Commit | Line | Data |
---|---|---|
0857dd3b JH |
1 | /* |
2 | BlueZ - Bluetooth protocol stack for Linux | |
3 | ||
4 | Copyright (C) 2014 Intel Corporation | |
5 | ||
6 | This program is free software; you can redistribute it and/or modify | |
7 | it under the terms of the GNU General Public License version 2 as | |
8 | published by the Free Software Foundation; | |
9 | ||
10 | THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS | |
11 | OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, | |
12 | FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS. | |
13 | IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY | |
14 | CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES | |
15 | WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN | |
16 | ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF | |
17 | OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. | |
18 | ||
19 | ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS, | |
20 | COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS | |
21 | SOFTWARE IS DISCLAIMED. | |
22 | */ | |
23 | ||
24 | #include <net/bluetooth/bluetooth.h> | |
25 | #include <net/bluetooth/hci_core.h> | |
26 | ||
27 | #include "smp.h" | |
28 | #include "hci_request.h" | |
29 | ||
30 | void hci_req_init(struct hci_request *req, struct hci_dev *hdev) | |
31 | { | |
32 | skb_queue_head_init(&req->cmd_q); | |
33 | req->hdev = hdev; | |
34 | req->err = 0; | |
35 | } | |
36 | ||
37 | int hci_req_run(struct hci_request *req, hci_req_complete_t complete) | |
38 | { | |
39 | struct hci_dev *hdev = req->hdev; | |
40 | struct sk_buff *skb; | |
41 | unsigned long flags; | |
42 | ||
43 | BT_DBG("length %u", skb_queue_len(&req->cmd_q)); | |
44 | ||
45 | /* If an error occurred during request building, remove all HCI | |
46 | * commands queued on the HCI request queue. | |
47 | */ | |
48 | if (req->err) { | |
49 | skb_queue_purge(&req->cmd_q); | |
50 | return req->err; | |
51 | } | |
52 | ||
53 | /* Do not allow empty requests */ | |
54 | if (skb_queue_empty(&req->cmd_q)) | |
55 | return -ENODATA; | |
56 | ||
57 | skb = skb_peek_tail(&req->cmd_q); | |
58 | bt_cb(skb)->req.complete = complete; | |
59 | ||
60 | spin_lock_irqsave(&hdev->cmd_q.lock, flags); | |
61 | skb_queue_splice_tail(&req->cmd_q, &hdev->cmd_q); | |
62 | spin_unlock_irqrestore(&hdev->cmd_q.lock, flags); | |
63 | ||
64 | queue_work(hdev->workqueue, &hdev->cmd_work); | |
65 | ||
66 | return 0; | |
67 | } | |
68 | ||
69 | struct sk_buff *hci_prepare_cmd(struct hci_dev *hdev, u16 opcode, u32 plen, | |
70 | const void *param) | |
71 | { | |
72 | int len = HCI_COMMAND_HDR_SIZE + plen; | |
73 | struct hci_command_hdr *hdr; | |
74 | struct sk_buff *skb; | |
75 | ||
76 | skb = bt_skb_alloc(len, GFP_ATOMIC); | |
77 | if (!skb) | |
78 | return NULL; | |
79 | ||
80 | hdr = (struct hci_command_hdr *) skb_put(skb, HCI_COMMAND_HDR_SIZE); | |
81 | hdr->opcode = cpu_to_le16(opcode); | |
82 | hdr->plen = plen; | |
83 | ||
84 | if (plen) | |
85 | memcpy(skb_put(skb, plen), param, plen); | |
86 | ||
87 | BT_DBG("skb len %d", skb->len); | |
88 | ||
89 | bt_cb(skb)->pkt_type = HCI_COMMAND_PKT; | |
90 | bt_cb(skb)->opcode = opcode; | |
91 | ||
92 | return skb; | |
93 | } | |
94 | ||
95 | /* Queue a command to an asynchronous HCI request */ | |
96 | void hci_req_add_ev(struct hci_request *req, u16 opcode, u32 plen, | |
97 | const void *param, u8 event) | |
98 | { | |
99 | struct hci_dev *hdev = req->hdev; | |
100 | struct sk_buff *skb; | |
101 | ||
102 | BT_DBG("%s opcode 0x%4.4x plen %d", hdev->name, opcode, plen); | |
103 | ||
104 | /* If an error occurred during request building, there is no point in | |
105 | * queueing the HCI command. We can simply return. | |
106 | */ | |
107 | if (req->err) | |
108 | return; | |
109 | ||
110 | skb = hci_prepare_cmd(hdev, opcode, plen, param); | |
111 | if (!skb) { | |
112 | BT_ERR("%s no memory for command (opcode 0x%4.4x)", | |
113 | hdev->name, opcode); | |
114 | req->err = -ENOMEM; | |
115 | return; | |
116 | } | |
117 | ||
118 | if (skb_queue_empty(&req->cmd_q)) | |
119 | bt_cb(skb)->req.start = true; | |
120 | ||
121 | bt_cb(skb)->req.event = event; | |
122 | ||
123 | skb_queue_tail(&req->cmd_q, skb); | |
124 | } | |
125 | ||
126 | void hci_req_add(struct hci_request *req, u16 opcode, u32 plen, | |
127 | const void *param) | |
128 | { | |
129 | hci_req_add_ev(req, opcode, plen, param, 0); | |
130 | } | |
131 | ||
132 | void hci_req_add_le_scan_disable(struct hci_request *req) | |
133 | { | |
134 | struct hci_cp_le_set_scan_enable cp; | |
135 | ||
136 | memset(&cp, 0, sizeof(cp)); | |
137 | cp.enable = LE_SCAN_DISABLE; | |
138 | hci_req_add(req, HCI_OP_LE_SET_SCAN_ENABLE, sizeof(cp), &cp); | |
139 | } | |
140 | ||
141 | static void add_to_white_list(struct hci_request *req, | |
142 | struct hci_conn_params *params) | |
143 | { | |
144 | struct hci_cp_le_add_to_white_list cp; | |
145 | ||
146 | cp.bdaddr_type = params->addr_type; | |
147 | bacpy(&cp.bdaddr, ¶ms->addr); | |
148 | ||
149 | hci_req_add(req, HCI_OP_LE_ADD_TO_WHITE_LIST, sizeof(cp), &cp); | |
150 | } | |
151 | ||
152 | static u8 update_white_list(struct hci_request *req) | |
153 | { | |
154 | struct hci_dev *hdev = req->hdev; | |
155 | struct hci_conn_params *params; | |
156 | struct bdaddr_list *b; | |
157 | uint8_t white_list_entries = 0; | |
158 | ||
159 | /* Go through the current white list programmed into the | |
160 | * controller one by one and check if that address is still | |
161 | * in the list of pending connections or list of devices to | |
162 | * report. If not present in either list, then queue the | |
163 | * command to remove it from the controller. | |
164 | */ | |
165 | list_for_each_entry(b, &hdev->le_white_list, list) { | |
166 | struct hci_cp_le_del_from_white_list cp; | |
167 | ||
168 | if (hci_pend_le_action_lookup(&hdev->pend_le_conns, | |
169 | &b->bdaddr, b->bdaddr_type) || | |
170 | hci_pend_le_action_lookup(&hdev->pend_le_reports, | |
171 | &b->bdaddr, b->bdaddr_type)) { | |
172 | white_list_entries++; | |
173 | continue; | |
174 | } | |
175 | ||
176 | cp.bdaddr_type = b->bdaddr_type; | |
177 | bacpy(&cp.bdaddr, &b->bdaddr); | |
178 | ||
179 | hci_req_add(req, HCI_OP_LE_DEL_FROM_WHITE_LIST, | |
180 | sizeof(cp), &cp); | |
181 | } | |
182 | ||
183 | /* Since all no longer valid white list entries have been | |
184 | * removed, walk through the list of pending connections | |
185 | * and ensure that any new device gets programmed into | |
186 | * the controller. | |
187 | * | |
188 | * If the list of the devices is larger than the list of | |
189 | * available white list entries in the controller, then | |
190 | * just abort and return filer policy value to not use the | |
191 | * white list. | |
192 | */ | |
193 | list_for_each_entry(params, &hdev->pend_le_conns, action) { | |
194 | if (hci_bdaddr_list_lookup(&hdev->le_white_list, | |
195 | ¶ms->addr, params->addr_type)) | |
196 | continue; | |
197 | ||
198 | if (white_list_entries >= hdev->le_white_list_size) { | |
199 | /* Select filter policy to accept all advertising */ | |
200 | return 0x00; | |
201 | } | |
202 | ||
203 | if (hci_find_irk_by_addr(hdev, ¶ms->addr, | |
204 | params->addr_type)) { | |
205 | /* White list can not be used with RPAs */ | |
206 | return 0x00; | |
207 | } | |
208 | ||
209 | white_list_entries++; | |
210 | add_to_white_list(req, params); | |
211 | } | |
212 | ||
213 | /* After adding all new pending connections, walk through | |
214 | * the list of pending reports and also add these to the | |
215 | * white list if there is still space. | |
216 | */ | |
217 | list_for_each_entry(params, &hdev->pend_le_reports, action) { | |
218 | if (hci_bdaddr_list_lookup(&hdev->le_white_list, | |
219 | ¶ms->addr, params->addr_type)) | |
220 | continue; | |
221 | ||
222 | if (white_list_entries >= hdev->le_white_list_size) { | |
223 | /* Select filter policy to accept all advertising */ | |
224 | return 0x00; | |
225 | } | |
226 | ||
227 | if (hci_find_irk_by_addr(hdev, ¶ms->addr, | |
228 | params->addr_type)) { | |
229 | /* White list can not be used with RPAs */ | |
230 | return 0x00; | |
231 | } | |
232 | ||
233 | white_list_entries++; | |
234 | add_to_white_list(req, params); | |
235 | } | |
236 | ||
237 | /* Select filter policy to use white list */ | |
238 | return 0x01; | |
239 | } | |
240 | ||
241 | void hci_req_add_le_passive_scan(struct hci_request *req) | |
242 | { | |
243 | struct hci_cp_le_set_scan_param param_cp; | |
244 | struct hci_cp_le_set_scan_enable enable_cp; | |
245 | struct hci_dev *hdev = req->hdev; | |
246 | u8 own_addr_type; | |
247 | u8 filter_policy; | |
248 | ||
249 | /* Set require_privacy to false since no SCAN_REQ are send | |
250 | * during passive scanning. Not using an non-resolvable address | |
251 | * here is important so that peer devices using direct | |
252 | * advertising with our address will be correctly reported | |
253 | * by the controller. | |
254 | */ | |
255 | if (hci_update_random_address(req, false, &own_addr_type)) | |
256 | return; | |
257 | ||
258 | /* Adding or removing entries from the white list must | |
259 | * happen before enabling scanning. The controller does | |
260 | * not allow white list modification while scanning. | |
261 | */ | |
262 | filter_policy = update_white_list(req); | |
263 | ||
264 | /* When the controller is using random resolvable addresses and | |
265 | * with that having LE privacy enabled, then controllers with | |
266 | * Extended Scanner Filter Policies support can now enable support | |
267 | * for handling directed advertising. | |
268 | * | |
269 | * So instead of using filter polices 0x00 (no whitelist) | |
270 | * and 0x01 (whitelist enabled) use the new filter policies | |
271 | * 0x02 (no whitelist) and 0x03 (whitelist enabled). | |
272 | */ | |
273 | if (test_bit(HCI_PRIVACY, &hdev->dev_flags) && | |
274 | (hdev->le_features[0] & HCI_LE_EXT_SCAN_POLICY)) | |
275 | filter_policy |= 0x02; | |
276 | ||
277 | memset(¶m_cp, 0, sizeof(param_cp)); | |
278 | param_cp.type = LE_SCAN_PASSIVE; | |
279 | param_cp.interval = cpu_to_le16(hdev->le_scan_interval); | |
280 | param_cp.window = cpu_to_le16(hdev->le_scan_window); | |
281 | param_cp.own_address_type = own_addr_type; | |
282 | param_cp.filter_policy = filter_policy; | |
283 | hci_req_add(req, HCI_OP_LE_SET_SCAN_PARAM, sizeof(param_cp), | |
284 | ¶m_cp); | |
285 | ||
286 | memset(&enable_cp, 0, sizeof(enable_cp)); | |
287 | enable_cp.enable = LE_SCAN_ENABLE; | |
288 | enable_cp.filter_dup = LE_SCAN_FILTER_DUP_ENABLE; | |
289 | hci_req_add(req, HCI_OP_LE_SET_SCAN_ENABLE, sizeof(enable_cp), | |
290 | &enable_cp); | |
291 | } | |
292 | ||
293 | static void set_random_addr(struct hci_request *req, bdaddr_t *rpa) | |
294 | { | |
295 | struct hci_dev *hdev = req->hdev; | |
296 | ||
297 | /* If we're advertising or initiating an LE connection we can't | |
298 | * go ahead and change the random address at this time. This is | |
299 | * because the eventual initiator address used for the | |
300 | * subsequently created connection will be undefined (some | |
301 | * controllers use the new address and others the one we had | |
302 | * when the operation started). | |
303 | * | |
304 | * In this kind of scenario skip the update and let the random | |
305 | * address be updated at the next cycle. | |
306 | */ | |
307 | if (test_bit(HCI_LE_ADV, &hdev->dev_flags) || | |
308 | hci_conn_hash_lookup_state(hdev, LE_LINK, BT_CONNECT)) { | |
309 | BT_DBG("Deferring random address update"); | |
310 | set_bit(HCI_RPA_EXPIRED, &hdev->dev_flags); | |
311 | return; | |
312 | } | |
313 | ||
314 | hci_req_add(req, HCI_OP_LE_SET_RANDOM_ADDR, 6, rpa); | |
315 | } | |
316 | ||
317 | int hci_update_random_address(struct hci_request *req, bool require_privacy, | |
318 | u8 *own_addr_type) | |
319 | { | |
320 | struct hci_dev *hdev = req->hdev; | |
321 | int err; | |
322 | ||
323 | /* If privacy is enabled use a resolvable private address. If | |
324 | * current RPA has expired or there is something else than | |
325 | * the current RPA in use, then generate a new one. | |
326 | */ | |
327 | if (test_bit(HCI_PRIVACY, &hdev->dev_flags)) { | |
328 | int to; | |
329 | ||
330 | *own_addr_type = ADDR_LE_DEV_RANDOM; | |
331 | ||
332 | if (!test_and_clear_bit(HCI_RPA_EXPIRED, &hdev->dev_flags) && | |
333 | !bacmp(&hdev->random_addr, &hdev->rpa)) | |
334 | return 0; | |
335 | ||
336 | err = smp_generate_rpa(hdev, hdev->irk, &hdev->rpa); | |
337 | if (err < 0) { | |
338 | BT_ERR("%s failed to generate new RPA", hdev->name); | |
339 | return err; | |
340 | } | |
341 | ||
342 | set_random_addr(req, &hdev->rpa); | |
343 | ||
344 | to = msecs_to_jiffies(hdev->rpa_timeout * 1000); | |
345 | queue_delayed_work(hdev->workqueue, &hdev->rpa_expired, to); | |
346 | ||
347 | return 0; | |
348 | } | |
349 | ||
350 | /* In case of required privacy without resolvable private address, | |
351 | * use an non-resolvable private address. This is useful for active | |
352 | * scanning and non-connectable advertising. | |
353 | */ | |
354 | if (require_privacy) { | |
355 | bdaddr_t nrpa; | |
356 | ||
357 | while (true) { | |
358 | /* The non-resolvable private address is generated | |
359 | * from random six bytes with the two most significant | |
360 | * bits cleared. | |
361 | */ | |
362 | get_random_bytes(&nrpa, 6); | |
363 | nrpa.b[5] &= 0x3f; | |
364 | ||
365 | /* The non-resolvable private address shall not be | |
366 | * equal to the public address. | |
367 | */ | |
368 | if (bacmp(&hdev->bdaddr, &nrpa)) | |
369 | break; | |
370 | } | |
371 | ||
372 | *own_addr_type = ADDR_LE_DEV_RANDOM; | |
373 | set_random_addr(req, &nrpa); | |
374 | return 0; | |
375 | } | |
376 | ||
377 | /* If forcing static address is in use or there is no public | |
378 | * address use the static address as random address (but skip | |
379 | * the HCI command if the current random address is already the | |
380 | * static one. | |
381 | */ | |
382 | if (test_bit(HCI_FORCE_STATIC_ADDR, &hdev->dbg_flags) || | |
383 | !bacmp(&hdev->bdaddr, BDADDR_ANY)) { | |
384 | *own_addr_type = ADDR_LE_DEV_RANDOM; | |
385 | if (bacmp(&hdev->static_addr, &hdev->random_addr)) | |
386 | hci_req_add(req, HCI_OP_LE_SET_RANDOM_ADDR, 6, | |
387 | &hdev->static_addr); | |
388 | return 0; | |
389 | } | |
390 | ||
391 | /* Neither privacy nor static address is being used so use a | |
392 | * public address. | |
393 | */ | |
394 | *own_addr_type = ADDR_LE_DEV_PUBLIC; | |
395 | ||
396 | return 0; | |
397 | } | |
2cf22218 | 398 | |
405a2611 JH |
399 | static bool disconnected_whitelist_entries(struct hci_dev *hdev) |
400 | { | |
401 | struct bdaddr_list *b; | |
402 | ||
403 | list_for_each_entry(b, &hdev->whitelist, list) { | |
404 | struct hci_conn *conn; | |
405 | ||
406 | conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &b->bdaddr); | |
407 | if (!conn) | |
408 | return true; | |
409 | ||
410 | if (conn->state != BT_CONNECTED && conn->state != BT_CONFIG) | |
411 | return true; | |
412 | } | |
413 | ||
414 | return false; | |
415 | } | |
416 | ||
417 | void __hci_update_page_scan(struct hci_request *req) | |
418 | { | |
419 | struct hci_dev *hdev = req->hdev; | |
420 | u8 scan; | |
421 | ||
422 | if (!test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags)) | |
423 | return; | |
424 | ||
425 | if (!hdev_is_powered(hdev)) | |
426 | return; | |
427 | ||
428 | if (mgmt_powering_down(hdev)) | |
429 | return; | |
430 | ||
431 | if (test_bit(HCI_CONNECTABLE, &hdev->dev_flags) || | |
432 | disconnected_whitelist_entries(hdev)) | |
433 | scan = SCAN_PAGE; | |
434 | else | |
435 | scan = SCAN_DISABLED; | |
436 | ||
437 | if (test_bit(HCI_PSCAN, &hdev->flags) == !!(scan & SCAN_PAGE)) | |
438 | return; | |
439 | ||
440 | if (test_bit(HCI_DISCOVERABLE, &hdev->dev_flags)) | |
441 | scan |= SCAN_INQUIRY; | |
442 | ||
443 | hci_req_add(req, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan); | |
444 | } | |
445 | ||
446 | void hci_update_page_scan(struct hci_dev *hdev) | |
447 | { | |
448 | struct hci_request req; | |
449 | ||
450 | hci_req_init(&req, hdev); | |
451 | __hci_update_page_scan(&req); | |
452 | hci_req_run(&req, NULL); | |
453 | } | |
454 | ||
2cf22218 JH |
455 | /* This function controls the background scanning based on hdev->pend_le_conns |
456 | * list. If there are pending LE connection we start the background scanning, | |
457 | * otherwise we stop it. | |
458 | * | |
459 | * This function requires the caller holds hdev->lock. | |
460 | */ | |
461 | void __hci_update_background_scan(struct hci_request *req) | |
462 | { | |
463 | struct hci_dev *hdev = req->hdev; | |
464 | struct hci_conn *conn; | |
465 | ||
466 | if (!test_bit(HCI_UP, &hdev->flags) || | |
467 | test_bit(HCI_INIT, &hdev->flags) || | |
468 | test_bit(HCI_SETUP, &hdev->dev_flags) || | |
469 | test_bit(HCI_CONFIG, &hdev->dev_flags) || | |
470 | test_bit(HCI_AUTO_OFF, &hdev->dev_flags) || | |
471 | test_bit(HCI_UNREGISTER, &hdev->dev_flags)) | |
472 | return; | |
473 | ||
474 | /* No point in doing scanning if LE support hasn't been enabled */ | |
475 | if (!test_bit(HCI_LE_ENABLED, &hdev->dev_flags)) | |
476 | return; | |
477 | ||
478 | /* If discovery is active don't interfere with it */ | |
479 | if (hdev->discovery.state != DISCOVERY_STOPPED) | |
480 | return; | |
481 | ||
482 | /* Reset RSSI and UUID filters when starting background scanning | |
483 | * since these filters are meant for service discovery only. | |
484 | * | |
485 | * The Start Discovery and Start Service Discovery operations | |
486 | * ensure to set proper values for RSSI threshold and UUID | |
487 | * filter list. So it is safe to just reset them here. | |
488 | */ | |
489 | hci_discovery_filter_clear(hdev); | |
490 | ||
491 | if (list_empty(&hdev->pend_le_conns) && | |
492 | list_empty(&hdev->pend_le_reports)) { | |
493 | /* If there is no pending LE connections or devices | |
494 | * to be scanned for, we should stop the background | |
495 | * scanning. | |
496 | */ | |
497 | ||
498 | /* If controller is not scanning we are done. */ | |
499 | if (!test_bit(HCI_LE_SCAN, &hdev->dev_flags)) | |
500 | return; | |
501 | ||
502 | hci_req_add_le_scan_disable(req); | |
503 | ||
504 | BT_DBG("%s stopping background scanning", hdev->name); | |
505 | } else { | |
506 | /* If there is at least one pending LE connection, we should | |
507 | * keep the background scan running. | |
508 | */ | |
509 | ||
510 | /* If controller is connecting, we should not start scanning | |
511 | * since some controllers are not able to scan and connect at | |
512 | * the same time. | |
513 | */ | |
514 | conn = hci_conn_hash_lookup_state(hdev, LE_LINK, BT_CONNECT); | |
515 | if (conn) | |
516 | return; | |
517 | ||
518 | /* If controller is currently scanning, we stop it to ensure we | |
519 | * don't miss any advertising (due to duplicates filter). | |
520 | */ | |
521 | if (test_bit(HCI_LE_SCAN, &hdev->dev_flags)) | |
522 | hci_req_add_le_scan_disable(req); | |
523 | ||
524 | hci_req_add_le_passive_scan(req); | |
525 | ||
526 | BT_DBG("%s starting background scanning", hdev->name); | |
527 | } | |
528 | } | |
529 | ||
530 | static void update_background_scan_complete(struct hci_dev *hdev, u8 status) | |
531 | { | |
532 | if (status) | |
533 | BT_DBG("HCI request failed to update background scanning: " | |
534 | "status 0x%2.2x", status); | |
535 | } | |
536 | ||
537 | void hci_update_background_scan(struct hci_dev *hdev) | |
538 | { | |
539 | int err; | |
540 | struct hci_request req; | |
541 | ||
542 | hci_req_init(&req, hdev); | |
543 | ||
544 | __hci_update_background_scan(&req); | |
545 | ||
546 | err = hci_req_run(&req, update_background_scan_complete); | |
547 | if (err && err != -ENODATA) | |
548 | BT_ERR("Failed to run HCI request: err %d", err); | |
549 | } |