Loading...
1/*
2 BlueZ - Bluetooth protocol stack for Linux
3
4 Copyright (C) 2014 Intel Corporation
5
6 This program is free software; you can redistribute it and/or modify
7 it under the terms of the GNU General Public License version 2 as
8 published by the Free Software Foundation;
9
10 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
11 OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
12 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
13 IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
14 CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
15 WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
16 ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
17 OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
18
19 ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
20 COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
21 SOFTWARE IS DISCLAIMED.
22*/
23
24#include <linux/sched/signal.h>
25
26#include <net/bluetooth/bluetooth.h>
27#include <net/bluetooth/hci_core.h>
28#include <net/bluetooth/mgmt.h>
29
30#include "smp.h"
31#include "hci_request.h"
32#include "msft.h"
33#include "eir.h"
34
35void hci_req_init(struct hci_request *req, struct hci_dev *hdev)
36{
37 skb_queue_head_init(&req->cmd_q);
38 req->hdev = hdev;
39 req->err = 0;
40}
41
42void hci_req_purge(struct hci_request *req)
43{
44 skb_queue_purge(&req->cmd_q);
45}
46
47bool hci_req_status_pend(struct hci_dev *hdev)
48{
49 return hdev->req_status == HCI_REQ_PEND;
50}
51
52static int req_run(struct hci_request *req, hci_req_complete_t complete,
53 hci_req_complete_skb_t complete_skb)
54{
55 struct hci_dev *hdev = req->hdev;
56 struct sk_buff *skb;
57 unsigned long flags;
58
59 bt_dev_dbg(hdev, "length %u", skb_queue_len(&req->cmd_q));
60
61 /* If an error occurred during request building, remove all HCI
62 * commands queued on the HCI request queue.
63 */
64 if (req->err) {
65 skb_queue_purge(&req->cmd_q);
66 return req->err;
67 }
68
69 /* Do not allow empty requests */
70 if (skb_queue_empty(&req->cmd_q))
71 return -ENODATA;
72
73 skb = skb_peek_tail(&req->cmd_q);
74 if (complete) {
75 bt_cb(skb)->hci.req_complete = complete;
76 } else if (complete_skb) {
77 bt_cb(skb)->hci.req_complete_skb = complete_skb;
78 bt_cb(skb)->hci.req_flags |= HCI_REQ_SKB;
79 }
80
81 spin_lock_irqsave(&hdev->cmd_q.lock, flags);
82 skb_queue_splice_tail(&req->cmd_q, &hdev->cmd_q);
83 spin_unlock_irqrestore(&hdev->cmd_q.lock, flags);
84
85 queue_work(hdev->workqueue, &hdev->cmd_work);
86
87 return 0;
88}
89
90int hci_req_run(struct hci_request *req, hci_req_complete_t complete)
91{
92 return req_run(req, complete, NULL);
93}
94
95int hci_req_run_skb(struct hci_request *req, hci_req_complete_skb_t complete)
96{
97 return req_run(req, NULL, complete);
98}
99
100void hci_req_sync_complete(struct hci_dev *hdev, u8 result, u16 opcode,
101 struct sk_buff *skb)
102{
103 bt_dev_dbg(hdev, "result 0x%2.2x", result);
104
105 if (hdev->req_status == HCI_REQ_PEND) {
106 hdev->req_result = result;
107 hdev->req_status = HCI_REQ_DONE;
108 if (skb)
109 hdev->req_skb = skb_get(skb);
110 wake_up_interruptible(&hdev->req_wait_q);
111 }
112}
113
114/* Execute request and wait for completion. */
115int __hci_req_sync(struct hci_dev *hdev, int (*func)(struct hci_request *req,
116 unsigned long opt),
117 unsigned long opt, u32 timeout, u8 *hci_status)
118{
119 struct hci_request req;
120 int err = 0;
121
122 bt_dev_dbg(hdev, "start");
123
124 hci_req_init(&req, hdev);
125
126 hdev->req_status = HCI_REQ_PEND;
127
128 err = func(&req, opt);
129 if (err) {
130 if (hci_status)
131 *hci_status = HCI_ERROR_UNSPECIFIED;
132 return err;
133 }
134
135 err = hci_req_run_skb(&req, hci_req_sync_complete);
136 if (err < 0) {
137 hdev->req_status = 0;
138
139 /* ENODATA means the HCI request command queue is empty.
140 * This can happen when a request with conditionals doesn't
141 * trigger any commands to be sent. This is normal behavior
142 * and should not trigger an error return.
143 */
144 if (err == -ENODATA) {
145 if (hci_status)
146 *hci_status = 0;
147 return 0;
148 }
149
150 if (hci_status)
151 *hci_status = HCI_ERROR_UNSPECIFIED;
152
153 return err;
154 }
155
156 err = wait_event_interruptible_timeout(hdev->req_wait_q,
157 hdev->req_status != HCI_REQ_PEND, timeout);
158
159 if (err == -ERESTARTSYS)
160 return -EINTR;
161
162 switch (hdev->req_status) {
163 case HCI_REQ_DONE:
164 err = -bt_to_errno(hdev->req_result);
165 if (hci_status)
166 *hci_status = hdev->req_result;
167 break;
168
169 case HCI_REQ_CANCELED:
170 err = -hdev->req_result;
171 if (hci_status)
172 *hci_status = HCI_ERROR_UNSPECIFIED;
173 break;
174
175 default:
176 err = -ETIMEDOUT;
177 if (hci_status)
178 *hci_status = HCI_ERROR_UNSPECIFIED;
179 break;
180 }
181
182 kfree_skb(hdev->req_skb);
183 hdev->req_skb = NULL;
184 hdev->req_status = hdev->req_result = 0;
185
186 bt_dev_dbg(hdev, "end: err %d", err);
187
188 return err;
189}
190
191int hci_req_sync(struct hci_dev *hdev, int (*req)(struct hci_request *req,
192 unsigned long opt),
193 unsigned long opt, u32 timeout, u8 *hci_status)
194{
195 int ret;
196
197 /* Serialize all requests */
198 hci_req_sync_lock(hdev);
199 /* check the state after obtaing the lock to protect the HCI_UP
200 * against any races from hci_dev_do_close when the controller
201 * gets removed.
202 */
203 if (test_bit(HCI_UP, &hdev->flags))
204 ret = __hci_req_sync(hdev, req, opt, timeout, hci_status);
205 else
206 ret = -ENETDOWN;
207 hci_req_sync_unlock(hdev);
208
209 return ret;
210}
211
212struct sk_buff *hci_prepare_cmd(struct hci_dev *hdev, u16 opcode, u32 plen,
213 const void *param)
214{
215 int len = HCI_COMMAND_HDR_SIZE + plen;
216 struct hci_command_hdr *hdr;
217 struct sk_buff *skb;
218
219 skb = bt_skb_alloc(len, GFP_ATOMIC);
220 if (!skb)
221 return NULL;
222
223 hdr = skb_put(skb, HCI_COMMAND_HDR_SIZE);
224 hdr->opcode = cpu_to_le16(opcode);
225 hdr->plen = plen;
226
227 if (plen)
228 skb_put_data(skb, param, plen);
229
230 bt_dev_dbg(hdev, "skb len %d", skb->len);
231
232 hci_skb_pkt_type(skb) = HCI_COMMAND_PKT;
233 hci_skb_opcode(skb) = opcode;
234
235 return skb;
236}
237
238/* Queue a command to an asynchronous HCI request */
239void hci_req_add_ev(struct hci_request *req, u16 opcode, u32 plen,
240 const void *param, u8 event)
241{
242 struct hci_dev *hdev = req->hdev;
243 struct sk_buff *skb;
244
245 bt_dev_dbg(hdev, "opcode 0x%4.4x plen %d", opcode, plen);
246
247 /* If an error occurred during request building, there is no point in
248 * queueing the HCI command. We can simply return.
249 */
250 if (req->err)
251 return;
252
253 skb = hci_prepare_cmd(hdev, opcode, plen, param);
254 if (!skb) {
255 bt_dev_err(hdev, "no memory for command (opcode 0x%4.4x)",
256 opcode);
257 req->err = -ENOMEM;
258 return;
259 }
260
261 if (skb_queue_empty(&req->cmd_q))
262 bt_cb(skb)->hci.req_flags |= HCI_REQ_START;
263
264 hci_skb_event(skb) = event;
265
266 skb_queue_tail(&req->cmd_q, skb);
267}
268
269void hci_req_add(struct hci_request *req, u16 opcode, u32 plen,
270 const void *param)
271{
272 bt_dev_dbg(req->hdev, "HCI_REQ-0x%4.4x", opcode);
273 hci_req_add_ev(req, opcode, plen, param, 0);
274}
275
276static void start_interleave_scan(struct hci_dev *hdev)
277{
278 hdev->interleave_scan_state = INTERLEAVE_SCAN_NO_FILTER;
279 queue_delayed_work(hdev->req_workqueue,
280 &hdev->interleave_scan, 0);
281}
282
283static bool is_interleave_scanning(struct hci_dev *hdev)
284{
285 return hdev->interleave_scan_state != INTERLEAVE_SCAN_NONE;
286}
287
288static void cancel_interleave_scan(struct hci_dev *hdev)
289{
290 bt_dev_dbg(hdev, "cancelling interleave scan");
291
292 cancel_delayed_work_sync(&hdev->interleave_scan);
293
294 hdev->interleave_scan_state = INTERLEAVE_SCAN_NONE;
295}
296
297/* Return true if interleave_scan wasn't started until exiting this function,
298 * otherwise, return false
299 */
300static bool __hci_update_interleaved_scan(struct hci_dev *hdev)
301{
302 /* Do interleaved scan only if all of the following are true:
303 * - There is at least one ADV monitor
304 * - At least one pending LE connection or one device to be scanned for
305 * - Monitor offloading is not supported
306 * If so, we should alternate between allowlist scan and one without
307 * any filters to save power.
308 */
309 bool use_interleaving = hci_is_adv_monitoring(hdev) &&
310 !(list_empty(&hdev->pend_le_conns) &&
311 list_empty(&hdev->pend_le_reports)) &&
312 hci_get_adv_monitor_offload_ext(hdev) ==
313 HCI_ADV_MONITOR_EXT_NONE;
314 bool is_interleaving = is_interleave_scanning(hdev);
315
316 if (use_interleaving && !is_interleaving) {
317 start_interleave_scan(hdev);
318 bt_dev_dbg(hdev, "starting interleave scan");
319 return true;
320 }
321
322 if (!use_interleaving && is_interleaving)
323 cancel_interleave_scan(hdev);
324
325 return false;
326}
327
328void hci_req_add_le_scan_disable(struct hci_request *req, bool rpa_le_conn)
329{
330 struct hci_dev *hdev = req->hdev;
331
332 if (hdev->scanning_paused) {
333 bt_dev_dbg(hdev, "Scanning is paused for suspend");
334 return;
335 }
336
337 if (use_ext_scan(hdev)) {
338 struct hci_cp_le_set_ext_scan_enable cp;
339
340 memset(&cp, 0, sizeof(cp));
341 cp.enable = LE_SCAN_DISABLE;
342 hci_req_add(req, HCI_OP_LE_SET_EXT_SCAN_ENABLE, sizeof(cp),
343 &cp);
344 } else {
345 struct hci_cp_le_set_scan_enable cp;
346
347 memset(&cp, 0, sizeof(cp));
348 cp.enable = LE_SCAN_DISABLE;
349 hci_req_add(req, HCI_OP_LE_SET_SCAN_ENABLE, sizeof(cp), &cp);
350 }
351
352 /* Disable address resolution */
353 if (hci_dev_test_flag(hdev, HCI_LL_RPA_RESOLUTION) && !rpa_le_conn) {
354 __u8 enable = 0x00;
355
356 hci_req_add(req, HCI_OP_LE_SET_ADDR_RESOLV_ENABLE, 1, &enable);
357 }
358}
359
360static void del_from_accept_list(struct hci_request *req, bdaddr_t *bdaddr,
361 u8 bdaddr_type)
362{
363 struct hci_cp_le_del_from_accept_list cp;
364
365 cp.bdaddr_type = bdaddr_type;
366 bacpy(&cp.bdaddr, bdaddr);
367
368 bt_dev_dbg(req->hdev, "Remove %pMR (0x%x) from accept list", &cp.bdaddr,
369 cp.bdaddr_type);
370 hci_req_add(req, HCI_OP_LE_DEL_FROM_ACCEPT_LIST, sizeof(cp), &cp);
371
372 if (use_ll_privacy(req->hdev)) {
373 struct smp_irk *irk;
374
375 irk = hci_find_irk_by_addr(req->hdev, bdaddr, bdaddr_type);
376 if (irk) {
377 struct hci_cp_le_del_from_resolv_list cp;
378
379 cp.bdaddr_type = bdaddr_type;
380 bacpy(&cp.bdaddr, bdaddr);
381
382 hci_req_add(req, HCI_OP_LE_DEL_FROM_RESOLV_LIST,
383 sizeof(cp), &cp);
384 }
385 }
386}
387
388/* Adds connection to accept list if needed. On error, returns -1. */
389static int add_to_accept_list(struct hci_request *req,
390 struct hci_conn_params *params, u8 *num_entries,
391 bool allow_rpa)
392{
393 struct hci_cp_le_add_to_accept_list cp;
394 struct hci_dev *hdev = req->hdev;
395
396 /* Already in accept list */
397 if (hci_bdaddr_list_lookup(&hdev->le_accept_list, ¶ms->addr,
398 params->addr_type))
399 return 0;
400
401 /* Select filter policy to accept all advertising */
402 if (*num_entries >= hdev->le_accept_list_size)
403 return -1;
404
405 /* Accept list can not be used with RPAs */
406 if (!allow_rpa &&
407 !hci_dev_test_flag(hdev, HCI_ENABLE_LL_PRIVACY) &&
408 hci_find_irk_by_addr(hdev, ¶ms->addr, params->addr_type)) {
409 return -1;
410 }
411
412 /* During suspend, only wakeable devices can be in accept list */
413 if (hdev->suspended &&
414 !(params->flags & HCI_CONN_FLAG_REMOTE_WAKEUP))
415 return 0;
416
417 *num_entries += 1;
418 cp.bdaddr_type = params->addr_type;
419 bacpy(&cp.bdaddr, ¶ms->addr);
420
421 bt_dev_dbg(hdev, "Add %pMR (0x%x) to accept list", &cp.bdaddr,
422 cp.bdaddr_type);
423 hci_req_add(req, HCI_OP_LE_ADD_TO_ACCEPT_LIST, sizeof(cp), &cp);
424
425 if (use_ll_privacy(hdev)) {
426 struct smp_irk *irk;
427
428 irk = hci_find_irk_by_addr(hdev, ¶ms->addr,
429 params->addr_type);
430 if (irk) {
431 struct hci_cp_le_add_to_resolv_list cp;
432
433 cp.bdaddr_type = params->addr_type;
434 bacpy(&cp.bdaddr, ¶ms->addr);
435 memcpy(cp.peer_irk, irk->val, 16);
436
437 if (hci_dev_test_flag(hdev, HCI_PRIVACY))
438 memcpy(cp.local_irk, hdev->irk, 16);
439 else
440 memset(cp.local_irk, 0, 16);
441
442 hci_req_add(req, HCI_OP_LE_ADD_TO_RESOLV_LIST,
443 sizeof(cp), &cp);
444 }
445 }
446
447 return 0;
448}
449
450static u8 update_accept_list(struct hci_request *req)
451{
452 struct hci_dev *hdev = req->hdev;
453 struct hci_conn_params *params;
454 struct bdaddr_list *b;
455 u8 num_entries = 0;
456 bool pend_conn, pend_report;
457 /* We allow usage of accept list even with RPAs in suspend. In the worst
458 * case, we won't be able to wake from devices that use the privacy1.2
459 * features. Additionally, once we support privacy1.2 and IRK
460 * offloading, we can update this to also check for those conditions.
461 */
462 bool allow_rpa = hdev->suspended;
463
464 if (use_ll_privacy(hdev))
465 allow_rpa = true;
466
467 /* Go through the current accept list programmed into the
468 * controller one by one and check if that address is still
469 * in the list of pending connections or list of devices to
470 * report. If not present in either list, then queue the
471 * command to remove it from the controller.
472 */
473 list_for_each_entry(b, &hdev->le_accept_list, list) {
474 pend_conn = hci_pend_le_action_lookup(&hdev->pend_le_conns,
475 &b->bdaddr,
476 b->bdaddr_type);
477 pend_report = hci_pend_le_action_lookup(&hdev->pend_le_reports,
478 &b->bdaddr,
479 b->bdaddr_type);
480
481 /* If the device is not likely to connect or report,
482 * remove it from the accept list.
483 */
484 if (!pend_conn && !pend_report) {
485 del_from_accept_list(req, &b->bdaddr, b->bdaddr_type);
486 continue;
487 }
488
489 /* Accept list can not be used with RPAs */
490 if (!allow_rpa &&
491 !hci_dev_test_flag(hdev, HCI_ENABLE_LL_PRIVACY) &&
492 hci_find_irk_by_addr(hdev, &b->bdaddr, b->bdaddr_type)) {
493 return 0x00;
494 }
495
496 num_entries++;
497 }
498
499 /* Since all no longer valid accept list entries have been
500 * removed, walk through the list of pending connections
501 * and ensure that any new device gets programmed into
502 * the controller.
503 *
504 * If the list of the devices is larger than the list of
505 * available accept list entries in the controller, then
506 * just abort and return filer policy value to not use the
507 * accept list.
508 */
509 list_for_each_entry(params, &hdev->pend_le_conns, action) {
510 if (add_to_accept_list(req, params, &num_entries, allow_rpa))
511 return 0x00;
512 }
513
514 /* After adding all new pending connections, walk through
515 * the list of pending reports and also add these to the
516 * accept list if there is still space. Abort if space runs out.
517 */
518 list_for_each_entry(params, &hdev->pend_le_reports, action) {
519 if (add_to_accept_list(req, params, &num_entries, allow_rpa))
520 return 0x00;
521 }
522
523 /* Use the allowlist unless the following conditions are all true:
524 * - We are not currently suspending
525 * - There are 1 or more ADV monitors registered and it's not offloaded
526 * - Interleaved scanning is not currently using the allowlist
527 */
528 if (!idr_is_empty(&hdev->adv_monitors_idr) && !hdev->suspended &&
529 hci_get_adv_monitor_offload_ext(hdev) == HCI_ADV_MONITOR_EXT_NONE &&
530 hdev->interleave_scan_state != INTERLEAVE_SCAN_ALLOWLIST)
531 return 0x00;
532
533 /* Select filter policy to use accept list */
534 return 0x01;
535}
536
537static bool scan_use_rpa(struct hci_dev *hdev)
538{
539 return hci_dev_test_flag(hdev, HCI_PRIVACY);
540}
541
542static void hci_req_start_scan(struct hci_request *req, u8 type, u16 interval,
543 u16 window, u8 own_addr_type, u8 filter_policy,
544 bool filter_dup, bool addr_resolv)
545{
546 struct hci_dev *hdev = req->hdev;
547
548 if (hdev->scanning_paused) {
549 bt_dev_dbg(hdev, "Scanning is paused for suspend");
550 return;
551 }
552
553 if (use_ll_privacy(hdev) && addr_resolv) {
554 u8 enable = 0x01;
555
556 hci_req_add(req, HCI_OP_LE_SET_ADDR_RESOLV_ENABLE, 1, &enable);
557 }
558
559 /* Use ext scanning if set ext scan param and ext scan enable is
560 * supported
561 */
562 if (use_ext_scan(hdev)) {
563 struct hci_cp_le_set_ext_scan_params *ext_param_cp;
564 struct hci_cp_le_set_ext_scan_enable ext_enable_cp;
565 struct hci_cp_le_scan_phy_params *phy_params;
566 u8 data[sizeof(*ext_param_cp) + sizeof(*phy_params) * 2];
567 u32 plen;
568
569 ext_param_cp = (void *)data;
570 phy_params = (void *)ext_param_cp->data;
571
572 memset(ext_param_cp, 0, sizeof(*ext_param_cp));
573 ext_param_cp->own_addr_type = own_addr_type;
574 ext_param_cp->filter_policy = filter_policy;
575
576 plen = sizeof(*ext_param_cp);
577
578 if (scan_1m(hdev) || scan_2m(hdev)) {
579 ext_param_cp->scanning_phys |= LE_SCAN_PHY_1M;
580
581 memset(phy_params, 0, sizeof(*phy_params));
582 phy_params->type = type;
583 phy_params->interval = cpu_to_le16(interval);
584 phy_params->window = cpu_to_le16(window);
585
586 plen += sizeof(*phy_params);
587 phy_params++;
588 }
589
590 if (scan_coded(hdev)) {
591 ext_param_cp->scanning_phys |= LE_SCAN_PHY_CODED;
592
593 memset(phy_params, 0, sizeof(*phy_params));
594 phy_params->type = type;
595 phy_params->interval = cpu_to_le16(interval);
596 phy_params->window = cpu_to_le16(window);
597
598 plen += sizeof(*phy_params);
599 phy_params++;
600 }
601
602 hci_req_add(req, HCI_OP_LE_SET_EXT_SCAN_PARAMS,
603 plen, ext_param_cp);
604
605 memset(&ext_enable_cp, 0, sizeof(ext_enable_cp));
606 ext_enable_cp.enable = LE_SCAN_ENABLE;
607 ext_enable_cp.filter_dup = filter_dup;
608
609 hci_req_add(req, HCI_OP_LE_SET_EXT_SCAN_ENABLE,
610 sizeof(ext_enable_cp), &ext_enable_cp);
611 } else {
612 struct hci_cp_le_set_scan_param param_cp;
613 struct hci_cp_le_set_scan_enable enable_cp;
614
615 memset(¶m_cp, 0, sizeof(param_cp));
616 param_cp.type = type;
617 param_cp.interval = cpu_to_le16(interval);
618 param_cp.window = cpu_to_le16(window);
619 param_cp.own_address_type = own_addr_type;
620 param_cp.filter_policy = filter_policy;
621 hci_req_add(req, HCI_OP_LE_SET_SCAN_PARAM, sizeof(param_cp),
622 ¶m_cp);
623
624 memset(&enable_cp, 0, sizeof(enable_cp));
625 enable_cp.enable = LE_SCAN_ENABLE;
626 enable_cp.filter_dup = filter_dup;
627 hci_req_add(req, HCI_OP_LE_SET_SCAN_ENABLE, sizeof(enable_cp),
628 &enable_cp);
629 }
630}
631
632static void set_random_addr(struct hci_request *req, bdaddr_t *rpa);
633static int hci_update_random_address(struct hci_request *req,
634 bool require_privacy, bool use_rpa,
635 u8 *own_addr_type)
636{
637 struct hci_dev *hdev = req->hdev;
638 int err;
639
640 /* If privacy is enabled use a resolvable private address. If
641 * current RPA has expired or there is something else than
642 * the current RPA in use, then generate a new one.
643 */
644 if (use_rpa) {
645 /* If Controller supports LL Privacy use own address type is
646 * 0x03
647 */
648 if (use_ll_privacy(hdev))
649 *own_addr_type = ADDR_LE_DEV_RANDOM_RESOLVED;
650 else
651 *own_addr_type = ADDR_LE_DEV_RANDOM;
652
653 if (rpa_valid(hdev))
654 return 0;
655
656 err = smp_generate_rpa(hdev, hdev->irk, &hdev->rpa);
657 if (err < 0) {
658 bt_dev_err(hdev, "failed to generate new RPA");
659 return err;
660 }
661
662 set_random_addr(req, &hdev->rpa);
663
664 return 0;
665 }
666
667 /* In case of required privacy without resolvable private address,
668 * use an non-resolvable private address. This is useful for active
669 * scanning and non-connectable advertising.
670 */
671 if (require_privacy) {
672 bdaddr_t nrpa;
673
674 while (true) {
675 /* The non-resolvable private address is generated
676 * from random six bytes with the two most significant
677 * bits cleared.
678 */
679 get_random_bytes(&nrpa, 6);
680 nrpa.b[5] &= 0x3f;
681
682 /* The non-resolvable private address shall not be
683 * equal to the public address.
684 */
685 if (bacmp(&hdev->bdaddr, &nrpa))
686 break;
687 }
688
689 *own_addr_type = ADDR_LE_DEV_RANDOM;
690 set_random_addr(req, &nrpa);
691 return 0;
692 }
693
694 /* If forcing static address is in use or there is no public
695 * address use the static address as random address (but skip
696 * the HCI command if the current random address is already the
697 * static one.
698 *
699 * In case BR/EDR has been disabled on a dual-mode controller
700 * and a static address has been configured, then use that
701 * address instead of the public BR/EDR address.
702 */
703 if (hci_dev_test_flag(hdev, HCI_FORCE_STATIC_ADDR) ||
704 !bacmp(&hdev->bdaddr, BDADDR_ANY) ||
705 (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) &&
706 bacmp(&hdev->static_addr, BDADDR_ANY))) {
707 *own_addr_type = ADDR_LE_DEV_RANDOM;
708 if (bacmp(&hdev->static_addr, &hdev->random_addr))
709 hci_req_add(req, HCI_OP_LE_SET_RANDOM_ADDR, 6,
710 &hdev->static_addr);
711 return 0;
712 }
713
714 /* Neither privacy nor static address is being used so use a
715 * public address.
716 */
717 *own_addr_type = ADDR_LE_DEV_PUBLIC;
718
719 return 0;
720}
721
722/* Ensure to call hci_req_add_le_scan_disable() first to disable the
723 * controller based address resolution to be able to reconfigure
724 * resolving list.
725 */
726void hci_req_add_le_passive_scan(struct hci_request *req)
727{
728 struct hci_dev *hdev = req->hdev;
729 u8 own_addr_type;
730 u8 filter_policy;
731 u16 window, interval;
732 /* Default is to enable duplicates filter */
733 u8 filter_dup = LE_SCAN_FILTER_DUP_ENABLE;
734 /* Background scanning should run with address resolution */
735 bool addr_resolv = true;
736
737 if (hdev->scanning_paused) {
738 bt_dev_dbg(hdev, "Scanning is paused for suspend");
739 return;
740 }
741
742 /* Set require_privacy to false since no SCAN_REQ are send
743 * during passive scanning. Not using an non-resolvable address
744 * here is important so that peer devices using direct
745 * advertising with our address will be correctly reported
746 * by the controller.
747 */
748 if (hci_update_random_address(req, false, scan_use_rpa(hdev),
749 &own_addr_type))
750 return;
751
752 if (hdev->enable_advmon_interleave_scan &&
753 __hci_update_interleaved_scan(hdev))
754 return;
755
756 bt_dev_dbg(hdev, "interleave state %d", hdev->interleave_scan_state);
757 /* Adding or removing entries from the accept list must
758 * happen before enabling scanning. The controller does
759 * not allow accept list modification while scanning.
760 */
761 filter_policy = update_accept_list(req);
762
763 /* When the controller is using random resolvable addresses and
764 * with that having LE privacy enabled, then controllers with
765 * Extended Scanner Filter Policies support can now enable support
766 * for handling directed advertising.
767 *
768 * So instead of using filter polices 0x00 (no accept list)
769 * and 0x01 (accept list enabled) use the new filter policies
770 * 0x02 (no accept list) and 0x03 (accept list enabled).
771 */
772 if (hci_dev_test_flag(hdev, HCI_PRIVACY) &&
773 (hdev->le_features[0] & HCI_LE_EXT_SCAN_POLICY))
774 filter_policy |= 0x02;
775
776 if (hdev->suspended) {
777 window = hdev->le_scan_window_suspend;
778 interval = hdev->le_scan_int_suspend;
779 } else if (hci_is_le_conn_scanning(hdev)) {
780 window = hdev->le_scan_window_connect;
781 interval = hdev->le_scan_int_connect;
782 } else if (hci_is_adv_monitoring(hdev)) {
783 window = hdev->le_scan_window_adv_monitor;
784 interval = hdev->le_scan_int_adv_monitor;
785
786 /* Disable duplicates filter when scanning for advertisement
787 * monitor for the following reasons.
788 *
789 * For HW pattern filtering (ex. MSFT), Realtek and Qualcomm
790 * controllers ignore RSSI_Sampling_Period when the duplicates
791 * filter is enabled.
792 *
793 * For SW pattern filtering, when we're not doing interleaved
794 * scanning, it is necessary to disable duplicates filter,
795 * otherwise hosts can only receive one advertisement and it's
796 * impossible to know if a peer is still in range.
797 */
798 filter_dup = LE_SCAN_FILTER_DUP_DISABLE;
799 } else {
800 window = hdev->le_scan_window;
801 interval = hdev->le_scan_interval;
802 }
803
804 bt_dev_dbg(hdev, "LE passive scan with accept list = %d",
805 filter_policy);
806 hci_req_start_scan(req, LE_SCAN_PASSIVE, interval, window,
807 own_addr_type, filter_policy, filter_dup,
808 addr_resolv);
809}
810
811static int hci_req_add_le_interleaved_scan(struct hci_request *req,
812 unsigned long opt)
813{
814 struct hci_dev *hdev = req->hdev;
815 int ret = 0;
816
817 hci_dev_lock(hdev);
818
819 if (hci_dev_test_flag(hdev, HCI_LE_SCAN))
820 hci_req_add_le_scan_disable(req, false);
821 hci_req_add_le_passive_scan(req);
822
823 switch (hdev->interleave_scan_state) {
824 case INTERLEAVE_SCAN_ALLOWLIST:
825 bt_dev_dbg(hdev, "next state: allowlist");
826 hdev->interleave_scan_state = INTERLEAVE_SCAN_NO_FILTER;
827 break;
828 case INTERLEAVE_SCAN_NO_FILTER:
829 bt_dev_dbg(hdev, "next state: no filter");
830 hdev->interleave_scan_state = INTERLEAVE_SCAN_ALLOWLIST;
831 break;
832 case INTERLEAVE_SCAN_NONE:
833 BT_ERR("unexpected error");
834 ret = -1;
835 }
836
837 hci_dev_unlock(hdev);
838
839 return ret;
840}
841
842static void interleave_scan_work(struct work_struct *work)
843{
844 struct hci_dev *hdev = container_of(work, struct hci_dev,
845 interleave_scan.work);
846 u8 status;
847 unsigned long timeout;
848
849 if (hdev->interleave_scan_state == INTERLEAVE_SCAN_ALLOWLIST) {
850 timeout = msecs_to_jiffies(hdev->advmon_allowlist_duration);
851 } else if (hdev->interleave_scan_state == INTERLEAVE_SCAN_NO_FILTER) {
852 timeout = msecs_to_jiffies(hdev->advmon_no_filter_duration);
853 } else {
854 bt_dev_err(hdev, "unexpected error");
855 return;
856 }
857
858 hci_req_sync(hdev, hci_req_add_le_interleaved_scan, 0,
859 HCI_CMD_TIMEOUT, &status);
860
861 /* Don't continue interleaving if it was canceled */
862 if (is_interleave_scanning(hdev))
863 queue_delayed_work(hdev->req_workqueue,
864 &hdev->interleave_scan, timeout);
865}
866
867static void set_random_addr(struct hci_request *req, bdaddr_t *rpa)
868{
869 struct hci_dev *hdev = req->hdev;
870
871 /* If we're advertising or initiating an LE connection we can't
872 * go ahead and change the random address at this time. This is
873 * because the eventual initiator address used for the
874 * subsequently created connection will be undefined (some
875 * controllers use the new address and others the one we had
876 * when the operation started).
877 *
878 * In this kind of scenario skip the update and let the random
879 * address be updated at the next cycle.
880 */
881 if (hci_dev_test_flag(hdev, HCI_LE_ADV) ||
882 hci_lookup_le_connect(hdev)) {
883 bt_dev_dbg(hdev, "Deferring random address update");
884 hci_dev_set_flag(hdev, HCI_RPA_EXPIRED);
885 return;
886 }
887
888 hci_req_add(req, HCI_OP_LE_SET_RANDOM_ADDR, 6, rpa);
889}
890
891void hci_request_setup(struct hci_dev *hdev)
892{
893 INIT_DELAYED_WORK(&hdev->interleave_scan, interleave_scan_work);
894}
895
896void hci_request_cancel_all(struct hci_dev *hdev)
897{
898 __hci_cmd_sync_cancel(hdev, ENODEV);
899
900 cancel_interleave_scan(hdev);
901}
1/*
2 BlueZ - Bluetooth protocol stack for Linux
3
4 Copyright (C) 2014 Intel Corporation
5
6 This program is free software; you can redistribute it and/or modify
7 it under the terms of the GNU General Public License version 2 as
8 published by the Free Software Foundation;
9
10 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
11 OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
12 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
13 IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
14 CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
15 WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
16 ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
17 OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
18
19 ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
20 COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
21 SOFTWARE IS DISCLAIMED.
22*/
23
24#include <asm/unaligned.h>
25
26#include <net/bluetooth/bluetooth.h>
27#include <net/bluetooth/hci_core.h>
28#include <net/bluetooth/mgmt.h>
29
30#include "smp.h"
31#include "hci_request.h"
32
33#define HCI_REQ_DONE 0
34#define HCI_REQ_PEND 1
35#define HCI_REQ_CANCELED 2
36
37void hci_req_init(struct hci_request *req, struct hci_dev *hdev)
38{
39 skb_queue_head_init(&req->cmd_q);
40 req->hdev = hdev;
41 req->err = 0;
42}
43
44static int req_run(struct hci_request *req, hci_req_complete_t complete,
45 hci_req_complete_skb_t complete_skb)
46{
47 struct hci_dev *hdev = req->hdev;
48 struct sk_buff *skb;
49 unsigned long flags;
50
51 BT_DBG("length %u", skb_queue_len(&req->cmd_q));
52
53 /* If an error occurred during request building, remove all HCI
54 * commands queued on the HCI request queue.
55 */
56 if (req->err) {
57 skb_queue_purge(&req->cmd_q);
58 return req->err;
59 }
60
61 /* Do not allow empty requests */
62 if (skb_queue_empty(&req->cmd_q))
63 return -ENODATA;
64
65 skb = skb_peek_tail(&req->cmd_q);
66 if (complete) {
67 bt_cb(skb)->hci.req_complete = complete;
68 } else if (complete_skb) {
69 bt_cb(skb)->hci.req_complete_skb = complete_skb;
70 bt_cb(skb)->hci.req_flags |= HCI_REQ_SKB;
71 }
72
73 spin_lock_irqsave(&hdev->cmd_q.lock, flags);
74 skb_queue_splice_tail(&req->cmd_q, &hdev->cmd_q);
75 spin_unlock_irqrestore(&hdev->cmd_q.lock, flags);
76
77 queue_work(hdev->workqueue, &hdev->cmd_work);
78
79 return 0;
80}
81
82int hci_req_run(struct hci_request *req, hci_req_complete_t complete)
83{
84 return req_run(req, complete, NULL);
85}
86
87int hci_req_run_skb(struct hci_request *req, hci_req_complete_skb_t complete)
88{
89 return req_run(req, NULL, complete);
90}
91
92static void hci_req_sync_complete(struct hci_dev *hdev, u8 result, u16 opcode,
93 struct sk_buff *skb)
94{
95 BT_DBG("%s result 0x%2.2x", hdev->name, result);
96
97 if (hdev->req_status == HCI_REQ_PEND) {
98 hdev->req_result = result;
99 hdev->req_status = HCI_REQ_DONE;
100 if (skb)
101 hdev->req_skb = skb_get(skb);
102 wake_up_interruptible(&hdev->req_wait_q);
103 }
104}
105
106void hci_req_sync_cancel(struct hci_dev *hdev, int err)
107{
108 BT_DBG("%s err 0x%2.2x", hdev->name, err);
109
110 if (hdev->req_status == HCI_REQ_PEND) {
111 hdev->req_result = err;
112 hdev->req_status = HCI_REQ_CANCELED;
113 wake_up_interruptible(&hdev->req_wait_q);
114 }
115}
116
117struct sk_buff *__hci_cmd_sync_ev(struct hci_dev *hdev, u16 opcode, u32 plen,
118 const void *param, u8 event, u32 timeout)
119{
120 DECLARE_WAITQUEUE(wait, current);
121 struct hci_request req;
122 struct sk_buff *skb;
123 int err = 0;
124
125 BT_DBG("%s", hdev->name);
126
127 hci_req_init(&req, hdev);
128
129 hci_req_add_ev(&req, opcode, plen, param, event);
130
131 hdev->req_status = HCI_REQ_PEND;
132
133 add_wait_queue(&hdev->req_wait_q, &wait);
134 set_current_state(TASK_INTERRUPTIBLE);
135
136 err = hci_req_run_skb(&req, hci_req_sync_complete);
137 if (err < 0) {
138 remove_wait_queue(&hdev->req_wait_q, &wait);
139 set_current_state(TASK_RUNNING);
140 return ERR_PTR(err);
141 }
142
143 schedule_timeout(timeout);
144
145 remove_wait_queue(&hdev->req_wait_q, &wait);
146
147 if (signal_pending(current))
148 return ERR_PTR(-EINTR);
149
150 switch (hdev->req_status) {
151 case HCI_REQ_DONE:
152 err = -bt_to_errno(hdev->req_result);
153 break;
154
155 case HCI_REQ_CANCELED:
156 err = -hdev->req_result;
157 break;
158
159 default:
160 err = -ETIMEDOUT;
161 break;
162 }
163
164 hdev->req_status = hdev->req_result = 0;
165 skb = hdev->req_skb;
166 hdev->req_skb = NULL;
167
168 BT_DBG("%s end: err %d", hdev->name, err);
169
170 if (err < 0) {
171 kfree_skb(skb);
172 return ERR_PTR(err);
173 }
174
175 if (!skb)
176 return ERR_PTR(-ENODATA);
177
178 return skb;
179}
180EXPORT_SYMBOL(__hci_cmd_sync_ev);
181
182struct sk_buff *__hci_cmd_sync(struct hci_dev *hdev, u16 opcode, u32 plen,
183 const void *param, u32 timeout)
184{
185 return __hci_cmd_sync_ev(hdev, opcode, plen, param, 0, timeout);
186}
187EXPORT_SYMBOL(__hci_cmd_sync);
188
189/* Execute request and wait for completion. */
190int __hci_req_sync(struct hci_dev *hdev, int (*func)(struct hci_request *req,
191 unsigned long opt),
192 unsigned long opt, u32 timeout, u8 *hci_status)
193{
194 struct hci_request req;
195 DECLARE_WAITQUEUE(wait, current);
196 int err = 0;
197
198 BT_DBG("%s start", hdev->name);
199
200 hci_req_init(&req, hdev);
201
202 hdev->req_status = HCI_REQ_PEND;
203
204 err = func(&req, opt);
205 if (err) {
206 if (hci_status)
207 *hci_status = HCI_ERROR_UNSPECIFIED;
208 return err;
209 }
210
211 add_wait_queue(&hdev->req_wait_q, &wait);
212 set_current_state(TASK_INTERRUPTIBLE);
213
214 err = hci_req_run_skb(&req, hci_req_sync_complete);
215 if (err < 0) {
216 hdev->req_status = 0;
217
218 remove_wait_queue(&hdev->req_wait_q, &wait);
219 set_current_state(TASK_RUNNING);
220
221 /* ENODATA means the HCI request command queue is empty.
222 * This can happen when a request with conditionals doesn't
223 * trigger any commands to be sent. This is normal behavior
224 * and should not trigger an error return.
225 */
226 if (err == -ENODATA) {
227 if (hci_status)
228 *hci_status = 0;
229 return 0;
230 }
231
232 if (hci_status)
233 *hci_status = HCI_ERROR_UNSPECIFIED;
234
235 return err;
236 }
237
238 schedule_timeout(timeout);
239
240 remove_wait_queue(&hdev->req_wait_q, &wait);
241
242 if (signal_pending(current))
243 return -EINTR;
244
245 switch (hdev->req_status) {
246 case HCI_REQ_DONE:
247 err = -bt_to_errno(hdev->req_result);
248 if (hci_status)
249 *hci_status = hdev->req_result;
250 break;
251
252 case HCI_REQ_CANCELED:
253 err = -hdev->req_result;
254 if (hci_status)
255 *hci_status = HCI_ERROR_UNSPECIFIED;
256 break;
257
258 default:
259 err = -ETIMEDOUT;
260 if (hci_status)
261 *hci_status = HCI_ERROR_UNSPECIFIED;
262 break;
263 }
264
265 hdev->req_status = hdev->req_result = 0;
266
267 BT_DBG("%s end: err %d", hdev->name, err);
268
269 return err;
270}
271
272int hci_req_sync(struct hci_dev *hdev, int (*req)(struct hci_request *req,
273 unsigned long opt),
274 unsigned long opt, u32 timeout, u8 *hci_status)
275{
276 int ret;
277
278 if (!test_bit(HCI_UP, &hdev->flags))
279 return -ENETDOWN;
280
281 /* Serialize all requests */
282 hci_req_sync_lock(hdev);
283 ret = __hci_req_sync(hdev, req, opt, timeout, hci_status);
284 hci_req_sync_unlock(hdev);
285
286 return ret;
287}
288
289struct sk_buff *hci_prepare_cmd(struct hci_dev *hdev, u16 opcode, u32 plen,
290 const void *param)
291{
292 int len = HCI_COMMAND_HDR_SIZE + plen;
293 struct hci_command_hdr *hdr;
294 struct sk_buff *skb;
295
296 skb = bt_skb_alloc(len, GFP_ATOMIC);
297 if (!skb)
298 return NULL;
299
300 hdr = (struct hci_command_hdr *) skb_put(skb, HCI_COMMAND_HDR_SIZE);
301 hdr->opcode = cpu_to_le16(opcode);
302 hdr->plen = plen;
303
304 if (plen)
305 memcpy(skb_put(skb, plen), param, plen);
306
307 BT_DBG("skb len %d", skb->len);
308
309 hci_skb_pkt_type(skb) = HCI_COMMAND_PKT;
310 hci_skb_opcode(skb) = opcode;
311
312 return skb;
313}
314
315/* Queue a command to an asynchronous HCI request */
316void hci_req_add_ev(struct hci_request *req, u16 opcode, u32 plen,
317 const void *param, u8 event)
318{
319 struct hci_dev *hdev = req->hdev;
320 struct sk_buff *skb;
321
322 BT_DBG("%s opcode 0x%4.4x plen %d", hdev->name, opcode, plen);
323
324 /* If an error occurred during request building, there is no point in
325 * queueing the HCI command. We can simply return.
326 */
327 if (req->err)
328 return;
329
330 skb = hci_prepare_cmd(hdev, opcode, plen, param);
331 if (!skb) {
332 BT_ERR("%s no memory for command (opcode 0x%4.4x)",
333 hdev->name, opcode);
334 req->err = -ENOMEM;
335 return;
336 }
337
338 if (skb_queue_empty(&req->cmd_q))
339 bt_cb(skb)->hci.req_flags |= HCI_REQ_START;
340
341 bt_cb(skb)->hci.req_event = event;
342
343 skb_queue_tail(&req->cmd_q, skb);
344}
345
346void hci_req_add(struct hci_request *req, u16 opcode, u32 plen,
347 const void *param)
348{
349 hci_req_add_ev(req, opcode, plen, param, 0);
350}
351
352void __hci_req_write_fast_connectable(struct hci_request *req, bool enable)
353{
354 struct hci_dev *hdev = req->hdev;
355 struct hci_cp_write_page_scan_activity acp;
356 u8 type;
357
358 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
359 return;
360
361 if (hdev->hci_ver < BLUETOOTH_VER_1_2)
362 return;
363
364 if (enable) {
365 type = PAGE_SCAN_TYPE_INTERLACED;
366
367 /* 160 msec page scan interval */
368 acp.interval = cpu_to_le16(0x0100);
369 } else {
370 type = PAGE_SCAN_TYPE_STANDARD; /* default */
371
372 /* default 1.28 sec page scan */
373 acp.interval = cpu_to_le16(0x0800);
374 }
375
376 acp.window = cpu_to_le16(0x0012);
377
378 if (__cpu_to_le16(hdev->page_scan_interval) != acp.interval ||
379 __cpu_to_le16(hdev->page_scan_window) != acp.window)
380 hci_req_add(req, HCI_OP_WRITE_PAGE_SCAN_ACTIVITY,
381 sizeof(acp), &acp);
382
383 if (hdev->page_scan_type != type)
384 hci_req_add(req, HCI_OP_WRITE_PAGE_SCAN_TYPE, 1, &type);
385}
386
387/* This function controls the background scanning based on hdev->pend_le_conns
388 * list. If there are pending LE connection we start the background scanning,
389 * otherwise we stop it.
390 *
391 * This function requires the caller holds hdev->lock.
392 */
393static void __hci_update_background_scan(struct hci_request *req)
394{
395 struct hci_dev *hdev = req->hdev;
396
397 if (!test_bit(HCI_UP, &hdev->flags) ||
398 test_bit(HCI_INIT, &hdev->flags) ||
399 hci_dev_test_flag(hdev, HCI_SETUP) ||
400 hci_dev_test_flag(hdev, HCI_CONFIG) ||
401 hci_dev_test_flag(hdev, HCI_AUTO_OFF) ||
402 hci_dev_test_flag(hdev, HCI_UNREGISTER))
403 return;
404
405 /* No point in doing scanning if LE support hasn't been enabled */
406 if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED))
407 return;
408
409 /* If discovery is active don't interfere with it */
410 if (hdev->discovery.state != DISCOVERY_STOPPED)
411 return;
412
413 /* Reset RSSI and UUID filters when starting background scanning
414 * since these filters are meant for service discovery only.
415 *
416 * The Start Discovery and Start Service Discovery operations
417 * ensure to set proper values for RSSI threshold and UUID
418 * filter list. So it is safe to just reset them here.
419 */
420 hci_discovery_filter_clear(hdev);
421
422 if (list_empty(&hdev->pend_le_conns) &&
423 list_empty(&hdev->pend_le_reports)) {
424 /* If there is no pending LE connections or devices
425 * to be scanned for, we should stop the background
426 * scanning.
427 */
428
429 /* If controller is not scanning we are done. */
430 if (!hci_dev_test_flag(hdev, HCI_LE_SCAN))
431 return;
432
433 hci_req_add_le_scan_disable(req);
434
435 BT_DBG("%s stopping background scanning", hdev->name);
436 } else {
437 /* If there is at least one pending LE connection, we should
438 * keep the background scan running.
439 */
440
441 /* If controller is connecting, we should not start scanning
442 * since some controllers are not able to scan and connect at
443 * the same time.
444 */
445 if (hci_lookup_le_connect(hdev))
446 return;
447
448 /* If controller is currently scanning, we stop it to ensure we
449 * don't miss any advertising (due to duplicates filter).
450 */
451 if (hci_dev_test_flag(hdev, HCI_LE_SCAN))
452 hci_req_add_le_scan_disable(req);
453
454 hci_req_add_le_passive_scan(req);
455
456 BT_DBG("%s starting background scanning", hdev->name);
457 }
458}
459
460void __hci_req_update_name(struct hci_request *req)
461{
462 struct hci_dev *hdev = req->hdev;
463 struct hci_cp_write_local_name cp;
464
465 memcpy(cp.name, hdev->dev_name, sizeof(cp.name));
466
467 hci_req_add(req, HCI_OP_WRITE_LOCAL_NAME, sizeof(cp), &cp);
468}
469
470#define PNP_INFO_SVCLASS_ID 0x1200
471
472static u8 *create_uuid16_list(struct hci_dev *hdev, u8 *data, ptrdiff_t len)
473{
474 u8 *ptr = data, *uuids_start = NULL;
475 struct bt_uuid *uuid;
476
477 if (len < 4)
478 return ptr;
479
480 list_for_each_entry(uuid, &hdev->uuids, list) {
481 u16 uuid16;
482
483 if (uuid->size != 16)
484 continue;
485
486 uuid16 = get_unaligned_le16(&uuid->uuid[12]);
487 if (uuid16 < 0x1100)
488 continue;
489
490 if (uuid16 == PNP_INFO_SVCLASS_ID)
491 continue;
492
493 if (!uuids_start) {
494 uuids_start = ptr;
495 uuids_start[0] = 1;
496 uuids_start[1] = EIR_UUID16_ALL;
497 ptr += 2;
498 }
499
500 /* Stop if not enough space to put next UUID */
501 if ((ptr - data) + sizeof(u16) > len) {
502 uuids_start[1] = EIR_UUID16_SOME;
503 break;
504 }
505
506 *ptr++ = (uuid16 & 0x00ff);
507 *ptr++ = (uuid16 & 0xff00) >> 8;
508 uuids_start[0] += sizeof(uuid16);
509 }
510
511 return ptr;
512}
513
514static u8 *create_uuid32_list(struct hci_dev *hdev, u8 *data, ptrdiff_t len)
515{
516 u8 *ptr = data, *uuids_start = NULL;
517 struct bt_uuid *uuid;
518
519 if (len < 6)
520 return ptr;
521
522 list_for_each_entry(uuid, &hdev->uuids, list) {
523 if (uuid->size != 32)
524 continue;
525
526 if (!uuids_start) {
527 uuids_start = ptr;
528 uuids_start[0] = 1;
529 uuids_start[1] = EIR_UUID32_ALL;
530 ptr += 2;
531 }
532
533 /* Stop if not enough space to put next UUID */
534 if ((ptr - data) + sizeof(u32) > len) {
535 uuids_start[1] = EIR_UUID32_SOME;
536 break;
537 }
538
539 memcpy(ptr, &uuid->uuid[12], sizeof(u32));
540 ptr += sizeof(u32);
541 uuids_start[0] += sizeof(u32);
542 }
543
544 return ptr;
545}
546
547static u8 *create_uuid128_list(struct hci_dev *hdev, u8 *data, ptrdiff_t len)
548{
549 u8 *ptr = data, *uuids_start = NULL;
550 struct bt_uuid *uuid;
551
552 if (len < 18)
553 return ptr;
554
555 list_for_each_entry(uuid, &hdev->uuids, list) {
556 if (uuid->size != 128)
557 continue;
558
559 if (!uuids_start) {
560 uuids_start = ptr;
561 uuids_start[0] = 1;
562 uuids_start[1] = EIR_UUID128_ALL;
563 ptr += 2;
564 }
565
566 /* Stop if not enough space to put next UUID */
567 if ((ptr - data) + 16 > len) {
568 uuids_start[1] = EIR_UUID128_SOME;
569 break;
570 }
571
572 memcpy(ptr, uuid->uuid, 16);
573 ptr += 16;
574 uuids_start[0] += 16;
575 }
576
577 return ptr;
578}
579
580static void create_eir(struct hci_dev *hdev, u8 *data)
581{
582 u8 *ptr = data;
583 size_t name_len;
584
585 name_len = strlen(hdev->dev_name);
586
587 if (name_len > 0) {
588 /* EIR Data type */
589 if (name_len > 48) {
590 name_len = 48;
591 ptr[1] = EIR_NAME_SHORT;
592 } else
593 ptr[1] = EIR_NAME_COMPLETE;
594
595 /* EIR Data length */
596 ptr[0] = name_len + 1;
597
598 memcpy(ptr + 2, hdev->dev_name, name_len);
599
600 ptr += (name_len + 2);
601 }
602
603 if (hdev->inq_tx_power != HCI_TX_POWER_INVALID) {
604 ptr[0] = 2;
605 ptr[1] = EIR_TX_POWER;
606 ptr[2] = (u8) hdev->inq_tx_power;
607
608 ptr += 3;
609 }
610
611 if (hdev->devid_source > 0) {
612 ptr[0] = 9;
613 ptr[1] = EIR_DEVICE_ID;
614
615 put_unaligned_le16(hdev->devid_source, ptr + 2);
616 put_unaligned_le16(hdev->devid_vendor, ptr + 4);
617 put_unaligned_le16(hdev->devid_product, ptr + 6);
618 put_unaligned_le16(hdev->devid_version, ptr + 8);
619
620 ptr += 10;
621 }
622
623 ptr = create_uuid16_list(hdev, ptr, HCI_MAX_EIR_LENGTH - (ptr - data));
624 ptr = create_uuid32_list(hdev, ptr, HCI_MAX_EIR_LENGTH - (ptr - data));
625 ptr = create_uuid128_list(hdev, ptr, HCI_MAX_EIR_LENGTH - (ptr - data));
626}
627
628void __hci_req_update_eir(struct hci_request *req)
629{
630 struct hci_dev *hdev = req->hdev;
631 struct hci_cp_write_eir cp;
632
633 if (!hdev_is_powered(hdev))
634 return;
635
636 if (!lmp_ext_inq_capable(hdev))
637 return;
638
639 if (!hci_dev_test_flag(hdev, HCI_SSP_ENABLED))
640 return;
641
642 if (hci_dev_test_flag(hdev, HCI_SERVICE_CACHE))
643 return;
644
645 memset(&cp, 0, sizeof(cp));
646
647 create_eir(hdev, cp.data);
648
649 if (memcmp(cp.data, hdev->eir, sizeof(cp.data)) == 0)
650 return;
651
652 memcpy(hdev->eir, cp.data, sizeof(cp.data));
653
654 hci_req_add(req, HCI_OP_WRITE_EIR, sizeof(cp), &cp);
655}
656
657void hci_req_add_le_scan_disable(struct hci_request *req)
658{
659 struct hci_cp_le_set_scan_enable cp;
660
661 memset(&cp, 0, sizeof(cp));
662 cp.enable = LE_SCAN_DISABLE;
663 hci_req_add(req, HCI_OP_LE_SET_SCAN_ENABLE, sizeof(cp), &cp);
664}
665
666static void add_to_white_list(struct hci_request *req,
667 struct hci_conn_params *params)
668{
669 struct hci_cp_le_add_to_white_list cp;
670
671 cp.bdaddr_type = params->addr_type;
672 bacpy(&cp.bdaddr, ¶ms->addr);
673
674 hci_req_add(req, HCI_OP_LE_ADD_TO_WHITE_LIST, sizeof(cp), &cp);
675}
676
677static u8 update_white_list(struct hci_request *req)
678{
679 struct hci_dev *hdev = req->hdev;
680 struct hci_conn_params *params;
681 struct bdaddr_list *b;
682 uint8_t white_list_entries = 0;
683
684 /* Go through the current white list programmed into the
685 * controller one by one and check if that address is still
686 * in the list of pending connections or list of devices to
687 * report. If not present in either list, then queue the
688 * command to remove it from the controller.
689 */
690 list_for_each_entry(b, &hdev->le_white_list, list) {
691 /* If the device is neither in pend_le_conns nor
692 * pend_le_reports then remove it from the whitelist.
693 */
694 if (!hci_pend_le_action_lookup(&hdev->pend_le_conns,
695 &b->bdaddr, b->bdaddr_type) &&
696 !hci_pend_le_action_lookup(&hdev->pend_le_reports,
697 &b->bdaddr, b->bdaddr_type)) {
698 struct hci_cp_le_del_from_white_list cp;
699
700 cp.bdaddr_type = b->bdaddr_type;
701 bacpy(&cp.bdaddr, &b->bdaddr);
702
703 hci_req_add(req, HCI_OP_LE_DEL_FROM_WHITE_LIST,
704 sizeof(cp), &cp);
705 continue;
706 }
707
708 if (hci_find_irk_by_addr(hdev, &b->bdaddr, b->bdaddr_type)) {
709 /* White list can not be used with RPAs */
710 return 0x00;
711 }
712
713 white_list_entries++;
714 }
715
716 /* Since all no longer valid white list entries have been
717 * removed, walk through the list of pending connections
718 * and ensure that any new device gets programmed into
719 * the controller.
720 *
721 * If the list of the devices is larger than the list of
722 * available white list entries in the controller, then
723 * just abort and return filer policy value to not use the
724 * white list.
725 */
726 list_for_each_entry(params, &hdev->pend_le_conns, action) {
727 if (hci_bdaddr_list_lookup(&hdev->le_white_list,
728 ¶ms->addr, params->addr_type))
729 continue;
730
731 if (white_list_entries >= hdev->le_white_list_size) {
732 /* Select filter policy to accept all advertising */
733 return 0x00;
734 }
735
736 if (hci_find_irk_by_addr(hdev, ¶ms->addr,
737 params->addr_type)) {
738 /* White list can not be used with RPAs */
739 return 0x00;
740 }
741
742 white_list_entries++;
743 add_to_white_list(req, params);
744 }
745
746 /* After adding all new pending connections, walk through
747 * the list of pending reports and also add these to the
748 * white list if there is still space.
749 */
750 list_for_each_entry(params, &hdev->pend_le_reports, action) {
751 if (hci_bdaddr_list_lookup(&hdev->le_white_list,
752 ¶ms->addr, params->addr_type))
753 continue;
754
755 if (white_list_entries >= hdev->le_white_list_size) {
756 /* Select filter policy to accept all advertising */
757 return 0x00;
758 }
759
760 if (hci_find_irk_by_addr(hdev, ¶ms->addr,
761 params->addr_type)) {
762 /* White list can not be used with RPAs */
763 return 0x00;
764 }
765
766 white_list_entries++;
767 add_to_white_list(req, params);
768 }
769
770 /* Select filter policy to use white list */
771 return 0x01;
772}
773
774static bool scan_use_rpa(struct hci_dev *hdev)
775{
776 return hci_dev_test_flag(hdev, HCI_PRIVACY);
777}
778
779void hci_req_add_le_passive_scan(struct hci_request *req)
780{
781 struct hci_cp_le_set_scan_param param_cp;
782 struct hci_cp_le_set_scan_enable enable_cp;
783 struct hci_dev *hdev = req->hdev;
784 u8 own_addr_type;
785 u8 filter_policy;
786
787 /* Set require_privacy to false since no SCAN_REQ are send
788 * during passive scanning. Not using an non-resolvable address
789 * here is important so that peer devices using direct
790 * advertising with our address will be correctly reported
791 * by the controller.
792 */
793 if (hci_update_random_address(req, false, scan_use_rpa(hdev),
794 &own_addr_type))
795 return;
796
797 /* Adding or removing entries from the white list must
798 * happen before enabling scanning. The controller does
799 * not allow white list modification while scanning.
800 */
801 filter_policy = update_white_list(req);
802
803 /* When the controller is using random resolvable addresses and
804 * with that having LE privacy enabled, then controllers with
805 * Extended Scanner Filter Policies support can now enable support
806 * for handling directed advertising.
807 *
808 * So instead of using filter polices 0x00 (no whitelist)
809 * and 0x01 (whitelist enabled) use the new filter policies
810 * 0x02 (no whitelist) and 0x03 (whitelist enabled).
811 */
812 if (hci_dev_test_flag(hdev, HCI_PRIVACY) &&
813 (hdev->le_features[0] & HCI_LE_EXT_SCAN_POLICY))
814 filter_policy |= 0x02;
815
816 memset(¶m_cp, 0, sizeof(param_cp));
817 param_cp.type = LE_SCAN_PASSIVE;
818 param_cp.interval = cpu_to_le16(hdev->le_scan_interval);
819 param_cp.window = cpu_to_le16(hdev->le_scan_window);
820 param_cp.own_address_type = own_addr_type;
821 param_cp.filter_policy = filter_policy;
822 hci_req_add(req, HCI_OP_LE_SET_SCAN_PARAM, sizeof(param_cp),
823 ¶m_cp);
824
825 memset(&enable_cp, 0, sizeof(enable_cp));
826 enable_cp.enable = LE_SCAN_ENABLE;
827 enable_cp.filter_dup = LE_SCAN_FILTER_DUP_ENABLE;
828 hci_req_add(req, HCI_OP_LE_SET_SCAN_ENABLE, sizeof(enable_cp),
829 &enable_cp);
830}
831
832static u8 get_cur_adv_instance_scan_rsp_len(struct hci_dev *hdev)
833{
834 u8 instance = hdev->cur_adv_instance;
835 struct adv_info *adv_instance;
836
837 /* Ignore instance 0 */
838 if (instance == 0x00)
839 return 0;
840
841 adv_instance = hci_find_adv_instance(hdev, instance);
842 if (!adv_instance)
843 return 0;
844
845 /* TODO: Take into account the "appearance" and "local-name" flags here.
846 * These are currently being ignored as they are not supported.
847 */
848 return adv_instance->scan_rsp_len;
849}
850
851void __hci_req_disable_advertising(struct hci_request *req)
852{
853 u8 enable = 0x00;
854
855 hci_req_add(req, HCI_OP_LE_SET_ADV_ENABLE, sizeof(enable), &enable);
856}
857
858static u32 get_adv_instance_flags(struct hci_dev *hdev, u8 instance)
859{
860 u32 flags;
861 struct adv_info *adv_instance;
862
863 if (instance == 0x00) {
864 /* Instance 0 always manages the "Tx Power" and "Flags"
865 * fields
866 */
867 flags = MGMT_ADV_FLAG_TX_POWER | MGMT_ADV_FLAG_MANAGED_FLAGS;
868
869 /* For instance 0, the HCI_ADVERTISING_CONNECTABLE setting
870 * corresponds to the "connectable" instance flag.
871 */
872 if (hci_dev_test_flag(hdev, HCI_ADVERTISING_CONNECTABLE))
873 flags |= MGMT_ADV_FLAG_CONNECTABLE;
874
875 if (hci_dev_test_flag(hdev, HCI_LIMITED_DISCOVERABLE))
876 flags |= MGMT_ADV_FLAG_LIMITED_DISCOV;
877 else if (hci_dev_test_flag(hdev, HCI_DISCOVERABLE))
878 flags |= MGMT_ADV_FLAG_DISCOV;
879
880 return flags;
881 }
882
883 adv_instance = hci_find_adv_instance(hdev, instance);
884
885 /* Return 0 when we got an invalid instance identifier. */
886 if (!adv_instance)
887 return 0;
888
889 return adv_instance->flags;
890}
891
892static bool adv_use_rpa(struct hci_dev *hdev, uint32_t flags)
893{
894 /* If privacy is not enabled don't use RPA */
895 if (!hci_dev_test_flag(hdev, HCI_PRIVACY))
896 return false;
897
898 /* If basic privacy mode is enabled use RPA */
899 if (!hci_dev_test_flag(hdev, HCI_LIMITED_PRIVACY))
900 return true;
901
902 /* If limited privacy mode is enabled don't use RPA if we're
903 * both discoverable and bondable.
904 */
905 if ((flags & MGMT_ADV_FLAG_DISCOV) &&
906 hci_dev_test_flag(hdev, HCI_BONDABLE))
907 return false;
908
909 /* We're neither bondable nor discoverable in the limited
910 * privacy mode, therefore use RPA.
911 */
912 return true;
913}
914
915void __hci_req_enable_advertising(struct hci_request *req)
916{
917 struct hci_dev *hdev = req->hdev;
918 struct hci_cp_le_set_adv_param cp;
919 u8 own_addr_type, enable = 0x01;
920 bool connectable;
921 u32 flags;
922
923 if (hci_conn_num(hdev, LE_LINK) > 0)
924 return;
925
926 if (hci_dev_test_flag(hdev, HCI_LE_ADV))
927 __hci_req_disable_advertising(req);
928
929 /* Clear the HCI_LE_ADV bit temporarily so that the
930 * hci_update_random_address knows that it's safe to go ahead
931 * and write a new random address. The flag will be set back on
932 * as soon as the SET_ADV_ENABLE HCI command completes.
933 */
934 hci_dev_clear_flag(hdev, HCI_LE_ADV);
935
936 flags = get_adv_instance_flags(hdev, hdev->cur_adv_instance);
937
938 /* If the "connectable" instance flag was not set, then choose between
939 * ADV_IND and ADV_NONCONN_IND based on the global connectable setting.
940 */
941 connectable = (flags & MGMT_ADV_FLAG_CONNECTABLE) ||
942 mgmt_get_connectable(hdev);
943
944 /* Set require_privacy to true only when non-connectable
945 * advertising is used. In that case it is fine to use a
946 * non-resolvable private address.
947 */
948 if (hci_update_random_address(req, !connectable,
949 adv_use_rpa(hdev, flags),
950 &own_addr_type) < 0)
951 return;
952
953 memset(&cp, 0, sizeof(cp));
954 cp.min_interval = cpu_to_le16(hdev->le_adv_min_interval);
955 cp.max_interval = cpu_to_le16(hdev->le_adv_max_interval);
956
957 if (connectable)
958 cp.type = LE_ADV_IND;
959 else if (get_cur_adv_instance_scan_rsp_len(hdev))
960 cp.type = LE_ADV_SCAN_IND;
961 else
962 cp.type = LE_ADV_NONCONN_IND;
963
964 cp.own_address_type = own_addr_type;
965 cp.channel_map = hdev->le_adv_channel_map;
966
967 hci_req_add(req, HCI_OP_LE_SET_ADV_PARAM, sizeof(cp), &cp);
968
969 hci_req_add(req, HCI_OP_LE_SET_ADV_ENABLE, sizeof(enable), &enable);
970}
971
972static u8 create_default_scan_rsp_data(struct hci_dev *hdev, u8 *ptr)
973{
974 u8 ad_len = 0;
975 size_t name_len;
976
977 name_len = strlen(hdev->dev_name);
978 if (name_len > 0) {
979 size_t max_len = HCI_MAX_AD_LENGTH - ad_len - 2;
980
981 if (name_len > max_len) {
982 name_len = max_len;
983 ptr[1] = EIR_NAME_SHORT;
984 } else
985 ptr[1] = EIR_NAME_COMPLETE;
986
987 ptr[0] = name_len + 1;
988
989 memcpy(ptr + 2, hdev->dev_name, name_len);
990
991 ad_len += (name_len + 2);
992 ptr += (name_len + 2);
993 }
994
995 return ad_len;
996}
997
998static u8 create_instance_scan_rsp_data(struct hci_dev *hdev, u8 instance,
999 u8 *ptr)
1000{
1001 struct adv_info *adv_instance;
1002
1003 adv_instance = hci_find_adv_instance(hdev, instance);
1004 if (!adv_instance)
1005 return 0;
1006
1007 /* TODO: Set the appropriate entries based on advertising instance flags
1008 * here once flags other than 0 are supported.
1009 */
1010 memcpy(ptr, adv_instance->scan_rsp_data,
1011 adv_instance->scan_rsp_len);
1012
1013 return adv_instance->scan_rsp_len;
1014}
1015
1016void __hci_req_update_scan_rsp_data(struct hci_request *req, u8 instance)
1017{
1018 struct hci_dev *hdev = req->hdev;
1019 struct hci_cp_le_set_scan_rsp_data cp;
1020 u8 len;
1021
1022 if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED))
1023 return;
1024
1025 memset(&cp, 0, sizeof(cp));
1026
1027 if (instance)
1028 len = create_instance_scan_rsp_data(hdev, instance, cp.data);
1029 else
1030 len = create_default_scan_rsp_data(hdev, cp.data);
1031
1032 if (hdev->scan_rsp_data_len == len &&
1033 !memcmp(cp.data, hdev->scan_rsp_data, len))
1034 return;
1035
1036 memcpy(hdev->scan_rsp_data, cp.data, sizeof(cp.data));
1037 hdev->scan_rsp_data_len = len;
1038
1039 cp.length = len;
1040
1041 hci_req_add(req, HCI_OP_LE_SET_SCAN_RSP_DATA, sizeof(cp), &cp);
1042}
1043
1044static u8 create_instance_adv_data(struct hci_dev *hdev, u8 instance, u8 *ptr)
1045{
1046 struct adv_info *adv_instance = NULL;
1047 u8 ad_len = 0, flags = 0;
1048 u32 instance_flags;
1049
1050 /* Return 0 when the current instance identifier is invalid. */
1051 if (instance) {
1052 adv_instance = hci_find_adv_instance(hdev, instance);
1053 if (!adv_instance)
1054 return 0;
1055 }
1056
1057 instance_flags = get_adv_instance_flags(hdev, instance);
1058
1059 /* The Add Advertising command allows userspace to set both the general
1060 * and limited discoverable flags.
1061 */
1062 if (instance_flags & MGMT_ADV_FLAG_DISCOV)
1063 flags |= LE_AD_GENERAL;
1064
1065 if (instance_flags & MGMT_ADV_FLAG_LIMITED_DISCOV)
1066 flags |= LE_AD_LIMITED;
1067
1068 if (flags || (instance_flags & MGMT_ADV_FLAG_MANAGED_FLAGS)) {
1069 /* If a discovery flag wasn't provided, simply use the global
1070 * settings.
1071 */
1072 if (!flags)
1073 flags |= mgmt_get_adv_discov_flags(hdev);
1074
1075 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
1076 flags |= LE_AD_NO_BREDR;
1077
1078 /* If flags would still be empty, then there is no need to
1079 * include the "Flags" AD field".
1080 */
1081 if (flags) {
1082 ptr[0] = 0x02;
1083 ptr[1] = EIR_FLAGS;
1084 ptr[2] = flags;
1085
1086 ad_len += 3;
1087 ptr += 3;
1088 }
1089 }
1090
1091 if (adv_instance) {
1092 memcpy(ptr, adv_instance->adv_data,
1093 adv_instance->adv_data_len);
1094 ad_len += adv_instance->adv_data_len;
1095 ptr += adv_instance->adv_data_len;
1096 }
1097
1098 /* Provide Tx Power only if we can provide a valid value for it */
1099 if (hdev->adv_tx_power != HCI_TX_POWER_INVALID &&
1100 (instance_flags & MGMT_ADV_FLAG_TX_POWER)) {
1101 ptr[0] = 0x02;
1102 ptr[1] = EIR_TX_POWER;
1103 ptr[2] = (u8)hdev->adv_tx_power;
1104
1105 ad_len += 3;
1106 ptr += 3;
1107 }
1108
1109 return ad_len;
1110}
1111
1112void __hci_req_update_adv_data(struct hci_request *req, u8 instance)
1113{
1114 struct hci_dev *hdev = req->hdev;
1115 struct hci_cp_le_set_adv_data cp;
1116 u8 len;
1117
1118 if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED))
1119 return;
1120
1121 memset(&cp, 0, sizeof(cp));
1122
1123 len = create_instance_adv_data(hdev, instance, cp.data);
1124
1125 /* There's nothing to do if the data hasn't changed */
1126 if (hdev->adv_data_len == len &&
1127 memcmp(cp.data, hdev->adv_data, len) == 0)
1128 return;
1129
1130 memcpy(hdev->adv_data, cp.data, sizeof(cp.data));
1131 hdev->adv_data_len = len;
1132
1133 cp.length = len;
1134
1135 hci_req_add(req, HCI_OP_LE_SET_ADV_DATA, sizeof(cp), &cp);
1136}
1137
1138int hci_req_update_adv_data(struct hci_dev *hdev, u8 instance)
1139{
1140 struct hci_request req;
1141
1142 hci_req_init(&req, hdev);
1143 __hci_req_update_adv_data(&req, instance);
1144
1145 return hci_req_run(&req, NULL);
1146}
1147
1148static void adv_enable_complete(struct hci_dev *hdev, u8 status, u16 opcode)
1149{
1150 BT_DBG("%s status %u", hdev->name, status);
1151}
1152
1153void hci_req_reenable_advertising(struct hci_dev *hdev)
1154{
1155 struct hci_request req;
1156
1157 if (!hci_dev_test_flag(hdev, HCI_ADVERTISING) &&
1158 list_empty(&hdev->adv_instances))
1159 return;
1160
1161 hci_req_init(&req, hdev);
1162
1163 if (hdev->cur_adv_instance) {
1164 __hci_req_schedule_adv_instance(&req, hdev->cur_adv_instance,
1165 true);
1166 } else {
1167 __hci_req_update_adv_data(&req, 0x00);
1168 __hci_req_update_scan_rsp_data(&req, 0x00);
1169 __hci_req_enable_advertising(&req);
1170 }
1171
1172 hci_req_run(&req, adv_enable_complete);
1173}
1174
1175static void adv_timeout_expire(struct work_struct *work)
1176{
1177 struct hci_dev *hdev = container_of(work, struct hci_dev,
1178 adv_instance_expire.work);
1179
1180 struct hci_request req;
1181 u8 instance;
1182
1183 BT_DBG("%s", hdev->name);
1184
1185 hci_dev_lock(hdev);
1186
1187 hdev->adv_instance_timeout = 0;
1188
1189 instance = hdev->cur_adv_instance;
1190 if (instance == 0x00)
1191 goto unlock;
1192
1193 hci_req_init(&req, hdev);
1194
1195 hci_req_clear_adv_instance(hdev, &req, instance, false);
1196
1197 if (list_empty(&hdev->adv_instances))
1198 __hci_req_disable_advertising(&req);
1199
1200 hci_req_run(&req, NULL);
1201
1202unlock:
1203 hci_dev_unlock(hdev);
1204}
1205
1206int __hci_req_schedule_adv_instance(struct hci_request *req, u8 instance,
1207 bool force)
1208{
1209 struct hci_dev *hdev = req->hdev;
1210 struct adv_info *adv_instance = NULL;
1211 u16 timeout;
1212
1213 if (hci_dev_test_flag(hdev, HCI_ADVERTISING) ||
1214 list_empty(&hdev->adv_instances))
1215 return -EPERM;
1216
1217 if (hdev->adv_instance_timeout)
1218 return -EBUSY;
1219
1220 adv_instance = hci_find_adv_instance(hdev, instance);
1221 if (!adv_instance)
1222 return -ENOENT;
1223
1224 /* A zero timeout means unlimited advertising. As long as there is
1225 * only one instance, duration should be ignored. We still set a timeout
1226 * in case further instances are being added later on.
1227 *
1228 * If the remaining lifetime of the instance is more than the duration
1229 * then the timeout corresponds to the duration, otherwise it will be
1230 * reduced to the remaining instance lifetime.
1231 */
1232 if (adv_instance->timeout == 0 ||
1233 adv_instance->duration <= adv_instance->remaining_time)
1234 timeout = adv_instance->duration;
1235 else
1236 timeout = adv_instance->remaining_time;
1237
1238 /* The remaining time is being reduced unless the instance is being
1239 * advertised without time limit.
1240 */
1241 if (adv_instance->timeout)
1242 adv_instance->remaining_time =
1243 adv_instance->remaining_time - timeout;
1244
1245 hdev->adv_instance_timeout = timeout;
1246 queue_delayed_work(hdev->req_workqueue,
1247 &hdev->adv_instance_expire,
1248 msecs_to_jiffies(timeout * 1000));
1249
1250 /* If we're just re-scheduling the same instance again then do not
1251 * execute any HCI commands. This happens when a single instance is
1252 * being advertised.
1253 */
1254 if (!force && hdev->cur_adv_instance == instance &&
1255 hci_dev_test_flag(hdev, HCI_LE_ADV))
1256 return 0;
1257
1258 hdev->cur_adv_instance = instance;
1259 __hci_req_update_adv_data(req, instance);
1260 __hci_req_update_scan_rsp_data(req, instance);
1261 __hci_req_enable_advertising(req);
1262
1263 return 0;
1264}
1265
1266static void cancel_adv_timeout(struct hci_dev *hdev)
1267{
1268 if (hdev->adv_instance_timeout) {
1269 hdev->adv_instance_timeout = 0;
1270 cancel_delayed_work(&hdev->adv_instance_expire);
1271 }
1272}
1273
1274/* For a single instance:
1275 * - force == true: The instance will be removed even when its remaining
1276 * lifetime is not zero.
1277 * - force == false: the instance will be deactivated but kept stored unless
1278 * the remaining lifetime is zero.
1279 *
1280 * For instance == 0x00:
1281 * - force == true: All instances will be removed regardless of their timeout
1282 * setting.
1283 * - force == false: Only instances that have a timeout will be removed.
1284 */
1285void hci_req_clear_adv_instance(struct hci_dev *hdev, struct hci_request *req,
1286 u8 instance, bool force)
1287{
1288 struct adv_info *adv_instance, *n, *next_instance = NULL;
1289 int err;
1290 u8 rem_inst;
1291
1292 /* Cancel any timeout concerning the removed instance(s). */
1293 if (!instance || hdev->cur_adv_instance == instance)
1294 cancel_adv_timeout(hdev);
1295
1296 /* Get the next instance to advertise BEFORE we remove
1297 * the current one. This can be the same instance again
1298 * if there is only one instance.
1299 */
1300 if (instance && hdev->cur_adv_instance == instance)
1301 next_instance = hci_get_next_instance(hdev, instance);
1302
1303 if (instance == 0x00) {
1304 list_for_each_entry_safe(adv_instance, n, &hdev->adv_instances,
1305 list) {
1306 if (!(force || adv_instance->timeout))
1307 continue;
1308
1309 rem_inst = adv_instance->instance;
1310 err = hci_remove_adv_instance(hdev, rem_inst);
1311 if (!err)
1312 mgmt_advertising_removed(NULL, hdev, rem_inst);
1313 }
1314 } else {
1315 adv_instance = hci_find_adv_instance(hdev, instance);
1316
1317 if (force || (adv_instance && adv_instance->timeout &&
1318 !adv_instance->remaining_time)) {
1319 /* Don't advertise a removed instance. */
1320 if (next_instance &&
1321 next_instance->instance == instance)
1322 next_instance = NULL;
1323
1324 err = hci_remove_adv_instance(hdev, instance);
1325 if (!err)
1326 mgmt_advertising_removed(NULL, hdev, instance);
1327 }
1328 }
1329
1330 if (!req || !hdev_is_powered(hdev) ||
1331 hci_dev_test_flag(hdev, HCI_ADVERTISING))
1332 return;
1333
1334 if (next_instance)
1335 __hci_req_schedule_adv_instance(req, next_instance->instance,
1336 false);
1337}
1338
1339static void set_random_addr(struct hci_request *req, bdaddr_t *rpa)
1340{
1341 struct hci_dev *hdev = req->hdev;
1342
1343 /* If we're advertising or initiating an LE connection we can't
1344 * go ahead and change the random address at this time. This is
1345 * because the eventual initiator address used for the
1346 * subsequently created connection will be undefined (some
1347 * controllers use the new address and others the one we had
1348 * when the operation started).
1349 *
1350 * In this kind of scenario skip the update and let the random
1351 * address be updated at the next cycle.
1352 */
1353 if (hci_dev_test_flag(hdev, HCI_LE_ADV) ||
1354 hci_lookup_le_connect(hdev)) {
1355 BT_DBG("Deferring random address update");
1356 hci_dev_set_flag(hdev, HCI_RPA_EXPIRED);
1357 return;
1358 }
1359
1360 hci_req_add(req, HCI_OP_LE_SET_RANDOM_ADDR, 6, rpa);
1361}
1362
1363int hci_update_random_address(struct hci_request *req, bool require_privacy,
1364 bool use_rpa, u8 *own_addr_type)
1365{
1366 struct hci_dev *hdev = req->hdev;
1367 int err;
1368
1369 /* If privacy is enabled use a resolvable private address. If
1370 * current RPA has expired or there is something else than
1371 * the current RPA in use, then generate a new one.
1372 */
1373 if (use_rpa) {
1374 int to;
1375
1376 *own_addr_type = ADDR_LE_DEV_RANDOM;
1377
1378 if (!hci_dev_test_and_clear_flag(hdev, HCI_RPA_EXPIRED) &&
1379 !bacmp(&hdev->random_addr, &hdev->rpa))
1380 return 0;
1381
1382 err = smp_generate_rpa(hdev, hdev->irk, &hdev->rpa);
1383 if (err < 0) {
1384 BT_ERR("%s failed to generate new RPA", hdev->name);
1385 return err;
1386 }
1387
1388 set_random_addr(req, &hdev->rpa);
1389
1390 to = msecs_to_jiffies(hdev->rpa_timeout * 1000);
1391 queue_delayed_work(hdev->workqueue, &hdev->rpa_expired, to);
1392
1393 return 0;
1394 }
1395
1396 /* In case of required privacy without resolvable private address,
1397 * use an non-resolvable private address. This is useful for active
1398 * scanning and non-connectable advertising.
1399 */
1400 if (require_privacy) {
1401 bdaddr_t nrpa;
1402
1403 while (true) {
1404 /* The non-resolvable private address is generated
1405 * from random six bytes with the two most significant
1406 * bits cleared.
1407 */
1408 get_random_bytes(&nrpa, 6);
1409 nrpa.b[5] &= 0x3f;
1410
1411 /* The non-resolvable private address shall not be
1412 * equal to the public address.
1413 */
1414 if (bacmp(&hdev->bdaddr, &nrpa))
1415 break;
1416 }
1417
1418 *own_addr_type = ADDR_LE_DEV_RANDOM;
1419 set_random_addr(req, &nrpa);
1420 return 0;
1421 }
1422
1423 /* If forcing static address is in use or there is no public
1424 * address use the static address as random address (but skip
1425 * the HCI command if the current random address is already the
1426 * static one.
1427 *
1428 * In case BR/EDR has been disabled on a dual-mode controller
1429 * and a static address has been configured, then use that
1430 * address instead of the public BR/EDR address.
1431 */
1432 if (hci_dev_test_flag(hdev, HCI_FORCE_STATIC_ADDR) ||
1433 !bacmp(&hdev->bdaddr, BDADDR_ANY) ||
1434 (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) &&
1435 bacmp(&hdev->static_addr, BDADDR_ANY))) {
1436 *own_addr_type = ADDR_LE_DEV_RANDOM;
1437 if (bacmp(&hdev->static_addr, &hdev->random_addr))
1438 hci_req_add(req, HCI_OP_LE_SET_RANDOM_ADDR, 6,
1439 &hdev->static_addr);
1440 return 0;
1441 }
1442
1443 /* Neither privacy nor static address is being used so use a
1444 * public address.
1445 */
1446 *own_addr_type = ADDR_LE_DEV_PUBLIC;
1447
1448 return 0;
1449}
1450
1451static bool disconnected_whitelist_entries(struct hci_dev *hdev)
1452{
1453 struct bdaddr_list *b;
1454
1455 list_for_each_entry(b, &hdev->whitelist, list) {
1456 struct hci_conn *conn;
1457
1458 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &b->bdaddr);
1459 if (!conn)
1460 return true;
1461
1462 if (conn->state != BT_CONNECTED && conn->state != BT_CONFIG)
1463 return true;
1464 }
1465
1466 return false;
1467}
1468
1469void __hci_req_update_scan(struct hci_request *req)
1470{
1471 struct hci_dev *hdev = req->hdev;
1472 u8 scan;
1473
1474 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
1475 return;
1476
1477 if (!hdev_is_powered(hdev))
1478 return;
1479
1480 if (mgmt_powering_down(hdev))
1481 return;
1482
1483 if (hci_dev_test_flag(hdev, HCI_CONNECTABLE) ||
1484 disconnected_whitelist_entries(hdev))
1485 scan = SCAN_PAGE;
1486 else
1487 scan = SCAN_DISABLED;
1488
1489 if (hci_dev_test_flag(hdev, HCI_DISCOVERABLE))
1490 scan |= SCAN_INQUIRY;
1491
1492 if (test_bit(HCI_PSCAN, &hdev->flags) == !!(scan & SCAN_PAGE) &&
1493 test_bit(HCI_ISCAN, &hdev->flags) == !!(scan & SCAN_INQUIRY))
1494 return;
1495
1496 hci_req_add(req, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
1497}
1498
1499static int update_scan(struct hci_request *req, unsigned long opt)
1500{
1501 hci_dev_lock(req->hdev);
1502 __hci_req_update_scan(req);
1503 hci_dev_unlock(req->hdev);
1504 return 0;
1505}
1506
1507static void scan_update_work(struct work_struct *work)
1508{
1509 struct hci_dev *hdev = container_of(work, struct hci_dev, scan_update);
1510
1511 hci_req_sync(hdev, update_scan, 0, HCI_CMD_TIMEOUT, NULL);
1512}
1513
1514static int connectable_update(struct hci_request *req, unsigned long opt)
1515{
1516 struct hci_dev *hdev = req->hdev;
1517
1518 hci_dev_lock(hdev);
1519
1520 __hci_req_update_scan(req);
1521
1522 /* If BR/EDR is not enabled and we disable advertising as a
1523 * by-product of disabling connectable, we need to update the
1524 * advertising flags.
1525 */
1526 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
1527 __hci_req_update_adv_data(req, hdev->cur_adv_instance);
1528
1529 /* Update the advertising parameters if necessary */
1530 if (hci_dev_test_flag(hdev, HCI_ADVERTISING) ||
1531 !list_empty(&hdev->adv_instances))
1532 __hci_req_enable_advertising(req);
1533
1534 __hci_update_background_scan(req);
1535
1536 hci_dev_unlock(hdev);
1537
1538 return 0;
1539}
1540
1541static void connectable_update_work(struct work_struct *work)
1542{
1543 struct hci_dev *hdev = container_of(work, struct hci_dev,
1544 connectable_update);
1545 u8 status;
1546
1547 hci_req_sync(hdev, connectable_update, 0, HCI_CMD_TIMEOUT, &status);
1548 mgmt_set_connectable_complete(hdev, status);
1549}
1550
1551static u8 get_service_classes(struct hci_dev *hdev)
1552{
1553 struct bt_uuid *uuid;
1554 u8 val = 0;
1555
1556 list_for_each_entry(uuid, &hdev->uuids, list)
1557 val |= uuid->svc_hint;
1558
1559 return val;
1560}
1561
1562void __hci_req_update_class(struct hci_request *req)
1563{
1564 struct hci_dev *hdev = req->hdev;
1565 u8 cod[3];
1566
1567 BT_DBG("%s", hdev->name);
1568
1569 if (!hdev_is_powered(hdev))
1570 return;
1571
1572 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
1573 return;
1574
1575 if (hci_dev_test_flag(hdev, HCI_SERVICE_CACHE))
1576 return;
1577
1578 cod[0] = hdev->minor_class;
1579 cod[1] = hdev->major_class;
1580 cod[2] = get_service_classes(hdev);
1581
1582 if (hci_dev_test_flag(hdev, HCI_LIMITED_DISCOVERABLE))
1583 cod[1] |= 0x20;
1584
1585 if (memcmp(cod, hdev->dev_class, 3) == 0)
1586 return;
1587
1588 hci_req_add(req, HCI_OP_WRITE_CLASS_OF_DEV, sizeof(cod), cod);
1589}
1590
1591static void write_iac(struct hci_request *req)
1592{
1593 struct hci_dev *hdev = req->hdev;
1594 struct hci_cp_write_current_iac_lap cp;
1595
1596 if (!hci_dev_test_flag(hdev, HCI_DISCOVERABLE))
1597 return;
1598
1599 if (hci_dev_test_flag(hdev, HCI_LIMITED_DISCOVERABLE)) {
1600 /* Limited discoverable mode */
1601 cp.num_iac = min_t(u8, hdev->num_iac, 2);
1602 cp.iac_lap[0] = 0x00; /* LIAC */
1603 cp.iac_lap[1] = 0x8b;
1604 cp.iac_lap[2] = 0x9e;
1605 cp.iac_lap[3] = 0x33; /* GIAC */
1606 cp.iac_lap[4] = 0x8b;
1607 cp.iac_lap[5] = 0x9e;
1608 } else {
1609 /* General discoverable mode */
1610 cp.num_iac = 1;
1611 cp.iac_lap[0] = 0x33; /* GIAC */
1612 cp.iac_lap[1] = 0x8b;
1613 cp.iac_lap[2] = 0x9e;
1614 }
1615
1616 hci_req_add(req, HCI_OP_WRITE_CURRENT_IAC_LAP,
1617 (cp.num_iac * 3) + 1, &cp);
1618}
1619
1620static int discoverable_update(struct hci_request *req, unsigned long opt)
1621{
1622 struct hci_dev *hdev = req->hdev;
1623
1624 hci_dev_lock(hdev);
1625
1626 if (hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) {
1627 write_iac(req);
1628 __hci_req_update_scan(req);
1629 __hci_req_update_class(req);
1630 }
1631
1632 /* Advertising instances don't use the global discoverable setting, so
1633 * only update AD if advertising was enabled using Set Advertising.
1634 */
1635 if (hci_dev_test_flag(hdev, HCI_ADVERTISING)) {
1636 __hci_req_update_adv_data(req, 0x00);
1637
1638 /* Discoverable mode affects the local advertising
1639 * address in limited privacy mode.
1640 */
1641 if (hci_dev_test_flag(hdev, HCI_LIMITED_PRIVACY))
1642 __hci_req_enable_advertising(req);
1643 }
1644
1645 hci_dev_unlock(hdev);
1646
1647 return 0;
1648}
1649
1650static void discoverable_update_work(struct work_struct *work)
1651{
1652 struct hci_dev *hdev = container_of(work, struct hci_dev,
1653 discoverable_update);
1654 u8 status;
1655
1656 hci_req_sync(hdev, discoverable_update, 0, HCI_CMD_TIMEOUT, &status);
1657 mgmt_set_discoverable_complete(hdev, status);
1658}
1659
1660void __hci_abort_conn(struct hci_request *req, struct hci_conn *conn,
1661 u8 reason)
1662{
1663 switch (conn->state) {
1664 case BT_CONNECTED:
1665 case BT_CONFIG:
1666 if (conn->type == AMP_LINK) {
1667 struct hci_cp_disconn_phy_link cp;
1668
1669 cp.phy_handle = HCI_PHY_HANDLE(conn->handle);
1670 cp.reason = reason;
1671 hci_req_add(req, HCI_OP_DISCONN_PHY_LINK, sizeof(cp),
1672 &cp);
1673 } else {
1674 struct hci_cp_disconnect dc;
1675
1676 dc.handle = cpu_to_le16(conn->handle);
1677 dc.reason = reason;
1678 hci_req_add(req, HCI_OP_DISCONNECT, sizeof(dc), &dc);
1679 }
1680
1681 conn->state = BT_DISCONN;
1682
1683 break;
1684 case BT_CONNECT:
1685 if (conn->type == LE_LINK) {
1686 if (test_bit(HCI_CONN_SCANNING, &conn->flags))
1687 break;
1688 hci_req_add(req, HCI_OP_LE_CREATE_CONN_CANCEL,
1689 0, NULL);
1690 } else if (conn->type == ACL_LINK) {
1691 if (req->hdev->hci_ver < BLUETOOTH_VER_1_2)
1692 break;
1693 hci_req_add(req, HCI_OP_CREATE_CONN_CANCEL,
1694 6, &conn->dst);
1695 }
1696 break;
1697 case BT_CONNECT2:
1698 if (conn->type == ACL_LINK) {
1699 struct hci_cp_reject_conn_req rej;
1700
1701 bacpy(&rej.bdaddr, &conn->dst);
1702 rej.reason = reason;
1703
1704 hci_req_add(req, HCI_OP_REJECT_CONN_REQ,
1705 sizeof(rej), &rej);
1706 } else if (conn->type == SCO_LINK || conn->type == ESCO_LINK) {
1707 struct hci_cp_reject_sync_conn_req rej;
1708
1709 bacpy(&rej.bdaddr, &conn->dst);
1710
1711 /* SCO rejection has its own limited set of
1712 * allowed error values (0x0D-0x0F) which isn't
1713 * compatible with most values passed to this
1714 * function. To be safe hard-code one of the
1715 * values that's suitable for SCO.
1716 */
1717 rej.reason = HCI_ERROR_REMOTE_LOW_RESOURCES;
1718
1719 hci_req_add(req, HCI_OP_REJECT_SYNC_CONN_REQ,
1720 sizeof(rej), &rej);
1721 }
1722 break;
1723 default:
1724 conn->state = BT_CLOSED;
1725 break;
1726 }
1727}
1728
1729static void abort_conn_complete(struct hci_dev *hdev, u8 status, u16 opcode)
1730{
1731 if (status)
1732 BT_DBG("Failed to abort connection: status 0x%2.2x", status);
1733}
1734
1735int hci_abort_conn(struct hci_conn *conn, u8 reason)
1736{
1737 struct hci_request req;
1738 int err;
1739
1740 hci_req_init(&req, conn->hdev);
1741
1742 __hci_abort_conn(&req, conn, reason);
1743
1744 err = hci_req_run(&req, abort_conn_complete);
1745 if (err && err != -ENODATA) {
1746 BT_ERR("Failed to run HCI request: err %d", err);
1747 return err;
1748 }
1749
1750 return 0;
1751}
1752
1753static int update_bg_scan(struct hci_request *req, unsigned long opt)
1754{
1755 hci_dev_lock(req->hdev);
1756 __hci_update_background_scan(req);
1757 hci_dev_unlock(req->hdev);
1758 return 0;
1759}
1760
1761static void bg_scan_update(struct work_struct *work)
1762{
1763 struct hci_dev *hdev = container_of(work, struct hci_dev,
1764 bg_scan_update);
1765 struct hci_conn *conn;
1766 u8 status;
1767 int err;
1768
1769 err = hci_req_sync(hdev, update_bg_scan, 0, HCI_CMD_TIMEOUT, &status);
1770 if (!err)
1771 return;
1772
1773 hci_dev_lock(hdev);
1774
1775 conn = hci_conn_hash_lookup_state(hdev, LE_LINK, BT_CONNECT);
1776 if (conn)
1777 hci_le_conn_failed(conn, status);
1778
1779 hci_dev_unlock(hdev);
1780}
1781
1782static int le_scan_disable(struct hci_request *req, unsigned long opt)
1783{
1784 hci_req_add_le_scan_disable(req);
1785 return 0;
1786}
1787
1788static int bredr_inquiry(struct hci_request *req, unsigned long opt)
1789{
1790 u8 length = opt;
1791 const u8 giac[3] = { 0x33, 0x8b, 0x9e };
1792 const u8 liac[3] = { 0x00, 0x8b, 0x9e };
1793 struct hci_cp_inquiry cp;
1794
1795 BT_DBG("%s", req->hdev->name);
1796
1797 hci_dev_lock(req->hdev);
1798 hci_inquiry_cache_flush(req->hdev);
1799 hci_dev_unlock(req->hdev);
1800
1801 memset(&cp, 0, sizeof(cp));
1802
1803 if (req->hdev->discovery.limited)
1804 memcpy(&cp.lap, liac, sizeof(cp.lap));
1805 else
1806 memcpy(&cp.lap, giac, sizeof(cp.lap));
1807
1808 cp.length = length;
1809
1810 hci_req_add(req, HCI_OP_INQUIRY, sizeof(cp), &cp);
1811
1812 return 0;
1813}
1814
1815static void le_scan_disable_work(struct work_struct *work)
1816{
1817 struct hci_dev *hdev = container_of(work, struct hci_dev,
1818 le_scan_disable.work);
1819 u8 status;
1820
1821 BT_DBG("%s", hdev->name);
1822
1823 if (!hci_dev_test_flag(hdev, HCI_LE_SCAN))
1824 return;
1825
1826 cancel_delayed_work(&hdev->le_scan_restart);
1827
1828 hci_req_sync(hdev, le_scan_disable, 0, HCI_CMD_TIMEOUT, &status);
1829 if (status) {
1830 BT_ERR("Failed to disable LE scan: status 0x%02x", status);
1831 return;
1832 }
1833
1834 hdev->discovery.scan_start = 0;
1835
1836 /* If we were running LE only scan, change discovery state. If
1837 * we were running both LE and BR/EDR inquiry simultaneously,
1838 * and BR/EDR inquiry is already finished, stop discovery,
1839 * otherwise BR/EDR inquiry will stop discovery when finished.
1840 * If we will resolve remote device name, do not change
1841 * discovery state.
1842 */
1843
1844 if (hdev->discovery.type == DISCOV_TYPE_LE)
1845 goto discov_stopped;
1846
1847 if (hdev->discovery.type != DISCOV_TYPE_INTERLEAVED)
1848 return;
1849
1850 if (test_bit(HCI_QUIRK_SIMULTANEOUS_DISCOVERY, &hdev->quirks)) {
1851 if (!test_bit(HCI_INQUIRY, &hdev->flags) &&
1852 hdev->discovery.state != DISCOVERY_RESOLVING)
1853 goto discov_stopped;
1854
1855 return;
1856 }
1857
1858 hci_req_sync(hdev, bredr_inquiry, DISCOV_INTERLEAVED_INQUIRY_LEN,
1859 HCI_CMD_TIMEOUT, &status);
1860 if (status) {
1861 BT_ERR("Inquiry failed: status 0x%02x", status);
1862 goto discov_stopped;
1863 }
1864
1865 return;
1866
1867discov_stopped:
1868 hci_dev_lock(hdev);
1869 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
1870 hci_dev_unlock(hdev);
1871}
1872
1873static int le_scan_restart(struct hci_request *req, unsigned long opt)
1874{
1875 struct hci_dev *hdev = req->hdev;
1876 struct hci_cp_le_set_scan_enable cp;
1877
1878 /* If controller is not scanning we are done. */
1879 if (!hci_dev_test_flag(hdev, HCI_LE_SCAN))
1880 return 0;
1881
1882 hci_req_add_le_scan_disable(req);
1883
1884 memset(&cp, 0, sizeof(cp));
1885 cp.enable = LE_SCAN_ENABLE;
1886 cp.filter_dup = LE_SCAN_FILTER_DUP_ENABLE;
1887 hci_req_add(req, HCI_OP_LE_SET_SCAN_ENABLE, sizeof(cp), &cp);
1888
1889 return 0;
1890}
1891
1892static void le_scan_restart_work(struct work_struct *work)
1893{
1894 struct hci_dev *hdev = container_of(work, struct hci_dev,
1895 le_scan_restart.work);
1896 unsigned long timeout, duration, scan_start, now;
1897 u8 status;
1898
1899 BT_DBG("%s", hdev->name);
1900
1901 hci_req_sync(hdev, le_scan_restart, 0, HCI_CMD_TIMEOUT, &status);
1902 if (status) {
1903 BT_ERR("Failed to restart LE scan: status %d", status);
1904 return;
1905 }
1906
1907 hci_dev_lock(hdev);
1908
1909 if (!test_bit(HCI_QUIRK_STRICT_DUPLICATE_FILTER, &hdev->quirks) ||
1910 !hdev->discovery.scan_start)
1911 goto unlock;
1912
1913 /* When the scan was started, hdev->le_scan_disable has been queued
1914 * after duration from scan_start. During scan restart this job
1915 * has been canceled, and we need to queue it again after proper
1916 * timeout, to make sure that scan does not run indefinitely.
1917 */
1918 duration = hdev->discovery.scan_duration;
1919 scan_start = hdev->discovery.scan_start;
1920 now = jiffies;
1921 if (now - scan_start <= duration) {
1922 int elapsed;
1923
1924 if (now >= scan_start)
1925 elapsed = now - scan_start;
1926 else
1927 elapsed = ULONG_MAX - scan_start + now;
1928
1929 timeout = duration - elapsed;
1930 } else {
1931 timeout = 0;
1932 }
1933
1934 queue_delayed_work(hdev->req_workqueue,
1935 &hdev->le_scan_disable, timeout);
1936
1937unlock:
1938 hci_dev_unlock(hdev);
1939}
1940
1941static void disable_advertising(struct hci_request *req)
1942{
1943 u8 enable = 0x00;
1944
1945 hci_req_add(req, HCI_OP_LE_SET_ADV_ENABLE, sizeof(enable), &enable);
1946}
1947
1948static int active_scan(struct hci_request *req, unsigned long opt)
1949{
1950 uint16_t interval = opt;
1951 struct hci_dev *hdev = req->hdev;
1952 struct hci_cp_le_set_scan_param param_cp;
1953 struct hci_cp_le_set_scan_enable enable_cp;
1954 u8 own_addr_type;
1955 int err;
1956
1957 BT_DBG("%s", hdev->name);
1958
1959 if (hci_dev_test_flag(hdev, HCI_LE_ADV)) {
1960 hci_dev_lock(hdev);
1961
1962 /* Don't let discovery abort an outgoing connection attempt
1963 * that's using directed advertising.
1964 */
1965 if (hci_lookup_le_connect(hdev)) {
1966 hci_dev_unlock(hdev);
1967 return -EBUSY;
1968 }
1969
1970 cancel_adv_timeout(hdev);
1971 hci_dev_unlock(hdev);
1972
1973 disable_advertising(req);
1974 }
1975
1976 /* If controller is scanning, it means the background scanning is
1977 * running. Thus, we should temporarily stop it in order to set the
1978 * discovery scanning parameters.
1979 */
1980 if (hci_dev_test_flag(hdev, HCI_LE_SCAN))
1981 hci_req_add_le_scan_disable(req);
1982
1983 /* All active scans will be done with either a resolvable private
1984 * address (when privacy feature has been enabled) or non-resolvable
1985 * private address.
1986 */
1987 err = hci_update_random_address(req, true, scan_use_rpa(hdev),
1988 &own_addr_type);
1989 if (err < 0)
1990 own_addr_type = ADDR_LE_DEV_PUBLIC;
1991
1992 memset(¶m_cp, 0, sizeof(param_cp));
1993 param_cp.type = LE_SCAN_ACTIVE;
1994 param_cp.interval = cpu_to_le16(interval);
1995 param_cp.window = cpu_to_le16(DISCOV_LE_SCAN_WIN);
1996 param_cp.own_address_type = own_addr_type;
1997
1998 hci_req_add(req, HCI_OP_LE_SET_SCAN_PARAM, sizeof(param_cp),
1999 ¶m_cp);
2000
2001 memset(&enable_cp, 0, sizeof(enable_cp));
2002 enable_cp.enable = LE_SCAN_ENABLE;
2003 enable_cp.filter_dup = LE_SCAN_FILTER_DUP_ENABLE;
2004
2005 hci_req_add(req, HCI_OP_LE_SET_SCAN_ENABLE, sizeof(enable_cp),
2006 &enable_cp);
2007
2008 return 0;
2009}
2010
2011static int interleaved_discov(struct hci_request *req, unsigned long opt)
2012{
2013 int err;
2014
2015 BT_DBG("%s", req->hdev->name);
2016
2017 err = active_scan(req, opt);
2018 if (err)
2019 return err;
2020
2021 return bredr_inquiry(req, DISCOV_BREDR_INQUIRY_LEN);
2022}
2023
2024static void start_discovery(struct hci_dev *hdev, u8 *status)
2025{
2026 unsigned long timeout;
2027
2028 BT_DBG("%s type %u", hdev->name, hdev->discovery.type);
2029
2030 switch (hdev->discovery.type) {
2031 case DISCOV_TYPE_BREDR:
2032 if (!hci_dev_test_flag(hdev, HCI_INQUIRY))
2033 hci_req_sync(hdev, bredr_inquiry,
2034 DISCOV_BREDR_INQUIRY_LEN, HCI_CMD_TIMEOUT,
2035 status);
2036 return;
2037 case DISCOV_TYPE_INTERLEAVED:
2038 /* When running simultaneous discovery, the LE scanning time
2039 * should occupy the whole discovery time sine BR/EDR inquiry
2040 * and LE scanning are scheduled by the controller.
2041 *
2042 * For interleaving discovery in comparison, BR/EDR inquiry
2043 * and LE scanning are done sequentially with separate
2044 * timeouts.
2045 */
2046 if (test_bit(HCI_QUIRK_SIMULTANEOUS_DISCOVERY,
2047 &hdev->quirks)) {
2048 timeout = msecs_to_jiffies(DISCOV_LE_TIMEOUT);
2049 /* During simultaneous discovery, we double LE scan
2050 * interval. We must leave some time for the controller
2051 * to do BR/EDR inquiry.
2052 */
2053 hci_req_sync(hdev, interleaved_discov,
2054 DISCOV_LE_SCAN_INT * 2, HCI_CMD_TIMEOUT,
2055 status);
2056 break;
2057 }
2058
2059 timeout = msecs_to_jiffies(hdev->discov_interleaved_timeout);
2060 hci_req_sync(hdev, active_scan, DISCOV_LE_SCAN_INT,
2061 HCI_CMD_TIMEOUT, status);
2062 break;
2063 case DISCOV_TYPE_LE:
2064 timeout = msecs_to_jiffies(DISCOV_LE_TIMEOUT);
2065 hci_req_sync(hdev, active_scan, DISCOV_LE_SCAN_INT,
2066 HCI_CMD_TIMEOUT, status);
2067 break;
2068 default:
2069 *status = HCI_ERROR_UNSPECIFIED;
2070 return;
2071 }
2072
2073 if (*status)
2074 return;
2075
2076 BT_DBG("%s timeout %u ms", hdev->name, jiffies_to_msecs(timeout));
2077
2078 /* When service discovery is used and the controller has a
2079 * strict duplicate filter, it is important to remember the
2080 * start and duration of the scan. This is required for
2081 * restarting scanning during the discovery phase.
2082 */
2083 if (test_bit(HCI_QUIRK_STRICT_DUPLICATE_FILTER, &hdev->quirks) &&
2084 hdev->discovery.result_filtering) {
2085 hdev->discovery.scan_start = jiffies;
2086 hdev->discovery.scan_duration = timeout;
2087 }
2088
2089 queue_delayed_work(hdev->req_workqueue, &hdev->le_scan_disable,
2090 timeout);
2091}
2092
2093bool hci_req_stop_discovery(struct hci_request *req)
2094{
2095 struct hci_dev *hdev = req->hdev;
2096 struct discovery_state *d = &hdev->discovery;
2097 struct hci_cp_remote_name_req_cancel cp;
2098 struct inquiry_entry *e;
2099 bool ret = false;
2100
2101 BT_DBG("%s state %u", hdev->name, hdev->discovery.state);
2102
2103 if (d->state == DISCOVERY_FINDING || d->state == DISCOVERY_STOPPING) {
2104 if (test_bit(HCI_INQUIRY, &hdev->flags))
2105 hci_req_add(req, HCI_OP_INQUIRY_CANCEL, 0, NULL);
2106
2107 if (hci_dev_test_flag(hdev, HCI_LE_SCAN)) {
2108 cancel_delayed_work(&hdev->le_scan_disable);
2109 hci_req_add_le_scan_disable(req);
2110 }
2111
2112 ret = true;
2113 } else {
2114 /* Passive scanning */
2115 if (hci_dev_test_flag(hdev, HCI_LE_SCAN)) {
2116 hci_req_add_le_scan_disable(req);
2117 ret = true;
2118 }
2119 }
2120
2121 /* No further actions needed for LE-only discovery */
2122 if (d->type == DISCOV_TYPE_LE)
2123 return ret;
2124
2125 if (d->state == DISCOVERY_RESOLVING || d->state == DISCOVERY_STOPPING) {
2126 e = hci_inquiry_cache_lookup_resolve(hdev, BDADDR_ANY,
2127 NAME_PENDING);
2128 if (!e)
2129 return ret;
2130
2131 bacpy(&cp.bdaddr, &e->data.bdaddr);
2132 hci_req_add(req, HCI_OP_REMOTE_NAME_REQ_CANCEL, sizeof(cp),
2133 &cp);
2134 ret = true;
2135 }
2136
2137 return ret;
2138}
2139
2140static int stop_discovery(struct hci_request *req, unsigned long opt)
2141{
2142 hci_dev_lock(req->hdev);
2143 hci_req_stop_discovery(req);
2144 hci_dev_unlock(req->hdev);
2145
2146 return 0;
2147}
2148
2149static void discov_update(struct work_struct *work)
2150{
2151 struct hci_dev *hdev = container_of(work, struct hci_dev,
2152 discov_update);
2153 u8 status = 0;
2154
2155 switch (hdev->discovery.state) {
2156 case DISCOVERY_STARTING:
2157 start_discovery(hdev, &status);
2158 mgmt_start_discovery_complete(hdev, status);
2159 if (status)
2160 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
2161 else
2162 hci_discovery_set_state(hdev, DISCOVERY_FINDING);
2163 break;
2164 case DISCOVERY_STOPPING:
2165 hci_req_sync(hdev, stop_discovery, 0, HCI_CMD_TIMEOUT, &status);
2166 mgmt_stop_discovery_complete(hdev, status);
2167 if (!status)
2168 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
2169 break;
2170 case DISCOVERY_STOPPED:
2171 default:
2172 return;
2173 }
2174}
2175
2176static void discov_off(struct work_struct *work)
2177{
2178 struct hci_dev *hdev = container_of(work, struct hci_dev,
2179 discov_off.work);
2180
2181 BT_DBG("%s", hdev->name);
2182
2183 hci_dev_lock(hdev);
2184
2185 /* When discoverable timeout triggers, then just make sure
2186 * the limited discoverable flag is cleared. Even in the case
2187 * of a timeout triggered from general discoverable, it is
2188 * safe to unconditionally clear the flag.
2189 */
2190 hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE);
2191 hci_dev_clear_flag(hdev, HCI_DISCOVERABLE);
2192 hdev->discov_timeout = 0;
2193
2194 hci_dev_unlock(hdev);
2195
2196 hci_req_sync(hdev, discoverable_update, 0, HCI_CMD_TIMEOUT, NULL);
2197 mgmt_new_settings(hdev);
2198}
2199
2200static int powered_update_hci(struct hci_request *req, unsigned long opt)
2201{
2202 struct hci_dev *hdev = req->hdev;
2203 u8 link_sec;
2204
2205 hci_dev_lock(hdev);
2206
2207 if (hci_dev_test_flag(hdev, HCI_SSP_ENABLED) &&
2208 !lmp_host_ssp_capable(hdev)) {
2209 u8 mode = 0x01;
2210
2211 hci_req_add(req, HCI_OP_WRITE_SSP_MODE, sizeof(mode), &mode);
2212
2213 if (bredr_sc_enabled(hdev) && !lmp_host_sc_capable(hdev)) {
2214 u8 support = 0x01;
2215
2216 hci_req_add(req, HCI_OP_WRITE_SC_SUPPORT,
2217 sizeof(support), &support);
2218 }
2219 }
2220
2221 if (hci_dev_test_flag(hdev, HCI_LE_ENABLED) &&
2222 lmp_bredr_capable(hdev)) {
2223 struct hci_cp_write_le_host_supported cp;
2224
2225 cp.le = 0x01;
2226 cp.simul = 0x00;
2227
2228 /* Check first if we already have the right
2229 * host state (host features set)
2230 */
2231 if (cp.le != lmp_host_le_capable(hdev) ||
2232 cp.simul != lmp_host_le_br_capable(hdev))
2233 hci_req_add(req, HCI_OP_WRITE_LE_HOST_SUPPORTED,
2234 sizeof(cp), &cp);
2235 }
2236
2237 if (hci_dev_test_flag(hdev, HCI_LE_ENABLED)) {
2238 /* Make sure the controller has a good default for
2239 * advertising data. This also applies to the case
2240 * where BR/EDR was toggled during the AUTO_OFF phase.
2241 */
2242 if (hci_dev_test_flag(hdev, HCI_ADVERTISING) ||
2243 list_empty(&hdev->adv_instances)) {
2244 __hci_req_update_adv_data(req, 0x00);
2245 __hci_req_update_scan_rsp_data(req, 0x00);
2246
2247 if (hci_dev_test_flag(hdev, HCI_ADVERTISING))
2248 __hci_req_enable_advertising(req);
2249 } else if (!list_empty(&hdev->adv_instances)) {
2250 struct adv_info *adv_instance;
2251
2252 adv_instance = list_first_entry(&hdev->adv_instances,
2253 struct adv_info, list);
2254 __hci_req_schedule_adv_instance(req,
2255 adv_instance->instance,
2256 true);
2257 }
2258 }
2259
2260 link_sec = hci_dev_test_flag(hdev, HCI_LINK_SECURITY);
2261 if (link_sec != test_bit(HCI_AUTH, &hdev->flags))
2262 hci_req_add(req, HCI_OP_WRITE_AUTH_ENABLE,
2263 sizeof(link_sec), &link_sec);
2264
2265 if (lmp_bredr_capable(hdev)) {
2266 if (hci_dev_test_flag(hdev, HCI_FAST_CONNECTABLE))
2267 __hci_req_write_fast_connectable(req, true);
2268 else
2269 __hci_req_write_fast_connectable(req, false);
2270 __hci_req_update_scan(req);
2271 __hci_req_update_class(req);
2272 __hci_req_update_name(req);
2273 __hci_req_update_eir(req);
2274 }
2275
2276 hci_dev_unlock(hdev);
2277 return 0;
2278}
2279
2280int __hci_req_hci_power_on(struct hci_dev *hdev)
2281{
2282 /* Register the available SMP channels (BR/EDR and LE) only when
2283 * successfully powering on the controller. This late
2284 * registration is required so that LE SMP can clearly decide if
2285 * the public address or static address is used.
2286 */
2287 smp_register(hdev);
2288
2289 return __hci_req_sync(hdev, powered_update_hci, 0, HCI_CMD_TIMEOUT,
2290 NULL);
2291}
2292
2293void hci_request_setup(struct hci_dev *hdev)
2294{
2295 INIT_WORK(&hdev->discov_update, discov_update);
2296 INIT_WORK(&hdev->bg_scan_update, bg_scan_update);
2297 INIT_WORK(&hdev->scan_update, scan_update_work);
2298 INIT_WORK(&hdev->connectable_update, connectable_update_work);
2299 INIT_WORK(&hdev->discoverable_update, discoverable_update_work);
2300 INIT_DELAYED_WORK(&hdev->discov_off, discov_off);
2301 INIT_DELAYED_WORK(&hdev->le_scan_disable, le_scan_disable_work);
2302 INIT_DELAYED_WORK(&hdev->le_scan_restart, le_scan_restart_work);
2303 INIT_DELAYED_WORK(&hdev->adv_instance_expire, adv_timeout_expire);
2304}
2305
2306void hci_request_cancel_all(struct hci_dev *hdev)
2307{
2308 hci_req_sync_cancel(hdev, ENODEV);
2309
2310 cancel_work_sync(&hdev->discov_update);
2311 cancel_work_sync(&hdev->bg_scan_update);
2312 cancel_work_sync(&hdev->scan_update);
2313 cancel_work_sync(&hdev->connectable_update);
2314 cancel_work_sync(&hdev->discoverable_update);
2315 cancel_delayed_work_sync(&hdev->discov_off);
2316 cancel_delayed_work_sync(&hdev->le_scan_disable);
2317 cancel_delayed_work_sync(&hdev->le_scan_restart);
2318
2319 if (hdev->adv_instance_timeout) {
2320 cancel_delayed_work_sync(&hdev->adv_instance_expire);
2321 hdev->adv_instance_timeout = 0;
2322 }
2323}