projects / linux-block.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
Merge tag 'v6.6-p5' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6
[linux-block.git] / net / bluetooth / hci_sync.c
CommitLineData
6a98e383
MH		 1// SPDX-License-Identifier: GPL-2.0
2/*
3 * BlueZ - Bluetooth protocol stack for Linux
4 *
5 * Copyright (C) 2021 Intel Corporation
6a42e9bf 6 * Copyright 2023 NXP
6a98e383
MH		 7 */
8
d0b13706
LAD		 9#include <linux/property.h>
10
6a98e383
MH		 11#include <net/bluetooth/bluetooth.h>
12#include <net/bluetooth/hci_core.h>
13#include <net/bluetooth/mgmt.h>
14
15#include "hci_request.h"
828cea2b 16#include "hci_codec.h"
d0b13706 17#include "hci_debugfs.h"
6a98e383 18#include "smp.h"
161510cc 19#include "eir.h"
d0b13706
LAD		 20#include "msft.h"
21#include "aosp.h"
22#include "leds.h"
6a98e383
MH		 23
24static void hci_cmd_sync_complete(struct hci_dev *hdev, u8 result, u16 opcode,
25 struct sk_buff *skb)
26{
27 bt_dev_dbg(hdev, "result 0x%2.2x", result);
28
29 if (hdev->req_status != HCI_REQ_PEND)
30 return;
31
32 hdev->req_result = result;
33 hdev->req_status = HCI_REQ_DONE;
34
cba6b758
LAD		 35 if (skb) {
36 struct sock *sk = hci_skb_sk(skb);
37
38 /* Drop sk reference if set */
39 if (sk)
40 sock_put(sk);
41
42 hdev->req_skb = skb_get(skb);
43 }
44
6a98e383
MH		 45 wake_up_interruptible(&hdev->req_wait_q);
46}
47
48static struct sk_buff *hci_cmd_sync_alloc(struct hci_dev *hdev, u16 opcode,
49 u32 plen, const void *param,
50 struct sock *sk)
51{
52 int len = HCI_COMMAND_HDR_SIZE + plen;
53 struct hci_command_hdr *hdr;
54 struct sk_buff *skb;
55
56 skb = bt_skb_alloc(len, GFP_ATOMIC);
57 if (!skb)
58 return NULL;
59
60 hdr = skb_put(skb, HCI_COMMAND_HDR_SIZE);
61 hdr->opcode = cpu_to_le16(opcode);
62 hdr->plen = plen;
63
64 if (plen)
65 skb_put_data(skb, param, plen);
66
67 bt_dev_dbg(hdev, "skb len %d", skb->len);
68
69 hci_skb_pkt_type(skb) = HCI_COMMAND_PKT;
70 hci_skb_opcode(skb) = opcode;
71
cba6b758
LAD		 72 /* Grab a reference if command needs to be associated with a sock (e.g.
73 * likely mgmt socket that initiated the command).
74 */
75 if (sk) {
76 hci_skb_sk(skb) = sk;
77 sock_hold(sk);
78 }
79
6a98e383
MH		 80 return skb;
81}
82
83static void hci_cmd_sync_add(struct hci_request *req, u16 opcode, u32 plen,
84 const void *param, u8 event, struct sock *sk)
85{
86 struct hci_dev *hdev = req->hdev;
87 struct sk_buff *skb;
88
89 bt_dev_dbg(hdev, "opcode 0x%4.4x plen %d", opcode, plen);
90
91 /* If an error occurred during request building, there is no point in
92 * queueing the HCI command. We can simply return.
93 */
94 if (req->err)
95 return;
96
97 skb = hci_cmd_sync_alloc(hdev, opcode, plen, param, sk);
98 if (!skb) {
99 bt_dev_err(hdev, "no memory for command (opcode 0x%4.4x)",
100 opcode);
101 req->err = -ENOMEM;
102 return;
103 }
104
105 if (skb_queue_empty(&req->cmd_q))
106 bt_cb(skb)->hci.req_flags |= HCI_REQ_START;
107
85b56857 108 hci_skb_event(skb) = event;
6a98e383
MH		 109
110 skb_queue_tail(&req->cmd_q, skb);
111}
112
113static int hci_cmd_sync_run(struct hci_request *req)
114{
115 struct hci_dev *hdev = req->hdev;
116 struct sk_buff *skb;
117 unsigned long flags;
118
119 bt_dev_dbg(hdev, "length %u", skb_queue_len(&req->cmd_q));
120
121 /* If an error occurred during request building, remove all HCI
122 * commands queued on the HCI request queue.
123 */
124 if (req->err) {
125 skb_queue_purge(&req->cmd_q);
126 return req->err;
127 }
128
129 /* Do not allow empty requests */
130 if (skb_queue_empty(&req->cmd_q))
131 return -ENODATA;
132
133 skb = skb_peek_tail(&req->cmd_q);
134 bt_cb(skb)->hci.req_complete_skb = hci_cmd_sync_complete;
135 bt_cb(skb)->hci.req_flags |= HCI_REQ_SKB;
136
137 spin_lock_irqsave(&hdev->cmd_q.lock, flags);
138 skb_queue_splice_tail(&req->cmd_q, &hdev->cmd_q);
139 spin_unlock_irqrestore(&hdev->cmd_q.lock, flags);
140
141 queue_work(hdev->workqueue, &hdev->cmd_work);
142
143 return 0;
144}
145
146/* This function requires the caller holds hdev->req_lock. */
147struct sk_buff *__hci_cmd_sync_sk(struct hci_dev *hdev, u16 opcode, u32 plen,
148 const void *param, u8 event, u32 timeout,
149 struct sock *sk)
150{
151 struct hci_request req;
152 struct sk_buff *skb;
153 int err = 0;
154
d0b13706 155 bt_dev_dbg(hdev, "Opcode 0x%4x", opcode);
6a98e383
MH		 156
157 hci_req_init(&req, hdev);
158
159 hci_cmd_sync_add(&req, opcode, plen, param, event, sk);
160
161 hdev->req_status = HCI_REQ_PEND;
162
163 err = hci_cmd_sync_run(&req);
164 if (err < 0)
165 return ERR_PTR(err);
166
167 err = wait_event_interruptible_timeout(hdev->req_wait_q,
168 hdev->req_status != HCI_REQ_PEND,
169 timeout);
170
171 if (err == -ERESTARTSYS)
172 return ERR_PTR(-EINTR);
173
174 switch (hdev->req_status) {
175 case HCI_REQ_DONE:
176 err = -bt_to_errno(hdev->req_result);
177 break;
178
179 case HCI_REQ_CANCELED:
180 err = -hdev->req_result;
181 break;
182
183 default:
184 err = -ETIMEDOUT;
185 break;
186 }
187
188 hdev->req_status = 0;
189 hdev->req_result = 0;
190 skb = hdev->req_skb;
191 hdev->req_skb = NULL;
192
193 bt_dev_dbg(hdev, "end: err %d", err);
194
195 if (err < 0) {
196 kfree_skb(skb);
197 return ERR_PTR(err);
198 }
199
6a98e383
MH		 200 return skb;
201}
202EXPORT_SYMBOL(__hci_cmd_sync_sk);
203
204/* This function requires the caller holds hdev->req_lock. */
205struct sk_buff *__hci_cmd_sync(struct hci_dev *hdev, u16 opcode, u32 plen,
206 const void *param, u32 timeout)
207{
208 return __hci_cmd_sync_sk(hdev, opcode, plen, param, 0, timeout, NULL);
209}
210EXPORT_SYMBOL(__hci_cmd_sync);
211
212/* Send HCI command and wait for command complete event */
213struct sk_buff *hci_cmd_sync(struct hci_dev *hdev, u16 opcode, u32 plen,
214 const void *param, u32 timeout)
215{
216 struct sk_buff *skb;
217
218 if (!test_bit(HCI_UP, &hdev->flags))
219 return ERR_PTR(-ENETDOWN);
220
221 bt_dev_dbg(hdev, "opcode 0x%4.4x plen %d", opcode, plen);
222
223 hci_req_sync_lock(hdev);
224 skb = __hci_cmd_sync(hdev, opcode, plen, param, timeout);
225 hci_req_sync_unlock(hdev);
226
227 return skb;
228}
229EXPORT_SYMBOL(hci_cmd_sync);
230
231/* This function requires the caller holds hdev->req_lock. */
232struct sk_buff *__hci_cmd_sync_ev(struct hci_dev *hdev, u16 opcode, u32 plen,
233 const void *param, u8 event, u32 timeout)
234{
235 return __hci_cmd_sync_sk(hdev, opcode, plen, param, event, timeout,
236 NULL);
237}
238EXPORT_SYMBOL(__hci_cmd_sync_ev);
239
240/* This function requires the caller holds hdev->req_lock. */
241int __hci_cmd_sync_status_sk(struct hci_dev *hdev, u16 opcode, u32 plen,
242 const void *param, u8 event, u32 timeout,
243 struct sock *sk)
244{
245 struct sk_buff *skb;
246 u8 status;
247
248 skb = __hci_cmd_sync_sk(hdev, opcode, plen, param, event, timeout, sk);
abfeea47 249 if (IS_ERR(skb)) {
b62e7220
LAD		 250 if (!event)
251 bt_dev_err(hdev, "Opcode 0x%4x failed: %ld", opcode,
252 PTR_ERR(skb));
6a98e383
MH		 253 return PTR_ERR(skb);
254 }
255
abfeea47
LAD		 256 /* If command return a status event skb will be set to NULL as there are
257 * no parameters, in case of failure IS_ERR(skb) would have be set to
258 * the actual error would be found with PTR_ERR(skb).
259 */
260 if (!skb)
261 return 0;
262
6a98e383
MH		 263 status = skb->data[0];
264
265 kfree_skb(skb);
266
267 return status;
268}
269EXPORT_SYMBOL(__hci_cmd_sync_status_sk);
270
271int __hci_cmd_sync_status(struct hci_dev *hdev, u16 opcode, u32 plen,
272 const void *param, u32 timeout)
273{
274 return __hci_cmd_sync_status_sk(hdev, opcode, plen, param, 0, timeout,
275 NULL);
276}
277EXPORT_SYMBOL(__hci_cmd_sync_status);
278
279static void hci_cmd_sync_work(struct work_struct *work)
280{
281 struct hci_dev *hdev = container_of(work, struct hci_dev, cmd_sync_work);
6a98e383
MH		 282
283 bt_dev_dbg(hdev, "");
284
008ee9eb
LAD		 285 /* Dequeue all entries and run them */
286 while (1) {
287 struct hci_cmd_sync_work_entry *entry;
6a98e383 288
008ee9eb
LAD		 289 mutex_lock(&hdev->cmd_sync_work_lock);
290 entry = list_first_entry_or_null(&hdev->cmd_sync_work_list,
291 struct hci_cmd_sync_work_entry,
292 list);
293 if (entry)
294 list_del(&entry->list);
295 mutex_unlock(&hdev->cmd_sync_work_lock);
6a98e383 296
008ee9eb
LAD		 297 if (!entry)
298 break;
6a98e383 299
008ee9eb 300 bt_dev_dbg(hdev, "entry %p", entry);
6a98e383 301
008ee9eb
LAD		 302 if (entry->func) {
303 int err;
6a98e383 304
008ee9eb
LAD		 305 hci_req_sync_lock(hdev);
306 err = entry->func(hdev, entry->data);
307 if (entry->destroy)
308 entry->destroy(hdev, entry->data, err);
309 hci_req_sync_unlock(hdev);
310 }
311
312 kfree(entry);
6a98e383
MH		 313 }
314}
315
744451c1
BB		 316static void hci_cmd_sync_cancel_work(struct work_struct *work)
317{
318 struct hci_dev *hdev = container_of(work, struct hci_dev, cmd_sync_cancel_work);
319
320 cancel_delayed_work_sync(&hdev->cmd_timer);
321 cancel_delayed_work_sync(&hdev->ncmd_timer);
322 atomic_set(&hdev->cmd_cnt, 1);
323
324 wake_up_interruptible(&hdev->req_wait_q);
325}
326
8ffde2a7
BG		 327static int hci_scan_disable_sync(struct hci_dev *hdev);
328static int scan_disable_sync(struct hci_dev *hdev, void *data)
329{
330 return hci_scan_disable_sync(hdev);
331}
332
333static int hci_inquiry_sync(struct hci_dev *hdev, u8 length);
334static int interleaved_inquiry_sync(struct hci_dev *hdev, void *data)
335{
336 return hci_inquiry_sync(hdev, DISCOV_INTERLEAVED_INQUIRY_LEN);
337}
338
339static void le_scan_disable(struct work_struct *work)
340{
341 struct hci_dev *hdev = container_of(work, struct hci_dev,
342 le_scan_disable.work);
343 int status;
344
345 bt_dev_dbg(hdev, "");
346 hci_dev_lock(hdev);
347
348 if (!hci_dev_test_flag(hdev, HCI_LE_SCAN))
349 goto _return;
350
351 cancel_delayed_work(&hdev->le_scan_restart);
352
353 status = hci_cmd_sync_queue(hdev, scan_disable_sync, NULL, NULL);
354 if (status) {
355 bt_dev_err(hdev, "failed to disable LE scan: %d", status);
356 goto _return;
357 }
358
359 hdev->discovery.scan_start = 0;
360
361 /* If we were running LE only scan, change discovery state. If
362 * we were running both LE and BR/EDR inquiry simultaneously,
363 * and BR/EDR inquiry is already finished, stop discovery,
364 * otherwise BR/EDR inquiry will stop discovery when finished.
365 * If we will resolve remote device name, do not change
366 * discovery state.
367 */
368
369 if (hdev->discovery.type == DISCOV_TYPE_LE)
370 goto discov_stopped;
371
372 if (hdev->discovery.type != DISCOV_TYPE_INTERLEAVED)
373 goto _return;
374
375 if (test_bit(HCI_QUIRK_SIMULTANEOUS_DISCOVERY, &hdev->quirks)) {
376 if (!test_bit(HCI_INQUIRY, &hdev->flags) &&
377 hdev->discovery.state != DISCOVERY_RESOLVING)
378 goto discov_stopped;
379
380 goto _return;
381 }
382
383 status = hci_cmd_sync_queue(hdev, interleaved_inquiry_sync, NULL, NULL);
384 if (status) {
385 bt_dev_err(hdev, "inquiry failed: status %d", status);
386 goto discov_stopped;
387 }
388
389 goto _return;
390
391discov_stopped:
392 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
393
394_return:
395 hci_dev_unlock(hdev);
396}
397
27d54b77
BG		 398static int hci_le_set_scan_enable_sync(struct hci_dev *hdev, u8 val,
399 u8 filter_dup);
400static int hci_le_scan_restart_sync(struct hci_dev *hdev)
401{
402 /* If controller is not scanning we are done. */
403 if (!hci_dev_test_flag(hdev, HCI_LE_SCAN))
404 return 0;
405
406 if (hdev->scanning_paused) {
407 bt_dev_dbg(hdev, "Scanning is paused for suspend");
408 return 0;
409 }
410
411 hci_le_set_scan_enable_sync(hdev, LE_SCAN_DISABLE, 0x00);
412 return hci_le_set_scan_enable_sync(hdev, LE_SCAN_ENABLE,
413 LE_SCAN_FILTER_DUP_ENABLE);
414}
415
27d54b77
BG		 416static void le_scan_restart(struct work_struct *work)
417{
418 struct hci_dev *hdev = container_of(work, struct hci_dev,
419 le_scan_restart.work);
420 unsigned long timeout, duration, scan_start, now;
421 int status;
422
423 bt_dev_dbg(hdev, "");
424
941c998b 425 status = hci_le_scan_restart_sync(hdev);
27d54b77
BG		 426 if (status) {
427 bt_dev_err(hdev, "failed to restart LE scan: status %d",
428 status);
941c998b 429 return;
27d54b77
BG		 430 }
431
941c998b
LAD		 432 hci_dev_lock(hdev);
433
27d54b77
BG		 434 if (!test_bit(HCI_QUIRK_STRICT_DUPLICATE_FILTER, &hdev->quirks) ||
435 !hdev->discovery.scan_start)
436 goto unlock;
437
438 /* When the scan was started, hdev->le_scan_disable has been queued
439 * after duration from scan_start. During scan restart this job
440 * has been canceled, and we need to queue it again after proper
441 * timeout, to make sure that scan does not run indefinitely.
442 */
443 duration = hdev->discovery.scan_duration;
444 scan_start = hdev->discovery.scan_start;
445 now = jiffies;
446 if (now - scan_start <= duration) {
447 int elapsed;
448
449 if (now >= scan_start)
450 elapsed = now - scan_start;
451 else
452 elapsed = ULONG_MAX - scan_start + now;
453
454 timeout = duration - elapsed;
455 } else {
456 timeout = 0;
457 }
458
459 queue_delayed_work(hdev->req_workqueue,
460 &hdev->le_scan_disable, timeout);
461
462unlock:
463 hci_dev_unlock(hdev);
464}
465
b338d917
BG		 466static int reenable_adv_sync(struct hci_dev *hdev, void *data)
467{
468 bt_dev_dbg(hdev, "");
469
470 if (!hci_dev_test_flag(hdev, HCI_ADVERTISING) &&
471 list_empty(&hdev->adv_instances))
472 return 0;
473
474 if (hdev->cur_adv_instance) {
475 return hci_schedule_adv_instance_sync(hdev,
476 hdev->cur_adv_instance,
477 true);
478 } else {
479 if (ext_adv_capable(hdev)) {
480 hci_start_ext_adv_sync(hdev, 0x00);
481 } else {
482 hci_update_adv_data_sync(hdev, 0x00);
483 hci_update_scan_rsp_data_sync(hdev, 0x00);
484 hci_enable_advertising_sync(hdev);
485 }
486 }
487
488 return 0;
489}
490
491static void reenable_adv(struct work_struct *work)
492{
493 struct hci_dev *hdev = container_of(work, struct hci_dev,
494 reenable_adv_work);
495 int status;
496
497 bt_dev_dbg(hdev, "");
498
499 hci_dev_lock(hdev);
500
501 status = hci_cmd_sync_queue(hdev, reenable_adv_sync, NULL, NULL);
502 if (status)
503 bt_dev_err(hdev, "failed to reenable ADV: %d", status);
504
505 hci_dev_unlock(hdev);
506}
507
c249ea9b
BG		 508static void cancel_adv_timeout(struct hci_dev *hdev)
509{
510 if (hdev->adv_instance_timeout) {
511 hdev->adv_instance_timeout = 0;
512 cancel_delayed_work(&hdev->adv_instance_expire);
513 }
514}
515
516/* For a single instance:
517 * - force == true: The instance will be removed even when its remaining
518 * lifetime is not zero.
519 * - force == false: the instance will be deactivated but kept stored unless
520 * the remaining lifetime is zero.
521 *
522 * For instance == 0x00:
523 * - force == true: All instances will be removed regardless of their timeout
524 * setting.
525 * - force == false: Only instances that have a timeout will be removed.
526 */
527int hci_clear_adv_instance_sync(struct hci_dev *hdev, struct sock *sk,
528 u8 instance, bool force)
529{
530 struct adv_info *adv_instance, *n, *next_instance = NULL;
531 int err;
532 u8 rem_inst;
533
534 /* Cancel any timeout concerning the removed instance(s). */
535 if (!instance || hdev->cur_adv_instance == instance)
536 cancel_adv_timeout(hdev);
537
538 /* Get the next instance to advertise BEFORE we remove
539 * the current one. This can be the same instance again
540 * if there is only one instance.
541 */
542 if (instance && hdev->cur_adv_instance == instance)
543 next_instance = hci_get_next_instance(hdev, instance);
544
545 if (instance == 0x00) {
546 list_for_each_entry_safe(adv_instance, n, &hdev->adv_instances,
547 list) {
548 if (!(force || adv_instance->timeout))
549 continue;
550
551 rem_inst = adv_instance->instance;
552 err = hci_remove_adv_instance(hdev, rem_inst);
553 if (!err)
554 mgmt_advertising_removed(sk, hdev, rem_inst);
555 }
556 } else {
557 adv_instance = hci_find_adv_instance(hdev, instance);
558
559 if (force || (adv_instance && adv_instance->timeout &&
560 !adv_instance->remaining_time)) {
561 /* Don't advertise a removed instance. */
562 if (next_instance &&
563 next_instance->instance == instance)
564 next_instance = NULL;
565
566 err = hci_remove_adv_instance(hdev, instance);
567 if (!err)
568 mgmt_advertising_removed(sk, hdev, instance);
569 }
570 }
571
572 if (!hdev_is_powered(hdev) || hci_dev_test_flag(hdev, HCI_ADVERTISING))
573 return 0;
574
575 if (next_instance && !ext_adv_capable(hdev))
576 return hci_schedule_adv_instance_sync(hdev,
577 next_instance->instance,
578 false);
579
580 return 0;
581}
582
583static int adv_timeout_expire_sync(struct hci_dev *hdev, void *data)
584{
585 u8 instance = *(u8 *)data;
586
587 kfree(data);
588
589 hci_clear_adv_instance_sync(hdev, NULL, instance, false);
590
591 if (list_empty(&hdev->adv_instances))
592 return hci_disable_advertising_sync(hdev);
593
594 return 0;
595}
596
597static void adv_timeout_expire(struct work_struct *work)
598{
599 u8 *inst_ptr;
600 struct hci_dev *hdev = container_of(work, struct hci_dev,
601 adv_instance_expire.work);
602
603 bt_dev_dbg(hdev, "");
604
605 hci_dev_lock(hdev);
606
607 hdev->adv_instance_timeout = 0;
608
609 if (hdev->cur_adv_instance == 0x00)
610 goto unlock;
611
612 inst_ptr = kmalloc(1, GFP_KERNEL);
613 if (!inst_ptr)
614 goto unlock;
615
616 *inst_ptr = hdev->cur_adv_instance;
617 hci_cmd_sync_queue(hdev, adv_timeout_expire_sync, inst_ptr, NULL);
618
619unlock:
620 hci_dev_unlock(hdev);
621}
622
6a98e383
MH		 623void hci_cmd_sync_init(struct hci_dev *hdev)
624{
625 INIT_WORK(&hdev->cmd_sync_work, hci_cmd_sync_work);
626 INIT_LIST_HEAD(&hdev->cmd_sync_work_list);
627 mutex_init(&hdev->cmd_sync_work_lock);
1857c199 628 mutex_init(&hdev->unregister_lock);
744451c1
BB		 629
630 INIT_WORK(&hdev->cmd_sync_cancel_work, hci_cmd_sync_cancel_work);
b338d917 631 INIT_WORK(&hdev->reenable_adv_work, reenable_adv);
8ffde2a7 632 INIT_DELAYED_WORK(&hdev->le_scan_disable, le_scan_disable);
27d54b77 633 INIT_DELAYED_WORK(&hdev->le_scan_restart, le_scan_restart);
c249ea9b 634 INIT_DELAYED_WORK(&hdev->adv_instance_expire, adv_timeout_expire);
6a98e383
MH		 635}
636
637void hci_cmd_sync_clear(struct hci_dev *hdev)
638{
639 struct hci_cmd_sync_work_entry *entry, *tmp;
640
641 cancel_work_sync(&hdev->cmd_sync_work);
b338d917 642 cancel_work_sync(&hdev->reenable_adv_work);
6a98e383 643
1c66bee4 644 mutex_lock(&hdev->cmd_sync_work_lock);
6a98e383
MH		 645 list_for_each_entry_safe(entry, tmp, &hdev->cmd_sync_work_list, list) {
646 if (entry->destroy)
647 entry->destroy(hdev, entry->data, -ECANCELED);
648
649 list_del(&entry->list);
650 kfree(entry);
651 }
1c66bee4 652 mutex_unlock(&hdev->cmd_sync_work_lock);
6a98e383
MH		 653}
654
744451c1 655void __hci_cmd_sync_cancel(struct hci_dev *hdev, int err)
914b08b3
BB		 656{
657 bt_dev_dbg(hdev, "err 0x%2.2x", err);
658
659 if (hdev->req_status == HCI_REQ_PEND) {
660 hdev->req_result = err;
661 hdev->req_status = HCI_REQ_CANCELED;
662
663 cancel_delayed_work_sync(&hdev->cmd_timer);
664 cancel_delayed_work_sync(&hdev->ncmd_timer);
665 atomic_set(&hdev->cmd_cnt, 1);
666
667 wake_up_interruptible(&hdev->req_wait_q);
668 }
669}
744451c1
BB		 670
671void hci_cmd_sync_cancel(struct hci_dev *hdev, int err)
672{
673 bt_dev_dbg(hdev, "err 0x%2.2x", err);
674
675 if (hdev->req_status == HCI_REQ_PEND) {
676 hdev->req_result = err;
677 hdev->req_status = HCI_REQ_CANCELED;
678
679 queue_work(hdev->workqueue, &hdev->cmd_sync_cancel_work);
680 }
681}
914b08b3
BB		 682EXPORT_SYMBOL(hci_cmd_sync_cancel);
683
d883a466
LAD		 684/* Submit HCI command to be run in as cmd_sync_work:
685 *
686 * - hdev must _not_ be unregistered
687 */
688int hci_cmd_sync_submit(struct hci_dev *hdev, hci_cmd_sync_work_func_t func,
689 void *data, hci_cmd_sync_work_destroy_t destroy)
6a98e383
MH		 690{
691 struct hci_cmd_sync_work_entry *entry;
1857c199 692 int err = 0;
6a98e383 693
1857c199
ZJ		 694 mutex_lock(&hdev->unregister_lock);
695 if (hci_dev_test_flag(hdev, HCI_UNREGISTER)) {
696 err = -ENODEV;
697 goto unlock;
698 }
0b94f265 699
6a98e383 700 entry = kmalloc(sizeof(*entry), GFP_KERNEL);
1857c199
ZJ		 701 if (!entry) {
702 err = -ENOMEM;
703 goto unlock;
704 }
6a98e383
MH		 705 entry->func = func;
706 entry->data = data;
707 entry->destroy = destroy;
708
709 mutex_lock(&hdev->cmd_sync_work_lock);
710 list_add_tail(&entry->list, &hdev->cmd_sync_work_list);
711 mutex_unlock(&hdev->cmd_sync_work_lock);
712
713 queue_work(hdev->req_workqueue, &hdev->cmd_sync_work);
714
1857c199
ZJ		 715unlock:
716 mutex_unlock(&hdev->unregister_lock);
717 return err;
6a98e383 718}
d883a466
LAD		 719EXPORT_SYMBOL(hci_cmd_sync_submit);
720
721/* Queue HCI command:
722 *
723 * - hdev must be running
724 */
725int hci_cmd_sync_queue(struct hci_dev *hdev, hci_cmd_sync_work_func_t func,
726 void *data, hci_cmd_sync_work_destroy_t destroy)
727{
728 /* Only queue command if hdev is running which means it had been opened
729 * and is either on init phase or is already up.
730 */
731 if (!test_bit(HCI_RUNNING, &hdev->flags))
732 return -ENETDOWN;
733
734 return hci_cmd_sync_submit(hdev, func, data, destroy);
735}
6a98e383 736EXPORT_SYMBOL(hci_cmd_sync_queue);
161510cc
LAD		 737
738int hci_update_eir_sync(struct hci_dev *hdev)
739{
740 struct hci_cp_write_eir cp;
741
742 bt_dev_dbg(hdev, "");
743
744 if (!hdev_is_powered(hdev))
745 return 0;
746
747 if (!lmp_ext_inq_capable(hdev))
748 return 0;
749
750 if (!hci_dev_test_flag(hdev, HCI_SSP_ENABLED))
751 return 0;
752
753 if (hci_dev_test_flag(hdev, HCI_SERVICE_CACHE))
754 return 0;
755
756 memset(&cp, 0, sizeof(cp));
757
758 eir_create(hdev, cp.data);
759
760 if (memcmp(cp.data, hdev->eir, sizeof(cp.data)) == 0)
761 return 0;
762
763 memcpy(hdev->eir, cp.data, sizeof(cp.data));
764
765 return __hci_cmd_sync_status(hdev, HCI_OP_WRITE_EIR, sizeof(cp), &cp,
766 HCI_CMD_TIMEOUT);
767}
768
769static u8 get_service_classes(struct hci_dev *hdev)
770{
771 struct bt_uuid *uuid;
772 u8 val = 0;
773
774 list_for_each_entry(uuid, &hdev->uuids, list)
775 val |= uuid->svc_hint;
776
777 return val;
778}
779
780int hci_update_class_sync(struct hci_dev *hdev)
781{
782 u8 cod[3];
783
784 bt_dev_dbg(hdev, "");
785
786 if (!hdev_is_powered(hdev))
787 return 0;
788
789 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
790 return 0;
791
792 if (hci_dev_test_flag(hdev, HCI_SERVICE_CACHE))
793 return 0;
794
795 cod[0] = hdev->minor_class;
796 cod[1] = hdev->major_class;
797 cod[2] = get_service_classes(hdev);
798
799 if (hci_dev_test_flag(hdev, HCI_LIMITED_DISCOVERABLE))
800 cod[1] |= 0x20;
801
802 if (memcmp(cod, hdev->dev_class, 3) == 0)
803 return 0;
804
805 return __hci_cmd_sync_status(hdev, HCI_OP_WRITE_CLASS_OF_DEV,
806 sizeof(cod), cod, HCI_CMD_TIMEOUT);
807}
cba6b758
LAD		 808
809static bool is_advertising_allowed(struct hci_dev *hdev, bool connectable)
810{
811 /* If there is no connection we are OK to advertise. */
812 if (hci_conn_num(hdev, LE_LINK) == 0)
813 return true;
814
815 /* Check le_states if there is any connection in peripheral role. */
816 if (hdev->conn_hash.le_num_peripheral > 0) {
817 /* Peripheral connection state and non connectable mode
818 * bit 20.
819 */
820 if (!connectable && !(hdev->le_states[2] & 0x10))
821 return false;
822
823 /* Peripheral connection state and connectable mode bit 38
824 * and scannable bit 21.
825 */
826 if (connectable && (!(hdev->le_states[4] & 0x40) ||
827 !(hdev->le_states[2] & 0x20)))
828 return false;
829 }
830
831 /* Check le_states if there is any connection in central role. */
832 if (hci_conn_num(hdev, LE_LINK) != hdev->conn_hash.le_num_peripheral) {
833 /* Central connection state and non connectable mode bit 18. */
834 if (!connectable && !(hdev->le_states[2] & 0x02))
835 return false;
836
837 /* Central connection state and connectable mode bit 35 and
838 * scannable 19.
839 */
840 if (connectable && (!(hdev->le_states[4] & 0x08) ||
841 !(hdev->le_states[2] & 0x08)))
842 return false;
843 }
844
845 return true;
846}
847
848static bool adv_use_rpa(struct hci_dev *hdev, uint32_t flags)
849{
850 /* If privacy is not enabled don't use RPA */
851 if (!hci_dev_test_flag(hdev, HCI_PRIVACY))
852 return false;
853
854 /* If basic privacy mode is enabled use RPA */
855 if (!hci_dev_test_flag(hdev, HCI_LIMITED_PRIVACY))
856 return true;
857
858 /* If limited privacy mode is enabled don't use RPA if we're
859 * both discoverable and bondable.
860 */
861 if ((flags & MGMT_ADV_FLAG_DISCOV) &&
862 hci_dev_test_flag(hdev, HCI_BONDABLE))
863 return false;
864
865 /* We're neither bondable nor discoverable in the limited
866 * privacy mode, therefore use RPA.
867 */
868 return true;
869}
870
871static int hci_set_random_addr_sync(struct hci_dev *hdev, bdaddr_t *rpa)
872{
873 /* If we're advertising or initiating an LE connection we can't
874 * go ahead and change the random address at this time. This is
875 * because the eventual initiator address used for the
876 * subsequently created connection will be undefined (some
877 * controllers use the new address and others the one we had
878 * when the operation started).
879 *
880 * In this kind of scenario skip the update and let the random
881 * address be updated at the next cycle.
882 */
883 if (hci_dev_test_flag(hdev, HCI_LE_ADV) ||
884 hci_lookup_le_connect(hdev)) {
885 bt_dev_dbg(hdev, "Deferring random address update");
886 hci_dev_set_flag(hdev, HCI_RPA_EXPIRED);
887 return 0;
888 }
889
890 return __hci_cmd_sync_status(hdev, HCI_OP_LE_SET_RANDOM_ADDR,
891 6, rpa, HCI_CMD_TIMEOUT);
892}
893
894int hci_update_random_address_sync(struct hci_dev *hdev, bool require_privacy,
895 bool rpa, u8 *own_addr_type)
896{
897 int err;
898
899 /* If privacy is enabled use a resolvable private address. If
900 * current RPA has expired or there is something else than
901 * the current RPA in use, then generate a new one.
902 */
903 if (rpa) {
904 /* If Controller supports LL Privacy use own address type is
905 * 0x03
906 */
ad383c2c 907 if (use_ll_privacy(hdev))
cba6b758
LAD		 908 *own_addr_type = ADDR_LE_DEV_RANDOM_RESOLVED;
909 else
910 *own_addr_type = ADDR_LE_DEV_RANDOM;
911
912 /* Check if RPA is valid */
913 if (rpa_valid(hdev))
914 return 0;
915
916 err = smp_generate_rpa(hdev, hdev->irk, &hdev->rpa);
917 if (err < 0) {
918 bt_dev_err(hdev, "failed to generate new RPA");
919 return err;
920 }
921
922 err = hci_set_random_addr_sync(hdev, &hdev->rpa);
923 if (err)
924 return err;
925
926 return 0;
927 }
928
929 /* In case of required privacy without resolvable private address,
930 * use an non-resolvable private address. This is useful for active
931 * scanning and non-connectable advertising.
932 */
933 if (require_privacy) {
934 bdaddr_t nrpa;
935
936 while (true) {
937 /* The non-resolvable private address is generated
938 * from random six bytes with the two most significant
939 * bits cleared.
940 */
941 get_random_bytes(&nrpa, 6);
942 nrpa.b[5] &= 0x3f;
943
944 /* The non-resolvable private address shall not be
945 * equal to the public address.
946 */
947 if (bacmp(&hdev->bdaddr, &nrpa))
948 break;
949 }
950
951 *own_addr_type = ADDR_LE_DEV_RANDOM;
952
953 return hci_set_random_addr_sync(hdev, &nrpa);
954 }
955
956 /* If forcing static address is in use or there is no public
957 * address use the static address as random address (but skip
958 * the HCI command if the current random address is already the
959 * static one.
960 *
961 * In case BR/EDR has been disabled on a dual-mode controller
962 * and a static address has been configured, then use that
963 * address instead of the public BR/EDR address.
964 */
965 if (hci_dev_test_flag(hdev, HCI_FORCE_STATIC_ADDR) ||
966 !bacmp(&hdev->bdaddr, BDADDR_ANY) ||
967 (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) &&
968 bacmp(&hdev->static_addr, BDADDR_ANY))) {
969 *own_addr_type = ADDR_LE_DEV_RANDOM;
970 if (bacmp(&hdev->static_addr, &hdev->random_addr))
971 return hci_set_random_addr_sync(hdev,
972 &hdev->static_addr);
973 return 0;
974 }
975
976 /* Neither privacy nor static address is being used so use a
977 * public address.
978 */
979 *own_addr_type = ADDR_LE_DEV_PUBLIC;
980
981 return 0;
982}
983
984static int hci_disable_ext_adv_instance_sync(struct hci_dev *hdev, u8 instance)
985{
986 struct hci_cp_le_set_ext_adv_enable *cp;
987 struct hci_cp_ext_adv_set *set;
988 u8 data[sizeof(*cp) + sizeof(*set) * 1];
989 u8 size;
990
991 /* If request specifies an instance that doesn't exist, fail */
992 if (instance > 0) {
993 struct adv_info *adv;
994
995 adv = hci_find_adv_instance(hdev, instance);
996 if (!adv)
997 return -EINVAL;
998
999 /* If not enabled there is nothing to do */
1000 if (!adv->enabled)
1001 return 0;
1002 }
1003
1004 memset(data, 0, sizeof(data));
1005
1006 cp = (void *)data;
1007 set = (void *)cp->data;
1008
1009 /* Instance 0x00 indicates all advertising instances will be disabled */
1010 cp->num_of_sets = !!instance;
1011 cp->enable = 0x00;
1012
1013 set->handle = instance;
1014
1015 size = sizeof(*cp) + sizeof(*set) * cp->num_of_sets;
1016
1017 return __hci_cmd_sync_status(hdev, HCI_OP_LE_SET_EXT_ADV_ENABLE,
1018 size, data, HCI_CMD_TIMEOUT);
1019}
1020
1021static int hci_set_adv_set_random_addr_sync(struct hci_dev *hdev, u8 instance,
1022 bdaddr_t *random_addr)
1023{
1024 struct hci_cp_le_set_adv_set_rand_addr cp;
1025 int err;
1026
1027 if (!instance) {
1028 /* Instance 0x00 doesn't have an adv_info, instead it uses
1029 * hdev->random_addr to track its address so whenever it needs
1030 * to be updated this also set the random address since
1031 * hdev->random_addr is shared with scan state machine.
1032 */
1033 err = hci_set_random_addr_sync(hdev, random_addr);
1034 if (err)
1035 return err;
1036 }
1037
1038 memset(&cp, 0, sizeof(cp));
1039
1040 cp.handle = instance;
1041 bacpy(&cp.bdaddr, random_addr);
1042
1043 return __hci_cmd_sync_status(hdev, HCI_OP_LE_SET_ADV_SET_RAND_ADDR,
1044 sizeof(cp), &cp, HCI_CMD_TIMEOUT);
1045}
1046
1047int hci_setup_ext_adv_instance_sync(struct hci_dev *hdev, u8 instance)
1048{
1049 struct hci_cp_le_set_ext_adv_params cp;
1050 bool connectable;
1051 u32 flags;
1052 bdaddr_t random_addr;
1053 u8 own_addr_type;
1054 int err;
1055 struct adv_info *adv;
1056 bool secondary_adv;
1057
1058 if (instance > 0) {
1059 adv = hci_find_adv_instance(hdev, instance);
1060 if (!adv)
1061 return -EINVAL;
1062 } else {
1063 adv = NULL;
1064 }
1065
1066 /* Updating parameters of an active instance will return a
1067 * Command Disallowed error, so we must first disable the
1068 * instance if it is active.
1069 */
1070 if (adv && !adv->pending) {
1071 err = hci_disable_ext_adv_instance_sync(hdev, instance);
1072 if (err)
1073 return err;
1074 }
1075
1076 flags = hci_adv_instance_flags(hdev, instance);
1077
1078 /* If the "connectable" instance flag was not set, then choose between
1079 * ADV_IND and ADV_NONCONN_IND based on the global connectable setting.
1080 */
1081 connectable = (flags & MGMT_ADV_FLAG_CONNECTABLE) ||
1082 mgmt_get_connectable(hdev);
1083
1084 if (!is_advertising_allowed(hdev, connectable))
1085 return -EPERM;
1086
1087 /* Set require_privacy to true only when non-connectable
1088 * advertising is used. In that case it is fine to use a
1089 * non-resolvable private address.
1090 */
1091 err = hci_get_random_address(hdev, !connectable,
1092 adv_use_rpa(hdev, flags), adv,
1093 &own_addr_type, &random_addr);
1094 if (err < 0)
1095 return err;
1096
1097 memset(&cp, 0, sizeof(cp));
1098
1099 if (adv) {
1100 hci_cpu_to_le24(adv->min_interval, cp.min_interval);
1101 hci_cpu_to_le24(adv->max_interval, cp.max_interval);
1102 cp.tx_power = adv->tx_power;
1103 } else {
1104 hci_cpu_to_le24(hdev->le_adv_min_interval, cp.min_interval);
1105 hci_cpu_to_le24(hdev->le_adv_max_interval, cp.max_interval);
1106 cp.tx_power = HCI_ADV_TX_POWER_NO_PREFERENCE;
1107 }
1108
1109 secondary_adv = (flags & MGMT_ADV_FLAG_SEC_MASK);
1110
1111 if (connectable) {
1112 if (secondary_adv)
1113 cp.evt_properties = cpu_to_le16(LE_EXT_ADV_CONN_IND);
1114 else
1115 cp.evt_properties = cpu_to_le16(LE_LEGACY_ADV_IND);
1116 } else if (hci_adv_instance_is_scannable(hdev, instance) ||
1117 (flags & MGMT_ADV_PARAM_SCAN_RSP)) {
1118 if (secondary_adv)
1119 cp.evt_properties = cpu_to_le16(LE_EXT_ADV_SCAN_IND);
1120 else
1121 cp.evt_properties = cpu_to_le16(LE_LEGACY_ADV_SCAN_IND);
1122 } else {
1123 if (secondary_adv)
1124 cp.evt_properties = cpu_to_le16(LE_EXT_ADV_NON_CONN_IND);
1125 else
1126 cp.evt_properties = cpu_to_le16(LE_LEGACY_NONCONN_IND);
1127 }
1128
cf75ad8b
LAD		 1129 /* If Own_Address_Type equals 0x02 or 0x03, the Peer_Address parameter
1130 * contains the peer’s Identity Address and the Peer_Address_Type
1131 * parameter contains the peer’s Identity Type (i.e., 0x00 or 0x01).
1132 * These parameters are used to locate the corresponding local IRK in
1133 * the resolving list; this IRK is used to generate their own address
1134 * used in the advertisement.
1135 */
1136 if (own_addr_type == ADDR_LE_DEV_RANDOM_RESOLVED)
1137 hci_copy_identity_address(hdev, &cp.peer_addr,
1138 &cp.peer_addr_type);
1139
cba6b758
LAD		 1140 cp.own_addr_type = own_addr_type;
1141 cp.channel_map = hdev->le_adv_channel_map;
1142 cp.handle = instance;
1143
1144 if (flags & MGMT_ADV_FLAG_SEC_2M) {
1145 cp.primary_phy = HCI_ADV_PHY_1M;
1146 cp.secondary_phy = HCI_ADV_PHY_2M;
1147 } else if (flags & MGMT_ADV_FLAG_SEC_CODED) {
1148 cp.primary_phy = HCI_ADV_PHY_CODED;
1149 cp.secondary_phy = HCI_ADV_PHY_CODED;
1150 } else {
1151 /* In all other cases use 1M */
1152 cp.primary_phy = HCI_ADV_PHY_1M;
1153 cp.secondary_phy = HCI_ADV_PHY_1M;
1154 }
1155
1156 err = __hci_cmd_sync_status(hdev, HCI_OP_LE_SET_EXT_ADV_PARAMS,
1157 sizeof(cp), &cp, HCI_CMD_TIMEOUT);
1158 if (err)
1159 return err;
1160
1161 if ((own_addr_type == ADDR_LE_DEV_RANDOM ||
1162 own_addr_type == ADDR_LE_DEV_RANDOM_RESOLVED) &&
1163 bacmp(&random_addr, BDADDR_ANY)) {
1164 /* Check if random address need to be updated */
1165 if (adv) {
1166 if (!bacmp(&random_addr, &adv->random_addr))
1167 return 0;
1168 } else {
1169 if (!bacmp(&random_addr, &hdev->random_addr))
1170 return 0;
1171 }
1172
1173 return hci_set_adv_set_random_addr_sync(hdev, instance,
1174 &random_addr);
1175 }
1176
1177 return 0;
1178}
1179
1180static int hci_set_ext_scan_rsp_data_sync(struct hci_dev *hdev, u8 instance)
1181{
1182 struct {
1183 struct hci_cp_le_set_ext_scan_rsp_data cp;
1184 u8 data[HCI_MAX_EXT_AD_LENGTH];
1185 } pdu;
1186 u8 len;
34a718bc
LAD		 1187 struct adv_info *adv = NULL;
1188 int err;
cba6b758
LAD		 1189
1190 memset(&pdu, 0, sizeof(pdu));
1191
34a718bc
LAD		 1192 if (instance) {
1193 adv = hci_find_adv_instance(hdev, instance);
1194 if (!adv || !adv->scan_rsp_changed)
1195 return 0;
1196 }
cba6b758 1197
34a718bc 1198 len = eir_create_scan_rsp(hdev, instance, pdu.data);
cba6b758
LAD		 1199
1200 pdu.cp.handle = instance;
1201 pdu.cp.length = len;
1202 pdu.cp.operation = LE_SET_ADV_DATA_OP_COMPLETE;
1203 pdu.cp.frag_pref = LE_SET_ADV_DATA_NO_FRAG;
1204
34a718bc
LAD		 1205 err = __hci_cmd_sync_status(hdev, HCI_OP_LE_SET_EXT_SCAN_RSP_DATA,
1206 sizeof(pdu.cp) + len, &pdu.cp,
1207 HCI_CMD_TIMEOUT);
1208 if (err)
1209 return err;
1210
1211 if (adv) {
1212 adv->scan_rsp_changed = false;
1213 } else {
1214 memcpy(hdev->scan_rsp_data, pdu.data, len);
1215 hdev->scan_rsp_data_len = len;
1216 }
1217
1218 return 0;
cba6b758
LAD		 1219}
1220
1221static int __hci_set_scan_rsp_data_sync(struct hci_dev *hdev, u8 instance)
1222{
1223 struct hci_cp_le_set_scan_rsp_data cp;
1224 u8 len;
1225
1226 memset(&cp, 0, sizeof(cp));
1227
1228 len = eir_create_scan_rsp(hdev, instance, cp.data);
1229
1230 if (hdev->scan_rsp_data_len == len &&
1231 !memcmp(cp.data, hdev->scan_rsp_data, len))
1232 return 0;
1233
1234 memcpy(hdev->scan_rsp_data, cp.data, sizeof(cp.data));
1235 hdev->scan_rsp_data_len = len;
1236
1237 cp.length = len;
1238
1239 return __hci_cmd_sync_status(hdev, HCI_OP_LE_SET_SCAN_RSP_DATA,
1240 sizeof(cp), &cp, HCI_CMD_TIMEOUT);
1241}
1242
1243int hci_update_scan_rsp_data_sync(struct hci_dev *hdev, u8 instance)
1244{
1245 if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED))
1246 return 0;
1247
1248 if (ext_adv_capable(hdev))
1249 return hci_set_ext_scan_rsp_data_sync(hdev, instance);
1250
1251 return __hci_set_scan_rsp_data_sync(hdev, instance);
1252}
1253
1254int hci_enable_ext_advertising_sync(struct hci_dev *hdev, u8 instance)
1255{
1256 struct hci_cp_le_set_ext_adv_enable *cp;
1257 struct hci_cp_ext_adv_set *set;
1258 u8 data[sizeof(*cp) + sizeof(*set) * 1];
1259 struct adv_info *adv;
1260
1261 if (instance > 0) {
1262 adv = hci_find_adv_instance(hdev, instance);
1263 if (!adv)
1264 return -EINVAL;
1265 /* If already enabled there is nothing to do */
1266 if (adv->enabled)
1267 return 0;
1268 } else {
1269 adv = NULL;
1270 }
1271
1272 cp = (void *)data;
1273 set = (void *)cp->data;
1274
1275 memset(cp, 0, sizeof(*cp));
1276
1277 cp->enable = 0x01;
1278 cp->num_of_sets = 0x01;
1279
1280 memset(set, 0, sizeof(*set));
1281
1282 set->handle = instance;
1283
1284 /* Set duration per instance since controller is responsible for
1285 * scheduling it.
1286 */
f16a491c 1287 if (adv && adv->timeout) {
cba6b758
LAD		 1288 u16 duration = adv->timeout * MSEC_PER_SEC;
1289
1290 /* Time = N * 10 ms */
1291 set->duration = cpu_to_le16(duration / 10);
1292 }
1293
1294 return __hci_cmd_sync_status(hdev, HCI_OP_LE_SET_EXT_ADV_ENABLE,
1295 sizeof(*cp) +
1296 sizeof(*set) * cp->num_of_sets,
1297 data, HCI_CMD_TIMEOUT);
1298}
1299
1300int hci_start_ext_adv_sync(struct hci_dev *hdev, u8 instance)
1301{
1302 int err;
1303
1304 err = hci_setup_ext_adv_instance_sync(hdev, instance);
1305 if (err)
1306 return err;
1307
1308 err = hci_set_ext_scan_rsp_data_sync(hdev, instance);
1309 if (err)
1310 return err;
1311
1312 return hci_enable_ext_advertising_sync(hdev, instance);
1313}
1314
eca0ae4a
LAD		 1315static int hci_disable_per_advertising_sync(struct hci_dev *hdev, u8 instance)
1316{
1317 struct hci_cp_le_set_per_adv_enable cp;
6a42e9bf 1318 struct adv_info *adv = NULL;
eca0ae4a
LAD		 1319
1320 /* If periodic advertising already disabled there is nothing to do. */
6a42e9bf
IT		 1321 adv = hci_find_adv_instance(hdev, instance);
1322 if (!adv || !adv->periodic || !adv->enabled)
eca0ae4a
LAD		 1323 return 0;
1324
1325 memset(&cp, 0, sizeof(cp));
1326
1327 cp.enable = 0x00;
1328 cp.handle = instance;
1329
1330 return __hci_cmd_sync_status(hdev, HCI_OP_LE_SET_PER_ADV_ENABLE,
1331 sizeof(cp), &cp, HCI_CMD_TIMEOUT);
1332}
1333
1334static int hci_set_per_adv_params_sync(struct hci_dev *hdev, u8 instance,
1335 u16 min_interval, u16 max_interval)
1336{
1337 struct hci_cp_le_set_per_adv_params cp;
1338
1339 memset(&cp, 0, sizeof(cp));
1340
1341 if (!min_interval)
1342 min_interval = DISCOV_LE_PER_ADV_INT_MIN;
1343
1344 if (!max_interval)
1345 max_interval = DISCOV_LE_PER_ADV_INT_MAX;
1346
1347 cp.handle = instance;
1348 cp.min_interval = cpu_to_le16(min_interval);
1349 cp.max_interval = cpu_to_le16(max_interval);
1350 cp.periodic_properties = 0x0000;
1351
1352 return __hci_cmd_sync_status(hdev, HCI_OP_LE_SET_PER_ADV_PARAMS,
1353 sizeof(cp), &cp, HCI_CMD_TIMEOUT);
1354}
1355
1356static int hci_set_per_adv_data_sync(struct hci_dev *hdev, u8 instance)
1357{
1358 struct {
1359 struct hci_cp_le_set_per_adv_data cp;
1360 u8 data[HCI_MAX_PER_AD_LENGTH];
1361 } pdu;
1362 u8 len;
1363
1364 memset(&pdu, 0, sizeof(pdu));
1365
1366 if (instance) {
1367 struct adv_info *adv = hci_find_adv_instance(hdev, instance);
1368
1369 if (!adv || !adv->periodic)
1370 return 0;
1371 }
1372
1373 len = eir_create_per_adv_data(hdev, instance, pdu.data);
1374
1375 pdu.cp.length = len;
1376 pdu.cp.handle = instance;
1377 pdu.cp.operation = LE_SET_ADV_DATA_OP_COMPLETE;
1378
1379 return __hci_cmd_sync_status(hdev, HCI_OP_LE_SET_PER_ADV_DATA,
1380 sizeof(pdu.cp) + len, &pdu,
1381 HCI_CMD_TIMEOUT);
1382}
1383
1384static int hci_enable_per_advertising_sync(struct hci_dev *hdev, u8 instance)
1385{
1386 struct hci_cp_le_set_per_adv_enable cp;
6a42e9bf 1387 struct adv_info *adv = NULL;
eca0ae4a
LAD		 1388
1389 /* If periodic advertising already enabled there is nothing to do. */
6a42e9bf
IT		 1390 adv = hci_find_adv_instance(hdev, instance);
1391 if (adv && adv->periodic && adv->enabled)
eca0ae4a
LAD		 1392 return 0;
1393
1394 memset(&cp, 0, sizeof(cp));
1395
1396 cp.enable = 0x01;
1397 cp.handle = instance;
1398
1399 return __hci_cmd_sync_status(hdev, HCI_OP_LE_SET_PER_ADV_ENABLE,
1400 sizeof(cp), &cp, HCI_CMD_TIMEOUT);
1401}
1402
1403/* Checks if periodic advertising data contains a Basic Announcement and if it
1404 * does generates a Broadcast ID and add Broadcast Announcement.
1405 */
1406static int hci_adv_bcast_annoucement(struct hci_dev *hdev, struct adv_info *adv)
1407{
1408 u8 bid[3];
1409 u8 ad[4 + 3];
1410
1411 /* Skip if NULL adv as instance 0x00 is used for general purpose
1412 * advertising so it cannot used for the likes of Broadcast Announcement
1413 * as it can be overwritten at any point.
1414 */
1415 if (!adv)
1416 return 0;
1417
1418 /* Check if PA data doesn't contains a Basic Audio Announcement then
1419 * there is nothing to do.
1420 */
1421 if (!eir_get_service_data(adv->per_adv_data, adv->per_adv_data_len,
1422 0x1851, NULL))
1423 return 0;
1424
1425 /* Check if advertising data already has a Broadcast Announcement since
1426 * the process may want to control the Broadcast ID directly and in that
1427 * case the kernel shall no interfere.
1428 */
1429 if (eir_get_service_data(adv->adv_data, adv->adv_data_len, 0x1852,
1430 NULL))
1431 return 0;
1432
1433 /* Generate Broadcast ID */
1434 get_random_bytes(bid, sizeof(bid));
1435 eir_append_service_data(ad, 0, 0x1852, bid, sizeof(bid));
1436 hci_set_adv_instance_data(hdev, adv->instance, sizeof(ad), ad, 0, NULL);
1437
1438 return hci_update_adv_data_sync(hdev, adv->instance);
1439}
1440
1441int hci_start_per_adv_sync(struct hci_dev *hdev, u8 instance, u8 data_len,
1442 u8 *data, u32 flags, u16 min_interval,
1443 u16 max_interval, u16 sync_interval)
1444{
1445 struct adv_info *adv = NULL;
1446 int err;
1447 bool added = false;
1448
1449 hci_disable_per_advertising_sync(hdev, instance);
1450
1451 if (instance) {
1452 adv = hci_find_adv_instance(hdev, instance);
1453 /* Create an instance if that could not be found */
1454 if (!adv) {
1455 adv = hci_add_per_instance(hdev, instance, flags,
1456 data_len, data,
1457 sync_interval,
1458 sync_interval);
1459 if (IS_ERR(adv))
1460 return PTR_ERR(adv);
6a42e9bf 1461 adv->pending = false;
eca0ae4a
LAD		 1462 added = true;
1463 }
1464 }
1465
6a42e9bf
IT		 1466 /* Start advertising */
1467 err = hci_start_ext_adv_sync(hdev, instance);
1468 if (err < 0)
1469 goto fail;
1470
1471 err = hci_adv_bcast_annoucement(hdev, adv);
1472 if (err < 0)
1473 goto fail;
eca0ae4a
LAD		 1474
1475 err = hci_set_per_adv_params_sync(hdev, instance, min_interval,
1476 max_interval);
1477 if (err < 0)
1478 goto fail;
1479
1480 err = hci_set_per_adv_data_sync(hdev, instance);
1481 if (err < 0)
1482 goto fail;
1483
1484 err = hci_enable_per_advertising_sync(hdev, instance);
1485 if (err < 0)
1486 goto fail;
1487
1488 return 0;
1489
1490fail:
1491 if (added)
1492 hci_remove_adv_instance(hdev, instance);
1493
1494 return err;
1495}
1496
cba6b758
LAD		 1497static int hci_start_adv_sync(struct hci_dev *hdev, u8 instance)
1498{
1499 int err;
1500
1501 if (ext_adv_capable(hdev))
1502 return hci_start_ext_adv_sync(hdev, instance);
1503
1504 err = hci_update_adv_data_sync(hdev, instance);
1505 if (err)
1506 return err;
1507
1508 err = hci_update_scan_rsp_data_sync(hdev, instance);
1509 if (err)
1510 return err;
1511
1512 return hci_enable_advertising_sync(hdev);
1513}
1514
1515int hci_enable_advertising_sync(struct hci_dev *hdev)
1516{
1517 struct adv_info *adv_instance;
1518 struct hci_cp_le_set_adv_param cp;
1519 u8 own_addr_type, enable = 0x01;
1520 bool connectable;
1521 u16 adv_min_interval, adv_max_interval;
1522 u32 flags;
1523 u8 status;
1524
ad383c2c
LAD		 1525 if (ext_adv_capable(hdev))
1526 return hci_enable_ext_advertising_sync(hdev,
1527 hdev->cur_adv_instance);
1528
cba6b758
LAD		 1529 flags = hci_adv_instance_flags(hdev, hdev->cur_adv_instance);
1530 adv_instance = hci_find_adv_instance(hdev, hdev->cur_adv_instance);
1531
1532 /* If the "connectable" instance flag was not set, then choose between
1533 * ADV_IND and ADV_NONCONN_IND based on the global connectable setting.
1534 */
1535 connectable = (flags & MGMT_ADV_FLAG_CONNECTABLE) ||
1536 mgmt_get_connectable(hdev);
1537
1538 if (!is_advertising_allowed(hdev, connectable))
1539 return -EINVAL;
1540
ad383c2c
LAD		 1541 status = hci_disable_advertising_sync(hdev);
1542 if (status)
1543 return status;
cba6b758
LAD		 1544
1545 /* Clear the HCI_LE_ADV bit temporarily so that the
1546 * hci_update_random_address knows that it's safe to go ahead
1547 * and write a new random address. The flag will be set back on
1548 * as soon as the SET_ADV_ENABLE HCI command completes.
1549 */
1550 hci_dev_clear_flag(hdev, HCI_LE_ADV);
1551
1552 /* Set require_privacy to true only when non-connectable
1553 * advertising is used. In that case it is fine to use a
1554 * non-resolvable private address.
1555 */
1556 status = hci_update_random_address_sync(hdev, !connectable,
1557 adv_use_rpa(hdev, flags),
1558 &own_addr_type);
1559 if (status)
1560 return status;
1561
1562 memset(&cp, 0, sizeof(cp));
1563
1564 if (adv_instance) {
1565 adv_min_interval = adv_instance->min_interval;
1566 adv_max_interval = adv_instance->max_interval;
1567 } else {
1568 adv_min_interval = hdev->le_adv_min_interval;
1569 adv_max_interval = hdev->le_adv_max_interval;
1570 }
1571
1572 if (connectable) {
1573 cp.type = LE_ADV_IND;
1574 } else {
1575 if (hci_adv_instance_is_scannable(hdev, hdev->cur_adv_instance))
1576 cp.type = LE_ADV_SCAN_IND;
1577 else
1578 cp.type = LE_ADV_NONCONN_IND;
1579
1580 if (!hci_dev_test_flag(hdev, HCI_DISCOVERABLE) ||
1581 hci_dev_test_flag(hdev, HCI_LIMITED_DISCOVERABLE)) {
1582 adv_min_interval = DISCOV_LE_FAST_ADV_INT_MIN;
1583 adv_max_interval = DISCOV_LE_FAST_ADV_INT_MAX;
1584 }
1585 }
1586
1587 cp.min_interval = cpu_to_le16(adv_min_interval);
1588 cp.max_interval = cpu_to_le16(adv_max_interval);
1589 cp.own_address_type = own_addr_type;
1590 cp.channel_map = hdev->le_adv_channel_map;
1591
1592 status = __hci_cmd_sync_status(hdev, HCI_OP_LE_SET_ADV_PARAM,
1593 sizeof(cp), &cp, HCI_CMD_TIMEOUT);
1594 if (status)
1595 return status;
1596
1597 return __hci_cmd_sync_status(hdev, HCI_OP_LE_SET_ADV_ENABLE,
1598 sizeof(enable), &enable, HCI_CMD_TIMEOUT);
1599}
1600
abfeea47
LAD		 1601static int enable_advertising_sync(struct hci_dev *hdev, void *data)
1602{
1603 return hci_enable_advertising_sync(hdev);
1604}
1605
1606int hci_enable_advertising(struct hci_dev *hdev)
1607{
1608 if (!hci_dev_test_flag(hdev, HCI_ADVERTISING) &&
1609 list_empty(&hdev->adv_instances))
1610 return 0;
1611
1612 return hci_cmd_sync_queue(hdev, enable_advertising_sync, NULL, NULL);
1613}
1614
1615int hci_remove_ext_adv_instance_sync(struct hci_dev *hdev, u8 instance,
1616 struct sock *sk)
cba6b758
LAD		 1617{
1618 int err;
1619
1620 if (!ext_adv_capable(hdev))
1621 return 0;
1622
1623 err = hci_disable_ext_adv_instance_sync(hdev, instance);
1624 if (err)
1625 return err;
1626
1627 /* If request specifies an instance that doesn't exist, fail */
1628 if (instance > 0 && !hci_find_adv_instance(hdev, instance))
1629 return -EINVAL;
1630
1631 return __hci_cmd_sync_status_sk(hdev, HCI_OP_LE_REMOVE_ADV_SET,
1632 sizeof(instance), &instance, 0,
1633 HCI_CMD_TIMEOUT, sk);
1634}
1635
eca0ae4a
LAD		 1636static int remove_ext_adv_sync(struct hci_dev *hdev, void *data)
1637{
1638 struct adv_info *adv = data;
1639 u8 instance = 0;
1640
1641 if (adv)
1642 instance = adv->instance;
1643
1644 return hci_remove_ext_adv_instance_sync(hdev, instance, NULL);
1645}
1646
1647int hci_remove_ext_adv_instance(struct hci_dev *hdev, u8 instance)
1648{
1649 struct adv_info *adv = NULL;
1650
1651 if (instance) {
1652 adv = hci_find_adv_instance(hdev, instance);
1653 if (!adv)
1654 return -EINVAL;
1655 }
1656
1657 return hci_cmd_sync_queue(hdev, remove_ext_adv_sync, adv, NULL);
1658}
1659
1660int hci_le_terminate_big_sync(struct hci_dev *hdev, u8 handle, u8 reason)
1661{
1662 struct hci_cp_le_term_big cp;
1663
1664 memset(&cp, 0, sizeof(cp));
1665 cp.handle = handle;
1666 cp.reason = reason;
1667
1668 return __hci_cmd_sync_status(hdev, HCI_OP_LE_TERM_BIG,
1669 sizeof(cp), &cp, HCI_CMD_TIMEOUT);
1670}
1671
cba6b758
LAD		 1672static int hci_set_ext_adv_data_sync(struct hci_dev *hdev, u8 instance)
1673{
1674 struct {
1675 struct hci_cp_le_set_ext_adv_data cp;
1676 u8 data[HCI_MAX_EXT_AD_LENGTH];
1677 } pdu;
1678 u8 len;
34a718bc
LAD		 1679 struct adv_info *adv = NULL;
1680 int err;
cba6b758
LAD		 1681
1682 memset(&pdu, 0, sizeof(pdu));
1683
34a718bc
LAD		 1684 if (instance) {
1685 adv = hci_find_adv_instance(hdev, instance);
1686 if (!adv || !adv->adv_data_changed)
1687 return 0;
1688 }
cba6b758 1689
34a718bc 1690 len = eir_create_adv_data(hdev, instance, pdu.data);
cba6b758
LAD		 1691
1692 pdu.cp.length = len;
1693 pdu.cp.handle = instance;
1694 pdu.cp.operation = LE_SET_ADV_DATA_OP_COMPLETE;
1695 pdu.cp.frag_pref = LE_SET_ADV_DATA_NO_FRAG;
1696
34a718bc
LAD		 1697 err = __hci_cmd_sync_status(hdev, HCI_OP_LE_SET_EXT_ADV_DATA,
1698 sizeof(pdu.cp) + len, &pdu.cp,
1699 HCI_CMD_TIMEOUT);
1700 if (err)
1701 return err;
1702
1703 /* Update data if the command succeed */
1704 if (adv) {
1705 adv->adv_data_changed = false;
1706 } else {
1707 memcpy(hdev->adv_data, pdu.data, len);
1708 hdev->adv_data_len = len;
1709 }
1710
1711 return 0;
cba6b758
LAD		 1712}
1713
1714static int hci_set_adv_data_sync(struct hci_dev *hdev, u8 instance)
1715{
1716 struct hci_cp_le_set_adv_data cp;
1717 u8 len;
1718
1719 memset(&cp, 0, sizeof(cp));
1720
1721 len = eir_create_adv_data(hdev, instance, cp.data);
1722
1723 /* There's nothing to do if the data hasn't changed */
1724 if (hdev->adv_data_len == len &&
1725 memcmp(cp.data, hdev->adv_data, len) == 0)
1726 return 0;
1727
1728 memcpy(hdev->adv_data, cp.data, sizeof(cp.data));
1729 hdev->adv_data_len = len;
1730
1731 cp.length = len;
1732
1733 return __hci_cmd_sync_status(hdev, HCI_OP_LE_SET_ADV_DATA,
1734 sizeof(cp), &cp, HCI_CMD_TIMEOUT);
1735}
1736
1737int hci_update_adv_data_sync(struct hci_dev *hdev, u8 instance)
1738{
1739 if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED))
1740 return 0;
1741
1742 if (ext_adv_capable(hdev))
1743 return hci_set_ext_adv_data_sync(hdev, instance);
1744
1745 return hci_set_adv_data_sync(hdev, instance);
1746}
1747
1748int hci_schedule_adv_instance_sync(struct hci_dev *hdev, u8 instance,
1749 bool force)
1750{
1751 struct adv_info *adv = NULL;
1752 u16 timeout;
1753
cf75ad8b 1754 if (hci_dev_test_flag(hdev, HCI_ADVERTISING) && !ext_adv_capable(hdev))
cba6b758
LAD		 1755 return -EPERM;
1756
1757 if (hdev->adv_instance_timeout)
1758 return -EBUSY;
1759
1760 adv = hci_find_adv_instance(hdev, instance);
1761 if (!adv)
1762 return -ENOENT;
1763
1764 /* A zero timeout means unlimited advertising. As long as there is
1765 * only one instance, duration should be ignored. We still set a timeout
1766 * in case further instances are being added later on.
1767 *
1768 * If the remaining lifetime of the instance is more than the duration
1769 * then the timeout corresponds to the duration, otherwise it will be
1770 * reduced to the remaining instance lifetime.
1771 */
1772 if (adv->timeout == 0 || adv->duration <= adv->remaining_time)
1773 timeout = adv->duration;
1774 else
1775 timeout = adv->remaining_time;
1776
1777 /* The remaining time is being reduced unless the instance is being
1778 * advertised without time limit.
1779 */
1780 if (adv->timeout)
1781 adv->remaining_time = adv->remaining_time - timeout;
1782
1783 /* Only use work for scheduling instances with legacy advertising */
1784 if (!ext_adv_capable(hdev)) {
1785 hdev->adv_instance_timeout = timeout;
1786 queue_delayed_work(hdev->req_workqueue,
1787 &hdev->adv_instance_expire,
1788 msecs_to_jiffies(timeout * 1000));
1789 }
1790
1791 /* If we're just re-scheduling the same instance again then do not
1792 * execute any HCI commands. This happens when a single instance is
1793 * being advertised.
1794 */
1795 if (!force && hdev->cur_adv_instance == instance &&
1796 hci_dev_test_flag(hdev, HCI_LE_ADV))
1797 return 0;
1798
1799 hdev->cur_adv_instance = instance;
1800
1801 return hci_start_adv_sync(hdev, instance);
1802}
1803
1804static int hci_clear_adv_sets_sync(struct hci_dev *hdev, struct sock *sk)
1805{
1806 int err;
1807
1808 if (!ext_adv_capable(hdev))
1809 return 0;
1810
1811 /* Disable instance 0x00 to disable all instances */
1812 err = hci_disable_ext_adv_instance_sync(hdev, 0x00);
1813 if (err)
1814 return err;
1815
1816 return __hci_cmd_sync_status_sk(hdev, HCI_OP_LE_CLEAR_ADV_SETS,
1817 0, NULL, 0, HCI_CMD_TIMEOUT, sk);
1818}
1819
1820static int hci_clear_adv_sync(struct hci_dev *hdev, struct sock *sk, bool force)
1821{
1822 struct adv_info *adv, *n;
b338d917 1823 int err = 0;
cba6b758
LAD		 1824
1825 if (ext_adv_capable(hdev))
1826 /* Remove all existing sets */
b338d917
BG		 1827 err = hci_clear_adv_sets_sync(hdev, sk);
1828 if (ext_adv_capable(hdev))
1829 return err;
cba6b758
LAD		 1830
1831 /* This is safe as long as there is no command send while the lock is
1832 * held.
1833 */
1834 hci_dev_lock(hdev);
1835
1836 /* Cleanup non-ext instances */
1837 list_for_each_entry_safe(adv, n, &hdev->adv_instances, list) {
1838 u8 instance = adv->instance;
1839 int err;
1840
1841 if (!(force || adv->timeout))
1842 continue;
1843
1844 err = hci_remove_adv_instance(hdev, instance);
1845 if (!err)
1846 mgmt_advertising_removed(sk, hdev, instance);
1847 }
1848
1849 hci_dev_unlock(hdev);
1850
1851 return 0;
1852}
1853
1854static int hci_remove_adv_sync(struct hci_dev *hdev, u8 instance,
1855 struct sock *sk)
1856{
b338d917 1857 int err = 0;
cba6b758
LAD		 1858
1859 /* If we use extended advertising, instance has to be removed first. */
1860 if (ext_adv_capable(hdev))
b338d917
BG		 1861 err = hci_remove_ext_adv_instance_sync(hdev, instance, sk);
1862 if (ext_adv_capable(hdev))
1863 return err;
cba6b758
LAD		 1864
1865 /* This is safe as long as there is no command send while the lock is
1866 * held.
1867 */
1868 hci_dev_lock(hdev);
1869
1870 err = hci_remove_adv_instance(hdev, instance);
1871 if (!err)
1872 mgmt_advertising_removed(sk, hdev, instance);
1873
1874 hci_dev_unlock(hdev);
1875
1876 return err;
1877}
1878
1879/* For a single instance:
1880 * - force == true: The instance will be removed even when its remaining
1881 * lifetime is not zero.
1882 * - force == false: the instance will be deactivated but kept stored unless
1883 * the remaining lifetime is zero.
1884 *
1885 * For instance == 0x00:
1886 * - force == true: All instances will be removed regardless of their timeout
1887 * setting.
1888 * - force == false: Only instances that have a timeout will be removed.
1889 */
1890int hci_remove_advertising_sync(struct hci_dev *hdev, struct sock *sk,
1891 u8 instance, bool force)
1892{
1893 struct adv_info *next = NULL;
1894 int err;
1895
1896 /* Cancel any timeout concerning the removed instance(s). */
1897 if (!instance || hdev->cur_adv_instance == instance)
1898 cancel_adv_timeout(hdev);
1899
1900 /* Get the next instance to advertise BEFORE we remove
1901 * the current one. This can be the same instance again
1902 * if there is only one instance.
1903 */
1904 if (hdev->cur_adv_instance == instance)
1905 next = hci_get_next_instance(hdev, instance);
1906
1907 if (!instance) {
1908 err = hci_clear_adv_sync(hdev, sk, force);
1909 if (err)
1910 return err;
1911 } else {
1912 struct adv_info *adv = hci_find_adv_instance(hdev, instance);
1913
1914 if (force || (adv && adv->timeout && !adv->remaining_time)) {
1915 /* Don't advertise a removed instance. */
1916 if (next && next->instance == instance)
1917 next = NULL;
1918
1919 err = hci_remove_adv_sync(hdev, instance, sk);
1920 if (err)
1921 return err;
1922 }
1923 }
1924
1925 if (!hdev_is_powered(hdev) || hci_dev_test_flag(hdev, HCI_ADVERTISING))
1926 return 0;
1927
1928 if (next && !ext_adv_capable(hdev))
1929 hci_schedule_adv_instance_sync(hdev, next->instance, false);
1930
1931 return 0;
1932}
1933
47db6b42
BG		 1934int hci_read_rssi_sync(struct hci_dev *hdev, __le16 handle)
1935{
1936 struct hci_cp_read_rssi cp;
1937
1938 cp.handle = handle;
1939 return __hci_cmd_sync_status(hdev, HCI_OP_READ_RSSI,
1940 sizeof(cp), &cp, HCI_CMD_TIMEOUT);
1941}
1942
5a750137
BG		 1943int hci_read_clock_sync(struct hci_dev *hdev, struct hci_cp_read_clock *cp)
1944{
1945 return __hci_cmd_sync_status(hdev, HCI_OP_READ_CLOCK,
1946 sizeof(*cp), cp, HCI_CMD_TIMEOUT);
1947}
1948
47db6b42
BG		 1949int hci_read_tx_power_sync(struct hci_dev *hdev, __le16 handle, u8 type)
1950{
1951 struct hci_cp_read_tx_power cp;
1952
1953 cp.handle = handle;
1954 cp.type = type;
1955 return __hci_cmd_sync_status(hdev, HCI_OP_READ_TX_POWER,
1956 sizeof(cp), &cp, HCI_CMD_TIMEOUT);
1957}
1958
cba6b758
LAD		 1959int hci_disable_advertising_sync(struct hci_dev *hdev)
1960{
1961 u8 enable = 0x00;
b338d917 1962 int err = 0;
cba6b758 1963
ad383c2c
LAD		 1964 /* If controller is not advertising we are done. */
1965 if (!hci_dev_test_flag(hdev, HCI_LE_ADV))
1966 return 0;
1967
cba6b758 1968 if (ext_adv_capable(hdev))
b338d917
BG		 1969 err = hci_disable_ext_adv_instance_sync(hdev, 0x00);
1970 if (ext_adv_capable(hdev))
1971 return err;
cba6b758
LAD		 1972
1973 return __hci_cmd_sync_status(hdev, HCI_OP_LE_SET_ADV_ENABLE,
1974 sizeof(enable), &enable, HCI_CMD_TIMEOUT);
1975}
e8907f76
LAD		 1976
1977static int hci_le_set_ext_scan_enable_sync(struct hci_dev *hdev, u8 val,
1978 u8 filter_dup)
1979{
1980 struct hci_cp_le_set_ext_scan_enable cp;
1981
1982 memset(&cp, 0, sizeof(cp));
1983 cp.enable = val;
b338d917
BG		 1984
1985 if (hci_dev_test_flag(hdev, HCI_MESH))
1986 cp.filter_dup = LE_SCAN_FILTER_DUP_DISABLE;
1987 else
1988 cp.filter_dup = filter_dup;
e8907f76
LAD		 1989
1990 return __hci_cmd_sync_status(hdev, HCI_OP_LE_SET_EXT_SCAN_ENABLE,
1991 sizeof(cp), &cp, HCI_CMD_TIMEOUT);
1992}
1993
1994static int hci_le_set_scan_enable_sync(struct hci_dev *hdev, u8 val,
1995 u8 filter_dup)
1996{
1997 struct hci_cp_le_set_scan_enable cp;
1998
1999 if (use_ext_scan(hdev))
2000 return hci_le_set_ext_scan_enable_sync(hdev, val, filter_dup);
2001
2002 memset(&cp, 0, sizeof(cp));
2003 cp.enable = val;
b338d917
BG		 2004
2005 if (val && hci_dev_test_flag(hdev, HCI_MESH))
2006 cp.filter_dup = LE_SCAN_FILTER_DUP_DISABLE;
2007 else
2008 cp.filter_dup = filter_dup;
e8907f76
LAD		 2009
2010 return __hci_cmd_sync_status(hdev, HCI_OP_LE_SET_SCAN_ENABLE,
2011 sizeof(cp), &cp, HCI_CMD_TIMEOUT);
2012}
2013
2014static int hci_le_set_addr_resolution_enable_sync(struct hci_dev *hdev, u8 val)
2015{
ad383c2c
LAD		 2016 if (!use_ll_privacy(hdev))
2017 return 0;
2018
2019 /* If controller is not/already resolving we are done. */
2020 if (val == hci_dev_test_flag(hdev, HCI_LL_RPA_RESOLUTION))
e8907f76
LAD		 2021 return 0;
2022
2023 return __hci_cmd_sync_status(hdev, HCI_OP_LE_SET_ADDR_RESOLV_ENABLE,
2024 sizeof(val), &val, HCI_CMD_TIMEOUT);
2025}
2026
27592ca1 2027static int hci_scan_disable_sync(struct hci_dev *hdev)
e8907f76
LAD		 2028{
2029 int err;
2030
2031 /* If controller is not scanning we are done. */
2032 if (!hci_dev_test_flag(hdev, HCI_LE_SCAN))
2033 return 0;
2034
2035 if (hdev->scanning_paused) {
2036 bt_dev_dbg(hdev, "Scanning is paused for suspend");
2037 return 0;
2038 }
2039
e8907f76
LAD		 2040 err = hci_le_set_scan_enable_sync(hdev, LE_SCAN_DISABLE, 0x00);
2041 if (err) {
2042 bt_dev_err(hdev, "Unable to disable scanning: %d", err);
2043 return err;
2044 }
2045
e8907f76
LAD		 2046 return err;
2047}
2048
2049static bool scan_use_rpa(struct hci_dev *hdev)
2050{
2051 return hci_dev_test_flag(hdev, HCI_PRIVACY);
2052}
2053
2054static void hci_start_interleave_scan(struct hci_dev *hdev)
2055{
2056 hdev->interleave_scan_state = INTERLEAVE_SCAN_NO_FILTER;
2057 queue_delayed_work(hdev->req_workqueue,
2058 &hdev->interleave_scan, 0);
2059}
2060
2061static bool is_interleave_scanning(struct hci_dev *hdev)
2062{
2063 return hdev->interleave_scan_state != INTERLEAVE_SCAN_NONE;
2064}
2065
2066static void cancel_interleave_scan(struct hci_dev *hdev)
2067{
2068 bt_dev_dbg(hdev, "cancelling interleave scan");
2069
2070 cancel_delayed_work_sync(&hdev->interleave_scan);
2071
2072 hdev->interleave_scan_state = INTERLEAVE_SCAN_NONE;
2073}
2074
2075/* Return true if interleave_scan wasn't started until exiting this function,
2076 * otherwise, return false
2077 */
2078static bool hci_update_interleaved_scan_sync(struct hci_dev *hdev)
2079{
2080 /* Do interleaved scan only if all of the following are true:
2081 * - There is at least one ADV monitor
2082 * - At least one pending LE connection or one device to be scanned for
2083 * - Monitor offloading is not supported
2084 * If so, we should alternate between allowlist scan and one without
2085 * any filters to save power.
2086 */
2087 bool use_interleaving = hci_is_adv_monitoring(hdev) &&
2088 !(list_empty(&hdev->pend_le_conns) &&
2089 list_empty(&hdev->pend_le_reports)) &&
2090 hci_get_adv_monitor_offload_ext(hdev) ==
2091 HCI_ADV_MONITOR_EXT_NONE;
2092 bool is_interleaving = is_interleave_scanning(hdev);
2093
2094 if (use_interleaving && !is_interleaving) {
2095 hci_start_interleave_scan(hdev);
2096 bt_dev_dbg(hdev, "starting interleave scan");
2097 return true;
2098 }
2099
2100 if (!use_interleaving && is_interleaving)
2101 cancel_interleave_scan(hdev);
2102
2103 return false;
2104}
2105
2106/* Removes connection to resolve list if needed.*/
2107static int hci_le_del_resolve_list_sync(struct hci_dev *hdev,
2108 bdaddr_t *bdaddr, u8 bdaddr_type)
2109{
2110 struct hci_cp_le_del_from_resolv_list cp;
2111 struct bdaddr_list_with_irk *entry;
2112
ad383c2c 2113 if (!use_ll_privacy(hdev))
e8907f76
LAD		 2114 return 0;
2115
2116 /* Check if the IRK has been programmed */
2117 entry = hci_bdaddr_list_lookup_with_irk(&hdev->le_resolv_list, bdaddr,
2118 bdaddr_type);
2119 if (!entry)
2120 return 0;
2121
2122 cp.bdaddr_type = bdaddr_type;
2123 bacpy(&cp.bdaddr, bdaddr);
2124
2125 return __hci_cmd_sync_status(hdev, HCI_OP_LE_DEL_FROM_RESOLV_LIST,
2126 sizeof(cp), &cp, HCI_CMD_TIMEOUT);
2127}
2128
2129static int hci_le_del_accept_list_sync(struct hci_dev *hdev,
2130 bdaddr_t *bdaddr, u8 bdaddr_type)
2131{
2132 struct hci_cp_le_del_from_accept_list cp;
2133 int err;
2134
2135 /* Check if device is on accept list before removing it */
2136 if (!hci_bdaddr_list_lookup(&hdev->le_accept_list, bdaddr, bdaddr_type))
2137 return 0;
2138
2139 cp.bdaddr_type = bdaddr_type;
2140 bacpy(&cp.bdaddr, bdaddr);
2141
ad383c2c
LAD		 2142 /* Ignore errors when removing from resolving list as that is likely
2143 * that the device was never added.
2144 */
2145 hci_le_del_resolve_list_sync(hdev, &cp.bdaddr, cp.bdaddr_type);
2146
e8907f76
LAD		 2147 err = __hci_cmd_sync_status(hdev, HCI_OP_LE_DEL_FROM_ACCEPT_LIST,
2148 sizeof(cp), &cp, HCI_CMD_TIMEOUT);
2149 if (err) {
2150 bt_dev_err(hdev, "Unable to remove from allow list: %d", err);
2151 return err;
2152 }
2153
2154 bt_dev_dbg(hdev, "Remove %pMR (0x%x) from allow list", &cp.bdaddr,
2155 cp.bdaddr_type);
2156
ad383c2c 2157 return 0;
e8907f76
LAD		 2158}
2159
195ef75e
PV		 2160struct conn_params {
2161 bdaddr_t addr;
2162 u8 addr_type;
2163 hci_conn_flags_t flags;
2164 u8 privacy_mode;
2165};
2166
cf75ad8b
LAD		 2167/* Adds connection to resolve list if needed.
2168 * Setting params to NULL programs local hdev->irk
2169 */
e8907f76 2170static int hci_le_add_resolve_list_sync(struct hci_dev *hdev,
195ef75e 2171 struct conn_params *params)
e8907f76
LAD		 2172{
2173 struct hci_cp_le_add_to_resolv_list cp;
2174 struct smp_irk *irk;
2175 struct bdaddr_list_with_irk *entry;
195ef75e 2176 struct hci_conn_params *p;
e8907f76 2177
ad383c2c 2178 if (!use_ll_privacy(hdev))
e8907f76
LAD		 2179 return 0;
2180
cf75ad8b
LAD		 2181 /* Attempt to program local identity address, type and irk if params is
2182 * NULL.
2183 */
2184 if (!params) {
2185 if (!hci_dev_test_flag(hdev, HCI_PRIVACY))
2186 return 0;
2187
2188 hci_copy_identity_address(hdev, &cp.bdaddr, &cp.bdaddr_type);
2189 memcpy(cp.peer_irk, hdev->irk, 16);
2190 goto done;
2191 }
2192
e8907f76
LAD		 2193 irk = hci_find_irk_by_addr(hdev, &params->addr, params->addr_type);
2194 if (!irk)
2195 return 0;
2196
2197 /* Check if the IK has _not_ been programmed yet. */
2198 entry = hci_bdaddr_list_lookup_with_irk(&hdev->le_resolv_list,
2199 &params->addr,
2200 params->addr_type);
2201 if (entry)
2202 return 0;
2203
2204 cp.bdaddr_type = params->addr_type;
2205 bacpy(&cp.bdaddr, &params->addr);
2206 memcpy(cp.peer_irk, irk->val, 16);
2207
0900b1c6
LAD		 2208 /* Default privacy mode is always Network */
2209 params->privacy_mode = HCI_NETWORK_PRIVACY;
2210
195ef75e
PV		 2211 rcu_read_lock();
2212 p = hci_pend_le_action_lookup(&hdev->pend_le_conns,
2213 &params->addr, params->addr_type);
2214 if (!p)
2215 p = hci_pend_le_action_lookup(&hdev->pend_le_reports,
2216 &params->addr, params->addr_type);
2217 if (p)
2218 WRITE_ONCE(p->privacy_mode, HCI_NETWORK_PRIVACY);
2219 rcu_read_unlock();
2220
cf75ad8b 2221done:
e8907f76
LAD		 2222 if (hci_dev_test_flag(hdev, HCI_PRIVACY))
2223 memcpy(cp.local_irk, hdev->irk, 16);
2224 else
2225 memset(cp.local_irk, 0, 16);
2226
2227 return __hci_cmd_sync_status(hdev, HCI_OP_LE_ADD_TO_RESOLV_LIST,
2228 sizeof(cp), &cp, HCI_CMD_TIMEOUT);
2229}
2230
853b70b5
LAD		 2231/* Set Device Privacy Mode. */
2232static int hci_le_set_privacy_mode_sync(struct hci_dev *hdev,
195ef75e 2233 struct conn_params *params)
853b70b5
LAD		 2234{
2235 struct hci_cp_le_set_privacy_mode cp;
2236 struct smp_irk *irk;
2237
2238 /* If device privacy mode has already been set there is nothing to do */
2239 if (params->privacy_mode == HCI_DEVICE_PRIVACY)
2240 return 0;
2241
2242 /* Check if HCI_CONN_FLAG_DEVICE_PRIVACY has been set as it also
2243 * indicates that LL Privacy has been enabled and
2244 * HCI_OP_LE_SET_PRIVACY_MODE is supported.
2245 */
e1cff700 2246 if (!(params->flags & HCI_CONN_FLAG_DEVICE_PRIVACY))
853b70b5
LAD		 2247 return 0;
2248
2249 irk = hci_find_irk_by_addr(hdev, &params->addr, params->addr_type);
2250 if (!irk)
2251 return 0;
2252
2253 memset(&cp, 0, sizeof(cp));
2254 cp.bdaddr_type = irk->addr_type;
2255 bacpy(&cp.bdaddr, &irk->bdaddr);
2256 cp.mode = HCI_DEVICE_PRIVACY;
2257
195ef75e
PV		 2258 /* Note: params->privacy_mode is not updated since it is a copy */
2259
853b70b5
LAD		 2260 return __hci_cmd_sync_status(hdev, HCI_OP_LE_SET_PRIVACY_MODE,
2261 sizeof(cp), &cp, HCI_CMD_TIMEOUT);
2262}
2263
e8907f76 2264/* Adds connection to allow list if needed, if the device uses RPA (has IRK)
853b70b5
LAD		 2265 * this attempts to program the device in the resolving list as well and
2266 * properly set the privacy mode.
e8907f76
LAD		 2267 */
2268static int hci_le_add_accept_list_sync(struct hci_dev *hdev,
195ef75e 2269 struct conn_params *params,
ad383c2c 2270 u8 *num_entries)
e8907f76
LAD		 2271{
2272 struct hci_cp_le_add_to_accept_list cp;
2273 int err;
2274
3b420553
LAD		 2275 /* During suspend, only wakeable devices can be in acceptlist */
2276 if (hdev->suspended &&
e1cff700 2277 !(params->flags & HCI_CONN_FLAG_REMOTE_WAKEUP))
3b420553
LAD		 2278 return 0;
2279
e8907f76
LAD		 2280 /* Select filter policy to accept all advertising */
2281 if (*num_entries >= hdev->le_accept_list_size)
2282 return -ENOSPC;
2283
2284 /* Accept list can not be used with RPAs */
ad383c2c 2285 if (!use_ll_privacy(hdev) &&
3b420553 2286 hci_find_irk_by_addr(hdev, &params->addr, params->addr_type))
e8907f76 2287 return -EINVAL;
e8907f76 2288
ad383c2c
LAD		 2289 /* Attempt to program the device in the resolving list first to avoid
2290 * having to rollback in case it fails since the resolving list is
2291 * dynamic it can probably be smaller than the accept list.
2292 */
2293 err = hci_le_add_resolve_list_sync(hdev, params);
2294 if (err) {
2295 bt_dev_err(hdev, "Unable to add to resolve list: %d", err);
2296 return err;
2297 }
2298
853b70b5
LAD		 2299 /* Set Privacy Mode */
2300 err = hci_le_set_privacy_mode_sync(hdev, params);
2301 if (err) {
2302 bt_dev_err(hdev, "Unable to set privacy mode: %d", err);
2303 return err;
2304 }
2305
2306 /* Check if already in accept list */
2307 if (hci_bdaddr_list_lookup(&hdev->le_accept_list, &params->addr,
2308 params->addr_type))
2309 return 0;
2310
e8907f76
LAD		 2311 *num_entries += 1;
2312 cp.bdaddr_type = params->addr_type;
2313 bacpy(&cp.bdaddr, &params->addr);
2314
2315 err = __hci_cmd_sync_status(hdev, HCI_OP_LE_ADD_TO_ACCEPT_LIST,
2316 sizeof(cp), &cp, HCI_CMD_TIMEOUT);
2317 if (err) {
2318 bt_dev_err(hdev, "Unable to add to allow list: %d", err);
ad383c2c
LAD		 2319 /* Rollback the device from the resolving list */
2320 hci_le_del_resolve_list_sync(hdev, &cp.bdaddr, cp.bdaddr_type);
e8907f76
LAD		 2321 return err;
2322 }
2323
2324 bt_dev_dbg(hdev, "Add %pMR (0x%x) to allow list", &cp.bdaddr,
2325 cp.bdaddr_type);
2326
ad383c2c
LAD		 2327 return 0;
2328}
2329
182ee45d 2330/* This function disables/pause all advertising instances */
ad383c2c
LAD		 2331static int hci_pause_advertising_sync(struct hci_dev *hdev)
2332{
2333 int err;
182ee45d 2334 int old_state;
ad383c2c 2335
9446bdde
LAD		 2336 /* If already been paused there is nothing to do. */
2337 if (hdev->advertising_paused)
ad383c2c
LAD		 2338 return 0;
2339
182ee45d
LAD		 2340 bt_dev_dbg(hdev, "Pausing directed advertising");
2341
2342 /* Stop directed advertising */
2343 old_state = hci_dev_test_flag(hdev, HCI_ADVERTISING);
2344 if (old_state) {
2345 /* When discoverable timeout triggers, then just make sure
2346 * the limited discoverable flag is cleared. Even in the case
2347 * of a timeout triggered from general discoverable, it is
2348 * safe to unconditionally clear the flag.
2349 */
2350 hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE);
2351 hci_dev_clear_flag(hdev, HCI_DISCOVERABLE);
2352 hdev->discov_timeout = 0;
2353 }
2354
ad383c2c
LAD		 2355 bt_dev_dbg(hdev, "Pausing advertising instances");
2356
2357 /* Call to disable any advertisements active on the controller.
2358 * This will succeed even if no advertisements are configured.
2359 */
2360 err = hci_disable_advertising_sync(hdev);
2361 if (err)
2362 return err;
2363
2364 /* If we are using software rotation, pause the loop */
2365 if (!ext_adv_capable(hdev))
2366 cancel_adv_timeout(hdev);
2367
2368 hdev->advertising_paused = true;
182ee45d 2369 hdev->advertising_old_state = old_state;
ad383c2c
LAD		 2370
2371 return 0;
e8907f76
LAD		 2372}
2373
182ee45d 2374/* This function enables all user advertising instances */
ad383c2c
LAD		 2375static int hci_resume_advertising_sync(struct hci_dev *hdev)
2376{
2377 struct adv_info *adv, *tmp;
2378 int err;
2379
2380 /* If advertising has not been paused there is nothing to do. */
2381 if (!hdev->advertising_paused)
2382 return 0;
2383
182ee45d
LAD		 2384 /* Resume directed advertising */
2385 hdev->advertising_paused = false;
2386 if (hdev->advertising_old_state) {
2387 hci_dev_set_flag(hdev, HCI_ADVERTISING);
182ee45d
LAD		 2388 hdev->advertising_old_state = 0;
2389 }
2390
ad383c2c
LAD		 2391 bt_dev_dbg(hdev, "Resuming advertising instances");
2392
2393 if (ext_adv_capable(hdev)) {
2394 /* Call for each tracked instance to be re-enabled */
2395 list_for_each_entry_safe(adv, tmp, &hdev->adv_instances, list) {
2396 err = hci_enable_ext_advertising_sync(hdev,
2397 adv->instance);
2398 if (!err)
2399 continue;
2400
2401 /* If the instance cannot be resumed remove it */
2402 hci_remove_ext_adv_instance_sync(hdev, adv->instance,
2403 NULL);
2404 }
2405 } else {
2406 /* Schedule for most recent instance to be restarted and begin
2407 * the software rotation loop
2408 */
2409 err = hci_schedule_adv_instance_sync(hdev,
2410 hdev->cur_adv_instance,
2411 true);
2412 }
2413
2414 hdev->advertising_paused = false;
2415
2416 return err;
2417}
2418
3c44a431
ZJ		 2419static int hci_pause_addr_resolution(struct hci_dev *hdev)
2420{
2421 int err;
2422
2423 if (!use_ll_privacy(hdev))
2424 return 0;
2425
2426 if (!hci_dev_test_flag(hdev, HCI_LL_RPA_RESOLUTION))
2427 return 0;
2428
2429 /* Cannot disable addr resolution if scanning is enabled or
2430 * when initiating an LE connection.
2431 */
2432 if (hci_dev_test_flag(hdev, HCI_LE_SCAN) ||
2433 hci_lookup_le_connect(hdev)) {
2434 bt_dev_err(hdev, "Command not allowed when scan/LE connect");
2435 return -EPERM;
2436 }
2437
2438 /* Cannot disable addr resolution if advertising is enabled. */
2439 err = hci_pause_advertising_sync(hdev);
2440 if (err) {
2441 bt_dev_err(hdev, "Pause advertising failed: %d", err);
2442 return err;
2443 }
2444
2445 err = hci_le_set_addr_resolution_enable_sync(hdev, 0x00);
2446 if (err)
2447 bt_dev_err(hdev, "Unable to disable Address Resolution: %d",
2448 err);
2449
2450 /* Return if address resolution is disabled and RPA is not used. */
2451 if (!err && scan_use_rpa(hdev))
ae051b04 2452 return 0;
3c44a431
ZJ		 2453
2454 hci_resume_advertising_sync(hdev);
2455 return err;
2456}
2457
f892244b
BG		 2458struct sk_buff *hci_read_local_oob_data_sync(struct hci_dev *hdev,
2459 bool extended, struct sock *sk)
2460{
2461 u16 opcode = extended ? HCI_OP_READ_LOCAL_OOB_EXT_DATA :
2462 HCI_OP_READ_LOCAL_OOB_DATA;
2463
2464 return __hci_cmd_sync_sk(hdev, opcode, 0, NULL, 0, HCI_CMD_TIMEOUT, sk);
2465}
2466
195ef75e
PV		 2467static struct conn_params *conn_params_copy(struct list_head *list, size_t *n)
2468{
2469 struct hci_conn_params *params;
2470 struct conn_params *p;
2471 size_t i;
2472
2473 rcu_read_lock();
2474
2475 i = 0;
2476 list_for_each_entry_rcu(params, list, action)
2477 ++i;
2478 *n = i;
2479
2480 rcu_read_unlock();
2481
2482 p = kvcalloc(*n, sizeof(struct conn_params), GFP_KERNEL);
2483 if (!p)
2484 return NULL;
2485
2486 rcu_read_lock();
2487
2488 i = 0;
2489 list_for_each_entry_rcu(params, list, action) {
2490 /* Racing adds are handled in next scan update */
2491 if (i >= *n)
2492 break;
2493
2494 /* No hdev->lock, but: addr, addr_type are immutable.
2495 * privacy_mode is only written by us or in
2496 * hci_cc_le_set_privacy_mode that we wait for.
2497 * We should be idempotent so MGMT updating flags
2498 * while we are processing is OK.
2499 */
2500 bacpy(&p[i].addr, &params->addr);
2501 p[i].addr_type = params->addr_type;
2502 p[i].flags = READ_ONCE(params->flags);
2503 p[i].privacy_mode = READ_ONCE(params->privacy_mode);
2504 ++i;
2505 }
2506
2507 rcu_read_unlock();
2508
2509 *n = i;
2510 return p;
2511}
2512
ad383c2c
LAD		 2513/* Device must not be scanning when updating the accept list.
2514 *
2515 * Update is done using the following sequence:
2516 *
2517 * use_ll_privacy((Disable Advertising) -> Disable Resolving List) ->
2518 * Remove Devices From Accept List ->
2519 * (has IRK && use_ll_privacy(Remove Devices From Resolving List))->
2520 * Add Devices to Accept List ->
2521 * (has IRK && use_ll_privacy(Remove Devices From Resolving List)) ->
2522 * use_ll_privacy(Enable Resolving List -> (Enable Advertising)) ->
2523 * Enable Scanning
2524 *
2525 * In case of failure advertising shall be restored to its original state and
2526 * return would disable accept list since either accept or resolving list could
2527 * not be programmed.
2528 *
2529 */
e8907f76
LAD		 2530static u8 hci_update_accept_list_sync(struct hci_dev *hdev)
2531{
195ef75e 2532 struct conn_params *params;
e8907f76
LAD		 2533 struct bdaddr_list *b, *t;
2534 u8 num_entries = 0;
2535 bool pend_conn, pend_report;
80740ebb 2536 u8 filter_policy;
195ef75e 2537 size_t i, n;
ad383c2c
LAD		 2538 int err;
2539
3c44a431 2540 /* Pause advertising if resolving list can be used as controllers
ad383c2c 2541 * cannot accept resolving list modifications while advertising.
e8907f76 2542 */
ad383c2c
LAD		 2543 if (use_ll_privacy(hdev)) {
2544 err = hci_pause_advertising_sync(hdev);
2545 if (err) {
2546 bt_dev_err(hdev, "pause advertising failed: %d", err);
2547 return 0x00;
2548 }
2549 }
e8907f76 2550
ad383c2c
LAD		 2551 /* Disable address resolution while reprogramming accept list since
2552 * devices that do have an IRK will be programmed in the resolving list
2553 * when LL Privacy is enabled.
2554 */
2555 err = hci_le_set_addr_resolution_enable_sync(hdev, 0x00);
2556 if (err) {
2557 bt_dev_err(hdev, "Unable to disable LL privacy: %d", err);
2558 goto done;
2559 }
e8907f76
LAD		 2560
2561 /* Go through the current accept list programmed into the
6828b583
LAD		 2562 * controller one by one and check if that address is connected or is
2563 * still in the list of pending connections or list of devices to
e8907f76
LAD		 2564 * report. If not present in either list, then remove it from
2565 * the controller.
2566 */
2567 list_for_each_entry_safe(b, t, &hdev->le_accept_list, list) {
6828b583
LAD		 2568 if (hci_conn_hash_lookup_le(hdev, &b->bdaddr, b->bdaddr_type))
2569 continue;
2570
195ef75e 2571 /* Pointers not dereferenced, no locks needed */
e8907f76
LAD		 2572 pend_conn = hci_pend_le_action_lookup(&hdev->pend_le_conns,
2573 &b->bdaddr,
2574 b->bdaddr_type);
2575 pend_report = hci_pend_le_action_lookup(&hdev->pend_le_reports,
2576 &b->bdaddr,
2577 b->bdaddr_type);
2578
2579 /* If the device is not likely to connect or report,
2580 * remove it from the acceptlist.
2581 */
2582 if (!pend_conn && !pend_report) {
2583 hci_le_del_accept_list_sync(hdev, &b->bdaddr,
2584 b->bdaddr_type);
2585 continue;
2586 }
2587
e8907f76
LAD		 2588 num_entries++;
2589 }
2590
2591 /* Since all no longer valid accept list entries have been
2592 * removed, walk through the list of pending connections
2593 * and ensure that any new device gets programmed into
2594 * the controller.
2595 *
2596 * If the list of the devices is larger than the list of
2597 * available accept list entries in the controller, then
2598 * just abort and return filer policy value to not use the
2599 * accept list.
195ef75e
PV		 2600 *
2601 * The list and params may be mutated while we wait for events,
2602 * so make a copy and iterate it.
e8907f76 2603 */
195ef75e
PV		 2604
2605 params = conn_params_copy(&hdev->pend_le_conns, &n);
2606 if (!params) {
2607 err = -ENOMEM;
2608 goto done;
2609 }
2610
2611 for (i = 0; i < n; ++i) {
2612 err = hci_le_add_accept_list_sync(hdev, &params[i],
2613 &num_entries);
2614 if (err) {
2615 kvfree(params);
ad383c2c 2616 goto done;
195ef75e 2617 }
e8907f76
LAD		 2618 }
2619
195ef75e
PV		 2620 kvfree(params);
2621
e8907f76
LAD		 2622 /* After adding all new pending connections, walk through
2623 * the list of pending reports and also add these to the
2624 * accept list if there is still space. Abort if space runs out.
2625 */
195ef75e
PV		 2626
2627 params = conn_params_copy(&hdev->pend_le_reports, &n);
2628 if (!params) {
2629 err = -ENOMEM;
2630 goto done;
2631 }
2632
2633 for (i = 0; i < n; ++i) {
2634 err = hci_le_add_accept_list_sync(hdev, &params[i],
2635 &num_entries);
2636 if (err) {
2637 kvfree(params);
ad383c2c 2638 goto done;
195ef75e 2639 }
e8907f76
LAD		 2640 }
2641
195ef75e
PV		 2642 kvfree(params);
2643
e8907f76
LAD		 2644 /* Use the allowlist unless the following conditions are all true:
2645 * - We are not currently suspending
2646 * - There are 1 or more ADV monitors registered and it's not offloaded
2647 * - Interleaved scanning is not currently using the allowlist
2648 */
2649 if (!idr_is_empty(&hdev->adv_monitors_idr) && !hdev->suspended &&
2650 hci_get_adv_monitor_offload_ext(hdev) == HCI_ADV_MONITOR_EXT_NONE &&
2651 hdev->interleave_scan_state != INTERLEAVE_SCAN_ALLOWLIST)
ad383c2c
LAD		 2652 err = -EINVAL;
2653
2654done:
80740ebb
LAD		 2655 filter_policy = err ? 0x00 : 0x01;
2656
ad383c2c
LAD		 2657 /* Enable address resolution when LL Privacy is enabled. */
2658 err = hci_le_set_addr_resolution_enable_sync(hdev, 0x01);
2659 if (err)
2660 bt_dev_err(hdev, "Unable to enable LL privacy: %d", err);
2661
2662 /* Resume advertising if it was paused */
2663 if (use_ll_privacy(hdev))
2664 hci_resume_advertising_sync(hdev);
e8907f76
LAD		 2665
2666 /* Select filter policy to use accept list */
80740ebb 2667 return filter_policy;
e8907f76
LAD		 2668}
2669
e8907f76
LAD		 2670static int hci_le_set_ext_scan_param_sync(struct hci_dev *hdev, u8 type,
2671 u16 interval, u16 window,
2672 u8 own_addr_type, u8 filter_policy)
2673{
2674 struct hci_cp_le_set_ext_scan_params *cp;
2675 struct hci_cp_le_scan_phy_params *phy;
2676 u8 data[sizeof(*cp) + sizeof(*phy) * 2];
2677 u8 num_phy = 0;
2678
2679 cp = (void *)data;
2680 phy = (void *)cp->data;
2681
2682 memset(data, 0, sizeof(data));
2683
2684 cp->own_addr_type = own_addr_type;
2685 cp->filter_policy = filter_policy;
2686
2687 if (scan_1m(hdev) || scan_2m(hdev)) {
2688 cp->scanning_phys |= LE_SCAN_PHY_1M;
2689
2690 phy->type = type;
2691 phy->interval = cpu_to_le16(interval);
2692 phy->window = cpu_to_le16(window);
2693
2694 num_phy++;
2695 phy++;
2696 }
2697
2698 if (scan_coded(hdev)) {
2699 cp->scanning_phys |= LE_SCAN_PHY_CODED;
2700
2701 phy->type = type;
2702 phy->interval = cpu_to_le16(interval);
2703 phy->window = cpu_to_le16(window);
2704
2705 num_phy++;
2706 phy++;
2707 }
2708
2709 return __hci_cmd_sync_status(hdev, HCI_OP_LE_SET_EXT_SCAN_PARAMS,
2710 sizeof(*cp) + sizeof(*phy) * num_phy,
2711 data, HCI_CMD_TIMEOUT);
2712}
2713
2714static int hci_le_set_scan_param_sync(struct hci_dev *hdev, u8 type,
2715 u16 interval, u16 window,
2716 u8 own_addr_type, u8 filter_policy)
2717{
2718 struct hci_cp_le_set_scan_param cp;
2719
2720 if (use_ext_scan(hdev))
2721 return hci_le_set_ext_scan_param_sync(hdev, type, interval,
2722 window, own_addr_type,
2723 filter_policy);
2724
2725 memset(&cp, 0, sizeof(cp));
2726 cp.type = type;
2727 cp.interval = cpu_to_le16(interval);
2728 cp.window = cpu_to_le16(window);
2729 cp.own_address_type = own_addr_type;
2730 cp.filter_policy = filter_policy;
2731
2732 return __hci_cmd_sync_status(hdev, HCI_OP_LE_SET_SCAN_PARAM,
2733 sizeof(cp), &cp, HCI_CMD_TIMEOUT);
2734}
2735
2736static int hci_start_scan_sync(struct hci_dev *hdev, u8 type, u16 interval,
abfeea47
LAD		 2737 u16 window, u8 own_addr_type, u8 filter_policy,
2738 u8 filter_dup)
e8907f76
LAD		 2739{
2740 int err;
2741
2742 if (hdev->scanning_paused) {
2743 bt_dev_dbg(hdev, "Scanning is paused for suspend");
2744 return 0;
2745 }
2746
e8907f76
LAD		 2747 err = hci_le_set_scan_param_sync(hdev, type, interval, window,
2748 own_addr_type, filter_policy);
2749 if (err)
2750 return err;
2751
abfeea47 2752 return hci_le_set_scan_enable_sync(hdev, LE_SCAN_ENABLE, filter_dup);
e8907f76
LAD		 2753}
2754
27592ca1 2755static int hci_passive_scan_sync(struct hci_dev *hdev)
e8907f76
LAD		 2756{
2757 u8 own_addr_type;
2758 u8 filter_policy;
2759 u16 window, interval;
b338d917 2760 u8 filter_dups = LE_SCAN_FILTER_DUP_ENABLE;
ad383c2c 2761 int err;
e8907f76
LAD		 2762
2763 if (hdev->scanning_paused) {
2764 bt_dev_dbg(hdev, "Scanning is paused for suspend");
2765 return 0;
2766 }
2767
ad383c2c
LAD		 2768 err = hci_scan_disable_sync(hdev);
2769 if (err) {
2770 bt_dev_err(hdev, "disable scanning failed: %d", err);
2771 return err;
2772 }
2773
e8907f76
LAD		 2774 /* Set require_privacy to false since no SCAN_REQ are send
2775 * during passive scanning. Not using an non-resolvable address
2776 * here is important so that peer devices using direct
2777 * advertising with our address will be correctly reported
2778 * by the controller.
2779 */
2780 if (hci_update_random_address_sync(hdev, false, scan_use_rpa(hdev),
2781 &own_addr_type))
2782 return 0;
2783
2784 if (hdev->enable_advmon_interleave_scan &&
2785 hci_update_interleaved_scan_sync(hdev))
2786 return 0;
2787
2788 bt_dev_dbg(hdev, "interleave state %d", hdev->interleave_scan_state);
ad383c2c 2789
e8907f76
LAD		 2790 /* Adding or removing entries from the accept list must
2791 * happen before enabling scanning. The controller does
2792 * not allow accept list modification while scanning.
2793 */
2794 filter_policy = hci_update_accept_list_sync(hdev);
2795
2796 /* When the controller is using random resolvable addresses and
2797 * with that having LE privacy enabled, then controllers with
2798 * Extended Scanner Filter Policies support can now enable support
2799 * for handling directed advertising.
2800 *
2801 * So instead of using filter polices 0x00 (no acceptlist)
2802 * and 0x01 (acceptlist enabled) use the new filter policies
2803 * 0x02 (no acceptlist) and 0x03 (acceptlist enabled).
2804 */
2805 if (hci_dev_test_flag(hdev, HCI_PRIVACY) &&
2806 (hdev->le_features[0] & HCI_LE_EXT_SCAN_POLICY))
2807 filter_policy |= 0x02;
2808
2809 if (hdev->suspended) {
2810 window = hdev->le_scan_window_suspend;
2811 interval = hdev->le_scan_int_suspend;
e8907f76
LAD		 2812 } else if (hci_is_le_conn_scanning(hdev)) {
2813 window = hdev->le_scan_window_connect;
2814 interval = hdev->le_scan_int_connect;
2815 } else if (hci_is_adv_monitoring(hdev)) {
2816 window = hdev->le_scan_window_adv_monitor;
2817 interval = hdev->le_scan_int_adv_monitor;
2818 } else {
2819 window = hdev->le_scan_window;
2820 interval = hdev->le_scan_interval;
2821 }
2822
b338d917
BG		 2823 /* Disable all filtering for Mesh */
2824 if (hci_dev_test_flag(hdev, HCI_MESH)) {
2825 filter_policy = 0;
2826 filter_dups = LE_SCAN_FILTER_DUP_DISABLE;
2827 }
2828
e8907f76
LAD		 2829 bt_dev_dbg(hdev, "LE passive scan with acceptlist = %d", filter_policy);
2830
2831 return hci_start_scan_sync(hdev, LE_SCAN_PASSIVE, interval, window,
b338d917 2832 own_addr_type, filter_policy, filter_dups);
e8907f76
LAD		 2833}
2834
2835/* This function controls the passive scanning based on hdev->pend_le_conns
2836 * list. If there are pending LE connection we start the background scanning,
ad383c2c
LAD		 2837 * otherwise we stop it in the following sequence:
2838 *
2839 * If there are devices to scan:
2840 *
2841 * Disable Scanning -> Update Accept List ->
2842 * use_ll_privacy((Disable Advertising) -> Disable Resolving List ->
2843 * Update Resolving List -> Enable Resolving List -> (Enable Advertising)) ->
2844 * Enable Scanning
2845 *
2846 * Otherwise:
2847 *
2848 * Disable Scanning
e8907f76
LAD		 2849 */
2850int hci_update_passive_scan_sync(struct hci_dev *hdev)
2851{
2852 int err;
2853
2854 if (!test_bit(HCI_UP, &hdev->flags) ||
2855 test_bit(HCI_INIT, &hdev->flags) ||
2856 hci_dev_test_flag(hdev, HCI_SETUP) ||
2857 hci_dev_test_flag(hdev, HCI_CONFIG) ||
2858 hci_dev_test_flag(hdev, HCI_AUTO_OFF) ||
2859 hci_dev_test_flag(hdev, HCI_UNREGISTER))
2860 return 0;
2861
2862 /* No point in doing scanning if LE support hasn't been enabled */
2863 if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED))
2864 return 0;
2865
2866 /* If discovery is active don't interfere with it */
2867 if (hdev->discovery.state != DISCOVERY_STOPPED)
2868 return 0;
2869
2870 /* Reset RSSI and UUID filters when starting background scanning
2871 * since these filters are meant for service discovery only.
2872 *
2873 * The Start Discovery and Start Service Discovery operations
2874 * ensure to set proper values for RSSI threshold and UUID
2875 * filter list. So it is safe to just reset them here.
2876 */
2877 hci_discovery_filter_clear(hdev);
2878
2879 bt_dev_dbg(hdev, "ADV monitoring is %s",
2880 hci_is_adv_monitoring(hdev) ? "on" : "off");
2881
b338d917
BG		 2882 if (!hci_dev_test_flag(hdev, HCI_MESH) &&
2883 list_empty(&hdev->pend_le_conns) &&
e8907f76 2884 list_empty(&hdev->pend_le_reports) &&
eca0ae4a
LAD		 2885 !hci_is_adv_monitoring(hdev) &&
2886 !hci_dev_test_flag(hdev, HCI_PA_SYNC)) {
e8907f76
LAD		 2887 /* If there is no pending LE connections or devices
2888 * to be scanned for or no ADV monitors, we should stop the
2889 * background scanning.
2890 */
2891
2892 bt_dev_dbg(hdev, "stopping background scanning");
2893
ad383c2c 2894 err = hci_scan_disable_sync(hdev);
e8907f76
LAD		 2895 if (err)
2896 bt_dev_err(hdev, "stop background scanning failed: %d",
2897 err);
2898 } else {
2899 /* If there is at least one pending LE connection, we should
2900 * keep the background scan running.
2901 */
2902
2903 /* If controller is connecting, we should not start scanning
2904 * since some controllers are not able to scan and connect at
2905 * the same time.
2906 */
2907 if (hci_lookup_le_connect(hdev))
2908 return 0;
2909
e8907f76
LAD		 2910 bt_dev_dbg(hdev, "start background scanning");
2911
2912 err = hci_passive_scan_sync(hdev);
2913 if (err)
2914 bt_dev_err(hdev, "start background scanning failed: %d",
2915 err);
2916 }
2917
2918 return err;
2919}
ad383c2c 2920
bb876725
BG		 2921static int update_scan_sync(struct hci_dev *hdev, void *data)
2922{
2923 return hci_update_scan_sync(hdev);
2924}
2925
2926int hci_update_scan(struct hci_dev *hdev)
2927{
2928 return hci_cmd_sync_queue(hdev, update_scan_sync, NULL, NULL);
2929}
2930
ad383c2c
LAD		 2931static int update_passive_scan_sync(struct hci_dev *hdev, void *data)
2932{
2933 return hci_update_passive_scan_sync(hdev);
2934}
2935
2936int hci_update_passive_scan(struct hci_dev *hdev)
2937{
5bee2fd6
LAD		 2938 /* Only queue if it would have any effect */
2939 if (!test_bit(HCI_UP, &hdev->flags) ||
2940 test_bit(HCI_INIT, &hdev->flags) ||
2941 hci_dev_test_flag(hdev, HCI_SETUP) ||
2942 hci_dev_test_flag(hdev, HCI_CONFIG) ||
2943 hci_dev_test_flag(hdev, HCI_AUTO_OFF) ||
2944 hci_dev_test_flag(hdev, HCI_UNREGISTER))
2945 return 0;
2946
ad383c2c
LAD		 2947 return hci_cmd_sync_queue(hdev, update_passive_scan_sync, NULL, NULL);
2948}
cf75ad8b 2949
2f2eb0c9 2950int hci_write_sc_support_sync(struct hci_dev *hdev, u8 val)
cf75ad8b 2951{
2f2eb0c9
BG		 2952 int err;
2953
cf75ad8b
LAD		 2954 if (!bredr_sc_enabled(hdev) || lmp_host_sc_capable(hdev))
2955 return 0;
2956
2f2eb0c9 2957 err = __hci_cmd_sync_status(hdev, HCI_OP_WRITE_SC_SUPPORT,
cf75ad8b 2958 sizeof(val), &val, HCI_CMD_TIMEOUT);
2f2eb0c9
BG		 2959
2960 if (!err) {
2961 if (val) {
2962 hdev->features[1][0] |= LMP_HOST_SC;
2963 hci_dev_set_flag(hdev, HCI_SC_ENABLED);
2964 } else {
2965 hdev->features[1][0] &= ~LMP_HOST_SC;
2966 hci_dev_clear_flag(hdev, HCI_SC_ENABLED);
2967 }
2968 }
2969
2970 return err;
cf75ad8b
LAD		 2971}
2972
3244845c 2973int hci_write_ssp_mode_sync(struct hci_dev *hdev, u8 mode)
cf75ad8b
LAD		 2974{
2975 int err;
2976
2977 if (!hci_dev_test_flag(hdev, HCI_SSP_ENABLED) ||
2978 lmp_host_ssp_capable(hdev))
2979 return 0;
2980
3244845c
BG		 2981 if (!mode && hci_dev_test_flag(hdev, HCI_USE_DEBUG_KEYS)) {
2982 __hci_cmd_sync_status(hdev, HCI_OP_WRITE_SSP_DEBUG_MODE,
2983 sizeof(mode), &mode, HCI_CMD_TIMEOUT);
2984 }
2985
cf75ad8b
LAD		 2986 err = __hci_cmd_sync_status(hdev, HCI_OP_WRITE_SSP_MODE,
2987 sizeof(mode), &mode, HCI_CMD_TIMEOUT);
2988 if (err)
2989 return err;
2990
2991 return hci_write_sc_support_sync(hdev, 0x01);
2992}
2993
d81a494c 2994int hci_write_le_host_supported_sync(struct hci_dev *hdev, u8 le, u8 simul)
cf75ad8b
LAD		 2995{
2996 struct hci_cp_write_le_host_supported cp;
2997
2998 if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED) ||
2999 !lmp_bredr_capable(hdev))
3000 return 0;
3001
3002 /* Check first if we already have the right host state
3003 * (host features set)
3004 */
3005 if (le == lmp_host_le_capable(hdev) &&
3006 simul == lmp_host_le_br_capable(hdev))
3007 return 0;
3008
3009 memset(&cp, 0, sizeof(cp));
3010
3011 cp.le = le;
3012 cp.simul = simul;
3013
3014 return __hci_cmd_sync_status(hdev, HCI_OP_WRITE_LE_HOST_SUPPORTED,
3015 sizeof(cp), &cp, HCI_CMD_TIMEOUT);
3016}
3017
3018static int hci_powered_update_adv_sync(struct hci_dev *hdev)
3019{
3020 struct adv_info *adv, *tmp;
3021 int err;
3022
3023 if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED))
3024 return 0;
3025
3026 /* If RPA Resolution has not been enable yet it means the
3027 * resolving list is empty and we should attempt to program the
3028 * local IRK in order to support using own_addr_type
3029 * ADDR_LE_DEV_RANDOM_RESOLVED (0x03).
3030 */
3031 if (!hci_dev_test_flag(hdev, HCI_LL_RPA_RESOLUTION)) {
3032 hci_le_add_resolve_list_sync(hdev, NULL);
3033 hci_le_set_addr_resolution_enable_sync(hdev, 0x01);
3034 }
3035
3036 /* Make sure the controller has a good default for
3037 * advertising data. This also applies to the case
3038 * where BR/EDR was toggled during the AUTO_OFF phase.
3039 */
3040 if (hci_dev_test_flag(hdev, HCI_ADVERTISING) ||
3041 list_empty(&hdev->adv_instances)) {
3042 if (ext_adv_capable(hdev)) {
3043 err = hci_setup_ext_adv_instance_sync(hdev, 0x00);
3044 if (!err)
3045 hci_update_scan_rsp_data_sync(hdev, 0x00);
3046 } else {
3047 err = hci_update_adv_data_sync(hdev, 0x00);
3048 if (!err)
3049 hci_update_scan_rsp_data_sync(hdev, 0x00);
3050 }
3051
3052 if (hci_dev_test_flag(hdev, HCI_ADVERTISING))
3053 hci_enable_advertising_sync(hdev);
3054 }
3055
3056 /* Call for each tracked instance to be scheduled */
3057 list_for_each_entry_safe(adv, tmp, &hdev->adv_instances, list)
3058 hci_schedule_adv_instance_sync(hdev, adv->instance, true);
3059
3060 return 0;
3061}
3062
3063static int hci_write_auth_enable_sync(struct hci_dev *hdev)
3064{
3065 u8 link_sec;
3066
3067 link_sec = hci_dev_test_flag(hdev, HCI_LINK_SECURITY);
3068 if (link_sec == test_bit(HCI_AUTH, &hdev->flags))
3069 return 0;
3070
3071 return __hci_cmd_sync_status(hdev, HCI_OP_WRITE_AUTH_ENABLE,
3072 sizeof(link_sec), &link_sec,
3073 HCI_CMD_TIMEOUT);
3074}
3075
353a0249 3076int hci_write_fast_connectable_sync(struct hci_dev *hdev, bool enable)
cf75ad8b
LAD		 3077{
3078 struct hci_cp_write_page_scan_activity cp;
3079 u8 type;
3080 int err = 0;
3081
3082 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
3083 return 0;
3084
3085 if (hdev->hci_ver < BLUETOOTH_VER_1_2)
3086 return 0;
3087
3088 memset(&cp, 0, sizeof(cp));
3089
3090 if (enable) {
3091 type = PAGE_SCAN_TYPE_INTERLACED;
3092
3093 /* 160 msec page scan interval */
3094 cp.interval = cpu_to_le16(0x0100);
3095 } else {
3096 type = hdev->def_page_scan_type;
3097 cp.interval = cpu_to_le16(hdev->def_page_scan_int);
3098 }
3099
3100 cp.window = cpu_to_le16(hdev->def_page_scan_window);
3101
3102 if (__cpu_to_le16(hdev->page_scan_interval) != cp.interval ||
3103 __cpu_to_le16(hdev->page_scan_window) != cp.window) {
3104 err = __hci_cmd_sync_status(hdev,
3105 HCI_OP_WRITE_PAGE_SCAN_ACTIVITY,
3106 sizeof(cp), &cp, HCI_CMD_TIMEOUT);
3107 if (err)
3108 return err;
3109 }
3110
3111 if (hdev->page_scan_type != type)
3112 err = __hci_cmd_sync_status(hdev,
3113 HCI_OP_WRITE_PAGE_SCAN_TYPE,
3114 sizeof(type), &type,
3115 HCI_CMD_TIMEOUT);
3116
3117 return err;
3118}
3119
3120static bool disconnected_accept_list_entries(struct hci_dev *hdev)
3121{
3122 struct bdaddr_list *b;
3123
3124 list_for_each_entry(b, &hdev->accept_list, list) {
3125 struct hci_conn *conn;
3126
3127 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &b->bdaddr);
3128 if (!conn)
3129 return true;
3130
3131 if (conn->state != BT_CONNECTED && conn->state != BT_CONFIG)
3132 return true;
3133 }
3134
3135 return false;
3136}
3137
3138static int hci_write_scan_enable_sync(struct hci_dev *hdev, u8 val)
3139{
3140 return __hci_cmd_sync_status(hdev, HCI_OP_WRITE_SCAN_ENABLE,
3141 sizeof(val), &val,
3142 HCI_CMD_TIMEOUT);
3143}
3144
451d95a9 3145int hci_update_scan_sync(struct hci_dev *hdev)
cf75ad8b
LAD		 3146{
3147 u8 scan;
3148
3149 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
3150 return 0;
3151
3152 if (!hdev_is_powered(hdev))
3153 return 0;
3154
3155 if (mgmt_powering_down(hdev))
3156 return 0;
3157
3158 if (hdev->scanning_paused)
3159 return 0;
3160
3161 if (hci_dev_test_flag(hdev, HCI_CONNECTABLE) ||
3162 disconnected_accept_list_entries(hdev))
3163 scan = SCAN_PAGE;
3164 else
3165 scan = SCAN_DISABLED;
3166
3167 if (hci_dev_test_flag(hdev, HCI_DISCOVERABLE))
3168 scan |= SCAN_INQUIRY;
3169
3170 if (test_bit(HCI_PSCAN, &hdev->flags) == !!(scan & SCAN_PAGE) &&
3171 test_bit(HCI_ISCAN, &hdev->flags) == !!(scan & SCAN_INQUIRY))
3172 return 0;
3173
3174 return hci_write_scan_enable_sync(hdev, scan);
3175}
3176
6f6ff38a 3177int hci_update_name_sync(struct hci_dev *hdev)
cf75ad8b
LAD		 3178{
3179 struct hci_cp_write_local_name cp;
3180
3181 memset(&cp, 0, sizeof(cp));
3182
3183 memcpy(cp.name, hdev->dev_name, sizeof(cp.name));
3184
3185 return __hci_cmd_sync_status(hdev, HCI_OP_WRITE_LOCAL_NAME,
3186 sizeof(cp), &cp,
3187 HCI_CMD_TIMEOUT);
3188}
3189
3190/* This function perform powered update HCI command sequence after the HCI init
3191 * sequence which end up resetting all states, the sequence is as follows:
3192 *
3193 * HCI_SSP_ENABLED(Enable SSP)
3194 * HCI_LE_ENABLED(Enable LE)
3195 * HCI_LE_ENABLED(use_ll_privacy(Add local IRK to Resolving List) ->
3196 * Update adv data)
3197 * Enable Authentication
3198 * lmp_bredr_capable(Set Fast Connectable -> Set Scan Type -> Set Class ->
3199 * Set Name -> Set EIR)
e411443c 3200 * HCI_FORCE_STATIC_ADDR | BDADDR_ANY && !HCI_BREDR_ENABLED (Set Static Address)
cf75ad8b
LAD		 3201 */
3202int hci_powered_update_sync(struct hci_dev *hdev)
3203{
3204 int err;
3205
3206 /* Register the available SMP channels (BR/EDR and LE) only when
3207 * successfully powering on the controller. This late
3208 * registration is required so that LE SMP can clearly decide if
3209 * the public address or static address is used.
3210 */
3211 smp_register(hdev);
3212
3213 err = hci_write_ssp_mode_sync(hdev, 0x01);
3214 if (err)
3215 return err;
3216
3217 err = hci_write_le_host_supported_sync(hdev, 0x01, 0x00);
3218 if (err)
3219 return err;
3220
3221 err = hci_powered_update_adv_sync(hdev);
3222 if (err)
3223 return err;
3224
3225 err = hci_write_auth_enable_sync(hdev);
3226 if (err)
3227 return err;
3228
3229 if (lmp_bredr_capable(hdev)) {
3230 if (hci_dev_test_flag(hdev, HCI_FAST_CONNECTABLE))
3231 hci_write_fast_connectable_sync(hdev, true);
3232 else
3233 hci_write_fast_connectable_sync(hdev, false);
3234 hci_update_scan_sync(hdev);
3235 hci_update_class_sync(hdev);
3236 hci_update_name_sync(hdev);
3237 hci_update_eir_sync(hdev);
3238 }
3239
e411443c
LAD		 3240 /* If forcing static address is in use or there is no public
3241 * address use the static address as random address (but skip
3242 * the HCI command if the current random address is already the
3243 * static one.
3244 *
3245 * In case BR/EDR has been disabled on a dual-mode controller
3246 * and a static address has been configured, then use that
3247 * address instead of the public BR/EDR address.
3248 */
3249 if (hci_dev_test_flag(hdev, HCI_FORCE_STATIC_ADDR) ||
3250 (!bacmp(&hdev->bdaddr, BDADDR_ANY) &&
3251 !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))) {
3252 if (bacmp(&hdev->static_addr, BDADDR_ANY))
3253 return hci_set_random_addr_sync(hdev,
3254 &hdev->static_addr);
3255 }
3256
cf75ad8b
LAD		 3257 return 0;
3258}
3259
d0b13706
LAD		 3260/**
3261 * hci_dev_get_bd_addr_from_property - Get the Bluetooth Device Address
3262 * (BD_ADDR) for a HCI device from
3263 * a firmware node property.
3264 * @hdev: The HCI device
cf75ad8b 3265 *
d0b13706
LAD		 3266 * Search the firmware node for 'local-bd-address'.
3267 *
3268 * All-zero BD addresses are rejected, because those could be properties
3269 * that exist in the firmware tables, but were not updated by the firmware. For
3270 * example, the DTS could define 'local-bd-address', with zero BD addresses.
cf75ad8b 3271 */
d0b13706 3272static void hci_dev_get_bd_addr_from_property(struct hci_dev *hdev)
cf75ad8b 3273{
d0b13706
LAD		 3274 struct fwnode_handle *fwnode = dev_fwnode(hdev->dev.parent);
3275 bdaddr_t ba;
3276 int ret;
cf75ad8b 3277
d0b13706
LAD		 3278 ret = fwnode_property_read_u8_array(fwnode, "local-bd-address",
3279 (u8 *)&ba, sizeof(ba));
3280 if (ret < 0 || !bacmp(&ba, BDADDR_ANY))
3281 return;
cf75ad8b 3282
d0b13706
LAD		 3283 bacpy(&hdev->public_addr, &ba);
3284}
cf75ad8b 3285
d0b13706
LAD		 3286struct hci_init_stage {
3287 int (*func)(struct hci_dev *hdev);
3288};
cf75ad8b 3289
d0b13706
LAD		 3290/* Run init stage NULL terminated function table */
3291static int hci_init_stage_sync(struct hci_dev *hdev,
3292 const struct hci_init_stage *stage)
3293{
3294 size_t i;
cf75ad8b 3295
d0b13706
LAD		 3296 for (i = 0; stage[i].func; i++) {
3297 int err;
cf75ad8b 3298
d0b13706
LAD		 3299 err = stage[i].func(hdev);
3300 if (err)
3301 return err;
cf75ad8b
LAD		 3302 }
3303
3304 return 0;
3305}
3306
d0b13706
LAD		 3307/* Read Local Version */
3308static int hci_read_local_version_sync(struct hci_dev *hdev)
cf75ad8b 3309{
d0b13706
LAD		 3310 return __hci_cmd_sync_status(hdev, HCI_OP_READ_LOCAL_VERSION,
3311 0, NULL, HCI_CMD_TIMEOUT);
3312}
cf75ad8b 3313
d0b13706
LAD		 3314/* Read BD Address */
3315static int hci_read_bd_addr_sync(struct hci_dev *hdev)
3316{
3317 return __hci_cmd_sync_status(hdev, HCI_OP_READ_BD_ADDR,
3318 0, NULL, HCI_CMD_TIMEOUT);
3319}
cf75ad8b 3320
d0b13706
LAD		 3321#define HCI_INIT(_func) \
3322{ \
3323 .func = _func, \
cf75ad8b
LAD		 3324}
3325
d0b13706
LAD		 3326static const struct hci_init_stage hci_init0[] = {
3327 /* HCI_OP_READ_LOCAL_VERSION */
3328 HCI_INIT(hci_read_local_version_sync),
3329 /* HCI_OP_READ_BD_ADDR */
3330 HCI_INIT(hci_read_bd_addr_sync),
3331 {}
3332};
3333
3334int hci_reset_sync(struct hci_dev *hdev)
cf75ad8b 3335{
cf75ad8b
LAD		 3336 int err;
3337
d0b13706 3338 set_bit(HCI_RESET, &hdev->flags);
cf75ad8b 3339
d0b13706
LAD		 3340 err = __hci_cmd_sync_status(hdev, HCI_OP_RESET, 0, NULL,
3341 HCI_CMD_TIMEOUT);
3342 if (err)
3343 return err;
cf75ad8b 3344
d0b13706
LAD		 3345 return 0;
3346}
cf75ad8b 3347
d0b13706
LAD		 3348static int hci_init0_sync(struct hci_dev *hdev)
3349{
3350 int err;
cf75ad8b 3351
d0b13706
LAD		 3352 bt_dev_dbg(hdev, "");
3353
3354 /* Reset */
3355 if (!test_bit(HCI_QUIRK_RESET_ON_CLOSE, &hdev->quirks)) {
3356 err = hci_reset_sync(hdev);
cf75ad8b
LAD		 3357 if (err)
3358 return err;
3359 }
3360
d0b13706
LAD		 3361 return hci_init_stage_sync(hdev, hci_init0);
3362}
abfeea47 3363
d0b13706
LAD		 3364static int hci_unconf_init_sync(struct hci_dev *hdev)
3365{
3366 int err;
3367
3368 if (test_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks))
cf75ad8b
LAD		 3369 return 0;
3370
d0b13706
LAD		 3371 err = hci_init0_sync(hdev);
3372 if (err < 0)
3373 return err;
cf75ad8b 3374
d0b13706
LAD		 3375 if (hci_dev_test_flag(hdev, HCI_SETUP))
3376 hci_debugfs_create_basic(hdev);
cf75ad8b
LAD		 3377
3378 return 0;
3379}
3380
d0b13706
LAD		 3381/* Read Local Supported Features. */
3382static int hci_read_local_features_sync(struct hci_dev *hdev)
cf75ad8b 3383{
d0b13706
LAD		 3384 /* Not all AMP controllers support this command */
3385 if (hdev->dev_type == HCI_AMP && !(hdev->commands[14] & 0x20))
3386 return 0;
cf75ad8b 3387
d0b13706
LAD		 3388 return __hci_cmd_sync_status(hdev, HCI_OP_READ_LOCAL_FEATURES,
3389 0, NULL, HCI_CMD_TIMEOUT);
cf75ad8b
LAD		 3390}
3391
d0b13706
LAD		 3392/* BR Controller init stage 1 command sequence */
3393static const struct hci_init_stage br_init1[] = {
3394 /* HCI_OP_READ_LOCAL_FEATURES */
3395 HCI_INIT(hci_read_local_features_sync),
3396 /* HCI_OP_READ_LOCAL_VERSION */
3397 HCI_INIT(hci_read_local_version_sync),
3398 /* HCI_OP_READ_BD_ADDR */
3399 HCI_INIT(hci_read_bd_addr_sync),
3400 {}
3401};
3402
3403/* Read Local Commands */
3404static int hci_read_local_cmds_sync(struct hci_dev *hdev)
cf75ad8b 3405{
d0b13706
LAD		 3406 /* All Bluetooth 1.2 and later controllers should support the
3407 * HCI command for reading the local supported commands.
3408 *
3409 * Unfortunately some controllers indicate Bluetooth 1.2 support,
3410 * but do not have support for this command. If that is the case,
3411 * the driver can quirk the behavior and skip reading the local
3412 * supported commands.
3413 */
3414 if (hdev->hci_ver > BLUETOOTH_VER_1_1 &&
3415 !test_bit(HCI_QUIRK_BROKEN_LOCAL_COMMANDS, &hdev->quirks))
3416 return __hci_cmd_sync_status(hdev, HCI_OP_READ_LOCAL_COMMANDS,
3417 0, NULL, HCI_CMD_TIMEOUT);
cf75ad8b 3418
d0b13706 3419 return 0;
cf75ad8b
LAD		 3420}
3421
d0b13706
LAD		 3422/* Read Local AMP Info */
3423static int hci_read_local_amp_info_sync(struct hci_dev *hdev)
cf75ad8b 3424{
d0b13706
LAD		 3425 return __hci_cmd_sync_status(hdev, HCI_OP_READ_LOCAL_AMP_INFO,
3426 0, NULL, HCI_CMD_TIMEOUT);
cf75ad8b
LAD		 3427}
3428
d0b13706
LAD		 3429/* Read Data Blk size */
3430static int hci_read_data_block_size_sync(struct hci_dev *hdev)
cf75ad8b 3431{
d0b13706
LAD		 3432 return __hci_cmd_sync_status(hdev, HCI_OP_READ_DATA_BLOCK_SIZE,
3433 0, NULL, HCI_CMD_TIMEOUT);
3434}
cf75ad8b 3435
d0b13706
LAD		 3436/* Read Flow Control Mode */
3437static int hci_read_flow_control_mode_sync(struct hci_dev *hdev)
3438{
3439 return __hci_cmd_sync_status(hdev, HCI_OP_READ_FLOW_CONTROL_MODE,
3440 0, NULL, HCI_CMD_TIMEOUT);
3441}
cf75ad8b 3442
d0b13706
LAD		 3443/* Read Location Data */
3444static int hci_read_location_data_sync(struct hci_dev *hdev)
3445{
3446 return __hci_cmd_sync_status(hdev, HCI_OP_READ_LOCATION_DATA,
3447 0, NULL, HCI_CMD_TIMEOUT);
cf75ad8b
LAD		 3448}
3449
d0b13706
LAD		 3450/* AMP Controller init stage 1 command sequence */
3451static const struct hci_init_stage amp_init1[] = {
3452 /* HCI_OP_READ_LOCAL_VERSION */
3453 HCI_INIT(hci_read_local_version_sync),
3454 /* HCI_OP_READ_LOCAL_COMMANDS */
3455 HCI_INIT(hci_read_local_cmds_sync),
3456 /* HCI_OP_READ_LOCAL_AMP_INFO */
3457 HCI_INIT(hci_read_local_amp_info_sync),
3458 /* HCI_OP_READ_DATA_BLOCK_SIZE */
3459 HCI_INIT(hci_read_data_block_size_sync),
3460 /* HCI_OP_READ_FLOW_CONTROL_MODE */
3461 HCI_INIT(hci_read_flow_control_mode_sync),
3462 /* HCI_OP_READ_LOCATION_DATA */
3463 HCI_INIT(hci_read_location_data_sync),
bce56405 3464 {}
d0b13706
LAD		 3465};
3466
3467static int hci_init1_sync(struct hci_dev *hdev)
cf75ad8b 3468{
d0b13706 3469 int err;
cf75ad8b 3470
d0b13706 3471 bt_dev_dbg(hdev, "");
cf75ad8b 3472
d0b13706
LAD		 3473 /* Reset */
3474 if (!test_bit(HCI_QUIRK_RESET_ON_CLOSE, &hdev->quirks)) {
3475 err = hci_reset_sync(hdev);
3476 if (err)
3477 return err;
3478 }
cf75ad8b 3479
d0b13706
LAD		 3480 switch (hdev->dev_type) {
3481 case HCI_PRIMARY:
3482 hdev->flow_ctl_mode = HCI_FLOW_CTL_MODE_PACKET_BASED;
3483 return hci_init_stage_sync(hdev, br_init1);
3484 case HCI_AMP:
3485 hdev->flow_ctl_mode = HCI_FLOW_CTL_MODE_BLOCK_BASED;
3486 return hci_init_stage_sync(hdev, amp_init1);
3487 default:
3488 bt_dev_err(hdev, "Unknown device type %d", hdev->dev_type);
3489 break;
3490 }
3491
3492 return 0;
cf75ad8b
LAD		 3493}
3494
d0b13706
LAD		 3495/* AMP Controller init stage 2 command sequence */
3496static const struct hci_init_stage amp_init2[] = {
3497 /* HCI_OP_READ_LOCAL_FEATURES */
3498 HCI_INIT(hci_read_local_features_sync),
bce56405 3499 {}
d0b13706
LAD		 3500};
3501
3502/* Read Buffer Size (ACL mtu, max pkt, etc.) */
3503static int hci_read_buffer_size_sync(struct hci_dev *hdev)
cf75ad8b 3504{
d0b13706
LAD		 3505 return __hci_cmd_sync_status(hdev, HCI_OP_READ_BUFFER_SIZE,
3506 0, NULL, HCI_CMD_TIMEOUT);
3507}
cf75ad8b 3508
d0b13706
LAD		 3509/* Read Class of Device */
3510static int hci_read_dev_class_sync(struct hci_dev *hdev)
3511{
3512 return __hci_cmd_sync_status(hdev, HCI_OP_READ_CLASS_OF_DEV,
3513 0, NULL, HCI_CMD_TIMEOUT);
3514}
cf75ad8b 3515
d0b13706
LAD		 3516/* Read Local Name */
3517static int hci_read_local_name_sync(struct hci_dev *hdev)
3518{
3519 return __hci_cmd_sync_status(hdev, HCI_OP_READ_LOCAL_NAME,
3520 0, NULL, HCI_CMD_TIMEOUT);
3521}
cf75ad8b 3522
d0b13706
LAD		 3523/* Read Voice Setting */
3524static int hci_read_voice_setting_sync(struct hci_dev *hdev)
3525{
3526 return __hci_cmd_sync_status(hdev, HCI_OP_READ_VOICE_SETTING,
3527 0, NULL, HCI_CMD_TIMEOUT);
cf75ad8b
LAD		 3528}
3529
d0b13706
LAD		 3530/* Read Number of Supported IAC */
3531static int hci_read_num_supported_iac_sync(struct hci_dev *hdev)
cf75ad8b 3532{
d0b13706
LAD		 3533 return __hci_cmd_sync_status(hdev, HCI_OP_READ_NUM_SUPPORTED_IAC,
3534 0, NULL, HCI_CMD_TIMEOUT);
3535}
cf75ad8b 3536
d0b13706
LAD		 3537/* Read Current IAC LAP */
3538static int hci_read_current_iac_lap_sync(struct hci_dev *hdev)
3539{
3540 return __hci_cmd_sync_status(hdev, HCI_OP_READ_CURRENT_IAC_LAP,
3541 0, NULL, HCI_CMD_TIMEOUT);
cf75ad8b
LAD		 3542}
3543
d0b13706
LAD		 3544static int hci_set_event_filter_sync(struct hci_dev *hdev, u8 flt_type,
3545 u8 cond_type, bdaddr_t *bdaddr,
3546 u8 auto_accept)
cf75ad8b 3547{
d0b13706 3548 struct hci_cp_set_event_filter cp;
cf75ad8b 3549
d0b13706 3550 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
cf75ad8b
LAD		 3551 return 0;
3552
0eaecfb2
IFM		 3553 if (test_bit(HCI_QUIRK_BROKEN_FILTER_CLEAR_ALL, &hdev->quirks))
3554 return 0;
3555
d0b13706
LAD		 3556 memset(&cp, 0, sizeof(cp));
3557 cp.flt_type = flt_type;
cf75ad8b 3558
d0b13706
LAD		 3559 if (flt_type != HCI_FLT_CLEAR_ALL) {
3560 cp.cond_type = cond_type;
3561 bacpy(&cp.addr_conn_flt.bdaddr, bdaddr);
3562 cp.addr_conn_flt.auto_accept = auto_accept;
cf75ad8b
LAD		 3563 }
3564
d0b13706
LAD		 3565 return __hci_cmd_sync_status(hdev, HCI_OP_SET_EVENT_FLT,
3566 flt_type == HCI_FLT_CLEAR_ALL ?
3567 sizeof(cp.flt_type) : sizeof(cp), &cp,
3568 HCI_CMD_TIMEOUT);
cf75ad8b
LAD		 3569}
3570
d0b13706 3571static int hci_clear_event_filter_sync(struct hci_dev *hdev)
cf75ad8b 3572{
d0b13706
LAD		 3573 if (!hci_dev_test_flag(hdev, HCI_EVENT_FILTER_CONFIGURED))
3574 return 0;
3575
0eaecfb2
IFM		 3576 /* In theory the state machine should not reach here unless
3577 * a hci_set_event_filter_sync() call succeeds, but we do
3578 * the check both for parity and as a future reminder.
3579 */
3580 if (test_bit(HCI_QUIRK_BROKEN_FILTER_CLEAR_ALL, &hdev->quirks))
3581 return 0;
3582
d0b13706
LAD		 3583 return hci_set_event_filter_sync(hdev, HCI_FLT_CLEAR_ALL, 0x00,
3584 BDADDR_ANY, 0x00);
3585}
3586
3587/* Connection accept timeout ~20 secs */
3588static int hci_write_ca_timeout_sync(struct hci_dev *hdev)
3589{
3590 __le16 param = cpu_to_le16(0x7d00);
3591
3592 return __hci_cmd_sync_status(hdev, HCI_OP_WRITE_CA_TIMEOUT,
3593 sizeof(param), &param, HCI_CMD_TIMEOUT);
3594}
3595
3596/* BR Controller init stage 2 command sequence */
3597static const struct hci_init_stage br_init2[] = {
3598 /* HCI_OP_READ_BUFFER_SIZE */
3599 HCI_INIT(hci_read_buffer_size_sync),
3600 /* HCI_OP_READ_CLASS_OF_DEV */
3601 HCI_INIT(hci_read_dev_class_sync),
3602 /* HCI_OP_READ_LOCAL_NAME */
3603 HCI_INIT(hci_read_local_name_sync),
3604 /* HCI_OP_READ_VOICE_SETTING */
3605 HCI_INIT(hci_read_voice_setting_sync),
3606 /* HCI_OP_READ_NUM_SUPPORTED_IAC */
3607 HCI_INIT(hci_read_num_supported_iac_sync),
3608 /* HCI_OP_READ_CURRENT_IAC_LAP */
3609 HCI_INIT(hci_read_current_iac_lap_sync),
3610 /* HCI_OP_SET_EVENT_FLT */
3611 HCI_INIT(hci_clear_event_filter_sync),
3612 /* HCI_OP_WRITE_CA_TIMEOUT */
3613 HCI_INIT(hci_write_ca_timeout_sync),
3614 {}
3615};
3616
3617static int hci_write_ssp_mode_1_sync(struct hci_dev *hdev)
3618{
3619 u8 mode = 0x01;
3620
3621 if (!lmp_ssp_capable(hdev) || !hci_dev_test_flag(hdev, HCI_SSP_ENABLED))
3622 return 0;
3623
3624 /* When SSP is available, then the host features page
3625 * should also be available as well. However some
3626 * controllers list the max_page as 0 as long as SSP
3627 * has not been enabled. To achieve proper debugging
3628 * output, force the minimum max_page to 1 at least.
3629 */
3630 hdev->max_page = 0x01;
3631
3632 return __hci_cmd_sync_status(hdev, HCI_OP_WRITE_SSP_MODE,
3633 sizeof(mode), &mode, HCI_CMD_TIMEOUT);
3634}
3635
3636static int hci_write_eir_sync(struct hci_dev *hdev)
3637{
3638 struct hci_cp_write_eir cp;
3639
3640 if (!lmp_ssp_capable(hdev) || hci_dev_test_flag(hdev, HCI_SSP_ENABLED))
3641 return 0;
3642
3643 memset(hdev->eir, 0, sizeof(hdev->eir));
3644 memset(&cp, 0, sizeof(cp));
3645
3646 return __hci_cmd_sync_status(hdev, HCI_OP_WRITE_EIR, sizeof(cp), &cp,
3647 HCI_CMD_TIMEOUT);
3648}
3649
3650static int hci_write_inquiry_mode_sync(struct hci_dev *hdev)
3651{
3652 u8 mode;
3653
3654 if (!lmp_inq_rssi_capable(hdev) &&
3655 !test_bit(HCI_QUIRK_FIXUP_INQUIRY_MODE, &hdev->quirks))
3656 return 0;
3657
3658 /* If Extended Inquiry Result events are supported, then
3659 * they are clearly preferred over Inquiry Result with RSSI
3660 * events.
3661 */
3662 mode = lmp_ext_inq_capable(hdev) ? 0x02 : 0x01;
3663
3664 return __hci_cmd_sync_status(hdev, HCI_OP_WRITE_INQUIRY_MODE,
3665 sizeof(mode), &mode, HCI_CMD_TIMEOUT);
3666}
3667
3668static int hci_read_inq_rsp_tx_power_sync(struct hci_dev *hdev)
3669{
3670 if (!lmp_inq_tx_pwr_capable(hdev))
3671 return 0;
3672
3673 return __hci_cmd_sync_status(hdev, HCI_OP_READ_INQ_RSP_TX_POWER,
3674 0, NULL, HCI_CMD_TIMEOUT);
3675}
3676
3677static int hci_read_local_ext_features_sync(struct hci_dev *hdev, u8 page)
3678{
3679 struct hci_cp_read_local_ext_features cp;
3680
3681 if (!lmp_ext_feat_capable(hdev))
3682 return 0;
3683
3684 memset(&cp, 0, sizeof(cp));
3685 cp.page = page;
3686
3687 return __hci_cmd_sync_status(hdev, HCI_OP_READ_LOCAL_EXT_FEATURES,
3688 sizeof(cp), &cp, HCI_CMD_TIMEOUT);
3689}
3690
3691static int hci_read_local_ext_features_1_sync(struct hci_dev *hdev)
3692{
3693 return hci_read_local_ext_features_sync(hdev, 0x01);
3694}
3695
3696/* HCI Controller init stage 2 command sequence */
3697static const struct hci_init_stage hci_init2[] = {
3698 /* HCI_OP_READ_LOCAL_COMMANDS */
3699 HCI_INIT(hci_read_local_cmds_sync),
3700 /* HCI_OP_WRITE_SSP_MODE */
3701 HCI_INIT(hci_write_ssp_mode_1_sync),
3702 /* HCI_OP_WRITE_EIR */
3703 HCI_INIT(hci_write_eir_sync),
3704 /* HCI_OP_WRITE_INQUIRY_MODE */
3705 HCI_INIT(hci_write_inquiry_mode_sync),
3706 /* HCI_OP_READ_INQ_RSP_TX_POWER */
3707 HCI_INIT(hci_read_inq_rsp_tx_power_sync),
3708 /* HCI_OP_READ_LOCAL_EXT_FEATURES */
3709 HCI_INIT(hci_read_local_ext_features_1_sync),
3710 /* HCI_OP_WRITE_AUTH_ENABLE */
3711 HCI_INIT(hci_write_auth_enable_sync),
3712 {}
3713};
3714
3715/* Read LE Buffer Size */
3716static int hci_le_read_buffer_size_sync(struct hci_dev *hdev)
3717{
c1631dbc 3718 /* Use Read LE Buffer Size V2 if supported */
3a4d29b6 3719 if (iso_capable(hdev) && hdev->commands[41] & 0x20)
c1631dbc
LAD		 3720 return __hci_cmd_sync_status(hdev,
3721 HCI_OP_LE_READ_BUFFER_SIZE_V2,
3722 0, NULL, HCI_CMD_TIMEOUT);
3723
d0b13706
LAD		 3724 return __hci_cmd_sync_status(hdev, HCI_OP_LE_READ_BUFFER_SIZE,
3725 0, NULL, HCI_CMD_TIMEOUT);
3726}
3727
3728/* Read LE Local Supported Features */
3729static int hci_le_read_local_features_sync(struct hci_dev *hdev)
3730{
3731 return __hci_cmd_sync_status(hdev, HCI_OP_LE_READ_LOCAL_FEATURES,
3732 0, NULL, HCI_CMD_TIMEOUT);
3733}
3734
3735/* Read LE Supported States */
3736static int hci_le_read_supported_states_sync(struct hci_dev *hdev)
3737{
3738 return __hci_cmd_sync_status(hdev, HCI_OP_LE_READ_SUPPORTED_STATES,
3739 0, NULL, HCI_CMD_TIMEOUT);
3740}
3741
3742/* LE Controller init stage 2 command sequence */
3743static const struct hci_init_stage le_init2[] = {
d0b13706
LAD		 3744 /* HCI_OP_LE_READ_LOCAL_FEATURES */
3745 HCI_INIT(hci_le_read_local_features_sync),
3a4d29b6
LAD		 3746 /* HCI_OP_LE_READ_BUFFER_SIZE */
3747 HCI_INIT(hci_le_read_buffer_size_sync),
d0b13706
LAD		 3748 /* HCI_OP_LE_READ_SUPPORTED_STATES */
3749 HCI_INIT(hci_le_read_supported_states_sync),
3750 {}
3751};
3752
3753static int hci_init2_sync(struct hci_dev *hdev)
3754{
3755 int err;
3756
3757 bt_dev_dbg(hdev, "");
3758
3759 if (hdev->dev_type == HCI_AMP)
3760 return hci_init_stage_sync(hdev, amp_init2);
3761
26afbd82
LAD		 3762 err = hci_init_stage_sync(hdev, hci_init2);
3763 if (err)
3764 return err;
3765
d0b13706
LAD		 3766 if (lmp_bredr_capable(hdev)) {
3767 err = hci_init_stage_sync(hdev, br_init2);
3768 if (err)
3769 return err;
3770 } else {
3771 hci_dev_clear_flag(hdev, HCI_BREDR_ENABLED);
3772 }
3773
3774 if (lmp_le_capable(hdev)) {
3775 err = hci_init_stage_sync(hdev, le_init2);
3776 if (err)
3777 return err;
3778 /* LE-only controllers have LE implicitly enabled */
3779 if (!lmp_bredr_capable(hdev))
3780 hci_dev_set_flag(hdev, HCI_LE_ENABLED);
3781 }
3782
26afbd82 3783 return 0;
d0b13706
LAD		 3784}
3785
3786static int hci_set_event_mask_sync(struct hci_dev *hdev)
3787{
3788 /* The second byte is 0xff instead of 0x9f (two reserved bits
3789 * disabled) since a Broadcom 1.2 dongle doesn't respond to the
3790 * command otherwise.
3791 */
3792 u8 events[8] = { 0xff, 0xff, 0xfb, 0xff, 0x00, 0x00, 0x00, 0x00 };
3793
3794 /* CSR 1.1 dongles does not accept any bitfield so don't try to set
3795 * any event mask for pre 1.2 devices.
3796 */
3797 if (hdev->hci_ver < BLUETOOTH_VER_1_2)
3798 return 0;
3799
3800 if (lmp_bredr_capable(hdev)) {
3801 events[4] |= 0x01; /* Flow Specification Complete */
182ee45d
LAD		 3802
3803 /* Don't set Disconnect Complete when suspended as that
3804 * would wakeup the host when disconnecting due to
3805 * suspend.
3806 */
3807 if (hdev->suspended)
3808 events[0] &= 0xef;
d0b13706
LAD		 3809 } else {
3810 /* Use a different default for LE-only devices */
3811 memset(events, 0, sizeof(events));
3812 events[1] |= 0x20; /* Command Complete */
3813 events[1] |= 0x40; /* Command Status */
3814 events[1] |= 0x80; /* Hardware Error */
3815
3816 /* If the controller supports the Disconnect command, enable
3817 * the corresponding event. In addition enable packet flow
3818 * control related events.
3819 */
3820 if (hdev->commands[0] & 0x20) {
182ee45d
LAD		 3821 /* Don't set Disconnect Complete when suspended as that
3822 * would wakeup the host when disconnecting due to
3823 * suspend.
3824 */
3825 if (!hdev->suspended)
3826 events[0] |= 0x10; /* Disconnection Complete */
d0b13706
LAD		 3827 events[2] |= 0x04; /* Number of Completed Packets */
3828 events[3] |= 0x02; /* Data Buffer Overflow */
3829 }
3830
3831 /* If the controller supports the Read Remote Version
3832 * Information command, enable the corresponding event.
3833 */
3834 if (hdev->commands[2] & 0x80)
3835 events[1] |= 0x08; /* Read Remote Version Information
3836 * Complete
3837 */
3838
3839 if (hdev->le_features[0] & HCI_LE_ENCRYPTION) {
3840 events[0] |= 0x80; /* Encryption Change */
3841 events[5] |= 0x80; /* Encryption Key Refresh Complete */
3842 }
3843 }
3844
3845 if (lmp_inq_rssi_capable(hdev) ||
3846 test_bit(HCI_QUIRK_FIXUP_INQUIRY_MODE, &hdev->quirks))
3847 events[4] |= 0x02; /* Inquiry Result with RSSI */
3848
3849 if (lmp_ext_feat_capable(hdev))
3850 events[4] |= 0x04; /* Read Remote Extended Features Complete */
3851
3852 if (lmp_esco_capable(hdev)) {
3853 events[5] |= 0x08; /* Synchronous Connection Complete */
3854 events[5] |= 0x10; /* Synchronous Connection Changed */
3855 }
3856
3857 if (lmp_sniffsubr_capable(hdev))
3858 events[5] |= 0x20; /* Sniff Subrating */
3859
3860 if (lmp_pause_enc_capable(hdev))
3861 events[5] |= 0x80; /* Encryption Key Refresh Complete */
3862
3863 if (lmp_ext_inq_capable(hdev))
3864 events[5] |= 0x40; /* Extended Inquiry Result */
3865
3866 if (lmp_no_flush_capable(hdev))
3867 events[7] |= 0x01; /* Enhanced Flush Complete */
3868
3869 if (lmp_lsto_capable(hdev))
3870 events[6] |= 0x80; /* Link Supervision Timeout Changed */
3871
3872 if (lmp_ssp_capable(hdev)) {
3873 events[6] |= 0x01; /* IO Capability Request */
3874 events[6] |= 0x02; /* IO Capability Response */
3875 events[6] |= 0x04; /* User Confirmation Request */
3876 events[6] |= 0x08; /* User Passkey Request */
3877 events[6] |= 0x10; /* Remote OOB Data Request */
3878 events[6] |= 0x20; /* Simple Pairing Complete */
3879 events[7] |= 0x04; /* User Passkey Notification */
3880 events[7] |= 0x08; /* Keypress Notification */
3881 events[7] |= 0x10; /* Remote Host Supported
3882 * Features Notification
3883 */
3884 }
3885
3886 if (lmp_le_capable(hdev))
3887 events[7] |= 0x20; /* LE Meta-Event */
3888
3889 return __hci_cmd_sync_status(hdev, HCI_OP_SET_EVENT_MASK,
3890 sizeof(events), events, HCI_CMD_TIMEOUT);
3891}
3892
3893static int hci_read_stored_link_key_sync(struct hci_dev *hdev)
3894{
3895 struct hci_cp_read_stored_link_key cp;
3896
3897 if (!(hdev->commands[6] & 0x20) ||
3898 test_bit(HCI_QUIRK_BROKEN_STORED_LINK_KEY, &hdev->quirks))
3899 return 0;
3900
3901 memset(&cp, 0, sizeof(cp));
3902 bacpy(&cp.bdaddr, BDADDR_ANY);
3903 cp.read_all = 0x01;
3904
3905 return __hci_cmd_sync_status(hdev, HCI_OP_READ_STORED_LINK_KEY,
3906 sizeof(cp), &cp, HCI_CMD_TIMEOUT);
3907}
3908
3909static int hci_setup_link_policy_sync(struct hci_dev *hdev)
3910{
3911 struct hci_cp_write_def_link_policy cp;
3912 u16 link_policy = 0;
3913
3914 if (!(hdev->commands[5] & 0x10))
3915 return 0;
3916
3917 memset(&cp, 0, sizeof(cp));
3918
3919 if (lmp_rswitch_capable(hdev))
3920 link_policy |= HCI_LP_RSWITCH;
3921 if (lmp_hold_capable(hdev))
3922 link_policy |= HCI_LP_HOLD;
3923 if (lmp_sniff_capable(hdev))
3924 link_policy |= HCI_LP_SNIFF;
3925 if (lmp_park_capable(hdev))
3926 link_policy |= HCI_LP_PARK;
3927
3928 cp.policy = cpu_to_le16(link_policy);
3929
3930 return __hci_cmd_sync_status(hdev, HCI_OP_WRITE_DEF_LINK_POLICY,
3931 sizeof(cp), &cp, HCI_CMD_TIMEOUT);
3932}
3933
3934static int hci_read_page_scan_activity_sync(struct hci_dev *hdev)
3935{
3936 if (!(hdev->commands[8] & 0x01))
3937 return 0;
3938
3939 return __hci_cmd_sync_status(hdev, HCI_OP_READ_PAGE_SCAN_ACTIVITY,
3940 0, NULL, HCI_CMD_TIMEOUT);
3941}
3942
3943static int hci_read_def_err_data_reporting_sync(struct hci_dev *hdev)
3944{
3945 if (!(hdev->commands[18] & 0x04) ||
42d7731e
IFM		 3946 !(hdev->features[0][6] & LMP_ERR_DATA_REPORTING) ||
3947 test_bit(HCI_QUIRK_BROKEN_ERR_DATA_REPORTING, &hdev->quirks))
d0b13706
LAD		 3948 return 0;
3949
3950 return __hci_cmd_sync_status(hdev, HCI_OP_READ_DEF_ERR_DATA_REPORTING,
3951 0, NULL, HCI_CMD_TIMEOUT);
3952}
3953
3954static int hci_read_page_scan_type_sync(struct hci_dev *hdev)
3955{
3956 /* Some older Broadcom based Bluetooth 1.2 controllers do not
3957 * support the Read Page Scan Type command. Check support for
3958 * this command in the bit mask of supported commands.
3959 */
3960 if (!(hdev->commands[13] & 0x01))
3961 return 0;
3962
3963 return __hci_cmd_sync_status(hdev, HCI_OP_READ_PAGE_SCAN_TYPE,
3964 0, NULL, HCI_CMD_TIMEOUT);
3965}
3966
3967/* Read features beyond page 1 if available */
3968static int hci_read_local_ext_features_all_sync(struct hci_dev *hdev)
3969{
3970 u8 page;
3971 int err;
3972
3973 if (!lmp_ext_feat_capable(hdev))
3974 return 0;
3975
3976 for (page = 2; page < HCI_MAX_PAGES && page <= hdev->max_page;
3977 page++) {
3978 err = hci_read_local_ext_features_sync(hdev, page);
3979 if (err)
3980 return err;
3981 }
3982
3983 return 0;
3984}
3985
3986/* HCI Controller init stage 3 command sequence */
3987static const struct hci_init_stage hci_init3[] = {
3988 /* HCI_OP_SET_EVENT_MASK */
3989 HCI_INIT(hci_set_event_mask_sync),
3990 /* HCI_OP_READ_STORED_LINK_KEY */
3991 HCI_INIT(hci_read_stored_link_key_sync),
3992 /* HCI_OP_WRITE_DEF_LINK_POLICY */
3993 HCI_INIT(hci_setup_link_policy_sync),
3994 /* HCI_OP_READ_PAGE_SCAN_ACTIVITY */
3995 HCI_INIT(hci_read_page_scan_activity_sync),
3996 /* HCI_OP_READ_DEF_ERR_DATA_REPORTING */
3997 HCI_INIT(hci_read_def_err_data_reporting_sync),
3998 /* HCI_OP_READ_PAGE_SCAN_TYPE */
3999 HCI_INIT(hci_read_page_scan_type_sync),
4000 /* HCI_OP_READ_LOCAL_EXT_FEATURES */
4001 HCI_INIT(hci_read_local_ext_features_all_sync),
4002 {}
4003};
4004
4005static int hci_le_set_event_mask_sync(struct hci_dev *hdev)
4006{
4007 u8 events[8];
4008
4009 if (!lmp_le_capable(hdev))
4010 return 0;
4011
4012 memset(events, 0, sizeof(events));
4013
4014 if (hdev->le_features[0] & HCI_LE_ENCRYPTION)
4015 events[0] |= 0x10; /* LE Long Term Key Request */
4016
4017 /* If controller supports the Connection Parameters Request
4018 * Link Layer Procedure, enable the corresponding event.
4019 */
4020 if (hdev->le_features[0] & HCI_LE_CONN_PARAM_REQ_PROC)
4021 /* LE Remote Connection Parameter Request */
4022 events[0] |= 0x20;
4023
4024 /* If the controller supports the Data Length Extension
4025 * feature, enable the corresponding event.
4026 */
4027 if (hdev->le_features[0] & HCI_LE_DATA_LEN_EXT)
4028 events[0] |= 0x40; /* LE Data Length Change */
4029
a56a1138
LAD		 4030 /* If the controller supports LL Privacy feature or LE Extended Adv,
4031 * enable the corresponding event.
d0b13706 4032 */
a56a1138 4033 if (use_enhanced_conn_complete(hdev))
d0b13706
LAD		 4034 events[1] |= 0x02; /* LE Enhanced Connection Complete */
4035
4036 /* If the controller supports Extended Scanner Filter
4037 * Policies, enable the corresponding event.
4038 */
4039 if (hdev->le_features[0] & HCI_LE_EXT_SCAN_POLICY)
4040 events[1] |= 0x04; /* LE Direct Advertising Report */
4041
4042 /* If the controller supports Channel Selection Algorithm #2
4043 * feature, enable the corresponding event.
4044 */
4045 if (hdev->le_features[1] & HCI_LE_CHAN_SEL_ALG2)
4046 events[2] |= 0x08; /* LE Channel Selection Algorithm */
4047
4048 /* If the controller supports the LE Set Scan Enable command,
4049 * enable the corresponding advertising report event.
4050 */
4051 if (hdev->commands[26] & 0x08)
4052 events[0] |= 0x02; /* LE Advertising Report */
4053
4054 /* If the controller supports the LE Create Connection
4055 * command, enable the corresponding event.
4056 */
4057 if (hdev->commands[26] & 0x10)
4058 events[0] |= 0x01; /* LE Connection Complete */
4059
4060 /* If the controller supports the LE Connection Update
4061 * command, enable the corresponding event.
4062 */
4063 if (hdev->commands[27] & 0x04)
4064 events[0] |= 0x04; /* LE Connection Update Complete */
4065
4066 /* If the controller supports the LE Read Remote Used Features
4067 * command, enable the corresponding event.
4068 */
4069 if (hdev->commands[27] & 0x20)
4070 /* LE Read Remote Used Features Complete */
4071 events[0] |= 0x08;
4072
4073 /* If the controller supports the LE Read Local P-256
4074 * Public Key command, enable the corresponding event.
4075 */
4076 if (hdev->commands[34] & 0x02)
4077 /* LE Read Local P-256 Public Key Complete */
4078 events[0] |= 0x80;
4079
4080 /* If the controller supports the LE Generate DHKey
4081 * command, enable the corresponding event.
4082 */
4083 if (hdev->commands[34] & 0x04)
4084 events[1] |= 0x01; /* LE Generate DHKey Complete */
4085
4086 /* If the controller supports the LE Set Default PHY or
4087 * LE Set PHY commands, enable the corresponding event.
4088 */
4089 if (hdev->commands[35] & (0x20 | 0x40))
4090 events[1] |= 0x08; /* LE PHY Update Complete */
4091
4092 /* If the controller supports LE Set Extended Scan Parameters
4093 * and LE Set Extended Scan Enable commands, enable the
4094 * corresponding event.
4095 */
4096 if (use_ext_scan(hdev))
4097 events[1] |= 0x10; /* LE Extended Advertising Report */
4098
4099 /* If the controller supports the LE Extended Advertising
4100 * command, enable the corresponding event.
4101 */
4102 if (ext_adv_capable(hdev))
4103 events[2] |= 0x02; /* LE Advertising Set Terminated */
4104
26afbd82
LAD		 4105 if (cis_capable(hdev)) {
4106 events[3] |= 0x01; /* LE CIS Established */
4107 if (cis_peripheral_capable(hdev))
4108 events[3] |= 0x02; /* LE CIS Request */
4109 }
4110
eca0ae4a 4111 if (bis_capable(hdev)) {
c33362a5
CD		 4112 events[1] |= 0x20; /* LE PA Report */
4113 events[1] |= 0x40; /* LE PA Sync Established */
eca0ae4a
LAD		 4114 events[3] |= 0x04; /* LE Create BIG Complete */
4115 events[3] |= 0x08; /* LE Terminate BIG Complete */
4116 events[3] |= 0x10; /* LE BIG Sync Established */
4117 events[3] |= 0x20; /* LE BIG Sync Loss */
c33362a5 4118 events[4] |= 0x02; /* LE BIG Info Advertising Report */
eca0ae4a
LAD		 4119 }
4120
d0b13706
LAD		 4121 return __hci_cmd_sync_status(hdev, HCI_OP_LE_SET_EVENT_MASK,
4122 sizeof(events), events, HCI_CMD_TIMEOUT);
4123}
4124
4125/* Read LE Advertising Channel TX Power */
4126static int hci_le_read_adv_tx_power_sync(struct hci_dev *hdev)
4127{
4128 if ((hdev->commands[25] & 0x40) && !ext_adv_capable(hdev)) {
4129 /* HCI TS spec forbids mixing of legacy and extended
4130 * advertising commands wherein READ_ADV_TX_POWER is
4131 * also included. So do not call it if extended adv
4132 * is supported otherwise controller will return
4133 * COMMAND_DISALLOWED for extended commands.
4134 */
4135 return __hci_cmd_sync_status(hdev,
4136 HCI_OP_LE_READ_ADV_TX_POWER,
4137 0, NULL, HCI_CMD_TIMEOUT);
4138 }
4139
4140 return 0;
4141}
4142
4143/* Read LE Min/Max Tx Power*/
4144static int hci_le_read_tx_power_sync(struct hci_dev *hdev)
4145{
d2f8114f
AG		 4146 if (!(hdev->commands[38] & 0x80) ||
4147 test_bit(HCI_QUIRK_BROKEN_READ_TRANSMIT_POWER, &hdev->quirks))
d0b13706
LAD		 4148 return 0;
4149
4150 return __hci_cmd_sync_status(hdev, HCI_OP_LE_READ_TRANSMIT_POWER,
4151 0, NULL, HCI_CMD_TIMEOUT);
4152}
4153
4154/* Read LE Accept List Size */
4155static int hci_le_read_accept_list_size_sync(struct hci_dev *hdev)
4156{
4157 if (!(hdev->commands[26] & 0x40))
4158 return 0;
4159
4160 return __hci_cmd_sync_status(hdev, HCI_OP_LE_READ_ACCEPT_LIST_SIZE,
4161 0, NULL, HCI_CMD_TIMEOUT);
4162}
4163
4164/* Clear LE Accept List */
4165static int hci_le_clear_accept_list_sync(struct hci_dev *hdev)
4166{
4167 if (!(hdev->commands[26] & 0x80))
4168 return 0;
4169
4170 return __hci_cmd_sync_status(hdev, HCI_OP_LE_CLEAR_ACCEPT_LIST, 0, NULL,
4171 HCI_CMD_TIMEOUT);
4172}
4173
4174/* Read LE Resolving List Size */
4175static int hci_le_read_resolv_list_size_sync(struct hci_dev *hdev)
4176{
4177 if (!(hdev->commands[34] & 0x40))
4178 return 0;
4179
4180 return __hci_cmd_sync_status(hdev, HCI_OP_LE_READ_RESOLV_LIST_SIZE,
4181 0, NULL, HCI_CMD_TIMEOUT);
4182}
4183
4184/* Clear LE Resolving List */
4185static int hci_le_clear_resolv_list_sync(struct hci_dev *hdev)
4186{
4187 if (!(hdev->commands[34] & 0x20))
4188 return 0;
4189
4190 return __hci_cmd_sync_status(hdev, HCI_OP_LE_CLEAR_RESOLV_LIST, 0, NULL,
4191 HCI_CMD_TIMEOUT);
4192}
4193
4194/* Set RPA timeout */
4195static int hci_le_set_rpa_timeout_sync(struct hci_dev *hdev)
4196{
4197 __le16 timeout = cpu_to_le16(hdev->rpa_timeout);
4198
91b6d02d
RC		 4199 if (!(hdev->commands[35] & 0x04) ||
4200 test_bit(HCI_QUIRK_BROKEN_SET_RPA_TIMEOUT, &hdev->quirks))
d0b13706
LAD		 4201 return 0;
4202
4203 return __hci_cmd_sync_status(hdev, HCI_OP_LE_SET_RPA_TIMEOUT,
4204 sizeof(timeout), &timeout,
4205 HCI_CMD_TIMEOUT);
4206}
4207
4208/* Read LE Maximum Data Length */
4209static int hci_le_read_max_data_len_sync(struct hci_dev *hdev)
4210{
4211 if (!(hdev->le_features[0] & HCI_LE_DATA_LEN_EXT))
4212 return 0;
4213
4214 return __hci_cmd_sync_status(hdev, HCI_OP_LE_READ_MAX_DATA_LEN, 0, NULL,
4215 HCI_CMD_TIMEOUT);
4216}
4217
4218/* Read LE Suggested Default Data Length */
4219static int hci_le_read_def_data_len_sync(struct hci_dev *hdev)
4220{
4221 if (!(hdev->le_features[0] & HCI_LE_DATA_LEN_EXT))
4222 return 0;
4223
4224 return __hci_cmd_sync_status(hdev, HCI_OP_LE_READ_DEF_DATA_LEN, 0, NULL,
4225 HCI_CMD_TIMEOUT);
4226}
4227
4228/* Read LE Number of Supported Advertising Sets */
4229static int hci_le_read_num_support_adv_sets_sync(struct hci_dev *hdev)
4230{
4231 if (!ext_adv_capable(hdev))
4232 return 0;
4233
4234 return __hci_cmd_sync_status(hdev,
4235 HCI_OP_LE_READ_NUM_SUPPORTED_ADV_SETS,
4236 0, NULL, HCI_CMD_TIMEOUT);
4237}
4238
4239/* Write LE Host Supported */
4240static int hci_set_le_support_sync(struct hci_dev *hdev)
4241{
4242 struct hci_cp_write_le_host_supported cp;
4243
4244 /* LE-only devices do not support explicit enablement */
4245 if (!lmp_bredr_capable(hdev))
4246 return 0;
4247
4248 memset(&cp, 0, sizeof(cp));
4249
4250 if (hci_dev_test_flag(hdev, HCI_LE_ENABLED)) {
4251 cp.le = 0x01;
4252 cp.simul = 0x00;
4253 }
4254
4255 if (cp.le == lmp_host_le_capable(hdev))
4256 return 0;
4257
4258 return __hci_cmd_sync_status(hdev, HCI_OP_WRITE_LE_HOST_SUPPORTED,
4259 sizeof(cp), &cp, HCI_CMD_TIMEOUT);
4260}
4261
26afbd82
LAD		 4262/* LE Set Host Feature */
4263static int hci_le_set_host_feature_sync(struct hci_dev *hdev)
4264{
4265 struct hci_cp_le_set_host_feature cp;
4266
4267 if (!iso_capable(hdev))
4268 return 0;
4269
4270 memset(&cp, 0, sizeof(cp));
4271
4272 /* Isochronous Channels (Host Support) */
4273 cp.bit_number = 32;
4274 cp.bit_value = 1;
4275
4276 return __hci_cmd_sync_status(hdev, HCI_OP_LE_SET_HOST_FEATURE,
4277 sizeof(cp), &cp, HCI_CMD_TIMEOUT);
4278}
4279
d0b13706
LAD		 4280/* LE Controller init stage 3 command sequence */
4281static const struct hci_init_stage le_init3[] = {
4282 /* HCI_OP_LE_SET_EVENT_MASK */
4283 HCI_INIT(hci_le_set_event_mask_sync),
4284 /* HCI_OP_LE_READ_ADV_TX_POWER */
4285 HCI_INIT(hci_le_read_adv_tx_power_sync),
4286 /* HCI_OP_LE_READ_TRANSMIT_POWER */
4287 HCI_INIT(hci_le_read_tx_power_sync),
4288 /* HCI_OP_LE_READ_ACCEPT_LIST_SIZE */
4289 HCI_INIT(hci_le_read_accept_list_size_sync),
4290 /* HCI_OP_LE_CLEAR_ACCEPT_LIST */
4291 HCI_INIT(hci_le_clear_accept_list_sync),
4292 /* HCI_OP_LE_READ_RESOLV_LIST_SIZE */
4293 HCI_INIT(hci_le_read_resolv_list_size_sync),
4294 /* HCI_OP_LE_CLEAR_RESOLV_LIST */
4295 HCI_INIT(hci_le_clear_resolv_list_sync),
4296 /* HCI_OP_LE_SET_RPA_TIMEOUT */
4297 HCI_INIT(hci_le_set_rpa_timeout_sync),
4298 /* HCI_OP_LE_READ_MAX_DATA_LEN */
4299 HCI_INIT(hci_le_read_max_data_len_sync),
4300 /* HCI_OP_LE_READ_DEF_DATA_LEN */
4301 HCI_INIT(hci_le_read_def_data_len_sync),
4302 /* HCI_OP_LE_READ_NUM_SUPPORTED_ADV_SETS */
4303 HCI_INIT(hci_le_read_num_support_adv_sets_sync),
4304 /* HCI_OP_WRITE_LE_HOST_SUPPORTED */
4305 HCI_INIT(hci_set_le_support_sync),
26afbd82
LAD		 4306 /* HCI_OP_LE_SET_HOST_FEATURE */
4307 HCI_INIT(hci_le_set_host_feature_sync),
d0b13706
LAD		 4308 {}
4309};
4310
4311static int hci_init3_sync(struct hci_dev *hdev)
4312{
4313 int err;
4314
4315 bt_dev_dbg(hdev, "");
4316
4317 err = hci_init_stage_sync(hdev, hci_init3);
4318 if (err)
4319 return err;
4320
4321 if (lmp_le_capable(hdev))
4322 return hci_init_stage_sync(hdev, le_init3);
4323
4324 return 0;
4325}
4326
4327static int hci_delete_stored_link_key_sync(struct hci_dev *hdev)
4328{
4329 struct hci_cp_delete_stored_link_key cp;
4330
4331 /* Some Broadcom based Bluetooth controllers do not support the
4332 * Delete Stored Link Key command. They are clearly indicating its
4333 * absence in the bit mask of supported commands.
4334 *
4335 * Check the supported commands and only if the command is marked
4336 * as supported send it. If not supported assume that the controller
4337 * does not have actual support for stored link keys which makes this
4338 * command redundant anyway.
4339 *
4340 * Some controllers indicate that they support handling deleting
4341 * stored link keys, but they don't. The quirk lets a driver
4342 * just disable this command.
4343 */
4344 if (!(hdev->commands[6] & 0x80) ||
4345 test_bit(HCI_QUIRK_BROKEN_STORED_LINK_KEY, &hdev->quirks))
4346 return 0;
4347
4348 memset(&cp, 0, sizeof(cp));
4349 bacpy(&cp.bdaddr, BDADDR_ANY);
4350 cp.delete_all = 0x01;
4351
4352 return __hci_cmd_sync_status(hdev, HCI_OP_DELETE_STORED_LINK_KEY,
4353 sizeof(cp), &cp, HCI_CMD_TIMEOUT);
4354}
4355
4356static int hci_set_event_mask_page_2_sync(struct hci_dev *hdev)
4357{
4358 u8 events[8] = { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 };
4359 bool changed = false;
4360
4361 /* Set event mask page 2 if the HCI command for it is supported */
4362 if (!(hdev->commands[22] & 0x04))
4363 return 0;
4364
4365 /* If Connectionless Peripheral Broadcast central role is supported
4366 * enable all necessary events for it.
4367 */
4368 if (lmp_cpb_central_capable(hdev)) {
4369 events[1] |= 0x40; /* Triggered Clock Capture */
4370 events[1] |= 0x80; /* Synchronization Train Complete */
0feb8af0 4371 events[2] |= 0x08; /* Truncated Page Complete */
d0b13706
LAD		 4372 events[2] |= 0x20; /* CPB Channel Map Change */
4373 changed = true;
4374 }
4375
4376 /* If Connectionless Peripheral Broadcast peripheral role is supported
4377 * enable all necessary events for it.
4378 */
4379 if (lmp_cpb_peripheral_capable(hdev)) {
4380 events[2] |= 0x01; /* Synchronization Train Received */
4381 events[2] |= 0x02; /* CPB Receive */
4382 events[2] |= 0x04; /* CPB Timeout */
0feb8af0 4383 events[2] |= 0x10; /* Peripheral Page Response Timeout */
d0b13706
LAD		 4384 changed = true;
4385 }
4386
4387 /* Enable Authenticated Payload Timeout Expired event if supported */
4388 if (lmp_ping_capable(hdev) || hdev->le_features[0] & HCI_LE_PING) {
4389 events[2] |= 0x80;
4390 changed = true;
4391 }
4392
4393 /* Some Broadcom based controllers indicate support for Set Event
4394 * Mask Page 2 command, but then actually do not support it. Since
4395 * the default value is all bits set to zero, the command is only
4396 * required if the event mask has to be changed. In case no change
4397 * to the event mask is needed, skip this command.
4398 */
4399 if (!changed)
4400 return 0;
4401
4402 return __hci_cmd_sync_status(hdev, HCI_OP_SET_EVENT_MASK_PAGE_2,
4403 sizeof(events), events, HCI_CMD_TIMEOUT);
4404}
4405
4406/* Read local codec list if the HCI command is supported */
4407static int hci_read_local_codecs_sync(struct hci_dev *hdev)
4408{
828cea2b
C		 4409 if (hdev->commands[45] & 0x04)
4410 hci_read_supported_codecs_v2(hdev);
4411 else if (hdev->commands[29] & 0x20)
4412 hci_read_supported_codecs(hdev);
d0b13706 4413
828cea2b 4414 return 0;
d0b13706
LAD		 4415}
4416
4417/* Read local pairing options if the HCI command is supported */
4418static int hci_read_local_pairing_opts_sync(struct hci_dev *hdev)
4419{
4420 if (!(hdev->commands[41] & 0x08))
4421 return 0;
4422
4423 return __hci_cmd_sync_status(hdev, HCI_OP_READ_LOCAL_PAIRING_OPTS,
4424 0, NULL, HCI_CMD_TIMEOUT);
4425}
4426
4427/* Get MWS transport configuration if the HCI command is supported */
4428static int hci_get_mws_transport_config_sync(struct hci_dev *hdev)
4429{
ffcb0a44 4430 if (!mws_transport_config_capable(hdev))
d0b13706
LAD		 4431 return 0;
4432
4433 return __hci_cmd_sync_status(hdev, HCI_OP_GET_MWS_TRANSPORT_CONFIG,
4434 0, NULL, HCI_CMD_TIMEOUT);
4435}
4436
4437/* Check for Synchronization Train support */
4438static int hci_read_sync_train_params_sync(struct hci_dev *hdev)
4439{
4440 if (!lmp_sync_train_capable(hdev))
4441 return 0;
4442
4443 return __hci_cmd_sync_status(hdev, HCI_OP_READ_SYNC_TRAIN_PARAMS,
4444 0, NULL, HCI_CMD_TIMEOUT);
4445}
4446
4447/* Enable Secure Connections if supported and configured */
4448static int hci_write_sc_support_1_sync(struct hci_dev *hdev)
4449{
4450 u8 support = 0x01;
4451
4452 if (!hci_dev_test_flag(hdev, HCI_SSP_ENABLED) ||
4453 !bredr_sc_enabled(hdev))
4454 return 0;
4455
4456 return __hci_cmd_sync_status(hdev, HCI_OP_WRITE_SC_SUPPORT,
4457 sizeof(support), &support,
4458 HCI_CMD_TIMEOUT);
4459}
4460
4461/* Set erroneous data reporting if supported to the wideband speech
4462 * setting value
4463 */
4464static int hci_set_err_data_report_sync(struct hci_dev *hdev)
4465{
4466 struct hci_cp_write_def_err_data_reporting cp;
4467 bool enabled = hci_dev_test_flag(hdev, HCI_WIDEBAND_SPEECH_ENABLED);
4468
4469 if (!(hdev->commands[18] & 0x08) ||
42d7731e
IFM		 4470 !(hdev->features[0][6] & LMP_ERR_DATA_REPORTING) ||
4471 test_bit(HCI_QUIRK_BROKEN_ERR_DATA_REPORTING, &hdev->quirks))
d0b13706
LAD		 4472 return 0;
4473
4474 if (enabled == hdev->err_data_reporting)
4475 return 0;
4476
4477 memset(&cp, 0, sizeof(cp));
4478 cp.err_data_reporting = enabled ? ERR_DATA_REPORTING_ENABLED :
4479 ERR_DATA_REPORTING_DISABLED;
4480
4481 return __hci_cmd_sync_status(hdev, HCI_OP_WRITE_DEF_ERR_DATA_REPORTING,
4482 sizeof(cp), &cp, HCI_CMD_TIMEOUT);
4483}
4484
4485static const struct hci_init_stage hci_init4[] = {
4486 /* HCI_OP_DELETE_STORED_LINK_KEY */
4487 HCI_INIT(hci_delete_stored_link_key_sync),
4488 /* HCI_OP_SET_EVENT_MASK_PAGE_2 */
4489 HCI_INIT(hci_set_event_mask_page_2_sync),
4490 /* HCI_OP_READ_LOCAL_CODECS */
4491 HCI_INIT(hci_read_local_codecs_sync),
4492 /* HCI_OP_READ_LOCAL_PAIRING_OPTS */
4493 HCI_INIT(hci_read_local_pairing_opts_sync),
4494 /* HCI_OP_GET_MWS_TRANSPORT_CONFIG */
4495 HCI_INIT(hci_get_mws_transport_config_sync),
4496 /* HCI_OP_READ_SYNC_TRAIN_PARAMS */
4497 HCI_INIT(hci_read_sync_train_params_sync),
4498 /* HCI_OP_WRITE_SC_SUPPORT */
4499 HCI_INIT(hci_write_sc_support_1_sync),
4500 /* HCI_OP_WRITE_DEF_ERR_DATA_REPORTING */
4501 HCI_INIT(hci_set_err_data_report_sync),
4502 {}
4503};
4504
4505/* Set Suggested Default Data Length to maximum if supported */
4506static int hci_le_set_write_def_data_len_sync(struct hci_dev *hdev)
4507{
4508 struct hci_cp_le_write_def_data_len cp;
4509
4510 if (!(hdev->le_features[0] & HCI_LE_DATA_LEN_EXT))
4511 return 0;
4512
4513 memset(&cp, 0, sizeof(cp));
4514 cp.tx_len = cpu_to_le16(hdev->le_max_tx_len);
4515 cp.tx_time = cpu_to_le16(hdev->le_max_tx_time);
4516
4517 return __hci_cmd_sync_status(hdev, HCI_OP_LE_WRITE_DEF_DATA_LEN,
4518 sizeof(cp), &cp, HCI_CMD_TIMEOUT);
4519}
4520
288c9022
LAD		 4521/* Set Default PHY parameters if command is supported, enables all supported
4522 * PHYs according to the LE Features bits.
4523 */
d0b13706
LAD		 4524static int hci_le_set_default_phy_sync(struct hci_dev *hdev)
4525{
4526 struct hci_cp_le_set_default_phy cp;
4527
288c9022
LAD		 4528 if (!(hdev->commands[35] & 0x20)) {
4529 /* If the command is not supported it means only 1M PHY is
4530 * supported.
4531 */
4532 hdev->le_tx_def_phys = HCI_LE_SET_PHY_1M;
4533 hdev->le_rx_def_phys = HCI_LE_SET_PHY_1M;
d0b13706 4534 return 0;
288c9022 4535 }
d0b13706
LAD		 4536
4537 memset(&cp, 0, sizeof(cp));
4538 cp.all_phys = 0x00;
288c9022
LAD		 4539 cp.tx_phys = HCI_LE_SET_PHY_1M;
4540 cp.rx_phys = HCI_LE_SET_PHY_1M;
4541
4542 /* Enables 2M PHY if supported */
4543 if (le_2m_capable(hdev)) {
4544 cp.tx_phys |= HCI_LE_SET_PHY_2M;
4545 cp.rx_phys |= HCI_LE_SET_PHY_2M;
4546 }
4547
4548 /* Enables Coded PHY if supported */
4549 if (le_coded_capable(hdev)) {
4550 cp.tx_phys |= HCI_LE_SET_PHY_CODED;
4551 cp.rx_phys |= HCI_LE_SET_PHY_CODED;
4552 }
d0b13706
LAD		 4553
4554 return __hci_cmd_sync_status(hdev, HCI_OP_LE_SET_DEFAULT_PHY,
4555 sizeof(cp), &cp, HCI_CMD_TIMEOUT);
4556}
4557
4558static const struct hci_init_stage le_init4[] = {
4559 /* HCI_OP_LE_WRITE_DEF_DATA_LEN */
4560 HCI_INIT(hci_le_set_write_def_data_len_sync),
4561 /* HCI_OP_LE_SET_DEFAULT_PHY */
4562 HCI_INIT(hci_le_set_default_phy_sync),
4563 {}
4564};
4565
4566static int hci_init4_sync(struct hci_dev *hdev)
4567{
4568 int err;
4569
4570 bt_dev_dbg(hdev, "");
4571
4572 err = hci_init_stage_sync(hdev, hci_init4);
4573 if (err)
4574 return err;
4575
4576 if (lmp_le_capable(hdev))
4577 return hci_init_stage_sync(hdev, le_init4);
4578
4579 return 0;
4580}
4581
4582static int hci_init_sync(struct hci_dev *hdev)
4583{
4584 int err;
4585
4586 err = hci_init1_sync(hdev);
4587 if (err < 0)
4588 return err;
4589
4590 if (hci_dev_test_flag(hdev, HCI_SETUP))
4591 hci_debugfs_create_basic(hdev);
4592
4593 err = hci_init2_sync(hdev);
4594 if (err < 0)
4595 return err;
4596
4597 /* HCI_PRIMARY covers both single-mode LE, BR/EDR and dual-mode
4598 * BR/EDR/LE type controllers. AMP controllers only need the
4599 * first two stages of init.
4600 */
4601 if (hdev->dev_type != HCI_PRIMARY)
4602 return 0;
4603
4604 err = hci_init3_sync(hdev);
4605 if (err < 0)
4606 return err;
4607
4608 err = hci_init4_sync(hdev);
4609 if (err < 0)
4610 return err;
4611
4612 /* This function is only called when the controller is actually in
4613 * configured state. When the controller is marked as unconfigured,
4614 * this initialization procedure is not run.
4615 *
4616 * It means that it is possible that a controller runs through its
4617 * setup phase and then discovers missing settings. If that is the
4618 * case, then this function will not be called. It then will only
4619 * be called during the config phase.
4620 *
4621 * So only when in setup phase or config phase, create the debugfs
4622 * entries and register the SMP channels.
4623 */
4624 if (!hci_dev_test_flag(hdev, HCI_SETUP) &&
4625 !hci_dev_test_flag(hdev, HCI_CONFIG))
4626 return 0;
4627
fe2ccc6c
JH		 4628 if (hci_dev_test_and_set_flag(hdev, HCI_DEBUGFS_CREATED))
4629 return 0;
4630
d0b13706
LAD		 4631 hci_debugfs_create_common(hdev);
4632
4633 if (lmp_bredr_capable(hdev))
4634 hci_debugfs_create_bredr(hdev);
4635
4636 if (lmp_le_capable(hdev))
4637 hci_debugfs_create_le(hdev);
4638
4639 return 0;
4640}
4641
6b5c1cda
LAD		 4642#define HCI_QUIRK_BROKEN(_quirk, _desc) { HCI_QUIRK_BROKEN_##_quirk, _desc }
4643
4644static const struct {
4645 unsigned long quirk;
4646 const char *desc;
4647} hci_broken_table[] = {
4648 HCI_QUIRK_BROKEN(LOCAL_COMMANDS,
4649 "HCI Read Local Supported Commands not supported"),
4650 HCI_QUIRK_BROKEN(STORED_LINK_KEY,
4651 "HCI Delete Stored Link Key command is advertised, "
4652 "but not supported."),
42d7731e
IFM		 4653 HCI_QUIRK_BROKEN(ERR_DATA_REPORTING,
4654 "HCI Read Default Erroneous Data Reporting command is "
4655 "advertised, but not supported."),
6b5c1cda
LAD		 4656 HCI_QUIRK_BROKEN(READ_TRANSMIT_POWER,
4657 "HCI Read Transmit Power Level command is advertised, "
4658 "but not supported."),
4659 HCI_QUIRK_BROKEN(FILTER_CLEAR_ALL,
4660 "HCI Set Event Filter command not supported."),
4661 HCI_QUIRK_BROKEN(ENHANCED_SETUP_SYNC_CONN,
4662 "HCI Enhanced Setup Synchronous Connection command is "
91b6d02d
RC		 4663 "advertised, but not supported."),
4664 HCI_QUIRK_BROKEN(SET_RPA_TIMEOUT,
4665 "HCI LE Set Random Private Address Timeout command is "
253f3399
LAD		 4666 "advertised, but not supported."),
4667 HCI_QUIRK_BROKEN(LE_CODED,
4668 "HCI LE Coded PHY feature bit is set, "
4669 "but its usage is not supported.")
6b5c1cda
LAD		 4670};
4671
1bbf4023
LAD		 4672/* This function handles hdev setup stage:
4673 *
4674 * Calls hdev->setup
4675 * Setup address if HCI_QUIRK_USE_BDADDR_PROPERTY is set.
4676 */
4677static int hci_dev_setup_sync(struct hci_dev *hdev)
d0b13706
LAD		 4678{
4679 int ret = 0;
1bbf4023
LAD		 4680 bool invalid_bdaddr;
4681 size_t i;
d0b13706
LAD		 4682
4683 if (!hci_dev_test_flag(hdev, HCI_SETUP) &&
1bbf4023
LAD		 4684 !test_bit(HCI_QUIRK_NON_PERSISTENT_SETUP, &hdev->quirks))
4685 return 0;
d0b13706 4686
1bbf4023 4687 bt_dev_dbg(hdev, "");
d0b13706 4688
1bbf4023 4689 hci_sock_dev_event(hdev, HCI_DEV_SETUP);
d0b13706 4690
1bbf4023
LAD		 4691 if (hdev->setup)
4692 ret = hdev->setup(hdev);
6b5c1cda 4693
1bbf4023
LAD		 4694 for (i = 0; i < ARRAY_SIZE(hci_broken_table); i++) {
4695 if (test_bit(hci_broken_table[i].quirk, &hdev->quirks))
4696 bt_dev_warn(hdev, "%s", hci_broken_table[i].desc);
4697 }
d0b13706 4698
1bbf4023
LAD		 4699 /* The transport driver can set the quirk to mark the
4700 * BD_ADDR invalid before creating the HCI device or in
4701 * its setup callback.
4702 */
6945795b
JH		 4703 invalid_bdaddr = test_bit(HCI_QUIRK_INVALID_BDADDR, &hdev->quirks) ||
4704 test_bit(HCI_QUIRK_USE_BDADDR_PROPERTY, &hdev->quirks);
1bbf4023 4705 if (!ret) {
0cb73658
JH		 4706 if (test_bit(HCI_QUIRK_USE_BDADDR_PROPERTY, &hdev->quirks) &&
4707 !bacmp(&hdev->public_addr, BDADDR_ANY))
4708 hci_dev_get_bd_addr_from_property(hdev);
4709
6945795b 4710 if (invalid_bdaddr && bacmp(&hdev->public_addr, BDADDR_ANY) &&
0cb73658
JH		 4711 hdev->set_bdaddr) {
4712 ret = hdev->set_bdaddr(hdev, &hdev->public_addr);
4713 if (!ret)
4714 invalid_bdaddr = false;
d0b13706 4715 }
1bbf4023 4716 }
d0b13706 4717
1bbf4023
LAD		 4718 /* The transport driver can set these quirks before
4719 * creating the HCI device or in its setup callback.
4720 *
4721 * For the invalid BD_ADDR quirk it is possible that
4722 * it becomes a valid address if the bootloader does
4723 * provide it (see above).
4724 *
4725 * In case any of them is set, the controller has to
4726 * start up as unconfigured.
4727 */
4728 if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks) ||
4729 invalid_bdaddr)
4730 hci_dev_set_flag(hdev, HCI_UNCONFIGURED);
d0b13706 4731
1bbf4023
LAD		 4732 /* For an unconfigured controller it is required to
4733 * read at least the version information provided by
4734 * the Read Local Version Information command.
4735 *
4736 * If the set_bdaddr driver callback is provided, then
4737 * also the original Bluetooth public device address
4738 * will be read using the Read BD Address command.
4739 */
4740 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED))
4741 return hci_unconf_init_sync(hdev);
4742
4743 return ret;
4744}
4745
4746/* This function handles hdev init stage:
4747 *
4748 * Calls hci_dev_setup_sync to perform setup stage
4749 * Calls hci_init_sync to perform HCI command init sequence
4750 */
4751static int hci_dev_init_sync(struct hci_dev *hdev)
4752{
4753 int ret;
4754
4755 bt_dev_dbg(hdev, "");
4756
4757 atomic_set(&hdev->cmd_cnt, 1);
4758 set_bit(HCI_INIT, &hdev->flags);
4759
4760 ret = hci_dev_setup_sync(hdev);
d0b13706
LAD		 4761
4762 if (hci_dev_test_flag(hdev, HCI_CONFIG)) {
4763 /* If public address change is configured, ensure that
4764 * the address gets programmed. If the driver does not
4765 * support changing the public address, fail the power
4766 * on procedure.
4767 */
4768 if (bacmp(&hdev->public_addr, BDADDR_ANY) &&
4769 hdev->set_bdaddr)
4770 ret = hdev->set_bdaddr(hdev, &hdev->public_addr);
4771 else
4772 ret = -EADDRNOTAVAIL;
4773 }
4774
4775 if (!ret) {
4776 if (!hci_dev_test_flag(hdev, HCI_UNCONFIGURED) &&
4777 !hci_dev_test_flag(hdev, HCI_USER_CHANNEL)) {
4778 ret = hci_init_sync(hdev);
4779 if (!ret && hdev->post_init)
4780 ret = hdev->post_init(hdev);
4781 }
4782 }
4783
4784 /* If the HCI Reset command is clearing all diagnostic settings,
4785 * then they need to be reprogrammed after the init procedure
4786 * completed.
4787 */
4788 if (test_bit(HCI_QUIRK_NON_PERSISTENT_DIAG, &hdev->quirks) &&
4789 !hci_dev_test_flag(hdev, HCI_USER_CHANNEL) &&
4790 hci_dev_test_flag(hdev, HCI_VENDOR_DIAG) && hdev->set_diag)
4791 ret = hdev->set_diag(hdev, true);
4792
385315de
JM		 4793 if (!hci_dev_test_flag(hdev, HCI_USER_CHANNEL)) {
4794 msft_do_open(hdev);
4795 aosp_do_open(hdev);
4796 }
d0b13706
LAD		 4797
4798 clear_bit(HCI_INIT, &hdev->flags);
4799
1bbf4023
LAD		 4800 return ret;
4801}
4802
4803int hci_dev_open_sync(struct hci_dev *hdev)
4804{
4805 int ret;
4806
4807 bt_dev_dbg(hdev, "");
4808
4809 if (hci_dev_test_flag(hdev, HCI_UNREGISTER)) {
4810 ret = -ENODEV;
4811 goto done;
4812 }
4813
4814 if (!hci_dev_test_flag(hdev, HCI_SETUP) &&
4815 !hci_dev_test_flag(hdev, HCI_CONFIG)) {
4816 /* Check for rfkill but allow the HCI setup stage to
4817 * proceed (which in itself doesn't cause any RF activity).
4818 */
4819 if (hci_dev_test_flag(hdev, HCI_RFKILLED)) {
4820 ret = -ERFKILL;
4821 goto done;
4822 }
4823
4824 /* Check for valid public address or a configured static
4825 * random address, but let the HCI setup proceed to
4826 * be able to determine if there is a public address
4827 * or not.
4828 *
4829 * In case of user channel usage, it is not important
4830 * if a public address or static random address is
4831 * available.
4832 *
4833 * This check is only valid for BR/EDR controllers
4834 * since AMP controllers do not have an address.
4835 */
4836 if (!hci_dev_test_flag(hdev, HCI_USER_CHANNEL) &&
4837 hdev->dev_type == HCI_PRIMARY &&
4838 !bacmp(&hdev->bdaddr, BDADDR_ANY) &&
4839 !bacmp(&hdev->static_addr, BDADDR_ANY)) {
4840 ret = -EADDRNOTAVAIL;
4841 goto done;
4842 }
4843 }
4844
4845 if (test_bit(HCI_UP, &hdev->flags)) {
4846 ret = -EALREADY;
4847 goto done;
4848 }
4849
4850 if (hdev->open(hdev)) {
4851 ret = -EIO;
4852 goto done;
4853 }
4854
9695ef87
APS		 4855 hci_devcd_reset(hdev);
4856
1bbf4023
LAD		 4857 set_bit(HCI_RUNNING, &hdev->flags);
4858 hci_sock_dev_event(hdev, HCI_DEV_OPEN);
4859
4860 ret = hci_dev_init_sync(hdev);
d0b13706
LAD		 4861 if (!ret) {
4862 hci_dev_hold(hdev);
4863 hci_dev_set_flag(hdev, HCI_RPA_EXPIRED);
4864 hci_adv_instances_set_rpa_expired(hdev, true);
4865 set_bit(HCI_UP, &hdev->flags);
4866 hci_sock_dev_event(hdev, HCI_DEV_UP);
4867 hci_leds_update_powered(hdev, true);
4868 if (!hci_dev_test_flag(hdev, HCI_SETUP) &&
4869 !hci_dev_test_flag(hdev, HCI_CONFIG) &&
4870 !hci_dev_test_flag(hdev, HCI_UNCONFIGURED) &&
4871 !hci_dev_test_flag(hdev, HCI_USER_CHANNEL) &&
4872 hci_dev_test_flag(hdev, HCI_MGMT) &&
4873 hdev->dev_type == HCI_PRIMARY) {
4874 ret = hci_powered_update_sync(hdev);
6abf0dae 4875 mgmt_power_on(hdev, ret);
d0b13706
LAD		 4876 }
4877 } else {
4878 /* Init failed, cleanup */
4879 flush_work(&hdev->tx_work);
4880
4881 /* Since hci_rx_work() is possible to awake new cmd_work
4882 * it should be flushed first to avoid unexpected call of
4883 * hci_cmd_work()
4884 */
4885 flush_work(&hdev->rx_work);
4886 flush_work(&hdev->cmd_work);
4887
4888 skb_queue_purge(&hdev->cmd_q);
4889 skb_queue_purge(&hdev->rx_q);
4890
4891 if (hdev->flush)
4892 hdev->flush(hdev);
4893
4894 if (hdev->sent_cmd) {
97dfaf07 4895 cancel_delayed_work_sync(&hdev->cmd_timer);
d0b13706
LAD		 4896 kfree_skb(hdev->sent_cmd);
4897 hdev->sent_cmd = NULL;
4898 }
4899
4900 clear_bit(HCI_RUNNING, &hdev->flags);
4901 hci_sock_dev_event(hdev, HCI_DEV_CLOSE);
4902
4903 hdev->close(hdev);
4904 hdev->flags &= BIT(HCI_RAW);
4905 }
4906
4907done:
4908 return ret;
4909}
4910
4911/* This function requires the caller holds hdev->lock */
4912static void hci_pend_le_actions_clear(struct hci_dev *hdev)
4913{
4914 struct hci_conn_params *p;
4915
4916 list_for_each_entry(p, &hdev->le_conn_params, list) {
195ef75e 4917 hci_pend_le_list_del_init(p);
d0b13706
LAD		 4918 if (p->conn) {
4919 hci_conn_drop(p->conn);
4920 hci_conn_put(p->conn);
4921 p->conn = NULL;
4922 }
d0b13706
LAD		 4923 }
4924
4925 BT_DBG("All LE pending actions cleared");
4926}
4927
8dbc3e75
APS		 4928static int hci_dev_shutdown(struct hci_dev *hdev)
4929{
4930 int err = 0;
4931 /* Similar to how we first do setup and then set the exclusive access
4932 * bit for userspace, we must first unset userchannel and then clean up.
4933 * Otherwise, the kernel can't properly use the hci channel to clean up
4934 * the controller (some shutdown routines require sending additional
4935 * commands to the controller for example).
4936 */
4937 bool was_userchannel =
4938 hci_dev_test_and_clear_flag(hdev, HCI_USER_CHANNEL);
4939
4940 if (!hci_dev_test_flag(hdev, HCI_UNREGISTER) &&
4941 test_bit(HCI_UP, &hdev->flags)) {
4942 /* Execute vendor specific shutdown routine */
4943 if (hdev->shutdown)
4944 err = hdev->shutdown(hdev);
4945 }
4946
4947 if (was_userchannel)
4948 hci_dev_set_flag(hdev, HCI_USER_CHANNEL);
4949
4950 return err;
4951}
4952
d0b13706
LAD		 4953int hci_dev_close_sync(struct hci_dev *hdev)
4954{
4955 bool auto_off;
4956 int err = 0;
4957
4958 bt_dev_dbg(hdev, "");
4959
4960 cancel_delayed_work(&hdev->power_off);
4961 cancel_delayed_work(&hdev->ncmd_timer);
8ffde2a7 4962 cancel_delayed_work(&hdev->le_scan_disable);
27d54b77 4963 cancel_delayed_work(&hdev->le_scan_restart);
d0b13706
LAD		 4964
4965 hci_request_cancel_all(hdev);
4966
c249ea9b
BG		 4967 if (hdev->adv_instance_timeout) {
4968 cancel_delayed_work_sync(&hdev->adv_instance_expire);
4969 hdev->adv_instance_timeout = 0;
4970 }
4971
8dbc3e75 4972 err = hci_dev_shutdown(hdev);
d0b13706
LAD		 4973
4974 if (!test_and_clear_bit(HCI_UP, &hdev->flags)) {
4975 cancel_delayed_work_sync(&hdev->cmd_timer);
4976 return err;
4977 }
4978
4979 hci_leds_update_powered(hdev, false);
4980
4981 /* Flush RX and TX works */
4982 flush_work(&hdev->tx_work);
4983 flush_work(&hdev->rx_work);
4984
4985 if (hdev->discov_timeout > 0) {
4986 hdev->discov_timeout = 0;
4987 hci_dev_clear_flag(hdev, HCI_DISCOVERABLE);
4988 hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE);
4989 }
4990
4991 if (hci_dev_test_and_clear_flag(hdev, HCI_SERVICE_CACHE))
4992 cancel_delayed_work(&hdev->service_cache);
4993
4994 if (hci_dev_test_flag(hdev, HCI_MGMT)) {
4995 struct adv_info *adv_instance;
4996
4997 cancel_delayed_work_sync(&hdev->rpa_expired);
4998
4999 list_for_each_entry(adv_instance, &hdev->adv_instances, list)
5000 cancel_delayed_work_sync(&adv_instance->rpa_expired_cb);
5001 }
5002
5003 /* Avoid potential lockdep warnings from the *_flush() calls by
5004 * ensuring the workqueue is empty up front.
5005 */
5006 drain_workqueue(hdev->workqueue);
5007
5008 hci_dev_lock(hdev);
5009
5010 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
5011
5012 auto_off = hci_dev_test_and_clear_flag(hdev, HCI_AUTO_OFF);
5013
5014 if (!auto_off && hdev->dev_type == HCI_PRIMARY &&
5015 !hci_dev_test_flag(hdev, HCI_USER_CHANNEL) &&
5016 hci_dev_test_flag(hdev, HCI_MGMT))
5017 __mgmt_power_off(hdev);
5018
5019 hci_inquiry_cache_flush(hdev);
5020 hci_pend_le_actions_clear(hdev);
5021 hci_conn_hash_flush(hdev);
fa78d2d1 5022 /* Prevent data races on hdev->smp_data or hdev->smp_bredr_data */
d0b13706 5023 smp_unregister(hdev);
fa78d2d1 5024 hci_dev_unlock(hdev);
d0b13706
LAD		 5025
5026 hci_sock_dev_event(hdev, HCI_DEV_DOWN);
5027
385315de
JM		 5028 if (!hci_dev_test_flag(hdev, HCI_USER_CHANNEL)) {
5029 aosp_do_close(hdev);
5030 msft_do_close(hdev);
5031 }
d0b13706
LAD		 5032
5033 if (hdev->flush)
5034 hdev->flush(hdev);
5035
5036 /* Reset device */
5037 skb_queue_purge(&hdev->cmd_q);
5038 atomic_set(&hdev->cmd_cnt, 1);
5039 if (test_bit(HCI_QUIRK_RESET_ON_CLOSE, &hdev->quirks) &&
5040 !auto_off && !hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) {
5041 set_bit(HCI_INIT, &hdev->flags);
5042 hci_reset_sync(hdev);
5043 clear_bit(HCI_INIT, &hdev->flags);
5044 }
5045
5046 /* flush cmd work */
5047 flush_work(&hdev->cmd_work);
5048
5049 /* Drop queues */
5050 skb_queue_purge(&hdev->rx_q);
5051 skb_queue_purge(&hdev->cmd_q);
5052 skb_queue_purge(&hdev->raw_q);
5053
5054 /* Drop last sent command */
5055 if (hdev->sent_cmd) {
5056 cancel_delayed_work_sync(&hdev->cmd_timer);
5057 kfree_skb(hdev->sent_cmd);
5058 hdev->sent_cmd = NULL;
5059 }
5060
5061 clear_bit(HCI_RUNNING, &hdev->flags);
5062 hci_sock_dev_event(hdev, HCI_DEV_CLOSE);
5063
d0b13706
LAD		 5064 /* After this point our queues are empty and no tasks are scheduled. */
5065 hdev->close(hdev);
5066
5067 /* Clear flags */
5068 hdev->flags &= BIT(HCI_RAW);
5069 hci_dev_clear_volatile_flags(hdev);
5070
5071 /* Controller radio is available but is currently powered down */
5072 hdev->amp_status = AMP_STATUS_POWERED_DOWN;
5073
5074 memset(hdev->eir, 0, sizeof(hdev->eir));
5075 memset(hdev->dev_class, 0, sizeof(hdev->dev_class));
5076 bacpy(&hdev->random_addr, BDADDR_ANY);
b938790e 5077 hci_codec_list_clear(&hdev->local_codecs);
d0b13706
LAD		 5078
5079 hci_dev_put(hdev);
5080 return err;
5081}
5082
5083/* This function perform power on HCI command sequence as follows:
5084 *
5085 * If controller is already up (HCI_UP) performs hci_powered_update_sync
5086 * sequence otherwise run hci_dev_open_sync which will follow with
5087 * hci_powered_update_sync after the init sequence is completed.
5088 */
5089static int hci_power_on_sync(struct hci_dev *hdev)
5090{
5091 int err;
5092
5093 if (test_bit(HCI_UP, &hdev->flags) &&
5094 hci_dev_test_flag(hdev, HCI_MGMT) &&
5095 hci_dev_test_and_clear_flag(hdev, HCI_AUTO_OFF)) {
5096 cancel_delayed_work(&hdev->power_off);
5097 return hci_powered_update_sync(hdev);
5098 }
5099
5100 err = hci_dev_open_sync(hdev);
5101 if (err < 0)
5102 return err;
5103
5104 /* During the HCI setup phase, a few error conditions are
5105 * ignored and they need to be checked now. If they are still
5106 * valid, it is important to return the device back off.
5107 */
5108 if (hci_dev_test_flag(hdev, HCI_RFKILLED) ||
5109 hci_dev_test_flag(hdev, HCI_UNCONFIGURED) ||
5110 (hdev->dev_type == HCI_PRIMARY &&
5111 !bacmp(&hdev->bdaddr, BDADDR_ANY) &&
5112 !bacmp(&hdev->static_addr, BDADDR_ANY))) {
5113 hci_dev_clear_flag(hdev, HCI_AUTO_OFF);
5114 hci_dev_close_sync(hdev);
5115 } else if (hci_dev_test_flag(hdev, HCI_AUTO_OFF)) {
5116 queue_delayed_work(hdev->req_workqueue, &hdev->power_off,
5117 HCI_AUTO_OFF_TIMEOUT);
5118 }
5119
5120 if (hci_dev_test_and_clear_flag(hdev, HCI_SETUP)) {
5121 /* For unconfigured devices, set the HCI_RAW flag
5122 * so that userspace can easily identify them.
5123 */
5124 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED))
5125 set_bit(HCI_RAW, &hdev->flags);
5126
5127 /* For fully configured devices, this will send
5128 * the Index Added event. For unconfigured devices,
5129 * it will send Unconfigued Index Added event.
5130 *
5131 * Devices with HCI_QUIRK_RAW_DEVICE are ignored
5132 * and no event will be send.
5133 */
5134 mgmt_index_added(hdev);
5135 } else if (hci_dev_test_and_clear_flag(hdev, HCI_CONFIG)) {
5136 /* When the controller is now configured, then it
5137 * is important to clear the HCI_RAW flag.
5138 */
5139 if (!hci_dev_test_flag(hdev, HCI_UNCONFIGURED))
5140 clear_bit(HCI_RAW, &hdev->flags);
5141
5142 /* Powering on the controller with HCI_CONFIG set only
5143 * happens with the transition from unconfigured to
5144 * configured. This will send the Index Added event.
5145 */
5146 mgmt_index_added(hdev);
5147 }
5148
5149 return 0;
5150}
5151
5152static int hci_remote_name_cancel_sync(struct hci_dev *hdev, bdaddr_t *addr)
5153{
5154 struct hci_cp_remote_name_req_cancel cp;
5155
5156 memset(&cp, 0, sizeof(cp));
5157 bacpy(&cp.bdaddr, addr);
5158
5159 return __hci_cmd_sync_status(hdev, HCI_OP_REMOTE_NAME_REQ_CANCEL,
5160 sizeof(cp), &cp, HCI_CMD_TIMEOUT);
5161}
5162
5163int hci_stop_discovery_sync(struct hci_dev *hdev)
5164{
5165 struct discovery_state *d = &hdev->discovery;
5166 struct inquiry_entry *e;
5167 int err;
5168
5169 bt_dev_dbg(hdev, "state %u", hdev->discovery.state);
5170
5171 if (d->state == DISCOVERY_FINDING || d->state == DISCOVERY_STOPPING) {
5172 if (test_bit(HCI_INQUIRY, &hdev->flags)) {
5173 err = __hci_cmd_sync_status(hdev, HCI_OP_INQUIRY_CANCEL,
5174 0, NULL, HCI_CMD_TIMEOUT);
5175 if (err)
5176 return err;
5177 }
5178
5179 if (hci_dev_test_flag(hdev, HCI_LE_SCAN)) {
5180 cancel_delayed_work(&hdev->le_scan_disable);
5181 cancel_delayed_work(&hdev->le_scan_restart);
5182
5183 err = hci_scan_disable_sync(hdev);
5184 if (err)
5185 return err;
5186 }
5187
5188 } else {
5189 err = hci_scan_disable_sync(hdev);
5190 if (err)
5191 return err;
5192 }
5193
5194 /* Resume advertising if it was paused */
5195 if (use_ll_privacy(hdev))
5196 hci_resume_advertising_sync(hdev);
5197
5198 /* No further actions needed for LE-only discovery */
5199 if (d->type == DISCOV_TYPE_LE)
5200 return 0;
5201
5202 if (d->state == DISCOVERY_RESOLVING || d->state == DISCOVERY_STOPPING) {
5203 e = hci_inquiry_cache_lookup_resolve(hdev, BDADDR_ANY,
5204 NAME_PENDING);
5205 if (!e)
5206 return 0;
5207
5208 return hci_remote_name_cancel_sync(hdev, &e->data.bdaddr);
5209 }
5210
5211 return 0;
5212}
5213
5214static int hci_disconnect_phy_link_sync(struct hci_dev *hdev, u16 handle,
5215 u8 reason)
5216{
5217 struct hci_cp_disconn_phy_link cp;
5218
5219 memset(&cp, 0, sizeof(cp));
5220 cp.phy_handle = HCI_PHY_HANDLE(handle);
5221 cp.reason = reason;
5222
5223 return __hci_cmd_sync_status(hdev, HCI_OP_DISCONN_PHY_LINK,
5224 sizeof(cp), &cp, HCI_CMD_TIMEOUT);
5225}
5226
5227static int hci_disconnect_sync(struct hci_dev *hdev, struct hci_conn *conn,
5228 u8 reason)
5229{
5230 struct hci_cp_disconnect cp;
5231
5232 if (conn->type == AMP_LINK)
5233 return hci_disconnect_phy_link_sync(hdev, conn->handle, reason);
5234
5235 memset(&cp, 0, sizeof(cp));
5236 cp.handle = cpu_to_le16(conn->handle);
5237 cp.reason = reason;
5238
f5d13029
AP		 5239 /* Wait for HCI_EV_DISCONN_COMPLETE, not HCI_EV_CMD_STATUS, when the
5240 * reason is anything but HCI_ERROR_REMOTE_POWER_OFF. This reason is
5241 * used when suspending or powering off, where we don't want to wait
5242 * for the peer's response.
d0b13706 5243 */
f5d13029 5244 if (reason != HCI_ERROR_REMOTE_POWER_OFF)
d0b13706
LAD		 5245 return __hci_cmd_sync_status_sk(hdev, HCI_OP_DISCONNECT,
5246 sizeof(cp), &cp,
5247 HCI_EV_DISCONN_COMPLETE,
5248 HCI_CMD_TIMEOUT, NULL);
5249
5250 return __hci_cmd_sync_status(hdev, HCI_OP_DISCONNECT, sizeof(cp), &cp,
5251 HCI_CMD_TIMEOUT);
5252}
5253
5254static int hci_le_connect_cancel_sync(struct hci_dev *hdev,
a13f316e 5255 struct hci_conn *conn, u8 reason)
d0b13706 5256{
a13f316e
LAD		 5257 /* Return reason if scanning since the connection shall probably be
5258 * cleanup directly.
5259 */
d0b13706 5260 if (test_bit(HCI_CONN_SCANNING, &conn->flags))
a13f316e 5261 return reason;
d0b13706 5262
a13f316e
LAD		 5263 if (conn->role == HCI_ROLE_SLAVE ||
5264 test_and_set_bit(HCI_CONN_CANCEL, &conn->flags))
b62e7220
LAD		 5265 return 0;
5266
d0b13706 5267 return __hci_cmd_sync_status(hdev, HCI_OP_LE_CREATE_CONN_CANCEL,
b62e7220 5268 0, NULL, HCI_CMD_TIMEOUT);
d0b13706
LAD		 5269}
5270
a13f316e
LAD		 5271static int hci_connect_cancel_sync(struct hci_dev *hdev, struct hci_conn *conn,
5272 u8 reason)
d0b13706
LAD		 5273{
5274 if (conn->type == LE_LINK)
a13f316e 5275 return hci_le_connect_cancel_sync(hdev, conn, reason);
d0b13706 5276
04a51d61
LAD		 5277 if (conn->type == ISO_LINK) {
5278 /* BLUETOOTH CORE SPECIFICATION Version 5.3 | Vol 4, Part E
5279 * page 1857:
5280 *
5281 * If this command is issued for a CIS on the Central and the
5282 * CIS is successfully terminated before being established,
5283 * then an HCI_LE_CIS_Established event shall also be sent for
5284 * this CIS with the Status Operation Cancelled by Host (0x44).
5285 */
5286 if (test_bit(HCI_CONN_CREATE_CIS, &conn->flags))
5287 return hci_disconnect_sync(hdev, conn, reason);
5288
2889bdd0
PV		 5289 /* CIS with no Create CIS sent have nothing to cancel */
5290 if (bacmp(&conn->dst, BDADDR_ANY))
5291 return HCI_ERROR_LOCAL_HOST_TERM;
5292
04a51d61
LAD		 5293 /* There is no way to cancel a BIS without terminating the BIG
5294 * which is done later on connection cleanup.
5295 */
5296 return 0;
5297 }
5298
d0b13706
LAD		 5299 if (hdev->hci_ver < BLUETOOTH_VER_1_2)
5300 return 0;
5301
094e3639
LAD		 5302 /* Wait for HCI_EV_CONN_COMPLETE, not HCI_EV_CMD_STATUS, when the
5303 * reason is anything but HCI_ERROR_REMOTE_POWER_OFF. This reason is
5304 * used when suspending or powering off, where we don't want to wait
5305 * for the peer's response.
5306 */
5307 if (reason != HCI_ERROR_REMOTE_POWER_OFF)
5308 return __hci_cmd_sync_status_sk(hdev, HCI_OP_CREATE_CONN_CANCEL,
5309 6, &conn->dst,
5310 HCI_EV_CONN_COMPLETE,
5311 HCI_CMD_TIMEOUT, NULL);
5312
d0b13706
LAD		 5313 return __hci_cmd_sync_status(hdev, HCI_OP_CREATE_CONN_CANCEL,
5314 6, &conn->dst, HCI_CMD_TIMEOUT);
5315}
5316
5317static int hci_reject_sco_sync(struct hci_dev *hdev, struct hci_conn *conn,
5318 u8 reason)
5319{
5320 struct hci_cp_reject_sync_conn_req cp;
5321
5322 memset(&cp, 0, sizeof(cp));
5323 bacpy(&cp.bdaddr, &conn->dst);
5324 cp.reason = reason;
5325
5326 /* SCO rejection has its own limited set of
5327 * allowed error values (0x0D-0x0F).
5328 */
5329 if (reason < 0x0d || reason > 0x0f)
5330 cp.reason = HCI_ERROR_REJ_LIMITED_RESOURCES;
5331
5332 return __hci_cmd_sync_status(hdev, HCI_OP_REJECT_SYNC_CONN_REQ,
5333 sizeof(cp), &cp, HCI_CMD_TIMEOUT);
5334}
5335
04a51d61
LAD		 5336static int hci_le_reject_cis_sync(struct hci_dev *hdev, struct hci_conn *conn,
5337 u8 reason)
5338{
5339 struct hci_cp_le_reject_cis cp;
5340
5341 memset(&cp, 0, sizeof(cp));
5342 cp.handle = cpu_to_le16(conn->handle);
5343 cp.reason = reason;
5344
5345 return __hci_cmd_sync_status(hdev, HCI_OP_LE_REJECT_CIS,
5346 sizeof(cp), &cp, HCI_CMD_TIMEOUT);
5347}
5348
d0b13706
LAD		 5349static int hci_reject_conn_sync(struct hci_dev *hdev, struct hci_conn *conn,
5350 u8 reason)
5351{
5352 struct hci_cp_reject_conn_req cp;
5353
04a51d61
LAD		 5354 if (conn->type == ISO_LINK)
5355 return hci_le_reject_cis_sync(hdev, conn, reason);
5356
d0b13706
LAD		 5357 if (conn->type == SCO_LINK || conn->type == ESCO_LINK)
5358 return hci_reject_sco_sync(hdev, conn, reason);
5359
5360 memset(&cp, 0, sizeof(cp));
5361 bacpy(&cp.bdaddr, &conn->dst);
5362 cp.reason = reason;
5363
5364 return __hci_cmd_sync_status(hdev, HCI_OP_REJECT_CONN_REQ,
5365 sizeof(cp), &cp, HCI_CMD_TIMEOUT);
5366}
5367
1f7435c8 5368int hci_abort_conn_sync(struct hci_dev *hdev, struct hci_conn *conn, u8 reason)
d0b13706 5369{
5af1f84e
LAD		 5370 int err = 0;
5371 u16 handle = conn->handle;
a239110e 5372 bool disconnect = false;
94d9ba9f 5373 struct hci_conn *c;
9b3628d7 5374
d0b13706
LAD		 5375 switch (conn->state) {
5376 case BT_CONNECTED:
5377 case BT_CONFIG:
5af1f84e
LAD		 5378 err = hci_disconnect_sync(hdev, conn, reason);
5379 break;
d0b13706 5380 case BT_CONNECT:
a13f316e 5381 err = hci_connect_cancel_sync(hdev, conn, reason);
5af1f84e 5382 break;
d0b13706 5383 case BT_CONNECT2:
5af1f84e
LAD		 5384 err = hci_reject_conn_sync(hdev, conn, reason);
5385 break;
f777d882 5386 case BT_OPEN:
fbdc4bc4
IT		 5387 hci_dev_lock(hdev);
5388
5389 /* Cleanup bis or pa sync connections */
5390 if (test_and_clear_bit(HCI_CONN_BIG_SYNC_FAILED, &conn->flags) ||
5391 test_and_clear_bit(HCI_CONN_PA_SYNC_FAILED, &conn->flags)) {
5392 hci_conn_failed(conn, reason);
5393 } else if (test_bit(HCI_CONN_PA_SYNC, &conn->flags) ||
5394 test_bit(HCI_CONN_BIG_SYNC, &conn->flags)) {
5395 conn->state = BT_CLOSED;
5396 hci_disconn_cfm(conn, reason);
5397 hci_conn_del(conn);
5398 }
5399
5400 hci_dev_unlock(hdev);
5401 return 0;
2889bdd0 5402 case BT_BOUND:
a239110e 5403 break;
d0b13706 5404 default:
a239110e
PV		 5405 disconnect = true;
5406 break;
d0b13706
LAD		 5407 }
5408
94d9ba9f
LAD		 5409 hci_dev_lock(hdev);
5410
a239110e 5411 /* Check if the connection has been cleaned up concurrently */
94d9ba9f
LAD		 5412 c = hci_conn_hash_lookup_handle(hdev, handle);
5413 if (!c || c != conn) {
5414 err = 0;
5415 goto unlock;
5416 }
5417
5af1f84e
LAD		 5418 /* Cleanup hci_conn object if it cannot be cancelled as it
5419 * likelly means the controller and host stack are out of sync
5420 * or in case of LE it was still scanning so it can be cleanup
5421 * safely.
5422 */
a239110e
PV		 5423 if (disconnect) {
5424 conn->state = BT_CLOSED;
5425 hci_disconn_cfm(conn, reason);
5426 hci_conn_del(conn);
5427 } else {
5428 hci_conn_failed(conn, reason);
5429 }
5af1f84e 5430
94d9ba9f
LAD		 5431unlock:
5432 hci_dev_unlock(hdev);
5af1f84e 5433 return err;
d0b13706
LAD		 5434}
5435
182ee45d
LAD		 5436static int hci_disconnect_all_sync(struct hci_dev *hdev, u8 reason)
5437{
94d9ba9f
LAD		 5438 struct list_head *head = &hdev->conn_hash.list;
5439 struct hci_conn *conn;
182ee45d 5440
94d9ba9f
LAD		 5441 rcu_read_lock();
5442 while ((conn = list_first_or_null_rcu(head, struct hci_conn, list))) {
5443 /* Make sure the connection is not freed while unlocking */
5444 conn = hci_conn_get(conn);
5445 rcu_read_unlock();
5446 /* Disregard possible errors since hci_conn_del shall have been
5447 * called even in case of errors had occurred since it would
5448 * then cause hci_conn_failed to be called which calls
5449 * hci_conn_del internally.
5450 */
5451 hci_abort_conn_sync(hdev, conn, reason);
5452 hci_conn_put(conn);
5453 rcu_read_lock();
182ee45d 5454 }
94d9ba9f 5455 rcu_read_unlock();
182ee45d 5456
8cd3c55c 5457 return 0;
182ee45d
LAD		 5458}
5459
d0b13706
LAD		 5460/* This function perform power off HCI command sequence as follows:
5461 *
5462 * Clear Advertising
5463 * Stop Discovery
5464 * Disconnect all connections
5465 * hci_dev_close_sync
5466 */
5467static int hci_power_off_sync(struct hci_dev *hdev)
5468{
d0b13706
LAD		 5469 int err;
5470
5471 /* If controller is already down there is nothing to do */
5472 if (!test_bit(HCI_UP, &hdev->flags))
5473 return 0;
5474
5475 if (test_bit(HCI_ISCAN, &hdev->flags) ||
5476 test_bit(HCI_PSCAN, &hdev->flags)) {
5477 err = hci_write_scan_enable_sync(hdev, 0x00);
5478 if (err)
5479 return err;
5480 }
5481
5482 err = hci_clear_adv_sync(hdev, NULL, false);
5483 if (err)
5484 return err;
5485
5486 err = hci_stop_discovery_sync(hdev);
5487 if (err)
5488 return err;
5489
182ee45d
LAD		 5490 /* Terminated due to Power Off */
5491 err = hci_disconnect_all_sync(hdev, HCI_ERROR_REMOTE_POWER_OFF);
5492 if (err)
5493 return err;
d0b13706
LAD		 5494
5495 return hci_dev_close_sync(hdev);
5496}
5497
5498int hci_set_powered_sync(struct hci_dev *hdev, u8 val)
5499{
5500 if (val)
5501 return hci_power_on_sync(hdev);
cf75ad8b
LAD		 5502
5503 return hci_power_off_sync(hdev);
5504}
abfeea47 5505
2bd1b237
LAD		 5506static int hci_write_iac_sync(struct hci_dev *hdev)
5507{
5508 struct hci_cp_write_current_iac_lap cp;
5509
5510 if (!hci_dev_test_flag(hdev, HCI_DISCOVERABLE))
5511 return 0;
5512
5513 memset(&cp, 0, sizeof(cp));
5514
5515 if (hci_dev_test_flag(hdev, HCI_LIMITED_DISCOVERABLE)) {
5516 /* Limited discoverable mode */
5517 cp.num_iac = min_t(u8, hdev->num_iac, 2);
5518 cp.iac_lap[0] = 0x00; /* LIAC */
5519 cp.iac_lap[1] = 0x8b;
5520 cp.iac_lap[2] = 0x9e;
5521 cp.iac_lap[3] = 0x33; /* GIAC */
5522 cp.iac_lap[4] = 0x8b;
5523 cp.iac_lap[5] = 0x9e;
5524 } else {
5525 /* General discoverable mode */
5526 cp.num_iac = 1;
5527 cp.iac_lap[0] = 0x33; /* GIAC */
5528 cp.iac_lap[1] = 0x8b;
5529 cp.iac_lap[2] = 0x9e;
5530 }
5531
5532 return __hci_cmd_sync_status(hdev, HCI_OP_WRITE_CURRENT_IAC_LAP,
5533 (cp.num_iac * 3) + 1, &cp,
5534 HCI_CMD_TIMEOUT);
5535}
5536
5537int hci_update_discoverable_sync(struct hci_dev *hdev)
5538{
5539 int err = 0;
5540
5541 if (hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) {
5542 err = hci_write_iac_sync(hdev);
5543 if (err)
5544 return err;
5545
5546 err = hci_update_scan_sync(hdev);
5547 if (err)
5548 return err;
5549
5550 err = hci_update_class_sync(hdev);
5551 if (err)
5552 return err;
5553 }
5554
5555 /* Advertising instances don't use the global discoverable setting, so
5556 * only update AD if advertising was enabled using Set Advertising.
5557 */
5558 if (hci_dev_test_flag(hdev, HCI_ADVERTISING)) {
5559 err = hci_update_adv_data_sync(hdev, 0x00);
5560 if (err)
5561 return err;
5562
5563 /* Discoverable mode affects the local advertising
5564 * address in limited privacy mode.
5565 */
5566 if (hci_dev_test_flag(hdev, HCI_LIMITED_PRIVACY)) {
5567 if (ext_adv_capable(hdev))
5568 err = hci_start_ext_adv_sync(hdev, 0x00);
5569 else
5570 err = hci_enable_advertising_sync(hdev);
5571 }
5572 }
5573
5574 return err;
5575}
5576
5577static int update_discoverable_sync(struct hci_dev *hdev, void *data)
5578{
5579 return hci_update_discoverable_sync(hdev);
5580}
5581
5582int hci_update_discoverable(struct hci_dev *hdev)
5583{
5584 /* Only queue if it would have any effect */
5585 if (hdev_is_powered(hdev) &&
5586 hci_dev_test_flag(hdev, HCI_ADVERTISING) &&
5587 hci_dev_test_flag(hdev, HCI_DISCOVERABLE) &&
5588 hci_dev_test_flag(hdev, HCI_LIMITED_PRIVACY))
5589 return hci_cmd_sync_queue(hdev, update_discoverable_sync, NULL,
5590 NULL);
5591
5592 return 0;
5593}
5594
f056a657
LAD		 5595int hci_update_connectable_sync(struct hci_dev *hdev)
5596{
5597 int err;
5598
5599 err = hci_update_scan_sync(hdev);
5600 if (err)
5601 return err;
5602
5603 /* If BR/EDR is not enabled and we disable advertising as a
5604 * by-product of disabling connectable, we need to update the
5605 * advertising flags.
5606 */
5607 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
5608 err = hci_update_adv_data_sync(hdev, hdev->cur_adv_instance);
5609
5610 /* Update the advertising parameters if necessary */
5611 if (hci_dev_test_flag(hdev, HCI_ADVERTISING) ||
5612 !list_empty(&hdev->adv_instances)) {
5613 if (ext_adv_capable(hdev))
5614 err = hci_start_ext_adv_sync(hdev,
5615 hdev->cur_adv_instance);
5616 else
5617 err = hci_enable_advertising_sync(hdev);
5618
5619 if (err)
5620 return err;
5621 }
5622
5623 return hci_update_passive_scan_sync(hdev);
5624}
5625
abfeea47
LAD		 5626static int hci_inquiry_sync(struct hci_dev *hdev, u8 length)
5627{
5628 const u8 giac[3] = { 0x33, 0x8b, 0x9e };
5629 const u8 liac[3] = { 0x00, 0x8b, 0x9e };
5630 struct hci_cp_inquiry cp;
5631
5632 bt_dev_dbg(hdev, "");
5633
5634 if (hci_dev_test_flag(hdev, HCI_INQUIRY))
5635 return 0;
5636
5637 hci_dev_lock(hdev);
5638 hci_inquiry_cache_flush(hdev);
5639 hci_dev_unlock(hdev);
5640
5641 memset(&cp, 0, sizeof(cp));
5642
5643 if (hdev->discovery.limited)
5644 memcpy(&cp.lap, liac, sizeof(cp.lap));
5645 else
5646 memcpy(&cp.lap, giac, sizeof(cp.lap));
5647
5648 cp.length = length;
5649
5650 return __hci_cmd_sync_status(hdev, HCI_OP_INQUIRY,
5651 sizeof(cp), &cp, HCI_CMD_TIMEOUT);
5652}
5653
5654static int hci_active_scan_sync(struct hci_dev *hdev, uint16_t interval)
5655{
5656 u8 own_addr_type;
5657 /* Accept list is not used for discovery */
5658 u8 filter_policy = 0x00;
5659 /* Default is to enable duplicates filter */
5660 u8 filter_dup = LE_SCAN_FILTER_DUP_ENABLE;
5661 int err;
5662
5663 bt_dev_dbg(hdev, "");
5664
5665 /* If controller is scanning, it means the passive scanning is
5666 * running. Thus, we should temporarily stop it in order to set the
5667 * discovery scanning parameters.
5668 */
5669 err = hci_scan_disable_sync(hdev);
5670 if (err) {
5671 bt_dev_err(hdev, "Unable to disable scanning: %d", err);
5672 return err;
5673 }
5674
5675 cancel_interleave_scan(hdev);
5676
3c44a431
ZJ		 5677 /* Pause address resolution for active scan and stop advertising if
5678 * privacy is enabled.
abfeea47 5679 */
3c44a431
ZJ		 5680 err = hci_pause_addr_resolution(hdev);
5681 if (err)
abfeea47 5682 goto failed;
abfeea47
LAD		 5683
5684 /* All active scans will be done with either a resolvable private
5685 * address (when privacy feature has been enabled) or non-resolvable
5686 * private address.
5687 */
5688 err = hci_update_random_address_sync(hdev, true, scan_use_rpa(hdev),
5689 &own_addr_type);
5690 if (err < 0)
5691 own_addr_type = ADDR_LE_DEV_PUBLIC;
5692
5693 if (hci_is_adv_monitoring(hdev)) {
5694 /* Duplicate filter should be disabled when some advertisement
5695 * monitor is activated, otherwise AdvMon can only receive one
5696 * advertisement for one peer(*) during active scanning, and
5697 * might report loss to these peers.
5698 *
5699 * Note that different controllers have different meanings of
5700 * |duplicate|. Some of them consider packets with the same
5701 * address as duplicate, and others consider packets with the
5702 * same address and the same RSSI as duplicate. Although in the
5703 * latter case we don't need to disable duplicate filter, but
5704 * it is common to have active scanning for a short period of
5705 * time, the power impact should be neglectable.
5706 */
5707 filter_dup = LE_SCAN_FILTER_DUP_DISABLE;
5708 }
5709
5710 err = hci_start_scan_sync(hdev, LE_SCAN_ACTIVE, interval,
5711 hdev->le_scan_window_discovery,
5712 own_addr_type, filter_policy, filter_dup);
5713 if (!err)
5714 return err;
5715
5716failed:
5717 /* Resume advertising if it was paused */
5718 if (use_ll_privacy(hdev))
5719 hci_resume_advertising_sync(hdev);
5720
5721 /* Resume passive scanning */
5722 hci_update_passive_scan_sync(hdev);
5723 return err;
5724}
5725
5726static int hci_start_interleaved_discovery_sync(struct hci_dev *hdev)
5727{
5728 int err;
5729
5730 bt_dev_dbg(hdev, "");
5731
5732 err = hci_active_scan_sync(hdev, hdev->le_scan_int_discovery * 2);
5733 if (err)
5734 return err;
5735
5736 return hci_inquiry_sync(hdev, DISCOV_BREDR_INQUIRY_LEN);
5737}
5738
5739int hci_start_discovery_sync(struct hci_dev *hdev)
5740{
5741 unsigned long timeout;
5742 int err;
5743
5744 bt_dev_dbg(hdev, "type %u", hdev->discovery.type);
5745
5746 switch (hdev->discovery.type) {
5747 case DISCOV_TYPE_BREDR:
5748 return hci_inquiry_sync(hdev, DISCOV_BREDR_INQUIRY_LEN);
5749 case DISCOV_TYPE_INTERLEAVED:
5750 /* When running simultaneous discovery, the LE scanning time
5751 * should occupy the whole discovery time sine BR/EDR inquiry
5752 * and LE scanning are scheduled by the controller.
5753 *
5754 * For interleaving discovery in comparison, BR/EDR inquiry
5755 * and LE scanning are done sequentially with separate
5756 * timeouts.
5757 */
5758 if (test_bit(HCI_QUIRK_SIMULTANEOUS_DISCOVERY,
5759 &hdev->quirks)) {
5760 timeout = msecs_to_jiffies(DISCOV_LE_TIMEOUT);
5761 /* During simultaneous discovery, we double LE scan
5762 * interval. We must leave some time for the controller
5763 * to do BR/EDR inquiry.
5764 */
5765 err = hci_start_interleaved_discovery_sync(hdev);
5766 break;
5767 }
5768
5769 timeout = msecs_to_jiffies(hdev->discov_interleaved_timeout);
5770 err = hci_active_scan_sync(hdev, hdev->le_scan_int_discovery);
5771 break;
5772 case DISCOV_TYPE_LE:
5773 timeout = msecs_to_jiffies(DISCOV_LE_TIMEOUT);
5774 err = hci_active_scan_sync(hdev, hdev->le_scan_int_discovery);
5775 break;
5776 default:
5777 return -EINVAL;
5778 }
5779
5780 if (err)
5781 return err;
5782
5783 bt_dev_dbg(hdev, "timeout %u ms", jiffies_to_msecs(timeout));
5784
5785 /* When service discovery is used and the controller has a
5786 * strict duplicate filter, it is important to remember the
5787 * start and duration of the scan. This is required for
5788 * restarting scanning during the discovery phase.
5789 */
5790 if (test_bit(HCI_QUIRK_STRICT_DUPLICATE_FILTER, &hdev->quirks) &&
5791 hdev->discovery.result_filtering) {
5792 hdev->discovery.scan_start = jiffies;
5793 hdev->discovery.scan_duration = timeout;
5794 }
5795
5796 queue_delayed_work(hdev->req_workqueue, &hdev->le_scan_disable,
5797 timeout);
abfeea47
LAD		 5798 return 0;
5799}
182ee45d
LAD		 5800
5801static void hci_suspend_monitor_sync(struct hci_dev *hdev)
5802{
5803 switch (hci_get_adv_monitor_offload_ext(hdev)) {
5804 case HCI_ADV_MONITOR_EXT_MSFT:
5805 msft_suspend_sync(hdev);
5806 break;
5807 default:
5808 return;
5809 }
5810}
5811
5812/* This function disables discovery and mark it as paused */
5813static int hci_pause_discovery_sync(struct hci_dev *hdev)
5814{
5815 int old_state = hdev->discovery.state;
5816 int err;
5817
5818 /* If discovery already stopped/stopping/paused there nothing to do */
5819 if (old_state == DISCOVERY_STOPPED || old_state == DISCOVERY_STOPPING ||
5820 hdev->discovery_paused)
5821 return 0;
5822
5823 hci_discovery_set_state(hdev, DISCOVERY_STOPPING);
5824 err = hci_stop_discovery_sync(hdev);
5825 if (err)
5826 return err;
5827
5828 hdev->discovery_paused = true;
5829 hdev->discovery_old_state = old_state;
5830 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
5831
5832 return 0;
5833}
5834
5835static int hci_update_event_filter_sync(struct hci_dev *hdev)
5836{
5837 struct bdaddr_list_with_flags *b;
5838 u8 scan = SCAN_DISABLED;
5839 bool scanning = test_bit(HCI_PSCAN, &hdev->flags);
5840 int err;
5841
5842 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
5843 return 0;
5844
0eaecfb2
IFM		 5845 /* Some fake CSR controllers lock up after setting this type of
5846 * filter, so avoid sending the request altogether.
5847 */
5848 if (test_bit(HCI_QUIRK_BROKEN_FILTER_CLEAR_ALL, &hdev->quirks))
5849 return 0;
5850
182ee45d
LAD		 5851 /* Always clear event filter when starting */
5852 hci_clear_event_filter_sync(hdev);
5853
5854 list_for_each_entry(b, &hdev->accept_list, list) {
e1cff700 5855 if (!(b->flags & HCI_CONN_FLAG_REMOTE_WAKEUP))
182ee45d
LAD		 5856 continue;
5857
5858 bt_dev_dbg(hdev, "Adding event filters for %pMR", &b->bdaddr);
5859
5860 err = hci_set_event_filter_sync(hdev, HCI_FLT_CONN_SETUP,
5861 HCI_CONN_SETUP_ALLOW_BDADDR,
5862 &b->bdaddr,
5863 HCI_CONN_SETUP_AUTO_ON);
5864 if (err)
5865 bt_dev_dbg(hdev, "Failed to set event filter for %pMR",
5866 &b->bdaddr);
5867 else
5868 scan = SCAN_PAGE;
5869 }
5870
5871 if (scan && !scanning)
5872 hci_write_scan_enable_sync(hdev, scan);
5873 else if (!scan && scanning)
5874 hci_write_scan_enable_sync(hdev, scan);
5875
5876 return 0;
5877}
5878
3b420553
LAD		 5879/* This function disables scan (BR and LE) and mark it as paused */
5880static int hci_pause_scan_sync(struct hci_dev *hdev)
5881{
5882 if (hdev->scanning_paused)
5883 return 0;
5884
5885 /* Disable page scan if enabled */
5886 if (test_bit(HCI_PSCAN, &hdev->flags))
5887 hci_write_scan_enable_sync(hdev, SCAN_DISABLED);
5888
5889 hci_scan_disable_sync(hdev);
5890
5891 hdev->scanning_paused = true;
5892
5893 return 0;
5894}
5895
182ee45d
LAD		 5896/* This function performs the HCI suspend procedures in the follow order:
5897 *
5898 * Pause discovery (active scanning/inquiry)
5899 * Pause Directed Advertising/Advertising
3b420553 5900 * Pause Scanning (passive scanning in case discovery was not active)
182ee45d
LAD		 5901 * Disconnect all connections
5902 * Set suspend_status to BT_SUSPEND_DISCONNECT if hdev cannot wakeup
5903 * otherwise:
5904 * Update event mask (only set events that are allowed to wake up the host)
5905 * Update event filter (with devices marked with HCI_CONN_FLAG_REMOTE_WAKEUP)
5906 * Update passive scanning (lower duty cycle)
5907 * Set suspend_status to BT_SUSPEND_CONFIGURE_WAKE
5908 */
5909int hci_suspend_sync(struct hci_dev *hdev)
5910{
5911 int err;
5912
5913 /* If marked as suspended there nothing to do */
5914 if (hdev->suspended)
5915 return 0;
5916
5917 /* Mark device as suspended */
5918 hdev->suspended = true;
5919
5920 /* Pause discovery if not already stopped */
5921 hci_pause_discovery_sync(hdev);
5922
5923 /* Pause other advertisements */
5924 hci_pause_advertising_sync(hdev);
5925
182ee45d
LAD		 5926 /* Suspend monitor filters */
5927 hci_suspend_monitor_sync(hdev);
5928
5929 /* Prevent disconnects from causing scanning to be re-enabled */
3b420553 5930 hci_pause_scan_sync(hdev);
182ee45d 5931
123f6d3a
LAD		 5932 if (hci_conn_count(hdev)) {
5933 /* Soft disconnect everything (power off) */
5934 err = hci_disconnect_all_sync(hdev, HCI_ERROR_REMOTE_POWER_OFF);
5935 if (err) {
5936 /* Set state to BT_RUNNING so resume doesn't notify */
5937 hdev->suspend_state = BT_RUNNING;
5938 hci_resume_sync(hdev);
5939 return err;
5940 }
182ee45d 5941
123f6d3a
LAD		 5942 /* Update event mask so only the allowed event can wakeup the
5943 * host.
5944 */
5945 hci_set_event_mask_sync(hdev);
5946 }
ef61b6ea 5947
182ee45d
LAD		 5948 /* Only configure accept list if disconnect succeeded and wake
5949 * isn't being prevented.
5950 */
5951 if (!hdev->wakeup || !hdev->wakeup(hdev)) {
5952 hdev->suspend_state = BT_SUSPEND_DISCONNECT;
5953 return 0;
5954 }
5955
5956 /* Unpause to take care of updating scanning params */
5957 hdev->scanning_paused = false;
5958
182ee45d
LAD		 5959 /* Enable event filter for paired devices */
5960 hci_update_event_filter_sync(hdev);
5961
5962 /* Update LE passive scan if enabled */
5963 hci_update_passive_scan_sync(hdev);
5964
5965 /* Pause scan changes again. */
5966 hdev->scanning_paused = true;
5967
5968 hdev->suspend_state = BT_SUSPEND_CONFIGURE_WAKE;
5969
5970 return 0;
5971}
5972
5973/* This function resumes discovery */
5974static int hci_resume_discovery_sync(struct hci_dev *hdev)
5975{
5976 int err;
5977
5978 /* If discovery not paused there nothing to do */
5979 if (!hdev->discovery_paused)
5980 return 0;
5981
5982 hdev->discovery_paused = false;
5983
5984 hci_discovery_set_state(hdev, DISCOVERY_STARTING);
5985
5986 err = hci_start_discovery_sync(hdev);
5987
5988 hci_discovery_set_state(hdev, err ? DISCOVERY_STOPPED :
5989 DISCOVERY_FINDING);
5990
5991 return err;
5992}
5993
5994static void hci_resume_monitor_sync(struct hci_dev *hdev)
5995{
5996 switch (hci_get_adv_monitor_offload_ext(hdev)) {
5997 case HCI_ADV_MONITOR_EXT_MSFT:
5998 msft_resume_sync(hdev);
5999 break;
6000 default:
6001 return;
6002 }
6003}
6004
3b420553
LAD		 6005/* This function resume scan and reset paused flag */
6006static int hci_resume_scan_sync(struct hci_dev *hdev)
6007{
6008 if (!hdev->scanning_paused)
6009 return 0;
6010
68253f3c
ZJ		 6011 hdev->scanning_paused = false;
6012
3b420553
LAD		 6013 hci_update_scan_sync(hdev);
6014
6015 /* Reset passive scanning to normal */
6016 hci_update_passive_scan_sync(hdev);
6017
3b420553
LAD		 6018 return 0;
6019}
6020
182ee45d
LAD		 6021/* This function performs the HCI suspend procedures in the follow order:
6022 *
6023 * Restore event mask
6024 * Clear event filter
6025 * Update passive scanning (normal duty cycle)
6026 * Resume Directed Advertising/Advertising
6027 * Resume discovery (active scanning/inquiry)
6028 */
6029int hci_resume_sync(struct hci_dev *hdev)
6030{
6031 /* If not marked as suspended there nothing to do */
6032 if (!hdev->suspended)
6033 return 0;
6034
6035 hdev->suspended = false;
182ee45d
LAD		 6036
6037 /* Restore event mask */
6038 hci_set_event_mask_sync(hdev);
6039
6040 /* Clear any event filters and restore scan state */
6041 hci_clear_event_filter_sync(hdev);
182ee45d 6042
3b420553
LAD		 6043 /* Resume scanning */
6044 hci_resume_scan_sync(hdev);
182ee45d
LAD		 6045
6046 /* Resume monitor filters */
6047 hci_resume_monitor_sync(hdev);
6048
6049 /* Resume other advertisements */
6050 hci_resume_advertising_sync(hdev);
6051
6052 /* Resume discovery */
6053 hci_resume_discovery_sync(hdev);
6054
6055 return 0;
6056}
8e8b92ee
LAD		 6057
6058static bool conn_use_rpa(struct hci_conn *conn)
6059{
6060 struct hci_dev *hdev = conn->hdev;
6061
6062 return hci_dev_test_flag(hdev, HCI_PRIVACY);
6063}
6064
6065static int hci_le_ext_directed_advertising_sync(struct hci_dev *hdev,
6066 struct hci_conn *conn)
6067{
6068 struct hci_cp_le_set_ext_adv_params cp;
6069 int err;
6070 bdaddr_t random_addr;
6071 u8 own_addr_type;
6072
6073 err = hci_update_random_address_sync(hdev, false, conn_use_rpa(conn),
6074 &own_addr_type);
6075 if (err)
6076 return err;
6077
6078 /* Set require_privacy to false so that the remote device has a
6079 * chance of identifying us.
6080 */
6081 err = hci_get_random_address(hdev, false, conn_use_rpa(conn), NULL,
6082 &own_addr_type, &random_addr);
6083 if (err)
6084 return err;
6085
6086 memset(&cp, 0, sizeof(cp));
6087
6088 cp.evt_properties = cpu_to_le16(LE_LEGACY_ADV_DIRECT_IND);
8e8b92ee
LAD		 6089 cp.channel_map = hdev->le_adv_channel_map;
6090 cp.tx_power = HCI_TX_POWER_INVALID;
6091 cp.primary_phy = HCI_ADV_PHY_1M;
6092 cp.secondary_phy = HCI_ADV_PHY_1M;
6093 cp.handle = 0x00; /* Use instance 0 for directed adv */
6094 cp.own_addr_type = own_addr_type;
6095 cp.peer_addr_type = conn->dst_type;
6096 bacpy(&cp.peer_addr, &conn->dst);
6097
6098 /* As per Core Spec 5.2 Vol 2, PART E, Sec 7.8.53, for
6099 * advertising_event_property LE_LEGACY_ADV_DIRECT_IND
6100 * does not supports advertising data when the advertising set already
6101 * contains some, the controller shall return erroc code 'Invalid
6102 * HCI Command Parameters(0x12).
6103 * So it is required to remove adv set for handle 0x00. since we use
6104 * instance 0 for directed adv.
6105 */
6106 err = hci_remove_ext_adv_instance_sync(hdev, cp.handle, NULL);
6107 if (err)
6108 return err;
6109
6110 err = __hci_cmd_sync_status(hdev, HCI_OP_LE_SET_EXT_ADV_PARAMS,
6111 sizeof(cp), &cp, HCI_CMD_TIMEOUT);
6112 if (err)
6113 return err;
6114
6115 /* Check if random address need to be updated */
6116 if (own_addr_type == ADDR_LE_DEV_RANDOM &&
6117 bacmp(&random_addr, BDADDR_ANY) &&
6118 bacmp(&random_addr, &hdev->random_addr)) {
6119 err = hci_set_adv_set_random_addr_sync(hdev, 0x00,
6120 &random_addr);
6121 if (err)
6122 return err;
6123 }
6124
6125 return hci_enable_ext_advertising_sync(hdev, 0x00);
6126}
6127
6128static int hci_le_directed_advertising_sync(struct hci_dev *hdev,
6129 struct hci_conn *conn)
6130{
6131 struct hci_cp_le_set_adv_param cp;
6132 u8 status;
6133 u8 own_addr_type;
6134 u8 enable;
6135
6136 if (ext_adv_capable(hdev))
6137 return hci_le_ext_directed_advertising_sync(hdev, conn);
6138
6139 /* Clear the HCI_LE_ADV bit temporarily so that the
6140 * hci_update_random_address knows that it's safe to go ahead
6141 * and write a new random address. The flag will be set back on
6142 * as soon as the SET_ADV_ENABLE HCI command completes.
6143 */
6144 hci_dev_clear_flag(hdev, HCI_LE_ADV);
6145
6146 /* Set require_privacy to false so that the remote device has a
6147 * chance of identifying us.
6148 */
6149 status = hci_update_random_address_sync(hdev, false, conn_use_rpa(conn),
6150 &own_addr_type);
6151 if (status)
6152 return status;
6153
6154 memset(&cp, 0, sizeof(cp));
6155
6156 /* Some controllers might reject command if intervals are not
6157 * within range for undirected advertising.
6158 * BCM20702A0 is known to be affected by this.
6159 */
6160 cp.min_interval = cpu_to_le16(0x0020);
6161 cp.max_interval = cpu_to_le16(0x0020);
6162
6163 cp.type = LE_ADV_DIRECT_IND;
6164 cp.own_address_type = own_addr_type;
6165 cp.direct_addr_type = conn->dst_type;
6166 bacpy(&cp.direct_addr, &conn->dst);
6167 cp.channel_map = hdev->le_adv_channel_map;
6168
6169 status = __hci_cmd_sync_status(hdev, HCI_OP_LE_SET_ADV_PARAM,
6170 sizeof(cp), &cp, HCI_CMD_TIMEOUT);
6171 if (status)
6172 return status;
6173
6174 enable = 0x01;
6175
6176 return __hci_cmd_sync_status(hdev, HCI_OP_LE_SET_ADV_ENABLE,
6177 sizeof(enable), &enable, HCI_CMD_TIMEOUT);
6178}
6179
6180static void set_ext_conn_params(struct hci_conn *conn,
6181 struct hci_cp_le_ext_conn_param *p)
6182{
6183 struct hci_dev *hdev = conn->hdev;
6184
6185 memset(p, 0, sizeof(*p));
6186
6187 p->scan_interval = cpu_to_le16(hdev->le_scan_int_connect);
6188 p->scan_window = cpu_to_le16(hdev->le_scan_window_connect);
6189 p->conn_interval_min = cpu_to_le16(conn->le_conn_min_interval);
6190 p->conn_interval_max = cpu_to_le16(conn->le_conn_max_interval);
6191 p->conn_latency = cpu_to_le16(conn->le_conn_latency);
6192 p->supervision_timeout = cpu_to_le16(conn->le_supv_timeout);
6193 p->min_ce_len = cpu_to_le16(0x0000);
6194 p->max_ce_len = cpu_to_le16(0x0000);
6195}
6196
89a0b8b9
LAD		 6197static int hci_le_ext_create_conn_sync(struct hci_dev *hdev,
6198 struct hci_conn *conn, u8 own_addr_type)
8e8b92ee
LAD		 6199{
6200 struct hci_cp_le_ext_create_conn *cp;
6201 struct hci_cp_le_ext_conn_param *p;
6202 u8 data[sizeof(*cp) + sizeof(*p) * 3];
6203 u32 plen;
6204
6205 cp = (void *)data;
6206 p = (void *)cp->data;
6207
6208 memset(cp, 0, sizeof(*cp));
6209
6210 bacpy(&cp->peer_addr, &conn->dst);
6211 cp->peer_addr_type = conn->dst_type;
6212 cp->own_addr_type = own_addr_type;
6213
6214 plen = sizeof(*cp);
6215
6216 if (scan_1m(hdev)) {
6217 cp->phys |= LE_SCAN_PHY_1M;
6218 set_ext_conn_params(conn, p);
6219
6220 p++;
6221 plen += sizeof(*p);
6222 }
6223
6224 if (scan_2m(hdev)) {
6225 cp->phys |= LE_SCAN_PHY_2M;
6226 set_ext_conn_params(conn, p);
6227
6228 p++;
6229 plen += sizeof(*p);
6230 }
6231
6232 if (scan_coded(hdev)) {
6233 cp->phys |= LE_SCAN_PHY_CODED;
6234 set_ext_conn_params(conn, p);
6235
6236 plen += sizeof(*p);
6237 }
6238
6cd29ec6
LAD		 6239 return __hci_cmd_sync_status_sk(hdev, HCI_OP_LE_EXT_CREATE_CONN,
6240 plen, data,
6241 HCI_EV_LE_ENHANCED_CONN_COMPLETE,
a56a1138 6242 conn->conn_timeout, NULL);
8e8b92ee
LAD		 6243}
6244
6245int hci_le_create_conn_sync(struct hci_dev *hdev, struct hci_conn *conn)
6246{
6247 struct hci_cp_le_create_conn cp;
6248 struct hci_conn_params *params;
6249 u8 own_addr_type;
6250 int err;
6251
8e8b92ee
LAD		 6252 /* If requested to connect as peripheral use directed advertising */
6253 if (conn->role == HCI_ROLE_SLAVE) {
76d0685b
LAD		 6254 /* If we're active scanning and simultaneous roles is not
6255 * enabled simply reject the attempt.
8e8b92ee
LAD		 6256 */
6257 if (hci_dev_test_flag(hdev, HCI_LE_SCAN) &&
4fc9857a 6258 hdev->le_scan_type == LE_SCAN_ACTIVE &&
76d0685b 6259 !hci_dev_test_flag(hdev, HCI_LE_SIMULTANEOUS_ROLES)) {
8e8b92ee
LAD		 6260 hci_conn_del(conn);
6261 return -EBUSY;
6262 }
6263
4fc9857a
LAD		 6264 /* Pause advertising while doing directed advertising. */
6265 hci_pause_advertising_sync(hdev);
6266
8e8b92ee
LAD		 6267 err = hci_le_directed_advertising_sync(hdev, conn);
6268 goto done;
6269 }
6270
76d0685b
LAD		 6271 /* Disable advertising if simultaneous roles is not in use. */
6272 if (!hci_dev_test_flag(hdev, HCI_LE_SIMULTANEOUS_ROLES))
4fc9857a
LAD		 6273 hci_pause_advertising_sync(hdev);
6274
8e8b92ee
LAD		 6275 params = hci_conn_params_lookup(hdev, &conn->dst, conn->dst_type);
6276 if (params) {
6277 conn->le_conn_min_interval = params->conn_min_interval;
6278 conn->le_conn_max_interval = params->conn_max_interval;
6279 conn->le_conn_latency = params->conn_latency;
6280 conn->le_supv_timeout = params->supervision_timeout;
6281 } else {
6282 conn->le_conn_min_interval = hdev->le_conn_min_interval;
6283 conn->le_conn_max_interval = hdev->le_conn_max_interval;
6284 conn->le_conn_latency = hdev->le_conn_latency;
6285 conn->le_supv_timeout = hdev->le_supv_timeout;
6286 }
6287
6288 /* If controller is scanning, we stop it since some controllers are
6289 * not able to scan and connect at the same time. Also set the
6290 * HCI_LE_SCAN_INTERRUPTED flag so that the command complete
6291 * handler for scan disabling knows to set the correct discovery
6292 * state.
6293 */
6294 if (hci_dev_test_flag(hdev, HCI_LE_SCAN)) {
6295 hci_scan_disable_sync(hdev);
6296 hci_dev_set_flag(hdev, HCI_LE_SCAN_INTERRUPTED);
6297 }
6298
6299 /* Update random address, but set require_privacy to false so
6300 * that we never connect with an non-resolvable address.
6301 */
6302 err = hci_update_random_address_sync(hdev, false, conn_use_rpa(conn),
6303 &own_addr_type);
6304 if (err)
6305 goto done;
6306
6307 if (use_ext_conn(hdev)) {
6308 err = hci_le_ext_create_conn_sync(hdev, conn, own_addr_type);
6309 goto done;
6310 }
6311
6312 memset(&cp, 0, sizeof(cp));
6313
6314 cp.scan_interval = cpu_to_le16(hdev->le_scan_int_connect);
6315 cp.scan_window = cpu_to_le16(hdev->le_scan_window_connect);
6316
6317 bacpy(&cp.peer_addr, &conn->dst);
6318 cp.peer_addr_type = conn->dst_type;
6319 cp.own_address_type = own_addr_type;
6320 cp.conn_interval_min = cpu_to_le16(conn->le_conn_min_interval);
6321 cp.conn_interval_max = cpu_to_le16(conn->le_conn_max_interval);
6322 cp.conn_latency = cpu_to_le16(conn->le_conn_latency);
6323 cp.supervision_timeout = cpu_to_le16(conn->le_supv_timeout);
6324 cp.min_ce_len = cpu_to_le16(0x0000);
6325 cp.max_ce_len = cpu_to_le16(0x0000);
6326
a56a1138
LAD		 6327 /* BLUETOOTH CORE SPECIFICATION Version 5.3 | Vol 4, Part E page 2261:
6328 *
6329 * If this event is unmasked and the HCI_LE_Connection_Complete event
6330 * is unmasked, only the HCI_LE_Enhanced_Connection_Complete event is
6331 * sent when a new connection has been created.
6332 */
6cd29ec6 6333 err = __hci_cmd_sync_status_sk(hdev, HCI_OP_LE_CREATE_CONN,
a56a1138
LAD		 6334 sizeof(cp), &cp,
6335 use_enhanced_conn_complete(hdev) ?
6336 HCI_EV_LE_ENHANCED_CONN_COMPLETE :
6337 HCI_EV_LE_CONN_COMPLETE,
6338 conn->conn_timeout, NULL);
8e8b92ee
LAD		 6339
6340done:
b62e7220 6341 if (err == -ETIMEDOUT)
a13f316e 6342 hci_le_connect_cancel_sync(hdev, conn, 0x00);
b62e7220 6343
4fc9857a 6344 /* Re-enable advertising after the connection attempt is finished. */
8e8b92ee
LAD		 6345 hci_resume_advertising_sync(hdev);
6346 return err;
6347}
26afbd82 6348
7f74563e 6349int hci_le_create_cis_sync(struct hci_dev *hdev)
c09b80be
LAD		 6350{
6351 struct {
6352 struct hci_cp_le_create_cis cp;
6353 struct hci_cis cis[0x1f];
6354 } cmd;
7f74563e
PV		 6355 struct hci_conn *conn;
6356 u8 cig = BT_ISO_QOS_CIG_UNSET;
6357
6358 /* The spec allows only one pending LE Create CIS command at a time. If
6359 * the command is pending now, don't do anything. We check for pending
6360 * connections after each CIS Established event.
6361 *
6362 * BLUETOOTH CORE SPECIFICATION Version 5.3 | Vol 4, Part E
6363 * page 2566:
6364 *
6365 * If the Host issues this command before all the
6366 * HCI_LE_CIS_Established events from the previous use of the
6367 * command have been generated, the Controller shall return the
6368 * error code Command Disallowed (0x0C).
6369 *
6370 * BLUETOOTH CORE SPECIFICATION Version 5.3 | Vol 4, Part E
6371 * page 2567:
6372 *
6373 * When the Controller receives the HCI_LE_Create_CIS command, the
6374 * Controller sends the HCI_Command_Status event to the Host. An
6375 * HCI_LE_CIS_Established event will be generated for each CIS when it
6376 * is established or if it is disconnected or considered lost before
6377 * being established; until all the events are generated, the command
6378 * remains pending.
6379 */
c09b80be
LAD		 6380
6381 memset(&cmd, 0, sizeof(cmd));
c09b80be
LAD		 6382
6383 hci_dev_lock(hdev);
6384
6385 rcu_read_lock();
6386
7f74563e 6387 /* Wait until previous Create CIS has completed */
c09b80be 6388 list_for_each_entry_rcu(conn, &hdev->conn_hash.list, list) {
7f74563e
PV		 6389 if (test_bit(HCI_CONN_CREATE_CIS, &conn->flags))
6390 goto done;
6391 }
c09b80be 6392
7f74563e
PV		 6393 /* Find CIG with all CIS ready */
6394 list_for_each_entry_rcu(conn, &hdev->conn_hash.list, list) {
6395 struct hci_conn *link;
6396
6397 if (hci_conn_check_create_cis(conn))
c09b80be
LAD		 6398 continue;
6399
7f74563e
PV		 6400 cig = conn->iso_qos.ucast.cig;
6401
6402 list_for_each_entry_rcu(link, &hdev->conn_hash.list, list) {
6403 if (hci_conn_check_create_cis(link) > 0 &&
6404 link->iso_qos.ucast.cig == cig &&
6405 link->state != BT_CONNECTED) {
6406 cig = BT_ISO_QOS_CIG_UNSET;
6407 break;
6408 }
c09b80be
LAD		 6409 }
6410
7f74563e
PV		 6411 if (cig != BT_ISO_QOS_CIG_UNSET)
6412 break;
6413 }
6414
6415 if (cig == BT_ISO_QOS_CIG_UNSET)
6416 goto done;
6417
6418 list_for_each_entry_rcu(conn, &hdev->conn_hash.list, list) {
6419 struct hci_cis *cis = &cmd.cis[cmd.cp.num_cis];
6420
6421 if (hci_conn_check_create_cis(conn) ||
6422 conn->iso_qos.ucast.cig != cig)
6423 continue;
6424
6425 set_bit(HCI_CONN_CREATE_CIS, &conn->flags);
c09b80be
LAD		 6426 cis->acl_handle = cpu_to_le16(conn->parent->handle);
6427 cis->cis_handle = cpu_to_le16(conn->handle);
6428 cmd.cp.num_cis++;
7f74563e
PV		 6429
6430 if (cmd.cp.num_cis >= ARRAY_SIZE(cmd.cis))
6431 break;
c09b80be
LAD		 6432 }
6433
7f74563e 6434done:
c09b80be
LAD		 6435 rcu_read_unlock();
6436
6437 hci_dev_unlock(hdev);
6438
6439 if (!cmd.cp.num_cis)
6440 return 0;
6441
6442 /* Wait for HCI_LE_CIS_Established */
6443 return __hci_cmd_sync_status_sk(hdev, HCI_OP_LE_CREATE_CIS,
6444 sizeof(cmd.cp) + sizeof(cmd.cis[0]) *
6445 cmd.cp.num_cis, &cmd,
6446 HCI_EVT_LE_CIS_ESTABLISHED,
6447 conn->conn_timeout, NULL);
6448}
6449
26afbd82
LAD		 6450int hci_le_remove_cig_sync(struct hci_dev *hdev, u8 handle)
6451{
6452 struct hci_cp_le_remove_cig cp;
6453
6454 memset(&cp, 0, sizeof(cp));
6455 cp.cig_id = handle;
6456
6457 return __hci_cmd_sync_status(hdev, HCI_OP_LE_REMOVE_CIG, sizeof(cp),
6458 &cp, HCI_CMD_TIMEOUT);
6459}
eca0ae4a
LAD		 6460
6461int hci_le_big_terminate_sync(struct hci_dev *hdev, u8 handle)
6462{
6463 struct hci_cp_le_big_term_sync cp;
6464
6465 memset(&cp, 0, sizeof(cp));
6466 cp.handle = handle;
6467
6468 return __hci_cmd_sync_status(hdev, HCI_OP_LE_BIG_TERM_SYNC,
6469 sizeof(cp), &cp, HCI_CMD_TIMEOUT);
6470}
6471
6472int hci_le_pa_terminate_sync(struct hci_dev *hdev, u16 handle)
6473{
6474 struct hci_cp_le_pa_term_sync cp;
6475
6476 memset(&cp, 0, sizeof(cp));
6477 cp.handle = cpu_to_le16(handle);
6478
6479 return __hci_cmd_sync_status(hdev, HCI_OP_LE_PA_TERM_SYNC,
6480 sizeof(cp), &cp, HCI_CMD_TIMEOUT);
6481}
3fe318ee
BG		 6482
6483int hci_get_random_address(struct hci_dev *hdev, bool require_privacy,
6484 bool use_rpa, struct adv_info *adv_instance,
6485 u8 *own_addr_type, bdaddr_t *rand_addr)
6486{
6487 int err;
6488
6489 bacpy(rand_addr, BDADDR_ANY);
6490
6491 /* If privacy is enabled use a resolvable private address. If
6492 * current RPA has expired then generate a new one.
6493 */
6494 if (use_rpa) {
6495 /* If Controller supports LL Privacy use own address type is
6496 * 0x03
6497 */
6498 if (use_ll_privacy(hdev))
6499 *own_addr_type = ADDR_LE_DEV_RANDOM_RESOLVED;
6500 else
6501 *own_addr_type = ADDR_LE_DEV_RANDOM;
6502
6503 if (adv_instance) {
6504 if (adv_rpa_valid(adv_instance))
6505 return 0;
6506 } else {
6507 if (rpa_valid(hdev))
6508 return 0;
6509 }
6510
6511 err = smp_generate_rpa(hdev, hdev->irk, &hdev->rpa);
6512 if (err < 0) {
6513 bt_dev_err(hdev, "failed to generate new RPA");
6514 return err;
6515 }
6516
6517 bacpy(rand_addr, &hdev->rpa);
6518
6519 return 0;
6520 }
6521
6522 /* In case of required privacy without resolvable private address,
6523 * use an non-resolvable private address. This is useful for
6524 * non-connectable advertising.
6525 */
6526 if (require_privacy) {
6527 bdaddr_t nrpa;
6528
6529 while (true) {
6530 /* The non-resolvable private address is generated
6531 * from random six bytes with the two most significant
6532 * bits cleared.
6533 */
6534 get_random_bytes(&nrpa, 6);
6535 nrpa.b[5] &= 0x3f;
6536
6537 /* The non-resolvable private address shall not be
6538 * equal to the public address.
6539 */
6540 if (bacmp(&hdev->bdaddr, &nrpa))
6541 break;
6542 }
6543
6544 *own_addr_type = ADDR_LE_DEV_RANDOM;
6545 bacpy(rand_addr, &nrpa);
6546
6547 return 0;
6548 }
6549
6550 /* No privacy so use a public address. */
6551 *own_addr_type = ADDR_LE_DEV_PUBLIC;
6552
6553 return 0;
6554}
651cd3d6
BG		 6555
6556static int _update_adv_data_sync(struct hci_dev *hdev, void *data)
6557{
a1f6c3ae 6558 u8 instance = PTR_UINT(data);
651cd3d6
BG		 6559
6560 return hci_update_adv_data_sync(hdev, instance);
6561}
6562
6563int hci_update_adv_data(struct hci_dev *hdev, u8 instance)
6564{
1ed8b37c 6565 return hci_cmd_sync_queue(hdev, _update_adv_data_sync,
a1f6c3ae 6566 UINT_PTR(instance), NULL);
651cd3d6 6567}
Linux 6.x block layer and io_uring tree(s)