1 /* 2 BlueZ - Bluetooth protocol stack for Linux 3 4 Copyright (C) 2010 Nokia Corporation 5 Copyright (C) 2011-2012 Intel Corporation 6 7 This program is free software; you can redistribute it and/or modify 8 it under the terms of the GNU General Public License version 2 as 9 published by the Free Software Foundation; 10 11 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS 12 OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 13 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS. 14 IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY 15 CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES 16 WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN 17 ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF 18 OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. 19 20 ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS, 21 COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS 22 SOFTWARE IS DISCLAIMED. 23 */ 24 25 /* Bluetooth HCI Management interface */ 26 27 #include <linux/module.h> 28 #include <asm/unaligned.h> 29 30 #include <net/bluetooth/bluetooth.h> 31 #include <net/bluetooth/hci_core.h> 32 #include <net/bluetooth/hci_sock.h> 33 #include <net/bluetooth/l2cap.h> 34 #include <net/bluetooth/mgmt.h> 35 36 #include "hci_request.h" 37 #include "smp.h" 38 #include "mgmt_util.h" 39 #include "mgmt_config.h" 40 #include "msft.h" 41 42 #define MGMT_VERSION 1 43 #define MGMT_REVISION 18 44 45 static const u16 mgmt_commands[] = { 46 MGMT_OP_READ_INDEX_LIST, 47 MGMT_OP_READ_INFO, 48 MGMT_OP_SET_POWERED, 49 MGMT_OP_SET_DISCOVERABLE, 50 MGMT_OP_SET_CONNECTABLE, 51 MGMT_OP_SET_FAST_CONNECTABLE, 52 MGMT_OP_SET_BONDABLE, 53 MGMT_OP_SET_LINK_SECURITY, 54 MGMT_OP_SET_SSP, 55 MGMT_OP_SET_HS, 56 MGMT_OP_SET_LE, 57 MGMT_OP_SET_DEV_CLASS, 58 MGMT_OP_SET_LOCAL_NAME, 59 MGMT_OP_ADD_UUID, 60 MGMT_OP_REMOVE_UUID, 61 MGMT_OP_LOAD_LINK_KEYS, 62 MGMT_OP_LOAD_LONG_TERM_KEYS, 63 MGMT_OP_DISCONNECT, 64 MGMT_OP_GET_CONNECTIONS, 65 MGMT_OP_PIN_CODE_REPLY, 66 MGMT_OP_PIN_CODE_NEG_REPLY, 67 MGMT_OP_SET_IO_CAPABILITY, 68 MGMT_OP_PAIR_DEVICE, 69 MGMT_OP_CANCEL_PAIR_DEVICE, 70 MGMT_OP_UNPAIR_DEVICE, 71 MGMT_OP_USER_CONFIRM_REPLY, 72 MGMT_OP_USER_CONFIRM_NEG_REPLY, 73 MGMT_OP_USER_PASSKEY_REPLY, 74 MGMT_OP_USER_PASSKEY_NEG_REPLY, 75 MGMT_OP_READ_LOCAL_OOB_DATA, 76 MGMT_OP_ADD_REMOTE_OOB_DATA, 77 MGMT_OP_REMOVE_REMOTE_OOB_DATA, 78 MGMT_OP_START_DISCOVERY, 79 MGMT_OP_STOP_DISCOVERY, 80 MGMT_OP_CONFIRM_NAME, 81 MGMT_OP_BLOCK_DEVICE, 82 MGMT_OP_UNBLOCK_DEVICE, 83 MGMT_OP_SET_DEVICE_ID, 84 MGMT_OP_SET_ADVERTISING, 85 MGMT_OP_SET_BREDR, 86 MGMT_OP_SET_STATIC_ADDRESS, 87 MGMT_OP_SET_SCAN_PARAMS, 88 MGMT_OP_SET_SECURE_CONN, 89 MGMT_OP_SET_DEBUG_KEYS, 90 MGMT_OP_SET_PRIVACY, 91 MGMT_OP_LOAD_IRKS, 92 MGMT_OP_GET_CONN_INFO, 93 MGMT_OP_GET_CLOCK_INFO, 94 MGMT_OP_ADD_DEVICE, 95 MGMT_OP_REMOVE_DEVICE, 96 MGMT_OP_LOAD_CONN_PARAM, 97 MGMT_OP_READ_UNCONF_INDEX_LIST, 98 MGMT_OP_READ_CONFIG_INFO, 99 MGMT_OP_SET_EXTERNAL_CONFIG, 100 MGMT_OP_SET_PUBLIC_ADDRESS, 101 MGMT_OP_START_SERVICE_DISCOVERY, 102 MGMT_OP_READ_LOCAL_OOB_EXT_DATA, 103 MGMT_OP_READ_EXT_INDEX_LIST, 104 MGMT_OP_READ_ADV_FEATURES, 105 MGMT_OP_ADD_ADVERTISING, 106 MGMT_OP_REMOVE_ADVERTISING, 107 MGMT_OP_GET_ADV_SIZE_INFO, 108 MGMT_OP_START_LIMITED_DISCOVERY, 109 MGMT_OP_READ_EXT_INFO, 110 MGMT_OP_SET_APPEARANCE, 111 MGMT_OP_SET_BLOCKED_KEYS, 112 MGMT_OP_SET_WIDEBAND_SPEECH, 113 MGMT_OP_READ_SECURITY_INFO, 114 MGMT_OP_READ_EXP_FEATURES_INFO, 115 MGMT_OP_SET_EXP_FEATURE, 116 MGMT_OP_READ_DEF_SYSTEM_CONFIG, 117 MGMT_OP_SET_DEF_SYSTEM_CONFIG, 118 MGMT_OP_READ_DEF_RUNTIME_CONFIG, 119 MGMT_OP_SET_DEF_RUNTIME_CONFIG, 120 MGMT_OP_GET_DEVICE_FLAGS, 121 MGMT_OP_SET_DEVICE_FLAGS, 122 MGMT_OP_READ_ADV_MONITOR_FEATURES, 123 MGMT_OP_ADD_ADV_PATTERNS_MONITOR, 124 MGMT_OP_REMOVE_ADV_MONITOR, 125 }; 126 127 static const u16 mgmt_events[] = { 128 MGMT_EV_CONTROLLER_ERROR, 129 MGMT_EV_INDEX_ADDED, 130 MGMT_EV_INDEX_REMOVED, 131 MGMT_EV_NEW_SETTINGS, 132 MGMT_EV_CLASS_OF_DEV_CHANGED, 133 MGMT_EV_LOCAL_NAME_CHANGED, 134 MGMT_EV_NEW_LINK_KEY, 135 MGMT_EV_NEW_LONG_TERM_KEY, 136 MGMT_EV_DEVICE_CONNECTED, 137 MGMT_EV_DEVICE_DISCONNECTED, 138 MGMT_EV_CONNECT_FAILED, 139 MGMT_EV_PIN_CODE_REQUEST, 140 MGMT_EV_USER_CONFIRM_REQUEST, 141 MGMT_EV_USER_PASSKEY_REQUEST, 142 MGMT_EV_AUTH_FAILED, 143 MGMT_EV_DEVICE_FOUND, 144 MGMT_EV_DISCOVERING, 145 MGMT_EV_DEVICE_BLOCKED, 146 MGMT_EV_DEVICE_UNBLOCKED, 147 MGMT_EV_DEVICE_UNPAIRED, 148 MGMT_EV_PASSKEY_NOTIFY, 149 MGMT_EV_NEW_IRK, 150 MGMT_EV_NEW_CSRK, 151 MGMT_EV_DEVICE_ADDED, 152 MGMT_EV_DEVICE_REMOVED, 153 MGMT_EV_NEW_CONN_PARAM, 154 MGMT_EV_UNCONF_INDEX_ADDED, 155 MGMT_EV_UNCONF_INDEX_REMOVED, 156 MGMT_EV_NEW_CONFIG_OPTIONS, 157 MGMT_EV_EXT_INDEX_ADDED, 158 MGMT_EV_EXT_INDEX_REMOVED, 159 MGMT_EV_LOCAL_OOB_DATA_UPDATED, 160 MGMT_EV_ADVERTISING_ADDED, 161 MGMT_EV_ADVERTISING_REMOVED, 162 MGMT_EV_EXT_INFO_CHANGED, 163 MGMT_EV_PHY_CONFIGURATION_CHANGED, 164 MGMT_EV_EXP_FEATURE_CHANGED, 165 MGMT_EV_DEVICE_FLAGS_CHANGED, 166 MGMT_EV_CONTROLLER_SUSPEND, 167 MGMT_EV_CONTROLLER_RESUME, 168 }; 169 170 static const u16 mgmt_untrusted_commands[] = { 171 MGMT_OP_READ_INDEX_LIST, 172 MGMT_OP_READ_INFO, 173 MGMT_OP_READ_UNCONF_INDEX_LIST, 174 MGMT_OP_READ_CONFIG_INFO, 175 MGMT_OP_READ_EXT_INDEX_LIST, 176 MGMT_OP_READ_EXT_INFO, 177 MGMT_OP_READ_SECURITY_INFO, 178 MGMT_OP_READ_EXP_FEATURES_INFO, 179 MGMT_OP_READ_DEF_SYSTEM_CONFIG, 180 MGMT_OP_READ_DEF_RUNTIME_CONFIG, 181 }; 182 183 static const u16 mgmt_untrusted_events[] = { 184 MGMT_EV_INDEX_ADDED, 185 MGMT_EV_INDEX_REMOVED, 186 MGMT_EV_NEW_SETTINGS, 187 MGMT_EV_CLASS_OF_DEV_CHANGED, 188 MGMT_EV_LOCAL_NAME_CHANGED, 189 MGMT_EV_UNCONF_INDEX_ADDED, 190 MGMT_EV_UNCONF_INDEX_REMOVED, 191 MGMT_EV_NEW_CONFIG_OPTIONS, 192 MGMT_EV_EXT_INDEX_ADDED, 193 MGMT_EV_EXT_INDEX_REMOVED, 194 MGMT_EV_EXT_INFO_CHANGED, 195 MGMT_EV_EXP_FEATURE_CHANGED, 196 MGMT_EV_ADV_MONITOR_ADDED, 197 MGMT_EV_ADV_MONITOR_REMOVED, 198 }; 199 200 #define CACHE_TIMEOUT msecs_to_jiffies(2 * 1000) 201 202 #define ZERO_KEY "\x00\x00\x00\x00\x00\x00\x00\x00" \ 203 "\x00\x00\x00\x00\x00\x00\x00\x00" 204 205 /* HCI to MGMT error code conversion table */ 206 static const u8 mgmt_status_table[] = { 207 MGMT_STATUS_SUCCESS, 208 MGMT_STATUS_UNKNOWN_COMMAND, /* Unknown Command */ 209 MGMT_STATUS_NOT_CONNECTED, /* No Connection */ 210 MGMT_STATUS_FAILED, /* Hardware Failure */ 211 MGMT_STATUS_CONNECT_FAILED, /* Page Timeout */ 212 MGMT_STATUS_AUTH_FAILED, /* Authentication Failed */ 213 MGMT_STATUS_AUTH_FAILED, /* PIN or Key Missing */ 214 MGMT_STATUS_NO_RESOURCES, /* Memory Full */ 215 MGMT_STATUS_TIMEOUT, /* Connection Timeout */ 216 MGMT_STATUS_NO_RESOURCES, /* Max Number of Connections */ 217 MGMT_STATUS_NO_RESOURCES, /* Max Number of SCO Connections */ 218 MGMT_STATUS_ALREADY_CONNECTED, /* ACL Connection Exists */ 219 MGMT_STATUS_BUSY, /* Command Disallowed */ 220 MGMT_STATUS_NO_RESOURCES, /* Rejected Limited Resources */ 221 MGMT_STATUS_REJECTED, /* Rejected Security */ 222 MGMT_STATUS_REJECTED, /* Rejected Personal */ 223 MGMT_STATUS_TIMEOUT, /* Host Timeout */ 224 MGMT_STATUS_NOT_SUPPORTED, /* Unsupported Feature */ 225 MGMT_STATUS_INVALID_PARAMS, /* Invalid Parameters */ 226 MGMT_STATUS_DISCONNECTED, /* OE User Ended Connection */ 227 MGMT_STATUS_NO_RESOURCES, /* OE Low Resources */ 228 MGMT_STATUS_DISCONNECTED, /* OE Power Off */ 229 MGMT_STATUS_DISCONNECTED, /* Connection Terminated */ 230 MGMT_STATUS_BUSY, /* Repeated Attempts */ 231 MGMT_STATUS_REJECTED, /* Pairing Not Allowed */ 232 MGMT_STATUS_FAILED, /* Unknown LMP PDU */ 233 MGMT_STATUS_NOT_SUPPORTED, /* Unsupported Remote Feature */ 234 MGMT_STATUS_REJECTED, /* SCO Offset Rejected */ 235 MGMT_STATUS_REJECTED, /* SCO Interval Rejected */ 236 MGMT_STATUS_REJECTED, /* Air Mode Rejected */ 237 MGMT_STATUS_INVALID_PARAMS, /* Invalid LMP Parameters */ 238 MGMT_STATUS_FAILED, /* Unspecified Error */ 239 MGMT_STATUS_NOT_SUPPORTED, /* Unsupported LMP Parameter Value */ 240 MGMT_STATUS_FAILED, /* Role Change Not Allowed */ 241 MGMT_STATUS_TIMEOUT, /* LMP Response Timeout */ 242 MGMT_STATUS_FAILED, /* LMP Error Transaction Collision */ 243 MGMT_STATUS_FAILED, /* LMP PDU Not Allowed */ 244 MGMT_STATUS_REJECTED, /* Encryption Mode Not Accepted */ 245 MGMT_STATUS_FAILED, /* Unit Link Key Used */ 246 MGMT_STATUS_NOT_SUPPORTED, /* QoS Not Supported */ 247 MGMT_STATUS_TIMEOUT, /* Instant Passed */ 248 MGMT_STATUS_NOT_SUPPORTED, /* Pairing Not Supported */ 249 MGMT_STATUS_FAILED, /* Transaction Collision */ 250 MGMT_STATUS_INVALID_PARAMS, /* Unacceptable Parameter */ 251 MGMT_STATUS_REJECTED, /* QoS Rejected */ 252 MGMT_STATUS_NOT_SUPPORTED, /* Classification Not Supported */ 253 MGMT_STATUS_REJECTED, /* Insufficient Security */ 254 MGMT_STATUS_INVALID_PARAMS, /* Parameter Out Of Range */ 255 MGMT_STATUS_BUSY, /* Role Switch Pending */ 256 MGMT_STATUS_FAILED, /* Slot Violation */ 257 MGMT_STATUS_FAILED, /* Role Switch Failed */ 258 MGMT_STATUS_INVALID_PARAMS, /* EIR Too Large */ 259 MGMT_STATUS_NOT_SUPPORTED, /* Simple Pairing Not Supported */ 260 MGMT_STATUS_BUSY, /* Host Busy Pairing */ 261 MGMT_STATUS_REJECTED, /* Rejected, No Suitable Channel */ 262 MGMT_STATUS_BUSY, /* Controller Busy */ 263 MGMT_STATUS_INVALID_PARAMS, /* Unsuitable Connection Interval */ 264 MGMT_STATUS_TIMEOUT, /* Directed Advertising Timeout */ 265 MGMT_STATUS_AUTH_FAILED, /* Terminated Due to MIC Failure */ 266 MGMT_STATUS_CONNECT_FAILED, /* Connection Establishment Failed */ 267 MGMT_STATUS_CONNECT_FAILED, /* MAC Connection Failed */ 268 }; 269 270 static u8 mgmt_status(u8 hci_status) 271 { 272 if (hci_status < ARRAY_SIZE(mgmt_status_table)) 273 return mgmt_status_table[hci_status]; 274 275 return MGMT_STATUS_FAILED; 276 } 277 278 static int mgmt_index_event(u16 event, struct hci_dev *hdev, void *data, 279 u16 len, int flag) 280 { 281 return mgmt_send_event(event, hdev, HCI_CHANNEL_CONTROL, data, len, 282 flag, NULL); 283 } 284 285 static int mgmt_limited_event(u16 event, struct hci_dev *hdev, void *data, 286 u16 len, int flag, struct sock *skip_sk) 287 { 288 return mgmt_send_event(event, hdev, HCI_CHANNEL_CONTROL, data, len, 289 flag, skip_sk); 290 } 291 292 static int mgmt_event(u16 event, struct hci_dev *hdev, void *data, u16 len, 293 struct sock *skip_sk) 294 { 295 return mgmt_send_event(event, hdev, HCI_CHANNEL_CONTROL, data, len, 296 HCI_SOCK_TRUSTED, skip_sk); 297 } 298 299 static u8 le_addr_type(u8 mgmt_addr_type) 300 { 301 if (mgmt_addr_type == BDADDR_LE_PUBLIC) 302 return ADDR_LE_DEV_PUBLIC; 303 else 304 return ADDR_LE_DEV_RANDOM; 305 } 306 307 void mgmt_fill_version_info(void *ver) 308 { 309 struct mgmt_rp_read_version *rp = ver; 310 311 rp->version = MGMT_VERSION; 312 rp->revision = cpu_to_le16(MGMT_REVISION); 313 } 314 315 static int read_version(struct sock *sk, struct hci_dev *hdev, void *data, 316 u16 data_len) 317 { 318 struct mgmt_rp_read_version rp; 319 320 bt_dev_dbg(hdev, "sock %p", sk); 321 322 mgmt_fill_version_info(&rp); 323 324 return mgmt_cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_VERSION, 0, 325 &rp, sizeof(rp)); 326 } 327 328 static int read_commands(struct sock *sk, struct hci_dev *hdev, void *data, 329 u16 data_len) 330 { 331 struct mgmt_rp_read_commands *rp; 332 u16 num_commands, num_events; 333 size_t rp_size; 334 int i, err; 335 336 bt_dev_dbg(hdev, "sock %p", sk); 337 338 if (hci_sock_test_flag(sk, HCI_SOCK_TRUSTED)) { 339 num_commands = ARRAY_SIZE(mgmt_commands); 340 num_events = ARRAY_SIZE(mgmt_events); 341 } else { 342 num_commands = ARRAY_SIZE(mgmt_untrusted_commands); 343 num_events = ARRAY_SIZE(mgmt_untrusted_events); 344 } 345 346 rp_size = sizeof(*rp) + ((num_commands + num_events) * sizeof(u16)); 347 348 rp = kmalloc(rp_size, GFP_KERNEL); 349 if (!rp) 350 return -ENOMEM; 351 352 rp->num_commands = cpu_to_le16(num_commands); 353 rp->num_events = cpu_to_le16(num_events); 354 355 if (hci_sock_test_flag(sk, HCI_SOCK_TRUSTED)) { 356 __le16 *opcode = rp->opcodes; 357 358 for (i = 0; i < num_commands; i++, opcode++) 359 put_unaligned_le16(mgmt_commands[i], opcode); 360 361 for (i = 0; i < num_events; i++, opcode++) 362 put_unaligned_le16(mgmt_events[i], opcode); 363 } else { 364 __le16 *opcode = rp->opcodes; 365 366 for (i = 0; i < num_commands; i++, opcode++) 367 put_unaligned_le16(mgmt_untrusted_commands[i], opcode); 368 369 for (i = 0; i < num_events; i++, opcode++) 370 put_unaligned_le16(mgmt_untrusted_events[i], opcode); 371 } 372 373 err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_COMMANDS, 0, 374 rp, rp_size); 375 kfree(rp); 376 377 return err; 378 } 379 380 static int read_index_list(struct sock *sk, struct hci_dev *hdev, void *data, 381 u16 data_len) 382 { 383 struct mgmt_rp_read_index_list *rp; 384 struct hci_dev *d; 385 size_t rp_len; 386 u16 count; 387 int err; 388 389 bt_dev_dbg(hdev, "sock %p", sk); 390 391 read_lock(&hci_dev_list_lock); 392 393 count = 0; 394 list_for_each_entry(d, &hci_dev_list, list) { 395 if (d->dev_type == HCI_PRIMARY && 396 !hci_dev_test_flag(d, HCI_UNCONFIGURED)) 397 count++; 398 } 399 400 rp_len = sizeof(*rp) + (2 * count); 401 rp = kmalloc(rp_len, GFP_ATOMIC); 402 if (!rp) { 403 read_unlock(&hci_dev_list_lock); 404 return -ENOMEM; 405 } 406 407 count = 0; 408 list_for_each_entry(d, &hci_dev_list, list) { 409 if (hci_dev_test_flag(d, HCI_SETUP) || 410 hci_dev_test_flag(d, HCI_CONFIG) || 411 hci_dev_test_flag(d, HCI_USER_CHANNEL)) 412 continue; 413 414 /* Devices marked as raw-only are neither configured 415 * nor unconfigured controllers. 416 */ 417 if (test_bit(HCI_QUIRK_RAW_DEVICE, &d->quirks)) 418 continue; 419 420 if (d->dev_type == HCI_PRIMARY && 421 !hci_dev_test_flag(d, HCI_UNCONFIGURED)) { 422 rp->index[count++] = cpu_to_le16(d->id); 423 bt_dev_dbg(hdev, "Added hci%u", d->id); 424 } 425 } 426 427 rp->num_controllers = cpu_to_le16(count); 428 rp_len = sizeof(*rp) + (2 * count); 429 430 read_unlock(&hci_dev_list_lock); 431 432 err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_INDEX_LIST, 433 0, rp, rp_len); 434 435 kfree(rp); 436 437 return err; 438 } 439 440 static int read_unconf_index_list(struct sock *sk, struct hci_dev *hdev, 441 void *data, u16 data_len) 442 { 443 struct mgmt_rp_read_unconf_index_list *rp; 444 struct hci_dev *d; 445 size_t rp_len; 446 u16 count; 447 int err; 448 449 bt_dev_dbg(hdev, "sock %p", sk); 450 451 read_lock(&hci_dev_list_lock); 452 453 count = 0; 454 list_for_each_entry(d, &hci_dev_list, list) { 455 if (d->dev_type == HCI_PRIMARY && 456 hci_dev_test_flag(d, HCI_UNCONFIGURED)) 457 count++; 458 } 459 460 rp_len = sizeof(*rp) + (2 * count); 461 rp = kmalloc(rp_len, GFP_ATOMIC); 462 if (!rp) { 463 read_unlock(&hci_dev_list_lock); 464 return -ENOMEM; 465 } 466 467 count = 0; 468 list_for_each_entry(d, &hci_dev_list, list) { 469 if (hci_dev_test_flag(d, HCI_SETUP) || 470 hci_dev_test_flag(d, HCI_CONFIG) || 471 hci_dev_test_flag(d, HCI_USER_CHANNEL)) 472 continue; 473 474 /* Devices marked as raw-only are neither configured 475 * nor unconfigured controllers. 476 */ 477 if (test_bit(HCI_QUIRK_RAW_DEVICE, &d->quirks)) 478 continue; 479 480 if (d->dev_type == HCI_PRIMARY && 481 hci_dev_test_flag(d, HCI_UNCONFIGURED)) { 482 rp->index[count++] = cpu_to_le16(d->id); 483 bt_dev_dbg(hdev, "Added hci%u", d->id); 484 } 485 } 486 487 rp->num_controllers = cpu_to_le16(count); 488 rp_len = sizeof(*rp) + (2 * count); 489 490 read_unlock(&hci_dev_list_lock); 491 492 err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE, 493 MGMT_OP_READ_UNCONF_INDEX_LIST, 0, rp, rp_len); 494 495 kfree(rp); 496 497 return err; 498 } 499 500 static int read_ext_index_list(struct sock *sk, struct hci_dev *hdev, 501 void *data, u16 data_len) 502 { 503 struct mgmt_rp_read_ext_index_list *rp; 504 struct hci_dev *d; 505 u16 count; 506 int err; 507 508 bt_dev_dbg(hdev, "sock %p", sk); 509 510 read_lock(&hci_dev_list_lock); 511 512 count = 0; 513 list_for_each_entry(d, &hci_dev_list, list) { 514 if (d->dev_type == HCI_PRIMARY || d->dev_type == HCI_AMP) 515 count++; 516 } 517 518 rp = kmalloc(struct_size(rp, entry, count), GFP_ATOMIC); 519 if (!rp) { 520 read_unlock(&hci_dev_list_lock); 521 return -ENOMEM; 522 } 523 524 count = 0; 525 list_for_each_entry(d, &hci_dev_list, list) { 526 if (hci_dev_test_flag(d, HCI_SETUP) || 527 hci_dev_test_flag(d, HCI_CONFIG) || 528 hci_dev_test_flag(d, HCI_USER_CHANNEL)) 529 continue; 530 531 /* Devices marked as raw-only are neither configured 532 * nor unconfigured controllers. 533 */ 534 if (test_bit(HCI_QUIRK_RAW_DEVICE, &d->quirks)) 535 continue; 536 537 if (d->dev_type == HCI_PRIMARY) { 538 if (hci_dev_test_flag(d, HCI_UNCONFIGURED)) 539 rp->entry[count].type = 0x01; 540 else 541 rp->entry[count].type = 0x00; 542 } else if (d->dev_type == HCI_AMP) { 543 rp->entry[count].type = 0x02; 544 } else { 545 continue; 546 } 547 548 rp->entry[count].bus = d->bus; 549 rp->entry[count++].index = cpu_to_le16(d->id); 550 bt_dev_dbg(hdev, "Added hci%u", d->id); 551 } 552 553 rp->num_controllers = cpu_to_le16(count); 554 555 read_unlock(&hci_dev_list_lock); 556 557 /* If this command is called at least once, then all the 558 * default index and unconfigured index events are disabled 559 * and from now on only extended index events are used. 560 */ 561 hci_sock_set_flag(sk, HCI_MGMT_EXT_INDEX_EVENTS); 562 hci_sock_clear_flag(sk, HCI_MGMT_INDEX_EVENTS); 563 hci_sock_clear_flag(sk, HCI_MGMT_UNCONF_INDEX_EVENTS); 564 565 err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE, 566 MGMT_OP_READ_EXT_INDEX_LIST, 0, rp, 567 struct_size(rp, entry, count)); 568 569 kfree(rp); 570 571 return err; 572 } 573 574 static bool is_configured(struct hci_dev *hdev) 575 { 576 if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks) && 577 !hci_dev_test_flag(hdev, HCI_EXT_CONFIGURED)) 578 return false; 579 580 if ((test_bit(HCI_QUIRK_INVALID_BDADDR, &hdev->quirks) || 581 test_bit(HCI_QUIRK_USE_BDADDR_PROPERTY, &hdev->quirks)) && 582 !bacmp(&hdev->public_addr, BDADDR_ANY)) 583 return false; 584 585 return true; 586 } 587 588 static __le32 get_missing_options(struct hci_dev *hdev) 589 { 590 u32 options = 0; 591 592 if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks) && 593 !hci_dev_test_flag(hdev, HCI_EXT_CONFIGURED)) 594 options |= MGMT_OPTION_EXTERNAL_CONFIG; 595 596 if ((test_bit(HCI_QUIRK_INVALID_BDADDR, &hdev->quirks) || 597 test_bit(HCI_QUIRK_USE_BDADDR_PROPERTY, &hdev->quirks)) && 598 !bacmp(&hdev->public_addr, BDADDR_ANY)) 599 options |= MGMT_OPTION_PUBLIC_ADDRESS; 600 601 return cpu_to_le32(options); 602 } 603 604 static int new_options(struct hci_dev *hdev, struct sock *skip) 605 { 606 __le32 options = get_missing_options(hdev); 607 608 return mgmt_limited_event(MGMT_EV_NEW_CONFIG_OPTIONS, hdev, &options, 609 sizeof(options), HCI_MGMT_OPTION_EVENTS, skip); 610 } 611 612 static int send_options_rsp(struct sock *sk, u16 opcode, struct hci_dev *hdev) 613 { 614 __le32 options = get_missing_options(hdev); 615 616 return mgmt_cmd_complete(sk, hdev->id, opcode, 0, &options, 617 sizeof(options)); 618 } 619 620 static int read_config_info(struct sock *sk, struct hci_dev *hdev, 621 void *data, u16 data_len) 622 { 623 struct mgmt_rp_read_config_info rp; 624 u32 options = 0; 625 626 bt_dev_dbg(hdev, "sock %p", sk); 627 628 hci_dev_lock(hdev); 629 630 memset(&rp, 0, sizeof(rp)); 631 rp.manufacturer = cpu_to_le16(hdev->manufacturer); 632 633 if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks)) 634 options |= MGMT_OPTION_EXTERNAL_CONFIG; 635 636 if (hdev->set_bdaddr) 637 options |= MGMT_OPTION_PUBLIC_ADDRESS; 638 639 rp.supported_options = cpu_to_le32(options); 640 rp.missing_options = get_missing_options(hdev); 641 642 hci_dev_unlock(hdev); 643 644 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_CONFIG_INFO, 0, 645 &rp, sizeof(rp)); 646 } 647 648 static u32 get_supported_phys(struct hci_dev *hdev) 649 { 650 u32 supported_phys = 0; 651 652 if (lmp_bredr_capable(hdev)) { 653 supported_phys |= MGMT_PHY_BR_1M_1SLOT; 654 655 if (hdev->features[0][0] & LMP_3SLOT) 656 supported_phys |= MGMT_PHY_BR_1M_3SLOT; 657 658 if (hdev->features[0][0] & LMP_5SLOT) 659 supported_phys |= MGMT_PHY_BR_1M_5SLOT; 660 661 if (lmp_edr_2m_capable(hdev)) { 662 supported_phys |= MGMT_PHY_EDR_2M_1SLOT; 663 664 if (lmp_edr_3slot_capable(hdev)) 665 supported_phys |= MGMT_PHY_EDR_2M_3SLOT; 666 667 if (lmp_edr_5slot_capable(hdev)) 668 supported_phys |= MGMT_PHY_EDR_2M_5SLOT; 669 670 if (lmp_edr_3m_capable(hdev)) { 671 supported_phys |= MGMT_PHY_EDR_3M_1SLOT; 672 673 if (lmp_edr_3slot_capable(hdev)) 674 supported_phys |= MGMT_PHY_EDR_3M_3SLOT; 675 676 if (lmp_edr_5slot_capable(hdev)) 677 supported_phys |= MGMT_PHY_EDR_3M_5SLOT; 678 } 679 } 680 } 681 682 if (lmp_le_capable(hdev)) { 683 supported_phys |= MGMT_PHY_LE_1M_TX; 684 supported_phys |= MGMT_PHY_LE_1M_RX; 685 686 if (hdev->le_features[1] & HCI_LE_PHY_2M) { 687 supported_phys |= MGMT_PHY_LE_2M_TX; 688 supported_phys |= MGMT_PHY_LE_2M_RX; 689 } 690 691 if (hdev->le_features[1] & HCI_LE_PHY_CODED) { 692 supported_phys |= MGMT_PHY_LE_CODED_TX; 693 supported_phys |= MGMT_PHY_LE_CODED_RX; 694 } 695 } 696 697 return supported_phys; 698 } 699 700 static u32 get_selected_phys(struct hci_dev *hdev) 701 { 702 u32 selected_phys = 0; 703 704 if (lmp_bredr_capable(hdev)) { 705 selected_phys |= MGMT_PHY_BR_1M_1SLOT; 706 707 if (hdev->pkt_type & (HCI_DM3 | HCI_DH3)) 708 selected_phys |= MGMT_PHY_BR_1M_3SLOT; 709 710 if (hdev->pkt_type & (HCI_DM5 | HCI_DH5)) 711 selected_phys |= MGMT_PHY_BR_1M_5SLOT; 712 713 if (lmp_edr_2m_capable(hdev)) { 714 if (!(hdev->pkt_type & HCI_2DH1)) 715 selected_phys |= MGMT_PHY_EDR_2M_1SLOT; 716 717 if (lmp_edr_3slot_capable(hdev) && 718 !(hdev->pkt_type & HCI_2DH3)) 719 selected_phys |= MGMT_PHY_EDR_2M_3SLOT; 720 721 if (lmp_edr_5slot_capable(hdev) && 722 !(hdev->pkt_type & HCI_2DH5)) 723 selected_phys |= MGMT_PHY_EDR_2M_5SLOT; 724 725 if (lmp_edr_3m_capable(hdev)) { 726 if (!(hdev->pkt_type & HCI_3DH1)) 727 selected_phys |= MGMT_PHY_EDR_3M_1SLOT; 728 729 if (lmp_edr_3slot_capable(hdev) && 730 !(hdev->pkt_type & HCI_3DH3)) 731 selected_phys |= MGMT_PHY_EDR_3M_3SLOT; 732 733 if (lmp_edr_5slot_capable(hdev) && 734 !(hdev->pkt_type & HCI_3DH5)) 735 selected_phys |= MGMT_PHY_EDR_3M_5SLOT; 736 } 737 } 738 } 739 740 if (lmp_le_capable(hdev)) { 741 if (hdev->le_tx_def_phys & HCI_LE_SET_PHY_1M) 742 selected_phys |= MGMT_PHY_LE_1M_TX; 743 744 if (hdev->le_rx_def_phys & HCI_LE_SET_PHY_1M) 745 selected_phys |= MGMT_PHY_LE_1M_RX; 746 747 if (hdev->le_tx_def_phys & HCI_LE_SET_PHY_2M) 748 selected_phys |= MGMT_PHY_LE_2M_TX; 749 750 if (hdev->le_rx_def_phys & HCI_LE_SET_PHY_2M) 751 selected_phys |= MGMT_PHY_LE_2M_RX; 752 753 if (hdev->le_tx_def_phys & HCI_LE_SET_PHY_CODED) 754 selected_phys |= MGMT_PHY_LE_CODED_TX; 755 756 if (hdev->le_rx_def_phys & HCI_LE_SET_PHY_CODED) 757 selected_phys |= MGMT_PHY_LE_CODED_RX; 758 } 759 760 return selected_phys; 761 } 762 763 static u32 get_configurable_phys(struct hci_dev *hdev) 764 { 765 return (get_supported_phys(hdev) & ~MGMT_PHY_BR_1M_1SLOT & 766 ~MGMT_PHY_LE_1M_TX & ~MGMT_PHY_LE_1M_RX); 767 } 768 769 static u32 get_supported_settings(struct hci_dev *hdev) 770 { 771 u32 settings = 0; 772 773 settings |= MGMT_SETTING_POWERED; 774 settings |= MGMT_SETTING_BONDABLE; 775 settings |= MGMT_SETTING_DEBUG_KEYS; 776 settings |= MGMT_SETTING_CONNECTABLE; 777 settings |= MGMT_SETTING_DISCOVERABLE; 778 779 if (lmp_bredr_capable(hdev)) { 780 if (hdev->hci_ver >= BLUETOOTH_VER_1_2) 781 settings |= MGMT_SETTING_FAST_CONNECTABLE; 782 settings |= MGMT_SETTING_BREDR; 783 settings |= MGMT_SETTING_LINK_SECURITY; 784 785 if (lmp_ssp_capable(hdev)) { 786 settings |= MGMT_SETTING_SSP; 787 if (IS_ENABLED(CONFIG_BT_HS)) 788 settings |= MGMT_SETTING_HS; 789 } 790 791 if (lmp_sc_capable(hdev)) 792 settings |= MGMT_SETTING_SECURE_CONN; 793 794 if (test_bit(HCI_QUIRK_WIDEBAND_SPEECH_SUPPORTED, 795 &hdev->quirks)) 796 settings |= MGMT_SETTING_WIDEBAND_SPEECH; 797 } 798 799 if (lmp_le_capable(hdev)) { 800 settings |= MGMT_SETTING_LE; 801 settings |= MGMT_SETTING_SECURE_CONN; 802 settings |= MGMT_SETTING_PRIVACY; 803 settings |= MGMT_SETTING_STATIC_ADDRESS; 804 805 /* When the experimental feature for LL Privacy support is 806 * enabled, then advertising is no longer supported. 807 */ 808 if (!hci_dev_test_flag(hdev, HCI_ENABLE_LL_PRIVACY)) 809 settings |= MGMT_SETTING_ADVERTISING; 810 } 811 812 if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks) || 813 hdev->set_bdaddr) 814 settings |= MGMT_SETTING_CONFIGURATION; 815 816 settings |= MGMT_SETTING_PHY_CONFIGURATION; 817 818 return settings; 819 } 820 821 static u32 get_current_settings(struct hci_dev *hdev) 822 { 823 u32 settings = 0; 824 825 if (hdev_is_powered(hdev)) 826 settings |= MGMT_SETTING_POWERED; 827 828 if (hci_dev_test_flag(hdev, HCI_CONNECTABLE)) 829 settings |= MGMT_SETTING_CONNECTABLE; 830 831 if (hci_dev_test_flag(hdev, HCI_FAST_CONNECTABLE)) 832 settings |= MGMT_SETTING_FAST_CONNECTABLE; 833 834 if (hci_dev_test_flag(hdev, HCI_DISCOVERABLE)) 835 settings |= MGMT_SETTING_DISCOVERABLE; 836 837 if (hci_dev_test_flag(hdev, HCI_BONDABLE)) 838 settings |= MGMT_SETTING_BONDABLE; 839 840 if (hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) 841 settings |= MGMT_SETTING_BREDR; 842 843 if (hci_dev_test_flag(hdev, HCI_LE_ENABLED)) 844 settings |= MGMT_SETTING_LE; 845 846 if (hci_dev_test_flag(hdev, HCI_LINK_SECURITY)) 847 settings |= MGMT_SETTING_LINK_SECURITY; 848 849 if (hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) 850 settings |= MGMT_SETTING_SSP; 851 852 if (hci_dev_test_flag(hdev, HCI_HS_ENABLED)) 853 settings |= MGMT_SETTING_HS; 854 855 if (hci_dev_test_flag(hdev, HCI_ADVERTISING)) 856 settings |= MGMT_SETTING_ADVERTISING; 857 858 if (hci_dev_test_flag(hdev, HCI_SC_ENABLED)) 859 settings |= MGMT_SETTING_SECURE_CONN; 860 861 if (hci_dev_test_flag(hdev, HCI_KEEP_DEBUG_KEYS)) 862 settings |= MGMT_SETTING_DEBUG_KEYS; 863 864 if (hci_dev_test_flag(hdev, HCI_PRIVACY)) 865 settings |= MGMT_SETTING_PRIVACY; 866 867 /* The current setting for static address has two purposes. The 868 * first is to indicate if the static address will be used and 869 * the second is to indicate if it is actually set. 870 * 871 * This means if the static address is not configured, this flag 872 * will never be set. If the address is configured, then if the 873 * address is actually used decides if the flag is set or not. 874 * 875 * For single mode LE only controllers and dual-mode controllers 876 * with BR/EDR disabled, the existence of the static address will 877 * be evaluated. 878 */ 879 if (hci_dev_test_flag(hdev, HCI_FORCE_STATIC_ADDR) || 880 !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) || 881 !bacmp(&hdev->bdaddr, BDADDR_ANY)) { 882 if (bacmp(&hdev->static_addr, BDADDR_ANY)) 883 settings |= MGMT_SETTING_STATIC_ADDRESS; 884 } 885 886 if (hci_dev_test_flag(hdev, HCI_WIDEBAND_SPEECH_ENABLED)) 887 settings |= MGMT_SETTING_WIDEBAND_SPEECH; 888 889 return settings; 890 } 891 892 static struct mgmt_pending_cmd *pending_find(u16 opcode, struct hci_dev *hdev) 893 { 894 return mgmt_pending_find(HCI_CHANNEL_CONTROL, opcode, hdev); 895 } 896 897 static struct mgmt_pending_cmd *pending_find_data(u16 opcode, 898 struct hci_dev *hdev, 899 const void *data) 900 { 901 return mgmt_pending_find_data(HCI_CHANNEL_CONTROL, opcode, hdev, data); 902 } 903 904 u8 mgmt_get_adv_discov_flags(struct hci_dev *hdev) 905 { 906 struct mgmt_pending_cmd *cmd; 907 908 /* If there's a pending mgmt command the flags will not yet have 909 * their final values, so check for this first. 910 */ 911 cmd = pending_find(MGMT_OP_SET_DISCOVERABLE, hdev); 912 if (cmd) { 913 struct mgmt_mode *cp = cmd->param; 914 if (cp->val == 0x01) 915 return LE_AD_GENERAL; 916 else if (cp->val == 0x02) 917 return LE_AD_LIMITED; 918 } else { 919 if (hci_dev_test_flag(hdev, HCI_LIMITED_DISCOVERABLE)) 920 return LE_AD_LIMITED; 921 else if (hci_dev_test_flag(hdev, HCI_DISCOVERABLE)) 922 return LE_AD_GENERAL; 923 } 924 925 return 0; 926 } 927 928 bool mgmt_get_connectable(struct hci_dev *hdev) 929 { 930 struct mgmt_pending_cmd *cmd; 931 932 /* If there's a pending mgmt command the flag will not yet have 933 * it's final value, so check for this first. 934 */ 935 cmd = pending_find(MGMT_OP_SET_CONNECTABLE, hdev); 936 if (cmd) { 937 struct mgmt_mode *cp = cmd->param; 938 939 return cp->val; 940 } 941 942 return hci_dev_test_flag(hdev, HCI_CONNECTABLE); 943 } 944 945 static void service_cache_off(struct work_struct *work) 946 { 947 struct hci_dev *hdev = container_of(work, struct hci_dev, 948 service_cache.work); 949 struct hci_request req; 950 951 if (!hci_dev_test_and_clear_flag(hdev, HCI_SERVICE_CACHE)) 952 return; 953 954 hci_req_init(&req, hdev); 955 956 hci_dev_lock(hdev); 957 958 __hci_req_update_eir(&req); 959 __hci_req_update_class(&req); 960 961 hci_dev_unlock(hdev); 962 963 hci_req_run(&req, NULL); 964 } 965 966 static void rpa_expired(struct work_struct *work) 967 { 968 struct hci_dev *hdev = container_of(work, struct hci_dev, 969 rpa_expired.work); 970 struct hci_request req; 971 972 bt_dev_dbg(hdev, ""); 973 974 hci_dev_set_flag(hdev, HCI_RPA_EXPIRED); 975 976 if (!hci_dev_test_flag(hdev, HCI_ADVERTISING)) 977 return; 978 979 /* The generation of a new RPA and programming it into the 980 * controller happens in the hci_req_enable_advertising() 981 * function. 982 */ 983 hci_req_init(&req, hdev); 984 if (ext_adv_capable(hdev)) 985 __hci_req_start_ext_adv(&req, hdev->cur_adv_instance); 986 else 987 __hci_req_enable_advertising(&req); 988 hci_req_run(&req, NULL); 989 } 990 991 static void mgmt_init_hdev(struct sock *sk, struct hci_dev *hdev) 992 { 993 if (hci_dev_test_and_set_flag(hdev, HCI_MGMT)) 994 return; 995 996 INIT_DELAYED_WORK(&hdev->service_cache, service_cache_off); 997 INIT_DELAYED_WORK(&hdev->rpa_expired, rpa_expired); 998 999 /* Non-mgmt controlled devices get this bit set 1000 * implicitly so that pairing works for them, however 1001 * for mgmt we require user-space to explicitly enable 1002 * it 1003 */ 1004 hci_dev_clear_flag(hdev, HCI_BONDABLE); 1005 } 1006 1007 static int read_controller_info(struct sock *sk, struct hci_dev *hdev, 1008 void *data, u16 data_len) 1009 { 1010 struct mgmt_rp_read_info rp; 1011 1012 bt_dev_dbg(hdev, "sock %p", sk); 1013 1014 hci_dev_lock(hdev); 1015 1016 memset(&rp, 0, sizeof(rp)); 1017 1018 bacpy(&rp.bdaddr, &hdev->bdaddr); 1019 1020 rp.version = hdev->hci_ver; 1021 rp.manufacturer = cpu_to_le16(hdev->manufacturer); 1022 1023 rp.supported_settings = cpu_to_le32(get_supported_settings(hdev)); 1024 rp.current_settings = cpu_to_le32(get_current_settings(hdev)); 1025 1026 memcpy(rp.dev_class, hdev->dev_class, 3); 1027 1028 memcpy(rp.name, hdev->dev_name, sizeof(hdev->dev_name)); 1029 memcpy(rp.short_name, hdev->short_name, sizeof(hdev->short_name)); 1030 1031 hci_dev_unlock(hdev); 1032 1033 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_INFO, 0, &rp, 1034 sizeof(rp)); 1035 } 1036 1037 static u16 append_eir_data_to_buf(struct hci_dev *hdev, u8 *eir) 1038 { 1039 u16 eir_len = 0; 1040 size_t name_len; 1041 1042 if (hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) 1043 eir_len = eir_append_data(eir, eir_len, EIR_CLASS_OF_DEV, 1044 hdev->dev_class, 3); 1045 1046 if (hci_dev_test_flag(hdev, HCI_LE_ENABLED)) 1047 eir_len = eir_append_le16(eir, eir_len, EIR_APPEARANCE, 1048 hdev->appearance); 1049 1050 name_len = strlen(hdev->dev_name); 1051 eir_len = eir_append_data(eir, eir_len, EIR_NAME_COMPLETE, 1052 hdev->dev_name, name_len); 1053 1054 name_len = strlen(hdev->short_name); 1055 eir_len = eir_append_data(eir, eir_len, EIR_NAME_SHORT, 1056 hdev->short_name, name_len); 1057 1058 return eir_len; 1059 } 1060 1061 static int read_ext_controller_info(struct sock *sk, struct hci_dev *hdev, 1062 void *data, u16 data_len) 1063 { 1064 char buf[512]; 1065 struct mgmt_rp_read_ext_info *rp = (void *)buf; 1066 u16 eir_len; 1067 1068 bt_dev_dbg(hdev, "sock %p", sk); 1069 1070 memset(&buf, 0, sizeof(buf)); 1071 1072 hci_dev_lock(hdev); 1073 1074 bacpy(&rp->bdaddr, &hdev->bdaddr); 1075 1076 rp->version = hdev->hci_ver; 1077 rp->manufacturer = cpu_to_le16(hdev->manufacturer); 1078 1079 rp->supported_settings = cpu_to_le32(get_supported_settings(hdev)); 1080 rp->current_settings = cpu_to_le32(get_current_settings(hdev)); 1081 1082 1083 eir_len = append_eir_data_to_buf(hdev, rp->eir); 1084 rp->eir_len = cpu_to_le16(eir_len); 1085 1086 hci_dev_unlock(hdev); 1087 1088 /* If this command is called at least once, then the events 1089 * for class of device and local name changes are disabled 1090 * and only the new extended controller information event 1091 * is used. 1092 */ 1093 hci_sock_set_flag(sk, HCI_MGMT_EXT_INFO_EVENTS); 1094 hci_sock_clear_flag(sk, HCI_MGMT_DEV_CLASS_EVENTS); 1095 hci_sock_clear_flag(sk, HCI_MGMT_LOCAL_NAME_EVENTS); 1096 1097 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_EXT_INFO, 0, rp, 1098 sizeof(*rp) + eir_len); 1099 } 1100 1101 static int ext_info_changed(struct hci_dev *hdev, struct sock *skip) 1102 { 1103 char buf[512]; 1104 struct mgmt_ev_ext_info_changed *ev = (void *)buf; 1105 u16 eir_len; 1106 1107 memset(buf, 0, sizeof(buf)); 1108 1109 eir_len = append_eir_data_to_buf(hdev, ev->eir); 1110 ev->eir_len = cpu_to_le16(eir_len); 1111 1112 return mgmt_limited_event(MGMT_EV_EXT_INFO_CHANGED, hdev, ev, 1113 sizeof(*ev) + eir_len, 1114 HCI_MGMT_EXT_INFO_EVENTS, skip); 1115 } 1116 1117 static int send_settings_rsp(struct sock *sk, u16 opcode, struct hci_dev *hdev) 1118 { 1119 __le32 settings = cpu_to_le32(get_current_settings(hdev)); 1120 1121 return mgmt_cmd_complete(sk, hdev->id, opcode, 0, &settings, 1122 sizeof(settings)); 1123 } 1124 1125 static void clean_up_hci_complete(struct hci_dev *hdev, u8 status, u16 opcode) 1126 { 1127 bt_dev_dbg(hdev, "status 0x%02x", status); 1128 1129 if (hci_conn_count(hdev) == 0) { 1130 cancel_delayed_work(&hdev->power_off); 1131 queue_work(hdev->req_workqueue, &hdev->power_off.work); 1132 } 1133 } 1134 1135 void mgmt_advertising_added(struct sock *sk, struct hci_dev *hdev, u8 instance) 1136 { 1137 struct mgmt_ev_advertising_added ev; 1138 1139 ev.instance = instance; 1140 1141 mgmt_event(MGMT_EV_ADVERTISING_ADDED, hdev, &ev, sizeof(ev), sk); 1142 } 1143 1144 void mgmt_advertising_removed(struct sock *sk, struct hci_dev *hdev, 1145 u8 instance) 1146 { 1147 struct mgmt_ev_advertising_removed ev; 1148 1149 ev.instance = instance; 1150 1151 mgmt_event(MGMT_EV_ADVERTISING_REMOVED, hdev, &ev, sizeof(ev), sk); 1152 } 1153 1154 static void cancel_adv_timeout(struct hci_dev *hdev) 1155 { 1156 if (hdev->adv_instance_timeout) { 1157 hdev->adv_instance_timeout = 0; 1158 cancel_delayed_work(&hdev->adv_instance_expire); 1159 } 1160 } 1161 1162 static int clean_up_hci_state(struct hci_dev *hdev) 1163 { 1164 struct hci_request req; 1165 struct hci_conn *conn; 1166 bool discov_stopped; 1167 int err; 1168 1169 hci_req_init(&req, hdev); 1170 1171 if (test_bit(HCI_ISCAN, &hdev->flags) || 1172 test_bit(HCI_PSCAN, &hdev->flags)) { 1173 u8 scan = 0x00; 1174 hci_req_add(&req, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan); 1175 } 1176 1177 hci_req_clear_adv_instance(hdev, NULL, NULL, 0x00, false); 1178 1179 if (hci_dev_test_flag(hdev, HCI_LE_ADV)) 1180 __hci_req_disable_advertising(&req); 1181 1182 discov_stopped = hci_req_stop_discovery(&req); 1183 1184 list_for_each_entry(conn, &hdev->conn_hash.list, list) { 1185 /* 0x15 == Terminated due to Power Off */ 1186 __hci_abort_conn(&req, conn, 0x15); 1187 } 1188 1189 err = hci_req_run(&req, clean_up_hci_complete); 1190 if (!err && discov_stopped) 1191 hci_discovery_set_state(hdev, DISCOVERY_STOPPING); 1192 1193 return err; 1194 } 1195 1196 static int set_powered(struct sock *sk, struct hci_dev *hdev, void *data, 1197 u16 len) 1198 { 1199 struct mgmt_mode *cp = data; 1200 struct mgmt_pending_cmd *cmd; 1201 int err; 1202 1203 bt_dev_dbg(hdev, "sock %p", sk); 1204 1205 if (cp->val != 0x00 && cp->val != 0x01) 1206 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED, 1207 MGMT_STATUS_INVALID_PARAMS); 1208 1209 hci_dev_lock(hdev); 1210 1211 if (pending_find(MGMT_OP_SET_POWERED, hdev)) { 1212 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED, 1213 MGMT_STATUS_BUSY); 1214 goto failed; 1215 } 1216 1217 if (!!cp->val == hdev_is_powered(hdev)) { 1218 err = send_settings_rsp(sk, MGMT_OP_SET_POWERED, hdev); 1219 goto failed; 1220 } 1221 1222 cmd = mgmt_pending_add(sk, MGMT_OP_SET_POWERED, hdev, data, len); 1223 if (!cmd) { 1224 err = -ENOMEM; 1225 goto failed; 1226 } 1227 1228 if (cp->val) { 1229 queue_work(hdev->req_workqueue, &hdev->power_on); 1230 err = 0; 1231 } else { 1232 /* Disconnect connections, stop scans, etc */ 1233 err = clean_up_hci_state(hdev); 1234 if (!err) 1235 queue_delayed_work(hdev->req_workqueue, &hdev->power_off, 1236 HCI_POWER_OFF_TIMEOUT); 1237 1238 /* ENODATA means there were no HCI commands queued */ 1239 if (err == -ENODATA) { 1240 cancel_delayed_work(&hdev->power_off); 1241 queue_work(hdev->req_workqueue, &hdev->power_off.work); 1242 err = 0; 1243 } 1244 } 1245 1246 failed: 1247 hci_dev_unlock(hdev); 1248 return err; 1249 } 1250 1251 static int new_settings(struct hci_dev *hdev, struct sock *skip) 1252 { 1253 __le32 ev = cpu_to_le32(get_current_settings(hdev)); 1254 1255 return mgmt_limited_event(MGMT_EV_NEW_SETTINGS, hdev, &ev, 1256 sizeof(ev), HCI_MGMT_SETTING_EVENTS, skip); 1257 } 1258 1259 int mgmt_new_settings(struct hci_dev *hdev) 1260 { 1261 return new_settings(hdev, NULL); 1262 } 1263 1264 struct cmd_lookup { 1265 struct sock *sk; 1266 struct hci_dev *hdev; 1267 u8 mgmt_status; 1268 }; 1269 1270 static void settings_rsp(struct mgmt_pending_cmd *cmd, void *data) 1271 { 1272 struct cmd_lookup *match = data; 1273 1274 send_settings_rsp(cmd->sk, cmd->opcode, match->hdev); 1275 1276 list_del(&cmd->list); 1277 1278 if (match->sk == NULL) { 1279 match->sk = cmd->sk; 1280 sock_hold(match->sk); 1281 } 1282 1283 mgmt_pending_free(cmd); 1284 } 1285 1286 static void cmd_status_rsp(struct mgmt_pending_cmd *cmd, void *data) 1287 { 1288 u8 *status = data; 1289 1290 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, *status); 1291 mgmt_pending_remove(cmd); 1292 } 1293 1294 static void cmd_complete_rsp(struct mgmt_pending_cmd *cmd, void *data) 1295 { 1296 if (cmd->cmd_complete) { 1297 u8 *status = data; 1298 1299 cmd->cmd_complete(cmd, *status); 1300 mgmt_pending_remove(cmd); 1301 1302 return; 1303 } 1304 1305 cmd_status_rsp(cmd, data); 1306 } 1307 1308 static int generic_cmd_complete(struct mgmt_pending_cmd *cmd, u8 status) 1309 { 1310 return mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, status, 1311 cmd->param, cmd->param_len); 1312 } 1313 1314 static int addr_cmd_complete(struct mgmt_pending_cmd *cmd, u8 status) 1315 { 1316 return mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, status, 1317 cmd->param, sizeof(struct mgmt_addr_info)); 1318 } 1319 1320 static u8 mgmt_bredr_support(struct hci_dev *hdev) 1321 { 1322 if (!lmp_bredr_capable(hdev)) 1323 return MGMT_STATUS_NOT_SUPPORTED; 1324 else if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) 1325 return MGMT_STATUS_REJECTED; 1326 else 1327 return MGMT_STATUS_SUCCESS; 1328 } 1329 1330 static u8 mgmt_le_support(struct hci_dev *hdev) 1331 { 1332 if (!lmp_le_capable(hdev)) 1333 return MGMT_STATUS_NOT_SUPPORTED; 1334 else if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED)) 1335 return MGMT_STATUS_REJECTED; 1336 else 1337 return MGMT_STATUS_SUCCESS; 1338 } 1339 1340 void mgmt_set_discoverable_complete(struct hci_dev *hdev, u8 status) 1341 { 1342 struct mgmt_pending_cmd *cmd; 1343 1344 bt_dev_dbg(hdev, "status 0x%02x", status); 1345 1346 hci_dev_lock(hdev); 1347 1348 cmd = pending_find(MGMT_OP_SET_DISCOVERABLE, hdev); 1349 if (!cmd) 1350 goto unlock; 1351 1352 if (status) { 1353 u8 mgmt_err = mgmt_status(status); 1354 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err); 1355 hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE); 1356 goto remove_cmd; 1357 } 1358 1359 if (hci_dev_test_flag(hdev, HCI_DISCOVERABLE) && 1360 hdev->discov_timeout > 0) { 1361 int to = msecs_to_jiffies(hdev->discov_timeout * 1000); 1362 queue_delayed_work(hdev->req_workqueue, &hdev->discov_off, to); 1363 } 1364 1365 send_settings_rsp(cmd->sk, MGMT_OP_SET_DISCOVERABLE, hdev); 1366 new_settings(hdev, cmd->sk); 1367 1368 remove_cmd: 1369 mgmt_pending_remove(cmd); 1370 1371 unlock: 1372 hci_dev_unlock(hdev); 1373 } 1374 1375 static int set_discoverable(struct sock *sk, struct hci_dev *hdev, void *data, 1376 u16 len) 1377 { 1378 struct mgmt_cp_set_discoverable *cp = data; 1379 struct mgmt_pending_cmd *cmd; 1380 u16 timeout; 1381 int err; 1382 1383 bt_dev_dbg(hdev, "sock %p", sk); 1384 1385 if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED) && 1386 !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) 1387 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE, 1388 MGMT_STATUS_REJECTED); 1389 1390 if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02) 1391 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE, 1392 MGMT_STATUS_INVALID_PARAMS); 1393 1394 timeout = __le16_to_cpu(cp->timeout); 1395 1396 /* Disabling discoverable requires that no timeout is set, 1397 * and enabling limited discoverable requires a timeout. 1398 */ 1399 if ((cp->val == 0x00 && timeout > 0) || 1400 (cp->val == 0x02 && timeout == 0)) 1401 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE, 1402 MGMT_STATUS_INVALID_PARAMS); 1403 1404 hci_dev_lock(hdev); 1405 1406 if (!hdev_is_powered(hdev) && timeout > 0) { 1407 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE, 1408 MGMT_STATUS_NOT_POWERED); 1409 goto failed; 1410 } 1411 1412 if (pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) || 1413 pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) { 1414 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE, 1415 MGMT_STATUS_BUSY); 1416 goto failed; 1417 } 1418 1419 if (!hci_dev_test_flag(hdev, HCI_CONNECTABLE)) { 1420 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE, 1421 MGMT_STATUS_REJECTED); 1422 goto failed; 1423 } 1424 1425 if (hdev->advertising_paused) { 1426 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE, 1427 MGMT_STATUS_BUSY); 1428 goto failed; 1429 } 1430 1431 if (!hdev_is_powered(hdev)) { 1432 bool changed = false; 1433 1434 /* Setting limited discoverable when powered off is 1435 * not a valid operation since it requires a timeout 1436 * and so no need to check HCI_LIMITED_DISCOVERABLE. 1437 */ 1438 if (!!cp->val != hci_dev_test_flag(hdev, HCI_DISCOVERABLE)) { 1439 hci_dev_change_flag(hdev, HCI_DISCOVERABLE); 1440 changed = true; 1441 } 1442 1443 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev); 1444 if (err < 0) 1445 goto failed; 1446 1447 if (changed) 1448 err = new_settings(hdev, sk); 1449 1450 goto failed; 1451 } 1452 1453 /* If the current mode is the same, then just update the timeout 1454 * value with the new value. And if only the timeout gets updated, 1455 * then no need for any HCI transactions. 1456 */ 1457 if (!!cp->val == hci_dev_test_flag(hdev, HCI_DISCOVERABLE) && 1458 (cp->val == 0x02) == hci_dev_test_flag(hdev, 1459 HCI_LIMITED_DISCOVERABLE)) { 1460 cancel_delayed_work(&hdev->discov_off); 1461 hdev->discov_timeout = timeout; 1462 1463 if (cp->val && hdev->discov_timeout > 0) { 1464 int to = msecs_to_jiffies(hdev->discov_timeout * 1000); 1465 queue_delayed_work(hdev->req_workqueue, 1466 &hdev->discov_off, to); 1467 } 1468 1469 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev); 1470 goto failed; 1471 } 1472 1473 cmd = mgmt_pending_add(sk, MGMT_OP_SET_DISCOVERABLE, hdev, data, len); 1474 if (!cmd) { 1475 err = -ENOMEM; 1476 goto failed; 1477 } 1478 1479 /* Cancel any potential discoverable timeout that might be 1480 * still active and store new timeout value. The arming of 1481 * the timeout happens in the complete handler. 1482 */ 1483 cancel_delayed_work(&hdev->discov_off); 1484 hdev->discov_timeout = timeout; 1485 1486 if (cp->val) 1487 hci_dev_set_flag(hdev, HCI_DISCOVERABLE); 1488 else 1489 hci_dev_clear_flag(hdev, HCI_DISCOVERABLE); 1490 1491 /* Limited discoverable mode */ 1492 if (cp->val == 0x02) 1493 hci_dev_set_flag(hdev, HCI_LIMITED_DISCOVERABLE); 1494 else 1495 hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE); 1496 1497 queue_work(hdev->req_workqueue, &hdev->discoverable_update); 1498 err = 0; 1499 1500 failed: 1501 hci_dev_unlock(hdev); 1502 return err; 1503 } 1504 1505 void mgmt_set_connectable_complete(struct hci_dev *hdev, u8 status) 1506 { 1507 struct mgmt_pending_cmd *cmd; 1508 1509 bt_dev_dbg(hdev, "status 0x%02x", status); 1510 1511 hci_dev_lock(hdev); 1512 1513 cmd = pending_find(MGMT_OP_SET_CONNECTABLE, hdev); 1514 if (!cmd) 1515 goto unlock; 1516 1517 if (status) { 1518 u8 mgmt_err = mgmt_status(status); 1519 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err); 1520 goto remove_cmd; 1521 } 1522 1523 send_settings_rsp(cmd->sk, MGMT_OP_SET_CONNECTABLE, hdev); 1524 new_settings(hdev, cmd->sk); 1525 1526 remove_cmd: 1527 mgmt_pending_remove(cmd); 1528 1529 unlock: 1530 hci_dev_unlock(hdev); 1531 } 1532 1533 static int set_connectable_update_settings(struct hci_dev *hdev, 1534 struct sock *sk, u8 val) 1535 { 1536 bool changed = false; 1537 int err; 1538 1539 if (!!val != hci_dev_test_flag(hdev, HCI_CONNECTABLE)) 1540 changed = true; 1541 1542 if (val) { 1543 hci_dev_set_flag(hdev, HCI_CONNECTABLE); 1544 } else { 1545 hci_dev_clear_flag(hdev, HCI_CONNECTABLE); 1546 hci_dev_clear_flag(hdev, HCI_DISCOVERABLE); 1547 } 1548 1549 err = send_settings_rsp(sk, MGMT_OP_SET_CONNECTABLE, hdev); 1550 if (err < 0) 1551 return err; 1552 1553 if (changed) { 1554 hci_req_update_scan(hdev); 1555 hci_update_background_scan(hdev); 1556 return new_settings(hdev, sk); 1557 } 1558 1559 return 0; 1560 } 1561 1562 static int set_connectable(struct sock *sk, struct hci_dev *hdev, void *data, 1563 u16 len) 1564 { 1565 struct mgmt_mode *cp = data; 1566 struct mgmt_pending_cmd *cmd; 1567 int err; 1568 1569 bt_dev_dbg(hdev, "sock %p", sk); 1570 1571 if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED) && 1572 !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) 1573 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE, 1574 MGMT_STATUS_REJECTED); 1575 1576 if (cp->val != 0x00 && cp->val != 0x01) 1577 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE, 1578 MGMT_STATUS_INVALID_PARAMS); 1579 1580 hci_dev_lock(hdev); 1581 1582 if (!hdev_is_powered(hdev)) { 1583 err = set_connectable_update_settings(hdev, sk, cp->val); 1584 goto failed; 1585 } 1586 1587 if (pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) || 1588 pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) { 1589 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE, 1590 MGMT_STATUS_BUSY); 1591 goto failed; 1592 } 1593 1594 cmd = mgmt_pending_add(sk, MGMT_OP_SET_CONNECTABLE, hdev, data, len); 1595 if (!cmd) { 1596 err = -ENOMEM; 1597 goto failed; 1598 } 1599 1600 if (cp->val) { 1601 hci_dev_set_flag(hdev, HCI_CONNECTABLE); 1602 } else { 1603 if (hdev->discov_timeout > 0) 1604 cancel_delayed_work(&hdev->discov_off); 1605 1606 hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE); 1607 hci_dev_clear_flag(hdev, HCI_DISCOVERABLE); 1608 hci_dev_clear_flag(hdev, HCI_CONNECTABLE); 1609 } 1610 1611 queue_work(hdev->req_workqueue, &hdev->connectable_update); 1612 err = 0; 1613 1614 failed: 1615 hci_dev_unlock(hdev); 1616 return err; 1617 } 1618 1619 static int set_bondable(struct sock *sk, struct hci_dev *hdev, void *data, 1620 u16 len) 1621 { 1622 struct mgmt_mode *cp = data; 1623 bool changed; 1624 int err; 1625 1626 bt_dev_dbg(hdev, "sock %p", sk); 1627 1628 if (cp->val != 0x00 && cp->val != 0x01) 1629 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BONDABLE, 1630 MGMT_STATUS_INVALID_PARAMS); 1631 1632 hci_dev_lock(hdev); 1633 1634 if (cp->val) 1635 changed = !hci_dev_test_and_set_flag(hdev, HCI_BONDABLE); 1636 else 1637 changed = hci_dev_test_and_clear_flag(hdev, HCI_BONDABLE); 1638 1639 err = send_settings_rsp(sk, MGMT_OP_SET_BONDABLE, hdev); 1640 if (err < 0) 1641 goto unlock; 1642 1643 if (changed) { 1644 /* In limited privacy mode the change of bondable mode 1645 * may affect the local advertising address. 1646 */ 1647 if (hdev_is_powered(hdev) && 1648 hci_dev_test_flag(hdev, HCI_ADVERTISING) && 1649 hci_dev_test_flag(hdev, HCI_DISCOVERABLE) && 1650 hci_dev_test_flag(hdev, HCI_LIMITED_PRIVACY)) 1651 queue_work(hdev->req_workqueue, 1652 &hdev->discoverable_update); 1653 1654 err = new_settings(hdev, sk); 1655 } 1656 1657 unlock: 1658 hci_dev_unlock(hdev); 1659 return err; 1660 } 1661 1662 static int set_link_security(struct sock *sk, struct hci_dev *hdev, void *data, 1663 u16 len) 1664 { 1665 struct mgmt_mode *cp = data; 1666 struct mgmt_pending_cmd *cmd; 1667 u8 val, status; 1668 int err; 1669 1670 bt_dev_dbg(hdev, "sock %p", sk); 1671 1672 status = mgmt_bredr_support(hdev); 1673 if (status) 1674 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY, 1675 status); 1676 1677 if (cp->val != 0x00 && cp->val != 0x01) 1678 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY, 1679 MGMT_STATUS_INVALID_PARAMS); 1680 1681 hci_dev_lock(hdev); 1682 1683 if (!hdev_is_powered(hdev)) { 1684 bool changed = false; 1685 1686 if (!!cp->val != hci_dev_test_flag(hdev, HCI_LINK_SECURITY)) { 1687 hci_dev_change_flag(hdev, HCI_LINK_SECURITY); 1688 changed = true; 1689 } 1690 1691 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev); 1692 if (err < 0) 1693 goto failed; 1694 1695 if (changed) 1696 err = new_settings(hdev, sk); 1697 1698 goto failed; 1699 } 1700 1701 if (pending_find(MGMT_OP_SET_LINK_SECURITY, hdev)) { 1702 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY, 1703 MGMT_STATUS_BUSY); 1704 goto failed; 1705 } 1706 1707 val = !!cp->val; 1708 1709 if (test_bit(HCI_AUTH, &hdev->flags) == val) { 1710 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev); 1711 goto failed; 1712 } 1713 1714 cmd = mgmt_pending_add(sk, MGMT_OP_SET_LINK_SECURITY, hdev, data, len); 1715 if (!cmd) { 1716 err = -ENOMEM; 1717 goto failed; 1718 } 1719 1720 err = hci_send_cmd(hdev, HCI_OP_WRITE_AUTH_ENABLE, sizeof(val), &val); 1721 if (err < 0) { 1722 mgmt_pending_remove(cmd); 1723 goto failed; 1724 } 1725 1726 failed: 1727 hci_dev_unlock(hdev); 1728 return err; 1729 } 1730 1731 static int set_ssp(struct sock *sk, struct hci_dev *hdev, void *data, u16 len) 1732 { 1733 struct mgmt_mode *cp = data; 1734 struct mgmt_pending_cmd *cmd; 1735 u8 status; 1736 int err; 1737 1738 bt_dev_dbg(hdev, "sock %p", sk); 1739 1740 status = mgmt_bredr_support(hdev); 1741 if (status) 1742 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP, status); 1743 1744 if (!lmp_ssp_capable(hdev)) 1745 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP, 1746 MGMT_STATUS_NOT_SUPPORTED); 1747 1748 if (cp->val != 0x00 && cp->val != 0x01) 1749 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP, 1750 MGMT_STATUS_INVALID_PARAMS); 1751 1752 hci_dev_lock(hdev); 1753 1754 if (!hdev_is_powered(hdev)) { 1755 bool changed; 1756 1757 if (cp->val) { 1758 changed = !hci_dev_test_and_set_flag(hdev, 1759 HCI_SSP_ENABLED); 1760 } else { 1761 changed = hci_dev_test_and_clear_flag(hdev, 1762 HCI_SSP_ENABLED); 1763 if (!changed) 1764 changed = hci_dev_test_and_clear_flag(hdev, 1765 HCI_HS_ENABLED); 1766 else 1767 hci_dev_clear_flag(hdev, HCI_HS_ENABLED); 1768 } 1769 1770 err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev); 1771 if (err < 0) 1772 goto failed; 1773 1774 if (changed) 1775 err = new_settings(hdev, sk); 1776 1777 goto failed; 1778 } 1779 1780 if (pending_find(MGMT_OP_SET_SSP, hdev)) { 1781 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP, 1782 MGMT_STATUS_BUSY); 1783 goto failed; 1784 } 1785 1786 if (!!cp->val == hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) { 1787 err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev); 1788 goto failed; 1789 } 1790 1791 cmd = mgmt_pending_add(sk, MGMT_OP_SET_SSP, hdev, data, len); 1792 if (!cmd) { 1793 err = -ENOMEM; 1794 goto failed; 1795 } 1796 1797 if (!cp->val && hci_dev_test_flag(hdev, HCI_USE_DEBUG_KEYS)) 1798 hci_send_cmd(hdev, HCI_OP_WRITE_SSP_DEBUG_MODE, 1799 sizeof(cp->val), &cp->val); 1800 1801 err = hci_send_cmd(hdev, HCI_OP_WRITE_SSP_MODE, 1, &cp->val); 1802 if (err < 0) { 1803 mgmt_pending_remove(cmd); 1804 goto failed; 1805 } 1806 1807 failed: 1808 hci_dev_unlock(hdev); 1809 return err; 1810 } 1811 1812 static int set_hs(struct sock *sk, struct hci_dev *hdev, void *data, u16 len) 1813 { 1814 struct mgmt_mode *cp = data; 1815 bool changed; 1816 u8 status; 1817 int err; 1818 1819 bt_dev_dbg(hdev, "sock %p", sk); 1820 1821 if (!IS_ENABLED(CONFIG_BT_HS)) 1822 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS, 1823 MGMT_STATUS_NOT_SUPPORTED); 1824 1825 status = mgmt_bredr_support(hdev); 1826 if (status) 1827 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS, status); 1828 1829 if (!lmp_ssp_capable(hdev)) 1830 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS, 1831 MGMT_STATUS_NOT_SUPPORTED); 1832 1833 if (!hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) 1834 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS, 1835 MGMT_STATUS_REJECTED); 1836 1837 if (cp->val != 0x00 && cp->val != 0x01) 1838 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS, 1839 MGMT_STATUS_INVALID_PARAMS); 1840 1841 hci_dev_lock(hdev); 1842 1843 if (pending_find(MGMT_OP_SET_SSP, hdev)) { 1844 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS, 1845 MGMT_STATUS_BUSY); 1846 goto unlock; 1847 } 1848 1849 if (cp->val) { 1850 changed = !hci_dev_test_and_set_flag(hdev, HCI_HS_ENABLED); 1851 } else { 1852 if (hdev_is_powered(hdev)) { 1853 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS, 1854 MGMT_STATUS_REJECTED); 1855 goto unlock; 1856 } 1857 1858 changed = hci_dev_test_and_clear_flag(hdev, HCI_HS_ENABLED); 1859 } 1860 1861 err = send_settings_rsp(sk, MGMT_OP_SET_HS, hdev); 1862 if (err < 0) 1863 goto unlock; 1864 1865 if (changed) 1866 err = new_settings(hdev, sk); 1867 1868 unlock: 1869 hci_dev_unlock(hdev); 1870 return err; 1871 } 1872 1873 static void le_enable_complete(struct hci_dev *hdev, u8 status, u16 opcode) 1874 { 1875 struct cmd_lookup match = { NULL, hdev }; 1876 1877 hci_dev_lock(hdev); 1878 1879 if (status) { 1880 u8 mgmt_err = mgmt_status(status); 1881 1882 mgmt_pending_foreach(MGMT_OP_SET_LE, hdev, cmd_status_rsp, 1883 &mgmt_err); 1884 goto unlock; 1885 } 1886 1887 mgmt_pending_foreach(MGMT_OP_SET_LE, hdev, settings_rsp, &match); 1888 1889 new_settings(hdev, match.sk); 1890 1891 if (match.sk) 1892 sock_put(match.sk); 1893 1894 /* Make sure the controller has a good default for 1895 * advertising data. Restrict the update to when LE 1896 * has actually been enabled. During power on, the 1897 * update in powered_update_hci will take care of it. 1898 */ 1899 if (hci_dev_test_flag(hdev, HCI_LE_ENABLED)) { 1900 struct hci_request req; 1901 hci_req_init(&req, hdev); 1902 if (ext_adv_capable(hdev)) { 1903 int err; 1904 1905 err = __hci_req_setup_ext_adv_instance(&req, 0x00); 1906 if (!err) 1907 __hci_req_update_scan_rsp_data(&req, 0x00); 1908 } else { 1909 __hci_req_update_adv_data(&req, 0x00); 1910 __hci_req_update_scan_rsp_data(&req, 0x00); 1911 } 1912 hci_req_run(&req, NULL); 1913 hci_update_background_scan(hdev); 1914 } 1915 1916 unlock: 1917 hci_dev_unlock(hdev); 1918 } 1919 1920 static int set_le(struct sock *sk, struct hci_dev *hdev, void *data, u16 len) 1921 { 1922 struct mgmt_mode *cp = data; 1923 struct hci_cp_write_le_host_supported hci_cp; 1924 struct mgmt_pending_cmd *cmd; 1925 struct hci_request req; 1926 int err; 1927 u8 val, enabled; 1928 1929 bt_dev_dbg(hdev, "sock %p", sk); 1930 1931 if (!lmp_le_capable(hdev)) 1932 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE, 1933 MGMT_STATUS_NOT_SUPPORTED); 1934 1935 if (cp->val != 0x00 && cp->val != 0x01) 1936 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE, 1937 MGMT_STATUS_INVALID_PARAMS); 1938 1939 /* Bluetooth single mode LE only controllers or dual-mode 1940 * controllers configured as LE only devices, do not allow 1941 * switching LE off. These have either LE enabled explicitly 1942 * or BR/EDR has been previously switched off. 1943 * 1944 * When trying to enable an already enabled LE, then gracefully 1945 * send a positive response. Trying to disable it however will 1946 * result into rejection. 1947 */ 1948 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) { 1949 if (cp->val == 0x01) 1950 return send_settings_rsp(sk, MGMT_OP_SET_LE, hdev); 1951 1952 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE, 1953 MGMT_STATUS_REJECTED); 1954 } 1955 1956 hci_dev_lock(hdev); 1957 1958 val = !!cp->val; 1959 enabled = lmp_host_le_capable(hdev); 1960 1961 if (!val) 1962 hci_req_clear_adv_instance(hdev, NULL, NULL, 0x00, true); 1963 1964 if (!hdev_is_powered(hdev) || val == enabled) { 1965 bool changed = false; 1966 1967 if (val != hci_dev_test_flag(hdev, HCI_LE_ENABLED)) { 1968 hci_dev_change_flag(hdev, HCI_LE_ENABLED); 1969 changed = true; 1970 } 1971 1972 if (!val && hci_dev_test_flag(hdev, HCI_ADVERTISING)) { 1973 hci_dev_clear_flag(hdev, HCI_ADVERTISING); 1974 changed = true; 1975 } 1976 1977 err = send_settings_rsp(sk, MGMT_OP_SET_LE, hdev); 1978 if (err < 0) 1979 goto unlock; 1980 1981 if (changed) 1982 err = new_settings(hdev, sk); 1983 1984 goto unlock; 1985 } 1986 1987 if (pending_find(MGMT_OP_SET_LE, hdev) || 1988 pending_find(MGMT_OP_SET_ADVERTISING, hdev)) { 1989 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE, 1990 MGMT_STATUS_BUSY); 1991 goto unlock; 1992 } 1993 1994 cmd = mgmt_pending_add(sk, MGMT_OP_SET_LE, hdev, data, len); 1995 if (!cmd) { 1996 err = -ENOMEM; 1997 goto unlock; 1998 } 1999 2000 hci_req_init(&req, hdev); 2001 2002 memset(&hci_cp, 0, sizeof(hci_cp)); 2003 2004 if (val) { 2005 hci_cp.le = val; 2006 hci_cp.simul = 0x00; 2007 } else { 2008 if (hci_dev_test_flag(hdev, HCI_LE_ADV)) 2009 __hci_req_disable_advertising(&req); 2010 2011 if (ext_adv_capable(hdev)) 2012 __hci_req_clear_ext_adv_sets(&req); 2013 } 2014 2015 hci_req_add(&req, HCI_OP_WRITE_LE_HOST_SUPPORTED, sizeof(hci_cp), 2016 &hci_cp); 2017 2018 err = hci_req_run(&req, le_enable_complete); 2019 if (err < 0) 2020 mgmt_pending_remove(cmd); 2021 2022 unlock: 2023 hci_dev_unlock(hdev); 2024 return err; 2025 } 2026 2027 /* This is a helper function to test for pending mgmt commands that can 2028 * cause CoD or EIR HCI commands. We can only allow one such pending 2029 * mgmt command at a time since otherwise we cannot easily track what 2030 * the current values are, will be, and based on that calculate if a new 2031 * HCI command needs to be sent and if yes with what value. 2032 */ 2033 static bool pending_eir_or_class(struct hci_dev *hdev) 2034 { 2035 struct mgmt_pending_cmd *cmd; 2036 2037 list_for_each_entry(cmd, &hdev->mgmt_pending, list) { 2038 switch (cmd->opcode) { 2039 case MGMT_OP_ADD_UUID: 2040 case MGMT_OP_REMOVE_UUID: 2041 case MGMT_OP_SET_DEV_CLASS: 2042 case MGMT_OP_SET_POWERED: 2043 return true; 2044 } 2045 } 2046 2047 return false; 2048 } 2049 2050 static const u8 bluetooth_base_uuid[] = { 2051 0xfb, 0x34, 0x9b, 0x5f, 0x80, 0x00, 0x00, 0x80, 2052 0x00, 0x10, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 2053 }; 2054 2055 static u8 get_uuid_size(const u8 *uuid) 2056 { 2057 u32 val; 2058 2059 if (memcmp(uuid, bluetooth_base_uuid, 12)) 2060 return 128; 2061 2062 val = get_unaligned_le32(&uuid[12]); 2063 if (val > 0xffff) 2064 return 32; 2065 2066 return 16; 2067 } 2068 2069 static void mgmt_class_complete(struct hci_dev *hdev, u16 mgmt_op, u8 status) 2070 { 2071 struct mgmt_pending_cmd *cmd; 2072 2073 hci_dev_lock(hdev); 2074 2075 cmd = pending_find(mgmt_op, hdev); 2076 if (!cmd) 2077 goto unlock; 2078 2079 mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, 2080 mgmt_status(status), hdev->dev_class, 3); 2081 2082 mgmt_pending_remove(cmd); 2083 2084 unlock: 2085 hci_dev_unlock(hdev); 2086 } 2087 2088 static void add_uuid_complete(struct hci_dev *hdev, u8 status, u16 opcode) 2089 { 2090 bt_dev_dbg(hdev, "status 0x%02x", status); 2091 2092 mgmt_class_complete(hdev, MGMT_OP_ADD_UUID, status); 2093 } 2094 2095 static int add_uuid(struct sock *sk, struct hci_dev *hdev, void *data, u16 len) 2096 { 2097 struct mgmt_cp_add_uuid *cp = data; 2098 struct mgmt_pending_cmd *cmd; 2099 struct hci_request req; 2100 struct bt_uuid *uuid; 2101 int err; 2102 2103 bt_dev_dbg(hdev, "sock %p", sk); 2104 2105 hci_dev_lock(hdev); 2106 2107 if (pending_eir_or_class(hdev)) { 2108 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_UUID, 2109 MGMT_STATUS_BUSY); 2110 goto failed; 2111 } 2112 2113 uuid = kmalloc(sizeof(*uuid), GFP_KERNEL); 2114 if (!uuid) { 2115 err = -ENOMEM; 2116 goto failed; 2117 } 2118 2119 memcpy(uuid->uuid, cp->uuid, 16); 2120 uuid->svc_hint = cp->svc_hint; 2121 uuid->size = get_uuid_size(cp->uuid); 2122 2123 list_add_tail(&uuid->list, &hdev->uuids); 2124 2125 hci_req_init(&req, hdev); 2126 2127 __hci_req_update_class(&req); 2128 __hci_req_update_eir(&req); 2129 2130 err = hci_req_run(&req, add_uuid_complete); 2131 if (err < 0) { 2132 if (err != -ENODATA) 2133 goto failed; 2134 2135 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_UUID, 0, 2136 hdev->dev_class, 3); 2137 goto failed; 2138 } 2139 2140 cmd = mgmt_pending_add(sk, MGMT_OP_ADD_UUID, hdev, data, len); 2141 if (!cmd) { 2142 err = -ENOMEM; 2143 goto failed; 2144 } 2145 2146 err = 0; 2147 2148 failed: 2149 hci_dev_unlock(hdev); 2150 return err; 2151 } 2152 2153 static bool enable_service_cache(struct hci_dev *hdev) 2154 { 2155 if (!hdev_is_powered(hdev)) 2156 return false; 2157 2158 if (!hci_dev_test_and_set_flag(hdev, HCI_SERVICE_CACHE)) { 2159 queue_delayed_work(hdev->workqueue, &hdev->service_cache, 2160 CACHE_TIMEOUT); 2161 return true; 2162 } 2163 2164 return false; 2165 } 2166 2167 static void remove_uuid_complete(struct hci_dev *hdev, u8 status, u16 opcode) 2168 { 2169 bt_dev_dbg(hdev, "status 0x%02x", status); 2170 2171 mgmt_class_complete(hdev, MGMT_OP_REMOVE_UUID, status); 2172 } 2173 2174 static int remove_uuid(struct sock *sk, struct hci_dev *hdev, void *data, 2175 u16 len) 2176 { 2177 struct mgmt_cp_remove_uuid *cp = data; 2178 struct mgmt_pending_cmd *cmd; 2179 struct bt_uuid *match, *tmp; 2180 u8 bt_uuid_any[] = { 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 }; 2181 struct hci_request req; 2182 int err, found; 2183 2184 bt_dev_dbg(hdev, "sock %p", sk); 2185 2186 hci_dev_lock(hdev); 2187 2188 if (pending_eir_or_class(hdev)) { 2189 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID, 2190 MGMT_STATUS_BUSY); 2191 goto unlock; 2192 } 2193 2194 if (memcmp(cp->uuid, bt_uuid_any, 16) == 0) { 2195 hci_uuids_clear(hdev); 2196 2197 if (enable_service_cache(hdev)) { 2198 err = mgmt_cmd_complete(sk, hdev->id, 2199 MGMT_OP_REMOVE_UUID, 2200 0, hdev->dev_class, 3); 2201 goto unlock; 2202 } 2203 2204 goto update_class; 2205 } 2206 2207 found = 0; 2208 2209 list_for_each_entry_safe(match, tmp, &hdev->uuids, list) { 2210 if (memcmp(match->uuid, cp->uuid, 16) != 0) 2211 continue; 2212 2213 list_del(&match->list); 2214 kfree(match); 2215 found++; 2216 } 2217 2218 if (found == 0) { 2219 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID, 2220 MGMT_STATUS_INVALID_PARAMS); 2221 goto unlock; 2222 } 2223 2224 update_class: 2225 hci_req_init(&req, hdev); 2226 2227 __hci_req_update_class(&req); 2228 __hci_req_update_eir(&req); 2229 2230 err = hci_req_run(&req, remove_uuid_complete); 2231 if (err < 0) { 2232 if (err != -ENODATA) 2233 goto unlock; 2234 2235 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_UUID, 0, 2236 hdev->dev_class, 3); 2237 goto unlock; 2238 } 2239 2240 cmd = mgmt_pending_add(sk, MGMT_OP_REMOVE_UUID, hdev, data, len); 2241 if (!cmd) { 2242 err = -ENOMEM; 2243 goto unlock; 2244 } 2245 2246 err = 0; 2247 2248 unlock: 2249 hci_dev_unlock(hdev); 2250 return err; 2251 } 2252 2253 static void set_class_complete(struct hci_dev *hdev, u8 status, u16 opcode) 2254 { 2255 bt_dev_dbg(hdev, "status 0x%02x", status); 2256 2257 mgmt_class_complete(hdev, MGMT_OP_SET_DEV_CLASS, status); 2258 } 2259 2260 static int set_dev_class(struct sock *sk, struct hci_dev *hdev, void *data, 2261 u16 len) 2262 { 2263 struct mgmt_cp_set_dev_class *cp = data; 2264 struct mgmt_pending_cmd *cmd; 2265 struct hci_request req; 2266 int err; 2267 2268 bt_dev_dbg(hdev, "sock %p", sk); 2269 2270 if (!lmp_bredr_capable(hdev)) 2271 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 2272 MGMT_STATUS_NOT_SUPPORTED); 2273 2274 hci_dev_lock(hdev); 2275 2276 if (pending_eir_or_class(hdev)) { 2277 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 2278 MGMT_STATUS_BUSY); 2279 goto unlock; 2280 } 2281 2282 if ((cp->minor & 0x03) != 0 || (cp->major & 0xe0) != 0) { 2283 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 2284 MGMT_STATUS_INVALID_PARAMS); 2285 goto unlock; 2286 } 2287 2288 hdev->major_class = cp->major; 2289 hdev->minor_class = cp->minor; 2290 2291 if (!hdev_is_powered(hdev)) { 2292 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 0, 2293 hdev->dev_class, 3); 2294 goto unlock; 2295 } 2296 2297 hci_req_init(&req, hdev); 2298 2299 if (hci_dev_test_and_clear_flag(hdev, HCI_SERVICE_CACHE)) { 2300 hci_dev_unlock(hdev); 2301 cancel_delayed_work_sync(&hdev->service_cache); 2302 hci_dev_lock(hdev); 2303 __hci_req_update_eir(&req); 2304 } 2305 2306 __hci_req_update_class(&req); 2307 2308 err = hci_req_run(&req, set_class_complete); 2309 if (err < 0) { 2310 if (err != -ENODATA) 2311 goto unlock; 2312 2313 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 0, 2314 hdev->dev_class, 3); 2315 goto unlock; 2316 } 2317 2318 cmd = mgmt_pending_add(sk, MGMT_OP_SET_DEV_CLASS, hdev, data, len); 2319 if (!cmd) { 2320 err = -ENOMEM; 2321 goto unlock; 2322 } 2323 2324 err = 0; 2325 2326 unlock: 2327 hci_dev_unlock(hdev); 2328 return err; 2329 } 2330 2331 static int load_link_keys(struct sock *sk, struct hci_dev *hdev, void *data, 2332 u16 len) 2333 { 2334 struct mgmt_cp_load_link_keys *cp = data; 2335 const u16 max_key_count = ((U16_MAX - sizeof(*cp)) / 2336 sizeof(struct mgmt_link_key_info)); 2337 u16 key_count, expected_len; 2338 bool changed; 2339 int i; 2340 2341 bt_dev_dbg(hdev, "sock %p", sk); 2342 2343 if (!lmp_bredr_capable(hdev)) 2344 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS, 2345 MGMT_STATUS_NOT_SUPPORTED); 2346 2347 key_count = __le16_to_cpu(cp->key_count); 2348 if (key_count > max_key_count) { 2349 bt_dev_err(hdev, "load_link_keys: too big key_count value %u", 2350 key_count); 2351 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS, 2352 MGMT_STATUS_INVALID_PARAMS); 2353 } 2354 2355 expected_len = struct_size(cp, keys, key_count); 2356 if (expected_len != len) { 2357 bt_dev_err(hdev, "load_link_keys: expected %u bytes, got %u bytes", 2358 expected_len, len); 2359 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS, 2360 MGMT_STATUS_INVALID_PARAMS); 2361 } 2362 2363 if (cp->debug_keys != 0x00 && cp->debug_keys != 0x01) 2364 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS, 2365 MGMT_STATUS_INVALID_PARAMS); 2366 2367 bt_dev_dbg(hdev, "debug_keys %u key_count %u", cp->debug_keys, 2368 key_count); 2369 2370 for (i = 0; i < key_count; i++) { 2371 struct mgmt_link_key_info *key = &cp->keys[i]; 2372 2373 if (key->addr.type != BDADDR_BREDR || key->type > 0x08) 2374 return mgmt_cmd_status(sk, hdev->id, 2375 MGMT_OP_LOAD_LINK_KEYS, 2376 MGMT_STATUS_INVALID_PARAMS); 2377 } 2378 2379 hci_dev_lock(hdev); 2380 2381 hci_link_keys_clear(hdev); 2382 2383 if (cp->debug_keys) 2384 changed = !hci_dev_test_and_set_flag(hdev, HCI_KEEP_DEBUG_KEYS); 2385 else 2386 changed = hci_dev_test_and_clear_flag(hdev, 2387 HCI_KEEP_DEBUG_KEYS); 2388 2389 if (changed) 2390 new_settings(hdev, NULL); 2391 2392 for (i = 0; i < key_count; i++) { 2393 struct mgmt_link_key_info *key = &cp->keys[i]; 2394 2395 if (hci_is_blocked_key(hdev, 2396 HCI_BLOCKED_KEY_TYPE_LINKKEY, 2397 key->val)) { 2398 bt_dev_warn(hdev, "Skipping blocked link key for %pMR", 2399 &key->addr.bdaddr); 2400 continue; 2401 } 2402 2403 /* Always ignore debug keys and require a new pairing if 2404 * the user wants to use them. 2405 */ 2406 if (key->type == HCI_LK_DEBUG_COMBINATION) 2407 continue; 2408 2409 hci_add_link_key(hdev, NULL, &key->addr.bdaddr, key->val, 2410 key->type, key->pin_len, NULL); 2411 } 2412 2413 mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS, 0, NULL, 0); 2414 2415 hci_dev_unlock(hdev); 2416 2417 return 0; 2418 } 2419 2420 static int device_unpaired(struct hci_dev *hdev, bdaddr_t *bdaddr, 2421 u8 addr_type, struct sock *skip_sk) 2422 { 2423 struct mgmt_ev_device_unpaired ev; 2424 2425 bacpy(&ev.addr.bdaddr, bdaddr); 2426 ev.addr.type = addr_type; 2427 2428 return mgmt_event(MGMT_EV_DEVICE_UNPAIRED, hdev, &ev, sizeof(ev), 2429 skip_sk); 2430 } 2431 2432 static int unpair_device(struct sock *sk, struct hci_dev *hdev, void *data, 2433 u16 len) 2434 { 2435 struct mgmt_cp_unpair_device *cp = data; 2436 struct mgmt_rp_unpair_device rp; 2437 struct hci_conn_params *params; 2438 struct mgmt_pending_cmd *cmd; 2439 struct hci_conn *conn; 2440 u8 addr_type; 2441 int err; 2442 2443 memset(&rp, 0, sizeof(rp)); 2444 bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr); 2445 rp.addr.type = cp->addr.type; 2446 2447 if (!bdaddr_type_is_valid(cp->addr.type)) 2448 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE, 2449 MGMT_STATUS_INVALID_PARAMS, 2450 &rp, sizeof(rp)); 2451 2452 if (cp->disconnect != 0x00 && cp->disconnect != 0x01) 2453 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE, 2454 MGMT_STATUS_INVALID_PARAMS, 2455 &rp, sizeof(rp)); 2456 2457 hci_dev_lock(hdev); 2458 2459 if (!hdev_is_powered(hdev)) { 2460 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE, 2461 MGMT_STATUS_NOT_POWERED, &rp, 2462 sizeof(rp)); 2463 goto unlock; 2464 } 2465 2466 if (cp->addr.type == BDADDR_BREDR) { 2467 /* If disconnection is requested, then look up the 2468 * connection. If the remote device is connected, it 2469 * will be later used to terminate the link. 2470 * 2471 * Setting it to NULL explicitly will cause no 2472 * termination of the link. 2473 */ 2474 if (cp->disconnect) 2475 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, 2476 &cp->addr.bdaddr); 2477 else 2478 conn = NULL; 2479 2480 err = hci_remove_link_key(hdev, &cp->addr.bdaddr); 2481 if (err < 0) { 2482 err = mgmt_cmd_complete(sk, hdev->id, 2483 MGMT_OP_UNPAIR_DEVICE, 2484 MGMT_STATUS_NOT_PAIRED, &rp, 2485 sizeof(rp)); 2486 goto unlock; 2487 } 2488 2489 goto done; 2490 } 2491 2492 /* LE address type */ 2493 addr_type = le_addr_type(cp->addr.type); 2494 2495 /* Abort any ongoing SMP pairing. Removes ltk and irk if they exist. */ 2496 err = smp_cancel_and_remove_pairing(hdev, &cp->addr.bdaddr, addr_type); 2497 if (err < 0) { 2498 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE, 2499 MGMT_STATUS_NOT_PAIRED, &rp, 2500 sizeof(rp)); 2501 goto unlock; 2502 } 2503 2504 conn = hci_conn_hash_lookup_le(hdev, &cp->addr.bdaddr, addr_type); 2505 if (!conn) { 2506 hci_conn_params_del(hdev, &cp->addr.bdaddr, addr_type); 2507 goto done; 2508 } 2509 2510 2511 /* Defer clearing up the connection parameters until closing to 2512 * give a chance of keeping them if a repairing happens. 2513 */ 2514 set_bit(HCI_CONN_PARAM_REMOVAL_PEND, &conn->flags); 2515 2516 /* Disable auto-connection parameters if present */ 2517 params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr, addr_type); 2518 if (params) { 2519 if (params->explicit_connect) 2520 params->auto_connect = HCI_AUTO_CONN_EXPLICIT; 2521 else 2522 params->auto_connect = HCI_AUTO_CONN_DISABLED; 2523 } 2524 2525 /* If disconnection is not requested, then clear the connection 2526 * variable so that the link is not terminated. 2527 */ 2528 if (!cp->disconnect) 2529 conn = NULL; 2530 2531 done: 2532 /* If the connection variable is set, then termination of the 2533 * link is requested. 2534 */ 2535 if (!conn) { 2536 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE, 0, 2537 &rp, sizeof(rp)); 2538 device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, sk); 2539 goto unlock; 2540 } 2541 2542 cmd = mgmt_pending_add(sk, MGMT_OP_UNPAIR_DEVICE, hdev, cp, 2543 sizeof(*cp)); 2544 if (!cmd) { 2545 err = -ENOMEM; 2546 goto unlock; 2547 } 2548 2549 cmd->cmd_complete = addr_cmd_complete; 2550 2551 err = hci_abort_conn(conn, HCI_ERROR_REMOTE_USER_TERM); 2552 if (err < 0) 2553 mgmt_pending_remove(cmd); 2554 2555 unlock: 2556 hci_dev_unlock(hdev); 2557 return err; 2558 } 2559 2560 static int disconnect(struct sock *sk, struct hci_dev *hdev, void *data, 2561 u16 len) 2562 { 2563 struct mgmt_cp_disconnect *cp = data; 2564 struct mgmt_rp_disconnect rp; 2565 struct mgmt_pending_cmd *cmd; 2566 struct hci_conn *conn; 2567 int err; 2568 2569 bt_dev_dbg(hdev, "sock %p", sk); 2570 2571 memset(&rp, 0, sizeof(rp)); 2572 bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr); 2573 rp.addr.type = cp->addr.type; 2574 2575 if (!bdaddr_type_is_valid(cp->addr.type)) 2576 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT, 2577 MGMT_STATUS_INVALID_PARAMS, 2578 &rp, sizeof(rp)); 2579 2580 hci_dev_lock(hdev); 2581 2582 if (!test_bit(HCI_UP, &hdev->flags)) { 2583 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT, 2584 MGMT_STATUS_NOT_POWERED, &rp, 2585 sizeof(rp)); 2586 goto failed; 2587 } 2588 2589 if (pending_find(MGMT_OP_DISCONNECT, hdev)) { 2590 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT, 2591 MGMT_STATUS_BUSY, &rp, sizeof(rp)); 2592 goto failed; 2593 } 2594 2595 if (cp->addr.type == BDADDR_BREDR) 2596 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, 2597 &cp->addr.bdaddr); 2598 else 2599 conn = hci_conn_hash_lookup_le(hdev, &cp->addr.bdaddr, 2600 le_addr_type(cp->addr.type)); 2601 2602 if (!conn || conn->state == BT_OPEN || conn->state == BT_CLOSED) { 2603 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT, 2604 MGMT_STATUS_NOT_CONNECTED, &rp, 2605 sizeof(rp)); 2606 goto failed; 2607 } 2608 2609 cmd = mgmt_pending_add(sk, MGMT_OP_DISCONNECT, hdev, data, len); 2610 if (!cmd) { 2611 err = -ENOMEM; 2612 goto failed; 2613 } 2614 2615 cmd->cmd_complete = generic_cmd_complete; 2616 2617 err = hci_disconnect(conn, HCI_ERROR_REMOTE_USER_TERM); 2618 if (err < 0) 2619 mgmt_pending_remove(cmd); 2620 2621 failed: 2622 hci_dev_unlock(hdev); 2623 return err; 2624 } 2625 2626 static u8 link_to_bdaddr(u8 link_type, u8 addr_type) 2627 { 2628 switch (link_type) { 2629 case LE_LINK: 2630 switch (addr_type) { 2631 case ADDR_LE_DEV_PUBLIC: 2632 return BDADDR_LE_PUBLIC; 2633 2634 default: 2635 /* Fallback to LE Random address type */ 2636 return BDADDR_LE_RANDOM; 2637 } 2638 2639 default: 2640 /* Fallback to BR/EDR type */ 2641 return BDADDR_BREDR; 2642 } 2643 } 2644 2645 static int get_connections(struct sock *sk, struct hci_dev *hdev, void *data, 2646 u16 data_len) 2647 { 2648 struct mgmt_rp_get_connections *rp; 2649 struct hci_conn *c; 2650 int err; 2651 u16 i; 2652 2653 bt_dev_dbg(hdev, "sock %p", sk); 2654 2655 hci_dev_lock(hdev); 2656 2657 if (!hdev_is_powered(hdev)) { 2658 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_CONNECTIONS, 2659 MGMT_STATUS_NOT_POWERED); 2660 goto unlock; 2661 } 2662 2663 i = 0; 2664 list_for_each_entry(c, &hdev->conn_hash.list, list) { 2665 if (test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags)) 2666 i++; 2667 } 2668 2669 rp = kmalloc(struct_size(rp, addr, i), GFP_KERNEL); 2670 if (!rp) { 2671 err = -ENOMEM; 2672 goto unlock; 2673 } 2674 2675 i = 0; 2676 list_for_each_entry(c, &hdev->conn_hash.list, list) { 2677 if (!test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags)) 2678 continue; 2679 bacpy(&rp->addr[i].bdaddr, &c->dst); 2680 rp->addr[i].type = link_to_bdaddr(c->type, c->dst_type); 2681 if (c->type == SCO_LINK || c->type == ESCO_LINK) 2682 continue; 2683 i++; 2684 } 2685 2686 rp->conn_count = cpu_to_le16(i); 2687 2688 /* Recalculate length in case of filtered SCO connections, etc */ 2689 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONNECTIONS, 0, rp, 2690 struct_size(rp, addr, i)); 2691 2692 kfree(rp); 2693 2694 unlock: 2695 hci_dev_unlock(hdev); 2696 return err; 2697 } 2698 2699 static int send_pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev, 2700 struct mgmt_cp_pin_code_neg_reply *cp) 2701 { 2702 struct mgmt_pending_cmd *cmd; 2703 int err; 2704 2705 cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_NEG_REPLY, hdev, cp, 2706 sizeof(*cp)); 2707 if (!cmd) 2708 return -ENOMEM; 2709 2710 cmd->cmd_complete = addr_cmd_complete; 2711 2712 err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_NEG_REPLY, 2713 sizeof(cp->addr.bdaddr), &cp->addr.bdaddr); 2714 if (err < 0) 2715 mgmt_pending_remove(cmd); 2716 2717 return err; 2718 } 2719 2720 static int pin_code_reply(struct sock *sk, struct hci_dev *hdev, void *data, 2721 u16 len) 2722 { 2723 struct hci_conn *conn; 2724 struct mgmt_cp_pin_code_reply *cp = data; 2725 struct hci_cp_pin_code_reply reply; 2726 struct mgmt_pending_cmd *cmd; 2727 int err; 2728 2729 bt_dev_dbg(hdev, "sock %p", sk); 2730 2731 hci_dev_lock(hdev); 2732 2733 if (!hdev_is_powered(hdev)) { 2734 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY, 2735 MGMT_STATUS_NOT_POWERED); 2736 goto failed; 2737 } 2738 2739 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->addr.bdaddr); 2740 if (!conn) { 2741 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY, 2742 MGMT_STATUS_NOT_CONNECTED); 2743 goto failed; 2744 } 2745 2746 if (conn->pending_sec_level == BT_SECURITY_HIGH && cp->pin_len != 16) { 2747 struct mgmt_cp_pin_code_neg_reply ncp; 2748 2749 memcpy(&ncp.addr, &cp->addr, sizeof(ncp.addr)); 2750 2751 bt_dev_err(hdev, "PIN code is not 16 bytes long"); 2752 2753 err = send_pin_code_neg_reply(sk, hdev, &ncp); 2754 if (err >= 0) 2755 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY, 2756 MGMT_STATUS_INVALID_PARAMS); 2757 2758 goto failed; 2759 } 2760 2761 cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_REPLY, hdev, data, len); 2762 if (!cmd) { 2763 err = -ENOMEM; 2764 goto failed; 2765 } 2766 2767 cmd->cmd_complete = addr_cmd_complete; 2768 2769 bacpy(&reply.bdaddr, &cp->addr.bdaddr); 2770 reply.pin_len = cp->pin_len; 2771 memcpy(reply.pin_code, cp->pin_code, sizeof(reply.pin_code)); 2772 2773 err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_REPLY, sizeof(reply), &reply); 2774 if (err < 0) 2775 mgmt_pending_remove(cmd); 2776 2777 failed: 2778 hci_dev_unlock(hdev); 2779 return err; 2780 } 2781 2782 static int set_io_capability(struct sock *sk, struct hci_dev *hdev, void *data, 2783 u16 len) 2784 { 2785 struct mgmt_cp_set_io_capability *cp = data; 2786 2787 bt_dev_dbg(hdev, "sock %p", sk); 2788 2789 if (cp->io_capability > SMP_IO_KEYBOARD_DISPLAY) 2790 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_IO_CAPABILITY, 2791 MGMT_STATUS_INVALID_PARAMS); 2792 2793 hci_dev_lock(hdev); 2794 2795 hdev->io_capability = cp->io_capability; 2796 2797 bt_dev_dbg(hdev, "IO capability set to 0x%02x", hdev->io_capability); 2798 2799 hci_dev_unlock(hdev); 2800 2801 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_IO_CAPABILITY, 0, 2802 NULL, 0); 2803 } 2804 2805 static struct mgmt_pending_cmd *find_pairing(struct hci_conn *conn) 2806 { 2807 struct hci_dev *hdev = conn->hdev; 2808 struct mgmt_pending_cmd *cmd; 2809 2810 list_for_each_entry(cmd, &hdev->mgmt_pending, list) { 2811 if (cmd->opcode != MGMT_OP_PAIR_DEVICE) 2812 continue; 2813 2814 if (cmd->user_data != conn) 2815 continue; 2816 2817 return cmd; 2818 } 2819 2820 return NULL; 2821 } 2822 2823 static int pairing_complete(struct mgmt_pending_cmd *cmd, u8 status) 2824 { 2825 struct mgmt_rp_pair_device rp; 2826 struct hci_conn *conn = cmd->user_data; 2827 int err; 2828 2829 bacpy(&rp.addr.bdaddr, &conn->dst); 2830 rp.addr.type = link_to_bdaddr(conn->type, conn->dst_type); 2831 2832 err = mgmt_cmd_complete(cmd->sk, cmd->index, MGMT_OP_PAIR_DEVICE, 2833 status, &rp, sizeof(rp)); 2834 2835 /* So we don't get further callbacks for this connection */ 2836 conn->connect_cfm_cb = NULL; 2837 conn->security_cfm_cb = NULL; 2838 conn->disconn_cfm_cb = NULL; 2839 2840 hci_conn_drop(conn); 2841 2842 /* The device is paired so there is no need to remove 2843 * its connection parameters anymore. 2844 */ 2845 clear_bit(HCI_CONN_PARAM_REMOVAL_PEND, &conn->flags); 2846 2847 hci_conn_put(conn); 2848 2849 return err; 2850 } 2851 2852 void mgmt_smp_complete(struct hci_conn *conn, bool complete) 2853 { 2854 u8 status = complete ? MGMT_STATUS_SUCCESS : MGMT_STATUS_FAILED; 2855 struct mgmt_pending_cmd *cmd; 2856 2857 cmd = find_pairing(conn); 2858 if (cmd) { 2859 cmd->cmd_complete(cmd, status); 2860 mgmt_pending_remove(cmd); 2861 } 2862 } 2863 2864 static void pairing_complete_cb(struct hci_conn *conn, u8 status) 2865 { 2866 struct mgmt_pending_cmd *cmd; 2867 2868 BT_DBG("status %u", status); 2869 2870 cmd = find_pairing(conn); 2871 if (!cmd) { 2872 BT_DBG("Unable to find a pending command"); 2873 return; 2874 } 2875 2876 cmd->cmd_complete(cmd, mgmt_status(status)); 2877 mgmt_pending_remove(cmd); 2878 } 2879 2880 static void le_pairing_complete_cb(struct hci_conn *conn, u8 status) 2881 { 2882 struct mgmt_pending_cmd *cmd; 2883 2884 BT_DBG("status %u", status); 2885 2886 if (!status) 2887 return; 2888 2889 cmd = find_pairing(conn); 2890 if (!cmd) { 2891 BT_DBG("Unable to find a pending command"); 2892 return; 2893 } 2894 2895 cmd->cmd_complete(cmd, mgmt_status(status)); 2896 mgmt_pending_remove(cmd); 2897 } 2898 2899 static int pair_device(struct sock *sk, struct hci_dev *hdev, void *data, 2900 u16 len) 2901 { 2902 struct mgmt_cp_pair_device *cp = data; 2903 struct mgmt_rp_pair_device rp; 2904 struct mgmt_pending_cmd *cmd; 2905 u8 sec_level, auth_type; 2906 struct hci_conn *conn; 2907 int err; 2908 2909 bt_dev_dbg(hdev, "sock %p", sk); 2910 2911 memset(&rp, 0, sizeof(rp)); 2912 bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr); 2913 rp.addr.type = cp->addr.type; 2914 2915 if (!bdaddr_type_is_valid(cp->addr.type)) 2916 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE, 2917 MGMT_STATUS_INVALID_PARAMS, 2918 &rp, sizeof(rp)); 2919 2920 if (cp->io_cap > SMP_IO_KEYBOARD_DISPLAY) 2921 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE, 2922 MGMT_STATUS_INVALID_PARAMS, 2923 &rp, sizeof(rp)); 2924 2925 hci_dev_lock(hdev); 2926 2927 if (!hdev_is_powered(hdev)) { 2928 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE, 2929 MGMT_STATUS_NOT_POWERED, &rp, 2930 sizeof(rp)); 2931 goto unlock; 2932 } 2933 2934 if (hci_bdaddr_is_paired(hdev, &cp->addr.bdaddr, cp->addr.type)) { 2935 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE, 2936 MGMT_STATUS_ALREADY_PAIRED, &rp, 2937 sizeof(rp)); 2938 goto unlock; 2939 } 2940 2941 sec_level = BT_SECURITY_MEDIUM; 2942 auth_type = HCI_AT_DEDICATED_BONDING; 2943 2944 if (cp->addr.type == BDADDR_BREDR) { 2945 conn = hci_connect_acl(hdev, &cp->addr.bdaddr, sec_level, 2946 auth_type, CONN_REASON_PAIR_DEVICE); 2947 } else { 2948 u8 addr_type = le_addr_type(cp->addr.type); 2949 struct hci_conn_params *p; 2950 2951 /* When pairing a new device, it is expected to remember 2952 * this device for future connections. Adding the connection 2953 * parameter information ahead of time allows tracking 2954 * of the slave preferred values and will speed up any 2955 * further connection establishment. 2956 * 2957 * If connection parameters already exist, then they 2958 * will be kept and this function does nothing. 2959 */ 2960 p = hci_conn_params_add(hdev, &cp->addr.bdaddr, addr_type); 2961 2962 if (p->auto_connect == HCI_AUTO_CONN_EXPLICIT) 2963 p->auto_connect = HCI_AUTO_CONN_DISABLED; 2964 2965 conn = hci_connect_le_scan(hdev, &cp->addr.bdaddr, addr_type, 2966 sec_level, HCI_LE_CONN_TIMEOUT, 2967 CONN_REASON_PAIR_DEVICE); 2968 } 2969 2970 if (IS_ERR(conn)) { 2971 int status; 2972 2973 if (PTR_ERR(conn) == -EBUSY) 2974 status = MGMT_STATUS_BUSY; 2975 else if (PTR_ERR(conn) == -EOPNOTSUPP) 2976 status = MGMT_STATUS_NOT_SUPPORTED; 2977 else if (PTR_ERR(conn) == -ECONNREFUSED) 2978 status = MGMT_STATUS_REJECTED; 2979 else 2980 status = MGMT_STATUS_CONNECT_FAILED; 2981 2982 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE, 2983 status, &rp, sizeof(rp)); 2984 goto unlock; 2985 } 2986 2987 if (conn->connect_cfm_cb) { 2988 hci_conn_drop(conn); 2989 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE, 2990 MGMT_STATUS_BUSY, &rp, sizeof(rp)); 2991 goto unlock; 2992 } 2993 2994 cmd = mgmt_pending_add(sk, MGMT_OP_PAIR_DEVICE, hdev, data, len); 2995 if (!cmd) { 2996 err = -ENOMEM; 2997 hci_conn_drop(conn); 2998 goto unlock; 2999 } 3000 3001 cmd->cmd_complete = pairing_complete; 3002 3003 /* For LE, just connecting isn't a proof that the pairing finished */ 3004 if (cp->addr.type == BDADDR_BREDR) { 3005 conn->connect_cfm_cb = pairing_complete_cb; 3006 conn->security_cfm_cb = pairing_complete_cb; 3007 conn->disconn_cfm_cb = pairing_complete_cb; 3008 } else { 3009 conn->connect_cfm_cb = le_pairing_complete_cb; 3010 conn->security_cfm_cb = le_pairing_complete_cb; 3011 conn->disconn_cfm_cb = le_pairing_complete_cb; 3012 } 3013 3014 conn->io_capability = cp->io_cap; 3015 cmd->user_data = hci_conn_get(conn); 3016 3017 if ((conn->state == BT_CONNECTED || conn->state == BT_CONFIG) && 3018 hci_conn_security(conn, sec_level, auth_type, true)) { 3019 cmd->cmd_complete(cmd, 0); 3020 mgmt_pending_remove(cmd); 3021 } 3022 3023 err = 0; 3024 3025 unlock: 3026 hci_dev_unlock(hdev); 3027 return err; 3028 } 3029 3030 static int cancel_pair_device(struct sock *sk, struct hci_dev *hdev, void *data, 3031 u16 len) 3032 { 3033 struct mgmt_addr_info *addr = data; 3034 struct mgmt_pending_cmd *cmd; 3035 struct hci_conn *conn; 3036 int err; 3037 3038 bt_dev_dbg(hdev, "sock %p", sk); 3039 3040 hci_dev_lock(hdev); 3041 3042 if (!hdev_is_powered(hdev)) { 3043 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE, 3044 MGMT_STATUS_NOT_POWERED); 3045 goto unlock; 3046 } 3047 3048 cmd = pending_find(MGMT_OP_PAIR_DEVICE, hdev); 3049 if (!cmd) { 3050 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE, 3051 MGMT_STATUS_INVALID_PARAMS); 3052 goto unlock; 3053 } 3054 3055 conn = cmd->user_data; 3056 3057 if (bacmp(&addr->bdaddr, &conn->dst) != 0) { 3058 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE, 3059 MGMT_STATUS_INVALID_PARAMS); 3060 goto unlock; 3061 } 3062 3063 cmd->cmd_complete(cmd, MGMT_STATUS_CANCELLED); 3064 mgmt_pending_remove(cmd); 3065 3066 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE, 0, 3067 addr, sizeof(*addr)); 3068 3069 /* Since user doesn't want to proceed with the connection, abort any 3070 * ongoing pairing and then terminate the link if it was created 3071 * because of the pair device action. 3072 */ 3073 if (addr->type == BDADDR_BREDR) 3074 hci_remove_link_key(hdev, &addr->bdaddr); 3075 else 3076 smp_cancel_and_remove_pairing(hdev, &addr->bdaddr, 3077 le_addr_type(addr->type)); 3078 3079 if (conn->conn_reason == CONN_REASON_PAIR_DEVICE) 3080 hci_abort_conn(conn, HCI_ERROR_REMOTE_USER_TERM); 3081 3082 unlock: 3083 hci_dev_unlock(hdev); 3084 return err; 3085 } 3086 3087 static int user_pairing_resp(struct sock *sk, struct hci_dev *hdev, 3088 struct mgmt_addr_info *addr, u16 mgmt_op, 3089 u16 hci_op, __le32 passkey) 3090 { 3091 struct mgmt_pending_cmd *cmd; 3092 struct hci_conn *conn; 3093 int err; 3094 3095 hci_dev_lock(hdev); 3096 3097 if (!hdev_is_powered(hdev)) { 3098 err = mgmt_cmd_complete(sk, hdev->id, mgmt_op, 3099 MGMT_STATUS_NOT_POWERED, addr, 3100 sizeof(*addr)); 3101 goto done; 3102 } 3103 3104 if (addr->type == BDADDR_BREDR) 3105 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &addr->bdaddr); 3106 else 3107 conn = hci_conn_hash_lookup_le(hdev, &addr->bdaddr, 3108 le_addr_type(addr->type)); 3109 3110 if (!conn) { 3111 err = mgmt_cmd_complete(sk, hdev->id, mgmt_op, 3112 MGMT_STATUS_NOT_CONNECTED, addr, 3113 sizeof(*addr)); 3114 goto done; 3115 } 3116 3117 if (addr->type == BDADDR_LE_PUBLIC || addr->type == BDADDR_LE_RANDOM) { 3118 err = smp_user_confirm_reply(conn, mgmt_op, passkey); 3119 if (!err) 3120 err = mgmt_cmd_complete(sk, hdev->id, mgmt_op, 3121 MGMT_STATUS_SUCCESS, addr, 3122 sizeof(*addr)); 3123 else 3124 err = mgmt_cmd_complete(sk, hdev->id, mgmt_op, 3125 MGMT_STATUS_FAILED, addr, 3126 sizeof(*addr)); 3127 3128 goto done; 3129 } 3130 3131 cmd = mgmt_pending_add(sk, mgmt_op, hdev, addr, sizeof(*addr)); 3132 if (!cmd) { 3133 err = -ENOMEM; 3134 goto done; 3135 } 3136 3137 cmd->cmd_complete = addr_cmd_complete; 3138 3139 /* Continue with pairing via HCI */ 3140 if (hci_op == HCI_OP_USER_PASSKEY_REPLY) { 3141 struct hci_cp_user_passkey_reply cp; 3142 3143 bacpy(&cp.bdaddr, &addr->bdaddr); 3144 cp.passkey = passkey; 3145 err = hci_send_cmd(hdev, hci_op, sizeof(cp), &cp); 3146 } else 3147 err = hci_send_cmd(hdev, hci_op, sizeof(addr->bdaddr), 3148 &addr->bdaddr); 3149 3150 if (err < 0) 3151 mgmt_pending_remove(cmd); 3152 3153 done: 3154 hci_dev_unlock(hdev); 3155 return err; 3156 } 3157 3158 static int pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev, 3159 void *data, u16 len) 3160 { 3161 struct mgmt_cp_pin_code_neg_reply *cp = data; 3162 3163 bt_dev_dbg(hdev, "sock %p", sk); 3164 3165 return user_pairing_resp(sk, hdev, &cp->addr, 3166 MGMT_OP_PIN_CODE_NEG_REPLY, 3167 HCI_OP_PIN_CODE_NEG_REPLY, 0); 3168 } 3169 3170 static int user_confirm_reply(struct sock *sk, struct hci_dev *hdev, void *data, 3171 u16 len) 3172 { 3173 struct mgmt_cp_user_confirm_reply *cp = data; 3174 3175 bt_dev_dbg(hdev, "sock %p", sk); 3176 3177 if (len != sizeof(*cp)) 3178 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_USER_CONFIRM_REPLY, 3179 MGMT_STATUS_INVALID_PARAMS); 3180 3181 return user_pairing_resp(sk, hdev, &cp->addr, 3182 MGMT_OP_USER_CONFIRM_REPLY, 3183 HCI_OP_USER_CONFIRM_REPLY, 0); 3184 } 3185 3186 static int user_confirm_neg_reply(struct sock *sk, struct hci_dev *hdev, 3187 void *data, u16 len) 3188 { 3189 struct mgmt_cp_user_confirm_neg_reply *cp = data; 3190 3191 bt_dev_dbg(hdev, "sock %p", sk); 3192 3193 return user_pairing_resp(sk, hdev, &cp->addr, 3194 MGMT_OP_USER_CONFIRM_NEG_REPLY, 3195 HCI_OP_USER_CONFIRM_NEG_REPLY, 0); 3196 } 3197 3198 static int user_passkey_reply(struct sock *sk, struct hci_dev *hdev, void *data, 3199 u16 len) 3200 { 3201 struct mgmt_cp_user_passkey_reply *cp = data; 3202 3203 bt_dev_dbg(hdev, "sock %p", sk); 3204 3205 return user_pairing_resp(sk, hdev, &cp->addr, 3206 MGMT_OP_USER_PASSKEY_REPLY, 3207 HCI_OP_USER_PASSKEY_REPLY, cp->passkey); 3208 } 3209 3210 static int user_passkey_neg_reply(struct sock *sk, struct hci_dev *hdev, 3211 void *data, u16 len) 3212 { 3213 struct mgmt_cp_user_passkey_neg_reply *cp = data; 3214 3215 bt_dev_dbg(hdev, "sock %p", sk); 3216 3217 return user_pairing_resp(sk, hdev, &cp->addr, 3218 MGMT_OP_USER_PASSKEY_NEG_REPLY, 3219 HCI_OP_USER_PASSKEY_NEG_REPLY, 0); 3220 } 3221 3222 static void adv_expire(struct hci_dev *hdev, u32 flags) 3223 { 3224 struct adv_info *adv_instance; 3225 struct hci_request req; 3226 int err; 3227 3228 adv_instance = hci_find_adv_instance(hdev, hdev->cur_adv_instance); 3229 if (!adv_instance) 3230 return; 3231 3232 /* stop if current instance doesn't need to be changed */ 3233 if (!(adv_instance->flags & flags)) 3234 return; 3235 3236 cancel_adv_timeout(hdev); 3237 3238 adv_instance = hci_get_next_instance(hdev, adv_instance->instance); 3239 if (!adv_instance) 3240 return; 3241 3242 hci_req_init(&req, hdev); 3243 err = __hci_req_schedule_adv_instance(&req, adv_instance->instance, 3244 true); 3245 if (err) 3246 return; 3247 3248 hci_req_run(&req, NULL); 3249 } 3250 3251 static void set_name_complete(struct hci_dev *hdev, u8 status, u16 opcode) 3252 { 3253 struct mgmt_cp_set_local_name *cp; 3254 struct mgmt_pending_cmd *cmd; 3255 3256 bt_dev_dbg(hdev, "status 0x%02x", status); 3257 3258 hci_dev_lock(hdev); 3259 3260 cmd = pending_find(MGMT_OP_SET_LOCAL_NAME, hdev); 3261 if (!cmd) 3262 goto unlock; 3263 3264 cp = cmd->param; 3265 3266 if (status) { 3267 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 3268 mgmt_status(status)); 3269 } else { 3270 mgmt_cmd_complete(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0, 3271 cp, sizeof(*cp)); 3272 3273 if (hci_dev_test_flag(hdev, HCI_LE_ADV)) 3274 adv_expire(hdev, MGMT_ADV_FLAG_LOCAL_NAME); 3275 } 3276 3277 mgmt_pending_remove(cmd); 3278 3279 unlock: 3280 hci_dev_unlock(hdev); 3281 } 3282 3283 static int set_local_name(struct sock *sk, struct hci_dev *hdev, void *data, 3284 u16 len) 3285 { 3286 struct mgmt_cp_set_local_name *cp = data; 3287 struct mgmt_pending_cmd *cmd; 3288 struct hci_request req; 3289 int err; 3290 3291 bt_dev_dbg(hdev, "sock %p", sk); 3292 3293 hci_dev_lock(hdev); 3294 3295 /* If the old values are the same as the new ones just return a 3296 * direct command complete event. 3297 */ 3298 if (!memcmp(hdev->dev_name, cp->name, sizeof(hdev->dev_name)) && 3299 !memcmp(hdev->short_name, cp->short_name, 3300 sizeof(hdev->short_name))) { 3301 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0, 3302 data, len); 3303 goto failed; 3304 } 3305 3306 memcpy(hdev->short_name, cp->short_name, sizeof(hdev->short_name)); 3307 3308 if (!hdev_is_powered(hdev)) { 3309 memcpy(hdev->dev_name, cp->name, sizeof(hdev->dev_name)); 3310 3311 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0, 3312 data, len); 3313 if (err < 0) 3314 goto failed; 3315 3316 err = mgmt_limited_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, data, 3317 len, HCI_MGMT_LOCAL_NAME_EVENTS, sk); 3318 ext_info_changed(hdev, sk); 3319 3320 goto failed; 3321 } 3322 3323 cmd = mgmt_pending_add(sk, MGMT_OP_SET_LOCAL_NAME, hdev, data, len); 3324 if (!cmd) { 3325 err = -ENOMEM; 3326 goto failed; 3327 } 3328 3329 memcpy(hdev->dev_name, cp->name, sizeof(hdev->dev_name)); 3330 3331 hci_req_init(&req, hdev); 3332 3333 if (lmp_bredr_capable(hdev)) { 3334 __hci_req_update_name(&req); 3335 __hci_req_update_eir(&req); 3336 } 3337 3338 /* The name is stored in the scan response data and so 3339 * no need to udpate the advertising data here. 3340 */ 3341 if (lmp_le_capable(hdev) && hci_dev_test_flag(hdev, HCI_ADVERTISING)) 3342 __hci_req_update_scan_rsp_data(&req, hdev->cur_adv_instance); 3343 3344 err = hci_req_run(&req, set_name_complete); 3345 if (err < 0) 3346 mgmt_pending_remove(cmd); 3347 3348 failed: 3349 hci_dev_unlock(hdev); 3350 return err; 3351 } 3352 3353 static int set_appearance(struct sock *sk, struct hci_dev *hdev, void *data, 3354 u16 len) 3355 { 3356 struct mgmt_cp_set_appearance *cp = data; 3357 u16 appearance; 3358 int err; 3359 3360 bt_dev_dbg(hdev, "sock %p", sk); 3361 3362 if (!lmp_le_capable(hdev)) 3363 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_APPEARANCE, 3364 MGMT_STATUS_NOT_SUPPORTED); 3365 3366 appearance = le16_to_cpu(cp->appearance); 3367 3368 hci_dev_lock(hdev); 3369 3370 if (hdev->appearance != appearance) { 3371 hdev->appearance = appearance; 3372 3373 if (hci_dev_test_flag(hdev, HCI_LE_ADV)) 3374 adv_expire(hdev, MGMT_ADV_FLAG_APPEARANCE); 3375 3376 ext_info_changed(hdev, sk); 3377 } 3378 3379 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_APPEARANCE, 0, NULL, 3380 0); 3381 3382 hci_dev_unlock(hdev); 3383 3384 return err; 3385 } 3386 3387 static int get_phy_configuration(struct sock *sk, struct hci_dev *hdev, 3388 void *data, u16 len) 3389 { 3390 struct mgmt_rp_get_phy_confguration rp; 3391 3392 bt_dev_dbg(hdev, "sock %p", sk); 3393 3394 hci_dev_lock(hdev); 3395 3396 memset(&rp, 0, sizeof(rp)); 3397 3398 rp.supported_phys = cpu_to_le32(get_supported_phys(hdev)); 3399 rp.selected_phys = cpu_to_le32(get_selected_phys(hdev)); 3400 rp.configurable_phys = cpu_to_le32(get_configurable_phys(hdev)); 3401 3402 hci_dev_unlock(hdev); 3403 3404 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_PHY_CONFIGURATION, 0, 3405 &rp, sizeof(rp)); 3406 } 3407 3408 int mgmt_phy_configuration_changed(struct hci_dev *hdev, struct sock *skip) 3409 { 3410 struct mgmt_ev_phy_configuration_changed ev; 3411 3412 memset(&ev, 0, sizeof(ev)); 3413 3414 ev.selected_phys = cpu_to_le32(get_selected_phys(hdev)); 3415 3416 return mgmt_event(MGMT_EV_PHY_CONFIGURATION_CHANGED, hdev, &ev, 3417 sizeof(ev), skip); 3418 } 3419 3420 static void set_default_phy_complete(struct hci_dev *hdev, u8 status, 3421 u16 opcode, struct sk_buff *skb) 3422 { 3423 struct mgmt_pending_cmd *cmd; 3424 3425 bt_dev_dbg(hdev, "status 0x%02x", status); 3426 3427 hci_dev_lock(hdev); 3428 3429 cmd = pending_find(MGMT_OP_SET_PHY_CONFIGURATION, hdev); 3430 if (!cmd) 3431 goto unlock; 3432 3433 if (status) { 3434 mgmt_cmd_status(cmd->sk, hdev->id, 3435 MGMT_OP_SET_PHY_CONFIGURATION, 3436 mgmt_status(status)); 3437 } else { 3438 mgmt_cmd_complete(cmd->sk, hdev->id, 3439 MGMT_OP_SET_PHY_CONFIGURATION, 0, 3440 NULL, 0); 3441 3442 mgmt_phy_configuration_changed(hdev, cmd->sk); 3443 } 3444 3445 mgmt_pending_remove(cmd); 3446 3447 unlock: 3448 hci_dev_unlock(hdev); 3449 } 3450 3451 static int set_phy_configuration(struct sock *sk, struct hci_dev *hdev, 3452 void *data, u16 len) 3453 { 3454 struct mgmt_cp_set_phy_confguration *cp = data; 3455 struct hci_cp_le_set_default_phy cp_phy; 3456 struct mgmt_pending_cmd *cmd; 3457 struct hci_request req; 3458 u32 selected_phys, configurable_phys, supported_phys, unconfigure_phys; 3459 u16 pkt_type = (HCI_DH1 | HCI_DM1); 3460 bool changed = false; 3461 int err; 3462 3463 bt_dev_dbg(hdev, "sock %p", sk); 3464 3465 configurable_phys = get_configurable_phys(hdev); 3466 supported_phys = get_supported_phys(hdev); 3467 selected_phys = __le32_to_cpu(cp->selected_phys); 3468 3469 if (selected_phys & ~supported_phys) 3470 return mgmt_cmd_status(sk, hdev->id, 3471 MGMT_OP_SET_PHY_CONFIGURATION, 3472 MGMT_STATUS_INVALID_PARAMS); 3473 3474 unconfigure_phys = supported_phys & ~configurable_phys; 3475 3476 if ((selected_phys & unconfigure_phys) != unconfigure_phys) 3477 return mgmt_cmd_status(sk, hdev->id, 3478 MGMT_OP_SET_PHY_CONFIGURATION, 3479 MGMT_STATUS_INVALID_PARAMS); 3480 3481 if (selected_phys == get_selected_phys(hdev)) 3482 return mgmt_cmd_complete(sk, hdev->id, 3483 MGMT_OP_SET_PHY_CONFIGURATION, 3484 0, NULL, 0); 3485 3486 hci_dev_lock(hdev); 3487 3488 if (!hdev_is_powered(hdev)) { 3489 err = mgmt_cmd_status(sk, hdev->id, 3490 MGMT_OP_SET_PHY_CONFIGURATION, 3491 MGMT_STATUS_REJECTED); 3492 goto unlock; 3493 } 3494 3495 if (pending_find(MGMT_OP_SET_PHY_CONFIGURATION, hdev)) { 3496 err = mgmt_cmd_status(sk, hdev->id, 3497 MGMT_OP_SET_PHY_CONFIGURATION, 3498 MGMT_STATUS_BUSY); 3499 goto unlock; 3500 } 3501 3502 if (selected_phys & MGMT_PHY_BR_1M_3SLOT) 3503 pkt_type |= (HCI_DH3 | HCI_DM3); 3504 else 3505 pkt_type &= ~(HCI_DH3 | HCI_DM3); 3506 3507 if (selected_phys & MGMT_PHY_BR_1M_5SLOT) 3508 pkt_type |= (HCI_DH5 | HCI_DM5); 3509 else 3510 pkt_type &= ~(HCI_DH5 | HCI_DM5); 3511 3512 if (selected_phys & MGMT_PHY_EDR_2M_1SLOT) 3513 pkt_type &= ~HCI_2DH1; 3514 else 3515 pkt_type |= HCI_2DH1; 3516 3517 if (selected_phys & MGMT_PHY_EDR_2M_3SLOT) 3518 pkt_type &= ~HCI_2DH3; 3519 else 3520 pkt_type |= HCI_2DH3; 3521 3522 if (selected_phys & MGMT_PHY_EDR_2M_5SLOT) 3523 pkt_type &= ~HCI_2DH5; 3524 else 3525 pkt_type |= HCI_2DH5; 3526 3527 if (selected_phys & MGMT_PHY_EDR_3M_1SLOT) 3528 pkt_type &= ~HCI_3DH1; 3529 else 3530 pkt_type |= HCI_3DH1; 3531 3532 if (selected_phys & MGMT_PHY_EDR_3M_3SLOT) 3533 pkt_type &= ~HCI_3DH3; 3534 else 3535 pkt_type |= HCI_3DH3; 3536 3537 if (selected_phys & MGMT_PHY_EDR_3M_5SLOT) 3538 pkt_type &= ~HCI_3DH5; 3539 else 3540 pkt_type |= HCI_3DH5; 3541 3542 if (pkt_type != hdev->pkt_type) { 3543 hdev->pkt_type = pkt_type; 3544 changed = true; 3545 } 3546 3547 if ((selected_phys & MGMT_PHY_LE_MASK) == 3548 (get_selected_phys(hdev) & MGMT_PHY_LE_MASK)) { 3549 if (changed) 3550 mgmt_phy_configuration_changed(hdev, sk); 3551 3552 err = mgmt_cmd_complete(sk, hdev->id, 3553 MGMT_OP_SET_PHY_CONFIGURATION, 3554 0, NULL, 0); 3555 3556 goto unlock; 3557 } 3558 3559 cmd = mgmt_pending_add(sk, MGMT_OP_SET_PHY_CONFIGURATION, hdev, data, 3560 len); 3561 if (!cmd) { 3562 err = -ENOMEM; 3563 goto unlock; 3564 } 3565 3566 hci_req_init(&req, hdev); 3567 3568 memset(&cp_phy, 0, sizeof(cp_phy)); 3569 3570 if (!(selected_phys & MGMT_PHY_LE_TX_MASK)) 3571 cp_phy.all_phys |= 0x01; 3572 3573 if (!(selected_phys & MGMT_PHY_LE_RX_MASK)) 3574 cp_phy.all_phys |= 0x02; 3575 3576 if (selected_phys & MGMT_PHY_LE_1M_TX) 3577 cp_phy.tx_phys |= HCI_LE_SET_PHY_1M; 3578 3579 if (selected_phys & MGMT_PHY_LE_2M_TX) 3580 cp_phy.tx_phys |= HCI_LE_SET_PHY_2M; 3581 3582 if (selected_phys & MGMT_PHY_LE_CODED_TX) 3583 cp_phy.tx_phys |= HCI_LE_SET_PHY_CODED; 3584 3585 if (selected_phys & MGMT_PHY_LE_1M_RX) 3586 cp_phy.rx_phys |= HCI_LE_SET_PHY_1M; 3587 3588 if (selected_phys & MGMT_PHY_LE_2M_RX) 3589 cp_phy.rx_phys |= HCI_LE_SET_PHY_2M; 3590 3591 if (selected_phys & MGMT_PHY_LE_CODED_RX) 3592 cp_phy.rx_phys |= HCI_LE_SET_PHY_CODED; 3593 3594 hci_req_add(&req, HCI_OP_LE_SET_DEFAULT_PHY, sizeof(cp_phy), &cp_phy); 3595 3596 err = hci_req_run_skb(&req, set_default_phy_complete); 3597 if (err < 0) 3598 mgmt_pending_remove(cmd); 3599 3600 unlock: 3601 hci_dev_unlock(hdev); 3602 3603 return err; 3604 } 3605 3606 static int set_blocked_keys(struct sock *sk, struct hci_dev *hdev, void *data, 3607 u16 len) 3608 { 3609 int err = MGMT_STATUS_SUCCESS; 3610 struct mgmt_cp_set_blocked_keys *keys = data; 3611 const u16 max_key_count = ((U16_MAX - sizeof(*keys)) / 3612 sizeof(struct mgmt_blocked_key_info)); 3613 u16 key_count, expected_len; 3614 int i; 3615 3616 bt_dev_dbg(hdev, "sock %p", sk); 3617 3618 key_count = __le16_to_cpu(keys->key_count); 3619 if (key_count > max_key_count) { 3620 bt_dev_err(hdev, "too big key_count value %u", key_count); 3621 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BLOCKED_KEYS, 3622 MGMT_STATUS_INVALID_PARAMS); 3623 } 3624 3625 expected_len = struct_size(keys, keys, key_count); 3626 if (expected_len != len) { 3627 bt_dev_err(hdev, "expected %u bytes, got %u bytes", 3628 expected_len, len); 3629 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BLOCKED_KEYS, 3630 MGMT_STATUS_INVALID_PARAMS); 3631 } 3632 3633 hci_dev_lock(hdev); 3634 3635 hci_blocked_keys_clear(hdev); 3636 3637 for (i = 0; i < keys->key_count; ++i) { 3638 struct blocked_key *b = kzalloc(sizeof(*b), GFP_KERNEL); 3639 3640 if (!b) { 3641 err = MGMT_STATUS_NO_RESOURCES; 3642 break; 3643 } 3644 3645 b->type = keys->keys[i].type; 3646 memcpy(b->val, keys->keys[i].val, sizeof(b->val)); 3647 list_add_rcu(&b->list, &hdev->blocked_keys); 3648 } 3649 hci_dev_unlock(hdev); 3650 3651 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_BLOCKED_KEYS, 3652 err, NULL, 0); 3653 } 3654 3655 static int set_wideband_speech(struct sock *sk, struct hci_dev *hdev, 3656 void *data, u16 len) 3657 { 3658 struct mgmt_mode *cp = data; 3659 int err; 3660 bool changed = false; 3661 3662 bt_dev_dbg(hdev, "sock %p", sk); 3663 3664 if (!test_bit(HCI_QUIRK_WIDEBAND_SPEECH_SUPPORTED, &hdev->quirks)) 3665 return mgmt_cmd_status(sk, hdev->id, 3666 MGMT_OP_SET_WIDEBAND_SPEECH, 3667 MGMT_STATUS_NOT_SUPPORTED); 3668 3669 if (cp->val != 0x00 && cp->val != 0x01) 3670 return mgmt_cmd_status(sk, hdev->id, 3671 MGMT_OP_SET_WIDEBAND_SPEECH, 3672 MGMT_STATUS_INVALID_PARAMS); 3673 3674 hci_dev_lock(hdev); 3675 3676 if (pending_find(MGMT_OP_SET_WIDEBAND_SPEECH, hdev)) { 3677 err = mgmt_cmd_status(sk, hdev->id, 3678 MGMT_OP_SET_WIDEBAND_SPEECH, 3679 MGMT_STATUS_BUSY); 3680 goto unlock; 3681 } 3682 3683 if (hdev_is_powered(hdev) && 3684 !!cp->val != hci_dev_test_flag(hdev, 3685 HCI_WIDEBAND_SPEECH_ENABLED)) { 3686 err = mgmt_cmd_status(sk, hdev->id, 3687 MGMT_OP_SET_WIDEBAND_SPEECH, 3688 MGMT_STATUS_REJECTED); 3689 goto unlock; 3690 } 3691 3692 if (cp->val) 3693 changed = !hci_dev_test_and_set_flag(hdev, 3694 HCI_WIDEBAND_SPEECH_ENABLED); 3695 else 3696 changed = hci_dev_test_and_clear_flag(hdev, 3697 HCI_WIDEBAND_SPEECH_ENABLED); 3698 3699 err = send_settings_rsp(sk, MGMT_OP_SET_WIDEBAND_SPEECH, hdev); 3700 if (err < 0) 3701 goto unlock; 3702 3703 if (changed) 3704 err = new_settings(hdev, sk); 3705 3706 unlock: 3707 hci_dev_unlock(hdev); 3708 return err; 3709 } 3710 3711 static int read_security_info(struct sock *sk, struct hci_dev *hdev, 3712 void *data, u16 data_len) 3713 { 3714 char buf[16]; 3715 struct mgmt_rp_read_security_info *rp = (void *)buf; 3716 u16 sec_len = 0; 3717 u8 flags = 0; 3718 3719 bt_dev_dbg(hdev, "sock %p", sk); 3720 3721 memset(&buf, 0, sizeof(buf)); 3722 3723 hci_dev_lock(hdev); 3724 3725 /* When the Read Simple Pairing Options command is supported, then 3726 * the remote public key validation is supported. 3727 */ 3728 if (hdev->commands[41] & 0x08) 3729 flags |= 0x01; /* Remote public key validation (BR/EDR) */ 3730 3731 flags |= 0x02; /* Remote public key validation (LE) */ 3732 3733 /* When the Read Encryption Key Size command is supported, then the 3734 * encryption key size is enforced. 3735 */ 3736 if (hdev->commands[20] & 0x10) 3737 flags |= 0x04; /* Encryption key size enforcement (BR/EDR) */ 3738 3739 flags |= 0x08; /* Encryption key size enforcement (LE) */ 3740 3741 sec_len = eir_append_data(rp->sec, sec_len, 0x01, &flags, 1); 3742 3743 /* When the Read Simple Pairing Options command is supported, then 3744 * also max encryption key size information is provided. 3745 */ 3746 if (hdev->commands[41] & 0x08) 3747 sec_len = eir_append_le16(rp->sec, sec_len, 0x02, 3748 hdev->max_enc_key_size); 3749 3750 sec_len = eir_append_le16(rp->sec, sec_len, 0x03, SMP_MAX_ENC_KEY_SIZE); 3751 3752 rp->sec_len = cpu_to_le16(sec_len); 3753 3754 hci_dev_unlock(hdev); 3755 3756 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_SECURITY_INFO, 0, 3757 rp, sizeof(*rp) + sec_len); 3758 } 3759 3760 #ifdef CONFIG_BT_FEATURE_DEBUG 3761 /* d4992530-b9ec-469f-ab01-6c481c47da1c */ 3762 static const u8 debug_uuid[16] = { 3763 0x1c, 0xda, 0x47, 0x1c, 0x48, 0x6c, 0x01, 0xab, 3764 0x9f, 0x46, 0xec, 0xb9, 0x30, 0x25, 0x99, 0xd4, 3765 }; 3766 #endif 3767 3768 /* 671b10b5-42c0-4696-9227-eb28d1b049d6 */ 3769 static const u8 simult_central_periph_uuid[16] = { 3770 0xd6, 0x49, 0xb0, 0xd1, 0x28, 0xeb, 0x27, 0x92, 3771 0x96, 0x46, 0xc0, 0x42, 0xb5, 0x10, 0x1b, 0x67, 3772 }; 3773 3774 /* 15c0a148-c273-11ea-b3de-0242ac130004 */ 3775 static const u8 rpa_resolution_uuid[16] = { 3776 0x04, 0x00, 0x13, 0xac, 0x42, 0x02, 0xde, 0xb3, 3777 0xea, 0x11, 0x73, 0xc2, 0x48, 0xa1, 0xc0, 0x15, 3778 }; 3779 3780 static int read_exp_features_info(struct sock *sk, struct hci_dev *hdev, 3781 void *data, u16 data_len) 3782 { 3783 char buf[62]; /* Enough space for 3 features */ 3784 struct mgmt_rp_read_exp_features_info *rp = (void *)buf; 3785 u16 idx = 0; 3786 u32 flags; 3787 3788 bt_dev_dbg(hdev, "sock %p", sk); 3789 3790 memset(&buf, 0, sizeof(buf)); 3791 3792 #ifdef CONFIG_BT_FEATURE_DEBUG 3793 if (!hdev) { 3794 flags = bt_dbg_get() ? BIT(0) : 0; 3795 3796 memcpy(rp->features[idx].uuid, debug_uuid, 16); 3797 rp->features[idx].flags = cpu_to_le32(flags); 3798 idx++; 3799 } 3800 #endif 3801 3802 if (hdev) { 3803 if (test_bit(HCI_QUIRK_VALID_LE_STATES, &hdev->quirks) && 3804 (hdev->le_states[4] & 0x08) && /* Central */ 3805 (hdev->le_states[4] & 0x40) && /* Peripheral */ 3806 (hdev->le_states[3] & 0x10)) /* Simultaneous */ 3807 flags = BIT(0); 3808 else 3809 flags = 0; 3810 3811 memcpy(rp->features[idx].uuid, simult_central_periph_uuid, 16); 3812 rp->features[idx].flags = cpu_to_le32(flags); 3813 idx++; 3814 } 3815 3816 if (hdev && use_ll_privacy(hdev)) { 3817 if (hci_dev_test_flag(hdev, HCI_ENABLE_LL_PRIVACY)) 3818 flags = BIT(0) | BIT(1); 3819 else 3820 flags = BIT(1); 3821 3822 memcpy(rp->features[idx].uuid, rpa_resolution_uuid, 16); 3823 rp->features[idx].flags = cpu_to_le32(flags); 3824 idx++; 3825 } 3826 3827 rp->feature_count = cpu_to_le16(idx); 3828 3829 /* After reading the experimental features information, enable 3830 * the events to update client on any future change. 3831 */ 3832 hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS); 3833 3834 return mgmt_cmd_complete(sk, hdev ? hdev->id : MGMT_INDEX_NONE, 3835 MGMT_OP_READ_EXP_FEATURES_INFO, 3836 0, rp, sizeof(*rp) + (20 * idx)); 3837 } 3838 3839 static int exp_ll_privacy_feature_changed(bool enabled, struct hci_dev *hdev, 3840 struct sock *skip) 3841 { 3842 struct mgmt_ev_exp_feature_changed ev; 3843 3844 memset(&ev, 0, sizeof(ev)); 3845 memcpy(ev.uuid, rpa_resolution_uuid, 16); 3846 ev.flags = cpu_to_le32((enabled ? BIT(0) : 0) | BIT(1)); 3847 3848 return mgmt_limited_event(MGMT_EV_EXP_FEATURE_CHANGED, hdev, 3849 &ev, sizeof(ev), 3850 HCI_MGMT_EXP_FEATURE_EVENTS, skip); 3851 3852 } 3853 3854 #ifdef CONFIG_BT_FEATURE_DEBUG 3855 static int exp_debug_feature_changed(bool enabled, struct sock *skip) 3856 { 3857 struct mgmt_ev_exp_feature_changed ev; 3858 3859 memset(&ev, 0, sizeof(ev)); 3860 memcpy(ev.uuid, debug_uuid, 16); 3861 ev.flags = cpu_to_le32(enabled ? BIT(0) : 0); 3862 3863 return mgmt_limited_event(MGMT_EV_EXP_FEATURE_CHANGED, NULL, 3864 &ev, sizeof(ev), 3865 HCI_MGMT_EXP_FEATURE_EVENTS, skip); 3866 } 3867 #endif 3868 3869 static int set_exp_feature(struct sock *sk, struct hci_dev *hdev, 3870 void *data, u16 data_len) 3871 { 3872 struct mgmt_cp_set_exp_feature *cp = data; 3873 struct mgmt_rp_set_exp_feature rp; 3874 3875 bt_dev_dbg(hdev, "sock %p", sk); 3876 3877 if (!memcmp(cp->uuid, ZERO_KEY, 16)) { 3878 memset(rp.uuid, 0, 16); 3879 rp.flags = cpu_to_le32(0); 3880 3881 #ifdef CONFIG_BT_FEATURE_DEBUG 3882 if (!hdev) { 3883 bool changed = bt_dbg_get(); 3884 3885 bt_dbg_set(false); 3886 3887 if (changed) 3888 exp_debug_feature_changed(false, sk); 3889 } 3890 #endif 3891 3892 if (hdev && use_ll_privacy(hdev) && !hdev_is_powered(hdev)) { 3893 bool changed = hci_dev_test_flag(hdev, 3894 HCI_ENABLE_LL_PRIVACY); 3895 3896 hci_dev_clear_flag(hdev, HCI_ENABLE_LL_PRIVACY); 3897 3898 if (changed) 3899 exp_ll_privacy_feature_changed(false, hdev, sk); 3900 } 3901 3902 hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS); 3903 3904 return mgmt_cmd_complete(sk, hdev ? hdev->id : MGMT_INDEX_NONE, 3905 MGMT_OP_SET_EXP_FEATURE, 0, 3906 &rp, sizeof(rp)); 3907 } 3908 3909 #ifdef CONFIG_BT_FEATURE_DEBUG 3910 if (!memcmp(cp->uuid, debug_uuid, 16)) { 3911 bool val, changed; 3912 int err; 3913 3914 /* Command requires to use the non-controller index */ 3915 if (hdev) 3916 return mgmt_cmd_status(sk, hdev->id, 3917 MGMT_OP_SET_EXP_FEATURE, 3918 MGMT_STATUS_INVALID_INDEX); 3919 3920 /* Parameters are limited to a single octet */ 3921 if (data_len != MGMT_SET_EXP_FEATURE_SIZE + 1) 3922 return mgmt_cmd_status(sk, MGMT_INDEX_NONE, 3923 MGMT_OP_SET_EXP_FEATURE, 3924 MGMT_STATUS_INVALID_PARAMS); 3925 3926 /* Only boolean on/off is supported */ 3927 if (cp->param[0] != 0x00 && cp->param[0] != 0x01) 3928 return mgmt_cmd_status(sk, MGMT_INDEX_NONE, 3929 MGMT_OP_SET_EXP_FEATURE, 3930 MGMT_STATUS_INVALID_PARAMS); 3931 3932 val = !!cp->param[0]; 3933 changed = val ? !bt_dbg_get() : bt_dbg_get(); 3934 bt_dbg_set(val); 3935 3936 memcpy(rp.uuid, debug_uuid, 16); 3937 rp.flags = cpu_to_le32(val ? BIT(0) : 0); 3938 3939 hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS); 3940 3941 err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE, 3942 MGMT_OP_SET_EXP_FEATURE, 0, 3943 &rp, sizeof(rp)); 3944 3945 if (changed) 3946 exp_debug_feature_changed(val, sk); 3947 3948 return err; 3949 } 3950 #endif 3951 3952 if (!memcmp(cp->uuid, rpa_resolution_uuid, 16)) { 3953 bool val, changed; 3954 int err; 3955 u32 flags; 3956 3957 /* Command requires to use the controller index */ 3958 if (!hdev) 3959 return mgmt_cmd_status(sk, MGMT_INDEX_NONE, 3960 MGMT_OP_SET_EXP_FEATURE, 3961 MGMT_STATUS_INVALID_INDEX); 3962 3963 /* Changes can only be made when controller is powered down */ 3964 if (hdev_is_powered(hdev)) 3965 return mgmt_cmd_status(sk, hdev->id, 3966 MGMT_OP_SET_EXP_FEATURE, 3967 MGMT_STATUS_NOT_POWERED); 3968 3969 /* Parameters are limited to a single octet */ 3970 if (data_len != MGMT_SET_EXP_FEATURE_SIZE + 1) 3971 return mgmt_cmd_status(sk, hdev->id, 3972 MGMT_OP_SET_EXP_FEATURE, 3973 MGMT_STATUS_INVALID_PARAMS); 3974 3975 /* Only boolean on/off is supported */ 3976 if (cp->param[0] != 0x00 && cp->param[0] != 0x01) 3977 return mgmt_cmd_status(sk, hdev->id, 3978 MGMT_OP_SET_EXP_FEATURE, 3979 MGMT_STATUS_INVALID_PARAMS); 3980 3981 val = !!cp->param[0]; 3982 3983 if (val) { 3984 changed = !hci_dev_test_flag(hdev, 3985 HCI_ENABLE_LL_PRIVACY); 3986 hci_dev_set_flag(hdev, HCI_ENABLE_LL_PRIVACY); 3987 hci_dev_clear_flag(hdev, HCI_ADVERTISING); 3988 3989 /* Enable LL privacy + supported settings changed */ 3990 flags = BIT(0) | BIT(1); 3991 } else { 3992 changed = hci_dev_test_flag(hdev, 3993 HCI_ENABLE_LL_PRIVACY); 3994 hci_dev_clear_flag(hdev, HCI_ENABLE_LL_PRIVACY); 3995 3996 /* Disable LL privacy + supported settings changed */ 3997 flags = BIT(1); 3998 } 3999 4000 memcpy(rp.uuid, rpa_resolution_uuid, 16); 4001 rp.flags = cpu_to_le32(flags); 4002 4003 hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS); 4004 4005 err = mgmt_cmd_complete(sk, hdev->id, 4006 MGMT_OP_SET_EXP_FEATURE, 0, 4007 &rp, sizeof(rp)); 4008 4009 if (changed) 4010 exp_ll_privacy_feature_changed(val, hdev, sk); 4011 4012 return err; 4013 } 4014 4015 return mgmt_cmd_status(sk, hdev ? hdev->id : MGMT_INDEX_NONE, 4016 MGMT_OP_SET_EXP_FEATURE, 4017 MGMT_STATUS_NOT_SUPPORTED); 4018 } 4019 4020 #define SUPPORTED_DEVICE_FLAGS() ((1U << HCI_CONN_FLAG_MAX) - 1) 4021 4022 static int get_device_flags(struct sock *sk, struct hci_dev *hdev, void *data, 4023 u16 data_len) 4024 { 4025 struct mgmt_cp_get_device_flags *cp = data; 4026 struct mgmt_rp_get_device_flags rp; 4027 struct bdaddr_list_with_flags *br_params; 4028 struct hci_conn_params *params; 4029 u32 supported_flags = SUPPORTED_DEVICE_FLAGS(); 4030 u32 current_flags = 0; 4031 u8 status = MGMT_STATUS_INVALID_PARAMS; 4032 4033 bt_dev_dbg(hdev, "Get device flags %pMR (type 0x%x)\n", 4034 &cp->addr.bdaddr, cp->addr.type); 4035 4036 hci_dev_lock(hdev); 4037 4038 if (cp->addr.type == BDADDR_BREDR) { 4039 br_params = hci_bdaddr_list_lookup_with_flags(&hdev->whitelist, 4040 &cp->addr.bdaddr, 4041 cp->addr.type); 4042 if (!br_params) 4043 goto done; 4044 4045 current_flags = br_params->current_flags; 4046 } else { 4047 params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr, 4048 le_addr_type(cp->addr.type)); 4049 4050 if (!params) 4051 goto done; 4052 4053 current_flags = params->current_flags; 4054 } 4055 4056 bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr); 4057 rp.addr.type = cp->addr.type; 4058 rp.supported_flags = cpu_to_le32(supported_flags); 4059 rp.current_flags = cpu_to_le32(current_flags); 4060 4061 status = MGMT_STATUS_SUCCESS; 4062 4063 done: 4064 hci_dev_unlock(hdev); 4065 4066 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_DEVICE_FLAGS, status, 4067 &rp, sizeof(rp)); 4068 } 4069 4070 static void device_flags_changed(struct sock *sk, struct hci_dev *hdev, 4071 bdaddr_t *bdaddr, u8 bdaddr_type, 4072 u32 supported_flags, u32 current_flags) 4073 { 4074 struct mgmt_ev_device_flags_changed ev; 4075 4076 bacpy(&ev.addr.bdaddr, bdaddr); 4077 ev.addr.type = bdaddr_type; 4078 ev.supported_flags = cpu_to_le32(supported_flags); 4079 ev.current_flags = cpu_to_le32(current_flags); 4080 4081 mgmt_event(MGMT_EV_DEVICE_FLAGS_CHANGED, hdev, &ev, sizeof(ev), sk); 4082 } 4083 4084 static int set_device_flags(struct sock *sk, struct hci_dev *hdev, void *data, 4085 u16 len) 4086 { 4087 struct mgmt_cp_set_device_flags *cp = data; 4088 struct bdaddr_list_with_flags *br_params; 4089 struct hci_conn_params *params; 4090 u8 status = MGMT_STATUS_INVALID_PARAMS; 4091 u32 supported_flags = SUPPORTED_DEVICE_FLAGS(); 4092 u32 current_flags = __le32_to_cpu(cp->current_flags); 4093 4094 bt_dev_dbg(hdev, "Set device flags %pMR (type 0x%x) = 0x%x", 4095 &cp->addr.bdaddr, cp->addr.type, 4096 __le32_to_cpu(current_flags)); 4097 4098 if ((supported_flags | current_flags) != supported_flags) { 4099 bt_dev_warn(hdev, "Bad flag given (0x%x) vs supported (0x%0x)", 4100 current_flags, supported_flags); 4101 goto done; 4102 } 4103 4104 hci_dev_lock(hdev); 4105 4106 if (cp->addr.type == BDADDR_BREDR) { 4107 br_params = hci_bdaddr_list_lookup_with_flags(&hdev->whitelist, 4108 &cp->addr.bdaddr, 4109 cp->addr.type); 4110 4111 if (br_params) { 4112 br_params->current_flags = current_flags; 4113 status = MGMT_STATUS_SUCCESS; 4114 } else { 4115 bt_dev_warn(hdev, "No such BR/EDR device %pMR (0x%x)", 4116 &cp->addr.bdaddr, cp->addr.type); 4117 } 4118 } else { 4119 params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr, 4120 le_addr_type(cp->addr.type)); 4121 if (params) { 4122 params->current_flags = current_flags; 4123 status = MGMT_STATUS_SUCCESS; 4124 } else { 4125 bt_dev_warn(hdev, "No such LE device %pMR (0x%x)", 4126 &cp->addr.bdaddr, 4127 le_addr_type(cp->addr.type)); 4128 } 4129 } 4130 4131 done: 4132 hci_dev_unlock(hdev); 4133 4134 if (status == MGMT_STATUS_SUCCESS) 4135 device_flags_changed(sk, hdev, &cp->addr.bdaddr, cp->addr.type, 4136 supported_flags, current_flags); 4137 4138 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_DEVICE_FLAGS, status, 4139 &cp->addr, sizeof(cp->addr)); 4140 } 4141 4142 static void mgmt_adv_monitor_added(struct sock *sk, struct hci_dev *hdev, 4143 u16 handle) 4144 { 4145 struct mgmt_ev_adv_monitor_added ev; 4146 4147 ev.monitor_handle = cpu_to_le16(handle); 4148 4149 mgmt_event(MGMT_EV_ADV_MONITOR_ADDED, hdev, &ev, sizeof(ev), sk); 4150 } 4151 4152 static void mgmt_adv_monitor_removed(struct sock *sk, struct hci_dev *hdev, 4153 u16 handle) 4154 { 4155 struct mgmt_ev_adv_monitor_added ev; 4156 4157 ev.monitor_handle = cpu_to_le16(handle); 4158 4159 mgmt_event(MGMT_EV_ADV_MONITOR_REMOVED, hdev, &ev, sizeof(ev), sk); 4160 } 4161 4162 static int read_adv_mon_features(struct sock *sk, struct hci_dev *hdev, 4163 void *data, u16 len) 4164 { 4165 struct adv_monitor *monitor = NULL; 4166 struct mgmt_rp_read_adv_monitor_features *rp = NULL; 4167 int handle, err; 4168 size_t rp_size = 0; 4169 __u32 supported = 0; 4170 __u16 num_handles = 0; 4171 __u16 handles[HCI_MAX_ADV_MONITOR_NUM_HANDLES]; 4172 4173 BT_DBG("request for %s", hdev->name); 4174 4175 hci_dev_lock(hdev); 4176 4177 if (msft_get_features(hdev) & MSFT_FEATURE_MASK_LE_ADV_MONITOR) 4178 supported |= MGMT_ADV_MONITOR_FEATURE_MASK_OR_PATTERNS; 4179 4180 idr_for_each_entry(&hdev->adv_monitors_idr, monitor, handle) { 4181 handles[num_handles++] = monitor->handle; 4182 } 4183 4184 hci_dev_unlock(hdev); 4185 4186 rp_size = sizeof(*rp) + (num_handles * sizeof(u16)); 4187 rp = kmalloc(rp_size, GFP_KERNEL); 4188 if (!rp) 4189 return -ENOMEM; 4190 4191 /* Once controller-based monitoring is in place, the enabled_features 4192 * should reflect the use. 4193 */ 4194 rp->supported_features = cpu_to_le32(supported); 4195 rp->enabled_features = 0; 4196 rp->max_num_handles = cpu_to_le16(HCI_MAX_ADV_MONITOR_NUM_HANDLES); 4197 rp->max_num_patterns = HCI_MAX_ADV_MONITOR_NUM_PATTERNS; 4198 rp->num_handles = cpu_to_le16(num_handles); 4199 if (num_handles) 4200 memcpy(&rp->handles, &handles, (num_handles * sizeof(u16))); 4201 4202 err = mgmt_cmd_complete(sk, hdev->id, 4203 MGMT_OP_READ_ADV_MONITOR_FEATURES, 4204 MGMT_STATUS_SUCCESS, rp, rp_size); 4205 4206 kfree(rp); 4207 4208 return err; 4209 } 4210 4211 static int add_adv_patterns_monitor(struct sock *sk, struct hci_dev *hdev, 4212 void *data, u16 len) 4213 { 4214 struct mgmt_cp_add_adv_patterns_monitor *cp = data; 4215 struct mgmt_rp_add_adv_patterns_monitor rp; 4216 struct adv_monitor *m = NULL; 4217 struct adv_pattern *p = NULL; 4218 unsigned int mp_cnt = 0, prev_adv_monitors_cnt; 4219 __u8 cp_ofst = 0, cp_len = 0; 4220 int err, i; 4221 4222 BT_DBG("request for %s", hdev->name); 4223 4224 if (len <= sizeof(*cp) || cp->pattern_count == 0) { 4225 err = mgmt_cmd_status(sk, hdev->id, 4226 MGMT_OP_ADD_ADV_PATTERNS_MONITOR, 4227 MGMT_STATUS_INVALID_PARAMS); 4228 goto failed; 4229 } 4230 4231 m = kmalloc(sizeof(*m), GFP_KERNEL); 4232 if (!m) { 4233 err = -ENOMEM; 4234 goto failed; 4235 } 4236 4237 INIT_LIST_HEAD(&m->patterns); 4238 m->active = false; 4239 4240 for (i = 0; i < cp->pattern_count; i++) { 4241 if (++mp_cnt > HCI_MAX_ADV_MONITOR_NUM_PATTERNS) { 4242 err = mgmt_cmd_status(sk, hdev->id, 4243 MGMT_OP_ADD_ADV_PATTERNS_MONITOR, 4244 MGMT_STATUS_INVALID_PARAMS); 4245 goto failed; 4246 } 4247 4248 cp_ofst = cp->patterns[i].offset; 4249 cp_len = cp->patterns[i].length; 4250 if (cp_ofst >= HCI_MAX_AD_LENGTH || 4251 cp_len > HCI_MAX_AD_LENGTH || 4252 (cp_ofst + cp_len) > HCI_MAX_AD_LENGTH) { 4253 err = mgmt_cmd_status(sk, hdev->id, 4254 MGMT_OP_ADD_ADV_PATTERNS_MONITOR, 4255 MGMT_STATUS_INVALID_PARAMS); 4256 goto failed; 4257 } 4258 4259 p = kmalloc(sizeof(*p), GFP_KERNEL); 4260 if (!p) { 4261 err = -ENOMEM; 4262 goto failed; 4263 } 4264 4265 p->ad_type = cp->patterns[i].ad_type; 4266 p->offset = cp->patterns[i].offset; 4267 p->length = cp->patterns[i].length; 4268 memcpy(p->value, cp->patterns[i].value, p->length); 4269 4270 INIT_LIST_HEAD(&p->list); 4271 list_add(&p->list, &m->patterns); 4272 } 4273 4274 if (mp_cnt != cp->pattern_count) { 4275 err = mgmt_cmd_status(sk, hdev->id, 4276 MGMT_OP_ADD_ADV_PATTERNS_MONITOR, 4277 MGMT_STATUS_INVALID_PARAMS); 4278 goto failed; 4279 } 4280 4281 hci_dev_lock(hdev); 4282 4283 prev_adv_monitors_cnt = hdev->adv_monitors_cnt; 4284 4285 err = hci_add_adv_monitor(hdev, m); 4286 if (err) { 4287 if (err == -ENOSPC) { 4288 mgmt_cmd_status(sk, hdev->id, 4289 MGMT_OP_ADD_ADV_PATTERNS_MONITOR, 4290 MGMT_STATUS_NO_RESOURCES); 4291 } 4292 goto unlock; 4293 } 4294 4295 if (hdev->adv_monitors_cnt > prev_adv_monitors_cnt) 4296 mgmt_adv_monitor_added(sk, hdev, m->handle); 4297 4298 hci_dev_unlock(hdev); 4299 4300 rp.monitor_handle = cpu_to_le16(m->handle); 4301 4302 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_ADV_PATTERNS_MONITOR, 4303 MGMT_STATUS_SUCCESS, &rp, sizeof(rp)); 4304 4305 unlock: 4306 hci_dev_unlock(hdev); 4307 4308 failed: 4309 hci_free_adv_monitor(m); 4310 return err; 4311 } 4312 4313 static int remove_adv_monitor(struct sock *sk, struct hci_dev *hdev, 4314 void *data, u16 len) 4315 { 4316 struct mgmt_cp_remove_adv_monitor *cp = data; 4317 struct mgmt_rp_remove_adv_monitor rp; 4318 unsigned int prev_adv_monitors_cnt; 4319 u16 handle; 4320 int err; 4321 4322 BT_DBG("request for %s", hdev->name); 4323 4324 hci_dev_lock(hdev); 4325 4326 handle = __le16_to_cpu(cp->monitor_handle); 4327 prev_adv_monitors_cnt = hdev->adv_monitors_cnt; 4328 4329 err = hci_remove_adv_monitor(hdev, handle); 4330 if (err == -ENOENT) { 4331 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_ADV_MONITOR, 4332 MGMT_STATUS_INVALID_INDEX); 4333 goto unlock; 4334 } 4335 4336 if (hdev->adv_monitors_cnt < prev_adv_monitors_cnt) 4337 mgmt_adv_monitor_removed(sk, hdev, handle); 4338 4339 hci_dev_unlock(hdev); 4340 4341 rp.monitor_handle = cp->monitor_handle; 4342 4343 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_ADV_MONITOR, 4344 MGMT_STATUS_SUCCESS, &rp, sizeof(rp)); 4345 4346 unlock: 4347 hci_dev_unlock(hdev); 4348 return err; 4349 } 4350 4351 static void read_local_oob_data_complete(struct hci_dev *hdev, u8 status, 4352 u16 opcode, struct sk_buff *skb) 4353 { 4354 struct mgmt_rp_read_local_oob_data mgmt_rp; 4355 size_t rp_size = sizeof(mgmt_rp); 4356 struct mgmt_pending_cmd *cmd; 4357 4358 bt_dev_dbg(hdev, "status %u", status); 4359 4360 cmd = pending_find(MGMT_OP_READ_LOCAL_OOB_DATA, hdev); 4361 if (!cmd) 4362 return; 4363 4364 if (status || !skb) { 4365 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA, 4366 status ? mgmt_status(status) : MGMT_STATUS_FAILED); 4367 goto remove; 4368 } 4369 4370 memset(&mgmt_rp, 0, sizeof(mgmt_rp)); 4371 4372 if (opcode == HCI_OP_READ_LOCAL_OOB_DATA) { 4373 struct hci_rp_read_local_oob_data *rp = (void *) skb->data; 4374 4375 if (skb->len < sizeof(*rp)) { 4376 mgmt_cmd_status(cmd->sk, hdev->id, 4377 MGMT_OP_READ_LOCAL_OOB_DATA, 4378 MGMT_STATUS_FAILED); 4379 goto remove; 4380 } 4381 4382 memcpy(mgmt_rp.hash192, rp->hash, sizeof(rp->hash)); 4383 memcpy(mgmt_rp.rand192, rp->rand, sizeof(rp->rand)); 4384 4385 rp_size -= sizeof(mgmt_rp.hash256) + sizeof(mgmt_rp.rand256); 4386 } else { 4387 struct hci_rp_read_local_oob_ext_data *rp = (void *) skb->data; 4388 4389 if (skb->len < sizeof(*rp)) { 4390 mgmt_cmd_status(cmd->sk, hdev->id, 4391 MGMT_OP_READ_LOCAL_OOB_DATA, 4392 MGMT_STATUS_FAILED); 4393 goto remove; 4394 } 4395 4396 memcpy(mgmt_rp.hash192, rp->hash192, sizeof(rp->hash192)); 4397 memcpy(mgmt_rp.rand192, rp->rand192, sizeof(rp->rand192)); 4398 4399 memcpy(mgmt_rp.hash256, rp->hash256, sizeof(rp->hash256)); 4400 memcpy(mgmt_rp.rand256, rp->rand256, sizeof(rp->rand256)); 4401 } 4402 4403 mgmt_cmd_complete(cmd->sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA, 4404 MGMT_STATUS_SUCCESS, &mgmt_rp, rp_size); 4405 4406 remove: 4407 mgmt_pending_remove(cmd); 4408 } 4409 4410 static int read_local_oob_data(struct sock *sk, struct hci_dev *hdev, 4411 void *data, u16 data_len) 4412 { 4413 struct mgmt_pending_cmd *cmd; 4414 struct hci_request req; 4415 int err; 4416 4417 bt_dev_dbg(hdev, "sock %p", sk); 4418 4419 hci_dev_lock(hdev); 4420 4421 if (!hdev_is_powered(hdev)) { 4422 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA, 4423 MGMT_STATUS_NOT_POWERED); 4424 goto unlock; 4425 } 4426 4427 if (!lmp_ssp_capable(hdev)) { 4428 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA, 4429 MGMT_STATUS_NOT_SUPPORTED); 4430 goto unlock; 4431 } 4432 4433 if (pending_find(MGMT_OP_READ_LOCAL_OOB_DATA, hdev)) { 4434 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA, 4435 MGMT_STATUS_BUSY); 4436 goto unlock; 4437 } 4438 4439 cmd = mgmt_pending_add(sk, MGMT_OP_READ_LOCAL_OOB_DATA, hdev, NULL, 0); 4440 if (!cmd) { 4441 err = -ENOMEM; 4442 goto unlock; 4443 } 4444 4445 hci_req_init(&req, hdev); 4446 4447 if (bredr_sc_enabled(hdev)) 4448 hci_req_add(&req, HCI_OP_READ_LOCAL_OOB_EXT_DATA, 0, NULL); 4449 else 4450 hci_req_add(&req, HCI_OP_READ_LOCAL_OOB_DATA, 0, NULL); 4451 4452 err = hci_req_run_skb(&req, read_local_oob_data_complete); 4453 if (err < 0) 4454 mgmt_pending_remove(cmd); 4455 4456 unlock: 4457 hci_dev_unlock(hdev); 4458 return err; 4459 } 4460 4461 static int add_remote_oob_data(struct sock *sk, struct hci_dev *hdev, 4462 void *data, u16 len) 4463 { 4464 struct mgmt_addr_info *addr = data; 4465 int err; 4466 4467 bt_dev_dbg(hdev, "sock %p", sk); 4468 4469 if (!bdaddr_type_is_valid(addr->type)) 4470 return mgmt_cmd_complete(sk, hdev->id, 4471 MGMT_OP_ADD_REMOTE_OOB_DATA, 4472 MGMT_STATUS_INVALID_PARAMS, 4473 addr, sizeof(*addr)); 4474 4475 hci_dev_lock(hdev); 4476 4477 if (len == MGMT_ADD_REMOTE_OOB_DATA_SIZE) { 4478 struct mgmt_cp_add_remote_oob_data *cp = data; 4479 u8 status; 4480 4481 if (cp->addr.type != BDADDR_BREDR) { 4482 err = mgmt_cmd_complete(sk, hdev->id, 4483 MGMT_OP_ADD_REMOTE_OOB_DATA, 4484 MGMT_STATUS_INVALID_PARAMS, 4485 &cp->addr, sizeof(cp->addr)); 4486 goto unlock; 4487 } 4488 4489 err = hci_add_remote_oob_data(hdev, &cp->addr.bdaddr, 4490 cp->addr.type, cp->hash, 4491 cp->rand, NULL, NULL); 4492 if (err < 0) 4493 status = MGMT_STATUS_FAILED; 4494 else 4495 status = MGMT_STATUS_SUCCESS; 4496 4497 err = mgmt_cmd_complete(sk, hdev->id, 4498 MGMT_OP_ADD_REMOTE_OOB_DATA, status, 4499 &cp->addr, sizeof(cp->addr)); 4500 } else if (len == MGMT_ADD_REMOTE_OOB_EXT_DATA_SIZE) { 4501 struct mgmt_cp_add_remote_oob_ext_data *cp = data; 4502 u8 *rand192, *hash192, *rand256, *hash256; 4503 u8 status; 4504 4505 if (bdaddr_type_is_le(cp->addr.type)) { 4506 /* Enforce zero-valued 192-bit parameters as 4507 * long as legacy SMP OOB isn't implemented. 4508 */ 4509 if (memcmp(cp->rand192, ZERO_KEY, 16) || 4510 memcmp(cp->hash192, ZERO_KEY, 16)) { 4511 err = mgmt_cmd_complete(sk, hdev->id, 4512 MGMT_OP_ADD_REMOTE_OOB_DATA, 4513 MGMT_STATUS_INVALID_PARAMS, 4514 addr, sizeof(*addr)); 4515 goto unlock; 4516 } 4517 4518 rand192 = NULL; 4519 hash192 = NULL; 4520 } else { 4521 /* In case one of the P-192 values is set to zero, 4522 * then just disable OOB data for P-192. 4523 */ 4524 if (!memcmp(cp->rand192, ZERO_KEY, 16) || 4525 !memcmp(cp->hash192, ZERO_KEY, 16)) { 4526 rand192 = NULL; 4527 hash192 = NULL; 4528 } else { 4529 rand192 = cp->rand192; 4530 hash192 = cp->hash192; 4531 } 4532 } 4533 4534 /* In case one of the P-256 values is set to zero, then just 4535 * disable OOB data for P-256. 4536 */ 4537 if (!memcmp(cp->rand256, ZERO_KEY, 16) || 4538 !memcmp(cp->hash256, ZERO_KEY, 16)) { 4539 rand256 = NULL; 4540 hash256 = NULL; 4541 } else { 4542 rand256 = cp->rand256; 4543 hash256 = cp->hash256; 4544 } 4545 4546 err = hci_add_remote_oob_data(hdev, &cp->addr.bdaddr, 4547 cp->addr.type, hash192, rand192, 4548 hash256, rand256); 4549 if (err < 0) 4550 status = MGMT_STATUS_FAILED; 4551 else 4552 status = MGMT_STATUS_SUCCESS; 4553 4554 err = mgmt_cmd_complete(sk, hdev->id, 4555 MGMT_OP_ADD_REMOTE_OOB_DATA, 4556 status, &cp->addr, sizeof(cp->addr)); 4557 } else { 4558 bt_dev_err(hdev, "add_remote_oob_data: invalid len of %u bytes", 4559 len); 4560 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_REMOTE_OOB_DATA, 4561 MGMT_STATUS_INVALID_PARAMS); 4562 } 4563 4564 unlock: 4565 hci_dev_unlock(hdev); 4566 return err; 4567 } 4568 4569 static int remove_remote_oob_data(struct sock *sk, struct hci_dev *hdev, 4570 void *data, u16 len) 4571 { 4572 struct mgmt_cp_remove_remote_oob_data *cp = data; 4573 u8 status; 4574 int err; 4575 4576 bt_dev_dbg(hdev, "sock %p", sk); 4577 4578 if (cp->addr.type != BDADDR_BREDR) 4579 return mgmt_cmd_complete(sk, hdev->id, 4580 MGMT_OP_REMOVE_REMOTE_OOB_DATA, 4581 MGMT_STATUS_INVALID_PARAMS, 4582 &cp->addr, sizeof(cp->addr)); 4583 4584 hci_dev_lock(hdev); 4585 4586 if (!bacmp(&cp->addr.bdaddr, BDADDR_ANY)) { 4587 hci_remote_oob_data_clear(hdev); 4588 status = MGMT_STATUS_SUCCESS; 4589 goto done; 4590 } 4591 4592 err = hci_remove_remote_oob_data(hdev, &cp->addr.bdaddr, cp->addr.type); 4593 if (err < 0) 4594 status = MGMT_STATUS_INVALID_PARAMS; 4595 else 4596 status = MGMT_STATUS_SUCCESS; 4597 4598 done: 4599 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_REMOTE_OOB_DATA, 4600 status, &cp->addr, sizeof(cp->addr)); 4601 4602 hci_dev_unlock(hdev); 4603 return err; 4604 } 4605 4606 void mgmt_start_discovery_complete(struct hci_dev *hdev, u8 status) 4607 { 4608 struct mgmt_pending_cmd *cmd; 4609 4610 bt_dev_dbg(hdev, "status %d", status); 4611 4612 hci_dev_lock(hdev); 4613 4614 cmd = pending_find(MGMT_OP_START_DISCOVERY, hdev); 4615 if (!cmd) 4616 cmd = pending_find(MGMT_OP_START_SERVICE_DISCOVERY, hdev); 4617 4618 if (!cmd) 4619 cmd = pending_find(MGMT_OP_START_LIMITED_DISCOVERY, hdev); 4620 4621 if (cmd) { 4622 cmd->cmd_complete(cmd, mgmt_status(status)); 4623 mgmt_pending_remove(cmd); 4624 } 4625 4626 hci_dev_unlock(hdev); 4627 4628 /* Handle suspend notifier */ 4629 if (test_and_clear_bit(SUSPEND_UNPAUSE_DISCOVERY, 4630 hdev->suspend_tasks)) { 4631 bt_dev_dbg(hdev, "Unpaused discovery"); 4632 wake_up(&hdev->suspend_wait_q); 4633 } 4634 } 4635 4636 static bool discovery_type_is_valid(struct hci_dev *hdev, uint8_t type, 4637 uint8_t *mgmt_status) 4638 { 4639 switch (type) { 4640 case DISCOV_TYPE_LE: 4641 *mgmt_status = mgmt_le_support(hdev); 4642 if (*mgmt_status) 4643 return false; 4644 break; 4645 case DISCOV_TYPE_INTERLEAVED: 4646 *mgmt_status = mgmt_le_support(hdev); 4647 if (*mgmt_status) 4648 return false; 4649 fallthrough; 4650 case DISCOV_TYPE_BREDR: 4651 *mgmt_status = mgmt_bredr_support(hdev); 4652 if (*mgmt_status) 4653 return false; 4654 break; 4655 default: 4656 *mgmt_status = MGMT_STATUS_INVALID_PARAMS; 4657 return false; 4658 } 4659 4660 return true; 4661 } 4662 4663 static int start_discovery_internal(struct sock *sk, struct hci_dev *hdev, 4664 u16 op, void *data, u16 len) 4665 { 4666 struct mgmt_cp_start_discovery *cp = data; 4667 struct mgmt_pending_cmd *cmd; 4668 u8 status; 4669 int err; 4670 4671 bt_dev_dbg(hdev, "sock %p", sk); 4672 4673 hci_dev_lock(hdev); 4674 4675 if (!hdev_is_powered(hdev)) { 4676 err = mgmt_cmd_complete(sk, hdev->id, op, 4677 MGMT_STATUS_NOT_POWERED, 4678 &cp->type, sizeof(cp->type)); 4679 goto failed; 4680 } 4681 4682 if (hdev->discovery.state != DISCOVERY_STOPPED || 4683 hci_dev_test_flag(hdev, HCI_PERIODIC_INQ)) { 4684 err = mgmt_cmd_complete(sk, hdev->id, op, MGMT_STATUS_BUSY, 4685 &cp->type, sizeof(cp->type)); 4686 goto failed; 4687 } 4688 4689 if (!discovery_type_is_valid(hdev, cp->type, &status)) { 4690 err = mgmt_cmd_complete(sk, hdev->id, op, status, 4691 &cp->type, sizeof(cp->type)); 4692 goto failed; 4693 } 4694 4695 /* Can't start discovery when it is paused */ 4696 if (hdev->discovery_paused) { 4697 err = mgmt_cmd_complete(sk, hdev->id, op, MGMT_STATUS_BUSY, 4698 &cp->type, sizeof(cp->type)); 4699 goto failed; 4700 } 4701 4702 /* Clear the discovery filter first to free any previously 4703 * allocated memory for the UUID list. 4704 */ 4705 hci_discovery_filter_clear(hdev); 4706 4707 hdev->discovery.type = cp->type; 4708 hdev->discovery.report_invalid_rssi = false; 4709 if (op == MGMT_OP_START_LIMITED_DISCOVERY) 4710 hdev->discovery.limited = true; 4711 else 4712 hdev->discovery.limited = false; 4713 4714 cmd = mgmt_pending_add(sk, op, hdev, data, len); 4715 if (!cmd) { 4716 err = -ENOMEM; 4717 goto failed; 4718 } 4719 4720 cmd->cmd_complete = generic_cmd_complete; 4721 4722 hci_discovery_set_state(hdev, DISCOVERY_STARTING); 4723 queue_work(hdev->req_workqueue, &hdev->discov_update); 4724 err = 0; 4725 4726 failed: 4727 hci_dev_unlock(hdev); 4728 return err; 4729 } 4730 4731 static int start_discovery(struct sock *sk, struct hci_dev *hdev, 4732 void *data, u16 len) 4733 { 4734 return start_discovery_internal(sk, hdev, MGMT_OP_START_DISCOVERY, 4735 data, len); 4736 } 4737 4738 static int start_limited_discovery(struct sock *sk, struct hci_dev *hdev, 4739 void *data, u16 len) 4740 { 4741 return start_discovery_internal(sk, hdev, 4742 MGMT_OP_START_LIMITED_DISCOVERY, 4743 data, len); 4744 } 4745 4746 static int service_discovery_cmd_complete(struct mgmt_pending_cmd *cmd, 4747 u8 status) 4748 { 4749 return mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, status, 4750 cmd->param, 1); 4751 } 4752 4753 static int start_service_discovery(struct sock *sk, struct hci_dev *hdev, 4754 void *data, u16 len) 4755 { 4756 struct mgmt_cp_start_service_discovery *cp = data; 4757 struct mgmt_pending_cmd *cmd; 4758 const u16 max_uuid_count = ((U16_MAX - sizeof(*cp)) / 16); 4759 u16 uuid_count, expected_len; 4760 u8 status; 4761 int err; 4762 4763 bt_dev_dbg(hdev, "sock %p", sk); 4764 4765 hci_dev_lock(hdev); 4766 4767 if (!hdev_is_powered(hdev)) { 4768 err = mgmt_cmd_complete(sk, hdev->id, 4769 MGMT_OP_START_SERVICE_DISCOVERY, 4770 MGMT_STATUS_NOT_POWERED, 4771 &cp->type, sizeof(cp->type)); 4772 goto failed; 4773 } 4774 4775 if (hdev->discovery.state != DISCOVERY_STOPPED || 4776 hci_dev_test_flag(hdev, HCI_PERIODIC_INQ)) { 4777 err = mgmt_cmd_complete(sk, hdev->id, 4778 MGMT_OP_START_SERVICE_DISCOVERY, 4779 MGMT_STATUS_BUSY, &cp->type, 4780 sizeof(cp->type)); 4781 goto failed; 4782 } 4783 4784 uuid_count = __le16_to_cpu(cp->uuid_count); 4785 if (uuid_count > max_uuid_count) { 4786 bt_dev_err(hdev, "service_discovery: too big uuid_count value %u", 4787 uuid_count); 4788 err = mgmt_cmd_complete(sk, hdev->id, 4789 MGMT_OP_START_SERVICE_DISCOVERY, 4790 MGMT_STATUS_INVALID_PARAMS, &cp->type, 4791 sizeof(cp->type)); 4792 goto failed; 4793 } 4794 4795 expected_len = sizeof(*cp) + uuid_count * 16; 4796 if (expected_len != len) { 4797 bt_dev_err(hdev, "service_discovery: expected %u bytes, got %u bytes", 4798 expected_len, len); 4799 err = mgmt_cmd_complete(sk, hdev->id, 4800 MGMT_OP_START_SERVICE_DISCOVERY, 4801 MGMT_STATUS_INVALID_PARAMS, &cp->type, 4802 sizeof(cp->type)); 4803 goto failed; 4804 } 4805 4806 if (!discovery_type_is_valid(hdev, cp->type, &status)) { 4807 err = mgmt_cmd_complete(sk, hdev->id, 4808 MGMT_OP_START_SERVICE_DISCOVERY, 4809 status, &cp->type, sizeof(cp->type)); 4810 goto failed; 4811 } 4812 4813 cmd = mgmt_pending_add(sk, MGMT_OP_START_SERVICE_DISCOVERY, 4814 hdev, data, len); 4815 if (!cmd) { 4816 err = -ENOMEM; 4817 goto failed; 4818 } 4819 4820 cmd->cmd_complete = service_discovery_cmd_complete; 4821 4822 /* Clear the discovery filter first to free any previously 4823 * allocated memory for the UUID list. 4824 */ 4825 hci_discovery_filter_clear(hdev); 4826 4827 hdev->discovery.result_filtering = true; 4828 hdev->discovery.type = cp->type; 4829 hdev->discovery.rssi = cp->rssi; 4830 hdev->discovery.uuid_count = uuid_count; 4831 4832 if (uuid_count > 0) { 4833 hdev->discovery.uuids = kmemdup(cp->uuids, uuid_count * 16, 4834 GFP_KERNEL); 4835 if (!hdev->discovery.uuids) { 4836 err = mgmt_cmd_complete(sk, hdev->id, 4837 MGMT_OP_START_SERVICE_DISCOVERY, 4838 MGMT_STATUS_FAILED, 4839 &cp->type, sizeof(cp->type)); 4840 mgmt_pending_remove(cmd); 4841 goto failed; 4842 } 4843 } 4844 4845 hci_discovery_set_state(hdev, DISCOVERY_STARTING); 4846 queue_work(hdev->req_workqueue, &hdev->discov_update); 4847 err = 0; 4848 4849 failed: 4850 hci_dev_unlock(hdev); 4851 return err; 4852 } 4853 4854 void mgmt_stop_discovery_complete(struct hci_dev *hdev, u8 status) 4855 { 4856 struct mgmt_pending_cmd *cmd; 4857 4858 bt_dev_dbg(hdev, "status %d", status); 4859 4860 hci_dev_lock(hdev); 4861 4862 cmd = pending_find(MGMT_OP_STOP_DISCOVERY, hdev); 4863 if (cmd) { 4864 cmd->cmd_complete(cmd, mgmt_status(status)); 4865 mgmt_pending_remove(cmd); 4866 } 4867 4868 hci_dev_unlock(hdev); 4869 4870 /* Handle suspend notifier */ 4871 if (test_and_clear_bit(SUSPEND_PAUSE_DISCOVERY, hdev->suspend_tasks)) { 4872 bt_dev_dbg(hdev, "Paused discovery"); 4873 wake_up(&hdev->suspend_wait_q); 4874 } 4875 } 4876 4877 static int stop_discovery(struct sock *sk, struct hci_dev *hdev, void *data, 4878 u16 len) 4879 { 4880 struct mgmt_cp_stop_discovery *mgmt_cp = data; 4881 struct mgmt_pending_cmd *cmd; 4882 int err; 4883 4884 bt_dev_dbg(hdev, "sock %p", sk); 4885 4886 hci_dev_lock(hdev); 4887 4888 if (!hci_discovery_active(hdev)) { 4889 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY, 4890 MGMT_STATUS_REJECTED, &mgmt_cp->type, 4891 sizeof(mgmt_cp->type)); 4892 goto unlock; 4893 } 4894 4895 if (hdev->discovery.type != mgmt_cp->type) { 4896 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY, 4897 MGMT_STATUS_INVALID_PARAMS, 4898 &mgmt_cp->type, sizeof(mgmt_cp->type)); 4899 goto unlock; 4900 } 4901 4902 cmd = mgmt_pending_add(sk, MGMT_OP_STOP_DISCOVERY, hdev, data, len); 4903 if (!cmd) { 4904 err = -ENOMEM; 4905 goto unlock; 4906 } 4907 4908 cmd->cmd_complete = generic_cmd_complete; 4909 4910 hci_discovery_set_state(hdev, DISCOVERY_STOPPING); 4911 queue_work(hdev->req_workqueue, &hdev->discov_update); 4912 err = 0; 4913 4914 unlock: 4915 hci_dev_unlock(hdev); 4916 return err; 4917 } 4918 4919 static int confirm_name(struct sock *sk, struct hci_dev *hdev, void *data, 4920 u16 len) 4921 { 4922 struct mgmt_cp_confirm_name *cp = data; 4923 struct inquiry_entry *e; 4924 int err; 4925 4926 bt_dev_dbg(hdev, "sock %p", sk); 4927 4928 hci_dev_lock(hdev); 4929 4930 if (!hci_discovery_active(hdev)) { 4931 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME, 4932 MGMT_STATUS_FAILED, &cp->addr, 4933 sizeof(cp->addr)); 4934 goto failed; 4935 } 4936 4937 e = hci_inquiry_cache_lookup_unknown(hdev, &cp->addr.bdaddr); 4938 if (!e) { 4939 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME, 4940 MGMT_STATUS_INVALID_PARAMS, &cp->addr, 4941 sizeof(cp->addr)); 4942 goto failed; 4943 } 4944 4945 if (cp->name_known) { 4946 e->name_state = NAME_KNOWN; 4947 list_del(&e->list); 4948 } else { 4949 e->name_state = NAME_NEEDED; 4950 hci_inquiry_cache_update_resolve(hdev, e); 4951 } 4952 4953 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME, 0, 4954 &cp->addr, sizeof(cp->addr)); 4955 4956 failed: 4957 hci_dev_unlock(hdev); 4958 return err; 4959 } 4960 4961 static int block_device(struct sock *sk, struct hci_dev *hdev, void *data, 4962 u16 len) 4963 { 4964 struct mgmt_cp_block_device *cp = data; 4965 u8 status; 4966 int err; 4967 4968 bt_dev_dbg(hdev, "sock %p", sk); 4969 4970 if (!bdaddr_type_is_valid(cp->addr.type)) 4971 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_BLOCK_DEVICE, 4972 MGMT_STATUS_INVALID_PARAMS, 4973 &cp->addr, sizeof(cp->addr)); 4974 4975 hci_dev_lock(hdev); 4976 4977 err = hci_bdaddr_list_add(&hdev->blacklist, &cp->addr.bdaddr, 4978 cp->addr.type); 4979 if (err < 0) { 4980 status = MGMT_STATUS_FAILED; 4981 goto done; 4982 } 4983 4984 mgmt_event(MGMT_EV_DEVICE_BLOCKED, hdev, &cp->addr, sizeof(cp->addr), 4985 sk); 4986 status = MGMT_STATUS_SUCCESS; 4987 4988 done: 4989 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_BLOCK_DEVICE, status, 4990 &cp->addr, sizeof(cp->addr)); 4991 4992 hci_dev_unlock(hdev); 4993 4994 return err; 4995 } 4996 4997 static int unblock_device(struct sock *sk, struct hci_dev *hdev, void *data, 4998 u16 len) 4999 { 5000 struct mgmt_cp_unblock_device *cp = data; 5001 u8 status; 5002 int err; 5003 5004 bt_dev_dbg(hdev, "sock %p", sk); 5005 5006 if (!bdaddr_type_is_valid(cp->addr.type)) 5007 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNBLOCK_DEVICE, 5008 MGMT_STATUS_INVALID_PARAMS, 5009 &cp->addr, sizeof(cp->addr)); 5010 5011 hci_dev_lock(hdev); 5012 5013 err = hci_bdaddr_list_del(&hdev->blacklist, &cp->addr.bdaddr, 5014 cp->addr.type); 5015 if (err < 0) { 5016 status = MGMT_STATUS_INVALID_PARAMS; 5017 goto done; 5018 } 5019 5020 mgmt_event(MGMT_EV_DEVICE_UNBLOCKED, hdev, &cp->addr, sizeof(cp->addr), 5021 sk); 5022 status = MGMT_STATUS_SUCCESS; 5023 5024 done: 5025 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNBLOCK_DEVICE, status, 5026 &cp->addr, sizeof(cp->addr)); 5027 5028 hci_dev_unlock(hdev); 5029 5030 return err; 5031 } 5032 5033 static int set_device_id(struct sock *sk, struct hci_dev *hdev, void *data, 5034 u16 len) 5035 { 5036 struct mgmt_cp_set_device_id *cp = data; 5037 struct hci_request req; 5038 int err; 5039 __u16 source; 5040 5041 bt_dev_dbg(hdev, "sock %p", sk); 5042 5043 source = __le16_to_cpu(cp->source); 5044 5045 if (source > 0x0002) 5046 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEVICE_ID, 5047 MGMT_STATUS_INVALID_PARAMS); 5048 5049 hci_dev_lock(hdev); 5050 5051 hdev->devid_source = source; 5052 hdev->devid_vendor = __le16_to_cpu(cp->vendor); 5053 hdev->devid_product = __le16_to_cpu(cp->product); 5054 hdev->devid_version = __le16_to_cpu(cp->version); 5055 5056 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_DEVICE_ID, 0, 5057 NULL, 0); 5058 5059 hci_req_init(&req, hdev); 5060 __hci_req_update_eir(&req); 5061 hci_req_run(&req, NULL); 5062 5063 hci_dev_unlock(hdev); 5064 5065 return err; 5066 } 5067 5068 static void enable_advertising_instance(struct hci_dev *hdev, u8 status, 5069 u16 opcode) 5070 { 5071 bt_dev_dbg(hdev, "status %d", status); 5072 } 5073 5074 static void set_advertising_complete(struct hci_dev *hdev, u8 status, 5075 u16 opcode) 5076 { 5077 struct cmd_lookup match = { NULL, hdev }; 5078 struct hci_request req; 5079 u8 instance; 5080 struct adv_info *adv_instance; 5081 int err; 5082 5083 hci_dev_lock(hdev); 5084 5085 if (status) { 5086 u8 mgmt_err = mgmt_status(status); 5087 5088 mgmt_pending_foreach(MGMT_OP_SET_ADVERTISING, hdev, 5089 cmd_status_rsp, &mgmt_err); 5090 goto unlock; 5091 } 5092 5093 if (hci_dev_test_flag(hdev, HCI_LE_ADV)) 5094 hci_dev_set_flag(hdev, HCI_ADVERTISING); 5095 else 5096 hci_dev_clear_flag(hdev, HCI_ADVERTISING); 5097 5098 mgmt_pending_foreach(MGMT_OP_SET_ADVERTISING, hdev, settings_rsp, 5099 &match); 5100 5101 new_settings(hdev, match.sk); 5102 5103 if (match.sk) 5104 sock_put(match.sk); 5105 5106 /* Handle suspend notifier */ 5107 if (test_and_clear_bit(SUSPEND_PAUSE_ADVERTISING, 5108 hdev->suspend_tasks)) { 5109 bt_dev_dbg(hdev, "Paused advertising"); 5110 wake_up(&hdev->suspend_wait_q); 5111 } else if (test_and_clear_bit(SUSPEND_UNPAUSE_ADVERTISING, 5112 hdev->suspend_tasks)) { 5113 bt_dev_dbg(hdev, "Unpaused advertising"); 5114 wake_up(&hdev->suspend_wait_q); 5115 } 5116 5117 /* If "Set Advertising" was just disabled and instance advertising was 5118 * set up earlier, then re-enable multi-instance advertising. 5119 */ 5120 if (hci_dev_test_flag(hdev, HCI_ADVERTISING) || 5121 list_empty(&hdev->adv_instances)) 5122 goto unlock; 5123 5124 instance = hdev->cur_adv_instance; 5125 if (!instance) { 5126 adv_instance = list_first_entry_or_null(&hdev->adv_instances, 5127 struct adv_info, list); 5128 if (!adv_instance) 5129 goto unlock; 5130 5131 instance = adv_instance->instance; 5132 } 5133 5134 hci_req_init(&req, hdev); 5135 5136 err = __hci_req_schedule_adv_instance(&req, instance, true); 5137 5138 if (!err) 5139 err = hci_req_run(&req, enable_advertising_instance); 5140 5141 if (err) 5142 bt_dev_err(hdev, "failed to re-configure advertising"); 5143 5144 unlock: 5145 hci_dev_unlock(hdev); 5146 } 5147 5148 static int set_advertising(struct sock *sk, struct hci_dev *hdev, void *data, 5149 u16 len) 5150 { 5151 struct mgmt_mode *cp = data; 5152 struct mgmt_pending_cmd *cmd; 5153 struct hci_request req; 5154 u8 val, status; 5155 int err; 5156 5157 bt_dev_dbg(hdev, "sock %p", sk); 5158 5159 status = mgmt_le_support(hdev); 5160 if (status) 5161 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING, 5162 status); 5163 5164 /* Enabling the experimental LL Privay support disables support for 5165 * advertising. 5166 */ 5167 if (hci_dev_test_flag(hdev, HCI_ENABLE_LL_PRIVACY)) 5168 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING, 5169 MGMT_STATUS_NOT_SUPPORTED); 5170 5171 if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02) 5172 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING, 5173 MGMT_STATUS_INVALID_PARAMS); 5174 5175 if (hdev->advertising_paused) 5176 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING, 5177 MGMT_STATUS_BUSY); 5178 5179 hci_dev_lock(hdev); 5180 5181 val = !!cp->val; 5182 5183 /* The following conditions are ones which mean that we should 5184 * not do any HCI communication but directly send a mgmt 5185 * response to user space (after toggling the flag if 5186 * necessary). 5187 */ 5188 if (!hdev_is_powered(hdev) || 5189 (val == hci_dev_test_flag(hdev, HCI_ADVERTISING) && 5190 (cp->val == 0x02) == hci_dev_test_flag(hdev, HCI_ADVERTISING_CONNECTABLE)) || 5191 hci_conn_num(hdev, LE_LINK) > 0 || 5192 (hci_dev_test_flag(hdev, HCI_LE_SCAN) && 5193 hdev->le_scan_type == LE_SCAN_ACTIVE)) { 5194 bool changed; 5195 5196 if (cp->val) { 5197 hdev->cur_adv_instance = 0x00; 5198 changed = !hci_dev_test_and_set_flag(hdev, HCI_ADVERTISING); 5199 if (cp->val == 0x02) 5200 hci_dev_set_flag(hdev, HCI_ADVERTISING_CONNECTABLE); 5201 else 5202 hci_dev_clear_flag(hdev, HCI_ADVERTISING_CONNECTABLE); 5203 } else { 5204 changed = hci_dev_test_and_clear_flag(hdev, HCI_ADVERTISING); 5205 hci_dev_clear_flag(hdev, HCI_ADVERTISING_CONNECTABLE); 5206 } 5207 5208 err = send_settings_rsp(sk, MGMT_OP_SET_ADVERTISING, hdev); 5209 if (err < 0) 5210 goto unlock; 5211 5212 if (changed) 5213 err = new_settings(hdev, sk); 5214 5215 goto unlock; 5216 } 5217 5218 if (pending_find(MGMT_OP_SET_ADVERTISING, hdev) || 5219 pending_find(MGMT_OP_SET_LE, hdev)) { 5220 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING, 5221 MGMT_STATUS_BUSY); 5222 goto unlock; 5223 } 5224 5225 cmd = mgmt_pending_add(sk, MGMT_OP_SET_ADVERTISING, hdev, data, len); 5226 if (!cmd) { 5227 err = -ENOMEM; 5228 goto unlock; 5229 } 5230 5231 hci_req_init(&req, hdev); 5232 5233 if (cp->val == 0x02) 5234 hci_dev_set_flag(hdev, HCI_ADVERTISING_CONNECTABLE); 5235 else 5236 hci_dev_clear_flag(hdev, HCI_ADVERTISING_CONNECTABLE); 5237 5238 cancel_adv_timeout(hdev); 5239 5240 if (val) { 5241 /* Switch to instance "0" for the Set Advertising setting. 5242 * We cannot use update_[adv|scan_rsp]_data() here as the 5243 * HCI_ADVERTISING flag is not yet set. 5244 */ 5245 hdev->cur_adv_instance = 0x00; 5246 5247 if (ext_adv_capable(hdev)) { 5248 __hci_req_start_ext_adv(&req, 0x00); 5249 } else { 5250 __hci_req_update_adv_data(&req, 0x00); 5251 __hci_req_update_scan_rsp_data(&req, 0x00); 5252 __hci_req_enable_advertising(&req); 5253 } 5254 } else { 5255 __hci_req_disable_advertising(&req); 5256 } 5257 5258 err = hci_req_run(&req, set_advertising_complete); 5259 if (err < 0) 5260 mgmt_pending_remove(cmd); 5261 5262 unlock: 5263 hci_dev_unlock(hdev); 5264 return err; 5265 } 5266 5267 static int set_static_address(struct sock *sk, struct hci_dev *hdev, 5268 void *data, u16 len) 5269 { 5270 struct mgmt_cp_set_static_address *cp = data; 5271 int err; 5272 5273 bt_dev_dbg(hdev, "sock %p", sk); 5274 5275 if (!lmp_le_capable(hdev)) 5276 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_STATIC_ADDRESS, 5277 MGMT_STATUS_NOT_SUPPORTED); 5278 5279 if (hdev_is_powered(hdev)) 5280 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_STATIC_ADDRESS, 5281 MGMT_STATUS_REJECTED); 5282 5283 if (bacmp(&cp->bdaddr, BDADDR_ANY)) { 5284 if (!bacmp(&cp->bdaddr, BDADDR_NONE)) 5285 return mgmt_cmd_status(sk, hdev->id, 5286 MGMT_OP_SET_STATIC_ADDRESS, 5287 MGMT_STATUS_INVALID_PARAMS); 5288 5289 /* Two most significant bits shall be set */ 5290 if ((cp->bdaddr.b[5] & 0xc0) != 0xc0) 5291 return mgmt_cmd_status(sk, hdev->id, 5292 MGMT_OP_SET_STATIC_ADDRESS, 5293 MGMT_STATUS_INVALID_PARAMS); 5294 } 5295 5296 hci_dev_lock(hdev); 5297 5298 bacpy(&hdev->static_addr, &cp->bdaddr); 5299 5300 err = send_settings_rsp(sk, MGMT_OP_SET_STATIC_ADDRESS, hdev); 5301 if (err < 0) 5302 goto unlock; 5303 5304 err = new_settings(hdev, sk); 5305 5306 unlock: 5307 hci_dev_unlock(hdev); 5308 return err; 5309 } 5310 5311 static int set_scan_params(struct sock *sk, struct hci_dev *hdev, 5312 void *data, u16 len) 5313 { 5314 struct mgmt_cp_set_scan_params *cp = data; 5315 __u16 interval, window; 5316 int err; 5317 5318 bt_dev_dbg(hdev, "sock %p", sk); 5319 5320 if (!lmp_le_capable(hdev)) 5321 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS, 5322 MGMT_STATUS_NOT_SUPPORTED); 5323 5324 interval = __le16_to_cpu(cp->interval); 5325 5326 if (interval < 0x0004 || interval > 0x4000) 5327 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS, 5328 MGMT_STATUS_INVALID_PARAMS); 5329 5330 window = __le16_to_cpu(cp->window); 5331 5332 if (window < 0x0004 || window > 0x4000) 5333 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS, 5334 MGMT_STATUS_INVALID_PARAMS); 5335 5336 if (window > interval) 5337 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS, 5338 MGMT_STATUS_INVALID_PARAMS); 5339 5340 hci_dev_lock(hdev); 5341 5342 hdev->le_scan_interval = interval; 5343 hdev->le_scan_window = window; 5344 5345 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS, 0, 5346 NULL, 0); 5347 5348 /* If background scan is running, restart it so new parameters are 5349 * loaded. 5350 */ 5351 if (hci_dev_test_flag(hdev, HCI_LE_SCAN) && 5352 hdev->discovery.state == DISCOVERY_STOPPED) { 5353 struct hci_request req; 5354 5355 hci_req_init(&req, hdev); 5356 5357 hci_req_add_le_scan_disable(&req, false); 5358 hci_req_add_le_passive_scan(&req); 5359 5360 hci_req_run(&req, NULL); 5361 } 5362 5363 hci_dev_unlock(hdev); 5364 5365 return err; 5366 } 5367 5368 static void fast_connectable_complete(struct hci_dev *hdev, u8 status, 5369 u16 opcode) 5370 { 5371 struct mgmt_pending_cmd *cmd; 5372 5373 bt_dev_dbg(hdev, "status 0x%02x", status); 5374 5375 hci_dev_lock(hdev); 5376 5377 cmd = pending_find(MGMT_OP_SET_FAST_CONNECTABLE, hdev); 5378 if (!cmd) 5379 goto unlock; 5380 5381 if (status) { 5382 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE, 5383 mgmt_status(status)); 5384 } else { 5385 struct mgmt_mode *cp = cmd->param; 5386 5387 if (cp->val) 5388 hci_dev_set_flag(hdev, HCI_FAST_CONNECTABLE); 5389 else 5390 hci_dev_clear_flag(hdev, HCI_FAST_CONNECTABLE); 5391 5392 send_settings_rsp(cmd->sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev); 5393 new_settings(hdev, cmd->sk); 5394 } 5395 5396 mgmt_pending_remove(cmd); 5397 5398 unlock: 5399 hci_dev_unlock(hdev); 5400 } 5401 5402 static int set_fast_connectable(struct sock *sk, struct hci_dev *hdev, 5403 void *data, u16 len) 5404 { 5405 struct mgmt_mode *cp = data; 5406 struct mgmt_pending_cmd *cmd; 5407 struct hci_request req; 5408 int err; 5409 5410 bt_dev_dbg(hdev, "sock %p", sk); 5411 5412 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) || 5413 hdev->hci_ver < BLUETOOTH_VER_1_2) 5414 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE, 5415 MGMT_STATUS_NOT_SUPPORTED); 5416 5417 if (cp->val != 0x00 && cp->val != 0x01) 5418 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE, 5419 MGMT_STATUS_INVALID_PARAMS); 5420 5421 hci_dev_lock(hdev); 5422 5423 if (pending_find(MGMT_OP_SET_FAST_CONNECTABLE, hdev)) { 5424 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE, 5425 MGMT_STATUS_BUSY); 5426 goto unlock; 5427 } 5428 5429 if (!!cp->val == hci_dev_test_flag(hdev, HCI_FAST_CONNECTABLE)) { 5430 err = send_settings_rsp(sk, MGMT_OP_SET_FAST_CONNECTABLE, 5431 hdev); 5432 goto unlock; 5433 } 5434 5435 if (!hdev_is_powered(hdev)) { 5436 hci_dev_change_flag(hdev, HCI_FAST_CONNECTABLE); 5437 err = send_settings_rsp(sk, MGMT_OP_SET_FAST_CONNECTABLE, 5438 hdev); 5439 new_settings(hdev, sk); 5440 goto unlock; 5441 } 5442 5443 cmd = mgmt_pending_add(sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev, 5444 data, len); 5445 if (!cmd) { 5446 err = -ENOMEM; 5447 goto unlock; 5448 } 5449 5450 hci_req_init(&req, hdev); 5451 5452 __hci_req_write_fast_connectable(&req, cp->val); 5453 5454 err = hci_req_run(&req, fast_connectable_complete); 5455 if (err < 0) { 5456 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE, 5457 MGMT_STATUS_FAILED); 5458 mgmt_pending_remove(cmd); 5459 } 5460 5461 unlock: 5462 hci_dev_unlock(hdev); 5463 5464 return err; 5465 } 5466 5467 static void set_bredr_complete(struct hci_dev *hdev, u8 status, u16 opcode) 5468 { 5469 struct mgmt_pending_cmd *cmd; 5470 5471 bt_dev_dbg(hdev, "status 0x%02x", status); 5472 5473 hci_dev_lock(hdev); 5474 5475 cmd = pending_find(MGMT_OP_SET_BREDR, hdev); 5476 if (!cmd) 5477 goto unlock; 5478 5479 if (status) { 5480 u8 mgmt_err = mgmt_status(status); 5481 5482 /* We need to restore the flag if related HCI commands 5483 * failed. 5484 */ 5485 hci_dev_clear_flag(hdev, HCI_BREDR_ENABLED); 5486 5487 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err); 5488 } else { 5489 send_settings_rsp(cmd->sk, MGMT_OP_SET_BREDR, hdev); 5490 new_settings(hdev, cmd->sk); 5491 } 5492 5493 mgmt_pending_remove(cmd); 5494 5495 unlock: 5496 hci_dev_unlock(hdev); 5497 } 5498 5499 static int set_bredr(struct sock *sk, struct hci_dev *hdev, void *data, u16 len) 5500 { 5501 struct mgmt_mode *cp = data; 5502 struct mgmt_pending_cmd *cmd; 5503 struct hci_request req; 5504 int err; 5505 5506 bt_dev_dbg(hdev, "sock %p", sk); 5507 5508 if (!lmp_bredr_capable(hdev) || !lmp_le_capable(hdev)) 5509 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR, 5510 MGMT_STATUS_NOT_SUPPORTED); 5511 5512 if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED)) 5513 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR, 5514 MGMT_STATUS_REJECTED); 5515 5516 if (cp->val != 0x00 && cp->val != 0x01) 5517 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR, 5518 MGMT_STATUS_INVALID_PARAMS); 5519 5520 hci_dev_lock(hdev); 5521 5522 if (cp->val == hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) { 5523 err = send_settings_rsp(sk, MGMT_OP_SET_BREDR, hdev); 5524 goto unlock; 5525 } 5526 5527 if (!hdev_is_powered(hdev)) { 5528 if (!cp->val) { 5529 hci_dev_clear_flag(hdev, HCI_DISCOVERABLE); 5530 hci_dev_clear_flag(hdev, HCI_SSP_ENABLED); 5531 hci_dev_clear_flag(hdev, HCI_LINK_SECURITY); 5532 hci_dev_clear_flag(hdev, HCI_FAST_CONNECTABLE); 5533 hci_dev_clear_flag(hdev, HCI_HS_ENABLED); 5534 } 5535 5536 hci_dev_change_flag(hdev, HCI_BREDR_ENABLED); 5537 5538 err = send_settings_rsp(sk, MGMT_OP_SET_BREDR, hdev); 5539 if (err < 0) 5540 goto unlock; 5541 5542 err = new_settings(hdev, sk); 5543 goto unlock; 5544 } 5545 5546 /* Reject disabling when powered on */ 5547 if (!cp->val) { 5548 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR, 5549 MGMT_STATUS_REJECTED); 5550 goto unlock; 5551 } else { 5552 /* When configuring a dual-mode controller to operate 5553 * with LE only and using a static address, then switching 5554 * BR/EDR back on is not allowed. 5555 * 5556 * Dual-mode controllers shall operate with the public 5557 * address as its identity address for BR/EDR and LE. So 5558 * reject the attempt to create an invalid configuration. 5559 * 5560 * The same restrictions applies when secure connections 5561 * has been enabled. For BR/EDR this is a controller feature 5562 * while for LE it is a host stack feature. This means that 5563 * switching BR/EDR back on when secure connections has been 5564 * enabled is not a supported transaction. 5565 */ 5566 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) && 5567 (bacmp(&hdev->static_addr, BDADDR_ANY) || 5568 hci_dev_test_flag(hdev, HCI_SC_ENABLED))) { 5569 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR, 5570 MGMT_STATUS_REJECTED); 5571 goto unlock; 5572 } 5573 } 5574 5575 if (pending_find(MGMT_OP_SET_BREDR, hdev)) { 5576 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR, 5577 MGMT_STATUS_BUSY); 5578 goto unlock; 5579 } 5580 5581 cmd = mgmt_pending_add(sk, MGMT_OP_SET_BREDR, hdev, data, len); 5582 if (!cmd) { 5583 err = -ENOMEM; 5584 goto unlock; 5585 } 5586 5587 /* We need to flip the bit already here so that 5588 * hci_req_update_adv_data generates the correct flags. 5589 */ 5590 hci_dev_set_flag(hdev, HCI_BREDR_ENABLED); 5591 5592 hci_req_init(&req, hdev); 5593 5594 __hci_req_write_fast_connectable(&req, false); 5595 __hci_req_update_scan(&req); 5596 5597 /* Since only the advertising data flags will change, there 5598 * is no need to update the scan response data. 5599 */ 5600 __hci_req_update_adv_data(&req, hdev->cur_adv_instance); 5601 5602 err = hci_req_run(&req, set_bredr_complete); 5603 if (err < 0) 5604 mgmt_pending_remove(cmd); 5605 5606 unlock: 5607 hci_dev_unlock(hdev); 5608 return err; 5609 } 5610 5611 static void sc_enable_complete(struct hci_dev *hdev, u8 status, u16 opcode) 5612 { 5613 struct mgmt_pending_cmd *cmd; 5614 struct mgmt_mode *cp; 5615 5616 bt_dev_dbg(hdev, "status %u", status); 5617 5618 hci_dev_lock(hdev); 5619 5620 cmd = pending_find(MGMT_OP_SET_SECURE_CONN, hdev); 5621 if (!cmd) 5622 goto unlock; 5623 5624 if (status) { 5625 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, 5626 mgmt_status(status)); 5627 goto remove; 5628 } 5629 5630 cp = cmd->param; 5631 5632 switch (cp->val) { 5633 case 0x00: 5634 hci_dev_clear_flag(hdev, HCI_SC_ENABLED); 5635 hci_dev_clear_flag(hdev, HCI_SC_ONLY); 5636 break; 5637 case 0x01: 5638 hci_dev_set_flag(hdev, HCI_SC_ENABLED); 5639 hci_dev_clear_flag(hdev, HCI_SC_ONLY); 5640 break; 5641 case 0x02: 5642 hci_dev_set_flag(hdev, HCI_SC_ENABLED); 5643 hci_dev_set_flag(hdev, HCI_SC_ONLY); 5644 break; 5645 } 5646 5647 send_settings_rsp(cmd->sk, MGMT_OP_SET_SECURE_CONN, hdev); 5648 new_settings(hdev, cmd->sk); 5649 5650 remove: 5651 mgmt_pending_remove(cmd); 5652 unlock: 5653 hci_dev_unlock(hdev); 5654 } 5655 5656 static int set_secure_conn(struct sock *sk, struct hci_dev *hdev, 5657 void *data, u16 len) 5658 { 5659 struct mgmt_mode *cp = data; 5660 struct mgmt_pending_cmd *cmd; 5661 struct hci_request req; 5662 u8 val; 5663 int err; 5664 5665 bt_dev_dbg(hdev, "sock %p", sk); 5666 5667 if (!lmp_sc_capable(hdev) && 5668 !hci_dev_test_flag(hdev, HCI_LE_ENABLED)) 5669 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN, 5670 MGMT_STATUS_NOT_SUPPORTED); 5671 5672 if (hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) && 5673 lmp_sc_capable(hdev) && 5674 !hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) 5675 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN, 5676 MGMT_STATUS_REJECTED); 5677 5678 if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02) 5679 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN, 5680 MGMT_STATUS_INVALID_PARAMS); 5681 5682 hci_dev_lock(hdev); 5683 5684 if (!hdev_is_powered(hdev) || !lmp_sc_capable(hdev) || 5685 !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) { 5686 bool changed; 5687 5688 if (cp->val) { 5689 changed = !hci_dev_test_and_set_flag(hdev, 5690 HCI_SC_ENABLED); 5691 if (cp->val == 0x02) 5692 hci_dev_set_flag(hdev, HCI_SC_ONLY); 5693 else 5694 hci_dev_clear_flag(hdev, HCI_SC_ONLY); 5695 } else { 5696 changed = hci_dev_test_and_clear_flag(hdev, 5697 HCI_SC_ENABLED); 5698 hci_dev_clear_flag(hdev, HCI_SC_ONLY); 5699 } 5700 5701 err = send_settings_rsp(sk, MGMT_OP_SET_SECURE_CONN, hdev); 5702 if (err < 0) 5703 goto failed; 5704 5705 if (changed) 5706 err = new_settings(hdev, sk); 5707 5708 goto failed; 5709 } 5710 5711 if (pending_find(MGMT_OP_SET_SECURE_CONN, hdev)) { 5712 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN, 5713 MGMT_STATUS_BUSY); 5714 goto failed; 5715 } 5716 5717 val = !!cp->val; 5718 5719 if (val == hci_dev_test_flag(hdev, HCI_SC_ENABLED) && 5720 (cp->val == 0x02) == hci_dev_test_flag(hdev, HCI_SC_ONLY)) { 5721 err = send_settings_rsp(sk, MGMT_OP_SET_SECURE_CONN, hdev); 5722 goto failed; 5723 } 5724 5725 cmd = mgmt_pending_add(sk, MGMT_OP_SET_SECURE_CONN, hdev, data, len); 5726 if (!cmd) { 5727 err = -ENOMEM; 5728 goto failed; 5729 } 5730 5731 hci_req_init(&req, hdev); 5732 hci_req_add(&req, HCI_OP_WRITE_SC_SUPPORT, 1, &val); 5733 err = hci_req_run(&req, sc_enable_complete); 5734 if (err < 0) { 5735 mgmt_pending_remove(cmd); 5736 goto failed; 5737 } 5738 5739 failed: 5740 hci_dev_unlock(hdev); 5741 return err; 5742 } 5743 5744 static int set_debug_keys(struct sock *sk, struct hci_dev *hdev, 5745 void *data, u16 len) 5746 { 5747 struct mgmt_mode *cp = data; 5748 bool changed, use_changed; 5749 int err; 5750 5751 bt_dev_dbg(hdev, "sock %p", sk); 5752 5753 if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02) 5754 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEBUG_KEYS, 5755 MGMT_STATUS_INVALID_PARAMS); 5756 5757 hci_dev_lock(hdev); 5758 5759 if (cp->val) 5760 changed = !hci_dev_test_and_set_flag(hdev, HCI_KEEP_DEBUG_KEYS); 5761 else 5762 changed = hci_dev_test_and_clear_flag(hdev, 5763 HCI_KEEP_DEBUG_KEYS); 5764 5765 if (cp->val == 0x02) 5766 use_changed = !hci_dev_test_and_set_flag(hdev, 5767 HCI_USE_DEBUG_KEYS); 5768 else 5769 use_changed = hci_dev_test_and_clear_flag(hdev, 5770 HCI_USE_DEBUG_KEYS); 5771 5772 if (hdev_is_powered(hdev) && use_changed && 5773 hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) { 5774 u8 mode = (cp->val == 0x02) ? 0x01 : 0x00; 5775 hci_send_cmd(hdev, HCI_OP_WRITE_SSP_DEBUG_MODE, 5776 sizeof(mode), &mode); 5777 } 5778 5779 err = send_settings_rsp(sk, MGMT_OP_SET_DEBUG_KEYS, hdev); 5780 if (err < 0) 5781 goto unlock; 5782 5783 if (changed) 5784 err = new_settings(hdev, sk); 5785 5786 unlock: 5787 hci_dev_unlock(hdev); 5788 return err; 5789 } 5790 5791 static int set_privacy(struct sock *sk, struct hci_dev *hdev, void *cp_data, 5792 u16 len) 5793 { 5794 struct mgmt_cp_set_privacy *cp = cp_data; 5795 bool changed; 5796 int err; 5797 5798 bt_dev_dbg(hdev, "sock %p", sk); 5799 5800 if (!lmp_le_capable(hdev)) 5801 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY, 5802 MGMT_STATUS_NOT_SUPPORTED); 5803 5804 if (cp->privacy != 0x00 && cp->privacy != 0x01 && cp->privacy != 0x02) 5805 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY, 5806 MGMT_STATUS_INVALID_PARAMS); 5807 5808 if (hdev_is_powered(hdev)) 5809 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY, 5810 MGMT_STATUS_REJECTED); 5811 5812 hci_dev_lock(hdev); 5813 5814 /* If user space supports this command it is also expected to 5815 * handle IRKs. Therefore, set the HCI_RPA_RESOLVING flag. 5816 */ 5817 hci_dev_set_flag(hdev, HCI_RPA_RESOLVING); 5818 5819 if (cp->privacy) { 5820 changed = !hci_dev_test_and_set_flag(hdev, HCI_PRIVACY); 5821 memcpy(hdev->irk, cp->irk, sizeof(hdev->irk)); 5822 hci_dev_set_flag(hdev, HCI_RPA_EXPIRED); 5823 hci_adv_instances_set_rpa_expired(hdev, true); 5824 if (cp->privacy == 0x02) 5825 hci_dev_set_flag(hdev, HCI_LIMITED_PRIVACY); 5826 else 5827 hci_dev_clear_flag(hdev, HCI_LIMITED_PRIVACY); 5828 } else { 5829 changed = hci_dev_test_and_clear_flag(hdev, HCI_PRIVACY); 5830 memset(hdev->irk, 0, sizeof(hdev->irk)); 5831 hci_dev_clear_flag(hdev, HCI_RPA_EXPIRED); 5832 hci_adv_instances_set_rpa_expired(hdev, false); 5833 hci_dev_clear_flag(hdev, HCI_LIMITED_PRIVACY); 5834 } 5835 5836 err = send_settings_rsp(sk, MGMT_OP_SET_PRIVACY, hdev); 5837 if (err < 0) 5838 goto unlock; 5839 5840 if (changed) 5841 err = new_settings(hdev, sk); 5842 5843 unlock: 5844 hci_dev_unlock(hdev); 5845 return err; 5846 } 5847 5848 static bool irk_is_valid(struct mgmt_irk_info *irk) 5849 { 5850 switch (irk->addr.type) { 5851 case BDADDR_LE_PUBLIC: 5852 return true; 5853 5854 case BDADDR_LE_RANDOM: 5855 /* Two most significant bits shall be set */ 5856 if ((irk->addr.bdaddr.b[5] & 0xc0) != 0xc0) 5857 return false; 5858 return true; 5859 } 5860 5861 return false; 5862 } 5863 5864 static int load_irks(struct sock *sk, struct hci_dev *hdev, void *cp_data, 5865 u16 len) 5866 { 5867 struct mgmt_cp_load_irks *cp = cp_data; 5868 const u16 max_irk_count = ((U16_MAX - sizeof(*cp)) / 5869 sizeof(struct mgmt_irk_info)); 5870 u16 irk_count, expected_len; 5871 int i, err; 5872 5873 bt_dev_dbg(hdev, "sock %p", sk); 5874 5875 if (!lmp_le_capable(hdev)) 5876 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS, 5877 MGMT_STATUS_NOT_SUPPORTED); 5878 5879 irk_count = __le16_to_cpu(cp->irk_count); 5880 if (irk_count > max_irk_count) { 5881 bt_dev_err(hdev, "load_irks: too big irk_count value %u", 5882 irk_count); 5883 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS, 5884 MGMT_STATUS_INVALID_PARAMS); 5885 } 5886 5887 expected_len = struct_size(cp, irks, irk_count); 5888 if (expected_len != len) { 5889 bt_dev_err(hdev, "load_irks: expected %u bytes, got %u bytes", 5890 expected_len, len); 5891 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS, 5892 MGMT_STATUS_INVALID_PARAMS); 5893 } 5894 5895 bt_dev_dbg(hdev, "irk_count %u", irk_count); 5896 5897 for (i = 0; i < irk_count; i++) { 5898 struct mgmt_irk_info *key = &cp->irks[i]; 5899 5900 if (!irk_is_valid(key)) 5901 return mgmt_cmd_status(sk, hdev->id, 5902 MGMT_OP_LOAD_IRKS, 5903 MGMT_STATUS_INVALID_PARAMS); 5904 } 5905 5906 hci_dev_lock(hdev); 5907 5908 hci_smp_irks_clear(hdev); 5909 5910 for (i = 0; i < irk_count; i++) { 5911 struct mgmt_irk_info *irk = &cp->irks[i]; 5912 5913 if (hci_is_blocked_key(hdev, 5914 HCI_BLOCKED_KEY_TYPE_IRK, 5915 irk->val)) { 5916 bt_dev_warn(hdev, "Skipping blocked IRK for %pMR", 5917 &irk->addr.bdaddr); 5918 continue; 5919 } 5920 5921 hci_add_irk(hdev, &irk->addr.bdaddr, 5922 le_addr_type(irk->addr.type), irk->val, 5923 BDADDR_ANY); 5924 } 5925 5926 hci_dev_set_flag(hdev, HCI_RPA_RESOLVING); 5927 5928 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_IRKS, 0, NULL, 0); 5929 5930 hci_dev_unlock(hdev); 5931 5932 return err; 5933 } 5934 5935 static bool ltk_is_valid(struct mgmt_ltk_info *key) 5936 { 5937 if (key->master != 0x00 && key->master != 0x01) 5938 return false; 5939 5940 switch (key->addr.type) { 5941 case BDADDR_LE_PUBLIC: 5942 return true; 5943 5944 case BDADDR_LE_RANDOM: 5945 /* Two most significant bits shall be set */ 5946 if ((key->addr.bdaddr.b[5] & 0xc0) != 0xc0) 5947 return false; 5948 return true; 5949 } 5950 5951 return false; 5952 } 5953 5954 static int load_long_term_keys(struct sock *sk, struct hci_dev *hdev, 5955 void *cp_data, u16 len) 5956 { 5957 struct mgmt_cp_load_long_term_keys *cp = cp_data; 5958 const u16 max_key_count = ((U16_MAX - sizeof(*cp)) / 5959 sizeof(struct mgmt_ltk_info)); 5960 u16 key_count, expected_len; 5961 int i, err; 5962 5963 bt_dev_dbg(hdev, "sock %p", sk); 5964 5965 if (!lmp_le_capable(hdev)) 5966 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS, 5967 MGMT_STATUS_NOT_SUPPORTED); 5968 5969 key_count = __le16_to_cpu(cp->key_count); 5970 if (key_count > max_key_count) { 5971 bt_dev_err(hdev, "load_ltks: too big key_count value %u", 5972 key_count); 5973 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS, 5974 MGMT_STATUS_INVALID_PARAMS); 5975 } 5976 5977 expected_len = struct_size(cp, keys, key_count); 5978 if (expected_len != len) { 5979 bt_dev_err(hdev, "load_keys: expected %u bytes, got %u bytes", 5980 expected_len, len); 5981 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS, 5982 MGMT_STATUS_INVALID_PARAMS); 5983 } 5984 5985 bt_dev_dbg(hdev, "key_count %u", key_count); 5986 5987 for (i = 0; i < key_count; i++) { 5988 struct mgmt_ltk_info *key = &cp->keys[i]; 5989 5990 if (!ltk_is_valid(key)) 5991 return mgmt_cmd_status(sk, hdev->id, 5992 MGMT_OP_LOAD_LONG_TERM_KEYS, 5993 MGMT_STATUS_INVALID_PARAMS); 5994 } 5995 5996 hci_dev_lock(hdev); 5997 5998 hci_smp_ltks_clear(hdev); 5999 6000 for (i = 0; i < key_count; i++) { 6001 struct mgmt_ltk_info *key = &cp->keys[i]; 6002 u8 type, authenticated; 6003 6004 if (hci_is_blocked_key(hdev, 6005 HCI_BLOCKED_KEY_TYPE_LTK, 6006 key->val)) { 6007 bt_dev_warn(hdev, "Skipping blocked LTK for %pMR", 6008 &key->addr.bdaddr); 6009 continue; 6010 } 6011 6012 switch (key->type) { 6013 case MGMT_LTK_UNAUTHENTICATED: 6014 authenticated = 0x00; 6015 type = key->master ? SMP_LTK : SMP_LTK_SLAVE; 6016 break; 6017 case MGMT_LTK_AUTHENTICATED: 6018 authenticated = 0x01; 6019 type = key->master ? SMP_LTK : SMP_LTK_SLAVE; 6020 break; 6021 case MGMT_LTK_P256_UNAUTH: 6022 authenticated = 0x00; 6023 type = SMP_LTK_P256; 6024 break; 6025 case MGMT_LTK_P256_AUTH: 6026 authenticated = 0x01; 6027 type = SMP_LTK_P256; 6028 break; 6029 case MGMT_LTK_P256_DEBUG: 6030 authenticated = 0x00; 6031 type = SMP_LTK_P256_DEBUG; 6032 fallthrough; 6033 default: 6034 continue; 6035 } 6036 6037 hci_add_ltk(hdev, &key->addr.bdaddr, 6038 le_addr_type(key->addr.type), type, authenticated, 6039 key->val, key->enc_size, key->ediv, key->rand); 6040 } 6041 6042 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS, 0, 6043 NULL, 0); 6044 6045 hci_dev_unlock(hdev); 6046 6047 return err; 6048 } 6049 6050 static int conn_info_cmd_complete(struct mgmt_pending_cmd *cmd, u8 status) 6051 { 6052 struct hci_conn *conn = cmd->user_data; 6053 struct mgmt_rp_get_conn_info rp; 6054 int err; 6055 6056 memcpy(&rp.addr, cmd->param, sizeof(rp.addr)); 6057 6058 if (status == MGMT_STATUS_SUCCESS) { 6059 rp.rssi = conn->rssi; 6060 rp.tx_power = conn->tx_power; 6061 rp.max_tx_power = conn->max_tx_power; 6062 } else { 6063 rp.rssi = HCI_RSSI_INVALID; 6064 rp.tx_power = HCI_TX_POWER_INVALID; 6065 rp.max_tx_power = HCI_TX_POWER_INVALID; 6066 } 6067 6068 err = mgmt_cmd_complete(cmd->sk, cmd->index, MGMT_OP_GET_CONN_INFO, 6069 status, &rp, sizeof(rp)); 6070 6071 hci_conn_drop(conn); 6072 hci_conn_put(conn); 6073 6074 return err; 6075 } 6076 6077 static void conn_info_refresh_complete(struct hci_dev *hdev, u8 hci_status, 6078 u16 opcode) 6079 { 6080 struct hci_cp_read_rssi *cp; 6081 struct mgmt_pending_cmd *cmd; 6082 struct hci_conn *conn; 6083 u16 handle; 6084 u8 status; 6085 6086 bt_dev_dbg(hdev, "status 0x%02x", hci_status); 6087 6088 hci_dev_lock(hdev); 6089 6090 /* Commands sent in request are either Read RSSI or Read Transmit Power 6091 * Level so we check which one was last sent to retrieve connection 6092 * handle. Both commands have handle as first parameter so it's safe to 6093 * cast data on the same command struct. 6094 * 6095 * First command sent is always Read RSSI and we fail only if it fails. 6096 * In other case we simply override error to indicate success as we 6097 * already remembered if TX power value is actually valid. 6098 */ 6099 cp = hci_sent_cmd_data(hdev, HCI_OP_READ_RSSI); 6100 if (!cp) { 6101 cp = hci_sent_cmd_data(hdev, HCI_OP_READ_TX_POWER); 6102 status = MGMT_STATUS_SUCCESS; 6103 } else { 6104 status = mgmt_status(hci_status); 6105 } 6106 6107 if (!cp) { 6108 bt_dev_err(hdev, "invalid sent_cmd in conn_info response"); 6109 goto unlock; 6110 } 6111 6112 handle = __le16_to_cpu(cp->handle); 6113 conn = hci_conn_hash_lookup_handle(hdev, handle); 6114 if (!conn) { 6115 bt_dev_err(hdev, "unknown handle (%d) in conn_info response", 6116 handle); 6117 goto unlock; 6118 } 6119 6120 cmd = pending_find_data(MGMT_OP_GET_CONN_INFO, hdev, conn); 6121 if (!cmd) 6122 goto unlock; 6123 6124 cmd->cmd_complete(cmd, status); 6125 mgmt_pending_remove(cmd); 6126 6127 unlock: 6128 hci_dev_unlock(hdev); 6129 } 6130 6131 static int get_conn_info(struct sock *sk, struct hci_dev *hdev, void *data, 6132 u16 len) 6133 { 6134 struct mgmt_cp_get_conn_info *cp = data; 6135 struct mgmt_rp_get_conn_info rp; 6136 struct hci_conn *conn; 6137 unsigned long conn_info_age; 6138 int err = 0; 6139 6140 bt_dev_dbg(hdev, "sock %p", sk); 6141 6142 memset(&rp, 0, sizeof(rp)); 6143 bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr); 6144 rp.addr.type = cp->addr.type; 6145 6146 if (!bdaddr_type_is_valid(cp->addr.type)) 6147 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO, 6148 MGMT_STATUS_INVALID_PARAMS, 6149 &rp, sizeof(rp)); 6150 6151 hci_dev_lock(hdev); 6152 6153 if (!hdev_is_powered(hdev)) { 6154 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO, 6155 MGMT_STATUS_NOT_POWERED, &rp, 6156 sizeof(rp)); 6157 goto unlock; 6158 } 6159 6160 if (cp->addr.type == BDADDR_BREDR) 6161 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, 6162 &cp->addr.bdaddr); 6163 else 6164 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &cp->addr.bdaddr); 6165 6166 if (!conn || conn->state != BT_CONNECTED) { 6167 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO, 6168 MGMT_STATUS_NOT_CONNECTED, &rp, 6169 sizeof(rp)); 6170 goto unlock; 6171 } 6172 6173 if (pending_find_data(MGMT_OP_GET_CONN_INFO, hdev, conn)) { 6174 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO, 6175 MGMT_STATUS_BUSY, &rp, sizeof(rp)); 6176 goto unlock; 6177 } 6178 6179 /* To avoid client trying to guess when to poll again for information we 6180 * calculate conn info age as random value between min/max set in hdev. 6181 */ 6182 conn_info_age = hdev->conn_info_min_age + 6183 prandom_u32_max(hdev->conn_info_max_age - 6184 hdev->conn_info_min_age); 6185 6186 /* Query controller to refresh cached values if they are too old or were 6187 * never read. 6188 */ 6189 if (time_after(jiffies, conn->conn_info_timestamp + 6190 msecs_to_jiffies(conn_info_age)) || 6191 !conn->conn_info_timestamp) { 6192 struct hci_request req; 6193 struct hci_cp_read_tx_power req_txp_cp; 6194 struct hci_cp_read_rssi req_rssi_cp; 6195 struct mgmt_pending_cmd *cmd; 6196 6197 hci_req_init(&req, hdev); 6198 req_rssi_cp.handle = cpu_to_le16(conn->handle); 6199 hci_req_add(&req, HCI_OP_READ_RSSI, sizeof(req_rssi_cp), 6200 &req_rssi_cp); 6201 6202 /* For LE links TX power does not change thus we don't need to 6203 * query for it once value is known. 6204 */ 6205 if (!bdaddr_type_is_le(cp->addr.type) || 6206 conn->tx_power == HCI_TX_POWER_INVALID) { 6207 req_txp_cp.handle = cpu_to_le16(conn->handle); 6208 req_txp_cp.type = 0x00; 6209 hci_req_add(&req, HCI_OP_READ_TX_POWER, 6210 sizeof(req_txp_cp), &req_txp_cp); 6211 } 6212 6213 /* Max TX power needs to be read only once per connection */ 6214 if (conn->max_tx_power == HCI_TX_POWER_INVALID) { 6215 req_txp_cp.handle = cpu_to_le16(conn->handle); 6216 req_txp_cp.type = 0x01; 6217 hci_req_add(&req, HCI_OP_READ_TX_POWER, 6218 sizeof(req_txp_cp), &req_txp_cp); 6219 } 6220 6221 err = hci_req_run(&req, conn_info_refresh_complete); 6222 if (err < 0) 6223 goto unlock; 6224 6225 cmd = mgmt_pending_add(sk, MGMT_OP_GET_CONN_INFO, hdev, 6226 data, len); 6227 if (!cmd) { 6228 err = -ENOMEM; 6229 goto unlock; 6230 } 6231 6232 hci_conn_hold(conn); 6233 cmd->user_data = hci_conn_get(conn); 6234 cmd->cmd_complete = conn_info_cmd_complete; 6235 6236 conn->conn_info_timestamp = jiffies; 6237 } else { 6238 /* Cache is valid, just reply with values cached in hci_conn */ 6239 rp.rssi = conn->rssi; 6240 rp.tx_power = conn->tx_power; 6241 rp.max_tx_power = conn->max_tx_power; 6242 6243 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO, 6244 MGMT_STATUS_SUCCESS, &rp, sizeof(rp)); 6245 } 6246 6247 unlock: 6248 hci_dev_unlock(hdev); 6249 return err; 6250 } 6251 6252 static int clock_info_cmd_complete(struct mgmt_pending_cmd *cmd, u8 status) 6253 { 6254 struct hci_conn *conn = cmd->user_data; 6255 struct mgmt_rp_get_clock_info rp; 6256 struct hci_dev *hdev; 6257 int err; 6258 6259 memset(&rp, 0, sizeof(rp)); 6260 memcpy(&rp.addr, cmd->param, sizeof(rp.addr)); 6261 6262 if (status) 6263 goto complete; 6264 6265 hdev = hci_dev_get(cmd->index); 6266 if (hdev) { 6267 rp.local_clock = cpu_to_le32(hdev->clock); 6268 hci_dev_put(hdev); 6269 } 6270 6271 if (conn) { 6272 rp.piconet_clock = cpu_to_le32(conn->clock); 6273 rp.accuracy = cpu_to_le16(conn->clock_accuracy); 6274 } 6275 6276 complete: 6277 err = mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, status, &rp, 6278 sizeof(rp)); 6279 6280 if (conn) { 6281 hci_conn_drop(conn); 6282 hci_conn_put(conn); 6283 } 6284 6285 return err; 6286 } 6287 6288 static void get_clock_info_complete(struct hci_dev *hdev, u8 status, u16 opcode) 6289 { 6290 struct hci_cp_read_clock *hci_cp; 6291 struct mgmt_pending_cmd *cmd; 6292 struct hci_conn *conn; 6293 6294 bt_dev_dbg(hdev, "status %u", status); 6295 6296 hci_dev_lock(hdev); 6297 6298 hci_cp = hci_sent_cmd_data(hdev, HCI_OP_READ_CLOCK); 6299 if (!hci_cp) 6300 goto unlock; 6301 6302 if (hci_cp->which) { 6303 u16 handle = __le16_to_cpu(hci_cp->handle); 6304 conn = hci_conn_hash_lookup_handle(hdev, handle); 6305 } else { 6306 conn = NULL; 6307 } 6308 6309 cmd = pending_find_data(MGMT_OP_GET_CLOCK_INFO, hdev, conn); 6310 if (!cmd) 6311 goto unlock; 6312 6313 cmd->cmd_complete(cmd, mgmt_status(status)); 6314 mgmt_pending_remove(cmd); 6315 6316 unlock: 6317 hci_dev_unlock(hdev); 6318 } 6319 6320 static int get_clock_info(struct sock *sk, struct hci_dev *hdev, void *data, 6321 u16 len) 6322 { 6323 struct mgmt_cp_get_clock_info *cp = data; 6324 struct mgmt_rp_get_clock_info rp; 6325 struct hci_cp_read_clock hci_cp; 6326 struct mgmt_pending_cmd *cmd; 6327 struct hci_request req; 6328 struct hci_conn *conn; 6329 int err; 6330 6331 bt_dev_dbg(hdev, "sock %p", sk); 6332 6333 memset(&rp, 0, sizeof(rp)); 6334 bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr); 6335 rp.addr.type = cp->addr.type; 6336 6337 if (cp->addr.type != BDADDR_BREDR) 6338 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CLOCK_INFO, 6339 MGMT_STATUS_INVALID_PARAMS, 6340 &rp, sizeof(rp)); 6341 6342 hci_dev_lock(hdev); 6343 6344 if (!hdev_is_powered(hdev)) { 6345 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CLOCK_INFO, 6346 MGMT_STATUS_NOT_POWERED, &rp, 6347 sizeof(rp)); 6348 goto unlock; 6349 } 6350 6351 if (bacmp(&cp->addr.bdaddr, BDADDR_ANY)) { 6352 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, 6353 &cp->addr.bdaddr); 6354 if (!conn || conn->state != BT_CONNECTED) { 6355 err = mgmt_cmd_complete(sk, hdev->id, 6356 MGMT_OP_GET_CLOCK_INFO, 6357 MGMT_STATUS_NOT_CONNECTED, 6358 &rp, sizeof(rp)); 6359 goto unlock; 6360 } 6361 } else { 6362 conn = NULL; 6363 } 6364 6365 cmd = mgmt_pending_add(sk, MGMT_OP_GET_CLOCK_INFO, hdev, data, len); 6366 if (!cmd) { 6367 err = -ENOMEM; 6368 goto unlock; 6369 } 6370 6371 cmd->cmd_complete = clock_info_cmd_complete; 6372 6373 hci_req_init(&req, hdev); 6374 6375 memset(&hci_cp, 0, sizeof(hci_cp)); 6376 hci_req_add(&req, HCI_OP_READ_CLOCK, sizeof(hci_cp), &hci_cp); 6377 6378 if (conn) { 6379 hci_conn_hold(conn); 6380 cmd->user_data = hci_conn_get(conn); 6381 6382 hci_cp.handle = cpu_to_le16(conn->handle); 6383 hci_cp.which = 0x01; /* Piconet clock */ 6384 hci_req_add(&req, HCI_OP_READ_CLOCK, sizeof(hci_cp), &hci_cp); 6385 } 6386 6387 err = hci_req_run(&req, get_clock_info_complete); 6388 if (err < 0) 6389 mgmt_pending_remove(cmd); 6390 6391 unlock: 6392 hci_dev_unlock(hdev); 6393 return err; 6394 } 6395 6396 static bool is_connected(struct hci_dev *hdev, bdaddr_t *addr, u8 type) 6397 { 6398 struct hci_conn *conn; 6399 6400 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, addr); 6401 if (!conn) 6402 return false; 6403 6404 if (conn->dst_type != type) 6405 return false; 6406 6407 if (conn->state != BT_CONNECTED) 6408 return false; 6409 6410 return true; 6411 } 6412 6413 /* This function requires the caller holds hdev->lock */ 6414 static int hci_conn_params_set(struct hci_dev *hdev, bdaddr_t *addr, 6415 u8 addr_type, u8 auto_connect) 6416 { 6417 struct hci_conn_params *params; 6418 6419 params = hci_conn_params_add(hdev, addr, addr_type); 6420 if (!params) 6421 return -EIO; 6422 6423 if (params->auto_connect == auto_connect) 6424 return 0; 6425 6426 list_del_init(¶ms->action); 6427 6428 switch (auto_connect) { 6429 case HCI_AUTO_CONN_DISABLED: 6430 case HCI_AUTO_CONN_LINK_LOSS: 6431 /* If auto connect is being disabled when we're trying to 6432 * connect to device, keep connecting. 6433 */ 6434 if (params->explicit_connect) 6435 list_add(¶ms->action, &hdev->pend_le_conns); 6436 break; 6437 case HCI_AUTO_CONN_REPORT: 6438 if (params->explicit_connect) 6439 list_add(¶ms->action, &hdev->pend_le_conns); 6440 else 6441 list_add(¶ms->action, &hdev->pend_le_reports); 6442 break; 6443 case HCI_AUTO_CONN_DIRECT: 6444 case HCI_AUTO_CONN_ALWAYS: 6445 if (!is_connected(hdev, addr, addr_type)) 6446 list_add(¶ms->action, &hdev->pend_le_conns); 6447 break; 6448 } 6449 6450 params->auto_connect = auto_connect; 6451 6452 bt_dev_dbg(hdev, "addr %pMR (type %u) auto_connect %u", 6453 addr, addr_type, auto_connect); 6454 6455 return 0; 6456 } 6457 6458 static void device_added(struct sock *sk, struct hci_dev *hdev, 6459 bdaddr_t *bdaddr, u8 type, u8 action) 6460 { 6461 struct mgmt_ev_device_added ev; 6462 6463 bacpy(&ev.addr.bdaddr, bdaddr); 6464 ev.addr.type = type; 6465 ev.action = action; 6466 6467 mgmt_event(MGMT_EV_DEVICE_ADDED, hdev, &ev, sizeof(ev), sk); 6468 } 6469 6470 static int add_device(struct sock *sk, struct hci_dev *hdev, 6471 void *data, u16 len) 6472 { 6473 struct mgmt_cp_add_device *cp = data; 6474 u8 auto_conn, addr_type; 6475 struct hci_conn_params *params; 6476 int err; 6477 u32 current_flags = 0; 6478 6479 bt_dev_dbg(hdev, "sock %p", sk); 6480 6481 if (!bdaddr_type_is_valid(cp->addr.type) || 6482 !bacmp(&cp->addr.bdaddr, BDADDR_ANY)) 6483 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE, 6484 MGMT_STATUS_INVALID_PARAMS, 6485 &cp->addr, sizeof(cp->addr)); 6486 6487 if (cp->action != 0x00 && cp->action != 0x01 && cp->action != 0x02) 6488 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE, 6489 MGMT_STATUS_INVALID_PARAMS, 6490 &cp->addr, sizeof(cp->addr)); 6491 6492 hci_dev_lock(hdev); 6493 6494 if (cp->addr.type == BDADDR_BREDR) { 6495 /* Only incoming connections action is supported for now */ 6496 if (cp->action != 0x01) { 6497 err = mgmt_cmd_complete(sk, hdev->id, 6498 MGMT_OP_ADD_DEVICE, 6499 MGMT_STATUS_INVALID_PARAMS, 6500 &cp->addr, sizeof(cp->addr)); 6501 goto unlock; 6502 } 6503 6504 err = hci_bdaddr_list_add_with_flags(&hdev->whitelist, 6505 &cp->addr.bdaddr, 6506 cp->addr.type, 0); 6507 if (err) 6508 goto unlock; 6509 6510 hci_req_update_scan(hdev); 6511 6512 goto added; 6513 } 6514 6515 addr_type = le_addr_type(cp->addr.type); 6516 6517 if (cp->action == 0x02) 6518 auto_conn = HCI_AUTO_CONN_ALWAYS; 6519 else if (cp->action == 0x01) 6520 auto_conn = HCI_AUTO_CONN_DIRECT; 6521 else 6522 auto_conn = HCI_AUTO_CONN_REPORT; 6523 6524 /* Kernel internally uses conn_params with resolvable private 6525 * address, but Add Device allows only identity addresses. 6526 * Make sure it is enforced before calling 6527 * hci_conn_params_lookup. 6528 */ 6529 if (!hci_is_identity_address(&cp->addr.bdaddr, addr_type)) { 6530 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE, 6531 MGMT_STATUS_INVALID_PARAMS, 6532 &cp->addr, sizeof(cp->addr)); 6533 goto unlock; 6534 } 6535 6536 /* If the connection parameters don't exist for this device, 6537 * they will be created and configured with defaults. 6538 */ 6539 if (hci_conn_params_set(hdev, &cp->addr.bdaddr, addr_type, 6540 auto_conn) < 0) { 6541 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE, 6542 MGMT_STATUS_FAILED, &cp->addr, 6543 sizeof(cp->addr)); 6544 goto unlock; 6545 } else { 6546 params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr, 6547 addr_type); 6548 if (params) 6549 current_flags = params->current_flags; 6550 } 6551 6552 hci_update_background_scan(hdev); 6553 6554 added: 6555 device_added(sk, hdev, &cp->addr.bdaddr, cp->addr.type, cp->action); 6556 device_flags_changed(NULL, hdev, &cp->addr.bdaddr, cp->addr.type, 6557 SUPPORTED_DEVICE_FLAGS(), current_flags); 6558 6559 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE, 6560 MGMT_STATUS_SUCCESS, &cp->addr, 6561 sizeof(cp->addr)); 6562 6563 unlock: 6564 hci_dev_unlock(hdev); 6565 return err; 6566 } 6567 6568 static void device_removed(struct sock *sk, struct hci_dev *hdev, 6569 bdaddr_t *bdaddr, u8 type) 6570 { 6571 struct mgmt_ev_device_removed ev; 6572 6573 bacpy(&ev.addr.bdaddr, bdaddr); 6574 ev.addr.type = type; 6575 6576 mgmt_event(MGMT_EV_DEVICE_REMOVED, hdev, &ev, sizeof(ev), sk); 6577 } 6578 6579 static int remove_device(struct sock *sk, struct hci_dev *hdev, 6580 void *data, u16 len) 6581 { 6582 struct mgmt_cp_remove_device *cp = data; 6583 int err; 6584 6585 bt_dev_dbg(hdev, "sock %p", sk); 6586 6587 hci_dev_lock(hdev); 6588 6589 if (bacmp(&cp->addr.bdaddr, BDADDR_ANY)) { 6590 struct hci_conn_params *params; 6591 u8 addr_type; 6592 6593 if (!bdaddr_type_is_valid(cp->addr.type)) { 6594 err = mgmt_cmd_complete(sk, hdev->id, 6595 MGMT_OP_REMOVE_DEVICE, 6596 MGMT_STATUS_INVALID_PARAMS, 6597 &cp->addr, sizeof(cp->addr)); 6598 goto unlock; 6599 } 6600 6601 if (cp->addr.type == BDADDR_BREDR) { 6602 err = hci_bdaddr_list_del(&hdev->whitelist, 6603 &cp->addr.bdaddr, 6604 cp->addr.type); 6605 if (err) { 6606 err = mgmt_cmd_complete(sk, hdev->id, 6607 MGMT_OP_REMOVE_DEVICE, 6608 MGMT_STATUS_INVALID_PARAMS, 6609 &cp->addr, 6610 sizeof(cp->addr)); 6611 goto unlock; 6612 } 6613 6614 hci_req_update_scan(hdev); 6615 6616 device_removed(sk, hdev, &cp->addr.bdaddr, 6617 cp->addr.type); 6618 goto complete; 6619 } 6620 6621 addr_type = le_addr_type(cp->addr.type); 6622 6623 /* Kernel internally uses conn_params with resolvable private 6624 * address, but Remove Device allows only identity addresses. 6625 * Make sure it is enforced before calling 6626 * hci_conn_params_lookup. 6627 */ 6628 if (!hci_is_identity_address(&cp->addr.bdaddr, addr_type)) { 6629 err = mgmt_cmd_complete(sk, hdev->id, 6630 MGMT_OP_REMOVE_DEVICE, 6631 MGMT_STATUS_INVALID_PARAMS, 6632 &cp->addr, sizeof(cp->addr)); 6633 goto unlock; 6634 } 6635 6636 params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr, 6637 addr_type); 6638 if (!params) { 6639 err = mgmt_cmd_complete(sk, hdev->id, 6640 MGMT_OP_REMOVE_DEVICE, 6641 MGMT_STATUS_INVALID_PARAMS, 6642 &cp->addr, sizeof(cp->addr)); 6643 goto unlock; 6644 } 6645 6646 if (params->auto_connect == HCI_AUTO_CONN_DISABLED || 6647 params->auto_connect == HCI_AUTO_CONN_EXPLICIT) { 6648 err = mgmt_cmd_complete(sk, hdev->id, 6649 MGMT_OP_REMOVE_DEVICE, 6650 MGMT_STATUS_INVALID_PARAMS, 6651 &cp->addr, sizeof(cp->addr)); 6652 goto unlock; 6653 } 6654 6655 list_del(¶ms->action); 6656 list_del(¶ms->list); 6657 kfree(params); 6658 hci_update_background_scan(hdev); 6659 6660 device_removed(sk, hdev, &cp->addr.bdaddr, cp->addr.type); 6661 } else { 6662 struct hci_conn_params *p, *tmp; 6663 struct bdaddr_list *b, *btmp; 6664 6665 if (cp->addr.type) { 6666 err = mgmt_cmd_complete(sk, hdev->id, 6667 MGMT_OP_REMOVE_DEVICE, 6668 MGMT_STATUS_INVALID_PARAMS, 6669 &cp->addr, sizeof(cp->addr)); 6670 goto unlock; 6671 } 6672 6673 list_for_each_entry_safe(b, btmp, &hdev->whitelist, list) { 6674 device_removed(sk, hdev, &b->bdaddr, b->bdaddr_type); 6675 list_del(&b->list); 6676 kfree(b); 6677 } 6678 6679 hci_req_update_scan(hdev); 6680 6681 list_for_each_entry_safe(p, tmp, &hdev->le_conn_params, list) { 6682 if (p->auto_connect == HCI_AUTO_CONN_DISABLED) 6683 continue; 6684 device_removed(sk, hdev, &p->addr, p->addr_type); 6685 if (p->explicit_connect) { 6686 p->auto_connect = HCI_AUTO_CONN_EXPLICIT; 6687 continue; 6688 } 6689 list_del(&p->action); 6690 list_del(&p->list); 6691 kfree(p); 6692 } 6693 6694 bt_dev_dbg(hdev, "All LE connection parameters were removed"); 6695 6696 hci_update_background_scan(hdev); 6697 } 6698 6699 complete: 6700 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_DEVICE, 6701 MGMT_STATUS_SUCCESS, &cp->addr, 6702 sizeof(cp->addr)); 6703 unlock: 6704 hci_dev_unlock(hdev); 6705 return err; 6706 } 6707 6708 static int load_conn_param(struct sock *sk, struct hci_dev *hdev, void *data, 6709 u16 len) 6710 { 6711 struct mgmt_cp_load_conn_param *cp = data; 6712 const u16 max_param_count = ((U16_MAX - sizeof(*cp)) / 6713 sizeof(struct mgmt_conn_param)); 6714 u16 param_count, expected_len; 6715 int i; 6716 6717 if (!lmp_le_capable(hdev)) 6718 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM, 6719 MGMT_STATUS_NOT_SUPPORTED); 6720 6721 param_count = __le16_to_cpu(cp->param_count); 6722 if (param_count > max_param_count) { 6723 bt_dev_err(hdev, "load_conn_param: too big param_count value %u", 6724 param_count); 6725 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM, 6726 MGMT_STATUS_INVALID_PARAMS); 6727 } 6728 6729 expected_len = struct_size(cp, params, param_count); 6730 if (expected_len != len) { 6731 bt_dev_err(hdev, "load_conn_param: expected %u bytes, got %u bytes", 6732 expected_len, len); 6733 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM, 6734 MGMT_STATUS_INVALID_PARAMS); 6735 } 6736 6737 bt_dev_dbg(hdev, "param_count %u", param_count); 6738 6739 hci_dev_lock(hdev); 6740 6741 hci_conn_params_clear_disabled(hdev); 6742 6743 for (i = 0; i < param_count; i++) { 6744 struct mgmt_conn_param *param = &cp->params[i]; 6745 struct hci_conn_params *hci_param; 6746 u16 min, max, latency, timeout; 6747 u8 addr_type; 6748 6749 bt_dev_dbg(hdev, "Adding %pMR (type %u)", ¶m->addr.bdaddr, 6750 param->addr.type); 6751 6752 if (param->addr.type == BDADDR_LE_PUBLIC) { 6753 addr_type = ADDR_LE_DEV_PUBLIC; 6754 } else if (param->addr.type == BDADDR_LE_RANDOM) { 6755 addr_type = ADDR_LE_DEV_RANDOM; 6756 } else { 6757 bt_dev_err(hdev, "ignoring invalid connection parameters"); 6758 continue; 6759 } 6760 6761 min = le16_to_cpu(param->min_interval); 6762 max = le16_to_cpu(param->max_interval); 6763 latency = le16_to_cpu(param->latency); 6764 timeout = le16_to_cpu(param->timeout); 6765 6766 bt_dev_dbg(hdev, "min 0x%04x max 0x%04x latency 0x%04x timeout 0x%04x", 6767 min, max, latency, timeout); 6768 6769 if (hci_check_conn_params(min, max, latency, timeout) < 0) { 6770 bt_dev_err(hdev, "ignoring invalid connection parameters"); 6771 continue; 6772 } 6773 6774 hci_param = hci_conn_params_add(hdev, ¶m->addr.bdaddr, 6775 addr_type); 6776 if (!hci_param) { 6777 bt_dev_err(hdev, "failed to add connection parameters"); 6778 continue; 6779 } 6780 6781 hci_param->conn_min_interval = min; 6782 hci_param->conn_max_interval = max; 6783 hci_param->conn_latency = latency; 6784 hci_param->supervision_timeout = timeout; 6785 } 6786 6787 hci_dev_unlock(hdev); 6788 6789 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM, 0, 6790 NULL, 0); 6791 } 6792 6793 static int set_external_config(struct sock *sk, struct hci_dev *hdev, 6794 void *data, u16 len) 6795 { 6796 struct mgmt_cp_set_external_config *cp = data; 6797 bool changed; 6798 int err; 6799 6800 bt_dev_dbg(hdev, "sock %p", sk); 6801 6802 if (hdev_is_powered(hdev)) 6803 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_EXTERNAL_CONFIG, 6804 MGMT_STATUS_REJECTED); 6805 6806 if (cp->config != 0x00 && cp->config != 0x01) 6807 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_EXTERNAL_CONFIG, 6808 MGMT_STATUS_INVALID_PARAMS); 6809 6810 if (!test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks)) 6811 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_EXTERNAL_CONFIG, 6812 MGMT_STATUS_NOT_SUPPORTED); 6813 6814 hci_dev_lock(hdev); 6815 6816 if (cp->config) 6817 changed = !hci_dev_test_and_set_flag(hdev, HCI_EXT_CONFIGURED); 6818 else 6819 changed = hci_dev_test_and_clear_flag(hdev, HCI_EXT_CONFIGURED); 6820 6821 err = send_options_rsp(sk, MGMT_OP_SET_EXTERNAL_CONFIG, hdev); 6822 if (err < 0) 6823 goto unlock; 6824 6825 if (!changed) 6826 goto unlock; 6827 6828 err = new_options(hdev, sk); 6829 6830 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED) == is_configured(hdev)) { 6831 mgmt_index_removed(hdev); 6832 6833 if (hci_dev_test_and_change_flag(hdev, HCI_UNCONFIGURED)) { 6834 hci_dev_set_flag(hdev, HCI_CONFIG); 6835 hci_dev_set_flag(hdev, HCI_AUTO_OFF); 6836 6837 queue_work(hdev->req_workqueue, &hdev->power_on); 6838 } else { 6839 set_bit(HCI_RAW, &hdev->flags); 6840 mgmt_index_added(hdev); 6841 } 6842 } 6843 6844 unlock: 6845 hci_dev_unlock(hdev); 6846 return err; 6847 } 6848 6849 static int set_public_address(struct sock *sk, struct hci_dev *hdev, 6850 void *data, u16 len) 6851 { 6852 struct mgmt_cp_set_public_address *cp = data; 6853 bool changed; 6854 int err; 6855 6856 bt_dev_dbg(hdev, "sock %p", sk); 6857 6858 if (hdev_is_powered(hdev)) 6859 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PUBLIC_ADDRESS, 6860 MGMT_STATUS_REJECTED); 6861 6862 if (!bacmp(&cp->bdaddr, BDADDR_ANY)) 6863 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PUBLIC_ADDRESS, 6864 MGMT_STATUS_INVALID_PARAMS); 6865 6866 if (!hdev->set_bdaddr) 6867 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PUBLIC_ADDRESS, 6868 MGMT_STATUS_NOT_SUPPORTED); 6869 6870 hci_dev_lock(hdev); 6871 6872 changed = !!bacmp(&hdev->public_addr, &cp->bdaddr); 6873 bacpy(&hdev->public_addr, &cp->bdaddr); 6874 6875 err = send_options_rsp(sk, MGMT_OP_SET_PUBLIC_ADDRESS, hdev); 6876 if (err < 0) 6877 goto unlock; 6878 6879 if (!changed) 6880 goto unlock; 6881 6882 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) 6883 err = new_options(hdev, sk); 6884 6885 if (is_configured(hdev)) { 6886 mgmt_index_removed(hdev); 6887 6888 hci_dev_clear_flag(hdev, HCI_UNCONFIGURED); 6889 6890 hci_dev_set_flag(hdev, HCI_CONFIG); 6891 hci_dev_set_flag(hdev, HCI_AUTO_OFF); 6892 6893 queue_work(hdev->req_workqueue, &hdev->power_on); 6894 } 6895 6896 unlock: 6897 hci_dev_unlock(hdev); 6898 return err; 6899 } 6900 6901 static void read_local_oob_ext_data_complete(struct hci_dev *hdev, u8 status, 6902 u16 opcode, struct sk_buff *skb) 6903 { 6904 const struct mgmt_cp_read_local_oob_ext_data *mgmt_cp; 6905 struct mgmt_rp_read_local_oob_ext_data *mgmt_rp; 6906 u8 *h192, *r192, *h256, *r256; 6907 struct mgmt_pending_cmd *cmd; 6908 u16 eir_len; 6909 int err; 6910 6911 bt_dev_dbg(hdev, "status %u", status); 6912 6913 cmd = pending_find(MGMT_OP_READ_LOCAL_OOB_EXT_DATA, hdev); 6914 if (!cmd) 6915 return; 6916 6917 mgmt_cp = cmd->param; 6918 6919 if (status) { 6920 status = mgmt_status(status); 6921 eir_len = 0; 6922 6923 h192 = NULL; 6924 r192 = NULL; 6925 h256 = NULL; 6926 r256 = NULL; 6927 } else if (opcode == HCI_OP_READ_LOCAL_OOB_DATA) { 6928 struct hci_rp_read_local_oob_data *rp; 6929 6930 if (skb->len != sizeof(*rp)) { 6931 status = MGMT_STATUS_FAILED; 6932 eir_len = 0; 6933 } else { 6934 status = MGMT_STATUS_SUCCESS; 6935 rp = (void *)skb->data; 6936 6937 eir_len = 5 + 18 + 18; 6938 h192 = rp->hash; 6939 r192 = rp->rand; 6940 h256 = NULL; 6941 r256 = NULL; 6942 } 6943 } else { 6944 struct hci_rp_read_local_oob_ext_data *rp; 6945 6946 if (skb->len != sizeof(*rp)) { 6947 status = MGMT_STATUS_FAILED; 6948 eir_len = 0; 6949 } else { 6950 status = MGMT_STATUS_SUCCESS; 6951 rp = (void *)skb->data; 6952 6953 if (hci_dev_test_flag(hdev, HCI_SC_ONLY)) { 6954 eir_len = 5 + 18 + 18; 6955 h192 = NULL; 6956 r192 = NULL; 6957 } else { 6958 eir_len = 5 + 18 + 18 + 18 + 18; 6959 h192 = rp->hash192; 6960 r192 = rp->rand192; 6961 } 6962 6963 h256 = rp->hash256; 6964 r256 = rp->rand256; 6965 } 6966 } 6967 6968 mgmt_rp = kmalloc(sizeof(*mgmt_rp) + eir_len, GFP_KERNEL); 6969 if (!mgmt_rp) 6970 goto done; 6971 6972 if (status) 6973 goto send_rsp; 6974 6975 eir_len = eir_append_data(mgmt_rp->eir, 0, EIR_CLASS_OF_DEV, 6976 hdev->dev_class, 3); 6977 6978 if (h192 && r192) { 6979 eir_len = eir_append_data(mgmt_rp->eir, eir_len, 6980 EIR_SSP_HASH_C192, h192, 16); 6981 eir_len = eir_append_data(mgmt_rp->eir, eir_len, 6982 EIR_SSP_RAND_R192, r192, 16); 6983 } 6984 6985 if (h256 && r256) { 6986 eir_len = eir_append_data(mgmt_rp->eir, eir_len, 6987 EIR_SSP_HASH_C256, h256, 16); 6988 eir_len = eir_append_data(mgmt_rp->eir, eir_len, 6989 EIR_SSP_RAND_R256, r256, 16); 6990 } 6991 6992 send_rsp: 6993 mgmt_rp->type = mgmt_cp->type; 6994 mgmt_rp->eir_len = cpu_to_le16(eir_len); 6995 6996 err = mgmt_cmd_complete(cmd->sk, hdev->id, 6997 MGMT_OP_READ_LOCAL_OOB_EXT_DATA, status, 6998 mgmt_rp, sizeof(*mgmt_rp) + eir_len); 6999 if (err < 0 || status) 7000 goto done; 7001 7002 hci_sock_set_flag(cmd->sk, HCI_MGMT_OOB_DATA_EVENTS); 7003 7004 err = mgmt_limited_event(MGMT_EV_LOCAL_OOB_DATA_UPDATED, hdev, 7005 mgmt_rp, sizeof(*mgmt_rp) + eir_len, 7006 HCI_MGMT_OOB_DATA_EVENTS, cmd->sk); 7007 done: 7008 kfree(mgmt_rp); 7009 mgmt_pending_remove(cmd); 7010 } 7011 7012 static int read_local_ssp_oob_req(struct hci_dev *hdev, struct sock *sk, 7013 struct mgmt_cp_read_local_oob_ext_data *cp) 7014 { 7015 struct mgmt_pending_cmd *cmd; 7016 struct hci_request req; 7017 int err; 7018 7019 cmd = mgmt_pending_add(sk, MGMT_OP_READ_LOCAL_OOB_EXT_DATA, hdev, 7020 cp, sizeof(*cp)); 7021 if (!cmd) 7022 return -ENOMEM; 7023 7024 hci_req_init(&req, hdev); 7025 7026 if (bredr_sc_enabled(hdev)) 7027 hci_req_add(&req, HCI_OP_READ_LOCAL_OOB_EXT_DATA, 0, NULL); 7028 else 7029 hci_req_add(&req, HCI_OP_READ_LOCAL_OOB_DATA, 0, NULL); 7030 7031 err = hci_req_run_skb(&req, read_local_oob_ext_data_complete); 7032 if (err < 0) { 7033 mgmt_pending_remove(cmd); 7034 return err; 7035 } 7036 7037 return 0; 7038 } 7039 7040 static int read_local_oob_ext_data(struct sock *sk, struct hci_dev *hdev, 7041 void *data, u16 data_len) 7042 { 7043 struct mgmt_cp_read_local_oob_ext_data *cp = data; 7044 struct mgmt_rp_read_local_oob_ext_data *rp; 7045 size_t rp_len; 7046 u16 eir_len; 7047 u8 status, flags, role, addr[7], hash[16], rand[16]; 7048 int err; 7049 7050 bt_dev_dbg(hdev, "sock %p", sk); 7051 7052 if (hdev_is_powered(hdev)) { 7053 switch (cp->type) { 7054 case BIT(BDADDR_BREDR): 7055 status = mgmt_bredr_support(hdev); 7056 if (status) 7057 eir_len = 0; 7058 else 7059 eir_len = 5; 7060 break; 7061 case (BIT(BDADDR_LE_PUBLIC) | BIT(BDADDR_LE_RANDOM)): 7062 status = mgmt_le_support(hdev); 7063 if (status) 7064 eir_len = 0; 7065 else 7066 eir_len = 9 + 3 + 18 + 18 + 3; 7067 break; 7068 default: 7069 status = MGMT_STATUS_INVALID_PARAMS; 7070 eir_len = 0; 7071 break; 7072 } 7073 } else { 7074 status = MGMT_STATUS_NOT_POWERED; 7075 eir_len = 0; 7076 } 7077 7078 rp_len = sizeof(*rp) + eir_len; 7079 rp = kmalloc(rp_len, GFP_ATOMIC); 7080 if (!rp) 7081 return -ENOMEM; 7082 7083 if (status) 7084 goto complete; 7085 7086 hci_dev_lock(hdev); 7087 7088 eir_len = 0; 7089 switch (cp->type) { 7090 case BIT(BDADDR_BREDR): 7091 if (hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) { 7092 err = read_local_ssp_oob_req(hdev, sk, cp); 7093 hci_dev_unlock(hdev); 7094 if (!err) 7095 goto done; 7096 7097 status = MGMT_STATUS_FAILED; 7098 goto complete; 7099 } else { 7100 eir_len = eir_append_data(rp->eir, eir_len, 7101 EIR_CLASS_OF_DEV, 7102 hdev->dev_class, 3); 7103 } 7104 break; 7105 case (BIT(BDADDR_LE_PUBLIC) | BIT(BDADDR_LE_RANDOM)): 7106 if (hci_dev_test_flag(hdev, HCI_SC_ENABLED) && 7107 smp_generate_oob(hdev, hash, rand) < 0) { 7108 hci_dev_unlock(hdev); 7109 status = MGMT_STATUS_FAILED; 7110 goto complete; 7111 } 7112 7113 /* This should return the active RPA, but since the RPA 7114 * is only programmed on demand, it is really hard to fill 7115 * this in at the moment. For now disallow retrieving 7116 * local out-of-band data when privacy is in use. 7117 * 7118 * Returning the identity address will not help here since 7119 * pairing happens before the identity resolving key is 7120 * known and thus the connection establishment happens 7121 * based on the RPA and not the identity address. 7122 */ 7123 if (hci_dev_test_flag(hdev, HCI_PRIVACY)) { 7124 hci_dev_unlock(hdev); 7125 status = MGMT_STATUS_REJECTED; 7126 goto complete; 7127 } 7128 7129 if (hci_dev_test_flag(hdev, HCI_FORCE_STATIC_ADDR) || 7130 !bacmp(&hdev->bdaddr, BDADDR_ANY) || 7131 (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) && 7132 bacmp(&hdev->static_addr, BDADDR_ANY))) { 7133 memcpy(addr, &hdev->static_addr, 6); 7134 addr[6] = 0x01; 7135 } else { 7136 memcpy(addr, &hdev->bdaddr, 6); 7137 addr[6] = 0x00; 7138 } 7139 7140 eir_len = eir_append_data(rp->eir, eir_len, EIR_LE_BDADDR, 7141 addr, sizeof(addr)); 7142 7143 if (hci_dev_test_flag(hdev, HCI_ADVERTISING)) 7144 role = 0x02; 7145 else 7146 role = 0x01; 7147 7148 eir_len = eir_append_data(rp->eir, eir_len, EIR_LE_ROLE, 7149 &role, sizeof(role)); 7150 7151 if (hci_dev_test_flag(hdev, HCI_SC_ENABLED)) { 7152 eir_len = eir_append_data(rp->eir, eir_len, 7153 EIR_LE_SC_CONFIRM, 7154 hash, sizeof(hash)); 7155 7156 eir_len = eir_append_data(rp->eir, eir_len, 7157 EIR_LE_SC_RANDOM, 7158 rand, sizeof(rand)); 7159 } 7160 7161 flags = mgmt_get_adv_discov_flags(hdev); 7162 7163 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) 7164 flags |= LE_AD_NO_BREDR; 7165 7166 eir_len = eir_append_data(rp->eir, eir_len, EIR_FLAGS, 7167 &flags, sizeof(flags)); 7168 break; 7169 } 7170 7171 hci_dev_unlock(hdev); 7172 7173 hci_sock_set_flag(sk, HCI_MGMT_OOB_DATA_EVENTS); 7174 7175 status = MGMT_STATUS_SUCCESS; 7176 7177 complete: 7178 rp->type = cp->type; 7179 rp->eir_len = cpu_to_le16(eir_len); 7180 7181 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_EXT_DATA, 7182 status, rp, sizeof(*rp) + eir_len); 7183 if (err < 0 || status) 7184 goto done; 7185 7186 err = mgmt_limited_event(MGMT_EV_LOCAL_OOB_DATA_UPDATED, hdev, 7187 rp, sizeof(*rp) + eir_len, 7188 HCI_MGMT_OOB_DATA_EVENTS, sk); 7189 7190 done: 7191 kfree(rp); 7192 7193 return err; 7194 } 7195 7196 static u32 get_supported_adv_flags(struct hci_dev *hdev) 7197 { 7198 u32 flags = 0; 7199 7200 flags |= MGMT_ADV_FLAG_CONNECTABLE; 7201 flags |= MGMT_ADV_FLAG_DISCOV; 7202 flags |= MGMT_ADV_FLAG_LIMITED_DISCOV; 7203 flags |= MGMT_ADV_FLAG_MANAGED_FLAGS; 7204 flags |= MGMT_ADV_FLAG_APPEARANCE; 7205 flags |= MGMT_ADV_FLAG_LOCAL_NAME; 7206 7207 /* In extended adv TX_POWER returned from Set Adv Param 7208 * will be always valid. 7209 */ 7210 if ((hdev->adv_tx_power != HCI_TX_POWER_INVALID) || 7211 ext_adv_capable(hdev)) 7212 flags |= MGMT_ADV_FLAG_TX_POWER; 7213 7214 if (ext_adv_capable(hdev)) { 7215 flags |= MGMT_ADV_FLAG_SEC_1M; 7216 flags |= MGMT_ADV_FLAG_HW_OFFLOAD; 7217 flags |= MGMT_ADV_FLAG_CAN_SET_TX_POWER; 7218 7219 if (hdev->le_features[1] & HCI_LE_PHY_2M) 7220 flags |= MGMT_ADV_FLAG_SEC_2M; 7221 7222 if (hdev->le_features[1] & HCI_LE_PHY_CODED) 7223 flags |= MGMT_ADV_FLAG_SEC_CODED; 7224 } 7225 7226 return flags; 7227 } 7228 7229 static int read_adv_features(struct sock *sk, struct hci_dev *hdev, 7230 void *data, u16 data_len) 7231 { 7232 struct mgmt_rp_read_adv_features *rp; 7233 size_t rp_len; 7234 int err; 7235 struct adv_info *adv_instance; 7236 u32 supported_flags; 7237 u8 *instance; 7238 7239 bt_dev_dbg(hdev, "sock %p", sk); 7240 7241 if (!lmp_le_capable(hdev)) 7242 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_ADV_FEATURES, 7243 MGMT_STATUS_REJECTED); 7244 7245 /* Enabling the experimental LL Privay support disables support for 7246 * advertising. 7247 */ 7248 if (hci_dev_test_flag(hdev, HCI_ENABLE_LL_PRIVACY)) 7249 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING, 7250 MGMT_STATUS_NOT_SUPPORTED); 7251 7252 hci_dev_lock(hdev); 7253 7254 rp_len = sizeof(*rp) + hdev->adv_instance_cnt; 7255 rp = kmalloc(rp_len, GFP_ATOMIC); 7256 if (!rp) { 7257 hci_dev_unlock(hdev); 7258 return -ENOMEM; 7259 } 7260 7261 supported_flags = get_supported_adv_flags(hdev); 7262 7263 rp->supported_flags = cpu_to_le32(supported_flags); 7264 rp->max_adv_data_len = HCI_MAX_AD_LENGTH; 7265 rp->max_scan_rsp_len = HCI_MAX_AD_LENGTH; 7266 rp->max_instances = hdev->le_num_of_adv_sets; 7267 rp->num_instances = hdev->adv_instance_cnt; 7268 7269 instance = rp->instance; 7270 list_for_each_entry(adv_instance, &hdev->adv_instances, list) { 7271 *instance = adv_instance->instance; 7272 instance++; 7273 } 7274 7275 hci_dev_unlock(hdev); 7276 7277 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_ADV_FEATURES, 7278 MGMT_STATUS_SUCCESS, rp, rp_len); 7279 7280 kfree(rp); 7281 7282 return err; 7283 } 7284 7285 static u8 calculate_name_len(struct hci_dev *hdev) 7286 { 7287 u8 buf[HCI_MAX_SHORT_NAME_LENGTH + 3]; 7288 7289 return append_local_name(hdev, buf, 0); 7290 } 7291 7292 static u8 tlv_data_max_len(struct hci_dev *hdev, u32 adv_flags, 7293 bool is_adv_data) 7294 { 7295 u8 max_len = HCI_MAX_AD_LENGTH; 7296 7297 if (is_adv_data) { 7298 if (adv_flags & (MGMT_ADV_FLAG_DISCOV | 7299 MGMT_ADV_FLAG_LIMITED_DISCOV | 7300 MGMT_ADV_FLAG_MANAGED_FLAGS)) 7301 max_len -= 3; 7302 7303 if (adv_flags & MGMT_ADV_FLAG_TX_POWER) 7304 max_len -= 3; 7305 } else { 7306 if (adv_flags & MGMT_ADV_FLAG_LOCAL_NAME) 7307 max_len -= calculate_name_len(hdev); 7308 7309 if (adv_flags & (MGMT_ADV_FLAG_APPEARANCE)) 7310 max_len -= 4; 7311 } 7312 7313 return max_len; 7314 } 7315 7316 static bool flags_managed(u32 adv_flags) 7317 { 7318 return adv_flags & (MGMT_ADV_FLAG_DISCOV | 7319 MGMT_ADV_FLAG_LIMITED_DISCOV | 7320 MGMT_ADV_FLAG_MANAGED_FLAGS); 7321 } 7322 7323 static bool tx_power_managed(u32 adv_flags) 7324 { 7325 return adv_flags & MGMT_ADV_FLAG_TX_POWER; 7326 } 7327 7328 static bool name_managed(u32 adv_flags) 7329 { 7330 return adv_flags & MGMT_ADV_FLAG_LOCAL_NAME; 7331 } 7332 7333 static bool appearance_managed(u32 adv_flags) 7334 { 7335 return adv_flags & MGMT_ADV_FLAG_APPEARANCE; 7336 } 7337 7338 static bool tlv_data_is_valid(struct hci_dev *hdev, u32 adv_flags, u8 *data, 7339 u8 len, bool is_adv_data) 7340 { 7341 int i, cur_len; 7342 u8 max_len; 7343 7344 max_len = tlv_data_max_len(hdev, adv_flags, is_adv_data); 7345 7346 if (len > max_len) 7347 return false; 7348 7349 /* Make sure that the data is correctly formatted. */ 7350 for (i = 0, cur_len = 0; i < len; i += (cur_len + 1)) { 7351 cur_len = data[i]; 7352 7353 if (data[i + 1] == EIR_FLAGS && 7354 (!is_adv_data || flags_managed(adv_flags))) 7355 return false; 7356 7357 if (data[i + 1] == EIR_TX_POWER && tx_power_managed(adv_flags)) 7358 return false; 7359 7360 if (data[i + 1] == EIR_NAME_COMPLETE && name_managed(adv_flags)) 7361 return false; 7362 7363 if (data[i + 1] == EIR_NAME_SHORT && name_managed(adv_flags)) 7364 return false; 7365 7366 if (data[i + 1] == EIR_APPEARANCE && 7367 appearance_managed(adv_flags)) 7368 return false; 7369 7370 /* If the current field length would exceed the total data 7371 * length, then it's invalid. 7372 */ 7373 if (i + cur_len >= len) 7374 return false; 7375 } 7376 7377 return true; 7378 } 7379 7380 static void add_advertising_complete(struct hci_dev *hdev, u8 status, 7381 u16 opcode) 7382 { 7383 struct mgmt_pending_cmd *cmd; 7384 struct mgmt_cp_add_advertising *cp; 7385 struct mgmt_rp_add_advertising rp; 7386 struct adv_info *adv_instance, *n; 7387 u8 instance; 7388 7389 bt_dev_dbg(hdev, "status %d", status); 7390 7391 hci_dev_lock(hdev); 7392 7393 cmd = pending_find(MGMT_OP_ADD_ADVERTISING, hdev); 7394 7395 list_for_each_entry_safe(adv_instance, n, &hdev->adv_instances, list) { 7396 if (!adv_instance->pending) 7397 continue; 7398 7399 if (!status) { 7400 adv_instance->pending = false; 7401 continue; 7402 } 7403 7404 instance = adv_instance->instance; 7405 7406 if (hdev->cur_adv_instance == instance) 7407 cancel_adv_timeout(hdev); 7408 7409 hci_remove_adv_instance(hdev, instance); 7410 mgmt_advertising_removed(cmd ? cmd->sk : NULL, hdev, instance); 7411 } 7412 7413 if (!cmd) 7414 goto unlock; 7415 7416 cp = cmd->param; 7417 rp.instance = cp->instance; 7418 7419 if (status) 7420 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, 7421 mgmt_status(status)); 7422 else 7423 mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, 7424 mgmt_status(status), &rp, sizeof(rp)); 7425 7426 mgmt_pending_remove(cmd); 7427 7428 unlock: 7429 hci_dev_unlock(hdev); 7430 } 7431 7432 static int add_advertising(struct sock *sk, struct hci_dev *hdev, 7433 void *data, u16 data_len) 7434 { 7435 struct mgmt_cp_add_advertising *cp = data; 7436 struct mgmt_rp_add_advertising rp; 7437 u32 flags; 7438 u32 supported_flags, phy_flags; 7439 u8 status; 7440 u16 timeout, duration; 7441 unsigned int prev_instance_cnt = hdev->adv_instance_cnt; 7442 u8 schedule_instance = 0; 7443 struct adv_info *next_instance; 7444 int err; 7445 struct mgmt_pending_cmd *cmd; 7446 struct hci_request req; 7447 7448 bt_dev_dbg(hdev, "sock %p", sk); 7449 7450 status = mgmt_le_support(hdev); 7451 if (status) 7452 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING, 7453 status); 7454 7455 /* Enabling the experimental LL Privay support disables support for 7456 * advertising. 7457 */ 7458 if (hci_dev_test_flag(hdev, HCI_ENABLE_LL_PRIVACY)) 7459 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING, 7460 MGMT_STATUS_NOT_SUPPORTED); 7461 7462 if (cp->instance < 1 || cp->instance > hdev->le_num_of_adv_sets) 7463 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING, 7464 MGMT_STATUS_INVALID_PARAMS); 7465 7466 if (data_len != sizeof(*cp) + cp->adv_data_len + cp->scan_rsp_len) 7467 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING, 7468 MGMT_STATUS_INVALID_PARAMS); 7469 7470 flags = __le32_to_cpu(cp->flags); 7471 timeout = __le16_to_cpu(cp->timeout); 7472 duration = __le16_to_cpu(cp->duration); 7473 7474 /* The current implementation only supports a subset of the specified 7475 * flags. Also need to check mutual exclusiveness of sec flags. 7476 */ 7477 supported_flags = get_supported_adv_flags(hdev); 7478 phy_flags = flags & MGMT_ADV_FLAG_SEC_MASK; 7479 if (flags & ~supported_flags || 7480 ((phy_flags && (phy_flags ^ (phy_flags & -phy_flags))))) 7481 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING, 7482 MGMT_STATUS_INVALID_PARAMS); 7483 7484 hci_dev_lock(hdev); 7485 7486 if (timeout && !hdev_is_powered(hdev)) { 7487 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING, 7488 MGMT_STATUS_REJECTED); 7489 goto unlock; 7490 } 7491 7492 if (pending_find(MGMT_OP_ADD_ADVERTISING, hdev) || 7493 pending_find(MGMT_OP_REMOVE_ADVERTISING, hdev) || 7494 pending_find(MGMT_OP_SET_LE, hdev)) { 7495 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING, 7496 MGMT_STATUS_BUSY); 7497 goto unlock; 7498 } 7499 7500 if (!tlv_data_is_valid(hdev, flags, cp->data, cp->adv_data_len, true) || 7501 !tlv_data_is_valid(hdev, flags, cp->data + cp->adv_data_len, 7502 cp->scan_rsp_len, false)) { 7503 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING, 7504 MGMT_STATUS_INVALID_PARAMS); 7505 goto unlock; 7506 } 7507 7508 err = hci_add_adv_instance(hdev, cp->instance, flags, 7509 cp->adv_data_len, cp->data, 7510 cp->scan_rsp_len, 7511 cp->data + cp->adv_data_len, 7512 timeout, duration); 7513 if (err < 0) { 7514 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING, 7515 MGMT_STATUS_FAILED); 7516 goto unlock; 7517 } 7518 7519 /* Only trigger an advertising added event if a new instance was 7520 * actually added. 7521 */ 7522 if (hdev->adv_instance_cnt > prev_instance_cnt) 7523 mgmt_advertising_added(sk, hdev, cp->instance); 7524 7525 if (hdev->cur_adv_instance == cp->instance) { 7526 /* If the currently advertised instance is being changed then 7527 * cancel the current advertising and schedule the next 7528 * instance. If there is only one instance then the overridden 7529 * advertising data will be visible right away. 7530 */ 7531 cancel_adv_timeout(hdev); 7532 7533 next_instance = hci_get_next_instance(hdev, cp->instance); 7534 if (next_instance) 7535 schedule_instance = next_instance->instance; 7536 } else if (!hdev->adv_instance_timeout) { 7537 /* Immediately advertise the new instance if no other 7538 * instance is currently being advertised. 7539 */ 7540 schedule_instance = cp->instance; 7541 } 7542 7543 /* If the HCI_ADVERTISING flag is set or the device isn't powered or 7544 * there is no instance to be advertised then we have no HCI 7545 * communication to make. Simply return. 7546 */ 7547 if (!hdev_is_powered(hdev) || 7548 hci_dev_test_flag(hdev, HCI_ADVERTISING) || 7549 !schedule_instance) { 7550 rp.instance = cp->instance; 7551 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_ADVERTISING, 7552 MGMT_STATUS_SUCCESS, &rp, sizeof(rp)); 7553 goto unlock; 7554 } 7555 7556 /* We're good to go, update advertising data, parameters, and start 7557 * advertising. 7558 */ 7559 cmd = mgmt_pending_add(sk, MGMT_OP_ADD_ADVERTISING, hdev, data, 7560 data_len); 7561 if (!cmd) { 7562 err = -ENOMEM; 7563 goto unlock; 7564 } 7565 7566 hci_req_init(&req, hdev); 7567 7568 err = __hci_req_schedule_adv_instance(&req, schedule_instance, true); 7569 7570 if (!err) 7571 err = hci_req_run(&req, add_advertising_complete); 7572 7573 if (err < 0) { 7574 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING, 7575 MGMT_STATUS_FAILED); 7576 mgmt_pending_remove(cmd); 7577 } 7578 7579 unlock: 7580 hci_dev_unlock(hdev); 7581 7582 return err; 7583 } 7584 7585 static void remove_advertising_complete(struct hci_dev *hdev, u8 status, 7586 u16 opcode) 7587 { 7588 struct mgmt_pending_cmd *cmd; 7589 struct mgmt_cp_remove_advertising *cp; 7590 struct mgmt_rp_remove_advertising rp; 7591 7592 bt_dev_dbg(hdev, "status %d", status); 7593 7594 hci_dev_lock(hdev); 7595 7596 /* A failure status here only means that we failed to disable 7597 * advertising. Otherwise, the advertising instance has been removed, 7598 * so report success. 7599 */ 7600 cmd = pending_find(MGMT_OP_REMOVE_ADVERTISING, hdev); 7601 if (!cmd) 7602 goto unlock; 7603 7604 cp = cmd->param; 7605 rp.instance = cp->instance; 7606 7607 mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, MGMT_STATUS_SUCCESS, 7608 &rp, sizeof(rp)); 7609 mgmt_pending_remove(cmd); 7610 7611 unlock: 7612 hci_dev_unlock(hdev); 7613 } 7614 7615 static int remove_advertising(struct sock *sk, struct hci_dev *hdev, 7616 void *data, u16 data_len) 7617 { 7618 struct mgmt_cp_remove_advertising *cp = data; 7619 struct mgmt_rp_remove_advertising rp; 7620 struct mgmt_pending_cmd *cmd; 7621 struct hci_request req; 7622 int err; 7623 7624 bt_dev_dbg(hdev, "sock %p", sk); 7625 7626 /* Enabling the experimental LL Privay support disables support for 7627 * advertising. 7628 */ 7629 if (hci_dev_test_flag(hdev, HCI_ENABLE_LL_PRIVACY)) 7630 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING, 7631 MGMT_STATUS_NOT_SUPPORTED); 7632 7633 hci_dev_lock(hdev); 7634 7635 if (cp->instance && !hci_find_adv_instance(hdev, cp->instance)) { 7636 err = mgmt_cmd_status(sk, hdev->id, 7637 MGMT_OP_REMOVE_ADVERTISING, 7638 MGMT_STATUS_INVALID_PARAMS); 7639 goto unlock; 7640 } 7641 7642 if (pending_find(MGMT_OP_ADD_ADVERTISING, hdev) || 7643 pending_find(MGMT_OP_REMOVE_ADVERTISING, hdev) || 7644 pending_find(MGMT_OP_SET_LE, hdev)) { 7645 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_ADVERTISING, 7646 MGMT_STATUS_BUSY); 7647 goto unlock; 7648 } 7649 7650 if (list_empty(&hdev->adv_instances)) { 7651 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_ADVERTISING, 7652 MGMT_STATUS_INVALID_PARAMS); 7653 goto unlock; 7654 } 7655 7656 hci_req_init(&req, hdev); 7657 7658 /* If we use extended advertising, instance is disabled and removed */ 7659 if (ext_adv_capable(hdev)) { 7660 __hci_req_disable_ext_adv_instance(&req, cp->instance); 7661 __hci_req_remove_ext_adv_instance(&req, cp->instance); 7662 } 7663 7664 hci_req_clear_adv_instance(hdev, sk, &req, cp->instance, true); 7665 7666 if (list_empty(&hdev->adv_instances)) 7667 __hci_req_disable_advertising(&req); 7668 7669 /* If no HCI commands have been collected so far or the HCI_ADVERTISING 7670 * flag is set or the device isn't powered then we have no HCI 7671 * communication to make. Simply return. 7672 */ 7673 if (skb_queue_empty(&req.cmd_q) || 7674 !hdev_is_powered(hdev) || 7675 hci_dev_test_flag(hdev, HCI_ADVERTISING)) { 7676 hci_req_purge(&req); 7677 rp.instance = cp->instance; 7678 err = mgmt_cmd_complete(sk, hdev->id, 7679 MGMT_OP_REMOVE_ADVERTISING, 7680 MGMT_STATUS_SUCCESS, &rp, sizeof(rp)); 7681 goto unlock; 7682 } 7683 7684 cmd = mgmt_pending_add(sk, MGMT_OP_REMOVE_ADVERTISING, hdev, data, 7685 data_len); 7686 if (!cmd) { 7687 err = -ENOMEM; 7688 goto unlock; 7689 } 7690 7691 err = hci_req_run(&req, remove_advertising_complete); 7692 if (err < 0) 7693 mgmt_pending_remove(cmd); 7694 7695 unlock: 7696 hci_dev_unlock(hdev); 7697 7698 return err; 7699 } 7700 7701 static int get_adv_size_info(struct sock *sk, struct hci_dev *hdev, 7702 void *data, u16 data_len) 7703 { 7704 struct mgmt_cp_get_adv_size_info *cp = data; 7705 struct mgmt_rp_get_adv_size_info rp; 7706 u32 flags, supported_flags; 7707 int err; 7708 7709 bt_dev_dbg(hdev, "sock %p", sk); 7710 7711 if (!lmp_le_capable(hdev)) 7712 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_ADV_SIZE_INFO, 7713 MGMT_STATUS_REJECTED); 7714 7715 if (cp->instance < 1 || cp->instance > hdev->le_num_of_adv_sets) 7716 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_ADV_SIZE_INFO, 7717 MGMT_STATUS_INVALID_PARAMS); 7718 7719 flags = __le32_to_cpu(cp->flags); 7720 7721 /* The current implementation only supports a subset of the specified 7722 * flags. 7723 */ 7724 supported_flags = get_supported_adv_flags(hdev); 7725 if (flags & ~supported_flags) 7726 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_ADV_SIZE_INFO, 7727 MGMT_STATUS_INVALID_PARAMS); 7728 7729 rp.instance = cp->instance; 7730 rp.flags = cp->flags; 7731 rp.max_adv_data_len = tlv_data_max_len(hdev, flags, true); 7732 rp.max_scan_rsp_len = tlv_data_max_len(hdev, flags, false); 7733 7734 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_ADV_SIZE_INFO, 7735 MGMT_STATUS_SUCCESS, &rp, sizeof(rp)); 7736 7737 return err; 7738 } 7739 7740 static const struct hci_mgmt_handler mgmt_handlers[] = { 7741 { NULL }, /* 0x0000 (no command) */ 7742 { read_version, MGMT_READ_VERSION_SIZE, 7743 HCI_MGMT_NO_HDEV | 7744 HCI_MGMT_UNTRUSTED }, 7745 { read_commands, MGMT_READ_COMMANDS_SIZE, 7746 HCI_MGMT_NO_HDEV | 7747 HCI_MGMT_UNTRUSTED }, 7748 { read_index_list, MGMT_READ_INDEX_LIST_SIZE, 7749 HCI_MGMT_NO_HDEV | 7750 HCI_MGMT_UNTRUSTED }, 7751 { read_controller_info, MGMT_READ_INFO_SIZE, 7752 HCI_MGMT_UNTRUSTED }, 7753 { set_powered, MGMT_SETTING_SIZE }, 7754 { set_discoverable, MGMT_SET_DISCOVERABLE_SIZE }, 7755 { set_connectable, MGMT_SETTING_SIZE }, 7756 { set_fast_connectable, MGMT_SETTING_SIZE }, 7757 { set_bondable, MGMT_SETTING_SIZE }, 7758 { set_link_security, MGMT_SETTING_SIZE }, 7759 { set_ssp, MGMT_SETTING_SIZE }, 7760 { set_hs, MGMT_SETTING_SIZE }, 7761 { set_le, MGMT_SETTING_SIZE }, 7762 { set_dev_class, MGMT_SET_DEV_CLASS_SIZE }, 7763 { set_local_name, MGMT_SET_LOCAL_NAME_SIZE }, 7764 { add_uuid, MGMT_ADD_UUID_SIZE }, 7765 { remove_uuid, MGMT_REMOVE_UUID_SIZE }, 7766 { load_link_keys, MGMT_LOAD_LINK_KEYS_SIZE, 7767 HCI_MGMT_VAR_LEN }, 7768 { load_long_term_keys, MGMT_LOAD_LONG_TERM_KEYS_SIZE, 7769 HCI_MGMT_VAR_LEN }, 7770 { disconnect, MGMT_DISCONNECT_SIZE }, 7771 { get_connections, MGMT_GET_CONNECTIONS_SIZE }, 7772 { pin_code_reply, MGMT_PIN_CODE_REPLY_SIZE }, 7773 { pin_code_neg_reply, MGMT_PIN_CODE_NEG_REPLY_SIZE }, 7774 { set_io_capability, MGMT_SET_IO_CAPABILITY_SIZE }, 7775 { pair_device, MGMT_PAIR_DEVICE_SIZE }, 7776 { cancel_pair_device, MGMT_CANCEL_PAIR_DEVICE_SIZE }, 7777 { unpair_device, MGMT_UNPAIR_DEVICE_SIZE }, 7778 { user_confirm_reply, MGMT_USER_CONFIRM_REPLY_SIZE }, 7779 { user_confirm_neg_reply, MGMT_USER_CONFIRM_NEG_REPLY_SIZE }, 7780 { user_passkey_reply, MGMT_USER_PASSKEY_REPLY_SIZE }, 7781 { user_passkey_neg_reply, MGMT_USER_PASSKEY_NEG_REPLY_SIZE }, 7782 { read_local_oob_data, MGMT_READ_LOCAL_OOB_DATA_SIZE }, 7783 { add_remote_oob_data, MGMT_ADD_REMOTE_OOB_DATA_SIZE, 7784 HCI_MGMT_VAR_LEN }, 7785 { remove_remote_oob_data, MGMT_REMOVE_REMOTE_OOB_DATA_SIZE }, 7786 { start_discovery, MGMT_START_DISCOVERY_SIZE }, 7787 { stop_discovery, MGMT_STOP_DISCOVERY_SIZE }, 7788 { confirm_name, MGMT_CONFIRM_NAME_SIZE }, 7789 { block_device, MGMT_BLOCK_DEVICE_SIZE }, 7790 { unblock_device, MGMT_UNBLOCK_DEVICE_SIZE }, 7791 { set_device_id, MGMT_SET_DEVICE_ID_SIZE }, 7792 { set_advertising, MGMT_SETTING_SIZE }, 7793 { set_bredr, MGMT_SETTING_SIZE }, 7794 { set_static_address, MGMT_SET_STATIC_ADDRESS_SIZE }, 7795 { set_scan_params, MGMT_SET_SCAN_PARAMS_SIZE }, 7796 { set_secure_conn, MGMT_SETTING_SIZE }, 7797 { set_debug_keys, MGMT_SETTING_SIZE }, 7798 { set_privacy, MGMT_SET_PRIVACY_SIZE }, 7799 { load_irks, MGMT_LOAD_IRKS_SIZE, 7800 HCI_MGMT_VAR_LEN }, 7801 { get_conn_info, MGMT_GET_CONN_INFO_SIZE }, 7802 { get_clock_info, MGMT_GET_CLOCK_INFO_SIZE }, 7803 { add_device, MGMT_ADD_DEVICE_SIZE }, 7804 { remove_device, MGMT_REMOVE_DEVICE_SIZE }, 7805 { load_conn_param, MGMT_LOAD_CONN_PARAM_SIZE, 7806 HCI_MGMT_VAR_LEN }, 7807 { read_unconf_index_list, MGMT_READ_UNCONF_INDEX_LIST_SIZE, 7808 HCI_MGMT_NO_HDEV | 7809 HCI_MGMT_UNTRUSTED }, 7810 { read_config_info, MGMT_READ_CONFIG_INFO_SIZE, 7811 HCI_MGMT_UNCONFIGURED | 7812 HCI_MGMT_UNTRUSTED }, 7813 { set_external_config, MGMT_SET_EXTERNAL_CONFIG_SIZE, 7814 HCI_MGMT_UNCONFIGURED }, 7815 { set_public_address, MGMT_SET_PUBLIC_ADDRESS_SIZE, 7816 HCI_MGMT_UNCONFIGURED }, 7817 { start_service_discovery, MGMT_START_SERVICE_DISCOVERY_SIZE, 7818 HCI_MGMT_VAR_LEN }, 7819 { read_local_oob_ext_data, MGMT_READ_LOCAL_OOB_EXT_DATA_SIZE }, 7820 { read_ext_index_list, MGMT_READ_EXT_INDEX_LIST_SIZE, 7821 HCI_MGMT_NO_HDEV | 7822 HCI_MGMT_UNTRUSTED }, 7823 { read_adv_features, MGMT_READ_ADV_FEATURES_SIZE }, 7824 { add_advertising, MGMT_ADD_ADVERTISING_SIZE, 7825 HCI_MGMT_VAR_LEN }, 7826 { remove_advertising, MGMT_REMOVE_ADVERTISING_SIZE }, 7827 { get_adv_size_info, MGMT_GET_ADV_SIZE_INFO_SIZE }, 7828 { start_limited_discovery, MGMT_START_DISCOVERY_SIZE }, 7829 { read_ext_controller_info,MGMT_READ_EXT_INFO_SIZE, 7830 HCI_MGMT_UNTRUSTED }, 7831 { set_appearance, MGMT_SET_APPEARANCE_SIZE }, 7832 { get_phy_configuration, MGMT_GET_PHY_CONFIGURATION_SIZE }, 7833 { set_phy_configuration, MGMT_SET_PHY_CONFIGURATION_SIZE }, 7834 { set_blocked_keys, MGMT_OP_SET_BLOCKED_KEYS_SIZE, 7835 HCI_MGMT_VAR_LEN }, 7836 { set_wideband_speech, MGMT_SETTING_SIZE }, 7837 { read_security_info, MGMT_READ_SECURITY_INFO_SIZE, 7838 HCI_MGMT_UNTRUSTED }, 7839 { read_exp_features_info, MGMT_READ_EXP_FEATURES_INFO_SIZE, 7840 HCI_MGMT_UNTRUSTED | 7841 HCI_MGMT_HDEV_OPTIONAL }, 7842 { set_exp_feature, MGMT_SET_EXP_FEATURE_SIZE, 7843 HCI_MGMT_VAR_LEN | 7844 HCI_MGMT_HDEV_OPTIONAL }, 7845 { read_def_system_config, MGMT_READ_DEF_SYSTEM_CONFIG_SIZE, 7846 HCI_MGMT_UNTRUSTED }, 7847 { set_def_system_config, MGMT_SET_DEF_SYSTEM_CONFIG_SIZE, 7848 HCI_MGMT_VAR_LEN }, 7849 { read_def_runtime_config, MGMT_READ_DEF_RUNTIME_CONFIG_SIZE, 7850 HCI_MGMT_UNTRUSTED }, 7851 { set_def_runtime_config, MGMT_SET_DEF_RUNTIME_CONFIG_SIZE, 7852 HCI_MGMT_VAR_LEN }, 7853 { get_device_flags, MGMT_GET_DEVICE_FLAGS_SIZE }, 7854 { set_device_flags, MGMT_SET_DEVICE_FLAGS_SIZE }, 7855 { read_adv_mon_features, MGMT_READ_ADV_MONITOR_FEATURES_SIZE }, 7856 { add_adv_patterns_monitor,MGMT_ADD_ADV_PATTERNS_MONITOR_SIZE, 7857 HCI_MGMT_VAR_LEN }, 7858 { remove_adv_monitor, MGMT_REMOVE_ADV_MONITOR_SIZE }, 7859 }; 7860 7861 void mgmt_index_added(struct hci_dev *hdev) 7862 { 7863 struct mgmt_ev_ext_index ev; 7864 7865 if (test_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks)) 7866 return; 7867 7868 switch (hdev->dev_type) { 7869 case HCI_PRIMARY: 7870 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) { 7871 mgmt_index_event(MGMT_EV_UNCONF_INDEX_ADDED, hdev, 7872 NULL, 0, HCI_MGMT_UNCONF_INDEX_EVENTS); 7873 ev.type = 0x01; 7874 } else { 7875 mgmt_index_event(MGMT_EV_INDEX_ADDED, hdev, NULL, 0, 7876 HCI_MGMT_INDEX_EVENTS); 7877 ev.type = 0x00; 7878 } 7879 break; 7880 case HCI_AMP: 7881 ev.type = 0x02; 7882 break; 7883 default: 7884 return; 7885 } 7886 7887 ev.bus = hdev->bus; 7888 7889 mgmt_index_event(MGMT_EV_EXT_INDEX_ADDED, hdev, &ev, sizeof(ev), 7890 HCI_MGMT_EXT_INDEX_EVENTS); 7891 } 7892 7893 void mgmt_index_removed(struct hci_dev *hdev) 7894 { 7895 struct mgmt_ev_ext_index ev; 7896 u8 status = MGMT_STATUS_INVALID_INDEX; 7897 7898 if (test_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks)) 7899 return; 7900 7901 switch (hdev->dev_type) { 7902 case HCI_PRIMARY: 7903 mgmt_pending_foreach(0, hdev, cmd_complete_rsp, &status); 7904 7905 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) { 7906 mgmt_index_event(MGMT_EV_UNCONF_INDEX_REMOVED, hdev, 7907 NULL, 0, HCI_MGMT_UNCONF_INDEX_EVENTS); 7908 ev.type = 0x01; 7909 } else { 7910 mgmt_index_event(MGMT_EV_INDEX_REMOVED, hdev, NULL, 0, 7911 HCI_MGMT_INDEX_EVENTS); 7912 ev.type = 0x00; 7913 } 7914 break; 7915 case HCI_AMP: 7916 ev.type = 0x02; 7917 break; 7918 default: 7919 return; 7920 } 7921 7922 ev.bus = hdev->bus; 7923 7924 mgmt_index_event(MGMT_EV_EXT_INDEX_REMOVED, hdev, &ev, sizeof(ev), 7925 HCI_MGMT_EXT_INDEX_EVENTS); 7926 } 7927 7928 /* This function requires the caller holds hdev->lock */ 7929 static void restart_le_actions(struct hci_dev *hdev) 7930 { 7931 struct hci_conn_params *p; 7932 7933 list_for_each_entry(p, &hdev->le_conn_params, list) { 7934 /* Needed for AUTO_OFF case where might not "really" 7935 * have been powered off. 7936 */ 7937 list_del_init(&p->action); 7938 7939 switch (p->auto_connect) { 7940 case HCI_AUTO_CONN_DIRECT: 7941 case HCI_AUTO_CONN_ALWAYS: 7942 list_add(&p->action, &hdev->pend_le_conns); 7943 break; 7944 case HCI_AUTO_CONN_REPORT: 7945 list_add(&p->action, &hdev->pend_le_reports); 7946 break; 7947 default: 7948 break; 7949 } 7950 } 7951 } 7952 7953 void mgmt_power_on(struct hci_dev *hdev, int err) 7954 { 7955 struct cmd_lookup match = { NULL, hdev }; 7956 7957 bt_dev_dbg(hdev, "err %d", err); 7958 7959 hci_dev_lock(hdev); 7960 7961 if (!err) { 7962 restart_le_actions(hdev); 7963 hci_update_background_scan(hdev); 7964 } 7965 7966 mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp, &match); 7967 7968 new_settings(hdev, match.sk); 7969 7970 if (match.sk) 7971 sock_put(match.sk); 7972 7973 hci_dev_unlock(hdev); 7974 } 7975 7976 void __mgmt_power_off(struct hci_dev *hdev) 7977 { 7978 struct cmd_lookup match = { NULL, hdev }; 7979 u8 status, zero_cod[] = { 0, 0, 0 }; 7980 7981 mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp, &match); 7982 7983 /* If the power off is because of hdev unregistration let 7984 * use the appropriate INVALID_INDEX status. Otherwise use 7985 * NOT_POWERED. We cover both scenarios here since later in 7986 * mgmt_index_removed() any hci_conn callbacks will have already 7987 * been triggered, potentially causing misleading DISCONNECTED 7988 * status responses. 7989 */ 7990 if (hci_dev_test_flag(hdev, HCI_UNREGISTER)) 7991 status = MGMT_STATUS_INVALID_INDEX; 7992 else 7993 status = MGMT_STATUS_NOT_POWERED; 7994 7995 mgmt_pending_foreach(0, hdev, cmd_complete_rsp, &status); 7996 7997 if (memcmp(hdev->dev_class, zero_cod, sizeof(zero_cod)) != 0) { 7998 mgmt_limited_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev, 7999 zero_cod, sizeof(zero_cod), 8000 HCI_MGMT_DEV_CLASS_EVENTS, NULL); 8001 ext_info_changed(hdev, NULL); 8002 } 8003 8004 new_settings(hdev, match.sk); 8005 8006 if (match.sk) 8007 sock_put(match.sk); 8008 } 8009 8010 void mgmt_set_powered_failed(struct hci_dev *hdev, int err) 8011 { 8012 struct mgmt_pending_cmd *cmd; 8013 u8 status; 8014 8015 cmd = pending_find(MGMT_OP_SET_POWERED, hdev); 8016 if (!cmd) 8017 return; 8018 8019 if (err == -ERFKILL) 8020 status = MGMT_STATUS_RFKILLED; 8021 else 8022 status = MGMT_STATUS_FAILED; 8023 8024 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_POWERED, status); 8025 8026 mgmt_pending_remove(cmd); 8027 } 8028 8029 void mgmt_new_link_key(struct hci_dev *hdev, struct link_key *key, 8030 bool persistent) 8031 { 8032 struct mgmt_ev_new_link_key ev; 8033 8034 memset(&ev, 0, sizeof(ev)); 8035 8036 ev.store_hint = persistent; 8037 bacpy(&ev.key.addr.bdaddr, &key->bdaddr); 8038 ev.key.addr.type = BDADDR_BREDR; 8039 ev.key.type = key->type; 8040 memcpy(ev.key.val, key->val, HCI_LINK_KEY_SIZE); 8041 ev.key.pin_len = key->pin_len; 8042 8043 mgmt_event(MGMT_EV_NEW_LINK_KEY, hdev, &ev, sizeof(ev), NULL); 8044 } 8045 8046 static u8 mgmt_ltk_type(struct smp_ltk *ltk) 8047 { 8048 switch (ltk->type) { 8049 case SMP_LTK: 8050 case SMP_LTK_SLAVE: 8051 if (ltk->authenticated) 8052 return MGMT_LTK_AUTHENTICATED; 8053 return MGMT_LTK_UNAUTHENTICATED; 8054 case SMP_LTK_P256: 8055 if (ltk->authenticated) 8056 return MGMT_LTK_P256_AUTH; 8057 return MGMT_LTK_P256_UNAUTH; 8058 case SMP_LTK_P256_DEBUG: 8059 return MGMT_LTK_P256_DEBUG; 8060 } 8061 8062 return MGMT_LTK_UNAUTHENTICATED; 8063 } 8064 8065 void mgmt_new_ltk(struct hci_dev *hdev, struct smp_ltk *key, bool persistent) 8066 { 8067 struct mgmt_ev_new_long_term_key ev; 8068 8069 memset(&ev, 0, sizeof(ev)); 8070 8071 /* Devices using resolvable or non-resolvable random addresses 8072 * without providing an identity resolving key don't require 8073 * to store long term keys. Their addresses will change the 8074 * next time around. 8075 * 8076 * Only when a remote device provides an identity address 8077 * make sure the long term key is stored. If the remote 8078 * identity is known, the long term keys are internally 8079 * mapped to the identity address. So allow static random 8080 * and public addresses here. 8081 */ 8082 if (key->bdaddr_type == ADDR_LE_DEV_RANDOM && 8083 (key->bdaddr.b[5] & 0xc0) != 0xc0) 8084 ev.store_hint = 0x00; 8085 else 8086 ev.store_hint = persistent; 8087 8088 bacpy(&ev.key.addr.bdaddr, &key->bdaddr); 8089 ev.key.addr.type = link_to_bdaddr(LE_LINK, key->bdaddr_type); 8090 ev.key.type = mgmt_ltk_type(key); 8091 ev.key.enc_size = key->enc_size; 8092 ev.key.ediv = key->ediv; 8093 ev.key.rand = key->rand; 8094 8095 if (key->type == SMP_LTK) 8096 ev.key.master = 1; 8097 8098 /* Make sure we copy only the significant bytes based on the 8099 * encryption key size, and set the rest of the value to zeroes. 8100 */ 8101 memcpy(ev.key.val, key->val, key->enc_size); 8102 memset(ev.key.val + key->enc_size, 0, 8103 sizeof(ev.key.val) - key->enc_size); 8104 8105 mgmt_event(MGMT_EV_NEW_LONG_TERM_KEY, hdev, &ev, sizeof(ev), NULL); 8106 } 8107 8108 void mgmt_new_irk(struct hci_dev *hdev, struct smp_irk *irk, bool persistent) 8109 { 8110 struct mgmt_ev_new_irk ev; 8111 8112 memset(&ev, 0, sizeof(ev)); 8113 8114 ev.store_hint = persistent; 8115 8116 bacpy(&ev.rpa, &irk->rpa); 8117 bacpy(&ev.irk.addr.bdaddr, &irk->bdaddr); 8118 ev.irk.addr.type = link_to_bdaddr(LE_LINK, irk->addr_type); 8119 memcpy(ev.irk.val, irk->val, sizeof(irk->val)); 8120 8121 mgmt_event(MGMT_EV_NEW_IRK, hdev, &ev, sizeof(ev), NULL); 8122 } 8123 8124 void mgmt_new_csrk(struct hci_dev *hdev, struct smp_csrk *csrk, 8125 bool persistent) 8126 { 8127 struct mgmt_ev_new_csrk ev; 8128 8129 memset(&ev, 0, sizeof(ev)); 8130 8131 /* Devices using resolvable or non-resolvable random addresses 8132 * without providing an identity resolving key don't require 8133 * to store signature resolving keys. Their addresses will change 8134 * the next time around. 8135 * 8136 * Only when a remote device provides an identity address 8137 * make sure the signature resolving key is stored. So allow 8138 * static random and public addresses here. 8139 */ 8140 if (csrk->bdaddr_type == ADDR_LE_DEV_RANDOM && 8141 (csrk->bdaddr.b[5] & 0xc0) != 0xc0) 8142 ev.store_hint = 0x00; 8143 else 8144 ev.store_hint = persistent; 8145 8146 bacpy(&ev.key.addr.bdaddr, &csrk->bdaddr); 8147 ev.key.addr.type = link_to_bdaddr(LE_LINK, csrk->bdaddr_type); 8148 ev.key.type = csrk->type; 8149 memcpy(ev.key.val, csrk->val, sizeof(csrk->val)); 8150 8151 mgmt_event(MGMT_EV_NEW_CSRK, hdev, &ev, sizeof(ev), NULL); 8152 } 8153 8154 void mgmt_new_conn_param(struct hci_dev *hdev, bdaddr_t *bdaddr, 8155 u8 bdaddr_type, u8 store_hint, u16 min_interval, 8156 u16 max_interval, u16 latency, u16 timeout) 8157 { 8158 struct mgmt_ev_new_conn_param ev; 8159 8160 if (!hci_is_identity_address(bdaddr, bdaddr_type)) 8161 return; 8162 8163 memset(&ev, 0, sizeof(ev)); 8164 bacpy(&ev.addr.bdaddr, bdaddr); 8165 ev.addr.type = link_to_bdaddr(LE_LINK, bdaddr_type); 8166 ev.store_hint = store_hint; 8167 ev.min_interval = cpu_to_le16(min_interval); 8168 ev.max_interval = cpu_to_le16(max_interval); 8169 ev.latency = cpu_to_le16(latency); 8170 ev.timeout = cpu_to_le16(timeout); 8171 8172 mgmt_event(MGMT_EV_NEW_CONN_PARAM, hdev, &ev, sizeof(ev), NULL); 8173 } 8174 8175 void mgmt_device_connected(struct hci_dev *hdev, struct hci_conn *conn, 8176 u32 flags, u8 *name, u8 name_len) 8177 { 8178 char buf[512]; 8179 struct mgmt_ev_device_connected *ev = (void *) buf; 8180 u16 eir_len = 0; 8181 8182 bacpy(&ev->addr.bdaddr, &conn->dst); 8183 ev->addr.type = link_to_bdaddr(conn->type, conn->dst_type); 8184 8185 ev->flags = __cpu_to_le32(flags); 8186 8187 /* We must ensure that the EIR Data fields are ordered and 8188 * unique. Keep it simple for now and avoid the problem by not 8189 * adding any BR/EDR data to the LE adv. 8190 */ 8191 if (conn->le_adv_data_len > 0) { 8192 memcpy(&ev->eir[eir_len], 8193 conn->le_adv_data, conn->le_adv_data_len); 8194 eir_len = conn->le_adv_data_len; 8195 } else { 8196 if (name_len > 0) 8197 eir_len = eir_append_data(ev->eir, 0, EIR_NAME_COMPLETE, 8198 name, name_len); 8199 8200 if (memcmp(conn->dev_class, "\0\0\0", 3) != 0) 8201 eir_len = eir_append_data(ev->eir, eir_len, 8202 EIR_CLASS_OF_DEV, 8203 conn->dev_class, 3); 8204 } 8205 8206 ev->eir_len = cpu_to_le16(eir_len); 8207 8208 mgmt_event(MGMT_EV_DEVICE_CONNECTED, hdev, buf, 8209 sizeof(*ev) + eir_len, NULL); 8210 } 8211 8212 static void disconnect_rsp(struct mgmt_pending_cmd *cmd, void *data) 8213 { 8214 struct sock **sk = data; 8215 8216 cmd->cmd_complete(cmd, 0); 8217 8218 *sk = cmd->sk; 8219 sock_hold(*sk); 8220 8221 mgmt_pending_remove(cmd); 8222 } 8223 8224 static void unpair_device_rsp(struct mgmt_pending_cmd *cmd, void *data) 8225 { 8226 struct hci_dev *hdev = data; 8227 struct mgmt_cp_unpair_device *cp = cmd->param; 8228 8229 device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, cmd->sk); 8230 8231 cmd->cmd_complete(cmd, 0); 8232 mgmt_pending_remove(cmd); 8233 } 8234 8235 bool mgmt_powering_down(struct hci_dev *hdev) 8236 { 8237 struct mgmt_pending_cmd *cmd; 8238 struct mgmt_mode *cp; 8239 8240 cmd = pending_find(MGMT_OP_SET_POWERED, hdev); 8241 if (!cmd) 8242 return false; 8243 8244 cp = cmd->param; 8245 if (!cp->val) 8246 return true; 8247 8248 return false; 8249 } 8250 8251 void mgmt_device_disconnected(struct hci_dev *hdev, bdaddr_t *bdaddr, 8252 u8 link_type, u8 addr_type, u8 reason, 8253 bool mgmt_connected) 8254 { 8255 struct mgmt_ev_device_disconnected ev; 8256 struct sock *sk = NULL; 8257 8258 /* The connection is still in hci_conn_hash so test for 1 8259 * instead of 0 to know if this is the last one. 8260 */ 8261 if (mgmt_powering_down(hdev) && hci_conn_count(hdev) == 1) { 8262 cancel_delayed_work(&hdev->power_off); 8263 queue_work(hdev->req_workqueue, &hdev->power_off.work); 8264 } 8265 8266 if (!mgmt_connected) 8267 return; 8268 8269 if (link_type != ACL_LINK && link_type != LE_LINK) 8270 return; 8271 8272 mgmt_pending_foreach(MGMT_OP_DISCONNECT, hdev, disconnect_rsp, &sk); 8273 8274 bacpy(&ev.addr.bdaddr, bdaddr); 8275 ev.addr.type = link_to_bdaddr(link_type, addr_type); 8276 ev.reason = reason; 8277 8278 /* Report disconnects due to suspend */ 8279 if (hdev->suspended) 8280 ev.reason = MGMT_DEV_DISCONN_LOCAL_HOST_SUSPEND; 8281 8282 mgmt_event(MGMT_EV_DEVICE_DISCONNECTED, hdev, &ev, sizeof(ev), sk); 8283 8284 if (sk) 8285 sock_put(sk); 8286 8287 mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, unpair_device_rsp, 8288 hdev); 8289 } 8290 8291 void mgmt_disconnect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr, 8292 u8 link_type, u8 addr_type, u8 status) 8293 { 8294 u8 bdaddr_type = link_to_bdaddr(link_type, addr_type); 8295 struct mgmt_cp_disconnect *cp; 8296 struct mgmt_pending_cmd *cmd; 8297 8298 mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, unpair_device_rsp, 8299 hdev); 8300 8301 cmd = pending_find(MGMT_OP_DISCONNECT, hdev); 8302 if (!cmd) 8303 return; 8304 8305 cp = cmd->param; 8306 8307 if (bacmp(bdaddr, &cp->addr.bdaddr)) 8308 return; 8309 8310 if (cp->addr.type != bdaddr_type) 8311 return; 8312 8313 cmd->cmd_complete(cmd, mgmt_status(status)); 8314 mgmt_pending_remove(cmd); 8315 } 8316 8317 void mgmt_connect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type, 8318 u8 addr_type, u8 status) 8319 { 8320 struct mgmt_ev_connect_failed ev; 8321 8322 /* The connection is still in hci_conn_hash so test for 1 8323 * instead of 0 to know if this is the last one. 8324 */ 8325 if (mgmt_powering_down(hdev) && hci_conn_count(hdev) == 1) { 8326 cancel_delayed_work(&hdev->power_off); 8327 queue_work(hdev->req_workqueue, &hdev->power_off.work); 8328 } 8329 8330 bacpy(&ev.addr.bdaddr, bdaddr); 8331 ev.addr.type = link_to_bdaddr(link_type, addr_type); 8332 ev.status = mgmt_status(status); 8333 8334 mgmt_event(MGMT_EV_CONNECT_FAILED, hdev, &ev, sizeof(ev), NULL); 8335 } 8336 8337 void mgmt_pin_code_request(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 secure) 8338 { 8339 struct mgmt_ev_pin_code_request ev; 8340 8341 bacpy(&ev.addr.bdaddr, bdaddr); 8342 ev.addr.type = BDADDR_BREDR; 8343 ev.secure = secure; 8344 8345 mgmt_event(MGMT_EV_PIN_CODE_REQUEST, hdev, &ev, sizeof(ev), NULL); 8346 } 8347 8348 void mgmt_pin_code_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr, 8349 u8 status) 8350 { 8351 struct mgmt_pending_cmd *cmd; 8352 8353 cmd = pending_find(MGMT_OP_PIN_CODE_REPLY, hdev); 8354 if (!cmd) 8355 return; 8356 8357 cmd->cmd_complete(cmd, mgmt_status(status)); 8358 mgmt_pending_remove(cmd); 8359 } 8360 8361 void mgmt_pin_code_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr, 8362 u8 status) 8363 { 8364 struct mgmt_pending_cmd *cmd; 8365 8366 cmd = pending_find(MGMT_OP_PIN_CODE_NEG_REPLY, hdev); 8367 if (!cmd) 8368 return; 8369 8370 cmd->cmd_complete(cmd, mgmt_status(status)); 8371 mgmt_pending_remove(cmd); 8372 } 8373 8374 int mgmt_user_confirm_request(struct hci_dev *hdev, bdaddr_t *bdaddr, 8375 u8 link_type, u8 addr_type, u32 value, 8376 u8 confirm_hint) 8377 { 8378 struct mgmt_ev_user_confirm_request ev; 8379 8380 bt_dev_dbg(hdev, "bdaddr %pMR", bdaddr); 8381 8382 bacpy(&ev.addr.bdaddr, bdaddr); 8383 ev.addr.type = link_to_bdaddr(link_type, addr_type); 8384 ev.confirm_hint = confirm_hint; 8385 ev.value = cpu_to_le32(value); 8386 8387 return mgmt_event(MGMT_EV_USER_CONFIRM_REQUEST, hdev, &ev, sizeof(ev), 8388 NULL); 8389 } 8390 8391 int mgmt_user_passkey_request(struct hci_dev *hdev, bdaddr_t *bdaddr, 8392 u8 link_type, u8 addr_type) 8393 { 8394 struct mgmt_ev_user_passkey_request ev; 8395 8396 bt_dev_dbg(hdev, "bdaddr %pMR", bdaddr); 8397 8398 bacpy(&ev.addr.bdaddr, bdaddr); 8399 ev.addr.type = link_to_bdaddr(link_type, addr_type); 8400 8401 return mgmt_event(MGMT_EV_USER_PASSKEY_REQUEST, hdev, &ev, sizeof(ev), 8402 NULL); 8403 } 8404 8405 static int user_pairing_resp_complete(struct hci_dev *hdev, bdaddr_t *bdaddr, 8406 u8 link_type, u8 addr_type, u8 status, 8407 u8 opcode) 8408 { 8409 struct mgmt_pending_cmd *cmd; 8410 8411 cmd = pending_find(opcode, hdev); 8412 if (!cmd) 8413 return -ENOENT; 8414 8415 cmd->cmd_complete(cmd, mgmt_status(status)); 8416 mgmt_pending_remove(cmd); 8417 8418 return 0; 8419 } 8420 8421 int mgmt_user_confirm_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr, 8422 u8 link_type, u8 addr_type, u8 status) 8423 { 8424 return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type, 8425 status, MGMT_OP_USER_CONFIRM_REPLY); 8426 } 8427 8428 int mgmt_user_confirm_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr, 8429 u8 link_type, u8 addr_type, u8 status) 8430 { 8431 return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type, 8432 status, 8433 MGMT_OP_USER_CONFIRM_NEG_REPLY); 8434 } 8435 8436 int mgmt_user_passkey_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr, 8437 u8 link_type, u8 addr_type, u8 status) 8438 { 8439 return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type, 8440 status, MGMT_OP_USER_PASSKEY_REPLY); 8441 } 8442 8443 int mgmt_user_passkey_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr, 8444 u8 link_type, u8 addr_type, u8 status) 8445 { 8446 return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type, 8447 status, 8448 MGMT_OP_USER_PASSKEY_NEG_REPLY); 8449 } 8450 8451 int mgmt_user_passkey_notify(struct hci_dev *hdev, bdaddr_t *bdaddr, 8452 u8 link_type, u8 addr_type, u32 passkey, 8453 u8 entered) 8454 { 8455 struct mgmt_ev_passkey_notify ev; 8456 8457 bt_dev_dbg(hdev, "bdaddr %pMR", bdaddr); 8458 8459 bacpy(&ev.addr.bdaddr, bdaddr); 8460 ev.addr.type = link_to_bdaddr(link_type, addr_type); 8461 ev.passkey = __cpu_to_le32(passkey); 8462 ev.entered = entered; 8463 8464 return mgmt_event(MGMT_EV_PASSKEY_NOTIFY, hdev, &ev, sizeof(ev), NULL); 8465 } 8466 8467 void mgmt_auth_failed(struct hci_conn *conn, u8 hci_status) 8468 { 8469 struct mgmt_ev_auth_failed ev; 8470 struct mgmt_pending_cmd *cmd; 8471 u8 status = mgmt_status(hci_status); 8472 8473 bacpy(&ev.addr.bdaddr, &conn->dst); 8474 ev.addr.type = link_to_bdaddr(conn->type, conn->dst_type); 8475 ev.status = status; 8476 8477 cmd = find_pairing(conn); 8478 8479 mgmt_event(MGMT_EV_AUTH_FAILED, conn->hdev, &ev, sizeof(ev), 8480 cmd ? cmd->sk : NULL); 8481 8482 if (cmd) { 8483 cmd->cmd_complete(cmd, status); 8484 mgmt_pending_remove(cmd); 8485 } 8486 } 8487 8488 void mgmt_auth_enable_complete(struct hci_dev *hdev, u8 status) 8489 { 8490 struct cmd_lookup match = { NULL, hdev }; 8491 bool changed; 8492 8493 if (status) { 8494 u8 mgmt_err = mgmt_status(status); 8495 mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev, 8496 cmd_status_rsp, &mgmt_err); 8497 return; 8498 } 8499 8500 if (test_bit(HCI_AUTH, &hdev->flags)) 8501 changed = !hci_dev_test_and_set_flag(hdev, HCI_LINK_SECURITY); 8502 else 8503 changed = hci_dev_test_and_clear_flag(hdev, HCI_LINK_SECURITY); 8504 8505 mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev, settings_rsp, 8506 &match); 8507 8508 if (changed) 8509 new_settings(hdev, match.sk); 8510 8511 if (match.sk) 8512 sock_put(match.sk); 8513 } 8514 8515 static void clear_eir(struct hci_request *req) 8516 { 8517 struct hci_dev *hdev = req->hdev; 8518 struct hci_cp_write_eir cp; 8519 8520 if (!lmp_ext_inq_capable(hdev)) 8521 return; 8522 8523 memset(hdev->eir, 0, sizeof(hdev->eir)); 8524 8525 memset(&cp, 0, sizeof(cp)); 8526 8527 hci_req_add(req, HCI_OP_WRITE_EIR, sizeof(cp), &cp); 8528 } 8529 8530 void mgmt_ssp_enable_complete(struct hci_dev *hdev, u8 enable, u8 status) 8531 { 8532 struct cmd_lookup match = { NULL, hdev }; 8533 struct hci_request req; 8534 bool changed = false; 8535 8536 if (status) { 8537 u8 mgmt_err = mgmt_status(status); 8538 8539 if (enable && hci_dev_test_and_clear_flag(hdev, 8540 HCI_SSP_ENABLED)) { 8541 hci_dev_clear_flag(hdev, HCI_HS_ENABLED); 8542 new_settings(hdev, NULL); 8543 } 8544 8545 mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev, cmd_status_rsp, 8546 &mgmt_err); 8547 return; 8548 } 8549 8550 if (enable) { 8551 changed = !hci_dev_test_and_set_flag(hdev, HCI_SSP_ENABLED); 8552 } else { 8553 changed = hci_dev_test_and_clear_flag(hdev, HCI_SSP_ENABLED); 8554 if (!changed) 8555 changed = hci_dev_test_and_clear_flag(hdev, 8556 HCI_HS_ENABLED); 8557 else 8558 hci_dev_clear_flag(hdev, HCI_HS_ENABLED); 8559 } 8560 8561 mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev, settings_rsp, &match); 8562 8563 if (changed) 8564 new_settings(hdev, match.sk); 8565 8566 if (match.sk) 8567 sock_put(match.sk); 8568 8569 hci_req_init(&req, hdev); 8570 8571 if (hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) { 8572 if (hci_dev_test_flag(hdev, HCI_USE_DEBUG_KEYS)) 8573 hci_req_add(&req, HCI_OP_WRITE_SSP_DEBUG_MODE, 8574 sizeof(enable), &enable); 8575 __hci_req_update_eir(&req); 8576 } else { 8577 clear_eir(&req); 8578 } 8579 8580 hci_req_run(&req, NULL); 8581 } 8582 8583 static void sk_lookup(struct mgmt_pending_cmd *cmd, void *data) 8584 { 8585 struct cmd_lookup *match = data; 8586 8587 if (match->sk == NULL) { 8588 match->sk = cmd->sk; 8589 sock_hold(match->sk); 8590 } 8591 } 8592 8593 void mgmt_set_class_of_dev_complete(struct hci_dev *hdev, u8 *dev_class, 8594 u8 status) 8595 { 8596 struct cmd_lookup match = { NULL, hdev, mgmt_status(status) }; 8597 8598 mgmt_pending_foreach(MGMT_OP_SET_DEV_CLASS, hdev, sk_lookup, &match); 8599 mgmt_pending_foreach(MGMT_OP_ADD_UUID, hdev, sk_lookup, &match); 8600 mgmt_pending_foreach(MGMT_OP_REMOVE_UUID, hdev, sk_lookup, &match); 8601 8602 if (!status) { 8603 mgmt_limited_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev, dev_class, 8604 3, HCI_MGMT_DEV_CLASS_EVENTS, NULL); 8605 ext_info_changed(hdev, NULL); 8606 } 8607 8608 if (match.sk) 8609 sock_put(match.sk); 8610 } 8611 8612 void mgmt_set_local_name_complete(struct hci_dev *hdev, u8 *name, u8 status) 8613 { 8614 struct mgmt_cp_set_local_name ev; 8615 struct mgmt_pending_cmd *cmd; 8616 8617 if (status) 8618 return; 8619 8620 memset(&ev, 0, sizeof(ev)); 8621 memcpy(ev.name, name, HCI_MAX_NAME_LENGTH); 8622 memcpy(ev.short_name, hdev->short_name, HCI_MAX_SHORT_NAME_LENGTH); 8623 8624 cmd = pending_find(MGMT_OP_SET_LOCAL_NAME, hdev); 8625 if (!cmd) { 8626 memcpy(hdev->dev_name, name, sizeof(hdev->dev_name)); 8627 8628 /* If this is a HCI command related to powering on the 8629 * HCI dev don't send any mgmt signals. 8630 */ 8631 if (pending_find(MGMT_OP_SET_POWERED, hdev)) 8632 return; 8633 } 8634 8635 mgmt_limited_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, &ev, sizeof(ev), 8636 HCI_MGMT_LOCAL_NAME_EVENTS, cmd ? cmd->sk : NULL); 8637 ext_info_changed(hdev, cmd ? cmd->sk : NULL); 8638 } 8639 8640 static inline bool has_uuid(u8 *uuid, u16 uuid_count, u8 (*uuids)[16]) 8641 { 8642 int i; 8643 8644 for (i = 0; i < uuid_count; i++) { 8645 if (!memcmp(uuid, uuids[i], 16)) 8646 return true; 8647 } 8648 8649 return false; 8650 } 8651 8652 static bool eir_has_uuids(u8 *eir, u16 eir_len, u16 uuid_count, u8 (*uuids)[16]) 8653 { 8654 u16 parsed = 0; 8655 8656 while (parsed < eir_len) { 8657 u8 field_len = eir[0]; 8658 u8 uuid[16]; 8659 int i; 8660 8661 if (field_len == 0) 8662 break; 8663 8664 if (eir_len - parsed < field_len + 1) 8665 break; 8666 8667 switch (eir[1]) { 8668 case EIR_UUID16_ALL: 8669 case EIR_UUID16_SOME: 8670 for (i = 0; i + 3 <= field_len; i += 2) { 8671 memcpy(uuid, bluetooth_base_uuid, 16); 8672 uuid[13] = eir[i + 3]; 8673 uuid[12] = eir[i + 2]; 8674 if (has_uuid(uuid, uuid_count, uuids)) 8675 return true; 8676 } 8677 break; 8678 case EIR_UUID32_ALL: 8679 case EIR_UUID32_SOME: 8680 for (i = 0; i + 5 <= field_len; i += 4) { 8681 memcpy(uuid, bluetooth_base_uuid, 16); 8682 uuid[15] = eir[i + 5]; 8683 uuid[14] = eir[i + 4]; 8684 uuid[13] = eir[i + 3]; 8685 uuid[12] = eir[i + 2]; 8686 if (has_uuid(uuid, uuid_count, uuids)) 8687 return true; 8688 } 8689 break; 8690 case EIR_UUID128_ALL: 8691 case EIR_UUID128_SOME: 8692 for (i = 0; i + 17 <= field_len; i += 16) { 8693 memcpy(uuid, eir + i + 2, 16); 8694 if (has_uuid(uuid, uuid_count, uuids)) 8695 return true; 8696 } 8697 break; 8698 } 8699 8700 parsed += field_len + 1; 8701 eir += field_len + 1; 8702 } 8703 8704 return false; 8705 } 8706 8707 static void restart_le_scan(struct hci_dev *hdev) 8708 { 8709 /* If controller is not scanning we are done. */ 8710 if (!hci_dev_test_flag(hdev, HCI_LE_SCAN)) 8711 return; 8712 8713 if (time_after(jiffies + DISCOV_LE_RESTART_DELAY, 8714 hdev->discovery.scan_start + 8715 hdev->discovery.scan_duration)) 8716 return; 8717 8718 queue_delayed_work(hdev->req_workqueue, &hdev->le_scan_restart, 8719 DISCOV_LE_RESTART_DELAY); 8720 } 8721 8722 static bool is_filter_match(struct hci_dev *hdev, s8 rssi, u8 *eir, 8723 u16 eir_len, u8 *scan_rsp, u8 scan_rsp_len) 8724 { 8725 /* If a RSSI threshold has been specified, and 8726 * HCI_QUIRK_STRICT_DUPLICATE_FILTER is not set, then all results with 8727 * a RSSI smaller than the RSSI threshold will be dropped. If the quirk 8728 * is set, let it through for further processing, as we might need to 8729 * restart the scan. 8730 * 8731 * For BR/EDR devices (pre 1.2) providing no RSSI during inquiry, 8732 * the results are also dropped. 8733 */ 8734 if (hdev->discovery.rssi != HCI_RSSI_INVALID && 8735 (rssi == HCI_RSSI_INVALID || 8736 (rssi < hdev->discovery.rssi && 8737 !test_bit(HCI_QUIRK_STRICT_DUPLICATE_FILTER, &hdev->quirks)))) 8738 return false; 8739 8740 if (hdev->discovery.uuid_count != 0) { 8741 /* If a list of UUIDs is provided in filter, results with no 8742 * matching UUID should be dropped. 8743 */ 8744 if (!eir_has_uuids(eir, eir_len, hdev->discovery.uuid_count, 8745 hdev->discovery.uuids) && 8746 !eir_has_uuids(scan_rsp, scan_rsp_len, 8747 hdev->discovery.uuid_count, 8748 hdev->discovery.uuids)) 8749 return false; 8750 } 8751 8752 /* If duplicate filtering does not report RSSI changes, then restart 8753 * scanning to ensure updated result with updated RSSI values. 8754 */ 8755 if (test_bit(HCI_QUIRK_STRICT_DUPLICATE_FILTER, &hdev->quirks)) { 8756 restart_le_scan(hdev); 8757 8758 /* Validate RSSI value against the RSSI threshold once more. */ 8759 if (hdev->discovery.rssi != HCI_RSSI_INVALID && 8760 rssi < hdev->discovery.rssi) 8761 return false; 8762 } 8763 8764 return true; 8765 } 8766 8767 void mgmt_device_found(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type, 8768 u8 addr_type, u8 *dev_class, s8 rssi, u32 flags, 8769 u8 *eir, u16 eir_len, u8 *scan_rsp, u8 scan_rsp_len) 8770 { 8771 char buf[512]; 8772 struct mgmt_ev_device_found *ev = (void *)buf; 8773 size_t ev_size; 8774 8775 /* Don't send events for a non-kernel initiated discovery. With 8776 * LE one exception is if we have pend_le_reports > 0 in which 8777 * case we're doing passive scanning and want these events. 8778 */ 8779 if (!hci_discovery_active(hdev)) { 8780 if (link_type == ACL_LINK) 8781 return; 8782 if (link_type == LE_LINK && 8783 list_empty(&hdev->pend_le_reports) && 8784 !hci_is_adv_monitoring(hdev)) { 8785 return; 8786 } 8787 } 8788 8789 if (hdev->discovery.result_filtering) { 8790 /* We are using service discovery */ 8791 if (!is_filter_match(hdev, rssi, eir, eir_len, scan_rsp, 8792 scan_rsp_len)) 8793 return; 8794 } 8795 8796 if (hdev->discovery.limited) { 8797 /* Check for limited discoverable bit */ 8798 if (dev_class) { 8799 if (!(dev_class[1] & 0x20)) 8800 return; 8801 } else { 8802 u8 *flags = eir_get_data(eir, eir_len, EIR_FLAGS, NULL); 8803 if (!flags || !(flags[0] & LE_AD_LIMITED)) 8804 return; 8805 } 8806 } 8807 8808 /* Make sure that the buffer is big enough. The 5 extra bytes 8809 * are for the potential CoD field. 8810 */ 8811 if (sizeof(*ev) + eir_len + scan_rsp_len + 5 > sizeof(buf)) 8812 return; 8813 8814 memset(buf, 0, sizeof(buf)); 8815 8816 /* In case of device discovery with BR/EDR devices (pre 1.2), the 8817 * RSSI value was reported as 0 when not available. This behavior 8818 * is kept when using device discovery. This is required for full 8819 * backwards compatibility with the API. 8820 * 8821 * However when using service discovery, the value 127 will be 8822 * returned when the RSSI is not available. 8823 */ 8824 if (rssi == HCI_RSSI_INVALID && !hdev->discovery.report_invalid_rssi && 8825 link_type == ACL_LINK) 8826 rssi = 0; 8827 8828 bacpy(&ev->addr.bdaddr, bdaddr); 8829 ev->addr.type = link_to_bdaddr(link_type, addr_type); 8830 ev->rssi = rssi; 8831 ev->flags = cpu_to_le32(flags); 8832 8833 if (eir_len > 0) 8834 /* Copy EIR or advertising data into event */ 8835 memcpy(ev->eir, eir, eir_len); 8836 8837 if (dev_class && !eir_get_data(ev->eir, eir_len, EIR_CLASS_OF_DEV, 8838 NULL)) 8839 eir_len = eir_append_data(ev->eir, eir_len, EIR_CLASS_OF_DEV, 8840 dev_class, 3); 8841 8842 if (scan_rsp_len > 0) 8843 /* Append scan response data to event */ 8844 memcpy(ev->eir + eir_len, scan_rsp, scan_rsp_len); 8845 8846 ev->eir_len = cpu_to_le16(eir_len + scan_rsp_len); 8847 ev_size = sizeof(*ev) + eir_len + scan_rsp_len; 8848 8849 mgmt_event(MGMT_EV_DEVICE_FOUND, hdev, ev, ev_size, NULL); 8850 } 8851 8852 void mgmt_remote_name(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type, 8853 u8 addr_type, s8 rssi, u8 *name, u8 name_len) 8854 { 8855 struct mgmt_ev_device_found *ev; 8856 char buf[sizeof(*ev) + HCI_MAX_NAME_LENGTH + 2]; 8857 u16 eir_len; 8858 8859 ev = (struct mgmt_ev_device_found *) buf; 8860 8861 memset(buf, 0, sizeof(buf)); 8862 8863 bacpy(&ev->addr.bdaddr, bdaddr); 8864 ev->addr.type = link_to_bdaddr(link_type, addr_type); 8865 ev->rssi = rssi; 8866 8867 eir_len = eir_append_data(ev->eir, 0, EIR_NAME_COMPLETE, name, 8868 name_len); 8869 8870 ev->eir_len = cpu_to_le16(eir_len); 8871 8872 mgmt_event(MGMT_EV_DEVICE_FOUND, hdev, ev, sizeof(*ev) + eir_len, NULL); 8873 } 8874 8875 void mgmt_discovering(struct hci_dev *hdev, u8 discovering) 8876 { 8877 struct mgmt_ev_discovering ev; 8878 8879 bt_dev_dbg(hdev, "discovering %u", discovering); 8880 8881 memset(&ev, 0, sizeof(ev)); 8882 ev.type = hdev->discovery.type; 8883 ev.discovering = discovering; 8884 8885 mgmt_event(MGMT_EV_DISCOVERING, hdev, &ev, sizeof(ev), NULL); 8886 } 8887 8888 void mgmt_suspending(struct hci_dev *hdev, u8 state) 8889 { 8890 struct mgmt_ev_controller_suspend ev; 8891 8892 ev.suspend_state = state; 8893 mgmt_event(MGMT_EV_CONTROLLER_SUSPEND, hdev, &ev, sizeof(ev), NULL); 8894 } 8895 8896 void mgmt_resuming(struct hci_dev *hdev, u8 reason, bdaddr_t *bdaddr, 8897 u8 addr_type) 8898 { 8899 struct mgmt_ev_controller_resume ev; 8900 8901 ev.wake_reason = reason; 8902 if (bdaddr) { 8903 bacpy(&ev.addr.bdaddr, bdaddr); 8904 ev.addr.type = addr_type; 8905 } else { 8906 memset(&ev.addr, 0, sizeof(ev.addr)); 8907 } 8908 8909 mgmt_event(MGMT_EV_CONTROLLER_RESUME, hdev, &ev, sizeof(ev), NULL); 8910 } 8911 8912 static struct hci_mgmt_chan chan = { 8913 .channel = HCI_CHANNEL_CONTROL, 8914 .handler_count = ARRAY_SIZE(mgmt_handlers), 8915 .handlers = mgmt_handlers, 8916 .hdev_init = mgmt_init_hdev, 8917 }; 8918 8919 int mgmt_init(void) 8920 { 8921 return hci_mgmt_chan_register(&chan); 8922 } 8923 8924 void mgmt_exit(void) 8925 { 8926 hci_mgmt_chan_unregister(&chan); 8927 } 8928