net/bluetooth/hci_request.c

   1 /*
   2    BlueZ - Bluetooth protocol stack for Linux
   3
   4    Copyright (C) 2014 Intel Corporation
   5
   6    This program is free software; you can redistribute it and/or modify
   7    it under the terms of the GNU General Public License version 2 as
   8    published by the Free Software Foundation;
   9
  10    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
  11    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  12    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
  13    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
  14    CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
  15    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  16    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  17    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  18
  19    ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
  20    COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
  21    SOFTWARE IS DISCLAIMED.
  22 */
  23
  24 #include <net/bluetooth/bluetooth.h>
  25 #include <net/bluetooth/hci_core.h>
  26
  27 #include "smp.h"
  28 #include "hci_request.h"
  29
  30 void hci_req_init(struct hci_request *req, struct hci_dev *hdev)
  31 {
  32         skb_queue_head_init(&req->cmd_q);
  33         req->hdev = hdev;
  34         req->err = 0;
  35 }
  36
  37 int hci_req_run(struct hci_request *req, hci_req_complete_t complete)
  38 {
  39         struct hci_dev *hdev = req->hdev;
  40         struct sk_buff *skb;
  41         unsigned long flags;
  42
  43         BT_DBG("length %u", skb_queue_len(&req->cmd_q));
  44
  45         /* If an error occurred during request building, remove all HCI
  46          * commands queued on the HCI request queue.
  47          */
  48         if (req->err) {
  49                 skb_queue_purge(&req->cmd_q);
  50                 return req->err;
  51         }
  52
  53         /* Do not allow empty requests */
  54         if (skb_queue_empty(&req->cmd_q))
  55                 return -ENODATA;
  56
  57         skb = skb_peek_tail(&req->cmd_q);
  58         bt_cb(skb)->req.complete = complete;
  59
  60         spin_lock_irqsave(&hdev->cmd_q.lock, flags);
  61         skb_queue_splice_tail(&req->cmd_q, &hdev->cmd_q);
  62         spin_unlock_irqrestore(&hdev->cmd_q.lock, flags);
  63
  64         queue_work(hdev->workqueue, &hdev->cmd_work);
  65
  66         return 0;
  67 }
  68
  69 struct sk_buff *hci_prepare_cmd(struct hci_dev *hdev, u16 opcode, u32 plen,
  70                                 const void *param)
  71 {
  72         int len = HCI_COMMAND_HDR_SIZE + plen;
  73         struct hci_command_hdr *hdr;
  74         struct sk_buff *skb;
  75
  76         skb = bt_skb_alloc(len, GFP_ATOMIC);
  77         if (!skb)
  78                 return NULL;
  79
  80         hdr = (struct hci_command_hdr *) skb_put(skb, HCI_COMMAND_HDR_SIZE);
  81         hdr->opcode = cpu_to_le16(opcode);
  82         hdr->plen   = plen;
  83
  84         if (plen)
  85                 memcpy(skb_put(skb, plen), param, plen);
  86
  87         BT_DBG("skb len %d", skb->len);
  88
  89         bt_cb(skb)->pkt_type = HCI_COMMAND_PKT;
  90         bt_cb(skb)->opcode = opcode;
  91
  92         return skb;
  93 }
  94
  95 /* Queue a command to an asynchronous HCI request */
  96 void hci_req_add_ev(struct hci_request *req, u16 opcode, u32 plen,
  97                     const void *param, u8 event)
  98 {
  99         struct hci_dev *hdev = req->hdev;
 100         struct sk_buff *skb;
 101
 102         BT_DBG("%s opcode 0x%4.4x plen %d", hdev->name, opcode, plen);
 103
 104         /* If an error occurred during request building, there is no point in
 105          * queueing the HCI command. We can simply return.
 106          */
 107         if (req->err)
 108                 return;
 109
 110         skb = hci_prepare_cmd(hdev, opcode, plen, param);
 111         if (!skb) {
 112                 BT_ERR("%s no memory for command (opcode 0x%4.4x)",
 113                        hdev->name, opcode);
 114                 req->err = -ENOMEM;
 115                 return;
 116         }
 117
 118         if (skb_queue_empty(&req->cmd_q))
 119                 bt_cb(skb)->req.start = true;
 120
 121         bt_cb(skb)->req.event = event;
 122
 123         skb_queue_tail(&req->cmd_q, skb);
 124 }
 125
 126 void hci_req_add(struct hci_request *req, u16 opcode, u32 plen,
 127                  const void *param)
 128 {
 129         hci_req_add_ev(req, opcode, plen, param, 0);
 130 }
 131
 132 void hci_req_add_le_scan_disable(struct hci_request *req)
 133 {
 134         struct hci_cp_le_set_scan_enable cp;
 135
 136         memset(&cp, 0, sizeof(cp));
 137         cp.enable = LE_SCAN_DISABLE;
 138         hci_req_add(req, HCI_OP_LE_SET_SCAN_ENABLE, sizeof(cp), &cp);
 139 }
 140
 141 static void add_to_white_list(struct hci_request *req,
 142                               struct hci_conn_params *params)
 143 {
 144         struct hci_cp_le_add_to_white_list cp;
 145
 146         cp.bdaddr_type = params->addr_type;
 147         bacpy(&cp.bdaddr, &params->addr);
 148
 149         hci_req_add(req, HCI_OP_LE_ADD_TO_WHITE_LIST, sizeof(cp), &cp);
 150 }
 151
 152 static u8 update_white_list(struct hci_request *req)
 153 {
 154         struct hci_dev *hdev = req->hdev;
 155         struct hci_conn_params *params;
 156         struct bdaddr_list *b;
 157         uint8_t white_list_entries = 0;
 158
 159         /* Go through the current white list programmed into the
 160          * controller one by one and check if that address is still
 161          * in the list of pending connections or list of devices to
 162          * report. If not present in either list, then queue the
 163          * command to remove it from the controller.
 164          */
 165         list_for_each_entry(b, &hdev->le_white_list, list) {
 166                 struct hci_cp_le_del_from_white_list cp;
 167
 168                 if (hci_pend_le_action_lookup(&hdev->pend_le_conns,
 169                                               &b->bdaddr, b->bdaddr_type) ||
 170                     hci_pend_le_action_lookup(&hdev->pend_le_reports,
 171                                               &b->bdaddr, b->bdaddr_type)) {
 172                         white_list_entries++;
 173                         continue;
 174                 }
 175
 176                 cp.bdaddr_type = b->bdaddr_type;
 177                 bacpy(&cp.bdaddr, &b->bdaddr);
 178
 179                 hci_req_add(req, HCI_OP_LE_DEL_FROM_WHITE_LIST,
 180                             sizeof(cp), &cp);
 181         }
 182
 183         /* Since all no longer valid white list entries have been
 184          * removed, walk through the list of pending connections
 185          * and ensure that any new device gets programmed into
 186          * the controller.
 187          *
 188          * If the list of the devices is larger than the list of
 189          * available white list entries in the controller, then
 190          * just abort and return filer policy value to not use the
 191          * white list.
 192          */
 193         list_for_each_entry(params, &hdev->pend_le_conns, action) {
 194                 if (hci_bdaddr_list_lookup(&hdev->le_white_list,
 195                                            &params->addr, params->addr_type))
 196                         continue;
 197
 198                 if (white_list_entries >= hdev->le_white_list_size) {
 199                         /* Select filter policy to accept all advertising */
 200                         return 0x00;
 201                 }
 202
 203                 if (hci_find_irk_by_addr(hdev, &params->addr,
 204                                          params->addr_type)) {
 205                         /* White list can not be used with RPAs */
 206                         return 0x00;
 207                 }
 208
 209                 white_list_entries++;
 210                 add_to_white_list(req, params);
 211         }
 212
 213         /* After adding all new pending connections, walk through
 214          * the list of pending reports and also add these to the
 215          * white list if there is still space.
 216          */
 217         list_for_each_entry(params, &hdev->pend_le_reports, action) {
 218                 if (hci_bdaddr_list_lookup(&hdev->le_white_list,
 219                                            &params->addr, params->addr_type))
 220                         continue;
 221
 222                 if (white_list_entries >= hdev->le_white_list_size) {
 223                         /* Select filter policy to accept all advertising */
 224                         return 0x00;
 225                 }
 226
 227                 if (hci_find_irk_by_addr(hdev, &params->addr,
 228                                          params->addr_type)) {
 229                         /* White list can not be used with RPAs */
 230                         return 0x00;
 231                 }
 232
 233                 white_list_entries++;
 234                 add_to_white_list(req, params);
 235         }
 236
 237         /* Select filter policy to use white list */
 238         return 0x01;
 239 }
 240
 241 void hci_req_add_le_passive_scan(struct hci_request *req)
 242 {
 243         struct hci_cp_le_set_scan_param param_cp;
 244         struct hci_cp_le_set_scan_enable enable_cp;
 245         struct hci_dev *hdev = req->hdev;
 246         u8 own_addr_type;
 247         u8 filter_policy;
 248
 249         /* Set require_privacy to false since no SCAN_REQ are send
 250          * during passive scanning. Not using an non-resolvable address
 251          * here is important so that peer devices using direct
 252          * advertising with our address will be correctly reported
 253          * by the controller.
 254          */
 255         if (hci_update_random_address(req, false, &own_addr_type))
 256                 return;
 257
 258         /* Adding or removing entries from the white list must
 259          * happen before enabling scanning. The controller does
 260          * not allow white list modification while scanning.
 261          */
 262         filter_policy = update_white_list(req);
 263
 264         /* When the controller is using random resolvable addresses and
 265          * with that having LE privacy enabled, then controllers with
 266          * Extended Scanner Filter Policies support can now enable support
 267          * for handling directed advertising.
 268          *
 269          * So instead of using filter polices 0x00 (no whitelist)
 270          * and 0x01 (whitelist enabled) use the new filter policies
 271          * 0x02 (no whitelist) and 0x03 (whitelist enabled).
 272          */
 273         if (test_bit(HCI_PRIVACY, &hdev->dev_flags) &&
 274             (hdev->le_features[0] & HCI_LE_EXT_SCAN_POLICY))
 275                 filter_policy |= 0x02;
 276
 277         memset(&param_cp, 0, sizeof(param_cp));
 278         param_cp.type = LE_SCAN_PASSIVE;
 279         param_cp.interval = cpu_to_le16(hdev->le_scan_interval);
 280         param_cp.window = cpu_to_le16(hdev->le_scan_window);
 281         param_cp.own_address_type = own_addr_type;
 282         param_cp.filter_policy = filter_policy;
 283         hci_req_add(req, HCI_OP_LE_SET_SCAN_PARAM, sizeof(param_cp),
 284                     &param_cp);
 285
 286         memset(&enable_cp, 0, sizeof(enable_cp));
 287         enable_cp.enable = LE_SCAN_ENABLE;
 288         enable_cp.filter_dup = LE_SCAN_FILTER_DUP_ENABLE;
 289         hci_req_add(req, HCI_OP_LE_SET_SCAN_ENABLE, sizeof(enable_cp),
 290                     &enable_cp);
 291 }
 292
 293 static void set_random_addr(struct hci_request *req, bdaddr_t *rpa)
 294 {
 295         struct hci_dev *hdev = req->hdev;
 296
 297         /* If we're advertising or initiating an LE connection we can't
 298          * go ahead and change the random address at this time. This is
 299          * because the eventual initiator address used for the
 300          * subsequently created connection will be undefined (some
 301          * controllers use the new address and others the one we had
 302          * when the operation started).
 303          *
 304          * In this kind of scenario skip the update and let the random
 305          * address be updated at the next cycle.
 306          */
 307         if (test_bit(HCI_LE_ADV, &hdev->dev_flags) ||
 308             hci_conn_hash_lookup_state(hdev, LE_LINK, BT_CONNECT)) {
 309                 BT_DBG("Deferring random address update");
 310                 set_bit(HCI_RPA_EXPIRED, &hdev->dev_flags);
 311                 return;
 312         }
 313
 314         hci_req_add(req, HCI_OP_LE_SET_RANDOM_ADDR, 6, rpa);
 315 }
 316
 317 int hci_update_random_address(struct hci_request *req, bool require_privacy,
 318                               u8 *own_addr_type)
 319 {
 320         struct hci_dev *hdev = req->hdev;
 321         int err;
 322
 323         /* If privacy is enabled use a resolvable private address. If
 324          * current RPA has expired or there is something else than
 325          * the current RPA in use, then generate a new one.
 326          */
 327         if (test_bit(HCI_PRIVACY, &hdev->dev_flags)) {
 328                 int to;
 329
 330                 *own_addr_type = ADDR_LE_DEV_RANDOM;
 331
 332                 if (!test_and_clear_bit(HCI_RPA_EXPIRED, &hdev->dev_flags) &&
 333                     !bacmp(&hdev->random_addr, &hdev->rpa))
 334                         return 0;
 335
 336                 err = smp_generate_rpa(hdev, hdev->irk, &hdev->rpa);
 337                 if (err < 0) {
 338                         BT_ERR("%s failed to generate new RPA", hdev->name);
 339                         return err;
 340                 }
 341
 342                 set_random_addr(req, &hdev->rpa);
 343
 344                 to = msecs_to_jiffies(hdev->rpa_timeout * 1000);
 345                 queue_delayed_work(hdev->workqueue, &hdev->rpa_expired, to);
 346
 347                 return 0;
 348         }
 349
 350         /* In case of required privacy without resolvable private address,
 351          * use an non-resolvable private address. This is useful for active
 352          * scanning and non-connectable advertising.
 353          */
 354         if (require_privacy) {
 355                 bdaddr_t nrpa;
 356
 357                 while (true) {
 358                         /* The non-resolvable private address is generated
 359                          * from random six bytes with the two most significant
 360                          * bits cleared.
 361                          */
 362                         get_random_bytes(&nrpa, 6);
 363                         nrpa.b[5] &= 0x3f;
 364
 365                         /* The non-resolvable private address shall not be
 366                          * equal to the public address.
 367                          */
 368                         if (bacmp(&hdev->bdaddr, &nrpa))
 369                                 break;
 370                 }
 371
 372                 *own_addr_type = ADDR_LE_DEV_RANDOM;
 373                 set_random_addr(req, &nrpa);
 374                 return 0;
 375         }
 376
 377         /* If forcing static address is in use or there is no public
 378          * address use the static address as random address (but skip
 379          * the HCI command if the current random address is already the
 380          * static one.
 381          *
 382          * In case BR/EDR has been disabled on a dual-mode controller
 383          * and a static address has been configured, then use that
 384          * address instead of the public BR/EDR address.
 385          */
 386         if (test_bit(HCI_FORCE_STATIC_ADDR, &hdev->dbg_flags) ||
 387             !bacmp(&hdev->bdaddr, BDADDR_ANY) ||
 388             (!test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags) &&
 389              bacmp(&hdev->static_addr, BDADDR_ANY))) {
 390                 *own_addr_type = ADDR_LE_DEV_RANDOM;
 391                 if (bacmp(&hdev->static_addr, &hdev->random_addr))
 392                         hci_req_add(req, HCI_OP_LE_SET_RANDOM_ADDR, 6,
 393                                     &hdev->static_addr);
 394                 return 0;
 395         }
 396
 397         /* Neither privacy nor static address is being used so use a
 398          * public address.
 399          */
 400         *own_addr_type = ADDR_LE_DEV_PUBLIC;
 401
 402         return 0;
 403 }
 404
 405 static bool disconnected_whitelist_entries(struct hci_dev *hdev)
 406 {
 407         struct bdaddr_list *b;
 408
 409         list_for_each_entry(b, &hdev->whitelist, list) {
 410                 struct hci_conn *conn;
 411
 412                 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &b->bdaddr);
 413                 if (!conn)
 414                         return true;
 415
 416                 if (conn->state != BT_CONNECTED && conn->state != BT_CONFIG)
 417                         return true;
 418         }
 419
 420         return false;
 421 }
 422
 423 void __hci_update_page_scan(struct hci_request *req)
 424 {
 425         struct hci_dev *hdev = req->hdev;
 426         u8 scan;
 427
 428         if (!test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
 429                 return;
 430
 431         if (!hdev_is_powered(hdev))
 432                 return;
 433
 434         if (mgmt_powering_down(hdev))
 435                 return;
 436
 437         if (test_bit(HCI_CONNECTABLE, &hdev->dev_flags) ||
 438             disconnected_whitelist_entries(hdev))
 439                 scan = SCAN_PAGE;
 440         else
 441                 scan = SCAN_DISABLED;
 442
 443         if (test_bit(HCI_PSCAN, &hdev->flags) == !!(scan & SCAN_PAGE))
 444                 return;
 445
 446         if (test_bit(HCI_DISCOVERABLE, &hdev->dev_flags))
 447                 scan |= SCAN_INQUIRY;
 448
 449         hci_req_add(req, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
 450 }
 451
 452 void hci_update_page_scan(struct hci_dev *hdev)
 453 {
 454         struct hci_request req;
 455
 456         hci_req_init(&req, hdev);
 457         __hci_update_page_scan(&req);
 458         hci_req_run(&req, NULL);
 459 }
 460
 461 /* This function controls the background scanning based on hdev->pend_le_conns
 462  * list. If there are pending LE connection we start the background scanning,
 463  * otherwise we stop it.
 464  *
 465  * This function requires the caller holds hdev->lock.
 466  */
 467 void __hci_update_background_scan(struct hci_request *req)
 468 {
 469         struct hci_dev *hdev = req->hdev;
 470         struct hci_conn *conn;
 471
 472         if (!test_bit(HCI_UP, &hdev->flags) ||
 473             test_bit(HCI_INIT, &hdev->flags) ||
 474             test_bit(HCI_SETUP, &hdev->dev_flags) ||
 475             test_bit(HCI_CONFIG, &hdev->dev_flags) ||
 476             test_bit(HCI_AUTO_OFF, &hdev->dev_flags) ||
 477             test_bit(HCI_UNREGISTER, &hdev->dev_flags))
 478                 return;
 479
 480         /* No point in doing scanning if LE support hasn't been enabled */
 481         if (!test_bit(HCI_LE_ENABLED, &hdev->dev_flags))
 482                 return;
 483
 484         /* If discovery is active don't interfere with it */
 485         if (hdev->discovery.state != DISCOVERY_STOPPED)
 486                 return;
 487
 488         /* Reset RSSI and UUID filters when starting background scanning
 489          * since these filters are meant for service discovery only.
 490          *
 491          * The Start Discovery and Start Service Discovery operations
 492          * ensure to set proper values for RSSI threshold and UUID
 493          * filter list. So it is safe to just reset them here.
 494          */
 495         hci_discovery_filter_clear(hdev);
 496
 497         if (list_empty(&hdev->pend_le_conns) &&
 498             list_empty(&hdev->pend_le_reports)) {
 499                 /* If there is no pending LE connections or devices
 500                  * to be scanned for, we should stop the background
 501                  * scanning.
 502                  */
 503
 504                 /* If controller is not scanning we are done. */
 505                 if (!test_bit(HCI_LE_SCAN, &hdev->dev_flags))
 506                         return;
 507
 508                 hci_req_add_le_scan_disable(req);
 509
 510                 BT_DBG("%s stopping background scanning", hdev->name);
 511         } else {
 512                 /* If there is at least one pending LE connection, we should
 513                  * keep the background scan running.
 514                  */
 515
 516                 /* If controller is connecting, we should not start scanning
 517                  * since some controllers are not able to scan and connect at
 518                  * the same time.
 519                  */
 520                 conn = hci_conn_hash_lookup_state(hdev, LE_LINK, BT_CONNECT);
 521                 if (conn)
 522                         return;
 523
 524                 /* If controller is currently scanning, we stop it to ensure we
 525                  * don't miss any advertising (due to duplicates filter).
 526                  */
 527                 if (test_bit(HCI_LE_SCAN, &hdev->dev_flags))
 528                         hci_req_add_le_scan_disable(req);
 529
 530                 hci_req_add_le_passive_scan(req);
 531
 532                 BT_DBG("%s starting background scanning", hdev->name);
 533         }
 534 }
 535
 536 static void update_background_scan_complete(struct hci_dev *hdev, u8 status,
 537                                             u16 opcode)
 538 {
 539         if (status)
 540                 BT_DBG("HCI request failed to update background scanning: "
 541                        "status 0x%2.2x", status);
 542 }
 543
 544 void hci_update_background_scan(struct hci_dev *hdev)
 545 {
 546         int err;
 547         struct hci_request req;
 548
 549         hci_req_init(&req, hdev);
 550
 551         __hci_update_background_scan(&req);
 552
 553         err = hci_req_run(&req, update_background_scan_complete);
 554         if (err && err != -ENODATA)
 555                 BT_ERR("Failed to run HCI request: err %d", err);
 556 }