Loading...
Note: File does not exist in v6.13.7.
1/*
2 BlueZ - Bluetooth protocol stack for Linux
3
4 Copyright (C) 2014 Intel Corporation
5
6 This program is free software; you can redistribute it and/or modify
7 it under the terms of the GNU General Public License version 2 as
8 published by the Free Software Foundation;
9
10 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
11 OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
12 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
13 IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
14 CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
15 WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
16 ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
17 OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
18
19 ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
20 COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
21 SOFTWARE IS DISCLAIMED.
22*/
23
24#include <asm/unaligned.h>
25
26#include <net/bluetooth/bluetooth.h>
27#include <net/bluetooth/hci_core.h>
28#include <net/bluetooth/mgmt.h>
29
30#include "smp.h"
31#include "hci_request.h"
32
33#define HCI_REQ_DONE 0
34#define HCI_REQ_PEND 1
35#define HCI_REQ_CANCELED 2
36
37void hci_req_init(struct hci_request *req, struct hci_dev *hdev)
38{
39 skb_queue_head_init(&req->cmd_q);
40 req->hdev = hdev;
41 req->err = 0;
42}
43
44static int req_run(struct hci_request *req, hci_req_complete_t complete,
45 hci_req_complete_skb_t complete_skb)
46{
47 struct hci_dev *hdev = req->hdev;
48 struct sk_buff *skb;
49 unsigned long flags;
50
51 BT_DBG("length %u", skb_queue_len(&req->cmd_q));
52
53 /* If an error occurred during request building, remove all HCI
54 * commands queued on the HCI request queue.
55 */
56 if (req->err) {
57 skb_queue_purge(&req->cmd_q);
58 return req->err;
59 }
60
61 /* Do not allow empty requests */
62 if (skb_queue_empty(&req->cmd_q))
63 return -ENODATA;
64
65 skb = skb_peek_tail(&req->cmd_q);
66 if (complete) {
67 bt_cb(skb)->hci.req_complete = complete;
68 } else if (complete_skb) {
69 bt_cb(skb)->hci.req_complete_skb = complete_skb;
70 bt_cb(skb)->hci.req_flags |= HCI_REQ_SKB;
71 }
72
73 spin_lock_irqsave(&hdev->cmd_q.lock, flags);
74 skb_queue_splice_tail(&req->cmd_q, &hdev->cmd_q);
75 spin_unlock_irqrestore(&hdev->cmd_q.lock, flags);
76
77 queue_work(hdev->workqueue, &hdev->cmd_work);
78
79 return 0;
80}
81
82int hci_req_run(struct hci_request *req, hci_req_complete_t complete)
83{
84 return req_run(req, complete, NULL);
85}
86
87int hci_req_run_skb(struct hci_request *req, hci_req_complete_skb_t complete)
88{
89 return req_run(req, NULL, complete);
90}
91
92static void hci_req_sync_complete(struct hci_dev *hdev, u8 result, u16 opcode,
93 struct sk_buff *skb)
94{
95 BT_DBG("%s result 0x%2.2x", hdev->name, result);
96
97 if (hdev->req_status == HCI_REQ_PEND) {
98 hdev->req_result = result;
99 hdev->req_status = HCI_REQ_DONE;
100 if (skb)
101 hdev->req_skb = skb_get(skb);
102 wake_up_interruptible(&hdev->req_wait_q);
103 }
104}
105
106void hci_req_sync_cancel(struct hci_dev *hdev, int err)
107{
108 BT_DBG("%s err 0x%2.2x", hdev->name, err);
109
110 if (hdev->req_status == HCI_REQ_PEND) {
111 hdev->req_result = err;
112 hdev->req_status = HCI_REQ_CANCELED;
113 wake_up_interruptible(&hdev->req_wait_q);
114 }
115}
116
117struct sk_buff *__hci_cmd_sync_ev(struct hci_dev *hdev, u16 opcode, u32 plen,
118 const void *param, u8 event, u32 timeout)
119{
120 DECLARE_WAITQUEUE(wait, current);
121 struct hci_request req;
122 struct sk_buff *skb;
123 int err = 0;
124
125 BT_DBG("%s", hdev->name);
126
127 hci_req_init(&req, hdev);
128
129 hci_req_add_ev(&req, opcode, plen, param, event);
130
131 hdev->req_status = HCI_REQ_PEND;
132
133 add_wait_queue(&hdev->req_wait_q, &wait);
134 set_current_state(TASK_INTERRUPTIBLE);
135
136 err = hci_req_run_skb(&req, hci_req_sync_complete);
137 if (err < 0) {
138 remove_wait_queue(&hdev->req_wait_q, &wait);
139 set_current_state(TASK_RUNNING);
140 return ERR_PTR(err);
141 }
142
143 schedule_timeout(timeout);
144
145 remove_wait_queue(&hdev->req_wait_q, &wait);
146
147 if (signal_pending(current))
148 return ERR_PTR(-EINTR);
149
150 switch (hdev->req_status) {
151 case HCI_REQ_DONE:
152 err = -bt_to_errno(hdev->req_result);
153 break;
154
155 case HCI_REQ_CANCELED:
156 err = -hdev->req_result;
157 break;
158
159 default:
160 err = -ETIMEDOUT;
161 break;
162 }
163
164 hdev->req_status = hdev->req_result = 0;
165 skb = hdev->req_skb;
166 hdev->req_skb = NULL;
167
168 BT_DBG("%s end: err %d", hdev->name, err);
169
170 if (err < 0) {
171 kfree_skb(skb);
172 return ERR_PTR(err);
173 }
174
175 if (!skb)
176 return ERR_PTR(-ENODATA);
177
178 return skb;
179}
180EXPORT_SYMBOL(__hci_cmd_sync_ev);
181
182struct sk_buff *__hci_cmd_sync(struct hci_dev *hdev, u16 opcode, u32 plen,
183 const void *param, u32 timeout)
184{
185 return __hci_cmd_sync_ev(hdev, opcode, plen, param, 0, timeout);
186}
187EXPORT_SYMBOL(__hci_cmd_sync);
188
189/* Execute request and wait for completion. */
190int __hci_req_sync(struct hci_dev *hdev, int (*func)(struct hci_request *req,
191 unsigned long opt),
192 unsigned long opt, u32 timeout, u8 *hci_status)
193{
194 struct hci_request req;
195 DECLARE_WAITQUEUE(wait, current);
196 int err = 0;
197
198 BT_DBG("%s start", hdev->name);
199
200 hci_req_init(&req, hdev);
201
202 hdev->req_status = HCI_REQ_PEND;
203
204 err = func(&req, opt);
205 if (err) {
206 if (hci_status)
207 *hci_status = HCI_ERROR_UNSPECIFIED;
208 return err;
209 }
210
211 add_wait_queue(&hdev->req_wait_q, &wait);
212 set_current_state(TASK_INTERRUPTIBLE);
213
214 err = hci_req_run_skb(&req, hci_req_sync_complete);
215 if (err < 0) {
216 hdev->req_status = 0;
217
218 remove_wait_queue(&hdev->req_wait_q, &wait);
219 set_current_state(TASK_RUNNING);
220
221 /* ENODATA means the HCI request command queue is empty.
222 * This can happen when a request with conditionals doesn't
223 * trigger any commands to be sent. This is normal behavior
224 * and should not trigger an error return.
225 */
226 if (err == -ENODATA) {
227 if (hci_status)
228 *hci_status = 0;
229 return 0;
230 }
231
232 if (hci_status)
233 *hci_status = HCI_ERROR_UNSPECIFIED;
234
235 return err;
236 }
237
238 schedule_timeout(timeout);
239
240 remove_wait_queue(&hdev->req_wait_q, &wait);
241
242 if (signal_pending(current))
243 return -EINTR;
244
245 switch (hdev->req_status) {
246 case HCI_REQ_DONE:
247 err = -bt_to_errno(hdev->req_result);
248 if (hci_status)
249 *hci_status = hdev->req_result;
250 break;
251
252 case HCI_REQ_CANCELED:
253 err = -hdev->req_result;
254 if (hci_status)
255 *hci_status = HCI_ERROR_UNSPECIFIED;
256 break;
257
258 default:
259 err = -ETIMEDOUT;
260 if (hci_status)
261 *hci_status = HCI_ERROR_UNSPECIFIED;
262 break;
263 }
264
265 hdev->req_status = hdev->req_result = 0;
266
267 BT_DBG("%s end: err %d", hdev->name, err);
268
269 return err;
270}
271
272int hci_req_sync(struct hci_dev *hdev, int (*req)(struct hci_request *req,
273 unsigned long opt),
274 unsigned long opt, u32 timeout, u8 *hci_status)
275{
276 int ret;
277
278 if (!test_bit(HCI_UP, &hdev->flags))
279 return -ENETDOWN;
280
281 /* Serialize all requests */
282 hci_req_sync_lock(hdev);
283 ret = __hci_req_sync(hdev, req, opt, timeout, hci_status);
284 hci_req_sync_unlock(hdev);
285
286 return ret;
287}
288
289struct sk_buff *hci_prepare_cmd(struct hci_dev *hdev, u16 opcode, u32 plen,
290 const void *param)
291{
292 int len = HCI_COMMAND_HDR_SIZE + plen;
293 struct hci_command_hdr *hdr;
294 struct sk_buff *skb;
295
296 skb = bt_skb_alloc(len, GFP_ATOMIC);
297 if (!skb)
298 return NULL;
299
300 hdr = (struct hci_command_hdr *) skb_put(skb, HCI_COMMAND_HDR_SIZE);
301 hdr->opcode = cpu_to_le16(opcode);
302 hdr->plen = plen;
303
304 if (plen)
305 memcpy(skb_put(skb, plen), param, plen);
306
307 BT_DBG("skb len %d", skb->len);
308
309 hci_skb_pkt_type(skb) = HCI_COMMAND_PKT;
310 hci_skb_opcode(skb) = opcode;
311
312 return skb;
313}
314
315/* Queue a command to an asynchronous HCI request */
316void hci_req_add_ev(struct hci_request *req, u16 opcode, u32 plen,
317 const void *param, u8 event)
318{
319 struct hci_dev *hdev = req->hdev;
320 struct sk_buff *skb;
321
322 BT_DBG("%s opcode 0x%4.4x plen %d", hdev->name, opcode, plen);
323
324 /* If an error occurred during request building, there is no point in
325 * queueing the HCI command. We can simply return.
326 */
327 if (req->err)
328 return;
329
330 skb = hci_prepare_cmd(hdev, opcode, plen, param);
331 if (!skb) {
332 BT_ERR("%s no memory for command (opcode 0x%4.4x)",
333 hdev->name, opcode);
334 req->err = -ENOMEM;
335 return;
336 }
337
338 if (skb_queue_empty(&req->cmd_q))
339 bt_cb(skb)->hci.req_flags |= HCI_REQ_START;
340
341 bt_cb(skb)->hci.req_event = event;
342
343 skb_queue_tail(&req->cmd_q, skb);
344}
345
346void hci_req_add(struct hci_request *req, u16 opcode, u32 plen,
347 const void *param)
348{
349 hci_req_add_ev(req, opcode, plen, param, 0);
350}
351
352void __hci_req_write_fast_connectable(struct hci_request *req, bool enable)
353{
354 struct hci_dev *hdev = req->hdev;
355 struct hci_cp_write_page_scan_activity acp;
356 u8 type;
357
358 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
359 return;
360
361 if (hdev->hci_ver < BLUETOOTH_VER_1_2)
362 return;
363
364 if (enable) {
365 type = PAGE_SCAN_TYPE_INTERLACED;
366
367 /* 160 msec page scan interval */
368 acp.interval = cpu_to_le16(0x0100);
369 } else {
370 type = PAGE_SCAN_TYPE_STANDARD; /* default */
371
372 /* default 1.28 sec page scan */
373 acp.interval = cpu_to_le16(0x0800);
374 }
375
376 acp.window = cpu_to_le16(0x0012);
377
378 if (__cpu_to_le16(hdev->page_scan_interval) != acp.interval ||
379 __cpu_to_le16(hdev->page_scan_window) != acp.window)
380 hci_req_add(req, HCI_OP_WRITE_PAGE_SCAN_ACTIVITY,
381 sizeof(acp), &acp);
382
383 if (hdev->page_scan_type != type)
384 hci_req_add(req, HCI_OP_WRITE_PAGE_SCAN_TYPE, 1, &type);
385}
386
387/* This function controls the background scanning based on hdev->pend_le_conns
388 * list. If there are pending LE connection we start the background scanning,
389 * otherwise we stop it.
390 *
391 * This function requires the caller holds hdev->lock.
392 */
393static void __hci_update_background_scan(struct hci_request *req)
394{
395 struct hci_dev *hdev = req->hdev;
396
397 if (!test_bit(HCI_UP, &hdev->flags) ||
398 test_bit(HCI_INIT, &hdev->flags) ||
399 hci_dev_test_flag(hdev, HCI_SETUP) ||
400 hci_dev_test_flag(hdev, HCI_CONFIG) ||
401 hci_dev_test_flag(hdev, HCI_AUTO_OFF) ||
402 hci_dev_test_flag(hdev, HCI_UNREGISTER))
403 return;
404
405 /* No point in doing scanning if LE support hasn't been enabled */
406 if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED))
407 return;
408
409 /* If discovery is active don't interfere with it */
410 if (hdev->discovery.state != DISCOVERY_STOPPED)
411 return;
412
413 /* Reset RSSI and UUID filters when starting background scanning
414 * since these filters are meant for service discovery only.
415 *
416 * The Start Discovery and Start Service Discovery operations
417 * ensure to set proper values for RSSI threshold and UUID
418 * filter list. So it is safe to just reset them here.
419 */
420 hci_discovery_filter_clear(hdev);
421
422 if (list_empty(&hdev->pend_le_conns) &&
423 list_empty(&hdev->pend_le_reports)) {
424 /* If there is no pending LE connections or devices
425 * to be scanned for, we should stop the background
426 * scanning.
427 */
428
429 /* If controller is not scanning we are done. */
430 if (!hci_dev_test_flag(hdev, HCI_LE_SCAN))
431 return;
432
433 hci_req_add_le_scan_disable(req);
434
435 BT_DBG("%s stopping background scanning", hdev->name);
436 } else {
437 /* If there is at least one pending LE connection, we should
438 * keep the background scan running.
439 */
440
441 /* If controller is connecting, we should not start scanning
442 * since some controllers are not able to scan and connect at
443 * the same time.
444 */
445 if (hci_lookup_le_connect(hdev))
446 return;
447
448 /* If controller is currently scanning, we stop it to ensure we
449 * don't miss any advertising (due to duplicates filter).
450 */
451 if (hci_dev_test_flag(hdev, HCI_LE_SCAN))
452 hci_req_add_le_scan_disable(req);
453
454 hci_req_add_le_passive_scan(req);
455
456 BT_DBG("%s starting background scanning", hdev->name);
457 }
458}
459
460void __hci_req_update_name(struct hci_request *req)
461{
462 struct hci_dev *hdev = req->hdev;
463 struct hci_cp_write_local_name cp;
464
465 memcpy(cp.name, hdev->dev_name, sizeof(cp.name));
466
467 hci_req_add(req, HCI_OP_WRITE_LOCAL_NAME, sizeof(cp), &cp);
468}
469
470#define PNP_INFO_SVCLASS_ID 0x1200
471
472static u8 *create_uuid16_list(struct hci_dev *hdev, u8 *data, ptrdiff_t len)
473{
474 u8 *ptr = data, *uuids_start = NULL;
475 struct bt_uuid *uuid;
476
477 if (len < 4)
478 return ptr;
479
480 list_for_each_entry(uuid, &hdev->uuids, list) {
481 u16 uuid16;
482
483 if (uuid->size != 16)
484 continue;
485
486 uuid16 = get_unaligned_le16(&uuid->uuid[12]);
487 if (uuid16 < 0x1100)
488 continue;
489
490 if (uuid16 == PNP_INFO_SVCLASS_ID)
491 continue;
492
493 if (!uuids_start) {
494 uuids_start = ptr;
495 uuids_start[0] = 1;
496 uuids_start[1] = EIR_UUID16_ALL;
497 ptr += 2;
498 }
499
500 /* Stop if not enough space to put next UUID */
501 if ((ptr - data) + sizeof(u16) > len) {
502 uuids_start[1] = EIR_UUID16_SOME;
503 break;
504 }
505
506 *ptr++ = (uuid16 & 0x00ff);
507 *ptr++ = (uuid16 & 0xff00) >> 8;
508 uuids_start[0] += sizeof(uuid16);
509 }
510
511 return ptr;
512}
513
514static u8 *create_uuid32_list(struct hci_dev *hdev, u8 *data, ptrdiff_t len)
515{
516 u8 *ptr = data, *uuids_start = NULL;
517 struct bt_uuid *uuid;
518
519 if (len < 6)
520 return ptr;
521
522 list_for_each_entry(uuid, &hdev->uuids, list) {
523 if (uuid->size != 32)
524 continue;
525
526 if (!uuids_start) {
527 uuids_start = ptr;
528 uuids_start[0] = 1;
529 uuids_start[1] = EIR_UUID32_ALL;
530 ptr += 2;
531 }
532
533 /* Stop if not enough space to put next UUID */
534 if ((ptr - data) + sizeof(u32) > len) {
535 uuids_start[1] = EIR_UUID32_SOME;
536 break;
537 }
538
539 memcpy(ptr, &uuid->uuid[12], sizeof(u32));
540 ptr += sizeof(u32);
541 uuids_start[0] += sizeof(u32);
542 }
543
544 return ptr;
545}
546
547static u8 *create_uuid128_list(struct hci_dev *hdev, u8 *data, ptrdiff_t len)
548{
549 u8 *ptr = data, *uuids_start = NULL;
550 struct bt_uuid *uuid;
551
552 if (len < 18)
553 return ptr;
554
555 list_for_each_entry(uuid, &hdev->uuids, list) {
556 if (uuid->size != 128)
557 continue;
558
559 if (!uuids_start) {
560 uuids_start = ptr;
561 uuids_start[0] = 1;
562 uuids_start[1] = EIR_UUID128_ALL;
563 ptr += 2;
564 }
565
566 /* Stop if not enough space to put next UUID */
567 if ((ptr - data) + 16 > len) {
568 uuids_start[1] = EIR_UUID128_SOME;
569 break;
570 }
571
572 memcpy(ptr, uuid->uuid, 16);
573 ptr += 16;
574 uuids_start[0] += 16;
575 }
576
577 return ptr;
578}
579
580static void create_eir(struct hci_dev *hdev, u8 *data)
581{
582 u8 *ptr = data;
583 size_t name_len;
584
585 name_len = strlen(hdev->dev_name);
586
587 if (name_len > 0) {
588 /* EIR Data type */
589 if (name_len > 48) {
590 name_len = 48;
591 ptr[1] = EIR_NAME_SHORT;
592 } else
593 ptr[1] = EIR_NAME_COMPLETE;
594
595 /* EIR Data length */
596 ptr[0] = name_len + 1;
597
598 memcpy(ptr + 2, hdev->dev_name, name_len);
599
600 ptr += (name_len + 2);
601 }
602
603 if (hdev->inq_tx_power != HCI_TX_POWER_INVALID) {
604 ptr[0] = 2;
605 ptr[1] = EIR_TX_POWER;
606 ptr[2] = (u8) hdev->inq_tx_power;
607
608 ptr += 3;
609 }
610
611 if (hdev->devid_source > 0) {
612 ptr[0] = 9;
613 ptr[1] = EIR_DEVICE_ID;
614
615 put_unaligned_le16(hdev->devid_source, ptr + 2);
616 put_unaligned_le16(hdev->devid_vendor, ptr + 4);
617 put_unaligned_le16(hdev->devid_product, ptr + 6);
618 put_unaligned_le16(hdev->devid_version, ptr + 8);
619
620 ptr += 10;
621 }
622
623 ptr = create_uuid16_list(hdev, ptr, HCI_MAX_EIR_LENGTH - (ptr - data));
624 ptr = create_uuid32_list(hdev, ptr, HCI_MAX_EIR_LENGTH - (ptr - data));
625 ptr = create_uuid128_list(hdev, ptr, HCI_MAX_EIR_LENGTH - (ptr - data));
626}
627
628void __hci_req_update_eir(struct hci_request *req)
629{
630 struct hci_dev *hdev = req->hdev;
631 struct hci_cp_write_eir cp;
632
633 if (!hdev_is_powered(hdev))
634 return;
635
636 if (!lmp_ext_inq_capable(hdev))
637 return;
638
639 if (!hci_dev_test_flag(hdev, HCI_SSP_ENABLED))
640 return;
641
642 if (hci_dev_test_flag(hdev, HCI_SERVICE_CACHE))
643 return;
644
645 memset(&cp, 0, sizeof(cp));
646
647 create_eir(hdev, cp.data);
648
649 if (memcmp(cp.data, hdev->eir, sizeof(cp.data)) == 0)
650 return;
651
652 memcpy(hdev->eir, cp.data, sizeof(cp.data));
653
654 hci_req_add(req, HCI_OP_WRITE_EIR, sizeof(cp), &cp);
655}
656
657void hci_req_add_le_scan_disable(struct hci_request *req)
658{
659 struct hci_cp_le_set_scan_enable cp;
660
661 memset(&cp, 0, sizeof(cp));
662 cp.enable = LE_SCAN_DISABLE;
663 hci_req_add(req, HCI_OP_LE_SET_SCAN_ENABLE, sizeof(cp), &cp);
664}
665
666static void add_to_white_list(struct hci_request *req,
667 struct hci_conn_params *params)
668{
669 struct hci_cp_le_add_to_white_list cp;
670
671 cp.bdaddr_type = params->addr_type;
672 bacpy(&cp.bdaddr, ¶ms->addr);
673
674 hci_req_add(req, HCI_OP_LE_ADD_TO_WHITE_LIST, sizeof(cp), &cp);
675}
676
677static u8 update_white_list(struct hci_request *req)
678{
679 struct hci_dev *hdev = req->hdev;
680 struct hci_conn_params *params;
681 struct bdaddr_list *b;
682 uint8_t white_list_entries = 0;
683
684 /* Go through the current white list programmed into the
685 * controller one by one and check if that address is still
686 * in the list of pending connections or list of devices to
687 * report. If not present in either list, then queue the
688 * command to remove it from the controller.
689 */
690 list_for_each_entry(b, &hdev->le_white_list, list) {
691 /* If the device is neither in pend_le_conns nor
692 * pend_le_reports then remove it from the whitelist.
693 */
694 if (!hci_pend_le_action_lookup(&hdev->pend_le_conns,
695 &b->bdaddr, b->bdaddr_type) &&
696 !hci_pend_le_action_lookup(&hdev->pend_le_reports,
697 &b->bdaddr, b->bdaddr_type)) {
698 struct hci_cp_le_del_from_white_list cp;
699
700 cp.bdaddr_type = b->bdaddr_type;
701 bacpy(&cp.bdaddr, &b->bdaddr);
702
703 hci_req_add(req, HCI_OP_LE_DEL_FROM_WHITE_LIST,
704 sizeof(cp), &cp);
705 continue;
706 }
707
708 if (hci_find_irk_by_addr(hdev, &b->bdaddr, b->bdaddr_type)) {
709 /* White list can not be used with RPAs */
710 return 0x00;
711 }
712
713 white_list_entries++;
714 }
715
716 /* Since all no longer valid white list entries have been
717 * removed, walk through the list of pending connections
718 * and ensure that any new device gets programmed into
719 * the controller.
720 *
721 * If the list of the devices is larger than the list of
722 * available white list entries in the controller, then
723 * just abort and return filer policy value to not use the
724 * white list.
725 */
726 list_for_each_entry(params, &hdev->pend_le_conns, action) {
727 if (hci_bdaddr_list_lookup(&hdev->le_white_list,
728 ¶ms->addr, params->addr_type))
729 continue;
730
731 if (white_list_entries >= hdev->le_white_list_size) {
732 /* Select filter policy to accept all advertising */
733 return 0x00;
734 }
735
736 if (hci_find_irk_by_addr(hdev, ¶ms->addr,
737 params->addr_type)) {
738 /* White list can not be used with RPAs */
739 return 0x00;
740 }
741
742 white_list_entries++;
743 add_to_white_list(req, params);
744 }
745
746 /* After adding all new pending connections, walk through
747 * the list of pending reports and also add these to the
748 * white list if there is still space.
749 */
750 list_for_each_entry(params, &hdev->pend_le_reports, action) {
751 if (hci_bdaddr_list_lookup(&hdev->le_white_list,
752 ¶ms->addr, params->addr_type))
753 continue;
754
755 if (white_list_entries >= hdev->le_white_list_size) {
756 /* Select filter policy to accept all advertising */
757 return 0x00;
758 }
759
760 if (hci_find_irk_by_addr(hdev, ¶ms->addr,
761 params->addr_type)) {
762 /* White list can not be used with RPAs */
763 return 0x00;
764 }
765
766 white_list_entries++;
767 add_to_white_list(req, params);
768 }
769
770 /* Select filter policy to use white list */
771 return 0x01;
772}
773
774static bool scan_use_rpa(struct hci_dev *hdev)
775{
776 return hci_dev_test_flag(hdev, HCI_PRIVACY);
777}
778
779void hci_req_add_le_passive_scan(struct hci_request *req)
780{
781 struct hci_cp_le_set_scan_param param_cp;
782 struct hci_cp_le_set_scan_enable enable_cp;
783 struct hci_dev *hdev = req->hdev;
784 u8 own_addr_type;
785 u8 filter_policy;
786
787 /* Set require_privacy to false since no SCAN_REQ are send
788 * during passive scanning. Not using an non-resolvable address
789 * here is important so that peer devices using direct
790 * advertising with our address will be correctly reported
791 * by the controller.
792 */
793 if (hci_update_random_address(req, false, scan_use_rpa(hdev),
794 &own_addr_type))
795 return;
796
797 /* Adding or removing entries from the white list must
798 * happen before enabling scanning. The controller does
799 * not allow white list modification while scanning.
800 */
801 filter_policy = update_white_list(req);
802
803 /* When the controller is using random resolvable addresses and
804 * with that having LE privacy enabled, then controllers with
805 * Extended Scanner Filter Policies support can now enable support
806 * for handling directed advertising.
807 *
808 * So instead of using filter polices 0x00 (no whitelist)
809 * and 0x01 (whitelist enabled) use the new filter policies
810 * 0x02 (no whitelist) and 0x03 (whitelist enabled).
811 */
812 if (hci_dev_test_flag(hdev, HCI_PRIVACY) &&
813 (hdev->le_features[0] & HCI_LE_EXT_SCAN_POLICY))
814 filter_policy |= 0x02;
815
816 memset(¶m_cp, 0, sizeof(param_cp));
817 param_cp.type = LE_SCAN_PASSIVE;
818 param_cp.interval = cpu_to_le16(hdev->le_scan_interval);
819 param_cp.window = cpu_to_le16(hdev->le_scan_window);
820 param_cp.own_address_type = own_addr_type;
821 param_cp.filter_policy = filter_policy;
822 hci_req_add(req, HCI_OP_LE_SET_SCAN_PARAM, sizeof(param_cp),
823 ¶m_cp);
824
825 memset(&enable_cp, 0, sizeof(enable_cp));
826 enable_cp.enable = LE_SCAN_ENABLE;
827 enable_cp.filter_dup = LE_SCAN_FILTER_DUP_ENABLE;
828 hci_req_add(req, HCI_OP_LE_SET_SCAN_ENABLE, sizeof(enable_cp),
829 &enable_cp);
830}
831
832static u8 get_cur_adv_instance_scan_rsp_len(struct hci_dev *hdev)
833{
834 u8 instance = hdev->cur_adv_instance;
835 struct adv_info *adv_instance;
836
837 /* Ignore instance 0 */
838 if (instance == 0x00)
839 return 0;
840
841 adv_instance = hci_find_adv_instance(hdev, instance);
842 if (!adv_instance)
843 return 0;
844
845 /* TODO: Take into account the "appearance" and "local-name" flags here.
846 * These are currently being ignored as they are not supported.
847 */
848 return adv_instance->scan_rsp_len;
849}
850
851void __hci_req_disable_advertising(struct hci_request *req)
852{
853 u8 enable = 0x00;
854
855 hci_req_add(req, HCI_OP_LE_SET_ADV_ENABLE, sizeof(enable), &enable);
856}
857
858static u32 get_adv_instance_flags(struct hci_dev *hdev, u8 instance)
859{
860 u32 flags;
861 struct adv_info *adv_instance;
862
863 if (instance == 0x00) {
864 /* Instance 0 always manages the "Tx Power" and "Flags"
865 * fields
866 */
867 flags = MGMT_ADV_FLAG_TX_POWER | MGMT_ADV_FLAG_MANAGED_FLAGS;
868
869 /* For instance 0, the HCI_ADVERTISING_CONNECTABLE setting
870 * corresponds to the "connectable" instance flag.
871 */
872 if (hci_dev_test_flag(hdev, HCI_ADVERTISING_CONNECTABLE))
873 flags |= MGMT_ADV_FLAG_CONNECTABLE;
874
875 if (hci_dev_test_flag(hdev, HCI_LIMITED_DISCOVERABLE))
876 flags |= MGMT_ADV_FLAG_LIMITED_DISCOV;
877 else if (hci_dev_test_flag(hdev, HCI_DISCOVERABLE))
878 flags |= MGMT_ADV_FLAG_DISCOV;
879
880 return flags;
881 }
882
883 adv_instance = hci_find_adv_instance(hdev, instance);
884
885 /* Return 0 when we got an invalid instance identifier. */
886 if (!adv_instance)
887 return 0;
888
889 return adv_instance->flags;
890}
891
892static bool adv_use_rpa(struct hci_dev *hdev, uint32_t flags)
893{
894 /* If privacy is not enabled don't use RPA */
895 if (!hci_dev_test_flag(hdev, HCI_PRIVACY))
896 return false;
897
898 /* If basic privacy mode is enabled use RPA */
899 if (!hci_dev_test_flag(hdev, HCI_LIMITED_PRIVACY))
900 return true;
901
902 /* If limited privacy mode is enabled don't use RPA if we're
903 * both discoverable and bondable.
904 */
905 if ((flags & MGMT_ADV_FLAG_DISCOV) &&
906 hci_dev_test_flag(hdev, HCI_BONDABLE))
907 return false;
908
909 /* We're neither bondable nor discoverable in the limited
910 * privacy mode, therefore use RPA.
911 */
912 return true;
913}
914
915void __hci_req_enable_advertising(struct hci_request *req)
916{
917 struct hci_dev *hdev = req->hdev;
918 struct hci_cp_le_set_adv_param cp;
919 u8 own_addr_type, enable = 0x01;
920 bool connectable;
921 u32 flags;
922
923 if (hci_conn_num(hdev, LE_LINK) > 0)
924 return;
925
926 if (hci_dev_test_flag(hdev, HCI_LE_ADV))
927 __hci_req_disable_advertising(req);
928
929 /* Clear the HCI_LE_ADV bit temporarily so that the
930 * hci_update_random_address knows that it's safe to go ahead
931 * and write a new random address. The flag will be set back on
932 * as soon as the SET_ADV_ENABLE HCI command completes.
933 */
934 hci_dev_clear_flag(hdev, HCI_LE_ADV);
935
936 flags = get_adv_instance_flags(hdev, hdev->cur_adv_instance);
937
938 /* If the "connectable" instance flag was not set, then choose between
939 * ADV_IND and ADV_NONCONN_IND based on the global connectable setting.
940 */
941 connectable = (flags & MGMT_ADV_FLAG_CONNECTABLE) ||
942 mgmt_get_connectable(hdev);
943
944 /* Set require_privacy to true only when non-connectable
945 * advertising is used. In that case it is fine to use a
946 * non-resolvable private address.
947 */
948 if (hci_update_random_address(req, !connectable,
949 adv_use_rpa(hdev, flags),
950 &own_addr_type) < 0)
951 return;
952
953 memset(&cp, 0, sizeof(cp));
954 cp.min_interval = cpu_to_le16(hdev->le_adv_min_interval);
955 cp.max_interval = cpu_to_le16(hdev->le_adv_max_interval);
956
957 if (connectable)
958 cp.type = LE_ADV_IND;
959 else if (get_cur_adv_instance_scan_rsp_len(hdev))
960 cp.type = LE_ADV_SCAN_IND;
961 else
962 cp.type = LE_ADV_NONCONN_IND;
963
964 cp.own_address_type = own_addr_type;
965 cp.channel_map = hdev->le_adv_channel_map;
966
967 hci_req_add(req, HCI_OP_LE_SET_ADV_PARAM, sizeof(cp), &cp);
968
969 hci_req_add(req, HCI_OP_LE_SET_ADV_ENABLE, sizeof(enable), &enable);
970}
971
972static u8 create_default_scan_rsp_data(struct hci_dev *hdev, u8 *ptr)
973{
974 u8 ad_len = 0;
975 size_t name_len;
976
977 name_len = strlen(hdev->dev_name);
978 if (name_len > 0) {
979 size_t max_len = HCI_MAX_AD_LENGTH - ad_len - 2;
980
981 if (name_len > max_len) {
982 name_len = max_len;
983 ptr[1] = EIR_NAME_SHORT;
984 } else
985 ptr[1] = EIR_NAME_COMPLETE;
986
987 ptr[0] = name_len + 1;
988
989 memcpy(ptr + 2, hdev->dev_name, name_len);
990
991 ad_len += (name_len + 2);
992 ptr += (name_len + 2);
993 }
994
995 return ad_len;
996}
997
998static u8 create_instance_scan_rsp_data(struct hci_dev *hdev, u8 instance,
999 u8 *ptr)
1000{
1001 struct adv_info *adv_instance;
1002
1003 adv_instance = hci_find_adv_instance(hdev, instance);
1004 if (!adv_instance)
1005 return 0;
1006
1007 /* TODO: Set the appropriate entries based on advertising instance flags
1008 * here once flags other than 0 are supported.
1009 */
1010 memcpy(ptr, adv_instance->scan_rsp_data,
1011 adv_instance->scan_rsp_len);
1012
1013 return adv_instance->scan_rsp_len;
1014}
1015
1016void __hci_req_update_scan_rsp_data(struct hci_request *req, u8 instance)
1017{
1018 struct hci_dev *hdev = req->hdev;
1019 struct hci_cp_le_set_scan_rsp_data cp;
1020 u8 len;
1021
1022 if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED))
1023 return;
1024
1025 memset(&cp, 0, sizeof(cp));
1026
1027 if (instance)
1028 len = create_instance_scan_rsp_data(hdev, instance, cp.data);
1029 else
1030 len = create_default_scan_rsp_data(hdev, cp.data);
1031
1032 if (hdev->scan_rsp_data_len == len &&
1033 !memcmp(cp.data, hdev->scan_rsp_data, len))
1034 return;
1035
1036 memcpy(hdev->scan_rsp_data, cp.data, sizeof(cp.data));
1037 hdev->scan_rsp_data_len = len;
1038
1039 cp.length = len;
1040
1041 hci_req_add(req, HCI_OP_LE_SET_SCAN_RSP_DATA, sizeof(cp), &cp);
1042}
1043
1044static u8 create_instance_adv_data(struct hci_dev *hdev, u8 instance, u8 *ptr)
1045{
1046 struct adv_info *adv_instance = NULL;
1047 u8 ad_len = 0, flags = 0;
1048 u32 instance_flags;
1049
1050 /* Return 0 when the current instance identifier is invalid. */
1051 if (instance) {
1052 adv_instance = hci_find_adv_instance(hdev, instance);
1053 if (!adv_instance)
1054 return 0;
1055 }
1056
1057 instance_flags = get_adv_instance_flags(hdev, instance);
1058
1059 /* The Add Advertising command allows userspace to set both the general
1060 * and limited discoverable flags.
1061 */
1062 if (instance_flags & MGMT_ADV_FLAG_DISCOV)
1063 flags |= LE_AD_GENERAL;
1064
1065 if (instance_flags & MGMT_ADV_FLAG_LIMITED_DISCOV)
1066 flags |= LE_AD_LIMITED;
1067
1068 if (flags || (instance_flags & MGMT_ADV_FLAG_MANAGED_FLAGS)) {
1069 /* If a discovery flag wasn't provided, simply use the global
1070 * settings.
1071 */
1072 if (!flags)
1073 flags |= mgmt_get_adv_discov_flags(hdev);
1074
1075 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
1076 flags |= LE_AD_NO_BREDR;
1077
1078 /* If flags would still be empty, then there is no need to
1079 * include the "Flags" AD field".
1080 */
1081 if (flags) {
1082 ptr[0] = 0x02;
1083 ptr[1] = EIR_FLAGS;
1084 ptr[2] = flags;
1085
1086 ad_len += 3;
1087 ptr += 3;
1088 }
1089 }
1090
1091 if (adv_instance) {
1092 memcpy(ptr, adv_instance->adv_data,
1093 adv_instance->adv_data_len);
1094 ad_len += adv_instance->adv_data_len;
1095 ptr += adv_instance->adv_data_len;
1096 }
1097
1098 /* Provide Tx Power only if we can provide a valid value for it */
1099 if (hdev->adv_tx_power != HCI_TX_POWER_INVALID &&
1100 (instance_flags & MGMT_ADV_FLAG_TX_POWER)) {
1101 ptr[0] = 0x02;
1102 ptr[1] = EIR_TX_POWER;
1103 ptr[2] = (u8)hdev->adv_tx_power;
1104
1105 ad_len += 3;
1106 ptr += 3;
1107 }
1108
1109 return ad_len;
1110}
1111
1112void __hci_req_update_adv_data(struct hci_request *req, u8 instance)
1113{
1114 struct hci_dev *hdev = req->hdev;
1115 struct hci_cp_le_set_adv_data cp;
1116 u8 len;
1117
1118 if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED))
1119 return;
1120
1121 memset(&cp, 0, sizeof(cp));
1122
1123 len = create_instance_adv_data(hdev, instance, cp.data);
1124
1125 /* There's nothing to do if the data hasn't changed */
1126 if (hdev->adv_data_len == len &&
1127 memcmp(cp.data, hdev->adv_data, len) == 0)
1128 return;
1129
1130 memcpy(hdev->adv_data, cp.data, sizeof(cp.data));
1131 hdev->adv_data_len = len;
1132
1133 cp.length = len;
1134
1135 hci_req_add(req, HCI_OP_LE_SET_ADV_DATA, sizeof(cp), &cp);
1136}
1137
1138int hci_req_update_adv_data(struct hci_dev *hdev, u8 instance)
1139{
1140 struct hci_request req;
1141
1142 hci_req_init(&req, hdev);
1143 __hci_req_update_adv_data(&req, instance);
1144
1145 return hci_req_run(&req, NULL);
1146}
1147
1148static void adv_enable_complete(struct hci_dev *hdev, u8 status, u16 opcode)
1149{
1150 BT_DBG("%s status %u", hdev->name, status);
1151}
1152
1153void hci_req_reenable_advertising(struct hci_dev *hdev)
1154{
1155 struct hci_request req;
1156
1157 if (!hci_dev_test_flag(hdev, HCI_ADVERTISING) &&
1158 list_empty(&hdev->adv_instances))
1159 return;
1160
1161 hci_req_init(&req, hdev);
1162
1163 if (hdev->cur_adv_instance) {
1164 __hci_req_schedule_adv_instance(&req, hdev->cur_adv_instance,
1165 true);
1166 } else {
1167 __hci_req_update_adv_data(&req, 0x00);
1168 __hci_req_update_scan_rsp_data(&req, 0x00);
1169 __hci_req_enable_advertising(&req);
1170 }
1171
1172 hci_req_run(&req, adv_enable_complete);
1173}
1174
1175static void adv_timeout_expire(struct work_struct *work)
1176{
1177 struct hci_dev *hdev = container_of(work, struct hci_dev,
1178 adv_instance_expire.work);
1179
1180 struct hci_request req;
1181 u8 instance;
1182
1183 BT_DBG("%s", hdev->name);
1184
1185 hci_dev_lock(hdev);
1186
1187 hdev->adv_instance_timeout = 0;
1188
1189 instance = hdev->cur_adv_instance;
1190 if (instance == 0x00)
1191 goto unlock;
1192
1193 hci_req_init(&req, hdev);
1194
1195 hci_req_clear_adv_instance(hdev, &req, instance, false);
1196
1197 if (list_empty(&hdev->adv_instances))
1198 __hci_req_disable_advertising(&req);
1199
1200 hci_req_run(&req, NULL);
1201
1202unlock:
1203 hci_dev_unlock(hdev);
1204}
1205
1206int __hci_req_schedule_adv_instance(struct hci_request *req, u8 instance,
1207 bool force)
1208{
1209 struct hci_dev *hdev = req->hdev;
1210 struct adv_info *adv_instance = NULL;
1211 u16 timeout;
1212
1213 if (hci_dev_test_flag(hdev, HCI_ADVERTISING) ||
1214 list_empty(&hdev->adv_instances))
1215 return -EPERM;
1216
1217 if (hdev->adv_instance_timeout)
1218 return -EBUSY;
1219
1220 adv_instance = hci_find_adv_instance(hdev, instance);
1221 if (!adv_instance)
1222 return -ENOENT;
1223
1224 /* A zero timeout means unlimited advertising. As long as there is
1225 * only one instance, duration should be ignored. We still set a timeout
1226 * in case further instances are being added later on.
1227 *
1228 * If the remaining lifetime of the instance is more than the duration
1229 * then the timeout corresponds to the duration, otherwise it will be
1230 * reduced to the remaining instance lifetime.
1231 */
1232 if (adv_instance->timeout == 0 ||
1233 adv_instance->duration <= adv_instance->remaining_time)
1234 timeout = adv_instance->duration;
1235 else
1236 timeout = adv_instance->remaining_time;
1237
1238 /* The remaining time is being reduced unless the instance is being
1239 * advertised without time limit.
1240 */
1241 if (adv_instance->timeout)
1242 adv_instance->remaining_time =
1243 adv_instance->remaining_time - timeout;
1244
1245 hdev->adv_instance_timeout = timeout;
1246 queue_delayed_work(hdev->req_workqueue,
1247 &hdev->adv_instance_expire,
1248 msecs_to_jiffies(timeout * 1000));
1249
1250 /* If we're just re-scheduling the same instance again then do not
1251 * execute any HCI commands. This happens when a single instance is
1252 * being advertised.
1253 */
1254 if (!force && hdev->cur_adv_instance == instance &&
1255 hci_dev_test_flag(hdev, HCI_LE_ADV))
1256 return 0;
1257
1258 hdev->cur_adv_instance = instance;
1259 __hci_req_update_adv_data(req, instance);
1260 __hci_req_update_scan_rsp_data(req, instance);
1261 __hci_req_enable_advertising(req);
1262
1263 return 0;
1264}
1265
1266static void cancel_adv_timeout(struct hci_dev *hdev)
1267{
1268 if (hdev->adv_instance_timeout) {
1269 hdev->adv_instance_timeout = 0;
1270 cancel_delayed_work(&hdev->adv_instance_expire);
1271 }
1272}
1273
1274/* For a single instance:
1275 * - force == true: The instance will be removed even when its remaining
1276 * lifetime is not zero.
1277 * - force == false: the instance will be deactivated but kept stored unless
1278 * the remaining lifetime is zero.
1279 *
1280 * For instance == 0x00:
1281 * - force == true: All instances will be removed regardless of their timeout
1282 * setting.
1283 * - force == false: Only instances that have a timeout will be removed.
1284 */
1285void hci_req_clear_adv_instance(struct hci_dev *hdev, struct hci_request *req,
1286 u8 instance, bool force)
1287{
1288 struct adv_info *adv_instance, *n, *next_instance = NULL;
1289 int err;
1290 u8 rem_inst;
1291
1292 /* Cancel any timeout concerning the removed instance(s). */
1293 if (!instance || hdev->cur_adv_instance == instance)
1294 cancel_adv_timeout(hdev);
1295
1296 /* Get the next instance to advertise BEFORE we remove
1297 * the current one. This can be the same instance again
1298 * if there is only one instance.
1299 */
1300 if (instance && hdev->cur_adv_instance == instance)
1301 next_instance = hci_get_next_instance(hdev, instance);
1302
1303 if (instance == 0x00) {
1304 list_for_each_entry_safe(adv_instance, n, &hdev->adv_instances,
1305 list) {
1306 if (!(force || adv_instance->timeout))
1307 continue;
1308
1309 rem_inst = adv_instance->instance;
1310 err = hci_remove_adv_instance(hdev, rem_inst);
1311 if (!err)
1312 mgmt_advertising_removed(NULL, hdev, rem_inst);
1313 }
1314 } else {
1315 adv_instance = hci_find_adv_instance(hdev, instance);
1316
1317 if (force || (adv_instance && adv_instance->timeout &&
1318 !adv_instance->remaining_time)) {
1319 /* Don't advertise a removed instance. */
1320 if (next_instance &&
1321 next_instance->instance == instance)
1322 next_instance = NULL;
1323
1324 err = hci_remove_adv_instance(hdev, instance);
1325 if (!err)
1326 mgmt_advertising_removed(NULL, hdev, instance);
1327 }
1328 }
1329
1330 if (!req || !hdev_is_powered(hdev) ||
1331 hci_dev_test_flag(hdev, HCI_ADVERTISING))
1332 return;
1333
1334 if (next_instance)
1335 __hci_req_schedule_adv_instance(req, next_instance->instance,
1336 false);
1337}
1338
1339static void set_random_addr(struct hci_request *req, bdaddr_t *rpa)
1340{
1341 struct hci_dev *hdev = req->hdev;
1342
1343 /* If we're advertising or initiating an LE connection we can't
1344 * go ahead and change the random address at this time. This is
1345 * because the eventual initiator address used for the
1346 * subsequently created connection will be undefined (some
1347 * controllers use the new address and others the one we had
1348 * when the operation started).
1349 *
1350 * In this kind of scenario skip the update and let the random
1351 * address be updated at the next cycle.
1352 */
1353 if (hci_dev_test_flag(hdev, HCI_LE_ADV) ||
1354 hci_lookup_le_connect(hdev)) {
1355 BT_DBG("Deferring random address update");
1356 hci_dev_set_flag(hdev, HCI_RPA_EXPIRED);
1357 return;
1358 }
1359
1360 hci_req_add(req, HCI_OP_LE_SET_RANDOM_ADDR, 6, rpa);
1361}
1362
1363int hci_update_random_address(struct hci_request *req, bool require_privacy,
1364 bool use_rpa, u8 *own_addr_type)
1365{
1366 struct hci_dev *hdev = req->hdev;
1367 int err;
1368
1369 /* If privacy is enabled use a resolvable private address. If
1370 * current RPA has expired or there is something else than
1371 * the current RPA in use, then generate a new one.
1372 */
1373 if (use_rpa) {
1374 int to;
1375
1376 *own_addr_type = ADDR_LE_DEV_RANDOM;
1377
1378 if (!hci_dev_test_and_clear_flag(hdev, HCI_RPA_EXPIRED) &&
1379 !bacmp(&hdev->random_addr, &hdev->rpa))
1380 return 0;
1381
1382 err = smp_generate_rpa(hdev, hdev->irk, &hdev->rpa);
1383 if (err < 0) {
1384 BT_ERR("%s failed to generate new RPA", hdev->name);
1385 return err;
1386 }
1387
1388 set_random_addr(req, &hdev->rpa);
1389
1390 to = msecs_to_jiffies(hdev->rpa_timeout * 1000);
1391 queue_delayed_work(hdev->workqueue, &hdev->rpa_expired, to);
1392
1393 return 0;
1394 }
1395
1396 /* In case of required privacy without resolvable private address,
1397 * use an non-resolvable private address. This is useful for active
1398 * scanning and non-connectable advertising.
1399 */
1400 if (require_privacy) {
1401 bdaddr_t nrpa;
1402
1403 while (true) {
1404 /* The non-resolvable private address is generated
1405 * from random six bytes with the two most significant
1406 * bits cleared.
1407 */
1408 get_random_bytes(&nrpa, 6);
1409 nrpa.b[5] &= 0x3f;
1410
1411 /* The non-resolvable private address shall not be
1412 * equal to the public address.
1413 */
1414 if (bacmp(&hdev->bdaddr, &nrpa))
1415 break;
1416 }
1417
1418 *own_addr_type = ADDR_LE_DEV_RANDOM;
1419 set_random_addr(req, &nrpa);
1420 return 0;
1421 }
1422
1423 /* If forcing static address is in use or there is no public
1424 * address use the static address as random address (but skip
1425 * the HCI command if the current random address is already the
1426 * static one.
1427 *
1428 * In case BR/EDR has been disabled on a dual-mode controller
1429 * and a static address has been configured, then use that
1430 * address instead of the public BR/EDR address.
1431 */
1432 if (hci_dev_test_flag(hdev, HCI_FORCE_STATIC_ADDR) ||
1433 !bacmp(&hdev->bdaddr, BDADDR_ANY) ||
1434 (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) &&
1435 bacmp(&hdev->static_addr, BDADDR_ANY))) {
1436 *own_addr_type = ADDR_LE_DEV_RANDOM;
1437 if (bacmp(&hdev->static_addr, &hdev->random_addr))
1438 hci_req_add(req, HCI_OP_LE_SET_RANDOM_ADDR, 6,
1439 &hdev->static_addr);
1440 return 0;
1441 }
1442
1443 /* Neither privacy nor static address is being used so use a
1444 * public address.
1445 */
1446 *own_addr_type = ADDR_LE_DEV_PUBLIC;
1447
1448 return 0;
1449}
1450
1451static bool disconnected_whitelist_entries(struct hci_dev *hdev)
1452{
1453 struct bdaddr_list *b;
1454
1455 list_for_each_entry(b, &hdev->whitelist, list) {
1456 struct hci_conn *conn;
1457
1458 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &b->bdaddr);
1459 if (!conn)
1460 return true;
1461
1462 if (conn->state != BT_CONNECTED && conn->state != BT_CONFIG)
1463 return true;
1464 }
1465
1466 return false;
1467}
1468
1469void __hci_req_update_scan(struct hci_request *req)
1470{
1471 struct hci_dev *hdev = req->hdev;
1472 u8 scan;
1473
1474 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
1475 return;
1476
1477 if (!hdev_is_powered(hdev))
1478 return;
1479
1480 if (mgmt_powering_down(hdev))
1481 return;
1482
1483 if (hci_dev_test_flag(hdev, HCI_CONNECTABLE) ||
1484 disconnected_whitelist_entries(hdev))
1485 scan = SCAN_PAGE;
1486 else
1487 scan = SCAN_DISABLED;
1488
1489 if (hci_dev_test_flag(hdev, HCI_DISCOVERABLE))
1490 scan |= SCAN_INQUIRY;
1491
1492 if (test_bit(HCI_PSCAN, &hdev->flags) == !!(scan & SCAN_PAGE) &&
1493 test_bit(HCI_ISCAN, &hdev->flags) == !!(scan & SCAN_INQUIRY))
1494 return;
1495
1496 hci_req_add(req, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
1497}
1498
1499static int update_scan(struct hci_request *req, unsigned long opt)
1500{
1501 hci_dev_lock(req->hdev);
1502 __hci_req_update_scan(req);
1503 hci_dev_unlock(req->hdev);
1504 return 0;
1505}
1506
1507static void scan_update_work(struct work_struct *work)
1508{
1509 struct hci_dev *hdev = container_of(work, struct hci_dev, scan_update);
1510
1511 hci_req_sync(hdev, update_scan, 0, HCI_CMD_TIMEOUT, NULL);
1512}
1513
1514static int connectable_update(struct hci_request *req, unsigned long opt)
1515{
1516 struct hci_dev *hdev = req->hdev;
1517
1518 hci_dev_lock(hdev);
1519
1520 __hci_req_update_scan(req);
1521
1522 /* If BR/EDR is not enabled and we disable advertising as a
1523 * by-product of disabling connectable, we need to update the
1524 * advertising flags.
1525 */
1526 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
1527 __hci_req_update_adv_data(req, hdev->cur_adv_instance);
1528
1529 /* Update the advertising parameters if necessary */
1530 if (hci_dev_test_flag(hdev, HCI_ADVERTISING) ||
1531 !list_empty(&hdev->adv_instances))
1532 __hci_req_enable_advertising(req);
1533
1534 __hci_update_background_scan(req);
1535
1536 hci_dev_unlock(hdev);
1537
1538 return 0;
1539}
1540
1541static void connectable_update_work(struct work_struct *work)
1542{
1543 struct hci_dev *hdev = container_of(work, struct hci_dev,
1544 connectable_update);
1545 u8 status;
1546
1547 hci_req_sync(hdev, connectable_update, 0, HCI_CMD_TIMEOUT, &status);
1548 mgmt_set_connectable_complete(hdev, status);
1549}
1550
1551static u8 get_service_classes(struct hci_dev *hdev)
1552{
1553 struct bt_uuid *uuid;
1554 u8 val = 0;
1555
1556 list_for_each_entry(uuid, &hdev->uuids, list)
1557 val |= uuid->svc_hint;
1558
1559 return val;
1560}
1561
1562void __hci_req_update_class(struct hci_request *req)
1563{
1564 struct hci_dev *hdev = req->hdev;
1565 u8 cod[3];
1566
1567 BT_DBG("%s", hdev->name);
1568
1569 if (!hdev_is_powered(hdev))
1570 return;
1571
1572 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
1573 return;
1574
1575 if (hci_dev_test_flag(hdev, HCI_SERVICE_CACHE))
1576 return;
1577
1578 cod[0] = hdev->minor_class;
1579 cod[1] = hdev->major_class;
1580 cod[2] = get_service_classes(hdev);
1581
1582 if (hci_dev_test_flag(hdev, HCI_LIMITED_DISCOVERABLE))
1583 cod[1] |= 0x20;
1584
1585 if (memcmp(cod, hdev->dev_class, 3) == 0)
1586 return;
1587
1588 hci_req_add(req, HCI_OP_WRITE_CLASS_OF_DEV, sizeof(cod), cod);
1589}
1590
1591static void write_iac(struct hci_request *req)
1592{
1593 struct hci_dev *hdev = req->hdev;
1594 struct hci_cp_write_current_iac_lap cp;
1595
1596 if (!hci_dev_test_flag(hdev, HCI_DISCOVERABLE))
1597 return;
1598
1599 if (hci_dev_test_flag(hdev, HCI_LIMITED_DISCOVERABLE)) {
1600 /* Limited discoverable mode */
1601 cp.num_iac = min_t(u8, hdev->num_iac, 2);
1602 cp.iac_lap[0] = 0x00; /* LIAC */
1603 cp.iac_lap[1] = 0x8b;
1604 cp.iac_lap[2] = 0x9e;
1605 cp.iac_lap[3] = 0x33; /* GIAC */
1606 cp.iac_lap[4] = 0x8b;
1607 cp.iac_lap[5] = 0x9e;
1608 } else {
1609 /* General discoverable mode */
1610 cp.num_iac = 1;
1611 cp.iac_lap[0] = 0x33; /* GIAC */
1612 cp.iac_lap[1] = 0x8b;
1613 cp.iac_lap[2] = 0x9e;
1614 }
1615
1616 hci_req_add(req, HCI_OP_WRITE_CURRENT_IAC_LAP,
1617 (cp.num_iac * 3) + 1, &cp);
1618}
1619
1620static int discoverable_update(struct hci_request *req, unsigned long opt)
1621{
1622 struct hci_dev *hdev = req->hdev;
1623
1624 hci_dev_lock(hdev);
1625
1626 if (hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) {
1627 write_iac(req);
1628 __hci_req_update_scan(req);
1629 __hci_req_update_class(req);
1630 }
1631
1632 /* Advertising instances don't use the global discoverable setting, so
1633 * only update AD if advertising was enabled using Set Advertising.
1634 */
1635 if (hci_dev_test_flag(hdev, HCI_ADVERTISING)) {
1636 __hci_req_update_adv_data(req, 0x00);
1637
1638 /* Discoverable mode affects the local advertising
1639 * address in limited privacy mode.
1640 */
1641 if (hci_dev_test_flag(hdev, HCI_LIMITED_PRIVACY))
1642 __hci_req_enable_advertising(req);
1643 }
1644
1645 hci_dev_unlock(hdev);
1646
1647 return 0;
1648}
1649
1650static void discoverable_update_work(struct work_struct *work)
1651{
1652 struct hci_dev *hdev = container_of(work, struct hci_dev,
1653 discoverable_update);
1654 u8 status;
1655
1656 hci_req_sync(hdev, discoverable_update, 0, HCI_CMD_TIMEOUT, &status);
1657 mgmt_set_discoverable_complete(hdev, status);
1658}
1659
1660void __hci_abort_conn(struct hci_request *req, struct hci_conn *conn,
1661 u8 reason)
1662{
1663 switch (conn->state) {
1664 case BT_CONNECTED:
1665 case BT_CONFIG:
1666 if (conn->type == AMP_LINK) {
1667 struct hci_cp_disconn_phy_link cp;
1668
1669 cp.phy_handle = HCI_PHY_HANDLE(conn->handle);
1670 cp.reason = reason;
1671 hci_req_add(req, HCI_OP_DISCONN_PHY_LINK, sizeof(cp),
1672 &cp);
1673 } else {
1674 struct hci_cp_disconnect dc;
1675
1676 dc.handle = cpu_to_le16(conn->handle);
1677 dc.reason = reason;
1678 hci_req_add(req, HCI_OP_DISCONNECT, sizeof(dc), &dc);
1679 }
1680
1681 conn->state = BT_DISCONN;
1682
1683 break;
1684 case BT_CONNECT:
1685 if (conn->type == LE_LINK) {
1686 if (test_bit(HCI_CONN_SCANNING, &conn->flags))
1687 break;
1688 hci_req_add(req, HCI_OP_LE_CREATE_CONN_CANCEL,
1689 0, NULL);
1690 } else if (conn->type == ACL_LINK) {
1691 if (req->hdev->hci_ver < BLUETOOTH_VER_1_2)
1692 break;
1693 hci_req_add(req, HCI_OP_CREATE_CONN_CANCEL,
1694 6, &conn->dst);
1695 }
1696 break;
1697 case BT_CONNECT2:
1698 if (conn->type == ACL_LINK) {
1699 struct hci_cp_reject_conn_req rej;
1700
1701 bacpy(&rej.bdaddr, &conn->dst);
1702 rej.reason = reason;
1703
1704 hci_req_add(req, HCI_OP_REJECT_CONN_REQ,
1705 sizeof(rej), &rej);
1706 } else if (conn->type == SCO_LINK || conn->type == ESCO_LINK) {
1707 struct hci_cp_reject_sync_conn_req rej;
1708
1709 bacpy(&rej.bdaddr, &conn->dst);
1710
1711 /* SCO rejection has its own limited set of
1712 * allowed error values (0x0D-0x0F) which isn't
1713 * compatible with most values passed to this
1714 * function. To be safe hard-code one of the
1715 * values that's suitable for SCO.
1716 */
1717 rej.reason = HCI_ERROR_REMOTE_LOW_RESOURCES;
1718
1719 hci_req_add(req, HCI_OP_REJECT_SYNC_CONN_REQ,
1720 sizeof(rej), &rej);
1721 }
1722 break;
1723 default:
1724 conn->state = BT_CLOSED;
1725 break;
1726 }
1727}
1728
1729static void abort_conn_complete(struct hci_dev *hdev, u8 status, u16 opcode)
1730{
1731 if (status)
1732 BT_DBG("Failed to abort connection: status 0x%2.2x", status);
1733}
1734
1735int hci_abort_conn(struct hci_conn *conn, u8 reason)
1736{
1737 struct hci_request req;
1738 int err;
1739
1740 hci_req_init(&req, conn->hdev);
1741
1742 __hci_abort_conn(&req, conn, reason);
1743
1744 err = hci_req_run(&req, abort_conn_complete);
1745 if (err && err != -ENODATA) {
1746 BT_ERR("Failed to run HCI request: err %d", err);
1747 return err;
1748 }
1749
1750 return 0;
1751}
1752
1753static int update_bg_scan(struct hci_request *req, unsigned long opt)
1754{
1755 hci_dev_lock(req->hdev);
1756 __hci_update_background_scan(req);
1757 hci_dev_unlock(req->hdev);
1758 return 0;
1759}
1760
1761static void bg_scan_update(struct work_struct *work)
1762{
1763 struct hci_dev *hdev = container_of(work, struct hci_dev,
1764 bg_scan_update);
1765 struct hci_conn *conn;
1766 u8 status;
1767 int err;
1768
1769 err = hci_req_sync(hdev, update_bg_scan, 0, HCI_CMD_TIMEOUT, &status);
1770 if (!err)
1771 return;
1772
1773 hci_dev_lock(hdev);
1774
1775 conn = hci_conn_hash_lookup_state(hdev, LE_LINK, BT_CONNECT);
1776 if (conn)
1777 hci_le_conn_failed(conn, status);
1778
1779 hci_dev_unlock(hdev);
1780}
1781
1782static int le_scan_disable(struct hci_request *req, unsigned long opt)
1783{
1784 hci_req_add_le_scan_disable(req);
1785 return 0;
1786}
1787
1788static int bredr_inquiry(struct hci_request *req, unsigned long opt)
1789{
1790 u8 length = opt;
1791 const u8 giac[3] = { 0x33, 0x8b, 0x9e };
1792 const u8 liac[3] = { 0x00, 0x8b, 0x9e };
1793 struct hci_cp_inquiry cp;
1794
1795 BT_DBG("%s", req->hdev->name);
1796
1797 hci_dev_lock(req->hdev);
1798 hci_inquiry_cache_flush(req->hdev);
1799 hci_dev_unlock(req->hdev);
1800
1801 memset(&cp, 0, sizeof(cp));
1802
1803 if (req->hdev->discovery.limited)
1804 memcpy(&cp.lap, liac, sizeof(cp.lap));
1805 else
1806 memcpy(&cp.lap, giac, sizeof(cp.lap));
1807
1808 cp.length = length;
1809
1810 hci_req_add(req, HCI_OP_INQUIRY, sizeof(cp), &cp);
1811
1812 return 0;
1813}
1814
1815static void le_scan_disable_work(struct work_struct *work)
1816{
1817 struct hci_dev *hdev = container_of(work, struct hci_dev,
1818 le_scan_disable.work);
1819 u8 status;
1820
1821 BT_DBG("%s", hdev->name);
1822
1823 if (!hci_dev_test_flag(hdev, HCI_LE_SCAN))
1824 return;
1825
1826 cancel_delayed_work(&hdev->le_scan_restart);
1827
1828 hci_req_sync(hdev, le_scan_disable, 0, HCI_CMD_TIMEOUT, &status);
1829 if (status) {
1830 BT_ERR("Failed to disable LE scan: status 0x%02x", status);
1831 return;
1832 }
1833
1834 hdev->discovery.scan_start = 0;
1835
1836 /* If we were running LE only scan, change discovery state. If
1837 * we were running both LE and BR/EDR inquiry simultaneously,
1838 * and BR/EDR inquiry is already finished, stop discovery,
1839 * otherwise BR/EDR inquiry will stop discovery when finished.
1840 * If we will resolve remote device name, do not change
1841 * discovery state.
1842 */
1843
1844 if (hdev->discovery.type == DISCOV_TYPE_LE)
1845 goto discov_stopped;
1846
1847 if (hdev->discovery.type != DISCOV_TYPE_INTERLEAVED)
1848 return;
1849
1850 if (test_bit(HCI_QUIRK_SIMULTANEOUS_DISCOVERY, &hdev->quirks)) {
1851 if (!test_bit(HCI_INQUIRY, &hdev->flags) &&
1852 hdev->discovery.state != DISCOVERY_RESOLVING)
1853 goto discov_stopped;
1854
1855 return;
1856 }
1857
1858 hci_req_sync(hdev, bredr_inquiry, DISCOV_INTERLEAVED_INQUIRY_LEN,
1859 HCI_CMD_TIMEOUT, &status);
1860 if (status) {
1861 BT_ERR("Inquiry failed: status 0x%02x", status);
1862 goto discov_stopped;
1863 }
1864
1865 return;
1866
1867discov_stopped:
1868 hci_dev_lock(hdev);
1869 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
1870 hci_dev_unlock(hdev);
1871}
1872
1873static int le_scan_restart(struct hci_request *req, unsigned long opt)
1874{
1875 struct hci_dev *hdev = req->hdev;
1876 struct hci_cp_le_set_scan_enable cp;
1877
1878 /* If controller is not scanning we are done. */
1879 if (!hci_dev_test_flag(hdev, HCI_LE_SCAN))
1880 return 0;
1881
1882 hci_req_add_le_scan_disable(req);
1883
1884 memset(&cp, 0, sizeof(cp));
1885 cp.enable = LE_SCAN_ENABLE;
1886 cp.filter_dup = LE_SCAN_FILTER_DUP_ENABLE;
1887 hci_req_add(req, HCI_OP_LE_SET_SCAN_ENABLE, sizeof(cp), &cp);
1888
1889 return 0;
1890}
1891
1892static void le_scan_restart_work(struct work_struct *work)
1893{
1894 struct hci_dev *hdev = container_of(work, struct hci_dev,
1895 le_scan_restart.work);
1896 unsigned long timeout, duration, scan_start, now;
1897 u8 status;
1898
1899 BT_DBG("%s", hdev->name);
1900
1901 hci_req_sync(hdev, le_scan_restart, 0, HCI_CMD_TIMEOUT, &status);
1902 if (status) {
1903 BT_ERR("Failed to restart LE scan: status %d", status);
1904 return;
1905 }
1906
1907 hci_dev_lock(hdev);
1908
1909 if (!test_bit(HCI_QUIRK_STRICT_DUPLICATE_FILTER, &hdev->quirks) ||
1910 !hdev->discovery.scan_start)
1911 goto unlock;
1912
1913 /* When the scan was started, hdev->le_scan_disable has been queued
1914 * after duration from scan_start. During scan restart this job
1915 * has been canceled, and we need to queue it again after proper
1916 * timeout, to make sure that scan does not run indefinitely.
1917 */
1918 duration = hdev->discovery.scan_duration;
1919 scan_start = hdev->discovery.scan_start;
1920 now = jiffies;
1921 if (now - scan_start <= duration) {
1922 int elapsed;
1923
1924 if (now >= scan_start)
1925 elapsed = now - scan_start;
1926 else
1927 elapsed = ULONG_MAX - scan_start + now;
1928
1929 timeout = duration - elapsed;
1930 } else {
1931 timeout = 0;
1932 }
1933
1934 queue_delayed_work(hdev->req_workqueue,
1935 &hdev->le_scan_disable, timeout);
1936
1937unlock:
1938 hci_dev_unlock(hdev);
1939}
1940
1941static void disable_advertising(struct hci_request *req)
1942{
1943 u8 enable = 0x00;
1944
1945 hci_req_add(req, HCI_OP_LE_SET_ADV_ENABLE, sizeof(enable), &enable);
1946}
1947
1948static int active_scan(struct hci_request *req, unsigned long opt)
1949{
1950 uint16_t interval = opt;
1951 struct hci_dev *hdev = req->hdev;
1952 struct hci_cp_le_set_scan_param param_cp;
1953 struct hci_cp_le_set_scan_enable enable_cp;
1954 u8 own_addr_type;
1955 int err;
1956
1957 BT_DBG("%s", hdev->name);
1958
1959 if (hci_dev_test_flag(hdev, HCI_LE_ADV)) {
1960 hci_dev_lock(hdev);
1961
1962 /* Don't let discovery abort an outgoing connection attempt
1963 * that's using directed advertising.
1964 */
1965 if (hci_lookup_le_connect(hdev)) {
1966 hci_dev_unlock(hdev);
1967 return -EBUSY;
1968 }
1969
1970 cancel_adv_timeout(hdev);
1971 hci_dev_unlock(hdev);
1972
1973 disable_advertising(req);
1974 }
1975
1976 /* If controller is scanning, it means the background scanning is
1977 * running. Thus, we should temporarily stop it in order to set the
1978 * discovery scanning parameters.
1979 */
1980 if (hci_dev_test_flag(hdev, HCI_LE_SCAN))
1981 hci_req_add_le_scan_disable(req);
1982
1983 /* All active scans will be done with either a resolvable private
1984 * address (when privacy feature has been enabled) or non-resolvable
1985 * private address.
1986 */
1987 err = hci_update_random_address(req, true, scan_use_rpa(hdev),
1988 &own_addr_type);
1989 if (err < 0)
1990 own_addr_type = ADDR_LE_DEV_PUBLIC;
1991
1992 memset(¶m_cp, 0, sizeof(param_cp));
1993 param_cp.type = LE_SCAN_ACTIVE;
1994 param_cp.interval = cpu_to_le16(interval);
1995 param_cp.window = cpu_to_le16(DISCOV_LE_SCAN_WIN);
1996 param_cp.own_address_type = own_addr_type;
1997
1998 hci_req_add(req, HCI_OP_LE_SET_SCAN_PARAM, sizeof(param_cp),
1999 ¶m_cp);
2000
2001 memset(&enable_cp, 0, sizeof(enable_cp));
2002 enable_cp.enable = LE_SCAN_ENABLE;
2003 enable_cp.filter_dup = LE_SCAN_FILTER_DUP_ENABLE;
2004
2005 hci_req_add(req, HCI_OP_LE_SET_SCAN_ENABLE, sizeof(enable_cp),
2006 &enable_cp);
2007
2008 return 0;
2009}
2010
2011static int interleaved_discov(struct hci_request *req, unsigned long opt)
2012{
2013 int err;
2014
2015 BT_DBG("%s", req->hdev->name);
2016
2017 err = active_scan(req, opt);
2018 if (err)
2019 return err;
2020
2021 return bredr_inquiry(req, DISCOV_BREDR_INQUIRY_LEN);
2022}
2023
2024static void start_discovery(struct hci_dev *hdev, u8 *status)
2025{
2026 unsigned long timeout;
2027
2028 BT_DBG("%s type %u", hdev->name, hdev->discovery.type);
2029
2030 switch (hdev->discovery.type) {
2031 case DISCOV_TYPE_BREDR:
2032 if (!hci_dev_test_flag(hdev, HCI_INQUIRY))
2033 hci_req_sync(hdev, bredr_inquiry,
2034 DISCOV_BREDR_INQUIRY_LEN, HCI_CMD_TIMEOUT,
2035 status);
2036 return;
2037 case DISCOV_TYPE_INTERLEAVED:
2038 /* When running simultaneous discovery, the LE scanning time
2039 * should occupy the whole discovery time sine BR/EDR inquiry
2040 * and LE scanning are scheduled by the controller.
2041 *
2042 * For interleaving discovery in comparison, BR/EDR inquiry
2043 * and LE scanning are done sequentially with separate
2044 * timeouts.
2045 */
2046 if (test_bit(HCI_QUIRK_SIMULTANEOUS_DISCOVERY,
2047 &hdev->quirks)) {
2048 timeout = msecs_to_jiffies(DISCOV_LE_TIMEOUT);
2049 /* During simultaneous discovery, we double LE scan
2050 * interval. We must leave some time for the controller
2051 * to do BR/EDR inquiry.
2052 */
2053 hci_req_sync(hdev, interleaved_discov,
2054 DISCOV_LE_SCAN_INT * 2, HCI_CMD_TIMEOUT,
2055 status);
2056 break;
2057 }
2058
2059 timeout = msecs_to_jiffies(hdev->discov_interleaved_timeout);
2060 hci_req_sync(hdev, active_scan, DISCOV_LE_SCAN_INT,
2061 HCI_CMD_TIMEOUT, status);
2062 break;
2063 case DISCOV_TYPE_LE:
2064 timeout = msecs_to_jiffies(DISCOV_LE_TIMEOUT);
2065 hci_req_sync(hdev, active_scan, DISCOV_LE_SCAN_INT,
2066 HCI_CMD_TIMEOUT, status);
2067 break;
2068 default:
2069 *status = HCI_ERROR_UNSPECIFIED;
2070 return;
2071 }
2072
2073 if (*status)
2074 return;
2075
2076 BT_DBG("%s timeout %u ms", hdev->name, jiffies_to_msecs(timeout));
2077
2078 /* When service discovery is used and the controller has a
2079 * strict duplicate filter, it is important to remember the
2080 * start and duration of the scan. This is required for
2081 * restarting scanning during the discovery phase.
2082 */
2083 if (test_bit(HCI_QUIRK_STRICT_DUPLICATE_FILTER, &hdev->quirks) &&
2084 hdev->discovery.result_filtering) {
2085 hdev->discovery.scan_start = jiffies;
2086 hdev->discovery.scan_duration = timeout;
2087 }
2088
2089 queue_delayed_work(hdev->req_workqueue, &hdev->le_scan_disable,
2090 timeout);
2091}
2092
2093bool hci_req_stop_discovery(struct hci_request *req)
2094{
2095 struct hci_dev *hdev = req->hdev;
2096 struct discovery_state *d = &hdev->discovery;
2097 struct hci_cp_remote_name_req_cancel cp;
2098 struct inquiry_entry *e;
2099 bool ret = false;
2100
2101 BT_DBG("%s state %u", hdev->name, hdev->discovery.state);
2102
2103 if (d->state == DISCOVERY_FINDING || d->state == DISCOVERY_STOPPING) {
2104 if (test_bit(HCI_INQUIRY, &hdev->flags))
2105 hci_req_add(req, HCI_OP_INQUIRY_CANCEL, 0, NULL);
2106
2107 if (hci_dev_test_flag(hdev, HCI_LE_SCAN)) {
2108 cancel_delayed_work(&hdev->le_scan_disable);
2109 hci_req_add_le_scan_disable(req);
2110 }
2111
2112 ret = true;
2113 } else {
2114 /* Passive scanning */
2115 if (hci_dev_test_flag(hdev, HCI_LE_SCAN)) {
2116 hci_req_add_le_scan_disable(req);
2117 ret = true;
2118 }
2119 }
2120
2121 /* No further actions needed for LE-only discovery */
2122 if (d->type == DISCOV_TYPE_LE)
2123 return ret;
2124
2125 if (d->state == DISCOVERY_RESOLVING || d->state == DISCOVERY_STOPPING) {
2126 e = hci_inquiry_cache_lookup_resolve(hdev, BDADDR_ANY,
2127 NAME_PENDING);
2128 if (!e)
2129 return ret;
2130
2131 bacpy(&cp.bdaddr, &e->data.bdaddr);
2132 hci_req_add(req, HCI_OP_REMOTE_NAME_REQ_CANCEL, sizeof(cp),
2133 &cp);
2134 ret = true;
2135 }
2136
2137 return ret;
2138}
2139
2140static int stop_discovery(struct hci_request *req, unsigned long opt)
2141{
2142 hci_dev_lock(req->hdev);
2143 hci_req_stop_discovery(req);
2144 hci_dev_unlock(req->hdev);
2145
2146 return 0;
2147}
2148
2149static void discov_update(struct work_struct *work)
2150{
2151 struct hci_dev *hdev = container_of(work, struct hci_dev,
2152 discov_update);
2153 u8 status = 0;
2154
2155 switch (hdev->discovery.state) {
2156 case DISCOVERY_STARTING:
2157 start_discovery(hdev, &status);
2158 mgmt_start_discovery_complete(hdev, status);
2159 if (status)
2160 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
2161 else
2162 hci_discovery_set_state(hdev, DISCOVERY_FINDING);
2163 break;
2164 case DISCOVERY_STOPPING:
2165 hci_req_sync(hdev, stop_discovery, 0, HCI_CMD_TIMEOUT, &status);
2166 mgmt_stop_discovery_complete(hdev, status);
2167 if (!status)
2168 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
2169 break;
2170 case DISCOVERY_STOPPED:
2171 default:
2172 return;
2173 }
2174}
2175
2176static void discov_off(struct work_struct *work)
2177{
2178 struct hci_dev *hdev = container_of(work, struct hci_dev,
2179 discov_off.work);
2180
2181 BT_DBG("%s", hdev->name);
2182
2183 hci_dev_lock(hdev);
2184
2185 /* When discoverable timeout triggers, then just make sure
2186 * the limited discoverable flag is cleared. Even in the case
2187 * of a timeout triggered from general discoverable, it is
2188 * safe to unconditionally clear the flag.
2189 */
2190 hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE);
2191 hci_dev_clear_flag(hdev, HCI_DISCOVERABLE);
2192 hdev->discov_timeout = 0;
2193
2194 hci_dev_unlock(hdev);
2195
2196 hci_req_sync(hdev, discoverable_update, 0, HCI_CMD_TIMEOUT, NULL);
2197 mgmt_new_settings(hdev);
2198}
2199
2200static int powered_update_hci(struct hci_request *req, unsigned long opt)
2201{
2202 struct hci_dev *hdev = req->hdev;
2203 u8 link_sec;
2204
2205 hci_dev_lock(hdev);
2206
2207 if (hci_dev_test_flag(hdev, HCI_SSP_ENABLED) &&
2208 !lmp_host_ssp_capable(hdev)) {
2209 u8 mode = 0x01;
2210
2211 hci_req_add(req, HCI_OP_WRITE_SSP_MODE, sizeof(mode), &mode);
2212
2213 if (bredr_sc_enabled(hdev) && !lmp_host_sc_capable(hdev)) {
2214 u8 support = 0x01;
2215
2216 hci_req_add(req, HCI_OP_WRITE_SC_SUPPORT,
2217 sizeof(support), &support);
2218 }
2219 }
2220
2221 if (hci_dev_test_flag(hdev, HCI_LE_ENABLED) &&
2222 lmp_bredr_capable(hdev)) {
2223 struct hci_cp_write_le_host_supported cp;
2224
2225 cp.le = 0x01;
2226 cp.simul = 0x00;
2227
2228 /* Check first if we already have the right
2229 * host state (host features set)
2230 */
2231 if (cp.le != lmp_host_le_capable(hdev) ||
2232 cp.simul != lmp_host_le_br_capable(hdev))
2233 hci_req_add(req, HCI_OP_WRITE_LE_HOST_SUPPORTED,
2234 sizeof(cp), &cp);
2235 }
2236
2237 if (hci_dev_test_flag(hdev, HCI_LE_ENABLED)) {
2238 /* Make sure the controller has a good default for
2239 * advertising data. This also applies to the case
2240 * where BR/EDR was toggled during the AUTO_OFF phase.
2241 */
2242 if (hci_dev_test_flag(hdev, HCI_ADVERTISING) ||
2243 list_empty(&hdev->adv_instances)) {
2244 __hci_req_update_adv_data(req, 0x00);
2245 __hci_req_update_scan_rsp_data(req, 0x00);
2246
2247 if (hci_dev_test_flag(hdev, HCI_ADVERTISING))
2248 __hci_req_enable_advertising(req);
2249 } else if (!list_empty(&hdev->adv_instances)) {
2250 struct adv_info *adv_instance;
2251
2252 adv_instance = list_first_entry(&hdev->adv_instances,
2253 struct adv_info, list);
2254 __hci_req_schedule_adv_instance(req,
2255 adv_instance->instance,
2256 true);
2257 }
2258 }
2259
2260 link_sec = hci_dev_test_flag(hdev, HCI_LINK_SECURITY);
2261 if (link_sec != test_bit(HCI_AUTH, &hdev->flags))
2262 hci_req_add(req, HCI_OP_WRITE_AUTH_ENABLE,
2263 sizeof(link_sec), &link_sec);
2264
2265 if (lmp_bredr_capable(hdev)) {
2266 if (hci_dev_test_flag(hdev, HCI_FAST_CONNECTABLE))
2267 __hci_req_write_fast_connectable(req, true);
2268 else
2269 __hci_req_write_fast_connectable(req, false);
2270 __hci_req_update_scan(req);
2271 __hci_req_update_class(req);
2272 __hci_req_update_name(req);
2273 __hci_req_update_eir(req);
2274 }
2275
2276 hci_dev_unlock(hdev);
2277 return 0;
2278}
2279
2280int __hci_req_hci_power_on(struct hci_dev *hdev)
2281{
2282 /* Register the available SMP channels (BR/EDR and LE) only when
2283 * successfully powering on the controller. This late
2284 * registration is required so that LE SMP can clearly decide if
2285 * the public address or static address is used.
2286 */
2287 smp_register(hdev);
2288
2289 return __hci_req_sync(hdev, powered_update_hci, 0, HCI_CMD_TIMEOUT,
2290 NULL);
2291}
2292
2293void hci_request_setup(struct hci_dev *hdev)
2294{
2295 INIT_WORK(&hdev->discov_update, discov_update);
2296 INIT_WORK(&hdev->bg_scan_update, bg_scan_update);
2297 INIT_WORK(&hdev->scan_update, scan_update_work);
2298 INIT_WORK(&hdev->connectable_update, connectable_update_work);
2299 INIT_WORK(&hdev->discoverable_update, discoverable_update_work);
2300 INIT_DELAYED_WORK(&hdev->discov_off, discov_off);
2301 INIT_DELAYED_WORK(&hdev->le_scan_disable, le_scan_disable_work);
2302 INIT_DELAYED_WORK(&hdev->le_scan_restart, le_scan_restart_work);
2303 INIT_DELAYED_WORK(&hdev->adv_instance_expire, adv_timeout_expire);
2304}
2305
2306void hci_request_cancel_all(struct hci_dev *hdev)
2307{
2308 hci_req_sync_cancel(hdev, ENODEV);
2309
2310 cancel_work_sync(&hdev->discov_update);
2311 cancel_work_sync(&hdev->bg_scan_update);
2312 cancel_work_sync(&hdev->scan_update);
2313 cancel_work_sync(&hdev->connectable_update);
2314 cancel_work_sync(&hdev->discoverable_update);
2315 cancel_delayed_work_sync(&hdev->discov_off);
2316 cancel_delayed_work_sync(&hdev->le_scan_disable);
2317 cancel_delayed_work_sync(&hdev->le_scan_restart);
2318
2319 if (hdev->adv_instance_timeout) {
2320 cancel_delayed_work_sync(&hdev->adv_instance_expire);
2321 hdev->adv_instance_timeout = 0;
2322 }
2323}