1 /* 2 BlueZ - Bluetooth protocol stack for Linux 3 4 Copyright (C) 2010 Nokia Corporation 5 Copyright (C) 2011-2012 Intel Corporation 6 7 This program is free software; you can redistribute it and/or modify 8 it under the terms of the GNU General Public License version 2 as 9 published by the Free Software Foundation; 10 11 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS 12 OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 13 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS. 14 IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY 15 CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES 16 WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN 17 ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF 18 OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. 19 20 ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS, 21 COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS 22 SOFTWARE IS DISCLAIMED. 23 */ 24 25 /* Bluetooth HCI Management interface */ 26 27 #include <linux/module.h> 28 #include <asm/unaligned.h> 29 30 #include <net/bluetooth/bluetooth.h> 31 #include <net/bluetooth/hci_core.h> 32 #include <net/bluetooth/hci_sock.h> 33 #include <net/bluetooth/l2cap.h> 34 #include <net/bluetooth/mgmt.h> 35 36 #include "hci_request.h" 37 #include "smp.h" 38 #include "mgmt_util.h" 39 #include "mgmt_config.h" 40 #include "msft.h" 41 #include "eir.h" 42 #include "aosp.h" 43 44 #define MGMT_VERSION 1 45 #define MGMT_REVISION 21 46 47 static const u16 mgmt_commands[] = { 48 MGMT_OP_READ_INDEX_LIST, 49 MGMT_OP_READ_INFO, 50 MGMT_OP_SET_POWERED, 51 MGMT_OP_SET_DISCOVERABLE, 52 MGMT_OP_SET_CONNECTABLE, 53 MGMT_OP_SET_FAST_CONNECTABLE, 54 MGMT_OP_SET_BONDABLE, 55 MGMT_OP_SET_LINK_SECURITY, 56 MGMT_OP_SET_SSP, 57 MGMT_OP_SET_HS, 58 MGMT_OP_SET_LE, 59 MGMT_OP_SET_DEV_CLASS, 60 MGMT_OP_SET_LOCAL_NAME, 61 MGMT_OP_ADD_UUID, 62 MGMT_OP_REMOVE_UUID, 63 MGMT_OP_LOAD_LINK_KEYS, 64 MGMT_OP_LOAD_LONG_TERM_KEYS, 65 MGMT_OP_DISCONNECT, 66 MGMT_OP_GET_CONNECTIONS, 67 MGMT_OP_PIN_CODE_REPLY, 68 MGMT_OP_PIN_CODE_NEG_REPLY, 69 MGMT_OP_SET_IO_CAPABILITY, 70 MGMT_OP_PAIR_DEVICE, 71 MGMT_OP_CANCEL_PAIR_DEVICE, 72 MGMT_OP_UNPAIR_DEVICE, 73 MGMT_OP_USER_CONFIRM_REPLY, 74 MGMT_OP_USER_CONFIRM_NEG_REPLY, 75 MGMT_OP_USER_PASSKEY_REPLY, 76 MGMT_OP_USER_PASSKEY_NEG_REPLY, 77 MGMT_OP_READ_LOCAL_OOB_DATA, 78 MGMT_OP_ADD_REMOTE_OOB_DATA, 79 MGMT_OP_REMOVE_REMOTE_OOB_DATA, 80 MGMT_OP_START_DISCOVERY, 81 MGMT_OP_STOP_DISCOVERY, 82 MGMT_OP_CONFIRM_NAME, 83 MGMT_OP_BLOCK_DEVICE, 84 MGMT_OP_UNBLOCK_DEVICE, 85 MGMT_OP_SET_DEVICE_ID, 86 MGMT_OP_SET_ADVERTISING, 87 MGMT_OP_SET_BREDR, 88 MGMT_OP_SET_STATIC_ADDRESS, 89 MGMT_OP_SET_SCAN_PARAMS, 90 MGMT_OP_SET_SECURE_CONN, 91 MGMT_OP_SET_DEBUG_KEYS, 92 MGMT_OP_SET_PRIVACY, 93 MGMT_OP_LOAD_IRKS, 94 MGMT_OP_GET_CONN_INFO, 95 MGMT_OP_GET_CLOCK_INFO, 96 MGMT_OP_ADD_DEVICE, 97 MGMT_OP_REMOVE_DEVICE, 98 MGMT_OP_LOAD_CONN_PARAM, 99 MGMT_OP_READ_UNCONF_INDEX_LIST, 100 MGMT_OP_READ_CONFIG_INFO, 101 MGMT_OP_SET_EXTERNAL_CONFIG, 102 MGMT_OP_SET_PUBLIC_ADDRESS, 103 MGMT_OP_START_SERVICE_DISCOVERY, 104 MGMT_OP_READ_LOCAL_OOB_EXT_DATA, 105 MGMT_OP_READ_EXT_INDEX_LIST, 106 MGMT_OP_READ_ADV_FEATURES, 107 MGMT_OP_ADD_ADVERTISING, 108 MGMT_OP_REMOVE_ADVERTISING, 109 MGMT_OP_GET_ADV_SIZE_INFO, 110 MGMT_OP_START_LIMITED_DISCOVERY, 111 MGMT_OP_READ_EXT_INFO, 112 MGMT_OP_SET_APPEARANCE, 113 MGMT_OP_GET_PHY_CONFIGURATION, 114 MGMT_OP_SET_PHY_CONFIGURATION, 115 MGMT_OP_SET_BLOCKED_KEYS, 116 MGMT_OP_SET_WIDEBAND_SPEECH, 117 MGMT_OP_READ_CONTROLLER_CAP, 118 MGMT_OP_READ_EXP_FEATURES_INFO, 119 MGMT_OP_SET_EXP_FEATURE, 120 MGMT_OP_READ_DEF_SYSTEM_CONFIG, 121 MGMT_OP_SET_DEF_SYSTEM_CONFIG, 122 MGMT_OP_READ_DEF_RUNTIME_CONFIG, 123 MGMT_OP_SET_DEF_RUNTIME_CONFIG, 124 MGMT_OP_GET_DEVICE_FLAGS, 125 MGMT_OP_SET_DEVICE_FLAGS, 126 MGMT_OP_READ_ADV_MONITOR_FEATURES, 127 MGMT_OP_ADD_ADV_PATTERNS_MONITOR, 128 MGMT_OP_REMOVE_ADV_MONITOR, 129 MGMT_OP_ADD_EXT_ADV_PARAMS, 130 MGMT_OP_ADD_EXT_ADV_DATA, 131 MGMT_OP_ADD_ADV_PATTERNS_MONITOR_RSSI, 132 }; 133 134 static const u16 mgmt_events[] = { 135 MGMT_EV_CONTROLLER_ERROR, 136 MGMT_EV_INDEX_ADDED, 137 MGMT_EV_INDEX_REMOVED, 138 MGMT_EV_NEW_SETTINGS, 139 MGMT_EV_CLASS_OF_DEV_CHANGED, 140 MGMT_EV_LOCAL_NAME_CHANGED, 141 MGMT_EV_NEW_LINK_KEY, 142 MGMT_EV_NEW_LONG_TERM_KEY, 143 MGMT_EV_DEVICE_CONNECTED, 144 MGMT_EV_DEVICE_DISCONNECTED, 145 MGMT_EV_CONNECT_FAILED, 146 MGMT_EV_PIN_CODE_REQUEST, 147 MGMT_EV_USER_CONFIRM_REQUEST, 148 MGMT_EV_USER_PASSKEY_REQUEST, 149 MGMT_EV_AUTH_FAILED, 150 MGMT_EV_DEVICE_FOUND, 151 MGMT_EV_DISCOVERING, 152 MGMT_EV_DEVICE_BLOCKED, 153 MGMT_EV_DEVICE_UNBLOCKED, 154 MGMT_EV_DEVICE_UNPAIRED, 155 MGMT_EV_PASSKEY_NOTIFY, 156 MGMT_EV_NEW_IRK, 157 MGMT_EV_NEW_CSRK, 158 MGMT_EV_DEVICE_ADDED, 159 MGMT_EV_DEVICE_REMOVED, 160 MGMT_EV_NEW_CONN_PARAM, 161 MGMT_EV_UNCONF_INDEX_ADDED, 162 MGMT_EV_UNCONF_INDEX_REMOVED, 163 MGMT_EV_NEW_CONFIG_OPTIONS, 164 MGMT_EV_EXT_INDEX_ADDED, 165 MGMT_EV_EXT_INDEX_REMOVED, 166 MGMT_EV_LOCAL_OOB_DATA_UPDATED, 167 MGMT_EV_ADVERTISING_ADDED, 168 MGMT_EV_ADVERTISING_REMOVED, 169 MGMT_EV_EXT_INFO_CHANGED, 170 MGMT_EV_PHY_CONFIGURATION_CHANGED, 171 MGMT_EV_EXP_FEATURE_CHANGED, 172 MGMT_EV_DEVICE_FLAGS_CHANGED, 173 MGMT_EV_ADV_MONITOR_ADDED, 174 MGMT_EV_ADV_MONITOR_REMOVED, 175 MGMT_EV_CONTROLLER_SUSPEND, 176 MGMT_EV_CONTROLLER_RESUME, 177 }; 178 179 static const u16 mgmt_untrusted_commands[] = { 180 MGMT_OP_READ_INDEX_LIST, 181 MGMT_OP_READ_INFO, 182 MGMT_OP_READ_UNCONF_INDEX_LIST, 183 MGMT_OP_READ_CONFIG_INFO, 184 MGMT_OP_READ_EXT_INDEX_LIST, 185 MGMT_OP_READ_EXT_INFO, 186 MGMT_OP_READ_CONTROLLER_CAP, 187 MGMT_OP_READ_EXP_FEATURES_INFO, 188 MGMT_OP_READ_DEF_SYSTEM_CONFIG, 189 MGMT_OP_READ_DEF_RUNTIME_CONFIG, 190 }; 191 192 static const u16 mgmt_untrusted_events[] = { 193 MGMT_EV_INDEX_ADDED, 194 MGMT_EV_INDEX_REMOVED, 195 MGMT_EV_NEW_SETTINGS, 196 MGMT_EV_CLASS_OF_DEV_CHANGED, 197 MGMT_EV_LOCAL_NAME_CHANGED, 198 MGMT_EV_UNCONF_INDEX_ADDED, 199 MGMT_EV_UNCONF_INDEX_REMOVED, 200 MGMT_EV_NEW_CONFIG_OPTIONS, 201 MGMT_EV_EXT_INDEX_ADDED, 202 MGMT_EV_EXT_INDEX_REMOVED, 203 MGMT_EV_EXT_INFO_CHANGED, 204 MGMT_EV_EXP_FEATURE_CHANGED, 205 }; 206 207 #define CACHE_TIMEOUT msecs_to_jiffies(2 * 1000) 208 209 #define ZERO_KEY "\x00\x00\x00\x00\x00\x00\x00\x00" \ 210 "\x00\x00\x00\x00\x00\x00\x00\x00" 211 212 /* HCI to MGMT error code conversion table */ 213 static const u8 mgmt_status_table[] = { 214 MGMT_STATUS_SUCCESS, 215 MGMT_STATUS_UNKNOWN_COMMAND, /* Unknown Command */ 216 MGMT_STATUS_NOT_CONNECTED, /* No Connection */ 217 MGMT_STATUS_FAILED, /* Hardware Failure */ 218 MGMT_STATUS_CONNECT_FAILED, /* Page Timeout */ 219 MGMT_STATUS_AUTH_FAILED, /* Authentication Failed */ 220 MGMT_STATUS_AUTH_FAILED, /* PIN or Key Missing */ 221 MGMT_STATUS_NO_RESOURCES, /* Memory Full */ 222 MGMT_STATUS_TIMEOUT, /* Connection Timeout */ 223 MGMT_STATUS_NO_RESOURCES, /* Max Number of Connections */ 224 MGMT_STATUS_NO_RESOURCES, /* Max Number of SCO Connections */ 225 MGMT_STATUS_ALREADY_CONNECTED, /* ACL Connection Exists */ 226 MGMT_STATUS_BUSY, /* Command Disallowed */ 227 MGMT_STATUS_NO_RESOURCES, /* Rejected Limited Resources */ 228 MGMT_STATUS_REJECTED, /* Rejected Security */ 229 MGMT_STATUS_REJECTED, /* Rejected Personal */ 230 MGMT_STATUS_TIMEOUT, /* Host Timeout */ 231 MGMT_STATUS_NOT_SUPPORTED, /* Unsupported Feature */ 232 MGMT_STATUS_INVALID_PARAMS, /* Invalid Parameters */ 233 MGMT_STATUS_DISCONNECTED, /* OE User Ended Connection */ 234 MGMT_STATUS_NO_RESOURCES, /* OE Low Resources */ 235 MGMT_STATUS_DISCONNECTED, /* OE Power Off */ 236 MGMT_STATUS_DISCONNECTED, /* Connection Terminated */ 237 MGMT_STATUS_BUSY, /* Repeated Attempts */ 238 MGMT_STATUS_REJECTED, /* Pairing Not Allowed */ 239 MGMT_STATUS_FAILED, /* Unknown LMP PDU */ 240 MGMT_STATUS_NOT_SUPPORTED, /* Unsupported Remote Feature */ 241 MGMT_STATUS_REJECTED, /* SCO Offset Rejected */ 242 MGMT_STATUS_REJECTED, /* SCO Interval Rejected */ 243 MGMT_STATUS_REJECTED, /* Air Mode Rejected */ 244 MGMT_STATUS_INVALID_PARAMS, /* Invalid LMP Parameters */ 245 MGMT_STATUS_FAILED, /* Unspecified Error */ 246 MGMT_STATUS_NOT_SUPPORTED, /* Unsupported LMP Parameter Value */ 247 MGMT_STATUS_FAILED, /* Role Change Not Allowed */ 248 MGMT_STATUS_TIMEOUT, /* LMP Response Timeout */ 249 MGMT_STATUS_FAILED, /* LMP Error Transaction Collision */ 250 MGMT_STATUS_FAILED, /* LMP PDU Not Allowed */ 251 MGMT_STATUS_REJECTED, /* Encryption Mode Not Accepted */ 252 MGMT_STATUS_FAILED, /* Unit Link Key Used */ 253 MGMT_STATUS_NOT_SUPPORTED, /* QoS Not Supported */ 254 MGMT_STATUS_TIMEOUT, /* Instant Passed */ 255 MGMT_STATUS_NOT_SUPPORTED, /* Pairing Not Supported */ 256 MGMT_STATUS_FAILED, /* Transaction Collision */ 257 MGMT_STATUS_FAILED, /* Reserved for future use */ 258 MGMT_STATUS_INVALID_PARAMS, /* Unacceptable Parameter */ 259 MGMT_STATUS_REJECTED, /* QoS Rejected */ 260 MGMT_STATUS_NOT_SUPPORTED, /* Classification Not Supported */ 261 MGMT_STATUS_REJECTED, /* Insufficient Security */ 262 MGMT_STATUS_INVALID_PARAMS, /* Parameter Out Of Range */ 263 MGMT_STATUS_FAILED, /* Reserved for future use */ 264 MGMT_STATUS_BUSY, /* Role Switch Pending */ 265 MGMT_STATUS_FAILED, /* Reserved for future use */ 266 MGMT_STATUS_FAILED, /* Slot Violation */ 267 MGMT_STATUS_FAILED, /* Role Switch Failed */ 268 MGMT_STATUS_INVALID_PARAMS, /* EIR Too Large */ 269 MGMT_STATUS_NOT_SUPPORTED, /* Simple Pairing Not Supported */ 270 MGMT_STATUS_BUSY, /* Host Busy Pairing */ 271 MGMT_STATUS_REJECTED, /* Rejected, No Suitable Channel */ 272 MGMT_STATUS_BUSY, /* Controller Busy */ 273 MGMT_STATUS_INVALID_PARAMS, /* Unsuitable Connection Interval */ 274 MGMT_STATUS_TIMEOUT, /* Directed Advertising Timeout */ 275 MGMT_STATUS_AUTH_FAILED, /* Terminated Due to MIC Failure */ 276 MGMT_STATUS_CONNECT_FAILED, /* Connection Establishment Failed */ 277 MGMT_STATUS_CONNECT_FAILED, /* MAC Connection Failed */ 278 }; 279 280 static u8 mgmt_errno_status(int err) 281 { 282 switch (err) { 283 case 0: 284 return MGMT_STATUS_SUCCESS; 285 case -EPERM: 286 return MGMT_STATUS_REJECTED; 287 case -EINVAL: 288 return MGMT_STATUS_INVALID_PARAMS; 289 case -EOPNOTSUPP: 290 return MGMT_STATUS_NOT_SUPPORTED; 291 case -EBUSY: 292 return MGMT_STATUS_BUSY; 293 case -ETIMEDOUT: 294 return MGMT_STATUS_AUTH_FAILED; 295 case -ENOMEM: 296 return MGMT_STATUS_NO_RESOURCES; 297 case -EISCONN: 298 return MGMT_STATUS_ALREADY_CONNECTED; 299 case -ENOTCONN: 300 return MGMT_STATUS_DISCONNECTED; 301 } 302 303 return MGMT_STATUS_FAILED; 304 } 305 306 static u8 mgmt_status(int err) 307 { 308 if (err < 0) 309 return mgmt_errno_status(err); 310 311 if (err < ARRAY_SIZE(mgmt_status_table)) 312 return mgmt_status_table[err]; 313 314 return MGMT_STATUS_FAILED; 315 } 316 317 static int mgmt_index_event(u16 event, struct hci_dev *hdev, void *data, 318 u16 len, int flag) 319 { 320 return mgmt_send_event(event, hdev, HCI_CHANNEL_CONTROL, data, len, 321 flag, NULL); 322 } 323 324 static int mgmt_limited_event(u16 event, struct hci_dev *hdev, void *data, 325 u16 len, int flag, struct sock *skip_sk) 326 { 327 return mgmt_send_event(event, hdev, HCI_CHANNEL_CONTROL, data, len, 328 flag, skip_sk); 329 } 330 331 static int mgmt_event(u16 event, struct hci_dev *hdev, void *data, u16 len, 332 struct sock *skip_sk) 333 { 334 return mgmt_send_event(event, hdev, HCI_CHANNEL_CONTROL, data, len, 335 HCI_SOCK_TRUSTED, skip_sk); 336 } 337 338 static int mgmt_event_skb(struct sk_buff *skb, struct sock *skip_sk) 339 { 340 return mgmt_send_event_skb(HCI_CHANNEL_CONTROL, skb, HCI_SOCK_TRUSTED, 341 skip_sk); 342 } 343 344 static u8 le_addr_type(u8 mgmt_addr_type) 345 { 346 if (mgmt_addr_type == BDADDR_LE_PUBLIC) 347 return ADDR_LE_DEV_PUBLIC; 348 else 349 return ADDR_LE_DEV_RANDOM; 350 } 351 352 void mgmt_fill_version_info(void *ver) 353 { 354 struct mgmt_rp_read_version *rp = ver; 355 356 rp->version = MGMT_VERSION; 357 rp->revision = cpu_to_le16(MGMT_REVISION); 358 } 359 360 static int read_version(struct sock *sk, struct hci_dev *hdev, void *data, 361 u16 data_len) 362 { 363 struct mgmt_rp_read_version rp; 364 365 bt_dev_dbg(hdev, "sock %p", sk); 366 367 mgmt_fill_version_info(&rp); 368 369 return mgmt_cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_VERSION, 0, 370 &rp, sizeof(rp)); 371 } 372 373 static int read_commands(struct sock *sk, struct hci_dev *hdev, void *data, 374 u16 data_len) 375 { 376 struct mgmt_rp_read_commands *rp; 377 u16 num_commands, num_events; 378 size_t rp_size; 379 int i, err; 380 381 bt_dev_dbg(hdev, "sock %p", sk); 382 383 if (hci_sock_test_flag(sk, HCI_SOCK_TRUSTED)) { 384 num_commands = ARRAY_SIZE(mgmt_commands); 385 num_events = ARRAY_SIZE(mgmt_events); 386 } else { 387 num_commands = ARRAY_SIZE(mgmt_untrusted_commands); 388 num_events = ARRAY_SIZE(mgmt_untrusted_events); 389 } 390 391 rp_size = sizeof(*rp) + ((num_commands + num_events) * sizeof(u16)); 392 393 rp = kmalloc(rp_size, GFP_KERNEL); 394 if (!rp) 395 return -ENOMEM; 396 397 rp->num_commands = cpu_to_le16(num_commands); 398 rp->num_events = cpu_to_le16(num_events); 399 400 if (hci_sock_test_flag(sk, HCI_SOCK_TRUSTED)) { 401 __le16 *opcode = rp->opcodes; 402 403 for (i = 0; i < num_commands; i++, opcode++) 404 put_unaligned_le16(mgmt_commands[i], opcode); 405 406 for (i = 0; i < num_events; i++, opcode++) 407 put_unaligned_le16(mgmt_events[i], opcode); 408 } else { 409 __le16 *opcode = rp->opcodes; 410 411 for (i = 0; i < num_commands; i++, opcode++) 412 put_unaligned_le16(mgmt_untrusted_commands[i], opcode); 413 414 for (i = 0; i < num_events; i++, opcode++) 415 put_unaligned_le16(mgmt_untrusted_events[i], opcode); 416 } 417 418 err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_COMMANDS, 0, 419 rp, rp_size); 420 kfree(rp); 421 422 return err; 423 } 424 425 static int read_index_list(struct sock *sk, struct hci_dev *hdev, void *data, 426 u16 data_len) 427 { 428 struct mgmt_rp_read_index_list *rp; 429 struct hci_dev *d; 430 size_t rp_len; 431 u16 count; 432 int err; 433 434 bt_dev_dbg(hdev, "sock %p", sk); 435 436 read_lock(&hci_dev_list_lock); 437 438 count = 0; 439 list_for_each_entry(d, &hci_dev_list, list) { 440 if (d->dev_type == HCI_PRIMARY && 441 !hci_dev_test_flag(d, HCI_UNCONFIGURED)) 442 count++; 443 } 444 445 rp_len = sizeof(*rp) + (2 * count); 446 rp = kmalloc(rp_len, GFP_ATOMIC); 447 if (!rp) { 448 read_unlock(&hci_dev_list_lock); 449 return -ENOMEM; 450 } 451 452 count = 0; 453 list_for_each_entry(d, &hci_dev_list, list) { 454 if (hci_dev_test_flag(d, HCI_SETUP) || 455 hci_dev_test_flag(d, HCI_CONFIG) || 456 hci_dev_test_flag(d, HCI_USER_CHANNEL)) 457 continue; 458 459 /* Devices marked as raw-only are neither configured 460 * nor unconfigured controllers. 461 */ 462 if (test_bit(HCI_QUIRK_RAW_DEVICE, &d->quirks)) 463 continue; 464 465 if (d->dev_type == HCI_PRIMARY && 466 !hci_dev_test_flag(d, HCI_UNCONFIGURED)) { 467 rp->index[count++] = cpu_to_le16(d->id); 468 bt_dev_dbg(hdev, "Added hci%u", d->id); 469 } 470 } 471 472 rp->num_controllers = cpu_to_le16(count); 473 rp_len = sizeof(*rp) + (2 * count); 474 475 read_unlock(&hci_dev_list_lock); 476 477 err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_INDEX_LIST, 478 0, rp, rp_len); 479 480 kfree(rp); 481 482 return err; 483 } 484 485 static int read_unconf_index_list(struct sock *sk, struct hci_dev *hdev, 486 void *data, u16 data_len) 487 { 488 struct mgmt_rp_read_unconf_index_list *rp; 489 struct hci_dev *d; 490 size_t rp_len; 491 u16 count; 492 int err; 493 494 bt_dev_dbg(hdev, "sock %p", sk); 495 496 read_lock(&hci_dev_list_lock); 497 498 count = 0; 499 list_for_each_entry(d, &hci_dev_list, list) { 500 if (d->dev_type == HCI_PRIMARY && 501 hci_dev_test_flag(d, HCI_UNCONFIGURED)) 502 count++; 503 } 504 505 rp_len = sizeof(*rp) + (2 * count); 506 rp = kmalloc(rp_len, GFP_ATOMIC); 507 if (!rp) { 508 read_unlock(&hci_dev_list_lock); 509 return -ENOMEM; 510 } 511 512 count = 0; 513 list_for_each_entry(d, &hci_dev_list, list) { 514 if (hci_dev_test_flag(d, HCI_SETUP) || 515 hci_dev_test_flag(d, HCI_CONFIG) || 516 hci_dev_test_flag(d, HCI_USER_CHANNEL)) 517 continue; 518 519 /* Devices marked as raw-only are neither configured 520 * nor unconfigured controllers. 521 */ 522 if (test_bit(HCI_QUIRK_RAW_DEVICE, &d->quirks)) 523 continue; 524 525 if (d->dev_type == HCI_PRIMARY && 526 hci_dev_test_flag(d, HCI_UNCONFIGURED)) { 527 rp->index[count++] = cpu_to_le16(d->id); 528 bt_dev_dbg(hdev, "Added hci%u", d->id); 529 } 530 } 531 532 rp->num_controllers = cpu_to_le16(count); 533 rp_len = sizeof(*rp) + (2 * count); 534 535 read_unlock(&hci_dev_list_lock); 536 537 err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE, 538 MGMT_OP_READ_UNCONF_INDEX_LIST, 0, rp, rp_len); 539 540 kfree(rp); 541 542 return err; 543 } 544 545 static int read_ext_index_list(struct sock *sk, struct hci_dev *hdev, 546 void *data, u16 data_len) 547 { 548 struct mgmt_rp_read_ext_index_list *rp; 549 struct hci_dev *d; 550 u16 count; 551 int err; 552 553 bt_dev_dbg(hdev, "sock %p", sk); 554 555 read_lock(&hci_dev_list_lock); 556 557 count = 0; 558 list_for_each_entry(d, &hci_dev_list, list) { 559 if (d->dev_type == HCI_PRIMARY || d->dev_type == HCI_AMP) 560 count++; 561 } 562 563 rp = kmalloc(struct_size(rp, entry, count), GFP_ATOMIC); 564 if (!rp) { 565 read_unlock(&hci_dev_list_lock); 566 return -ENOMEM; 567 } 568 569 count = 0; 570 list_for_each_entry(d, &hci_dev_list, list) { 571 if (hci_dev_test_flag(d, HCI_SETUP) || 572 hci_dev_test_flag(d, HCI_CONFIG) || 573 hci_dev_test_flag(d, HCI_USER_CHANNEL)) 574 continue; 575 576 /* Devices marked as raw-only are neither configured 577 * nor unconfigured controllers. 578 */ 579 if (test_bit(HCI_QUIRK_RAW_DEVICE, &d->quirks)) 580 continue; 581 582 if (d->dev_type == HCI_PRIMARY) { 583 if (hci_dev_test_flag(d, HCI_UNCONFIGURED)) 584 rp->entry[count].type = 0x01; 585 else 586 rp->entry[count].type = 0x00; 587 } else if (d->dev_type == HCI_AMP) { 588 rp->entry[count].type = 0x02; 589 } else { 590 continue; 591 } 592 593 rp->entry[count].bus = d->bus; 594 rp->entry[count++].index = cpu_to_le16(d->id); 595 bt_dev_dbg(hdev, "Added hci%u", d->id); 596 } 597 598 rp->num_controllers = cpu_to_le16(count); 599 600 read_unlock(&hci_dev_list_lock); 601 602 /* If this command is called at least once, then all the 603 * default index and unconfigured index events are disabled 604 * and from now on only extended index events are used. 605 */ 606 hci_sock_set_flag(sk, HCI_MGMT_EXT_INDEX_EVENTS); 607 hci_sock_clear_flag(sk, HCI_MGMT_INDEX_EVENTS); 608 hci_sock_clear_flag(sk, HCI_MGMT_UNCONF_INDEX_EVENTS); 609 610 err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE, 611 MGMT_OP_READ_EXT_INDEX_LIST, 0, rp, 612 struct_size(rp, entry, count)); 613 614 kfree(rp); 615 616 return err; 617 } 618 619 static bool is_configured(struct hci_dev *hdev) 620 { 621 if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks) && 622 !hci_dev_test_flag(hdev, HCI_EXT_CONFIGURED)) 623 return false; 624 625 if ((test_bit(HCI_QUIRK_INVALID_BDADDR, &hdev->quirks) || 626 test_bit(HCI_QUIRK_USE_BDADDR_PROPERTY, &hdev->quirks)) && 627 !bacmp(&hdev->public_addr, BDADDR_ANY)) 628 return false; 629 630 return true; 631 } 632 633 static __le32 get_missing_options(struct hci_dev *hdev) 634 { 635 u32 options = 0; 636 637 if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks) && 638 !hci_dev_test_flag(hdev, HCI_EXT_CONFIGURED)) 639 options |= MGMT_OPTION_EXTERNAL_CONFIG; 640 641 if ((test_bit(HCI_QUIRK_INVALID_BDADDR, &hdev->quirks) || 642 test_bit(HCI_QUIRK_USE_BDADDR_PROPERTY, &hdev->quirks)) && 643 !bacmp(&hdev->public_addr, BDADDR_ANY)) 644 options |= MGMT_OPTION_PUBLIC_ADDRESS; 645 646 return cpu_to_le32(options); 647 } 648 649 static int new_options(struct hci_dev *hdev, struct sock *skip) 650 { 651 __le32 options = get_missing_options(hdev); 652 653 return mgmt_limited_event(MGMT_EV_NEW_CONFIG_OPTIONS, hdev, &options, 654 sizeof(options), HCI_MGMT_OPTION_EVENTS, skip); 655 } 656 657 static int send_options_rsp(struct sock *sk, u16 opcode, struct hci_dev *hdev) 658 { 659 __le32 options = get_missing_options(hdev); 660 661 return mgmt_cmd_complete(sk, hdev->id, opcode, 0, &options, 662 sizeof(options)); 663 } 664 665 static int read_config_info(struct sock *sk, struct hci_dev *hdev, 666 void *data, u16 data_len) 667 { 668 struct mgmt_rp_read_config_info rp; 669 u32 options = 0; 670 671 bt_dev_dbg(hdev, "sock %p", sk); 672 673 hci_dev_lock(hdev); 674 675 memset(&rp, 0, sizeof(rp)); 676 rp.manufacturer = cpu_to_le16(hdev->manufacturer); 677 678 if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks)) 679 options |= MGMT_OPTION_EXTERNAL_CONFIG; 680 681 if (hdev->set_bdaddr) 682 options |= MGMT_OPTION_PUBLIC_ADDRESS; 683 684 rp.supported_options = cpu_to_le32(options); 685 rp.missing_options = get_missing_options(hdev); 686 687 hci_dev_unlock(hdev); 688 689 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_CONFIG_INFO, 0, 690 &rp, sizeof(rp)); 691 } 692 693 static u32 get_supported_phys(struct hci_dev *hdev) 694 { 695 u32 supported_phys = 0; 696 697 if (lmp_bredr_capable(hdev)) { 698 supported_phys |= MGMT_PHY_BR_1M_1SLOT; 699 700 if (hdev->features[0][0] & LMP_3SLOT) 701 supported_phys |= MGMT_PHY_BR_1M_3SLOT; 702 703 if (hdev->features[0][0] & LMP_5SLOT) 704 supported_phys |= MGMT_PHY_BR_1M_5SLOT; 705 706 if (lmp_edr_2m_capable(hdev)) { 707 supported_phys |= MGMT_PHY_EDR_2M_1SLOT; 708 709 if (lmp_edr_3slot_capable(hdev)) 710 supported_phys |= MGMT_PHY_EDR_2M_3SLOT; 711 712 if (lmp_edr_5slot_capable(hdev)) 713 supported_phys |= MGMT_PHY_EDR_2M_5SLOT; 714 715 if (lmp_edr_3m_capable(hdev)) { 716 supported_phys |= MGMT_PHY_EDR_3M_1SLOT; 717 718 if (lmp_edr_3slot_capable(hdev)) 719 supported_phys |= MGMT_PHY_EDR_3M_3SLOT; 720 721 if (lmp_edr_5slot_capable(hdev)) 722 supported_phys |= MGMT_PHY_EDR_3M_5SLOT; 723 } 724 } 725 } 726 727 if (lmp_le_capable(hdev)) { 728 supported_phys |= MGMT_PHY_LE_1M_TX; 729 supported_phys |= MGMT_PHY_LE_1M_RX; 730 731 if (hdev->le_features[1] & HCI_LE_PHY_2M) { 732 supported_phys |= MGMT_PHY_LE_2M_TX; 733 supported_phys |= MGMT_PHY_LE_2M_RX; 734 } 735 736 if (hdev->le_features[1] & HCI_LE_PHY_CODED) { 737 supported_phys |= MGMT_PHY_LE_CODED_TX; 738 supported_phys |= MGMT_PHY_LE_CODED_RX; 739 } 740 } 741 742 return supported_phys; 743 } 744 745 static u32 get_selected_phys(struct hci_dev *hdev) 746 { 747 u32 selected_phys = 0; 748 749 if (lmp_bredr_capable(hdev)) { 750 selected_phys |= MGMT_PHY_BR_1M_1SLOT; 751 752 if (hdev->pkt_type & (HCI_DM3 | HCI_DH3)) 753 selected_phys |= MGMT_PHY_BR_1M_3SLOT; 754 755 if (hdev->pkt_type & (HCI_DM5 | HCI_DH5)) 756 selected_phys |= MGMT_PHY_BR_1M_5SLOT; 757 758 if (lmp_edr_2m_capable(hdev)) { 759 if (!(hdev->pkt_type & HCI_2DH1)) 760 selected_phys |= MGMT_PHY_EDR_2M_1SLOT; 761 762 if (lmp_edr_3slot_capable(hdev) && 763 !(hdev->pkt_type & HCI_2DH3)) 764 selected_phys |= MGMT_PHY_EDR_2M_3SLOT; 765 766 if (lmp_edr_5slot_capable(hdev) && 767 !(hdev->pkt_type & HCI_2DH5)) 768 selected_phys |= MGMT_PHY_EDR_2M_5SLOT; 769 770 if (lmp_edr_3m_capable(hdev)) { 771 if (!(hdev->pkt_type & HCI_3DH1)) 772 selected_phys |= MGMT_PHY_EDR_3M_1SLOT; 773 774 if (lmp_edr_3slot_capable(hdev) && 775 !(hdev->pkt_type & HCI_3DH3)) 776 selected_phys |= MGMT_PHY_EDR_3M_3SLOT; 777 778 if (lmp_edr_5slot_capable(hdev) && 779 !(hdev->pkt_type & HCI_3DH5)) 780 selected_phys |= MGMT_PHY_EDR_3M_5SLOT; 781 } 782 } 783 } 784 785 if (lmp_le_capable(hdev)) { 786 if (hdev->le_tx_def_phys & HCI_LE_SET_PHY_1M) 787 selected_phys |= MGMT_PHY_LE_1M_TX; 788 789 if (hdev->le_rx_def_phys & HCI_LE_SET_PHY_1M) 790 selected_phys |= MGMT_PHY_LE_1M_RX; 791 792 if (hdev->le_tx_def_phys & HCI_LE_SET_PHY_2M) 793 selected_phys |= MGMT_PHY_LE_2M_TX; 794 795 if (hdev->le_rx_def_phys & HCI_LE_SET_PHY_2M) 796 selected_phys |= MGMT_PHY_LE_2M_RX; 797 798 if (hdev->le_tx_def_phys & HCI_LE_SET_PHY_CODED) 799 selected_phys |= MGMT_PHY_LE_CODED_TX; 800 801 if (hdev->le_rx_def_phys & HCI_LE_SET_PHY_CODED) 802 selected_phys |= MGMT_PHY_LE_CODED_RX; 803 } 804 805 return selected_phys; 806 } 807 808 static u32 get_configurable_phys(struct hci_dev *hdev) 809 { 810 return (get_supported_phys(hdev) & ~MGMT_PHY_BR_1M_1SLOT & 811 ~MGMT_PHY_LE_1M_TX & ~MGMT_PHY_LE_1M_RX); 812 } 813 814 static u32 get_supported_settings(struct hci_dev *hdev) 815 { 816 u32 settings = 0; 817 818 settings |= MGMT_SETTING_POWERED; 819 settings |= MGMT_SETTING_BONDABLE; 820 settings |= MGMT_SETTING_DEBUG_KEYS; 821 settings |= MGMT_SETTING_CONNECTABLE; 822 settings |= MGMT_SETTING_DISCOVERABLE; 823 824 if (lmp_bredr_capable(hdev)) { 825 if (hdev->hci_ver >= BLUETOOTH_VER_1_2) 826 settings |= MGMT_SETTING_FAST_CONNECTABLE; 827 settings |= MGMT_SETTING_BREDR; 828 settings |= MGMT_SETTING_LINK_SECURITY; 829 830 if (lmp_ssp_capable(hdev)) { 831 settings |= MGMT_SETTING_SSP; 832 if (IS_ENABLED(CONFIG_BT_HS)) 833 settings |= MGMT_SETTING_HS; 834 } 835 836 if (lmp_sc_capable(hdev)) 837 settings |= MGMT_SETTING_SECURE_CONN; 838 839 if (test_bit(HCI_QUIRK_WIDEBAND_SPEECH_SUPPORTED, 840 &hdev->quirks)) 841 settings |= MGMT_SETTING_WIDEBAND_SPEECH; 842 } 843 844 if (lmp_le_capable(hdev)) { 845 settings |= MGMT_SETTING_LE; 846 settings |= MGMT_SETTING_SECURE_CONN; 847 settings |= MGMT_SETTING_PRIVACY; 848 settings |= MGMT_SETTING_STATIC_ADDRESS; 849 settings |= MGMT_SETTING_ADVERTISING; 850 } 851 852 if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks) || 853 hdev->set_bdaddr) 854 settings |= MGMT_SETTING_CONFIGURATION; 855 856 settings |= MGMT_SETTING_PHY_CONFIGURATION; 857 858 return settings; 859 } 860 861 static u32 get_current_settings(struct hci_dev *hdev) 862 { 863 u32 settings = 0; 864 865 if (hdev_is_powered(hdev)) 866 settings |= MGMT_SETTING_POWERED; 867 868 if (hci_dev_test_flag(hdev, HCI_CONNECTABLE)) 869 settings |= MGMT_SETTING_CONNECTABLE; 870 871 if (hci_dev_test_flag(hdev, HCI_FAST_CONNECTABLE)) 872 settings |= MGMT_SETTING_FAST_CONNECTABLE; 873 874 if (hci_dev_test_flag(hdev, HCI_DISCOVERABLE)) 875 settings |= MGMT_SETTING_DISCOVERABLE; 876 877 if (hci_dev_test_flag(hdev, HCI_BONDABLE)) 878 settings |= MGMT_SETTING_BONDABLE; 879 880 if (hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) 881 settings |= MGMT_SETTING_BREDR; 882 883 if (hci_dev_test_flag(hdev, HCI_LE_ENABLED)) 884 settings |= MGMT_SETTING_LE; 885 886 if (hci_dev_test_flag(hdev, HCI_LINK_SECURITY)) 887 settings |= MGMT_SETTING_LINK_SECURITY; 888 889 if (hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) 890 settings |= MGMT_SETTING_SSP; 891 892 if (hci_dev_test_flag(hdev, HCI_HS_ENABLED)) 893 settings |= MGMT_SETTING_HS; 894 895 if (hci_dev_test_flag(hdev, HCI_ADVERTISING)) 896 settings |= MGMT_SETTING_ADVERTISING; 897 898 if (hci_dev_test_flag(hdev, HCI_SC_ENABLED)) 899 settings |= MGMT_SETTING_SECURE_CONN; 900 901 if (hci_dev_test_flag(hdev, HCI_KEEP_DEBUG_KEYS)) 902 settings |= MGMT_SETTING_DEBUG_KEYS; 903 904 if (hci_dev_test_flag(hdev, HCI_PRIVACY)) 905 settings |= MGMT_SETTING_PRIVACY; 906 907 /* The current setting for static address has two purposes. The 908 * first is to indicate if the static address will be used and 909 * the second is to indicate if it is actually set. 910 * 911 * This means if the static address is not configured, this flag 912 * will never be set. If the address is configured, then if the 913 * address is actually used decides if the flag is set or not. 914 * 915 * For single mode LE only controllers and dual-mode controllers 916 * with BR/EDR disabled, the existence of the static address will 917 * be evaluated. 918 */ 919 if (hci_dev_test_flag(hdev, HCI_FORCE_STATIC_ADDR) || 920 !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) || 921 !bacmp(&hdev->bdaddr, BDADDR_ANY)) { 922 if (bacmp(&hdev->static_addr, BDADDR_ANY)) 923 settings |= MGMT_SETTING_STATIC_ADDRESS; 924 } 925 926 if (hci_dev_test_flag(hdev, HCI_WIDEBAND_SPEECH_ENABLED)) 927 settings |= MGMT_SETTING_WIDEBAND_SPEECH; 928 929 return settings; 930 } 931 932 static struct mgmt_pending_cmd *pending_find(u16 opcode, struct hci_dev *hdev) 933 { 934 return mgmt_pending_find(HCI_CHANNEL_CONTROL, opcode, hdev); 935 } 936 937 u8 mgmt_get_adv_discov_flags(struct hci_dev *hdev) 938 { 939 struct mgmt_pending_cmd *cmd; 940 941 /* If there's a pending mgmt command the flags will not yet have 942 * their final values, so check for this first. 943 */ 944 cmd = pending_find(MGMT_OP_SET_DISCOVERABLE, hdev); 945 if (cmd) { 946 struct mgmt_mode *cp = cmd->param; 947 if (cp->val == 0x01) 948 return LE_AD_GENERAL; 949 else if (cp->val == 0x02) 950 return LE_AD_LIMITED; 951 } else { 952 if (hci_dev_test_flag(hdev, HCI_LIMITED_DISCOVERABLE)) 953 return LE_AD_LIMITED; 954 else if (hci_dev_test_flag(hdev, HCI_DISCOVERABLE)) 955 return LE_AD_GENERAL; 956 } 957 958 return 0; 959 } 960 961 bool mgmt_get_connectable(struct hci_dev *hdev) 962 { 963 struct mgmt_pending_cmd *cmd; 964 965 /* If there's a pending mgmt command the flag will not yet have 966 * it's final value, so check for this first. 967 */ 968 cmd = pending_find(MGMT_OP_SET_CONNECTABLE, hdev); 969 if (cmd) { 970 struct mgmt_mode *cp = cmd->param; 971 972 return cp->val; 973 } 974 975 return hci_dev_test_flag(hdev, HCI_CONNECTABLE); 976 } 977 978 static int service_cache_sync(struct hci_dev *hdev, void *data) 979 { 980 hci_update_eir_sync(hdev); 981 hci_update_class_sync(hdev); 982 983 return 0; 984 } 985 986 static void service_cache_off(struct work_struct *work) 987 { 988 struct hci_dev *hdev = container_of(work, struct hci_dev, 989 service_cache.work); 990 991 if (!hci_dev_test_and_clear_flag(hdev, HCI_SERVICE_CACHE)) 992 return; 993 994 hci_cmd_sync_queue(hdev, service_cache_sync, NULL, NULL); 995 } 996 997 static int rpa_expired_sync(struct hci_dev *hdev, void *data) 998 { 999 /* The generation of a new RPA and programming it into the 1000 * controller happens in the hci_req_enable_advertising() 1001 * function. 1002 */ 1003 if (ext_adv_capable(hdev)) 1004 return hci_start_ext_adv_sync(hdev, hdev->cur_adv_instance); 1005 else 1006 return hci_enable_advertising_sync(hdev); 1007 } 1008 1009 static void rpa_expired(struct work_struct *work) 1010 { 1011 struct hci_dev *hdev = container_of(work, struct hci_dev, 1012 rpa_expired.work); 1013 1014 bt_dev_dbg(hdev, ""); 1015 1016 hci_dev_set_flag(hdev, HCI_RPA_EXPIRED); 1017 1018 if (!hci_dev_test_flag(hdev, HCI_ADVERTISING)) 1019 return; 1020 1021 hci_cmd_sync_queue(hdev, rpa_expired_sync, NULL, NULL); 1022 } 1023 1024 static void mgmt_init_hdev(struct sock *sk, struct hci_dev *hdev) 1025 { 1026 if (hci_dev_test_and_set_flag(hdev, HCI_MGMT)) 1027 return; 1028 1029 INIT_DELAYED_WORK(&hdev->service_cache, service_cache_off); 1030 INIT_DELAYED_WORK(&hdev->rpa_expired, rpa_expired); 1031 1032 /* Non-mgmt controlled devices get this bit set 1033 * implicitly so that pairing works for them, however 1034 * for mgmt we require user-space to explicitly enable 1035 * it 1036 */ 1037 hci_dev_clear_flag(hdev, HCI_BONDABLE); 1038 } 1039 1040 static int read_controller_info(struct sock *sk, struct hci_dev *hdev, 1041 void *data, u16 data_len) 1042 { 1043 struct mgmt_rp_read_info rp; 1044 1045 bt_dev_dbg(hdev, "sock %p", sk); 1046 1047 hci_dev_lock(hdev); 1048 1049 memset(&rp, 0, sizeof(rp)); 1050 1051 bacpy(&rp.bdaddr, &hdev->bdaddr); 1052 1053 rp.version = hdev->hci_ver; 1054 rp.manufacturer = cpu_to_le16(hdev->manufacturer); 1055 1056 rp.supported_settings = cpu_to_le32(get_supported_settings(hdev)); 1057 rp.current_settings = cpu_to_le32(get_current_settings(hdev)); 1058 1059 memcpy(rp.dev_class, hdev->dev_class, 3); 1060 1061 memcpy(rp.name, hdev->dev_name, sizeof(hdev->dev_name)); 1062 memcpy(rp.short_name, hdev->short_name, sizeof(hdev->short_name)); 1063 1064 hci_dev_unlock(hdev); 1065 1066 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_INFO, 0, &rp, 1067 sizeof(rp)); 1068 } 1069 1070 static u16 append_eir_data_to_buf(struct hci_dev *hdev, u8 *eir) 1071 { 1072 u16 eir_len = 0; 1073 size_t name_len; 1074 1075 if (hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) 1076 eir_len = eir_append_data(eir, eir_len, EIR_CLASS_OF_DEV, 1077 hdev->dev_class, 3); 1078 1079 if (hci_dev_test_flag(hdev, HCI_LE_ENABLED)) 1080 eir_len = eir_append_le16(eir, eir_len, EIR_APPEARANCE, 1081 hdev->appearance); 1082 1083 name_len = strlen(hdev->dev_name); 1084 eir_len = eir_append_data(eir, eir_len, EIR_NAME_COMPLETE, 1085 hdev->dev_name, name_len); 1086 1087 name_len = strlen(hdev->short_name); 1088 eir_len = eir_append_data(eir, eir_len, EIR_NAME_SHORT, 1089 hdev->short_name, name_len); 1090 1091 return eir_len; 1092 } 1093 1094 static int read_ext_controller_info(struct sock *sk, struct hci_dev *hdev, 1095 void *data, u16 data_len) 1096 { 1097 char buf[512]; 1098 struct mgmt_rp_read_ext_info *rp = (void *)buf; 1099 u16 eir_len; 1100 1101 bt_dev_dbg(hdev, "sock %p", sk); 1102 1103 memset(&buf, 0, sizeof(buf)); 1104 1105 hci_dev_lock(hdev); 1106 1107 bacpy(&rp->bdaddr, &hdev->bdaddr); 1108 1109 rp->version = hdev->hci_ver; 1110 rp->manufacturer = cpu_to_le16(hdev->manufacturer); 1111 1112 rp->supported_settings = cpu_to_le32(get_supported_settings(hdev)); 1113 rp->current_settings = cpu_to_le32(get_current_settings(hdev)); 1114 1115 1116 eir_len = append_eir_data_to_buf(hdev, rp->eir); 1117 rp->eir_len = cpu_to_le16(eir_len); 1118 1119 hci_dev_unlock(hdev); 1120 1121 /* If this command is called at least once, then the events 1122 * for class of device and local name changes are disabled 1123 * and only the new extended controller information event 1124 * is used. 1125 */ 1126 hci_sock_set_flag(sk, HCI_MGMT_EXT_INFO_EVENTS); 1127 hci_sock_clear_flag(sk, HCI_MGMT_DEV_CLASS_EVENTS); 1128 hci_sock_clear_flag(sk, HCI_MGMT_LOCAL_NAME_EVENTS); 1129 1130 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_EXT_INFO, 0, rp, 1131 sizeof(*rp) + eir_len); 1132 } 1133 1134 static int ext_info_changed(struct hci_dev *hdev, struct sock *skip) 1135 { 1136 char buf[512]; 1137 struct mgmt_ev_ext_info_changed *ev = (void *)buf; 1138 u16 eir_len; 1139 1140 memset(buf, 0, sizeof(buf)); 1141 1142 eir_len = append_eir_data_to_buf(hdev, ev->eir); 1143 ev->eir_len = cpu_to_le16(eir_len); 1144 1145 return mgmt_limited_event(MGMT_EV_EXT_INFO_CHANGED, hdev, ev, 1146 sizeof(*ev) + eir_len, 1147 HCI_MGMT_EXT_INFO_EVENTS, skip); 1148 } 1149 1150 static int send_settings_rsp(struct sock *sk, u16 opcode, struct hci_dev *hdev) 1151 { 1152 __le32 settings = cpu_to_le32(get_current_settings(hdev)); 1153 1154 return mgmt_cmd_complete(sk, hdev->id, opcode, 0, &settings, 1155 sizeof(settings)); 1156 } 1157 1158 void mgmt_advertising_added(struct sock *sk, struct hci_dev *hdev, u8 instance) 1159 { 1160 struct mgmt_ev_advertising_added ev; 1161 1162 ev.instance = instance; 1163 1164 mgmt_event(MGMT_EV_ADVERTISING_ADDED, hdev, &ev, sizeof(ev), sk); 1165 } 1166 1167 void mgmt_advertising_removed(struct sock *sk, struct hci_dev *hdev, 1168 u8 instance) 1169 { 1170 struct mgmt_ev_advertising_removed ev; 1171 1172 ev.instance = instance; 1173 1174 mgmt_event(MGMT_EV_ADVERTISING_REMOVED, hdev, &ev, sizeof(ev), sk); 1175 } 1176 1177 static void cancel_adv_timeout(struct hci_dev *hdev) 1178 { 1179 if (hdev->adv_instance_timeout) { 1180 hdev->adv_instance_timeout = 0; 1181 cancel_delayed_work(&hdev->adv_instance_expire); 1182 } 1183 } 1184 1185 /* This function requires the caller holds hdev->lock */ 1186 static void restart_le_actions(struct hci_dev *hdev) 1187 { 1188 struct hci_conn_params *p; 1189 1190 list_for_each_entry(p, &hdev->le_conn_params, list) { 1191 /* Needed for AUTO_OFF case where might not "really" 1192 * have been powered off. 1193 */ 1194 list_del_init(&p->action); 1195 1196 switch (p->auto_connect) { 1197 case HCI_AUTO_CONN_DIRECT: 1198 case HCI_AUTO_CONN_ALWAYS: 1199 list_add(&p->action, &hdev->pend_le_conns); 1200 break; 1201 case HCI_AUTO_CONN_REPORT: 1202 list_add(&p->action, &hdev->pend_le_reports); 1203 break; 1204 default: 1205 break; 1206 } 1207 } 1208 } 1209 1210 static int new_settings(struct hci_dev *hdev, struct sock *skip) 1211 { 1212 __le32 ev = cpu_to_le32(get_current_settings(hdev)); 1213 1214 return mgmt_limited_event(MGMT_EV_NEW_SETTINGS, hdev, &ev, 1215 sizeof(ev), HCI_MGMT_SETTING_EVENTS, skip); 1216 } 1217 1218 static void mgmt_set_powered_complete(struct hci_dev *hdev, void *data, int err) 1219 { 1220 struct mgmt_pending_cmd *cmd = data; 1221 struct mgmt_mode *cp; 1222 1223 /* Make sure cmd still outstanding. */ 1224 if (cmd != pending_find(MGMT_OP_SET_POWERED, hdev)) 1225 return; 1226 1227 cp = cmd->param; 1228 1229 bt_dev_dbg(hdev, "err %d", err); 1230 1231 if (!err) { 1232 if (cp->val) { 1233 hci_dev_lock(hdev); 1234 restart_le_actions(hdev); 1235 hci_update_passive_scan(hdev); 1236 hci_dev_unlock(hdev); 1237 } 1238 1239 send_settings_rsp(cmd->sk, cmd->opcode, hdev); 1240 1241 /* Only call new_setting for power on as power off is deferred 1242 * to hdev->power_off work which does call hci_dev_do_close. 1243 */ 1244 if (cp->val) 1245 new_settings(hdev, cmd->sk); 1246 } else { 1247 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_POWERED, 1248 mgmt_status(err)); 1249 } 1250 1251 mgmt_pending_remove(cmd); 1252 } 1253 1254 static int set_powered_sync(struct hci_dev *hdev, void *data) 1255 { 1256 struct mgmt_pending_cmd *cmd = data; 1257 struct mgmt_mode *cp = cmd->param; 1258 1259 BT_DBG("%s", hdev->name); 1260 1261 return hci_set_powered_sync(hdev, cp->val); 1262 } 1263 1264 static int set_powered(struct sock *sk, struct hci_dev *hdev, void *data, 1265 u16 len) 1266 { 1267 struct mgmt_mode *cp = data; 1268 struct mgmt_pending_cmd *cmd; 1269 int err; 1270 1271 bt_dev_dbg(hdev, "sock %p", sk); 1272 1273 if (cp->val != 0x00 && cp->val != 0x01) 1274 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED, 1275 MGMT_STATUS_INVALID_PARAMS); 1276 1277 hci_dev_lock(hdev); 1278 1279 if (pending_find(MGMT_OP_SET_POWERED, hdev)) { 1280 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED, 1281 MGMT_STATUS_BUSY); 1282 goto failed; 1283 } 1284 1285 if (!!cp->val == hdev_is_powered(hdev)) { 1286 err = send_settings_rsp(sk, MGMT_OP_SET_POWERED, hdev); 1287 goto failed; 1288 } 1289 1290 cmd = mgmt_pending_add(sk, MGMT_OP_SET_POWERED, hdev, data, len); 1291 if (!cmd) { 1292 err = -ENOMEM; 1293 goto failed; 1294 } 1295 1296 err = hci_cmd_sync_queue(hdev, set_powered_sync, cmd, 1297 mgmt_set_powered_complete); 1298 1299 if (err < 0) 1300 mgmt_pending_remove(cmd); 1301 1302 failed: 1303 hci_dev_unlock(hdev); 1304 return err; 1305 } 1306 1307 int mgmt_new_settings(struct hci_dev *hdev) 1308 { 1309 return new_settings(hdev, NULL); 1310 } 1311 1312 struct cmd_lookup { 1313 struct sock *sk; 1314 struct hci_dev *hdev; 1315 u8 mgmt_status; 1316 }; 1317 1318 static void settings_rsp(struct mgmt_pending_cmd *cmd, void *data) 1319 { 1320 struct cmd_lookup *match = data; 1321 1322 send_settings_rsp(cmd->sk, cmd->opcode, match->hdev); 1323 1324 list_del(&cmd->list); 1325 1326 if (match->sk == NULL) { 1327 match->sk = cmd->sk; 1328 sock_hold(match->sk); 1329 } 1330 1331 mgmt_pending_free(cmd); 1332 } 1333 1334 static void cmd_status_rsp(struct mgmt_pending_cmd *cmd, void *data) 1335 { 1336 u8 *status = data; 1337 1338 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, *status); 1339 mgmt_pending_remove(cmd); 1340 } 1341 1342 static void cmd_complete_rsp(struct mgmt_pending_cmd *cmd, void *data) 1343 { 1344 if (cmd->cmd_complete) { 1345 u8 *status = data; 1346 1347 cmd->cmd_complete(cmd, *status); 1348 mgmt_pending_remove(cmd); 1349 1350 return; 1351 } 1352 1353 cmd_status_rsp(cmd, data); 1354 } 1355 1356 static int generic_cmd_complete(struct mgmt_pending_cmd *cmd, u8 status) 1357 { 1358 return mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, status, 1359 cmd->param, cmd->param_len); 1360 } 1361 1362 static int addr_cmd_complete(struct mgmt_pending_cmd *cmd, u8 status) 1363 { 1364 return mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, status, 1365 cmd->param, sizeof(struct mgmt_addr_info)); 1366 } 1367 1368 static u8 mgmt_bredr_support(struct hci_dev *hdev) 1369 { 1370 if (!lmp_bredr_capable(hdev)) 1371 return MGMT_STATUS_NOT_SUPPORTED; 1372 else if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) 1373 return MGMT_STATUS_REJECTED; 1374 else 1375 return MGMT_STATUS_SUCCESS; 1376 } 1377 1378 static u8 mgmt_le_support(struct hci_dev *hdev) 1379 { 1380 if (!lmp_le_capable(hdev)) 1381 return MGMT_STATUS_NOT_SUPPORTED; 1382 else if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED)) 1383 return MGMT_STATUS_REJECTED; 1384 else 1385 return MGMT_STATUS_SUCCESS; 1386 } 1387 1388 static void mgmt_set_discoverable_complete(struct hci_dev *hdev, void *data, 1389 int err) 1390 { 1391 struct mgmt_pending_cmd *cmd = data; 1392 1393 bt_dev_dbg(hdev, "err %d", err); 1394 1395 /* Make sure cmd still outstanding. */ 1396 if (cmd != pending_find(MGMT_OP_SET_DISCOVERABLE, hdev)) 1397 return; 1398 1399 hci_dev_lock(hdev); 1400 1401 if (err) { 1402 u8 mgmt_err = mgmt_status(err); 1403 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err); 1404 hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE); 1405 goto done; 1406 } 1407 1408 if (hci_dev_test_flag(hdev, HCI_DISCOVERABLE) && 1409 hdev->discov_timeout > 0) { 1410 int to = msecs_to_jiffies(hdev->discov_timeout * 1000); 1411 queue_delayed_work(hdev->req_workqueue, &hdev->discov_off, to); 1412 } 1413 1414 send_settings_rsp(cmd->sk, MGMT_OP_SET_DISCOVERABLE, hdev); 1415 new_settings(hdev, cmd->sk); 1416 1417 done: 1418 mgmt_pending_remove(cmd); 1419 hci_dev_unlock(hdev); 1420 } 1421 1422 static int set_discoverable_sync(struct hci_dev *hdev, void *data) 1423 { 1424 BT_DBG("%s", hdev->name); 1425 1426 return hci_update_discoverable_sync(hdev); 1427 } 1428 1429 static int set_discoverable(struct sock *sk, struct hci_dev *hdev, void *data, 1430 u16 len) 1431 { 1432 struct mgmt_cp_set_discoverable *cp = data; 1433 struct mgmt_pending_cmd *cmd; 1434 u16 timeout; 1435 int err; 1436 1437 bt_dev_dbg(hdev, "sock %p", sk); 1438 1439 if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED) && 1440 !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) 1441 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE, 1442 MGMT_STATUS_REJECTED); 1443 1444 if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02) 1445 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE, 1446 MGMT_STATUS_INVALID_PARAMS); 1447 1448 timeout = __le16_to_cpu(cp->timeout); 1449 1450 /* Disabling discoverable requires that no timeout is set, 1451 * and enabling limited discoverable requires a timeout. 1452 */ 1453 if ((cp->val == 0x00 && timeout > 0) || 1454 (cp->val == 0x02 && timeout == 0)) 1455 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE, 1456 MGMT_STATUS_INVALID_PARAMS); 1457 1458 hci_dev_lock(hdev); 1459 1460 if (!hdev_is_powered(hdev) && timeout > 0) { 1461 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE, 1462 MGMT_STATUS_NOT_POWERED); 1463 goto failed; 1464 } 1465 1466 if (pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) || 1467 pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) { 1468 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE, 1469 MGMT_STATUS_BUSY); 1470 goto failed; 1471 } 1472 1473 if (!hci_dev_test_flag(hdev, HCI_CONNECTABLE)) { 1474 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE, 1475 MGMT_STATUS_REJECTED); 1476 goto failed; 1477 } 1478 1479 if (hdev->advertising_paused) { 1480 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE, 1481 MGMT_STATUS_BUSY); 1482 goto failed; 1483 } 1484 1485 if (!hdev_is_powered(hdev)) { 1486 bool changed = false; 1487 1488 /* Setting limited discoverable when powered off is 1489 * not a valid operation since it requires a timeout 1490 * and so no need to check HCI_LIMITED_DISCOVERABLE. 1491 */ 1492 if (!!cp->val != hci_dev_test_flag(hdev, HCI_DISCOVERABLE)) { 1493 hci_dev_change_flag(hdev, HCI_DISCOVERABLE); 1494 changed = true; 1495 } 1496 1497 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev); 1498 if (err < 0) 1499 goto failed; 1500 1501 if (changed) 1502 err = new_settings(hdev, sk); 1503 1504 goto failed; 1505 } 1506 1507 /* If the current mode is the same, then just update the timeout 1508 * value with the new value. And if only the timeout gets updated, 1509 * then no need for any HCI transactions. 1510 */ 1511 if (!!cp->val == hci_dev_test_flag(hdev, HCI_DISCOVERABLE) && 1512 (cp->val == 0x02) == hci_dev_test_flag(hdev, 1513 HCI_LIMITED_DISCOVERABLE)) { 1514 cancel_delayed_work(&hdev->discov_off); 1515 hdev->discov_timeout = timeout; 1516 1517 if (cp->val && hdev->discov_timeout > 0) { 1518 int to = msecs_to_jiffies(hdev->discov_timeout * 1000); 1519 queue_delayed_work(hdev->req_workqueue, 1520 &hdev->discov_off, to); 1521 } 1522 1523 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev); 1524 goto failed; 1525 } 1526 1527 cmd = mgmt_pending_add(sk, MGMT_OP_SET_DISCOVERABLE, hdev, data, len); 1528 if (!cmd) { 1529 err = -ENOMEM; 1530 goto failed; 1531 } 1532 1533 /* Cancel any potential discoverable timeout that might be 1534 * still active and store new timeout value. The arming of 1535 * the timeout happens in the complete handler. 1536 */ 1537 cancel_delayed_work(&hdev->discov_off); 1538 hdev->discov_timeout = timeout; 1539 1540 if (cp->val) 1541 hci_dev_set_flag(hdev, HCI_DISCOVERABLE); 1542 else 1543 hci_dev_clear_flag(hdev, HCI_DISCOVERABLE); 1544 1545 /* Limited discoverable mode */ 1546 if (cp->val == 0x02) 1547 hci_dev_set_flag(hdev, HCI_LIMITED_DISCOVERABLE); 1548 else 1549 hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE); 1550 1551 err = hci_cmd_sync_queue(hdev, set_discoverable_sync, cmd, 1552 mgmt_set_discoverable_complete); 1553 1554 if (err < 0) 1555 mgmt_pending_remove(cmd); 1556 1557 failed: 1558 hci_dev_unlock(hdev); 1559 return err; 1560 } 1561 1562 static void mgmt_set_connectable_complete(struct hci_dev *hdev, void *data, 1563 int err) 1564 { 1565 struct mgmt_pending_cmd *cmd = data; 1566 1567 bt_dev_dbg(hdev, "err %d", err); 1568 1569 /* Make sure cmd still outstanding. */ 1570 if (cmd != pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) 1571 return; 1572 1573 hci_dev_lock(hdev); 1574 1575 if (err) { 1576 u8 mgmt_err = mgmt_status(err); 1577 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err); 1578 goto done; 1579 } 1580 1581 send_settings_rsp(cmd->sk, MGMT_OP_SET_CONNECTABLE, hdev); 1582 new_settings(hdev, cmd->sk); 1583 1584 done: 1585 if (cmd) 1586 mgmt_pending_remove(cmd); 1587 1588 hci_dev_unlock(hdev); 1589 } 1590 1591 static int set_connectable_update_settings(struct hci_dev *hdev, 1592 struct sock *sk, u8 val) 1593 { 1594 bool changed = false; 1595 int err; 1596 1597 if (!!val != hci_dev_test_flag(hdev, HCI_CONNECTABLE)) 1598 changed = true; 1599 1600 if (val) { 1601 hci_dev_set_flag(hdev, HCI_CONNECTABLE); 1602 } else { 1603 hci_dev_clear_flag(hdev, HCI_CONNECTABLE); 1604 hci_dev_clear_flag(hdev, HCI_DISCOVERABLE); 1605 } 1606 1607 err = send_settings_rsp(sk, MGMT_OP_SET_CONNECTABLE, hdev); 1608 if (err < 0) 1609 return err; 1610 1611 if (changed) { 1612 hci_req_update_scan(hdev); 1613 hci_update_passive_scan(hdev); 1614 return new_settings(hdev, sk); 1615 } 1616 1617 return 0; 1618 } 1619 1620 static int set_connectable_sync(struct hci_dev *hdev, void *data) 1621 { 1622 BT_DBG("%s", hdev->name); 1623 1624 return hci_update_connectable_sync(hdev); 1625 } 1626 1627 static int set_connectable(struct sock *sk, struct hci_dev *hdev, void *data, 1628 u16 len) 1629 { 1630 struct mgmt_mode *cp = data; 1631 struct mgmt_pending_cmd *cmd; 1632 int err; 1633 1634 bt_dev_dbg(hdev, "sock %p", sk); 1635 1636 if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED) && 1637 !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) 1638 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE, 1639 MGMT_STATUS_REJECTED); 1640 1641 if (cp->val != 0x00 && cp->val != 0x01) 1642 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE, 1643 MGMT_STATUS_INVALID_PARAMS); 1644 1645 hci_dev_lock(hdev); 1646 1647 if (!hdev_is_powered(hdev)) { 1648 err = set_connectable_update_settings(hdev, sk, cp->val); 1649 goto failed; 1650 } 1651 1652 if (pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) || 1653 pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) { 1654 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE, 1655 MGMT_STATUS_BUSY); 1656 goto failed; 1657 } 1658 1659 cmd = mgmt_pending_add(sk, MGMT_OP_SET_CONNECTABLE, hdev, data, len); 1660 if (!cmd) { 1661 err = -ENOMEM; 1662 goto failed; 1663 } 1664 1665 if (cp->val) { 1666 hci_dev_set_flag(hdev, HCI_CONNECTABLE); 1667 } else { 1668 if (hdev->discov_timeout > 0) 1669 cancel_delayed_work(&hdev->discov_off); 1670 1671 hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE); 1672 hci_dev_clear_flag(hdev, HCI_DISCOVERABLE); 1673 hci_dev_clear_flag(hdev, HCI_CONNECTABLE); 1674 } 1675 1676 err = hci_cmd_sync_queue(hdev, set_connectable_sync, cmd, 1677 mgmt_set_connectable_complete); 1678 1679 if (err < 0) 1680 mgmt_pending_remove(cmd); 1681 1682 failed: 1683 hci_dev_unlock(hdev); 1684 return err; 1685 } 1686 1687 static int set_bondable(struct sock *sk, struct hci_dev *hdev, void *data, 1688 u16 len) 1689 { 1690 struct mgmt_mode *cp = data; 1691 bool changed; 1692 int err; 1693 1694 bt_dev_dbg(hdev, "sock %p", sk); 1695 1696 if (cp->val != 0x00 && cp->val != 0x01) 1697 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BONDABLE, 1698 MGMT_STATUS_INVALID_PARAMS); 1699 1700 hci_dev_lock(hdev); 1701 1702 if (cp->val) 1703 changed = !hci_dev_test_and_set_flag(hdev, HCI_BONDABLE); 1704 else 1705 changed = hci_dev_test_and_clear_flag(hdev, HCI_BONDABLE); 1706 1707 err = send_settings_rsp(sk, MGMT_OP_SET_BONDABLE, hdev); 1708 if (err < 0) 1709 goto unlock; 1710 1711 if (changed) { 1712 /* In limited privacy mode the change of bondable mode 1713 * may affect the local advertising address. 1714 */ 1715 hci_update_discoverable(hdev); 1716 1717 err = new_settings(hdev, sk); 1718 } 1719 1720 unlock: 1721 hci_dev_unlock(hdev); 1722 return err; 1723 } 1724 1725 static int set_link_security(struct sock *sk, struct hci_dev *hdev, void *data, 1726 u16 len) 1727 { 1728 struct mgmt_mode *cp = data; 1729 struct mgmt_pending_cmd *cmd; 1730 u8 val, status; 1731 int err; 1732 1733 bt_dev_dbg(hdev, "sock %p", sk); 1734 1735 status = mgmt_bredr_support(hdev); 1736 if (status) 1737 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY, 1738 status); 1739 1740 if (cp->val != 0x00 && cp->val != 0x01) 1741 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY, 1742 MGMT_STATUS_INVALID_PARAMS); 1743 1744 hci_dev_lock(hdev); 1745 1746 if (!hdev_is_powered(hdev)) { 1747 bool changed = false; 1748 1749 if (!!cp->val != hci_dev_test_flag(hdev, HCI_LINK_SECURITY)) { 1750 hci_dev_change_flag(hdev, HCI_LINK_SECURITY); 1751 changed = true; 1752 } 1753 1754 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev); 1755 if (err < 0) 1756 goto failed; 1757 1758 if (changed) 1759 err = new_settings(hdev, sk); 1760 1761 goto failed; 1762 } 1763 1764 if (pending_find(MGMT_OP_SET_LINK_SECURITY, hdev)) { 1765 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY, 1766 MGMT_STATUS_BUSY); 1767 goto failed; 1768 } 1769 1770 val = !!cp->val; 1771 1772 if (test_bit(HCI_AUTH, &hdev->flags) == val) { 1773 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev); 1774 goto failed; 1775 } 1776 1777 cmd = mgmt_pending_add(sk, MGMT_OP_SET_LINK_SECURITY, hdev, data, len); 1778 if (!cmd) { 1779 err = -ENOMEM; 1780 goto failed; 1781 } 1782 1783 err = hci_send_cmd(hdev, HCI_OP_WRITE_AUTH_ENABLE, sizeof(val), &val); 1784 if (err < 0) { 1785 mgmt_pending_remove(cmd); 1786 goto failed; 1787 } 1788 1789 failed: 1790 hci_dev_unlock(hdev); 1791 return err; 1792 } 1793 1794 static void set_ssp_complete(struct hci_dev *hdev, void *data, int err) 1795 { 1796 struct cmd_lookup match = { NULL, hdev }; 1797 struct mgmt_pending_cmd *cmd = data; 1798 struct mgmt_mode *cp = cmd->param; 1799 u8 enable = cp->val; 1800 bool changed; 1801 1802 /* Make sure cmd still outstanding. */ 1803 if (cmd != pending_find(MGMT_OP_SET_SSP, hdev)) 1804 return; 1805 1806 if (err) { 1807 u8 mgmt_err = mgmt_status(err); 1808 1809 if (enable && hci_dev_test_and_clear_flag(hdev, 1810 HCI_SSP_ENABLED)) { 1811 hci_dev_clear_flag(hdev, HCI_HS_ENABLED); 1812 new_settings(hdev, NULL); 1813 } 1814 1815 mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev, cmd_status_rsp, 1816 &mgmt_err); 1817 return; 1818 } 1819 1820 if (enable) { 1821 changed = !hci_dev_test_and_set_flag(hdev, HCI_SSP_ENABLED); 1822 } else { 1823 changed = hci_dev_test_and_clear_flag(hdev, HCI_SSP_ENABLED); 1824 1825 if (!changed) 1826 changed = hci_dev_test_and_clear_flag(hdev, 1827 HCI_HS_ENABLED); 1828 else 1829 hci_dev_clear_flag(hdev, HCI_HS_ENABLED); 1830 } 1831 1832 mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev, settings_rsp, &match); 1833 1834 if (changed) 1835 new_settings(hdev, match.sk); 1836 1837 if (match.sk) 1838 sock_put(match.sk); 1839 1840 hci_update_eir_sync(hdev); 1841 } 1842 1843 static int set_ssp_sync(struct hci_dev *hdev, void *data) 1844 { 1845 struct mgmt_pending_cmd *cmd = data; 1846 struct mgmt_mode *cp = cmd->param; 1847 bool changed = false; 1848 int err; 1849 1850 if (cp->val) 1851 changed = !hci_dev_test_and_set_flag(hdev, HCI_SSP_ENABLED); 1852 1853 err = hci_write_ssp_mode_sync(hdev, cp->val); 1854 1855 if (!err && changed) 1856 hci_dev_clear_flag(hdev, HCI_SSP_ENABLED); 1857 1858 return err; 1859 } 1860 1861 static int set_ssp(struct sock *sk, struct hci_dev *hdev, void *data, u16 len) 1862 { 1863 struct mgmt_mode *cp = data; 1864 struct mgmt_pending_cmd *cmd; 1865 u8 status; 1866 int err; 1867 1868 bt_dev_dbg(hdev, "sock %p", sk); 1869 1870 status = mgmt_bredr_support(hdev); 1871 if (status) 1872 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP, status); 1873 1874 if (!lmp_ssp_capable(hdev)) 1875 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP, 1876 MGMT_STATUS_NOT_SUPPORTED); 1877 1878 if (cp->val != 0x00 && cp->val != 0x01) 1879 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP, 1880 MGMT_STATUS_INVALID_PARAMS); 1881 1882 hci_dev_lock(hdev); 1883 1884 if (!hdev_is_powered(hdev)) { 1885 bool changed; 1886 1887 if (cp->val) { 1888 changed = !hci_dev_test_and_set_flag(hdev, 1889 HCI_SSP_ENABLED); 1890 } else { 1891 changed = hci_dev_test_and_clear_flag(hdev, 1892 HCI_SSP_ENABLED); 1893 if (!changed) 1894 changed = hci_dev_test_and_clear_flag(hdev, 1895 HCI_HS_ENABLED); 1896 else 1897 hci_dev_clear_flag(hdev, HCI_HS_ENABLED); 1898 } 1899 1900 err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev); 1901 if (err < 0) 1902 goto failed; 1903 1904 if (changed) 1905 err = new_settings(hdev, sk); 1906 1907 goto failed; 1908 } 1909 1910 if (pending_find(MGMT_OP_SET_SSP, hdev)) { 1911 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP, 1912 MGMT_STATUS_BUSY); 1913 goto failed; 1914 } 1915 1916 if (!!cp->val == hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) { 1917 err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev); 1918 goto failed; 1919 } 1920 1921 cmd = mgmt_pending_add(sk, MGMT_OP_SET_SSP, hdev, data, len); 1922 if (!cmd) 1923 err = -ENOMEM; 1924 else 1925 err = hci_cmd_sync_queue(hdev, set_ssp_sync, cmd, 1926 set_ssp_complete); 1927 1928 if (err < 0) { 1929 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP, 1930 MGMT_STATUS_FAILED); 1931 1932 if (cmd) 1933 mgmt_pending_remove(cmd); 1934 } 1935 1936 failed: 1937 hci_dev_unlock(hdev); 1938 return err; 1939 } 1940 1941 static int set_hs(struct sock *sk, struct hci_dev *hdev, void *data, u16 len) 1942 { 1943 struct mgmt_mode *cp = data; 1944 bool changed; 1945 u8 status; 1946 int err; 1947 1948 bt_dev_dbg(hdev, "sock %p", sk); 1949 1950 if (!IS_ENABLED(CONFIG_BT_HS)) 1951 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS, 1952 MGMT_STATUS_NOT_SUPPORTED); 1953 1954 status = mgmt_bredr_support(hdev); 1955 if (status) 1956 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS, status); 1957 1958 if (!lmp_ssp_capable(hdev)) 1959 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS, 1960 MGMT_STATUS_NOT_SUPPORTED); 1961 1962 if (!hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) 1963 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS, 1964 MGMT_STATUS_REJECTED); 1965 1966 if (cp->val != 0x00 && cp->val != 0x01) 1967 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS, 1968 MGMT_STATUS_INVALID_PARAMS); 1969 1970 hci_dev_lock(hdev); 1971 1972 if (pending_find(MGMT_OP_SET_SSP, hdev)) { 1973 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS, 1974 MGMT_STATUS_BUSY); 1975 goto unlock; 1976 } 1977 1978 if (cp->val) { 1979 changed = !hci_dev_test_and_set_flag(hdev, HCI_HS_ENABLED); 1980 } else { 1981 if (hdev_is_powered(hdev)) { 1982 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS, 1983 MGMT_STATUS_REJECTED); 1984 goto unlock; 1985 } 1986 1987 changed = hci_dev_test_and_clear_flag(hdev, HCI_HS_ENABLED); 1988 } 1989 1990 err = send_settings_rsp(sk, MGMT_OP_SET_HS, hdev); 1991 if (err < 0) 1992 goto unlock; 1993 1994 if (changed) 1995 err = new_settings(hdev, sk); 1996 1997 unlock: 1998 hci_dev_unlock(hdev); 1999 return err; 2000 } 2001 2002 static void set_le_complete(struct hci_dev *hdev, void *data, int err) 2003 { 2004 struct cmd_lookup match = { NULL, hdev }; 2005 u8 status = mgmt_status(err); 2006 2007 bt_dev_dbg(hdev, "err %d", err); 2008 2009 if (status) { 2010 mgmt_pending_foreach(MGMT_OP_SET_LE, hdev, cmd_status_rsp, 2011 &status); 2012 return; 2013 } 2014 2015 mgmt_pending_foreach(MGMT_OP_SET_LE, hdev, settings_rsp, &match); 2016 2017 new_settings(hdev, match.sk); 2018 2019 if (match.sk) 2020 sock_put(match.sk); 2021 } 2022 2023 static int set_le_sync(struct hci_dev *hdev, void *data) 2024 { 2025 struct mgmt_pending_cmd *cmd = data; 2026 struct mgmt_mode *cp = cmd->param; 2027 u8 val = !!cp->val; 2028 int err; 2029 2030 if (!val) { 2031 if (hci_dev_test_flag(hdev, HCI_LE_ADV)) 2032 hci_disable_advertising_sync(hdev); 2033 2034 if (ext_adv_capable(hdev)) 2035 hci_remove_ext_adv_instance_sync(hdev, 0, cmd->sk); 2036 } else { 2037 hci_dev_set_flag(hdev, HCI_LE_ENABLED); 2038 } 2039 2040 err = hci_write_le_host_supported_sync(hdev, val, 0); 2041 2042 /* Make sure the controller has a good default for 2043 * advertising data. Restrict the update to when LE 2044 * has actually been enabled. During power on, the 2045 * update in powered_update_hci will take care of it. 2046 */ 2047 if (!err && hci_dev_test_flag(hdev, HCI_LE_ENABLED)) { 2048 if (ext_adv_capable(hdev)) { 2049 int status; 2050 2051 status = hci_setup_ext_adv_instance_sync(hdev, 0x00); 2052 if (!status) 2053 hci_update_scan_rsp_data_sync(hdev, 0x00); 2054 } else { 2055 hci_update_adv_data_sync(hdev, 0x00); 2056 hci_update_scan_rsp_data_sync(hdev, 0x00); 2057 } 2058 2059 hci_update_passive_scan(hdev); 2060 } 2061 2062 return err; 2063 } 2064 2065 static int set_le(struct sock *sk, struct hci_dev *hdev, void *data, u16 len) 2066 { 2067 struct mgmt_mode *cp = data; 2068 struct mgmt_pending_cmd *cmd; 2069 int err; 2070 u8 val, enabled; 2071 2072 bt_dev_dbg(hdev, "sock %p", sk); 2073 2074 if (!lmp_le_capable(hdev)) 2075 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE, 2076 MGMT_STATUS_NOT_SUPPORTED); 2077 2078 if (cp->val != 0x00 && cp->val != 0x01) 2079 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE, 2080 MGMT_STATUS_INVALID_PARAMS); 2081 2082 /* Bluetooth single mode LE only controllers or dual-mode 2083 * controllers configured as LE only devices, do not allow 2084 * switching LE off. These have either LE enabled explicitly 2085 * or BR/EDR has been previously switched off. 2086 * 2087 * When trying to enable an already enabled LE, then gracefully 2088 * send a positive response. Trying to disable it however will 2089 * result into rejection. 2090 */ 2091 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) { 2092 if (cp->val == 0x01) 2093 return send_settings_rsp(sk, MGMT_OP_SET_LE, hdev); 2094 2095 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE, 2096 MGMT_STATUS_REJECTED); 2097 } 2098 2099 hci_dev_lock(hdev); 2100 2101 val = !!cp->val; 2102 enabled = lmp_host_le_capable(hdev); 2103 2104 if (!val) 2105 hci_req_clear_adv_instance(hdev, NULL, NULL, 0x00, true); 2106 2107 if (!hdev_is_powered(hdev) || val == enabled) { 2108 bool changed = false; 2109 2110 if (val != hci_dev_test_flag(hdev, HCI_LE_ENABLED)) { 2111 hci_dev_change_flag(hdev, HCI_LE_ENABLED); 2112 changed = true; 2113 } 2114 2115 if (!val && hci_dev_test_flag(hdev, HCI_ADVERTISING)) { 2116 hci_dev_clear_flag(hdev, HCI_ADVERTISING); 2117 changed = true; 2118 } 2119 2120 err = send_settings_rsp(sk, MGMT_OP_SET_LE, hdev); 2121 if (err < 0) 2122 goto unlock; 2123 2124 if (changed) 2125 err = new_settings(hdev, sk); 2126 2127 goto unlock; 2128 } 2129 2130 if (pending_find(MGMT_OP_SET_LE, hdev) || 2131 pending_find(MGMT_OP_SET_ADVERTISING, hdev)) { 2132 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE, 2133 MGMT_STATUS_BUSY); 2134 goto unlock; 2135 } 2136 2137 cmd = mgmt_pending_add(sk, MGMT_OP_SET_LE, hdev, data, len); 2138 if (!cmd) 2139 err = -ENOMEM; 2140 else 2141 err = hci_cmd_sync_queue(hdev, set_le_sync, cmd, 2142 set_le_complete); 2143 2144 if (err < 0) { 2145 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE, 2146 MGMT_STATUS_FAILED); 2147 2148 if (cmd) 2149 mgmt_pending_remove(cmd); 2150 } 2151 2152 unlock: 2153 hci_dev_unlock(hdev); 2154 return err; 2155 } 2156 2157 /* This is a helper function to test for pending mgmt commands that can 2158 * cause CoD or EIR HCI commands. We can only allow one such pending 2159 * mgmt command at a time since otherwise we cannot easily track what 2160 * the current values are, will be, and based on that calculate if a new 2161 * HCI command needs to be sent and if yes with what value. 2162 */ 2163 static bool pending_eir_or_class(struct hci_dev *hdev) 2164 { 2165 struct mgmt_pending_cmd *cmd; 2166 2167 list_for_each_entry(cmd, &hdev->mgmt_pending, list) { 2168 switch (cmd->opcode) { 2169 case MGMT_OP_ADD_UUID: 2170 case MGMT_OP_REMOVE_UUID: 2171 case MGMT_OP_SET_DEV_CLASS: 2172 case MGMT_OP_SET_POWERED: 2173 return true; 2174 } 2175 } 2176 2177 return false; 2178 } 2179 2180 static const u8 bluetooth_base_uuid[] = { 2181 0xfb, 0x34, 0x9b, 0x5f, 0x80, 0x00, 0x00, 0x80, 2182 0x00, 0x10, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 2183 }; 2184 2185 static u8 get_uuid_size(const u8 *uuid) 2186 { 2187 u32 val; 2188 2189 if (memcmp(uuid, bluetooth_base_uuid, 12)) 2190 return 128; 2191 2192 val = get_unaligned_le32(&uuid[12]); 2193 if (val > 0xffff) 2194 return 32; 2195 2196 return 16; 2197 } 2198 2199 static void mgmt_class_complete(struct hci_dev *hdev, void *data, int err) 2200 { 2201 struct mgmt_pending_cmd *cmd = data; 2202 2203 bt_dev_dbg(hdev, "err %d", err); 2204 2205 mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, 2206 mgmt_status(err), hdev->dev_class, 3); 2207 2208 mgmt_pending_free(cmd); 2209 } 2210 2211 static int add_uuid_sync(struct hci_dev *hdev, void *data) 2212 { 2213 int err; 2214 2215 err = hci_update_class_sync(hdev); 2216 if (err) 2217 return err; 2218 2219 return hci_update_eir_sync(hdev); 2220 } 2221 2222 static int add_uuid(struct sock *sk, struct hci_dev *hdev, void *data, u16 len) 2223 { 2224 struct mgmt_cp_add_uuid *cp = data; 2225 struct mgmt_pending_cmd *cmd; 2226 struct bt_uuid *uuid; 2227 int err; 2228 2229 bt_dev_dbg(hdev, "sock %p", sk); 2230 2231 hci_dev_lock(hdev); 2232 2233 if (pending_eir_or_class(hdev)) { 2234 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_UUID, 2235 MGMT_STATUS_BUSY); 2236 goto failed; 2237 } 2238 2239 uuid = kmalloc(sizeof(*uuid), GFP_KERNEL); 2240 if (!uuid) { 2241 err = -ENOMEM; 2242 goto failed; 2243 } 2244 2245 memcpy(uuid->uuid, cp->uuid, 16); 2246 uuid->svc_hint = cp->svc_hint; 2247 uuid->size = get_uuid_size(cp->uuid); 2248 2249 list_add_tail(&uuid->list, &hdev->uuids); 2250 2251 cmd = mgmt_pending_new(sk, MGMT_OP_ADD_UUID, hdev, data, len); 2252 if (!cmd) { 2253 err = -ENOMEM; 2254 goto failed; 2255 } 2256 2257 err = hci_cmd_sync_queue(hdev, add_uuid_sync, cmd, mgmt_class_complete); 2258 if (err < 0) { 2259 mgmt_pending_free(cmd); 2260 goto failed; 2261 } 2262 2263 failed: 2264 hci_dev_unlock(hdev); 2265 return err; 2266 } 2267 2268 static bool enable_service_cache(struct hci_dev *hdev) 2269 { 2270 if (!hdev_is_powered(hdev)) 2271 return false; 2272 2273 if (!hci_dev_test_and_set_flag(hdev, HCI_SERVICE_CACHE)) { 2274 queue_delayed_work(hdev->workqueue, &hdev->service_cache, 2275 CACHE_TIMEOUT); 2276 return true; 2277 } 2278 2279 return false; 2280 } 2281 2282 static int remove_uuid_sync(struct hci_dev *hdev, void *data) 2283 { 2284 int err; 2285 2286 err = hci_update_class_sync(hdev); 2287 if (err) 2288 return err; 2289 2290 return hci_update_eir_sync(hdev); 2291 } 2292 2293 static int remove_uuid(struct sock *sk, struct hci_dev *hdev, void *data, 2294 u16 len) 2295 { 2296 struct mgmt_cp_remove_uuid *cp = data; 2297 struct mgmt_pending_cmd *cmd; 2298 struct bt_uuid *match, *tmp; 2299 u8 bt_uuid_any[] = { 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 }; 2300 int err, found; 2301 2302 bt_dev_dbg(hdev, "sock %p", sk); 2303 2304 hci_dev_lock(hdev); 2305 2306 if (pending_eir_or_class(hdev)) { 2307 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID, 2308 MGMT_STATUS_BUSY); 2309 goto unlock; 2310 } 2311 2312 if (memcmp(cp->uuid, bt_uuid_any, 16) == 0) { 2313 hci_uuids_clear(hdev); 2314 2315 if (enable_service_cache(hdev)) { 2316 err = mgmt_cmd_complete(sk, hdev->id, 2317 MGMT_OP_REMOVE_UUID, 2318 0, hdev->dev_class, 3); 2319 goto unlock; 2320 } 2321 2322 goto update_class; 2323 } 2324 2325 found = 0; 2326 2327 list_for_each_entry_safe(match, tmp, &hdev->uuids, list) { 2328 if (memcmp(match->uuid, cp->uuid, 16) != 0) 2329 continue; 2330 2331 list_del(&match->list); 2332 kfree(match); 2333 found++; 2334 } 2335 2336 if (found == 0) { 2337 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID, 2338 MGMT_STATUS_INVALID_PARAMS); 2339 goto unlock; 2340 } 2341 2342 update_class: 2343 cmd = mgmt_pending_new(sk, MGMT_OP_REMOVE_UUID, hdev, data, len); 2344 if (!cmd) { 2345 err = -ENOMEM; 2346 goto unlock; 2347 } 2348 2349 err = hci_cmd_sync_queue(hdev, remove_uuid_sync, cmd, 2350 mgmt_class_complete); 2351 if (err < 0) 2352 mgmt_pending_free(cmd); 2353 2354 unlock: 2355 hci_dev_unlock(hdev); 2356 return err; 2357 } 2358 2359 static int set_class_sync(struct hci_dev *hdev, void *data) 2360 { 2361 int err = 0; 2362 2363 if (hci_dev_test_and_clear_flag(hdev, HCI_SERVICE_CACHE)) { 2364 cancel_delayed_work_sync(&hdev->service_cache); 2365 err = hci_update_eir_sync(hdev); 2366 } 2367 2368 if (err) 2369 return err; 2370 2371 return hci_update_class_sync(hdev); 2372 } 2373 2374 static int set_dev_class(struct sock *sk, struct hci_dev *hdev, void *data, 2375 u16 len) 2376 { 2377 struct mgmt_cp_set_dev_class *cp = data; 2378 struct mgmt_pending_cmd *cmd; 2379 int err; 2380 2381 bt_dev_dbg(hdev, "sock %p", sk); 2382 2383 if (!lmp_bredr_capable(hdev)) 2384 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 2385 MGMT_STATUS_NOT_SUPPORTED); 2386 2387 hci_dev_lock(hdev); 2388 2389 if (pending_eir_or_class(hdev)) { 2390 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 2391 MGMT_STATUS_BUSY); 2392 goto unlock; 2393 } 2394 2395 if ((cp->minor & 0x03) != 0 || (cp->major & 0xe0) != 0) { 2396 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 2397 MGMT_STATUS_INVALID_PARAMS); 2398 goto unlock; 2399 } 2400 2401 hdev->major_class = cp->major; 2402 hdev->minor_class = cp->minor; 2403 2404 if (!hdev_is_powered(hdev)) { 2405 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 0, 2406 hdev->dev_class, 3); 2407 goto unlock; 2408 } 2409 2410 cmd = mgmt_pending_new(sk, MGMT_OP_SET_DEV_CLASS, hdev, data, len); 2411 if (!cmd) { 2412 err = -ENOMEM; 2413 goto unlock; 2414 } 2415 2416 err = hci_cmd_sync_queue(hdev, set_class_sync, cmd, 2417 mgmt_class_complete); 2418 if (err < 0) 2419 mgmt_pending_free(cmd); 2420 2421 unlock: 2422 hci_dev_unlock(hdev); 2423 return err; 2424 } 2425 2426 static int load_link_keys(struct sock *sk, struct hci_dev *hdev, void *data, 2427 u16 len) 2428 { 2429 struct mgmt_cp_load_link_keys *cp = data; 2430 const u16 max_key_count = ((U16_MAX - sizeof(*cp)) / 2431 sizeof(struct mgmt_link_key_info)); 2432 u16 key_count, expected_len; 2433 bool changed; 2434 int i; 2435 2436 bt_dev_dbg(hdev, "sock %p", sk); 2437 2438 if (!lmp_bredr_capable(hdev)) 2439 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS, 2440 MGMT_STATUS_NOT_SUPPORTED); 2441 2442 key_count = __le16_to_cpu(cp->key_count); 2443 if (key_count > max_key_count) { 2444 bt_dev_err(hdev, "load_link_keys: too big key_count value %u", 2445 key_count); 2446 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS, 2447 MGMT_STATUS_INVALID_PARAMS); 2448 } 2449 2450 expected_len = struct_size(cp, keys, key_count); 2451 if (expected_len != len) { 2452 bt_dev_err(hdev, "load_link_keys: expected %u bytes, got %u bytes", 2453 expected_len, len); 2454 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS, 2455 MGMT_STATUS_INVALID_PARAMS); 2456 } 2457 2458 if (cp->debug_keys != 0x00 && cp->debug_keys != 0x01) 2459 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS, 2460 MGMT_STATUS_INVALID_PARAMS); 2461 2462 bt_dev_dbg(hdev, "debug_keys %u key_count %u", cp->debug_keys, 2463 key_count); 2464 2465 for (i = 0; i < key_count; i++) { 2466 struct mgmt_link_key_info *key = &cp->keys[i]; 2467 2468 if (key->addr.type != BDADDR_BREDR || key->type > 0x08) 2469 return mgmt_cmd_status(sk, hdev->id, 2470 MGMT_OP_LOAD_LINK_KEYS, 2471 MGMT_STATUS_INVALID_PARAMS); 2472 } 2473 2474 hci_dev_lock(hdev); 2475 2476 hci_link_keys_clear(hdev); 2477 2478 if (cp->debug_keys) 2479 changed = !hci_dev_test_and_set_flag(hdev, HCI_KEEP_DEBUG_KEYS); 2480 else 2481 changed = hci_dev_test_and_clear_flag(hdev, 2482 HCI_KEEP_DEBUG_KEYS); 2483 2484 if (changed) 2485 new_settings(hdev, NULL); 2486 2487 for (i = 0; i < key_count; i++) { 2488 struct mgmt_link_key_info *key = &cp->keys[i]; 2489 2490 if (hci_is_blocked_key(hdev, 2491 HCI_BLOCKED_KEY_TYPE_LINKKEY, 2492 key->val)) { 2493 bt_dev_warn(hdev, "Skipping blocked link key for %pMR", 2494 &key->addr.bdaddr); 2495 continue; 2496 } 2497 2498 /* Always ignore debug keys and require a new pairing if 2499 * the user wants to use them. 2500 */ 2501 if (key->type == HCI_LK_DEBUG_COMBINATION) 2502 continue; 2503 2504 hci_add_link_key(hdev, NULL, &key->addr.bdaddr, key->val, 2505 key->type, key->pin_len, NULL); 2506 } 2507 2508 mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS, 0, NULL, 0); 2509 2510 hci_dev_unlock(hdev); 2511 2512 return 0; 2513 } 2514 2515 static int device_unpaired(struct hci_dev *hdev, bdaddr_t *bdaddr, 2516 u8 addr_type, struct sock *skip_sk) 2517 { 2518 struct mgmt_ev_device_unpaired ev; 2519 2520 bacpy(&ev.addr.bdaddr, bdaddr); 2521 ev.addr.type = addr_type; 2522 2523 return mgmt_event(MGMT_EV_DEVICE_UNPAIRED, hdev, &ev, sizeof(ev), 2524 skip_sk); 2525 } 2526 2527 static int unpair_device(struct sock *sk, struct hci_dev *hdev, void *data, 2528 u16 len) 2529 { 2530 struct mgmt_cp_unpair_device *cp = data; 2531 struct mgmt_rp_unpair_device rp; 2532 struct hci_conn_params *params; 2533 struct mgmt_pending_cmd *cmd; 2534 struct hci_conn *conn; 2535 u8 addr_type; 2536 int err; 2537 2538 memset(&rp, 0, sizeof(rp)); 2539 bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr); 2540 rp.addr.type = cp->addr.type; 2541 2542 if (!bdaddr_type_is_valid(cp->addr.type)) 2543 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE, 2544 MGMT_STATUS_INVALID_PARAMS, 2545 &rp, sizeof(rp)); 2546 2547 if (cp->disconnect != 0x00 && cp->disconnect != 0x01) 2548 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE, 2549 MGMT_STATUS_INVALID_PARAMS, 2550 &rp, sizeof(rp)); 2551 2552 hci_dev_lock(hdev); 2553 2554 if (!hdev_is_powered(hdev)) { 2555 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE, 2556 MGMT_STATUS_NOT_POWERED, &rp, 2557 sizeof(rp)); 2558 goto unlock; 2559 } 2560 2561 if (cp->addr.type == BDADDR_BREDR) { 2562 /* If disconnection is requested, then look up the 2563 * connection. If the remote device is connected, it 2564 * will be later used to terminate the link. 2565 * 2566 * Setting it to NULL explicitly will cause no 2567 * termination of the link. 2568 */ 2569 if (cp->disconnect) 2570 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, 2571 &cp->addr.bdaddr); 2572 else 2573 conn = NULL; 2574 2575 err = hci_remove_link_key(hdev, &cp->addr.bdaddr); 2576 if (err < 0) { 2577 err = mgmt_cmd_complete(sk, hdev->id, 2578 MGMT_OP_UNPAIR_DEVICE, 2579 MGMT_STATUS_NOT_PAIRED, &rp, 2580 sizeof(rp)); 2581 goto unlock; 2582 } 2583 2584 goto done; 2585 } 2586 2587 /* LE address type */ 2588 addr_type = le_addr_type(cp->addr.type); 2589 2590 /* Abort any ongoing SMP pairing. Removes ltk and irk if they exist. */ 2591 err = smp_cancel_and_remove_pairing(hdev, &cp->addr.bdaddr, addr_type); 2592 if (err < 0) { 2593 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE, 2594 MGMT_STATUS_NOT_PAIRED, &rp, 2595 sizeof(rp)); 2596 goto unlock; 2597 } 2598 2599 conn = hci_conn_hash_lookup_le(hdev, &cp->addr.bdaddr, addr_type); 2600 if (!conn) { 2601 hci_conn_params_del(hdev, &cp->addr.bdaddr, addr_type); 2602 goto done; 2603 } 2604 2605 2606 /* Defer clearing up the connection parameters until closing to 2607 * give a chance of keeping them if a repairing happens. 2608 */ 2609 set_bit(HCI_CONN_PARAM_REMOVAL_PEND, &conn->flags); 2610 2611 /* Disable auto-connection parameters if present */ 2612 params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr, addr_type); 2613 if (params) { 2614 if (params->explicit_connect) 2615 params->auto_connect = HCI_AUTO_CONN_EXPLICIT; 2616 else 2617 params->auto_connect = HCI_AUTO_CONN_DISABLED; 2618 } 2619 2620 /* If disconnection is not requested, then clear the connection 2621 * variable so that the link is not terminated. 2622 */ 2623 if (!cp->disconnect) 2624 conn = NULL; 2625 2626 done: 2627 /* If the connection variable is set, then termination of the 2628 * link is requested. 2629 */ 2630 if (!conn) { 2631 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE, 0, 2632 &rp, sizeof(rp)); 2633 device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, sk); 2634 goto unlock; 2635 } 2636 2637 cmd = mgmt_pending_add(sk, MGMT_OP_UNPAIR_DEVICE, hdev, cp, 2638 sizeof(*cp)); 2639 if (!cmd) { 2640 err = -ENOMEM; 2641 goto unlock; 2642 } 2643 2644 cmd->cmd_complete = addr_cmd_complete; 2645 2646 err = hci_abort_conn(conn, HCI_ERROR_REMOTE_USER_TERM); 2647 if (err < 0) 2648 mgmt_pending_remove(cmd); 2649 2650 unlock: 2651 hci_dev_unlock(hdev); 2652 return err; 2653 } 2654 2655 static int disconnect(struct sock *sk, struct hci_dev *hdev, void *data, 2656 u16 len) 2657 { 2658 struct mgmt_cp_disconnect *cp = data; 2659 struct mgmt_rp_disconnect rp; 2660 struct mgmt_pending_cmd *cmd; 2661 struct hci_conn *conn; 2662 int err; 2663 2664 bt_dev_dbg(hdev, "sock %p", sk); 2665 2666 memset(&rp, 0, sizeof(rp)); 2667 bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr); 2668 rp.addr.type = cp->addr.type; 2669 2670 if (!bdaddr_type_is_valid(cp->addr.type)) 2671 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT, 2672 MGMT_STATUS_INVALID_PARAMS, 2673 &rp, sizeof(rp)); 2674 2675 hci_dev_lock(hdev); 2676 2677 if (!test_bit(HCI_UP, &hdev->flags)) { 2678 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT, 2679 MGMT_STATUS_NOT_POWERED, &rp, 2680 sizeof(rp)); 2681 goto failed; 2682 } 2683 2684 if (pending_find(MGMT_OP_DISCONNECT, hdev)) { 2685 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT, 2686 MGMT_STATUS_BUSY, &rp, sizeof(rp)); 2687 goto failed; 2688 } 2689 2690 if (cp->addr.type == BDADDR_BREDR) 2691 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, 2692 &cp->addr.bdaddr); 2693 else 2694 conn = hci_conn_hash_lookup_le(hdev, &cp->addr.bdaddr, 2695 le_addr_type(cp->addr.type)); 2696 2697 if (!conn || conn->state == BT_OPEN || conn->state == BT_CLOSED) { 2698 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT, 2699 MGMT_STATUS_NOT_CONNECTED, &rp, 2700 sizeof(rp)); 2701 goto failed; 2702 } 2703 2704 cmd = mgmt_pending_add(sk, MGMT_OP_DISCONNECT, hdev, data, len); 2705 if (!cmd) { 2706 err = -ENOMEM; 2707 goto failed; 2708 } 2709 2710 cmd->cmd_complete = generic_cmd_complete; 2711 2712 err = hci_disconnect(conn, HCI_ERROR_REMOTE_USER_TERM); 2713 if (err < 0) 2714 mgmt_pending_remove(cmd); 2715 2716 failed: 2717 hci_dev_unlock(hdev); 2718 return err; 2719 } 2720 2721 static u8 link_to_bdaddr(u8 link_type, u8 addr_type) 2722 { 2723 switch (link_type) { 2724 case LE_LINK: 2725 switch (addr_type) { 2726 case ADDR_LE_DEV_PUBLIC: 2727 return BDADDR_LE_PUBLIC; 2728 2729 default: 2730 /* Fallback to LE Random address type */ 2731 return BDADDR_LE_RANDOM; 2732 } 2733 2734 default: 2735 /* Fallback to BR/EDR type */ 2736 return BDADDR_BREDR; 2737 } 2738 } 2739 2740 static int get_connections(struct sock *sk, struct hci_dev *hdev, void *data, 2741 u16 data_len) 2742 { 2743 struct mgmt_rp_get_connections *rp; 2744 struct hci_conn *c; 2745 int err; 2746 u16 i; 2747 2748 bt_dev_dbg(hdev, "sock %p", sk); 2749 2750 hci_dev_lock(hdev); 2751 2752 if (!hdev_is_powered(hdev)) { 2753 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_CONNECTIONS, 2754 MGMT_STATUS_NOT_POWERED); 2755 goto unlock; 2756 } 2757 2758 i = 0; 2759 list_for_each_entry(c, &hdev->conn_hash.list, list) { 2760 if (test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags)) 2761 i++; 2762 } 2763 2764 rp = kmalloc(struct_size(rp, addr, i), GFP_KERNEL); 2765 if (!rp) { 2766 err = -ENOMEM; 2767 goto unlock; 2768 } 2769 2770 i = 0; 2771 list_for_each_entry(c, &hdev->conn_hash.list, list) { 2772 if (!test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags)) 2773 continue; 2774 bacpy(&rp->addr[i].bdaddr, &c->dst); 2775 rp->addr[i].type = link_to_bdaddr(c->type, c->dst_type); 2776 if (c->type == SCO_LINK || c->type == ESCO_LINK) 2777 continue; 2778 i++; 2779 } 2780 2781 rp->conn_count = cpu_to_le16(i); 2782 2783 /* Recalculate length in case of filtered SCO connections, etc */ 2784 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONNECTIONS, 0, rp, 2785 struct_size(rp, addr, i)); 2786 2787 kfree(rp); 2788 2789 unlock: 2790 hci_dev_unlock(hdev); 2791 return err; 2792 } 2793 2794 static int send_pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev, 2795 struct mgmt_cp_pin_code_neg_reply *cp) 2796 { 2797 struct mgmt_pending_cmd *cmd; 2798 int err; 2799 2800 cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_NEG_REPLY, hdev, cp, 2801 sizeof(*cp)); 2802 if (!cmd) 2803 return -ENOMEM; 2804 2805 cmd->cmd_complete = addr_cmd_complete; 2806 2807 err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_NEG_REPLY, 2808 sizeof(cp->addr.bdaddr), &cp->addr.bdaddr); 2809 if (err < 0) 2810 mgmt_pending_remove(cmd); 2811 2812 return err; 2813 } 2814 2815 static int pin_code_reply(struct sock *sk, struct hci_dev *hdev, void *data, 2816 u16 len) 2817 { 2818 struct hci_conn *conn; 2819 struct mgmt_cp_pin_code_reply *cp = data; 2820 struct hci_cp_pin_code_reply reply; 2821 struct mgmt_pending_cmd *cmd; 2822 int err; 2823 2824 bt_dev_dbg(hdev, "sock %p", sk); 2825 2826 hci_dev_lock(hdev); 2827 2828 if (!hdev_is_powered(hdev)) { 2829 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY, 2830 MGMT_STATUS_NOT_POWERED); 2831 goto failed; 2832 } 2833 2834 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->addr.bdaddr); 2835 if (!conn) { 2836 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY, 2837 MGMT_STATUS_NOT_CONNECTED); 2838 goto failed; 2839 } 2840 2841 if (conn->pending_sec_level == BT_SECURITY_HIGH && cp->pin_len != 16) { 2842 struct mgmt_cp_pin_code_neg_reply ncp; 2843 2844 memcpy(&ncp.addr, &cp->addr, sizeof(ncp.addr)); 2845 2846 bt_dev_err(hdev, "PIN code is not 16 bytes long"); 2847 2848 err = send_pin_code_neg_reply(sk, hdev, &ncp); 2849 if (err >= 0) 2850 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY, 2851 MGMT_STATUS_INVALID_PARAMS); 2852 2853 goto failed; 2854 } 2855 2856 cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_REPLY, hdev, data, len); 2857 if (!cmd) { 2858 err = -ENOMEM; 2859 goto failed; 2860 } 2861 2862 cmd->cmd_complete = addr_cmd_complete; 2863 2864 bacpy(&reply.bdaddr, &cp->addr.bdaddr); 2865 reply.pin_len = cp->pin_len; 2866 memcpy(reply.pin_code, cp->pin_code, sizeof(reply.pin_code)); 2867 2868 err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_REPLY, sizeof(reply), &reply); 2869 if (err < 0) 2870 mgmt_pending_remove(cmd); 2871 2872 failed: 2873 hci_dev_unlock(hdev); 2874 return err; 2875 } 2876 2877 static int set_io_capability(struct sock *sk, struct hci_dev *hdev, void *data, 2878 u16 len) 2879 { 2880 struct mgmt_cp_set_io_capability *cp = data; 2881 2882 bt_dev_dbg(hdev, "sock %p", sk); 2883 2884 if (cp->io_capability > SMP_IO_KEYBOARD_DISPLAY) 2885 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_IO_CAPABILITY, 2886 MGMT_STATUS_INVALID_PARAMS); 2887 2888 hci_dev_lock(hdev); 2889 2890 hdev->io_capability = cp->io_capability; 2891 2892 bt_dev_dbg(hdev, "IO capability set to 0x%02x", hdev->io_capability); 2893 2894 hci_dev_unlock(hdev); 2895 2896 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_IO_CAPABILITY, 0, 2897 NULL, 0); 2898 } 2899 2900 static struct mgmt_pending_cmd *find_pairing(struct hci_conn *conn) 2901 { 2902 struct hci_dev *hdev = conn->hdev; 2903 struct mgmt_pending_cmd *cmd; 2904 2905 list_for_each_entry(cmd, &hdev->mgmt_pending, list) { 2906 if (cmd->opcode != MGMT_OP_PAIR_DEVICE) 2907 continue; 2908 2909 if (cmd->user_data != conn) 2910 continue; 2911 2912 return cmd; 2913 } 2914 2915 return NULL; 2916 } 2917 2918 static int pairing_complete(struct mgmt_pending_cmd *cmd, u8 status) 2919 { 2920 struct mgmt_rp_pair_device rp; 2921 struct hci_conn *conn = cmd->user_data; 2922 int err; 2923 2924 bacpy(&rp.addr.bdaddr, &conn->dst); 2925 rp.addr.type = link_to_bdaddr(conn->type, conn->dst_type); 2926 2927 err = mgmt_cmd_complete(cmd->sk, cmd->index, MGMT_OP_PAIR_DEVICE, 2928 status, &rp, sizeof(rp)); 2929 2930 /* So we don't get further callbacks for this connection */ 2931 conn->connect_cfm_cb = NULL; 2932 conn->security_cfm_cb = NULL; 2933 conn->disconn_cfm_cb = NULL; 2934 2935 hci_conn_drop(conn); 2936 2937 /* The device is paired so there is no need to remove 2938 * its connection parameters anymore. 2939 */ 2940 clear_bit(HCI_CONN_PARAM_REMOVAL_PEND, &conn->flags); 2941 2942 hci_conn_put(conn); 2943 2944 return err; 2945 } 2946 2947 void mgmt_smp_complete(struct hci_conn *conn, bool complete) 2948 { 2949 u8 status = complete ? MGMT_STATUS_SUCCESS : MGMT_STATUS_FAILED; 2950 struct mgmt_pending_cmd *cmd; 2951 2952 cmd = find_pairing(conn); 2953 if (cmd) { 2954 cmd->cmd_complete(cmd, status); 2955 mgmt_pending_remove(cmd); 2956 } 2957 } 2958 2959 static void pairing_complete_cb(struct hci_conn *conn, u8 status) 2960 { 2961 struct mgmt_pending_cmd *cmd; 2962 2963 BT_DBG("status %u", status); 2964 2965 cmd = find_pairing(conn); 2966 if (!cmd) { 2967 BT_DBG("Unable to find a pending command"); 2968 return; 2969 } 2970 2971 cmd->cmd_complete(cmd, mgmt_status(status)); 2972 mgmt_pending_remove(cmd); 2973 } 2974 2975 static void le_pairing_complete_cb(struct hci_conn *conn, u8 status) 2976 { 2977 struct mgmt_pending_cmd *cmd; 2978 2979 BT_DBG("status %u", status); 2980 2981 if (!status) 2982 return; 2983 2984 cmd = find_pairing(conn); 2985 if (!cmd) { 2986 BT_DBG("Unable to find a pending command"); 2987 return; 2988 } 2989 2990 cmd->cmd_complete(cmd, mgmt_status(status)); 2991 mgmt_pending_remove(cmd); 2992 } 2993 2994 static int pair_device(struct sock *sk, struct hci_dev *hdev, void *data, 2995 u16 len) 2996 { 2997 struct mgmt_cp_pair_device *cp = data; 2998 struct mgmt_rp_pair_device rp; 2999 struct mgmt_pending_cmd *cmd; 3000 u8 sec_level, auth_type; 3001 struct hci_conn *conn; 3002 int err; 3003 3004 bt_dev_dbg(hdev, "sock %p", sk); 3005 3006 memset(&rp, 0, sizeof(rp)); 3007 bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr); 3008 rp.addr.type = cp->addr.type; 3009 3010 if (!bdaddr_type_is_valid(cp->addr.type)) 3011 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE, 3012 MGMT_STATUS_INVALID_PARAMS, 3013 &rp, sizeof(rp)); 3014 3015 if (cp->io_cap > SMP_IO_KEYBOARD_DISPLAY) 3016 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE, 3017 MGMT_STATUS_INVALID_PARAMS, 3018 &rp, sizeof(rp)); 3019 3020 hci_dev_lock(hdev); 3021 3022 if (!hdev_is_powered(hdev)) { 3023 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE, 3024 MGMT_STATUS_NOT_POWERED, &rp, 3025 sizeof(rp)); 3026 goto unlock; 3027 } 3028 3029 if (hci_bdaddr_is_paired(hdev, &cp->addr.bdaddr, cp->addr.type)) { 3030 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE, 3031 MGMT_STATUS_ALREADY_PAIRED, &rp, 3032 sizeof(rp)); 3033 goto unlock; 3034 } 3035 3036 sec_level = BT_SECURITY_MEDIUM; 3037 auth_type = HCI_AT_DEDICATED_BONDING; 3038 3039 if (cp->addr.type == BDADDR_BREDR) { 3040 conn = hci_connect_acl(hdev, &cp->addr.bdaddr, sec_level, 3041 auth_type, CONN_REASON_PAIR_DEVICE); 3042 } else { 3043 u8 addr_type = le_addr_type(cp->addr.type); 3044 struct hci_conn_params *p; 3045 3046 /* When pairing a new device, it is expected to remember 3047 * this device for future connections. Adding the connection 3048 * parameter information ahead of time allows tracking 3049 * of the peripheral preferred values and will speed up any 3050 * further connection establishment. 3051 * 3052 * If connection parameters already exist, then they 3053 * will be kept and this function does nothing. 3054 */ 3055 p = hci_conn_params_add(hdev, &cp->addr.bdaddr, addr_type); 3056 3057 if (p->auto_connect == HCI_AUTO_CONN_EXPLICIT) 3058 p->auto_connect = HCI_AUTO_CONN_DISABLED; 3059 3060 conn = hci_connect_le_scan(hdev, &cp->addr.bdaddr, addr_type, 3061 sec_level, HCI_LE_CONN_TIMEOUT, 3062 CONN_REASON_PAIR_DEVICE); 3063 } 3064 3065 if (IS_ERR(conn)) { 3066 int status; 3067 3068 if (PTR_ERR(conn) == -EBUSY) 3069 status = MGMT_STATUS_BUSY; 3070 else if (PTR_ERR(conn) == -EOPNOTSUPP) 3071 status = MGMT_STATUS_NOT_SUPPORTED; 3072 else if (PTR_ERR(conn) == -ECONNREFUSED) 3073 status = MGMT_STATUS_REJECTED; 3074 else 3075 status = MGMT_STATUS_CONNECT_FAILED; 3076 3077 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE, 3078 status, &rp, sizeof(rp)); 3079 goto unlock; 3080 } 3081 3082 if (conn->connect_cfm_cb) { 3083 hci_conn_drop(conn); 3084 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE, 3085 MGMT_STATUS_BUSY, &rp, sizeof(rp)); 3086 goto unlock; 3087 } 3088 3089 cmd = mgmt_pending_add(sk, MGMT_OP_PAIR_DEVICE, hdev, data, len); 3090 if (!cmd) { 3091 err = -ENOMEM; 3092 hci_conn_drop(conn); 3093 goto unlock; 3094 } 3095 3096 cmd->cmd_complete = pairing_complete; 3097 3098 /* For LE, just connecting isn't a proof that the pairing finished */ 3099 if (cp->addr.type == BDADDR_BREDR) { 3100 conn->connect_cfm_cb = pairing_complete_cb; 3101 conn->security_cfm_cb = pairing_complete_cb; 3102 conn->disconn_cfm_cb = pairing_complete_cb; 3103 } else { 3104 conn->connect_cfm_cb = le_pairing_complete_cb; 3105 conn->security_cfm_cb = le_pairing_complete_cb; 3106 conn->disconn_cfm_cb = le_pairing_complete_cb; 3107 } 3108 3109 conn->io_capability = cp->io_cap; 3110 cmd->user_data = hci_conn_get(conn); 3111 3112 if ((conn->state == BT_CONNECTED || conn->state == BT_CONFIG) && 3113 hci_conn_security(conn, sec_level, auth_type, true)) { 3114 cmd->cmd_complete(cmd, 0); 3115 mgmt_pending_remove(cmd); 3116 } 3117 3118 err = 0; 3119 3120 unlock: 3121 hci_dev_unlock(hdev); 3122 return err; 3123 } 3124 3125 static int cancel_pair_device(struct sock *sk, struct hci_dev *hdev, void *data, 3126 u16 len) 3127 { 3128 struct mgmt_addr_info *addr = data; 3129 struct mgmt_pending_cmd *cmd; 3130 struct hci_conn *conn; 3131 int err; 3132 3133 bt_dev_dbg(hdev, "sock %p", sk); 3134 3135 hci_dev_lock(hdev); 3136 3137 if (!hdev_is_powered(hdev)) { 3138 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE, 3139 MGMT_STATUS_NOT_POWERED); 3140 goto unlock; 3141 } 3142 3143 cmd = pending_find(MGMT_OP_PAIR_DEVICE, hdev); 3144 if (!cmd) { 3145 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE, 3146 MGMT_STATUS_INVALID_PARAMS); 3147 goto unlock; 3148 } 3149 3150 conn = cmd->user_data; 3151 3152 if (bacmp(&addr->bdaddr, &conn->dst) != 0) { 3153 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE, 3154 MGMT_STATUS_INVALID_PARAMS); 3155 goto unlock; 3156 } 3157 3158 cmd->cmd_complete(cmd, MGMT_STATUS_CANCELLED); 3159 mgmt_pending_remove(cmd); 3160 3161 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE, 0, 3162 addr, sizeof(*addr)); 3163 3164 /* Since user doesn't want to proceed with the connection, abort any 3165 * ongoing pairing and then terminate the link if it was created 3166 * because of the pair device action. 3167 */ 3168 if (addr->type == BDADDR_BREDR) 3169 hci_remove_link_key(hdev, &addr->bdaddr); 3170 else 3171 smp_cancel_and_remove_pairing(hdev, &addr->bdaddr, 3172 le_addr_type(addr->type)); 3173 3174 if (conn->conn_reason == CONN_REASON_PAIR_DEVICE) 3175 hci_abort_conn(conn, HCI_ERROR_REMOTE_USER_TERM); 3176 3177 unlock: 3178 hci_dev_unlock(hdev); 3179 return err; 3180 } 3181 3182 static int user_pairing_resp(struct sock *sk, struct hci_dev *hdev, 3183 struct mgmt_addr_info *addr, u16 mgmt_op, 3184 u16 hci_op, __le32 passkey) 3185 { 3186 struct mgmt_pending_cmd *cmd; 3187 struct hci_conn *conn; 3188 int err; 3189 3190 hci_dev_lock(hdev); 3191 3192 if (!hdev_is_powered(hdev)) { 3193 err = mgmt_cmd_complete(sk, hdev->id, mgmt_op, 3194 MGMT_STATUS_NOT_POWERED, addr, 3195 sizeof(*addr)); 3196 goto done; 3197 } 3198 3199 if (addr->type == BDADDR_BREDR) 3200 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &addr->bdaddr); 3201 else 3202 conn = hci_conn_hash_lookup_le(hdev, &addr->bdaddr, 3203 le_addr_type(addr->type)); 3204 3205 if (!conn) { 3206 err = mgmt_cmd_complete(sk, hdev->id, mgmt_op, 3207 MGMT_STATUS_NOT_CONNECTED, addr, 3208 sizeof(*addr)); 3209 goto done; 3210 } 3211 3212 if (addr->type == BDADDR_LE_PUBLIC || addr->type == BDADDR_LE_RANDOM) { 3213 err = smp_user_confirm_reply(conn, mgmt_op, passkey); 3214 if (!err) 3215 err = mgmt_cmd_complete(sk, hdev->id, mgmt_op, 3216 MGMT_STATUS_SUCCESS, addr, 3217 sizeof(*addr)); 3218 else 3219 err = mgmt_cmd_complete(sk, hdev->id, mgmt_op, 3220 MGMT_STATUS_FAILED, addr, 3221 sizeof(*addr)); 3222 3223 goto done; 3224 } 3225 3226 cmd = mgmt_pending_add(sk, mgmt_op, hdev, addr, sizeof(*addr)); 3227 if (!cmd) { 3228 err = -ENOMEM; 3229 goto done; 3230 } 3231 3232 cmd->cmd_complete = addr_cmd_complete; 3233 3234 /* Continue with pairing via HCI */ 3235 if (hci_op == HCI_OP_USER_PASSKEY_REPLY) { 3236 struct hci_cp_user_passkey_reply cp; 3237 3238 bacpy(&cp.bdaddr, &addr->bdaddr); 3239 cp.passkey = passkey; 3240 err = hci_send_cmd(hdev, hci_op, sizeof(cp), &cp); 3241 } else 3242 err = hci_send_cmd(hdev, hci_op, sizeof(addr->bdaddr), 3243 &addr->bdaddr); 3244 3245 if (err < 0) 3246 mgmt_pending_remove(cmd); 3247 3248 done: 3249 hci_dev_unlock(hdev); 3250 return err; 3251 } 3252 3253 static int pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev, 3254 void *data, u16 len) 3255 { 3256 struct mgmt_cp_pin_code_neg_reply *cp = data; 3257 3258 bt_dev_dbg(hdev, "sock %p", sk); 3259 3260 return user_pairing_resp(sk, hdev, &cp->addr, 3261 MGMT_OP_PIN_CODE_NEG_REPLY, 3262 HCI_OP_PIN_CODE_NEG_REPLY, 0); 3263 } 3264 3265 static int user_confirm_reply(struct sock *sk, struct hci_dev *hdev, void *data, 3266 u16 len) 3267 { 3268 struct mgmt_cp_user_confirm_reply *cp = data; 3269 3270 bt_dev_dbg(hdev, "sock %p", sk); 3271 3272 if (len != sizeof(*cp)) 3273 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_USER_CONFIRM_REPLY, 3274 MGMT_STATUS_INVALID_PARAMS); 3275 3276 return user_pairing_resp(sk, hdev, &cp->addr, 3277 MGMT_OP_USER_CONFIRM_REPLY, 3278 HCI_OP_USER_CONFIRM_REPLY, 0); 3279 } 3280 3281 static int user_confirm_neg_reply(struct sock *sk, struct hci_dev *hdev, 3282 void *data, u16 len) 3283 { 3284 struct mgmt_cp_user_confirm_neg_reply *cp = data; 3285 3286 bt_dev_dbg(hdev, "sock %p", sk); 3287 3288 return user_pairing_resp(sk, hdev, &cp->addr, 3289 MGMT_OP_USER_CONFIRM_NEG_REPLY, 3290 HCI_OP_USER_CONFIRM_NEG_REPLY, 0); 3291 } 3292 3293 static int user_passkey_reply(struct sock *sk, struct hci_dev *hdev, void *data, 3294 u16 len) 3295 { 3296 struct mgmt_cp_user_passkey_reply *cp = data; 3297 3298 bt_dev_dbg(hdev, "sock %p", sk); 3299 3300 return user_pairing_resp(sk, hdev, &cp->addr, 3301 MGMT_OP_USER_PASSKEY_REPLY, 3302 HCI_OP_USER_PASSKEY_REPLY, cp->passkey); 3303 } 3304 3305 static int user_passkey_neg_reply(struct sock *sk, struct hci_dev *hdev, 3306 void *data, u16 len) 3307 { 3308 struct mgmt_cp_user_passkey_neg_reply *cp = data; 3309 3310 bt_dev_dbg(hdev, "sock %p", sk); 3311 3312 return user_pairing_resp(sk, hdev, &cp->addr, 3313 MGMT_OP_USER_PASSKEY_NEG_REPLY, 3314 HCI_OP_USER_PASSKEY_NEG_REPLY, 0); 3315 } 3316 3317 static int adv_expire_sync(struct hci_dev *hdev, u32 flags) 3318 { 3319 struct adv_info *adv_instance; 3320 3321 adv_instance = hci_find_adv_instance(hdev, hdev->cur_adv_instance); 3322 if (!adv_instance) 3323 return 0; 3324 3325 /* stop if current instance doesn't need to be changed */ 3326 if (!(adv_instance->flags & flags)) 3327 return 0; 3328 3329 cancel_adv_timeout(hdev); 3330 3331 adv_instance = hci_get_next_instance(hdev, adv_instance->instance); 3332 if (!adv_instance) 3333 return 0; 3334 3335 hci_schedule_adv_instance_sync(hdev, adv_instance->instance, true); 3336 3337 return 0; 3338 } 3339 3340 static int name_changed_sync(struct hci_dev *hdev, void *data) 3341 { 3342 return adv_expire_sync(hdev, MGMT_ADV_FLAG_LOCAL_NAME); 3343 } 3344 3345 static void set_name_complete(struct hci_dev *hdev, void *data, int err) 3346 { 3347 struct mgmt_pending_cmd *cmd = data; 3348 struct mgmt_cp_set_local_name *cp = cmd->param; 3349 u8 status = mgmt_status(err); 3350 3351 bt_dev_dbg(hdev, "err %d", err); 3352 3353 if (cmd != pending_find(MGMT_OP_SET_LOCAL_NAME, hdev)) 3354 return; 3355 3356 if (status) { 3357 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 3358 status); 3359 } else { 3360 mgmt_cmd_complete(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0, 3361 cp, sizeof(*cp)); 3362 3363 if (hci_dev_test_flag(hdev, HCI_LE_ADV)) 3364 hci_cmd_sync_queue(hdev, name_changed_sync, NULL, NULL); 3365 } 3366 3367 mgmt_pending_remove(cmd); 3368 } 3369 3370 static int set_name_sync(struct hci_dev *hdev, void *data) 3371 { 3372 if (lmp_bredr_capable(hdev)) { 3373 hci_update_name_sync(hdev); 3374 hci_update_eir_sync(hdev); 3375 } 3376 3377 /* The name is stored in the scan response data and so 3378 * no need to update the advertising data here. 3379 */ 3380 if (lmp_le_capable(hdev) && hci_dev_test_flag(hdev, HCI_ADVERTISING)) 3381 hci_update_scan_rsp_data_sync(hdev, hdev->cur_adv_instance); 3382 3383 return 0; 3384 } 3385 3386 static int set_local_name(struct sock *sk, struct hci_dev *hdev, void *data, 3387 u16 len) 3388 { 3389 struct mgmt_cp_set_local_name *cp = data; 3390 struct mgmt_pending_cmd *cmd; 3391 int err; 3392 3393 bt_dev_dbg(hdev, "sock %p", sk); 3394 3395 hci_dev_lock(hdev); 3396 3397 /* If the old values are the same as the new ones just return a 3398 * direct command complete event. 3399 */ 3400 if (!memcmp(hdev->dev_name, cp->name, sizeof(hdev->dev_name)) && 3401 !memcmp(hdev->short_name, cp->short_name, 3402 sizeof(hdev->short_name))) { 3403 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0, 3404 data, len); 3405 goto failed; 3406 } 3407 3408 memcpy(hdev->short_name, cp->short_name, sizeof(hdev->short_name)); 3409 3410 if (!hdev_is_powered(hdev)) { 3411 memcpy(hdev->dev_name, cp->name, sizeof(hdev->dev_name)); 3412 3413 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0, 3414 data, len); 3415 if (err < 0) 3416 goto failed; 3417 3418 err = mgmt_limited_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, data, 3419 len, HCI_MGMT_LOCAL_NAME_EVENTS, sk); 3420 ext_info_changed(hdev, sk); 3421 3422 goto failed; 3423 } 3424 3425 cmd = mgmt_pending_add(sk, MGMT_OP_SET_LOCAL_NAME, hdev, data, len); 3426 if (!cmd) 3427 err = -ENOMEM; 3428 else 3429 err = hci_cmd_sync_queue(hdev, set_name_sync, cmd, 3430 set_name_complete); 3431 3432 if (err < 0) { 3433 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 3434 MGMT_STATUS_FAILED); 3435 3436 if (cmd) 3437 mgmt_pending_remove(cmd); 3438 3439 goto failed; 3440 } 3441 3442 memcpy(hdev->dev_name, cp->name, sizeof(hdev->dev_name)); 3443 3444 failed: 3445 hci_dev_unlock(hdev); 3446 return err; 3447 } 3448 3449 static int appearance_changed_sync(struct hci_dev *hdev, void *data) 3450 { 3451 return adv_expire_sync(hdev, MGMT_ADV_FLAG_APPEARANCE); 3452 } 3453 3454 static int set_appearance(struct sock *sk, struct hci_dev *hdev, void *data, 3455 u16 len) 3456 { 3457 struct mgmt_cp_set_appearance *cp = data; 3458 u16 appearance; 3459 int err; 3460 3461 bt_dev_dbg(hdev, "sock %p", sk); 3462 3463 if (!lmp_le_capable(hdev)) 3464 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_APPEARANCE, 3465 MGMT_STATUS_NOT_SUPPORTED); 3466 3467 appearance = le16_to_cpu(cp->appearance); 3468 3469 hci_dev_lock(hdev); 3470 3471 if (hdev->appearance != appearance) { 3472 hdev->appearance = appearance; 3473 3474 if (hci_dev_test_flag(hdev, HCI_LE_ADV)) 3475 hci_cmd_sync_queue(hdev, appearance_changed_sync, NULL, 3476 NULL); 3477 3478 ext_info_changed(hdev, sk); 3479 } 3480 3481 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_APPEARANCE, 0, NULL, 3482 0); 3483 3484 hci_dev_unlock(hdev); 3485 3486 return err; 3487 } 3488 3489 static int get_phy_configuration(struct sock *sk, struct hci_dev *hdev, 3490 void *data, u16 len) 3491 { 3492 struct mgmt_rp_get_phy_configuration rp; 3493 3494 bt_dev_dbg(hdev, "sock %p", sk); 3495 3496 hci_dev_lock(hdev); 3497 3498 memset(&rp, 0, sizeof(rp)); 3499 3500 rp.supported_phys = cpu_to_le32(get_supported_phys(hdev)); 3501 rp.selected_phys = cpu_to_le32(get_selected_phys(hdev)); 3502 rp.configurable_phys = cpu_to_le32(get_configurable_phys(hdev)); 3503 3504 hci_dev_unlock(hdev); 3505 3506 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_PHY_CONFIGURATION, 0, 3507 &rp, sizeof(rp)); 3508 } 3509 3510 int mgmt_phy_configuration_changed(struct hci_dev *hdev, struct sock *skip) 3511 { 3512 struct mgmt_ev_phy_configuration_changed ev; 3513 3514 memset(&ev, 0, sizeof(ev)); 3515 3516 ev.selected_phys = cpu_to_le32(get_selected_phys(hdev)); 3517 3518 return mgmt_event(MGMT_EV_PHY_CONFIGURATION_CHANGED, hdev, &ev, 3519 sizeof(ev), skip); 3520 } 3521 3522 static void set_default_phy_complete(struct hci_dev *hdev, void *data, int err) 3523 { 3524 struct mgmt_pending_cmd *cmd = data; 3525 struct sk_buff *skb = cmd->skb; 3526 u8 status = mgmt_status(err); 3527 3528 if (cmd != pending_find(MGMT_OP_SET_PHY_CONFIGURATION, hdev)) 3529 return; 3530 3531 if (!status) { 3532 if (!skb) 3533 status = MGMT_STATUS_FAILED; 3534 else if (IS_ERR(skb)) 3535 status = mgmt_status(PTR_ERR(skb)); 3536 else 3537 status = mgmt_status(skb->data[0]); 3538 } 3539 3540 bt_dev_dbg(hdev, "status %d", status); 3541 3542 if (status) { 3543 mgmt_cmd_status(cmd->sk, hdev->id, 3544 MGMT_OP_SET_PHY_CONFIGURATION, status); 3545 } else { 3546 mgmt_cmd_complete(cmd->sk, hdev->id, 3547 MGMT_OP_SET_PHY_CONFIGURATION, 0, 3548 NULL, 0); 3549 3550 mgmt_phy_configuration_changed(hdev, cmd->sk); 3551 } 3552 3553 if (skb && !IS_ERR(skb)) 3554 kfree_skb(skb); 3555 3556 mgmt_pending_remove(cmd); 3557 } 3558 3559 static int set_default_phy_sync(struct hci_dev *hdev, void *data) 3560 { 3561 struct mgmt_pending_cmd *cmd = data; 3562 struct mgmt_cp_set_phy_configuration *cp = cmd->param; 3563 struct hci_cp_le_set_default_phy cp_phy; 3564 u32 selected_phys = __le32_to_cpu(cp->selected_phys); 3565 3566 memset(&cp_phy, 0, sizeof(cp_phy)); 3567 3568 if (!(selected_phys & MGMT_PHY_LE_TX_MASK)) 3569 cp_phy.all_phys |= 0x01; 3570 3571 if (!(selected_phys & MGMT_PHY_LE_RX_MASK)) 3572 cp_phy.all_phys |= 0x02; 3573 3574 if (selected_phys & MGMT_PHY_LE_1M_TX) 3575 cp_phy.tx_phys |= HCI_LE_SET_PHY_1M; 3576 3577 if (selected_phys & MGMT_PHY_LE_2M_TX) 3578 cp_phy.tx_phys |= HCI_LE_SET_PHY_2M; 3579 3580 if (selected_phys & MGMT_PHY_LE_CODED_TX) 3581 cp_phy.tx_phys |= HCI_LE_SET_PHY_CODED; 3582 3583 if (selected_phys & MGMT_PHY_LE_1M_RX) 3584 cp_phy.rx_phys |= HCI_LE_SET_PHY_1M; 3585 3586 if (selected_phys & MGMT_PHY_LE_2M_RX) 3587 cp_phy.rx_phys |= HCI_LE_SET_PHY_2M; 3588 3589 if (selected_phys & MGMT_PHY_LE_CODED_RX) 3590 cp_phy.rx_phys |= HCI_LE_SET_PHY_CODED; 3591 3592 cmd->skb = __hci_cmd_sync(hdev, HCI_OP_LE_SET_DEFAULT_PHY, 3593 sizeof(cp_phy), &cp_phy, HCI_CMD_TIMEOUT); 3594 3595 return 0; 3596 } 3597 3598 static int set_phy_configuration(struct sock *sk, struct hci_dev *hdev, 3599 void *data, u16 len) 3600 { 3601 struct mgmt_cp_set_phy_configuration *cp = data; 3602 struct mgmt_pending_cmd *cmd; 3603 u32 selected_phys, configurable_phys, supported_phys, unconfigure_phys; 3604 u16 pkt_type = (HCI_DH1 | HCI_DM1); 3605 bool changed = false; 3606 int err; 3607 3608 bt_dev_dbg(hdev, "sock %p", sk); 3609 3610 configurable_phys = get_configurable_phys(hdev); 3611 supported_phys = get_supported_phys(hdev); 3612 selected_phys = __le32_to_cpu(cp->selected_phys); 3613 3614 if (selected_phys & ~supported_phys) 3615 return mgmt_cmd_status(sk, hdev->id, 3616 MGMT_OP_SET_PHY_CONFIGURATION, 3617 MGMT_STATUS_INVALID_PARAMS); 3618 3619 unconfigure_phys = supported_phys & ~configurable_phys; 3620 3621 if ((selected_phys & unconfigure_phys) != unconfigure_phys) 3622 return mgmt_cmd_status(sk, hdev->id, 3623 MGMT_OP_SET_PHY_CONFIGURATION, 3624 MGMT_STATUS_INVALID_PARAMS); 3625 3626 if (selected_phys == get_selected_phys(hdev)) 3627 return mgmt_cmd_complete(sk, hdev->id, 3628 MGMT_OP_SET_PHY_CONFIGURATION, 3629 0, NULL, 0); 3630 3631 hci_dev_lock(hdev); 3632 3633 if (!hdev_is_powered(hdev)) { 3634 err = mgmt_cmd_status(sk, hdev->id, 3635 MGMT_OP_SET_PHY_CONFIGURATION, 3636 MGMT_STATUS_REJECTED); 3637 goto unlock; 3638 } 3639 3640 if (pending_find(MGMT_OP_SET_PHY_CONFIGURATION, hdev)) { 3641 err = mgmt_cmd_status(sk, hdev->id, 3642 MGMT_OP_SET_PHY_CONFIGURATION, 3643 MGMT_STATUS_BUSY); 3644 goto unlock; 3645 } 3646 3647 if (selected_phys & MGMT_PHY_BR_1M_3SLOT) 3648 pkt_type |= (HCI_DH3 | HCI_DM3); 3649 else 3650 pkt_type &= ~(HCI_DH3 | HCI_DM3); 3651 3652 if (selected_phys & MGMT_PHY_BR_1M_5SLOT) 3653 pkt_type |= (HCI_DH5 | HCI_DM5); 3654 else 3655 pkt_type &= ~(HCI_DH5 | HCI_DM5); 3656 3657 if (selected_phys & MGMT_PHY_EDR_2M_1SLOT) 3658 pkt_type &= ~HCI_2DH1; 3659 else 3660 pkt_type |= HCI_2DH1; 3661 3662 if (selected_phys & MGMT_PHY_EDR_2M_3SLOT) 3663 pkt_type &= ~HCI_2DH3; 3664 else 3665 pkt_type |= HCI_2DH3; 3666 3667 if (selected_phys & MGMT_PHY_EDR_2M_5SLOT) 3668 pkt_type &= ~HCI_2DH5; 3669 else 3670 pkt_type |= HCI_2DH5; 3671 3672 if (selected_phys & MGMT_PHY_EDR_3M_1SLOT) 3673 pkt_type &= ~HCI_3DH1; 3674 else 3675 pkt_type |= HCI_3DH1; 3676 3677 if (selected_phys & MGMT_PHY_EDR_3M_3SLOT) 3678 pkt_type &= ~HCI_3DH3; 3679 else 3680 pkt_type |= HCI_3DH3; 3681 3682 if (selected_phys & MGMT_PHY_EDR_3M_5SLOT) 3683 pkt_type &= ~HCI_3DH5; 3684 else 3685 pkt_type |= HCI_3DH5; 3686 3687 if (pkt_type != hdev->pkt_type) { 3688 hdev->pkt_type = pkt_type; 3689 changed = true; 3690 } 3691 3692 if ((selected_phys & MGMT_PHY_LE_MASK) == 3693 (get_selected_phys(hdev) & MGMT_PHY_LE_MASK)) { 3694 if (changed) 3695 mgmt_phy_configuration_changed(hdev, sk); 3696 3697 err = mgmt_cmd_complete(sk, hdev->id, 3698 MGMT_OP_SET_PHY_CONFIGURATION, 3699 0, NULL, 0); 3700 3701 goto unlock; 3702 } 3703 3704 cmd = mgmt_pending_add(sk, MGMT_OP_SET_PHY_CONFIGURATION, hdev, data, 3705 len); 3706 if (!cmd) 3707 err = -ENOMEM; 3708 else 3709 err = hci_cmd_sync_queue(hdev, set_default_phy_sync, cmd, 3710 set_default_phy_complete); 3711 3712 if (err < 0) { 3713 err = mgmt_cmd_status(sk, hdev->id, 3714 MGMT_OP_SET_PHY_CONFIGURATION, 3715 MGMT_STATUS_FAILED); 3716 3717 if (cmd) 3718 mgmt_pending_remove(cmd); 3719 } 3720 3721 unlock: 3722 hci_dev_unlock(hdev); 3723 3724 return err; 3725 } 3726 3727 static int set_blocked_keys(struct sock *sk, struct hci_dev *hdev, void *data, 3728 u16 len) 3729 { 3730 int err = MGMT_STATUS_SUCCESS; 3731 struct mgmt_cp_set_blocked_keys *keys = data; 3732 const u16 max_key_count = ((U16_MAX - sizeof(*keys)) / 3733 sizeof(struct mgmt_blocked_key_info)); 3734 u16 key_count, expected_len; 3735 int i; 3736 3737 bt_dev_dbg(hdev, "sock %p", sk); 3738 3739 key_count = __le16_to_cpu(keys->key_count); 3740 if (key_count > max_key_count) { 3741 bt_dev_err(hdev, "too big key_count value %u", key_count); 3742 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BLOCKED_KEYS, 3743 MGMT_STATUS_INVALID_PARAMS); 3744 } 3745 3746 expected_len = struct_size(keys, keys, key_count); 3747 if (expected_len != len) { 3748 bt_dev_err(hdev, "expected %u bytes, got %u bytes", 3749 expected_len, len); 3750 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BLOCKED_KEYS, 3751 MGMT_STATUS_INVALID_PARAMS); 3752 } 3753 3754 hci_dev_lock(hdev); 3755 3756 hci_blocked_keys_clear(hdev); 3757 3758 for (i = 0; i < keys->key_count; ++i) { 3759 struct blocked_key *b = kzalloc(sizeof(*b), GFP_KERNEL); 3760 3761 if (!b) { 3762 err = MGMT_STATUS_NO_RESOURCES; 3763 break; 3764 } 3765 3766 b->type = keys->keys[i].type; 3767 memcpy(b->val, keys->keys[i].val, sizeof(b->val)); 3768 list_add_rcu(&b->list, &hdev->blocked_keys); 3769 } 3770 hci_dev_unlock(hdev); 3771 3772 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_BLOCKED_KEYS, 3773 err, NULL, 0); 3774 } 3775 3776 static int set_wideband_speech(struct sock *sk, struct hci_dev *hdev, 3777 void *data, u16 len) 3778 { 3779 struct mgmt_mode *cp = data; 3780 int err; 3781 bool changed = false; 3782 3783 bt_dev_dbg(hdev, "sock %p", sk); 3784 3785 if (!test_bit(HCI_QUIRK_WIDEBAND_SPEECH_SUPPORTED, &hdev->quirks)) 3786 return mgmt_cmd_status(sk, hdev->id, 3787 MGMT_OP_SET_WIDEBAND_SPEECH, 3788 MGMT_STATUS_NOT_SUPPORTED); 3789 3790 if (cp->val != 0x00 && cp->val != 0x01) 3791 return mgmt_cmd_status(sk, hdev->id, 3792 MGMT_OP_SET_WIDEBAND_SPEECH, 3793 MGMT_STATUS_INVALID_PARAMS); 3794 3795 hci_dev_lock(hdev); 3796 3797 if (hdev_is_powered(hdev) && 3798 !!cp->val != hci_dev_test_flag(hdev, 3799 HCI_WIDEBAND_SPEECH_ENABLED)) { 3800 err = mgmt_cmd_status(sk, hdev->id, 3801 MGMT_OP_SET_WIDEBAND_SPEECH, 3802 MGMT_STATUS_REJECTED); 3803 goto unlock; 3804 } 3805 3806 if (cp->val) 3807 changed = !hci_dev_test_and_set_flag(hdev, 3808 HCI_WIDEBAND_SPEECH_ENABLED); 3809 else 3810 changed = hci_dev_test_and_clear_flag(hdev, 3811 HCI_WIDEBAND_SPEECH_ENABLED); 3812 3813 err = send_settings_rsp(sk, MGMT_OP_SET_WIDEBAND_SPEECH, hdev); 3814 if (err < 0) 3815 goto unlock; 3816 3817 if (changed) 3818 err = new_settings(hdev, sk); 3819 3820 unlock: 3821 hci_dev_unlock(hdev); 3822 return err; 3823 } 3824 3825 static int read_controller_cap(struct sock *sk, struct hci_dev *hdev, 3826 void *data, u16 data_len) 3827 { 3828 char buf[20]; 3829 struct mgmt_rp_read_controller_cap *rp = (void *)buf; 3830 u16 cap_len = 0; 3831 u8 flags = 0; 3832 u8 tx_power_range[2]; 3833 3834 bt_dev_dbg(hdev, "sock %p", sk); 3835 3836 memset(&buf, 0, sizeof(buf)); 3837 3838 hci_dev_lock(hdev); 3839 3840 /* When the Read Simple Pairing Options command is supported, then 3841 * the remote public key validation is supported. 3842 * 3843 * Alternatively, when Microsoft extensions are available, they can 3844 * indicate support for public key validation as well. 3845 */ 3846 if ((hdev->commands[41] & 0x08) || msft_curve_validity(hdev)) 3847 flags |= 0x01; /* Remote public key validation (BR/EDR) */ 3848 3849 flags |= 0x02; /* Remote public key validation (LE) */ 3850 3851 /* When the Read Encryption Key Size command is supported, then the 3852 * encryption key size is enforced. 3853 */ 3854 if (hdev->commands[20] & 0x10) 3855 flags |= 0x04; /* Encryption key size enforcement (BR/EDR) */ 3856 3857 flags |= 0x08; /* Encryption key size enforcement (LE) */ 3858 3859 cap_len = eir_append_data(rp->cap, cap_len, MGMT_CAP_SEC_FLAGS, 3860 &flags, 1); 3861 3862 /* When the Read Simple Pairing Options command is supported, then 3863 * also max encryption key size information is provided. 3864 */ 3865 if (hdev->commands[41] & 0x08) 3866 cap_len = eir_append_le16(rp->cap, cap_len, 3867 MGMT_CAP_MAX_ENC_KEY_SIZE, 3868 hdev->max_enc_key_size); 3869 3870 cap_len = eir_append_le16(rp->cap, cap_len, 3871 MGMT_CAP_SMP_MAX_ENC_KEY_SIZE, 3872 SMP_MAX_ENC_KEY_SIZE); 3873 3874 /* Append the min/max LE tx power parameters if we were able to fetch 3875 * it from the controller 3876 */ 3877 if (hdev->commands[38] & 0x80) { 3878 memcpy(&tx_power_range[0], &hdev->min_le_tx_power, 1); 3879 memcpy(&tx_power_range[1], &hdev->max_le_tx_power, 1); 3880 cap_len = eir_append_data(rp->cap, cap_len, MGMT_CAP_LE_TX_PWR, 3881 tx_power_range, 2); 3882 } 3883 3884 rp->cap_len = cpu_to_le16(cap_len); 3885 3886 hci_dev_unlock(hdev); 3887 3888 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_CONTROLLER_CAP, 0, 3889 rp, sizeof(*rp) + cap_len); 3890 } 3891 3892 #ifdef CONFIG_BT_FEATURE_DEBUG 3893 /* d4992530-b9ec-469f-ab01-6c481c47da1c */ 3894 static const u8 debug_uuid[16] = { 3895 0x1c, 0xda, 0x47, 0x1c, 0x48, 0x6c, 0x01, 0xab, 3896 0x9f, 0x46, 0xec, 0xb9, 0x30, 0x25, 0x99, 0xd4, 3897 }; 3898 #endif 3899 3900 /* 330859bc-7506-492d-9370-9a6f0614037f */ 3901 static const u8 quality_report_uuid[16] = { 3902 0x7f, 0x03, 0x14, 0x06, 0x6f, 0x9a, 0x70, 0x93, 3903 0x2d, 0x49, 0x06, 0x75, 0xbc, 0x59, 0x08, 0x33, 3904 }; 3905 3906 /* a6695ace-ee7f-4fb9-881a-5fac66c629af */ 3907 static const u8 offload_codecs_uuid[16] = { 3908 0xaf, 0x29, 0xc6, 0x66, 0xac, 0x5f, 0x1a, 0x88, 3909 0xb9, 0x4f, 0x7f, 0xee, 0xce, 0x5a, 0x69, 0xa6, 3910 }; 3911 3912 /* 671b10b5-42c0-4696-9227-eb28d1b049d6 */ 3913 static const u8 le_simultaneous_roles_uuid[16] = { 3914 0xd6, 0x49, 0xb0, 0xd1, 0x28, 0xeb, 0x27, 0x92, 3915 0x96, 0x46, 0xc0, 0x42, 0xb5, 0x10, 0x1b, 0x67, 3916 }; 3917 3918 /* 15c0a148-c273-11ea-b3de-0242ac130004 */ 3919 static const u8 rpa_resolution_uuid[16] = { 3920 0x04, 0x00, 0x13, 0xac, 0x42, 0x02, 0xde, 0xb3, 3921 0xea, 0x11, 0x73, 0xc2, 0x48, 0xa1, 0xc0, 0x15, 3922 }; 3923 3924 static int read_exp_features_info(struct sock *sk, struct hci_dev *hdev, 3925 void *data, u16 data_len) 3926 { 3927 char buf[102]; /* Enough space for 5 features: 2 + 20 * 5 */ 3928 struct mgmt_rp_read_exp_features_info *rp = (void *)buf; 3929 u16 idx = 0; 3930 u32 flags; 3931 3932 bt_dev_dbg(hdev, "sock %p", sk); 3933 3934 memset(&buf, 0, sizeof(buf)); 3935 3936 #ifdef CONFIG_BT_FEATURE_DEBUG 3937 if (!hdev) { 3938 flags = bt_dbg_get() ? BIT(0) : 0; 3939 3940 memcpy(rp->features[idx].uuid, debug_uuid, 16); 3941 rp->features[idx].flags = cpu_to_le32(flags); 3942 idx++; 3943 } 3944 #endif 3945 3946 if (hdev && hci_dev_le_state_simultaneous(hdev)) { 3947 if (hci_dev_test_flag(hdev, HCI_LE_SIMULTANEOUS_ROLES)) 3948 flags = BIT(0); 3949 else 3950 flags = 0; 3951 3952 memcpy(rp->features[idx].uuid, le_simultaneous_roles_uuid, 16); 3953 rp->features[idx].flags = cpu_to_le32(flags); 3954 idx++; 3955 } 3956 3957 if (hdev && ll_privacy_capable(hdev)) { 3958 if (hci_dev_test_flag(hdev, HCI_ENABLE_LL_PRIVACY)) 3959 flags = BIT(0) | BIT(1); 3960 else 3961 flags = BIT(1); 3962 3963 memcpy(rp->features[idx].uuid, rpa_resolution_uuid, 16); 3964 rp->features[idx].flags = cpu_to_le32(flags); 3965 idx++; 3966 } 3967 3968 if (hdev && (aosp_has_quality_report(hdev) || 3969 hdev->set_quality_report)) { 3970 if (hci_dev_test_flag(hdev, HCI_QUALITY_REPORT)) 3971 flags = BIT(0); 3972 else 3973 flags = 0; 3974 3975 memcpy(rp->features[idx].uuid, quality_report_uuid, 16); 3976 rp->features[idx].flags = cpu_to_le32(flags); 3977 idx++; 3978 } 3979 3980 if (hdev && hdev->get_data_path_id) { 3981 if (hci_dev_test_flag(hdev, HCI_OFFLOAD_CODECS_ENABLED)) 3982 flags = BIT(0); 3983 else 3984 flags = 0; 3985 3986 memcpy(rp->features[idx].uuid, offload_codecs_uuid, 16); 3987 rp->features[idx].flags = cpu_to_le32(flags); 3988 idx++; 3989 } 3990 3991 rp->feature_count = cpu_to_le16(idx); 3992 3993 /* After reading the experimental features information, enable 3994 * the events to update client on any future change. 3995 */ 3996 hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS); 3997 3998 return mgmt_cmd_complete(sk, hdev ? hdev->id : MGMT_INDEX_NONE, 3999 MGMT_OP_READ_EXP_FEATURES_INFO, 4000 0, rp, sizeof(*rp) + (20 * idx)); 4001 } 4002 4003 static int exp_ll_privacy_feature_changed(bool enabled, struct hci_dev *hdev, 4004 struct sock *skip) 4005 { 4006 struct mgmt_ev_exp_feature_changed ev; 4007 4008 memset(&ev, 0, sizeof(ev)); 4009 memcpy(ev.uuid, rpa_resolution_uuid, 16); 4010 ev.flags = cpu_to_le32((enabled ? BIT(0) : 0) | BIT(1)); 4011 4012 if (enabled && privacy_mode_capable(hdev)) 4013 set_bit(HCI_CONN_FLAG_DEVICE_PRIVACY, hdev->conn_flags); 4014 else 4015 clear_bit(HCI_CONN_FLAG_DEVICE_PRIVACY, hdev->conn_flags); 4016 4017 return mgmt_limited_event(MGMT_EV_EXP_FEATURE_CHANGED, hdev, 4018 &ev, sizeof(ev), 4019 HCI_MGMT_EXP_FEATURE_EVENTS, skip); 4020 4021 } 4022 4023 static int exp_feature_changed(struct hci_dev *hdev, const u8 *uuid, 4024 bool enabled, struct sock *skip) 4025 { 4026 struct mgmt_ev_exp_feature_changed ev; 4027 4028 memset(&ev, 0, sizeof(ev)); 4029 memcpy(ev.uuid, uuid, 16); 4030 ev.flags = cpu_to_le32(enabled ? BIT(0) : 0); 4031 4032 return mgmt_limited_event(MGMT_EV_EXP_FEATURE_CHANGED, hdev, 4033 &ev, sizeof(ev), 4034 HCI_MGMT_EXP_FEATURE_EVENTS, skip); 4035 } 4036 4037 #define EXP_FEAT(_uuid, _set_func) \ 4038 { \ 4039 .uuid = _uuid, \ 4040 .set_func = _set_func, \ 4041 } 4042 4043 /* The zero key uuid is special. Multiple exp features are set through it. */ 4044 static int set_zero_key_func(struct sock *sk, struct hci_dev *hdev, 4045 struct mgmt_cp_set_exp_feature *cp, u16 data_len) 4046 { 4047 struct mgmt_rp_set_exp_feature rp; 4048 4049 memset(rp.uuid, 0, 16); 4050 rp.flags = cpu_to_le32(0); 4051 4052 #ifdef CONFIG_BT_FEATURE_DEBUG 4053 if (!hdev) { 4054 bool changed = bt_dbg_get(); 4055 4056 bt_dbg_set(false); 4057 4058 if (changed) 4059 exp_feature_changed(NULL, ZERO_KEY, false, sk); 4060 } 4061 #endif 4062 4063 if (hdev && use_ll_privacy(hdev) && !hdev_is_powered(hdev)) { 4064 bool changed; 4065 4066 changed = hci_dev_test_and_clear_flag(hdev, 4067 HCI_ENABLE_LL_PRIVACY); 4068 if (changed) 4069 exp_feature_changed(hdev, rpa_resolution_uuid, false, 4070 sk); 4071 } 4072 4073 hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS); 4074 4075 return mgmt_cmd_complete(sk, hdev ? hdev->id : MGMT_INDEX_NONE, 4076 MGMT_OP_SET_EXP_FEATURE, 0, 4077 &rp, sizeof(rp)); 4078 } 4079 4080 #ifdef CONFIG_BT_FEATURE_DEBUG 4081 static int set_debug_func(struct sock *sk, struct hci_dev *hdev, 4082 struct mgmt_cp_set_exp_feature *cp, u16 data_len) 4083 { 4084 struct mgmt_rp_set_exp_feature rp; 4085 4086 bool val, changed; 4087 int err; 4088 4089 /* Command requires to use the non-controller index */ 4090 if (hdev) 4091 return mgmt_cmd_status(sk, hdev->id, 4092 MGMT_OP_SET_EXP_FEATURE, 4093 MGMT_STATUS_INVALID_INDEX); 4094 4095 /* Parameters are limited to a single octet */ 4096 if (data_len != MGMT_SET_EXP_FEATURE_SIZE + 1) 4097 return mgmt_cmd_status(sk, MGMT_INDEX_NONE, 4098 MGMT_OP_SET_EXP_FEATURE, 4099 MGMT_STATUS_INVALID_PARAMS); 4100 4101 /* Only boolean on/off is supported */ 4102 if (cp->param[0] != 0x00 && cp->param[0] != 0x01) 4103 return mgmt_cmd_status(sk, MGMT_INDEX_NONE, 4104 MGMT_OP_SET_EXP_FEATURE, 4105 MGMT_STATUS_INVALID_PARAMS); 4106 4107 val = !!cp->param[0]; 4108 changed = val ? !bt_dbg_get() : bt_dbg_get(); 4109 bt_dbg_set(val); 4110 4111 memcpy(rp.uuid, debug_uuid, 16); 4112 rp.flags = cpu_to_le32(val ? BIT(0) : 0); 4113 4114 hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS); 4115 4116 err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE, 4117 MGMT_OP_SET_EXP_FEATURE, 0, 4118 &rp, sizeof(rp)); 4119 4120 if (changed) 4121 exp_feature_changed(hdev, debug_uuid, val, sk); 4122 4123 return err; 4124 } 4125 #endif 4126 4127 static int set_rpa_resolution_func(struct sock *sk, struct hci_dev *hdev, 4128 struct mgmt_cp_set_exp_feature *cp, 4129 u16 data_len) 4130 { 4131 struct mgmt_rp_set_exp_feature rp; 4132 bool val, changed; 4133 int err; 4134 u32 flags; 4135 4136 /* Command requires to use the controller index */ 4137 if (!hdev) 4138 return mgmt_cmd_status(sk, MGMT_INDEX_NONE, 4139 MGMT_OP_SET_EXP_FEATURE, 4140 MGMT_STATUS_INVALID_INDEX); 4141 4142 /* Changes can only be made when controller is powered down */ 4143 if (hdev_is_powered(hdev)) 4144 return mgmt_cmd_status(sk, hdev->id, 4145 MGMT_OP_SET_EXP_FEATURE, 4146 MGMT_STATUS_REJECTED); 4147 4148 /* Parameters are limited to a single octet */ 4149 if (data_len != MGMT_SET_EXP_FEATURE_SIZE + 1) 4150 return mgmt_cmd_status(sk, hdev->id, 4151 MGMT_OP_SET_EXP_FEATURE, 4152 MGMT_STATUS_INVALID_PARAMS); 4153 4154 /* Only boolean on/off is supported */ 4155 if (cp->param[0] != 0x00 && cp->param[0] != 0x01) 4156 return mgmt_cmd_status(sk, hdev->id, 4157 MGMT_OP_SET_EXP_FEATURE, 4158 MGMT_STATUS_INVALID_PARAMS); 4159 4160 val = !!cp->param[0]; 4161 4162 if (val) { 4163 changed = !hci_dev_test_and_set_flag(hdev, 4164 HCI_ENABLE_LL_PRIVACY); 4165 hci_dev_clear_flag(hdev, HCI_ADVERTISING); 4166 4167 /* Enable LL privacy + supported settings changed */ 4168 flags = BIT(0) | BIT(1); 4169 } else { 4170 changed = hci_dev_test_and_clear_flag(hdev, 4171 HCI_ENABLE_LL_PRIVACY); 4172 4173 /* Disable LL privacy + supported settings changed */ 4174 flags = BIT(1); 4175 } 4176 4177 memcpy(rp.uuid, rpa_resolution_uuid, 16); 4178 rp.flags = cpu_to_le32(flags); 4179 4180 hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS); 4181 4182 err = mgmt_cmd_complete(sk, hdev->id, 4183 MGMT_OP_SET_EXP_FEATURE, 0, 4184 &rp, sizeof(rp)); 4185 4186 if (changed) 4187 exp_ll_privacy_feature_changed(val, hdev, sk); 4188 4189 return err; 4190 } 4191 4192 static int set_quality_report_func(struct sock *sk, struct hci_dev *hdev, 4193 struct mgmt_cp_set_exp_feature *cp, 4194 u16 data_len) 4195 { 4196 struct mgmt_rp_set_exp_feature rp; 4197 bool val, changed; 4198 int err; 4199 4200 /* Command requires to use a valid controller index */ 4201 if (!hdev) 4202 return mgmt_cmd_status(sk, MGMT_INDEX_NONE, 4203 MGMT_OP_SET_EXP_FEATURE, 4204 MGMT_STATUS_INVALID_INDEX); 4205 4206 /* Parameters are limited to a single octet */ 4207 if (data_len != MGMT_SET_EXP_FEATURE_SIZE + 1) 4208 return mgmt_cmd_status(sk, hdev->id, 4209 MGMT_OP_SET_EXP_FEATURE, 4210 MGMT_STATUS_INVALID_PARAMS); 4211 4212 /* Only boolean on/off is supported */ 4213 if (cp->param[0] != 0x00 && cp->param[0] != 0x01) 4214 return mgmt_cmd_status(sk, hdev->id, 4215 MGMT_OP_SET_EXP_FEATURE, 4216 MGMT_STATUS_INVALID_PARAMS); 4217 4218 hci_req_sync_lock(hdev); 4219 4220 val = !!cp->param[0]; 4221 changed = (val != hci_dev_test_flag(hdev, HCI_QUALITY_REPORT)); 4222 4223 if (!aosp_has_quality_report(hdev) && !hdev->set_quality_report) { 4224 err = mgmt_cmd_status(sk, hdev->id, 4225 MGMT_OP_SET_EXP_FEATURE, 4226 MGMT_STATUS_NOT_SUPPORTED); 4227 goto unlock_quality_report; 4228 } 4229 4230 if (changed) { 4231 if (hdev->set_quality_report) 4232 err = hdev->set_quality_report(hdev, val); 4233 else 4234 err = aosp_set_quality_report(hdev, val); 4235 4236 if (err) { 4237 err = mgmt_cmd_status(sk, hdev->id, 4238 MGMT_OP_SET_EXP_FEATURE, 4239 MGMT_STATUS_FAILED); 4240 goto unlock_quality_report; 4241 } 4242 4243 if (val) 4244 hci_dev_set_flag(hdev, HCI_QUALITY_REPORT); 4245 else 4246 hci_dev_clear_flag(hdev, HCI_QUALITY_REPORT); 4247 } 4248 4249 bt_dev_dbg(hdev, "quality report enable %d changed %d", val, changed); 4250 4251 memcpy(rp.uuid, quality_report_uuid, 16); 4252 rp.flags = cpu_to_le32(val ? BIT(0) : 0); 4253 hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS); 4254 4255 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_EXP_FEATURE, 0, 4256 &rp, sizeof(rp)); 4257 4258 if (changed) 4259 exp_feature_changed(hdev, quality_report_uuid, val, sk); 4260 4261 unlock_quality_report: 4262 hci_req_sync_unlock(hdev); 4263 return err; 4264 } 4265 4266 static int set_offload_codec_func(struct sock *sk, struct hci_dev *hdev, 4267 struct mgmt_cp_set_exp_feature *cp, 4268 u16 data_len) 4269 { 4270 bool val, changed; 4271 int err; 4272 struct mgmt_rp_set_exp_feature rp; 4273 4274 /* Command requires to use a valid controller index */ 4275 if (!hdev) 4276 return mgmt_cmd_status(sk, MGMT_INDEX_NONE, 4277 MGMT_OP_SET_EXP_FEATURE, 4278 MGMT_STATUS_INVALID_INDEX); 4279 4280 /* Parameters are limited to a single octet */ 4281 if (data_len != MGMT_SET_EXP_FEATURE_SIZE + 1) 4282 return mgmt_cmd_status(sk, hdev->id, 4283 MGMT_OP_SET_EXP_FEATURE, 4284 MGMT_STATUS_INVALID_PARAMS); 4285 4286 /* Only boolean on/off is supported */ 4287 if (cp->param[0] != 0x00 && cp->param[0] != 0x01) 4288 return mgmt_cmd_status(sk, hdev->id, 4289 MGMT_OP_SET_EXP_FEATURE, 4290 MGMT_STATUS_INVALID_PARAMS); 4291 4292 val = !!cp->param[0]; 4293 changed = (val != hci_dev_test_flag(hdev, HCI_OFFLOAD_CODECS_ENABLED)); 4294 4295 if (!hdev->get_data_path_id) { 4296 return mgmt_cmd_status(sk, hdev->id, 4297 MGMT_OP_SET_EXP_FEATURE, 4298 MGMT_STATUS_NOT_SUPPORTED); 4299 } 4300 4301 if (changed) { 4302 if (val) 4303 hci_dev_set_flag(hdev, HCI_OFFLOAD_CODECS_ENABLED); 4304 else 4305 hci_dev_clear_flag(hdev, HCI_OFFLOAD_CODECS_ENABLED); 4306 } 4307 4308 bt_dev_info(hdev, "offload codecs enable %d changed %d", 4309 val, changed); 4310 4311 memcpy(rp.uuid, offload_codecs_uuid, 16); 4312 rp.flags = cpu_to_le32(val ? BIT(0) : 0); 4313 hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS); 4314 err = mgmt_cmd_complete(sk, hdev->id, 4315 MGMT_OP_SET_EXP_FEATURE, 0, 4316 &rp, sizeof(rp)); 4317 4318 if (changed) 4319 exp_feature_changed(hdev, offload_codecs_uuid, val, sk); 4320 4321 return err; 4322 } 4323 4324 static int set_le_simultaneous_roles_func(struct sock *sk, struct hci_dev *hdev, 4325 struct mgmt_cp_set_exp_feature *cp, 4326 u16 data_len) 4327 { 4328 bool val, changed; 4329 int err; 4330 struct mgmt_rp_set_exp_feature rp; 4331 4332 /* Command requires to use a valid controller index */ 4333 if (!hdev) 4334 return mgmt_cmd_status(sk, MGMT_INDEX_NONE, 4335 MGMT_OP_SET_EXP_FEATURE, 4336 MGMT_STATUS_INVALID_INDEX); 4337 4338 /* Parameters are limited to a single octet */ 4339 if (data_len != MGMT_SET_EXP_FEATURE_SIZE + 1) 4340 return mgmt_cmd_status(sk, hdev->id, 4341 MGMT_OP_SET_EXP_FEATURE, 4342 MGMT_STATUS_INVALID_PARAMS); 4343 4344 /* Only boolean on/off is supported */ 4345 if (cp->param[0] != 0x00 && cp->param[0] != 0x01) 4346 return mgmt_cmd_status(sk, hdev->id, 4347 MGMT_OP_SET_EXP_FEATURE, 4348 MGMT_STATUS_INVALID_PARAMS); 4349 4350 val = !!cp->param[0]; 4351 changed = (val != hci_dev_test_flag(hdev, HCI_LE_SIMULTANEOUS_ROLES)); 4352 4353 if (!hci_dev_le_state_simultaneous(hdev)) { 4354 return mgmt_cmd_status(sk, hdev->id, 4355 MGMT_OP_SET_EXP_FEATURE, 4356 MGMT_STATUS_NOT_SUPPORTED); 4357 } 4358 4359 if (changed) { 4360 if (val) 4361 hci_dev_set_flag(hdev, HCI_LE_SIMULTANEOUS_ROLES); 4362 else 4363 hci_dev_clear_flag(hdev, HCI_LE_SIMULTANEOUS_ROLES); 4364 } 4365 4366 bt_dev_info(hdev, "LE simultaneous roles enable %d changed %d", 4367 val, changed); 4368 4369 memcpy(rp.uuid, le_simultaneous_roles_uuid, 16); 4370 rp.flags = cpu_to_le32(val ? BIT(0) : 0); 4371 hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS); 4372 err = mgmt_cmd_complete(sk, hdev->id, 4373 MGMT_OP_SET_EXP_FEATURE, 0, 4374 &rp, sizeof(rp)); 4375 4376 if (changed) 4377 exp_feature_changed(hdev, le_simultaneous_roles_uuid, val, sk); 4378 4379 return err; 4380 } 4381 4382 static const struct mgmt_exp_feature { 4383 const u8 *uuid; 4384 int (*set_func)(struct sock *sk, struct hci_dev *hdev, 4385 struct mgmt_cp_set_exp_feature *cp, u16 data_len); 4386 } exp_features[] = { 4387 EXP_FEAT(ZERO_KEY, set_zero_key_func), 4388 #ifdef CONFIG_BT_FEATURE_DEBUG 4389 EXP_FEAT(debug_uuid, set_debug_func), 4390 #endif 4391 EXP_FEAT(rpa_resolution_uuid, set_rpa_resolution_func), 4392 EXP_FEAT(quality_report_uuid, set_quality_report_func), 4393 EXP_FEAT(offload_codecs_uuid, set_offload_codec_func), 4394 EXP_FEAT(le_simultaneous_roles_uuid, set_le_simultaneous_roles_func), 4395 4396 /* end with a null feature */ 4397 EXP_FEAT(NULL, NULL) 4398 }; 4399 4400 static int set_exp_feature(struct sock *sk, struct hci_dev *hdev, 4401 void *data, u16 data_len) 4402 { 4403 struct mgmt_cp_set_exp_feature *cp = data; 4404 size_t i = 0; 4405 4406 bt_dev_dbg(hdev, "sock %p", sk); 4407 4408 for (i = 0; exp_features[i].uuid; i++) { 4409 if (!memcmp(cp->uuid, exp_features[i].uuid, 16)) 4410 return exp_features[i].set_func(sk, hdev, cp, data_len); 4411 } 4412 4413 return mgmt_cmd_status(sk, hdev ? hdev->id : MGMT_INDEX_NONE, 4414 MGMT_OP_SET_EXP_FEATURE, 4415 MGMT_STATUS_NOT_SUPPORTED); 4416 } 4417 4418 static int get_device_flags(struct sock *sk, struct hci_dev *hdev, void *data, 4419 u16 data_len) 4420 { 4421 struct mgmt_cp_get_device_flags *cp = data; 4422 struct mgmt_rp_get_device_flags rp; 4423 struct bdaddr_list_with_flags *br_params; 4424 struct hci_conn_params *params; 4425 u32 supported_flags; 4426 u32 current_flags = 0; 4427 u8 status = MGMT_STATUS_INVALID_PARAMS; 4428 4429 bt_dev_dbg(hdev, "Get device flags %pMR (type 0x%x)\n", 4430 &cp->addr.bdaddr, cp->addr.type); 4431 4432 hci_dev_lock(hdev); 4433 4434 bitmap_to_arr32(&supported_flags, hdev->conn_flags, 4435 __HCI_CONN_NUM_FLAGS); 4436 4437 memset(&rp, 0, sizeof(rp)); 4438 4439 if (cp->addr.type == BDADDR_BREDR) { 4440 br_params = hci_bdaddr_list_lookup_with_flags(&hdev->accept_list, 4441 &cp->addr.bdaddr, 4442 cp->addr.type); 4443 if (!br_params) 4444 goto done; 4445 4446 bitmap_to_arr32(¤t_flags, br_params->flags, 4447 __HCI_CONN_NUM_FLAGS); 4448 } else { 4449 params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr, 4450 le_addr_type(cp->addr.type)); 4451 4452 if (!params) 4453 goto done; 4454 4455 bitmap_to_arr32(¤t_flags, params->flags, 4456 __HCI_CONN_NUM_FLAGS); 4457 } 4458 4459 bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr); 4460 rp.addr.type = cp->addr.type; 4461 rp.supported_flags = cpu_to_le32(supported_flags); 4462 rp.current_flags = cpu_to_le32(current_flags); 4463 4464 status = MGMT_STATUS_SUCCESS; 4465 4466 done: 4467 hci_dev_unlock(hdev); 4468 4469 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_DEVICE_FLAGS, status, 4470 &rp, sizeof(rp)); 4471 } 4472 4473 static void device_flags_changed(struct sock *sk, struct hci_dev *hdev, 4474 bdaddr_t *bdaddr, u8 bdaddr_type, 4475 u32 supported_flags, u32 current_flags) 4476 { 4477 struct mgmt_ev_device_flags_changed ev; 4478 4479 bacpy(&ev.addr.bdaddr, bdaddr); 4480 ev.addr.type = bdaddr_type; 4481 ev.supported_flags = cpu_to_le32(supported_flags); 4482 ev.current_flags = cpu_to_le32(current_flags); 4483 4484 mgmt_event(MGMT_EV_DEVICE_FLAGS_CHANGED, hdev, &ev, sizeof(ev), sk); 4485 } 4486 4487 static int set_device_flags(struct sock *sk, struct hci_dev *hdev, void *data, 4488 u16 len) 4489 { 4490 struct mgmt_cp_set_device_flags *cp = data; 4491 struct bdaddr_list_with_flags *br_params; 4492 struct hci_conn_params *params; 4493 u8 status = MGMT_STATUS_INVALID_PARAMS; 4494 u32 supported_flags; 4495 u32 current_flags = __le32_to_cpu(cp->current_flags); 4496 4497 bt_dev_dbg(hdev, "Set device flags %pMR (type 0x%x) = 0x%x", 4498 &cp->addr.bdaddr, cp->addr.type, 4499 __le32_to_cpu(current_flags)); 4500 4501 bitmap_to_arr32(&supported_flags, hdev->conn_flags, 4502 __HCI_CONN_NUM_FLAGS); 4503 4504 if ((supported_flags | current_flags) != supported_flags) { 4505 bt_dev_warn(hdev, "Bad flag given (0x%x) vs supported (0x%0x)", 4506 current_flags, supported_flags); 4507 goto done; 4508 } 4509 4510 hci_dev_lock(hdev); 4511 4512 if (cp->addr.type == BDADDR_BREDR) { 4513 br_params = hci_bdaddr_list_lookup_with_flags(&hdev->accept_list, 4514 &cp->addr.bdaddr, 4515 cp->addr.type); 4516 4517 if (br_params) { 4518 bitmap_from_u64(br_params->flags, current_flags); 4519 status = MGMT_STATUS_SUCCESS; 4520 } else { 4521 bt_dev_warn(hdev, "No such BR/EDR device %pMR (0x%x)", 4522 &cp->addr.bdaddr, cp->addr.type); 4523 } 4524 } else { 4525 params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr, 4526 le_addr_type(cp->addr.type)); 4527 if (params) { 4528 bitmap_from_u64(params->flags, current_flags); 4529 status = MGMT_STATUS_SUCCESS; 4530 4531 /* Update passive scan if HCI_CONN_FLAG_DEVICE_PRIVACY 4532 * has been set. 4533 */ 4534 if (test_bit(HCI_CONN_FLAG_DEVICE_PRIVACY, 4535 params->flags)) 4536 hci_update_passive_scan(hdev); 4537 } else { 4538 bt_dev_warn(hdev, "No such LE device %pMR (0x%x)", 4539 &cp->addr.bdaddr, 4540 le_addr_type(cp->addr.type)); 4541 } 4542 } 4543 4544 done: 4545 hci_dev_unlock(hdev); 4546 4547 if (status == MGMT_STATUS_SUCCESS) 4548 device_flags_changed(sk, hdev, &cp->addr.bdaddr, cp->addr.type, 4549 supported_flags, current_flags); 4550 4551 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_DEVICE_FLAGS, status, 4552 &cp->addr, sizeof(cp->addr)); 4553 } 4554 4555 static void mgmt_adv_monitor_added(struct sock *sk, struct hci_dev *hdev, 4556 u16 handle) 4557 { 4558 struct mgmt_ev_adv_monitor_added ev; 4559 4560 ev.monitor_handle = cpu_to_le16(handle); 4561 4562 mgmt_event(MGMT_EV_ADV_MONITOR_ADDED, hdev, &ev, sizeof(ev), sk); 4563 } 4564 4565 void mgmt_adv_monitor_removed(struct hci_dev *hdev, u16 handle) 4566 { 4567 struct mgmt_ev_adv_monitor_removed ev; 4568 struct mgmt_pending_cmd *cmd; 4569 struct sock *sk_skip = NULL; 4570 struct mgmt_cp_remove_adv_monitor *cp; 4571 4572 cmd = pending_find(MGMT_OP_REMOVE_ADV_MONITOR, hdev); 4573 if (cmd) { 4574 cp = cmd->param; 4575 4576 if (cp->monitor_handle) 4577 sk_skip = cmd->sk; 4578 } 4579 4580 ev.monitor_handle = cpu_to_le16(handle); 4581 4582 mgmt_event(MGMT_EV_ADV_MONITOR_REMOVED, hdev, &ev, sizeof(ev), sk_skip); 4583 } 4584 4585 static int read_adv_mon_features(struct sock *sk, struct hci_dev *hdev, 4586 void *data, u16 len) 4587 { 4588 struct adv_monitor *monitor = NULL; 4589 struct mgmt_rp_read_adv_monitor_features *rp = NULL; 4590 int handle, err; 4591 size_t rp_size = 0; 4592 __u32 supported = 0; 4593 __u32 enabled = 0; 4594 __u16 num_handles = 0; 4595 __u16 handles[HCI_MAX_ADV_MONITOR_NUM_HANDLES]; 4596 4597 BT_DBG("request for %s", hdev->name); 4598 4599 hci_dev_lock(hdev); 4600 4601 if (msft_monitor_supported(hdev)) 4602 supported |= MGMT_ADV_MONITOR_FEATURE_MASK_OR_PATTERNS; 4603 4604 idr_for_each_entry(&hdev->adv_monitors_idr, monitor, handle) 4605 handles[num_handles++] = monitor->handle; 4606 4607 hci_dev_unlock(hdev); 4608 4609 rp_size = sizeof(*rp) + (num_handles * sizeof(u16)); 4610 rp = kmalloc(rp_size, GFP_KERNEL); 4611 if (!rp) 4612 return -ENOMEM; 4613 4614 /* All supported features are currently enabled */ 4615 enabled = supported; 4616 4617 rp->supported_features = cpu_to_le32(supported); 4618 rp->enabled_features = cpu_to_le32(enabled); 4619 rp->max_num_handles = cpu_to_le16(HCI_MAX_ADV_MONITOR_NUM_HANDLES); 4620 rp->max_num_patterns = HCI_MAX_ADV_MONITOR_NUM_PATTERNS; 4621 rp->num_handles = cpu_to_le16(num_handles); 4622 if (num_handles) 4623 memcpy(&rp->handles, &handles, (num_handles * sizeof(u16))); 4624 4625 err = mgmt_cmd_complete(sk, hdev->id, 4626 MGMT_OP_READ_ADV_MONITOR_FEATURES, 4627 MGMT_STATUS_SUCCESS, rp, rp_size); 4628 4629 kfree(rp); 4630 4631 return err; 4632 } 4633 4634 int mgmt_add_adv_patterns_monitor_complete(struct hci_dev *hdev, u8 status) 4635 { 4636 struct mgmt_rp_add_adv_patterns_monitor rp; 4637 struct mgmt_pending_cmd *cmd; 4638 struct adv_monitor *monitor; 4639 int err = 0; 4640 4641 hci_dev_lock(hdev); 4642 4643 cmd = pending_find(MGMT_OP_ADD_ADV_PATTERNS_MONITOR_RSSI, hdev); 4644 if (!cmd) { 4645 cmd = pending_find(MGMT_OP_ADD_ADV_PATTERNS_MONITOR, hdev); 4646 if (!cmd) 4647 goto done; 4648 } 4649 4650 monitor = cmd->user_data; 4651 rp.monitor_handle = cpu_to_le16(monitor->handle); 4652 4653 if (!status) { 4654 mgmt_adv_monitor_added(cmd->sk, hdev, monitor->handle); 4655 hdev->adv_monitors_cnt++; 4656 if (monitor->state == ADV_MONITOR_STATE_NOT_REGISTERED) 4657 monitor->state = ADV_MONITOR_STATE_REGISTERED; 4658 hci_update_passive_scan(hdev); 4659 } 4660 4661 err = mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, 4662 mgmt_status(status), &rp, sizeof(rp)); 4663 mgmt_pending_remove(cmd); 4664 4665 done: 4666 hci_dev_unlock(hdev); 4667 bt_dev_dbg(hdev, "add monitor %d complete, status %u", 4668 rp.monitor_handle, status); 4669 4670 return err; 4671 } 4672 4673 static int __add_adv_patterns_monitor(struct sock *sk, struct hci_dev *hdev, 4674 struct adv_monitor *m, u8 status, 4675 void *data, u16 len, u16 op) 4676 { 4677 struct mgmt_rp_add_adv_patterns_monitor rp; 4678 struct mgmt_pending_cmd *cmd; 4679 int err; 4680 bool pending; 4681 4682 hci_dev_lock(hdev); 4683 4684 if (status) 4685 goto unlock; 4686 4687 if (pending_find(MGMT_OP_SET_LE, hdev) || 4688 pending_find(MGMT_OP_ADD_ADV_PATTERNS_MONITOR, hdev) || 4689 pending_find(MGMT_OP_ADD_ADV_PATTERNS_MONITOR_RSSI, hdev) || 4690 pending_find(MGMT_OP_REMOVE_ADV_MONITOR, hdev)) { 4691 status = MGMT_STATUS_BUSY; 4692 goto unlock; 4693 } 4694 4695 cmd = mgmt_pending_add(sk, op, hdev, data, len); 4696 if (!cmd) { 4697 status = MGMT_STATUS_NO_RESOURCES; 4698 goto unlock; 4699 } 4700 4701 cmd->user_data = m; 4702 pending = hci_add_adv_monitor(hdev, m, &err); 4703 if (err) { 4704 if (err == -ENOSPC || err == -ENOMEM) 4705 status = MGMT_STATUS_NO_RESOURCES; 4706 else if (err == -EINVAL) 4707 status = MGMT_STATUS_INVALID_PARAMS; 4708 else 4709 status = MGMT_STATUS_FAILED; 4710 4711 mgmt_pending_remove(cmd); 4712 goto unlock; 4713 } 4714 4715 if (!pending) { 4716 mgmt_pending_remove(cmd); 4717 rp.monitor_handle = cpu_to_le16(m->handle); 4718 mgmt_adv_monitor_added(sk, hdev, m->handle); 4719 m->state = ADV_MONITOR_STATE_REGISTERED; 4720 hdev->adv_monitors_cnt++; 4721 4722 hci_dev_unlock(hdev); 4723 return mgmt_cmd_complete(sk, hdev->id, op, MGMT_STATUS_SUCCESS, 4724 &rp, sizeof(rp)); 4725 } 4726 4727 hci_dev_unlock(hdev); 4728 4729 return 0; 4730 4731 unlock: 4732 hci_free_adv_monitor(hdev, m); 4733 hci_dev_unlock(hdev); 4734 return mgmt_cmd_status(sk, hdev->id, op, status); 4735 } 4736 4737 static void parse_adv_monitor_rssi(struct adv_monitor *m, 4738 struct mgmt_adv_rssi_thresholds *rssi) 4739 { 4740 if (rssi) { 4741 m->rssi.low_threshold = rssi->low_threshold; 4742 m->rssi.low_threshold_timeout = 4743 __le16_to_cpu(rssi->low_threshold_timeout); 4744 m->rssi.high_threshold = rssi->high_threshold; 4745 m->rssi.high_threshold_timeout = 4746 __le16_to_cpu(rssi->high_threshold_timeout); 4747 m->rssi.sampling_period = rssi->sampling_period; 4748 } else { 4749 /* Default values. These numbers are the least constricting 4750 * parameters for MSFT API to work, so it behaves as if there 4751 * are no rssi parameter to consider. May need to be changed 4752 * if other API are to be supported. 4753 */ 4754 m->rssi.low_threshold = -127; 4755 m->rssi.low_threshold_timeout = 60; 4756 m->rssi.high_threshold = -127; 4757 m->rssi.high_threshold_timeout = 0; 4758 m->rssi.sampling_period = 0; 4759 } 4760 } 4761 4762 static u8 parse_adv_monitor_pattern(struct adv_monitor *m, u8 pattern_count, 4763 struct mgmt_adv_pattern *patterns) 4764 { 4765 u8 offset = 0, length = 0; 4766 struct adv_pattern *p = NULL; 4767 int i; 4768 4769 for (i = 0; i < pattern_count; i++) { 4770 offset = patterns[i].offset; 4771 length = patterns[i].length; 4772 if (offset >= HCI_MAX_AD_LENGTH || 4773 length > HCI_MAX_AD_LENGTH || 4774 (offset + length) > HCI_MAX_AD_LENGTH) 4775 return MGMT_STATUS_INVALID_PARAMS; 4776 4777 p = kmalloc(sizeof(*p), GFP_KERNEL); 4778 if (!p) 4779 return MGMT_STATUS_NO_RESOURCES; 4780 4781 p->ad_type = patterns[i].ad_type; 4782 p->offset = patterns[i].offset; 4783 p->length = patterns[i].length; 4784 memcpy(p->value, patterns[i].value, p->length); 4785 4786 INIT_LIST_HEAD(&p->list); 4787 list_add(&p->list, &m->patterns); 4788 } 4789 4790 return MGMT_STATUS_SUCCESS; 4791 } 4792 4793 static int add_adv_patterns_monitor(struct sock *sk, struct hci_dev *hdev, 4794 void *data, u16 len) 4795 { 4796 struct mgmt_cp_add_adv_patterns_monitor *cp = data; 4797 struct adv_monitor *m = NULL; 4798 u8 status = MGMT_STATUS_SUCCESS; 4799 size_t expected_size = sizeof(*cp); 4800 4801 BT_DBG("request for %s", hdev->name); 4802 4803 if (len <= sizeof(*cp)) { 4804 status = MGMT_STATUS_INVALID_PARAMS; 4805 goto done; 4806 } 4807 4808 expected_size += cp->pattern_count * sizeof(struct mgmt_adv_pattern); 4809 if (len != expected_size) { 4810 status = MGMT_STATUS_INVALID_PARAMS; 4811 goto done; 4812 } 4813 4814 m = kzalloc(sizeof(*m), GFP_KERNEL); 4815 if (!m) { 4816 status = MGMT_STATUS_NO_RESOURCES; 4817 goto done; 4818 } 4819 4820 INIT_LIST_HEAD(&m->patterns); 4821 4822 parse_adv_monitor_rssi(m, NULL); 4823 status = parse_adv_monitor_pattern(m, cp->pattern_count, cp->patterns); 4824 4825 done: 4826 return __add_adv_patterns_monitor(sk, hdev, m, status, data, len, 4827 MGMT_OP_ADD_ADV_PATTERNS_MONITOR); 4828 } 4829 4830 static int add_adv_patterns_monitor_rssi(struct sock *sk, struct hci_dev *hdev, 4831 void *data, u16 len) 4832 { 4833 struct mgmt_cp_add_adv_patterns_monitor_rssi *cp = data; 4834 struct adv_monitor *m = NULL; 4835 u8 status = MGMT_STATUS_SUCCESS; 4836 size_t expected_size = sizeof(*cp); 4837 4838 BT_DBG("request for %s", hdev->name); 4839 4840 if (len <= sizeof(*cp)) { 4841 status = MGMT_STATUS_INVALID_PARAMS; 4842 goto done; 4843 } 4844 4845 expected_size += cp->pattern_count * sizeof(struct mgmt_adv_pattern); 4846 if (len != expected_size) { 4847 status = MGMT_STATUS_INVALID_PARAMS; 4848 goto done; 4849 } 4850 4851 m = kzalloc(sizeof(*m), GFP_KERNEL); 4852 if (!m) { 4853 status = MGMT_STATUS_NO_RESOURCES; 4854 goto done; 4855 } 4856 4857 INIT_LIST_HEAD(&m->patterns); 4858 4859 parse_adv_monitor_rssi(m, &cp->rssi); 4860 status = parse_adv_monitor_pattern(m, cp->pattern_count, cp->patterns); 4861 4862 done: 4863 return __add_adv_patterns_monitor(sk, hdev, m, status, data, len, 4864 MGMT_OP_ADD_ADV_PATTERNS_MONITOR_RSSI); 4865 } 4866 4867 int mgmt_remove_adv_monitor_complete(struct hci_dev *hdev, u8 status) 4868 { 4869 struct mgmt_rp_remove_adv_monitor rp; 4870 struct mgmt_cp_remove_adv_monitor *cp; 4871 struct mgmt_pending_cmd *cmd; 4872 int err = 0; 4873 4874 hci_dev_lock(hdev); 4875 4876 cmd = pending_find(MGMT_OP_REMOVE_ADV_MONITOR, hdev); 4877 if (!cmd) 4878 goto done; 4879 4880 cp = cmd->param; 4881 rp.monitor_handle = cp->monitor_handle; 4882 4883 if (!status) 4884 hci_update_passive_scan(hdev); 4885 4886 err = mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, 4887 mgmt_status(status), &rp, sizeof(rp)); 4888 mgmt_pending_remove(cmd); 4889 4890 done: 4891 hci_dev_unlock(hdev); 4892 bt_dev_dbg(hdev, "remove monitor %d complete, status %u", 4893 rp.monitor_handle, status); 4894 4895 return err; 4896 } 4897 4898 static int remove_adv_monitor(struct sock *sk, struct hci_dev *hdev, 4899 void *data, u16 len) 4900 { 4901 struct mgmt_cp_remove_adv_monitor *cp = data; 4902 struct mgmt_rp_remove_adv_monitor rp; 4903 struct mgmt_pending_cmd *cmd; 4904 u16 handle = __le16_to_cpu(cp->monitor_handle); 4905 int err, status; 4906 bool pending; 4907 4908 BT_DBG("request for %s", hdev->name); 4909 rp.monitor_handle = cp->monitor_handle; 4910 4911 hci_dev_lock(hdev); 4912 4913 if (pending_find(MGMT_OP_SET_LE, hdev) || 4914 pending_find(MGMT_OP_REMOVE_ADV_MONITOR, hdev) || 4915 pending_find(MGMT_OP_ADD_ADV_PATTERNS_MONITOR, hdev) || 4916 pending_find(MGMT_OP_ADD_ADV_PATTERNS_MONITOR_RSSI, hdev)) { 4917 status = MGMT_STATUS_BUSY; 4918 goto unlock; 4919 } 4920 4921 cmd = mgmt_pending_add(sk, MGMT_OP_REMOVE_ADV_MONITOR, hdev, data, len); 4922 if (!cmd) { 4923 status = MGMT_STATUS_NO_RESOURCES; 4924 goto unlock; 4925 } 4926 4927 if (handle) 4928 pending = hci_remove_single_adv_monitor(hdev, handle, &err); 4929 else 4930 pending = hci_remove_all_adv_monitor(hdev, &err); 4931 4932 if (err) { 4933 mgmt_pending_remove(cmd); 4934 4935 if (err == -ENOENT) 4936 status = MGMT_STATUS_INVALID_INDEX; 4937 else 4938 status = MGMT_STATUS_FAILED; 4939 4940 goto unlock; 4941 } 4942 4943 /* monitor can be removed without forwarding request to controller */ 4944 if (!pending) { 4945 mgmt_pending_remove(cmd); 4946 hci_dev_unlock(hdev); 4947 4948 return mgmt_cmd_complete(sk, hdev->id, 4949 MGMT_OP_REMOVE_ADV_MONITOR, 4950 MGMT_STATUS_SUCCESS, 4951 &rp, sizeof(rp)); 4952 } 4953 4954 hci_dev_unlock(hdev); 4955 return 0; 4956 4957 unlock: 4958 hci_dev_unlock(hdev); 4959 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_ADV_MONITOR, 4960 status); 4961 } 4962 4963 static void read_local_oob_data_complete(struct hci_dev *hdev, void *data, int err) 4964 { 4965 struct mgmt_rp_read_local_oob_data mgmt_rp; 4966 size_t rp_size = sizeof(mgmt_rp); 4967 struct mgmt_pending_cmd *cmd = data; 4968 struct sk_buff *skb = cmd->skb; 4969 u8 status = mgmt_status(err); 4970 4971 if (!status) { 4972 if (!skb) 4973 status = MGMT_STATUS_FAILED; 4974 else if (IS_ERR(skb)) 4975 status = mgmt_status(PTR_ERR(skb)); 4976 else 4977 status = mgmt_status(skb->data[0]); 4978 } 4979 4980 bt_dev_dbg(hdev, "status %d", status); 4981 4982 if (status) { 4983 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA, status); 4984 goto remove; 4985 } 4986 4987 memset(&mgmt_rp, 0, sizeof(mgmt_rp)); 4988 4989 if (!bredr_sc_enabled(hdev)) { 4990 struct hci_rp_read_local_oob_data *rp = (void *) skb->data; 4991 4992 if (skb->len < sizeof(*rp)) { 4993 mgmt_cmd_status(cmd->sk, hdev->id, 4994 MGMT_OP_READ_LOCAL_OOB_DATA, 4995 MGMT_STATUS_FAILED); 4996 goto remove; 4997 } 4998 4999 memcpy(mgmt_rp.hash192, rp->hash, sizeof(rp->hash)); 5000 memcpy(mgmt_rp.rand192, rp->rand, sizeof(rp->rand)); 5001 5002 rp_size -= sizeof(mgmt_rp.hash256) + sizeof(mgmt_rp.rand256); 5003 } else { 5004 struct hci_rp_read_local_oob_ext_data *rp = (void *) skb->data; 5005 5006 if (skb->len < sizeof(*rp)) { 5007 mgmt_cmd_status(cmd->sk, hdev->id, 5008 MGMT_OP_READ_LOCAL_OOB_DATA, 5009 MGMT_STATUS_FAILED); 5010 goto remove; 5011 } 5012 5013 memcpy(mgmt_rp.hash192, rp->hash192, sizeof(rp->hash192)); 5014 memcpy(mgmt_rp.rand192, rp->rand192, sizeof(rp->rand192)); 5015 5016 memcpy(mgmt_rp.hash256, rp->hash256, sizeof(rp->hash256)); 5017 memcpy(mgmt_rp.rand256, rp->rand256, sizeof(rp->rand256)); 5018 } 5019 5020 mgmt_cmd_complete(cmd->sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA, 5021 MGMT_STATUS_SUCCESS, &mgmt_rp, rp_size); 5022 5023 remove: 5024 if (skb && !IS_ERR(skb)) 5025 kfree_skb(skb); 5026 5027 mgmt_pending_free(cmd); 5028 } 5029 5030 static int read_local_oob_data_sync(struct hci_dev *hdev, void *data) 5031 { 5032 struct mgmt_pending_cmd *cmd = data; 5033 5034 if (bredr_sc_enabled(hdev)) 5035 cmd->skb = hci_read_local_oob_data_sync(hdev, true, cmd->sk); 5036 else 5037 cmd->skb = hci_read_local_oob_data_sync(hdev, false, cmd->sk); 5038 5039 if (IS_ERR(cmd->skb)) 5040 return PTR_ERR(cmd->skb); 5041 else 5042 return 0; 5043 } 5044 5045 static int read_local_oob_data(struct sock *sk, struct hci_dev *hdev, 5046 void *data, u16 data_len) 5047 { 5048 struct mgmt_pending_cmd *cmd; 5049 int err; 5050 5051 bt_dev_dbg(hdev, "sock %p", sk); 5052 5053 hci_dev_lock(hdev); 5054 5055 if (!hdev_is_powered(hdev)) { 5056 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA, 5057 MGMT_STATUS_NOT_POWERED); 5058 goto unlock; 5059 } 5060 5061 if (!lmp_ssp_capable(hdev)) { 5062 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA, 5063 MGMT_STATUS_NOT_SUPPORTED); 5064 goto unlock; 5065 } 5066 5067 cmd = mgmt_pending_new(sk, MGMT_OP_READ_LOCAL_OOB_DATA, hdev, NULL, 0); 5068 if (!cmd) 5069 err = -ENOMEM; 5070 else 5071 err = hci_cmd_sync_queue(hdev, read_local_oob_data_sync, cmd, 5072 read_local_oob_data_complete); 5073 5074 if (err < 0) { 5075 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA, 5076 MGMT_STATUS_FAILED); 5077 5078 if (cmd) 5079 mgmt_pending_free(cmd); 5080 } 5081 5082 unlock: 5083 hci_dev_unlock(hdev); 5084 return err; 5085 } 5086 5087 static int add_remote_oob_data(struct sock *sk, struct hci_dev *hdev, 5088 void *data, u16 len) 5089 { 5090 struct mgmt_addr_info *addr = data; 5091 int err; 5092 5093 bt_dev_dbg(hdev, "sock %p", sk); 5094 5095 if (!bdaddr_type_is_valid(addr->type)) 5096 return mgmt_cmd_complete(sk, hdev->id, 5097 MGMT_OP_ADD_REMOTE_OOB_DATA, 5098 MGMT_STATUS_INVALID_PARAMS, 5099 addr, sizeof(*addr)); 5100 5101 hci_dev_lock(hdev); 5102 5103 if (len == MGMT_ADD_REMOTE_OOB_DATA_SIZE) { 5104 struct mgmt_cp_add_remote_oob_data *cp = data; 5105 u8 status; 5106 5107 if (cp->addr.type != BDADDR_BREDR) { 5108 err = mgmt_cmd_complete(sk, hdev->id, 5109 MGMT_OP_ADD_REMOTE_OOB_DATA, 5110 MGMT_STATUS_INVALID_PARAMS, 5111 &cp->addr, sizeof(cp->addr)); 5112 goto unlock; 5113 } 5114 5115 err = hci_add_remote_oob_data(hdev, &cp->addr.bdaddr, 5116 cp->addr.type, cp->hash, 5117 cp->rand, NULL, NULL); 5118 if (err < 0) 5119 status = MGMT_STATUS_FAILED; 5120 else 5121 status = MGMT_STATUS_SUCCESS; 5122 5123 err = mgmt_cmd_complete(sk, hdev->id, 5124 MGMT_OP_ADD_REMOTE_OOB_DATA, status, 5125 &cp->addr, sizeof(cp->addr)); 5126 } else if (len == MGMT_ADD_REMOTE_OOB_EXT_DATA_SIZE) { 5127 struct mgmt_cp_add_remote_oob_ext_data *cp = data; 5128 u8 *rand192, *hash192, *rand256, *hash256; 5129 u8 status; 5130 5131 if (bdaddr_type_is_le(cp->addr.type)) { 5132 /* Enforce zero-valued 192-bit parameters as 5133 * long as legacy SMP OOB isn't implemented. 5134 */ 5135 if (memcmp(cp->rand192, ZERO_KEY, 16) || 5136 memcmp(cp->hash192, ZERO_KEY, 16)) { 5137 err = mgmt_cmd_complete(sk, hdev->id, 5138 MGMT_OP_ADD_REMOTE_OOB_DATA, 5139 MGMT_STATUS_INVALID_PARAMS, 5140 addr, sizeof(*addr)); 5141 goto unlock; 5142 } 5143 5144 rand192 = NULL; 5145 hash192 = NULL; 5146 } else { 5147 /* In case one of the P-192 values is set to zero, 5148 * then just disable OOB data for P-192. 5149 */ 5150 if (!memcmp(cp->rand192, ZERO_KEY, 16) || 5151 !memcmp(cp->hash192, ZERO_KEY, 16)) { 5152 rand192 = NULL; 5153 hash192 = NULL; 5154 } else { 5155 rand192 = cp->rand192; 5156 hash192 = cp->hash192; 5157 } 5158 } 5159 5160 /* In case one of the P-256 values is set to zero, then just 5161 * disable OOB data for P-256. 5162 */ 5163 if (!memcmp(cp->rand256, ZERO_KEY, 16) || 5164 !memcmp(cp->hash256, ZERO_KEY, 16)) { 5165 rand256 = NULL; 5166 hash256 = NULL; 5167 } else { 5168 rand256 = cp->rand256; 5169 hash256 = cp->hash256; 5170 } 5171 5172 err = hci_add_remote_oob_data(hdev, &cp->addr.bdaddr, 5173 cp->addr.type, hash192, rand192, 5174 hash256, rand256); 5175 if (err < 0) 5176 status = MGMT_STATUS_FAILED; 5177 else 5178 status = MGMT_STATUS_SUCCESS; 5179 5180 err = mgmt_cmd_complete(sk, hdev->id, 5181 MGMT_OP_ADD_REMOTE_OOB_DATA, 5182 status, &cp->addr, sizeof(cp->addr)); 5183 } else { 5184 bt_dev_err(hdev, "add_remote_oob_data: invalid len of %u bytes", 5185 len); 5186 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_REMOTE_OOB_DATA, 5187 MGMT_STATUS_INVALID_PARAMS); 5188 } 5189 5190 unlock: 5191 hci_dev_unlock(hdev); 5192 return err; 5193 } 5194 5195 static int remove_remote_oob_data(struct sock *sk, struct hci_dev *hdev, 5196 void *data, u16 len) 5197 { 5198 struct mgmt_cp_remove_remote_oob_data *cp = data; 5199 u8 status; 5200 int err; 5201 5202 bt_dev_dbg(hdev, "sock %p", sk); 5203 5204 if (cp->addr.type != BDADDR_BREDR) 5205 return mgmt_cmd_complete(sk, hdev->id, 5206 MGMT_OP_REMOVE_REMOTE_OOB_DATA, 5207 MGMT_STATUS_INVALID_PARAMS, 5208 &cp->addr, sizeof(cp->addr)); 5209 5210 hci_dev_lock(hdev); 5211 5212 if (!bacmp(&cp->addr.bdaddr, BDADDR_ANY)) { 5213 hci_remote_oob_data_clear(hdev); 5214 status = MGMT_STATUS_SUCCESS; 5215 goto done; 5216 } 5217 5218 err = hci_remove_remote_oob_data(hdev, &cp->addr.bdaddr, cp->addr.type); 5219 if (err < 0) 5220 status = MGMT_STATUS_INVALID_PARAMS; 5221 else 5222 status = MGMT_STATUS_SUCCESS; 5223 5224 done: 5225 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_REMOTE_OOB_DATA, 5226 status, &cp->addr, sizeof(cp->addr)); 5227 5228 hci_dev_unlock(hdev); 5229 return err; 5230 } 5231 5232 void mgmt_start_discovery_complete(struct hci_dev *hdev, u8 status) 5233 { 5234 struct mgmt_pending_cmd *cmd; 5235 5236 bt_dev_dbg(hdev, "status %u", status); 5237 5238 hci_dev_lock(hdev); 5239 5240 cmd = pending_find(MGMT_OP_START_DISCOVERY, hdev); 5241 if (!cmd) 5242 cmd = pending_find(MGMT_OP_START_SERVICE_DISCOVERY, hdev); 5243 5244 if (!cmd) 5245 cmd = pending_find(MGMT_OP_START_LIMITED_DISCOVERY, hdev); 5246 5247 if (cmd) { 5248 cmd->cmd_complete(cmd, mgmt_status(status)); 5249 mgmt_pending_remove(cmd); 5250 } 5251 5252 hci_dev_unlock(hdev); 5253 } 5254 5255 static bool discovery_type_is_valid(struct hci_dev *hdev, uint8_t type, 5256 uint8_t *mgmt_status) 5257 { 5258 switch (type) { 5259 case DISCOV_TYPE_LE: 5260 *mgmt_status = mgmt_le_support(hdev); 5261 if (*mgmt_status) 5262 return false; 5263 break; 5264 case DISCOV_TYPE_INTERLEAVED: 5265 *mgmt_status = mgmt_le_support(hdev); 5266 if (*mgmt_status) 5267 return false; 5268 fallthrough; 5269 case DISCOV_TYPE_BREDR: 5270 *mgmt_status = mgmt_bredr_support(hdev); 5271 if (*mgmt_status) 5272 return false; 5273 break; 5274 default: 5275 *mgmt_status = MGMT_STATUS_INVALID_PARAMS; 5276 return false; 5277 } 5278 5279 return true; 5280 } 5281 5282 static void start_discovery_complete(struct hci_dev *hdev, void *data, int err) 5283 { 5284 struct mgmt_pending_cmd *cmd = data; 5285 5286 if (cmd != pending_find(MGMT_OP_START_DISCOVERY, hdev) && 5287 cmd != pending_find(MGMT_OP_START_LIMITED_DISCOVERY, hdev) && 5288 cmd != pending_find(MGMT_OP_START_SERVICE_DISCOVERY, hdev)) 5289 return; 5290 5291 bt_dev_dbg(hdev, "err %d", err); 5292 5293 mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, mgmt_status(err), 5294 cmd->param, 1); 5295 mgmt_pending_remove(cmd); 5296 5297 hci_discovery_set_state(hdev, err ? DISCOVERY_STOPPED: 5298 DISCOVERY_FINDING); 5299 } 5300 5301 static int start_discovery_sync(struct hci_dev *hdev, void *data) 5302 { 5303 return hci_start_discovery_sync(hdev); 5304 } 5305 5306 static int start_discovery_internal(struct sock *sk, struct hci_dev *hdev, 5307 u16 op, void *data, u16 len) 5308 { 5309 struct mgmt_cp_start_discovery *cp = data; 5310 struct mgmt_pending_cmd *cmd; 5311 u8 status; 5312 int err; 5313 5314 bt_dev_dbg(hdev, "sock %p", sk); 5315 5316 hci_dev_lock(hdev); 5317 5318 if (!hdev_is_powered(hdev)) { 5319 err = mgmt_cmd_complete(sk, hdev->id, op, 5320 MGMT_STATUS_NOT_POWERED, 5321 &cp->type, sizeof(cp->type)); 5322 goto failed; 5323 } 5324 5325 if (hdev->discovery.state != DISCOVERY_STOPPED || 5326 hci_dev_test_flag(hdev, HCI_PERIODIC_INQ)) { 5327 err = mgmt_cmd_complete(sk, hdev->id, op, MGMT_STATUS_BUSY, 5328 &cp->type, sizeof(cp->type)); 5329 goto failed; 5330 } 5331 5332 if (!discovery_type_is_valid(hdev, cp->type, &status)) { 5333 err = mgmt_cmd_complete(sk, hdev->id, op, status, 5334 &cp->type, sizeof(cp->type)); 5335 goto failed; 5336 } 5337 5338 /* Can't start discovery when it is paused */ 5339 if (hdev->discovery_paused) { 5340 err = mgmt_cmd_complete(sk, hdev->id, op, MGMT_STATUS_BUSY, 5341 &cp->type, sizeof(cp->type)); 5342 goto failed; 5343 } 5344 5345 /* Clear the discovery filter first to free any previously 5346 * allocated memory for the UUID list. 5347 */ 5348 hci_discovery_filter_clear(hdev); 5349 5350 hdev->discovery.type = cp->type; 5351 hdev->discovery.report_invalid_rssi = false; 5352 if (op == MGMT_OP_START_LIMITED_DISCOVERY) 5353 hdev->discovery.limited = true; 5354 else 5355 hdev->discovery.limited = false; 5356 5357 cmd = mgmt_pending_add(sk, op, hdev, data, len); 5358 if (!cmd) { 5359 err = -ENOMEM; 5360 goto failed; 5361 } 5362 5363 err = hci_cmd_sync_queue(hdev, start_discovery_sync, cmd, 5364 start_discovery_complete); 5365 if (err < 0) { 5366 mgmt_pending_remove(cmd); 5367 goto failed; 5368 } 5369 5370 hci_discovery_set_state(hdev, DISCOVERY_STARTING); 5371 5372 failed: 5373 hci_dev_unlock(hdev); 5374 return err; 5375 } 5376 5377 static int start_discovery(struct sock *sk, struct hci_dev *hdev, 5378 void *data, u16 len) 5379 { 5380 return start_discovery_internal(sk, hdev, MGMT_OP_START_DISCOVERY, 5381 data, len); 5382 } 5383 5384 static int start_limited_discovery(struct sock *sk, struct hci_dev *hdev, 5385 void *data, u16 len) 5386 { 5387 return start_discovery_internal(sk, hdev, 5388 MGMT_OP_START_LIMITED_DISCOVERY, 5389 data, len); 5390 } 5391 5392 static int start_service_discovery(struct sock *sk, struct hci_dev *hdev, 5393 void *data, u16 len) 5394 { 5395 struct mgmt_cp_start_service_discovery *cp = data; 5396 struct mgmt_pending_cmd *cmd; 5397 const u16 max_uuid_count = ((U16_MAX - sizeof(*cp)) / 16); 5398 u16 uuid_count, expected_len; 5399 u8 status; 5400 int err; 5401 5402 bt_dev_dbg(hdev, "sock %p", sk); 5403 5404 hci_dev_lock(hdev); 5405 5406 if (!hdev_is_powered(hdev)) { 5407 err = mgmt_cmd_complete(sk, hdev->id, 5408 MGMT_OP_START_SERVICE_DISCOVERY, 5409 MGMT_STATUS_NOT_POWERED, 5410 &cp->type, sizeof(cp->type)); 5411 goto failed; 5412 } 5413 5414 if (hdev->discovery.state != DISCOVERY_STOPPED || 5415 hci_dev_test_flag(hdev, HCI_PERIODIC_INQ)) { 5416 err = mgmt_cmd_complete(sk, hdev->id, 5417 MGMT_OP_START_SERVICE_DISCOVERY, 5418 MGMT_STATUS_BUSY, &cp->type, 5419 sizeof(cp->type)); 5420 goto failed; 5421 } 5422 5423 if (hdev->discovery_paused) { 5424 err = mgmt_cmd_complete(sk, hdev->id, 5425 MGMT_OP_START_SERVICE_DISCOVERY, 5426 MGMT_STATUS_BUSY, &cp->type, 5427 sizeof(cp->type)); 5428 goto failed; 5429 } 5430 5431 uuid_count = __le16_to_cpu(cp->uuid_count); 5432 if (uuid_count > max_uuid_count) { 5433 bt_dev_err(hdev, "service_discovery: too big uuid_count value %u", 5434 uuid_count); 5435 err = mgmt_cmd_complete(sk, hdev->id, 5436 MGMT_OP_START_SERVICE_DISCOVERY, 5437 MGMT_STATUS_INVALID_PARAMS, &cp->type, 5438 sizeof(cp->type)); 5439 goto failed; 5440 } 5441 5442 expected_len = sizeof(*cp) + uuid_count * 16; 5443 if (expected_len != len) { 5444 bt_dev_err(hdev, "service_discovery: expected %u bytes, got %u bytes", 5445 expected_len, len); 5446 err = mgmt_cmd_complete(sk, hdev->id, 5447 MGMT_OP_START_SERVICE_DISCOVERY, 5448 MGMT_STATUS_INVALID_PARAMS, &cp->type, 5449 sizeof(cp->type)); 5450 goto failed; 5451 } 5452 5453 if (!discovery_type_is_valid(hdev, cp->type, &status)) { 5454 err = mgmt_cmd_complete(sk, hdev->id, 5455 MGMT_OP_START_SERVICE_DISCOVERY, 5456 status, &cp->type, sizeof(cp->type)); 5457 goto failed; 5458 } 5459 5460 cmd = mgmt_pending_add(sk, MGMT_OP_START_SERVICE_DISCOVERY, 5461 hdev, data, len); 5462 if (!cmd) { 5463 err = -ENOMEM; 5464 goto failed; 5465 } 5466 5467 /* Clear the discovery filter first to free any previously 5468 * allocated memory for the UUID list. 5469 */ 5470 hci_discovery_filter_clear(hdev); 5471 5472 hdev->discovery.result_filtering = true; 5473 hdev->discovery.type = cp->type; 5474 hdev->discovery.rssi = cp->rssi; 5475 hdev->discovery.uuid_count = uuid_count; 5476 5477 if (uuid_count > 0) { 5478 hdev->discovery.uuids = kmemdup(cp->uuids, uuid_count * 16, 5479 GFP_KERNEL); 5480 if (!hdev->discovery.uuids) { 5481 err = mgmt_cmd_complete(sk, hdev->id, 5482 MGMT_OP_START_SERVICE_DISCOVERY, 5483 MGMT_STATUS_FAILED, 5484 &cp->type, sizeof(cp->type)); 5485 mgmt_pending_remove(cmd); 5486 goto failed; 5487 } 5488 } 5489 5490 err = hci_cmd_sync_queue(hdev, start_discovery_sync, cmd, 5491 start_discovery_complete); 5492 if (err < 0) { 5493 mgmt_pending_remove(cmd); 5494 goto failed; 5495 } 5496 5497 hci_discovery_set_state(hdev, DISCOVERY_STARTING); 5498 5499 failed: 5500 hci_dev_unlock(hdev); 5501 return err; 5502 } 5503 5504 void mgmt_stop_discovery_complete(struct hci_dev *hdev, u8 status) 5505 { 5506 struct mgmt_pending_cmd *cmd; 5507 5508 bt_dev_dbg(hdev, "status %u", status); 5509 5510 hci_dev_lock(hdev); 5511 5512 cmd = pending_find(MGMT_OP_STOP_DISCOVERY, hdev); 5513 if (cmd) { 5514 cmd->cmd_complete(cmd, mgmt_status(status)); 5515 mgmt_pending_remove(cmd); 5516 } 5517 5518 hci_dev_unlock(hdev); 5519 } 5520 5521 static void stop_discovery_complete(struct hci_dev *hdev, void *data, int err) 5522 { 5523 struct mgmt_pending_cmd *cmd = data; 5524 5525 if (cmd != pending_find(MGMT_OP_STOP_DISCOVERY, hdev)) 5526 return; 5527 5528 bt_dev_dbg(hdev, "err %d", err); 5529 5530 mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, mgmt_status(err), 5531 cmd->param, 1); 5532 mgmt_pending_remove(cmd); 5533 5534 if (!err) 5535 hci_discovery_set_state(hdev, DISCOVERY_STOPPED); 5536 } 5537 5538 static int stop_discovery_sync(struct hci_dev *hdev, void *data) 5539 { 5540 return hci_stop_discovery_sync(hdev); 5541 } 5542 5543 static int stop_discovery(struct sock *sk, struct hci_dev *hdev, void *data, 5544 u16 len) 5545 { 5546 struct mgmt_cp_stop_discovery *mgmt_cp = data; 5547 struct mgmt_pending_cmd *cmd; 5548 int err; 5549 5550 bt_dev_dbg(hdev, "sock %p", sk); 5551 5552 hci_dev_lock(hdev); 5553 5554 if (!hci_discovery_active(hdev)) { 5555 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY, 5556 MGMT_STATUS_REJECTED, &mgmt_cp->type, 5557 sizeof(mgmt_cp->type)); 5558 goto unlock; 5559 } 5560 5561 if (hdev->discovery.type != mgmt_cp->type) { 5562 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY, 5563 MGMT_STATUS_INVALID_PARAMS, 5564 &mgmt_cp->type, sizeof(mgmt_cp->type)); 5565 goto unlock; 5566 } 5567 5568 cmd = mgmt_pending_add(sk, MGMT_OP_STOP_DISCOVERY, hdev, data, len); 5569 if (!cmd) { 5570 err = -ENOMEM; 5571 goto unlock; 5572 } 5573 5574 err = hci_cmd_sync_queue(hdev, stop_discovery_sync, cmd, 5575 stop_discovery_complete); 5576 if (err < 0) { 5577 mgmt_pending_remove(cmd); 5578 goto unlock; 5579 } 5580 5581 hci_discovery_set_state(hdev, DISCOVERY_STOPPING); 5582 5583 unlock: 5584 hci_dev_unlock(hdev); 5585 return err; 5586 } 5587 5588 static int confirm_name(struct sock *sk, struct hci_dev *hdev, void *data, 5589 u16 len) 5590 { 5591 struct mgmt_cp_confirm_name *cp = data; 5592 struct inquiry_entry *e; 5593 int err; 5594 5595 bt_dev_dbg(hdev, "sock %p", sk); 5596 5597 hci_dev_lock(hdev); 5598 5599 if (!hci_discovery_active(hdev)) { 5600 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME, 5601 MGMT_STATUS_FAILED, &cp->addr, 5602 sizeof(cp->addr)); 5603 goto failed; 5604 } 5605 5606 e = hci_inquiry_cache_lookup_unknown(hdev, &cp->addr.bdaddr); 5607 if (!e) { 5608 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME, 5609 MGMT_STATUS_INVALID_PARAMS, &cp->addr, 5610 sizeof(cp->addr)); 5611 goto failed; 5612 } 5613 5614 if (cp->name_known) { 5615 e->name_state = NAME_KNOWN; 5616 list_del(&e->list); 5617 } else { 5618 e->name_state = NAME_NEEDED; 5619 hci_inquiry_cache_update_resolve(hdev, e); 5620 } 5621 5622 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME, 0, 5623 &cp->addr, sizeof(cp->addr)); 5624 5625 failed: 5626 hci_dev_unlock(hdev); 5627 return err; 5628 } 5629 5630 static int block_device(struct sock *sk, struct hci_dev *hdev, void *data, 5631 u16 len) 5632 { 5633 struct mgmt_cp_block_device *cp = data; 5634 u8 status; 5635 int err; 5636 5637 bt_dev_dbg(hdev, "sock %p", sk); 5638 5639 if (!bdaddr_type_is_valid(cp->addr.type)) 5640 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_BLOCK_DEVICE, 5641 MGMT_STATUS_INVALID_PARAMS, 5642 &cp->addr, sizeof(cp->addr)); 5643 5644 hci_dev_lock(hdev); 5645 5646 err = hci_bdaddr_list_add(&hdev->reject_list, &cp->addr.bdaddr, 5647 cp->addr.type); 5648 if (err < 0) { 5649 status = MGMT_STATUS_FAILED; 5650 goto done; 5651 } 5652 5653 mgmt_event(MGMT_EV_DEVICE_BLOCKED, hdev, &cp->addr, sizeof(cp->addr), 5654 sk); 5655 status = MGMT_STATUS_SUCCESS; 5656 5657 done: 5658 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_BLOCK_DEVICE, status, 5659 &cp->addr, sizeof(cp->addr)); 5660 5661 hci_dev_unlock(hdev); 5662 5663 return err; 5664 } 5665 5666 static int unblock_device(struct sock *sk, struct hci_dev *hdev, void *data, 5667 u16 len) 5668 { 5669 struct mgmt_cp_unblock_device *cp = data; 5670 u8 status; 5671 int err; 5672 5673 bt_dev_dbg(hdev, "sock %p", sk); 5674 5675 if (!bdaddr_type_is_valid(cp->addr.type)) 5676 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNBLOCK_DEVICE, 5677 MGMT_STATUS_INVALID_PARAMS, 5678 &cp->addr, sizeof(cp->addr)); 5679 5680 hci_dev_lock(hdev); 5681 5682 err = hci_bdaddr_list_del(&hdev->reject_list, &cp->addr.bdaddr, 5683 cp->addr.type); 5684 if (err < 0) { 5685 status = MGMT_STATUS_INVALID_PARAMS; 5686 goto done; 5687 } 5688 5689 mgmt_event(MGMT_EV_DEVICE_UNBLOCKED, hdev, &cp->addr, sizeof(cp->addr), 5690 sk); 5691 status = MGMT_STATUS_SUCCESS; 5692 5693 done: 5694 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNBLOCK_DEVICE, status, 5695 &cp->addr, sizeof(cp->addr)); 5696 5697 hci_dev_unlock(hdev); 5698 5699 return err; 5700 } 5701 5702 static int set_device_id_sync(struct hci_dev *hdev, void *data) 5703 { 5704 return hci_update_eir_sync(hdev); 5705 } 5706 5707 static int set_device_id(struct sock *sk, struct hci_dev *hdev, void *data, 5708 u16 len) 5709 { 5710 struct mgmt_cp_set_device_id *cp = data; 5711 int err; 5712 __u16 source; 5713 5714 bt_dev_dbg(hdev, "sock %p", sk); 5715 5716 source = __le16_to_cpu(cp->source); 5717 5718 if (source > 0x0002) 5719 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEVICE_ID, 5720 MGMT_STATUS_INVALID_PARAMS); 5721 5722 hci_dev_lock(hdev); 5723 5724 hdev->devid_source = source; 5725 hdev->devid_vendor = __le16_to_cpu(cp->vendor); 5726 hdev->devid_product = __le16_to_cpu(cp->product); 5727 hdev->devid_version = __le16_to_cpu(cp->version); 5728 5729 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_DEVICE_ID, 0, 5730 NULL, 0); 5731 5732 hci_cmd_sync_queue(hdev, set_device_id_sync, NULL, NULL); 5733 5734 hci_dev_unlock(hdev); 5735 5736 return err; 5737 } 5738 5739 static void enable_advertising_instance(struct hci_dev *hdev, int err) 5740 { 5741 if (err) 5742 bt_dev_err(hdev, "failed to re-configure advertising %d", err); 5743 else 5744 bt_dev_dbg(hdev, "status %d", err); 5745 } 5746 5747 static void set_advertising_complete(struct hci_dev *hdev, void *data, int err) 5748 { 5749 struct cmd_lookup match = { NULL, hdev }; 5750 u8 instance; 5751 struct adv_info *adv_instance; 5752 u8 status = mgmt_status(err); 5753 5754 if (status) { 5755 mgmt_pending_foreach(MGMT_OP_SET_ADVERTISING, hdev, 5756 cmd_status_rsp, &status); 5757 return; 5758 } 5759 5760 if (hci_dev_test_flag(hdev, HCI_LE_ADV)) 5761 hci_dev_set_flag(hdev, HCI_ADVERTISING); 5762 else 5763 hci_dev_clear_flag(hdev, HCI_ADVERTISING); 5764 5765 mgmt_pending_foreach(MGMT_OP_SET_ADVERTISING, hdev, settings_rsp, 5766 &match); 5767 5768 new_settings(hdev, match.sk); 5769 5770 if (match.sk) 5771 sock_put(match.sk); 5772 5773 /* If "Set Advertising" was just disabled and instance advertising was 5774 * set up earlier, then re-enable multi-instance advertising. 5775 */ 5776 if (hci_dev_test_flag(hdev, HCI_ADVERTISING) || 5777 list_empty(&hdev->adv_instances)) 5778 return; 5779 5780 instance = hdev->cur_adv_instance; 5781 if (!instance) { 5782 adv_instance = list_first_entry_or_null(&hdev->adv_instances, 5783 struct adv_info, list); 5784 if (!adv_instance) 5785 return; 5786 5787 instance = adv_instance->instance; 5788 } 5789 5790 err = hci_schedule_adv_instance_sync(hdev, instance, true); 5791 5792 enable_advertising_instance(hdev, err); 5793 } 5794 5795 static int set_adv_sync(struct hci_dev *hdev, void *data) 5796 { 5797 struct mgmt_pending_cmd *cmd = data; 5798 struct mgmt_mode *cp = cmd->param; 5799 u8 val = !!cp->val; 5800 5801 if (cp->val == 0x02) 5802 hci_dev_set_flag(hdev, HCI_ADVERTISING_CONNECTABLE); 5803 else 5804 hci_dev_clear_flag(hdev, HCI_ADVERTISING_CONNECTABLE); 5805 5806 cancel_adv_timeout(hdev); 5807 5808 if (val) { 5809 /* Switch to instance "0" for the Set Advertising setting. 5810 * We cannot use update_[adv|scan_rsp]_data() here as the 5811 * HCI_ADVERTISING flag is not yet set. 5812 */ 5813 hdev->cur_adv_instance = 0x00; 5814 5815 if (ext_adv_capable(hdev)) { 5816 hci_start_ext_adv_sync(hdev, 0x00); 5817 } else { 5818 hci_update_adv_data_sync(hdev, 0x00); 5819 hci_update_scan_rsp_data_sync(hdev, 0x00); 5820 hci_enable_advertising_sync(hdev); 5821 } 5822 } else { 5823 hci_disable_advertising_sync(hdev); 5824 } 5825 5826 return 0; 5827 } 5828 5829 static int set_advertising(struct sock *sk, struct hci_dev *hdev, void *data, 5830 u16 len) 5831 { 5832 struct mgmt_mode *cp = data; 5833 struct mgmt_pending_cmd *cmd; 5834 u8 val, status; 5835 int err; 5836 5837 bt_dev_dbg(hdev, "sock %p", sk); 5838 5839 status = mgmt_le_support(hdev); 5840 if (status) 5841 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING, 5842 status); 5843 5844 if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02) 5845 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING, 5846 MGMT_STATUS_INVALID_PARAMS); 5847 5848 if (hdev->advertising_paused) 5849 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING, 5850 MGMT_STATUS_BUSY); 5851 5852 hci_dev_lock(hdev); 5853 5854 val = !!cp->val; 5855 5856 /* The following conditions are ones which mean that we should 5857 * not do any HCI communication but directly send a mgmt 5858 * response to user space (after toggling the flag if 5859 * necessary). 5860 */ 5861 if (!hdev_is_powered(hdev) || 5862 (val == hci_dev_test_flag(hdev, HCI_ADVERTISING) && 5863 (cp->val == 0x02) == hci_dev_test_flag(hdev, HCI_ADVERTISING_CONNECTABLE)) || 5864 hci_conn_num(hdev, LE_LINK) > 0 || 5865 (hci_dev_test_flag(hdev, HCI_LE_SCAN) && 5866 hdev->le_scan_type == LE_SCAN_ACTIVE)) { 5867 bool changed; 5868 5869 if (cp->val) { 5870 hdev->cur_adv_instance = 0x00; 5871 changed = !hci_dev_test_and_set_flag(hdev, HCI_ADVERTISING); 5872 if (cp->val == 0x02) 5873 hci_dev_set_flag(hdev, HCI_ADVERTISING_CONNECTABLE); 5874 else 5875 hci_dev_clear_flag(hdev, HCI_ADVERTISING_CONNECTABLE); 5876 } else { 5877 changed = hci_dev_test_and_clear_flag(hdev, HCI_ADVERTISING); 5878 hci_dev_clear_flag(hdev, HCI_ADVERTISING_CONNECTABLE); 5879 } 5880 5881 err = send_settings_rsp(sk, MGMT_OP_SET_ADVERTISING, hdev); 5882 if (err < 0) 5883 goto unlock; 5884 5885 if (changed) 5886 err = new_settings(hdev, sk); 5887 5888 goto unlock; 5889 } 5890 5891 if (pending_find(MGMT_OP_SET_ADVERTISING, hdev) || 5892 pending_find(MGMT_OP_SET_LE, hdev)) { 5893 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING, 5894 MGMT_STATUS_BUSY); 5895 goto unlock; 5896 } 5897 5898 cmd = mgmt_pending_add(sk, MGMT_OP_SET_ADVERTISING, hdev, data, len); 5899 if (!cmd) 5900 err = -ENOMEM; 5901 else 5902 err = hci_cmd_sync_queue(hdev, set_adv_sync, cmd, 5903 set_advertising_complete); 5904 5905 if (err < 0 && cmd) 5906 mgmt_pending_remove(cmd); 5907 5908 unlock: 5909 hci_dev_unlock(hdev); 5910 return err; 5911 } 5912 5913 static int set_static_address(struct sock *sk, struct hci_dev *hdev, 5914 void *data, u16 len) 5915 { 5916 struct mgmt_cp_set_static_address *cp = data; 5917 int err; 5918 5919 bt_dev_dbg(hdev, "sock %p", sk); 5920 5921 if (!lmp_le_capable(hdev)) 5922 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_STATIC_ADDRESS, 5923 MGMT_STATUS_NOT_SUPPORTED); 5924 5925 if (hdev_is_powered(hdev)) 5926 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_STATIC_ADDRESS, 5927 MGMT_STATUS_REJECTED); 5928 5929 if (bacmp(&cp->bdaddr, BDADDR_ANY)) { 5930 if (!bacmp(&cp->bdaddr, BDADDR_NONE)) 5931 return mgmt_cmd_status(sk, hdev->id, 5932 MGMT_OP_SET_STATIC_ADDRESS, 5933 MGMT_STATUS_INVALID_PARAMS); 5934 5935 /* Two most significant bits shall be set */ 5936 if ((cp->bdaddr.b[5] & 0xc0) != 0xc0) 5937 return mgmt_cmd_status(sk, hdev->id, 5938 MGMT_OP_SET_STATIC_ADDRESS, 5939 MGMT_STATUS_INVALID_PARAMS); 5940 } 5941 5942 hci_dev_lock(hdev); 5943 5944 bacpy(&hdev->static_addr, &cp->bdaddr); 5945 5946 err = send_settings_rsp(sk, MGMT_OP_SET_STATIC_ADDRESS, hdev); 5947 if (err < 0) 5948 goto unlock; 5949 5950 err = new_settings(hdev, sk); 5951 5952 unlock: 5953 hci_dev_unlock(hdev); 5954 return err; 5955 } 5956 5957 static int set_scan_params(struct sock *sk, struct hci_dev *hdev, 5958 void *data, u16 len) 5959 { 5960 struct mgmt_cp_set_scan_params *cp = data; 5961 __u16 interval, window; 5962 int err; 5963 5964 bt_dev_dbg(hdev, "sock %p", sk); 5965 5966 if (!lmp_le_capable(hdev)) 5967 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS, 5968 MGMT_STATUS_NOT_SUPPORTED); 5969 5970 interval = __le16_to_cpu(cp->interval); 5971 5972 if (interval < 0x0004 || interval > 0x4000) 5973 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS, 5974 MGMT_STATUS_INVALID_PARAMS); 5975 5976 window = __le16_to_cpu(cp->window); 5977 5978 if (window < 0x0004 || window > 0x4000) 5979 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS, 5980 MGMT_STATUS_INVALID_PARAMS); 5981 5982 if (window > interval) 5983 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS, 5984 MGMT_STATUS_INVALID_PARAMS); 5985 5986 hci_dev_lock(hdev); 5987 5988 hdev->le_scan_interval = interval; 5989 hdev->le_scan_window = window; 5990 5991 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS, 0, 5992 NULL, 0); 5993 5994 /* If background scan is running, restart it so new parameters are 5995 * loaded. 5996 */ 5997 if (hci_dev_test_flag(hdev, HCI_LE_SCAN) && 5998 hdev->discovery.state == DISCOVERY_STOPPED) 5999 hci_update_passive_scan(hdev); 6000 6001 hci_dev_unlock(hdev); 6002 6003 return err; 6004 } 6005 6006 static void fast_connectable_complete(struct hci_dev *hdev, void *data, int err) 6007 { 6008 struct mgmt_pending_cmd *cmd = data; 6009 6010 bt_dev_dbg(hdev, "err %d", err); 6011 6012 if (err) { 6013 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE, 6014 mgmt_status(err)); 6015 } else { 6016 struct mgmt_mode *cp = cmd->param; 6017 6018 if (cp->val) 6019 hci_dev_set_flag(hdev, HCI_FAST_CONNECTABLE); 6020 else 6021 hci_dev_clear_flag(hdev, HCI_FAST_CONNECTABLE); 6022 6023 send_settings_rsp(cmd->sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev); 6024 new_settings(hdev, cmd->sk); 6025 } 6026 6027 mgmt_pending_free(cmd); 6028 } 6029 6030 static int write_fast_connectable_sync(struct hci_dev *hdev, void *data) 6031 { 6032 struct mgmt_pending_cmd *cmd = data; 6033 struct mgmt_mode *cp = cmd->param; 6034 6035 return hci_write_fast_connectable_sync(hdev, cp->val); 6036 } 6037 6038 static int set_fast_connectable(struct sock *sk, struct hci_dev *hdev, 6039 void *data, u16 len) 6040 { 6041 struct mgmt_mode *cp = data; 6042 struct mgmt_pending_cmd *cmd; 6043 int err; 6044 6045 bt_dev_dbg(hdev, "sock %p", sk); 6046 6047 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) || 6048 hdev->hci_ver < BLUETOOTH_VER_1_2) 6049 return mgmt_cmd_status(sk, hdev->id, 6050 MGMT_OP_SET_FAST_CONNECTABLE, 6051 MGMT_STATUS_NOT_SUPPORTED); 6052 6053 if (cp->val != 0x00 && cp->val != 0x01) 6054 return mgmt_cmd_status(sk, hdev->id, 6055 MGMT_OP_SET_FAST_CONNECTABLE, 6056 MGMT_STATUS_INVALID_PARAMS); 6057 6058 hci_dev_lock(hdev); 6059 6060 if (!!cp->val == hci_dev_test_flag(hdev, HCI_FAST_CONNECTABLE)) { 6061 err = send_settings_rsp(sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev); 6062 goto unlock; 6063 } 6064 6065 if (!hdev_is_powered(hdev)) { 6066 hci_dev_change_flag(hdev, HCI_FAST_CONNECTABLE); 6067 err = send_settings_rsp(sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev); 6068 new_settings(hdev, sk); 6069 goto unlock; 6070 } 6071 6072 cmd = mgmt_pending_new(sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev, data, 6073 len); 6074 if (!cmd) 6075 err = -ENOMEM; 6076 else 6077 err = hci_cmd_sync_queue(hdev, write_fast_connectable_sync, cmd, 6078 fast_connectable_complete); 6079 6080 if (err < 0) { 6081 mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE, 6082 MGMT_STATUS_FAILED); 6083 6084 if (cmd) 6085 mgmt_pending_free(cmd); 6086 } 6087 6088 unlock: 6089 hci_dev_unlock(hdev); 6090 6091 return err; 6092 } 6093 6094 static void set_bredr_complete(struct hci_dev *hdev, void *data, int err) 6095 { 6096 struct mgmt_pending_cmd *cmd = data; 6097 6098 bt_dev_dbg(hdev, "err %d", err); 6099 6100 if (err) { 6101 u8 mgmt_err = mgmt_status(err); 6102 6103 /* We need to restore the flag if related HCI commands 6104 * failed. 6105 */ 6106 hci_dev_clear_flag(hdev, HCI_BREDR_ENABLED); 6107 6108 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err); 6109 } else { 6110 send_settings_rsp(cmd->sk, MGMT_OP_SET_BREDR, hdev); 6111 new_settings(hdev, cmd->sk); 6112 } 6113 6114 mgmt_pending_free(cmd); 6115 } 6116 6117 static int set_bredr_sync(struct hci_dev *hdev, void *data) 6118 { 6119 int status; 6120 6121 status = hci_write_fast_connectable_sync(hdev, false); 6122 6123 if (!status) 6124 status = hci_update_scan_sync(hdev); 6125 6126 /* Since only the advertising data flags will change, there 6127 * is no need to update the scan response data. 6128 */ 6129 if (!status) 6130 status = hci_update_adv_data_sync(hdev, hdev->cur_adv_instance); 6131 6132 return status; 6133 } 6134 6135 static int set_bredr(struct sock *sk, struct hci_dev *hdev, void *data, u16 len) 6136 { 6137 struct mgmt_mode *cp = data; 6138 struct mgmt_pending_cmd *cmd; 6139 int err; 6140 6141 bt_dev_dbg(hdev, "sock %p", sk); 6142 6143 if (!lmp_bredr_capable(hdev) || !lmp_le_capable(hdev)) 6144 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR, 6145 MGMT_STATUS_NOT_SUPPORTED); 6146 6147 if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED)) 6148 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR, 6149 MGMT_STATUS_REJECTED); 6150 6151 if (cp->val != 0x00 && cp->val != 0x01) 6152 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR, 6153 MGMT_STATUS_INVALID_PARAMS); 6154 6155 hci_dev_lock(hdev); 6156 6157 if (cp->val == hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) { 6158 err = send_settings_rsp(sk, MGMT_OP_SET_BREDR, hdev); 6159 goto unlock; 6160 } 6161 6162 if (!hdev_is_powered(hdev)) { 6163 if (!cp->val) { 6164 hci_dev_clear_flag(hdev, HCI_DISCOVERABLE); 6165 hci_dev_clear_flag(hdev, HCI_SSP_ENABLED); 6166 hci_dev_clear_flag(hdev, HCI_LINK_SECURITY); 6167 hci_dev_clear_flag(hdev, HCI_FAST_CONNECTABLE); 6168 hci_dev_clear_flag(hdev, HCI_HS_ENABLED); 6169 } 6170 6171 hci_dev_change_flag(hdev, HCI_BREDR_ENABLED); 6172 6173 err = send_settings_rsp(sk, MGMT_OP_SET_BREDR, hdev); 6174 if (err < 0) 6175 goto unlock; 6176 6177 err = new_settings(hdev, sk); 6178 goto unlock; 6179 } 6180 6181 /* Reject disabling when powered on */ 6182 if (!cp->val) { 6183 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR, 6184 MGMT_STATUS_REJECTED); 6185 goto unlock; 6186 } else { 6187 /* When configuring a dual-mode controller to operate 6188 * with LE only and using a static address, then switching 6189 * BR/EDR back on is not allowed. 6190 * 6191 * Dual-mode controllers shall operate with the public 6192 * address as its identity address for BR/EDR and LE. So 6193 * reject the attempt to create an invalid configuration. 6194 * 6195 * The same restrictions applies when secure connections 6196 * has been enabled. For BR/EDR this is a controller feature 6197 * while for LE it is a host stack feature. This means that 6198 * switching BR/EDR back on when secure connections has been 6199 * enabled is not a supported transaction. 6200 */ 6201 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) && 6202 (bacmp(&hdev->static_addr, BDADDR_ANY) || 6203 hci_dev_test_flag(hdev, HCI_SC_ENABLED))) { 6204 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR, 6205 MGMT_STATUS_REJECTED); 6206 goto unlock; 6207 } 6208 } 6209 6210 cmd = mgmt_pending_new(sk, MGMT_OP_SET_BREDR, hdev, data, len); 6211 if (!cmd) 6212 err = -ENOMEM; 6213 else 6214 err = hci_cmd_sync_queue(hdev, set_bredr_sync, cmd, 6215 set_bredr_complete); 6216 6217 if (err < 0) { 6218 mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR, 6219 MGMT_STATUS_FAILED); 6220 if (cmd) 6221 mgmt_pending_free(cmd); 6222 6223 goto unlock; 6224 } 6225 6226 /* We need to flip the bit already here so that 6227 * hci_req_update_adv_data generates the correct flags. 6228 */ 6229 hci_dev_set_flag(hdev, HCI_BREDR_ENABLED); 6230 6231 unlock: 6232 hci_dev_unlock(hdev); 6233 return err; 6234 } 6235 6236 static void set_secure_conn_complete(struct hci_dev *hdev, void *data, int err) 6237 { 6238 struct mgmt_pending_cmd *cmd = data; 6239 struct mgmt_mode *cp; 6240 6241 bt_dev_dbg(hdev, "err %d", err); 6242 6243 if (err) { 6244 u8 mgmt_err = mgmt_status(err); 6245 6246 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err); 6247 goto done; 6248 } 6249 6250 cp = cmd->param; 6251 6252 switch (cp->val) { 6253 case 0x00: 6254 hci_dev_clear_flag(hdev, HCI_SC_ENABLED); 6255 hci_dev_clear_flag(hdev, HCI_SC_ONLY); 6256 break; 6257 case 0x01: 6258 hci_dev_set_flag(hdev, HCI_SC_ENABLED); 6259 hci_dev_clear_flag(hdev, HCI_SC_ONLY); 6260 break; 6261 case 0x02: 6262 hci_dev_set_flag(hdev, HCI_SC_ENABLED); 6263 hci_dev_set_flag(hdev, HCI_SC_ONLY); 6264 break; 6265 } 6266 6267 send_settings_rsp(cmd->sk, cmd->opcode, hdev); 6268 new_settings(hdev, cmd->sk); 6269 6270 done: 6271 mgmt_pending_free(cmd); 6272 } 6273 6274 static int set_secure_conn_sync(struct hci_dev *hdev, void *data) 6275 { 6276 struct mgmt_pending_cmd *cmd = data; 6277 struct mgmt_mode *cp = cmd->param; 6278 u8 val = !!cp->val; 6279 6280 /* Force write of val */ 6281 hci_dev_set_flag(hdev, HCI_SC_ENABLED); 6282 6283 return hci_write_sc_support_sync(hdev, val); 6284 } 6285 6286 static int set_secure_conn(struct sock *sk, struct hci_dev *hdev, 6287 void *data, u16 len) 6288 { 6289 struct mgmt_mode *cp = data; 6290 struct mgmt_pending_cmd *cmd; 6291 u8 val; 6292 int err; 6293 6294 bt_dev_dbg(hdev, "sock %p", sk); 6295 6296 if (!lmp_sc_capable(hdev) && 6297 !hci_dev_test_flag(hdev, HCI_LE_ENABLED)) 6298 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN, 6299 MGMT_STATUS_NOT_SUPPORTED); 6300 6301 if (hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) && 6302 lmp_sc_capable(hdev) && 6303 !hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) 6304 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN, 6305 MGMT_STATUS_REJECTED); 6306 6307 if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02) 6308 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN, 6309 MGMT_STATUS_INVALID_PARAMS); 6310 6311 hci_dev_lock(hdev); 6312 6313 if (!hdev_is_powered(hdev) || !lmp_sc_capable(hdev) || 6314 !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) { 6315 bool changed; 6316 6317 if (cp->val) { 6318 changed = !hci_dev_test_and_set_flag(hdev, 6319 HCI_SC_ENABLED); 6320 if (cp->val == 0x02) 6321 hci_dev_set_flag(hdev, HCI_SC_ONLY); 6322 else 6323 hci_dev_clear_flag(hdev, HCI_SC_ONLY); 6324 } else { 6325 changed = hci_dev_test_and_clear_flag(hdev, 6326 HCI_SC_ENABLED); 6327 hci_dev_clear_flag(hdev, HCI_SC_ONLY); 6328 } 6329 6330 err = send_settings_rsp(sk, MGMT_OP_SET_SECURE_CONN, hdev); 6331 if (err < 0) 6332 goto failed; 6333 6334 if (changed) 6335 err = new_settings(hdev, sk); 6336 6337 goto failed; 6338 } 6339 6340 val = !!cp->val; 6341 6342 if (val == hci_dev_test_flag(hdev, HCI_SC_ENABLED) && 6343 (cp->val == 0x02) == hci_dev_test_flag(hdev, HCI_SC_ONLY)) { 6344 err = send_settings_rsp(sk, MGMT_OP_SET_SECURE_CONN, hdev); 6345 goto failed; 6346 } 6347 6348 cmd = mgmt_pending_new(sk, MGMT_OP_SET_SECURE_CONN, hdev, data, len); 6349 if (!cmd) 6350 err = -ENOMEM; 6351 else 6352 err = hci_cmd_sync_queue(hdev, set_secure_conn_sync, cmd, 6353 set_secure_conn_complete); 6354 6355 if (err < 0) { 6356 mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN, 6357 MGMT_STATUS_FAILED); 6358 if (cmd) 6359 mgmt_pending_free(cmd); 6360 } 6361 6362 failed: 6363 hci_dev_unlock(hdev); 6364 return err; 6365 } 6366 6367 static int set_debug_keys(struct sock *sk, struct hci_dev *hdev, 6368 void *data, u16 len) 6369 { 6370 struct mgmt_mode *cp = data; 6371 bool changed, use_changed; 6372 int err; 6373 6374 bt_dev_dbg(hdev, "sock %p", sk); 6375 6376 if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02) 6377 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEBUG_KEYS, 6378 MGMT_STATUS_INVALID_PARAMS); 6379 6380 hci_dev_lock(hdev); 6381 6382 if (cp->val) 6383 changed = !hci_dev_test_and_set_flag(hdev, HCI_KEEP_DEBUG_KEYS); 6384 else 6385 changed = hci_dev_test_and_clear_flag(hdev, 6386 HCI_KEEP_DEBUG_KEYS); 6387 6388 if (cp->val == 0x02) 6389 use_changed = !hci_dev_test_and_set_flag(hdev, 6390 HCI_USE_DEBUG_KEYS); 6391 else 6392 use_changed = hci_dev_test_and_clear_flag(hdev, 6393 HCI_USE_DEBUG_KEYS); 6394 6395 if (hdev_is_powered(hdev) && use_changed && 6396 hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) { 6397 u8 mode = (cp->val == 0x02) ? 0x01 : 0x00; 6398 hci_send_cmd(hdev, HCI_OP_WRITE_SSP_DEBUG_MODE, 6399 sizeof(mode), &mode); 6400 } 6401 6402 err = send_settings_rsp(sk, MGMT_OP_SET_DEBUG_KEYS, hdev); 6403 if (err < 0) 6404 goto unlock; 6405 6406 if (changed) 6407 err = new_settings(hdev, sk); 6408 6409 unlock: 6410 hci_dev_unlock(hdev); 6411 return err; 6412 } 6413 6414 static int set_privacy(struct sock *sk, struct hci_dev *hdev, void *cp_data, 6415 u16 len) 6416 { 6417 struct mgmt_cp_set_privacy *cp = cp_data; 6418 bool changed; 6419 int err; 6420 6421 bt_dev_dbg(hdev, "sock %p", sk); 6422 6423 if (!lmp_le_capable(hdev)) 6424 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY, 6425 MGMT_STATUS_NOT_SUPPORTED); 6426 6427 if (cp->privacy != 0x00 && cp->privacy != 0x01 && cp->privacy != 0x02) 6428 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY, 6429 MGMT_STATUS_INVALID_PARAMS); 6430 6431 if (hdev_is_powered(hdev)) 6432 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY, 6433 MGMT_STATUS_REJECTED); 6434 6435 hci_dev_lock(hdev); 6436 6437 /* If user space supports this command it is also expected to 6438 * handle IRKs. Therefore, set the HCI_RPA_RESOLVING flag. 6439 */ 6440 hci_dev_set_flag(hdev, HCI_RPA_RESOLVING); 6441 6442 if (cp->privacy) { 6443 changed = !hci_dev_test_and_set_flag(hdev, HCI_PRIVACY); 6444 memcpy(hdev->irk, cp->irk, sizeof(hdev->irk)); 6445 hci_dev_set_flag(hdev, HCI_RPA_EXPIRED); 6446 hci_adv_instances_set_rpa_expired(hdev, true); 6447 if (cp->privacy == 0x02) 6448 hci_dev_set_flag(hdev, HCI_LIMITED_PRIVACY); 6449 else 6450 hci_dev_clear_flag(hdev, HCI_LIMITED_PRIVACY); 6451 } else { 6452 changed = hci_dev_test_and_clear_flag(hdev, HCI_PRIVACY); 6453 memset(hdev->irk, 0, sizeof(hdev->irk)); 6454 hci_dev_clear_flag(hdev, HCI_RPA_EXPIRED); 6455 hci_adv_instances_set_rpa_expired(hdev, false); 6456 hci_dev_clear_flag(hdev, HCI_LIMITED_PRIVACY); 6457 } 6458 6459 err = send_settings_rsp(sk, MGMT_OP_SET_PRIVACY, hdev); 6460 if (err < 0) 6461 goto unlock; 6462 6463 if (changed) 6464 err = new_settings(hdev, sk); 6465 6466 unlock: 6467 hci_dev_unlock(hdev); 6468 return err; 6469 } 6470 6471 static bool irk_is_valid(struct mgmt_irk_info *irk) 6472 { 6473 switch (irk->addr.type) { 6474 case BDADDR_LE_PUBLIC: 6475 return true; 6476 6477 case BDADDR_LE_RANDOM: 6478 /* Two most significant bits shall be set */ 6479 if ((irk->addr.bdaddr.b[5] & 0xc0) != 0xc0) 6480 return false; 6481 return true; 6482 } 6483 6484 return false; 6485 } 6486 6487 static int load_irks(struct sock *sk, struct hci_dev *hdev, void *cp_data, 6488 u16 len) 6489 { 6490 struct mgmt_cp_load_irks *cp = cp_data; 6491 const u16 max_irk_count = ((U16_MAX - sizeof(*cp)) / 6492 sizeof(struct mgmt_irk_info)); 6493 u16 irk_count, expected_len; 6494 int i, err; 6495 6496 bt_dev_dbg(hdev, "sock %p", sk); 6497 6498 if (!lmp_le_capable(hdev)) 6499 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS, 6500 MGMT_STATUS_NOT_SUPPORTED); 6501 6502 irk_count = __le16_to_cpu(cp->irk_count); 6503 if (irk_count > max_irk_count) { 6504 bt_dev_err(hdev, "load_irks: too big irk_count value %u", 6505 irk_count); 6506 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS, 6507 MGMT_STATUS_INVALID_PARAMS); 6508 } 6509 6510 expected_len = struct_size(cp, irks, irk_count); 6511 if (expected_len != len) { 6512 bt_dev_err(hdev, "load_irks: expected %u bytes, got %u bytes", 6513 expected_len, len); 6514 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS, 6515 MGMT_STATUS_INVALID_PARAMS); 6516 } 6517 6518 bt_dev_dbg(hdev, "irk_count %u", irk_count); 6519 6520 for (i = 0; i < irk_count; i++) { 6521 struct mgmt_irk_info *key = &cp->irks[i]; 6522 6523 if (!irk_is_valid(key)) 6524 return mgmt_cmd_status(sk, hdev->id, 6525 MGMT_OP_LOAD_IRKS, 6526 MGMT_STATUS_INVALID_PARAMS); 6527 } 6528 6529 hci_dev_lock(hdev); 6530 6531 hci_smp_irks_clear(hdev); 6532 6533 for (i = 0; i < irk_count; i++) { 6534 struct mgmt_irk_info *irk = &cp->irks[i]; 6535 6536 if (hci_is_blocked_key(hdev, 6537 HCI_BLOCKED_KEY_TYPE_IRK, 6538 irk->val)) { 6539 bt_dev_warn(hdev, "Skipping blocked IRK for %pMR", 6540 &irk->addr.bdaddr); 6541 continue; 6542 } 6543 6544 hci_add_irk(hdev, &irk->addr.bdaddr, 6545 le_addr_type(irk->addr.type), irk->val, 6546 BDADDR_ANY); 6547 } 6548 6549 hci_dev_set_flag(hdev, HCI_RPA_RESOLVING); 6550 6551 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_IRKS, 0, NULL, 0); 6552 6553 hci_dev_unlock(hdev); 6554 6555 return err; 6556 } 6557 6558 static bool ltk_is_valid(struct mgmt_ltk_info *key) 6559 { 6560 if (key->initiator != 0x00 && key->initiator != 0x01) 6561 return false; 6562 6563 switch (key->addr.type) { 6564 case BDADDR_LE_PUBLIC: 6565 return true; 6566 6567 case BDADDR_LE_RANDOM: 6568 /* Two most significant bits shall be set */ 6569 if ((key->addr.bdaddr.b[5] & 0xc0) != 0xc0) 6570 return false; 6571 return true; 6572 } 6573 6574 return false; 6575 } 6576 6577 static int load_long_term_keys(struct sock *sk, struct hci_dev *hdev, 6578 void *cp_data, u16 len) 6579 { 6580 struct mgmt_cp_load_long_term_keys *cp = cp_data; 6581 const u16 max_key_count = ((U16_MAX - sizeof(*cp)) / 6582 sizeof(struct mgmt_ltk_info)); 6583 u16 key_count, expected_len; 6584 int i, err; 6585 6586 bt_dev_dbg(hdev, "sock %p", sk); 6587 6588 if (!lmp_le_capable(hdev)) 6589 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS, 6590 MGMT_STATUS_NOT_SUPPORTED); 6591 6592 key_count = __le16_to_cpu(cp->key_count); 6593 if (key_count > max_key_count) { 6594 bt_dev_err(hdev, "load_ltks: too big key_count value %u", 6595 key_count); 6596 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS, 6597 MGMT_STATUS_INVALID_PARAMS); 6598 } 6599 6600 expected_len = struct_size(cp, keys, key_count); 6601 if (expected_len != len) { 6602 bt_dev_err(hdev, "load_keys: expected %u bytes, got %u bytes", 6603 expected_len, len); 6604 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS, 6605 MGMT_STATUS_INVALID_PARAMS); 6606 } 6607 6608 bt_dev_dbg(hdev, "key_count %u", key_count); 6609 6610 for (i = 0; i < key_count; i++) { 6611 struct mgmt_ltk_info *key = &cp->keys[i]; 6612 6613 if (!ltk_is_valid(key)) 6614 return mgmt_cmd_status(sk, hdev->id, 6615 MGMT_OP_LOAD_LONG_TERM_KEYS, 6616 MGMT_STATUS_INVALID_PARAMS); 6617 } 6618 6619 hci_dev_lock(hdev); 6620 6621 hci_smp_ltks_clear(hdev); 6622 6623 for (i = 0; i < key_count; i++) { 6624 struct mgmt_ltk_info *key = &cp->keys[i]; 6625 u8 type, authenticated; 6626 6627 if (hci_is_blocked_key(hdev, 6628 HCI_BLOCKED_KEY_TYPE_LTK, 6629 key->val)) { 6630 bt_dev_warn(hdev, "Skipping blocked LTK for %pMR", 6631 &key->addr.bdaddr); 6632 continue; 6633 } 6634 6635 switch (key->type) { 6636 case MGMT_LTK_UNAUTHENTICATED: 6637 authenticated = 0x00; 6638 type = key->initiator ? SMP_LTK : SMP_LTK_RESPONDER; 6639 break; 6640 case MGMT_LTK_AUTHENTICATED: 6641 authenticated = 0x01; 6642 type = key->initiator ? SMP_LTK : SMP_LTK_RESPONDER; 6643 break; 6644 case MGMT_LTK_P256_UNAUTH: 6645 authenticated = 0x00; 6646 type = SMP_LTK_P256; 6647 break; 6648 case MGMT_LTK_P256_AUTH: 6649 authenticated = 0x01; 6650 type = SMP_LTK_P256; 6651 break; 6652 case MGMT_LTK_P256_DEBUG: 6653 authenticated = 0x00; 6654 type = SMP_LTK_P256_DEBUG; 6655 fallthrough; 6656 default: 6657 continue; 6658 } 6659 6660 hci_add_ltk(hdev, &key->addr.bdaddr, 6661 le_addr_type(key->addr.type), type, authenticated, 6662 key->val, key->enc_size, key->ediv, key->rand); 6663 } 6664 6665 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS, 0, 6666 NULL, 0); 6667 6668 hci_dev_unlock(hdev); 6669 6670 return err; 6671 } 6672 6673 static void get_conn_info_complete(struct hci_dev *hdev, void *data, int err) 6674 { 6675 struct mgmt_pending_cmd *cmd = data; 6676 struct hci_conn *conn = cmd->user_data; 6677 struct mgmt_cp_get_conn_info *cp = cmd->param; 6678 struct mgmt_rp_get_conn_info rp; 6679 u8 status; 6680 6681 bt_dev_dbg(hdev, "err %d", err); 6682 6683 memcpy(&rp.addr, &cp->addr.bdaddr, sizeof(rp.addr)); 6684 6685 status = mgmt_status(err); 6686 if (status == MGMT_STATUS_SUCCESS) { 6687 rp.rssi = conn->rssi; 6688 rp.tx_power = conn->tx_power; 6689 rp.max_tx_power = conn->max_tx_power; 6690 } else { 6691 rp.rssi = HCI_RSSI_INVALID; 6692 rp.tx_power = HCI_TX_POWER_INVALID; 6693 rp.max_tx_power = HCI_TX_POWER_INVALID; 6694 } 6695 6696 mgmt_cmd_complete(cmd->sk, cmd->index, MGMT_OP_GET_CONN_INFO, status, 6697 &rp, sizeof(rp)); 6698 6699 if (conn) { 6700 hci_conn_drop(conn); 6701 hci_conn_put(conn); 6702 } 6703 6704 mgmt_pending_free(cmd); 6705 } 6706 6707 static int get_conn_info_sync(struct hci_dev *hdev, void *data) 6708 { 6709 struct mgmt_pending_cmd *cmd = data; 6710 struct mgmt_cp_get_conn_info *cp = cmd->param; 6711 struct hci_conn *conn; 6712 int err; 6713 __le16 handle; 6714 6715 /* Make sure we are still connected */ 6716 if (cp->addr.type == BDADDR_BREDR) 6717 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, 6718 &cp->addr.bdaddr); 6719 else 6720 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &cp->addr.bdaddr); 6721 6722 if (!conn || conn != cmd->user_data || conn->state != BT_CONNECTED) { 6723 if (cmd->user_data) { 6724 hci_conn_drop(cmd->user_data); 6725 hci_conn_put(cmd->user_data); 6726 cmd->user_data = NULL; 6727 } 6728 return MGMT_STATUS_NOT_CONNECTED; 6729 } 6730 6731 handle = cpu_to_le16(conn->handle); 6732 6733 /* Refresh RSSI each time */ 6734 err = hci_read_rssi_sync(hdev, handle); 6735 6736 /* For LE links TX power does not change thus we don't need to 6737 * query for it once value is known. 6738 */ 6739 if (!err && (!bdaddr_type_is_le(cp->addr.type) || 6740 conn->tx_power == HCI_TX_POWER_INVALID)) 6741 err = hci_read_tx_power_sync(hdev, handle, 0x00); 6742 6743 /* Max TX power needs to be read only once per connection */ 6744 if (!err && conn->max_tx_power == HCI_TX_POWER_INVALID) 6745 err = hci_read_tx_power_sync(hdev, handle, 0x01); 6746 6747 return err; 6748 } 6749 6750 static int get_conn_info(struct sock *sk, struct hci_dev *hdev, void *data, 6751 u16 len) 6752 { 6753 struct mgmt_cp_get_conn_info *cp = data; 6754 struct mgmt_rp_get_conn_info rp; 6755 struct hci_conn *conn; 6756 unsigned long conn_info_age; 6757 int err = 0; 6758 6759 bt_dev_dbg(hdev, "sock %p", sk); 6760 6761 memset(&rp, 0, sizeof(rp)); 6762 bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr); 6763 rp.addr.type = cp->addr.type; 6764 6765 if (!bdaddr_type_is_valid(cp->addr.type)) 6766 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO, 6767 MGMT_STATUS_INVALID_PARAMS, 6768 &rp, sizeof(rp)); 6769 6770 hci_dev_lock(hdev); 6771 6772 if (!hdev_is_powered(hdev)) { 6773 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO, 6774 MGMT_STATUS_NOT_POWERED, &rp, 6775 sizeof(rp)); 6776 goto unlock; 6777 } 6778 6779 if (cp->addr.type == BDADDR_BREDR) 6780 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, 6781 &cp->addr.bdaddr); 6782 else 6783 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &cp->addr.bdaddr); 6784 6785 if (!conn || conn->state != BT_CONNECTED) { 6786 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO, 6787 MGMT_STATUS_NOT_CONNECTED, &rp, 6788 sizeof(rp)); 6789 goto unlock; 6790 } 6791 6792 /* To avoid client trying to guess when to poll again for information we 6793 * calculate conn info age as random value between min/max set in hdev. 6794 */ 6795 conn_info_age = hdev->conn_info_min_age + 6796 prandom_u32_max(hdev->conn_info_max_age - 6797 hdev->conn_info_min_age); 6798 6799 /* Query controller to refresh cached values if they are too old or were 6800 * never read. 6801 */ 6802 if (time_after(jiffies, conn->conn_info_timestamp + 6803 msecs_to_jiffies(conn_info_age)) || 6804 !conn->conn_info_timestamp) { 6805 struct mgmt_pending_cmd *cmd; 6806 6807 cmd = mgmt_pending_new(sk, MGMT_OP_GET_CONN_INFO, hdev, data, 6808 len); 6809 if (!cmd) 6810 err = -ENOMEM; 6811 else 6812 err = hci_cmd_sync_queue(hdev, get_conn_info_sync, 6813 cmd, get_conn_info_complete); 6814 6815 if (err < 0) { 6816 mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO, 6817 MGMT_STATUS_FAILED, &rp, sizeof(rp)); 6818 6819 if (cmd) 6820 mgmt_pending_free(cmd); 6821 6822 goto unlock; 6823 } 6824 6825 hci_conn_hold(conn); 6826 cmd->user_data = hci_conn_get(conn); 6827 6828 conn->conn_info_timestamp = jiffies; 6829 } else { 6830 /* Cache is valid, just reply with values cached in hci_conn */ 6831 rp.rssi = conn->rssi; 6832 rp.tx_power = conn->tx_power; 6833 rp.max_tx_power = conn->max_tx_power; 6834 6835 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO, 6836 MGMT_STATUS_SUCCESS, &rp, sizeof(rp)); 6837 } 6838 6839 unlock: 6840 hci_dev_unlock(hdev); 6841 return err; 6842 } 6843 6844 static void get_clock_info_complete(struct hci_dev *hdev, void *data, int err) 6845 { 6846 struct mgmt_pending_cmd *cmd = data; 6847 struct mgmt_cp_get_clock_info *cp = cmd->param; 6848 struct mgmt_rp_get_clock_info rp; 6849 struct hci_conn *conn = cmd->user_data; 6850 u8 status = mgmt_status(err); 6851 6852 bt_dev_dbg(hdev, "err %d", err); 6853 6854 memset(&rp, 0, sizeof(rp)); 6855 bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr); 6856 rp.addr.type = cp->addr.type; 6857 6858 if (err) 6859 goto complete; 6860 6861 rp.local_clock = cpu_to_le32(hdev->clock); 6862 6863 if (conn) { 6864 rp.piconet_clock = cpu_to_le32(conn->clock); 6865 rp.accuracy = cpu_to_le16(conn->clock_accuracy); 6866 hci_conn_drop(conn); 6867 hci_conn_put(conn); 6868 } 6869 6870 complete: 6871 mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, status, &rp, 6872 sizeof(rp)); 6873 6874 mgmt_pending_free(cmd); 6875 } 6876 6877 static int get_clock_info_sync(struct hci_dev *hdev, void *data) 6878 { 6879 struct mgmt_pending_cmd *cmd = data; 6880 struct mgmt_cp_get_clock_info *cp = cmd->param; 6881 struct hci_cp_read_clock hci_cp; 6882 struct hci_conn *conn = cmd->user_data; 6883 int err; 6884 6885 memset(&hci_cp, 0, sizeof(hci_cp)); 6886 err = hci_read_clock_sync(hdev, &hci_cp); 6887 6888 if (conn) { 6889 /* Make sure connection still exists */ 6890 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, 6891 &cp->addr.bdaddr); 6892 6893 if (conn && conn == cmd->user_data && 6894 conn->state == BT_CONNECTED) { 6895 hci_cp.handle = cpu_to_le16(conn->handle); 6896 hci_cp.which = 0x01; /* Piconet clock */ 6897 err = hci_read_clock_sync(hdev, &hci_cp); 6898 } else if (cmd->user_data) { 6899 hci_conn_drop(cmd->user_data); 6900 hci_conn_put(cmd->user_data); 6901 cmd->user_data = NULL; 6902 } 6903 } 6904 6905 return err; 6906 } 6907 6908 static int get_clock_info(struct sock *sk, struct hci_dev *hdev, void *data, 6909 u16 len) 6910 { 6911 struct mgmt_cp_get_clock_info *cp = data; 6912 struct mgmt_rp_get_clock_info rp; 6913 struct mgmt_pending_cmd *cmd; 6914 struct hci_conn *conn; 6915 int err; 6916 6917 bt_dev_dbg(hdev, "sock %p", sk); 6918 6919 memset(&rp, 0, sizeof(rp)); 6920 bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr); 6921 rp.addr.type = cp->addr.type; 6922 6923 if (cp->addr.type != BDADDR_BREDR) 6924 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CLOCK_INFO, 6925 MGMT_STATUS_INVALID_PARAMS, 6926 &rp, sizeof(rp)); 6927 6928 hci_dev_lock(hdev); 6929 6930 if (!hdev_is_powered(hdev)) { 6931 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CLOCK_INFO, 6932 MGMT_STATUS_NOT_POWERED, &rp, 6933 sizeof(rp)); 6934 goto unlock; 6935 } 6936 6937 if (bacmp(&cp->addr.bdaddr, BDADDR_ANY)) { 6938 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, 6939 &cp->addr.bdaddr); 6940 if (!conn || conn->state != BT_CONNECTED) { 6941 err = mgmt_cmd_complete(sk, hdev->id, 6942 MGMT_OP_GET_CLOCK_INFO, 6943 MGMT_STATUS_NOT_CONNECTED, 6944 &rp, sizeof(rp)); 6945 goto unlock; 6946 } 6947 } else { 6948 conn = NULL; 6949 } 6950 6951 cmd = mgmt_pending_new(sk, MGMT_OP_GET_CLOCK_INFO, hdev, data, len); 6952 if (!cmd) 6953 err = -ENOMEM; 6954 else 6955 err = hci_cmd_sync_queue(hdev, get_clock_info_sync, cmd, 6956 get_clock_info_complete); 6957 6958 if (err < 0) { 6959 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CLOCK_INFO, 6960 MGMT_STATUS_FAILED, &rp, sizeof(rp)); 6961 6962 if (cmd) 6963 mgmt_pending_free(cmd); 6964 6965 } else if (conn) { 6966 hci_conn_hold(conn); 6967 cmd->user_data = hci_conn_get(conn); 6968 } 6969 6970 6971 unlock: 6972 hci_dev_unlock(hdev); 6973 return err; 6974 } 6975 6976 static bool is_connected(struct hci_dev *hdev, bdaddr_t *addr, u8 type) 6977 { 6978 struct hci_conn *conn; 6979 6980 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, addr); 6981 if (!conn) 6982 return false; 6983 6984 if (conn->dst_type != type) 6985 return false; 6986 6987 if (conn->state != BT_CONNECTED) 6988 return false; 6989 6990 return true; 6991 } 6992 6993 /* This function requires the caller holds hdev->lock */ 6994 static int hci_conn_params_set(struct hci_dev *hdev, bdaddr_t *addr, 6995 u8 addr_type, u8 auto_connect) 6996 { 6997 struct hci_conn_params *params; 6998 6999 params = hci_conn_params_add(hdev, addr, addr_type); 7000 if (!params) 7001 return -EIO; 7002 7003 if (params->auto_connect == auto_connect) 7004 return 0; 7005 7006 list_del_init(¶ms->action); 7007 7008 switch (auto_connect) { 7009 case HCI_AUTO_CONN_DISABLED: 7010 case HCI_AUTO_CONN_LINK_LOSS: 7011 /* If auto connect is being disabled when we're trying to 7012 * connect to device, keep connecting. 7013 */ 7014 if (params->explicit_connect) 7015 list_add(¶ms->action, &hdev->pend_le_conns); 7016 break; 7017 case HCI_AUTO_CONN_REPORT: 7018 if (params->explicit_connect) 7019 list_add(¶ms->action, &hdev->pend_le_conns); 7020 else 7021 list_add(¶ms->action, &hdev->pend_le_reports); 7022 break; 7023 case HCI_AUTO_CONN_DIRECT: 7024 case HCI_AUTO_CONN_ALWAYS: 7025 if (!is_connected(hdev, addr, addr_type)) 7026 list_add(¶ms->action, &hdev->pend_le_conns); 7027 break; 7028 } 7029 7030 params->auto_connect = auto_connect; 7031 7032 bt_dev_dbg(hdev, "addr %pMR (type %u) auto_connect %u", 7033 addr, addr_type, auto_connect); 7034 7035 return 0; 7036 } 7037 7038 static void device_added(struct sock *sk, struct hci_dev *hdev, 7039 bdaddr_t *bdaddr, u8 type, u8 action) 7040 { 7041 struct mgmt_ev_device_added ev; 7042 7043 bacpy(&ev.addr.bdaddr, bdaddr); 7044 ev.addr.type = type; 7045 ev.action = action; 7046 7047 mgmt_event(MGMT_EV_DEVICE_ADDED, hdev, &ev, sizeof(ev), sk); 7048 } 7049 7050 static int add_device_sync(struct hci_dev *hdev, void *data) 7051 { 7052 return hci_update_passive_scan_sync(hdev); 7053 } 7054 7055 static int add_device(struct sock *sk, struct hci_dev *hdev, 7056 void *data, u16 len) 7057 { 7058 struct mgmt_cp_add_device *cp = data; 7059 u8 auto_conn, addr_type; 7060 struct hci_conn_params *params; 7061 int err; 7062 u32 current_flags = 0; 7063 u32 supported_flags; 7064 7065 bt_dev_dbg(hdev, "sock %p", sk); 7066 7067 if (!bdaddr_type_is_valid(cp->addr.type) || 7068 !bacmp(&cp->addr.bdaddr, BDADDR_ANY)) 7069 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE, 7070 MGMT_STATUS_INVALID_PARAMS, 7071 &cp->addr, sizeof(cp->addr)); 7072 7073 if (cp->action != 0x00 && cp->action != 0x01 && cp->action != 0x02) 7074 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE, 7075 MGMT_STATUS_INVALID_PARAMS, 7076 &cp->addr, sizeof(cp->addr)); 7077 7078 hci_dev_lock(hdev); 7079 7080 if (cp->addr.type == BDADDR_BREDR) { 7081 /* Only incoming connections action is supported for now */ 7082 if (cp->action != 0x01) { 7083 err = mgmt_cmd_complete(sk, hdev->id, 7084 MGMT_OP_ADD_DEVICE, 7085 MGMT_STATUS_INVALID_PARAMS, 7086 &cp->addr, sizeof(cp->addr)); 7087 goto unlock; 7088 } 7089 7090 err = hci_bdaddr_list_add_with_flags(&hdev->accept_list, 7091 &cp->addr.bdaddr, 7092 cp->addr.type, 0); 7093 if (err) 7094 goto unlock; 7095 7096 hci_req_update_scan(hdev); 7097 7098 goto added; 7099 } 7100 7101 addr_type = le_addr_type(cp->addr.type); 7102 7103 if (cp->action == 0x02) 7104 auto_conn = HCI_AUTO_CONN_ALWAYS; 7105 else if (cp->action == 0x01) 7106 auto_conn = HCI_AUTO_CONN_DIRECT; 7107 else 7108 auto_conn = HCI_AUTO_CONN_REPORT; 7109 7110 /* Kernel internally uses conn_params with resolvable private 7111 * address, but Add Device allows only identity addresses. 7112 * Make sure it is enforced before calling 7113 * hci_conn_params_lookup. 7114 */ 7115 if (!hci_is_identity_address(&cp->addr.bdaddr, addr_type)) { 7116 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE, 7117 MGMT_STATUS_INVALID_PARAMS, 7118 &cp->addr, sizeof(cp->addr)); 7119 goto unlock; 7120 } 7121 7122 /* If the connection parameters don't exist for this device, 7123 * they will be created and configured with defaults. 7124 */ 7125 if (hci_conn_params_set(hdev, &cp->addr.bdaddr, addr_type, 7126 auto_conn) < 0) { 7127 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE, 7128 MGMT_STATUS_FAILED, &cp->addr, 7129 sizeof(cp->addr)); 7130 goto unlock; 7131 } else { 7132 params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr, 7133 addr_type); 7134 if (params) 7135 bitmap_to_arr32(¤t_flags, params->flags, 7136 __HCI_CONN_NUM_FLAGS); 7137 } 7138 7139 err = hci_cmd_sync_queue(hdev, add_device_sync, NULL, NULL); 7140 if (err < 0) 7141 goto unlock; 7142 7143 added: 7144 device_added(sk, hdev, &cp->addr.bdaddr, cp->addr.type, cp->action); 7145 bitmap_to_arr32(&supported_flags, hdev->conn_flags, 7146 __HCI_CONN_NUM_FLAGS); 7147 device_flags_changed(NULL, hdev, &cp->addr.bdaddr, cp->addr.type, 7148 supported_flags, current_flags); 7149 7150 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE, 7151 MGMT_STATUS_SUCCESS, &cp->addr, 7152 sizeof(cp->addr)); 7153 7154 unlock: 7155 hci_dev_unlock(hdev); 7156 return err; 7157 } 7158 7159 static void device_removed(struct sock *sk, struct hci_dev *hdev, 7160 bdaddr_t *bdaddr, u8 type) 7161 { 7162 struct mgmt_ev_device_removed ev; 7163 7164 bacpy(&ev.addr.bdaddr, bdaddr); 7165 ev.addr.type = type; 7166 7167 mgmt_event(MGMT_EV_DEVICE_REMOVED, hdev, &ev, sizeof(ev), sk); 7168 } 7169 7170 static int remove_device_sync(struct hci_dev *hdev, void *data) 7171 { 7172 return hci_update_passive_scan_sync(hdev); 7173 } 7174 7175 static int remove_device(struct sock *sk, struct hci_dev *hdev, 7176 void *data, u16 len) 7177 { 7178 struct mgmt_cp_remove_device *cp = data; 7179 int err; 7180 7181 bt_dev_dbg(hdev, "sock %p", sk); 7182 7183 hci_dev_lock(hdev); 7184 7185 if (bacmp(&cp->addr.bdaddr, BDADDR_ANY)) { 7186 struct hci_conn_params *params; 7187 u8 addr_type; 7188 7189 if (!bdaddr_type_is_valid(cp->addr.type)) { 7190 err = mgmt_cmd_complete(sk, hdev->id, 7191 MGMT_OP_REMOVE_DEVICE, 7192 MGMT_STATUS_INVALID_PARAMS, 7193 &cp->addr, sizeof(cp->addr)); 7194 goto unlock; 7195 } 7196 7197 if (cp->addr.type == BDADDR_BREDR) { 7198 err = hci_bdaddr_list_del(&hdev->accept_list, 7199 &cp->addr.bdaddr, 7200 cp->addr.type); 7201 if (err) { 7202 err = mgmt_cmd_complete(sk, hdev->id, 7203 MGMT_OP_REMOVE_DEVICE, 7204 MGMT_STATUS_INVALID_PARAMS, 7205 &cp->addr, 7206 sizeof(cp->addr)); 7207 goto unlock; 7208 } 7209 7210 hci_req_update_scan(hdev); 7211 7212 device_removed(sk, hdev, &cp->addr.bdaddr, 7213 cp->addr.type); 7214 goto complete; 7215 } 7216 7217 addr_type = le_addr_type(cp->addr.type); 7218 7219 /* Kernel internally uses conn_params with resolvable private 7220 * address, but Remove Device allows only identity addresses. 7221 * Make sure it is enforced before calling 7222 * hci_conn_params_lookup. 7223 */ 7224 if (!hci_is_identity_address(&cp->addr.bdaddr, addr_type)) { 7225 err = mgmt_cmd_complete(sk, hdev->id, 7226 MGMT_OP_REMOVE_DEVICE, 7227 MGMT_STATUS_INVALID_PARAMS, 7228 &cp->addr, sizeof(cp->addr)); 7229 goto unlock; 7230 } 7231 7232 params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr, 7233 addr_type); 7234 if (!params) { 7235 err = mgmt_cmd_complete(sk, hdev->id, 7236 MGMT_OP_REMOVE_DEVICE, 7237 MGMT_STATUS_INVALID_PARAMS, 7238 &cp->addr, sizeof(cp->addr)); 7239 goto unlock; 7240 } 7241 7242 if (params->auto_connect == HCI_AUTO_CONN_DISABLED || 7243 params->auto_connect == HCI_AUTO_CONN_EXPLICIT) { 7244 err = mgmt_cmd_complete(sk, hdev->id, 7245 MGMT_OP_REMOVE_DEVICE, 7246 MGMT_STATUS_INVALID_PARAMS, 7247 &cp->addr, sizeof(cp->addr)); 7248 goto unlock; 7249 } 7250 7251 list_del(¶ms->action); 7252 list_del(¶ms->list); 7253 kfree(params); 7254 7255 device_removed(sk, hdev, &cp->addr.bdaddr, cp->addr.type); 7256 } else { 7257 struct hci_conn_params *p, *tmp; 7258 struct bdaddr_list *b, *btmp; 7259 7260 if (cp->addr.type) { 7261 err = mgmt_cmd_complete(sk, hdev->id, 7262 MGMT_OP_REMOVE_DEVICE, 7263 MGMT_STATUS_INVALID_PARAMS, 7264 &cp->addr, sizeof(cp->addr)); 7265 goto unlock; 7266 } 7267 7268 list_for_each_entry_safe(b, btmp, &hdev->accept_list, list) { 7269 device_removed(sk, hdev, &b->bdaddr, b->bdaddr_type); 7270 list_del(&b->list); 7271 kfree(b); 7272 } 7273 7274 hci_req_update_scan(hdev); 7275 7276 list_for_each_entry_safe(p, tmp, &hdev->le_conn_params, list) { 7277 if (p->auto_connect == HCI_AUTO_CONN_DISABLED) 7278 continue; 7279 device_removed(sk, hdev, &p->addr, p->addr_type); 7280 if (p->explicit_connect) { 7281 p->auto_connect = HCI_AUTO_CONN_EXPLICIT; 7282 continue; 7283 } 7284 list_del(&p->action); 7285 list_del(&p->list); 7286 kfree(p); 7287 } 7288 7289 bt_dev_dbg(hdev, "All LE connection parameters were removed"); 7290 } 7291 7292 hci_cmd_sync_queue(hdev, remove_device_sync, NULL, NULL); 7293 7294 complete: 7295 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_DEVICE, 7296 MGMT_STATUS_SUCCESS, &cp->addr, 7297 sizeof(cp->addr)); 7298 unlock: 7299 hci_dev_unlock(hdev); 7300 return err; 7301 } 7302 7303 static int load_conn_param(struct sock *sk, struct hci_dev *hdev, void *data, 7304 u16 len) 7305 { 7306 struct mgmt_cp_load_conn_param *cp = data; 7307 const u16 max_param_count = ((U16_MAX - sizeof(*cp)) / 7308 sizeof(struct mgmt_conn_param)); 7309 u16 param_count, expected_len; 7310 int i; 7311 7312 if (!lmp_le_capable(hdev)) 7313 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM, 7314 MGMT_STATUS_NOT_SUPPORTED); 7315 7316 param_count = __le16_to_cpu(cp->param_count); 7317 if (param_count > max_param_count) { 7318 bt_dev_err(hdev, "load_conn_param: too big param_count value %u", 7319 param_count); 7320 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM, 7321 MGMT_STATUS_INVALID_PARAMS); 7322 } 7323 7324 expected_len = struct_size(cp, params, param_count); 7325 if (expected_len != len) { 7326 bt_dev_err(hdev, "load_conn_param: expected %u bytes, got %u bytes", 7327 expected_len, len); 7328 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM, 7329 MGMT_STATUS_INVALID_PARAMS); 7330 } 7331 7332 bt_dev_dbg(hdev, "param_count %u", param_count); 7333 7334 hci_dev_lock(hdev); 7335 7336 hci_conn_params_clear_disabled(hdev); 7337 7338 for (i = 0; i < param_count; i++) { 7339 struct mgmt_conn_param *param = &cp->params[i]; 7340 struct hci_conn_params *hci_param; 7341 u16 min, max, latency, timeout; 7342 u8 addr_type; 7343 7344 bt_dev_dbg(hdev, "Adding %pMR (type %u)", ¶m->addr.bdaddr, 7345 param->addr.type); 7346 7347 if (param->addr.type == BDADDR_LE_PUBLIC) { 7348 addr_type = ADDR_LE_DEV_PUBLIC; 7349 } else if (param->addr.type == BDADDR_LE_RANDOM) { 7350 addr_type = ADDR_LE_DEV_RANDOM; 7351 } else { 7352 bt_dev_err(hdev, "ignoring invalid connection parameters"); 7353 continue; 7354 } 7355 7356 min = le16_to_cpu(param->min_interval); 7357 max = le16_to_cpu(param->max_interval); 7358 latency = le16_to_cpu(param->latency); 7359 timeout = le16_to_cpu(param->timeout); 7360 7361 bt_dev_dbg(hdev, "min 0x%04x max 0x%04x latency 0x%04x timeout 0x%04x", 7362 min, max, latency, timeout); 7363 7364 if (hci_check_conn_params(min, max, latency, timeout) < 0) { 7365 bt_dev_err(hdev, "ignoring invalid connection parameters"); 7366 continue; 7367 } 7368 7369 hci_param = hci_conn_params_add(hdev, ¶m->addr.bdaddr, 7370 addr_type); 7371 if (!hci_param) { 7372 bt_dev_err(hdev, "failed to add connection parameters"); 7373 continue; 7374 } 7375 7376 hci_param->conn_min_interval = min; 7377 hci_param->conn_max_interval = max; 7378 hci_param->conn_latency = latency; 7379 hci_param->supervision_timeout = timeout; 7380 } 7381 7382 hci_dev_unlock(hdev); 7383 7384 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM, 0, 7385 NULL, 0); 7386 } 7387 7388 static int set_external_config(struct sock *sk, struct hci_dev *hdev, 7389 void *data, u16 len) 7390 { 7391 struct mgmt_cp_set_external_config *cp = data; 7392 bool changed; 7393 int err; 7394 7395 bt_dev_dbg(hdev, "sock %p", sk); 7396 7397 if (hdev_is_powered(hdev)) 7398 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_EXTERNAL_CONFIG, 7399 MGMT_STATUS_REJECTED); 7400 7401 if (cp->config != 0x00 && cp->config != 0x01) 7402 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_EXTERNAL_CONFIG, 7403 MGMT_STATUS_INVALID_PARAMS); 7404 7405 if (!test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks)) 7406 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_EXTERNAL_CONFIG, 7407 MGMT_STATUS_NOT_SUPPORTED); 7408 7409 hci_dev_lock(hdev); 7410 7411 if (cp->config) 7412 changed = !hci_dev_test_and_set_flag(hdev, HCI_EXT_CONFIGURED); 7413 else 7414 changed = hci_dev_test_and_clear_flag(hdev, HCI_EXT_CONFIGURED); 7415 7416 err = send_options_rsp(sk, MGMT_OP_SET_EXTERNAL_CONFIG, hdev); 7417 if (err < 0) 7418 goto unlock; 7419 7420 if (!changed) 7421 goto unlock; 7422 7423 err = new_options(hdev, sk); 7424 7425 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED) == is_configured(hdev)) { 7426 mgmt_index_removed(hdev); 7427 7428 if (hci_dev_test_and_change_flag(hdev, HCI_UNCONFIGURED)) { 7429 hci_dev_set_flag(hdev, HCI_CONFIG); 7430 hci_dev_set_flag(hdev, HCI_AUTO_OFF); 7431 7432 queue_work(hdev->req_workqueue, &hdev->power_on); 7433 } else { 7434 set_bit(HCI_RAW, &hdev->flags); 7435 mgmt_index_added(hdev); 7436 } 7437 } 7438 7439 unlock: 7440 hci_dev_unlock(hdev); 7441 return err; 7442 } 7443 7444 static int set_public_address(struct sock *sk, struct hci_dev *hdev, 7445 void *data, u16 len) 7446 { 7447 struct mgmt_cp_set_public_address *cp = data; 7448 bool changed; 7449 int err; 7450 7451 bt_dev_dbg(hdev, "sock %p", sk); 7452 7453 if (hdev_is_powered(hdev)) 7454 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PUBLIC_ADDRESS, 7455 MGMT_STATUS_REJECTED); 7456 7457 if (!bacmp(&cp->bdaddr, BDADDR_ANY)) 7458 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PUBLIC_ADDRESS, 7459 MGMT_STATUS_INVALID_PARAMS); 7460 7461 if (!hdev->set_bdaddr) 7462 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PUBLIC_ADDRESS, 7463 MGMT_STATUS_NOT_SUPPORTED); 7464 7465 hci_dev_lock(hdev); 7466 7467 changed = !!bacmp(&hdev->public_addr, &cp->bdaddr); 7468 bacpy(&hdev->public_addr, &cp->bdaddr); 7469 7470 err = send_options_rsp(sk, MGMT_OP_SET_PUBLIC_ADDRESS, hdev); 7471 if (err < 0) 7472 goto unlock; 7473 7474 if (!changed) 7475 goto unlock; 7476 7477 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) 7478 err = new_options(hdev, sk); 7479 7480 if (is_configured(hdev)) { 7481 mgmt_index_removed(hdev); 7482 7483 hci_dev_clear_flag(hdev, HCI_UNCONFIGURED); 7484 7485 hci_dev_set_flag(hdev, HCI_CONFIG); 7486 hci_dev_set_flag(hdev, HCI_AUTO_OFF); 7487 7488 queue_work(hdev->req_workqueue, &hdev->power_on); 7489 } 7490 7491 unlock: 7492 hci_dev_unlock(hdev); 7493 return err; 7494 } 7495 7496 static void read_local_oob_ext_data_complete(struct hci_dev *hdev, void *data, 7497 int err) 7498 { 7499 const struct mgmt_cp_read_local_oob_ext_data *mgmt_cp; 7500 struct mgmt_rp_read_local_oob_ext_data *mgmt_rp; 7501 u8 *h192, *r192, *h256, *r256; 7502 struct mgmt_pending_cmd *cmd = data; 7503 struct sk_buff *skb = cmd->skb; 7504 u8 status = mgmt_status(err); 7505 u16 eir_len; 7506 7507 if (cmd != pending_find(MGMT_OP_READ_LOCAL_OOB_EXT_DATA, hdev)) 7508 return; 7509 7510 if (!status) { 7511 if (!skb) 7512 status = MGMT_STATUS_FAILED; 7513 else if (IS_ERR(skb)) 7514 status = mgmt_status(PTR_ERR(skb)); 7515 else 7516 status = mgmt_status(skb->data[0]); 7517 } 7518 7519 bt_dev_dbg(hdev, "status %u", status); 7520 7521 mgmt_cp = cmd->param; 7522 7523 if (status) { 7524 status = mgmt_status(status); 7525 eir_len = 0; 7526 7527 h192 = NULL; 7528 r192 = NULL; 7529 h256 = NULL; 7530 r256 = NULL; 7531 } else if (!bredr_sc_enabled(hdev)) { 7532 struct hci_rp_read_local_oob_data *rp; 7533 7534 if (skb->len != sizeof(*rp)) { 7535 status = MGMT_STATUS_FAILED; 7536 eir_len = 0; 7537 } else { 7538 status = MGMT_STATUS_SUCCESS; 7539 rp = (void *)skb->data; 7540 7541 eir_len = 5 + 18 + 18; 7542 h192 = rp->hash; 7543 r192 = rp->rand; 7544 h256 = NULL; 7545 r256 = NULL; 7546 } 7547 } else { 7548 struct hci_rp_read_local_oob_ext_data *rp; 7549 7550 if (skb->len != sizeof(*rp)) { 7551 status = MGMT_STATUS_FAILED; 7552 eir_len = 0; 7553 } else { 7554 status = MGMT_STATUS_SUCCESS; 7555 rp = (void *)skb->data; 7556 7557 if (hci_dev_test_flag(hdev, HCI_SC_ONLY)) { 7558 eir_len = 5 + 18 + 18; 7559 h192 = NULL; 7560 r192 = NULL; 7561 } else { 7562 eir_len = 5 + 18 + 18 + 18 + 18; 7563 h192 = rp->hash192; 7564 r192 = rp->rand192; 7565 } 7566 7567 h256 = rp->hash256; 7568 r256 = rp->rand256; 7569 } 7570 } 7571 7572 mgmt_rp = kmalloc(sizeof(*mgmt_rp) + eir_len, GFP_KERNEL); 7573 if (!mgmt_rp) 7574 goto done; 7575 7576 if (eir_len == 0) 7577 goto send_rsp; 7578 7579 eir_len = eir_append_data(mgmt_rp->eir, 0, EIR_CLASS_OF_DEV, 7580 hdev->dev_class, 3); 7581 7582 if (h192 && r192) { 7583 eir_len = eir_append_data(mgmt_rp->eir, eir_len, 7584 EIR_SSP_HASH_C192, h192, 16); 7585 eir_len = eir_append_data(mgmt_rp->eir, eir_len, 7586 EIR_SSP_RAND_R192, r192, 16); 7587 } 7588 7589 if (h256 && r256) { 7590 eir_len = eir_append_data(mgmt_rp->eir, eir_len, 7591 EIR_SSP_HASH_C256, h256, 16); 7592 eir_len = eir_append_data(mgmt_rp->eir, eir_len, 7593 EIR_SSP_RAND_R256, r256, 16); 7594 } 7595 7596 send_rsp: 7597 mgmt_rp->type = mgmt_cp->type; 7598 mgmt_rp->eir_len = cpu_to_le16(eir_len); 7599 7600 err = mgmt_cmd_complete(cmd->sk, hdev->id, 7601 MGMT_OP_READ_LOCAL_OOB_EXT_DATA, status, 7602 mgmt_rp, sizeof(*mgmt_rp) + eir_len); 7603 if (err < 0 || status) 7604 goto done; 7605 7606 hci_sock_set_flag(cmd->sk, HCI_MGMT_OOB_DATA_EVENTS); 7607 7608 err = mgmt_limited_event(MGMT_EV_LOCAL_OOB_DATA_UPDATED, hdev, 7609 mgmt_rp, sizeof(*mgmt_rp) + eir_len, 7610 HCI_MGMT_OOB_DATA_EVENTS, cmd->sk); 7611 done: 7612 if (skb && !IS_ERR(skb)) 7613 kfree_skb(skb); 7614 7615 kfree(mgmt_rp); 7616 mgmt_pending_remove(cmd); 7617 } 7618 7619 static int read_local_ssp_oob_req(struct hci_dev *hdev, struct sock *sk, 7620 struct mgmt_cp_read_local_oob_ext_data *cp) 7621 { 7622 struct mgmt_pending_cmd *cmd; 7623 int err; 7624 7625 cmd = mgmt_pending_add(sk, MGMT_OP_READ_LOCAL_OOB_EXT_DATA, hdev, 7626 cp, sizeof(*cp)); 7627 if (!cmd) 7628 return -ENOMEM; 7629 7630 err = hci_cmd_sync_queue(hdev, read_local_oob_data_sync, cmd, 7631 read_local_oob_ext_data_complete); 7632 7633 if (err < 0) { 7634 mgmt_pending_remove(cmd); 7635 return err; 7636 } 7637 7638 return 0; 7639 } 7640 7641 static int read_local_oob_ext_data(struct sock *sk, struct hci_dev *hdev, 7642 void *data, u16 data_len) 7643 { 7644 struct mgmt_cp_read_local_oob_ext_data *cp = data; 7645 struct mgmt_rp_read_local_oob_ext_data *rp; 7646 size_t rp_len; 7647 u16 eir_len; 7648 u8 status, flags, role, addr[7], hash[16], rand[16]; 7649 int err; 7650 7651 bt_dev_dbg(hdev, "sock %p", sk); 7652 7653 if (hdev_is_powered(hdev)) { 7654 switch (cp->type) { 7655 case BIT(BDADDR_BREDR): 7656 status = mgmt_bredr_support(hdev); 7657 if (status) 7658 eir_len = 0; 7659 else 7660 eir_len = 5; 7661 break; 7662 case (BIT(BDADDR_LE_PUBLIC) | BIT(BDADDR_LE_RANDOM)): 7663 status = mgmt_le_support(hdev); 7664 if (status) 7665 eir_len = 0; 7666 else 7667 eir_len = 9 + 3 + 18 + 18 + 3; 7668 break; 7669 default: 7670 status = MGMT_STATUS_INVALID_PARAMS; 7671 eir_len = 0; 7672 break; 7673 } 7674 } else { 7675 status = MGMT_STATUS_NOT_POWERED; 7676 eir_len = 0; 7677 } 7678 7679 rp_len = sizeof(*rp) + eir_len; 7680 rp = kmalloc(rp_len, GFP_ATOMIC); 7681 if (!rp) 7682 return -ENOMEM; 7683 7684 if (!status && !lmp_ssp_capable(hdev)) { 7685 status = MGMT_STATUS_NOT_SUPPORTED; 7686 eir_len = 0; 7687 } 7688 7689 if (status) 7690 goto complete; 7691 7692 hci_dev_lock(hdev); 7693 7694 eir_len = 0; 7695 switch (cp->type) { 7696 case BIT(BDADDR_BREDR): 7697 if (hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) { 7698 err = read_local_ssp_oob_req(hdev, sk, cp); 7699 hci_dev_unlock(hdev); 7700 if (!err) 7701 goto done; 7702 7703 status = MGMT_STATUS_FAILED; 7704 goto complete; 7705 } else { 7706 eir_len = eir_append_data(rp->eir, eir_len, 7707 EIR_CLASS_OF_DEV, 7708 hdev->dev_class, 3); 7709 } 7710 break; 7711 case (BIT(BDADDR_LE_PUBLIC) | BIT(BDADDR_LE_RANDOM)): 7712 if (hci_dev_test_flag(hdev, HCI_SC_ENABLED) && 7713 smp_generate_oob(hdev, hash, rand) < 0) { 7714 hci_dev_unlock(hdev); 7715 status = MGMT_STATUS_FAILED; 7716 goto complete; 7717 } 7718 7719 /* This should return the active RPA, but since the RPA 7720 * is only programmed on demand, it is really hard to fill 7721 * this in at the moment. For now disallow retrieving 7722 * local out-of-band data when privacy is in use. 7723 * 7724 * Returning the identity address will not help here since 7725 * pairing happens before the identity resolving key is 7726 * known and thus the connection establishment happens 7727 * based on the RPA and not the identity address. 7728 */ 7729 if (hci_dev_test_flag(hdev, HCI_PRIVACY)) { 7730 hci_dev_unlock(hdev); 7731 status = MGMT_STATUS_REJECTED; 7732 goto complete; 7733 } 7734 7735 if (hci_dev_test_flag(hdev, HCI_FORCE_STATIC_ADDR) || 7736 !bacmp(&hdev->bdaddr, BDADDR_ANY) || 7737 (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) && 7738 bacmp(&hdev->static_addr, BDADDR_ANY))) { 7739 memcpy(addr, &hdev->static_addr, 6); 7740 addr[6] = 0x01; 7741 } else { 7742 memcpy(addr, &hdev->bdaddr, 6); 7743 addr[6] = 0x00; 7744 } 7745 7746 eir_len = eir_append_data(rp->eir, eir_len, EIR_LE_BDADDR, 7747 addr, sizeof(addr)); 7748 7749 if (hci_dev_test_flag(hdev, HCI_ADVERTISING)) 7750 role = 0x02; 7751 else 7752 role = 0x01; 7753 7754 eir_len = eir_append_data(rp->eir, eir_len, EIR_LE_ROLE, 7755 &role, sizeof(role)); 7756 7757 if (hci_dev_test_flag(hdev, HCI_SC_ENABLED)) { 7758 eir_len = eir_append_data(rp->eir, eir_len, 7759 EIR_LE_SC_CONFIRM, 7760 hash, sizeof(hash)); 7761 7762 eir_len = eir_append_data(rp->eir, eir_len, 7763 EIR_LE_SC_RANDOM, 7764 rand, sizeof(rand)); 7765 } 7766 7767 flags = mgmt_get_adv_discov_flags(hdev); 7768 7769 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) 7770 flags |= LE_AD_NO_BREDR; 7771 7772 eir_len = eir_append_data(rp->eir, eir_len, EIR_FLAGS, 7773 &flags, sizeof(flags)); 7774 break; 7775 } 7776 7777 hci_dev_unlock(hdev); 7778 7779 hci_sock_set_flag(sk, HCI_MGMT_OOB_DATA_EVENTS); 7780 7781 status = MGMT_STATUS_SUCCESS; 7782 7783 complete: 7784 rp->type = cp->type; 7785 rp->eir_len = cpu_to_le16(eir_len); 7786 7787 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_EXT_DATA, 7788 status, rp, sizeof(*rp) + eir_len); 7789 if (err < 0 || status) 7790 goto done; 7791 7792 err = mgmt_limited_event(MGMT_EV_LOCAL_OOB_DATA_UPDATED, hdev, 7793 rp, sizeof(*rp) + eir_len, 7794 HCI_MGMT_OOB_DATA_EVENTS, sk); 7795 7796 done: 7797 kfree(rp); 7798 7799 return err; 7800 } 7801 7802 static u32 get_supported_adv_flags(struct hci_dev *hdev) 7803 { 7804 u32 flags = 0; 7805 7806 flags |= MGMT_ADV_FLAG_CONNECTABLE; 7807 flags |= MGMT_ADV_FLAG_DISCOV; 7808 flags |= MGMT_ADV_FLAG_LIMITED_DISCOV; 7809 flags |= MGMT_ADV_FLAG_MANAGED_FLAGS; 7810 flags |= MGMT_ADV_FLAG_APPEARANCE; 7811 flags |= MGMT_ADV_FLAG_LOCAL_NAME; 7812 flags |= MGMT_ADV_PARAM_DURATION; 7813 flags |= MGMT_ADV_PARAM_TIMEOUT; 7814 flags |= MGMT_ADV_PARAM_INTERVALS; 7815 flags |= MGMT_ADV_PARAM_TX_POWER; 7816 flags |= MGMT_ADV_PARAM_SCAN_RSP; 7817 7818 /* In extended adv TX_POWER returned from Set Adv Param 7819 * will be always valid. 7820 */ 7821 if ((hdev->adv_tx_power != HCI_TX_POWER_INVALID) || 7822 ext_adv_capable(hdev)) 7823 flags |= MGMT_ADV_FLAG_TX_POWER; 7824 7825 if (ext_adv_capable(hdev)) { 7826 flags |= MGMT_ADV_FLAG_SEC_1M; 7827 flags |= MGMT_ADV_FLAG_HW_OFFLOAD; 7828 flags |= MGMT_ADV_FLAG_CAN_SET_TX_POWER; 7829 7830 if (hdev->le_features[1] & HCI_LE_PHY_2M) 7831 flags |= MGMT_ADV_FLAG_SEC_2M; 7832 7833 if (hdev->le_features[1] & HCI_LE_PHY_CODED) 7834 flags |= MGMT_ADV_FLAG_SEC_CODED; 7835 } 7836 7837 return flags; 7838 } 7839 7840 static int read_adv_features(struct sock *sk, struct hci_dev *hdev, 7841 void *data, u16 data_len) 7842 { 7843 struct mgmt_rp_read_adv_features *rp; 7844 size_t rp_len; 7845 int err; 7846 struct adv_info *adv_instance; 7847 u32 supported_flags; 7848 u8 *instance; 7849 7850 bt_dev_dbg(hdev, "sock %p", sk); 7851 7852 if (!lmp_le_capable(hdev)) 7853 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_ADV_FEATURES, 7854 MGMT_STATUS_REJECTED); 7855 7856 hci_dev_lock(hdev); 7857 7858 rp_len = sizeof(*rp) + hdev->adv_instance_cnt; 7859 rp = kmalloc(rp_len, GFP_ATOMIC); 7860 if (!rp) { 7861 hci_dev_unlock(hdev); 7862 return -ENOMEM; 7863 } 7864 7865 supported_flags = get_supported_adv_flags(hdev); 7866 7867 rp->supported_flags = cpu_to_le32(supported_flags); 7868 rp->max_adv_data_len = HCI_MAX_AD_LENGTH; 7869 rp->max_scan_rsp_len = HCI_MAX_AD_LENGTH; 7870 rp->max_instances = hdev->le_num_of_adv_sets; 7871 rp->num_instances = hdev->adv_instance_cnt; 7872 7873 instance = rp->instance; 7874 list_for_each_entry(adv_instance, &hdev->adv_instances, list) { 7875 *instance = adv_instance->instance; 7876 instance++; 7877 } 7878 7879 hci_dev_unlock(hdev); 7880 7881 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_ADV_FEATURES, 7882 MGMT_STATUS_SUCCESS, rp, rp_len); 7883 7884 kfree(rp); 7885 7886 return err; 7887 } 7888 7889 static u8 calculate_name_len(struct hci_dev *hdev) 7890 { 7891 u8 buf[HCI_MAX_SHORT_NAME_LENGTH + 3]; 7892 7893 return eir_append_local_name(hdev, buf, 0); 7894 } 7895 7896 static u8 tlv_data_max_len(struct hci_dev *hdev, u32 adv_flags, 7897 bool is_adv_data) 7898 { 7899 u8 max_len = HCI_MAX_AD_LENGTH; 7900 7901 if (is_adv_data) { 7902 if (adv_flags & (MGMT_ADV_FLAG_DISCOV | 7903 MGMT_ADV_FLAG_LIMITED_DISCOV | 7904 MGMT_ADV_FLAG_MANAGED_FLAGS)) 7905 max_len -= 3; 7906 7907 if (adv_flags & MGMT_ADV_FLAG_TX_POWER) 7908 max_len -= 3; 7909 } else { 7910 if (adv_flags & MGMT_ADV_FLAG_LOCAL_NAME) 7911 max_len -= calculate_name_len(hdev); 7912 7913 if (adv_flags & (MGMT_ADV_FLAG_APPEARANCE)) 7914 max_len -= 4; 7915 } 7916 7917 return max_len; 7918 } 7919 7920 static bool flags_managed(u32 adv_flags) 7921 { 7922 return adv_flags & (MGMT_ADV_FLAG_DISCOV | 7923 MGMT_ADV_FLAG_LIMITED_DISCOV | 7924 MGMT_ADV_FLAG_MANAGED_FLAGS); 7925 } 7926 7927 static bool tx_power_managed(u32 adv_flags) 7928 { 7929 return adv_flags & MGMT_ADV_FLAG_TX_POWER; 7930 } 7931 7932 static bool name_managed(u32 adv_flags) 7933 { 7934 return adv_flags & MGMT_ADV_FLAG_LOCAL_NAME; 7935 } 7936 7937 static bool appearance_managed(u32 adv_flags) 7938 { 7939 return adv_flags & MGMT_ADV_FLAG_APPEARANCE; 7940 } 7941 7942 static bool tlv_data_is_valid(struct hci_dev *hdev, u32 adv_flags, u8 *data, 7943 u8 len, bool is_adv_data) 7944 { 7945 int i, cur_len; 7946 u8 max_len; 7947 7948 max_len = tlv_data_max_len(hdev, adv_flags, is_adv_data); 7949 7950 if (len > max_len) 7951 return false; 7952 7953 /* Make sure that the data is correctly formatted. */ 7954 for (i = 0, cur_len = 0; i < len; i += (cur_len + 1)) { 7955 cur_len = data[i]; 7956 7957 if (!cur_len) 7958 continue; 7959 7960 if (data[i + 1] == EIR_FLAGS && 7961 (!is_adv_data || flags_managed(adv_flags))) 7962 return false; 7963 7964 if (data[i + 1] == EIR_TX_POWER && tx_power_managed(adv_flags)) 7965 return false; 7966 7967 if (data[i + 1] == EIR_NAME_COMPLETE && name_managed(adv_flags)) 7968 return false; 7969 7970 if (data[i + 1] == EIR_NAME_SHORT && name_managed(adv_flags)) 7971 return false; 7972 7973 if (data[i + 1] == EIR_APPEARANCE && 7974 appearance_managed(adv_flags)) 7975 return false; 7976 7977 /* If the current field length would exceed the total data 7978 * length, then it's invalid. 7979 */ 7980 if (i + cur_len >= len) 7981 return false; 7982 } 7983 7984 return true; 7985 } 7986 7987 static bool requested_adv_flags_are_valid(struct hci_dev *hdev, u32 adv_flags) 7988 { 7989 u32 supported_flags, phy_flags; 7990 7991 /* The current implementation only supports a subset of the specified 7992 * flags. Also need to check mutual exclusiveness of sec flags. 7993 */ 7994 supported_flags = get_supported_adv_flags(hdev); 7995 phy_flags = adv_flags & MGMT_ADV_FLAG_SEC_MASK; 7996 if (adv_flags & ~supported_flags || 7997 ((phy_flags && (phy_flags ^ (phy_flags & -phy_flags))))) 7998 return false; 7999 8000 return true; 8001 } 8002 8003 static bool adv_busy(struct hci_dev *hdev) 8004 { 8005 return pending_find(MGMT_OP_SET_LE, hdev); 8006 } 8007 8008 static void add_adv_complete(struct hci_dev *hdev, struct sock *sk, u8 instance, 8009 int err) 8010 { 8011 struct adv_info *adv, *n; 8012 8013 bt_dev_dbg(hdev, "err %d", err); 8014 8015 hci_dev_lock(hdev); 8016 8017 list_for_each_entry_safe(adv, n, &hdev->adv_instances, list) { 8018 u8 instance; 8019 8020 if (!adv->pending) 8021 continue; 8022 8023 if (!err) { 8024 adv->pending = false; 8025 continue; 8026 } 8027 8028 instance = adv->instance; 8029 8030 if (hdev->cur_adv_instance == instance) 8031 cancel_adv_timeout(hdev); 8032 8033 hci_remove_adv_instance(hdev, instance); 8034 mgmt_advertising_removed(sk, hdev, instance); 8035 } 8036 8037 hci_dev_unlock(hdev); 8038 } 8039 8040 static void add_advertising_complete(struct hci_dev *hdev, void *data, int err) 8041 { 8042 struct mgmt_pending_cmd *cmd = data; 8043 struct mgmt_cp_add_advertising *cp = cmd->param; 8044 struct mgmt_rp_add_advertising rp; 8045 8046 memset(&rp, 0, sizeof(rp)); 8047 8048 rp.instance = cp->instance; 8049 8050 if (err) 8051 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, 8052 mgmt_status(err)); 8053 else 8054 mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, 8055 mgmt_status(err), &rp, sizeof(rp)); 8056 8057 add_adv_complete(hdev, cmd->sk, cp->instance, err); 8058 8059 mgmt_pending_free(cmd); 8060 } 8061 8062 static int add_advertising_sync(struct hci_dev *hdev, void *data) 8063 { 8064 struct mgmt_pending_cmd *cmd = data; 8065 struct mgmt_cp_add_advertising *cp = cmd->param; 8066 8067 return hci_schedule_adv_instance_sync(hdev, cp->instance, true); 8068 } 8069 8070 static int add_advertising(struct sock *sk, struct hci_dev *hdev, 8071 void *data, u16 data_len) 8072 { 8073 struct mgmt_cp_add_advertising *cp = data; 8074 struct mgmt_rp_add_advertising rp; 8075 u32 flags; 8076 u8 status; 8077 u16 timeout, duration; 8078 unsigned int prev_instance_cnt = hdev->adv_instance_cnt; 8079 u8 schedule_instance = 0; 8080 struct adv_info *next_instance; 8081 int err; 8082 struct mgmt_pending_cmd *cmd; 8083 8084 bt_dev_dbg(hdev, "sock %p", sk); 8085 8086 status = mgmt_le_support(hdev); 8087 if (status) 8088 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING, 8089 status); 8090 8091 if (cp->instance < 1 || cp->instance > hdev->le_num_of_adv_sets) 8092 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING, 8093 MGMT_STATUS_INVALID_PARAMS); 8094 8095 if (data_len != sizeof(*cp) + cp->adv_data_len + cp->scan_rsp_len) 8096 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING, 8097 MGMT_STATUS_INVALID_PARAMS); 8098 8099 flags = __le32_to_cpu(cp->flags); 8100 timeout = __le16_to_cpu(cp->timeout); 8101 duration = __le16_to_cpu(cp->duration); 8102 8103 if (!requested_adv_flags_are_valid(hdev, flags)) 8104 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING, 8105 MGMT_STATUS_INVALID_PARAMS); 8106 8107 hci_dev_lock(hdev); 8108 8109 if (timeout && !hdev_is_powered(hdev)) { 8110 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING, 8111 MGMT_STATUS_REJECTED); 8112 goto unlock; 8113 } 8114 8115 if (adv_busy(hdev)) { 8116 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING, 8117 MGMT_STATUS_BUSY); 8118 goto unlock; 8119 } 8120 8121 if (!tlv_data_is_valid(hdev, flags, cp->data, cp->adv_data_len, true) || 8122 !tlv_data_is_valid(hdev, flags, cp->data + cp->adv_data_len, 8123 cp->scan_rsp_len, false)) { 8124 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING, 8125 MGMT_STATUS_INVALID_PARAMS); 8126 goto unlock; 8127 } 8128 8129 err = hci_add_adv_instance(hdev, cp->instance, flags, 8130 cp->adv_data_len, cp->data, 8131 cp->scan_rsp_len, 8132 cp->data + cp->adv_data_len, 8133 timeout, duration, 8134 HCI_ADV_TX_POWER_NO_PREFERENCE, 8135 hdev->le_adv_min_interval, 8136 hdev->le_adv_max_interval); 8137 if (err < 0) { 8138 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING, 8139 MGMT_STATUS_FAILED); 8140 goto unlock; 8141 } 8142 8143 /* Only trigger an advertising added event if a new instance was 8144 * actually added. 8145 */ 8146 if (hdev->adv_instance_cnt > prev_instance_cnt) 8147 mgmt_advertising_added(sk, hdev, cp->instance); 8148 8149 if (hdev->cur_adv_instance == cp->instance) { 8150 /* If the currently advertised instance is being changed then 8151 * cancel the current advertising and schedule the next 8152 * instance. If there is only one instance then the overridden 8153 * advertising data will be visible right away. 8154 */ 8155 cancel_adv_timeout(hdev); 8156 8157 next_instance = hci_get_next_instance(hdev, cp->instance); 8158 if (next_instance) 8159 schedule_instance = next_instance->instance; 8160 } else if (!hdev->adv_instance_timeout) { 8161 /* Immediately advertise the new instance if no other 8162 * instance is currently being advertised. 8163 */ 8164 schedule_instance = cp->instance; 8165 } 8166 8167 /* If the HCI_ADVERTISING flag is set or the device isn't powered or 8168 * there is no instance to be advertised then we have no HCI 8169 * communication to make. Simply return. 8170 */ 8171 if (!hdev_is_powered(hdev) || 8172 hci_dev_test_flag(hdev, HCI_ADVERTISING) || 8173 !schedule_instance) { 8174 rp.instance = cp->instance; 8175 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_ADVERTISING, 8176 MGMT_STATUS_SUCCESS, &rp, sizeof(rp)); 8177 goto unlock; 8178 } 8179 8180 /* We're good to go, update advertising data, parameters, and start 8181 * advertising. 8182 */ 8183 cmd = mgmt_pending_new(sk, MGMT_OP_ADD_ADVERTISING, hdev, data, 8184 data_len); 8185 if (!cmd) { 8186 err = -ENOMEM; 8187 goto unlock; 8188 } 8189 8190 cp->instance = schedule_instance; 8191 8192 err = hci_cmd_sync_queue(hdev, add_advertising_sync, cmd, 8193 add_advertising_complete); 8194 if (err < 0) 8195 mgmt_pending_free(cmd); 8196 8197 unlock: 8198 hci_dev_unlock(hdev); 8199 8200 return err; 8201 } 8202 8203 static void add_ext_adv_params_complete(struct hci_dev *hdev, void *data, 8204 int err) 8205 { 8206 struct mgmt_pending_cmd *cmd = data; 8207 struct mgmt_cp_add_ext_adv_params *cp = cmd->param; 8208 struct mgmt_rp_add_ext_adv_params rp; 8209 struct adv_info *adv; 8210 u32 flags; 8211 8212 BT_DBG("%s", hdev->name); 8213 8214 hci_dev_lock(hdev); 8215 8216 adv = hci_find_adv_instance(hdev, cp->instance); 8217 if (!adv) 8218 goto unlock; 8219 8220 rp.instance = cp->instance; 8221 rp.tx_power = adv->tx_power; 8222 8223 /* While we're at it, inform userspace of the available space for this 8224 * advertisement, given the flags that will be used. 8225 */ 8226 flags = __le32_to_cpu(cp->flags); 8227 rp.max_adv_data_len = tlv_data_max_len(hdev, flags, true); 8228 rp.max_scan_rsp_len = tlv_data_max_len(hdev, flags, false); 8229 8230 if (err) { 8231 /* If this advertisement was previously advertising and we 8232 * failed to update it, we signal that it has been removed and 8233 * delete its structure 8234 */ 8235 if (!adv->pending) 8236 mgmt_advertising_removed(cmd->sk, hdev, cp->instance); 8237 8238 hci_remove_adv_instance(hdev, cp->instance); 8239 8240 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, 8241 mgmt_status(err)); 8242 } else { 8243 mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, 8244 mgmt_status(err), &rp, sizeof(rp)); 8245 } 8246 8247 unlock: 8248 if (cmd) 8249 mgmt_pending_free(cmd); 8250 8251 hci_dev_unlock(hdev); 8252 } 8253 8254 static int add_ext_adv_params_sync(struct hci_dev *hdev, void *data) 8255 { 8256 struct mgmt_pending_cmd *cmd = data; 8257 struct mgmt_cp_add_ext_adv_params *cp = cmd->param; 8258 8259 return hci_setup_ext_adv_instance_sync(hdev, cp->instance); 8260 } 8261 8262 static int add_ext_adv_params(struct sock *sk, struct hci_dev *hdev, 8263 void *data, u16 data_len) 8264 { 8265 struct mgmt_cp_add_ext_adv_params *cp = data; 8266 struct mgmt_rp_add_ext_adv_params rp; 8267 struct mgmt_pending_cmd *cmd = NULL; 8268 u32 flags, min_interval, max_interval; 8269 u16 timeout, duration; 8270 u8 status; 8271 s8 tx_power; 8272 int err; 8273 8274 BT_DBG("%s", hdev->name); 8275 8276 status = mgmt_le_support(hdev); 8277 if (status) 8278 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_PARAMS, 8279 status); 8280 8281 if (cp->instance < 1 || cp->instance > hdev->le_num_of_adv_sets) 8282 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_PARAMS, 8283 MGMT_STATUS_INVALID_PARAMS); 8284 8285 /* The purpose of breaking add_advertising into two separate MGMT calls 8286 * for params and data is to allow more parameters to be added to this 8287 * structure in the future. For this reason, we verify that we have the 8288 * bare minimum structure we know of when the interface was defined. Any 8289 * extra parameters we don't know about will be ignored in this request. 8290 */ 8291 if (data_len < MGMT_ADD_EXT_ADV_PARAMS_MIN_SIZE) 8292 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING, 8293 MGMT_STATUS_INVALID_PARAMS); 8294 8295 flags = __le32_to_cpu(cp->flags); 8296 8297 if (!requested_adv_flags_are_valid(hdev, flags)) 8298 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_PARAMS, 8299 MGMT_STATUS_INVALID_PARAMS); 8300 8301 hci_dev_lock(hdev); 8302 8303 /* In new interface, we require that we are powered to register */ 8304 if (!hdev_is_powered(hdev)) { 8305 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_PARAMS, 8306 MGMT_STATUS_REJECTED); 8307 goto unlock; 8308 } 8309 8310 if (adv_busy(hdev)) { 8311 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_PARAMS, 8312 MGMT_STATUS_BUSY); 8313 goto unlock; 8314 } 8315 8316 /* Parse defined parameters from request, use defaults otherwise */ 8317 timeout = (flags & MGMT_ADV_PARAM_TIMEOUT) ? 8318 __le16_to_cpu(cp->timeout) : 0; 8319 8320 duration = (flags & MGMT_ADV_PARAM_DURATION) ? 8321 __le16_to_cpu(cp->duration) : 8322 hdev->def_multi_adv_rotation_duration; 8323 8324 min_interval = (flags & MGMT_ADV_PARAM_INTERVALS) ? 8325 __le32_to_cpu(cp->min_interval) : 8326 hdev->le_adv_min_interval; 8327 8328 max_interval = (flags & MGMT_ADV_PARAM_INTERVALS) ? 8329 __le32_to_cpu(cp->max_interval) : 8330 hdev->le_adv_max_interval; 8331 8332 tx_power = (flags & MGMT_ADV_PARAM_TX_POWER) ? 8333 cp->tx_power : 8334 HCI_ADV_TX_POWER_NO_PREFERENCE; 8335 8336 /* Create advertising instance with no advertising or response data */ 8337 err = hci_add_adv_instance(hdev, cp->instance, flags, 8338 0, NULL, 0, NULL, timeout, duration, 8339 tx_power, min_interval, max_interval); 8340 8341 if (err < 0) { 8342 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_PARAMS, 8343 MGMT_STATUS_FAILED); 8344 goto unlock; 8345 } 8346 8347 /* Submit request for advertising params if ext adv available */ 8348 if (ext_adv_capable(hdev)) { 8349 cmd = mgmt_pending_new(sk, MGMT_OP_ADD_EXT_ADV_PARAMS, hdev, 8350 data, data_len); 8351 if (!cmd) { 8352 err = -ENOMEM; 8353 hci_remove_adv_instance(hdev, cp->instance); 8354 goto unlock; 8355 } 8356 8357 err = hci_cmd_sync_queue(hdev, add_ext_adv_params_sync, cmd, 8358 add_ext_adv_params_complete); 8359 if (err < 0) 8360 mgmt_pending_free(cmd); 8361 } else { 8362 rp.instance = cp->instance; 8363 rp.tx_power = HCI_ADV_TX_POWER_NO_PREFERENCE; 8364 rp.max_adv_data_len = tlv_data_max_len(hdev, flags, true); 8365 rp.max_scan_rsp_len = tlv_data_max_len(hdev, flags, false); 8366 err = mgmt_cmd_complete(sk, hdev->id, 8367 MGMT_OP_ADD_EXT_ADV_PARAMS, 8368 MGMT_STATUS_SUCCESS, &rp, sizeof(rp)); 8369 } 8370 8371 unlock: 8372 hci_dev_unlock(hdev); 8373 8374 return err; 8375 } 8376 8377 static void add_ext_adv_data_complete(struct hci_dev *hdev, void *data, int err) 8378 { 8379 struct mgmt_pending_cmd *cmd = data; 8380 struct mgmt_cp_add_ext_adv_data *cp = cmd->param; 8381 struct mgmt_rp_add_advertising rp; 8382 8383 add_adv_complete(hdev, cmd->sk, cp->instance, err); 8384 8385 memset(&rp, 0, sizeof(rp)); 8386 8387 rp.instance = cp->instance; 8388 8389 if (err) 8390 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, 8391 mgmt_status(err)); 8392 else 8393 mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, 8394 mgmt_status(err), &rp, sizeof(rp)); 8395 8396 mgmt_pending_free(cmd); 8397 } 8398 8399 static int add_ext_adv_data_sync(struct hci_dev *hdev, void *data) 8400 { 8401 struct mgmt_pending_cmd *cmd = data; 8402 struct mgmt_cp_add_ext_adv_data *cp = cmd->param; 8403 int err; 8404 8405 if (ext_adv_capable(hdev)) { 8406 err = hci_update_adv_data_sync(hdev, cp->instance); 8407 if (err) 8408 return err; 8409 8410 err = hci_update_scan_rsp_data_sync(hdev, cp->instance); 8411 if (err) 8412 return err; 8413 8414 return hci_enable_ext_advertising_sync(hdev, cp->instance); 8415 } 8416 8417 return hci_schedule_adv_instance_sync(hdev, cp->instance, true); 8418 } 8419 8420 static int add_ext_adv_data(struct sock *sk, struct hci_dev *hdev, void *data, 8421 u16 data_len) 8422 { 8423 struct mgmt_cp_add_ext_adv_data *cp = data; 8424 struct mgmt_rp_add_ext_adv_data rp; 8425 u8 schedule_instance = 0; 8426 struct adv_info *next_instance; 8427 struct adv_info *adv_instance; 8428 int err = 0; 8429 struct mgmt_pending_cmd *cmd; 8430 8431 BT_DBG("%s", hdev->name); 8432 8433 hci_dev_lock(hdev); 8434 8435 adv_instance = hci_find_adv_instance(hdev, cp->instance); 8436 8437 if (!adv_instance) { 8438 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_DATA, 8439 MGMT_STATUS_INVALID_PARAMS); 8440 goto unlock; 8441 } 8442 8443 /* In new interface, we require that we are powered to register */ 8444 if (!hdev_is_powered(hdev)) { 8445 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_DATA, 8446 MGMT_STATUS_REJECTED); 8447 goto clear_new_instance; 8448 } 8449 8450 if (adv_busy(hdev)) { 8451 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_DATA, 8452 MGMT_STATUS_BUSY); 8453 goto clear_new_instance; 8454 } 8455 8456 /* Validate new data */ 8457 if (!tlv_data_is_valid(hdev, adv_instance->flags, cp->data, 8458 cp->adv_data_len, true) || 8459 !tlv_data_is_valid(hdev, adv_instance->flags, cp->data + 8460 cp->adv_data_len, cp->scan_rsp_len, false)) { 8461 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_DATA, 8462 MGMT_STATUS_INVALID_PARAMS); 8463 goto clear_new_instance; 8464 } 8465 8466 /* Set the data in the advertising instance */ 8467 hci_set_adv_instance_data(hdev, cp->instance, cp->adv_data_len, 8468 cp->data, cp->scan_rsp_len, 8469 cp->data + cp->adv_data_len); 8470 8471 /* If using software rotation, determine next instance to use */ 8472 if (hdev->cur_adv_instance == cp->instance) { 8473 /* If the currently advertised instance is being changed 8474 * then cancel the current advertising and schedule the 8475 * next instance. If there is only one instance then the 8476 * overridden advertising data will be visible right 8477 * away 8478 */ 8479 cancel_adv_timeout(hdev); 8480 8481 next_instance = hci_get_next_instance(hdev, cp->instance); 8482 if (next_instance) 8483 schedule_instance = next_instance->instance; 8484 } else if (!hdev->adv_instance_timeout) { 8485 /* Immediately advertise the new instance if no other 8486 * instance is currently being advertised. 8487 */ 8488 schedule_instance = cp->instance; 8489 } 8490 8491 /* If the HCI_ADVERTISING flag is set or there is no instance to 8492 * be advertised then we have no HCI communication to make. 8493 * Simply return. 8494 */ 8495 if (hci_dev_test_flag(hdev, HCI_ADVERTISING) || !schedule_instance) { 8496 if (adv_instance->pending) { 8497 mgmt_advertising_added(sk, hdev, cp->instance); 8498 adv_instance->pending = false; 8499 } 8500 rp.instance = cp->instance; 8501 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_DATA, 8502 MGMT_STATUS_SUCCESS, &rp, sizeof(rp)); 8503 goto unlock; 8504 } 8505 8506 cmd = mgmt_pending_new(sk, MGMT_OP_ADD_EXT_ADV_DATA, hdev, data, 8507 data_len); 8508 if (!cmd) { 8509 err = -ENOMEM; 8510 goto clear_new_instance; 8511 } 8512 8513 err = hci_cmd_sync_queue(hdev, add_ext_adv_data_sync, cmd, 8514 add_ext_adv_data_complete); 8515 if (err < 0) { 8516 mgmt_pending_free(cmd); 8517 goto clear_new_instance; 8518 } 8519 8520 /* We were successful in updating data, so trigger advertising_added 8521 * event if this is an instance that wasn't previously advertising. If 8522 * a failure occurs in the requests we initiated, we will remove the 8523 * instance again in add_advertising_complete 8524 */ 8525 if (adv_instance->pending) 8526 mgmt_advertising_added(sk, hdev, cp->instance); 8527 8528 goto unlock; 8529 8530 clear_new_instance: 8531 hci_remove_adv_instance(hdev, cp->instance); 8532 8533 unlock: 8534 hci_dev_unlock(hdev); 8535 8536 return err; 8537 } 8538 8539 static void remove_advertising_complete(struct hci_dev *hdev, void *data, 8540 int err) 8541 { 8542 struct mgmt_pending_cmd *cmd = data; 8543 struct mgmt_cp_remove_advertising *cp = cmd->param; 8544 struct mgmt_rp_remove_advertising rp; 8545 8546 bt_dev_dbg(hdev, "err %d", err); 8547 8548 memset(&rp, 0, sizeof(rp)); 8549 rp.instance = cp->instance; 8550 8551 if (err) 8552 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, 8553 mgmt_status(err)); 8554 else 8555 mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, 8556 MGMT_STATUS_SUCCESS, &rp, sizeof(rp)); 8557 8558 mgmt_pending_free(cmd); 8559 } 8560 8561 static int remove_advertising_sync(struct hci_dev *hdev, void *data) 8562 { 8563 struct mgmt_pending_cmd *cmd = data; 8564 struct mgmt_cp_remove_advertising *cp = cmd->param; 8565 int err; 8566 8567 err = hci_remove_advertising_sync(hdev, cmd->sk, cp->instance, true); 8568 if (err) 8569 return err; 8570 8571 if (list_empty(&hdev->adv_instances)) 8572 err = hci_disable_advertising_sync(hdev); 8573 8574 return err; 8575 } 8576 8577 static int remove_advertising(struct sock *sk, struct hci_dev *hdev, 8578 void *data, u16 data_len) 8579 { 8580 struct mgmt_cp_remove_advertising *cp = data; 8581 struct mgmt_pending_cmd *cmd; 8582 int err; 8583 8584 bt_dev_dbg(hdev, "sock %p", sk); 8585 8586 hci_dev_lock(hdev); 8587 8588 if (cp->instance && !hci_find_adv_instance(hdev, cp->instance)) { 8589 err = mgmt_cmd_status(sk, hdev->id, 8590 MGMT_OP_REMOVE_ADVERTISING, 8591 MGMT_STATUS_INVALID_PARAMS); 8592 goto unlock; 8593 } 8594 8595 if (pending_find(MGMT_OP_SET_LE, hdev)) { 8596 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_ADVERTISING, 8597 MGMT_STATUS_BUSY); 8598 goto unlock; 8599 } 8600 8601 if (list_empty(&hdev->adv_instances)) { 8602 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_ADVERTISING, 8603 MGMT_STATUS_INVALID_PARAMS); 8604 goto unlock; 8605 } 8606 8607 cmd = mgmt_pending_new(sk, MGMT_OP_REMOVE_ADVERTISING, hdev, data, 8608 data_len); 8609 if (!cmd) { 8610 err = -ENOMEM; 8611 goto unlock; 8612 } 8613 8614 err = hci_cmd_sync_queue(hdev, remove_advertising_sync, cmd, 8615 remove_advertising_complete); 8616 if (err < 0) 8617 mgmt_pending_free(cmd); 8618 8619 unlock: 8620 hci_dev_unlock(hdev); 8621 8622 return err; 8623 } 8624 8625 static int get_adv_size_info(struct sock *sk, struct hci_dev *hdev, 8626 void *data, u16 data_len) 8627 { 8628 struct mgmt_cp_get_adv_size_info *cp = data; 8629 struct mgmt_rp_get_adv_size_info rp; 8630 u32 flags, supported_flags; 8631 int err; 8632 8633 bt_dev_dbg(hdev, "sock %p", sk); 8634 8635 if (!lmp_le_capable(hdev)) 8636 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_ADV_SIZE_INFO, 8637 MGMT_STATUS_REJECTED); 8638 8639 if (cp->instance < 1 || cp->instance > hdev->le_num_of_adv_sets) 8640 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_ADV_SIZE_INFO, 8641 MGMT_STATUS_INVALID_PARAMS); 8642 8643 flags = __le32_to_cpu(cp->flags); 8644 8645 /* The current implementation only supports a subset of the specified 8646 * flags. 8647 */ 8648 supported_flags = get_supported_adv_flags(hdev); 8649 if (flags & ~supported_flags) 8650 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_ADV_SIZE_INFO, 8651 MGMT_STATUS_INVALID_PARAMS); 8652 8653 rp.instance = cp->instance; 8654 rp.flags = cp->flags; 8655 rp.max_adv_data_len = tlv_data_max_len(hdev, flags, true); 8656 rp.max_scan_rsp_len = tlv_data_max_len(hdev, flags, false); 8657 8658 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_ADV_SIZE_INFO, 8659 MGMT_STATUS_SUCCESS, &rp, sizeof(rp)); 8660 8661 return err; 8662 } 8663 8664 static const struct hci_mgmt_handler mgmt_handlers[] = { 8665 { NULL }, /* 0x0000 (no command) */ 8666 { read_version, MGMT_READ_VERSION_SIZE, 8667 HCI_MGMT_NO_HDEV | 8668 HCI_MGMT_UNTRUSTED }, 8669 { read_commands, MGMT_READ_COMMANDS_SIZE, 8670 HCI_MGMT_NO_HDEV | 8671 HCI_MGMT_UNTRUSTED }, 8672 { read_index_list, MGMT_READ_INDEX_LIST_SIZE, 8673 HCI_MGMT_NO_HDEV | 8674 HCI_MGMT_UNTRUSTED }, 8675 { read_controller_info, MGMT_READ_INFO_SIZE, 8676 HCI_MGMT_UNTRUSTED }, 8677 { set_powered, MGMT_SETTING_SIZE }, 8678 { set_discoverable, MGMT_SET_DISCOVERABLE_SIZE }, 8679 { set_connectable, MGMT_SETTING_SIZE }, 8680 { set_fast_connectable, MGMT_SETTING_SIZE }, 8681 { set_bondable, MGMT_SETTING_SIZE }, 8682 { set_link_security, MGMT_SETTING_SIZE }, 8683 { set_ssp, MGMT_SETTING_SIZE }, 8684 { set_hs, MGMT_SETTING_SIZE }, 8685 { set_le, MGMT_SETTING_SIZE }, 8686 { set_dev_class, MGMT_SET_DEV_CLASS_SIZE }, 8687 { set_local_name, MGMT_SET_LOCAL_NAME_SIZE }, 8688 { add_uuid, MGMT_ADD_UUID_SIZE }, 8689 { remove_uuid, MGMT_REMOVE_UUID_SIZE }, 8690 { load_link_keys, MGMT_LOAD_LINK_KEYS_SIZE, 8691 HCI_MGMT_VAR_LEN }, 8692 { load_long_term_keys, MGMT_LOAD_LONG_TERM_KEYS_SIZE, 8693 HCI_MGMT_VAR_LEN }, 8694 { disconnect, MGMT_DISCONNECT_SIZE }, 8695 { get_connections, MGMT_GET_CONNECTIONS_SIZE }, 8696 { pin_code_reply, MGMT_PIN_CODE_REPLY_SIZE }, 8697 { pin_code_neg_reply, MGMT_PIN_CODE_NEG_REPLY_SIZE }, 8698 { set_io_capability, MGMT_SET_IO_CAPABILITY_SIZE }, 8699 { pair_device, MGMT_PAIR_DEVICE_SIZE }, 8700 { cancel_pair_device, MGMT_CANCEL_PAIR_DEVICE_SIZE }, 8701 { unpair_device, MGMT_UNPAIR_DEVICE_SIZE }, 8702 { user_confirm_reply, MGMT_USER_CONFIRM_REPLY_SIZE }, 8703 { user_confirm_neg_reply, MGMT_USER_CONFIRM_NEG_REPLY_SIZE }, 8704 { user_passkey_reply, MGMT_USER_PASSKEY_REPLY_SIZE }, 8705 { user_passkey_neg_reply, MGMT_USER_PASSKEY_NEG_REPLY_SIZE }, 8706 { read_local_oob_data, MGMT_READ_LOCAL_OOB_DATA_SIZE }, 8707 { add_remote_oob_data, MGMT_ADD_REMOTE_OOB_DATA_SIZE, 8708 HCI_MGMT_VAR_LEN }, 8709 { remove_remote_oob_data, MGMT_REMOVE_REMOTE_OOB_DATA_SIZE }, 8710 { start_discovery, MGMT_START_DISCOVERY_SIZE }, 8711 { stop_discovery, MGMT_STOP_DISCOVERY_SIZE }, 8712 { confirm_name, MGMT_CONFIRM_NAME_SIZE }, 8713 { block_device, MGMT_BLOCK_DEVICE_SIZE }, 8714 { unblock_device, MGMT_UNBLOCK_DEVICE_SIZE }, 8715 { set_device_id, MGMT_SET_DEVICE_ID_SIZE }, 8716 { set_advertising, MGMT_SETTING_SIZE }, 8717 { set_bredr, MGMT_SETTING_SIZE }, 8718 { set_static_address, MGMT_SET_STATIC_ADDRESS_SIZE }, 8719 { set_scan_params, MGMT_SET_SCAN_PARAMS_SIZE }, 8720 { set_secure_conn, MGMT_SETTING_SIZE }, 8721 { set_debug_keys, MGMT_SETTING_SIZE }, 8722 { set_privacy, MGMT_SET_PRIVACY_SIZE }, 8723 { load_irks, MGMT_LOAD_IRKS_SIZE, 8724 HCI_MGMT_VAR_LEN }, 8725 { get_conn_info, MGMT_GET_CONN_INFO_SIZE }, 8726 { get_clock_info, MGMT_GET_CLOCK_INFO_SIZE }, 8727 { add_device, MGMT_ADD_DEVICE_SIZE }, 8728 { remove_device, MGMT_REMOVE_DEVICE_SIZE }, 8729 { load_conn_param, MGMT_LOAD_CONN_PARAM_SIZE, 8730 HCI_MGMT_VAR_LEN }, 8731 { read_unconf_index_list, MGMT_READ_UNCONF_INDEX_LIST_SIZE, 8732 HCI_MGMT_NO_HDEV | 8733 HCI_MGMT_UNTRUSTED }, 8734 { read_config_info, MGMT_READ_CONFIG_INFO_SIZE, 8735 HCI_MGMT_UNCONFIGURED | 8736 HCI_MGMT_UNTRUSTED }, 8737 { set_external_config, MGMT_SET_EXTERNAL_CONFIG_SIZE, 8738 HCI_MGMT_UNCONFIGURED }, 8739 { set_public_address, MGMT_SET_PUBLIC_ADDRESS_SIZE, 8740 HCI_MGMT_UNCONFIGURED }, 8741 { start_service_discovery, MGMT_START_SERVICE_DISCOVERY_SIZE, 8742 HCI_MGMT_VAR_LEN }, 8743 { read_local_oob_ext_data, MGMT_READ_LOCAL_OOB_EXT_DATA_SIZE }, 8744 { read_ext_index_list, MGMT_READ_EXT_INDEX_LIST_SIZE, 8745 HCI_MGMT_NO_HDEV | 8746 HCI_MGMT_UNTRUSTED }, 8747 { read_adv_features, MGMT_READ_ADV_FEATURES_SIZE }, 8748 { add_advertising, MGMT_ADD_ADVERTISING_SIZE, 8749 HCI_MGMT_VAR_LEN }, 8750 { remove_advertising, MGMT_REMOVE_ADVERTISING_SIZE }, 8751 { get_adv_size_info, MGMT_GET_ADV_SIZE_INFO_SIZE }, 8752 { start_limited_discovery, MGMT_START_DISCOVERY_SIZE }, 8753 { read_ext_controller_info,MGMT_READ_EXT_INFO_SIZE, 8754 HCI_MGMT_UNTRUSTED }, 8755 { set_appearance, MGMT_SET_APPEARANCE_SIZE }, 8756 { get_phy_configuration, MGMT_GET_PHY_CONFIGURATION_SIZE }, 8757 { set_phy_configuration, MGMT_SET_PHY_CONFIGURATION_SIZE }, 8758 { set_blocked_keys, MGMT_OP_SET_BLOCKED_KEYS_SIZE, 8759 HCI_MGMT_VAR_LEN }, 8760 { set_wideband_speech, MGMT_SETTING_SIZE }, 8761 { read_controller_cap, MGMT_READ_CONTROLLER_CAP_SIZE, 8762 HCI_MGMT_UNTRUSTED }, 8763 { read_exp_features_info, MGMT_READ_EXP_FEATURES_INFO_SIZE, 8764 HCI_MGMT_UNTRUSTED | 8765 HCI_MGMT_HDEV_OPTIONAL }, 8766 { set_exp_feature, MGMT_SET_EXP_FEATURE_SIZE, 8767 HCI_MGMT_VAR_LEN | 8768 HCI_MGMT_HDEV_OPTIONAL }, 8769 { read_def_system_config, MGMT_READ_DEF_SYSTEM_CONFIG_SIZE, 8770 HCI_MGMT_UNTRUSTED }, 8771 { set_def_system_config, MGMT_SET_DEF_SYSTEM_CONFIG_SIZE, 8772 HCI_MGMT_VAR_LEN }, 8773 { read_def_runtime_config, MGMT_READ_DEF_RUNTIME_CONFIG_SIZE, 8774 HCI_MGMT_UNTRUSTED }, 8775 { set_def_runtime_config, MGMT_SET_DEF_RUNTIME_CONFIG_SIZE, 8776 HCI_MGMT_VAR_LEN }, 8777 { get_device_flags, MGMT_GET_DEVICE_FLAGS_SIZE }, 8778 { set_device_flags, MGMT_SET_DEVICE_FLAGS_SIZE }, 8779 { read_adv_mon_features, MGMT_READ_ADV_MONITOR_FEATURES_SIZE }, 8780 { add_adv_patterns_monitor,MGMT_ADD_ADV_PATTERNS_MONITOR_SIZE, 8781 HCI_MGMT_VAR_LEN }, 8782 { remove_adv_monitor, MGMT_REMOVE_ADV_MONITOR_SIZE }, 8783 { add_ext_adv_params, MGMT_ADD_EXT_ADV_PARAMS_MIN_SIZE, 8784 HCI_MGMT_VAR_LEN }, 8785 { add_ext_adv_data, MGMT_ADD_EXT_ADV_DATA_SIZE, 8786 HCI_MGMT_VAR_LEN }, 8787 { add_adv_patterns_monitor_rssi, 8788 MGMT_ADD_ADV_PATTERNS_MONITOR_RSSI_SIZE, 8789 HCI_MGMT_VAR_LEN }, 8790 }; 8791 8792 void mgmt_index_added(struct hci_dev *hdev) 8793 { 8794 struct mgmt_ev_ext_index ev; 8795 8796 if (test_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks)) 8797 return; 8798 8799 switch (hdev->dev_type) { 8800 case HCI_PRIMARY: 8801 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) { 8802 mgmt_index_event(MGMT_EV_UNCONF_INDEX_ADDED, hdev, 8803 NULL, 0, HCI_MGMT_UNCONF_INDEX_EVENTS); 8804 ev.type = 0x01; 8805 } else { 8806 mgmt_index_event(MGMT_EV_INDEX_ADDED, hdev, NULL, 0, 8807 HCI_MGMT_INDEX_EVENTS); 8808 ev.type = 0x00; 8809 } 8810 break; 8811 case HCI_AMP: 8812 ev.type = 0x02; 8813 break; 8814 default: 8815 return; 8816 } 8817 8818 ev.bus = hdev->bus; 8819 8820 mgmt_index_event(MGMT_EV_EXT_INDEX_ADDED, hdev, &ev, sizeof(ev), 8821 HCI_MGMT_EXT_INDEX_EVENTS); 8822 } 8823 8824 void mgmt_index_removed(struct hci_dev *hdev) 8825 { 8826 struct mgmt_ev_ext_index ev; 8827 u8 status = MGMT_STATUS_INVALID_INDEX; 8828 8829 if (test_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks)) 8830 return; 8831 8832 switch (hdev->dev_type) { 8833 case HCI_PRIMARY: 8834 mgmt_pending_foreach(0, hdev, cmd_complete_rsp, &status); 8835 8836 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) { 8837 mgmt_index_event(MGMT_EV_UNCONF_INDEX_REMOVED, hdev, 8838 NULL, 0, HCI_MGMT_UNCONF_INDEX_EVENTS); 8839 ev.type = 0x01; 8840 } else { 8841 mgmt_index_event(MGMT_EV_INDEX_REMOVED, hdev, NULL, 0, 8842 HCI_MGMT_INDEX_EVENTS); 8843 ev.type = 0x00; 8844 } 8845 break; 8846 case HCI_AMP: 8847 ev.type = 0x02; 8848 break; 8849 default: 8850 return; 8851 } 8852 8853 ev.bus = hdev->bus; 8854 8855 mgmt_index_event(MGMT_EV_EXT_INDEX_REMOVED, hdev, &ev, sizeof(ev), 8856 HCI_MGMT_EXT_INDEX_EVENTS); 8857 } 8858 8859 void mgmt_power_on(struct hci_dev *hdev, int err) 8860 { 8861 struct cmd_lookup match = { NULL, hdev }; 8862 8863 bt_dev_dbg(hdev, "err %d", err); 8864 8865 hci_dev_lock(hdev); 8866 8867 if (!err) { 8868 restart_le_actions(hdev); 8869 hci_update_passive_scan(hdev); 8870 } 8871 8872 mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp, &match); 8873 8874 new_settings(hdev, match.sk); 8875 8876 if (match.sk) 8877 sock_put(match.sk); 8878 8879 hci_dev_unlock(hdev); 8880 } 8881 8882 void __mgmt_power_off(struct hci_dev *hdev) 8883 { 8884 struct cmd_lookup match = { NULL, hdev }; 8885 u8 status, zero_cod[] = { 0, 0, 0 }; 8886 8887 mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp, &match); 8888 8889 /* If the power off is because of hdev unregistration let 8890 * use the appropriate INVALID_INDEX status. Otherwise use 8891 * NOT_POWERED. We cover both scenarios here since later in 8892 * mgmt_index_removed() any hci_conn callbacks will have already 8893 * been triggered, potentially causing misleading DISCONNECTED 8894 * status responses. 8895 */ 8896 if (hci_dev_test_flag(hdev, HCI_UNREGISTER)) 8897 status = MGMT_STATUS_INVALID_INDEX; 8898 else 8899 status = MGMT_STATUS_NOT_POWERED; 8900 8901 mgmt_pending_foreach(0, hdev, cmd_complete_rsp, &status); 8902 8903 if (memcmp(hdev->dev_class, zero_cod, sizeof(zero_cod)) != 0) { 8904 mgmt_limited_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev, 8905 zero_cod, sizeof(zero_cod), 8906 HCI_MGMT_DEV_CLASS_EVENTS, NULL); 8907 ext_info_changed(hdev, NULL); 8908 } 8909 8910 new_settings(hdev, match.sk); 8911 8912 if (match.sk) 8913 sock_put(match.sk); 8914 } 8915 8916 void mgmt_set_powered_failed(struct hci_dev *hdev, int err) 8917 { 8918 struct mgmt_pending_cmd *cmd; 8919 u8 status; 8920 8921 cmd = pending_find(MGMT_OP_SET_POWERED, hdev); 8922 if (!cmd) 8923 return; 8924 8925 if (err == -ERFKILL) 8926 status = MGMT_STATUS_RFKILLED; 8927 else 8928 status = MGMT_STATUS_FAILED; 8929 8930 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_POWERED, status); 8931 8932 mgmt_pending_remove(cmd); 8933 } 8934 8935 void mgmt_new_link_key(struct hci_dev *hdev, struct link_key *key, 8936 bool persistent) 8937 { 8938 struct mgmt_ev_new_link_key ev; 8939 8940 memset(&ev, 0, sizeof(ev)); 8941 8942 ev.store_hint = persistent; 8943 bacpy(&ev.key.addr.bdaddr, &key->bdaddr); 8944 ev.key.addr.type = BDADDR_BREDR; 8945 ev.key.type = key->type; 8946 memcpy(ev.key.val, key->val, HCI_LINK_KEY_SIZE); 8947 ev.key.pin_len = key->pin_len; 8948 8949 mgmt_event(MGMT_EV_NEW_LINK_KEY, hdev, &ev, sizeof(ev), NULL); 8950 } 8951 8952 static u8 mgmt_ltk_type(struct smp_ltk *ltk) 8953 { 8954 switch (ltk->type) { 8955 case SMP_LTK: 8956 case SMP_LTK_RESPONDER: 8957 if (ltk->authenticated) 8958 return MGMT_LTK_AUTHENTICATED; 8959 return MGMT_LTK_UNAUTHENTICATED; 8960 case SMP_LTK_P256: 8961 if (ltk->authenticated) 8962 return MGMT_LTK_P256_AUTH; 8963 return MGMT_LTK_P256_UNAUTH; 8964 case SMP_LTK_P256_DEBUG: 8965 return MGMT_LTK_P256_DEBUG; 8966 } 8967 8968 return MGMT_LTK_UNAUTHENTICATED; 8969 } 8970 8971 void mgmt_new_ltk(struct hci_dev *hdev, struct smp_ltk *key, bool persistent) 8972 { 8973 struct mgmt_ev_new_long_term_key ev; 8974 8975 memset(&ev, 0, sizeof(ev)); 8976 8977 /* Devices using resolvable or non-resolvable random addresses 8978 * without providing an identity resolving key don't require 8979 * to store long term keys. Their addresses will change the 8980 * next time around. 8981 * 8982 * Only when a remote device provides an identity address 8983 * make sure the long term key is stored. If the remote 8984 * identity is known, the long term keys are internally 8985 * mapped to the identity address. So allow static random 8986 * and public addresses here. 8987 */ 8988 if (key->bdaddr_type == ADDR_LE_DEV_RANDOM && 8989 (key->bdaddr.b[5] & 0xc0) != 0xc0) 8990 ev.store_hint = 0x00; 8991 else 8992 ev.store_hint = persistent; 8993 8994 bacpy(&ev.key.addr.bdaddr, &key->bdaddr); 8995 ev.key.addr.type = link_to_bdaddr(LE_LINK, key->bdaddr_type); 8996 ev.key.type = mgmt_ltk_type(key); 8997 ev.key.enc_size = key->enc_size; 8998 ev.key.ediv = key->ediv; 8999 ev.key.rand = key->rand; 9000 9001 if (key->type == SMP_LTK) 9002 ev.key.initiator = 1; 9003 9004 /* Make sure we copy only the significant bytes based on the 9005 * encryption key size, and set the rest of the value to zeroes. 9006 */ 9007 memcpy(ev.key.val, key->val, key->enc_size); 9008 memset(ev.key.val + key->enc_size, 0, 9009 sizeof(ev.key.val) - key->enc_size); 9010 9011 mgmt_event(MGMT_EV_NEW_LONG_TERM_KEY, hdev, &ev, sizeof(ev), NULL); 9012 } 9013 9014 void mgmt_new_irk(struct hci_dev *hdev, struct smp_irk *irk, bool persistent) 9015 { 9016 struct mgmt_ev_new_irk ev; 9017 9018 memset(&ev, 0, sizeof(ev)); 9019 9020 ev.store_hint = persistent; 9021 9022 bacpy(&ev.rpa, &irk->rpa); 9023 bacpy(&ev.irk.addr.bdaddr, &irk->bdaddr); 9024 ev.irk.addr.type = link_to_bdaddr(LE_LINK, irk->addr_type); 9025 memcpy(ev.irk.val, irk->val, sizeof(irk->val)); 9026 9027 mgmt_event(MGMT_EV_NEW_IRK, hdev, &ev, sizeof(ev), NULL); 9028 } 9029 9030 void mgmt_new_csrk(struct hci_dev *hdev, struct smp_csrk *csrk, 9031 bool persistent) 9032 { 9033 struct mgmt_ev_new_csrk ev; 9034 9035 memset(&ev, 0, sizeof(ev)); 9036 9037 /* Devices using resolvable or non-resolvable random addresses 9038 * without providing an identity resolving key don't require 9039 * to store signature resolving keys. Their addresses will change 9040 * the next time around. 9041 * 9042 * Only when a remote device provides an identity address 9043 * make sure the signature resolving key is stored. So allow 9044 * static random and public addresses here. 9045 */ 9046 if (csrk->bdaddr_type == ADDR_LE_DEV_RANDOM && 9047 (csrk->bdaddr.b[5] & 0xc0) != 0xc0) 9048 ev.store_hint = 0x00; 9049 else 9050 ev.store_hint = persistent; 9051 9052 bacpy(&ev.key.addr.bdaddr, &csrk->bdaddr); 9053 ev.key.addr.type = link_to_bdaddr(LE_LINK, csrk->bdaddr_type); 9054 ev.key.type = csrk->type; 9055 memcpy(ev.key.val, csrk->val, sizeof(csrk->val)); 9056 9057 mgmt_event(MGMT_EV_NEW_CSRK, hdev, &ev, sizeof(ev), NULL); 9058 } 9059 9060 void mgmt_new_conn_param(struct hci_dev *hdev, bdaddr_t *bdaddr, 9061 u8 bdaddr_type, u8 store_hint, u16 min_interval, 9062 u16 max_interval, u16 latency, u16 timeout) 9063 { 9064 struct mgmt_ev_new_conn_param ev; 9065 9066 if (!hci_is_identity_address(bdaddr, bdaddr_type)) 9067 return; 9068 9069 memset(&ev, 0, sizeof(ev)); 9070 bacpy(&ev.addr.bdaddr, bdaddr); 9071 ev.addr.type = link_to_bdaddr(LE_LINK, bdaddr_type); 9072 ev.store_hint = store_hint; 9073 ev.min_interval = cpu_to_le16(min_interval); 9074 ev.max_interval = cpu_to_le16(max_interval); 9075 ev.latency = cpu_to_le16(latency); 9076 ev.timeout = cpu_to_le16(timeout); 9077 9078 mgmt_event(MGMT_EV_NEW_CONN_PARAM, hdev, &ev, sizeof(ev), NULL); 9079 } 9080 9081 void mgmt_device_connected(struct hci_dev *hdev, struct hci_conn *conn, 9082 u8 *name, u8 name_len) 9083 { 9084 struct sk_buff *skb; 9085 struct mgmt_ev_device_connected *ev; 9086 u16 eir_len = 0; 9087 u32 flags = 0; 9088 9089 if (conn->le_adv_data_len > 0) 9090 skb = mgmt_alloc_skb(hdev, MGMT_EV_DEVICE_CONNECTED, 9091 conn->le_adv_data_len); 9092 else 9093 skb = mgmt_alloc_skb(hdev, MGMT_EV_DEVICE_CONNECTED, 9094 2 + name_len + 5); 9095 9096 ev = skb_put(skb, sizeof(*ev)); 9097 bacpy(&ev->addr.bdaddr, &conn->dst); 9098 ev->addr.type = link_to_bdaddr(conn->type, conn->dst_type); 9099 9100 if (conn->out) 9101 flags |= MGMT_DEV_FOUND_INITIATED_CONN; 9102 9103 ev->flags = __cpu_to_le32(flags); 9104 9105 /* We must ensure that the EIR Data fields are ordered and 9106 * unique. Keep it simple for now and avoid the problem by not 9107 * adding any BR/EDR data to the LE adv. 9108 */ 9109 if (conn->le_adv_data_len > 0) { 9110 skb_put_data(skb, conn->le_adv_data, conn->le_adv_data_len); 9111 eir_len = conn->le_adv_data_len; 9112 } else { 9113 if (name_len > 0) { 9114 eir_len = eir_append_data(ev->eir, 0, EIR_NAME_COMPLETE, 9115 name, name_len); 9116 skb_put(skb, eir_len); 9117 } 9118 9119 if (memcmp(conn->dev_class, "\0\0\0", 3) != 0) { 9120 eir_len = eir_append_data(ev->eir, eir_len, 9121 EIR_CLASS_OF_DEV, 9122 conn->dev_class, 3); 9123 skb_put(skb, 5); 9124 } 9125 } 9126 9127 ev->eir_len = cpu_to_le16(eir_len); 9128 9129 mgmt_event_skb(skb, NULL); 9130 } 9131 9132 static void disconnect_rsp(struct mgmt_pending_cmd *cmd, void *data) 9133 { 9134 struct sock **sk = data; 9135 9136 cmd->cmd_complete(cmd, 0); 9137 9138 *sk = cmd->sk; 9139 sock_hold(*sk); 9140 9141 mgmt_pending_remove(cmd); 9142 } 9143 9144 static void unpair_device_rsp(struct mgmt_pending_cmd *cmd, void *data) 9145 { 9146 struct hci_dev *hdev = data; 9147 struct mgmt_cp_unpair_device *cp = cmd->param; 9148 9149 device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, cmd->sk); 9150 9151 cmd->cmd_complete(cmd, 0); 9152 mgmt_pending_remove(cmd); 9153 } 9154 9155 bool mgmt_powering_down(struct hci_dev *hdev) 9156 { 9157 struct mgmt_pending_cmd *cmd; 9158 struct mgmt_mode *cp; 9159 9160 cmd = pending_find(MGMT_OP_SET_POWERED, hdev); 9161 if (!cmd) 9162 return false; 9163 9164 cp = cmd->param; 9165 if (!cp->val) 9166 return true; 9167 9168 return false; 9169 } 9170 9171 void mgmt_device_disconnected(struct hci_dev *hdev, bdaddr_t *bdaddr, 9172 u8 link_type, u8 addr_type, u8 reason, 9173 bool mgmt_connected) 9174 { 9175 struct mgmt_ev_device_disconnected ev; 9176 struct sock *sk = NULL; 9177 9178 /* The connection is still in hci_conn_hash so test for 1 9179 * instead of 0 to know if this is the last one. 9180 */ 9181 if (mgmt_powering_down(hdev) && hci_conn_count(hdev) == 1) { 9182 cancel_delayed_work(&hdev->power_off); 9183 queue_work(hdev->req_workqueue, &hdev->power_off.work); 9184 } 9185 9186 if (!mgmt_connected) 9187 return; 9188 9189 if (link_type != ACL_LINK && link_type != LE_LINK) 9190 return; 9191 9192 mgmt_pending_foreach(MGMT_OP_DISCONNECT, hdev, disconnect_rsp, &sk); 9193 9194 bacpy(&ev.addr.bdaddr, bdaddr); 9195 ev.addr.type = link_to_bdaddr(link_type, addr_type); 9196 ev.reason = reason; 9197 9198 /* Report disconnects due to suspend */ 9199 if (hdev->suspended) 9200 ev.reason = MGMT_DEV_DISCONN_LOCAL_HOST_SUSPEND; 9201 9202 mgmt_event(MGMT_EV_DEVICE_DISCONNECTED, hdev, &ev, sizeof(ev), sk); 9203 9204 if (sk) 9205 sock_put(sk); 9206 9207 mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, unpair_device_rsp, 9208 hdev); 9209 } 9210 9211 void mgmt_disconnect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr, 9212 u8 link_type, u8 addr_type, u8 status) 9213 { 9214 u8 bdaddr_type = link_to_bdaddr(link_type, addr_type); 9215 struct mgmt_cp_disconnect *cp; 9216 struct mgmt_pending_cmd *cmd; 9217 9218 mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, unpair_device_rsp, 9219 hdev); 9220 9221 cmd = pending_find(MGMT_OP_DISCONNECT, hdev); 9222 if (!cmd) 9223 return; 9224 9225 cp = cmd->param; 9226 9227 if (bacmp(bdaddr, &cp->addr.bdaddr)) 9228 return; 9229 9230 if (cp->addr.type != bdaddr_type) 9231 return; 9232 9233 cmd->cmd_complete(cmd, mgmt_status(status)); 9234 mgmt_pending_remove(cmd); 9235 } 9236 9237 void mgmt_connect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type, 9238 u8 addr_type, u8 status) 9239 { 9240 struct mgmt_ev_connect_failed ev; 9241 9242 /* The connection is still in hci_conn_hash so test for 1 9243 * instead of 0 to know if this is the last one. 9244 */ 9245 if (mgmt_powering_down(hdev) && hci_conn_count(hdev) == 1) { 9246 cancel_delayed_work(&hdev->power_off); 9247 queue_work(hdev->req_workqueue, &hdev->power_off.work); 9248 } 9249 9250 bacpy(&ev.addr.bdaddr, bdaddr); 9251 ev.addr.type = link_to_bdaddr(link_type, addr_type); 9252 ev.status = mgmt_status(status); 9253 9254 mgmt_event(MGMT_EV_CONNECT_FAILED, hdev, &ev, sizeof(ev), NULL); 9255 } 9256 9257 void mgmt_pin_code_request(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 secure) 9258 { 9259 struct mgmt_ev_pin_code_request ev; 9260 9261 bacpy(&ev.addr.bdaddr, bdaddr); 9262 ev.addr.type = BDADDR_BREDR; 9263 ev.secure = secure; 9264 9265 mgmt_event(MGMT_EV_PIN_CODE_REQUEST, hdev, &ev, sizeof(ev), NULL); 9266 } 9267 9268 void mgmt_pin_code_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr, 9269 u8 status) 9270 { 9271 struct mgmt_pending_cmd *cmd; 9272 9273 cmd = pending_find(MGMT_OP_PIN_CODE_REPLY, hdev); 9274 if (!cmd) 9275 return; 9276 9277 cmd->cmd_complete(cmd, mgmt_status(status)); 9278 mgmt_pending_remove(cmd); 9279 } 9280 9281 void mgmt_pin_code_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr, 9282 u8 status) 9283 { 9284 struct mgmt_pending_cmd *cmd; 9285 9286 cmd = pending_find(MGMT_OP_PIN_CODE_NEG_REPLY, hdev); 9287 if (!cmd) 9288 return; 9289 9290 cmd->cmd_complete(cmd, mgmt_status(status)); 9291 mgmt_pending_remove(cmd); 9292 } 9293 9294 int mgmt_user_confirm_request(struct hci_dev *hdev, bdaddr_t *bdaddr, 9295 u8 link_type, u8 addr_type, u32 value, 9296 u8 confirm_hint) 9297 { 9298 struct mgmt_ev_user_confirm_request ev; 9299 9300 bt_dev_dbg(hdev, "bdaddr %pMR", bdaddr); 9301 9302 bacpy(&ev.addr.bdaddr, bdaddr); 9303 ev.addr.type = link_to_bdaddr(link_type, addr_type); 9304 ev.confirm_hint = confirm_hint; 9305 ev.value = cpu_to_le32(value); 9306 9307 return mgmt_event(MGMT_EV_USER_CONFIRM_REQUEST, hdev, &ev, sizeof(ev), 9308 NULL); 9309 } 9310 9311 int mgmt_user_passkey_request(struct hci_dev *hdev, bdaddr_t *bdaddr, 9312 u8 link_type, u8 addr_type) 9313 { 9314 struct mgmt_ev_user_passkey_request ev; 9315 9316 bt_dev_dbg(hdev, "bdaddr %pMR", bdaddr); 9317 9318 bacpy(&ev.addr.bdaddr, bdaddr); 9319 ev.addr.type = link_to_bdaddr(link_type, addr_type); 9320 9321 return mgmt_event(MGMT_EV_USER_PASSKEY_REQUEST, hdev, &ev, sizeof(ev), 9322 NULL); 9323 } 9324 9325 static int user_pairing_resp_complete(struct hci_dev *hdev, bdaddr_t *bdaddr, 9326 u8 link_type, u8 addr_type, u8 status, 9327 u8 opcode) 9328 { 9329 struct mgmt_pending_cmd *cmd; 9330 9331 cmd = pending_find(opcode, hdev); 9332 if (!cmd) 9333 return -ENOENT; 9334 9335 cmd->cmd_complete(cmd, mgmt_status(status)); 9336 mgmt_pending_remove(cmd); 9337 9338 return 0; 9339 } 9340 9341 int mgmt_user_confirm_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr, 9342 u8 link_type, u8 addr_type, u8 status) 9343 { 9344 return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type, 9345 status, MGMT_OP_USER_CONFIRM_REPLY); 9346 } 9347 9348 int mgmt_user_confirm_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr, 9349 u8 link_type, u8 addr_type, u8 status) 9350 { 9351 return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type, 9352 status, 9353 MGMT_OP_USER_CONFIRM_NEG_REPLY); 9354 } 9355 9356 int mgmt_user_passkey_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr, 9357 u8 link_type, u8 addr_type, u8 status) 9358 { 9359 return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type, 9360 status, MGMT_OP_USER_PASSKEY_REPLY); 9361 } 9362 9363 int mgmt_user_passkey_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr, 9364 u8 link_type, u8 addr_type, u8 status) 9365 { 9366 return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type, 9367 status, 9368 MGMT_OP_USER_PASSKEY_NEG_REPLY); 9369 } 9370 9371 int mgmt_user_passkey_notify(struct hci_dev *hdev, bdaddr_t *bdaddr, 9372 u8 link_type, u8 addr_type, u32 passkey, 9373 u8 entered) 9374 { 9375 struct mgmt_ev_passkey_notify ev; 9376 9377 bt_dev_dbg(hdev, "bdaddr %pMR", bdaddr); 9378 9379 bacpy(&ev.addr.bdaddr, bdaddr); 9380 ev.addr.type = link_to_bdaddr(link_type, addr_type); 9381 ev.passkey = __cpu_to_le32(passkey); 9382 ev.entered = entered; 9383 9384 return mgmt_event(MGMT_EV_PASSKEY_NOTIFY, hdev, &ev, sizeof(ev), NULL); 9385 } 9386 9387 void mgmt_auth_failed(struct hci_conn *conn, u8 hci_status) 9388 { 9389 struct mgmt_ev_auth_failed ev; 9390 struct mgmt_pending_cmd *cmd; 9391 u8 status = mgmt_status(hci_status); 9392 9393 bacpy(&ev.addr.bdaddr, &conn->dst); 9394 ev.addr.type = link_to_bdaddr(conn->type, conn->dst_type); 9395 ev.status = status; 9396 9397 cmd = find_pairing(conn); 9398 9399 mgmt_event(MGMT_EV_AUTH_FAILED, conn->hdev, &ev, sizeof(ev), 9400 cmd ? cmd->sk : NULL); 9401 9402 if (cmd) { 9403 cmd->cmd_complete(cmd, status); 9404 mgmt_pending_remove(cmd); 9405 } 9406 } 9407 9408 void mgmt_auth_enable_complete(struct hci_dev *hdev, u8 status) 9409 { 9410 struct cmd_lookup match = { NULL, hdev }; 9411 bool changed; 9412 9413 if (status) { 9414 u8 mgmt_err = mgmt_status(status); 9415 mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev, 9416 cmd_status_rsp, &mgmt_err); 9417 return; 9418 } 9419 9420 if (test_bit(HCI_AUTH, &hdev->flags)) 9421 changed = !hci_dev_test_and_set_flag(hdev, HCI_LINK_SECURITY); 9422 else 9423 changed = hci_dev_test_and_clear_flag(hdev, HCI_LINK_SECURITY); 9424 9425 mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev, settings_rsp, 9426 &match); 9427 9428 if (changed) 9429 new_settings(hdev, match.sk); 9430 9431 if (match.sk) 9432 sock_put(match.sk); 9433 } 9434 9435 static void sk_lookup(struct mgmt_pending_cmd *cmd, void *data) 9436 { 9437 struct cmd_lookup *match = data; 9438 9439 if (match->sk == NULL) { 9440 match->sk = cmd->sk; 9441 sock_hold(match->sk); 9442 } 9443 } 9444 9445 void mgmt_set_class_of_dev_complete(struct hci_dev *hdev, u8 *dev_class, 9446 u8 status) 9447 { 9448 struct cmd_lookup match = { NULL, hdev, mgmt_status(status) }; 9449 9450 mgmt_pending_foreach(MGMT_OP_SET_DEV_CLASS, hdev, sk_lookup, &match); 9451 mgmt_pending_foreach(MGMT_OP_ADD_UUID, hdev, sk_lookup, &match); 9452 mgmt_pending_foreach(MGMT_OP_REMOVE_UUID, hdev, sk_lookup, &match); 9453 9454 if (!status) { 9455 mgmt_limited_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev, dev_class, 9456 3, HCI_MGMT_DEV_CLASS_EVENTS, NULL); 9457 ext_info_changed(hdev, NULL); 9458 } 9459 9460 if (match.sk) 9461 sock_put(match.sk); 9462 } 9463 9464 void mgmt_set_local_name_complete(struct hci_dev *hdev, u8 *name, u8 status) 9465 { 9466 struct mgmt_cp_set_local_name ev; 9467 struct mgmt_pending_cmd *cmd; 9468 9469 if (status) 9470 return; 9471 9472 memset(&ev, 0, sizeof(ev)); 9473 memcpy(ev.name, name, HCI_MAX_NAME_LENGTH); 9474 memcpy(ev.short_name, hdev->short_name, HCI_MAX_SHORT_NAME_LENGTH); 9475 9476 cmd = pending_find(MGMT_OP_SET_LOCAL_NAME, hdev); 9477 if (!cmd) { 9478 memcpy(hdev->dev_name, name, sizeof(hdev->dev_name)); 9479 9480 /* If this is a HCI command related to powering on the 9481 * HCI dev don't send any mgmt signals. 9482 */ 9483 if (pending_find(MGMT_OP_SET_POWERED, hdev)) 9484 return; 9485 } 9486 9487 mgmt_limited_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, &ev, sizeof(ev), 9488 HCI_MGMT_LOCAL_NAME_EVENTS, cmd ? cmd->sk : NULL); 9489 ext_info_changed(hdev, cmd ? cmd->sk : NULL); 9490 } 9491 9492 static inline bool has_uuid(u8 *uuid, u16 uuid_count, u8 (*uuids)[16]) 9493 { 9494 int i; 9495 9496 for (i = 0; i < uuid_count; i++) { 9497 if (!memcmp(uuid, uuids[i], 16)) 9498 return true; 9499 } 9500 9501 return false; 9502 } 9503 9504 static bool eir_has_uuids(u8 *eir, u16 eir_len, u16 uuid_count, u8 (*uuids)[16]) 9505 { 9506 u16 parsed = 0; 9507 9508 while (parsed < eir_len) { 9509 u8 field_len = eir[0]; 9510 u8 uuid[16]; 9511 int i; 9512 9513 if (field_len == 0) 9514 break; 9515 9516 if (eir_len - parsed < field_len + 1) 9517 break; 9518 9519 switch (eir[1]) { 9520 case EIR_UUID16_ALL: 9521 case EIR_UUID16_SOME: 9522 for (i = 0; i + 3 <= field_len; i += 2) { 9523 memcpy(uuid, bluetooth_base_uuid, 16); 9524 uuid[13] = eir[i + 3]; 9525 uuid[12] = eir[i + 2]; 9526 if (has_uuid(uuid, uuid_count, uuids)) 9527 return true; 9528 } 9529 break; 9530 case EIR_UUID32_ALL: 9531 case EIR_UUID32_SOME: 9532 for (i = 0; i + 5 <= field_len; i += 4) { 9533 memcpy(uuid, bluetooth_base_uuid, 16); 9534 uuid[15] = eir[i + 5]; 9535 uuid[14] = eir[i + 4]; 9536 uuid[13] = eir[i + 3]; 9537 uuid[12] = eir[i + 2]; 9538 if (has_uuid(uuid, uuid_count, uuids)) 9539 return true; 9540 } 9541 break; 9542 case EIR_UUID128_ALL: 9543 case EIR_UUID128_SOME: 9544 for (i = 0; i + 17 <= field_len; i += 16) { 9545 memcpy(uuid, eir + i + 2, 16); 9546 if (has_uuid(uuid, uuid_count, uuids)) 9547 return true; 9548 } 9549 break; 9550 } 9551 9552 parsed += field_len + 1; 9553 eir += field_len + 1; 9554 } 9555 9556 return false; 9557 } 9558 9559 static void restart_le_scan(struct hci_dev *hdev) 9560 { 9561 /* If controller is not scanning we are done. */ 9562 if (!hci_dev_test_flag(hdev, HCI_LE_SCAN)) 9563 return; 9564 9565 if (time_after(jiffies + DISCOV_LE_RESTART_DELAY, 9566 hdev->discovery.scan_start + 9567 hdev->discovery.scan_duration)) 9568 return; 9569 9570 queue_delayed_work(hdev->req_workqueue, &hdev->le_scan_restart, 9571 DISCOV_LE_RESTART_DELAY); 9572 } 9573 9574 static bool is_filter_match(struct hci_dev *hdev, s8 rssi, u8 *eir, 9575 u16 eir_len, u8 *scan_rsp, u8 scan_rsp_len) 9576 { 9577 /* If a RSSI threshold has been specified, and 9578 * HCI_QUIRK_STRICT_DUPLICATE_FILTER is not set, then all results with 9579 * a RSSI smaller than the RSSI threshold will be dropped. If the quirk 9580 * is set, let it through for further processing, as we might need to 9581 * restart the scan. 9582 * 9583 * For BR/EDR devices (pre 1.2) providing no RSSI during inquiry, 9584 * the results are also dropped. 9585 */ 9586 if (hdev->discovery.rssi != HCI_RSSI_INVALID && 9587 (rssi == HCI_RSSI_INVALID || 9588 (rssi < hdev->discovery.rssi && 9589 !test_bit(HCI_QUIRK_STRICT_DUPLICATE_FILTER, &hdev->quirks)))) 9590 return false; 9591 9592 if (hdev->discovery.uuid_count != 0) { 9593 /* If a list of UUIDs is provided in filter, results with no 9594 * matching UUID should be dropped. 9595 */ 9596 if (!eir_has_uuids(eir, eir_len, hdev->discovery.uuid_count, 9597 hdev->discovery.uuids) && 9598 !eir_has_uuids(scan_rsp, scan_rsp_len, 9599 hdev->discovery.uuid_count, 9600 hdev->discovery.uuids)) 9601 return false; 9602 } 9603 9604 /* If duplicate filtering does not report RSSI changes, then restart 9605 * scanning to ensure updated result with updated RSSI values. 9606 */ 9607 if (test_bit(HCI_QUIRK_STRICT_DUPLICATE_FILTER, &hdev->quirks)) { 9608 restart_le_scan(hdev); 9609 9610 /* Validate RSSI value against the RSSI threshold once more. */ 9611 if (hdev->discovery.rssi != HCI_RSSI_INVALID && 9612 rssi < hdev->discovery.rssi) 9613 return false; 9614 } 9615 9616 return true; 9617 } 9618 9619 void mgmt_device_found(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type, 9620 u8 addr_type, u8 *dev_class, s8 rssi, u32 flags, 9621 u8 *eir, u16 eir_len, u8 *scan_rsp, u8 scan_rsp_len) 9622 { 9623 struct sk_buff *skb; 9624 struct mgmt_ev_device_found *ev; 9625 9626 /* Don't send events for a non-kernel initiated discovery. With 9627 * LE one exception is if we have pend_le_reports > 0 in which 9628 * case we're doing passive scanning and want these events. 9629 */ 9630 if (!hci_discovery_active(hdev)) { 9631 if (link_type == ACL_LINK) 9632 return; 9633 if (link_type == LE_LINK && 9634 list_empty(&hdev->pend_le_reports) && 9635 !hci_is_adv_monitoring(hdev)) { 9636 return; 9637 } 9638 } 9639 9640 if (hdev->discovery.result_filtering) { 9641 /* We are using service discovery */ 9642 if (!is_filter_match(hdev, rssi, eir, eir_len, scan_rsp, 9643 scan_rsp_len)) 9644 return; 9645 } 9646 9647 if (hdev->discovery.limited) { 9648 /* Check for limited discoverable bit */ 9649 if (dev_class) { 9650 if (!(dev_class[1] & 0x20)) 9651 return; 9652 } else { 9653 u8 *flags = eir_get_data(eir, eir_len, EIR_FLAGS, NULL); 9654 if (!flags || !(flags[0] & LE_AD_LIMITED)) 9655 return; 9656 } 9657 } 9658 9659 /* Allocate skb. The 5 extra bytes are for the potential CoD field */ 9660 skb = mgmt_alloc_skb(hdev, MGMT_EV_DEVICE_FOUND, 9661 sizeof(*ev) + eir_len + scan_rsp_len + 5); 9662 if (!skb) 9663 return; 9664 9665 ev = skb_put(skb, sizeof(*ev)); 9666 9667 /* In case of device discovery with BR/EDR devices (pre 1.2), the 9668 * RSSI value was reported as 0 when not available. This behavior 9669 * is kept when using device discovery. This is required for full 9670 * backwards compatibility with the API. 9671 * 9672 * However when using service discovery, the value 127 will be 9673 * returned when the RSSI is not available. 9674 */ 9675 if (rssi == HCI_RSSI_INVALID && !hdev->discovery.report_invalid_rssi && 9676 link_type == ACL_LINK) 9677 rssi = 0; 9678 9679 bacpy(&ev->addr.bdaddr, bdaddr); 9680 ev->addr.type = link_to_bdaddr(link_type, addr_type); 9681 ev->rssi = rssi; 9682 ev->flags = cpu_to_le32(flags); 9683 9684 if (eir_len > 0) 9685 /* Copy EIR or advertising data into event */ 9686 skb_put_data(skb, eir, eir_len); 9687 9688 if (dev_class && !eir_get_data(eir, eir_len, EIR_CLASS_OF_DEV, NULL)) { 9689 u8 eir_cod[5]; 9690 9691 eir_len += eir_append_data(eir_cod, 0, EIR_CLASS_OF_DEV, 9692 dev_class, 3); 9693 skb_put_data(skb, eir_cod, sizeof(eir_cod)); 9694 } 9695 9696 if (scan_rsp_len > 0) 9697 /* Append scan response data to event */ 9698 skb_put_data(skb, scan_rsp, scan_rsp_len); 9699 9700 ev->eir_len = cpu_to_le16(eir_len + scan_rsp_len); 9701 9702 mgmt_event_skb(skb, NULL); 9703 } 9704 9705 void mgmt_remote_name(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type, 9706 u8 addr_type, s8 rssi, u8 *name, u8 name_len) 9707 { 9708 struct sk_buff *skb; 9709 struct mgmt_ev_device_found *ev; 9710 u16 eir_len; 9711 u32 flags; 9712 9713 if (name_len) 9714 skb = mgmt_alloc_skb(hdev, MGMT_EV_DEVICE_FOUND, 2 + name_len); 9715 else 9716 skb = mgmt_alloc_skb(hdev, MGMT_EV_DEVICE_FOUND, 0); 9717 9718 ev = skb_put(skb, sizeof(*ev)); 9719 bacpy(&ev->addr.bdaddr, bdaddr); 9720 ev->addr.type = link_to_bdaddr(link_type, addr_type); 9721 ev->rssi = rssi; 9722 9723 if (name) { 9724 eir_len = eir_append_data(ev->eir, 0, EIR_NAME_COMPLETE, name, 9725 name_len); 9726 flags = 0; 9727 skb_put(skb, eir_len); 9728 } else { 9729 eir_len = 0; 9730 flags = MGMT_DEV_FOUND_NAME_REQUEST_FAILED; 9731 } 9732 9733 ev->eir_len = cpu_to_le16(eir_len); 9734 ev->flags = cpu_to_le32(flags); 9735 9736 mgmt_event_skb(skb, NULL); 9737 } 9738 9739 void mgmt_discovering(struct hci_dev *hdev, u8 discovering) 9740 { 9741 struct mgmt_ev_discovering ev; 9742 9743 bt_dev_dbg(hdev, "discovering %u", discovering); 9744 9745 memset(&ev, 0, sizeof(ev)); 9746 ev.type = hdev->discovery.type; 9747 ev.discovering = discovering; 9748 9749 mgmt_event(MGMT_EV_DISCOVERING, hdev, &ev, sizeof(ev), NULL); 9750 } 9751 9752 void mgmt_suspending(struct hci_dev *hdev, u8 state) 9753 { 9754 struct mgmt_ev_controller_suspend ev; 9755 9756 ev.suspend_state = state; 9757 mgmt_event(MGMT_EV_CONTROLLER_SUSPEND, hdev, &ev, sizeof(ev), NULL); 9758 } 9759 9760 void mgmt_resuming(struct hci_dev *hdev, u8 reason, bdaddr_t *bdaddr, 9761 u8 addr_type) 9762 { 9763 struct mgmt_ev_controller_resume ev; 9764 9765 ev.wake_reason = reason; 9766 if (bdaddr) { 9767 bacpy(&ev.addr.bdaddr, bdaddr); 9768 ev.addr.type = addr_type; 9769 } else { 9770 memset(&ev.addr, 0, sizeof(ev.addr)); 9771 } 9772 9773 mgmt_event(MGMT_EV_CONTROLLER_RESUME, hdev, &ev, sizeof(ev), NULL); 9774 } 9775 9776 static struct hci_mgmt_chan chan = { 9777 .channel = HCI_CHANNEL_CONTROL, 9778 .handler_count = ARRAY_SIZE(mgmt_handlers), 9779 .handlers = mgmt_handlers, 9780 .hdev_init = mgmt_init_hdev, 9781 }; 9782 9783 int mgmt_init(void) 9784 { 9785 return hci_mgmt_chan_register(&chan); 9786 } 9787 9788 void mgmt_exit(void) 9789 { 9790 hci_mgmt_chan_unregister(&chan); 9791 } 9792