projects / deliverable / linux.git / blob
? search:
summary | shortlog | log | commit | commitdiff | tree
blame | history | raw | HEAD
Merge commit 'fixes.2015.02.23a' into core/rcu
[deliverable/linux.git] / net / bluetooth / hci_request.c
1 /*
2 BlueZ - Bluetooth protocol stack for Linux
3
4 Copyright (C) 2014 Intel Corporation
5
6 This program is free software; you can redistribute it and/or modify
7 it under the terms of the GNU General Public License version 2 as
8 published by the Free Software Foundation;
9
10 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
11 OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
12 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
13 IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
14 CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
15 WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
16 ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
17 OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
18
19 ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
20 COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
21 SOFTWARE IS DISCLAIMED.
22 */
23
24 #include <asm/unaligned.h>
25
26 #include <net/bluetooth/bluetooth.h>
27 #include <net/bluetooth/hci_core.h>
28 #include <net/bluetooth/mgmt.h>
29
30 #include "smp.h"
31 #include "hci_request.h"
32
33 #define HCI_REQ_DONE 0
34 #define HCI_REQ_PEND 1
35 #define HCI_REQ_CANCELED 2
36
37 void hci_req_init(struct hci_request *req, struct hci_dev *hdev)
38 {
39 skb_queue_head_init(&req->cmd_q);
40 req->hdev = hdev;
41 req->err = 0;
42 }
43
44 static int req_run(struct hci_request *req, hci_req_complete_t complete,
45 hci_req_complete_skb_t complete_skb)
46 {
47 struct hci_dev *hdev = req->hdev;
48 struct sk_buff *skb;
49 unsigned long flags;
50
51 BT_DBG("length %u", skb_queue_len(&req->cmd_q));
52
53 /* If an error occurred during request building, remove all HCI
54 * commands queued on the HCI request queue.
55 */
56 if (req->err) {
57 skb_queue_purge(&req->cmd_q);
58 return req->err;
59 }
60
61 /* Do not allow empty requests */
62 if (skb_queue_empty(&req->cmd_q))
63 return -ENODATA;
64
65 skb = skb_peek_tail(&req->cmd_q);
66 if (complete) {
67 bt_cb(skb)->hci.req_complete = complete;
68 } else if (complete_skb) {
69 bt_cb(skb)->hci.req_complete_skb = complete_skb;
70 bt_cb(skb)->hci.req_flags |= HCI_REQ_SKB;
71 }
72
73 spin_lock_irqsave(&hdev->cmd_q.lock, flags);
74 skb_queue_splice_tail(&req->cmd_q, &hdev->cmd_q);
75 spin_unlock_irqrestore(&hdev->cmd_q.lock, flags);
76
77 queue_work(hdev->workqueue, &hdev->cmd_work);
78
79 return 0;
80 }
81
82 int hci_req_run(struct hci_request *req, hci_req_complete_t complete)
83 {
84 return req_run(req, complete, NULL);
85 }
86
87 int hci_req_run_skb(struct hci_request *req, hci_req_complete_skb_t complete)
88 {
89 return req_run(req, NULL, complete);
90 }
91
92 static void hci_req_sync_complete(struct hci_dev *hdev, u8 result, u16 opcode,
93 struct sk_buff *skb)
94 {
95 BT_DBG("%s result 0x%2.2x", hdev->name, result);
96
97 if (hdev->req_status == HCI_REQ_PEND) {
98 hdev->req_result = result;
99 hdev->req_status = HCI_REQ_DONE;
100 if (skb)
101 hdev->req_skb = skb_get(skb);
102 wake_up_interruptible(&hdev->req_wait_q);
103 }
104 }
105
106 void hci_req_sync_cancel(struct hci_dev *hdev, int err)
107 {
108 BT_DBG("%s err 0x%2.2x", hdev->name, err);
109
110 if (hdev->req_status == HCI_REQ_PEND) {
111 hdev->req_result = err;
112 hdev->req_status = HCI_REQ_CANCELED;
113 wake_up_interruptible(&hdev->req_wait_q);
114 }
115 }
116
117 struct sk_buff *__hci_cmd_sync_ev(struct hci_dev *hdev, u16 opcode, u32 plen,
118 const void *param, u8 event, u32 timeout)
119 {
120 DECLARE_WAITQUEUE(wait, current);
121 struct hci_request req;
122 struct sk_buff *skb;
123 int err = 0;
124
125 BT_DBG("%s", hdev->name);
126
127 hci_req_init(&req, hdev);
128
129 hci_req_add_ev(&req, opcode, plen, param, event);
130
131 hdev->req_status = HCI_REQ_PEND;
132
133 add_wait_queue(&hdev->req_wait_q, &wait);
134 set_current_state(TASK_INTERRUPTIBLE);
135
136 err = hci_req_run_skb(&req, hci_req_sync_complete);
137 if (err < 0) {
138 remove_wait_queue(&hdev->req_wait_q, &wait);
139 set_current_state(TASK_RUNNING);
140 return ERR_PTR(err);
141 }
142
143 schedule_timeout(timeout);
144
145 remove_wait_queue(&hdev->req_wait_q, &wait);
146
147 if (signal_pending(current))
148 return ERR_PTR(-EINTR);
149
150 switch (hdev->req_status) {
151 case HCI_REQ_DONE:
152 err = -bt_to_errno(hdev->req_result);
153 break;
154
155 case HCI_REQ_CANCELED:
156 err = -hdev->req_result;
157 break;
158
159 default:
160 err = -ETIMEDOUT;
161 break;
162 }
163
164 hdev->req_status = hdev->req_result = 0;
165 skb = hdev->req_skb;
166 hdev->req_skb = NULL;
167
168 BT_DBG("%s end: err %d", hdev->name, err);
169
170 if (err < 0) {
171 kfree_skb(skb);
172 return ERR_PTR(err);
173 }
174
175 if (!skb)
176 return ERR_PTR(-ENODATA);
177
178 return skb;
179 }
180 EXPORT_SYMBOL(__hci_cmd_sync_ev);
181
182 struct sk_buff *__hci_cmd_sync(struct hci_dev *hdev, u16 opcode, u32 plen,
183 const void *param, u32 timeout)
184 {
185 return __hci_cmd_sync_ev(hdev, opcode, plen, param, 0, timeout);
186 }
187 EXPORT_SYMBOL(__hci_cmd_sync);
188
189 /* Execute request and wait for completion. */
190 int __hci_req_sync(struct hci_dev *hdev, int (*func)(struct hci_request *req,
191 unsigned long opt),
192 unsigned long opt, u32 timeout, u8 *hci_status)
193 {
194 struct hci_request req;
195 DECLARE_WAITQUEUE(wait, current);
196 int err = 0;
197
198 BT_DBG("%s start", hdev->name);
199
200 hci_req_init(&req, hdev);
201
202 hdev->req_status = HCI_REQ_PEND;
203
204 err = func(&req, opt);
205 if (err) {
206 if (hci_status)
207 *hci_status = HCI_ERROR_UNSPECIFIED;
208 return err;
209 }
210
211 add_wait_queue(&hdev->req_wait_q, &wait);
212 set_current_state(TASK_INTERRUPTIBLE);
213
214 err = hci_req_run_skb(&req, hci_req_sync_complete);
215 if (err < 0) {
216 hdev->req_status = 0;
217
218 remove_wait_queue(&hdev->req_wait_q, &wait);
219 set_current_state(TASK_RUNNING);
220
221 /* ENODATA means the HCI request command queue is empty.
222 * This can happen when a request with conditionals doesn't
223 * trigger any commands to be sent. This is normal behavior
224 * and should not trigger an error return.
225 */
226 if (err == -ENODATA) {
227 if (hci_status)
228 *hci_status = 0;
229 return 0;
230 }
231
232 if (hci_status)
233 *hci_status = HCI_ERROR_UNSPECIFIED;
234
235 return err;
236 }
237
238 schedule_timeout(timeout);
239
240 remove_wait_queue(&hdev->req_wait_q, &wait);
241
242 if (signal_pending(current))
243 return -EINTR;
244
245 switch (hdev->req_status) {
246 case HCI_REQ_DONE:
247 err = -bt_to_errno(hdev->req_result);
248 if (hci_status)
249 *hci_status = hdev->req_result;
250 break;
251
252 case HCI_REQ_CANCELED:
253 err = -hdev->req_result;
254 if (hci_status)
255 *hci_status = HCI_ERROR_UNSPECIFIED;
256 break;
257
258 default:
259 err = -ETIMEDOUT;
260 if (hci_status)
261 *hci_status = HCI_ERROR_UNSPECIFIED;
262 break;
263 }
264
265 hdev->req_status = hdev->req_result = 0;
266
267 BT_DBG("%s end: err %d", hdev->name, err);
268
269 return err;
270 }
271
272 int hci_req_sync(struct hci_dev *hdev, int (*req)(struct hci_request *req,
273 unsigned long opt),
274 unsigned long opt, u32 timeout, u8 *hci_status)
275 {
276 int ret;
277
278 if (!test_bit(HCI_UP, &hdev->flags))
279 return -ENETDOWN;
280
281 /* Serialize all requests */
282 hci_req_sync_lock(hdev);
283 ret = __hci_req_sync(hdev, req, opt, timeout, hci_status);
284 hci_req_sync_unlock(hdev);
285
286 return ret;
287 }
288
289 struct sk_buff *hci_prepare_cmd(struct hci_dev *hdev, u16 opcode, u32 plen,
290 const void *param)
291 {
292 int len = HCI_COMMAND_HDR_SIZE + plen;
293 struct hci_command_hdr *hdr;
294 struct sk_buff *skb;
295
296 skb = bt_skb_alloc(len, GFP_ATOMIC);
297 if (!skb)
298 return NULL;
299
300 hdr = (struct hci_command_hdr *) skb_put(skb, HCI_COMMAND_HDR_SIZE);
301 hdr->opcode = cpu_to_le16(opcode);
302 hdr->plen = plen;
303
304 if (plen)
305 memcpy(skb_put(skb, plen), param, plen);
306
307 BT_DBG("skb len %d", skb->len);
308
309 hci_skb_pkt_type(skb) = HCI_COMMAND_PKT;
310 hci_skb_opcode(skb) = opcode;
311
312 return skb;
313 }
314
315 /* Queue a command to an asynchronous HCI request */
316 void hci_req_add_ev(struct hci_request *req, u16 opcode, u32 plen,
317 const void *param, u8 event)
318 {
319 struct hci_dev *hdev = req->hdev;
320 struct sk_buff *skb;
321
322 BT_DBG("%s opcode 0x%4.4x plen %d", hdev->name, opcode, plen);
323
324 /* If an error occurred during request building, there is no point in
325 * queueing the HCI command. We can simply return.
326 */
327 if (req->err)
328 return;
329
330 skb = hci_prepare_cmd(hdev, opcode, plen, param);
331 if (!skb) {
332 BT_ERR("%s no memory for command (opcode 0x%4.4x)",
333 hdev->name, opcode);
334 req->err = -ENOMEM;
335 return;
336 }
337
338 if (skb_queue_empty(&req->cmd_q))
339 bt_cb(skb)->hci.req_flags |= HCI_REQ_START;
340
341 bt_cb(skb)->hci.req_event = event;
342
343 skb_queue_tail(&req->cmd_q, skb);
344 }
345
346 void hci_req_add(struct hci_request *req, u16 opcode, u32 plen,
347 const void *param)
348 {
349 hci_req_add_ev(req, opcode, plen, param, 0);
350 }
351
352 void __hci_req_write_fast_connectable(struct hci_request *req, bool enable)
353 {
354 struct hci_dev *hdev = req->hdev;
355 struct hci_cp_write_page_scan_activity acp;
356 u8 type;
357
358 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
359 return;
360
361 if (hdev->hci_ver < BLUETOOTH_VER_1_2)
362 return;
363
364 if (enable) {
365 type = PAGE_SCAN_TYPE_INTERLACED;
366
367 /* 160 msec page scan interval */
368 acp.interval = cpu_to_le16(0x0100);
369 } else {
370 type = PAGE_SCAN_TYPE_STANDARD; /* default */
371
372 /* default 1.28 sec page scan */
373 acp.interval = cpu_to_le16(0x0800);
374 }
375
376 acp.window = cpu_to_le16(0x0012);
377
378 if (__cpu_to_le16(hdev->page_scan_interval) != acp.interval ||
379 __cpu_to_le16(hdev->page_scan_window) != acp.window)
380 hci_req_add(req, HCI_OP_WRITE_PAGE_SCAN_ACTIVITY,
381 sizeof(acp), &acp);
382
383 if (hdev->page_scan_type != type)
384 hci_req_add(req, HCI_OP_WRITE_PAGE_SCAN_TYPE, 1, &type);
385 }
386
387 /* This function controls the background scanning based on hdev->pend_le_conns
388 * list. If there are pending LE connection we start the background scanning,
389 * otherwise we stop it.
390 *
391 * This function requires the caller holds hdev->lock.
392 */
393 static void __hci_update_background_scan(struct hci_request *req)
394 {
395 struct hci_dev *hdev = req->hdev;
396
397 if (!test_bit(HCI_UP, &hdev->flags) ||
398 test_bit(HCI_INIT, &hdev->flags) ||
399 hci_dev_test_flag(hdev, HCI_SETUP) ||
400 hci_dev_test_flag(hdev, HCI_CONFIG) ||
401 hci_dev_test_flag(hdev, HCI_AUTO_OFF) ||
402 hci_dev_test_flag(hdev, HCI_UNREGISTER))
403 return;
404
405 /* No point in doing scanning if LE support hasn't been enabled */
406 if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED))
407 return;
408
409 /* If discovery is active don't interfere with it */
410 if (hdev->discovery.state != DISCOVERY_STOPPED)
411 return;
412
413 /* Reset RSSI and UUID filters when starting background scanning
414 * since these filters are meant for service discovery only.
415 *
416 * The Start Discovery and Start Service Discovery operations
417 * ensure to set proper values for RSSI threshold and UUID
418 * filter list. So it is safe to just reset them here.
419 */
420 hci_discovery_filter_clear(hdev);
421
422 if (list_empty(&hdev->pend_le_conns) &&
423 list_empty(&hdev->pend_le_reports)) {
424 /* If there is no pending LE connections or devices
425 * to be scanned for, we should stop the background
426 * scanning.
427 */
428
429 /* If controller is not scanning we are done. */
430 if (!hci_dev_test_flag(hdev, HCI_LE_SCAN))
431 return;
432
433 hci_req_add_le_scan_disable(req);
434
435 BT_DBG("%s stopping background scanning", hdev->name);
436 } else {
437 /* If there is at least one pending LE connection, we should
438 * keep the background scan running.
439 */
440
441 /* If controller is connecting, we should not start scanning
442 * since some controllers are not able to scan and connect at
443 * the same time.
444 */
445 if (hci_lookup_le_connect(hdev))
446 return;
447
448 /* If controller is currently scanning, we stop it to ensure we
449 * don't miss any advertising (due to duplicates filter).
450 */
451 if (hci_dev_test_flag(hdev, HCI_LE_SCAN))
452 hci_req_add_le_scan_disable(req);
453
454 hci_req_add_le_passive_scan(req);
455
456 BT_DBG("%s starting background scanning", hdev->name);
457 }
458 }
459
460 void __hci_req_update_name(struct hci_request *req)
461 {
462 struct hci_dev *hdev = req->hdev;
463 struct hci_cp_write_local_name cp;
464
465 memcpy(cp.name, hdev->dev_name, sizeof(cp.name));
466
467 hci_req_add(req, HCI_OP_WRITE_LOCAL_NAME, sizeof(cp), &cp);
468 }
469
470 #define PNP_INFO_SVCLASS_ID 0x1200
471
472 static u8 *create_uuid16_list(struct hci_dev *hdev, u8 *data, ptrdiff_t len)
473 {
474 u8 *ptr = data, *uuids_start = NULL;
475 struct bt_uuid *uuid;
476
477 if (len < 4)
478 return ptr;
479
480 list_for_each_entry(uuid, &hdev->uuids, list) {
481 u16 uuid16;
482
483 if (uuid->size != 16)
484 continue;
485
486 uuid16 = get_unaligned_le16(&uuid->uuid[12]);
487 if (uuid16 < 0x1100)
488 continue;
489
490 if (uuid16 == PNP_INFO_SVCLASS_ID)
491 continue;
492
493 if (!uuids_start) {
494 uuids_start = ptr;
495 uuids_start[0] = 1;
496 uuids_start[1] = EIR_UUID16_ALL;
497 ptr += 2;
498 }
499
500 /* Stop if not enough space to put next UUID */
501 if ((ptr - data) + sizeof(u16) > len) {
502 uuids_start[1] = EIR_UUID16_SOME;
503 break;
504 }
505
506 *ptr++ = (uuid16 & 0x00ff);
507 *ptr++ = (uuid16 & 0xff00) >> 8;
508 uuids_start[0] += sizeof(uuid16);
509 }
510
511 return ptr;
512 }
513
514 static u8 *create_uuid32_list(struct hci_dev *hdev, u8 *data, ptrdiff_t len)
515 {
516 u8 *ptr = data, *uuids_start = NULL;
517 struct bt_uuid *uuid;
518
519 if (len < 6)
520 return ptr;
521
522 list_for_each_entry(uuid, &hdev->uuids, list) {
523 if (uuid->size != 32)
524 continue;
525
526 if (!uuids_start) {
527 uuids_start = ptr;
528 uuids_start[0] = 1;
529 uuids_start[1] = EIR_UUID32_ALL;
530 ptr += 2;
531 }
532
533 /* Stop if not enough space to put next UUID */
534 if ((ptr - data) + sizeof(u32) > len) {
535 uuids_start[1] = EIR_UUID32_SOME;
536 break;
537 }
538
539 memcpy(ptr, &uuid->uuid[12], sizeof(u32));
540 ptr += sizeof(u32);
541 uuids_start[0] += sizeof(u32);
542 }
543
544 return ptr;
545 }
546
547 static u8 *create_uuid128_list(struct hci_dev *hdev, u8 *data, ptrdiff_t len)
548 {
549 u8 *ptr = data, *uuids_start = NULL;
550 struct bt_uuid *uuid;
551
552 if (len < 18)
553 return ptr;
554
555 list_for_each_entry(uuid, &hdev->uuids, list) {
556 if (uuid->size != 128)
557 continue;
558
559 if (!uuids_start) {
560 uuids_start = ptr;
561 uuids_start[0] = 1;
562 uuids_start[1] = EIR_UUID128_ALL;
563 ptr += 2;
564 }
565
566 /* Stop if not enough space to put next UUID */
567 if ((ptr - data) + 16 > len) {
568 uuids_start[1] = EIR_UUID128_SOME;
569 break;
570 }
571
572 memcpy(ptr, uuid->uuid, 16);
573 ptr += 16;
574 uuids_start[0] += 16;
575 }
576
577 return ptr;
578 }
579
580 static void create_eir(struct hci_dev *hdev, u8 *data)
581 {
582 u8 *ptr = data;
583 size_t name_len;
584
585 name_len = strlen(hdev->dev_name);
586
587 if (name_len > 0) {
588 /* EIR Data type */
589 if (name_len > 48) {
590 name_len = 48;
591 ptr[1] = EIR_NAME_SHORT;
592 } else
593 ptr[1] = EIR_NAME_COMPLETE;
594
595 /* EIR Data length */
596 ptr[0] = name_len + 1;
597
598 memcpy(ptr + 2, hdev->dev_name, name_len);
599
600 ptr += (name_len + 2);
601 }
602
603 if (hdev->inq_tx_power != HCI_TX_POWER_INVALID) {
604 ptr[0] = 2;
605 ptr[1] = EIR_TX_POWER;
606 ptr[2] = (u8) hdev->inq_tx_power;
607
608 ptr += 3;
609 }
610
611 if (hdev->devid_source > 0) {
612 ptr[0] = 9;
613 ptr[1] = EIR_DEVICE_ID;
614
615 put_unaligned_le16(hdev->devid_source, ptr + 2);
616 put_unaligned_le16(hdev->devid_vendor, ptr + 4);
617 put_unaligned_le16(hdev->devid_product, ptr + 6);
618 put_unaligned_le16(hdev->devid_version, ptr + 8);
619
620 ptr += 10;
621 }
622
623 ptr = create_uuid16_list(hdev, ptr, HCI_MAX_EIR_LENGTH - (ptr - data));
624 ptr = create_uuid32_list(hdev, ptr, HCI_MAX_EIR_LENGTH - (ptr - data));
625 ptr = create_uuid128_list(hdev, ptr, HCI_MAX_EIR_LENGTH - (ptr - data));
626 }
627
628 void __hci_req_update_eir(struct hci_request *req)
629 {
630 struct hci_dev *hdev = req->hdev;
631 struct hci_cp_write_eir cp;
632
633 if (!hdev_is_powered(hdev))
634 return;
635
636 if (!lmp_ext_inq_capable(hdev))
637 return;
638
639 if (!hci_dev_test_flag(hdev, HCI_SSP_ENABLED))
640 return;
641
642 if (hci_dev_test_flag(hdev, HCI_SERVICE_CACHE))
643 return;
644
645 memset(&cp, 0, sizeof(cp));
646
647 create_eir(hdev, cp.data);
648
649 if (memcmp(cp.data, hdev->eir, sizeof(cp.data)) == 0)
650 return;
651
652 memcpy(hdev->eir, cp.data, sizeof(cp.data));
653
654 hci_req_add(req, HCI_OP_WRITE_EIR, sizeof(cp), &cp);
655 }
656
657 void hci_req_add_le_scan_disable(struct hci_request *req)
658 {
659 struct hci_cp_le_set_scan_enable cp;
660
661 memset(&cp, 0, sizeof(cp));
662 cp.enable = LE_SCAN_DISABLE;
663 hci_req_add(req, HCI_OP_LE_SET_SCAN_ENABLE, sizeof(cp), &cp);
664 }
665
666 static void add_to_white_list(struct hci_request *req,
667 struct hci_conn_params *params)
668 {
669 struct hci_cp_le_add_to_white_list cp;
670
671 cp.bdaddr_type = params->addr_type;
672 bacpy(&cp.bdaddr, &params->addr);
673
674 hci_req_add(req, HCI_OP_LE_ADD_TO_WHITE_LIST, sizeof(cp), &cp);
675 }
676
677 static u8 update_white_list(struct hci_request *req)
678 {
679 struct hci_dev *hdev = req->hdev;
680 struct hci_conn_params *params;
681 struct bdaddr_list *b;
682 uint8_t white_list_entries = 0;
683
684 /* Go through the current white list programmed into the
685 * controller one by one and check if that address is still
686 * in the list of pending connections or list of devices to
687 * report. If not present in either list, then queue the
688 * command to remove it from the controller.
689 */
690 list_for_each_entry(b, &hdev->le_white_list, list) {
691 /* If the device is neither in pend_le_conns nor
692 * pend_le_reports then remove it from the whitelist.
693 */
694 if (!hci_pend_le_action_lookup(&hdev->pend_le_conns,
695 &b->bdaddr, b->bdaddr_type) &&
696 !hci_pend_le_action_lookup(&hdev->pend_le_reports,
697 &b->bdaddr, b->bdaddr_type)) {
698 struct hci_cp_le_del_from_white_list cp;
699
700 cp.bdaddr_type = b->bdaddr_type;
701 bacpy(&cp.bdaddr, &b->bdaddr);
702
703 hci_req_add(req, HCI_OP_LE_DEL_FROM_WHITE_LIST,
704 sizeof(cp), &cp);
705 continue;
706 }
707
708 if (hci_find_irk_by_addr(hdev, &b->bdaddr, b->bdaddr_type)) {
709 /* White list can not be used with RPAs */
710 return 0x00;
711 }
712
713 white_list_entries++;
714 }
715
716 /* Since all no longer valid white list entries have been
717 * removed, walk through the list of pending connections
718 * and ensure that any new device gets programmed into
719 * the controller.
720 *
721 * If the list of the devices is larger than the list of
722 * available white list entries in the controller, then
723 * just abort and return filer policy value to not use the
724 * white list.
725 */
726 list_for_each_entry(params, &hdev->pend_le_conns, action) {
727 if (hci_bdaddr_list_lookup(&hdev->le_white_list,
728 &params->addr, params->addr_type))
729 continue;
730
731 if (white_list_entries >= hdev->le_white_list_size) {
732 /* Select filter policy to accept all advertising */
733 return 0x00;
734 }
735
736 if (hci_find_irk_by_addr(hdev, &params->addr,
737 params->addr_type)) {
738 /* White list can not be used with RPAs */
739 return 0x00;
740 }
741
742 white_list_entries++;
743 add_to_white_list(req, params);
744 }
745
746 /* After adding all new pending connections, walk through
747 * the list of pending reports and also add these to the
748 * white list if there is still space.
749 */
750 list_for_each_entry(params, &hdev->pend_le_reports, action) {
751 if (hci_bdaddr_list_lookup(&hdev->le_white_list,
752 &params->addr, params->addr_type))
753 continue;
754
755 if (white_list_entries >= hdev->le_white_list_size) {
756 /* Select filter policy to accept all advertising */
757 return 0x00;
758 }
759
760 if (hci_find_irk_by_addr(hdev, &params->addr,
761 params->addr_type)) {
762 /* White list can not be used with RPAs */
763 return 0x00;
764 }
765
766 white_list_entries++;
767 add_to_white_list(req, params);
768 }
769
770 /* Select filter policy to use white list */
771 return 0x01;
772 }
773
774 void hci_req_add_le_passive_scan(struct hci_request *req)
775 {
776 struct hci_cp_le_set_scan_param param_cp;
777 struct hci_cp_le_set_scan_enable enable_cp;
778 struct hci_dev *hdev = req->hdev;
779 u8 own_addr_type;
780 u8 filter_policy;
781
782 /* Set require_privacy to false since no SCAN_REQ are send
783 * during passive scanning. Not using an non-resolvable address
784 * here is important so that peer devices using direct
785 * advertising with our address will be correctly reported
786 * by the controller.
787 */
788 if (hci_update_random_address(req, false, &own_addr_type))
789 return;
790
791 /* Adding or removing entries from the white list must
792 * happen before enabling scanning. The controller does
793 * not allow white list modification while scanning.
794 */
795 filter_policy = update_white_list(req);
796
797 /* When the controller is using random resolvable addresses and
798 * with that having LE privacy enabled, then controllers with
799 * Extended Scanner Filter Policies support can now enable support
800 * for handling directed advertising.
801 *
802 * So instead of using filter polices 0x00 (no whitelist)
803 * and 0x01 (whitelist enabled) use the new filter policies
804 * 0x02 (no whitelist) and 0x03 (whitelist enabled).
805 */
806 if (hci_dev_test_flag(hdev, HCI_PRIVACY) &&
807 (hdev->le_features[0] & HCI_LE_EXT_SCAN_POLICY))
808 filter_policy |= 0x02;
809
810 memset(&param_cp, 0, sizeof(param_cp));
811 param_cp.type = LE_SCAN_PASSIVE;
812 param_cp.interval = cpu_to_le16(hdev->le_scan_interval);
813 param_cp.window = cpu_to_le16(hdev->le_scan_window);
814 param_cp.own_address_type = own_addr_type;
815 param_cp.filter_policy = filter_policy;
816 hci_req_add(req, HCI_OP_LE_SET_SCAN_PARAM, sizeof(param_cp),
817 &param_cp);
818
819 memset(&enable_cp, 0, sizeof(enable_cp));
820 enable_cp.enable = LE_SCAN_ENABLE;
821 enable_cp.filter_dup = LE_SCAN_FILTER_DUP_ENABLE;
822 hci_req_add(req, HCI_OP_LE_SET_SCAN_ENABLE, sizeof(enable_cp),
823 &enable_cp);
824 }
825
826 static u8 get_cur_adv_instance_scan_rsp_len(struct hci_dev *hdev)
827 {
828 u8 instance = hdev->cur_adv_instance;
829 struct adv_info *adv_instance;
830
831 /* Ignore instance 0 */
832 if (instance == 0x00)
833 return 0;
834
835 adv_instance = hci_find_adv_instance(hdev, instance);
836 if (!adv_instance)
837 return 0;
838
839 /* TODO: Take into account the "appearance" and "local-name" flags here.
840 * These are currently being ignored as they are not supported.
841 */
842 return adv_instance->scan_rsp_len;
843 }
844
845 void __hci_req_disable_advertising(struct hci_request *req)
846 {
847 u8 enable = 0x00;
848
849 hci_req_add(req, HCI_OP_LE_SET_ADV_ENABLE, sizeof(enable), &enable);
850 }
851
852 static u32 get_adv_instance_flags(struct hci_dev *hdev, u8 instance)
853 {
854 u32 flags;
855 struct adv_info *adv_instance;
856
857 if (instance == 0x00) {
858 /* Instance 0 always manages the "Tx Power" and "Flags"
859 * fields
860 */
861 flags = MGMT_ADV_FLAG_TX_POWER | MGMT_ADV_FLAG_MANAGED_FLAGS;
862
863 /* For instance 0, the HCI_ADVERTISING_CONNECTABLE setting
864 * corresponds to the "connectable" instance flag.
865 */
866 if (hci_dev_test_flag(hdev, HCI_ADVERTISING_CONNECTABLE))
867 flags |= MGMT_ADV_FLAG_CONNECTABLE;
868
869 return flags;
870 }
871
872 adv_instance = hci_find_adv_instance(hdev, instance);
873
874 /* Return 0 when we got an invalid instance identifier. */
875 if (!adv_instance)
876 return 0;
877
878 return adv_instance->flags;
879 }
880
881 void __hci_req_enable_advertising(struct hci_request *req)
882 {
883 struct hci_dev *hdev = req->hdev;
884 struct hci_cp_le_set_adv_param cp;
885 u8 own_addr_type, enable = 0x01;
886 bool connectable;
887 u32 flags;
888
889 if (hci_conn_num(hdev, LE_LINK) > 0)
890 return;
891
892 if (hci_dev_test_flag(hdev, HCI_LE_ADV))
893 __hci_req_disable_advertising(req);
894
895 /* Clear the HCI_LE_ADV bit temporarily so that the
896 * hci_update_random_address knows that it's safe to go ahead
897 * and write a new random address. The flag will be set back on
898 * as soon as the SET_ADV_ENABLE HCI command completes.
899 */
900 hci_dev_clear_flag(hdev, HCI_LE_ADV);
901
902 flags = get_adv_instance_flags(hdev, hdev->cur_adv_instance);
903
904 /* If the "connectable" instance flag was not set, then choose between
905 * ADV_IND and ADV_NONCONN_IND based on the global connectable setting.
906 */
907 connectable = (flags & MGMT_ADV_FLAG_CONNECTABLE) ||
908 mgmt_get_connectable(hdev);
909
910 /* Set require_privacy to true only when non-connectable
911 * advertising is used. In that case it is fine to use a
912 * non-resolvable private address.
913 */
914 if (hci_update_random_address(req, !connectable, &own_addr_type) < 0)
915 return;
916
917 memset(&cp, 0, sizeof(cp));
918 cp.min_interval = cpu_to_le16(hdev->le_adv_min_interval);
919 cp.max_interval = cpu_to_le16(hdev->le_adv_max_interval);
920
921 if (connectable)
922 cp.type = LE_ADV_IND;
923 else if (get_cur_adv_instance_scan_rsp_len(hdev))
924 cp.type = LE_ADV_SCAN_IND;
925 else
926 cp.type = LE_ADV_NONCONN_IND;
927
928 cp.own_address_type = own_addr_type;
929 cp.channel_map = hdev->le_adv_channel_map;
930
931 hci_req_add(req, HCI_OP_LE_SET_ADV_PARAM, sizeof(cp), &cp);
932
933 hci_req_add(req, HCI_OP_LE_SET_ADV_ENABLE, sizeof(enable), &enable);
934 }
935
936 static u8 create_default_scan_rsp_data(struct hci_dev *hdev, u8 *ptr)
937 {
938 u8 ad_len = 0;
939 size_t name_len;
940
941 name_len = strlen(hdev->dev_name);
942 if (name_len > 0) {
943 size_t max_len = HCI_MAX_AD_LENGTH - ad_len - 2;
944
945 if (name_len > max_len) {
946 name_len = max_len;
947 ptr[1] = EIR_NAME_SHORT;
948 } else
949 ptr[1] = EIR_NAME_COMPLETE;
950
951 ptr[0] = name_len + 1;
952
953 memcpy(ptr + 2, hdev->dev_name, name_len);
954
955 ad_len += (name_len + 2);
956 ptr += (name_len + 2);
957 }
958
959 return ad_len;
960 }
961
962 static u8 create_instance_scan_rsp_data(struct hci_dev *hdev, u8 instance,
963 u8 *ptr)
964 {
965 struct adv_info *adv_instance;
966
967 adv_instance = hci_find_adv_instance(hdev, instance);
968 if (!adv_instance)
969 return 0;
970
971 /* TODO: Set the appropriate entries based on advertising instance flags
972 * here once flags other than 0 are supported.
973 */
974 memcpy(ptr, adv_instance->scan_rsp_data,
975 adv_instance->scan_rsp_len);
976
977 return adv_instance->scan_rsp_len;
978 }
979
980 void __hci_req_update_scan_rsp_data(struct hci_request *req, u8 instance)
981 {
982 struct hci_dev *hdev = req->hdev;
983 struct hci_cp_le_set_scan_rsp_data cp;
984 u8 len;
985
986 if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED))
987 return;
988
989 memset(&cp, 0, sizeof(cp));
990
991 if (instance)
992 len = create_instance_scan_rsp_data(hdev, instance, cp.data);
993 else
994 len = create_default_scan_rsp_data(hdev, cp.data);
995
996 if (hdev->scan_rsp_data_len == len &&
997 !memcmp(cp.data, hdev->scan_rsp_data, len))
998 return;
999
1000 memcpy(hdev->scan_rsp_data, cp.data, sizeof(cp.data));
1001 hdev->scan_rsp_data_len = len;
1002
1003 cp.length = len;
1004
1005 hci_req_add(req, HCI_OP_LE_SET_SCAN_RSP_DATA, sizeof(cp), &cp);
1006 }
1007
1008 static u8 create_instance_adv_data(struct hci_dev *hdev, u8 instance, u8 *ptr)
1009 {
1010 struct adv_info *adv_instance = NULL;
1011 u8 ad_len = 0, flags = 0;
1012 u32 instance_flags;
1013
1014 /* Return 0 when the current instance identifier is invalid. */
1015 if (instance) {
1016 adv_instance = hci_find_adv_instance(hdev, instance);
1017 if (!adv_instance)
1018 return 0;
1019 }
1020
1021 instance_flags = get_adv_instance_flags(hdev, instance);
1022
1023 /* The Add Advertising command allows userspace to set both the general
1024 * and limited discoverable flags.
1025 */
1026 if (instance_flags & MGMT_ADV_FLAG_DISCOV)
1027 flags |= LE_AD_GENERAL;
1028
1029 if (instance_flags & MGMT_ADV_FLAG_LIMITED_DISCOV)
1030 flags |= LE_AD_LIMITED;
1031
1032 if (flags || (instance_flags & MGMT_ADV_FLAG_MANAGED_FLAGS)) {
1033 /* If a discovery flag wasn't provided, simply use the global
1034 * settings.
1035 */
1036 if (!flags)
1037 flags |= mgmt_get_adv_discov_flags(hdev);
1038
1039 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
1040 flags |= LE_AD_NO_BREDR;
1041
1042 /* If flags would still be empty, then there is no need to
1043 * include the "Flags" AD field".
1044 */
1045 if (flags) {
1046 ptr[0] = 0x02;
1047 ptr[1] = EIR_FLAGS;
1048 ptr[2] = flags;
1049
1050 ad_len += 3;
1051 ptr += 3;
1052 }
1053 }
1054
1055 if (adv_instance) {
1056 memcpy(ptr, adv_instance->adv_data,
1057 adv_instance->adv_data_len);
1058 ad_len += adv_instance->adv_data_len;
1059 ptr += adv_instance->adv_data_len;
1060 }
1061
1062 /* Provide Tx Power only if we can provide a valid value for it */
1063 if (hdev->adv_tx_power != HCI_TX_POWER_INVALID &&
1064 (instance_flags & MGMT_ADV_FLAG_TX_POWER)) {
1065 ptr[0] = 0x02;
1066 ptr[1] = EIR_TX_POWER;
1067 ptr[2] = (u8)hdev->adv_tx_power;
1068
1069 ad_len += 3;
1070 ptr += 3;
1071 }
1072
1073 return ad_len;
1074 }
1075
1076 void __hci_req_update_adv_data(struct hci_request *req, u8 instance)
1077 {
1078 struct hci_dev *hdev = req->hdev;
1079 struct hci_cp_le_set_adv_data cp;
1080 u8 len;
1081
1082 if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED))
1083 return;
1084
1085 memset(&cp, 0, sizeof(cp));
1086
1087 len = create_instance_adv_data(hdev, instance, cp.data);
1088
1089 /* There's nothing to do if the data hasn't changed */
1090 if (hdev->adv_data_len == len &&
1091 memcmp(cp.data, hdev->adv_data, len) == 0)
1092 return;
1093
1094 memcpy(hdev->adv_data, cp.data, sizeof(cp.data));
1095 hdev->adv_data_len = len;
1096
1097 cp.length = len;
1098
1099 hci_req_add(req, HCI_OP_LE_SET_ADV_DATA, sizeof(cp), &cp);
1100 }
1101
1102 int hci_req_update_adv_data(struct hci_dev *hdev, u8 instance)
1103 {
1104 struct hci_request req;
1105
1106 hci_req_init(&req, hdev);
1107 __hci_req_update_adv_data(&req, instance);
1108
1109 return hci_req_run(&req, NULL);
1110 }
1111
1112 static void adv_enable_complete(struct hci_dev *hdev, u8 status, u16 opcode)
1113 {
1114 BT_DBG("%s status %u", hdev->name, status);
1115 }
1116
1117 void hci_req_reenable_advertising(struct hci_dev *hdev)
1118 {
1119 struct hci_request req;
1120
1121 if (!hci_dev_test_flag(hdev, HCI_ADVERTISING) &&
1122 list_empty(&hdev->adv_instances))
1123 return;
1124
1125 hci_req_init(&req, hdev);
1126
1127 if (hdev->cur_adv_instance) {
1128 __hci_req_schedule_adv_instance(&req, hdev->cur_adv_instance,
1129 true);
1130 } else {
1131 __hci_req_update_adv_data(&req, 0x00);
1132 __hci_req_update_scan_rsp_data(&req, 0x00);
1133 __hci_req_enable_advertising(&req);
1134 }
1135
1136 hci_req_run(&req, adv_enable_complete);
1137 }
1138
1139 static void adv_timeout_expire(struct work_struct *work)
1140 {
1141 struct hci_dev *hdev = container_of(work, struct hci_dev,
1142 adv_instance_expire.work);
1143
1144 struct hci_request req;
1145 u8 instance;
1146
1147 BT_DBG("%s", hdev->name);
1148
1149 hci_dev_lock(hdev);
1150
1151 hdev->adv_instance_timeout = 0;
1152
1153 instance = hdev->cur_adv_instance;
1154 if (instance == 0x00)
1155 goto unlock;
1156
1157 hci_req_init(&req, hdev);
1158
1159 hci_req_clear_adv_instance(hdev, &req, instance, false);
1160
1161 if (list_empty(&hdev->adv_instances))
1162 __hci_req_disable_advertising(&req);
1163
1164 hci_req_run(&req, NULL);
1165
1166 unlock:
1167 hci_dev_unlock(hdev);
1168 }
1169
1170 int __hci_req_schedule_adv_instance(struct hci_request *req, u8 instance,
1171 bool force)
1172 {
1173 struct hci_dev *hdev = req->hdev;
1174 struct adv_info *adv_instance = NULL;
1175 u16 timeout;
1176
1177 if (hci_dev_test_flag(hdev, HCI_ADVERTISING) ||
1178 list_empty(&hdev->adv_instances))
1179 return -EPERM;
1180
1181 if (hdev->adv_instance_timeout)
1182 return -EBUSY;
1183
1184 adv_instance = hci_find_adv_instance(hdev, instance);
1185 if (!adv_instance)
1186 return -ENOENT;
1187
1188 /* A zero timeout means unlimited advertising. As long as there is
1189 * only one instance, duration should be ignored. We still set a timeout
1190 * in case further instances are being added later on.
1191 *
1192 * If the remaining lifetime of the instance is more than the duration
1193 * then the timeout corresponds to the duration, otherwise it will be
1194 * reduced to the remaining instance lifetime.
1195 */
1196 if (adv_instance->timeout == 0 ||
1197 adv_instance->duration <= adv_instance->remaining_time)
1198 timeout = adv_instance->duration;
1199 else
1200 timeout = adv_instance->remaining_time;
1201
1202 /* The remaining time is being reduced unless the instance is being
1203 * advertised without time limit.
1204 */
1205 if (adv_instance->timeout)
1206 adv_instance->remaining_time =
1207 adv_instance->remaining_time - timeout;
1208
1209 hdev->adv_instance_timeout = timeout;
1210 queue_delayed_work(hdev->req_workqueue,
1211 &hdev->adv_instance_expire,
1212 msecs_to_jiffies(timeout * 1000));
1213
1214 /* If we're just re-scheduling the same instance again then do not
1215 * execute any HCI commands. This happens when a single instance is
1216 * being advertised.
1217 */
1218 if (!force && hdev->cur_adv_instance == instance &&
1219 hci_dev_test_flag(hdev, HCI_LE_ADV))
1220 return 0;
1221
1222 hdev->cur_adv_instance = instance;
1223 __hci_req_update_adv_data(req, instance);
1224 __hci_req_update_scan_rsp_data(req, instance);
1225 __hci_req_enable_advertising(req);
1226
1227 return 0;
1228 }
1229
1230 static void cancel_adv_timeout(struct hci_dev *hdev)
1231 {
1232 if (hdev->adv_instance_timeout) {
1233 hdev->adv_instance_timeout = 0;
1234 cancel_delayed_work(&hdev->adv_instance_expire);
1235 }
1236 }
1237
1238 /* For a single instance:
1239 * - force == true: The instance will be removed even when its remaining
1240 * lifetime is not zero.
1241 * - force == false: the instance will be deactivated but kept stored unless
1242 * the remaining lifetime is zero.
1243 *
1244 * For instance == 0x00:
1245 * - force == true: All instances will be removed regardless of their timeout
1246 * setting.
1247 * - force == false: Only instances that have a timeout will be removed.
1248 */
1249 void hci_req_clear_adv_instance(struct hci_dev *hdev, struct hci_request *req,
1250 u8 instance, bool force)
1251 {
1252 struct adv_info *adv_instance, *n, *next_instance = NULL;
1253 int err;
1254 u8 rem_inst;
1255
1256 /* Cancel any timeout concerning the removed instance(s). */
1257 if (!instance || hdev->cur_adv_instance == instance)
1258 cancel_adv_timeout(hdev);
1259
1260 /* Get the next instance to advertise BEFORE we remove
1261 * the current one. This can be the same instance again
1262 * if there is only one instance.
1263 */
1264 if (instance && hdev->cur_adv_instance == instance)
1265 next_instance = hci_get_next_instance(hdev, instance);
1266
1267 if (instance == 0x00) {
1268 list_for_each_entry_safe(adv_instance, n, &hdev->adv_instances,
1269 list) {
1270 if (!(force || adv_instance->timeout))
1271 continue;
1272
1273 rem_inst = adv_instance->instance;
1274 err = hci_remove_adv_instance(hdev, rem_inst);
1275 if (!err)
1276 mgmt_advertising_removed(NULL, hdev, rem_inst);
1277 }
1278 } else {
1279 adv_instance = hci_find_adv_instance(hdev, instance);
1280
1281 if (force || (adv_instance && adv_instance->timeout &&
1282 !adv_instance->remaining_time)) {
1283 /* Don't advertise a removed instance. */
1284 if (next_instance &&
1285 next_instance->instance == instance)
1286 next_instance = NULL;
1287
1288 err = hci_remove_adv_instance(hdev, instance);
1289 if (!err)
1290 mgmt_advertising_removed(NULL, hdev, instance);
1291 }
1292 }
1293
1294 if (!req || !hdev_is_powered(hdev) ||
1295 hci_dev_test_flag(hdev, HCI_ADVERTISING))
1296 return;
1297
1298 if (next_instance)
1299 __hci_req_schedule_adv_instance(req, next_instance->instance,
1300 false);
1301 }
1302
1303 static void set_random_addr(struct hci_request *req, bdaddr_t *rpa)
1304 {
1305 struct hci_dev *hdev = req->hdev;
1306
1307 /* If we're advertising or initiating an LE connection we can't
1308 * go ahead and change the random address at this time. This is
1309 * because the eventual initiator address used for the
1310 * subsequently created connection will be undefined (some
1311 * controllers use the new address and others the one we had
1312 * when the operation started).
1313 *
1314 * In this kind of scenario skip the update and let the random
1315 * address be updated at the next cycle.
1316 */
1317 if (hci_dev_test_flag(hdev, HCI_LE_ADV) ||
1318 hci_lookup_le_connect(hdev)) {
1319 BT_DBG("Deferring random address update");
1320 hci_dev_set_flag(hdev, HCI_RPA_EXPIRED);
1321 return;
1322 }
1323
1324 hci_req_add(req, HCI_OP_LE_SET_RANDOM_ADDR, 6, rpa);
1325 }
1326
1327 int hci_update_random_address(struct hci_request *req, bool require_privacy,
1328 u8 *own_addr_type)
1329 {
1330 struct hci_dev *hdev = req->hdev;
1331 int err;
1332
1333 /* If privacy is enabled use a resolvable private address. If
1334 * current RPA has expired or there is something else than
1335 * the current RPA in use, then generate a new one.
1336 */
1337 if (hci_dev_test_flag(hdev, HCI_PRIVACY)) {
1338 int to;
1339
1340 *own_addr_type = ADDR_LE_DEV_RANDOM;
1341
1342 if (!hci_dev_test_and_clear_flag(hdev, HCI_RPA_EXPIRED) &&
1343 !bacmp(&hdev->random_addr, &hdev->rpa))
1344 return 0;
1345
1346 err = smp_generate_rpa(hdev, hdev->irk, &hdev->rpa);
1347 if (err < 0) {
1348 BT_ERR("%s failed to generate new RPA", hdev->name);
1349 return err;
1350 }
1351
1352 set_random_addr(req, &hdev->rpa);
1353
1354 to = msecs_to_jiffies(hdev->rpa_timeout * 1000);
1355 queue_delayed_work(hdev->workqueue, &hdev->rpa_expired, to);
1356
1357 return 0;
1358 }
1359
1360 /* In case of required privacy without resolvable private address,
1361 * use an non-resolvable private address. This is useful for active
1362 * scanning and non-connectable advertising.
1363 */
1364 if (require_privacy) {
1365 bdaddr_t nrpa;
1366
1367 while (true) {
1368 /* The non-resolvable private address is generated
1369 * from random six bytes with the two most significant
1370 * bits cleared.
1371 */
1372 get_random_bytes(&nrpa, 6);
1373 nrpa.b[5] &= 0x3f;
1374
1375 /* The non-resolvable private address shall not be
1376 * equal to the public address.
1377 */
1378 if (bacmp(&hdev->bdaddr, &nrpa))
1379 break;
1380 }
1381
1382 *own_addr_type = ADDR_LE_DEV_RANDOM;
1383 set_random_addr(req, &nrpa);
1384 return 0;
1385 }
1386
1387 /* If forcing static address is in use or there is no public
1388 * address use the static address as random address (but skip
1389 * the HCI command if the current random address is already the
1390 * static one.
1391 *
1392 * In case BR/EDR has been disabled on a dual-mode controller
1393 * and a static address has been configured, then use that
1394 * address instead of the public BR/EDR address.
1395 */
1396 if (hci_dev_test_flag(hdev, HCI_FORCE_STATIC_ADDR) ||
1397 !bacmp(&hdev->bdaddr, BDADDR_ANY) ||
1398 (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) &&
1399 bacmp(&hdev->static_addr, BDADDR_ANY))) {
1400 *own_addr_type = ADDR_LE_DEV_RANDOM;
1401 if (bacmp(&hdev->static_addr, &hdev->random_addr))
1402 hci_req_add(req, HCI_OP_LE_SET_RANDOM_ADDR, 6,
1403 &hdev->static_addr);
1404 return 0;
1405 }
1406
1407 /* Neither privacy nor static address is being used so use a
1408 * public address.
1409 */
1410 *own_addr_type = ADDR_LE_DEV_PUBLIC;
1411
1412 return 0;
1413 }
1414
1415 static bool disconnected_whitelist_entries(struct hci_dev *hdev)
1416 {
1417 struct bdaddr_list *b;
1418
1419 list_for_each_entry(b, &hdev->whitelist, list) {
1420 struct hci_conn *conn;
1421
1422 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &b->bdaddr);
1423 if (!conn)
1424 return true;
1425
1426 if (conn->state != BT_CONNECTED && conn->state != BT_CONFIG)
1427 return true;
1428 }
1429
1430 return false;
1431 }
1432
1433 void __hci_req_update_scan(struct hci_request *req)
1434 {
1435 struct hci_dev *hdev = req->hdev;
1436 u8 scan;
1437
1438 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
1439 return;
1440
1441 if (!hdev_is_powered(hdev))
1442 return;
1443
1444 if (mgmt_powering_down(hdev))
1445 return;
1446
1447 if (hci_dev_test_flag(hdev, HCI_CONNECTABLE) ||
1448 disconnected_whitelist_entries(hdev))
1449 scan = SCAN_PAGE;
1450 else
1451 scan = SCAN_DISABLED;
1452
1453 if (hci_dev_test_flag(hdev, HCI_DISCOVERABLE))
1454 scan |= SCAN_INQUIRY;
1455
1456 if (test_bit(HCI_PSCAN, &hdev->flags) == !!(scan & SCAN_PAGE) &&
1457 test_bit(HCI_ISCAN, &hdev->flags) == !!(scan & SCAN_INQUIRY))
1458 return;
1459
1460 hci_req_add(req, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
1461 }
1462
1463 static int update_scan(struct hci_request *req, unsigned long opt)
1464 {
1465 hci_dev_lock(req->hdev);
1466 __hci_req_update_scan(req);
1467 hci_dev_unlock(req->hdev);
1468 return 0;
1469 }
1470
1471 static void scan_update_work(struct work_struct *work)
1472 {
1473 struct hci_dev *hdev = container_of(work, struct hci_dev, scan_update);
1474
1475 hci_req_sync(hdev, update_scan, 0, HCI_CMD_TIMEOUT, NULL);
1476 }
1477
1478 static int connectable_update(struct hci_request *req, unsigned long opt)
1479 {
1480 struct hci_dev *hdev = req->hdev;
1481
1482 hci_dev_lock(hdev);
1483
1484 __hci_req_update_scan(req);
1485
1486 /* If BR/EDR is not enabled and we disable advertising as a
1487 * by-product of disabling connectable, we need to update the
1488 * advertising flags.
1489 */
1490 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
1491 __hci_req_update_adv_data(req, hdev->cur_adv_instance);
1492
1493 /* Update the advertising parameters if necessary */
1494 if (hci_dev_test_flag(hdev, HCI_ADVERTISING) ||
1495 !list_empty(&hdev->adv_instances))
1496 __hci_req_enable_advertising(req);
1497
1498 __hci_update_background_scan(req);
1499
1500 hci_dev_unlock(hdev);
1501
1502 return 0;
1503 }
1504
1505 static void connectable_update_work(struct work_struct *work)
1506 {
1507 struct hci_dev *hdev = container_of(work, struct hci_dev,
1508 connectable_update);
1509 u8 status;
1510
1511 hci_req_sync(hdev, connectable_update, 0, HCI_CMD_TIMEOUT, &status);
1512 mgmt_set_connectable_complete(hdev, status);
1513 }
1514
1515 static u8 get_service_classes(struct hci_dev *hdev)
1516 {
1517 struct bt_uuid *uuid;
1518 u8 val = 0;
1519
1520 list_for_each_entry(uuid, &hdev->uuids, list)
1521 val |= uuid->svc_hint;
1522
1523 return val;
1524 }
1525
1526 void __hci_req_update_class(struct hci_request *req)
1527 {
1528 struct hci_dev *hdev = req->hdev;
1529 u8 cod[3];
1530
1531 BT_DBG("%s", hdev->name);
1532
1533 if (!hdev_is_powered(hdev))
1534 return;
1535
1536 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
1537 return;
1538
1539 if (hci_dev_test_flag(hdev, HCI_SERVICE_CACHE))
1540 return;
1541
1542 cod[0] = hdev->minor_class;
1543 cod[1] = hdev->major_class;
1544 cod[2] = get_service_classes(hdev);
1545
1546 if (hci_dev_test_flag(hdev, HCI_LIMITED_DISCOVERABLE))
1547 cod[1] |= 0x20;
1548
1549 if (memcmp(cod, hdev->dev_class, 3) == 0)
1550 return;
1551
1552 hci_req_add(req, HCI_OP_WRITE_CLASS_OF_DEV, sizeof(cod), cod);
1553 }
1554
1555 static void write_iac(struct hci_request *req)
1556 {
1557 struct hci_dev *hdev = req->hdev;
1558 struct hci_cp_write_current_iac_lap cp;
1559
1560 if (!hci_dev_test_flag(hdev, HCI_DISCOVERABLE))
1561 return;
1562
1563 if (hci_dev_test_flag(hdev, HCI_LIMITED_DISCOVERABLE)) {
1564 /* Limited discoverable mode */
1565 cp.num_iac = min_t(u8, hdev->num_iac, 2);
1566 cp.iac_lap[0] = 0x00; /* LIAC */
1567 cp.iac_lap[1] = 0x8b;
1568 cp.iac_lap[2] = 0x9e;
1569 cp.iac_lap[3] = 0x33; /* GIAC */
1570 cp.iac_lap[4] = 0x8b;
1571 cp.iac_lap[5] = 0x9e;
1572 } else {
1573 /* General discoverable mode */
1574 cp.num_iac = 1;
1575 cp.iac_lap[0] = 0x33; /* GIAC */
1576 cp.iac_lap[1] = 0x8b;
1577 cp.iac_lap[2] = 0x9e;
1578 }
1579
1580 hci_req_add(req, HCI_OP_WRITE_CURRENT_IAC_LAP,
1581 (cp.num_iac * 3) + 1, &cp);
1582 }
1583
1584 static int discoverable_update(struct hci_request *req, unsigned long opt)
1585 {
1586 struct hci_dev *hdev = req->hdev;
1587
1588 hci_dev_lock(hdev);
1589
1590 if (hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) {
1591 write_iac(req);
1592 __hci_req_update_scan(req);
1593 __hci_req_update_class(req);
1594 }
1595
1596 /* Advertising instances don't use the global discoverable setting, so
1597 * only update AD if advertising was enabled using Set Advertising.
1598 */
1599 if (hci_dev_test_flag(hdev, HCI_ADVERTISING))
1600 __hci_req_update_adv_data(req, 0x00);
1601
1602 hci_dev_unlock(hdev);
1603
1604 return 0;
1605 }
1606
1607 static void discoverable_update_work(struct work_struct *work)
1608 {
1609 struct hci_dev *hdev = container_of(work, struct hci_dev,
1610 discoverable_update);
1611 u8 status;
1612
1613 hci_req_sync(hdev, discoverable_update, 0, HCI_CMD_TIMEOUT, &status);
1614 mgmt_set_discoverable_complete(hdev, status);
1615 }
1616
1617 void __hci_abort_conn(struct hci_request *req, struct hci_conn *conn,
1618 u8 reason)
1619 {
1620 switch (conn->state) {
1621 case BT_CONNECTED:
1622 case BT_CONFIG:
1623 if (conn->type == AMP_LINK) {
1624 struct hci_cp_disconn_phy_link cp;
1625
1626 cp.phy_handle = HCI_PHY_HANDLE(conn->handle);
1627 cp.reason = reason;
1628 hci_req_add(req, HCI_OP_DISCONN_PHY_LINK, sizeof(cp),
1629 &cp);
1630 } else {
1631 struct hci_cp_disconnect dc;
1632
1633 dc.handle = cpu_to_le16(conn->handle);
1634 dc.reason = reason;
1635 hci_req_add(req, HCI_OP_DISCONNECT, sizeof(dc), &dc);
1636 }
1637
1638 conn->state = BT_DISCONN;
1639
1640 break;
1641 case BT_CONNECT:
1642 if (conn->type == LE_LINK) {
1643 if (test_bit(HCI_CONN_SCANNING, &conn->flags))
1644 break;
1645 hci_req_add(req, HCI_OP_LE_CREATE_CONN_CANCEL,
1646 0, NULL);
1647 } else if (conn->type == ACL_LINK) {
1648 if (req->hdev->hci_ver < BLUETOOTH_VER_1_2)
1649 break;
1650 hci_req_add(req, HCI_OP_CREATE_CONN_CANCEL,
1651 6, &conn->dst);
1652 }
1653 break;
1654 case BT_CONNECT2:
1655 if (conn->type == ACL_LINK) {
1656 struct hci_cp_reject_conn_req rej;
1657
1658 bacpy(&rej.bdaddr, &conn->dst);
1659 rej.reason = reason;
1660
1661 hci_req_add(req, HCI_OP_REJECT_CONN_REQ,
1662 sizeof(rej), &rej);
1663 } else if (conn->type == SCO_LINK || conn->type == ESCO_LINK) {
1664 struct hci_cp_reject_sync_conn_req rej;
1665
1666 bacpy(&rej.bdaddr, &conn->dst);
1667
1668 /* SCO rejection has its own limited set of
1669 * allowed error values (0x0D-0x0F) which isn't
1670 * compatible with most values passed to this
1671 * function. To be safe hard-code one of the
1672 * values that's suitable for SCO.
1673 */
1674 rej.reason = HCI_ERROR_REMOTE_LOW_RESOURCES;
1675
1676 hci_req_add(req, HCI_OP_REJECT_SYNC_CONN_REQ,
1677 sizeof(rej), &rej);
1678 }
1679 break;
1680 default:
1681 conn->state = BT_CLOSED;
1682 break;
1683 }
1684 }
1685
1686 static void abort_conn_complete(struct hci_dev *hdev, u8 status, u16 opcode)
1687 {
1688 if (status)
1689 BT_DBG("Failed to abort connection: status 0x%2.2x", status);
1690 }
1691
1692 int hci_abort_conn(struct hci_conn *conn, u8 reason)
1693 {
1694 struct hci_request req;
1695 int err;
1696
1697 hci_req_init(&req, conn->hdev);
1698
1699 __hci_abort_conn(&req, conn, reason);
1700
1701 err = hci_req_run(&req, abort_conn_complete);
1702 if (err && err != -ENODATA) {
1703 BT_ERR("Failed to run HCI request: err %d", err);
1704 return err;
1705 }
1706
1707 return 0;
1708 }
1709
1710 static int update_bg_scan(struct hci_request *req, unsigned long opt)
1711 {
1712 hci_dev_lock(req->hdev);
1713 __hci_update_background_scan(req);
1714 hci_dev_unlock(req->hdev);
1715 return 0;
1716 }
1717
1718 static void bg_scan_update(struct work_struct *work)
1719 {
1720 struct hci_dev *hdev = container_of(work, struct hci_dev,
1721 bg_scan_update);
1722 struct hci_conn *conn;
1723 u8 status;
1724 int err;
1725
1726 err = hci_req_sync(hdev, update_bg_scan, 0, HCI_CMD_TIMEOUT, &status);
1727 if (!err)
1728 return;
1729
1730 hci_dev_lock(hdev);
1731
1732 conn = hci_conn_hash_lookup_state(hdev, LE_LINK, BT_CONNECT);
1733 if (conn)
1734 hci_le_conn_failed(conn, status);
1735
1736 hci_dev_unlock(hdev);
1737 }
1738
1739 static int le_scan_disable(struct hci_request *req, unsigned long opt)
1740 {
1741 hci_req_add_le_scan_disable(req);
1742 return 0;
1743 }
1744
1745 static int bredr_inquiry(struct hci_request *req, unsigned long opt)
1746 {
1747 u8 length = opt;
1748 const u8 giac[3] = { 0x33, 0x8b, 0x9e };
1749 const u8 liac[3] = { 0x00, 0x8b, 0x9e };
1750 struct hci_cp_inquiry cp;
1751
1752 BT_DBG("%s", req->hdev->name);
1753
1754 hci_dev_lock(req->hdev);
1755 hci_inquiry_cache_flush(req->hdev);
1756 hci_dev_unlock(req->hdev);
1757
1758 memset(&cp, 0, sizeof(cp));
1759
1760 if (req->hdev->discovery.limited)
1761 memcpy(&cp.lap, liac, sizeof(cp.lap));
1762 else
1763 memcpy(&cp.lap, giac, sizeof(cp.lap));
1764
1765 cp.length = length;
1766
1767 hci_req_add(req, HCI_OP_INQUIRY, sizeof(cp), &cp);
1768
1769 return 0;
1770 }
1771
1772 static void le_scan_disable_work(struct work_struct *work)
1773 {
1774 struct hci_dev *hdev = container_of(work, struct hci_dev,
1775 le_scan_disable.work);
1776 u8 status;
1777
1778 BT_DBG("%s", hdev->name);
1779
1780 if (!hci_dev_test_flag(hdev, HCI_LE_SCAN))
1781 return;
1782
1783 cancel_delayed_work(&hdev->le_scan_restart);
1784
1785 hci_req_sync(hdev, le_scan_disable, 0, HCI_CMD_TIMEOUT, &status);
1786 if (status) {
1787 BT_ERR("Failed to disable LE scan: status 0x%02x", status);
1788 return;
1789 }
1790
1791 hdev->discovery.scan_start = 0;
1792
1793 /* If we were running LE only scan, change discovery state. If
1794 * we were running both LE and BR/EDR inquiry simultaneously,
1795 * and BR/EDR inquiry is already finished, stop discovery,
1796 * otherwise BR/EDR inquiry will stop discovery when finished.
1797 * If we will resolve remote device name, do not change
1798 * discovery state.
1799 */
1800
1801 if (hdev->discovery.type == DISCOV_TYPE_LE)
1802 goto discov_stopped;
1803
1804 if (hdev->discovery.type != DISCOV_TYPE_INTERLEAVED)
1805 return;
1806
1807 if (test_bit(HCI_QUIRK_SIMULTANEOUS_DISCOVERY, &hdev->quirks)) {
1808 if (!test_bit(HCI_INQUIRY, &hdev->flags) &&
1809 hdev->discovery.state != DISCOVERY_RESOLVING)
1810 goto discov_stopped;
1811
1812 return;
1813 }
1814
1815 hci_req_sync(hdev, bredr_inquiry, DISCOV_INTERLEAVED_INQUIRY_LEN,
1816 HCI_CMD_TIMEOUT, &status);
1817 if (status) {
1818 BT_ERR("Inquiry failed: status 0x%02x", status);
1819 goto discov_stopped;
1820 }
1821
1822 return;
1823
1824 discov_stopped:
1825 hci_dev_lock(hdev);
1826 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
1827 hci_dev_unlock(hdev);
1828 }
1829
1830 static int le_scan_restart(struct hci_request *req, unsigned long opt)
1831 {
1832 struct hci_dev *hdev = req->hdev;
1833 struct hci_cp_le_set_scan_enable cp;
1834
1835 /* If controller is not scanning we are done. */
1836 if (!hci_dev_test_flag(hdev, HCI_LE_SCAN))
1837 return 0;
1838
1839 hci_req_add_le_scan_disable(req);
1840
1841 memset(&cp, 0, sizeof(cp));
1842 cp.enable = LE_SCAN_ENABLE;
1843 cp.filter_dup = LE_SCAN_FILTER_DUP_ENABLE;
1844 hci_req_add(req, HCI_OP_LE_SET_SCAN_ENABLE, sizeof(cp), &cp);
1845
1846 return 0;
1847 }
1848
1849 static void le_scan_restart_work(struct work_struct *work)
1850 {
1851 struct hci_dev *hdev = container_of(work, struct hci_dev,
1852 le_scan_restart.work);
1853 unsigned long timeout, duration, scan_start, now;
1854 u8 status;
1855
1856 BT_DBG("%s", hdev->name);
1857
1858 hci_req_sync(hdev, le_scan_restart, 0, HCI_CMD_TIMEOUT, &status);
1859 if (status) {
1860 BT_ERR("Failed to restart LE scan: status %d", status);
1861 return;
1862 }
1863
1864 hci_dev_lock(hdev);
1865
1866 if (!test_bit(HCI_QUIRK_STRICT_DUPLICATE_FILTER, &hdev->quirks) ||
1867 !hdev->discovery.scan_start)
1868 goto unlock;
1869
1870 /* When the scan was started, hdev->le_scan_disable has been queued
1871 * after duration from scan_start. During scan restart this job
1872 * has been canceled, and we need to queue it again after proper
1873 * timeout, to make sure that scan does not run indefinitely.
1874 */
1875 duration = hdev->discovery.scan_duration;
1876 scan_start = hdev->discovery.scan_start;
1877 now = jiffies;
1878 if (now - scan_start <= duration) {
1879 int elapsed;
1880
1881 if (now >= scan_start)
1882 elapsed = now - scan_start;
1883 else
1884 elapsed = ULONG_MAX - scan_start + now;
1885
1886 timeout = duration - elapsed;
1887 } else {
1888 timeout = 0;
1889 }
1890
1891 queue_delayed_work(hdev->req_workqueue,
1892 &hdev->le_scan_disable, timeout);
1893
1894 unlock:
1895 hci_dev_unlock(hdev);
1896 }
1897
1898 static void disable_advertising(struct hci_request *req)
1899 {
1900 u8 enable = 0x00;
1901
1902 hci_req_add(req, HCI_OP_LE_SET_ADV_ENABLE, sizeof(enable), &enable);
1903 }
1904
1905 static int active_scan(struct hci_request *req, unsigned long opt)
1906 {
1907 uint16_t interval = opt;
1908 struct hci_dev *hdev = req->hdev;
1909 struct hci_cp_le_set_scan_param param_cp;
1910 struct hci_cp_le_set_scan_enable enable_cp;
1911 u8 own_addr_type;
1912 int err;
1913
1914 BT_DBG("%s", hdev->name);
1915
1916 if (hci_dev_test_flag(hdev, HCI_LE_ADV)) {
1917 hci_dev_lock(hdev);
1918
1919 /* Don't let discovery abort an outgoing connection attempt
1920 * that's using directed advertising.
1921 */
1922 if (hci_lookup_le_connect(hdev)) {
1923 hci_dev_unlock(hdev);
1924 return -EBUSY;
1925 }
1926
1927 cancel_adv_timeout(hdev);
1928 hci_dev_unlock(hdev);
1929
1930 disable_advertising(req);
1931 }
1932
1933 /* If controller is scanning, it means the background scanning is
1934 * running. Thus, we should temporarily stop it in order to set the
1935 * discovery scanning parameters.
1936 */
1937 if (hci_dev_test_flag(hdev, HCI_LE_SCAN))
1938 hci_req_add_le_scan_disable(req);
1939
1940 /* All active scans will be done with either a resolvable private
1941 * address (when privacy feature has been enabled) or non-resolvable
1942 * private address.
1943 */
1944 err = hci_update_random_address(req, true, &own_addr_type);
1945 if (err < 0)
1946 own_addr_type = ADDR_LE_DEV_PUBLIC;
1947
1948 memset(&param_cp, 0, sizeof(param_cp));
1949 param_cp.type = LE_SCAN_ACTIVE;
1950 param_cp.interval = cpu_to_le16(interval);
1951 param_cp.window = cpu_to_le16(DISCOV_LE_SCAN_WIN);
1952 param_cp.own_address_type = own_addr_type;
1953
1954 hci_req_add(req, HCI_OP_LE_SET_SCAN_PARAM, sizeof(param_cp),
1955 &param_cp);
1956
1957 memset(&enable_cp, 0, sizeof(enable_cp));
1958 enable_cp.enable = LE_SCAN_ENABLE;
1959 enable_cp.filter_dup = LE_SCAN_FILTER_DUP_ENABLE;
1960
1961 hci_req_add(req, HCI_OP_LE_SET_SCAN_ENABLE, sizeof(enable_cp),
1962 &enable_cp);
1963
1964 return 0;
1965 }
1966
1967 static int interleaved_discov(struct hci_request *req, unsigned long opt)
1968 {
1969 int err;
1970
1971 BT_DBG("%s", req->hdev->name);
1972
1973 err = active_scan(req, opt);
1974 if (err)
1975 return err;
1976
1977 return bredr_inquiry(req, DISCOV_BREDR_INQUIRY_LEN);
1978 }
1979
1980 static void start_discovery(struct hci_dev *hdev, u8 *status)
1981 {
1982 unsigned long timeout;
1983
1984 BT_DBG("%s type %u", hdev->name, hdev->discovery.type);
1985
1986 switch (hdev->discovery.type) {
1987 case DISCOV_TYPE_BREDR:
1988 if (!hci_dev_test_flag(hdev, HCI_INQUIRY))
1989 hci_req_sync(hdev, bredr_inquiry,
1990 DISCOV_BREDR_INQUIRY_LEN, HCI_CMD_TIMEOUT,
1991 status);
1992 return;
1993 case DISCOV_TYPE_INTERLEAVED:
1994 /* When running simultaneous discovery, the LE scanning time
1995 * should occupy the whole discovery time sine BR/EDR inquiry
1996 * and LE scanning are scheduled by the controller.
1997 *
1998 * For interleaving discovery in comparison, BR/EDR inquiry
1999 * and LE scanning are done sequentially with separate
2000 * timeouts.
2001 */
2002 if (test_bit(HCI_QUIRK_SIMULTANEOUS_DISCOVERY,
2003 &hdev->quirks)) {
2004 timeout = msecs_to_jiffies(DISCOV_LE_TIMEOUT);
2005 /* During simultaneous discovery, we double LE scan
2006 * interval. We must leave some time for the controller
2007 * to do BR/EDR inquiry.
2008 */
2009 hci_req_sync(hdev, interleaved_discov,
2010 DISCOV_LE_SCAN_INT * 2, HCI_CMD_TIMEOUT,
2011 status);
2012 break;
2013 }
2014
2015 timeout = msecs_to_jiffies(hdev->discov_interleaved_timeout);
2016 hci_req_sync(hdev, active_scan, DISCOV_LE_SCAN_INT,
2017 HCI_CMD_TIMEOUT, status);
2018 break;
2019 case DISCOV_TYPE_LE:
2020 timeout = msecs_to_jiffies(DISCOV_LE_TIMEOUT);
2021 hci_req_sync(hdev, active_scan, DISCOV_LE_SCAN_INT,
2022 HCI_CMD_TIMEOUT, status);
2023 break;
2024 default:
2025 *status = HCI_ERROR_UNSPECIFIED;
2026 return;
2027 }
2028
2029 if (*status)
2030 return;
2031
2032 BT_DBG("%s timeout %u ms", hdev->name, jiffies_to_msecs(timeout));
2033
2034 /* When service discovery is used and the controller has a
2035 * strict duplicate filter, it is important to remember the
2036 * start and duration of the scan. This is required for
2037 * restarting scanning during the discovery phase.
2038 */
2039 if (test_bit(HCI_QUIRK_STRICT_DUPLICATE_FILTER, &hdev->quirks) &&
2040 hdev->discovery.result_filtering) {
2041 hdev->discovery.scan_start = jiffies;
2042 hdev->discovery.scan_duration = timeout;
2043 }
2044
2045 queue_delayed_work(hdev->req_workqueue, &hdev->le_scan_disable,
2046 timeout);
2047 }
2048
2049 bool hci_req_stop_discovery(struct hci_request *req)
2050 {
2051 struct hci_dev *hdev = req->hdev;
2052 struct discovery_state *d = &hdev->discovery;
2053 struct hci_cp_remote_name_req_cancel cp;
2054 struct inquiry_entry *e;
2055 bool ret = false;
2056
2057 BT_DBG("%s state %u", hdev->name, hdev->discovery.state);
2058
2059 if (d->state == DISCOVERY_FINDING || d->state == DISCOVERY_STOPPING) {
2060 if (test_bit(HCI_INQUIRY, &hdev->flags))
2061 hci_req_add(req, HCI_OP_INQUIRY_CANCEL, 0, NULL);
2062
2063 if (hci_dev_test_flag(hdev, HCI_LE_SCAN)) {
2064 cancel_delayed_work(&hdev->le_scan_disable);
2065 hci_req_add_le_scan_disable(req);
2066 }
2067
2068 ret = true;
2069 } else {
2070 /* Passive scanning */
2071 if (hci_dev_test_flag(hdev, HCI_LE_SCAN)) {
2072 hci_req_add_le_scan_disable(req);
2073 ret = true;
2074 }
2075 }
2076
2077 /* No further actions needed for LE-only discovery */
2078 if (d->type == DISCOV_TYPE_LE)
2079 return ret;
2080
2081 if (d->state == DISCOVERY_RESOLVING || d->state == DISCOVERY_STOPPING) {
2082 e = hci_inquiry_cache_lookup_resolve(hdev, BDADDR_ANY,
2083 NAME_PENDING);
2084 if (!e)
2085 return ret;
2086
2087 bacpy(&cp.bdaddr, &e->data.bdaddr);
2088 hci_req_add(req, HCI_OP_REMOTE_NAME_REQ_CANCEL, sizeof(cp),
2089 &cp);
2090 ret = true;
2091 }
2092
2093 return ret;
2094 }
2095
2096 static int stop_discovery(struct hci_request *req, unsigned long opt)
2097 {
2098 hci_dev_lock(req->hdev);
2099 hci_req_stop_discovery(req);
2100 hci_dev_unlock(req->hdev);
2101
2102 return 0;
2103 }
2104
2105 static void discov_update(struct work_struct *work)
2106 {
2107 struct hci_dev *hdev = container_of(work, struct hci_dev,
2108 discov_update);
2109 u8 status = 0;
2110
2111 switch (hdev->discovery.state) {
2112 case DISCOVERY_STARTING:
2113 start_discovery(hdev, &status);
2114 mgmt_start_discovery_complete(hdev, status);
2115 if (status)
2116 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
2117 else
2118 hci_discovery_set_state(hdev, DISCOVERY_FINDING);
2119 break;
2120 case DISCOVERY_STOPPING:
2121 hci_req_sync(hdev, stop_discovery, 0, HCI_CMD_TIMEOUT, &status);
2122 mgmt_stop_discovery_complete(hdev, status);
2123 if (!status)
2124 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
2125 break;
2126 case DISCOVERY_STOPPED:
2127 default:
2128 return;
2129 }
2130 }
2131
2132 static void discov_off(struct work_struct *work)
2133 {
2134 struct hci_dev *hdev = container_of(work, struct hci_dev,
2135 discov_off.work);
2136
2137 BT_DBG("%s", hdev->name);
2138
2139 hci_dev_lock(hdev);
2140
2141 /* When discoverable timeout triggers, then just make sure
2142 * the limited discoverable flag is cleared. Even in the case
2143 * of a timeout triggered from general discoverable, it is
2144 * safe to unconditionally clear the flag.
2145 */
2146 hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE);
2147 hci_dev_clear_flag(hdev, HCI_DISCOVERABLE);
2148 hdev->discov_timeout = 0;
2149
2150 hci_dev_unlock(hdev);
2151
2152 hci_req_sync(hdev, discoverable_update, 0, HCI_CMD_TIMEOUT, NULL);
2153 mgmt_new_settings(hdev);
2154 }
2155
2156 static int powered_update_hci(struct hci_request *req, unsigned long opt)
2157 {
2158 struct hci_dev *hdev = req->hdev;
2159 u8 link_sec;
2160
2161 hci_dev_lock(hdev);
2162
2163 if (hci_dev_test_flag(hdev, HCI_SSP_ENABLED) &&
2164 !lmp_host_ssp_capable(hdev)) {
2165 u8 mode = 0x01;
2166
2167 hci_req_add(req, HCI_OP_WRITE_SSP_MODE, sizeof(mode), &mode);
2168
2169 if (bredr_sc_enabled(hdev) && !lmp_host_sc_capable(hdev)) {
2170 u8 support = 0x01;
2171
2172 hci_req_add(req, HCI_OP_WRITE_SC_SUPPORT,
2173 sizeof(support), &support);
2174 }
2175 }
2176
2177 if (hci_dev_test_flag(hdev, HCI_LE_ENABLED) &&
2178 lmp_bredr_capable(hdev)) {
2179 struct hci_cp_write_le_host_supported cp;
2180
2181 cp.le = 0x01;
2182 cp.simul = 0x00;
2183
2184 /* Check first if we already have the right
2185 * host state (host features set)
2186 */
2187 if (cp.le != lmp_host_le_capable(hdev) ||
2188 cp.simul != lmp_host_le_br_capable(hdev))
2189 hci_req_add(req, HCI_OP_WRITE_LE_HOST_SUPPORTED,
2190 sizeof(cp), &cp);
2191 }
2192
2193 if (hci_dev_test_flag(hdev, HCI_LE_ENABLED)) {
2194 /* Make sure the controller has a good default for
2195 * advertising data. This also applies to the case
2196 * where BR/EDR was toggled during the AUTO_OFF phase.
2197 */
2198 if (hci_dev_test_flag(hdev, HCI_ADVERTISING) ||
2199 list_empty(&hdev->adv_instances)) {
2200 __hci_req_update_adv_data(req, 0x00);
2201 __hci_req_update_scan_rsp_data(req, 0x00);
2202
2203 if (hci_dev_test_flag(hdev, HCI_ADVERTISING))
2204 __hci_req_enable_advertising(req);
2205 } else if (!list_empty(&hdev->adv_instances)) {
2206 struct adv_info *adv_instance;
2207
2208 adv_instance = list_first_entry(&hdev->adv_instances,
2209 struct adv_info, list);
2210 __hci_req_schedule_adv_instance(req,
2211 adv_instance->instance,
2212 true);
2213 }
2214 }
2215
2216 link_sec = hci_dev_test_flag(hdev, HCI_LINK_SECURITY);
2217 if (link_sec != test_bit(HCI_AUTH, &hdev->flags))
2218 hci_req_add(req, HCI_OP_WRITE_AUTH_ENABLE,
2219 sizeof(link_sec), &link_sec);
2220
2221 if (lmp_bredr_capable(hdev)) {
2222 if (hci_dev_test_flag(hdev, HCI_FAST_CONNECTABLE))
2223 __hci_req_write_fast_connectable(req, true);
2224 else
2225 __hci_req_write_fast_connectable(req, false);
2226 __hci_req_update_scan(req);
2227 __hci_req_update_class(req);
2228 __hci_req_update_name(req);
2229 __hci_req_update_eir(req);
2230 }
2231
2232 hci_dev_unlock(hdev);
2233 return 0;
2234 }
2235
2236 int __hci_req_hci_power_on(struct hci_dev *hdev)
2237 {
2238 /* Register the available SMP channels (BR/EDR and LE) only when
2239 * successfully powering on the controller. This late
2240 * registration is required so that LE SMP can clearly decide if
2241 * the public address or static address is used.
2242 */
2243 smp_register(hdev);
2244
2245 return __hci_req_sync(hdev, powered_update_hci, 0, HCI_CMD_TIMEOUT,
2246 NULL);
2247 }
2248
2249 void hci_request_setup(struct hci_dev *hdev)
2250 {
2251 INIT_WORK(&hdev->discov_update, discov_update);
2252 INIT_WORK(&hdev->bg_scan_update, bg_scan_update);
2253 INIT_WORK(&hdev->scan_update, scan_update_work);
2254 INIT_WORK(&hdev->connectable_update, connectable_update_work);
2255 INIT_WORK(&hdev->discoverable_update, discoverable_update_work);
2256 INIT_DELAYED_WORK(&hdev->discov_off, discov_off);
2257 INIT_DELAYED_WORK(&hdev->le_scan_disable, le_scan_disable_work);
2258 INIT_DELAYED_WORK(&hdev->le_scan_restart, le_scan_restart_work);
2259 INIT_DELAYED_WORK(&hdev->adv_instance_expire, adv_timeout_expire);
2260 }
2261
2262 void hci_request_cancel_all(struct hci_dev *hdev)
2263 {
2264 hci_req_sync_cancel(hdev, ENODEV);
2265
2266 cancel_work_sync(&hdev->discov_update);
2267 cancel_work_sync(&hdev->bg_scan_update);
2268 cancel_work_sync(&hdev->scan_update);
2269 cancel_work_sync(&hdev->connectable_update);
2270 cancel_work_sync(&hdev->discoverable_update);
2271 cancel_delayed_work_sync(&hdev->discov_off);
2272 cancel_delayed_work_sync(&hdev->le_scan_disable);
2273 cancel_delayed_work_sync(&hdev->le_scan_restart);
2274
2275 if (hdev->adv_instance_timeout) {
2276 cancel_delayed_work_sync(&hdev->adv_instance_expire);
2277 hdev->adv_instance_timeout = 0;
2278 }
2279 }
Linux kernel - Deliverables
This page took 0.115548 seconds and 5 git commands to generate.