xref: /openbmc/linux/net/bluetooth/hci_request.c (revision d7a3d85e)
1 /*
2    BlueZ - Bluetooth protocol stack for Linux
3 
4    Copyright (C) 2014 Intel Corporation
5 
6    This program is free software; you can redistribute it and/or modify
7    it under the terms of the GNU General Public License version 2 as
8    published by the Free Software Foundation;
9 
10    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
11    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
12    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
13    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
14    CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
15    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
16    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
17    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
18 
19    ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
20    COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
21    SOFTWARE IS DISCLAIMED.
22 */
23 
24 #include <net/bluetooth/bluetooth.h>
25 #include <net/bluetooth/hci_core.h>
26 
27 #include "smp.h"
28 #include "hci_request.h"
29 
30 void hci_req_init(struct hci_request *req, struct hci_dev *hdev)
31 {
32 	skb_queue_head_init(&req->cmd_q);
33 	req->hdev = hdev;
34 	req->err = 0;
35 }
36 
37 static int req_run(struct hci_request *req, hci_req_complete_t complete,
38 		   hci_req_complete_skb_t complete_skb)
39 {
40 	struct hci_dev *hdev = req->hdev;
41 	struct sk_buff *skb;
42 	unsigned long flags;
43 
44 	BT_DBG("length %u", skb_queue_len(&req->cmd_q));
45 
46 	/* If an error occurred during request building, remove all HCI
47 	 * commands queued on the HCI request queue.
48 	 */
49 	if (req->err) {
50 		skb_queue_purge(&req->cmd_q);
51 		return req->err;
52 	}
53 
54 	/* Do not allow empty requests */
55 	if (skb_queue_empty(&req->cmd_q))
56 		return -ENODATA;
57 
58 	skb = skb_peek_tail(&req->cmd_q);
59 	bt_cb(skb)->req.complete = complete;
60 	bt_cb(skb)->req.complete_skb = complete_skb;
61 
62 	spin_lock_irqsave(&hdev->cmd_q.lock, flags);
63 	skb_queue_splice_tail(&req->cmd_q, &hdev->cmd_q);
64 	spin_unlock_irqrestore(&hdev->cmd_q.lock, flags);
65 
66 	queue_work(hdev->workqueue, &hdev->cmd_work);
67 
68 	return 0;
69 }
70 
71 int hci_req_run(struct hci_request *req, hci_req_complete_t complete)
72 {
73 	return req_run(req, complete, NULL);
74 }
75 
76 int hci_req_run_skb(struct hci_request *req, hci_req_complete_skb_t complete)
77 {
78 	return req_run(req, NULL, complete);
79 }
80 
81 struct sk_buff *hci_prepare_cmd(struct hci_dev *hdev, u16 opcode, u32 plen,
82 				const void *param)
83 {
84 	int len = HCI_COMMAND_HDR_SIZE + plen;
85 	struct hci_command_hdr *hdr;
86 	struct sk_buff *skb;
87 
88 	skb = bt_skb_alloc(len, GFP_ATOMIC);
89 	if (!skb)
90 		return NULL;
91 
92 	hdr = (struct hci_command_hdr *) skb_put(skb, HCI_COMMAND_HDR_SIZE);
93 	hdr->opcode = cpu_to_le16(opcode);
94 	hdr->plen   = plen;
95 
96 	if (plen)
97 		memcpy(skb_put(skb, plen), param, plen);
98 
99 	BT_DBG("skb len %d", skb->len);
100 
101 	bt_cb(skb)->pkt_type = HCI_COMMAND_PKT;
102 	bt_cb(skb)->opcode = opcode;
103 
104 	return skb;
105 }
106 
107 /* Queue a command to an asynchronous HCI request */
108 void hci_req_add_ev(struct hci_request *req, u16 opcode, u32 plen,
109 		    const void *param, u8 event)
110 {
111 	struct hci_dev *hdev = req->hdev;
112 	struct sk_buff *skb;
113 
114 	BT_DBG("%s opcode 0x%4.4x plen %d", hdev->name, opcode, plen);
115 
116 	/* If an error occurred during request building, there is no point in
117 	 * queueing the HCI command. We can simply return.
118 	 */
119 	if (req->err)
120 		return;
121 
122 	skb = hci_prepare_cmd(hdev, opcode, plen, param);
123 	if (!skb) {
124 		BT_ERR("%s no memory for command (opcode 0x%4.4x)",
125 		       hdev->name, opcode);
126 		req->err = -ENOMEM;
127 		return;
128 	}
129 
130 	if (skb_queue_empty(&req->cmd_q))
131 		bt_cb(skb)->req.start = true;
132 
133 	bt_cb(skb)->req.event = event;
134 
135 	skb_queue_tail(&req->cmd_q, skb);
136 }
137 
138 void hci_req_add(struct hci_request *req, u16 opcode, u32 plen,
139 		 const void *param)
140 {
141 	hci_req_add_ev(req, opcode, plen, param, 0);
142 }
143 
144 void hci_req_add_le_scan_disable(struct hci_request *req)
145 {
146 	struct hci_cp_le_set_scan_enable cp;
147 
148 	memset(&cp, 0, sizeof(cp));
149 	cp.enable = LE_SCAN_DISABLE;
150 	hci_req_add(req, HCI_OP_LE_SET_SCAN_ENABLE, sizeof(cp), &cp);
151 }
152 
153 static void add_to_white_list(struct hci_request *req,
154 			      struct hci_conn_params *params)
155 {
156 	struct hci_cp_le_add_to_white_list cp;
157 
158 	cp.bdaddr_type = params->addr_type;
159 	bacpy(&cp.bdaddr, &params->addr);
160 
161 	hci_req_add(req, HCI_OP_LE_ADD_TO_WHITE_LIST, sizeof(cp), &cp);
162 }
163 
164 static u8 update_white_list(struct hci_request *req)
165 {
166 	struct hci_dev *hdev = req->hdev;
167 	struct hci_conn_params *params;
168 	struct bdaddr_list *b;
169 	uint8_t white_list_entries = 0;
170 
171 	/* Go through the current white list programmed into the
172 	 * controller one by one and check if that address is still
173 	 * in the list of pending connections or list of devices to
174 	 * report. If not present in either list, then queue the
175 	 * command to remove it from the controller.
176 	 */
177 	list_for_each_entry(b, &hdev->le_white_list, list) {
178 		struct hci_cp_le_del_from_white_list cp;
179 
180 		if (hci_pend_le_action_lookup(&hdev->pend_le_conns,
181 					      &b->bdaddr, b->bdaddr_type) ||
182 		    hci_pend_le_action_lookup(&hdev->pend_le_reports,
183 					      &b->bdaddr, b->bdaddr_type)) {
184 			white_list_entries++;
185 			continue;
186 		}
187 
188 		cp.bdaddr_type = b->bdaddr_type;
189 		bacpy(&cp.bdaddr, &b->bdaddr);
190 
191 		hci_req_add(req, HCI_OP_LE_DEL_FROM_WHITE_LIST,
192 			    sizeof(cp), &cp);
193 	}
194 
195 	/* Since all no longer valid white list entries have been
196 	 * removed, walk through the list of pending connections
197 	 * and ensure that any new device gets programmed into
198 	 * the controller.
199 	 *
200 	 * If the list of the devices is larger than the list of
201 	 * available white list entries in the controller, then
202 	 * just abort and return filer policy value to not use the
203 	 * white list.
204 	 */
205 	list_for_each_entry(params, &hdev->pend_le_conns, action) {
206 		if (hci_bdaddr_list_lookup(&hdev->le_white_list,
207 					   &params->addr, params->addr_type))
208 			continue;
209 
210 		if (white_list_entries >= hdev->le_white_list_size) {
211 			/* Select filter policy to accept all advertising */
212 			return 0x00;
213 		}
214 
215 		if (hci_find_irk_by_addr(hdev, &params->addr,
216 					 params->addr_type)) {
217 			/* White list can not be used with RPAs */
218 			return 0x00;
219 		}
220 
221 		white_list_entries++;
222 		add_to_white_list(req, params);
223 	}
224 
225 	/* After adding all new pending connections, walk through
226 	 * the list of pending reports and also add these to the
227 	 * white list if there is still space.
228 	 */
229 	list_for_each_entry(params, &hdev->pend_le_reports, action) {
230 		if (hci_bdaddr_list_lookup(&hdev->le_white_list,
231 					   &params->addr, params->addr_type))
232 			continue;
233 
234 		if (white_list_entries >= hdev->le_white_list_size) {
235 			/* Select filter policy to accept all advertising */
236 			return 0x00;
237 		}
238 
239 		if (hci_find_irk_by_addr(hdev, &params->addr,
240 					 params->addr_type)) {
241 			/* White list can not be used with RPAs */
242 			return 0x00;
243 		}
244 
245 		white_list_entries++;
246 		add_to_white_list(req, params);
247 	}
248 
249 	/* Select filter policy to use white list */
250 	return 0x01;
251 }
252 
253 void hci_req_add_le_passive_scan(struct hci_request *req)
254 {
255 	struct hci_cp_le_set_scan_param param_cp;
256 	struct hci_cp_le_set_scan_enable enable_cp;
257 	struct hci_dev *hdev = req->hdev;
258 	u8 own_addr_type;
259 	u8 filter_policy;
260 
261 	/* Set require_privacy to false since no SCAN_REQ are send
262 	 * during passive scanning. Not using an non-resolvable address
263 	 * here is important so that peer devices using direct
264 	 * advertising with our address will be correctly reported
265 	 * by the controller.
266 	 */
267 	if (hci_update_random_address(req, false, &own_addr_type))
268 		return;
269 
270 	/* Adding or removing entries from the white list must
271 	 * happen before enabling scanning. The controller does
272 	 * not allow white list modification while scanning.
273 	 */
274 	filter_policy = update_white_list(req);
275 
276 	/* When the controller is using random resolvable addresses and
277 	 * with that having LE privacy enabled, then controllers with
278 	 * Extended Scanner Filter Policies support can now enable support
279 	 * for handling directed advertising.
280 	 *
281 	 * So instead of using filter polices 0x00 (no whitelist)
282 	 * and 0x01 (whitelist enabled) use the new filter policies
283 	 * 0x02 (no whitelist) and 0x03 (whitelist enabled).
284 	 */
285 	if (hci_dev_test_flag(hdev, HCI_PRIVACY) &&
286 	    (hdev->le_features[0] & HCI_LE_EXT_SCAN_POLICY))
287 		filter_policy |= 0x02;
288 
289 	memset(&param_cp, 0, sizeof(param_cp));
290 	param_cp.type = LE_SCAN_PASSIVE;
291 	param_cp.interval = cpu_to_le16(hdev->le_scan_interval);
292 	param_cp.window = cpu_to_le16(hdev->le_scan_window);
293 	param_cp.own_address_type = own_addr_type;
294 	param_cp.filter_policy = filter_policy;
295 	hci_req_add(req, HCI_OP_LE_SET_SCAN_PARAM, sizeof(param_cp),
296 		    &param_cp);
297 
298 	memset(&enable_cp, 0, sizeof(enable_cp));
299 	enable_cp.enable = LE_SCAN_ENABLE;
300 	enable_cp.filter_dup = LE_SCAN_FILTER_DUP_ENABLE;
301 	hci_req_add(req, HCI_OP_LE_SET_SCAN_ENABLE, sizeof(enable_cp),
302 		    &enable_cp);
303 }
304 
305 static void set_random_addr(struct hci_request *req, bdaddr_t *rpa)
306 {
307 	struct hci_dev *hdev = req->hdev;
308 
309 	/* If we're advertising or initiating an LE connection we can't
310 	 * go ahead and change the random address at this time. This is
311 	 * because the eventual initiator address used for the
312 	 * subsequently created connection will be undefined (some
313 	 * controllers use the new address and others the one we had
314 	 * when the operation started).
315 	 *
316 	 * In this kind of scenario skip the update and let the random
317 	 * address be updated at the next cycle.
318 	 */
319 	if (hci_dev_test_flag(hdev, HCI_LE_ADV) ||
320 	    hci_conn_hash_lookup_state(hdev, LE_LINK, BT_CONNECT)) {
321 		BT_DBG("Deferring random address update");
322 		hci_dev_set_flag(hdev, HCI_RPA_EXPIRED);
323 		return;
324 	}
325 
326 	hci_req_add(req, HCI_OP_LE_SET_RANDOM_ADDR, 6, rpa);
327 }
328 
329 int hci_update_random_address(struct hci_request *req, bool require_privacy,
330 			      u8 *own_addr_type)
331 {
332 	struct hci_dev *hdev = req->hdev;
333 	int err;
334 
335 	/* If privacy is enabled use a resolvable private address. If
336 	 * current RPA has expired or there is something else than
337 	 * the current RPA in use, then generate a new one.
338 	 */
339 	if (hci_dev_test_flag(hdev, HCI_PRIVACY)) {
340 		int to;
341 
342 		*own_addr_type = ADDR_LE_DEV_RANDOM;
343 
344 		if (!hci_dev_test_and_clear_flag(hdev, HCI_RPA_EXPIRED) &&
345 		    !bacmp(&hdev->random_addr, &hdev->rpa))
346 			return 0;
347 
348 		err = smp_generate_rpa(hdev, hdev->irk, &hdev->rpa);
349 		if (err < 0) {
350 			BT_ERR("%s failed to generate new RPA", hdev->name);
351 			return err;
352 		}
353 
354 		set_random_addr(req, &hdev->rpa);
355 
356 		to = msecs_to_jiffies(hdev->rpa_timeout * 1000);
357 		queue_delayed_work(hdev->workqueue, &hdev->rpa_expired, to);
358 
359 		return 0;
360 	}
361 
362 	/* In case of required privacy without resolvable private address,
363 	 * use an non-resolvable private address. This is useful for active
364 	 * scanning and non-connectable advertising.
365 	 */
366 	if (require_privacy) {
367 		bdaddr_t nrpa;
368 
369 		while (true) {
370 			/* The non-resolvable private address is generated
371 			 * from random six bytes with the two most significant
372 			 * bits cleared.
373 			 */
374 			get_random_bytes(&nrpa, 6);
375 			nrpa.b[5] &= 0x3f;
376 
377 			/* The non-resolvable private address shall not be
378 			 * equal to the public address.
379 			 */
380 			if (bacmp(&hdev->bdaddr, &nrpa))
381 				break;
382 		}
383 
384 		*own_addr_type = ADDR_LE_DEV_RANDOM;
385 		set_random_addr(req, &nrpa);
386 		return 0;
387 	}
388 
389 	/* If forcing static address is in use or there is no public
390 	 * address use the static address as random address (but skip
391 	 * the HCI command if the current random address is already the
392 	 * static one.
393 	 *
394 	 * In case BR/EDR has been disabled on a dual-mode controller
395 	 * and a static address has been configured, then use that
396 	 * address instead of the public BR/EDR address.
397 	 */
398 	if (hci_dev_test_flag(hdev, HCI_FORCE_STATIC_ADDR) ||
399 	    !bacmp(&hdev->bdaddr, BDADDR_ANY) ||
400 	    (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) &&
401 	     bacmp(&hdev->static_addr, BDADDR_ANY))) {
402 		*own_addr_type = ADDR_LE_DEV_RANDOM;
403 		if (bacmp(&hdev->static_addr, &hdev->random_addr))
404 			hci_req_add(req, HCI_OP_LE_SET_RANDOM_ADDR, 6,
405 				    &hdev->static_addr);
406 		return 0;
407 	}
408 
409 	/* Neither privacy nor static address is being used so use a
410 	 * public address.
411 	 */
412 	*own_addr_type = ADDR_LE_DEV_PUBLIC;
413 
414 	return 0;
415 }
416 
417 static bool disconnected_whitelist_entries(struct hci_dev *hdev)
418 {
419 	struct bdaddr_list *b;
420 
421 	list_for_each_entry(b, &hdev->whitelist, list) {
422 		struct hci_conn *conn;
423 
424 		conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &b->bdaddr);
425 		if (!conn)
426 			return true;
427 
428 		if (conn->state != BT_CONNECTED && conn->state != BT_CONFIG)
429 			return true;
430 	}
431 
432 	return false;
433 }
434 
435 void __hci_update_page_scan(struct hci_request *req)
436 {
437 	struct hci_dev *hdev = req->hdev;
438 	u8 scan;
439 
440 	if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
441 		return;
442 
443 	if (!hdev_is_powered(hdev))
444 		return;
445 
446 	if (mgmt_powering_down(hdev))
447 		return;
448 
449 	if (hci_dev_test_flag(hdev, HCI_CONNECTABLE) ||
450 	    disconnected_whitelist_entries(hdev))
451 		scan = SCAN_PAGE;
452 	else
453 		scan = SCAN_DISABLED;
454 
455 	if (test_bit(HCI_PSCAN, &hdev->flags) == !!(scan & SCAN_PAGE))
456 		return;
457 
458 	if (hci_dev_test_flag(hdev, HCI_DISCOVERABLE))
459 		scan |= SCAN_INQUIRY;
460 
461 	hci_req_add(req, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
462 }
463 
464 void hci_update_page_scan(struct hci_dev *hdev)
465 {
466 	struct hci_request req;
467 
468 	hci_req_init(&req, hdev);
469 	__hci_update_page_scan(&req);
470 	hci_req_run(&req, NULL);
471 }
472 
473 /* This function controls the background scanning based on hdev->pend_le_conns
474  * list. If there are pending LE connection we start the background scanning,
475  * otherwise we stop it.
476  *
477  * This function requires the caller holds hdev->lock.
478  */
479 void __hci_update_background_scan(struct hci_request *req)
480 {
481 	struct hci_dev *hdev = req->hdev;
482 	struct hci_conn *conn;
483 
484 	if (!test_bit(HCI_UP, &hdev->flags) ||
485 	    test_bit(HCI_INIT, &hdev->flags) ||
486 	    hci_dev_test_flag(hdev, HCI_SETUP) ||
487 	    hci_dev_test_flag(hdev, HCI_CONFIG) ||
488 	    hci_dev_test_flag(hdev, HCI_AUTO_OFF) ||
489 	    hci_dev_test_flag(hdev, HCI_UNREGISTER))
490 		return;
491 
492 	/* No point in doing scanning if LE support hasn't been enabled */
493 	if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED))
494 		return;
495 
496 	/* If discovery is active don't interfere with it */
497 	if (hdev->discovery.state != DISCOVERY_STOPPED)
498 		return;
499 
500 	/* Reset RSSI and UUID filters when starting background scanning
501 	 * since these filters are meant for service discovery only.
502 	 *
503 	 * The Start Discovery and Start Service Discovery operations
504 	 * ensure to set proper values for RSSI threshold and UUID
505 	 * filter list. So it is safe to just reset them here.
506 	 */
507 	hci_discovery_filter_clear(hdev);
508 
509 	if (list_empty(&hdev->pend_le_conns) &&
510 	    list_empty(&hdev->pend_le_reports)) {
511 		/* If there is no pending LE connections or devices
512 		 * to be scanned for, we should stop the background
513 		 * scanning.
514 		 */
515 
516 		/* If controller is not scanning we are done. */
517 		if (!hci_dev_test_flag(hdev, HCI_LE_SCAN))
518 			return;
519 
520 		hci_req_add_le_scan_disable(req);
521 
522 		BT_DBG("%s stopping background scanning", hdev->name);
523 	} else {
524 		/* If there is at least one pending LE connection, we should
525 		 * keep the background scan running.
526 		 */
527 
528 		/* If controller is connecting, we should not start scanning
529 		 * since some controllers are not able to scan and connect at
530 		 * the same time.
531 		 */
532 		conn = hci_conn_hash_lookup_state(hdev, LE_LINK, BT_CONNECT);
533 		if (conn)
534 			return;
535 
536 		/* If controller is currently scanning, we stop it to ensure we
537 		 * don't miss any advertising (due to duplicates filter).
538 		 */
539 		if (hci_dev_test_flag(hdev, HCI_LE_SCAN))
540 			hci_req_add_le_scan_disable(req);
541 
542 		hci_req_add_le_passive_scan(req);
543 
544 		BT_DBG("%s starting background scanning", hdev->name);
545 	}
546 }
547 
548 static void update_background_scan_complete(struct hci_dev *hdev, u8 status,
549 					    u16 opcode)
550 {
551 	if (status)
552 		BT_DBG("HCI request failed to update background scanning: "
553 		       "status 0x%2.2x", status);
554 }
555 
556 void hci_update_background_scan(struct hci_dev *hdev)
557 {
558 	int err;
559 	struct hci_request req;
560 
561 	hci_req_init(&req, hdev);
562 
563 	__hci_update_background_scan(&req);
564 
565 	err = hci_req_run(&req, update_background_scan_complete);
566 	if (err && err != -ENODATA)
567 		BT_ERR("Failed to run HCI request: err %d", err);
568 }
569