1 /* 2 BlueZ - Bluetooth protocol stack for Linux 3 4 Copyright (C) 2010 Nokia Corporation 5 Copyright (C) 2011-2012 Intel Corporation 6 7 This program is free software; you can redistribute it and/or modify 8 it under the terms of the GNU General Public License version 2 as 9 published by the Free Software Foundation; 10 11 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS 12 OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 13 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS. 14 IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY 15 CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES 16 WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN 17 ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF 18 OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. 19 20 ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS, 21 COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS 22 SOFTWARE IS DISCLAIMED. 23 */ 24 25 /* Bluetooth HCI Management interface */ 26 27 #include <linux/module.h> 28 #include <asm/unaligned.h> 29 30 #include <net/bluetooth/bluetooth.h> 31 #include <net/bluetooth/hci_core.h> 32 #include <net/bluetooth/hci_sock.h> 33 #include <net/bluetooth/l2cap.h> 34 #include <net/bluetooth/mgmt.h> 35 36 #include "hci_request.h" 37 #include "smp.h" 38 #include "mgmt_util.h" 39 #include "mgmt_config.h" 40 #include "msft.h" 41 42 #define MGMT_VERSION 1 43 #define MGMT_REVISION 21 44 45 static const u16 mgmt_commands[] = { 46 MGMT_OP_READ_INDEX_LIST, 47 MGMT_OP_READ_INFO, 48 MGMT_OP_SET_POWERED, 49 MGMT_OP_SET_DISCOVERABLE, 50 MGMT_OP_SET_CONNECTABLE, 51 MGMT_OP_SET_FAST_CONNECTABLE, 52 MGMT_OP_SET_BONDABLE, 53 MGMT_OP_SET_LINK_SECURITY, 54 MGMT_OP_SET_SSP, 55 MGMT_OP_SET_HS, 56 MGMT_OP_SET_LE, 57 MGMT_OP_SET_DEV_CLASS, 58 MGMT_OP_SET_LOCAL_NAME, 59 MGMT_OP_ADD_UUID, 60 MGMT_OP_REMOVE_UUID, 61 MGMT_OP_LOAD_LINK_KEYS, 62 MGMT_OP_LOAD_LONG_TERM_KEYS, 63 MGMT_OP_DISCONNECT, 64 MGMT_OP_GET_CONNECTIONS, 65 MGMT_OP_PIN_CODE_REPLY, 66 MGMT_OP_PIN_CODE_NEG_REPLY, 67 MGMT_OP_SET_IO_CAPABILITY, 68 MGMT_OP_PAIR_DEVICE, 69 MGMT_OP_CANCEL_PAIR_DEVICE, 70 MGMT_OP_UNPAIR_DEVICE, 71 MGMT_OP_USER_CONFIRM_REPLY, 72 MGMT_OP_USER_CONFIRM_NEG_REPLY, 73 MGMT_OP_USER_PASSKEY_REPLY, 74 MGMT_OP_USER_PASSKEY_NEG_REPLY, 75 MGMT_OP_READ_LOCAL_OOB_DATA, 76 MGMT_OP_ADD_REMOTE_OOB_DATA, 77 MGMT_OP_REMOVE_REMOTE_OOB_DATA, 78 MGMT_OP_START_DISCOVERY, 79 MGMT_OP_STOP_DISCOVERY, 80 MGMT_OP_CONFIRM_NAME, 81 MGMT_OP_BLOCK_DEVICE, 82 MGMT_OP_UNBLOCK_DEVICE, 83 MGMT_OP_SET_DEVICE_ID, 84 MGMT_OP_SET_ADVERTISING, 85 MGMT_OP_SET_BREDR, 86 MGMT_OP_SET_STATIC_ADDRESS, 87 MGMT_OP_SET_SCAN_PARAMS, 88 MGMT_OP_SET_SECURE_CONN, 89 MGMT_OP_SET_DEBUG_KEYS, 90 MGMT_OP_SET_PRIVACY, 91 MGMT_OP_LOAD_IRKS, 92 MGMT_OP_GET_CONN_INFO, 93 MGMT_OP_GET_CLOCK_INFO, 94 MGMT_OP_ADD_DEVICE, 95 MGMT_OP_REMOVE_DEVICE, 96 MGMT_OP_LOAD_CONN_PARAM, 97 MGMT_OP_READ_UNCONF_INDEX_LIST, 98 MGMT_OP_READ_CONFIG_INFO, 99 MGMT_OP_SET_EXTERNAL_CONFIG, 100 MGMT_OP_SET_PUBLIC_ADDRESS, 101 MGMT_OP_START_SERVICE_DISCOVERY, 102 MGMT_OP_READ_LOCAL_OOB_EXT_DATA, 103 MGMT_OP_READ_EXT_INDEX_LIST, 104 MGMT_OP_READ_ADV_FEATURES, 105 MGMT_OP_ADD_ADVERTISING, 106 MGMT_OP_REMOVE_ADVERTISING, 107 MGMT_OP_GET_ADV_SIZE_INFO, 108 MGMT_OP_START_LIMITED_DISCOVERY, 109 MGMT_OP_READ_EXT_INFO, 110 MGMT_OP_SET_APPEARANCE, 111 MGMT_OP_GET_PHY_CONFIGURATION, 112 MGMT_OP_SET_PHY_CONFIGURATION, 113 MGMT_OP_SET_BLOCKED_KEYS, 114 MGMT_OP_SET_WIDEBAND_SPEECH, 115 MGMT_OP_READ_CONTROLLER_CAP, 116 MGMT_OP_READ_EXP_FEATURES_INFO, 117 MGMT_OP_SET_EXP_FEATURE, 118 MGMT_OP_READ_DEF_SYSTEM_CONFIG, 119 MGMT_OP_SET_DEF_SYSTEM_CONFIG, 120 MGMT_OP_READ_DEF_RUNTIME_CONFIG, 121 MGMT_OP_SET_DEF_RUNTIME_CONFIG, 122 MGMT_OP_GET_DEVICE_FLAGS, 123 MGMT_OP_SET_DEVICE_FLAGS, 124 MGMT_OP_READ_ADV_MONITOR_FEATURES, 125 MGMT_OP_ADD_ADV_PATTERNS_MONITOR, 126 MGMT_OP_REMOVE_ADV_MONITOR, 127 MGMT_OP_ADD_EXT_ADV_PARAMS, 128 MGMT_OP_ADD_EXT_ADV_DATA, 129 MGMT_OP_ADD_ADV_PATTERNS_MONITOR_RSSI, 130 }; 131 132 static const u16 mgmt_events[] = { 133 MGMT_EV_CONTROLLER_ERROR, 134 MGMT_EV_INDEX_ADDED, 135 MGMT_EV_INDEX_REMOVED, 136 MGMT_EV_NEW_SETTINGS, 137 MGMT_EV_CLASS_OF_DEV_CHANGED, 138 MGMT_EV_LOCAL_NAME_CHANGED, 139 MGMT_EV_NEW_LINK_KEY, 140 MGMT_EV_NEW_LONG_TERM_KEY, 141 MGMT_EV_DEVICE_CONNECTED, 142 MGMT_EV_DEVICE_DISCONNECTED, 143 MGMT_EV_CONNECT_FAILED, 144 MGMT_EV_PIN_CODE_REQUEST, 145 MGMT_EV_USER_CONFIRM_REQUEST, 146 MGMT_EV_USER_PASSKEY_REQUEST, 147 MGMT_EV_AUTH_FAILED, 148 MGMT_EV_DEVICE_FOUND, 149 MGMT_EV_DISCOVERING, 150 MGMT_EV_DEVICE_BLOCKED, 151 MGMT_EV_DEVICE_UNBLOCKED, 152 MGMT_EV_DEVICE_UNPAIRED, 153 MGMT_EV_PASSKEY_NOTIFY, 154 MGMT_EV_NEW_IRK, 155 MGMT_EV_NEW_CSRK, 156 MGMT_EV_DEVICE_ADDED, 157 MGMT_EV_DEVICE_REMOVED, 158 MGMT_EV_NEW_CONN_PARAM, 159 MGMT_EV_UNCONF_INDEX_ADDED, 160 MGMT_EV_UNCONF_INDEX_REMOVED, 161 MGMT_EV_NEW_CONFIG_OPTIONS, 162 MGMT_EV_EXT_INDEX_ADDED, 163 MGMT_EV_EXT_INDEX_REMOVED, 164 MGMT_EV_LOCAL_OOB_DATA_UPDATED, 165 MGMT_EV_ADVERTISING_ADDED, 166 MGMT_EV_ADVERTISING_REMOVED, 167 MGMT_EV_EXT_INFO_CHANGED, 168 MGMT_EV_PHY_CONFIGURATION_CHANGED, 169 MGMT_EV_EXP_FEATURE_CHANGED, 170 MGMT_EV_DEVICE_FLAGS_CHANGED, 171 MGMT_EV_ADV_MONITOR_ADDED, 172 MGMT_EV_ADV_MONITOR_REMOVED, 173 MGMT_EV_CONTROLLER_SUSPEND, 174 MGMT_EV_CONTROLLER_RESUME, 175 }; 176 177 static const u16 mgmt_untrusted_commands[] = { 178 MGMT_OP_READ_INDEX_LIST, 179 MGMT_OP_READ_INFO, 180 MGMT_OP_READ_UNCONF_INDEX_LIST, 181 MGMT_OP_READ_CONFIG_INFO, 182 MGMT_OP_READ_EXT_INDEX_LIST, 183 MGMT_OP_READ_EXT_INFO, 184 MGMT_OP_READ_CONTROLLER_CAP, 185 MGMT_OP_READ_EXP_FEATURES_INFO, 186 MGMT_OP_READ_DEF_SYSTEM_CONFIG, 187 MGMT_OP_READ_DEF_RUNTIME_CONFIG, 188 }; 189 190 static const u16 mgmt_untrusted_events[] = { 191 MGMT_EV_INDEX_ADDED, 192 MGMT_EV_INDEX_REMOVED, 193 MGMT_EV_NEW_SETTINGS, 194 MGMT_EV_CLASS_OF_DEV_CHANGED, 195 MGMT_EV_LOCAL_NAME_CHANGED, 196 MGMT_EV_UNCONF_INDEX_ADDED, 197 MGMT_EV_UNCONF_INDEX_REMOVED, 198 MGMT_EV_NEW_CONFIG_OPTIONS, 199 MGMT_EV_EXT_INDEX_ADDED, 200 MGMT_EV_EXT_INDEX_REMOVED, 201 MGMT_EV_EXT_INFO_CHANGED, 202 MGMT_EV_EXP_FEATURE_CHANGED, 203 }; 204 205 #define CACHE_TIMEOUT msecs_to_jiffies(2 * 1000) 206 207 #define ZERO_KEY "\x00\x00\x00\x00\x00\x00\x00\x00" \ 208 "\x00\x00\x00\x00\x00\x00\x00\x00" 209 210 /* HCI to MGMT error code conversion table */ 211 static const u8 mgmt_status_table[] = { 212 MGMT_STATUS_SUCCESS, 213 MGMT_STATUS_UNKNOWN_COMMAND, /* Unknown Command */ 214 MGMT_STATUS_NOT_CONNECTED, /* No Connection */ 215 MGMT_STATUS_FAILED, /* Hardware Failure */ 216 MGMT_STATUS_CONNECT_FAILED, /* Page Timeout */ 217 MGMT_STATUS_AUTH_FAILED, /* Authentication Failed */ 218 MGMT_STATUS_AUTH_FAILED, /* PIN or Key Missing */ 219 MGMT_STATUS_NO_RESOURCES, /* Memory Full */ 220 MGMT_STATUS_TIMEOUT, /* Connection Timeout */ 221 MGMT_STATUS_NO_RESOURCES, /* Max Number of Connections */ 222 MGMT_STATUS_NO_RESOURCES, /* Max Number of SCO Connections */ 223 MGMT_STATUS_ALREADY_CONNECTED, /* ACL Connection Exists */ 224 MGMT_STATUS_BUSY, /* Command Disallowed */ 225 MGMT_STATUS_NO_RESOURCES, /* Rejected Limited Resources */ 226 MGMT_STATUS_REJECTED, /* Rejected Security */ 227 MGMT_STATUS_REJECTED, /* Rejected Personal */ 228 MGMT_STATUS_TIMEOUT, /* Host Timeout */ 229 MGMT_STATUS_NOT_SUPPORTED, /* Unsupported Feature */ 230 MGMT_STATUS_INVALID_PARAMS, /* Invalid Parameters */ 231 MGMT_STATUS_DISCONNECTED, /* OE User Ended Connection */ 232 MGMT_STATUS_NO_RESOURCES, /* OE Low Resources */ 233 MGMT_STATUS_DISCONNECTED, /* OE Power Off */ 234 MGMT_STATUS_DISCONNECTED, /* Connection Terminated */ 235 MGMT_STATUS_BUSY, /* Repeated Attempts */ 236 MGMT_STATUS_REJECTED, /* Pairing Not Allowed */ 237 MGMT_STATUS_FAILED, /* Unknown LMP PDU */ 238 MGMT_STATUS_NOT_SUPPORTED, /* Unsupported Remote Feature */ 239 MGMT_STATUS_REJECTED, /* SCO Offset Rejected */ 240 MGMT_STATUS_REJECTED, /* SCO Interval Rejected */ 241 MGMT_STATUS_REJECTED, /* Air Mode Rejected */ 242 MGMT_STATUS_INVALID_PARAMS, /* Invalid LMP Parameters */ 243 MGMT_STATUS_FAILED, /* Unspecified Error */ 244 MGMT_STATUS_NOT_SUPPORTED, /* Unsupported LMP Parameter Value */ 245 MGMT_STATUS_FAILED, /* Role Change Not Allowed */ 246 MGMT_STATUS_TIMEOUT, /* LMP Response Timeout */ 247 MGMT_STATUS_FAILED, /* LMP Error Transaction Collision */ 248 MGMT_STATUS_FAILED, /* LMP PDU Not Allowed */ 249 MGMT_STATUS_REJECTED, /* Encryption Mode Not Accepted */ 250 MGMT_STATUS_FAILED, /* Unit Link Key Used */ 251 MGMT_STATUS_NOT_SUPPORTED, /* QoS Not Supported */ 252 MGMT_STATUS_TIMEOUT, /* Instant Passed */ 253 MGMT_STATUS_NOT_SUPPORTED, /* Pairing Not Supported */ 254 MGMT_STATUS_FAILED, /* Transaction Collision */ 255 MGMT_STATUS_FAILED, /* Reserved for future use */ 256 MGMT_STATUS_INVALID_PARAMS, /* Unacceptable Parameter */ 257 MGMT_STATUS_REJECTED, /* QoS Rejected */ 258 MGMT_STATUS_NOT_SUPPORTED, /* Classification Not Supported */ 259 MGMT_STATUS_REJECTED, /* Insufficient Security */ 260 MGMT_STATUS_INVALID_PARAMS, /* Parameter Out Of Range */ 261 MGMT_STATUS_FAILED, /* Reserved for future use */ 262 MGMT_STATUS_BUSY, /* Role Switch Pending */ 263 MGMT_STATUS_FAILED, /* Reserved for future use */ 264 MGMT_STATUS_FAILED, /* Slot Violation */ 265 MGMT_STATUS_FAILED, /* Role Switch Failed */ 266 MGMT_STATUS_INVALID_PARAMS, /* EIR Too Large */ 267 MGMT_STATUS_NOT_SUPPORTED, /* Simple Pairing Not Supported */ 268 MGMT_STATUS_BUSY, /* Host Busy Pairing */ 269 MGMT_STATUS_REJECTED, /* Rejected, No Suitable Channel */ 270 MGMT_STATUS_BUSY, /* Controller Busy */ 271 MGMT_STATUS_INVALID_PARAMS, /* Unsuitable Connection Interval */ 272 MGMT_STATUS_TIMEOUT, /* Directed Advertising Timeout */ 273 MGMT_STATUS_AUTH_FAILED, /* Terminated Due to MIC Failure */ 274 MGMT_STATUS_CONNECT_FAILED, /* Connection Establishment Failed */ 275 MGMT_STATUS_CONNECT_FAILED, /* MAC Connection Failed */ 276 }; 277 278 static u8 mgmt_status(u8 hci_status) 279 { 280 if (hci_status < ARRAY_SIZE(mgmt_status_table)) 281 return mgmt_status_table[hci_status]; 282 283 return MGMT_STATUS_FAILED; 284 } 285 286 static int mgmt_index_event(u16 event, struct hci_dev *hdev, void *data, 287 u16 len, int flag) 288 { 289 return mgmt_send_event(event, hdev, HCI_CHANNEL_CONTROL, data, len, 290 flag, NULL); 291 } 292 293 static int mgmt_limited_event(u16 event, struct hci_dev *hdev, void *data, 294 u16 len, int flag, struct sock *skip_sk) 295 { 296 return mgmt_send_event(event, hdev, HCI_CHANNEL_CONTROL, data, len, 297 flag, skip_sk); 298 } 299 300 static int mgmt_event(u16 event, struct hci_dev *hdev, void *data, u16 len, 301 struct sock *skip_sk) 302 { 303 return mgmt_send_event(event, hdev, HCI_CHANNEL_CONTROL, data, len, 304 HCI_SOCK_TRUSTED, skip_sk); 305 } 306 307 static u8 le_addr_type(u8 mgmt_addr_type) 308 { 309 if (mgmt_addr_type == BDADDR_LE_PUBLIC) 310 return ADDR_LE_DEV_PUBLIC; 311 else 312 return ADDR_LE_DEV_RANDOM; 313 } 314 315 void mgmt_fill_version_info(void *ver) 316 { 317 struct mgmt_rp_read_version *rp = ver; 318 319 rp->version = MGMT_VERSION; 320 rp->revision = cpu_to_le16(MGMT_REVISION); 321 } 322 323 static int read_version(struct sock *sk, struct hci_dev *hdev, void *data, 324 u16 data_len) 325 { 326 struct mgmt_rp_read_version rp; 327 328 bt_dev_dbg(hdev, "sock %p", sk); 329 330 mgmt_fill_version_info(&rp); 331 332 return mgmt_cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_VERSION, 0, 333 &rp, sizeof(rp)); 334 } 335 336 static int read_commands(struct sock *sk, struct hci_dev *hdev, void *data, 337 u16 data_len) 338 { 339 struct mgmt_rp_read_commands *rp; 340 u16 num_commands, num_events; 341 size_t rp_size; 342 int i, err; 343 344 bt_dev_dbg(hdev, "sock %p", sk); 345 346 if (hci_sock_test_flag(sk, HCI_SOCK_TRUSTED)) { 347 num_commands = ARRAY_SIZE(mgmt_commands); 348 num_events = ARRAY_SIZE(mgmt_events); 349 } else { 350 num_commands = ARRAY_SIZE(mgmt_untrusted_commands); 351 num_events = ARRAY_SIZE(mgmt_untrusted_events); 352 } 353 354 rp_size = sizeof(*rp) + ((num_commands + num_events) * sizeof(u16)); 355 356 rp = kmalloc(rp_size, GFP_KERNEL); 357 if (!rp) 358 return -ENOMEM; 359 360 rp->num_commands = cpu_to_le16(num_commands); 361 rp->num_events = cpu_to_le16(num_events); 362 363 if (hci_sock_test_flag(sk, HCI_SOCK_TRUSTED)) { 364 __le16 *opcode = rp->opcodes; 365 366 for (i = 0; i < num_commands; i++, opcode++) 367 put_unaligned_le16(mgmt_commands[i], opcode); 368 369 for (i = 0; i < num_events; i++, opcode++) 370 put_unaligned_le16(mgmt_events[i], opcode); 371 } else { 372 __le16 *opcode = rp->opcodes; 373 374 for (i = 0; i < num_commands; i++, opcode++) 375 put_unaligned_le16(mgmt_untrusted_commands[i], opcode); 376 377 for (i = 0; i < num_events; i++, opcode++) 378 put_unaligned_le16(mgmt_untrusted_events[i], opcode); 379 } 380 381 err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_COMMANDS, 0, 382 rp, rp_size); 383 kfree(rp); 384 385 return err; 386 } 387 388 static int read_index_list(struct sock *sk, struct hci_dev *hdev, void *data, 389 u16 data_len) 390 { 391 struct mgmt_rp_read_index_list *rp; 392 struct hci_dev *d; 393 size_t rp_len; 394 u16 count; 395 int err; 396 397 bt_dev_dbg(hdev, "sock %p", sk); 398 399 read_lock(&hci_dev_list_lock); 400 401 count = 0; 402 list_for_each_entry(d, &hci_dev_list, list) { 403 if (d->dev_type == HCI_PRIMARY && 404 !hci_dev_test_flag(d, HCI_UNCONFIGURED)) 405 count++; 406 } 407 408 rp_len = sizeof(*rp) + (2 * count); 409 rp = kmalloc(rp_len, GFP_ATOMIC); 410 if (!rp) { 411 read_unlock(&hci_dev_list_lock); 412 return -ENOMEM; 413 } 414 415 count = 0; 416 list_for_each_entry(d, &hci_dev_list, list) { 417 if (hci_dev_test_flag(d, HCI_SETUP) || 418 hci_dev_test_flag(d, HCI_CONFIG) || 419 hci_dev_test_flag(d, HCI_USER_CHANNEL)) 420 continue; 421 422 /* Devices marked as raw-only are neither configured 423 * nor unconfigured controllers. 424 */ 425 if (test_bit(HCI_QUIRK_RAW_DEVICE, &d->quirks)) 426 continue; 427 428 if (d->dev_type == HCI_PRIMARY && 429 !hci_dev_test_flag(d, HCI_UNCONFIGURED)) { 430 rp->index[count++] = cpu_to_le16(d->id); 431 bt_dev_dbg(hdev, "Added hci%u", d->id); 432 } 433 } 434 435 rp->num_controllers = cpu_to_le16(count); 436 rp_len = sizeof(*rp) + (2 * count); 437 438 read_unlock(&hci_dev_list_lock); 439 440 err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_INDEX_LIST, 441 0, rp, rp_len); 442 443 kfree(rp); 444 445 return err; 446 } 447 448 static int read_unconf_index_list(struct sock *sk, struct hci_dev *hdev, 449 void *data, u16 data_len) 450 { 451 struct mgmt_rp_read_unconf_index_list *rp; 452 struct hci_dev *d; 453 size_t rp_len; 454 u16 count; 455 int err; 456 457 bt_dev_dbg(hdev, "sock %p", sk); 458 459 read_lock(&hci_dev_list_lock); 460 461 count = 0; 462 list_for_each_entry(d, &hci_dev_list, list) { 463 if (d->dev_type == HCI_PRIMARY && 464 hci_dev_test_flag(d, HCI_UNCONFIGURED)) 465 count++; 466 } 467 468 rp_len = sizeof(*rp) + (2 * count); 469 rp = kmalloc(rp_len, GFP_ATOMIC); 470 if (!rp) { 471 read_unlock(&hci_dev_list_lock); 472 return -ENOMEM; 473 } 474 475 count = 0; 476 list_for_each_entry(d, &hci_dev_list, list) { 477 if (hci_dev_test_flag(d, HCI_SETUP) || 478 hci_dev_test_flag(d, HCI_CONFIG) || 479 hci_dev_test_flag(d, HCI_USER_CHANNEL)) 480 continue; 481 482 /* Devices marked as raw-only are neither configured 483 * nor unconfigured controllers. 484 */ 485 if (test_bit(HCI_QUIRK_RAW_DEVICE, &d->quirks)) 486 continue; 487 488 if (d->dev_type == HCI_PRIMARY && 489 hci_dev_test_flag(d, HCI_UNCONFIGURED)) { 490 rp->index[count++] = cpu_to_le16(d->id); 491 bt_dev_dbg(hdev, "Added hci%u", d->id); 492 } 493 } 494 495 rp->num_controllers = cpu_to_le16(count); 496 rp_len = sizeof(*rp) + (2 * count); 497 498 read_unlock(&hci_dev_list_lock); 499 500 err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE, 501 MGMT_OP_READ_UNCONF_INDEX_LIST, 0, rp, rp_len); 502 503 kfree(rp); 504 505 return err; 506 } 507 508 static int read_ext_index_list(struct sock *sk, struct hci_dev *hdev, 509 void *data, u16 data_len) 510 { 511 struct mgmt_rp_read_ext_index_list *rp; 512 struct hci_dev *d; 513 u16 count; 514 int err; 515 516 bt_dev_dbg(hdev, "sock %p", sk); 517 518 read_lock(&hci_dev_list_lock); 519 520 count = 0; 521 list_for_each_entry(d, &hci_dev_list, list) { 522 if (d->dev_type == HCI_PRIMARY || d->dev_type == HCI_AMP) 523 count++; 524 } 525 526 rp = kmalloc(struct_size(rp, entry, count), GFP_ATOMIC); 527 if (!rp) { 528 read_unlock(&hci_dev_list_lock); 529 return -ENOMEM; 530 } 531 532 count = 0; 533 list_for_each_entry(d, &hci_dev_list, list) { 534 if (hci_dev_test_flag(d, HCI_SETUP) || 535 hci_dev_test_flag(d, HCI_CONFIG) || 536 hci_dev_test_flag(d, HCI_USER_CHANNEL)) 537 continue; 538 539 /* Devices marked as raw-only are neither configured 540 * nor unconfigured controllers. 541 */ 542 if (test_bit(HCI_QUIRK_RAW_DEVICE, &d->quirks)) 543 continue; 544 545 if (d->dev_type == HCI_PRIMARY) { 546 if (hci_dev_test_flag(d, HCI_UNCONFIGURED)) 547 rp->entry[count].type = 0x01; 548 else 549 rp->entry[count].type = 0x00; 550 } else if (d->dev_type == HCI_AMP) { 551 rp->entry[count].type = 0x02; 552 } else { 553 continue; 554 } 555 556 rp->entry[count].bus = d->bus; 557 rp->entry[count++].index = cpu_to_le16(d->id); 558 bt_dev_dbg(hdev, "Added hci%u", d->id); 559 } 560 561 rp->num_controllers = cpu_to_le16(count); 562 563 read_unlock(&hci_dev_list_lock); 564 565 /* If this command is called at least once, then all the 566 * default index and unconfigured index events are disabled 567 * and from now on only extended index events are used. 568 */ 569 hci_sock_set_flag(sk, HCI_MGMT_EXT_INDEX_EVENTS); 570 hci_sock_clear_flag(sk, HCI_MGMT_INDEX_EVENTS); 571 hci_sock_clear_flag(sk, HCI_MGMT_UNCONF_INDEX_EVENTS); 572 573 err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE, 574 MGMT_OP_READ_EXT_INDEX_LIST, 0, rp, 575 struct_size(rp, entry, count)); 576 577 kfree(rp); 578 579 return err; 580 } 581 582 static bool is_configured(struct hci_dev *hdev) 583 { 584 if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks) && 585 !hci_dev_test_flag(hdev, HCI_EXT_CONFIGURED)) 586 return false; 587 588 if ((test_bit(HCI_QUIRK_INVALID_BDADDR, &hdev->quirks) || 589 test_bit(HCI_QUIRK_USE_BDADDR_PROPERTY, &hdev->quirks)) && 590 !bacmp(&hdev->public_addr, BDADDR_ANY)) 591 return false; 592 593 return true; 594 } 595 596 static __le32 get_missing_options(struct hci_dev *hdev) 597 { 598 u32 options = 0; 599 600 if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks) && 601 !hci_dev_test_flag(hdev, HCI_EXT_CONFIGURED)) 602 options |= MGMT_OPTION_EXTERNAL_CONFIG; 603 604 if ((test_bit(HCI_QUIRK_INVALID_BDADDR, &hdev->quirks) || 605 test_bit(HCI_QUIRK_USE_BDADDR_PROPERTY, &hdev->quirks)) && 606 !bacmp(&hdev->public_addr, BDADDR_ANY)) 607 options |= MGMT_OPTION_PUBLIC_ADDRESS; 608 609 return cpu_to_le32(options); 610 } 611 612 static int new_options(struct hci_dev *hdev, struct sock *skip) 613 { 614 __le32 options = get_missing_options(hdev); 615 616 return mgmt_limited_event(MGMT_EV_NEW_CONFIG_OPTIONS, hdev, &options, 617 sizeof(options), HCI_MGMT_OPTION_EVENTS, skip); 618 } 619 620 static int send_options_rsp(struct sock *sk, u16 opcode, struct hci_dev *hdev) 621 { 622 __le32 options = get_missing_options(hdev); 623 624 return mgmt_cmd_complete(sk, hdev->id, opcode, 0, &options, 625 sizeof(options)); 626 } 627 628 static int read_config_info(struct sock *sk, struct hci_dev *hdev, 629 void *data, u16 data_len) 630 { 631 struct mgmt_rp_read_config_info rp; 632 u32 options = 0; 633 634 bt_dev_dbg(hdev, "sock %p", sk); 635 636 hci_dev_lock(hdev); 637 638 memset(&rp, 0, sizeof(rp)); 639 rp.manufacturer = cpu_to_le16(hdev->manufacturer); 640 641 if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks)) 642 options |= MGMT_OPTION_EXTERNAL_CONFIG; 643 644 if (hdev->set_bdaddr) 645 options |= MGMT_OPTION_PUBLIC_ADDRESS; 646 647 rp.supported_options = cpu_to_le32(options); 648 rp.missing_options = get_missing_options(hdev); 649 650 hci_dev_unlock(hdev); 651 652 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_CONFIG_INFO, 0, 653 &rp, sizeof(rp)); 654 } 655 656 static u32 get_supported_phys(struct hci_dev *hdev) 657 { 658 u32 supported_phys = 0; 659 660 if (lmp_bredr_capable(hdev)) { 661 supported_phys |= MGMT_PHY_BR_1M_1SLOT; 662 663 if (hdev->features[0][0] & LMP_3SLOT) 664 supported_phys |= MGMT_PHY_BR_1M_3SLOT; 665 666 if (hdev->features[0][0] & LMP_5SLOT) 667 supported_phys |= MGMT_PHY_BR_1M_5SLOT; 668 669 if (lmp_edr_2m_capable(hdev)) { 670 supported_phys |= MGMT_PHY_EDR_2M_1SLOT; 671 672 if (lmp_edr_3slot_capable(hdev)) 673 supported_phys |= MGMT_PHY_EDR_2M_3SLOT; 674 675 if (lmp_edr_5slot_capable(hdev)) 676 supported_phys |= MGMT_PHY_EDR_2M_5SLOT; 677 678 if (lmp_edr_3m_capable(hdev)) { 679 supported_phys |= MGMT_PHY_EDR_3M_1SLOT; 680 681 if (lmp_edr_3slot_capable(hdev)) 682 supported_phys |= MGMT_PHY_EDR_3M_3SLOT; 683 684 if (lmp_edr_5slot_capable(hdev)) 685 supported_phys |= MGMT_PHY_EDR_3M_5SLOT; 686 } 687 } 688 } 689 690 if (lmp_le_capable(hdev)) { 691 supported_phys |= MGMT_PHY_LE_1M_TX; 692 supported_phys |= MGMT_PHY_LE_1M_RX; 693 694 if (hdev->le_features[1] & HCI_LE_PHY_2M) { 695 supported_phys |= MGMT_PHY_LE_2M_TX; 696 supported_phys |= MGMT_PHY_LE_2M_RX; 697 } 698 699 if (hdev->le_features[1] & HCI_LE_PHY_CODED) { 700 supported_phys |= MGMT_PHY_LE_CODED_TX; 701 supported_phys |= MGMT_PHY_LE_CODED_RX; 702 } 703 } 704 705 return supported_phys; 706 } 707 708 static u32 get_selected_phys(struct hci_dev *hdev) 709 { 710 u32 selected_phys = 0; 711 712 if (lmp_bredr_capable(hdev)) { 713 selected_phys |= MGMT_PHY_BR_1M_1SLOT; 714 715 if (hdev->pkt_type & (HCI_DM3 | HCI_DH3)) 716 selected_phys |= MGMT_PHY_BR_1M_3SLOT; 717 718 if (hdev->pkt_type & (HCI_DM5 | HCI_DH5)) 719 selected_phys |= MGMT_PHY_BR_1M_5SLOT; 720 721 if (lmp_edr_2m_capable(hdev)) { 722 if (!(hdev->pkt_type & HCI_2DH1)) 723 selected_phys |= MGMT_PHY_EDR_2M_1SLOT; 724 725 if (lmp_edr_3slot_capable(hdev) && 726 !(hdev->pkt_type & HCI_2DH3)) 727 selected_phys |= MGMT_PHY_EDR_2M_3SLOT; 728 729 if (lmp_edr_5slot_capable(hdev) && 730 !(hdev->pkt_type & HCI_2DH5)) 731 selected_phys |= MGMT_PHY_EDR_2M_5SLOT; 732 733 if (lmp_edr_3m_capable(hdev)) { 734 if (!(hdev->pkt_type & HCI_3DH1)) 735 selected_phys |= MGMT_PHY_EDR_3M_1SLOT; 736 737 if (lmp_edr_3slot_capable(hdev) && 738 !(hdev->pkt_type & HCI_3DH3)) 739 selected_phys |= MGMT_PHY_EDR_3M_3SLOT; 740 741 if (lmp_edr_5slot_capable(hdev) && 742 !(hdev->pkt_type & HCI_3DH5)) 743 selected_phys |= MGMT_PHY_EDR_3M_5SLOT; 744 } 745 } 746 } 747 748 if (lmp_le_capable(hdev)) { 749 if (hdev->le_tx_def_phys & HCI_LE_SET_PHY_1M) 750 selected_phys |= MGMT_PHY_LE_1M_TX; 751 752 if (hdev->le_rx_def_phys & HCI_LE_SET_PHY_1M) 753 selected_phys |= MGMT_PHY_LE_1M_RX; 754 755 if (hdev->le_tx_def_phys & HCI_LE_SET_PHY_2M) 756 selected_phys |= MGMT_PHY_LE_2M_TX; 757 758 if (hdev->le_rx_def_phys & HCI_LE_SET_PHY_2M) 759 selected_phys |= MGMT_PHY_LE_2M_RX; 760 761 if (hdev->le_tx_def_phys & HCI_LE_SET_PHY_CODED) 762 selected_phys |= MGMT_PHY_LE_CODED_TX; 763 764 if (hdev->le_rx_def_phys & HCI_LE_SET_PHY_CODED) 765 selected_phys |= MGMT_PHY_LE_CODED_RX; 766 } 767 768 return selected_phys; 769 } 770 771 static u32 get_configurable_phys(struct hci_dev *hdev) 772 { 773 return (get_supported_phys(hdev) & ~MGMT_PHY_BR_1M_1SLOT & 774 ~MGMT_PHY_LE_1M_TX & ~MGMT_PHY_LE_1M_RX); 775 } 776 777 static u32 get_supported_settings(struct hci_dev *hdev) 778 { 779 u32 settings = 0; 780 781 settings |= MGMT_SETTING_POWERED; 782 settings |= MGMT_SETTING_BONDABLE; 783 settings |= MGMT_SETTING_DEBUG_KEYS; 784 settings |= MGMT_SETTING_CONNECTABLE; 785 settings |= MGMT_SETTING_DISCOVERABLE; 786 787 if (lmp_bredr_capable(hdev)) { 788 if (hdev->hci_ver >= BLUETOOTH_VER_1_2) 789 settings |= MGMT_SETTING_FAST_CONNECTABLE; 790 settings |= MGMT_SETTING_BREDR; 791 settings |= MGMT_SETTING_LINK_SECURITY; 792 793 if (lmp_ssp_capable(hdev)) { 794 settings |= MGMT_SETTING_SSP; 795 if (IS_ENABLED(CONFIG_BT_HS)) 796 settings |= MGMT_SETTING_HS; 797 } 798 799 if (lmp_sc_capable(hdev)) 800 settings |= MGMT_SETTING_SECURE_CONN; 801 802 if (test_bit(HCI_QUIRK_WIDEBAND_SPEECH_SUPPORTED, 803 &hdev->quirks)) 804 settings |= MGMT_SETTING_WIDEBAND_SPEECH; 805 } 806 807 if (lmp_le_capable(hdev)) { 808 settings |= MGMT_SETTING_LE; 809 settings |= MGMT_SETTING_SECURE_CONN; 810 settings |= MGMT_SETTING_PRIVACY; 811 settings |= MGMT_SETTING_STATIC_ADDRESS; 812 813 /* When the experimental feature for LL Privacy support is 814 * enabled, then advertising is no longer supported. 815 */ 816 if (!hci_dev_test_flag(hdev, HCI_ENABLE_LL_PRIVACY)) 817 settings |= MGMT_SETTING_ADVERTISING; 818 } 819 820 if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks) || 821 hdev->set_bdaddr) 822 settings |= MGMT_SETTING_CONFIGURATION; 823 824 settings |= MGMT_SETTING_PHY_CONFIGURATION; 825 826 return settings; 827 } 828 829 static u32 get_current_settings(struct hci_dev *hdev) 830 { 831 u32 settings = 0; 832 833 if (hdev_is_powered(hdev)) 834 settings |= MGMT_SETTING_POWERED; 835 836 if (hci_dev_test_flag(hdev, HCI_CONNECTABLE)) 837 settings |= MGMT_SETTING_CONNECTABLE; 838 839 if (hci_dev_test_flag(hdev, HCI_FAST_CONNECTABLE)) 840 settings |= MGMT_SETTING_FAST_CONNECTABLE; 841 842 if (hci_dev_test_flag(hdev, HCI_DISCOVERABLE)) 843 settings |= MGMT_SETTING_DISCOVERABLE; 844 845 if (hci_dev_test_flag(hdev, HCI_BONDABLE)) 846 settings |= MGMT_SETTING_BONDABLE; 847 848 if (hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) 849 settings |= MGMT_SETTING_BREDR; 850 851 if (hci_dev_test_flag(hdev, HCI_LE_ENABLED)) 852 settings |= MGMT_SETTING_LE; 853 854 if (hci_dev_test_flag(hdev, HCI_LINK_SECURITY)) 855 settings |= MGMT_SETTING_LINK_SECURITY; 856 857 if (hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) 858 settings |= MGMT_SETTING_SSP; 859 860 if (hci_dev_test_flag(hdev, HCI_HS_ENABLED)) 861 settings |= MGMT_SETTING_HS; 862 863 if (hci_dev_test_flag(hdev, HCI_ADVERTISING)) 864 settings |= MGMT_SETTING_ADVERTISING; 865 866 if (hci_dev_test_flag(hdev, HCI_SC_ENABLED)) 867 settings |= MGMT_SETTING_SECURE_CONN; 868 869 if (hci_dev_test_flag(hdev, HCI_KEEP_DEBUG_KEYS)) 870 settings |= MGMT_SETTING_DEBUG_KEYS; 871 872 if (hci_dev_test_flag(hdev, HCI_PRIVACY)) 873 settings |= MGMT_SETTING_PRIVACY; 874 875 /* The current setting for static address has two purposes. The 876 * first is to indicate if the static address will be used and 877 * the second is to indicate if it is actually set. 878 * 879 * This means if the static address is not configured, this flag 880 * will never be set. If the address is configured, then if the 881 * address is actually used decides if the flag is set or not. 882 * 883 * For single mode LE only controllers and dual-mode controllers 884 * with BR/EDR disabled, the existence of the static address will 885 * be evaluated. 886 */ 887 if (hci_dev_test_flag(hdev, HCI_FORCE_STATIC_ADDR) || 888 !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) || 889 !bacmp(&hdev->bdaddr, BDADDR_ANY)) { 890 if (bacmp(&hdev->static_addr, BDADDR_ANY)) 891 settings |= MGMT_SETTING_STATIC_ADDRESS; 892 } 893 894 if (hci_dev_test_flag(hdev, HCI_WIDEBAND_SPEECH_ENABLED)) 895 settings |= MGMT_SETTING_WIDEBAND_SPEECH; 896 897 return settings; 898 } 899 900 static struct mgmt_pending_cmd *pending_find(u16 opcode, struct hci_dev *hdev) 901 { 902 return mgmt_pending_find(HCI_CHANNEL_CONTROL, opcode, hdev); 903 } 904 905 static struct mgmt_pending_cmd *pending_find_data(u16 opcode, 906 struct hci_dev *hdev, 907 const void *data) 908 { 909 return mgmt_pending_find_data(HCI_CHANNEL_CONTROL, opcode, hdev, data); 910 } 911 912 u8 mgmt_get_adv_discov_flags(struct hci_dev *hdev) 913 { 914 struct mgmt_pending_cmd *cmd; 915 916 /* If there's a pending mgmt command the flags will not yet have 917 * their final values, so check for this first. 918 */ 919 cmd = pending_find(MGMT_OP_SET_DISCOVERABLE, hdev); 920 if (cmd) { 921 struct mgmt_mode *cp = cmd->param; 922 if (cp->val == 0x01) 923 return LE_AD_GENERAL; 924 else if (cp->val == 0x02) 925 return LE_AD_LIMITED; 926 } else { 927 if (hci_dev_test_flag(hdev, HCI_LIMITED_DISCOVERABLE)) 928 return LE_AD_LIMITED; 929 else if (hci_dev_test_flag(hdev, HCI_DISCOVERABLE)) 930 return LE_AD_GENERAL; 931 } 932 933 return 0; 934 } 935 936 bool mgmt_get_connectable(struct hci_dev *hdev) 937 { 938 struct mgmt_pending_cmd *cmd; 939 940 /* If there's a pending mgmt command the flag will not yet have 941 * it's final value, so check for this first. 942 */ 943 cmd = pending_find(MGMT_OP_SET_CONNECTABLE, hdev); 944 if (cmd) { 945 struct mgmt_mode *cp = cmd->param; 946 947 return cp->val; 948 } 949 950 return hci_dev_test_flag(hdev, HCI_CONNECTABLE); 951 } 952 953 static void service_cache_off(struct work_struct *work) 954 { 955 struct hci_dev *hdev = container_of(work, struct hci_dev, 956 service_cache.work); 957 struct hci_request req; 958 959 if (!hci_dev_test_and_clear_flag(hdev, HCI_SERVICE_CACHE)) 960 return; 961 962 hci_req_init(&req, hdev); 963 964 hci_dev_lock(hdev); 965 966 __hci_req_update_eir(&req); 967 __hci_req_update_class(&req); 968 969 hci_dev_unlock(hdev); 970 971 hci_req_run(&req, NULL); 972 } 973 974 static void rpa_expired(struct work_struct *work) 975 { 976 struct hci_dev *hdev = container_of(work, struct hci_dev, 977 rpa_expired.work); 978 struct hci_request req; 979 980 bt_dev_dbg(hdev, ""); 981 982 hci_dev_set_flag(hdev, HCI_RPA_EXPIRED); 983 984 if (!hci_dev_test_flag(hdev, HCI_ADVERTISING)) 985 return; 986 987 /* The generation of a new RPA and programming it into the 988 * controller happens in the hci_req_enable_advertising() 989 * function. 990 */ 991 hci_req_init(&req, hdev); 992 if (ext_adv_capable(hdev)) 993 __hci_req_start_ext_adv(&req, hdev->cur_adv_instance); 994 else 995 __hci_req_enable_advertising(&req); 996 hci_req_run(&req, NULL); 997 } 998 999 static void mgmt_init_hdev(struct sock *sk, struct hci_dev *hdev) 1000 { 1001 if (hci_dev_test_and_set_flag(hdev, HCI_MGMT)) 1002 return; 1003 1004 INIT_DELAYED_WORK(&hdev->service_cache, service_cache_off); 1005 INIT_DELAYED_WORK(&hdev->rpa_expired, rpa_expired); 1006 1007 /* Non-mgmt controlled devices get this bit set 1008 * implicitly so that pairing works for them, however 1009 * for mgmt we require user-space to explicitly enable 1010 * it 1011 */ 1012 hci_dev_clear_flag(hdev, HCI_BONDABLE); 1013 } 1014 1015 static int read_controller_info(struct sock *sk, struct hci_dev *hdev, 1016 void *data, u16 data_len) 1017 { 1018 struct mgmt_rp_read_info rp; 1019 1020 bt_dev_dbg(hdev, "sock %p", sk); 1021 1022 hci_dev_lock(hdev); 1023 1024 memset(&rp, 0, sizeof(rp)); 1025 1026 bacpy(&rp.bdaddr, &hdev->bdaddr); 1027 1028 rp.version = hdev->hci_ver; 1029 rp.manufacturer = cpu_to_le16(hdev->manufacturer); 1030 1031 rp.supported_settings = cpu_to_le32(get_supported_settings(hdev)); 1032 rp.current_settings = cpu_to_le32(get_current_settings(hdev)); 1033 1034 memcpy(rp.dev_class, hdev->dev_class, 3); 1035 1036 memcpy(rp.name, hdev->dev_name, sizeof(hdev->dev_name)); 1037 memcpy(rp.short_name, hdev->short_name, sizeof(hdev->short_name)); 1038 1039 hci_dev_unlock(hdev); 1040 1041 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_INFO, 0, &rp, 1042 sizeof(rp)); 1043 } 1044 1045 static u16 append_eir_data_to_buf(struct hci_dev *hdev, u8 *eir) 1046 { 1047 u16 eir_len = 0; 1048 size_t name_len; 1049 1050 if (hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) 1051 eir_len = eir_append_data(eir, eir_len, EIR_CLASS_OF_DEV, 1052 hdev->dev_class, 3); 1053 1054 if (hci_dev_test_flag(hdev, HCI_LE_ENABLED)) 1055 eir_len = eir_append_le16(eir, eir_len, EIR_APPEARANCE, 1056 hdev->appearance); 1057 1058 name_len = strlen(hdev->dev_name); 1059 eir_len = eir_append_data(eir, eir_len, EIR_NAME_COMPLETE, 1060 hdev->dev_name, name_len); 1061 1062 name_len = strlen(hdev->short_name); 1063 eir_len = eir_append_data(eir, eir_len, EIR_NAME_SHORT, 1064 hdev->short_name, name_len); 1065 1066 return eir_len; 1067 } 1068 1069 static int read_ext_controller_info(struct sock *sk, struct hci_dev *hdev, 1070 void *data, u16 data_len) 1071 { 1072 char buf[512]; 1073 struct mgmt_rp_read_ext_info *rp = (void *)buf; 1074 u16 eir_len; 1075 1076 bt_dev_dbg(hdev, "sock %p", sk); 1077 1078 memset(&buf, 0, sizeof(buf)); 1079 1080 hci_dev_lock(hdev); 1081 1082 bacpy(&rp->bdaddr, &hdev->bdaddr); 1083 1084 rp->version = hdev->hci_ver; 1085 rp->manufacturer = cpu_to_le16(hdev->manufacturer); 1086 1087 rp->supported_settings = cpu_to_le32(get_supported_settings(hdev)); 1088 rp->current_settings = cpu_to_le32(get_current_settings(hdev)); 1089 1090 1091 eir_len = append_eir_data_to_buf(hdev, rp->eir); 1092 rp->eir_len = cpu_to_le16(eir_len); 1093 1094 hci_dev_unlock(hdev); 1095 1096 /* If this command is called at least once, then the events 1097 * for class of device and local name changes are disabled 1098 * and only the new extended controller information event 1099 * is used. 1100 */ 1101 hci_sock_set_flag(sk, HCI_MGMT_EXT_INFO_EVENTS); 1102 hci_sock_clear_flag(sk, HCI_MGMT_DEV_CLASS_EVENTS); 1103 hci_sock_clear_flag(sk, HCI_MGMT_LOCAL_NAME_EVENTS); 1104 1105 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_EXT_INFO, 0, rp, 1106 sizeof(*rp) + eir_len); 1107 } 1108 1109 static int ext_info_changed(struct hci_dev *hdev, struct sock *skip) 1110 { 1111 char buf[512]; 1112 struct mgmt_ev_ext_info_changed *ev = (void *)buf; 1113 u16 eir_len; 1114 1115 memset(buf, 0, sizeof(buf)); 1116 1117 eir_len = append_eir_data_to_buf(hdev, ev->eir); 1118 ev->eir_len = cpu_to_le16(eir_len); 1119 1120 return mgmt_limited_event(MGMT_EV_EXT_INFO_CHANGED, hdev, ev, 1121 sizeof(*ev) + eir_len, 1122 HCI_MGMT_EXT_INFO_EVENTS, skip); 1123 } 1124 1125 static int send_settings_rsp(struct sock *sk, u16 opcode, struct hci_dev *hdev) 1126 { 1127 __le32 settings = cpu_to_le32(get_current_settings(hdev)); 1128 1129 return mgmt_cmd_complete(sk, hdev->id, opcode, 0, &settings, 1130 sizeof(settings)); 1131 } 1132 1133 static void clean_up_hci_complete(struct hci_dev *hdev, u8 status, u16 opcode) 1134 { 1135 bt_dev_dbg(hdev, "status 0x%02x", status); 1136 1137 if (hci_conn_count(hdev) == 0) { 1138 cancel_delayed_work(&hdev->power_off); 1139 queue_work(hdev->req_workqueue, &hdev->power_off.work); 1140 } 1141 } 1142 1143 void mgmt_advertising_added(struct sock *sk, struct hci_dev *hdev, u8 instance) 1144 { 1145 struct mgmt_ev_advertising_added ev; 1146 1147 ev.instance = instance; 1148 1149 mgmt_event(MGMT_EV_ADVERTISING_ADDED, hdev, &ev, sizeof(ev), sk); 1150 } 1151 1152 void mgmt_advertising_removed(struct sock *sk, struct hci_dev *hdev, 1153 u8 instance) 1154 { 1155 struct mgmt_ev_advertising_removed ev; 1156 1157 ev.instance = instance; 1158 1159 mgmt_event(MGMT_EV_ADVERTISING_REMOVED, hdev, &ev, sizeof(ev), sk); 1160 } 1161 1162 static void cancel_adv_timeout(struct hci_dev *hdev) 1163 { 1164 if (hdev->adv_instance_timeout) { 1165 hdev->adv_instance_timeout = 0; 1166 cancel_delayed_work(&hdev->adv_instance_expire); 1167 } 1168 } 1169 1170 static int clean_up_hci_state(struct hci_dev *hdev) 1171 { 1172 struct hci_request req; 1173 struct hci_conn *conn; 1174 bool discov_stopped; 1175 int err; 1176 1177 hci_req_init(&req, hdev); 1178 1179 if (test_bit(HCI_ISCAN, &hdev->flags) || 1180 test_bit(HCI_PSCAN, &hdev->flags)) { 1181 u8 scan = 0x00; 1182 hci_req_add(&req, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan); 1183 } 1184 1185 hci_req_clear_adv_instance(hdev, NULL, NULL, 0x00, false); 1186 1187 if (hci_dev_test_flag(hdev, HCI_LE_ADV)) 1188 __hci_req_disable_advertising(&req); 1189 1190 discov_stopped = hci_req_stop_discovery(&req); 1191 1192 list_for_each_entry(conn, &hdev->conn_hash.list, list) { 1193 /* 0x15 == Terminated due to Power Off */ 1194 __hci_abort_conn(&req, conn, 0x15); 1195 } 1196 1197 err = hci_req_run(&req, clean_up_hci_complete); 1198 if (!err && discov_stopped) 1199 hci_discovery_set_state(hdev, DISCOVERY_STOPPING); 1200 1201 return err; 1202 } 1203 1204 static int set_powered(struct sock *sk, struct hci_dev *hdev, void *data, 1205 u16 len) 1206 { 1207 struct mgmt_mode *cp = data; 1208 struct mgmt_pending_cmd *cmd; 1209 int err; 1210 1211 bt_dev_dbg(hdev, "sock %p", sk); 1212 1213 if (cp->val != 0x00 && cp->val != 0x01) 1214 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED, 1215 MGMT_STATUS_INVALID_PARAMS); 1216 1217 hci_dev_lock(hdev); 1218 1219 if (pending_find(MGMT_OP_SET_POWERED, hdev)) { 1220 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED, 1221 MGMT_STATUS_BUSY); 1222 goto failed; 1223 } 1224 1225 if (!!cp->val == hdev_is_powered(hdev)) { 1226 err = send_settings_rsp(sk, MGMT_OP_SET_POWERED, hdev); 1227 goto failed; 1228 } 1229 1230 cmd = mgmt_pending_add(sk, MGMT_OP_SET_POWERED, hdev, data, len); 1231 if (!cmd) { 1232 err = -ENOMEM; 1233 goto failed; 1234 } 1235 1236 if (cp->val) { 1237 queue_work(hdev->req_workqueue, &hdev->power_on); 1238 err = 0; 1239 } else { 1240 /* Disconnect connections, stop scans, etc */ 1241 err = clean_up_hci_state(hdev); 1242 if (!err) 1243 queue_delayed_work(hdev->req_workqueue, &hdev->power_off, 1244 HCI_POWER_OFF_TIMEOUT); 1245 1246 /* ENODATA means there were no HCI commands queued */ 1247 if (err == -ENODATA) { 1248 cancel_delayed_work(&hdev->power_off); 1249 queue_work(hdev->req_workqueue, &hdev->power_off.work); 1250 err = 0; 1251 } 1252 } 1253 1254 failed: 1255 hci_dev_unlock(hdev); 1256 return err; 1257 } 1258 1259 static int new_settings(struct hci_dev *hdev, struct sock *skip) 1260 { 1261 __le32 ev = cpu_to_le32(get_current_settings(hdev)); 1262 1263 return mgmt_limited_event(MGMT_EV_NEW_SETTINGS, hdev, &ev, 1264 sizeof(ev), HCI_MGMT_SETTING_EVENTS, skip); 1265 } 1266 1267 int mgmt_new_settings(struct hci_dev *hdev) 1268 { 1269 return new_settings(hdev, NULL); 1270 } 1271 1272 struct cmd_lookup { 1273 struct sock *sk; 1274 struct hci_dev *hdev; 1275 u8 mgmt_status; 1276 }; 1277 1278 static void settings_rsp(struct mgmt_pending_cmd *cmd, void *data) 1279 { 1280 struct cmd_lookup *match = data; 1281 1282 send_settings_rsp(cmd->sk, cmd->opcode, match->hdev); 1283 1284 list_del(&cmd->list); 1285 1286 if (match->sk == NULL) { 1287 match->sk = cmd->sk; 1288 sock_hold(match->sk); 1289 } 1290 1291 mgmt_pending_free(cmd); 1292 } 1293 1294 static void cmd_status_rsp(struct mgmt_pending_cmd *cmd, void *data) 1295 { 1296 u8 *status = data; 1297 1298 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, *status); 1299 mgmt_pending_remove(cmd); 1300 } 1301 1302 static void cmd_complete_rsp(struct mgmt_pending_cmd *cmd, void *data) 1303 { 1304 if (cmd->cmd_complete) { 1305 u8 *status = data; 1306 1307 cmd->cmd_complete(cmd, *status); 1308 mgmt_pending_remove(cmd); 1309 1310 return; 1311 } 1312 1313 cmd_status_rsp(cmd, data); 1314 } 1315 1316 static int generic_cmd_complete(struct mgmt_pending_cmd *cmd, u8 status) 1317 { 1318 return mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, status, 1319 cmd->param, cmd->param_len); 1320 } 1321 1322 static int addr_cmd_complete(struct mgmt_pending_cmd *cmd, u8 status) 1323 { 1324 return mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, status, 1325 cmd->param, sizeof(struct mgmt_addr_info)); 1326 } 1327 1328 static u8 mgmt_bredr_support(struct hci_dev *hdev) 1329 { 1330 if (!lmp_bredr_capable(hdev)) 1331 return MGMT_STATUS_NOT_SUPPORTED; 1332 else if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) 1333 return MGMT_STATUS_REJECTED; 1334 else 1335 return MGMT_STATUS_SUCCESS; 1336 } 1337 1338 static u8 mgmt_le_support(struct hci_dev *hdev) 1339 { 1340 if (!lmp_le_capable(hdev)) 1341 return MGMT_STATUS_NOT_SUPPORTED; 1342 else if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED)) 1343 return MGMT_STATUS_REJECTED; 1344 else 1345 return MGMT_STATUS_SUCCESS; 1346 } 1347 1348 void mgmt_set_discoverable_complete(struct hci_dev *hdev, u8 status) 1349 { 1350 struct mgmt_pending_cmd *cmd; 1351 1352 bt_dev_dbg(hdev, "status 0x%02x", status); 1353 1354 hci_dev_lock(hdev); 1355 1356 cmd = pending_find(MGMT_OP_SET_DISCOVERABLE, hdev); 1357 if (!cmd) 1358 goto unlock; 1359 1360 if (status) { 1361 u8 mgmt_err = mgmt_status(status); 1362 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err); 1363 hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE); 1364 goto remove_cmd; 1365 } 1366 1367 if (hci_dev_test_flag(hdev, HCI_DISCOVERABLE) && 1368 hdev->discov_timeout > 0) { 1369 int to = msecs_to_jiffies(hdev->discov_timeout * 1000); 1370 queue_delayed_work(hdev->req_workqueue, &hdev->discov_off, to); 1371 } 1372 1373 send_settings_rsp(cmd->sk, MGMT_OP_SET_DISCOVERABLE, hdev); 1374 new_settings(hdev, cmd->sk); 1375 1376 remove_cmd: 1377 mgmt_pending_remove(cmd); 1378 1379 unlock: 1380 hci_dev_unlock(hdev); 1381 } 1382 1383 static int set_discoverable(struct sock *sk, struct hci_dev *hdev, void *data, 1384 u16 len) 1385 { 1386 struct mgmt_cp_set_discoverable *cp = data; 1387 struct mgmt_pending_cmd *cmd; 1388 u16 timeout; 1389 int err; 1390 1391 bt_dev_dbg(hdev, "sock %p", sk); 1392 1393 if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED) && 1394 !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) 1395 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE, 1396 MGMT_STATUS_REJECTED); 1397 1398 if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02) 1399 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE, 1400 MGMT_STATUS_INVALID_PARAMS); 1401 1402 timeout = __le16_to_cpu(cp->timeout); 1403 1404 /* Disabling discoverable requires that no timeout is set, 1405 * and enabling limited discoverable requires a timeout. 1406 */ 1407 if ((cp->val == 0x00 && timeout > 0) || 1408 (cp->val == 0x02 && timeout == 0)) 1409 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE, 1410 MGMT_STATUS_INVALID_PARAMS); 1411 1412 hci_dev_lock(hdev); 1413 1414 if (!hdev_is_powered(hdev) && timeout > 0) { 1415 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE, 1416 MGMT_STATUS_NOT_POWERED); 1417 goto failed; 1418 } 1419 1420 if (pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) || 1421 pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) { 1422 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE, 1423 MGMT_STATUS_BUSY); 1424 goto failed; 1425 } 1426 1427 if (!hci_dev_test_flag(hdev, HCI_CONNECTABLE)) { 1428 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE, 1429 MGMT_STATUS_REJECTED); 1430 goto failed; 1431 } 1432 1433 if (hdev->advertising_paused) { 1434 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE, 1435 MGMT_STATUS_BUSY); 1436 goto failed; 1437 } 1438 1439 if (!hdev_is_powered(hdev)) { 1440 bool changed = false; 1441 1442 /* Setting limited discoverable when powered off is 1443 * not a valid operation since it requires a timeout 1444 * and so no need to check HCI_LIMITED_DISCOVERABLE. 1445 */ 1446 if (!!cp->val != hci_dev_test_flag(hdev, HCI_DISCOVERABLE)) { 1447 hci_dev_change_flag(hdev, HCI_DISCOVERABLE); 1448 changed = true; 1449 } 1450 1451 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev); 1452 if (err < 0) 1453 goto failed; 1454 1455 if (changed) 1456 err = new_settings(hdev, sk); 1457 1458 goto failed; 1459 } 1460 1461 /* If the current mode is the same, then just update the timeout 1462 * value with the new value. And if only the timeout gets updated, 1463 * then no need for any HCI transactions. 1464 */ 1465 if (!!cp->val == hci_dev_test_flag(hdev, HCI_DISCOVERABLE) && 1466 (cp->val == 0x02) == hci_dev_test_flag(hdev, 1467 HCI_LIMITED_DISCOVERABLE)) { 1468 cancel_delayed_work(&hdev->discov_off); 1469 hdev->discov_timeout = timeout; 1470 1471 if (cp->val && hdev->discov_timeout > 0) { 1472 int to = msecs_to_jiffies(hdev->discov_timeout * 1000); 1473 queue_delayed_work(hdev->req_workqueue, 1474 &hdev->discov_off, to); 1475 } 1476 1477 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev); 1478 goto failed; 1479 } 1480 1481 cmd = mgmt_pending_add(sk, MGMT_OP_SET_DISCOVERABLE, hdev, data, len); 1482 if (!cmd) { 1483 err = -ENOMEM; 1484 goto failed; 1485 } 1486 1487 /* Cancel any potential discoverable timeout that might be 1488 * still active and store new timeout value. The arming of 1489 * the timeout happens in the complete handler. 1490 */ 1491 cancel_delayed_work(&hdev->discov_off); 1492 hdev->discov_timeout = timeout; 1493 1494 if (cp->val) 1495 hci_dev_set_flag(hdev, HCI_DISCOVERABLE); 1496 else 1497 hci_dev_clear_flag(hdev, HCI_DISCOVERABLE); 1498 1499 /* Limited discoverable mode */ 1500 if (cp->val == 0x02) 1501 hci_dev_set_flag(hdev, HCI_LIMITED_DISCOVERABLE); 1502 else 1503 hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE); 1504 1505 queue_work(hdev->req_workqueue, &hdev->discoverable_update); 1506 err = 0; 1507 1508 failed: 1509 hci_dev_unlock(hdev); 1510 return err; 1511 } 1512 1513 void mgmt_set_connectable_complete(struct hci_dev *hdev, u8 status) 1514 { 1515 struct mgmt_pending_cmd *cmd; 1516 1517 bt_dev_dbg(hdev, "status 0x%02x", status); 1518 1519 hci_dev_lock(hdev); 1520 1521 cmd = pending_find(MGMT_OP_SET_CONNECTABLE, hdev); 1522 if (!cmd) 1523 goto unlock; 1524 1525 if (status) { 1526 u8 mgmt_err = mgmt_status(status); 1527 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err); 1528 goto remove_cmd; 1529 } 1530 1531 send_settings_rsp(cmd->sk, MGMT_OP_SET_CONNECTABLE, hdev); 1532 new_settings(hdev, cmd->sk); 1533 1534 remove_cmd: 1535 mgmt_pending_remove(cmd); 1536 1537 unlock: 1538 hci_dev_unlock(hdev); 1539 } 1540 1541 static int set_connectable_update_settings(struct hci_dev *hdev, 1542 struct sock *sk, u8 val) 1543 { 1544 bool changed = false; 1545 int err; 1546 1547 if (!!val != hci_dev_test_flag(hdev, HCI_CONNECTABLE)) 1548 changed = true; 1549 1550 if (val) { 1551 hci_dev_set_flag(hdev, HCI_CONNECTABLE); 1552 } else { 1553 hci_dev_clear_flag(hdev, HCI_CONNECTABLE); 1554 hci_dev_clear_flag(hdev, HCI_DISCOVERABLE); 1555 } 1556 1557 err = send_settings_rsp(sk, MGMT_OP_SET_CONNECTABLE, hdev); 1558 if (err < 0) 1559 return err; 1560 1561 if (changed) { 1562 hci_req_update_scan(hdev); 1563 hci_update_background_scan(hdev); 1564 return new_settings(hdev, sk); 1565 } 1566 1567 return 0; 1568 } 1569 1570 static int set_connectable(struct sock *sk, struct hci_dev *hdev, void *data, 1571 u16 len) 1572 { 1573 struct mgmt_mode *cp = data; 1574 struct mgmt_pending_cmd *cmd; 1575 int err; 1576 1577 bt_dev_dbg(hdev, "sock %p", sk); 1578 1579 if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED) && 1580 !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) 1581 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE, 1582 MGMT_STATUS_REJECTED); 1583 1584 if (cp->val != 0x00 && cp->val != 0x01) 1585 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE, 1586 MGMT_STATUS_INVALID_PARAMS); 1587 1588 hci_dev_lock(hdev); 1589 1590 if (!hdev_is_powered(hdev)) { 1591 err = set_connectable_update_settings(hdev, sk, cp->val); 1592 goto failed; 1593 } 1594 1595 if (pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) || 1596 pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) { 1597 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE, 1598 MGMT_STATUS_BUSY); 1599 goto failed; 1600 } 1601 1602 cmd = mgmt_pending_add(sk, MGMT_OP_SET_CONNECTABLE, hdev, data, len); 1603 if (!cmd) { 1604 err = -ENOMEM; 1605 goto failed; 1606 } 1607 1608 if (cp->val) { 1609 hci_dev_set_flag(hdev, HCI_CONNECTABLE); 1610 } else { 1611 if (hdev->discov_timeout > 0) 1612 cancel_delayed_work(&hdev->discov_off); 1613 1614 hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE); 1615 hci_dev_clear_flag(hdev, HCI_DISCOVERABLE); 1616 hci_dev_clear_flag(hdev, HCI_CONNECTABLE); 1617 } 1618 1619 queue_work(hdev->req_workqueue, &hdev->connectable_update); 1620 err = 0; 1621 1622 failed: 1623 hci_dev_unlock(hdev); 1624 return err; 1625 } 1626 1627 static int set_bondable(struct sock *sk, struct hci_dev *hdev, void *data, 1628 u16 len) 1629 { 1630 struct mgmt_mode *cp = data; 1631 bool changed; 1632 int err; 1633 1634 bt_dev_dbg(hdev, "sock %p", sk); 1635 1636 if (cp->val != 0x00 && cp->val != 0x01) 1637 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BONDABLE, 1638 MGMT_STATUS_INVALID_PARAMS); 1639 1640 hci_dev_lock(hdev); 1641 1642 if (cp->val) 1643 changed = !hci_dev_test_and_set_flag(hdev, HCI_BONDABLE); 1644 else 1645 changed = hci_dev_test_and_clear_flag(hdev, HCI_BONDABLE); 1646 1647 err = send_settings_rsp(sk, MGMT_OP_SET_BONDABLE, hdev); 1648 if (err < 0) 1649 goto unlock; 1650 1651 if (changed) { 1652 /* In limited privacy mode the change of bondable mode 1653 * may affect the local advertising address. 1654 */ 1655 if (hdev_is_powered(hdev) && 1656 hci_dev_test_flag(hdev, HCI_ADVERTISING) && 1657 hci_dev_test_flag(hdev, HCI_DISCOVERABLE) && 1658 hci_dev_test_flag(hdev, HCI_LIMITED_PRIVACY)) 1659 queue_work(hdev->req_workqueue, 1660 &hdev->discoverable_update); 1661 1662 err = new_settings(hdev, sk); 1663 } 1664 1665 unlock: 1666 hci_dev_unlock(hdev); 1667 return err; 1668 } 1669 1670 static int set_link_security(struct sock *sk, struct hci_dev *hdev, void *data, 1671 u16 len) 1672 { 1673 struct mgmt_mode *cp = data; 1674 struct mgmt_pending_cmd *cmd; 1675 u8 val, status; 1676 int err; 1677 1678 bt_dev_dbg(hdev, "sock %p", sk); 1679 1680 status = mgmt_bredr_support(hdev); 1681 if (status) 1682 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY, 1683 status); 1684 1685 if (cp->val != 0x00 && cp->val != 0x01) 1686 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY, 1687 MGMT_STATUS_INVALID_PARAMS); 1688 1689 hci_dev_lock(hdev); 1690 1691 if (!hdev_is_powered(hdev)) { 1692 bool changed = false; 1693 1694 if (!!cp->val != hci_dev_test_flag(hdev, HCI_LINK_SECURITY)) { 1695 hci_dev_change_flag(hdev, HCI_LINK_SECURITY); 1696 changed = true; 1697 } 1698 1699 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev); 1700 if (err < 0) 1701 goto failed; 1702 1703 if (changed) 1704 err = new_settings(hdev, sk); 1705 1706 goto failed; 1707 } 1708 1709 if (pending_find(MGMT_OP_SET_LINK_SECURITY, hdev)) { 1710 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY, 1711 MGMT_STATUS_BUSY); 1712 goto failed; 1713 } 1714 1715 val = !!cp->val; 1716 1717 if (test_bit(HCI_AUTH, &hdev->flags) == val) { 1718 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev); 1719 goto failed; 1720 } 1721 1722 cmd = mgmt_pending_add(sk, MGMT_OP_SET_LINK_SECURITY, hdev, data, len); 1723 if (!cmd) { 1724 err = -ENOMEM; 1725 goto failed; 1726 } 1727 1728 err = hci_send_cmd(hdev, HCI_OP_WRITE_AUTH_ENABLE, sizeof(val), &val); 1729 if (err < 0) { 1730 mgmt_pending_remove(cmd); 1731 goto failed; 1732 } 1733 1734 failed: 1735 hci_dev_unlock(hdev); 1736 return err; 1737 } 1738 1739 static int set_ssp(struct sock *sk, struct hci_dev *hdev, void *data, u16 len) 1740 { 1741 struct mgmt_mode *cp = data; 1742 struct mgmt_pending_cmd *cmd; 1743 u8 status; 1744 int err; 1745 1746 bt_dev_dbg(hdev, "sock %p", sk); 1747 1748 status = mgmt_bredr_support(hdev); 1749 if (status) 1750 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP, status); 1751 1752 if (!lmp_ssp_capable(hdev)) 1753 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP, 1754 MGMT_STATUS_NOT_SUPPORTED); 1755 1756 if (cp->val != 0x00 && cp->val != 0x01) 1757 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP, 1758 MGMT_STATUS_INVALID_PARAMS); 1759 1760 hci_dev_lock(hdev); 1761 1762 if (!hdev_is_powered(hdev)) { 1763 bool changed; 1764 1765 if (cp->val) { 1766 changed = !hci_dev_test_and_set_flag(hdev, 1767 HCI_SSP_ENABLED); 1768 } else { 1769 changed = hci_dev_test_and_clear_flag(hdev, 1770 HCI_SSP_ENABLED); 1771 if (!changed) 1772 changed = hci_dev_test_and_clear_flag(hdev, 1773 HCI_HS_ENABLED); 1774 else 1775 hci_dev_clear_flag(hdev, HCI_HS_ENABLED); 1776 } 1777 1778 err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev); 1779 if (err < 0) 1780 goto failed; 1781 1782 if (changed) 1783 err = new_settings(hdev, sk); 1784 1785 goto failed; 1786 } 1787 1788 if (pending_find(MGMT_OP_SET_SSP, hdev)) { 1789 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP, 1790 MGMT_STATUS_BUSY); 1791 goto failed; 1792 } 1793 1794 if (!!cp->val == hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) { 1795 err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev); 1796 goto failed; 1797 } 1798 1799 cmd = mgmt_pending_add(sk, MGMT_OP_SET_SSP, hdev, data, len); 1800 if (!cmd) { 1801 err = -ENOMEM; 1802 goto failed; 1803 } 1804 1805 if (!cp->val && hci_dev_test_flag(hdev, HCI_USE_DEBUG_KEYS)) 1806 hci_send_cmd(hdev, HCI_OP_WRITE_SSP_DEBUG_MODE, 1807 sizeof(cp->val), &cp->val); 1808 1809 err = hci_send_cmd(hdev, HCI_OP_WRITE_SSP_MODE, 1, &cp->val); 1810 if (err < 0) { 1811 mgmt_pending_remove(cmd); 1812 goto failed; 1813 } 1814 1815 failed: 1816 hci_dev_unlock(hdev); 1817 return err; 1818 } 1819 1820 static int set_hs(struct sock *sk, struct hci_dev *hdev, void *data, u16 len) 1821 { 1822 struct mgmt_mode *cp = data; 1823 bool changed; 1824 u8 status; 1825 int err; 1826 1827 bt_dev_dbg(hdev, "sock %p", sk); 1828 1829 if (!IS_ENABLED(CONFIG_BT_HS)) 1830 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS, 1831 MGMT_STATUS_NOT_SUPPORTED); 1832 1833 status = mgmt_bredr_support(hdev); 1834 if (status) 1835 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS, status); 1836 1837 if (!lmp_ssp_capable(hdev)) 1838 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS, 1839 MGMT_STATUS_NOT_SUPPORTED); 1840 1841 if (!hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) 1842 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS, 1843 MGMT_STATUS_REJECTED); 1844 1845 if (cp->val != 0x00 && cp->val != 0x01) 1846 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS, 1847 MGMT_STATUS_INVALID_PARAMS); 1848 1849 hci_dev_lock(hdev); 1850 1851 if (pending_find(MGMT_OP_SET_SSP, hdev)) { 1852 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS, 1853 MGMT_STATUS_BUSY); 1854 goto unlock; 1855 } 1856 1857 if (cp->val) { 1858 changed = !hci_dev_test_and_set_flag(hdev, HCI_HS_ENABLED); 1859 } else { 1860 if (hdev_is_powered(hdev)) { 1861 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS, 1862 MGMT_STATUS_REJECTED); 1863 goto unlock; 1864 } 1865 1866 changed = hci_dev_test_and_clear_flag(hdev, HCI_HS_ENABLED); 1867 } 1868 1869 err = send_settings_rsp(sk, MGMT_OP_SET_HS, hdev); 1870 if (err < 0) 1871 goto unlock; 1872 1873 if (changed) 1874 err = new_settings(hdev, sk); 1875 1876 unlock: 1877 hci_dev_unlock(hdev); 1878 return err; 1879 } 1880 1881 static void le_enable_complete(struct hci_dev *hdev, u8 status, u16 opcode) 1882 { 1883 struct cmd_lookup match = { NULL, hdev }; 1884 1885 hci_dev_lock(hdev); 1886 1887 if (status) { 1888 u8 mgmt_err = mgmt_status(status); 1889 1890 mgmt_pending_foreach(MGMT_OP_SET_LE, hdev, cmd_status_rsp, 1891 &mgmt_err); 1892 goto unlock; 1893 } 1894 1895 mgmt_pending_foreach(MGMT_OP_SET_LE, hdev, settings_rsp, &match); 1896 1897 new_settings(hdev, match.sk); 1898 1899 if (match.sk) 1900 sock_put(match.sk); 1901 1902 /* Make sure the controller has a good default for 1903 * advertising data. Restrict the update to when LE 1904 * has actually been enabled. During power on, the 1905 * update in powered_update_hci will take care of it. 1906 */ 1907 if (hci_dev_test_flag(hdev, HCI_LE_ENABLED)) { 1908 struct hci_request req; 1909 hci_req_init(&req, hdev); 1910 if (ext_adv_capable(hdev)) { 1911 int err; 1912 1913 err = __hci_req_setup_ext_adv_instance(&req, 0x00); 1914 if (!err) 1915 __hci_req_update_scan_rsp_data(&req, 0x00); 1916 } else { 1917 __hci_req_update_adv_data(&req, 0x00); 1918 __hci_req_update_scan_rsp_data(&req, 0x00); 1919 } 1920 hci_req_run(&req, NULL); 1921 hci_update_background_scan(hdev); 1922 } 1923 1924 unlock: 1925 hci_dev_unlock(hdev); 1926 } 1927 1928 static int set_le(struct sock *sk, struct hci_dev *hdev, void *data, u16 len) 1929 { 1930 struct mgmt_mode *cp = data; 1931 struct hci_cp_write_le_host_supported hci_cp; 1932 struct mgmt_pending_cmd *cmd; 1933 struct hci_request req; 1934 int err; 1935 u8 val, enabled; 1936 1937 bt_dev_dbg(hdev, "sock %p", sk); 1938 1939 if (!lmp_le_capable(hdev)) 1940 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE, 1941 MGMT_STATUS_NOT_SUPPORTED); 1942 1943 if (cp->val != 0x00 && cp->val != 0x01) 1944 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE, 1945 MGMT_STATUS_INVALID_PARAMS); 1946 1947 /* Bluetooth single mode LE only controllers or dual-mode 1948 * controllers configured as LE only devices, do not allow 1949 * switching LE off. These have either LE enabled explicitly 1950 * or BR/EDR has been previously switched off. 1951 * 1952 * When trying to enable an already enabled LE, then gracefully 1953 * send a positive response. Trying to disable it however will 1954 * result into rejection. 1955 */ 1956 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) { 1957 if (cp->val == 0x01) 1958 return send_settings_rsp(sk, MGMT_OP_SET_LE, hdev); 1959 1960 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE, 1961 MGMT_STATUS_REJECTED); 1962 } 1963 1964 hci_dev_lock(hdev); 1965 1966 val = !!cp->val; 1967 enabled = lmp_host_le_capable(hdev); 1968 1969 if (!val) 1970 hci_req_clear_adv_instance(hdev, NULL, NULL, 0x00, true); 1971 1972 if (!hdev_is_powered(hdev) || val == enabled) { 1973 bool changed = false; 1974 1975 if (val != hci_dev_test_flag(hdev, HCI_LE_ENABLED)) { 1976 hci_dev_change_flag(hdev, HCI_LE_ENABLED); 1977 changed = true; 1978 } 1979 1980 if (!val && hci_dev_test_flag(hdev, HCI_ADVERTISING)) { 1981 hci_dev_clear_flag(hdev, HCI_ADVERTISING); 1982 changed = true; 1983 } 1984 1985 err = send_settings_rsp(sk, MGMT_OP_SET_LE, hdev); 1986 if (err < 0) 1987 goto unlock; 1988 1989 if (changed) 1990 err = new_settings(hdev, sk); 1991 1992 goto unlock; 1993 } 1994 1995 if (pending_find(MGMT_OP_SET_LE, hdev) || 1996 pending_find(MGMT_OP_SET_ADVERTISING, hdev)) { 1997 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE, 1998 MGMT_STATUS_BUSY); 1999 goto unlock; 2000 } 2001 2002 cmd = mgmt_pending_add(sk, MGMT_OP_SET_LE, hdev, data, len); 2003 if (!cmd) { 2004 err = -ENOMEM; 2005 goto unlock; 2006 } 2007 2008 hci_req_init(&req, hdev); 2009 2010 memset(&hci_cp, 0, sizeof(hci_cp)); 2011 2012 if (val) { 2013 hci_cp.le = val; 2014 hci_cp.simul = 0x00; 2015 } else { 2016 if (hci_dev_test_flag(hdev, HCI_LE_ADV)) 2017 __hci_req_disable_advertising(&req); 2018 2019 if (ext_adv_capable(hdev)) 2020 __hci_req_clear_ext_adv_sets(&req); 2021 } 2022 2023 hci_req_add(&req, HCI_OP_WRITE_LE_HOST_SUPPORTED, sizeof(hci_cp), 2024 &hci_cp); 2025 2026 err = hci_req_run(&req, le_enable_complete); 2027 if (err < 0) 2028 mgmt_pending_remove(cmd); 2029 2030 unlock: 2031 hci_dev_unlock(hdev); 2032 return err; 2033 } 2034 2035 /* This is a helper function to test for pending mgmt commands that can 2036 * cause CoD or EIR HCI commands. We can only allow one such pending 2037 * mgmt command at a time since otherwise we cannot easily track what 2038 * the current values are, will be, and based on that calculate if a new 2039 * HCI command needs to be sent and if yes with what value. 2040 */ 2041 static bool pending_eir_or_class(struct hci_dev *hdev) 2042 { 2043 struct mgmt_pending_cmd *cmd; 2044 2045 list_for_each_entry(cmd, &hdev->mgmt_pending, list) { 2046 switch (cmd->opcode) { 2047 case MGMT_OP_ADD_UUID: 2048 case MGMT_OP_REMOVE_UUID: 2049 case MGMT_OP_SET_DEV_CLASS: 2050 case MGMT_OP_SET_POWERED: 2051 return true; 2052 } 2053 } 2054 2055 return false; 2056 } 2057 2058 static const u8 bluetooth_base_uuid[] = { 2059 0xfb, 0x34, 0x9b, 0x5f, 0x80, 0x00, 0x00, 0x80, 2060 0x00, 0x10, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 2061 }; 2062 2063 static u8 get_uuid_size(const u8 *uuid) 2064 { 2065 u32 val; 2066 2067 if (memcmp(uuid, bluetooth_base_uuid, 12)) 2068 return 128; 2069 2070 val = get_unaligned_le32(&uuid[12]); 2071 if (val > 0xffff) 2072 return 32; 2073 2074 return 16; 2075 } 2076 2077 static void mgmt_class_complete(struct hci_dev *hdev, u16 mgmt_op, u8 status) 2078 { 2079 struct mgmt_pending_cmd *cmd; 2080 2081 hci_dev_lock(hdev); 2082 2083 cmd = pending_find(mgmt_op, hdev); 2084 if (!cmd) 2085 goto unlock; 2086 2087 mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, 2088 mgmt_status(status), hdev->dev_class, 3); 2089 2090 mgmt_pending_remove(cmd); 2091 2092 unlock: 2093 hci_dev_unlock(hdev); 2094 } 2095 2096 static void add_uuid_complete(struct hci_dev *hdev, u8 status, u16 opcode) 2097 { 2098 bt_dev_dbg(hdev, "status 0x%02x", status); 2099 2100 mgmt_class_complete(hdev, MGMT_OP_ADD_UUID, status); 2101 } 2102 2103 static int add_uuid(struct sock *sk, struct hci_dev *hdev, void *data, u16 len) 2104 { 2105 struct mgmt_cp_add_uuid *cp = data; 2106 struct mgmt_pending_cmd *cmd; 2107 struct hci_request req; 2108 struct bt_uuid *uuid; 2109 int err; 2110 2111 bt_dev_dbg(hdev, "sock %p", sk); 2112 2113 hci_dev_lock(hdev); 2114 2115 if (pending_eir_or_class(hdev)) { 2116 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_UUID, 2117 MGMT_STATUS_BUSY); 2118 goto failed; 2119 } 2120 2121 uuid = kmalloc(sizeof(*uuid), GFP_KERNEL); 2122 if (!uuid) { 2123 err = -ENOMEM; 2124 goto failed; 2125 } 2126 2127 memcpy(uuid->uuid, cp->uuid, 16); 2128 uuid->svc_hint = cp->svc_hint; 2129 uuid->size = get_uuid_size(cp->uuid); 2130 2131 list_add_tail(&uuid->list, &hdev->uuids); 2132 2133 hci_req_init(&req, hdev); 2134 2135 __hci_req_update_class(&req); 2136 __hci_req_update_eir(&req); 2137 2138 err = hci_req_run(&req, add_uuid_complete); 2139 if (err < 0) { 2140 if (err != -ENODATA) 2141 goto failed; 2142 2143 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_UUID, 0, 2144 hdev->dev_class, 3); 2145 goto failed; 2146 } 2147 2148 cmd = mgmt_pending_add(sk, MGMT_OP_ADD_UUID, hdev, data, len); 2149 if (!cmd) { 2150 err = -ENOMEM; 2151 goto failed; 2152 } 2153 2154 err = 0; 2155 2156 failed: 2157 hci_dev_unlock(hdev); 2158 return err; 2159 } 2160 2161 static bool enable_service_cache(struct hci_dev *hdev) 2162 { 2163 if (!hdev_is_powered(hdev)) 2164 return false; 2165 2166 if (!hci_dev_test_and_set_flag(hdev, HCI_SERVICE_CACHE)) { 2167 queue_delayed_work(hdev->workqueue, &hdev->service_cache, 2168 CACHE_TIMEOUT); 2169 return true; 2170 } 2171 2172 return false; 2173 } 2174 2175 static void remove_uuid_complete(struct hci_dev *hdev, u8 status, u16 opcode) 2176 { 2177 bt_dev_dbg(hdev, "status 0x%02x", status); 2178 2179 mgmt_class_complete(hdev, MGMT_OP_REMOVE_UUID, status); 2180 } 2181 2182 static int remove_uuid(struct sock *sk, struct hci_dev *hdev, void *data, 2183 u16 len) 2184 { 2185 struct mgmt_cp_remove_uuid *cp = data; 2186 struct mgmt_pending_cmd *cmd; 2187 struct bt_uuid *match, *tmp; 2188 u8 bt_uuid_any[] = { 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 }; 2189 struct hci_request req; 2190 int err, found; 2191 2192 bt_dev_dbg(hdev, "sock %p", sk); 2193 2194 hci_dev_lock(hdev); 2195 2196 if (pending_eir_or_class(hdev)) { 2197 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID, 2198 MGMT_STATUS_BUSY); 2199 goto unlock; 2200 } 2201 2202 if (memcmp(cp->uuid, bt_uuid_any, 16) == 0) { 2203 hci_uuids_clear(hdev); 2204 2205 if (enable_service_cache(hdev)) { 2206 err = mgmt_cmd_complete(sk, hdev->id, 2207 MGMT_OP_REMOVE_UUID, 2208 0, hdev->dev_class, 3); 2209 goto unlock; 2210 } 2211 2212 goto update_class; 2213 } 2214 2215 found = 0; 2216 2217 list_for_each_entry_safe(match, tmp, &hdev->uuids, list) { 2218 if (memcmp(match->uuid, cp->uuid, 16) != 0) 2219 continue; 2220 2221 list_del(&match->list); 2222 kfree(match); 2223 found++; 2224 } 2225 2226 if (found == 0) { 2227 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID, 2228 MGMT_STATUS_INVALID_PARAMS); 2229 goto unlock; 2230 } 2231 2232 update_class: 2233 hci_req_init(&req, hdev); 2234 2235 __hci_req_update_class(&req); 2236 __hci_req_update_eir(&req); 2237 2238 err = hci_req_run(&req, remove_uuid_complete); 2239 if (err < 0) { 2240 if (err != -ENODATA) 2241 goto unlock; 2242 2243 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_UUID, 0, 2244 hdev->dev_class, 3); 2245 goto unlock; 2246 } 2247 2248 cmd = mgmt_pending_add(sk, MGMT_OP_REMOVE_UUID, hdev, data, len); 2249 if (!cmd) { 2250 err = -ENOMEM; 2251 goto unlock; 2252 } 2253 2254 err = 0; 2255 2256 unlock: 2257 hci_dev_unlock(hdev); 2258 return err; 2259 } 2260 2261 static void set_class_complete(struct hci_dev *hdev, u8 status, u16 opcode) 2262 { 2263 bt_dev_dbg(hdev, "status 0x%02x", status); 2264 2265 mgmt_class_complete(hdev, MGMT_OP_SET_DEV_CLASS, status); 2266 } 2267 2268 static int set_dev_class(struct sock *sk, struct hci_dev *hdev, void *data, 2269 u16 len) 2270 { 2271 struct mgmt_cp_set_dev_class *cp = data; 2272 struct mgmt_pending_cmd *cmd; 2273 struct hci_request req; 2274 int err; 2275 2276 bt_dev_dbg(hdev, "sock %p", sk); 2277 2278 if (!lmp_bredr_capable(hdev)) 2279 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 2280 MGMT_STATUS_NOT_SUPPORTED); 2281 2282 hci_dev_lock(hdev); 2283 2284 if (pending_eir_or_class(hdev)) { 2285 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 2286 MGMT_STATUS_BUSY); 2287 goto unlock; 2288 } 2289 2290 if ((cp->minor & 0x03) != 0 || (cp->major & 0xe0) != 0) { 2291 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 2292 MGMT_STATUS_INVALID_PARAMS); 2293 goto unlock; 2294 } 2295 2296 hdev->major_class = cp->major; 2297 hdev->minor_class = cp->minor; 2298 2299 if (!hdev_is_powered(hdev)) { 2300 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 0, 2301 hdev->dev_class, 3); 2302 goto unlock; 2303 } 2304 2305 hci_req_init(&req, hdev); 2306 2307 if (hci_dev_test_and_clear_flag(hdev, HCI_SERVICE_CACHE)) { 2308 hci_dev_unlock(hdev); 2309 cancel_delayed_work_sync(&hdev->service_cache); 2310 hci_dev_lock(hdev); 2311 __hci_req_update_eir(&req); 2312 } 2313 2314 __hci_req_update_class(&req); 2315 2316 err = hci_req_run(&req, set_class_complete); 2317 if (err < 0) { 2318 if (err != -ENODATA) 2319 goto unlock; 2320 2321 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 0, 2322 hdev->dev_class, 3); 2323 goto unlock; 2324 } 2325 2326 cmd = mgmt_pending_add(sk, MGMT_OP_SET_DEV_CLASS, hdev, data, len); 2327 if (!cmd) { 2328 err = -ENOMEM; 2329 goto unlock; 2330 } 2331 2332 err = 0; 2333 2334 unlock: 2335 hci_dev_unlock(hdev); 2336 return err; 2337 } 2338 2339 static int load_link_keys(struct sock *sk, struct hci_dev *hdev, void *data, 2340 u16 len) 2341 { 2342 struct mgmt_cp_load_link_keys *cp = data; 2343 const u16 max_key_count = ((U16_MAX - sizeof(*cp)) / 2344 sizeof(struct mgmt_link_key_info)); 2345 u16 key_count, expected_len; 2346 bool changed; 2347 int i; 2348 2349 bt_dev_dbg(hdev, "sock %p", sk); 2350 2351 if (!lmp_bredr_capable(hdev)) 2352 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS, 2353 MGMT_STATUS_NOT_SUPPORTED); 2354 2355 key_count = __le16_to_cpu(cp->key_count); 2356 if (key_count > max_key_count) { 2357 bt_dev_err(hdev, "load_link_keys: too big key_count value %u", 2358 key_count); 2359 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS, 2360 MGMT_STATUS_INVALID_PARAMS); 2361 } 2362 2363 expected_len = struct_size(cp, keys, key_count); 2364 if (expected_len != len) { 2365 bt_dev_err(hdev, "load_link_keys: expected %u bytes, got %u bytes", 2366 expected_len, len); 2367 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS, 2368 MGMT_STATUS_INVALID_PARAMS); 2369 } 2370 2371 if (cp->debug_keys != 0x00 && cp->debug_keys != 0x01) 2372 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS, 2373 MGMT_STATUS_INVALID_PARAMS); 2374 2375 bt_dev_dbg(hdev, "debug_keys %u key_count %u", cp->debug_keys, 2376 key_count); 2377 2378 for (i = 0; i < key_count; i++) { 2379 struct mgmt_link_key_info *key = &cp->keys[i]; 2380 2381 if (key->addr.type != BDADDR_BREDR || key->type > 0x08) 2382 return mgmt_cmd_status(sk, hdev->id, 2383 MGMT_OP_LOAD_LINK_KEYS, 2384 MGMT_STATUS_INVALID_PARAMS); 2385 } 2386 2387 hci_dev_lock(hdev); 2388 2389 hci_link_keys_clear(hdev); 2390 2391 if (cp->debug_keys) 2392 changed = !hci_dev_test_and_set_flag(hdev, HCI_KEEP_DEBUG_KEYS); 2393 else 2394 changed = hci_dev_test_and_clear_flag(hdev, 2395 HCI_KEEP_DEBUG_KEYS); 2396 2397 if (changed) 2398 new_settings(hdev, NULL); 2399 2400 for (i = 0; i < key_count; i++) { 2401 struct mgmt_link_key_info *key = &cp->keys[i]; 2402 2403 if (hci_is_blocked_key(hdev, 2404 HCI_BLOCKED_KEY_TYPE_LINKKEY, 2405 key->val)) { 2406 bt_dev_warn(hdev, "Skipping blocked link key for %pMR", 2407 &key->addr.bdaddr); 2408 continue; 2409 } 2410 2411 /* Always ignore debug keys and require a new pairing if 2412 * the user wants to use them. 2413 */ 2414 if (key->type == HCI_LK_DEBUG_COMBINATION) 2415 continue; 2416 2417 hci_add_link_key(hdev, NULL, &key->addr.bdaddr, key->val, 2418 key->type, key->pin_len, NULL); 2419 } 2420 2421 mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS, 0, NULL, 0); 2422 2423 hci_dev_unlock(hdev); 2424 2425 return 0; 2426 } 2427 2428 static int device_unpaired(struct hci_dev *hdev, bdaddr_t *bdaddr, 2429 u8 addr_type, struct sock *skip_sk) 2430 { 2431 struct mgmt_ev_device_unpaired ev; 2432 2433 bacpy(&ev.addr.bdaddr, bdaddr); 2434 ev.addr.type = addr_type; 2435 2436 return mgmt_event(MGMT_EV_DEVICE_UNPAIRED, hdev, &ev, sizeof(ev), 2437 skip_sk); 2438 } 2439 2440 static int unpair_device(struct sock *sk, struct hci_dev *hdev, void *data, 2441 u16 len) 2442 { 2443 struct mgmt_cp_unpair_device *cp = data; 2444 struct mgmt_rp_unpair_device rp; 2445 struct hci_conn_params *params; 2446 struct mgmt_pending_cmd *cmd; 2447 struct hci_conn *conn; 2448 u8 addr_type; 2449 int err; 2450 2451 memset(&rp, 0, sizeof(rp)); 2452 bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr); 2453 rp.addr.type = cp->addr.type; 2454 2455 if (!bdaddr_type_is_valid(cp->addr.type)) 2456 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE, 2457 MGMT_STATUS_INVALID_PARAMS, 2458 &rp, sizeof(rp)); 2459 2460 if (cp->disconnect != 0x00 && cp->disconnect != 0x01) 2461 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE, 2462 MGMT_STATUS_INVALID_PARAMS, 2463 &rp, sizeof(rp)); 2464 2465 hci_dev_lock(hdev); 2466 2467 if (!hdev_is_powered(hdev)) { 2468 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE, 2469 MGMT_STATUS_NOT_POWERED, &rp, 2470 sizeof(rp)); 2471 goto unlock; 2472 } 2473 2474 if (cp->addr.type == BDADDR_BREDR) { 2475 /* If disconnection is requested, then look up the 2476 * connection. If the remote device is connected, it 2477 * will be later used to terminate the link. 2478 * 2479 * Setting it to NULL explicitly will cause no 2480 * termination of the link. 2481 */ 2482 if (cp->disconnect) 2483 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, 2484 &cp->addr.bdaddr); 2485 else 2486 conn = NULL; 2487 2488 err = hci_remove_link_key(hdev, &cp->addr.bdaddr); 2489 if (err < 0) { 2490 err = mgmt_cmd_complete(sk, hdev->id, 2491 MGMT_OP_UNPAIR_DEVICE, 2492 MGMT_STATUS_NOT_PAIRED, &rp, 2493 sizeof(rp)); 2494 goto unlock; 2495 } 2496 2497 goto done; 2498 } 2499 2500 /* LE address type */ 2501 addr_type = le_addr_type(cp->addr.type); 2502 2503 /* Abort any ongoing SMP pairing. Removes ltk and irk if they exist. */ 2504 err = smp_cancel_and_remove_pairing(hdev, &cp->addr.bdaddr, addr_type); 2505 if (err < 0) { 2506 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE, 2507 MGMT_STATUS_NOT_PAIRED, &rp, 2508 sizeof(rp)); 2509 goto unlock; 2510 } 2511 2512 conn = hci_conn_hash_lookup_le(hdev, &cp->addr.bdaddr, addr_type); 2513 if (!conn) { 2514 hci_conn_params_del(hdev, &cp->addr.bdaddr, addr_type); 2515 goto done; 2516 } 2517 2518 2519 /* Defer clearing up the connection parameters until closing to 2520 * give a chance of keeping them if a repairing happens. 2521 */ 2522 set_bit(HCI_CONN_PARAM_REMOVAL_PEND, &conn->flags); 2523 2524 /* Disable auto-connection parameters if present */ 2525 params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr, addr_type); 2526 if (params) { 2527 if (params->explicit_connect) 2528 params->auto_connect = HCI_AUTO_CONN_EXPLICIT; 2529 else 2530 params->auto_connect = HCI_AUTO_CONN_DISABLED; 2531 } 2532 2533 /* If disconnection is not requested, then clear the connection 2534 * variable so that the link is not terminated. 2535 */ 2536 if (!cp->disconnect) 2537 conn = NULL; 2538 2539 done: 2540 /* If the connection variable is set, then termination of the 2541 * link is requested. 2542 */ 2543 if (!conn) { 2544 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE, 0, 2545 &rp, sizeof(rp)); 2546 device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, sk); 2547 goto unlock; 2548 } 2549 2550 cmd = mgmt_pending_add(sk, MGMT_OP_UNPAIR_DEVICE, hdev, cp, 2551 sizeof(*cp)); 2552 if (!cmd) { 2553 err = -ENOMEM; 2554 goto unlock; 2555 } 2556 2557 cmd->cmd_complete = addr_cmd_complete; 2558 2559 err = hci_abort_conn(conn, HCI_ERROR_REMOTE_USER_TERM); 2560 if (err < 0) 2561 mgmt_pending_remove(cmd); 2562 2563 unlock: 2564 hci_dev_unlock(hdev); 2565 return err; 2566 } 2567 2568 static int disconnect(struct sock *sk, struct hci_dev *hdev, void *data, 2569 u16 len) 2570 { 2571 struct mgmt_cp_disconnect *cp = data; 2572 struct mgmt_rp_disconnect rp; 2573 struct mgmt_pending_cmd *cmd; 2574 struct hci_conn *conn; 2575 int err; 2576 2577 bt_dev_dbg(hdev, "sock %p", sk); 2578 2579 memset(&rp, 0, sizeof(rp)); 2580 bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr); 2581 rp.addr.type = cp->addr.type; 2582 2583 if (!bdaddr_type_is_valid(cp->addr.type)) 2584 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT, 2585 MGMT_STATUS_INVALID_PARAMS, 2586 &rp, sizeof(rp)); 2587 2588 hci_dev_lock(hdev); 2589 2590 if (!test_bit(HCI_UP, &hdev->flags)) { 2591 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT, 2592 MGMT_STATUS_NOT_POWERED, &rp, 2593 sizeof(rp)); 2594 goto failed; 2595 } 2596 2597 if (pending_find(MGMT_OP_DISCONNECT, hdev)) { 2598 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT, 2599 MGMT_STATUS_BUSY, &rp, sizeof(rp)); 2600 goto failed; 2601 } 2602 2603 if (cp->addr.type == BDADDR_BREDR) 2604 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, 2605 &cp->addr.bdaddr); 2606 else 2607 conn = hci_conn_hash_lookup_le(hdev, &cp->addr.bdaddr, 2608 le_addr_type(cp->addr.type)); 2609 2610 if (!conn || conn->state == BT_OPEN || conn->state == BT_CLOSED) { 2611 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT, 2612 MGMT_STATUS_NOT_CONNECTED, &rp, 2613 sizeof(rp)); 2614 goto failed; 2615 } 2616 2617 cmd = mgmt_pending_add(sk, MGMT_OP_DISCONNECT, hdev, data, len); 2618 if (!cmd) { 2619 err = -ENOMEM; 2620 goto failed; 2621 } 2622 2623 cmd->cmd_complete = generic_cmd_complete; 2624 2625 err = hci_disconnect(conn, HCI_ERROR_REMOTE_USER_TERM); 2626 if (err < 0) 2627 mgmt_pending_remove(cmd); 2628 2629 failed: 2630 hci_dev_unlock(hdev); 2631 return err; 2632 } 2633 2634 static u8 link_to_bdaddr(u8 link_type, u8 addr_type) 2635 { 2636 switch (link_type) { 2637 case LE_LINK: 2638 switch (addr_type) { 2639 case ADDR_LE_DEV_PUBLIC: 2640 return BDADDR_LE_PUBLIC; 2641 2642 default: 2643 /* Fallback to LE Random address type */ 2644 return BDADDR_LE_RANDOM; 2645 } 2646 2647 default: 2648 /* Fallback to BR/EDR type */ 2649 return BDADDR_BREDR; 2650 } 2651 } 2652 2653 static int get_connections(struct sock *sk, struct hci_dev *hdev, void *data, 2654 u16 data_len) 2655 { 2656 struct mgmt_rp_get_connections *rp; 2657 struct hci_conn *c; 2658 int err; 2659 u16 i; 2660 2661 bt_dev_dbg(hdev, "sock %p", sk); 2662 2663 hci_dev_lock(hdev); 2664 2665 if (!hdev_is_powered(hdev)) { 2666 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_CONNECTIONS, 2667 MGMT_STATUS_NOT_POWERED); 2668 goto unlock; 2669 } 2670 2671 i = 0; 2672 list_for_each_entry(c, &hdev->conn_hash.list, list) { 2673 if (test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags)) 2674 i++; 2675 } 2676 2677 rp = kmalloc(struct_size(rp, addr, i), GFP_KERNEL); 2678 if (!rp) { 2679 err = -ENOMEM; 2680 goto unlock; 2681 } 2682 2683 i = 0; 2684 list_for_each_entry(c, &hdev->conn_hash.list, list) { 2685 if (!test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags)) 2686 continue; 2687 bacpy(&rp->addr[i].bdaddr, &c->dst); 2688 rp->addr[i].type = link_to_bdaddr(c->type, c->dst_type); 2689 if (c->type == SCO_LINK || c->type == ESCO_LINK) 2690 continue; 2691 i++; 2692 } 2693 2694 rp->conn_count = cpu_to_le16(i); 2695 2696 /* Recalculate length in case of filtered SCO connections, etc */ 2697 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONNECTIONS, 0, rp, 2698 struct_size(rp, addr, i)); 2699 2700 kfree(rp); 2701 2702 unlock: 2703 hci_dev_unlock(hdev); 2704 return err; 2705 } 2706 2707 static int send_pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev, 2708 struct mgmt_cp_pin_code_neg_reply *cp) 2709 { 2710 struct mgmt_pending_cmd *cmd; 2711 int err; 2712 2713 cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_NEG_REPLY, hdev, cp, 2714 sizeof(*cp)); 2715 if (!cmd) 2716 return -ENOMEM; 2717 2718 cmd->cmd_complete = addr_cmd_complete; 2719 2720 err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_NEG_REPLY, 2721 sizeof(cp->addr.bdaddr), &cp->addr.bdaddr); 2722 if (err < 0) 2723 mgmt_pending_remove(cmd); 2724 2725 return err; 2726 } 2727 2728 static int pin_code_reply(struct sock *sk, struct hci_dev *hdev, void *data, 2729 u16 len) 2730 { 2731 struct hci_conn *conn; 2732 struct mgmt_cp_pin_code_reply *cp = data; 2733 struct hci_cp_pin_code_reply reply; 2734 struct mgmt_pending_cmd *cmd; 2735 int err; 2736 2737 bt_dev_dbg(hdev, "sock %p", sk); 2738 2739 hci_dev_lock(hdev); 2740 2741 if (!hdev_is_powered(hdev)) { 2742 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY, 2743 MGMT_STATUS_NOT_POWERED); 2744 goto failed; 2745 } 2746 2747 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->addr.bdaddr); 2748 if (!conn) { 2749 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY, 2750 MGMT_STATUS_NOT_CONNECTED); 2751 goto failed; 2752 } 2753 2754 if (conn->pending_sec_level == BT_SECURITY_HIGH && cp->pin_len != 16) { 2755 struct mgmt_cp_pin_code_neg_reply ncp; 2756 2757 memcpy(&ncp.addr, &cp->addr, sizeof(ncp.addr)); 2758 2759 bt_dev_err(hdev, "PIN code is not 16 bytes long"); 2760 2761 err = send_pin_code_neg_reply(sk, hdev, &ncp); 2762 if (err >= 0) 2763 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY, 2764 MGMT_STATUS_INVALID_PARAMS); 2765 2766 goto failed; 2767 } 2768 2769 cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_REPLY, hdev, data, len); 2770 if (!cmd) { 2771 err = -ENOMEM; 2772 goto failed; 2773 } 2774 2775 cmd->cmd_complete = addr_cmd_complete; 2776 2777 bacpy(&reply.bdaddr, &cp->addr.bdaddr); 2778 reply.pin_len = cp->pin_len; 2779 memcpy(reply.pin_code, cp->pin_code, sizeof(reply.pin_code)); 2780 2781 err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_REPLY, sizeof(reply), &reply); 2782 if (err < 0) 2783 mgmt_pending_remove(cmd); 2784 2785 failed: 2786 hci_dev_unlock(hdev); 2787 return err; 2788 } 2789 2790 static int set_io_capability(struct sock *sk, struct hci_dev *hdev, void *data, 2791 u16 len) 2792 { 2793 struct mgmt_cp_set_io_capability *cp = data; 2794 2795 bt_dev_dbg(hdev, "sock %p", sk); 2796 2797 if (cp->io_capability > SMP_IO_KEYBOARD_DISPLAY) 2798 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_IO_CAPABILITY, 2799 MGMT_STATUS_INVALID_PARAMS); 2800 2801 hci_dev_lock(hdev); 2802 2803 hdev->io_capability = cp->io_capability; 2804 2805 bt_dev_dbg(hdev, "IO capability set to 0x%02x", hdev->io_capability); 2806 2807 hci_dev_unlock(hdev); 2808 2809 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_IO_CAPABILITY, 0, 2810 NULL, 0); 2811 } 2812 2813 static struct mgmt_pending_cmd *find_pairing(struct hci_conn *conn) 2814 { 2815 struct hci_dev *hdev = conn->hdev; 2816 struct mgmt_pending_cmd *cmd; 2817 2818 list_for_each_entry(cmd, &hdev->mgmt_pending, list) { 2819 if (cmd->opcode != MGMT_OP_PAIR_DEVICE) 2820 continue; 2821 2822 if (cmd->user_data != conn) 2823 continue; 2824 2825 return cmd; 2826 } 2827 2828 return NULL; 2829 } 2830 2831 static int pairing_complete(struct mgmt_pending_cmd *cmd, u8 status) 2832 { 2833 struct mgmt_rp_pair_device rp; 2834 struct hci_conn *conn = cmd->user_data; 2835 int err; 2836 2837 bacpy(&rp.addr.bdaddr, &conn->dst); 2838 rp.addr.type = link_to_bdaddr(conn->type, conn->dst_type); 2839 2840 err = mgmt_cmd_complete(cmd->sk, cmd->index, MGMT_OP_PAIR_DEVICE, 2841 status, &rp, sizeof(rp)); 2842 2843 /* So we don't get further callbacks for this connection */ 2844 conn->connect_cfm_cb = NULL; 2845 conn->security_cfm_cb = NULL; 2846 conn->disconn_cfm_cb = NULL; 2847 2848 hci_conn_drop(conn); 2849 2850 /* The device is paired so there is no need to remove 2851 * its connection parameters anymore. 2852 */ 2853 clear_bit(HCI_CONN_PARAM_REMOVAL_PEND, &conn->flags); 2854 2855 hci_conn_put(conn); 2856 2857 return err; 2858 } 2859 2860 void mgmt_smp_complete(struct hci_conn *conn, bool complete) 2861 { 2862 u8 status = complete ? MGMT_STATUS_SUCCESS : MGMT_STATUS_FAILED; 2863 struct mgmt_pending_cmd *cmd; 2864 2865 cmd = find_pairing(conn); 2866 if (cmd) { 2867 cmd->cmd_complete(cmd, status); 2868 mgmt_pending_remove(cmd); 2869 } 2870 } 2871 2872 static void pairing_complete_cb(struct hci_conn *conn, u8 status) 2873 { 2874 struct mgmt_pending_cmd *cmd; 2875 2876 BT_DBG("status %u", status); 2877 2878 cmd = find_pairing(conn); 2879 if (!cmd) { 2880 BT_DBG("Unable to find a pending command"); 2881 return; 2882 } 2883 2884 cmd->cmd_complete(cmd, mgmt_status(status)); 2885 mgmt_pending_remove(cmd); 2886 } 2887 2888 static void le_pairing_complete_cb(struct hci_conn *conn, u8 status) 2889 { 2890 struct mgmt_pending_cmd *cmd; 2891 2892 BT_DBG("status %u", status); 2893 2894 if (!status) 2895 return; 2896 2897 cmd = find_pairing(conn); 2898 if (!cmd) { 2899 BT_DBG("Unable to find a pending command"); 2900 return; 2901 } 2902 2903 cmd->cmd_complete(cmd, mgmt_status(status)); 2904 mgmt_pending_remove(cmd); 2905 } 2906 2907 static int pair_device(struct sock *sk, struct hci_dev *hdev, void *data, 2908 u16 len) 2909 { 2910 struct mgmt_cp_pair_device *cp = data; 2911 struct mgmt_rp_pair_device rp; 2912 struct mgmt_pending_cmd *cmd; 2913 u8 sec_level, auth_type; 2914 struct hci_conn *conn; 2915 int err; 2916 2917 bt_dev_dbg(hdev, "sock %p", sk); 2918 2919 memset(&rp, 0, sizeof(rp)); 2920 bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr); 2921 rp.addr.type = cp->addr.type; 2922 2923 if (!bdaddr_type_is_valid(cp->addr.type)) 2924 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE, 2925 MGMT_STATUS_INVALID_PARAMS, 2926 &rp, sizeof(rp)); 2927 2928 if (cp->io_cap > SMP_IO_KEYBOARD_DISPLAY) 2929 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE, 2930 MGMT_STATUS_INVALID_PARAMS, 2931 &rp, sizeof(rp)); 2932 2933 hci_dev_lock(hdev); 2934 2935 if (!hdev_is_powered(hdev)) { 2936 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE, 2937 MGMT_STATUS_NOT_POWERED, &rp, 2938 sizeof(rp)); 2939 goto unlock; 2940 } 2941 2942 if (hci_bdaddr_is_paired(hdev, &cp->addr.bdaddr, cp->addr.type)) { 2943 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE, 2944 MGMT_STATUS_ALREADY_PAIRED, &rp, 2945 sizeof(rp)); 2946 goto unlock; 2947 } 2948 2949 sec_level = BT_SECURITY_MEDIUM; 2950 auth_type = HCI_AT_DEDICATED_BONDING; 2951 2952 if (cp->addr.type == BDADDR_BREDR) { 2953 conn = hci_connect_acl(hdev, &cp->addr.bdaddr, sec_level, 2954 auth_type, CONN_REASON_PAIR_DEVICE); 2955 } else { 2956 u8 addr_type = le_addr_type(cp->addr.type); 2957 struct hci_conn_params *p; 2958 2959 /* When pairing a new device, it is expected to remember 2960 * this device for future connections. Adding the connection 2961 * parameter information ahead of time allows tracking 2962 * of the peripheral preferred values and will speed up any 2963 * further connection establishment. 2964 * 2965 * If connection parameters already exist, then they 2966 * will be kept and this function does nothing. 2967 */ 2968 p = hci_conn_params_add(hdev, &cp->addr.bdaddr, addr_type); 2969 2970 if (p->auto_connect == HCI_AUTO_CONN_EXPLICIT) 2971 p->auto_connect = HCI_AUTO_CONN_DISABLED; 2972 2973 conn = hci_connect_le_scan(hdev, &cp->addr.bdaddr, addr_type, 2974 sec_level, HCI_LE_CONN_TIMEOUT, 2975 CONN_REASON_PAIR_DEVICE); 2976 } 2977 2978 if (IS_ERR(conn)) { 2979 int status; 2980 2981 if (PTR_ERR(conn) == -EBUSY) 2982 status = MGMT_STATUS_BUSY; 2983 else if (PTR_ERR(conn) == -EOPNOTSUPP) 2984 status = MGMT_STATUS_NOT_SUPPORTED; 2985 else if (PTR_ERR(conn) == -ECONNREFUSED) 2986 status = MGMT_STATUS_REJECTED; 2987 else 2988 status = MGMT_STATUS_CONNECT_FAILED; 2989 2990 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE, 2991 status, &rp, sizeof(rp)); 2992 goto unlock; 2993 } 2994 2995 if (conn->connect_cfm_cb) { 2996 hci_conn_drop(conn); 2997 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE, 2998 MGMT_STATUS_BUSY, &rp, sizeof(rp)); 2999 goto unlock; 3000 } 3001 3002 cmd = mgmt_pending_add(sk, MGMT_OP_PAIR_DEVICE, hdev, data, len); 3003 if (!cmd) { 3004 err = -ENOMEM; 3005 hci_conn_drop(conn); 3006 goto unlock; 3007 } 3008 3009 cmd->cmd_complete = pairing_complete; 3010 3011 /* For LE, just connecting isn't a proof that the pairing finished */ 3012 if (cp->addr.type == BDADDR_BREDR) { 3013 conn->connect_cfm_cb = pairing_complete_cb; 3014 conn->security_cfm_cb = pairing_complete_cb; 3015 conn->disconn_cfm_cb = pairing_complete_cb; 3016 } else { 3017 conn->connect_cfm_cb = le_pairing_complete_cb; 3018 conn->security_cfm_cb = le_pairing_complete_cb; 3019 conn->disconn_cfm_cb = le_pairing_complete_cb; 3020 } 3021 3022 conn->io_capability = cp->io_cap; 3023 cmd->user_data = hci_conn_get(conn); 3024 3025 if ((conn->state == BT_CONNECTED || conn->state == BT_CONFIG) && 3026 hci_conn_security(conn, sec_level, auth_type, true)) { 3027 cmd->cmd_complete(cmd, 0); 3028 mgmt_pending_remove(cmd); 3029 } 3030 3031 err = 0; 3032 3033 unlock: 3034 hci_dev_unlock(hdev); 3035 return err; 3036 } 3037 3038 static int cancel_pair_device(struct sock *sk, struct hci_dev *hdev, void *data, 3039 u16 len) 3040 { 3041 struct mgmt_addr_info *addr = data; 3042 struct mgmt_pending_cmd *cmd; 3043 struct hci_conn *conn; 3044 int err; 3045 3046 bt_dev_dbg(hdev, "sock %p", sk); 3047 3048 hci_dev_lock(hdev); 3049 3050 if (!hdev_is_powered(hdev)) { 3051 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE, 3052 MGMT_STATUS_NOT_POWERED); 3053 goto unlock; 3054 } 3055 3056 cmd = pending_find(MGMT_OP_PAIR_DEVICE, hdev); 3057 if (!cmd) { 3058 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE, 3059 MGMT_STATUS_INVALID_PARAMS); 3060 goto unlock; 3061 } 3062 3063 conn = cmd->user_data; 3064 3065 if (bacmp(&addr->bdaddr, &conn->dst) != 0) { 3066 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE, 3067 MGMT_STATUS_INVALID_PARAMS); 3068 goto unlock; 3069 } 3070 3071 cmd->cmd_complete(cmd, MGMT_STATUS_CANCELLED); 3072 mgmt_pending_remove(cmd); 3073 3074 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE, 0, 3075 addr, sizeof(*addr)); 3076 3077 /* Since user doesn't want to proceed with the connection, abort any 3078 * ongoing pairing and then terminate the link if it was created 3079 * because of the pair device action. 3080 */ 3081 if (addr->type == BDADDR_BREDR) 3082 hci_remove_link_key(hdev, &addr->bdaddr); 3083 else 3084 smp_cancel_and_remove_pairing(hdev, &addr->bdaddr, 3085 le_addr_type(addr->type)); 3086 3087 if (conn->conn_reason == CONN_REASON_PAIR_DEVICE) 3088 hci_abort_conn(conn, HCI_ERROR_REMOTE_USER_TERM); 3089 3090 unlock: 3091 hci_dev_unlock(hdev); 3092 return err; 3093 } 3094 3095 static int user_pairing_resp(struct sock *sk, struct hci_dev *hdev, 3096 struct mgmt_addr_info *addr, u16 mgmt_op, 3097 u16 hci_op, __le32 passkey) 3098 { 3099 struct mgmt_pending_cmd *cmd; 3100 struct hci_conn *conn; 3101 int err; 3102 3103 hci_dev_lock(hdev); 3104 3105 if (!hdev_is_powered(hdev)) { 3106 err = mgmt_cmd_complete(sk, hdev->id, mgmt_op, 3107 MGMT_STATUS_NOT_POWERED, addr, 3108 sizeof(*addr)); 3109 goto done; 3110 } 3111 3112 if (addr->type == BDADDR_BREDR) 3113 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &addr->bdaddr); 3114 else 3115 conn = hci_conn_hash_lookup_le(hdev, &addr->bdaddr, 3116 le_addr_type(addr->type)); 3117 3118 if (!conn) { 3119 err = mgmt_cmd_complete(sk, hdev->id, mgmt_op, 3120 MGMT_STATUS_NOT_CONNECTED, addr, 3121 sizeof(*addr)); 3122 goto done; 3123 } 3124 3125 if (addr->type == BDADDR_LE_PUBLIC || addr->type == BDADDR_LE_RANDOM) { 3126 err = smp_user_confirm_reply(conn, mgmt_op, passkey); 3127 if (!err) 3128 err = mgmt_cmd_complete(sk, hdev->id, mgmt_op, 3129 MGMT_STATUS_SUCCESS, addr, 3130 sizeof(*addr)); 3131 else 3132 err = mgmt_cmd_complete(sk, hdev->id, mgmt_op, 3133 MGMT_STATUS_FAILED, addr, 3134 sizeof(*addr)); 3135 3136 goto done; 3137 } 3138 3139 cmd = mgmt_pending_add(sk, mgmt_op, hdev, addr, sizeof(*addr)); 3140 if (!cmd) { 3141 err = -ENOMEM; 3142 goto done; 3143 } 3144 3145 cmd->cmd_complete = addr_cmd_complete; 3146 3147 /* Continue with pairing via HCI */ 3148 if (hci_op == HCI_OP_USER_PASSKEY_REPLY) { 3149 struct hci_cp_user_passkey_reply cp; 3150 3151 bacpy(&cp.bdaddr, &addr->bdaddr); 3152 cp.passkey = passkey; 3153 err = hci_send_cmd(hdev, hci_op, sizeof(cp), &cp); 3154 } else 3155 err = hci_send_cmd(hdev, hci_op, sizeof(addr->bdaddr), 3156 &addr->bdaddr); 3157 3158 if (err < 0) 3159 mgmt_pending_remove(cmd); 3160 3161 done: 3162 hci_dev_unlock(hdev); 3163 return err; 3164 } 3165 3166 static int pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev, 3167 void *data, u16 len) 3168 { 3169 struct mgmt_cp_pin_code_neg_reply *cp = data; 3170 3171 bt_dev_dbg(hdev, "sock %p", sk); 3172 3173 return user_pairing_resp(sk, hdev, &cp->addr, 3174 MGMT_OP_PIN_CODE_NEG_REPLY, 3175 HCI_OP_PIN_CODE_NEG_REPLY, 0); 3176 } 3177 3178 static int user_confirm_reply(struct sock *sk, struct hci_dev *hdev, void *data, 3179 u16 len) 3180 { 3181 struct mgmt_cp_user_confirm_reply *cp = data; 3182 3183 bt_dev_dbg(hdev, "sock %p", sk); 3184 3185 if (len != sizeof(*cp)) 3186 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_USER_CONFIRM_REPLY, 3187 MGMT_STATUS_INVALID_PARAMS); 3188 3189 return user_pairing_resp(sk, hdev, &cp->addr, 3190 MGMT_OP_USER_CONFIRM_REPLY, 3191 HCI_OP_USER_CONFIRM_REPLY, 0); 3192 } 3193 3194 static int user_confirm_neg_reply(struct sock *sk, struct hci_dev *hdev, 3195 void *data, u16 len) 3196 { 3197 struct mgmt_cp_user_confirm_neg_reply *cp = data; 3198 3199 bt_dev_dbg(hdev, "sock %p", sk); 3200 3201 return user_pairing_resp(sk, hdev, &cp->addr, 3202 MGMT_OP_USER_CONFIRM_NEG_REPLY, 3203 HCI_OP_USER_CONFIRM_NEG_REPLY, 0); 3204 } 3205 3206 static int user_passkey_reply(struct sock *sk, struct hci_dev *hdev, void *data, 3207 u16 len) 3208 { 3209 struct mgmt_cp_user_passkey_reply *cp = data; 3210 3211 bt_dev_dbg(hdev, "sock %p", sk); 3212 3213 return user_pairing_resp(sk, hdev, &cp->addr, 3214 MGMT_OP_USER_PASSKEY_REPLY, 3215 HCI_OP_USER_PASSKEY_REPLY, cp->passkey); 3216 } 3217 3218 static int user_passkey_neg_reply(struct sock *sk, struct hci_dev *hdev, 3219 void *data, u16 len) 3220 { 3221 struct mgmt_cp_user_passkey_neg_reply *cp = data; 3222 3223 bt_dev_dbg(hdev, "sock %p", sk); 3224 3225 return user_pairing_resp(sk, hdev, &cp->addr, 3226 MGMT_OP_USER_PASSKEY_NEG_REPLY, 3227 HCI_OP_USER_PASSKEY_NEG_REPLY, 0); 3228 } 3229 3230 static void adv_expire(struct hci_dev *hdev, u32 flags) 3231 { 3232 struct adv_info *adv_instance; 3233 struct hci_request req; 3234 int err; 3235 3236 adv_instance = hci_find_adv_instance(hdev, hdev->cur_adv_instance); 3237 if (!adv_instance) 3238 return; 3239 3240 /* stop if current instance doesn't need to be changed */ 3241 if (!(adv_instance->flags & flags)) 3242 return; 3243 3244 cancel_adv_timeout(hdev); 3245 3246 adv_instance = hci_get_next_instance(hdev, adv_instance->instance); 3247 if (!adv_instance) 3248 return; 3249 3250 hci_req_init(&req, hdev); 3251 err = __hci_req_schedule_adv_instance(&req, adv_instance->instance, 3252 true); 3253 if (err) 3254 return; 3255 3256 hci_req_run(&req, NULL); 3257 } 3258 3259 static void set_name_complete(struct hci_dev *hdev, u8 status, u16 opcode) 3260 { 3261 struct mgmt_cp_set_local_name *cp; 3262 struct mgmt_pending_cmd *cmd; 3263 3264 bt_dev_dbg(hdev, "status 0x%02x", status); 3265 3266 hci_dev_lock(hdev); 3267 3268 cmd = pending_find(MGMT_OP_SET_LOCAL_NAME, hdev); 3269 if (!cmd) 3270 goto unlock; 3271 3272 cp = cmd->param; 3273 3274 if (status) { 3275 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 3276 mgmt_status(status)); 3277 } else { 3278 mgmt_cmd_complete(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0, 3279 cp, sizeof(*cp)); 3280 3281 if (hci_dev_test_flag(hdev, HCI_LE_ADV)) 3282 adv_expire(hdev, MGMT_ADV_FLAG_LOCAL_NAME); 3283 } 3284 3285 mgmt_pending_remove(cmd); 3286 3287 unlock: 3288 hci_dev_unlock(hdev); 3289 } 3290 3291 static int set_local_name(struct sock *sk, struct hci_dev *hdev, void *data, 3292 u16 len) 3293 { 3294 struct mgmt_cp_set_local_name *cp = data; 3295 struct mgmt_pending_cmd *cmd; 3296 struct hci_request req; 3297 int err; 3298 3299 bt_dev_dbg(hdev, "sock %p", sk); 3300 3301 hci_dev_lock(hdev); 3302 3303 /* If the old values are the same as the new ones just return a 3304 * direct command complete event. 3305 */ 3306 if (!memcmp(hdev->dev_name, cp->name, sizeof(hdev->dev_name)) && 3307 !memcmp(hdev->short_name, cp->short_name, 3308 sizeof(hdev->short_name))) { 3309 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0, 3310 data, len); 3311 goto failed; 3312 } 3313 3314 memcpy(hdev->short_name, cp->short_name, sizeof(hdev->short_name)); 3315 3316 if (!hdev_is_powered(hdev)) { 3317 memcpy(hdev->dev_name, cp->name, sizeof(hdev->dev_name)); 3318 3319 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0, 3320 data, len); 3321 if (err < 0) 3322 goto failed; 3323 3324 err = mgmt_limited_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, data, 3325 len, HCI_MGMT_LOCAL_NAME_EVENTS, sk); 3326 ext_info_changed(hdev, sk); 3327 3328 goto failed; 3329 } 3330 3331 cmd = mgmt_pending_add(sk, MGMT_OP_SET_LOCAL_NAME, hdev, data, len); 3332 if (!cmd) { 3333 err = -ENOMEM; 3334 goto failed; 3335 } 3336 3337 memcpy(hdev->dev_name, cp->name, sizeof(hdev->dev_name)); 3338 3339 hci_req_init(&req, hdev); 3340 3341 if (lmp_bredr_capable(hdev)) { 3342 __hci_req_update_name(&req); 3343 __hci_req_update_eir(&req); 3344 } 3345 3346 /* The name is stored in the scan response data and so 3347 * no need to update the advertising data here. 3348 */ 3349 if (lmp_le_capable(hdev) && hci_dev_test_flag(hdev, HCI_ADVERTISING)) 3350 __hci_req_update_scan_rsp_data(&req, hdev->cur_adv_instance); 3351 3352 err = hci_req_run(&req, set_name_complete); 3353 if (err < 0) 3354 mgmt_pending_remove(cmd); 3355 3356 failed: 3357 hci_dev_unlock(hdev); 3358 return err; 3359 } 3360 3361 static int set_appearance(struct sock *sk, struct hci_dev *hdev, void *data, 3362 u16 len) 3363 { 3364 struct mgmt_cp_set_appearance *cp = data; 3365 u16 appearance; 3366 int err; 3367 3368 bt_dev_dbg(hdev, "sock %p", sk); 3369 3370 if (!lmp_le_capable(hdev)) 3371 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_APPEARANCE, 3372 MGMT_STATUS_NOT_SUPPORTED); 3373 3374 appearance = le16_to_cpu(cp->appearance); 3375 3376 hci_dev_lock(hdev); 3377 3378 if (hdev->appearance != appearance) { 3379 hdev->appearance = appearance; 3380 3381 if (hci_dev_test_flag(hdev, HCI_LE_ADV)) 3382 adv_expire(hdev, MGMT_ADV_FLAG_APPEARANCE); 3383 3384 ext_info_changed(hdev, sk); 3385 } 3386 3387 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_APPEARANCE, 0, NULL, 3388 0); 3389 3390 hci_dev_unlock(hdev); 3391 3392 return err; 3393 } 3394 3395 static int get_phy_configuration(struct sock *sk, struct hci_dev *hdev, 3396 void *data, u16 len) 3397 { 3398 struct mgmt_rp_get_phy_configuration rp; 3399 3400 bt_dev_dbg(hdev, "sock %p", sk); 3401 3402 hci_dev_lock(hdev); 3403 3404 memset(&rp, 0, sizeof(rp)); 3405 3406 rp.supported_phys = cpu_to_le32(get_supported_phys(hdev)); 3407 rp.selected_phys = cpu_to_le32(get_selected_phys(hdev)); 3408 rp.configurable_phys = cpu_to_le32(get_configurable_phys(hdev)); 3409 3410 hci_dev_unlock(hdev); 3411 3412 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_PHY_CONFIGURATION, 0, 3413 &rp, sizeof(rp)); 3414 } 3415 3416 int mgmt_phy_configuration_changed(struct hci_dev *hdev, struct sock *skip) 3417 { 3418 struct mgmt_ev_phy_configuration_changed ev; 3419 3420 memset(&ev, 0, sizeof(ev)); 3421 3422 ev.selected_phys = cpu_to_le32(get_selected_phys(hdev)); 3423 3424 return mgmt_event(MGMT_EV_PHY_CONFIGURATION_CHANGED, hdev, &ev, 3425 sizeof(ev), skip); 3426 } 3427 3428 static void set_default_phy_complete(struct hci_dev *hdev, u8 status, 3429 u16 opcode, struct sk_buff *skb) 3430 { 3431 struct mgmt_pending_cmd *cmd; 3432 3433 bt_dev_dbg(hdev, "status 0x%02x", status); 3434 3435 hci_dev_lock(hdev); 3436 3437 cmd = pending_find(MGMT_OP_SET_PHY_CONFIGURATION, hdev); 3438 if (!cmd) 3439 goto unlock; 3440 3441 if (status) { 3442 mgmt_cmd_status(cmd->sk, hdev->id, 3443 MGMT_OP_SET_PHY_CONFIGURATION, 3444 mgmt_status(status)); 3445 } else { 3446 mgmt_cmd_complete(cmd->sk, hdev->id, 3447 MGMT_OP_SET_PHY_CONFIGURATION, 0, 3448 NULL, 0); 3449 3450 mgmt_phy_configuration_changed(hdev, cmd->sk); 3451 } 3452 3453 mgmt_pending_remove(cmd); 3454 3455 unlock: 3456 hci_dev_unlock(hdev); 3457 } 3458 3459 static int set_phy_configuration(struct sock *sk, struct hci_dev *hdev, 3460 void *data, u16 len) 3461 { 3462 struct mgmt_cp_set_phy_configuration *cp = data; 3463 struct hci_cp_le_set_default_phy cp_phy; 3464 struct mgmt_pending_cmd *cmd; 3465 struct hci_request req; 3466 u32 selected_phys, configurable_phys, supported_phys, unconfigure_phys; 3467 u16 pkt_type = (HCI_DH1 | HCI_DM1); 3468 bool changed = false; 3469 int err; 3470 3471 bt_dev_dbg(hdev, "sock %p", sk); 3472 3473 configurable_phys = get_configurable_phys(hdev); 3474 supported_phys = get_supported_phys(hdev); 3475 selected_phys = __le32_to_cpu(cp->selected_phys); 3476 3477 if (selected_phys & ~supported_phys) 3478 return mgmt_cmd_status(sk, hdev->id, 3479 MGMT_OP_SET_PHY_CONFIGURATION, 3480 MGMT_STATUS_INVALID_PARAMS); 3481 3482 unconfigure_phys = supported_phys & ~configurable_phys; 3483 3484 if ((selected_phys & unconfigure_phys) != unconfigure_phys) 3485 return mgmt_cmd_status(sk, hdev->id, 3486 MGMT_OP_SET_PHY_CONFIGURATION, 3487 MGMT_STATUS_INVALID_PARAMS); 3488 3489 if (selected_phys == get_selected_phys(hdev)) 3490 return mgmt_cmd_complete(sk, hdev->id, 3491 MGMT_OP_SET_PHY_CONFIGURATION, 3492 0, NULL, 0); 3493 3494 hci_dev_lock(hdev); 3495 3496 if (!hdev_is_powered(hdev)) { 3497 err = mgmt_cmd_status(sk, hdev->id, 3498 MGMT_OP_SET_PHY_CONFIGURATION, 3499 MGMT_STATUS_REJECTED); 3500 goto unlock; 3501 } 3502 3503 if (pending_find(MGMT_OP_SET_PHY_CONFIGURATION, hdev)) { 3504 err = mgmt_cmd_status(sk, hdev->id, 3505 MGMT_OP_SET_PHY_CONFIGURATION, 3506 MGMT_STATUS_BUSY); 3507 goto unlock; 3508 } 3509 3510 if (selected_phys & MGMT_PHY_BR_1M_3SLOT) 3511 pkt_type |= (HCI_DH3 | HCI_DM3); 3512 else 3513 pkt_type &= ~(HCI_DH3 | HCI_DM3); 3514 3515 if (selected_phys & MGMT_PHY_BR_1M_5SLOT) 3516 pkt_type |= (HCI_DH5 | HCI_DM5); 3517 else 3518 pkt_type &= ~(HCI_DH5 | HCI_DM5); 3519 3520 if (selected_phys & MGMT_PHY_EDR_2M_1SLOT) 3521 pkt_type &= ~HCI_2DH1; 3522 else 3523 pkt_type |= HCI_2DH1; 3524 3525 if (selected_phys & MGMT_PHY_EDR_2M_3SLOT) 3526 pkt_type &= ~HCI_2DH3; 3527 else 3528 pkt_type |= HCI_2DH3; 3529 3530 if (selected_phys & MGMT_PHY_EDR_2M_5SLOT) 3531 pkt_type &= ~HCI_2DH5; 3532 else 3533 pkt_type |= HCI_2DH5; 3534 3535 if (selected_phys & MGMT_PHY_EDR_3M_1SLOT) 3536 pkt_type &= ~HCI_3DH1; 3537 else 3538 pkt_type |= HCI_3DH1; 3539 3540 if (selected_phys & MGMT_PHY_EDR_3M_3SLOT) 3541 pkt_type &= ~HCI_3DH3; 3542 else 3543 pkt_type |= HCI_3DH3; 3544 3545 if (selected_phys & MGMT_PHY_EDR_3M_5SLOT) 3546 pkt_type &= ~HCI_3DH5; 3547 else 3548 pkt_type |= HCI_3DH5; 3549 3550 if (pkt_type != hdev->pkt_type) { 3551 hdev->pkt_type = pkt_type; 3552 changed = true; 3553 } 3554 3555 if ((selected_phys & MGMT_PHY_LE_MASK) == 3556 (get_selected_phys(hdev) & MGMT_PHY_LE_MASK)) { 3557 if (changed) 3558 mgmt_phy_configuration_changed(hdev, sk); 3559 3560 err = mgmt_cmd_complete(sk, hdev->id, 3561 MGMT_OP_SET_PHY_CONFIGURATION, 3562 0, NULL, 0); 3563 3564 goto unlock; 3565 } 3566 3567 cmd = mgmt_pending_add(sk, MGMT_OP_SET_PHY_CONFIGURATION, hdev, data, 3568 len); 3569 if (!cmd) { 3570 err = -ENOMEM; 3571 goto unlock; 3572 } 3573 3574 hci_req_init(&req, hdev); 3575 3576 memset(&cp_phy, 0, sizeof(cp_phy)); 3577 3578 if (!(selected_phys & MGMT_PHY_LE_TX_MASK)) 3579 cp_phy.all_phys |= 0x01; 3580 3581 if (!(selected_phys & MGMT_PHY_LE_RX_MASK)) 3582 cp_phy.all_phys |= 0x02; 3583 3584 if (selected_phys & MGMT_PHY_LE_1M_TX) 3585 cp_phy.tx_phys |= HCI_LE_SET_PHY_1M; 3586 3587 if (selected_phys & MGMT_PHY_LE_2M_TX) 3588 cp_phy.tx_phys |= HCI_LE_SET_PHY_2M; 3589 3590 if (selected_phys & MGMT_PHY_LE_CODED_TX) 3591 cp_phy.tx_phys |= HCI_LE_SET_PHY_CODED; 3592 3593 if (selected_phys & MGMT_PHY_LE_1M_RX) 3594 cp_phy.rx_phys |= HCI_LE_SET_PHY_1M; 3595 3596 if (selected_phys & MGMT_PHY_LE_2M_RX) 3597 cp_phy.rx_phys |= HCI_LE_SET_PHY_2M; 3598 3599 if (selected_phys & MGMT_PHY_LE_CODED_RX) 3600 cp_phy.rx_phys |= HCI_LE_SET_PHY_CODED; 3601 3602 hci_req_add(&req, HCI_OP_LE_SET_DEFAULT_PHY, sizeof(cp_phy), &cp_phy); 3603 3604 err = hci_req_run_skb(&req, set_default_phy_complete); 3605 if (err < 0) 3606 mgmt_pending_remove(cmd); 3607 3608 unlock: 3609 hci_dev_unlock(hdev); 3610 3611 return err; 3612 } 3613 3614 static int set_blocked_keys(struct sock *sk, struct hci_dev *hdev, void *data, 3615 u16 len) 3616 { 3617 int err = MGMT_STATUS_SUCCESS; 3618 struct mgmt_cp_set_blocked_keys *keys = data; 3619 const u16 max_key_count = ((U16_MAX - sizeof(*keys)) / 3620 sizeof(struct mgmt_blocked_key_info)); 3621 u16 key_count, expected_len; 3622 int i; 3623 3624 bt_dev_dbg(hdev, "sock %p", sk); 3625 3626 key_count = __le16_to_cpu(keys->key_count); 3627 if (key_count > max_key_count) { 3628 bt_dev_err(hdev, "too big key_count value %u", key_count); 3629 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BLOCKED_KEYS, 3630 MGMT_STATUS_INVALID_PARAMS); 3631 } 3632 3633 expected_len = struct_size(keys, keys, key_count); 3634 if (expected_len != len) { 3635 bt_dev_err(hdev, "expected %u bytes, got %u bytes", 3636 expected_len, len); 3637 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BLOCKED_KEYS, 3638 MGMT_STATUS_INVALID_PARAMS); 3639 } 3640 3641 hci_dev_lock(hdev); 3642 3643 hci_blocked_keys_clear(hdev); 3644 3645 for (i = 0; i < keys->key_count; ++i) { 3646 struct blocked_key *b = kzalloc(sizeof(*b), GFP_KERNEL); 3647 3648 if (!b) { 3649 err = MGMT_STATUS_NO_RESOURCES; 3650 break; 3651 } 3652 3653 b->type = keys->keys[i].type; 3654 memcpy(b->val, keys->keys[i].val, sizeof(b->val)); 3655 list_add_rcu(&b->list, &hdev->blocked_keys); 3656 } 3657 hci_dev_unlock(hdev); 3658 3659 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_BLOCKED_KEYS, 3660 err, NULL, 0); 3661 } 3662 3663 static int set_wideband_speech(struct sock *sk, struct hci_dev *hdev, 3664 void *data, u16 len) 3665 { 3666 struct mgmt_mode *cp = data; 3667 int err; 3668 bool changed = false; 3669 3670 bt_dev_dbg(hdev, "sock %p", sk); 3671 3672 if (!test_bit(HCI_QUIRK_WIDEBAND_SPEECH_SUPPORTED, &hdev->quirks)) 3673 return mgmt_cmd_status(sk, hdev->id, 3674 MGMT_OP_SET_WIDEBAND_SPEECH, 3675 MGMT_STATUS_NOT_SUPPORTED); 3676 3677 if (cp->val != 0x00 && cp->val != 0x01) 3678 return mgmt_cmd_status(sk, hdev->id, 3679 MGMT_OP_SET_WIDEBAND_SPEECH, 3680 MGMT_STATUS_INVALID_PARAMS); 3681 3682 hci_dev_lock(hdev); 3683 3684 if (pending_find(MGMT_OP_SET_WIDEBAND_SPEECH, hdev)) { 3685 err = mgmt_cmd_status(sk, hdev->id, 3686 MGMT_OP_SET_WIDEBAND_SPEECH, 3687 MGMT_STATUS_BUSY); 3688 goto unlock; 3689 } 3690 3691 if (hdev_is_powered(hdev) && 3692 !!cp->val != hci_dev_test_flag(hdev, 3693 HCI_WIDEBAND_SPEECH_ENABLED)) { 3694 err = mgmt_cmd_status(sk, hdev->id, 3695 MGMT_OP_SET_WIDEBAND_SPEECH, 3696 MGMT_STATUS_REJECTED); 3697 goto unlock; 3698 } 3699 3700 if (cp->val) 3701 changed = !hci_dev_test_and_set_flag(hdev, 3702 HCI_WIDEBAND_SPEECH_ENABLED); 3703 else 3704 changed = hci_dev_test_and_clear_flag(hdev, 3705 HCI_WIDEBAND_SPEECH_ENABLED); 3706 3707 err = send_settings_rsp(sk, MGMT_OP_SET_WIDEBAND_SPEECH, hdev); 3708 if (err < 0) 3709 goto unlock; 3710 3711 if (changed) 3712 err = new_settings(hdev, sk); 3713 3714 unlock: 3715 hci_dev_unlock(hdev); 3716 return err; 3717 } 3718 3719 static int read_controller_cap(struct sock *sk, struct hci_dev *hdev, 3720 void *data, u16 data_len) 3721 { 3722 char buf[20]; 3723 struct mgmt_rp_read_controller_cap *rp = (void *)buf; 3724 u16 cap_len = 0; 3725 u8 flags = 0; 3726 u8 tx_power_range[2]; 3727 3728 bt_dev_dbg(hdev, "sock %p", sk); 3729 3730 memset(&buf, 0, sizeof(buf)); 3731 3732 hci_dev_lock(hdev); 3733 3734 /* When the Read Simple Pairing Options command is supported, then 3735 * the remote public key validation is supported. 3736 * 3737 * Alternatively, when Microsoft extensions are available, they can 3738 * indicate support for public key validation as well. 3739 */ 3740 if ((hdev->commands[41] & 0x08) || msft_curve_validity(hdev)) 3741 flags |= 0x01; /* Remote public key validation (BR/EDR) */ 3742 3743 flags |= 0x02; /* Remote public key validation (LE) */ 3744 3745 /* When the Read Encryption Key Size command is supported, then the 3746 * encryption key size is enforced. 3747 */ 3748 if (hdev->commands[20] & 0x10) 3749 flags |= 0x04; /* Encryption key size enforcement (BR/EDR) */ 3750 3751 flags |= 0x08; /* Encryption key size enforcement (LE) */ 3752 3753 cap_len = eir_append_data(rp->cap, cap_len, MGMT_CAP_SEC_FLAGS, 3754 &flags, 1); 3755 3756 /* When the Read Simple Pairing Options command is supported, then 3757 * also max encryption key size information is provided. 3758 */ 3759 if (hdev->commands[41] & 0x08) 3760 cap_len = eir_append_le16(rp->cap, cap_len, 3761 MGMT_CAP_MAX_ENC_KEY_SIZE, 3762 hdev->max_enc_key_size); 3763 3764 cap_len = eir_append_le16(rp->cap, cap_len, 3765 MGMT_CAP_SMP_MAX_ENC_KEY_SIZE, 3766 SMP_MAX_ENC_KEY_SIZE); 3767 3768 /* Append the min/max LE tx power parameters if we were able to fetch 3769 * it from the controller 3770 */ 3771 if (hdev->commands[38] & 0x80) { 3772 memcpy(&tx_power_range[0], &hdev->min_le_tx_power, 1); 3773 memcpy(&tx_power_range[1], &hdev->max_le_tx_power, 1); 3774 cap_len = eir_append_data(rp->cap, cap_len, MGMT_CAP_LE_TX_PWR, 3775 tx_power_range, 2); 3776 } 3777 3778 rp->cap_len = cpu_to_le16(cap_len); 3779 3780 hci_dev_unlock(hdev); 3781 3782 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_CONTROLLER_CAP, 0, 3783 rp, sizeof(*rp) + cap_len); 3784 } 3785 3786 #ifdef CONFIG_BT_FEATURE_DEBUG 3787 /* d4992530-b9ec-469f-ab01-6c481c47da1c */ 3788 static const u8 debug_uuid[16] = { 3789 0x1c, 0xda, 0x47, 0x1c, 0x48, 0x6c, 0x01, 0xab, 3790 0x9f, 0x46, 0xec, 0xb9, 0x30, 0x25, 0x99, 0xd4, 3791 }; 3792 #endif 3793 3794 /* 671b10b5-42c0-4696-9227-eb28d1b049d6 */ 3795 static const u8 simult_central_periph_uuid[16] = { 3796 0xd6, 0x49, 0xb0, 0xd1, 0x28, 0xeb, 0x27, 0x92, 3797 0x96, 0x46, 0xc0, 0x42, 0xb5, 0x10, 0x1b, 0x67, 3798 }; 3799 3800 /* 15c0a148-c273-11ea-b3de-0242ac130004 */ 3801 static const u8 rpa_resolution_uuid[16] = { 3802 0x04, 0x00, 0x13, 0xac, 0x42, 0x02, 0xde, 0xb3, 3803 0xea, 0x11, 0x73, 0xc2, 0x48, 0xa1, 0xc0, 0x15, 3804 }; 3805 3806 static int read_exp_features_info(struct sock *sk, struct hci_dev *hdev, 3807 void *data, u16 data_len) 3808 { 3809 char buf[62]; /* Enough space for 3 features */ 3810 struct mgmt_rp_read_exp_features_info *rp = (void *)buf; 3811 u16 idx = 0; 3812 u32 flags; 3813 3814 bt_dev_dbg(hdev, "sock %p", sk); 3815 3816 memset(&buf, 0, sizeof(buf)); 3817 3818 #ifdef CONFIG_BT_FEATURE_DEBUG 3819 if (!hdev) { 3820 flags = bt_dbg_get() ? BIT(0) : 0; 3821 3822 memcpy(rp->features[idx].uuid, debug_uuid, 16); 3823 rp->features[idx].flags = cpu_to_le32(flags); 3824 idx++; 3825 } 3826 #endif 3827 3828 if (hdev) { 3829 if (test_bit(HCI_QUIRK_VALID_LE_STATES, &hdev->quirks) && 3830 (hdev->le_states[4] & 0x08) && /* Central */ 3831 (hdev->le_states[4] & 0x40) && /* Peripheral */ 3832 (hdev->le_states[3] & 0x10)) /* Simultaneous */ 3833 flags = BIT(0); 3834 else 3835 flags = 0; 3836 3837 memcpy(rp->features[idx].uuid, simult_central_periph_uuid, 16); 3838 rp->features[idx].flags = cpu_to_le32(flags); 3839 idx++; 3840 } 3841 3842 if (hdev && use_ll_privacy(hdev)) { 3843 if (hci_dev_test_flag(hdev, HCI_ENABLE_LL_PRIVACY)) 3844 flags = BIT(0) | BIT(1); 3845 else 3846 flags = BIT(1); 3847 3848 memcpy(rp->features[idx].uuid, rpa_resolution_uuid, 16); 3849 rp->features[idx].flags = cpu_to_le32(flags); 3850 idx++; 3851 } 3852 3853 rp->feature_count = cpu_to_le16(idx); 3854 3855 /* After reading the experimental features information, enable 3856 * the events to update client on any future change. 3857 */ 3858 hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS); 3859 3860 return mgmt_cmd_complete(sk, hdev ? hdev->id : MGMT_INDEX_NONE, 3861 MGMT_OP_READ_EXP_FEATURES_INFO, 3862 0, rp, sizeof(*rp) + (20 * idx)); 3863 } 3864 3865 static int exp_ll_privacy_feature_changed(bool enabled, struct hci_dev *hdev, 3866 struct sock *skip) 3867 { 3868 struct mgmt_ev_exp_feature_changed ev; 3869 3870 memset(&ev, 0, sizeof(ev)); 3871 memcpy(ev.uuid, rpa_resolution_uuid, 16); 3872 ev.flags = cpu_to_le32((enabled ? BIT(0) : 0) | BIT(1)); 3873 3874 return mgmt_limited_event(MGMT_EV_EXP_FEATURE_CHANGED, hdev, 3875 &ev, sizeof(ev), 3876 HCI_MGMT_EXP_FEATURE_EVENTS, skip); 3877 3878 } 3879 3880 #ifdef CONFIG_BT_FEATURE_DEBUG 3881 static int exp_debug_feature_changed(bool enabled, struct sock *skip) 3882 { 3883 struct mgmt_ev_exp_feature_changed ev; 3884 3885 memset(&ev, 0, sizeof(ev)); 3886 memcpy(ev.uuid, debug_uuid, 16); 3887 ev.flags = cpu_to_le32(enabled ? BIT(0) : 0); 3888 3889 return mgmt_limited_event(MGMT_EV_EXP_FEATURE_CHANGED, NULL, 3890 &ev, sizeof(ev), 3891 HCI_MGMT_EXP_FEATURE_EVENTS, skip); 3892 } 3893 #endif 3894 3895 static int set_exp_feature(struct sock *sk, struct hci_dev *hdev, 3896 void *data, u16 data_len) 3897 { 3898 struct mgmt_cp_set_exp_feature *cp = data; 3899 struct mgmt_rp_set_exp_feature rp; 3900 3901 bt_dev_dbg(hdev, "sock %p", sk); 3902 3903 if (!memcmp(cp->uuid, ZERO_KEY, 16)) { 3904 memset(rp.uuid, 0, 16); 3905 rp.flags = cpu_to_le32(0); 3906 3907 #ifdef CONFIG_BT_FEATURE_DEBUG 3908 if (!hdev) { 3909 bool changed = bt_dbg_get(); 3910 3911 bt_dbg_set(false); 3912 3913 if (changed) 3914 exp_debug_feature_changed(false, sk); 3915 } 3916 #endif 3917 3918 if (hdev && use_ll_privacy(hdev) && !hdev_is_powered(hdev)) { 3919 bool changed = hci_dev_test_flag(hdev, 3920 HCI_ENABLE_LL_PRIVACY); 3921 3922 hci_dev_clear_flag(hdev, HCI_ENABLE_LL_PRIVACY); 3923 3924 if (changed) 3925 exp_ll_privacy_feature_changed(false, hdev, sk); 3926 } 3927 3928 hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS); 3929 3930 return mgmt_cmd_complete(sk, hdev ? hdev->id : MGMT_INDEX_NONE, 3931 MGMT_OP_SET_EXP_FEATURE, 0, 3932 &rp, sizeof(rp)); 3933 } 3934 3935 #ifdef CONFIG_BT_FEATURE_DEBUG 3936 if (!memcmp(cp->uuid, debug_uuid, 16)) { 3937 bool val, changed; 3938 int err; 3939 3940 /* Command requires to use the non-controller index */ 3941 if (hdev) 3942 return mgmt_cmd_status(sk, hdev->id, 3943 MGMT_OP_SET_EXP_FEATURE, 3944 MGMT_STATUS_INVALID_INDEX); 3945 3946 /* Parameters are limited to a single octet */ 3947 if (data_len != MGMT_SET_EXP_FEATURE_SIZE + 1) 3948 return mgmt_cmd_status(sk, MGMT_INDEX_NONE, 3949 MGMT_OP_SET_EXP_FEATURE, 3950 MGMT_STATUS_INVALID_PARAMS); 3951 3952 /* Only boolean on/off is supported */ 3953 if (cp->param[0] != 0x00 && cp->param[0] != 0x01) 3954 return mgmt_cmd_status(sk, MGMT_INDEX_NONE, 3955 MGMT_OP_SET_EXP_FEATURE, 3956 MGMT_STATUS_INVALID_PARAMS); 3957 3958 val = !!cp->param[0]; 3959 changed = val ? !bt_dbg_get() : bt_dbg_get(); 3960 bt_dbg_set(val); 3961 3962 memcpy(rp.uuid, debug_uuid, 16); 3963 rp.flags = cpu_to_le32(val ? BIT(0) : 0); 3964 3965 hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS); 3966 3967 err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE, 3968 MGMT_OP_SET_EXP_FEATURE, 0, 3969 &rp, sizeof(rp)); 3970 3971 if (changed) 3972 exp_debug_feature_changed(val, sk); 3973 3974 return err; 3975 } 3976 #endif 3977 3978 if (!memcmp(cp->uuid, rpa_resolution_uuid, 16)) { 3979 bool val, changed; 3980 int err; 3981 u32 flags; 3982 3983 /* Command requires to use the controller index */ 3984 if (!hdev) 3985 return mgmt_cmd_status(sk, MGMT_INDEX_NONE, 3986 MGMT_OP_SET_EXP_FEATURE, 3987 MGMT_STATUS_INVALID_INDEX); 3988 3989 /* Changes can only be made when controller is powered down */ 3990 if (hdev_is_powered(hdev)) 3991 return mgmt_cmd_status(sk, hdev->id, 3992 MGMT_OP_SET_EXP_FEATURE, 3993 MGMT_STATUS_REJECTED); 3994 3995 /* Parameters are limited to a single octet */ 3996 if (data_len != MGMT_SET_EXP_FEATURE_SIZE + 1) 3997 return mgmt_cmd_status(sk, hdev->id, 3998 MGMT_OP_SET_EXP_FEATURE, 3999 MGMT_STATUS_INVALID_PARAMS); 4000 4001 /* Only boolean on/off is supported */ 4002 if (cp->param[0] != 0x00 && cp->param[0] != 0x01) 4003 return mgmt_cmd_status(sk, hdev->id, 4004 MGMT_OP_SET_EXP_FEATURE, 4005 MGMT_STATUS_INVALID_PARAMS); 4006 4007 val = !!cp->param[0]; 4008 4009 if (val) { 4010 changed = !hci_dev_test_flag(hdev, 4011 HCI_ENABLE_LL_PRIVACY); 4012 hci_dev_set_flag(hdev, HCI_ENABLE_LL_PRIVACY); 4013 hci_dev_clear_flag(hdev, HCI_ADVERTISING); 4014 4015 /* Enable LL privacy + supported settings changed */ 4016 flags = BIT(0) | BIT(1); 4017 } else { 4018 changed = hci_dev_test_flag(hdev, 4019 HCI_ENABLE_LL_PRIVACY); 4020 hci_dev_clear_flag(hdev, HCI_ENABLE_LL_PRIVACY); 4021 4022 /* Disable LL privacy + supported settings changed */ 4023 flags = BIT(1); 4024 } 4025 4026 memcpy(rp.uuid, rpa_resolution_uuid, 16); 4027 rp.flags = cpu_to_le32(flags); 4028 4029 hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS); 4030 4031 err = mgmt_cmd_complete(sk, hdev->id, 4032 MGMT_OP_SET_EXP_FEATURE, 0, 4033 &rp, sizeof(rp)); 4034 4035 if (changed) 4036 exp_ll_privacy_feature_changed(val, hdev, sk); 4037 4038 return err; 4039 } 4040 4041 return mgmt_cmd_status(sk, hdev ? hdev->id : MGMT_INDEX_NONE, 4042 MGMT_OP_SET_EXP_FEATURE, 4043 MGMT_STATUS_NOT_SUPPORTED); 4044 } 4045 4046 #define SUPPORTED_DEVICE_FLAGS() ((1U << HCI_CONN_FLAG_MAX) - 1) 4047 4048 static int get_device_flags(struct sock *sk, struct hci_dev *hdev, void *data, 4049 u16 data_len) 4050 { 4051 struct mgmt_cp_get_device_flags *cp = data; 4052 struct mgmt_rp_get_device_flags rp; 4053 struct bdaddr_list_with_flags *br_params; 4054 struct hci_conn_params *params; 4055 u32 supported_flags = SUPPORTED_DEVICE_FLAGS(); 4056 u32 current_flags = 0; 4057 u8 status = MGMT_STATUS_INVALID_PARAMS; 4058 4059 bt_dev_dbg(hdev, "Get device flags %pMR (type 0x%x)\n", 4060 &cp->addr.bdaddr, cp->addr.type); 4061 4062 hci_dev_lock(hdev); 4063 4064 memset(&rp, 0, sizeof(rp)); 4065 4066 if (cp->addr.type == BDADDR_BREDR) { 4067 br_params = hci_bdaddr_list_lookup_with_flags(&hdev->accept_list, 4068 &cp->addr.bdaddr, 4069 cp->addr.type); 4070 if (!br_params) 4071 goto done; 4072 4073 current_flags = br_params->current_flags; 4074 } else { 4075 params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr, 4076 le_addr_type(cp->addr.type)); 4077 4078 if (!params) 4079 goto done; 4080 4081 current_flags = params->current_flags; 4082 } 4083 4084 bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr); 4085 rp.addr.type = cp->addr.type; 4086 rp.supported_flags = cpu_to_le32(supported_flags); 4087 rp.current_flags = cpu_to_le32(current_flags); 4088 4089 status = MGMT_STATUS_SUCCESS; 4090 4091 done: 4092 hci_dev_unlock(hdev); 4093 4094 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_DEVICE_FLAGS, status, 4095 &rp, sizeof(rp)); 4096 } 4097 4098 static void device_flags_changed(struct sock *sk, struct hci_dev *hdev, 4099 bdaddr_t *bdaddr, u8 bdaddr_type, 4100 u32 supported_flags, u32 current_flags) 4101 { 4102 struct mgmt_ev_device_flags_changed ev; 4103 4104 bacpy(&ev.addr.bdaddr, bdaddr); 4105 ev.addr.type = bdaddr_type; 4106 ev.supported_flags = cpu_to_le32(supported_flags); 4107 ev.current_flags = cpu_to_le32(current_flags); 4108 4109 mgmt_event(MGMT_EV_DEVICE_FLAGS_CHANGED, hdev, &ev, sizeof(ev), sk); 4110 } 4111 4112 static int set_device_flags(struct sock *sk, struct hci_dev *hdev, void *data, 4113 u16 len) 4114 { 4115 struct mgmt_cp_set_device_flags *cp = data; 4116 struct bdaddr_list_with_flags *br_params; 4117 struct hci_conn_params *params; 4118 u8 status = MGMT_STATUS_INVALID_PARAMS; 4119 u32 supported_flags = SUPPORTED_DEVICE_FLAGS(); 4120 u32 current_flags = __le32_to_cpu(cp->current_flags); 4121 4122 bt_dev_dbg(hdev, "Set device flags %pMR (type 0x%x) = 0x%x", 4123 &cp->addr.bdaddr, cp->addr.type, 4124 __le32_to_cpu(current_flags)); 4125 4126 if ((supported_flags | current_flags) != supported_flags) { 4127 bt_dev_warn(hdev, "Bad flag given (0x%x) vs supported (0x%0x)", 4128 current_flags, supported_flags); 4129 goto done; 4130 } 4131 4132 hci_dev_lock(hdev); 4133 4134 if (cp->addr.type == BDADDR_BREDR) { 4135 br_params = hci_bdaddr_list_lookup_with_flags(&hdev->accept_list, 4136 &cp->addr.bdaddr, 4137 cp->addr.type); 4138 4139 if (br_params) { 4140 br_params->current_flags = current_flags; 4141 status = MGMT_STATUS_SUCCESS; 4142 } else { 4143 bt_dev_warn(hdev, "No such BR/EDR device %pMR (0x%x)", 4144 &cp->addr.bdaddr, cp->addr.type); 4145 } 4146 } else { 4147 params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr, 4148 le_addr_type(cp->addr.type)); 4149 if (params) { 4150 params->current_flags = current_flags; 4151 status = MGMT_STATUS_SUCCESS; 4152 } else { 4153 bt_dev_warn(hdev, "No such LE device %pMR (0x%x)", 4154 &cp->addr.bdaddr, 4155 le_addr_type(cp->addr.type)); 4156 } 4157 } 4158 4159 done: 4160 hci_dev_unlock(hdev); 4161 4162 if (status == MGMT_STATUS_SUCCESS) 4163 device_flags_changed(sk, hdev, &cp->addr.bdaddr, cp->addr.type, 4164 supported_flags, current_flags); 4165 4166 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_DEVICE_FLAGS, status, 4167 &cp->addr, sizeof(cp->addr)); 4168 } 4169 4170 static void mgmt_adv_monitor_added(struct sock *sk, struct hci_dev *hdev, 4171 u16 handle) 4172 { 4173 struct mgmt_ev_adv_monitor_added ev; 4174 4175 ev.monitor_handle = cpu_to_le16(handle); 4176 4177 mgmt_event(MGMT_EV_ADV_MONITOR_ADDED, hdev, &ev, sizeof(ev), sk); 4178 } 4179 4180 void mgmt_adv_monitor_removed(struct hci_dev *hdev, u16 handle) 4181 { 4182 struct mgmt_ev_adv_monitor_removed ev; 4183 struct mgmt_pending_cmd *cmd; 4184 struct sock *sk_skip = NULL; 4185 struct mgmt_cp_remove_adv_monitor *cp; 4186 4187 cmd = pending_find(MGMT_OP_REMOVE_ADV_MONITOR, hdev); 4188 if (cmd) { 4189 cp = cmd->param; 4190 4191 if (cp->monitor_handle) 4192 sk_skip = cmd->sk; 4193 } 4194 4195 ev.monitor_handle = cpu_to_le16(handle); 4196 4197 mgmt_event(MGMT_EV_ADV_MONITOR_REMOVED, hdev, &ev, sizeof(ev), sk_skip); 4198 } 4199 4200 static int read_adv_mon_features(struct sock *sk, struct hci_dev *hdev, 4201 void *data, u16 len) 4202 { 4203 struct adv_monitor *monitor = NULL; 4204 struct mgmt_rp_read_adv_monitor_features *rp = NULL; 4205 int handle, err; 4206 size_t rp_size = 0; 4207 __u32 supported = 0; 4208 __u32 enabled = 0; 4209 __u16 num_handles = 0; 4210 __u16 handles[HCI_MAX_ADV_MONITOR_NUM_HANDLES]; 4211 4212 BT_DBG("request for %s", hdev->name); 4213 4214 hci_dev_lock(hdev); 4215 4216 if (msft_monitor_supported(hdev)) 4217 supported |= MGMT_ADV_MONITOR_FEATURE_MASK_OR_PATTERNS; 4218 4219 idr_for_each_entry(&hdev->adv_monitors_idr, monitor, handle) 4220 handles[num_handles++] = monitor->handle; 4221 4222 hci_dev_unlock(hdev); 4223 4224 rp_size = sizeof(*rp) + (num_handles * sizeof(u16)); 4225 rp = kmalloc(rp_size, GFP_KERNEL); 4226 if (!rp) 4227 return -ENOMEM; 4228 4229 /* All supported features are currently enabled */ 4230 enabled = supported; 4231 4232 rp->supported_features = cpu_to_le32(supported); 4233 rp->enabled_features = cpu_to_le32(enabled); 4234 rp->max_num_handles = cpu_to_le16(HCI_MAX_ADV_MONITOR_NUM_HANDLES); 4235 rp->max_num_patterns = HCI_MAX_ADV_MONITOR_NUM_PATTERNS; 4236 rp->num_handles = cpu_to_le16(num_handles); 4237 if (num_handles) 4238 memcpy(&rp->handles, &handles, (num_handles * sizeof(u16))); 4239 4240 err = mgmt_cmd_complete(sk, hdev->id, 4241 MGMT_OP_READ_ADV_MONITOR_FEATURES, 4242 MGMT_STATUS_SUCCESS, rp, rp_size); 4243 4244 kfree(rp); 4245 4246 return err; 4247 } 4248 4249 int mgmt_add_adv_patterns_monitor_complete(struct hci_dev *hdev, u8 status) 4250 { 4251 struct mgmt_rp_add_adv_patterns_monitor rp; 4252 struct mgmt_pending_cmd *cmd; 4253 struct adv_monitor *monitor; 4254 int err = 0; 4255 4256 hci_dev_lock(hdev); 4257 4258 cmd = pending_find(MGMT_OP_ADD_ADV_PATTERNS_MONITOR_RSSI, hdev); 4259 if (!cmd) { 4260 cmd = pending_find(MGMT_OP_ADD_ADV_PATTERNS_MONITOR, hdev); 4261 if (!cmd) 4262 goto done; 4263 } 4264 4265 monitor = cmd->user_data; 4266 rp.monitor_handle = cpu_to_le16(monitor->handle); 4267 4268 if (!status) { 4269 mgmt_adv_monitor_added(cmd->sk, hdev, monitor->handle); 4270 hdev->adv_monitors_cnt++; 4271 if (monitor->state == ADV_MONITOR_STATE_NOT_REGISTERED) 4272 monitor->state = ADV_MONITOR_STATE_REGISTERED; 4273 hci_update_background_scan(hdev); 4274 } 4275 4276 err = mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, 4277 mgmt_status(status), &rp, sizeof(rp)); 4278 mgmt_pending_remove(cmd); 4279 4280 done: 4281 hci_dev_unlock(hdev); 4282 bt_dev_dbg(hdev, "add monitor %d complete, status %u", 4283 rp.monitor_handle, status); 4284 4285 return err; 4286 } 4287 4288 static int __add_adv_patterns_monitor(struct sock *sk, struct hci_dev *hdev, 4289 struct adv_monitor *m, u8 status, 4290 void *data, u16 len, u16 op) 4291 { 4292 struct mgmt_rp_add_adv_patterns_monitor rp; 4293 struct mgmt_pending_cmd *cmd; 4294 int err; 4295 bool pending; 4296 4297 hci_dev_lock(hdev); 4298 4299 if (status) 4300 goto unlock; 4301 4302 if (pending_find(MGMT_OP_SET_LE, hdev) || 4303 pending_find(MGMT_OP_ADD_ADV_PATTERNS_MONITOR, hdev) || 4304 pending_find(MGMT_OP_ADD_ADV_PATTERNS_MONITOR_RSSI, hdev) || 4305 pending_find(MGMT_OP_REMOVE_ADV_MONITOR, hdev)) { 4306 status = MGMT_STATUS_BUSY; 4307 goto unlock; 4308 } 4309 4310 cmd = mgmt_pending_add(sk, op, hdev, data, len); 4311 if (!cmd) { 4312 status = MGMT_STATUS_NO_RESOURCES; 4313 goto unlock; 4314 } 4315 4316 cmd->user_data = m; 4317 pending = hci_add_adv_monitor(hdev, m, &err); 4318 if (err) { 4319 if (err == -ENOSPC || err == -ENOMEM) 4320 status = MGMT_STATUS_NO_RESOURCES; 4321 else if (err == -EINVAL) 4322 status = MGMT_STATUS_INVALID_PARAMS; 4323 else 4324 status = MGMT_STATUS_FAILED; 4325 4326 mgmt_pending_remove(cmd); 4327 goto unlock; 4328 } 4329 4330 if (!pending) { 4331 mgmt_pending_remove(cmd); 4332 rp.monitor_handle = cpu_to_le16(m->handle); 4333 mgmt_adv_monitor_added(sk, hdev, m->handle); 4334 m->state = ADV_MONITOR_STATE_REGISTERED; 4335 hdev->adv_monitors_cnt++; 4336 4337 hci_dev_unlock(hdev); 4338 return mgmt_cmd_complete(sk, hdev->id, op, MGMT_STATUS_SUCCESS, 4339 &rp, sizeof(rp)); 4340 } 4341 4342 hci_dev_unlock(hdev); 4343 4344 return 0; 4345 4346 unlock: 4347 hci_free_adv_monitor(hdev, m); 4348 hci_dev_unlock(hdev); 4349 return mgmt_cmd_status(sk, hdev->id, op, status); 4350 } 4351 4352 static void parse_adv_monitor_rssi(struct adv_monitor *m, 4353 struct mgmt_adv_rssi_thresholds *rssi) 4354 { 4355 if (rssi) { 4356 m->rssi.low_threshold = rssi->low_threshold; 4357 m->rssi.low_threshold_timeout = 4358 __le16_to_cpu(rssi->low_threshold_timeout); 4359 m->rssi.high_threshold = rssi->high_threshold; 4360 m->rssi.high_threshold_timeout = 4361 __le16_to_cpu(rssi->high_threshold_timeout); 4362 m->rssi.sampling_period = rssi->sampling_period; 4363 } else { 4364 /* Default values. These numbers are the least constricting 4365 * parameters for MSFT API to work, so it behaves as if there 4366 * are no rssi parameter to consider. May need to be changed 4367 * if other API are to be supported. 4368 */ 4369 m->rssi.low_threshold = -127; 4370 m->rssi.low_threshold_timeout = 60; 4371 m->rssi.high_threshold = -127; 4372 m->rssi.high_threshold_timeout = 0; 4373 m->rssi.sampling_period = 0; 4374 } 4375 } 4376 4377 static u8 parse_adv_monitor_pattern(struct adv_monitor *m, u8 pattern_count, 4378 struct mgmt_adv_pattern *patterns) 4379 { 4380 u8 offset = 0, length = 0; 4381 struct adv_pattern *p = NULL; 4382 int i; 4383 4384 for (i = 0; i < pattern_count; i++) { 4385 offset = patterns[i].offset; 4386 length = patterns[i].length; 4387 if (offset >= HCI_MAX_AD_LENGTH || 4388 length > HCI_MAX_AD_LENGTH || 4389 (offset + length) > HCI_MAX_AD_LENGTH) 4390 return MGMT_STATUS_INVALID_PARAMS; 4391 4392 p = kmalloc(sizeof(*p), GFP_KERNEL); 4393 if (!p) 4394 return MGMT_STATUS_NO_RESOURCES; 4395 4396 p->ad_type = patterns[i].ad_type; 4397 p->offset = patterns[i].offset; 4398 p->length = patterns[i].length; 4399 memcpy(p->value, patterns[i].value, p->length); 4400 4401 INIT_LIST_HEAD(&p->list); 4402 list_add(&p->list, &m->patterns); 4403 } 4404 4405 return MGMT_STATUS_SUCCESS; 4406 } 4407 4408 static int add_adv_patterns_monitor(struct sock *sk, struct hci_dev *hdev, 4409 void *data, u16 len) 4410 { 4411 struct mgmt_cp_add_adv_patterns_monitor *cp = data; 4412 struct adv_monitor *m = NULL; 4413 u8 status = MGMT_STATUS_SUCCESS; 4414 size_t expected_size = sizeof(*cp); 4415 4416 BT_DBG("request for %s", hdev->name); 4417 4418 if (len <= sizeof(*cp)) { 4419 status = MGMT_STATUS_INVALID_PARAMS; 4420 goto done; 4421 } 4422 4423 expected_size += cp->pattern_count * sizeof(struct mgmt_adv_pattern); 4424 if (len != expected_size) { 4425 status = MGMT_STATUS_INVALID_PARAMS; 4426 goto done; 4427 } 4428 4429 m = kzalloc(sizeof(*m), GFP_KERNEL); 4430 if (!m) { 4431 status = MGMT_STATUS_NO_RESOURCES; 4432 goto done; 4433 } 4434 4435 INIT_LIST_HEAD(&m->patterns); 4436 4437 parse_adv_monitor_rssi(m, NULL); 4438 status = parse_adv_monitor_pattern(m, cp->pattern_count, cp->patterns); 4439 4440 done: 4441 return __add_adv_patterns_monitor(sk, hdev, m, status, data, len, 4442 MGMT_OP_ADD_ADV_PATTERNS_MONITOR); 4443 } 4444 4445 static int add_adv_patterns_monitor_rssi(struct sock *sk, struct hci_dev *hdev, 4446 void *data, u16 len) 4447 { 4448 struct mgmt_cp_add_adv_patterns_monitor_rssi *cp = data; 4449 struct adv_monitor *m = NULL; 4450 u8 status = MGMT_STATUS_SUCCESS; 4451 size_t expected_size = sizeof(*cp); 4452 4453 BT_DBG("request for %s", hdev->name); 4454 4455 if (len <= sizeof(*cp)) { 4456 status = MGMT_STATUS_INVALID_PARAMS; 4457 goto done; 4458 } 4459 4460 expected_size += cp->pattern_count * sizeof(struct mgmt_adv_pattern); 4461 if (len != expected_size) { 4462 status = MGMT_STATUS_INVALID_PARAMS; 4463 goto done; 4464 } 4465 4466 m = kzalloc(sizeof(*m), GFP_KERNEL); 4467 if (!m) { 4468 status = MGMT_STATUS_NO_RESOURCES; 4469 goto done; 4470 } 4471 4472 INIT_LIST_HEAD(&m->patterns); 4473 4474 parse_adv_monitor_rssi(m, &cp->rssi); 4475 status = parse_adv_monitor_pattern(m, cp->pattern_count, cp->patterns); 4476 4477 done: 4478 return __add_adv_patterns_monitor(sk, hdev, m, status, data, len, 4479 MGMT_OP_ADD_ADV_PATTERNS_MONITOR_RSSI); 4480 } 4481 4482 int mgmt_remove_adv_monitor_complete(struct hci_dev *hdev, u8 status) 4483 { 4484 struct mgmt_rp_remove_adv_monitor rp; 4485 struct mgmt_cp_remove_adv_monitor *cp; 4486 struct mgmt_pending_cmd *cmd; 4487 int err = 0; 4488 4489 hci_dev_lock(hdev); 4490 4491 cmd = pending_find(MGMT_OP_REMOVE_ADV_MONITOR, hdev); 4492 if (!cmd) 4493 goto done; 4494 4495 cp = cmd->param; 4496 rp.monitor_handle = cp->monitor_handle; 4497 4498 if (!status) 4499 hci_update_background_scan(hdev); 4500 4501 err = mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, 4502 mgmt_status(status), &rp, sizeof(rp)); 4503 mgmt_pending_remove(cmd); 4504 4505 done: 4506 hci_dev_unlock(hdev); 4507 bt_dev_dbg(hdev, "remove monitor %d complete, status %u", 4508 rp.monitor_handle, status); 4509 4510 return err; 4511 } 4512 4513 static int remove_adv_monitor(struct sock *sk, struct hci_dev *hdev, 4514 void *data, u16 len) 4515 { 4516 struct mgmt_cp_remove_adv_monitor *cp = data; 4517 struct mgmt_rp_remove_adv_monitor rp; 4518 struct mgmt_pending_cmd *cmd; 4519 u16 handle = __le16_to_cpu(cp->monitor_handle); 4520 int err, status; 4521 bool pending; 4522 4523 BT_DBG("request for %s", hdev->name); 4524 rp.monitor_handle = cp->monitor_handle; 4525 4526 hci_dev_lock(hdev); 4527 4528 if (pending_find(MGMT_OP_SET_LE, hdev) || 4529 pending_find(MGMT_OP_REMOVE_ADV_MONITOR, hdev) || 4530 pending_find(MGMT_OP_ADD_ADV_PATTERNS_MONITOR, hdev) || 4531 pending_find(MGMT_OP_ADD_ADV_PATTERNS_MONITOR_RSSI, hdev)) { 4532 status = MGMT_STATUS_BUSY; 4533 goto unlock; 4534 } 4535 4536 cmd = mgmt_pending_add(sk, MGMT_OP_REMOVE_ADV_MONITOR, hdev, data, len); 4537 if (!cmd) { 4538 status = MGMT_STATUS_NO_RESOURCES; 4539 goto unlock; 4540 } 4541 4542 if (handle) 4543 pending = hci_remove_single_adv_monitor(hdev, handle, &err); 4544 else 4545 pending = hci_remove_all_adv_monitor(hdev, &err); 4546 4547 if (err) { 4548 mgmt_pending_remove(cmd); 4549 4550 if (err == -ENOENT) 4551 status = MGMT_STATUS_INVALID_INDEX; 4552 else 4553 status = MGMT_STATUS_FAILED; 4554 4555 goto unlock; 4556 } 4557 4558 /* monitor can be removed without forwarding request to controller */ 4559 if (!pending) { 4560 mgmt_pending_remove(cmd); 4561 hci_dev_unlock(hdev); 4562 4563 return mgmt_cmd_complete(sk, hdev->id, 4564 MGMT_OP_REMOVE_ADV_MONITOR, 4565 MGMT_STATUS_SUCCESS, 4566 &rp, sizeof(rp)); 4567 } 4568 4569 hci_dev_unlock(hdev); 4570 return 0; 4571 4572 unlock: 4573 hci_dev_unlock(hdev); 4574 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_ADV_MONITOR, 4575 status); 4576 } 4577 4578 static void read_local_oob_data_complete(struct hci_dev *hdev, u8 status, 4579 u16 opcode, struct sk_buff *skb) 4580 { 4581 struct mgmt_rp_read_local_oob_data mgmt_rp; 4582 size_t rp_size = sizeof(mgmt_rp); 4583 struct mgmt_pending_cmd *cmd; 4584 4585 bt_dev_dbg(hdev, "status %u", status); 4586 4587 cmd = pending_find(MGMT_OP_READ_LOCAL_OOB_DATA, hdev); 4588 if (!cmd) 4589 return; 4590 4591 if (status || !skb) { 4592 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA, 4593 status ? mgmt_status(status) : MGMT_STATUS_FAILED); 4594 goto remove; 4595 } 4596 4597 memset(&mgmt_rp, 0, sizeof(mgmt_rp)); 4598 4599 if (opcode == HCI_OP_READ_LOCAL_OOB_DATA) { 4600 struct hci_rp_read_local_oob_data *rp = (void *) skb->data; 4601 4602 if (skb->len < sizeof(*rp)) { 4603 mgmt_cmd_status(cmd->sk, hdev->id, 4604 MGMT_OP_READ_LOCAL_OOB_DATA, 4605 MGMT_STATUS_FAILED); 4606 goto remove; 4607 } 4608 4609 memcpy(mgmt_rp.hash192, rp->hash, sizeof(rp->hash)); 4610 memcpy(mgmt_rp.rand192, rp->rand, sizeof(rp->rand)); 4611 4612 rp_size -= sizeof(mgmt_rp.hash256) + sizeof(mgmt_rp.rand256); 4613 } else { 4614 struct hci_rp_read_local_oob_ext_data *rp = (void *) skb->data; 4615 4616 if (skb->len < sizeof(*rp)) { 4617 mgmt_cmd_status(cmd->sk, hdev->id, 4618 MGMT_OP_READ_LOCAL_OOB_DATA, 4619 MGMT_STATUS_FAILED); 4620 goto remove; 4621 } 4622 4623 memcpy(mgmt_rp.hash192, rp->hash192, sizeof(rp->hash192)); 4624 memcpy(mgmt_rp.rand192, rp->rand192, sizeof(rp->rand192)); 4625 4626 memcpy(mgmt_rp.hash256, rp->hash256, sizeof(rp->hash256)); 4627 memcpy(mgmt_rp.rand256, rp->rand256, sizeof(rp->rand256)); 4628 } 4629 4630 mgmt_cmd_complete(cmd->sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA, 4631 MGMT_STATUS_SUCCESS, &mgmt_rp, rp_size); 4632 4633 remove: 4634 mgmt_pending_remove(cmd); 4635 } 4636 4637 static int read_local_oob_data(struct sock *sk, struct hci_dev *hdev, 4638 void *data, u16 data_len) 4639 { 4640 struct mgmt_pending_cmd *cmd; 4641 struct hci_request req; 4642 int err; 4643 4644 bt_dev_dbg(hdev, "sock %p", sk); 4645 4646 hci_dev_lock(hdev); 4647 4648 if (!hdev_is_powered(hdev)) { 4649 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA, 4650 MGMT_STATUS_NOT_POWERED); 4651 goto unlock; 4652 } 4653 4654 if (!lmp_ssp_capable(hdev)) { 4655 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA, 4656 MGMT_STATUS_NOT_SUPPORTED); 4657 goto unlock; 4658 } 4659 4660 if (pending_find(MGMT_OP_READ_LOCAL_OOB_DATA, hdev)) { 4661 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA, 4662 MGMT_STATUS_BUSY); 4663 goto unlock; 4664 } 4665 4666 cmd = mgmt_pending_add(sk, MGMT_OP_READ_LOCAL_OOB_DATA, hdev, NULL, 0); 4667 if (!cmd) { 4668 err = -ENOMEM; 4669 goto unlock; 4670 } 4671 4672 hci_req_init(&req, hdev); 4673 4674 if (bredr_sc_enabled(hdev)) 4675 hci_req_add(&req, HCI_OP_READ_LOCAL_OOB_EXT_DATA, 0, NULL); 4676 else 4677 hci_req_add(&req, HCI_OP_READ_LOCAL_OOB_DATA, 0, NULL); 4678 4679 err = hci_req_run_skb(&req, read_local_oob_data_complete); 4680 if (err < 0) 4681 mgmt_pending_remove(cmd); 4682 4683 unlock: 4684 hci_dev_unlock(hdev); 4685 return err; 4686 } 4687 4688 static int add_remote_oob_data(struct sock *sk, struct hci_dev *hdev, 4689 void *data, u16 len) 4690 { 4691 struct mgmt_addr_info *addr = data; 4692 int err; 4693 4694 bt_dev_dbg(hdev, "sock %p", sk); 4695 4696 if (!bdaddr_type_is_valid(addr->type)) 4697 return mgmt_cmd_complete(sk, hdev->id, 4698 MGMT_OP_ADD_REMOTE_OOB_DATA, 4699 MGMT_STATUS_INVALID_PARAMS, 4700 addr, sizeof(*addr)); 4701 4702 hci_dev_lock(hdev); 4703 4704 if (len == MGMT_ADD_REMOTE_OOB_DATA_SIZE) { 4705 struct mgmt_cp_add_remote_oob_data *cp = data; 4706 u8 status; 4707 4708 if (cp->addr.type != BDADDR_BREDR) { 4709 err = mgmt_cmd_complete(sk, hdev->id, 4710 MGMT_OP_ADD_REMOTE_OOB_DATA, 4711 MGMT_STATUS_INVALID_PARAMS, 4712 &cp->addr, sizeof(cp->addr)); 4713 goto unlock; 4714 } 4715 4716 err = hci_add_remote_oob_data(hdev, &cp->addr.bdaddr, 4717 cp->addr.type, cp->hash, 4718 cp->rand, NULL, NULL); 4719 if (err < 0) 4720 status = MGMT_STATUS_FAILED; 4721 else 4722 status = MGMT_STATUS_SUCCESS; 4723 4724 err = mgmt_cmd_complete(sk, hdev->id, 4725 MGMT_OP_ADD_REMOTE_OOB_DATA, status, 4726 &cp->addr, sizeof(cp->addr)); 4727 } else if (len == MGMT_ADD_REMOTE_OOB_EXT_DATA_SIZE) { 4728 struct mgmt_cp_add_remote_oob_ext_data *cp = data; 4729 u8 *rand192, *hash192, *rand256, *hash256; 4730 u8 status; 4731 4732 if (bdaddr_type_is_le(cp->addr.type)) { 4733 /* Enforce zero-valued 192-bit parameters as 4734 * long as legacy SMP OOB isn't implemented. 4735 */ 4736 if (memcmp(cp->rand192, ZERO_KEY, 16) || 4737 memcmp(cp->hash192, ZERO_KEY, 16)) { 4738 err = mgmt_cmd_complete(sk, hdev->id, 4739 MGMT_OP_ADD_REMOTE_OOB_DATA, 4740 MGMT_STATUS_INVALID_PARAMS, 4741 addr, sizeof(*addr)); 4742 goto unlock; 4743 } 4744 4745 rand192 = NULL; 4746 hash192 = NULL; 4747 } else { 4748 /* In case one of the P-192 values is set to zero, 4749 * then just disable OOB data for P-192. 4750 */ 4751 if (!memcmp(cp->rand192, ZERO_KEY, 16) || 4752 !memcmp(cp->hash192, ZERO_KEY, 16)) { 4753 rand192 = NULL; 4754 hash192 = NULL; 4755 } else { 4756 rand192 = cp->rand192; 4757 hash192 = cp->hash192; 4758 } 4759 } 4760 4761 /* In case one of the P-256 values is set to zero, then just 4762 * disable OOB data for P-256. 4763 */ 4764 if (!memcmp(cp->rand256, ZERO_KEY, 16) || 4765 !memcmp(cp->hash256, ZERO_KEY, 16)) { 4766 rand256 = NULL; 4767 hash256 = NULL; 4768 } else { 4769 rand256 = cp->rand256; 4770 hash256 = cp->hash256; 4771 } 4772 4773 err = hci_add_remote_oob_data(hdev, &cp->addr.bdaddr, 4774 cp->addr.type, hash192, rand192, 4775 hash256, rand256); 4776 if (err < 0) 4777 status = MGMT_STATUS_FAILED; 4778 else 4779 status = MGMT_STATUS_SUCCESS; 4780 4781 err = mgmt_cmd_complete(sk, hdev->id, 4782 MGMT_OP_ADD_REMOTE_OOB_DATA, 4783 status, &cp->addr, sizeof(cp->addr)); 4784 } else { 4785 bt_dev_err(hdev, "add_remote_oob_data: invalid len of %u bytes", 4786 len); 4787 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_REMOTE_OOB_DATA, 4788 MGMT_STATUS_INVALID_PARAMS); 4789 } 4790 4791 unlock: 4792 hci_dev_unlock(hdev); 4793 return err; 4794 } 4795 4796 static int remove_remote_oob_data(struct sock *sk, struct hci_dev *hdev, 4797 void *data, u16 len) 4798 { 4799 struct mgmt_cp_remove_remote_oob_data *cp = data; 4800 u8 status; 4801 int err; 4802 4803 bt_dev_dbg(hdev, "sock %p", sk); 4804 4805 if (cp->addr.type != BDADDR_BREDR) 4806 return mgmt_cmd_complete(sk, hdev->id, 4807 MGMT_OP_REMOVE_REMOTE_OOB_DATA, 4808 MGMT_STATUS_INVALID_PARAMS, 4809 &cp->addr, sizeof(cp->addr)); 4810 4811 hci_dev_lock(hdev); 4812 4813 if (!bacmp(&cp->addr.bdaddr, BDADDR_ANY)) { 4814 hci_remote_oob_data_clear(hdev); 4815 status = MGMT_STATUS_SUCCESS; 4816 goto done; 4817 } 4818 4819 err = hci_remove_remote_oob_data(hdev, &cp->addr.bdaddr, cp->addr.type); 4820 if (err < 0) 4821 status = MGMT_STATUS_INVALID_PARAMS; 4822 else 4823 status = MGMT_STATUS_SUCCESS; 4824 4825 done: 4826 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_REMOTE_OOB_DATA, 4827 status, &cp->addr, sizeof(cp->addr)); 4828 4829 hci_dev_unlock(hdev); 4830 return err; 4831 } 4832 4833 void mgmt_start_discovery_complete(struct hci_dev *hdev, u8 status) 4834 { 4835 struct mgmt_pending_cmd *cmd; 4836 4837 bt_dev_dbg(hdev, "status %u", status); 4838 4839 hci_dev_lock(hdev); 4840 4841 cmd = pending_find(MGMT_OP_START_DISCOVERY, hdev); 4842 if (!cmd) 4843 cmd = pending_find(MGMT_OP_START_SERVICE_DISCOVERY, hdev); 4844 4845 if (!cmd) 4846 cmd = pending_find(MGMT_OP_START_LIMITED_DISCOVERY, hdev); 4847 4848 if (cmd) { 4849 cmd->cmd_complete(cmd, mgmt_status(status)); 4850 mgmt_pending_remove(cmd); 4851 } 4852 4853 hci_dev_unlock(hdev); 4854 4855 /* Handle suspend notifier */ 4856 if (test_and_clear_bit(SUSPEND_UNPAUSE_DISCOVERY, 4857 hdev->suspend_tasks)) { 4858 bt_dev_dbg(hdev, "Unpaused discovery"); 4859 wake_up(&hdev->suspend_wait_q); 4860 } 4861 } 4862 4863 static bool discovery_type_is_valid(struct hci_dev *hdev, uint8_t type, 4864 uint8_t *mgmt_status) 4865 { 4866 switch (type) { 4867 case DISCOV_TYPE_LE: 4868 *mgmt_status = mgmt_le_support(hdev); 4869 if (*mgmt_status) 4870 return false; 4871 break; 4872 case DISCOV_TYPE_INTERLEAVED: 4873 *mgmt_status = mgmt_le_support(hdev); 4874 if (*mgmt_status) 4875 return false; 4876 fallthrough; 4877 case DISCOV_TYPE_BREDR: 4878 *mgmt_status = mgmt_bredr_support(hdev); 4879 if (*mgmt_status) 4880 return false; 4881 break; 4882 default: 4883 *mgmt_status = MGMT_STATUS_INVALID_PARAMS; 4884 return false; 4885 } 4886 4887 return true; 4888 } 4889 4890 static int start_discovery_internal(struct sock *sk, struct hci_dev *hdev, 4891 u16 op, void *data, u16 len) 4892 { 4893 struct mgmt_cp_start_discovery *cp = data; 4894 struct mgmt_pending_cmd *cmd; 4895 u8 status; 4896 int err; 4897 4898 bt_dev_dbg(hdev, "sock %p", sk); 4899 4900 hci_dev_lock(hdev); 4901 4902 if (!hdev_is_powered(hdev)) { 4903 err = mgmt_cmd_complete(sk, hdev->id, op, 4904 MGMT_STATUS_NOT_POWERED, 4905 &cp->type, sizeof(cp->type)); 4906 goto failed; 4907 } 4908 4909 if (hdev->discovery.state != DISCOVERY_STOPPED || 4910 hci_dev_test_flag(hdev, HCI_PERIODIC_INQ)) { 4911 err = mgmt_cmd_complete(sk, hdev->id, op, MGMT_STATUS_BUSY, 4912 &cp->type, sizeof(cp->type)); 4913 goto failed; 4914 } 4915 4916 if (!discovery_type_is_valid(hdev, cp->type, &status)) { 4917 err = mgmt_cmd_complete(sk, hdev->id, op, status, 4918 &cp->type, sizeof(cp->type)); 4919 goto failed; 4920 } 4921 4922 /* Can't start discovery when it is paused */ 4923 if (hdev->discovery_paused) { 4924 err = mgmt_cmd_complete(sk, hdev->id, op, MGMT_STATUS_BUSY, 4925 &cp->type, sizeof(cp->type)); 4926 goto failed; 4927 } 4928 4929 /* Clear the discovery filter first to free any previously 4930 * allocated memory for the UUID list. 4931 */ 4932 hci_discovery_filter_clear(hdev); 4933 4934 hdev->discovery.type = cp->type; 4935 hdev->discovery.report_invalid_rssi = false; 4936 if (op == MGMT_OP_START_LIMITED_DISCOVERY) 4937 hdev->discovery.limited = true; 4938 else 4939 hdev->discovery.limited = false; 4940 4941 cmd = mgmt_pending_add(sk, op, hdev, data, len); 4942 if (!cmd) { 4943 err = -ENOMEM; 4944 goto failed; 4945 } 4946 4947 cmd->cmd_complete = generic_cmd_complete; 4948 4949 hci_discovery_set_state(hdev, DISCOVERY_STARTING); 4950 queue_work(hdev->req_workqueue, &hdev->discov_update); 4951 err = 0; 4952 4953 failed: 4954 hci_dev_unlock(hdev); 4955 return err; 4956 } 4957 4958 static int start_discovery(struct sock *sk, struct hci_dev *hdev, 4959 void *data, u16 len) 4960 { 4961 return start_discovery_internal(sk, hdev, MGMT_OP_START_DISCOVERY, 4962 data, len); 4963 } 4964 4965 static int start_limited_discovery(struct sock *sk, struct hci_dev *hdev, 4966 void *data, u16 len) 4967 { 4968 return start_discovery_internal(sk, hdev, 4969 MGMT_OP_START_LIMITED_DISCOVERY, 4970 data, len); 4971 } 4972 4973 static int service_discovery_cmd_complete(struct mgmt_pending_cmd *cmd, 4974 u8 status) 4975 { 4976 return mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, status, 4977 cmd->param, 1); 4978 } 4979 4980 static int start_service_discovery(struct sock *sk, struct hci_dev *hdev, 4981 void *data, u16 len) 4982 { 4983 struct mgmt_cp_start_service_discovery *cp = data; 4984 struct mgmt_pending_cmd *cmd; 4985 const u16 max_uuid_count = ((U16_MAX - sizeof(*cp)) / 16); 4986 u16 uuid_count, expected_len; 4987 u8 status; 4988 int err; 4989 4990 bt_dev_dbg(hdev, "sock %p", sk); 4991 4992 hci_dev_lock(hdev); 4993 4994 if (!hdev_is_powered(hdev)) { 4995 err = mgmt_cmd_complete(sk, hdev->id, 4996 MGMT_OP_START_SERVICE_DISCOVERY, 4997 MGMT_STATUS_NOT_POWERED, 4998 &cp->type, sizeof(cp->type)); 4999 goto failed; 5000 } 5001 5002 if (hdev->discovery.state != DISCOVERY_STOPPED || 5003 hci_dev_test_flag(hdev, HCI_PERIODIC_INQ)) { 5004 err = mgmt_cmd_complete(sk, hdev->id, 5005 MGMT_OP_START_SERVICE_DISCOVERY, 5006 MGMT_STATUS_BUSY, &cp->type, 5007 sizeof(cp->type)); 5008 goto failed; 5009 } 5010 5011 if (hdev->discovery_paused) { 5012 err = mgmt_cmd_complete(sk, hdev->id, 5013 MGMT_OP_START_SERVICE_DISCOVERY, 5014 MGMT_STATUS_BUSY, &cp->type, 5015 sizeof(cp->type)); 5016 goto failed; 5017 } 5018 5019 uuid_count = __le16_to_cpu(cp->uuid_count); 5020 if (uuid_count > max_uuid_count) { 5021 bt_dev_err(hdev, "service_discovery: too big uuid_count value %u", 5022 uuid_count); 5023 err = mgmt_cmd_complete(sk, hdev->id, 5024 MGMT_OP_START_SERVICE_DISCOVERY, 5025 MGMT_STATUS_INVALID_PARAMS, &cp->type, 5026 sizeof(cp->type)); 5027 goto failed; 5028 } 5029 5030 expected_len = sizeof(*cp) + uuid_count * 16; 5031 if (expected_len != len) { 5032 bt_dev_err(hdev, "service_discovery: expected %u bytes, got %u bytes", 5033 expected_len, len); 5034 err = mgmt_cmd_complete(sk, hdev->id, 5035 MGMT_OP_START_SERVICE_DISCOVERY, 5036 MGMT_STATUS_INVALID_PARAMS, &cp->type, 5037 sizeof(cp->type)); 5038 goto failed; 5039 } 5040 5041 if (!discovery_type_is_valid(hdev, cp->type, &status)) { 5042 err = mgmt_cmd_complete(sk, hdev->id, 5043 MGMT_OP_START_SERVICE_DISCOVERY, 5044 status, &cp->type, sizeof(cp->type)); 5045 goto failed; 5046 } 5047 5048 cmd = mgmt_pending_add(sk, MGMT_OP_START_SERVICE_DISCOVERY, 5049 hdev, data, len); 5050 if (!cmd) { 5051 err = -ENOMEM; 5052 goto failed; 5053 } 5054 5055 cmd->cmd_complete = service_discovery_cmd_complete; 5056 5057 /* Clear the discovery filter first to free any previously 5058 * allocated memory for the UUID list. 5059 */ 5060 hci_discovery_filter_clear(hdev); 5061 5062 hdev->discovery.result_filtering = true; 5063 hdev->discovery.type = cp->type; 5064 hdev->discovery.rssi = cp->rssi; 5065 hdev->discovery.uuid_count = uuid_count; 5066 5067 if (uuid_count > 0) { 5068 hdev->discovery.uuids = kmemdup(cp->uuids, uuid_count * 16, 5069 GFP_KERNEL); 5070 if (!hdev->discovery.uuids) { 5071 err = mgmt_cmd_complete(sk, hdev->id, 5072 MGMT_OP_START_SERVICE_DISCOVERY, 5073 MGMT_STATUS_FAILED, 5074 &cp->type, sizeof(cp->type)); 5075 mgmt_pending_remove(cmd); 5076 goto failed; 5077 } 5078 } 5079 5080 hci_discovery_set_state(hdev, DISCOVERY_STARTING); 5081 queue_work(hdev->req_workqueue, &hdev->discov_update); 5082 err = 0; 5083 5084 failed: 5085 hci_dev_unlock(hdev); 5086 return err; 5087 } 5088 5089 void mgmt_stop_discovery_complete(struct hci_dev *hdev, u8 status) 5090 { 5091 struct mgmt_pending_cmd *cmd; 5092 5093 bt_dev_dbg(hdev, "status %u", status); 5094 5095 hci_dev_lock(hdev); 5096 5097 cmd = pending_find(MGMT_OP_STOP_DISCOVERY, hdev); 5098 if (cmd) { 5099 cmd->cmd_complete(cmd, mgmt_status(status)); 5100 mgmt_pending_remove(cmd); 5101 } 5102 5103 hci_dev_unlock(hdev); 5104 5105 /* Handle suspend notifier */ 5106 if (test_and_clear_bit(SUSPEND_PAUSE_DISCOVERY, hdev->suspend_tasks)) { 5107 bt_dev_dbg(hdev, "Paused discovery"); 5108 wake_up(&hdev->suspend_wait_q); 5109 } 5110 } 5111 5112 static int stop_discovery(struct sock *sk, struct hci_dev *hdev, void *data, 5113 u16 len) 5114 { 5115 struct mgmt_cp_stop_discovery *mgmt_cp = data; 5116 struct mgmt_pending_cmd *cmd; 5117 int err; 5118 5119 bt_dev_dbg(hdev, "sock %p", sk); 5120 5121 hci_dev_lock(hdev); 5122 5123 if (!hci_discovery_active(hdev)) { 5124 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY, 5125 MGMT_STATUS_REJECTED, &mgmt_cp->type, 5126 sizeof(mgmt_cp->type)); 5127 goto unlock; 5128 } 5129 5130 if (hdev->discovery.type != mgmt_cp->type) { 5131 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY, 5132 MGMT_STATUS_INVALID_PARAMS, 5133 &mgmt_cp->type, sizeof(mgmt_cp->type)); 5134 goto unlock; 5135 } 5136 5137 cmd = mgmt_pending_add(sk, MGMT_OP_STOP_DISCOVERY, hdev, data, len); 5138 if (!cmd) { 5139 err = -ENOMEM; 5140 goto unlock; 5141 } 5142 5143 cmd->cmd_complete = generic_cmd_complete; 5144 5145 hci_discovery_set_state(hdev, DISCOVERY_STOPPING); 5146 queue_work(hdev->req_workqueue, &hdev->discov_update); 5147 err = 0; 5148 5149 unlock: 5150 hci_dev_unlock(hdev); 5151 return err; 5152 } 5153 5154 static int confirm_name(struct sock *sk, struct hci_dev *hdev, void *data, 5155 u16 len) 5156 { 5157 struct mgmt_cp_confirm_name *cp = data; 5158 struct inquiry_entry *e; 5159 int err; 5160 5161 bt_dev_dbg(hdev, "sock %p", sk); 5162 5163 hci_dev_lock(hdev); 5164 5165 if (!hci_discovery_active(hdev)) { 5166 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME, 5167 MGMT_STATUS_FAILED, &cp->addr, 5168 sizeof(cp->addr)); 5169 goto failed; 5170 } 5171 5172 e = hci_inquiry_cache_lookup_unknown(hdev, &cp->addr.bdaddr); 5173 if (!e) { 5174 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME, 5175 MGMT_STATUS_INVALID_PARAMS, &cp->addr, 5176 sizeof(cp->addr)); 5177 goto failed; 5178 } 5179 5180 if (cp->name_known) { 5181 e->name_state = NAME_KNOWN; 5182 list_del(&e->list); 5183 } else { 5184 e->name_state = NAME_NEEDED; 5185 hci_inquiry_cache_update_resolve(hdev, e); 5186 } 5187 5188 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME, 0, 5189 &cp->addr, sizeof(cp->addr)); 5190 5191 failed: 5192 hci_dev_unlock(hdev); 5193 return err; 5194 } 5195 5196 static int block_device(struct sock *sk, struct hci_dev *hdev, void *data, 5197 u16 len) 5198 { 5199 struct mgmt_cp_block_device *cp = data; 5200 u8 status; 5201 int err; 5202 5203 bt_dev_dbg(hdev, "sock %p", sk); 5204 5205 if (!bdaddr_type_is_valid(cp->addr.type)) 5206 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_BLOCK_DEVICE, 5207 MGMT_STATUS_INVALID_PARAMS, 5208 &cp->addr, sizeof(cp->addr)); 5209 5210 hci_dev_lock(hdev); 5211 5212 err = hci_bdaddr_list_add(&hdev->reject_list, &cp->addr.bdaddr, 5213 cp->addr.type); 5214 if (err < 0) { 5215 status = MGMT_STATUS_FAILED; 5216 goto done; 5217 } 5218 5219 mgmt_event(MGMT_EV_DEVICE_BLOCKED, hdev, &cp->addr, sizeof(cp->addr), 5220 sk); 5221 status = MGMT_STATUS_SUCCESS; 5222 5223 done: 5224 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_BLOCK_DEVICE, status, 5225 &cp->addr, sizeof(cp->addr)); 5226 5227 hci_dev_unlock(hdev); 5228 5229 return err; 5230 } 5231 5232 static int unblock_device(struct sock *sk, struct hci_dev *hdev, void *data, 5233 u16 len) 5234 { 5235 struct mgmt_cp_unblock_device *cp = data; 5236 u8 status; 5237 int err; 5238 5239 bt_dev_dbg(hdev, "sock %p", sk); 5240 5241 if (!bdaddr_type_is_valid(cp->addr.type)) 5242 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNBLOCK_DEVICE, 5243 MGMT_STATUS_INVALID_PARAMS, 5244 &cp->addr, sizeof(cp->addr)); 5245 5246 hci_dev_lock(hdev); 5247 5248 err = hci_bdaddr_list_del(&hdev->reject_list, &cp->addr.bdaddr, 5249 cp->addr.type); 5250 if (err < 0) { 5251 status = MGMT_STATUS_INVALID_PARAMS; 5252 goto done; 5253 } 5254 5255 mgmt_event(MGMT_EV_DEVICE_UNBLOCKED, hdev, &cp->addr, sizeof(cp->addr), 5256 sk); 5257 status = MGMT_STATUS_SUCCESS; 5258 5259 done: 5260 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNBLOCK_DEVICE, status, 5261 &cp->addr, sizeof(cp->addr)); 5262 5263 hci_dev_unlock(hdev); 5264 5265 return err; 5266 } 5267 5268 static int set_device_id(struct sock *sk, struct hci_dev *hdev, void *data, 5269 u16 len) 5270 { 5271 struct mgmt_cp_set_device_id *cp = data; 5272 struct hci_request req; 5273 int err; 5274 __u16 source; 5275 5276 bt_dev_dbg(hdev, "sock %p", sk); 5277 5278 source = __le16_to_cpu(cp->source); 5279 5280 if (source > 0x0002) 5281 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEVICE_ID, 5282 MGMT_STATUS_INVALID_PARAMS); 5283 5284 hci_dev_lock(hdev); 5285 5286 hdev->devid_source = source; 5287 hdev->devid_vendor = __le16_to_cpu(cp->vendor); 5288 hdev->devid_product = __le16_to_cpu(cp->product); 5289 hdev->devid_version = __le16_to_cpu(cp->version); 5290 5291 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_DEVICE_ID, 0, 5292 NULL, 0); 5293 5294 hci_req_init(&req, hdev); 5295 __hci_req_update_eir(&req); 5296 hci_req_run(&req, NULL); 5297 5298 hci_dev_unlock(hdev); 5299 5300 return err; 5301 } 5302 5303 static void enable_advertising_instance(struct hci_dev *hdev, u8 status, 5304 u16 opcode) 5305 { 5306 bt_dev_dbg(hdev, "status %u", status); 5307 } 5308 5309 static void set_advertising_complete(struct hci_dev *hdev, u8 status, 5310 u16 opcode) 5311 { 5312 struct cmd_lookup match = { NULL, hdev }; 5313 struct hci_request req; 5314 u8 instance; 5315 struct adv_info *adv_instance; 5316 int err; 5317 5318 hci_dev_lock(hdev); 5319 5320 if (status) { 5321 u8 mgmt_err = mgmt_status(status); 5322 5323 mgmt_pending_foreach(MGMT_OP_SET_ADVERTISING, hdev, 5324 cmd_status_rsp, &mgmt_err); 5325 goto unlock; 5326 } 5327 5328 if (hci_dev_test_flag(hdev, HCI_LE_ADV)) 5329 hci_dev_set_flag(hdev, HCI_ADVERTISING); 5330 else 5331 hci_dev_clear_flag(hdev, HCI_ADVERTISING); 5332 5333 mgmt_pending_foreach(MGMT_OP_SET_ADVERTISING, hdev, settings_rsp, 5334 &match); 5335 5336 new_settings(hdev, match.sk); 5337 5338 if (match.sk) 5339 sock_put(match.sk); 5340 5341 /* Handle suspend notifier */ 5342 if (test_and_clear_bit(SUSPEND_PAUSE_ADVERTISING, 5343 hdev->suspend_tasks)) { 5344 bt_dev_dbg(hdev, "Paused advertising"); 5345 wake_up(&hdev->suspend_wait_q); 5346 } else if (test_and_clear_bit(SUSPEND_UNPAUSE_ADVERTISING, 5347 hdev->suspend_tasks)) { 5348 bt_dev_dbg(hdev, "Unpaused advertising"); 5349 wake_up(&hdev->suspend_wait_q); 5350 } 5351 5352 /* If "Set Advertising" was just disabled and instance advertising was 5353 * set up earlier, then re-enable multi-instance advertising. 5354 */ 5355 if (hci_dev_test_flag(hdev, HCI_ADVERTISING) || 5356 list_empty(&hdev->adv_instances)) 5357 goto unlock; 5358 5359 instance = hdev->cur_adv_instance; 5360 if (!instance) { 5361 adv_instance = list_first_entry_or_null(&hdev->adv_instances, 5362 struct adv_info, list); 5363 if (!adv_instance) 5364 goto unlock; 5365 5366 instance = adv_instance->instance; 5367 } 5368 5369 hci_req_init(&req, hdev); 5370 5371 err = __hci_req_schedule_adv_instance(&req, instance, true); 5372 5373 if (!err) 5374 err = hci_req_run(&req, enable_advertising_instance); 5375 5376 if (err) 5377 bt_dev_err(hdev, "failed to re-configure advertising"); 5378 5379 unlock: 5380 hci_dev_unlock(hdev); 5381 } 5382 5383 static int set_advertising(struct sock *sk, struct hci_dev *hdev, void *data, 5384 u16 len) 5385 { 5386 struct mgmt_mode *cp = data; 5387 struct mgmt_pending_cmd *cmd; 5388 struct hci_request req; 5389 u8 val, status; 5390 int err; 5391 5392 bt_dev_dbg(hdev, "sock %p", sk); 5393 5394 status = mgmt_le_support(hdev); 5395 if (status) 5396 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING, 5397 status); 5398 5399 /* Enabling the experimental LL Privay support disables support for 5400 * advertising. 5401 */ 5402 if (hci_dev_test_flag(hdev, HCI_ENABLE_LL_PRIVACY)) 5403 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING, 5404 MGMT_STATUS_NOT_SUPPORTED); 5405 5406 if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02) 5407 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING, 5408 MGMT_STATUS_INVALID_PARAMS); 5409 5410 if (hdev->advertising_paused) 5411 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING, 5412 MGMT_STATUS_BUSY); 5413 5414 hci_dev_lock(hdev); 5415 5416 val = !!cp->val; 5417 5418 /* The following conditions are ones which mean that we should 5419 * not do any HCI communication but directly send a mgmt 5420 * response to user space (after toggling the flag if 5421 * necessary). 5422 */ 5423 if (!hdev_is_powered(hdev) || 5424 (val == hci_dev_test_flag(hdev, HCI_ADVERTISING) && 5425 (cp->val == 0x02) == hci_dev_test_flag(hdev, HCI_ADVERTISING_CONNECTABLE)) || 5426 hci_conn_num(hdev, LE_LINK) > 0 || 5427 (hci_dev_test_flag(hdev, HCI_LE_SCAN) && 5428 hdev->le_scan_type == LE_SCAN_ACTIVE)) { 5429 bool changed; 5430 5431 if (cp->val) { 5432 hdev->cur_adv_instance = 0x00; 5433 changed = !hci_dev_test_and_set_flag(hdev, HCI_ADVERTISING); 5434 if (cp->val == 0x02) 5435 hci_dev_set_flag(hdev, HCI_ADVERTISING_CONNECTABLE); 5436 else 5437 hci_dev_clear_flag(hdev, HCI_ADVERTISING_CONNECTABLE); 5438 } else { 5439 changed = hci_dev_test_and_clear_flag(hdev, HCI_ADVERTISING); 5440 hci_dev_clear_flag(hdev, HCI_ADVERTISING_CONNECTABLE); 5441 } 5442 5443 err = send_settings_rsp(sk, MGMT_OP_SET_ADVERTISING, hdev); 5444 if (err < 0) 5445 goto unlock; 5446 5447 if (changed) 5448 err = new_settings(hdev, sk); 5449 5450 goto unlock; 5451 } 5452 5453 if (pending_find(MGMT_OP_SET_ADVERTISING, hdev) || 5454 pending_find(MGMT_OP_SET_LE, hdev)) { 5455 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING, 5456 MGMT_STATUS_BUSY); 5457 goto unlock; 5458 } 5459 5460 cmd = mgmt_pending_add(sk, MGMT_OP_SET_ADVERTISING, hdev, data, len); 5461 if (!cmd) { 5462 err = -ENOMEM; 5463 goto unlock; 5464 } 5465 5466 hci_req_init(&req, hdev); 5467 5468 if (cp->val == 0x02) 5469 hci_dev_set_flag(hdev, HCI_ADVERTISING_CONNECTABLE); 5470 else 5471 hci_dev_clear_flag(hdev, HCI_ADVERTISING_CONNECTABLE); 5472 5473 cancel_adv_timeout(hdev); 5474 5475 if (val) { 5476 /* Switch to instance "0" for the Set Advertising setting. 5477 * We cannot use update_[adv|scan_rsp]_data() here as the 5478 * HCI_ADVERTISING flag is not yet set. 5479 */ 5480 hdev->cur_adv_instance = 0x00; 5481 5482 if (ext_adv_capable(hdev)) { 5483 __hci_req_start_ext_adv(&req, 0x00); 5484 } else { 5485 __hci_req_update_adv_data(&req, 0x00); 5486 __hci_req_update_scan_rsp_data(&req, 0x00); 5487 __hci_req_enable_advertising(&req); 5488 } 5489 } else { 5490 __hci_req_disable_advertising(&req); 5491 } 5492 5493 err = hci_req_run(&req, set_advertising_complete); 5494 if (err < 0) 5495 mgmt_pending_remove(cmd); 5496 5497 unlock: 5498 hci_dev_unlock(hdev); 5499 return err; 5500 } 5501 5502 static int set_static_address(struct sock *sk, struct hci_dev *hdev, 5503 void *data, u16 len) 5504 { 5505 struct mgmt_cp_set_static_address *cp = data; 5506 int err; 5507 5508 bt_dev_dbg(hdev, "sock %p", sk); 5509 5510 if (!lmp_le_capable(hdev)) 5511 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_STATIC_ADDRESS, 5512 MGMT_STATUS_NOT_SUPPORTED); 5513 5514 if (hdev_is_powered(hdev)) 5515 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_STATIC_ADDRESS, 5516 MGMT_STATUS_REJECTED); 5517 5518 if (bacmp(&cp->bdaddr, BDADDR_ANY)) { 5519 if (!bacmp(&cp->bdaddr, BDADDR_NONE)) 5520 return mgmt_cmd_status(sk, hdev->id, 5521 MGMT_OP_SET_STATIC_ADDRESS, 5522 MGMT_STATUS_INVALID_PARAMS); 5523 5524 /* Two most significant bits shall be set */ 5525 if ((cp->bdaddr.b[5] & 0xc0) != 0xc0) 5526 return mgmt_cmd_status(sk, hdev->id, 5527 MGMT_OP_SET_STATIC_ADDRESS, 5528 MGMT_STATUS_INVALID_PARAMS); 5529 } 5530 5531 hci_dev_lock(hdev); 5532 5533 bacpy(&hdev->static_addr, &cp->bdaddr); 5534 5535 err = send_settings_rsp(sk, MGMT_OP_SET_STATIC_ADDRESS, hdev); 5536 if (err < 0) 5537 goto unlock; 5538 5539 err = new_settings(hdev, sk); 5540 5541 unlock: 5542 hci_dev_unlock(hdev); 5543 return err; 5544 } 5545 5546 static int set_scan_params(struct sock *sk, struct hci_dev *hdev, 5547 void *data, u16 len) 5548 { 5549 struct mgmt_cp_set_scan_params *cp = data; 5550 __u16 interval, window; 5551 int err; 5552 5553 bt_dev_dbg(hdev, "sock %p", sk); 5554 5555 if (!lmp_le_capable(hdev)) 5556 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS, 5557 MGMT_STATUS_NOT_SUPPORTED); 5558 5559 interval = __le16_to_cpu(cp->interval); 5560 5561 if (interval < 0x0004 || interval > 0x4000) 5562 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS, 5563 MGMT_STATUS_INVALID_PARAMS); 5564 5565 window = __le16_to_cpu(cp->window); 5566 5567 if (window < 0x0004 || window > 0x4000) 5568 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS, 5569 MGMT_STATUS_INVALID_PARAMS); 5570 5571 if (window > interval) 5572 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS, 5573 MGMT_STATUS_INVALID_PARAMS); 5574 5575 hci_dev_lock(hdev); 5576 5577 hdev->le_scan_interval = interval; 5578 hdev->le_scan_window = window; 5579 5580 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS, 0, 5581 NULL, 0); 5582 5583 /* If background scan is running, restart it so new parameters are 5584 * loaded. 5585 */ 5586 if (hci_dev_test_flag(hdev, HCI_LE_SCAN) && 5587 hdev->discovery.state == DISCOVERY_STOPPED) { 5588 struct hci_request req; 5589 5590 hci_req_init(&req, hdev); 5591 5592 hci_req_add_le_scan_disable(&req, false); 5593 hci_req_add_le_passive_scan(&req); 5594 5595 hci_req_run(&req, NULL); 5596 } 5597 5598 hci_dev_unlock(hdev); 5599 5600 return err; 5601 } 5602 5603 static void fast_connectable_complete(struct hci_dev *hdev, u8 status, 5604 u16 opcode) 5605 { 5606 struct mgmt_pending_cmd *cmd; 5607 5608 bt_dev_dbg(hdev, "status 0x%02x", status); 5609 5610 hci_dev_lock(hdev); 5611 5612 cmd = pending_find(MGMT_OP_SET_FAST_CONNECTABLE, hdev); 5613 if (!cmd) 5614 goto unlock; 5615 5616 if (status) { 5617 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE, 5618 mgmt_status(status)); 5619 } else { 5620 struct mgmt_mode *cp = cmd->param; 5621 5622 if (cp->val) 5623 hci_dev_set_flag(hdev, HCI_FAST_CONNECTABLE); 5624 else 5625 hci_dev_clear_flag(hdev, HCI_FAST_CONNECTABLE); 5626 5627 send_settings_rsp(cmd->sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev); 5628 new_settings(hdev, cmd->sk); 5629 } 5630 5631 mgmt_pending_remove(cmd); 5632 5633 unlock: 5634 hci_dev_unlock(hdev); 5635 } 5636 5637 static int set_fast_connectable(struct sock *sk, struct hci_dev *hdev, 5638 void *data, u16 len) 5639 { 5640 struct mgmt_mode *cp = data; 5641 struct mgmt_pending_cmd *cmd; 5642 struct hci_request req; 5643 int err; 5644 5645 bt_dev_dbg(hdev, "sock %p", sk); 5646 5647 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) || 5648 hdev->hci_ver < BLUETOOTH_VER_1_2) 5649 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE, 5650 MGMT_STATUS_NOT_SUPPORTED); 5651 5652 if (cp->val != 0x00 && cp->val != 0x01) 5653 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE, 5654 MGMT_STATUS_INVALID_PARAMS); 5655 5656 hci_dev_lock(hdev); 5657 5658 if (pending_find(MGMT_OP_SET_FAST_CONNECTABLE, hdev)) { 5659 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE, 5660 MGMT_STATUS_BUSY); 5661 goto unlock; 5662 } 5663 5664 if (!!cp->val == hci_dev_test_flag(hdev, HCI_FAST_CONNECTABLE)) { 5665 err = send_settings_rsp(sk, MGMT_OP_SET_FAST_CONNECTABLE, 5666 hdev); 5667 goto unlock; 5668 } 5669 5670 if (!hdev_is_powered(hdev)) { 5671 hci_dev_change_flag(hdev, HCI_FAST_CONNECTABLE); 5672 err = send_settings_rsp(sk, MGMT_OP_SET_FAST_CONNECTABLE, 5673 hdev); 5674 new_settings(hdev, sk); 5675 goto unlock; 5676 } 5677 5678 cmd = mgmt_pending_add(sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev, 5679 data, len); 5680 if (!cmd) { 5681 err = -ENOMEM; 5682 goto unlock; 5683 } 5684 5685 hci_req_init(&req, hdev); 5686 5687 __hci_req_write_fast_connectable(&req, cp->val); 5688 5689 err = hci_req_run(&req, fast_connectable_complete); 5690 if (err < 0) { 5691 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE, 5692 MGMT_STATUS_FAILED); 5693 mgmt_pending_remove(cmd); 5694 } 5695 5696 unlock: 5697 hci_dev_unlock(hdev); 5698 5699 return err; 5700 } 5701 5702 static void set_bredr_complete(struct hci_dev *hdev, u8 status, u16 opcode) 5703 { 5704 struct mgmt_pending_cmd *cmd; 5705 5706 bt_dev_dbg(hdev, "status 0x%02x", status); 5707 5708 hci_dev_lock(hdev); 5709 5710 cmd = pending_find(MGMT_OP_SET_BREDR, hdev); 5711 if (!cmd) 5712 goto unlock; 5713 5714 if (status) { 5715 u8 mgmt_err = mgmt_status(status); 5716 5717 /* We need to restore the flag if related HCI commands 5718 * failed. 5719 */ 5720 hci_dev_clear_flag(hdev, HCI_BREDR_ENABLED); 5721 5722 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err); 5723 } else { 5724 send_settings_rsp(cmd->sk, MGMT_OP_SET_BREDR, hdev); 5725 new_settings(hdev, cmd->sk); 5726 } 5727 5728 mgmt_pending_remove(cmd); 5729 5730 unlock: 5731 hci_dev_unlock(hdev); 5732 } 5733 5734 static int set_bredr(struct sock *sk, struct hci_dev *hdev, void *data, u16 len) 5735 { 5736 struct mgmt_mode *cp = data; 5737 struct mgmt_pending_cmd *cmd; 5738 struct hci_request req; 5739 int err; 5740 5741 bt_dev_dbg(hdev, "sock %p", sk); 5742 5743 if (!lmp_bredr_capable(hdev) || !lmp_le_capable(hdev)) 5744 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR, 5745 MGMT_STATUS_NOT_SUPPORTED); 5746 5747 if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED)) 5748 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR, 5749 MGMT_STATUS_REJECTED); 5750 5751 if (cp->val != 0x00 && cp->val != 0x01) 5752 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR, 5753 MGMT_STATUS_INVALID_PARAMS); 5754 5755 hci_dev_lock(hdev); 5756 5757 if (cp->val == hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) { 5758 err = send_settings_rsp(sk, MGMT_OP_SET_BREDR, hdev); 5759 goto unlock; 5760 } 5761 5762 if (!hdev_is_powered(hdev)) { 5763 if (!cp->val) { 5764 hci_dev_clear_flag(hdev, HCI_DISCOVERABLE); 5765 hci_dev_clear_flag(hdev, HCI_SSP_ENABLED); 5766 hci_dev_clear_flag(hdev, HCI_LINK_SECURITY); 5767 hci_dev_clear_flag(hdev, HCI_FAST_CONNECTABLE); 5768 hci_dev_clear_flag(hdev, HCI_HS_ENABLED); 5769 } 5770 5771 hci_dev_change_flag(hdev, HCI_BREDR_ENABLED); 5772 5773 err = send_settings_rsp(sk, MGMT_OP_SET_BREDR, hdev); 5774 if (err < 0) 5775 goto unlock; 5776 5777 err = new_settings(hdev, sk); 5778 goto unlock; 5779 } 5780 5781 /* Reject disabling when powered on */ 5782 if (!cp->val) { 5783 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR, 5784 MGMT_STATUS_REJECTED); 5785 goto unlock; 5786 } else { 5787 /* When configuring a dual-mode controller to operate 5788 * with LE only and using a static address, then switching 5789 * BR/EDR back on is not allowed. 5790 * 5791 * Dual-mode controllers shall operate with the public 5792 * address as its identity address for BR/EDR and LE. So 5793 * reject the attempt to create an invalid configuration. 5794 * 5795 * The same restrictions applies when secure connections 5796 * has been enabled. For BR/EDR this is a controller feature 5797 * while for LE it is a host stack feature. This means that 5798 * switching BR/EDR back on when secure connections has been 5799 * enabled is not a supported transaction. 5800 */ 5801 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) && 5802 (bacmp(&hdev->static_addr, BDADDR_ANY) || 5803 hci_dev_test_flag(hdev, HCI_SC_ENABLED))) { 5804 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR, 5805 MGMT_STATUS_REJECTED); 5806 goto unlock; 5807 } 5808 } 5809 5810 if (pending_find(MGMT_OP_SET_BREDR, hdev)) { 5811 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR, 5812 MGMT_STATUS_BUSY); 5813 goto unlock; 5814 } 5815 5816 cmd = mgmt_pending_add(sk, MGMT_OP_SET_BREDR, hdev, data, len); 5817 if (!cmd) { 5818 err = -ENOMEM; 5819 goto unlock; 5820 } 5821 5822 /* We need to flip the bit already here so that 5823 * hci_req_update_adv_data generates the correct flags. 5824 */ 5825 hci_dev_set_flag(hdev, HCI_BREDR_ENABLED); 5826 5827 hci_req_init(&req, hdev); 5828 5829 __hci_req_write_fast_connectable(&req, false); 5830 __hci_req_update_scan(&req); 5831 5832 /* Since only the advertising data flags will change, there 5833 * is no need to update the scan response data. 5834 */ 5835 __hci_req_update_adv_data(&req, hdev->cur_adv_instance); 5836 5837 err = hci_req_run(&req, set_bredr_complete); 5838 if (err < 0) 5839 mgmt_pending_remove(cmd); 5840 5841 unlock: 5842 hci_dev_unlock(hdev); 5843 return err; 5844 } 5845 5846 static void sc_enable_complete(struct hci_dev *hdev, u8 status, u16 opcode) 5847 { 5848 struct mgmt_pending_cmd *cmd; 5849 struct mgmt_mode *cp; 5850 5851 bt_dev_dbg(hdev, "status %u", status); 5852 5853 hci_dev_lock(hdev); 5854 5855 cmd = pending_find(MGMT_OP_SET_SECURE_CONN, hdev); 5856 if (!cmd) 5857 goto unlock; 5858 5859 if (status) { 5860 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, 5861 mgmt_status(status)); 5862 goto remove; 5863 } 5864 5865 cp = cmd->param; 5866 5867 switch (cp->val) { 5868 case 0x00: 5869 hci_dev_clear_flag(hdev, HCI_SC_ENABLED); 5870 hci_dev_clear_flag(hdev, HCI_SC_ONLY); 5871 break; 5872 case 0x01: 5873 hci_dev_set_flag(hdev, HCI_SC_ENABLED); 5874 hci_dev_clear_flag(hdev, HCI_SC_ONLY); 5875 break; 5876 case 0x02: 5877 hci_dev_set_flag(hdev, HCI_SC_ENABLED); 5878 hci_dev_set_flag(hdev, HCI_SC_ONLY); 5879 break; 5880 } 5881 5882 send_settings_rsp(cmd->sk, MGMT_OP_SET_SECURE_CONN, hdev); 5883 new_settings(hdev, cmd->sk); 5884 5885 remove: 5886 mgmt_pending_remove(cmd); 5887 unlock: 5888 hci_dev_unlock(hdev); 5889 } 5890 5891 static int set_secure_conn(struct sock *sk, struct hci_dev *hdev, 5892 void *data, u16 len) 5893 { 5894 struct mgmt_mode *cp = data; 5895 struct mgmt_pending_cmd *cmd; 5896 struct hci_request req; 5897 u8 val; 5898 int err; 5899 5900 bt_dev_dbg(hdev, "sock %p", sk); 5901 5902 if (!lmp_sc_capable(hdev) && 5903 !hci_dev_test_flag(hdev, HCI_LE_ENABLED)) 5904 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN, 5905 MGMT_STATUS_NOT_SUPPORTED); 5906 5907 if (hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) && 5908 lmp_sc_capable(hdev) && 5909 !hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) 5910 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN, 5911 MGMT_STATUS_REJECTED); 5912 5913 if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02) 5914 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN, 5915 MGMT_STATUS_INVALID_PARAMS); 5916 5917 hci_dev_lock(hdev); 5918 5919 if (!hdev_is_powered(hdev) || !lmp_sc_capable(hdev) || 5920 !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) { 5921 bool changed; 5922 5923 if (cp->val) { 5924 changed = !hci_dev_test_and_set_flag(hdev, 5925 HCI_SC_ENABLED); 5926 if (cp->val == 0x02) 5927 hci_dev_set_flag(hdev, HCI_SC_ONLY); 5928 else 5929 hci_dev_clear_flag(hdev, HCI_SC_ONLY); 5930 } else { 5931 changed = hci_dev_test_and_clear_flag(hdev, 5932 HCI_SC_ENABLED); 5933 hci_dev_clear_flag(hdev, HCI_SC_ONLY); 5934 } 5935 5936 err = send_settings_rsp(sk, MGMT_OP_SET_SECURE_CONN, hdev); 5937 if (err < 0) 5938 goto failed; 5939 5940 if (changed) 5941 err = new_settings(hdev, sk); 5942 5943 goto failed; 5944 } 5945 5946 if (pending_find(MGMT_OP_SET_SECURE_CONN, hdev)) { 5947 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN, 5948 MGMT_STATUS_BUSY); 5949 goto failed; 5950 } 5951 5952 val = !!cp->val; 5953 5954 if (val == hci_dev_test_flag(hdev, HCI_SC_ENABLED) && 5955 (cp->val == 0x02) == hci_dev_test_flag(hdev, HCI_SC_ONLY)) { 5956 err = send_settings_rsp(sk, MGMT_OP_SET_SECURE_CONN, hdev); 5957 goto failed; 5958 } 5959 5960 cmd = mgmt_pending_add(sk, MGMT_OP_SET_SECURE_CONN, hdev, data, len); 5961 if (!cmd) { 5962 err = -ENOMEM; 5963 goto failed; 5964 } 5965 5966 hci_req_init(&req, hdev); 5967 hci_req_add(&req, HCI_OP_WRITE_SC_SUPPORT, 1, &val); 5968 err = hci_req_run(&req, sc_enable_complete); 5969 if (err < 0) { 5970 mgmt_pending_remove(cmd); 5971 goto failed; 5972 } 5973 5974 failed: 5975 hci_dev_unlock(hdev); 5976 return err; 5977 } 5978 5979 static int set_debug_keys(struct sock *sk, struct hci_dev *hdev, 5980 void *data, u16 len) 5981 { 5982 struct mgmt_mode *cp = data; 5983 bool changed, use_changed; 5984 int err; 5985 5986 bt_dev_dbg(hdev, "sock %p", sk); 5987 5988 if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02) 5989 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEBUG_KEYS, 5990 MGMT_STATUS_INVALID_PARAMS); 5991 5992 hci_dev_lock(hdev); 5993 5994 if (cp->val) 5995 changed = !hci_dev_test_and_set_flag(hdev, HCI_KEEP_DEBUG_KEYS); 5996 else 5997 changed = hci_dev_test_and_clear_flag(hdev, 5998 HCI_KEEP_DEBUG_KEYS); 5999 6000 if (cp->val == 0x02) 6001 use_changed = !hci_dev_test_and_set_flag(hdev, 6002 HCI_USE_DEBUG_KEYS); 6003 else 6004 use_changed = hci_dev_test_and_clear_flag(hdev, 6005 HCI_USE_DEBUG_KEYS); 6006 6007 if (hdev_is_powered(hdev) && use_changed && 6008 hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) { 6009 u8 mode = (cp->val == 0x02) ? 0x01 : 0x00; 6010 hci_send_cmd(hdev, HCI_OP_WRITE_SSP_DEBUG_MODE, 6011 sizeof(mode), &mode); 6012 } 6013 6014 err = send_settings_rsp(sk, MGMT_OP_SET_DEBUG_KEYS, hdev); 6015 if (err < 0) 6016 goto unlock; 6017 6018 if (changed) 6019 err = new_settings(hdev, sk); 6020 6021 unlock: 6022 hci_dev_unlock(hdev); 6023 return err; 6024 } 6025 6026 static int set_privacy(struct sock *sk, struct hci_dev *hdev, void *cp_data, 6027 u16 len) 6028 { 6029 struct mgmt_cp_set_privacy *cp = cp_data; 6030 bool changed; 6031 int err; 6032 6033 bt_dev_dbg(hdev, "sock %p", sk); 6034 6035 if (!lmp_le_capable(hdev)) 6036 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY, 6037 MGMT_STATUS_NOT_SUPPORTED); 6038 6039 if (cp->privacy != 0x00 && cp->privacy != 0x01 && cp->privacy != 0x02) 6040 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY, 6041 MGMT_STATUS_INVALID_PARAMS); 6042 6043 if (hdev_is_powered(hdev)) 6044 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY, 6045 MGMT_STATUS_REJECTED); 6046 6047 hci_dev_lock(hdev); 6048 6049 /* If user space supports this command it is also expected to 6050 * handle IRKs. Therefore, set the HCI_RPA_RESOLVING flag. 6051 */ 6052 hci_dev_set_flag(hdev, HCI_RPA_RESOLVING); 6053 6054 if (cp->privacy) { 6055 changed = !hci_dev_test_and_set_flag(hdev, HCI_PRIVACY); 6056 memcpy(hdev->irk, cp->irk, sizeof(hdev->irk)); 6057 hci_dev_set_flag(hdev, HCI_RPA_EXPIRED); 6058 hci_adv_instances_set_rpa_expired(hdev, true); 6059 if (cp->privacy == 0x02) 6060 hci_dev_set_flag(hdev, HCI_LIMITED_PRIVACY); 6061 else 6062 hci_dev_clear_flag(hdev, HCI_LIMITED_PRIVACY); 6063 } else { 6064 changed = hci_dev_test_and_clear_flag(hdev, HCI_PRIVACY); 6065 memset(hdev->irk, 0, sizeof(hdev->irk)); 6066 hci_dev_clear_flag(hdev, HCI_RPA_EXPIRED); 6067 hci_adv_instances_set_rpa_expired(hdev, false); 6068 hci_dev_clear_flag(hdev, HCI_LIMITED_PRIVACY); 6069 } 6070 6071 err = send_settings_rsp(sk, MGMT_OP_SET_PRIVACY, hdev); 6072 if (err < 0) 6073 goto unlock; 6074 6075 if (changed) 6076 err = new_settings(hdev, sk); 6077 6078 unlock: 6079 hci_dev_unlock(hdev); 6080 return err; 6081 } 6082 6083 static bool irk_is_valid(struct mgmt_irk_info *irk) 6084 { 6085 switch (irk->addr.type) { 6086 case BDADDR_LE_PUBLIC: 6087 return true; 6088 6089 case BDADDR_LE_RANDOM: 6090 /* Two most significant bits shall be set */ 6091 if ((irk->addr.bdaddr.b[5] & 0xc0) != 0xc0) 6092 return false; 6093 return true; 6094 } 6095 6096 return false; 6097 } 6098 6099 static int load_irks(struct sock *sk, struct hci_dev *hdev, void *cp_data, 6100 u16 len) 6101 { 6102 struct mgmt_cp_load_irks *cp = cp_data; 6103 const u16 max_irk_count = ((U16_MAX - sizeof(*cp)) / 6104 sizeof(struct mgmt_irk_info)); 6105 u16 irk_count, expected_len; 6106 int i, err; 6107 6108 bt_dev_dbg(hdev, "sock %p", sk); 6109 6110 if (!lmp_le_capable(hdev)) 6111 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS, 6112 MGMT_STATUS_NOT_SUPPORTED); 6113 6114 irk_count = __le16_to_cpu(cp->irk_count); 6115 if (irk_count > max_irk_count) { 6116 bt_dev_err(hdev, "load_irks: too big irk_count value %u", 6117 irk_count); 6118 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS, 6119 MGMT_STATUS_INVALID_PARAMS); 6120 } 6121 6122 expected_len = struct_size(cp, irks, irk_count); 6123 if (expected_len != len) { 6124 bt_dev_err(hdev, "load_irks: expected %u bytes, got %u bytes", 6125 expected_len, len); 6126 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS, 6127 MGMT_STATUS_INVALID_PARAMS); 6128 } 6129 6130 bt_dev_dbg(hdev, "irk_count %u", irk_count); 6131 6132 for (i = 0; i < irk_count; i++) { 6133 struct mgmt_irk_info *key = &cp->irks[i]; 6134 6135 if (!irk_is_valid(key)) 6136 return mgmt_cmd_status(sk, hdev->id, 6137 MGMT_OP_LOAD_IRKS, 6138 MGMT_STATUS_INVALID_PARAMS); 6139 } 6140 6141 hci_dev_lock(hdev); 6142 6143 hci_smp_irks_clear(hdev); 6144 6145 for (i = 0; i < irk_count; i++) { 6146 struct mgmt_irk_info *irk = &cp->irks[i]; 6147 6148 if (hci_is_blocked_key(hdev, 6149 HCI_BLOCKED_KEY_TYPE_IRK, 6150 irk->val)) { 6151 bt_dev_warn(hdev, "Skipping blocked IRK for %pMR", 6152 &irk->addr.bdaddr); 6153 continue; 6154 } 6155 6156 hci_add_irk(hdev, &irk->addr.bdaddr, 6157 le_addr_type(irk->addr.type), irk->val, 6158 BDADDR_ANY); 6159 } 6160 6161 hci_dev_set_flag(hdev, HCI_RPA_RESOLVING); 6162 6163 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_IRKS, 0, NULL, 0); 6164 6165 hci_dev_unlock(hdev); 6166 6167 return err; 6168 } 6169 6170 static bool ltk_is_valid(struct mgmt_ltk_info *key) 6171 { 6172 if (key->initiator != 0x00 && key->initiator != 0x01) 6173 return false; 6174 6175 switch (key->addr.type) { 6176 case BDADDR_LE_PUBLIC: 6177 return true; 6178 6179 case BDADDR_LE_RANDOM: 6180 /* Two most significant bits shall be set */ 6181 if ((key->addr.bdaddr.b[5] & 0xc0) != 0xc0) 6182 return false; 6183 return true; 6184 } 6185 6186 return false; 6187 } 6188 6189 static int load_long_term_keys(struct sock *sk, struct hci_dev *hdev, 6190 void *cp_data, u16 len) 6191 { 6192 struct mgmt_cp_load_long_term_keys *cp = cp_data; 6193 const u16 max_key_count = ((U16_MAX - sizeof(*cp)) / 6194 sizeof(struct mgmt_ltk_info)); 6195 u16 key_count, expected_len; 6196 int i, err; 6197 6198 bt_dev_dbg(hdev, "sock %p", sk); 6199 6200 if (!lmp_le_capable(hdev)) 6201 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS, 6202 MGMT_STATUS_NOT_SUPPORTED); 6203 6204 key_count = __le16_to_cpu(cp->key_count); 6205 if (key_count > max_key_count) { 6206 bt_dev_err(hdev, "load_ltks: too big key_count value %u", 6207 key_count); 6208 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS, 6209 MGMT_STATUS_INVALID_PARAMS); 6210 } 6211 6212 expected_len = struct_size(cp, keys, key_count); 6213 if (expected_len != len) { 6214 bt_dev_err(hdev, "load_keys: expected %u bytes, got %u bytes", 6215 expected_len, len); 6216 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS, 6217 MGMT_STATUS_INVALID_PARAMS); 6218 } 6219 6220 bt_dev_dbg(hdev, "key_count %u", key_count); 6221 6222 for (i = 0; i < key_count; i++) { 6223 struct mgmt_ltk_info *key = &cp->keys[i]; 6224 6225 if (!ltk_is_valid(key)) 6226 return mgmt_cmd_status(sk, hdev->id, 6227 MGMT_OP_LOAD_LONG_TERM_KEYS, 6228 MGMT_STATUS_INVALID_PARAMS); 6229 } 6230 6231 hci_dev_lock(hdev); 6232 6233 hci_smp_ltks_clear(hdev); 6234 6235 for (i = 0; i < key_count; i++) { 6236 struct mgmt_ltk_info *key = &cp->keys[i]; 6237 u8 type, authenticated; 6238 6239 if (hci_is_blocked_key(hdev, 6240 HCI_BLOCKED_KEY_TYPE_LTK, 6241 key->val)) { 6242 bt_dev_warn(hdev, "Skipping blocked LTK for %pMR", 6243 &key->addr.bdaddr); 6244 continue; 6245 } 6246 6247 switch (key->type) { 6248 case MGMT_LTK_UNAUTHENTICATED: 6249 authenticated = 0x00; 6250 type = key->initiator ? SMP_LTK : SMP_LTK_RESPONDER; 6251 break; 6252 case MGMT_LTK_AUTHENTICATED: 6253 authenticated = 0x01; 6254 type = key->initiator ? SMP_LTK : SMP_LTK_RESPONDER; 6255 break; 6256 case MGMT_LTK_P256_UNAUTH: 6257 authenticated = 0x00; 6258 type = SMP_LTK_P256; 6259 break; 6260 case MGMT_LTK_P256_AUTH: 6261 authenticated = 0x01; 6262 type = SMP_LTK_P256; 6263 break; 6264 case MGMT_LTK_P256_DEBUG: 6265 authenticated = 0x00; 6266 type = SMP_LTK_P256_DEBUG; 6267 fallthrough; 6268 default: 6269 continue; 6270 } 6271 6272 hci_add_ltk(hdev, &key->addr.bdaddr, 6273 le_addr_type(key->addr.type), type, authenticated, 6274 key->val, key->enc_size, key->ediv, key->rand); 6275 } 6276 6277 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS, 0, 6278 NULL, 0); 6279 6280 hci_dev_unlock(hdev); 6281 6282 return err; 6283 } 6284 6285 static int conn_info_cmd_complete(struct mgmt_pending_cmd *cmd, u8 status) 6286 { 6287 struct hci_conn *conn = cmd->user_data; 6288 struct mgmt_rp_get_conn_info rp; 6289 int err; 6290 6291 memcpy(&rp.addr, cmd->param, sizeof(rp.addr)); 6292 6293 if (status == MGMT_STATUS_SUCCESS) { 6294 rp.rssi = conn->rssi; 6295 rp.tx_power = conn->tx_power; 6296 rp.max_tx_power = conn->max_tx_power; 6297 } else { 6298 rp.rssi = HCI_RSSI_INVALID; 6299 rp.tx_power = HCI_TX_POWER_INVALID; 6300 rp.max_tx_power = HCI_TX_POWER_INVALID; 6301 } 6302 6303 err = mgmt_cmd_complete(cmd->sk, cmd->index, MGMT_OP_GET_CONN_INFO, 6304 status, &rp, sizeof(rp)); 6305 6306 hci_conn_drop(conn); 6307 hci_conn_put(conn); 6308 6309 return err; 6310 } 6311 6312 static void conn_info_refresh_complete(struct hci_dev *hdev, u8 hci_status, 6313 u16 opcode) 6314 { 6315 struct hci_cp_read_rssi *cp; 6316 struct mgmt_pending_cmd *cmd; 6317 struct hci_conn *conn; 6318 u16 handle; 6319 u8 status; 6320 6321 bt_dev_dbg(hdev, "status 0x%02x", hci_status); 6322 6323 hci_dev_lock(hdev); 6324 6325 /* Commands sent in request are either Read RSSI or Read Transmit Power 6326 * Level so we check which one was last sent to retrieve connection 6327 * handle. Both commands have handle as first parameter so it's safe to 6328 * cast data on the same command struct. 6329 * 6330 * First command sent is always Read RSSI and we fail only if it fails. 6331 * In other case we simply override error to indicate success as we 6332 * already remembered if TX power value is actually valid. 6333 */ 6334 cp = hci_sent_cmd_data(hdev, HCI_OP_READ_RSSI); 6335 if (!cp) { 6336 cp = hci_sent_cmd_data(hdev, HCI_OP_READ_TX_POWER); 6337 status = MGMT_STATUS_SUCCESS; 6338 } else { 6339 status = mgmt_status(hci_status); 6340 } 6341 6342 if (!cp) { 6343 bt_dev_err(hdev, "invalid sent_cmd in conn_info response"); 6344 goto unlock; 6345 } 6346 6347 handle = __le16_to_cpu(cp->handle); 6348 conn = hci_conn_hash_lookup_handle(hdev, handle); 6349 if (!conn) { 6350 bt_dev_err(hdev, "unknown handle (%u) in conn_info response", 6351 handle); 6352 goto unlock; 6353 } 6354 6355 cmd = pending_find_data(MGMT_OP_GET_CONN_INFO, hdev, conn); 6356 if (!cmd) 6357 goto unlock; 6358 6359 cmd->cmd_complete(cmd, status); 6360 mgmt_pending_remove(cmd); 6361 6362 unlock: 6363 hci_dev_unlock(hdev); 6364 } 6365 6366 static int get_conn_info(struct sock *sk, struct hci_dev *hdev, void *data, 6367 u16 len) 6368 { 6369 struct mgmt_cp_get_conn_info *cp = data; 6370 struct mgmt_rp_get_conn_info rp; 6371 struct hci_conn *conn; 6372 unsigned long conn_info_age; 6373 int err = 0; 6374 6375 bt_dev_dbg(hdev, "sock %p", sk); 6376 6377 memset(&rp, 0, sizeof(rp)); 6378 bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr); 6379 rp.addr.type = cp->addr.type; 6380 6381 if (!bdaddr_type_is_valid(cp->addr.type)) 6382 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO, 6383 MGMT_STATUS_INVALID_PARAMS, 6384 &rp, sizeof(rp)); 6385 6386 hci_dev_lock(hdev); 6387 6388 if (!hdev_is_powered(hdev)) { 6389 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO, 6390 MGMT_STATUS_NOT_POWERED, &rp, 6391 sizeof(rp)); 6392 goto unlock; 6393 } 6394 6395 if (cp->addr.type == BDADDR_BREDR) 6396 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, 6397 &cp->addr.bdaddr); 6398 else 6399 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &cp->addr.bdaddr); 6400 6401 if (!conn || conn->state != BT_CONNECTED) { 6402 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO, 6403 MGMT_STATUS_NOT_CONNECTED, &rp, 6404 sizeof(rp)); 6405 goto unlock; 6406 } 6407 6408 if (pending_find_data(MGMT_OP_GET_CONN_INFO, hdev, conn)) { 6409 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO, 6410 MGMT_STATUS_BUSY, &rp, sizeof(rp)); 6411 goto unlock; 6412 } 6413 6414 /* To avoid client trying to guess when to poll again for information we 6415 * calculate conn info age as random value between min/max set in hdev. 6416 */ 6417 conn_info_age = hdev->conn_info_min_age + 6418 prandom_u32_max(hdev->conn_info_max_age - 6419 hdev->conn_info_min_age); 6420 6421 /* Query controller to refresh cached values if they are too old or were 6422 * never read. 6423 */ 6424 if (time_after(jiffies, conn->conn_info_timestamp + 6425 msecs_to_jiffies(conn_info_age)) || 6426 !conn->conn_info_timestamp) { 6427 struct hci_request req; 6428 struct hci_cp_read_tx_power req_txp_cp; 6429 struct hci_cp_read_rssi req_rssi_cp; 6430 struct mgmt_pending_cmd *cmd; 6431 6432 hci_req_init(&req, hdev); 6433 req_rssi_cp.handle = cpu_to_le16(conn->handle); 6434 hci_req_add(&req, HCI_OP_READ_RSSI, sizeof(req_rssi_cp), 6435 &req_rssi_cp); 6436 6437 /* For LE links TX power does not change thus we don't need to 6438 * query for it once value is known. 6439 */ 6440 if (!bdaddr_type_is_le(cp->addr.type) || 6441 conn->tx_power == HCI_TX_POWER_INVALID) { 6442 req_txp_cp.handle = cpu_to_le16(conn->handle); 6443 req_txp_cp.type = 0x00; 6444 hci_req_add(&req, HCI_OP_READ_TX_POWER, 6445 sizeof(req_txp_cp), &req_txp_cp); 6446 } 6447 6448 /* Max TX power needs to be read only once per connection */ 6449 if (conn->max_tx_power == HCI_TX_POWER_INVALID) { 6450 req_txp_cp.handle = cpu_to_le16(conn->handle); 6451 req_txp_cp.type = 0x01; 6452 hci_req_add(&req, HCI_OP_READ_TX_POWER, 6453 sizeof(req_txp_cp), &req_txp_cp); 6454 } 6455 6456 err = hci_req_run(&req, conn_info_refresh_complete); 6457 if (err < 0) 6458 goto unlock; 6459 6460 cmd = mgmt_pending_add(sk, MGMT_OP_GET_CONN_INFO, hdev, 6461 data, len); 6462 if (!cmd) { 6463 err = -ENOMEM; 6464 goto unlock; 6465 } 6466 6467 hci_conn_hold(conn); 6468 cmd->user_data = hci_conn_get(conn); 6469 cmd->cmd_complete = conn_info_cmd_complete; 6470 6471 conn->conn_info_timestamp = jiffies; 6472 } else { 6473 /* Cache is valid, just reply with values cached in hci_conn */ 6474 rp.rssi = conn->rssi; 6475 rp.tx_power = conn->tx_power; 6476 rp.max_tx_power = conn->max_tx_power; 6477 6478 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO, 6479 MGMT_STATUS_SUCCESS, &rp, sizeof(rp)); 6480 } 6481 6482 unlock: 6483 hci_dev_unlock(hdev); 6484 return err; 6485 } 6486 6487 static int clock_info_cmd_complete(struct mgmt_pending_cmd *cmd, u8 status) 6488 { 6489 struct hci_conn *conn = cmd->user_data; 6490 struct mgmt_rp_get_clock_info rp; 6491 struct hci_dev *hdev; 6492 int err; 6493 6494 memset(&rp, 0, sizeof(rp)); 6495 memcpy(&rp.addr, cmd->param, sizeof(rp.addr)); 6496 6497 if (status) 6498 goto complete; 6499 6500 hdev = hci_dev_get(cmd->index); 6501 if (hdev) { 6502 rp.local_clock = cpu_to_le32(hdev->clock); 6503 hci_dev_put(hdev); 6504 } 6505 6506 if (conn) { 6507 rp.piconet_clock = cpu_to_le32(conn->clock); 6508 rp.accuracy = cpu_to_le16(conn->clock_accuracy); 6509 } 6510 6511 complete: 6512 err = mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, status, &rp, 6513 sizeof(rp)); 6514 6515 if (conn) { 6516 hci_conn_drop(conn); 6517 hci_conn_put(conn); 6518 } 6519 6520 return err; 6521 } 6522 6523 static void get_clock_info_complete(struct hci_dev *hdev, u8 status, u16 opcode) 6524 { 6525 struct hci_cp_read_clock *hci_cp; 6526 struct mgmt_pending_cmd *cmd; 6527 struct hci_conn *conn; 6528 6529 bt_dev_dbg(hdev, "status %u", status); 6530 6531 hci_dev_lock(hdev); 6532 6533 hci_cp = hci_sent_cmd_data(hdev, HCI_OP_READ_CLOCK); 6534 if (!hci_cp) 6535 goto unlock; 6536 6537 if (hci_cp->which) { 6538 u16 handle = __le16_to_cpu(hci_cp->handle); 6539 conn = hci_conn_hash_lookup_handle(hdev, handle); 6540 } else { 6541 conn = NULL; 6542 } 6543 6544 cmd = pending_find_data(MGMT_OP_GET_CLOCK_INFO, hdev, conn); 6545 if (!cmd) 6546 goto unlock; 6547 6548 cmd->cmd_complete(cmd, mgmt_status(status)); 6549 mgmt_pending_remove(cmd); 6550 6551 unlock: 6552 hci_dev_unlock(hdev); 6553 } 6554 6555 static int get_clock_info(struct sock *sk, struct hci_dev *hdev, void *data, 6556 u16 len) 6557 { 6558 struct mgmt_cp_get_clock_info *cp = data; 6559 struct mgmt_rp_get_clock_info rp; 6560 struct hci_cp_read_clock hci_cp; 6561 struct mgmt_pending_cmd *cmd; 6562 struct hci_request req; 6563 struct hci_conn *conn; 6564 int err; 6565 6566 bt_dev_dbg(hdev, "sock %p", sk); 6567 6568 memset(&rp, 0, sizeof(rp)); 6569 bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr); 6570 rp.addr.type = cp->addr.type; 6571 6572 if (cp->addr.type != BDADDR_BREDR) 6573 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CLOCK_INFO, 6574 MGMT_STATUS_INVALID_PARAMS, 6575 &rp, sizeof(rp)); 6576 6577 hci_dev_lock(hdev); 6578 6579 if (!hdev_is_powered(hdev)) { 6580 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CLOCK_INFO, 6581 MGMT_STATUS_NOT_POWERED, &rp, 6582 sizeof(rp)); 6583 goto unlock; 6584 } 6585 6586 if (bacmp(&cp->addr.bdaddr, BDADDR_ANY)) { 6587 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, 6588 &cp->addr.bdaddr); 6589 if (!conn || conn->state != BT_CONNECTED) { 6590 err = mgmt_cmd_complete(sk, hdev->id, 6591 MGMT_OP_GET_CLOCK_INFO, 6592 MGMT_STATUS_NOT_CONNECTED, 6593 &rp, sizeof(rp)); 6594 goto unlock; 6595 } 6596 } else { 6597 conn = NULL; 6598 } 6599 6600 cmd = mgmt_pending_add(sk, MGMT_OP_GET_CLOCK_INFO, hdev, data, len); 6601 if (!cmd) { 6602 err = -ENOMEM; 6603 goto unlock; 6604 } 6605 6606 cmd->cmd_complete = clock_info_cmd_complete; 6607 6608 hci_req_init(&req, hdev); 6609 6610 memset(&hci_cp, 0, sizeof(hci_cp)); 6611 hci_req_add(&req, HCI_OP_READ_CLOCK, sizeof(hci_cp), &hci_cp); 6612 6613 if (conn) { 6614 hci_conn_hold(conn); 6615 cmd->user_data = hci_conn_get(conn); 6616 6617 hci_cp.handle = cpu_to_le16(conn->handle); 6618 hci_cp.which = 0x01; /* Piconet clock */ 6619 hci_req_add(&req, HCI_OP_READ_CLOCK, sizeof(hci_cp), &hci_cp); 6620 } 6621 6622 err = hci_req_run(&req, get_clock_info_complete); 6623 if (err < 0) 6624 mgmt_pending_remove(cmd); 6625 6626 unlock: 6627 hci_dev_unlock(hdev); 6628 return err; 6629 } 6630 6631 static bool is_connected(struct hci_dev *hdev, bdaddr_t *addr, u8 type) 6632 { 6633 struct hci_conn *conn; 6634 6635 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, addr); 6636 if (!conn) 6637 return false; 6638 6639 if (conn->dst_type != type) 6640 return false; 6641 6642 if (conn->state != BT_CONNECTED) 6643 return false; 6644 6645 return true; 6646 } 6647 6648 /* This function requires the caller holds hdev->lock */ 6649 static int hci_conn_params_set(struct hci_dev *hdev, bdaddr_t *addr, 6650 u8 addr_type, u8 auto_connect) 6651 { 6652 struct hci_conn_params *params; 6653 6654 params = hci_conn_params_add(hdev, addr, addr_type); 6655 if (!params) 6656 return -EIO; 6657 6658 if (params->auto_connect == auto_connect) 6659 return 0; 6660 6661 list_del_init(¶ms->action); 6662 6663 switch (auto_connect) { 6664 case HCI_AUTO_CONN_DISABLED: 6665 case HCI_AUTO_CONN_LINK_LOSS: 6666 /* If auto connect is being disabled when we're trying to 6667 * connect to device, keep connecting. 6668 */ 6669 if (params->explicit_connect) 6670 list_add(¶ms->action, &hdev->pend_le_conns); 6671 break; 6672 case HCI_AUTO_CONN_REPORT: 6673 if (params->explicit_connect) 6674 list_add(¶ms->action, &hdev->pend_le_conns); 6675 else 6676 list_add(¶ms->action, &hdev->pend_le_reports); 6677 break; 6678 case HCI_AUTO_CONN_DIRECT: 6679 case HCI_AUTO_CONN_ALWAYS: 6680 if (!is_connected(hdev, addr, addr_type)) 6681 list_add(¶ms->action, &hdev->pend_le_conns); 6682 break; 6683 } 6684 6685 params->auto_connect = auto_connect; 6686 6687 bt_dev_dbg(hdev, "addr %pMR (type %u) auto_connect %u", 6688 addr, addr_type, auto_connect); 6689 6690 return 0; 6691 } 6692 6693 static void device_added(struct sock *sk, struct hci_dev *hdev, 6694 bdaddr_t *bdaddr, u8 type, u8 action) 6695 { 6696 struct mgmt_ev_device_added ev; 6697 6698 bacpy(&ev.addr.bdaddr, bdaddr); 6699 ev.addr.type = type; 6700 ev.action = action; 6701 6702 mgmt_event(MGMT_EV_DEVICE_ADDED, hdev, &ev, sizeof(ev), sk); 6703 } 6704 6705 static int add_device(struct sock *sk, struct hci_dev *hdev, 6706 void *data, u16 len) 6707 { 6708 struct mgmt_cp_add_device *cp = data; 6709 u8 auto_conn, addr_type; 6710 struct hci_conn_params *params; 6711 int err; 6712 u32 current_flags = 0; 6713 6714 bt_dev_dbg(hdev, "sock %p", sk); 6715 6716 if (!bdaddr_type_is_valid(cp->addr.type) || 6717 !bacmp(&cp->addr.bdaddr, BDADDR_ANY)) 6718 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE, 6719 MGMT_STATUS_INVALID_PARAMS, 6720 &cp->addr, sizeof(cp->addr)); 6721 6722 if (cp->action != 0x00 && cp->action != 0x01 && cp->action != 0x02) 6723 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE, 6724 MGMT_STATUS_INVALID_PARAMS, 6725 &cp->addr, sizeof(cp->addr)); 6726 6727 hci_dev_lock(hdev); 6728 6729 if (cp->addr.type == BDADDR_BREDR) { 6730 /* Only incoming connections action is supported for now */ 6731 if (cp->action != 0x01) { 6732 err = mgmt_cmd_complete(sk, hdev->id, 6733 MGMT_OP_ADD_DEVICE, 6734 MGMT_STATUS_INVALID_PARAMS, 6735 &cp->addr, sizeof(cp->addr)); 6736 goto unlock; 6737 } 6738 6739 err = hci_bdaddr_list_add_with_flags(&hdev->accept_list, 6740 &cp->addr.bdaddr, 6741 cp->addr.type, 0); 6742 if (err) 6743 goto unlock; 6744 6745 hci_req_update_scan(hdev); 6746 6747 goto added; 6748 } 6749 6750 addr_type = le_addr_type(cp->addr.type); 6751 6752 if (cp->action == 0x02) 6753 auto_conn = HCI_AUTO_CONN_ALWAYS; 6754 else if (cp->action == 0x01) 6755 auto_conn = HCI_AUTO_CONN_DIRECT; 6756 else 6757 auto_conn = HCI_AUTO_CONN_REPORT; 6758 6759 /* Kernel internally uses conn_params with resolvable private 6760 * address, but Add Device allows only identity addresses. 6761 * Make sure it is enforced before calling 6762 * hci_conn_params_lookup. 6763 */ 6764 if (!hci_is_identity_address(&cp->addr.bdaddr, addr_type)) { 6765 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE, 6766 MGMT_STATUS_INVALID_PARAMS, 6767 &cp->addr, sizeof(cp->addr)); 6768 goto unlock; 6769 } 6770 6771 /* If the connection parameters don't exist for this device, 6772 * they will be created and configured with defaults. 6773 */ 6774 if (hci_conn_params_set(hdev, &cp->addr.bdaddr, addr_type, 6775 auto_conn) < 0) { 6776 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE, 6777 MGMT_STATUS_FAILED, &cp->addr, 6778 sizeof(cp->addr)); 6779 goto unlock; 6780 } else { 6781 params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr, 6782 addr_type); 6783 if (params) 6784 current_flags = params->current_flags; 6785 } 6786 6787 hci_update_background_scan(hdev); 6788 6789 added: 6790 device_added(sk, hdev, &cp->addr.bdaddr, cp->addr.type, cp->action); 6791 device_flags_changed(NULL, hdev, &cp->addr.bdaddr, cp->addr.type, 6792 SUPPORTED_DEVICE_FLAGS(), current_flags); 6793 6794 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE, 6795 MGMT_STATUS_SUCCESS, &cp->addr, 6796 sizeof(cp->addr)); 6797 6798 unlock: 6799 hci_dev_unlock(hdev); 6800 return err; 6801 } 6802 6803 static void device_removed(struct sock *sk, struct hci_dev *hdev, 6804 bdaddr_t *bdaddr, u8 type) 6805 { 6806 struct mgmt_ev_device_removed ev; 6807 6808 bacpy(&ev.addr.bdaddr, bdaddr); 6809 ev.addr.type = type; 6810 6811 mgmt_event(MGMT_EV_DEVICE_REMOVED, hdev, &ev, sizeof(ev), sk); 6812 } 6813 6814 static int remove_device(struct sock *sk, struct hci_dev *hdev, 6815 void *data, u16 len) 6816 { 6817 struct mgmt_cp_remove_device *cp = data; 6818 int err; 6819 6820 bt_dev_dbg(hdev, "sock %p", sk); 6821 6822 hci_dev_lock(hdev); 6823 6824 if (bacmp(&cp->addr.bdaddr, BDADDR_ANY)) { 6825 struct hci_conn_params *params; 6826 u8 addr_type; 6827 6828 if (!bdaddr_type_is_valid(cp->addr.type)) { 6829 err = mgmt_cmd_complete(sk, hdev->id, 6830 MGMT_OP_REMOVE_DEVICE, 6831 MGMT_STATUS_INVALID_PARAMS, 6832 &cp->addr, sizeof(cp->addr)); 6833 goto unlock; 6834 } 6835 6836 if (cp->addr.type == BDADDR_BREDR) { 6837 err = hci_bdaddr_list_del(&hdev->accept_list, 6838 &cp->addr.bdaddr, 6839 cp->addr.type); 6840 if (err) { 6841 err = mgmt_cmd_complete(sk, hdev->id, 6842 MGMT_OP_REMOVE_DEVICE, 6843 MGMT_STATUS_INVALID_PARAMS, 6844 &cp->addr, 6845 sizeof(cp->addr)); 6846 goto unlock; 6847 } 6848 6849 hci_req_update_scan(hdev); 6850 6851 device_removed(sk, hdev, &cp->addr.bdaddr, 6852 cp->addr.type); 6853 goto complete; 6854 } 6855 6856 addr_type = le_addr_type(cp->addr.type); 6857 6858 /* Kernel internally uses conn_params with resolvable private 6859 * address, but Remove Device allows only identity addresses. 6860 * Make sure it is enforced before calling 6861 * hci_conn_params_lookup. 6862 */ 6863 if (!hci_is_identity_address(&cp->addr.bdaddr, addr_type)) { 6864 err = mgmt_cmd_complete(sk, hdev->id, 6865 MGMT_OP_REMOVE_DEVICE, 6866 MGMT_STATUS_INVALID_PARAMS, 6867 &cp->addr, sizeof(cp->addr)); 6868 goto unlock; 6869 } 6870 6871 params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr, 6872 addr_type); 6873 if (!params) { 6874 err = mgmt_cmd_complete(sk, hdev->id, 6875 MGMT_OP_REMOVE_DEVICE, 6876 MGMT_STATUS_INVALID_PARAMS, 6877 &cp->addr, sizeof(cp->addr)); 6878 goto unlock; 6879 } 6880 6881 if (params->auto_connect == HCI_AUTO_CONN_DISABLED || 6882 params->auto_connect == HCI_AUTO_CONN_EXPLICIT) { 6883 err = mgmt_cmd_complete(sk, hdev->id, 6884 MGMT_OP_REMOVE_DEVICE, 6885 MGMT_STATUS_INVALID_PARAMS, 6886 &cp->addr, sizeof(cp->addr)); 6887 goto unlock; 6888 } 6889 6890 list_del(¶ms->action); 6891 list_del(¶ms->list); 6892 kfree(params); 6893 hci_update_background_scan(hdev); 6894 6895 device_removed(sk, hdev, &cp->addr.bdaddr, cp->addr.type); 6896 } else { 6897 struct hci_conn_params *p, *tmp; 6898 struct bdaddr_list *b, *btmp; 6899 6900 if (cp->addr.type) { 6901 err = mgmt_cmd_complete(sk, hdev->id, 6902 MGMT_OP_REMOVE_DEVICE, 6903 MGMT_STATUS_INVALID_PARAMS, 6904 &cp->addr, sizeof(cp->addr)); 6905 goto unlock; 6906 } 6907 6908 list_for_each_entry_safe(b, btmp, &hdev->accept_list, list) { 6909 device_removed(sk, hdev, &b->bdaddr, b->bdaddr_type); 6910 list_del(&b->list); 6911 kfree(b); 6912 } 6913 6914 hci_req_update_scan(hdev); 6915 6916 list_for_each_entry_safe(p, tmp, &hdev->le_conn_params, list) { 6917 if (p->auto_connect == HCI_AUTO_CONN_DISABLED) 6918 continue; 6919 device_removed(sk, hdev, &p->addr, p->addr_type); 6920 if (p->explicit_connect) { 6921 p->auto_connect = HCI_AUTO_CONN_EXPLICIT; 6922 continue; 6923 } 6924 list_del(&p->action); 6925 list_del(&p->list); 6926 kfree(p); 6927 } 6928 6929 bt_dev_dbg(hdev, "All LE connection parameters were removed"); 6930 6931 hci_update_background_scan(hdev); 6932 } 6933 6934 complete: 6935 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_DEVICE, 6936 MGMT_STATUS_SUCCESS, &cp->addr, 6937 sizeof(cp->addr)); 6938 unlock: 6939 hci_dev_unlock(hdev); 6940 return err; 6941 } 6942 6943 static int load_conn_param(struct sock *sk, struct hci_dev *hdev, void *data, 6944 u16 len) 6945 { 6946 struct mgmt_cp_load_conn_param *cp = data; 6947 const u16 max_param_count = ((U16_MAX - sizeof(*cp)) / 6948 sizeof(struct mgmt_conn_param)); 6949 u16 param_count, expected_len; 6950 int i; 6951 6952 if (!lmp_le_capable(hdev)) 6953 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM, 6954 MGMT_STATUS_NOT_SUPPORTED); 6955 6956 param_count = __le16_to_cpu(cp->param_count); 6957 if (param_count > max_param_count) { 6958 bt_dev_err(hdev, "load_conn_param: too big param_count value %u", 6959 param_count); 6960 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM, 6961 MGMT_STATUS_INVALID_PARAMS); 6962 } 6963 6964 expected_len = struct_size(cp, params, param_count); 6965 if (expected_len != len) { 6966 bt_dev_err(hdev, "load_conn_param: expected %u bytes, got %u bytes", 6967 expected_len, len); 6968 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM, 6969 MGMT_STATUS_INVALID_PARAMS); 6970 } 6971 6972 bt_dev_dbg(hdev, "param_count %u", param_count); 6973 6974 hci_dev_lock(hdev); 6975 6976 hci_conn_params_clear_disabled(hdev); 6977 6978 for (i = 0; i < param_count; i++) { 6979 struct mgmt_conn_param *param = &cp->params[i]; 6980 struct hci_conn_params *hci_param; 6981 u16 min, max, latency, timeout; 6982 u8 addr_type; 6983 6984 bt_dev_dbg(hdev, "Adding %pMR (type %u)", ¶m->addr.bdaddr, 6985 param->addr.type); 6986 6987 if (param->addr.type == BDADDR_LE_PUBLIC) { 6988 addr_type = ADDR_LE_DEV_PUBLIC; 6989 } else if (param->addr.type == BDADDR_LE_RANDOM) { 6990 addr_type = ADDR_LE_DEV_RANDOM; 6991 } else { 6992 bt_dev_err(hdev, "ignoring invalid connection parameters"); 6993 continue; 6994 } 6995 6996 min = le16_to_cpu(param->min_interval); 6997 max = le16_to_cpu(param->max_interval); 6998 latency = le16_to_cpu(param->latency); 6999 timeout = le16_to_cpu(param->timeout); 7000 7001 bt_dev_dbg(hdev, "min 0x%04x max 0x%04x latency 0x%04x timeout 0x%04x", 7002 min, max, latency, timeout); 7003 7004 if (hci_check_conn_params(min, max, latency, timeout) < 0) { 7005 bt_dev_err(hdev, "ignoring invalid connection parameters"); 7006 continue; 7007 } 7008 7009 hci_param = hci_conn_params_add(hdev, ¶m->addr.bdaddr, 7010 addr_type); 7011 if (!hci_param) { 7012 bt_dev_err(hdev, "failed to add connection parameters"); 7013 continue; 7014 } 7015 7016 hci_param->conn_min_interval = min; 7017 hci_param->conn_max_interval = max; 7018 hci_param->conn_latency = latency; 7019 hci_param->supervision_timeout = timeout; 7020 } 7021 7022 hci_dev_unlock(hdev); 7023 7024 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM, 0, 7025 NULL, 0); 7026 } 7027 7028 static int set_external_config(struct sock *sk, struct hci_dev *hdev, 7029 void *data, u16 len) 7030 { 7031 struct mgmt_cp_set_external_config *cp = data; 7032 bool changed; 7033 int err; 7034 7035 bt_dev_dbg(hdev, "sock %p", sk); 7036 7037 if (hdev_is_powered(hdev)) 7038 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_EXTERNAL_CONFIG, 7039 MGMT_STATUS_REJECTED); 7040 7041 if (cp->config != 0x00 && cp->config != 0x01) 7042 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_EXTERNAL_CONFIG, 7043 MGMT_STATUS_INVALID_PARAMS); 7044 7045 if (!test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks)) 7046 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_EXTERNAL_CONFIG, 7047 MGMT_STATUS_NOT_SUPPORTED); 7048 7049 hci_dev_lock(hdev); 7050 7051 if (cp->config) 7052 changed = !hci_dev_test_and_set_flag(hdev, HCI_EXT_CONFIGURED); 7053 else 7054 changed = hci_dev_test_and_clear_flag(hdev, HCI_EXT_CONFIGURED); 7055 7056 err = send_options_rsp(sk, MGMT_OP_SET_EXTERNAL_CONFIG, hdev); 7057 if (err < 0) 7058 goto unlock; 7059 7060 if (!changed) 7061 goto unlock; 7062 7063 err = new_options(hdev, sk); 7064 7065 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED) == is_configured(hdev)) { 7066 mgmt_index_removed(hdev); 7067 7068 if (hci_dev_test_and_change_flag(hdev, HCI_UNCONFIGURED)) { 7069 hci_dev_set_flag(hdev, HCI_CONFIG); 7070 hci_dev_set_flag(hdev, HCI_AUTO_OFF); 7071 7072 queue_work(hdev->req_workqueue, &hdev->power_on); 7073 } else { 7074 set_bit(HCI_RAW, &hdev->flags); 7075 mgmt_index_added(hdev); 7076 } 7077 } 7078 7079 unlock: 7080 hci_dev_unlock(hdev); 7081 return err; 7082 } 7083 7084 static int set_public_address(struct sock *sk, struct hci_dev *hdev, 7085 void *data, u16 len) 7086 { 7087 struct mgmt_cp_set_public_address *cp = data; 7088 bool changed; 7089 int err; 7090 7091 bt_dev_dbg(hdev, "sock %p", sk); 7092 7093 if (hdev_is_powered(hdev)) 7094 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PUBLIC_ADDRESS, 7095 MGMT_STATUS_REJECTED); 7096 7097 if (!bacmp(&cp->bdaddr, BDADDR_ANY)) 7098 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PUBLIC_ADDRESS, 7099 MGMT_STATUS_INVALID_PARAMS); 7100 7101 if (!hdev->set_bdaddr) 7102 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PUBLIC_ADDRESS, 7103 MGMT_STATUS_NOT_SUPPORTED); 7104 7105 hci_dev_lock(hdev); 7106 7107 changed = !!bacmp(&hdev->public_addr, &cp->bdaddr); 7108 bacpy(&hdev->public_addr, &cp->bdaddr); 7109 7110 err = send_options_rsp(sk, MGMT_OP_SET_PUBLIC_ADDRESS, hdev); 7111 if (err < 0) 7112 goto unlock; 7113 7114 if (!changed) 7115 goto unlock; 7116 7117 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) 7118 err = new_options(hdev, sk); 7119 7120 if (is_configured(hdev)) { 7121 mgmt_index_removed(hdev); 7122 7123 hci_dev_clear_flag(hdev, HCI_UNCONFIGURED); 7124 7125 hci_dev_set_flag(hdev, HCI_CONFIG); 7126 hci_dev_set_flag(hdev, HCI_AUTO_OFF); 7127 7128 queue_work(hdev->req_workqueue, &hdev->power_on); 7129 } 7130 7131 unlock: 7132 hci_dev_unlock(hdev); 7133 return err; 7134 } 7135 7136 static void read_local_oob_ext_data_complete(struct hci_dev *hdev, u8 status, 7137 u16 opcode, struct sk_buff *skb) 7138 { 7139 const struct mgmt_cp_read_local_oob_ext_data *mgmt_cp; 7140 struct mgmt_rp_read_local_oob_ext_data *mgmt_rp; 7141 u8 *h192, *r192, *h256, *r256; 7142 struct mgmt_pending_cmd *cmd; 7143 u16 eir_len; 7144 int err; 7145 7146 bt_dev_dbg(hdev, "status %u", status); 7147 7148 cmd = pending_find(MGMT_OP_READ_LOCAL_OOB_EXT_DATA, hdev); 7149 if (!cmd) 7150 return; 7151 7152 mgmt_cp = cmd->param; 7153 7154 if (status) { 7155 status = mgmt_status(status); 7156 eir_len = 0; 7157 7158 h192 = NULL; 7159 r192 = NULL; 7160 h256 = NULL; 7161 r256 = NULL; 7162 } else if (opcode == HCI_OP_READ_LOCAL_OOB_DATA) { 7163 struct hci_rp_read_local_oob_data *rp; 7164 7165 if (skb->len != sizeof(*rp)) { 7166 status = MGMT_STATUS_FAILED; 7167 eir_len = 0; 7168 } else { 7169 status = MGMT_STATUS_SUCCESS; 7170 rp = (void *)skb->data; 7171 7172 eir_len = 5 + 18 + 18; 7173 h192 = rp->hash; 7174 r192 = rp->rand; 7175 h256 = NULL; 7176 r256 = NULL; 7177 } 7178 } else { 7179 struct hci_rp_read_local_oob_ext_data *rp; 7180 7181 if (skb->len != sizeof(*rp)) { 7182 status = MGMT_STATUS_FAILED; 7183 eir_len = 0; 7184 } else { 7185 status = MGMT_STATUS_SUCCESS; 7186 rp = (void *)skb->data; 7187 7188 if (hci_dev_test_flag(hdev, HCI_SC_ONLY)) { 7189 eir_len = 5 + 18 + 18; 7190 h192 = NULL; 7191 r192 = NULL; 7192 } else { 7193 eir_len = 5 + 18 + 18 + 18 + 18; 7194 h192 = rp->hash192; 7195 r192 = rp->rand192; 7196 } 7197 7198 h256 = rp->hash256; 7199 r256 = rp->rand256; 7200 } 7201 } 7202 7203 mgmt_rp = kmalloc(sizeof(*mgmt_rp) + eir_len, GFP_KERNEL); 7204 if (!mgmt_rp) 7205 goto done; 7206 7207 if (status) 7208 goto send_rsp; 7209 7210 eir_len = eir_append_data(mgmt_rp->eir, 0, EIR_CLASS_OF_DEV, 7211 hdev->dev_class, 3); 7212 7213 if (h192 && r192) { 7214 eir_len = eir_append_data(mgmt_rp->eir, eir_len, 7215 EIR_SSP_HASH_C192, h192, 16); 7216 eir_len = eir_append_data(mgmt_rp->eir, eir_len, 7217 EIR_SSP_RAND_R192, r192, 16); 7218 } 7219 7220 if (h256 && r256) { 7221 eir_len = eir_append_data(mgmt_rp->eir, eir_len, 7222 EIR_SSP_HASH_C256, h256, 16); 7223 eir_len = eir_append_data(mgmt_rp->eir, eir_len, 7224 EIR_SSP_RAND_R256, r256, 16); 7225 } 7226 7227 send_rsp: 7228 mgmt_rp->type = mgmt_cp->type; 7229 mgmt_rp->eir_len = cpu_to_le16(eir_len); 7230 7231 err = mgmt_cmd_complete(cmd->sk, hdev->id, 7232 MGMT_OP_READ_LOCAL_OOB_EXT_DATA, status, 7233 mgmt_rp, sizeof(*mgmt_rp) + eir_len); 7234 if (err < 0 || status) 7235 goto done; 7236 7237 hci_sock_set_flag(cmd->sk, HCI_MGMT_OOB_DATA_EVENTS); 7238 7239 err = mgmt_limited_event(MGMT_EV_LOCAL_OOB_DATA_UPDATED, hdev, 7240 mgmt_rp, sizeof(*mgmt_rp) + eir_len, 7241 HCI_MGMT_OOB_DATA_EVENTS, cmd->sk); 7242 done: 7243 kfree(mgmt_rp); 7244 mgmt_pending_remove(cmd); 7245 } 7246 7247 static int read_local_ssp_oob_req(struct hci_dev *hdev, struct sock *sk, 7248 struct mgmt_cp_read_local_oob_ext_data *cp) 7249 { 7250 struct mgmt_pending_cmd *cmd; 7251 struct hci_request req; 7252 int err; 7253 7254 cmd = mgmt_pending_add(sk, MGMT_OP_READ_LOCAL_OOB_EXT_DATA, hdev, 7255 cp, sizeof(*cp)); 7256 if (!cmd) 7257 return -ENOMEM; 7258 7259 hci_req_init(&req, hdev); 7260 7261 if (bredr_sc_enabled(hdev)) 7262 hci_req_add(&req, HCI_OP_READ_LOCAL_OOB_EXT_DATA, 0, NULL); 7263 else 7264 hci_req_add(&req, HCI_OP_READ_LOCAL_OOB_DATA, 0, NULL); 7265 7266 err = hci_req_run_skb(&req, read_local_oob_ext_data_complete); 7267 if (err < 0) { 7268 mgmt_pending_remove(cmd); 7269 return err; 7270 } 7271 7272 return 0; 7273 } 7274 7275 static int read_local_oob_ext_data(struct sock *sk, struct hci_dev *hdev, 7276 void *data, u16 data_len) 7277 { 7278 struct mgmt_cp_read_local_oob_ext_data *cp = data; 7279 struct mgmt_rp_read_local_oob_ext_data *rp; 7280 size_t rp_len; 7281 u16 eir_len; 7282 u8 status, flags, role, addr[7], hash[16], rand[16]; 7283 int err; 7284 7285 bt_dev_dbg(hdev, "sock %p", sk); 7286 7287 if (hdev_is_powered(hdev)) { 7288 switch (cp->type) { 7289 case BIT(BDADDR_BREDR): 7290 status = mgmt_bredr_support(hdev); 7291 if (status) 7292 eir_len = 0; 7293 else 7294 eir_len = 5; 7295 break; 7296 case (BIT(BDADDR_LE_PUBLIC) | BIT(BDADDR_LE_RANDOM)): 7297 status = mgmt_le_support(hdev); 7298 if (status) 7299 eir_len = 0; 7300 else 7301 eir_len = 9 + 3 + 18 + 18 + 3; 7302 break; 7303 default: 7304 status = MGMT_STATUS_INVALID_PARAMS; 7305 eir_len = 0; 7306 break; 7307 } 7308 } else { 7309 status = MGMT_STATUS_NOT_POWERED; 7310 eir_len = 0; 7311 } 7312 7313 rp_len = sizeof(*rp) + eir_len; 7314 rp = kmalloc(rp_len, GFP_ATOMIC); 7315 if (!rp) 7316 return -ENOMEM; 7317 7318 if (status) 7319 goto complete; 7320 7321 hci_dev_lock(hdev); 7322 7323 eir_len = 0; 7324 switch (cp->type) { 7325 case BIT(BDADDR_BREDR): 7326 if (hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) { 7327 err = read_local_ssp_oob_req(hdev, sk, cp); 7328 hci_dev_unlock(hdev); 7329 if (!err) 7330 goto done; 7331 7332 status = MGMT_STATUS_FAILED; 7333 goto complete; 7334 } else { 7335 eir_len = eir_append_data(rp->eir, eir_len, 7336 EIR_CLASS_OF_DEV, 7337 hdev->dev_class, 3); 7338 } 7339 break; 7340 case (BIT(BDADDR_LE_PUBLIC) | BIT(BDADDR_LE_RANDOM)): 7341 if (hci_dev_test_flag(hdev, HCI_SC_ENABLED) && 7342 smp_generate_oob(hdev, hash, rand) < 0) { 7343 hci_dev_unlock(hdev); 7344 status = MGMT_STATUS_FAILED; 7345 goto complete; 7346 } 7347 7348 /* This should return the active RPA, but since the RPA 7349 * is only programmed on demand, it is really hard to fill 7350 * this in at the moment. For now disallow retrieving 7351 * local out-of-band data when privacy is in use. 7352 * 7353 * Returning the identity address will not help here since 7354 * pairing happens before the identity resolving key is 7355 * known and thus the connection establishment happens 7356 * based on the RPA and not the identity address. 7357 */ 7358 if (hci_dev_test_flag(hdev, HCI_PRIVACY)) { 7359 hci_dev_unlock(hdev); 7360 status = MGMT_STATUS_REJECTED; 7361 goto complete; 7362 } 7363 7364 if (hci_dev_test_flag(hdev, HCI_FORCE_STATIC_ADDR) || 7365 !bacmp(&hdev->bdaddr, BDADDR_ANY) || 7366 (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) && 7367 bacmp(&hdev->static_addr, BDADDR_ANY))) { 7368 memcpy(addr, &hdev->static_addr, 6); 7369 addr[6] = 0x01; 7370 } else { 7371 memcpy(addr, &hdev->bdaddr, 6); 7372 addr[6] = 0x00; 7373 } 7374 7375 eir_len = eir_append_data(rp->eir, eir_len, EIR_LE_BDADDR, 7376 addr, sizeof(addr)); 7377 7378 if (hci_dev_test_flag(hdev, HCI_ADVERTISING)) 7379 role = 0x02; 7380 else 7381 role = 0x01; 7382 7383 eir_len = eir_append_data(rp->eir, eir_len, EIR_LE_ROLE, 7384 &role, sizeof(role)); 7385 7386 if (hci_dev_test_flag(hdev, HCI_SC_ENABLED)) { 7387 eir_len = eir_append_data(rp->eir, eir_len, 7388 EIR_LE_SC_CONFIRM, 7389 hash, sizeof(hash)); 7390 7391 eir_len = eir_append_data(rp->eir, eir_len, 7392 EIR_LE_SC_RANDOM, 7393 rand, sizeof(rand)); 7394 } 7395 7396 flags = mgmt_get_adv_discov_flags(hdev); 7397 7398 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) 7399 flags |= LE_AD_NO_BREDR; 7400 7401 eir_len = eir_append_data(rp->eir, eir_len, EIR_FLAGS, 7402 &flags, sizeof(flags)); 7403 break; 7404 } 7405 7406 hci_dev_unlock(hdev); 7407 7408 hci_sock_set_flag(sk, HCI_MGMT_OOB_DATA_EVENTS); 7409 7410 status = MGMT_STATUS_SUCCESS; 7411 7412 complete: 7413 rp->type = cp->type; 7414 rp->eir_len = cpu_to_le16(eir_len); 7415 7416 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_EXT_DATA, 7417 status, rp, sizeof(*rp) + eir_len); 7418 if (err < 0 || status) 7419 goto done; 7420 7421 err = mgmt_limited_event(MGMT_EV_LOCAL_OOB_DATA_UPDATED, hdev, 7422 rp, sizeof(*rp) + eir_len, 7423 HCI_MGMT_OOB_DATA_EVENTS, sk); 7424 7425 done: 7426 kfree(rp); 7427 7428 return err; 7429 } 7430 7431 static u32 get_supported_adv_flags(struct hci_dev *hdev) 7432 { 7433 u32 flags = 0; 7434 7435 flags |= MGMT_ADV_FLAG_CONNECTABLE; 7436 flags |= MGMT_ADV_FLAG_DISCOV; 7437 flags |= MGMT_ADV_FLAG_LIMITED_DISCOV; 7438 flags |= MGMT_ADV_FLAG_MANAGED_FLAGS; 7439 flags |= MGMT_ADV_FLAG_APPEARANCE; 7440 flags |= MGMT_ADV_FLAG_LOCAL_NAME; 7441 flags |= MGMT_ADV_PARAM_DURATION; 7442 flags |= MGMT_ADV_PARAM_TIMEOUT; 7443 flags |= MGMT_ADV_PARAM_INTERVALS; 7444 flags |= MGMT_ADV_PARAM_TX_POWER; 7445 flags |= MGMT_ADV_PARAM_SCAN_RSP; 7446 7447 /* In extended adv TX_POWER returned from Set Adv Param 7448 * will be always valid. 7449 */ 7450 if ((hdev->adv_tx_power != HCI_TX_POWER_INVALID) || 7451 ext_adv_capable(hdev)) 7452 flags |= MGMT_ADV_FLAG_TX_POWER; 7453 7454 if (ext_adv_capable(hdev)) { 7455 flags |= MGMT_ADV_FLAG_SEC_1M; 7456 flags |= MGMT_ADV_FLAG_HW_OFFLOAD; 7457 flags |= MGMT_ADV_FLAG_CAN_SET_TX_POWER; 7458 7459 if (hdev->le_features[1] & HCI_LE_PHY_2M) 7460 flags |= MGMT_ADV_FLAG_SEC_2M; 7461 7462 if (hdev->le_features[1] & HCI_LE_PHY_CODED) 7463 flags |= MGMT_ADV_FLAG_SEC_CODED; 7464 } 7465 7466 return flags; 7467 } 7468 7469 static int read_adv_features(struct sock *sk, struct hci_dev *hdev, 7470 void *data, u16 data_len) 7471 { 7472 struct mgmt_rp_read_adv_features *rp; 7473 size_t rp_len; 7474 int err; 7475 struct adv_info *adv_instance; 7476 u32 supported_flags; 7477 u8 *instance; 7478 7479 bt_dev_dbg(hdev, "sock %p", sk); 7480 7481 if (!lmp_le_capable(hdev)) 7482 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_ADV_FEATURES, 7483 MGMT_STATUS_REJECTED); 7484 7485 /* Enabling the experimental LL Privay support disables support for 7486 * advertising. 7487 */ 7488 if (hci_dev_test_flag(hdev, HCI_ENABLE_LL_PRIVACY)) 7489 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_ADV_FEATURES, 7490 MGMT_STATUS_NOT_SUPPORTED); 7491 7492 hci_dev_lock(hdev); 7493 7494 rp_len = sizeof(*rp) + hdev->adv_instance_cnt; 7495 rp = kmalloc(rp_len, GFP_ATOMIC); 7496 if (!rp) { 7497 hci_dev_unlock(hdev); 7498 return -ENOMEM; 7499 } 7500 7501 supported_flags = get_supported_adv_flags(hdev); 7502 7503 rp->supported_flags = cpu_to_le32(supported_flags); 7504 rp->max_adv_data_len = HCI_MAX_AD_LENGTH; 7505 rp->max_scan_rsp_len = HCI_MAX_AD_LENGTH; 7506 rp->max_instances = hdev->le_num_of_adv_sets; 7507 rp->num_instances = hdev->adv_instance_cnt; 7508 7509 instance = rp->instance; 7510 list_for_each_entry(adv_instance, &hdev->adv_instances, list) { 7511 *instance = adv_instance->instance; 7512 instance++; 7513 } 7514 7515 hci_dev_unlock(hdev); 7516 7517 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_ADV_FEATURES, 7518 MGMT_STATUS_SUCCESS, rp, rp_len); 7519 7520 kfree(rp); 7521 7522 return err; 7523 } 7524 7525 static u8 calculate_name_len(struct hci_dev *hdev) 7526 { 7527 u8 buf[HCI_MAX_SHORT_NAME_LENGTH + 3]; 7528 7529 return append_local_name(hdev, buf, 0); 7530 } 7531 7532 static u8 tlv_data_max_len(struct hci_dev *hdev, u32 adv_flags, 7533 bool is_adv_data) 7534 { 7535 u8 max_len = HCI_MAX_AD_LENGTH; 7536 7537 if (is_adv_data) { 7538 if (adv_flags & (MGMT_ADV_FLAG_DISCOV | 7539 MGMT_ADV_FLAG_LIMITED_DISCOV | 7540 MGMT_ADV_FLAG_MANAGED_FLAGS)) 7541 max_len -= 3; 7542 7543 if (adv_flags & MGMT_ADV_FLAG_TX_POWER) 7544 max_len -= 3; 7545 } else { 7546 if (adv_flags & MGMT_ADV_FLAG_LOCAL_NAME) 7547 max_len -= calculate_name_len(hdev); 7548 7549 if (adv_flags & (MGMT_ADV_FLAG_APPEARANCE)) 7550 max_len -= 4; 7551 } 7552 7553 return max_len; 7554 } 7555 7556 static bool flags_managed(u32 adv_flags) 7557 { 7558 return adv_flags & (MGMT_ADV_FLAG_DISCOV | 7559 MGMT_ADV_FLAG_LIMITED_DISCOV | 7560 MGMT_ADV_FLAG_MANAGED_FLAGS); 7561 } 7562 7563 static bool tx_power_managed(u32 adv_flags) 7564 { 7565 return adv_flags & MGMT_ADV_FLAG_TX_POWER; 7566 } 7567 7568 static bool name_managed(u32 adv_flags) 7569 { 7570 return adv_flags & MGMT_ADV_FLAG_LOCAL_NAME; 7571 } 7572 7573 static bool appearance_managed(u32 adv_flags) 7574 { 7575 return adv_flags & MGMT_ADV_FLAG_APPEARANCE; 7576 } 7577 7578 static bool tlv_data_is_valid(struct hci_dev *hdev, u32 adv_flags, u8 *data, 7579 u8 len, bool is_adv_data) 7580 { 7581 int i, cur_len; 7582 u8 max_len; 7583 7584 max_len = tlv_data_max_len(hdev, adv_flags, is_adv_data); 7585 7586 if (len > max_len) 7587 return false; 7588 7589 /* Make sure that the data is correctly formatted. */ 7590 for (i = 0, cur_len = 0; i < len; i += (cur_len + 1)) { 7591 cur_len = data[i]; 7592 7593 if (!cur_len) 7594 continue; 7595 7596 if (data[i + 1] == EIR_FLAGS && 7597 (!is_adv_data || flags_managed(adv_flags))) 7598 return false; 7599 7600 if (data[i + 1] == EIR_TX_POWER && tx_power_managed(adv_flags)) 7601 return false; 7602 7603 if (data[i + 1] == EIR_NAME_COMPLETE && name_managed(adv_flags)) 7604 return false; 7605 7606 if (data[i + 1] == EIR_NAME_SHORT && name_managed(adv_flags)) 7607 return false; 7608 7609 if (data[i + 1] == EIR_APPEARANCE && 7610 appearance_managed(adv_flags)) 7611 return false; 7612 7613 /* If the current field length would exceed the total data 7614 * length, then it's invalid. 7615 */ 7616 if (i + cur_len >= len) 7617 return false; 7618 } 7619 7620 return true; 7621 } 7622 7623 static bool requested_adv_flags_are_valid(struct hci_dev *hdev, u32 adv_flags) 7624 { 7625 u32 supported_flags, phy_flags; 7626 7627 /* The current implementation only supports a subset of the specified 7628 * flags. Also need to check mutual exclusiveness of sec flags. 7629 */ 7630 supported_flags = get_supported_adv_flags(hdev); 7631 phy_flags = adv_flags & MGMT_ADV_FLAG_SEC_MASK; 7632 if (adv_flags & ~supported_flags || 7633 ((phy_flags && (phy_flags ^ (phy_flags & -phy_flags))))) 7634 return false; 7635 7636 return true; 7637 } 7638 7639 static bool adv_busy(struct hci_dev *hdev) 7640 { 7641 return (pending_find(MGMT_OP_ADD_ADVERTISING, hdev) || 7642 pending_find(MGMT_OP_REMOVE_ADVERTISING, hdev) || 7643 pending_find(MGMT_OP_SET_LE, hdev) || 7644 pending_find(MGMT_OP_ADD_EXT_ADV_PARAMS, hdev) || 7645 pending_find(MGMT_OP_ADD_EXT_ADV_DATA, hdev)); 7646 } 7647 7648 static void add_advertising_complete(struct hci_dev *hdev, u8 status, 7649 u16 opcode) 7650 { 7651 struct mgmt_pending_cmd *cmd; 7652 struct mgmt_cp_add_advertising *cp; 7653 struct mgmt_rp_add_advertising rp; 7654 struct adv_info *adv_instance, *n; 7655 u8 instance; 7656 7657 bt_dev_dbg(hdev, "status %u", status); 7658 7659 hci_dev_lock(hdev); 7660 7661 cmd = pending_find(MGMT_OP_ADD_ADVERTISING, hdev); 7662 if (!cmd) 7663 cmd = pending_find(MGMT_OP_ADD_EXT_ADV_DATA, hdev); 7664 7665 list_for_each_entry_safe(adv_instance, n, &hdev->adv_instances, list) { 7666 if (!adv_instance->pending) 7667 continue; 7668 7669 if (!status) { 7670 adv_instance->pending = false; 7671 continue; 7672 } 7673 7674 instance = adv_instance->instance; 7675 7676 if (hdev->cur_adv_instance == instance) 7677 cancel_adv_timeout(hdev); 7678 7679 hci_remove_adv_instance(hdev, instance); 7680 mgmt_advertising_removed(cmd ? cmd->sk : NULL, hdev, instance); 7681 } 7682 7683 if (!cmd) 7684 goto unlock; 7685 7686 cp = cmd->param; 7687 rp.instance = cp->instance; 7688 7689 if (status) 7690 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, 7691 mgmt_status(status)); 7692 else 7693 mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, 7694 mgmt_status(status), &rp, sizeof(rp)); 7695 7696 mgmt_pending_remove(cmd); 7697 7698 unlock: 7699 hci_dev_unlock(hdev); 7700 } 7701 7702 static int add_advertising(struct sock *sk, struct hci_dev *hdev, 7703 void *data, u16 data_len) 7704 { 7705 struct mgmt_cp_add_advertising *cp = data; 7706 struct mgmt_rp_add_advertising rp; 7707 u32 flags; 7708 u8 status; 7709 u16 timeout, duration; 7710 unsigned int prev_instance_cnt = hdev->adv_instance_cnt; 7711 u8 schedule_instance = 0; 7712 struct adv_info *next_instance; 7713 int err; 7714 struct mgmt_pending_cmd *cmd; 7715 struct hci_request req; 7716 7717 bt_dev_dbg(hdev, "sock %p", sk); 7718 7719 status = mgmt_le_support(hdev); 7720 if (status) 7721 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING, 7722 status); 7723 7724 /* Enabling the experimental LL Privay support disables support for 7725 * advertising. 7726 */ 7727 if (hci_dev_test_flag(hdev, HCI_ENABLE_LL_PRIVACY)) 7728 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING, 7729 MGMT_STATUS_NOT_SUPPORTED); 7730 7731 if (cp->instance < 1 || cp->instance > hdev->le_num_of_adv_sets) 7732 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING, 7733 MGMT_STATUS_INVALID_PARAMS); 7734 7735 if (data_len != sizeof(*cp) + cp->adv_data_len + cp->scan_rsp_len) 7736 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING, 7737 MGMT_STATUS_INVALID_PARAMS); 7738 7739 flags = __le32_to_cpu(cp->flags); 7740 timeout = __le16_to_cpu(cp->timeout); 7741 duration = __le16_to_cpu(cp->duration); 7742 7743 if (!requested_adv_flags_are_valid(hdev, flags)) 7744 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING, 7745 MGMT_STATUS_INVALID_PARAMS); 7746 7747 hci_dev_lock(hdev); 7748 7749 if (timeout && !hdev_is_powered(hdev)) { 7750 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING, 7751 MGMT_STATUS_REJECTED); 7752 goto unlock; 7753 } 7754 7755 if (adv_busy(hdev)) { 7756 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING, 7757 MGMT_STATUS_BUSY); 7758 goto unlock; 7759 } 7760 7761 if (!tlv_data_is_valid(hdev, flags, cp->data, cp->adv_data_len, true) || 7762 !tlv_data_is_valid(hdev, flags, cp->data + cp->adv_data_len, 7763 cp->scan_rsp_len, false)) { 7764 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING, 7765 MGMT_STATUS_INVALID_PARAMS); 7766 goto unlock; 7767 } 7768 7769 err = hci_add_adv_instance(hdev, cp->instance, flags, 7770 cp->adv_data_len, cp->data, 7771 cp->scan_rsp_len, 7772 cp->data + cp->adv_data_len, 7773 timeout, duration, 7774 HCI_ADV_TX_POWER_NO_PREFERENCE, 7775 hdev->le_adv_min_interval, 7776 hdev->le_adv_max_interval); 7777 if (err < 0) { 7778 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING, 7779 MGMT_STATUS_FAILED); 7780 goto unlock; 7781 } 7782 7783 /* Only trigger an advertising added event if a new instance was 7784 * actually added. 7785 */ 7786 if (hdev->adv_instance_cnt > prev_instance_cnt) 7787 mgmt_advertising_added(sk, hdev, cp->instance); 7788 7789 if (hdev->cur_adv_instance == cp->instance) { 7790 /* If the currently advertised instance is being changed then 7791 * cancel the current advertising and schedule the next 7792 * instance. If there is only one instance then the overridden 7793 * advertising data will be visible right away. 7794 */ 7795 cancel_adv_timeout(hdev); 7796 7797 next_instance = hci_get_next_instance(hdev, cp->instance); 7798 if (next_instance) 7799 schedule_instance = next_instance->instance; 7800 } else if (!hdev->adv_instance_timeout) { 7801 /* Immediately advertise the new instance if no other 7802 * instance is currently being advertised. 7803 */ 7804 schedule_instance = cp->instance; 7805 } 7806 7807 /* If the HCI_ADVERTISING flag is set or the device isn't powered or 7808 * there is no instance to be advertised then we have no HCI 7809 * communication to make. Simply return. 7810 */ 7811 if (!hdev_is_powered(hdev) || 7812 hci_dev_test_flag(hdev, HCI_ADVERTISING) || 7813 !schedule_instance) { 7814 rp.instance = cp->instance; 7815 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_ADVERTISING, 7816 MGMT_STATUS_SUCCESS, &rp, sizeof(rp)); 7817 goto unlock; 7818 } 7819 7820 /* We're good to go, update advertising data, parameters, and start 7821 * advertising. 7822 */ 7823 cmd = mgmt_pending_add(sk, MGMT_OP_ADD_ADVERTISING, hdev, data, 7824 data_len); 7825 if (!cmd) { 7826 err = -ENOMEM; 7827 goto unlock; 7828 } 7829 7830 hci_req_init(&req, hdev); 7831 7832 err = __hci_req_schedule_adv_instance(&req, schedule_instance, true); 7833 7834 if (!err) 7835 err = hci_req_run(&req, add_advertising_complete); 7836 7837 if (err < 0) { 7838 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING, 7839 MGMT_STATUS_FAILED); 7840 mgmt_pending_remove(cmd); 7841 } 7842 7843 unlock: 7844 hci_dev_unlock(hdev); 7845 7846 return err; 7847 } 7848 7849 static void add_ext_adv_params_complete(struct hci_dev *hdev, u8 status, 7850 u16 opcode) 7851 { 7852 struct mgmt_pending_cmd *cmd; 7853 struct mgmt_cp_add_ext_adv_params *cp; 7854 struct mgmt_rp_add_ext_adv_params rp; 7855 struct adv_info *adv_instance; 7856 u32 flags; 7857 7858 BT_DBG("%s", hdev->name); 7859 7860 hci_dev_lock(hdev); 7861 7862 cmd = pending_find(MGMT_OP_ADD_EXT_ADV_PARAMS, hdev); 7863 if (!cmd) 7864 goto unlock; 7865 7866 cp = cmd->param; 7867 adv_instance = hci_find_adv_instance(hdev, cp->instance); 7868 if (!adv_instance) 7869 goto unlock; 7870 7871 rp.instance = cp->instance; 7872 rp.tx_power = adv_instance->tx_power; 7873 7874 /* While we're at it, inform userspace of the available space for this 7875 * advertisement, given the flags that will be used. 7876 */ 7877 flags = __le32_to_cpu(cp->flags); 7878 rp.max_adv_data_len = tlv_data_max_len(hdev, flags, true); 7879 rp.max_scan_rsp_len = tlv_data_max_len(hdev, flags, false); 7880 7881 if (status) { 7882 /* If this advertisement was previously advertising and we 7883 * failed to update it, we signal that it has been removed and 7884 * delete its structure 7885 */ 7886 if (!adv_instance->pending) 7887 mgmt_advertising_removed(cmd->sk, hdev, cp->instance); 7888 7889 hci_remove_adv_instance(hdev, cp->instance); 7890 7891 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, 7892 mgmt_status(status)); 7893 7894 } else { 7895 mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, 7896 mgmt_status(status), &rp, sizeof(rp)); 7897 } 7898 7899 unlock: 7900 if (cmd) 7901 mgmt_pending_remove(cmd); 7902 7903 hci_dev_unlock(hdev); 7904 } 7905 7906 static int add_ext_adv_params(struct sock *sk, struct hci_dev *hdev, 7907 void *data, u16 data_len) 7908 { 7909 struct mgmt_cp_add_ext_adv_params *cp = data; 7910 struct mgmt_rp_add_ext_adv_params rp; 7911 struct mgmt_pending_cmd *cmd = NULL; 7912 struct adv_info *adv_instance; 7913 struct hci_request req; 7914 u32 flags, min_interval, max_interval; 7915 u16 timeout, duration; 7916 u8 status; 7917 s8 tx_power; 7918 int err; 7919 7920 BT_DBG("%s", hdev->name); 7921 7922 status = mgmt_le_support(hdev); 7923 if (status) 7924 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_PARAMS, 7925 status); 7926 7927 if (cp->instance < 1 || cp->instance > hdev->le_num_of_adv_sets) 7928 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_PARAMS, 7929 MGMT_STATUS_INVALID_PARAMS); 7930 7931 /* The purpose of breaking add_advertising into two separate MGMT calls 7932 * for params and data is to allow more parameters to be added to this 7933 * structure in the future. For this reason, we verify that we have the 7934 * bare minimum structure we know of when the interface was defined. Any 7935 * extra parameters we don't know about will be ignored in this request. 7936 */ 7937 if (data_len < MGMT_ADD_EXT_ADV_PARAMS_MIN_SIZE) 7938 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING, 7939 MGMT_STATUS_INVALID_PARAMS); 7940 7941 flags = __le32_to_cpu(cp->flags); 7942 7943 if (!requested_adv_flags_are_valid(hdev, flags)) 7944 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_PARAMS, 7945 MGMT_STATUS_INVALID_PARAMS); 7946 7947 hci_dev_lock(hdev); 7948 7949 /* In new interface, we require that we are powered to register */ 7950 if (!hdev_is_powered(hdev)) { 7951 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_PARAMS, 7952 MGMT_STATUS_REJECTED); 7953 goto unlock; 7954 } 7955 7956 if (adv_busy(hdev)) { 7957 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_PARAMS, 7958 MGMT_STATUS_BUSY); 7959 goto unlock; 7960 } 7961 7962 /* Parse defined parameters from request, use defaults otherwise */ 7963 timeout = (flags & MGMT_ADV_PARAM_TIMEOUT) ? 7964 __le16_to_cpu(cp->timeout) : 0; 7965 7966 duration = (flags & MGMT_ADV_PARAM_DURATION) ? 7967 __le16_to_cpu(cp->duration) : 7968 hdev->def_multi_adv_rotation_duration; 7969 7970 min_interval = (flags & MGMT_ADV_PARAM_INTERVALS) ? 7971 __le32_to_cpu(cp->min_interval) : 7972 hdev->le_adv_min_interval; 7973 7974 max_interval = (flags & MGMT_ADV_PARAM_INTERVALS) ? 7975 __le32_to_cpu(cp->max_interval) : 7976 hdev->le_adv_max_interval; 7977 7978 tx_power = (flags & MGMT_ADV_PARAM_TX_POWER) ? 7979 cp->tx_power : 7980 HCI_ADV_TX_POWER_NO_PREFERENCE; 7981 7982 /* Create advertising instance with no advertising or response data */ 7983 err = hci_add_adv_instance(hdev, cp->instance, flags, 7984 0, NULL, 0, NULL, timeout, duration, 7985 tx_power, min_interval, max_interval); 7986 7987 if (err < 0) { 7988 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_PARAMS, 7989 MGMT_STATUS_FAILED); 7990 goto unlock; 7991 } 7992 7993 /* Submit request for advertising params if ext adv available */ 7994 if (ext_adv_capable(hdev)) { 7995 hci_req_init(&req, hdev); 7996 adv_instance = hci_find_adv_instance(hdev, cp->instance); 7997 7998 /* Updating parameters of an active instance will return a 7999 * Command Disallowed error, so we must first disable the 8000 * instance if it is active. 8001 */ 8002 if (!adv_instance->pending) 8003 __hci_req_disable_ext_adv_instance(&req, cp->instance); 8004 8005 __hci_req_setup_ext_adv_instance(&req, cp->instance); 8006 8007 err = hci_req_run(&req, add_ext_adv_params_complete); 8008 8009 if (!err) 8010 cmd = mgmt_pending_add(sk, MGMT_OP_ADD_EXT_ADV_PARAMS, 8011 hdev, data, data_len); 8012 if (!cmd) { 8013 err = -ENOMEM; 8014 hci_remove_adv_instance(hdev, cp->instance); 8015 goto unlock; 8016 } 8017 8018 } else { 8019 rp.instance = cp->instance; 8020 rp.tx_power = HCI_ADV_TX_POWER_NO_PREFERENCE; 8021 rp.max_adv_data_len = tlv_data_max_len(hdev, flags, true); 8022 rp.max_scan_rsp_len = tlv_data_max_len(hdev, flags, false); 8023 err = mgmt_cmd_complete(sk, hdev->id, 8024 MGMT_OP_ADD_EXT_ADV_PARAMS, 8025 MGMT_STATUS_SUCCESS, &rp, sizeof(rp)); 8026 } 8027 8028 unlock: 8029 hci_dev_unlock(hdev); 8030 8031 return err; 8032 } 8033 8034 static int add_ext_adv_data(struct sock *sk, struct hci_dev *hdev, void *data, 8035 u16 data_len) 8036 { 8037 struct mgmt_cp_add_ext_adv_data *cp = data; 8038 struct mgmt_rp_add_ext_adv_data rp; 8039 u8 schedule_instance = 0; 8040 struct adv_info *next_instance; 8041 struct adv_info *adv_instance; 8042 int err = 0; 8043 struct mgmt_pending_cmd *cmd; 8044 struct hci_request req; 8045 8046 BT_DBG("%s", hdev->name); 8047 8048 hci_dev_lock(hdev); 8049 8050 adv_instance = hci_find_adv_instance(hdev, cp->instance); 8051 8052 if (!adv_instance) { 8053 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_DATA, 8054 MGMT_STATUS_INVALID_PARAMS); 8055 goto unlock; 8056 } 8057 8058 /* In new interface, we require that we are powered to register */ 8059 if (!hdev_is_powered(hdev)) { 8060 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_DATA, 8061 MGMT_STATUS_REJECTED); 8062 goto clear_new_instance; 8063 } 8064 8065 if (adv_busy(hdev)) { 8066 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_DATA, 8067 MGMT_STATUS_BUSY); 8068 goto clear_new_instance; 8069 } 8070 8071 /* Validate new data */ 8072 if (!tlv_data_is_valid(hdev, adv_instance->flags, cp->data, 8073 cp->adv_data_len, true) || 8074 !tlv_data_is_valid(hdev, adv_instance->flags, cp->data + 8075 cp->adv_data_len, cp->scan_rsp_len, false)) { 8076 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_DATA, 8077 MGMT_STATUS_INVALID_PARAMS); 8078 goto clear_new_instance; 8079 } 8080 8081 /* Set the data in the advertising instance */ 8082 hci_set_adv_instance_data(hdev, cp->instance, cp->adv_data_len, 8083 cp->data, cp->scan_rsp_len, 8084 cp->data + cp->adv_data_len); 8085 8086 /* We're good to go, update advertising data, parameters, and start 8087 * advertising. 8088 */ 8089 8090 hci_req_init(&req, hdev); 8091 8092 hci_req_add(&req, HCI_OP_READ_LOCAL_NAME, 0, NULL); 8093 8094 if (ext_adv_capable(hdev)) { 8095 __hci_req_update_adv_data(&req, cp->instance); 8096 __hci_req_update_scan_rsp_data(&req, cp->instance); 8097 __hci_req_enable_ext_advertising(&req, cp->instance); 8098 8099 } else { 8100 /* If using software rotation, determine next instance to use */ 8101 8102 if (hdev->cur_adv_instance == cp->instance) { 8103 /* If the currently advertised instance is being changed 8104 * then cancel the current advertising and schedule the 8105 * next instance. If there is only one instance then the 8106 * overridden advertising data will be visible right 8107 * away 8108 */ 8109 cancel_adv_timeout(hdev); 8110 8111 next_instance = hci_get_next_instance(hdev, 8112 cp->instance); 8113 if (next_instance) 8114 schedule_instance = next_instance->instance; 8115 } else if (!hdev->adv_instance_timeout) { 8116 /* Immediately advertise the new instance if no other 8117 * instance is currently being advertised. 8118 */ 8119 schedule_instance = cp->instance; 8120 } 8121 8122 /* If the HCI_ADVERTISING flag is set or there is no instance to 8123 * be advertised then we have no HCI communication to make. 8124 * Simply return. 8125 */ 8126 if (hci_dev_test_flag(hdev, HCI_ADVERTISING) || 8127 !schedule_instance) { 8128 if (adv_instance->pending) { 8129 mgmt_advertising_added(sk, hdev, cp->instance); 8130 adv_instance->pending = false; 8131 } 8132 rp.instance = cp->instance; 8133 err = mgmt_cmd_complete(sk, hdev->id, 8134 MGMT_OP_ADD_EXT_ADV_DATA, 8135 MGMT_STATUS_SUCCESS, &rp, 8136 sizeof(rp)); 8137 goto unlock; 8138 } 8139 8140 err = __hci_req_schedule_adv_instance(&req, schedule_instance, 8141 true); 8142 } 8143 8144 cmd = mgmt_pending_add(sk, MGMT_OP_ADD_EXT_ADV_DATA, hdev, data, 8145 data_len); 8146 if (!cmd) { 8147 err = -ENOMEM; 8148 goto clear_new_instance; 8149 } 8150 8151 if (!err) 8152 err = hci_req_run(&req, add_advertising_complete); 8153 8154 if (err < 0) { 8155 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_DATA, 8156 MGMT_STATUS_FAILED); 8157 mgmt_pending_remove(cmd); 8158 goto clear_new_instance; 8159 } 8160 8161 /* We were successful in updating data, so trigger advertising_added 8162 * event if this is an instance that wasn't previously advertising. If 8163 * a failure occurs in the requests we initiated, we will remove the 8164 * instance again in add_advertising_complete 8165 */ 8166 if (adv_instance->pending) 8167 mgmt_advertising_added(sk, hdev, cp->instance); 8168 8169 goto unlock; 8170 8171 clear_new_instance: 8172 hci_remove_adv_instance(hdev, cp->instance); 8173 8174 unlock: 8175 hci_dev_unlock(hdev); 8176 8177 return err; 8178 } 8179 8180 static void remove_advertising_complete(struct hci_dev *hdev, u8 status, 8181 u16 opcode) 8182 { 8183 struct mgmt_pending_cmd *cmd; 8184 struct mgmt_cp_remove_advertising *cp; 8185 struct mgmt_rp_remove_advertising rp; 8186 8187 bt_dev_dbg(hdev, "status %u", status); 8188 8189 hci_dev_lock(hdev); 8190 8191 /* A failure status here only means that we failed to disable 8192 * advertising. Otherwise, the advertising instance has been removed, 8193 * so report success. 8194 */ 8195 cmd = pending_find(MGMT_OP_REMOVE_ADVERTISING, hdev); 8196 if (!cmd) 8197 goto unlock; 8198 8199 cp = cmd->param; 8200 rp.instance = cp->instance; 8201 8202 mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, MGMT_STATUS_SUCCESS, 8203 &rp, sizeof(rp)); 8204 mgmt_pending_remove(cmd); 8205 8206 unlock: 8207 hci_dev_unlock(hdev); 8208 } 8209 8210 static int remove_advertising(struct sock *sk, struct hci_dev *hdev, 8211 void *data, u16 data_len) 8212 { 8213 struct mgmt_cp_remove_advertising *cp = data; 8214 struct mgmt_rp_remove_advertising rp; 8215 struct mgmt_pending_cmd *cmd; 8216 struct hci_request req; 8217 int err; 8218 8219 bt_dev_dbg(hdev, "sock %p", sk); 8220 8221 /* Enabling the experimental LL Privay support disables support for 8222 * advertising. 8223 */ 8224 if (hci_dev_test_flag(hdev, HCI_ENABLE_LL_PRIVACY)) 8225 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING, 8226 MGMT_STATUS_NOT_SUPPORTED); 8227 8228 hci_dev_lock(hdev); 8229 8230 if (cp->instance && !hci_find_adv_instance(hdev, cp->instance)) { 8231 err = mgmt_cmd_status(sk, hdev->id, 8232 MGMT_OP_REMOVE_ADVERTISING, 8233 MGMT_STATUS_INVALID_PARAMS); 8234 goto unlock; 8235 } 8236 8237 if (pending_find(MGMT_OP_ADD_ADVERTISING, hdev) || 8238 pending_find(MGMT_OP_REMOVE_ADVERTISING, hdev) || 8239 pending_find(MGMT_OP_SET_LE, hdev)) { 8240 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_ADVERTISING, 8241 MGMT_STATUS_BUSY); 8242 goto unlock; 8243 } 8244 8245 if (list_empty(&hdev->adv_instances)) { 8246 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_ADVERTISING, 8247 MGMT_STATUS_INVALID_PARAMS); 8248 goto unlock; 8249 } 8250 8251 hci_req_init(&req, hdev); 8252 8253 /* If we use extended advertising, instance is disabled and removed */ 8254 if (ext_adv_capable(hdev)) { 8255 __hci_req_disable_ext_adv_instance(&req, cp->instance); 8256 __hci_req_remove_ext_adv_instance(&req, cp->instance); 8257 } 8258 8259 hci_req_clear_adv_instance(hdev, sk, &req, cp->instance, true); 8260 8261 if (list_empty(&hdev->adv_instances)) 8262 __hci_req_disable_advertising(&req); 8263 8264 /* If no HCI commands have been collected so far or the HCI_ADVERTISING 8265 * flag is set or the device isn't powered then we have no HCI 8266 * communication to make. Simply return. 8267 */ 8268 if (skb_queue_empty(&req.cmd_q) || 8269 !hdev_is_powered(hdev) || 8270 hci_dev_test_flag(hdev, HCI_ADVERTISING)) { 8271 hci_req_purge(&req); 8272 rp.instance = cp->instance; 8273 err = mgmt_cmd_complete(sk, hdev->id, 8274 MGMT_OP_REMOVE_ADVERTISING, 8275 MGMT_STATUS_SUCCESS, &rp, sizeof(rp)); 8276 goto unlock; 8277 } 8278 8279 cmd = mgmt_pending_add(sk, MGMT_OP_REMOVE_ADVERTISING, hdev, data, 8280 data_len); 8281 if (!cmd) { 8282 err = -ENOMEM; 8283 goto unlock; 8284 } 8285 8286 err = hci_req_run(&req, remove_advertising_complete); 8287 if (err < 0) 8288 mgmt_pending_remove(cmd); 8289 8290 unlock: 8291 hci_dev_unlock(hdev); 8292 8293 return err; 8294 } 8295 8296 static int get_adv_size_info(struct sock *sk, struct hci_dev *hdev, 8297 void *data, u16 data_len) 8298 { 8299 struct mgmt_cp_get_adv_size_info *cp = data; 8300 struct mgmt_rp_get_adv_size_info rp; 8301 u32 flags, supported_flags; 8302 int err; 8303 8304 bt_dev_dbg(hdev, "sock %p", sk); 8305 8306 if (!lmp_le_capable(hdev)) 8307 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_ADV_SIZE_INFO, 8308 MGMT_STATUS_REJECTED); 8309 8310 if (cp->instance < 1 || cp->instance > hdev->le_num_of_adv_sets) 8311 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_ADV_SIZE_INFO, 8312 MGMT_STATUS_INVALID_PARAMS); 8313 8314 flags = __le32_to_cpu(cp->flags); 8315 8316 /* The current implementation only supports a subset of the specified 8317 * flags. 8318 */ 8319 supported_flags = get_supported_adv_flags(hdev); 8320 if (flags & ~supported_flags) 8321 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_ADV_SIZE_INFO, 8322 MGMT_STATUS_INVALID_PARAMS); 8323 8324 rp.instance = cp->instance; 8325 rp.flags = cp->flags; 8326 rp.max_adv_data_len = tlv_data_max_len(hdev, flags, true); 8327 rp.max_scan_rsp_len = tlv_data_max_len(hdev, flags, false); 8328 8329 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_ADV_SIZE_INFO, 8330 MGMT_STATUS_SUCCESS, &rp, sizeof(rp)); 8331 8332 return err; 8333 } 8334 8335 static const struct hci_mgmt_handler mgmt_handlers[] = { 8336 { NULL }, /* 0x0000 (no command) */ 8337 { read_version, MGMT_READ_VERSION_SIZE, 8338 HCI_MGMT_NO_HDEV | 8339 HCI_MGMT_UNTRUSTED }, 8340 { read_commands, MGMT_READ_COMMANDS_SIZE, 8341 HCI_MGMT_NO_HDEV | 8342 HCI_MGMT_UNTRUSTED }, 8343 { read_index_list, MGMT_READ_INDEX_LIST_SIZE, 8344 HCI_MGMT_NO_HDEV | 8345 HCI_MGMT_UNTRUSTED }, 8346 { read_controller_info, MGMT_READ_INFO_SIZE, 8347 HCI_MGMT_UNTRUSTED }, 8348 { set_powered, MGMT_SETTING_SIZE }, 8349 { set_discoverable, MGMT_SET_DISCOVERABLE_SIZE }, 8350 { set_connectable, MGMT_SETTING_SIZE }, 8351 { set_fast_connectable, MGMT_SETTING_SIZE }, 8352 { set_bondable, MGMT_SETTING_SIZE }, 8353 { set_link_security, MGMT_SETTING_SIZE }, 8354 { set_ssp, MGMT_SETTING_SIZE }, 8355 { set_hs, MGMT_SETTING_SIZE }, 8356 { set_le, MGMT_SETTING_SIZE }, 8357 { set_dev_class, MGMT_SET_DEV_CLASS_SIZE }, 8358 { set_local_name, MGMT_SET_LOCAL_NAME_SIZE }, 8359 { add_uuid, MGMT_ADD_UUID_SIZE }, 8360 { remove_uuid, MGMT_REMOVE_UUID_SIZE }, 8361 { load_link_keys, MGMT_LOAD_LINK_KEYS_SIZE, 8362 HCI_MGMT_VAR_LEN }, 8363 { load_long_term_keys, MGMT_LOAD_LONG_TERM_KEYS_SIZE, 8364 HCI_MGMT_VAR_LEN }, 8365 { disconnect, MGMT_DISCONNECT_SIZE }, 8366 { get_connections, MGMT_GET_CONNECTIONS_SIZE }, 8367 { pin_code_reply, MGMT_PIN_CODE_REPLY_SIZE }, 8368 { pin_code_neg_reply, MGMT_PIN_CODE_NEG_REPLY_SIZE }, 8369 { set_io_capability, MGMT_SET_IO_CAPABILITY_SIZE }, 8370 { pair_device, MGMT_PAIR_DEVICE_SIZE }, 8371 { cancel_pair_device, MGMT_CANCEL_PAIR_DEVICE_SIZE }, 8372 { unpair_device, MGMT_UNPAIR_DEVICE_SIZE }, 8373 { user_confirm_reply, MGMT_USER_CONFIRM_REPLY_SIZE }, 8374 { user_confirm_neg_reply, MGMT_USER_CONFIRM_NEG_REPLY_SIZE }, 8375 { user_passkey_reply, MGMT_USER_PASSKEY_REPLY_SIZE }, 8376 { user_passkey_neg_reply, MGMT_USER_PASSKEY_NEG_REPLY_SIZE }, 8377 { read_local_oob_data, MGMT_READ_LOCAL_OOB_DATA_SIZE }, 8378 { add_remote_oob_data, MGMT_ADD_REMOTE_OOB_DATA_SIZE, 8379 HCI_MGMT_VAR_LEN }, 8380 { remove_remote_oob_data, MGMT_REMOVE_REMOTE_OOB_DATA_SIZE }, 8381 { start_discovery, MGMT_START_DISCOVERY_SIZE }, 8382 { stop_discovery, MGMT_STOP_DISCOVERY_SIZE }, 8383 { confirm_name, MGMT_CONFIRM_NAME_SIZE }, 8384 { block_device, MGMT_BLOCK_DEVICE_SIZE }, 8385 { unblock_device, MGMT_UNBLOCK_DEVICE_SIZE }, 8386 { set_device_id, MGMT_SET_DEVICE_ID_SIZE }, 8387 { set_advertising, MGMT_SETTING_SIZE }, 8388 { set_bredr, MGMT_SETTING_SIZE }, 8389 { set_static_address, MGMT_SET_STATIC_ADDRESS_SIZE }, 8390 { set_scan_params, MGMT_SET_SCAN_PARAMS_SIZE }, 8391 { set_secure_conn, MGMT_SETTING_SIZE }, 8392 { set_debug_keys, MGMT_SETTING_SIZE }, 8393 { set_privacy, MGMT_SET_PRIVACY_SIZE }, 8394 { load_irks, MGMT_LOAD_IRKS_SIZE, 8395 HCI_MGMT_VAR_LEN }, 8396 { get_conn_info, MGMT_GET_CONN_INFO_SIZE }, 8397 { get_clock_info, MGMT_GET_CLOCK_INFO_SIZE }, 8398 { add_device, MGMT_ADD_DEVICE_SIZE }, 8399 { remove_device, MGMT_REMOVE_DEVICE_SIZE }, 8400 { load_conn_param, MGMT_LOAD_CONN_PARAM_SIZE, 8401 HCI_MGMT_VAR_LEN }, 8402 { read_unconf_index_list, MGMT_READ_UNCONF_INDEX_LIST_SIZE, 8403 HCI_MGMT_NO_HDEV | 8404 HCI_MGMT_UNTRUSTED }, 8405 { read_config_info, MGMT_READ_CONFIG_INFO_SIZE, 8406 HCI_MGMT_UNCONFIGURED | 8407 HCI_MGMT_UNTRUSTED }, 8408 { set_external_config, MGMT_SET_EXTERNAL_CONFIG_SIZE, 8409 HCI_MGMT_UNCONFIGURED }, 8410 { set_public_address, MGMT_SET_PUBLIC_ADDRESS_SIZE, 8411 HCI_MGMT_UNCONFIGURED }, 8412 { start_service_discovery, MGMT_START_SERVICE_DISCOVERY_SIZE, 8413 HCI_MGMT_VAR_LEN }, 8414 { read_local_oob_ext_data, MGMT_READ_LOCAL_OOB_EXT_DATA_SIZE }, 8415 { read_ext_index_list, MGMT_READ_EXT_INDEX_LIST_SIZE, 8416 HCI_MGMT_NO_HDEV | 8417 HCI_MGMT_UNTRUSTED }, 8418 { read_adv_features, MGMT_READ_ADV_FEATURES_SIZE }, 8419 { add_advertising, MGMT_ADD_ADVERTISING_SIZE, 8420 HCI_MGMT_VAR_LEN }, 8421 { remove_advertising, MGMT_REMOVE_ADVERTISING_SIZE }, 8422 { get_adv_size_info, MGMT_GET_ADV_SIZE_INFO_SIZE }, 8423 { start_limited_discovery, MGMT_START_DISCOVERY_SIZE }, 8424 { read_ext_controller_info,MGMT_READ_EXT_INFO_SIZE, 8425 HCI_MGMT_UNTRUSTED }, 8426 { set_appearance, MGMT_SET_APPEARANCE_SIZE }, 8427 { get_phy_configuration, MGMT_GET_PHY_CONFIGURATION_SIZE }, 8428 { set_phy_configuration, MGMT_SET_PHY_CONFIGURATION_SIZE }, 8429 { set_blocked_keys, MGMT_OP_SET_BLOCKED_KEYS_SIZE, 8430 HCI_MGMT_VAR_LEN }, 8431 { set_wideband_speech, MGMT_SETTING_SIZE }, 8432 { read_controller_cap, MGMT_READ_CONTROLLER_CAP_SIZE, 8433 HCI_MGMT_UNTRUSTED }, 8434 { read_exp_features_info, MGMT_READ_EXP_FEATURES_INFO_SIZE, 8435 HCI_MGMT_UNTRUSTED | 8436 HCI_MGMT_HDEV_OPTIONAL }, 8437 { set_exp_feature, MGMT_SET_EXP_FEATURE_SIZE, 8438 HCI_MGMT_VAR_LEN | 8439 HCI_MGMT_HDEV_OPTIONAL }, 8440 { read_def_system_config, MGMT_READ_DEF_SYSTEM_CONFIG_SIZE, 8441 HCI_MGMT_UNTRUSTED }, 8442 { set_def_system_config, MGMT_SET_DEF_SYSTEM_CONFIG_SIZE, 8443 HCI_MGMT_VAR_LEN }, 8444 { read_def_runtime_config, MGMT_READ_DEF_RUNTIME_CONFIG_SIZE, 8445 HCI_MGMT_UNTRUSTED }, 8446 { set_def_runtime_config, MGMT_SET_DEF_RUNTIME_CONFIG_SIZE, 8447 HCI_MGMT_VAR_LEN }, 8448 { get_device_flags, MGMT_GET_DEVICE_FLAGS_SIZE }, 8449 { set_device_flags, MGMT_SET_DEVICE_FLAGS_SIZE }, 8450 { read_adv_mon_features, MGMT_READ_ADV_MONITOR_FEATURES_SIZE }, 8451 { add_adv_patterns_monitor,MGMT_ADD_ADV_PATTERNS_MONITOR_SIZE, 8452 HCI_MGMT_VAR_LEN }, 8453 { remove_adv_monitor, MGMT_REMOVE_ADV_MONITOR_SIZE }, 8454 { add_ext_adv_params, MGMT_ADD_EXT_ADV_PARAMS_MIN_SIZE, 8455 HCI_MGMT_VAR_LEN }, 8456 { add_ext_adv_data, MGMT_ADD_EXT_ADV_DATA_SIZE, 8457 HCI_MGMT_VAR_LEN }, 8458 { add_adv_patterns_monitor_rssi, 8459 MGMT_ADD_ADV_PATTERNS_MONITOR_RSSI_SIZE, 8460 HCI_MGMT_VAR_LEN }, 8461 }; 8462 8463 void mgmt_index_added(struct hci_dev *hdev) 8464 { 8465 struct mgmt_ev_ext_index ev; 8466 8467 if (test_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks)) 8468 return; 8469 8470 switch (hdev->dev_type) { 8471 case HCI_PRIMARY: 8472 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) { 8473 mgmt_index_event(MGMT_EV_UNCONF_INDEX_ADDED, hdev, 8474 NULL, 0, HCI_MGMT_UNCONF_INDEX_EVENTS); 8475 ev.type = 0x01; 8476 } else { 8477 mgmt_index_event(MGMT_EV_INDEX_ADDED, hdev, NULL, 0, 8478 HCI_MGMT_INDEX_EVENTS); 8479 ev.type = 0x00; 8480 } 8481 break; 8482 case HCI_AMP: 8483 ev.type = 0x02; 8484 break; 8485 default: 8486 return; 8487 } 8488 8489 ev.bus = hdev->bus; 8490 8491 mgmt_index_event(MGMT_EV_EXT_INDEX_ADDED, hdev, &ev, sizeof(ev), 8492 HCI_MGMT_EXT_INDEX_EVENTS); 8493 } 8494 8495 void mgmt_index_removed(struct hci_dev *hdev) 8496 { 8497 struct mgmt_ev_ext_index ev; 8498 u8 status = MGMT_STATUS_INVALID_INDEX; 8499 8500 if (test_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks)) 8501 return; 8502 8503 switch (hdev->dev_type) { 8504 case HCI_PRIMARY: 8505 mgmt_pending_foreach(0, hdev, cmd_complete_rsp, &status); 8506 8507 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) { 8508 mgmt_index_event(MGMT_EV_UNCONF_INDEX_REMOVED, hdev, 8509 NULL, 0, HCI_MGMT_UNCONF_INDEX_EVENTS); 8510 ev.type = 0x01; 8511 } else { 8512 mgmt_index_event(MGMT_EV_INDEX_REMOVED, hdev, NULL, 0, 8513 HCI_MGMT_INDEX_EVENTS); 8514 ev.type = 0x00; 8515 } 8516 break; 8517 case HCI_AMP: 8518 ev.type = 0x02; 8519 break; 8520 default: 8521 return; 8522 } 8523 8524 ev.bus = hdev->bus; 8525 8526 mgmt_index_event(MGMT_EV_EXT_INDEX_REMOVED, hdev, &ev, sizeof(ev), 8527 HCI_MGMT_EXT_INDEX_EVENTS); 8528 } 8529 8530 /* This function requires the caller holds hdev->lock */ 8531 static void restart_le_actions(struct hci_dev *hdev) 8532 { 8533 struct hci_conn_params *p; 8534 8535 list_for_each_entry(p, &hdev->le_conn_params, list) { 8536 /* Needed for AUTO_OFF case where might not "really" 8537 * have been powered off. 8538 */ 8539 list_del_init(&p->action); 8540 8541 switch (p->auto_connect) { 8542 case HCI_AUTO_CONN_DIRECT: 8543 case HCI_AUTO_CONN_ALWAYS: 8544 list_add(&p->action, &hdev->pend_le_conns); 8545 break; 8546 case HCI_AUTO_CONN_REPORT: 8547 list_add(&p->action, &hdev->pend_le_reports); 8548 break; 8549 default: 8550 break; 8551 } 8552 } 8553 } 8554 8555 void mgmt_power_on(struct hci_dev *hdev, int err) 8556 { 8557 struct cmd_lookup match = { NULL, hdev }; 8558 8559 bt_dev_dbg(hdev, "err %d", err); 8560 8561 hci_dev_lock(hdev); 8562 8563 if (!err) { 8564 restart_le_actions(hdev); 8565 hci_update_background_scan(hdev); 8566 } 8567 8568 mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp, &match); 8569 8570 new_settings(hdev, match.sk); 8571 8572 if (match.sk) 8573 sock_put(match.sk); 8574 8575 hci_dev_unlock(hdev); 8576 } 8577 8578 void __mgmt_power_off(struct hci_dev *hdev) 8579 { 8580 struct cmd_lookup match = { NULL, hdev }; 8581 u8 status, zero_cod[] = { 0, 0, 0 }; 8582 8583 mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp, &match); 8584 8585 /* If the power off is because of hdev unregistration let 8586 * use the appropriate INVALID_INDEX status. Otherwise use 8587 * NOT_POWERED. We cover both scenarios here since later in 8588 * mgmt_index_removed() any hci_conn callbacks will have already 8589 * been triggered, potentially causing misleading DISCONNECTED 8590 * status responses. 8591 */ 8592 if (hci_dev_test_flag(hdev, HCI_UNREGISTER)) 8593 status = MGMT_STATUS_INVALID_INDEX; 8594 else 8595 status = MGMT_STATUS_NOT_POWERED; 8596 8597 mgmt_pending_foreach(0, hdev, cmd_complete_rsp, &status); 8598 8599 if (memcmp(hdev->dev_class, zero_cod, sizeof(zero_cod)) != 0) { 8600 mgmt_limited_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev, 8601 zero_cod, sizeof(zero_cod), 8602 HCI_MGMT_DEV_CLASS_EVENTS, NULL); 8603 ext_info_changed(hdev, NULL); 8604 } 8605 8606 new_settings(hdev, match.sk); 8607 8608 if (match.sk) 8609 sock_put(match.sk); 8610 } 8611 8612 void mgmt_set_powered_failed(struct hci_dev *hdev, int err) 8613 { 8614 struct mgmt_pending_cmd *cmd; 8615 u8 status; 8616 8617 cmd = pending_find(MGMT_OP_SET_POWERED, hdev); 8618 if (!cmd) 8619 return; 8620 8621 if (err == -ERFKILL) 8622 status = MGMT_STATUS_RFKILLED; 8623 else 8624 status = MGMT_STATUS_FAILED; 8625 8626 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_POWERED, status); 8627 8628 mgmt_pending_remove(cmd); 8629 } 8630 8631 void mgmt_new_link_key(struct hci_dev *hdev, struct link_key *key, 8632 bool persistent) 8633 { 8634 struct mgmt_ev_new_link_key ev; 8635 8636 memset(&ev, 0, sizeof(ev)); 8637 8638 ev.store_hint = persistent; 8639 bacpy(&ev.key.addr.bdaddr, &key->bdaddr); 8640 ev.key.addr.type = BDADDR_BREDR; 8641 ev.key.type = key->type; 8642 memcpy(ev.key.val, key->val, HCI_LINK_KEY_SIZE); 8643 ev.key.pin_len = key->pin_len; 8644 8645 mgmt_event(MGMT_EV_NEW_LINK_KEY, hdev, &ev, sizeof(ev), NULL); 8646 } 8647 8648 static u8 mgmt_ltk_type(struct smp_ltk *ltk) 8649 { 8650 switch (ltk->type) { 8651 case SMP_LTK: 8652 case SMP_LTK_RESPONDER: 8653 if (ltk->authenticated) 8654 return MGMT_LTK_AUTHENTICATED; 8655 return MGMT_LTK_UNAUTHENTICATED; 8656 case SMP_LTK_P256: 8657 if (ltk->authenticated) 8658 return MGMT_LTK_P256_AUTH; 8659 return MGMT_LTK_P256_UNAUTH; 8660 case SMP_LTK_P256_DEBUG: 8661 return MGMT_LTK_P256_DEBUG; 8662 } 8663 8664 return MGMT_LTK_UNAUTHENTICATED; 8665 } 8666 8667 void mgmt_new_ltk(struct hci_dev *hdev, struct smp_ltk *key, bool persistent) 8668 { 8669 struct mgmt_ev_new_long_term_key ev; 8670 8671 memset(&ev, 0, sizeof(ev)); 8672 8673 /* Devices using resolvable or non-resolvable random addresses 8674 * without providing an identity resolving key don't require 8675 * to store long term keys. Their addresses will change the 8676 * next time around. 8677 * 8678 * Only when a remote device provides an identity address 8679 * make sure the long term key is stored. If the remote 8680 * identity is known, the long term keys are internally 8681 * mapped to the identity address. So allow static random 8682 * and public addresses here. 8683 */ 8684 if (key->bdaddr_type == ADDR_LE_DEV_RANDOM && 8685 (key->bdaddr.b[5] & 0xc0) != 0xc0) 8686 ev.store_hint = 0x00; 8687 else 8688 ev.store_hint = persistent; 8689 8690 bacpy(&ev.key.addr.bdaddr, &key->bdaddr); 8691 ev.key.addr.type = link_to_bdaddr(LE_LINK, key->bdaddr_type); 8692 ev.key.type = mgmt_ltk_type(key); 8693 ev.key.enc_size = key->enc_size; 8694 ev.key.ediv = key->ediv; 8695 ev.key.rand = key->rand; 8696 8697 if (key->type == SMP_LTK) 8698 ev.key.initiator = 1; 8699 8700 /* Make sure we copy only the significant bytes based on the 8701 * encryption key size, and set the rest of the value to zeroes. 8702 */ 8703 memcpy(ev.key.val, key->val, key->enc_size); 8704 memset(ev.key.val + key->enc_size, 0, 8705 sizeof(ev.key.val) - key->enc_size); 8706 8707 mgmt_event(MGMT_EV_NEW_LONG_TERM_KEY, hdev, &ev, sizeof(ev), NULL); 8708 } 8709 8710 void mgmt_new_irk(struct hci_dev *hdev, struct smp_irk *irk, bool persistent) 8711 { 8712 struct mgmt_ev_new_irk ev; 8713 8714 memset(&ev, 0, sizeof(ev)); 8715 8716 ev.store_hint = persistent; 8717 8718 bacpy(&ev.rpa, &irk->rpa); 8719 bacpy(&ev.irk.addr.bdaddr, &irk->bdaddr); 8720 ev.irk.addr.type = link_to_bdaddr(LE_LINK, irk->addr_type); 8721 memcpy(ev.irk.val, irk->val, sizeof(irk->val)); 8722 8723 mgmt_event(MGMT_EV_NEW_IRK, hdev, &ev, sizeof(ev), NULL); 8724 } 8725 8726 void mgmt_new_csrk(struct hci_dev *hdev, struct smp_csrk *csrk, 8727 bool persistent) 8728 { 8729 struct mgmt_ev_new_csrk ev; 8730 8731 memset(&ev, 0, sizeof(ev)); 8732 8733 /* Devices using resolvable or non-resolvable random addresses 8734 * without providing an identity resolving key don't require 8735 * to store signature resolving keys. Their addresses will change 8736 * the next time around. 8737 * 8738 * Only when a remote device provides an identity address 8739 * make sure the signature resolving key is stored. So allow 8740 * static random and public addresses here. 8741 */ 8742 if (csrk->bdaddr_type == ADDR_LE_DEV_RANDOM && 8743 (csrk->bdaddr.b[5] & 0xc0) != 0xc0) 8744 ev.store_hint = 0x00; 8745 else 8746 ev.store_hint = persistent; 8747 8748 bacpy(&ev.key.addr.bdaddr, &csrk->bdaddr); 8749 ev.key.addr.type = link_to_bdaddr(LE_LINK, csrk->bdaddr_type); 8750 ev.key.type = csrk->type; 8751 memcpy(ev.key.val, csrk->val, sizeof(csrk->val)); 8752 8753 mgmt_event(MGMT_EV_NEW_CSRK, hdev, &ev, sizeof(ev), NULL); 8754 } 8755 8756 void mgmt_new_conn_param(struct hci_dev *hdev, bdaddr_t *bdaddr, 8757 u8 bdaddr_type, u8 store_hint, u16 min_interval, 8758 u16 max_interval, u16 latency, u16 timeout) 8759 { 8760 struct mgmt_ev_new_conn_param ev; 8761 8762 if (!hci_is_identity_address(bdaddr, bdaddr_type)) 8763 return; 8764 8765 memset(&ev, 0, sizeof(ev)); 8766 bacpy(&ev.addr.bdaddr, bdaddr); 8767 ev.addr.type = link_to_bdaddr(LE_LINK, bdaddr_type); 8768 ev.store_hint = store_hint; 8769 ev.min_interval = cpu_to_le16(min_interval); 8770 ev.max_interval = cpu_to_le16(max_interval); 8771 ev.latency = cpu_to_le16(latency); 8772 ev.timeout = cpu_to_le16(timeout); 8773 8774 mgmt_event(MGMT_EV_NEW_CONN_PARAM, hdev, &ev, sizeof(ev), NULL); 8775 } 8776 8777 void mgmt_device_connected(struct hci_dev *hdev, struct hci_conn *conn, 8778 u8 *name, u8 name_len) 8779 { 8780 char buf[512]; 8781 struct mgmt_ev_device_connected *ev = (void *) buf; 8782 u16 eir_len = 0; 8783 u32 flags = 0; 8784 8785 bacpy(&ev->addr.bdaddr, &conn->dst); 8786 ev->addr.type = link_to_bdaddr(conn->type, conn->dst_type); 8787 8788 if (conn->out) 8789 flags |= MGMT_DEV_FOUND_INITIATED_CONN; 8790 8791 ev->flags = __cpu_to_le32(flags); 8792 8793 /* We must ensure that the EIR Data fields are ordered and 8794 * unique. Keep it simple for now and avoid the problem by not 8795 * adding any BR/EDR data to the LE adv. 8796 */ 8797 if (conn->le_adv_data_len > 0) { 8798 memcpy(&ev->eir[eir_len], 8799 conn->le_adv_data, conn->le_adv_data_len); 8800 eir_len = conn->le_adv_data_len; 8801 } else { 8802 if (name_len > 0) 8803 eir_len = eir_append_data(ev->eir, 0, EIR_NAME_COMPLETE, 8804 name, name_len); 8805 8806 if (memcmp(conn->dev_class, "\0\0\0", 3) != 0) 8807 eir_len = eir_append_data(ev->eir, eir_len, 8808 EIR_CLASS_OF_DEV, 8809 conn->dev_class, 3); 8810 } 8811 8812 ev->eir_len = cpu_to_le16(eir_len); 8813 8814 mgmt_event(MGMT_EV_DEVICE_CONNECTED, hdev, buf, 8815 sizeof(*ev) + eir_len, NULL); 8816 } 8817 8818 static void disconnect_rsp(struct mgmt_pending_cmd *cmd, void *data) 8819 { 8820 struct sock **sk = data; 8821 8822 cmd->cmd_complete(cmd, 0); 8823 8824 *sk = cmd->sk; 8825 sock_hold(*sk); 8826 8827 mgmt_pending_remove(cmd); 8828 } 8829 8830 static void unpair_device_rsp(struct mgmt_pending_cmd *cmd, void *data) 8831 { 8832 struct hci_dev *hdev = data; 8833 struct mgmt_cp_unpair_device *cp = cmd->param; 8834 8835 device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, cmd->sk); 8836 8837 cmd->cmd_complete(cmd, 0); 8838 mgmt_pending_remove(cmd); 8839 } 8840 8841 bool mgmt_powering_down(struct hci_dev *hdev) 8842 { 8843 struct mgmt_pending_cmd *cmd; 8844 struct mgmt_mode *cp; 8845 8846 cmd = pending_find(MGMT_OP_SET_POWERED, hdev); 8847 if (!cmd) 8848 return false; 8849 8850 cp = cmd->param; 8851 if (!cp->val) 8852 return true; 8853 8854 return false; 8855 } 8856 8857 void mgmt_device_disconnected(struct hci_dev *hdev, bdaddr_t *bdaddr, 8858 u8 link_type, u8 addr_type, u8 reason, 8859 bool mgmt_connected) 8860 { 8861 struct mgmt_ev_device_disconnected ev; 8862 struct sock *sk = NULL; 8863 8864 /* The connection is still in hci_conn_hash so test for 1 8865 * instead of 0 to know if this is the last one. 8866 */ 8867 if (mgmt_powering_down(hdev) && hci_conn_count(hdev) == 1) { 8868 cancel_delayed_work(&hdev->power_off); 8869 queue_work(hdev->req_workqueue, &hdev->power_off.work); 8870 } 8871 8872 if (!mgmt_connected) 8873 return; 8874 8875 if (link_type != ACL_LINK && link_type != LE_LINK) 8876 return; 8877 8878 mgmt_pending_foreach(MGMT_OP_DISCONNECT, hdev, disconnect_rsp, &sk); 8879 8880 bacpy(&ev.addr.bdaddr, bdaddr); 8881 ev.addr.type = link_to_bdaddr(link_type, addr_type); 8882 ev.reason = reason; 8883 8884 /* Report disconnects due to suspend */ 8885 if (hdev->suspended) 8886 ev.reason = MGMT_DEV_DISCONN_LOCAL_HOST_SUSPEND; 8887 8888 mgmt_event(MGMT_EV_DEVICE_DISCONNECTED, hdev, &ev, sizeof(ev), sk); 8889 8890 if (sk) 8891 sock_put(sk); 8892 8893 mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, unpair_device_rsp, 8894 hdev); 8895 } 8896 8897 void mgmt_disconnect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr, 8898 u8 link_type, u8 addr_type, u8 status) 8899 { 8900 u8 bdaddr_type = link_to_bdaddr(link_type, addr_type); 8901 struct mgmt_cp_disconnect *cp; 8902 struct mgmt_pending_cmd *cmd; 8903 8904 mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, unpair_device_rsp, 8905 hdev); 8906 8907 cmd = pending_find(MGMT_OP_DISCONNECT, hdev); 8908 if (!cmd) 8909 return; 8910 8911 cp = cmd->param; 8912 8913 if (bacmp(bdaddr, &cp->addr.bdaddr)) 8914 return; 8915 8916 if (cp->addr.type != bdaddr_type) 8917 return; 8918 8919 cmd->cmd_complete(cmd, mgmt_status(status)); 8920 mgmt_pending_remove(cmd); 8921 } 8922 8923 void mgmt_connect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type, 8924 u8 addr_type, u8 status) 8925 { 8926 struct mgmt_ev_connect_failed ev; 8927 8928 /* The connection is still in hci_conn_hash so test for 1 8929 * instead of 0 to know if this is the last one. 8930 */ 8931 if (mgmt_powering_down(hdev) && hci_conn_count(hdev) == 1) { 8932 cancel_delayed_work(&hdev->power_off); 8933 queue_work(hdev->req_workqueue, &hdev->power_off.work); 8934 } 8935 8936 bacpy(&ev.addr.bdaddr, bdaddr); 8937 ev.addr.type = link_to_bdaddr(link_type, addr_type); 8938 ev.status = mgmt_status(status); 8939 8940 mgmt_event(MGMT_EV_CONNECT_FAILED, hdev, &ev, sizeof(ev), NULL); 8941 } 8942 8943 void mgmt_pin_code_request(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 secure) 8944 { 8945 struct mgmt_ev_pin_code_request ev; 8946 8947 bacpy(&ev.addr.bdaddr, bdaddr); 8948 ev.addr.type = BDADDR_BREDR; 8949 ev.secure = secure; 8950 8951 mgmt_event(MGMT_EV_PIN_CODE_REQUEST, hdev, &ev, sizeof(ev), NULL); 8952 } 8953 8954 void mgmt_pin_code_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr, 8955 u8 status) 8956 { 8957 struct mgmt_pending_cmd *cmd; 8958 8959 cmd = pending_find(MGMT_OP_PIN_CODE_REPLY, hdev); 8960 if (!cmd) 8961 return; 8962 8963 cmd->cmd_complete(cmd, mgmt_status(status)); 8964 mgmt_pending_remove(cmd); 8965 } 8966 8967 void mgmt_pin_code_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr, 8968 u8 status) 8969 { 8970 struct mgmt_pending_cmd *cmd; 8971 8972 cmd = pending_find(MGMT_OP_PIN_CODE_NEG_REPLY, hdev); 8973 if (!cmd) 8974 return; 8975 8976 cmd->cmd_complete(cmd, mgmt_status(status)); 8977 mgmt_pending_remove(cmd); 8978 } 8979 8980 int mgmt_user_confirm_request(struct hci_dev *hdev, bdaddr_t *bdaddr, 8981 u8 link_type, u8 addr_type, u32 value, 8982 u8 confirm_hint) 8983 { 8984 struct mgmt_ev_user_confirm_request ev; 8985 8986 bt_dev_dbg(hdev, "bdaddr %pMR", bdaddr); 8987 8988 bacpy(&ev.addr.bdaddr, bdaddr); 8989 ev.addr.type = link_to_bdaddr(link_type, addr_type); 8990 ev.confirm_hint = confirm_hint; 8991 ev.value = cpu_to_le32(value); 8992 8993 return mgmt_event(MGMT_EV_USER_CONFIRM_REQUEST, hdev, &ev, sizeof(ev), 8994 NULL); 8995 } 8996 8997 int mgmt_user_passkey_request(struct hci_dev *hdev, bdaddr_t *bdaddr, 8998 u8 link_type, u8 addr_type) 8999 { 9000 struct mgmt_ev_user_passkey_request ev; 9001 9002 bt_dev_dbg(hdev, "bdaddr %pMR", bdaddr); 9003 9004 bacpy(&ev.addr.bdaddr, bdaddr); 9005 ev.addr.type = link_to_bdaddr(link_type, addr_type); 9006 9007 return mgmt_event(MGMT_EV_USER_PASSKEY_REQUEST, hdev, &ev, sizeof(ev), 9008 NULL); 9009 } 9010 9011 static int user_pairing_resp_complete(struct hci_dev *hdev, bdaddr_t *bdaddr, 9012 u8 link_type, u8 addr_type, u8 status, 9013 u8 opcode) 9014 { 9015 struct mgmt_pending_cmd *cmd; 9016 9017 cmd = pending_find(opcode, hdev); 9018 if (!cmd) 9019 return -ENOENT; 9020 9021 cmd->cmd_complete(cmd, mgmt_status(status)); 9022 mgmt_pending_remove(cmd); 9023 9024 return 0; 9025 } 9026 9027 int mgmt_user_confirm_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr, 9028 u8 link_type, u8 addr_type, u8 status) 9029 { 9030 return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type, 9031 status, MGMT_OP_USER_CONFIRM_REPLY); 9032 } 9033 9034 int mgmt_user_confirm_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr, 9035 u8 link_type, u8 addr_type, u8 status) 9036 { 9037 return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type, 9038 status, 9039 MGMT_OP_USER_CONFIRM_NEG_REPLY); 9040 } 9041 9042 int mgmt_user_passkey_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr, 9043 u8 link_type, u8 addr_type, u8 status) 9044 { 9045 return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type, 9046 status, MGMT_OP_USER_PASSKEY_REPLY); 9047 } 9048 9049 int mgmt_user_passkey_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr, 9050 u8 link_type, u8 addr_type, u8 status) 9051 { 9052 return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type, 9053 status, 9054 MGMT_OP_USER_PASSKEY_NEG_REPLY); 9055 } 9056 9057 int mgmt_user_passkey_notify(struct hci_dev *hdev, bdaddr_t *bdaddr, 9058 u8 link_type, u8 addr_type, u32 passkey, 9059 u8 entered) 9060 { 9061 struct mgmt_ev_passkey_notify ev; 9062 9063 bt_dev_dbg(hdev, "bdaddr %pMR", bdaddr); 9064 9065 bacpy(&ev.addr.bdaddr, bdaddr); 9066 ev.addr.type = link_to_bdaddr(link_type, addr_type); 9067 ev.passkey = __cpu_to_le32(passkey); 9068 ev.entered = entered; 9069 9070 return mgmt_event(MGMT_EV_PASSKEY_NOTIFY, hdev, &ev, sizeof(ev), NULL); 9071 } 9072 9073 void mgmt_auth_failed(struct hci_conn *conn, u8 hci_status) 9074 { 9075 struct mgmt_ev_auth_failed ev; 9076 struct mgmt_pending_cmd *cmd; 9077 u8 status = mgmt_status(hci_status); 9078 9079 bacpy(&ev.addr.bdaddr, &conn->dst); 9080 ev.addr.type = link_to_bdaddr(conn->type, conn->dst_type); 9081 ev.status = status; 9082 9083 cmd = find_pairing(conn); 9084 9085 mgmt_event(MGMT_EV_AUTH_FAILED, conn->hdev, &ev, sizeof(ev), 9086 cmd ? cmd->sk : NULL); 9087 9088 if (cmd) { 9089 cmd->cmd_complete(cmd, status); 9090 mgmt_pending_remove(cmd); 9091 } 9092 } 9093 9094 void mgmt_auth_enable_complete(struct hci_dev *hdev, u8 status) 9095 { 9096 struct cmd_lookup match = { NULL, hdev }; 9097 bool changed; 9098 9099 if (status) { 9100 u8 mgmt_err = mgmt_status(status); 9101 mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev, 9102 cmd_status_rsp, &mgmt_err); 9103 return; 9104 } 9105 9106 if (test_bit(HCI_AUTH, &hdev->flags)) 9107 changed = !hci_dev_test_and_set_flag(hdev, HCI_LINK_SECURITY); 9108 else 9109 changed = hci_dev_test_and_clear_flag(hdev, HCI_LINK_SECURITY); 9110 9111 mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev, settings_rsp, 9112 &match); 9113 9114 if (changed) 9115 new_settings(hdev, match.sk); 9116 9117 if (match.sk) 9118 sock_put(match.sk); 9119 } 9120 9121 static void clear_eir(struct hci_request *req) 9122 { 9123 struct hci_dev *hdev = req->hdev; 9124 struct hci_cp_write_eir cp; 9125 9126 if (!lmp_ext_inq_capable(hdev)) 9127 return; 9128 9129 memset(hdev->eir, 0, sizeof(hdev->eir)); 9130 9131 memset(&cp, 0, sizeof(cp)); 9132 9133 hci_req_add(req, HCI_OP_WRITE_EIR, sizeof(cp), &cp); 9134 } 9135 9136 void mgmt_ssp_enable_complete(struct hci_dev *hdev, u8 enable, u8 status) 9137 { 9138 struct cmd_lookup match = { NULL, hdev }; 9139 struct hci_request req; 9140 bool changed = false; 9141 9142 if (status) { 9143 u8 mgmt_err = mgmt_status(status); 9144 9145 if (enable && hci_dev_test_and_clear_flag(hdev, 9146 HCI_SSP_ENABLED)) { 9147 hci_dev_clear_flag(hdev, HCI_HS_ENABLED); 9148 new_settings(hdev, NULL); 9149 } 9150 9151 mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev, cmd_status_rsp, 9152 &mgmt_err); 9153 return; 9154 } 9155 9156 if (enable) { 9157 changed = !hci_dev_test_and_set_flag(hdev, HCI_SSP_ENABLED); 9158 } else { 9159 changed = hci_dev_test_and_clear_flag(hdev, HCI_SSP_ENABLED); 9160 if (!changed) 9161 changed = hci_dev_test_and_clear_flag(hdev, 9162 HCI_HS_ENABLED); 9163 else 9164 hci_dev_clear_flag(hdev, HCI_HS_ENABLED); 9165 } 9166 9167 mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev, settings_rsp, &match); 9168 9169 if (changed) 9170 new_settings(hdev, match.sk); 9171 9172 if (match.sk) 9173 sock_put(match.sk); 9174 9175 hci_req_init(&req, hdev); 9176 9177 if (hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) { 9178 if (hci_dev_test_flag(hdev, HCI_USE_DEBUG_KEYS)) 9179 hci_req_add(&req, HCI_OP_WRITE_SSP_DEBUG_MODE, 9180 sizeof(enable), &enable); 9181 __hci_req_update_eir(&req); 9182 } else { 9183 clear_eir(&req); 9184 } 9185 9186 hci_req_run(&req, NULL); 9187 } 9188 9189 static void sk_lookup(struct mgmt_pending_cmd *cmd, void *data) 9190 { 9191 struct cmd_lookup *match = data; 9192 9193 if (match->sk == NULL) { 9194 match->sk = cmd->sk; 9195 sock_hold(match->sk); 9196 } 9197 } 9198 9199 void mgmt_set_class_of_dev_complete(struct hci_dev *hdev, u8 *dev_class, 9200 u8 status) 9201 { 9202 struct cmd_lookup match = { NULL, hdev, mgmt_status(status) }; 9203 9204 mgmt_pending_foreach(MGMT_OP_SET_DEV_CLASS, hdev, sk_lookup, &match); 9205 mgmt_pending_foreach(MGMT_OP_ADD_UUID, hdev, sk_lookup, &match); 9206 mgmt_pending_foreach(MGMT_OP_REMOVE_UUID, hdev, sk_lookup, &match); 9207 9208 if (!status) { 9209 mgmt_limited_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev, dev_class, 9210 3, HCI_MGMT_DEV_CLASS_EVENTS, NULL); 9211 ext_info_changed(hdev, NULL); 9212 } 9213 9214 if (match.sk) 9215 sock_put(match.sk); 9216 } 9217 9218 void mgmt_set_local_name_complete(struct hci_dev *hdev, u8 *name, u8 status) 9219 { 9220 struct mgmt_cp_set_local_name ev; 9221 struct mgmt_pending_cmd *cmd; 9222 9223 if (status) 9224 return; 9225 9226 memset(&ev, 0, sizeof(ev)); 9227 memcpy(ev.name, name, HCI_MAX_NAME_LENGTH); 9228 memcpy(ev.short_name, hdev->short_name, HCI_MAX_SHORT_NAME_LENGTH); 9229 9230 cmd = pending_find(MGMT_OP_SET_LOCAL_NAME, hdev); 9231 if (!cmd) { 9232 memcpy(hdev->dev_name, name, sizeof(hdev->dev_name)); 9233 9234 /* If this is a HCI command related to powering on the 9235 * HCI dev don't send any mgmt signals. 9236 */ 9237 if (pending_find(MGMT_OP_SET_POWERED, hdev)) 9238 return; 9239 } 9240 9241 mgmt_limited_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, &ev, sizeof(ev), 9242 HCI_MGMT_LOCAL_NAME_EVENTS, cmd ? cmd->sk : NULL); 9243 ext_info_changed(hdev, cmd ? cmd->sk : NULL); 9244 } 9245 9246 static inline bool has_uuid(u8 *uuid, u16 uuid_count, u8 (*uuids)[16]) 9247 { 9248 int i; 9249 9250 for (i = 0; i < uuid_count; i++) { 9251 if (!memcmp(uuid, uuids[i], 16)) 9252 return true; 9253 } 9254 9255 return false; 9256 } 9257 9258 static bool eir_has_uuids(u8 *eir, u16 eir_len, u16 uuid_count, u8 (*uuids)[16]) 9259 { 9260 u16 parsed = 0; 9261 9262 while (parsed < eir_len) { 9263 u8 field_len = eir[0]; 9264 u8 uuid[16]; 9265 int i; 9266 9267 if (field_len == 0) 9268 break; 9269 9270 if (eir_len - parsed < field_len + 1) 9271 break; 9272 9273 switch (eir[1]) { 9274 case EIR_UUID16_ALL: 9275 case EIR_UUID16_SOME: 9276 for (i = 0; i + 3 <= field_len; i += 2) { 9277 memcpy(uuid, bluetooth_base_uuid, 16); 9278 uuid[13] = eir[i + 3]; 9279 uuid[12] = eir[i + 2]; 9280 if (has_uuid(uuid, uuid_count, uuids)) 9281 return true; 9282 } 9283 break; 9284 case EIR_UUID32_ALL: 9285 case EIR_UUID32_SOME: 9286 for (i = 0; i + 5 <= field_len; i += 4) { 9287 memcpy(uuid, bluetooth_base_uuid, 16); 9288 uuid[15] = eir[i + 5]; 9289 uuid[14] = eir[i + 4]; 9290 uuid[13] = eir[i + 3]; 9291 uuid[12] = eir[i + 2]; 9292 if (has_uuid(uuid, uuid_count, uuids)) 9293 return true; 9294 } 9295 break; 9296 case EIR_UUID128_ALL: 9297 case EIR_UUID128_SOME: 9298 for (i = 0; i + 17 <= field_len; i += 16) { 9299 memcpy(uuid, eir + i + 2, 16); 9300 if (has_uuid(uuid, uuid_count, uuids)) 9301 return true; 9302 } 9303 break; 9304 } 9305 9306 parsed += field_len + 1; 9307 eir += field_len + 1; 9308 } 9309 9310 return false; 9311 } 9312 9313 static void restart_le_scan(struct hci_dev *hdev) 9314 { 9315 /* If controller is not scanning we are done. */ 9316 if (!hci_dev_test_flag(hdev, HCI_LE_SCAN)) 9317 return; 9318 9319 if (time_after(jiffies + DISCOV_LE_RESTART_DELAY, 9320 hdev->discovery.scan_start + 9321 hdev->discovery.scan_duration)) 9322 return; 9323 9324 queue_delayed_work(hdev->req_workqueue, &hdev->le_scan_restart, 9325 DISCOV_LE_RESTART_DELAY); 9326 } 9327 9328 static bool is_filter_match(struct hci_dev *hdev, s8 rssi, u8 *eir, 9329 u16 eir_len, u8 *scan_rsp, u8 scan_rsp_len) 9330 { 9331 /* If a RSSI threshold has been specified, and 9332 * HCI_QUIRK_STRICT_DUPLICATE_FILTER is not set, then all results with 9333 * a RSSI smaller than the RSSI threshold will be dropped. If the quirk 9334 * is set, let it through for further processing, as we might need to 9335 * restart the scan. 9336 * 9337 * For BR/EDR devices (pre 1.2) providing no RSSI during inquiry, 9338 * the results are also dropped. 9339 */ 9340 if (hdev->discovery.rssi != HCI_RSSI_INVALID && 9341 (rssi == HCI_RSSI_INVALID || 9342 (rssi < hdev->discovery.rssi && 9343 !test_bit(HCI_QUIRK_STRICT_DUPLICATE_FILTER, &hdev->quirks)))) 9344 return false; 9345 9346 if (hdev->discovery.uuid_count != 0) { 9347 /* If a list of UUIDs is provided in filter, results with no 9348 * matching UUID should be dropped. 9349 */ 9350 if (!eir_has_uuids(eir, eir_len, hdev->discovery.uuid_count, 9351 hdev->discovery.uuids) && 9352 !eir_has_uuids(scan_rsp, scan_rsp_len, 9353 hdev->discovery.uuid_count, 9354 hdev->discovery.uuids)) 9355 return false; 9356 } 9357 9358 /* If duplicate filtering does not report RSSI changes, then restart 9359 * scanning to ensure updated result with updated RSSI values. 9360 */ 9361 if (test_bit(HCI_QUIRK_STRICT_DUPLICATE_FILTER, &hdev->quirks)) { 9362 restart_le_scan(hdev); 9363 9364 /* Validate RSSI value against the RSSI threshold once more. */ 9365 if (hdev->discovery.rssi != HCI_RSSI_INVALID && 9366 rssi < hdev->discovery.rssi) 9367 return false; 9368 } 9369 9370 return true; 9371 } 9372 9373 void mgmt_device_found(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type, 9374 u8 addr_type, u8 *dev_class, s8 rssi, u32 flags, 9375 u8 *eir, u16 eir_len, u8 *scan_rsp, u8 scan_rsp_len) 9376 { 9377 char buf[512]; 9378 struct mgmt_ev_device_found *ev = (void *)buf; 9379 size_t ev_size; 9380 9381 /* Don't send events for a non-kernel initiated discovery. With 9382 * LE one exception is if we have pend_le_reports > 0 in which 9383 * case we're doing passive scanning and want these events. 9384 */ 9385 if (!hci_discovery_active(hdev)) { 9386 if (link_type == ACL_LINK) 9387 return; 9388 if (link_type == LE_LINK && 9389 list_empty(&hdev->pend_le_reports) && 9390 !hci_is_adv_monitoring(hdev)) { 9391 return; 9392 } 9393 } 9394 9395 if (hdev->discovery.result_filtering) { 9396 /* We are using service discovery */ 9397 if (!is_filter_match(hdev, rssi, eir, eir_len, scan_rsp, 9398 scan_rsp_len)) 9399 return; 9400 } 9401 9402 if (hdev->discovery.limited) { 9403 /* Check for limited discoverable bit */ 9404 if (dev_class) { 9405 if (!(dev_class[1] & 0x20)) 9406 return; 9407 } else { 9408 u8 *flags = eir_get_data(eir, eir_len, EIR_FLAGS, NULL); 9409 if (!flags || !(flags[0] & LE_AD_LIMITED)) 9410 return; 9411 } 9412 } 9413 9414 /* Make sure that the buffer is big enough. The 5 extra bytes 9415 * are for the potential CoD field. 9416 */ 9417 if (sizeof(*ev) + eir_len + scan_rsp_len + 5 > sizeof(buf)) 9418 return; 9419 9420 memset(buf, 0, sizeof(buf)); 9421 9422 /* In case of device discovery with BR/EDR devices (pre 1.2), the 9423 * RSSI value was reported as 0 when not available. This behavior 9424 * is kept when using device discovery. This is required for full 9425 * backwards compatibility with the API. 9426 * 9427 * However when using service discovery, the value 127 will be 9428 * returned when the RSSI is not available. 9429 */ 9430 if (rssi == HCI_RSSI_INVALID && !hdev->discovery.report_invalid_rssi && 9431 link_type == ACL_LINK) 9432 rssi = 0; 9433 9434 bacpy(&ev->addr.bdaddr, bdaddr); 9435 ev->addr.type = link_to_bdaddr(link_type, addr_type); 9436 ev->rssi = rssi; 9437 ev->flags = cpu_to_le32(flags); 9438 9439 if (eir_len > 0) 9440 /* Copy EIR or advertising data into event */ 9441 memcpy(ev->eir, eir, eir_len); 9442 9443 if (dev_class && !eir_get_data(ev->eir, eir_len, EIR_CLASS_OF_DEV, 9444 NULL)) 9445 eir_len = eir_append_data(ev->eir, eir_len, EIR_CLASS_OF_DEV, 9446 dev_class, 3); 9447 9448 if (scan_rsp_len > 0) 9449 /* Append scan response data to event */ 9450 memcpy(ev->eir + eir_len, scan_rsp, scan_rsp_len); 9451 9452 ev->eir_len = cpu_to_le16(eir_len + scan_rsp_len); 9453 ev_size = sizeof(*ev) + eir_len + scan_rsp_len; 9454 9455 mgmt_event(MGMT_EV_DEVICE_FOUND, hdev, ev, ev_size, NULL); 9456 } 9457 9458 void mgmt_remote_name(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type, 9459 u8 addr_type, s8 rssi, u8 *name, u8 name_len) 9460 { 9461 struct mgmt_ev_device_found *ev; 9462 char buf[sizeof(*ev) + HCI_MAX_NAME_LENGTH + 2]; 9463 u16 eir_len; 9464 9465 ev = (struct mgmt_ev_device_found *) buf; 9466 9467 memset(buf, 0, sizeof(buf)); 9468 9469 bacpy(&ev->addr.bdaddr, bdaddr); 9470 ev->addr.type = link_to_bdaddr(link_type, addr_type); 9471 ev->rssi = rssi; 9472 9473 eir_len = eir_append_data(ev->eir, 0, EIR_NAME_COMPLETE, name, 9474 name_len); 9475 9476 ev->eir_len = cpu_to_le16(eir_len); 9477 9478 mgmt_event(MGMT_EV_DEVICE_FOUND, hdev, ev, sizeof(*ev) + eir_len, NULL); 9479 } 9480 9481 void mgmt_discovering(struct hci_dev *hdev, u8 discovering) 9482 { 9483 struct mgmt_ev_discovering ev; 9484 9485 bt_dev_dbg(hdev, "discovering %u", discovering); 9486 9487 memset(&ev, 0, sizeof(ev)); 9488 ev.type = hdev->discovery.type; 9489 ev.discovering = discovering; 9490 9491 mgmt_event(MGMT_EV_DISCOVERING, hdev, &ev, sizeof(ev), NULL); 9492 } 9493 9494 void mgmt_suspending(struct hci_dev *hdev, u8 state) 9495 { 9496 struct mgmt_ev_controller_suspend ev; 9497 9498 ev.suspend_state = state; 9499 mgmt_event(MGMT_EV_CONTROLLER_SUSPEND, hdev, &ev, sizeof(ev), NULL); 9500 } 9501 9502 void mgmt_resuming(struct hci_dev *hdev, u8 reason, bdaddr_t *bdaddr, 9503 u8 addr_type) 9504 { 9505 struct mgmt_ev_controller_resume ev; 9506 9507 ev.wake_reason = reason; 9508 if (bdaddr) { 9509 bacpy(&ev.addr.bdaddr, bdaddr); 9510 ev.addr.type = addr_type; 9511 } else { 9512 memset(&ev.addr, 0, sizeof(ev.addr)); 9513 } 9514 9515 mgmt_event(MGMT_EV_CONTROLLER_RESUME, hdev, &ev, sizeof(ev), NULL); 9516 } 9517 9518 static struct hci_mgmt_chan chan = { 9519 .channel = HCI_CHANNEL_CONTROL, 9520 .handler_count = ARRAY_SIZE(mgmt_handlers), 9521 .handlers = mgmt_handlers, 9522 .hdev_init = mgmt_init_hdev, 9523 }; 9524 9525 int mgmt_init(void) 9526 { 9527 return hci_mgmt_chan_register(&chan); 9528 } 9529 9530 void mgmt_exit(void) 9531 { 9532 hci_mgmt_chan_unregister(&chan); 9533 } 9534