2 BlueZ - Bluetooth protocol stack for Linux
4 Copyright (C) 2014 Intel Corporation
6 This program is free software; you can redistribute it and/or modify
7 it under the terms of the GNU General Public License version 2 as
8 published by the Free Software Foundation;
10 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
11 OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
12 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
13 IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
14 CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
15 WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
16 ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
17 OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
19 ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
20 COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
21 SOFTWARE IS DISCLAIMED.
24 #include <linux/sched/signal.h>
26 #include <net/bluetooth/bluetooth.h>
27 #include <net/bluetooth/hci_core.h>
28 #include <net/bluetooth/mgmt.h>
31 #include "hci_request.h"
34 #define HCI_REQ_DONE 0
35 #define HCI_REQ_PEND 1
36 #define HCI_REQ_CANCELED 2
38 void hci_req_init(struct hci_request *req, struct hci_dev *hdev)
40 skb_queue_head_init(&req->cmd_q);
45 void hci_req_purge(struct hci_request *req)
47 skb_queue_purge(&req->cmd_q);
50 bool hci_req_status_pend(struct hci_dev *hdev)
52 return hdev->req_status == HCI_REQ_PEND;
55 static int req_run(struct hci_request *req, hci_req_complete_t complete,
56 hci_req_complete_skb_t complete_skb)
58 struct hci_dev *hdev = req->hdev;
62 bt_dev_dbg(hdev, "length %u", skb_queue_len(&req->cmd_q));
64 /* If an error occurred during request building, remove all HCI
65 * commands queued on the HCI request queue.
68 skb_queue_purge(&req->cmd_q);
72 /* Do not allow empty requests */
73 if (skb_queue_empty(&req->cmd_q))
76 skb = skb_peek_tail(&req->cmd_q);
78 bt_cb(skb)->hci.req_complete = complete;
79 } else if (complete_skb) {
80 bt_cb(skb)->hci.req_complete_skb = complete_skb;
81 bt_cb(skb)->hci.req_flags |= HCI_REQ_SKB;
84 spin_lock_irqsave(&hdev->cmd_q.lock, flags);
85 skb_queue_splice_tail(&req->cmd_q, &hdev->cmd_q);
86 spin_unlock_irqrestore(&hdev->cmd_q.lock, flags);
88 queue_work(hdev->workqueue, &hdev->cmd_work);
93 int hci_req_run(struct hci_request *req, hci_req_complete_t complete)
95 return req_run(req, complete, NULL);
98 int hci_req_run_skb(struct hci_request *req, hci_req_complete_skb_t complete)
100 return req_run(req, NULL, complete);
103 static void hci_req_sync_complete(struct hci_dev *hdev, u8 result, u16 opcode,
106 bt_dev_dbg(hdev, "result 0x%2.2x", result);
108 if (hdev->req_status == HCI_REQ_PEND) {
109 hdev->req_result = result;
110 hdev->req_status = HCI_REQ_DONE;
112 hdev->req_skb = skb_get(skb);
113 wake_up_interruptible(&hdev->req_wait_q);
117 void hci_req_sync_cancel(struct hci_dev *hdev, int err)
119 bt_dev_dbg(hdev, "err 0x%2.2x", err);
121 if (hdev->req_status == HCI_REQ_PEND) {
122 hdev->req_result = err;
123 hdev->req_status = HCI_REQ_CANCELED;
124 wake_up_interruptible(&hdev->req_wait_q);
128 struct sk_buff *__hci_cmd_sync_ev(struct hci_dev *hdev, u16 opcode, u32 plen,
129 const void *param, u8 event, u32 timeout)
131 struct hci_request req;
135 bt_dev_dbg(hdev, "");
137 hci_req_init(&req, hdev);
139 hci_req_add_ev(&req, opcode, plen, param, event);
141 hdev->req_status = HCI_REQ_PEND;
143 err = hci_req_run_skb(&req, hci_req_sync_complete);
147 err = wait_event_interruptible_timeout(hdev->req_wait_q,
148 hdev->req_status != HCI_REQ_PEND, timeout);
150 if (err == -ERESTARTSYS)
151 return ERR_PTR(-EINTR);
153 switch (hdev->req_status) {
155 err = -bt_to_errno(hdev->req_result);
158 case HCI_REQ_CANCELED:
159 err = -hdev->req_result;
167 hdev->req_status = hdev->req_result = 0;
169 hdev->req_skb = NULL;
171 bt_dev_dbg(hdev, "end: err %d", err);
179 return ERR_PTR(-ENODATA);
183 EXPORT_SYMBOL(__hci_cmd_sync_ev);
185 struct sk_buff *__hci_cmd_sync(struct hci_dev *hdev, u16 opcode, u32 plen,
186 const void *param, u32 timeout)
188 return __hci_cmd_sync_ev(hdev, opcode, plen, param, 0, timeout);
190 EXPORT_SYMBOL(__hci_cmd_sync);
192 /* Execute request and wait for completion. */
193 int __hci_req_sync(struct hci_dev *hdev, int (*func)(struct hci_request *req,
195 unsigned long opt, u32 timeout, u8 *hci_status)
197 struct hci_request req;
200 bt_dev_dbg(hdev, "start");
202 hci_req_init(&req, hdev);
204 hdev->req_status = HCI_REQ_PEND;
206 err = func(&req, opt);
209 *hci_status = HCI_ERROR_UNSPECIFIED;
213 err = hci_req_run_skb(&req, hci_req_sync_complete);
215 hdev->req_status = 0;
217 /* ENODATA means the HCI request command queue is empty.
218 * This can happen when a request with conditionals doesn't
219 * trigger any commands to be sent. This is normal behavior
220 * and should not trigger an error return.
222 if (err == -ENODATA) {
229 *hci_status = HCI_ERROR_UNSPECIFIED;
234 err = wait_event_interruptible_timeout(hdev->req_wait_q,
235 hdev->req_status != HCI_REQ_PEND, timeout);
237 if (err == -ERESTARTSYS)
240 switch (hdev->req_status) {
242 err = -bt_to_errno(hdev->req_result);
244 *hci_status = hdev->req_result;
247 case HCI_REQ_CANCELED:
248 err = -hdev->req_result;
250 *hci_status = HCI_ERROR_UNSPECIFIED;
256 *hci_status = HCI_ERROR_UNSPECIFIED;
260 kfree_skb(hdev->req_skb);
261 hdev->req_skb = NULL;
262 hdev->req_status = hdev->req_result = 0;
264 bt_dev_dbg(hdev, "end: err %d", err);
269 int hci_req_sync(struct hci_dev *hdev, int (*req)(struct hci_request *req,
271 unsigned long opt, u32 timeout, u8 *hci_status)
275 /* Serialize all requests */
276 hci_req_sync_lock(hdev);
277 /* check the state after obtaing the lock to protect the HCI_UP
278 * against any races from hci_dev_do_close when the controller
281 if (test_bit(HCI_UP, &hdev->flags))
282 ret = __hci_req_sync(hdev, req, opt, timeout, hci_status);
285 hci_req_sync_unlock(hdev);
290 struct sk_buff *hci_prepare_cmd(struct hci_dev *hdev, u16 opcode, u32 plen,
293 int len = HCI_COMMAND_HDR_SIZE + plen;
294 struct hci_command_hdr *hdr;
297 skb = bt_skb_alloc(len, GFP_ATOMIC);
301 hdr = skb_put(skb, HCI_COMMAND_HDR_SIZE);
302 hdr->opcode = cpu_to_le16(opcode);
306 skb_put_data(skb, param, plen);
308 bt_dev_dbg(hdev, "skb len %d", skb->len);
310 hci_skb_pkt_type(skb) = HCI_COMMAND_PKT;
311 hci_skb_opcode(skb) = opcode;
316 /* Queue a command to an asynchronous HCI request */
317 void hci_req_add_ev(struct hci_request *req, u16 opcode, u32 plen,
318 const void *param, u8 event)
320 struct hci_dev *hdev = req->hdev;
323 bt_dev_dbg(hdev, "opcode 0x%4.4x plen %d", opcode, plen);
325 /* If an error occurred during request building, there is no point in
326 * queueing the HCI command. We can simply return.
331 skb = hci_prepare_cmd(hdev, opcode, plen, param);
333 bt_dev_err(hdev, "no memory for command (opcode 0x%4.4x)",
339 if (skb_queue_empty(&req->cmd_q))
340 bt_cb(skb)->hci.req_flags |= HCI_REQ_START;
342 bt_cb(skb)->hci.req_event = event;
344 skb_queue_tail(&req->cmd_q, skb);
347 void hci_req_add(struct hci_request *req, u16 opcode, u32 plen,
350 hci_req_add_ev(req, opcode, plen, param, 0);
353 void __hci_req_write_fast_connectable(struct hci_request *req, bool enable)
355 struct hci_dev *hdev = req->hdev;
356 struct hci_cp_write_page_scan_activity acp;
359 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
362 if (hdev->hci_ver < BLUETOOTH_VER_1_2)
366 type = PAGE_SCAN_TYPE_INTERLACED;
368 /* 160 msec page scan interval */
369 acp.interval = cpu_to_le16(0x0100);
371 type = hdev->def_page_scan_type;
372 acp.interval = cpu_to_le16(hdev->def_page_scan_int);
375 acp.window = cpu_to_le16(hdev->def_page_scan_window);
377 if (__cpu_to_le16(hdev->page_scan_interval) != acp.interval ||
378 __cpu_to_le16(hdev->page_scan_window) != acp.window)
379 hci_req_add(req, HCI_OP_WRITE_PAGE_SCAN_ACTIVITY,
382 if (hdev->page_scan_type != type)
383 hci_req_add(req, HCI_OP_WRITE_PAGE_SCAN_TYPE, 1, &type);
386 static void start_interleave_scan(struct hci_dev *hdev)
388 hdev->interleave_scan_state = INTERLEAVE_SCAN_NO_FILTER;
389 queue_delayed_work(hdev->req_workqueue,
390 &hdev->interleave_scan, 0);
393 static bool is_interleave_scanning(struct hci_dev *hdev)
395 return hdev->interleave_scan_state != INTERLEAVE_SCAN_NONE;
398 static void cancel_interleave_scan(struct hci_dev *hdev)
400 bt_dev_dbg(hdev, "cancelling interleave scan");
402 cancel_delayed_work_sync(&hdev->interleave_scan);
404 hdev->interleave_scan_state = INTERLEAVE_SCAN_NONE;
407 /* Return true if interleave_scan wasn't started until exiting this function,
408 * otherwise, return false
410 static bool __hci_update_interleaved_scan(struct hci_dev *hdev)
412 /* Do interleaved scan only if all of the following are true:
413 * - There is at least one ADV monitor
414 * - At least one pending LE connection or one device to be scanned for
415 * - Monitor offloading is not supported
416 * If so, we should alternate between allowlist scan and one without
417 * any filters to save power.
419 bool use_interleaving = hci_is_adv_monitoring(hdev) &&
420 !(list_empty(&hdev->pend_le_conns) &&
421 list_empty(&hdev->pend_le_reports)) &&
422 hci_get_adv_monitor_offload_ext(hdev) ==
423 HCI_ADV_MONITOR_EXT_NONE;
424 bool is_interleaving = is_interleave_scanning(hdev);
426 if (use_interleaving && !is_interleaving) {
427 start_interleave_scan(hdev);
428 bt_dev_dbg(hdev, "starting interleave scan");
432 if (!use_interleaving && is_interleaving)
433 cancel_interleave_scan(hdev);
438 /* This function controls the background scanning based on hdev->pend_le_conns
439 * list. If there are pending LE connection we start the background scanning,
440 * otherwise we stop it.
442 * This function requires the caller holds hdev->lock.
444 static void __hci_update_background_scan(struct hci_request *req)
446 struct hci_dev *hdev = req->hdev;
448 if (!test_bit(HCI_UP, &hdev->flags) ||
449 test_bit(HCI_INIT, &hdev->flags) ||
450 hci_dev_test_flag(hdev, HCI_SETUP) ||
451 hci_dev_test_flag(hdev, HCI_CONFIG) ||
452 hci_dev_test_flag(hdev, HCI_AUTO_OFF) ||
453 hci_dev_test_flag(hdev, HCI_UNREGISTER))
456 /* No point in doing scanning if LE support hasn't been enabled */
457 if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED))
460 /* If discovery is active don't interfere with it */
461 if (hdev->discovery.state != DISCOVERY_STOPPED)
464 /* Reset RSSI and UUID filters when starting background scanning
465 * since these filters are meant for service discovery only.
467 * The Start Discovery and Start Service Discovery operations
468 * ensure to set proper values for RSSI threshold and UUID
469 * filter list. So it is safe to just reset them here.
471 hci_discovery_filter_clear(hdev);
473 bt_dev_dbg(hdev, "ADV monitoring is %s",
474 hci_is_adv_monitoring(hdev) ? "on" : "off");
476 if (list_empty(&hdev->pend_le_conns) &&
477 list_empty(&hdev->pend_le_reports) &&
478 !hci_is_adv_monitoring(hdev)) {
479 /* If there is no pending LE connections or devices
480 * to be scanned for or no ADV monitors, we should stop the
481 * background scanning.
484 /* If controller is not scanning we are done. */
485 if (!hci_dev_test_flag(hdev, HCI_LE_SCAN))
488 hci_req_add_le_scan_disable(req, false);
490 bt_dev_dbg(hdev, "stopping background scanning");
492 /* If there is at least one pending LE connection, we should
493 * keep the background scan running.
496 /* If controller is connecting, we should not start scanning
497 * since some controllers are not able to scan and connect at
500 if (hci_lookup_le_connect(hdev))
503 /* If controller is currently scanning, we stop it to ensure we
504 * don't miss any advertising (due to duplicates filter).
506 if (hci_dev_test_flag(hdev, HCI_LE_SCAN))
507 hci_req_add_le_scan_disable(req, false);
509 hci_req_add_le_passive_scan(req);
510 bt_dev_dbg(hdev, "starting background scanning");
514 void __hci_req_update_name(struct hci_request *req)
516 struct hci_dev *hdev = req->hdev;
517 struct hci_cp_write_local_name cp;
519 memcpy(cp.name, hdev->dev_name, sizeof(cp.name));
521 hci_req_add(req, HCI_OP_WRITE_LOCAL_NAME, sizeof(cp), &cp);
524 #define PNP_INFO_SVCLASS_ID 0x1200
526 static u8 *create_uuid16_list(struct hci_dev *hdev, u8 *data, ptrdiff_t len)
528 u8 *ptr = data, *uuids_start = NULL;
529 struct bt_uuid *uuid;
534 list_for_each_entry(uuid, &hdev->uuids, list) {
537 if (uuid->size != 16)
540 uuid16 = get_unaligned_le16(&uuid->uuid[12]);
544 if (uuid16 == PNP_INFO_SVCLASS_ID)
550 uuids_start[1] = EIR_UUID16_ALL;
554 /* Stop if not enough space to put next UUID */
555 if ((ptr - data) + sizeof(u16) > len) {
556 uuids_start[1] = EIR_UUID16_SOME;
560 *ptr++ = (uuid16 & 0x00ff);
561 *ptr++ = (uuid16 & 0xff00) >> 8;
562 uuids_start[0] += sizeof(uuid16);
568 static u8 *create_uuid32_list(struct hci_dev *hdev, u8 *data, ptrdiff_t len)
570 u8 *ptr = data, *uuids_start = NULL;
571 struct bt_uuid *uuid;
576 list_for_each_entry(uuid, &hdev->uuids, list) {
577 if (uuid->size != 32)
583 uuids_start[1] = EIR_UUID32_ALL;
587 /* Stop if not enough space to put next UUID */
588 if ((ptr - data) + sizeof(u32) > len) {
589 uuids_start[1] = EIR_UUID32_SOME;
593 memcpy(ptr, &uuid->uuid[12], sizeof(u32));
595 uuids_start[0] += sizeof(u32);
601 static u8 *create_uuid128_list(struct hci_dev *hdev, u8 *data, ptrdiff_t len)
603 u8 *ptr = data, *uuids_start = NULL;
604 struct bt_uuid *uuid;
609 list_for_each_entry(uuid, &hdev->uuids, list) {
610 if (uuid->size != 128)
616 uuids_start[1] = EIR_UUID128_ALL;
620 /* Stop if not enough space to put next UUID */
621 if ((ptr - data) + 16 > len) {
622 uuids_start[1] = EIR_UUID128_SOME;
626 memcpy(ptr, uuid->uuid, 16);
628 uuids_start[0] += 16;
634 static void create_eir(struct hci_dev *hdev, u8 *data)
639 name_len = strlen(hdev->dev_name);
645 ptr[1] = EIR_NAME_SHORT;
647 ptr[1] = EIR_NAME_COMPLETE;
649 /* EIR Data length */
650 ptr[0] = name_len + 1;
652 memcpy(ptr + 2, hdev->dev_name, name_len);
654 ptr += (name_len + 2);
657 if (hdev->inq_tx_power != HCI_TX_POWER_INVALID) {
659 ptr[1] = EIR_TX_POWER;
660 ptr[2] = (u8) hdev->inq_tx_power;
665 if (hdev->devid_source > 0) {
667 ptr[1] = EIR_DEVICE_ID;
669 put_unaligned_le16(hdev->devid_source, ptr + 2);
670 put_unaligned_le16(hdev->devid_vendor, ptr + 4);
671 put_unaligned_le16(hdev->devid_product, ptr + 6);
672 put_unaligned_le16(hdev->devid_version, ptr + 8);
677 ptr = create_uuid16_list(hdev, ptr, HCI_MAX_EIR_LENGTH - (ptr - data));
678 ptr = create_uuid32_list(hdev, ptr, HCI_MAX_EIR_LENGTH - (ptr - data));
679 ptr = create_uuid128_list(hdev, ptr, HCI_MAX_EIR_LENGTH - (ptr - data));
682 void __hci_req_update_eir(struct hci_request *req)
684 struct hci_dev *hdev = req->hdev;
685 struct hci_cp_write_eir cp;
687 if (!hdev_is_powered(hdev))
690 if (!lmp_ext_inq_capable(hdev))
693 if (!hci_dev_test_flag(hdev, HCI_SSP_ENABLED))
696 if (hci_dev_test_flag(hdev, HCI_SERVICE_CACHE))
699 memset(&cp, 0, sizeof(cp));
701 create_eir(hdev, cp.data);
703 if (memcmp(cp.data, hdev->eir, sizeof(cp.data)) == 0)
706 memcpy(hdev->eir, cp.data, sizeof(cp.data));
708 hci_req_add(req, HCI_OP_WRITE_EIR, sizeof(cp), &cp);
711 void hci_req_add_le_scan_disable(struct hci_request *req, bool rpa_le_conn)
713 struct hci_dev *hdev = req->hdev;
715 if (hdev->scanning_paused) {
716 bt_dev_dbg(hdev, "Scanning is paused for suspend");
721 set_bit(SUSPEND_SCAN_DISABLE, hdev->suspend_tasks);
723 if (use_ext_scan(hdev)) {
724 struct hci_cp_le_set_ext_scan_enable cp;
726 memset(&cp, 0, sizeof(cp));
727 cp.enable = LE_SCAN_DISABLE;
728 hci_req_add(req, HCI_OP_LE_SET_EXT_SCAN_ENABLE, sizeof(cp),
731 struct hci_cp_le_set_scan_enable cp;
733 memset(&cp, 0, sizeof(cp));
734 cp.enable = LE_SCAN_DISABLE;
735 hci_req_add(req, HCI_OP_LE_SET_SCAN_ENABLE, sizeof(cp), &cp);
738 /* Disable address resolution */
739 if (use_ll_privacy(hdev) &&
740 hci_dev_test_flag(hdev, HCI_ENABLE_LL_PRIVACY) &&
741 hci_dev_test_flag(hdev, HCI_LL_RPA_RESOLUTION) && !rpa_le_conn) {
744 hci_req_add(req, HCI_OP_LE_SET_ADDR_RESOLV_ENABLE, 1, &enable);
748 static void del_from_white_list(struct hci_request *req, bdaddr_t *bdaddr,
751 struct hci_cp_le_del_from_white_list cp;
753 cp.bdaddr_type = bdaddr_type;
754 bacpy(&cp.bdaddr, bdaddr);
756 bt_dev_dbg(req->hdev, "Remove %pMR (0x%x) from whitelist", &cp.bdaddr,
758 hci_req_add(req, HCI_OP_LE_DEL_FROM_WHITE_LIST, sizeof(cp), &cp);
760 if (use_ll_privacy(req->hdev) &&
761 hci_dev_test_flag(req->hdev, HCI_ENABLE_LL_PRIVACY)) {
764 irk = hci_find_irk_by_addr(req->hdev, bdaddr, bdaddr_type);
766 struct hci_cp_le_del_from_resolv_list cp;
768 cp.bdaddr_type = bdaddr_type;
769 bacpy(&cp.bdaddr, bdaddr);
771 hci_req_add(req, HCI_OP_LE_DEL_FROM_RESOLV_LIST,
777 /* Adds connection to white list if needed. On error, returns -1. */
778 static int add_to_white_list(struct hci_request *req,
779 struct hci_conn_params *params, u8 *num_entries,
782 struct hci_cp_le_add_to_white_list cp;
783 struct hci_dev *hdev = req->hdev;
785 /* Already in white list */
786 if (hci_bdaddr_list_lookup(&hdev->le_white_list, ¶ms->addr,
790 /* Select filter policy to accept all advertising */
791 if (*num_entries >= hdev->le_white_list_size)
794 /* White list can not be used with RPAs */
796 !hci_dev_test_flag(hdev, HCI_ENABLE_LL_PRIVACY) &&
797 hci_find_irk_by_addr(hdev, ¶ms->addr, params->addr_type)) {
801 /* During suspend, only wakeable devices can be in whitelist */
802 if (hdev->suspended && !hci_conn_test_flag(HCI_CONN_FLAG_REMOTE_WAKEUP,
803 params->current_flags))
807 cp.bdaddr_type = params->addr_type;
808 bacpy(&cp.bdaddr, ¶ms->addr);
810 bt_dev_dbg(hdev, "Add %pMR (0x%x) to whitelist", &cp.bdaddr,
812 hci_req_add(req, HCI_OP_LE_ADD_TO_WHITE_LIST, sizeof(cp), &cp);
814 if (use_ll_privacy(hdev) &&
815 hci_dev_test_flag(hdev, HCI_ENABLE_LL_PRIVACY)) {
818 irk = hci_find_irk_by_addr(hdev, ¶ms->addr,
821 struct hci_cp_le_add_to_resolv_list cp;
823 cp.bdaddr_type = params->addr_type;
824 bacpy(&cp.bdaddr, ¶ms->addr);
825 memcpy(cp.peer_irk, irk->val, 16);
827 if (hci_dev_test_flag(hdev, HCI_PRIVACY))
828 memcpy(cp.local_irk, hdev->irk, 16);
830 memset(cp.local_irk, 0, 16);
832 hci_req_add(req, HCI_OP_LE_ADD_TO_RESOLV_LIST,
840 static u8 update_white_list(struct hci_request *req)
842 struct hci_dev *hdev = req->hdev;
843 struct hci_conn_params *params;
844 struct bdaddr_list *b;
846 bool pend_conn, pend_report;
847 /* We allow whitelisting even with RPAs in suspend. In the worst case,
848 * we won't be able to wake from devices that use the privacy1.2
849 * features. Additionally, once we support privacy1.2 and IRK
850 * offloading, we can update this to also check for those conditions.
852 bool allow_rpa = hdev->suspended;
854 if (use_ll_privacy(hdev) &&
855 hci_dev_test_flag(hdev, HCI_ENABLE_LL_PRIVACY))
858 /* Go through the current white list programmed into the
859 * controller one by one and check if that address is still
860 * in the list of pending connections or list of devices to
861 * report. If not present in either list, then queue the
862 * command to remove it from the controller.
864 list_for_each_entry(b, &hdev->le_white_list, list) {
865 pend_conn = hci_pend_le_action_lookup(&hdev->pend_le_conns,
868 pend_report = hci_pend_le_action_lookup(&hdev->pend_le_reports,
872 /* If the device is not likely to connect or report,
873 * remove it from the whitelist.
875 if (!pend_conn && !pend_report) {
876 del_from_white_list(req, &b->bdaddr, b->bdaddr_type);
880 /* White list can not be used with RPAs */
882 !hci_dev_test_flag(hdev, HCI_ENABLE_LL_PRIVACY) &&
883 hci_find_irk_by_addr(hdev, &b->bdaddr, b->bdaddr_type)) {
890 /* Since all no longer valid white list entries have been
891 * removed, walk through the list of pending connections
892 * and ensure that any new device gets programmed into
895 * If the list of the devices is larger than the list of
896 * available white list entries in the controller, then
897 * just abort and return filer policy value to not use the
900 list_for_each_entry(params, &hdev->pend_le_conns, action) {
901 if (add_to_white_list(req, params, &num_entries, allow_rpa))
905 /* After adding all new pending connections, walk through
906 * the list of pending reports and also add these to the
907 * white list if there is still space. Abort if space runs out.
909 list_for_each_entry(params, &hdev->pend_le_reports, action) {
910 if (add_to_white_list(req, params, &num_entries, allow_rpa))
914 /* Use the allowlist unless the following conditions are all true:
915 * - We are not currently suspending
916 * - There are 1 or more ADV monitors registered and it's not offloaded
917 * - Interleaved scanning is not currently using the allowlist
919 if (!idr_is_empty(&hdev->adv_monitors_idr) && !hdev->suspended &&
920 hci_get_adv_monitor_offload_ext(hdev) == HCI_ADV_MONITOR_EXT_NONE &&
921 hdev->interleave_scan_state != INTERLEAVE_SCAN_ALLOWLIST)
924 /* Select filter policy to use white list */
928 static bool scan_use_rpa(struct hci_dev *hdev)
930 return hci_dev_test_flag(hdev, HCI_PRIVACY);
933 static void hci_req_start_scan(struct hci_request *req, u8 type, u16 interval,
934 u16 window, u8 own_addr_type, u8 filter_policy,
937 struct hci_dev *hdev = req->hdev;
939 if (hdev->scanning_paused) {
940 bt_dev_dbg(hdev, "Scanning is paused for suspend");
944 if (use_ll_privacy(hdev) &&
945 hci_dev_test_flag(hdev, HCI_ENABLE_LL_PRIVACY) &&
949 hci_req_add(req, HCI_OP_LE_SET_ADDR_RESOLV_ENABLE, 1, &enable);
952 /* Use ext scanning if set ext scan param and ext scan enable is
955 if (use_ext_scan(hdev)) {
956 struct hci_cp_le_set_ext_scan_params *ext_param_cp;
957 struct hci_cp_le_set_ext_scan_enable ext_enable_cp;
958 struct hci_cp_le_scan_phy_params *phy_params;
959 u8 data[sizeof(*ext_param_cp) + sizeof(*phy_params) * 2];
962 ext_param_cp = (void *)data;
963 phy_params = (void *)ext_param_cp->data;
965 memset(ext_param_cp, 0, sizeof(*ext_param_cp));
966 ext_param_cp->own_addr_type = own_addr_type;
967 ext_param_cp->filter_policy = filter_policy;
969 plen = sizeof(*ext_param_cp);
971 if (scan_1m(hdev) || scan_2m(hdev)) {
972 ext_param_cp->scanning_phys |= LE_SCAN_PHY_1M;
974 memset(phy_params, 0, sizeof(*phy_params));
975 phy_params->type = type;
976 phy_params->interval = cpu_to_le16(interval);
977 phy_params->window = cpu_to_le16(window);
979 plen += sizeof(*phy_params);
983 if (scan_coded(hdev)) {
984 ext_param_cp->scanning_phys |= LE_SCAN_PHY_CODED;
986 memset(phy_params, 0, sizeof(*phy_params));
987 phy_params->type = type;
988 phy_params->interval = cpu_to_le16(interval);
989 phy_params->window = cpu_to_le16(window);
991 plen += sizeof(*phy_params);
995 hci_req_add(req, HCI_OP_LE_SET_EXT_SCAN_PARAMS,
998 memset(&ext_enable_cp, 0, sizeof(ext_enable_cp));
999 ext_enable_cp.enable = LE_SCAN_ENABLE;
1000 ext_enable_cp.filter_dup = LE_SCAN_FILTER_DUP_ENABLE;
1002 hci_req_add(req, HCI_OP_LE_SET_EXT_SCAN_ENABLE,
1003 sizeof(ext_enable_cp), &ext_enable_cp);
1005 struct hci_cp_le_set_scan_param param_cp;
1006 struct hci_cp_le_set_scan_enable enable_cp;
1008 memset(¶m_cp, 0, sizeof(param_cp));
1009 param_cp.type = type;
1010 param_cp.interval = cpu_to_le16(interval);
1011 param_cp.window = cpu_to_le16(window);
1012 param_cp.own_address_type = own_addr_type;
1013 param_cp.filter_policy = filter_policy;
1014 hci_req_add(req, HCI_OP_LE_SET_SCAN_PARAM, sizeof(param_cp),
1017 memset(&enable_cp, 0, sizeof(enable_cp));
1018 enable_cp.enable = LE_SCAN_ENABLE;
1019 enable_cp.filter_dup = LE_SCAN_FILTER_DUP_ENABLE;
1020 hci_req_add(req, HCI_OP_LE_SET_SCAN_ENABLE, sizeof(enable_cp),
1025 /* Returns true if an le connection is in the scanning state */
1026 static inline bool hci_is_le_conn_scanning(struct hci_dev *hdev)
1028 struct hci_conn_hash *h = &hdev->conn_hash;
1033 list_for_each_entry_rcu(c, &h->list, list) {
1034 if (c->type == LE_LINK && c->state == BT_CONNECT &&
1035 test_bit(HCI_CONN_SCANNING, &c->flags)) {
1046 /* Ensure to call hci_req_add_le_scan_disable() first to disable the
1047 * controller based address resolution to be able to reconfigure
1050 void hci_req_add_le_passive_scan(struct hci_request *req)
1052 struct hci_dev *hdev = req->hdev;
1055 u16 window, interval;
1056 /* Background scanning should run with address resolution */
1057 bool addr_resolv = true;
1059 if (hdev->scanning_paused) {
1060 bt_dev_dbg(hdev, "Scanning is paused for suspend");
1064 /* Set require_privacy to false since no SCAN_REQ are send
1065 * during passive scanning. Not using an non-resolvable address
1066 * here is important so that peer devices using direct
1067 * advertising with our address will be correctly reported
1068 * by the controller.
1070 if (hci_update_random_address(req, false, scan_use_rpa(hdev),
1074 if (hdev->enable_advmon_interleave_scan &&
1075 __hci_update_interleaved_scan(hdev))
1078 bt_dev_dbg(hdev, "interleave state %d", hdev->interleave_scan_state);
1079 /* Adding or removing entries from the white list must
1080 * happen before enabling scanning. The controller does
1081 * not allow white list modification while scanning.
1083 filter_policy = update_white_list(req);
1085 /* When the controller is using random resolvable addresses and
1086 * with that having LE privacy enabled, then controllers with
1087 * Extended Scanner Filter Policies support can now enable support
1088 * for handling directed advertising.
1090 * So instead of using filter polices 0x00 (no whitelist)
1091 * and 0x01 (whitelist enabled) use the new filter policies
1092 * 0x02 (no whitelist) and 0x03 (whitelist enabled).
1094 if (hci_dev_test_flag(hdev, HCI_PRIVACY) &&
1095 (hdev->le_features[0] & HCI_LE_EXT_SCAN_POLICY))
1096 filter_policy |= 0x02;
1098 if (hdev->suspended) {
1099 window = hdev->le_scan_window_suspend;
1100 interval = hdev->le_scan_int_suspend;
1102 set_bit(SUSPEND_SCAN_ENABLE, hdev->suspend_tasks);
1103 } else if (hci_is_le_conn_scanning(hdev)) {
1104 window = hdev->le_scan_window_connect;
1105 interval = hdev->le_scan_int_connect;
1106 } else if (hci_is_adv_monitoring(hdev)) {
1107 window = hdev->le_scan_window_adv_monitor;
1108 interval = hdev->le_scan_int_adv_monitor;
1110 window = hdev->le_scan_window;
1111 interval = hdev->le_scan_interval;
1114 bt_dev_dbg(hdev, "LE passive scan with whitelist = %d", filter_policy);
1115 hci_req_start_scan(req, LE_SCAN_PASSIVE, interval, window,
1116 own_addr_type, filter_policy, addr_resolv);
1119 static bool adv_instance_is_scannable(struct hci_dev *hdev, u8 instance)
1121 struct adv_info *adv_instance;
1123 /* Instance 0x00 always set local name */
1124 if (instance == 0x00)
1127 adv_instance = hci_find_adv_instance(hdev, instance);
1131 if (adv_instance->flags & MGMT_ADV_FLAG_APPEARANCE ||
1132 adv_instance->flags & MGMT_ADV_FLAG_LOCAL_NAME)
1135 return adv_instance->scan_rsp_len ? true : false;
1138 static void hci_req_clear_event_filter(struct hci_request *req)
1140 struct hci_cp_set_event_filter f;
1142 if (!hci_dev_test_flag(req->hdev, HCI_BREDR_ENABLED))
1145 if (hci_dev_test_flag(req->hdev, HCI_EVENT_FILTER_CONFIGURED)) {
1146 memset(&f, 0, sizeof(f));
1147 f.flt_type = HCI_FLT_CLEAR_ALL;
1148 hci_req_add(req, HCI_OP_SET_EVENT_FLT, 1, &f);
1152 static void hci_req_set_event_filter(struct hci_request *req)
1154 struct bdaddr_list_with_flags *b;
1155 struct hci_cp_set_event_filter f;
1156 struct hci_dev *hdev = req->hdev;
1157 u8 scan = SCAN_DISABLED;
1158 bool scanning = test_bit(HCI_PSCAN, &hdev->flags);
1160 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
1163 /* Always clear event filter when starting */
1164 hci_req_clear_event_filter(req);
1166 list_for_each_entry(b, &hdev->whitelist, list) {
1167 if (!hci_conn_test_flag(HCI_CONN_FLAG_REMOTE_WAKEUP,
1171 memset(&f, 0, sizeof(f));
1172 bacpy(&f.addr_conn_flt.bdaddr, &b->bdaddr);
1173 f.flt_type = HCI_FLT_CONN_SETUP;
1174 f.cond_type = HCI_CONN_SETUP_ALLOW_BDADDR;
1175 f.addr_conn_flt.auto_accept = HCI_CONN_SETUP_AUTO_ON;
1177 bt_dev_dbg(hdev, "Adding event filters for %pMR", &b->bdaddr);
1178 hci_req_add(req, HCI_OP_SET_EVENT_FLT, sizeof(f), &f);
1182 if (scan && !scanning) {
1183 set_bit(SUSPEND_SCAN_ENABLE, hdev->suspend_tasks);
1184 hci_req_add(req, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
1185 } else if (!scan && scanning) {
1186 set_bit(SUSPEND_SCAN_DISABLE, hdev->suspend_tasks);
1187 hci_req_add(req, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
1191 static void cancel_adv_timeout(struct hci_dev *hdev)
1193 if (hdev->adv_instance_timeout) {
1194 hdev->adv_instance_timeout = 0;
1195 cancel_delayed_work(&hdev->adv_instance_expire);
1199 /* This function requires the caller holds hdev->lock */
1200 void __hci_req_pause_adv_instances(struct hci_request *req)
1202 bt_dev_dbg(req->hdev, "Pausing advertising instances");
1204 /* Call to disable any advertisements active on the controller.
1205 * This will succeed even if no advertisements are configured.
1207 __hci_req_disable_advertising(req);
1209 /* If we are using software rotation, pause the loop */
1210 if (!ext_adv_capable(req->hdev))
1211 cancel_adv_timeout(req->hdev);
1214 /* This function requires the caller holds hdev->lock */
1215 static void __hci_req_resume_adv_instances(struct hci_request *req)
1217 struct adv_info *adv;
1219 bt_dev_dbg(req->hdev, "Resuming advertising instances");
1221 if (ext_adv_capable(req->hdev)) {
1222 /* Call for each tracked instance to be re-enabled */
1223 list_for_each_entry(adv, &req->hdev->adv_instances, list) {
1224 __hci_req_enable_ext_advertising(req,
1229 /* Schedule for most recent instance to be restarted and begin
1230 * the software rotation loop
1232 __hci_req_schedule_adv_instance(req,
1233 req->hdev->cur_adv_instance,
1238 /* This function requires the caller holds hdev->lock */
1239 int hci_req_resume_adv_instances(struct hci_dev *hdev)
1241 struct hci_request req;
1243 hci_req_init(&req, hdev);
1244 __hci_req_resume_adv_instances(&req);
1246 return hci_req_run(&req, NULL);
1249 static void suspend_req_complete(struct hci_dev *hdev, u8 status, u16 opcode)
1251 bt_dev_dbg(hdev, "Request complete opcode=0x%x, status=0x%x", opcode,
1253 if (test_bit(SUSPEND_SCAN_ENABLE, hdev->suspend_tasks) ||
1254 test_bit(SUSPEND_SCAN_DISABLE, hdev->suspend_tasks)) {
1255 clear_bit(SUSPEND_SCAN_ENABLE, hdev->suspend_tasks);
1256 clear_bit(SUSPEND_SCAN_DISABLE, hdev->suspend_tasks);
1257 wake_up(&hdev->suspend_wait_q);
1260 if (test_bit(SUSPEND_SET_ADV_FILTER, hdev->suspend_tasks)) {
1261 clear_bit(SUSPEND_SET_ADV_FILTER, hdev->suspend_tasks);
1262 wake_up(&hdev->suspend_wait_q);
1266 static void hci_req_add_set_adv_filter_enable(struct hci_request *req,
1269 struct hci_dev *hdev = req->hdev;
1271 switch (hci_get_adv_monitor_offload_ext(hdev)) {
1272 case HCI_ADV_MONITOR_EXT_MSFT:
1273 msft_req_add_set_filter_enable(req, enable);
1279 /* No need to block when enabling since it's on resume path */
1280 if (hdev->suspended && !enable)
1281 set_bit(SUSPEND_SET_ADV_FILTER, hdev->suspend_tasks);
1284 /* Call with hci_dev_lock */
1285 void hci_req_prepare_suspend(struct hci_dev *hdev, enum suspended_state next)
1288 struct hci_conn *conn;
1289 struct hci_request req;
1291 int disconnect_counter;
1293 if (next == hdev->suspend_state) {
1294 bt_dev_dbg(hdev, "Same state before and after: %d", next);
1298 hdev->suspend_state = next;
1299 hci_req_init(&req, hdev);
1301 if (next == BT_SUSPEND_DISCONNECT) {
1302 /* Mark device as suspended */
1303 hdev->suspended = true;
1305 /* Pause discovery if not already stopped */
1306 old_state = hdev->discovery.state;
1307 if (old_state != DISCOVERY_STOPPED) {
1308 set_bit(SUSPEND_PAUSE_DISCOVERY, hdev->suspend_tasks);
1309 hci_discovery_set_state(hdev, DISCOVERY_STOPPING);
1310 queue_work(hdev->req_workqueue, &hdev->discov_update);
1313 hdev->discovery_paused = true;
1314 hdev->discovery_old_state = old_state;
1316 /* Stop directed advertising */
1317 old_state = hci_dev_test_flag(hdev, HCI_ADVERTISING);
1319 set_bit(SUSPEND_PAUSE_ADVERTISING, hdev->suspend_tasks);
1320 cancel_delayed_work(&hdev->discov_off);
1321 queue_delayed_work(hdev->req_workqueue,
1322 &hdev->discov_off, 0);
1325 /* Pause other advertisements */
1326 if (hdev->adv_instance_cnt)
1327 __hci_req_pause_adv_instances(&req);
1329 hdev->advertising_paused = true;
1330 hdev->advertising_old_state = old_state;
1332 /* Disable page scan if enabled */
1333 if (test_bit(HCI_PSCAN, &hdev->flags)) {
1334 page_scan = SCAN_DISABLED;
1335 hci_req_add(&req, HCI_OP_WRITE_SCAN_ENABLE, 1,
1337 set_bit(SUSPEND_SCAN_DISABLE, hdev->suspend_tasks);
1340 /* Disable LE passive scan if enabled */
1341 if (hci_dev_test_flag(hdev, HCI_LE_SCAN)) {
1342 cancel_interleave_scan(hdev);
1343 hci_req_add_le_scan_disable(&req, false);
1346 /* Disable advertisement filters */
1347 hci_req_add_set_adv_filter_enable(&req, false);
1349 /* Prevent disconnects from causing scanning to be re-enabled */
1350 hdev->scanning_paused = true;
1352 /* Run commands before disconnecting */
1353 hci_req_run(&req, suspend_req_complete);
1355 disconnect_counter = 0;
1356 /* Soft disconnect everything (power off) */
1357 list_for_each_entry(conn, &hdev->conn_hash.list, list) {
1358 hci_disconnect(conn, HCI_ERROR_REMOTE_POWER_OFF);
1359 disconnect_counter++;
1362 if (disconnect_counter > 0) {
1364 "Had %d disconnects. Will wait on them",
1365 disconnect_counter);
1366 set_bit(SUSPEND_DISCONNECTING, hdev->suspend_tasks);
1368 } else if (next == BT_SUSPEND_CONFIGURE_WAKE) {
1369 /* Unpause to take care of updating scanning params */
1370 hdev->scanning_paused = false;
1371 /* Enable event filter for paired devices */
1372 hci_req_set_event_filter(&req);
1373 /* Enable passive scan at lower duty cycle */
1374 __hci_update_background_scan(&req);
1375 /* Pause scan changes again. */
1376 hdev->scanning_paused = true;
1377 hci_req_run(&req, suspend_req_complete);
1379 hdev->suspended = false;
1380 hdev->scanning_paused = false;
1382 /* Clear any event filters and restore scan state */
1383 hci_req_clear_event_filter(&req);
1384 __hci_req_update_scan(&req);
1386 /* Reset passive/background scanning to normal */
1387 __hci_update_background_scan(&req);
1388 /* Enable all of the advertisement filters */
1389 hci_req_add_set_adv_filter_enable(&req, true);
1391 /* Unpause directed advertising */
1392 hdev->advertising_paused = false;
1393 if (hdev->advertising_old_state) {
1394 set_bit(SUSPEND_UNPAUSE_ADVERTISING,
1395 hdev->suspend_tasks);
1396 hci_dev_set_flag(hdev, HCI_ADVERTISING);
1397 queue_work(hdev->req_workqueue,
1398 &hdev->discoverable_update);
1399 hdev->advertising_old_state = 0;
1402 /* Resume other advertisements */
1403 if (hdev->adv_instance_cnt)
1404 __hci_req_resume_adv_instances(&req);
1406 /* Unpause discovery */
1407 hdev->discovery_paused = false;
1408 if (hdev->discovery_old_state != DISCOVERY_STOPPED &&
1409 hdev->discovery_old_state != DISCOVERY_STOPPING) {
1410 set_bit(SUSPEND_UNPAUSE_DISCOVERY, hdev->suspend_tasks);
1411 hci_discovery_set_state(hdev, DISCOVERY_STARTING);
1412 queue_work(hdev->req_workqueue, &hdev->discov_update);
1415 hci_req_run(&req, suspend_req_complete);
1418 hdev->suspend_state = next;
1421 clear_bit(SUSPEND_PREPARE_NOTIFIER, hdev->suspend_tasks);
1422 wake_up(&hdev->suspend_wait_q);
1425 static bool adv_cur_instance_is_scannable(struct hci_dev *hdev)
1427 return adv_instance_is_scannable(hdev, hdev->cur_adv_instance);
1430 void __hci_req_disable_advertising(struct hci_request *req)
1432 if (ext_adv_capable(req->hdev)) {
1433 __hci_req_disable_ext_adv_instance(req, 0x00);
1438 hci_req_add(req, HCI_OP_LE_SET_ADV_ENABLE, sizeof(enable), &enable);
1442 static u32 get_adv_instance_flags(struct hci_dev *hdev, u8 instance)
1445 struct adv_info *adv_instance;
1447 if (instance == 0x00) {
1448 /* Instance 0 always manages the "Tx Power" and "Flags"
1451 flags = MGMT_ADV_FLAG_TX_POWER | MGMT_ADV_FLAG_MANAGED_FLAGS;
1453 /* For instance 0, the HCI_ADVERTISING_CONNECTABLE setting
1454 * corresponds to the "connectable" instance flag.
1456 if (hci_dev_test_flag(hdev, HCI_ADVERTISING_CONNECTABLE))
1457 flags |= MGMT_ADV_FLAG_CONNECTABLE;
1459 if (hci_dev_test_flag(hdev, HCI_LIMITED_DISCOVERABLE))
1460 flags |= MGMT_ADV_FLAG_LIMITED_DISCOV;
1461 else if (hci_dev_test_flag(hdev, HCI_DISCOVERABLE))
1462 flags |= MGMT_ADV_FLAG_DISCOV;
1467 adv_instance = hci_find_adv_instance(hdev, instance);
1469 /* Return 0 when we got an invalid instance identifier. */
1473 return adv_instance->flags;
1476 static bool adv_use_rpa(struct hci_dev *hdev, uint32_t flags)
1478 /* If privacy is not enabled don't use RPA */
1479 if (!hci_dev_test_flag(hdev, HCI_PRIVACY))
1482 /* If basic privacy mode is enabled use RPA */
1483 if (!hci_dev_test_flag(hdev, HCI_LIMITED_PRIVACY))
1486 /* If limited privacy mode is enabled don't use RPA if we're
1487 * both discoverable and bondable.
1489 if ((flags & MGMT_ADV_FLAG_DISCOV) &&
1490 hci_dev_test_flag(hdev, HCI_BONDABLE))
1493 /* We're neither bondable nor discoverable in the limited
1494 * privacy mode, therefore use RPA.
1499 static bool is_advertising_allowed(struct hci_dev *hdev, bool connectable)
1501 /* If there is no connection we are OK to advertise. */
1502 if (hci_conn_num(hdev, LE_LINK) == 0)
1505 /* Check le_states if there is any connection in slave role. */
1506 if (hdev->conn_hash.le_num_slave > 0) {
1507 /* Slave connection state and non connectable mode bit 20. */
1508 if (!connectable && !(hdev->le_states[2] & 0x10))
1511 /* Slave connection state and connectable mode bit 38
1512 * and scannable bit 21.
1514 if (connectable && (!(hdev->le_states[4] & 0x40) ||
1515 !(hdev->le_states[2] & 0x20)))
1519 /* Check le_states if there is any connection in master role. */
1520 if (hci_conn_num(hdev, LE_LINK) != hdev->conn_hash.le_num_slave) {
1521 /* Master connection state and non connectable mode bit 18. */
1522 if (!connectable && !(hdev->le_states[2] & 0x02))
1525 /* Master connection state and connectable mode bit 35 and
1528 if (connectable && (!(hdev->le_states[4] & 0x08) ||
1529 !(hdev->le_states[2] & 0x08)))
1536 void __hci_req_enable_advertising(struct hci_request *req)
1538 struct hci_dev *hdev = req->hdev;
1539 struct adv_info *adv_instance;
1540 struct hci_cp_le_set_adv_param cp;
1541 u8 own_addr_type, enable = 0x01;
1543 u16 adv_min_interval, adv_max_interval;
1546 flags = get_adv_instance_flags(hdev, hdev->cur_adv_instance);
1547 adv_instance = hci_find_adv_instance(hdev, hdev->cur_adv_instance);
1549 /* If the "connectable" instance flag was not set, then choose between
1550 * ADV_IND and ADV_NONCONN_IND based on the global connectable setting.
1552 connectable = (flags & MGMT_ADV_FLAG_CONNECTABLE) ||
1553 mgmt_get_connectable(hdev);
1555 if (!is_advertising_allowed(hdev, connectable))
1558 if (hci_dev_test_flag(hdev, HCI_LE_ADV))
1559 __hci_req_disable_advertising(req);
1561 /* Clear the HCI_LE_ADV bit temporarily so that the
1562 * hci_update_random_address knows that it's safe to go ahead
1563 * and write a new random address. The flag will be set back on
1564 * as soon as the SET_ADV_ENABLE HCI command completes.
1566 hci_dev_clear_flag(hdev, HCI_LE_ADV);
1568 /* Set require_privacy to true only when non-connectable
1569 * advertising is used. In that case it is fine to use a
1570 * non-resolvable private address.
1572 if (hci_update_random_address(req, !connectable,
1573 adv_use_rpa(hdev, flags),
1574 &own_addr_type) < 0)
1577 memset(&cp, 0, sizeof(cp));
1580 adv_min_interval = adv_instance->min_interval;
1581 adv_max_interval = adv_instance->max_interval;
1583 adv_min_interval = hdev->le_adv_min_interval;
1584 adv_max_interval = hdev->le_adv_max_interval;
1588 cp.type = LE_ADV_IND;
1590 if (adv_cur_instance_is_scannable(hdev))
1591 cp.type = LE_ADV_SCAN_IND;
1593 cp.type = LE_ADV_NONCONN_IND;
1595 if (!hci_dev_test_flag(hdev, HCI_DISCOVERABLE) ||
1596 hci_dev_test_flag(hdev, HCI_LIMITED_DISCOVERABLE)) {
1597 adv_min_interval = DISCOV_LE_FAST_ADV_INT_MIN;
1598 adv_max_interval = DISCOV_LE_FAST_ADV_INT_MAX;
1602 cp.min_interval = cpu_to_le16(adv_min_interval);
1603 cp.max_interval = cpu_to_le16(adv_max_interval);
1604 cp.own_address_type = own_addr_type;
1605 cp.channel_map = hdev->le_adv_channel_map;
1607 hci_req_add(req, HCI_OP_LE_SET_ADV_PARAM, sizeof(cp), &cp);
1609 hci_req_add(req, HCI_OP_LE_SET_ADV_ENABLE, sizeof(enable), &enable);
1612 u8 append_local_name(struct hci_dev *hdev, u8 *ptr, u8 ad_len)
1615 size_t complete_len;
1617 /* no space left for name (+ NULL + type + len) */
1618 if ((HCI_MAX_AD_LENGTH - ad_len) < HCI_MAX_SHORT_NAME_LENGTH + 3)
1621 /* use complete name if present and fits */
1622 complete_len = strlen(hdev->dev_name);
1623 if (complete_len && complete_len <= HCI_MAX_SHORT_NAME_LENGTH)
1624 return eir_append_data(ptr, ad_len, EIR_NAME_COMPLETE,
1625 hdev->dev_name, complete_len + 1);
1627 /* use short name if present */
1628 short_len = strlen(hdev->short_name);
1630 return eir_append_data(ptr, ad_len, EIR_NAME_SHORT,
1631 hdev->short_name, short_len + 1);
1633 /* use shortened full name if present, we already know that name
1634 * is longer then HCI_MAX_SHORT_NAME_LENGTH
1637 u8 name[HCI_MAX_SHORT_NAME_LENGTH + 1];
1639 memcpy(name, hdev->dev_name, HCI_MAX_SHORT_NAME_LENGTH);
1640 name[HCI_MAX_SHORT_NAME_LENGTH] = '\0';
1642 return eir_append_data(ptr, ad_len, EIR_NAME_SHORT, name,
1649 static u8 append_appearance(struct hci_dev *hdev, u8 *ptr, u8 ad_len)
1651 return eir_append_le16(ptr, ad_len, EIR_APPEARANCE, hdev->appearance);
1654 static u8 create_default_scan_rsp_data(struct hci_dev *hdev, u8 *ptr)
1656 u8 scan_rsp_len = 0;
1658 if (hdev->appearance)
1659 scan_rsp_len = append_appearance(hdev, ptr, scan_rsp_len);
1661 return append_local_name(hdev, ptr, scan_rsp_len);
1664 static u8 create_instance_scan_rsp_data(struct hci_dev *hdev, u8 instance,
1667 struct adv_info *adv_instance;
1669 u8 scan_rsp_len = 0;
1671 adv_instance = hci_find_adv_instance(hdev, instance);
1675 instance_flags = adv_instance->flags;
1677 if ((instance_flags & MGMT_ADV_FLAG_APPEARANCE) && hdev->appearance)
1678 scan_rsp_len = append_appearance(hdev, ptr, scan_rsp_len);
1680 memcpy(&ptr[scan_rsp_len], adv_instance->scan_rsp_data,
1681 adv_instance->scan_rsp_len);
1683 scan_rsp_len += adv_instance->scan_rsp_len;
1685 if (instance_flags & MGMT_ADV_FLAG_LOCAL_NAME)
1686 scan_rsp_len = append_local_name(hdev, ptr, scan_rsp_len);
1688 return scan_rsp_len;
1691 void __hci_req_update_scan_rsp_data(struct hci_request *req, u8 instance)
1693 struct hci_dev *hdev = req->hdev;
1696 if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED))
1699 if (ext_adv_capable(hdev)) {
1700 struct hci_cp_le_set_ext_scan_rsp_data cp;
1702 memset(&cp, 0, sizeof(cp));
1705 len = create_instance_scan_rsp_data(hdev, instance,
1708 len = create_default_scan_rsp_data(hdev, cp.data);
1710 if (hdev->scan_rsp_data_len == len &&
1711 !memcmp(cp.data, hdev->scan_rsp_data, len))
1714 memcpy(hdev->scan_rsp_data, cp.data, sizeof(cp.data));
1715 hdev->scan_rsp_data_len = len;
1717 cp.handle = instance;
1719 cp.operation = LE_SET_ADV_DATA_OP_COMPLETE;
1720 cp.frag_pref = LE_SET_ADV_DATA_NO_FRAG;
1722 hci_req_add(req, HCI_OP_LE_SET_EXT_SCAN_RSP_DATA, sizeof(cp),
1725 struct hci_cp_le_set_scan_rsp_data cp;
1727 memset(&cp, 0, sizeof(cp));
1730 len = create_instance_scan_rsp_data(hdev, instance,
1733 len = create_default_scan_rsp_data(hdev, cp.data);
1735 if (hdev->scan_rsp_data_len == len &&
1736 !memcmp(cp.data, hdev->scan_rsp_data, len))
1739 memcpy(hdev->scan_rsp_data, cp.data, sizeof(cp.data));
1740 hdev->scan_rsp_data_len = len;
1744 hci_req_add(req, HCI_OP_LE_SET_SCAN_RSP_DATA, sizeof(cp), &cp);
1748 static u8 create_instance_adv_data(struct hci_dev *hdev, u8 instance, u8 *ptr)
1750 struct adv_info *adv_instance = NULL;
1751 u8 ad_len = 0, flags = 0;
1754 /* Return 0 when the current instance identifier is invalid. */
1756 adv_instance = hci_find_adv_instance(hdev, instance);
1761 instance_flags = get_adv_instance_flags(hdev, instance);
1763 /* If instance already has the flags set skip adding it once
1766 if (adv_instance && eir_get_data(adv_instance->adv_data,
1767 adv_instance->adv_data_len, EIR_FLAGS,
1771 /* The Add Advertising command allows userspace to set both the general
1772 * and limited discoverable flags.
1774 if (instance_flags & MGMT_ADV_FLAG_DISCOV)
1775 flags |= LE_AD_GENERAL;
1777 if (instance_flags & MGMT_ADV_FLAG_LIMITED_DISCOV)
1778 flags |= LE_AD_LIMITED;
1780 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
1781 flags |= LE_AD_NO_BREDR;
1783 if (flags || (instance_flags & MGMT_ADV_FLAG_MANAGED_FLAGS)) {
1784 /* If a discovery flag wasn't provided, simply use the global
1788 flags |= mgmt_get_adv_discov_flags(hdev);
1790 /* If flags would still be empty, then there is no need to
1791 * include the "Flags" AD field".
1805 memcpy(ptr, adv_instance->adv_data,
1806 adv_instance->adv_data_len);
1807 ad_len += adv_instance->adv_data_len;
1808 ptr += adv_instance->adv_data_len;
1811 if (instance_flags & MGMT_ADV_FLAG_TX_POWER) {
1814 if (ext_adv_capable(hdev)) {
1816 adv_tx_power = adv_instance->tx_power;
1818 adv_tx_power = hdev->adv_tx_power;
1820 adv_tx_power = hdev->adv_tx_power;
1823 /* Provide Tx Power only if we can provide a valid value for it */
1824 if (adv_tx_power != HCI_TX_POWER_INVALID) {
1826 ptr[1] = EIR_TX_POWER;
1827 ptr[2] = (u8)adv_tx_power;
1837 void __hci_req_update_adv_data(struct hci_request *req, u8 instance)
1839 struct hci_dev *hdev = req->hdev;
1842 if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED))
1845 if (ext_adv_capable(hdev)) {
1846 struct hci_cp_le_set_ext_adv_data cp;
1848 memset(&cp, 0, sizeof(cp));
1850 len = create_instance_adv_data(hdev, instance, cp.data);
1852 /* There's nothing to do if the data hasn't changed */
1853 if (hdev->adv_data_len == len &&
1854 memcmp(cp.data, hdev->adv_data, len) == 0)
1857 memcpy(hdev->adv_data, cp.data, sizeof(cp.data));
1858 hdev->adv_data_len = len;
1861 cp.handle = instance;
1862 cp.operation = LE_SET_ADV_DATA_OP_COMPLETE;
1863 cp.frag_pref = LE_SET_ADV_DATA_NO_FRAG;
1865 hci_req_add(req, HCI_OP_LE_SET_EXT_ADV_DATA, sizeof(cp), &cp);
1867 struct hci_cp_le_set_adv_data cp;
1869 memset(&cp, 0, sizeof(cp));
1871 len = create_instance_adv_data(hdev, instance, cp.data);
1873 /* There's nothing to do if the data hasn't changed */
1874 if (hdev->adv_data_len == len &&
1875 memcmp(cp.data, hdev->adv_data, len) == 0)
1878 memcpy(hdev->adv_data, cp.data, sizeof(cp.data));
1879 hdev->adv_data_len = len;
1883 hci_req_add(req, HCI_OP_LE_SET_ADV_DATA, sizeof(cp), &cp);
1887 int hci_req_update_adv_data(struct hci_dev *hdev, u8 instance)
1889 struct hci_request req;
1891 hci_req_init(&req, hdev);
1892 __hci_req_update_adv_data(&req, instance);
1894 return hci_req_run(&req, NULL);
1897 static void enable_addr_resolution_complete(struct hci_dev *hdev, u8 status,
1900 BT_DBG("%s status %u", hdev->name, status);
1903 void hci_req_disable_address_resolution(struct hci_dev *hdev)
1905 struct hci_request req;
1908 if (!use_ll_privacy(hdev) &&
1909 !hci_dev_test_flag(hdev, HCI_LL_RPA_RESOLUTION))
1912 hci_req_init(&req, hdev);
1914 hci_req_add(&req, HCI_OP_LE_SET_ADDR_RESOLV_ENABLE, 1, &enable);
1916 hci_req_run(&req, enable_addr_resolution_complete);
1919 static void adv_enable_complete(struct hci_dev *hdev, u8 status, u16 opcode)
1921 bt_dev_dbg(hdev, "status %u", status);
1924 void hci_req_reenable_advertising(struct hci_dev *hdev)
1926 struct hci_request req;
1928 if (!hci_dev_test_flag(hdev, HCI_ADVERTISING) &&
1929 list_empty(&hdev->adv_instances))
1932 hci_req_init(&req, hdev);
1934 if (hdev->cur_adv_instance) {
1935 __hci_req_schedule_adv_instance(&req, hdev->cur_adv_instance,
1938 if (ext_adv_capable(hdev)) {
1939 __hci_req_start_ext_adv(&req, 0x00);
1941 __hci_req_update_adv_data(&req, 0x00);
1942 __hci_req_update_scan_rsp_data(&req, 0x00);
1943 __hci_req_enable_advertising(&req);
1947 hci_req_run(&req, adv_enable_complete);
1950 static void adv_timeout_expire(struct work_struct *work)
1952 struct hci_dev *hdev = container_of(work, struct hci_dev,
1953 adv_instance_expire.work);
1955 struct hci_request req;
1958 bt_dev_dbg(hdev, "");
1962 hdev->adv_instance_timeout = 0;
1964 instance = hdev->cur_adv_instance;
1965 if (instance == 0x00)
1968 hci_req_init(&req, hdev);
1970 hci_req_clear_adv_instance(hdev, NULL, &req, instance, false);
1972 if (list_empty(&hdev->adv_instances))
1973 __hci_req_disable_advertising(&req);
1975 hci_req_run(&req, NULL);
1978 hci_dev_unlock(hdev);
1981 static int hci_req_add_le_interleaved_scan(struct hci_request *req,
1984 struct hci_dev *hdev = req->hdev;
1989 if (hci_dev_test_flag(hdev, HCI_LE_SCAN))
1990 hci_req_add_le_scan_disable(req, false);
1991 hci_req_add_le_passive_scan(req);
1993 switch (hdev->interleave_scan_state) {
1994 case INTERLEAVE_SCAN_ALLOWLIST:
1995 bt_dev_dbg(hdev, "next state: allowlist");
1996 hdev->interleave_scan_state = INTERLEAVE_SCAN_NO_FILTER;
1998 case INTERLEAVE_SCAN_NO_FILTER:
1999 bt_dev_dbg(hdev, "next state: no filter");
2000 hdev->interleave_scan_state = INTERLEAVE_SCAN_ALLOWLIST;
2002 case INTERLEAVE_SCAN_NONE:
2003 BT_ERR("unexpected error");
2007 hci_dev_unlock(hdev);
2012 static void interleave_scan_work(struct work_struct *work)
2014 struct hci_dev *hdev = container_of(work, struct hci_dev,
2015 interleave_scan.work);
2017 unsigned long timeout;
2019 if (hdev->interleave_scan_state == INTERLEAVE_SCAN_ALLOWLIST) {
2020 timeout = msecs_to_jiffies(hdev->advmon_allowlist_duration);
2021 } else if (hdev->interleave_scan_state == INTERLEAVE_SCAN_NO_FILTER) {
2022 timeout = msecs_to_jiffies(hdev->advmon_no_filter_duration);
2024 bt_dev_err(hdev, "unexpected error");
2028 hci_req_sync(hdev, hci_req_add_le_interleaved_scan, 0,
2029 HCI_CMD_TIMEOUT, &status);
2031 /* Don't continue interleaving if it was canceled */
2032 if (is_interleave_scanning(hdev))
2033 queue_delayed_work(hdev->req_workqueue,
2034 &hdev->interleave_scan, timeout);
2037 int hci_get_random_address(struct hci_dev *hdev, bool require_privacy,
2038 bool use_rpa, struct adv_info *adv_instance,
2039 u8 *own_addr_type, bdaddr_t *rand_addr)
2043 bacpy(rand_addr, BDADDR_ANY);
2045 /* If privacy is enabled use a resolvable private address. If
2046 * current RPA has expired then generate a new one.
2051 /* If Controller supports LL Privacy use own address type is
2054 if (use_ll_privacy(hdev) &&
2055 hci_dev_test_flag(hdev, HCI_ENABLE_LL_PRIVACY))
2056 *own_addr_type = ADDR_LE_DEV_RANDOM_RESOLVED;
2058 *own_addr_type = ADDR_LE_DEV_RANDOM;
2061 if (!adv_instance->rpa_expired &&
2062 !bacmp(&adv_instance->random_addr, &hdev->rpa))
2065 adv_instance->rpa_expired = false;
2067 if (!hci_dev_test_and_clear_flag(hdev, HCI_RPA_EXPIRED) &&
2068 !bacmp(&hdev->random_addr, &hdev->rpa))
2072 err = smp_generate_rpa(hdev, hdev->irk, &hdev->rpa);
2074 bt_dev_err(hdev, "failed to generate new RPA");
2078 bacpy(rand_addr, &hdev->rpa);
2080 to = msecs_to_jiffies(hdev->rpa_timeout * 1000);
2082 queue_delayed_work(hdev->workqueue,
2083 &adv_instance->rpa_expired_cb, to);
2085 queue_delayed_work(hdev->workqueue,
2086 &hdev->rpa_expired, to);
2091 /* In case of required privacy without resolvable private address,
2092 * use an non-resolvable private address. This is useful for
2093 * non-connectable advertising.
2095 if (require_privacy) {
2099 /* The non-resolvable private address is generated
2100 * from random six bytes with the two most significant
2103 get_random_bytes(&nrpa, 6);
2106 /* The non-resolvable private address shall not be
2107 * equal to the public address.
2109 if (bacmp(&hdev->bdaddr, &nrpa))
2113 *own_addr_type = ADDR_LE_DEV_RANDOM;
2114 bacpy(rand_addr, &nrpa);
2119 /* No privacy so use a public address. */
2120 *own_addr_type = ADDR_LE_DEV_PUBLIC;
2125 void __hci_req_clear_ext_adv_sets(struct hci_request *req)
2127 hci_req_add(req, HCI_OP_LE_CLEAR_ADV_SETS, 0, NULL);
2130 int __hci_req_setup_ext_adv_instance(struct hci_request *req, u8 instance)
2132 struct hci_cp_le_set_ext_adv_params cp;
2133 struct hci_dev *hdev = req->hdev;
2136 bdaddr_t random_addr;
2139 struct adv_info *adv_instance;
2143 adv_instance = hci_find_adv_instance(hdev, instance);
2147 adv_instance = NULL;
2150 flags = get_adv_instance_flags(hdev, instance);
2152 /* If the "connectable" instance flag was not set, then choose between
2153 * ADV_IND and ADV_NONCONN_IND based on the global connectable setting.
2155 connectable = (flags & MGMT_ADV_FLAG_CONNECTABLE) ||
2156 mgmt_get_connectable(hdev);
2158 if (!is_advertising_allowed(hdev, connectable))
2161 /* Set require_privacy to true only when non-connectable
2162 * advertising is used. In that case it is fine to use a
2163 * non-resolvable private address.
2165 err = hci_get_random_address(hdev, !connectable,
2166 adv_use_rpa(hdev, flags), adv_instance,
2167 &own_addr_type, &random_addr);
2171 memset(&cp, 0, sizeof(cp));
2174 hci_cpu_to_le24(adv_instance->min_interval, cp.min_interval);
2175 hci_cpu_to_le24(adv_instance->max_interval, cp.max_interval);
2176 cp.tx_power = adv_instance->tx_power;
2178 hci_cpu_to_le24(hdev->le_adv_min_interval, cp.min_interval);
2179 hci_cpu_to_le24(hdev->le_adv_max_interval, cp.max_interval);
2180 cp.tx_power = HCI_ADV_TX_POWER_NO_PREFERENCE;
2183 secondary_adv = (flags & MGMT_ADV_FLAG_SEC_MASK);
2187 cp.evt_properties = cpu_to_le16(LE_EXT_ADV_CONN_IND);
2189 cp.evt_properties = cpu_to_le16(LE_LEGACY_ADV_IND);
2190 } else if (adv_instance_is_scannable(hdev, instance) ||
2191 (flags & MGMT_ADV_PARAM_SCAN_RSP)) {
2193 cp.evt_properties = cpu_to_le16(LE_EXT_ADV_SCAN_IND);
2195 cp.evt_properties = cpu_to_le16(LE_LEGACY_ADV_SCAN_IND);
2198 cp.evt_properties = cpu_to_le16(LE_EXT_ADV_NON_CONN_IND);
2200 cp.evt_properties = cpu_to_le16(LE_LEGACY_NONCONN_IND);
2203 cp.own_addr_type = own_addr_type;
2204 cp.channel_map = hdev->le_adv_channel_map;
2205 cp.handle = instance;
2207 if (flags & MGMT_ADV_FLAG_SEC_2M) {
2208 cp.primary_phy = HCI_ADV_PHY_1M;
2209 cp.secondary_phy = HCI_ADV_PHY_2M;
2210 } else if (flags & MGMT_ADV_FLAG_SEC_CODED) {
2211 cp.primary_phy = HCI_ADV_PHY_CODED;
2212 cp.secondary_phy = HCI_ADV_PHY_CODED;
2214 /* In all other cases use 1M */
2215 cp.primary_phy = HCI_ADV_PHY_1M;
2216 cp.secondary_phy = HCI_ADV_PHY_1M;
2219 hci_req_add(req, HCI_OP_LE_SET_EXT_ADV_PARAMS, sizeof(cp), &cp);
2221 if (own_addr_type == ADDR_LE_DEV_RANDOM &&
2222 bacmp(&random_addr, BDADDR_ANY)) {
2223 struct hci_cp_le_set_adv_set_rand_addr cp;
2225 /* Check if random address need to be updated */
2227 if (!bacmp(&random_addr, &adv_instance->random_addr))
2230 if (!bacmp(&random_addr, &hdev->random_addr))
2234 memset(&cp, 0, sizeof(cp));
2236 cp.handle = instance;
2237 bacpy(&cp.bdaddr, &random_addr);
2240 HCI_OP_LE_SET_ADV_SET_RAND_ADDR,
2247 int __hci_req_enable_ext_advertising(struct hci_request *req, u8 instance)
2249 struct hci_dev *hdev = req->hdev;
2250 struct hci_cp_le_set_ext_adv_enable *cp;
2251 struct hci_cp_ext_adv_set *adv_set;
2252 u8 data[sizeof(*cp) + sizeof(*adv_set) * 1];
2253 struct adv_info *adv_instance;
2256 adv_instance = hci_find_adv_instance(hdev, instance);
2260 adv_instance = NULL;
2264 adv_set = (void *) cp->data;
2266 memset(cp, 0, sizeof(*cp));
2269 cp->num_of_sets = 0x01;
2271 memset(adv_set, 0, sizeof(*adv_set));
2273 adv_set->handle = instance;
2275 /* Set duration per instance since controller is responsible for
2278 if (adv_instance && adv_instance->duration) {
2279 u16 duration = adv_instance->timeout * MSEC_PER_SEC;
2281 /* Time = N * 10 ms */
2282 adv_set->duration = cpu_to_le16(duration / 10);
2285 hci_req_add(req, HCI_OP_LE_SET_EXT_ADV_ENABLE,
2286 sizeof(*cp) + sizeof(*adv_set) * cp->num_of_sets,
2292 int __hci_req_disable_ext_adv_instance(struct hci_request *req, u8 instance)
2294 struct hci_dev *hdev = req->hdev;
2295 struct hci_cp_le_set_ext_adv_enable *cp;
2296 struct hci_cp_ext_adv_set *adv_set;
2297 u8 data[sizeof(*cp) + sizeof(*adv_set) * 1];
2300 /* If request specifies an instance that doesn't exist, fail */
2301 if (instance > 0 && !hci_find_adv_instance(hdev, instance))
2304 memset(data, 0, sizeof(data));
2307 adv_set = (void *)cp->data;
2309 /* Instance 0x00 indicates all advertising instances will be disabled */
2310 cp->num_of_sets = !!instance;
2313 adv_set->handle = instance;
2315 req_size = sizeof(*cp) + sizeof(*adv_set) * cp->num_of_sets;
2316 hci_req_add(req, HCI_OP_LE_SET_EXT_ADV_ENABLE, req_size, data);
2321 int __hci_req_remove_ext_adv_instance(struct hci_request *req, u8 instance)
2323 struct hci_dev *hdev = req->hdev;
2325 /* If request specifies an instance that doesn't exist, fail */
2326 if (instance > 0 && !hci_find_adv_instance(hdev, instance))
2329 hci_req_add(req, HCI_OP_LE_REMOVE_ADV_SET, sizeof(instance), &instance);
2334 int __hci_req_start_ext_adv(struct hci_request *req, u8 instance)
2336 struct hci_dev *hdev = req->hdev;
2337 struct adv_info *adv_instance = hci_find_adv_instance(hdev, instance);
2340 /* If instance isn't pending, the chip knows about it, and it's safe to
2343 if (adv_instance && !adv_instance->pending)
2344 __hci_req_disable_ext_adv_instance(req, instance);
2346 err = __hci_req_setup_ext_adv_instance(req, instance);
2350 __hci_req_update_scan_rsp_data(req, instance);
2351 __hci_req_enable_ext_advertising(req, instance);
2356 int __hci_req_schedule_adv_instance(struct hci_request *req, u8 instance,
2359 struct hci_dev *hdev = req->hdev;
2360 struct adv_info *adv_instance = NULL;
2363 if (hci_dev_test_flag(hdev, HCI_ADVERTISING) ||
2364 list_empty(&hdev->adv_instances))
2367 if (hdev->adv_instance_timeout)
2370 adv_instance = hci_find_adv_instance(hdev, instance);
2374 /* A zero timeout means unlimited advertising. As long as there is
2375 * only one instance, duration should be ignored. We still set a timeout
2376 * in case further instances are being added later on.
2378 * If the remaining lifetime of the instance is more than the duration
2379 * then the timeout corresponds to the duration, otherwise it will be
2380 * reduced to the remaining instance lifetime.
2382 if (adv_instance->timeout == 0 ||
2383 adv_instance->duration <= adv_instance->remaining_time)
2384 timeout = adv_instance->duration;
2386 timeout = adv_instance->remaining_time;
2388 /* The remaining time is being reduced unless the instance is being
2389 * advertised without time limit.
2391 if (adv_instance->timeout)
2392 adv_instance->remaining_time =
2393 adv_instance->remaining_time - timeout;
2395 /* Only use work for scheduling instances with legacy advertising */
2396 if (!ext_adv_capable(hdev)) {
2397 hdev->adv_instance_timeout = timeout;
2398 queue_delayed_work(hdev->req_workqueue,
2399 &hdev->adv_instance_expire,
2400 msecs_to_jiffies(timeout * 1000));
2403 /* If we're just re-scheduling the same instance again then do not
2404 * execute any HCI commands. This happens when a single instance is
2407 if (!force && hdev->cur_adv_instance == instance &&
2408 hci_dev_test_flag(hdev, HCI_LE_ADV))
2411 hdev->cur_adv_instance = instance;
2412 if (ext_adv_capable(hdev)) {
2413 __hci_req_start_ext_adv(req, instance);
2415 __hci_req_update_adv_data(req, instance);
2416 __hci_req_update_scan_rsp_data(req, instance);
2417 __hci_req_enable_advertising(req);
2423 /* For a single instance:
2424 * - force == true: The instance will be removed even when its remaining
2425 * lifetime is not zero.
2426 * - force == false: the instance will be deactivated but kept stored unless
2427 * the remaining lifetime is zero.
2429 * For instance == 0x00:
2430 * - force == true: All instances will be removed regardless of their timeout
2432 * - force == false: Only instances that have a timeout will be removed.
2434 void hci_req_clear_adv_instance(struct hci_dev *hdev, struct sock *sk,
2435 struct hci_request *req, u8 instance,
2438 struct adv_info *adv_instance, *n, *next_instance = NULL;
2442 /* Cancel any timeout concerning the removed instance(s). */
2443 if (!instance || hdev->cur_adv_instance == instance)
2444 cancel_adv_timeout(hdev);
2446 /* Get the next instance to advertise BEFORE we remove
2447 * the current one. This can be the same instance again
2448 * if there is only one instance.
2450 if (instance && hdev->cur_adv_instance == instance)
2451 next_instance = hci_get_next_instance(hdev, instance);
2453 if (instance == 0x00) {
2454 list_for_each_entry_safe(adv_instance, n, &hdev->adv_instances,
2456 if (!(force || adv_instance->timeout))
2459 rem_inst = adv_instance->instance;
2460 err = hci_remove_adv_instance(hdev, rem_inst);
2462 mgmt_advertising_removed(sk, hdev, rem_inst);
2465 adv_instance = hci_find_adv_instance(hdev, instance);
2467 if (force || (adv_instance && adv_instance->timeout &&
2468 !adv_instance->remaining_time)) {
2469 /* Don't advertise a removed instance. */
2470 if (next_instance &&
2471 next_instance->instance == instance)
2472 next_instance = NULL;
2474 err = hci_remove_adv_instance(hdev, instance);
2476 mgmt_advertising_removed(sk, hdev, instance);
2480 if (!req || !hdev_is_powered(hdev) ||
2481 hci_dev_test_flag(hdev, HCI_ADVERTISING))
2484 if (next_instance && !ext_adv_capable(hdev))
2485 __hci_req_schedule_adv_instance(req, next_instance->instance,
2489 static void set_random_addr(struct hci_request *req, bdaddr_t *rpa)
2491 struct hci_dev *hdev = req->hdev;
2493 /* If we're advertising or initiating an LE connection we can't
2494 * go ahead and change the random address at this time. This is
2495 * because the eventual initiator address used for the
2496 * subsequently created connection will be undefined (some
2497 * controllers use the new address and others the one we had
2498 * when the operation started).
2500 * In this kind of scenario skip the update and let the random
2501 * address be updated at the next cycle.
2503 if (hci_dev_test_flag(hdev, HCI_LE_ADV) ||
2504 hci_lookup_le_connect(hdev)) {
2505 bt_dev_dbg(hdev, "Deferring random address update");
2506 hci_dev_set_flag(hdev, HCI_RPA_EXPIRED);
2510 hci_req_add(req, HCI_OP_LE_SET_RANDOM_ADDR, 6, rpa);
2513 int hci_update_random_address(struct hci_request *req, bool require_privacy,
2514 bool use_rpa, u8 *own_addr_type)
2516 struct hci_dev *hdev = req->hdev;
2519 /* If privacy is enabled use a resolvable private address. If
2520 * current RPA has expired or there is something else than
2521 * the current RPA in use, then generate a new one.
2526 /* If Controller supports LL Privacy use own address type is
2529 if (use_ll_privacy(hdev) &&
2530 hci_dev_test_flag(hdev, HCI_ENABLE_LL_PRIVACY))
2531 *own_addr_type = ADDR_LE_DEV_RANDOM_RESOLVED;
2533 *own_addr_type = ADDR_LE_DEV_RANDOM;
2535 if (!hci_dev_test_and_clear_flag(hdev, HCI_RPA_EXPIRED) &&
2536 !bacmp(&hdev->random_addr, &hdev->rpa))
2539 err = smp_generate_rpa(hdev, hdev->irk, &hdev->rpa);
2541 bt_dev_err(hdev, "failed to generate new RPA");
2545 set_random_addr(req, &hdev->rpa);
2547 to = msecs_to_jiffies(hdev->rpa_timeout * 1000);
2548 queue_delayed_work(hdev->workqueue, &hdev->rpa_expired, to);
2553 /* In case of required privacy without resolvable private address,
2554 * use an non-resolvable private address. This is useful for active
2555 * scanning and non-connectable advertising.
2557 if (require_privacy) {
2561 /* The non-resolvable private address is generated
2562 * from random six bytes with the two most significant
2565 get_random_bytes(&nrpa, 6);
2568 /* The non-resolvable private address shall not be
2569 * equal to the public address.
2571 if (bacmp(&hdev->bdaddr, &nrpa))
2575 *own_addr_type = ADDR_LE_DEV_RANDOM;
2576 set_random_addr(req, &nrpa);
2580 /* If forcing static address is in use or there is no public
2581 * address use the static address as random address (but skip
2582 * the HCI command if the current random address is already the
2585 * In case BR/EDR has been disabled on a dual-mode controller
2586 * and a static address has been configured, then use that
2587 * address instead of the public BR/EDR address.
2589 if (hci_dev_test_flag(hdev, HCI_FORCE_STATIC_ADDR) ||
2590 !bacmp(&hdev->bdaddr, BDADDR_ANY) ||
2591 (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) &&
2592 bacmp(&hdev->static_addr, BDADDR_ANY))) {
2593 *own_addr_type = ADDR_LE_DEV_RANDOM;
2594 if (bacmp(&hdev->static_addr, &hdev->random_addr))
2595 hci_req_add(req, HCI_OP_LE_SET_RANDOM_ADDR, 6,
2596 &hdev->static_addr);
2600 /* Neither privacy nor static address is being used so use a
2603 *own_addr_type = ADDR_LE_DEV_PUBLIC;
2608 static bool disconnected_whitelist_entries(struct hci_dev *hdev)
2610 struct bdaddr_list *b;
2612 list_for_each_entry(b, &hdev->whitelist, list) {
2613 struct hci_conn *conn;
2615 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &b->bdaddr);
2619 if (conn->state != BT_CONNECTED && conn->state != BT_CONFIG)
2626 void __hci_req_update_scan(struct hci_request *req)
2628 struct hci_dev *hdev = req->hdev;
2631 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
2634 if (!hdev_is_powered(hdev))
2637 if (mgmt_powering_down(hdev))
2640 if (hdev->scanning_paused)
2643 if (hci_dev_test_flag(hdev, HCI_CONNECTABLE) ||
2644 disconnected_whitelist_entries(hdev))
2647 scan = SCAN_DISABLED;
2649 if (hci_dev_test_flag(hdev, HCI_DISCOVERABLE))
2650 scan |= SCAN_INQUIRY;
2652 if (test_bit(HCI_PSCAN, &hdev->flags) == !!(scan & SCAN_PAGE) &&
2653 test_bit(HCI_ISCAN, &hdev->flags) == !!(scan & SCAN_INQUIRY))
2656 hci_req_add(req, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
2659 static int update_scan(struct hci_request *req, unsigned long opt)
2661 hci_dev_lock(req->hdev);
2662 __hci_req_update_scan(req);
2663 hci_dev_unlock(req->hdev);
2667 static void scan_update_work(struct work_struct *work)
2669 struct hci_dev *hdev = container_of(work, struct hci_dev, scan_update);
2671 hci_req_sync(hdev, update_scan, 0, HCI_CMD_TIMEOUT, NULL);
2674 static int connectable_update(struct hci_request *req, unsigned long opt)
2676 struct hci_dev *hdev = req->hdev;
2680 __hci_req_update_scan(req);
2682 /* If BR/EDR is not enabled and we disable advertising as a
2683 * by-product of disabling connectable, we need to update the
2684 * advertising flags.
2686 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
2687 __hci_req_update_adv_data(req, hdev->cur_adv_instance);
2689 /* Update the advertising parameters if necessary */
2690 if (hci_dev_test_flag(hdev, HCI_ADVERTISING) ||
2691 !list_empty(&hdev->adv_instances)) {
2692 if (ext_adv_capable(hdev))
2693 __hci_req_start_ext_adv(req, hdev->cur_adv_instance);
2695 __hci_req_enable_advertising(req);
2698 __hci_update_background_scan(req);
2700 hci_dev_unlock(hdev);
2705 static void connectable_update_work(struct work_struct *work)
2707 struct hci_dev *hdev = container_of(work, struct hci_dev,
2708 connectable_update);
2711 hci_req_sync(hdev, connectable_update, 0, HCI_CMD_TIMEOUT, &status);
2712 mgmt_set_connectable_complete(hdev, status);
2715 static u8 get_service_classes(struct hci_dev *hdev)
2717 struct bt_uuid *uuid;
2720 list_for_each_entry(uuid, &hdev->uuids, list)
2721 val |= uuid->svc_hint;
2726 void __hci_req_update_class(struct hci_request *req)
2728 struct hci_dev *hdev = req->hdev;
2731 bt_dev_dbg(hdev, "");
2733 if (!hdev_is_powered(hdev))
2736 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
2739 if (hci_dev_test_flag(hdev, HCI_SERVICE_CACHE))
2742 cod[0] = hdev->minor_class;
2743 cod[1] = hdev->major_class;
2744 cod[2] = get_service_classes(hdev);
2746 if (hci_dev_test_flag(hdev, HCI_LIMITED_DISCOVERABLE))
2749 if (memcmp(cod, hdev->dev_class, 3) == 0)
2752 hci_req_add(req, HCI_OP_WRITE_CLASS_OF_DEV, sizeof(cod), cod);
2755 static void write_iac(struct hci_request *req)
2757 struct hci_dev *hdev = req->hdev;
2758 struct hci_cp_write_current_iac_lap cp;
2760 if (!hci_dev_test_flag(hdev, HCI_DISCOVERABLE))
2763 if (hci_dev_test_flag(hdev, HCI_LIMITED_DISCOVERABLE)) {
2764 /* Limited discoverable mode */
2765 cp.num_iac = min_t(u8, hdev->num_iac, 2);
2766 cp.iac_lap[0] = 0x00; /* LIAC */
2767 cp.iac_lap[1] = 0x8b;
2768 cp.iac_lap[2] = 0x9e;
2769 cp.iac_lap[3] = 0x33; /* GIAC */
2770 cp.iac_lap[4] = 0x8b;
2771 cp.iac_lap[5] = 0x9e;
2773 /* General discoverable mode */
2775 cp.iac_lap[0] = 0x33; /* GIAC */
2776 cp.iac_lap[1] = 0x8b;
2777 cp.iac_lap[2] = 0x9e;
2780 hci_req_add(req, HCI_OP_WRITE_CURRENT_IAC_LAP,
2781 (cp.num_iac * 3) + 1, &cp);
2784 static int discoverable_update(struct hci_request *req, unsigned long opt)
2786 struct hci_dev *hdev = req->hdev;
2790 if (hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) {
2792 __hci_req_update_scan(req);
2793 __hci_req_update_class(req);
2796 /* Advertising instances don't use the global discoverable setting, so
2797 * only update AD if advertising was enabled using Set Advertising.
2799 if (hci_dev_test_flag(hdev, HCI_ADVERTISING)) {
2800 __hci_req_update_adv_data(req, 0x00);
2802 /* Discoverable mode affects the local advertising
2803 * address in limited privacy mode.
2805 if (hci_dev_test_flag(hdev, HCI_LIMITED_PRIVACY)) {
2806 if (ext_adv_capable(hdev))
2807 __hci_req_start_ext_adv(req, 0x00);
2809 __hci_req_enable_advertising(req);
2813 hci_dev_unlock(hdev);
2818 static void discoverable_update_work(struct work_struct *work)
2820 struct hci_dev *hdev = container_of(work, struct hci_dev,
2821 discoverable_update);
2824 hci_req_sync(hdev, discoverable_update, 0, HCI_CMD_TIMEOUT, &status);
2825 mgmt_set_discoverable_complete(hdev, status);
2828 void __hci_abort_conn(struct hci_request *req, struct hci_conn *conn,
2831 switch (conn->state) {
2834 if (conn->type == AMP_LINK) {
2835 struct hci_cp_disconn_phy_link cp;
2837 cp.phy_handle = HCI_PHY_HANDLE(conn->handle);
2839 hci_req_add(req, HCI_OP_DISCONN_PHY_LINK, sizeof(cp),
2842 struct hci_cp_disconnect dc;
2844 dc.handle = cpu_to_le16(conn->handle);
2846 hci_req_add(req, HCI_OP_DISCONNECT, sizeof(dc), &dc);
2849 conn->state = BT_DISCONN;
2853 if (conn->type == LE_LINK) {
2854 if (test_bit(HCI_CONN_SCANNING, &conn->flags))
2856 hci_req_add(req, HCI_OP_LE_CREATE_CONN_CANCEL,
2858 } else if (conn->type == ACL_LINK) {
2859 if (req->hdev->hci_ver < BLUETOOTH_VER_1_2)
2861 hci_req_add(req, HCI_OP_CREATE_CONN_CANCEL,
2866 if (conn->type == ACL_LINK) {
2867 struct hci_cp_reject_conn_req rej;
2869 bacpy(&rej.bdaddr, &conn->dst);
2870 rej.reason = reason;
2872 hci_req_add(req, HCI_OP_REJECT_CONN_REQ,
2874 } else if (conn->type == SCO_LINK || conn->type == ESCO_LINK) {
2875 struct hci_cp_reject_sync_conn_req rej;
2877 bacpy(&rej.bdaddr, &conn->dst);
2879 /* SCO rejection has its own limited set of
2880 * allowed error values (0x0D-0x0F) which isn't
2881 * compatible with most values passed to this
2882 * function. To be safe hard-code one of the
2883 * values that's suitable for SCO.
2885 rej.reason = HCI_ERROR_REJ_LIMITED_RESOURCES;
2887 hci_req_add(req, HCI_OP_REJECT_SYNC_CONN_REQ,
2892 conn->state = BT_CLOSED;
2897 static void abort_conn_complete(struct hci_dev *hdev, u8 status, u16 opcode)
2900 bt_dev_dbg(hdev, "Failed to abort connection: status 0x%2.2x", status);
2903 int hci_abort_conn(struct hci_conn *conn, u8 reason)
2905 struct hci_request req;
2908 hci_req_init(&req, conn->hdev);
2910 __hci_abort_conn(&req, conn, reason);
2912 err = hci_req_run(&req, abort_conn_complete);
2913 if (err && err != -ENODATA) {
2914 bt_dev_err(conn->hdev, "failed to run HCI request: err %d", err);
2921 static int update_bg_scan(struct hci_request *req, unsigned long opt)
2923 hci_dev_lock(req->hdev);
2924 __hci_update_background_scan(req);
2925 hci_dev_unlock(req->hdev);
2929 static void bg_scan_update(struct work_struct *work)
2931 struct hci_dev *hdev = container_of(work, struct hci_dev,
2933 struct hci_conn *conn;
2937 err = hci_req_sync(hdev, update_bg_scan, 0, HCI_CMD_TIMEOUT, &status);
2943 conn = hci_conn_hash_lookup_state(hdev, LE_LINK, BT_CONNECT);
2945 hci_le_conn_failed(conn, status);
2947 hci_dev_unlock(hdev);
2950 static int le_scan_disable(struct hci_request *req, unsigned long opt)
2952 hci_req_add_le_scan_disable(req, false);
2956 static int bredr_inquiry(struct hci_request *req, unsigned long opt)
2959 const u8 giac[3] = { 0x33, 0x8b, 0x9e };
2960 const u8 liac[3] = { 0x00, 0x8b, 0x9e };
2961 struct hci_cp_inquiry cp;
2963 if (test_bit(HCI_INQUIRY, &req->hdev->flags))
2966 bt_dev_dbg(req->hdev, "");
2968 hci_dev_lock(req->hdev);
2969 hci_inquiry_cache_flush(req->hdev);
2970 hci_dev_unlock(req->hdev);
2972 memset(&cp, 0, sizeof(cp));
2974 if (req->hdev->discovery.limited)
2975 memcpy(&cp.lap, liac, sizeof(cp.lap));
2977 memcpy(&cp.lap, giac, sizeof(cp.lap));
2981 hci_req_add(req, HCI_OP_INQUIRY, sizeof(cp), &cp);
2986 static void le_scan_disable_work(struct work_struct *work)
2988 struct hci_dev *hdev = container_of(work, struct hci_dev,
2989 le_scan_disable.work);
2992 bt_dev_dbg(hdev, "");
2994 if (!hci_dev_test_flag(hdev, HCI_LE_SCAN))
2997 cancel_delayed_work(&hdev->le_scan_restart);
2999 hci_req_sync(hdev, le_scan_disable, 0, HCI_CMD_TIMEOUT, &status);
3001 bt_dev_err(hdev, "failed to disable LE scan: status 0x%02x",
3006 hdev->discovery.scan_start = 0;
3008 /* If we were running LE only scan, change discovery state. If
3009 * we were running both LE and BR/EDR inquiry simultaneously,
3010 * and BR/EDR inquiry is already finished, stop discovery,
3011 * otherwise BR/EDR inquiry will stop discovery when finished.
3012 * If we will resolve remote device name, do not change
3016 if (hdev->discovery.type == DISCOV_TYPE_LE)
3017 goto discov_stopped;
3019 if (hdev->discovery.type != DISCOV_TYPE_INTERLEAVED)
3022 if (test_bit(HCI_QUIRK_SIMULTANEOUS_DISCOVERY, &hdev->quirks)) {
3023 if (!test_bit(HCI_INQUIRY, &hdev->flags) &&
3024 hdev->discovery.state != DISCOVERY_RESOLVING)
3025 goto discov_stopped;
3030 hci_req_sync(hdev, bredr_inquiry, DISCOV_INTERLEAVED_INQUIRY_LEN,
3031 HCI_CMD_TIMEOUT, &status);
3033 bt_dev_err(hdev, "inquiry failed: status 0x%02x", status);
3034 goto discov_stopped;
3041 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
3042 hci_dev_unlock(hdev);
3045 static int le_scan_restart(struct hci_request *req, unsigned long opt)
3047 struct hci_dev *hdev = req->hdev;
3049 /* If controller is not scanning we are done. */
3050 if (!hci_dev_test_flag(hdev, HCI_LE_SCAN))
3053 if (hdev->scanning_paused) {
3054 bt_dev_dbg(hdev, "Scanning is paused for suspend");
3058 hci_req_add_le_scan_disable(req, false);
3060 if (use_ext_scan(hdev)) {
3061 struct hci_cp_le_set_ext_scan_enable ext_enable_cp;
3063 memset(&ext_enable_cp, 0, sizeof(ext_enable_cp));
3064 ext_enable_cp.enable = LE_SCAN_ENABLE;
3065 ext_enable_cp.filter_dup = LE_SCAN_FILTER_DUP_ENABLE;
3067 hci_req_add(req, HCI_OP_LE_SET_EXT_SCAN_ENABLE,
3068 sizeof(ext_enable_cp), &ext_enable_cp);
3070 struct hci_cp_le_set_scan_enable cp;
3072 memset(&cp, 0, sizeof(cp));
3073 cp.enable = LE_SCAN_ENABLE;
3074 cp.filter_dup = LE_SCAN_FILTER_DUP_ENABLE;
3075 hci_req_add(req, HCI_OP_LE_SET_SCAN_ENABLE, sizeof(cp), &cp);
3081 static void le_scan_restart_work(struct work_struct *work)
3083 struct hci_dev *hdev = container_of(work, struct hci_dev,
3084 le_scan_restart.work);
3085 unsigned long timeout, duration, scan_start, now;
3088 bt_dev_dbg(hdev, "");
3090 hci_req_sync(hdev, le_scan_restart, 0, HCI_CMD_TIMEOUT, &status);
3092 bt_dev_err(hdev, "failed to restart LE scan: status %d",
3099 if (!test_bit(HCI_QUIRK_STRICT_DUPLICATE_FILTER, &hdev->quirks) ||
3100 !hdev->discovery.scan_start)
3103 /* When the scan was started, hdev->le_scan_disable has been queued
3104 * after duration from scan_start. During scan restart this job
3105 * has been canceled, and we need to queue it again after proper
3106 * timeout, to make sure that scan does not run indefinitely.
3108 duration = hdev->discovery.scan_duration;
3109 scan_start = hdev->discovery.scan_start;
3111 if (now - scan_start <= duration) {
3114 if (now >= scan_start)
3115 elapsed = now - scan_start;
3117 elapsed = ULONG_MAX - scan_start + now;
3119 timeout = duration - elapsed;
3124 queue_delayed_work(hdev->req_workqueue,
3125 &hdev->le_scan_disable, timeout);
3128 hci_dev_unlock(hdev);
3131 static int active_scan(struct hci_request *req, unsigned long opt)
3133 uint16_t interval = opt;
3134 struct hci_dev *hdev = req->hdev;
3136 /* White list is not used for discovery */
3137 u8 filter_policy = 0x00;
3138 /* Discovery doesn't require controller address resolution */
3139 bool addr_resolv = false;
3142 bt_dev_dbg(hdev, "");
3144 /* If controller is scanning, it means the background scanning is
3145 * running. Thus, we should temporarily stop it in order to set the
3146 * discovery scanning parameters.
3148 if (hci_dev_test_flag(hdev, HCI_LE_SCAN)) {
3149 hci_req_add_le_scan_disable(req, false);
3150 cancel_interleave_scan(hdev);
3153 /* All active scans will be done with either a resolvable private
3154 * address (when privacy feature has been enabled) or non-resolvable
3157 err = hci_update_random_address(req, true, scan_use_rpa(hdev),
3160 own_addr_type = ADDR_LE_DEV_PUBLIC;
3162 hci_req_start_scan(req, LE_SCAN_ACTIVE, interval,
3163 hdev->le_scan_window_discovery, own_addr_type,
3164 filter_policy, addr_resolv);
3168 static int interleaved_discov(struct hci_request *req, unsigned long opt)
3172 bt_dev_dbg(req->hdev, "");
3174 err = active_scan(req, opt);
3178 return bredr_inquiry(req, DISCOV_BREDR_INQUIRY_LEN);
3181 static void start_discovery(struct hci_dev *hdev, u8 *status)
3183 unsigned long timeout;
3185 bt_dev_dbg(hdev, "type %u", hdev->discovery.type);
3187 switch (hdev->discovery.type) {
3188 case DISCOV_TYPE_BREDR:
3189 if (!hci_dev_test_flag(hdev, HCI_INQUIRY))
3190 hci_req_sync(hdev, bredr_inquiry,
3191 DISCOV_BREDR_INQUIRY_LEN, HCI_CMD_TIMEOUT,
3194 case DISCOV_TYPE_INTERLEAVED:
3195 /* When running simultaneous discovery, the LE scanning time
3196 * should occupy the whole discovery time sine BR/EDR inquiry
3197 * and LE scanning are scheduled by the controller.
3199 * For interleaving discovery in comparison, BR/EDR inquiry
3200 * and LE scanning are done sequentially with separate
3203 if (test_bit(HCI_QUIRK_SIMULTANEOUS_DISCOVERY,
3205 timeout = msecs_to_jiffies(DISCOV_LE_TIMEOUT);
3206 /* During simultaneous discovery, we double LE scan
3207 * interval. We must leave some time for the controller
3208 * to do BR/EDR inquiry.
3210 hci_req_sync(hdev, interleaved_discov,
3211 hdev->le_scan_int_discovery * 2, HCI_CMD_TIMEOUT,
3216 timeout = msecs_to_jiffies(hdev->discov_interleaved_timeout);
3217 hci_req_sync(hdev, active_scan, hdev->le_scan_int_discovery,
3218 HCI_CMD_TIMEOUT, status);
3220 case DISCOV_TYPE_LE:
3221 timeout = msecs_to_jiffies(DISCOV_LE_TIMEOUT);
3222 hci_req_sync(hdev, active_scan, hdev->le_scan_int_discovery,
3223 HCI_CMD_TIMEOUT, status);
3226 *status = HCI_ERROR_UNSPECIFIED;
3233 bt_dev_dbg(hdev, "timeout %u ms", jiffies_to_msecs(timeout));
3235 /* When service discovery is used and the controller has a
3236 * strict duplicate filter, it is important to remember the
3237 * start and duration of the scan. This is required for
3238 * restarting scanning during the discovery phase.
3240 if (test_bit(HCI_QUIRK_STRICT_DUPLICATE_FILTER, &hdev->quirks) &&
3241 hdev->discovery.result_filtering) {
3242 hdev->discovery.scan_start = jiffies;
3243 hdev->discovery.scan_duration = timeout;
3246 queue_delayed_work(hdev->req_workqueue, &hdev->le_scan_disable,
3250 bool hci_req_stop_discovery(struct hci_request *req)
3252 struct hci_dev *hdev = req->hdev;
3253 struct discovery_state *d = &hdev->discovery;
3254 struct hci_cp_remote_name_req_cancel cp;
3255 struct inquiry_entry *e;
3258 bt_dev_dbg(hdev, "state %u", hdev->discovery.state);
3260 if (d->state == DISCOVERY_FINDING || d->state == DISCOVERY_STOPPING) {
3261 if (test_bit(HCI_INQUIRY, &hdev->flags))
3262 hci_req_add(req, HCI_OP_INQUIRY_CANCEL, 0, NULL);
3264 if (hci_dev_test_flag(hdev, HCI_LE_SCAN)) {
3265 cancel_delayed_work(&hdev->le_scan_disable);
3266 cancel_delayed_work(&hdev->le_scan_restart);
3267 hci_req_add_le_scan_disable(req, false);
3272 /* Passive scanning */
3273 if (hci_dev_test_flag(hdev, HCI_LE_SCAN)) {
3274 hci_req_add_le_scan_disable(req, false);
3279 /* No further actions needed for LE-only discovery */
3280 if (d->type == DISCOV_TYPE_LE)
3283 if (d->state == DISCOVERY_RESOLVING || d->state == DISCOVERY_STOPPING) {
3284 e = hci_inquiry_cache_lookup_resolve(hdev, BDADDR_ANY,
3289 bacpy(&cp.bdaddr, &e->data.bdaddr);
3290 hci_req_add(req, HCI_OP_REMOTE_NAME_REQ_CANCEL, sizeof(cp),
3298 static int stop_discovery(struct hci_request *req, unsigned long opt)
3300 hci_dev_lock(req->hdev);
3301 hci_req_stop_discovery(req);
3302 hci_dev_unlock(req->hdev);
3307 static void discov_update(struct work_struct *work)
3309 struct hci_dev *hdev = container_of(work, struct hci_dev,
3313 switch (hdev->discovery.state) {
3314 case DISCOVERY_STARTING:
3315 start_discovery(hdev, &status);
3316 mgmt_start_discovery_complete(hdev, status);
3318 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
3320 hci_discovery_set_state(hdev, DISCOVERY_FINDING);
3322 case DISCOVERY_STOPPING:
3323 hci_req_sync(hdev, stop_discovery, 0, HCI_CMD_TIMEOUT, &status);
3324 mgmt_stop_discovery_complete(hdev, status);
3326 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
3328 case DISCOVERY_STOPPED:
3334 static void discov_off(struct work_struct *work)
3336 struct hci_dev *hdev = container_of(work, struct hci_dev,
3339 bt_dev_dbg(hdev, "");
3343 /* When discoverable timeout triggers, then just make sure
3344 * the limited discoverable flag is cleared. Even in the case
3345 * of a timeout triggered from general discoverable, it is
3346 * safe to unconditionally clear the flag.
3348 hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE);
3349 hci_dev_clear_flag(hdev, HCI_DISCOVERABLE);
3350 hdev->discov_timeout = 0;
3352 hci_dev_unlock(hdev);
3354 hci_req_sync(hdev, discoverable_update, 0, HCI_CMD_TIMEOUT, NULL);
3355 mgmt_new_settings(hdev);
3358 static int powered_update_hci(struct hci_request *req, unsigned long opt)
3360 struct hci_dev *hdev = req->hdev;
3365 if (hci_dev_test_flag(hdev, HCI_SSP_ENABLED) &&
3366 !lmp_host_ssp_capable(hdev)) {
3369 hci_req_add(req, HCI_OP_WRITE_SSP_MODE, sizeof(mode), &mode);
3371 if (bredr_sc_enabled(hdev) && !lmp_host_sc_capable(hdev)) {
3374 hci_req_add(req, HCI_OP_WRITE_SC_SUPPORT,
3375 sizeof(support), &support);
3379 if (hci_dev_test_flag(hdev, HCI_LE_ENABLED) &&
3380 lmp_bredr_capable(hdev)) {
3381 struct hci_cp_write_le_host_supported cp;
3386 /* Check first if we already have the right
3387 * host state (host features set)
3389 if (cp.le != lmp_host_le_capable(hdev) ||
3390 cp.simul != lmp_host_le_br_capable(hdev))
3391 hci_req_add(req, HCI_OP_WRITE_LE_HOST_SUPPORTED,
3395 if (hci_dev_test_flag(hdev, HCI_LE_ENABLED)) {
3396 /* Make sure the controller has a good default for
3397 * advertising data. This also applies to the case
3398 * where BR/EDR was toggled during the AUTO_OFF phase.
3400 if (hci_dev_test_flag(hdev, HCI_ADVERTISING) ||
3401 list_empty(&hdev->adv_instances)) {
3404 if (ext_adv_capable(hdev)) {
3405 err = __hci_req_setup_ext_adv_instance(req,
3408 __hci_req_update_scan_rsp_data(req,
3412 __hci_req_update_adv_data(req, 0x00);
3413 __hci_req_update_scan_rsp_data(req, 0x00);
3416 if (hci_dev_test_flag(hdev, HCI_ADVERTISING)) {
3417 if (!ext_adv_capable(hdev))
3418 __hci_req_enable_advertising(req);
3420 __hci_req_enable_ext_advertising(req,
3423 } else if (!list_empty(&hdev->adv_instances)) {
3424 struct adv_info *adv_instance;
3426 adv_instance = list_first_entry(&hdev->adv_instances,
3427 struct adv_info, list);
3428 __hci_req_schedule_adv_instance(req,
3429 adv_instance->instance,
3434 link_sec = hci_dev_test_flag(hdev, HCI_LINK_SECURITY);
3435 if (link_sec != test_bit(HCI_AUTH, &hdev->flags))
3436 hci_req_add(req, HCI_OP_WRITE_AUTH_ENABLE,
3437 sizeof(link_sec), &link_sec);
3439 if (lmp_bredr_capable(hdev)) {
3440 if (hci_dev_test_flag(hdev, HCI_FAST_CONNECTABLE))
3441 __hci_req_write_fast_connectable(req, true);
3443 __hci_req_write_fast_connectable(req, false);
3444 __hci_req_update_scan(req);
3445 __hci_req_update_class(req);
3446 __hci_req_update_name(req);
3447 __hci_req_update_eir(req);
3450 hci_dev_unlock(hdev);
3454 int __hci_req_hci_power_on(struct hci_dev *hdev)
3456 /* Register the available SMP channels (BR/EDR and LE) only when
3457 * successfully powering on the controller. This late
3458 * registration is required so that LE SMP can clearly decide if
3459 * the public address or static address is used.
3463 return __hci_req_sync(hdev, powered_update_hci, 0, HCI_CMD_TIMEOUT,
3467 void hci_request_setup(struct hci_dev *hdev)
3469 INIT_WORK(&hdev->discov_update, discov_update);
3470 INIT_WORK(&hdev->bg_scan_update, bg_scan_update);
3471 INIT_WORK(&hdev->scan_update, scan_update_work);
3472 INIT_WORK(&hdev->connectable_update, connectable_update_work);
3473 INIT_WORK(&hdev->discoverable_update, discoverable_update_work);
3474 INIT_DELAYED_WORK(&hdev->discov_off, discov_off);
3475 INIT_DELAYED_WORK(&hdev->le_scan_disable, le_scan_disable_work);
3476 INIT_DELAYED_WORK(&hdev->le_scan_restart, le_scan_restart_work);
3477 INIT_DELAYED_WORK(&hdev->adv_instance_expire, adv_timeout_expire);
3478 INIT_DELAYED_WORK(&hdev->interleave_scan, interleave_scan_work);
3481 void hci_request_cancel_all(struct hci_dev *hdev)
3483 hci_req_sync_cancel(hdev, ENODEV);
3485 cancel_work_sync(&hdev->discov_update);
3486 cancel_work_sync(&hdev->bg_scan_update);
3487 cancel_work_sync(&hdev->scan_update);
3488 cancel_work_sync(&hdev->connectable_update);
3489 cancel_work_sync(&hdev->discoverable_update);
3490 cancel_delayed_work_sync(&hdev->discov_off);
3491 cancel_delayed_work_sync(&hdev->le_scan_disable);
3492 cancel_delayed_work_sync(&hdev->le_scan_restart);
3494 if (hdev->adv_instance_timeout) {
3495 cancel_delayed_work_sync(&hdev->adv_instance_expire);
3496 hdev->adv_instance_timeout = 0;
3499 cancel_interleave_scan(hdev);