1 /* 2 BlueZ - Bluetooth protocol stack for Linux 3 4 Copyright (C) 2014 Intel Corporation 5 6 This program is free software; you can redistribute it and/or modify 7 it under the terms of the GNU General Public License version 2 as 8 published by the Free Software Foundation; 9 10 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS 11 OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 12 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS. 13 IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY 14 CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES 15 WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN 16 ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF 17 OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. 18 19 ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS, 20 COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS 21 SOFTWARE IS DISCLAIMED. 22 */ 23 24 #include <linux/sched/signal.h> 25 26 #include <net/bluetooth/bluetooth.h> 27 #include <net/bluetooth/hci_core.h> 28 #include <net/bluetooth/mgmt.h> 29 30 #include "smp.h" 31 #include "hci_request.h" 32 33 #define HCI_REQ_DONE 0 34 #define HCI_REQ_PEND 1 35 #define HCI_REQ_CANCELED 2 36 37 void hci_req_init(struct hci_request *req, struct hci_dev *hdev) 38 { 39 skb_queue_head_init(&req->cmd_q); 40 req->hdev = hdev; 41 req->err = 0; 42 } 43 44 void hci_req_purge(struct hci_request *req) 45 { 46 skb_queue_purge(&req->cmd_q); 47 } 48 49 bool hci_req_status_pend(struct hci_dev *hdev) 50 { 51 return hdev->req_status == HCI_REQ_PEND; 52 } 53 54 static int req_run(struct hci_request *req, hci_req_complete_t complete, 55 hci_req_complete_skb_t complete_skb) 56 { 57 struct hci_dev *hdev = req->hdev; 58 struct sk_buff *skb; 59 unsigned long flags; 60 61 BT_DBG("length %u", skb_queue_len(&req->cmd_q)); 62 63 /* If an error occurred during request building, remove all HCI 64 * commands queued on the HCI request queue. 65 */ 66 if (req->err) { 67 skb_queue_purge(&req->cmd_q); 68 return req->err; 69 } 70 71 /* Do not allow empty requests */ 72 if (skb_queue_empty(&req->cmd_q)) 73 return -ENODATA; 74 75 skb = skb_peek_tail(&req->cmd_q); 76 if (complete) { 77 bt_cb(skb)->hci.req_complete = complete; 78 } else if (complete_skb) { 79 bt_cb(skb)->hci.req_complete_skb = complete_skb; 80 bt_cb(skb)->hci.req_flags |= HCI_REQ_SKB; 81 } 82 83 spin_lock_irqsave(&hdev->cmd_q.lock, flags); 84 skb_queue_splice_tail(&req->cmd_q, &hdev->cmd_q); 85 spin_unlock_irqrestore(&hdev->cmd_q.lock, flags); 86 87 queue_work(hdev->workqueue, &hdev->cmd_work); 88 89 return 0; 90 } 91 92 int hci_req_run(struct hci_request *req, hci_req_complete_t complete) 93 { 94 return req_run(req, complete, NULL); 95 } 96 97 int hci_req_run_skb(struct hci_request *req, hci_req_complete_skb_t complete) 98 { 99 return req_run(req, NULL, complete); 100 } 101 102 static void hci_req_sync_complete(struct hci_dev *hdev, u8 result, u16 opcode, 103 struct sk_buff *skb) 104 { 105 BT_DBG("%s result 0x%2.2x", hdev->name, result); 106 107 if (hdev->req_status == HCI_REQ_PEND) { 108 hdev->req_result = result; 109 hdev->req_status = HCI_REQ_DONE; 110 if (skb) 111 hdev->req_skb = skb_get(skb); 112 wake_up_interruptible(&hdev->req_wait_q); 113 } 114 } 115 116 void hci_req_sync_cancel(struct hci_dev *hdev, int err) 117 { 118 BT_DBG("%s err 0x%2.2x", hdev->name, err); 119 120 if (hdev->req_status == HCI_REQ_PEND) { 121 hdev->req_result = err; 122 hdev->req_status = HCI_REQ_CANCELED; 123 wake_up_interruptible(&hdev->req_wait_q); 124 } 125 } 126 127 struct sk_buff *__hci_cmd_sync_ev(struct hci_dev *hdev, u16 opcode, u32 plen, 128 const void *param, u8 event, u32 timeout) 129 { 130 struct hci_request req; 131 struct sk_buff *skb; 132 int err = 0; 133 134 BT_DBG("%s", hdev->name); 135 136 hci_req_init(&req, hdev); 137 138 hci_req_add_ev(&req, opcode, plen, param, event); 139 140 hdev->req_status = HCI_REQ_PEND; 141 142 err = hci_req_run_skb(&req, hci_req_sync_complete); 143 if (err < 0) 144 return ERR_PTR(err); 145 146 err = wait_event_interruptible_timeout(hdev->req_wait_q, 147 hdev->req_status != HCI_REQ_PEND, timeout); 148 149 if (err == -ERESTARTSYS) 150 return ERR_PTR(-EINTR); 151 152 switch (hdev->req_status) { 153 case HCI_REQ_DONE: 154 err = -bt_to_errno(hdev->req_result); 155 break; 156 157 case HCI_REQ_CANCELED: 158 err = -hdev->req_result; 159 break; 160 161 default: 162 err = -ETIMEDOUT; 163 break; 164 } 165 166 hdev->req_status = hdev->req_result = 0; 167 skb = hdev->req_skb; 168 hdev->req_skb = NULL; 169 170 BT_DBG("%s end: err %d", hdev->name, err); 171 172 if (err < 0) { 173 kfree_skb(skb); 174 return ERR_PTR(err); 175 } 176 177 if (!skb) 178 return ERR_PTR(-ENODATA); 179 180 return skb; 181 } 182 EXPORT_SYMBOL(__hci_cmd_sync_ev); 183 184 struct sk_buff *__hci_cmd_sync(struct hci_dev *hdev, u16 opcode, u32 plen, 185 const void *param, u32 timeout) 186 { 187 return __hci_cmd_sync_ev(hdev, opcode, plen, param, 0, timeout); 188 } 189 EXPORT_SYMBOL(__hci_cmd_sync); 190 191 /* Execute request and wait for completion. */ 192 int __hci_req_sync(struct hci_dev *hdev, int (*func)(struct hci_request *req, 193 unsigned long opt), 194 unsigned long opt, u32 timeout, u8 *hci_status) 195 { 196 struct hci_request req; 197 int err = 0; 198 199 BT_DBG("%s start", hdev->name); 200 201 hci_req_init(&req, hdev); 202 203 hdev->req_status = HCI_REQ_PEND; 204 205 err = func(&req, opt); 206 if (err) { 207 if (hci_status) 208 *hci_status = HCI_ERROR_UNSPECIFIED; 209 return err; 210 } 211 212 err = hci_req_run_skb(&req, hci_req_sync_complete); 213 if (err < 0) { 214 hdev->req_status = 0; 215 216 /* ENODATA means the HCI request command queue is empty. 217 * This can happen when a request with conditionals doesn't 218 * trigger any commands to be sent. This is normal behavior 219 * and should not trigger an error return. 220 */ 221 if (err == -ENODATA) { 222 if (hci_status) 223 *hci_status = 0; 224 return 0; 225 } 226 227 if (hci_status) 228 *hci_status = HCI_ERROR_UNSPECIFIED; 229 230 return err; 231 } 232 233 err = wait_event_interruptible_timeout(hdev->req_wait_q, 234 hdev->req_status != HCI_REQ_PEND, timeout); 235 236 if (err == -ERESTARTSYS) 237 return -EINTR; 238 239 switch (hdev->req_status) { 240 case HCI_REQ_DONE: 241 err = -bt_to_errno(hdev->req_result); 242 if (hci_status) 243 *hci_status = hdev->req_result; 244 break; 245 246 case HCI_REQ_CANCELED: 247 err = -hdev->req_result; 248 if (hci_status) 249 *hci_status = HCI_ERROR_UNSPECIFIED; 250 break; 251 252 default: 253 err = -ETIMEDOUT; 254 if (hci_status) 255 *hci_status = HCI_ERROR_UNSPECIFIED; 256 break; 257 } 258 259 kfree_skb(hdev->req_skb); 260 hdev->req_skb = NULL; 261 hdev->req_status = hdev->req_result = 0; 262 263 BT_DBG("%s end: err %d", hdev->name, err); 264 265 return err; 266 } 267 268 int hci_req_sync(struct hci_dev *hdev, int (*req)(struct hci_request *req, 269 unsigned long opt), 270 unsigned long opt, u32 timeout, u8 *hci_status) 271 { 272 int ret; 273 274 if (!test_bit(HCI_UP, &hdev->flags)) 275 return -ENETDOWN; 276 277 /* Serialize all requests */ 278 hci_req_sync_lock(hdev); 279 ret = __hci_req_sync(hdev, req, opt, timeout, hci_status); 280 hci_req_sync_unlock(hdev); 281 282 return ret; 283 } 284 285 struct sk_buff *hci_prepare_cmd(struct hci_dev *hdev, u16 opcode, u32 plen, 286 const void *param) 287 { 288 int len = HCI_COMMAND_HDR_SIZE + plen; 289 struct hci_command_hdr *hdr; 290 struct sk_buff *skb; 291 292 skb = bt_skb_alloc(len, GFP_ATOMIC); 293 if (!skb) 294 return NULL; 295 296 hdr = skb_put(skb, HCI_COMMAND_HDR_SIZE); 297 hdr->opcode = cpu_to_le16(opcode); 298 hdr->plen = plen; 299 300 if (plen) 301 skb_put_data(skb, param, plen); 302 303 BT_DBG("skb len %d", skb->len); 304 305 hci_skb_pkt_type(skb) = HCI_COMMAND_PKT; 306 hci_skb_opcode(skb) = opcode; 307 308 return skb; 309 } 310 311 /* Queue a command to an asynchronous HCI request */ 312 void hci_req_add_ev(struct hci_request *req, u16 opcode, u32 plen, 313 const void *param, u8 event) 314 { 315 struct hci_dev *hdev = req->hdev; 316 struct sk_buff *skb; 317 318 BT_DBG("%s opcode 0x%4.4x plen %d", hdev->name, opcode, plen); 319 320 /* If an error occurred during request building, there is no point in 321 * queueing the HCI command. We can simply return. 322 */ 323 if (req->err) 324 return; 325 326 skb = hci_prepare_cmd(hdev, opcode, plen, param); 327 if (!skb) { 328 bt_dev_err(hdev, "no memory for command (opcode 0x%4.4x)", 329 opcode); 330 req->err = -ENOMEM; 331 return; 332 } 333 334 if (skb_queue_empty(&req->cmd_q)) 335 bt_cb(skb)->hci.req_flags |= HCI_REQ_START; 336 337 bt_cb(skb)->hci.req_event = event; 338 339 skb_queue_tail(&req->cmd_q, skb); 340 } 341 342 void hci_req_add(struct hci_request *req, u16 opcode, u32 plen, 343 const void *param) 344 { 345 hci_req_add_ev(req, opcode, plen, param, 0); 346 } 347 348 void __hci_req_write_fast_connectable(struct hci_request *req, bool enable) 349 { 350 struct hci_dev *hdev = req->hdev; 351 struct hci_cp_write_page_scan_activity acp; 352 u8 type; 353 354 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) 355 return; 356 357 if (hdev->hci_ver < BLUETOOTH_VER_1_2) 358 return; 359 360 if (enable) { 361 type = PAGE_SCAN_TYPE_INTERLACED; 362 363 /* 160 msec page scan interval */ 364 acp.interval = cpu_to_le16(0x0100); 365 } else { 366 type = PAGE_SCAN_TYPE_STANDARD; /* default */ 367 368 /* default 1.28 sec page scan */ 369 acp.interval = cpu_to_le16(0x0800); 370 } 371 372 acp.window = cpu_to_le16(0x0012); 373 374 if (__cpu_to_le16(hdev->page_scan_interval) != acp.interval || 375 __cpu_to_le16(hdev->page_scan_window) != acp.window) 376 hci_req_add(req, HCI_OP_WRITE_PAGE_SCAN_ACTIVITY, 377 sizeof(acp), &acp); 378 379 if (hdev->page_scan_type != type) 380 hci_req_add(req, HCI_OP_WRITE_PAGE_SCAN_TYPE, 1, &type); 381 } 382 383 /* This function controls the background scanning based on hdev->pend_le_conns 384 * list. If there are pending LE connection we start the background scanning, 385 * otherwise we stop it. 386 * 387 * This function requires the caller holds hdev->lock. 388 */ 389 static void __hci_update_background_scan(struct hci_request *req) 390 { 391 struct hci_dev *hdev = req->hdev; 392 393 if (!test_bit(HCI_UP, &hdev->flags) || 394 test_bit(HCI_INIT, &hdev->flags) || 395 hci_dev_test_flag(hdev, HCI_SETUP) || 396 hci_dev_test_flag(hdev, HCI_CONFIG) || 397 hci_dev_test_flag(hdev, HCI_AUTO_OFF) || 398 hci_dev_test_flag(hdev, HCI_UNREGISTER)) 399 return; 400 401 /* No point in doing scanning if LE support hasn't been enabled */ 402 if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED)) 403 return; 404 405 /* If discovery is active don't interfere with it */ 406 if (hdev->discovery.state != DISCOVERY_STOPPED) 407 return; 408 409 /* Reset RSSI and UUID filters when starting background scanning 410 * since these filters are meant for service discovery only. 411 * 412 * The Start Discovery and Start Service Discovery operations 413 * ensure to set proper values for RSSI threshold and UUID 414 * filter list. So it is safe to just reset them here. 415 */ 416 hci_discovery_filter_clear(hdev); 417 418 if (list_empty(&hdev->pend_le_conns) && 419 list_empty(&hdev->pend_le_reports)) { 420 /* If there is no pending LE connections or devices 421 * to be scanned for, we should stop the background 422 * scanning. 423 */ 424 425 /* If controller is not scanning we are done. */ 426 if (!hci_dev_test_flag(hdev, HCI_LE_SCAN)) 427 return; 428 429 hci_req_add_le_scan_disable(req); 430 431 BT_DBG("%s stopping background scanning", hdev->name); 432 } else { 433 /* If there is at least one pending LE connection, we should 434 * keep the background scan running. 435 */ 436 437 /* If controller is connecting, we should not start scanning 438 * since some controllers are not able to scan and connect at 439 * the same time. 440 */ 441 if (hci_lookup_le_connect(hdev)) 442 return; 443 444 /* If controller is currently scanning, we stop it to ensure we 445 * don't miss any advertising (due to duplicates filter). 446 */ 447 if (hci_dev_test_flag(hdev, HCI_LE_SCAN)) 448 hci_req_add_le_scan_disable(req); 449 450 hci_req_add_le_passive_scan(req); 451 452 BT_DBG("%s starting background scanning", hdev->name); 453 } 454 } 455 456 void __hci_req_update_name(struct hci_request *req) 457 { 458 struct hci_dev *hdev = req->hdev; 459 struct hci_cp_write_local_name cp; 460 461 memcpy(cp.name, hdev->dev_name, sizeof(cp.name)); 462 463 hci_req_add(req, HCI_OP_WRITE_LOCAL_NAME, sizeof(cp), &cp); 464 } 465 466 #define PNP_INFO_SVCLASS_ID 0x1200 467 468 static u8 *create_uuid16_list(struct hci_dev *hdev, u8 *data, ptrdiff_t len) 469 { 470 u8 *ptr = data, *uuids_start = NULL; 471 struct bt_uuid *uuid; 472 473 if (len < 4) 474 return ptr; 475 476 list_for_each_entry(uuid, &hdev->uuids, list) { 477 u16 uuid16; 478 479 if (uuid->size != 16) 480 continue; 481 482 uuid16 = get_unaligned_le16(&uuid->uuid[12]); 483 if (uuid16 < 0x1100) 484 continue; 485 486 if (uuid16 == PNP_INFO_SVCLASS_ID) 487 continue; 488 489 if (!uuids_start) { 490 uuids_start = ptr; 491 uuids_start[0] = 1; 492 uuids_start[1] = EIR_UUID16_ALL; 493 ptr += 2; 494 } 495 496 /* Stop if not enough space to put next UUID */ 497 if ((ptr - data) + sizeof(u16) > len) { 498 uuids_start[1] = EIR_UUID16_SOME; 499 break; 500 } 501 502 *ptr++ = (uuid16 & 0x00ff); 503 *ptr++ = (uuid16 & 0xff00) >> 8; 504 uuids_start[0] += sizeof(uuid16); 505 } 506 507 return ptr; 508 } 509 510 static u8 *create_uuid32_list(struct hci_dev *hdev, u8 *data, ptrdiff_t len) 511 { 512 u8 *ptr = data, *uuids_start = NULL; 513 struct bt_uuid *uuid; 514 515 if (len < 6) 516 return ptr; 517 518 list_for_each_entry(uuid, &hdev->uuids, list) { 519 if (uuid->size != 32) 520 continue; 521 522 if (!uuids_start) { 523 uuids_start = ptr; 524 uuids_start[0] = 1; 525 uuids_start[1] = EIR_UUID32_ALL; 526 ptr += 2; 527 } 528 529 /* Stop if not enough space to put next UUID */ 530 if ((ptr - data) + sizeof(u32) > len) { 531 uuids_start[1] = EIR_UUID32_SOME; 532 break; 533 } 534 535 memcpy(ptr, &uuid->uuid[12], sizeof(u32)); 536 ptr += sizeof(u32); 537 uuids_start[0] += sizeof(u32); 538 } 539 540 return ptr; 541 } 542 543 static u8 *create_uuid128_list(struct hci_dev *hdev, u8 *data, ptrdiff_t len) 544 { 545 u8 *ptr = data, *uuids_start = NULL; 546 struct bt_uuid *uuid; 547 548 if (len < 18) 549 return ptr; 550 551 list_for_each_entry(uuid, &hdev->uuids, list) { 552 if (uuid->size != 128) 553 continue; 554 555 if (!uuids_start) { 556 uuids_start = ptr; 557 uuids_start[0] = 1; 558 uuids_start[1] = EIR_UUID128_ALL; 559 ptr += 2; 560 } 561 562 /* Stop if not enough space to put next UUID */ 563 if ((ptr - data) + 16 > len) { 564 uuids_start[1] = EIR_UUID128_SOME; 565 break; 566 } 567 568 memcpy(ptr, uuid->uuid, 16); 569 ptr += 16; 570 uuids_start[0] += 16; 571 } 572 573 return ptr; 574 } 575 576 static void create_eir(struct hci_dev *hdev, u8 *data) 577 { 578 u8 *ptr = data; 579 size_t name_len; 580 581 name_len = strlen(hdev->dev_name); 582 583 if (name_len > 0) { 584 /* EIR Data type */ 585 if (name_len > 48) { 586 name_len = 48; 587 ptr[1] = EIR_NAME_SHORT; 588 } else 589 ptr[1] = EIR_NAME_COMPLETE; 590 591 /* EIR Data length */ 592 ptr[0] = name_len + 1; 593 594 memcpy(ptr + 2, hdev->dev_name, name_len); 595 596 ptr += (name_len + 2); 597 } 598 599 if (hdev->inq_tx_power != HCI_TX_POWER_INVALID) { 600 ptr[0] = 2; 601 ptr[1] = EIR_TX_POWER; 602 ptr[2] = (u8) hdev->inq_tx_power; 603 604 ptr += 3; 605 } 606 607 if (hdev->devid_source > 0) { 608 ptr[0] = 9; 609 ptr[1] = EIR_DEVICE_ID; 610 611 put_unaligned_le16(hdev->devid_source, ptr + 2); 612 put_unaligned_le16(hdev->devid_vendor, ptr + 4); 613 put_unaligned_le16(hdev->devid_product, ptr + 6); 614 put_unaligned_le16(hdev->devid_version, ptr + 8); 615 616 ptr += 10; 617 } 618 619 ptr = create_uuid16_list(hdev, ptr, HCI_MAX_EIR_LENGTH - (ptr - data)); 620 ptr = create_uuid32_list(hdev, ptr, HCI_MAX_EIR_LENGTH - (ptr - data)); 621 ptr = create_uuid128_list(hdev, ptr, HCI_MAX_EIR_LENGTH - (ptr - data)); 622 } 623 624 void __hci_req_update_eir(struct hci_request *req) 625 { 626 struct hci_dev *hdev = req->hdev; 627 struct hci_cp_write_eir cp; 628 629 if (!hdev_is_powered(hdev)) 630 return; 631 632 if (!lmp_ext_inq_capable(hdev)) 633 return; 634 635 if (!hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) 636 return; 637 638 if (hci_dev_test_flag(hdev, HCI_SERVICE_CACHE)) 639 return; 640 641 memset(&cp, 0, sizeof(cp)); 642 643 create_eir(hdev, cp.data); 644 645 if (memcmp(cp.data, hdev->eir, sizeof(cp.data)) == 0) 646 return; 647 648 memcpy(hdev->eir, cp.data, sizeof(cp.data)); 649 650 hci_req_add(req, HCI_OP_WRITE_EIR, sizeof(cp), &cp); 651 } 652 653 void hci_req_add_le_scan_disable(struct hci_request *req) 654 { 655 struct hci_dev *hdev = req->hdev; 656 657 if (use_ext_scan(hdev)) { 658 struct hci_cp_le_set_ext_scan_enable cp; 659 660 memset(&cp, 0, sizeof(cp)); 661 cp.enable = LE_SCAN_DISABLE; 662 hci_req_add(req, HCI_OP_LE_SET_EXT_SCAN_ENABLE, sizeof(cp), 663 &cp); 664 } else { 665 struct hci_cp_le_set_scan_enable cp; 666 667 memset(&cp, 0, sizeof(cp)); 668 cp.enable = LE_SCAN_DISABLE; 669 hci_req_add(req, HCI_OP_LE_SET_SCAN_ENABLE, sizeof(cp), &cp); 670 } 671 } 672 673 static void add_to_white_list(struct hci_request *req, 674 struct hci_conn_params *params) 675 { 676 struct hci_cp_le_add_to_white_list cp; 677 678 cp.bdaddr_type = params->addr_type; 679 bacpy(&cp.bdaddr, ¶ms->addr); 680 681 hci_req_add(req, HCI_OP_LE_ADD_TO_WHITE_LIST, sizeof(cp), &cp); 682 } 683 684 static u8 update_white_list(struct hci_request *req) 685 { 686 struct hci_dev *hdev = req->hdev; 687 struct hci_conn_params *params; 688 struct bdaddr_list *b; 689 uint8_t white_list_entries = 0; 690 691 /* Go through the current white list programmed into the 692 * controller one by one and check if that address is still 693 * in the list of pending connections or list of devices to 694 * report. If not present in either list, then queue the 695 * command to remove it from the controller. 696 */ 697 list_for_each_entry(b, &hdev->le_white_list, list) { 698 /* If the device is neither in pend_le_conns nor 699 * pend_le_reports then remove it from the whitelist. 700 */ 701 if (!hci_pend_le_action_lookup(&hdev->pend_le_conns, 702 &b->bdaddr, b->bdaddr_type) && 703 !hci_pend_le_action_lookup(&hdev->pend_le_reports, 704 &b->bdaddr, b->bdaddr_type)) { 705 struct hci_cp_le_del_from_white_list cp; 706 707 cp.bdaddr_type = b->bdaddr_type; 708 bacpy(&cp.bdaddr, &b->bdaddr); 709 710 hci_req_add(req, HCI_OP_LE_DEL_FROM_WHITE_LIST, 711 sizeof(cp), &cp); 712 continue; 713 } 714 715 if (hci_find_irk_by_addr(hdev, &b->bdaddr, b->bdaddr_type)) { 716 /* White list can not be used with RPAs */ 717 return 0x00; 718 } 719 720 white_list_entries++; 721 } 722 723 /* Since all no longer valid white list entries have been 724 * removed, walk through the list of pending connections 725 * and ensure that any new device gets programmed into 726 * the controller. 727 * 728 * If the list of the devices is larger than the list of 729 * available white list entries in the controller, then 730 * just abort and return filer policy value to not use the 731 * white list. 732 */ 733 list_for_each_entry(params, &hdev->pend_le_conns, action) { 734 if (hci_bdaddr_list_lookup(&hdev->le_white_list, 735 ¶ms->addr, params->addr_type)) 736 continue; 737 738 if (white_list_entries >= hdev->le_white_list_size) { 739 /* Select filter policy to accept all advertising */ 740 return 0x00; 741 } 742 743 if (hci_find_irk_by_addr(hdev, ¶ms->addr, 744 params->addr_type)) { 745 /* White list can not be used with RPAs */ 746 return 0x00; 747 } 748 749 white_list_entries++; 750 add_to_white_list(req, params); 751 } 752 753 /* After adding all new pending connections, walk through 754 * the list of pending reports and also add these to the 755 * white list if there is still space. 756 */ 757 list_for_each_entry(params, &hdev->pend_le_reports, action) { 758 if (hci_bdaddr_list_lookup(&hdev->le_white_list, 759 ¶ms->addr, params->addr_type)) 760 continue; 761 762 if (white_list_entries >= hdev->le_white_list_size) { 763 /* Select filter policy to accept all advertising */ 764 return 0x00; 765 } 766 767 if (hci_find_irk_by_addr(hdev, ¶ms->addr, 768 params->addr_type)) { 769 /* White list can not be used with RPAs */ 770 return 0x00; 771 } 772 773 white_list_entries++; 774 add_to_white_list(req, params); 775 } 776 777 /* Select filter policy to use white list */ 778 return 0x01; 779 } 780 781 static bool scan_use_rpa(struct hci_dev *hdev) 782 { 783 return hci_dev_test_flag(hdev, HCI_PRIVACY); 784 } 785 786 static void hci_req_start_scan(struct hci_request *req, u8 type, u16 interval, 787 u16 window, u8 own_addr_type, u8 filter_policy) 788 { 789 struct hci_dev *hdev = req->hdev; 790 791 /* Use ext scanning if set ext scan param and ext scan enable is 792 * supported 793 */ 794 if (use_ext_scan(hdev)) { 795 struct hci_cp_le_set_ext_scan_params *ext_param_cp; 796 struct hci_cp_le_set_ext_scan_enable ext_enable_cp; 797 struct hci_cp_le_scan_phy_params *phy_params; 798 u8 data[sizeof(*ext_param_cp) + sizeof(*phy_params) * 2]; 799 u32 plen; 800 801 ext_param_cp = (void *)data; 802 phy_params = (void *)ext_param_cp->data; 803 804 memset(ext_param_cp, 0, sizeof(*ext_param_cp)); 805 ext_param_cp->own_addr_type = own_addr_type; 806 ext_param_cp->filter_policy = filter_policy; 807 808 plen = sizeof(*ext_param_cp); 809 810 if (scan_1m(hdev) || scan_2m(hdev)) { 811 ext_param_cp->scanning_phys |= LE_SCAN_PHY_1M; 812 813 memset(phy_params, 0, sizeof(*phy_params)); 814 phy_params->type = type; 815 phy_params->interval = cpu_to_le16(interval); 816 phy_params->window = cpu_to_le16(window); 817 818 plen += sizeof(*phy_params); 819 phy_params++; 820 } 821 822 if (scan_coded(hdev)) { 823 ext_param_cp->scanning_phys |= LE_SCAN_PHY_CODED; 824 825 memset(phy_params, 0, sizeof(*phy_params)); 826 phy_params->type = type; 827 phy_params->interval = cpu_to_le16(interval); 828 phy_params->window = cpu_to_le16(window); 829 830 plen += sizeof(*phy_params); 831 phy_params++; 832 } 833 834 hci_req_add(req, HCI_OP_LE_SET_EXT_SCAN_PARAMS, 835 plen, ext_param_cp); 836 837 memset(&ext_enable_cp, 0, sizeof(ext_enable_cp)); 838 ext_enable_cp.enable = LE_SCAN_ENABLE; 839 ext_enable_cp.filter_dup = LE_SCAN_FILTER_DUP_ENABLE; 840 841 hci_req_add(req, HCI_OP_LE_SET_EXT_SCAN_ENABLE, 842 sizeof(ext_enable_cp), &ext_enable_cp); 843 } else { 844 struct hci_cp_le_set_scan_param param_cp; 845 struct hci_cp_le_set_scan_enable enable_cp; 846 847 memset(¶m_cp, 0, sizeof(param_cp)); 848 param_cp.type = type; 849 param_cp.interval = cpu_to_le16(interval); 850 param_cp.window = cpu_to_le16(window); 851 param_cp.own_address_type = own_addr_type; 852 param_cp.filter_policy = filter_policy; 853 hci_req_add(req, HCI_OP_LE_SET_SCAN_PARAM, sizeof(param_cp), 854 ¶m_cp); 855 856 memset(&enable_cp, 0, sizeof(enable_cp)); 857 enable_cp.enable = LE_SCAN_ENABLE; 858 enable_cp.filter_dup = LE_SCAN_FILTER_DUP_ENABLE; 859 hci_req_add(req, HCI_OP_LE_SET_SCAN_ENABLE, sizeof(enable_cp), 860 &enable_cp); 861 } 862 } 863 864 void hci_req_add_le_passive_scan(struct hci_request *req) 865 { 866 struct hci_dev *hdev = req->hdev; 867 u8 own_addr_type; 868 u8 filter_policy; 869 870 /* Set require_privacy to false since no SCAN_REQ are send 871 * during passive scanning. Not using an non-resolvable address 872 * here is important so that peer devices using direct 873 * advertising with our address will be correctly reported 874 * by the controller. 875 */ 876 if (hci_update_random_address(req, false, scan_use_rpa(hdev), 877 &own_addr_type)) 878 return; 879 880 /* Adding or removing entries from the white list must 881 * happen before enabling scanning. The controller does 882 * not allow white list modification while scanning. 883 */ 884 filter_policy = update_white_list(req); 885 886 /* When the controller is using random resolvable addresses and 887 * with that having LE privacy enabled, then controllers with 888 * Extended Scanner Filter Policies support can now enable support 889 * for handling directed advertising. 890 * 891 * So instead of using filter polices 0x00 (no whitelist) 892 * and 0x01 (whitelist enabled) use the new filter policies 893 * 0x02 (no whitelist) and 0x03 (whitelist enabled). 894 */ 895 if (hci_dev_test_flag(hdev, HCI_PRIVACY) && 896 (hdev->le_features[0] & HCI_LE_EXT_SCAN_POLICY)) 897 filter_policy |= 0x02; 898 899 hci_req_start_scan(req, LE_SCAN_PASSIVE, hdev->le_scan_interval, 900 hdev->le_scan_window, own_addr_type, filter_policy); 901 } 902 903 static u8 get_adv_instance_scan_rsp_len(struct hci_dev *hdev, u8 instance) 904 { 905 struct adv_info *adv_instance; 906 907 /* Ignore instance 0 */ 908 if (instance == 0x00) 909 return 0; 910 911 adv_instance = hci_find_adv_instance(hdev, instance); 912 if (!adv_instance) 913 return 0; 914 915 /* TODO: Take into account the "appearance" and "local-name" flags here. 916 * These are currently being ignored as they are not supported. 917 */ 918 return adv_instance->scan_rsp_len; 919 } 920 921 static u8 get_cur_adv_instance_scan_rsp_len(struct hci_dev *hdev) 922 { 923 u8 instance = hdev->cur_adv_instance; 924 struct adv_info *adv_instance; 925 926 /* Ignore instance 0 */ 927 if (instance == 0x00) 928 return 0; 929 930 adv_instance = hci_find_adv_instance(hdev, instance); 931 if (!adv_instance) 932 return 0; 933 934 /* TODO: Take into account the "appearance" and "local-name" flags here. 935 * These are currently being ignored as they are not supported. 936 */ 937 return adv_instance->scan_rsp_len; 938 } 939 940 void __hci_req_disable_advertising(struct hci_request *req) 941 { 942 if (ext_adv_capable(req->hdev)) { 943 struct hci_cp_le_set_ext_adv_enable cp; 944 945 cp.enable = 0x00; 946 /* Disable all sets since we only support one set at the moment */ 947 cp.num_of_sets = 0x00; 948 949 hci_req_add(req, HCI_OP_LE_SET_EXT_ADV_ENABLE, sizeof(cp), &cp); 950 } else { 951 u8 enable = 0x00; 952 953 hci_req_add(req, HCI_OP_LE_SET_ADV_ENABLE, sizeof(enable), &enable); 954 } 955 } 956 957 static u32 get_adv_instance_flags(struct hci_dev *hdev, u8 instance) 958 { 959 u32 flags; 960 struct adv_info *adv_instance; 961 962 if (instance == 0x00) { 963 /* Instance 0 always manages the "Tx Power" and "Flags" 964 * fields 965 */ 966 flags = MGMT_ADV_FLAG_TX_POWER | MGMT_ADV_FLAG_MANAGED_FLAGS; 967 968 /* For instance 0, the HCI_ADVERTISING_CONNECTABLE setting 969 * corresponds to the "connectable" instance flag. 970 */ 971 if (hci_dev_test_flag(hdev, HCI_ADVERTISING_CONNECTABLE)) 972 flags |= MGMT_ADV_FLAG_CONNECTABLE; 973 974 if (hci_dev_test_flag(hdev, HCI_LIMITED_DISCOVERABLE)) 975 flags |= MGMT_ADV_FLAG_LIMITED_DISCOV; 976 else if (hci_dev_test_flag(hdev, HCI_DISCOVERABLE)) 977 flags |= MGMT_ADV_FLAG_DISCOV; 978 979 return flags; 980 } 981 982 adv_instance = hci_find_adv_instance(hdev, instance); 983 984 /* Return 0 when we got an invalid instance identifier. */ 985 if (!adv_instance) 986 return 0; 987 988 return adv_instance->flags; 989 } 990 991 static bool adv_use_rpa(struct hci_dev *hdev, uint32_t flags) 992 { 993 /* If privacy is not enabled don't use RPA */ 994 if (!hci_dev_test_flag(hdev, HCI_PRIVACY)) 995 return false; 996 997 /* If basic privacy mode is enabled use RPA */ 998 if (!hci_dev_test_flag(hdev, HCI_LIMITED_PRIVACY)) 999 return true; 1000 1001 /* If limited privacy mode is enabled don't use RPA if we're 1002 * both discoverable and bondable. 1003 */ 1004 if ((flags & MGMT_ADV_FLAG_DISCOV) && 1005 hci_dev_test_flag(hdev, HCI_BONDABLE)) 1006 return false; 1007 1008 /* We're neither bondable nor discoverable in the limited 1009 * privacy mode, therefore use RPA. 1010 */ 1011 return true; 1012 } 1013 1014 static bool is_advertising_allowed(struct hci_dev *hdev, bool connectable) 1015 { 1016 /* If there is no connection we are OK to advertise. */ 1017 if (hci_conn_num(hdev, LE_LINK) == 0) 1018 return true; 1019 1020 /* Check le_states if there is any connection in slave role. */ 1021 if (hdev->conn_hash.le_num_slave > 0) { 1022 /* Slave connection state and non connectable mode bit 20. */ 1023 if (!connectable && !(hdev->le_states[2] & 0x10)) 1024 return false; 1025 1026 /* Slave connection state and connectable mode bit 38 1027 * and scannable bit 21. 1028 */ 1029 if (connectable && (!(hdev->le_states[4] & 0x40) || 1030 !(hdev->le_states[2] & 0x20))) 1031 return false; 1032 } 1033 1034 /* Check le_states if there is any connection in master role. */ 1035 if (hci_conn_num(hdev, LE_LINK) != hdev->conn_hash.le_num_slave) { 1036 /* Master connection state and non connectable mode bit 18. */ 1037 if (!connectable && !(hdev->le_states[2] & 0x02)) 1038 return false; 1039 1040 /* Master connection state and connectable mode bit 35 and 1041 * scannable 19. 1042 */ 1043 if (connectable && (!(hdev->le_states[4] & 0x08) || 1044 !(hdev->le_states[2] & 0x08))) 1045 return false; 1046 } 1047 1048 return true; 1049 } 1050 1051 void __hci_req_enable_advertising(struct hci_request *req) 1052 { 1053 struct hci_dev *hdev = req->hdev; 1054 struct hci_cp_le_set_adv_param cp; 1055 u8 own_addr_type, enable = 0x01; 1056 bool connectable; 1057 u32 flags; 1058 1059 flags = get_adv_instance_flags(hdev, hdev->cur_adv_instance); 1060 1061 /* If the "connectable" instance flag was not set, then choose between 1062 * ADV_IND and ADV_NONCONN_IND based on the global connectable setting. 1063 */ 1064 connectable = (flags & MGMT_ADV_FLAG_CONNECTABLE) || 1065 mgmt_get_connectable(hdev); 1066 1067 if (!is_advertising_allowed(hdev, connectable)) 1068 return; 1069 1070 if (hci_dev_test_flag(hdev, HCI_LE_ADV)) 1071 __hci_req_disable_advertising(req); 1072 1073 /* Clear the HCI_LE_ADV bit temporarily so that the 1074 * hci_update_random_address knows that it's safe to go ahead 1075 * and write a new random address. The flag will be set back on 1076 * as soon as the SET_ADV_ENABLE HCI command completes. 1077 */ 1078 hci_dev_clear_flag(hdev, HCI_LE_ADV); 1079 1080 /* Set require_privacy to true only when non-connectable 1081 * advertising is used. In that case it is fine to use a 1082 * non-resolvable private address. 1083 */ 1084 if (hci_update_random_address(req, !connectable, 1085 adv_use_rpa(hdev, flags), 1086 &own_addr_type) < 0) 1087 return; 1088 1089 memset(&cp, 0, sizeof(cp)); 1090 cp.min_interval = cpu_to_le16(hdev->le_adv_min_interval); 1091 cp.max_interval = cpu_to_le16(hdev->le_adv_max_interval); 1092 1093 if (connectable) 1094 cp.type = LE_ADV_IND; 1095 else if (get_cur_adv_instance_scan_rsp_len(hdev)) 1096 cp.type = LE_ADV_SCAN_IND; 1097 else 1098 cp.type = LE_ADV_NONCONN_IND; 1099 1100 cp.own_address_type = own_addr_type; 1101 cp.channel_map = hdev->le_adv_channel_map; 1102 1103 hci_req_add(req, HCI_OP_LE_SET_ADV_PARAM, sizeof(cp), &cp); 1104 1105 hci_req_add(req, HCI_OP_LE_SET_ADV_ENABLE, sizeof(enable), &enable); 1106 } 1107 1108 u8 append_local_name(struct hci_dev *hdev, u8 *ptr, u8 ad_len) 1109 { 1110 size_t short_len; 1111 size_t complete_len; 1112 1113 /* no space left for name (+ NULL + type + len) */ 1114 if ((HCI_MAX_AD_LENGTH - ad_len) < HCI_MAX_SHORT_NAME_LENGTH + 3) 1115 return ad_len; 1116 1117 /* use complete name if present and fits */ 1118 complete_len = strlen(hdev->dev_name); 1119 if (complete_len && complete_len <= HCI_MAX_SHORT_NAME_LENGTH) 1120 return eir_append_data(ptr, ad_len, EIR_NAME_COMPLETE, 1121 hdev->dev_name, complete_len + 1); 1122 1123 /* use short name if present */ 1124 short_len = strlen(hdev->short_name); 1125 if (short_len) 1126 return eir_append_data(ptr, ad_len, EIR_NAME_SHORT, 1127 hdev->short_name, short_len + 1); 1128 1129 /* use shortened full name if present, we already know that name 1130 * is longer then HCI_MAX_SHORT_NAME_LENGTH 1131 */ 1132 if (complete_len) { 1133 u8 name[HCI_MAX_SHORT_NAME_LENGTH + 1]; 1134 1135 memcpy(name, hdev->dev_name, HCI_MAX_SHORT_NAME_LENGTH); 1136 name[HCI_MAX_SHORT_NAME_LENGTH] = '\0'; 1137 1138 return eir_append_data(ptr, ad_len, EIR_NAME_SHORT, name, 1139 sizeof(name)); 1140 } 1141 1142 return ad_len; 1143 } 1144 1145 static u8 append_appearance(struct hci_dev *hdev, u8 *ptr, u8 ad_len) 1146 { 1147 return eir_append_le16(ptr, ad_len, EIR_APPEARANCE, hdev->appearance); 1148 } 1149 1150 static u8 create_default_scan_rsp_data(struct hci_dev *hdev, u8 *ptr) 1151 { 1152 u8 scan_rsp_len = 0; 1153 1154 if (hdev->appearance) { 1155 scan_rsp_len = append_appearance(hdev, ptr, scan_rsp_len); 1156 } 1157 1158 return append_local_name(hdev, ptr, scan_rsp_len); 1159 } 1160 1161 static u8 create_instance_scan_rsp_data(struct hci_dev *hdev, u8 instance, 1162 u8 *ptr) 1163 { 1164 struct adv_info *adv_instance; 1165 u32 instance_flags; 1166 u8 scan_rsp_len = 0; 1167 1168 adv_instance = hci_find_adv_instance(hdev, instance); 1169 if (!adv_instance) 1170 return 0; 1171 1172 instance_flags = adv_instance->flags; 1173 1174 if ((instance_flags & MGMT_ADV_FLAG_APPEARANCE) && hdev->appearance) { 1175 scan_rsp_len = append_appearance(hdev, ptr, scan_rsp_len); 1176 } 1177 1178 memcpy(&ptr[scan_rsp_len], adv_instance->scan_rsp_data, 1179 adv_instance->scan_rsp_len); 1180 1181 scan_rsp_len += adv_instance->scan_rsp_len; 1182 1183 if (instance_flags & MGMT_ADV_FLAG_LOCAL_NAME) 1184 scan_rsp_len = append_local_name(hdev, ptr, scan_rsp_len); 1185 1186 return scan_rsp_len; 1187 } 1188 1189 void __hci_req_update_scan_rsp_data(struct hci_request *req, u8 instance) 1190 { 1191 struct hci_dev *hdev = req->hdev; 1192 u8 len; 1193 1194 if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED)) 1195 return; 1196 1197 if (ext_adv_capable(hdev)) { 1198 struct hci_cp_le_set_ext_scan_rsp_data cp; 1199 1200 memset(&cp, 0, sizeof(cp)); 1201 1202 if (instance) 1203 len = create_instance_scan_rsp_data(hdev, instance, 1204 cp.data); 1205 else 1206 len = create_default_scan_rsp_data(hdev, cp.data); 1207 1208 if (hdev->scan_rsp_data_len == len && 1209 !memcmp(cp.data, hdev->scan_rsp_data, len)) 1210 return; 1211 1212 memcpy(hdev->scan_rsp_data, cp.data, sizeof(cp.data)); 1213 hdev->scan_rsp_data_len = len; 1214 1215 cp.handle = 0; 1216 cp.length = len; 1217 cp.operation = LE_SET_ADV_DATA_OP_COMPLETE; 1218 cp.frag_pref = LE_SET_ADV_DATA_NO_FRAG; 1219 1220 hci_req_add(req, HCI_OP_LE_SET_EXT_SCAN_RSP_DATA, sizeof(cp), 1221 &cp); 1222 } else { 1223 struct hci_cp_le_set_scan_rsp_data cp; 1224 1225 memset(&cp, 0, sizeof(cp)); 1226 1227 if (instance) 1228 len = create_instance_scan_rsp_data(hdev, instance, 1229 cp.data); 1230 else 1231 len = create_default_scan_rsp_data(hdev, cp.data); 1232 1233 if (hdev->scan_rsp_data_len == len && 1234 !memcmp(cp.data, hdev->scan_rsp_data, len)) 1235 return; 1236 1237 memcpy(hdev->scan_rsp_data, cp.data, sizeof(cp.data)); 1238 hdev->scan_rsp_data_len = len; 1239 1240 cp.length = len; 1241 1242 hci_req_add(req, HCI_OP_LE_SET_SCAN_RSP_DATA, sizeof(cp), &cp); 1243 } 1244 } 1245 1246 static u8 create_instance_adv_data(struct hci_dev *hdev, u8 instance, u8 *ptr) 1247 { 1248 struct adv_info *adv_instance = NULL; 1249 u8 ad_len = 0, flags = 0; 1250 u32 instance_flags; 1251 1252 /* Return 0 when the current instance identifier is invalid. */ 1253 if (instance) { 1254 adv_instance = hci_find_adv_instance(hdev, instance); 1255 if (!adv_instance) 1256 return 0; 1257 } 1258 1259 instance_flags = get_adv_instance_flags(hdev, instance); 1260 1261 /* The Add Advertising command allows userspace to set both the general 1262 * and limited discoverable flags. 1263 */ 1264 if (instance_flags & MGMT_ADV_FLAG_DISCOV) 1265 flags |= LE_AD_GENERAL; 1266 1267 if (instance_flags & MGMT_ADV_FLAG_LIMITED_DISCOV) 1268 flags |= LE_AD_LIMITED; 1269 1270 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) 1271 flags |= LE_AD_NO_BREDR; 1272 1273 if (flags || (instance_flags & MGMT_ADV_FLAG_MANAGED_FLAGS)) { 1274 /* If a discovery flag wasn't provided, simply use the global 1275 * settings. 1276 */ 1277 if (!flags) 1278 flags |= mgmt_get_adv_discov_flags(hdev); 1279 1280 /* If flags would still be empty, then there is no need to 1281 * include the "Flags" AD field". 1282 */ 1283 if (flags) { 1284 ptr[0] = 0x02; 1285 ptr[1] = EIR_FLAGS; 1286 ptr[2] = flags; 1287 1288 ad_len += 3; 1289 ptr += 3; 1290 } 1291 } 1292 1293 if (adv_instance) { 1294 memcpy(ptr, adv_instance->adv_data, 1295 adv_instance->adv_data_len); 1296 ad_len += adv_instance->adv_data_len; 1297 ptr += adv_instance->adv_data_len; 1298 } 1299 1300 if (instance_flags & MGMT_ADV_FLAG_TX_POWER) { 1301 s8 adv_tx_power; 1302 1303 if (ext_adv_capable(hdev)) { 1304 if (adv_instance) 1305 adv_tx_power = adv_instance->tx_power; 1306 else 1307 adv_tx_power = hdev->adv_tx_power; 1308 } else { 1309 adv_tx_power = hdev->adv_tx_power; 1310 } 1311 1312 /* Provide Tx Power only if we can provide a valid value for it */ 1313 if (adv_tx_power != HCI_TX_POWER_INVALID) { 1314 ptr[0] = 0x02; 1315 ptr[1] = EIR_TX_POWER; 1316 ptr[2] = (u8)adv_tx_power; 1317 1318 ad_len += 3; 1319 ptr += 3; 1320 } 1321 } 1322 1323 return ad_len; 1324 } 1325 1326 void __hci_req_update_adv_data(struct hci_request *req, u8 instance) 1327 { 1328 struct hci_dev *hdev = req->hdev; 1329 u8 len; 1330 1331 if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED)) 1332 return; 1333 1334 if (ext_adv_capable(hdev)) { 1335 struct hci_cp_le_set_ext_adv_data cp; 1336 1337 memset(&cp, 0, sizeof(cp)); 1338 1339 len = create_instance_adv_data(hdev, instance, cp.data); 1340 1341 /* There's nothing to do if the data hasn't changed */ 1342 if (hdev->adv_data_len == len && 1343 memcmp(cp.data, hdev->adv_data, len) == 0) 1344 return; 1345 1346 memcpy(hdev->adv_data, cp.data, sizeof(cp.data)); 1347 hdev->adv_data_len = len; 1348 1349 cp.length = len; 1350 cp.handle = 0; 1351 cp.operation = LE_SET_ADV_DATA_OP_COMPLETE; 1352 cp.frag_pref = LE_SET_ADV_DATA_NO_FRAG; 1353 1354 hci_req_add(req, HCI_OP_LE_SET_EXT_ADV_DATA, sizeof(cp), &cp); 1355 } else { 1356 struct hci_cp_le_set_adv_data cp; 1357 1358 memset(&cp, 0, sizeof(cp)); 1359 1360 len = create_instance_adv_data(hdev, instance, cp.data); 1361 1362 /* There's nothing to do if the data hasn't changed */ 1363 if (hdev->adv_data_len == len && 1364 memcmp(cp.data, hdev->adv_data, len) == 0) 1365 return; 1366 1367 memcpy(hdev->adv_data, cp.data, sizeof(cp.data)); 1368 hdev->adv_data_len = len; 1369 1370 cp.length = len; 1371 1372 hci_req_add(req, HCI_OP_LE_SET_ADV_DATA, sizeof(cp), &cp); 1373 } 1374 } 1375 1376 int hci_req_update_adv_data(struct hci_dev *hdev, u8 instance) 1377 { 1378 struct hci_request req; 1379 1380 hci_req_init(&req, hdev); 1381 __hci_req_update_adv_data(&req, instance); 1382 1383 return hci_req_run(&req, NULL); 1384 } 1385 1386 static void adv_enable_complete(struct hci_dev *hdev, u8 status, u16 opcode) 1387 { 1388 BT_DBG("%s status %u", hdev->name, status); 1389 } 1390 1391 void hci_req_reenable_advertising(struct hci_dev *hdev) 1392 { 1393 struct hci_request req; 1394 1395 if (!hci_dev_test_flag(hdev, HCI_ADVERTISING) && 1396 list_empty(&hdev->adv_instances)) 1397 return; 1398 1399 hci_req_init(&req, hdev); 1400 1401 if (hdev->cur_adv_instance) { 1402 __hci_req_schedule_adv_instance(&req, hdev->cur_adv_instance, 1403 true); 1404 } else { 1405 if (ext_adv_capable(hdev)) { 1406 __hci_req_start_ext_adv(&req, 0x00); 1407 } else { 1408 __hci_req_update_adv_data(&req, 0x00); 1409 __hci_req_update_scan_rsp_data(&req, 0x00); 1410 __hci_req_enable_advertising(&req); 1411 } 1412 } 1413 1414 hci_req_run(&req, adv_enable_complete); 1415 } 1416 1417 static void adv_timeout_expire(struct work_struct *work) 1418 { 1419 struct hci_dev *hdev = container_of(work, struct hci_dev, 1420 adv_instance_expire.work); 1421 1422 struct hci_request req; 1423 u8 instance; 1424 1425 BT_DBG("%s", hdev->name); 1426 1427 hci_dev_lock(hdev); 1428 1429 hdev->adv_instance_timeout = 0; 1430 1431 instance = hdev->cur_adv_instance; 1432 if (instance == 0x00) 1433 goto unlock; 1434 1435 hci_req_init(&req, hdev); 1436 1437 hci_req_clear_adv_instance(hdev, NULL, &req, instance, false); 1438 1439 if (list_empty(&hdev->adv_instances)) 1440 __hci_req_disable_advertising(&req); 1441 1442 hci_req_run(&req, NULL); 1443 1444 unlock: 1445 hci_dev_unlock(hdev); 1446 } 1447 1448 int hci_get_random_address(struct hci_dev *hdev, bool require_privacy, 1449 bool use_rpa, struct adv_info *adv_instance, 1450 u8 *own_addr_type, bdaddr_t *rand_addr) 1451 { 1452 int err; 1453 1454 bacpy(rand_addr, BDADDR_ANY); 1455 1456 /* If privacy is enabled use a resolvable private address. If 1457 * current RPA has expired then generate a new one. 1458 */ 1459 if (use_rpa) { 1460 int to; 1461 1462 *own_addr_type = ADDR_LE_DEV_RANDOM; 1463 1464 if (adv_instance) { 1465 if (!adv_instance->rpa_expired && 1466 !bacmp(&adv_instance->random_addr, &hdev->rpa)) 1467 return 0; 1468 1469 adv_instance->rpa_expired = false; 1470 } else { 1471 if (!hci_dev_test_and_clear_flag(hdev, HCI_RPA_EXPIRED) && 1472 !bacmp(&hdev->random_addr, &hdev->rpa)) 1473 return 0; 1474 } 1475 1476 err = smp_generate_rpa(hdev, hdev->irk, &hdev->rpa); 1477 if (err < 0) { 1478 BT_ERR("%s failed to generate new RPA", hdev->name); 1479 return err; 1480 } 1481 1482 bacpy(rand_addr, &hdev->rpa); 1483 1484 to = msecs_to_jiffies(hdev->rpa_timeout * 1000); 1485 if (adv_instance) 1486 queue_delayed_work(hdev->workqueue, 1487 &adv_instance->rpa_expired_cb, to); 1488 else 1489 queue_delayed_work(hdev->workqueue, 1490 &hdev->rpa_expired, to); 1491 1492 return 0; 1493 } 1494 1495 /* In case of required privacy without resolvable private address, 1496 * use an non-resolvable private address. This is useful for 1497 * non-connectable advertising. 1498 */ 1499 if (require_privacy) { 1500 bdaddr_t nrpa; 1501 1502 while (true) { 1503 /* The non-resolvable private address is generated 1504 * from random six bytes with the two most significant 1505 * bits cleared. 1506 */ 1507 get_random_bytes(&nrpa, 6); 1508 nrpa.b[5] &= 0x3f; 1509 1510 /* The non-resolvable private address shall not be 1511 * equal to the public address. 1512 */ 1513 if (bacmp(&hdev->bdaddr, &nrpa)) 1514 break; 1515 } 1516 1517 *own_addr_type = ADDR_LE_DEV_RANDOM; 1518 bacpy(rand_addr, &nrpa); 1519 1520 return 0; 1521 } 1522 1523 /* No privacy so use a public address. */ 1524 *own_addr_type = ADDR_LE_DEV_PUBLIC; 1525 1526 return 0; 1527 } 1528 1529 void __hci_req_clear_ext_adv_sets(struct hci_request *req) 1530 { 1531 hci_req_add(req, HCI_OP_LE_CLEAR_ADV_SETS, 0, NULL); 1532 } 1533 1534 int __hci_req_setup_ext_adv_instance(struct hci_request *req, u8 instance) 1535 { 1536 struct hci_cp_le_set_ext_adv_params cp; 1537 struct hci_dev *hdev = req->hdev; 1538 bool connectable; 1539 u32 flags; 1540 bdaddr_t random_addr; 1541 u8 own_addr_type; 1542 int err; 1543 struct adv_info *adv_instance; 1544 bool secondary_adv; 1545 /* In ext adv set param interval is 3 octets */ 1546 const u8 adv_interval[3] = { 0x00, 0x08, 0x00 }; 1547 1548 if (instance > 0) { 1549 adv_instance = hci_find_adv_instance(hdev, instance); 1550 if (!adv_instance) 1551 return -EINVAL; 1552 } else { 1553 adv_instance = NULL; 1554 } 1555 1556 flags = get_adv_instance_flags(hdev, instance); 1557 1558 /* If the "connectable" instance flag was not set, then choose between 1559 * ADV_IND and ADV_NONCONN_IND based on the global connectable setting. 1560 */ 1561 connectable = (flags & MGMT_ADV_FLAG_CONNECTABLE) || 1562 mgmt_get_connectable(hdev); 1563 1564 if (!is_advertising_allowed(hdev, connectable)) 1565 return -EPERM; 1566 1567 /* Set require_privacy to true only when non-connectable 1568 * advertising is used. In that case it is fine to use a 1569 * non-resolvable private address. 1570 */ 1571 err = hci_get_random_address(hdev, !connectable, 1572 adv_use_rpa(hdev, flags), adv_instance, 1573 &own_addr_type, &random_addr); 1574 if (err < 0) 1575 return err; 1576 1577 memset(&cp, 0, sizeof(cp)); 1578 1579 memcpy(cp.min_interval, adv_interval, sizeof(cp.min_interval)); 1580 memcpy(cp.max_interval, adv_interval, sizeof(cp.max_interval)); 1581 1582 secondary_adv = (flags & MGMT_ADV_FLAG_SEC_MASK); 1583 1584 if (connectable) { 1585 if (secondary_adv) 1586 cp.evt_properties = cpu_to_le16(LE_EXT_ADV_CONN_IND); 1587 else 1588 cp.evt_properties = cpu_to_le16(LE_LEGACY_ADV_IND); 1589 } else if (get_adv_instance_scan_rsp_len(hdev, instance)) { 1590 if (secondary_adv) 1591 cp.evt_properties = cpu_to_le16(LE_EXT_ADV_SCAN_IND); 1592 else 1593 cp.evt_properties = cpu_to_le16(LE_LEGACY_ADV_SCAN_IND); 1594 } else { 1595 if (secondary_adv) 1596 cp.evt_properties = cpu_to_le16(LE_EXT_ADV_NON_CONN_IND); 1597 else 1598 cp.evt_properties = cpu_to_le16(LE_LEGACY_NONCONN_IND); 1599 } 1600 1601 cp.own_addr_type = own_addr_type; 1602 cp.channel_map = hdev->le_adv_channel_map; 1603 cp.tx_power = 127; 1604 cp.handle = 0; 1605 1606 if (flags & MGMT_ADV_FLAG_SEC_2M) { 1607 cp.primary_phy = HCI_ADV_PHY_1M; 1608 cp.secondary_phy = HCI_ADV_PHY_2M; 1609 } else if (flags & MGMT_ADV_FLAG_SEC_CODED) { 1610 cp.primary_phy = HCI_ADV_PHY_CODED; 1611 cp.secondary_phy = HCI_ADV_PHY_CODED; 1612 } else { 1613 /* In all other cases use 1M */ 1614 cp.primary_phy = HCI_ADV_PHY_1M; 1615 cp.secondary_phy = HCI_ADV_PHY_1M; 1616 } 1617 1618 hci_req_add(req, HCI_OP_LE_SET_EXT_ADV_PARAMS, sizeof(cp), &cp); 1619 1620 if (own_addr_type == ADDR_LE_DEV_RANDOM && 1621 bacmp(&random_addr, BDADDR_ANY)) { 1622 struct hci_cp_le_set_adv_set_rand_addr cp; 1623 1624 /* Check if random address need to be updated */ 1625 if (adv_instance) { 1626 if (!bacmp(&random_addr, &adv_instance->random_addr)) 1627 return 0; 1628 } else { 1629 if (!bacmp(&random_addr, &hdev->random_addr)) 1630 return 0; 1631 } 1632 1633 memset(&cp, 0, sizeof(cp)); 1634 1635 cp.handle = 0; 1636 bacpy(&cp.bdaddr, &random_addr); 1637 1638 hci_req_add(req, 1639 HCI_OP_LE_SET_ADV_SET_RAND_ADDR, 1640 sizeof(cp), &cp); 1641 } 1642 1643 return 0; 1644 } 1645 1646 void __hci_req_enable_ext_advertising(struct hci_request *req) 1647 { 1648 struct hci_cp_le_set_ext_adv_enable *cp; 1649 struct hci_cp_ext_adv_set *adv_set; 1650 u8 data[sizeof(*cp) + sizeof(*adv_set) * 1]; 1651 1652 cp = (void *) data; 1653 adv_set = (void *) cp->data; 1654 1655 memset(cp, 0, sizeof(*cp)); 1656 1657 cp->enable = 0x01; 1658 cp->num_of_sets = 0x01; 1659 1660 memset(adv_set, 0, sizeof(*adv_set)); 1661 1662 adv_set->handle = 0; 1663 1664 hci_req_add(req, HCI_OP_LE_SET_EXT_ADV_ENABLE, 1665 sizeof(*cp) + sizeof(*adv_set) * cp->num_of_sets, 1666 data); 1667 } 1668 1669 int __hci_req_start_ext_adv(struct hci_request *req, u8 instance) 1670 { 1671 struct hci_dev *hdev = req->hdev; 1672 int err; 1673 1674 if (hci_dev_test_flag(hdev, HCI_LE_ADV)) 1675 __hci_req_disable_advertising(req); 1676 1677 err = __hci_req_setup_ext_adv_instance(req, instance); 1678 if (err < 0) 1679 return err; 1680 1681 __hci_req_update_scan_rsp_data(req, instance); 1682 __hci_req_enable_ext_advertising(req); 1683 1684 return 0; 1685 } 1686 1687 int __hci_req_schedule_adv_instance(struct hci_request *req, u8 instance, 1688 bool force) 1689 { 1690 struct hci_dev *hdev = req->hdev; 1691 struct adv_info *adv_instance = NULL; 1692 u16 timeout; 1693 1694 if (hci_dev_test_flag(hdev, HCI_ADVERTISING) || 1695 list_empty(&hdev->adv_instances)) 1696 return -EPERM; 1697 1698 if (hdev->adv_instance_timeout) 1699 return -EBUSY; 1700 1701 adv_instance = hci_find_adv_instance(hdev, instance); 1702 if (!adv_instance) 1703 return -ENOENT; 1704 1705 /* A zero timeout means unlimited advertising. As long as there is 1706 * only one instance, duration should be ignored. We still set a timeout 1707 * in case further instances are being added later on. 1708 * 1709 * If the remaining lifetime of the instance is more than the duration 1710 * then the timeout corresponds to the duration, otherwise it will be 1711 * reduced to the remaining instance lifetime. 1712 */ 1713 if (adv_instance->timeout == 0 || 1714 adv_instance->duration <= adv_instance->remaining_time) 1715 timeout = adv_instance->duration; 1716 else 1717 timeout = adv_instance->remaining_time; 1718 1719 /* The remaining time is being reduced unless the instance is being 1720 * advertised without time limit. 1721 */ 1722 if (adv_instance->timeout) 1723 adv_instance->remaining_time = 1724 adv_instance->remaining_time - timeout; 1725 1726 hdev->adv_instance_timeout = timeout; 1727 queue_delayed_work(hdev->req_workqueue, 1728 &hdev->adv_instance_expire, 1729 msecs_to_jiffies(timeout * 1000)); 1730 1731 /* If we're just re-scheduling the same instance again then do not 1732 * execute any HCI commands. This happens when a single instance is 1733 * being advertised. 1734 */ 1735 if (!force && hdev->cur_adv_instance == instance && 1736 hci_dev_test_flag(hdev, HCI_LE_ADV)) 1737 return 0; 1738 1739 hdev->cur_adv_instance = instance; 1740 if (ext_adv_capable(hdev)) { 1741 __hci_req_start_ext_adv(req, instance); 1742 } else { 1743 __hci_req_update_adv_data(req, instance); 1744 __hci_req_update_scan_rsp_data(req, instance); 1745 __hci_req_enable_advertising(req); 1746 } 1747 1748 return 0; 1749 } 1750 1751 static void cancel_adv_timeout(struct hci_dev *hdev) 1752 { 1753 if (hdev->adv_instance_timeout) { 1754 hdev->adv_instance_timeout = 0; 1755 cancel_delayed_work(&hdev->adv_instance_expire); 1756 } 1757 } 1758 1759 /* For a single instance: 1760 * - force == true: The instance will be removed even when its remaining 1761 * lifetime is not zero. 1762 * - force == false: the instance will be deactivated but kept stored unless 1763 * the remaining lifetime is zero. 1764 * 1765 * For instance == 0x00: 1766 * - force == true: All instances will be removed regardless of their timeout 1767 * setting. 1768 * - force == false: Only instances that have a timeout will be removed. 1769 */ 1770 void hci_req_clear_adv_instance(struct hci_dev *hdev, struct sock *sk, 1771 struct hci_request *req, u8 instance, 1772 bool force) 1773 { 1774 struct adv_info *adv_instance, *n, *next_instance = NULL; 1775 int err; 1776 u8 rem_inst; 1777 1778 /* Cancel any timeout concerning the removed instance(s). */ 1779 if (!instance || hdev->cur_adv_instance == instance) 1780 cancel_adv_timeout(hdev); 1781 1782 /* Get the next instance to advertise BEFORE we remove 1783 * the current one. This can be the same instance again 1784 * if there is only one instance. 1785 */ 1786 if (instance && hdev->cur_adv_instance == instance) 1787 next_instance = hci_get_next_instance(hdev, instance); 1788 1789 if (instance == 0x00) { 1790 list_for_each_entry_safe(adv_instance, n, &hdev->adv_instances, 1791 list) { 1792 if (!(force || adv_instance->timeout)) 1793 continue; 1794 1795 rem_inst = adv_instance->instance; 1796 err = hci_remove_adv_instance(hdev, rem_inst); 1797 if (!err) 1798 mgmt_advertising_removed(sk, hdev, rem_inst); 1799 } 1800 } else { 1801 adv_instance = hci_find_adv_instance(hdev, instance); 1802 1803 if (force || (adv_instance && adv_instance->timeout && 1804 !adv_instance->remaining_time)) { 1805 /* Don't advertise a removed instance. */ 1806 if (next_instance && 1807 next_instance->instance == instance) 1808 next_instance = NULL; 1809 1810 err = hci_remove_adv_instance(hdev, instance); 1811 if (!err) 1812 mgmt_advertising_removed(sk, hdev, instance); 1813 } 1814 } 1815 1816 if (!req || !hdev_is_powered(hdev) || 1817 hci_dev_test_flag(hdev, HCI_ADVERTISING)) 1818 return; 1819 1820 if (next_instance) 1821 __hci_req_schedule_adv_instance(req, next_instance->instance, 1822 false); 1823 } 1824 1825 static void set_random_addr(struct hci_request *req, bdaddr_t *rpa) 1826 { 1827 struct hci_dev *hdev = req->hdev; 1828 1829 /* If we're advertising or initiating an LE connection we can't 1830 * go ahead and change the random address at this time. This is 1831 * because the eventual initiator address used for the 1832 * subsequently created connection will be undefined (some 1833 * controllers use the new address and others the one we had 1834 * when the operation started). 1835 * 1836 * In this kind of scenario skip the update and let the random 1837 * address be updated at the next cycle. 1838 */ 1839 if (hci_dev_test_flag(hdev, HCI_LE_ADV) || 1840 hci_lookup_le_connect(hdev)) { 1841 BT_DBG("Deferring random address update"); 1842 hci_dev_set_flag(hdev, HCI_RPA_EXPIRED); 1843 return; 1844 } 1845 1846 hci_req_add(req, HCI_OP_LE_SET_RANDOM_ADDR, 6, rpa); 1847 } 1848 1849 int hci_update_random_address(struct hci_request *req, bool require_privacy, 1850 bool use_rpa, u8 *own_addr_type) 1851 { 1852 struct hci_dev *hdev = req->hdev; 1853 int err; 1854 1855 /* If privacy is enabled use a resolvable private address. If 1856 * current RPA has expired or there is something else than 1857 * the current RPA in use, then generate a new one. 1858 */ 1859 if (use_rpa) { 1860 int to; 1861 1862 *own_addr_type = ADDR_LE_DEV_RANDOM; 1863 1864 if (!hci_dev_test_and_clear_flag(hdev, HCI_RPA_EXPIRED) && 1865 !bacmp(&hdev->random_addr, &hdev->rpa)) 1866 return 0; 1867 1868 err = smp_generate_rpa(hdev, hdev->irk, &hdev->rpa); 1869 if (err < 0) { 1870 bt_dev_err(hdev, "failed to generate new RPA"); 1871 return err; 1872 } 1873 1874 set_random_addr(req, &hdev->rpa); 1875 1876 to = msecs_to_jiffies(hdev->rpa_timeout * 1000); 1877 queue_delayed_work(hdev->workqueue, &hdev->rpa_expired, to); 1878 1879 return 0; 1880 } 1881 1882 /* In case of required privacy without resolvable private address, 1883 * use an non-resolvable private address. This is useful for active 1884 * scanning and non-connectable advertising. 1885 */ 1886 if (require_privacy) { 1887 bdaddr_t nrpa; 1888 1889 while (true) { 1890 /* The non-resolvable private address is generated 1891 * from random six bytes with the two most significant 1892 * bits cleared. 1893 */ 1894 get_random_bytes(&nrpa, 6); 1895 nrpa.b[5] &= 0x3f; 1896 1897 /* The non-resolvable private address shall not be 1898 * equal to the public address. 1899 */ 1900 if (bacmp(&hdev->bdaddr, &nrpa)) 1901 break; 1902 } 1903 1904 *own_addr_type = ADDR_LE_DEV_RANDOM; 1905 set_random_addr(req, &nrpa); 1906 return 0; 1907 } 1908 1909 /* If forcing static address is in use or there is no public 1910 * address use the static address as random address (but skip 1911 * the HCI command if the current random address is already the 1912 * static one. 1913 * 1914 * In case BR/EDR has been disabled on a dual-mode controller 1915 * and a static address has been configured, then use that 1916 * address instead of the public BR/EDR address. 1917 */ 1918 if (hci_dev_test_flag(hdev, HCI_FORCE_STATIC_ADDR) || 1919 !bacmp(&hdev->bdaddr, BDADDR_ANY) || 1920 (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) && 1921 bacmp(&hdev->static_addr, BDADDR_ANY))) { 1922 *own_addr_type = ADDR_LE_DEV_RANDOM; 1923 if (bacmp(&hdev->static_addr, &hdev->random_addr)) 1924 hci_req_add(req, HCI_OP_LE_SET_RANDOM_ADDR, 6, 1925 &hdev->static_addr); 1926 return 0; 1927 } 1928 1929 /* Neither privacy nor static address is being used so use a 1930 * public address. 1931 */ 1932 *own_addr_type = ADDR_LE_DEV_PUBLIC; 1933 1934 return 0; 1935 } 1936 1937 static bool disconnected_whitelist_entries(struct hci_dev *hdev) 1938 { 1939 struct bdaddr_list *b; 1940 1941 list_for_each_entry(b, &hdev->whitelist, list) { 1942 struct hci_conn *conn; 1943 1944 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &b->bdaddr); 1945 if (!conn) 1946 return true; 1947 1948 if (conn->state != BT_CONNECTED && conn->state != BT_CONFIG) 1949 return true; 1950 } 1951 1952 return false; 1953 } 1954 1955 void __hci_req_update_scan(struct hci_request *req) 1956 { 1957 struct hci_dev *hdev = req->hdev; 1958 u8 scan; 1959 1960 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) 1961 return; 1962 1963 if (!hdev_is_powered(hdev)) 1964 return; 1965 1966 if (mgmt_powering_down(hdev)) 1967 return; 1968 1969 if (hci_dev_test_flag(hdev, HCI_CONNECTABLE) || 1970 disconnected_whitelist_entries(hdev)) 1971 scan = SCAN_PAGE; 1972 else 1973 scan = SCAN_DISABLED; 1974 1975 if (hci_dev_test_flag(hdev, HCI_DISCOVERABLE)) 1976 scan |= SCAN_INQUIRY; 1977 1978 if (test_bit(HCI_PSCAN, &hdev->flags) == !!(scan & SCAN_PAGE) && 1979 test_bit(HCI_ISCAN, &hdev->flags) == !!(scan & SCAN_INQUIRY)) 1980 return; 1981 1982 hci_req_add(req, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan); 1983 } 1984 1985 static int update_scan(struct hci_request *req, unsigned long opt) 1986 { 1987 hci_dev_lock(req->hdev); 1988 __hci_req_update_scan(req); 1989 hci_dev_unlock(req->hdev); 1990 return 0; 1991 } 1992 1993 static void scan_update_work(struct work_struct *work) 1994 { 1995 struct hci_dev *hdev = container_of(work, struct hci_dev, scan_update); 1996 1997 hci_req_sync(hdev, update_scan, 0, HCI_CMD_TIMEOUT, NULL); 1998 } 1999 2000 static int connectable_update(struct hci_request *req, unsigned long opt) 2001 { 2002 struct hci_dev *hdev = req->hdev; 2003 2004 hci_dev_lock(hdev); 2005 2006 __hci_req_update_scan(req); 2007 2008 /* If BR/EDR is not enabled and we disable advertising as a 2009 * by-product of disabling connectable, we need to update the 2010 * advertising flags. 2011 */ 2012 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) 2013 __hci_req_update_adv_data(req, hdev->cur_adv_instance); 2014 2015 /* Update the advertising parameters if necessary */ 2016 if (hci_dev_test_flag(hdev, HCI_ADVERTISING) || 2017 !list_empty(&hdev->adv_instances)) { 2018 if (ext_adv_capable(hdev)) 2019 __hci_req_start_ext_adv(req, hdev->cur_adv_instance); 2020 else 2021 __hci_req_enable_advertising(req); 2022 } 2023 2024 __hci_update_background_scan(req); 2025 2026 hci_dev_unlock(hdev); 2027 2028 return 0; 2029 } 2030 2031 static void connectable_update_work(struct work_struct *work) 2032 { 2033 struct hci_dev *hdev = container_of(work, struct hci_dev, 2034 connectable_update); 2035 u8 status; 2036 2037 hci_req_sync(hdev, connectable_update, 0, HCI_CMD_TIMEOUT, &status); 2038 mgmt_set_connectable_complete(hdev, status); 2039 } 2040 2041 static u8 get_service_classes(struct hci_dev *hdev) 2042 { 2043 struct bt_uuid *uuid; 2044 u8 val = 0; 2045 2046 list_for_each_entry(uuid, &hdev->uuids, list) 2047 val |= uuid->svc_hint; 2048 2049 return val; 2050 } 2051 2052 void __hci_req_update_class(struct hci_request *req) 2053 { 2054 struct hci_dev *hdev = req->hdev; 2055 u8 cod[3]; 2056 2057 BT_DBG("%s", hdev->name); 2058 2059 if (!hdev_is_powered(hdev)) 2060 return; 2061 2062 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) 2063 return; 2064 2065 if (hci_dev_test_flag(hdev, HCI_SERVICE_CACHE)) 2066 return; 2067 2068 cod[0] = hdev->minor_class; 2069 cod[1] = hdev->major_class; 2070 cod[2] = get_service_classes(hdev); 2071 2072 if (hci_dev_test_flag(hdev, HCI_LIMITED_DISCOVERABLE)) 2073 cod[1] |= 0x20; 2074 2075 if (memcmp(cod, hdev->dev_class, 3) == 0) 2076 return; 2077 2078 hci_req_add(req, HCI_OP_WRITE_CLASS_OF_DEV, sizeof(cod), cod); 2079 } 2080 2081 static void write_iac(struct hci_request *req) 2082 { 2083 struct hci_dev *hdev = req->hdev; 2084 struct hci_cp_write_current_iac_lap cp; 2085 2086 if (!hci_dev_test_flag(hdev, HCI_DISCOVERABLE)) 2087 return; 2088 2089 if (hci_dev_test_flag(hdev, HCI_LIMITED_DISCOVERABLE)) { 2090 /* Limited discoverable mode */ 2091 cp.num_iac = min_t(u8, hdev->num_iac, 2); 2092 cp.iac_lap[0] = 0x00; /* LIAC */ 2093 cp.iac_lap[1] = 0x8b; 2094 cp.iac_lap[2] = 0x9e; 2095 cp.iac_lap[3] = 0x33; /* GIAC */ 2096 cp.iac_lap[4] = 0x8b; 2097 cp.iac_lap[5] = 0x9e; 2098 } else { 2099 /* General discoverable mode */ 2100 cp.num_iac = 1; 2101 cp.iac_lap[0] = 0x33; /* GIAC */ 2102 cp.iac_lap[1] = 0x8b; 2103 cp.iac_lap[2] = 0x9e; 2104 } 2105 2106 hci_req_add(req, HCI_OP_WRITE_CURRENT_IAC_LAP, 2107 (cp.num_iac * 3) + 1, &cp); 2108 } 2109 2110 static int discoverable_update(struct hci_request *req, unsigned long opt) 2111 { 2112 struct hci_dev *hdev = req->hdev; 2113 2114 hci_dev_lock(hdev); 2115 2116 if (hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) { 2117 write_iac(req); 2118 __hci_req_update_scan(req); 2119 __hci_req_update_class(req); 2120 } 2121 2122 /* Advertising instances don't use the global discoverable setting, so 2123 * only update AD if advertising was enabled using Set Advertising. 2124 */ 2125 if (hci_dev_test_flag(hdev, HCI_ADVERTISING)) { 2126 __hci_req_update_adv_data(req, 0x00); 2127 2128 /* Discoverable mode affects the local advertising 2129 * address in limited privacy mode. 2130 */ 2131 if (hci_dev_test_flag(hdev, HCI_LIMITED_PRIVACY)) { 2132 if (ext_adv_capable(hdev)) 2133 __hci_req_start_ext_adv(req, 0x00); 2134 else 2135 __hci_req_enable_advertising(req); 2136 } 2137 } 2138 2139 hci_dev_unlock(hdev); 2140 2141 return 0; 2142 } 2143 2144 static void discoverable_update_work(struct work_struct *work) 2145 { 2146 struct hci_dev *hdev = container_of(work, struct hci_dev, 2147 discoverable_update); 2148 u8 status; 2149 2150 hci_req_sync(hdev, discoverable_update, 0, HCI_CMD_TIMEOUT, &status); 2151 mgmt_set_discoverable_complete(hdev, status); 2152 } 2153 2154 void __hci_abort_conn(struct hci_request *req, struct hci_conn *conn, 2155 u8 reason) 2156 { 2157 switch (conn->state) { 2158 case BT_CONNECTED: 2159 case BT_CONFIG: 2160 if (conn->type == AMP_LINK) { 2161 struct hci_cp_disconn_phy_link cp; 2162 2163 cp.phy_handle = HCI_PHY_HANDLE(conn->handle); 2164 cp.reason = reason; 2165 hci_req_add(req, HCI_OP_DISCONN_PHY_LINK, sizeof(cp), 2166 &cp); 2167 } else { 2168 struct hci_cp_disconnect dc; 2169 2170 dc.handle = cpu_to_le16(conn->handle); 2171 dc.reason = reason; 2172 hci_req_add(req, HCI_OP_DISCONNECT, sizeof(dc), &dc); 2173 } 2174 2175 conn->state = BT_DISCONN; 2176 2177 break; 2178 case BT_CONNECT: 2179 if (conn->type == LE_LINK) { 2180 if (test_bit(HCI_CONN_SCANNING, &conn->flags)) 2181 break; 2182 hci_req_add(req, HCI_OP_LE_CREATE_CONN_CANCEL, 2183 0, NULL); 2184 } else if (conn->type == ACL_LINK) { 2185 if (req->hdev->hci_ver < BLUETOOTH_VER_1_2) 2186 break; 2187 hci_req_add(req, HCI_OP_CREATE_CONN_CANCEL, 2188 6, &conn->dst); 2189 } 2190 break; 2191 case BT_CONNECT2: 2192 if (conn->type == ACL_LINK) { 2193 struct hci_cp_reject_conn_req rej; 2194 2195 bacpy(&rej.bdaddr, &conn->dst); 2196 rej.reason = reason; 2197 2198 hci_req_add(req, HCI_OP_REJECT_CONN_REQ, 2199 sizeof(rej), &rej); 2200 } else if (conn->type == SCO_LINK || conn->type == ESCO_LINK) { 2201 struct hci_cp_reject_sync_conn_req rej; 2202 2203 bacpy(&rej.bdaddr, &conn->dst); 2204 2205 /* SCO rejection has its own limited set of 2206 * allowed error values (0x0D-0x0F) which isn't 2207 * compatible with most values passed to this 2208 * function. To be safe hard-code one of the 2209 * values that's suitable for SCO. 2210 */ 2211 rej.reason = HCI_ERROR_REJ_LIMITED_RESOURCES; 2212 2213 hci_req_add(req, HCI_OP_REJECT_SYNC_CONN_REQ, 2214 sizeof(rej), &rej); 2215 } 2216 break; 2217 default: 2218 conn->state = BT_CLOSED; 2219 break; 2220 } 2221 } 2222 2223 static void abort_conn_complete(struct hci_dev *hdev, u8 status, u16 opcode) 2224 { 2225 if (status) 2226 BT_DBG("Failed to abort connection: status 0x%2.2x", status); 2227 } 2228 2229 int hci_abort_conn(struct hci_conn *conn, u8 reason) 2230 { 2231 struct hci_request req; 2232 int err; 2233 2234 hci_req_init(&req, conn->hdev); 2235 2236 __hci_abort_conn(&req, conn, reason); 2237 2238 err = hci_req_run(&req, abort_conn_complete); 2239 if (err && err != -ENODATA) { 2240 bt_dev_err(conn->hdev, "failed to run HCI request: err %d", err); 2241 return err; 2242 } 2243 2244 return 0; 2245 } 2246 2247 static int update_bg_scan(struct hci_request *req, unsigned long opt) 2248 { 2249 hci_dev_lock(req->hdev); 2250 __hci_update_background_scan(req); 2251 hci_dev_unlock(req->hdev); 2252 return 0; 2253 } 2254 2255 static void bg_scan_update(struct work_struct *work) 2256 { 2257 struct hci_dev *hdev = container_of(work, struct hci_dev, 2258 bg_scan_update); 2259 struct hci_conn *conn; 2260 u8 status; 2261 int err; 2262 2263 err = hci_req_sync(hdev, update_bg_scan, 0, HCI_CMD_TIMEOUT, &status); 2264 if (!err) 2265 return; 2266 2267 hci_dev_lock(hdev); 2268 2269 conn = hci_conn_hash_lookup_state(hdev, LE_LINK, BT_CONNECT); 2270 if (conn) 2271 hci_le_conn_failed(conn, status); 2272 2273 hci_dev_unlock(hdev); 2274 } 2275 2276 static int le_scan_disable(struct hci_request *req, unsigned long opt) 2277 { 2278 hci_req_add_le_scan_disable(req); 2279 return 0; 2280 } 2281 2282 static int bredr_inquiry(struct hci_request *req, unsigned long opt) 2283 { 2284 u8 length = opt; 2285 const u8 giac[3] = { 0x33, 0x8b, 0x9e }; 2286 const u8 liac[3] = { 0x00, 0x8b, 0x9e }; 2287 struct hci_cp_inquiry cp; 2288 2289 BT_DBG("%s", req->hdev->name); 2290 2291 hci_dev_lock(req->hdev); 2292 hci_inquiry_cache_flush(req->hdev); 2293 hci_dev_unlock(req->hdev); 2294 2295 memset(&cp, 0, sizeof(cp)); 2296 2297 if (req->hdev->discovery.limited) 2298 memcpy(&cp.lap, liac, sizeof(cp.lap)); 2299 else 2300 memcpy(&cp.lap, giac, sizeof(cp.lap)); 2301 2302 cp.length = length; 2303 2304 hci_req_add(req, HCI_OP_INQUIRY, sizeof(cp), &cp); 2305 2306 return 0; 2307 } 2308 2309 static void le_scan_disable_work(struct work_struct *work) 2310 { 2311 struct hci_dev *hdev = container_of(work, struct hci_dev, 2312 le_scan_disable.work); 2313 u8 status; 2314 2315 BT_DBG("%s", hdev->name); 2316 2317 if (!hci_dev_test_flag(hdev, HCI_LE_SCAN)) 2318 return; 2319 2320 cancel_delayed_work(&hdev->le_scan_restart); 2321 2322 hci_req_sync(hdev, le_scan_disable, 0, HCI_CMD_TIMEOUT, &status); 2323 if (status) { 2324 bt_dev_err(hdev, "failed to disable LE scan: status 0x%02x", 2325 status); 2326 return; 2327 } 2328 2329 hdev->discovery.scan_start = 0; 2330 2331 /* If we were running LE only scan, change discovery state. If 2332 * we were running both LE and BR/EDR inquiry simultaneously, 2333 * and BR/EDR inquiry is already finished, stop discovery, 2334 * otherwise BR/EDR inquiry will stop discovery when finished. 2335 * If we will resolve remote device name, do not change 2336 * discovery state. 2337 */ 2338 2339 if (hdev->discovery.type == DISCOV_TYPE_LE) 2340 goto discov_stopped; 2341 2342 if (hdev->discovery.type != DISCOV_TYPE_INTERLEAVED) 2343 return; 2344 2345 if (test_bit(HCI_QUIRK_SIMULTANEOUS_DISCOVERY, &hdev->quirks)) { 2346 if (!test_bit(HCI_INQUIRY, &hdev->flags) && 2347 hdev->discovery.state != DISCOVERY_RESOLVING) 2348 goto discov_stopped; 2349 2350 return; 2351 } 2352 2353 hci_req_sync(hdev, bredr_inquiry, DISCOV_INTERLEAVED_INQUIRY_LEN, 2354 HCI_CMD_TIMEOUT, &status); 2355 if (status) { 2356 bt_dev_err(hdev, "inquiry failed: status 0x%02x", status); 2357 goto discov_stopped; 2358 } 2359 2360 return; 2361 2362 discov_stopped: 2363 hci_dev_lock(hdev); 2364 hci_discovery_set_state(hdev, DISCOVERY_STOPPED); 2365 hci_dev_unlock(hdev); 2366 } 2367 2368 static int le_scan_restart(struct hci_request *req, unsigned long opt) 2369 { 2370 struct hci_dev *hdev = req->hdev; 2371 2372 /* If controller is not scanning we are done. */ 2373 if (!hci_dev_test_flag(hdev, HCI_LE_SCAN)) 2374 return 0; 2375 2376 hci_req_add_le_scan_disable(req); 2377 2378 if (use_ext_scan(hdev)) { 2379 struct hci_cp_le_set_ext_scan_enable ext_enable_cp; 2380 2381 memset(&ext_enable_cp, 0, sizeof(ext_enable_cp)); 2382 ext_enable_cp.enable = LE_SCAN_ENABLE; 2383 ext_enable_cp.filter_dup = LE_SCAN_FILTER_DUP_ENABLE; 2384 2385 hci_req_add(req, HCI_OP_LE_SET_EXT_SCAN_ENABLE, 2386 sizeof(ext_enable_cp), &ext_enable_cp); 2387 } else { 2388 struct hci_cp_le_set_scan_enable cp; 2389 2390 memset(&cp, 0, sizeof(cp)); 2391 cp.enable = LE_SCAN_ENABLE; 2392 cp.filter_dup = LE_SCAN_FILTER_DUP_ENABLE; 2393 hci_req_add(req, HCI_OP_LE_SET_SCAN_ENABLE, sizeof(cp), &cp); 2394 } 2395 2396 return 0; 2397 } 2398 2399 static void le_scan_restart_work(struct work_struct *work) 2400 { 2401 struct hci_dev *hdev = container_of(work, struct hci_dev, 2402 le_scan_restart.work); 2403 unsigned long timeout, duration, scan_start, now; 2404 u8 status; 2405 2406 BT_DBG("%s", hdev->name); 2407 2408 hci_req_sync(hdev, le_scan_restart, 0, HCI_CMD_TIMEOUT, &status); 2409 if (status) { 2410 bt_dev_err(hdev, "failed to restart LE scan: status %d", 2411 status); 2412 return; 2413 } 2414 2415 hci_dev_lock(hdev); 2416 2417 if (!test_bit(HCI_QUIRK_STRICT_DUPLICATE_FILTER, &hdev->quirks) || 2418 !hdev->discovery.scan_start) 2419 goto unlock; 2420 2421 /* When the scan was started, hdev->le_scan_disable has been queued 2422 * after duration from scan_start. During scan restart this job 2423 * has been canceled, and we need to queue it again after proper 2424 * timeout, to make sure that scan does not run indefinitely. 2425 */ 2426 duration = hdev->discovery.scan_duration; 2427 scan_start = hdev->discovery.scan_start; 2428 now = jiffies; 2429 if (now - scan_start <= duration) { 2430 int elapsed; 2431 2432 if (now >= scan_start) 2433 elapsed = now - scan_start; 2434 else 2435 elapsed = ULONG_MAX - scan_start + now; 2436 2437 timeout = duration - elapsed; 2438 } else { 2439 timeout = 0; 2440 } 2441 2442 queue_delayed_work(hdev->req_workqueue, 2443 &hdev->le_scan_disable, timeout); 2444 2445 unlock: 2446 hci_dev_unlock(hdev); 2447 } 2448 2449 static int active_scan(struct hci_request *req, unsigned long opt) 2450 { 2451 uint16_t interval = opt; 2452 struct hci_dev *hdev = req->hdev; 2453 u8 own_addr_type; 2454 int err; 2455 2456 BT_DBG("%s", hdev->name); 2457 2458 if (hci_dev_test_flag(hdev, HCI_LE_ADV)) { 2459 hci_dev_lock(hdev); 2460 2461 /* Don't let discovery abort an outgoing connection attempt 2462 * that's using directed advertising. 2463 */ 2464 if (hci_lookup_le_connect(hdev)) { 2465 hci_dev_unlock(hdev); 2466 return -EBUSY; 2467 } 2468 2469 cancel_adv_timeout(hdev); 2470 hci_dev_unlock(hdev); 2471 2472 __hci_req_disable_advertising(req); 2473 } 2474 2475 /* If controller is scanning, it means the background scanning is 2476 * running. Thus, we should temporarily stop it in order to set the 2477 * discovery scanning parameters. 2478 */ 2479 if (hci_dev_test_flag(hdev, HCI_LE_SCAN)) 2480 hci_req_add_le_scan_disable(req); 2481 2482 /* All active scans will be done with either a resolvable private 2483 * address (when privacy feature has been enabled) or non-resolvable 2484 * private address. 2485 */ 2486 err = hci_update_random_address(req, true, scan_use_rpa(hdev), 2487 &own_addr_type); 2488 if (err < 0) 2489 own_addr_type = ADDR_LE_DEV_PUBLIC; 2490 2491 hci_req_start_scan(req, LE_SCAN_ACTIVE, interval, DISCOV_LE_SCAN_WIN, 2492 own_addr_type, 0); 2493 return 0; 2494 } 2495 2496 static int interleaved_discov(struct hci_request *req, unsigned long opt) 2497 { 2498 int err; 2499 2500 BT_DBG("%s", req->hdev->name); 2501 2502 err = active_scan(req, opt); 2503 if (err) 2504 return err; 2505 2506 return bredr_inquiry(req, DISCOV_BREDR_INQUIRY_LEN); 2507 } 2508 2509 static void start_discovery(struct hci_dev *hdev, u8 *status) 2510 { 2511 unsigned long timeout; 2512 2513 BT_DBG("%s type %u", hdev->name, hdev->discovery.type); 2514 2515 switch (hdev->discovery.type) { 2516 case DISCOV_TYPE_BREDR: 2517 if (!hci_dev_test_flag(hdev, HCI_INQUIRY)) 2518 hci_req_sync(hdev, bredr_inquiry, 2519 DISCOV_BREDR_INQUIRY_LEN, HCI_CMD_TIMEOUT, 2520 status); 2521 return; 2522 case DISCOV_TYPE_INTERLEAVED: 2523 /* When running simultaneous discovery, the LE scanning time 2524 * should occupy the whole discovery time sine BR/EDR inquiry 2525 * and LE scanning are scheduled by the controller. 2526 * 2527 * For interleaving discovery in comparison, BR/EDR inquiry 2528 * and LE scanning are done sequentially with separate 2529 * timeouts. 2530 */ 2531 if (test_bit(HCI_QUIRK_SIMULTANEOUS_DISCOVERY, 2532 &hdev->quirks)) { 2533 timeout = msecs_to_jiffies(DISCOV_LE_TIMEOUT); 2534 /* During simultaneous discovery, we double LE scan 2535 * interval. We must leave some time for the controller 2536 * to do BR/EDR inquiry. 2537 */ 2538 hci_req_sync(hdev, interleaved_discov, 2539 DISCOV_LE_SCAN_INT * 2, HCI_CMD_TIMEOUT, 2540 status); 2541 break; 2542 } 2543 2544 timeout = msecs_to_jiffies(hdev->discov_interleaved_timeout); 2545 hci_req_sync(hdev, active_scan, DISCOV_LE_SCAN_INT, 2546 HCI_CMD_TIMEOUT, status); 2547 break; 2548 case DISCOV_TYPE_LE: 2549 timeout = msecs_to_jiffies(DISCOV_LE_TIMEOUT); 2550 hci_req_sync(hdev, active_scan, DISCOV_LE_SCAN_INT, 2551 HCI_CMD_TIMEOUT, status); 2552 break; 2553 default: 2554 *status = HCI_ERROR_UNSPECIFIED; 2555 return; 2556 } 2557 2558 if (*status) 2559 return; 2560 2561 BT_DBG("%s timeout %u ms", hdev->name, jiffies_to_msecs(timeout)); 2562 2563 /* When service discovery is used and the controller has a 2564 * strict duplicate filter, it is important to remember the 2565 * start and duration of the scan. This is required for 2566 * restarting scanning during the discovery phase. 2567 */ 2568 if (test_bit(HCI_QUIRK_STRICT_DUPLICATE_FILTER, &hdev->quirks) && 2569 hdev->discovery.result_filtering) { 2570 hdev->discovery.scan_start = jiffies; 2571 hdev->discovery.scan_duration = timeout; 2572 } 2573 2574 queue_delayed_work(hdev->req_workqueue, &hdev->le_scan_disable, 2575 timeout); 2576 } 2577 2578 bool hci_req_stop_discovery(struct hci_request *req) 2579 { 2580 struct hci_dev *hdev = req->hdev; 2581 struct discovery_state *d = &hdev->discovery; 2582 struct hci_cp_remote_name_req_cancel cp; 2583 struct inquiry_entry *e; 2584 bool ret = false; 2585 2586 BT_DBG("%s state %u", hdev->name, hdev->discovery.state); 2587 2588 if (d->state == DISCOVERY_FINDING || d->state == DISCOVERY_STOPPING) { 2589 if (test_bit(HCI_INQUIRY, &hdev->flags)) 2590 hci_req_add(req, HCI_OP_INQUIRY_CANCEL, 0, NULL); 2591 2592 if (hci_dev_test_flag(hdev, HCI_LE_SCAN)) { 2593 cancel_delayed_work(&hdev->le_scan_disable); 2594 hci_req_add_le_scan_disable(req); 2595 } 2596 2597 ret = true; 2598 } else { 2599 /* Passive scanning */ 2600 if (hci_dev_test_flag(hdev, HCI_LE_SCAN)) { 2601 hci_req_add_le_scan_disable(req); 2602 ret = true; 2603 } 2604 } 2605 2606 /* No further actions needed for LE-only discovery */ 2607 if (d->type == DISCOV_TYPE_LE) 2608 return ret; 2609 2610 if (d->state == DISCOVERY_RESOLVING || d->state == DISCOVERY_STOPPING) { 2611 e = hci_inquiry_cache_lookup_resolve(hdev, BDADDR_ANY, 2612 NAME_PENDING); 2613 if (!e) 2614 return ret; 2615 2616 bacpy(&cp.bdaddr, &e->data.bdaddr); 2617 hci_req_add(req, HCI_OP_REMOTE_NAME_REQ_CANCEL, sizeof(cp), 2618 &cp); 2619 ret = true; 2620 } 2621 2622 return ret; 2623 } 2624 2625 static int stop_discovery(struct hci_request *req, unsigned long opt) 2626 { 2627 hci_dev_lock(req->hdev); 2628 hci_req_stop_discovery(req); 2629 hci_dev_unlock(req->hdev); 2630 2631 return 0; 2632 } 2633 2634 static void discov_update(struct work_struct *work) 2635 { 2636 struct hci_dev *hdev = container_of(work, struct hci_dev, 2637 discov_update); 2638 u8 status = 0; 2639 2640 switch (hdev->discovery.state) { 2641 case DISCOVERY_STARTING: 2642 start_discovery(hdev, &status); 2643 mgmt_start_discovery_complete(hdev, status); 2644 if (status) 2645 hci_discovery_set_state(hdev, DISCOVERY_STOPPED); 2646 else 2647 hci_discovery_set_state(hdev, DISCOVERY_FINDING); 2648 break; 2649 case DISCOVERY_STOPPING: 2650 hci_req_sync(hdev, stop_discovery, 0, HCI_CMD_TIMEOUT, &status); 2651 mgmt_stop_discovery_complete(hdev, status); 2652 if (!status) 2653 hci_discovery_set_state(hdev, DISCOVERY_STOPPED); 2654 break; 2655 case DISCOVERY_STOPPED: 2656 default: 2657 return; 2658 } 2659 } 2660 2661 static void discov_off(struct work_struct *work) 2662 { 2663 struct hci_dev *hdev = container_of(work, struct hci_dev, 2664 discov_off.work); 2665 2666 BT_DBG("%s", hdev->name); 2667 2668 hci_dev_lock(hdev); 2669 2670 /* When discoverable timeout triggers, then just make sure 2671 * the limited discoverable flag is cleared. Even in the case 2672 * of a timeout triggered from general discoverable, it is 2673 * safe to unconditionally clear the flag. 2674 */ 2675 hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE); 2676 hci_dev_clear_flag(hdev, HCI_DISCOVERABLE); 2677 hdev->discov_timeout = 0; 2678 2679 hci_dev_unlock(hdev); 2680 2681 hci_req_sync(hdev, discoverable_update, 0, HCI_CMD_TIMEOUT, NULL); 2682 mgmt_new_settings(hdev); 2683 } 2684 2685 static int powered_update_hci(struct hci_request *req, unsigned long opt) 2686 { 2687 struct hci_dev *hdev = req->hdev; 2688 u8 link_sec; 2689 2690 hci_dev_lock(hdev); 2691 2692 if (hci_dev_test_flag(hdev, HCI_SSP_ENABLED) && 2693 !lmp_host_ssp_capable(hdev)) { 2694 u8 mode = 0x01; 2695 2696 hci_req_add(req, HCI_OP_WRITE_SSP_MODE, sizeof(mode), &mode); 2697 2698 if (bredr_sc_enabled(hdev) && !lmp_host_sc_capable(hdev)) { 2699 u8 support = 0x01; 2700 2701 hci_req_add(req, HCI_OP_WRITE_SC_SUPPORT, 2702 sizeof(support), &support); 2703 } 2704 } 2705 2706 if (hci_dev_test_flag(hdev, HCI_LE_ENABLED) && 2707 lmp_bredr_capable(hdev)) { 2708 struct hci_cp_write_le_host_supported cp; 2709 2710 cp.le = 0x01; 2711 cp.simul = 0x00; 2712 2713 /* Check first if we already have the right 2714 * host state (host features set) 2715 */ 2716 if (cp.le != lmp_host_le_capable(hdev) || 2717 cp.simul != lmp_host_le_br_capable(hdev)) 2718 hci_req_add(req, HCI_OP_WRITE_LE_HOST_SUPPORTED, 2719 sizeof(cp), &cp); 2720 } 2721 2722 if (hci_dev_test_flag(hdev, HCI_LE_ENABLED)) { 2723 /* Make sure the controller has a good default for 2724 * advertising data. This also applies to the case 2725 * where BR/EDR was toggled during the AUTO_OFF phase. 2726 */ 2727 if (hci_dev_test_flag(hdev, HCI_ADVERTISING) || 2728 list_empty(&hdev->adv_instances)) { 2729 int err; 2730 2731 if (ext_adv_capable(hdev)) { 2732 err = __hci_req_setup_ext_adv_instance(req, 2733 0x00); 2734 if (!err) 2735 __hci_req_update_scan_rsp_data(req, 2736 0x00); 2737 } else { 2738 err = 0; 2739 __hci_req_update_adv_data(req, 0x00); 2740 __hci_req_update_scan_rsp_data(req, 0x00); 2741 } 2742 2743 if (hci_dev_test_flag(hdev, HCI_ADVERTISING)) { 2744 if (!ext_adv_capable(hdev)) 2745 __hci_req_enable_advertising(req); 2746 else if (!err) 2747 __hci_req_enable_ext_advertising(req); 2748 } 2749 } else if (!list_empty(&hdev->adv_instances)) { 2750 struct adv_info *adv_instance; 2751 2752 adv_instance = list_first_entry(&hdev->adv_instances, 2753 struct adv_info, list); 2754 __hci_req_schedule_adv_instance(req, 2755 adv_instance->instance, 2756 true); 2757 } 2758 } 2759 2760 link_sec = hci_dev_test_flag(hdev, HCI_LINK_SECURITY); 2761 if (link_sec != test_bit(HCI_AUTH, &hdev->flags)) 2762 hci_req_add(req, HCI_OP_WRITE_AUTH_ENABLE, 2763 sizeof(link_sec), &link_sec); 2764 2765 if (lmp_bredr_capable(hdev)) { 2766 if (hci_dev_test_flag(hdev, HCI_FAST_CONNECTABLE)) 2767 __hci_req_write_fast_connectable(req, true); 2768 else 2769 __hci_req_write_fast_connectable(req, false); 2770 __hci_req_update_scan(req); 2771 __hci_req_update_class(req); 2772 __hci_req_update_name(req); 2773 __hci_req_update_eir(req); 2774 } 2775 2776 hci_dev_unlock(hdev); 2777 return 0; 2778 } 2779 2780 int __hci_req_hci_power_on(struct hci_dev *hdev) 2781 { 2782 /* Register the available SMP channels (BR/EDR and LE) only when 2783 * successfully powering on the controller. This late 2784 * registration is required so that LE SMP can clearly decide if 2785 * the public address or static address is used. 2786 */ 2787 smp_register(hdev); 2788 2789 return __hci_req_sync(hdev, powered_update_hci, 0, HCI_CMD_TIMEOUT, 2790 NULL); 2791 } 2792 2793 void hci_request_setup(struct hci_dev *hdev) 2794 { 2795 INIT_WORK(&hdev->discov_update, discov_update); 2796 INIT_WORK(&hdev->bg_scan_update, bg_scan_update); 2797 INIT_WORK(&hdev->scan_update, scan_update_work); 2798 INIT_WORK(&hdev->connectable_update, connectable_update_work); 2799 INIT_WORK(&hdev->discoverable_update, discoverable_update_work); 2800 INIT_DELAYED_WORK(&hdev->discov_off, discov_off); 2801 INIT_DELAYED_WORK(&hdev->le_scan_disable, le_scan_disable_work); 2802 INIT_DELAYED_WORK(&hdev->le_scan_restart, le_scan_restart_work); 2803 INIT_DELAYED_WORK(&hdev->adv_instance_expire, adv_timeout_expire); 2804 } 2805 2806 void hci_request_cancel_all(struct hci_dev *hdev) 2807 { 2808 hci_req_sync_cancel(hdev, ENODEV); 2809 2810 cancel_work_sync(&hdev->discov_update); 2811 cancel_work_sync(&hdev->bg_scan_update); 2812 cancel_work_sync(&hdev->scan_update); 2813 cancel_work_sync(&hdev->connectable_update); 2814 cancel_work_sync(&hdev->discoverable_update); 2815 cancel_delayed_work_sync(&hdev->discov_off); 2816 cancel_delayed_work_sync(&hdev->le_scan_disable); 2817 cancel_delayed_work_sync(&hdev->le_scan_restart); 2818 2819 if (hdev->adv_instance_timeout) { 2820 cancel_delayed_work_sync(&hdev->adv_instance_expire); 2821 hdev->adv_instance_timeout = 0; 2822 } 2823 } 2824