Broken "device" privacy for my TI chip

Broken "device" privacy for my TI chip

[Kai Ruhnau]

Hi,

I’m running BlueZ 5.50 on my embedded platform containing an ODIN-W160 WiFi/Bluetooth-combo-chip with a TI Bluetooth core. After un-resetting the Bluetooth power GPIO, I run `hciattach … texas 115200 flow` and then start bluetoothd. In `main.conf`, I have set `Privacy=device`.

With this setup, the `set_privacy_complete` (adapter.c) callback in bluetoothd is called with `status == MGMT_STATUS_REJECTED` and according to my 4.9 kernel, this is the case when `hdev_is_powered`: After booting and running `hciattach`, my chip is already "up" and thus I cannot set the IRK.

I found in `texas_post` (hciattach_ti.c), that there's an explicit ioctl to HCIDEVUP the chip at the end, so this combination cannot work correctly at the moment.

For the time being, I have extended my hciattach systemd unit with `ExecStartPost=/usr/bin/hciconfig hci0 down` and that fixes the `set_privacy` call chain when starting bluetoothd.

Cheers,
Kai

--
Kai Ruhnau
Software Manager
T:+49 202 769302 19

Target Systemelektronik GmbH & Co. KG
Heinz-Fangman-Straße 4
42287 Wuppertal

Amtsgericht Wuppertal HRA 23898
Persönlich haftende Gesellschafterin
Target Systemelektronik Beteiligungs GmbH
Heinz-Fangman-Straße 4, 42287 Wuppertal
Amtsgericht Wuppertal HRB 25346
Geschäftsführer: Jürgen Stein
--

Re: Broken "device" privacy for my TI chip

[Marcel Holtmann]

Hi Kai,

> I’m running BlueZ 5.50 on my embedded platform containing an ODIN-W160 WiFi/Bluetooth-combo-chip with a TI Bluetooth core. After un-resetting the Bluetooth power GPIO, I run `hciattach … texas 115200 flow` and then start bluetoothd. In `main.conf`, I have set `Privacy=device`.
> 
> With this setup, the `set_privacy_complete` (adapter.c) callback in bluetoothd is called with `status == MGMT_STATUS_REJECTED` and according to my 4.9 kernel, this is the case when `hdev_is_powered`: After booting and running `hciattach`, my chip is already "up" and thus I cannot set the IRK.
> 
> I found in `texas_post` (hciattach_ti.c), that there's an explicit ioctl to HCIDEVUP the chip at the end, so this combination cannot work correctly at the moment.
> 
> For the time being, I have extended my hciattach systemd unit with `ExecStartPost=/usr/bin/hciconfig hci0 down` and that fixes the `set_privacy` call chain when starting bluetoothd.

stop using hciattach and start using serdev.

Regards

Marcel

AW: Broken "device" privacy for my TI chip

[Kai Ruhnau]

Hi Marcel,

>> I’m running BlueZ 5.50 on my embedded platform containing an ODIN-W160 WiFi/Bluetooth-combo-chip with a TI Bluetooth core. After un-resetting the Bluetooth power GPIO, I run `hciattach … texas 115200 flow` and then start bluetoothd. In `main.conf`, I have set `Privacy=device`.
>>
>> With this setup, the `set_privacy_complete` (adapter.c) callback in bluetoothd is called with `status == MGMT_STATUS_REJECTED` and according to my 4.9 kernel, this is the case when `hdev_is_powered`: After booting and running `hciattach`, my chip is already "up" and thus I cannot set the IRK.
>>
>> I found in `texas_post` (hciattach_ti.c), that there's an explicit ioctl to HCIDEVUP the chip at the end, so this combination cannot work correctly at the moment.
>>
>> For the time being, I have extended my hciattach systemd unit with `ExecStartPost=/usr/bin/hciconfig hci0 down` and that fixes the `set_privacy` call chain when starting bluetoothd.
>
> stop using hciattach and start using serdev.

I'm still on linux-stable 4.9, so I have to put that on the list of things that will be better when I find time to update. Thanks for the pointer!

Cheers,
Kai
--
Kai Ruhnau
Software Manager
T:+49 202 769302 19

Target Systemelektronik GmbH & Co. KG
Heinz-Fangman-Straße 4
42287 Wuppertal

Amtsgericht Wuppertal HRA 23898
Persönlich haftende Gesellschafterin
Target Systemelektronik Beteiligungs GmbH
Heinz-Fangman-Straße 4, 42287 Wuppertal
Amtsgericht Wuppertal HRB 25346
Geschäftsführer: Jürgen Stein
--