Loading...
1/*
2 BlueZ - Bluetooth protocol stack for Linux
3
4 Copyright (C) 2014 Intel Corporation
5
6 This program is free software; you can redistribute it and/or modify
7 it under the terms of the GNU General Public License version 2 as
8 published by the Free Software Foundation;
9
10 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
11 OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
12 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
13 IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
14 CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
15 WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
16 ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
17 OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
18
19 ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
20 COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
21 SOFTWARE IS DISCLAIMED.
22*/
23
24#include <linux/sched/signal.h>
25
26#include <net/bluetooth/bluetooth.h>
27#include <net/bluetooth/hci_core.h>
28#include <net/bluetooth/mgmt.h>
29
30#include "smp.h"
31#include "hci_request.h"
32#include "msft.h"
33#include "eir.h"
34
35void hci_req_init(struct hci_request *req, struct hci_dev *hdev)
36{
37 skb_queue_head_init(&req->cmd_q);
38 req->hdev = hdev;
39 req->err = 0;
40}
41
42void hci_req_purge(struct hci_request *req)
43{
44 skb_queue_purge(&req->cmd_q);
45}
46
47bool hci_req_status_pend(struct hci_dev *hdev)
48{
49 return hdev->req_status == HCI_REQ_PEND;
50}
51
52static int req_run(struct hci_request *req, hci_req_complete_t complete,
53 hci_req_complete_skb_t complete_skb)
54{
55 struct hci_dev *hdev = req->hdev;
56 struct sk_buff *skb;
57 unsigned long flags;
58
59 bt_dev_dbg(hdev, "length %u", skb_queue_len(&req->cmd_q));
60
61 /* If an error occurred during request building, remove all HCI
62 * commands queued on the HCI request queue.
63 */
64 if (req->err) {
65 skb_queue_purge(&req->cmd_q);
66 return req->err;
67 }
68
69 /* Do not allow empty requests */
70 if (skb_queue_empty(&req->cmd_q))
71 return -ENODATA;
72
73 skb = skb_peek_tail(&req->cmd_q);
74 if (complete) {
75 bt_cb(skb)->hci.req_complete = complete;
76 } else if (complete_skb) {
77 bt_cb(skb)->hci.req_complete_skb = complete_skb;
78 bt_cb(skb)->hci.req_flags |= HCI_REQ_SKB;
79 }
80
81 spin_lock_irqsave(&hdev->cmd_q.lock, flags);
82 skb_queue_splice_tail(&req->cmd_q, &hdev->cmd_q);
83 spin_unlock_irqrestore(&hdev->cmd_q.lock, flags);
84
85 queue_work(hdev->workqueue, &hdev->cmd_work);
86
87 return 0;
88}
89
90int hci_req_run(struct hci_request *req, hci_req_complete_t complete)
91{
92 return req_run(req, complete, NULL);
93}
94
95int hci_req_run_skb(struct hci_request *req, hci_req_complete_skb_t complete)
96{
97 return req_run(req, NULL, complete);
98}
99
100void hci_req_sync_complete(struct hci_dev *hdev, u8 result, u16 opcode,
101 struct sk_buff *skb)
102{
103 bt_dev_dbg(hdev, "result 0x%2.2x", result);
104
105 if (hdev->req_status == HCI_REQ_PEND) {
106 hdev->req_result = result;
107 hdev->req_status = HCI_REQ_DONE;
108 if (skb)
109 hdev->req_skb = skb_get(skb);
110 wake_up_interruptible(&hdev->req_wait_q);
111 }
112}
113
114/* Execute request and wait for completion. */
115int __hci_req_sync(struct hci_dev *hdev, int (*func)(struct hci_request *req,
116 unsigned long opt),
117 unsigned long opt, u32 timeout, u8 *hci_status)
118{
119 struct hci_request req;
120 int err = 0;
121
122 bt_dev_dbg(hdev, "start");
123
124 hci_req_init(&req, hdev);
125
126 hdev->req_status = HCI_REQ_PEND;
127
128 err = func(&req, opt);
129 if (err) {
130 if (hci_status)
131 *hci_status = HCI_ERROR_UNSPECIFIED;
132 return err;
133 }
134
135 err = hci_req_run_skb(&req, hci_req_sync_complete);
136 if (err < 0) {
137 hdev->req_status = 0;
138
139 /* ENODATA means the HCI request command queue is empty.
140 * This can happen when a request with conditionals doesn't
141 * trigger any commands to be sent. This is normal behavior
142 * and should not trigger an error return.
143 */
144 if (err == -ENODATA) {
145 if (hci_status)
146 *hci_status = 0;
147 return 0;
148 }
149
150 if (hci_status)
151 *hci_status = HCI_ERROR_UNSPECIFIED;
152
153 return err;
154 }
155
156 err = wait_event_interruptible_timeout(hdev->req_wait_q,
157 hdev->req_status != HCI_REQ_PEND, timeout);
158
159 if (err == -ERESTARTSYS)
160 return -EINTR;
161
162 switch (hdev->req_status) {
163 case HCI_REQ_DONE:
164 err = -bt_to_errno(hdev->req_result);
165 if (hci_status)
166 *hci_status = hdev->req_result;
167 break;
168
169 case HCI_REQ_CANCELED:
170 err = -hdev->req_result;
171 if (hci_status)
172 *hci_status = HCI_ERROR_UNSPECIFIED;
173 break;
174
175 default:
176 err = -ETIMEDOUT;
177 if (hci_status)
178 *hci_status = HCI_ERROR_UNSPECIFIED;
179 break;
180 }
181
182 kfree_skb(hdev->req_skb);
183 hdev->req_skb = NULL;
184 hdev->req_status = hdev->req_result = 0;
185
186 bt_dev_dbg(hdev, "end: err %d", err);
187
188 return err;
189}
190
191int hci_req_sync(struct hci_dev *hdev, int (*req)(struct hci_request *req,
192 unsigned long opt),
193 unsigned long opt, u32 timeout, u8 *hci_status)
194{
195 int ret;
196
197 /* Serialize all requests */
198 hci_req_sync_lock(hdev);
199 /* check the state after obtaing the lock to protect the HCI_UP
200 * against any races from hci_dev_do_close when the controller
201 * gets removed.
202 */
203 if (test_bit(HCI_UP, &hdev->flags))
204 ret = __hci_req_sync(hdev, req, opt, timeout, hci_status);
205 else
206 ret = -ENETDOWN;
207 hci_req_sync_unlock(hdev);
208
209 return ret;
210}
211
212struct sk_buff *hci_prepare_cmd(struct hci_dev *hdev, u16 opcode, u32 plen,
213 const void *param)
214{
215 int len = HCI_COMMAND_HDR_SIZE + plen;
216 struct hci_command_hdr *hdr;
217 struct sk_buff *skb;
218
219 skb = bt_skb_alloc(len, GFP_ATOMIC);
220 if (!skb)
221 return NULL;
222
223 hdr = skb_put(skb, HCI_COMMAND_HDR_SIZE);
224 hdr->opcode = cpu_to_le16(opcode);
225 hdr->plen = plen;
226
227 if (plen)
228 skb_put_data(skb, param, plen);
229
230 bt_dev_dbg(hdev, "skb len %d", skb->len);
231
232 hci_skb_pkt_type(skb) = HCI_COMMAND_PKT;
233 hci_skb_opcode(skb) = opcode;
234
235 return skb;
236}
237
238/* Queue a command to an asynchronous HCI request */
239void hci_req_add_ev(struct hci_request *req, u16 opcode, u32 plen,
240 const void *param, u8 event)
241{
242 struct hci_dev *hdev = req->hdev;
243 struct sk_buff *skb;
244
245 bt_dev_dbg(hdev, "opcode 0x%4.4x plen %d", opcode, plen);
246
247 /* If an error occurred during request building, there is no point in
248 * queueing the HCI command. We can simply return.
249 */
250 if (req->err)
251 return;
252
253 skb = hci_prepare_cmd(hdev, opcode, plen, param);
254 if (!skb) {
255 bt_dev_err(hdev, "no memory for command (opcode 0x%4.4x)",
256 opcode);
257 req->err = -ENOMEM;
258 return;
259 }
260
261 if (skb_queue_empty(&req->cmd_q))
262 bt_cb(skb)->hci.req_flags |= HCI_REQ_START;
263
264 hci_skb_event(skb) = event;
265
266 skb_queue_tail(&req->cmd_q, skb);
267}
268
269void hci_req_add(struct hci_request *req, u16 opcode, u32 plen,
270 const void *param)
271{
272 bt_dev_dbg(req->hdev, "HCI_REQ-0x%4.4x", opcode);
273 hci_req_add_ev(req, opcode, plen, param, 0);
274}
275
276static void start_interleave_scan(struct hci_dev *hdev)
277{
278 hdev->interleave_scan_state = INTERLEAVE_SCAN_NO_FILTER;
279 queue_delayed_work(hdev->req_workqueue,
280 &hdev->interleave_scan, 0);
281}
282
283static bool is_interleave_scanning(struct hci_dev *hdev)
284{
285 return hdev->interleave_scan_state != INTERLEAVE_SCAN_NONE;
286}
287
288static void cancel_interleave_scan(struct hci_dev *hdev)
289{
290 bt_dev_dbg(hdev, "cancelling interleave scan");
291
292 cancel_delayed_work_sync(&hdev->interleave_scan);
293
294 hdev->interleave_scan_state = INTERLEAVE_SCAN_NONE;
295}
296
297/* Return true if interleave_scan wasn't started until exiting this function,
298 * otherwise, return false
299 */
300static bool __hci_update_interleaved_scan(struct hci_dev *hdev)
301{
302 /* Do interleaved scan only if all of the following are true:
303 * - There is at least one ADV monitor
304 * - At least one pending LE connection or one device to be scanned for
305 * - Monitor offloading is not supported
306 * If so, we should alternate between allowlist scan and one without
307 * any filters to save power.
308 */
309 bool use_interleaving = hci_is_adv_monitoring(hdev) &&
310 !(list_empty(&hdev->pend_le_conns) &&
311 list_empty(&hdev->pend_le_reports)) &&
312 hci_get_adv_monitor_offload_ext(hdev) ==
313 HCI_ADV_MONITOR_EXT_NONE;
314 bool is_interleaving = is_interleave_scanning(hdev);
315
316 if (use_interleaving && !is_interleaving) {
317 start_interleave_scan(hdev);
318 bt_dev_dbg(hdev, "starting interleave scan");
319 return true;
320 }
321
322 if (!use_interleaving && is_interleaving)
323 cancel_interleave_scan(hdev);
324
325 return false;
326}
327
328void hci_req_add_le_scan_disable(struct hci_request *req, bool rpa_le_conn)
329{
330 struct hci_dev *hdev = req->hdev;
331
332 if (hdev->scanning_paused) {
333 bt_dev_dbg(hdev, "Scanning is paused for suspend");
334 return;
335 }
336
337 if (use_ext_scan(hdev)) {
338 struct hci_cp_le_set_ext_scan_enable cp;
339
340 memset(&cp, 0, sizeof(cp));
341 cp.enable = LE_SCAN_DISABLE;
342 hci_req_add(req, HCI_OP_LE_SET_EXT_SCAN_ENABLE, sizeof(cp),
343 &cp);
344 } else {
345 struct hci_cp_le_set_scan_enable cp;
346
347 memset(&cp, 0, sizeof(cp));
348 cp.enable = LE_SCAN_DISABLE;
349 hci_req_add(req, HCI_OP_LE_SET_SCAN_ENABLE, sizeof(cp), &cp);
350 }
351
352 /* Disable address resolution */
353 if (hci_dev_test_flag(hdev, HCI_LL_RPA_RESOLUTION) && !rpa_le_conn) {
354 __u8 enable = 0x00;
355
356 hci_req_add(req, HCI_OP_LE_SET_ADDR_RESOLV_ENABLE, 1, &enable);
357 }
358}
359
360static void del_from_accept_list(struct hci_request *req, bdaddr_t *bdaddr,
361 u8 bdaddr_type)
362{
363 struct hci_cp_le_del_from_accept_list cp;
364
365 cp.bdaddr_type = bdaddr_type;
366 bacpy(&cp.bdaddr, bdaddr);
367
368 bt_dev_dbg(req->hdev, "Remove %pMR (0x%x) from accept list", &cp.bdaddr,
369 cp.bdaddr_type);
370 hci_req_add(req, HCI_OP_LE_DEL_FROM_ACCEPT_LIST, sizeof(cp), &cp);
371
372 if (use_ll_privacy(req->hdev)) {
373 struct smp_irk *irk;
374
375 irk = hci_find_irk_by_addr(req->hdev, bdaddr, bdaddr_type);
376 if (irk) {
377 struct hci_cp_le_del_from_resolv_list cp;
378
379 cp.bdaddr_type = bdaddr_type;
380 bacpy(&cp.bdaddr, bdaddr);
381
382 hci_req_add(req, HCI_OP_LE_DEL_FROM_RESOLV_LIST,
383 sizeof(cp), &cp);
384 }
385 }
386}
387
388/* Adds connection to accept list if needed. On error, returns -1. */
389static int add_to_accept_list(struct hci_request *req,
390 struct hci_conn_params *params, u8 *num_entries,
391 bool allow_rpa)
392{
393 struct hci_cp_le_add_to_accept_list cp;
394 struct hci_dev *hdev = req->hdev;
395
396 /* Already in accept list */
397 if (hci_bdaddr_list_lookup(&hdev->le_accept_list, ¶ms->addr,
398 params->addr_type))
399 return 0;
400
401 /* Select filter policy to accept all advertising */
402 if (*num_entries >= hdev->le_accept_list_size)
403 return -1;
404
405 /* Accept list can not be used with RPAs */
406 if (!allow_rpa &&
407 !hci_dev_test_flag(hdev, HCI_ENABLE_LL_PRIVACY) &&
408 hci_find_irk_by_addr(hdev, ¶ms->addr, params->addr_type)) {
409 return -1;
410 }
411
412 /* During suspend, only wakeable devices can be in accept list */
413 if (hdev->suspended &&
414 !(params->flags & HCI_CONN_FLAG_REMOTE_WAKEUP))
415 return 0;
416
417 *num_entries += 1;
418 cp.bdaddr_type = params->addr_type;
419 bacpy(&cp.bdaddr, ¶ms->addr);
420
421 bt_dev_dbg(hdev, "Add %pMR (0x%x) to accept list", &cp.bdaddr,
422 cp.bdaddr_type);
423 hci_req_add(req, HCI_OP_LE_ADD_TO_ACCEPT_LIST, sizeof(cp), &cp);
424
425 if (use_ll_privacy(hdev)) {
426 struct smp_irk *irk;
427
428 irk = hci_find_irk_by_addr(hdev, ¶ms->addr,
429 params->addr_type);
430 if (irk) {
431 struct hci_cp_le_add_to_resolv_list cp;
432
433 cp.bdaddr_type = params->addr_type;
434 bacpy(&cp.bdaddr, ¶ms->addr);
435 memcpy(cp.peer_irk, irk->val, 16);
436
437 if (hci_dev_test_flag(hdev, HCI_PRIVACY))
438 memcpy(cp.local_irk, hdev->irk, 16);
439 else
440 memset(cp.local_irk, 0, 16);
441
442 hci_req_add(req, HCI_OP_LE_ADD_TO_RESOLV_LIST,
443 sizeof(cp), &cp);
444 }
445 }
446
447 return 0;
448}
449
450static u8 update_accept_list(struct hci_request *req)
451{
452 struct hci_dev *hdev = req->hdev;
453 struct hci_conn_params *params;
454 struct bdaddr_list *b;
455 u8 num_entries = 0;
456 bool pend_conn, pend_report;
457 /* We allow usage of accept list even with RPAs in suspend. In the worst
458 * case, we won't be able to wake from devices that use the privacy1.2
459 * features. Additionally, once we support privacy1.2 and IRK
460 * offloading, we can update this to also check for those conditions.
461 */
462 bool allow_rpa = hdev->suspended;
463
464 if (use_ll_privacy(hdev))
465 allow_rpa = true;
466
467 /* Go through the current accept list programmed into the
468 * controller one by one and check if that address is still
469 * in the list of pending connections or list of devices to
470 * report. If not present in either list, then queue the
471 * command to remove it from the controller.
472 */
473 list_for_each_entry(b, &hdev->le_accept_list, list) {
474 pend_conn = hci_pend_le_action_lookup(&hdev->pend_le_conns,
475 &b->bdaddr,
476 b->bdaddr_type);
477 pend_report = hci_pend_le_action_lookup(&hdev->pend_le_reports,
478 &b->bdaddr,
479 b->bdaddr_type);
480
481 /* If the device is not likely to connect or report,
482 * remove it from the accept list.
483 */
484 if (!pend_conn && !pend_report) {
485 del_from_accept_list(req, &b->bdaddr, b->bdaddr_type);
486 continue;
487 }
488
489 /* Accept list can not be used with RPAs */
490 if (!allow_rpa &&
491 !hci_dev_test_flag(hdev, HCI_ENABLE_LL_PRIVACY) &&
492 hci_find_irk_by_addr(hdev, &b->bdaddr, b->bdaddr_type)) {
493 return 0x00;
494 }
495
496 num_entries++;
497 }
498
499 /* Since all no longer valid accept list entries have been
500 * removed, walk through the list of pending connections
501 * and ensure that any new device gets programmed into
502 * the controller.
503 *
504 * If the list of the devices is larger than the list of
505 * available accept list entries in the controller, then
506 * just abort and return filer policy value to not use the
507 * accept list.
508 */
509 list_for_each_entry(params, &hdev->pend_le_conns, action) {
510 if (add_to_accept_list(req, params, &num_entries, allow_rpa))
511 return 0x00;
512 }
513
514 /* After adding all new pending connections, walk through
515 * the list of pending reports and also add these to the
516 * accept list if there is still space. Abort if space runs out.
517 */
518 list_for_each_entry(params, &hdev->pend_le_reports, action) {
519 if (add_to_accept_list(req, params, &num_entries, allow_rpa))
520 return 0x00;
521 }
522
523 /* Use the allowlist unless the following conditions are all true:
524 * - We are not currently suspending
525 * - There are 1 or more ADV monitors registered and it's not offloaded
526 * - Interleaved scanning is not currently using the allowlist
527 */
528 if (!idr_is_empty(&hdev->adv_monitors_idr) && !hdev->suspended &&
529 hci_get_adv_monitor_offload_ext(hdev) == HCI_ADV_MONITOR_EXT_NONE &&
530 hdev->interleave_scan_state != INTERLEAVE_SCAN_ALLOWLIST)
531 return 0x00;
532
533 /* Select filter policy to use accept list */
534 return 0x01;
535}
536
537static bool scan_use_rpa(struct hci_dev *hdev)
538{
539 return hci_dev_test_flag(hdev, HCI_PRIVACY);
540}
541
542static void hci_req_start_scan(struct hci_request *req, u8 type, u16 interval,
543 u16 window, u8 own_addr_type, u8 filter_policy,
544 bool filter_dup, bool addr_resolv)
545{
546 struct hci_dev *hdev = req->hdev;
547
548 if (hdev->scanning_paused) {
549 bt_dev_dbg(hdev, "Scanning is paused for suspend");
550 return;
551 }
552
553 if (use_ll_privacy(hdev) && addr_resolv) {
554 u8 enable = 0x01;
555
556 hci_req_add(req, HCI_OP_LE_SET_ADDR_RESOLV_ENABLE, 1, &enable);
557 }
558
559 /* Use ext scanning if set ext scan param and ext scan enable is
560 * supported
561 */
562 if (use_ext_scan(hdev)) {
563 struct hci_cp_le_set_ext_scan_params *ext_param_cp;
564 struct hci_cp_le_set_ext_scan_enable ext_enable_cp;
565 struct hci_cp_le_scan_phy_params *phy_params;
566 u8 data[sizeof(*ext_param_cp) + sizeof(*phy_params) * 2];
567 u32 plen;
568
569 ext_param_cp = (void *)data;
570 phy_params = (void *)ext_param_cp->data;
571
572 memset(ext_param_cp, 0, sizeof(*ext_param_cp));
573 ext_param_cp->own_addr_type = own_addr_type;
574 ext_param_cp->filter_policy = filter_policy;
575
576 plen = sizeof(*ext_param_cp);
577
578 if (scan_1m(hdev) || scan_2m(hdev)) {
579 ext_param_cp->scanning_phys |= LE_SCAN_PHY_1M;
580
581 memset(phy_params, 0, sizeof(*phy_params));
582 phy_params->type = type;
583 phy_params->interval = cpu_to_le16(interval);
584 phy_params->window = cpu_to_le16(window);
585
586 plen += sizeof(*phy_params);
587 phy_params++;
588 }
589
590 if (scan_coded(hdev)) {
591 ext_param_cp->scanning_phys |= LE_SCAN_PHY_CODED;
592
593 memset(phy_params, 0, sizeof(*phy_params));
594 phy_params->type = type;
595 phy_params->interval = cpu_to_le16(interval);
596 phy_params->window = cpu_to_le16(window);
597
598 plen += sizeof(*phy_params);
599 phy_params++;
600 }
601
602 hci_req_add(req, HCI_OP_LE_SET_EXT_SCAN_PARAMS,
603 plen, ext_param_cp);
604
605 memset(&ext_enable_cp, 0, sizeof(ext_enable_cp));
606 ext_enable_cp.enable = LE_SCAN_ENABLE;
607 ext_enable_cp.filter_dup = filter_dup;
608
609 hci_req_add(req, HCI_OP_LE_SET_EXT_SCAN_ENABLE,
610 sizeof(ext_enable_cp), &ext_enable_cp);
611 } else {
612 struct hci_cp_le_set_scan_param param_cp;
613 struct hci_cp_le_set_scan_enable enable_cp;
614
615 memset(¶m_cp, 0, sizeof(param_cp));
616 param_cp.type = type;
617 param_cp.interval = cpu_to_le16(interval);
618 param_cp.window = cpu_to_le16(window);
619 param_cp.own_address_type = own_addr_type;
620 param_cp.filter_policy = filter_policy;
621 hci_req_add(req, HCI_OP_LE_SET_SCAN_PARAM, sizeof(param_cp),
622 ¶m_cp);
623
624 memset(&enable_cp, 0, sizeof(enable_cp));
625 enable_cp.enable = LE_SCAN_ENABLE;
626 enable_cp.filter_dup = filter_dup;
627 hci_req_add(req, HCI_OP_LE_SET_SCAN_ENABLE, sizeof(enable_cp),
628 &enable_cp);
629 }
630}
631
632static void set_random_addr(struct hci_request *req, bdaddr_t *rpa);
633static int hci_update_random_address(struct hci_request *req,
634 bool require_privacy, bool use_rpa,
635 u8 *own_addr_type)
636{
637 struct hci_dev *hdev = req->hdev;
638 int err;
639
640 /* If privacy is enabled use a resolvable private address. If
641 * current RPA has expired or there is something else than
642 * the current RPA in use, then generate a new one.
643 */
644 if (use_rpa) {
645 /* If Controller supports LL Privacy use own address type is
646 * 0x03
647 */
648 if (use_ll_privacy(hdev))
649 *own_addr_type = ADDR_LE_DEV_RANDOM_RESOLVED;
650 else
651 *own_addr_type = ADDR_LE_DEV_RANDOM;
652
653 if (rpa_valid(hdev))
654 return 0;
655
656 err = smp_generate_rpa(hdev, hdev->irk, &hdev->rpa);
657 if (err < 0) {
658 bt_dev_err(hdev, "failed to generate new RPA");
659 return err;
660 }
661
662 set_random_addr(req, &hdev->rpa);
663
664 return 0;
665 }
666
667 /* In case of required privacy without resolvable private address,
668 * use an non-resolvable private address. This is useful for active
669 * scanning and non-connectable advertising.
670 */
671 if (require_privacy) {
672 bdaddr_t nrpa;
673
674 while (true) {
675 /* The non-resolvable private address is generated
676 * from random six bytes with the two most significant
677 * bits cleared.
678 */
679 get_random_bytes(&nrpa, 6);
680 nrpa.b[5] &= 0x3f;
681
682 /* The non-resolvable private address shall not be
683 * equal to the public address.
684 */
685 if (bacmp(&hdev->bdaddr, &nrpa))
686 break;
687 }
688
689 *own_addr_type = ADDR_LE_DEV_RANDOM;
690 set_random_addr(req, &nrpa);
691 return 0;
692 }
693
694 /* If forcing static address is in use or there is no public
695 * address use the static address as random address (but skip
696 * the HCI command if the current random address is already the
697 * static one.
698 *
699 * In case BR/EDR has been disabled on a dual-mode controller
700 * and a static address has been configured, then use that
701 * address instead of the public BR/EDR address.
702 */
703 if (hci_dev_test_flag(hdev, HCI_FORCE_STATIC_ADDR) ||
704 !bacmp(&hdev->bdaddr, BDADDR_ANY) ||
705 (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) &&
706 bacmp(&hdev->static_addr, BDADDR_ANY))) {
707 *own_addr_type = ADDR_LE_DEV_RANDOM;
708 if (bacmp(&hdev->static_addr, &hdev->random_addr))
709 hci_req_add(req, HCI_OP_LE_SET_RANDOM_ADDR, 6,
710 &hdev->static_addr);
711 return 0;
712 }
713
714 /* Neither privacy nor static address is being used so use a
715 * public address.
716 */
717 *own_addr_type = ADDR_LE_DEV_PUBLIC;
718
719 return 0;
720}
721
722/* Ensure to call hci_req_add_le_scan_disable() first to disable the
723 * controller based address resolution to be able to reconfigure
724 * resolving list.
725 */
726void hci_req_add_le_passive_scan(struct hci_request *req)
727{
728 struct hci_dev *hdev = req->hdev;
729 u8 own_addr_type;
730 u8 filter_policy;
731 u16 window, interval;
732 /* Default is to enable duplicates filter */
733 u8 filter_dup = LE_SCAN_FILTER_DUP_ENABLE;
734 /* Background scanning should run with address resolution */
735 bool addr_resolv = true;
736
737 if (hdev->scanning_paused) {
738 bt_dev_dbg(hdev, "Scanning is paused for suspend");
739 return;
740 }
741
742 /* Set require_privacy to false since no SCAN_REQ are send
743 * during passive scanning. Not using an non-resolvable address
744 * here is important so that peer devices using direct
745 * advertising with our address will be correctly reported
746 * by the controller.
747 */
748 if (hci_update_random_address(req, false, scan_use_rpa(hdev),
749 &own_addr_type))
750 return;
751
752 if (hdev->enable_advmon_interleave_scan &&
753 __hci_update_interleaved_scan(hdev))
754 return;
755
756 bt_dev_dbg(hdev, "interleave state %d", hdev->interleave_scan_state);
757 /* Adding or removing entries from the accept list must
758 * happen before enabling scanning. The controller does
759 * not allow accept list modification while scanning.
760 */
761 filter_policy = update_accept_list(req);
762
763 /* When the controller is using random resolvable addresses and
764 * with that having LE privacy enabled, then controllers with
765 * Extended Scanner Filter Policies support can now enable support
766 * for handling directed advertising.
767 *
768 * So instead of using filter polices 0x00 (no accept list)
769 * and 0x01 (accept list enabled) use the new filter policies
770 * 0x02 (no accept list) and 0x03 (accept list enabled).
771 */
772 if (hci_dev_test_flag(hdev, HCI_PRIVACY) &&
773 (hdev->le_features[0] & HCI_LE_EXT_SCAN_POLICY))
774 filter_policy |= 0x02;
775
776 if (hdev->suspended) {
777 window = hdev->le_scan_window_suspend;
778 interval = hdev->le_scan_int_suspend;
779 } else if (hci_is_le_conn_scanning(hdev)) {
780 window = hdev->le_scan_window_connect;
781 interval = hdev->le_scan_int_connect;
782 } else if (hci_is_adv_monitoring(hdev)) {
783 window = hdev->le_scan_window_adv_monitor;
784 interval = hdev->le_scan_int_adv_monitor;
785
786 /* Disable duplicates filter when scanning for advertisement
787 * monitor for the following reasons.
788 *
789 * For HW pattern filtering (ex. MSFT), Realtek and Qualcomm
790 * controllers ignore RSSI_Sampling_Period when the duplicates
791 * filter is enabled.
792 *
793 * For SW pattern filtering, when we're not doing interleaved
794 * scanning, it is necessary to disable duplicates filter,
795 * otherwise hosts can only receive one advertisement and it's
796 * impossible to know if a peer is still in range.
797 */
798 filter_dup = LE_SCAN_FILTER_DUP_DISABLE;
799 } else {
800 window = hdev->le_scan_window;
801 interval = hdev->le_scan_interval;
802 }
803
804 bt_dev_dbg(hdev, "LE passive scan with accept list = %d",
805 filter_policy);
806 hci_req_start_scan(req, LE_SCAN_PASSIVE, interval, window,
807 own_addr_type, filter_policy, filter_dup,
808 addr_resolv);
809}
810
811static int hci_req_add_le_interleaved_scan(struct hci_request *req,
812 unsigned long opt)
813{
814 struct hci_dev *hdev = req->hdev;
815 int ret = 0;
816
817 hci_dev_lock(hdev);
818
819 if (hci_dev_test_flag(hdev, HCI_LE_SCAN))
820 hci_req_add_le_scan_disable(req, false);
821 hci_req_add_le_passive_scan(req);
822
823 switch (hdev->interleave_scan_state) {
824 case INTERLEAVE_SCAN_ALLOWLIST:
825 bt_dev_dbg(hdev, "next state: allowlist");
826 hdev->interleave_scan_state = INTERLEAVE_SCAN_NO_FILTER;
827 break;
828 case INTERLEAVE_SCAN_NO_FILTER:
829 bt_dev_dbg(hdev, "next state: no filter");
830 hdev->interleave_scan_state = INTERLEAVE_SCAN_ALLOWLIST;
831 break;
832 case INTERLEAVE_SCAN_NONE:
833 BT_ERR("unexpected error");
834 ret = -1;
835 }
836
837 hci_dev_unlock(hdev);
838
839 return ret;
840}
841
842static void interleave_scan_work(struct work_struct *work)
843{
844 struct hci_dev *hdev = container_of(work, struct hci_dev,
845 interleave_scan.work);
846 u8 status;
847 unsigned long timeout;
848
849 if (hdev->interleave_scan_state == INTERLEAVE_SCAN_ALLOWLIST) {
850 timeout = msecs_to_jiffies(hdev->advmon_allowlist_duration);
851 } else if (hdev->interleave_scan_state == INTERLEAVE_SCAN_NO_FILTER) {
852 timeout = msecs_to_jiffies(hdev->advmon_no_filter_duration);
853 } else {
854 bt_dev_err(hdev, "unexpected error");
855 return;
856 }
857
858 hci_req_sync(hdev, hci_req_add_le_interleaved_scan, 0,
859 HCI_CMD_TIMEOUT, &status);
860
861 /* Don't continue interleaving if it was canceled */
862 if (is_interleave_scanning(hdev))
863 queue_delayed_work(hdev->req_workqueue,
864 &hdev->interleave_scan, timeout);
865}
866
867static void set_random_addr(struct hci_request *req, bdaddr_t *rpa)
868{
869 struct hci_dev *hdev = req->hdev;
870
871 /* If we're advertising or initiating an LE connection we can't
872 * go ahead and change the random address at this time. This is
873 * because the eventual initiator address used for the
874 * subsequently created connection will be undefined (some
875 * controllers use the new address and others the one we had
876 * when the operation started).
877 *
878 * In this kind of scenario skip the update and let the random
879 * address be updated at the next cycle.
880 */
881 if (hci_dev_test_flag(hdev, HCI_LE_ADV) ||
882 hci_lookup_le_connect(hdev)) {
883 bt_dev_dbg(hdev, "Deferring random address update");
884 hci_dev_set_flag(hdev, HCI_RPA_EXPIRED);
885 return;
886 }
887
888 hci_req_add(req, HCI_OP_LE_SET_RANDOM_ADDR, 6, rpa);
889}
890
891void hci_request_setup(struct hci_dev *hdev)
892{
893 INIT_DELAYED_WORK(&hdev->interleave_scan, interleave_scan_work);
894}
895
896void hci_request_cancel_all(struct hci_dev *hdev)
897{
898 __hci_cmd_sync_cancel(hdev, ENODEV);
899
900 cancel_interleave_scan(hdev);
901}
1/*
2 BlueZ - Bluetooth protocol stack for Linux
3
4 Copyright (C) 2014 Intel Corporation
5
6 This program is free software; you can redistribute it and/or modify
7 it under the terms of the GNU General Public License version 2 as
8 published by the Free Software Foundation;
9
10 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
11 OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
12 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
13 IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
14 CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
15 WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
16 ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
17 OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
18
19 ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
20 COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
21 SOFTWARE IS DISCLAIMED.
22*/
23
24#include <net/bluetooth/bluetooth.h>
25#include <net/bluetooth/hci_core.h>
26#include <net/bluetooth/mgmt.h>
27
28#include "smp.h"
29#include "hci_request.h"
30
31#define HCI_REQ_DONE 0
32#define HCI_REQ_PEND 1
33#define HCI_REQ_CANCELED 2
34
35void hci_req_init(struct hci_request *req, struct hci_dev *hdev)
36{
37 skb_queue_head_init(&req->cmd_q);
38 req->hdev = hdev;
39 req->err = 0;
40}
41
42static int req_run(struct hci_request *req, hci_req_complete_t complete,
43 hci_req_complete_skb_t complete_skb)
44{
45 struct hci_dev *hdev = req->hdev;
46 struct sk_buff *skb;
47 unsigned long flags;
48
49 BT_DBG("length %u", skb_queue_len(&req->cmd_q));
50
51 /* If an error occurred during request building, remove all HCI
52 * commands queued on the HCI request queue.
53 */
54 if (req->err) {
55 skb_queue_purge(&req->cmd_q);
56 return req->err;
57 }
58
59 /* Do not allow empty requests */
60 if (skb_queue_empty(&req->cmd_q))
61 return -ENODATA;
62
63 skb = skb_peek_tail(&req->cmd_q);
64 if (complete) {
65 bt_cb(skb)->hci.req_complete = complete;
66 } else if (complete_skb) {
67 bt_cb(skb)->hci.req_complete_skb = complete_skb;
68 bt_cb(skb)->hci.req_flags |= HCI_REQ_SKB;
69 }
70
71 spin_lock_irqsave(&hdev->cmd_q.lock, flags);
72 skb_queue_splice_tail(&req->cmd_q, &hdev->cmd_q);
73 spin_unlock_irqrestore(&hdev->cmd_q.lock, flags);
74
75 queue_work(hdev->workqueue, &hdev->cmd_work);
76
77 return 0;
78}
79
80int hci_req_run(struct hci_request *req, hci_req_complete_t complete)
81{
82 return req_run(req, complete, NULL);
83}
84
85int hci_req_run_skb(struct hci_request *req, hci_req_complete_skb_t complete)
86{
87 return req_run(req, NULL, complete);
88}
89
90static void hci_req_sync_complete(struct hci_dev *hdev, u8 result, u16 opcode,
91 struct sk_buff *skb)
92{
93 BT_DBG("%s result 0x%2.2x", hdev->name, result);
94
95 if (hdev->req_status == HCI_REQ_PEND) {
96 hdev->req_result = result;
97 hdev->req_status = HCI_REQ_DONE;
98 if (skb)
99 hdev->req_skb = skb_get(skb);
100 wake_up_interruptible(&hdev->req_wait_q);
101 }
102}
103
104void hci_req_sync_cancel(struct hci_dev *hdev, int err)
105{
106 BT_DBG("%s err 0x%2.2x", hdev->name, err);
107
108 if (hdev->req_status == HCI_REQ_PEND) {
109 hdev->req_result = err;
110 hdev->req_status = HCI_REQ_CANCELED;
111 wake_up_interruptible(&hdev->req_wait_q);
112 }
113}
114
115struct sk_buff *__hci_cmd_sync_ev(struct hci_dev *hdev, u16 opcode, u32 plen,
116 const void *param, u8 event, u32 timeout)
117{
118 DECLARE_WAITQUEUE(wait, current);
119 struct hci_request req;
120 struct sk_buff *skb;
121 int err = 0;
122
123 BT_DBG("%s", hdev->name);
124
125 hci_req_init(&req, hdev);
126
127 hci_req_add_ev(&req, opcode, plen, param, event);
128
129 hdev->req_status = HCI_REQ_PEND;
130
131 add_wait_queue(&hdev->req_wait_q, &wait);
132 set_current_state(TASK_INTERRUPTIBLE);
133
134 err = hci_req_run_skb(&req, hci_req_sync_complete);
135 if (err < 0) {
136 remove_wait_queue(&hdev->req_wait_q, &wait);
137 set_current_state(TASK_RUNNING);
138 return ERR_PTR(err);
139 }
140
141 schedule_timeout(timeout);
142
143 remove_wait_queue(&hdev->req_wait_q, &wait);
144
145 if (signal_pending(current))
146 return ERR_PTR(-EINTR);
147
148 switch (hdev->req_status) {
149 case HCI_REQ_DONE:
150 err = -bt_to_errno(hdev->req_result);
151 break;
152
153 case HCI_REQ_CANCELED:
154 err = -hdev->req_result;
155 break;
156
157 default:
158 err = -ETIMEDOUT;
159 break;
160 }
161
162 hdev->req_status = hdev->req_result = 0;
163 skb = hdev->req_skb;
164 hdev->req_skb = NULL;
165
166 BT_DBG("%s end: err %d", hdev->name, err);
167
168 if (err < 0) {
169 kfree_skb(skb);
170 return ERR_PTR(err);
171 }
172
173 if (!skb)
174 return ERR_PTR(-ENODATA);
175
176 return skb;
177}
178EXPORT_SYMBOL(__hci_cmd_sync_ev);
179
180struct sk_buff *__hci_cmd_sync(struct hci_dev *hdev, u16 opcode, u32 plen,
181 const void *param, u32 timeout)
182{
183 return __hci_cmd_sync_ev(hdev, opcode, plen, param, 0, timeout);
184}
185EXPORT_SYMBOL(__hci_cmd_sync);
186
187/* Execute request and wait for completion. */
188int __hci_req_sync(struct hci_dev *hdev, int (*func)(struct hci_request *req,
189 unsigned long opt),
190 unsigned long opt, u32 timeout, u8 *hci_status)
191{
192 struct hci_request req;
193 DECLARE_WAITQUEUE(wait, current);
194 int err = 0;
195
196 BT_DBG("%s start", hdev->name);
197
198 hci_req_init(&req, hdev);
199
200 hdev->req_status = HCI_REQ_PEND;
201
202 err = func(&req, opt);
203 if (err) {
204 if (hci_status)
205 *hci_status = HCI_ERROR_UNSPECIFIED;
206 return err;
207 }
208
209 add_wait_queue(&hdev->req_wait_q, &wait);
210 set_current_state(TASK_INTERRUPTIBLE);
211
212 err = hci_req_run_skb(&req, hci_req_sync_complete);
213 if (err < 0) {
214 hdev->req_status = 0;
215
216 remove_wait_queue(&hdev->req_wait_q, &wait);
217 set_current_state(TASK_RUNNING);
218
219 /* ENODATA means the HCI request command queue is empty.
220 * This can happen when a request with conditionals doesn't
221 * trigger any commands to be sent. This is normal behavior
222 * and should not trigger an error return.
223 */
224 if (err == -ENODATA) {
225 if (hci_status)
226 *hci_status = 0;
227 return 0;
228 }
229
230 if (hci_status)
231 *hci_status = HCI_ERROR_UNSPECIFIED;
232
233 return err;
234 }
235
236 schedule_timeout(timeout);
237
238 remove_wait_queue(&hdev->req_wait_q, &wait);
239
240 if (signal_pending(current))
241 return -EINTR;
242
243 switch (hdev->req_status) {
244 case HCI_REQ_DONE:
245 err = -bt_to_errno(hdev->req_result);
246 if (hci_status)
247 *hci_status = hdev->req_result;
248 break;
249
250 case HCI_REQ_CANCELED:
251 err = -hdev->req_result;
252 if (hci_status)
253 *hci_status = HCI_ERROR_UNSPECIFIED;
254 break;
255
256 default:
257 err = -ETIMEDOUT;
258 if (hci_status)
259 *hci_status = HCI_ERROR_UNSPECIFIED;
260 break;
261 }
262
263 kfree_skb(hdev->req_skb);
264 hdev->req_skb = NULL;
265 hdev->req_status = hdev->req_result = 0;
266
267 BT_DBG("%s end: err %d", hdev->name, err);
268
269 return err;
270}
271
272int hci_req_sync(struct hci_dev *hdev, int (*req)(struct hci_request *req,
273 unsigned long opt),
274 unsigned long opt, u32 timeout, u8 *hci_status)
275{
276 int ret;
277
278 if (!test_bit(HCI_UP, &hdev->flags))
279 return -ENETDOWN;
280
281 /* Serialize all requests */
282 hci_req_sync_lock(hdev);
283 ret = __hci_req_sync(hdev, req, opt, timeout, hci_status);
284 hci_req_sync_unlock(hdev);
285
286 return ret;
287}
288
289struct sk_buff *hci_prepare_cmd(struct hci_dev *hdev, u16 opcode, u32 plen,
290 const void *param)
291{
292 int len = HCI_COMMAND_HDR_SIZE + plen;
293 struct hci_command_hdr *hdr;
294 struct sk_buff *skb;
295
296 skb = bt_skb_alloc(len, GFP_ATOMIC);
297 if (!skb)
298 return NULL;
299
300 hdr = (struct hci_command_hdr *) skb_put(skb, HCI_COMMAND_HDR_SIZE);
301 hdr->opcode = cpu_to_le16(opcode);
302 hdr->plen = plen;
303
304 if (plen)
305 memcpy(skb_put(skb, plen), param, plen);
306
307 BT_DBG("skb len %d", skb->len);
308
309 hci_skb_pkt_type(skb) = HCI_COMMAND_PKT;
310 hci_skb_opcode(skb) = opcode;
311
312 return skb;
313}
314
315/* Queue a command to an asynchronous HCI request */
316void hci_req_add_ev(struct hci_request *req, u16 opcode, u32 plen,
317 const void *param, u8 event)
318{
319 struct hci_dev *hdev = req->hdev;
320 struct sk_buff *skb;
321
322 BT_DBG("%s opcode 0x%4.4x plen %d", hdev->name, opcode, plen);
323
324 /* If an error occurred during request building, there is no point in
325 * queueing the HCI command. We can simply return.
326 */
327 if (req->err)
328 return;
329
330 skb = hci_prepare_cmd(hdev, opcode, plen, param);
331 if (!skb) {
332 BT_ERR("%s no memory for command (opcode 0x%4.4x)",
333 hdev->name, opcode);
334 req->err = -ENOMEM;
335 return;
336 }
337
338 if (skb_queue_empty(&req->cmd_q))
339 bt_cb(skb)->hci.req_flags |= HCI_REQ_START;
340
341 bt_cb(skb)->hci.req_event = event;
342
343 skb_queue_tail(&req->cmd_q, skb);
344}
345
346void hci_req_add(struct hci_request *req, u16 opcode, u32 plen,
347 const void *param)
348{
349 hci_req_add_ev(req, opcode, plen, param, 0);
350}
351
352void __hci_req_write_fast_connectable(struct hci_request *req, bool enable)
353{
354 struct hci_dev *hdev = req->hdev;
355 struct hci_cp_write_page_scan_activity acp;
356 u8 type;
357
358 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
359 return;
360
361 if (hdev->hci_ver < BLUETOOTH_VER_1_2)
362 return;
363
364 if (enable) {
365 type = PAGE_SCAN_TYPE_INTERLACED;
366
367 /* 160 msec page scan interval */
368 acp.interval = cpu_to_le16(0x0100);
369 } else {
370 type = PAGE_SCAN_TYPE_STANDARD; /* default */
371
372 /* default 1.28 sec page scan */
373 acp.interval = cpu_to_le16(0x0800);
374 }
375
376 acp.window = cpu_to_le16(0x0012);
377
378 if (__cpu_to_le16(hdev->page_scan_interval) != acp.interval ||
379 __cpu_to_le16(hdev->page_scan_window) != acp.window)
380 hci_req_add(req, HCI_OP_WRITE_PAGE_SCAN_ACTIVITY,
381 sizeof(acp), &acp);
382
383 if (hdev->page_scan_type != type)
384 hci_req_add(req, HCI_OP_WRITE_PAGE_SCAN_TYPE, 1, &type);
385}
386
387/* This function controls the background scanning based on hdev->pend_le_conns
388 * list. If there are pending LE connection we start the background scanning,
389 * otherwise we stop it.
390 *
391 * This function requires the caller holds hdev->lock.
392 */
393static void __hci_update_background_scan(struct hci_request *req)
394{
395 struct hci_dev *hdev = req->hdev;
396
397 if (!test_bit(HCI_UP, &hdev->flags) ||
398 test_bit(HCI_INIT, &hdev->flags) ||
399 hci_dev_test_flag(hdev, HCI_SETUP) ||
400 hci_dev_test_flag(hdev, HCI_CONFIG) ||
401 hci_dev_test_flag(hdev, HCI_AUTO_OFF) ||
402 hci_dev_test_flag(hdev, HCI_UNREGISTER))
403 return;
404
405 /* No point in doing scanning if LE support hasn't been enabled */
406 if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED))
407 return;
408
409 /* If discovery is active don't interfere with it */
410 if (hdev->discovery.state != DISCOVERY_STOPPED)
411 return;
412
413 /* Reset RSSI and UUID filters when starting background scanning
414 * since these filters are meant for service discovery only.
415 *
416 * The Start Discovery and Start Service Discovery operations
417 * ensure to set proper values for RSSI threshold and UUID
418 * filter list. So it is safe to just reset them here.
419 */
420 hci_discovery_filter_clear(hdev);
421
422 if (list_empty(&hdev->pend_le_conns) &&
423 list_empty(&hdev->pend_le_reports)) {
424 /* If there is no pending LE connections or devices
425 * to be scanned for, we should stop the background
426 * scanning.
427 */
428
429 /* If controller is not scanning we are done. */
430 if (!hci_dev_test_flag(hdev, HCI_LE_SCAN))
431 return;
432
433 hci_req_add_le_scan_disable(req);
434
435 BT_DBG("%s stopping background scanning", hdev->name);
436 } else {
437 /* If there is at least one pending LE connection, we should
438 * keep the background scan running.
439 */
440
441 /* If controller is connecting, we should not start scanning
442 * since some controllers are not able to scan and connect at
443 * the same time.
444 */
445 if (hci_lookup_le_connect(hdev))
446 return;
447
448 /* If controller is currently scanning, we stop it to ensure we
449 * don't miss any advertising (due to duplicates filter).
450 */
451 if (hci_dev_test_flag(hdev, HCI_LE_SCAN))
452 hci_req_add_le_scan_disable(req);
453
454 hci_req_add_le_passive_scan(req);
455
456 BT_DBG("%s starting background scanning", hdev->name);
457 }
458}
459
460void __hci_req_update_name(struct hci_request *req)
461{
462 struct hci_dev *hdev = req->hdev;
463 struct hci_cp_write_local_name cp;
464
465 memcpy(cp.name, hdev->dev_name, sizeof(cp.name));
466
467 hci_req_add(req, HCI_OP_WRITE_LOCAL_NAME, sizeof(cp), &cp);
468}
469
470#define PNP_INFO_SVCLASS_ID 0x1200
471
472static u8 *create_uuid16_list(struct hci_dev *hdev, u8 *data, ptrdiff_t len)
473{
474 u8 *ptr = data, *uuids_start = NULL;
475 struct bt_uuid *uuid;
476
477 if (len < 4)
478 return ptr;
479
480 list_for_each_entry(uuid, &hdev->uuids, list) {
481 u16 uuid16;
482
483 if (uuid->size != 16)
484 continue;
485
486 uuid16 = get_unaligned_le16(&uuid->uuid[12]);
487 if (uuid16 < 0x1100)
488 continue;
489
490 if (uuid16 == PNP_INFO_SVCLASS_ID)
491 continue;
492
493 if (!uuids_start) {
494 uuids_start = ptr;
495 uuids_start[0] = 1;
496 uuids_start[1] = EIR_UUID16_ALL;
497 ptr += 2;
498 }
499
500 /* Stop if not enough space to put next UUID */
501 if ((ptr - data) + sizeof(u16) > len) {
502 uuids_start[1] = EIR_UUID16_SOME;
503 break;
504 }
505
506 *ptr++ = (uuid16 & 0x00ff);
507 *ptr++ = (uuid16 & 0xff00) >> 8;
508 uuids_start[0] += sizeof(uuid16);
509 }
510
511 return ptr;
512}
513
514static u8 *create_uuid32_list(struct hci_dev *hdev, u8 *data, ptrdiff_t len)
515{
516 u8 *ptr = data, *uuids_start = NULL;
517 struct bt_uuid *uuid;
518
519 if (len < 6)
520 return ptr;
521
522 list_for_each_entry(uuid, &hdev->uuids, list) {
523 if (uuid->size != 32)
524 continue;
525
526 if (!uuids_start) {
527 uuids_start = ptr;
528 uuids_start[0] = 1;
529 uuids_start[1] = EIR_UUID32_ALL;
530 ptr += 2;
531 }
532
533 /* Stop if not enough space to put next UUID */
534 if ((ptr - data) + sizeof(u32) > len) {
535 uuids_start[1] = EIR_UUID32_SOME;
536 break;
537 }
538
539 memcpy(ptr, &uuid->uuid[12], sizeof(u32));
540 ptr += sizeof(u32);
541 uuids_start[0] += sizeof(u32);
542 }
543
544 return ptr;
545}
546
547static u8 *create_uuid128_list(struct hci_dev *hdev, u8 *data, ptrdiff_t len)
548{
549 u8 *ptr = data, *uuids_start = NULL;
550 struct bt_uuid *uuid;
551
552 if (len < 18)
553 return ptr;
554
555 list_for_each_entry(uuid, &hdev->uuids, list) {
556 if (uuid->size != 128)
557 continue;
558
559 if (!uuids_start) {
560 uuids_start = ptr;
561 uuids_start[0] = 1;
562 uuids_start[1] = EIR_UUID128_ALL;
563 ptr += 2;
564 }
565
566 /* Stop if not enough space to put next UUID */
567 if ((ptr - data) + 16 > len) {
568 uuids_start[1] = EIR_UUID128_SOME;
569 break;
570 }
571
572 memcpy(ptr, uuid->uuid, 16);
573 ptr += 16;
574 uuids_start[0] += 16;
575 }
576
577 return ptr;
578}
579
580static void create_eir(struct hci_dev *hdev, u8 *data)
581{
582 u8 *ptr = data;
583 size_t name_len;
584
585 name_len = strlen(hdev->dev_name);
586
587 if (name_len > 0) {
588 /* EIR Data type */
589 if (name_len > 48) {
590 name_len = 48;
591 ptr[1] = EIR_NAME_SHORT;
592 } else
593 ptr[1] = EIR_NAME_COMPLETE;
594
595 /* EIR Data length */
596 ptr[0] = name_len + 1;
597
598 memcpy(ptr + 2, hdev->dev_name, name_len);
599
600 ptr += (name_len + 2);
601 }
602
603 if (hdev->inq_tx_power != HCI_TX_POWER_INVALID) {
604 ptr[0] = 2;
605 ptr[1] = EIR_TX_POWER;
606 ptr[2] = (u8) hdev->inq_tx_power;
607
608 ptr += 3;
609 }
610
611 if (hdev->devid_source > 0) {
612 ptr[0] = 9;
613 ptr[1] = EIR_DEVICE_ID;
614
615 put_unaligned_le16(hdev->devid_source, ptr + 2);
616 put_unaligned_le16(hdev->devid_vendor, ptr + 4);
617 put_unaligned_le16(hdev->devid_product, ptr + 6);
618 put_unaligned_le16(hdev->devid_version, ptr + 8);
619
620 ptr += 10;
621 }
622
623 ptr = create_uuid16_list(hdev, ptr, HCI_MAX_EIR_LENGTH - (ptr - data));
624 ptr = create_uuid32_list(hdev, ptr, HCI_MAX_EIR_LENGTH - (ptr - data));
625 ptr = create_uuid128_list(hdev, ptr, HCI_MAX_EIR_LENGTH - (ptr - data));
626}
627
628void __hci_req_update_eir(struct hci_request *req)
629{
630 struct hci_dev *hdev = req->hdev;
631 struct hci_cp_write_eir cp;
632
633 if (!hdev_is_powered(hdev))
634 return;
635
636 if (!lmp_ext_inq_capable(hdev))
637 return;
638
639 if (!hci_dev_test_flag(hdev, HCI_SSP_ENABLED))
640 return;
641
642 if (hci_dev_test_flag(hdev, HCI_SERVICE_CACHE))
643 return;
644
645 memset(&cp, 0, sizeof(cp));
646
647 create_eir(hdev, cp.data);
648
649 if (memcmp(cp.data, hdev->eir, sizeof(cp.data)) == 0)
650 return;
651
652 memcpy(hdev->eir, cp.data, sizeof(cp.data));
653
654 hci_req_add(req, HCI_OP_WRITE_EIR, sizeof(cp), &cp);
655}
656
657void hci_req_add_le_scan_disable(struct hci_request *req)
658{
659 struct hci_cp_le_set_scan_enable cp;
660
661 memset(&cp, 0, sizeof(cp));
662 cp.enable = LE_SCAN_DISABLE;
663 hci_req_add(req, HCI_OP_LE_SET_SCAN_ENABLE, sizeof(cp), &cp);
664}
665
666static void add_to_white_list(struct hci_request *req,
667 struct hci_conn_params *params)
668{
669 struct hci_cp_le_add_to_white_list cp;
670
671 cp.bdaddr_type = params->addr_type;
672 bacpy(&cp.bdaddr, ¶ms->addr);
673
674 hci_req_add(req, HCI_OP_LE_ADD_TO_WHITE_LIST, sizeof(cp), &cp);
675}
676
677static u8 update_white_list(struct hci_request *req)
678{
679 struct hci_dev *hdev = req->hdev;
680 struct hci_conn_params *params;
681 struct bdaddr_list *b;
682 uint8_t white_list_entries = 0;
683
684 /* Go through the current white list programmed into the
685 * controller one by one and check if that address is still
686 * in the list of pending connections or list of devices to
687 * report. If not present in either list, then queue the
688 * command to remove it from the controller.
689 */
690 list_for_each_entry(b, &hdev->le_white_list, list) {
691 /* If the device is neither in pend_le_conns nor
692 * pend_le_reports then remove it from the whitelist.
693 */
694 if (!hci_pend_le_action_lookup(&hdev->pend_le_conns,
695 &b->bdaddr, b->bdaddr_type) &&
696 !hci_pend_le_action_lookup(&hdev->pend_le_reports,
697 &b->bdaddr, b->bdaddr_type)) {
698 struct hci_cp_le_del_from_white_list cp;
699
700 cp.bdaddr_type = b->bdaddr_type;
701 bacpy(&cp.bdaddr, &b->bdaddr);
702
703 hci_req_add(req, HCI_OP_LE_DEL_FROM_WHITE_LIST,
704 sizeof(cp), &cp);
705 continue;
706 }
707
708 if (hci_find_irk_by_addr(hdev, &b->bdaddr, b->bdaddr_type)) {
709 /* White list can not be used with RPAs */
710 return 0x00;
711 }
712
713 white_list_entries++;
714 }
715
716 /* Since all no longer valid white list entries have been
717 * removed, walk through the list of pending connections
718 * and ensure that any new device gets programmed into
719 * the controller.
720 *
721 * If the list of the devices is larger than the list of
722 * available white list entries in the controller, then
723 * just abort and return filer policy value to not use the
724 * white list.
725 */
726 list_for_each_entry(params, &hdev->pend_le_conns, action) {
727 if (hci_bdaddr_list_lookup(&hdev->le_white_list,
728 ¶ms->addr, params->addr_type))
729 continue;
730
731 if (white_list_entries >= hdev->le_white_list_size) {
732 /* Select filter policy to accept all advertising */
733 return 0x00;
734 }
735
736 if (hci_find_irk_by_addr(hdev, ¶ms->addr,
737 params->addr_type)) {
738 /* White list can not be used with RPAs */
739 return 0x00;
740 }
741
742 white_list_entries++;
743 add_to_white_list(req, params);
744 }
745
746 /* After adding all new pending connections, walk through
747 * the list of pending reports and also add these to the
748 * white list if there is still space.
749 */
750 list_for_each_entry(params, &hdev->pend_le_reports, action) {
751 if (hci_bdaddr_list_lookup(&hdev->le_white_list,
752 ¶ms->addr, params->addr_type))
753 continue;
754
755 if (white_list_entries >= hdev->le_white_list_size) {
756 /* Select filter policy to accept all advertising */
757 return 0x00;
758 }
759
760 if (hci_find_irk_by_addr(hdev, ¶ms->addr,
761 params->addr_type)) {
762 /* White list can not be used with RPAs */
763 return 0x00;
764 }
765
766 white_list_entries++;
767 add_to_white_list(req, params);
768 }
769
770 /* Select filter policy to use white list */
771 return 0x01;
772}
773
774static bool scan_use_rpa(struct hci_dev *hdev)
775{
776 return hci_dev_test_flag(hdev, HCI_PRIVACY);
777}
778
779void hci_req_add_le_passive_scan(struct hci_request *req)
780{
781 struct hci_cp_le_set_scan_param param_cp;
782 struct hci_cp_le_set_scan_enable enable_cp;
783 struct hci_dev *hdev = req->hdev;
784 u8 own_addr_type;
785 u8 filter_policy;
786
787 /* Set require_privacy to false since no SCAN_REQ are send
788 * during passive scanning. Not using an non-resolvable address
789 * here is important so that peer devices using direct
790 * advertising with our address will be correctly reported
791 * by the controller.
792 */
793 if (hci_update_random_address(req, false, scan_use_rpa(hdev),
794 &own_addr_type))
795 return;
796
797 /* Adding or removing entries from the white list must
798 * happen before enabling scanning. The controller does
799 * not allow white list modification while scanning.
800 */
801 filter_policy = update_white_list(req);
802
803 /* When the controller is using random resolvable addresses and
804 * with that having LE privacy enabled, then controllers with
805 * Extended Scanner Filter Policies support can now enable support
806 * for handling directed advertising.
807 *
808 * So instead of using filter polices 0x00 (no whitelist)
809 * and 0x01 (whitelist enabled) use the new filter policies
810 * 0x02 (no whitelist) and 0x03 (whitelist enabled).
811 */
812 if (hci_dev_test_flag(hdev, HCI_PRIVACY) &&
813 (hdev->le_features[0] & HCI_LE_EXT_SCAN_POLICY))
814 filter_policy |= 0x02;
815
816 memset(¶m_cp, 0, sizeof(param_cp));
817 param_cp.type = LE_SCAN_PASSIVE;
818 param_cp.interval = cpu_to_le16(hdev->le_scan_interval);
819 param_cp.window = cpu_to_le16(hdev->le_scan_window);
820 param_cp.own_address_type = own_addr_type;
821 param_cp.filter_policy = filter_policy;
822 hci_req_add(req, HCI_OP_LE_SET_SCAN_PARAM, sizeof(param_cp),
823 ¶m_cp);
824
825 memset(&enable_cp, 0, sizeof(enable_cp));
826 enable_cp.enable = LE_SCAN_ENABLE;
827 enable_cp.filter_dup = LE_SCAN_FILTER_DUP_ENABLE;
828 hci_req_add(req, HCI_OP_LE_SET_SCAN_ENABLE, sizeof(enable_cp),
829 &enable_cp);
830}
831
832static u8 get_cur_adv_instance_scan_rsp_len(struct hci_dev *hdev)
833{
834 u8 instance = hdev->cur_adv_instance;
835 struct adv_info *adv_instance;
836
837 /* Ignore instance 0 */
838 if (instance == 0x00)
839 return 0;
840
841 adv_instance = hci_find_adv_instance(hdev, instance);
842 if (!adv_instance)
843 return 0;
844
845 /* TODO: Take into account the "appearance" and "local-name" flags here.
846 * These are currently being ignored as they are not supported.
847 */
848 return adv_instance->scan_rsp_len;
849}
850
851void __hci_req_disable_advertising(struct hci_request *req)
852{
853 u8 enable = 0x00;
854
855 hci_req_add(req, HCI_OP_LE_SET_ADV_ENABLE, sizeof(enable), &enable);
856}
857
858static u32 get_adv_instance_flags(struct hci_dev *hdev, u8 instance)
859{
860 u32 flags;
861 struct adv_info *adv_instance;
862
863 if (instance == 0x00) {
864 /* Instance 0 always manages the "Tx Power" and "Flags"
865 * fields
866 */
867 flags = MGMT_ADV_FLAG_TX_POWER | MGMT_ADV_FLAG_MANAGED_FLAGS;
868
869 /* For instance 0, the HCI_ADVERTISING_CONNECTABLE setting
870 * corresponds to the "connectable" instance flag.
871 */
872 if (hci_dev_test_flag(hdev, HCI_ADVERTISING_CONNECTABLE))
873 flags |= MGMT_ADV_FLAG_CONNECTABLE;
874
875 if (hci_dev_test_flag(hdev, HCI_LIMITED_DISCOVERABLE))
876 flags |= MGMT_ADV_FLAG_LIMITED_DISCOV;
877 else if (hci_dev_test_flag(hdev, HCI_DISCOVERABLE))
878 flags |= MGMT_ADV_FLAG_DISCOV;
879
880 return flags;
881 }
882
883 adv_instance = hci_find_adv_instance(hdev, instance);
884
885 /* Return 0 when we got an invalid instance identifier. */
886 if (!adv_instance)
887 return 0;
888
889 return adv_instance->flags;
890}
891
892static bool adv_use_rpa(struct hci_dev *hdev, uint32_t flags)
893{
894 /* If privacy is not enabled don't use RPA */
895 if (!hci_dev_test_flag(hdev, HCI_PRIVACY))
896 return false;
897
898 /* If basic privacy mode is enabled use RPA */
899 if (!hci_dev_test_flag(hdev, HCI_LIMITED_PRIVACY))
900 return true;
901
902 /* If limited privacy mode is enabled don't use RPA if we're
903 * both discoverable and bondable.
904 */
905 if ((flags & MGMT_ADV_FLAG_DISCOV) &&
906 hci_dev_test_flag(hdev, HCI_BONDABLE))
907 return false;
908
909 /* We're neither bondable nor discoverable in the limited
910 * privacy mode, therefore use RPA.
911 */
912 return true;
913}
914
915void __hci_req_enable_advertising(struct hci_request *req)
916{
917 struct hci_dev *hdev = req->hdev;
918 struct hci_cp_le_set_adv_param cp;
919 u8 own_addr_type, enable = 0x01;
920 bool connectable;
921 u32 flags;
922
923 if (hci_conn_num(hdev, LE_LINK) > 0)
924 return;
925
926 if (hci_dev_test_flag(hdev, HCI_LE_ADV))
927 __hci_req_disable_advertising(req);
928
929 /* Clear the HCI_LE_ADV bit temporarily so that the
930 * hci_update_random_address knows that it's safe to go ahead
931 * and write a new random address. The flag will be set back on
932 * as soon as the SET_ADV_ENABLE HCI command completes.
933 */
934 hci_dev_clear_flag(hdev, HCI_LE_ADV);
935
936 flags = get_adv_instance_flags(hdev, hdev->cur_adv_instance);
937
938 /* If the "connectable" instance flag was not set, then choose between
939 * ADV_IND and ADV_NONCONN_IND based on the global connectable setting.
940 */
941 connectable = (flags & MGMT_ADV_FLAG_CONNECTABLE) ||
942 mgmt_get_connectable(hdev);
943
944 /* Set require_privacy to true only when non-connectable
945 * advertising is used. In that case it is fine to use a
946 * non-resolvable private address.
947 */
948 if (hci_update_random_address(req, !connectable,
949 adv_use_rpa(hdev, flags),
950 &own_addr_type) < 0)
951 return;
952
953 memset(&cp, 0, sizeof(cp));
954 cp.min_interval = cpu_to_le16(hdev->le_adv_min_interval);
955 cp.max_interval = cpu_to_le16(hdev->le_adv_max_interval);
956
957 if (connectable)
958 cp.type = LE_ADV_IND;
959 else if (get_cur_adv_instance_scan_rsp_len(hdev))
960 cp.type = LE_ADV_SCAN_IND;
961 else
962 cp.type = LE_ADV_NONCONN_IND;
963
964 cp.own_address_type = own_addr_type;
965 cp.channel_map = hdev->le_adv_channel_map;
966
967 hci_req_add(req, HCI_OP_LE_SET_ADV_PARAM, sizeof(cp), &cp);
968
969 hci_req_add(req, HCI_OP_LE_SET_ADV_ENABLE, sizeof(enable), &enable);
970}
971
972u8 append_local_name(struct hci_dev *hdev, u8 *ptr, u8 ad_len)
973{
974 size_t short_len;
975 size_t complete_len;
976
977 /* no space left for name (+ NULL + type + len) */
978 if ((HCI_MAX_AD_LENGTH - ad_len) < HCI_MAX_SHORT_NAME_LENGTH + 3)
979 return ad_len;
980
981 /* use complete name if present and fits */
982 complete_len = strlen(hdev->dev_name);
983 if (complete_len && complete_len <= HCI_MAX_SHORT_NAME_LENGTH)
984 return eir_append_data(ptr, ad_len, EIR_NAME_COMPLETE,
985 hdev->dev_name, complete_len + 1);
986
987 /* use short name if present */
988 short_len = strlen(hdev->short_name);
989 if (short_len)
990 return eir_append_data(ptr, ad_len, EIR_NAME_SHORT,
991 hdev->short_name, short_len + 1);
992
993 /* use shortened full name if present, we already know that name
994 * is longer then HCI_MAX_SHORT_NAME_LENGTH
995 */
996 if (complete_len) {
997 u8 name[HCI_MAX_SHORT_NAME_LENGTH + 1];
998
999 memcpy(name, hdev->dev_name, HCI_MAX_SHORT_NAME_LENGTH);
1000 name[HCI_MAX_SHORT_NAME_LENGTH] = '\0';
1001
1002 return eir_append_data(ptr, ad_len, EIR_NAME_SHORT, name,
1003 sizeof(name));
1004 }
1005
1006 return ad_len;
1007}
1008
1009static u8 append_appearance(struct hci_dev *hdev, u8 *ptr, u8 ad_len)
1010{
1011 return eir_append_le16(ptr, ad_len, EIR_APPEARANCE, hdev->appearance);
1012}
1013
1014static u8 create_default_scan_rsp_data(struct hci_dev *hdev, u8 *ptr)
1015{
1016 u8 scan_rsp_len = 0;
1017
1018 if (hdev->appearance) {
1019 scan_rsp_len = append_appearance(hdev, ptr, scan_rsp_len);
1020 }
1021
1022 return append_local_name(hdev, ptr, scan_rsp_len);
1023}
1024
1025static u8 create_instance_scan_rsp_data(struct hci_dev *hdev, u8 instance,
1026 u8 *ptr)
1027{
1028 struct adv_info *adv_instance;
1029 u32 instance_flags;
1030 u8 scan_rsp_len = 0;
1031
1032 adv_instance = hci_find_adv_instance(hdev, instance);
1033 if (!adv_instance)
1034 return 0;
1035
1036 instance_flags = adv_instance->flags;
1037
1038 if ((instance_flags & MGMT_ADV_FLAG_APPEARANCE) && hdev->appearance) {
1039 scan_rsp_len = append_appearance(hdev, ptr, scan_rsp_len);
1040 }
1041
1042 memcpy(&ptr[scan_rsp_len], adv_instance->scan_rsp_data,
1043 adv_instance->scan_rsp_len);
1044
1045 scan_rsp_len += adv_instance->scan_rsp_len;
1046
1047 if (instance_flags & MGMT_ADV_FLAG_LOCAL_NAME)
1048 scan_rsp_len = append_local_name(hdev, ptr, scan_rsp_len);
1049
1050 return scan_rsp_len;
1051}
1052
1053void __hci_req_update_scan_rsp_data(struct hci_request *req, u8 instance)
1054{
1055 struct hci_dev *hdev = req->hdev;
1056 struct hci_cp_le_set_scan_rsp_data cp;
1057 u8 len;
1058
1059 if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED))
1060 return;
1061
1062 memset(&cp, 0, sizeof(cp));
1063
1064 if (instance)
1065 len = create_instance_scan_rsp_data(hdev, instance, cp.data);
1066 else
1067 len = create_default_scan_rsp_data(hdev, cp.data);
1068
1069 if (hdev->scan_rsp_data_len == len &&
1070 !memcmp(cp.data, hdev->scan_rsp_data, len))
1071 return;
1072
1073 memcpy(hdev->scan_rsp_data, cp.data, sizeof(cp.data));
1074 hdev->scan_rsp_data_len = len;
1075
1076 cp.length = len;
1077
1078 hci_req_add(req, HCI_OP_LE_SET_SCAN_RSP_DATA, sizeof(cp), &cp);
1079}
1080
1081static u8 create_instance_adv_data(struct hci_dev *hdev, u8 instance, u8 *ptr)
1082{
1083 struct adv_info *adv_instance = NULL;
1084 u8 ad_len = 0, flags = 0;
1085 u32 instance_flags;
1086
1087 /* Return 0 when the current instance identifier is invalid. */
1088 if (instance) {
1089 adv_instance = hci_find_adv_instance(hdev, instance);
1090 if (!adv_instance)
1091 return 0;
1092 }
1093
1094 instance_flags = get_adv_instance_flags(hdev, instance);
1095
1096 /* The Add Advertising command allows userspace to set both the general
1097 * and limited discoverable flags.
1098 */
1099 if (instance_flags & MGMT_ADV_FLAG_DISCOV)
1100 flags |= LE_AD_GENERAL;
1101
1102 if (instance_flags & MGMT_ADV_FLAG_LIMITED_DISCOV)
1103 flags |= LE_AD_LIMITED;
1104
1105 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
1106 flags |= LE_AD_NO_BREDR;
1107
1108 if (flags || (instance_flags & MGMT_ADV_FLAG_MANAGED_FLAGS)) {
1109 /* If a discovery flag wasn't provided, simply use the global
1110 * settings.
1111 */
1112 if (!flags)
1113 flags |= mgmt_get_adv_discov_flags(hdev);
1114
1115 /* If flags would still be empty, then there is no need to
1116 * include the "Flags" AD field".
1117 */
1118 if (flags) {
1119 ptr[0] = 0x02;
1120 ptr[1] = EIR_FLAGS;
1121 ptr[2] = flags;
1122
1123 ad_len += 3;
1124 ptr += 3;
1125 }
1126 }
1127
1128 if (adv_instance) {
1129 memcpy(ptr, adv_instance->adv_data,
1130 adv_instance->adv_data_len);
1131 ad_len += adv_instance->adv_data_len;
1132 ptr += adv_instance->adv_data_len;
1133 }
1134
1135 /* Provide Tx Power only if we can provide a valid value for it */
1136 if (hdev->adv_tx_power != HCI_TX_POWER_INVALID &&
1137 (instance_flags & MGMT_ADV_FLAG_TX_POWER)) {
1138 ptr[0] = 0x02;
1139 ptr[1] = EIR_TX_POWER;
1140 ptr[2] = (u8)hdev->adv_tx_power;
1141
1142 ad_len += 3;
1143 ptr += 3;
1144 }
1145
1146 return ad_len;
1147}
1148
1149void __hci_req_update_adv_data(struct hci_request *req, u8 instance)
1150{
1151 struct hci_dev *hdev = req->hdev;
1152 struct hci_cp_le_set_adv_data cp;
1153 u8 len;
1154
1155 if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED))
1156 return;
1157
1158 memset(&cp, 0, sizeof(cp));
1159
1160 len = create_instance_adv_data(hdev, instance, cp.data);
1161
1162 /* There's nothing to do if the data hasn't changed */
1163 if (hdev->adv_data_len == len &&
1164 memcmp(cp.data, hdev->adv_data, len) == 0)
1165 return;
1166
1167 memcpy(hdev->adv_data, cp.data, sizeof(cp.data));
1168 hdev->adv_data_len = len;
1169
1170 cp.length = len;
1171
1172 hci_req_add(req, HCI_OP_LE_SET_ADV_DATA, sizeof(cp), &cp);
1173}
1174
1175int hci_req_update_adv_data(struct hci_dev *hdev, u8 instance)
1176{
1177 struct hci_request req;
1178
1179 hci_req_init(&req, hdev);
1180 __hci_req_update_adv_data(&req, instance);
1181
1182 return hci_req_run(&req, NULL);
1183}
1184
1185static void adv_enable_complete(struct hci_dev *hdev, u8 status, u16 opcode)
1186{
1187 BT_DBG("%s status %u", hdev->name, status);
1188}
1189
1190void hci_req_reenable_advertising(struct hci_dev *hdev)
1191{
1192 struct hci_request req;
1193
1194 if (!hci_dev_test_flag(hdev, HCI_ADVERTISING) &&
1195 list_empty(&hdev->adv_instances))
1196 return;
1197
1198 hci_req_init(&req, hdev);
1199
1200 if (hdev->cur_adv_instance) {
1201 __hci_req_schedule_adv_instance(&req, hdev->cur_adv_instance,
1202 true);
1203 } else {
1204 __hci_req_update_adv_data(&req, 0x00);
1205 __hci_req_update_scan_rsp_data(&req, 0x00);
1206 __hci_req_enable_advertising(&req);
1207 }
1208
1209 hci_req_run(&req, adv_enable_complete);
1210}
1211
1212static void adv_timeout_expire(struct work_struct *work)
1213{
1214 struct hci_dev *hdev = container_of(work, struct hci_dev,
1215 adv_instance_expire.work);
1216
1217 struct hci_request req;
1218 u8 instance;
1219
1220 BT_DBG("%s", hdev->name);
1221
1222 hci_dev_lock(hdev);
1223
1224 hdev->adv_instance_timeout = 0;
1225
1226 instance = hdev->cur_adv_instance;
1227 if (instance == 0x00)
1228 goto unlock;
1229
1230 hci_req_init(&req, hdev);
1231
1232 hci_req_clear_adv_instance(hdev, NULL, &req, instance, false);
1233
1234 if (list_empty(&hdev->adv_instances))
1235 __hci_req_disable_advertising(&req);
1236
1237 hci_req_run(&req, NULL);
1238
1239unlock:
1240 hci_dev_unlock(hdev);
1241}
1242
1243int __hci_req_schedule_adv_instance(struct hci_request *req, u8 instance,
1244 bool force)
1245{
1246 struct hci_dev *hdev = req->hdev;
1247 struct adv_info *adv_instance = NULL;
1248 u16 timeout;
1249
1250 if (hci_dev_test_flag(hdev, HCI_ADVERTISING) ||
1251 list_empty(&hdev->adv_instances))
1252 return -EPERM;
1253
1254 if (hdev->adv_instance_timeout)
1255 return -EBUSY;
1256
1257 adv_instance = hci_find_adv_instance(hdev, instance);
1258 if (!adv_instance)
1259 return -ENOENT;
1260
1261 /* A zero timeout means unlimited advertising. As long as there is
1262 * only one instance, duration should be ignored. We still set a timeout
1263 * in case further instances are being added later on.
1264 *
1265 * If the remaining lifetime of the instance is more than the duration
1266 * then the timeout corresponds to the duration, otherwise it will be
1267 * reduced to the remaining instance lifetime.
1268 */
1269 if (adv_instance->timeout == 0 ||
1270 adv_instance->duration <= adv_instance->remaining_time)
1271 timeout = adv_instance->duration;
1272 else
1273 timeout = adv_instance->remaining_time;
1274
1275 /* The remaining time is being reduced unless the instance is being
1276 * advertised without time limit.
1277 */
1278 if (adv_instance->timeout)
1279 adv_instance->remaining_time =
1280 adv_instance->remaining_time - timeout;
1281
1282 hdev->adv_instance_timeout = timeout;
1283 queue_delayed_work(hdev->req_workqueue,
1284 &hdev->adv_instance_expire,
1285 msecs_to_jiffies(timeout * 1000));
1286
1287 /* If we're just re-scheduling the same instance again then do not
1288 * execute any HCI commands. This happens when a single instance is
1289 * being advertised.
1290 */
1291 if (!force && hdev->cur_adv_instance == instance &&
1292 hci_dev_test_flag(hdev, HCI_LE_ADV))
1293 return 0;
1294
1295 hdev->cur_adv_instance = instance;
1296 __hci_req_update_adv_data(req, instance);
1297 __hci_req_update_scan_rsp_data(req, instance);
1298 __hci_req_enable_advertising(req);
1299
1300 return 0;
1301}
1302
1303static void cancel_adv_timeout(struct hci_dev *hdev)
1304{
1305 if (hdev->adv_instance_timeout) {
1306 hdev->adv_instance_timeout = 0;
1307 cancel_delayed_work(&hdev->adv_instance_expire);
1308 }
1309}
1310
1311/* For a single instance:
1312 * - force == true: The instance will be removed even when its remaining
1313 * lifetime is not zero.
1314 * - force == false: the instance will be deactivated but kept stored unless
1315 * the remaining lifetime is zero.
1316 *
1317 * For instance == 0x00:
1318 * - force == true: All instances will be removed regardless of their timeout
1319 * setting.
1320 * - force == false: Only instances that have a timeout will be removed.
1321 */
1322void hci_req_clear_adv_instance(struct hci_dev *hdev, struct sock *sk,
1323 struct hci_request *req, u8 instance,
1324 bool force)
1325{
1326 struct adv_info *adv_instance, *n, *next_instance = NULL;
1327 int err;
1328 u8 rem_inst;
1329
1330 /* Cancel any timeout concerning the removed instance(s). */
1331 if (!instance || hdev->cur_adv_instance == instance)
1332 cancel_adv_timeout(hdev);
1333
1334 /* Get the next instance to advertise BEFORE we remove
1335 * the current one. This can be the same instance again
1336 * if there is only one instance.
1337 */
1338 if (instance && hdev->cur_adv_instance == instance)
1339 next_instance = hci_get_next_instance(hdev, instance);
1340
1341 if (instance == 0x00) {
1342 list_for_each_entry_safe(adv_instance, n, &hdev->adv_instances,
1343 list) {
1344 if (!(force || adv_instance->timeout))
1345 continue;
1346
1347 rem_inst = adv_instance->instance;
1348 err = hci_remove_adv_instance(hdev, rem_inst);
1349 if (!err)
1350 mgmt_advertising_removed(sk, hdev, rem_inst);
1351 }
1352 } else {
1353 adv_instance = hci_find_adv_instance(hdev, instance);
1354
1355 if (force || (adv_instance && adv_instance->timeout &&
1356 !adv_instance->remaining_time)) {
1357 /* Don't advertise a removed instance. */
1358 if (next_instance &&
1359 next_instance->instance == instance)
1360 next_instance = NULL;
1361
1362 err = hci_remove_adv_instance(hdev, instance);
1363 if (!err)
1364 mgmt_advertising_removed(sk, hdev, instance);
1365 }
1366 }
1367
1368 if (!req || !hdev_is_powered(hdev) ||
1369 hci_dev_test_flag(hdev, HCI_ADVERTISING))
1370 return;
1371
1372 if (next_instance)
1373 __hci_req_schedule_adv_instance(req, next_instance->instance,
1374 false);
1375}
1376
1377static void set_random_addr(struct hci_request *req, bdaddr_t *rpa)
1378{
1379 struct hci_dev *hdev = req->hdev;
1380
1381 /* If we're advertising or initiating an LE connection we can't
1382 * go ahead and change the random address at this time. This is
1383 * because the eventual initiator address used for the
1384 * subsequently created connection will be undefined (some
1385 * controllers use the new address and others the one we had
1386 * when the operation started).
1387 *
1388 * In this kind of scenario skip the update and let the random
1389 * address be updated at the next cycle.
1390 */
1391 if (hci_dev_test_flag(hdev, HCI_LE_ADV) ||
1392 hci_lookup_le_connect(hdev)) {
1393 BT_DBG("Deferring random address update");
1394 hci_dev_set_flag(hdev, HCI_RPA_EXPIRED);
1395 return;
1396 }
1397
1398 hci_req_add(req, HCI_OP_LE_SET_RANDOM_ADDR, 6, rpa);
1399}
1400
1401int hci_update_random_address(struct hci_request *req, bool require_privacy,
1402 bool use_rpa, u8 *own_addr_type)
1403{
1404 struct hci_dev *hdev = req->hdev;
1405 int err;
1406
1407 /* If privacy is enabled use a resolvable private address. If
1408 * current RPA has expired or there is something else than
1409 * the current RPA in use, then generate a new one.
1410 */
1411 if (use_rpa) {
1412 int to;
1413
1414 *own_addr_type = ADDR_LE_DEV_RANDOM;
1415
1416 if (!hci_dev_test_and_clear_flag(hdev, HCI_RPA_EXPIRED) &&
1417 !bacmp(&hdev->random_addr, &hdev->rpa))
1418 return 0;
1419
1420 err = smp_generate_rpa(hdev, hdev->irk, &hdev->rpa);
1421 if (err < 0) {
1422 BT_ERR("%s failed to generate new RPA", hdev->name);
1423 return err;
1424 }
1425
1426 set_random_addr(req, &hdev->rpa);
1427
1428 to = msecs_to_jiffies(hdev->rpa_timeout * 1000);
1429 queue_delayed_work(hdev->workqueue, &hdev->rpa_expired, to);
1430
1431 return 0;
1432 }
1433
1434 /* In case of required privacy without resolvable private address,
1435 * use an non-resolvable private address. This is useful for active
1436 * scanning and non-connectable advertising.
1437 */
1438 if (require_privacy) {
1439 bdaddr_t nrpa;
1440
1441 while (true) {
1442 /* The non-resolvable private address is generated
1443 * from random six bytes with the two most significant
1444 * bits cleared.
1445 */
1446 get_random_bytes(&nrpa, 6);
1447 nrpa.b[5] &= 0x3f;
1448
1449 /* The non-resolvable private address shall not be
1450 * equal to the public address.
1451 */
1452 if (bacmp(&hdev->bdaddr, &nrpa))
1453 break;
1454 }
1455
1456 *own_addr_type = ADDR_LE_DEV_RANDOM;
1457 set_random_addr(req, &nrpa);
1458 return 0;
1459 }
1460
1461 /* If forcing static address is in use or there is no public
1462 * address use the static address as random address (but skip
1463 * the HCI command if the current random address is already the
1464 * static one.
1465 *
1466 * In case BR/EDR has been disabled on a dual-mode controller
1467 * and a static address has been configured, then use that
1468 * address instead of the public BR/EDR address.
1469 */
1470 if (hci_dev_test_flag(hdev, HCI_FORCE_STATIC_ADDR) ||
1471 !bacmp(&hdev->bdaddr, BDADDR_ANY) ||
1472 (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) &&
1473 bacmp(&hdev->static_addr, BDADDR_ANY))) {
1474 *own_addr_type = ADDR_LE_DEV_RANDOM;
1475 if (bacmp(&hdev->static_addr, &hdev->random_addr))
1476 hci_req_add(req, HCI_OP_LE_SET_RANDOM_ADDR, 6,
1477 &hdev->static_addr);
1478 return 0;
1479 }
1480
1481 /* Neither privacy nor static address is being used so use a
1482 * public address.
1483 */
1484 *own_addr_type = ADDR_LE_DEV_PUBLIC;
1485
1486 return 0;
1487}
1488
1489static bool disconnected_whitelist_entries(struct hci_dev *hdev)
1490{
1491 struct bdaddr_list *b;
1492
1493 list_for_each_entry(b, &hdev->whitelist, list) {
1494 struct hci_conn *conn;
1495
1496 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &b->bdaddr);
1497 if (!conn)
1498 return true;
1499
1500 if (conn->state != BT_CONNECTED && conn->state != BT_CONFIG)
1501 return true;
1502 }
1503
1504 return false;
1505}
1506
1507void __hci_req_update_scan(struct hci_request *req)
1508{
1509 struct hci_dev *hdev = req->hdev;
1510 u8 scan;
1511
1512 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
1513 return;
1514
1515 if (!hdev_is_powered(hdev))
1516 return;
1517
1518 if (mgmt_powering_down(hdev))
1519 return;
1520
1521 if (hci_dev_test_flag(hdev, HCI_CONNECTABLE) ||
1522 disconnected_whitelist_entries(hdev))
1523 scan = SCAN_PAGE;
1524 else
1525 scan = SCAN_DISABLED;
1526
1527 if (hci_dev_test_flag(hdev, HCI_DISCOVERABLE))
1528 scan |= SCAN_INQUIRY;
1529
1530 if (test_bit(HCI_PSCAN, &hdev->flags) == !!(scan & SCAN_PAGE) &&
1531 test_bit(HCI_ISCAN, &hdev->flags) == !!(scan & SCAN_INQUIRY))
1532 return;
1533
1534 hci_req_add(req, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
1535}
1536
1537static int update_scan(struct hci_request *req, unsigned long opt)
1538{
1539 hci_dev_lock(req->hdev);
1540 __hci_req_update_scan(req);
1541 hci_dev_unlock(req->hdev);
1542 return 0;
1543}
1544
1545static void scan_update_work(struct work_struct *work)
1546{
1547 struct hci_dev *hdev = container_of(work, struct hci_dev, scan_update);
1548
1549 hci_req_sync(hdev, update_scan, 0, HCI_CMD_TIMEOUT, NULL);
1550}
1551
1552static int connectable_update(struct hci_request *req, unsigned long opt)
1553{
1554 struct hci_dev *hdev = req->hdev;
1555
1556 hci_dev_lock(hdev);
1557
1558 __hci_req_update_scan(req);
1559
1560 /* If BR/EDR is not enabled and we disable advertising as a
1561 * by-product of disabling connectable, we need to update the
1562 * advertising flags.
1563 */
1564 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
1565 __hci_req_update_adv_data(req, hdev->cur_adv_instance);
1566
1567 /* Update the advertising parameters if necessary */
1568 if (hci_dev_test_flag(hdev, HCI_ADVERTISING) ||
1569 !list_empty(&hdev->adv_instances))
1570 __hci_req_enable_advertising(req);
1571
1572 __hci_update_background_scan(req);
1573
1574 hci_dev_unlock(hdev);
1575
1576 return 0;
1577}
1578
1579static void connectable_update_work(struct work_struct *work)
1580{
1581 struct hci_dev *hdev = container_of(work, struct hci_dev,
1582 connectable_update);
1583 u8 status;
1584
1585 hci_req_sync(hdev, connectable_update, 0, HCI_CMD_TIMEOUT, &status);
1586 mgmt_set_connectable_complete(hdev, status);
1587}
1588
1589static u8 get_service_classes(struct hci_dev *hdev)
1590{
1591 struct bt_uuid *uuid;
1592 u8 val = 0;
1593
1594 list_for_each_entry(uuid, &hdev->uuids, list)
1595 val |= uuid->svc_hint;
1596
1597 return val;
1598}
1599
1600void __hci_req_update_class(struct hci_request *req)
1601{
1602 struct hci_dev *hdev = req->hdev;
1603 u8 cod[3];
1604
1605 BT_DBG("%s", hdev->name);
1606
1607 if (!hdev_is_powered(hdev))
1608 return;
1609
1610 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
1611 return;
1612
1613 if (hci_dev_test_flag(hdev, HCI_SERVICE_CACHE))
1614 return;
1615
1616 cod[0] = hdev->minor_class;
1617 cod[1] = hdev->major_class;
1618 cod[2] = get_service_classes(hdev);
1619
1620 if (hci_dev_test_flag(hdev, HCI_LIMITED_DISCOVERABLE))
1621 cod[1] |= 0x20;
1622
1623 if (memcmp(cod, hdev->dev_class, 3) == 0)
1624 return;
1625
1626 hci_req_add(req, HCI_OP_WRITE_CLASS_OF_DEV, sizeof(cod), cod);
1627}
1628
1629static void write_iac(struct hci_request *req)
1630{
1631 struct hci_dev *hdev = req->hdev;
1632 struct hci_cp_write_current_iac_lap cp;
1633
1634 if (!hci_dev_test_flag(hdev, HCI_DISCOVERABLE))
1635 return;
1636
1637 if (hci_dev_test_flag(hdev, HCI_LIMITED_DISCOVERABLE)) {
1638 /* Limited discoverable mode */
1639 cp.num_iac = min_t(u8, hdev->num_iac, 2);
1640 cp.iac_lap[0] = 0x00; /* LIAC */
1641 cp.iac_lap[1] = 0x8b;
1642 cp.iac_lap[2] = 0x9e;
1643 cp.iac_lap[3] = 0x33; /* GIAC */
1644 cp.iac_lap[4] = 0x8b;
1645 cp.iac_lap[5] = 0x9e;
1646 } else {
1647 /* General discoverable mode */
1648 cp.num_iac = 1;
1649 cp.iac_lap[0] = 0x33; /* GIAC */
1650 cp.iac_lap[1] = 0x8b;
1651 cp.iac_lap[2] = 0x9e;
1652 }
1653
1654 hci_req_add(req, HCI_OP_WRITE_CURRENT_IAC_LAP,
1655 (cp.num_iac * 3) + 1, &cp);
1656}
1657
1658static int discoverable_update(struct hci_request *req, unsigned long opt)
1659{
1660 struct hci_dev *hdev = req->hdev;
1661
1662 hci_dev_lock(hdev);
1663
1664 if (hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) {
1665 write_iac(req);
1666 __hci_req_update_scan(req);
1667 __hci_req_update_class(req);
1668 }
1669
1670 /* Advertising instances don't use the global discoverable setting, so
1671 * only update AD if advertising was enabled using Set Advertising.
1672 */
1673 if (hci_dev_test_flag(hdev, HCI_ADVERTISING)) {
1674 __hci_req_update_adv_data(req, 0x00);
1675
1676 /* Discoverable mode affects the local advertising
1677 * address in limited privacy mode.
1678 */
1679 if (hci_dev_test_flag(hdev, HCI_LIMITED_PRIVACY))
1680 __hci_req_enable_advertising(req);
1681 }
1682
1683 hci_dev_unlock(hdev);
1684
1685 return 0;
1686}
1687
1688static void discoverable_update_work(struct work_struct *work)
1689{
1690 struct hci_dev *hdev = container_of(work, struct hci_dev,
1691 discoverable_update);
1692 u8 status;
1693
1694 hci_req_sync(hdev, discoverable_update, 0, HCI_CMD_TIMEOUT, &status);
1695 mgmt_set_discoverable_complete(hdev, status);
1696}
1697
1698void __hci_abort_conn(struct hci_request *req, struct hci_conn *conn,
1699 u8 reason)
1700{
1701 switch (conn->state) {
1702 case BT_CONNECTED:
1703 case BT_CONFIG:
1704 if (conn->type == AMP_LINK) {
1705 struct hci_cp_disconn_phy_link cp;
1706
1707 cp.phy_handle = HCI_PHY_HANDLE(conn->handle);
1708 cp.reason = reason;
1709 hci_req_add(req, HCI_OP_DISCONN_PHY_LINK, sizeof(cp),
1710 &cp);
1711 } else {
1712 struct hci_cp_disconnect dc;
1713
1714 dc.handle = cpu_to_le16(conn->handle);
1715 dc.reason = reason;
1716 hci_req_add(req, HCI_OP_DISCONNECT, sizeof(dc), &dc);
1717 }
1718
1719 conn->state = BT_DISCONN;
1720
1721 break;
1722 case BT_CONNECT:
1723 if (conn->type == LE_LINK) {
1724 if (test_bit(HCI_CONN_SCANNING, &conn->flags))
1725 break;
1726 hci_req_add(req, HCI_OP_LE_CREATE_CONN_CANCEL,
1727 0, NULL);
1728 } else if (conn->type == ACL_LINK) {
1729 if (req->hdev->hci_ver < BLUETOOTH_VER_1_2)
1730 break;
1731 hci_req_add(req, HCI_OP_CREATE_CONN_CANCEL,
1732 6, &conn->dst);
1733 }
1734 break;
1735 case BT_CONNECT2:
1736 if (conn->type == ACL_LINK) {
1737 struct hci_cp_reject_conn_req rej;
1738
1739 bacpy(&rej.bdaddr, &conn->dst);
1740 rej.reason = reason;
1741
1742 hci_req_add(req, HCI_OP_REJECT_CONN_REQ,
1743 sizeof(rej), &rej);
1744 } else if (conn->type == SCO_LINK || conn->type == ESCO_LINK) {
1745 struct hci_cp_reject_sync_conn_req rej;
1746
1747 bacpy(&rej.bdaddr, &conn->dst);
1748
1749 /* SCO rejection has its own limited set of
1750 * allowed error values (0x0D-0x0F) which isn't
1751 * compatible with most values passed to this
1752 * function. To be safe hard-code one of the
1753 * values that's suitable for SCO.
1754 */
1755 rej.reason = HCI_ERROR_REJ_LIMITED_RESOURCES;
1756
1757 hci_req_add(req, HCI_OP_REJECT_SYNC_CONN_REQ,
1758 sizeof(rej), &rej);
1759 }
1760 break;
1761 default:
1762 conn->state = BT_CLOSED;
1763 break;
1764 }
1765}
1766
1767static void abort_conn_complete(struct hci_dev *hdev, u8 status, u16 opcode)
1768{
1769 if (status)
1770 BT_DBG("Failed to abort connection: status 0x%2.2x", status);
1771}
1772
1773int hci_abort_conn(struct hci_conn *conn, u8 reason)
1774{
1775 struct hci_request req;
1776 int err;
1777
1778 hci_req_init(&req, conn->hdev);
1779
1780 __hci_abort_conn(&req, conn, reason);
1781
1782 err = hci_req_run(&req, abort_conn_complete);
1783 if (err && err != -ENODATA) {
1784 BT_ERR("Failed to run HCI request: err %d", err);
1785 return err;
1786 }
1787
1788 return 0;
1789}
1790
1791static int update_bg_scan(struct hci_request *req, unsigned long opt)
1792{
1793 hci_dev_lock(req->hdev);
1794 __hci_update_background_scan(req);
1795 hci_dev_unlock(req->hdev);
1796 return 0;
1797}
1798
1799static void bg_scan_update(struct work_struct *work)
1800{
1801 struct hci_dev *hdev = container_of(work, struct hci_dev,
1802 bg_scan_update);
1803 struct hci_conn *conn;
1804 u8 status;
1805 int err;
1806
1807 err = hci_req_sync(hdev, update_bg_scan, 0, HCI_CMD_TIMEOUT, &status);
1808 if (!err)
1809 return;
1810
1811 hci_dev_lock(hdev);
1812
1813 conn = hci_conn_hash_lookup_state(hdev, LE_LINK, BT_CONNECT);
1814 if (conn)
1815 hci_le_conn_failed(conn, status);
1816
1817 hci_dev_unlock(hdev);
1818}
1819
1820static int le_scan_disable(struct hci_request *req, unsigned long opt)
1821{
1822 hci_req_add_le_scan_disable(req);
1823 return 0;
1824}
1825
1826static int bredr_inquiry(struct hci_request *req, unsigned long opt)
1827{
1828 u8 length = opt;
1829 const u8 giac[3] = { 0x33, 0x8b, 0x9e };
1830 const u8 liac[3] = { 0x00, 0x8b, 0x9e };
1831 struct hci_cp_inquiry cp;
1832
1833 BT_DBG("%s", req->hdev->name);
1834
1835 hci_dev_lock(req->hdev);
1836 hci_inquiry_cache_flush(req->hdev);
1837 hci_dev_unlock(req->hdev);
1838
1839 memset(&cp, 0, sizeof(cp));
1840
1841 if (req->hdev->discovery.limited)
1842 memcpy(&cp.lap, liac, sizeof(cp.lap));
1843 else
1844 memcpy(&cp.lap, giac, sizeof(cp.lap));
1845
1846 cp.length = length;
1847
1848 hci_req_add(req, HCI_OP_INQUIRY, sizeof(cp), &cp);
1849
1850 return 0;
1851}
1852
1853static void le_scan_disable_work(struct work_struct *work)
1854{
1855 struct hci_dev *hdev = container_of(work, struct hci_dev,
1856 le_scan_disable.work);
1857 u8 status;
1858
1859 BT_DBG("%s", hdev->name);
1860
1861 if (!hci_dev_test_flag(hdev, HCI_LE_SCAN))
1862 return;
1863
1864 cancel_delayed_work(&hdev->le_scan_restart);
1865
1866 hci_req_sync(hdev, le_scan_disable, 0, HCI_CMD_TIMEOUT, &status);
1867 if (status) {
1868 BT_ERR("Failed to disable LE scan: status 0x%02x", status);
1869 return;
1870 }
1871
1872 hdev->discovery.scan_start = 0;
1873
1874 /* If we were running LE only scan, change discovery state. If
1875 * we were running both LE and BR/EDR inquiry simultaneously,
1876 * and BR/EDR inquiry is already finished, stop discovery,
1877 * otherwise BR/EDR inquiry will stop discovery when finished.
1878 * If we will resolve remote device name, do not change
1879 * discovery state.
1880 */
1881
1882 if (hdev->discovery.type == DISCOV_TYPE_LE)
1883 goto discov_stopped;
1884
1885 if (hdev->discovery.type != DISCOV_TYPE_INTERLEAVED)
1886 return;
1887
1888 if (test_bit(HCI_QUIRK_SIMULTANEOUS_DISCOVERY, &hdev->quirks)) {
1889 if (!test_bit(HCI_INQUIRY, &hdev->flags) &&
1890 hdev->discovery.state != DISCOVERY_RESOLVING)
1891 goto discov_stopped;
1892
1893 return;
1894 }
1895
1896 hci_req_sync(hdev, bredr_inquiry, DISCOV_INTERLEAVED_INQUIRY_LEN,
1897 HCI_CMD_TIMEOUT, &status);
1898 if (status) {
1899 BT_ERR("Inquiry failed: status 0x%02x", status);
1900 goto discov_stopped;
1901 }
1902
1903 return;
1904
1905discov_stopped:
1906 hci_dev_lock(hdev);
1907 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
1908 hci_dev_unlock(hdev);
1909}
1910
1911static int le_scan_restart(struct hci_request *req, unsigned long opt)
1912{
1913 struct hci_dev *hdev = req->hdev;
1914 struct hci_cp_le_set_scan_enable cp;
1915
1916 /* If controller is not scanning we are done. */
1917 if (!hci_dev_test_flag(hdev, HCI_LE_SCAN))
1918 return 0;
1919
1920 hci_req_add_le_scan_disable(req);
1921
1922 memset(&cp, 0, sizeof(cp));
1923 cp.enable = LE_SCAN_ENABLE;
1924 cp.filter_dup = LE_SCAN_FILTER_DUP_ENABLE;
1925 hci_req_add(req, HCI_OP_LE_SET_SCAN_ENABLE, sizeof(cp), &cp);
1926
1927 return 0;
1928}
1929
1930static void le_scan_restart_work(struct work_struct *work)
1931{
1932 struct hci_dev *hdev = container_of(work, struct hci_dev,
1933 le_scan_restart.work);
1934 unsigned long timeout, duration, scan_start, now;
1935 u8 status;
1936
1937 BT_DBG("%s", hdev->name);
1938
1939 hci_req_sync(hdev, le_scan_restart, 0, HCI_CMD_TIMEOUT, &status);
1940 if (status) {
1941 BT_ERR("Failed to restart LE scan: status %d", status);
1942 return;
1943 }
1944
1945 hci_dev_lock(hdev);
1946
1947 if (!test_bit(HCI_QUIRK_STRICT_DUPLICATE_FILTER, &hdev->quirks) ||
1948 !hdev->discovery.scan_start)
1949 goto unlock;
1950
1951 /* When the scan was started, hdev->le_scan_disable has been queued
1952 * after duration from scan_start. During scan restart this job
1953 * has been canceled, and we need to queue it again after proper
1954 * timeout, to make sure that scan does not run indefinitely.
1955 */
1956 duration = hdev->discovery.scan_duration;
1957 scan_start = hdev->discovery.scan_start;
1958 now = jiffies;
1959 if (now - scan_start <= duration) {
1960 int elapsed;
1961
1962 if (now >= scan_start)
1963 elapsed = now - scan_start;
1964 else
1965 elapsed = ULONG_MAX - scan_start + now;
1966
1967 timeout = duration - elapsed;
1968 } else {
1969 timeout = 0;
1970 }
1971
1972 queue_delayed_work(hdev->req_workqueue,
1973 &hdev->le_scan_disable, timeout);
1974
1975unlock:
1976 hci_dev_unlock(hdev);
1977}
1978
1979static void disable_advertising(struct hci_request *req)
1980{
1981 u8 enable = 0x00;
1982
1983 hci_req_add(req, HCI_OP_LE_SET_ADV_ENABLE, sizeof(enable), &enable);
1984}
1985
1986static int active_scan(struct hci_request *req, unsigned long opt)
1987{
1988 uint16_t interval = opt;
1989 struct hci_dev *hdev = req->hdev;
1990 struct hci_cp_le_set_scan_param param_cp;
1991 struct hci_cp_le_set_scan_enable enable_cp;
1992 u8 own_addr_type;
1993 int err;
1994
1995 BT_DBG("%s", hdev->name);
1996
1997 if (hci_dev_test_flag(hdev, HCI_LE_ADV)) {
1998 hci_dev_lock(hdev);
1999
2000 /* Don't let discovery abort an outgoing connection attempt
2001 * that's using directed advertising.
2002 */
2003 if (hci_lookup_le_connect(hdev)) {
2004 hci_dev_unlock(hdev);
2005 return -EBUSY;
2006 }
2007
2008 cancel_adv_timeout(hdev);
2009 hci_dev_unlock(hdev);
2010
2011 disable_advertising(req);
2012 }
2013
2014 /* If controller is scanning, it means the background scanning is
2015 * running. Thus, we should temporarily stop it in order to set the
2016 * discovery scanning parameters.
2017 */
2018 if (hci_dev_test_flag(hdev, HCI_LE_SCAN))
2019 hci_req_add_le_scan_disable(req);
2020
2021 /* All active scans will be done with either a resolvable private
2022 * address (when privacy feature has been enabled) or non-resolvable
2023 * private address.
2024 */
2025 err = hci_update_random_address(req, true, scan_use_rpa(hdev),
2026 &own_addr_type);
2027 if (err < 0)
2028 own_addr_type = ADDR_LE_DEV_PUBLIC;
2029
2030 memset(¶m_cp, 0, sizeof(param_cp));
2031 param_cp.type = LE_SCAN_ACTIVE;
2032 param_cp.interval = cpu_to_le16(interval);
2033 param_cp.window = cpu_to_le16(DISCOV_LE_SCAN_WIN);
2034 param_cp.own_address_type = own_addr_type;
2035
2036 hci_req_add(req, HCI_OP_LE_SET_SCAN_PARAM, sizeof(param_cp),
2037 ¶m_cp);
2038
2039 memset(&enable_cp, 0, sizeof(enable_cp));
2040 enable_cp.enable = LE_SCAN_ENABLE;
2041 enable_cp.filter_dup = LE_SCAN_FILTER_DUP_ENABLE;
2042
2043 hci_req_add(req, HCI_OP_LE_SET_SCAN_ENABLE, sizeof(enable_cp),
2044 &enable_cp);
2045
2046 return 0;
2047}
2048
2049static int interleaved_discov(struct hci_request *req, unsigned long opt)
2050{
2051 int err;
2052
2053 BT_DBG("%s", req->hdev->name);
2054
2055 err = active_scan(req, opt);
2056 if (err)
2057 return err;
2058
2059 return bredr_inquiry(req, DISCOV_BREDR_INQUIRY_LEN);
2060}
2061
2062static void start_discovery(struct hci_dev *hdev, u8 *status)
2063{
2064 unsigned long timeout;
2065
2066 BT_DBG("%s type %u", hdev->name, hdev->discovery.type);
2067
2068 switch (hdev->discovery.type) {
2069 case DISCOV_TYPE_BREDR:
2070 if (!hci_dev_test_flag(hdev, HCI_INQUIRY))
2071 hci_req_sync(hdev, bredr_inquiry,
2072 DISCOV_BREDR_INQUIRY_LEN, HCI_CMD_TIMEOUT,
2073 status);
2074 return;
2075 case DISCOV_TYPE_INTERLEAVED:
2076 /* When running simultaneous discovery, the LE scanning time
2077 * should occupy the whole discovery time sine BR/EDR inquiry
2078 * and LE scanning are scheduled by the controller.
2079 *
2080 * For interleaving discovery in comparison, BR/EDR inquiry
2081 * and LE scanning are done sequentially with separate
2082 * timeouts.
2083 */
2084 if (test_bit(HCI_QUIRK_SIMULTANEOUS_DISCOVERY,
2085 &hdev->quirks)) {
2086 timeout = msecs_to_jiffies(DISCOV_LE_TIMEOUT);
2087 /* During simultaneous discovery, we double LE scan
2088 * interval. We must leave some time for the controller
2089 * to do BR/EDR inquiry.
2090 */
2091 hci_req_sync(hdev, interleaved_discov,
2092 DISCOV_LE_SCAN_INT * 2, HCI_CMD_TIMEOUT,
2093 status);
2094 break;
2095 }
2096
2097 timeout = msecs_to_jiffies(hdev->discov_interleaved_timeout);
2098 hci_req_sync(hdev, active_scan, DISCOV_LE_SCAN_INT,
2099 HCI_CMD_TIMEOUT, status);
2100 break;
2101 case DISCOV_TYPE_LE:
2102 timeout = msecs_to_jiffies(DISCOV_LE_TIMEOUT);
2103 hci_req_sync(hdev, active_scan, DISCOV_LE_SCAN_INT,
2104 HCI_CMD_TIMEOUT, status);
2105 break;
2106 default:
2107 *status = HCI_ERROR_UNSPECIFIED;
2108 return;
2109 }
2110
2111 if (*status)
2112 return;
2113
2114 BT_DBG("%s timeout %u ms", hdev->name, jiffies_to_msecs(timeout));
2115
2116 /* When service discovery is used and the controller has a
2117 * strict duplicate filter, it is important to remember the
2118 * start and duration of the scan. This is required for
2119 * restarting scanning during the discovery phase.
2120 */
2121 if (test_bit(HCI_QUIRK_STRICT_DUPLICATE_FILTER, &hdev->quirks) &&
2122 hdev->discovery.result_filtering) {
2123 hdev->discovery.scan_start = jiffies;
2124 hdev->discovery.scan_duration = timeout;
2125 }
2126
2127 queue_delayed_work(hdev->req_workqueue, &hdev->le_scan_disable,
2128 timeout);
2129}
2130
2131bool hci_req_stop_discovery(struct hci_request *req)
2132{
2133 struct hci_dev *hdev = req->hdev;
2134 struct discovery_state *d = &hdev->discovery;
2135 struct hci_cp_remote_name_req_cancel cp;
2136 struct inquiry_entry *e;
2137 bool ret = false;
2138
2139 BT_DBG("%s state %u", hdev->name, hdev->discovery.state);
2140
2141 if (d->state == DISCOVERY_FINDING || d->state == DISCOVERY_STOPPING) {
2142 if (test_bit(HCI_INQUIRY, &hdev->flags))
2143 hci_req_add(req, HCI_OP_INQUIRY_CANCEL, 0, NULL);
2144
2145 if (hci_dev_test_flag(hdev, HCI_LE_SCAN)) {
2146 cancel_delayed_work(&hdev->le_scan_disable);
2147 hci_req_add_le_scan_disable(req);
2148 }
2149
2150 ret = true;
2151 } else {
2152 /* Passive scanning */
2153 if (hci_dev_test_flag(hdev, HCI_LE_SCAN)) {
2154 hci_req_add_le_scan_disable(req);
2155 ret = true;
2156 }
2157 }
2158
2159 /* No further actions needed for LE-only discovery */
2160 if (d->type == DISCOV_TYPE_LE)
2161 return ret;
2162
2163 if (d->state == DISCOVERY_RESOLVING || d->state == DISCOVERY_STOPPING) {
2164 e = hci_inquiry_cache_lookup_resolve(hdev, BDADDR_ANY,
2165 NAME_PENDING);
2166 if (!e)
2167 return ret;
2168
2169 bacpy(&cp.bdaddr, &e->data.bdaddr);
2170 hci_req_add(req, HCI_OP_REMOTE_NAME_REQ_CANCEL, sizeof(cp),
2171 &cp);
2172 ret = true;
2173 }
2174
2175 return ret;
2176}
2177
2178static int stop_discovery(struct hci_request *req, unsigned long opt)
2179{
2180 hci_dev_lock(req->hdev);
2181 hci_req_stop_discovery(req);
2182 hci_dev_unlock(req->hdev);
2183
2184 return 0;
2185}
2186
2187static void discov_update(struct work_struct *work)
2188{
2189 struct hci_dev *hdev = container_of(work, struct hci_dev,
2190 discov_update);
2191 u8 status = 0;
2192
2193 switch (hdev->discovery.state) {
2194 case DISCOVERY_STARTING:
2195 start_discovery(hdev, &status);
2196 mgmt_start_discovery_complete(hdev, status);
2197 if (status)
2198 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
2199 else
2200 hci_discovery_set_state(hdev, DISCOVERY_FINDING);
2201 break;
2202 case DISCOVERY_STOPPING:
2203 hci_req_sync(hdev, stop_discovery, 0, HCI_CMD_TIMEOUT, &status);
2204 mgmt_stop_discovery_complete(hdev, status);
2205 if (!status)
2206 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
2207 break;
2208 case DISCOVERY_STOPPED:
2209 default:
2210 return;
2211 }
2212}
2213
2214static void discov_off(struct work_struct *work)
2215{
2216 struct hci_dev *hdev = container_of(work, struct hci_dev,
2217 discov_off.work);
2218
2219 BT_DBG("%s", hdev->name);
2220
2221 hci_dev_lock(hdev);
2222
2223 /* When discoverable timeout triggers, then just make sure
2224 * the limited discoverable flag is cleared. Even in the case
2225 * of a timeout triggered from general discoverable, it is
2226 * safe to unconditionally clear the flag.
2227 */
2228 hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE);
2229 hci_dev_clear_flag(hdev, HCI_DISCOVERABLE);
2230 hdev->discov_timeout = 0;
2231
2232 hci_dev_unlock(hdev);
2233
2234 hci_req_sync(hdev, discoverable_update, 0, HCI_CMD_TIMEOUT, NULL);
2235 mgmt_new_settings(hdev);
2236}
2237
2238static int powered_update_hci(struct hci_request *req, unsigned long opt)
2239{
2240 struct hci_dev *hdev = req->hdev;
2241 u8 link_sec;
2242
2243 hci_dev_lock(hdev);
2244
2245 if (hci_dev_test_flag(hdev, HCI_SSP_ENABLED) &&
2246 !lmp_host_ssp_capable(hdev)) {
2247 u8 mode = 0x01;
2248
2249 hci_req_add(req, HCI_OP_WRITE_SSP_MODE, sizeof(mode), &mode);
2250
2251 if (bredr_sc_enabled(hdev) && !lmp_host_sc_capable(hdev)) {
2252 u8 support = 0x01;
2253
2254 hci_req_add(req, HCI_OP_WRITE_SC_SUPPORT,
2255 sizeof(support), &support);
2256 }
2257 }
2258
2259 if (hci_dev_test_flag(hdev, HCI_LE_ENABLED) &&
2260 lmp_bredr_capable(hdev)) {
2261 struct hci_cp_write_le_host_supported cp;
2262
2263 cp.le = 0x01;
2264 cp.simul = 0x00;
2265
2266 /* Check first if we already have the right
2267 * host state (host features set)
2268 */
2269 if (cp.le != lmp_host_le_capable(hdev) ||
2270 cp.simul != lmp_host_le_br_capable(hdev))
2271 hci_req_add(req, HCI_OP_WRITE_LE_HOST_SUPPORTED,
2272 sizeof(cp), &cp);
2273 }
2274
2275 if (hci_dev_test_flag(hdev, HCI_LE_ENABLED)) {
2276 /* Make sure the controller has a good default for
2277 * advertising data. This also applies to the case
2278 * where BR/EDR was toggled during the AUTO_OFF phase.
2279 */
2280 if (hci_dev_test_flag(hdev, HCI_ADVERTISING) ||
2281 list_empty(&hdev->adv_instances)) {
2282 __hci_req_update_adv_data(req, 0x00);
2283 __hci_req_update_scan_rsp_data(req, 0x00);
2284
2285 if (hci_dev_test_flag(hdev, HCI_ADVERTISING))
2286 __hci_req_enable_advertising(req);
2287 } else if (!list_empty(&hdev->adv_instances)) {
2288 struct adv_info *adv_instance;
2289
2290 adv_instance = list_first_entry(&hdev->adv_instances,
2291 struct adv_info, list);
2292 __hci_req_schedule_adv_instance(req,
2293 adv_instance->instance,
2294 true);
2295 }
2296 }
2297
2298 link_sec = hci_dev_test_flag(hdev, HCI_LINK_SECURITY);
2299 if (link_sec != test_bit(HCI_AUTH, &hdev->flags))
2300 hci_req_add(req, HCI_OP_WRITE_AUTH_ENABLE,
2301 sizeof(link_sec), &link_sec);
2302
2303 if (lmp_bredr_capable(hdev)) {
2304 if (hci_dev_test_flag(hdev, HCI_FAST_CONNECTABLE))
2305 __hci_req_write_fast_connectable(req, true);
2306 else
2307 __hci_req_write_fast_connectable(req, false);
2308 __hci_req_update_scan(req);
2309 __hci_req_update_class(req);
2310 __hci_req_update_name(req);
2311 __hci_req_update_eir(req);
2312 }
2313
2314 hci_dev_unlock(hdev);
2315 return 0;
2316}
2317
2318int __hci_req_hci_power_on(struct hci_dev *hdev)
2319{
2320 /* Register the available SMP channels (BR/EDR and LE) only when
2321 * successfully powering on the controller. This late
2322 * registration is required so that LE SMP can clearly decide if
2323 * the public address or static address is used.
2324 */
2325 smp_register(hdev);
2326
2327 return __hci_req_sync(hdev, powered_update_hci, 0, HCI_CMD_TIMEOUT,
2328 NULL);
2329}
2330
2331void hci_request_setup(struct hci_dev *hdev)
2332{
2333 INIT_WORK(&hdev->discov_update, discov_update);
2334 INIT_WORK(&hdev->bg_scan_update, bg_scan_update);
2335 INIT_WORK(&hdev->scan_update, scan_update_work);
2336 INIT_WORK(&hdev->connectable_update, connectable_update_work);
2337 INIT_WORK(&hdev->discoverable_update, discoverable_update_work);
2338 INIT_DELAYED_WORK(&hdev->discov_off, discov_off);
2339 INIT_DELAYED_WORK(&hdev->le_scan_disable, le_scan_disable_work);
2340 INIT_DELAYED_WORK(&hdev->le_scan_restart, le_scan_restart_work);
2341 INIT_DELAYED_WORK(&hdev->adv_instance_expire, adv_timeout_expire);
2342}
2343
2344void hci_request_cancel_all(struct hci_dev *hdev)
2345{
2346 hci_req_sync_cancel(hdev, ENODEV);
2347
2348 cancel_work_sync(&hdev->discov_update);
2349 cancel_work_sync(&hdev->bg_scan_update);
2350 cancel_work_sync(&hdev->scan_update);
2351 cancel_work_sync(&hdev->connectable_update);
2352 cancel_work_sync(&hdev->discoverable_update);
2353 cancel_delayed_work_sync(&hdev->discov_off);
2354 cancel_delayed_work_sync(&hdev->le_scan_disable);
2355 cancel_delayed_work_sync(&hdev->le_scan_restart);
2356
2357 if (hdev->adv_instance_timeout) {
2358 cancel_delayed_work_sync(&hdev->adv_instance_expire);
2359 hdev->adv_instance_timeout = 0;
2360 }
2361}