1 /* 2 BlueZ - Bluetooth protocol stack for Linux 3 4 Copyright (C) 2010 Nokia Corporation 5 Copyright (C) 2011-2012 Intel Corporation 6 7 This program is free software; you can redistribute it and/or modify 8 it under the terms of the GNU General Public License version 2 as 9 published by the Free Software Foundation; 10 11 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS 12 OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 13 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS. 14 IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY 15 CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES 16 WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN 17 ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF 18 OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. 19 20 ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS, 21 COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS 22 SOFTWARE IS DISCLAIMED. 23 */ 24 25 /* Bluetooth HCI Management interface */ 26 27 #include <linux/module.h> 28 #include <asm/unaligned.h> 29 30 #include <net/bluetooth/bluetooth.h> 31 #include <net/bluetooth/hci_core.h> 32 #include <net/bluetooth/hci_sock.h> 33 #include <net/bluetooth/l2cap.h> 34 #include <net/bluetooth/mgmt.h> 35 36 #include "hci_request.h" 37 #include "smp.h" 38 #include "mgmt_util.h" 39 #include "mgmt_config.h" 40 #include "msft.h" 41 #include "eir.h" 42 #include "aosp.h" 43 44 #define MGMT_VERSION 1 45 #define MGMT_REVISION 22 46 47 static const u16 mgmt_commands[] = { 48 MGMT_OP_READ_INDEX_LIST, 49 MGMT_OP_READ_INFO, 50 MGMT_OP_SET_POWERED, 51 MGMT_OP_SET_DISCOVERABLE, 52 MGMT_OP_SET_CONNECTABLE, 53 MGMT_OP_SET_FAST_CONNECTABLE, 54 MGMT_OP_SET_BONDABLE, 55 MGMT_OP_SET_LINK_SECURITY, 56 MGMT_OP_SET_SSP, 57 MGMT_OP_SET_HS, 58 MGMT_OP_SET_LE, 59 MGMT_OP_SET_DEV_CLASS, 60 MGMT_OP_SET_LOCAL_NAME, 61 MGMT_OP_ADD_UUID, 62 MGMT_OP_REMOVE_UUID, 63 MGMT_OP_LOAD_LINK_KEYS, 64 MGMT_OP_LOAD_LONG_TERM_KEYS, 65 MGMT_OP_DISCONNECT, 66 MGMT_OP_GET_CONNECTIONS, 67 MGMT_OP_PIN_CODE_REPLY, 68 MGMT_OP_PIN_CODE_NEG_REPLY, 69 MGMT_OP_SET_IO_CAPABILITY, 70 MGMT_OP_PAIR_DEVICE, 71 MGMT_OP_CANCEL_PAIR_DEVICE, 72 MGMT_OP_UNPAIR_DEVICE, 73 MGMT_OP_USER_CONFIRM_REPLY, 74 MGMT_OP_USER_CONFIRM_NEG_REPLY, 75 MGMT_OP_USER_PASSKEY_REPLY, 76 MGMT_OP_USER_PASSKEY_NEG_REPLY, 77 MGMT_OP_READ_LOCAL_OOB_DATA, 78 MGMT_OP_ADD_REMOTE_OOB_DATA, 79 MGMT_OP_REMOVE_REMOTE_OOB_DATA, 80 MGMT_OP_START_DISCOVERY, 81 MGMT_OP_STOP_DISCOVERY, 82 MGMT_OP_CONFIRM_NAME, 83 MGMT_OP_BLOCK_DEVICE, 84 MGMT_OP_UNBLOCK_DEVICE, 85 MGMT_OP_SET_DEVICE_ID, 86 MGMT_OP_SET_ADVERTISING, 87 MGMT_OP_SET_BREDR, 88 MGMT_OP_SET_STATIC_ADDRESS, 89 MGMT_OP_SET_SCAN_PARAMS, 90 MGMT_OP_SET_SECURE_CONN, 91 MGMT_OP_SET_DEBUG_KEYS, 92 MGMT_OP_SET_PRIVACY, 93 MGMT_OP_LOAD_IRKS, 94 MGMT_OP_GET_CONN_INFO, 95 MGMT_OP_GET_CLOCK_INFO, 96 MGMT_OP_ADD_DEVICE, 97 MGMT_OP_REMOVE_DEVICE, 98 MGMT_OP_LOAD_CONN_PARAM, 99 MGMT_OP_READ_UNCONF_INDEX_LIST, 100 MGMT_OP_READ_CONFIG_INFO, 101 MGMT_OP_SET_EXTERNAL_CONFIG, 102 MGMT_OP_SET_PUBLIC_ADDRESS, 103 MGMT_OP_START_SERVICE_DISCOVERY, 104 MGMT_OP_READ_LOCAL_OOB_EXT_DATA, 105 MGMT_OP_READ_EXT_INDEX_LIST, 106 MGMT_OP_READ_ADV_FEATURES, 107 MGMT_OP_ADD_ADVERTISING, 108 MGMT_OP_REMOVE_ADVERTISING, 109 MGMT_OP_GET_ADV_SIZE_INFO, 110 MGMT_OP_START_LIMITED_DISCOVERY, 111 MGMT_OP_READ_EXT_INFO, 112 MGMT_OP_SET_APPEARANCE, 113 MGMT_OP_GET_PHY_CONFIGURATION, 114 MGMT_OP_SET_PHY_CONFIGURATION, 115 MGMT_OP_SET_BLOCKED_KEYS, 116 MGMT_OP_SET_WIDEBAND_SPEECH, 117 MGMT_OP_READ_CONTROLLER_CAP, 118 MGMT_OP_READ_EXP_FEATURES_INFO, 119 MGMT_OP_SET_EXP_FEATURE, 120 MGMT_OP_READ_DEF_SYSTEM_CONFIG, 121 MGMT_OP_SET_DEF_SYSTEM_CONFIG, 122 MGMT_OP_READ_DEF_RUNTIME_CONFIG, 123 MGMT_OP_SET_DEF_RUNTIME_CONFIG, 124 MGMT_OP_GET_DEVICE_FLAGS, 125 MGMT_OP_SET_DEVICE_FLAGS, 126 MGMT_OP_READ_ADV_MONITOR_FEATURES, 127 MGMT_OP_ADD_ADV_PATTERNS_MONITOR, 128 MGMT_OP_REMOVE_ADV_MONITOR, 129 MGMT_OP_ADD_EXT_ADV_PARAMS, 130 MGMT_OP_ADD_EXT_ADV_DATA, 131 MGMT_OP_ADD_ADV_PATTERNS_MONITOR_RSSI, 132 }; 133 134 static const u16 mgmt_events[] = { 135 MGMT_EV_CONTROLLER_ERROR, 136 MGMT_EV_INDEX_ADDED, 137 MGMT_EV_INDEX_REMOVED, 138 MGMT_EV_NEW_SETTINGS, 139 MGMT_EV_CLASS_OF_DEV_CHANGED, 140 MGMT_EV_LOCAL_NAME_CHANGED, 141 MGMT_EV_NEW_LINK_KEY, 142 MGMT_EV_NEW_LONG_TERM_KEY, 143 MGMT_EV_DEVICE_CONNECTED, 144 MGMT_EV_DEVICE_DISCONNECTED, 145 MGMT_EV_CONNECT_FAILED, 146 MGMT_EV_PIN_CODE_REQUEST, 147 MGMT_EV_USER_CONFIRM_REQUEST, 148 MGMT_EV_USER_PASSKEY_REQUEST, 149 MGMT_EV_AUTH_FAILED, 150 MGMT_EV_DEVICE_FOUND, 151 MGMT_EV_DISCOVERING, 152 MGMT_EV_DEVICE_BLOCKED, 153 MGMT_EV_DEVICE_UNBLOCKED, 154 MGMT_EV_DEVICE_UNPAIRED, 155 MGMT_EV_PASSKEY_NOTIFY, 156 MGMT_EV_NEW_IRK, 157 MGMT_EV_NEW_CSRK, 158 MGMT_EV_DEVICE_ADDED, 159 MGMT_EV_DEVICE_REMOVED, 160 MGMT_EV_NEW_CONN_PARAM, 161 MGMT_EV_UNCONF_INDEX_ADDED, 162 MGMT_EV_UNCONF_INDEX_REMOVED, 163 MGMT_EV_NEW_CONFIG_OPTIONS, 164 MGMT_EV_EXT_INDEX_ADDED, 165 MGMT_EV_EXT_INDEX_REMOVED, 166 MGMT_EV_LOCAL_OOB_DATA_UPDATED, 167 MGMT_EV_ADVERTISING_ADDED, 168 MGMT_EV_ADVERTISING_REMOVED, 169 MGMT_EV_EXT_INFO_CHANGED, 170 MGMT_EV_PHY_CONFIGURATION_CHANGED, 171 MGMT_EV_EXP_FEATURE_CHANGED, 172 MGMT_EV_DEVICE_FLAGS_CHANGED, 173 MGMT_EV_ADV_MONITOR_ADDED, 174 MGMT_EV_ADV_MONITOR_REMOVED, 175 MGMT_EV_CONTROLLER_SUSPEND, 176 MGMT_EV_CONTROLLER_RESUME, 177 MGMT_EV_ADV_MONITOR_DEVICE_FOUND, 178 MGMT_EV_ADV_MONITOR_DEVICE_LOST, 179 }; 180 181 static const u16 mgmt_untrusted_commands[] = { 182 MGMT_OP_READ_INDEX_LIST, 183 MGMT_OP_READ_INFO, 184 MGMT_OP_READ_UNCONF_INDEX_LIST, 185 MGMT_OP_READ_CONFIG_INFO, 186 MGMT_OP_READ_EXT_INDEX_LIST, 187 MGMT_OP_READ_EXT_INFO, 188 MGMT_OP_READ_CONTROLLER_CAP, 189 MGMT_OP_READ_EXP_FEATURES_INFO, 190 MGMT_OP_READ_DEF_SYSTEM_CONFIG, 191 MGMT_OP_READ_DEF_RUNTIME_CONFIG, 192 }; 193 194 static const u16 mgmt_untrusted_events[] = { 195 MGMT_EV_INDEX_ADDED, 196 MGMT_EV_INDEX_REMOVED, 197 MGMT_EV_NEW_SETTINGS, 198 MGMT_EV_CLASS_OF_DEV_CHANGED, 199 MGMT_EV_LOCAL_NAME_CHANGED, 200 MGMT_EV_UNCONF_INDEX_ADDED, 201 MGMT_EV_UNCONF_INDEX_REMOVED, 202 MGMT_EV_NEW_CONFIG_OPTIONS, 203 MGMT_EV_EXT_INDEX_ADDED, 204 MGMT_EV_EXT_INDEX_REMOVED, 205 MGMT_EV_EXT_INFO_CHANGED, 206 MGMT_EV_EXP_FEATURE_CHANGED, 207 }; 208 209 #define CACHE_TIMEOUT msecs_to_jiffies(2 * 1000) 210 211 #define ZERO_KEY "\x00\x00\x00\x00\x00\x00\x00\x00" \ 212 "\x00\x00\x00\x00\x00\x00\x00\x00" 213 214 /* HCI to MGMT error code conversion table */ 215 static const u8 mgmt_status_table[] = { 216 MGMT_STATUS_SUCCESS, 217 MGMT_STATUS_UNKNOWN_COMMAND, /* Unknown Command */ 218 MGMT_STATUS_NOT_CONNECTED, /* No Connection */ 219 MGMT_STATUS_FAILED, /* Hardware Failure */ 220 MGMT_STATUS_CONNECT_FAILED, /* Page Timeout */ 221 MGMT_STATUS_AUTH_FAILED, /* Authentication Failed */ 222 MGMT_STATUS_AUTH_FAILED, /* PIN or Key Missing */ 223 MGMT_STATUS_NO_RESOURCES, /* Memory Full */ 224 MGMT_STATUS_TIMEOUT, /* Connection Timeout */ 225 MGMT_STATUS_NO_RESOURCES, /* Max Number of Connections */ 226 MGMT_STATUS_NO_RESOURCES, /* Max Number of SCO Connections */ 227 MGMT_STATUS_ALREADY_CONNECTED, /* ACL Connection Exists */ 228 MGMT_STATUS_BUSY, /* Command Disallowed */ 229 MGMT_STATUS_NO_RESOURCES, /* Rejected Limited Resources */ 230 MGMT_STATUS_REJECTED, /* Rejected Security */ 231 MGMT_STATUS_REJECTED, /* Rejected Personal */ 232 MGMT_STATUS_TIMEOUT, /* Host Timeout */ 233 MGMT_STATUS_NOT_SUPPORTED, /* Unsupported Feature */ 234 MGMT_STATUS_INVALID_PARAMS, /* Invalid Parameters */ 235 MGMT_STATUS_DISCONNECTED, /* OE User Ended Connection */ 236 MGMT_STATUS_NO_RESOURCES, /* OE Low Resources */ 237 MGMT_STATUS_DISCONNECTED, /* OE Power Off */ 238 MGMT_STATUS_DISCONNECTED, /* Connection Terminated */ 239 MGMT_STATUS_BUSY, /* Repeated Attempts */ 240 MGMT_STATUS_REJECTED, /* Pairing Not Allowed */ 241 MGMT_STATUS_FAILED, /* Unknown LMP PDU */ 242 MGMT_STATUS_NOT_SUPPORTED, /* Unsupported Remote Feature */ 243 MGMT_STATUS_REJECTED, /* SCO Offset Rejected */ 244 MGMT_STATUS_REJECTED, /* SCO Interval Rejected */ 245 MGMT_STATUS_REJECTED, /* Air Mode Rejected */ 246 MGMT_STATUS_INVALID_PARAMS, /* Invalid LMP Parameters */ 247 MGMT_STATUS_FAILED, /* Unspecified Error */ 248 MGMT_STATUS_NOT_SUPPORTED, /* Unsupported LMP Parameter Value */ 249 MGMT_STATUS_FAILED, /* Role Change Not Allowed */ 250 MGMT_STATUS_TIMEOUT, /* LMP Response Timeout */ 251 MGMT_STATUS_FAILED, /* LMP Error Transaction Collision */ 252 MGMT_STATUS_FAILED, /* LMP PDU Not Allowed */ 253 MGMT_STATUS_REJECTED, /* Encryption Mode Not Accepted */ 254 MGMT_STATUS_FAILED, /* Unit Link Key Used */ 255 MGMT_STATUS_NOT_SUPPORTED, /* QoS Not Supported */ 256 MGMT_STATUS_TIMEOUT, /* Instant Passed */ 257 MGMT_STATUS_NOT_SUPPORTED, /* Pairing Not Supported */ 258 MGMT_STATUS_FAILED, /* Transaction Collision */ 259 MGMT_STATUS_FAILED, /* Reserved for future use */ 260 MGMT_STATUS_INVALID_PARAMS, /* Unacceptable Parameter */ 261 MGMT_STATUS_REJECTED, /* QoS Rejected */ 262 MGMT_STATUS_NOT_SUPPORTED, /* Classification Not Supported */ 263 MGMT_STATUS_REJECTED, /* Insufficient Security */ 264 MGMT_STATUS_INVALID_PARAMS, /* Parameter Out Of Range */ 265 MGMT_STATUS_FAILED, /* Reserved for future use */ 266 MGMT_STATUS_BUSY, /* Role Switch Pending */ 267 MGMT_STATUS_FAILED, /* Reserved for future use */ 268 MGMT_STATUS_FAILED, /* Slot Violation */ 269 MGMT_STATUS_FAILED, /* Role Switch Failed */ 270 MGMT_STATUS_INVALID_PARAMS, /* EIR Too Large */ 271 MGMT_STATUS_NOT_SUPPORTED, /* Simple Pairing Not Supported */ 272 MGMT_STATUS_BUSY, /* Host Busy Pairing */ 273 MGMT_STATUS_REJECTED, /* Rejected, No Suitable Channel */ 274 MGMT_STATUS_BUSY, /* Controller Busy */ 275 MGMT_STATUS_INVALID_PARAMS, /* Unsuitable Connection Interval */ 276 MGMT_STATUS_TIMEOUT, /* Directed Advertising Timeout */ 277 MGMT_STATUS_AUTH_FAILED, /* Terminated Due to MIC Failure */ 278 MGMT_STATUS_CONNECT_FAILED, /* Connection Establishment Failed */ 279 MGMT_STATUS_CONNECT_FAILED, /* MAC Connection Failed */ 280 }; 281 282 static u8 mgmt_errno_status(int err) 283 { 284 switch (err) { 285 case 0: 286 return MGMT_STATUS_SUCCESS; 287 case -EPERM: 288 return MGMT_STATUS_REJECTED; 289 case -EINVAL: 290 return MGMT_STATUS_INVALID_PARAMS; 291 case -EOPNOTSUPP: 292 return MGMT_STATUS_NOT_SUPPORTED; 293 case -EBUSY: 294 return MGMT_STATUS_BUSY; 295 case -ETIMEDOUT: 296 return MGMT_STATUS_AUTH_FAILED; 297 case -ENOMEM: 298 return MGMT_STATUS_NO_RESOURCES; 299 case -EISCONN: 300 return MGMT_STATUS_ALREADY_CONNECTED; 301 case -ENOTCONN: 302 return MGMT_STATUS_DISCONNECTED; 303 } 304 305 return MGMT_STATUS_FAILED; 306 } 307 308 static u8 mgmt_status(int err) 309 { 310 if (err < 0) 311 return mgmt_errno_status(err); 312 313 if (err < ARRAY_SIZE(mgmt_status_table)) 314 return mgmt_status_table[err]; 315 316 return MGMT_STATUS_FAILED; 317 } 318 319 static int mgmt_index_event(u16 event, struct hci_dev *hdev, void *data, 320 u16 len, int flag) 321 { 322 return mgmt_send_event(event, hdev, HCI_CHANNEL_CONTROL, data, len, 323 flag, NULL); 324 } 325 326 static int mgmt_limited_event(u16 event, struct hci_dev *hdev, void *data, 327 u16 len, int flag, struct sock *skip_sk) 328 { 329 return mgmt_send_event(event, hdev, HCI_CHANNEL_CONTROL, data, len, 330 flag, skip_sk); 331 } 332 333 static int mgmt_event(u16 event, struct hci_dev *hdev, void *data, u16 len, 334 struct sock *skip_sk) 335 { 336 return mgmt_send_event(event, hdev, HCI_CHANNEL_CONTROL, data, len, 337 HCI_SOCK_TRUSTED, skip_sk); 338 } 339 340 static int mgmt_event_skb(struct sk_buff *skb, struct sock *skip_sk) 341 { 342 return mgmt_send_event_skb(HCI_CHANNEL_CONTROL, skb, HCI_SOCK_TRUSTED, 343 skip_sk); 344 } 345 346 static u8 le_addr_type(u8 mgmt_addr_type) 347 { 348 if (mgmt_addr_type == BDADDR_LE_PUBLIC) 349 return ADDR_LE_DEV_PUBLIC; 350 else 351 return ADDR_LE_DEV_RANDOM; 352 } 353 354 void mgmt_fill_version_info(void *ver) 355 { 356 struct mgmt_rp_read_version *rp = ver; 357 358 rp->version = MGMT_VERSION; 359 rp->revision = cpu_to_le16(MGMT_REVISION); 360 } 361 362 static int read_version(struct sock *sk, struct hci_dev *hdev, void *data, 363 u16 data_len) 364 { 365 struct mgmt_rp_read_version rp; 366 367 bt_dev_dbg(hdev, "sock %p", sk); 368 369 mgmt_fill_version_info(&rp); 370 371 return mgmt_cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_VERSION, 0, 372 &rp, sizeof(rp)); 373 } 374 375 static int read_commands(struct sock *sk, struct hci_dev *hdev, void *data, 376 u16 data_len) 377 { 378 struct mgmt_rp_read_commands *rp; 379 u16 num_commands, num_events; 380 size_t rp_size; 381 int i, err; 382 383 bt_dev_dbg(hdev, "sock %p", sk); 384 385 if (hci_sock_test_flag(sk, HCI_SOCK_TRUSTED)) { 386 num_commands = ARRAY_SIZE(mgmt_commands); 387 num_events = ARRAY_SIZE(mgmt_events); 388 } else { 389 num_commands = ARRAY_SIZE(mgmt_untrusted_commands); 390 num_events = ARRAY_SIZE(mgmt_untrusted_events); 391 } 392 393 rp_size = sizeof(*rp) + ((num_commands + num_events) * sizeof(u16)); 394 395 rp = kmalloc(rp_size, GFP_KERNEL); 396 if (!rp) 397 return -ENOMEM; 398 399 rp->num_commands = cpu_to_le16(num_commands); 400 rp->num_events = cpu_to_le16(num_events); 401 402 if (hci_sock_test_flag(sk, HCI_SOCK_TRUSTED)) { 403 __le16 *opcode = rp->opcodes; 404 405 for (i = 0; i < num_commands; i++, opcode++) 406 put_unaligned_le16(mgmt_commands[i], opcode); 407 408 for (i = 0; i < num_events; i++, opcode++) 409 put_unaligned_le16(mgmt_events[i], opcode); 410 } else { 411 __le16 *opcode = rp->opcodes; 412 413 for (i = 0; i < num_commands; i++, opcode++) 414 put_unaligned_le16(mgmt_untrusted_commands[i], opcode); 415 416 for (i = 0; i < num_events; i++, opcode++) 417 put_unaligned_le16(mgmt_untrusted_events[i], opcode); 418 } 419 420 err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_COMMANDS, 0, 421 rp, rp_size); 422 kfree(rp); 423 424 return err; 425 } 426 427 static int read_index_list(struct sock *sk, struct hci_dev *hdev, void *data, 428 u16 data_len) 429 { 430 struct mgmt_rp_read_index_list *rp; 431 struct hci_dev *d; 432 size_t rp_len; 433 u16 count; 434 int err; 435 436 bt_dev_dbg(hdev, "sock %p", sk); 437 438 read_lock(&hci_dev_list_lock); 439 440 count = 0; 441 list_for_each_entry(d, &hci_dev_list, list) { 442 if (d->dev_type == HCI_PRIMARY && 443 !hci_dev_test_flag(d, HCI_UNCONFIGURED)) 444 count++; 445 } 446 447 rp_len = sizeof(*rp) + (2 * count); 448 rp = kmalloc(rp_len, GFP_ATOMIC); 449 if (!rp) { 450 read_unlock(&hci_dev_list_lock); 451 return -ENOMEM; 452 } 453 454 count = 0; 455 list_for_each_entry(d, &hci_dev_list, list) { 456 if (hci_dev_test_flag(d, HCI_SETUP) || 457 hci_dev_test_flag(d, HCI_CONFIG) || 458 hci_dev_test_flag(d, HCI_USER_CHANNEL)) 459 continue; 460 461 /* Devices marked as raw-only are neither configured 462 * nor unconfigured controllers. 463 */ 464 if (test_bit(HCI_QUIRK_RAW_DEVICE, &d->quirks)) 465 continue; 466 467 if (d->dev_type == HCI_PRIMARY && 468 !hci_dev_test_flag(d, HCI_UNCONFIGURED)) { 469 rp->index[count++] = cpu_to_le16(d->id); 470 bt_dev_dbg(hdev, "Added hci%u", d->id); 471 } 472 } 473 474 rp->num_controllers = cpu_to_le16(count); 475 rp_len = sizeof(*rp) + (2 * count); 476 477 read_unlock(&hci_dev_list_lock); 478 479 err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_INDEX_LIST, 480 0, rp, rp_len); 481 482 kfree(rp); 483 484 return err; 485 } 486 487 static int read_unconf_index_list(struct sock *sk, struct hci_dev *hdev, 488 void *data, u16 data_len) 489 { 490 struct mgmt_rp_read_unconf_index_list *rp; 491 struct hci_dev *d; 492 size_t rp_len; 493 u16 count; 494 int err; 495 496 bt_dev_dbg(hdev, "sock %p", sk); 497 498 read_lock(&hci_dev_list_lock); 499 500 count = 0; 501 list_for_each_entry(d, &hci_dev_list, list) { 502 if (d->dev_type == HCI_PRIMARY && 503 hci_dev_test_flag(d, HCI_UNCONFIGURED)) 504 count++; 505 } 506 507 rp_len = sizeof(*rp) + (2 * count); 508 rp = kmalloc(rp_len, GFP_ATOMIC); 509 if (!rp) { 510 read_unlock(&hci_dev_list_lock); 511 return -ENOMEM; 512 } 513 514 count = 0; 515 list_for_each_entry(d, &hci_dev_list, list) { 516 if (hci_dev_test_flag(d, HCI_SETUP) || 517 hci_dev_test_flag(d, HCI_CONFIG) || 518 hci_dev_test_flag(d, HCI_USER_CHANNEL)) 519 continue; 520 521 /* Devices marked as raw-only are neither configured 522 * nor unconfigured controllers. 523 */ 524 if (test_bit(HCI_QUIRK_RAW_DEVICE, &d->quirks)) 525 continue; 526 527 if (d->dev_type == HCI_PRIMARY && 528 hci_dev_test_flag(d, HCI_UNCONFIGURED)) { 529 rp->index[count++] = cpu_to_le16(d->id); 530 bt_dev_dbg(hdev, "Added hci%u", d->id); 531 } 532 } 533 534 rp->num_controllers = cpu_to_le16(count); 535 rp_len = sizeof(*rp) + (2 * count); 536 537 read_unlock(&hci_dev_list_lock); 538 539 err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE, 540 MGMT_OP_READ_UNCONF_INDEX_LIST, 0, rp, rp_len); 541 542 kfree(rp); 543 544 return err; 545 } 546 547 static int read_ext_index_list(struct sock *sk, struct hci_dev *hdev, 548 void *data, u16 data_len) 549 { 550 struct mgmt_rp_read_ext_index_list *rp; 551 struct hci_dev *d; 552 u16 count; 553 int err; 554 555 bt_dev_dbg(hdev, "sock %p", sk); 556 557 read_lock(&hci_dev_list_lock); 558 559 count = 0; 560 list_for_each_entry(d, &hci_dev_list, list) { 561 if (d->dev_type == HCI_PRIMARY || d->dev_type == HCI_AMP) 562 count++; 563 } 564 565 rp = kmalloc(struct_size(rp, entry, count), GFP_ATOMIC); 566 if (!rp) { 567 read_unlock(&hci_dev_list_lock); 568 return -ENOMEM; 569 } 570 571 count = 0; 572 list_for_each_entry(d, &hci_dev_list, list) { 573 if (hci_dev_test_flag(d, HCI_SETUP) || 574 hci_dev_test_flag(d, HCI_CONFIG) || 575 hci_dev_test_flag(d, HCI_USER_CHANNEL)) 576 continue; 577 578 /* Devices marked as raw-only are neither configured 579 * nor unconfigured controllers. 580 */ 581 if (test_bit(HCI_QUIRK_RAW_DEVICE, &d->quirks)) 582 continue; 583 584 if (d->dev_type == HCI_PRIMARY) { 585 if (hci_dev_test_flag(d, HCI_UNCONFIGURED)) 586 rp->entry[count].type = 0x01; 587 else 588 rp->entry[count].type = 0x00; 589 } else if (d->dev_type == HCI_AMP) { 590 rp->entry[count].type = 0x02; 591 } else { 592 continue; 593 } 594 595 rp->entry[count].bus = d->bus; 596 rp->entry[count++].index = cpu_to_le16(d->id); 597 bt_dev_dbg(hdev, "Added hci%u", d->id); 598 } 599 600 rp->num_controllers = cpu_to_le16(count); 601 602 read_unlock(&hci_dev_list_lock); 603 604 /* If this command is called at least once, then all the 605 * default index and unconfigured index events are disabled 606 * and from now on only extended index events are used. 607 */ 608 hci_sock_set_flag(sk, HCI_MGMT_EXT_INDEX_EVENTS); 609 hci_sock_clear_flag(sk, HCI_MGMT_INDEX_EVENTS); 610 hci_sock_clear_flag(sk, HCI_MGMT_UNCONF_INDEX_EVENTS); 611 612 err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE, 613 MGMT_OP_READ_EXT_INDEX_LIST, 0, rp, 614 struct_size(rp, entry, count)); 615 616 kfree(rp); 617 618 return err; 619 } 620 621 static bool is_configured(struct hci_dev *hdev) 622 { 623 if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks) && 624 !hci_dev_test_flag(hdev, HCI_EXT_CONFIGURED)) 625 return false; 626 627 if ((test_bit(HCI_QUIRK_INVALID_BDADDR, &hdev->quirks) || 628 test_bit(HCI_QUIRK_USE_BDADDR_PROPERTY, &hdev->quirks)) && 629 !bacmp(&hdev->public_addr, BDADDR_ANY)) 630 return false; 631 632 return true; 633 } 634 635 static __le32 get_missing_options(struct hci_dev *hdev) 636 { 637 u32 options = 0; 638 639 if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks) && 640 !hci_dev_test_flag(hdev, HCI_EXT_CONFIGURED)) 641 options |= MGMT_OPTION_EXTERNAL_CONFIG; 642 643 if ((test_bit(HCI_QUIRK_INVALID_BDADDR, &hdev->quirks) || 644 test_bit(HCI_QUIRK_USE_BDADDR_PROPERTY, &hdev->quirks)) && 645 !bacmp(&hdev->public_addr, BDADDR_ANY)) 646 options |= MGMT_OPTION_PUBLIC_ADDRESS; 647 648 return cpu_to_le32(options); 649 } 650 651 static int new_options(struct hci_dev *hdev, struct sock *skip) 652 { 653 __le32 options = get_missing_options(hdev); 654 655 return mgmt_limited_event(MGMT_EV_NEW_CONFIG_OPTIONS, hdev, &options, 656 sizeof(options), HCI_MGMT_OPTION_EVENTS, skip); 657 } 658 659 static int send_options_rsp(struct sock *sk, u16 opcode, struct hci_dev *hdev) 660 { 661 __le32 options = get_missing_options(hdev); 662 663 return mgmt_cmd_complete(sk, hdev->id, opcode, 0, &options, 664 sizeof(options)); 665 } 666 667 static int read_config_info(struct sock *sk, struct hci_dev *hdev, 668 void *data, u16 data_len) 669 { 670 struct mgmt_rp_read_config_info rp; 671 u32 options = 0; 672 673 bt_dev_dbg(hdev, "sock %p", sk); 674 675 hci_dev_lock(hdev); 676 677 memset(&rp, 0, sizeof(rp)); 678 rp.manufacturer = cpu_to_le16(hdev->manufacturer); 679 680 if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks)) 681 options |= MGMT_OPTION_EXTERNAL_CONFIG; 682 683 if (hdev->set_bdaddr) 684 options |= MGMT_OPTION_PUBLIC_ADDRESS; 685 686 rp.supported_options = cpu_to_le32(options); 687 rp.missing_options = get_missing_options(hdev); 688 689 hci_dev_unlock(hdev); 690 691 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_CONFIG_INFO, 0, 692 &rp, sizeof(rp)); 693 } 694 695 static u32 get_supported_phys(struct hci_dev *hdev) 696 { 697 u32 supported_phys = 0; 698 699 if (lmp_bredr_capable(hdev)) { 700 supported_phys |= MGMT_PHY_BR_1M_1SLOT; 701 702 if (hdev->features[0][0] & LMP_3SLOT) 703 supported_phys |= MGMT_PHY_BR_1M_3SLOT; 704 705 if (hdev->features[0][0] & LMP_5SLOT) 706 supported_phys |= MGMT_PHY_BR_1M_5SLOT; 707 708 if (lmp_edr_2m_capable(hdev)) { 709 supported_phys |= MGMT_PHY_EDR_2M_1SLOT; 710 711 if (lmp_edr_3slot_capable(hdev)) 712 supported_phys |= MGMT_PHY_EDR_2M_3SLOT; 713 714 if (lmp_edr_5slot_capable(hdev)) 715 supported_phys |= MGMT_PHY_EDR_2M_5SLOT; 716 717 if (lmp_edr_3m_capable(hdev)) { 718 supported_phys |= MGMT_PHY_EDR_3M_1SLOT; 719 720 if (lmp_edr_3slot_capable(hdev)) 721 supported_phys |= MGMT_PHY_EDR_3M_3SLOT; 722 723 if (lmp_edr_5slot_capable(hdev)) 724 supported_phys |= MGMT_PHY_EDR_3M_5SLOT; 725 } 726 } 727 } 728 729 if (lmp_le_capable(hdev)) { 730 supported_phys |= MGMT_PHY_LE_1M_TX; 731 supported_phys |= MGMT_PHY_LE_1M_RX; 732 733 if (hdev->le_features[1] & HCI_LE_PHY_2M) { 734 supported_phys |= MGMT_PHY_LE_2M_TX; 735 supported_phys |= MGMT_PHY_LE_2M_RX; 736 } 737 738 if (hdev->le_features[1] & HCI_LE_PHY_CODED) { 739 supported_phys |= MGMT_PHY_LE_CODED_TX; 740 supported_phys |= MGMT_PHY_LE_CODED_RX; 741 } 742 } 743 744 return supported_phys; 745 } 746 747 static u32 get_selected_phys(struct hci_dev *hdev) 748 { 749 u32 selected_phys = 0; 750 751 if (lmp_bredr_capable(hdev)) { 752 selected_phys |= MGMT_PHY_BR_1M_1SLOT; 753 754 if (hdev->pkt_type & (HCI_DM3 | HCI_DH3)) 755 selected_phys |= MGMT_PHY_BR_1M_3SLOT; 756 757 if (hdev->pkt_type & (HCI_DM5 | HCI_DH5)) 758 selected_phys |= MGMT_PHY_BR_1M_5SLOT; 759 760 if (lmp_edr_2m_capable(hdev)) { 761 if (!(hdev->pkt_type & HCI_2DH1)) 762 selected_phys |= MGMT_PHY_EDR_2M_1SLOT; 763 764 if (lmp_edr_3slot_capable(hdev) && 765 !(hdev->pkt_type & HCI_2DH3)) 766 selected_phys |= MGMT_PHY_EDR_2M_3SLOT; 767 768 if (lmp_edr_5slot_capable(hdev) && 769 !(hdev->pkt_type & HCI_2DH5)) 770 selected_phys |= MGMT_PHY_EDR_2M_5SLOT; 771 772 if (lmp_edr_3m_capable(hdev)) { 773 if (!(hdev->pkt_type & HCI_3DH1)) 774 selected_phys |= MGMT_PHY_EDR_3M_1SLOT; 775 776 if (lmp_edr_3slot_capable(hdev) && 777 !(hdev->pkt_type & HCI_3DH3)) 778 selected_phys |= MGMT_PHY_EDR_3M_3SLOT; 779 780 if (lmp_edr_5slot_capable(hdev) && 781 !(hdev->pkt_type & HCI_3DH5)) 782 selected_phys |= MGMT_PHY_EDR_3M_5SLOT; 783 } 784 } 785 } 786 787 if (lmp_le_capable(hdev)) { 788 if (hdev->le_tx_def_phys & HCI_LE_SET_PHY_1M) 789 selected_phys |= MGMT_PHY_LE_1M_TX; 790 791 if (hdev->le_rx_def_phys & HCI_LE_SET_PHY_1M) 792 selected_phys |= MGMT_PHY_LE_1M_RX; 793 794 if (hdev->le_tx_def_phys & HCI_LE_SET_PHY_2M) 795 selected_phys |= MGMT_PHY_LE_2M_TX; 796 797 if (hdev->le_rx_def_phys & HCI_LE_SET_PHY_2M) 798 selected_phys |= MGMT_PHY_LE_2M_RX; 799 800 if (hdev->le_tx_def_phys & HCI_LE_SET_PHY_CODED) 801 selected_phys |= MGMT_PHY_LE_CODED_TX; 802 803 if (hdev->le_rx_def_phys & HCI_LE_SET_PHY_CODED) 804 selected_phys |= MGMT_PHY_LE_CODED_RX; 805 } 806 807 return selected_phys; 808 } 809 810 static u32 get_configurable_phys(struct hci_dev *hdev) 811 { 812 return (get_supported_phys(hdev) & ~MGMT_PHY_BR_1M_1SLOT & 813 ~MGMT_PHY_LE_1M_TX & ~MGMT_PHY_LE_1M_RX); 814 } 815 816 static u32 get_supported_settings(struct hci_dev *hdev) 817 { 818 u32 settings = 0; 819 820 settings |= MGMT_SETTING_POWERED; 821 settings |= MGMT_SETTING_BONDABLE; 822 settings |= MGMT_SETTING_DEBUG_KEYS; 823 settings |= MGMT_SETTING_CONNECTABLE; 824 settings |= MGMT_SETTING_DISCOVERABLE; 825 826 if (lmp_bredr_capable(hdev)) { 827 if (hdev->hci_ver >= BLUETOOTH_VER_1_2) 828 settings |= MGMT_SETTING_FAST_CONNECTABLE; 829 settings |= MGMT_SETTING_BREDR; 830 settings |= MGMT_SETTING_LINK_SECURITY; 831 832 if (lmp_ssp_capable(hdev)) { 833 settings |= MGMT_SETTING_SSP; 834 if (IS_ENABLED(CONFIG_BT_HS)) 835 settings |= MGMT_SETTING_HS; 836 } 837 838 if (lmp_sc_capable(hdev)) 839 settings |= MGMT_SETTING_SECURE_CONN; 840 841 if (test_bit(HCI_QUIRK_WIDEBAND_SPEECH_SUPPORTED, 842 &hdev->quirks)) 843 settings |= MGMT_SETTING_WIDEBAND_SPEECH; 844 } 845 846 if (lmp_le_capable(hdev)) { 847 settings |= MGMT_SETTING_LE; 848 settings |= MGMT_SETTING_SECURE_CONN; 849 settings |= MGMT_SETTING_PRIVACY; 850 settings |= MGMT_SETTING_STATIC_ADDRESS; 851 settings |= MGMT_SETTING_ADVERTISING; 852 } 853 854 if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks) || 855 hdev->set_bdaddr) 856 settings |= MGMT_SETTING_CONFIGURATION; 857 858 settings |= MGMT_SETTING_PHY_CONFIGURATION; 859 860 return settings; 861 } 862 863 static u32 get_current_settings(struct hci_dev *hdev) 864 { 865 u32 settings = 0; 866 867 if (hdev_is_powered(hdev)) 868 settings |= MGMT_SETTING_POWERED; 869 870 if (hci_dev_test_flag(hdev, HCI_CONNECTABLE)) 871 settings |= MGMT_SETTING_CONNECTABLE; 872 873 if (hci_dev_test_flag(hdev, HCI_FAST_CONNECTABLE)) 874 settings |= MGMT_SETTING_FAST_CONNECTABLE; 875 876 if (hci_dev_test_flag(hdev, HCI_DISCOVERABLE)) 877 settings |= MGMT_SETTING_DISCOVERABLE; 878 879 if (hci_dev_test_flag(hdev, HCI_BONDABLE)) 880 settings |= MGMT_SETTING_BONDABLE; 881 882 if (hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) 883 settings |= MGMT_SETTING_BREDR; 884 885 if (hci_dev_test_flag(hdev, HCI_LE_ENABLED)) 886 settings |= MGMT_SETTING_LE; 887 888 if (hci_dev_test_flag(hdev, HCI_LINK_SECURITY)) 889 settings |= MGMT_SETTING_LINK_SECURITY; 890 891 if (hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) 892 settings |= MGMT_SETTING_SSP; 893 894 if (hci_dev_test_flag(hdev, HCI_HS_ENABLED)) 895 settings |= MGMT_SETTING_HS; 896 897 if (hci_dev_test_flag(hdev, HCI_ADVERTISING)) 898 settings |= MGMT_SETTING_ADVERTISING; 899 900 if (hci_dev_test_flag(hdev, HCI_SC_ENABLED)) 901 settings |= MGMT_SETTING_SECURE_CONN; 902 903 if (hci_dev_test_flag(hdev, HCI_KEEP_DEBUG_KEYS)) 904 settings |= MGMT_SETTING_DEBUG_KEYS; 905 906 if (hci_dev_test_flag(hdev, HCI_PRIVACY)) 907 settings |= MGMT_SETTING_PRIVACY; 908 909 /* The current setting for static address has two purposes. The 910 * first is to indicate if the static address will be used and 911 * the second is to indicate if it is actually set. 912 * 913 * This means if the static address is not configured, this flag 914 * will never be set. If the address is configured, then if the 915 * address is actually used decides if the flag is set or not. 916 * 917 * For single mode LE only controllers and dual-mode controllers 918 * with BR/EDR disabled, the existence of the static address will 919 * be evaluated. 920 */ 921 if (hci_dev_test_flag(hdev, HCI_FORCE_STATIC_ADDR) || 922 !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) || 923 !bacmp(&hdev->bdaddr, BDADDR_ANY)) { 924 if (bacmp(&hdev->static_addr, BDADDR_ANY)) 925 settings |= MGMT_SETTING_STATIC_ADDRESS; 926 } 927 928 if (hci_dev_test_flag(hdev, HCI_WIDEBAND_SPEECH_ENABLED)) 929 settings |= MGMT_SETTING_WIDEBAND_SPEECH; 930 931 return settings; 932 } 933 934 static struct mgmt_pending_cmd *pending_find(u16 opcode, struct hci_dev *hdev) 935 { 936 return mgmt_pending_find(HCI_CHANNEL_CONTROL, opcode, hdev); 937 } 938 939 u8 mgmt_get_adv_discov_flags(struct hci_dev *hdev) 940 { 941 struct mgmt_pending_cmd *cmd; 942 943 /* If there's a pending mgmt command the flags will not yet have 944 * their final values, so check for this first. 945 */ 946 cmd = pending_find(MGMT_OP_SET_DISCOVERABLE, hdev); 947 if (cmd) { 948 struct mgmt_mode *cp = cmd->param; 949 if (cp->val == 0x01) 950 return LE_AD_GENERAL; 951 else if (cp->val == 0x02) 952 return LE_AD_LIMITED; 953 } else { 954 if (hci_dev_test_flag(hdev, HCI_LIMITED_DISCOVERABLE)) 955 return LE_AD_LIMITED; 956 else if (hci_dev_test_flag(hdev, HCI_DISCOVERABLE)) 957 return LE_AD_GENERAL; 958 } 959 960 return 0; 961 } 962 963 bool mgmt_get_connectable(struct hci_dev *hdev) 964 { 965 struct mgmt_pending_cmd *cmd; 966 967 /* If there's a pending mgmt command the flag will not yet have 968 * it's final value, so check for this first. 969 */ 970 cmd = pending_find(MGMT_OP_SET_CONNECTABLE, hdev); 971 if (cmd) { 972 struct mgmt_mode *cp = cmd->param; 973 974 return cp->val; 975 } 976 977 return hci_dev_test_flag(hdev, HCI_CONNECTABLE); 978 } 979 980 static int service_cache_sync(struct hci_dev *hdev, void *data) 981 { 982 hci_update_eir_sync(hdev); 983 hci_update_class_sync(hdev); 984 985 return 0; 986 } 987 988 static void service_cache_off(struct work_struct *work) 989 { 990 struct hci_dev *hdev = container_of(work, struct hci_dev, 991 service_cache.work); 992 993 if (!hci_dev_test_and_clear_flag(hdev, HCI_SERVICE_CACHE)) 994 return; 995 996 hci_cmd_sync_queue(hdev, service_cache_sync, NULL, NULL); 997 } 998 999 static int rpa_expired_sync(struct hci_dev *hdev, void *data) 1000 { 1001 /* The generation of a new RPA and programming it into the 1002 * controller happens in the hci_req_enable_advertising() 1003 * function. 1004 */ 1005 if (ext_adv_capable(hdev)) 1006 return hci_start_ext_adv_sync(hdev, hdev->cur_adv_instance); 1007 else 1008 return hci_enable_advertising_sync(hdev); 1009 } 1010 1011 static void rpa_expired(struct work_struct *work) 1012 { 1013 struct hci_dev *hdev = container_of(work, struct hci_dev, 1014 rpa_expired.work); 1015 1016 bt_dev_dbg(hdev, ""); 1017 1018 hci_dev_set_flag(hdev, HCI_RPA_EXPIRED); 1019 1020 if (!hci_dev_test_flag(hdev, HCI_ADVERTISING)) 1021 return; 1022 1023 hci_cmd_sync_queue(hdev, rpa_expired_sync, NULL, NULL); 1024 } 1025 1026 static void mgmt_init_hdev(struct sock *sk, struct hci_dev *hdev) 1027 { 1028 if (hci_dev_test_and_set_flag(hdev, HCI_MGMT)) 1029 return; 1030 1031 INIT_DELAYED_WORK(&hdev->service_cache, service_cache_off); 1032 INIT_DELAYED_WORK(&hdev->rpa_expired, rpa_expired); 1033 1034 /* Non-mgmt controlled devices get this bit set 1035 * implicitly so that pairing works for them, however 1036 * for mgmt we require user-space to explicitly enable 1037 * it 1038 */ 1039 hci_dev_clear_flag(hdev, HCI_BONDABLE); 1040 } 1041 1042 static int read_controller_info(struct sock *sk, struct hci_dev *hdev, 1043 void *data, u16 data_len) 1044 { 1045 struct mgmt_rp_read_info rp; 1046 1047 bt_dev_dbg(hdev, "sock %p", sk); 1048 1049 hci_dev_lock(hdev); 1050 1051 memset(&rp, 0, sizeof(rp)); 1052 1053 bacpy(&rp.bdaddr, &hdev->bdaddr); 1054 1055 rp.version = hdev->hci_ver; 1056 rp.manufacturer = cpu_to_le16(hdev->manufacturer); 1057 1058 rp.supported_settings = cpu_to_le32(get_supported_settings(hdev)); 1059 rp.current_settings = cpu_to_le32(get_current_settings(hdev)); 1060 1061 memcpy(rp.dev_class, hdev->dev_class, 3); 1062 1063 memcpy(rp.name, hdev->dev_name, sizeof(hdev->dev_name)); 1064 memcpy(rp.short_name, hdev->short_name, sizeof(hdev->short_name)); 1065 1066 hci_dev_unlock(hdev); 1067 1068 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_INFO, 0, &rp, 1069 sizeof(rp)); 1070 } 1071 1072 static u16 append_eir_data_to_buf(struct hci_dev *hdev, u8 *eir) 1073 { 1074 u16 eir_len = 0; 1075 size_t name_len; 1076 1077 if (hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) 1078 eir_len = eir_append_data(eir, eir_len, EIR_CLASS_OF_DEV, 1079 hdev->dev_class, 3); 1080 1081 if (hci_dev_test_flag(hdev, HCI_LE_ENABLED)) 1082 eir_len = eir_append_le16(eir, eir_len, EIR_APPEARANCE, 1083 hdev->appearance); 1084 1085 name_len = strlen(hdev->dev_name); 1086 eir_len = eir_append_data(eir, eir_len, EIR_NAME_COMPLETE, 1087 hdev->dev_name, name_len); 1088 1089 name_len = strlen(hdev->short_name); 1090 eir_len = eir_append_data(eir, eir_len, EIR_NAME_SHORT, 1091 hdev->short_name, name_len); 1092 1093 return eir_len; 1094 } 1095 1096 static int read_ext_controller_info(struct sock *sk, struct hci_dev *hdev, 1097 void *data, u16 data_len) 1098 { 1099 char buf[512]; 1100 struct mgmt_rp_read_ext_info *rp = (void *)buf; 1101 u16 eir_len; 1102 1103 bt_dev_dbg(hdev, "sock %p", sk); 1104 1105 memset(&buf, 0, sizeof(buf)); 1106 1107 hci_dev_lock(hdev); 1108 1109 bacpy(&rp->bdaddr, &hdev->bdaddr); 1110 1111 rp->version = hdev->hci_ver; 1112 rp->manufacturer = cpu_to_le16(hdev->manufacturer); 1113 1114 rp->supported_settings = cpu_to_le32(get_supported_settings(hdev)); 1115 rp->current_settings = cpu_to_le32(get_current_settings(hdev)); 1116 1117 1118 eir_len = append_eir_data_to_buf(hdev, rp->eir); 1119 rp->eir_len = cpu_to_le16(eir_len); 1120 1121 hci_dev_unlock(hdev); 1122 1123 /* If this command is called at least once, then the events 1124 * for class of device and local name changes are disabled 1125 * and only the new extended controller information event 1126 * is used. 1127 */ 1128 hci_sock_set_flag(sk, HCI_MGMT_EXT_INFO_EVENTS); 1129 hci_sock_clear_flag(sk, HCI_MGMT_DEV_CLASS_EVENTS); 1130 hci_sock_clear_flag(sk, HCI_MGMT_LOCAL_NAME_EVENTS); 1131 1132 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_EXT_INFO, 0, rp, 1133 sizeof(*rp) + eir_len); 1134 } 1135 1136 static int ext_info_changed(struct hci_dev *hdev, struct sock *skip) 1137 { 1138 char buf[512]; 1139 struct mgmt_ev_ext_info_changed *ev = (void *)buf; 1140 u16 eir_len; 1141 1142 memset(buf, 0, sizeof(buf)); 1143 1144 eir_len = append_eir_data_to_buf(hdev, ev->eir); 1145 ev->eir_len = cpu_to_le16(eir_len); 1146 1147 return mgmt_limited_event(MGMT_EV_EXT_INFO_CHANGED, hdev, ev, 1148 sizeof(*ev) + eir_len, 1149 HCI_MGMT_EXT_INFO_EVENTS, skip); 1150 } 1151 1152 static int send_settings_rsp(struct sock *sk, u16 opcode, struct hci_dev *hdev) 1153 { 1154 __le32 settings = cpu_to_le32(get_current_settings(hdev)); 1155 1156 return mgmt_cmd_complete(sk, hdev->id, opcode, 0, &settings, 1157 sizeof(settings)); 1158 } 1159 1160 void mgmt_advertising_added(struct sock *sk, struct hci_dev *hdev, u8 instance) 1161 { 1162 struct mgmt_ev_advertising_added ev; 1163 1164 ev.instance = instance; 1165 1166 mgmt_event(MGMT_EV_ADVERTISING_ADDED, hdev, &ev, sizeof(ev), sk); 1167 } 1168 1169 void mgmt_advertising_removed(struct sock *sk, struct hci_dev *hdev, 1170 u8 instance) 1171 { 1172 struct mgmt_ev_advertising_removed ev; 1173 1174 ev.instance = instance; 1175 1176 mgmt_event(MGMT_EV_ADVERTISING_REMOVED, hdev, &ev, sizeof(ev), sk); 1177 } 1178 1179 static void cancel_adv_timeout(struct hci_dev *hdev) 1180 { 1181 if (hdev->adv_instance_timeout) { 1182 hdev->adv_instance_timeout = 0; 1183 cancel_delayed_work(&hdev->adv_instance_expire); 1184 } 1185 } 1186 1187 /* This function requires the caller holds hdev->lock */ 1188 static void restart_le_actions(struct hci_dev *hdev) 1189 { 1190 struct hci_conn_params *p; 1191 1192 list_for_each_entry(p, &hdev->le_conn_params, list) { 1193 /* Needed for AUTO_OFF case where might not "really" 1194 * have been powered off. 1195 */ 1196 list_del_init(&p->action); 1197 1198 switch (p->auto_connect) { 1199 case HCI_AUTO_CONN_DIRECT: 1200 case HCI_AUTO_CONN_ALWAYS: 1201 list_add(&p->action, &hdev->pend_le_conns); 1202 break; 1203 case HCI_AUTO_CONN_REPORT: 1204 list_add(&p->action, &hdev->pend_le_reports); 1205 break; 1206 default: 1207 break; 1208 } 1209 } 1210 } 1211 1212 static int new_settings(struct hci_dev *hdev, struct sock *skip) 1213 { 1214 __le32 ev = cpu_to_le32(get_current_settings(hdev)); 1215 1216 return mgmt_limited_event(MGMT_EV_NEW_SETTINGS, hdev, &ev, 1217 sizeof(ev), HCI_MGMT_SETTING_EVENTS, skip); 1218 } 1219 1220 static void mgmt_set_powered_complete(struct hci_dev *hdev, void *data, int err) 1221 { 1222 struct mgmt_pending_cmd *cmd = data; 1223 struct mgmt_mode *cp; 1224 1225 /* Make sure cmd still outstanding. */ 1226 if (cmd != pending_find(MGMT_OP_SET_POWERED, hdev)) 1227 return; 1228 1229 cp = cmd->param; 1230 1231 bt_dev_dbg(hdev, "err %d", err); 1232 1233 if (!err) { 1234 if (cp->val) { 1235 hci_dev_lock(hdev); 1236 restart_le_actions(hdev); 1237 hci_update_passive_scan(hdev); 1238 hci_dev_unlock(hdev); 1239 } 1240 1241 send_settings_rsp(cmd->sk, cmd->opcode, hdev); 1242 1243 /* Only call new_setting for power on as power off is deferred 1244 * to hdev->power_off work which does call hci_dev_do_close. 1245 */ 1246 if (cp->val) 1247 new_settings(hdev, cmd->sk); 1248 } else { 1249 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_POWERED, 1250 mgmt_status(err)); 1251 } 1252 1253 mgmt_pending_remove(cmd); 1254 } 1255 1256 static int set_powered_sync(struct hci_dev *hdev, void *data) 1257 { 1258 struct mgmt_pending_cmd *cmd = data; 1259 struct mgmt_mode *cp = cmd->param; 1260 1261 BT_DBG("%s", hdev->name); 1262 1263 return hci_set_powered_sync(hdev, cp->val); 1264 } 1265 1266 static int set_powered(struct sock *sk, struct hci_dev *hdev, void *data, 1267 u16 len) 1268 { 1269 struct mgmt_mode *cp = data; 1270 struct mgmt_pending_cmd *cmd; 1271 int err; 1272 1273 bt_dev_dbg(hdev, "sock %p", sk); 1274 1275 if (cp->val != 0x00 && cp->val != 0x01) 1276 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED, 1277 MGMT_STATUS_INVALID_PARAMS); 1278 1279 hci_dev_lock(hdev); 1280 1281 if (pending_find(MGMT_OP_SET_POWERED, hdev)) { 1282 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED, 1283 MGMT_STATUS_BUSY); 1284 goto failed; 1285 } 1286 1287 if (!!cp->val == hdev_is_powered(hdev)) { 1288 err = send_settings_rsp(sk, MGMT_OP_SET_POWERED, hdev); 1289 goto failed; 1290 } 1291 1292 cmd = mgmt_pending_add(sk, MGMT_OP_SET_POWERED, hdev, data, len); 1293 if (!cmd) { 1294 err = -ENOMEM; 1295 goto failed; 1296 } 1297 1298 err = hci_cmd_sync_queue(hdev, set_powered_sync, cmd, 1299 mgmt_set_powered_complete); 1300 1301 if (err < 0) 1302 mgmt_pending_remove(cmd); 1303 1304 failed: 1305 hci_dev_unlock(hdev); 1306 return err; 1307 } 1308 1309 int mgmt_new_settings(struct hci_dev *hdev) 1310 { 1311 return new_settings(hdev, NULL); 1312 } 1313 1314 struct cmd_lookup { 1315 struct sock *sk; 1316 struct hci_dev *hdev; 1317 u8 mgmt_status; 1318 }; 1319 1320 static void settings_rsp(struct mgmt_pending_cmd *cmd, void *data) 1321 { 1322 struct cmd_lookup *match = data; 1323 1324 send_settings_rsp(cmd->sk, cmd->opcode, match->hdev); 1325 1326 list_del(&cmd->list); 1327 1328 if (match->sk == NULL) { 1329 match->sk = cmd->sk; 1330 sock_hold(match->sk); 1331 } 1332 1333 mgmt_pending_free(cmd); 1334 } 1335 1336 static void cmd_status_rsp(struct mgmt_pending_cmd *cmd, void *data) 1337 { 1338 u8 *status = data; 1339 1340 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, *status); 1341 mgmt_pending_remove(cmd); 1342 } 1343 1344 static void cmd_complete_rsp(struct mgmt_pending_cmd *cmd, void *data) 1345 { 1346 if (cmd->cmd_complete) { 1347 u8 *status = data; 1348 1349 cmd->cmd_complete(cmd, *status); 1350 mgmt_pending_remove(cmd); 1351 1352 return; 1353 } 1354 1355 cmd_status_rsp(cmd, data); 1356 } 1357 1358 static int generic_cmd_complete(struct mgmt_pending_cmd *cmd, u8 status) 1359 { 1360 return mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, status, 1361 cmd->param, cmd->param_len); 1362 } 1363 1364 static int addr_cmd_complete(struct mgmt_pending_cmd *cmd, u8 status) 1365 { 1366 return mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, status, 1367 cmd->param, sizeof(struct mgmt_addr_info)); 1368 } 1369 1370 static u8 mgmt_bredr_support(struct hci_dev *hdev) 1371 { 1372 if (!lmp_bredr_capable(hdev)) 1373 return MGMT_STATUS_NOT_SUPPORTED; 1374 else if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) 1375 return MGMT_STATUS_REJECTED; 1376 else 1377 return MGMT_STATUS_SUCCESS; 1378 } 1379 1380 static u8 mgmt_le_support(struct hci_dev *hdev) 1381 { 1382 if (!lmp_le_capable(hdev)) 1383 return MGMT_STATUS_NOT_SUPPORTED; 1384 else if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED)) 1385 return MGMT_STATUS_REJECTED; 1386 else 1387 return MGMT_STATUS_SUCCESS; 1388 } 1389 1390 static void mgmt_set_discoverable_complete(struct hci_dev *hdev, void *data, 1391 int err) 1392 { 1393 struct mgmt_pending_cmd *cmd = data; 1394 1395 bt_dev_dbg(hdev, "err %d", err); 1396 1397 /* Make sure cmd still outstanding. */ 1398 if (cmd != pending_find(MGMT_OP_SET_DISCOVERABLE, hdev)) 1399 return; 1400 1401 hci_dev_lock(hdev); 1402 1403 if (err) { 1404 u8 mgmt_err = mgmt_status(err); 1405 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err); 1406 hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE); 1407 goto done; 1408 } 1409 1410 if (hci_dev_test_flag(hdev, HCI_DISCOVERABLE) && 1411 hdev->discov_timeout > 0) { 1412 int to = msecs_to_jiffies(hdev->discov_timeout * 1000); 1413 queue_delayed_work(hdev->req_workqueue, &hdev->discov_off, to); 1414 } 1415 1416 send_settings_rsp(cmd->sk, MGMT_OP_SET_DISCOVERABLE, hdev); 1417 new_settings(hdev, cmd->sk); 1418 1419 done: 1420 mgmt_pending_remove(cmd); 1421 hci_dev_unlock(hdev); 1422 } 1423 1424 static int set_discoverable_sync(struct hci_dev *hdev, void *data) 1425 { 1426 BT_DBG("%s", hdev->name); 1427 1428 return hci_update_discoverable_sync(hdev); 1429 } 1430 1431 static int set_discoverable(struct sock *sk, struct hci_dev *hdev, void *data, 1432 u16 len) 1433 { 1434 struct mgmt_cp_set_discoverable *cp = data; 1435 struct mgmt_pending_cmd *cmd; 1436 u16 timeout; 1437 int err; 1438 1439 bt_dev_dbg(hdev, "sock %p", sk); 1440 1441 if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED) && 1442 !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) 1443 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE, 1444 MGMT_STATUS_REJECTED); 1445 1446 if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02) 1447 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE, 1448 MGMT_STATUS_INVALID_PARAMS); 1449 1450 timeout = __le16_to_cpu(cp->timeout); 1451 1452 /* Disabling discoverable requires that no timeout is set, 1453 * and enabling limited discoverable requires a timeout. 1454 */ 1455 if ((cp->val == 0x00 && timeout > 0) || 1456 (cp->val == 0x02 && timeout == 0)) 1457 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE, 1458 MGMT_STATUS_INVALID_PARAMS); 1459 1460 hci_dev_lock(hdev); 1461 1462 if (!hdev_is_powered(hdev) && timeout > 0) { 1463 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE, 1464 MGMT_STATUS_NOT_POWERED); 1465 goto failed; 1466 } 1467 1468 if (pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) || 1469 pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) { 1470 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE, 1471 MGMT_STATUS_BUSY); 1472 goto failed; 1473 } 1474 1475 if (!hci_dev_test_flag(hdev, HCI_CONNECTABLE)) { 1476 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE, 1477 MGMT_STATUS_REJECTED); 1478 goto failed; 1479 } 1480 1481 if (hdev->advertising_paused) { 1482 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE, 1483 MGMT_STATUS_BUSY); 1484 goto failed; 1485 } 1486 1487 if (!hdev_is_powered(hdev)) { 1488 bool changed = false; 1489 1490 /* Setting limited discoverable when powered off is 1491 * not a valid operation since it requires a timeout 1492 * and so no need to check HCI_LIMITED_DISCOVERABLE. 1493 */ 1494 if (!!cp->val != hci_dev_test_flag(hdev, HCI_DISCOVERABLE)) { 1495 hci_dev_change_flag(hdev, HCI_DISCOVERABLE); 1496 changed = true; 1497 } 1498 1499 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev); 1500 if (err < 0) 1501 goto failed; 1502 1503 if (changed) 1504 err = new_settings(hdev, sk); 1505 1506 goto failed; 1507 } 1508 1509 /* If the current mode is the same, then just update the timeout 1510 * value with the new value. And if only the timeout gets updated, 1511 * then no need for any HCI transactions. 1512 */ 1513 if (!!cp->val == hci_dev_test_flag(hdev, HCI_DISCOVERABLE) && 1514 (cp->val == 0x02) == hci_dev_test_flag(hdev, 1515 HCI_LIMITED_DISCOVERABLE)) { 1516 cancel_delayed_work(&hdev->discov_off); 1517 hdev->discov_timeout = timeout; 1518 1519 if (cp->val && hdev->discov_timeout > 0) { 1520 int to = msecs_to_jiffies(hdev->discov_timeout * 1000); 1521 queue_delayed_work(hdev->req_workqueue, 1522 &hdev->discov_off, to); 1523 } 1524 1525 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev); 1526 goto failed; 1527 } 1528 1529 cmd = mgmt_pending_add(sk, MGMT_OP_SET_DISCOVERABLE, hdev, data, len); 1530 if (!cmd) { 1531 err = -ENOMEM; 1532 goto failed; 1533 } 1534 1535 /* Cancel any potential discoverable timeout that might be 1536 * still active and store new timeout value. The arming of 1537 * the timeout happens in the complete handler. 1538 */ 1539 cancel_delayed_work(&hdev->discov_off); 1540 hdev->discov_timeout = timeout; 1541 1542 if (cp->val) 1543 hci_dev_set_flag(hdev, HCI_DISCOVERABLE); 1544 else 1545 hci_dev_clear_flag(hdev, HCI_DISCOVERABLE); 1546 1547 /* Limited discoverable mode */ 1548 if (cp->val == 0x02) 1549 hci_dev_set_flag(hdev, HCI_LIMITED_DISCOVERABLE); 1550 else 1551 hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE); 1552 1553 err = hci_cmd_sync_queue(hdev, set_discoverable_sync, cmd, 1554 mgmt_set_discoverable_complete); 1555 1556 if (err < 0) 1557 mgmt_pending_remove(cmd); 1558 1559 failed: 1560 hci_dev_unlock(hdev); 1561 return err; 1562 } 1563 1564 static void mgmt_set_connectable_complete(struct hci_dev *hdev, void *data, 1565 int err) 1566 { 1567 struct mgmt_pending_cmd *cmd = data; 1568 1569 bt_dev_dbg(hdev, "err %d", err); 1570 1571 /* Make sure cmd still outstanding. */ 1572 if (cmd != pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) 1573 return; 1574 1575 hci_dev_lock(hdev); 1576 1577 if (err) { 1578 u8 mgmt_err = mgmt_status(err); 1579 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err); 1580 goto done; 1581 } 1582 1583 send_settings_rsp(cmd->sk, MGMT_OP_SET_CONNECTABLE, hdev); 1584 new_settings(hdev, cmd->sk); 1585 1586 done: 1587 if (cmd) 1588 mgmt_pending_remove(cmd); 1589 1590 hci_dev_unlock(hdev); 1591 } 1592 1593 static int set_connectable_update_settings(struct hci_dev *hdev, 1594 struct sock *sk, u8 val) 1595 { 1596 bool changed = false; 1597 int err; 1598 1599 if (!!val != hci_dev_test_flag(hdev, HCI_CONNECTABLE)) 1600 changed = true; 1601 1602 if (val) { 1603 hci_dev_set_flag(hdev, HCI_CONNECTABLE); 1604 } else { 1605 hci_dev_clear_flag(hdev, HCI_CONNECTABLE); 1606 hci_dev_clear_flag(hdev, HCI_DISCOVERABLE); 1607 } 1608 1609 err = send_settings_rsp(sk, MGMT_OP_SET_CONNECTABLE, hdev); 1610 if (err < 0) 1611 return err; 1612 1613 if (changed) { 1614 hci_req_update_scan(hdev); 1615 hci_update_passive_scan(hdev); 1616 return new_settings(hdev, sk); 1617 } 1618 1619 return 0; 1620 } 1621 1622 static int set_connectable_sync(struct hci_dev *hdev, void *data) 1623 { 1624 BT_DBG("%s", hdev->name); 1625 1626 return hci_update_connectable_sync(hdev); 1627 } 1628 1629 static int set_connectable(struct sock *sk, struct hci_dev *hdev, void *data, 1630 u16 len) 1631 { 1632 struct mgmt_mode *cp = data; 1633 struct mgmt_pending_cmd *cmd; 1634 int err; 1635 1636 bt_dev_dbg(hdev, "sock %p", sk); 1637 1638 if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED) && 1639 !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) 1640 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE, 1641 MGMT_STATUS_REJECTED); 1642 1643 if (cp->val != 0x00 && cp->val != 0x01) 1644 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE, 1645 MGMT_STATUS_INVALID_PARAMS); 1646 1647 hci_dev_lock(hdev); 1648 1649 if (!hdev_is_powered(hdev)) { 1650 err = set_connectable_update_settings(hdev, sk, cp->val); 1651 goto failed; 1652 } 1653 1654 if (pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) || 1655 pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) { 1656 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE, 1657 MGMT_STATUS_BUSY); 1658 goto failed; 1659 } 1660 1661 cmd = mgmt_pending_add(sk, MGMT_OP_SET_CONNECTABLE, hdev, data, len); 1662 if (!cmd) { 1663 err = -ENOMEM; 1664 goto failed; 1665 } 1666 1667 if (cp->val) { 1668 hci_dev_set_flag(hdev, HCI_CONNECTABLE); 1669 } else { 1670 if (hdev->discov_timeout > 0) 1671 cancel_delayed_work(&hdev->discov_off); 1672 1673 hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE); 1674 hci_dev_clear_flag(hdev, HCI_DISCOVERABLE); 1675 hci_dev_clear_flag(hdev, HCI_CONNECTABLE); 1676 } 1677 1678 err = hci_cmd_sync_queue(hdev, set_connectable_sync, cmd, 1679 mgmt_set_connectable_complete); 1680 1681 if (err < 0) 1682 mgmt_pending_remove(cmd); 1683 1684 failed: 1685 hci_dev_unlock(hdev); 1686 return err; 1687 } 1688 1689 static int set_bondable(struct sock *sk, struct hci_dev *hdev, void *data, 1690 u16 len) 1691 { 1692 struct mgmt_mode *cp = data; 1693 bool changed; 1694 int err; 1695 1696 bt_dev_dbg(hdev, "sock %p", sk); 1697 1698 if (cp->val != 0x00 && cp->val != 0x01) 1699 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BONDABLE, 1700 MGMT_STATUS_INVALID_PARAMS); 1701 1702 hci_dev_lock(hdev); 1703 1704 if (cp->val) 1705 changed = !hci_dev_test_and_set_flag(hdev, HCI_BONDABLE); 1706 else 1707 changed = hci_dev_test_and_clear_flag(hdev, HCI_BONDABLE); 1708 1709 err = send_settings_rsp(sk, MGMT_OP_SET_BONDABLE, hdev); 1710 if (err < 0) 1711 goto unlock; 1712 1713 if (changed) { 1714 /* In limited privacy mode the change of bondable mode 1715 * may affect the local advertising address. 1716 */ 1717 hci_update_discoverable(hdev); 1718 1719 err = new_settings(hdev, sk); 1720 } 1721 1722 unlock: 1723 hci_dev_unlock(hdev); 1724 return err; 1725 } 1726 1727 static int set_link_security(struct sock *sk, struct hci_dev *hdev, void *data, 1728 u16 len) 1729 { 1730 struct mgmt_mode *cp = data; 1731 struct mgmt_pending_cmd *cmd; 1732 u8 val, status; 1733 int err; 1734 1735 bt_dev_dbg(hdev, "sock %p", sk); 1736 1737 status = mgmt_bredr_support(hdev); 1738 if (status) 1739 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY, 1740 status); 1741 1742 if (cp->val != 0x00 && cp->val != 0x01) 1743 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY, 1744 MGMT_STATUS_INVALID_PARAMS); 1745 1746 hci_dev_lock(hdev); 1747 1748 if (!hdev_is_powered(hdev)) { 1749 bool changed = false; 1750 1751 if (!!cp->val != hci_dev_test_flag(hdev, HCI_LINK_SECURITY)) { 1752 hci_dev_change_flag(hdev, HCI_LINK_SECURITY); 1753 changed = true; 1754 } 1755 1756 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev); 1757 if (err < 0) 1758 goto failed; 1759 1760 if (changed) 1761 err = new_settings(hdev, sk); 1762 1763 goto failed; 1764 } 1765 1766 if (pending_find(MGMT_OP_SET_LINK_SECURITY, hdev)) { 1767 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY, 1768 MGMT_STATUS_BUSY); 1769 goto failed; 1770 } 1771 1772 val = !!cp->val; 1773 1774 if (test_bit(HCI_AUTH, &hdev->flags) == val) { 1775 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev); 1776 goto failed; 1777 } 1778 1779 cmd = mgmt_pending_add(sk, MGMT_OP_SET_LINK_SECURITY, hdev, data, len); 1780 if (!cmd) { 1781 err = -ENOMEM; 1782 goto failed; 1783 } 1784 1785 err = hci_send_cmd(hdev, HCI_OP_WRITE_AUTH_ENABLE, sizeof(val), &val); 1786 if (err < 0) { 1787 mgmt_pending_remove(cmd); 1788 goto failed; 1789 } 1790 1791 failed: 1792 hci_dev_unlock(hdev); 1793 return err; 1794 } 1795 1796 static void set_ssp_complete(struct hci_dev *hdev, void *data, int err) 1797 { 1798 struct cmd_lookup match = { NULL, hdev }; 1799 struct mgmt_pending_cmd *cmd = data; 1800 struct mgmt_mode *cp = cmd->param; 1801 u8 enable = cp->val; 1802 bool changed; 1803 1804 /* Make sure cmd still outstanding. */ 1805 if (cmd != pending_find(MGMT_OP_SET_SSP, hdev)) 1806 return; 1807 1808 if (err) { 1809 u8 mgmt_err = mgmt_status(err); 1810 1811 if (enable && hci_dev_test_and_clear_flag(hdev, 1812 HCI_SSP_ENABLED)) { 1813 hci_dev_clear_flag(hdev, HCI_HS_ENABLED); 1814 new_settings(hdev, NULL); 1815 } 1816 1817 mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev, cmd_status_rsp, 1818 &mgmt_err); 1819 return; 1820 } 1821 1822 if (enable) { 1823 changed = !hci_dev_test_and_set_flag(hdev, HCI_SSP_ENABLED); 1824 } else { 1825 changed = hci_dev_test_and_clear_flag(hdev, HCI_SSP_ENABLED); 1826 1827 if (!changed) 1828 changed = hci_dev_test_and_clear_flag(hdev, 1829 HCI_HS_ENABLED); 1830 else 1831 hci_dev_clear_flag(hdev, HCI_HS_ENABLED); 1832 } 1833 1834 mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev, settings_rsp, &match); 1835 1836 if (changed) 1837 new_settings(hdev, match.sk); 1838 1839 if (match.sk) 1840 sock_put(match.sk); 1841 1842 hci_update_eir_sync(hdev); 1843 } 1844 1845 static int set_ssp_sync(struct hci_dev *hdev, void *data) 1846 { 1847 struct mgmt_pending_cmd *cmd = data; 1848 struct mgmt_mode *cp = cmd->param; 1849 bool changed = false; 1850 int err; 1851 1852 if (cp->val) 1853 changed = !hci_dev_test_and_set_flag(hdev, HCI_SSP_ENABLED); 1854 1855 err = hci_write_ssp_mode_sync(hdev, cp->val); 1856 1857 if (!err && changed) 1858 hci_dev_clear_flag(hdev, HCI_SSP_ENABLED); 1859 1860 return err; 1861 } 1862 1863 static int set_ssp(struct sock *sk, struct hci_dev *hdev, void *data, u16 len) 1864 { 1865 struct mgmt_mode *cp = data; 1866 struct mgmt_pending_cmd *cmd; 1867 u8 status; 1868 int err; 1869 1870 bt_dev_dbg(hdev, "sock %p", sk); 1871 1872 status = mgmt_bredr_support(hdev); 1873 if (status) 1874 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP, status); 1875 1876 if (!lmp_ssp_capable(hdev)) 1877 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP, 1878 MGMT_STATUS_NOT_SUPPORTED); 1879 1880 if (cp->val != 0x00 && cp->val != 0x01) 1881 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP, 1882 MGMT_STATUS_INVALID_PARAMS); 1883 1884 hci_dev_lock(hdev); 1885 1886 if (!hdev_is_powered(hdev)) { 1887 bool changed; 1888 1889 if (cp->val) { 1890 changed = !hci_dev_test_and_set_flag(hdev, 1891 HCI_SSP_ENABLED); 1892 } else { 1893 changed = hci_dev_test_and_clear_flag(hdev, 1894 HCI_SSP_ENABLED); 1895 if (!changed) 1896 changed = hci_dev_test_and_clear_flag(hdev, 1897 HCI_HS_ENABLED); 1898 else 1899 hci_dev_clear_flag(hdev, HCI_HS_ENABLED); 1900 } 1901 1902 err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev); 1903 if (err < 0) 1904 goto failed; 1905 1906 if (changed) 1907 err = new_settings(hdev, sk); 1908 1909 goto failed; 1910 } 1911 1912 if (pending_find(MGMT_OP_SET_SSP, hdev)) { 1913 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP, 1914 MGMT_STATUS_BUSY); 1915 goto failed; 1916 } 1917 1918 if (!!cp->val == hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) { 1919 err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev); 1920 goto failed; 1921 } 1922 1923 cmd = mgmt_pending_add(sk, MGMT_OP_SET_SSP, hdev, data, len); 1924 if (!cmd) 1925 err = -ENOMEM; 1926 else 1927 err = hci_cmd_sync_queue(hdev, set_ssp_sync, cmd, 1928 set_ssp_complete); 1929 1930 if (err < 0) { 1931 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP, 1932 MGMT_STATUS_FAILED); 1933 1934 if (cmd) 1935 mgmt_pending_remove(cmd); 1936 } 1937 1938 failed: 1939 hci_dev_unlock(hdev); 1940 return err; 1941 } 1942 1943 static int set_hs(struct sock *sk, struct hci_dev *hdev, void *data, u16 len) 1944 { 1945 struct mgmt_mode *cp = data; 1946 bool changed; 1947 u8 status; 1948 int err; 1949 1950 bt_dev_dbg(hdev, "sock %p", sk); 1951 1952 if (!IS_ENABLED(CONFIG_BT_HS)) 1953 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS, 1954 MGMT_STATUS_NOT_SUPPORTED); 1955 1956 status = mgmt_bredr_support(hdev); 1957 if (status) 1958 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS, status); 1959 1960 if (!lmp_ssp_capable(hdev)) 1961 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS, 1962 MGMT_STATUS_NOT_SUPPORTED); 1963 1964 if (!hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) 1965 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS, 1966 MGMT_STATUS_REJECTED); 1967 1968 if (cp->val != 0x00 && cp->val != 0x01) 1969 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS, 1970 MGMT_STATUS_INVALID_PARAMS); 1971 1972 hci_dev_lock(hdev); 1973 1974 if (pending_find(MGMT_OP_SET_SSP, hdev)) { 1975 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS, 1976 MGMT_STATUS_BUSY); 1977 goto unlock; 1978 } 1979 1980 if (cp->val) { 1981 changed = !hci_dev_test_and_set_flag(hdev, HCI_HS_ENABLED); 1982 } else { 1983 if (hdev_is_powered(hdev)) { 1984 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS, 1985 MGMT_STATUS_REJECTED); 1986 goto unlock; 1987 } 1988 1989 changed = hci_dev_test_and_clear_flag(hdev, HCI_HS_ENABLED); 1990 } 1991 1992 err = send_settings_rsp(sk, MGMT_OP_SET_HS, hdev); 1993 if (err < 0) 1994 goto unlock; 1995 1996 if (changed) 1997 err = new_settings(hdev, sk); 1998 1999 unlock: 2000 hci_dev_unlock(hdev); 2001 return err; 2002 } 2003 2004 static void set_le_complete(struct hci_dev *hdev, void *data, int err) 2005 { 2006 struct cmd_lookup match = { NULL, hdev }; 2007 u8 status = mgmt_status(err); 2008 2009 bt_dev_dbg(hdev, "err %d", err); 2010 2011 if (status) { 2012 mgmt_pending_foreach(MGMT_OP_SET_LE, hdev, cmd_status_rsp, 2013 &status); 2014 return; 2015 } 2016 2017 mgmt_pending_foreach(MGMT_OP_SET_LE, hdev, settings_rsp, &match); 2018 2019 new_settings(hdev, match.sk); 2020 2021 if (match.sk) 2022 sock_put(match.sk); 2023 } 2024 2025 static int set_le_sync(struct hci_dev *hdev, void *data) 2026 { 2027 struct mgmt_pending_cmd *cmd = data; 2028 struct mgmt_mode *cp = cmd->param; 2029 u8 val = !!cp->val; 2030 int err; 2031 2032 if (!val) { 2033 if (hci_dev_test_flag(hdev, HCI_LE_ADV)) 2034 hci_disable_advertising_sync(hdev); 2035 2036 if (ext_adv_capable(hdev)) 2037 hci_remove_ext_adv_instance_sync(hdev, 0, cmd->sk); 2038 } else { 2039 hci_dev_set_flag(hdev, HCI_LE_ENABLED); 2040 } 2041 2042 err = hci_write_le_host_supported_sync(hdev, val, 0); 2043 2044 /* Make sure the controller has a good default for 2045 * advertising data. Restrict the update to when LE 2046 * has actually been enabled. During power on, the 2047 * update in powered_update_hci will take care of it. 2048 */ 2049 if (!err && hci_dev_test_flag(hdev, HCI_LE_ENABLED)) { 2050 if (ext_adv_capable(hdev)) { 2051 int status; 2052 2053 status = hci_setup_ext_adv_instance_sync(hdev, 0x00); 2054 if (!status) 2055 hci_update_scan_rsp_data_sync(hdev, 0x00); 2056 } else { 2057 hci_update_adv_data_sync(hdev, 0x00); 2058 hci_update_scan_rsp_data_sync(hdev, 0x00); 2059 } 2060 2061 hci_update_passive_scan(hdev); 2062 } 2063 2064 return err; 2065 } 2066 2067 static int set_le(struct sock *sk, struct hci_dev *hdev, void *data, u16 len) 2068 { 2069 struct mgmt_mode *cp = data; 2070 struct mgmt_pending_cmd *cmd; 2071 int err; 2072 u8 val, enabled; 2073 2074 bt_dev_dbg(hdev, "sock %p", sk); 2075 2076 if (!lmp_le_capable(hdev)) 2077 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE, 2078 MGMT_STATUS_NOT_SUPPORTED); 2079 2080 if (cp->val != 0x00 && cp->val != 0x01) 2081 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE, 2082 MGMT_STATUS_INVALID_PARAMS); 2083 2084 /* Bluetooth single mode LE only controllers or dual-mode 2085 * controllers configured as LE only devices, do not allow 2086 * switching LE off. These have either LE enabled explicitly 2087 * or BR/EDR has been previously switched off. 2088 * 2089 * When trying to enable an already enabled LE, then gracefully 2090 * send a positive response. Trying to disable it however will 2091 * result into rejection. 2092 */ 2093 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) { 2094 if (cp->val == 0x01) 2095 return send_settings_rsp(sk, MGMT_OP_SET_LE, hdev); 2096 2097 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE, 2098 MGMT_STATUS_REJECTED); 2099 } 2100 2101 hci_dev_lock(hdev); 2102 2103 val = !!cp->val; 2104 enabled = lmp_host_le_capable(hdev); 2105 2106 if (!val) 2107 hci_req_clear_adv_instance(hdev, NULL, NULL, 0x00, true); 2108 2109 if (!hdev_is_powered(hdev) || val == enabled) { 2110 bool changed = false; 2111 2112 if (val != hci_dev_test_flag(hdev, HCI_LE_ENABLED)) { 2113 hci_dev_change_flag(hdev, HCI_LE_ENABLED); 2114 changed = true; 2115 } 2116 2117 if (!val && hci_dev_test_flag(hdev, HCI_ADVERTISING)) { 2118 hci_dev_clear_flag(hdev, HCI_ADVERTISING); 2119 changed = true; 2120 } 2121 2122 err = send_settings_rsp(sk, MGMT_OP_SET_LE, hdev); 2123 if (err < 0) 2124 goto unlock; 2125 2126 if (changed) 2127 err = new_settings(hdev, sk); 2128 2129 goto unlock; 2130 } 2131 2132 if (pending_find(MGMT_OP_SET_LE, hdev) || 2133 pending_find(MGMT_OP_SET_ADVERTISING, hdev)) { 2134 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE, 2135 MGMT_STATUS_BUSY); 2136 goto unlock; 2137 } 2138 2139 cmd = mgmt_pending_add(sk, MGMT_OP_SET_LE, hdev, data, len); 2140 if (!cmd) 2141 err = -ENOMEM; 2142 else 2143 err = hci_cmd_sync_queue(hdev, set_le_sync, cmd, 2144 set_le_complete); 2145 2146 if (err < 0) { 2147 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE, 2148 MGMT_STATUS_FAILED); 2149 2150 if (cmd) 2151 mgmt_pending_remove(cmd); 2152 } 2153 2154 unlock: 2155 hci_dev_unlock(hdev); 2156 return err; 2157 } 2158 2159 /* This is a helper function to test for pending mgmt commands that can 2160 * cause CoD or EIR HCI commands. We can only allow one such pending 2161 * mgmt command at a time since otherwise we cannot easily track what 2162 * the current values are, will be, and based on that calculate if a new 2163 * HCI command needs to be sent and if yes with what value. 2164 */ 2165 static bool pending_eir_or_class(struct hci_dev *hdev) 2166 { 2167 struct mgmt_pending_cmd *cmd; 2168 2169 list_for_each_entry(cmd, &hdev->mgmt_pending, list) { 2170 switch (cmd->opcode) { 2171 case MGMT_OP_ADD_UUID: 2172 case MGMT_OP_REMOVE_UUID: 2173 case MGMT_OP_SET_DEV_CLASS: 2174 case MGMT_OP_SET_POWERED: 2175 return true; 2176 } 2177 } 2178 2179 return false; 2180 } 2181 2182 static const u8 bluetooth_base_uuid[] = { 2183 0xfb, 0x34, 0x9b, 0x5f, 0x80, 0x00, 0x00, 0x80, 2184 0x00, 0x10, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 2185 }; 2186 2187 static u8 get_uuid_size(const u8 *uuid) 2188 { 2189 u32 val; 2190 2191 if (memcmp(uuid, bluetooth_base_uuid, 12)) 2192 return 128; 2193 2194 val = get_unaligned_le32(&uuid[12]); 2195 if (val > 0xffff) 2196 return 32; 2197 2198 return 16; 2199 } 2200 2201 static void mgmt_class_complete(struct hci_dev *hdev, void *data, int err) 2202 { 2203 struct mgmt_pending_cmd *cmd = data; 2204 2205 bt_dev_dbg(hdev, "err %d", err); 2206 2207 mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, 2208 mgmt_status(err), hdev->dev_class, 3); 2209 2210 mgmt_pending_free(cmd); 2211 } 2212 2213 static int add_uuid_sync(struct hci_dev *hdev, void *data) 2214 { 2215 int err; 2216 2217 err = hci_update_class_sync(hdev); 2218 if (err) 2219 return err; 2220 2221 return hci_update_eir_sync(hdev); 2222 } 2223 2224 static int add_uuid(struct sock *sk, struct hci_dev *hdev, void *data, u16 len) 2225 { 2226 struct mgmt_cp_add_uuid *cp = data; 2227 struct mgmt_pending_cmd *cmd; 2228 struct bt_uuid *uuid; 2229 int err; 2230 2231 bt_dev_dbg(hdev, "sock %p", sk); 2232 2233 hci_dev_lock(hdev); 2234 2235 if (pending_eir_or_class(hdev)) { 2236 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_UUID, 2237 MGMT_STATUS_BUSY); 2238 goto failed; 2239 } 2240 2241 uuid = kmalloc(sizeof(*uuid), GFP_KERNEL); 2242 if (!uuid) { 2243 err = -ENOMEM; 2244 goto failed; 2245 } 2246 2247 memcpy(uuid->uuid, cp->uuid, 16); 2248 uuid->svc_hint = cp->svc_hint; 2249 uuid->size = get_uuid_size(cp->uuid); 2250 2251 list_add_tail(&uuid->list, &hdev->uuids); 2252 2253 cmd = mgmt_pending_new(sk, MGMT_OP_ADD_UUID, hdev, data, len); 2254 if (!cmd) { 2255 err = -ENOMEM; 2256 goto failed; 2257 } 2258 2259 err = hci_cmd_sync_queue(hdev, add_uuid_sync, cmd, mgmt_class_complete); 2260 if (err < 0) { 2261 mgmt_pending_free(cmd); 2262 goto failed; 2263 } 2264 2265 failed: 2266 hci_dev_unlock(hdev); 2267 return err; 2268 } 2269 2270 static bool enable_service_cache(struct hci_dev *hdev) 2271 { 2272 if (!hdev_is_powered(hdev)) 2273 return false; 2274 2275 if (!hci_dev_test_and_set_flag(hdev, HCI_SERVICE_CACHE)) { 2276 queue_delayed_work(hdev->workqueue, &hdev->service_cache, 2277 CACHE_TIMEOUT); 2278 return true; 2279 } 2280 2281 return false; 2282 } 2283 2284 static int remove_uuid_sync(struct hci_dev *hdev, void *data) 2285 { 2286 int err; 2287 2288 err = hci_update_class_sync(hdev); 2289 if (err) 2290 return err; 2291 2292 return hci_update_eir_sync(hdev); 2293 } 2294 2295 static int remove_uuid(struct sock *sk, struct hci_dev *hdev, void *data, 2296 u16 len) 2297 { 2298 struct mgmt_cp_remove_uuid *cp = data; 2299 struct mgmt_pending_cmd *cmd; 2300 struct bt_uuid *match, *tmp; 2301 static const u8 bt_uuid_any[] = { 2302 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 2303 }; 2304 int err, found; 2305 2306 bt_dev_dbg(hdev, "sock %p", sk); 2307 2308 hci_dev_lock(hdev); 2309 2310 if (pending_eir_or_class(hdev)) { 2311 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID, 2312 MGMT_STATUS_BUSY); 2313 goto unlock; 2314 } 2315 2316 if (memcmp(cp->uuid, bt_uuid_any, 16) == 0) { 2317 hci_uuids_clear(hdev); 2318 2319 if (enable_service_cache(hdev)) { 2320 err = mgmt_cmd_complete(sk, hdev->id, 2321 MGMT_OP_REMOVE_UUID, 2322 0, hdev->dev_class, 3); 2323 goto unlock; 2324 } 2325 2326 goto update_class; 2327 } 2328 2329 found = 0; 2330 2331 list_for_each_entry_safe(match, tmp, &hdev->uuids, list) { 2332 if (memcmp(match->uuid, cp->uuid, 16) != 0) 2333 continue; 2334 2335 list_del(&match->list); 2336 kfree(match); 2337 found++; 2338 } 2339 2340 if (found == 0) { 2341 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID, 2342 MGMT_STATUS_INVALID_PARAMS); 2343 goto unlock; 2344 } 2345 2346 update_class: 2347 cmd = mgmt_pending_new(sk, MGMT_OP_REMOVE_UUID, hdev, data, len); 2348 if (!cmd) { 2349 err = -ENOMEM; 2350 goto unlock; 2351 } 2352 2353 err = hci_cmd_sync_queue(hdev, remove_uuid_sync, cmd, 2354 mgmt_class_complete); 2355 if (err < 0) 2356 mgmt_pending_free(cmd); 2357 2358 unlock: 2359 hci_dev_unlock(hdev); 2360 return err; 2361 } 2362 2363 static int set_class_sync(struct hci_dev *hdev, void *data) 2364 { 2365 int err = 0; 2366 2367 if (hci_dev_test_and_clear_flag(hdev, HCI_SERVICE_CACHE)) { 2368 cancel_delayed_work_sync(&hdev->service_cache); 2369 err = hci_update_eir_sync(hdev); 2370 } 2371 2372 if (err) 2373 return err; 2374 2375 return hci_update_class_sync(hdev); 2376 } 2377 2378 static int set_dev_class(struct sock *sk, struct hci_dev *hdev, void *data, 2379 u16 len) 2380 { 2381 struct mgmt_cp_set_dev_class *cp = data; 2382 struct mgmt_pending_cmd *cmd; 2383 int err; 2384 2385 bt_dev_dbg(hdev, "sock %p", sk); 2386 2387 if (!lmp_bredr_capable(hdev)) 2388 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 2389 MGMT_STATUS_NOT_SUPPORTED); 2390 2391 hci_dev_lock(hdev); 2392 2393 if (pending_eir_or_class(hdev)) { 2394 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 2395 MGMT_STATUS_BUSY); 2396 goto unlock; 2397 } 2398 2399 if ((cp->minor & 0x03) != 0 || (cp->major & 0xe0) != 0) { 2400 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 2401 MGMT_STATUS_INVALID_PARAMS); 2402 goto unlock; 2403 } 2404 2405 hdev->major_class = cp->major; 2406 hdev->minor_class = cp->minor; 2407 2408 if (!hdev_is_powered(hdev)) { 2409 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 0, 2410 hdev->dev_class, 3); 2411 goto unlock; 2412 } 2413 2414 cmd = mgmt_pending_new(sk, MGMT_OP_SET_DEV_CLASS, hdev, data, len); 2415 if (!cmd) { 2416 err = -ENOMEM; 2417 goto unlock; 2418 } 2419 2420 err = hci_cmd_sync_queue(hdev, set_class_sync, cmd, 2421 mgmt_class_complete); 2422 if (err < 0) 2423 mgmt_pending_free(cmd); 2424 2425 unlock: 2426 hci_dev_unlock(hdev); 2427 return err; 2428 } 2429 2430 static int load_link_keys(struct sock *sk, struct hci_dev *hdev, void *data, 2431 u16 len) 2432 { 2433 struct mgmt_cp_load_link_keys *cp = data; 2434 const u16 max_key_count = ((U16_MAX - sizeof(*cp)) / 2435 sizeof(struct mgmt_link_key_info)); 2436 u16 key_count, expected_len; 2437 bool changed; 2438 int i; 2439 2440 bt_dev_dbg(hdev, "sock %p", sk); 2441 2442 if (!lmp_bredr_capable(hdev)) 2443 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS, 2444 MGMT_STATUS_NOT_SUPPORTED); 2445 2446 key_count = __le16_to_cpu(cp->key_count); 2447 if (key_count > max_key_count) { 2448 bt_dev_err(hdev, "load_link_keys: too big key_count value %u", 2449 key_count); 2450 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS, 2451 MGMT_STATUS_INVALID_PARAMS); 2452 } 2453 2454 expected_len = struct_size(cp, keys, key_count); 2455 if (expected_len != len) { 2456 bt_dev_err(hdev, "load_link_keys: expected %u bytes, got %u bytes", 2457 expected_len, len); 2458 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS, 2459 MGMT_STATUS_INVALID_PARAMS); 2460 } 2461 2462 if (cp->debug_keys != 0x00 && cp->debug_keys != 0x01) 2463 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS, 2464 MGMT_STATUS_INVALID_PARAMS); 2465 2466 bt_dev_dbg(hdev, "debug_keys %u key_count %u", cp->debug_keys, 2467 key_count); 2468 2469 for (i = 0; i < key_count; i++) { 2470 struct mgmt_link_key_info *key = &cp->keys[i]; 2471 2472 if (key->addr.type != BDADDR_BREDR || key->type > 0x08) 2473 return mgmt_cmd_status(sk, hdev->id, 2474 MGMT_OP_LOAD_LINK_KEYS, 2475 MGMT_STATUS_INVALID_PARAMS); 2476 } 2477 2478 hci_dev_lock(hdev); 2479 2480 hci_link_keys_clear(hdev); 2481 2482 if (cp->debug_keys) 2483 changed = !hci_dev_test_and_set_flag(hdev, HCI_KEEP_DEBUG_KEYS); 2484 else 2485 changed = hci_dev_test_and_clear_flag(hdev, 2486 HCI_KEEP_DEBUG_KEYS); 2487 2488 if (changed) 2489 new_settings(hdev, NULL); 2490 2491 for (i = 0; i < key_count; i++) { 2492 struct mgmt_link_key_info *key = &cp->keys[i]; 2493 2494 if (hci_is_blocked_key(hdev, 2495 HCI_BLOCKED_KEY_TYPE_LINKKEY, 2496 key->val)) { 2497 bt_dev_warn(hdev, "Skipping blocked link key for %pMR", 2498 &key->addr.bdaddr); 2499 continue; 2500 } 2501 2502 /* Always ignore debug keys and require a new pairing if 2503 * the user wants to use them. 2504 */ 2505 if (key->type == HCI_LK_DEBUG_COMBINATION) 2506 continue; 2507 2508 hci_add_link_key(hdev, NULL, &key->addr.bdaddr, key->val, 2509 key->type, key->pin_len, NULL); 2510 } 2511 2512 mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS, 0, NULL, 0); 2513 2514 hci_dev_unlock(hdev); 2515 2516 return 0; 2517 } 2518 2519 static int device_unpaired(struct hci_dev *hdev, bdaddr_t *bdaddr, 2520 u8 addr_type, struct sock *skip_sk) 2521 { 2522 struct mgmt_ev_device_unpaired ev; 2523 2524 bacpy(&ev.addr.bdaddr, bdaddr); 2525 ev.addr.type = addr_type; 2526 2527 return mgmt_event(MGMT_EV_DEVICE_UNPAIRED, hdev, &ev, sizeof(ev), 2528 skip_sk); 2529 } 2530 2531 static int unpair_device(struct sock *sk, struct hci_dev *hdev, void *data, 2532 u16 len) 2533 { 2534 struct mgmt_cp_unpair_device *cp = data; 2535 struct mgmt_rp_unpair_device rp; 2536 struct hci_conn_params *params; 2537 struct mgmt_pending_cmd *cmd; 2538 struct hci_conn *conn; 2539 u8 addr_type; 2540 int err; 2541 2542 memset(&rp, 0, sizeof(rp)); 2543 bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr); 2544 rp.addr.type = cp->addr.type; 2545 2546 if (!bdaddr_type_is_valid(cp->addr.type)) 2547 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE, 2548 MGMT_STATUS_INVALID_PARAMS, 2549 &rp, sizeof(rp)); 2550 2551 if (cp->disconnect != 0x00 && cp->disconnect != 0x01) 2552 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE, 2553 MGMT_STATUS_INVALID_PARAMS, 2554 &rp, sizeof(rp)); 2555 2556 hci_dev_lock(hdev); 2557 2558 if (!hdev_is_powered(hdev)) { 2559 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE, 2560 MGMT_STATUS_NOT_POWERED, &rp, 2561 sizeof(rp)); 2562 goto unlock; 2563 } 2564 2565 if (cp->addr.type == BDADDR_BREDR) { 2566 /* If disconnection is requested, then look up the 2567 * connection. If the remote device is connected, it 2568 * will be later used to terminate the link. 2569 * 2570 * Setting it to NULL explicitly will cause no 2571 * termination of the link. 2572 */ 2573 if (cp->disconnect) 2574 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, 2575 &cp->addr.bdaddr); 2576 else 2577 conn = NULL; 2578 2579 err = hci_remove_link_key(hdev, &cp->addr.bdaddr); 2580 if (err < 0) { 2581 err = mgmt_cmd_complete(sk, hdev->id, 2582 MGMT_OP_UNPAIR_DEVICE, 2583 MGMT_STATUS_NOT_PAIRED, &rp, 2584 sizeof(rp)); 2585 goto unlock; 2586 } 2587 2588 goto done; 2589 } 2590 2591 /* LE address type */ 2592 addr_type = le_addr_type(cp->addr.type); 2593 2594 /* Abort any ongoing SMP pairing. Removes ltk and irk if they exist. */ 2595 err = smp_cancel_and_remove_pairing(hdev, &cp->addr.bdaddr, addr_type); 2596 if (err < 0) { 2597 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE, 2598 MGMT_STATUS_NOT_PAIRED, &rp, 2599 sizeof(rp)); 2600 goto unlock; 2601 } 2602 2603 conn = hci_conn_hash_lookup_le(hdev, &cp->addr.bdaddr, addr_type); 2604 if (!conn) { 2605 hci_conn_params_del(hdev, &cp->addr.bdaddr, addr_type); 2606 goto done; 2607 } 2608 2609 2610 /* Defer clearing up the connection parameters until closing to 2611 * give a chance of keeping them if a repairing happens. 2612 */ 2613 set_bit(HCI_CONN_PARAM_REMOVAL_PEND, &conn->flags); 2614 2615 /* Disable auto-connection parameters if present */ 2616 params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr, addr_type); 2617 if (params) { 2618 if (params->explicit_connect) 2619 params->auto_connect = HCI_AUTO_CONN_EXPLICIT; 2620 else 2621 params->auto_connect = HCI_AUTO_CONN_DISABLED; 2622 } 2623 2624 /* If disconnection is not requested, then clear the connection 2625 * variable so that the link is not terminated. 2626 */ 2627 if (!cp->disconnect) 2628 conn = NULL; 2629 2630 done: 2631 /* If the connection variable is set, then termination of the 2632 * link is requested. 2633 */ 2634 if (!conn) { 2635 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE, 0, 2636 &rp, sizeof(rp)); 2637 device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, sk); 2638 goto unlock; 2639 } 2640 2641 cmd = mgmt_pending_add(sk, MGMT_OP_UNPAIR_DEVICE, hdev, cp, 2642 sizeof(*cp)); 2643 if (!cmd) { 2644 err = -ENOMEM; 2645 goto unlock; 2646 } 2647 2648 cmd->cmd_complete = addr_cmd_complete; 2649 2650 err = hci_abort_conn(conn, HCI_ERROR_REMOTE_USER_TERM); 2651 if (err < 0) 2652 mgmt_pending_remove(cmd); 2653 2654 unlock: 2655 hci_dev_unlock(hdev); 2656 return err; 2657 } 2658 2659 static int disconnect(struct sock *sk, struct hci_dev *hdev, void *data, 2660 u16 len) 2661 { 2662 struct mgmt_cp_disconnect *cp = data; 2663 struct mgmt_rp_disconnect rp; 2664 struct mgmt_pending_cmd *cmd; 2665 struct hci_conn *conn; 2666 int err; 2667 2668 bt_dev_dbg(hdev, "sock %p", sk); 2669 2670 memset(&rp, 0, sizeof(rp)); 2671 bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr); 2672 rp.addr.type = cp->addr.type; 2673 2674 if (!bdaddr_type_is_valid(cp->addr.type)) 2675 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT, 2676 MGMT_STATUS_INVALID_PARAMS, 2677 &rp, sizeof(rp)); 2678 2679 hci_dev_lock(hdev); 2680 2681 if (!test_bit(HCI_UP, &hdev->flags)) { 2682 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT, 2683 MGMT_STATUS_NOT_POWERED, &rp, 2684 sizeof(rp)); 2685 goto failed; 2686 } 2687 2688 if (pending_find(MGMT_OP_DISCONNECT, hdev)) { 2689 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT, 2690 MGMT_STATUS_BUSY, &rp, sizeof(rp)); 2691 goto failed; 2692 } 2693 2694 if (cp->addr.type == BDADDR_BREDR) 2695 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, 2696 &cp->addr.bdaddr); 2697 else 2698 conn = hci_conn_hash_lookup_le(hdev, &cp->addr.bdaddr, 2699 le_addr_type(cp->addr.type)); 2700 2701 if (!conn || conn->state == BT_OPEN || conn->state == BT_CLOSED) { 2702 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT, 2703 MGMT_STATUS_NOT_CONNECTED, &rp, 2704 sizeof(rp)); 2705 goto failed; 2706 } 2707 2708 cmd = mgmt_pending_add(sk, MGMT_OP_DISCONNECT, hdev, data, len); 2709 if (!cmd) { 2710 err = -ENOMEM; 2711 goto failed; 2712 } 2713 2714 cmd->cmd_complete = generic_cmd_complete; 2715 2716 err = hci_disconnect(conn, HCI_ERROR_REMOTE_USER_TERM); 2717 if (err < 0) 2718 mgmt_pending_remove(cmd); 2719 2720 failed: 2721 hci_dev_unlock(hdev); 2722 return err; 2723 } 2724 2725 static u8 link_to_bdaddr(u8 link_type, u8 addr_type) 2726 { 2727 switch (link_type) { 2728 case LE_LINK: 2729 switch (addr_type) { 2730 case ADDR_LE_DEV_PUBLIC: 2731 return BDADDR_LE_PUBLIC; 2732 2733 default: 2734 /* Fallback to LE Random address type */ 2735 return BDADDR_LE_RANDOM; 2736 } 2737 2738 default: 2739 /* Fallback to BR/EDR type */ 2740 return BDADDR_BREDR; 2741 } 2742 } 2743 2744 static int get_connections(struct sock *sk, struct hci_dev *hdev, void *data, 2745 u16 data_len) 2746 { 2747 struct mgmt_rp_get_connections *rp; 2748 struct hci_conn *c; 2749 int err; 2750 u16 i; 2751 2752 bt_dev_dbg(hdev, "sock %p", sk); 2753 2754 hci_dev_lock(hdev); 2755 2756 if (!hdev_is_powered(hdev)) { 2757 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_CONNECTIONS, 2758 MGMT_STATUS_NOT_POWERED); 2759 goto unlock; 2760 } 2761 2762 i = 0; 2763 list_for_each_entry(c, &hdev->conn_hash.list, list) { 2764 if (test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags)) 2765 i++; 2766 } 2767 2768 rp = kmalloc(struct_size(rp, addr, i), GFP_KERNEL); 2769 if (!rp) { 2770 err = -ENOMEM; 2771 goto unlock; 2772 } 2773 2774 i = 0; 2775 list_for_each_entry(c, &hdev->conn_hash.list, list) { 2776 if (!test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags)) 2777 continue; 2778 bacpy(&rp->addr[i].bdaddr, &c->dst); 2779 rp->addr[i].type = link_to_bdaddr(c->type, c->dst_type); 2780 if (c->type == SCO_LINK || c->type == ESCO_LINK) 2781 continue; 2782 i++; 2783 } 2784 2785 rp->conn_count = cpu_to_le16(i); 2786 2787 /* Recalculate length in case of filtered SCO connections, etc */ 2788 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONNECTIONS, 0, rp, 2789 struct_size(rp, addr, i)); 2790 2791 kfree(rp); 2792 2793 unlock: 2794 hci_dev_unlock(hdev); 2795 return err; 2796 } 2797 2798 static int send_pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev, 2799 struct mgmt_cp_pin_code_neg_reply *cp) 2800 { 2801 struct mgmt_pending_cmd *cmd; 2802 int err; 2803 2804 cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_NEG_REPLY, hdev, cp, 2805 sizeof(*cp)); 2806 if (!cmd) 2807 return -ENOMEM; 2808 2809 cmd->cmd_complete = addr_cmd_complete; 2810 2811 err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_NEG_REPLY, 2812 sizeof(cp->addr.bdaddr), &cp->addr.bdaddr); 2813 if (err < 0) 2814 mgmt_pending_remove(cmd); 2815 2816 return err; 2817 } 2818 2819 static int pin_code_reply(struct sock *sk, struct hci_dev *hdev, void *data, 2820 u16 len) 2821 { 2822 struct hci_conn *conn; 2823 struct mgmt_cp_pin_code_reply *cp = data; 2824 struct hci_cp_pin_code_reply reply; 2825 struct mgmt_pending_cmd *cmd; 2826 int err; 2827 2828 bt_dev_dbg(hdev, "sock %p", sk); 2829 2830 hci_dev_lock(hdev); 2831 2832 if (!hdev_is_powered(hdev)) { 2833 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY, 2834 MGMT_STATUS_NOT_POWERED); 2835 goto failed; 2836 } 2837 2838 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->addr.bdaddr); 2839 if (!conn) { 2840 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY, 2841 MGMT_STATUS_NOT_CONNECTED); 2842 goto failed; 2843 } 2844 2845 if (conn->pending_sec_level == BT_SECURITY_HIGH && cp->pin_len != 16) { 2846 struct mgmt_cp_pin_code_neg_reply ncp; 2847 2848 memcpy(&ncp.addr, &cp->addr, sizeof(ncp.addr)); 2849 2850 bt_dev_err(hdev, "PIN code is not 16 bytes long"); 2851 2852 err = send_pin_code_neg_reply(sk, hdev, &ncp); 2853 if (err >= 0) 2854 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY, 2855 MGMT_STATUS_INVALID_PARAMS); 2856 2857 goto failed; 2858 } 2859 2860 cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_REPLY, hdev, data, len); 2861 if (!cmd) { 2862 err = -ENOMEM; 2863 goto failed; 2864 } 2865 2866 cmd->cmd_complete = addr_cmd_complete; 2867 2868 bacpy(&reply.bdaddr, &cp->addr.bdaddr); 2869 reply.pin_len = cp->pin_len; 2870 memcpy(reply.pin_code, cp->pin_code, sizeof(reply.pin_code)); 2871 2872 err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_REPLY, sizeof(reply), &reply); 2873 if (err < 0) 2874 mgmt_pending_remove(cmd); 2875 2876 failed: 2877 hci_dev_unlock(hdev); 2878 return err; 2879 } 2880 2881 static int set_io_capability(struct sock *sk, struct hci_dev *hdev, void *data, 2882 u16 len) 2883 { 2884 struct mgmt_cp_set_io_capability *cp = data; 2885 2886 bt_dev_dbg(hdev, "sock %p", sk); 2887 2888 if (cp->io_capability > SMP_IO_KEYBOARD_DISPLAY) 2889 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_IO_CAPABILITY, 2890 MGMT_STATUS_INVALID_PARAMS); 2891 2892 hci_dev_lock(hdev); 2893 2894 hdev->io_capability = cp->io_capability; 2895 2896 bt_dev_dbg(hdev, "IO capability set to 0x%02x", hdev->io_capability); 2897 2898 hci_dev_unlock(hdev); 2899 2900 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_IO_CAPABILITY, 0, 2901 NULL, 0); 2902 } 2903 2904 static struct mgmt_pending_cmd *find_pairing(struct hci_conn *conn) 2905 { 2906 struct hci_dev *hdev = conn->hdev; 2907 struct mgmt_pending_cmd *cmd; 2908 2909 list_for_each_entry(cmd, &hdev->mgmt_pending, list) { 2910 if (cmd->opcode != MGMT_OP_PAIR_DEVICE) 2911 continue; 2912 2913 if (cmd->user_data != conn) 2914 continue; 2915 2916 return cmd; 2917 } 2918 2919 return NULL; 2920 } 2921 2922 static int pairing_complete(struct mgmt_pending_cmd *cmd, u8 status) 2923 { 2924 struct mgmt_rp_pair_device rp; 2925 struct hci_conn *conn = cmd->user_data; 2926 int err; 2927 2928 bacpy(&rp.addr.bdaddr, &conn->dst); 2929 rp.addr.type = link_to_bdaddr(conn->type, conn->dst_type); 2930 2931 err = mgmt_cmd_complete(cmd->sk, cmd->index, MGMT_OP_PAIR_DEVICE, 2932 status, &rp, sizeof(rp)); 2933 2934 /* So we don't get further callbacks for this connection */ 2935 conn->connect_cfm_cb = NULL; 2936 conn->security_cfm_cb = NULL; 2937 conn->disconn_cfm_cb = NULL; 2938 2939 hci_conn_drop(conn); 2940 2941 /* The device is paired so there is no need to remove 2942 * its connection parameters anymore. 2943 */ 2944 clear_bit(HCI_CONN_PARAM_REMOVAL_PEND, &conn->flags); 2945 2946 hci_conn_put(conn); 2947 2948 return err; 2949 } 2950 2951 void mgmt_smp_complete(struct hci_conn *conn, bool complete) 2952 { 2953 u8 status = complete ? MGMT_STATUS_SUCCESS : MGMT_STATUS_FAILED; 2954 struct mgmt_pending_cmd *cmd; 2955 2956 cmd = find_pairing(conn); 2957 if (cmd) { 2958 cmd->cmd_complete(cmd, status); 2959 mgmt_pending_remove(cmd); 2960 } 2961 } 2962 2963 static void pairing_complete_cb(struct hci_conn *conn, u8 status) 2964 { 2965 struct mgmt_pending_cmd *cmd; 2966 2967 BT_DBG("status %u", status); 2968 2969 cmd = find_pairing(conn); 2970 if (!cmd) { 2971 BT_DBG("Unable to find a pending command"); 2972 return; 2973 } 2974 2975 cmd->cmd_complete(cmd, mgmt_status(status)); 2976 mgmt_pending_remove(cmd); 2977 } 2978 2979 static void le_pairing_complete_cb(struct hci_conn *conn, u8 status) 2980 { 2981 struct mgmt_pending_cmd *cmd; 2982 2983 BT_DBG("status %u", status); 2984 2985 if (!status) 2986 return; 2987 2988 cmd = find_pairing(conn); 2989 if (!cmd) { 2990 BT_DBG("Unable to find a pending command"); 2991 return; 2992 } 2993 2994 cmd->cmd_complete(cmd, mgmt_status(status)); 2995 mgmt_pending_remove(cmd); 2996 } 2997 2998 static int pair_device(struct sock *sk, struct hci_dev *hdev, void *data, 2999 u16 len) 3000 { 3001 struct mgmt_cp_pair_device *cp = data; 3002 struct mgmt_rp_pair_device rp; 3003 struct mgmt_pending_cmd *cmd; 3004 u8 sec_level, auth_type; 3005 struct hci_conn *conn; 3006 int err; 3007 3008 bt_dev_dbg(hdev, "sock %p", sk); 3009 3010 memset(&rp, 0, sizeof(rp)); 3011 bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr); 3012 rp.addr.type = cp->addr.type; 3013 3014 if (!bdaddr_type_is_valid(cp->addr.type)) 3015 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE, 3016 MGMT_STATUS_INVALID_PARAMS, 3017 &rp, sizeof(rp)); 3018 3019 if (cp->io_cap > SMP_IO_KEYBOARD_DISPLAY) 3020 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE, 3021 MGMT_STATUS_INVALID_PARAMS, 3022 &rp, sizeof(rp)); 3023 3024 hci_dev_lock(hdev); 3025 3026 if (!hdev_is_powered(hdev)) { 3027 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE, 3028 MGMT_STATUS_NOT_POWERED, &rp, 3029 sizeof(rp)); 3030 goto unlock; 3031 } 3032 3033 if (hci_bdaddr_is_paired(hdev, &cp->addr.bdaddr, cp->addr.type)) { 3034 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE, 3035 MGMT_STATUS_ALREADY_PAIRED, &rp, 3036 sizeof(rp)); 3037 goto unlock; 3038 } 3039 3040 sec_level = BT_SECURITY_MEDIUM; 3041 auth_type = HCI_AT_DEDICATED_BONDING; 3042 3043 if (cp->addr.type == BDADDR_BREDR) { 3044 conn = hci_connect_acl(hdev, &cp->addr.bdaddr, sec_level, 3045 auth_type, CONN_REASON_PAIR_DEVICE); 3046 } else { 3047 u8 addr_type = le_addr_type(cp->addr.type); 3048 struct hci_conn_params *p; 3049 3050 /* When pairing a new device, it is expected to remember 3051 * this device for future connections. Adding the connection 3052 * parameter information ahead of time allows tracking 3053 * of the peripheral preferred values and will speed up any 3054 * further connection establishment. 3055 * 3056 * If connection parameters already exist, then they 3057 * will be kept and this function does nothing. 3058 */ 3059 p = hci_conn_params_add(hdev, &cp->addr.bdaddr, addr_type); 3060 3061 if (p->auto_connect == HCI_AUTO_CONN_EXPLICIT) 3062 p->auto_connect = HCI_AUTO_CONN_DISABLED; 3063 3064 conn = hci_connect_le_scan(hdev, &cp->addr.bdaddr, addr_type, 3065 sec_level, HCI_LE_CONN_TIMEOUT, 3066 CONN_REASON_PAIR_DEVICE); 3067 } 3068 3069 if (IS_ERR(conn)) { 3070 int status; 3071 3072 if (PTR_ERR(conn) == -EBUSY) 3073 status = MGMT_STATUS_BUSY; 3074 else if (PTR_ERR(conn) == -EOPNOTSUPP) 3075 status = MGMT_STATUS_NOT_SUPPORTED; 3076 else if (PTR_ERR(conn) == -ECONNREFUSED) 3077 status = MGMT_STATUS_REJECTED; 3078 else 3079 status = MGMT_STATUS_CONNECT_FAILED; 3080 3081 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE, 3082 status, &rp, sizeof(rp)); 3083 goto unlock; 3084 } 3085 3086 if (conn->connect_cfm_cb) { 3087 hci_conn_drop(conn); 3088 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE, 3089 MGMT_STATUS_BUSY, &rp, sizeof(rp)); 3090 goto unlock; 3091 } 3092 3093 cmd = mgmt_pending_add(sk, MGMT_OP_PAIR_DEVICE, hdev, data, len); 3094 if (!cmd) { 3095 err = -ENOMEM; 3096 hci_conn_drop(conn); 3097 goto unlock; 3098 } 3099 3100 cmd->cmd_complete = pairing_complete; 3101 3102 /* For LE, just connecting isn't a proof that the pairing finished */ 3103 if (cp->addr.type == BDADDR_BREDR) { 3104 conn->connect_cfm_cb = pairing_complete_cb; 3105 conn->security_cfm_cb = pairing_complete_cb; 3106 conn->disconn_cfm_cb = pairing_complete_cb; 3107 } else { 3108 conn->connect_cfm_cb = le_pairing_complete_cb; 3109 conn->security_cfm_cb = le_pairing_complete_cb; 3110 conn->disconn_cfm_cb = le_pairing_complete_cb; 3111 } 3112 3113 conn->io_capability = cp->io_cap; 3114 cmd->user_data = hci_conn_get(conn); 3115 3116 if ((conn->state == BT_CONNECTED || conn->state == BT_CONFIG) && 3117 hci_conn_security(conn, sec_level, auth_type, true)) { 3118 cmd->cmd_complete(cmd, 0); 3119 mgmt_pending_remove(cmd); 3120 } 3121 3122 err = 0; 3123 3124 unlock: 3125 hci_dev_unlock(hdev); 3126 return err; 3127 } 3128 3129 static int cancel_pair_device(struct sock *sk, struct hci_dev *hdev, void *data, 3130 u16 len) 3131 { 3132 struct mgmt_addr_info *addr = data; 3133 struct mgmt_pending_cmd *cmd; 3134 struct hci_conn *conn; 3135 int err; 3136 3137 bt_dev_dbg(hdev, "sock %p", sk); 3138 3139 hci_dev_lock(hdev); 3140 3141 if (!hdev_is_powered(hdev)) { 3142 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE, 3143 MGMT_STATUS_NOT_POWERED); 3144 goto unlock; 3145 } 3146 3147 cmd = pending_find(MGMT_OP_PAIR_DEVICE, hdev); 3148 if (!cmd) { 3149 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE, 3150 MGMT_STATUS_INVALID_PARAMS); 3151 goto unlock; 3152 } 3153 3154 conn = cmd->user_data; 3155 3156 if (bacmp(&addr->bdaddr, &conn->dst) != 0) { 3157 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE, 3158 MGMT_STATUS_INVALID_PARAMS); 3159 goto unlock; 3160 } 3161 3162 cmd->cmd_complete(cmd, MGMT_STATUS_CANCELLED); 3163 mgmt_pending_remove(cmd); 3164 3165 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE, 0, 3166 addr, sizeof(*addr)); 3167 3168 /* Since user doesn't want to proceed with the connection, abort any 3169 * ongoing pairing and then terminate the link if it was created 3170 * because of the pair device action. 3171 */ 3172 if (addr->type == BDADDR_BREDR) 3173 hci_remove_link_key(hdev, &addr->bdaddr); 3174 else 3175 smp_cancel_and_remove_pairing(hdev, &addr->bdaddr, 3176 le_addr_type(addr->type)); 3177 3178 if (conn->conn_reason == CONN_REASON_PAIR_DEVICE) 3179 hci_abort_conn(conn, HCI_ERROR_REMOTE_USER_TERM); 3180 3181 unlock: 3182 hci_dev_unlock(hdev); 3183 return err; 3184 } 3185 3186 static int user_pairing_resp(struct sock *sk, struct hci_dev *hdev, 3187 struct mgmt_addr_info *addr, u16 mgmt_op, 3188 u16 hci_op, __le32 passkey) 3189 { 3190 struct mgmt_pending_cmd *cmd; 3191 struct hci_conn *conn; 3192 int err; 3193 3194 hci_dev_lock(hdev); 3195 3196 if (!hdev_is_powered(hdev)) { 3197 err = mgmt_cmd_complete(sk, hdev->id, mgmt_op, 3198 MGMT_STATUS_NOT_POWERED, addr, 3199 sizeof(*addr)); 3200 goto done; 3201 } 3202 3203 if (addr->type == BDADDR_BREDR) 3204 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &addr->bdaddr); 3205 else 3206 conn = hci_conn_hash_lookup_le(hdev, &addr->bdaddr, 3207 le_addr_type(addr->type)); 3208 3209 if (!conn) { 3210 err = mgmt_cmd_complete(sk, hdev->id, mgmt_op, 3211 MGMT_STATUS_NOT_CONNECTED, addr, 3212 sizeof(*addr)); 3213 goto done; 3214 } 3215 3216 if (addr->type == BDADDR_LE_PUBLIC || addr->type == BDADDR_LE_RANDOM) { 3217 err = smp_user_confirm_reply(conn, mgmt_op, passkey); 3218 if (!err) 3219 err = mgmt_cmd_complete(sk, hdev->id, mgmt_op, 3220 MGMT_STATUS_SUCCESS, addr, 3221 sizeof(*addr)); 3222 else 3223 err = mgmt_cmd_complete(sk, hdev->id, mgmt_op, 3224 MGMT_STATUS_FAILED, addr, 3225 sizeof(*addr)); 3226 3227 goto done; 3228 } 3229 3230 cmd = mgmt_pending_add(sk, mgmt_op, hdev, addr, sizeof(*addr)); 3231 if (!cmd) { 3232 err = -ENOMEM; 3233 goto done; 3234 } 3235 3236 cmd->cmd_complete = addr_cmd_complete; 3237 3238 /* Continue with pairing via HCI */ 3239 if (hci_op == HCI_OP_USER_PASSKEY_REPLY) { 3240 struct hci_cp_user_passkey_reply cp; 3241 3242 bacpy(&cp.bdaddr, &addr->bdaddr); 3243 cp.passkey = passkey; 3244 err = hci_send_cmd(hdev, hci_op, sizeof(cp), &cp); 3245 } else 3246 err = hci_send_cmd(hdev, hci_op, sizeof(addr->bdaddr), 3247 &addr->bdaddr); 3248 3249 if (err < 0) 3250 mgmt_pending_remove(cmd); 3251 3252 done: 3253 hci_dev_unlock(hdev); 3254 return err; 3255 } 3256 3257 static int pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev, 3258 void *data, u16 len) 3259 { 3260 struct mgmt_cp_pin_code_neg_reply *cp = data; 3261 3262 bt_dev_dbg(hdev, "sock %p", sk); 3263 3264 return user_pairing_resp(sk, hdev, &cp->addr, 3265 MGMT_OP_PIN_CODE_NEG_REPLY, 3266 HCI_OP_PIN_CODE_NEG_REPLY, 0); 3267 } 3268 3269 static int user_confirm_reply(struct sock *sk, struct hci_dev *hdev, void *data, 3270 u16 len) 3271 { 3272 struct mgmt_cp_user_confirm_reply *cp = data; 3273 3274 bt_dev_dbg(hdev, "sock %p", sk); 3275 3276 if (len != sizeof(*cp)) 3277 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_USER_CONFIRM_REPLY, 3278 MGMT_STATUS_INVALID_PARAMS); 3279 3280 return user_pairing_resp(sk, hdev, &cp->addr, 3281 MGMT_OP_USER_CONFIRM_REPLY, 3282 HCI_OP_USER_CONFIRM_REPLY, 0); 3283 } 3284 3285 static int user_confirm_neg_reply(struct sock *sk, struct hci_dev *hdev, 3286 void *data, u16 len) 3287 { 3288 struct mgmt_cp_user_confirm_neg_reply *cp = data; 3289 3290 bt_dev_dbg(hdev, "sock %p", sk); 3291 3292 return user_pairing_resp(sk, hdev, &cp->addr, 3293 MGMT_OP_USER_CONFIRM_NEG_REPLY, 3294 HCI_OP_USER_CONFIRM_NEG_REPLY, 0); 3295 } 3296 3297 static int user_passkey_reply(struct sock *sk, struct hci_dev *hdev, void *data, 3298 u16 len) 3299 { 3300 struct mgmt_cp_user_passkey_reply *cp = data; 3301 3302 bt_dev_dbg(hdev, "sock %p", sk); 3303 3304 return user_pairing_resp(sk, hdev, &cp->addr, 3305 MGMT_OP_USER_PASSKEY_REPLY, 3306 HCI_OP_USER_PASSKEY_REPLY, cp->passkey); 3307 } 3308 3309 static int user_passkey_neg_reply(struct sock *sk, struct hci_dev *hdev, 3310 void *data, u16 len) 3311 { 3312 struct mgmt_cp_user_passkey_neg_reply *cp = data; 3313 3314 bt_dev_dbg(hdev, "sock %p", sk); 3315 3316 return user_pairing_resp(sk, hdev, &cp->addr, 3317 MGMT_OP_USER_PASSKEY_NEG_REPLY, 3318 HCI_OP_USER_PASSKEY_NEG_REPLY, 0); 3319 } 3320 3321 static int adv_expire_sync(struct hci_dev *hdev, u32 flags) 3322 { 3323 struct adv_info *adv_instance; 3324 3325 adv_instance = hci_find_adv_instance(hdev, hdev->cur_adv_instance); 3326 if (!adv_instance) 3327 return 0; 3328 3329 /* stop if current instance doesn't need to be changed */ 3330 if (!(adv_instance->flags & flags)) 3331 return 0; 3332 3333 cancel_adv_timeout(hdev); 3334 3335 adv_instance = hci_get_next_instance(hdev, adv_instance->instance); 3336 if (!adv_instance) 3337 return 0; 3338 3339 hci_schedule_adv_instance_sync(hdev, adv_instance->instance, true); 3340 3341 return 0; 3342 } 3343 3344 static int name_changed_sync(struct hci_dev *hdev, void *data) 3345 { 3346 return adv_expire_sync(hdev, MGMT_ADV_FLAG_LOCAL_NAME); 3347 } 3348 3349 static void set_name_complete(struct hci_dev *hdev, void *data, int err) 3350 { 3351 struct mgmt_pending_cmd *cmd = data; 3352 struct mgmt_cp_set_local_name *cp = cmd->param; 3353 u8 status = mgmt_status(err); 3354 3355 bt_dev_dbg(hdev, "err %d", err); 3356 3357 if (cmd != pending_find(MGMT_OP_SET_LOCAL_NAME, hdev)) 3358 return; 3359 3360 if (status) { 3361 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 3362 status); 3363 } else { 3364 mgmt_cmd_complete(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0, 3365 cp, sizeof(*cp)); 3366 3367 if (hci_dev_test_flag(hdev, HCI_LE_ADV)) 3368 hci_cmd_sync_queue(hdev, name_changed_sync, NULL, NULL); 3369 } 3370 3371 mgmt_pending_remove(cmd); 3372 } 3373 3374 static int set_name_sync(struct hci_dev *hdev, void *data) 3375 { 3376 if (lmp_bredr_capable(hdev)) { 3377 hci_update_name_sync(hdev); 3378 hci_update_eir_sync(hdev); 3379 } 3380 3381 /* The name is stored in the scan response data and so 3382 * no need to update the advertising data here. 3383 */ 3384 if (lmp_le_capable(hdev) && hci_dev_test_flag(hdev, HCI_ADVERTISING)) 3385 hci_update_scan_rsp_data_sync(hdev, hdev->cur_adv_instance); 3386 3387 return 0; 3388 } 3389 3390 static int set_local_name(struct sock *sk, struct hci_dev *hdev, void *data, 3391 u16 len) 3392 { 3393 struct mgmt_cp_set_local_name *cp = data; 3394 struct mgmt_pending_cmd *cmd; 3395 int err; 3396 3397 bt_dev_dbg(hdev, "sock %p", sk); 3398 3399 hci_dev_lock(hdev); 3400 3401 /* If the old values are the same as the new ones just return a 3402 * direct command complete event. 3403 */ 3404 if (!memcmp(hdev->dev_name, cp->name, sizeof(hdev->dev_name)) && 3405 !memcmp(hdev->short_name, cp->short_name, 3406 sizeof(hdev->short_name))) { 3407 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0, 3408 data, len); 3409 goto failed; 3410 } 3411 3412 memcpy(hdev->short_name, cp->short_name, sizeof(hdev->short_name)); 3413 3414 if (!hdev_is_powered(hdev)) { 3415 memcpy(hdev->dev_name, cp->name, sizeof(hdev->dev_name)); 3416 3417 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0, 3418 data, len); 3419 if (err < 0) 3420 goto failed; 3421 3422 err = mgmt_limited_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, data, 3423 len, HCI_MGMT_LOCAL_NAME_EVENTS, sk); 3424 ext_info_changed(hdev, sk); 3425 3426 goto failed; 3427 } 3428 3429 cmd = mgmt_pending_add(sk, MGMT_OP_SET_LOCAL_NAME, hdev, data, len); 3430 if (!cmd) 3431 err = -ENOMEM; 3432 else 3433 err = hci_cmd_sync_queue(hdev, set_name_sync, cmd, 3434 set_name_complete); 3435 3436 if (err < 0) { 3437 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 3438 MGMT_STATUS_FAILED); 3439 3440 if (cmd) 3441 mgmt_pending_remove(cmd); 3442 3443 goto failed; 3444 } 3445 3446 memcpy(hdev->dev_name, cp->name, sizeof(hdev->dev_name)); 3447 3448 failed: 3449 hci_dev_unlock(hdev); 3450 return err; 3451 } 3452 3453 static int appearance_changed_sync(struct hci_dev *hdev, void *data) 3454 { 3455 return adv_expire_sync(hdev, MGMT_ADV_FLAG_APPEARANCE); 3456 } 3457 3458 static int set_appearance(struct sock *sk, struct hci_dev *hdev, void *data, 3459 u16 len) 3460 { 3461 struct mgmt_cp_set_appearance *cp = data; 3462 u16 appearance; 3463 int err; 3464 3465 bt_dev_dbg(hdev, "sock %p", sk); 3466 3467 if (!lmp_le_capable(hdev)) 3468 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_APPEARANCE, 3469 MGMT_STATUS_NOT_SUPPORTED); 3470 3471 appearance = le16_to_cpu(cp->appearance); 3472 3473 hci_dev_lock(hdev); 3474 3475 if (hdev->appearance != appearance) { 3476 hdev->appearance = appearance; 3477 3478 if (hci_dev_test_flag(hdev, HCI_LE_ADV)) 3479 hci_cmd_sync_queue(hdev, appearance_changed_sync, NULL, 3480 NULL); 3481 3482 ext_info_changed(hdev, sk); 3483 } 3484 3485 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_APPEARANCE, 0, NULL, 3486 0); 3487 3488 hci_dev_unlock(hdev); 3489 3490 return err; 3491 } 3492 3493 static int get_phy_configuration(struct sock *sk, struct hci_dev *hdev, 3494 void *data, u16 len) 3495 { 3496 struct mgmt_rp_get_phy_configuration rp; 3497 3498 bt_dev_dbg(hdev, "sock %p", sk); 3499 3500 hci_dev_lock(hdev); 3501 3502 memset(&rp, 0, sizeof(rp)); 3503 3504 rp.supported_phys = cpu_to_le32(get_supported_phys(hdev)); 3505 rp.selected_phys = cpu_to_le32(get_selected_phys(hdev)); 3506 rp.configurable_phys = cpu_to_le32(get_configurable_phys(hdev)); 3507 3508 hci_dev_unlock(hdev); 3509 3510 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_PHY_CONFIGURATION, 0, 3511 &rp, sizeof(rp)); 3512 } 3513 3514 int mgmt_phy_configuration_changed(struct hci_dev *hdev, struct sock *skip) 3515 { 3516 struct mgmt_ev_phy_configuration_changed ev; 3517 3518 memset(&ev, 0, sizeof(ev)); 3519 3520 ev.selected_phys = cpu_to_le32(get_selected_phys(hdev)); 3521 3522 return mgmt_event(MGMT_EV_PHY_CONFIGURATION_CHANGED, hdev, &ev, 3523 sizeof(ev), skip); 3524 } 3525 3526 static void set_default_phy_complete(struct hci_dev *hdev, void *data, int err) 3527 { 3528 struct mgmt_pending_cmd *cmd = data; 3529 struct sk_buff *skb = cmd->skb; 3530 u8 status = mgmt_status(err); 3531 3532 if (cmd != pending_find(MGMT_OP_SET_PHY_CONFIGURATION, hdev)) 3533 return; 3534 3535 if (!status) { 3536 if (!skb) 3537 status = MGMT_STATUS_FAILED; 3538 else if (IS_ERR(skb)) 3539 status = mgmt_status(PTR_ERR(skb)); 3540 else 3541 status = mgmt_status(skb->data[0]); 3542 } 3543 3544 bt_dev_dbg(hdev, "status %d", status); 3545 3546 if (status) { 3547 mgmt_cmd_status(cmd->sk, hdev->id, 3548 MGMT_OP_SET_PHY_CONFIGURATION, status); 3549 } else { 3550 mgmt_cmd_complete(cmd->sk, hdev->id, 3551 MGMT_OP_SET_PHY_CONFIGURATION, 0, 3552 NULL, 0); 3553 3554 mgmt_phy_configuration_changed(hdev, cmd->sk); 3555 } 3556 3557 if (skb && !IS_ERR(skb)) 3558 kfree_skb(skb); 3559 3560 mgmt_pending_remove(cmd); 3561 } 3562 3563 static int set_default_phy_sync(struct hci_dev *hdev, void *data) 3564 { 3565 struct mgmt_pending_cmd *cmd = data; 3566 struct mgmt_cp_set_phy_configuration *cp = cmd->param; 3567 struct hci_cp_le_set_default_phy cp_phy; 3568 u32 selected_phys = __le32_to_cpu(cp->selected_phys); 3569 3570 memset(&cp_phy, 0, sizeof(cp_phy)); 3571 3572 if (!(selected_phys & MGMT_PHY_LE_TX_MASK)) 3573 cp_phy.all_phys |= 0x01; 3574 3575 if (!(selected_phys & MGMT_PHY_LE_RX_MASK)) 3576 cp_phy.all_phys |= 0x02; 3577 3578 if (selected_phys & MGMT_PHY_LE_1M_TX) 3579 cp_phy.tx_phys |= HCI_LE_SET_PHY_1M; 3580 3581 if (selected_phys & MGMT_PHY_LE_2M_TX) 3582 cp_phy.tx_phys |= HCI_LE_SET_PHY_2M; 3583 3584 if (selected_phys & MGMT_PHY_LE_CODED_TX) 3585 cp_phy.tx_phys |= HCI_LE_SET_PHY_CODED; 3586 3587 if (selected_phys & MGMT_PHY_LE_1M_RX) 3588 cp_phy.rx_phys |= HCI_LE_SET_PHY_1M; 3589 3590 if (selected_phys & MGMT_PHY_LE_2M_RX) 3591 cp_phy.rx_phys |= HCI_LE_SET_PHY_2M; 3592 3593 if (selected_phys & MGMT_PHY_LE_CODED_RX) 3594 cp_phy.rx_phys |= HCI_LE_SET_PHY_CODED; 3595 3596 cmd->skb = __hci_cmd_sync(hdev, HCI_OP_LE_SET_DEFAULT_PHY, 3597 sizeof(cp_phy), &cp_phy, HCI_CMD_TIMEOUT); 3598 3599 return 0; 3600 } 3601 3602 static int set_phy_configuration(struct sock *sk, struct hci_dev *hdev, 3603 void *data, u16 len) 3604 { 3605 struct mgmt_cp_set_phy_configuration *cp = data; 3606 struct mgmt_pending_cmd *cmd; 3607 u32 selected_phys, configurable_phys, supported_phys, unconfigure_phys; 3608 u16 pkt_type = (HCI_DH1 | HCI_DM1); 3609 bool changed = false; 3610 int err; 3611 3612 bt_dev_dbg(hdev, "sock %p", sk); 3613 3614 configurable_phys = get_configurable_phys(hdev); 3615 supported_phys = get_supported_phys(hdev); 3616 selected_phys = __le32_to_cpu(cp->selected_phys); 3617 3618 if (selected_phys & ~supported_phys) 3619 return mgmt_cmd_status(sk, hdev->id, 3620 MGMT_OP_SET_PHY_CONFIGURATION, 3621 MGMT_STATUS_INVALID_PARAMS); 3622 3623 unconfigure_phys = supported_phys & ~configurable_phys; 3624 3625 if ((selected_phys & unconfigure_phys) != unconfigure_phys) 3626 return mgmt_cmd_status(sk, hdev->id, 3627 MGMT_OP_SET_PHY_CONFIGURATION, 3628 MGMT_STATUS_INVALID_PARAMS); 3629 3630 if (selected_phys == get_selected_phys(hdev)) 3631 return mgmt_cmd_complete(sk, hdev->id, 3632 MGMT_OP_SET_PHY_CONFIGURATION, 3633 0, NULL, 0); 3634 3635 hci_dev_lock(hdev); 3636 3637 if (!hdev_is_powered(hdev)) { 3638 err = mgmt_cmd_status(sk, hdev->id, 3639 MGMT_OP_SET_PHY_CONFIGURATION, 3640 MGMT_STATUS_REJECTED); 3641 goto unlock; 3642 } 3643 3644 if (pending_find(MGMT_OP_SET_PHY_CONFIGURATION, hdev)) { 3645 err = mgmt_cmd_status(sk, hdev->id, 3646 MGMT_OP_SET_PHY_CONFIGURATION, 3647 MGMT_STATUS_BUSY); 3648 goto unlock; 3649 } 3650 3651 if (selected_phys & MGMT_PHY_BR_1M_3SLOT) 3652 pkt_type |= (HCI_DH3 | HCI_DM3); 3653 else 3654 pkt_type &= ~(HCI_DH3 | HCI_DM3); 3655 3656 if (selected_phys & MGMT_PHY_BR_1M_5SLOT) 3657 pkt_type |= (HCI_DH5 | HCI_DM5); 3658 else 3659 pkt_type &= ~(HCI_DH5 | HCI_DM5); 3660 3661 if (selected_phys & MGMT_PHY_EDR_2M_1SLOT) 3662 pkt_type &= ~HCI_2DH1; 3663 else 3664 pkt_type |= HCI_2DH1; 3665 3666 if (selected_phys & MGMT_PHY_EDR_2M_3SLOT) 3667 pkt_type &= ~HCI_2DH3; 3668 else 3669 pkt_type |= HCI_2DH3; 3670 3671 if (selected_phys & MGMT_PHY_EDR_2M_5SLOT) 3672 pkt_type &= ~HCI_2DH5; 3673 else 3674 pkt_type |= HCI_2DH5; 3675 3676 if (selected_phys & MGMT_PHY_EDR_3M_1SLOT) 3677 pkt_type &= ~HCI_3DH1; 3678 else 3679 pkt_type |= HCI_3DH1; 3680 3681 if (selected_phys & MGMT_PHY_EDR_3M_3SLOT) 3682 pkt_type &= ~HCI_3DH3; 3683 else 3684 pkt_type |= HCI_3DH3; 3685 3686 if (selected_phys & MGMT_PHY_EDR_3M_5SLOT) 3687 pkt_type &= ~HCI_3DH5; 3688 else 3689 pkt_type |= HCI_3DH5; 3690 3691 if (pkt_type != hdev->pkt_type) { 3692 hdev->pkt_type = pkt_type; 3693 changed = true; 3694 } 3695 3696 if ((selected_phys & MGMT_PHY_LE_MASK) == 3697 (get_selected_phys(hdev) & MGMT_PHY_LE_MASK)) { 3698 if (changed) 3699 mgmt_phy_configuration_changed(hdev, sk); 3700 3701 err = mgmt_cmd_complete(sk, hdev->id, 3702 MGMT_OP_SET_PHY_CONFIGURATION, 3703 0, NULL, 0); 3704 3705 goto unlock; 3706 } 3707 3708 cmd = mgmt_pending_add(sk, MGMT_OP_SET_PHY_CONFIGURATION, hdev, data, 3709 len); 3710 if (!cmd) 3711 err = -ENOMEM; 3712 else 3713 err = hci_cmd_sync_queue(hdev, set_default_phy_sync, cmd, 3714 set_default_phy_complete); 3715 3716 if (err < 0) { 3717 err = mgmt_cmd_status(sk, hdev->id, 3718 MGMT_OP_SET_PHY_CONFIGURATION, 3719 MGMT_STATUS_FAILED); 3720 3721 if (cmd) 3722 mgmt_pending_remove(cmd); 3723 } 3724 3725 unlock: 3726 hci_dev_unlock(hdev); 3727 3728 return err; 3729 } 3730 3731 static int set_blocked_keys(struct sock *sk, struct hci_dev *hdev, void *data, 3732 u16 len) 3733 { 3734 int err = MGMT_STATUS_SUCCESS; 3735 struct mgmt_cp_set_blocked_keys *keys = data; 3736 const u16 max_key_count = ((U16_MAX - sizeof(*keys)) / 3737 sizeof(struct mgmt_blocked_key_info)); 3738 u16 key_count, expected_len; 3739 int i; 3740 3741 bt_dev_dbg(hdev, "sock %p", sk); 3742 3743 key_count = __le16_to_cpu(keys->key_count); 3744 if (key_count > max_key_count) { 3745 bt_dev_err(hdev, "too big key_count value %u", key_count); 3746 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BLOCKED_KEYS, 3747 MGMT_STATUS_INVALID_PARAMS); 3748 } 3749 3750 expected_len = struct_size(keys, keys, key_count); 3751 if (expected_len != len) { 3752 bt_dev_err(hdev, "expected %u bytes, got %u bytes", 3753 expected_len, len); 3754 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BLOCKED_KEYS, 3755 MGMT_STATUS_INVALID_PARAMS); 3756 } 3757 3758 hci_dev_lock(hdev); 3759 3760 hci_blocked_keys_clear(hdev); 3761 3762 for (i = 0; i < keys->key_count; ++i) { 3763 struct blocked_key *b = kzalloc(sizeof(*b), GFP_KERNEL); 3764 3765 if (!b) { 3766 err = MGMT_STATUS_NO_RESOURCES; 3767 break; 3768 } 3769 3770 b->type = keys->keys[i].type; 3771 memcpy(b->val, keys->keys[i].val, sizeof(b->val)); 3772 list_add_rcu(&b->list, &hdev->blocked_keys); 3773 } 3774 hci_dev_unlock(hdev); 3775 3776 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_BLOCKED_KEYS, 3777 err, NULL, 0); 3778 } 3779 3780 static int set_wideband_speech(struct sock *sk, struct hci_dev *hdev, 3781 void *data, u16 len) 3782 { 3783 struct mgmt_mode *cp = data; 3784 int err; 3785 bool changed = false; 3786 3787 bt_dev_dbg(hdev, "sock %p", sk); 3788 3789 if (!test_bit(HCI_QUIRK_WIDEBAND_SPEECH_SUPPORTED, &hdev->quirks)) 3790 return mgmt_cmd_status(sk, hdev->id, 3791 MGMT_OP_SET_WIDEBAND_SPEECH, 3792 MGMT_STATUS_NOT_SUPPORTED); 3793 3794 if (cp->val != 0x00 && cp->val != 0x01) 3795 return mgmt_cmd_status(sk, hdev->id, 3796 MGMT_OP_SET_WIDEBAND_SPEECH, 3797 MGMT_STATUS_INVALID_PARAMS); 3798 3799 hci_dev_lock(hdev); 3800 3801 if (hdev_is_powered(hdev) && 3802 !!cp->val != hci_dev_test_flag(hdev, 3803 HCI_WIDEBAND_SPEECH_ENABLED)) { 3804 err = mgmt_cmd_status(sk, hdev->id, 3805 MGMT_OP_SET_WIDEBAND_SPEECH, 3806 MGMT_STATUS_REJECTED); 3807 goto unlock; 3808 } 3809 3810 if (cp->val) 3811 changed = !hci_dev_test_and_set_flag(hdev, 3812 HCI_WIDEBAND_SPEECH_ENABLED); 3813 else 3814 changed = hci_dev_test_and_clear_flag(hdev, 3815 HCI_WIDEBAND_SPEECH_ENABLED); 3816 3817 err = send_settings_rsp(sk, MGMT_OP_SET_WIDEBAND_SPEECH, hdev); 3818 if (err < 0) 3819 goto unlock; 3820 3821 if (changed) 3822 err = new_settings(hdev, sk); 3823 3824 unlock: 3825 hci_dev_unlock(hdev); 3826 return err; 3827 } 3828 3829 static int read_controller_cap(struct sock *sk, struct hci_dev *hdev, 3830 void *data, u16 data_len) 3831 { 3832 char buf[20]; 3833 struct mgmt_rp_read_controller_cap *rp = (void *)buf; 3834 u16 cap_len = 0; 3835 u8 flags = 0; 3836 u8 tx_power_range[2]; 3837 3838 bt_dev_dbg(hdev, "sock %p", sk); 3839 3840 memset(&buf, 0, sizeof(buf)); 3841 3842 hci_dev_lock(hdev); 3843 3844 /* When the Read Simple Pairing Options command is supported, then 3845 * the remote public key validation is supported. 3846 * 3847 * Alternatively, when Microsoft extensions are available, they can 3848 * indicate support for public key validation as well. 3849 */ 3850 if ((hdev->commands[41] & 0x08) || msft_curve_validity(hdev)) 3851 flags |= 0x01; /* Remote public key validation (BR/EDR) */ 3852 3853 flags |= 0x02; /* Remote public key validation (LE) */ 3854 3855 /* When the Read Encryption Key Size command is supported, then the 3856 * encryption key size is enforced. 3857 */ 3858 if (hdev->commands[20] & 0x10) 3859 flags |= 0x04; /* Encryption key size enforcement (BR/EDR) */ 3860 3861 flags |= 0x08; /* Encryption key size enforcement (LE) */ 3862 3863 cap_len = eir_append_data(rp->cap, cap_len, MGMT_CAP_SEC_FLAGS, 3864 &flags, 1); 3865 3866 /* When the Read Simple Pairing Options command is supported, then 3867 * also max encryption key size information is provided. 3868 */ 3869 if (hdev->commands[41] & 0x08) 3870 cap_len = eir_append_le16(rp->cap, cap_len, 3871 MGMT_CAP_MAX_ENC_KEY_SIZE, 3872 hdev->max_enc_key_size); 3873 3874 cap_len = eir_append_le16(rp->cap, cap_len, 3875 MGMT_CAP_SMP_MAX_ENC_KEY_SIZE, 3876 SMP_MAX_ENC_KEY_SIZE); 3877 3878 /* Append the min/max LE tx power parameters if we were able to fetch 3879 * it from the controller 3880 */ 3881 if (hdev->commands[38] & 0x80) { 3882 memcpy(&tx_power_range[0], &hdev->min_le_tx_power, 1); 3883 memcpy(&tx_power_range[1], &hdev->max_le_tx_power, 1); 3884 cap_len = eir_append_data(rp->cap, cap_len, MGMT_CAP_LE_TX_PWR, 3885 tx_power_range, 2); 3886 } 3887 3888 rp->cap_len = cpu_to_le16(cap_len); 3889 3890 hci_dev_unlock(hdev); 3891 3892 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_CONTROLLER_CAP, 0, 3893 rp, sizeof(*rp) + cap_len); 3894 } 3895 3896 #ifdef CONFIG_BT_FEATURE_DEBUG 3897 /* d4992530-b9ec-469f-ab01-6c481c47da1c */ 3898 static const u8 debug_uuid[16] = { 3899 0x1c, 0xda, 0x47, 0x1c, 0x48, 0x6c, 0x01, 0xab, 3900 0x9f, 0x46, 0xec, 0xb9, 0x30, 0x25, 0x99, 0xd4, 3901 }; 3902 #endif 3903 3904 /* 330859bc-7506-492d-9370-9a6f0614037f */ 3905 static const u8 quality_report_uuid[16] = { 3906 0x7f, 0x03, 0x14, 0x06, 0x6f, 0x9a, 0x70, 0x93, 3907 0x2d, 0x49, 0x06, 0x75, 0xbc, 0x59, 0x08, 0x33, 3908 }; 3909 3910 /* a6695ace-ee7f-4fb9-881a-5fac66c629af */ 3911 static const u8 offload_codecs_uuid[16] = { 3912 0xaf, 0x29, 0xc6, 0x66, 0xac, 0x5f, 0x1a, 0x88, 3913 0xb9, 0x4f, 0x7f, 0xee, 0xce, 0x5a, 0x69, 0xa6, 3914 }; 3915 3916 /* 671b10b5-42c0-4696-9227-eb28d1b049d6 */ 3917 static const u8 le_simultaneous_roles_uuid[16] = { 3918 0xd6, 0x49, 0xb0, 0xd1, 0x28, 0xeb, 0x27, 0x92, 3919 0x96, 0x46, 0xc0, 0x42, 0xb5, 0x10, 0x1b, 0x67, 3920 }; 3921 3922 /* 15c0a148-c273-11ea-b3de-0242ac130004 */ 3923 static const u8 rpa_resolution_uuid[16] = { 3924 0x04, 0x00, 0x13, 0xac, 0x42, 0x02, 0xde, 0xb3, 3925 0xea, 0x11, 0x73, 0xc2, 0x48, 0xa1, 0xc0, 0x15, 3926 }; 3927 3928 static int read_exp_features_info(struct sock *sk, struct hci_dev *hdev, 3929 void *data, u16 data_len) 3930 { 3931 char buf[102]; /* Enough space for 5 features: 2 + 20 * 5 */ 3932 struct mgmt_rp_read_exp_features_info *rp = (void *)buf; 3933 u16 idx = 0; 3934 u32 flags; 3935 3936 bt_dev_dbg(hdev, "sock %p", sk); 3937 3938 memset(&buf, 0, sizeof(buf)); 3939 3940 #ifdef CONFIG_BT_FEATURE_DEBUG 3941 if (!hdev) { 3942 flags = bt_dbg_get() ? BIT(0) : 0; 3943 3944 memcpy(rp->features[idx].uuid, debug_uuid, 16); 3945 rp->features[idx].flags = cpu_to_le32(flags); 3946 idx++; 3947 } 3948 #endif 3949 3950 if (hdev && hci_dev_le_state_simultaneous(hdev)) { 3951 if (hci_dev_test_flag(hdev, HCI_LE_SIMULTANEOUS_ROLES)) 3952 flags = BIT(0); 3953 else 3954 flags = 0; 3955 3956 memcpy(rp->features[idx].uuid, le_simultaneous_roles_uuid, 16); 3957 rp->features[idx].flags = cpu_to_le32(flags); 3958 idx++; 3959 } 3960 3961 if (hdev && ll_privacy_capable(hdev)) { 3962 if (hci_dev_test_flag(hdev, HCI_ENABLE_LL_PRIVACY)) 3963 flags = BIT(0) | BIT(1); 3964 else 3965 flags = BIT(1); 3966 3967 memcpy(rp->features[idx].uuid, rpa_resolution_uuid, 16); 3968 rp->features[idx].flags = cpu_to_le32(flags); 3969 idx++; 3970 } 3971 3972 if (hdev && (aosp_has_quality_report(hdev) || 3973 hdev->set_quality_report)) { 3974 if (hci_dev_test_flag(hdev, HCI_QUALITY_REPORT)) 3975 flags = BIT(0); 3976 else 3977 flags = 0; 3978 3979 memcpy(rp->features[idx].uuid, quality_report_uuid, 16); 3980 rp->features[idx].flags = cpu_to_le32(flags); 3981 idx++; 3982 } 3983 3984 if (hdev && hdev->get_data_path_id) { 3985 if (hci_dev_test_flag(hdev, HCI_OFFLOAD_CODECS_ENABLED)) 3986 flags = BIT(0); 3987 else 3988 flags = 0; 3989 3990 memcpy(rp->features[idx].uuid, offload_codecs_uuid, 16); 3991 rp->features[idx].flags = cpu_to_le32(flags); 3992 idx++; 3993 } 3994 3995 rp->feature_count = cpu_to_le16(idx); 3996 3997 /* After reading the experimental features information, enable 3998 * the events to update client on any future change. 3999 */ 4000 hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS); 4001 4002 return mgmt_cmd_complete(sk, hdev ? hdev->id : MGMT_INDEX_NONE, 4003 MGMT_OP_READ_EXP_FEATURES_INFO, 4004 0, rp, sizeof(*rp) + (20 * idx)); 4005 } 4006 4007 static int exp_ll_privacy_feature_changed(bool enabled, struct hci_dev *hdev, 4008 struct sock *skip) 4009 { 4010 struct mgmt_ev_exp_feature_changed ev; 4011 4012 memset(&ev, 0, sizeof(ev)); 4013 memcpy(ev.uuid, rpa_resolution_uuid, 16); 4014 ev.flags = cpu_to_le32((enabled ? BIT(0) : 0) | BIT(1)); 4015 4016 if (enabled && privacy_mode_capable(hdev)) 4017 set_bit(HCI_CONN_FLAG_DEVICE_PRIVACY, hdev->conn_flags); 4018 else 4019 clear_bit(HCI_CONN_FLAG_DEVICE_PRIVACY, hdev->conn_flags); 4020 4021 return mgmt_limited_event(MGMT_EV_EXP_FEATURE_CHANGED, hdev, 4022 &ev, sizeof(ev), 4023 HCI_MGMT_EXP_FEATURE_EVENTS, skip); 4024 4025 } 4026 4027 static int exp_feature_changed(struct hci_dev *hdev, const u8 *uuid, 4028 bool enabled, struct sock *skip) 4029 { 4030 struct mgmt_ev_exp_feature_changed ev; 4031 4032 memset(&ev, 0, sizeof(ev)); 4033 memcpy(ev.uuid, uuid, 16); 4034 ev.flags = cpu_to_le32(enabled ? BIT(0) : 0); 4035 4036 return mgmt_limited_event(MGMT_EV_EXP_FEATURE_CHANGED, hdev, 4037 &ev, sizeof(ev), 4038 HCI_MGMT_EXP_FEATURE_EVENTS, skip); 4039 } 4040 4041 #define EXP_FEAT(_uuid, _set_func) \ 4042 { \ 4043 .uuid = _uuid, \ 4044 .set_func = _set_func, \ 4045 } 4046 4047 /* The zero key uuid is special. Multiple exp features are set through it. */ 4048 static int set_zero_key_func(struct sock *sk, struct hci_dev *hdev, 4049 struct mgmt_cp_set_exp_feature *cp, u16 data_len) 4050 { 4051 struct mgmt_rp_set_exp_feature rp; 4052 4053 memset(rp.uuid, 0, 16); 4054 rp.flags = cpu_to_le32(0); 4055 4056 #ifdef CONFIG_BT_FEATURE_DEBUG 4057 if (!hdev) { 4058 bool changed = bt_dbg_get(); 4059 4060 bt_dbg_set(false); 4061 4062 if (changed) 4063 exp_feature_changed(NULL, ZERO_KEY, false, sk); 4064 } 4065 #endif 4066 4067 if (hdev && use_ll_privacy(hdev) && !hdev_is_powered(hdev)) { 4068 bool changed; 4069 4070 changed = hci_dev_test_and_clear_flag(hdev, 4071 HCI_ENABLE_LL_PRIVACY); 4072 if (changed) 4073 exp_feature_changed(hdev, rpa_resolution_uuid, false, 4074 sk); 4075 } 4076 4077 hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS); 4078 4079 return mgmt_cmd_complete(sk, hdev ? hdev->id : MGMT_INDEX_NONE, 4080 MGMT_OP_SET_EXP_FEATURE, 0, 4081 &rp, sizeof(rp)); 4082 } 4083 4084 #ifdef CONFIG_BT_FEATURE_DEBUG 4085 static int set_debug_func(struct sock *sk, struct hci_dev *hdev, 4086 struct mgmt_cp_set_exp_feature *cp, u16 data_len) 4087 { 4088 struct mgmt_rp_set_exp_feature rp; 4089 4090 bool val, changed; 4091 int err; 4092 4093 /* Command requires to use the non-controller index */ 4094 if (hdev) 4095 return mgmt_cmd_status(sk, hdev->id, 4096 MGMT_OP_SET_EXP_FEATURE, 4097 MGMT_STATUS_INVALID_INDEX); 4098 4099 /* Parameters are limited to a single octet */ 4100 if (data_len != MGMT_SET_EXP_FEATURE_SIZE + 1) 4101 return mgmt_cmd_status(sk, MGMT_INDEX_NONE, 4102 MGMT_OP_SET_EXP_FEATURE, 4103 MGMT_STATUS_INVALID_PARAMS); 4104 4105 /* Only boolean on/off is supported */ 4106 if (cp->param[0] != 0x00 && cp->param[0] != 0x01) 4107 return mgmt_cmd_status(sk, MGMT_INDEX_NONE, 4108 MGMT_OP_SET_EXP_FEATURE, 4109 MGMT_STATUS_INVALID_PARAMS); 4110 4111 val = !!cp->param[0]; 4112 changed = val ? !bt_dbg_get() : bt_dbg_get(); 4113 bt_dbg_set(val); 4114 4115 memcpy(rp.uuid, debug_uuid, 16); 4116 rp.flags = cpu_to_le32(val ? BIT(0) : 0); 4117 4118 hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS); 4119 4120 err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE, 4121 MGMT_OP_SET_EXP_FEATURE, 0, 4122 &rp, sizeof(rp)); 4123 4124 if (changed) 4125 exp_feature_changed(hdev, debug_uuid, val, sk); 4126 4127 return err; 4128 } 4129 #endif 4130 4131 static int set_rpa_resolution_func(struct sock *sk, struct hci_dev *hdev, 4132 struct mgmt_cp_set_exp_feature *cp, 4133 u16 data_len) 4134 { 4135 struct mgmt_rp_set_exp_feature rp; 4136 bool val, changed; 4137 int err; 4138 u32 flags; 4139 4140 /* Command requires to use the controller index */ 4141 if (!hdev) 4142 return mgmt_cmd_status(sk, MGMT_INDEX_NONE, 4143 MGMT_OP_SET_EXP_FEATURE, 4144 MGMT_STATUS_INVALID_INDEX); 4145 4146 /* Changes can only be made when controller is powered down */ 4147 if (hdev_is_powered(hdev)) 4148 return mgmt_cmd_status(sk, hdev->id, 4149 MGMT_OP_SET_EXP_FEATURE, 4150 MGMT_STATUS_REJECTED); 4151 4152 /* Parameters are limited to a single octet */ 4153 if (data_len != MGMT_SET_EXP_FEATURE_SIZE + 1) 4154 return mgmt_cmd_status(sk, hdev->id, 4155 MGMT_OP_SET_EXP_FEATURE, 4156 MGMT_STATUS_INVALID_PARAMS); 4157 4158 /* Only boolean on/off is supported */ 4159 if (cp->param[0] != 0x00 && cp->param[0] != 0x01) 4160 return mgmt_cmd_status(sk, hdev->id, 4161 MGMT_OP_SET_EXP_FEATURE, 4162 MGMT_STATUS_INVALID_PARAMS); 4163 4164 val = !!cp->param[0]; 4165 4166 if (val) { 4167 changed = !hci_dev_test_and_set_flag(hdev, 4168 HCI_ENABLE_LL_PRIVACY); 4169 hci_dev_clear_flag(hdev, HCI_ADVERTISING); 4170 4171 /* Enable LL privacy + supported settings changed */ 4172 flags = BIT(0) | BIT(1); 4173 } else { 4174 changed = hci_dev_test_and_clear_flag(hdev, 4175 HCI_ENABLE_LL_PRIVACY); 4176 4177 /* Disable LL privacy + supported settings changed */ 4178 flags = BIT(1); 4179 } 4180 4181 memcpy(rp.uuid, rpa_resolution_uuid, 16); 4182 rp.flags = cpu_to_le32(flags); 4183 4184 hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS); 4185 4186 err = mgmt_cmd_complete(sk, hdev->id, 4187 MGMT_OP_SET_EXP_FEATURE, 0, 4188 &rp, sizeof(rp)); 4189 4190 if (changed) 4191 exp_ll_privacy_feature_changed(val, hdev, sk); 4192 4193 return err; 4194 } 4195 4196 static int set_quality_report_func(struct sock *sk, struct hci_dev *hdev, 4197 struct mgmt_cp_set_exp_feature *cp, 4198 u16 data_len) 4199 { 4200 struct mgmt_rp_set_exp_feature rp; 4201 bool val, changed; 4202 int err; 4203 4204 /* Command requires to use a valid controller index */ 4205 if (!hdev) 4206 return mgmt_cmd_status(sk, MGMT_INDEX_NONE, 4207 MGMT_OP_SET_EXP_FEATURE, 4208 MGMT_STATUS_INVALID_INDEX); 4209 4210 /* Parameters are limited to a single octet */ 4211 if (data_len != MGMT_SET_EXP_FEATURE_SIZE + 1) 4212 return mgmt_cmd_status(sk, hdev->id, 4213 MGMT_OP_SET_EXP_FEATURE, 4214 MGMT_STATUS_INVALID_PARAMS); 4215 4216 /* Only boolean on/off is supported */ 4217 if (cp->param[0] != 0x00 && cp->param[0] != 0x01) 4218 return mgmt_cmd_status(sk, hdev->id, 4219 MGMT_OP_SET_EXP_FEATURE, 4220 MGMT_STATUS_INVALID_PARAMS); 4221 4222 hci_req_sync_lock(hdev); 4223 4224 val = !!cp->param[0]; 4225 changed = (val != hci_dev_test_flag(hdev, HCI_QUALITY_REPORT)); 4226 4227 if (!aosp_has_quality_report(hdev) && !hdev->set_quality_report) { 4228 err = mgmt_cmd_status(sk, hdev->id, 4229 MGMT_OP_SET_EXP_FEATURE, 4230 MGMT_STATUS_NOT_SUPPORTED); 4231 goto unlock_quality_report; 4232 } 4233 4234 if (changed) { 4235 if (hdev->set_quality_report) 4236 err = hdev->set_quality_report(hdev, val); 4237 else 4238 err = aosp_set_quality_report(hdev, val); 4239 4240 if (err) { 4241 err = mgmt_cmd_status(sk, hdev->id, 4242 MGMT_OP_SET_EXP_FEATURE, 4243 MGMT_STATUS_FAILED); 4244 goto unlock_quality_report; 4245 } 4246 4247 if (val) 4248 hci_dev_set_flag(hdev, HCI_QUALITY_REPORT); 4249 else 4250 hci_dev_clear_flag(hdev, HCI_QUALITY_REPORT); 4251 } 4252 4253 bt_dev_dbg(hdev, "quality report enable %d changed %d", val, changed); 4254 4255 memcpy(rp.uuid, quality_report_uuid, 16); 4256 rp.flags = cpu_to_le32(val ? BIT(0) : 0); 4257 hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS); 4258 4259 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_EXP_FEATURE, 0, 4260 &rp, sizeof(rp)); 4261 4262 if (changed) 4263 exp_feature_changed(hdev, quality_report_uuid, val, sk); 4264 4265 unlock_quality_report: 4266 hci_req_sync_unlock(hdev); 4267 return err; 4268 } 4269 4270 static int set_offload_codec_func(struct sock *sk, struct hci_dev *hdev, 4271 struct mgmt_cp_set_exp_feature *cp, 4272 u16 data_len) 4273 { 4274 bool val, changed; 4275 int err; 4276 struct mgmt_rp_set_exp_feature rp; 4277 4278 /* Command requires to use a valid controller index */ 4279 if (!hdev) 4280 return mgmt_cmd_status(sk, MGMT_INDEX_NONE, 4281 MGMT_OP_SET_EXP_FEATURE, 4282 MGMT_STATUS_INVALID_INDEX); 4283 4284 /* Parameters are limited to a single octet */ 4285 if (data_len != MGMT_SET_EXP_FEATURE_SIZE + 1) 4286 return mgmt_cmd_status(sk, hdev->id, 4287 MGMT_OP_SET_EXP_FEATURE, 4288 MGMT_STATUS_INVALID_PARAMS); 4289 4290 /* Only boolean on/off is supported */ 4291 if (cp->param[0] != 0x00 && cp->param[0] != 0x01) 4292 return mgmt_cmd_status(sk, hdev->id, 4293 MGMT_OP_SET_EXP_FEATURE, 4294 MGMT_STATUS_INVALID_PARAMS); 4295 4296 val = !!cp->param[0]; 4297 changed = (val != hci_dev_test_flag(hdev, HCI_OFFLOAD_CODECS_ENABLED)); 4298 4299 if (!hdev->get_data_path_id) { 4300 return mgmt_cmd_status(sk, hdev->id, 4301 MGMT_OP_SET_EXP_FEATURE, 4302 MGMT_STATUS_NOT_SUPPORTED); 4303 } 4304 4305 if (changed) { 4306 if (val) 4307 hci_dev_set_flag(hdev, HCI_OFFLOAD_CODECS_ENABLED); 4308 else 4309 hci_dev_clear_flag(hdev, HCI_OFFLOAD_CODECS_ENABLED); 4310 } 4311 4312 bt_dev_info(hdev, "offload codecs enable %d changed %d", 4313 val, changed); 4314 4315 memcpy(rp.uuid, offload_codecs_uuid, 16); 4316 rp.flags = cpu_to_le32(val ? BIT(0) : 0); 4317 hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS); 4318 err = mgmt_cmd_complete(sk, hdev->id, 4319 MGMT_OP_SET_EXP_FEATURE, 0, 4320 &rp, sizeof(rp)); 4321 4322 if (changed) 4323 exp_feature_changed(hdev, offload_codecs_uuid, val, sk); 4324 4325 return err; 4326 } 4327 4328 static int set_le_simultaneous_roles_func(struct sock *sk, struct hci_dev *hdev, 4329 struct mgmt_cp_set_exp_feature *cp, 4330 u16 data_len) 4331 { 4332 bool val, changed; 4333 int err; 4334 struct mgmt_rp_set_exp_feature rp; 4335 4336 /* Command requires to use a valid controller index */ 4337 if (!hdev) 4338 return mgmt_cmd_status(sk, MGMT_INDEX_NONE, 4339 MGMT_OP_SET_EXP_FEATURE, 4340 MGMT_STATUS_INVALID_INDEX); 4341 4342 /* Parameters are limited to a single octet */ 4343 if (data_len != MGMT_SET_EXP_FEATURE_SIZE + 1) 4344 return mgmt_cmd_status(sk, hdev->id, 4345 MGMT_OP_SET_EXP_FEATURE, 4346 MGMT_STATUS_INVALID_PARAMS); 4347 4348 /* Only boolean on/off is supported */ 4349 if (cp->param[0] != 0x00 && cp->param[0] != 0x01) 4350 return mgmt_cmd_status(sk, hdev->id, 4351 MGMT_OP_SET_EXP_FEATURE, 4352 MGMT_STATUS_INVALID_PARAMS); 4353 4354 val = !!cp->param[0]; 4355 changed = (val != hci_dev_test_flag(hdev, HCI_LE_SIMULTANEOUS_ROLES)); 4356 4357 if (!hci_dev_le_state_simultaneous(hdev)) { 4358 return mgmt_cmd_status(sk, hdev->id, 4359 MGMT_OP_SET_EXP_FEATURE, 4360 MGMT_STATUS_NOT_SUPPORTED); 4361 } 4362 4363 if (changed) { 4364 if (val) 4365 hci_dev_set_flag(hdev, HCI_LE_SIMULTANEOUS_ROLES); 4366 else 4367 hci_dev_clear_flag(hdev, HCI_LE_SIMULTANEOUS_ROLES); 4368 } 4369 4370 bt_dev_info(hdev, "LE simultaneous roles enable %d changed %d", 4371 val, changed); 4372 4373 memcpy(rp.uuid, le_simultaneous_roles_uuid, 16); 4374 rp.flags = cpu_to_le32(val ? BIT(0) : 0); 4375 hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS); 4376 err = mgmt_cmd_complete(sk, hdev->id, 4377 MGMT_OP_SET_EXP_FEATURE, 0, 4378 &rp, sizeof(rp)); 4379 4380 if (changed) 4381 exp_feature_changed(hdev, le_simultaneous_roles_uuid, val, sk); 4382 4383 return err; 4384 } 4385 4386 static const struct mgmt_exp_feature { 4387 const u8 *uuid; 4388 int (*set_func)(struct sock *sk, struct hci_dev *hdev, 4389 struct mgmt_cp_set_exp_feature *cp, u16 data_len); 4390 } exp_features[] = { 4391 EXP_FEAT(ZERO_KEY, set_zero_key_func), 4392 #ifdef CONFIG_BT_FEATURE_DEBUG 4393 EXP_FEAT(debug_uuid, set_debug_func), 4394 #endif 4395 EXP_FEAT(rpa_resolution_uuid, set_rpa_resolution_func), 4396 EXP_FEAT(quality_report_uuid, set_quality_report_func), 4397 EXP_FEAT(offload_codecs_uuid, set_offload_codec_func), 4398 EXP_FEAT(le_simultaneous_roles_uuid, set_le_simultaneous_roles_func), 4399 4400 /* end with a null feature */ 4401 EXP_FEAT(NULL, NULL) 4402 }; 4403 4404 static int set_exp_feature(struct sock *sk, struct hci_dev *hdev, 4405 void *data, u16 data_len) 4406 { 4407 struct mgmt_cp_set_exp_feature *cp = data; 4408 size_t i = 0; 4409 4410 bt_dev_dbg(hdev, "sock %p", sk); 4411 4412 for (i = 0; exp_features[i].uuid; i++) { 4413 if (!memcmp(cp->uuid, exp_features[i].uuid, 16)) 4414 return exp_features[i].set_func(sk, hdev, cp, data_len); 4415 } 4416 4417 return mgmt_cmd_status(sk, hdev ? hdev->id : MGMT_INDEX_NONE, 4418 MGMT_OP_SET_EXP_FEATURE, 4419 MGMT_STATUS_NOT_SUPPORTED); 4420 } 4421 4422 static int get_device_flags(struct sock *sk, struct hci_dev *hdev, void *data, 4423 u16 data_len) 4424 { 4425 struct mgmt_cp_get_device_flags *cp = data; 4426 struct mgmt_rp_get_device_flags rp; 4427 struct bdaddr_list_with_flags *br_params; 4428 struct hci_conn_params *params; 4429 u32 supported_flags; 4430 u32 current_flags = 0; 4431 u8 status = MGMT_STATUS_INVALID_PARAMS; 4432 4433 bt_dev_dbg(hdev, "Get device flags %pMR (type 0x%x)\n", 4434 &cp->addr.bdaddr, cp->addr.type); 4435 4436 hci_dev_lock(hdev); 4437 4438 bitmap_to_arr32(&supported_flags, hdev->conn_flags, 4439 __HCI_CONN_NUM_FLAGS); 4440 4441 memset(&rp, 0, sizeof(rp)); 4442 4443 if (cp->addr.type == BDADDR_BREDR) { 4444 br_params = hci_bdaddr_list_lookup_with_flags(&hdev->accept_list, 4445 &cp->addr.bdaddr, 4446 cp->addr.type); 4447 if (!br_params) 4448 goto done; 4449 4450 bitmap_to_arr32(¤t_flags, br_params->flags, 4451 __HCI_CONN_NUM_FLAGS); 4452 } else { 4453 params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr, 4454 le_addr_type(cp->addr.type)); 4455 4456 if (!params) 4457 goto done; 4458 4459 bitmap_to_arr32(¤t_flags, params->flags, 4460 __HCI_CONN_NUM_FLAGS); 4461 } 4462 4463 bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr); 4464 rp.addr.type = cp->addr.type; 4465 rp.supported_flags = cpu_to_le32(supported_flags); 4466 rp.current_flags = cpu_to_le32(current_flags); 4467 4468 status = MGMT_STATUS_SUCCESS; 4469 4470 done: 4471 hci_dev_unlock(hdev); 4472 4473 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_DEVICE_FLAGS, status, 4474 &rp, sizeof(rp)); 4475 } 4476 4477 static void device_flags_changed(struct sock *sk, struct hci_dev *hdev, 4478 bdaddr_t *bdaddr, u8 bdaddr_type, 4479 u32 supported_flags, u32 current_flags) 4480 { 4481 struct mgmt_ev_device_flags_changed ev; 4482 4483 bacpy(&ev.addr.bdaddr, bdaddr); 4484 ev.addr.type = bdaddr_type; 4485 ev.supported_flags = cpu_to_le32(supported_flags); 4486 ev.current_flags = cpu_to_le32(current_flags); 4487 4488 mgmt_event(MGMT_EV_DEVICE_FLAGS_CHANGED, hdev, &ev, sizeof(ev), sk); 4489 } 4490 4491 static int set_device_flags(struct sock *sk, struct hci_dev *hdev, void *data, 4492 u16 len) 4493 { 4494 struct mgmt_cp_set_device_flags *cp = data; 4495 struct bdaddr_list_with_flags *br_params; 4496 struct hci_conn_params *params; 4497 u8 status = MGMT_STATUS_INVALID_PARAMS; 4498 u32 supported_flags; 4499 u32 current_flags = __le32_to_cpu(cp->current_flags); 4500 4501 bt_dev_dbg(hdev, "Set device flags %pMR (type 0x%x) = 0x%x", 4502 &cp->addr.bdaddr, cp->addr.type, 4503 __le32_to_cpu(current_flags)); 4504 4505 bitmap_to_arr32(&supported_flags, hdev->conn_flags, 4506 __HCI_CONN_NUM_FLAGS); 4507 4508 if ((supported_flags | current_flags) != supported_flags) { 4509 bt_dev_warn(hdev, "Bad flag given (0x%x) vs supported (0x%0x)", 4510 current_flags, supported_flags); 4511 goto done; 4512 } 4513 4514 hci_dev_lock(hdev); 4515 4516 if (cp->addr.type == BDADDR_BREDR) { 4517 br_params = hci_bdaddr_list_lookup_with_flags(&hdev->accept_list, 4518 &cp->addr.bdaddr, 4519 cp->addr.type); 4520 4521 if (br_params) { 4522 bitmap_from_u64(br_params->flags, current_flags); 4523 status = MGMT_STATUS_SUCCESS; 4524 } else { 4525 bt_dev_warn(hdev, "No such BR/EDR device %pMR (0x%x)", 4526 &cp->addr.bdaddr, cp->addr.type); 4527 } 4528 } else { 4529 params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr, 4530 le_addr_type(cp->addr.type)); 4531 if (params) { 4532 DECLARE_BITMAP(flags, __HCI_CONN_NUM_FLAGS); 4533 4534 bitmap_from_u64(flags, current_flags); 4535 4536 /* Devices using RPAs can only be programmed in the 4537 * acceptlist LL Privacy has been enable otherwise they 4538 * cannot mark HCI_CONN_FLAG_REMOTE_WAKEUP. 4539 */ 4540 if (test_bit(HCI_CONN_FLAG_REMOTE_WAKEUP, flags) && 4541 !use_ll_privacy(hdev) && 4542 hci_find_irk_by_addr(hdev, ¶ms->addr, 4543 params->addr_type)) { 4544 bt_dev_warn(hdev, 4545 "Cannot set wakeable for RPA"); 4546 goto unlock; 4547 } 4548 4549 bitmap_from_u64(params->flags, current_flags); 4550 status = MGMT_STATUS_SUCCESS; 4551 4552 /* Update passive scan if HCI_CONN_FLAG_DEVICE_PRIVACY 4553 * has been set. 4554 */ 4555 if (test_bit(HCI_CONN_FLAG_DEVICE_PRIVACY, 4556 params->flags)) 4557 hci_update_passive_scan(hdev); 4558 } else { 4559 bt_dev_warn(hdev, "No such LE device %pMR (0x%x)", 4560 &cp->addr.bdaddr, 4561 le_addr_type(cp->addr.type)); 4562 } 4563 } 4564 4565 unlock: 4566 hci_dev_unlock(hdev); 4567 4568 done: 4569 if (status == MGMT_STATUS_SUCCESS) 4570 device_flags_changed(sk, hdev, &cp->addr.bdaddr, cp->addr.type, 4571 supported_flags, current_flags); 4572 4573 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_DEVICE_FLAGS, status, 4574 &cp->addr, sizeof(cp->addr)); 4575 } 4576 4577 static void mgmt_adv_monitor_added(struct sock *sk, struct hci_dev *hdev, 4578 u16 handle) 4579 { 4580 struct mgmt_ev_adv_monitor_added ev; 4581 4582 ev.monitor_handle = cpu_to_le16(handle); 4583 4584 mgmt_event(MGMT_EV_ADV_MONITOR_ADDED, hdev, &ev, sizeof(ev), sk); 4585 } 4586 4587 void mgmt_adv_monitor_removed(struct hci_dev *hdev, u16 handle) 4588 { 4589 struct mgmt_ev_adv_monitor_removed ev; 4590 struct mgmt_pending_cmd *cmd; 4591 struct sock *sk_skip = NULL; 4592 struct mgmt_cp_remove_adv_monitor *cp; 4593 4594 cmd = pending_find(MGMT_OP_REMOVE_ADV_MONITOR, hdev); 4595 if (cmd) { 4596 cp = cmd->param; 4597 4598 if (cp->monitor_handle) 4599 sk_skip = cmd->sk; 4600 } 4601 4602 ev.monitor_handle = cpu_to_le16(handle); 4603 4604 mgmt_event(MGMT_EV_ADV_MONITOR_REMOVED, hdev, &ev, sizeof(ev), sk_skip); 4605 } 4606 4607 static int read_adv_mon_features(struct sock *sk, struct hci_dev *hdev, 4608 void *data, u16 len) 4609 { 4610 struct adv_monitor *monitor = NULL; 4611 struct mgmt_rp_read_adv_monitor_features *rp = NULL; 4612 int handle, err; 4613 size_t rp_size = 0; 4614 __u32 supported = 0; 4615 __u32 enabled = 0; 4616 __u16 num_handles = 0; 4617 __u16 handles[HCI_MAX_ADV_MONITOR_NUM_HANDLES]; 4618 4619 BT_DBG("request for %s", hdev->name); 4620 4621 hci_dev_lock(hdev); 4622 4623 if (msft_monitor_supported(hdev)) 4624 supported |= MGMT_ADV_MONITOR_FEATURE_MASK_OR_PATTERNS; 4625 4626 idr_for_each_entry(&hdev->adv_monitors_idr, monitor, handle) 4627 handles[num_handles++] = monitor->handle; 4628 4629 hci_dev_unlock(hdev); 4630 4631 rp_size = sizeof(*rp) + (num_handles * sizeof(u16)); 4632 rp = kmalloc(rp_size, GFP_KERNEL); 4633 if (!rp) 4634 return -ENOMEM; 4635 4636 /* All supported features are currently enabled */ 4637 enabled = supported; 4638 4639 rp->supported_features = cpu_to_le32(supported); 4640 rp->enabled_features = cpu_to_le32(enabled); 4641 rp->max_num_handles = cpu_to_le16(HCI_MAX_ADV_MONITOR_NUM_HANDLES); 4642 rp->max_num_patterns = HCI_MAX_ADV_MONITOR_NUM_PATTERNS; 4643 rp->num_handles = cpu_to_le16(num_handles); 4644 if (num_handles) 4645 memcpy(&rp->handles, &handles, (num_handles * sizeof(u16))); 4646 4647 err = mgmt_cmd_complete(sk, hdev->id, 4648 MGMT_OP_READ_ADV_MONITOR_FEATURES, 4649 MGMT_STATUS_SUCCESS, rp, rp_size); 4650 4651 kfree(rp); 4652 4653 return err; 4654 } 4655 4656 int mgmt_add_adv_patterns_monitor_complete(struct hci_dev *hdev, u8 status) 4657 { 4658 struct mgmt_rp_add_adv_patterns_monitor rp; 4659 struct mgmt_pending_cmd *cmd; 4660 struct adv_monitor *monitor; 4661 int err = 0; 4662 4663 hci_dev_lock(hdev); 4664 4665 cmd = pending_find(MGMT_OP_ADD_ADV_PATTERNS_MONITOR_RSSI, hdev); 4666 if (!cmd) { 4667 cmd = pending_find(MGMT_OP_ADD_ADV_PATTERNS_MONITOR, hdev); 4668 if (!cmd) 4669 goto done; 4670 } 4671 4672 monitor = cmd->user_data; 4673 rp.monitor_handle = cpu_to_le16(monitor->handle); 4674 4675 if (!status) { 4676 mgmt_adv_monitor_added(cmd->sk, hdev, monitor->handle); 4677 hdev->adv_monitors_cnt++; 4678 if (monitor->state == ADV_MONITOR_STATE_NOT_REGISTERED) 4679 monitor->state = ADV_MONITOR_STATE_REGISTERED; 4680 hci_update_passive_scan(hdev); 4681 } 4682 4683 err = mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, 4684 mgmt_status(status), &rp, sizeof(rp)); 4685 mgmt_pending_remove(cmd); 4686 4687 done: 4688 hci_dev_unlock(hdev); 4689 bt_dev_dbg(hdev, "add monitor %d complete, status %u", 4690 rp.monitor_handle, status); 4691 4692 return err; 4693 } 4694 4695 static int __add_adv_patterns_monitor(struct sock *sk, struct hci_dev *hdev, 4696 struct adv_monitor *m, u8 status, 4697 void *data, u16 len, u16 op) 4698 { 4699 struct mgmt_rp_add_adv_patterns_monitor rp; 4700 struct mgmt_pending_cmd *cmd; 4701 int err; 4702 bool pending; 4703 4704 hci_dev_lock(hdev); 4705 4706 if (status) 4707 goto unlock; 4708 4709 if (pending_find(MGMT_OP_SET_LE, hdev) || 4710 pending_find(MGMT_OP_ADD_ADV_PATTERNS_MONITOR, hdev) || 4711 pending_find(MGMT_OP_ADD_ADV_PATTERNS_MONITOR_RSSI, hdev) || 4712 pending_find(MGMT_OP_REMOVE_ADV_MONITOR, hdev)) { 4713 status = MGMT_STATUS_BUSY; 4714 goto unlock; 4715 } 4716 4717 cmd = mgmt_pending_add(sk, op, hdev, data, len); 4718 if (!cmd) { 4719 status = MGMT_STATUS_NO_RESOURCES; 4720 goto unlock; 4721 } 4722 4723 cmd->user_data = m; 4724 pending = hci_add_adv_monitor(hdev, m, &err); 4725 if (err) { 4726 if (err == -ENOSPC || err == -ENOMEM) 4727 status = MGMT_STATUS_NO_RESOURCES; 4728 else if (err == -EINVAL) 4729 status = MGMT_STATUS_INVALID_PARAMS; 4730 else 4731 status = MGMT_STATUS_FAILED; 4732 4733 mgmt_pending_remove(cmd); 4734 goto unlock; 4735 } 4736 4737 if (!pending) { 4738 mgmt_pending_remove(cmd); 4739 rp.monitor_handle = cpu_to_le16(m->handle); 4740 mgmt_adv_monitor_added(sk, hdev, m->handle); 4741 m->state = ADV_MONITOR_STATE_REGISTERED; 4742 hdev->adv_monitors_cnt++; 4743 4744 hci_dev_unlock(hdev); 4745 return mgmt_cmd_complete(sk, hdev->id, op, MGMT_STATUS_SUCCESS, 4746 &rp, sizeof(rp)); 4747 } 4748 4749 hci_dev_unlock(hdev); 4750 4751 return 0; 4752 4753 unlock: 4754 hci_free_adv_monitor(hdev, m); 4755 hci_dev_unlock(hdev); 4756 return mgmt_cmd_status(sk, hdev->id, op, status); 4757 } 4758 4759 static void parse_adv_monitor_rssi(struct adv_monitor *m, 4760 struct mgmt_adv_rssi_thresholds *rssi) 4761 { 4762 if (rssi) { 4763 m->rssi.low_threshold = rssi->low_threshold; 4764 m->rssi.low_threshold_timeout = 4765 __le16_to_cpu(rssi->low_threshold_timeout); 4766 m->rssi.high_threshold = rssi->high_threshold; 4767 m->rssi.high_threshold_timeout = 4768 __le16_to_cpu(rssi->high_threshold_timeout); 4769 m->rssi.sampling_period = rssi->sampling_period; 4770 } else { 4771 /* Default values. These numbers are the least constricting 4772 * parameters for MSFT API to work, so it behaves as if there 4773 * are no rssi parameter to consider. May need to be changed 4774 * if other API are to be supported. 4775 */ 4776 m->rssi.low_threshold = -127; 4777 m->rssi.low_threshold_timeout = 60; 4778 m->rssi.high_threshold = -127; 4779 m->rssi.high_threshold_timeout = 0; 4780 m->rssi.sampling_period = 0; 4781 } 4782 } 4783 4784 static u8 parse_adv_monitor_pattern(struct adv_monitor *m, u8 pattern_count, 4785 struct mgmt_adv_pattern *patterns) 4786 { 4787 u8 offset = 0, length = 0; 4788 struct adv_pattern *p = NULL; 4789 int i; 4790 4791 for (i = 0; i < pattern_count; i++) { 4792 offset = patterns[i].offset; 4793 length = patterns[i].length; 4794 if (offset >= HCI_MAX_AD_LENGTH || 4795 length > HCI_MAX_AD_LENGTH || 4796 (offset + length) > HCI_MAX_AD_LENGTH) 4797 return MGMT_STATUS_INVALID_PARAMS; 4798 4799 p = kmalloc(sizeof(*p), GFP_KERNEL); 4800 if (!p) 4801 return MGMT_STATUS_NO_RESOURCES; 4802 4803 p->ad_type = patterns[i].ad_type; 4804 p->offset = patterns[i].offset; 4805 p->length = patterns[i].length; 4806 memcpy(p->value, patterns[i].value, p->length); 4807 4808 INIT_LIST_HEAD(&p->list); 4809 list_add(&p->list, &m->patterns); 4810 } 4811 4812 return MGMT_STATUS_SUCCESS; 4813 } 4814 4815 static int add_adv_patterns_monitor(struct sock *sk, struct hci_dev *hdev, 4816 void *data, u16 len) 4817 { 4818 struct mgmt_cp_add_adv_patterns_monitor *cp = data; 4819 struct adv_monitor *m = NULL; 4820 u8 status = MGMT_STATUS_SUCCESS; 4821 size_t expected_size = sizeof(*cp); 4822 4823 BT_DBG("request for %s", hdev->name); 4824 4825 if (len <= sizeof(*cp)) { 4826 status = MGMT_STATUS_INVALID_PARAMS; 4827 goto done; 4828 } 4829 4830 expected_size += cp->pattern_count * sizeof(struct mgmt_adv_pattern); 4831 if (len != expected_size) { 4832 status = MGMT_STATUS_INVALID_PARAMS; 4833 goto done; 4834 } 4835 4836 m = kzalloc(sizeof(*m), GFP_KERNEL); 4837 if (!m) { 4838 status = MGMT_STATUS_NO_RESOURCES; 4839 goto done; 4840 } 4841 4842 INIT_LIST_HEAD(&m->patterns); 4843 4844 parse_adv_monitor_rssi(m, NULL); 4845 status = parse_adv_monitor_pattern(m, cp->pattern_count, cp->patterns); 4846 4847 done: 4848 return __add_adv_patterns_monitor(sk, hdev, m, status, data, len, 4849 MGMT_OP_ADD_ADV_PATTERNS_MONITOR); 4850 } 4851 4852 static int add_adv_patterns_monitor_rssi(struct sock *sk, struct hci_dev *hdev, 4853 void *data, u16 len) 4854 { 4855 struct mgmt_cp_add_adv_patterns_monitor_rssi *cp = data; 4856 struct adv_monitor *m = NULL; 4857 u8 status = MGMT_STATUS_SUCCESS; 4858 size_t expected_size = sizeof(*cp); 4859 4860 BT_DBG("request for %s", hdev->name); 4861 4862 if (len <= sizeof(*cp)) { 4863 status = MGMT_STATUS_INVALID_PARAMS; 4864 goto done; 4865 } 4866 4867 expected_size += cp->pattern_count * sizeof(struct mgmt_adv_pattern); 4868 if (len != expected_size) { 4869 status = MGMT_STATUS_INVALID_PARAMS; 4870 goto done; 4871 } 4872 4873 m = kzalloc(sizeof(*m), GFP_KERNEL); 4874 if (!m) { 4875 status = MGMT_STATUS_NO_RESOURCES; 4876 goto done; 4877 } 4878 4879 INIT_LIST_HEAD(&m->patterns); 4880 4881 parse_adv_monitor_rssi(m, &cp->rssi); 4882 status = parse_adv_monitor_pattern(m, cp->pattern_count, cp->patterns); 4883 4884 done: 4885 return __add_adv_patterns_monitor(sk, hdev, m, status, data, len, 4886 MGMT_OP_ADD_ADV_PATTERNS_MONITOR_RSSI); 4887 } 4888 4889 int mgmt_remove_adv_monitor_complete(struct hci_dev *hdev, u8 status) 4890 { 4891 struct mgmt_rp_remove_adv_monitor rp; 4892 struct mgmt_cp_remove_adv_monitor *cp; 4893 struct mgmt_pending_cmd *cmd; 4894 int err = 0; 4895 4896 hci_dev_lock(hdev); 4897 4898 cmd = pending_find(MGMT_OP_REMOVE_ADV_MONITOR, hdev); 4899 if (!cmd) 4900 goto done; 4901 4902 cp = cmd->param; 4903 rp.monitor_handle = cp->monitor_handle; 4904 4905 if (!status) 4906 hci_update_passive_scan(hdev); 4907 4908 err = mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, 4909 mgmt_status(status), &rp, sizeof(rp)); 4910 mgmt_pending_remove(cmd); 4911 4912 done: 4913 hci_dev_unlock(hdev); 4914 bt_dev_dbg(hdev, "remove monitor %d complete, status %u", 4915 rp.monitor_handle, status); 4916 4917 return err; 4918 } 4919 4920 static int remove_adv_monitor(struct sock *sk, struct hci_dev *hdev, 4921 void *data, u16 len) 4922 { 4923 struct mgmt_cp_remove_adv_monitor *cp = data; 4924 struct mgmt_rp_remove_adv_monitor rp; 4925 struct mgmt_pending_cmd *cmd; 4926 u16 handle = __le16_to_cpu(cp->monitor_handle); 4927 int err, status; 4928 bool pending; 4929 4930 BT_DBG("request for %s", hdev->name); 4931 rp.monitor_handle = cp->monitor_handle; 4932 4933 hci_dev_lock(hdev); 4934 4935 if (pending_find(MGMT_OP_SET_LE, hdev) || 4936 pending_find(MGMT_OP_REMOVE_ADV_MONITOR, hdev) || 4937 pending_find(MGMT_OP_ADD_ADV_PATTERNS_MONITOR, hdev) || 4938 pending_find(MGMT_OP_ADD_ADV_PATTERNS_MONITOR_RSSI, hdev)) { 4939 status = MGMT_STATUS_BUSY; 4940 goto unlock; 4941 } 4942 4943 cmd = mgmt_pending_add(sk, MGMT_OP_REMOVE_ADV_MONITOR, hdev, data, len); 4944 if (!cmd) { 4945 status = MGMT_STATUS_NO_RESOURCES; 4946 goto unlock; 4947 } 4948 4949 if (handle) 4950 pending = hci_remove_single_adv_monitor(hdev, handle, &err); 4951 else 4952 pending = hci_remove_all_adv_monitor(hdev, &err); 4953 4954 if (err) { 4955 mgmt_pending_remove(cmd); 4956 4957 if (err == -ENOENT) 4958 status = MGMT_STATUS_INVALID_INDEX; 4959 else 4960 status = MGMT_STATUS_FAILED; 4961 4962 goto unlock; 4963 } 4964 4965 /* monitor can be removed without forwarding request to controller */ 4966 if (!pending) { 4967 mgmt_pending_remove(cmd); 4968 hci_dev_unlock(hdev); 4969 4970 return mgmt_cmd_complete(sk, hdev->id, 4971 MGMT_OP_REMOVE_ADV_MONITOR, 4972 MGMT_STATUS_SUCCESS, 4973 &rp, sizeof(rp)); 4974 } 4975 4976 hci_dev_unlock(hdev); 4977 return 0; 4978 4979 unlock: 4980 hci_dev_unlock(hdev); 4981 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_ADV_MONITOR, 4982 status); 4983 } 4984 4985 static void read_local_oob_data_complete(struct hci_dev *hdev, void *data, int err) 4986 { 4987 struct mgmt_rp_read_local_oob_data mgmt_rp; 4988 size_t rp_size = sizeof(mgmt_rp); 4989 struct mgmt_pending_cmd *cmd = data; 4990 struct sk_buff *skb = cmd->skb; 4991 u8 status = mgmt_status(err); 4992 4993 if (!status) { 4994 if (!skb) 4995 status = MGMT_STATUS_FAILED; 4996 else if (IS_ERR(skb)) 4997 status = mgmt_status(PTR_ERR(skb)); 4998 else 4999 status = mgmt_status(skb->data[0]); 5000 } 5001 5002 bt_dev_dbg(hdev, "status %d", status); 5003 5004 if (status) { 5005 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA, status); 5006 goto remove; 5007 } 5008 5009 memset(&mgmt_rp, 0, sizeof(mgmt_rp)); 5010 5011 if (!bredr_sc_enabled(hdev)) { 5012 struct hci_rp_read_local_oob_data *rp = (void *) skb->data; 5013 5014 if (skb->len < sizeof(*rp)) { 5015 mgmt_cmd_status(cmd->sk, hdev->id, 5016 MGMT_OP_READ_LOCAL_OOB_DATA, 5017 MGMT_STATUS_FAILED); 5018 goto remove; 5019 } 5020 5021 memcpy(mgmt_rp.hash192, rp->hash, sizeof(rp->hash)); 5022 memcpy(mgmt_rp.rand192, rp->rand, sizeof(rp->rand)); 5023 5024 rp_size -= sizeof(mgmt_rp.hash256) + sizeof(mgmt_rp.rand256); 5025 } else { 5026 struct hci_rp_read_local_oob_ext_data *rp = (void *) skb->data; 5027 5028 if (skb->len < sizeof(*rp)) { 5029 mgmt_cmd_status(cmd->sk, hdev->id, 5030 MGMT_OP_READ_LOCAL_OOB_DATA, 5031 MGMT_STATUS_FAILED); 5032 goto remove; 5033 } 5034 5035 memcpy(mgmt_rp.hash192, rp->hash192, sizeof(rp->hash192)); 5036 memcpy(mgmt_rp.rand192, rp->rand192, sizeof(rp->rand192)); 5037 5038 memcpy(mgmt_rp.hash256, rp->hash256, sizeof(rp->hash256)); 5039 memcpy(mgmt_rp.rand256, rp->rand256, sizeof(rp->rand256)); 5040 } 5041 5042 mgmt_cmd_complete(cmd->sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA, 5043 MGMT_STATUS_SUCCESS, &mgmt_rp, rp_size); 5044 5045 remove: 5046 if (skb && !IS_ERR(skb)) 5047 kfree_skb(skb); 5048 5049 mgmt_pending_free(cmd); 5050 } 5051 5052 static int read_local_oob_data_sync(struct hci_dev *hdev, void *data) 5053 { 5054 struct mgmt_pending_cmd *cmd = data; 5055 5056 if (bredr_sc_enabled(hdev)) 5057 cmd->skb = hci_read_local_oob_data_sync(hdev, true, cmd->sk); 5058 else 5059 cmd->skb = hci_read_local_oob_data_sync(hdev, false, cmd->sk); 5060 5061 if (IS_ERR(cmd->skb)) 5062 return PTR_ERR(cmd->skb); 5063 else 5064 return 0; 5065 } 5066 5067 static int read_local_oob_data(struct sock *sk, struct hci_dev *hdev, 5068 void *data, u16 data_len) 5069 { 5070 struct mgmt_pending_cmd *cmd; 5071 int err; 5072 5073 bt_dev_dbg(hdev, "sock %p", sk); 5074 5075 hci_dev_lock(hdev); 5076 5077 if (!hdev_is_powered(hdev)) { 5078 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA, 5079 MGMT_STATUS_NOT_POWERED); 5080 goto unlock; 5081 } 5082 5083 if (!lmp_ssp_capable(hdev)) { 5084 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA, 5085 MGMT_STATUS_NOT_SUPPORTED); 5086 goto unlock; 5087 } 5088 5089 cmd = mgmt_pending_new(sk, MGMT_OP_READ_LOCAL_OOB_DATA, hdev, NULL, 0); 5090 if (!cmd) 5091 err = -ENOMEM; 5092 else 5093 err = hci_cmd_sync_queue(hdev, read_local_oob_data_sync, cmd, 5094 read_local_oob_data_complete); 5095 5096 if (err < 0) { 5097 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA, 5098 MGMT_STATUS_FAILED); 5099 5100 if (cmd) 5101 mgmt_pending_free(cmd); 5102 } 5103 5104 unlock: 5105 hci_dev_unlock(hdev); 5106 return err; 5107 } 5108 5109 static int add_remote_oob_data(struct sock *sk, struct hci_dev *hdev, 5110 void *data, u16 len) 5111 { 5112 struct mgmt_addr_info *addr = data; 5113 int err; 5114 5115 bt_dev_dbg(hdev, "sock %p", sk); 5116 5117 if (!bdaddr_type_is_valid(addr->type)) 5118 return mgmt_cmd_complete(sk, hdev->id, 5119 MGMT_OP_ADD_REMOTE_OOB_DATA, 5120 MGMT_STATUS_INVALID_PARAMS, 5121 addr, sizeof(*addr)); 5122 5123 hci_dev_lock(hdev); 5124 5125 if (len == MGMT_ADD_REMOTE_OOB_DATA_SIZE) { 5126 struct mgmt_cp_add_remote_oob_data *cp = data; 5127 u8 status; 5128 5129 if (cp->addr.type != BDADDR_BREDR) { 5130 err = mgmt_cmd_complete(sk, hdev->id, 5131 MGMT_OP_ADD_REMOTE_OOB_DATA, 5132 MGMT_STATUS_INVALID_PARAMS, 5133 &cp->addr, sizeof(cp->addr)); 5134 goto unlock; 5135 } 5136 5137 err = hci_add_remote_oob_data(hdev, &cp->addr.bdaddr, 5138 cp->addr.type, cp->hash, 5139 cp->rand, NULL, NULL); 5140 if (err < 0) 5141 status = MGMT_STATUS_FAILED; 5142 else 5143 status = MGMT_STATUS_SUCCESS; 5144 5145 err = mgmt_cmd_complete(sk, hdev->id, 5146 MGMT_OP_ADD_REMOTE_OOB_DATA, status, 5147 &cp->addr, sizeof(cp->addr)); 5148 } else if (len == MGMT_ADD_REMOTE_OOB_EXT_DATA_SIZE) { 5149 struct mgmt_cp_add_remote_oob_ext_data *cp = data; 5150 u8 *rand192, *hash192, *rand256, *hash256; 5151 u8 status; 5152 5153 if (bdaddr_type_is_le(cp->addr.type)) { 5154 /* Enforce zero-valued 192-bit parameters as 5155 * long as legacy SMP OOB isn't implemented. 5156 */ 5157 if (memcmp(cp->rand192, ZERO_KEY, 16) || 5158 memcmp(cp->hash192, ZERO_KEY, 16)) { 5159 err = mgmt_cmd_complete(sk, hdev->id, 5160 MGMT_OP_ADD_REMOTE_OOB_DATA, 5161 MGMT_STATUS_INVALID_PARAMS, 5162 addr, sizeof(*addr)); 5163 goto unlock; 5164 } 5165 5166 rand192 = NULL; 5167 hash192 = NULL; 5168 } else { 5169 /* In case one of the P-192 values is set to zero, 5170 * then just disable OOB data for P-192. 5171 */ 5172 if (!memcmp(cp->rand192, ZERO_KEY, 16) || 5173 !memcmp(cp->hash192, ZERO_KEY, 16)) { 5174 rand192 = NULL; 5175 hash192 = NULL; 5176 } else { 5177 rand192 = cp->rand192; 5178 hash192 = cp->hash192; 5179 } 5180 } 5181 5182 /* In case one of the P-256 values is set to zero, then just 5183 * disable OOB data for P-256. 5184 */ 5185 if (!memcmp(cp->rand256, ZERO_KEY, 16) || 5186 !memcmp(cp->hash256, ZERO_KEY, 16)) { 5187 rand256 = NULL; 5188 hash256 = NULL; 5189 } else { 5190 rand256 = cp->rand256; 5191 hash256 = cp->hash256; 5192 } 5193 5194 err = hci_add_remote_oob_data(hdev, &cp->addr.bdaddr, 5195 cp->addr.type, hash192, rand192, 5196 hash256, rand256); 5197 if (err < 0) 5198 status = MGMT_STATUS_FAILED; 5199 else 5200 status = MGMT_STATUS_SUCCESS; 5201 5202 err = mgmt_cmd_complete(sk, hdev->id, 5203 MGMT_OP_ADD_REMOTE_OOB_DATA, 5204 status, &cp->addr, sizeof(cp->addr)); 5205 } else { 5206 bt_dev_err(hdev, "add_remote_oob_data: invalid len of %u bytes", 5207 len); 5208 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_REMOTE_OOB_DATA, 5209 MGMT_STATUS_INVALID_PARAMS); 5210 } 5211 5212 unlock: 5213 hci_dev_unlock(hdev); 5214 return err; 5215 } 5216 5217 static int remove_remote_oob_data(struct sock *sk, struct hci_dev *hdev, 5218 void *data, u16 len) 5219 { 5220 struct mgmt_cp_remove_remote_oob_data *cp = data; 5221 u8 status; 5222 int err; 5223 5224 bt_dev_dbg(hdev, "sock %p", sk); 5225 5226 if (cp->addr.type != BDADDR_BREDR) 5227 return mgmt_cmd_complete(sk, hdev->id, 5228 MGMT_OP_REMOVE_REMOTE_OOB_DATA, 5229 MGMT_STATUS_INVALID_PARAMS, 5230 &cp->addr, sizeof(cp->addr)); 5231 5232 hci_dev_lock(hdev); 5233 5234 if (!bacmp(&cp->addr.bdaddr, BDADDR_ANY)) { 5235 hci_remote_oob_data_clear(hdev); 5236 status = MGMT_STATUS_SUCCESS; 5237 goto done; 5238 } 5239 5240 err = hci_remove_remote_oob_data(hdev, &cp->addr.bdaddr, cp->addr.type); 5241 if (err < 0) 5242 status = MGMT_STATUS_INVALID_PARAMS; 5243 else 5244 status = MGMT_STATUS_SUCCESS; 5245 5246 done: 5247 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_REMOTE_OOB_DATA, 5248 status, &cp->addr, sizeof(cp->addr)); 5249 5250 hci_dev_unlock(hdev); 5251 return err; 5252 } 5253 5254 void mgmt_start_discovery_complete(struct hci_dev *hdev, u8 status) 5255 { 5256 struct mgmt_pending_cmd *cmd; 5257 5258 bt_dev_dbg(hdev, "status %u", status); 5259 5260 hci_dev_lock(hdev); 5261 5262 cmd = pending_find(MGMT_OP_START_DISCOVERY, hdev); 5263 if (!cmd) 5264 cmd = pending_find(MGMT_OP_START_SERVICE_DISCOVERY, hdev); 5265 5266 if (!cmd) 5267 cmd = pending_find(MGMT_OP_START_LIMITED_DISCOVERY, hdev); 5268 5269 if (cmd) { 5270 cmd->cmd_complete(cmd, mgmt_status(status)); 5271 mgmt_pending_remove(cmd); 5272 } 5273 5274 hci_dev_unlock(hdev); 5275 } 5276 5277 static bool discovery_type_is_valid(struct hci_dev *hdev, uint8_t type, 5278 uint8_t *mgmt_status) 5279 { 5280 switch (type) { 5281 case DISCOV_TYPE_LE: 5282 *mgmt_status = mgmt_le_support(hdev); 5283 if (*mgmt_status) 5284 return false; 5285 break; 5286 case DISCOV_TYPE_INTERLEAVED: 5287 *mgmt_status = mgmt_le_support(hdev); 5288 if (*mgmt_status) 5289 return false; 5290 fallthrough; 5291 case DISCOV_TYPE_BREDR: 5292 *mgmt_status = mgmt_bredr_support(hdev); 5293 if (*mgmt_status) 5294 return false; 5295 break; 5296 default: 5297 *mgmt_status = MGMT_STATUS_INVALID_PARAMS; 5298 return false; 5299 } 5300 5301 return true; 5302 } 5303 5304 static void start_discovery_complete(struct hci_dev *hdev, void *data, int err) 5305 { 5306 struct mgmt_pending_cmd *cmd = data; 5307 5308 if (cmd != pending_find(MGMT_OP_START_DISCOVERY, hdev) && 5309 cmd != pending_find(MGMT_OP_START_LIMITED_DISCOVERY, hdev) && 5310 cmd != pending_find(MGMT_OP_START_SERVICE_DISCOVERY, hdev)) 5311 return; 5312 5313 bt_dev_dbg(hdev, "err %d", err); 5314 5315 mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, mgmt_status(err), 5316 cmd->param, 1); 5317 mgmt_pending_remove(cmd); 5318 5319 hci_discovery_set_state(hdev, err ? DISCOVERY_STOPPED: 5320 DISCOVERY_FINDING); 5321 } 5322 5323 static int start_discovery_sync(struct hci_dev *hdev, void *data) 5324 { 5325 return hci_start_discovery_sync(hdev); 5326 } 5327 5328 static int start_discovery_internal(struct sock *sk, struct hci_dev *hdev, 5329 u16 op, void *data, u16 len) 5330 { 5331 struct mgmt_cp_start_discovery *cp = data; 5332 struct mgmt_pending_cmd *cmd; 5333 u8 status; 5334 int err; 5335 5336 bt_dev_dbg(hdev, "sock %p", sk); 5337 5338 hci_dev_lock(hdev); 5339 5340 if (!hdev_is_powered(hdev)) { 5341 err = mgmt_cmd_complete(sk, hdev->id, op, 5342 MGMT_STATUS_NOT_POWERED, 5343 &cp->type, sizeof(cp->type)); 5344 goto failed; 5345 } 5346 5347 if (hdev->discovery.state != DISCOVERY_STOPPED || 5348 hci_dev_test_flag(hdev, HCI_PERIODIC_INQ)) { 5349 err = mgmt_cmd_complete(sk, hdev->id, op, MGMT_STATUS_BUSY, 5350 &cp->type, sizeof(cp->type)); 5351 goto failed; 5352 } 5353 5354 if (!discovery_type_is_valid(hdev, cp->type, &status)) { 5355 err = mgmt_cmd_complete(sk, hdev->id, op, status, 5356 &cp->type, sizeof(cp->type)); 5357 goto failed; 5358 } 5359 5360 /* Can't start discovery when it is paused */ 5361 if (hdev->discovery_paused) { 5362 err = mgmt_cmd_complete(sk, hdev->id, op, MGMT_STATUS_BUSY, 5363 &cp->type, sizeof(cp->type)); 5364 goto failed; 5365 } 5366 5367 /* Clear the discovery filter first to free any previously 5368 * allocated memory for the UUID list. 5369 */ 5370 hci_discovery_filter_clear(hdev); 5371 5372 hdev->discovery.type = cp->type; 5373 hdev->discovery.report_invalid_rssi = false; 5374 if (op == MGMT_OP_START_LIMITED_DISCOVERY) 5375 hdev->discovery.limited = true; 5376 else 5377 hdev->discovery.limited = false; 5378 5379 cmd = mgmt_pending_add(sk, op, hdev, data, len); 5380 if (!cmd) { 5381 err = -ENOMEM; 5382 goto failed; 5383 } 5384 5385 err = hci_cmd_sync_queue(hdev, start_discovery_sync, cmd, 5386 start_discovery_complete); 5387 if (err < 0) { 5388 mgmt_pending_remove(cmd); 5389 goto failed; 5390 } 5391 5392 hci_discovery_set_state(hdev, DISCOVERY_STARTING); 5393 5394 failed: 5395 hci_dev_unlock(hdev); 5396 return err; 5397 } 5398 5399 static int start_discovery(struct sock *sk, struct hci_dev *hdev, 5400 void *data, u16 len) 5401 { 5402 return start_discovery_internal(sk, hdev, MGMT_OP_START_DISCOVERY, 5403 data, len); 5404 } 5405 5406 static int start_limited_discovery(struct sock *sk, struct hci_dev *hdev, 5407 void *data, u16 len) 5408 { 5409 return start_discovery_internal(sk, hdev, 5410 MGMT_OP_START_LIMITED_DISCOVERY, 5411 data, len); 5412 } 5413 5414 static int start_service_discovery(struct sock *sk, struct hci_dev *hdev, 5415 void *data, u16 len) 5416 { 5417 struct mgmt_cp_start_service_discovery *cp = data; 5418 struct mgmt_pending_cmd *cmd; 5419 const u16 max_uuid_count = ((U16_MAX - sizeof(*cp)) / 16); 5420 u16 uuid_count, expected_len; 5421 u8 status; 5422 int err; 5423 5424 bt_dev_dbg(hdev, "sock %p", sk); 5425 5426 hci_dev_lock(hdev); 5427 5428 if (!hdev_is_powered(hdev)) { 5429 err = mgmt_cmd_complete(sk, hdev->id, 5430 MGMT_OP_START_SERVICE_DISCOVERY, 5431 MGMT_STATUS_NOT_POWERED, 5432 &cp->type, sizeof(cp->type)); 5433 goto failed; 5434 } 5435 5436 if (hdev->discovery.state != DISCOVERY_STOPPED || 5437 hci_dev_test_flag(hdev, HCI_PERIODIC_INQ)) { 5438 err = mgmt_cmd_complete(sk, hdev->id, 5439 MGMT_OP_START_SERVICE_DISCOVERY, 5440 MGMT_STATUS_BUSY, &cp->type, 5441 sizeof(cp->type)); 5442 goto failed; 5443 } 5444 5445 if (hdev->discovery_paused) { 5446 err = mgmt_cmd_complete(sk, hdev->id, 5447 MGMT_OP_START_SERVICE_DISCOVERY, 5448 MGMT_STATUS_BUSY, &cp->type, 5449 sizeof(cp->type)); 5450 goto failed; 5451 } 5452 5453 uuid_count = __le16_to_cpu(cp->uuid_count); 5454 if (uuid_count > max_uuid_count) { 5455 bt_dev_err(hdev, "service_discovery: too big uuid_count value %u", 5456 uuid_count); 5457 err = mgmt_cmd_complete(sk, hdev->id, 5458 MGMT_OP_START_SERVICE_DISCOVERY, 5459 MGMT_STATUS_INVALID_PARAMS, &cp->type, 5460 sizeof(cp->type)); 5461 goto failed; 5462 } 5463 5464 expected_len = sizeof(*cp) + uuid_count * 16; 5465 if (expected_len != len) { 5466 bt_dev_err(hdev, "service_discovery: expected %u bytes, got %u bytes", 5467 expected_len, len); 5468 err = mgmt_cmd_complete(sk, hdev->id, 5469 MGMT_OP_START_SERVICE_DISCOVERY, 5470 MGMT_STATUS_INVALID_PARAMS, &cp->type, 5471 sizeof(cp->type)); 5472 goto failed; 5473 } 5474 5475 if (!discovery_type_is_valid(hdev, cp->type, &status)) { 5476 err = mgmt_cmd_complete(sk, hdev->id, 5477 MGMT_OP_START_SERVICE_DISCOVERY, 5478 status, &cp->type, sizeof(cp->type)); 5479 goto failed; 5480 } 5481 5482 cmd = mgmt_pending_add(sk, MGMT_OP_START_SERVICE_DISCOVERY, 5483 hdev, data, len); 5484 if (!cmd) { 5485 err = -ENOMEM; 5486 goto failed; 5487 } 5488 5489 /* Clear the discovery filter first to free any previously 5490 * allocated memory for the UUID list. 5491 */ 5492 hci_discovery_filter_clear(hdev); 5493 5494 hdev->discovery.result_filtering = true; 5495 hdev->discovery.type = cp->type; 5496 hdev->discovery.rssi = cp->rssi; 5497 hdev->discovery.uuid_count = uuid_count; 5498 5499 if (uuid_count > 0) { 5500 hdev->discovery.uuids = kmemdup(cp->uuids, uuid_count * 16, 5501 GFP_KERNEL); 5502 if (!hdev->discovery.uuids) { 5503 err = mgmt_cmd_complete(sk, hdev->id, 5504 MGMT_OP_START_SERVICE_DISCOVERY, 5505 MGMT_STATUS_FAILED, 5506 &cp->type, sizeof(cp->type)); 5507 mgmt_pending_remove(cmd); 5508 goto failed; 5509 } 5510 } 5511 5512 err = hci_cmd_sync_queue(hdev, start_discovery_sync, cmd, 5513 start_discovery_complete); 5514 if (err < 0) { 5515 mgmt_pending_remove(cmd); 5516 goto failed; 5517 } 5518 5519 hci_discovery_set_state(hdev, DISCOVERY_STARTING); 5520 5521 failed: 5522 hci_dev_unlock(hdev); 5523 return err; 5524 } 5525 5526 void mgmt_stop_discovery_complete(struct hci_dev *hdev, u8 status) 5527 { 5528 struct mgmt_pending_cmd *cmd; 5529 5530 bt_dev_dbg(hdev, "status %u", status); 5531 5532 hci_dev_lock(hdev); 5533 5534 cmd = pending_find(MGMT_OP_STOP_DISCOVERY, hdev); 5535 if (cmd) { 5536 cmd->cmd_complete(cmd, mgmt_status(status)); 5537 mgmt_pending_remove(cmd); 5538 } 5539 5540 hci_dev_unlock(hdev); 5541 } 5542 5543 static void stop_discovery_complete(struct hci_dev *hdev, void *data, int err) 5544 { 5545 struct mgmt_pending_cmd *cmd = data; 5546 5547 if (cmd != pending_find(MGMT_OP_STOP_DISCOVERY, hdev)) 5548 return; 5549 5550 bt_dev_dbg(hdev, "err %d", err); 5551 5552 mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, mgmt_status(err), 5553 cmd->param, 1); 5554 mgmt_pending_remove(cmd); 5555 5556 if (!err) 5557 hci_discovery_set_state(hdev, DISCOVERY_STOPPED); 5558 } 5559 5560 static int stop_discovery_sync(struct hci_dev *hdev, void *data) 5561 { 5562 return hci_stop_discovery_sync(hdev); 5563 } 5564 5565 static int stop_discovery(struct sock *sk, struct hci_dev *hdev, void *data, 5566 u16 len) 5567 { 5568 struct mgmt_cp_stop_discovery *mgmt_cp = data; 5569 struct mgmt_pending_cmd *cmd; 5570 int err; 5571 5572 bt_dev_dbg(hdev, "sock %p", sk); 5573 5574 hci_dev_lock(hdev); 5575 5576 if (!hci_discovery_active(hdev)) { 5577 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY, 5578 MGMT_STATUS_REJECTED, &mgmt_cp->type, 5579 sizeof(mgmt_cp->type)); 5580 goto unlock; 5581 } 5582 5583 if (hdev->discovery.type != mgmt_cp->type) { 5584 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY, 5585 MGMT_STATUS_INVALID_PARAMS, 5586 &mgmt_cp->type, sizeof(mgmt_cp->type)); 5587 goto unlock; 5588 } 5589 5590 cmd = mgmt_pending_add(sk, MGMT_OP_STOP_DISCOVERY, hdev, data, len); 5591 if (!cmd) { 5592 err = -ENOMEM; 5593 goto unlock; 5594 } 5595 5596 err = hci_cmd_sync_queue(hdev, stop_discovery_sync, cmd, 5597 stop_discovery_complete); 5598 if (err < 0) { 5599 mgmt_pending_remove(cmd); 5600 goto unlock; 5601 } 5602 5603 hci_discovery_set_state(hdev, DISCOVERY_STOPPING); 5604 5605 unlock: 5606 hci_dev_unlock(hdev); 5607 return err; 5608 } 5609 5610 static int confirm_name(struct sock *sk, struct hci_dev *hdev, void *data, 5611 u16 len) 5612 { 5613 struct mgmt_cp_confirm_name *cp = data; 5614 struct inquiry_entry *e; 5615 int err; 5616 5617 bt_dev_dbg(hdev, "sock %p", sk); 5618 5619 hci_dev_lock(hdev); 5620 5621 if (!hci_discovery_active(hdev)) { 5622 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME, 5623 MGMT_STATUS_FAILED, &cp->addr, 5624 sizeof(cp->addr)); 5625 goto failed; 5626 } 5627 5628 e = hci_inquiry_cache_lookup_unknown(hdev, &cp->addr.bdaddr); 5629 if (!e) { 5630 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME, 5631 MGMT_STATUS_INVALID_PARAMS, &cp->addr, 5632 sizeof(cp->addr)); 5633 goto failed; 5634 } 5635 5636 if (cp->name_known) { 5637 e->name_state = NAME_KNOWN; 5638 list_del(&e->list); 5639 } else { 5640 e->name_state = NAME_NEEDED; 5641 hci_inquiry_cache_update_resolve(hdev, e); 5642 } 5643 5644 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME, 0, 5645 &cp->addr, sizeof(cp->addr)); 5646 5647 failed: 5648 hci_dev_unlock(hdev); 5649 return err; 5650 } 5651 5652 static int block_device(struct sock *sk, struct hci_dev *hdev, void *data, 5653 u16 len) 5654 { 5655 struct mgmt_cp_block_device *cp = data; 5656 u8 status; 5657 int err; 5658 5659 bt_dev_dbg(hdev, "sock %p", sk); 5660 5661 if (!bdaddr_type_is_valid(cp->addr.type)) 5662 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_BLOCK_DEVICE, 5663 MGMT_STATUS_INVALID_PARAMS, 5664 &cp->addr, sizeof(cp->addr)); 5665 5666 hci_dev_lock(hdev); 5667 5668 err = hci_bdaddr_list_add(&hdev->reject_list, &cp->addr.bdaddr, 5669 cp->addr.type); 5670 if (err < 0) { 5671 status = MGMT_STATUS_FAILED; 5672 goto done; 5673 } 5674 5675 mgmt_event(MGMT_EV_DEVICE_BLOCKED, hdev, &cp->addr, sizeof(cp->addr), 5676 sk); 5677 status = MGMT_STATUS_SUCCESS; 5678 5679 done: 5680 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_BLOCK_DEVICE, status, 5681 &cp->addr, sizeof(cp->addr)); 5682 5683 hci_dev_unlock(hdev); 5684 5685 return err; 5686 } 5687 5688 static int unblock_device(struct sock *sk, struct hci_dev *hdev, void *data, 5689 u16 len) 5690 { 5691 struct mgmt_cp_unblock_device *cp = data; 5692 u8 status; 5693 int err; 5694 5695 bt_dev_dbg(hdev, "sock %p", sk); 5696 5697 if (!bdaddr_type_is_valid(cp->addr.type)) 5698 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNBLOCK_DEVICE, 5699 MGMT_STATUS_INVALID_PARAMS, 5700 &cp->addr, sizeof(cp->addr)); 5701 5702 hci_dev_lock(hdev); 5703 5704 err = hci_bdaddr_list_del(&hdev->reject_list, &cp->addr.bdaddr, 5705 cp->addr.type); 5706 if (err < 0) { 5707 status = MGMT_STATUS_INVALID_PARAMS; 5708 goto done; 5709 } 5710 5711 mgmt_event(MGMT_EV_DEVICE_UNBLOCKED, hdev, &cp->addr, sizeof(cp->addr), 5712 sk); 5713 status = MGMT_STATUS_SUCCESS; 5714 5715 done: 5716 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNBLOCK_DEVICE, status, 5717 &cp->addr, sizeof(cp->addr)); 5718 5719 hci_dev_unlock(hdev); 5720 5721 return err; 5722 } 5723 5724 static int set_device_id_sync(struct hci_dev *hdev, void *data) 5725 { 5726 return hci_update_eir_sync(hdev); 5727 } 5728 5729 static int set_device_id(struct sock *sk, struct hci_dev *hdev, void *data, 5730 u16 len) 5731 { 5732 struct mgmt_cp_set_device_id *cp = data; 5733 int err; 5734 __u16 source; 5735 5736 bt_dev_dbg(hdev, "sock %p", sk); 5737 5738 source = __le16_to_cpu(cp->source); 5739 5740 if (source > 0x0002) 5741 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEVICE_ID, 5742 MGMT_STATUS_INVALID_PARAMS); 5743 5744 hci_dev_lock(hdev); 5745 5746 hdev->devid_source = source; 5747 hdev->devid_vendor = __le16_to_cpu(cp->vendor); 5748 hdev->devid_product = __le16_to_cpu(cp->product); 5749 hdev->devid_version = __le16_to_cpu(cp->version); 5750 5751 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_DEVICE_ID, 0, 5752 NULL, 0); 5753 5754 hci_cmd_sync_queue(hdev, set_device_id_sync, NULL, NULL); 5755 5756 hci_dev_unlock(hdev); 5757 5758 return err; 5759 } 5760 5761 static void enable_advertising_instance(struct hci_dev *hdev, int err) 5762 { 5763 if (err) 5764 bt_dev_err(hdev, "failed to re-configure advertising %d", err); 5765 else 5766 bt_dev_dbg(hdev, "status %d", err); 5767 } 5768 5769 static void set_advertising_complete(struct hci_dev *hdev, void *data, int err) 5770 { 5771 struct cmd_lookup match = { NULL, hdev }; 5772 u8 instance; 5773 struct adv_info *adv_instance; 5774 u8 status = mgmt_status(err); 5775 5776 if (status) { 5777 mgmt_pending_foreach(MGMT_OP_SET_ADVERTISING, hdev, 5778 cmd_status_rsp, &status); 5779 return; 5780 } 5781 5782 if (hci_dev_test_flag(hdev, HCI_LE_ADV)) 5783 hci_dev_set_flag(hdev, HCI_ADVERTISING); 5784 else 5785 hci_dev_clear_flag(hdev, HCI_ADVERTISING); 5786 5787 mgmt_pending_foreach(MGMT_OP_SET_ADVERTISING, hdev, settings_rsp, 5788 &match); 5789 5790 new_settings(hdev, match.sk); 5791 5792 if (match.sk) 5793 sock_put(match.sk); 5794 5795 /* If "Set Advertising" was just disabled and instance advertising was 5796 * set up earlier, then re-enable multi-instance advertising. 5797 */ 5798 if (hci_dev_test_flag(hdev, HCI_ADVERTISING) || 5799 list_empty(&hdev->adv_instances)) 5800 return; 5801 5802 instance = hdev->cur_adv_instance; 5803 if (!instance) { 5804 adv_instance = list_first_entry_or_null(&hdev->adv_instances, 5805 struct adv_info, list); 5806 if (!adv_instance) 5807 return; 5808 5809 instance = adv_instance->instance; 5810 } 5811 5812 err = hci_schedule_adv_instance_sync(hdev, instance, true); 5813 5814 enable_advertising_instance(hdev, err); 5815 } 5816 5817 static int set_adv_sync(struct hci_dev *hdev, void *data) 5818 { 5819 struct mgmt_pending_cmd *cmd = data; 5820 struct mgmt_mode *cp = cmd->param; 5821 u8 val = !!cp->val; 5822 5823 if (cp->val == 0x02) 5824 hci_dev_set_flag(hdev, HCI_ADVERTISING_CONNECTABLE); 5825 else 5826 hci_dev_clear_flag(hdev, HCI_ADVERTISING_CONNECTABLE); 5827 5828 cancel_adv_timeout(hdev); 5829 5830 if (val) { 5831 /* Switch to instance "0" for the Set Advertising setting. 5832 * We cannot use update_[adv|scan_rsp]_data() here as the 5833 * HCI_ADVERTISING flag is not yet set. 5834 */ 5835 hdev->cur_adv_instance = 0x00; 5836 5837 if (ext_adv_capable(hdev)) { 5838 hci_start_ext_adv_sync(hdev, 0x00); 5839 } else { 5840 hci_update_adv_data_sync(hdev, 0x00); 5841 hci_update_scan_rsp_data_sync(hdev, 0x00); 5842 hci_enable_advertising_sync(hdev); 5843 } 5844 } else { 5845 hci_disable_advertising_sync(hdev); 5846 } 5847 5848 return 0; 5849 } 5850 5851 static int set_advertising(struct sock *sk, struct hci_dev *hdev, void *data, 5852 u16 len) 5853 { 5854 struct mgmt_mode *cp = data; 5855 struct mgmt_pending_cmd *cmd; 5856 u8 val, status; 5857 int err; 5858 5859 bt_dev_dbg(hdev, "sock %p", sk); 5860 5861 status = mgmt_le_support(hdev); 5862 if (status) 5863 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING, 5864 status); 5865 5866 if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02) 5867 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING, 5868 MGMT_STATUS_INVALID_PARAMS); 5869 5870 if (hdev->advertising_paused) 5871 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING, 5872 MGMT_STATUS_BUSY); 5873 5874 hci_dev_lock(hdev); 5875 5876 val = !!cp->val; 5877 5878 /* The following conditions are ones which mean that we should 5879 * not do any HCI communication but directly send a mgmt 5880 * response to user space (after toggling the flag if 5881 * necessary). 5882 */ 5883 if (!hdev_is_powered(hdev) || 5884 (val == hci_dev_test_flag(hdev, HCI_ADVERTISING) && 5885 (cp->val == 0x02) == hci_dev_test_flag(hdev, HCI_ADVERTISING_CONNECTABLE)) || 5886 hci_conn_num(hdev, LE_LINK) > 0 || 5887 (hci_dev_test_flag(hdev, HCI_LE_SCAN) && 5888 hdev->le_scan_type == LE_SCAN_ACTIVE)) { 5889 bool changed; 5890 5891 if (cp->val) { 5892 hdev->cur_adv_instance = 0x00; 5893 changed = !hci_dev_test_and_set_flag(hdev, HCI_ADVERTISING); 5894 if (cp->val == 0x02) 5895 hci_dev_set_flag(hdev, HCI_ADVERTISING_CONNECTABLE); 5896 else 5897 hci_dev_clear_flag(hdev, HCI_ADVERTISING_CONNECTABLE); 5898 } else { 5899 changed = hci_dev_test_and_clear_flag(hdev, HCI_ADVERTISING); 5900 hci_dev_clear_flag(hdev, HCI_ADVERTISING_CONNECTABLE); 5901 } 5902 5903 err = send_settings_rsp(sk, MGMT_OP_SET_ADVERTISING, hdev); 5904 if (err < 0) 5905 goto unlock; 5906 5907 if (changed) 5908 err = new_settings(hdev, sk); 5909 5910 goto unlock; 5911 } 5912 5913 if (pending_find(MGMT_OP_SET_ADVERTISING, hdev) || 5914 pending_find(MGMT_OP_SET_LE, hdev)) { 5915 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING, 5916 MGMT_STATUS_BUSY); 5917 goto unlock; 5918 } 5919 5920 cmd = mgmt_pending_add(sk, MGMT_OP_SET_ADVERTISING, hdev, data, len); 5921 if (!cmd) 5922 err = -ENOMEM; 5923 else 5924 err = hci_cmd_sync_queue(hdev, set_adv_sync, cmd, 5925 set_advertising_complete); 5926 5927 if (err < 0 && cmd) 5928 mgmt_pending_remove(cmd); 5929 5930 unlock: 5931 hci_dev_unlock(hdev); 5932 return err; 5933 } 5934 5935 static int set_static_address(struct sock *sk, struct hci_dev *hdev, 5936 void *data, u16 len) 5937 { 5938 struct mgmt_cp_set_static_address *cp = data; 5939 int err; 5940 5941 bt_dev_dbg(hdev, "sock %p", sk); 5942 5943 if (!lmp_le_capable(hdev)) 5944 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_STATIC_ADDRESS, 5945 MGMT_STATUS_NOT_SUPPORTED); 5946 5947 if (hdev_is_powered(hdev)) 5948 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_STATIC_ADDRESS, 5949 MGMT_STATUS_REJECTED); 5950 5951 if (bacmp(&cp->bdaddr, BDADDR_ANY)) { 5952 if (!bacmp(&cp->bdaddr, BDADDR_NONE)) 5953 return mgmt_cmd_status(sk, hdev->id, 5954 MGMT_OP_SET_STATIC_ADDRESS, 5955 MGMT_STATUS_INVALID_PARAMS); 5956 5957 /* Two most significant bits shall be set */ 5958 if ((cp->bdaddr.b[5] & 0xc0) != 0xc0) 5959 return mgmt_cmd_status(sk, hdev->id, 5960 MGMT_OP_SET_STATIC_ADDRESS, 5961 MGMT_STATUS_INVALID_PARAMS); 5962 } 5963 5964 hci_dev_lock(hdev); 5965 5966 bacpy(&hdev->static_addr, &cp->bdaddr); 5967 5968 err = send_settings_rsp(sk, MGMT_OP_SET_STATIC_ADDRESS, hdev); 5969 if (err < 0) 5970 goto unlock; 5971 5972 err = new_settings(hdev, sk); 5973 5974 unlock: 5975 hci_dev_unlock(hdev); 5976 return err; 5977 } 5978 5979 static int set_scan_params(struct sock *sk, struct hci_dev *hdev, 5980 void *data, u16 len) 5981 { 5982 struct mgmt_cp_set_scan_params *cp = data; 5983 __u16 interval, window; 5984 int err; 5985 5986 bt_dev_dbg(hdev, "sock %p", sk); 5987 5988 if (!lmp_le_capable(hdev)) 5989 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS, 5990 MGMT_STATUS_NOT_SUPPORTED); 5991 5992 interval = __le16_to_cpu(cp->interval); 5993 5994 if (interval < 0x0004 || interval > 0x4000) 5995 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS, 5996 MGMT_STATUS_INVALID_PARAMS); 5997 5998 window = __le16_to_cpu(cp->window); 5999 6000 if (window < 0x0004 || window > 0x4000) 6001 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS, 6002 MGMT_STATUS_INVALID_PARAMS); 6003 6004 if (window > interval) 6005 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS, 6006 MGMT_STATUS_INVALID_PARAMS); 6007 6008 hci_dev_lock(hdev); 6009 6010 hdev->le_scan_interval = interval; 6011 hdev->le_scan_window = window; 6012 6013 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS, 0, 6014 NULL, 0); 6015 6016 /* If background scan is running, restart it so new parameters are 6017 * loaded. 6018 */ 6019 if (hci_dev_test_flag(hdev, HCI_LE_SCAN) && 6020 hdev->discovery.state == DISCOVERY_STOPPED) 6021 hci_update_passive_scan(hdev); 6022 6023 hci_dev_unlock(hdev); 6024 6025 return err; 6026 } 6027 6028 static void fast_connectable_complete(struct hci_dev *hdev, void *data, int err) 6029 { 6030 struct mgmt_pending_cmd *cmd = data; 6031 6032 bt_dev_dbg(hdev, "err %d", err); 6033 6034 if (err) { 6035 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE, 6036 mgmt_status(err)); 6037 } else { 6038 struct mgmt_mode *cp = cmd->param; 6039 6040 if (cp->val) 6041 hci_dev_set_flag(hdev, HCI_FAST_CONNECTABLE); 6042 else 6043 hci_dev_clear_flag(hdev, HCI_FAST_CONNECTABLE); 6044 6045 send_settings_rsp(cmd->sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev); 6046 new_settings(hdev, cmd->sk); 6047 } 6048 6049 mgmt_pending_free(cmd); 6050 } 6051 6052 static int write_fast_connectable_sync(struct hci_dev *hdev, void *data) 6053 { 6054 struct mgmt_pending_cmd *cmd = data; 6055 struct mgmt_mode *cp = cmd->param; 6056 6057 return hci_write_fast_connectable_sync(hdev, cp->val); 6058 } 6059 6060 static int set_fast_connectable(struct sock *sk, struct hci_dev *hdev, 6061 void *data, u16 len) 6062 { 6063 struct mgmt_mode *cp = data; 6064 struct mgmt_pending_cmd *cmd; 6065 int err; 6066 6067 bt_dev_dbg(hdev, "sock %p", sk); 6068 6069 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) || 6070 hdev->hci_ver < BLUETOOTH_VER_1_2) 6071 return mgmt_cmd_status(sk, hdev->id, 6072 MGMT_OP_SET_FAST_CONNECTABLE, 6073 MGMT_STATUS_NOT_SUPPORTED); 6074 6075 if (cp->val != 0x00 && cp->val != 0x01) 6076 return mgmt_cmd_status(sk, hdev->id, 6077 MGMT_OP_SET_FAST_CONNECTABLE, 6078 MGMT_STATUS_INVALID_PARAMS); 6079 6080 hci_dev_lock(hdev); 6081 6082 if (!!cp->val == hci_dev_test_flag(hdev, HCI_FAST_CONNECTABLE)) { 6083 err = send_settings_rsp(sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev); 6084 goto unlock; 6085 } 6086 6087 if (!hdev_is_powered(hdev)) { 6088 hci_dev_change_flag(hdev, HCI_FAST_CONNECTABLE); 6089 err = send_settings_rsp(sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev); 6090 new_settings(hdev, sk); 6091 goto unlock; 6092 } 6093 6094 cmd = mgmt_pending_new(sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev, data, 6095 len); 6096 if (!cmd) 6097 err = -ENOMEM; 6098 else 6099 err = hci_cmd_sync_queue(hdev, write_fast_connectable_sync, cmd, 6100 fast_connectable_complete); 6101 6102 if (err < 0) { 6103 mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE, 6104 MGMT_STATUS_FAILED); 6105 6106 if (cmd) 6107 mgmt_pending_free(cmd); 6108 } 6109 6110 unlock: 6111 hci_dev_unlock(hdev); 6112 6113 return err; 6114 } 6115 6116 static void set_bredr_complete(struct hci_dev *hdev, void *data, int err) 6117 { 6118 struct mgmt_pending_cmd *cmd = data; 6119 6120 bt_dev_dbg(hdev, "err %d", err); 6121 6122 if (err) { 6123 u8 mgmt_err = mgmt_status(err); 6124 6125 /* We need to restore the flag if related HCI commands 6126 * failed. 6127 */ 6128 hci_dev_clear_flag(hdev, HCI_BREDR_ENABLED); 6129 6130 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err); 6131 } else { 6132 send_settings_rsp(cmd->sk, MGMT_OP_SET_BREDR, hdev); 6133 new_settings(hdev, cmd->sk); 6134 } 6135 6136 mgmt_pending_free(cmd); 6137 } 6138 6139 static int set_bredr_sync(struct hci_dev *hdev, void *data) 6140 { 6141 int status; 6142 6143 status = hci_write_fast_connectable_sync(hdev, false); 6144 6145 if (!status) 6146 status = hci_update_scan_sync(hdev); 6147 6148 /* Since only the advertising data flags will change, there 6149 * is no need to update the scan response data. 6150 */ 6151 if (!status) 6152 status = hci_update_adv_data_sync(hdev, hdev->cur_adv_instance); 6153 6154 return status; 6155 } 6156 6157 static int set_bredr(struct sock *sk, struct hci_dev *hdev, void *data, u16 len) 6158 { 6159 struct mgmt_mode *cp = data; 6160 struct mgmt_pending_cmd *cmd; 6161 int err; 6162 6163 bt_dev_dbg(hdev, "sock %p", sk); 6164 6165 if (!lmp_bredr_capable(hdev) || !lmp_le_capable(hdev)) 6166 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR, 6167 MGMT_STATUS_NOT_SUPPORTED); 6168 6169 if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED)) 6170 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR, 6171 MGMT_STATUS_REJECTED); 6172 6173 if (cp->val != 0x00 && cp->val != 0x01) 6174 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR, 6175 MGMT_STATUS_INVALID_PARAMS); 6176 6177 hci_dev_lock(hdev); 6178 6179 if (cp->val == hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) { 6180 err = send_settings_rsp(sk, MGMT_OP_SET_BREDR, hdev); 6181 goto unlock; 6182 } 6183 6184 if (!hdev_is_powered(hdev)) { 6185 if (!cp->val) { 6186 hci_dev_clear_flag(hdev, HCI_DISCOVERABLE); 6187 hci_dev_clear_flag(hdev, HCI_SSP_ENABLED); 6188 hci_dev_clear_flag(hdev, HCI_LINK_SECURITY); 6189 hci_dev_clear_flag(hdev, HCI_FAST_CONNECTABLE); 6190 hci_dev_clear_flag(hdev, HCI_HS_ENABLED); 6191 } 6192 6193 hci_dev_change_flag(hdev, HCI_BREDR_ENABLED); 6194 6195 err = send_settings_rsp(sk, MGMT_OP_SET_BREDR, hdev); 6196 if (err < 0) 6197 goto unlock; 6198 6199 err = new_settings(hdev, sk); 6200 goto unlock; 6201 } 6202 6203 /* Reject disabling when powered on */ 6204 if (!cp->val) { 6205 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR, 6206 MGMT_STATUS_REJECTED); 6207 goto unlock; 6208 } else { 6209 /* When configuring a dual-mode controller to operate 6210 * with LE only and using a static address, then switching 6211 * BR/EDR back on is not allowed. 6212 * 6213 * Dual-mode controllers shall operate with the public 6214 * address as its identity address for BR/EDR and LE. So 6215 * reject the attempt to create an invalid configuration. 6216 * 6217 * The same restrictions applies when secure connections 6218 * has been enabled. For BR/EDR this is a controller feature 6219 * while for LE it is a host stack feature. This means that 6220 * switching BR/EDR back on when secure connections has been 6221 * enabled is not a supported transaction. 6222 */ 6223 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) && 6224 (bacmp(&hdev->static_addr, BDADDR_ANY) || 6225 hci_dev_test_flag(hdev, HCI_SC_ENABLED))) { 6226 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR, 6227 MGMT_STATUS_REJECTED); 6228 goto unlock; 6229 } 6230 } 6231 6232 cmd = mgmt_pending_new(sk, MGMT_OP_SET_BREDR, hdev, data, len); 6233 if (!cmd) 6234 err = -ENOMEM; 6235 else 6236 err = hci_cmd_sync_queue(hdev, set_bredr_sync, cmd, 6237 set_bredr_complete); 6238 6239 if (err < 0) { 6240 mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR, 6241 MGMT_STATUS_FAILED); 6242 if (cmd) 6243 mgmt_pending_free(cmd); 6244 6245 goto unlock; 6246 } 6247 6248 /* We need to flip the bit already here so that 6249 * hci_req_update_adv_data generates the correct flags. 6250 */ 6251 hci_dev_set_flag(hdev, HCI_BREDR_ENABLED); 6252 6253 unlock: 6254 hci_dev_unlock(hdev); 6255 return err; 6256 } 6257 6258 static void set_secure_conn_complete(struct hci_dev *hdev, void *data, int err) 6259 { 6260 struct mgmt_pending_cmd *cmd = data; 6261 struct mgmt_mode *cp; 6262 6263 bt_dev_dbg(hdev, "err %d", err); 6264 6265 if (err) { 6266 u8 mgmt_err = mgmt_status(err); 6267 6268 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err); 6269 goto done; 6270 } 6271 6272 cp = cmd->param; 6273 6274 switch (cp->val) { 6275 case 0x00: 6276 hci_dev_clear_flag(hdev, HCI_SC_ENABLED); 6277 hci_dev_clear_flag(hdev, HCI_SC_ONLY); 6278 break; 6279 case 0x01: 6280 hci_dev_set_flag(hdev, HCI_SC_ENABLED); 6281 hci_dev_clear_flag(hdev, HCI_SC_ONLY); 6282 break; 6283 case 0x02: 6284 hci_dev_set_flag(hdev, HCI_SC_ENABLED); 6285 hci_dev_set_flag(hdev, HCI_SC_ONLY); 6286 break; 6287 } 6288 6289 send_settings_rsp(cmd->sk, cmd->opcode, hdev); 6290 new_settings(hdev, cmd->sk); 6291 6292 done: 6293 mgmt_pending_free(cmd); 6294 } 6295 6296 static int set_secure_conn_sync(struct hci_dev *hdev, void *data) 6297 { 6298 struct mgmt_pending_cmd *cmd = data; 6299 struct mgmt_mode *cp = cmd->param; 6300 u8 val = !!cp->val; 6301 6302 /* Force write of val */ 6303 hci_dev_set_flag(hdev, HCI_SC_ENABLED); 6304 6305 return hci_write_sc_support_sync(hdev, val); 6306 } 6307 6308 static int set_secure_conn(struct sock *sk, struct hci_dev *hdev, 6309 void *data, u16 len) 6310 { 6311 struct mgmt_mode *cp = data; 6312 struct mgmt_pending_cmd *cmd; 6313 u8 val; 6314 int err; 6315 6316 bt_dev_dbg(hdev, "sock %p", sk); 6317 6318 if (!lmp_sc_capable(hdev) && 6319 !hci_dev_test_flag(hdev, HCI_LE_ENABLED)) 6320 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN, 6321 MGMT_STATUS_NOT_SUPPORTED); 6322 6323 if (hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) && 6324 lmp_sc_capable(hdev) && 6325 !hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) 6326 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN, 6327 MGMT_STATUS_REJECTED); 6328 6329 if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02) 6330 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN, 6331 MGMT_STATUS_INVALID_PARAMS); 6332 6333 hci_dev_lock(hdev); 6334 6335 if (!hdev_is_powered(hdev) || !lmp_sc_capable(hdev) || 6336 !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) { 6337 bool changed; 6338 6339 if (cp->val) { 6340 changed = !hci_dev_test_and_set_flag(hdev, 6341 HCI_SC_ENABLED); 6342 if (cp->val == 0x02) 6343 hci_dev_set_flag(hdev, HCI_SC_ONLY); 6344 else 6345 hci_dev_clear_flag(hdev, HCI_SC_ONLY); 6346 } else { 6347 changed = hci_dev_test_and_clear_flag(hdev, 6348 HCI_SC_ENABLED); 6349 hci_dev_clear_flag(hdev, HCI_SC_ONLY); 6350 } 6351 6352 err = send_settings_rsp(sk, MGMT_OP_SET_SECURE_CONN, hdev); 6353 if (err < 0) 6354 goto failed; 6355 6356 if (changed) 6357 err = new_settings(hdev, sk); 6358 6359 goto failed; 6360 } 6361 6362 val = !!cp->val; 6363 6364 if (val == hci_dev_test_flag(hdev, HCI_SC_ENABLED) && 6365 (cp->val == 0x02) == hci_dev_test_flag(hdev, HCI_SC_ONLY)) { 6366 err = send_settings_rsp(sk, MGMT_OP_SET_SECURE_CONN, hdev); 6367 goto failed; 6368 } 6369 6370 cmd = mgmt_pending_new(sk, MGMT_OP_SET_SECURE_CONN, hdev, data, len); 6371 if (!cmd) 6372 err = -ENOMEM; 6373 else 6374 err = hci_cmd_sync_queue(hdev, set_secure_conn_sync, cmd, 6375 set_secure_conn_complete); 6376 6377 if (err < 0) { 6378 mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN, 6379 MGMT_STATUS_FAILED); 6380 if (cmd) 6381 mgmt_pending_free(cmd); 6382 } 6383 6384 failed: 6385 hci_dev_unlock(hdev); 6386 return err; 6387 } 6388 6389 static int set_debug_keys(struct sock *sk, struct hci_dev *hdev, 6390 void *data, u16 len) 6391 { 6392 struct mgmt_mode *cp = data; 6393 bool changed, use_changed; 6394 int err; 6395 6396 bt_dev_dbg(hdev, "sock %p", sk); 6397 6398 if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02) 6399 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEBUG_KEYS, 6400 MGMT_STATUS_INVALID_PARAMS); 6401 6402 hci_dev_lock(hdev); 6403 6404 if (cp->val) 6405 changed = !hci_dev_test_and_set_flag(hdev, HCI_KEEP_DEBUG_KEYS); 6406 else 6407 changed = hci_dev_test_and_clear_flag(hdev, 6408 HCI_KEEP_DEBUG_KEYS); 6409 6410 if (cp->val == 0x02) 6411 use_changed = !hci_dev_test_and_set_flag(hdev, 6412 HCI_USE_DEBUG_KEYS); 6413 else 6414 use_changed = hci_dev_test_and_clear_flag(hdev, 6415 HCI_USE_DEBUG_KEYS); 6416 6417 if (hdev_is_powered(hdev) && use_changed && 6418 hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) { 6419 u8 mode = (cp->val == 0x02) ? 0x01 : 0x00; 6420 hci_send_cmd(hdev, HCI_OP_WRITE_SSP_DEBUG_MODE, 6421 sizeof(mode), &mode); 6422 } 6423 6424 err = send_settings_rsp(sk, MGMT_OP_SET_DEBUG_KEYS, hdev); 6425 if (err < 0) 6426 goto unlock; 6427 6428 if (changed) 6429 err = new_settings(hdev, sk); 6430 6431 unlock: 6432 hci_dev_unlock(hdev); 6433 return err; 6434 } 6435 6436 static int set_privacy(struct sock *sk, struct hci_dev *hdev, void *cp_data, 6437 u16 len) 6438 { 6439 struct mgmt_cp_set_privacy *cp = cp_data; 6440 bool changed; 6441 int err; 6442 6443 bt_dev_dbg(hdev, "sock %p", sk); 6444 6445 if (!lmp_le_capable(hdev)) 6446 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY, 6447 MGMT_STATUS_NOT_SUPPORTED); 6448 6449 if (cp->privacy != 0x00 && cp->privacy != 0x01 && cp->privacy != 0x02) 6450 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY, 6451 MGMT_STATUS_INVALID_PARAMS); 6452 6453 if (hdev_is_powered(hdev)) 6454 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY, 6455 MGMT_STATUS_REJECTED); 6456 6457 hci_dev_lock(hdev); 6458 6459 /* If user space supports this command it is also expected to 6460 * handle IRKs. Therefore, set the HCI_RPA_RESOLVING flag. 6461 */ 6462 hci_dev_set_flag(hdev, HCI_RPA_RESOLVING); 6463 6464 if (cp->privacy) { 6465 changed = !hci_dev_test_and_set_flag(hdev, HCI_PRIVACY); 6466 memcpy(hdev->irk, cp->irk, sizeof(hdev->irk)); 6467 hci_dev_set_flag(hdev, HCI_RPA_EXPIRED); 6468 hci_adv_instances_set_rpa_expired(hdev, true); 6469 if (cp->privacy == 0x02) 6470 hci_dev_set_flag(hdev, HCI_LIMITED_PRIVACY); 6471 else 6472 hci_dev_clear_flag(hdev, HCI_LIMITED_PRIVACY); 6473 } else { 6474 changed = hci_dev_test_and_clear_flag(hdev, HCI_PRIVACY); 6475 memset(hdev->irk, 0, sizeof(hdev->irk)); 6476 hci_dev_clear_flag(hdev, HCI_RPA_EXPIRED); 6477 hci_adv_instances_set_rpa_expired(hdev, false); 6478 hci_dev_clear_flag(hdev, HCI_LIMITED_PRIVACY); 6479 } 6480 6481 err = send_settings_rsp(sk, MGMT_OP_SET_PRIVACY, hdev); 6482 if (err < 0) 6483 goto unlock; 6484 6485 if (changed) 6486 err = new_settings(hdev, sk); 6487 6488 unlock: 6489 hci_dev_unlock(hdev); 6490 return err; 6491 } 6492 6493 static bool irk_is_valid(struct mgmt_irk_info *irk) 6494 { 6495 switch (irk->addr.type) { 6496 case BDADDR_LE_PUBLIC: 6497 return true; 6498 6499 case BDADDR_LE_RANDOM: 6500 /* Two most significant bits shall be set */ 6501 if ((irk->addr.bdaddr.b[5] & 0xc0) != 0xc0) 6502 return false; 6503 return true; 6504 } 6505 6506 return false; 6507 } 6508 6509 static int load_irks(struct sock *sk, struct hci_dev *hdev, void *cp_data, 6510 u16 len) 6511 { 6512 struct mgmt_cp_load_irks *cp = cp_data; 6513 const u16 max_irk_count = ((U16_MAX - sizeof(*cp)) / 6514 sizeof(struct mgmt_irk_info)); 6515 u16 irk_count, expected_len; 6516 int i, err; 6517 6518 bt_dev_dbg(hdev, "sock %p", sk); 6519 6520 if (!lmp_le_capable(hdev)) 6521 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS, 6522 MGMT_STATUS_NOT_SUPPORTED); 6523 6524 irk_count = __le16_to_cpu(cp->irk_count); 6525 if (irk_count > max_irk_count) { 6526 bt_dev_err(hdev, "load_irks: too big irk_count value %u", 6527 irk_count); 6528 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS, 6529 MGMT_STATUS_INVALID_PARAMS); 6530 } 6531 6532 expected_len = struct_size(cp, irks, irk_count); 6533 if (expected_len != len) { 6534 bt_dev_err(hdev, "load_irks: expected %u bytes, got %u bytes", 6535 expected_len, len); 6536 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS, 6537 MGMT_STATUS_INVALID_PARAMS); 6538 } 6539 6540 bt_dev_dbg(hdev, "irk_count %u", irk_count); 6541 6542 for (i = 0; i < irk_count; i++) { 6543 struct mgmt_irk_info *key = &cp->irks[i]; 6544 6545 if (!irk_is_valid(key)) 6546 return mgmt_cmd_status(sk, hdev->id, 6547 MGMT_OP_LOAD_IRKS, 6548 MGMT_STATUS_INVALID_PARAMS); 6549 } 6550 6551 hci_dev_lock(hdev); 6552 6553 hci_smp_irks_clear(hdev); 6554 6555 for (i = 0; i < irk_count; i++) { 6556 struct mgmt_irk_info *irk = &cp->irks[i]; 6557 6558 if (hci_is_blocked_key(hdev, 6559 HCI_BLOCKED_KEY_TYPE_IRK, 6560 irk->val)) { 6561 bt_dev_warn(hdev, "Skipping blocked IRK for %pMR", 6562 &irk->addr.bdaddr); 6563 continue; 6564 } 6565 6566 hci_add_irk(hdev, &irk->addr.bdaddr, 6567 le_addr_type(irk->addr.type), irk->val, 6568 BDADDR_ANY); 6569 } 6570 6571 hci_dev_set_flag(hdev, HCI_RPA_RESOLVING); 6572 6573 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_IRKS, 0, NULL, 0); 6574 6575 hci_dev_unlock(hdev); 6576 6577 return err; 6578 } 6579 6580 static bool ltk_is_valid(struct mgmt_ltk_info *key) 6581 { 6582 if (key->initiator != 0x00 && key->initiator != 0x01) 6583 return false; 6584 6585 switch (key->addr.type) { 6586 case BDADDR_LE_PUBLIC: 6587 return true; 6588 6589 case BDADDR_LE_RANDOM: 6590 /* Two most significant bits shall be set */ 6591 if ((key->addr.bdaddr.b[5] & 0xc0) != 0xc0) 6592 return false; 6593 return true; 6594 } 6595 6596 return false; 6597 } 6598 6599 static int load_long_term_keys(struct sock *sk, struct hci_dev *hdev, 6600 void *cp_data, u16 len) 6601 { 6602 struct mgmt_cp_load_long_term_keys *cp = cp_data; 6603 const u16 max_key_count = ((U16_MAX - sizeof(*cp)) / 6604 sizeof(struct mgmt_ltk_info)); 6605 u16 key_count, expected_len; 6606 int i, err; 6607 6608 bt_dev_dbg(hdev, "sock %p", sk); 6609 6610 if (!lmp_le_capable(hdev)) 6611 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS, 6612 MGMT_STATUS_NOT_SUPPORTED); 6613 6614 key_count = __le16_to_cpu(cp->key_count); 6615 if (key_count > max_key_count) { 6616 bt_dev_err(hdev, "load_ltks: too big key_count value %u", 6617 key_count); 6618 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS, 6619 MGMT_STATUS_INVALID_PARAMS); 6620 } 6621 6622 expected_len = struct_size(cp, keys, key_count); 6623 if (expected_len != len) { 6624 bt_dev_err(hdev, "load_keys: expected %u bytes, got %u bytes", 6625 expected_len, len); 6626 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS, 6627 MGMT_STATUS_INVALID_PARAMS); 6628 } 6629 6630 bt_dev_dbg(hdev, "key_count %u", key_count); 6631 6632 for (i = 0; i < key_count; i++) { 6633 struct mgmt_ltk_info *key = &cp->keys[i]; 6634 6635 if (!ltk_is_valid(key)) 6636 return mgmt_cmd_status(sk, hdev->id, 6637 MGMT_OP_LOAD_LONG_TERM_KEYS, 6638 MGMT_STATUS_INVALID_PARAMS); 6639 } 6640 6641 hci_dev_lock(hdev); 6642 6643 hci_smp_ltks_clear(hdev); 6644 6645 for (i = 0; i < key_count; i++) { 6646 struct mgmt_ltk_info *key = &cp->keys[i]; 6647 u8 type, authenticated; 6648 6649 if (hci_is_blocked_key(hdev, 6650 HCI_BLOCKED_KEY_TYPE_LTK, 6651 key->val)) { 6652 bt_dev_warn(hdev, "Skipping blocked LTK for %pMR", 6653 &key->addr.bdaddr); 6654 continue; 6655 } 6656 6657 switch (key->type) { 6658 case MGMT_LTK_UNAUTHENTICATED: 6659 authenticated = 0x00; 6660 type = key->initiator ? SMP_LTK : SMP_LTK_RESPONDER; 6661 break; 6662 case MGMT_LTK_AUTHENTICATED: 6663 authenticated = 0x01; 6664 type = key->initiator ? SMP_LTK : SMP_LTK_RESPONDER; 6665 break; 6666 case MGMT_LTK_P256_UNAUTH: 6667 authenticated = 0x00; 6668 type = SMP_LTK_P256; 6669 break; 6670 case MGMT_LTK_P256_AUTH: 6671 authenticated = 0x01; 6672 type = SMP_LTK_P256; 6673 break; 6674 case MGMT_LTK_P256_DEBUG: 6675 authenticated = 0x00; 6676 type = SMP_LTK_P256_DEBUG; 6677 fallthrough; 6678 default: 6679 continue; 6680 } 6681 6682 hci_add_ltk(hdev, &key->addr.bdaddr, 6683 le_addr_type(key->addr.type), type, authenticated, 6684 key->val, key->enc_size, key->ediv, key->rand); 6685 } 6686 6687 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS, 0, 6688 NULL, 0); 6689 6690 hci_dev_unlock(hdev); 6691 6692 return err; 6693 } 6694 6695 static void get_conn_info_complete(struct hci_dev *hdev, void *data, int err) 6696 { 6697 struct mgmt_pending_cmd *cmd = data; 6698 struct hci_conn *conn = cmd->user_data; 6699 struct mgmt_cp_get_conn_info *cp = cmd->param; 6700 struct mgmt_rp_get_conn_info rp; 6701 u8 status; 6702 6703 bt_dev_dbg(hdev, "err %d", err); 6704 6705 memcpy(&rp.addr, &cp->addr.bdaddr, sizeof(rp.addr)); 6706 6707 status = mgmt_status(err); 6708 if (status == MGMT_STATUS_SUCCESS) { 6709 rp.rssi = conn->rssi; 6710 rp.tx_power = conn->tx_power; 6711 rp.max_tx_power = conn->max_tx_power; 6712 } else { 6713 rp.rssi = HCI_RSSI_INVALID; 6714 rp.tx_power = HCI_TX_POWER_INVALID; 6715 rp.max_tx_power = HCI_TX_POWER_INVALID; 6716 } 6717 6718 mgmt_cmd_complete(cmd->sk, cmd->index, MGMT_OP_GET_CONN_INFO, status, 6719 &rp, sizeof(rp)); 6720 6721 if (conn) { 6722 hci_conn_drop(conn); 6723 hci_conn_put(conn); 6724 } 6725 6726 mgmt_pending_free(cmd); 6727 } 6728 6729 static int get_conn_info_sync(struct hci_dev *hdev, void *data) 6730 { 6731 struct mgmt_pending_cmd *cmd = data; 6732 struct mgmt_cp_get_conn_info *cp = cmd->param; 6733 struct hci_conn *conn; 6734 int err; 6735 __le16 handle; 6736 6737 /* Make sure we are still connected */ 6738 if (cp->addr.type == BDADDR_BREDR) 6739 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, 6740 &cp->addr.bdaddr); 6741 else 6742 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &cp->addr.bdaddr); 6743 6744 if (!conn || conn != cmd->user_data || conn->state != BT_CONNECTED) { 6745 if (cmd->user_data) { 6746 hci_conn_drop(cmd->user_data); 6747 hci_conn_put(cmd->user_data); 6748 cmd->user_data = NULL; 6749 } 6750 return MGMT_STATUS_NOT_CONNECTED; 6751 } 6752 6753 handle = cpu_to_le16(conn->handle); 6754 6755 /* Refresh RSSI each time */ 6756 err = hci_read_rssi_sync(hdev, handle); 6757 6758 /* For LE links TX power does not change thus we don't need to 6759 * query for it once value is known. 6760 */ 6761 if (!err && (!bdaddr_type_is_le(cp->addr.type) || 6762 conn->tx_power == HCI_TX_POWER_INVALID)) 6763 err = hci_read_tx_power_sync(hdev, handle, 0x00); 6764 6765 /* Max TX power needs to be read only once per connection */ 6766 if (!err && conn->max_tx_power == HCI_TX_POWER_INVALID) 6767 err = hci_read_tx_power_sync(hdev, handle, 0x01); 6768 6769 return err; 6770 } 6771 6772 static int get_conn_info(struct sock *sk, struct hci_dev *hdev, void *data, 6773 u16 len) 6774 { 6775 struct mgmt_cp_get_conn_info *cp = data; 6776 struct mgmt_rp_get_conn_info rp; 6777 struct hci_conn *conn; 6778 unsigned long conn_info_age; 6779 int err = 0; 6780 6781 bt_dev_dbg(hdev, "sock %p", sk); 6782 6783 memset(&rp, 0, sizeof(rp)); 6784 bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr); 6785 rp.addr.type = cp->addr.type; 6786 6787 if (!bdaddr_type_is_valid(cp->addr.type)) 6788 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO, 6789 MGMT_STATUS_INVALID_PARAMS, 6790 &rp, sizeof(rp)); 6791 6792 hci_dev_lock(hdev); 6793 6794 if (!hdev_is_powered(hdev)) { 6795 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO, 6796 MGMT_STATUS_NOT_POWERED, &rp, 6797 sizeof(rp)); 6798 goto unlock; 6799 } 6800 6801 if (cp->addr.type == BDADDR_BREDR) 6802 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, 6803 &cp->addr.bdaddr); 6804 else 6805 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &cp->addr.bdaddr); 6806 6807 if (!conn || conn->state != BT_CONNECTED) { 6808 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO, 6809 MGMT_STATUS_NOT_CONNECTED, &rp, 6810 sizeof(rp)); 6811 goto unlock; 6812 } 6813 6814 /* To avoid client trying to guess when to poll again for information we 6815 * calculate conn info age as random value between min/max set in hdev. 6816 */ 6817 conn_info_age = hdev->conn_info_min_age + 6818 prandom_u32_max(hdev->conn_info_max_age - 6819 hdev->conn_info_min_age); 6820 6821 /* Query controller to refresh cached values if they are too old or were 6822 * never read. 6823 */ 6824 if (time_after(jiffies, conn->conn_info_timestamp + 6825 msecs_to_jiffies(conn_info_age)) || 6826 !conn->conn_info_timestamp) { 6827 struct mgmt_pending_cmd *cmd; 6828 6829 cmd = mgmt_pending_new(sk, MGMT_OP_GET_CONN_INFO, hdev, data, 6830 len); 6831 if (!cmd) 6832 err = -ENOMEM; 6833 else 6834 err = hci_cmd_sync_queue(hdev, get_conn_info_sync, 6835 cmd, get_conn_info_complete); 6836 6837 if (err < 0) { 6838 mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO, 6839 MGMT_STATUS_FAILED, &rp, sizeof(rp)); 6840 6841 if (cmd) 6842 mgmt_pending_free(cmd); 6843 6844 goto unlock; 6845 } 6846 6847 hci_conn_hold(conn); 6848 cmd->user_data = hci_conn_get(conn); 6849 6850 conn->conn_info_timestamp = jiffies; 6851 } else { 6852 /* Cache is valid, just reply with values cached in hci_conn */ 6853 rp.rssi = conn->rssi; 6854 rp.tx_power = conn->tx_power; 6855 rp.max_tx_power = conn->max_tx_power; 6856 6857 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO, 6858 MGMT_STATUS_SUCCESS, &rp, sizeof(rp)); 6859 } 6860 6861 unlock: 6862 hci_dev_unlock(hdev); 6863 return err; 6864 } 6865 6866 static void get_clock_info_complete(struct hci_dev *hdev, void *data, int err) 6867 { 6868 struct mgmt_pending_cmd *cmd = data; 6869 struct mgmt_cp_get_clock_info *cp = cmd->param; 6870 struct mgmt_rp_get_clock_info rp; 6871 struct hci_conn *conn = cmd->user_data; 6872 u8 status = mgmt_status(err); 6873 6874 bt_dev_dbg(hdev, "err %d", err); 6875 6876 memset(&rp, 0, sizeof(rp)); 6877 bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr); 6878 rp.addr.type = cp->addr.type; 6879 6880 if (err) 6881 goto complete; 6882 6883 rp.local_clock = cpu_to_le32(hdev->clock); 6884 6885 if (conn) { 6886 rp.piconet_clock = cpu_to_le32(conn->clock); 6887 rp.accuracy = cpu_to_le16(conn->clock_accuracy); 6888 hci_conn_drop(conn); 6889 hci_conn_put(conn); 6890 } 6891 6892 complete: 6893 mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, status, &rp, 6894 sizeof(rp)); 6895 6896 mgmt_pending_free(cmd); 6897 } 6898 6899 static int get_clock_info_sync(struct hci_dev *hdev, void *data) 6900 { 6901 struct mgmt_pending_cmd *cmd = data; 6902 struct mgmt_cp_get_clock_info *cp = cmd->param; 6903 struct hci_cp_read_clock hci_cp; 6904 struct hci_conn *conn = cmd->user_data; 6905 int err; 6906 6907 memset(&hci_cp, 0, sizeof(hci_cp)); 6908 err = hci_read_clock_sync(hdev, &hci_cp); 6909 6910 if (conn) { 6911 /* Make sure connection still exists */ 6912 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, 6913 &cp->addr.bdaddr); 6914 6915 if (conn && conn == cmd->user_data && 6916 conn->state == BT_CONNECTED) { 6917 hci_cp.handle = cpu_to_le16(conn->handle); 6918 hci_cp.which = 0x01; /* Piconet clock */ 6919 err = hci_read_clock_sync(hdev, &hci_cp); 6920 } else if (cmd->user_data) { 6921 hci_conn_drop(cmd->user_data); 6922 hci_conn_put(cmd->user_data); 6923 cmd->user_data = NULL; 6924 } 6925 } 6926 6927 return err; 6928 } 6929 6930 static int get_clock_info(struct sock *sk, struct hci_dev *hdev, void *data, 6931 u16 len) 6932 { 6933 struct mgmt_cp_get_clock_info *cp = data; 6934 struct mgmt_rp_get_clock_info rp; 6935 struct mgmt_pending_cmd *cmd; 6936 struct hci_conn *conn; 6937 int err; 6938 6939 bt_dev_dbg(hdev, "sock %p", sk); 6940 6941 memset(&rp, 0, sizeof(rp)); 6942 bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr); 6943 rp.addr.type = cp->addr.type; 6944 6945 if (cp->addr.type != BDADDR_BREDR) 6946 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CLOCK_INFO, 6947 MGMT_STATUS_INVALID_PARAMS, 6948 &rp, sizeof(rp)); 6949 6950 hci_dev_lock(hdev); 6951 6952 if (!hdev_is_powered(hdev)) { 6953 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CLOCK_INFO, 6954 MGMT_STATUS_NOT_POWERED, &rp, 6955 sizeof(rp)); 6956 goto unlock; 6957 } 6958 6959 if (bacmp(&cp->addr.bdaddr, BDADDR_ANY)) { 6960 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, 6961 &cp->addr.bdaddr); 6962 if (!conn || conn->state != BT_CONNECTED) { 6963 err = mgmt_cmd_complete(sk, hdev->id, 6964 MGMT_OP_GET_CLOCK_INFO, 6965 MGMT_STATUS_NOT_CONNECTED, 6966 &rp, sizeof(rp)); 6967 goto unlock; 6968 } 6969 } else { 6970 conn = NULL; 6971 } 6972 6973 cmd = mgmt_pending_new(sk, MGMT_OP_GET_CLOCK_INFO, hdev, data, len); 6974 if (!cmd) 6975 err = -ENOMEM; 6976 else 6977 err = hci_cmd_sync_queue(hdev, get_clock_info_sync, cmd, 6978 get_clock_info_complete); 6979 6980 if (err < 0) { 6981 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CLOCK_INFO, 6982 MGMT_STATUS_FAILED, &rp, sizeof(rp)); 6983 6984 if (cmd) 6985 mgmt_pending_free(cmd); 6986 6987 } else if (conn) { 6988 hci_conn_hold(conn); 6989 cmd->user_data = hci_conn_get(conn); 6990 } 6991 6992 6993 unlock: 6994 hci_dev_unlock(hdev); 6995 return err; 6996 } 6997 6998 static bool is_connected(struct hci_dev *hdev, bdaddr_t *addr, u8 type) 6999 { 7000 struct hci_conn *conn; 7001 7002 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, addr); 7003 if (!conn) 7004 return false; 7005 7006 if (conn->dst_type != type) 7007 return false; 7008 7009 if (conn->state != BT_CONNECTED) 7010 return false; 7011 7012 return true; 7013 } 7014 7015 /* This function requires the caller holds hdev->lock */ 7016 static int hci_conn_params_set(struct hci_dev *hdev, bdaddr_t *addr, 7017 u8 addr_type, u8 auto_connect) 7018 { 7019 struct hci_conn_params *params; 7020 7021 params = hci_conn_params_add(hdev, addr, addr_type); 7022 if (!params) 7023 return -EIO; 7024 7025 if (params->auto_connect == auto_connect) 7026 return 0; 7027 7028 list_del_init(¶ms->action); 7029 7030 switch (auto_connect) { 7031 case HCI_AUTO_CONN_DISABLED: 7032 case HCI_AUTO_CONN_LINK_LOSS: 7033 /* If auto connect is being disabled when we're trying to 7034 * connect to device, keep connecting. 7035 */ 7036 if (params->explicit_connect) 7037 list_add(¶ms->action, &hdev->pend_le_conns); 7038 break; 7039 case HCI_AUTO_CONN_REPORT: 7040 if (params->explicit_connect) 7041 list_add(¶ms->action, &hdev->pend_le_conns); 7042 else 7043 list_add(¶ms->action, &hdev->pend_le_reports); 7044 break; 7045 case HCI_AUTO_CONN_DIRECT: 7046 case HCI_AUTO_CONN_ALWAYS: 7047 if (!is_connected(hdev, addr, addr_type)) 7048 list_add(¶ms->action, &hdev->pend_le_conns); 7049 break; 7050 } 7051 7052 params->auto_connect = auto_connect; 7053 7054 bt_dev_dbg(hdev, "addr %pMR (type %u) auto_connect %u", 7055 addr, addr_type, auto_connect); 7056 7057 return 0; 7058 } 7059 7060 static void device_added(struct sock *sk, struct hci_dev *hdev, 7061 bdaddr_t *bdaddr, u8 type, u8 action) 7062 { 7063 struct mgmt_ev_device_added ev; 7064 7065 bacpy(&ev.addr.bdaddr, bdaddr); 7066 ev.addr.type = type; 7067 ev.action = action; 7068 7069 mgmt_event(MGMT_EV_DEVICE_ADDED, hdev, &ev, sizeof(ev), sk); 7070 } 7071 7072 static int add_device_sync(struct hci_dev *hdev, void *data) 7073 { 7074 return hci_update_passive_scan_sync(hdev); 7075 } 7076 7077 static int add_device(struct sock *sk, struct hci_dev *hdev, 7078 void *data, u16 len) 7079 { 7080 struct mgmt_cp_add_device *cp = data; 7081 u8 auto_conn, addr_type; 7082 struct hci_conn_params *params; 7083 int err; 7084 u32 current_flags = 0; 7085 u32 supported_flags; 7086 7087 bt_dev_dbg(hdev, "sock %p", sk); 7088 7089 if (!bdaddr_type_is_valid(cp->addr.type) || 7090 !bacmp(&cp->addr.bdaddr, BDADDR_ANY)) 7091 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE, 7092 MGMT_STATUS_INVALID_PARAMS, 7093 &cp->addr, sizeof(cp->addr)); 7094 7095 if (cp->action != 0x00 && cp->action != 0x01 && cp->action != 0x02) 7096 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE, 7097 MGMT_STATUS_INVALID_PARAMS, 7098 &cp->addr, sizeof(cp->addr)); 7099 7100 hci_dev_lock(hdev); 7101 7102 if (cp->addr.type == BDADDR_BREDR) { 7103 /* Only incoming connections action is supported for now */ 7104 if (cp->action != 0x01) { 7105 err = mgmt_cmd_complete(sk, hdev->id, 7106 MGMT_OP_ADD_DEVICE, 7107 MGMT_STATUS_INVALID_PARAMS, 7108 &cp->addr, sizeof(cp->addr)); 7109 goto unlock; 7110 } 7111 7112 err = hci_bdaddr_list_add_with_flags(&hdev->accept_list, 7113 &cp->addr.bdaddr, 7114 cp->addr.type, 0); 7115 if (err) 7116 goto unlock; 7117 7118 hci_req_update_scan(hdev); 7119 7120 goto added; 7121 } 7122 7123 addr_type = le_addr_type(cp->addr.type); 7124 7125 if (cp->action == 0x02) 7126 auto_conn = HCI_AUTO_CONN_ALWAYS; 7127 else if (cp->action == 0x01) 7128 auto_conn = HCI_AUTO_CONN_DIRECT; 7129 else 7130 auto_conn = HCI_AUTO_CONN_REPORT; 7131 7132 /* Kernel internally uses conn_params with resolvable private 7133 * address, but Add Device allows only identity addresses. 7134 * Make sure it is enforced before calling 7135 * hci_conn_params_lookup. 7136 */ 7137 if (!hci_is_identity_address(&cp->addr.bdaddr, addr_type)) { 7138 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE, 7139 MGMT_STATUS_INVALID_PARAMS, 7140 &cp->addr, sizeof(cp->addr)); 7141 goto unlock; 7142 } 7143 7144 /* If the connection parameters don't exist for this device, 7145 * they will be created and configured with defaults. 7146 */ 7147 if (hci_conn_params_set(hdev, &cp->addr.bdaddr, addr_type, 7148 auto_conn) < 0) { 7149 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE, 7150 MGMT_STATUS_FAILED, &cp->addr, 7151 sizeof(cp->addr)); 7152 goto unlock; 7153 } else { 7154 params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr, 7155 addr_type); 7156 if (params) 7157 bitmap_to_arr32(¤t_flags, params->flags, 7158 __HCI_CONN_NUM_FLAGS); 7159 } 7160 7161 err = hci_cmd_sync_queue(hdev, add_device_sync, NULL, NULL); 7162 if (err < 0) 7163 goto unlock; 7164 7165 added: 7166 device_added(sk, hdev, &cp->addr.bdaddr, cp->addr.type, cp->action); 7167 bitmap_to_arr32(&supported_flags, hdev->conn_flags, 7168 __HCI_CONN_NUM_FLAGS); 7169 device_flags_changed(NULL, hdev, &cp->addr.bdaddr, cp->addr.type, 7170 supported_flags, current_flags); 7171 7172 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE, 7173 MGMT_STATUS_SUCCESS, &cp->addr, 7174 sizeof(cp->addr)); 7175 7176 unlock: 7177 hci_dev_unlock(hdev); 7178 return err; 7179 } 7180 7181 static void device_removed(struct sock *sk, struct hci_dev *hdev, 7182 bdaddr_t *bdaddr, u8 type) 7183 { 7184 struct mgmt_ev_device_removed ev; 7185 7186 bacpy(&ev.addr.bdaddr, bdaddr); 7187 ev.addr.type = type; 7188 7189 mgmt_event(MGMT_EV_DEVICE_REMOVED, hdev, &ev, sizeof(ev), sk); 7190 } 7191 7192 static int remove_device_sync(struct hci_dev *hdev, void *data) 7193 { 7194 return hci_update_passive_scan_sync(hdev); 7195 } 7196 7197 static int remove_device(struct sock *sk, struct hci_dev *hdev, 7198 void *data, u16 len) 7199 { 7200 struct mgmt_cp_remove_device *cp = data; 7201 int err; 7202 7203 bt_dev_dbg(hdev, "sock %p", sk); 7204 7205 hci_dev_lock(hdev); 7206 7207 if (bacmp(&cp->addr.bdaddr, BDADDR_ANY)) { 7208 struct hci_conn_params *params; 7209 u8 addr_type; 7210 7211 if (!bdaddr_type_is_valid(cp->addr.type)) { 7212 err = mgmt_cmd_complete(sk, hdev->id, 7213 MGMT_OP_REMOVE_DEVICE, 7214 MGMT_STATUS_INVALID_PARAMS, 7215 &cp->addr, sizeof(cp->addr)); 7216 goto unlock; 7217 } 7218 7219 if (cp->addr.type == BDADDR_BREDR) { 7220 err = hci_bdaddr_list_del(&hdev->accept_list, 7221 &cp->addr.bdaddr, 7222 cp->addr.type); 7223 if (err) { 7224 err = mgmt_cmd_complete(sk, hdev->id, 7225 MGMT_OP_REMOVE_DEVICE, 7226 MGMT_STATUS_INVALID_PARAMS, 7227 &cp->addr, 7228 sizeof(cp->addr)); 7229 goto unlock; 7230 } 7231 7232 hci_req_update_scan(hdev); 7233 7234 device_removed(sk, hdev, &cp->addr.bdaddr, 7235 cp->addr.type); 7236 goto complete; 7237 } 7238 7239 addr_type = le_addr_type(cp->addr.type); 7240 7241 /* Kernel internally uses conn_params with resolvable private 7242 * address, but Remove Device allows only identity addresses. 7243 * Make sure it is enforced before calling 7244 * hci_conn_params_lookup. 7245 */ 7246 if (!hci_is_identity_address(&cp->addr.bdaddr, addr_type)) { 7247 err = mgmt_cmd_complete(sk, hdev->id, 7248 MGMT_OP_REMOVE_DEVICE, 7249 MGMT_STATUS_INVALID_PARAMS, 7250 &cp->addr, sizeof(cp->addr)); 7251 goto unlock; 7252 } 7253 7254 params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr, 7255 addr_type); 7256 if (!params) { 7257 err = mgmt_cmd_complete(sk, hdev->id, 7258 MGMT_OP_REMOVE_DEVICE, 7259 MGMT_STATUS_INVALID_PARAMS, 7260 &cp->addr, sizeof(cp->addr)); 7261 goto unlock; 7262 } 7263 7264 if (params->auto_connect == HCI_AUTO_CONN_DISABLED || 7265 params->auto_connect == HCI_AUTO_CONN_EXPLICIT) { 7266 err = mgmt_cmd_complete(sk, hdev->id, 7267 MGMT_OP_REMOVE_DEVICE, 7268 MGMT_STATUS_INVALID_PARAMS, 7269 &cp->addr, sizeof(cp->addr)); 7270 goto unlock; 7271 } 7272 7273 list_del(¶ms->action); 7274 list_del(¶ms->list); 7275 kfree(params); 7276 7277 device_removed(sk, hdev, &cp->addr.bdaddr, cp->addr.type); 7278 } else { 7279 struct hci_conn_params *p, *tmp; 7280 struct bdaddr_list *b, *btmp; 7281 7282 if (cp->addr.type) { 7283 err = mgmt_cmd_complete(sk, hdev->id, 7284 MGMT_OP_REMOVE_DEVICE, 7285 MGMT_STATUS_INVALID_PARAMS, 7286 &cp->addr, sizeof(cp->addr)); 7287 goto unlock; 7288 } 7289 7290 list_for_each_entry_safe(b, btmp, &hdev->accept_list, list) { 7291 device_removed(sk, hdev, &b->bdaddr, b->bdaddr_type); 7292 list_del(&b->list); 7293 kfree(b); 7294 } 7295 7296 hci_req_update_scan(hdev); 7297 7298 list_for_each_entry_safe(p, tmp, &hdev->le_conn_params, list) { 7299 if (p->auto_connect == HCI_AUTO_CONN_DISABLED) 7300 continue; 7301 device_removed(sk, hdev, &p->addr, p->addr_type); 7302 if (p->explicit_connect) { 7303 p->auto_connect = HCI_AUTO_CONN_EXPLICIT; 7304 continue; 7305 } 7306 list_del(&p->action); 7307 list_del(&p->list); 7308 kfree(p); 7309 } 7310 7311 bt_dev_dbg(hdev, "All LE connection parameters were removed"); 7312 } 7313 7314 hci_cmd_sync_queue(hdev, remove_device_sync, NULL, NULL); 7315 7316 complete: 7317 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_DEVICE, 7318 MGMT_STATUS_SUCCESS, &cp->addr, 7319 sizeof(cp->addr)); 7320 unlock: 7321 hci_dev_unlock(hdev); 7322 return err; 7323 } 7324 7325 static int load_conn_param(struct sock *sk, struct hci_dev *hdev, void *data, 7326 u16 len) 7327 { 7328 struct mgmt_cp_load_conn_param *cp = data; 7329 const u16 max_param_count = ((U16_MAX - sizeof(*cp)) / 7330 sizeof(struct mgmt_conn_param)); 7331 u16 param_count, expected_len; 7332 int i; 7333 7334 if (!lmp_le_capable(hdev)) 7335 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM, 7336 MGMT_STATUS_NOT_SUPPORTED); 7337 7338 param_count = __le16_to_cpu(cp->param_count); 7339 if (param_count > max_param_count) { 7340 bt_dev_err(hdev, "load_conn_param: too big param_count value %u", 7341 param_count); 7342 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM, 7343 MGMT_STATUS_INVALID_PARAMS); 7344 } 7345 7346 expected_len = struct_size(cp, params, param_count); 7347 if (expected_len != len) { 7348 bt_dev_err(hdev, "load_conn_param: expected %u bytes, got %u bytes", 7349 expected_len, len); 7350 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM, 7351 MGMT_STATUS_INVALID_PARAMS); 7352 } 7353 7354 bt_dev_dbg(hdev, "param_count %u", param_count); 7355 7356 hci_dev_lock(hdev); 7357 7358 hci_conn_params_clear_disabled(hdev); 7359 7360 for (i = 0; i < param_count; i++) { 7361 struct mgmt_conn_param *param = &cp->params[i]; 7362 struct hci_conn_params *hci_param; 7363 u16 min, max, latency, timeout; 7364 u8 addr_type; 7365 7366 bt_dev_dbg(hdev, "Adding %pMR (type %u)", ¶m->addr.bdaddr, 7367 param->addr.type); 7368 7369 if (param->addr.type == BDADDR_LE_PUBLIC) { 7370 addr_type = ADDR_LE_DEV_PUBLIC; 7371 } else if (param->addr.type == BDADDR_LE_RANDOM) { 7372 addr_type = ADDR_LE_DEV_RANDOM; 7373 } else { 7374 bt_dev_err(hdev, "ignoring invalid connection parameters"); 7375 continue; 7376 } 7377 7378 min = le16_to_cpu(param->min_interval); 7379 max = le16_to_cpu(param->max_interval); 7380 latency = le16_to_cpu(param->latency); 7381 timeout = le16_to_cpu(param->timeout); 7382 7383 bt_dev_dbg(hdev, "min 0x%04x max 0x%04x latency 0x%04x timeout 0x%04x", 7384 min, max, latency, timeout); 7385 7386 if (hci_check_conn_params(min, max, latency, timeout) < 0) { 7387 bt_dev_err(hdev, "ignoring invalid connection parameters"); 7388 continue; 7389 } 7390 7391 hci_param = hci_conn_params_add(hdev, ¶m->addr.bdaddr, 7392 addr_type); 7393 if (!hci_param) { 7394 bt_dev_err(hdev, "failed to add connection parameters"); 7395 continue; 7396 } 7397 7398 hci_param->conn_min_interval = min; 7399 hci_param->conn_max_interval = max; 7400 hci_param->conn_latency = latency; 7401 hci_param->supervision_timeout = timeout; 7402 } 7403 7404 hci_dev_unlock(hdev); 7405 7406 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM, 0, 7407 NULL, 0); 7408 } 7409 7410 static int set_external_config(struct sock *sk, struct hci_dev *hdev, 7411 void *data, u16 len) 7412 { 7413 struct mgmt_cp_set_external_config *cp = data; 7414 bool changed; 7415 int err; 7416 7417 bt_dev_dbg(hdev, "sock %p", sk); 7418 7419 if (hdev_is_powered(hdev)) 7420 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_EXTERNAL_CONFIG, 7421 MGMT_STATUS_REJECTED); 7422 7423 if (cp->config != 0x00 && cp->config != 0x01) 7424 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_EXTERNAL_CONFIG, 7425 MGMT_STATUS_INVALID_PARAMS); 7426 7427 if (!test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks)) 7428 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_EXTERNAL_CONFIG, 7429 MGMT_STATUS_NOT_SUPPORTED); 7430 7431 hci_dev_lock(hdev); 7432 7433 if (cp->config) 7434 changed = !hci_dev_test_and_set_flag(hdev, HCI_EXT_CONFIGURED); 7435 else 7436 changed = hci_dev_test_and_clear_flag(hdev, HCI_EXT_CONFIGURED); 7437 7438 err = send_options_rsp(sk, MGMT_OP_SET_EXTERNAL_CONFIG, hdev); 7439 if (err < 0) 7440 goto unlock; 7441 7442 if (!changed) 7443 goto unlock; 7444 7445 err = new_options(hdev, sk); 7446 7447 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED) == is_configured(hdev)) { 7448 mgmt_index_removed(hdev); 7449 7450 if (hci_dev_test_and_change_flag(hdev, HCI_UNCONFIGURED)) { 7451 hci_dev_set_flag(hdev, HCI_CONFIG); 7452 hci_dev_set_flag(hdev, HCI_AUTO_OFF); 7453 7454 queue_work(hdev->req_workqueue, &hdev->power_on); 7455 } else { 7456 set_bit(HCI_RAW, &hdev->flags); 7457 mgmt_index_added(hdev); 7458 } 7459 } 7460 7461 unlock: 7462 hci_dev_unlock(hdev); 7463 return err; 7464 } 7465 7466 static int set_public_address(struct sock *sk, struct hci_dev *hdev, 7467 void *data, u16 len) 7468 { 7469 struct mgmt_cp_set_public_address *cp = data; 7470 bool changed; 7471 int err; 7472 7473 bt_dev_dbg(hdev, "sock %p", sk); 7474 7475 if (hdev_is_powered(hdev)) 7476 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PUBLIC_ADDRESS, 7477 MGMT_STATUS_REJECTED); 7478 7479 if (!bacmp(&cp->bdaddr, BDADDR_ANY)) 7480 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PUBLIC_ADDRESS, 7481 MGMT_STATUS_INVALID_PARAMS); 7482 7483 if (!hdev->set_bdaddr) 7484 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PUBLIC_ADDRESS, 7485 MGMT_STATUS_NOT_SUPPORTED); 7486 7487 hci_dev_lock(hdev); 7488 7489 changed = !!bacmp(&hdev->public_addr, &cp->bdaddr); 7490 bacpy(&hdev->public_addr, &cp->bdaddr); 7491 7492 err = send_options_rsp(sk, MGMT_OP_SET_PUBLIC_ADDRESS, hdev); 7493 if (err < 0) 7494 goto unlock; 7495 7496 if (!changed) 7497 goto unlock; 7498 7499 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) 7500 err = new_options(hdev, sk); 7501 7502 if (is_configured(hdev)) { 7503 mgmt_index_removed(hdev); 7504 7505 hci_dev_clear_flag(hdev, HCI_UNCONFIGURED); 7506 7507 hci_dev_set_flag(hdev, HCI_CONFIG); 7508 hci_dev_set_flag(hdev, HCI_AUTO_OFF); 7509 7510 queue_work(hdev->req_workqueue, &hdev->power_on); 7511 } 7512 7513 unlock: 7514 hci_dev_unlock(hdev); 7515 return err; 7516 } 7517 7518 static void read_local_oob_ext_data_complete(struct hci_dev *hdev, void *data, 7519 int err) 7520 { 7521 const struct mgmt_cp_read_local_oob_ext_data *mgmt_cp; 7522 struct mgmt_rp_read_local_oob_ext_data *mgmt_rp; 7523 u8 *h192, *r192, *h256, *r256; 7524 struct mgmt_pending_cmd *cmd = data; 7525 struct sk_buff *skb = cmd->skb; 7526 u8 status = mgmt_status(err); 7527 u16 eir_len; 7528 7529 if (cmd != pending_find(MGMT_OP_READ_LOCAL_OOB_EXT_DATA, hdev)) 7530 return; 7531 7532 if (!status) { 7533 if (!skb) 7534 status = MGMT_STATUS_FAILED; 7535 else if (IS_ERR(skb)) 7536 status = mgmt_status(PTR_ERR(skb)); 7537 else 7538 status = mgmt_status(skb->data[0]); 7539 } 7540 7541 bt_dev_dbg(hdev, "status %u", status); 7542 7543 mgmt_cp = cmd->param; 7544 7545 if (status) { 7546 status = mgmt_status(status); 7547 eir_len = 0; 7548 7549 h192 = NULL; 7550 r192 = NULL; 7551 h256 = NULL; 7552 r256 = NULL; 7553 } else if (!bredr_sc_enabled(hdev)) { 7554 struct hci_rp_read_local_oob_data *rp; 7555 7556 if (skb->len != sizeof(*rp)) { 7557 status = MGMT_STATUS_FAILED; 7558 eir_len = 0; 7559 } else { 7560 status = MGMT_STATUS_SUCCESS; 7561 rp = (void *)skb->data; 7562 7563 eir_len = 5 + 18 + 18; 7564 h192 = rp->hash; 7565 r192 = rp->rand; 7566 h256 = NULL; 7567 r256 = NULL; 7568 } 7569 } else { 7570 struct hci_rp_read_local_oob_ext_data *rp; 7571 7572 if (skb->len != sizeof(*rp)) { 7573 status = MGMT_STATUS_FAILED; 7574 eir_len = 0; 7575 } else { 7576 status = MGMT_STATUS_SUCCESS; 7577 rp = (void *)skb->data; 7578 7579 if (hci_dev_test_flag(hdev, HCI_SC_ONLY)) { 7580 eir_len = 5 + 18 + 18; 7581 h192 = NULL; 7582 r192 = NULL; 7583 } else { 7584 eir_len = 5 + 18 + 18 + 18 + 18; 7585 h192 = rp->hash192; 7586 r192 = rp->rand192; 7587 } 7588 7589 h256 = rp->hash256; 7590 r256 = rp->rand256; 7591 } 7592 } 7593 7594 mgmt_rp = kmalloc(sizeof(*mgmt_rp) + eir_len, GFP_KERNEL); 7595 if (!mgmt_rp) 7596 goto done; 7597 7598 if (eir_len == 0) 7599 goto send_rsp; 7600 7601 eir_len = eir_append_data(mgmt_rp->eir, 0, EIR_CLASS_OF_DEV, 7602 hdev->dev_class, 3); 7603 7604 if (h192 && r192) { 7605 eir_len = eir_append_data(mgmt_rp->eir, eir_len, 7606 EIR_SSP_HASH_C192, h192, 16); 7607 eir_len = eir_append_data(mgmt_rp->eir, eir_len, 7608 EIR_SSP_RAND_R192, r192, 16); 7609 } 7610 7611 if (h256 && r256) { 7612 eir_len = eir_append_data(mgmt_rp->eir, eir_len, 7613 EIR_SSP_HASH_C256, h256, 16); 7614 eir_len = eir_append_data(mgmt_rp->eir, eir_len, 7615 EIR_SSP_RAND_R256, r256, 16); 7616 } 7617 7618 send_rsp: 7619 mgmt_rp->type = mgmt_cp->type; 7620 mgmt_rp->eir_len = cpu_to_le16(eir_len); 7621 7622 err = mgmt_cmd_complete(cmd->sk, hdev->id, 7623 MGMT_OP_READ_LOCAL_OOB_EXT_DATA, status, 7624 mgmt_rp, sizeof(*mgmt_rp) + eir_len); 7625 if (err < 0 || status) 7626 goto done; 7627 7628 hci_sock_set_flag(cmd->sk, HCI_MGMT_OOB_DATA_EVENTS); 7629 7630 err = mgmt_limited_event(MGMT_EV_LOCAL_OOB_DATA_UPDATED, hdev, 7631 mgmt_rp, sizeof(*mgmt_rp) + eir_len, 7632 HCI_MGMT_OOB_DATA_EVENTS, cmd->sk); 7633 done: 7634 if (skb && !IS_ERR(skb)) 7635 kfree_skb(skb); 7636 7637 kfree(mgmt_rp); 7638 mgmt_pending_remove(cmd); 7639 } 7640 7641 static int read_local_ssp_oob_req(struct hci_dev *hdev, struct sock *sk, 7642 struct mgmt_cp_read_local_oob_ext_data *cp) 7643 { 7644 struct mgmt_pending_cmd *cmd; 7645 int err; 7646 7647 cmd = mgmt_pending_add(sk, MGMT_OP_READ_LOCAL_OOB_EXT_DATA, hdev, 7648 cp, sizeof(*cp)); 7649 if (!cmd) 7650 return -ENOMEM; 7651 7652 err = hci_cmd_sync_queue(hdev, read_local_oob_data_sync, cmd, 7653 read_local_oob_ext_data_complete); 7654 7655 if (err < 0) { 7656 mgmt_pending_remove(cmd); 7657 return err; 7658 } 7659 7660 return 0; 7661 } 7662 7663 static int read_local_oob_ext_data(struct sock *sk, struct hci_dev *hdev, 7664 void *data, u16 data_len) 7665 { 7666 struct mgmt_cp_read_local_oob_ext_data *cp = data; 7667 struct mgmt_rp_read_local_oob_ext_data *rp; 7668 size_t rp_len; 7669 u16 eir_len; 7670 u8 status, flags, role, addr[7], hash[16], rand[16]; 7671 int err; 7672 7673 bt_dev_dbg(hdev, "sock %p", sk); 7674 7675 if (hdev_is_powered(hdev)) { 7676 switch (cp->type) { 7677 case BIT(BDADDR_BREDR): 7678 status = mgmt_bredr_support(hdev); 7679 if (status) 7680 eir_len = 0; 7681 else 7682 eir_len = 5; 7683 break; 7684 case (BIT(BDADDR_LE_PUBLIC) | BIT(BDADDR_LE_RANDOM)): 7685 status = mgmt_le_support(hdev); 7686 if (status) 7687 eir_len = 0; 7688 else 7689 eir_len = 9 + 3 + 18 + 18 + 3; 7690 break; 7691 default: 7692 status = MGMT_STATUS_INVALID_PARAMS; 7693 eir_len = 0; 7694 break; 7695 } 7696 } else { 7697 status = MGMT_STATUS_NOT_POWERED; 7698 eir_len = 0; 7699 } 7700 7701 rp_len = sizeof(*rp) + eir_len; 7702 rp = kmalloc(rp_len, GFP_ATOMIC); 7703 if (!rp) 7704 return -ENOMEM; 7705 7706 if (!status && !lmp_ssp_capable(hdev)) { 7707 status = MGMT_STATUS_NOT_SUPPORTED; 7708 eir_len = 0; 7709 } 7710 7711 if (status) 7712 goto complete; 7713 7714 hci_dev_lock(hdev); 7715 7716 eir_len = 0; 7717 switch (cp->type) { 7718 case BIT(BDADDR_BREDR): 7719 if (hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) { 7720 err = read_local_ssp_oob_req(hdev, sk, cp); 7721 hci_dev_unlock(hdev); 7722 if (!err) 7723 goto done; 7724 7725 status = MGMT_STATUS_FAILED; 7726 goto complete; 7727 } else { 7728 eir_len = eir_append_data(rp->eir, eir_len, 7729 EIR_CLASS_OF_DEV, 7730 hdev->dev_class, 3); 7731 } 7732 break; 7733 case (BIT(BDADDR_LE_PUBLIC) | BIT(BDADDR_LE_RANDOM)): 7734 if (hci_dev_test_flag(hdev, HCI_SC_ENABLED) && 7735 smp_generate_oob(hdev, hash, rand) < 0) { 7736 hci_dev_unlock(hdev); 7737 status = MGMT_STATUS_FAILED; 7738 goto complete; 7739 } 7740 7741 /* This should return the active RPA, but since the RPA 7742 * is only programmed on demand, it is really hard to fill 7743 * this in at the moment. For now disallow retrieving 7744 * local out-of-band data when privacy is in use. 7745 * 7746 * Returning the identity address will not help here since 7747 * pairing happens before the identity resolving key is 7748 * known and thus the connection establishment happens 7749 * based on the RPA and not the identity address. 7750 */ 7751 if (hci_dev_test_flag(hdev, HCI_PRIVACY)) { 7752 hci_dev_unlock(hdev); 7753 status = MGMT_STATUS_REJECTED; 7754 goto complete; 7755 } 7756 7757 if (hci_dev_test_flag(hdev, HCI_FORCE_STATIC_ADDR) || 7758 !bacmp(&hdev->bdaddr, BDADDR_ANY) || 7759 (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) && 7760 bacmp(&hdev->static_addr, BDADDR_ANY))) { 7761 memcpy(addr, &hdev->static_addr, 6); 7762 addr[6] = 0x01; 7763 } else { 7764 memcpy(addr, &hdev->bdaddr, 6); 7765 addr[6] = 0x00; 7766 } 7767 7768 eir_len = eir_append_data(rp->eir, eir_len, EIR_LE_BDADDR, 7769 addr, sizeof(addr)); 7770 7771 if (hci_dev_test_flag(hdev, HCI_ADVERTISING)) 7772 role = 0x02; 7773 else 7774 role = 0x01; 7775 7776 eir_len = eir_append_data(rp->eir, eir_len, EIR_LE_ROLE, 7777 &role, sizeof(role)); 7778 7779 if (hci_dev_test_flag(hdev, HCI_SC_ENABLED)) { 7780 eir_len = eir_append_data(rp->eir, eir_len, 7781 EIR_LE_SC_CONFIRM, 7782 hash, sizeof(hash)); 7783 7784 eir_len = eir_append_data(rp->eir, eir_len, 7785 EIR_LE_SC_RANDOM, 7786 rand, sizeof(rand)); 7787 } 7788 7789 flags = mgmt_get_adv_discov_flags(hdev); 7790 7791 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) 7792 flags |= LE_AD_NO_BREDR; 7793 7794 eir_len = eir_append_data(rp->eir, eir_len, EIR_FLAGS, 7795 &flags, sizeof(flags)); 7796 break; 7797 } 7798 7799 hci_dev_unlock(hdev); 7800 7801 hci_sock_set_flag(sk, HCI_MGMT_OOB_DATA_EVENTS); 7802 7803 status = MGMT_STATUS_SUCCESS; 7804 7805 complete: 7806 rp->type = cp->type; 7807 rp->eir_len = cpu_to_le16(eir_len); 7808 7809 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_EXT_DATA, 7810 status, rp, sizeof(*rp) + eir_len); 7811 if (err < 0 || status) 7812 goto done; 7813 7814 err = mgmt_limited_event(MGMT_EV_LOCAL_OOB_DATA_UPDATED, hdev, 7815 rp, sizeof(*rp) + eir_len, 7816 HCI_MGMT_OOB_DATA_EVENTS, sk); 7817 7818 done: 7819 kfree(rp); 7820 7821 return err; 7822 } 7823 7824 static u32 get_supported_adv_flags(struct hci_dev *hdev) 7825 { 7826 u32 flags = 0; 7827 7828 flags |= MGMT_ADV_FLAG_CONNECTABLE; 7829 flags |= MGMT_ADV_FLAG_DISCOV; 7830 flags |= MGMT_ADV_FLAG_LIMITED_DISCOV; 7831 flags |= MGMT_ADV_FLAG_MANAGED_FLAGS; 7832 flags |= MGMT_ADV_FLAG_APPEARANCE; 7833 flags |= MGMT_ADV_FLAG_LOCAL_NAME; 7834 flags |= MGMT_ADV_PARAM_DURATION; 7835 flags |= MGMT_ADV_PARAM_TIMEOUT; 7836 flags |= MGMT_ADV_PARAM_INTERVALS; 7837 flags |= MGMT_ADV_PARAM_TX_POWER; 7838 flags |= MGMT_ADV_PARAM_SCAN_RSP; 7839 7840 /* In extended adv TX_POWER returned from Set Adv Param 7841 * will be always valid. 7842 */ 7843 if ((hdev->adv_tx_power != HCI_TX_POWER_INVALID) || 7844 ext_adv_capable(hdev)) 7845 flags |= MGMT_ADV_FLAG_TX_POWER; 7846 7847 if (ext_adv_capable(hdev)) { 7848 flags |= MGMT_ADV_FLAG_SEC_1M; 7849 flags |= MGMT_ADV_FLAG_HW_OFFLOAD; 7850 flags |= MGMT_ADV_FLAG_CAN_SET_TX_POWER; 7851 7852 if (hdev->le_features[1] & HCI_LE_PHY_2M) 7853 flags |= MGMT_ADV_FLAG_SEC_2M; 7854 7855 if (hdev->le_features[1] & HCI_LE_PHY_CODED) 7856 flags |= MGMT_ADV_FLAG_SEC_CODED; 7857 } 7858 7859 return flags; 7860 } 7861 7862 static int read_adv_features(struct sock *sk, struct hci_dev *hdev, 7863 void *data, u16 data_len) 7864 { 7865 struct mgmt_rp_read_adv_features *rp; 7866 size_t rp_len; 7867 int err; 7868 struct adv_info *adv_instance; 7869 u32 supported_flags; 7870 u8 *instance; 7871 7872 bt_dev_dbg(hdev, "sock %p", sk); 7873 7874 if (!lmp_le_capable(hdev)) 7875 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_ADV_FEATURES, 7876 MGMT_STATUS_REJECTED); 7877 7878 hci_dev_lock(hdev); 7879 7880 rp_len = sizeof(*rp) + hdev->adv_instance_cnt; 7881 rp = kmalloc(rp_len, GFP_ATOMIC); 7882 if (!rp) { 7883 hci_dev_unlock(hdev); 7884 return -ENOMEM; 7885 } 7886 7887 supported_flags = get_supported_adv_flags(hdev); 7888 7889 rp->supported_flags = cpu_to_le32(supported_flags); 7890 rp->max_adv_data_len = HCI_MAX_AD_LENGTH; 7891 rp->max_scan_rsp_len = HCI_MAX_AD_LENGTH; 7892 rp->max_instances = hdev->le_num_of_adv_sets; 7893 rp->num_instances = hdev->adv_instance_cnt; 7894 7895 instance = rp->instance; 7896 list_for_each_entry(adv_instance, &hdev->adv_instances, list) { 7897 *instance = adv_instance->instance; 7898 instance++; 7899 } 7900 7901 hci_dev_unlock(hdev); 7902 7903 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_ADV_FEATURES, 7904 MGMT_STATUS_SUCCESS, rp, rp_len); 7905 7906 kfree(rp); 7907 7908 return err; 7909 } 7910 7911 static u8 calculate_name_len(struct hci_dev *hdev) 7912 { 7913 u8 buf[HCI_MAX_SHORT_NAME_LENGTH + 3]; 7914 7915 return eir_append_local_name(hdev, buf, 0); 7916 } 7917 7918 static u8 tlv_data_max_len(struct hci_dev *hdev, u32 adv_flags, 7919 bool is_adv_data) 7920 { 7921 u8 max_len = HCI_MAX_AD_LENGTH; 7922 7923 if (is_adv_data) { 7924 if (adv_flags & (MGMT_ADV_FLAG_DISCOV | 7925 MGMT_ADV_FLAG_LIMITED_DISCOV | 7926 MGMT_ADV_FLAG_MANAGED_FLAGS)) 7927 max_len -= 3; 7928 7929 if (adv_flags & MGMT_ADV_FLAG_TX_POWER) 7930 max_len -= 3; 7931 } else { 7932 if (adv_flags & MGMT_ADV_FLAG_LOCAL_NAME) 7933 max_len -= calculate_name_len(hdev); 7934 7935 if (adv_flags & (MGMT_ADV_FLAG_APPEARANCE)) 7936 max_len -= 4; 7937 } 7938 7939 return max_len; 7940 } 7941 7942 static bool flags_managed(u32 adv_flags) 7943 { 7944 return adv_flags & (MGMT_ADV_FLAG_DISCOV | 7945 MGMT_ADV_FLAG_LIMITED_DISCOV | 7946 MGMT_ADV_FLAG_MANAGED_FLAGS); 7947 } 7948 7949 static bool tx_power_managed(u32 adv_flags) 7950 { 7951 return adv_flags & MGMT_ADV_FLAG_TX_POWER; 7952 } 7953 7954 static bool name_managed(u32 adv_flags) 7955 { 7956 return adv_flags & MGMT_ADV_FLAG_LOCAL_NAME; 7957 } 7958 7959 static bool appearance_managed(u32 adv_flags) 7960 { 7961 return adv_flags & MGMT_ADV_FLAG_APPEARANCE; 7962 } 7963 7964 static bool tlv_data_is_valid(struct hci_dev *hdev, u32 adv_flags, u8 *data, 7965 u8 len, bool is_adv_data) 7966 { 7967 int i, cur_len; 7968 u8 max_len; 7969 7970 max_len = tlv_data_max_len(hdev, adv_flags, is_adv_data); 7971 7972 if (len > max_len) 7973 return false; 7974 7975 /* Make sure that the data is correctly formatted. */ 7976 for (i = 0; i < len; i += (cur_len + 1)) { 7977 cur_len = data[i]; 7978 7979 if (!cur_len) 7980 continue; 7981 7982 if (data[i + 1] == EIR_FLAGS && 7983 (!is_adv_data || flags_managed(adv_flags))) 7984 return false; 7985 7986 if (data[i + 1] == EIR_TX_POWER && tx_power_managed(adv_flags)) 7987 return false; 7988 7989 if (data[i + 1] == EIR_NAME_COMPLETE && name_managed(adv_flags)) 7990 return false; 7991 7992 if (data[i + 1] == EIR_NAME_SHORT && name_managed(adv_flags)) 7993 return false; 7994 7995 if (data[i + 1] == EIR_APPEARANCE && 7996 appearance_managed(adv_flags)) 7997 return false; 7998 7999 /* If the current field length would exceed the total data 8000 * length, then it's invalid. 8001 */ 8002 if (i + cur_len >= len) 8003 return false; 8004 } 8005 8006 return true; 8007 } 8008 8009 static bool requested_adv_flags_are_valid(struct hci_dev *hdev, u32 adv_flags) 8010 { 8011 u32 supported_flags, phy_flags; 8012 8013 /* The current implementation only supports a subset of the specified 8014 * flags. Also need to check mutual exclusiveness of sec flags. 8015 */ 8016 supported_flags = get_supported_adv_flags(hdev); 8017 phy_flags = adv_flags & MGMT_ADV_FLAG_SEC_MASK; 8018 if (adv_flags & ~supported_flags || 8019 ((phy_flags && (phy_flags ^ (phy_flags & -phy_flags))))) 8020 return false; 8021 8022 return true; 8023 } 8024 8025 static bool adv_busy(struct hci_dev *hdev) 8026 { 8027 return pending_find(MGMT_OP_SET_LE, hdev); 8028 } 8029 8030 static void add_adv_complete(struct hci_dev *hdev, struct sock *sk, u8 instance, 8031 int err) 8032 { 8033 struct adv_info *adv, *n; 8034 8035 bt_dev_dbg(hdev, "err %d", err); 8036 8037 hci_dev_lock(hdev); 8038 8039 list_for_each_entry_safe(adv, n, &hdev->adv_instances, list) { 8040 u8 instance; 8041 8042 if (!adv->pending) 8043 continue; 8044 8045 if (!err) { 8046 adv->pending = false; 8047 continue; 8048 } 8049 8050 instance = adv->instance; 8051 8052 if (hdev->cur_adv_instance == instance) 8053 cancel_adv_timeout(hdev); 8054 8055 hci_remove_adv_instance(hdev, instance); 8056 mgmt_advertising_removed(sk, hdev, instance); 8057 } 8058 8059 hci_dev_unlock(hdev); 8060 } 8061 8062 static void add_advertising_complete(struct hci_dev *hdev, void *data, int err) 8063 { 8064 struct mgmt_pending_cmd *cmd = data; 8065 struct mgmt_cp_add_advertising *cp = cmd->param; 8066 struct mgmt_rp_add_advertising rp; 8067 8068 memset(&rp, 0, sizeof(rp)); 8069 8070 rp.instance = cp->instance; 8071 8072 if (err) 8073 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, 8074 mgmt_status(err)); 8075 else 8076 mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, 8077 mgmt_status(err), &rp, sizeof(rp)); 8078 8079 add_adv_complete(hdev, cmd->sk, cp->instance, err); 8080 8081 mgmt_pending_free(cmd); 8082 } 8083 8084 static int add_advertising_sync(struct hci_dev *hdev, void *data) 8085 { 8086 struct mgmt_pending_cmd *cmd = data; 8087 struct mgmt_cp_add_advertising *cp = cmd->param; 8088 8089 return hci_schedule_adv_instance_sync(hdev, cp->instance, true); 8090 } 8091 8092 static int add_advertising(struct sock *sk, struct hci_dev *hdev, 8093 void *data, u16 data_len) 8094 { 8095 struct mgmt_cp_add_advertising *cp = data; 8096 struct mgmt_rp_add_advertising rp; 8097 u32 flags; 8098 u8 status; 8099 u16 timeout, duration; 8100 unsigned int prev_instance_cnt; 8101 u8 schedule_instance = 0; 8102 struct adv_info *next_instance; 8103 int err; 8104 struct mgmt_pending_cmd *cmd; 8105 8106 bt_dev_dbg(hdev, "sock %p", sk); 8107 8108 status = mgmt_le_support(hdev); 8109 if (status) 8110 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING, 8111 status); 8112 8113 if (cp->instance < 1 || cp->instance > hdev->le_num_of_adv_sets) 8114 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING, 8115 MGMT_STATUS_INVALID_PARAMS); 8116 8117 if (data_len != sizeof(*cp) + cp->adv_data_len + cp->scan_rsp_len) 8118 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING, 8119 MGMT_STATUS_INVALID_PARAMS); 8120 8121 flags = __le32_to_cpu(cp->flags); 8122 timeout = __le16_to_cpu(cp->timeout); 8123 duration = __le16_to_cpu(cp->duration); 8124 8125 if (!requested_adv_flags_are_valid(hdev, flags)) 8126 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING, 8127 MGMT_STATUS_INVALID_PARAMS); 8128 8129 hci_dev_lock(hdev); 8130 8131 if (timeout && !hdev_is_powered(hdev)) { 8132 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING, 8133 MGMT_STATUS_REJECTED); 8134 goto unlock; 8135 } 8136 8137 if (adv_busy(hdev)) { 8138 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING, 8139 MGMT_STATUS_BUSY); 8140 goto unlock; 8141 } 8142 8143 if (!tlv_data_is_valid(hdev, flags, cp->data, cp->adv_data_len, true) || 8144 !tlv_data_is_valid(hdev, flags, cp->data + cp->adv_data_len, 8145 cp->scan_rsp_len, false)) { 8146 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING, 8147 MGMT_STATUS_INVALID_PARAMS); 8148 goto unlock; 8149 } 8150 8151 prev_instance_cnt = hdev->adv_instance_cnt; 8152 8153 err = hci_add_adv_instance(hdev, cp->instance, flags, 8154 cp->adv_data_len, cp->data, 8155 cp->scan_rsp_len, 8156 cp->data + cp->adv_data_len, 8157 timeout, duration, 8158 HCI_ADV_TX_POWER_NO_PREFERENCE, 8159 hdev->le_adv_min_interval, 8160 hdev->le_adv_max_interval); 8161 if (err < 0) { 8162 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING, 8163 MGMT_STATUS_FAILED); 8164 goto unlock; 8165 } 8166 8167 /* Only trigger an advertising added event if a new instance was 8168 * actually added. 8169 */ 8170 if (hdev->adv_instance_cnt > prev_instance_cnt) 8171 mgmt_advertising_added(sk, hdev, cp->instance); 8172 8173 if (hdev->cur_adv_instance == cp->instance) { 8174 /* If the currently advertised instance is being changed then 8175 * cancel the current advertising and schedule the next 8176 * instance. If there is only one instance then the overridden 8177 * advertising data will be visible right away. 8178 */ 8179 cancel_adv_timeout(hdev); 8180 8181 next_instance = hci_get_next_instance(hdev, cp->instance); 8182 if (next_instance) 8183 schedule_instance = next_instance->instance; 8184 } else if (!hdev->adv_instance_timeout) { 8185 /* Immediately advertise the new instance if no other 8186 * instance is currently being advertised. 8187 */ 8188 schedule_instance = cp->instance; 8189 } 8190 8191 /* If the HCI_ADVERTISING flag is set or the device isn't powered or 8192 * there is no instance to be advertised then we have no HCI 8193 * communication to make. Simply return. 8194 */ 8195 if (!hdev_is_powered(hdev) || 8196 hci_dev_test_flag(hdev, HCI_ADVERTISING) || 8197 !schedule_instance) { 8198 rp.instance = cp->instance; 8199 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_ADVERTISING, 8200 MGMT_STATUS_SUCCESS, &rp, sizeof(rp)); 8201 goto unlock; 8202 } 8203 8204 /* We're good to go, update advertising data, parameters, and start 8205 * advertising. 8206 */ 8207 cmd = mgmt_pending_new(sk, MGMT_OP_ADD_ADVERTISING, hdev, data, 8208 data_len); 8209 if (!cmd) { 8210 err = -ENOMEM; 8211 goto unlock; 8212 } 8213 8214 cp->instance = schedule_instance; 8215 8216 err = hci_cmd_sync_queue(hdev, add_advertising_sync, cmd, 8217 add_advertising_complete); 8218 if (err < 0) 8219 mgmt_pending_free(cmd); 8220 8221 unlock: 8222 hci_dev_unlock(hdev); 8223 8224 return err; 8225 } 8226 8227 static void add_ext_adv_params_complete(struct hci_dev *hdev, void *data, 8228 int err) 8229 { 8230 struct mgmt_pending_cmd *cmd = data; 8231 struct mgmt_cp_add_ext_adv_params *cp = cmd->param; 8232 struct mgmt_rp_add_ext_adv_params rp; 8233 struct adv_info *adv; 8234 u32 flags; 8235 8236 BT_DBG("%s", hdev->name); 8237 8238 hci_dev_lock(hdev); 8239 8240 adv = hci_find_adv_instance(hdev, cp->instance); 8241 if (!adv) 8242 goto unlock; 8243 8244 rp.instance = cp->instance; 8245 rp.tx_power = adv->tx_power; 8246 8247 /* While we're at it, inform userspace of the available space for this 8248 * advertisement, given the flags that will be used. 8249 */ 8250 flags = __le32_to_cpu(cp->flags); 8251 rp.max_adv_data_len = tlv_data_max_len(hdev, flags, true); 8252 rp.max_scan_rsp_len = tlv_data_max_len(hdev, flags, false); 8253 8254 if (err) { 8255 /* If this advertisement was previously advertising and we 8256 * failed to update it, we signal that it has been removed and 8257 * delete its structure 8258 */ 8259 if (!adv->pending) 8260 mgmt_advertising_removed(cmd->sk, hdev, cp->instance); 8261 8262 hci_remove_adv_instance(hdev, cp->instance); 8263 8264 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, 8265 mgmt_status(err)); 8266 } else { 8267 mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, 8268 mgmt_status(err), &rp, sizeof(rp)); 8269 } 8270 8271 unlock: 8272 if (cmd) 8273 mgmt_pending_free(cmd); 8274 8275 hci_dev_unlock(hdev); 8276 } 8277 8278 static int add_ext_adv_params_sync(struct hci_dev *hdev, void *data) 8279 { 8280 struct mgmt_pending_cmd *cmd = data; 8281 struct mgmt_cp_add_ext_adv_params *cp = cmd->param; 8282 8283 return hci_setup_ext_adv_instance_sync(hdev, cp->instance); 8284 } 8285 8286 static int add_ext_adv_params(struct sock *sk, struct hci_dev *hdev, 8287 void *data, u16 data_len) 8288 { 8289 struct mgmt_cp_add_ext_adv_params *cp = data; 8290 struct mgmt_rp_add_ext_adv_params rp; 8291 struct mgmt_pending_cmd *cmd = NULL; 8292 u32 flags, min_interval, max_interval; 8293 u16 timeout, duration; 8294 u8 status; 8295 s8 tx_power; 8296 int err; 8297 8298 BT_DBG("%s", hdev->name); 8299 8300 status = mgmt_le_support(hdev); 8301 if (status) 8302 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_PARAMS, 8303 status); 8304 8305 if (cp->instance < 1 || cp->instance > hdev->le_num_of_adv_sets) 8306 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_PARAMS, 8307 MGMT_STATUS_INVALID_PARAMS); 8308 8309 /* The purpose of breaking add_advertising into two separate MGMT calls 8310 * for params and data is to allow more parameters to be added to this 8311 * structure in the future. For this reason, we verify that we have the 8312 * bare minimum structure we know of when the interface was defined. Any 8313 * extra parameters we don't know about will be ignored in this request. 8314 */ 8315 if (data_len < MGMT_ADD_EXT_ADV_PARAMS_MIN_SIZE) 8316 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING, 8317 MGMT_STATUS_INVALID_PARAMS); 8318 8319 flags = __le32_to_cpu(cp->flags); 8320 8321 if (!requested_adv_flags_are_valid(hdev, flags)) 8322 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_PARAMS, 8323 MGMT_STATUS_INVALID_PARAMS); 8324 8325 hci_dev_lock(hdev); 8326 8327 /* In new interface, we require that we are powered to register */ 8328 if (!hdev_is_powered(hdev)) { 8329 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_PARAMS, 8330 MGMT_STATUS_REJECTED); 8331 goto unlock; 8332 } 8333 8334 if (adv_busy(hdev)) { 8335 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_PARAMS, 8336 MGMT_STATUS_BUSY); 8337 goto unlock; 8338 } 8339 8340 /* Parse defined parameters from request, use defaults otherwise */ 8341 timeout = (flags & MGMT_ADV_PARAM_TIMEOUT) ? 8342 __le16_to_cpu(cp->timeout) : 0; 8343 8344 duration = (flags & MGMT_ADV_PARAM_DURATION) ? 8345 __le16_to_cpu(cp->duration) : 8346 hdev->def_multi_adv_rotation_duration; 8347 8348 min_interval = (flags & MGMT_ADV_PARAM_INTERVALS) ? 8349 __le32_to_cpu(cp->min_interval) : 8350 hdev->le_adv_min_interval; 8351 8352 max_interval = (flags & MGMT_ADV_PARAM_INTERVALS) ? 8353 __le32_to_cpu(cp->max_interval) : 8354 hdev->le_adv_max_interval; 8355 8356 tx_power = (flags & MGMT_ADV_PARAM_TX_POWER) ? 8357 cp->tx_power : 8358 HCI_ADV_TX_POWER_NO_PREFERENCE; 8359 8360 /* Create advertising instance with no advertising or response data */ 8361 err = hci_add_adv_instance(hdev, cp->instance, flags, 8362 0, NULL, 0, NULL, timeout, duration, 8363 tx_power, min_interval, max_interval); 8364 8365 if (err < 0) { 8366 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_PARAMS, 8367 MGMT_STATUS_FAILED); 8368 goto unlock; 8369 } 8370 8371 /* Submit request for advertising params if ext adv available */ 8372 if (ext_adv_capable(hdev)) { 8373 cmd = mgmt_pending_new(sk, MGMT_OP_ADD_EXT_ADV_PARAMS, hdev, 8374 data, data_len); 8375 if (!cmd) { 8376 err = -ENOMEM; 8377 hci_remove_adv_instance(hdev, cp->instance); 8378 goto unlock; 8379 } 8380 8381 err = hci_cmd_sync_queue(hdev, add_ext_adv_params_sync, cmd, 8382 add_ext_adv_params_complete); 8383 if (err < 0) 8384 mgmt_pending_free(cmd); 8385 } else { 8386 rp.instance = cp->instance; 8387 rp.tx_power = HCI_ADV_TX_POWER_NO_PREFERENCE; 8388 rp.max_adv_data_len = tlv_data_max_len(hdev, flags, true); 8389 rp.max_scan_rsp_len = tlv_data_max_len(hdev, flags, false); 8390 err = mgmt_cmd_complete(sk, hdev->id, 8391 MGMT_OP_ADD_EXT_ADV_PARAMS, 8392 MGMT_STATUS_SUCCESS, &rp, sizeof(rp)); 8393 } 8394 8395 unlock: 8396 hci_dev_unlock(hdev); 8397 8398 return err; 8399 } 8400 8401 static void add_ext_adv_data_complete(struct hci_dev *hdev, void *data, int err) 8402 { 8403 struct mgmt_pending_cmd *cmd = data; 8404 struct mgmt_cp_add_ext_adv_data *cp = cmd->param; 8405 struct mgmt_rp_add_advertising rp; 8406 8407 add_adv_complete(hdev, cmd->sk, cp->instance, err); 8408 8409 memset(&rp, 0, sizeof(rp)); 8410 8411 rp.instance = cp->instance; 8412 8413 if (err) 8414 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, 8415 mgmt_status(err)); 8416 else 8417 mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, 8418 mgmt_status(err), &rp, sizeof(rp)); 8419 8420 mgmt_pending_free(cmd); 8421 } 8422 8423 static int add_ext_adv_data_sync(struct hci_dev *hdev, void *data) 8424 { 8425 struct mgmt_pending_cmd *cmd = data; 8426 struct mgmt_cp_add_ext_adv_data *cp = cmd->param; 8427 int err; 8428 8429 if (ext_adv_capable(hdev)) { 8430 err = hci_update_adv_data_sync(hdev, cp->instance); 8431 if (err) 8432 return err; 8433 8434 err = hci_update_scan_rsp_data_sync(hdev, cp->instance); 8435 if (err) 8436 return err; 8437 8438 return hci_enable_ext_advertising_sync(hdev, cp->instance); 8439 } 8440 8441 return hci_schedule_adv_instance_sync(hdev, cp->instance, true); 8442 } 8443 8444 static int add_ext_adv_data(struct sock *sk, struct hci_dev *hdev, void *data, 8445 u16 data_len) 8446 { 8447 struct mgmt_cp_add_ext_adv_data *cp = data; 8448 struct mgmt_rp_add_ext_adv_data rp; 8449 u8 schedule_instance = 0; 8450 struct adv_info *next_instance; 8451 struct adv_info *adv_instance; 8452 int err = 0; 8453 struct mgmt_pending_cmd *cmd; 8454 8455 BT_DBG("%s", hdev->name); 8456 8457 hci_dev_lock(hdev); 8458 8459 adv_instance = hci_find_adv_instance(hdev, cp->instance); 8460 8461 if (!adv_instance) { 8462 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_DATA, 8463 MGMT_STATUS_INVALID_PARAMS); 8464 goto unlock; 8465 } 8466 8467 /* In new interface, we require that we are powered to register */ 8468 if (!hdev_is_powered(hdev)) { 8469 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_DATA, 8470 MGMT_STATUS_REJECTED); 8471 goto clear_new_instance; 8472 } 8473 8474 if (adv_busy(hdev)) { 8475 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_DATA, 8476 MGMT_STATUS_BUSY); 8477 goto clear_new_instance; 8478 } 8479 8480 /* Validate new data */ 8481 if (!tlv_data_is_valid(hdev, adv_instance->flags, cp->data, 8482 cp->adv_data_len, true) || 8483 !tlv_data_is_valid(hdev, adv_instance->flags, cp->data + 8484 cp->adv_data_len, cp->scan_rsp_len, false)) { 8485 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_DATA, 8486 MGMT_STATUS_INVALID_PARAMS); 8487 goto clear_new_instance; 8488 } 8489 8490 /* Set the data in the advertising instance */ 8491 hci_set_adv_instance_data(hdev, cp->instance, cp->adv_data_len, 8492 cp->data, cp->scan_rsp_len, 8493 cp->data + cp->adv_data_len); 8494 8495 /* If using software rotation, determine next instance to use */ 8496 if (hdev->cur_adv_instance == cp->instance) { 8497 /* If the currently advertised instance is being changed 8498 * then cancel the current advertising and schedule the 8499 * next instance. If there is only one instance then the 8500 * overridden advertising data will be visible right 8501 * away 8502 */ 8503 cancel_adv_timeout(hdev); 8504 8505 next_instance = hci_get_next_instance(hdev, cp->instance); 8506 if (next_instance) 8507 schedule_instance = next_instance->instance; 8508 } else if (!hdev->adv_instance_timeout) { 8509 /* Immediately advertise the new instance if no other 8510 * instance is currently being advertised. 8511 */ 8512 schedule_instance = cp->instance; 8513 } 8514 8515 /* If the HCI_ADVERTISING flag is set or there is no instance to 8516 * be advertised then we have no HCI communication to make. 8517 * Simply return. 8518 */ 8519 if (hci_dev_test_flag(hdev, HCI_ADVERTISING) || !schedule_instance) { 8520 if (adv_instance->pending) { 8521 mgmt_advertising_added(sk, hdev, cp->instance); 8522 adv_instance->pending = false; 8523 } 8524 rp.instance = cp->instance; 8525 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_DATA, 8526 MGMT_STATUS_SUCCESS, &rp, sizeof(rp)); 8527 goto unlock; 8528 } 8529 8530 cmd = mgmt_pending_new(sk, MGMT_OP_ADD_EXT_ADV_DATA, hdev, data, 8531 data_len); 8532 if (!cmd) { 8533 err = -ENOMEM; 8534 goto clear_new_instance; 8535 } 8536 8537 err = hci_cmd_sync_queue(hdev, add_ext_adv_data_sync, cmd, 8538 add_ext_adv_data_complete); 8539 if (err < 0) { 8540 mgmt_pending_free(cmd); 8541 goto clear_new_instance; 8542 } 8543 8544 /* We were successful in updating data, so trigger advertising_added 8545 * event if this is an instance that wasn't previously advertising. If 8546 * a failure occurs in the requests we initiated, we will remove the 8547 * instance again in add_advertising_complete 8548 */ 8549 if (adv_instance->pending) 8550 mgmt_advertising_added(sk, hdev, cp->instance); 8551 8552 goto unlock; 8553 8554 clear_new_instance: 8555 hci_remove_adv_instance(hdev, cp->instance); 8556 8557 unlock: 8558 hci_dev_unlock(hdev); 8559 8560 return err; 8561 } 8562 8563 static void remove_advertising_complete(struct hci_dev *hdev, void *data, 8564 int err) 8565 { 8566 struct mgmt_pending_cmd *cmd = data; 8567 struct mgmt_cp_remove_advertising *cp = cmd->param; 8568 struct mgmt_rp_remove_advertising rp; 8569 8570 bt_dev_dbg(hdev, "err %d", err); 8571 8572 memset(&rp, 0, sizeof(rp)); 8573 rp.instance = cp->instance; 8574 8575 if (err) 8576 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, 8577 mgmt_status(err)); 8578 else 8579 mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, 8580 MGMT_STATUS_SUCCESS, &rp, sizeof(rp)); 8581 8582 mgmt_pending_free(cmd); 8583 } 8584 8585 static int remove_advertising_sync(struct hci_dev *hdev, void *data) 8586 { 8587 struct mgmt_pending_cmd *cmd = data; 8588 struct mgmt_cp_remove_advertising *cp = cmd->param; 8589 int err; 8590 8591 err = hci_remove_advertising_sync(hdev, cmd->sk, cp->instance, true); 8592 if (err) 8593 return err; 8594 8595 if (list_empty(&hdev->adv_instances)) 8596 err = hci_disable_advertising_sync(hdev); 8597 8598 return err; 8599 } 8600 8601 static int remove_advertising(struct sock *sk, struct hci_dev *hdev, 8602 void *data, u16 data_len) 8603 { 8604 struct mgmt_cp_remove_advertising *cp = data; 8605 struct mgmt_pending_cmd *cmd; 8606 int err; 8607 8608 bt_dev_dbg(hdev, "sock %p", sk); 8609 8610 hci_dev_lock(hdev); 8611 8612 if (cp->instance && !hci_find_adv_instance(hdev, cp->instance)) { 8613 err = mgmt_cmd_status(sk, hdev->id, 8614 MGMT_OP_REMOVE_ADVERTISING, 8615 MGMT_STATUS_INVALID_PARAMS); 8616 goto unlock; 8617 } 8618 8619 if (pending_find(MGMT_OP_SET_LE, hdev)) { 8620 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_ADVERTISING, 8621 MGMT_STATUS_BUSY); 8622 goto unlock; 8623 } 8624 8625 if (list_empty(&hdev->adv_instances)) { 8626 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_ADVERTISING, 8627 MGMT_STATUS_INVALID_PARAMS); 8628 goto unlock; 8629 } 8630 8631 cmd = mgmt_pending_new(sk, MGMT_OP_REMOVE_ADVERTISING, hdev, data, 8632 data_len); 8633 if (!cmd) { 8634 err = -ENOMEM; 8635 goto unlock; 8636 } 8637 8638 err = hci_cmd_sync_queue(hdev, remove_advertising_sync, cmd, 8639 remove_advertising_complete); 8640 if (err < 0) 8641 mgmt_pending_free(cmd); 8642 8643 unlock: 8644 hci_dev_unlock(hdev); 8645 8646 return err; 8647 } 8648 8649 static int get_adv_size_info(struct sock *sk, struct hci_dev *hdev, 8650 void *data, u16 data_len) 8651 { 8652 struct mgmt_cp_get_adv_size_info *cp = data; 8653 struct mgmt_rp_get_adv_size_info rp; 8654 u32 flags, supported_flags; 8655 8656 bt_dev_dbg(hdev, "sock %p", sk); 8657 8658 if (!lmp_le_capable(hdev)) 8659 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_ADV_SIZE_INFO, 8660 MGMT_STATUS_REJECTED); 8661 8662 if (cp->instance < 1 || cp->instance > hdev->le_num_of_adv_sets) 8663 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_ADV_SIZE_INFO, 8664 MGMT_STATUS_INVALID_PARAMS); 8665 8666 flags = __le32_to_cpu(cp->flags); 8667 8668 /* The current implementation only supports a subset of the specified 8669 * flags. 8670 */ 8671 supported_flags = get_supported_adv_flags(hdev); 8672 if (flags & ~supported_flags) 8673 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_ADV_SIZE_INFO, 8674 MGMT_STATUS_INVALID_PARAMS); 8675 8676 rp.instance = cp->instance; 8677 rp.flags = cp->flags; 8678 rp.max_adv_data_len = tlv_data_max_len(hdev, flags, true); 8679 rp.max_scan_rsp_len = tlv_data_max_len(hdev, flags, false); 8680 8681 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_ADV_SIZE_INFO, 8682 MGMT_STATUS_SUCCESS, &rp, sizeof(rp)); 8683 } 8684 8685 static const struct hci_mgmt_handler mgmt_handlers[] = { 8686 { NULL }, /* 0x0000 (no command) */ 8687 { read_version, MGMT_READ_VERSION_SIZE, 8688 HCI_MGMT_NO_HDEV | 8689 HCI_MGMT_UNTRUSTED }, 8690 { read_commands, MGMT_READ_COMMANDS_SIZE, 8691 HCI_MGMT_NO_HDEV | 8692 HCI_MGMT_UNTRUSTED }, 8693 { read_index_list, MGMT_READ_INDEX_LIST_SIZE, 8694 HCI_MGMT_NO_HDEV | 8695 HCI_MGMT_UNTRUSTED }, 8696 { read_controller_info, MGMT_READ_INFO_SIZE, 8697 HCI_MGMT_UNTRUSTED }, 8698 { set_powered, MGMT_SETTING_SIZE }, 8699 { set_discoverable, MGMT_SET_DISCOVERABLE_SIZE }, 8700 { set_connectable, MGMT_SETTING_SIZE }, 8701 { set_fast_connectable, MGMT_SETTING_SIZE }, 8702 { set_bondable, MGMT_SETTING_SIZE }, 8703 { set_link_security, MGMT_SETTING_SIZE }, 8704 { set_ssp, MGMT_SETTING_SIZE }, 8705 { set_hs, MGMT_SETTING_SIZE }, 8706 { set_le, MGMT_SETTING_SIZE }, 8707 { set_dev_class, MGMT_SET_DEV_CLASS_SIZE }, 8708 { set_local_name, MGMT_SET_LOCAL_NAME_SIZE }, 8709 { add_uuid, MGMT_ADD_UUID_SIZE }, 8710 { remove_uuid, MGMT_REMOVE_UUID_SIZE }, 8711 { load_link_keys, MGMT_LOAD_LINK_KEYS_SIZE, 8712 HCI_MGMT_VAR_LEN }, 8713 { load_long_term_keys, MGMT_LOAD_LONG_TERM_KEYS_SIZE, 8714 HCI_MGMT_VAR_LEN }, 8715 { disconnect, MGMT_DISCONNECT_SIZE }, 8716 { get_connections, MGMT_GET_CONNECTIONS_SIZE }, 8717 { pin_code_reply, MGMT_PIN_CODE_REPLY_SIZE }, 8718 { pin_code_neg_reply, MGMT_PIN_CODE_NEG_REPLY_SIZE }, 8719 { set_io_capability, MGMT_SET_IO_CAPABILITY_SIZE }, 8720 { pair_device, MGMT_PAIR_DEVICE_SIZE }, 8721 { cancel_pair_device, MGMT_CANCEL_PAIR_DEVICE_SIZE }, 8722 { unpair_device, MGMT_UNPAIR_DEVICE_SIZE }, 8723 { user_confirm_reply, MGMT_USER_CONFIRM_REPLY_SIZE }, 8724 { user_confirm_neg_reply, MGMT_USER_CONFIRM_NEG_REPLY_SIZE }, 8725 { user_passkey_reply, MGMT_USER_PASSKEY_REPLY_SIZE }, 8726 { user_passkey_neg_reply, MGMT_USER_PASSKEY_NEG_REPLY_SIZE }, 8727 { read_local_oob_data, MGMT_READ_LOCAL_OOB_DATA_SIZE }, 8728 { add_remote_oob_data, MGMT_ADD_REMOTE_OOB_DATA_SIZE, 8729 HCI_MGMT_VAR_LEN }, 8730 { remove_remote_oob_data, MGMT_REMOVE_REMOTE_OOB_DATA_SIZE }, 8731 { start_discovery, MGMT_START_DISCOVERY_SIZE }, 8732 { stop_discovery, MGMT_STOP_DISCOVERY_SIZE }, 8733 { confirm_name, MGMT_CONFIRM_NAME_SIZE }, 8734 { block_device, MGMT_BLOCK_DEVICE_SIZE }, 8735 { unblock_device, MGMT_UNBLOCK_DEVICE_SIZE }, 8736 { set_device_id, MGMT_SET_DEVICE_ID_SIZE }, 8737 { set_advertising, MGMT_SETTING_SIZE }, 8738 { set_bredr, MGMT_SETTING_SIZE }, 8739 { set_static_address, MGMT_SET_STATIC_ADDRESS_SIZE }, 8740 { set_scan_params, MGMT_SET_SCAN_PARAMS_SIZE }, 8741 { set_secure_conn, MGMT_SETTING_SIZE }, 8742 { set_debug_keys, MGMT_SETTING_SIZE }, 8743 { set_privacy, MGMT_SET_PRIVACY_SIZE }, 8744 { load_irks, MGMT_LOAD_IRKS_SIZE, 8745 HCI_MGMT_VAR_LEN }, 8746 { get_conn_info, MGMT_GET_CONN_INFO_SIZE }, 8747 { get_clock_info, MGMT_GET_CLOCK_INFO_SIZE }, 8748 { add_device, MGMT_ADD_DEVICE_SIZE }, 8749 { remove_device, MGMT_REMOVE_DEVICE_SIZE }, 8750 { load_conn_param, MGMT_LOAD_CONN_PARAM_SIZE, 8751 HCI_MGMT_VAR_LEN }, 8752 { read_unconf_index_list, MGMT_READ_UNCONF_INDEX_LIST_SIZE, 8753 HCI_MGMT_NO_HDEV | 8754 HCI_MGMT_UNTRUSTED }, 8755 { read_config_info, MGMT_READ_CONFIG_INFO_SIZE, 8756 HCI_MGMT_UNCONFIGURED | 8757 HCI_MGMT_UNTRUSTED }, 8758 { set_external_config, MGMT_SET_EXTERNAL_CONFIG_SIZE, 8759 HCI_MGMT_UNCONFIGURED }, 8760 { set_public_address, MGMT_SET_PUBLIC_ADDRESS_SIZE, 8761 HCI_MGMT_UNCONFIGURED }, 8762 { start_service_discovery, MGMT_START_SERVICE_DISCOVERY_SIZE, 8763 HCI_MGMT_VAR_LEN }, 8764 { read_local_oob_ext_data, MGMT_READ_LOCAL_OOB_EXT_DATA_SIZE }, 8765 { read_ext_index_list, MGMT_READ_EXT_INDEX_LIST_SIZE, 8766 HCI_MGMT_NO_HDEV | 8767 HCI_MGMT_UNTRUSTED }, 8768 { read_adv_features, MGMT_READ_ADV_FEATURES_SIZE }, 8769 { add_advertising, MGMT_ADD_ADVERTISING_SIZE, 8770 HCI_MGMT_VAR_LEN }, 8771 { remove_advertising, MGMT_REMOVE_ADVERTISING_SIZE }, 8772 { get_adv_size_info, MGMT_GET_ADV_SIZE_INFO_SIZE }, 8773 { start_limited_discovery, MGMT_START_DISCOVERY_SIZE }, 8774 { read_ext_controller_info,MGMT_READ_EXT_INFO_SIZE, 8775 HCI_MGMT_UNTRUSTED }, 8776 { set_appearance, MGMT_SET_APPEARANCE_SIZE }, 8777 { get_phy_configuration, MGMT_GET_PHY_CONFIGURATION_SIZE }, 8778 { set_phy_configuration, MGMT_SET_PHY_CONFIGURATION_SIZE }, 8779 { set_blocked_keys, MGMT_OP_SET_BLOCKED_KEYS_SIZE, 8780 HCI_MGMT_VAR_LEN }, 8781 { set_wideband_speech, MGMT_SETTING_SIZE }, 8782 { read_controller_cap, MGMT_READ_CONTROLLER_CAP_SIZE, 8783 HCI_MGMT_UNTRUSTED }, 8784 { read_exp_features_info, MGMT_READ_EXP_FEATURES_INFO_SIZE, 8785 HCI_MGMT_UNTRUSTED | 8786 HCI_MGMT_HDEV_OPTIONAL }, 8787 { set_exp_feature, MGMT_SET_EXP_FEATURE_SIZE, 8788 HCI_MGMT_VAR_LEN | 8789 HCI_MGMT_HDEV_OPTIONAL }, 8790 { read_def_system_config, MGMT_READ_DEF_SYSTEM_CONFIG_SIZE, 8791 HCI_MGMT_UNTRUSTED }, 8792 { set_def_system_config, MGMT_SET_DEF_SYSTEM_CONFIG_SIZE, 8793 HCI_MGMT_VAR_LEN }, 8794 { read_def_runtime_config, MGMT_READ_DEF_RUNTIME_CONFIG_SIZE, 8795 HCI_MGMT_UNTRUSTED }, 8796 { set_def_runtime_config, MGMT_SET_DEF_RUNTIME_CONFIG_SIZE, 8797 HCI_MGMT_VAR_LEN }, 8798 { get_device_flags, MGMT_GET_DEVICE_FLAGS_SIZE }, 8799 { set_device_flags, MGMT_SET_DEVICE_FLAGS_SIZE }, 8800 { read_adv_mon_features, MGMT_READ_ADV_MONITOR_FEATURES_SIZE }, 8801 { add_adv_patterns_monitor,MGMT_ADD_ADV_PATTERNS_MONITOR_SIZE, 8802 HCI_MGMT_VAR_LEN }, 8803 { remove_adv_monitor, MGMT_REMOVE_ADV_MONITOR_SIZE }, 8804 { add_ext_adv_params, MGMT_ADD_EXT_ADV_PARAMS_MIN_SIZE, 8805 HCI_MGMT_VAR_LEN }, 8806 { add_ext_adv_data, MGMT_ADD_EXT_ADV_DATA_SIZE, 8807 HCI_MGMT_VAR_LEN }, 8808 { add_adv_patterns_monitor_rssi, 8809 MGMT_ADD_ADV_PATTERNS_MONITOR_RSSI_SIZE, 8810 HCI_MGMT_VAR_LEN }, 8811 }; 8812 8813 void mgmt_index_added(struct hci_dev *hdev) 8814 { 8815 struct mgmt_ev_ext_index ev; 8816 8817 if (test_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks)) 8818 return; 8819 8820 switch (hdev->dev_type) { 8821 case HCI_PRIMARY: 8822 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) { 8823 mgmt_index_event(MGMT_EV_UNCONF_INDEX_ADDED, hdev, 8824 NULL, 0, HCI_MGMT_UNCONF_INDEX_EVENTS); 8825 ev.type = 0x01; 8826 } else { 8827 mgmt_index_event(MGMT_EV_INDEX_ADDED, hdev, NULL, 0, 8828 HCI_MGMT_INDEX_EVENTS); 8829 ev.type = 0x00; 8830 } 8831 break; 8832 case HCI_AMP: 8833 ev.type = 0x02; 8834 break; 8835 default: 8836 return; 8837 } 8838 8839 ev.bus = hdev->bus; 8840 8841 mgmt_index_event(MGMT_EV_EXT_INDEX_ADDED, hdev, &ev, sizeof(ev), 8842 HCI_MGMT_EXT_INDEX_EVENTS); 8843 } 8844 8845 void mgmt_index_removed(struct hci_dev *hdev) 8846 { 8847 struct mgmt_ev_ext_index ev; 8848 u8 status = MGMT_STATUS_INVALID_INDEX; 8849 8850 if (test_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks)) 8851 return; 8852 8853 switch (hdev->dev_type) { 8854 case HCI_PRIMARY: 8855 mgmt_pending_foreach(0, hdev, cmd_complete_rsp, &status); 8856 8857 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) { 8858 mgmt_index_event(MGMT_EV_UNCONF_INDEX_REMOVED, hdev, 8859 NULL, 0, HCI_MGMT_UNCONF_INDEX_EVENTS); 8860 ev.type = 0x01; 8861 } else { 8862 mgmt_index_event(MGMT_EV_INDEX_REMOVED, hdev, NULL, 0, 8863 HCI_MGMT_INDEX_EVENTS); 8864 ev.type = 0x00; 8865 } 8866 break; 8867 case HCI_AMP: 8868 ev.type = 0x02; 8869 break; 8870 default: 8871 return; 8872 } 8873 8874 ev.bus = hdev->bus; 8875 8876 mgmt_index_event(MGMT_EV_EXT_INDEX_REMOVED, hdev, &ev, sizeof(ev), 8877 HCI_MGMT_EXT_INDEX_EVENTS); 8878 } 8879 8880 void mgmt_power_on(struct hci_dev *hdev, int err) 8881 { 8882 struct cmd_lookup match = { NULL, hdev }; 8883 8884 bt_dev_dbg(hdev, "err %d", err); 8885 8886 hci_dev_lock(hdev); 8887 8888 if (!err) { 8889 restart_le_actions(hdev); 8890 hci_update_passive_scan(hdev); 8891 } 8892 8893 mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp, &match); 8894 8895 new_settings(hdev, match.sk); 8896 8897 if (match.sk) 8898 sock_put(match.sk); 8899 8900 hci_dev_unlock(hdev); 8901 } 8902 8903 void __mgmt_power_off(struct hci_dev *hdev) 8904 { 8905 struct cmd_lookup match = { NULL, hdev }; 8906 u8 status, zero_cod[] = { 0, 0, 0 }; 8907 8908 mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp, &match); 8909 8910 /* If the power off is because of hdev unregistration let 8911 * use the appropriate INVALID_INDEX status. Otherwise use 8912 * NOT_POWERED. We cover both scenarios here since later in 8913 * mgmt_index_removed() any hci_conn callbacks will have already 8914 * been triggered, potentially causing misleading DISCONNECTED 8915 * status responses. 8916 */ 8917 if (hci_dev_test_flag(hdev, HCI_UNREGISTER)) 8918 status = MGMT_STATUS_INVALID_INDEX; 8919 else 8920 status = MGMT_STATUS_NOT_POWERED; 8921 8922 mgmt_pending_foreach(0, hdev, cmd_complete_rsp, &status); 8923 8924 if (memcmp(hdev->dev_class, zero_cod, sizeof(zero_cod)) != 0) { 8925 mgmt_limited_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev, 8926 zero_cod, sizeof(zero_cod), 8927 HCI_MGMT_DEV_CLASS_EVENTS, NULL); 8928 ext_info_changed(hdev, NULL); 8929 } 8930 8931 new_settings(hdev, match.sk); 8932 8933 if (match.sk) 8934 sock_put(match.sk); 8935 } 8936 8937 void mgmt_set_powered_failed(struct hci_dev *hdev, int err) 8938 { 8939 struct mgmt_pending_cmd *cmd; 8940 u8 status; 8941 8942 cmd = pending_find(MGMT_OP_SET_POWERED, hdev); 8943 if (!cmd) 8944 return; 8945 8946 if (err == -ERFKILL) 8947 status = MGMT_STATUS_RFKILLED; 8948 else 8949 status = MGMT_STATUS_FAILED; 8950 8951 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_POWERED, status); 8952 8953 mgmt_pending_remove(cmd); 8954 } 8955 8956 void mgmt_new_link_key(struct hci_dev *hdev, struct link_key *key, 8957 bool persistent) 8958 { 8959 struct mgmt_ev_new_link_key ev; 8960 8961 memset(&ev, 0, sizeof(ev)); 8962 8963 ev.store_hint = persistent; 8964 bacpy(&ev.key.addr.bdaddr, &key->bdaddr); 8965 ev.key.addr.type = BDADDR_BREDR; 8966 ev.key.type = key->type; 8967 memcpy(ev.key.val, key->val, HCI_LINK_KEY_SIZE); 8968 ev.key.pin_len = key->pin_len; 8969 8970 mgmt_event(MGMT_EV_NEW_LINK_KEY, hdev, &ev, sizeof(ev), NULL); 8971 } 8972 8973 static u8 mgmt_ltk_type(struct smp_ltk *ltk) 8974 { 8975 switch (ltk->type) { 8976 case SMP_LTK: 8977 case SMP_LTK_RESPONDER: 8978 if (ltk->authenticated) 8979 return MGMT_LTK_AUTHENTICATED; 8980 return MGMT_LTK_UNAUTHENTICATED; 8981 case SMP_LTK_P256: 8982 if (ltk->authenticated) 8983 return MGMT_LTK_P256_AUTH; 8984 return MGMT_LTK_P256_UNAUTH; 8985 case SMP_LTK_P256_DEBUG: 8986 return MGMT_LTK_P256_DEBUG; 8987 } 8988 8989 return MGMT_LTK_UNAUTHENTICATED; 8990 } 8991 8992 void mgmt_new_ltk(struct hci_dev *hdev, struct smp_ltk *key, bool persistent) 8993 { 8994 struct mgmt_ev_new_long_term_key ev; 8995 8996 memset(&ev, 0, sizeof(ev)); 8997 8998 /* Devices using resolvable or non-resolvable random addresses 8999 * without providing an identity resolving key don't require 9000 * to store long term keys. Their addresses will change the 9001 * next time around. 9002 * 9003 * Only when a remote device provides an identity address 9004 * make sure the long term key is stored. If the remote 9005 * identity is known, the long term keys are internally 9006 * mapped to the identity address. So allow static random 9007 * and public addresses here. 9008 */ 9009 if (key->bdaddr_type == ADDR_LE_DEV_RANDOM && 9010 (key->bdaddr.b[5] & 0xc0) != 0xc0) 9011 ev.store_hint = 0x00; 9012 else 9013 ev.store_hint = persistent; 9014 9015 bacpy(&ev.key.addr.bdaddr, &key->bdaddr); 9016 ev.key.addr.type = link_to_bdaddr(LE_LINK, key->bdaddr_type); 9017 ev.key.type = mgmt_ltk_type(key); 9018 ev.key.enc_size = key->enc_size; 9019 ev.key.ediv = key->ediv; 9020 ev.key.rand = key->rand; 9021 9022 if (key->type == SMP_LTK) 9023 ev.key.initiator = 1; 9024 9025 /* Make sure we copy only the significant bytes based on the 9026 * encryption key size, and set the rest of the value to zeroes. 9027 */ 9028 memcpy(ev.key.val, key->val, key->enc_size); 9029 memset(ev.key.val + key->enc_size, 0, 9030 sizeof(ev.key.val) - key->enc_size); 9031 9032 mgmt_event(MGMT_EV_NEW_LONG_TERM_KEY, hdev, &ev, sizeof(ev), NULL); 9033 } 9034 9035 void mgmt_new_irk(struct hci_dev *hdev, struct smp_irk *irk, bool persistent) 9036 { 9037 struct mgmt_ev_new_irk ev; 9038 9039 memset(&ev, 0, sizeof(ev)); 9040 9041 ev.store_hint = persistent; 9042 9043 bacpy(&ev.rpa, &irk->rpa); 9044 bacpy(&ev.irk.addr.bdaddr, &irk->bdaddr); 9045 ev.irk.addr.type = link_to_bdaddr(LE_LINK, irk->addr_type); 9046 memcpy(ev.irk.val, irk->val, sizeof(irk->val)); 9047 9048 mgmt_event(MGMT_EV_NEW_IRK, hdev, &ev, sizeof(ev), NULL); 9049 } 9050 9051 void mgmt_new_csrk(struct hci_dev *hdev, struct smp_csrk *csrk, 9052 bool persistent) 9053 { 9054 struct mgmt_ev_new_csrk ev; 9055 9056 memset(&ev, 0, sizeof(ev)); 9057 9058 /* Devices using resolvable or non-resolvable random addresses 9059 * without providing an identity resolving key don't require 9060 * to store signature resolving keys. Their addresses will change 9061 * the next time around. 9062 * 9063 * Only when a remote device provides an identity address 9064 * make sure the signature resolving key is stored. So allow 9065 * static random and public addresses here. 9066 */ 9067 if (csrk->bdaddr_type == ADDR_LE_DEV_RANDOM && 9068 (csrk->bdaddr.b[5] & 0xc0) != 0xc0) 9069 ev.store_hint = 0x00; 9070 else 9071 ev.store_hint = persistent; 9072 9073 bacpy(&ev.key.addr.bdaddr, &csrk->bdaddr); 9074 ev.key.addr.type = link_to_bdaddr(LE_LINK, csrk->bdaddr_type); 9075 ev.key.type = csrk->type; 9076 memcpy(ev.key.val, csrk->val, sizeof(csrk->val)); 9077 9078 mgmt_event(MGMT_EV_NEW_CSRK, hdev, &ev, sizeof(ev), NULL); 9079 } 9080 9081 void mgmt_new_conn_param(struct hci_dev *hdev, bdaddr_t *bdaddr, 9082 u8 bdaddr_type, u8 store_hint, u16 min_interval, 9083 u16 max_interval, u16 latency, u16 timeout) 9084 { 9085 struct mgmt_ev_new_conn_param ev; 9086 9087 if (!hci_is_identity_address(bdaddr, bdaddr_type)) 9088 return; 9089 9090 memset(&ev, 0, sizeof(ev)); 9091 bacpy(&ev.addr.bdaddr, bdaddr); 9092 ev.addr.type = link_to_bdaddr(LE_LINK, bdaddr_type); 9093 ev.store_hint = store_hint; 9094 ev.min_interval = cpu_to_le16(min_interval); 9095 ev.max_interval = cpu_to_le16(max_interval); 9096 ev.latency = cpu_to_le16(latency); 9097 ev.timeout = cpu_to_le16(timeout); 9098 9099 mgmt_event(MGMT_EV_NEW_CONN_PARAM, hdev, &ev, sizeof(ev), NULL); 9100 } 9101 9102 void mgmt_device_connected(struct hci_dev *hdev, struct hci_conn *conn, 9103 u8 *name, u8 name_len) 9104 { 9105 struct sk_buff *skb; 9106 struct mgmt_ev_device_connected *ev; 9107 u16 eir_len = 0; 9108 u32 flags = 0; 9109 9110 /* allocate buff for LE or BR/EDR adv */ 9111 if (conn->le_adv_data_len > 0) 9112 skb = mgmt_alloc_skb(hdev, MGMT_EV_DEVICE_CONNECTED, 9113 sizeof(*ev) + conn->le_adv_data_len); 9114 else 9115 skb = mgmt_alloc_skb(hdev, MGMT_EV_DEVICE_CONNECTED, 9116 sizeof(*ev) + (name ? eir_precalc_len(name_len) : 0) + 9117 eir_precalc_len(sizeof(conn->dev_class))); 9118 9119 ev = skb_put(skb, sizeof(*ev)); 9120 bacpy(&ev->addr.bdaddr, &conn->dst); 9121 ev->addr.type = link_to_bdaddr(conn->type, conn->dst_type); 9122 9123 if (conn->out) 9124 flags |= MGMT_DEV_FOUND_INITIATED_CONN; 9125 9126 ev->flags = __cpu_to_le32(flags); 9127 9128 /* We must ensure that the EIR Data fields are ordered and 9129 * unique. Keep it simple for now and avoid the problem by not 9130 * adding any BR/EDR data to the LE adv. 9131 */ 9132 if (conn->le_adv_data_len > 0) { 9133 skb_put_data(skb, conn->le_adv_data, conn->le_adv_data_len); 9134 eir_len = conn->le_adv_data_len; 9135 } else { 9136 if (name) 9137 eir_len += eir_skb_put_data(skb, EIR_NAME_COMPLETE, name, name_len); 9138 9139 if (memcmp(conn->dev_class, "\0\0\0", sizeof(conn->dev_class))) 9140 eir_len += eir_skb_put_data(skb, EIR_CLASS_OF_DEV, 9141 conn->dev_class, sizeof(conn->dev_class)); 9142 } 9143 9144 ev->eir_len = cpu_to_le16(eir_len); 9145 9146 mgmt_event_skb(skb, NULL); 9147 } 9148 9149 static void disconnect_rsp(struct mgmt_pending_cmd *cmd, void *data) 9150 { 9151 struct sock **sk = data; 9152 9153 cmd->cmd_complete(cmd, 0); 9154 9155 *sk = cmd->sk; 9156 sock_hold(*sk); 9157 9158 mgmt_pending_remove(cmd); 9159 } 9160 9161 static void unpair_device_rsp(struct mgmt_pending_cmd *cmd, void *data) 9162 { 9163 struct hci_dev *hdev = data; 9164 struct mgmt_cp_unpair_device *cp = cmd->param; 9165 9166 device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, cmd->sk); 9167 9168 cmd->cmd_complete(cmd, 0); 9169 mgmt_pending_remove(cmd); 9170 } 9171 9172 bool mgmt_powering_down(struct hci_dev *hdev) 9173 { 9174 struct mgmt_pending_cmd *cmd; 9175 struct mgmt_mode *cp; 9176 9177 cmd = pending_find(MGMT_OP_SET_POWERED, hdev); 9178 if (!cmd) 9179 return false; 9180 9181 cp = cmd->param; 9182 if (!cp->val) 9183 return true; 9184 9185 return false; 9186 } 9187 9188 void mgmt_device_disconnected(struct hci_dev *hdev, bdaddr_t *bdaddr, 9189 u8 link_type, u8 addr_type, u8 reason, 9190 bool mgmt_connected) 9191 { 9192 struct mgmt_ev_device_disconnected ev; 9193 struct sock *sk = NULL; 9194 9195 /* The connection is still in hci_conn_hash so test for 1 9196 * instead of 0 to know if this is the last one. 9197 */ 9198 if (mgmt_powering_down(hdev) && hci_conn_count(hdev) == 1) { 9199 cancel_delayed_work(&hdev->power_off); 9200 queue_work(hdev->req_workqueue, &hdev->power_off.work); 9201 } 9202 9203 if (!mgmt_connected) 9204 return; 9205 9206 if (link_type != ACL_LINK && link_type != LE_LINK) 9207 return; 9208 9209 mgmt_pending_foreach(MGMT_OP_DISCONNECT, hdev, disconnect_rsp, &sk); 9210 9211 bacpy(&ev.addr.bdaddr, bdaddr); 9212 ev.addr.type = link_to_bdaddr(link_type, addr_type); 9213 ev.reason = reason; 9214 9215 /* Report disconnects due to suspend */ 9216 if (hdev->suspended) 9217 ev.reason = MGMT_DEV_DISCONN_LOCAL_HOST_SUSPEND; 9218 9219 mgmt_event(MGMT_EV_DEVICE_DISCONNECTED, hdev, &ev, sizeof(ev), sk); 9220 9221 if (sk) 9222 sock_put(sk); 9223 9224 mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, unpair_device_rsp, 9225 hdev); 9226 } 9227 9228 void mgmt_disconnect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr, 9229 u8 link_type, u8 addr_type, u8 status) 9230 { 9231 u8 bdaddr_type = link_to_bdaddr(link_type, addr_type); 9232 struct mgmt_cp_disconnect *cp; 9233 struct mgmt_pending_cmd *cmd; 9234 9235 mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, unpair_device_rsp, 9236 hdev); 9237 9238 cmd = pending_find(MGMT_OP_DISCONNECT, hdev); 9239 if (!cmd) 9240 return; 9241 9242 cp = cmd->param; 9243 9244 if (bacmp(bdaddr, &cp->addr.bdaddr)) 9245 return; 9246 9247 if (cp->addr.type != bdaddr_type) 9248 return; 9249 9250 cmd->cmd_complete(cmd, mgmt_status(status)); 9251 mgmt_pending_remove(cmd); 9252 } 9253 9254 void mgmt_connect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type, 9255 u8 addr_type, u8 status) 9256 { 9257 struct mgmt_ev_connect_failed ev; 9258 9259 /* The connection is still in hci_conn_hash so test for 1 9260 * instead of 0 to know if this is the last one. 9261 */ 9262 if (mgmt_powering_down(hdev) && hci_conn_count(hdev) == 1) { 9263 cancel_delayed_work(&hdev->power_off); 9264 queue_work(hdev->req_workqueue, &hdev->power_off.work); 9265 } 9266 9267 bacpy(&ev.addr.bdaddr, bdaddr); 9268 ev.addr.type = link_to_bdaddr(link_type, addr_type); 9269 ev.status = mgmt_status(status); 9270 9271 mgmt_event(MGMT_EV_CONNECT_FAILED, hdev, &ev, sizeof(ev), NULL); 9272 } 9273 9274 void mgmt_pin_code_request(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 secure) 9275 { 9276 struct mgmt_ev_pin_code_request ev; 9277 9278 bacpy(&ev.addr.bdaddr, bdaddr); 9279 ev.addr.type = BDADDR_BREDR; 9280 ev.secure = secure; 9281 9282 mgmt_event(MGMT_EV_PIN_CODE_REQUEST, hdev, &ev, sizeof(ev), NULL); 9283 } 9284 9285 void mgmt_pin_code_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr, 9286 u8 status) 9287 { 9288 struct mgmt_pending_cmd *cmd; 9289 9290 cmd = pending_find(MGMT_OP_PIN_CODE_REPLY, hdev); 9291 if (!cmd) 9292 return; 9293 9294 cmd->cmd_complete(cmd, mgmt_status(status)); 9295 mgmt_pending_remove(cmd); 9296 } 9297 9298 void mgmt_pin_code_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr, 9299 u8 status) 9300 { 9301 struct mgmt_pending_cmd *cmd; 9302 9303 cmd = pending_find(MGMT_OP_PIN_CODE_NEG_REPLY, hdev); 9304 if (!cmd) 9305 return; 9306 9307 cmd->cmd_complete(cmd, mgmt_status(status)); 9308 mgmt_pending_remove(cmd); 9309 } 9310 9311 int mgmt_user_confirm_request(struct hci_dev *hdev, bdaddr_t *bdaddr, 9312 u8 link_type, u8 addr_type, u32 value, 9313 u8 confirm_hint) 9314 { 9315 struct mgmt_ev_user_confirm_request ev; 9316 9317 bt_dev_dbg(hdev, "bdaddr %pMR", bdaddr); 9318 9319 bacpy(&ev.addr.bdaddr, bdaddr); 9320 ev.addr.type = link_to_bdaddr(link_type, addr_type); 9321 ev.confirm_hint = confirm_hint; 9322 ev.value = cpu_to_le32(value); 9323 9324 return mgmt_event(MGMT_EV_USER_CONFIRM_REQUEST, hdev, &ev, sizeof(ev), 9325 NULL); 9326 } 9327 9328 int mgmt_user_passkey_request(struct hci_dev *hdev, bdaddr_t *bdaddr, 9329 u8 link_type, u8 addr_type) 9330 { 9331 struct mgmt_ev_user_passkey_request ev; 9332 9333 bt_dev_dbg(hdev, "bdaddr %pMR", bdaddr); 9334 9335 bacpy(&ev.addr.bdaddr, bdaddr); 9336 ev.addr.type = link_to_bdaddr(link_type, addr_type); 9337 9338 return mgmt_event(MGMT_EV_USER_PASSKEY_REQUEST, hdev, &ev, sizeof(ev), 9339 NULL); 9340 } 9341 9342 static int user_pairing_resp_complete(struct hci_dev *hdev, bdaddr_t *bdaddr, 9343 u8 link_type, u8 addr_type, u8 status, 9344 u8 opcode) 9345 { 9346 struct mgmt_pending_cmd *cmd; 9347 9348 cmd = pending_find(opcode, hdev); 9349 if (!cmd) 9350 return -ENOENT; 9351 9352 cmd->cmd_complete(cmd, mgmt_status(status)); 9353 mgmt_pending_remove(cmd); 9354 9355 return 0; 9356 } 9357 9358 int mgmt_user_confirm_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr, 9359 u8 link_type, u8 addr_type, u8 status) 9360 { 9361 return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type, 9362 status, MGMT_OP_USER_CONFIRM_REPLY); 9363 } 9364 9365 int mgmt_user_confirm_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr, 9366 u8 link_type, u8 addr_type, u8 status) 9367 { 9368 return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type, 9369 status, 9370 MGMT_OP_USER_CONFIRM_NEG_REPLY); 9371 } 9372 9373 int mgmt_user_passkey_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr, 9374 u8 link_type, u8 addr_type, u8 status) 9375 { 9376 return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type, 9377 status, MGMT_OP_USER_PASSKEY_REPLY); 9378 } 9379 9380 int mgmt_user_passkey_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr, 9381 u8 link_type, u8 addr_type, u8 status) 9382 { 9383 return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type, 9384 status, 9385 MGMT_OP_USER_PASSKEY_NEG_REPLY); 9386 } 9387 9388 int mgmt_user_passkey_notify(struct hci_dev *hdev, bdaddr_t *bdaddr, 9389 u8 link_type, u8 addr_type, u32 passkey, 9390 u8 entered) 9391 { 9392 struct mgmt_ev_passkey_notify ev; 9393 9394 bt_dev_dbg(hdev, "bdaddr %pMR", bdaddr); 9395 9396 bacpy(&ev.addr.bdaddr, bdaddr); 9397 ev.addr.type = link_to_bdaddr(link_type, addr_type); 9398 ev.passkey = __cpu_to_le32(passkey); 9399 ev.entered = entered; 9400 9401 return mgmt_event(MGMT_EV_PASSKEY_NOTIFY, hdev, &ev, sizeof(ev), NULL); 9402 } 9403 9404 void mgmt_auth_failed(struct hci_conn *conn, u8 hci_status) 9405 { 9406 struct mgmt_ev_auth_failed ev; 9407 struct mgmt_pending_cmd *cmd; 9408 u8 status = mgmt_status(hci_status); 9409 9410 bacpy(&ev.addr.bdaddr, &conn->dst); 9411 ev.addr.type = link_to_bdaddr(conn->type, conn->dst_type); 9412 ev.status = status; 9413 9414 cmd = find_pairing(conn); 9415 9416 mgmt_event(MGMT_EV_AUTH_FAILED, conn->hdev, &ev, sizeof(ev), 9417 cmd ? cmd->sk : NULL); 9418 9419 if (cmd) { 9420 cmd->cmd_complete(cmd, status); 9421 mgmt_pending_remove(cmd); 9422 } 9423 } 9424 9425 void mgmt_auth_enable_complete(struct hci_dev *hdev, u8 status) 9426 { 9427 struct cmd_lookup match = { NULL, hdev }; 9428 bool changed; 9429 9430 if (status) { 9431 u8 mgmt_err = mgmt_status(status); 9432 mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev, 9433 cmd_status_rsp, &mgmt_err); 9434 return; 9435 } 9436 9437 if (test_bit(HCI_AUTH, &hdev->flags)) 9438 changed = !hci_dev_test_and_set_flag(hdev, HCI_LINK_SECURITY); 9439 else 9440 changed = hci_dev_test_and_clear_flag(hdev, HCI_LINK_SECURITY); 9441 9442 mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev, settings_rsp, 9443 &match); 9444 9445 if (changed) 9446 new_settings(hdev, match.sk); 9447 9448 if (match.sk) 9449 sock_put(match.sk); 9450 } 9451 9452 static void sk_lookup(struct mgmt_pending_cmd *cmd, void *data) 9453 { 9454 struct cmd_lookup *match = data; 9455 9456 if (match->sk == NULL) { 9457 match->sk = cmd->sk; 9458 sock_hold(match->sk); 9459 } 9460 } 9461 9462 void mgmt_set_class_of_dev_complete(struct hci_dev *hdev, u8 *dev_class, 9463 u8 status) 9464 { 9465 struct cmd_lookup match = { NULL, hdev, mgmt_status(status) }; 9466 9467 mgmt_pending_foreach(MGMT_OP_SET_DEV_CLASS, hdev, sk_lookup, &match); 9468 mgmt_pending_foreach(MGMT_OP_ADD_UUID, hdev, sk_lookup, &match); 9469 mgmt_pending_foreach(MGMT_OP_REMOVE_UUID, hdev, sk_lookup, &match); 9470 9471 if (!status) { 9472 mgmt_limited_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev, dev_class, 9473 3, HCI_MGMT_DEV_CLASS_EVENTS, NULL); 9474 ext_info_changed(hdev, NULL); 9475 } 9476 9477 if (match.sk) 9478 sock_put(match.sk); 9479 } 9480 9481 void mgmt_set_local_name_complete(struct hci_dev *hdev, u8 *name, u8 status) 9482 { 9483 struct mgmt_cp_set_local_name ev; 9484 struct mgmt_pending_cmd *cmd; 9485 9486 if (status) 9487 return; 9488 9489 memset(&ev, 0, sizeof(ev)); 9490 memcpy(ev.name, name, HCI_MAX_NAME_LENGTH); 9491 memcpy(ev.short_name, hdev->short_name, HCI_MAX_SHORT_NAME_LENGTH); 9492 9493 cmd = pending_find(MGMT_OP_SET_LOCAL_NAME, hdev); 9494 if (!cmd) { 9495 memcpy(hdev->dev_name, name, sizeof(hdev->dev_name)); 9496 9497 /* If this is a HCI command related to powering on the 9498 * HCI dev don't send any mgmt signals. 9499 */ 9500 if (pending_find(MGMT_OP_SET_POWERED, hdev)) 9501 return; 9502 } 9503 9504 mgmt_limited_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, &ev, sizeof(ev), 9505 HCI_MGMT_LOCAL_NAME_EVENTS, cmd ? cmd->sk : NULL); 9506 ext_info_changed(hdev, cmd ? cmd->sk : NULL); 9507 } 9508 9509 static inline bool has_uuid(u8 *uuid, u16 uuid_count, u8 (*uuids)[16]) 9510 { 9511 int i; 9512 9513 for (i = 0; i < uuid_count; i++) { 9514 if (!memcmp(uuid, uuids[i], 16)) 9515 return true; 9516 } 9517 9518 return false; 9519 } 9520 9521 static bool eir_has_uuids(u8 *eir, u16 eir_len, u16 uuid_count, u8 (*uuids)[16]) 9522 { 9523 u16 parsed = 0; 9524 9525 while (parsed < eir_len) { 9526 u8 field_len = eir[0]; 9527 u8 uuid[16]; 9528 int i; 9529 9530 if (field_len == 0) 9531 break; 9532 9533 if (eir_len - parsed < field_len + 1) 9534 break; 9535 9536 switch (eir[1]) { 9537 case EIR_UUID16_ALL: 9538 case EIR_UUID16_SOME: 9539 for (i = 0; i + 3 <= field_len; i += 2) { 9540 memcpy(uuid, bluetooth_base_uuid, 16); 9541 uuid[13] = eir[i + 3]; 9542 uuid[12] = eir[i + 2]; 9543 if (has_uuid(uuid, uuid_count, uuids)) 9544 return true; 9545 } 9546 break; 9547 case EIR_UUID32_ALL: 9548 case EIR_UUID32_SOME: 9549 for (i = 0; i + 5 <= field_len; i += 4) { 9550 memcpy(uuid, bluetooth_base_uuid, 16); 9551 uuid[15] = eir[i + 5]; 9552 uuid[14] = eir[i + 4]; 9553 uuid[13] = eir[i + 3]; 9554 uuid[12] = eir[i + 2]; 9555 if (has_uuid(uuid, uuid_count, uuids)) 9556 return true; 9557 } 9558 break; 9559 case EIR_UUID128_ALL: 9560 case EIR_UUID128_SOME: 9561 for (i = 0; i + 17 <= field_len; i += 16) { 9562 memcpy(uuid, eir + i + 2, 16); 9563 if (has_uuid(uuid, uuid_count, uuids)) 9564 return true; 9565 } 9566 break; 9567 } 9568 9569 parsed += field_len + 1; 9570 eir += field_len + 1; 9571 } 9572 9573 return false; 9574 } 9575 9576 static void restart_le_scan(struct hci_dev *hdev) 9577 { 9578 /* If controller is not scanning we are done. */ 9579 if (!hci_dev_test_flag(hdev, HCI_LE_SCAN)) 9580 return; 9581 9582 if (time_after(jiffies + DISCOV_LE_RESTART_DELAY, 9583 hdev->discovery.scan_start + 9584 hdev->discovery.scan_duration)) 9585 return; 9586 9587 queue_delayed_work(hdev->req_workqueue, &hdev->le_scan_restart, 9588 DISCOV_LE_RESTART_DELAY); 9589 } 9590 9591 static bool is_filter_match(struct hci_dev *hdev, s8 rssi, u8 *eir, 9592 u16 eir_len, u8 *scan_rsp, u8 scan_rsp_len) 9593 { 9594 /* If a RSSI threshold has been specified, and 9595 * HCI_QUIRK_STRICT_DUPLICATE_FILTER is not set, then all results with 9596 * a RSSI smaller than the RSSI threshold will be dropped. If the quirk 9597 * is set, let it through for further processing, as we might need to 9598 * restart the scan. 9599 * 9600 * For BR/EDR devices (pre 1.2) providing no RSSI during inquiry, 9601 * the results are also dropped. 9602 */ 9603 if (hdev->discovery.rssi != HCI_RSSI_INVALID && 9604 (rssi == HCI_RSSI_INVALID || 9605 (rssi < hdev->discovery.rssi && 9606 !test_bit(HCI_QUIRK_STRICT_DUPLICATE_FILTER, &hdev->quirks)))) 9607 return false; 9608 9609 if (hdev->discovery.uuid_count != 0) { 9610 /* If a list of UUIDs is provided in filter, results with no 9611 * matching UUID should be dropped. 9612 */ 9613 if (!eir_has_uuids(eir, eir_len, hdev->discovery.uuid_count, 9614 hdev->discovery.uuids) && 9615 !eir_has_uuids(scan_rsp, scan_rsp_len, 9616 hdev->discovery.uuid_count, 9617 hdev->discovery.uuids)) 9618 return false; 9619 } 9620 9621 /* If duplicate filtering does not report RSSI changes, then restart 9622 * scanning to ensure updated result with updated RSSI values. 9623 */ 9624 if (test_bit(HCI_QUIRK_STRICT_DUPLICATE_FILTER, &hdev->quirks)) { 9625 restart_le_scan(hdev); 9626 9627 /* Validate RSSI value against the RSSI threshold once more. */ 9628 if (hdev->discovery.rssi != HCI_RSSI_INVALID && 9629 rssi < hdev->discovery.rssi) 9630 return false; 9631 } 9632 9633 return true; 9634 } 9635 9636 void mgmt_adv_monitor_device_lost(struct hci_dev *hdev, u16 handle, 9637 bdaddr_t *bdaddr, u8 addr_type) 9638 { 9639 struct mgmt_ev_adv_monitor_device_lost ev; 9640 9641 ev.monitor_handle = cpu_to_le16(handle); 9642 bacpy(&ev.addr.bdaddr, bdaddr); 9643 ev.addr.type = addr_type; 9644 9645 mgmt_event(MGMT_EV_ADV_MONITOR_DEVICE_LOST, hdev, &ev, sizeof(ev), 9646 NULL); 9647 } 9648 9649 static void mgmt_send_adv_monitor_device_found(struct hci_dev *hdev, 9650 struct sk_buff *skb, 9651 struct sock *skip_sk, 9652 u16 handle) 9653 { 9654 struct sk_buff *advmon_skb; 9655 size_t advmon_skb_len; 9656 __le16 *monitor_handle; 9657 9658 if (!skb) 9659 return; 9660 9661 advmon_skb_len = (sizeof(struct mgmt_ev_adv_monitor_device_found) - 9662 sizeof(struct mgmt_ev_device_found)) + skb->len; 9663 advmon_skb = mgmt_alloc_skb(hdev, MGMT_EV_ADV_MONITOR_DEVICE_FOUND, 9664 advmon_skb_len); 9665 if (!advmon_skb) 9666 return; 9667 9668 /* ADV_MONITOR_DEVICE_FOUND is similar to DEVICE_FOUND event except 9669 * that it also has 'monitor_handle'. Make a copy of DEVICE_FOUND and 9670 * store monitor_handle of the matched monitor. 9671 */ 9672 monitor_handle = skb_put(advmon_skb, sizeof(*monitor_handle)); 9673 *monitor_handle = cpu_to_le16(handle); 9674 skb_put_data(advmon_skb, skb->data, skb->len); 9675 9676 mgmt_event_skb(advmon_skb, skip_sk); 9677 } 9678 9679 static void mgmt_adv_monitor_device_found(struct hci_dev *hdev, 9680 bdaddr_t *bdaddr, bool report_device, 9681 struct sk_buff *skb, 9682 struct sock *skip_sk) 9683 { 9684 struct monitored_device *dev, *tmp; 9685 bool matched = false; 9686 bool notified = false; 9687 9688 /* We have received the Advertisement Report because: 9689 * 1. the kernel has initiated active discovery 9690 * 2. if not, we have pend_le_reports > 0 in which case we are doing 9691 * passive scanning 9692 * 3. if none of the above is true, we have one or more active 9693 * Advertisement Monitor 9694 * 9695 * For case 1 and 2, report all advertisements via MGMT_EV_DEVICE_FOUND 9696 * and report ONLY one advertisement per device for the matched Monitor 9697 * via MGMT_EV_ADV_MONITOR_DEVICE_FOUND event. 9698 * 9699 * For case 3, since we are not active scanning and all advertisements 9700 * received are due to a matched Advertisement Monitor, report all 9701 * advertisements ONLY via MGMT_EV_ADV_MONITOR_DEVICE_FOUND event. 9702 */ 9703 if (report_device && !hdev->advmon_pend_notify) { 9704 mgmt_event_skb(skb, skip_sk); 9705 return; 9706 } 9707 9708 hdev->advmon_pend_notify = false; 9709 9710 list_for_each_entry_safe(dev, tmp, &hdev->monitored_devices, list) { 9711 if (!bacmp(&dev->bdaddr, bdaddr)) { 9712 matched = true; 9713 9714 if (!dev->notified) { 9715 mgmt_send_adv_monitor_device_found(hdev, skb, 9716 skip_sk, 9717 dev->handle); 9718 notified = true; 9719 dev->notified = true; 9720 } 9721 } 9722 9723 if (!dev->notified) 9724 hdev->advmon_pend_notify = true; 9725 } 9726 9727 if (!report_device && 9728 ((matched && !notified) || !msft_monitor_supported(hdev))) { 9729 /* Handle 0 indicates that we are not active scanning and this 9730 * is a subsequent advertisement report for an already matched 9731 * Advertisement Monitor or the controller offloading support 9732 * is not available. 9733 */ 9734 mgmt_send_adv_monitor_device_found(hdev, skb, skip_sk, 0); 9735 } 9736 9737 if (report_device) 9738 mgmt_event_skb(skb, skip_sk); 9739 else 9740 kfree_skb(skb); 9741 } 9742 9743 void mgmt_device_found(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type, 9744 u8 addr_type, u8 *dev_class, s8 rssi, u32 flags, 9745 u8 *eir, u16 eir_len, u8 *scan_rsp, u8 scan_rsp_len) 9746 { 9747 struct sk_buff *skb; 9748 struct mgmt_ev_device_found *ev; 9749 bool report_device = hci_discovery_active(hdev); 9750 9751 /* Don't send events for a non-kernel initiated discovery. With 9752 * LE one exception is if we have pend_le_reports > 0 in which 9753 * case we're doing passive scanning and want these events. 9754 */ 9755 if (!hci_discovery_active(hdev)) { 9756 if (link_type == ACL_LINK) 9757 return; 9758 if (link_type == LE_LINK && !list_empty(&hdev->pend_le_reports)) 9759 report_device = true; 9760 else if (!hci_is_adv_monitoring(hdev)) 9761 return; 9762 } 9763 9764 if (hdev->discovery.result_filtering) { 9765 /* We are using service discovery */ 9766 if (!is_filter_match(hdev, rssi, eir, eir_len, scan_rsp, 9767 scan_rsp_len)) 9768 return; 9769 } 9770 9771 if (hdev->discovery.limited) { 9772 /* Check for limited discoverable bit */ 9773 if (dev_class) { 9774 if (!(dev_class[1] & 0x20)) 9775 return; 9776 } else { 9777 u8 *flags = eir_get_data(eir, eir_len, EIR_FLAGS, NULL); 9778 if (!flags || !(flags[0] & LE_AD_LIMITED)) 9779 return; 9780 } 9781 } 9782 9783 /* Allocate skb. The 5 extra bytes are for the potential CoD field */ 9784 skb = mgmt_alloc_skb(hdev, MGMT_EV_DEVICE_FOUND, 9785 sizeof(*ev) + eir_len + scan_rsp_len + 5); 9786 if (!skb) 9787 return; 9788 9789 ev = skb_put(skb, sizeof(*ev)); 9790 9791 /* In case of device discovery with BR/EDR devices (pre 1.2), the 9792 * RSSI value was reported as 0 when not available. This behavior 9793 * is kept when using device discovery. This is required for full 9794 * backwards compatibility with the API. 9795 * 9796 * However when using service discovery, the value 127 will be 9797 * returned when the RSSI is not available. 9798 */ 9799 if (rssi == HCI_RSSI_INVALID && !hdev->discovery.report_invalid_rssi && 9800 link_type == ACL_LINK) 9801 rssi = 0; 9802 9803 bacpy(&ev->addr.bdaddr, bdaddr); 9804 ev->addr.type = link_to_bdaddr(link_type, addr_type); 9805 ev->rssi = rssi; 9806 ev->flags = cpu_to_le32(flags); 9807 9808 if (eir_len > 0) 9809 /* Copy EIR or advertising data into event */ 9810 skb_put_data(skb, eir, eir_len); 9811 9812 if (dev_class && !eir_get_data(eir, eir_len, EIR_CLASS_OF_DEV, NULL)) { 9813 u8 eir_cod[5]; 9814 9815 eir_len += eir_append_data(eir_cod, 0, EIR_CLASS_OF_DEV, 9816 dev_class, 3); 9817 skb_put_data(skb, eir_cod, sizeof(eir_cod)); 9818 } 9819 9820 if (scan_rsp_len > 0) 9821 /* Append scan response data to event */ 9822 skb_put_data(skb, scan_rsp, scan_rsp_len); 9823 9824 ev->eir_len = cpu_to_le16(eir_len + scan_rsp_len); 9825 9826 mgmt_adv_monitor_device_found(hdev, bdaddr, report_device, skb, NULL); 9827 } 9828 9829 void mgmt_remote_name(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type, 9830 u8 addr_type, s8 rssi, u8 *name, u8 name_len) 9831 { 9832 struct sk_buff *skb; 9833 struct mgmt_ev_device_found *ev; 9834 u16 eir_len = 0; 9835 u32 flags = 0; 9836 9837 skb = mgmt_alloc_skb(hdev, MGMT_EV_DEVICE_FOUND, 9838 sizeof(*ev) + (name ? eir_precalc_len(name_len) : 0)); 9839 9840 ev = skb_put(skb, sizeof(*ev)); 9841 bacpy(&ev->addr.bdaddr, bdaddr); 9842 ev->addr.type = link_to_bdaddr(link_type, addr_type); 9843 ev->rssi = rssi; 9844 9845 if (name) 9846 eir_len += eir_skb_put_data(skb, EIR_NAME_COMPLETE, name, name_len); 9847 else 9848 flags = MGMT_DEV_FOUND_NAME_REQUEST_FAILED; 9849 9850 ev->eir_len = cpu_to_le16(eir_len); 9851 ev->flags = cpu_to_le32(flags); 9852 9853 mgmt_event_skb(skb, NULL); 9854 } 9855 9856 void mgmt_discovering(struct hci_dev *hdev, u8 discovering) 9857 { 9858 struct mgmt_ev_discovering ev; 9859 9860 bt_dev_dbg(hdev, "discovering %u", discovering); 9861 9862 memset(&ev, 0, sizeof(ev)); 9863 ev.type = hdev->discovery.type; 9864 ev.discovering = discovering; 9865 9866 mgmt_event(MGMT_EV_DISCOVERING, hdev, &ev, sizeof(ev), NULL); 9867 } 9868 9869 void mgmt_suspending(struct hci_dev *hdev, u8 state) 9870 { 9871 struct mgmt_ev_controller_suspend ev; 9872 9873 ev.suspend_state = state; 9874 mgmt_event(MGMT_EV_CONTROLLER_SUSPEND, hdev, &ev, sizeof(ev), NULL); 9875 } 9876 9877 void mgmt_resuming(struct hci_dev *hdev, u8 reason, bdaddr_t *bdaddr, 9878 u8 addr_type) 9879 { 9880 struct mgmt_ev_controller_resume ev; 9881 9882 ev.wake_reason = reason; 9883 if (bdaddr) { 9884 bacpy(&ev.addr.bdaddr, bdaddr); 9885 ev.addr.type = addr_type; 9886 } else { 9887 memset(&ev.addr, 0, sizeof(ev.addr)); 9888 } 9889 9890 mgmt_event(MGMT_EV_CONTROLLER_RESUME, hdev, &ev, sizeof(ev), NULL); 9891 } 9892 9893 static struct hci_mgmt_chan chan = { 9894 .channel = HCI_CHANNEL_CONTROL, 9895 .handler_count = ARRAY_SIZE(mgmt_handlers), 9896 .handlers = mgmt_handlers, 9897 .hdev_init = mgmt_init_hdev, 9898 }; 9899 9900 int mgmt_init(void) 9901 { 9902 return hci_mgmt_chan_register(&chan); 9903 } 9904 9905 void mgmt_exit(void) 9906 { 9907 hci_mgmt_chan_unregister(&chan); 9908 } 9909