1 /* 2 BlueZ - Bluetooth protocol stack for Linux 3 4 Copyright (C) 2010 Nokia Corporation 5 Copyright (C) 2011-2012 Intel Corporation 6 7 This program is free software; you can redistribute it and/or modify 8 it under the terms of the GNU General Public License version 2 as 9 published by the Free Software Foundation; 10 11 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS 12 OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 13 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS. 14 IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY 15 CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES 16 WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN 17 ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF 18 OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. 19 20 ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS, 21 COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS 22 SOFTWARE IS DISCLAIMED. 23 */ 24 25 /* Bluetooth HCI Management interface */ 26 27 #include <linux/module.h> 28 #include <asm/unaligned.h> 29 30 #include <net/bluetooth/bluetooth.h> 31 #include <net/bluetooth/hci_core.h> 32 #include <net/bluetooth/hci_sock.h> 33 #include <net/bluetooth/l2cap.h> 34 #include <net/bluetooth/mgmt.h> 35 36 #include "hci_request.h" 37 #include "smp.h" 38 #include "mgmt_util.h" 39 #include "mgmt_config.h" 40 #include "msft.h" 41 #include "eir.h" 42 #include "aosp.h" 43 44 #define MGMT_VERSION 1 45 #define MGMT_REVISION 22 46 47 static const u16 mgmt_commands[] = { 48 MGMT_OP_READ_INDEX_LIST, 49 MGMT_OP_READ_INFO, 50 MGMT_OP_SET_POWERED, 51 MGMT_OP_SET_DISCOVERABLE, 52 MGMT_OP_SET_CONNECTABLE, 53 MGMT_OP_SET_FAST_CONNECTABLE, 54 MGMT_OP_SET_BONDABLE, 55 MGMT_OP_SET_LINK_SECURITY, 56 MGMT_OP_SET_SSP, 57 MGMT_OP_SET_HS, 58 MGMT_OP_SET_LE, 59 MGMT_OP_SET_DEV_CLASS, 60 MGMT_OP_SET_LOCAL_NAME, 61 MGMT_OP_ADD_UUID, 62 MGMT_OP_REMOVE_UUID, 63 MGMT_OP_LOAD_LINK_KEYS, 64 MGMT_OP_LOAD_LONG_TERM_KEYS, 65 MGMT_OP_DISCONNECT, 66 MGMT_OP_GET_CONNECTIONS, 67 MGMT_OP_PIN_CODE_REPLY, 68 MGMT_OP_PIN_CODE_NEG_REPLY, 69 MGMT_OP_SET_IO_CAPABILITY, 70 MGMT_OP_PAIR_DEVICE, 71 MGMT_OP_CANCEL_PAIR_DEVICE, 72 MGMT_OP_UNPAIR_DEVICE, 73 MGMT_OP_USER_CONFIRM_REPLY, 74 MGMT_OP_USER_CONFIRM_NEG_REPLY, 75 MGMT_OP_USER_PASSKEY_REPLY, 76 MGMT_OP_USER_PASSKEY_NEG_REPLY, 77 MGMT_OP_READ_LOCAL_OOB_DATA, 78 MGMT_OP_ADD_REMOTE_OOB_DATA, 79 MGMT_OP_REMOVE_REMOTE_OOB_DATA, 80 MGMT_OP_START_DISCOVERY, 81 MGMT_OP_STOP_DISCOVERY, 82 MGMT_OP_CONFIRM_NAME, 83 MGMT_OP_BLOCK_DEVICE, 84 MGMT_OP_UNBLOCK_DEVICE, 85 MGMT_OP_SET_DEVICE_ID, 86 MGMT_OP_SET_ADVERTISING, 87 MGMT_OP_SET_BREDR, 88 MGMT_OP_SET_STATIC_ADDRESS, 89 MGMT_OP_SET_SCAN_PARAMS, 90 MGMT_OP_SET_SECURE_CONN, 91 MGMT_OP_SET_DEBUG_KEYS, 92 MGMT_OP_SET_PRIVACY, 93 MGMT_OP_LOAD_IRKS, 94 MGMT_OP_GET_CONN_INFO, 95 MGMT_OP_GET_CLOCK_INFO, 96 MGMT_OP_ADD_DEVICE, 97 MGMT_OP_REMOVE_DEVICE, 98 MGMT_OP_LOAD_CONN_PARAM, 99 MGMT_OP_READ_UNCONF_INDEX_LIST, 100 MGMT_OP_READ_CONFIG_INFO, 101 MGMT_OP_SET_EXTERNAL_CONFIG, 102 MGMT_OP_SET_PUBLIC_ADDRESS, 103 MGMT_OP_START_SERVICE_DISCOVERY, 104 MGMT_OP_READ_LOCAL_OOB_EXT_DATA, 105 MGMT_OP_READ_EXT_INDEX_LIST, 106 MGMT_OP_READ_ADV_FEATURES, 107 MGMT_OP_ADD_ADVERTISING, 108 MGMT_OP_REMOVE_ADVERTISING, 109 MGMT_OP_GET_ADV_SIZE_INFO, 110 MGMT_OP_START_LIMITED_DISCOVERY, 111 MGMT_OP_READ_EXT_INFO, 112 MGMT_OP_SET_APPEARANCE, 113 MGMT_OP_GET_PHY_CONFIGURATION, 114 MGMT_OP_SET_PHY_CONFIGURATION, 115 MGMT_OP_SET_BLOCKED_KEYS, 116 MGMT_OP_SET_WIDEBAND_SPEECH, 117 MGMT_OP_READ_CONTROLLER_CAP, 118 MGMT_OP_READ_EXP_FEATURES_INFO, 119 MGMT_OP_SET_EXP_FEATURE, 120 MGMT_OP_READ_DEF_SYSTEM_CONFIG, 121 MGMT_OP_SET_DEF_SYSTEM_CONFIG, 122 MGMT_OP_READ_DEF_RUNTIME_CONFIG, 123 MGMT_OP_SET_DEF_RUNTIME_CONFIG, 124 MGMT_OP_GET_DEVICE_FLAGS, 125 MGMT_OP_SET_DEVICE_FLAGS, 126 MGMT_OP_READ_ADV_MONITOR_FEATURES, 127 MGMT_OP_ADD_ADV_PATTERNS_MONITOR, 128 MGMT_OP_REMOVE_ADV_MONITOR, 129 MGMT_OP_ADD_EXT_ADV_PARAMS, 130 MGMT_OP_ADD_EXT_ADV_DATA, 131 MGMT_OP_ADD_ADV_PATTERNS_MONITOR_RSSI, 132 }; 133 134 static const u16 mgmt_events[] = { 135 MGMT_EV_CONTROLLER_ERROR, 136 MGMT_EV_INDEX_ADDED, 137 MGMT_EV_INDEX_REMOVED, 138 MGMT_EV_NEW_SETTINGS, 139 MGMT_EV_CLASS_OF_DEV_CHANGED, 140 MGMT_EV_LOCAL_NAME_CHANGED, 141 MGMT_EV_NEW_LINK_KEY, 142 MGMT_EV_NEW_LONG_TERM_KEY, 143 MGMT_EV_DEVICE_CONNECTED, 144 MGMT_EV_DEVICE_DISCONNECTED, 145 MGMT_EV_CONNECT_FAILED, 146 MGMT_EV_PIN_CODE_REQUEST, 147 MGMT_EV_USER_CONFIRM_REQUEST, 148 MGMT_EV_USER_PASSKEY_REQUEST, 149 MGMT_EV_AUTH_FAILED, 150 MGMT_EV_DEVICE_FOUND, 151 MGMT_EV_DISCOVERING, 152 MGMT_EV_DEVICE_BLOCKED, 153 MGMT_EV_DEVICE_UNBLOCKED, 154 MGMT_EV_DEVICE_UNPAIRED, 155 MGMT_EV_PASSKEY_NOTIFY, 156 MGMT_EV_NEW_IRK, 157 MGMT_EV_NEW_CSRK, 158 MGMT_EV_DEVICE_ADDED, 159 MGMT_EV_DEVICE_REMOVED, 160 MGMT_EV_NEW_CONN_PARAM, 161 MGMT_EV_UNCONF_INDEX_ADDED, 162 MGMT_EV_UNCONF_INDEX_REMOVED, 163 MGMT_EV_NEW_CONFIG_OPTIONS, 164 MGMT_EV_EXT_INDEX_ADDED, 165 MGMT_EV_EXT_INDEX_REMOVED, 166 MGMT_EV_LOCAL_OOB_DATA_UPDATED, 167 MGMT_EV_ADVERTISING_ADDED, 168 MGMT_EV_ADVERTISING_REMOVED, 169 MGMT_EV_EXT_INFO_CHANGED, 170 MGMT_EV_PHY_CONFIGURATION_CHANGED, 171 MGMT_EV_EXP_FEATURE_CHANGED, 172 MGMT_EV_DEVICE_FLAGS_CHANGED, 173 MGMT_EV_ADV_MONITOR_ADDED, 174 MGMT_EV_ADV_MONITOR_REMOVED, 175 MGMT_EV_CONTROLLER_SUSPEND, 176 MGMT_EV_CONTROLLER_RESUME, 177 MGMT_EV_ADV_MONITOR_DEVICE_FOUND, 178 MGMT_EV_ADV_MONITOR_DEVICE_LOST, 179 }; 180 181 static const u16 mgmt_untrusted_commands[] = { 182 MGMT_OP_READ_INDEX_LIST, 183 MGMT_OP_READ_INFO, 184 MGMT_OP_READ_UNCONF_INDEX_LIST, 185 MGMT_OP_READ_CONFIG_INFO, 186 MGMT_OP_READ_EXT_INDEX_LIST, 187 MGMT_OP_READ_EXT_INFO, 188 MGMT_OP_READ_CONTROLLER_CAP, 189 MGMT_OP_READ_EXP_FEATURES_INFO, 190 MGMT_OP_READ_DEF_SYSTEM_CONFIG, 191 MGMT_OP_READ_DEF_RUNTIME_CONFIG, 192 }; 193 194 static const u16 mgmt_untrusted_events[] = { 195 MGMT_EV_INDEX_ADDED, 196 MGMT_EV_INDEX_REMOVED, 197 MGMT_EV_NEW_SETTINGS, 198 MGMT_EV_CLASS_OF_DEV_CHANGED, 199 MGMT_EV_LOCAL_NAME_CHANGED, 200 MGMT_EV_UNCONF_INDEX_ADDED, 201 MGMT_EV_UNCONF_INDEX_REMOVED, 202 MGMT_EV_NEW_CONFIG_OPTIONS, 203 MGMT_EV_EXT_INDEX_ADDED, 204 MGMT_EV_EXT_INDEX_REMOVED, 205 MGMT_EV_EXT_INFO_CHANGED, 206 MGMT_EV_EXP_FEATURE_CHANGED, 207 }; 208 209 #define CACHE_TIMEOUT msecs_to_jiffies(2 * 1000) 210 211 #define ZERO_KEY "\x00\x00\x00\x00\x00\x00\x00\x00" \ 212 "\x00\x00\x00\x00\x00\x00\x00\x00" 213 214 /* HCI to MGMT error code conversion table */ 215 static const u8 mgmt_status_table[] = { 216 MGMT_STATUS_SUCCESS, 217 MGMT_STATUS_UNKNOWN_COMMAND, /* Unknown Command */ 218 MGMT_STATUS_NOT_CONNECTED, /* No Connection */ 219 MGMT_STATUS_FAILED, /* Hardware Failure */ 220 MGMT_STATUS_CONNECT_FAILED, /* Page Timeout */ 221 MGMT_STATUS_AUTH_FAILED, /* Authentication Failed */ 222 MGMT_STATUS_AUTH_FAILED, /* PIN or Key Missing */ 223 MGMT_STATUS_NO_RESOURCES, /* Memory Full */ 224 MGMT_STATUS_TIMEOUT, /* Connection Timeout */ 225 MGMT_STATUS_NO_RESOURCES, /* Max Number of Connections */ 226 MGMT_STATUS_NO_RESOURCES, /* Max Number of SCO Connections */ 227 MGMT_STATUS_ALREADY_CONNECTED, /* ACL Connection Exists */ 228 MGMT_STATUS_BUSY, /* Command Disallowed */ 229 MGMT_STATUS_NO_RESOURCES, /* Rejected Limited Resources */ 230 MGMT_STATUS_REJECTED, /* Rejected Security */ 231 MGMT_STATUS_REJECTED, /* Rejected Personal */ 232 MGMT_STATUS_TIMEOUT, /* Host Timeout */ 233 MGMT_STATUS_NOT_SUPPORTED, /* Unsupported Feature */ 234 MGMT_STATUS_INVALID_PARAMS, /* Invalid Parameters */ 235 MGMT_STATUS_DISCONNECTED, /* OE User Ended Connection */ 236 MGMT_STATUS_NO_RESOURCES, /* OE Low Resources */ 237 MGMT_STATUS_DISCONNECTED, /* OE Power Off */ 238 MGMT_STATUS_DISCONNECTED, /* Connection Terminated */ 239 MGMT_STATUS_BUSY, /* Repeated Attempts */ 240 MGMT_STATUS_REJECTED, /* Pairing Not Allowed */ 241 MGMT_STATUS_FAILED, /* Unknown LMP PDU */ 242 MGMT_STATUS_NOT_SUPPORTED, /* Unsupported Remote Feature */ 243 MGMT_STATUS_REJECTED, /* SCO Offset Rejected */ 244 MGMT_STATUS_REJECTED, /* SCO Interval Rejected */ 245 MGMT_STATUS_REJECTED, /* Air Mode Rejected */ 246 MGMT_STATUS_INVALID_PARAMS, /* Invalid LMP Parameters */ 247 MGMT_STATUS_FAILED, /* Unspecified Error */ 248 MGMT_STATUS_NOT_SUPPORTED, /* Unsupported LMP Parameter Value */ 249 MGMT_STATUS_FAILED, /* Role Change Not Allowed */ 250 MGMT_STATUS_TIMEOUT, /* LMP Response Timeout */ 251 MGMT_STATUS_FAILED, /* LMP Error Transaction Collision */ 252 MGMT_STATUS_FAILED, /* LMP PDU Not Allowed */ 253 MGMT_STATUS_REJECTED, /* Encryption Mode Not Accepted */ 254 MGMT_STATUS_FAILED, /* Unit Link Key Used */ 255 MGMT_STATUS_NOT_SUPPORTED, /* QoS Not Supported */ 256 MGMT_STATUS_TIMEOUT, /* Instant Passed */ 257 MGMT_STATUS_NOT_SUPPORTED, /* Pairing Not Supported */ 258 MGMT_STATUS_FAILED, /* Transaction Collision */ 259 MGMT_STATUS_FAILED, /* Reserved for future use */ 260 MGMT_STATUS_INVALID_PARAMS, /* Unacceptable Parameter */ 261 MGMT_STATUS_REJECTED, /* QoS Rejected */ 262 MGMT_STATUS_NOT_SUPPORTED, /* Classification Not Supported */ 263 MGMT_STATUS_REJECTED, /* Insufficient Security */ 264 MGMT_STATUS_INVALID_PARAMS, /* Parameter Out Of Range */ 265 MGMT_STATUS_FAILED, /* Reserved for future use */ 266 MGMT_STATUS_BUSY, /* Role Switch Pending */ 267 MGMT_STATUS_FAILED, /* Reserved for future use */ 268 MGMT_STATUS_FAILED, /* Slot Violation */ 269 MGMT_STATUS_FAILED, /* Role Switch Failed */ 270 MGMT_STATUS_INVALID_PARAMS, /* EIR Too Large */ 271 MGMT_STATUS_NOT_SUPPORTED, /* Simple Pairing Not Supported */ 272 MGMT_STATUS_BUSY, /* Host Busy Pairing */ 273 MGMT_STATUS_REJECTED, /* Rejected, No Suitable Channel */ 274 MGMT_STATUS_BUSY, /* Controller Busy */ 275 MGMT_STATUS_INVALID_PARAMS, /* Unsuitable Connection Interval */ 276 MGMT_STATUS_TIMEOUT, /* Directed Advertising Timeout */ 277 MGMT_STATUS_AUTH_FAILED, /* Terminated Due to MIC Failure */ 278 MGMT_STATUS_CONNECT_FAILED, /* Connection Establishment Failed */ 279 MGMT_STATUS_CONNECT_FAILED, /* MAC Connection Failed */ 280 }; 281 282 static u8 mgmt_errno_status(int err) 283 { 284 switch (err) { 285 case 0: 286 return MGMT_STATUS_SUCCESS; 287 case -EPERM: 288 return MGMT_STATUS_REJECTED; 289 case -EINVAL: 290 return MGMT_STATUS_INVALID_PARAMS; 291 case -EOPNOTSUPP: 292 return MGMT_STATUS_NOT_SUPPORTED; 293 case -EBUSY: 294 return MGMT_STATUS_BUSY; 295 case -ETIMEDOUT: 296 return MGMT_STATUS_AUTH_FAILED; 297 case -ENOMEM: 298 return MGMT_STATUS_NO_RESOURCES; 299 case -EISCONN: 300 return MGMT_STATUS_ALREADY_CONNECTED; 301 case -ENOTCONN: 302 return MGMT_STATUS_DISCONNECTED; 303 } 304 305 return MGMT_STATUS_FAILED; 306 } 307 308 static u8 mgmt_status(int err) 309 { 310 if (err < 0) 311 return mgmt_errno_status(err); 312 313 if (err < ARRAY_SIZE(mgmt_status_table)) 314 return mgmt_status_table[err]; 315 316 return MGMT_STATUS_FAILED; 317 } 318 319 static int mgmt_index_event(u16 event, struct hci_dev *hdev, void *data, 320 u16 len, int flag) 321 { 322 return mgmt_send_event(event, hdev, HCI_CHANNEL_CONTROL, data, len, 323 flag, NULL); 324 } 325 326 static int mgmt_limited_event(u16 event, struct hci_dev *hdev, void *data, 327 u16 len, int flag, struct sock *skip_sk) 328 { 329 return mgmt_send_event(event, hdev, HCI_CHANNEL_CONTROL, data, len, 330 flag, skip_sk); 331 } 332 333 static int mgmt_event(u16 event, struct hci_dev *hdev, void *data, u16 len, 334 struct sock *skip_sk) 335 { 336 return mgmt_send_event(event, hdev, HCI_CHANNEL_CONTROL, data, len, 337 HCI_SOCK_TRUSTED, skip_sk); 338 } 339 340 static int mgmt_event_skb(struct sk_buff *skb, struct sock *skip_sk) 341 { 342 return mgmt_send_event_skb(HCI_CHANNEL_CONTROL, skb, HCI_SOCK_TRUSTED, 343 skip_sk); 344 } 345 346 static u8 le_addr_type(u8 mgmt_addr_type) 347 { 348 if (mgmt_addr_type == BDADDR_LE_PUBLIC) 349 return ADDR_LE_DEV_PUBLIC; 350 else 351 return ADDR_LE_DEV_RANDOM; 352 } 353 354 void mgmt_fill_version_info(void *ver) 355 { 356 struct mgmt_rp_read_version *rp = ver; 357 358 rp->version = MGMT_VERSION; 359 rp->revision = cpu_to_le16(MGMT_REVISION); 360 } 361 362 static int read_version(struct sock *sk, struct hci_dev *hdev, void *data, 363 u16 data_len) 364 { 365 struct mgmt_rp_read_version rp; 366 367 bt_dev_dbg(hdev, "sock %p", sk); 368 369 mgmt_fill_version_info(&rp); 370 371 return mgmt_cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_VERSION, 0, 372 &rp, sizeof(rp)); 373 } 374 375 static int read_commands(struct sock *sk, struct hci_dev *hdev, void *data, 376 u16 data_len) 377 { 378 struct mgmt_rp_read_commands *rp; 379 u16 num_commands, num_events; 380 size_t rp_size; 381 int i, err; 382 383 bt_dev_dbg(hdev, "sock %p", sk); 384 385 if (hci_sock_test_flag(sk, HCI_SOCK_TRUSTED)) { 386 num_commands = ARRAY_SIZE(mgmt_commands); 387 num_events = ARRAY_SIZE(mgmt_events); 388 } else { 389 num_commands = ARRAY_SIZE(mgmt_untrusted_commands); 390 num_events = ARRAY_SIZE(mgmt_untrusted_events); 391 } 392 393 rp_size = sizeof(*rp) + ((num_commands + num_events) * sizeof(u16)); 394 395 rp = kmalloc(rp_size, GFP_KERNEL); 396 if (!rp) 397 return -ENOMEM; 398 399 rp->num_commands = cpu_to_le16(num_commands); 400 rp->num_events = cpu_to_le16(num_events); 401 402 if (hci_sock_test_flag(sk, HCI_SOCK_TRUSTED)) { 403 __le16 *opcode = rp->opcodes; 404 405 for (i = 0; i < num_commands; i++, opcode++) 406 put_unaligned_le16(mgmt_commands[i], opcode); 407 408 for (i = 0; i < num_events; i++, opcode++) 409 put_unaligned_le16(mgmt_events[i], opcode); 410 } else { 411 __le16 *opcode = rp->opcodes; 412 413 for (i = 0; i < num_commands; i++, opcode++) 414 put_unaligned_le16(mgmt_untrusted_commands[i], opcode); 415 416 for (i = 0; i < num_events; i++, opcode++) 417 put_unaligned_le16(mgmt_untrusted_events[i], opcode); 418 } 419 420 err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_COMMANDS, 0, 421 rp, rp_size); 422 kfree(rp); 423 424 return err; 425 } 426 427 static int read_index_list(struct sock *sk, struct hci_dev *hdev, void *data, 428 u16 data_len) 429 { 430 struct mgmt_rp_read_index_list *rp; 431 struct hci_dev *d; 432 size_t rp_len; 433 u16 count; 434 int err; 435 436 bt_dev_dbg(hdev, "sock %p", sk); 437 438 read_lock(&hci_dev_list_lock); 439 440 count = 0; 441 list_for_each_entry(d, &hci_dev_list, list) { 442 if (d->dev_type == HCI_PRIMARY && 443 !hci_dev_test_flag(d, HCI_UNCONFIGURED)) 444 count++; 445 } 446 447 rp_len = sizeof(*rp) + (2 * count); 448 rp = kmalloc(rp_len, GFP_ATOMIC); 449 if (!rp) { 450 read_unlock(&hci_dev_list_lock); 451 return -ENOMEM; 452 } 453 454 count = 0; 455 list_for_each_entry(d, &hci_dev_list, list) { 456 if (hci_dev_test_flag(d, HCI_SETUP) || 457 hci_dev_test_flag(d, HCI_CONFIG) || 458 hci_dev_test_flag(d, HCI_USER_CHANNEL)) 459 continue; 460 461 /* Devices marked as raw-only are neither configured 462 * nor unconfigured controllers. 463 */ 464 if (test_bit(HCI_QUIRK_RAW_DEVICE, &d->quirks)) 465 continue; 466 467 if (d->dev_type == HCI_PRIMARY && 468 !hci_dev_test_flag(d, HCI_UNCONFIGURED)) { 469 rp->index[count++] = cpu_to_le16(d->id); 470 bt_dev_dbg(hdev, "Added hci%u", d->id); 471 } 472 } 473 474 rp->num_controllers = cpu_to_le16(count); 475 rp_len = sizeof(*rp) + (2 * count); 476 477 read_unlock(&hci_dev_list_lock); 478 479 err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_INDEX_LIST, 480 0, rp, rp_len); 481 482 kfree(rp); 483 484 return err; 485 } 486 487 static int read_unconf_index_list(struct sock *sk, struct hci_dev *hdev, 488 void *data, u16 data_len) 489 { 490 struct mgmt_rp_read_unconf_index_list *rp; 491 struct hci_dev *d; 492 size_t rp_len; 493 u16 count; 494 int err; 495 496 bt_dev_dbg(hdev, "sock %p", sk); 497 498 read_lock(&hci_dev_list_lock); 499 500 count = 0; 501 list_for_each_entry(d, &hci_dev_list, list) { 502 if (d->dev_type == HCI_PRIMARY && 503 hci_dev_test_flag(d, HCI_UNCONFIGURED)) 504 count++; 505 } 506 507 rp_len = sizeof(*rp) + (2 * count); 508 rp = kmalloc(rp_len, GFP_ATOMIC); 509 if (!rp) { 510 read_unlock(&hci_dev_list_lock); 511 return -ENOMEM; 512 } 513 514 count = 0; 515 list_for_each_entry(d, &hci_dev_list, list) { 516 if (hci_dev_test_flag(d, HCI_SETUP) || 517 hci_dev_test_flag(d, HCI_CONFIG) || 518 hci_dev_test_flag(d, HCI_USER_CHANNEL)) 519 continue; 520 521 /* Devices marked as raw-only are neither configured 522 * nor unconfigured controllers. 523 */ 524 if (test_bit(HCI_QUIRK_RAW_DEVICE, &d->quirks)) 525 continue; 526 527 if (d->dev_type == HCI_PRIMARY && 528 hci_dev_test_flag(d, HCI_UNCONFIGURED)) { 529 rp->index[count++] = cpu_to_le16(d->id); 530 bt_dev_dbg(hdev, "Added hci%u", d->id); 531 } 532 } 533 534 rp->num_controllers = cpu_to_le16(count); 535 rp_len = sizeof(*rp) + (2 * count); 536 537 read_unlock(&hci_dev_list_lock); 538 539 err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE, 540 MGMT_OP_READ_UNCONF_INDEX_LIST, 0, rp, rp_len); 541 542 kfree(rp); 543 544 return err; 545 } 546 547 static int read_ext_index_list(struct sock *sk, struct hci_dev *hdev, 548 void *data, u16 data_len) 549 { 550 struct mgmt_rp_read_ext_index_list *rp; 551 struct hci_dev *d; 552 u16 count; 553 int err; 554 555 bt_dev_dbg(hdev, "sock %p", sk); 556 557 read_lock(&hci_dev_list_lock); 558 559 count = 0; 560 list_for_each_entry(d, &hci_dev_list, list) { 561 if (d->dev_type == HCI_PRIMARY || d->dev_type == HCI_AMP) 562 count++; 563 } 564 565 rp = kmalloc(struct_size(rp, entry, count), GFP_ATOMIC); 566 if (!rp) { 567 read_unlock(&hci_dev_list_lock); 568 return -ENOMEM; 569 } 570 571 count = 0; 572 list_for_each_entry(d, &hci_dev_list, list) { 573 if (hci_dev_test_flag(d, HCI_SETUP) || 574 hci_dev_test_flag(d, HCI_CONFIG) || 575 hci_dev_test_flag(d, HCI_USER_CHANNEL)) 576 continue; 577 578 /* Devices marked as raw-only are neither configured 579 * nor unconfigured controllers. 580 */ 581 if (test_bit(HCI_QUIRK_RAW_DEVICE, &d->quirks)) 582 continue; 583 584 if (d->dev_type == HCI_PRIMARY) { 585 if (hci_dev_test_flag(d, HCI_UNCONFIGURED)) 586 rp->entry[count].type = 0x01; 587 else 588 rp->entry[count].type = 0x00; 589 } else if (d->dev_type == HCI_AMP) { 590 rp->entry[count].type = 0x02; 591 } else { 592 continue; 593 } 594 595 rp->entry[count].bus = d->bus; 596 rp->entry[count++].index = cpu_to_le16(d->id); 597 bt_dev_dbg(hdev, "Added hci%u", d->id); 598 } 599 600 rp->num_controllers = cpu_to_le16(count); 601 602 read_unlock(&hci_dev_list_lock); 603 604 /* If this command is called at least once, then all the 605 * default index and unconfigured index events are disabled 606 * and from now on only extended index events are used. 607 */ 608 hci_sock_set_flag(sk, HCI_MGMT_EXT_INDEX_EVENTS); 609 hci_sock_clear_flag(sk, HCI_MGMT_INDEX_EVENTS); 610 hci_sock_clear_flag(sk, HCI_MGMT_UNCONF_INDEX_EVENTS); 611 612 err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE, 613 MGMT_OP_READ_EXT_INDEX_LIST, 0, rp, 614 struct_size(rp, entry, count)); 615 616 kfree(rp); 617 618 return err; 619 } 620 621 static bool is_configured(struct hci_dev *hdev) 622 { 623 if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks) && 624 !hci_dev_test_flag(hdev, HCI_EXT_CONFIGURED)) 625 return false; 626 627 if ((test_bit(HCI_QUIRK_INVALID_BDADDR, &hdev->quirks) || 628 test_bit(HCI_QUIRK_USE_BDADDR_PROPERTY, &hdev->quirks)) && 629 !bacmp(&hdev->public_addr, BDADDR_ANY)) 630 return false; 631 632 return true; 633 } 634 635 static __le32 get_missing_options(struct hci_dev *hdev) 636 { 637 u32 options = 0; 638 639 if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks) && 640 !hci_dev_test_flag(hdev, HCI_EXT_CONFIGURED)) 641 options |= MGMT_OPTION_EXTERNAL_CONFIG; 642 643 if ((test_bit(HCI_QUIRK_INVALID_BDADDR, &hdev->quirks) || 644 test_bit(HCI_QUIRK_USE_BDADDR_PROPERTY, &hdev->quirks)) && 645 !bacmp(&hdev->public_addr, BDADDR_ANY)) 646 options |= MGMT_OPTION_PUBLIC_ADDRESS; 647 648 return cpu_to_le32(options); 649 } 650 651 static int new_options(struct hci_dev *hdev, struct sock *skip) 652 { 653 __le32 options = get_missing_options(hdev); 654 655 return mgmt_limited_event(MGMT_EV_NEW_CONFIG_OPTIONS, hdev, &options, 656 sizeof(options), HCI_MGMT_OPTION_EVENTS, skip); 657 } 658 659 static int send_options_rsp(struct sock *sk, u16 opcode, struct hci_dev *hdev) 660 { 661 __le32 options = get_missing_options(hdev); 662 663 return mgmt_cmd_complete(sk, hdev->id, opcode, 0, &options, 664 sizeof(options)); 665 } 666 667 static int read_config_info(struct sock *sk, struct hci_dev *hdev, 668 void *data, u16 data_len) 669 { 670 struct mgmt_rp_read_config_info rp; 671 u32 options = 0; 672 673 bt_dev_dbg(hdev, "sock %p", sk); 674 675 hci_dev_lock(hdev); 676 677 memset(&rp, 0, sizeof(rp)); 678 rp.manufacturer = cpu_to_le16(hdev->manufacturer); 679 680 if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks)) 681 options |= MGMT_OPTION_EXTERNAL_CONFIG; 682 683 if (hdev->set_bdaddr) 684 options |= MGMT_OPTION_PUBLIC_ADDRESS; 685 686 rp.supported_options = cpu_to_le32(options); 687 rp.missing_options = get_missing_options(hdev); 688 689 hci_dev_unlock(hdev); 690 691 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_CONFIG_INFO, 0, 692 &rp, sizeof(rp)); 693 } 694 695 static u32 get_supported_phys(struct hci_dev *hdev) 696 { 697 u32 supported_phys = 0; 698 699 if (lmp_bredr_capable(hdev)) { 700 supported_phys |= MGMT_PHY_BR_1M_1SLOT; 701 702 if (hdev->features[0][0] & LMP_3SLOT) 703 supported_phys |= MGMT_PHY_BR_1M_3SLOT; 704 705 if (hdev->features[0][0] & LMP_5SLOT) 706 supported_phys |= MGMT_PHY_BR_1M_5SLOT; 707 708 if (lmp_edr_2m_capable(hdev)) { 709 supported_phys |= MGMT_PHY_EDR_2M_1SLOT; 710 711 if (lmp_edr_3slot_capable(hdev)) 712 supported_phys |= MGMT_PHY_EDR_2M_3SLOT; 713 714 if (lmp_edr_5slot_capable(hdev)) 715 supported_phys |= MGMT_PHY_EDR_2M_5SLOT; 716 717 if (lmp_edr_3m_capable(hdev)) { 718 supported_phys |= MGMT_PHY_EDR_3M_1SLOT; 719 720 if (lmp_edr_3slot_capable(hdev)) 721 supported_phys |= MGMT_PHY_EDR_3M_3SLOT; 722 723 if (lmp_edr_5slot_capable(hdev)) 724 supported_phys |= MGMT_PHY_EDR_3M_5SLOT; 725 } 726 } 727 } 728 729 if (lmp_le_capable(hdev)) { 730 supported_phys |= MGMT_PHY_LE_1M_TX; 731 supported_phys |= MGMT_PHY_LE_1M_RX; 732 733 if (hdev->le_features[1] & HCI_LE_PHY_2M) { 734 supported_phys |= MGMT_PHY_LE_2M_TX; 735 supported_phys |= MGMT_PHY_LE_2M_RX; 736 } 737 738 if (hdev->le_features[1] & HCI_LE_PHY_CODED) { 739 supported_phys |= MGMT_PHY_LE_CODED_TX; 740 supported_phys |= MGMT_PHY_LE_CODED_RX; 741 } 742 } 743 744 return supported_phys; 745 } 746 747 static u32 get_selected_phys(struct hci_dev *hdev) 748 { 749 u32 selected_phys = 0; 750 751 if (lmp_bredr_capable(hdev)) { 752 selected_phys |= MGMT_PHY_BR_1M_1SLOT; 753 754 if (hdev->pkt_type & (HCI_DM3 | HCI_DH3)) 755 selected_phys |= MGMT_PHY_BR_1M_3SLOT; 756 757 if (hdev->pkt_type & (HCI_DM5 | HCI_DH5)) 758 selected_phys |= MGMT_PHY_BR_1M_5SLOT; 759 760 if (lmp_edr_2m_capable(hdev)) { 761 if (!(hdev->pkt_type & HCI_2DH1)) 762 selected_phys |= MGMT_PHY_EDR_2M_1SLOT; 763 764 if (lmp_edr_3slot_capable(hdev) && 765 !(hdev->pkt_type & HCI_2DH3)) 766 selected_phys |= MGMT_PHY_EDR_2M_3SLOT; 767 768 if (lmp_edr_5slot_capable(hdev) && 769 !(hdev->pkt_type & HCI_2DH5)) 770 selected_phys |= MGMT_PHY_EDR_2M_5SLOT; 771 772 if (lmp_edr_3m_capable(hdev)) { 773 if (!(hdev->pkt_type & HCI_3DH1)) 774 selected_phys |= MGMT_PHY_EDR_3M_1SLOT; 775 776 if (lmp_edr_3slot_capable(hdev) && 777 !(hdev->pkt_type & HCI_3DH3)) 778 selected_phys |= MGMT_PHY_EDR_3M_3SLOT; 779 780 if (lmp_edr_5slot_capable(hdev) && 781 !(hdev->pkt_type & HCI_3DH5)) 782 selected_phys |= MGMT_PHY_EDR_3M_5SLOT; 783 } 784 } 785 } 786 787 if (lmp_le_capable(hdev)) { 788 if (hdev->le_tx_def_phys & HCI_LE_SET_PHY_1M) 789 selected_phys |= MGMT_PHY_LE_1M_TX; 790 791 if (hdev->le_rx_def_phys & HCI_LE_SET_PHY_1M) 792 selected_phys |= MGMT_PHY_LE_1M_RX; 793 794 if (hdev->le_tx_def_phys & HCI_LE_SET_PHY_2M) 795 selected_phys |= MGMT_PHY_LE_2M_TX; 796 797 if (hdev->le_rx_def_phys & HCI_LE_SET_PHY_2M) 798 selected_phys |= MGMT_PHY_LE_2M_RX; 799 800 if (hdev->le_tx_def_phys & HCI_LE_SET_PHY_CODED) 801 selected_phys |= MGMT_PHY_LE_CODED_TX; 802 803 if (hdev->le_rx_def_phys & HCI_LE_SET_PHY_CODED) 804 selected_phys |= MGMT_PHY_LE_CODED_RX; 805 } 806 807 return selected_phys; 808 } 809 810 static u32 get_configurable_phys(struct hci_dev *hdev) 811 { 812 return (get_supported_phys(hdev) & ~MGMT_PHY_BR_1M_1SLOT & 813 ~MGMT_PHY_LE_1M_TX & ~MGMT_PHY_LE_1M_RX); 814 } 815 816 static u32 get_supported_settings(struct hci_dev *hdev) 817 { 818 u32 settings = 0; 819 820 settings |= MGMT_SETTING_POWERED; 821 settings |= MGMT_SETTING_BONDABLE; 822 settings |= MGMT_SETTING_DEBUG_KEYS; 823 settings |= MGMT_SETTING_CONNECTABLE; 824 settings |= MGMT_SETTING_DISCOVERABLE; 825 826 if (lmp_bredr_capable(hdev)) { 827 if (hdev->hci_ver >= BLUETOOTH_VER_1_2) 828 settings |= MGMT_SETTING_FAST_CONNECTABLE; 829 settings |= MGMT_SETTING_BREDR; 830 settings |= MGMT_SETTING_LINK_SECURITY; 831 832 if (lmp_ssp_capable(hdev)) { 833 settings |= MGMT_SETTING_SSP; 834 if (IS_ENABLED(CONFIG_BT_HS)) 835 settings |= MGMT_SETTING_HS; 836 } 837 838 if (lmp_sc_capable(hdev)) 839 settings |= MGMT_SETTING_SECURE_CONN; 840 841 if (test_bit(HCI_QUIRK_WIDEBAND_SPEECH_SUPPORTED, 842 &hdev->quirks)) 843 settings |= MGMT_SETTING_WIDEBAND_SPEECH; 844 } 845 846 if (lmp_le_capable(hdev)) { 847 settings |= MGMT_SETTING_LE; 848 settings |= MGMT_SETTING_SECURE_CONN; 849 settings |= MGMT_SETTING_PRIVACY; 850 settings |= MGMT_SETTING_STATIC_ADDRESS; 851 settings |= MGMT_SETTING_ADVERTISING; 852 } 853 854 if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks) || 855 hdev->set_bdaddr) 856 settings |= MGMT_SETTING_CONFIGURATION; 857 858 settings |= MGMT_SETTING_PHY_CONFIGURATION; 859 860 return settings; 861 } 862 863 static u32 get_current_settings(struct hci_dev *hdev) 864 { 865 u32 settings = 0; 866 867 if (hdev_is_powered(hdev)) 868 settings |= MGMT_SETTING_POWERED; 869 870 if (hci_dev_test_flag(hdev, HCI_CONNECTABLE)) 871 settings |= MGMT_SETTING_CONNECTABLE; 872 873 if (hci_dev_test_flag(hdev, HCI_FAST_CONNECTABLE)) 874 settings |= MGMT_SETTING_FAST_CONNECTABLE; 875 876 if (hci_dev_test_flag(hdev, HCI_DISCOVERABLE)) 877 settings |= MGMT_SETTING_DISCOVERABLE; 878 879 if (hci_dev_test_flag(hdev, HCI_BONDABLE)) 880 settings |= MGMT_SETTING_BONDABLE; 881 882 if (hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) 883 settings |= MGMT_SETTING_BREDR; 884 885 if (hci_dev_test_flag(hdev, HCI_LE_ENABLED)) 886 settings |= MGMT_SETTING_LE; 887 888 if (hci_dev_test_flag(hdev, HCI_LINK_SECURITY)) 889 settings |= MGMT_SETTING_LINK_SECURITY; 890 891 if (hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) 892 settings |= MGMT_SETTING_SSP; 893 894 if (hci_dev_test_flag(hdev, HCI_HS_ENABLED)) 895 settings |= MGMT_SETTING_HS; 896 897 if (hci_dev_test_flag(hdev, HCI_ADVERTISING)) 898 settings |= MGMT_SETTING_ADVERTISING; 899 900 if (hci_dev_test_flag(hdev, HCI_SC_ENABLED)) 901 settings |= MGMT_SETTING_SECURE_CONN; 902 903 if (hci_dev_test_flag(hdev, HCI_KEEP_DEBUG_KEYS)) 904 settings |= MGMT_SETTING_DEBUG_KEYS; 905 906 if (hci_dev_test_flag(hdev, HCI_PRIVACY)) 907 settings |= MGMT_SETTING_PRIVACY; 908 909 /* The current setting for static address has two purposes. The 910 * first is to indicate if the static address will be used and 911 * the second is to indicate if it is actually set. 912 * 913 * This means if the static address is not configured, this flag 914 * will never be set. If the address is configured, then if the 915 * address is actually used decides if the flag is set or not. 916 * 917 * For single mode LE only controllers and dual-mode controllers 918 * with BR/EDR disabled, the existence of the static address will 919 * be evaluated. 920 */ 921 if (hci_dev_test_flag(hdev, HCI_FORCE_STATIC_ADDR) || 922 !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) || 923 !bacmp(&hdev->bdaddr, BDADDR_ANY)) { 924 if (bacmp(&hdev->static_addr, BDADDR_ANY)) 925 settings |= MGMT_SETTING_STATIC_ADDRESS; 926 } 927 928 if (hci_dev_test_flag(hdev, HCI_WIDEBAND_SPEECH_ENABLED)) 929 settings |= MGMT_SETTING_WIDEBAND_SPEECH; 930 931 return settings; 932 } 933 934 static struct mgmt_pending_cmd *pending_find(u16 opcode, struct hci_dev *hdev) 935 { 936 return mgmt_pending_find(HCI_CHANNEL_CONTROL, opcode, hdev); 937 } 938 939 u8 mgmt_get_adv_discov_flags(struct hci_dev *hdev) 940 { 941 struct mgmt_pending_cmd *cmd; 942 943 /* If there's a pending mgmt command the flags will not yet have 944 * their final values, so check for this first. 945 */ 946 cmd = pending_find(MGMT_OP_SET_DISCOVERABLE, hdev); 947 if (cmd) { 948 struct mgmt_mode *cp = cmd->param; 949 if (cp->val == 0x01) 950 return LE_AD_GENERAL; 951 else if (cp->val == 0x02) 952 return LE_AD_LIMITED; 953 } else { 954 if (hci_dev_test_flag(hdev, HCI_LIMITED_DISCOVERABLE)) 955 return LE_AD_LIMITED; 956 else if (hci_dev_test_flag(hdev, HCI_DISCOVERABLE)) 957 return LE_AD_GENERAL; 958 } 959 960 return 0; 961 } 962 963 bool mgmt_get_connectable(struct hci_dev *hdev) 964 { 965 struct mgmt_pending_cmd *cmd; 966 967 /* If there's a pending mgmt command the flag will not yet have 968 * it's final value, so check for this first. 969 */ 970 cmd = pending_find(MGMT_OP_SET_CONNECTABLE, hdev); 971 if (cmd) { 972 struct mgmt_mode *cp = cmd->param; 973 974 return cp->val; 975 } 976 977 return hci_dev_test_flag(hdev, HCI_CONNECTABLE); 978 } 979 980 static int service_cache_sync(struct hci_dev *hdev, void *data) 981 { 982 hci_update_eir_sync(hdev); 983 hci_update_class_sync(hdev); 984 985 return 0; 986 } 987 988 static void service_cache_off(struct work_struct *work) 989 { 990 struct hci_dev *hdev = container_of(work, struct hci_dev, 991 service_cache.work); 992 993 if (!hci_dev_test_and_clear_flag(hdev, HCI_SERVICE_CACHE)) 994 return; 995 996 hci_cmd_sync_queue(hdev, service_cache_sync, NULL, NULL); 997 } 998 999 static int rpa_expired_sync(struct hci_dev *hdev, void *data) 1000 { 1001 /* The generation of a new RPA and programming it into the 1002 * controller happens in the hci_req_enable_advertising() 1003 * function. 1004 */ 1005 if (ext_adv_capable(hdev)) 1006 return hci_start_ext_adv_sync(hdev, hdev->cur_adv_instance); 1007 else 1008 return hci_enable_advertising_sync(hdev); 1009 } 1010 1011 static void rpa_expired(struct work_struct *work) 1012 { 1013 struct hci_dev *hdev = container_of(work, struct hci_dev, 1014 rpa_expired.work); 1015 1016 bt_dev_dbg(hdev, ""); 1017 1018 hci_dev_set_flag(hdev, HCI_RPA_EXPIRED); 1019 1020 if (!hci_dev_test_flag(hdev, HCI_ADVERTISING)) 1021 return; 1022 1023 hci_cmd_sync_queue(hdev, rpa_expired_sync, NULL, NULL); 1024 } 1025 1026 static void mgmt_init_hdev(struct sock *sk, struct hci_dev *hdev) 1027 { 1028 if (hci_dev_test_and_set_flag(hdev, HCI_MGMT)) 1029 return; 1030 1031 INIT_DELAYED_WORK(&hdev->service_cache, service_cache_off); 1032 INIT_DELAYED_WORK(&hdev->rpa_expired, rpa_expired); 1033 1034 /* Non-mgmt controlled devices get this bit set 1035 * implicitly so that pairing works for them, however 1036 * for mgmt we require user-space to explicitly enable 1037 * it 1038 */ 1039 hci_dev_clear_flag(hdev, HCI_BONDABLE); 1040 } 1041 1042 static int read_controller_info(struct sock *sk, struct hci_dev *hdev, 1043 void *data, u16 data_len) 1044 { 1045 struct mgmt_rp_read_info rp; 1046 1047 bt_dev_dbg(hdev, "sock %p", sk); 1048 1049 hci_dev_lock(hdev); 1050 1051 memset(&rp, 0, sizeof(rp)); 1052 1053 bacpy(&rp.bdaddr, &hdev->bdaddr); 1054 1055 rp.version = hdev->hci_ver; 1056 rp.manufacturer = cpu_to_le16(hdev->manufacturer); 1057 1058 rp.supported_settings = cpu_to_le32(get_supported_settings(hdev)); 1059 rp.current_settings = cpu_to_le32(get_current_settings(hdev)); 1060 1061 memcpy(rp.dev_class, hdev->dev_class, 3); 1062 1063 memcpy(rp.name, hdev->dev_name, sizeof(hdev->dev_name)); 1064 memcpy(rp.short_name, hdev->short_name, sizeof(hdev->short_name)); 1065 1066 hci_dev_unlock(hdev); 1067 1068 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_INFO, 0, &rp, 1069 sizeof(rp)); 1070 } 1071 1072 static u16 append_eir_data_to_buf(struct hci_dev *hdev, u8 *eir) 1073 { 1074 u16 eir_len = 0; 1075 size_t name_len; 1076 1077 if (hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) 1078 eir_len = eir_append_data(eir, eir_len, EIR_CLASS_OF_DEV, 1079 hdev->dev_class, 3); 1080 1081 if (hci_dev_test_flag(hdev, HCI_LE_ENABLED)) 1082 eir_len = eir_append_le16(eir, eir_len, EIR_APPEARANCE, 1083 hdev->appearance); 1084 1085 name_len = strlen(hdev->dev_name); 1086 eir_len = eir_append_data(eir, eir_len, EIR_NAME_COMPLETE, 1087 hdev->dev_name, name_len); 1088 1089 name_len = strlen(hdev->short_name); 1090 eir_len = eir_append_data(eir, eir_len, EIR_NAME_SHORT, 1091 hdev->short_name, name_len); 1092 1093 return eir_len; 1094 } 1095 1096 static int read_ext_controller_info(struct sock *sk, struct hci_dev *hdev, 1097 void *data, u16 data_len) 1098 { 1099 char buf[512]; 1100 struct mgmt_rp_read_ext_info *rp = (void *)buf; 1101 u16 eir_len; 1102 1103 bt_dev_dbg(hdev, "sock %p", sk); 1104 1105 memset(&buf, 0, sizeof(buf)); 1106 1107 hci_dev_lock(hdev); 1108 1109 bacpy(&rp->bdaddr, &hdev->bdaddr); 1110 1111 rp->version = hdev->hci_ver; 1112 rp->manufacturer = cpu_to_le16(hdev->manufacturer); 1113 1114 rp->supported_settings = cpu_to_le32(get_supported_settings(hdev)); 1115 rp->current_settings = cpu_to_le32(get_current_settings(hdev)); 1116 1117 1118 eir_len = append_eir_data_to_buf(hdev, rp->eir); 1119 rp->eir_len = cpu_to_le16(eir_len); 1120 1121 hci_dev_unlock(hdev); 1122 1123 /* If this command is called at least once, then the events 1124 * for class of device and local name changes are disabled 1125 * and only the new extended controller information event 1126 * is used. 1127 */ 1128 hci_sock_set_flag(sk, HCI_MGMT_EXT_INFO_EVENTS); 1129 hci_sock_clear_flag(sk, HCI_MGMT_DEV_CLASS_EVENTS); 1130 hci_sock_clear_flag(sk, HCI_MGMT_LOCAL_NAME_EVENTS); 1131 1132 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_EXT_INFO, 0, rp, 1133 sizeof(*rp) + eir_len); 1134 } 1135 1136 static int ext_info_changed(struct hci_dev *hdev, struct sock *skip) 1137 { 1138 char buf[512]; 1139 struct mgmt_ev_ext_info_changed *ev = (void *)buf; 1140 u16 eir_len; 1141 1142 memset(buf, 0, sizeof(buf)); 1143 1144 eir_len = append_eir_data_to_buf(hdev, ev->eir); 1145 ev->eir_len = cpu_to_le16(eir_len); 1146 1147 return mgmt_limited_event(MGMT_EV_EXT_INFO_CHANGED, hdev, ev, 1148 sizeof(*ev) + eir_len, 1149 HCI_MGMT_EXT_INFO_EVENTS, skip); 1150 } 1151 1152 static int send_settings_rsp(struct sock *sk, u16 opcode, struct hci_dev *hdev) 1153 { 1154 __le32 settings = cpu_to_le32(get_current_settings(hdev)); 1155 1156 return mgmt_cmd_complete(sk, hdev->id, opcode, 0, &settings, 1157 sizeof(settings)); 1158 } 1159 1160 void mgmt_advertising_added(struct sock *sk, struct hci_dev *hdev, u8 instance) 1161 { 1162 struct mgmt_ev_advertising_added ev; 1163 1164 ev.instance = instance; 1165 1166 mgmt_event(MGMT_EV_ADVERTISING_ADDED, hdev, &ev, sizeof(ev), sk); 1167 } 1168 1169 void mgmt_advertising_removed(struct sock *sk, struct hci_dev *hdev, 1170 u8 instance) 1171 { 1172 struct mgmt_ev_advertising_removed ev; 1173 1174 ev.instance = instance; 1175 1176 mgmt_event(MGMT_EV_ADVERTISING_REMOVED, hdev, &ev, sizeof(ev), sk); 1177 } 1178 1179 static void cancel_adv_timeout(struct hci_dev *hdev) 1180 { 1181 if (hdev->adv_instance_timeout) { 1182 hdev->adv_instance_timeout = 0; 1183 cancel_delayed_work(&hdev->adv_instance_expire); 1184 } 1185 } 1186 1187 /* This function requires the caller holds hdev->lock */ 1188 static void restart_le_actions(struct hci_dev *hdev) 1189 { 1190 struct hci_conn_params *p; 1191 1192 list_for_each_entry(p, &hdev->le_conn_params, list) { 1193 /* Needed for AUTO_OFF case where might not "really" 1194 * have been powered off. 1195 */ 1196 list_del_init(&p->action); 1197 1198 switch (p->auto_connect) { 1199 case HCI_AUTO_CONN_DIRECT: 1200 case HCI_AUTO_CONN_ALWAYS: 1201 list_add(&p->action, &hdev->pend_le_conns); 1202 break; 1203 case HCI_AUTO_CONN_REPORT: 1204 list_add(&p->action, &hdev->pend_le_reports); 1205 break; 1206 default: 1207 break; 1208 } 1209 } 1210 } 1211 1212 static int new_settings(struct hci_dev *hdev, struct sock *skip) 1213 { 1214 __le32 ev = cpu_to_le32(get_current_settings(hdev)); 1215 1216 return mgmt_limited_event(MGMT_EV_NEW_SETTINGS, hdev, &ev, 1217 sizeof(ev), HCI_MGMT_SETTING_EVENTS, skip); 1218 } 1219 1220 static void mgmt_set_powered_complete(struct hci_dev *hdev, void *data, int err) 1221 { 1222 struct mgmt_pending_cmd *cmd = data; 1223 struct mgmt_mode *cp; 1224 1225 /* Make sure cmd still outstanding. */ 1226 if (cmd != pending_find(MGMT_OP_SET_POWERED, hdev)) 1227 return; 1228 1229 cp = cmd->param; 1230 1231 bt_dev_dbg(hdev, "err %d", err); 1232 1233 if (!err) { 1234 if (cp->val) { 1235 hci_dev_lock(hdev); 1236 restart_le_actions(hdev); 1237 hci_update_passive_scan(hdev); 1238 hci_dev_unlock(hdev); 1239 } 1240 1241 send_settings_rsp(cmd->sk, cmd->opcode, hdev); 1242 1243 /* Only call new_setting for power on as power off is deferred 1244 * to hdev->power_off work which does call hci_dev_do_close. 1245 */ 1246 if (cp->val) 1247 new_settings(hdev, cmd->sk); 1248 } else { 1249 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_POWERED, 1250 mgmt_status(err)); 1251 } 1252 1253 mgmt_pending_remove(cmd); 1254 } 1255 1256 static int set_powered_sync(struct hci_dev *hdev, void *data) 1257 { 1258 struct mgmt_pending_cmd *cmd = data; 1259 struct mgmt_mode *cp = cmd->param; 1260 1261 BT_DBG("%s", hdev->name); 1262 1263 return hci_set_powered_sync(hdev, cp->val); 1264 } 1265 1266 static int set_powered(struct sock *sk, struct hci_dev *hdev, void *data, 1267 u16 len) 1268 { 1269 struct mgmt_mode *cp = data; 1270 struct mgmt_pending_cmd *cmd; 1271 int err; 1272 1273 bt_dev_dbg(hdev, "sock %p", sk); 1274 1275 if (cp->val != 0x00 && cp->val != 0x01) 1276 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED, 1277 MGMT_STATUS_INVALID_PARAMS); 1278 1279 hci_dev_lock(hdev); 1280 1281 if (pending_find(MGMT_OP_SET_POWERED, hdev)) { 1282 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED, 1283 MGMT_STATUS_BUSY); 1284 goto failed; 1285 } 1286 1287 if (!!cp->val == hdev_is_powered(hdev)) { 1288 err = send_settings_rsp(sk, MGMT_OP_SET_POWERED, hdev); 1289 goto failed; 1290 } 1291 1292 cmd = mgmt_pending_add(sk, MGMT_OP_SET_POWERED, hdev, data, len); 1293 if (!cmd) { 1294 err = -ENOMEM; 1295 goto failed; 1296 } 1297 1298 err = hci_cmd_sync_queue(hdev, set_powered_sync, cmd, 1299 mgmt_set_powered_complete); 1300 1301 if (err < 0) 1302 mgmt_pending_remove(cmd); 1303 1304 failed: 1305 hci_dev_unlock(hdev); 1306 return err; 1307 } 1308 1309 int mgmt_new_settings(struct hci_dev *hdev) 1310 { 1311 return new_settings(hdev, NULL); 1312 } 1313 1314 struct cmd_lookup { 1315 struct sock *sk; 1316 struct hci_dev *hdev; 1317 u8 mgmt_status; 1318 }; 1319 1320 static void settings_rsp(struct mgmt_pending_cmd *cmd, void *data) 1321 { 1322 struct cmd_lookup *match = data; 1323 1324 send_settings_rsp(cmd->sk, cmd->opcode, match->hdev); 1325 1326 list_del(&cmd->list); 1327 1328 if (match->sk == NULL) { 1329 match->sk = cmd->sk; 1330 sock_hold(match->sk); 1331 } 1332 1333 mgmt_pending_free(cmd); 1334 } 1335 1336 static void cmd_status_rsp(struct mgmt_pending_cmd *cmd, void *data) 1337 { 1338 u8 *status = data; 1339 1340 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, *status); 1341 mgmt_pending_remove(cmd); 1342 } 1343 1344 static void cmd_complete_rsp(struct mgmt_pending_cmd *cmd, void *data) 1345 { 1346 if (cmd->cmd_complete) { 1347 u8 *status = data; 1348 1349 cmd->cmd_complete(cmd, *status); 1350 mgmt_pending_remove(cmd); 1351 1352 return; 1353 } 1354 1355 cmd_status_rsp(cmd, data); 1356 } 1357 1358 static int generic_cmd_complete(struct mgmt_pending_cmd *cmd, u8 status) 1359 { 1360 return mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, status, 1361 cmd->param, cmd->param_len); 1362 } 1363 1364 static int addr_cmd_complete(struct mgmt_pending_cmd *cmd, u8 status) 1365 { 1366 return mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, status, 1367 cmd->param, sizeof(struct mgmt_addr_info)); 1368 } 1369 1370 static u8 mgmt_bredr_support(struct hci_dev *hdev) 1371 { 1372 if (!lmp_bredr_capable(hdev)) 1373 return MGMT_STATUS_NOT_SUPPORTED; 1374 else if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) 1375 return MGMT_STATUS_REJECTED; 1376 else 1377 return MGMT_STATUS_SUCCESS; 1378 } 1379 1380 static u8 mgmt_le_support(struct hci_dev *hdev) 1381 { 1382 if (!lmp_le_capable(hdev)) 1383 return MGMT_STATUS_NOT_SUPPORTED; 1384 else if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED)) 1385 return MGMT_STATUS_REJECTED; 1386 else 1387 return MGMT_STATUS_SUCCESS; 1388 } 1389 1390 static void mgmt_set_discoverable_complete(struct hci_dev *hdev, void *data, 1391 int err) 1392 { 1393 struct mgmt_pending_cmd *cmd = data; 1394 1395 bt_dev_dbg(hdev, "err %d", err); 1396 1397 /* Make sure cmd still outstanding. */ 1398 if (cmd != pending_find(MGMT_OP_SET_DISCOVERABLE, hdev)) 1399 return; 1400 1401 hci_dev_lock(hdev); 1402 1403 if (err) { 1404 u8 mgmt_err = mgmt_status(err); 1405 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err); 1406 hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE); 1407 goto done; 1408 } 1409 1410 if (hci_dev_test_flag(hdev, HCI_DISCOVERABLE) && 1411 hdev->discov_timeout > 0) { 1412 int to = msecs_to_jiffies(hdev->discov_timeout * 1000); 1413 queue_delayed_work(hdev->req_workqueue, &hdev->discov_off, to); 1414 } 1415 1416 send_settings_rsp(cmd->sk, MGMT_OP_SET_DISCOVERABLE, hdev); 1417 new_settings(hdev, cmd->sk); 1418 1419 done: 1420 mgmt_pending_remove(cmd); 1421 hci_dev_unlock(hdev); 1422 } 1423 1424 static int set_discoverable_sync(struct hci_dev *hdev, void *data) 1425 { 1426 BT_DBG("%s", hdev->name); 1427 1428 return hci_update_discoverable_sync(hdev); 1429 } 1430 1431 static int set_discoverable(struct sock *sk, struct hci_dev *hdev, void *data, 1432 u16 len) 1433 { 1434 struct mgmt_cp_set_discoverable *cp = data; 1435 struct mgmt_pending_cmd *cmd; 1436 u16 timeout; 1437 int err; 1438 1439 bt_dev_dbg(hdev, "sock %p", sk); 1440 1441 if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED) && 1442 !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) 1443 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE, 1444 MGMT_STATUS_REJECTED); 1445 1446 if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02) 1447 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE, 1448 MGMT_STATUS_INVALID_PARAMS); 1449 1450 timeout = __le16_to_cpu(cp->timeout); 1451 1452 /* Disabling discoverable requires that no timeout is set, 1453 * and enabling limited discoverable requires a timeout. 1454 */ 1455 if ((cp->val == 0x00 && timeout > 0) || 1456 (cp->val == 0x02 && timeout == 0)) 1457 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE, 1458 MGMT_STATUS_INVALID_PARAMS); 1459 1460 hci_dev_lock(hdev); 1461 1462 if (!hdev_is_powered(hdev) && timeout > 0) { 1463 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE, 1464 MGMT_STATUS_NOT_POWERED); 1465 goto failed; 1466 } 1467 1468 if (pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) || 1469 pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) { 1470 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE, 1471 MGMT_STATUS_BUSY); 1472 goto failed; 1473 } 1474 1475 if (!hci_dev_test_flag(hdev, HCI_CONNECTABLE)) { 1476 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE, 1477 MGMT_STATUS_REJECTED); 1478 goto failed; 1479 } 1480 1481 if (hdev->advertising_paused) { 1482 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE, 1483 MGMT_STATUS_BUSY); 1484 goto failed; 1485 } 1486 1487 if (!hdev_is_powered(hdev)) { 1488 bool changed = false; 1489 1490 /* Setting limited discoverable when powered off is 1491 * not a valid operation since it requires a timeout 1492 * and so no need to check HCI_LIMITED_DISCOVERABLE. 1493 */ 1494 if (!!cp->val != hci_dev_test_flag(hdev, HCI_DISCOVERABLE)) { 1495 hci_dev_change_flag(hdev, HCI_DISCOVERABLE); 1496 changed = true; 1497 } 1498 1499 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev); 1500 if (err < 0) 1501 goto failed; 1502 1503 if (changed) 1504 err = new_settings(hdev, sk); 1505 1506 goto failed; 1507 } 1508 1509 /* If the current mode is the same, then just update the timeout 1510 * value with the new value. And if only the timeout gets updated, 1511 * then no need for any HCI transactions. 1512 */ 1513 if (!!cp->val == hci_dev_test_flag(hdev, HCI_DISCOVERABLE) && 1514 (cp->val == 0x02) == hci_dev_test_flag(hdev, 1515 HCI_LIMITED_DISCOVERABLE)) { 1516 cancel_delayed_work(&hdev->discov_off); 1517 hdev->discov_timeout = timeout; 1518 1519 if (cp->val && hdev->discov_timeout > 0) { 1520 int to = msecs_to_jiffies(hdev->discov_timeout * 1000); 1521 queue_delayed_work(hdev->req_workqueue, 1522 &hdev->discov_off, to); 1523 } 1524 1525 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev); 1526 goto failed; 1527 } 1528 1529 cmd = mgmt_pending_add(sk, MGMT_OP_SET_DISCOVERABLE, hdev, data, len); 1530 if (!cmd) { 1531 err = -ENOMEM; 1532 goto failed; 1533 } 1534 1535 /* Cancel any potential discoverable timeout that might be 1536 * still active and store new timeout value. The arming of 1537 * the timeout happens in the complete handler. 1538 */ 1539 cancel_delayed_work(&hdev->discov_off); 1540 hdev->discov_timeout = timeout; 1541 1542 if (cp->val) 1543 hci_dev_set_flag(hdev, HCI_DISCOVERABLE); 1544 else 1545 hci_dev_clear_flag(hdev, HCI_DISCOVERABLE); 1546 1547 /* Limited discoverable mode */ 1548 if (cp->val == 0x02) 1549 hci_dev_set_flag(hdev, HCI_LIMITED_DISCOVERABLE); 1550 else 1551 hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE); 1552 1553 err = hci_cmd_sync_queue(hdev, set_discoverable_sync, cmd, 1554 mgmt_set_discoverable_complete); 1555 1556 if (err < 0) 1557 mgmt_pending_remove(cmd); 1558 1559 failed: 1560 hci_dev_unlock(hdev); 1561 return err; 1562 } 1563 1564 static void mgmt_set_connectable_complete(struct hci_dev *hdev, void *data, 1565 int err) 1566 { 1567 struct mgmt_pending_cmd *cmd = data; 1568 1569 bt_dev_dbg(hdev, "err %d", err); 1570 1571 /* Make sure cmd still outstanding. */ 1572 if (cmd != pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) 1573 return; 1574 1575 hci_dev_lock(hdev); 1576 1577 if (err) { 1578 u8 mgmt_err = mgmt_status(err); 1579 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err); 1580 goto done; 1581 } 1582 1583 send_settings_rsp(cmd->sk, MGMT_OP_SET_CONNECTABLE, hdev); 1584 new_settings(hdev, cmd->sk); 1585 1586 done: 1587 if (cmd) 1588 mgmt_pending_remove(cmd); 1589 1590 hci_dev_unlock(hdev); 1591 } 1592 1593 static int set_connectable_update_settings(struct hci_dev *hdev, 1594 struct sock *sk, u8 val) 1595 { 1596 bool changed = false; 1597 int err; 1598 1599 if (!!val != hci_dev_test_flag(hdev, HCI_CONNECTABLE)) 1600 changed = true; 1601 1602 if (val) { 1603 hci_dev_set_flag(hdev, HCI_CONNECTABLE); 1604 } else { 1605 hci_dev_clear_flag(hdev, HCI_CONNECTABLE); 1606 hci_dev_clear_flag(hdev, HCI_DISCOVERABLE); 1607 } 1608 1609 err = send_settings_rsp(sk, MGMT_OP_SET_CONNECTABLE, hdev); 1610 if (err < 0) 1611 return err; 1612 1613 if (changed) { 1614 hci_req_update_scan(hdev); 1615 hci_update_passive_scan(hdev); 1616 return new_settings(hdev, sk); 1617 } 1618 1619 return 0; 1620 } 1621 1622 static int set_connectable_sync(struct hci_dev *hdev, void *data) 1623 { 1624 BT_DBG("%s", hdev->name); 1625 1626 return hci_update_connectable_sync(hdev); 1627 } 1628 1629 static int set_connectable(struct sock *sk, struct hci_dev *hdev, void *data, 1630 u16 len) 1631 { 1632 struct mgmt_mode *cp = data; 1633 struct mgmt_pending_cmd *cmd; 1634 int err; 1635 1636 bt_dev_dbg(hdev, "sock %p", sk); 1637 1638 if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED) && 1639 !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) 1640 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE, 1641 MGMT_STATUS_REJECTED); 1642 1643 if (cp->val != 0x00 && cp->val != 0x01) 1644 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE, 1645 MGMT_STATUS_INVALID_PARAMS); 1646 1647 hci_dev_lock(hdev); 1648 1649 if (!hdev_is_powered(hdev)) { 1650 err = set_connectable_update_settings(hdev, sk, cp->val); 1651 goto failed; 1652 } 1653 1654 if (pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) || 1655 pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) { 1656 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE, 1657 MGMT_STATUS_BUSY); 1658 goto failed; 1659 } 1660 1661 cmd = mgmt_pending_add(sk, MGMT_OP_SET_CONNECTABLE, hdev, data, len); 1662 if (!cmd) { 1663 err = -ENOMEM; 1664 goto failed; 1665 } 1666 1667 if (cp->val) { 1668 hci_dev_set_flag(hdev, HCI_CONNECTABLE); 1669 } else { 1670 if (hdev->discov_timeout > 0) 1671 cancel_delayed_work(&hdev->discov_off); 1672 1673 hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE); 1674 hci_dev_clear_flag(hdev, HCI_DISCOVERABLE); 1675 hci_dev_clear_flag(hdev, HCI_CONNECTABLE); 1676 } 1677 1678 err = hci_cmd_sync_queue(hdev, set_connectable_sync, cmd, 1679 mgmt_set_connectable_complete); 1680 1681 if (err < 0) 1682 mgmt_pending_remove(cmd); 1683 1684 failed: 1685 hci_dev_unlock(hdev); 1686 return err; 1687 } 1688 1689 static int set_bondable(struct sock *sk, struct hci_dev *hdev, void *data, 1690 u16 len) 1691 { 1692 struct mgmt_mode *cp = data; 1693 bool changed; 1694 int err; 1695 1696 bt_dev_dbg(hdev, "sock %p", sk); 1697 1698 if (cp->val != 0x00 && cp->val != 0x01) 1699 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BONDABLE, 1700 MGMT_STATUS_INVALID_PARAMS); 1701 1702 hci_dev_lock(hdev); 1703 1704 if (cp->val) 1705 changed = !hci_dev_test_and_set_flag(hdev, HCI_BONDABLE); 1706 else 1707 changed = hci_dev_test_and_clear_flag(hdev, HCI_BONDABLE); 1708 1709 err = send_settings_rsp(sk, MGMT_OP_SET_BONDABLE, hdev); 1710 if (err < 0) 1711 goto unlock; 1712 1713 if (changed) { 1714 /* In limited privacy mode the change of bondable mode 1715 * may affect the local advertising address. 1716 */ 1717 hci_update_discoverable(hdev); 1718 1719 err = new_settings(hdev, sk); 1720 } 1721 1722 unlock: 1723 hci_dev_unlock(hdev); 1724 return err; 1725 } 1726 1727 static int set_link_security(struct sock *sk, struct hci_dev *hdev, void *data, 1728 u16 len) 1729 { 1730 struct mgmt_mode *cp = data; 1731 struct mgmt_pending_cmd *cmd; 1732 u8 val, status; 1733 int err; 1734 1735 bt_dev_dbg(hdev, "sock %p", sk); 1736 1737 status = mgmt_bredr_support(hdev); 1738 if (status) 1739 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY, 1740 status); 1741 1742 if (cp->val != 0x00 && cp->val != 0x01) 1743 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY, 1744 MGMT_STATUS_INVALID_PARAMS); 1745 1746 hci_dev_lock(hdev); 1747 1748 if (!hdev_is_powered(hdev)) { 1749 bool changed = false; 1750 1751 if (!!cp->val != hci_dev_test_flag(hdev, HCI_LINK_SECURITY)) { 1752 hci_dev_change_flag(hdev, HCI_LINK_SECURITY); 1753 changed = true; 1754 } 1755 1756 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev); 1757 if (err < 0) 1758 goto failed; 1759 1760 if (changed) 1761 err = new_settings(hdev, sk); 1762 1763 goto failed; 1764 } 1765 1766 if (pending_find(MGMT_OP_SET_LINK_SECURITY, hdev)) { 1767 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY, 1768 MGMT_STATUS_BUSY); 1769 goto failed; 1770 } 1771 1772 val = !!cp->val; 1773 1774 if (test_bit(HCI_AUTH, &hdev->flags) == val) { 1775 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev); 1776 goto failed; 1777 } 1778 1779 cmd = mgmt_pending_add(sk, MGMT_OP_SET_LINK_SECURITY, hdev, data, len); 1780 if (!cmd) { 1781 err = -ENOMEM; 1782 goto failed; 1783 } 1784 1785 err = hci_send_cmd(hdev, HCI_OP_WRITE_AUTH_ENABLE, sizeof(val), &val); 1786 if (err < 0) { 1787 mgmt_pending_remove(cmd); 1788 goto failed; 1789 } 1790 1791 failed: 1792 hci_dev_unlock(hdev); 1793 return err; 1794 } 1795 1796 static void set_ssp_complete(struct hci_dev *hdev, void *data, int err) 1797 { 1798 struct cmd_lookup match = { NULL, hdev }; 1799 struct mgmt_pending_cmd *cmd = data; 1800 struct mgmt_mode *cp = cmd->param; 1801 u8 enable = cp->val; 1802 bool changed; 1803 1804 /* Make sure cmd still outstanding. */ 1805 if (cmd != pending_find(MGMT_OP_SET_SSP, hdev)) 1806 return; 1807 1808 if (err) { 1809 u8 mgmt_err = mgmt_status(err); 1810 1811 if (enable && hci_dev_test_and_clear_flag(hdev, 1812 HCI_SSP_ENABLED)) { 1813 hci_dev_clear_flag(hdev, HCI_HS_ENABLED); 1814 new_settings(hdev, NULL); 1815 } 1816 1817 mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev, cmd_status_rsp, 1818 &mgmt_err); 1819 return; 1820 } 1821 1822 if (enable) { 1823 changed = !hci_dev_test_and_set_flag(hdev, HCI_SSP_ENABLED); 1824 } else { 1825 changed = hci_dev_test_and_clear_flag(hdev, HCI_SSP_ENABLED); 1826 1827 if (!changed) 1828 changed = hci_dev_test_and_clear_flag(hdev, 1829 HCI_HS_ENABLED); 1830 else 1831 hci_dev_clear_flag(hdev, HCI_HS_ENABLED); 1832 } 1833 1834 mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev, settings_rsp, &match); 1835 1836 if (changed) 1837 new_settings(hdev, match.sk); 1838 1839 if (match.sk) 1840 sock_put(match.sk); 1841 1842 hci_update_eir_sync(hdev); 1843 } 1844 1845 static int set_ssp_sync(struct hci_dev *hdev, void *data) 1846 { 1847 struct mgmt_pending_cmd *cmd = data; 1848 struct mgmt_mode *cp = cmd->param; 1849 bool changed = false; 1850 int err; 1851 1852 if (cp->val) 1853 changed = !hci_dev_test_and_set_flag(hdev, HCI_SSP_ENABLED); 1854 1855 err = hci_write_ssp_mode_sync(hdev, cp->val); 1856 1857 if (!err && changed) 1858 hci_dev_clear_flag(hdev, HCI_SSP_ENABLED); 1859 1860 return err; 1861 } 1862 1863 static int set_ssp(struct sock *sk, struct hci_dev *hdev, void *data, u16 len) 1864 { 1865 struct mgmt_mode *cp = data; 1866 struct mgmt_pending_cmd *cmd; 1867 u8 status; 1868 int err; 1869 1870 bt_dev_dbg(hdev, "sock %p", sk); 1871 1872 status = mgmt_bredr_support(hdev); 1873 if (status) 1874 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP, status); 1875 1876 if (!lmp_ssp_capable(hdev)) 1877 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP, 1878 MGMT_STATUS_NOT_SUPPORTED); 1879 1880 if (cp->val != 0x00 && cp->val != 0x01) 1881 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP, 1882 MGMT_STATUS_INVALID_PARAMS); 1883 1884 hci_dev_lock(hdev); 1885 1886 if (!hdev_is_powered(hdev)) { 1887 bool changed; 1888 1889 if (cp->val) { 1890 changed = !hci_dev_test_and_set_flag(hdev, 1891 HCI_SSP_ENABLED); 1892 } else { 1893 changed = hci_dev_test_and_clear_flag(hdev, 1894 HCI_SSP_ENABLED); 1895 if (!changed) 1896 changed = hci_dev_test_and_clear_flag(hdev, 1897 HCI_HS_ENABLED); 1898 else 1899 hci_dev_clear_flag(hdev, HCI_HS_ENABLED); 1900 } 1901 1902 err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev); 1903 if (err < 0) 1904 goto failed; 1905 1906 if (changed) 1907 err = new_settings(hdev, sk); 1908 1909 goto failed; 1910 } 1911 1912 if (pending_find(MGMT_OP_SET_SSP, hdev)) { 1913 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP, 1914 MGMT_STATUS_BUSY); 1915 goto failed; 1916 } 1917 1918 if (!!cp->val == hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) { 1919 err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev); 1920 goto failed; 1921 } 1922 1923 cmd = mgmt_pending_add(sk, MGMT_OP_SET_SSP, hdev, data, len); 1924 if (!cmd) 1925 err = -ENOMEM; 1926 else 1927 err = hci_cmd_sync_queue(hdev, set_ssp_sync, cmd, 1928 set_ssp_complete); 1929 1930 if (err < 0) { 1931 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP, 1932 MGMT_STATUS_FAILED); 1933 1934 if (cmd) 1935 mgmt_pending_remove(cmd); 1936 } 1937 1938 failed: 1939 hci_dev_unlock(hdev); 1940 return err; 1941 } 1942 1943 static int set_hs(struct sock *sk, struct hci_dev *hdev, void *data, u16 len) 1944 { 1945 struct mgmt_mode *cp = data; 1946 bool changed; 1947 u8 status; 1948 int err; 1949 1950 bt_dev_dbg(hdev, "sock %p", sk); 1951 1952 if (!IS_ENABLED(CONFIG_BT_HS)) 1953 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS, 1954 MGMT_STATUS_NOT_SUPPORTED); 1955 1956 status = mgmt_bredr_support(hdev); 1957 if (status) 1958 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS, status); 1959 1960 if (!lmp_ssp_capable(hdev)) 1961 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS, 1962 MGMT_STATUS_NOT_SUPPORTED); 1963 1964 if (!hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) 1965 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS, 1966 MGMT_STATUS_REJECTED); 1967 1968 if (cp->val != 0x00 && cp->val != 0x01) 1969 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS, 1970 MGMT_STATUS_INVALID_PARAMS); 1971 1972 hci_dev_lock(hdev); 1973 1974 if (pending_find(MGMT_OP_SET_SSP, hdev)) { 1975 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS, 1976 MGMT_STATUS_BUSY); 1977 goto unlock; 1978 } 1979 1980 if (cp->val) { 1981 changed = !hci_dev_test_and_set_flag(hdev, HCI_HS_ENABLED); 1982 } else { 1983 if (hdev_is_powered(hdev)) { 1984 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS, 1985 MGMT_STATUS_REJECTED); 1986 goto unlock; 1987 } 1988 1989 changed = hci_dev_test_and_clear_flag(hdev, HCI_HS_ENABLED); 1990 } 1991 1992 err = send_settings_rsp(sk, MGMT_OP_SET_HS, hdev); 1993 if (err < 0) 1994 goto unlock; 1995 1996 if (changed) 1997 err = new_settings(hdev, sk); 1998 1999 unlock: 2000 hci_dev_unlock(hdev); 2001 return err; 2002 } 2003 2004 static void set_le_complete(struct hci_dev *hdev, void *data, int err) 2005 { 2006 struct cmd_lookup match = { NULL, hdev }; 2007 u8 status = mgmt_status(err); 2008 2009 bt_dev_dbg(hdev, "err %d", err); 2010 2011 if (status) { 2012 mgmt_pending_foreach(MGMT_OP_SET_LE, hdev, cmd_status_rsp, 2013 &status); 2014 return; 2015 } 2016 2017 mgmt_pending_foreach(MGMT_OP_SET_LE, hdev, settings_rsp, &match); 2018 2019 new_settings(hdev, match.sk); 2020 2021 if (match.sk) 2022 sock_put(match.sk); 2023 } 2024 2025 static int set_le_sync(struct hci_dev *hdev, void *data) 2026 { 2027 struct mgmt_pending_cmd *cmd = data; 2028 struct mgmt_mode *cp = cmd->param; 2029 u8 val = !!cp->val; 2030 int err; 2031 2032 if (!val) { 2033 if (hci_dev_test_flag(hdev, HCI_LE_ADV)) 2034 hci_disable_advertising_sync(hdev); 2035 2036 if (ext_adv_capable(hdev)) 2037 hci_remove_ext_adv_instance_sync(hdev, 0, cmd->sk); 2038 } else { 2039 hci_dev_set_flag(hdev, HCI_LE_ENABLED); 2040 } 2041 2042 err = hci_write_le_host_supported_sync(hdev, val, 0); 2043 2044 /* Make sure the controller has a good default for 2045 * advertising data. Restrict the update to when LE 2046 * has actually been enabled. During power on, the 2047 * update in powered_update_hci will take care of it. 2048 */ 2049 if (!err && hci_dev_test_flag(hdev, HCI_LE_ENABLED)) { 2050 if (ext_adv_capable(hdev)) { 2051 int status; 2052 2053 status = hci_setup_ext_adv_instance_sync(hdev, 0x00); 2054 if (!status) 2055 hci_update_scan_rsp_data_sync(hdev, 0x00); 2056 } else { 2057 hci_update_adv_data_sync(hdev, 0x00); 2058 hci_update_scan_rsp_data_sync(hdev, 0x00); 2059 } 2060 2061 hci_update_passive_scan(hdev); 2062 } 2063 2064 return err; 2065 } 2066 2067 static int set_le(struct sock *sk, struct hci_dev *hdev, void *data, u16 len) 2068 { 2069 struct mgmt_mode *cp = data; 2070 struct mgmt_pending_cmd *cmd; 2071 int err; 2072 u8 val, enabled; 2073 2074 bt_dev_dbg(hdev, "sock %p", sk); 2075 2076 if (!lmp_le_capable(hdev)) 2077 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE, 2078 MGMT_STATUS_NOT_SUPPORTED); 2079 2080 if (cp->val != 0x00 && cp->val != 0x01) 2081 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE, 2082 MGMT_STATUS_INVALID_PARAMS); 2083 2084 /* Bluetooth single mode LE only controllers or dual-mode 2085 * controllers configured as LE only devices, do not allow 2086 * switching LE off. These have either LE enabled explicitly 2087 * or BR/EDR has been previously switched off. 2088 * 2089 * When trying to enable an already enabled LE, then gracefully 2090 * send a positive response. Trying to disable it however will 2091 * result into rejection. 2092 */ 2093 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) { 2094 if (cp->val == 0x01) 2095 return send_settings_rsp(sk, MGMT_OP_SET_LE, hdev); 2096 2097 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE, 2098 MGMT_STATUS_REJECTED); 2099 } 2100 2101 hci_dev_lock(hdev); 2102 2103 val = !!cp->val; 2104 enabled = lmp_host_le_capable(hdev); 2105 2106 if (!val) 2107 hci_req_clear_adv_instance(hdev, NULL, NULL, 0x00, true); 2108 2109 if (!hdev_is_powered(hdev) || val == enabled) { 2110 bool changed = false; 2111 2112 if (val != hci_dev_test_flag(hdev, HCI_LE_ENABLED)) { 2113 hci_dev_change_flag(hdev, HCI_LE_ENABLED); 2114 changed = true; 2115 } 2116 2117 if (!val && hci_dev_test_flag(hdev, HCI_ADVERTISING)) { 2118 hci_dev_clear_flag(hdev, HCI_ADVERTISING); 2119 changed = true; 2120 } 2121 2122 err = send_settings_rsp(sk, MGMT_OP_SET_LE, hdev); 2123 if (err < 0) 2124 goto unlock; 2125 2126 if (changed) 2127 err = new_settings(hdev, sk); 2128 2129 goto unlock; 2130 } 2131 2132 if (pending_find(MGMT_OP_SET_LE, hdev) || 2133 pending_find(MGMT_OP_SET_ADVERTISING, hdev)) { 2134 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE, 2135 MGMT_STATUS_BUSY); 2136 goto unlock; 2137 } 2138 2139 cmd = mgmt_pending_add(sk, MGMT_OP_SET_LE, hdev, data, len); 2140 if (!cmd) 2141 err = -ENOMEM; 2142 else 2143 err = hci_cmd_sync_queue(hdev, set_le_sync, cmd, 2144 set_le_complete); 2145 2146 if (err < 0) { 2147 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE, 2148 MGMT_STATUS_FAILED); 2149 2150 if (cmd) 2151 mgmt_pending_remove(cmd); 2152 } 2153 2154 unlock: 2155 hci_dev_unlock(hdev); 2156 return err; 2157 } 2158 2159 /* This is a helper function to test for pending mgmt commands that can 2160 * cause CoD or EIR HCI commands. We can only allow one such pending 2161 * mgmt command at a time since otherwise we cannot easily track what 2162 * the current values are, will be, and based on that calculate if a new 2163 * HCI command needs to be sent and if yes with what value. 2164 */ 2165 static bool pending_eir_or_class(struct hci_dev *hdev) 2166 { 2167 struct mgmt_pending_cmd *cmd; 2168 2169 list_for_each_entry(cmd, &hdev->mgmt_pending, list) { 2170 switch (cmd->opcode) { 2171 case MGMT_OP_ADD_UUID: 2172 case MGMT_OP_REMOVE_UUID: 2173 case MGMT_OP_SET_DEV_CLASS: 2174 case MGMT_OP_SET_POWERED: 2175 return true; 2176 } 2177 } 2178 2179 return false; 2180 } 2181 2182 static const u8 bluetooth_base_uuid[] = { 2183 0xfb, 0x34, 0x9b, 0x5f, 0x80, 0x00, 0x00, 0x80, 2184 0x00, 0x10, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 2185 }; 2186 2187 static u8 get_uuid_size(const u8 *uuid) 2188 { 2189 u32 val; 2190 2191 if (memcmp(uuid, bluetooth_base_uuid, 12)) 2192 return 128; 2193 2194 val = get_unaligned_le32(&uuid[12]); 2195 if (val > 0xffff) 2196 return 32; 2197 2198 return 16; 2199 } 2200 2201 static void mgmt_class_complete(struct hci_dev *hdev, void *data, int err) 2202 { 2203 struct mgmt_pending_cmd *cmd = data; 2204 2205 bt_dev_dbg(hdev, "err %d", err); 2206 2207 mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, 2208 mgmt_status(err), hdev->dev_class, 3); 2209 2210 mgmt_pending_free(cmd); 2211 } 2212 2213 static int add_uuid_sync(struct hci_dev *hdev, void *data) 2214 { 2215 int err; 2216 2217 err = hci_update_class_sync(hdev); 2218 if (err) 2219 return err; 2220 2221 return hci_update_eir_sync(hdev); 2222 } 2223 2224 static int add_uuid(struct sock *sk, struct hci_dev *hdev, void *data, u16 len) 2225 { 2226 struct mgmt_cp_add_uuid *cp = data; 2227 struct mgmt_pending_cmd *cmd; 2228 struct bt_uuid *uuid; 2229 int err; 2230 2231 bt_dev_dbg(hdev, "sock %p", sk); 2232 2233 hci_dev_lock(hdev); 2234 2235 if (pending_eir_or_class(hdev)) { 2236 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_UUID, 2237 MGMT_STATUS_BUSY); 2238 goto failed; 2239 } 2240 2241 uuid = kmalloc(sizeof(*uuid), GFP_KERNEL); 2242 if (!uuid) { 2243 err = -ENOMEM; 2244 goto failed; 2245 } 2246 2247 memcpy(uuid->uuid, cp->uuid, 16); 2248 uuid->svc_hint = cp->svc_hint; 2249 uuid->size = get_uuid_size(cp->uuid); 2250 2251 list_add_tail(&uuid->list, &hdev->uuids); 2252 2253 cmd = mgmt_pending_new(sk, MGMT_OP_ADD_UUID, hdev, data, len); 2254 if (!cmd) { 2255 err = -ENOMEM; 2256 goto failed; 2257 } 2258 2259 err = hci_cmd_sync_queue(hdev, add_uuid_sync, cmd, mgmt_class_complete); 2260 if (err < 0) { 2261 mgmt_pending_free(cmd); 2262 goto failed; 2263 } 2264 2265 failed: 2266 hci_dev_unlock(hdev); 2267 return err; 2268 } 2269 2270 static bool enable_service_cache(struct hci_dev *hdev) 2271 { 2272 if (!hdev_is_powered(hdev)) 2273 return false; 2274 2275 if (!hci_dev_test_and_set_flag(hdev, HCI_SERVICE_CACHE)) { 2276 queue_delayed_work(hdev->workqueue, &hdev->service_cache, 2277 CACHE_TIMEOUT); 2278 return true; 2279 } 2280 2281 return false; 2282 } 2283 2284 static int remove_uuid_sync(struct hci_dev *hdev, void *data) 2285 { 2286 int err; 2287 2288 err = hci_update_class_sync(hdev); 2289 if (err) 2290 return err; 2291 2292 return hci_update_eir_sync(hdev); 2293 } 2294 2295 static int remove_uuid(struct sock *sk, struct hci_dev *hdev, void *data, 2296 u16 len) 2297 { 2298 struct mgmt_cp_remove_uuid *cp = data; 2299 struct mgmt_pending_cmd *cmd; 2300 struct bt_uuid *match, *tmp; 2301 static const u8 bt_uuid_any[] = { 2302 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 2303 }; 2304 int err, found; 2305 2306 bt_dev_dbg(hdev, "sock %p", sk); 2307 2308 hci_dev_lock(hdev); 2309 2310 if (pending_eir_or_class(hdev)) { 2311 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID, 2312 MGMT_STATUS_BUSY); 2313 goto unlock; 2314 } 2315 2316 if (memcmp(cp->uuid, bt_uuid_any, 16) == 0) { 2317 hci_uuids_clear(hdev); 2318 2319 if (enable_service_cache(hdev)) { 2320 err = mgmt_cmd_complete(sk, hdev->id, 2321 MGMT_OP_REMOVE_UUID, 2322 0, hdev->dev_class, 3); 2323 goto unlock; 2324 } 2325 2326 goto update_class; 2327 } 2328 2329 found = 0; 2330 2331 list_for_each_entry_safe(match, tmp, &hdev->uuids, list) { 2332 if (memcmp(match->uuid, cp->uuid, 16) != 0) 2333 continue; 2334 2335 list_del(&match->list); 2336 kfree(match); 2337 found++; 2338 } 2339 2340 if (found == 0) { 2341 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID, 2342 MGMT_STATUS_INVALID_PARAMS); 2343 goto unlock; 2344 } 2345 2346 update_class: 2347 cmd = mgmt_pending_new(sk, MGMT_OP_REMOVE_UUID, hdev, data, len); 2348 if (!cmd) { 2349 err = -ENOMEM; 2350 goto unlock; 2351 } 2352 2353 err = hci_cmd_sync_queue(hdev, remove_uuid_sync, cmd, 2354 mgmt_class_complete); 2355 if (err < 0) 2356 mgmt_pending_free(cmd); 2357 2358 unlock: 2359 hci_dev_unlock(hdev); 2360 return err; 2361 } 2362 2363 static int set_class_sync(struct hci_dev *hdev, void *data) 2364 { 2365 int err = 0; 2366 2367 if (hci_dev_test_and_clear_flag(hdev, HCI_SERVICE_CACHE)) { 2368 cancel_delayed_work_sync(&hdev->service_cache); 2369 err = hci_update_eir_sync(hdev); 2370 } 2371 2372 if (err) 2373 return err; 2374 2375 return hci_update_class_sync(hdev); 2376 } 2377 2378 static int set_dev_class(struct sock *sk, struct hci_dev *hdev, void *data, 2379 u16 len) 2380 { 2381 struct mgmt_cp_set_dev_class *cp = data; 2382 struct mgmt_pending_cmd *cmd; 2383 int err; 2384 2385 bt_dev_dbg(hdev, "sock %p", sk); 2386 2387 if (!lmp_bredr_capable(hdev)) 2388 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 2389 MGMT_STATUS_NOT_SUPPORTED); 2390 2391 hci_dev_lock(hdev); 2392 2393 if (pending_eir_or_class(hdev)) { 2394 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 2395 MGMT_STATUS_BUSY); 2396 goto unlock; 2397 } 2398 2399 if ((cp->minor & 0x03) != 0 || (cp->major & 0xe0) != 0) { 2400 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 2401 MGMT_STATUS_INVALID_PARAMS); 2402 goto unlock; 2403 } 2404 2405 hdev->major_class = cp->major; 2406 hdev->minor_class = cp->minor; 2407 2408 if (!hdev_is_powered(hdev)) { 2409 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 0, 2410 hdev->dev_class, 3); 2411 goto unlock; 2412 } 2413 2414 cmd = mgmt_pending_new(sk, MGMT_OP_SET_DEV_CLASS, hdev, data, len); 2415 if (!cmd) { 2416 err = -ENOMEM; 2417 goto unlock; 2418 } 2419 2420 err = hci_cmd_sync_queue(hdev, set_class_sync, cmd, 2421 mgmt_class_complete); 2422 if (err < 0) 2423 mgmt_pending_free(cmd); 2424 2425 unlock: 2426 hci_dev_unlock(hdev); 2427 return err; 2428 } 2429 2430 static int load_link_keys(struct sock *sk, struct hci_dev *hdev, void *data, 2431 u16 len) 2432 { 2433 struct mgmt_cp_load_link_keys *cp = data; 2434 const u16 max_key_count = ((U16_MAX - sizeof(*cp)) / 2435 sizeof(struct mgmt_link_key_info)); 2436 u16 key_count, expected_len; 2437 bool changed; 2438 int i; 2439 2440 bt_dev_dbg(hdev, "sock %p", sk); 2441 2442 if (!lmp_bredr_capable(hdev)) 2443 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS, 2444 MGMT_STATUS_NOT_SUPPORTED); 2445 2446 key_count = __le16_to_cpu(cp->key_count); 2447 if (key_count > max_key_count) { 2448 bt_dev_err(hdev, "load_link_keys: too big key_count value %u", 2449 key_count); 2450 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS, 2451 MGMT_STATUS_INVALID_PARAMS); 2452 } 2453 2454 expected_len = struct_size(cp, keys, key_count); 2455 if (expected_len != len) { 2456 bt_dev_err(hdev, "load_link_keys: expected %u bytes, got %u bytes", 2457 expected_len, len); 2458 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS, 2459 MGMT_STATUS_INVALID_PARAMS); 2460 } 2461 2462 if (cp->debug_keys != 0x00 && cp->debug_keys != 0x01) 2463 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS, 2464 MGMT_STATUS_INVALID_PARAMS); 2465 2466 bt_dev_dbg(hdev, "debug_keys %u key_count %u", cp->debug_keys, 2467 key_count); 2468 2469 for (i = 0; i < key_count; i++) { 2470 struct mgmt_link_key_info *key = &cp->keys[i]; 2471 2472 if (key->addr.type != BDADDR_BREDR || key->type > 0x08) 2473 return mgmt_cmd_status(sk, hdev->id, 2474 MGMT_OP_LOAD_LINK_KEYS, 2475 MGMT_STATUS_INVALID_PARAMS); 2476 } 2477 2478 hci_dev_lock(hdev); 2479 2480 hci_link_keys_clear(hdev); 2481 2482 if (cp->debug_keys) 2483 changed = !hci_dev_test_and_set_flag(hdev, HCI_KEEP_DEBUG_KEYS); 2484 else 2485 changed = hci_dev_test_and_clear_flag(hdev, 2486 HCI_KEEP_DEBUG_KEYS); 2487 2488 if (changed) 2489 new_settings(hdev, NULL); 2490 2491 for (i = 0; i < key_count; i++) { 2492 struct mgmt_link_key_info *key = &cp->keys[i]; 2493 2494 if (hci_is_blocked_key(hdev, 2495 HCI_BLOCKED_KEY_TYPE_LINKKEY, 2496 key->val)) { 2497 bt_dev_warn(hdev, "Skipping blocked link key for %pMR", 2498 &key->addr.bdaddr); 2499 continue; 2500 } 2501 2502 /* Always ignore debug keys and require a new pairing if 2503 * the user wants to use them. 2504 */ 2505 if (key->type == HCI_LK_DEBUG_COMBINATION) 2506 continue; 2507 2508 hci_add_link_key(hdev, NULL, &key->addr.bdaddr, key->val, 2509 key->type, key->pin_len, NULL); 2510 } 2511 2512 mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS, 0, NULL, 0); 2513 2514 hci_dev_unlock(hdev); 2515 2516 return 0; 2517 } 2518 2519 static int device_unpaired(struct hci_dev *hdev, bdaddr_t *bdaddr, 2520 u8 addr_type, struct sock *skip_sk) 2521 { 2522 struct mgmt_ev_device_unpaired ev; 2523 2524 bacpy(&ev.addr.bdaddr, bdaddr); 2525 ev.addr.type = addr_type; 2526 2527 return mgmt_event(MGMT_EV_DEVICE_UNPAIRED, hdev, &ev, sizeof(ev), 2528 skip_sk); 2529 } 2530 2531 static int unpair_device(struct sock *sk, struct hci_dev *hdev, void *data, 2532 u16 len) 2533 { 2534 struct mgmt_cp_unpair_device *cp = data; 2535 struct mgmt_rp_unpair_device rp; 2536 struct hci_conn_params *params; 2537 struct mgmt_pending_cmd *cmd; 2538 struct hci_conn *conn; 2539 u8 addr_type; 2540 int err; 2541 2542 memset(&rp, 0, sizeof(rp)); 2543 bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr); 2544 rp.addr.type = cp->addr.type; 2545 2546 if (!bdaddr_type_is_valid(cp->addr.type)) 2547 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE, 2548 MGMT_STATUS_INVALID_PARAMS, 2549 &rp, sizeof(rp)); 2550 2551 if (cp->disconnect != 0x00 && cp->disconnect != 0x01) 2552 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE, 2553 MGMT_STATUS_INVALID_PARAMS, 2554 &rp, sizeof(rp)); 2555 2556 hci_dev_lock(hdev); 2557 2558 if (!hdev_is_powered(hdev)) { 2559 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE, 2560 MGMT_STATUS_NOT_POWERED, &rp, 2561 sizeof(rp)); 2562 goto unlock; 2563 } 2564 2565 if (cp->addr.type == BDADDR_BREDR) { 2566 /* If disconnection is requested, then look up the 2567 * connection. If the remote device is connected, it 2568 * will be later used to terminate the link. 2569 * 2570 * Setting it to NULL explicitly will cause no 2571 * termination of the link. 2572 */ 2573 if (cp->disconnect) 2574 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, 2575 &cp->addr.bdaddr); 2576 else 2577 conn = NULL; 2578 2579 err = hci_remove_link_key(hdev, &cp->addr.bdaddr); 2580 if (err < 0) { 2581 err = mgmt_cmd_complete(sk, hdev->id, 2582 MGMT_OP_UNPAIR_DEVICE, 2583 MGMT_STATUS_NOT_PAIRED, &rp, 2584 sizeof(rp)); 2585 goto unlock; 2586 } 2587 2588 goto done; 2589 } 2590 2591 /* LE address type */ 2592 addr_type = le_addr_type(cp->addr.type); 2593 2594 /* Abort any ongoing SMP pairing. Removes ltk and irk if they exist. */ 2595 err = smp_cancel_and_remove_pairing(hdev, &cp->addr.bdaddr, addr_type); 2596 if (err < 0) { 2597 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE, 2598 MGMT_STATUS_NOT_PAIRED, &rp, 2599 sizeof(rp)); 2600 goto unlock; 2601 } 2602 2603 conn = hci_conn_hash_lookup_le(hdev, &cp->addr.bdaddr, addr_type); 2604 if (!conn) { 2605 hci_conn_params_del(hdev, &cp->addr.bdaddr, addr_type); 2606 goto done; 2607 } 2608 2609 2610 /* Defer clearing up the connection parameters until closing to 2611 * give a chance of keeping them if a repairing happens. 2612 */ 2613 set_bit(HCI_CONN_PARAM_REMOVAL_PEND, &conn->flags); 2614 2615 /* Disable auto-connection parameters if present */ 2616 params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr, addr_type); 2617 if (params) { 2618 if (params->explicit_connect) 2619 params->auto_connect = HCI_AUTO_CONN_EXPLICIT; 2620 else 2621 params->auto_connect = HCI_AUTO_CONN_DISABLED; 2622 } 2623 2624 /* If disconnection is not requested, then clear the connection 2625 * variable so that the link is not terminated. 2626 */ 2627 if (!cp->disconnect) 2628 conn = NULL; 2629 2630 done: 2631 /* If the connection variable is set, then termination of the 2632 * link is requested. 2633 */ 2634 if (!conn) { 2635 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE, 0, 2636 &rp, sizeof(rp)); 2637 device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, sk); 2638 goto unlock; 2639 } 2640 2641 cmd = mgmt_pending_add(sk, MGMT_OP_UNPAIR_DEVICE, hdev, cp, 2642 sizeof(*cp)); 2643 if (!cmd) { 2644 err = -ENOMEM; 2645 goto unlock; 2646 } 2647 2648 cmd->cmd_complete = addr_cmd_complete; 2649 2650 err = hci_abort_conn(conn, HCI_ERROR_REMOTE_USER_TERM); 2651 if (err < 0) 2652 mgmt_pending_remove(cmd); 2653 2654 unlock: 2655 hci_dev_unlock(hdev); 2656 return err; 2657 } 2658 2659 static int disconnect(struct sock *sk, struct hci_dev *hdev, void *data, 2660 u16 len) 2661 { 2662 struct mgmt_cp_disconnect *cp = data; 2663 struct mgmt_rp_disconnect rp; 2664 struct mgmt_pending_cmd *cmd; 2665 struct hci_conn *conn; 2666 int err; 2667 2668 bt_dev_dbg(hdev, "sock %p", sk); 2669 2670 memset(&rp, 0, sizeof(rp)); 2671 bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr); 2672 rp.addr.type = cp->addr.type; 2673 2674 if (!bdaddr_type_is_valid(cp->addr.type)) 2675 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT, 2676 MGMT_STATUS_INVALID_PARAMS, 2677 &rp, sizeof(rp)); 2678 2679 hci_dev_lock(hdev); 2680 2681 if (!test_bit(HCI_UP, &hdev->flags)) { 2682 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT, 2683 MGMT_STATUS_NOT_POWERED, &rp, 2684 sizeof(rp)); 2685 goto failed; 2686 } 2687 2688 if (pending_find(MGMT_OP_DISCONNECT, hdev)) { 2689 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT, 2690 MGMT_STATUS_BUSY, &rp, sizeof(rp)); 2691 goto failed; 2692 } 2693 2694 if (cp->addr.type == BDADDR_BREDR) 2695 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, 2696 &cp->addr.bdaddr); 2697 else 2698 conn = hci_conn_hash_lookup_le(hdev, &cp->addr.bdaddr, 2699 le_addr_type(cp->addr.type)); 2700 2701 if (!conn || conn->state == BT_OPEN || conn->state == BT_CLOSED) { 2702 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT, 2703 MGMT_STATUS_NOT_CONNECTED, &rp, 2704 sizeof(rp)); 2705 goto failed; 2706 } 2707 2708 cmd = mgmt_pending_add(sk, MGMT_OP_DISCONNECT, hdev, data, len); 2709 if (!cmd) { 2710 err = -ENOMEM; 2711 goto failed; 2712 } 2713 2714 cmd->cmd_complete = generic_cmd_complete; 2715 2716 err = hci_disconnect(conn, HCI_ERROR_REMOTE_USER_TERM); 2717 if (err < 0) 2718 mgmt_pending_remove(cmd); 2719 2720 failed: 2721 hci_dev_unlock(hdev); 2722 return err; 2723 } 2724 2725 static u8 link_to_bdaddr(u8 link_type, u8 addr_type) 2726 { 2727 switch (link_type) { 2728 case LE_LINK: 2729 switch (addr_type) { 2730 case ADDR_LE_DEV_PUBLIC: 2731 return BDADDR_LE_PUBLIC; 2732 2733 default: 2734 /* Fallback to LE Random address type */ 2735 return BDADDR_LE_RANDOM; 2736 } 2737 2738 default: 2739 /* Fallback to BR/EDR type */ 2740 return BDADDR_BREDR; 2741 } 2742 } 2743 2744 static int get_connections(struct sock *sk, struct hci_dev *hdev, void *data, 2745 u16 data_len) 2746 { 2747 struct mgmt_rp_get_connections *rp; 2748 struct hci_conn *c; 2749 int err; 2750 u16 i; 2751 2752 bt_dev_dbg(hdev, "sock %p", sk); 2753 2754 hci_dev_lock(hdev); 2755 2756 if (!hdev_is_powered(hdev)) { 2757 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_CONNECTIONS, 2758 MGMT_STATUS_NOT_POWERED); 2759 goto unlock; 2760 } 2761 2762 i = 0; 2763 list_for_each_entry(c, &hdev->conn_hash.list, list) { 2764 if (test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags)) 2765 i++; 2766 } 2767 2768 rp = kmalloc(struct_size(rp, addr, i), GFP_KERNEL); 2769 if (!rp) { 2770 err = -ENOMEM; 2771 goto unlock; 2772 } 2773 2774 i = 0; 2775 list_for_each_entry(c, &hdev->conn_hash.list, list) { 2776 if (!test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags)) 2777 continue; 2778 bacpy(&rp->addr[i].bdaddr, &c->dst); 2779 rp->addr[i].type = link_to_bdaddr(c->type, c->dst_type); 2780 if (c->type == SCO_LINK || c->type == ESCO_LINK) 2781 continue; 2782 i++; 2783 } 2784 2785 rp->conn_count = cpu_to_le16(i); 2786 2787 /* Recalculate length in case of filtered SCO connections, etc */ 2788 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONNECTIONS, 0, rp, 2789 struct_size(rp, addr, i)); 2790 2791 kfree(rp); 2792 2793 unlock: 2794 hci_dev_unlock(hdev); 2795 return err; 2796 } 2797 2798 static int send_pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev, 2799 struct mgmt_cp_pin_code_neg_reply *cp) 2800 { 2801 struct mgmt_pending_cmd *cmd; 2802 int err; 2803 2804 cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_NEG_REPLY, hdev, cp, 2805 sizeof(*cp)); 2806 if (!cmd) 2807 return -ENOMEM; 2808 2809 cmd->cmd_complete = addr_cmd_complete; 2810 2811 err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_NEG_REPLY, 2812 sizeof(cp->addr.bdaddr), &cp->addr.bdaddr); 2813 if (err < 0) 2814 mgmt_pending_remove(cmd); 2815 2816 return err; 2817 } 2818 2819 static int pin_code_reply(struct sock *sk, struct hci_dev *hdev, void *data, 2820 u16 len) 2821 { 2822 struct hci_conn *conn; 2823 struct mgmt_cp_pin_code_reply *cp = data; 2824 struct hci_cp_pin_code_reply reply; 2825 struct mgmt_pending_cmd *cmd; 2826 int err; 2827 2828 bt_dev_dbg(hdev, "sock %p", sk); 2829 2830 hci_dev_lock(hdev); 2831 2832 if (!hdev_is_powered(hdev)) { 2833 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY, 2834 MGMT_STATUS_NOT_POWERED); 2835 goto failed; 2836 } 2837 2838 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->addr.bdaddr); 2839 if (!conn) { 2840 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY, 2841 MGMT_STATUS_NOT_CONNECTED); 2842 goto failed; 2843 } 2844 2845 if (conn->pending_sec_level == BT_SECURITY_HIGH && cp->pin_len != 16) { 2846 struct mgmt_cp_pin_code_neg_reply ncp; 2847 2848 memcpy(&ncp.addr, &cp->addr, sizeof(ncp.addr)); 2849 2850 bt_dev_err(hdev, "PIN code is not 16 bytes long"); 2851 2852 err = send_pin_code_neg_reply(sk, hdev, &ncp); 2853 if (err >= 0) 2854 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY, 2855 MGMT_STATUS_INVALID_PARAMS); 2856 2857 goto failed; 2858 } 2859 2860 cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_REPLY, hdev, data, len); 2861 if (!cmd) { 2862 err = -ENOMEM; 2863 goto failed; 2864 } 2865 2866 cmd->cmd_complete = addr_cmd_complete; 2867 2868 bacpy(&reply.bdaddr, &cp->addr.bdaddr); 2869 reply.pin_len = cp->pin_len; 2870 memcpy(reply.pin_code, cp->pin_code, sizeof(reply.pin_code)); 2871 2872 err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_REPLY, sizeof(reply), &reply); 2873 if (err < 0) 2874 mgmt_pending_remove(cmd); 2875 2876 failed: 2877 hci_dev_unlock(hdev); 2878 return err; 2879 } 2880 2881 static int set_io_capability(struct sock *sk, struct hci_dev *hdev, void *data, 2882 u16 len) 2883 { 2884 struct mgmt_cp_set_io_capability *cp = data; 2885 2886 bt_dev_dbg(hdev, "sock %p", sk); 2887 2888 if (cp->io_capability > SMP_IO_KEYBOARD_DISPLAY) 2889 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_IO_CAPABILITY, 2890 MGMT_STATUS_INVALID_PARAMS); 2891 2892 hci_dev_lock(hdev); 2893 2894 hdev->io_capability = cp->io_capability; 2895 2896 bt_dev_dbg(hdev, "IO capability set to 0x%02x", hdev->io_capability); 2897 2898 hci_dev_unlock(hdev); 2899 2900 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_IO_CAPABILITY, 0, 2901 NULL, 0); 2902 } 2903 2904 static struct mgmt_pending_cmd *find_pairing(struct hci_conn *conn) 2905 { 2906 struct hci_dev *hdev = conn->hdev; 2907 struct mgmt_pending_cmd *cmd; 2908 2909 list_for_each_entry(cmd, &hdev->mgmt_pending, list) { 2910 if (cmd->opcode != MGMT_OP_PAIR_DEVICE) 2911 continue; 2912 2913 if (cmd->user_data != conn) 2914 continue; 2915 2916 return cmd; 2917 } 2918 2919 return NULL; 2920 } 2921 2922 static int pairing_complete(struct mgmt_pending_cmd *cmd, u8 status) 2923 { 2924 struct mgmt_rp_pair_device rp; 2925 struct hci_conn *conn = cmd->user_data; 2926 int err; 2927 2928 bacpy(&rp.addr.bdaddr, &conn->dst); 2929 rp.addr.type = link_to_bdaddr(conn->type, conn->dst_type); 2930 2931 err = mgmt_cmd_complete(cmd->sk, cmd->index, MGMT_OP_PAIR_DEVICE, 2932 status, &rp, sizeof(rp)); 2933 2934 /* So we don't get further callbacks for this connection */ 2935 conn->connect_cfm_cb = NULL; 2936 conn->security_cfm_cb = NULL; 2937 conn->disconn_cfm_cb = NULL; 2938 2939 hci_conn_drop(conn); 2940 2941 /* The device is paired so there is no need to remove 2942 * its connection parameters anymore. 2943 */ 2944 clear_bit(HCI_CONN_PARAM_REMOVAL_PEND, &conn->flags); 2945 2946 hci_conn_put(conn); 2947 2948 return err; 2949 } 2950 2951 void mgmt_smp_complete(struct hci_conn *conn, bool complete) 2952 { 2953 u8 status = complete ? MGMT_STATUS_SUCCESS : MGMT_STATUS_FAILED; 2954 struct mgmt_pending_cmd *cmd; 2955 2956 cmd = find_pairing(conn); 2957 if (cmd) { 2958 cmd->cmd_complete(cmd, status); 2959 mgmt_pending_remove(cmd); 2960 } 2961 } 2962 2963 static void pairing_complete_cb(struct hci_conn *conn, u8 status) 2964 { 2965 struct mgmt_pending_cmd *cmd; 2966 2967 BT_DBG("status %u", status); 2968 2969 cmd = find_pairing(conn); 2970 if (!cmd) { 2971 BT_DBG("Unable to find a pending command"); 2972 return; 2973 } 2974 2975 cmd->cmd_complete(cmd, mgmt_status(status)); 2976 mgmt_pending_remove(cmd); 2977 } 2978 2979 static void le_pairing_complete_cb(struct hci_conn *conn, u8 status) 2980 { 2981 struct mgmt_pending_cmd *cmd; 2982 2983 BT_DBG("status %u", status); 2984 2985 if (!status) 2986 return; 2987 2988 cmd = find_pairing(conn); 2989 if (!cmd) { 2990 BT_DBG("Unable to find a pending command"); 2991 return; 2992 } 2993 2994 cmd->cmd_complete(cmd, mgmt_status(status)); 2995 mgmt_pending_remove(cmd); 2996 } 2997 2998 static int pair_device(struct sock *sk, struct hci_dev *hdev, void *data, 2999 u16 len) 3000 { 3001 struct mgmt_cp_pair_device *cp = data; 3002 struct mgmt_rp_pair_device rp; 3003 struct mgmt_pending_cmd *cmd; 3004 u8 sec_level, auth_type; 3005 struct hci_conn *conn; 3006 int err; 3007 3008 bt_dev_dbg(hdev, "sock %p", sk); 3009 3010 memset(&rp, 0, sizeof(rp)); 3011 bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr); 3012 rp.addr.type = cp->addr.type; 3013 3014 if (!bdaddr_type_is_valid(cp->addr.type)) 3015 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE, 3016 MGMT_STATUS_INVALID_PARAMS, 3017 &rp, sizeof(rp)); 3018 3019 if (cp->io_cap > SMP_IO_KEYBOARD_DISPLAY) 3020 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE, 3021 MGMT_STATUS_INVALID_PARAMS, 3022 &rp, sizeof(rp)); 3023 3024 hci_dev_lock(hdev); 3025 3026 if (!hdev_is_powered(hdev)) { 3027 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE, 3028 MGMT_STATUS_NOT_POWERED, &rp, 3029 sizeof(rp)); 3030 goto unlock; 3031 } 3032 3033 if (hci_bdaddr_is_paired(hdev, &cp->addr.bdaddr, cp->addr.type)) { 3034 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE, 3035 MGMT_STATUS_ALREADY_PAIRED, &rp, 3036 sizeof(rp)); 3037 goto unlock; 3038 } 3039 3040 sec_level = BT_SECURITY_MEDIUM; 3041 auth_type = HCI_AT_DEDICATED_BONDING; 3042 3043 if (cp->addr.type == BDADDR_BREDR) { 3044 conn = hci_connect_acl(hdev, &cp->addr.bdaddr, sec_level, 3045 auth_type, CONN_REASON_PAIR_DEVICE); 3046 } else { 3047 u8 addr_type = le_addr_type(cp->addr.type); 3048 struct hci_conn_params *p; 3049 3050 /* When pairing a new device, it is expected to remember 3051 * this device for future connections. Adding the connection 3052 * parameter information ahead of time allows tracking 3053 * of the peripheral preferred values and will speed up any 3054 * further connection establishment. 3055 * 3056 * If connection parameters already exist, then they 3057 * will be kept and this function does nothing. 3058 */ 3059 p = hci_conn_params_add(hdev, &cp->addr.bdaddr, addr_type); 3060 3061 if (p->auto_connect == HCI_AUTO_CONN_EXPLICIT) 3062 p->auto_connect = HCI_AUTO_CONN_DISABLED; 3063 3064 conn = hci_connect_le_scan(hdev, &cp->addr.bdaddr, addr_type, 3065 sec_level, HCI_LE_CONN_TIMEOUT, 3066 CONN_REASON_PAIR_DEVICE); 3067 } 3068 3069 if (IS_ERR(conn)) { 3070 int status; 3071 3072 if (PTR_ERR(conn) == -EBUSY) 3073 status = MGMT_STATUS_BUSY; 3074 else if (PTR_ERR(conn) == -EOPNOTSUPP) 3075 status = MGMT_STATUS_NOT_SUPPORTED; 3076 else if (PTR_ERR(conn) == -ECONNREFUSED) 3077 status = MGMT_STATUS_REJECTED; 3078 else 3079 status = MGMT_STATUS_CONNECT_FAILED; 3080 3081 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE, 3082 status, &rp, sizeof(rp)); 3083 goto unlock; 3084 } 3085 3086 if (conn->connect_cfm_cb) { 3087 hci_conn_drop(conn); 3088 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE, 3089 MGMT_STATUS_BUSY, &rp, sizeof(rp)); 3090 goto unlock; 3091 } 3092 3093 cmd = mgmt_pending_add(sk, MGMT_OP_PAIR_DEVICE, hdev, data, len); 3094 if (!cmd) { 3095 err = -ENOMEM; 3096 hci_conn_drop(conn); 3097 goto unlock; 3098 } 3099 3100 cmd->cmd_complete = pairing_complete; 3101 3102 /* For LE, just connecting isn't a proof that the pairing finished */ 3103 if (cp->addr.type == BDADDR_BREDR) { 3104 conn->connect_cfm_cb = pairing_complete_cb; 3105 conn->security_cfm_cb = pairing_complete_cb; 3106 conn->disconn_cfm_cb = pairing_complete_cb; 3107 } else { 3108 conn->connect_cfm_cb = le_pairing_complete_cb; 3109 conn->security_cfm_cb = le_pairing_complete_cb; 3110 conn->disconn_cfm_cb = le_pairing_complete_cb; 3111 } 3112 3113 conn->io_capability = cp->io_cap; 3114 cmd->user_data = hci_conn_get(conn); 3115 3116 if ((conn->state == BT_CONNECTED || conn->state == BT_CONFIG) && 3117 hci_conn_security(conn, sec_level, auth_type, true)) { 3118 cmd->cmd_complete(cmd, 0); 3119 mgmt_pending_remove(cmd); 3120 } 3121 3122 err = 0; 3123 3124 unlock: 3125 hci_dev_unlock(hdev); 3126 return err; 3127 } 3128 3129 static int cancel_pair_device(struct sock *sk, struct hci_dev *hdev, void *data, 3130 u16 len) 3131 { 3132 struct mgmt_addr_info *addr = data; 3133 struct mgmt_pending_cmd *cmd; 3134 struct hci_conn *conn; 3135 int err; 3136 3137 bt_dev_dbg(hdev, "sock %p", sk); 3138 3139 hci_dev_lock(hdev); 3140 3141 if (!hdev_is_powered(hdev)) { 3142 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE, 3143 MGMT_STATUS_NOT_POWERED); 3144 goto unlock; 3145 } 3146 3147 cmd = pending_find(MGMT_OP_PAIR_DEVICE, hdev); 3148 if (!cmd) { 3149 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE, 3150 MGMT_STATUS_INVALID_PARAMS); 3151 goto unlock; 3152 } 3153 3154 conn = cmd->user_data; 3155 3156 if (bacmp(&addr->bdaddr, &conn->dst) != 0) { 3157 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE, 3158 MGMT_STATUS_INVALID_PARAMS); 3159 goto unlock; 3160 } 3161 3162 cmd->cmd_complete(cmd, MGMT_STATUS_CANCELLED); 3163 mgmt_pending_remove(cmd); 3164 3165 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE, 0, 3166 addr, sizeof(*addr)); 3167 3168 /* Since user doesn't want to proceed with the connection, abort any 3169 * ongoing pairing and then terminate the link if it was created 3170 * because of the pair device action. 3171 */ 3172 if (addr->type == BDADDR_BREDR) 3173 hci_remove_link_key(hdev, &addr->bdaddr); 3174 else 3175 smp_cancel_and_remove_pairing(hdev, &addr->bdaddr, 3176 le_addr_type(addr->type)); 3177 3178 if (conn->conn_reason == CONN_REASON_PAIR_DEVICE) 3179 hci_abort_conn(conn, HCI_ERROR_REMOTE_USER_TERM); 3180 3181 unlock: 3182 hci_dev_unlock(hdev); 3183 return err; 3184 } 3185 3186 static int user_pairing_resp(struct sock *sk, struct hci_dev *hdev, 3187 struct mgmt_addr_info *addr, u16 mgmt_op, 3188 u16 hci_op, __le32 passkey) 3189 { 3190 struct mgmt_pending_cmd *cmd; 3191 struct hci_conn *conn; 3192 int err; 3193 3194 hci_dev_lock(hdev); 3195 3196 if (!hdev_is_powered(hdev)) { 3197 err = mgmt_cmd_complete(sk, hdev->id, mgmt_op, 3198 MGMT_STATUS_NOT_POWERED, addr, 3199 sizeof(*addr)); 3200 goto done; 3201 } 3202 3203 if (addr->type == BDADDR_BREDR) 3204 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &addr->bdaddr); 3205 else 3206 conn = hci_conn_hash_lookup_le(hdev, &addr->bdaddr, 3207 le_addr_type(addr->type)); 3208 3209 if (!conn) { 3210 err = mgmt_cmd_complete(sk, hdev->id, mgmt_op, 3211 MGMT_STATUS_NOT_CONNECTED, addr, 3212 sizeof(*addr)); 3213 goto done; 3214 } 3215 3216 if (addr->type == BDADDR_LE_PUBLIC || addr->type == BDADDR_LE_RANDOM) { 3217 err = smp_user_confirm_reply(conn, mgmt_op, passkey); 3218 if (!err) 3219 err = mgmt_cmd_complete(sk, hdev->id, mgmt_op, 3220 MGMT_STATUS_SUCCESS, addr, 3221 sizeof(*addr)); 3222 else 3223 err = mgmt_cmd_complete(sk, hdev->id, mgmt_op, 3224 MGMT_STATUS_FAILED, addr, 3225 sizeof(*addr)); 3226 3227 goto done; 3228 } 3229 3230 cmd = mgmt_pending_add(sk, mgmt_op, hdev, addr, sizeof(*addr)); 3231 if (!cmd) { 3232 err = -ENOMEM; 3233 goto done; 3234 } 3235 3236 cmd->cmd_complete = addr_cmd_complete; 3237 3238 /* Continue with pairing via HCI */ 3239 if (hci_op == HCI_OP_USER_PASSKEY_REPLY) { 3240 struct hci_cp_user_passkey_reply cp; 3241 3242 bacpy(&cp.bdaddr, &addr->bdaddr); 3243 cp.passkey = passkey; 3244 err = hci_send_cmd(hdev, hci_op, sizeof(cp), &cp); 3245 } else 3246 err = hci_send_cmd(hdev, hci_op, sizeof(addr->bdaddr), 3247 &addr->bdaddr); 3248 3249 if (err < 0) 3250 mgmt_pending_remove(cmd); 3251 3252 done: 3253 hci_dev_unlock(hdev); 3254 return err; 3255 } 3256 3257 static int pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev, 3258 void *data, u16 len) 3259 { 3260 struct mgmt_cp_pin_code_neg_reply *cp = data; 3261 3262 bt_dev_dbg(hdev, "sock %p", sk); 3263 3264 return user_pairing_resp(sk, hdev, &cp->addr, 3265 MGMT_OP_PIN_CODE_NEG_REPLY, 3266 HCI_OP_PIN_CODE_NEG_REPLY, 0); 3267 } 3268 3269 static int user_confirm_reply(struct sock *sk, struct hci_dev *hdev, void *data, 3270 u16 len) 3271 { 3272 struct mgmt_cp_user_confirm_reply *cp = data; 3273 3274 bt_dev_dbg(hdev, "sock %p", sk); 3275 3276 if (len != sizeof(*cp)) 3277 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_USER_CONFIRM_REPLY, 3278 MGMT_STATUS_INVALID_PARAMS); 3279 3280 return user_pairing_resp(sk, hdev, &cp->addr, 3281 MGMT_OP_USER_CONFIRM_REPLY, 3282 HCI_OP_USER_CONFIRM_REPLY, 0); 3283 } 3284 3285 static int user_confirm_neg_reply(struct sock *sk, struct hci_dev *hdev, 3286 void *data, u16 len) 3287 { 3288 struct mgmt_cp_user_confirm_neg_reply *cp = data; 3289 3290 bt_dev_dbg(hdev, "sock %p", sk); 3291 3292 return user_pairing_resp(sk, hdev, &cp->addr, 3293 MGMT_OP_USER_CONFIRM_NEG_REPLY, 3294 HCI_OP_USER_CONFIRM_NEG_REPLY, 0); 3295 } 3296 3297 static int user_passkey_reply(struct sock *sk, struct hci_dev *hdev, void *data, 3298 u16 len) 3299 { 3300 struct mgmt_cp_user_passkey_reply *cp = data; 3301 3302 bt_dev_dbg(hdev, "sock %p", sk); 3303 3304 return user_pairing_resp(sk, hdev, &cp->addr, 3305 MGMT_OP_USER_PASSKEY_REPLY, 3306 HCI_OP_USER_PASSKEY_REPLY, cp->passkey); 3307 } 3308 3309 static int user_passkey_neg_reply(struct sock *sk, struct hci_dev *hdev, 3310 void *data, u16 len) 3311 { 3312 struct mgmt_cp_user_passkey_neg_reply *cp = data; 3313 3314 bt_dev_dbg(hdev, "sock %p", sk); 3315 3316 return user_pairing_resp(sk, hdev, &cp->addr, 3317 MGMT_OP_USER_PASSKEY_NEG_REPLY, 3318 HCI_OP_USER_PASSKEY_NEG_REPLY, 0); 3319 } 3320 3321 static int adv_expire_sync(struct hci_dev *hdev, u32 flags) 3322 { 3323 struct adv_info *adv_instance; 3324 3325 adv_instance = hci_find_adv_instance(hdev, hdev->cur_adv_instance); 3326 if (!adv_instance) 3327 return 0; 3328 3329 /* stop if current instance doesn't need to be changed */ 3330 if (!(adv_instance->flags & flags)) 3331 return 0; 3332 3333 cancel_adv_timeout(hdev); 3334 3335 adv_instance = hci_get_next_instance(hdev, adv_instance->instance); 3336 if (!adv_instance) 3337 return 0; 3338 3339 hci_schedule_adv_instance_sync(hdev, adv_instance->instance, true); 3340 3341 return 0; 3342 } 3343 3344 static int name_changed_sync(struct hci_dev *hdev, void *data) 3345 { 3346 return adv_expire_sync(hdev, MGMT_ADV_FLAG_LOCAL_NAME); 3347 } 3348 3349 static void set_name_complete(struct hci_dev *hdev, void *data, int err) 3350 { 3351 struct mgmt_pending_cmd *cmd = data; 3352 struct mgmt_cp_set_local_name *cp = cmd->param; 3353 u8 status = mgmt_status(err); 3354 3355 bt_dev_dbg(hdev, "err %d", err); 3356 3357 if (cmd != pending_find(MGMT_OP_SET_LOCAL_NAME, hdev)) 3358 return; 3359 3360 if (status) { 3361 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 3362 status); 3363 } else { 3364 mgmt_cmd_complete(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0, 3365 cp, sizeof(*cp)); 3366 3367 if (hci_dev_test_flag(hdev, HCI_LE_ADV)) 3368 hci_cmd_sync_queue(hdev, name_changed_sync, NULL, NULL); 3369 } 3370 3371 mgmt_pending_remove(cmd); 3372 } 3373 3374 static int set_name_sync(struct hci_dev *hdev, void *data) 3375 { 3376 if (lmp_bredr_capable(hdev)) { 3377 hci_update_name_sync(hdev); 3378 hci_update_eir_sync(hdev); 3379 } 3380 3381 /* The name is stored in the scan response data and so 3382 * no need to update the advertising data here. 3383 */ 3384 if (lmp_le_capable(hdev) && hci_dev_test_flag(hdev, HCI_ADVERTISING)) 3385 hci_update_scan_rsp_data_sync(hdev, hdev->cur_adv_instance); 3386 3387 return 0; 3388 } 3389 3390 static int set_local_name(struct sock *sk, struct hci_dev *hdev, void *data, 3391 u16 len) 3392 { 3393 struct mgmt_cp_set_local_name *cp = data; 3394 struct mgmt_pending_cmd *cmd; 3395 int err; 3396 3397 bt_dev_dbg(hdev, "sock %p", sk); 3398 3399 hci_dev_lock(hdev); 3400 3401 /* If the old values are the same as the new ones just return a 3402 * direct command complete event. 3403 */ 3404 if (!memcmp(hdev->dev_name, cp->name, sizeof(hdev->dev_name)) && 3405 !memcmp(hdev->short_name, cp->short_name, 3406 sizeof(hdev->short_name))) { 3407 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0, 3408 data, len); 3409 goto failed; 3410 } 3411 3412 memcpy(hdev->short_name, cp->short_name, sizeof(hdev->short_name)); 3413 3414 if (!hdev_is_powered(hdev)) { 3415 memcpy(hdev->dev_name, cp->name, sizeof(hdev->dev_name)); 3416 3417 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0, 3418 data, len); 3419 if (err < 0) 3420 goto failed; 3421 3422 err = mgmt_limited_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, data, 3423 len, HCI_MGMT_LOCAL_NAME_EVENTS, sk); 3424 ext_info_changed(hdev, sk); 3425 3426 goto failed; 3427 } 3428 3429 cmd = mgmt_pending_add(sk, MGMT_OP_SET_LOCAL_NAME, hdev, data, len); 3430 if (!cmd) 3431 err = -ENOMEM; 3432 else 3433 err = hci_cmd_sync_queue(hdev, set_name_sync, cmd, 3434 set_name_complete); 3435 3436 if (err < 0) { 3437 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 3438 MGMT_STATUS_FAILED); 3439 3440 if (cmd) 3441 mgmt_pending_remove(cmd); 3442 3443 goto failed; 3444 } 3445 3446 memcpy(hdev->dev_name, cp->name, sizeof(hdev->dev_name)); 3447 3448 failed: 3449 hci_dev_unlock(hdev); 3450 return err; 3451 } 3452 3453 static int appearance_changed_sync(struct hci_dev *hdev, void *data) 3454 { 3455 return adv_expire_sync(hdev, MGMT_ADV_FLAG_APPEARANCE); 3456 } 3457 3458 static int set_appearance(struct sock *sk, struct hci_dev *hdev, void *data, 3459 u16 len) 3460 { 3461 struct mgmt_cp_set_appearance *cp = data; 3462 u16 appearance; 3463 int err; 3464 3465 bt_dev_dbg(hdev, "sock %p", sk); 3466 3467 if (!lmp_le_capable(hdev)) 3468 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_APPEARANCE, 3469 MGMT_STATUS_NOT_SUPPORTED); 3470 3471 appearance = le16_to_cpu(cp->appearance); 3472 3473 hci_dev_lock(hdev); 3474 3475 if (hdev->appearance != appearance) { 3476 hdev->appearance = appearance; 3477 3478 if (hci_dev_test_flag(hdev, HCI_LE_ADV)) 3479 hci_cmd_sync_queue(hdev, appearance_changed_sync, NULL, 3480 NULL); 3481 3482 ext_info_changed(hdev, sk); 3483 } 3484 3485 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_APPEARANCE, 0, NULL, 3486 0); 3487 3488 hci_dev_unlock(hdev); 3489 3490 return err; 3491 } 3492 3493 static int get_phy_configuration(struct sock *sk, struct hci_dev *hdev, 3494 void *data, u16 len) 3495 { 3496 struct mgmt_rp_get_phy_configuration rp; 3497 3498 bt_dev_dbg(hdev, "sock %p", sk); 3499 3500 hci_dev_lock(hdev); 3501 3502 memset(&rp, 0, sizeof(rp)); 3503 3504 rp.supported_phys = cpu_to_le32(get_supported_phys(hdev)); 3505 rp.selected_phys = cpu_to_le32(get_selected_phys(hdev)); 3506 rp.configurable_phys = cpu_to_le32(get_configurable_phys(hdev)); 3507 3508 hci_dev_unlock(hdev); 3509 3510 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_PHY_CONFIGURATION, 0, 3511 &rp, sizeof(rp)); 3512 } 3513 3514 int mgmt_phy_configuration_changed(struct hci_dev *hdev, struct sock *skip) 3515 { 3516 struct mgmt_ev_phy_configuration_changed ev; 3517 3518 memset(&ev, 0, sizeof(ev)); 3519 3520 ev.selected_phys = cpu_to_le32(get_selected_phys(hdev)); 3521 3522 return mgmt_event(MGMT_EV_PHY_CONFIGURATION_CHANGED, hdev, &ev, 3523 sizeof(ev), skip); 3524 } 3525 3526 static void set_default_phy_complete(struct hci_dev *hdev, void *data, int err) 3527 { 3528 struct mgmt_pending_cmd *cmd = data; 3529 struct sk_buff *skb = cmd->skb; 3530 u8 status = mgmt_status(err); 3531 3532 if (cmd != pending_find(MGMT_OP_SET_PHY_CONFIGURATION, hdev)) 3533 return; 3534 3535 if (!status) { 3536 if (!skb) 3537 status = MGMT_STATUS_FAILED; 3538 else if (IS_ERR(skb)) 3539 status = mgmt_status(PTR_ERR(skb)); 3540 else 3541 status = mgmt_status(skb->data[0]); 3542 } 3543 3544 bt_dev_dbg(hdev, "status %d", status); 3545 3546 if (status) { 3547 mgmt_cmd_status(cmd->sk, hdev->id, 3548 MGMT_OP_SET_PHY_CONFIGURATION, status); 3549 } else { 3550 mgmt_cmd_complete(cmd->sk, hdev->id, 3551 MGMT_OP_SET_PHY_CONFIGURATION, 0, 3552 NULL, 0); 3553 3554 mgmt_phy_configuration_changed(hdev, cmd->sk); 3555 } 3556 3557 if (skb && !IS_ERR(skb)) 3558 kfree_skb(skb); 3559 3560 mgmt_pending_remove(cmd); 3561 } 3562 3563 static int set_default_phy_sync(struct hci_dev *hdev, void *data) 3564 { 3565 struct mgmt_pending_cmd *cmd = data; 3566 struct mgmt_cp_set_phy_configuration *cp = cmd->param; 3567 struct hci_cp_le_set_default_phy cp_phy; 3568 u32 selected_phys = __le32_to_cpu(cp->selected_phys); 3569 3570 memset(&cp_phy, 0, sizeof(cp_phy)); 3571 3572 if (!(selected_phys & MGMT_PHY_LE_TX_MASK)) 3573 cp_phy.all_phys |= 0x01; 3574 3575 if (!(selected_phys & MGMT_PHY_LE_RX_MASK)) 3576 cp_phy.all_phys |= 0x02; 3577 3578 if (selected_phys & MGMT_PHY_LE_1M_TX) 3579 cp_phy.tx_phys |= HCI_LE_SET_PHY_1M; 3580 3581 if (selected_phys & MGMT_PHY_LE_2M_TX) 3582 cp_phy.tx_phys |= HCI_LE_SET_PHY_2M; 3583 3584 if (selected_phys & MGMT_PHY_LE_CODED_TX) 3585 cp_phy.tx_phys |= HCI_LE_SET_PHY_CODED; 3586 3587 if (selected_phys & MGMT_PHY_LE_1M_RX) 3588 cp_phy.rx_phys |= HCI_LE_SET_PHY_1M; 3589 3590 if (selected_phys & MGMT_PHY_LE_2M_RX) 3591 cp_phy.rx_phys |= HCI_LE_SET_PHY_2M; 3592 3593 if (selected_phys & MGMT_PHY_LE_CODED_RX) 3594 cp_phy.rx_phys |= HCI_LE_SET_PHY_CODED; 3595 3596 cmd->skb = __hci_cmd_sync(hdev, HCI_OP_LE_SET_DEFAULT_PHY, 3597 sizeof(cp_phy), &cp_phy, HCI_CMD_TIMEOUT); 3598 3599 return 0; 3600 } 3601 3602 static int set_phy_configuration(struct sock *sk, struct hci_dev *hdev, 3603 void *data, u16 len) 3604 { 3605 struct mgmt_cp_set_phy_configuration *cp = data; 3606 struct mgmt_pending_cmd *cmd; 3607 u32 selected_phys, configurable_phys, supported_phys, unconfigure_phys; 3608 u16 pkt_type = (HCI_DH1 | HCI_DM1); 3609 bool changed = false; 3610 int err; 3611 3612 bt_dev_dbg(hdev, "sock %p", sk); 3613 3614 configurable_phys = get_configurable_phys(hdev); 3615 supported_phys = get_supported_phys(hdev); 3616 selected_phys = __le32_to_cpu(cp->selected_phys); 3617 3618 if (selected_phys & ~supported_phys) 3619 return mgmt_cmd_status(sk, hdev->id, 3620 MGMT_OP_SET_PHY_CONFIGURATION, 3621 MGMT_STATUS_INVALID_PARAMS); 3622 3623 unconfigure_phys = supported_phys & ~configurable_phys; 3624 3625 if ((selected_phys & unconfigure_phys) != unconfigure_phys) 3626 return mgmt_cmd_status(sk, hdev->id, 3627 MGMT_OP_SET_PHY_CONFIGURATION, 3628 MGMT_STATUS_INVALID_PARAMS); 3629 3630 if (selected_phys == get_selected_phys(hdev)) 3631 return mgmt_cmd_complete(sk, hdev->id, 3632 MGMT_OP_SET_PHY_CONFIGURATION, 3633 0, NULL, 0); 3634 3635 hci_dev_lock(hdev); 3636 3637 if (!hdev_is_powered(hdev)) { 3638 err = mgmt_cmd_status(sk, hdev->id, 3639 MGMT_OP_SET_PHY_CONFIGURATION, 3640 MGMT_STATUS_REJECTED); 3641 goto unlock; 3642 } 3643 3644 if (pending_find(MGMT_OP_SET_PHY_CONFIGURATION, hdev)) { 3645 err = mgmt_cmd_status(sk, hdev->id, 3646 MGMT_OP_SET_PHY_CONFIGURATION, 3647 MGMT_STATUS_BUSY); 3648 goto unlock; 3649 } 3650 3651 if (selected_phys & MGMT_PHY_BR_1M_3SLOT) 3652 pkt_type |= (HCI_DH3 | HCI_DM3); 3653 else 3654 pkt_type &= ~(HCI_DH3 | HCI_DM3); 3655 3656 if (selected_phys & MGMT_PHY_BR_1M_5SLOT) 3657 pkt_type |= (HCI_DH5 | HCI_DM5); 3658 else 3659 pkt_type &= ~(HCI_DH5 | HCI_DM5); 3660 3661 if (selected_phys & MGMT_PHY_EDR_2M_1SLOT) 3662 pkt_type &= ~HCI_2DH1; 3663 else 3664 pkt_type |= HCI_2DH1; 3665 3666 if (selected_phys & MGMT_PHY_EDR_2M_3SLOT) 3667 pkt_type &= ~HCI_2DH3; 3668 else 3669 pkt_type |= HCI_2DH3; 3670 3671 if (selected_phys & MGMT_PHY_EDR_2M_5SLOT) 3672 pkt_type &= ~HCI_2DH5; 3673 else 3674 pkt_type |= HCI_2DH5; 3675 3676 if (selected_phys & MGMT_PHY_EDR_3M_1SLOT) 3677 pkt_type &= ~HCI_3DH1; 3678 else 3679 pkt_type |= HCI_3DH1; 3680 3681 if (selected_phys & MGMT_PHY_EDR_3M_3SLOT) 3682 pkt_type &= ~HCI_3DH3; 3683 else 3684 pkt_type |= HCI_3DH3; 3685 3686 if (selected_phys & MGMT_PHY_EDR_3M_5SLOT) 3687 pkt_type &= ~HCI_3DH5; 3688 else 3689 pkt_type |= HCI_3DH5; 3690 3691 if (pkt_type != hdev->pkt_type) { 3692 hdev->pkt_type = pkt_type; 3693 changed = true; 3694 } 3695 3696 if ((selected_phys & MGMT_PHY_LE_MASK) == 3697 (get_selected_phys(hdev) & MGMT_PHY_LE_MASK)) { 3698 if (changed) 3699 mgmt_phy_configuration_changed(hdev, sk); 3700 3701 err = mgmt_cmd_complete(sk, hdev->id, 3702 MGMT_OP_SET_PHY_CONFIGURATION, 3703 0, NULL, 0); 3704 3705 goto unlock; 3706 } 3707 3708 cmd = mgmt_pending_add(sk, MGMT_OP_SET_PHY_CONFIGURATION, hdev, data, 3709 len); 3710 if (!cmd) 3711 err = -ENOMEM; 3712 else 3713 err = hci_cmd_sync_queue(hdev, set_default_phy_sync, cmd, 3714 set_default_phy_complete); 3715 3716 if (err < 0) { 3717 err = mgmt_cmd_status(sk, hdev->id, 3718 MGMT_OP_SET_PHY_CONFIGURATION, 3719 MGMT_STATUS_FAILED); 3720 3721 if (cmd) 3722 mgmt_pending_remove(cmd); 3723 } 3724 3725 unlock: 3726 hci_dev_unlock(hdev); 3727 3728 return err; 3729 } 3730 3731 static int set_blocked_keys(struct sock *sk, struct hci_dev *hdev, void *data, 3732 u16 len) 3733 { 3734 int err = MGMT_STATUS_SUCCESS; 3735 struct mgmt_cp_set_blocked_keys *keys = data; 3736 const u16 max_key_count = ((U16_MAX - sizeof(*keys)) / 3737 sizeof(struct mgmt_blocked_key_info)); 3738 u16 key_count, expected_len; 3739 int i; 3740 3741 bt_dev_dbg(hdev, "sock %p", sk); 3742 3743 key_count = __le16_to_cpu(keys->key_count); 3744 if (key_count > max_key_count) { 3745 bt_dev_err(hdev, "too big key_count value %u", key_count); 3746 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BLOCKED_KEYS, 3747 MGMT_STATUS_INVALID_PARAMS); 3748 } 3749 3750 expected_len = struct_size(keys, keys, key_count); 3751 if (expected_len != len) { 3752 bt_dev_err(hdev, "expected %u bytes, got %u bytes", 3753 expected_len, len); 3754 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BLOCKED_KEYS, 3755 MGMT_STATUS_INVALID_PARAMS); 3756 } 3757 3758 hci_dev_lock(hdev); 3759 3760 hci_blocked_keys_clear(hdev); 3761 3762 for (i = 0; i < keys->key_count; ++i) { 3763 struct blocked_key *b = kzalloc(sizeof(*b), GFP_KERNEL); 3764 3765 if (!b) { 3766 err = MGMT_STATUS_NO_RESOURCES; 3767 break; 3768 } 3769 3770 b->type = keys->keys[i].type; 3771 memcpy(b->val, keys->keys[i].val, sizeof(b->val)); 3772 list_add_rcu(&b->list, &hdev->blocked_keys); 3773 } 3774 hci_dev_unlock(hdev); 3775 3776 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_BLOCKED_KEYS, 3777 err, NULL, 0); 3778 } 3779 3780 static int set_wideband_speech(struct sock *sk, struct hci_dev *hdev, 3781 void *data, u16 len) 3782 { 3783 struct mgmt_mode *cp = data; 3784 int err; 3785 bool changed = false; 3786 3787 bt_dev_dbg(hdev, "sock %p", sk); 3788 3789 if (!test_bit(HCI_QUIRK_WIDEBAND_SPEECH_SUPPORTED, &hdev->quirks)) 3790 return mgmt_cmd_status(sk, hdev->id, 3791 MGMT_OP_SET_WIDEBAND_SPEECH, 3792 MGMT_STATUS_NOT_SUPPORTED); 3793 3794 if (cp->val != 0x00 && cp->val != 0x01) 3795 return mgmt_cmd_status(sk, hdev->id, 3796 MGMT_OP_SET_WIDEBAND_SPEECH, 3797 MGMT_STATUS_INVALID_PARAMS); 3798 3799 hci_dev_lock(hdev); 3800 3801 if (hdev_is_powered(hdev) && 3802 !!cp->val != hci_dev_test_flag(hdev, 3803 HCI_WIDEBAND_SPEECH_ENABLED)) { 3804 err = mgmt_cmd_status(sk, hdev->id, 3805 MGMT_OP_SET_WIDEBAND_SPEECH, 3806 MGMT_STATUS_REJECTED); 3807 goto unlock; 3808 } 3809 3810 if (cp->val) 3811 changed = !hci_dev_test_and_set_flag(hdev, 3812 HCI_WIDEBAND_SPEECH_ENABLED); 3813 else 3814 changed = hci_dev_test_and_clear_flag(hdev, 3815 HCI_WIDEBAND_SPEECH_ENABLED); 3816 3817 err = send_settings_rsp(sk, MGMT_OP_SET_WIDEBAND_SPEECH, hdev); 3818 if (err < 0) 3819 goto unlock; 3820 3821 if (changed) 3822 err = new_settings(hdev, sk); 3823 3824 unlock: 3825 hci_dev_unlock(hdev); 3826 return err; 3827 } 3828 3829 static int read_controller_cap(struct sock *sk, struct hci_dev *hdev, 3830 void *data, u16 data_len) 3831 { 3832 char buf[20]; 3833 struct mgmt_rp_read_controller_cap *rp = (void *)buf; 3834 u16 cap_len = 0; 3835 u8 flags = 0; 3836 u8 tx_power_range[2]; 3837 3838 bt_dev_dbg(hdev, "sock %p", sk); 3839 3840 memset(&buf, 0, sizeof(buf)); 3841 3842 hci_dev_lock(hdev); 3843 3844 /* When the Read Simple Pairing Options command is supported, then 3845 * the remote public key validation is supported. 3846 * 3847 * Alternatively, when Microsoft extensions are available, they can 3848 * indicate support for public key validation as well. 3849 */ 3850 if ((hdev->commands[41] & 0x08) || msft_curve_validity(hdev)) 3851 flags |= 0x01; /* Remote public key validation (BR/EDR) */ 3852 3853 flags |= 0x02; /* Remote public key validation (LE) */ 3854 3855 /* When the Read Encryption Key Size command is supported, then the 3856 * encryption key size is enforced. 3857 */ 3858 if (hdev->commands[20] & 0x10) 3859 flags |= 0x04; /* Encryption key size enforcement (BR/EDR) */ 3860 3861 flags |= 0x08; /* Encryption key size enforcement (LE) */ 3862 3863 cap_len = eir_append_data(rp->cap, cap_len, MGMT_CAP_SEC_FLAGS, 3864 &flags, 1); 3865 3866 /* When the Read Simple Pairing Options command is supported, then 3867 * also max encryption key size information is provided. 3868 */ 3869 if (hdev->commands[41] & 0x08) 3870 cap_len = eir_append_le16(rp->cap, cap_len, 3871 MGMT_CAP_MAX_ENC_KEY_SIZE, 3872 hdev->max_enc_key_size); 3873 3874 cap_len = eir_append_le16(rp->cap, cap_len, 3875 MGMT_CAP_SMP_MAX_ENC_KEY_SIZE, 3876 SMP_MAX_ENC_KEY_SIZE); 3877 3878 /* Append the min/max LE tx power parameters if we were able to fetch 3879 * it from the controller 3880 */ 3881 if (hdev->commands[38] & 0x80) { 3882 memcpy(&tx_power_range[0], &hdev->min_le_tx_power, 1); 3883 memcpy(&tx_power_range[1], &hdev->max_le_tx_power, 1); 3884 cap_len = eir_append_data(rp->cap, cap_len, MGMT_CAP_LE_TX_PWR, 3885 tx_power_range, 2); 3886 } 3887 3888 rp->cap_len = cpu_to_le16(cap_len); 3889 3890 hci_dev_unlock(hdev); 3891 3892 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_CONTROLLER_CAP, 0, 3893 rp, sizeof(*rp) + cap_len); 3894 } 3895 3896 #ifdef CONFIG_BT_FEATURE_DEBUG 3897 /* d4992530-b9ec-469f-ab01-6c481c47da1c */ 3898 static const u8 debug_uuid[16] = { 3899 0x1c, 0xda, 0x47, 0x1c, 0x48, 0x6c, 0x01, 0xab, 3900 0x9f, 0x46, 0xec, 0xb9, 0x30, 0x25, 0x99, 0xd4, 3901 }; 3902 #endif 3903 3904 /* 330859bc-7506-492d-9370-9a6f0614037f */ 3905 static const u8 quality_report_uuid[16] = { 3906 0x7f, 0x03, 0x14, 0x06, 0x6f, 0x9a, 0x70, 0x93, 3907 0x2d, 0x49, 0x06, 0x75, 0xbc, 0x59, 0x08, 0x33, 3908 }; 3909 3910 /* a6695ace-ee7f-4fb9-881a-5fac66c629af */ 3911 static const u8 offload_codecs_uuid[16] = { 3912 0xaf, 0x29, 0xc6, 0x66, 0xac, 0x5f, 0x1a, 0x88, 3913 0xb9, 0x4f, 0x7f, 0xee, 0xce, 0x5a, 0x69, 0xa6, 3914 }; 3915 3916 /* 671b10b5-42c0-4696-9227-eb28d1b049d6 */ 3917 static const u8 le_simultaneous_roles_uuid[16] = { 3918 0xd6, 0x49, 0xb0, 0xd1, 0x28, 0xeb, 0x27, 0x92, 3919 0x96, 0x46, 0xc0, 0x42, 0xb5, 0x10, 0x1b, 0x67, 3920 }; 3921 3922 /* 15c0a148-c273-11ea-b3de-0242ac130004 */ 3923 static const u8 rpa_resolution_uuid[16] = { 3924 0x04, 0x00, 0x13, 0xac, 0x42, 0x02, 0xde, 0xb3, 3925 0xea, 0x11, 0x73, 0xc2, 0x48, 0xa1, 0xc0, 0x15, 3926 }; 3927 3928 static int read_exp_features_info(struct sock *sk, struct hci_dev *hdev, 3929 void *data, u16 data_len) 3930 { 3931 char buf[102]; /* Enough space for 5 features: 2 + 20 * 5 */ 3932 struct mgmt_rp_read_exp_features_info *rp = (void *)buf; 3933 u16 idx = 0; 3934 u32 flags; 3935 3936 bt_dev_dbg(hdev, "sock %p", sk); 3937 3938 memset(&buf, 0, sizeof(buf)); 3939 3940 #ifdef CONFIG_BT_FEATURE_DEBUG 3941 if (!hdev) { 3942 flags = bt_dbg_get() ? BIT(0) : 0; 3943 3944 memcpy(rp->features[idx].uuid, debug_uuid, 16); 3945 rp->features[idx].flags = cpu_to_le32(flags); 3946 idx++; 3947 } 3948 #endif 3949 3950 if (hdev && hci_dev_le_state_simultaneous(hdev)) { 3951 if (hci_dev_test_flag(hdev, HCI_LE_SIMULTANEOUS_ROLES)) 3952 flags = BIT(0); 3953 else 3954 flags = 0; 3955 3956 memcpy(rp->features[idx].uuid, le_simultaneous_roles_uuid, 16); 3957 rp->features[idx].flags = cpu_to_le32(flags); 3958 idx++; 3959 } 3960 3961 if (hdev && ll_privacy_capable(hdev)) { 3962 if (hci_dev_test_flag(hdev, HCI_ENABLE_LL_PRIVACY)) 3963 flags = BIT(0) | BIT(1); 3964 else 3965 flags = BIT(1); 3966 3967 memcpy(rp->features[idx].uuid, rpa_resolution_uuid, 16); 3968 rp->features[idx].flags = cpu_to_le32(flags); 3969 idx++; 3970 } 3971 3972 if (hdev && (aosp_has_quality_report(hdev) || 3973 hdev->set_quality_report)) { 3974 if (hci_dev_test_flag(hdev, HCI_QUALITY_REPORT)) 3975 flags = BIT(0); 3976 else 3977 flags = 0; 3978 3979 memcpy(rp->features[idx].uuid, quality_report_uuid, 16); 3980 rp->features[idx].flags = cpu_to_le32(flags); 3981 idx++; 3982 } 3983 3984 if (hdev && hdev->get_data_path_id) { 3985 if (hci_dev_test_flag(hdev, HCI_OFFLOAD_CODECS_ENABLED)) 3986 flags = BIT(0); 3987 else 3988 flags = 0; 3989 3990 memcpy(rp->features[idx].uuid, offload_codecs_uuid, 16); 3991 rp->features[idx].flags = cpu_to_le32(flags); 3992 idx++; 3993 } 3994 3995 rp->feature_count = cpu_to_le16(idx); 3996 3997 /* After reading the experimental features information, enable 3998 * the events to update client on any future change. 3999 */ 4000 hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS); 4001 4002 return mgmt_cmd_complete(sk, hdev ? hdev->id : MGMT_INDEX_NONE, 4003 MGMT_OP_READ_EXP_FEATURES_INFO, 4004 0, rp, sizeof(*rp) + (20 * idx)); 4005 } 4006 4007 static int exp_ll_privacy_feature_changed(bool enabled, struct hci_dev *hdev, 4008 struct sock *skip) 4009 { 4010 struct mgmt_ev_exp_feature_changed ev; 4011 4012 memset(&ev, 0, sizeof(ev)); 4013 memcpy(ev.uuid, rpa_resolution_uuid, 16); 4014 ev.flags = cpu_to_le32((enabled ? BIT(0) : 0) | BIT(1)); 4015 4016 // Do we need to be atomic with the conn_flags? 4017 if (enabled && privacy_mode_capable(hdev)) 4018 hdev->conn_flags |= HCI_CONN_FLAG_DEVICE_PRIVACY; 4019 else 4020 hdev->conn_flags &= ~HCI_CONN_FLAG_DEVICE_PRIVACY; 4021 4022 return mgmt_limited_event(MGMT_EV_EXP_FEATURE_CHANGED, hdev, 4023 &ev, sizeof(ev), 4024 HCI_MGMT_EXP_FEATURE_EVENTS, skip); 4025 4026 } 4027 4028 static int exp_feature_changed(struct hci_dev *hdev, const u8 *uuid, 4029 bool enabled, struct sock *skip) 4030 { 4031 struct mgmt_ev_exp_feature_changed ev; 4032 4033 memset(&ev, 0, sizeof(ev)); 4034 memcpy(ev.uuid, uuid, 16); 4035 ev.flags = cpu_to_le32(enabled ? BIT(0) : 0); 4036 4037 return mgmt_limited_event(MGMT_EV_EXP_FEATURE_CHANGED, hdev, 4038 &ev, sizeof(ev), 4039 HCI_MGMT_EXP_FEATURE_EVENTS, skip); 4040 } 4041 4042 #define EXP_FEAT(_uuid, _set_func) \ 4043 { \ 4044 .uuid = _uuid, \ 4045 .set_func = _set_func, \ 4046 } 4047 4048 /* The zero key uuid is special. Multiple exp features are set through it. */ 4049 static int set_zero_key_func(struct sock *sk, struct hci_dev *hdev, 4050 struct mgmt_cp_set_exp_feature *cp, u16 data_len) 4051 { 4052 struct mgmt_rp_set_exp_feature rp; 4053 4054 memset(rp.uuid, 0, 16); 4055 rp.flags = cpu_to_le32(0); 4056 4057 #ifdef CONFIG_BT_FEATURE_DEBUG 4058 if (!hdev) { 4059 bool changed = bt_dbg_get(); 4060 4061 bt_dbg_set(false); 4062 4063 if (changed) 4064 exp_feature_changed(NULL, ZERO_KEY, false, sk); 4065 } 4066 #endif 4067 4068 if (hdev && use_ll_privacy(hdev) && !hdev_is_powered(hdev)) { 4069 bool changed; 4070 4071 changed = hci_dev_test_and_clear_flag(hdev, 4072 HCI_ENABLE_LL_PRIVACY); 4073 if (changed) 4074 exp_feature_changed(hdev, rpa_resolution_uuid, false, 4075 sk); 4076 } 4077 4078 hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS); 4079 4080 return mgmt_cmd_complete(sk, hdev ? hdev->id : MGMT_INDEX_NONE, 4081 MGMT_OP_SET_EXP_FEATURE, 0, 4082 &rp, sizeof(rp)); 4083 } 4084 4085 #ifdef CONFIG_BT_FEATURE_DEBUG 4086 static int set_debug_func(struct sock *sk, struct hci_dev *hdev, 4087 struct mgmt_cp_set_exp_feature *cp, u16 data_len) 4088 { 4089 struct mgmt_rp_set_exp_feature rp; 4090 4091 bool val, changed; 4092 int err; 4093 4094 /* Command requires to use the non-controller index */ 4095 if (hdev) 4096 return mgmt_cmd_status(sk, hdev->id, 4097 MGMT_OP_SET_EXP_FEATURE, 4098 MGMT_STATUS_INVALID_INDEX); 4099 4100 /* Parameters are limited to a single octet */ 4101 if (data_len != MGMT_SET_EXP_FEATURE_SIZE + 1) 4102 return mgmt_cmd_status(sk, MGMT_INDEX_NONE, 4103 MGMT_OP_SET_EXP_FEATURE, 4104 MGMT_STATUS_INVALID_PARAMS); 4105 4106 /* Only boolean on/off is supported */ 4107 if (cp->param[0] != 0x00 && cp->param[0] != 0x01) 4108 return mgmt_cmd_status(sk, MGMT_INDEX_NONE, 4109 MGMT_OP_SET_EXP_FEATURE, 4110 MGMT_STATUS_INVALID_PARAMS); 4111 4112 val = !!cp->param[0]; 4113 changed = val ? !bt_dbg_get() : bt_dbg_get(); 4114 bt_dbg_set(val); 4115 4116 memcpy(rp.uuid, debug_uuid, 16); 4117 rp.flags = cpu_to_le32(val ? BIT(0) : 0); 4118 4119 hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS); 4120 4121 err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE, 4122 MGMT_OP_SET_EXP_FEATURE, 0, 4123 &rp, sizeof(rp)); 4124 4125 if (changed) 4126 exp_feature_changed(hdev, debug_uuid, val, sk); 4127 4128 return err; 4129 } 4130 #endif 4131 4132 static int set_rpa_resolution_func(struct sock *sk, struct hci_dev *hdev, 4133 struct mgmt_cp_set_exp_feature *cp, 4134 u16 data_len) 4135 { 4136 struct mgmt_rp_set_exp_feature rp; 4137 bool val, changed; 4138 int err; 4139 u32 flags; 4140 4141 /* Command requires to use the controller index */ 4142 if (!hdev) 4143 return mgmt_cmd_status(sk, MGMT_INDEX_NONE, 4144 MGMT_OP_SET_EXP_FEATURE, 4145 MGMT_STATUS_INVALID_INDEX); 4146 4147 /* Changes can only be made when controller is powered down */ 4148 if (hdev_is_powered(hdev)) 4149 return mgmt_cmd_status(sk, hdev->id, 4150 MGMT_OP_SET_EXP_FEATURE, 4151 MGMT_STATUS_REJECTED); 4152 4153 /* Parameters are limited to a single octet */ 4154 if (data_len != MGMT_SET_EXP_FEATURE_SIZE + 1) 4155 return mgmt_cmd_status(sk, hdev->id, 4156 MGMT_OP_SET_EXP_FEATURE, 4157 MGMT_STATUS_INVALID_PARAMS); 4158 4159 /* Only boolean on/off is supported */ 4160 if (cp->param[0] != 0x00 && cp->param[0] != 0x01) 4161 return mgmt_cmd_status(sk, hdev->id, 4162 MGMT_OP_SET_EXP_FEATURE, 4163 MGMT_STATUS_INVALID_PARAMS); 4164 4165 val = !!cp->param[0]; 4166 4167 if (val) { 4168 changed = !hci_dev_test_and_set_flag(hdev, 4169 HCI_ENABLE_LL_PRIVACY); 4170 hci_dev_clear_flag(hdev, HCI_ADVERTISING); 4171 4172 /* Enable LL privacy + supported settings changed */ 4173 flags = BIT(0) | BIT(1); 4174 } else { 4175 changed = hci_dev_test_and_clear_flag(hdev, 4176 HCI_ENABLE_LL_PRIVACY); 4177 4178 /* Disable LL privacy + supported settings changed */ 4179 flags = BIT(1); 4180 } 4181 4182 memcpy(rp.uuid, rpa_resolution_uuid, 16); 4183 rp.flags = cpu_to_le32(flags); 4184 4185 hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS); 4186 4187 err = mgmt_cmd_complete(sk, hdev->id, 4188 MGMT_OP_SET_EXP_FEATURE, 0, 4189 &rp, sizeof(rp)); 4190 4191 if (changed) 4192 exp_ll_privacy_feature_changed(val, hdev, sk); 4193 4194 return err; 4195 } 4196 4197 static int set_quality_report_func(struct sock *sk, struct hci_dev *hdev, 4198 struct mgmt_cp_set_exp_feature *cp, 4199 u16 data_len) 4200 { 4201 struct mgmt_rp_set_exp_feature rp; 4202 bool val, changed; 4203 int err; 4204 4205 /* Command requires to use a valid controller index */ 4206 if (!hdev) 4207 return mgmt_cmd_status(sk, MGMT_INDEX_NONE, 4208 MGMT_OP_SET_EXP_FEATURE, 4209 MGMT_STATUS_INVALID_INDEX); 4210 4211 /* Parameters are limited to a single octet */ 4212 if (data_len != MGMT_SET_EXP_FEATURE_SIZE + 1) 4213 return mgmt_cmd_status(sk, hdev->id, 4214 MGMT_OP_SET_EXP_FEATURE, 4215 MGMT_STATUS_INVALID_PARAMS); 4216 4217 /* Only boolean on/off is supported */ 4218 if (cp->param[0] != 0x00 && cp->param[0] != 0x01) 4219 return mgmt_cmd_status(sk, hdev->id, 4220 MGMT_OP_SET_EXP_FEATURE, 4221 MGMT_STATUS_INVALID_PARAMS); 4222 4223 hci_req_sync_lock(hdev); 4224 4225 val = !!cp->param[0]; 4226 changed = (val != hci_dev_test_flag(hdev, HCI_QUALITY_REPORT)); 4227 4228 if (!aosp_has_quality_report(hdev) && !hdev->set_quality_report) { 4229 err = mgmt_cmd_status(sk, hdev->id, 4230 MGMT_OP_SET_EXP_FEATURE, 4231 MGMT_STATUS_NOT_SUPPORTED); 4232 goto unlock_quality_report; 4233 } 4234 4235 if (changed) { 4236 if (hdev->set_quality_report) 4237 err = hdev->set_quality_report(hdev, val); 4238 else 4239 err = aosp_set_quality_report(hdev, val); 4240 4241 if (err) { 4242 err = mgmt_cmd_status(sk, hdev->id, 4243 MGMT_OP_SET_EXP_FEATURE, 4244 MGMT_STATUS_FAILED); 4245 goto unlock_quality_report; 4246 } 4247 4248 if (val) 4249 hci_dev_set_flag(hdev, HCI_QUALITY_REPORT); 4250 else 4251 hci_dev_clear_flag(hdev, HCI_QUALITY_REPORT); 4252 } 4253 4254 bt_dev_dbg(hdev, "quality report enable %d changed %d", val, changed); 4255 4256 memcpy(rp.uuid, quality_report_uuid, 16); 4257 rp.flags = cpu_to_le32(val ? BIT(0) : 0); 4258 hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS); 4259 4260 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_EXP_FEATURE, 0, 4261 &rp, sizeof(rp)); 4262 4263 if (changed) 4264 exp_feature_changed(hdev, quality_report_uuid, val, sk); 4265 4266 unlock_quality_report: 4267 hci_req_sync_unlock(hdev); 4268 return err; 4269 } 4270 4271 static int set_offload_codec_func(struct sock *sk, struct hci_dev *hdev, 4272 struct mgmt_cp_set_exp_feature *cp, 4273 u16 data_len) 4274 { 4275 bool val, changed; 4276 int err; 4277 struct mgmt_rp_set_exp_feature rp; 4278 4279 /* Command requires to use a valid controller index */ 4280 if (!hdev) 4281 return mgmt_cmd_status(sk, MGMT_INDEX_NONE, 4282 MGMT_OP_SET_EXP_FEATURE, 4283 MGMT_STATUS_INVALID_INDEX); 4284 4285 /* Parameters are limited to a single octet */ 4286 if (data_len != MGMT_SET_EXP_FEATURE_SIZE + 1) 4287 return mgmt_cmd_status(sk, hdev->id, 4288 MGMT_OP_SET_EXP_FEATURE, 4289 MGMT_STATUS_INVALID_PARAMS); 4290 4291 /* Only boolean on/off is supported */ 4292 if (cp->param[0] != 0x00 && cp->param[0] != 0x01) 4293 return mgmt_cmd_status(sk, hdev->id, 4294 MGMT_OP_SET_EXP_FEATURE, 4295 MGMT_STATUS_INVALID_PARAMS); 4296 4297 val = !!cp->param[0]; 4298 changed = (val != hci_dev_test_flag(hdev, HCI_OFFLOAD_CODECS_ENABLED)); 4299 4300 if (!hdev->get_data_path_id) { 4301 return mgmt_cmd_status(sk, hdev->id, 4302 MGMT_OP_SET_EXP_FEATURE, 4303 MGMT_STATUS_NOT_SUPPORTED); 4304 } 4305 4306 if (changed) { 4307 if (val) 4308 hci_dev_set_flag(hdev, HCI_OFFLOAD_CODECS_ENABLED); 4309 else 4310 hci_dev_clear_flag(hdev, HCI_OFFLOAD_CODECS_ENABLED); 4311 } 4312 4313 bt_dev_info(hdev, "offload codecs enable %d changed %d", 4314 val, changed); 4315 4316 memcpy(rp.uuid, offload_codecs_uuid, 16); 4317 rp.flags = cpu_to_le32(val ? BIT(0) : 0); 4318 hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS); 4319 err = mgmt_cmd_complete(sk, hdev->id, 4320 MGMT_OP_SET_EXP_FEATURE, 0, 4321 &rp, sizeof(rp)); 4322 4323 if (changed) 4324 exp_feature_changed(hdev, offload_codecs_uuid, val, sk); 4325 4326 return err; 4327 } 4328 4329 static int set_le_simultaneous_roles_func(struct sock *sk, struct hci_dev *hdev, 4330 struct mgmt_cp_set_exp_feature *cp, 4331 u16 data_len) 4332 { 4333 bool val, changed; 4334 int err; 4335 struct mgmt_rp_set_exp_feature rp; 4336 4337 /* Command requires to use a valid controller index */ 4338 if (!hdev) 4339 return mgmt_cmd_status(sk, MGMT_INDEX_NONE, 4340 MGMT_OP_SET_EXP_FEATURE, 4341 MGMT_STATUS_INVALID_INDEX); 4342 4343 /* Parameters are limited to a single octet */ 4344 if (data_len != MGMT_SET_EXP_FEATURE_SIZE + 1) 4345 return mgmt_cmd_status(sk, hdev->id, 4346 MGMT_OP_SET_EXP_FEATURE, 4347 MGMT_STATUS_INVALID_PARAMS); 4348 4349 /* Only boolean on/off is supported */ 4350 if (cp->param[0] != 0x00 && cp->param[0] != 0x01) 4351 return mgmt_cmd_status(sk, hdev->id, 4352 MGMT_OP_SET_EXP_FEATURE, 4353 MGMT_STATUS_INVALID_PARAMS); 4354 4355 val = !!cp->param[0]; 4356 changed = (val != hci_dev_test_flag(hdev, HCI_LE_SIMULTANEOUS_ROLES)); 4357 4358 if (!hci_dev_le_state_simultaneous(hdev)) { 4359 return mgmt_cmd_status(sk, hdev->id, 4360 MGMT_OP_SET_EXP_FEATURE, 4361 MGMT_STATUS_NOT_SUPPORTED); 4362 } 4363 4364 if (changed) { 4365 if (val) 4366 hci_dev_set_flag(hdev, HCI_LE_SIMULTANEOUS_ROLES); 4367 else 4368 hci_dev_clear_flag(hdev, HCI_LE_SIMULTANEOUS_ROLES); 4369 } 4370 4371 bt_dev_info(hdev, "LE simultaneous roles enable %d changed %d", 4372 val, changed); 4373 4374 memcpy(rp.uuid, le_simultaneous_roles_uuid, 16); 4375 rp.flags = cpu_to_le32(val ? BIT(0) : 0); 4376 hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS); 4377 err = mgmt_cmd_complete(sk, hdev->id, 4378 MGMT_OP_SET_EXP_FEATURE, 0, 4379 &rp, sizeof(rp)); 4380 4381 if (changed) 4382 exp_feature_changed(hdev, le_simultaneous_roles_uuid, val, sk); 4383 4384 return err; 4385 } 4386 4387 static const struct mgmt_exp_feature { 4388 const u8 *uuid; 4389 int (*set_func)(struct sock *sk, struct hci_dev *hdev, 4390 struct mgmt_cp_set_exp_feature *cp, u16 data_len); 4391 } exp_features[] = { 4392 EXP_FEAT(ZERO_KEY, set_zero_key_func), 4393 #ifdef CONFIG_BT_FEATURE_DEBUG 4394 EXP_FEAT(debug_uuid, set_debug_func), 4395 #endif 4396 EXP_FEAT(rpa_resolution_uuid, set_rpa_resolution_func), 4397 EXP_FEAT(quality_report_uuid, set_quality_report_func), 4398 EXP_FEAT(offload_codecs_uuid, set_offload_codec_func), 4399 EXP_FEAT(le_simultaneous_roles_uuid, set_le_simultaneous_roles_func), 4400 4401 /* end with a null feature */ 4402 EXP_FEAT(NULL, NULL) 4403 }; 4404 4405 static int set_exp_feature(struct sock *sk, struct hci_dev *hdev, 4406 void *data, u16 data_len) 4407 { 4408 struct mgmt_cp_set_exp_feature *cp = data; 4409 size_t i = 0; 4410 4411 bt_dev_dbg(hdev, "sock %p", sk); 4412 4413 for (i = 0; exp_features[i].uuid; i++) { 4414 if (!memcmp(cp->uuid, exp_features[i].uuid, 16)) 4415 return exp_features[i].set_func(sk, hdev, cp, data_len); 4416 } 4417 4418 return mgmt_cmd_status(sk, hdev ? hdev->id : MGMT_INDEX_NONE, 4419 MGMT_OP_SET_EXP_FEATURE, 4420 MGMT_STATUS_NOT_SUPPORTED); 4421 } 4422 4423 static int get_device_flags(struct sock *sk, struct hci_dev *hdev, void *data, 4424 u16 data_len) 4425 { 4426 struct mgmt_cp_get_device_flags *cp = data; 4427 struct mgmt_rp_get_device_flags rp; 4428 struct bdaddr_list_with_flags *br_params; 4429 struct hci_conn_params *params; 4430 u32 supported_flags; 4431 u32 current_flags = 0; 4432 u8 status = MGMT_STATUS_INVALID_PARAMS; 4433 4434 bt_dev_dbg(hdev, "Get device flags %pMR (type 0x%x)\n", 4435 &cp->addr.bdaddr, cp->addr.type); 4436 4437 hci_dev_lock(hdev); 4438 4439 supported_flags = hdev->conn_flags; 4440 4441 memset(&rp, 0, sizeof(rp)); 4442 4443 if (cp->addr.type == BDADDR_BREDR) { 4444 br_params = hci_bdaddr_list_lookup_with_flags(&hdev->accept_list, 4445 &cp->addr.bdaddr, 4446 cp->addr.type); 4447 if (!br_params) 4448 goto done; 4449 4450 current_flags = br_params->flags; 4451 } else { 4452 params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr, 4453 le_addr_type(cp->addr.type)); 4454 4455 if (!params) 4456 goto done; 4457 4458 current_flags = params->flags; 4459 } 4460 4461 bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr); 4462 rp.addr.type = cp->addr.type; 4463 rp.supported_flags = cpu_to_le32(supported_flags); 4464 rp.current_flags = cpu_to_le32(current_flags); 4465 4466 status = MGMT_STATUS_SUCCESS; 4467 4468 done: 4469 hci_dev_unlock(hdev); 4470 4471 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_DEVICE_FLAGS, status, 4472 &rp, sizeof(rp)); 4473 } 4474 4475 static void device_flags_changed(struct sock *sk, struct hci_dev *hdev, 4476 bdaddr_t *bdaddr, u8 bdaddr_type, 4477 u32 supported_flags, u32 current_flags) 4478 { 4479 struct mgmt_ev_device_flags_changed ev; 4480 4481 bacpy(&ev.addr.bdaddr, bdaddr); 4482 ev.addr.type = bdaddr_type; 4483 ev.supported_flags = cpu_to_le32(supported_flags); 4484 ev.current_flags = cpu_to_le32(current_flags); 4485 4486 mgmt_event(MGMT_EV_DEVICE_FLAGS_CHANGED, hdev, &ev, sizeof(ev), sk); 4487 } 4488 4489 static int set_device_flags(struct sock *sk, struct hci_dev *hdev, void *data, 4490 u16 len) 4491 { 4492 struct mgmt_cp_set_device_flags *cp = data; 4493 struct bdaddr_list_with_flags *br_params; 4494 struct hci_conn_params *params; 4495 u8 status = MGMT_STATUS_INVALID_PARAMS; 4496 u32 supported_flags; 4497 u32 current_flags = __le32_to_cpu(cp->current_flags); 4498 4499 bt_dev_dbg(hdev, "Set device flags %pMR (type 0x%x) = 0x%x", 4500 &cp->addr.bdaddr, cp->addr.type, 4501 __le32_to_cpu(current_flags)); 4502 4503 // We should take hci_dev_lock() early, I think.. conn_flags can change 4504 supported_flags = hdev->conn_flags; 4505 4506 if ((supported_flags | current_flags) != supported_flags) { 4507 bt_dev_warn(hdev, "Bad flag given (0x%x) vs supported (0x%0x)", 4508 current_flags, supported_flags); 4509 goto done; 4510 } 4511 4512 hci_dev_lock(hdev); 4513 4514 if (cp->addr.type == BDADDR_BREDR) { 4515 br_params = hci_bdaddr_list_lookup_with_flags(&hdev->accept_list, 4516 &cp->addr.bdaddr, 4517 cp->addr.type); 4518 4519 if (br_params) { 4520 br_params->flags = current_flags; 4521 status = MGMT_STATUS_SUCCESS; 4522 } else { 4523 bt_dev_warn(hdev, "No such BR/EDR device %pMR (0x%x)", 4524 &cp->addr.bdaddr, cp->addr.type); 4525 } 4526 } else { 4527 params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr, 4528 le_addr_type(cp->addr.type)); 4529 if (params) { 4530 /* Devices using RPAs can only be programmed in the 4531 * acceptlist LL Privacy has been enable otherwise they 4532 * cannot mark HCI_CONN_FLAG_REMOTE_WAKEUP. 4533 */ 4534 if ((current_flags & HCI_CONN_FLAG_REMOTE_WAKEUP) && 4535 !use_ll_privacy(hdev) && 4536 hci_find_irk_by_addr(hdev, ¶ms->addr, 4537 params->addr_type)) { 4538 bt_dev_warn(hdev, 4539 "Cannot set wakeable for RPA"); 4540 goto unlock; 4541 } 4542 4543 params->flags = current_flags; 4544 status = MGMT_STATUS_SUCCESS; 4545 4546 /* Update passive scan if HCI_CONN_FLAG_DEVICE_PRIVACY 4547 * has been set. 4548 */ 4549 if (params->flags & HCI_CONN_FLAG_DEVICE_PRIVACY) 4550 hci_update_passive_scan(hdev); 4551 } else { 4552 bt_dev_warn(hdev, "No such LE device %pMR (0x%x)", 4553 &cp->addr.bdaddr, 4554 le_addr_type(cp->addr.type)); 4555 } 4556 } 4557 4558 unlock: 4559 hci_dev_unlock(hdev); 4560 4561 done: 4562 if (status == MGMT_STATUS_SUCCESS) 4563 device_flags_changed(sk, hdev, &cp->addr.bdaddr, cp->addr.type, 4564 supported_flags, current_flags); 4565 4566 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_DEVICE_FLAGS, status, 4567 &cp->addr, sizeof(cp->addr)); 4568 } 4569 4570 static void mgmt_adv_monitor_added(struct sock *sk, struct hci_dev *hdev, 4571 u16 handle) 4572 { 4573 struct mgmt_ev_adv_monitor_added ev; 4574 4575 ev.monitor_handle = cpu_to_le16(handle); 4576 4577 mgmt_event(MGMT_EV_ADV_MONITOR_ADDED, hdev, &ev, sizeof(ev), sk); 4578 } 4579 4580 void mgmt_adv_monitor_removed(struct hci_dev *hdev, u16 handle) 4581 { 4582 struct mgmt_ev_adv_monitor_removed ev; 4583 struct mgmt_pending_cmd *cmd; 4584 struct sock *sk_skip = NULL; 4585 struct mgmt_cp_remove_adv_monitor *cp; 4586 4587 cmd = pending_find(MGMT_OP_REMOVE_ADV_MONITOR, hdev); 4588 if (cmd) { 4589 cp = cmd->param; 4590 4591 if (cp->monitor_handle) 4592 sk_skip = cmd->sk; 4593 } 4594 4595 ev.monitor_handle = cpu_to_le16(handle); 4596 4597 mgmt_event(MGMT_EV_ADV_MONITOR_REMOVED, hdev, &ev, sizeof(ev), sk_skip); 4598 } 4599 4600 static int read_adv_mon_features(struct sock *sk, struct hci_dev *hdev, 4601 void *data, u16 len) 4602 { 4603 struct adv_monitor *monitor = NULL; 4604 struct mgmt_rp_read_adv_monitor_features *rp = NULL; 4605 int handle, err; 4606 size_t rp_size = 0; 4607 __u32 supported = 0; 4608 __u32 enabled = 0; 4609 __u16 num_handles = 0; 4610 __u16 handles[HCI_MAX_ADV_MONITOR_NUM_HANDLES]; 4611 4612 BT_DBG("request for %s", hdev->name); 4613 4614 hci_dev_lock(hdev); 4615 4616 if (msft_monitor_supported(hdev)) 4617 supported |= MGMT_ADV_MONITOR_FEATURE_MASK_OR_PATTERNS; 4618 4619 idr_for_each_entry(&hdev->adv_monitors_idr, monitor, handle) 4620 handles[num_handles++] = monitor->handle; 4621 4622 hci_dev_unlock(hdev); 4623 4624 rp_size = sizeof(*rp) + (num_handles * sizeof(u16)); 4625 rp = kmalloc(rp_size, GFP_KERNEL); 4626 if (!rp) 4627 return -ENOMEM; 4628 4629 /* All supported features are currently enabled */ 4630 enabled = supported; 4631 4632 rp->supported_features = cpu_to_le32(supported); 4633 rp->enabled_features = cpu_to_le32(enabled); 4634 rp->max_num_handles = cpu_to_le16(HCI_MAX_ADV_MONITOR_NUM_HANDLES); 4635 rp->max_num_patterns = HCI_MAX_ADV_MONITOR_NUM_PATTERNS; 4636 rp->num_handles = cpu_to_le16(num_handles); 4637 if (num_handles) 4638 memcpy(&rp->handles, &handles, (num_handles * sizeof(u16))); 4639 4640 err = mgmt_cmd_complete(sk, hdev->id, 4641 MGMT_OP_READ_ADV_MONITOR_FEATURES, 4642 MGMT_STATUS_SUCCESS, rp, rp_size); 4643 4644 kfree(rp); 4645 4646 return err; 4647 } 4648 4649 int mgmt_add_adv_patterns_monitor_complete(struct hci_dev *hdev, u8 status) 4650 { 4651 struct mgmt_rp_add_adv_patterns_monitor rp; 4652 struct mgmt_pending_cmd *cmd; 4653 struct adv_monitor *monitor; 4654 int err = 0; 4655 4656 hci_dev_lock(hdev); 4657 4658 cmd = pending_find(MGMT_OP_ADD_ADV_PATTERNS_MONITOR_RSSI, hdev); 4659 if (!cmd) { 4660 cmd = pending_find(MGMT_OP_ADD_ADV_PATTERNS_MONITOR, hdev); 4661 if (!cmd) 4662 goto done; 4663 } 4664 4665 monitor = cmd->user_data; 4666 rp.monitor_handle = cpu_to_le16(monitor->handle); 4667 4668 if (!status) { 4669 mgmt_adv_monitor_added(cmd->sk, hdev, monitor->handle); 4670 hdev->adv_monitors_cnt++; 4671 if (monitor->state == ADV_MONITOR_STATE_NOT_REGISTERED) 4672 monitor->state = ADV_MONITOR_STATE_REGISTERED; 4673 hci_update_passive_scan(hdev); 4674 } 4675 4676 err = mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, 4677 mgmt_status(status), &rp, sizeof(rp)); 4678 mgmt_pending_remove(cmd); 4679 4680 done: 4681 hci_dev_unlock(hdev); 4682 bt_dev_dbg(hdev, "add monitor %d complete, status %u", 4683 rp.monitor_handle, status); 4684 4685 return err; 4686 } 4687 4688 static int __add_adv_patterns_monitor(struct sock *sk, struct hci_dev *hdev, 4689 struct adv_monitor *m, u8 status, 4690 void *data, u16 len, u16 op) 4691 { 4692 struct mgmt_rp_add_adv_patterns_monitor rp; 4693 struct mgmt_pending_cmd *cmd; 4694 int err; 4695 bool pending; 4696 4697 hci_dev_lock(hdev); 4698 4699 if (status) 4700 goto unlock; 4701 4702 if (pending_find(MGMT_OP_SET_LE, hdev) || 4703 pending_find(MGMT_OP_ADD_ADV_PATTERNS_MONITOR, hdev) || 4704 pending_find(MGMT_OP_ADD_ADV_PATTERNS_MONITOR_RSSI, hdev) || 4705 pending_find(MGMT_OP_REMOVE_ADV_MONITOR, hdev)) { 4706 status = MGMT_STATUS_BUSY; 4707 goto unlock; 4708 } 4709 4710 cmd = mgmt_pending_add(sk, op, hdev, data, len); 4711 if (!cmd) { 4712 status = MGMT_STATUS_NO_RESOURCES; 4713 goto unlock; 4714 } 4715 4716 cmd->user_data = m; 4717 pending = hci_add_adv_monitor(hdev, m, &err); 4718 if (err) { 4719 if (err == -ENOSPC || err == -ENOMEM) 4720 status = MGMT_STATUS_NO_RESOURCES; 4721 else if (err == -EINVAL) 4722 status = MGMT_STATUS_INVALID_PARAMS; 4723 else 4724 status = MGMT_STATUS_FAILED; 4725 4726 mgmt_pending_remove(cmd); 4727 goto unlock; 4728 } 4729 4730 if (!pending) { 4731 mgmt_pending_remove(cmd); 4732 rp.monitor_handle = cpu_to_le16(m->handle); 4733 mgmt_adv_monitor_added(sk, hdev, m->handle); 4734 m->state = ADV_MONITOR_STATE_REGISTERED; 4735 hdev->adv_monitors_cnt++; 4736 4737 hci_dev_unlock(hdev); 4738 return mgmt_cmd_complete(sk, hdev->id, op, MGMT_STATUS_SUCCESS, 4739 &rp, sizeof(rp)); 4740 } 4741 4742 hci_dev_unlock(hdev); 4743 4744 return 0; 4745 4746 unlock: 4747 hci_free_adv_monitor(hdev, m); 4748 hci_dev_unlock(hdev); 4749 return mgmt_cmd_status(sk, hdev->id, op, status); 4750 } 4751 4752 static void parse_adv_monitor_rssi(struct adv_monitor *m, 4753 struct mgmt_adv_rssi_thresholds *rssi) 4754 { 4755 if (rssi) { 4756 m->rssi.low_threshold = rssi->low_threshold; 4757 m->rssi.low_threshold_timeout = 4758 __le16_to_cpu(rssi->low_threshold_timeout); 4759 m->rssi.high_threshold = rssi->high_threshold; 4760 m->rssi.high_threshold_timeout = 4761 __le16_to_cpu(rssi->high_threshold_timeout); 4762 m->rssi.sampling_period = rssi->sampling_period; 4763 } else { 4764 /* Default values. These numbers are the least constricting 4765 * parameters for MSFT API to work, so it behaves as if there 4766 * are no rssi parameter to consider. May need to be changed 4767 * if other API are to be supported. 4768 */ 4769 m->rssi.low_threshold = -127; 4770 m->rssi.low_threshold_timeout = 60; 4771 m->rssi.high_threshold = -127; 4772 m->rssi.high_threshold_timeout = 0; 4773 m->rssi.sampling_period = 0; 4774 } 4775 } 4776 4777 static u8 parse_adv_monitor_pattern(struct adv_monitor *m, u8 pattern_count, 4778 struct mgmt_adv_pattern *patterns) 4779 { 4780 u8 offset = 0, length = 0; 4781 struct adv_pattern *p = NULL; 4782 int i; 4783 4784 for (i = 0; i < pattern_count; i++) { 4785 offset = patterns[i].offset; 4786 length = patterns[i].length; 4787 if (offset >= HCI_MAX_AD_LENGTH || 4788 length > HCI_MAX_AD_LENGTH || 4789 (offset + length) > HCI_MAX_AD_LENGTH) 4790 return MGMT_STATUS_INVALID_PARAMS; 4791 4792 p = kmalloc(sizeof(*p), GFP_KERNEL); 4793 if (!p) 4794 return MGMT_STATUS_NO_RESOURCES; 4795 4796 p->ad_type = patterns[i].ad_type; 4797 p->offset = patterns[i].offset; 4798 p->length = patterns[i].length; 4799 memcpy(p->value, patterns[i].value, p->length); 4800 4801 INIT_LIST_HEAD(&p->list); 4802 list_add(&p->list, &m->patterns); 4803 } 4804 4805 return MGMT_STATUS_SUCCESS; 4806 } 4807 4808 static int add_adv_patterns_monitor(struct sock *sk, struct hci_dev *hdev, 4809 void *data, u16 len) 4810 { 4811 struct mgmt_cp_add_adv_patterns_monitor *cp = data; 4812 struct adv_monitor *m = NULL; 4813 u8 status = MGMT_STATUS_SUCCESS; 4814 size_t expected_size = sizeof(*cp); 4815 4816 BT_DBG("request for %s", hdev->name); 4817 4818 if (len <= sizeof(*cp)) { 4819 status = MGMT_STATUS_INVALID_PARAMS; 4820 goto done; 4821 } 4822 4823 expected_size += cp->pattern_count * sizeof(struct mgmt_adv_pattern); 4824 if (len != expected_size) { 4825 status = MGMT_STATUS_INVALID_PARAMS; 4826 goto done; 4827 } 4828 4829 m = kzalloc(sizeof(*m), GFP_KERNEL); 4830 if (!m) { 4831 status = MGMT_STATUS_NO_RESOURCES; 4832 goto done; 4833 } 4834 4835 INIT_LIST_HEAD(&m->patterns); 4836 4837 parse_adv_monitor_rssi(m, NULL); 4838 status = parse_adv_monitor_pattern(m, cp->pattern_count, cp->patterns); 4839 4840 done: 4841 return __add_adv_patterns_monitor(sk, hdev, m, status, data, len, 4842 MGMT_OP_ADD_ADV_PATTERNS_MONITOR); 4843 } 4844 4845 static int add_adv_patterns_monitor_rssi(struct sock *sk, struct hci_dev *hdev, 4846 void *data, u16 len) 4847 { 4848 struct mgmt_cp_add_adv_patterns_monitor_rssi *cp = data; 4849 struct adv_monitor *m = NULL; 4850 u8 status = MGMT_STATUS_SUCCESS; 4851 size_t expected_size = sizeof(*cp); 4852 4853 BT_DBG("request for %s", hdev->name); 4854 4855 if (len <= sizeof(*cp)) { 4856 status = MGMT_STATUS_INVALID_PARAMS; 4857 goto done; 4858 } 4859 4860 expected_size += cp->pattern_count * sizeof(struct mgmt_adv_pattern); 4861 if (len != expected_size) { 4862 status = MGMT_STATUS_INVALID_PARAMS; 4863 goto done; 4864 } 4865 4866 m = kzalloc(sizeof(*m), GFP_KERNEL); 4867 if (!m) { 4868 status = MGMT_STATUS_NO_RESOURCES; 4869 goto done; 4870 } 4871 4872 INIT_LIST_HEAD(&m->patterns); 4873 4874 parse_adv_monitor_rssi(m, &cp->rssi); 4875 status = parse_adv_monitor_pattern(m, cp->pattern_count, cp->patterns); 4876 4877 done: 4878 return __add_adv_patterns_monitor(sk, hdev, m, status, data, len, 4879 MGMT_OP_ADD_ADV_PATTERNS_MONITOR_RSSI); 4880 } 4881 4882 int mgmt_remove_adv_monitor_complete(struct hci_dev *hdev, u8 status) 4883 { 4884 struct mgmt_rp_remove_adv_monitor rp; 4885 struct mgmt_cp_remove_adv_monitor *cp; 4886 struct mgmt_pending_cmd *cmd; 4887 int err = 0; 4888 4889 hci_dev_lock(hdev); 4890 4891 cmd = pending_find(MGMT_OP_REMOVE_ADV_MONITOR, hdev); 4892 if (!cmd) 4893 goto done; 4894 4895 cp = cmd->param; 4896 rp.monitor_handle = cp->monitor_handle; 4897 4898 if (!status) 4899 hci_update_passive_scan(hdev); 4900 4901 err = mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, 4902 mgmt_status(status), &rp, sizeof(rp)); 4903 mgmt_pending_remove(cmd); 4904 4905 done: 4906 hci_dev_unlock(hdev); 4907 bt_dev_dbg(hdev, "remove monitor %d complete, status %u", 4908 rp.monitor_handle, status); 4909 4910 return err; 4911 } 4912 4913 static int remove_adv_monitor(struct sock *sk, struct hci_dev *hdev, 4914 void *data, u16 len) 4915 { 4916 struct mgmt_cp_remove_adv_monitor *cp = data; 4917 struct mgmt_rp_remove_adv_monitor rp; 4918 struct mgmt_pending_cmd *cmd; 4919 u16 handle = __le16_to_cpu(cp->monitor_handle); 4920 int err, status; 4921 bool pending; 4922 4923 BT_DBG("request for %s", hdev->name); 4924 rp.monitor_handle = cp->monitor_handle; 4925 4926 hci_dev_lock(hdev); 4927 4928 if (pending_find(MGMT_OP_SET_LE, hdev) || 4929 pending_find(MGMT_OP_REMOVE_ADV_MONITOR, hdev) || 4930 pending_find(MGMT_OP_ADD_ADV_PATTERNS_MONITOR, hdev) || 4931 pending_find(MGMT_OP_ADD_ADV_PATTERNS_MONITOR_RSSI, hdev)) { 4932 status = MGMT_STATUS_BUSY; 4933 goto unlock; 4934 } 4935 4936 cmd = mgmt_pending_add(sk, MGMT_OP_REMOVE_ADV_MONITOR, hdev, data, len); 4937 if (!cmd) { 4938 status = MGMT_STATUS_NO_RESOURCES; 4939 goto unlock; 4940 } 4941 4942 if (handle) 4943 pending = hci_remove_single_adv_monitor(hdev, handle, &err); 4944 else 4945 pending = hci_remove_all_adv_monitor(hdev, &err); 4946 4947 if (err) { 4948 mgmt_pending_remove(cmd); 4949 4950 if (err == -ENOENT) 4951 status = MGMT_STATUS_INVALID_INDEX; 4952 else 4953 status = MGMT_STATUS_FAILED; 4954 4955 goto unlock; 4956 } 4957 4958 /* monitor can be removed without forwarding request to controller */ 4959 if (!pending) { 4960 mgmt_pending_remove(cmd); 4961 hci_dev_unlock(hdev); 4962 4963 return mgmt_cmd_complete(sk, hdev->id, 4964 MGMT_OP_REMOVE_ADV_MONITOR, 4965 MGMT_STATUS_SUCCESS, 4966 &rp, sizeof(rp)); 4967 } 4968 4969 hci_dev_unlock(hdev); 4970 return 0; 4971 4972 unlock: 4973 hci_dev_unlock(hdev); 4974 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_ADV_MONITOR, 4975 status); 4976 } 4977 4978 static void read_local_oob_data_complete(struct hci_dev *hdev, void *data, int err) 4979 { 4980 struct mgmt_rp_read_local_oob_data mgmt_rp; 4981 size_t rp_size = sizeof(mgmt_rp); 4982 struct mgmt_pending_cmd *cmd = data; 4983 struct sk_buff *skb = cmd->skb; 4984 u8 status = mgmt_status(err); 4985 4986 if (!status) { 4987 if (!skb) 4988 status = MGMT_STATUS_FAILED; 4989 else if (IS_ERR(skb)) 4990 status = mgmt_status(PTR_ERR(skb)); 4991 else 4992 status = mgmt_status(skb->data[0]); 4993 } 4994 4995 bt_dev_dbg(hdev, "status %d", status); 4996 4997 if (status) { 4998 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA, status); 4999 goto remove; 5000 } 5001 5002 memset(&mgmt_rp, 0, sizeof(mgmt_rp)); 5003 5004 if (!bredr_sc_enabled(hdev)) { 5005 struct hci_rp_read_local_oob_data *rp = (void *) skb->data; 5006 5007 if (skb->len < sizeof(*rp)) { 5008 mgmt_cmd_status(cmd->sk, hdev->id, 5009 MGMT_OP_READ_LOCAL_OOB_DATA, 5010 MGMT_STATUS_FAILED); 5011 goto remove; 5012 } 5013 5014 memcpy(mgmt_rp.hash192, rp->hash, sizeof(rp->hash)); 5015 memcpy(mgmt_rp.rand192, rp->rand, sizeof(rp->rand)); 5016 5017 rp_size -= sizeof(mgmt_rp.hash256) + sizeof(mgmt_rp.rand256); 5018 } else { 5019 struct hci_rp_read_local_oob_ext_data *rp = (void *) skb->data; 5020 5021 if (skb->len < sizeof(*rp)) { 5022 mgmt_cmd_status(cmd->sk, hdev->id, 5023 MGMT_OP_READ_LOCAL_OOB_DATA, 5024 MGMT_STATUS_FAILED); 5025 goto remove; 5026 } 5027 5028 memcpy(mgmt_rp.hash192, rp->hash192, sizeof(rp->hash192)); 5029 memcpy(mgmt_rp.rand192, rp->rand192, sizeof(rp->rand192)); 5030 5031 memcpy(mgmt_rp.hash256, rp->hash256, sizeof(rp->hash256)); 5032 memcpy(mgmt_rp.rand256, rp->rand256, sizeof(rp->rand256)); 5033 } 5034 5035 mgmt_cmd_complete(cmd->sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA, 5036 MGMT_STATUS_SUCCESS, &mgmt_rp, rp_size); 5037 5038 remove: 5039 if (skb && !IS_ERR(skb)) 5040 kfree_skb(skb); 5041 5042 mgmt_pending_free(cmd); 5043 } 5044 5045 static int read_local_oob_data_sync(struct hci_dev *hdev, void *data) 5046 { 5047 struct mgmt_pending_cmd *cmd = data; 5048 5049 if (bredr_sc_enabled(hdev)) 5050 cmd->skb = hci_read_local_oob_data_sync(hdev, true, cmd->sk); 5051 else 5052 cmd->skb = hci_read_local_oob_data_sync(hdev, false, cmd->sk); 5053 5054 if (IS_ERR(cmd->skb)) 5055 return PTR_ERR(cmd->skb); 5056 else 5057 return 0; 5058 } 5059 5060 static int read_local_oob_data(struct sock *sk, struct hci_dev *hdev, 5061 void *data, u16 data_len) 5062 { 5063 struct mgmt_pending_cmd *cmd; 5064 int err; 5065 5066 bt_dev_dbg(hdev, "sock %p", sk); 5067 5068 hci_dev_lock(hdev); 5069 5070 if (!hdev_is_powered(hdev)) { 5071 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA, 5072 MGMT_STATUS_NOT_POWERED); 5073 goto unlock; 5074 } 5075 5076 if (!lmp_ssp_capable(hdev)) { 5077 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA, 5078 MGMT_STATUS_NOT_SUPPORTED); 5079 goto unlock; 5080 } 5081 5082 cmd = mgmt_pending_new(sk, MGMT_OP_READ_LOCAL_OOB_DATA, hdev, NULL, 0); 5083 if (!cmd) 5084 err = -ENOMEM; 5085 else 5086 err = hci_cmd_sync_queue(hdev, read_local_oob_data_sync, cmd, 5087 read_local_oob_data_complete); 5088 5089 if (err < 0) { 5090 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA, 5091 MGMT_STATUS_FAILED); 5092 5093 if (cmd) 5094 mgmt_pending_free(cmd); 5095 } 5096 5097 unlock: 5098 hci_dev_unlock(hdev); 5099 return err; 5100 } 5101 5102 static int add_remote_oob_data(struct sock *sk, struct hci_dev *hdev, 5103 void *data, u16 len) 5104 { 5105 struct mgmt_addr_info *addr = data; 5106 int err; 5107 5108 bt_dev_dbg(hdev, "sock %p", sk); 5109 5110 if (!bdaddr_type_is_valid(addr->type)) 5111 return mgmt_cmd_complete(sk, hdev->id, 5112 MGMT_OP_ADD_REMOTE_OOB_DATA, 5113 MGMT_STATUS_INVALID_PARAMS, 5114 addr, sizeof(*addr)); 5115 5116 hci_dev_lock(hdev); 5117 5118 if (len == MGMT_ADD_REMOTE_OOB_DATA_SIZE) { 5119 struct mgmt_cp_add_remote_oob_data *cp = data; 5120 u8 status; 5121 5122 if (cp->addr.type != BDADDR_BREDR) { 5123 err = mgmt_cmd_complete(sk, hdev->id, 5124 MGMT_OP_ADD_REMOTE_OOB_DATA, 5125 MGMT_STATUS_INVALID_PARAMS, 5126 &cp->addr, sizeof(cp->addr)); 5127 goto unlock; 5128 } 5129 5130 err = hci_add_remote_oob_data(hdev, &cp->addr.bdaddr, 5131 cp->addr.type, cp->hash, 5132 cp->rand, NULL, NULL); 5133 if (err < 0) 5134 status = MGMT_STATUS_FAILED; 5135 else 5136 status = MGMT_STATUS_SUCCESS; 5137 5138 err = mgmt_cmd_complete(sk, hdev->id, 5139 MGMT_OP_ADD_REMOTE_OOB_DATA, status, 5140 &cp->addr, sizeof(cp->addr)); 5141 } else if (len == MGMT_ADD_REMOTE_OOB_EXT_DATA_SIZE) { 5142 struct mgmt_cp_add_remote_oob_ext_data *cp = data; 5143 u8 *rand192, *hash192, *rand256, *hash256; 5144 u8 status; 5145 5146 if (bdaddr_type_is_le(cp->addr.type)) { 5147 /* Enforce zero-valued 192-bit parameters as 5148 * long as legacy SMP OOB isn't implemented. 5149 */ 5150 if (memcmp(cp->rand192, ZERO_KEY, 16) || 5151 memcmp(cp->hash192, ZERO_KEY, 16)) { 5152 err = mgmt_cmd_complete(sk, hdev->id, 5153 MGMT_OP_ADD_REMOTE_OOB_DATA, 5154 MGMT_STATUS_INVALID_PARAMS, 5155 addr, sizeof(*addr)); 5156 goto unlock; 5157 } 5158 5159 rand192 = NULL; 5160 hash192 = NULL; 5161 } else { 5162 /* In case one of the P-192 values is set to zero, 5163 * then just disable OOB data for P-192. 5164 */ 5165 if (!memcmp(cp->rand192, ZERO_KEY, 16) || 5166 !memcmp(cp->hash192, ZERO_KEY, 16)) { 5167 rand192 = NULL; 5168 hash192 = NULL; 5169 } else { 5170 rand192 = cp->rand192; 5171 hash192 = cp->hash192; 5172 } 5173 } 5174 5175 /* In case one of the P-256 values is set to zero, then just 5176 * disable OOB data for P-256. 5177 */ 5178 if (!memcmp(cp->rand256, ZERO_KEY, 16) || 5179 !memcmp(cp->hash256, ZERO_KEY, 16)) { 5180 rand256 = NULL; 5181 hash256 = NULL; 5182 } else { 5183 rand256 = cp->rand256; 5184 hash256 = cp->hash256; 5185 } 5186 5187 err = hci_add_remote_oob_data(hdev, &cp->addr.bdaddr, 5188 cp->addr.type, hash192, rand192, 5189 hash256, rand256); 5190 if (err < 0) 5191 status = MGMT_STATUS_FAILED; 5192 else 5193 status = MGMT_STATUS_SUCCESS; 5194 5195 err = mgmt_cmd_complete(sk, hdev->id, 5196 MGMT_OP_ADD_REMOTE_OOB_DATA, 5197 status, &cp->addr, sizeof(cp->addr)); 5198 } else { 5199 bt_dev_err(hdev, "add_remote_oob_data: invalid len of %u bytes", 5200 len); 5201 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_REMOTE_OOB_DATA, 5202 MGMT_STATUS_INVALID_PARAMS); 5203 } 5204 5205 unlock: 5206 hci_dev_unlock(hdev); 5207 return err; 5208 } 5209 5210 static int remove_remote_oob_data(struct sock *sk, struct hci_dev *hdev, 5211 void *data, u16 len) 5212 { 5213 struct mgmt_cp_remove_remote_oob_data *cp = data; 5214 u8 status; 5215 int err; 5216 5217 bt_dev_dbg(hdev, "sock %p", sk); 5218 5219 if (cp->addr.type != BDADDR_BREDR) 5220 return mgmt_cmd_complete(sk, hdev->id, 5221 MGMT_OP_REMOVE_REMOTE_OOB_DATA, 5222 MGMT_STATUS_INVALID_PARAMS, 5223 &cp->addr, sizeof(cp->addr)); 5224 5225 hci_dev_lock(hdev); 5226 5227 if (!bacmp(&cp->addr.bdaddr, BDADDR_ANY)) { 5228 hci_remote_oob_data_clear(hdev); 5229 status = MGMT_STATUS_SUCCESS; 5230 goto done; 5231 } 5232 5233 err = hci_remove_remote_oob_data(hdev, &cp->addr.bdaddr, cp->addr.type); 5234 if (err < 0) 5235 status = MGMT_STATUS_INVALID_PARAMS; 5236 else 5237 status = MGMT_STATUS_SUCCESS; 5238 5239 done: 5240 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_REMOTE_OOB_DATA, 5241 status, &cp->addr, sizeof(cp->addr)); 5242 5243 hci_dev_unlock(hdev); 5244 return err; 5245 } 5246 5247 void mgmt_start_discovery_complete(struct hci_dev *hdev, u8 status) 5248 { 5249 struct mgmt_pending_cmd *cmd; 5250 5251 bt_dev_dbg(hdev, "status %u", status); 5252 5253 hci_dev_lock(hdev); 5254 5255 cmd = pending_find(MGMT_OP_START_DISCOVERY, hdev); 5256 if (!cmd) 5257 cmd = pending_find(MGMT_OP_START_SERVICE_DISCOVERY, hdev); 5258 5259 if (!cmd) 5260 cmd = pending_find(MGMT_OP_START_LIMITED_DISCOVERY, hdev); 5261 5262 if (cmd) { 5263 cmd->cmd_complete(cmd, mgmt_status(status)); 5264 mgmt_pending_remove(cmd); 5265 } 5266 5267 hci_dev_unlock(hdev); 5268 } 5269 5270 static bool discovery_type_is_valid(struct hci_dev *hdev, uint8_t type, 5271 uint8_t *mgmt_status) 5272 { 5273 switch (type) { 5274 case DISCOV_TYPE_LE: 5275 *mgmt_status = mgmt_le_support(hdev); 5276 if (*mgmt_status) 5277 return false; 5278 break; 5279 case DISCOV_TYPE_INTERLEAVED: 5280 *mgmt_status = mgmt_le_support(hdev); 5281 if (*mgmt_status) 5282 return false; 5283 fallthrough; 5284 case DISCOV_TYPE_BREDR: 5285 *mgmt_status = mgmt_bredr_support(hdev); 5286 if (*mgmt_status) 5287 return false; 5288 break; 5289 default: 5290 *mgmt_status = MGMT_STATUS_INVALID_PARAMS; 5291 return false; 5292 } 5293 5294 return true; 5295 } 5296 5297 static void start_discovery_complete(struct hci_dev *hdev, void *data, int err) 5298 { 5299 struct mgmt_pending_cmd *cmd = data; 5300 5301 if (cmd != pending_find(MGMT_OP_START_DISCOVERY, hdev) && 5302 cmd != pending_find(MGMT_OP_START_LIMITED_DISCOVERY, hdev) && 5303 cmd != pending_find(MGMT_OP_START_SERVICE_DISCOVERY, hdev)) 5304 return; 5305 5306 bt_dev_dbg(hdev, "err %d", err); 5307 5308 mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, mgmt_status(err), 5309 cmd->param, 1); 5310 mgmt_pending_remove(cmd); 5311 5312 hci_discovery_set_state(hdev, err ? DISCOVERY_STOPPED: 5313 DISCOVERY_FINDING); 5314 } 5315 5316 static int start_discovery_sync(struct hci_dev *hdev, void *data) 5317 { 5318 return hci_start_discovery_sync(hdev); 5319 } 5320 5321 static int start_discovery_internal(struct sock *sk, struct hci_dev *hdev, 5322 u16 op, void *data, u16 len) 5323 { 5324 struct mgmt_cp_start_discovery *cp = data; 5325 struct mgmt_pending_cmd *cmd; 5326 u8 status; 5327 int err; 5328 5329 bt_dev_dbg(hdev, "sock %p", sk); 5330 5331 hci_dev_lock(hdev); 5332 5333 if (!hdev_is_powered(hdev)) { 5334 err = mgmt_cmd_complete(sk, hdev->id, op, 5335 MGMT_STATUS_NOT_POWERED, 5336 &cp->type, sizeof(cp->type)); 5337 goto failed; 5338 } 5339 5340 if (hdev->discovery.state != DISCOVERY_STOPPED || 5341 hci_dev_test_flag(hdev, HCI_PERIODIC_INQ)) { 5342 err = mgmt_cmd_complete(sk, hdev->id, op, MGMT_STATUS_BUSY, 5343 &cp->type, sizeof(cp->type)); 5344 goto failed; 5345 } 5346 5347 if (!discovery_type_is_valid(hdev, cp->type, &status)) { 5348 err = mgmt_cmd_complete(sk, hdev->id, op, status, 5349 &cp->type, sizeof(cp->type)); 5350 goto failed; 5351 } 5352 5353 /* Can't start discovery when it is paused */ 5354 if (hdev->discovery_paused) { 5355 err = mgmt_cmd_complete(sk, hdev->id, op, MGMT_STATUS_BUSY, 5356 &cp->type, sizeof(cp->type)); 5357 goto failed; 5358 } 5359 5360 /* Clear the discovery filter first to free any previously 5361 * allocated memory for the UUID list. 5362 */ 5363 hci_discovery_filter_clear(hdev); 5364 5365 hdev->discovery.type = cp->type; 5366 hdev->discovery.report_invalid_rssi = false; 5367 if (op == MGMT_OP_START_LIMITED_DISCOVERY) 5368 hdev->discovery.limited = true; 5369 else 5370 hdev->discovery.limited = false; 5371 5372 cmd = mgmt_pending_add(sk, op, hdev, data, len); 5373 if (!cmd) { 5374 err = -ENOMEM; 5375 goto failed; 5376 } 5377 5378 err = hci_cmd_sync_queue(hdev, start_discovery_sync, cmd, 5379 start_discovery_complete); 5380 if (err < 0) { 5381 mgmt_pending_remove(cmd); 5382 goto failed; 5383 } 5384 5385 hci_discovery_set_state(hdev, DISCOVERY_STARTING); 5386 5387 failed: 5388 hci_dev_unlock(hdev); 5389 return err; 5390 } 5391 5392 static int start_discovery(struct sock *sk, struct hci_dev *hdev, 5393 void *data, u16 len) 5394 { 5395 return start_discovery_internal(sk, hdev, MGMT_OP_START_DISCOVERY, 5396 data, len); 5397 } 5398 5399 static int start_limited_discovery(struct sock *sk, struct hci_dev *hdev, 5400 void *data, u16 len) 5401 { 5402 return start_discovery_internal(sk, hdev, 5403 MGMT_OP_START_LIMITED_DISCOVERY, 5404 data, len); 5405 } 5406 5407 static int start_service_discovery(struct sock *sk, struct hci_dev *hdev, 5408 void *data, u16 len) 5409 { 5410 struct mgmt_cp_start_service_discovery *cp = data; 5411 struct mgmt_pending_cmd *cmd; 5412 const u16 max_uuid_count = ((U16_MAX - sizeof(*cp)) / 16); 5413 u16 uuid_count, expected_len; 5414 u8 status; 5415 int err; 5416 5417 bt_dev_dbg(hdev, "sock %p", sk); 5418 5419 hci_dev_lock(hdev); 5420 5421 if (!hdev_is_powered(hdev)) { 5422 err = mgmt_cmd_complete(sk, hdev->id, 5423 MGMT_OP_START_SERVICE_DISCOVERY, 5424 MGMT_STATUS_NOT_POWERED, 5425 &cp->type, sizeof(cp->type)); 5426 goto failed; 5427 } 5428 5429 if (hdev->discovery.state != DISCOVERY_STOPPED || 5430 hci_dev_test_flag(hdev, HCI_PERIODIC_INQ)) { 5431 err = mgmt_cmd_complete(sk, hdev->id, 5432 MGMT_OP_START_SERVICE_DISCOVERY, 5433 MGMT_STATUS_BUSY, &cp->type, 5434 sizeof(cp->type)); 5435 goto failed; 5436 } 5437 5438 if (hdev->discovery_paused) { 5439 err = mgmt_cmd_complete(sk, hdev->id, 5440 MGMT_OP_START_SERVICE_DISCOVERY, 5441 MGMT_STATUS_BUSY, &cp->type, 5442 sizeof(cp->type)); 5443 goto failed; 5444 } 5445 5446 uuid_count = __le16_to_cpu(cp->uuid_count); 5447 if (uuid_count > max_uuid_count) { 5448 bt_dev_err(hdev, "service_discovery: too big uuid_count value %u", 5449 uuid_count); 5450 err = mgmt_cmd_complete(sk, hdev->id, 5451 MGMT_OP_START_SERVICE_DISCOVERY, 5452 MGMT_STATUS_INVALID_PARAMS, &cp->type, 5453 sizeof(cp->type)); 5454 goto failed; 5455 } 5456 5457 expected_len = sizeof(*cp) + uuid_count * 16; 5458 if (expected_len != len) { 5459 bt_dev_err(hdev, "service_discovery: expected %u bytes, got %u bytes", 5460 expected_len, len); 5461 err = mgmt_cmd_complete(sk, hdev->id, 5462 MGMT_OP_START_SERVICE_DISCOVERY, 5463 MGMT_STATUS_INVALID_PARAMS, &cp->type, 5464 sizeof(cp->type)); 5465 goto failed; 5466 } 5467 5468 if (!discovery_type_is_valid(hdev, cp->type, &status)) { 5469 err = mgmt_cmd_complete(sk, hdev->id, 5470 MGMT_OP_START_SERVICE_DISCOVERY, 5471 status, &cp->type, sizeof(cp->type)); 5472 goto failed; 5473 } 5474 5475 cmd = mgmt_pending_add(sk, MGMT_OP_START_SERVICE_DISCOVERY, 5476 hdev, data, len); 5477 if (!cmd) { 5478 err = -ENOMEM; 5479 goto failed; 5480 } 5481 5482 /* Clear the discovery filter first to free any previously 5483 * allocated memory for the UUID list. 5484 */ 5485 hci_discovery_filter_clear(hdev); 5486 5487 hdev->discovery.result_filtering = true; 5488 hdev->discovery.type = cp->type; 5489 hdev->discovery.rssi = cp->rssi; 5490 hdev->discovery.uuid_count = uuid_count; 5491 5492 if (uuid_count > 0) { 5493 hdev->discovery.uuids = kmemdup(cp->uuids, uuid_count * 16, 5494 GFP_KERNEL); 5495 if (!hdev->discovery.uuids) { 5496 err = mgmt_cmd_complete(sk, hdev->id, 5497 MGMT_OP_START_SERVICE_DISCOVERY, 5498 MGMT_STATUS_FAILED, 5499 &cp->type, sizeof(cp->type)); 5500 mgmt_pending_remove(cmd); 5501 goto failed; 5502 } 5503 } 5504 5505 err = hci_cmd_sync_queue(hdev, start_discovery_sync, cmd, 5506 start_discovery_complete); 5507 if (err < 0) { 5508 mgmt_pending_remove(cmd); 5509 goto failed; 5510 } 5511 5512 hci_discovery_set_state(hdev, DISCOVERY_STARTING); 5513 5514 failed: 5515 hci_dev_unlock(hdev); 5516 return err; 5517 } 5518 5519 void mgmt_stop_discovery_complete(struct hci_dev *hdev, u8 status) 5520 { 5521 struct mgmt_pending_cmd *cmd; 5522 5523 bt_dev_dbg(hdev, "status %u", status); 5524 5525 hci_dev_lock(hdev); 5526 5527 cmd = pending_find(MGMT_OP_STOP_DISCOVERY, hdev); 5528 if (cmd) { 5529 cmd->cmd_complete(cmd, mgmt_status(status)); 5530 mgmt_pending_remove(cmd); 5531 } 5532 5533 hci_dev_unlock(hdev); 5534 } 5535 5536 static void stop_discovery_complete(struct hci_dev *hdev, void *data, int err) 5537 { 5538 struct mgmt_pending_cmd *cmd = data; 5539 5540 if (cmd != pending_find(MGMT_OP_STOP_DISCOVERY, hdev)) 5541 return; 5542 5543 bt_dev_dbg(hdev, "err %d", err); 5544 5545 mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, mgmt_status(err), 5546 cmd->param, 1); 5547 mgmt_pending_remove(cmd); 5548 5549 if (!err) 5550 hci_discovery_set_state(hdev, DISCOVERY_STOPPED); 5551 } 5552 5553 static int stop_discovery_sync(struct hci_dev *hdev, void *data) 5554 { 5555 return hci_stop_discovery_sync(hdev); 5556 } 5557 5558 static int stop_discovery(struct sock *sk, struct hci_dev *hdev, void *data, 5559 u16 len) 5560 { 5561 struct mgmt_cp_stop_discovery *mgmt_cp = data; 5562 struct mgmt_pending_cmd *cmd; 5563 int err; 5564 5565 bt_dev_dbg(hdev, "sock %p", sk); 5566 5567 hci_dev_lock(hdev); 5568 5569 if (!hci_discovery_active(hdev)) { 5570 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY, 5571 MGMT_STATUS_REJECTED, &mgmt_cp->type, 5572 sizeof(mgmt_cp->type)); 5573 goto unlock; 5574 } 5575 5576 if (hdev->discovery.type != mgmt_cp->type) { 5577 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY, 5578 MGMT_STATUS_INVALID_PARAMS, 5579 &mgmt_cp->type, sizeof(mgmt_cp->type)); 5580 goto unlock; 5581 } 5582 5583 cmd = mgmt_pending_add(sk, MGMT_OP_STOP_DISCOVERY, hdev, data, len); 5584 if (!cmd) { 5585 err = -ENOMEM; 5586 goto unlock; 5587 } 5588 5589 err = hci_cmd_sync_queue(hdev, stop_discovery_sync, cmd, 5590 stop_discovery_complete); 5591 if (err < 0) { 5592 mgmt_pending_remove(cmd); 5593 goto unlock; 5594 } 5595 5596 hci_discovery_set_state(hdev, DISCOVERY_STOPPING); 5597 5598 unlock: 5599 hci_dev_unlock(hdev); 5600 return err; 5601 } 5602 5603 static int confirm_name(struct sock *sk, struct hci_dev *hdev, void *data, 5604 u16 len) 5605 { 5606 struct mgmt_cp_confirm_name *cp = data; 5607 struct inquiry_entry *e; 5608 int err; 5609 5610 bt_dev_dbg(hdev, "sock %p", sk); 5611 5612 hci_dev_lock(hdev); 5613 5614 if (!hci_discovery_active(hdev)) { 5615 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME, 5616 MGMT_STATUS_FAILED, &cp->addr, 5617 sizeof(cp->addr)); 5618 goto failed; 5619 } 5620 5621 e = hci_inquiry_cache_lookup_unknown(hdev, &cp->addr.bdaddr); 5622 if (!e) { 5623 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME, 5624 MGMT_STATUS_INVALID_PARAMS, &cp->addr, 5625 sizeof(cp->addr)); 5626 goto failed; 5627 } 5628 5629 if (cp->name_known) { 5630 e->name_state = NAME_KNOWN; 5631 list_del(&e->list); 5632 } else { 5633 e->name_state = NAME_NEEDED; 5634 hci_inquiry_cache_update_resolve(hdev, e); 5635 } 5636 5637 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME, 0, 5638 &cp->addr, sizeof(cp->addr)); 5639 5640 failed: 5641 hci_dev_unlock(hdev); 5642 return err; 5643 } 5644 5645 static int block_device(struct sock *sk, struct hci_dev *hdev, void *data, 5646 u16 len) 5647 { 5648 struct mgmt_cp_block_device *cp = data; 5649 u8 status; 5650 int err; 5651 5652 bt_dev_dbg(hdev, "sock %p", sk); 5653 5654 if (!bdaddr_type_is_valid(cp->addr.type)) 5655 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_BLOCK_DEVICE, 5656 MGMT_STATUS_INVALID_PARAMS, 5657 &cp->addr, sizeof(cp->addr)); 5658 5659 hci_dev_lock(hdev); 5660 5661 err = hci_bdaddr_list_add(&hdev->reject_list, &cp->addr.bdaddr, 5662 cp->addr.type); 5663 if (err < 0) { 5664 status = MGMT_STATUS_FAILED; 5665 goto done; 5666 } 5667 5668 mgmt_event(MGMT_EV_DEVICE_BLOCKED, hdev, &cp->addr, sizeof(cp->addr), 5669 sk); 5670 status = MGMT_STATUS_SUCCESS; 5671 5672 done: 5673 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_BLOCK_DEVICE, status, 5674 &cp->addr, sizeof(cp->addr)); 5675 5676 hci_dev_unlock(hdev); 5677 5678 return err; 5679 } 5680 5681 static int unblock_device(struct sock *sk, struct hci_dev *hdev, void *data, 5682 u16 len) 5683 { 5684 struct mgmt_cp_unblock_device *cp = data; 5685 u8 status; 5686 int err; 5687 5688 bt_dev_dbg(hdev, "sock %p", sk); 5689 5690 if (!bdaddr_type_is_valid(cp->addr.type)) 5691 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNBLOCK_DEVICE, 5692 MGMT_STATUS_INVALID_PARAMS, 5693 &cp->addr, sizeof(cp->addr)); 5694 5695 hci_dev_lock(hdev); 5696 5697 err = hci_bdaddr_list_del(&hdev->reject_list, &cp->addr.bdaddr, 5698 cp->addr.type); 5699 if (err < 0) { 5700 status = MGMT_STATUS_INVALID_PARAMS; 5701 goto done; 5702 } 5703 5704 mgmt_event(MGMT_EV_DEVICE_UNBLOCKED, hdev, &cp->addr, sizeof(cp->addr), 5705 sk); 5706 status = MGMT_STATUS_SUCCESS; 5707 5708 done: 5709 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNBLOCK_DEVICE, status, 5710 &cp->addr, sizeof(cp->addr)); 5711 5712 hci_dev_unlock(hdev); 5713 5714 return err; 5715 } 5716 5717 static int set_device_id_sync(struct hci_dev *hdev, void *data) 5718 { 5719 return hci_update_eir_sync(hdev); 5720 } 5721 5722 static int set_device_id(struct sock *sk, struct hci_dev *hdev, void *data, 5723 u16 len) 5724 { 5725 struct mgmt_cp_set_device_id *cp = data; 5726 int err; 5727 __u16 source; 5728 5729 bt_dev_dbg(hdev, "sock %p", sk); 5730 5731 source = __le16_to_cpu(cp->source); 5732 5733 if (source > 0x0002) 5734 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEVICE_ID, 5735 MGMT_STATUS_INVALID_PARAMS); 5736 5737 hci_dev_lock(hdev); 5738 5739 hdev->devid_source = source; 5740 hdev->devid_vendor = __le16_to_cpu(cp->vendor); 5741 hdev->devid_product = __le16_to_cpu(cp->product); 5742 hdev->devid_version = __le16_to_cpu(cp->version); 5743 5744 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_DEVICE_ID, 0, 5745 NULL, 0); 5746 5747 hci_cmd_sync_queue(hdev, set_device_id_sync, NULL, NULL); 5748 5749 hci_dev_unlock(hdev); 5750 5751 return err; 5752 } 5753 5754 static void enable_advertising_instance(struct hci_dev *hdev, int err) 5755 { 5756 if (err) 5757 bt_dev_err(hdev, "failed to re-configure advertising %d", err); 5758 else 5759 bt_dev_dbg(hdev, "status %d", err); 5760 } 5761 5762 static void set_advertising_complete(struct hci_dev *hdev, void *data, int err) 5763 { 5764 struct cmd_lookup match = { NULL, hdev }; 5765 u8 instance; 5766 struct adv_info *adv_instance; 5767 u8 status = mgmt_status(err); 5768 5769 if (status) { 5770 mgmt_pending_foreach(MGMT_OP_SET_ADVERTISING, hdev, 5771 cmd_status_rsp, &status); 5772 return; 5773 } 5774 5775 if (hci_dev_test_flag(hdev, HCI_LE_ADV)) 5776 hci_dev_set_flag(hdev, HCI_ADVERTISING); 5777 else 5778 hci_dev_clear_flag(hdev, HCI_ADVERTISING); 5779 5780 mgmt_pending_foreach(MGMT_OP_SET_ADVERTISING, hdev, settings_rsp, 5781 &match); 5782 5783 new_settings(hdev, match.sk); 5784 5785 if (match.sk) 5786 sock_put(match.sk); 5787 5788 /* If "Set Advertising" was just disabled and instance advertising was 5789 * set up earlier, then re-enable multi-instance advertising. 5790 */ 5791 if (hci_dev_test_flag(hdev, HCI_ADVERTISING) || 5792 list_empty(&hdev->adv_instances)) 5793 return; 5794 5795 instance = hdev->cur_adv_instance; 5796 if (!instance) { 5797 adv_instance = list_first_entry_or_null(&hdev->adv_instances, 5798 struct adv_info, list); 5799 if (!adv_instance) 5800 return; 5801 5802 instance = adv_instance->instance; 5803 } 5804 5805 err = hci_schedule_adv_instance_sync(hdev, instance, true); 5806 5807 enable_advertising_instance(hdev, err); 5808 } 5809 5810 static int set_adv_sync(struct hci_dev *hdev, void *data) 5811 { 5812 struct mgmt_pending_cmd *cmd = data; 5813 struct mgmt_mode *cp = cmd->param; 5814 u8 val = !!cp->val; 5815 5816 if (cp->val == 0x02) 5817 hci_dev_set_flag(hdev, HCI_ADVERTISING_CONNECTABLE); 5818 else 5819 hci_dev_clear_flag(hdev, HCI_ADVERTISING_CONNECTABLE); 5820 5821 cancel_adv_timeout(hdev); 5822 5823 if (val) { 5824 /* Switch to instance "0" for the Set Advertising setting. 5825 * We cannot use update_[adv|scan_rsp]_data() here as the 5826 * HCI_ADVERTISING flag is not yet set. 5827 */ 5828 hdev->cur_adv_instance = 0x00; 5829 5830 if (ext_adv_capable(hdev)) { 5831 hci_start_ext_adv_sync(hdev, 0x00); 5832 } else { 5833 hci_update_adv_data_sync(hdev, 0x00); 5834 hci_update_scan_rsp_data_sync(hdev, 0x00); 5835 hci_enable_advertising_sync(hdev); 5836 } 5837 } else { 5838 hci_disable_advertising_sync(hdev); 5839 } 5840 5841 return 0; 5842 } 5843 5844 static int set_advertising(struct sock *sk, struct hci_dev *hdev, void *data, 5845 u16 len) 5846 { 5847 struct mgmt_mode *cp = data; 5848 struct mgmt_pending_cmd *cmd; 5849 u8 val, status; 5850 int err; 5851 5852 bt_dev_dbg(hdev, "sock %p", sk); 5853 5854 status = mgmt_le_support(hdev); 5855 if (status) 5856 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING, 5857 status); 5858 5859 if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02) 5860 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING, 5861 MGMT_STATUS_INVALID_PARAMS); 5862 5863 if (hdev->advertising_paused) 5864 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING, 5865 MGMT_STATUS_BUSY); 5866 5867 hci_dev_lock(hdev); 5868 5869 val = !!cp->val; 5870 5871 /* The following conditions are ones which mean that we should 5872 * not do any HCI communication but directly send a mgmt 5873 * response to user space (after toggling the flag if 5874 * necessary). 5875 */ 5876 if (!hdev_is_powered(hdev) || 5877 (val == hci_dev_test_flag(hdev, HCI_ADVERTISING) && 5878 (cp->val == 0x02) == hci_dev_test_flag(hdev, HCI_ADVERTISING_CONNECTABLE)) || 5879 hci_conn_num(hdev, LE_LINK) > 0 || 5880 (hci_dev_test_flag(hdev, HCI_LE_SCAN) && 5881 hdev->le_scan_type == LE_SCAN_ACTIVE)) { 5882 bool changed; 5883 5884 if (cp->val) { 5885 hdev->cur_adv_instance = 0x00; 5886 changed = !hci_dev_test_and_set_flag(hdev, HCI_ADVERTISING); 5887 if (cp->val == 0x02) 5888 hci_dev_set_flag(hdev, HCI_ADVERTISING_CONNECTABLE); 5889 else 5890 hci_dev_clear_flag(hdev, HCI_ADVERTISING_CONNECTABLE); 5891 } else { 5892 changed = hci_dev_test_and_clear_flag(hdev, HCI_ADVERTISING); 5893 hci_dev_clear_flag(hdev, HCI_ADVERTISING_CONNECTABLE); 5894 } 5895 5896 err = send_settings_rsp(sk, MGMT_OP_SET_ADVERTISING, hdev); 5897 if (err < 0) 5898 goto unlock; 5899 5900 if (changed) 5901 err = new_settings(hdev, sk); 5902 5903 goto unlock; 5904 } 5905 5906 if (pending_find(MGMT_OP_SET_ADVERTISING, hdev) || 5907 pending_find(MGMT_OP_SET_LE, hdev)) { 5908 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING, 5909 MGMT_STATUS_BUSY); 5910 goto unlock; 5911 } 5912 5913 cmd = mgmt_pending_add(sk, MGMT_OP_SET_ADVERTISING, hdev, data, len); 5914 if (!cmd) 5915 err = -ENOMEM; 5916 else 5917 err = hci_cmd_sync_queue(hdev, set_adv_sync, cmd, 5918 set_advertising_complete); 5919 5920 if (err < 0 && cmd) 5921 mgmt_pending_remove(cmd); 5922 5923 unlock: 5924 hci_dev_unlock(hdev); 5925 return err; 5926 } 5927 5928 static int set_static_address(struct sock *sk, struct hci_dev *hdev, 5929 void *data, u16 len) 5930 { 5931 struct mgmt_cp_set_static_address *cp = data; 5932 int err; 5933 5934 bt_dev_dbg(hdev, "sock %p", sk); 5935 5936 if (!lmp_le_capable(hdev)) 5937 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_STATIC_ADDRESS, 5938 MGMT_STATUS_NOT_SUPPORTED); 5939 5940 if (hdev_is_powered(hdev)) 5941 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_STATIC_ADDRESS, 5942 MGMT_STATUS_REJECTED); 5943 5944 if (bacmp(&cp->bdaddr, BDADDR_ANY)) { 5945 if (!bacmp(&cp->bdaddr, BDADDR_NONE)) 5946 return mgmt_cmd_status(sk, hdev->id, 5947 MGMT_OP_SET_STATIC_ADDRESS, 5948 MGMT_STATUS_INVALID_PARAMS); 5949 5950 /* Two most significant bits shall be set */ 5951 if ((cp->bdaddr.b[5] & 0xc0) != 0xc0) 5952 return mgmt_cmd_status(sk, hdev->id, 5953 MGMT_OP_SET_STATIC_ADDRESS, 5954 MGMT_STATUS_INVALID_PARAMS); 5955 } 5956 5957 hci_dev_lock(hdev); 5958 5959 bacpy(&hdev->static_addr, &cp->bdaddr); 5960 5961 err = send_settings_rsp(sk, MGMT_OP_SET_STATIC_ADDRESS, hdev); 5962 if (err < 0) 5963 goto unlock; 5964 5965 err = new_settings(hdev, sk); 5966 5967 unlock: 5968 hci_dev_unlock(hdev); 5969 return err; 5970 } 5971 5972 static int set_scan_params(struct sock *sk, struct hci_dev *hdev, 5973 void *data, u16 len) 5974 { 5975 struct mgmt_cp_set_scan_params *cp = data; 5976 __u16 interval, window; 5977 int err; 5978 5979 bt_dev_dbg(hdev, "sock %p", sk); 5980 5981 if (!lmp_le_capable(hdev)) 5982 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS, 5983 MGMT_STATUS_NOT_SUPPORTED); 5984 5985 interval = __le16_to_cpu(cp->interval); 5986 5987 if (interval < 0x0004 || interval > 0x4000) 5988 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS, 5989 MGMT_STATUS_INVALID_PARAMS); 5990 5991 window = __le16_to_cpu(cp->window); 5992 5993 if (window < 0x0004 || window > 0x4000) 5994 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS, 5995 MGMT_STATUS_INVALID_PARAMS); 5996 5997 if (window > interval) 5998 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS, 5999 MGMT_STATUS_INVALID_PARAMS); 6000 6001 hci_dev_lock(hdev); 6002 6003 hdev->le_scan_interval = interval; 6004 hdev->le_scan_window = window; 6005 6006 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS, 0, 6007 NULL, 0); 6008 6009 /* If background scan is running, restart it so new parameters are 6010 * loaded. 6011 */ 6012 if (hci_dev_test_flag(hdev, HCI_LE_SCAN) && 6013 hdev->discovery.state == DISCOVERY_STOPPED) 6014 hci_update_passive_scan(hdev); 6015 6016 hci_dev_unlock(hdev); 6017 6018 return err; 6019 } 6020 6021 static void fast_connectable_complete(struct hci_dev *hdev, void *data, int err) 6022 { 6023 struct mgmt_pending_cmd *cmd = data; 6024 6025 bt_dev_dbg(hdev, "err %d", err); 6026 6027 if (err) { 6028 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE, 6029 mgmt_status(err)); 6030 } else { 6031 struct mgmt_mode *cp = cmd->param; 6032 6033 if (cp->val) 6034 hci_dev_set_flag(hdev, HCI_FAST_CONNECTABLE); 6035 else 6036 hci_dev_clear_flag(hdev, HCI_FAST_CONNECTABLE); 6037 6038 send_settings_rsp(cmd->sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev); 6039 new_settings(hdev, cmd->sk); 6040 } 6041 6042 mgmt_pending_free(cmd); 6043 } 6044 6045 static int write_fast_connectable_sync(struct hci_dev *hdev, void *data) 6046 { 6047 struct mgmt_pending_cmd *cmd = data; 6048 struct mgmt_mode *cp = cmd->param; 6049 6050 return hci_write_fast_connectable_sync(hdev, cp->val); 6051 } 6052 6053 static int set_fast_connectable(struct sock *sk, struct hci_dev *hdev, 6054 void *data, u16 len) 6055 { 6056 struct mgmt_mode *cp = data; 6057 struct mgmt_pending_cmd *cmd; 6058 int err; 6059 6060 bt_dev_dbg(hdev, "sock %p", sk); 6061 6062 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) || 6063 hdev->hci_ver < BLUETOOTH_VER_1_2) 6064 return mgmt_cmd_status(sk, hdev->id, 6065 MGMT_OP_SET_FAST_CONNECTABLE, 6066 MGMT_STATUS_NOT_SUPPORTED); 6067 6068 if (cp->val != 0x00 && cp->val != 0x01) 6069 return mgmt_cmd_status(sk, hdev->id, 6070 MGMT_OP_SET_FAST_CONNECTABLE, 6071 MGMT_STATUS_INVALID_PARAMS); 6072 6073 hci_dev_lock(hdev); 6074 6075 if (!!cp->val == hci_dev_test_flag(hdev, HCI_FAST_CONNECTABLE)) { 6076 err = send_settings_rsp(sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev); 6077 goto unlock; 6078 } 6079 6080 if (!hdev_is_powered(hdev)) { 6081 hci_dev_change_flag(hdev, HCI_FAST_CONNECTABLE); 6082 err = send_settings_rsp(sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev); 6083 new_settings(hdev, sk); 6084 goto unlock; 6085 } 6086 6087 cmd = mgmt_pending_new(sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev, data, 6088 len); 6089 if (!cmd) 6090 err = -ENOMEM; 6091 else 6092 err = hci_cmd_sync_queue(hdev, write_fast_connectable_sync, cmd, 6093 fast_connectable_complete); 6094 6095 if (err < 0) { 6096 mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE, 6097 MGMT_STATUS_FAILED); 6098 6099 if (cmd) 6100 mgmt_pending_free(cmd); 6101 } 6102 6103 unlock: 6104 hci_dev_unlock(hdev); 6105 6106 return err; 6107 } 6108 6109 static void set_bredr_complete(struct hci_dev *hdev, void *data, int err) 6110 { 6111 struct mgmt_pending_cmd *cmd = data; 6112 6113 bt_dev_dbg(hdev, "err %d", err); 6114 6115 if (err) { 6116 u8 mgmt_err = mgmt_status(err); 6117 6118 /* We need to restore the flag if related HCI commands 6119 * failed. 6120 */ 6121 hci_dev_clear_flag(hdev, HCI_BREDR_ENABLED); 6122 6123 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err); 6124 } else { 6125 send_settings_rsp(cmd->sk, MGMT_OP_SET_BREDR, hdev); 6126 new_settings(hdev, cmd->sk); 6127 } 6128 6129 mgmt_pending_free(cmd); 6130 } 6131 6132 static int set_bredr_sync(struct hci_dev *hdev, void *data) 6133 { 6134 int status; 6135 6136 status = hci_write_fast_connectable_sync(hdev, false); 6137 6138 if (!status) 6139 status = hci_update_scan_sync(hdev); 6140 6141 /* Since only the advertising data flags will change, there 6142 * is no need to update the scan response data. 6143 */ 6144 if (!status) 6145 status = hci_update_adv_data_sync(hdev, hdev->cur_adv_instance); 6146 6147 return status; 6148 } 6149 6150 static int set_bredr(struct sock *sk, struct hci_dev *hdev, void *data, u16 len) 6151 { 6152 struct mgmt_mode *cp = data; 6153 struct mgmt_pending_cmd *cmd; 6154 int err; 6155 6156 bt_dev_dbg(hdev, "sock %p", sk); 6157 6158 if (!lmp_bredr_capable(hdev) || !lmp_le_capable(hdev)) 6159 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR, 6160 MGMT_STATUS_NOT_SUPPORTED); 6161 6162 if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED)) 6163 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR, 6164 MGMT_STATUS_REJECTED); 6165 6166 if (cp->val != 0x00 && cp->val != 0x01) 6167 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR, 6168 MGMT_STATUS_INVALID_PARAMS); 6169 6170 hci_dev_lock(hdev); 6171 6172 if (cp->val == hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) { 6173 err = send_settings_rsp(sk, MGMT_OP_SET_BREDR, hdev); 6174 goto unlock; 6175 } 6176 6177 if (!hdev_is_powered(hdev)) { 6178 if (!cp->val) { 6179 hci_dev_clear_flag(hdev, HCI_DISCOVERABLE); 6180 hci_dev_clear_flag(hdev, HCI_SSP_ENABLED); 6181 hci_dev_clear_flag(hdev, HCI_LINK_SECURITY); 6182 hci_dev_clear_flag(hdev, HCI_FAST_CONNECTABLE); 6183 hci_dev_clear_flag(hdev, HCI_HS_ENABLED); 6184 } 6185 6186 hci_dev_change_flag(hdev, HCI_BREDR_ENABLED); 6187 6188 err = send_settings_rsp(sk, MGMT_OP_SET_BREDR, hdev); 6189 if (err < 0) 6190 goto unlock; 6191 6192 err = new_settings(hdev, sk); 6193 goto unlock; 6194 } 6195 6196 /* Reject disabling when powered on */ 6197 if (!cp->val) { 6198 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR, 6199 MGMT_STATUS_REJECTED); 6200 goto unlock; 6201 } else { 6202 /* When configuring a dual-mode controller to operate 6203 * with LE only and using a static address, then switching 6204 * BR/EDR back on is not allowed. 6205 * 6206 * Dual-mode controllers shall operate with the public 6207 * address as its identity address for BR/EDR and LE. So 6208 * reject the attempt to create an invalid configuration. 6209 * 6210 * The same restrictions applies when secure connections 6211 * has been enabled. For BR/EDR this is a controller feature 6212 * while for LE it is a host stack feature. This means that 6213 * switching BR/EDR back on when secure connections has been 6214 * enabled is not a supported transaction. 6215 */ 6216 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) && 6217 (bacmp(&hdev->static_addr, BDADDR_ANY) || 6218 hci_dev_test_flag(hdev, HCI_SC_ENABLED))) { 6219 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR, 6220 MGMT_STATUS_REJECTED); 6221 goto unlock; 6222 } 6223 } 6224 6225 cmd = mgmt_pending_new(sk, MGMT_OP_SET_BREDR, hdev, data, len); 6226 if (!cmd) 6227 err = -ENOMEM; 6228 else 6229 err = hci_cmd_sync_queue(hdev, set_bredr_sync, cmd, 6230 set_bredr_complete); 6231 6232 if (err < 0) { 6233 mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR, 6234 MGMT_STATUS_FAILED); 6235 if (cmd) 6236 mgmt_pending_free(cmd); 6237 6238 goto unlock; 6239 } 6240 6241 /* We need to flip the bit already here so that 6242 * hci_req_update_adv_data generates the correct flags. 6243 */ 6244 hci_dev_set_flag(hdev, HCI_BREDR_ENABLED); 6245 6246 unlock: 6247 hci_dev_unlock(hdev); 6248 return err; 6249 } 6250 6251 static void set_secure_conn_complete(struct hci_dev *hdev, void *data, int err) 6252 { 6253 struct mgmt_pending_cmd *cmd = data; 6254 struct mgmt_mode *cp; 6255 6256 bt_dev_dbg(hdev, "err %d", err); 6257 6258 if (err) { 6259 u8 mgmt_err = mgmt_status(err); 6260 6261 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err); 6262 goto done; 6263 } 6264 6265 cp = cmd->param; 6266 6267 switch (cp->val) { 6268 case 0x00: 6269 hci_dev_clear_flag(hdev, HCI_SC_ENABLED); 6270 hci_dev_clear_flag(hdev, HCI_SC_ONLY); 6271 break; 6272 case 0x01: 6273 hci_dev_set_flag(hdev, HCI_SC_ENABLED); 6274 hci_dev_clear_flag(hdev, HCI_SC_ONLY); 6275 break; 6276 case 0x02: 6277 hci_dev_set_flag(hdev, HCI_SC_ENABLED); 6278 hci_dev_set_flag(hdev, HCI_SC_ONLY); 6279 break; 6280 } 6281 6282 send_settings_rsp(cmd->sk, cmd->opcode, hdev); 6283 new_settings(hdev, cmd->sk); 6284 6285 done: 6286 mgmt_pending_free(cmd); 6287 } 6288 6289 static int set_secure_conn_sync(struct hci_dev *hdev, void *data) 6290 { 6291 struct mgmt_pending_cmd *cmd = data; 6292 struct mgmt_mode *cp = cmd->param; 6293 u8 val = !!cp->val; 6294 6295 /* Force write of val */ 6296 hci_dev_set_flag(hdev, HCI_SC_ENABLED); 6297 6298 return hci_write_sc_support_sync(hdev, val); 6299 } 6300 6301 static int set_secure_conn(struct sock *sk, struct hci_dev *hdev, 6302 void *data, u16 len) 6303 { 6304 struct mgmt_mode *cp = data; 6305 struct mgmt_pending_cmd *cmd; 6306 u8 val; 6307 int err; 6308 6309 bt_dev_dbg(hdev, "sock %p", sk); 6310 6311 if (!lmp_sc_capable(hdev) && 6312 !hci_dev_test_flag(hdev, HCI_LE_ENABLED)) 6313 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN, 6314 MGMT_STATUS_NOT_SUPPORTED); 6315 6316 if (hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) && 6317 lmp_sc_capable(hdev) && 6318 !hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) 6319 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN, 6320 MGMT_STATUS_REJECTED); 6321 6322 if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02) 6323 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN, 6324 MGMT_STATUS_INVALID_PARAMS); 6325 6326 hci_dev_lock(hdev); 6327 6328 if (!hdev_is_powered(hdev) || !lmp_sc_capable(hdev) || 6329 !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) { 6330 bool changed; 6331 6332 if (cp->val) { 6333 changed = !hci_dev_test_and_set_flag(hdev, 6334 HCI_SC_ENABLED); 6335 if (cp->val == 0x02) 6336 hci_dev_set_flag(hdev, HCI_SC_ONLY); 6337 else 6338 hci_dev_clear_flag(hdev, HCI_SC_ONLY); 6339 } else { 6340 changed = hci_dev_test_and_clear_flag(hdev, 6341 HCI_SC_ENABLED); 6342 hci_dev_clear_flag(hdev, HCI_SC_ONLY); 6343 } 6344 6345 err = send_settings_rsp(sk, MGMT_OP_SET_SECURE_CONN, hdev); 6346 if (err < 0) 6347 goto failed; 6348 6349 if (changed) 6350 err = new_settings(hdev, sk); 6351 6352 goto failed; 6353 } 6354 6355 val = !!cp->val; 6356 6357 if (val == hci_dev_test_flag(hdev, HCI_SC_ENABLED) && 6358 (cp->val == 0x02) == hci_dev_test_flag(hdev, HCI_SC_ONLY)) { 6359 err = send_settings_rsp(sk, MGMT_OP_SET_SECURE_CONN, hdev); 6360 goto failed; 6361 } 6362 6363 cmd = mgmt_pending_new(sk, MGMT_OP_SET_SECURE_CONN, hdev, data, len); 6364 if (!cmd) 6365 err = -ENOMEM; 6366 else 6367 err = hci_cmd_sync_queue(hdev, set_secure_conn_sync, cmd, 6368 set_secure_conn_complete); 6369 6370 if (err < 0) { 6371 mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN, 6372 MGMT_STATUS_FAILED); 6373 if (cmd) 6374 mgmt_pending_free(cmd); 6375 } 6376 6377 failed: 6378 hci_dev_unlock(hdev); 6379 return err; 6380 } 6381 6382 static int set_debug_keys(struct sock *sk, struct hci_dev *hdev, 6383 void *data, u16 len) 6384 { 6385 struct mgmt_mode *cp = data; 6386 bool changed, use_changed; 6387 int err; 6388 6389 bt_dev_dbg(hdev, "sock %p", sk); 6390 6391 if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02) 6392 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEBUG_KEYS, 6393 MGMT_STATUS_INVALID_PARAMS); 6394 6395 hci_dev_lock(hdev); 6396 6397 if (cp->val) 6398 changed = !hci_dev_test_and_set_flag(hdev, HCI_KEEP_DEBUG_KEYS); 6399 else 6400 changed = hci_dev_test_and_clear_flag(hdev, 6401 HCI_KEEP_DEBUG_KEYS); 6402 6403 if (cp->val == 0x02) 6404 use_changed = !hci_dev_test_and_set_flag(hdev, 6405 HCI_USE_DEBUG_KEYS); 6406 else 6407 use_changed = hci_dev_test_and_clear_flag(hdev, 6408 HCI_USE_DEBUG_KEYS); 6409 6410 if (hdev_is_powered(hdev) && use_changed && 6411 hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) { 6412 u8 mode = (cp->val == 0x02) ? 0x01 : 0x00; 6413 hci_send_cmd(hdev, HCI_OP_WRITE_SSP_DEBUG_MODE, 6414 sizeof(mode), &mode); 6415 } 6416 6417 err = send_settings_rsp(sk, MGMT_OP_SET_DEBUG_KEYS, hdev); 6418 if (err < 0) 6419 goto unlock; 6420 6421 if (changed) 6422 err = new_settings(hdev, sk); 6423 6424 unlock: 6425 hci_dev_unlock(hdev); 6426 return err; 6427 } 6428 6429 static int set_privacy(struct sock *sk, struct hci_dev *hdev, void *cp_data, 6430 u16 len) 6431 { 6432 struct mgmt_cp_set_privacy *cp = cp_data; 6433 bool changed; 6434 int err; 6435 6436 bt_dev_dbg(hdev, "sock %p", sk); 6437 6438 if (!lmp_le_capable(hdev)) 6439 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY, 6440 MGMT_STATUS_NOT_SUPPORTED); 6441 6442 if (cp->privacy != 0x00 && cp->privacy != 0x01 && cp->privacy != 0x02) 6443 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY, 6444 MGMT_STATUS_INVALID_PARAMS); 6445 6446 if (hdev_is_powered(hdev)) 6447 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY, 6448 MGMT_STATUS_REJECTED); 6449 6450 hci_dev_lock(hdev); 6451 6452 /* If user space supports this command it is also expected to 6453 * handle IRKs. Therefore, set the HCI_RPA_RESOLVING flag. 6454 */ 6455 hci_dev_set_flag(hdev, HCI_RPA_RESOLVING); 6456 6457 if (cp->privacy) { 6458 changed = !hci_dev_test_and_set_flag(hdev, HCI_PRIVACY); 6459 memcpy(hdev->irk, cp->irk, sizeof(hdev->irk)); 6460 hci_dev_set_flag(hdev, HCI_RPA_EXPIRED); 6461 hci_adv_instances_set_rpa_expired(hdev, true); 6462 if (cp->privacy == 0x02) 6463 hci_dev_set_flag(hdev, HCI_LIMITED_PRIVACY); 6464 else 6465 hci_dev_clear_flag(hdev, HCI_LIMITED_PRIVACY); 6466 } else { 6467 changed = hci_dev_test_and_clear_flag(hdev, HCI_PRIVACY); 6468 memset(hdev->irk, 0, sizeof(hdev->irk)); 6469 hci_dev_clear_flag(hdev, HCI_RPA_EXPIRED); 6470 hci_adv_instances_set_rpa_expired(hdev, false); 6471 hci_dev_clear_flag(hdev, HCI_LIMITED_PRIVACY); 6472 } 6473 6474 err = send_settings_rsp(sk, MGMT_OP_SET_PRIVACY, hdev); 6475 if (err < 0) 6476 goto unlock; 6477 6478 if (changed) 6479 err = new_settings(hdev, sk); 6480 6481 unlock: 6482 hci_dev_unlock(hdev); 6483 return err; 6484 } 6485 6486 static bool irk_is_valid(struct mgmt_irk_info *irk) 6487 { 6488 switch (irk->addr.type) { 6489 case BDADDR_LE_PUBLIC: 6490 return true; 6491 6492 case BDADDR_LE_RANDOM: 6493 /* Two most significant bits shall be set */ 6494 if ((irk->addr.bdaddr.b[5] & 0xc0) != 0xc0) 6495 return false; 6496 return true; 6497 } 6498 6499 return false; 6500 } 6501 6502 static int load_irks(struct sock *sk, struct hci_dev *hdev, void *cp_data, 6503 u16 len) 6504 { 6505 struct mgmt_cp_load_irks *cp = cp_data; 6506 const u16 max_irk_count = ((U16_MAX - sizeof(*cp)) / 6507 sizeof(struct mgmt_irk_info)); 6508 u16 irk_count, expected_len; 6509 int i, err; 6510 6511 bt_dev_dbg(hdev, "sock %p", sk); 6512 6513 if (!lmp_le_capable(hdev)) 6514 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS, 6515 MGMT_STATUS_NOT_SUPPORTED); 6516 6517 irk_count = __le16_to_cpu(cp->irk_count); 6518 if (irk_count > max_irk_count) { 6519 bt_dev_err(hdev, "load_irks: too big irk_count value %u", 6520 irk_count); 6521 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS, 6522 MGMT_STATUS_INVALID_PARAMS); 6523 } 6524 6525 expected_len = struct_size(cp, irks, irk_count); 6526 if (expected_len != len) { 6527 bt_dev_err(hdev, "load_irks: expected %u bytes, got %u bytes", 6528 expected_len, len); 6529 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS, 6530 MGMT_STATUS_INVALID_PARAMS); 6531 } 6532 6533 bt_dev_dbg(hdev, "irk_count %u", irk_count); 6534 6535 for (i = 0; i < irk_count; i++) { 6536 struct mgmt_irk_info *key = &cp->irks[i]; 6537 6538 if (!irk_is_valid(key)) 6539 return mgmt_cmd_status(sk, hdev->id, 6540 MGMT_OP_LOAD_IRKS, 6541 MGMT_STATUS_INVALID_PARAMS); 6542 } 6543 6544 hci_dev_lock(hdev); 6545 6546 hci_smp_irks_clear(hdev); 6547 6548 for (i = 0; i < irk_count; i++) { 6549 struct mgmt_irk_info *irk = &cp->irks[i]; 6550 6551 if (hci_is_blocked_key(hdev, 6552 HCI_BLOCKED_KEY_TYPE_IRK, 6553 irk->val)) { 6554 bt_dev_warn(hdev, "Skipping blocked IRK for %pMR", 6555 &irk->addr.bdaddr); 6556 continue; 6557 } 6558 6559 hci_add_irk(hdev, &irk->addr.bdaddr, 6560 le_addr_type(irk->addr.type), irk->val, 6561 BDADDR_ANY); 6562 } 6563 6564 hci_dev_set_flag(hdev, HCI_RPA_RESOLVING); 6565 6566 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_IRKS, 0, NULL, 0); 6567 6568 hci_dev_unlock(hdev); 6569 6570 return err; 6571 } 6572 6573 static bool ltk_is_valid(struct mgmt_ltk_info *key) 6574 { 6575 if (key->initiator != 0x00 && key->initiator != 0x01) 6576 return false; 6577 6578 switch (key->addr.type) { 6579 case BDADDR_LE_PUBLIC: 6580 return true; 6581 6582 case BDADDR_LE_RANDOM: 6583 /* Two most significant bits shall be set */ 6584 if ((key->addr.bdaddr.b[5] & 0xc0) != 0xc0) 6585 return false; 6586 return true; 6587 } 6588 6589 return false; 6590 } 6591 6592 static int load_long_term_keys(struct sock *sk, struct hci_dev *hdev, 6593 void *cp_data, u16 len) 6594 { 6595 struct mgmt_cp_load_long_term_keys *cp = cp_data; 6596 const u16 max_key_count = ((U16_MAX - sizeof(*cp)) / 6597 sizeof(struct mgmt_ltk_info)); 6598 u16 key_count, expected_len; 6599 int i, err; 6600 6601 bt_dev_dbg(hdev, "sock %p", sk); 6602 6603 if (!lmp_le_capable(hdev)) 6604 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS, 6605 MGMT_STATUS_NOT_SUPPORTED); 6606 6607 key_count = __le16_to_cpu(cp->key_count); 6608 if (key_count > max_key_count) { 6609 bt_dev_err(hdev, "load_ltks: too big key_count value %u", 6610 key_count); 6611 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS, 6612 MGMT_STATUS_INVALID_PARAMS); 6613 } 6614 6615 expected_len = struct_size(cp, keys, key_count); 6616 if (expected_len != len) { 6617 bt_dev_err(hdev, "load_keys: expected %u bytes, got %u bytes", 6618 expected_len, len); 6619 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS, 6620 MGMT_STATUS_INVALID_PARAMS); 6621 } 6622 6623 bt_dev_dbg(hdev, "key_count %u", key_count); 6624 6625 for (i = 0; i < key_count; i++) { 6626 struct mgmt_ltk_info *key = &cp->keys[i]; 6627 6628 if (!ltk_is_valid(key)) 6629 return mgmt_cmd_status(sk, hdev->id, 6630 MGMT_OP_LOAD_LONG_TERM_KEYS, 6631 MGMT_STATUS_INVALID_PARAMS); 6632 } 6633 6634 hci_dev_lock(hdev); 6635 6636 hci_smp_ltks_clear(hdev); 6637 6638 for (i = 0; i < key_count; i++) { 6639 struct mgmt_ltk_info *key = &cp->keys[i]; 6640 u8 type, authenticated; 6641 6642 if (hci_is_blocked_key(hdev, 6643 HCI_BLOCKED_KEY_TYPE_LTK, 6644 key->val)) { 6645 bt_dev_warn(hdev, "Skipping blocked LTK for %pMR", 6646 &key->addr.bdaddr); 6647 continue; 6648 } 6649 6650 switch (key->type) { 6651 case MGMT_LTK_UNAUTHENTICATED: 6652 authenticated = 0x00; 6653 type = key->initiator ? SMP_LTK : SMP_LTK_RESPONDER; 6654 break; 6655 case MGMT_LTK_AUTHENTICATED: 6656 authenticated = 0x01; 6657 type = key->initiator ? SMP_LTK : SMP_LTK_RESPONDER; 6658 break; 6659 case MGMT_LTK_P256_UNAUTH: 6660 authenticated = 0x00; 6661 type = SMP_LTK_P256; 6662 break; 6663 case MGMT_LTK_P256_AUTH: 6664 authenticated = 0x01; 6665 type = SMP_LTK_P256; 6666 break; 6667 case MGMT_LTK_P256_DEBUG: 6668 authenticated = 0x00; 6669 type = SMP_LTK_P256_DEBUG; 6670 fallthrough; 6671 default: 6672 continue; 6673 } 6674 6675 hci_add_ltk(hdev, &key->addr.bdaddr, 6676 le_addr_type(key->addr.type), type, authenticated, 6677 key->val, key->enc_size, key->ediv, key->rand); 6678 } 6679 6680 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS, 0, 6681 NULL, 0); 6682 6683 hci_dev_unlock(hdev); 6684 6685 return err; 6686 } 6687 6688 static void get_conn_info_complete(struct hci_dev *hdev, void *data, int err) 6689 { 6690 struct mgmt_pending_cmd *cmd = data; 6691 struct hci_conn *conn = cmd->user_data; 6692 struct mgmt_cp_get_conn_info *cp = cmd->param; 6693 struct mgmt_rp_get_conn_info rp; 6694 u8 status; 6695 6696 bt_dev_dbg(hdev, "err %d", err); 6697 6698 memcpy(&rp.addr, &cp->addr.bdaddr, sizeof(rp.addr)); 6699 6700 status = mgmt_status(err); 6701 if (status == MGMT_STATUS_SUCCESS) { 6702 rp.rssi = conn->rssi; 6703 rp.tx_power = conn->tx_power; 6704 rp.max_tx_power = conn->max_tx_power; 6705 } else { 6706 rp.rssi = HCI_RSSI_INVALID; 6707 rp.tx_power = HCI_TX_POWER_INVALID; 6708 rp.max_tx_power = HCI_TX_POWER_INVALID; 6709 } 6710 6711 mgmt_cmd_complete(cmd->sk, cmd->index, MGMT_OP_GET_CONN_INFO, status, 6712 &rp, sizeof(rp)); 6713 6714 if (conn) { 6715 hci_conn_drop(conn); 6716 hci_conn_put(conn); 6717 } 6718 6719 mgmt_pending_free(cmd); 6720 } 6721 6722 static int get_conn_info_sync(struct hci_dev *hdev, void *data) 6723 { 6724 struct mgmt_pending_cmd *cmd = data; 6725 struct mgmt_cp_get_conn_info *cp = cmd->param; 6726 struct hci_conn *conn; 6727 int err; 6728 __le16 handle; 6729 6730 /* Make sure we are still connected */ 6731 if (cp->addr.type == BDADDR_BREDR) 6732 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, 6733 &cp->addr.bdaddr); 6734 else 6735 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &cp->addr.bdaddr); 6736 6737 if (!conn || conn != cmd->user_data || conn->state != BT_CONNECTED) { 6738 if (cmd->user_data) { 6739 hci_conn_drop(cmd->user_data); 6740 hci_conn_put(cmd->user_data); 6741 cmd->user_data = NULL; 6742 } 6743 return MGMT_STATUS_NOT_CONNECTED; 6744 } 6745 6746 handle = cpu_to_le16(conn->handle); 6747 6748 /* Refresh RSSI each time */ 6749 err = hci_read_rssi_sync(hdev, handle); 6750 6751 /* For LE links TX power does not change thus we don't need to 6752 * query for it once value is known. 6753 */ 6754 if (!err && (!bdaddr_type_is_le(cp->addr.type) || 6755 conn->tx_power == HCI_TX_POWER_INVALID)) 6756 err = hci_read_tx_power_sync(hdev, handle, 0x00); 6757 6758 /* Max TX power needs to be read only once per connection */ 6759 if (!err && conn->max_tx_power == HCI_TX_POWER_INVALID) 6760 err = hci_read_tx_power_sync(hdev, handle, 0x01); 6761 6762 return err; 6763 } 6764 6765 static int get_conn_info(struct sock *sk, struct hci_dev *hdev, void *data, 6766 u16 len) 6767 { 6768 struct mgmt_cp_get_conn_info *cp = data; 6769 struct mgmt_rp_get_conn_info rp; 6770 struct hci_conn *conn; 6771 unsigned long conn_info_age; 6772 int err = 0; 6773 6774 bt_dev_dbg(hdev, "sock %p", sk); 6775 6776 memset(&rp, 0, sizeof(rp)); 6777 bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr); 6778 rp.addr.type = cp->addr.type; 6779 6780 if (!bdaddr_type_is_valid(cp->addr.type)) 6781 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO, 6782 MGMT_STATUS_INVALID_PARAMS, 6783 &rp, sizeof(rp)); 6784 6785 hci_dev_lock(hdev); 6786 6787 if (!hdev_is_powered(hdev)) { 6788 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO, 6789 MGMT_STATUS_NOT_POWERED, &rp, 6790 sizeof(rp)); 6791 goto unlock; 6792 } 6793 6794 if (cp->addr.type == BDADDR_BREDR) 6795 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, 6796 &cp->addr.bdaddr); 6797 else 6798 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &cp->addr.bdaddr); 6799 6800 if (!conn || conn->state != BT_CONNECTED) { 6801 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO, 6802 MGMT_STATUS_NOT_CONNECTED, &rp, 6803 sizeof(rp)); 6804 goto unlock; 6805 } 6806 6807 /* To avoid client trying to guess when to poll again for information we 6808 * calculate conn info age as random value between min/max set in hdev. 6809 */ 6810 conn_info_age = hdev->conn_info_min_age + 6811 prandom_u32_max(hdev->conn_info_max_age - 6812 hdev->conn_info_min_age); 6813 6814 /* Query controller to refresh cached values if they are too old or were 6815 * never read. 6816 */ 6817 if (time_after(jiffies, conn->conn_info_timestamp + 6818 msecs_to_jiffies(conn_info_age)) || 6819 !conn->conn_info_timestamp) { 6820 struct mgmt_pending_cmd *cmd; 6821 6822 cmd = mgmt_pending_new(sk, MGMT_OP_GET_CONN_INFO, hdev, data, 6823 len); 6824 if (!cmd) 6825 err = -ENOMEM; 6826 else 6827 err = hci_cmd_sync_queue(hdev, get_conn_info_sync, 6828 cmd, get_conn_info_complete); 6829 6830 if (err < 0) { 6831 mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO, 6832 MGMT_STATUS_FAILED, &rp, sizeof(rp)); 6833 6834 if (cmd) 6835 mgmt_pending_free(cmd); 6836 6837 goto unlock; 6838 } 6839 6840 hci_conn_hold(conn); 6841 cmd->user_data = hci_conn_get(conn); 6842 6843 conn->conn_info_timestamp = jiffies; 6844 } else { 6845 /* Cache is valid, just reply with values cached in hci_conn */ 6846 rp.rssi = conn->rssi; 6847 rp.tx_power = conn->tx_power; 6848 rp.max_tx_power = conn->max_tx_power; 6849 6850 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO, 6851 MGMT_STATUS_SUCCESS, &rp, sizeof(rp)); 6852 } 6853 6854 unlock: 6855 hci_dev_unlock(hdev); 6856 return err; 6857 } 6858 6859 static void get_clock_info_complete(struct hci_dev *hdev, void *data, int err) 6860 { 6861 struct mgmt_pending_cmd *cmd = data; 6862 struct mgmt_cp_get_clock_info *cp = cmd->param; 6863 struct mgmt_rp_get_clock_info rp; 6864 struct hci_conn *conn = cmd->user_data; 6865 u8 status = mgmt_status(err); 6866 6867 bt_dev_dbg(hdev, "err %d", err); 6868 6869 memset(&rp, 0, sizeof(rp)); 6870 bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr); 6871 rp.addr.type = cp->addr.type; 6872 6873 if (err) 6874 goto complete; 6875 6876 rp.local_clock = cpu_to_le32(hdev->clock); 6877 6878 if (conn) { 6879 rp.piconet_clock = cpu_to_le32(conn->clock); 6880 rp.accuracy = cpu_to_le16(conn->clock_accuracy); 6881 hci_conn_drop(conn); 6882 hci_conn_put(conn); 6883 } 6884 6885 complete: 6886 mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, status, &rp, 6887 sizeof(rp)); 6888 6889 mgmt_pending_free(cmd); 6890 } 6891 6892 static int get_clock_info_sync(struct hci_dev *hdev, void *data) 6893 { 6894 struct mgmt_pending_cmd *cmd = data; 6895 struct mgmt_cp_get_clock_info *cp = cmd->param; 6896 struct hci_cp_read_clock hci_cp; 6897 struct hci_conn *conn = cmd->user_data; 6898 int err; 6899 6900 memset(&hci_cp, 0, sizeof(hci_cp)); 6901 err = hci_read_clock_sync(hdev, &hci_cp); 6902 6903 if (conn) { 6904 /* Make sure connection still exists */ 6905 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, 6906 &cp->addr.bdaddr); 6907 6908 if (conn && conn == cmd->user_data && 6909 conn->state == BT_CONNECTED) { 6910 hci_cp.handle = cpu_to_le16(conn->handle); 6911 hci_cp.which = 0x01; /* Piconet clock */ 6912 err = hci_read_clock_sync(hdev, &hci_cp); 6913 } else if (cmd->user_data) { 6914 hci_conn_drop(cmd->user_data); 6915 hci_conn_put(cmd->user_data); 6916 cmd->user_data = NULL; 6917 } 6918 } 6919 6920 return err; 6921 } 6922 6923 static int get_clock_info(struct sock *sk, struct hci_dev *hdev, void *data, 6924 u16 len) 6925 { 6926 struct mgmt_cp_get_clock_info *cp = data; 6927 struct mgmt_rp_get_clock_info rp; 6928 struct mgmt_pending_cmd *cmd; 6929 struct hci_conn *conn; 6930 int err; 6931 6932 bt_dev_dbg(hdev, "sock %p", sk); 6933 6934 memset(&rp, 0, sizeof(rp)); 6935 bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr); 6936 rp.addr.type = cp->addr.type; 6937 6938 if (cp->addr.type != BDADDR_BREDR) 6939 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CLOCK_INFO, 6940 MGMT_STATUS_INVALID_PARAMS, 6941 &rp, sizeof(rp)); 6942 6943 hci_dev_lock(hdev); 6944 6945 if (!hdev_is_powered(hdev)) { 6946 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CLOCK_INFO, 6947 MGMT_STATUS_NOT_POWERED, &rp, 6948 sizeof(rp)); 6949 goto unlock; 6950 } 6951 6952 if (bacmp(&cp->addr.bdaddr, BDADDR_ANY)) { 6953 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, 6954 &cp->addr.bdaddr); 6955 if (!conn || conn->state != BT_CONNECTED) { 6956 err = mgmt_cmd_complete(sk, hdev->id, 6957 MGMT_OP_GET_CLOCK_INFO, 6958 MGMT_STATUS_NOT_CONNECTED, 6959 &rp, sizeof(rp)); 6960 goto unlock; 6961 } 6962 } else { 6963 conn = NULL; 6964 } 6965 6966 cmd = mgmt_pending_new(sk, MGMT_OP_GET_CLOCK_INFO, hdev, data, len); 6967 if (!cmd) 6968 err = -ENOMEM; 6969 else 6970 err = hci_cmd_sync_queue(hdev, get_clock_info_sync, cmd, 6971 get_clock_info_complete); 6972 6973 if (err < 0) { 6974 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CLOCK_INFO, 6975 MGMT_STATUS_FAILED, &rp, sizeof(rp)); 6976 6977 if (cmd) 6978 mgmt_pending_free(cmd); 6979 6980 } else if (conn) { 6981 hci_conn_hold(conn); 6982 cmd->user_data = hci_conn_get(conn); 6983 } 6984 6985 6986 unlock: 6987 hci_dev_unlock(hdev); 6988 return err; 6989 } 6990 6991 static bool is_connected(struct hci_dev *hdev, bdaddr_t *addr, u8 type) 6992 { 6993 struct hci_conn *conn; 6994 6995 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, addr); 6996 if (!conn) 6997 return false; 6998 6999 if (conn->dst_type != type) 7000 return false; 7001 7002 if (conn->state != BT_CONNECTED) 7003 return false; 7004 7005 return true; 7006 } 7007 7008 /* This function requires the caller holds hdev->lock */ 7009 static int hci_conn_params_set(struct hci_dev *hdev, bdaddr_t *addr, 7010 u8 addr_type, u8 auto_connect) 7011 { 7012 struct hci_conn_params *params; 7013 7014 params = hci_conn_params_add(hdev, addr, addr_type); 7015 if (!params) 7016 return -EIO; 7017 7018 if (params->auto_connect == auto_connect) 7019 return 0; 7020 7021 list_del_init(¶ms->action); 7022 7023 switch (auto_connect) { 7024 case HCI_AUTO_CONN_DISABLED: 7025 case HCI_AUTO_CONN_LINK_LOSS: 7026 /* If auto connect is being disabled when we're trying to 7027 * connect to device, keep connecting. 7028 */ 7029 if (params->explicit_connect) 7030 list_add(¶ms->action, &hdev->pend_le_conns); 7031 break; 7032 case HCI_AUTO_CONN_REPORT: 7033 if (params->explicit_connect) 7034 list_add(¶ms->action, &hdev->pend_le_conns); 7035 else 7036 list_add(¶ms->action, &hdev->pend_le_reports); 7037 break; 7038 case HCI_AUTO_CONN_DIRECT: 7039 case HCI_AUTO_CONN_ALWAYS: 7040 if (!is_connected(hdev, addr, addr_type)) 7041 list_add(¶ms->action, &hdev->pend_le_conns); 7042 break; 7043 } 7044 7045 params->auto_connect = auto_connect; 7046 7047 bt_dev_dbg(hdev, "addr %pMR (type %u) auto_connect %u", 7048 addr, addr_type, auto_connect); 7049 7050 return 0; 7051 } 7052 7053 static void device_added(struct sock *sk, struct hci_dev *hdev, 7054 bdaddr_t *bdaddr, u8 type, u8 action) 7055 { 7056 struct mgmt_ev_device_added ev; 7057 7058 bacpy(&ev.addr.bdaddr, bdaddr); 7059 ev.addr.type = type; 7060 ev.action = action; 7061 7062 mgmt_event(MGMT_EV_DEVICE_ADDED, hdev, &ev, sizeof(ev), sk); 7063 } 7064 7065 static int add_device_sync(struct hci_dev *hdev, void *data) 7066 { 7067 return hci_update_passive_scan_sync(hdev); 7068 } 7069 7070 static int add_device(struct sock *sk, struct hci_dev *hdev, 7071 void *data, u16 len) 7072 { 7073 struct mgmt_cp_add_device *cp = data; 7074 u8 auto_conn, addr_type; 7075 struct hci_conn_params *params; 7076 int err; 7077 u32 current_flags = 0; 7078 u32 supported_flags; 7079 7080 bt_dev_dbg(hdev, "sock %p", sk); 7081 7082 if (!bdaddr_type_is_valid(cp->addr.type) || 7083 !bacmp(&cp->addr.bdaddr, BDADDR_ANY)) 7084 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE, 7085 MGMT_STATUS_INVALID_PARAMS, 7086 &cp->addr, sizeof(cp->addr)); 7087 7088 if (cp->action != 0x00 && cp->action != 0x01 && cp->action != 0x02) 7089 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE, 7090 MGMT_STATUS_INVALID_PARAMS, 7091 &cp->addr, sizeof(cp->addr)); 7092 7093 hci_dev_lock(hdev); 7094 7095 if (cp->addr.type == BDADDR_BREDR) { 7096 /* Only incoming connections action is supported for now */ 7097 if (cp->action != 0x01) { 7098 err = mgmt_cmd_complete(sk, hdev->id, 7099 MGMT_OP_ADD_DEVICE, 7100 MGMT_STATUS_INVALID_PARAMS, 7101 &cp->addr, sizeof(cp->addr)); 7102 goto unlock; 7103 } 7104 7105 err = hci_bdaddr_list_add_with_flags(&hdev->accept_list, 7106 &cp->addr.bdaddr, 7107 cp->addr.type, 0); 7108 if (err) 7109 goto unlock; 7110 7111 hci_req_update_scan(hdev); 7112 7113 goto added; 7114 } 7115 7116 addr_type = le_addr_type(cp->addr.type); 7117 7118 if (cp->action == 0x02) 7119 auto_conn = HCI_AUTO_CONN_ALWAYS; 7120 else if (cp->action == 0x01) 7121 auto_conn = HCI_AUTO_CONN_DIRECT; 7122 else 7123 auto_conn = HCI_AUTO_CONN_REPORT; 7124 7125 /* Kernel internally uses conn_params with resolvable private 7126 * address, but Add Device allows only identity addresses. 7127 * Make sure it is enforced before calling 7128 * hci_conn_params_lookup. 7129 */ 7130 if (!hci_is_identity_address(&cp->addr.bdaddr, addr_type)) { 7131 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE, 7132 MGMT_STATUS_INVALID_PARAMS, 7133 &cp->addr, sizeof(cp->addr)); 7134 goto unlock; 7135 } 7136 7137 /* If the connection parameters don't exist for this device, 7138 * they will be created and configured with defaults. 7139 */ 7140 if (hci_conn_params_set(hdev, &cp->addr.bdaddr, addr_type, 7141 auto_conn) < 0) { 7142 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE, 7143 MGMT_STATUS_FAILED, &cp->addr, 7144 sizeof(cp->addr)); 7145 goto unlock; 7146 } else { 7147 params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr, 7148 addr_type); 7149 if (params) 7150 current_flags = params->flags; 7151 } 7152 7153 err = hci_cmd_sync_queue(hdev, add_device_sync, NULL, NULL); 7154 if (err < 0) 7155 goto unlock; 7156 7157 added: 7158 device_added(sk, hdev, &cp->addr.bdaddr, cp->addr.type, cp->action); 7159 supported_flags = hdev->conn_flags; 7160 device_flags_changed(NULL, hdev, &cp->addr.bdaddr, cp->addr.type, 7161 supported_flags, current_flags); 7162 7163 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE, 7164 MGMT_STATUS_SUCCESS, &cp->addr, 7165 sizeof(cp->addr)); 7166 7167 unlock: 7168 hci_dev_unlock(hdev); 7169 return err; 7170 } 7171 7172 static void device_removed(struct sock *sk, struct hci_dev *hdev, 7173 bdaddr_t *bdaddr, u8 type) 7174 { 7175 struct mgmt_ev_device_removed ev; 7176 7177 bacpy(&ev.addr.bdaddr, bdaddr); 7178 ev.addr.type = type; 7179 7180 mgmt_event(MGMT_EV_DEVICE_REMOVED, hdev, &ev, sizeof(ev), sk); 7181 } 7182 7183 static int remove_device_sync(struct hci_dev *hdev, void *data) 7184 { 7185 return hci_update_passive_scan_sync(hdev); 7186 } 7187 7188 static int remove_device(struct sock *sk, struct hci_dev *hdev, 7189 void *data, u16 len) 7190 { 7191 struct mgmt_cp_remove_device *cp = data; 7192 int err; 7193 7194 bt_dev_dbg(hdev, "sock %p", sk); 7195 7196 hci_dev_lock(hdev); 7197 7198 if (bacmp(&cp->addr.bdaddr, BDADDR_ANY)) { 7199 struct hci_conn_params *params; 7200 u8 addr_type; 7201 7202 if (!bdaddr_type_is_valid(cp->addr.type)) { 7203 err = mgmt_cmd_complete(sk, hdev->id, 7204 MGMT_OP_REMOVE_DEVICE, 7205 MGMT_STATUS_INVALID_PARAMS, 7206 &cp->addr, sizeof(cp->addr)); 7207 goto unlock; 7208 } 7209 7210 if (cp->addr.type == BDADDR_BREDR) { 7211 err = hci_bdaddr_list_del(&hdev->accept_list, 7212 &cp->addr.bdaddr, 7213 cp->addr.type); 7214 if (err) { 7215 err = mgmt_cmd_complete(sk, hdev->id, 7216 MGMT_OP_REMOVE_DEVICE, 7217 MGMT_STATUS_INVALID_PARAMS, 7218 &cp->addr, 7219 sizeof(cp->addr)); 7220 goto unlock; 7221 } 7222 7223 hci_req_update_scan(hdev); 7224 7225 device_removed(sk, hdev, &cp->addr.bdaddr, 7226 cp->addr.type); 7227 goto complete; 7228 } 7229 7230 addr_type = le_addr_type(cp->addr.type); 7231 7232 /* Kernel internally uses conn_params with resolvable private 7233 * address, but Remove Device allows only identity addresses. 7234 * Make sure it is enforced before calling 7235 * hci_conn_params_lookup. 7236 */ 7237 if (!hci_is_identity_address(&cp->addr.bdaddr, addr_type)) { 7238 err = mgmt_cmd_complete(sk, hdev->id, 7239 MGMT_OP_REMOVE_DEVICE, 7240 MGMT_STATUS_INVALID_PARAMS, 7241 &cp->addr, sizeof(cp->addr)); 7242 goto unlock; 7243 } 7244 7245 params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr, 7246 addr_type); 7247 if (!params) { 7248 err = mgmt_cmd_complete(sk, hdev->id, 7249 MGMT_OP_REMOVE_DEVICE, 7250 MGMT_STATUS_INVALID_PARAMS, 7251 &cp->addr, sizeof(cp->addr)); 7252 goto unlock; 7253 } 7254 7255 if (params->auto_connect == HCI_AUTO_CONN_DISABLED || 7256 params->auto_connect == HCI_AUTO_CONN_EXPLICIT) { 7257 err = mgmt_cmd_complete(sk, hdev->id, 7258 MGMT_OP_REMOVE_DEVICE, 7259 MGMT_STATUS_INVALID_PARAMS, 7260 &cp->addr, sizeof(cp->addr)); 7261 goto unlock; 7262 } 7263 7264 list_del(¶ms->action); 7265 list_del(¶ms->list); 7266 kfree(params); 7267 7268 device_removed(sk, hdev, &cp->addr.bdaddr, cp->addr.type); 7269 } else { 7270 struct hci_conn_params *p, *tmp; 7271 struct bdaddr_list *b, *btmp; 7272 7273 if (cp->addr.type) { 7274 err = mgmt_cmd_complete(sk, hdev->id, 7275 MGMT_OP_REMOVE_DEVICE, 7276 MGMT_STATUS_INVALID_PARAMS, 7277 &cp->addr, sizeof(cp->addr)); 7278 goto unlock; 7279 } 7280 7281 list_for_each_entry_safe(b, btmp, &hdev->accept_list, list) { 7282 device_removed(sk, hdev, &b->bdaddr, b->bdaddr_type); 7283 list_del(&b->list); 7284 kfree(b); 7285 } 7286 7287 hci_req_update_scan(hdev); 7288 7289 list_for_each_entry_safe(p, tmp, &hdev->le_conn_params, list) { 7290 if (p->auto_connect == HCI_AUTO_CONN_DISABLED) 7291 continue; 7292 device_removed(sk, hdev, &p->addr, p->addr_type); 7293 if (p->explicit_connect) { 7294 p->auto_connect = HCI_AUTO_CONN_EXPLICIT; 7295 continue; 7296 } 7297 list_del(&p->action); 7298 list_del(&p->list); 7299 kfree(p); 7300 } 7301 7302 bt_dev_dbg(hdev, "All LE connection parameters were removed"); 7303 } 7304 7305 hci_cmd_sync_queue(hdev, remove_device_sync, NULL, NULL); 7306 7307 complete: 7308 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_DEVICE, 7309 MGMT_STATUS_SUCCESS, &cp->addr, 7310 sizeof(cp->addr)); 7311 unlock: 7312 hci_dev_unlock(hdev); 7313 return err; 7314 } 7315 7316 static int load_conn_param(struct sock *sk, struct hci_dev *hdev, void *data, 7317 u16 len) 7318 { 7319 struct mgmt_cp_load_conn_param *cp = data; 7320 const u16 max_param_count = ((U16_MAX - sizeof(*cp)) / 7321 sizeof(struct mgmt_conn_param)); 7322 u16 param_count, expected_len; 7323 int i; 7324 7325 if (!lmp_le_capable(hdev)) 7326 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM, 7327 MGMT_STATUS_NOT_SUPPORTED); 7328 7329 param_count = __le16_to_cpu(cp->param_count); 7330 if (param_count > max_param_count) { 7331 bt_dev_err(hdev, "load_conn_param: too big param_count value %u", 7332 param_count); 7333 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM, 7334 MGMT_STATUS_INVALID_PARAMS); 7335 } 7336 7337 expected_len = struct_size(cp, params, param_count); 7338 if (expected_len != len) { 7339 bt_dev_err(hdev, "load_conn_param: expected %u bytes, got %u bytes", 7340 expected_len, len); 7341 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM, 7342 MGMT_STATUS_INVALID_PARAMS); 7343 } 7344 7345 bt_dev_dbg(hdev, "param_count %u", param_count); 7346 7347 hci_dev_lock(hdev); 7348 7349 hci_conn_params_clear_disabled(hdev); 7350 7351 for (i = 0; i < param_count; i++) { 7352 struct mgmt_conn_param *param = &cp->params[i]; 7353 struct hci_conn_params *hci_param; 7354 u16 min, max, latency, timeout; 7355 u8 addr_type; 7356 7357 bt_dev_dbg(hdev, "Adding %pMR (type %u)", ¶m->addr.bdaddr, 7358 param->addr.type); 7359 7360 if (param->addr.type == BDADDR_LE_PUBLIC) { 7361 addr_type = ADDR_LE_DEV_PUBLIC; 7362 } else if (param->addr.type == BDADDR_LE_RANDOM) { 7363 addr_type = ADDR_LE_DEV_RANDOM; 7364 } else { 7365 bt_dev_err(hdev, "ignoring invalid connection parameters"); 7366 continue; 7367 } 7368 7369 min = le16_to_cpu(param->min_interval); 7370 max = le16_to_cpu(param->max_interval); 7371 latency = le16_to_cpu(param->latency); 7372 timeout = le16_to_cpu(param->timeout); 7373 7374 bt_dev_dbg(hdev, "min 0x%04x max 0x%04x latency 0x%04x timeout 0x%04x", 7375 min, max, latency, timeout); 7376 7377 if (hci_check_conn_params(min, max, latency, timeout) < 0) { 7378 bt_dev_err(hdev, "ignoring invalid connection parameters"); 7379 continue; 7380 } 7381 7382 hci_param = hci_conn_params_add(hdev, ¶m->addr.bdaddr, 7383 addr_type); 7384 if (!hci_param) { 7385 bt_dev_err(hdev, "failed to add connection parameters"); 7386 continue; 7387 } 7388 7389 hci_param->conn_min_interval = min; 7390 hci_param->conn_max_interval = max; 7391 hci_param->conn_latency = latency; 7392 hci_param->supervision_timeout = timeout; 7393 } 7394 7395 hci_dev_unlock(hdev); 7396 7397 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM, 0, 7398 NULL, 0); 7399 } 7400 7401 static int set_external_config(struct sock *sk, struct hci_dev *hdev, 7402 void *data, u16 len) 7403 { 7404 struct mgmt_cp_set_external_config *cp = data; 7405 bool changed; 7406 int err; 7407 7408 bt_dev_dbg(hdev, "sock %p", sk); 7409 7410 if (hdev_is_powered(hdev)) 7411 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_EXTERNAL_CONFIG, 7412 MGMT_STATUS_REJECTED); 7413 7414 if (cp->config != 0x00 && cp->config != 0x01) 7415 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_EXTERNAL_CONFIG, 7416 MGMT_STATUS_INVALID_PARAMS); 7417 7418 if (!test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks)) 7419 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_EXTERNAL_CONFIG, 7420 MGMT_STATUS_NOT_SUPPORTED); 7421 7422 hci_dev_lock(hdev); 7423 7424 if (cp->config) 7425 changed = !hci_dev_test_and_set_flag(hdev, HCI_EXT_CONFIGURED); 7426 else 7427 changed = hci_dev_test_and_clear_flag(hdev, HCI_EXT_CONFIGURED); 7428 7429 err = send_options_rsp(sk, MGMT_OP_SET_EXTERNAL_CONFIG, hdev); 7430 if (err < 0) 7431 goto unlock; 7432 7433 if (!changed) 7434 goto unlock; 7435 7436 err = new_options(hdev, sk); 7437 7438 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED) == is_configured(hdev)) { 7439 mgmt_index_removed(hdev); 7440 7441 if (hci_dev_test_and_change_flag(hdev, HCI_UNCONFIGURED)) { 7442 hci_dev_set_flag(hdev, HCI_CONFIG); 7443 hci_dev_set_flag(hdev, HCI_AUTO_OFF); 7444 7445 queue_work(hdev->req_workqueue, &hdev->power_on); 7446 } else { 7447 set_bit(HCI_RAW, &hdev->flags); 7448 mgmt_index_added(hdev); 7449 } 7450 } 7451 7452 unlock: 7453 hci_dev_unlock(hdev); 7454 return err; 7455 } 7456 7457 static int set_public_address(struct sock *sk, struct hci_dev *hdev, 7458 void *data, u16 len) 7459 { 7460 struct mgmt_cp_set_public_address *cp = data; 7461 bool changed; 7462 int err; 7463 7464 bt_dev_dbg(hdev, "sock %p", sk); 7465 7466 if (hdev_is_powered(hdev)) 7467 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PUBLIC_ADDRESS, 7468 MGMT_STATUS_REJECTED); 7469 7470 if (!bacmp(&cp->bdaddr, BDADDR_ANY)) 7471 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PUBLIC_ADDRESS, 7472 MGMT_STATUS_INVALID_PARAMS); 7473 7474 if (!hdev->set_bdaddr) 7475 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PUBLIC_ADDRESS, 7476 MGMT_STATUS_NOT_SUPPORTED); 7477 7478 hci_dev_lock(hdev); 7479 7480 changed = !!bacmp(&hdev->public_addr, &cp->bdaddr); 7481 bacpy(&hdev->public_addr, &cp->bdaddr); 7482 7483 err = send_options_rsp(sk, MGMT_OP_SET_PUBLIC_ADDRESS, hdev); 7484 if (err < 0) 7485 goto unlock; 7486 7487 if (!changed) 7488 goto unlock; 7489 7490 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) 7491 err = new_options(hdev, sk); 7492 7493 if (is_configured(hdev)) { 7494 mgmt_index_removed(hdev); 7495 7496 hci_dev_clear_flag(hdev, HCI_UNCONFIGURED); 7497 7498 hci_dev_set_flag(hdev, HCI_CONFIG); 7499 hci_dev_set_flag(hdev, HCI_AUTO_OFF); 7500 7501 queue_work(hdev->req_workqueue, &hdev->power_on); 7502 } 7503 7504 unlock: 7505 hci_dev_unlock(hdev); 7506 return err; 7507 } 7508 7509 static void read_local_oob_ext_data_complete(struct hci_dev *hdev, void *data, 7510 int err) 7511 { 7512 const struct mgmt_cp_read_local_oob_ext_data *mgmt_cp; 7513 struct mgmt_rp_read_local_oob_ext_data *mgmt_rp; 7514 u8 *h192, *r192, *h256, *r256; 7515 struct mgmt_pending_cmd *cmd = data; 7516 struct sk_buff *skb = cmd->skb; 7517 u8 status = mgmt_status(err); 7518 u16 eir_len; 7519 7520 if (cmd != pending_find(MGMT_OP_READ_LOCAL_OOB_EXT_DATA, hdev)) 7521 return; 7522 7523 if (!status) { 7524 if (!skb) 7525 status = MGMT_STATUS_FAILED; 7526 else if (IS_ERR(skb)) 7527 status = mgmt_status(PTR_ERR(skb)); 7528 else 7529 status = mgmt_status(skb->data[0]); 7530 } 7531 7532 bt_dev_dbg(hdev, "status %u", status); 7533 7534 mgmt_cp = cmd->param; 7535 7536 if (status) { 7537 status = mgmt_status(status); 7538 eir_len = 0; 7539 7540 h192 = NULL; 7541 r192 = NULL; 7542 h256 = NULL; 7543 r256 = NULL; 7544 } else if (!bredr_sc_enabled(hdev)) { 7545 struct hci_rp_read_local_oob_data *rp; 7546 7547 if (skb->len != sizeof(*rp)) { 7548 status = MGMT_STATUS_FAILED; 7549 eir_len = 0; 7550 } else { 7551 status = MGMT_STATUS_SUCCESS; 7552 rp = (void *)skb->data; 7553 7554 eir_len = 5 + 18 + 18; 7555 h192 = rp->hash; 7556 r192 = rp->rand; 7557 h256 = NULL; 7558 r256 = NULL; 7559 } 7560 } else { 7561 struct hci_rp_read_local_oob_ext_data *rp; 7562 7563 if (skb->len != sizeof(*rp)) { 7564 status = MGMT_STATUS_FAILED; 7565 eir_len = 0; 7566 } else { 7567 status = MGMT_STATUS_SUCCESS; 7568 rp = (void *)skb->data; 7569 7570 if (hci_dev_test_flag(hdev, HCI_SC_ONLY)) { 7571 eir_len = 5 + 18 + 18; 7572 h192 = NULL; 7573 r192 = NULL; 7574 } else { 7575 eir_len = 5 + 18 + 18 + 18 + 18; 7576 h192 = rp->hash192; 7577 r192 = rp->rand192; 7578 } 7579 7580 h256 = rp->hash256; 7581 r256 = rp->rand256; 7582 } 7583 } 7584 7585 mgmt_rp = kmalloc(sizeof(*mgmt_rp) + eir_len, GFP_KERNEL); 7586 if (!mgmt_rp) 7587 goto done; 7588 7589 if (eir_len == 0) 7590 goto send_rsp; 7591 7592 eir_len = eir_append_data(mgmt_rp->eir, 0, EIR_CLASS_OF_DEV, 7593 hdev->dev_class, 3); 7594 7595 if (h192 && r192) { 7596 eir_len = eir_append_data(mgmt_rp->eir, eir_len, 7597 EIR_SSP_HASH_C192, h192, 16); 7598 eir_len = eir_append_data(mgmt_rp->eir, eir_len, 7599 EIR_SSP_RAND_R192, r192, 16); 7600 } 7601 7602 if (h256 && r256) { 7603 eir_len = eir_append_data(mgmt_rp->eir, eir_len, 7604 EIR_SSP_HASH_C256, h256, 16); 7605 eir_len = eir_append_data(mgmt_rp->eir, eir_len, 7606 EIR_SSP_RAND_R256, r256, 16); 7607 } 7608 7609 send_rsp: 7610 mgmt_rp->type = mgmt_cp->type; 7611 mgmt_rp->eir_len = cpu_to_le16(eir_len); 7612 7613 err = mgmt_cmd_complete(cmd->sk, hdev->id, 7614 MGMT_OP_READ_LOCAL_OOB_EXT_DATA, status, 7615 mgmt_rp, sizeof(*mgmt_rp) + eir_len); 7616 if (err < 0 || status) 7617 goto done; 7618 7619 hci_sock_set_flag(cmd->sk, HCI_MGMT_OOB_DATA_EVENTS); 7620 7621 err = mgmt_limited_event(MGMT_EV_LOCAL_OOB_DATA_UPDATED, hdev, 7622 mgmt_rp, sizeof(*mgmt_rp) + eir_len, 7623 HCI_MGMT_OOB_DATA_EVENTS, cmd->sk); 7624 done: 7625 if (skb && !IS_ERR(skb)) 7626 kfree_skb(skb); 7627 7628 kfree(mgmt_rp); 7629 mgmt_pending_remove(cmd); 7630 } 7631 7632 static int read_local_ssp_oob_req(struct hci_dev *hdev, struct sock *sk, 7633 struct mgmt_cp_read_local_oob_ext_data *cp) 7634 { 7635 struct mgmt_pending_cmd *cmd; 7636 int err; 7637 7638 cmd = mgmt_pending_add(sk, MGMT_OP_READ_LOCAL_OOB_EXT_DATA, hdev, 7639 cp, sizeof(*cp)); 7640 if (!cmd) 7641 return -ENOMEM; 7642 7643 err = hci_cmd_sync_queue(hdev, read_local_oob_data_sync, cmd, 7644 read_local_oob_ext_data_complete); 7645 7646 if (err < 0) { 7647 mgmt_pending_remove(cmd); 7648 return err; 7649 } 7650 7651 return 0; 7652 } 7653 7654 static int read_local_oob_ext_data(struct sock *sk, struct hci_dev *hdev, 7655 void *data, u16 data_len) 7656 { 7657 struct mgmt_cp_read_local_oob_ext_data *cp = data; 7658 struct mgmt_rp_read_local_oob_ext_data *rp; 7659 size_t rp_len; 7660 u16 eir_len; 7661 u8 status, flags, role, addr[7], hash[16], rand[16]; 7662 int err; 7663 7664 bt_dev_dbg(hdev, "sock %p", sk); 7665 7666 if (hdev_is_powered(hdev)) { 7667 switch (cp->type) { 7668 case BIT(BDADDR_BREDR): 7669 status = mgmt_bredr_support(hdev); 7670 if (status) 7671 eir_len = 0; 7672 else 7673 eir_len = 5; 7674 break; 7675 case (BIT(BDADDR_LE_PUBLIC) | BIT(BDADDR_LE_RANDOM)): 7676 status = mgmt_le_support(hdev); 7677 if (status) 7678 eir_len = 0; 7679 else 7680 eir_len = 9 + 3 + 18 + 18 + 3; 7681 break; 7682 default: 7683 status = MGMT_STATUS_INVALID_PARAMS; 7684 eir_len = 0; 7685 break; 7686 } 7687 } else { 7688 status = MGMT_STATUS_NOT_POWERED; 7689 eir_len = 0; 7690 } 7691 7692 rp_len = sizeof(*rp) + eir_len; 7693 rp = kmalloc(rp_len, GFP_ATOMIC); 7694 if (!rp) 7695 return -ENOMEM; 7696 7697 if (!status && !lmp_ssp_capable(hdev)) { 7698 status = MGMT_STATUS_NOT_SUPPORTED; 7699 eir_len = 0; 7700 } 7701 7702 if (status) 7703 goto complete; 7704 7705 hci_dev_lock(hdev); 7706 7707 eir_len = 0; 7708 switch (cp->type) { 7709 case BIT(BDADDR_BREDR): 7710 if (hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) { 7711 err = read_local_ssp_oob_req(hdev, sk, cp); 7712 hci_dev_unlock(hdev); 7713 if (!err) 7714 goto done; 7715 7716 status = MGMT_STATUS_FAILED; 7717 goto complete; 7718 } else { 7719 eir_len = eir_append_data(rp->eir, eir_len, 7720 EIR_CLASS_OF_DEV, 7721 hdev->dev_class, 3); 7722 } 7723 break; 7724 case (BIT(BDADDR_LE_PUBLIC) | BIT(BDADDR_LE_RANDOM)): 7725 if (hci_dev_test_flag(hdev, HCI_SC_ENABLED) && 7726 smp_generate_oob(hdev, hash, rand) < 0) { 7727 hci_dev_unlock(hdev); 7728 status = MGMT_STATUS_FAILED; 7729 goto complete; 7730 } 7731 7732 /* This should return the active RPA, but since the RPA 7733 * is only programmed on demand, it is really hard to fill 7734 * this in at the moment. For now disallow retrieving 7735 * local out-of-band data when privacy is in use. 7736 * 7737 * Returning the identity address will not help here since 7738 * pairing happens before the identity resolving key is 7739 * known and thus the connection establishment happens 7740 * based on the RPA and not the identity address. 7741 */ 7742 if (hci_dev_test_flag(hdev, HCI_PRIVACY)) { 7743 hci_dev_unlock(hdev); 7744 status = MGMT_STATUS_REJECTED; 7745 goto complete; 7746 } 7747 7748 if (hci_dev_test_flag(hdev, HCI_FORCE_STATIC_ADDR) || 7749 !bacmp(&hdev->bdaddr, BDADDR_ANY) || 7750 (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) && 7751 bacmp(&hdev->static_addr, BDADDR_ANY))) { 7752 memcpy(addr, &hdev->static_addr, 6); 7753 addr[6] = 0x01; 7754 } else { 7755 memcpy(addr, &hdev->bdaddr, 6); 7756 addr[6] = 0x00; 7757 } 7758 7759 eir_len = eir_append_data(rp->eir, eir_len, EIR_LE_BDADDR, 7760 addr, sizeof(addr)); 7761 7762 if (hci_dev_test_flag(hdev, HCI_ADVERTISING)) 7763 role = 0x02; 7764 else 7765 role = 0x01; 7766 7767 eir_len = eir_append_data(rp->eir, eir_len, EIR_LE_ROLE, 7768 &role, sizeof(role)); 7769 7770 if (hci_dev_test_flag(hdev, HCI_SC_ENABLED)) { 7771 eir_len = eir_append_data(rp->eir, eir_len, 7772 EIR_LE_SC_CONFIRM, 7773 hash, sizeof(hash)); 7774 7775 eir_len = eir_append_data(rp->eir, eir_len, 7776 EIR_LE_SC_RANDOM, 7777 rand, sizeof(rand)); 7778 } 7779 7780 flags = mgmt_get_adv_discov_flags(hdev); 7781 7782 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) 7783 flags |= LE_AD_NO_BREDR; 7784 7785 eir_len = eir_append_data(rp->eir, eir_len, EIR_FLAGS, 7786 &flags, sizeof(flags)); 7787 break; 7788 } 7789 7790 hci_dev_unlock(hdev); 7791 7792 hci_sock_set_flag(sk, HCI_MGMT_OOB_DATA_EVENTS); 7793 7794 status = MGMT_STATUS_SUCCESS; 7795 7796 complete: 7797 rp->type = cp->type; 7798 rp->eir_len = cpu_to_le16(eir_len); 7799 7800 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_EXT_DATA, 7801 status, rp, sizeof(*rp) + eir_len); 7802 if (err < 0 || status) 7803 goto done; 7804 7805 err = mgmt_limited_event(MGMT_EV_LOCAL_OOB_DATA_UPDATED, hdev, 7806 rp, sizeof(*rp) + eir_len, 7807 HCI_MGMT_OOB_DATA_EVENTS, sk); 7808 7809 done: 7810 kfree(rp); 7811 7812 return err; 7813 } 7814 7815 static u32 get_supported_adv_flags(struct hci_dev *hdev) 7816 { 7817 u32 flags = 0; 7818 7819 flags |= MGMT_ADV_FLAG_CONNECTABLE; 7820 flags |= MGMT_ADV_FLAG_DISCOV; 7821 flags |= MGMT_ADV_FLAG_LIMITED_DISCOV; 7822 flags |= MGMT_ADV_FLAG_MANAGED_FLAGS; 7823 flags |= MGMT_ADV_FLAG_APPEARANCE; 7824 flags |= MGMT_ADV_FLAG_LOCAL_NAME; 7825 flags |= MGMT_ADV_PARAM_DURATION; 7826 flags |= MGMT_ADV_PARAM_TIMEOUT; 7827 flags |= MGMT_ADV_PARAM_INTERVALS; 7828 flags |= MGMT_ADV_PARAM_TX_POWER; 7829 flags |= MGMT_ADV_PARAM_SCAN_RSP; 7830 7831 /* In extended adv TX_POWER returned from Set Adv Param 7832 * will be always valid. 7833 */ 7834 if ((hdev->adv_tx_power != HCI_TX_POWER_INVALID) || 7835 ext_adv_capable(hdev)) 7836 flags |= MGMT_ADV_FLAG_TX_POWER; 7837 7838 if (ext_adv_capable(hdev)) { 7839 flags |= MGMT_ADV_FLAG_SEC_1M; 7840 flags |= MGMT_ADV_FLAG_HW_OFFLOAD; 7841 flags |= MGMT_ADV_FLAG_CAN_SET_TX_POWER; 7842 7843 if (hdev->le_features[1] & HCI_LE_PHY_2M) 7844 flags |= MGMT_ADV_FLAG_SEC_2M; 7845 7846 if (hdev->le_features[1] & HCI_LE_PHY_CODED) 7847 flags |= MGMT_ADV_FLAG_SEC_CODED; 7848 } 7849 7850 return flags; 7851 } 7852 7853 static int read_adv_features(struct sock *sk, struct hci_dev *hdev, 7854 void *data, u16 data_len) 7855 { 7856 struct mgmt_rp_read_adv_features *rp; 7857 size_t rp_len; 7858 int err; 7859 struct adv_info *adv_instance; 7860 u32 supported_flags; 7861 u8 *instance; 7862 7863 bt_dev_dbg(hdev, "sock %p", sk); 7864 7865 if (!lmp_le_capable(hdev)) 7866 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_ADV_FEATURES, 7867 MGMT_STATUS_REJECTED); 7868 7869 hci_dev_lock(hdev); 7870 7871 rp_len = sizeof(*rp) + hdev->adv_instance_cnt; 7872 rp = kmalloc(rp_len, GFP_ATOMIC); 7873 if (!rp) { 7874 hci_dev_unlock(hdev); 7875 return -ENOMEM; 7876 } 7877 7878 supported_flags = get_supported_adv_flags(hdev); 7879 7880 rp->supported_flags = cpu_to_le32(supported_flags); 7881 rp->max_adv_data_len = HCI_MAX_AD_LENGTH; 7882 rp->max_scan_rsp_len = HCI_MAX_AD_LENGTH; 7883 rp->max_instances = hdev->le_num_of_adv_sets; 7884 rp->num_instances = hdev->adv_instance_cnt; 7885 7886 instance = rp->instance; 7887 list_for_each_entry(adv_instance, &hdev->adv_instances, list) { 7888 *instance = adv_instance->instance; 7889 instance++; 7890 } 7891 7892 hci_dev_unlock(hdev); 7893 7894 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_ADV_FEATURES, 7895 MGMT_STATUS_SUCCESS, rp, rp_len); 7896 7897 kfree(rp); 7898 7899 return err; 7900 } 7901 7902 static u8 calculate_name_len(struct hci_dev *hdev) 7903 { 7904 u8 buf[HCI_MAX_SHORT_NAME_LENGTH + 3]; 7905 7906 return eir_append_local_name(hdev, buf, 0); 7907 } 7908 7909 static u8 tlv_data_max_len(struct hci_dev *hdev, u32 adv_flags, 7910 bool is_adv_data) 7911 { 7912 u8 max_len = HCI_MAX_AD_LENGTH; 7913 7914 if (is_adv_data) { 7915 if (adv_flags & (MGMT_ADV_FLAG_DISCOV | 7916 MGMT_ADV_FLAG_LIMITED_DISCOV | 7917 MGMT_ADV_FLAG_MANAGED_FLAGS)) 7918 max_len -= 3; 7919 7920 if (adv_flags & MGMT_ADV_FLAG_TX_POWER) 7921 max_len -= 3; 7922 } else { 7923 if (adv_flags & MGMT_ADV_FLAG_LOCAL_NAME) 7924 max_len -= calculate_name_len(hdev); 7925 7926 if (adv_flags & (MGMT_ADV_FLAG_APPEARANCE)) 7927 max_len -= 4; 7928 } 7929 7930 return max_len; 7931 } 7932 7933 static bool flags_managed(u32 adv_flags) 7934 { 7935 return adv_flags & (MGMT_ADV_FLAG_DISCOV | 7936 MGMT_ADV_FLAG_LIMITED_DISCOV | 7937 MGMT_ADV_FLAG_MANAGED_FLAGS); 7938 } 7939 7940 static bool tx_power_managed(u32 adv_flags) 7941 { 7942 return adv_flags & MGMT_ADV_FLAG_TX_POWER; 7943 } 7944 7945 static bool name_managed(u32 adv_flags) 7946 { 7947 return adv_flags & MGMT_ADV_FLAG_LOCAL_NAME; 7948 } 7949 7950 static bool appearance_managed(u32 adv_flags) 7951 { 7952 return adv_flags & MGMT_ADV_FLAG_APPEARANCE; 7953 } 7954 7955 static bool tlv_data_is_valid(struct hci_dev *hdev, u32 adv_flags, u8 *data, 7956 u8 len, bool is_adv_data) 7957 { 7958 int i, cur_len; 7959 u8 max_len; 7960 7961 max_len = tlv_data_max_len(hdev, adv_flags, is_adv_data); 7962 7963 if (len > max_len) 7964 return false; 7965 7966 /* Make sure that the data is correctly formatted. */ 7967 for (i = 0; i < len; i += (cur_len + 1)) { 7968 cur_len = data[i]; 7969 7970 if (!cur_len) 7971 continue; 7972 7973 if (data[i + 1] == EIR_FLAGS && 7974 (!is_adv_data || flags_managed(adv_flags))) 7975 return false; 7976 7977 if (data[i + 1] == EIR_TX_POWER && tx_power_managed(adv_flags)) 7978 return false; 7979 7980 if (data[i + 1] == EIR_NAME_COMPLETE && name_managed(adv_flags)) 7981 return false; 7982 7983 if (data[i + 1] == EIR_NAME_SHORT && name_managed(adv_flags)) 7984 return false; 7985 7986 if (data[i + 1] == EIR_APPEARANCE && 7987 appearance_managed(adv_flags)) 7988 return false; 7989 7990 /* If the current field length would exceed the total data 7991 * length, then it's invalid. 7992 */ 7993 if (i + cur_len >= len) 7994 return false; 7995 } 7996 7997 return true; 7998 } 7999 8000 static bool requested_adv_flags_are_valid(struct hci_dev *hdev, u32 adv_flags) 8001 { 8002 u32 supported_flags, phy_flags; 8003 8004 /* The current implementation only supports a subset of the specified 8005 * flags. Also need to check mutual exclusiveness of sec flags. 8006 */ 8007 supported_flags = get_supported_adv_flags(hdev); 8008 phy_flags = adv_flags & MGMT_ADV_FLAG_SEC_MASK; 8009 if (adv_flags & ~supported_flags || 8010 ((phy_flags && (phy_flags ^ (phy_flags & -phy_flags))))) 8011 return false; 8012 8013 return true; 8014 } 8015 8016 static bool adv_busy(struct hci_dev *hdev) 8017 { 8018 return pending_find(MGMT_OP_SET_LE, hdev); 8019 } 8020 8021 static void add_adv_complete(struct hci_dev *hdev, struct sock *sk, u8 instance, 8022 int err) 8023 { 8024 struct adv_info *adv, *n; 8025 8026 bt_dev_dbg(hdev, "err %d", err); 8027 8028 hci_dev_lock(hdev); 8029 8030 list_for_each_entry_safe(adv, n, &hdev->adv_instances, list) { 8031 u8 instance; 8032 8033 if (!adv->pending) 8034 continue; 8035 8036 if (!err) { 8037 adv->pending = false; 8038 continue; 8039 } 8040 8041 instance = adv->instance; 8042 8043 if (hdev->cur_adv_instance == instance) 8044 cancel_adv_timeout(hdev); 8045 8046 hci_remove_adv_instance(hdev, instance); 8047 mgmt_advertising_removed(sk, hdev, instance); 8048 } 8049 8050 hci_dev_unlock(hdev); 8051 } 8052 8053 static void add_advertising_complete(struct hci_dev *hdev, void *data, int err) 8054 { 8055 struct mgmt_pending_cmd *cmd = data; 8056 struct mgmt_cp_add_advertising *cp = cmd->param; 8057 struct mgmt_rp_add_advertising rp; 8058 8059 memset(&rp, 0, sizeof(rp)); 8060 8061 rp.instance = cp->instance; 8062 8063 if (err) 8064 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, 8065 mgmt_status(err)); 8066 else 8067 mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, 8068 mgmt_status(err), &rp, sizeof(rp)); 8069 8070 add_adv_complete(hdev, cmd->sk, cp->instance, err); 8071 8072 mgmt_pending_free(cmd); 8073 } 8074 8075 static int add_advertising_sync(struct hci_dev *hdev, void *data) 8076 { 8077 struct mgmt_pending_cmd *cmd = data; 8078 struct mgmt_cp_add_advertising *cp = cmd->param; 8079 8080 return hci_schedule_adv_instance_sync(hdev, cp->instance, true); 8081 } 8082 8083 static int add_advertising(struct sock *sk, struct hci_dev *hdev, 8084 void *data, u16 data_len) 8085 { 8086 struct mgmt_cp_add_advertising *cp = data; 8087 struct mgmt_rp_add_advertising rp; 8088 u32 flags; 8089 u8 status; 8090 u16 timeout, duration; 8091 unsigned int prev_instance_cnt; 8092 u8 schedule_instance = 0; 8093 struct adv_info *next_instance; 8094 int err; 8095 struct mgmt_pending_cmd *cmd; 8096 8097 bt_dev_dbg(hdev, "sock %p", sk); 8098 8099 status = mgmt_le_support(hdev); 8100 if (status) 8101 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING, 8102 status); 8103 8104 if (cp->instance < 1 || cp->instance > hdev->le_num_of_adv_sets) 8105 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING, 8106 MGMT_STATUS_INVALID_PARAMS); 8107 8108 if (data_len != sizeof(*cp) + cp->adv_data_len + cp->scan_rsp_len) 8109 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING, 8110 MGMT_STATUS_INVALID_PARAMS); 8111 8112 flags = __le32_to_cpu(cp->flags); 8113 timeout = __le16_to_cpu(cp->timeout); 8114 duration = __le16_to_cpu(cp->duration); 8115 8116 if (!requested_adv_flags_are_valid(hdev, flags)) 8117 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING, 8118 MGMT_STATUS_INVALID_PARAMS); 8119 8120 hci_dev_lock(hdev); 8121 8122 if (timeout && !hdev_is_powered(hdev)) { 8123 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING, 8124 MGMT_STATUS_REJECTED); 8125 goto unlock; 8126 } 8127 8128 if (adv_busy(hdev)) { 8129 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING, 8130 MGMT_STATUS_BUSY); 8131 goto unlock; 8132 } 8133 8134 if (!tlv_data_is_valid(hdev, flags, cp->data, cp->adv_data_len, true) || 8135 !tlv_data_is_valid(hdev, flags, cp->data + cp->adv_data_len, 8136 cp->scan_rsp_len, false)) { 8137 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING, 8138 MGMT_STATUS_INVALID_PARAMS); 8139 goto unlock; 8140 } 8141 8142 prev_instance_cnt = hdev->adv_instance_cnt; 8143 8144 err = hci_add_adv_instance(hdev, cp->instance, flags, 8145 cp->adv_data_len, cp->data, 8146 cp->scan_rsp_len, 8147 cp->data + cp->adv_data_len, 8148 timeout, duration, 8149 HCI_ADV_TX_POWER_NO_PREFERENCE, 8150 hdev->le_adv_min_interval, 8151 hdev->le_adv_max_interval); 8152 if (err < 0) { 8153 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING, 8154 MGMT_STATUS_FAILED); 8155 goto unlock; 8156 } 8157 8158 /* Only trigger an advertising added event if a new instance was 8159 * actually added. 8160 */ 8161 if (hdev->adv_instance_cnt > prev_instance_cnt) 8162 mgmt_advertising_added(sk, hdev, cp->instance); 8163 8164 if (hdev->cur_adv_instance == cp->instance) { 8165 /* If the currently advertised instance is being changed then 8166 * cancel the current advertising and schedule the next 8167 * instance. If there is only one instance then the overridden 8168 * advertising data will be visible right away. 8169 */ 8170 cancel_adv_timeout(hdev); 8171 8172 next_instance = hci_get_next_instance(hdev, cp->instance); 8173 if (next_instance) 8174 schedule_instance = next_instance->instance; 8175 } else if (!hdev->adv_instance_timeout) { 8176 /* Immediately advertise the new instance if no other 8177 * instance is currently being advertised. 8178 */ 8179 schedule_instance = cp->instance; 8180 } 8181 8182 /* If the HCI_ADVERTISING flag is set or the device isn't powered or 8183 * there is no instance to be advertised then we have no HCI 8184 * communication to make. Simply return. 8185 */ 8186 if (!hdev_is_powered(hdev) || 8187 hci_dev_test_flag(hdev, HCI_ADVERTISING) || 8188 !schedule_instance) { 8189 rp.instance = cp->instance; 8190 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_ADVERTISING, 8191 MGMT_STATUS_SUCCESS, &rp, sizeof(rp)); 8192 goto unlock; 8193 } 8194 8195 /* We're good to go, update advertising data, parameters, and start 8196 * advertising. 8197 */ 8198 cmd = mgmt_pending_new(sk, MGMT_OP_ADD_ADVERTISING, hdev, data, 8199 data_len); 8200 if (!cmd) { 8201 err = -ENOMEM; 8202 goto unlock; 8203 } 8204 8205 cp->instance = schedule_instance; 8206 8207 err = hci_cmd_sync_queue(hdev, add_advertising_sync, cmd, 8208 add_advertising_complete); 8209 if (err < 0) 8210 mgmt_pending_free(cmd); 8211 8212 unlock: 8213 hci_dev_unlock(hdev); 8214 8215 return err; 8216 } 8217 8218 static void add_ext_adv_params_complete(struct hci_dev *hdev, void *data, 8219 int err) 8220 { 8221 struct mgmt_pending_cmd *cmd = data; 8222 struct mgmt_cp_add_ext_adv_params *cp = cmd->param; 8223 struct mgmt_rp_add_ext_adv_params rp; 8224 struct adv_info *adv; 8225 u32 flags; 8226 8227 BT_DBG("%s", hdev->name); 8228 8229 hci_dev_lock(hdev); 8230 8231 adv = hci_find_adv_instance(hdev, cp->instance); 8232 if (!adv) 8233 goto unlock; 8234 8235 rp.instance = cp->instance; 8236 rp.tx_power = adv->tx_power; 8237 8238 /* While we're at it, inform userspace of the available space for this 8239 * advertisement, given the flags that will be used. 8240 */ 8241 flags = __le32_to_cpu(cp->flags); 8242 rp.max_adv_data_len = tlv_data_max_len(hdev, flags, true); 8243 rp.max_scan_rsp_len = tlv_data_max_len(hdev, flags, false); 8244 8245 if (err) { 8246 /* If this advertisement was previously advertising and we 8247 * failed to update it, we signal that it has been removed and 8248 * delete its structure 8249 */ 8250 if (!adv->pending) 8251 mgmt_advertising_removed(cmd->sk, hdev, cp->instance); 8252 8253 hci_remove_adv_instance(hdev, cp->instance); 8254 8255 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, 8256 mgmt_status(err)); 8257 } else { 8258 mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, 8259 mgmt_status(err), &rp, sizeof(rp)); 8260 } 8261 8262 unlock: 8263 if (cmd) 8264 mgmt_pending_free(cmd); 8265 8266 hci_dev_unlock(hdev); 8267 } 8268 8269 static int add_ext_adv_params_sync(struct hci_dev *hdev, void *data) 8270 { 8271 struct mgmt_pending_cmd *cmd = data; 8272 struct mgmt_cp_add_ext_adv_params *cp = cmd->param; 8273 8274 return hci_setup_ext_adv_instance_sync(hdev, cp->instance); 8275 } 8276 8277 static int add_ext_adv_params(struct sock *sk, struct hci_dev *hdev, 8278 void *data, u16 data_len) 8279 { 8280 struct mgmt_cp_add_ext_adv_params *cp = data; 8281 struct mgmt_rp_add_ext_adv_params rp; 8282 struct mgmt_pending_cmd *cmd = NULL; 8283 u32 flags, min_interval, max_interval; 8284 u16 timeout, duration; 8285 u8 status; 8286 s8 tx_power; 8287 int err; 8288 8289 BT_DBG("%s", hdev->name); 8290 8291 status = mgmt_le_support(hdev); 8292 if (status) 8293 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_PARAMS, 8294 status); 8295 8296 if (cp->instance < 1 || cp->instance > hdev->le_num_of_adv_sets) 8297 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_PARAMS, 8298 MGMT_STATUS_INVALID_PARAMS); 8299 8300 /* The purpose of breaking add_advertising into two separate MGMT calls 8301 * for params and data is to allow more parameters to be added to this 8302 * structure in the future. For this reason, we verify that we have the 8303 * bare minimum structure we know of when the interface was defined. Any 8304 * extra parameters we don't know about will be ignored in this request. 8305 */ 8306 if (data_len < MGMT_ADD_EXT_ADV_PARAMS_MIN_SIZE) 8307 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING, 8308 MGMT_STATUS_INVALID_PARAMS); 8309 8310 flags = __le32_to_cpu(cp->flags); 8311 8312 if (!requested_adv_flags_are_valid(hdev, flags)) 8313 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_PARAMS, 8314 MGMT_STATUS_INVALID_PARAMS); 8315 8316 hci_dev_lock(hdev); 8317 8318 /* In new interface, we require that we are powered to register */ 8319 if (!hdev_is_powered(hdev)) { 8320 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_PARAMS, 8321 MGMT_STATUS_REJECTED); 8322 goto unlock; 8323 } 8324 8325 if (adv_busy(hdev)) { 8326 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_PARAMS, 8327 MGMT_STATUS_BUSY); 8328 goto unlock; 8329 } 8330 8331 /* Parse defined parameters from request, use defaults otherwise */ 8332 timeout = (flags & MGMT_ADV_PARAM_TIMEOUT) ? 8333 __le16_to_cpu(cp->timeout) : 0; 8334 8335 duration = (flags & MGMT_ADV_PARAM_DURATION) ? 8336 __le16_to_cpu(cp->duration) : 8337 hdev->def_multi_adv_rotation_duration; 8338 8339 min_interval = (flags & MGMT_ADV_PARAM_INTERVALS) ? 8340 __le32_to_cpu(cp->min_interval) : 8341 hdev->le_adv_min_interval; 8342 8343 max_interval = (flags & MGMT_ADV_PARAM_INTERVALS) ? 8344 __le32_to_cpu(cp->max_interval) : 8345 hdev->le_adv_max_interval; 8346 8347 tx_power = (flags & MGMT_ADV_PARAM_TX_POWER) ? 8348 cp->tx_power : 8349 HCI_ADV_TX_POWER_NO_PREFERENCE; 8350 8351 /* Create advertising instance with no advertising or response data */ 8352 err = hci_add_adv_instance(hdev, cp->instance, flags, 8353 0, NULL, 0, NULL, timeout, duration, 8354 tx_power, min_interval, max_interval); 8355 8356 if (err < 0) { 8357 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_PARAMS, 8358 MGMT_STATUS_FAILED); 8359 goto unlock; 8360 } 8361 8362 /* Submit request for advertising params if ext adv available */ 8363 if (ext_adv_capable(hdev)) { 8364 cmd = mgmt_pending_new(sk, MGMT_OP_ADD_EXT_ADV_PARAMS, hdev, 8365 data, data_len); 8366 if (!cmd) { 8367 err = -ENOMEM; 8368 hci_remove_adv_instance(hdev, cp->instance); 8369 goto unlock; 8370 } 8371 8372 err = hci_cmd_sync_queue(hdev, add_ext_adv_params_sync, cmd, 8373 add_ext_adv_params_complete); 8374 if (err < 0) 8375 mgmt_pending_free(cmd); 8376 } else { 8377 rp.instance = cp->instance; 8378 rp.tx_power = HCI_ADV_TX_POWER_NO_PREFERENCE; 8379 rp.max_adv_data_len = tlv_data_max_len(hdev, flags, true); 8380 rp.max_scan_rsp_len = tlv_data_max_len(hdev, flags, false); 8381 err = mgmt_cmd_complete(sk, hdev->id, 8382 MGMT_OP_ADD_EXT_ADV_PARAMS, 8383 MGMT_STATUS_SUCCESS, &rp, sizeof(rp)); 8384 } 8385 8386 unlock: 8387 hci_dev_unlock(hdev); 8388 8389 return err; 8390 } 8391 8392 static void add_ext_adv_data_complete(struct hci_dev *hdev, void *data, int err) 8393 { 8394 struct mgmt_pending_cmd *cmd = data; 8395 struct mgmt_cp_add_ext_adv_data *cp = cmd->param; 8396 struct mgmt_rp_add_advertising rp; 8397 8398 add_adv_complete(hdev, cmd->sk, cp->instance, err); 8399 8400 memset(&rp, 0, sizeof(rp)); 8401 8402 rp.instance = cp->instance; 8403 8404 if (err) 8405 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, 8406 mgmt_status(err)); 8407 else 8408 mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, 8409 mgmt_status(err), &rp, sizeof(rp)); 8410 8411 mgmt_pending_free(cmd); 8412 } 8413 8414 static int add_ext_adv_data_sync(struct hci_dev *hdev, void *data) 8415 { 8416 struct mgmt_pending_cmd *cmd = data; 8417 struct mgmt_cp_add_ext_adv_data *cp = cmd->param; 8418 int err; 8419 8420 if (ext_adv_capable(hdev)) { 8421 err = hci_update_adv_data_sync(hdev, cp->instance); 8422 if (err) 8423 return err; 8424 8425 err = hci_update_scan_rsp_data_sync(hdev, cp->instance); 8426 if (err) 8427 return err; 8428 8429 return hci_enable_ext_advertising_sync(hdev, cp->instance); 8430 } 8431 8432 return hci_schedule_adv_instance_sync(hdev, cp->instance, true); 8433 } 8434 8435 static int add_ext_adv_data(struct sock *sk, struct hci_dev *hdev, void *data, 8436 u16 data_len) 8437 { 8438 struct mgmt_cp_add_ext_adv_data *cp = data; 8439 struct mgmt_rp_add_ext_adv_data rp; 8440 u8 schedule_instance = 0; 8441 struct adv_info *next_instance; 8442 struct adv_info *adv_instance; 8443 int err = 0; 8444 struct mgmt_pending_cmd *cmd; 8445 8446 BT_DBG("%s", hdev->name); 8447 8448 hci_dev_lock(hdev); 8449 8450 adv_instance = hci_find_adv_instance(hdev, cp->instance); 8451 8452 if (!adv_instance) { 8453 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_DATA, 8454 MGMT_STATUS_INVALID_PARAMS); 8455 goto unlock; 8456 } 8457 8458 /* In new interface, we require that we are powered to register */ 8459 if (!hdev_is_powered(hdev)) { 8460 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_DATA, 8461 MGMT_STATUS_REJECTED); 8462 goto clear_new_instance; 8463 } 8464 8465 if (adv_busy(hdev)) { 8466 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_DATA, 8467 MGMT_STATUS_BUSY); 8468 goto clear_new_instance; 8469 } 8470 8471 /* Validate new data */ 8472 if (!tlv_data_is_valid(hdev, adv_instance->flags, cp->data, 8473 cp->adv_data_len, true) || 8474 !tlv_data_is_valid(hdev, adv_instance->flags, cp->data + 8475 cp->adv_data_len, cp->scan_rsp_len, false)) { 8476 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_DATA, 8477 MGMT_STATUS_INVALID_PARAMS); 8478 goto clear_new_instance; 8479 } 8480 8481 /* Set the data in the advertising instance */ 8482 hci_set_adv_instance_data(hdev, cp->instance, cp->adv_data_len, 8483 cp->data, cp->scan_rsp_len, 8484 cp->data + cp->adv_data_len); 8485 8486 /* If using software rotation, determine next instance to use */ 8487 if (hdev->cur_adv_instance == cp->instance) { 8488 /* If the currently advertised instance is being changed 8489 * then cancel the current advertising and schedule the 8490 * next instance. If there is only one instance then the 8491 * overridden advertising data will be visible right 8492 * away 8493 */ 8494 cancel_adv_timeout(hdev); 8495 8496 next_instance = hci_get_next_instance(hdev, cp->instance); 8497 if (next_instance) 8498 schedule_instance = next_instance->instance; 8499 } else if (!hdev->adv_instance_timeout) { 8500 /* Immediately advertise the new instance if no other 8501 * instance is currently being advertised. 8502 */ 8503 schedule_instance = cp->instance; 8504 } 8505 8506 /* If the HCI_ADVERTISING flag is set or there is no instance to 8507 * be advertised then we have no HCI communication to make. 8508 * Simply return. 8509 */ 8510 if (hci_dev_test_flag(hdev, HCI_ADVERTISING) || !schedule_instance) { 8511 if (adv_instance->pending) { 8512 mgmt_advertising_added(sk, hdev, cp->instance); 8513 adv_instance->pending = false; 8514 } 8515 rp.instance = cp->instance; 8516 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_DATA, 8517 MGMT_STATUS_SUCCESS, &rp, sizeof(rp)); 8518 goto unlock; 8519 } 8520 8521 cmd = mgmt_pending_new(sk, MGMT_OP_ADD_EXT_ADV_DATA, hdev, data, 8522 data_len); 8523 if (!cmd) { 8524 err = -ENOMEM; 8525 goto clear_new_instance; 8526 } 8527 8528 err = hci_cmd_sync_queue(hdev, add_ext_adv_data_sync, cmd, 8529 add_ext_adv_data_complete); 8530 if (err < 0) { 8531 mgmt_pending_free(cmd); 8532 goto clear_new_instance; 8533 } 8534 8535 /* We were successful in updating data, so trigger advertising_added 8536 * event if this is an instance that wasn't previously advertising. If 8537 * a failure occurs in the requests we initiated, we will remove the 8538 * instance again in add_advertising_complete 8539 */ 8540 if (adv_instance->pending) 8541 mgmt_advertising_added(sk, hdev, cp->instance); 8542 8543 goto unlock; 8544 8545 clear_new_instance: 8546 hci_remove_adv_instance(hdev, cp->instance); 8547 8548 unlock: 8549 hci_dev_unlock(hdev); 8550 8551 return err; 8552 } 8553 8554 static void remove_advertising_complete(struct hci_dev *hdev, void *data, 8555 int err) 8556 { 8557 struct mgmt_pending_cmd *cmd = data; 8558 struct mgmt_cp_remove_advertising *cp = cmd->param; 8559 struct mgmt_rp_remove_advertising rp; 8560 8561 bt_dev_dbg(hdev, "err %d", err); 8562 8563 memset(&rp, 0, sizeof(rp)); 8564 rp.instance = cp->instance; 8565 8566 if (err) 8567 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, 8568 mgmt_status(err)); 8569 else 8570 mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, 8571 MGMT_STATUS_SUCCESS, &rp, sizeof(rp)); 8572 8573 mgmt_pending_free(cmd); 8574 } 8575 8576 static int remove_advertising_sync(struct hci_dev *hdev, void *data) 8577 { 8578 struct mgmt_pending_cmd *cmd = data; 8579 struct mgmt_cp_remove_advertising *cp = cmd->param; 8580 int err; 8581 8582 err = hci_remove_advertising_sync(hdev, cmd->sk, cp->instance, true); 8583 if (err) 8584 return err; 8585 8586 if (list_empty(&hdev->adv_instances)) 8587 err = hci_disable_advertising_sync(hdev); 8588 8589 return err; 8590 } 8591 8592 static int remove_advertising(struct sock *sk, struct hci_dev *hdev, 8593 void *data, u16 data_len) 8594 { 8595 struct mgmt_cp_remove_advertising *cp = data; 8596 struct mgmt_pending_cmd *cmd; 8597 int err; 8598 8599 bt_dev_dbg(hdev, "sock %p", sk); 8600 8601 hci_dev_lock(hdev); 8602 8603 if (cp->instance && !hci_find_adv_instance(hdev, cp->instance)) { 8604 err = mgmt_cmd_status(sk, hdev->id, 8605 MGMT_OP_REMOVE_ADVERTISING, 8606 MGMT_STATUS_INVALID_PARAMS); 8607 goto unlock; 8608 } 8609 8610 if (pending_find(MGMT_OP_SET_LE, hdev)) { 8611 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_ADVERTISING, 8612 MGMT_STATUS_BUSY); 8613 goto unlock; 8614 } 8615 8616 if (list_empty(&hdev->adv_instances)) { 8617 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_ADVERTISING, 8618 MGMT_STATUS_INVALID_PARAMS); 8619 goto unlock; 8620 } 8621 8622 cmd = mgmt_pending_new(sk, MGMT_OP_REMOVE_ADVERTISING, hdev, data, 8623 data_len); 8624 if (!cmd) { 8625 err = -ENOMEM; 8626 goto unlock; 8627 } 8628 8629 err = hci_cmd_sync_queue(hdev, remove_advertising_sync, cmd, 8630 remove_advertising_complete); 8631 if (err < 0) 8632 mgmt_pending_free(cmd); 8633 8634 unlock: 8635 hci_dev_unlock(hdev); 8636 8637 return err; 8638 } 8639 8640 static int get_adv_size_info(struct sock *sk, struct hci_dev *hdev, 8641 void *data, u16 data_len) 8642 { 8643 struct mgmt_cp_get_adv_size_info *cp = data; 8644 struct mgmt_rp_get_adv_size_info rp; 8645 u32 flags, supported_flags; 8646 8647 bt_dev_dbg(hdev, "sock %p", sk); 8648 8649 if (!lmp_le_capable(hdev)) 8650 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_ADV_SIZE_INFO, 8651 MGMT_STATUS_REJECTED); 8652 8653 if (cp->instance < 1 || cp->instance > hdev->le_num_of_adv_sets) 8654 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_ADV_SIZE_INFO, 8655 MGMT_STATUS_INVALID_PARAMS); 8656 8657 flags = __le32_to_cpu(cp->flags); 8658 8659 /* The current implementation only supports a subset of the specified 8660 * flags. 8661 */ 8662 supported_flags = get_supported_adv_flags(hdev); 8663 if (flags & ~supported_flags) 8664 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_ADV_SIZE_INFO, 8665 MGMT_STATUS_INVALID_PARAMS); 8666 8667 rp.instance = cp->instance; 8668 rp.flags = cp->flags; 8669 rp.max_adv_data_len = tlv_data_max_len(hdev, flags, true); 8670 rp.max_scan_rsp_len = tlv_data_max_len(hdev, flags, false); 8671 8672 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_ADV_SIZE_INFO, 8673 MGMT_STATUS_SUCCESS, &rp, sizeof(rp)); 8674 } 8675 8676 static const struct hci_mgmt_handler mgmt_handlers[] = { 8677 { NULL }, /* 0x0000 (no command) */ 8678 { read_version, MGMT_READ_VERSION_SIZE, 8679 HCI_MGMT_NO_HDEV | 8680 HCI_MGMT_UNTRUSTED }, 8681 { read_commands, MGMT_READ_COMMANDS_SIZE, 8682 HCI_MGMT_NO_HDEV | 8683 HCI_MGMT_UNTRUSTED }, 8684 { read_index_list, MGMT_READ_INDEX_LIST_SIZE, 8685 HCI_MGMT_NO_HDEV | 8686 HCI_MGMT_UNTRUSTED }, 8687 { read_controller_info, MGMT_READ_INFO_SIZE, 8688 HCI_MGMT_UNTRUSTED }, 8689 { set_powered, MGMT_SETTING_SIZE }, 8690 { set_discoverable, MGMT_SET_DISCOVERABLE_SIZE }, 8691 { set_connectable, MGMT_SETTING_SIZE }, 8692 { set_fast_connectable, MGMT_SETTING_SIZE }, 8693 { set_bondable, MGMT_SETTING_SIZE }, 8694 { set_link_security, MGMT_SETTING_SIZE }, 8695 { set_ssp, MGMT_SETTING_SIZE }, 8696 { set_hs, MGMT_SETTING_SIZE }, 8697 { set_le, MGMT_SETTING_SIZE }, 8698 { set_dev_class, MGMT_SET_DEV_CLASS_SIZE }, 8699 { set_local_name, MGMT_SET_LOCAL_NAME_SIZE }, 8700 { add_uuid, MGMT_ADD_UUID_SIZE }, 8701 { remove_uuid, MGMT_REMOVE_UUID_SIZE }, 8702 { load_link_keys, MGMT_LOAD_LINK_KEYS_SIZE, 8703 HCI_MGMT_VAR_LEN }, 8704 { load_long_term_keys, MGMT_LOAD_LONG_TERM_KEYS_SIZE, 8705 HCI_MGMT_VAR_LEN }, 8706 { disconnect, MGMT_DISCONNECT_SIZE }, 8707 { get_connections, MGMT_GET_CONNECTIONS_SIZE }, 8708 { pin_code_reply, MGMT_PIN_CODE_REPLY_SIZE }, 8709 { pin_code_neg_reply, MGMT_PIN_CODE_NEG_REPLY_SIZE }, 8710 { set_io_capability, MGMT_SET_IO_CAPABILITY_SIZE }, 8711 { pair_device, MGMT_PAIR_DEVICE_SIZE }, 8712 { cancel_pair_device, MGMT_CANCEL_PAIR_DEVICE_SIZE }, 8713 { unpair_device, MGMT_UNPAIR_DEVICE_SIZE }, 8714 { user_confirm_reply, MGMT_USER_CONFIRM_REPLY_SIZE }, 8715 { user_confirm_neg_reply, MGMT_USER_CONFIRM_NEG_REPLY_SIZE }, 8716 { user_passkey_reply, MGMT_USER_PASSKEY_REPLY_SIZE }, 8717 { user_passkey_neg_reply, MGMT_USER_PASSKEY_NEG_REPLY_SIZE }, 8718 { read_local_oob_data, MGMT_READ_LOCAL_OOB_DATA_SIZE }, 8719 { add_remote_oob_data, MGMT_ADD_REMOTE_OOB_DATA_SIZE, 8720 HCI_MGMT_VAR_LEN }, 8721 { remove_remote_oob_data, MGMT_REMOVE_REMOTE_OOB_DATA_SIZE }, 8722 { start_discovery, MGMT_START_DISCOVERY_SIZE }, 8723 { stop_discovery, MGMT_STOP_DISCOVERY_SIZE }, 8724 { confirm_name, MGMT_CONFIRM_NAME_SIZE }, 8725 { block_device, MGMT_BLOCK_DEVICE_SIZE }, 8726 { unblock_device, MGMT_UNBLOCK_DEVICE_SIZE }, 8727 { set_device_id, MGMT_SET_DEVICE_ID_SIZE }, 8728 { set_advertising, MGMT_SETTING_SIZE }, 8729 { set_bredr, MGMT_SETTING_SIZE }, 8730 { set_static_address, MGMT_SET_STATIC_ADDRESS_SIZE }, 8731 { set_scan_params, MGMT_SET_SCAN_PARAMS_SIZE }, 8732 { set_secure_conn, MGMT_SETTING_SIZE }, 8733 { set_debug_keys, MGMT_SETTING_SIZE }, 8734 { set_privacy, MGMT_SET_PRIVACY_SIZE }, 8735 { load_irks, MGMT_LOAD_IRKS_SIZE, 8736 HCI_MGMT_VAR_LEN }, 8737 { get_conn_info, MGMT_GET_CONN_INFO_SIZE }, 8738 { get_clock_info, MGMT_GET_CLOCK_INFO_SIZE }, 8739 { add_device, MGMT_ADD_DEVICE_SIZE }, 8740 { remove_device, MGMT_REMOVE_DEVICE_SIZE }, 8741 { load_conn_param, MGMT_LOAD_CONN_PARAM_SIZE, 8742 HCI_MGMT_VAR_LEN }, 8743 { read_unconf_index_list, MGMT_READ_UNCONF_INDEX_LIST_SIZE, 8744 HCI_MGMT_NO_HDEV | 8745 HCI_MGMT_UNTRUSTED }, 8746 { read_config_info, MGMT_READ_CONFIG_INFO_SIZE, 8747 HCI_MGMT_UNCONFIGURED | 8748 HCI_MGMT_UNTRUSTED }, 8749 { set_external_config, MGMT_SET_EXTERNAL_CONFIG_SIZE, 8750 HCI_MGMT_UNCONFIGURED }, 8751 { set_public_address, MGMT_SET_PUBLIC_ADDRESS_SIZE, 8752 HCI_MGMT_UNCONFIGURED }, 8753 { start_service_discovery, MGMT_START_SERVICE_DISCOVERY_SIZE, 8754 HCI_MGMT_VAR_LEN }, 8755 { read_local_oob_ext_data, MGMT_READ_LOCAL_OOB_EXT_DATA_SIZE }, 8756 { read_ext_index_list, MGMT_READ_EXT_INDEX_LIST_SIZE, 8757 HCI_MGMT_NO_HDEV | 8758 HCI_MGMT_UNTRUSTED }, 8759 { read_adv_features, MGMT_READ_ADV_FEATURES_SIZE }, 8760 { add_advertising, MGMT_ADD_ADVERTISING_SIZE, 8761 HCI_MGMT_VAR_LEN }, 8762 { remove_advertising, MGMT_REMOVE_ADVERTISING_SIZE }, 8763 { get_adv_size_info, MGMT_GET_ADV_SIZE_INFO_SIZE }, 8764 { start_limited_discovery, MGMT_START_DISCOVERY_SIZE }, 8765 { read_ext_controller_info,MGMT_READ_EXT_INFO_SIZE, 8766 HCI_MGMT_UNTRUSTED }, 8767 { set_appearance, MGMT_SET_APPEARANCE_SIZE }, 8768 { get_phy_configuration, MGMT_GET_PHY_CONFIGURATION_SIZE }, 8769 { set_phy_configuration, MGMT_SET_PHY_CONFIGURATION_SIZE }, 8770 { set_blocked_keys, MGMT_OP_SET_BLOCKED_KEYS_SIZE, 8771 HCI_MGMT_VAR_LEN }, 8772 { set_wideband_speech, MGMT_SETTING_SIZE }, 8773 { read_controller_cap, MGMT_READ_CONTROLLER_CAP_SIZE, 8774 HCI_MGMT_UNTRUSTED }, 8775 { read_exp_features_info, MGMT_READ_EXP_FEATURES_INFO_SIZE, 8776 HCI_MGMT_UNTRUSTED | 8777 HCI_MGMT_HDEV_OPTIONAL }, 8778 { set_exp_feature, MGMT_SET_EXP_FEATURE_SIZE, 8779 HCI_MGMT_VAR_LEN | 8780 HCI_MGMT_HDEV_OPTIONAL }, 8781 { read_def_system_config, MGMT_READ_DEF_SYSTEM_CONFIG_SIZE, 8782 HCI_MGMT_UNTRUSTED }, 8783 { set_def_system_config, MGMT_SET_DEF_SYSTEM_CONFIG_SIZE, 8784 HCI_MGMT_VAR_LEN }, 8785 { read_def_runtime_config, MGMT_READ_DEF_RUNTIME_CONFIG_SIZE, 8786 HCI_MGMT_UNTRUSTED }, 8787 { set_def_runtime_config, MGMT_SET_DEF_RUNTIME_CONFIG_SIZE, 8788 HCI_MGMT_VAR_LEN }, 8789 { get_device_flags, MGMT_GET_DEVICE_FLAGS_SIZE }, 8790 { set_device_flags, MGMT_SET_DEVICE_FLAGS_SIZE }, 8791 { read_adv_mon_features, MGMT_READ_ADV_MONITOR_FEATURES_SIZE }, 8792 { add_adv_patterns_monitor,MGMT_ADD_ADV_PATTERNS_MONITOR_SIZE, 8793 HCI_MGMT_VAR_LEN }, 8794 { remove_adv_monitor, MGMT_REMOVE_ADV_MONITOR_SIZE }, 8795 { add_ext_adv_params, MGMT_ADD_EXT_ADV_PARAMS_MIN_SIZE, 8796 HCI_MGMT_VAR_LEN }, 8797 { add_ext_adv_data, MGMT_ADD_EXT_ADV_DATA_SIZE, 8798 HCI_MGMT_VAR_LEN }, 8799 { add_adv_patterns_monitor_rssi, 8800 MGMT_ADD_ADV_PATTERNS_MONITOR_RSSI_SIZE, 8801 HCI_MGMT_VAR_LEN }, 8802 }; 8803 8804 void mgmt_index_added(struct hci_dev *hdev) 8805 { 8806 struct mgmt_ev_ext_index ev; 8807 8808 if (test_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks)) 8809 return; 8810 8811 switch (hdev->dev_type) { 8812 case HCI_PRIMARY: 8813 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) { 8814 mgmt_index_event(MGMT_EV_UNCONF_INDEX_ADDED, hdev, 8815 NULL, 0, HCI_MGMT_UNCONF_INDEX_EVENTS); 8816 ev.type = 0x01; 8817 } else { 8818 mgmt_index_event(MGMT_EV_INDEX_ADDED, hdev, NULL, 0, 8819 HCI_MGMT_INDEX_EVENTS); 8820 ev.type = 0x00; 8821 } 8822 break; 8823 case HCI_AMP: 8824 ev.type = 0x02; 8825 break; 8826 default: 8827 return; 8828 } 8829 8830 ev.bus = hdev->bus; 8831 8832 mgmt_index_event(MGMT_EV_EXT_INDEX_ADDED, hdev, &ev, sizeof(ev), 8833 HCI_MGMT_EXT_INDEX_EVENTS); 8834 } 8835 8836 void mgmt_index_removed(struct hci_dev *hdev) 8837 { 8838 struct mgmt_ev_ext_index ev; 8839 u8 status = MGMT_STATUS_INVALID_INDEX; 8840 8841 if (test_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks)) 8842 return; 8843 8844 switch (hdev->dev_type) { 8845 case HCI_PRIMARY: 8846 mgmt_pending_foreach(0, hdev, cmd_complete_rsp, &status); 8847 8848 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) { 8849 mgmt_index_event(MGMT_EV_UNCONF_INDEX_REMOVED, hdev, 8850 NULL, 0, HCI_MGMT_UNCONF_INDEX_EVENTS); 8851 ev.type = 0x01; 8852 } else { 8853 mgmt_index_event(MGMT_EV_INDEX_REMOVED, hdev, NULL, 0, 8854 HCI_MGMT_INDEX_EVENTS); 8855 ev.type = 0x00; 8856 } 8857 break; 8858 case HCI_AMP: 8859 ev.type = 0x02; 8860 break; 8861 default: 8862 return; 8863 } 8864 8865 ev.bus = hdev->bus; 8866 8867 mgmt_index_event(MGMT_EV_EXT_INDEX_REMOVED, hdev, &ev, sizeof(ev), 8868 HCI_MGMT_EXT_INDEX_EVENTS); 8869 } 8870 8871 void mgmt_power_on(struct hci_dev *hdev, int err) 8872 { 8873 struct cmd_lookup match = { NULL, hdev }; 8874 8875 bt_dev_dbg(hdev, "err %d", err); 8876 8877 hci_dev_lock(hdev); 8878 8879 if (!err) { 8880 restart_le_actions(hdev); 8881 hci_update_passive_scan(hdev); 8882 } 8883 8884 mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp, &match); 8885 8886 new_settings(hdev, match.sk); 8887 8888 if (match.sk) 8889 sock_put(match.sk); 8890 8891 hci_dev_unlock(hdev); 8892 } 8893 8894 void __mgmt_power_off(struct hci_dev *hdev) 8895 { 8896 struct cmd_lookup match = { NULL, hdev }; 8897 u8 status, zero_cod[] = { 0, 0, 0 }; 8898 8899 mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp, &match); 8900 8901 /* If the power off is because of hdev unregistration let 8902 * use the appropriate INVALID_INDEX status. Otherwise use 8903 * NOT_POWERED. We cover both scenarios here since later in 8904 * mgmt_index_removed() any hci_conn callbacks will have already 8905 * been triggered, potentially causing misleading DISCONNECTED 8906 * status responses. 8907 */ 8908 if (hci_dev_test_flag(hdev, HCI_UNREGISTER)) 8909 status = MGMT_STATUS_INVALID_INDEX; 8910 else 8911 status = MGMT_STATUS_NOT_POWERED; 8912 8913 mgmt_pending_foreach(0, hdev, cmd_complete_rsp, &status); 8914 8915 if (memcmp(hdev->dev_class, zero_cod, sizeof(zero_cod)) != 0) { 8916 mgmt_limited_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev, 8917 zero_cod, sizeof(zero_cod), 8918 HCI_MGMT_DEV_CLASS_EVENTS, NULL); 8919 ext_info_changed(hdev, NULL); 8920 } 8921 8922 new_settings(hdev, match.sk); 8923 8924 if (match.sk) 8925 sock_put(match.sk); 8926 } 8927 8928 void mgmt_set_powered_failed(struct hci_dev *hdev, int err) 8929 { 8930 struct mgmt_pending_cmd *cmd; 8931 u8 status; 8932 8933 cmd = pending_find(MGMT_OP_SET_POWERED, hdev); 8934 if (!cmd) 8935 return; 8936 8937 if (err == -ERFKILL) 8938 status = MGMT_STATUS_RFKILLED; 8939 else 8940 status = MGMT_STATUS_FAILED; 8941 8942 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_POWERED, status); 8943 8944 mgmt_pending_remove(cmd); 8945 } 8946 8947 void mgmt_new_link_key(struct hci_dev *hdev, struct link_key *key, 8948 bool persistent) 8949 { 8950 struct mgmt_ev_new_link_key ev; 8951 8952 memset(&ev, 0, sizeof(ev)); 8953 8954 ev.store_hint = persistent; 8955 bacpy(&ev.key.addr.bdaddr, &key->bdaddr); 8956 ev.key.addr.type = BDADDR_BREDR; 8957 ev.key.type = key->type; 8958 memcpy(ev.key.val, key->val, HCI_LINK_KEY_SIZE); 8959 ev.key.pin_len = key->pin_len; 8960 8961 mgmt_event(MGMT_EV_NEW_LINK_KEY, hdev, &ev, sizeof(ev), NULL); 8962 } 8963 8964 static u8 mgmt_ltk_type(struct smp_ltk *ltk) 8965 { 8966 switch (ltk->type) { 8967 case SMP_LTK: 8968 case SMP_LTK_RESPONDER: 8969 if (ltk->authenticated) 8970 return MGMT_LTK_AUTHENTICATED; 8971 return MGMT_LTK_UNAUTHENTICATED; 8972 case SMP_LTK_P256: 8973 if (ltk->authenticated) 8974 return MGMT_LTK_P256_AUTH; 8975 return MGMT_LTK_P256_UNAUTH; 8976 case SMP_LTK_P256_DEBUG: 8977 return MGMT_LTK_P256_DEBUG; 8978 } 8979 8980 return MGMT_LTK_UNAUTHENTICATED; 8981 } 8982 8983 void mgmt_new_ltk(struct hci_dev *hdev, struct smp_ltk *key, bool persistent) 8984 { 8985 struct mgmt_ev_new_long_term_key ev; 8986 8987 memset(&ev, 0, sizeof(ev)); 8988 8989 /* Devices using resolvable or non-resolvable random addresses 8990 * without providing an identity resolving key don't require 8991 * to store long term keys. Their addresses will change the 8992 * next time around. 8993 * 8994 * Only when a remote device provides an identity address 8995 * make sure the long term key is stored. If the remote 8996 * identity is known, the long term keys are internally 8997 * mapped to the identity address. So allow static random 8998 * and public addresses here. 8999 */ 9000 if (key->bdaddr_type == ADDR_LE_DEV_RANDOM && 9001 (key->bdaddr.b[5] & 0xc0) != 0xc0) 9002 ev.store_hint = 0x00; 9003 else 9004 ev.store_hint = persistent; 9005 9006 bacpy(&ev.key.addr.bdaddr, &key->bdaddr); 9007 ev.key.addr.type = link_to_bdaddr(LE_LINK, key->bdaddr_type); 9008 ev.key.type = mgmt_ltk_type(key); 9009 ev.key.enc_size = key->enc_size; 9010 ev.key.ediv = key->ediv; 9011 ev.key.rand = key->rand; 9012 9013 if (key->type == SMP_LTK) 9014 ev.key.initiator = 1; 9015 9016 /* Make sure we copy only the significant bytes based on the 9017 * encryption key size, and set the rest of the value to zeroes. 9018 */ 9019 memcpy(ev.key.val, key->val, key->enc_size); 9020 memset(ev.key.val + key->enc_size, 0, 9021 sizeof(ev.key.val) - key->enc_size); 9022 9023 mgmt_event(MGMT_EV_NEW_LONG_TERM_KEY, hdev, &ev, sizeof(ev), NULL); 9024 } 9025 9026 void mgmt_new_irk(struct hci_dev *hdev, struct smp_irk *irk, bool persistent) 9027 { 9028 struct mgmt_ev_new_irk ev; 9029 9030 memset(&ev, 0, sizeof(ev)); 9031 9032 ev.store_hint = persistent; 9033 9034 bacpy(&ev.rpa, &irk->rpa); 9035 bacpy(&ev.irk.addr.bdaddr, &irk->bdaddr); 9036 ev.irk.addr.type = link_to_bdaddr(LE_LINK, irk->addr_type); 9037 memcpy(ev.irk.val, irk->val, sizeof(irk->val)); 9038 9039 mgmt_event(MGMT_EV_NEW_IRK, hdev, &ev, sizeof(ev), NULL); 9040 } 9041 9042 void mgmt_new_csrk(struct hci_dev *hdev, struct smp_csrk *csrk, 9043 bool persistent) 9044 { 9045 struct mgmt_ev_new_csrk ev; 9046 9047 memset(&ev, 0, sizeof(ev)); 9048 9049 /* Devices using resolvable or non-resolvable random addresses 9050 * without providing an identity resolving key don't require 9051 * to store signature resolving keys. Their addresses will change 9052 * the next time around. 9053 * 9054 * Only when a remote device provides an identity address 9055 * make sure the signature resolving key is stored. So allow 9056 * static random and public addresses here. 9057 */ 9058 if (csrk->bdaddr_type == ADDR_LE_DEV_RANDOM && 9059 (csrk->bdaddr.b[5] & 0xc0) != 0xc0) 9060 ev.store_hint = 0x00; 9061 else 9062 ev.store_hint = persistent; 9063 9064 bacpy(&ev.key.addr.bdaddr, &csrk->bdaddr); 9065 ev.key.addr.type = link_to_bdaddr(LE_LINK, csrk->bdaddr_type); 9066 ev.key.type = csrk->type; 9067 memcpy(ev.key.val, csrk->val, sizeof(csrk->val)); 9068 9069 mgmt_event(MGMT_EV_NEW_CSRK, hdev, &ev, sizeof(ev), NULL); 9070 } 9071 9072 void mgmt_new_conn_param(struct hci_dev *hdev, bdaddr_t *bdaddr, 9073 u8 bdaddr_type, u8 store_hint, u16 min_interval, 9074 u16 max_interval, u16 latency, u16 timeout) 9075 { 9076 struct mgmt_ev_new_conn_param ev; 9077 9078 if (!hci_is_identity_address(bdaddr, bdaddr_type)) 9079 return; 9080 9081 memset(&ev, 0, sizeof(ev)); 9082 bacpy(&ev.addr.bdaddr, bdaddr); 9083 ev.addr.type = link_to_bdaddr(LE_LINK, bdaddr_type); 9084 ev.store_hint = store_hint; 9085 ev.min_interval = cpu_to_le16(min_interval); 9086 ev.max_interval = cpu_to_le16(max_interval); 9087 ev.latency = cpu_to_le16(latency); 9088 ev.timeout = cpu_to_le16(timeout); 9089 9090 mgmt_event(MGMT_EV_NEW_CONN_PARAM, hdev, &ev, sizeof(ev), NULL); 9091 } 9092 9093 void mgmt_device_connected(struct hci_dev *hdev, struct hci_conn *conn, 9094 u8 *name, u8 name_len) 9095 { 9096 struct sk_buff *skb; 9097 struct mgmt_ev_device_connected *ev; 9098 u16 eir_len = 0; 9099 u32 flags = 0; 9100 9101 /* allocate buff for LE or BR/EDR adv */ 9102 if (conn->le_adv_data_len > 0) 9103 skb = mgmt_alloc_skb(hdev, MGMT_EV_DEVICE_CONNECTED, 9104 sizeof(*ev) + conn->le_adv_data_len); 9105 else 9106 skb = mgmt_alloc_skb(hdev, MGMT_EV_DEVICE_CONNECTED, 9107 sizeof(*ev) + (name ? eir_precalc_len(name_len) : 0) + 9108 eir_precalc_len(sizeof(conn->dev_class))); 9109 9110 ev = skb_put(skb, sizeof(*ev)); 9111 bacpy(&ev->addr.bdaddr, &conn->dst); 9112 ev->addr.type = link_to_bdaddr(conn->type, conn->dst_type); 9113 9114 if (conn->out) 9115 flags |= MGMT_DEV_FOUND_INITIATED_CONN; 9116 9117 ev->flags = __cpu_to_le32(flags); 9118 9119 /* We must ensure that the EIR Data fields are ordered and 9120 * unique. Keep it simple for now and avoid the problem by not 9121 * adding any BR/EDR data to the LE adv. 9122 */ 9123 if (conn->le_adv_data_len > 0) { 9124 skb_put_data(skb, conn->le_adv_data, conn->le_adv_data_len); 9125 eir_len = conn->le_adv_data_len; 9126 } else { 9127 if (name) 9128 eir_len += eir_skb_put_data(skb, EIR_NAME_COMPLETE, name, name_len); 9129 9130 if (memcmp(conn->dev_class, "\0\0\0", sizeof(conn->dev_class))) 9131 eir_len += eir_skb_put_data(skb, EIR_CLASS_OF_DEV, 9132 conn->dev_class, sizeof(conn->dev_class)); 9133 } 9134 9135 ev->eir_len = cpu_to_le16(eir_len); 9136 9137 mgmt_event_skb(skb, NULL); 9138 } 9139 9140 static void disconnect_rsp(struct mgmt_pending_cmd *cmd, void *data) 9141 { 9142 struct sock **sk = data; 9143 9144 cmd->cmd_complete(cmd, 0); 9145 9146 *sk = cmd->sk; 9147 sock_hold(*sk); 9148 9149 mgmt_pending_remove(cmd); 9150 } 9151 9152 static void unpair_device_rsp(struct mgmt_pending_cmd *cmd, void *data) 9153 { 9154 struct hci_dev *hdev = data; 9155 struct mgmt_cp_unpair_device *cp = cmd->param; 9156 9157 device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, cmd->sk); 9158 9159 cmd->cmd_complete(cmd, 0); 9160 mgmt_pending_remove(cmd); 9161 } 9162 9163 bool mgmt_powering_down(struct hci_dev *hdev) 9164 { 9165 struct mgmt_pending_cmd *cmd; 9166 struct mgmt_mode *cp; 9167 9168 cmd = pending_find(MGMT_OP_SET_POWERED, hdev); 9169 if (!cmd) 9170 return false; 9171 9172 cp = cmd->param; 9173 if (!cp->val) 9174 return true; 9175 9176 return false; 9177 } 9178 9179 void mgmt_device_disconnected(struct hci_dev *hdev, bdaddr_t *bdaddr, 9180 u8 link_type, u8 addr_type, u8 reason, 9181 bool mgmt_connected) 9182 { 9183 struct mgmt_ev_device_disconnected ev; 9184 struct sock *sk = NULL; 9185 9186 /* The connection is still in hci_conn_hash so test for 1 9187 * instead of 0 to know if this is the last one. 9188 */ 9189 if (mgmt_powering_down(hdev) && hci_conn_count(hdev) == 1) { 9190 cancel_delayed_work(&hdev->power_off); 9191 queue_work(hdev->req_workqueue, &hdev->power_off.work); 9192 } 9193 9194 if (!mgmt_connected) 9195 return; 9196 9197 if (link_type != ACL_LINK && link_type != LE_LINK) 9198 return; 9199 9200 mgmt_pending_foreach(MGMT_OP_DISCONNECT, hdev, disconnect_rsp, &sk); 9201 9202 bacpy(&ev.addr.bdaddr, bdaddr); 9203 ev.addr.type = link_to_bdaddr(link_type, addr_type); 9204 ev.reason = reason; 9205 9206 /* Report disconnects due to suspend */ 9207 if (hdev->suspended) 9208 ev.reason = MGMT_DEV_DISCONN_LOCAL_HOST_SUSPEND; 9209 9210 mgmt_event(MGMT_EV_DEVICE_DISCONNECTED, hdev, &ev, sizeof(ev), sk); 9211 9212 if (sk) 9213 sock_put(sk); 9214 9215 mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, unpair_device_rsp, 9216 hdev); 9217 } 9218 9219 void mgmt_disconnect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr, 9220 u8 link_type, u8 addr_type, u8 status) 9221 { 9222 u8 bdaddr_type = link_to_bdaddr(link_type, addr_type); 9223 struct mgmt_cp_disconnect *cp; 9224 struct mgmt_pending_cmd *cmd; 9225 9226 mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, unpair_device_rsp, 9227 hdev); 9228 9229 cmd = pending_find(MGMT_OP_DISCONNECT, hdev); 9230 if (!cmd) 9231 return; 9232 9233 cp = cmd->param; 9234 9235 if (bacmp(bdaddr, &cp->addr.bdaddr)) 9236 return; 9237 9238 if (cp->addr.type != bdaddr_type) 9239 return; 9240 9241 cmd->cmd_complete(cmd, mgmt_status(status)); 9242 mgmt_pending_remove(cmd); 9243 } 9244 9245 void mgmt_connect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type, 9246 u8 addr_type, u8 status) 9247 { 9248 struct mgmt_ev_connect_failed ev; 9249 9250 /* The connection is still in hci_conn_hash so test for 1 9251 * instead of 0 to know if this is the last one. 9252 */ 9253 if (mgmt_powering_down(hdev) && hci_conn_count(hdev) == 1) { 9254 cancel_delayed_work(&hdev->power_off); 9255 queue_work(hdev->req_workqueue, &hdev->power_off.work); 9256 } 9257 9258 bacpy(&ev.addr.bdaddr, bdaddr); 9259 ev.addr.type = link_to_bdaddr(link_type, addr_type); 9260 ev.status = mgmt_status(status); 9261 9262 mgmt_event(MGMT_EV_CONNECT_FAILED, hdev, &ev, sizeof(ev), NULL); 9263 } 9264 9265 void mgmt_pin_code_request(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 secure) 9266 { 9267 struct mgmt_ev_pin_code_request ev; 9268 9269 bacpy(&ev.addr.bdaddr, bdaddr); 9270 ev.addr.type = BDADDR_BREDR; 9271 ev.secure = secure; 9272 9273 mgmt_event(MGMT_EV_PIN_CODE_REQUEST, hdev, &ev, sizeof(ev), NULL); 9274 } 9275 9276 void mgmt_pin_code_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr, 9277 u8 status) 9278 { 9279 struct mgmt_pending_cmd *cmd; 9280 9281 cmd = pending_find(MGMT_OP_PIN_CODE_REPLY, hdev); 9282 if (!cmd) 9283 return; 9284 9285 cmd->cmd_complete(cmd, mgmt_status(status)); 9286 mgmt_pending_remove(cmd); 9287 } 9288 9289 void mgmt_pin_code_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr, 9290 u8 status) 9291 { 9292 struct mgmt_pending_cmd *cmd; 9293 9294 cmd = pending_find(MGMT_OP_PIN_CODE_NEG_REPLY, hdev); 9295 if (!cmd) 9296 return; 9297 9298 cmd->cmd_complete(cmd, mgmt_status(status)); 9299 mgmt_pending_remove(cmd); 9300 } 9301 9302 int mgmt_user_confirm_request(struct hci_dev *hdev, bdaddr_t *bdaddr, 9303 u8 link_type, u8 addr_type, u32 value, 9304 u8 confirm_hint) 9305 { 9306 struct mgmt_ev_user_confirm_request ev; 9307 9308 bt_dev_dbg(hdev, "bdaddr %pMR", bdaddr); 9309 9310 bacpy(&ev.addr.bdaddr, bdaddr); 9311 ev.addr.type = link_to_bdaddr(link_type, addr_type); 9312 ev.confirm_hint = confirm_hint; 9313 ev.value = cpu_to_le32(value); 9314 9315 return mgmt_event(MGMT_EV_USER_CONFIRM_REQUEST, hdev, &ev, sizeof(ev), 9316 NULL); 9317 } 9318 9319 int mgmt_user_passkey_request(struct hci_dev *hdev, bdaddr_t *bdaddr, 9320 u8 link_type, u8 addr_type) 9321 { 9322 struct mgmt_ev_user_passkey_request ev; 9323 9324 bt_dev_dbg(hdev, "bdaddr %pMR", bdaddr); 9325 9326 bacpy(&ev.addr.bdaddr, bdaddr); 9327 ev.addr.type = link_to_bdaddr(link_type, addr_type); 9328 9329 return mgmt_event(MGMT_EV_USER_PASSKEY_REQUEST, hdev, &ev, sizeof(ev), 9330 NULL); 9331 } 9332 9333 static int user_pairing_resp_complete(struct hci_dev *hdev, bdaddr_t *bdaddr, 9334 u8 link_type, u8 addr_type, u8 status, 9335 u8 opcode) 9336 { 9337 struct mgmt_pending_cmd *cmd; 9338 9339 cmd = pending_find(opcode, hdev); 9340 if (!cmd) 9341 return -ENOENT; 9342 9343 cmd->cmd_complete(cmd, mgmt_status(status)); 9344 mgmt_pending_remove(cmd); 9345 9346 return 0; 9347 } 9348 9349 int mgmt_user_confirm_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr, 9350 u8 link_type, u8 addr_type, u8 status) 9351 { 9352 return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type, 9353 status, MGMT_OP_USER_CONFIRM_REPLY); 9354 } 9355 9356 int mgmt_user_confirm_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr, 9357 u8 link_type, u8 addr_type, u8 status) 9358 { 9359 return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type, 9360 status, 9361 MGMT_OP_USER_CONFIRM_NEG_REPLY); 9362 } 9363 9364 int mgmt_user_passkey_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr, 9365 u8 link_type, u8 addr_type, u8 status) 9366 { 9367 return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type, 9368 status, MGMT_OP_USER_PASSKEY_REPLY); 9369 } 9370 9371 int mgmt_user_passkey_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr, 9372 u8 link_type, u8 addr_type, u8 status) 9373 { 9374 return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type, 9375 status, 9376 MGMT_OP_USER_PASSKEY_NEG_REPLY); 9377 } 9378 9379 int mgmt_user_passkey_notify(struct hci_dev *hdev, bdaddr_t *bdaddr, 9380 u8 link_type, u8 addr_type, u32 passkey, 9381 u8 entered) 9382 { 9383 struct mgmt_ev_passkey_notify ev; 9384 9385 bt_dev_dbg(hdev, "bdaddr %pMR", bdaddr); 9386 9387 bacpy(&ev.addr.bdaddr, bdaddr); 9388 ev.addr.type = link_to_bdaddr(link_type, addr_type); 9389 ev.passkey = __cpu_to_le32(passkey); 9390 ev.entered = entered; 9391 9392 return mgmt_event(MGMT_EV_PASSKEY_NOTIFY, hdev, &ev, sizeof(ev), NULL); 9393 } 9394 9395 void mgmt_auth_failed(struct hci_conn *conn, u8 hci_status) 9396 { 9397 struct mgmt_ev_auth_failed ev; 9398 struct mgmt_pending_cmd *cmd; 9399 u8 status = mgmt_status(hci_status); 9400 9401 bacpy(&ev.addr.bdaddr, &conn->dst); 9402 ev.addr.type = link_to_bdaddr(conn->type, conn->dst_type); 9403 ev.status = status; 9404 9405 cmd = find_pairing(conn); 9406 9407 mgmt_event(MGMT_EV_AUTH_FAILED, conn->hdev, &ev, sizeof(ev), 9408 cmd ? cmd->sk : NULL); 9409 9410 if (cmd) { 9411 cmd->cmd_complete(cmd, status); 9412 mgmt_pending_remove(cmd); 9413 } 9414 } 9415 9416 void mgmt_auth_enable_complete(struct hci_dev *hdev, u8 status) 9417 { 9418 struct cmd_lookup match = { NULL, hdev }; 9419 bool changed; 9420 9421 if (status) { 9422 u8 mgmt_err = mgmt_status(status); 9423 mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev, 9424 cmd_status_rsp, &mgmt_err); 9425 return; 9426 } 9427 9428 if (test_bit(HCI_AUTH, &hdev->flags)) 9429 changed = !hci_dev_test_and_set_flag(hdev, HCI_LINK_SECURITY); 9430 else 9431 changed = hci_dev_test_and_clear_flag(hdev, HCI_LINK_SECURITY); 9432 9433 mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev, settings_rsp, 9434 &match); 9435 9436 if (changed) 9437 new_settings(hdev, match.sk); 9438 9439 if (match.sk) 9440 sock_put(match.sk); 9441 } 9442 9443 static void sk_lookup(struct mgmt_pending_cmd *cmd, void *data) 9444 { 9445 struct cmd_lookup *match = data; 9446 9447 if (match->sk == NULL) { 9448 match->sk = cmd->sk; 9449 sock_hold(match->sk); 9450 } 9451 } 9452 9453 void mgmt_set_class_of_dev_complete(struct hci_dev *hdev, u8 *dev_class, 9454 u8 status) 9455 { 9456 struct cmd_lookup match = { NULL, hdev, mgmt_status(status) }; 9457 9458 mgmt_pending_foreach(MGMT_OP_SET_DEV_CLASS, hdev, sk_lookup, &match); 9459 mgmt_pending_foreach(MGMT_OP_ADD_UUID, hdev, sk_lookup, &match); 9460 mgmt_pending_foreach(MGMT_OP_REMOVE_UUID, hdev, sk_lookup, &match); 9461 9462 if (!status) { 9463 mgmt_limited_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev, dev_class, 9464 3, HCI_MGMT_DEV_CLASS_EVENTS, NULL); 9465 ext_info_changed(hdev, NULL); 9466 } 9467 9468 if (match.sk) 9469 sock_put(match.sk); 9470 } 9471 9472 void mgmt_set_local_name_complete(struct hci_dev *hdev, u8 *name, u8 status) 9473 { 9474 struct mgmt_cp_set_local_name ev; 9475 struct mgmt_pending_cmd *cmd; 9476 9477 if (status) 9478 return; 9479 9480 memset(&ev, 0, sizeof(ev)); 9481 memcpy(ev.name, name, HCI_MAX_NAME_LENGTH); 9482 memcpy(ev.short_name, hdev->short_name, HCI_MAX_SHORT_NAME_LENGTH); 9483 9484 cmd = pending_find(MGMT_OP_SET_LOCAL_NAME, hdev); 9485 if (!cmd) { 9486 memcpy(hdev->dev_name, name, sizeof(hdev->dev_name)); 9487 9488 /* If this is a HCI command related to powering on the 9489 * HCI dev don't send any mgmt signals. 9490 */ 9491 if (pending_find(MGMT_OP_SET_POWERED, hdev)) 9492 return; 9493 } 9494 9495 mgmt_limited_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, &ev, sizeof(ev), 9496 HCI_MGMT_LOCAL_NAME_EVENTS, cmd ? cmd->sk : NULL); 9497 ext_info_changed(hdev, cmd ? cmd->sk : NULL); 9498 } 9499 9500 static inline bool has_uuid(u8 *uuid, u16 uuid_count, u8 (*uuids)[16]) 9501 { 9502 int i; 9503 9504 for (i = 0; i < uuid_count; i++) { 9505 if (!memcmp(uuid, uuids[i], 16)) 9506 return true; 9507 } 9508 9509 return false; 9510 } 9511 9512 static bool eir_has_uuids(u8 *eir, u16 eir_len, u16 uuid_count, u8 (*uuids)[16]) 9513 { 9514 u16 parsed = 0; 9515 9516 while (parsed < eir_len) { 9517 u8 field_len = eir[0]; 9518 u8 uuid[16]; 9519 int i; 9520 9521 if (field_len == 0) 9522 break; 9523 9524 if (eir_len - parsed < field_len + 1) 9525 break; 9526 9527 switch (eir[1]) { 9528 case EIR_UUID16_ALL: 9529 case EIR_UUID16_SOME: 9530 for (i = 0; i + 3 <= field_len; i += 2) { 9531 memcpy(uuid, bluetooth_base_uuid, 16); 9532 uuid[13] = eir[i + 3]; 9533 uuid[12] = eir[i + 2]; 9534 if (has_uuid(uuid, uuid_count, uuids)) 9535 return true; 9536 } 9537 break; 9538 case EIR_UUID32_ALL: 9539 case EIR_UUID32_SOME: 9540 for (i = 0; i + 5 <= field_len; i += 4) { 9541 memcpy(uuid, bluetooth_base_uuid, 16); 9542 uuid[15] = eir[i + 5]; 9543 uuid[14] = eir[i + 4]; 9544 uuid[13] = eir[i + 3]; 9545 uuid[12] = eir[i + 2]; 9546 if (has_uuid(uuid, uuid_count, uuids)) 9547 return true; 9548 } 9549 break; 9550 case EIR_UUID128_ALL: 9551 case EIR_UUID128_SOME: 9552 for (i = 0; i + 17 <= field_len; i += 16) { 9553 memcpy(uuid, eir + i + 2, 16); 9554 if (has_uuid(uuid, uuid_count, uuids)) 9555 return true; 9556 } 9557 break; 9558 } 9559 9560 parsed += field_len + 1; 9561 eir += field_len + 1; 9562 } 9563 9564 return false; 9565 } 9566 9567 static void restart_le_scan(struct hci_dev *hdev) 9568 { 9569 /* If controller is not scanning we are done. */ 9570 if (!hci_dev_test_flag(hdev, HCI_LE_SCAN)) 9571 return; 9572 9573 if (time_after(jiffies + DISCOV_LE_RESTART_DELAY, 9574 hdev->discovery.scan_start + 9575 hdev->discovery.scan_duration)) 9576 return; 9577 9578 queue_delayed_work(hdev->req_workqueue, &hdev->le_scan_restart, 9579 DISCOV_LE_RESTART_DELAY); 9580 } 9581 9582 static bool is_filter_match(struct hci_dev *hdev, s8 rssi, u8 *eir, 9583 u16 eir_len, u8 *scan_rsp, u8 scan_rsp_len) 9584 { 9585 /* If a RSSI threshold has been specified, and 9586 * HCI_QUIRK_STRICT_DUPLICATE_FILTER is not set, then all results with 9587 * a RSSI smaller than the RSSI threshold will be dropped. If the quirk 9588 * is set, let it through for further processing, as we might need to 9589 * restart the scan. 9590 * 9591 * For BR/EDR devices (pre 1.2) providing no RSSI during inquiry, 9592 * the results are also dropped. 9593 */ 9594 if (hdev->discovery.rssi != HCI_RSSI_INVALID && 9595 (rssi == HCI_RSSI_INVALID || 9596 (rssi < hdev->discovery.rssi && 9597 !test_bit(HCI_QUIRK_STRICT_DUPLICATE_FILTER, &hdev->quirks)))) 9598 return false; 9599 9600 if (hdev->discovery.uuid_count != 0) { 9601 /* If a list of UUIDs is provided in filter, results with no 9602 * matching UUID should be dropped. 9603 */ 9604 if (!eir_has_uuids(eir, eir_len, hdev->discovery.uuid_count, 9605 hdev->discovery.uuids) && 9606 !eir_has_uuids(scan_rsp, scan_rsp_len, 9607 hdev->discovery.uuid_count, 9608 hdev->discovery.uuids)) 9609 return false; 9610 } 9611 9612 /* If duplicate filtering does not report RSSI changes, then restart 9613 * scanning to ensure updated result with updated RSSI values. 9614 */ 9615 if (test_bit(HCI_QUIRK_STRICT_DUPLICATE_FILTER, &hdev->quirks)) { 9616 restart_le_scan(hdev); 9617 9618 /* Validate RSSI value against the RSSI threshold once more. */ 9619 if (hdev->discovery.rssi != HCI_RSSI_INVALID && 9620 rssi < hdev->discovery.rssi) 9621 return false; 9622 } 9623 9624 return true; 9625 } 9626 9627 void mgmt_adv_monitor_device_lost(struct hci_dev *hdev, u16 handle, 9628 bdaddr_t *bdaddr, u8 addr_type) 9629 { 9630 struct mgmt_ev_adv_monitor_device_lost ev; 9631 9632 ev.monitor_handle = cpu_to_le16(handle); 9633 bacpy(&ev.addr.bdaddr, bdaddr); 9634 ev.addr.type = addr_type; 9635 9636 mgmt_event(MGMT_EV_ADV_MONITOR_DEVICE_LOST, hdev, &ev, sizeof(ev), 9637 NULL); 9638 } 9639 9640 static void mgmt_send_adv_monitor_device_found(struct hci_dev *hdev, 9641 struct sk_buff *skb, 9642 struct sock *skip_sk, 9643 u16 handle) 9644 { 9645 struct sk_buff *advmon_skb; 9646 size_t advmon_skb_len; 9647 __le16 *monitor_handle; 9648 9649 if (!skb) 9650 return; 9651 9652 advmon_skb_len = (sizeof(struct mgmt_ev_adv_monitor_device_found) - 9653 sizeof(struct mgmt_ev_device_found)) + skb->len; 9654 advmon_skb = mgmt_alloc_skb(hdev, MGMT_EV_ADV_MONITOR_DEVICE_FOUND, 9655 advmon_skb_len); 9656 if (!advmon_skb) 9657 return; 9658 9659 /* ADV_MONITOR_DEVICE_FOUND is similar to DEVICE_FOUND event except 9660 * that it also has 'monitor_handle'. Make a copy of DEVICE_FOUND and 9661 * store monitor_handle of the matched monitor. 9662 */ 9663 monitor_handle = skb_put(advmon_skb, sizeof(*monitor_handle)); 9664 *monitor_handle = cpu_to_le16(handle); 9665 skb_put_data(advmon_skb, skb->data, skb->len); 9666 9667 mgmt_event_skb(advmon_skb, skip_sk); 9668 } 9669 9670 static void mgmt_adv_monitor_device_found(struct hci_dev *hdev, 9671 bdaddr_t *bdaddr, bool report_device, 9672 struct sk_buff *skb, 9673 struct sock *skip_sk) 9674 { 9675 struct monitored_device *dev, *tmp; 9676 bool matched = false; 9677 bool notified = false; 9678 9679 /* We have received the Advertisement Report because: 9680 * 1. the kernel has initiated active discovery 9681 * 2. if not, we have pend_le_reports > 0 in which case we are doing 9682 * passive scanning 9683 * 3. if none of the above is true, we have one or more active 9684 * Advertisement Monitor 9685 * 9686 * For case 1 and 2, report all advertisements via MGMT_EV_DEVICE_FOUND 9687 * and report ONLY one advertisement per device for the matched Monitor 9688 * via MGMT_EV_ADV_MONITOR_DEVICE_FOUND event. 9689 * 9690 * For case 3, since we are not active scanning and all advertisements 9691 * received are due to a matched Advertisement Monitor, report all 9692 * advertisements ONLY via MGMT_EV_ADV_MONITOR_DEVICE_FOUND event. 9693 */ 9694 if (report_device && !hdev->advmon_pend_notify) { 9695 mgmt_event_skb(skb, skip_sk); 9696 return; 9697 } 9698 9699 hdev->advmon_pend_notify = false; 9700 9701 list_for_each_entry_safe(dev, tmp, &hdev->monitored_devices, list) { 9702 if (!bacmp(&dev->bdaddr, bdaddr)) { 9703 matched = true; 9704 9705 if (!dev->notified) { 9706 mgmt_send_adv_monitor_device_found(hdev, skb, 9707 skip_sk, 9708 dev->handle); 9709 notified = true; 9710 dev->notified = true; 9711 } 9712 } 9713 9714 if (!dev->notified) 9715 hdev->advmon_pend_notify = true; 9716 } 9717 9718 if (!report_device && 9719 ((matched && !notified) || !msft_monitor_supported(hdev))) { 9720 /* Handle 0 indicates that we are not active scanning and this 9721 * is a subsequent advertisement report for an already matched 9722 * Advertisement Monitor or the controller offloading support 9723 * is not available. 9724 */ 9725 mgmt_send_adv_monitor_device_found(hdev, skb, skip_sk, 0); 9726 } 9727 9728 if (report_device) 9729 mgmt_event_skb(skb, skip_sk); 9730 else 9731 kfree_skb(skb); 9732 } 9733 9734 void mgmt_device_found(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type, 9735 u8 addr_type, u8 *dev_class, s8 rssi, u32 flags, 9736 u8 *eir, u16 eir_len, u8 *scan_rsp, u8 scan_rsp_len) 9737 { 9738 struct sk_buff *skb; 9739 struct mgmt_ev_device_found *ev; 9740 bool report_device = hci_discovery_active(hdev); 9741 9742 /* Don't send events for a non-kernel initiated discovery. With 9743 * LE one exception is if we have pend_le_reports > 0 in which 9744 * case we're doing passive scanning and want these events. 9745 */ 9746 if (!hci_discovery_active(hdev)) { 9747 if (link_type == ACL_LINK) 9748 return; 9749 if (link_type == LE_LINK && !list_empty(&hdev->pend_le_reports)) 9750 report_device = true; 9751 else if (!hci_is_adv_monitoring(hdev)) 9752 return; 9753 } 9754 9755 if (hdev->discovery.result_filtering) { 9756 /* We are using service discovery */ 9757 if (!is_filter_match(hdev, rssi, eir, eir_len, scan_rsp, 9758 scan_rsp_len)) 9759 return; 9760 } 9761 9762 if (hdev->discovery.limited) { 9763 /* Check for limited discoverable bit */ 9764 if (dev_class) { 9765 if (!(dev_class[1] & 0x20)) 9766 return; 9767 } else { 9768 u8 *flags = eir_get_data(eir, eir_len, EIR_FLAGS, NULL); 9769 if (!flags || !(flags[0] & LE_AD_LIMITED)) 9770 return; 9771 } 9772 } 9773 9774 /* Allocate skb. The 5 extra bytes are for the potential CoD field */ 9775 skb = mgmt_alloc_skb(hdev, MGMT_EV_DEVICE_FOUND, 9776 sizeof(*ev) + eir_len + scan_rsp_len + 5); 9777 if (!skb) 9778 return; 9779 9780 ev = skb_put(skb, sizeof(*ev)); 9781 9782 /* In case of device discovery with BR/EDR devices (pre 1.2), the 9783 * RSSI value was reported as 0 when not available. This behavior 9784 * is kept when using device discovery. This is required for full 9785 * backwards compatibility with the API. 9786 * 9787 * However when using service discovery, the value 127 will be 9788 * returned when the RSSI is not available. 9789 */ 9790 if (rssi == HCI_RSSI_INVALID && !hdev->discovery.report_invalid_rssi && 9791 link_type == ACL_LINK) 9792 rssi = 0; 9793 9794 bacpy(&ev->addr.bdaddr, bdaddr); 9795 ev->addr.type = link_to_bdaddr(link_type, addr_type); 9796 ev->rssi = rssi; 9797 ev->flags = cpu_to_le32(flags); 9798 9799 if (eir_len > 0) 9800 /* Copy EIR or advertising data into event */ 9801 skb_put_data(skb, eir, eir_len); 9802 9803 if (dev_class && !eir_get_data(eir, eir_len, EIR_CLASS_OF_DEV, NULL)) { 9804 u8 eir_cod[5]; 9805 9806 eir_len += eir_append_data(eir_cod, 0, EIR_CLASS_OF_DEV, 9807 dev_class, 3); 9808 skb_put_data(skb, eir_cod, sizeof(eir_cod)); 9809 } 9810 9811 if (scan_rsp_len > 0) 9812 /* Append scan response data to event */ 9813 skb_put_data(skb, scan_rsp, scan_rsp_len); 9814 9815 ev->eir_len = cpu_to_le16(eir_len + scan_rsp_len); 9816 9817 mgmt_adv_monitor_device_found(hdev, bdaddr, report_device, skb, NULL); 9818 } 9819 9820 void mgmt_remote_name(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type, 9821 u8 addr_type, s8 rssi, u8 *name, u8 name_len) 9822 { 9823 struct sk_buff *skb; 9824 struct mgmt_ev_device_found *ev; 9825 u16 eir_len = 0; 9826 u32 flags = 0; 9827 9828 skb = mgmt_alloc_skb(hdev, MGMT_EV_DEVICE_FOUND, 9829 sizeof(*ev) + (name ? eir_precalc_len(name_len) : 0)); 9830 9831 ev = skb_put(skb, sizeof(*ev)); 9832 bacpy(&ev->addr.bdaddr, bdaddr); 9833 ev->addr.type = link_to_bdaddr(link_type, addr_type); 9834 ev->rssi = rssi; 9835 9836 if (name) 9837 eir_len += eir_skb_put_data(skb, EIR_NAME_COMPLETE, name, name_len); 9838 else 9839 flags = MGMT_DEV_FOUND_NAME_REQUEST_FAILED; 9840 9841 ev->eir_len = cpu_to_le16(eir_len); 9842 ev->flags = cpu_to_le32(flags); 9843 9844 mgmt_event_skb(skb, NULL); 9845 } 9846 9847 void mgmt_discovering(struct hci_dev *hdev, u8 discovering) 9848 { 9849 struct mgmt_ev_discovering ev; 9850 9851 bt_dev_dbg(hdev, "discovering %u", discovering); 9852 9853 memset(&ev, 0, sizeof(ev)); 9854 ev.type = hdev->discovery.type; 9855 ev.discovering = discovering; 9856 9857 mgmt_event(MGMT_EV_DISCOVERING, hdev, &ev, sizeof(ev), NULL); 9858 } 9859 9860 void mgmt_suspending(struct hci_dev *hdev, u8 state) 9861 { 9862 struct mgmt_ev_controller_suspend ev; 9863 9864 ev.suspend_state = state; 9865 mgmt_event(MGMT_EV_CONTROLLER_SUSPEND, hdev, &ev, sizeof(ev), NULL); 9866 } 9867 9868 void mgmt_resuming(struct hci_dev *hdev, u8 reason, bdaddr_t *bdaddr, 9869 u8 addr_type) 9870 { 9871 struct mgmt_ev_controller_resume ev; 9872 9873 ev.wake_reason = reason; 9874 if (bdaddr) { 9875 bacpy(&ev.addr.bdaddr, bdaddr); 9876 ev.addr.type = addr_type; 9877 } else { 9878 memset(&ev.addr, 0, sizeof(ev.addr)); 9879 } 9880 9881 mgmt_event(MGMT_EV_CONTROLLER_RESUME, hdev, &ev, sizeof(ev), NULL); 9882 } 9883 9884 static struct hci_mgmt_chan chan = { 9885 .channel = HCI_CHANNEL_CONTROL, 9886 .handler_count = ARRAY_SIZE(mgmt_handlers), 9887 .handlers = mgmt_handlers, 9888 .hdev_init = mgmt_init_hdev, 9889 }; 9890 9891 int mgmt_init(void) 9892 { 9893 return hci_mgmt_chan_register(&chan); 9894 } 9895 9896 void mgmt_exit(void) 9897 { 9898 hci_mgmt_chan_unregister(&chan); 9899 } 9900