1 /* 2 BlueZ - Bluetooth protocol stack for Linux 3 4 Copyright (C) 2010 Nokia Corporation 5 Copyright (C) 2011-2012 Intel Corporation 6 7 This program is free software; you can redistribute it and/or modify 8 it under the terms of the GNU General Public License version 2 as 9 published by the Free Software Foundation; 10 11 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS 12 OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 13 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS. 14 IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY 15 CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES 16 WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN 17 ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF 18 OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. 19 20 ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS, 21 COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS 22 SOFTWARE IS DISCLAIMED. 23 */ 24 25 /* Bluetooth HCI Management interface */ 26 27 #include <linux/module.h> 28 #include <asm/unaligned.h> 29 30 #include <net/bluetooth/bluetooth.h> 31 #include <net/bluetooth/hci_core.h> 32 #include <net/bluetooth/hci_sock.h> 33 #include <net/bluetooth/l2cap.h> 34 #include <net/bluetooth/mgmt.h> 35 36 #include "hci_request.h" 37 #include "smp.h" 38 #include "mgmt_util.h" 39 #include "mgmt_config.h" 40 #include "msft.h" 41 #include "eir.h" 42 43 #define MGMT_VERSION 1 44 #define MGMT_REVISION 21 45 46 static const u16 mgmt_commands[] = { 47 MGMT_OP_READ_INDEX_LIST, 48 MGMT_OP_READ_INFO, 49 MGMT_OP_SET_POWERED, 50 MGMT_OP_SET_DISCOVERABLE, 51 MGMT_OP_SET_CONNECTABLE, 52 MGMT_OP_SET_FAST_CONNECTABLE, 53 MGMT_OP_SET_BONDABLE, 54 MGMT_OP_SET_LINK_SECURITY, 55 MGMT_OP_SET_SSP, 56 MGMT_OP_SET_HS, 57 MGMT_OP_SET_LE, 58 MGMT_OP_SET_DEV_CLASS, 59 MGMT_OP_SET_LOCAL_NAME, 60 MGMT_OP_ADD_UUID, 61 MGMT_OP_REMOVE_UUID, 62 MGMT_OP_LOAD_LINK_KEYS, 63 MGMT_OP_LOAD_LONG_TERM_KEYS, 64 MGMT_OP_DISCONNECT, 65 MGMT_OP_GET_CONNECTIONS, 66 MGMT_OP_PIN_CODE_REPLY, 67 MGMT_OP_PIN_CODE_NEG_REPLY, 68 MGMT_OP_SET_IO_CAPABILITY, 69 MGMT_OP_PAIR_DEVICE, 70 MGMT_OP_CANCEL_PAIR_DEVICE, 71 MGMT_OP_UNPAIR_DEVICE, 72 MGMT_OP_USER_CONFIRM_REPLY, 73 MGMT_OP_USER_CONFIRM_NEG_REPLY, 74 MGMT_OP_USER_PASSKEY_REPLY, 75 MGMT_OP_USER_PASSKEY_NEG_REPLY, 76 MGMT_OP_READ_LOCAL_OOB_DATA, 77 MGMT_OP_ADD_REMOTE_OOB_DATA, 78 MGMT_OP_REMOVE_REMOTE_OOB_DATA, 79 MGMT_OP_START_DISCOVERY, 80 MGMT_OP_STOP_DISCOVERY, 81 MGMT_OP_CONFIRM_NAME, 82 MGMT_OP_BLOCK_DEVICE, 83 MGMT_OP_UNBLOCK_DEVICE, 84 MGMT_OP_SET_DEVICE_ID, 85 MGMT_OP_SET_ADVERTISING, 86 MGMT_OP_SET_BREDR, 87 MGMT_OP_SET_STATIC_ADDRESS, 88 MGMT_OP_SET_SCAN_PARAMS, 89 MGMT_OP_SET_SECURE_CONN, 90 MGMT_OP_SET_DEBUG_KEYS, 91 MGMT_OP_SET_PRIVACY, 92 MGMT_OP_LOAD_IRKS, 93 MGMT_OP_GET_CONN_INFO, 94 MGMT_OP_GET_CLOCK_INFO, 95 MGMT_OP_ADD_DEVICE, 96 MGMT_OP_REMOVE_DEVICE, 97 MGMT_OP_LOAD_CONN_PARAM, 98 MGMT_OP_READ_UNCONF_INDEX_LIST, 99 MGMT_OP_READ_CONFIG_INFO, 100 MGMT_OP_SET_EXTERNAL_CONFIG, 101 MGMT_OP_SET_PUBLIC_ADDRESS, 102 MGMT_OP_START_SERVICE_DISCOVERY, 103 MGMT_OP_READ_LOCAL_OOB_EXT_DATA, 104 MGMT_OP_READ_EXT_INDEX_LIST, 105 MGMT_OP_READ_ADV_FEATURES, 106 MGMT_OP_ADD_ADVERTISING, 107 MGMT_OP_REMOVE_ADVERTISING, 108 MGMT_OP_GET_ADV_SIZE_INFO, 109 MGMT_OP_START_LIMITED_DISCOVERY, 110 MGMT_OP_READ_EXT_INFO, 111 MGMT_OP_SET_APPEARANCE, 112 MGMT_OP_GET_PHY_CONFIGURATION, 113 MGMT_OP_SET_PHY_CONFIGURATION, 114 MGMT_OP_SET_BLOCKED_KEYS, 115 MGMT_OP_SET_WIDEBAND_SPEECH, 116 MGMT_OP_READ_CONTROLLER_CAP, 117 MGMT_OP_READ_EXP_FEATURES_INFO, 118 MGMT_OP_SET_EXP_FEATURE, 119 MGMT_OP_READ_DEF_SYSTEM_CONFIG, 120 MGMT_OP_SET_DEF_SYSTEM_CONFIG, 121 MGMT_OP_READ_DEF_RUNTIME_CONFIG, 122 MGMT_OP_SET_DEF_RUNTIME_CONFIG, 123 MGMT_OP_GET_DEVICE_FLAGS, 124 MGMT_OP_SET_DEVICE_FLAGS, 125 MGMT_OP_READ_ADV_MONITOR_FEATURES, 126 MGMT_OP_ADD_ADV_PATTERNS_MONITOR, 127 MGMT_OP_REMOVE_ADV_MONITOR, 128 MGMT_OP_ADD_EXT_ADV_PARAMS, 129 MGMT_OP_ADD_EXT_ADV_DATA, 130 MGMT_OP_ADD_ADV_PATTERNS_MONITOR_RSSI, 131 }; 132 133 static const u16 mgmt_events[] = { 134 MGMT_EV_CONTROLLER_ERROR, 135 MGMT_EV_INDEX_ADDED, 136 MGMT_EV_INDEX_REMOVED, 137 MGMT_EV_NEW_SETTINGS, 138 MGMT_EV_CLASS_OF_DEV_CHANGED, 139 MGMT_EV_LOCAL_NAME_CHANGED, 140 MGMT_EV_NEW_LINK_KEY, 141 MGMT_EV_NEW_LONG_TERM_KEY, 142 MGMT_EV_DEVICE_CONNECTED, 143 MGMT_EV_DEVICE_DISCONNECTED, 144 MGMT_EV_CONNECT_FAILED, 145 MGMT_EV_PIN_CODE_REQUEST, 146 MGMT_EV_USER_CONFIRM_REQUEST, 147 MGMT_EV_USER_PASSKEY_REQUEST, 148 MGMT_EV_AUTH_FAILED, 149 MGMT_EV_DEVICE_FOUND, 150 MGMT_EV_DISCOVERING, 151 MGMT_EV_DEVICE_BLOCKED, 152 MGMT_EV_DEVICE_UNBLOCKED, 153 MGMT_EV_DEVICE_UNPAIRED, 154 MGMT_EV_PASSKEY_NOTIFY, 155 MGMT_EV_NEW_IRK, 156 MGMT_EV_NEW_CSRK, 157 MGMT_EV_DEVICE_ADDED, 158 MGMT_EV_DEVICE_REMOVED, 159 MGMT_EV_NEW_CONN_PARAM, 160 MGMT_EV_UNCONF_INDEX_ADDED, 161 MGMT_EV_UNCONF_INDEX_REMOVED, 162 MGMT_EV_NEW_CONFIG_OPTIONS, 163 MGMT_EV_EXT_INDEX_ADDED, 164 MGMT_EV_EXT_INDEX_REMOVED, 165 MGMT_EV_LOCAL_OOB_DATA_UPDATED, 166 MGMT_EV_ADVERTISING_ADDED, 167 MGMT_EV_ADVERTISING_REMOVED, 168 MGMT_EV_EXT_INFO_CHANGED, 169 MGMT_EV_PHY_CONFIGURATION_CHANGED, 170 MGMT_EV_EXP_FEATURE_CHANGED, 171 MGMT_EV_DEVICE_FLAGS_CHANGED, 172 MGMT_EV_ADV_MONITOR_ADDED, 173 MGMT_EV_ADV_MONITOR_REMOVED, 174 MGMT_EV_CONTROLLER_SUSPEND, 175 MGMT_EV_CONTROLLER_RESUME, 176 }; 177 178 static const u16 mgmt_untrusted_commands[] = { 179 MGMT_OP_READ_INDEX_LIST, 180 MGMT_OP_READ_INFO, 181 MGMT_OP_READ_UNCONF_INDEX_LIST, 182 MGMT_OP_READ_CONFIG_INFO, 183 MGMT_OP_READ_EXT_INDEX_LIST, 184 MGMT_OP_READ_EXT_INFO, 185 MGMT_OP_READ_CONTROLLER_CAP, 186 MGMT_OP_READ_EXP_FEATURES_INFO, 187 MGMT_OP_READ_DEF_SYSTEM_CONFIG, 188 MGMT_OP_READ_DEF_RUNTIME_CONFIG, 189 }; 190 191 static const u16 mgmt_untrusted_events[] = { 192 MGMT_EV_INDEX_ADDED, 193 MGMT_EV_INDEX_REMOVED, 194 MGMT_EV_NEW_SETTINGS, 195 MGMT_EV_CLASS_OF_DEV_CHANGED, 196 MGMT_EV_LOCAL_NAME_CHANGED, 197 MGMT_EV_UNCONF_INDEX_ADDED, 198 MGMT_EV_UNCONF_INDEX_REMOVED, 199 MGMT_EV_NEW_CONFIG_OPTIONS, 200 MGMT_EV_EXT_INDEX_ADDED, 201 MGMT_EV_EXT_INDEX_REMOVED, 202 MGMT_EV_EXT_INFO_CHANGED, 203 MGMT_EV_EXP_FEATURE_CHANGED, 204 }; 205 206 #define CACHE_TIMEOUT msecs_to_jiffies(2 * 1000) 207 208 #define ZERO_KEY "\x00\x00\x00\x00\x00\x00\x00\x00" \ 209 "\x00\x00\x00\x00\x00\x00\x00\x00" 210 211 /* HCI to MGMT error code conversion table */ 212 static const u8 mgmt_status_table[] = { 213 MGMT_STATUS_SUCCESS, 214 MGMT_STATUS_UNKNOWN_COMMAND, /* Unknown Command */ 215 MGMT_STATUS_NOT_CONNECTED, /* No Connection */ 216 MGMT_STATUS_FAILED, /* Hardware Failure */ 217 MGMT_STATUS_CONNECT_FAILED, /* Page Timeout */ 218 MGMT_STATUS_AUTH_FAILED, /* Authentication Failed */ 219 MGMT_STATUS_AUTH_FAILED, /* PIN or Key Missing */ 220 MGMT_STATUS_NO_RESOURCES, /* Memory Full */ 221 MGMT_STATUS_TIMEOUT, /* Connection Timeout */ 222 MGMT_STATUS_NO_RESOURCES, /* Max Number of Connections */ 223 MGMT_STATUS_NO_RESOURCES, /* Max Number of SCO Connections */ 224 MGMT_STATUS_ALREADY_CONNECTED, /* ACL Connection Exists */ 225 MGMT_STATUS_BUSY, /* Command Disallowed */ 226 MGMT_STATUS_NO_RESOURCES, /* Rejected Limited Resources */ 227 MGMT_STATUS_REJECTED, /* Rejected Security */ 228 MGMT_STATUS_REJECTED, /* Rejected Personal */ 229 MGMT_STATUS_TIMEOUT, /* Host Timeout */ 230 MGMT_STATUS_NOT_SUPPORTED, /* Unsupported Feature */ 231 MGMT_STATUS_INVALID_PARAMS, /* Invalid Parameters */ 232 MGMT_STATUS_DISCONNECTED, /* OE User Ended Connection */ 233 MGMT_STATUS_NO_RESOURCES, /* OE Low Resources */ 234 MGMT_STATUS_DISCONNECTED, /* OE Power Off */ 235 MGMT_STATUS_DISCONNECTED, /* Connection Terminated */ 236 MGMT_STATUS_BUSY, /* Repeated Attempts */ 237 MGMT_STATUS_REJECTED, /* Pairing Not Allowed */ 238 MGMT_STATUS_FAILED, /* Unknown LMP PDU */ 239 MGMT_STATUS_NOT_SUPPORTED, /* Unsupported Remote Feature */ 240 MGMT_STATUS_REJECTED, /* SCO Offset Rejected */ 241 MGMT_STATUS_REJECTED, /* SCO Interval Rejected */ 242 MGMT_STATUS_REJECTED, /* Air Mode Rejected */ 243 MGMT_STATUS_INVALID_PARAMS, /* Invalid LMP Parameters */ 244 MGMT_STATUS_FAILED, /* Unspecified Error */ 245 MGMT_STATUS_NOT_SUPPORTED, /* Unsupported LMP Parameter Value */ 246 MGMT_STATUS_FAILED, /* Role Change Not Allowed */ 247 MGMT_STATUS_TIMEOUT, /* LMP Response Timeout */ 248 MGMT_STATUS_FAILED, /* LMP Error Transaction Collision */ 249 MGMT_STATUS_FAILED, /* LMP PDU Not Allowed */ 250 MGMT_STATUS_REJECTED, /* Encryption Mode Not Accepted */ 251 MGMT_STATUS_FAILED, /* Unit Link Key Used */ 252 MGMT_STATUS_NOT_SUPPORTED, /* QoS Not Supported */ 253 MGMT_STATUS_TIMEOUT, /* Instant Passed */ 254 MGMT_STATUS_NOT_SUPPORTED, /* Pairing Not Supported */ 255 MGMT_STATUS_FAILED, /* Transaction Collision */ 256 MGMT_STATUS_FAILED, /* Reserved for future use */ 257 MGMT_STATUS_INVALID_PARAMS, /* Unacceptable Parameter */ 258 MGMT_STATUS_REJECTED, /* QoS Rejected */ 259 MGMT_STATUS_NOT_SUPPORTED, /* Classification Not Supported */ 260 MGMT_STATUS_REJECTED, /* Insufficient Security */ 261 MGMT_STATUS_INVALID_PARAMS, /* Parameter Out Of Range */ 262 MGMT_STATUS_FAILED, /* Reserved for future use */ 263 MGMT_STATUS_BUSY, /* Role Switch Pending */ 264 MGMT_STATUS_FAILED, /* Reserved for future use */ 265 MGMT_STATUS_FAILED, /* Slot Violation */ 266 MGMT_STATUS_FAILED, /* Role Switch Failed */ 267 MGMT_STATUS_INVALID_PARAMS, /* EIR Too Large */ 268 MGMT_STATUS_NOT_SUPPORTED, /* Simple Pairing Not Supported */ 269 MGMT_STATUS_BUSY, /* Host Busy Pairing */ 270 MGMT_STATUS_REJECTED, /* Rejected, No Suitable Channel */ 271 MGMT_STATUS_BUSY, /* Controller Busy */ 272 MGMT_STATUS_INVALID_PARAMS, /* Unsuitable Connection Interval */ 273 MGMT_STATUS_TIMEOUT, /* Directed Advertising Timeout */ 274 MGMT_STATUS_AUTH_FAILED, /* Terminated Due to MIC Failure */ 275 MGMT_STATUS_CONNECT_FAILED, /* Connection Establishment Failed */ 276 MGMT_STATUS_CONNECT_FAILED, /* MAC Connection Failed */ 277 }; 278 279 static u8 mgmt_status(u8 hci_status) 280 { 281 if (hci_status < ARRAY_SIZE(mgmt_status_table)) 282 return mgmt_status_table[hci_status]; 283 284 return MGMT_STATUS_FAILED; 285 } 286 287 static int mgmt_index_event(u16 event, struct hci_dev *hdev, void *data, 288 u16 len, int flag) 289 { 290 return mgmt_send_event(event, hdev, HCI_CHANNEL_CONTROL, data, len, 291 flag, NULL); 292 } 293 294 static int mgmt_limited_event(u16 event, struct hci_dev *hdev, void *data, 295 u16 len, int flag, struct sock *skip_sk) 296 { 297 return mgmt_send_event(event, hdev, HCI_CHANNEL_CONTROL, data, len, 298 flag, skip_sk); 299 } 300 301 static int mgmt_event(u16 event, struct hci_dev *hdev, void *data, u16 len, 302 struct sock *skip_sk) 303 { 304 return mgmt_send_event(event, hdev, HCI_CHANNEL_CONTROL, data, len, 305 HCI_SOCK_TRUSTED, skip_sk); 306 } 307 308 static u8 le_addr_type(u8 mgmt_addr_type) 309 { 310 if (mgmt_addr_type == BDADDR_LE_PUBLIC) 311 return ADDR_LE_DEV_PUBLIC; 312 else 313 return ADDR_LE_DEV_RANDOM; 314 } 315 316 void mgmt_fill_version_info(void *ver) 317 { 318 struct mgmt_rp_read_version *rp = ver; 319 320 rp->version = MGMT_VERSION; 321 rp->revision = cpu_to_le16(MGMT_REVISION); 322 } 323 324 static int read_version(struct sock *sk, struct hci_dev *hdev, void *data, 325 u16 data_len) 326 { 327 struct mgmt_rp_read_version rp; 328 329 bt_dev_dbg(hdev, "sock %p", sk); 330 331 mgmt_fill_version_info(&rp); 332 333 return mgmt_cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_VERSION, 0, 334 &rp, sizeof(rp)); 335 } 336 337 static int read_commands(struct sock *sk, struct hci_dev *hdev, void *data, 338 u16 data_len) 339 { 340 struct mgmt_rp_read_commands *rp; 341 u16 num_commands, num_events; 342 size_t rp_size; 343 int i, err; 344 345 bt_dev_dbg(hdev, "sock %p", sk); 346 347 if (hci_sock_test_flag(sk, HCI_SOCK_TRUSTED)) { 348 num_commands = ARRAY_SIZE(mgmt_commands); 349 num_events = ARRAY_SIZE(mgmt_events); 350 } else { 351 num_commands = ARRAY_SIZE(mgmt_untrusted_commands); 352 num_events = ARRAY_SIZE(mgmt_untrusted_events); 353 } 354 355 rp_size = sizeof(*rp) + ((num_commands + num_events) * sizeof(u16)); 356 357 rp = kmalloc(rp_size, GFP_KERNEL); 358 if (!rp) 359 return -ENOMEM; 360 361 rp->num_commands = cpu_to_le16(num_commands); 362 rp->num_events = cpu_to_le16(num_events); 363 364 if (hci_sock_test_flag(sk, HCI_SOCK_TRUSTED)) { 365 __le16 *opcode = rp->opcodes; 366 367 for (i = 0; i < num_commands; i++, opcode++) 368 put_unaligned_le16(mgmt_commands[i], opcode); 369 370 for (i = 0; i < num_events; i++, opcode++) 371 put_unaligned_le16(mgmt_events[i], opcode); 372 } else { 373 __le16 *opcode = rp->opcodes; 374 375 for (i = 0; i < num_commands; i++, opcode++) 376 put_unaligned_le16(mgmt_untrusted_commands[i], opcode); 377 378 for (i = 0; i < num_events; i++, opcode++) 379 put_unaligned_le16(mgmt_untrusted_events[i], opcode); 380 } 381 382 err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_COMMANDS, 0, 383 rp, rp_size); 384 kfree(rp); 385 386 return err; 387 } 388 389 static int read_index_list(struct sock *sk, struct hci_dev *hdev, void *data, 390 u16 data_len) 391 { 392 struct mgmt_rp_read_index_list *rp; 393 struct hci_dev *d; 394 size_t rp_len; 395 u16 count; 396 int err; 397 398 bt_dev_dbg(hdev, "sock %p", sk); 399 400 read_lock(&hci_dev_list_lock); 401 402 count = 0; 403 list_for_each_entry(d, &hci_dev_list, list) { 404 if (d->dev_type == HCI_PRIMARY && 405 !hci_dev_test_flag(d, HCI_UNCONFIGURED)) 406 count++; 407 } 408 409 rp_len = sizeof(*rp) + (2 * count); 410 rp = kmalloc(rp_len, GFP_ATOMIC); 411 if (!rp) { 412 read_unlock(&hci_dev_list_lock); 413 return -ENOMEM; 414 } 415 416 count = 0; 417 list_for_each_entry(d, &hci_dev_list, list) { 418 if (hci_dev_test_flag(d, HCI_SETUP) || 419 hci_dev_test_flag(d, HCI_CONFIG) || 420 hci_dev_test_flag(d, HCI_USER_CHANNEL)) 421 continue; 422 423 /* Devices marked as raw-only are neither configured 424 * nor unconfigured controllers. 425 */ 426 if (test_bit(HCI_QUIRK_RAW_DEVICE, &d->quirks)) 427 continue; 428 429 if (d->dev_type == HCI_PRIMARY && 430 !hci_dev_test_flag(d, HCI_UNCONFIGURED)) { 431 rp->index[count++] = cpu_to_le16(d->id); 432 bt_dev_dbg(hdev, "Added hci%u", d->id); 433 } 434 } 435 436 rp->num_controllers = cpu_to_le16(count); 437 rp_len = sizeof(*rp) + (2 * count); 438 439 read_unlock(&hci_dev_list_lock); 440 441 err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_INDEX_LIST, 442 0, rp, rp_len); 443 444 kfree(rp); 445 446 return err; 447 } 448 449 static int read_unconf_index_list(struct sock *sk, struct hci_dev *hdev, 450 void *data, u16 data_len) 451 { 452 struct mgmt_rp_read_unconf_index_list *rp; 453 struct hci_dev *d; 454 size_t rp_len; 455 u16 count; 456 int err; 457 458 bt_dev_dbg(hdev, "sock %p", sk); 459 460 read_lock(&hci_dev_list_lock); 461 462 count = 0; 463 list_for_each_entry(d, &hci_dev_list, list) { 464 if (d->dev_type == HCI_PRIMARY && 465 hci_dev_test_flag(d, HCI_UNCONFIGURED)) 466 count++; 467 } 468 469 rp_len = sizeof(*rp) + (2 * count); 470 rp = kmalloc(rp_len, GFP_ATOMIC); 471 if (!rp) { 472 read_unlock(&hci_dev_list_lock); 473 return -ENOMEM; 474 } 475 476 count = 0; 477 list_for_each_entry(d, &hci_dev_list, list) { 478 if (hci_dev_test_flag(d, HCI_SETUP) || 479 hci_dev_test_flag(d, HCI_CONFIG) || 480 hci_dev_test_flag(d, HCI_USER_CHANNEL)) 481 continue; 482 483 /* Devices marked as raw-only are neither configured 484 * nor unconfigured controllers. 485 */ 486 if (test_bit(HCI_QUIRK_RAW_DEVICE, &d->quirks)) 487 continue; 488 489 if (d->dev_type == HCI_PRIMARY && 490 hci_dev_test_flag(d, HCI_UNCONFIGURED)) { 491 rp->index[count++] = cpu_to_le16(d->id); 492 bt_dev_dbg(hdev, "Added hci%u", d->id); 493 } 494 } 495 496 rp->num_controllers = cpu_to_le16(count); 497 rp_len = sizeof(*rp) + (2 * count); 498 499 read_unlock(&hci_dev_list_lock); 500 501 err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE, 502 MGMT_OP_READ_UNCONF_INDEX_LIST, 0, rp, rp_len); 503 504 kfree(rp); 505 506 return err; 507 } 508 509 static int read_ext_index_list(struct sock *sk, struct hci_dev *hdev, 510 void *data, u16 data_len) 511 { 512 struct mgmt_rp_read_ext_index_list *rp; 513 struct hci_dev *d; 514 u16 count; 515 int err; 516 517 bt_dev_dbg(hdev, "sock %p", sk); 518 519 read_lock(&hci_dev_list_lock); 520 521 count = 0; 522 list_for_each_entry(d, &hci_dev_list, list) { 523 if (d->dev_type == HCI_PRIMARY || d->dev_type == HCI_AMP) 524 count++; 525 } 526 527 rp = kmalloc(struct_size(rp, entry, count), GFP_ATOMIC); 528 if (!rp) { 529 read_unlock(&hci_dev_list_lock); 530 return -ENOMEM; 531 } 532 533 count = 0; 534 list_for_each_entry(d, &hci_dev_list, list) { 535 if (hci_dev_test_flag(d, HCI_SETUP) || 536 hci_dev_test_flag(d, HCI_CONFIG) || 537 hci_dev_test_flag(d, HCI_USER_CHANNEL)) 538 continue; 539 540 /* Devices marked as raw-only are neither configured 541 * nor unconfigured controllers. 542 */ 543 if (test_bit(HCI_QUIRK_RAW_DEVICE, &d->quirks)) 544 continue; 545 546 if (d->dev_type == HCI_PRIMARY) { 547 if (hci_dev_test_flag(d, HCI_UNCONFIGURED)) 548 rp->entry[count].type = 0x01; 549 else 550 rp->entry[count].type = 0x00; 551 } else if (d->dev_type == HCI_AMP) { 552 rp->entry[count].type = 0x02; 553 } else { 554 continue; 555 } 556 557 rp->entry[count].bus = d->bus; 558 rp->entry[count++].index = cpu_to_le16(d->id); 559 bt_dev_dbg(hdev, "Added hci%u", d->id); 560 } 561 562 rp->num_controllers = cpu_to_le16(count); 563 564 read_unlock(&hci_dev_list_lock); 565 566 /* If this command is called at least once, then all the 567 * default index and unconfigured index events are disabled 568 * and from now on only extended index events are used. 569 */ 570 hci_sock_set_flag(sk, HCI_MGMT_EXT_INDEX_EVENTS); 571 hci_sock_clear_flag(sk, HCI_MGMT_INDEX_EVENTS); 572 hci_sock_clear_flag(sk, HCI_MGMT_UNCONF_INDEX_EVENTS); 573 574 err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE, 575 MGMT_OP_READ_EXT_INDEX_LIST, 0, rp, 576 struct_size(rp, entry, count)); 577 578 kfree(rp); 579 580 return err; 581 } 582 583 static bool is_configured(struct hci_dev *hdev) 584 { 585 if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks) && 586 !hci_dev_test_flag(hdev, HCI_EXT_CONFIGURED)) 587 return false; 588 589 if ((test_bit(HCI_QUIRK_INVALID_BDADDR, &hdev->quirks) || 590 test_bit(HCI_QUIRK_USE_BDADDR_PROPERTY, &hdev->quirks)) && 591 !bacmp(&hdev->public_addr, BDADDR_ANY)) 592 return false; 593 594 return true; 595 } 596 597 static __le32 get_missing_options(struct hci_dev *hdev) 598 { 599 u32 options = 0; 600 601 if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks) && 602 !hci_dev_test_flag(hdev, HCI_EXT_CONFIGURED)) 603 options |= MGMT_OPTION_EXTERNAL_CONFIG; 604 605 if ((test_bit(HCI_QUIRK_INVALID_BDADDR, &hdev->quirks) || 606 test_bit(HCI_QUIRK_USE_BDADDR_PROPERTY, &hdev->quirks)) && 607 !bacmp(&hdev->public_addr, BDADDR_ANY)) 608 options |= MGMT_OPTION_PUBLIC_ADDRESS; 609 610 return cpu_to_le32(options); 611 } 612 613 static int new_options(struct hci_dev *hdev, struct sock *skip) 614 { 615 __le32 options = get_missing_options(hdev); 616 617 return mgmt_limited_event(MGMT_EV_NEW_CONFIG_OPTIONS, hdev, &options, 618 sizeof(options), HCI_MGMT_OPTION_EVENTS, skip); 619 } 620 621 static int send_options_rsp(struct sock *sk, u16 opcode, struct hci_dev *hdev) 622 { 623 __le32 options = get_missing_options(hdev); 624 625 return mgmt_cmd_complete(sk, hdev->id, opcode, 0, &options, 626 sizeof(options)); 627 } 628 629 static int read_config_info(struct sock *sk, struct hci_dev *hdev, 630 void *data, u16 data_len) 631 { 632 struct mgmt_rp_read_config_info rp; 633 u32 options = 0; 634 635 bt_dev_dbg(hdev, "sock %p", sk); 636 637 hci_dev_lock(hdev); 638 639 memset(&rp, 0, sizeof(rp)); 640 rp.manufacturer = cpu_to_le16(hdev->manufacturer); 641 642 if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks)) 643 options |= MGMT_OPTION_EXTERNAL_CONFIG; 644 645 if (hdev->set_bdaddr) 646 options |= MGMT_OPTION_PUBLIC_ADDRESS; 647 648 rp.supported_options = cpu_to_le32(options); 649 rp.missing_options = get_missing_options(hdev); 650 651 hci_dev_unlock(hdev); 652 653 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_CONFIG_INFO, 0, 654 &rp, sizeof(rp)); 655 } 656 657 static u32 get_supported_phys(struct hci_dev *hdev) 658 { 659 u32 supported_phys = 0; 660 661 if (lmp_bredr_capable(hdev)) { 662 supported_phys |= MGMT_PHY_BR_1M_1SLOT; 663 664 if (hdev->features[0][0] & LMP_3SLOT) 665 supported_phys |= MGMT_PHY_BR_1M_3SLOT; 666 667 if (hdev->features[0][0] & LMP_5SLOT) 668 supported_phys |= MGMT_PHY_BR_1M_5SLOT; 669 670 if (lmp_edr_2m_capable(hdev)) { 671 supported_phys |= MGMT_PHY_EDR_2M_1SLOT; 672 673 if (lmp_edr_3slot_capable(hdev)) 674 supported_phys |= MGMT_PHY_EDR_2M_3SLOT; 675 676 if (lmp_edr_5slot_capable(hdev)) 677 supported_phys |= MGMT_PHY_EDR_2M_5SLOT; 678 679 if (lmp_edr_3m_capable(hdev)) { 680 supported_phys |= MGMT_PHY_EDR_3M_1SLOT; 681 682 if (lmp_edr_3slot_capable(hdev)) 683 supported_phys |= MGMT_PHY_EDR_3M_3SLOT; 684 685 if (lmp_edr_5slot_capable(hdev)) 686 supported_phys |= MGMT_PHY_EDR_3M_5SLOT; 687 } 688 } 689 } 690 691 if (lmp_le_capable(hdev)) { 692 supported_phys |= MGMT_PHY_LE_1M_TX; 693 supported_phys |= MGMT_PHY_LE_1M_RX; 694 695 if (hdev->le_features[1] & HCI_LE_PHY_2M) { 696 supported_phys |= MGMT_PHY_LE_2M_TX; 697 supported_phys |= MGMT_PHY_LE_2M_RX; 698 } 699 700 if (hdev->le_features[1] & HCI_LE_PHY_CODED) { 701 supported_phys |= MGMT_PHY_LE_CODED_TX; 702 supported_phys |= MGMT_PHY_LE_CODED_RX; 703 } 704 } 705 706 return supported_phys; 707 } 708 709 static u32 get_selected_phys(struct hci_dev *hdev) 710 { 711 u32 selected_phys = 0; 712 713 if (lmp_bredr_capable(hdev)) { 714 selected_phys |= MGMT_PHY_BR_1M_1SLOT; 715 716 if (hdev->pkt_type & (HCI_DM3 | HCI_DH3)) 717 selected_phys |= MGMT_PHY_BR_1M_3SLOT; 718 719 if (hdev->pkt_type & (HCI_DM5 | HCI_DH5)) 720 selected_phys |= MGMT_PHY_BR_1M_5SLOT; 721 722 if (lmp_edr_2m_capable(hdev)) { 723 if (!(hdev->pkt_type & HCI_2DH1)) 724 selected_phys |= MGMT_PHY_EDR_2M_1SLOT; 725 726 if (lmp_edr_3slot_capable(hdev) && 727 !(hdev->pkt_type & HCI_2DH3)) 728 selected_phys |= MGMT_PHY_EDR_2M_3SLOT; 729 730 if (lmp_edr_5slot_capable(hdev) && 731 !(hdev->pkt_type & HCI_2DH5)) 732 selected_phys |= MGMT_PHY_EDR_2M_5SLOT; 733 734 if (lmp_edr_3m_capable(hdev)) { 735 if (!(hdev->pkt_type & HCI_3DH1)) 736 selected_phys |= MGMT_PHY_EDR_3M_1SLOT; 737 738 if (lmp_edr_3slot_capable(hdev) && 739 !(hdev->pkt_type & HCI_3DH3)) 740 selected_phys |= MGMT_PHY_EDR_3M_3SLOT; 741 742 if (lmp_edr_5slot_capable(hdev) && 743 !(hdev->pkt_type & HCI_3DH5)) 744 selected_phys |= MGMT_PHY_EDR_3M_5SLOT; 745 } 746 } 747 } 748 749 if (lmp_le_capable(hdev)) { 750 if (hdev->le_tx_def_phys & HCI_LE_SET_PHY_1M) 751 selected_phys |= MGMT_PHY_LE_1M_TX; 752 753 if (hdev->le_rx_def_phys & HCI_LE_SET_PHY_1M) 754 selected_phys |= MGMT_PHY_LE_1M_RX; 755 756 if (hdev->le_tx_def_phys & HCI_LE_SET_PHY_2M) 757 selected_phys |= MGMT_PHY_LE_2M_TX; 758 759 if (hdev->le_rx_def_phys & HCI_LE_SET_PHY_2M) 760 selected_phys |= MGMT_PHY_LE_2M_RX; 761 762 if (hdev->le_tx_def_phys & HCI_LE_SET_PHY_CODED) 763 selected_phys |= MGMT_PHY_LE_CODED_TX; 764 765 if (hdev->le_rx_def_phys & HCI_LE_SET_PHY_CODED) 766 selected_phys |= MGMT_PHY_LE_CODED_RX; 767 } 768 769 return selected_phys; 770 } 771 772 static u32 get_configurable_phys(struct hci_dev *hdev) 773 { 774 return (get_supported_phys(hdev) & ~MGMT_PHY_BR_1M_1SLOT & 775 ~MGMT_PHY_LE_1M_TX & ~MGMT_PHY_LE_1M_RX); 776 } 777 778 static u32 get_supported_settings(struct hci_dev *hdev) 779 { 780 u32 settings = 0; 781 782 settings |= MGMT_SETTING_POWERED; 783 settings |= MGMT_SETTING_BONDABLE; 784 settings |= MGMT_SETTING_DEBUG_KEYS; 785 settings |= MGMT_SETTING_CONNECTABLE; 786 settings |= MGMT_SETTING_DISCOVERABLE; 787 788 if (lmp_bredr_capable(hdev)) { 789 if (hdev->hci_ver >= BLUETOOTH_VER_1_2) 790 settings |= MGMT_SETTING_FAST_CONNECTABLE; 791 settings |= MGMT_SETTING_BREDR; 792 settings |= MGMT_SETTING_LINK_SECURITY; 793 794 if (lmp_ssp_capable(hdev)) { 795 settings |= MGMT_SETTING_SSP; 796 if (IS_ENABLED(CONFIG_BT_HS)) 797 settings |= MGMT_SETTING_HS; 798 } 799 800 if (lmp_sc_capable(hdev)) 801 settings |= MGMT_SETTING_SECURE_CONN; 802 803 if (test_bit(HCI_QUIRK_WIDEBAND_SPEECH_SUPPORTED, 804 &hdev->quirks)) 805 settings |= MGMT_SETTING_WIDEBAND_SPEECH; 806 } 807 808 if (lmp_le_capable(hdev)) { 809 settings |= MGMT_SETTING_LE; 810 settings |= MGMT_SETTING_SECURE_CONN; 811 settings |= MGMT_SETTING_PRIVACY; 812 settings |= MGMT_SETTING_STATIC_ADDRESS; 813 814 /* When the experimental feature for LL Privacy support is 815 * enabled, then advertising is no longer supported. 816 */ 817 if (!hci_dev_test_flag(hdev, HCI_ENABLE_LL_PRIVACY)) 818 settings |= MGMT_SETTING_ADVERTISING; 819 } 820 821 if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks) || 822 hdev->set_bdaddr) 823 settings |= MGMT_SETTING_CONFIGURATION; 824 825 settings |= MGMT_SETTING_PHY_CONFIGURATION; 826 827 return settings; 828 } 829 830 static u32 get_current_settings(struct hci_dev *hdev) 831 { 832 u32 settings = 0; 833 834 if (hdev_is_powered(hdev)) 835 settings |= MGMT_SETTING_POWERED; 836 837 if (hci_dev_test_flag(hdev, HCI_CONNECTABLE)) 838 settings |= MGMT_SETTING_CONNECTABLE; 839 840 if (hci_dev_test_flag(hdev, HCI_FAST_CONNECTABLE)) 841 settings |= MGMT_SETTING_FAST_CONNECTABLE; 842 843 if (hci_dev_test_flag(hdev, HCI_DISCOVERABLE)) 844 settings |= MGMT_SETTING_DISCOVERABLE; 845 846 if (hci_dev_test_flag(hdev, HCI_BONDABLE)) 847 settings |= MGMT_SETTING_BONDABLE; 848 849 if (hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) 850 settings |= MGMT_SETTING_BREDR; 851 852 if (hci_dev_test_flag(hdev, HCI_LE_ENABLED)) 853 settings |= MGMT_SETTING_LE; 854 855 if (hci_dev_test_flag(hdev, HCI_LINK_SECURITY)) 856 settings |= MGMT_SETTING_LINK_SECURITY; 857 858 if (hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) 859 settings |= MGMT_SETTING_SSP; 860 861 if (hci_dev_test_flag(hdev, HCI_HS_ENABLED)) 862 settings |= MGMT_SETTING_HS; 863 864 if (hci_dev_test_flag(hdev, HCI_ADVERTISING)) 865 settings |= MGMT_SETTING_ADVERTISING; 866 867 if (hci_dev_test_flag(hdev, HCI_SC_ENABLED)) 868 settings |= MGMT_SETTING_SECURE_CONN; 869 870 if (hci_dev_test_flag(hdev, HCI_KEEP_DEBUG_KEYS)) 871 settings |= MGMT_SETTING_DEBUG_KEYS; 872 873 if (hci_dev_test_flag(hdev, HCI_PRIVACY)) 874 settings |= MGMT_SETTING_PRIVACY; 875 876 /* The current setting for static address has two purposes. The 877 * first is to indicate if the static address will be used and 878 * the second is to indicate if it is actually set. 879 * 880 * This means if the static address is not configured, this flag 881 * will never be set. If the address is configured, then if the 882 * address is actually used decides if the flag is set or not. 883 * 884 * For single mode LE only controllers and dual-mode controllers 885 * with BR/EDR disabled, the existence of the static address will 886 * be evaluated. 887 */ 888 if (hci_dev_test_flag(hdev, HCI_FORCE_STATIC_ADDR) || 889 !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) || 890 !bacmp(&hdev->bdaddr, BDADDR_ANY)) { 891 if (bacmp(&hdev->static_addr, BDADDR_ANY)) 892 settings |= MGMT_SETTING_STATIC_ADDRESS; 893 } 894 895 if (hci_dev_test_flag(hdev, HCI_WIDEBAND_SPEECH_ENABLED)) 896 settings |= MGMT_SETTING_WIDEBAND_SPEECH; 897 898 return settings; 899 } 900 901 static struct mgmt_pending_cmd *pending_find(u16 opcode, struct hci_dev *hdev) 902 { 903 return mgmt_pending_find(HCI_CHANNEL_CONTROL, opcode, hdev); 904 } 905 906 static struct mgmt_pending_cmd *pending_find_data(u16 opcode, 907 struct hci_dev *hdev, 908 const void *data) 909 { 910 return mgmt_pending_find_data(HCI_CHANNEL_CONTROL, opcode, hdev, data); 911 } 912 913 u8 mgmt_get_adv_discov_flags(struct hci_dev *hdev) 914 { 915 struct mgmt_pending_cmd *cmd; 916 917 /* If there's a pending mgmt command the flags will not yet have 918 * their final values, so check for this first. 919 */ 920 cmd = pending_find(MGMT_OP_SET_DISCOVERABLE, hdev); 921 if (cmd) { 922 struct mgmt_mode *cp = cmd->param; 923 if (cp->val == 0x01) 924 return LE_AD_GENERAL; 925 else if (cp->val == 0x02) 926 return LE_AD_LIMITED; 927 } else { 928 if (hci_dev_test_flag(hdev, HCI_LIMITED_DISCOVERABLE)) 929 return LE_AD_LIMITED; 930 else if (hci_dev_test_flag(hdev, HCI_DISCOVERABLE)) 931 return LE_AD_GENERAL; 932 } 933 934 return 0; 935 } 936 937 bool mgmt_get_connectable(struct hci_dev *hdev) 938 { 939 struct mgmt_pending_cmd *cmd; 940 941 /* If there's a pending mgmt command the flag will not yet have 942 * it's final value, so check for this first. 943 */ 944 cmd = pending_find(MGMT_OP_SET_CONNECTABLE, hdev); 945 if (cmd) { 946 struct mgmt_mode *cp = cmd->param; 947 948 return cp->val; 949 } 950 951 return hci_dev_test_flag(hdev, HCI_CONNECTABLE); 952 } 953 954 static void service_cache_off(struct work_struct *work) 955 { 956 struct hci_dev *hdev = container_of(work, struct hci_dev, 957 service_cache.work); 958 struct hci_request req; 959 960 if (!hci_dev_test_and_clear_flag(hdev, HCI_SERVICE_CACHE)) 961 return; 962 963 hci_req_init(&req, hdev); 964 965 hci_dev_lock(hdev); 966 967 __hci_req_update_eir(&req); 968 __hci_req_update_class(&req); 969 970 hci_dev_unlock(hdev); 971 972 hci_req_run(&req, NULL); 973 } 974 975 static void rpa_expired(struct work_struct *work) 976 { 977 struct hci_dev *hdev = container_of(work, struct hci_dev, 978 rpa_expired.work); 979 struct hci_request req; 980 981 bt_dev_dbg(hdev, ""); 982 983 hci_dev_set_flag(hdev, HCI_RPA_EXPIRED); 984 985 if (!hci_dev_test_flag(hdev, HCI_ADVERTISING)) 986 return; 987 988 /* The generation of a new RPA and programming it into the 989 * controller happens in the hci_req_enable_advertising() 990 * function. 991 */ 992 hci_req_init(&req, hdev); 993 if (ext_adv_capable(hdev)) 994 __hci_req_start_ext_adv(&req, hdev->cur_adv_instance); 995 else 996 __hci_req_enable_advertising(&req); 997 hci_req_run(&req, NULL); 998 } 999 1000 static void mgmt_init_hdev(struct sock *sk, struct hci_dev *hdev) 1001 { 1002 if (hci_dev_test_and_set_flag(hdev, HCI_MGMT)) 1003 return; 1004 1005 INIT_DELAYED_WORK(&hdev->service_cache, service_cache_off); 1006 INIT_DELAYED_WORK(&hdev->rpa_expired, rpa_expired); 1007 1008 /* Non-mgmt controlled devices get this bit set 1009 * implicitly so that pairing works for them, however 1010 * for mgmt we require user-space to explicitly enable 1011 * it 1012 */ 1013 hci_dev_clear_flag(hdev, HCI_BONDABLE); 1014 } 1015 1016 static int read_controller_info(struct sock *sk, struct hci_dev *hdev, 1017 void *data, u16 data_len) 1018 { 1019 struct mgmt_rp_read_info rp; 1020 1021 bt_dev_dbg(hdev, "sock %p", sk); 1022 1023 hci_dev_lock(hdev); 1024 1025 memset(&rp, 0, sizeof(rp)); 1026 1027 bacpy(&rp.bdaddr, &hdev->bdaddr); 1028 1029 rp.version = hdev->hci_ver; 1030 rp.manufacturer = cpu_to_le16(hdev->manufacturer); 1031 1032 rp.supported_settings = cpu_to_le32(get_supported_settings(hdev)); 1033 rp.current_settings = cpu_to_le32(get_current_settings(hdev)); 1034 1035 memcpy(rp.dev_class, hdev->dev_class, 3); 1036 1037 memcpy(rp.name, hdev->dev_name, sizeof(hdev->dev_name)); 1038 memcpy(rp.short_name, hdev->short_name, sizeof(hdev->short_name)); 1039 1040 hci_dev_unlock(hdev); 1041 1042 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_INFO, 0, &rp, 1043 sizeof(rp)); 1044 } 1045 1046 static u16 append_eir_data_to_buf(struct hci_dev *hdev, u8 *eir) 1047 { 1048 u16 eir_len = 0; 1049 size_t name_len; 1050 1051 if (hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) 1052 eir_len = eir_append_data(eir, eir_len, EIR_CLASS_OF_DEV, 1053 hdev->dev_class, 3); 1054 1055 if (hci_dev_test_flag(hdev, HCI_LE_ENABLED)) 1056 eir_len = eir_append_le16(eir, eir_len, EIR_APPEARANCE, 1057 hdev->appearance); 1058 1059 name_len = strlen(hdev->dev_name); 1060 eir_len = eir_append_data(eir, eir_len, EIR_NAME_COMPLETE, 1061 hdev->dev_name, name_len); 1062 1063 name_len = strlen(hdev->short_name); 1064 eir_len = eir_append_data(eir, eir_len, EIR_NAME_SHORT, 1065 hdev->short_name, name_len); 1066 1067 return eir_len; 1068 } 1069 1070 static int read_ext_controller_info(struct sock *sk, struct hci_dev *hdev, 1071 void *data, u16 data_len) 1072 { 1073 char buf[512]; 1074 struct mgmt_rp_read_ext_info *rp = (void *)buf; 1075 u16 eir_len; 1076 1077 bt_dev_dbg(hdev, "sock %p", sk); 1078 1079 memset(&buf, 0, sizeof(buf)); 1080 1081 hci_dev_lock(hdev); 1082 1083 bacpy(&rp->bdaddr, &hdev->bdaddr); 1084 1085 rp->version = hdev->hci_ver; 1086 rp->manufacturer = cpu_to_le16(hdev->manufacturer); 1087 1088 rp->supported_settings = cpu_to_le32(get_supported_settings(hdev)); 1089 rp->current_settings = cpu_to_le32(get_current_settings(hdev)); 1090 1091 1092 eir_len = append_eir_data_to_buf(hdev, rp->eir); 1093 rp->eir_len = cpu_to_le16(eir_len); 1094 1095 hci_dev_unlock(hdev); 1096 1097 /* If this command is called at least once, then the events 1098 * for class of device and local name changes are disabled 1099 * and only the new extended controller information event 1100 * is used. 1101 */ 1102 hci_sock_set_flag(sk, HCI_MGMT_EXT_INFO_EVENTS); 1103 hci_sock_clear_flag(sk, HCI_MGMT_DEV_CLASS_EVENTS); 1104 hci_sock_clear_flag(sk, HCI_MGMT_LOCAL_NAME_EVENTS); 1105 1106 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_EXT_INFO, 0, rp, 1107 sizeof(*rp) + eir_len); 1108 } 1109 1110 static int ext_info_changed(struct hci_dev *hdev, struct sock *skip) 1111 { 1112 char buf[512]; 1113 struct mgmt_ev_ext_info_changed *ev = (void *)buf; 1114 u16 eir_len; 1115 1116 memset(buf, 0, sizeof(buf)); 1117 1118 eir_len = append_eir_data_to_buf(hdev, ev->eir); 1119 ev->eir_len = cpu_to_le16(eir_len); 1120 1121 return mgmt_limited_event(MGMT_EV_EXT_INFO_CHANGED, hdev, ev, 1122 sizeof(*ev) + eir_len, 1123 HCI_MGMT_EXT_INFO_EVENTS, skip); 1124 } 1125 1126 static int send_settings_rsp(struct sock *sk, u16 opcode, struct hci_dev *hdev) 1127 { 1128 __le32 settings = cpu_to_le32(get_current_settings(hdev)); 1129 1130 return mgmt_cmd_complete(sk, hdev->id, opcode, 0, &settings, 1131 sizeof(settings)); 1132 } 1133 1134 static void clean_up_hci_complete(struct hci_dev *hdev, u8 status, u16 opcode) 1135 { 1136 bt_dev_dbg(hdev, "status 0x%02x", status); 1137 1138 if (hci_conn_count(hdev) == 0) { 1139 cancel_delayed_work(&hdev->power_off); 1140 queue_work(hdev->req_workqueue, &hdev->power_off.work); 1141 } 1142 } 1143 1144 void mgmt_advertising_added(struct sock *sk, struct hci_dev *hdev, u8 instance) 1145 { 1146 struct mgmt_ev_advertising_added ev; 1147 1148 ev.instance = instance; 1149 1150 mgmt_event(MGMT_EV_ADVERTISING_ADDED, hdev, &ev, sizeof(ev), sk); 1151 } 1152 1153 void mgmt_advertising_removed(struct sock *sk, struct hci_dev *hdev, 1154 u8 instance) 1155 { 1156 struct mgmt_ev_advertising_removed ev; 1157 1158 ev.instance = instance; 1159 1160 mgmt_event(MGMT_EV_ADVERTISING_REMOVED, hdev, &ev, sizeof(ev), sk); 1161 } 1162 1163 static void cancel_adv_timeout(struct hci_dev *hdev) 1164 { 1165 if (hdev->adv_instance_timeout) { 1166 hdev->adv_instance_timeout = 0; 1167 cancel_delayed_work(&hdev->adv_instance_expire); 1168 } 1169 } 1170 1171 static int clean_up_hci_state(struct hci_dev *hdev) 1172 { 1173 struct hci_request req; 1174 struct hci_conn *conn; 1175 bool discov_stopped; 1176 int err; 1177 1178 hci_req_init(&req, hdev); 1179 1180 if (test_bit(HCI_ISCAN, &hdev->flags) || 1181 test_bit(HCI_PSCAN, &hdev->flags)) { 1182 u8 scan = 0x00; 1183 hci_req_add(&req, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan); 1184 } 1185 1186 hci_req_clear_adv_instance(hdev, NULL, NULL, 0x00, false); 1187 1188 if (hci_dev_test_flag(hdev, HCI_LE_ADV)) 1189 __hci_req_disable_advertising(&req); 1190 1191 discov_stopped = hci_req_stop_discovery(&req); 1192 1193 list_for_each_entry(conn, &hdev->conn_hash.list, list) { 1194 /* 0x15 == Terminated due to Power Off */ 1195 __hci_abort_conn(&req, conn, 0x15); 1196 } 1197 1198 err = hci_req_run(&req, clean_up_hci_complete); 1199 if (!err && discov_stopped) 1200 hci_discovery_set_state(hdev, DISCOVERY_STOPPING); 1201 1202 return err; 1203 } 1204 1205 static int set_powered(struct sock *sk, struct hci_dev *hdev, void *data, 1206 u16 len) 1207 { 1208 struct mgmt_mode *cp = data; 1209 struct mgmt_pending_cmd *cmd; 1210 int err; 1211 1212 bt_dev_dbg(hdev, "sock %p", sk); 1213 1214 if (cp->val != 0x00 && cp->val != 0x01) 1215 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED, 1216 MGMT_STATUS_INVALID_PARAMS); 1217 1218 hci_dev_lock(hdev); 1219 1220 if (pending_find(MGMT_OP_SET_POWERED, hdev)) { 1221 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED, 1222 MGMT_STATUS_BUSY); 1223 goto failed; 1224 } 1225 1226 if (!!cp->val == hdev_is_powered(hdev)) { 1227 err = send_settings_rsp(sk, MGMT_OP_SET_POWERED, hdev); 1228 goto failed; 1229 } 1230 1231 cmd = mgmt_pending_add(sk, MGMT_OP_SET_POWERED, hdev, data, len); 1232 if (!cmd) { 1233 err = -ENOMEM; 1234 goto failed; 1235 } 1236 1237 if (cp->val) { 1238 queue_work(hdev->req_workqueue, &hdev->power_on); 1239 err = 0; 1240 } else { 1241 /* Disconnect connections, stop scans, etc */ 1242 err = clean_up_hci_state(hdev); 1243 if (!err) 1244 queue_delayed_work(hdev->req_workqueue, &hdev->power_off, 1245 HCI_POWER_OFF_TIMEOUT); 1246 1247 /* ENODATA means there were no HCI commands queued */ 1248 if (err == -ENODATA) { 1249 cancel_delayed_work(&hdev->power_off); 1250 queue_work(hdev->req_workqueue, &hdev->power_off.work); 1251 err = 0; 1252 } 1253 } 1254 1255 failed: 1256 hci_dev_unlock(hdev); 1257 return err; 1258 } 1259 1260 static int new_settings(struct hci_dev *hdev, struct sock *skip) 1261 { 1262 __le32 ev = cpu_to_le32(get_current_settings(hdev)); 1263 1264 return mgmt_limited_event(MGMT_EV_NEW_SETTINGS, hdev, &ev, 1265 sizeof(ev), HCI_MGMT_SETTING_EVENTS, skip); 1266 } 1267 1268 int mgmt_new_settings(struct hci_dev *hdev) 1269 { 1270 return new_settings(hdev, NULL); 1271 } 1272 1273 struct cmd_lookup { 1274 struct sock *sk; 1275 struct hci_dev *hdev; 1276 u8 mgmt_status; 1277 }; 1278 1279 static void settings_rsp(struct mgmt_pending_cmd *cmd, void *data) 1280 { 1281 struct cmd_lookup *match = data; 1282 1283 send_settings_rsp(cmd->sk, cmd->opcode, match->hdev); 1284 1285 list_del(&cmd->list); 1286 1287 if (match->sk == NULL) { 1288 match->sk = cmd->sk; 1289 sock_hold(match->sk); 1290 } 1291 1292 mgmt_pending_free(cmd); 1293 } 1294 1295 static void cmd_status_rsp(struct mgmt_pending_cmd *cmd, void *data) 1296 { 1297 u8 *status = data; 1298 1299 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, *status); 1300 mgmt_pending_remove(cmd); 1301 } 1302 1303 static void cmd_complete_rsp(struct mgmt_pending_cmd *cmd, void *data) 1304 { 1305 if (cmd->cmd_complete) { 1306 u8 *status = data; 1307 1308 cmd->cmd_complete(cmd, *status); 1309 mgmt_pending_remove(cmd); 1310 1311 return; 1312 } 1313 1314 cmd_status_rsp(cmd, data); 1315 } 1316 1317 static int generic_cmd_complete(struct mgmt_pending_cmd *cmd, u8 status) 1318 { 1319 return mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, status, 1320 cmd->param, cmd->param_len); 1321 } 1322 1323 static int addr_cmd_complete(struct mgmt_pending_cmd *cmd, u8 status) 1324 { 1325 return mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, status, 1326 cmd->param, sizeof(struct mgmt_addr_info)); 1327 } 1328 1329 static u8 mgmt_bredr_support(struct hci_dev *hdev) 1330 { 1331 if (!lmp_bredr_capable(hdev)) 1332 return MGMT_STATUS_NOT_SUPPORTED; 1333 else if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) 1334 return MGMT_STATUS_REJECTED; 1335 else 1336 return MGMT_STATUS_SUCCESS; 1337 } 1338 1339 static u8 mgmt_le_support(struct hci_dev *hdev) 1340 { 1341 if (!lmp_le_capable(hdev)) 1342 return MGMT_STATUS_NOT_SUPPORTED; 1343 else if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED)) 1344 return MGMT_STATUS_REJECTED; 1345 else 1346 return MGMT_STATUS_SUCCESS; 1347 } 1348 1349 void mgmt_set_discoverable_complete(struct hci_dev *hdev, u8 status) 1350 { 1351 struct mgmt_pending_cmd *cmd; 1352 1353 bt_dev_dbg(hdev, "status 0x%02x", status); 1354 1355 hci_dev_lock(hdev); 1356 1357 cmd = pending_find(MGMT_OP_SET_DISCOVERABLE, hdev); 1358 if (!cmd) 1359 goto unlock; 1360 1361 if (status) { 1362 u8 mgmt_err = mgmt_status(status); 1363 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err); 1364 hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE); 1365 goto remove_cmd; 1366 } 1367 1368 if (hci_dev_test_flag(hdev, HCI_DISCOVERABLE) && 1369 hdev->discov_timeout > 0) { 1370 int to = msecs_to_jiffies(hdev->discov_timeout * 1000); 1371 queue_delayed_work(hdev->req_workqueue, &hdev->discov_off, to); 1372 } 1373 1374 send_settings_rsp(cmd->sk, MGMT_OP_SET_DISCOVERABLE, hdev); 1375 new_settings(hdev, cmd->sk); 1376 1377 remove_cmd: 1378 mgmt_pending_remove(cmd); 1379 1380 unlock: 1381 hci_dev_unlock(hdev); 1382 } 1383 1384 static int set_discoverable(struct sock *sk, struct hci_dev *hdev, void *data, 1385 u16 len) 1386 { 1387 struct mgmt_cp_set_discoverable *cp = data; 1388 struct mgmt_pending_cmd *cmd; 1389 u16 timeout; 1390 int err; 1391 1392 bt_dev_dbg(hdev, "sock %p", sk); 1393 1394 if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED) && 1395 !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) 1396 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE, 1397 MGMT_STATUS_REJECTED); 1398 1399 if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02) 1400 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE, 1401 MGMT_STATUS_INVALID_PARAMS); 1402 1403 timeout = __le16_to_cpu(cp->timeout); 1404 1405 /* Disabling discoverable requires that no timeout is set, 1406 * and enabling limited discoverable requires a timeout. 1407 */ 1408 if ((cp->val == 0x00 && timeout > 0) || 1409 (cp->val == 0x02 && timeout == 0)) 1410 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE, 1411 MGMT_STATUS_INVALID_PARAMS); 1412 1413 hci_dev_lock(hdev); 1414 1415 if (!hdev_is_powered(hdev) && timeout > 0) { 1416 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE, 1417 MGMT_STATUS_NOT_POWERED); 1418 goto failed; 1419 } 1420 1421 if (pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) || 1422 pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) { 1423 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE, 1424 MGMT_STATUS_BUSY); 1425 goto failed; 1426 } 1427 1428 if (!hci_dev_test_flag(hdev, HCI_CONNECTABLE)) { 1429 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE, 1430 MGMT_STATUS_REJECTED); 1431 goto failed; 1432 } 1433 1434 if (hdev->advertising_paused) { 1435 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE, 1436 MGMT_STATUS_BUSY); 1437 goto failed; 1438 } 1439 1440 if (!hdev_is_powered(hdev)) { 1441 bool changed = false; 1442 1443 /* Setting limited discoverable when powered off is 1444 * not a valid operation since it requires a timeout 1445 * and so no need to check HCI_LIMITED_DISCOVERABLE. 1446 */ 1447 if (!!cp->val != hci_dev_test_flag(hdev, HCI_DISCOVERABLE)) { 1448 hci_dev_change_flag(hdev, HCI_DISCOVERABLE); 1449 changed = true; 1450 } 1451 1452 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev); 1453 if (err < 0) 1454 goto failed; 1455 1456 if (changed) 1457 err = new_settings(hdev, sk); 1458 1459 goto failed; 1460 } 1461 1462 /* If the current mode is the same, then just update the timeout 1463 * value with the new value. And if only the timeout gets updated, 1464 * then no need for any HCI transactions. 1465 */ 1466 if (!!cp->val == hci_dev_test_flag(hdev, HCI_DISCOVERABLE) && 1467 (cp->val == 0x02) == hci_dev_test_flag(hdev, 1468 HCI_LIMITED_DISCOVERABLE)) { 1469 cancel_delayed_work(&hdev->discov_off); 1470 hdev->discov_timeout = timeout; 1471 1472 if (cp->val && hdev->discov_timeout > 0) { 1473 int to = msecs_to_jiffies(hdev->discov_timeout * 1000); 1474 queue_delayed_work(hdev->req_workqueue, 1475 &hdev->discov_off, to); 1476 } 1477 1478 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev); 1479 goto failed; 1480 } 1481 1482 cmd = mgmt_pending_add(sk, MGMT_OP_SET_DISCOVERABLE, hdev, data, len); 1483 if (!cmd) { 1484 err = -ENOMEM; 1485 goto failed; 1486 } 1487 1488 /* Cancel any potential discoverable timeout that might be 1489 * still active and store new timeout value. The arming of 1490 * the timeout happens in the complete handler. 1491 */ 1492 cancel_delayed_work(&hdev->discov_off); 1493 hdev->discov_timeout = timeout; 1494 1495 if (cp->val) 1496 hci_dev_set_flag(hdev, HCI_DISCOVERABLE); 1497 else 1498 hci_dev_clear_flag(hdev, HCI_DISCOVERABLE); 1499 1500 /* Limited discoverable mode */ 1501 if (cp->val == 0x02) 1502 hci_dev_set_flag(hdev, HCI_LIMITED_DISCOVERABLE); 1503 else 1504 hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE); 1505 1506 queue_work(hdev->req_workqueue, &hdev->discoverable_update); 1507 err = 0; 1508 1509 failed: 1510 hci_dev_unlock(hdev); 1511 return err; 1512 } 1513 1514 void mgmt_set_connectable_complete(struct hci_dev *hdev, u8 status) 1515 { 1516 struct mgmt_pending_cmd *cmd; 1517 1518 bt_dev_dbg(hdev, "status 0x%02x", status); 1519 1520 hci_dev_lock(hdev); 1521 1522 cmd = pending_find(MGMT_OP_SET_CONNECTABLE, hdev); 1523 if (!cmd) 1524 goto unlock; 1525 1526 if (status) { 1527 u8 mgmt_err = mgmt_status(status); 1528 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err); 1529 goto remove_cmd; 1530 } 1531 1532 send_settings_rsp(cmd->sk, MGMT_OP_SET_CONNECTABLE, hdev); 1533 new_settings(hdev, cmd->sk); 1534 1535 remove_cmd: 1536 mgmt_pending_remove(cmd); 1537 1538 unlock: 1539 hci_dev_unlock(hdev); 1540 } 1541 1542 static int set_connectable_update_settings(struct hci_dev *hdev, 1543 struct sock *sk, u8 val) 1544 { 1545 bool changed = false; 1546 int err; 1547 1548 if (!!val != hci_dev_test_flag(hdev, HCI_CONNECTABLE)) 1549 changed = true; 1550 1551 if (val) { 1552 hci_dev_set_flag(hdev, HCI_CONNECTABLE); 1553 } else { 1554 hci_dev_clear_flag(hdev, HCI_CONNECTABLE); 1555 hci_dev_clear_flag(hdev, HCI_DISCOVERABLE); 1556 } 1557 1558 err = send_settings_rsp(sk, MGMT_OP_SET_CONNECTABLE, hdev); 1559 if (err < 0) 1560 return err; 1561 1562 if (changed) { 1563 hci_req_update_scan(hdev); 1564 hci_update_background_scan(hdev); 1565 return new_settings(hdev, sk); 1566 } 1567 1568 return 0; 1569 } 1570 1571 static int set_connectable(struct sock *sk, struct hci_dev *hdev, void *data, 1572 u16 len) 1573 { 1574 struct mgmt_mode *cp = data; 1575 struct mgmt_pending_cmd *cmd; 1576 int err; 1577 1578 bt_dev_dbg(hdev, "sock %p", sk); 1579 1580 if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED) && 1581 !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) 1582 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE, 1583 MGMT_STATUS_REJECTED); 1584 1585 if (cp->val != 0x00 && cp->val != 0x01) 1586 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE, 1587 MGMT_STATUS_INVALID_PARAMS); 1588 1589 hci_dev_lock(hdev); 1590 1591 if (!hdev_is_powered(hdev)) { 1592 err = set_connectable_update_settings(hdev, sk, cp->val); 1593 goto failed; 1594 } 1595 1596 if (pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) || 1597 pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) { 1598 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE, 1599 MGMT_STATUS_BUSY); 1600 goto failed; 1601 } 1602 1603 cmd = mgmt_pending_add(sk, MGMT_OP_SET_CONNECTABLE, hdev, data, len); 1604 if (!cmd) { 1605 err = -ENOMEM; 1606 goto failed; 1607 } 1608 1609 if (cp->val) { 1610 hci_dev_set_flag(hdev, HCI_CONNECTABLE); 1611 } else { 1612 if (hdev->discov_timeout > 0) 1613 cancel_delayed_work(&hdev->discov_off); 1614 1615 hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE); 1616 hci_dev_clear_flag(hdev, HCI_DISCOVERABLE); 1617 hci_dev_clear_flag(hdev, HCI_CONNECTABLE); 1618 } 1619 1620 queue_work(hdev->req_workqueue, &hdev->connectable_update); 1621 err = 0; 1622 1623 failed: 1624 hci_dev_unlock(hdev); 1625 return err; 1626 } 1627 1628 static int set_bondable(struct sock *sk, struct hci_dev *hdev, void *data, 1629 u16 len) 1630 { 1631 struct mgmt_mode *cp = data; 1632 bool changed; 1633 int err; 1634 1635 bt_dev_dbg(hdev, "sock %p", sk); 1636 1637 if (cp->val != 0x00 && cp->val != 0x01) 1638 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BONDABLE, 1639 MGMT_STATUS_INVALID_PARAMS); 1640 1641 hci_dev_lock(hdev); 1642 1643 if (cp->val) 1644 changed = !hci_dev_test_and_set_flag(hdev, HCI_BONDABLE); 1645 else 1646 changed = hci_dev_test_and_clear_flag(hdev, HCI_BONDABLE); 1647 1648 err = send_settings_rsp(sk, MGMT_OP_SET_BONDABLE, hdev); 1649 if (err < 0) 1650 goto unlock; 1651 1652 if (changed) { 1653 /* In limited privacy mode the change of bondable mode 1654 * may affect the local advertising address. 1655 */ 1656 if (hdev_is_powered(hdev) && 1657 hci_dev_test_flag(hdev, HCI_ADVERTISING) && 1658 hci_dev_test_flag(hdev, HCI_DISCOVERABLE) && 1659 hci_dev_test_flag(hdev, HCI_LIMITED_PRIVACY)) 1660 queue_work(hdev->req_workqueue, 1661 &hdev->discoverable_update); 1662 1663 err = new_settings(hdev, sk); 1664 } 1665 1666 unlock: 1667 hci_dev_unlock(hdev); 1668 return err; 1669 } 1670 1671 static int set_link_security(struct sock *sk, struct hci_dev *hdev, void *data, 1672 u16 len) 1673 { 1674 struct mgmt_mode *cp = data; 1675 struct mgmt_pending_cmd *cmd; 1676 u8 val, status; 1677 int err; 1678 1679 bt_dev_dbg(hdev, "sock %p", sk); 1680 1681 status = mgmt_bredr_support(hdev); 1682 if (status) 1683 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY, 1684 status); 1685 1686 if (cp->val != 0x00 && cp->val != 0x01) 1687 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY, 1688 MGMT_STATUS_INVALID_PARAMS); 1689 1690 hci_dev_lock(hdev); 1691 1692 if (!hdev_is_powered(hdev)) { 1693 bool changed = false; 1694 1695 if (!!cp->val != hci_dev_test_flag(hdev, HCI_LINK_SECURITY)) { 1696 hci_dev_change_flag(hdev, HCI_LINK_SECURITY); 1697 changed = true; 1698 } 1699 1700 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev); 1701 if (err < 0) 1702 goto failed; 1703 1704 if (changed) 1705 err = new_settings(hdev, sk); 1706 1707 goto failed; 1708 } 1709 1710 if (pending_find(MGMT_OP_SET_LINK_SECURITY, hdev)) { 1711 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY, 1712 MGMT_STATUS_BUSY); 1713 goto failed; 1714 } 1715 1716 val = !!cp->val; 1717 1718 if (test_bit(HCI_AUTH, &hdev->flags) == val) { 1719 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev); 1720 goto failed; 1721 } 1722 1723 cmd = mgmt_pending_add(sk, MGMT_OP_SET_LINK_SECURITY, hdev, data, len); 1724 if (!cmd) { 1725 err = -ENOMEM; 1726 goto failed; 1727 } 1728 1729 err = hci_send_cmd(hdev, HCI_OP_WRITE_AUTH_ENABLE, sizeof(val), &val); 1730 if (err < 0) { 1731 mgmt_pending_remove(cmd); 1732 goto failed; 1733 } 1734 1735 failed: 1736 hci_dev_unlock(hdev); 1737 return err; 1738 } 1739 1740 static int set_ssp(struct sock *sk, struct hci_dev *hdev, void *data, u16 len) 1741 { 1742 struct mgmt_mode *cp = data; 1743 struct mgmt_pending_cmd *cmd; 1744 u8 status; 1745 int err; 1746 1747 bt_dev_dbg(hdev, "sock %p", sk); 1748 1749 status = mgmt_bredr_support(hdev); 1750 if (status) 1751 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP, status); 1752 1753 if (!lmp_ssp_capable(hdev)) 1754 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP, 1755 MGMT_STATUS_NOT_SUPPORTED); 1756 1757 if (cp->val != 0x00 && cp->val != 0x01) 1758 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP, 1759 MGMT_STATUS_INVALID_PARAMS); 1760 1761 hci_dev_lock(hdev); 1762 1763 if (!hdev_is_powered(hdev)) { 1764 bool changed; 1765 1766 if (cp->val) { 1767 changed = !hci_dev_test_and_set_flag(hdev, 1768 HCI_SSP_ENABLED); 1769 } else { 1770 changed = hci_dev_test_and_clear_flag(hdev, 1771 HCI_SSP_ENABLED); 1772 if (!changed) 1773 changed = hci_dev_test_and_clear_flag(hdev, 1774 HCI_HS_ENABLED); 1775 else 1776 hci_dev_clear_flag(hdev, HCI_HS_ENABLED); 1777 } 1778 1779 err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev); 1780 if (err < 0) 1781 goto failed; 1782 1783 if (changed) 1784 err = new_settings(hdev, sk); 1785 1786 goto failed; 1787 } 1788 1789 if (pending_find(MGMT_OP_SET_SSP, hdev)) { 1790 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP, 1791 MGMT_STATUS_BUSY); 1792 goto failed; 1793 } 1794 1795 if (!!cp->val == hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) { 1796 err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev); 1797 goto failed; 1798 } 1799 1800 cmd = mgmt_pending_add(sk, MGMT_OP_SET_SSP, hdev, data, len); 1801 if (!cmd) { 1802 err = -ENOMEM; 1803 goto failed; 1804 } 1805 1806 if (!cp->val && hci_dev_test_flag(hdev, HCI_USE_DEBUG_KEYS)) 1807 hci_send_cmd(hdev, HCI_OP_WRITE_SSP_DEBUG_MODE, 1808 sizeof(cp->val), &cp->val); 1809 1810 err = hci_send_cmd(hdev, HCI_OP_WRITE_SSP_MODE, 1, &cp->val); 1811 if (err < 0) { 1812 mgmt_pending_remove(cmd); 1813 goto failed; 1814 } 1815 1816 failed: 1817 hci_dev_unlock(hdev); 1818 return err; 1819 } 1820 1821 static int set_hs(struct sock *sk, struct hci_dev *hdev, void *data, u16 len) 1822 { 1823 struct mgmt_mode *cp = data; 1824 bool changed; 1825 u8 status; 1826 int err; 1827 1828 bt_dev_dbg(hdev, "sock %p", sk); 1829 1830 if (!IS_ENABLED(CONFIG_BT_HS)) 1831 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS, 1832 MGMT_STATUS_NOT_SUPPORTED); 1833 1834 status = mgmt_bredr_support(hdev); 1835 if (status) 1836 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS, status); 1837 1838 if (!lmp_ssp_capable(hdev)) 1839 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS, 1840 MGMT_STATUS_NOT_SUPPORTED); 1841 1842 if (!hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) 1843 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS, 1844 MGMT_STATUS_REJECTED); 1845 1846 if (cp->val != 0x00 && cp->val != 0x01) 1847 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS, 1848 MGMT_STATUS_INVALID_PARAMS); 1849 1850 hci_dev_lock(hdev); 1851 1852 if (pending_find(MGMT_OP_SET_SSP, hdev)) { 1853 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS, 1854 MGMT_STATUS_BUSY); 1855 goto unlock; 1856 } 1857 1858 if (cp->val) { 1859 changed = !hci_dev_test_and_set_flag(hdev, HCI_HS_ENABLED); 1860 } else { 1861 if (hdev_is_powered(hdev)) { 1862 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS, 1863 MGMT_STATUS_REJECTED); 1864 goto unlock; 1865 } 1866 1867 changed = hci_dev_test_and_clear_flag(hdev, HCI_HS_ENABLED); 1868 } 1869 1870 err = send_settings_rsp(sk, MGMT_OP_SET_HS, hdev); 1871 if (err < 0) 1872 goto unlock; 1873 1874 if (changed) 1875 err = new_settings(hdev, sk); 1876 1877 unlock: 1878 hci_dev_unlock(hdev); 1879 return err; 1880 } 1881 1882 static void le_enable_complete(struct hci_dev *hdev, u8 status, u16 opcode) 1883 { 1884 struct cmd_lookup match = { NULL, hdev }; 1885 1886 hci_dev_lock(hdev); 1887 1888 if (status) { 1889 u8 mgmt_err = mgmt_status(status); 1890 1891 mgmt_pending_foreach(MGMT_OP_SET_LE, hdev, cmd_status_rsp, 1892 &mgmt_err); 1893 goto unlock; 1894 } 1895 1896 mgmt_pending_foreach(MGMT_OP_SET_LE, hdev, settings_rsp, &match); 1897 1898 new_settings(hdev, match.sk); 1899 1900 if (match.sk) 1901 sock_put(match.sk); 1902 1903 /* Make sure the controller has a good default for 1904 * advertising data. Restrict the update to when LE 1905 * has actually been enabled. During power on, the 1906 * update in powered_update_hci will take care of it. 1907 */ 1908 if (hci_dev_test_flag(hdev, HCI_LE_ENABLED)) { 1909 struct hci_request req; 1910 hci_req_init(&req, hdev); 1911 if (ext_adv_capable(hdev)) { 1912 int err; 1913 1914 err = __hci_req_setup_ext_adv_instance(&req, 0x00); 1915 if (!err) 1916 __hci_req_update_scan_rsp_data(&req, 0x00); 1917 } else { 1918 __hci_req_update_adv_data(&req, 0x00); 1919 __hci_req_update_scan_rsp_data(&req, 0x00); 1920 } 1921 hci_req_run(&req, NULL); 1922 hci_update_background_scan(hdev); 1923 } 1924 1925 unlock: 1926 hci_dev_unlock(hdev); 1927 } 1928 1929 static int set_le(struct sock *sk, struct hci_dev *hdev, void *data, u16 len) 1930 { 1931 struct mgmt_mode *cp = data; 1932 struct hci_cp_write_le_host_supported hci_cp; 1933 struct mgmt_pending_cmd *cmd; 1934 struct hci_request req; 1935 int err; 1936 u8 val, enabled; 1937 1938 bt_dev_dbg(hdev, "sock %p", sk); 1939 1940 if (!lmp_le_capable(hdev)) 1941 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE, 1942 MGMT_STATUS_NOT_SUPPORTED); 1943 1944 if (cp->val != 0x00 && cp->val != 0x01) 1945 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE, 1946 MGMT_STATUS_INVALID_PARAMS); 1947 1948 /* Bluetooth single mode LE only controllers or dual-mode 1949 * controllers configured as LE only devices, do not allow 1950 * switching LE off. These have either LE enabled explicitly 1951 * or BR/EDR has been previously switched off. 1952 * 1953 * When trying to enable an already enabled LE, then gracefully 1954 * send a positive response. Trying to disable it however will 1955 * result into rejection. 1956 */ 1957 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) { 1958 if (cp->val == 0x01) 1959 return send_settings_rsp(sk, MGMT_OP_SET_LE, hdev); 1960 1961 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE, 1962 MGMT_STATUS_REJECTED); 1963 } 1964 1965 hci_dev_lock(hdev); 1966 1967 val = !!cp->val; 1968 enabled = lmp_host_le_capable(hdev); 1969 1970 if (!val) 1971 hci_req_clear_adv_instance(hdev, NULL, NULL, 0x00, true); 1972 1973 if (!hdev_is_powered(hdev) || val == enabled) { 1974 bool changed = false; 1975 1976 if (val != hci_dev_test_flag(hdev, HCI_LE_ENABLED)) { 1977 hci_dev_change_flag(hdev, HCI_LE_ENABLED); 1978 changed = true; 1979 } 1980 1981 if (!val && hci_dev_test_flag(hdev, HCI_ADVERTISING)) { 1982 hci_dev_clear_flag(hdev, HCI_ADVERTISING); 1983 changed = true; 1984 } 1985 1986 err = send_settings_rsp(sk, MGMT_OP_SET_LE, hdev); 1987 if (err < 0) 1988 goto unlock; 1989 1990 if (changed) 1991 err = new_settings(hdev, sk); 1992 1993 goto unlock; 1994 } 1995 1996 if (pending_find(MGMT_OP_SET_LE, hdev) || 1997 pending_find(MGMT_OP_SET_ADVERTISING, hdev)) { 1998 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE, 1999 MGMT_STATUS_BUSY); 2000 goto unlock; 2001 } 2002 2003 cmd = mgmt_pending_add(sk, MGMT_OP_SET_LE, hdev, data, len); 2004 if (!cmd) { 2005 err = -ENOMEM; 2006 goto unlock; 2007 } 2008 2009 hci_req_init(&req, hdev); 2010 2011 memset(&hci_cp, 0, sizeof(hci_cp)); 2012 2013 if (val) { 2014 hci_cp.le = val; 2015 hci_cp.simul = 0x00; 2016 } else { 2017 if (hci_dev_test_flag(hdev, HCI_LE_ADV)) 2018 __hci_req_disable_advertising(&req); 2019 2020 if (ext_adv_capable(hdev)) 2021 __hci_req_clear_ext_adv_sets(&req); 2022 } 2023 2024 hci_req_add(&req, HCI_OP_WRITE_LE_HOST_SUPPORTED, sizeof(hci_cp), 2025 &hci_cp); 2026 2027 err = hci_req_run(&req, le_enable_complete); 2028 if (err < 0) 2029 mgmt_pending_remove(cmd); 2030 2031 unlock: 2032 hci_dev_unlock(hdev); 2033 return err; 2034 } 2035 2036 /* This is a helper function to test for pending mgmt commands that can 2037 * cause CoD or EIR HCI commands. We can only allow one such pending 2038 * mgmt command at a time since otherwise we cannot easily track what 2039 * the current values are, will be, and based on that calculate if a new 2040 * HCI command needs to be sent and if yes with what value. 2041 */ 2042 static bool pending_eir_or_class(struct hci_dev *hdev) 2043 { 2044 struct mgmt_pending_cmd *cmd; 2045 2046 list_for_each_entry(cmd, &hdev->mgmt_pending, list) { 2047 switch (cmd->opcode) { 2048 case MGMT_OP_ADD_UUID: 2049 case MGMT_OP_REMOVE_UUID: 2050 case MGMT_OP_SET_DEV_CLASS: 2051 case MGMT_OP_SET_POWERED: 2052 return true; 2053 } 2054 } 2055 2056 return false; 2057 } 2058 2059 static const u8 bluetooth_base_uuid[] = { 2060 0xfb, 0x34, 0x9b, 0x5f, 0x80, 0x00, 0x00, 0x80, 2061 0x00, 0x10, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 2062 }; 2063 2064 static u8 get_uuid_size(const u8 *uuid) 2065 { 2066 u32 val; 2067 2068 if (memcmp(uuid, bluetooth_base_uuid, 12)) 2069 return 128; 2070 2071 val = get_unaligned_le32(&uuid[12]); 2072 if (val > 0xffff) 2073 return 32; 2074 2075 return 16; 2076 } 2077 2078 static void mgmt_class_complete(struct hci_dev *hdev, u16 mgmt_op, u8 status) 2079 { 2080 struct mgmt_pending_cmd *cmd; 2081 2082 hci_dev_lock(hdev); 2083 2084 cmd = pending_find(mgmt_op, hdev); 2085 if (!cmd) 2086 goto unlock; 2087 2088 mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, 2089 mgmt_status(status), hdev->dev_class, 3); 2090 2091 mgmt_pending_remove(cmd); 2092 2093 unlock: 2094 hci_dev_unlock(hdev); 2095 } 2096 2097 static void add_uuid_complete(struct hci_dev *hdev, u8 status, u16 opcode) 2098 { 2099 bt_dev_dbg(hdev, "status 0x%02x", status); 2100 2101 mgmt_class_complete(hdev, MGMT_OP_ADD_UUID, status); 2102 } 2103 2104 static int add_uuid(struct sock *sk, struct hci_dev *hdev, void *data, u16 len) 2105 { 2106 struct mgmt_cp_add_uuid *cp = data; 2107 struct mgmt_pending_cmd *cmd; 2108 struct hci_request req; 2109 struct bt_uuid *uuid; 2110 int err; 2111 2112 bt_dev_dbg(hdev, "sock %p", sk); 2113 2114 hci_dev_lock(hdev); 2115 2116 if (pending_eir_or_class(hdev)) { 2117 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_UUID, 2118 MGMT_STATUS_BUSY); 2119 goto failed; 2120 } 2121 2122 uuid = kmalloc(sizeof(*uuid), GFP_KERNEL); 2123 if (!uuid) { 2124 err = -ENOMEM; 2125 goto failed; 2126 } 2127 2128 memcpy(uuid->uuid, cp->uuid, 16); 2129 uuid->svc_hint = cp->svc_hint; 2130 uuid->size = get_uuid_size(cp->uuid); 2131 2132 list_add_tail(&uuid->list, &hdev->uuids); 2133 2134 hci_req_init(&req, hdev); 2135 2136 __hci_req_update_class(&req); 2137 __hci_req_update_eir(&req); 2138 2139 err = hci_req_run(&req, add_uuid_complete); 2140 if (err < 0) { 2141 if (err != -ENODATA) 2142 goto failed; 2143 2144 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_UUID, 0, 2145 hdev->dev_class, 3); 2146 goto failed; 2147 } 2148 2149 cmd = mgmt_pending_add(sk, MGMT_OP_ADD_UUID, hdev, data, len); 2150 if (!cmd) { 2151 err = -ENOMEM; 2152 goto failed; 2153 } 2154 2155 err = 0; 2156 2157 failed: 2158 hci_dev_unlock(hdev); 2159 return err; 2160 } 2161 2162 static bool enable_service_cache(struct hci_dev *hdev) 2163 { 2164 if (!hdev_is_powered(hdev)) 2165 return false; 2166 2167 if (!hci_dev_test_and_set_flag(hdev, HCI_SERVICE_CACHE)) { 2168 queue_delayed_work(hdev->workqueue, &hdev->service_cache, 2169 CACHE_TIMEOUT); 2170 return true; 2171 } 2172 2173 return false; 2174 } 2175 2176 static void remove_uuid_complete(struct hci_dev *hdev, u8 status, u16 opcode) 2177 { 2178 bt_dev_dbg(hdev, "status 0x%02x", status); 2179 2180 mgmt_class_complete(hdev, MGMT_OP_REMOVE_UUID, status); 2181 } 2182 2183 static int remove_uuid(struct sock *sk, struct hci_dev *hdev, void *data, 2184 u16 len) 2185 { 2186 struct mgmt_cp_remove_uuid *cp = data; 2187 struct mgmt_pending_cmd *cmd; 2188 struct bt_uuid *match, *tmp; 2189 u8 bt_uuid_any[] = { 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 }; 2190 struct hci_request req; 2191 int err, found; 2192 2193 bt_dev_dbg(hdev, "sock %p", sk); 2194 2195 hci_dev_lock(hdev); 2196 2197 if (pending_eir_or_class(hdev)) { 2198 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID, 2199 MGMT_STATUS_BUSY); 2200 goto unlock; 2201 } 2202 2203 if (memcmp(cp->uuid, bt_uuid_any, 16) == 0) { 2204 hci_uuids_clear(hdev); 2205 2206 if (enable_service_cache(hdev)) { 2207 err = mgmt_cmd_complete(sk, hdev->id, 2208 MGMT_OP_REMOVE_UUID, 2209 0, hdev->dev_class, 3); 2210 goto unlock; 2211 } 2212 2213 goto update_class; 2214 } 2215 2216 found = 0; 2217 2218 list_for_each_entry_safe(match, tmp, &hdev->uuids, list) { 2219 if (memcmp(match->uuid, cp->uuid, 16) != 0) 2220 continue; 2221 2222 list_del(&match->list); 2223 kfree(match); 2224 found++; 2225 } 2226 2227 if (found == 0) { 2228 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID, 2229 MGMT_STATUS_INVALID_PARAMS); 2230 goto unlock; 2231 } 2232 2233 update_class: 2234 hci_req_init(&req, hdev); 2235 2236 __hci_req_update_class(&req); 2237 __hci_req_update_eir(&req); 2238 2239 err = hci_req_run(&req, remove_uuid_complete); 2240 if (err < 0) { 2241 if (err != -ENODATA) 2242 goto unlock; 2243 2244 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_UUID, 0, 2245 hdev->dev_class, 3); 2246 goto unlock; 2247 } 2248 2249 cmd = mgmt_pending_add(sk, MGMT_OP_REMOVE_UUID, hdev, data, len); 2250 if (!cmd) { 2251 err = -ENOMEM; 2252 goto unlock; 2253 } 2254 2255 err = 0; 2256 2257 unlock: 2258 hci_dev_unlock(hdev); 2259 return err; 2260 } 2261 2262 static void set_class_complete(struct hci_dev *hdev, u8 status, u16 opcode) 2263 { 2264 bt_dev_dbg(hdev, "status 0x%02x", status); 2265 2266 mgmt_class_complete(hdev, MGMT_OP_SET_DEV_CLASS, status); 2267 } 2268 2269 static int set_dev_class(struct sock *sk, struct hci_dev *hdev, void *data, 2270 u16 len) 2271 { 2272 struct mgmt_cp_set_dev_class *cp = data; 2273 struct mgmt_pending_cmd *cmd; 2274 struct hci_request req; 2275 int err; 2276 2277 bt_dev_dbg(hdev, "sock %p", sk); 2278 2279 if (!lmp_bredr_capable(hdev)) 2280 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 2281 MGMT_STATUS_NOT_SUPPORTED); 2282 2283 hci_dev_lock(hdev); 2284 2285 if (pending_eir_or_class(hdev)) { 2286 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 2287 MGMT_STATUS_BUSY); 2288 goto unlock; 2289 } 2290 2291 if ((cp->minor & 0x03) != 0 || (cp->major & 0xe0) != 0) { 2292 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 2293 MGMT_STATUS_INVALID_PARAMS); 2294 goto unlock; 2295 } 2296 2297 hdev->major_class = cp->major; 2298 hdev->minor_class = cp->minor; 2299 2300 if (!hdev_is_powered(hdev)) { 2301 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 0, 2302 hdev->dev_class, 3); 2303 goto unlock; 2304 } 2305 2306 hci_req_init(&req, hdev); 2307 2308 if (hci_dev_test_and_clear_flag(hdev, HCI_SERVICE_CACHE)) { 2309 hci_dev_unlock(hdev); 2310 cancel_delayed_work_sync(&hdev->service_cache); 2311 hci_dev_lock(hdev); 2312 __hci_req_update_eir(&req); 2313 } 2314 2315 __hci_req_update_class(&req); 2316 2317 err = hci_req_run(&req, set_class_complete); 2318 if (err < 0) { 2319 if (err != -ENODATA) 2320 goto unlock; 2321 2322 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 0, 2323 hdev->dev_class, 3); 2324 goto unlock; 2325 } 2326 2327 cmd = mgmt_pending_add(sk, MGMT_OP_SET_DEV_CLASS, hdev, data, len); 2328 if (!cmd) { 2329 err = -ENOMEM; 2330 goto unlock; 2331 } 2332 2333 err = 0; 2334 2335 unlock: 2336 hci_dev_unlock(hdev); 2337 return err; 2338 } 2339 2340 static int load_link_keys(struct sock *sk, struct hci_dev *hdev, void *data, 2341 u16 len) 2342 { 2343 struct mgmt_cp_load_link_keys *cp = data; 2344 const u16 max_key_count = ((U16_MAX - sizeof(*cp)) / 2345 sizeof(struct mgmt_link_key_info)); 2346 u16 key_count, expected_len; 2347 bool changed; 2348 int i; 2349 2350 bt_dev_dbg(hdev, "sock %p", sk); 2351 2352 if (!lmp_bredr_capable(hdev)) 2353 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS, 2354 MGMT_STATUS_NOT_SUPPORTED); 2355 2356 key_count = __le16_to_cpu(cp->key_count); 2357 if (key_count > max_key_count) { 2358 bt_dev_err(hdev, "load_link_keys: too big key_count value %u", 2359 key_count); 2360 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS, 2361 MGMT_STATUS_INVALID_PARAMS); 2362 } 2363 2364 expected_len = struct_size(cp, keys, key_count); 2365 if (expected_len != len) { 2366 bt_dev_err(hdev, "load_link_keys: expected %u bytes, got %u bytes", 2367 expected_len, len); 2368 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS, 2369 MGMT_STATUS_INVALID_PARAMS); 2370 } 2371 2372 if (cp->debug_keys != 0x00 && cp->debug_keys != 0x01) 2373 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS, 2374 MGMT_STATUS_INVALID_PARAMS); 2375 2376 bt_dev_dbg(hdev, "debug_keys %u key_count %u", cp->debug_keys, 2377 key_count); 2378 2379 for (i = 0; i < key_count; i++) { 2380 struct mgmt_link_key_info *key = &cp->keys[i]; 2381 2382 if (key->addr.type != BDADDR_BREDR || key->type > 0x08) 2383 return mgmt_cmd_status(sk, hdev->id, 2384 MGMT_OP_LOAD_LINK_KEYS, 2385 MGMT_STATUS_INVALID_PARAMS); 2386 } 2387 2388 hci_dev_lock(hdev); 2389 2390 hci_link_keys_clear(hdev); 2391 2392 if (cp->debug_keys) 2393 changed = !hci_dev_test_and_set_flag(hdev, HCI_KEEP_DEBUG_KEYS); 2394 else 2395 changed = hci_dev_test_and_clear_flag(hdev, 2396 HCI_KEEP_DEBUG_KEYS); 2397 2398 if (changed) 2399 new_settings(hdev, NULL); 2400 2401 for (i = 0; i < key_count; i++) { 2402 struct mgmt_link_key_info *key = &cp->keys[i]; 2403 2404 if (hci_is_blocked_key(hdev, 2405 HCI_BLOCKED_KEY_TYPE_LINKKEY, 2406 key->val)) { 2407 bt_dev_warn(hdev, "Skipping blocked link key for %pMR", 2408 &key->addr.bdaddr); 2409 continue; 2410 } 2411 2412 /* Always ignore debug keys and require a new pairing if 2413 * the user wants to use them. 2414 */ 2415 if (key->type == HCI_LK_DEBUG_COMBINATION) 2416 continue; 2417 2418 hci_add_link_key(hdev, NULL, &key->addr.bdaddr, key->val, 2419 key->type, key->pin_len, NULL); 2420 } 2421 2422 mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS, 0, NULL, 0); 2423 2424 hci_dev_unlock(hdev); 2425 2426 return 0; 2427 } 2428 2429 static int device_unpaired(struct hci_dev *hdev, bdaddr_t *bdaddr, 2430 u8 addr_type, struct sock *skip_sk) 2431 { 2432 struct mgmt_ev_device_unpaired ev; 2433 2434 bacpy(&ev.addr.bdaddr, bdaddr); 2435 ev.addr.type = addr_type; 2436 2437 return mgmt_event(MGMT_EV_DEVICE_UNPAIRED, hdev, &ev, sizeof(ev), 2438 skip_sk); 2439 } 2440 2441 static int unpair_device(struct sock *sk, struct hci_dev *hdev, void *data, 2442 u16 len) 2443 { 2444 struct mgmt_cp_unpair_device *cp = data; 2445 struct mgmt_rp_unpair_device rp; 2446 struct hci_conn_params *params; 2447 struct mgmt_pending_cmd *cmd; 2448 struct hci_conn *conn; 2449 u8 addr_type; 2450 int err; 2451 2452 memset(&rp, 0, sizeof(rp)); 2453 bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr); 2454 rp.addr.type = cp->addr.type; 2455 2456 if (!bdaddr_type_is_valid(cp->addr.type)) 2457 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE, 2458 MGMT_STATUS_INVALID_PARAMS, 2459 &rp, sizeof(rp)); 2460 2461 if (cp->disconnect != 0x00 && cp->disconnect != 0x01) 2462 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE, 2463 MGMT_STATUS_INVALID_PARAMS, 2464 &rp, sizeof(rp)); 2465 2466 hci_dev_lock(hdev); 2467 2468 if (!hdev_is_powered(hdev)) { 2469 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE, 2470 MGMT_STATUS_NOT_POWERED, &rp, 2471 sizeof(rp)); 2472 goto unlock; 2473 } 2474 2475 if (cp->addr.type == BDADDR_BREDR) { 2476 /* If disconnection is requested, then look up the 2477 * connection. If the remote device is connected, it 2478 * will be later used to terminate the link. 2479 * 2480 * Setting it to NULL explicitly will cause no 2481 * termination of the link. 2482 */ 2483 if (cp->disconnect) 2484 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, 2485 &cp->addr.bdaddr); 2486 else 2487 conn = NULL; 2488 2489 err = hci_remove_link_key(hdev, &cp->addr.bdaddr); 2490 if (err < 0) { 2491 err = mgmt_cmd_complete(sk, hdev->id, 2492 MGMT_OP_UNPAIR_DEVICE, 2493 MGMT_STATUS_NOT_PAIRED, &rp, 2494 sizeof(rp)); 2495 goto unlock; 2496 } 2497 2498 goto done; 2499 } 2500 2501 /* LE address type */ 2502 addr_type = le_addr_type(cp->addr.type); 2503 2504 /* Abort any ongoing SMP pairing. Removes ltk and irk if they exist. */ 2505 err = smp_cancel_and_remove_pairing(hdev, &cp->addr.bdaddr, addr_type); 2506 if (err < 0) { 2507 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE, 2508 MGMT_STATUS_NOT_PAIRED, &rp, 2509 sizeof(rp)); 2510 goto unlock; 2511 } 2512 2513 conn = hci_conn_hash_lookup_le(hdev, &cp->addr.bdaddr, addr_type); 2514 if (!conn) { 2515 hci_conn_params_del(hdev, &cp->addr.bdaddr, addr_type); 2516 goto done; 2517 } 2518 2519 2520 /* Defer clearing up the connection parameters until closing to 2521 * give a chance of keeping them if a repairing happens. 2522 */ 2523 set_bit(HCI_CONN_PARAM_REMOVAL_PEND, &conn->flags); 2524 2525 /* Disable auto-connection parameters if present */ 2526 params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr, addr_type); 2527 if (params) { 2528 if (params->explicit_connect) 2529 params->auto_connect = HCI_AUTO_CONN_EXPLICIT; 2530 else 2531 params->auto_connect = HCI_AUTO_CONN_DISABLED; 2532 } 2533 2534 /* If disconnection is not requested, then clear the connection 2535 * variable so that the link is not terminated. 2536 */ 2537 if (!cp->disconnect) 2538 conn = NULL; 2539 2540 done: 2541 /* If the connection variable is set, then termination of the 2542 * link is requested. 2543 */ 2544 if (!conn) { 2545 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE, 0, 2546 &rp, sizeof(rp)); 2547 device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, sk); 2548 goto unlock; 2549 } 2550 2551 cmd = mgmt_pending_add(sk, MGMT_OP_UNPAIR_DEVICE, hdev, cp, 2552 sizeof(*cp)); 2553 if (!cmd) { 2554 err = -ENOMEM; 2555 goto unlock; 2556 } 2557 2558 cmd->cmd_complete = addr_cmd_complete; 2559 2560 err = hci_abort_conn(conn, HCI_ERROR_REMOTE_USER_TERM); 2561 if (err < 0) 2562 mgmt_pending_remove(cmd); 2563 2564 unlock: 2565 hci_dev_unlock(hdev); 2566 return err; 2567 } 2568 2569 static int disconnect(struct sock *sk, struct hci_dev *hdev, void *data, 2570 u16 len) 2571 { 2572 struct mgmt_cp_disconnect *cp = data; 2573 struct mgmt_rp_disconnect rp; 2574 struct mgmt_pending_cmd *cmd; 2575 struct hci_conn *conn; 2576 int err; 2577 2578 bt_dev_dbg(hdev, "sock %p", sk); 2579 2580 memset(&rp, 0, sizeof(rp)); 2581 bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr); 2582 rp.addr.type = cp->addr.type; 2583 2584 if (!bdaddr_type_is_valid(cp->addr.type)) 2585 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT, 2586 MGMT_STATUS_INVALID_PARAMS, 2587 &rp, sizeof(rp)); 2588 2589 hci_dev_lock(hdev); 2590 2591 if (!test_bit(HCI_UP, &hdev->flags)) { 2592 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT, 2593 MGMT_STATUS_NOT_POWERED, &rp, 2594 sizeof(rp)); 2595 goto failed; 2596 } 2597 2598 if (pending_find(MGMT_OP_DISCONNECT, hdev)) { 2599 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT, 2600 MGMT_STATUS_BUSY, &rp, sizeof(rp)); 2601 goto failed; 2602 } 2603 2604 if (cp->addr.type == BDADDR_BREDR) 2605 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, 2606 &cp->addr.bdaddr); 2607 else 2608 conn = hci_conn_hash_lookup_le(hdev, &cp->addr.bdaddr, 2609 le_addr_type(cp->addr.type)); 2610 2611 if (!conn || conn->state == BT_OPEN || conn->state == BT_CLOSED) { 2612 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT, 2613 MGMT_STATUS_NOT_CONNECTED, &rp, 2614 sizeof(rp)); 2615 goto failed; 2616 } 2617 2618 cmd = mgmt_pending_add(sk, MGMT_OP_DISCONNECT, hdev, data, len); 2619 if (!cmd) { 2620 err = -ENOMEM; 2621 goto failed; 2622 } 2623 2624 cmd->cmd_complete = generic_cmd_complete; 2625 2626 err = hci_disconnect(conn, HCI_ERROR_REMOTE_USER_TERM); 2627 if (err < 0) 2628 mgmt_pending_remove(cmd); 2629 2630 failed: 2631 hci_dev_unlock(hdev); 2632 return err; 2633 } 2634 2635 static u8 link_to_bdaddr(u8 link_type, u8 addr_type) 2636 { 2637 switch (link_type) { 2638 case LE_LINK: 2639 switch (addr_type) { 2640 case ADDR_LE_DEV_PUBLIC: 2641 return BDADDR_LE_PUBLIC; 2642 2643 default: 2644 /* Fallback to LE Random address type */ 2645 return BDADDR_LE_RANDOM; 2646 } 2647 2648 default: 2649 /* Fallback to BR/EDR type */ 2650 return BDADDR_BREDR; 2651 } 2652 } 2653 2654 static int get_connections(struct sock *sk, struct hci_dev *hdev, void *data, 2655 u16 data_len) 2656 { 2657 struct mgmt_rp_get_connections *rp; 2658 struct hci_conn *c; 2659 int err; 2660 u16 i; 2661 2662 bt_dev_dbg(hdev, "sock %p", sk); 2663 2664 hci_dev_lock(hdev); 2665 2666 if (!hdev_is_powered(hdev)) { 2667 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_CONNECTIONS, 2668 MGMT_STATUS_NOT_POWERED); 2669 goto unlock; 2670 } 2671 2672 i = 0; 2673 list_for_each_entry(c, &hdev->conn_hash.list, list) { 2674 if (test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags)) 2675 i++; 2676 } 2677 2678 rp = kmalloc(struct_size(rp, addr, i), GFP_KERNEL); 2679 if (!rp) { 2680 err = -ENOMEM; 2681 goto unlock; 2682 } 2683 2684 i = 0; 2685 list_for_each_entry(c, &hdev->conn_hash.list, list) { 2686 if (!test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags)) 2687 continue; 2688 bacpy(&rp->addr[i].bdaddr, &c->dst); 2689 rp->addr[i].type = link_to_bdaddr(c->type, c->dst_type); 2690 if (c->type == SCO_LINK || c->type == ESCO_LINK) 2691 continue; 2692 i++; 2693 } 2694 2695 rp->conn_count = cpu_to_le16(i); 2696 2697 /* Recalculate length in case of filtered SCO connections, etc */ 2698 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONNECTIONS, 0, rp, 2699 struct_size(rp, addr, i)); 2700 2701 kfree(rp); 2702 2703 unlock: 2704 hci_dev_unlock(hdev); 2705 return err; 2706 } 2707 2708 static int send_pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev, 2709 struct mgmt_cp_pin_code_neg_reply *cp) 2710 { 2711 struct mgmt_pending_cmd *cmd; 2712 int err; 2713 2714 cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_NEG_REPLY, hdev, cp, 2715 sizeof(*cp)); 2716 if (!cmd) 2717 return -ENOMEM; 2718 2719 cmd->cmd_complete = addr_cmd_complete; 2720 2721 err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_NEG_REPLY, 2722 sizeof(cp->addr.bdaddr), &cp->addr.bdaddr); 2723 if (err < 0) 2724 mgmt_pending_remove(cmd); 2725 2726 return err; 2727 } 2728 2729 static int pin_code_reply(struct sock *sk, struct hci_dev *hdev, void *data, 2730 u16 len) 2731 { 2732 struct hci_conn *conn; 2733 struct mgmt_cp_pin_code_reply *cp = data; 2734 struct hci_cp_pin_code_reply reply; 2735 struct mgmt_pending_cmd *cmd; 2736 int err; 2737 2738 bt_dev_dbg(hdev, "sock %p", sk); 2739 2740 hci_dev_lock(hdev); 2741 2742 if (!hdev_is_powered(hdev)) { 2743 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY, 2744 MGMT_STATUS_NOT_POWERED); 2745 goto failed; 2746 } 2747 2748 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->addr.bdaddr); 2749 if (!conn) { 2750 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY, 2751 MGMT_STATUS_NOT_CONNECTED); 2752 goto failed; 2753 } 2754 2755 if (conn->pending_sec_level == BT_SECURITY_HIGH && cp->pin_len != 16) { 2756 struct mgmt_cp_pin_code_neg_reply ncp; 2757 2758 memcpy(&ncp.addr, &cp->addr, sizeof(ncp.addr)); 2759 2760 bt_dev_err(hdev, "PIN code is not 16 bytes long"); 2761 2762 err = send_pin_code_neg_reply(sk, hdev, &ncp); 2763 if (err >= 0) 2764 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY, 2765 MGMT_STATUS_INVALID_PARAMS); 2766 2767 goto failed; 2768 } 2769 2770 cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_REPLY, hdev, data, len); 2771 if (!cmd) { 2772 err = -ENOMEM; 2773 goto failed; 2774 } 2775 2776 cmd->cmd_complete = addr_cmd_complete; 2777 2778 bacpy(&reply.bdaddr, &cp->addr.bdaddr); 2779 reply.pin_len = cp->pin_len; 2780 memcpy(reply.pin_code, cp->pin_code, sizeof(reply.pin_code)); 2781 2782 err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_REPLY, sizeof(reply), &reply); 2783 if (err < 0) 2784 mgmt_pending_remove(cmd); 2785 2786 failed: 2787 hci_dev_unlock(hdev); 2788 return err; 2789 } 2790 2791 static int set_io_capability(struct sock *sk, struct hci_dev *hdev, void *data, 2792 u16 len) 2793 { 2794 struct mgmt_cp_set_io_capability *cp = data; 2795 2796 bt_dev_dbg(hdev, "sock %p", sk); 2797 2798 if (cp->io_capability > SMP_IO_KEYBOARD_DISPLAY) 2799 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_IO_CAPABILITY, 2800 MGMT_STATUS_INVALID_PARAMS); 2801 2802 hci_dev_lock(hdev); 2803 2804 hdev->io_capability = cp->io_capability; 2805 2806 bt_dev_dbg(hdev, "IO capability set to 0x%02x", hdev->io_capability); 2807 2808 hci_dev_unlock(hdev); 2809 2810 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_IO_CAPABILITY, 0, 2811 NULL, 0); 2812 } 2813 2814 static struct mgmt_pending_cmd *find_pairing(struct hci_conn *conn) 2815 { 2816 struct hci_dev *hdev = conn->hdev; 2817 struct mgmt_pending_cmd *cmd; 2818 2819 list_for_each_entry(cmd, &hdev->mgmt_pending, list) { 2820 if (cmd->opcode != MGMT_OP_PAIR_DEVICE) 2821 continue; 2822 2823 if (cmd->user_data != conn) 2824 continue; 2825 2826 return cmd; 2827 } 2828 2829 return NULL; 2830 } 2831 2832 static int pairing_complete(struct mgmt_pending_cmd *cmd, u8 status) 2833 { 2834 struct mgmt_rp_pair_device rp; 2835 struct hci_conn *conn = cmd->user_data; 2836 int err; 2837 2838 bacpy(&rp.addr.bdaddr, &conn->dst); 2839 rp.addr.type = link_to_bdaddr(conn->type, conn->dst_type); 2840 2841 err = mgmt_cmd_complete(cmd->sk, cmd->index, MGMT_OP_PAIR_DEVICE, 2842 status, &rp, sizeof(rp)); 2843 2844 /* So we don't get further callbacks for this connection */ 2845 conn->connect_cfm_cb = NULL; 2846 conn->security_cfm_cb = NULL; 2847 conn->disconn_cfm_cb = NULL; 2848 2849 hci_conn_drop(conn); 2850 2851 /* The device is paired so there is no need to remove 2852 * its connection parameters anymore. 2853 */ 2854 clear_bit(HCI_CONN_PARAM_REMOVAL_PEND, &conn->flags); 2855 2856 hci_conn_put(conn); 2857 2858 return err; 2859 } 2860 2861 void mgmt_smp_complete(struct hci_conn *conn, bool complete) 2862 { 2863 u8 status = complete ? MGMT_STATUS_SUCCESS : MGMT_STATUS_FAILED; 2864 struct mgmt_pending_cmd *cmd; 2865 2866 cmd = find_pairing(conn); 2867 if (cmd) { 2868 cmd->cmd_complete(cmd, status); 2869 mgmt_pending_remove(cmd); 2870 } 2871 } 2872 2873 static void pairing_complete_cb(struct hci_conn *conn, u8 status) 2874 { 2875 struct mgmt_pending_cmd *cmd; 2876 2877 BT_DBG("status %u", status); 2878 2879 cmd = find_pairing(conn); 2880 if (!cmd) { 2881 BT_DBG("Unable to find a pending command"); 2882 return; 2883 } 2884 2885 cmd->cmd_complete(cmd, mgmt_status(status)); 2886 mgmt_pending_remove(cmd); 2887 } 2888 2889 static void le_pairing_complete_cb(struct hci_conn *conn, u8 status) 2890 { 2891 struct mgmt_pending_cmd *cmd; 2892 2893 BT_DBG("status %u", status); 2894 2895 if (!status) 2896 return; 2897 2898 cmd = find_pairing(conn); 2899 if (!cmd) { 2900 BT_DBG("Unable to find a pending command"); 2901 return; 2902 } 2903 2904 cmd->cmd_complete(cmd, mgmt_status(status)); 2905 mgmt_pending_remove(cmd); 2906 } 2907 2908 static int pair_device(struct sock *sk, struct hci_dev *hdev, void *data, 2909 u16 len) 2910 { 2911 struct mgmt_cp_pair_device *cp = data; 2912 struct mgmt_rp_pair_device rp; 2913 struct mgmt_pending_cmd *cmd; 2914 u8 sec_level, auth_type; 2915 struct hci_conn *conn; 2916 int err; 2917 2918 bt_dev_dbg(hdev, "sock %p", sk); 2919 2920 memset(&rp, 0, sizeof(rp)); 2921 bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr); 2922 rp.addr.type = cp->addr.type; 2923 2924 if (!bdaddr_type_is_valid(cp->addr.type)) 2925 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE, 2926 MGMT_STATUS_INVALID_PARAMS, 2927 &rp, sizeof(rp)); 2928 2929 if (cp->io_cap > SMP_IO_KEYBOARD_DISPLAY) 2930 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE, 2931 MGMT_STATUS_INVALID_PARAMS, 2932 &rp, sizeof(rp)); 2933 2934 hci_dev_lock(hdev); 2935 2936 if (!hdev_is_powered(hdev)) { 2937 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE, 2938 MGMT_STATUS_NOT_POWERED, &rp, 2939 sizeof(rp)); 2940 goto unlock; 2941 } 2942 2943 if (hci_bdaddr_is_paired(hdev, &cp->addr.bdaddr, cp->addr.type)) { 2944 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE, 2945 MGMT_STATUS_ALREADY_PAIRED, &rp, 2946 sizeof(rp)); 2947 goto unlock; 2948 } 2949 2950 sec_level = BT_SECURITY_MEDIUM; 2951 auth_type = HCI_AT_DEDICATED_BONDING; 2952 2953 if (cp->addr.type == BDADDR_BREDR) { 2954 conn = hci_connect_acl(hdev, &cp->addr.bdaddr, sec_level, 2955 auth_type, CONN_REASON_PAIR_DEVICE); 2956 } else { 2957 u8 addr_type = le_addr_type(cp->addr.type); 2958 struct hci_conn_params *p; 2959 2960 /* When pairing a new device, it is expected to remember 2961 * this device for future connections. Adding the connection 2962 * parameter information ahead of time allows tracking 2963 * of the peripheral preferred values and will speed up any 2964 * further connection establishment. 2965 * 2966 * If connection parameters already exist, then they 2967 * will be kept and this function does nothing. 2968 */ 2969 p = hci_conn_params_add(hdev, &cp->addr.bdaddr, addr_type); 2970 2971 if (p->auto_connect == HCI_AUTO_CONN_EXPLICIT) 2972 p->auto_connect = HCI_AUTO_CONN_DISABLED; 2973 2974 conn = hci_connect_le_scan(hdev, &cp->addr.bdaddr, addr_type, 2975 sec_level, HCI_LE_CONN_TIMEOUT, 2976 CONN_REASON_PAIR_DEVICE); 2977 } 2978 2979 if (IS_ERR(conn)) { 2980 int status; 2981 2982 if (PTR_ERR(conn) == -EBUSY) 2983 status = MGMT_STATUS_BUSY; 2984 else if (PTR_ERR(conn) == -EOPNOTSUPP) 2985 status = MGMT_STATUS_NOT_SUPPORTED; 2986 else if (PTR_ERR(conn) == -ECONNREFUSED) 2987 status = MGMT_STATUS_REJECTED; 2988 else 2989 status = MGMT_STATUS_CONNECT_FAILED; 2990 2991 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE, 2992 status, &rp, sizeof(rp)); 2993 goto unlock; 2994 } 2995 2996 if (conn->connect_cfm_cb) { 2997 hci_conn_drop(conn); 2998 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE, 2999 MGMT_STATUS_BUSY, &rp, sizeof(rp)); 3000 goto unlock; 3001 } 3002 3003 cmd = mgmt_pending_add(sk, MGMT_OP_PAIR_DEVICE, hdev, data, len); 3004 if (!cmd) { 3005 err = -ENOMEM; 3006 hci_conn_drop(conn); 3007 goto unlock; 3008 } 3009 3010 cmd->cmd_complete = pairing_complete; 3011 3012 /* For LE, just connecting isn't a proof that the pairing finished */ 3013 if (cp->addr.type == BDADDR_BREDR) { 3014 conn->connect_cfm_cb = pairing_complete_cb; 3015 conn->security_cfm_cb = pairing_complete_cb; 3016 conn->disconn_cfm_cb = pairing_complete_cb; 3017 } else { 3018 conn->connect_cfm_cb = le_pairing_complete_cb; 3019 conn->security_cfm_cb = le_pairing_complete_cb; 3020 conn->disconn_cfm_cb = le_pairing_complete_cb; 3021 } 3022 3023 conn->io_capability = cp->io_cap; 3024 cmd->user_data = hci_conn_get(conn); 3025 3026 if ((conn->state == BT_CONNECTED || conn->state == BT_CONFIG) && 3027 hci_conn_security(conn, sec_level, auth_type, true)) { 3028 cmd->cmd_complete(cmd, 0); 3029 mgmt_pending_remove(cmd); 3030 } 3031 3032 err = 0; 3033 3034 unlock: 3035 hci_dev_unlock(hdev); 3036 return err; 3037 } 3038 3039 static int cancel_pair_device(struct sock *sk, struct hci_dev *hdev, void *data, 3040 u16 len) 3041 { 3042 struct mgmt_addr_info *addr = data; 3043 struct mgmt_pending_cmd *cmd; 3044 struct hci_conn *conn; 3045 int err; 3046 3047 bt_dev_dbg(hdev, "sock %p", sk); 3048 3049 hci_dev_lock(hdev); 3050 3051 if (!hdev_is_powered(hdev)) { 3052 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE, 3053 MGMT_STATUS_NOT_POWERED); 3054 goto unlock; 3055 } 3056 3057 cmd = pending_find(MGMT_OP_PAIR_DEVICE, hdev); 3058 if (!cmd) { 3059 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE, 3060 MGMT_STATUS_INVALID_PARAMS); 3061 goto unlock; 3062 } 3063 3064 conn = cmd->user_data; 3065 3066 if (bacmp(&addr->bdaddr, &conn->dst) != 0) { 3067 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE, 3068 MGMT_STATUS_INVALID_PARAMS); 3069 goto unlock; 3070 } 3071 3072 cmd->cmd_complete(cmd, MGMT_STATUS_CANCELLED); 3073 mgmt_pending_remove(cmd); 3074 3075 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE, 0, 3076 addr, sizeof(*addr)); 3077 3078 /* Since user doesn't want to proceed with the connection, abort any 3079 * ongoing pairing and then terminate the link if it was created 3080 * because of the pair device action. 3081 */ 3082 if (addr->type == BDADDR_BREDR) 3083 hci_remove_link_key(hdev, &addr->bdaddr); 3084 else 3085 smp_cancel_and_remove_pairing(hdev, &addr->bdaddr, 3086 le_addr_type(addr->type)); 3087 3088 if (conn->conn_reason == CONN_REASON_PAIR_DEVICE) 3089 hci_abort_conn(conn, HCI_ERROR_REMOTE_USER_TERM); 3090 3091 unlock: 3092 hci_dev_unlock(hdev); 3093 return err; 3094 } 3095 3096 static int user_pairing_resp(struct sock *sk, struct hci_dev *hdev, 3097 struct mgmt_addr_info *addr, u16 mgmt_op, 3098 u16 hci_op, __le32 passkey) 3099 { 3100 struct mgmt_pending_cmd *cmd; 3101 struct hci_conn *conn; 3102 int err; 3103 3104 hci_dev_lock(hdev); 3105 3106 if (!hdev_is_powered(hdev)) { 3107 err = mgmt_cmd_complete(sk, hdev->id, mgmt_op, 3108 MGMT_STATUS_NOT_POWERED, addr, 3109 sizeof(*addr)); 3110 goto done; 3111 } 3112 3113 if (addr->type == BDADDR_BREDR) 3114 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &addr->bdaddr); 3115 else 3116 conn = hci_conn_hash_lookup_le(hdev, &addr->bdaddr, 3117 le_addr_type(addr->type)); 3118 3119 if (!conn) { 3120 err = mgmt_cmd_complete(sk, hdev->id, mgmt_op, 3121 MGMT_STATUS_NOT_CONNECTED, addr, 3122 sizeof(*addr)); 3123 goto done; 3124 } 3125 3126 if (addr->type == BDADDR_LE_PUBLIC || addr->type == BDADDR_LE_RANDOM) { 3127 err = smp_user_confirm_reply(conn, mgmt_op, passkey); 3128 if (!err) 3129 err = mgmt_cmd_complete(sk, hdev->id, mgmt_op, 3130 MGMT_STATUS_SUCCESS, addr, 3131 sizeof(*addr)); 3132 else 3133 err = mgmt_cmd_complete(sk, hdev->id, mgmt_op, 3134 MGMT_STATUS_FAILED, addr, 3135 sizeof(*addr)); 3136 3137 goto done; 3138 } 3139 3140 cmd = mgmt_pending_add(sk, mgmt_op, hdev, addr, sizeof(*addr)); 3141 if (!cmd) { 3142 err = -ENOMEM; 3143 goto done; 3144 } 3145 3146 cmd->cmd_complete = addr_cmd_complete; 3147 3148 /* Continue with pairing via HCI */ 3149 if (hci_op == HCI_OP_USER_PASSKEY_REPLY) { 3150 struct hci_cp_user_passkey_reply cp; 3151 3152 bacpy(&cp.bdaddr, &addr->bdaddr); 3153 cp.passkey = passkey; 3154 err = hci_send_cmd(hdev, hci_op, sizeof(cp), &cp); 3155 } else 3156 err = hci_send_cmd(hdev, hci_op, sizeof(addr->bdaddr), 3157 &addr->bdaddr); 3158 3159 if (err < 0) 3160 mgmt_pending_remove(cmd); 3161 3162 done: 3163 hci_dev_unlock(hdev); 3164 return err; 3165 } 3166 3167 static int pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev, 3168 void *data, u16 len) 3169 { 3170 struct mgmt_cp_pin_code_neg_reply *cp = data; 3171 3172 bt_dev_dbg(hdev, "sock %p", sk); 3173 3174 return user_pairing_resp(sk, hdev, &cp->addr, 3175 MGMT_OP_PIN_CODE_NEG_REPLY, 3176 HCI_OP_PIN_CODE_NEG_REPLY, 0); 3177 } 3178 3179 static int user_confirm_reply(struct sock *sk, struct hci_dev *hdev, void *data, 3180 u16 len) 3181 { 3182 struct mgmt_cp_user_confirm_reply *cp = data; 3183 3184 bt_dev_dbg(hdev, "sock %p", sk); 3185 3186 if (len != sizeof(*cp)) 3187 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_USER_CONFIRM_REPLY, 3188 MGMT_STATUS_INVALID_PARAMS); 3189 3190 return user_pairing_resp(sk, hdev, &cp->addr, 3191 MGMT_OP_USER_CONFIRM_REPLY, 3192 HCI_OP_USER_CONFIRM_REPLY, 0); 3193 } 3194 3195 static int user_confirm_neg_reply(struct sock *sk, struct hci_dev *hdev, 3196 void *data, u16 len) 3197 { 3198 struct mgmt_cp_user_confirm_neg_reply *cp = data; 3199 3200 bt_dev_dbg(hdev, "sock %p", sk); 3201 3202 return user_pairing_resp(sk, hdev, &cp->addr, 3203 MGMT_OP_USER_CONFIRM_NEG_REPLY, 3204 HCI_OP_USER_CONFIRM_NEG_REPLY, 0); 3205 } 3206 3207 static int user_passkey_reply(struct sock *sk, struct hci_dev *hdev, void *data, 3208 u16 len) 3209 { 3210 struct mgmt_cp_user_passkey_reply *cp = data; 3211 3212 bt_dev_dbg(hdev, "sock %p", sk); 3213 3214 return user_pairing_resp(sk, hdev, &cp->addr, 3215 MGMT_OP_USER_PASSKEY_REPLY, 3216 HCI_OP_USER_PASSKEY_REPLY, cp->passkey); 3217 } 3218 3219 static int user_passkey_neg_reply(struct sock *sk, struct hci_dev *hdev, 3220 void *data, u16 len) 3221 { 3222 struct mgmt_cp_user_passkey_neg_reply *cp = data; 3223 3224 bt_dev_dbg(hdev, "sock %p", sk); 3225 3226 return user_pairing_resp(sk, hdev, &cp->addr, 3227 MGMT_OP_USER_PASSKEY_NEG_REPLY, 3228 HCI_OP_USER_PASSKEY_NEG_REPLY, 0); 3229 } 3230 3231 static void adv_expire(struct hci_dev *hdev, u32 flags) 3232 { 3233 struct adv_info *adv_instance; 3234 struct hci_request req; 3235 int err; 3236 3237 adv_instance = hci_find_adv_instance(hdev, hdev->cur_adv_instance); 3238 if (!adv_instance) 3239 return; 3240 3241 /* stop if current instance doesn't need to be changed */ 3242 if (!(adv_instance->flags & flags)) 3243 return; 3244 3245 cancel_adv_timeout(hdev); 3246 3247 adv_instance = hci_get_next_instance(hdev, adv_instance->instance); 3248 if (!adv_instance) 3249 return; 3250 3251 hci_req_init(&req, hdev); 3252 err = __hci_req_schedule_adv_instance(&req, adv_instance->instance, 3253 true); 3254 if (err) 3255 return; 3256 3257 hci_req_run(&req, NULL); 3258 } 3259 3260 static void set_name_complete(struct hci_dev *hdev, u8 status, u16 opcode) 3261 { 3262 struct mgmt_cp_set_local_name *cp; 3263 struct mgmt_pending_cmd *cmd; 3264 3265 bt_dev_dbg(hdev, "status 0x%02x", status); 3266 3267 hci_dev_lock(hdev); 3268 3269 cmd = pending_find(MGMT_OP_SET_LOCAL_NAME, hdev); 3270 if (!cmd) 3271 goto unlock; 3272 3273 cp = cmd->param; 3274 3275 if (status) { 3276 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 3277 mgmt_status(status)); 3278 } else { 3279 mgmt_cmd_complete(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0, 3280 cp, sizeof(*cp)); 3281 3282 if (hci_dev_test_flag(hdev, HCI_LE_ADV)) 3283 adv_expire(hdev, MGMT_ADV_FLAG_LOCAL_NAME); 3284 } 3285 3286 mgmt_pending_remove(cmd); 3287 3288 unlock: 3289 hci_dev_unlock(hdev); 3290 } 3291 3292 static int set_local_name(struct sock *sk, struct hci_dev *hdev, void *data, 3293 u16 len) 3294 { 3295 struct mgmt_cp_set_local_name *cp = data; 3296 struct mgmt_pending_cmd *cmd; 3297 struct hci_request req; 3298 int err; 3299 3300 bt_dev_dbg(hdev, "sock %p", sk); 3301 3302 hci_dev_lock(hdev); 3303 3304 /* If the old values are the same as the new ones just return a 3305 * direct command complete event. 3306 */ 3307 if (!memcmp(hdev->dev_name, cp->name, sizeof(hdev->dev_name)) && 3308 !memcmp(hdev->short_name, cp->short_name, 3309 sizeof(hdev->short_name))) { 3310 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0, 3311 data, len); 3312 goto failed; 3313 } 3314 3315 memcpy(hdev->short_name, cp->short_name, sizeof(hdev->short_name)); 3316 3317 if (!hdev_is_powered(hdev)) { 3318 memcpy(hdev->dev_name, cp->name, sizeof(hdev->dev_name)); 3319 3320 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0, 3321 data, len); 3322 if (err < 0) 3323 goto failed; 3324 3325 err = mgmt_limited_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, data, 3326 len, HCI_MGMT_LOCAL_NAME_EVENTS, sk); 3327 ext_info_changed(hdev, sk); 3328 3329 goto failed; 3330 } 3331 3332 cmd = mgmt_pending_add(sk, MGMT_OP_SET_LOCAL_NAME, hdev, data, len); 3333 if (!cmd) { 3334 err = -ENOMEM; 3335 goto failed; 3336 } 3337 3338 memcpy(hdev->dev_name, cp->name, sizeof(hdev->dev_name)); 3339 3340 hci_req_init(&req, hdev); 3341 3342 if (lmp_bredr_capable(hdev)) { 3343 __hci_req_update_name(&req); 3344 __hci_req_update_eir(&req); 3345 } 3346 3347 /* The name is stored in the scan response data and so 3348 * no need to update the advertising data here. 3349 */ 3350 if (lmp_le_capable(hdev) && hci_dev_test_flag(hdev, HCI_ADVERTISING)) 3351 __hci_req_update_scan_rsp_data(&req, hdev->cur_adv_instance); 3352 3353 err = hci_req_run(&req, set_name_complete); 3354 if (err < 0) 3355 mgmt_pending_remove(cmd); 3356 3357 failed: 3358 hci_dev_unlock(hdev); 3359 return err; 3360 } 3361 3362 static int set_appearance(struct sock *sk, struct hci_dev *hdev, void *data, 3363 u16 len) 3364 { 3365 struct mgmt_cp_set_appearance *cp = data; 3366 u16 appearance; 3367 int err; 3368 3369 bt_dev_dbg(hdev, "sock %p", sk); 3370 3371 if (!lmp_le_capable(hdev)) 3372 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_APPEARANCE, 3373 MGMT_STATUS_NOT_SUPPORTED); 3374 3375 appearance = le16_to_cpu(cp->appearance); 3376 3377 hci_dev_lock(hdev); 3378 3379 if (hdev->appearance != appearance) { 3380 hdev->appearance = appearance; 3381 3382 if (hci_dev_test_flag(hdev, HCI_LE_ADV)) 3383 adv_expire(hdev, MGMT_ADV_FLAG_APPEARANCE); 3384 3385 ext_info_changed(hdev, sk); 3386 } 3387 3388 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_APPEARANCE, 0, NULL, 3389 0); 3390 3391 hci_dev_unlock(hdev); 3392 3393 return err; 3394 } 3395 3396 static int get_phy_configuration(struct sock *sk, struct hci_dev *hdev, 3397 void *data, u16 len) 3398 { 3399 struct mgmt_rp_get_phy_configuration rp; 3400 3401 bt_dev_dbg(hdev, "sock %p", sk); 3402 3403 hci_dev_lock(hdev); 3404 3405 memset(&rp, 0, sizeof(rp)); 3406 3407 rp.supported_phys = cpu_to_le32(get_supported_phys(hdev)); 3408 rp.selected_phys = cpu_to_le32(get_selected_phys(hdev)); 3409 rp.configurable_phys = cpu_to_le32(get_configurable_phys(hdev)); 3410 3411 hci_dev_unlock(hdev); 3412 3413 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_PHY_CONFIGURATION, 0, 3414 &rp, sizeof(rp)); 3415 } 3416 3417 int mgmt_phy_configuration_changed(struct hci_dev *hdev, struct sock *skip) 3418 { 3419 struct mgmt_ev_phy_configuration_changed ev; 3420 3421 memset(&ev, 0, sizeof(ev)); 3422 3423 ev.selected_phys = cpu_to_le32(get_selected_phys(hdev)); 3424 3425 return mgmt_event(MGMT_EV_PHY_CONFIGURATION_CHANGED, hdev, &ev, 3426 sizeof(ev), skip); 3427 } 3428 3429 static void set_default_phy_complete(struct hci_dev *hdev, u8 status, 3430 u16 opcode, struct sk_buff *skb) 3431 { 3432 struct mgmt_pending_cmd *cmd; 3433 3434 bt_dev_dbg(hdev, "status 0x%02x", status); 3435 3436 hci_dev_lock(hdev); 3437 3438 cmd = pending_find(MGMT_OP_SET_PHY_CONFIGURATION, hdev); 3439 if (!cmd) 3440 goto unlock; 3441 3442 if (status) { 3443 mgmt_cmd_status(cmd->sk, hdev->id, 3444 MGMT_OP_SET_PHY_CONFIGURATION, 3445 mgmt_status(status)); 3446 } else { 3447 mgmt_cmd_complete(cmd->sk, hdev->id, 3448 MGMT_OP_SET_PHY_CONFIGURATION, 0, 3449 NULL, 0); 3450 3451 mgmt_phy_configuration_changed(hdev, cmd->sk); 3452 } 3453 3454 mgmt_pending_remove(cmd); 3455 3456 unlock: 3457 hci_dev_unlock(hdev); 3458 } 3459 3460 static int set_phy_configuration(struct sock *sk, struct hci_dev *hdev, 3461 void *data, u16 len) 3462 { 3463 struct mgmt_cp_set_phy_configuration *cp = data; 3464 struct hci_cp_le_set_default_phy cp_phy; 3465 struct mgmt_pending_cmd *cmd; 3466 struct hci_request req; 3467 u32 selected_phys, configurable_phys, supported_phys, unconfigure_phys; 3468 u16 pkt_type = (HCI_DH1 | HCI_DM1); 3469 bool changed = false; 3470 int err; 3471 3472 bt_dev_dbg(hdev, "sock %p", sk); 3473 3474 configurable_phys = get_configurable_phys(hdev); 3475 supported_phys = get_supported_phys(hdev); 3476 selected_phys = __le32_to_cpu(cp->selected_phys); 3477 3478 if (selected_phys & ~supported_phys) 3479 return mgmt_cmd_status(sk, hdev->id, 3480 MGMT_OP_SET_PHY_CONFIGURATION, 3481 MGMT_STATUS_INVALID_PARAMS); 3482 3483 unconfigure_phys = supported_phys & ~configurable_phys; 3484 3485 if ((selected_phys & unconfigure_phys) != unconfigure_phys) 3486 return mgmt_cmd_status(sk, hdev->id, 3487 MGMT_OP_SET_PHY_CONFIGURATION, 3488 MGMT_STATUS_INVALID_PARAMS); 3489 3490 if (selected_phys == get_selected_phys(hdev)) 3491 return mgmt_cmd_complete(sk, hdev->id, 3492 MGMT_OP_SET_PHY_CONFIGURATION, 3493 0, NULL, 0); 3494 3495 hci_dev_lock(hdev); 3496 3497 if (!hdev_is_powered(hdev)) { 3498 err = mgmt_cmd_status(sk, hdev->id, 3499 MGMT_OP_SET_PHY_CONFIGURATION, 3500 MGMT_STATUS_REJECTED); 3501 goto unlock; 3502 } 3503 3504 if (pending_find(MGMT_OP_SET_PHY_CONFIGURATION, hdev)) { 3505 err = mgmt_cmd_status(sk, hdev->id, 3506 MGMT_OP_SET_PHY_CONFIGURATION, 3507 MGMT_STATUS_BUSY); 3508 goto unlock; 3509 } 3510 3511 if (selected_phys & MGMT_PHY_BR_1M_3SLOT) 3512 pkt_type |= (HCI_DH3 | HCI_DM3); 3513 else 3514 pkt_type &= ~(HCI_DH3 | HCI_DM3); 3515 3516 if (selected_phys & MGMT_PHY_BR_1M_5SLOT) 3517 pkt_type |= (HCI_DH5 | HCI_DM5); 3518 else 3519 pkt_type &= ~(HCI_DH5 | HCI_DM5); 3520 3521 if (selected_phys & MGMT_PHY_EDR_2M_1SLOT) 3522 pkt_type &= ~HCI_2DH1; 3523 else 3524 pkt_type |= HCI_2DH1; 3525 3526 if (selected_phys & MGMT_PHY_EDR_2M_3SLOT) 3527 pkt_type &= ~HCI_2DH3; 3528 else 3529 pkt_type |= HCI_2DH3; 3530 3531 if (selected_phys & MGMT_PHY_EDR_2M_5SLOT) 3532 pkt_type &= ~HCI_2DH5; 3533 else 3534 pkt_type |= HCI_2DH5; 3535 3536 if (selected_phys & MGMT_PHY_EDR_3M_1SLOT) 3537 pkt_type &= ~HCI_3DH1; 3538 else 3539 pkt_type |= HCI_3DH1; 3540 3541 if (selected_phys & MGMT_PHY_EDR_3M_3SLOT) 3542 pkt_type &= ~HCI_3DH3; 3543 else 3544 pkt_type |= HCI_3DH3; 3545 3546 if (selected_phys & MGMT_PHY_EDR_3M_5SLOT) 3547 pkt_type &= ~HCI_3DH5; 3548 else 3549 pkt_type |= HCI_3DH5; 3550 3551 if (pkt_type != hdev->pkt_type) { 3552 hdev->pkt_type = pkt_type; 3553 changed = true; 3554 } 3555 3556 if ((selected_phys & MGMT_PHY_LE_MASK) == 3557 (get_selected_phys(hdev) & MGMT_PHY_LE_MASK)) { 3558 if (changed) 3559 mgmt_phy_configuration_changed(hdev, sk); 3560 3561 err = mgmt_cmd_complete(sk, hdev->id, 3562 MGMT_OP_SET_PHY_CONFIGURATION, 3563 0, NULL, 0); 3564 3565 goto unlock; 3566 } 3567 3568 cmd = mgmt_pending_add(sk, MGMT_OP_SET_PHY_CONFIGURATION, hdev, data, 3569 len); 3570 if (!cmd) { 3571 err = -ENOMEM; 3572 goto unlock; 3573 } 3574 3575 hci_req_init(&req, hdev); 3576 3577 memset(&cp_phy, 0, sizeof(cp_phy)); 3578 3579 if (!(selected_phys & MGMT_PHY_LE_TX_MASK)) 3580 cp_phy.all_phys |= 0x01; 3581 3582 if (!(selected_phys & MGMT_PHY_LE_RX_MASK)) 3583 cp_phy.all_phys |= 0x02; 3584 3585 if (selected_phys & MGMT_PHY_LE_1M_TX) 3586 cp_phy.tx_phys |= HCI_LE_SET_PHY_1M; 3587 3588 if (selected_phys & MGMT_PHY_LE_2M_TX) 3589 cp_phy.tx_phys |= HCI_LE_SET_PHY_2M; 3590 3591 if (selected_phys & MGMT_PHY_LE_CODED_TX) 3592 cp_phy.tx_phys |= HCI_LE_SET_PHY_CODED; 3593 3594 if (selected_phys & MGMT_PHY_LE_1M_RX) 3595 cp_phy.rx_phys |= HCI_LE_SET_PHY_1M; 3596 3597 if (selected_phys & MGMT_PHY_LE_2M_RX) 3598 cp_phy.rx_phys |= HCI_LE_SET_PHY_2M; 3599 3600 if (selected_phys & MGMT_PHY_LE_CODED_RX) 3601 cp_phy.rx_phys |= HCI_LE_SET_PHY_CODED; 3602 3603 hci_req_add(&req, HCI_OP_LE_SET_DEFAULT_PHY, sizeof(cp_phy), &cp_phy); 3604 3605 err = hci_req_run_skb(&req, set_default_phy_complete); 3606 if (err < 0) 3607 mgmt_pending_remove(cmd); 3608 3609 unlock: 3610 hci_dev_unlock(hdev); 3611 3612 return err; 3613 } 3614 3615 static int set_blocked_keys(struct sock *sk, struct hci_dev *hdev, void *data, 3616 u16 len) 3617 { 3618 int err = MGMT_STATUS_SUCCESS; 3619 struct mgmt_cp_set_blocked_keys *keys = data; 3620 const u16 max_key_count = ((U16_MAX - sizeof(*keys)) / 3621 sizeof(struct mgmt_blocked_key_info)); 3622 u16 key_count, expected_len; 3623 int i; 3624 3625 bt_dev_dbg(hdev, "sock %p", sk); 3626 3627 key_count = __le16_to_cpu(keys->key_count); 3628 if (key_count > max_key_count) { 3629 bt_dev_err(hdev, "too big key_count value %u", key_count); 3630 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BLOCKED_KEYS, 3631 MGMT_STATUS_INVALID_PARAMS); 3632 } 3633 3634 expected_len = struct_size(keys, keys, key_count); 3635 if (expected_len != len) { 3636 bt_dev_err(hdev, "expected %u bytes, got %u bytes", 3637 expected_len, len); 3638 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BLOCKED_KEYS, 3639 MGMT_STATUS_INVALID_PARAMS); 3640 } 3641 3642 hci_dev_lock(hdev); 3643 3644 hci_blocked_keys_clear(hdev); 3645 3646 for (i = 0; i < keys->key_count; ++i) { 3647 struct blocked_key *b = kzalloc(sizeof(*b), GFP_KERNEL); 3648 3649 if (!b) { 3650 err = MGMT_STATUS_NO_RESOURCES; 3651 break; 3652 } 3653 3654 b->type = keys->keys[i].type; 3655 memcpy(b->val, keys->keys[i].val, sizeof(b->val)); 3656 list_add_rcu(&b->list, &hdev->blocked_keys); 3657 } 3658 hci_dev_unlock(hdev); 3659 3660 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_BLOCKED_KEYS, 3661 err, NULL, 0); 3662 } 3663 3664 static int set_wideband_speech(struct sock *sk, struct hci_dev *hdev, 3665 void *data, u16 len) 3666 { 3667 struct mgmt_mode *cp = data; 3668 int err; 3669 bool changed = false; 3670 3671 bt_dev_dbg(hdev, "sock %p", sk); 3672 3673 if (!test_bit(HCI_QUIRK_WIDEBAND_SPEECH_SUPPORTED, &hdev->quirks)) 3674 return mgmt_cmd_status(sk, hdev->id, 3675 MGMT_OP_SET_WIDEBAND_SPEECH, 3676 MGMT_STATUS_NOT_SUPPORTED); 3677 3678 if (cp->val != 0x00 && cp->val != 0x01) 3679 return mgmt_cmd_status(sk, hdev->id, 3680 MGMT_OP_SET_WIDEBAND_SPEECH, 3681 MGMT_STATUS_INVALID_PARAMS); 3682 3683 hci_dev_lock(hdev); 3684 3685 if (pending_find(MGMT_OP_SET_WIDEBAND_SPEECH, hdev)) { 3686 err = mgmt_cmd_status(sk, hdev->id, 3687 MGMT_OP_SET_WIDEBAND_SPEECH, 3688 MGMT_STATUS_BUSY); 3689 goto unlock; 3690 } 3691 3692 if (hdev_is_powered(hdev) && 3693 !!cp->val != hci_dev_test_flag(hdev, 3694 HCI_WIDEBAND_SPEECH_ENABLED)) { 3695 err = mgmt_cmd_status(sk, hdev->id, 3696 MGMT_OP_SET_WIDEBAND_SPEECH, 3697 MGMT_STATUS_REJECTED); 3698 goto unlock; 3699 } 3700 3701 if (cp->val) 3702 changed = !hci_dev_test_and_set_flag(hdev, 3703 HCI_WIDEBAND_SPEECH_ENABLED); 3704 else 3705 changed = hci_dev_test_and_clear_flag(hdev, 3706 HCI_WIDEBAND_SPEECH_ENABLED); 3707 3708 err = send_settings_rsp(sk, MGMT_OP_SET_WIDEBAND_SPEECH, hdev); 3709 if (err < 0) 3710 goto unlock; 3711 3712 if (changed) 3713 err = new_settings(hdev, sk); 3714 3715 unlock: 3716 hci_dev_unlock(hdev); 3717 return err; 3718 } 3719 3720 static int read_controller_cap(struct sock *sk, struct hci_dev *hdev, 3721 void *data, u16 data_len) 3722 { 3723 char buf[20]; 3724 struct mgmt_rp_read_controller_cap *rp = (void *)buf; 3725 u16 cap_len = 0; 3726 u8 flags = 0; 3727 u8 tx_power_range[2]; 3728 3729 bt_dev_dbg(hdev, "sock %p", sk); 3730 3731 memset(&buf, 0, sizeof(buf)); 3732 3733 hci_dev_lock(hdev); 3734 3735 /* When the Read Simple Pairing Options command is supported, then 3736 * the remote public key validation is supported. 3737 * 3738 * Alternatively, when Microsoft extensions are available, they can 3739 * indicate support for public key validation as well. 3740 */ 3741 if ((hdev->commands[41] & 0x08) || msft_curve_validity(hdev)) 3742 flags |= 0x01; /* Remote public key validation (BR/EDR) */ 3743 3744 flags |= 0x02; /* Remote public key validation (LE) */ 3745 3746 /* When the Read Encryption Key Size command is supported, then the 3747 * encryption key size is enforced. 3748 */ 3749 if (hdev->commands[20] & 0x10) 3750 flags |= 0x04; /* Encryption key size enforcement (BR/EDR) */ 3751 3752 flags |= 0x08; /* Encryption key size enforcement (LE) */ 3753 3754 cap_len = eir_append_data(rp->cap, cap_len, MGMT_CAP_SEC_FLAGS, 3755 &flags, 1); 3756 3757 /* When the Read Simple Pairing Options command is supported, then 3758 * also max encryption key size information is provided. 3759 */ 3760 if (hdev->commands[41] & 0x08) 3761 cap_len = eir_append_le16(rp->cap, cap_len, 3762 MGMT_CAP_MAX_ENC_KEY_SIZE, 3763 hdev->max_enc_key_size); 3764 3765 cap_len = eir_append_le16(rp->cap, cap_len, 3766 MGMT_CAP_SMP_MAX_ENC_KEY_SIZE, 3767 SMP_MAX_ENC_KEY_SIZE); 3768 3769 /* Append the min/max LE tx power parameters if we were able to fetch 3770 * it from the controller 3771 */ 3772 if (hdev->commands[38] & 0x80) { 3773 memcpy(&tx_power_range[0], &hdev->min_le_tx_power, 1); 3774 memcpy(&tx_power_range[1], &hdev->max_le_tx_power, 1); 3775 cap_len = eir_append_data(rp->cap, cap_len, MGMT_CAP_LE_TX_PWR, 3776 tx_power_range, 2); 3777 } 3778 3779 rp->cap_len = cpu_to_le16(cap_len); 3780 3781 hci_dev_unlock(hdev); 3782 3783 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_CONTROLLER_CAP, 0, 3784 rp, sizeof(*rp) + cap_len); 3785 } 3786 3787 #ifdef CONFIG_BT_FEATURE_DEBUG 3788 /* d4992530-b9ec-469f-ab01-6c481c47da1c */ 3789 static const u8 debug_uuid[16] = { 3790 0x1c, 0xda, 0x47, 0x1c, 0x48, 0x6c, 0x01, 0xab, 3791 0x9f, 0x46, 0xec, 0xb9, 0x30, 0x25, 0x99, 0xd4, 3792 }; 3793 #endif 3794 3795 /* 330859bc-7506-492d-9370-9a6f0614037f */ 3796 static const u8 quality_report_uuid[16] = { 3797 0x7f, 0x03, 0x14, 0x06, 0x6f, 0x9a, 0x70, 0x93, 3798 0x2d, 0x49, 0x06, 0x75, 0xbc, 0x59, 0x08, 0x33, 3799 }; 3800 3801 /* a6695ace-ee7f-4fb9-881a-5fac66c629af */ 3802 static const u8 offload_codecs_uuid[16] = { 3803 0xaf, 0x29, 0xc6, 0x66, 0xac, 0x5f, 0x1a, 0x88, 3804 0xb9, 0x4f, 0x7f, 0xee, 0xce, 0x5a, 0x69, 0xa6, 3805 }; 3806 3807 /* 671b10b5-42c0-4696-9227-eb28d1b049d6 */ 3808 static const u8 simult_central_periph_uuid[16] = { 3809 0xd6, 0x49, 0xb0, 0xd1, 0x28, 0xeb, 0x27, 0x92, 3810 0x96, 0x46, 0xc0, 0x42, 0xb5, 0x10, 0x1b, 0x67, 3811 }; 3812 3813 /* 15c0a148-c273-11ea-b3de-0242ac130004 */ 3814 static const u8 rpa_resolution_uuid[16] = { 3815 0x04, 0x00, 0x13, 0xac, 0x42, 0x02, 0xde, 0xb3, 3816 0xea, 0x11, 0x73, 0xc2, 0x48, 0xa1, 0xc0, 0x15, 3817 }; 3818 3819 static int read_exp_features_info(struct sock *sk, struct hci_dev *hdev, 3820 void *data, u16 data_len) 3821 { 3822 char buf[102]; /* Enough space for 5 features: 2 + 20 * 5 */ 3823 struct mgmt_rp_read_exp_features_info *rp = (void *)buf; 3824 u16 idx = 0; 3825 u32 flags; 3826 3827 bt_dev_dbg(hdev, "sock %p", sk); 3828 3829 memset(&buf, 0, sizeof(buf)); 3830 3831 #ifdef CONFIG_BT_FEATURE_DEBUG 3832 if (!hdev) { 3833 flags = bt_dbg_get() ? BIT(0) : 0; 3834 3835 memcpy(rp->features[idx].uuid, debug_uuid, 16); 3836 rp->features[idx].flags = cpu_to_le32(flags); 3837 idx++; 3838 } 3839 #endif 3840 3841 if (hdev) { 3842 if (test_bit(HCI_QUIRK_VALID_LE_STATES, &hdev->quirks) && 3843 (hdev->le_states[4] & 0x08) && /* Central */ 3844 (hdev->le_states[4] & 0x40) && /* Peripheral */ 3845 (hdev->le_states[3] & 0x10)) /* Simultaneous */ 3846 flags = BIT(0); 3847 else 3848 flags = 0; 3849 3850 memcpy(rp->features[idx].uuid, simult_central_periph_uuid, 16); 3851 rp->features[idx].flags = cpu_to_le32(flags); 3852 idx++; 3853 } 3854 3855 if (hdev && use_ll_privacy(hdev)) { 3856 if (hci_dev_test_flag(hdev, HCI_ENABLE_LL_PRIVACY)) 3857 flags = BIT(0) | BIT(1); 3858 else 3859 flags = BIT(1); 3860 3861 memcpy(rp->features[idx].uuid, rpa_resolution_uuid, 16); 3862 rp->features[idx].flags = cpu_to_le32(flags); 3863 idx++; 3864 } 3865 3866 if (hdev && hdev->set_quality_report) { 3867 if (hci_dev_test_flag(hdev, HCI_QUALITY_REPORT)) 3868 flags = BIT(0); 3869 else 3870 flags = 0; 3871 3872 memcpy(rp->features[idx].uuid, quality_report_uuid, 16); 3873 rp->features[idx].flags = cpu_to_le32(flags); 3874 idx++; 3875 } 3876 3877 if (hdev && hdev->get_data_path_id) { 3878 if (hci_dev_test_flag(hdev, HCI_OFFLOAD_CODECS_ENABLED)) 3879 flags = BIT(0); 3880 else 3881 flags = 0; 3882 3883 memcpy(rp->features[idx].uuid, offload_codecs_uuid, 16); 3884 rp->features[idx].flags = cpu_to_le32(flags); 3885 idx++; 3886 } 3887 3888 rp->feature_count = cpu_to_le16(idx); 3889 3890 /* After reading the experimental features information, enable 3891 * the events to update client on any future change. 3892 */ 3893 hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS); 3894 3895 return mgmt_cmd_complete(sk, hdev ? hdev->id : MGMT_INDEX_NONE, 3896 MGMT_OP_READ_EXP_FEATURES_INFO, 3897 0, rp, sizeof(*rp) + (20 * idx)); 3898 } 3899 3900 static int exp_ll_privacy_feature_changed(bool enabled, struct hci_dev *hdev, 3901 struct sock *skip) 3902 { 3903 struct mgmt_ev_exp_feature_changed ev; 3904 3905 memset(&ev, 0, sizeof(ev)); 3906 memcpy(ev.uuid, rpa_resolution_uuid, 16); 3907 ev.flags = cpu_to_le32((enabled ? BIT(0) : 0) | BIT(1)); 3908 3909 return mgmt_limited_event(MGMT_EV_EXP_FEATURE_CHANGED, hdev, 3910 &ev, sizeof(ev), 3911 HCI_MGMT_EXP_FEATURE_EVENTS, skip); 3912 3913 } 3914 3915 #ifdef CONFIG_BT_FEATURE_DEBUG 3916 static int exp_debug_feature_changed(bool enabled, struct sock *skip) 3917 { 3918 struct mgmt_ev_exp_feature_changed ev; 3919 3920 memset(&ev, 0, sizeof(ev)); 3921 memcpy(ev.uuid, debug_uuid, 16); 3922 ev.flags = cpu_to_le32(enabled ? BIT(0) : 0); 3923 3924 return mgmt_limited_event(MGMT_EV_EXP_FEATURE_CHANGED, NULL, 3925 &ev, sizeof(ev), 3926 HCI_MGMT_EXP_FEATURE_EVENTS, skip); 3927 } 3928 #endif 3929 3930 static int exp_quality_report_feature_changed(bool enabled, struct sock *skip) 3931 { 3932 struct mgmt_ev_exp_feature_changed ev; 3933 3934 memset(&ev, 0, sizeof(ev)); 3935 memcpy(ev.uuid, quality_report_uuid, 16); 3936 ev.flags = cpu_to_le32(enabled ? BIT(0) : 0); 3937 3938 return mgmt_limited_event(MGMT_EV_EXP_FEATURE_CHANGED, NULL, 3939 &ev, sizeof(ev), 3940 HCI_MGMT_EXP_FEATURE_EVENTS, skip); 3941 } 3942 3943 #define EXP_FEAT(_uuid, _set_func) \ 3944 { \ 3945 .uuid = _uuid, \ 3946 .set_func = _set_func, \ 3947 } 3948 3949 /* The zero key uuid is special. Multiple exp features are set through it. */ 3950 static int set_zero_key_func(struct sock *sk, struct hci_dev *hdev, 3951 struct mgmt_cp_set_exp_feature *cp, u16 data_len) 3952 { 3953 struct mgmt_rp_set_exp_feature rp; 3954 3955 memset(rp.uuid, 0, 16); 3956 rp.flags = cpu_to_le32(0); 3957 3958 #ifdef CONFIG_BT_FEATURE_DEBUG 3959 if (!hdev) { 3960 bool changed = bt_dbg_get(); 3961 3962 bt_dbg_set(false); 3963 3964 if (changed) 3965 exp_debug_feature_changed(false, sk); 3966 } 3967 #endif 3968 3969 if (hdev && use_ll_privacy(hdev) && !hdev_is_powered(hdev)) { 3970 bool changed = hci_dev_test_flag(hdev, HCI_ENABLE_LL_PRIVACY); 3971 3972 hci_dev_clear_flag(hdev, HCI_ENABLE_LL_PRIVACY); 3973 3974 if (changed) 3975 exp_ll_privacy_feature_changed(false, hdev, sk); 3976 } 3977 3978 hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS); 3979 3980 return mgmt_cmd_complete(sk, hdev ? hdev->id : MGMT_INDEX_NONE, 3981 MGMT_OP_SET_EXP_FEATURE, 0, 3982 &rp, sizeof(rp)); 3983 } 3984 3985 #ifdef CONFIG_BT_FEATURE_DEBUG 3986 static int set_debug_func(struct sock *sk, struct hci_dev *hdev, 3987 struct mgmt_cp_set_exp_feature *cp, u16 data_len) 3988 { 3989 struct mgmt_rp_set_exp_feature rp; 3990 3991 bool val, changed; 3992 int err; 3993 3994 /* Command requires to use the non-controller index */ 3995 if (hdev) 3996 return mgmt_cmd_status(sk, hdev->id, 3997 MGMT_OP_SET_EXP_FEATURE, 3998 MGMT_STATUS_INVALID_INDEX); 3999 4000 /* Parameters are limited to a single octet */ 4001 if (data_len != MGMT_SET_EXP_FEATURE_SIZE + 1) 4002 return mgmt_cmd_status(sk, MGMT_INDEX_NONE, 4003 MGMT_OP_SET_EXP_FEATURE, 4004 MGMT_STATUS_INVALID_PARAMS); 4005 4006 /* Only boolean on/off is supported */ 4007 if (cp->param[0] != 0x00 && cp->param[0] != 0x01) 4008 return mgmt_cmd_status(sk, MGMT_INDEX_NONE, 4009 MGMT_OP_SET_EXP_FEATURE, 4010 MGMT_STATUS_INVALID_PARAMS); 4011 4012 val = !!cp->param[0]; 4013 changed = val ? !bt_dbg_get() : bt_dbg_get(); 4014 bt_dbg_set(val); 4015 4016 memcpy(rp.uuid, debug_uuid, 16); 4017 rp.flags = cpu_to_le32(val ? BIT(0) : 0); 4018 4019 hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS); 4020 4021 err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE, 4022 MGMT_OP_SET_EXP_FEATURE, 0, 4023 &rp, sizeof(rp)); 4024 4025 if (changed) 4026 exp_debug_feature_changed(val, sk); 4027 4028 return err; 4029 } 4030 #endif 4031 4032 static int set_rpa_resolution_func(struct sock *sk, struct hci_dev *hdev, 4033 struct mgmt_cp_set_exp_feature *cp, 4034 u16 data_len) 4035 { 4036 struct mgmt_rp_set_exp_feature rp; 4037 bool val, changed; 4038 int err; 4039 u32 flags; 4040 4041 /* Command requires to use the controller index */ 4042 if (!hdev) 4043 return mgmt_cmd_status(sk, MGMT_INDEX_NONE, 4044 MGMT_OP_SET_EXP_FEATURE, 4045 MGMT_STATUS_INVALID_INDEX); 4046 4047 /* Changes can only be made when controller is powered down */ 4048 if (hdev_is_powered(hdev)) 4049 return mgmt_cmd_status(sk, hdev->id, 4050 MGMT_OP_SET_EXP_FEATURE, 4051 MGMT_STATUS_REJECTED); 4052 4053 /* Parameters are limited to a single octet */ 4054 if (data_len != MGMT_SET_EXP_FEATURE_SIZE + 1) 4055 return mgmt_cmd_status(sk, hdev->id, 4056 MGMT_OP_SET_EXP_FEATURE, 4057 MGMT_STATUS_INVALID_PARAMS); 4058 4059 /* Only boolean on/off is supported */ 4060 if (cp->param[0] != 0x00 && cp->param[0] != 0x01) 4061 return mgmt_cmd_status(sk, hdev->id, 4062 MGMT_OP_SET_EXP_FEATURE, 4063 MGMT_STATUS_INVALID_PARAMS); 4064 4065 val = !!cp->param[0]; 4066 4067 if (val) { 4068 changed = !hci_dev_test_flag(hdev, HCI_ENABLE_LL_PRIVACY); 4069 hci_dev_set_flag(hdev, HCI_ENABLE_LL_PRIVACY); 4070 hci_dev_clear_flag(hdev, HCI_ADVERTISING); 4071 4072 /* Enable LL privacy + supported settings changed */ 4073 flags = BIT(0) | BIT(1); 4074 } else { 4075 changed = hci_dev_test_flag(hdev, HCI_ENABLE_LL_PRIVACY); 4076 hci_dev_clear_flag(hdev, HCI_ENABLE_LL_PRIVACY); 4077 4078 /* Disable LL privacy + supported settings changed */ 4079 flags = BIT(1); 4080 } 4081 4082 memcpy(rp.uuid, rpa_resolution_uuid, 16); 4083 rp.flags = cpu_to_le32(flags); 4084 4085 hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS); 4086 4087 err = mgmt_cmd_complete(sk, hdev->id, 4088 MGMT_OP_SET_EXP_FEATURE, 0, 4089 &rp, sizeof(rp)); 4090 4091 if (changed) 4092 exp_ll_privacy_feature_changed(val, hdev, sk); 4093 4094 return err; 4095 } 4096 4097 static int set_quality_report_func(struct sock *sk, struct hci_dev *hdev, 4098 struct mgmt_cp_set_exp_feature *cp, 4099 u16 data_len) 4100 { 4101 struct mgmt_rp_set_exp_feature rp; 4102 bool val, changed; 4103 int err; 4104 4105 /* Command requires to use a valid controller index */ 4106 if (!hdev) 4107 return mgmt_cmd_status(sk, MGMT_INDEX_NONE, 4108 MGMT_OP_SET_EXP_FEATURE, 4109 MGMT_STATUS_INVALID_INDEX); 4110 4111 /* Parameters are limited to a single octet */ 4112 if (data_len != MGMT_SET_EXP_FEATURE_SIZE + 1) 4113 return mgmt_cmd_status(sk, hdev->id, 4114 MGMT_OP_SET_EXP_FEATURE, 4115 MGMT_STATUS_INVALID_PARAMS); 4116 4117 /* Only boolean on/off is supported */ 4118 if (cp->param[0] != 0x00 && cp->param[0] != 0x01) 4119 return mgmt_cmd_status(sk, hdev->id, 4120 MGMT_OP_SET_EXP_FEATURE, 4121 MGMT_STATUS_INVALID_PARAMS); 4122 4123 hci_req_sync_lock(hdev); 4124 4125 val = !!cp->param[0]; 4126 changed = (val != hci_dev_test_flag(hdev, HCI_QUALITY_REPORT)); 4127 4128 if (!hdev->set_quality_report) { 4129 err = mgmt_cmd_status(sk, hdev->id, 4130 MGMT_OP_SET_EXP_FEATURE, 4131 MGMT_STATUS_NOT_SUPPORTED); 4132 goto unlock_quality_report; 4133 } 4134 4135 if (changed) { 4136 err = hdev->set_quality_report(hdev, val); 4137 if (err) { 4138 err = mgmt_cmd_status(sk, hdev->id, 4139 MGMT_OP_SET_EXP_FEATURE, 4140 MGMT_STATUS_FAILED); 4141 goto unlock_quality_report; 4142 } 4143 if (val) 4144 hci_dev_set_flag(hdev, HCI_QUALITY_REPORT); 4145 else 4146 hci_dev_clear_flag(hdev, HCI_QUALITY_REPORT); 4147 } 4148 4149 bt_dev_dbg(hdev, "quality report enable %d changed %d", val, changed); 4150 4151 memcpy(rp.uuid, quality_report_uuid, 16); 4152 rp.flags = cpu_to_le32(val ? BIT(0) : 0); 4153 hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS); 4154 err = mgmt_cmd_complete(sk, hdev->id, 4155 MGMT_OP_SET_EXP_FEATURE, 0, 4156 &rp, sizeof(rp)); 4157 4158 if (changed) 4159 exp_quality_report_feature_changed(val, sk); 4160 4161 unlock_quality_report: 4162 hci_req_sync_unlock(hdev); 4163 return err; 4164 } 4165 4166 static int exp_offload_codec_feature_changed(bool enabled, struct sock *skip) 4167 { 4168 struct mgmt_ev_exp_feature_changed ev; 4169 4170 memset(&ev, 0, sizeof(ev)); 4171 memcpy(ev.uuid, offload_codecs_uuid, 16); 4172 ev.flags = cpu_to_le32(enabled ? BIT(0) : 0); 4173 4174 return mgmt_limited_event(MGMT_EV_EXP_FEATURE_CHANGED, NULL, 4175 &ev, sizeof(ev), 4176 HCI_MGMT_EXP_FEATURE_EVENTS, skip); 4177 } 4178 4179 static int set_offload_codec_func(struct sock *sk, struct hci_dev *hdev, 4180 struct mgmt_cp_set_exp_feature *cp, 4181 u16 data_len) 4182 { 4183 bool val, changed; 4184 int err; 4185 struct mgmt_rp_set_exp_feature rp; 4186 4187 /* Command requires to use a valid controller index */ 4188 if (!hdev) 4189 return mgmt_cmd_status(sk, MGMT_INDEX_NONE, 4190 MGMT_OP_SET_EXP_FEATURE, 4191 MGMT_STATUS_INVALID_INDEX); 4192 4193 /* Parameters are limited to a single octet */ 4194 if (data_len != MGMT_SET_EXP_FEATURE_SIZE + 1) 4195 return mgmt_cmd_status(sk, hdev->id, 4196 MGMT_OP_SET_EXP_FEATURE, 4197 MGMT_STATUS_INVALID_PARAMS); 4198 4199 /* Only boolean on/off is supported */ 4200 if (cp->param[0] != 0x00 && cp->param[0] != 0x01) 4201 return mgmt_cmd_status(sk, hdev->id, 4202 MGMT_OP_SET_EXP_FEATURE, 4203 MGMT_STATUS_INVALID_PARAMS); 4204 4205 val = !!cp->param[0]; 4206 changed = (val != hci_dev_test_flag(hdev, HCI_OFFLOAD_CODECS_ENABLED)); 4207 4208 if (!hdev->get_data_path_id) { 4209 return mgmt_cmd_status(sk, hdev->id, 4210 MGMT_OP_SET_EXP_FEATURE, 4211 MGMT_STATUS_NOT_SUPPORTED); 4212 } 4213 4214 if (changed) { 4215 if (val) 4216 hci_dev_set_flag(hdev, HCI_OFFLOAD_CODECS_ENABLED); 4217 else 4218 hci_dev_clear_flag(hdev, HCI_OFFLOAD_CODECS_ENABLED); 4219 } 4220 4221 bt_dev_info(hdev, "offload codecs enable %d changed %d", 4222 val, changed); 4223 4224 memcpy(rp.uuid, offload_codecs_uuid, 16); 4225 rp.flags = cpu_to_le32(val ? BIT(0) : 0); 4226 hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS); 4227 err = mgmt_cmd_complete(sk, hdev->id, 4228 MGMT_OP_SET_EXP_FEATURE, 0, 4229 &rp, sizeof(rp)); 4230 4231 if (changed) 4232 exp_offload_codec_feature_changed(val, sk); 4233 4234 return err; 4235 } 4236 4237 static const struct mgmt_exp_feature { 4238 const u8 *uuid; 4239 int (*set_func)(struct sock *sk, struct hci_dev *hdev, 4240 struct mgmt_cp_set_exp_feature *cp, u16 data_len); 4241 } exp_features[] = { 4242 EXP_FEAT(ZERO_KEY, set_zero_key_func), 4243 #ifdef CONFIG_BT_FEATURE_DEBUG 4244 EXP_FEAT(debug_uuid, set_debug_func), 4245 #endif 4246 EXP_FEAT(rpa_resolution_uuid, set_rpa_resolution_func), 4247 EXP_FEAT(quality_report_uuid, set_quality_report_func), 4248 EXP_FEAT(offload_codecs_uuid, set_offload_codec_func), 4249 4250 /* end with a null feature */ 4251 EXP_FEAT(NULL, NULL) 4252 }; 4253 4254 static int set_exp_feature(struct sock *sk, struct hci_dev *hdev, 4255 void *data, u16 data_len) 4256 { 4257 struct mgmt_cp_set_exp_feature *cp = data; 4258 size_t i = 0; 4259 4260 bt_dev_dbg(hdev, "sock %p", sk); 4261 4262 for (i = 0; exp_features[i].uuid; i++) { 4263 if (!memcmp(cp->uuid, exp_features[i].uuid, 16)) 4264 return exp_features[i].set_func(sk, hdev, cp, data_len); 4265 } 4266 4267 return mgmt_cmd_status(sk, hdev ? hdev->id : MGMT_INDEX_NONE, 4268 MGMT_OP_SET_EXP_FEATURE, 4269 MGMT_STATUS_NOT_SUPPORTED); 4270 } 4271 4272 #define SUPPORTED_DEVICE_FLAGS() ((1U << HCI_CONN_FLAG_MAX) - 1) 4273 4274 static int get_device_flags(struct sock *sk, struct hci_dev *hdev, void *data, 4275 u16 data_len) 4276 { 4277 struct mgmt_cp_get_device_flags *cp = data; 4278 struct mgmt_rp_get_device_flags rp; 4279 struct bdaddr_list_with_flags *br_params; 4280 struct hci_conn_params *params; 4281 u32 supported_flags = SUPPORTED_DEVICE_FLAGS(); 4282 u32 current_flags = 0; 4283 u8 status = MGMT_STATUS_INVALID_PARAMS; 4284 4285 bt_dev_dbg(hdev, "Get device flags %pMR (type 0x%x)\n", 4286 &cp->addr.bdaddr, cp->addr.type); 4287 4288 hci_dev_lock(hdev); 4289 4290 memset(&rp, 0, sizeof(rp)); 4291 4292 if (cp->addr.type == BDADDR_BREDR) { 4293 br_params = hci_bdaddr_list_lookup_with_flags(&hdev->accept_list, 4294 &cp->addr.bdaddr, 4295 cp->addr.type); 4296 if (!br_params) 4297 goto done; 4298 4299 current_flags = br_params->current_flags; 4300 } else { 4301 params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr, 4302 le_addr_type(cp->addr.type)); 4303 4304 if (!params) 4305 goto done; 4306 4307 current_flags = params->current_flags; 4308 } 4309 4310 bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr); 4311 rp.addr.type = cp->addr.type; 4312 rp.supported_flags = cpu_to_le32(supported_flags); 4313 rp.current_flags = cpu_to_le32(current_flags); 4314 4315 status = MGMT_STATUS_SUCCESS; 4316 4317 done: 4318 hci_dev_unlock(hdev); 4319 4320 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_DEVICE_FLAGS, status, 4321 &rp, sizeof(rp)); 4322 } 4323 4324 static void device_flags_changed(struct sock *sk, struct hci_dev *hdev, 4325 bdaddr_t *bdaddr, u8 bdaddr_type, 4326 u32 supported_flags, u32 current_flags) 4327 { 4328 struct mgmt_ev_device_flags_changed ev; 4329 4330 bacpy(&ev.addr.bdaddr, bdaddr); 4331 ev.addr.type = bdaddr_type; 4332 ev.supported_flags = cpu_to_le32(supported_flags); 4333 ev.current_flags = cpu_to_le32(current_flags); 4334 4335 mgmt_event(MGMT_EV_DEVICE_FLAGS_CHANGED, hdev, &ev, sizeof(ev), sk); 4336 } 4337 4338 static int set_device_flags(struct sock *sk, struct hci_dev *hdev, void *data, 4339 u16 len) 4340 { 4341 struct mgmt_cp_set_device_flags *cp = data; 4342 struct bdaddr_list_with_flags *br_params; 4343 struct hci_conn_params *params; 4344 u8 status = MGMT_STATUS_INVALID_PARAMS; 4345 u32 supported_flags = SUPPORTED_DEVICE_FLAGS(); 4346 u32 current_flags = __le32_to_cpu(cp->current_flags); 4347 4348 bt_dev_dbg(hdev, "Set device flags %pMR (type 0x%x) = 0x%x", 4349 &cp->addr.bdaddr, cp->addr.type, 4350 __le32_to_cpu(current_flags)); 4351 4352 if ((supported_flags | current_flags) != supported_flags) { 4353 bt_dev_warn(hdev, "Bad flag given (0x%x) vs supported (0x%0x)", 4354 current_flags, supported_flags); 4355 goto done; 4356 } 4357 4358 hci_dev_lock(hdev); 4359 4360 if (cp->addr.type == BDADDR_BREDR) { 4361 br_params = hci_bdaddr_list_lookup_with_flags(&hdev->accept_list, 4362 &cp->addr.bdaddr, 4363 cp->addr.type); 4364 4365 if (br_params) { 4366 br_params->current_flags = current_flags; 4367 status = MGMT_STATUS_SUCCESS; 4368 } else { 4369 bt_dev_warn(hdev, "No such BR/EDR device %pMR (0x%x)", 4370 &cp->addr.bdaddr, cp->addr.type); 4371 } 4372 } else { 4373 params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr, 4374 le_addr_type(cp->addr.type)); 4375 if (params) { 4376 params->current_flags = current_flags; 4377 status = MGMT_STATUS_SUCCESS; 4378 } else { 4379 bt_dev_warn(hdev, "No such LE device %pMR (0x%x)", 4380 &cp->addr.bdaddr, 4381 le_addr_type(cp->addr.type)); 4382 } 4383 } 4384 4385 done: 4386 hci_dev_unlock(hdev); 4387 4388 if (status == MGMT_STATUS_SUCCESS) 4389 device_flags_changed(sk, hdev, &cp->addr.bdaddr, cp->addr.type, 4390 supported_flags, current_flags); 4391 4392 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_DEVICE_FLAGS, status, 4393 &cp->addr, sizeof(cp->addr)); 4394 } 4395 4396 static void mgmt_adv_monitor_added(struct sock *sk, struct hci_dev *hdev, 4397 u16 handle) 4398 { 4399 struct mgmt_ev_adv_monitor_added ev; 4400 4401 ev.monitor_handle = cpu_to_le16(handle); 4402 4403 mgmt_event(MGMT_EV_ADV_MONITOR_ADDED, hdev, &ev, sizeof(ev), sk); 4404 } 4405 4406 void mgmt_adv_monitor_removed(struct hci_dev *hdev, u16 handle) 4407 { 4408 struct mgmt_ev_adv_monitor_removed ev; 4409 struct mgmt_pending_cmd *cmd; 4410 struct sock *sk_skip = NULL; 4411 struct mgmt_cp_remove_adv_monitor *cp; 4412 4413 cmd = pending_find(MGMT_OP_REMOVE_ADV_MONITOR, hdev); 4414 if (cmd) { 4415 cp = cmd->param; 4416 4417 if (cp->monitor_handle) 4418 sk_skip = cmd->sk; 4419 } 4420 4421 ev.monitor_handle = cpu_to_le16(handle); 4422 4423 mgmt_event(MGMT_EV_ADV_MONITOR_REMOVED, hdev, &ev, sizeof(ev), sk_skip); 4424 } 4425 4426 static int read_adv_mon_features(struct sock *sk, struct hci_dev *hdev, 4427 void *data, u16 len) 4428 { 4429 struct adv_monitor *monitor = NULL; 4430 struct mgmt_rp_read_adv_monitor_features *rp = NULL; 4431 int handle, err; 4432 size_t rp_size = 0; 4433 __u32 supported = 0; 4434 __u32 enabled = 0; 4435 __u16 num_handles = 0; 4436 __u16 handles[HCI_MAX_ADV_MONITOR_NUM_HANDLES]; 4437 4438 BT_DBG("request for %s", hdev->name); 4439 4440 hci_dev_lock(hdev); 4441 4442 if (msft_monitor_supported(hdev)) 4443 supported |= MGMT_ADV_MONITOR_FEATURE_MASK_OR_PATTERNS; 4444 4445 idr_for_each_entry(&hdev->adv_monitors_idr, monitor, handle) 4446 handles[num_handles++] = monitor->handle; 4447 4448 hci_dev_unlock(hdev); 4449 4450 rp_size = sizeof(*rp) + (num_handles * sizeof(u16)); 4451 rp = kmalloc(rp_size, GFP_KERNEL); 4452 if (!rp) 4453 return -ENOMEM; 4454 4455 /* All supported features are currently enabled */ 4456 enabled = supported; 4457 4458 rp->supported_features = cpu_to_le32(supported); 4459 rp->enabled_features = cpu_to_le32(enabled); 4460 rp->max_num_handles = cpu_to_le16(HCI_MAX_ADV_MONITOR_NUM_HANDLES); 4461 rp->max_num_patterns = HCI_MAX_ADV_MONITOR_NUM_PATTERNS; 4462 rp->num_handles = cpu_to_le16(num_handles); 4463 if (num_handles) 4464 memcpy(&rp->handles, &handles, (num_handles * sizeof(u16))); 4465 4466 err = mgmt_cmd_complete(sk, hdev->id, 4467 MGMT_OP_READ_ADV_MONITOR_FEATURES, 4468 MGMT_STATUS_SUCCESS, rp, rp_size); 4469 4470 kfree(rp); 4471 4472 return err; 4473 } 4474 4475 int mgmt_add_adv_patterns_monitor_complete(struct hci_dev *hdev, u8 status) 4476 { 4477 struct mgmt_rp_add_adv_patterns_monitor rp; 4478 struct mgmt_pending_cmd *cmd; 4479 struct adv_monitor *monitor; 4480 int err = 0; 4481 4482 hci_dev_lock(hdev); 4483 4484 cmd = pending_find(MGMT_OP_ADD_ADV_PATTERNS_MONITOR_RSSI, hdev); 4485 if (!cmd) { 4486 cmd = pending_find(MGMT_OP_ADD_ADV_PATTERNS_MONITOR, hdev); 4487 if (!cmd) 4488 goto done; 4489 } 4490 4491 monitor = cmd->user_data; 4492 rp.monitor_handle = cpu_to_le16(monitor->handle); 4493 4494 if (!status) { 4495 mgmt_adv_monitor_added(cmd->sk, hdev, monitor->handle); 4496 hdev->adv_monitors_cnt++; 4497 if (monitor->state == ADV_MONITOR_STATE_NOT_REGISTERED) 4498 monitor->state = ADV_MONITOR_STATE_REGISTERED; 4499 hci_update_background_scan(hdev); 4500 } 4501 4502 err = mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, 4503 mgmt_status(status), &rp, sizeof(rp)); 4504 mgmt_pending_remove(cmd); 4505 4506 done: 4507 hci_dev_unlock(hdev); 4508 bt_dev_dbg(hdev, "add monitor %d complete, status %u", 4509 rp.monitor_handle, status); 4510 4511 return err; 4512 } 4513 4514 static int __add_adv_patterns_monitor(struct sock *sk, struct hci_dev *hdev, 4515 struct adv_monitor *m, u8 status, 4516 void *data, u16 len, u16 op) 4517 { 4518 struct mgmt_rp_add_adv_patterns_monitor rp; 4519 struct mgmt_pending_cmd *cmd; 4520 int err; 4521 bool pending; 4522 4523 hci_dev_lock(hdev); 4524 4525 if (status) 4526 goto unlock; 4527 4528 if (pending_find(MGMT_OP_SET_LE, hdev) || 4529 pending_find(MGMT_OP_ADD_ADV_PATTERNS_MONITOR, hdev) || 4530 pending_find(MGMT_OP_ADD_ADV_PATTERNS_MONITOR_RSSI, hdev) || 4531 pending_find(MGMT_OP_REMOVE_ADV_MONITOR, hdev)) { 4532 status = MGMT_STATUS_BUSY; 4533 goto unlock; 4534 } 4535 4536 cmd = mgmt_pending_add(sk, op, hdev, data, len); 4537 if (!cmd) { 4538 status = MGMT_STATUS_NO_RESOURCES; 4539 goto unlock; 4540 } 4541 4542 cmd->user_data = m; 4543 pending = hci_add_adv_monitor(hdev, m, &err); 4544 if (err) { 4545 if (err == -ENOSPC || err == -ENOMEM) 4546 status = MGMT_STATUS_NO_RESOURCES; 4547 else if (err == -EINVAL) 4548 status = MGMT_STATUS_INVALID_PARAMS; 4549 else 4550 status = MGMT_STATUS_FAILED; 4551 4552 mgmt_pending_remove(cmd); 4553 goto unlock; 4554 } 4555 4556 if (!pending) { 4557 mgmt_pending_remove(cmd); 4558 rp.monitor_handle = cpu_to_le16(m->handle); 4559 mgmt_adv_monitor_added(sk, hdev, m->handle); 4560 m->state = ADV_MONITOR_STATE_REGISTERED; 4561 hdev->adv_monitors_cnt++; 4562 4563 hci_dev_unlock(hdev); 4564 return mgmt_cmd_complete(sk, hdev->id, op, MGMT_STATUS_SUCCESS, 4565 &rp, sizeof(rp)); 4566 } 4567 4568 hci_dev_unlock(hdev); 4569 4570 return 0; 4571 4572 unlock: 4573 hci_free_adv_monitor(hdev, m); 4574 hci_dev_unlock(hdev); 4575 return mgmt_cmd_status(sk, hdev->id, op, status); 4576 } 4577 4578 static void parse_adv_monitor_rssi(struct adv_monitor *m, 4579 struct mgmt_adv_rssi_thresholds *rssi) 4580 { 4581 if (rssi) { 4582 m->rssi.low_threshold = rssi->low_threshold; 4583 m->rssi.low_threshold_timeout = 4584 __le16_to_cpu(rssi->low_threshold_timeout); 4585 m->rssi.high_threshold = rssi->high_threshold; 4586 m->rssi.high_threshold_timeout = 4587 __le16_to_cpu(rssi->high_threshold_timeout); 4588 m->rssi.sampling_period = rssi->sampling_period; 4589 } else { 4590 /* Default values. These numbers are the least constricting 4591 * parameters for MSFT API to work, so it behaves as if there 4592 * are no rssi parameter to consider. May need to be changed 4593 * if other API are to be supported. 4594 */ 4595 m->rssi.low_threshold = -127; 4596 m->rssi.low_threshold_timeout = 60; 4597 m->rssi.high_threshold = -127; 4598 m->rssi.high_threshold_timeout = 0; 4599 m->rssi.sampling_period = 0; 4600 } 4601 } 4602 4603 static u8 parse_adv_monitor_pattern(struct adv_monitor *m, u8 pattern_count, 4604 struct mgmt_adv_pattern *patterns) 4605 { 4606 u8 offset = 0, length = 0; 4607 struct adv_pattern *p = NULL; 4608 int i; 4609 4610 for (i = 0; i < pattern_count; i++) { 4611 offset = patterns[i].offset; 4612 length = patterns[i].length; 4613 if (offset >= HCI_MAX_AD_LENGTH || 4614 length > HCI_MAX_AD_LENGTH || 4615 (offset + length) > HCI_MAX_AD_LENGTH) 4616 return MGMT_STATUS_INVALID_PARAMS; 4617 4618 p = kmalloc(sizeof(*p), GFP_KERNEL); 4619 if (!p) 4620 return MGMT_STATUS_NO_RESOURCES; 4621 4622 p->ad_type = patterns[i].ad_type; 4623 p->offset = patterns[i].offset; 4624 p->length = patterns[i].length; 4625 memcpy(p->value, patterns[i].value, p->length); 4626 4627 INIT_LIST_HEAD(&p->list); 4628 list_add(&p->list, &m->patterns); 4629 } 4630 4631 return MGMT_STATUS_SUCCESS; 4632 } 4633 4634 static int add_adv_patterns_monitor(struct sock *sk, struct hci_dev *hdev, 4635 void *data, u16 len) 4636 { 4637 struct mgmt_cp_add_adv_patterns_monitor *cp = data; 4638 struct adv_monitor *m = NULL; 4639 u8 status = MGMT_STATUS_SUCCESS; 4640 size_t expected_size = sizeof(*cp); 4641 4642 BT_DBG("request for %s", hdev->name); 4643 4644 if (len <= sizeof(*cp)) { 4645 status = MGMT_STATUS_INVALID_PARAMS; 4646 goto done; 4647 } 4648 4649 expected_size += cp->pattern_count * sizeof(struct mgmt_adv_pattern); 4650 if (len != expected_size) { 4651 status = MGMT_STATUS_INVALID_PARAMS; 4652 goto done; 4653 } 4654 4655 m = kzalloc(sizeof(*m), GFP_KERNEL); 4656 if (!m) { 4657 status = MGMT_STATUS_NO_RESOURCES; 4658 goto done; 4659 } 4660 4661 INIT_LIST_HEAD(&m->patterns); 4662 4663 parse_adv_monitor_rssi(m, NULL); 4664 status = parse_adv_monitor_pattern(m, cp->pattern_count, cp->patterns); 4665 4666 done: 4667 return __add_adv_patterns_monitor(sk, hdev, m, status, data, len, 4668 MGMT_OP_ADD_ADV_PATTERNS_MONITOR); 4669 } 4670 4671 static int add_adv_patterns_monitor_rssi(struct sock *sk, struct hci_dev *hdev, 4672 void *data, u16 len) 4673 { 4674 struct mgmt_cp_add_adv_patterns_monitor_rssi *cp = data; 4675 struct adv_monitor *m = NULL; 4676 u8 status = MGMT_STATUS_SUCCESS; 4677 size_t expected_size = sizeof(*cp); 4678 4679 BT_DBG("request for %s", hdev->name); 4680 4681 if (len <= sizeof(*cp)) { 4682 status = MGMT_STATUS_INVALID_PARAMS; 4683 goto done; 4684 } 4685 4686 expected_size += cp->pattern_count * sizeof(struct mgmt_adv_pattern); 4687 if (len != expected_size) { 4688 status = MGMT_STATUS_INVALID_PARAMS; 4689 goto done; 4690 } 4691 4692 m = kzalloc(sizeof(*m), GFP_KERNEL); 4693 if (!m) { 4694 status = MGMT_STATUS_NO_RESOURCES; 4695 goto done; 4696 } 4697 4698 INIT_LIST_HEAD(&m->patterns); 4699 4700 parse_adv_monitor_rssi(m, &cp->rssi); 4701 status = parse_adv_monitor_pattern(m, cp->pattern_count, cp->patterns); 4702 4703 done: 4704 return __add_adv_patterns_monitor(sk, hdev, m, status, data, len, 4705 MGMT_OP_ADD_ADV_PATTERNS_MONITOR_RSSI); 4706 } 4707 4708 int mgmt_remove_adv_monitor_complete(struct hci_dev *hdev, u8 status) 4709 { 4710 struct mgmt_rp_remove_adv_monitor rp; 4711 struct mgmt_cp_remove_adv_monitor *cp; 4712 struct mgmt_pending_cmd *cmd; 4713 int err = 0; 4714 4715 hci_dev_lock(hdev); 4716 4717 cmd = pending_find(MGMT_OP_REMOVE_ADV_MONITOR, hdev); 4718 if (!cmd) 4719 goto done; 4720 4721 cp = cmd->param; 4722 rp.monitor_handle = cp->monitor_handle; 4723 4724 if (!status) 4725 hci_update_background_scan(hdev); 4726 4727 err = mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, 4728 mgmt_status(status), &rp, sizeof(rp)); 4729 mgmt_pending_remove(cmd); 4730 4731 done: 4732 hci_dev_unlock(hdev); 4733 bt_dev_dbg(hdev, "remove monitor %d complete, status %u", 4734 rp.monitor_handle, status); 4735 4736 return err; 4737 } 4738 4739 static int remove_adv_monitor(struct sock *sk, struct hci_dev *hdev, 4740 void *data, u16 len) 4741 { 4742 struct mgmt_cp_remove_adv_monitor *cp = data; 4743 struct mgmt_rp_remove_adv_monitor rp; 4744 struct mgmt_pending_cmd *cmd; 4745 u16 handle = __le16_to_cpu(cp->monitor_handle); 4746 int err, status; 4747 bool pending; 4748 4749 BT_DBG("request for %s", hdev->name); 4750 rp.monitor_handle = cp->monitor_handle; 4751 4752 hci_dev_lock(hdev); 4753 4754 if (pending_find(MGMT_OP_SET_LE, hdev) || 4755 pending_find(MGMT_OP_REMOVE_ADV_MONITOR, hdev) || 4756 pending_find(MGMT_OP_ADD_ADV_PATTERNS_MONITOR, hdev) || 4757 pending_find(MGMT_OP_ADD_ADV_PATTERNS_MONITOR_RSSI, hdev)) { 4758 status = MGMT_STATUS_BUSY; 4759 goto unlock; 4760 } 4761 4762 cmd = mgmt_pending_add(sk, MGMT_OP_REMOVE_ADV_MONITOR, hdev, data, len); 4763 if (!cmd) { 4764 status = MGMT_STATUS_NO_RESOURCES; 4765 goto unlock; 4766 } 4767 4768 if (handle) 4769 pending = hci_remove_single_adv_monitor(hdev, handle, &err); 4770 else 4771 pending = hci_remove_all_adv_monitor(hdev, &err); 4772 4773 if (err) { 4774 mgmt_pending_remove(cmd); 4775 4776 if (err == -ENOENT) 4777 status = MGMT_STATUS_INVALID_INDEX; 4778 else 4779 status = MGMT_STATUS_FAILED; 4780 4781 goto unlock; 4782 } 4783 4784 /* monitor can be removed without forwarding request to controller */ 4785 if (!pending) { 4786 mgmt_pending_remove(cmd); 4787 hci_dev_unlock(hdev); 4788 4789 return mgmt_cmd_complete(sk, hdev->id, 4790 MGMT_OP_REMOVE_ADV_MONITOR, 4791 MGMT_STATUS_SUCCESS, 4792 &rp, sizeof(rp)); 4793 } 4794 4795 hci_dev_unlock(hdev); 4796 return 0; 4797 4798 unlock: 4799 hci_dev_unlock(hdev); 4800 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_ADV_MONITOR, 4801 status); 4802 } 4803 4804 static void read_local_oob_data_complete(struct hci_dev *hdev, u8 status, 4805 u16 opcode, struct sk_buff *skb) 4806 { 4807 struct mgmt_rp_read_local_oob_data mgmt_rp; 4808 size_t rp_size = sizeof(mgmt_rp); 4809 struct mgmt_pending_cmd *cmd; 4810 4811 bt_dev_dbg(hdev, "status %u", status); 4812 4813 cmd = pending_find(MGMT_OP_READ_LOCAL_OOB_DATA, hdev); 4814 if (!cmd) 4815 return; 4816 4817 if (status || !skb) { 4818 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA, 4819 status ? mgmt_status(status) : MGMT_STATUS_FAILED); 4820 goto remove; 4821 } 4822 4823 memset(&mgmt_rp, 0, sizeof(mgmt_rp)); 4824 4825 if (opcode == HCI_OP_READ_LOCAL_OOB_DATA) { 4826 struct hci_rp_read_local_oob_data *rp = (void *) skb->data; 4827 4828 if (skb->len < sizeof(*rp)) { 4829 mgmt_cmd_status(cmd->sk, hdev->id, 4830 MGMT_OP_READ_LOCAL_OOB_DATA, 4831 MGMT_STATUS_FAILED); 4832 goto remove; 4833 } 4834 4835 memcpy(mgmt_rp.hash192, rp->hash, sizeof(rp->hash)); 4836 memcpy(mgmt_rp.rand192, rp->rand, sizeof(rp->rand)); 4837 4838 rp_size -= sizeof(mgmt_rp.hash256) + sizeof(mgmt_rp.rand256); 4839 } else { 4840 struct hci_rp_read_local_oob_ext_data *rp = (void *) skb->data; 4841 4842 if (skb->len < sizeof(*rp)) { 4843 mgmt_cmd_status(cmd->sk, hdev->id, 4844 MGMT_OP_READ_LOCAL_OOB_DATA, 4845 MGMT_STATUS_FAILED); 4846 goto remove; 4847 } 4848 4849 memcpy(mgmt_rp.hash192, rp->hash192, sizeof(rp->hash192)); 4850 memcpy(mgmt_rp.rand192, rp->rand192, sizeof(rp->rand192)); 4851 4852 memcpy(mgmt_rp.hash256, rp->hash256, sizeof(rp->hash256)); 4853 memcpy(mgmt_rp.rand256, rp->rand256, sizeof(rp->rand256)); 4854 } 4855 4856 mgmt_cmd_complete(cmd->sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA, 4857 MGMT_STATUS_SUCCESS, &mgmt_rp, rp_size); 4858 4859 remove: 4860 mgmt_pending_remove(cmd); 4861 } 4862 4863 static int read_local_oob_data(struct sock *sk, struct hci_dev *hdev, 4864 void *data, u16 data_len) 4865 { 4866 struct mgmt_pending_cmd *cmd; 4867 struct hci_request req; 4868 int err; 4869 4870 bt_dev_dbg(hdev, "sock %p", sk); 4871 4872 hci_dev_lock(hdev); 4873 4874 if (!hdev_is_powered(hdev)) { 4875 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA, 4876 MGMT_STATUS_NOT_POWERED); 4877 goto unlock; 4878 } 4879 4880 if (!lmp_ssp_capable(hdev)) { 4881 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA, 4882 MGMT_STATUS_NOT_SUPPORTED); 4883 goto unlock; 4884 } 4885 4886 if (pending_find(MGMT_OP_READ_LOCAL_OOB_DATA, hdev)) { 4887 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA, 4888 MGMT_STATUS_BUSY); 4889 goto unlock; 4890 } 4891 4892 cmd = mgmt_pending_add(sk, MGMT_OP_READ_LOCAL_OOB_DATA, hdev, NULL, 0); 4893 if (!cmd) { 4894 err = -ENOMEM; 4895 goto unlock; 4896 } 4897 4898 hci_req_init(&req, hdev); 4899 4900 if (bredr_sc_enabled(hdev)) 4901 hci_req_add(&req, HCI_OP_READ_LOCAL_OOB_EXT_DATA, 0, NULL); 4902 else 4903 hci_req_add(&req, HCI_OP_READ_LOCAL_OOB_DATA, 0, NULL); 4904 4905 err = hci_req_run_skb(&req, read_local_oob_data_complete); 4906 if (err < 0) 4907 mgmt_pending_remove(cmd); 4908 4909 unlock: 4910 hci_dev_unlock(hdev); 4911 return err; 4912 } 4913 4914 static int add_remote_oob_data(struct sock *sk, struct hci_dev *hdev, 4915 void *data, u16 len) 4916 { 4917 struct mgmt_addr_info *addr = data; 4918 int err; 4919 4920 bt_dev_dbg(hdev, "sock %p", sk); 4921 4922 if (!bdaddr_type_is_valid(addr->type)) 4923 return mgmt_cmd_complete(sk, hdev->id, 4924 MGMT_OP_ADD_REMOTE_OOB_DATA, 4925 MGMT_STATUS_INVALID_PARAMS, 4926 addr, sizeof(*addr)); 4927 4928 hci_dev_lock(hdev); 4929 4930 if (len == MGMT_ADD_REMOTE_OOB_DATA_SIZE) { 4931 struct mgmt_cp_add_remote_oob_data *cp = data; 4932 u8 status; 4933 4934 if (cp->addr.type != BDADDR_BREDR) { 4935 err = mgmt_cmd_complete(sk, hdev->id, 4936 MGMT_OP_ADD_REMOTE_OOB_DATA, 4937 MGMT_STATUS_INVALID_PARAMS, 4938 &cp->addr, sizeof(cp->addr)); 4939 goto unlock; 4940 } 4941 4942 err = hci_add_remote_oob_data(hdev, &cp->addr.bdaddr, 4943 cp->addr.type, cp->hash, 4944 cp->rand, NULL, NULL); 4945 if (err < 0) 4946 status = MGMT_STATUS_FAILED; 4947 else 4948 status = MGMT_STATUS_SUCCESS; 4949 4950 err = mgmt_cmd_complete(sk, hdev->id, 4951 MGMT_OP_ADD_REMOTE_OOB_DATA, status, 4952 &cp->addr, sizeof(cp->addr)); 4953 } else if (len == MGMT_ADD_REMOTE_OOB_EXT_DATA_SIZE) { 4954 struct mgmt_cp_add_remote_oob_ext_data *cp = data; 4955 u8 *rand192, *hash192, *rand256, *hash256; 4956 u8 status; 4957 4958 if (bdaddr_type_is_le(cp->addr.type)) { 4959 /* Enforce zero-valued 192-bit parameters as 4960 * long as legacy SMP OOB isn't implemented. 4961 */ 4962 if (memcmp(cp->rand192, ZERO_KEY, 16) || 4963 memcmp(cp->hash192, ZERO_KEY, 16)) { 4964 err = mgmt_cmd_complete(sk, hdev->id, 4965 MGMT_OP_ADD_REMOTE_OOB_DATA, 4966 MGMT_STATUS_INVALID_PARAMS, 4967 addr, sizeof(*addr)); 4968 goto unlock; 4969 } 4970 4971 rand192 = NULL; 4972 hash192 = NULL; 4973 } else { 4974 /* In case one of the P-192 values is set to zero, 4975 * then just disable OOB data for P-192. 4976 */ 4977 if (!memcmp(cp->rand192, ZERO_KEY, 16) || 4978 !memcmp(cp->hash192, ZERO_KEY, 16)) { 4979 rand192 = NULL; 4980 hash192 = NULL; 4981 } else { 4982 rand192 = cp->rand192; 4983 hash192 = cp->hash192; 4984 } 4985 } 4986 4987 /* In case one of the P-256 values is set to zero, then just 4988 * disable OOB data for P-256. 4989 */ 4990 if (!memcmp(cp->rand256, ZERO_KEY, 16) || 4991 !memcmp(cp->hash256, ZERO_KEY, 16)) { 4992 rand256 = NULL; 4993 hash256 = NULL; 4994 } else { 4995 rand256 = cp->rand256; 4996 hash256 = cp->hash256; 4997 } 4998 4999 err = hci_add_remote_oob_data(hdev, &cp->addr.bdaddr, 5000 cp->addr.type, hash192, rand192, 5001 hash256, rand256); 5002 if (err < 0) 5003 status = MGMT_STATUS_FAILED; 5004 else 5005 status = MGMT_STATUS_SUCCESS; 5006 5007 err = mgmt_cmd_complete(sk, hdev->id, 5008 MGMT_OP_ADD_REMOTE_OOB_DATA, 5009 status, &cp->addr, sizeof(cp->addr)); 5010 } else { 5011 bt_dev_err(hdev, "add_remote_oob_data: invalid len of %u bytes", 5012 len); 5013 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_REMOTE_OOB_DATA, 5014 MGMT_STATUS_INVALID_PARAMS); 5015 } 5016 5017 unlock: 5018 hci_dev_unlock(hdev); 5019 return err; 5020 } 5021 5022 static int remove_remote_oob_data(struct sock *sk, struct hci_dev *hdev, 5023 void *data, u16 len) 5024 { 5025 struct mgmt_cp_remove_remote_oob_data *cp = data; 5026 u8 status; 5027 int err; 5028 5029 bt_dev_dbg(hdev, "sock %p", sk); 5030 5031 if (cp->addr.type != BDADDR_BREDR) 5032 return mgmt_cmd_complete(sk, hdev->id, 5033 MGMT_OP_REMOVE_REMOTE_OOB_DATA, 5034 MGMT_STATUS_INVALID_PARAMS, 5035 &cp->addr, sizeof(cp->addr)); 5036 5037 hci_dev_lock(hdev); 5038 5039 if (!bacmp(&cp->addr.bdaddr, BDADDR_ANY)) { 5040 hci_remote_oob_data_clear(hdev); 5041 status = MGMT_STATUS_SUCCESS; 5042 goto done; 5043 } 5044 5045 err = hci_remove_remote_oob_data(hdev, &cp->addr.bdaddr, cp->addr.type); 5046 if (err < 0) 5047 status = MGMT_STATUS_INVALID_PARAMS; 5048 else 5049 status = MGMT_STATUS_SUCCESS; 5050 5051 done: 5052 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_REMOTE_OOB_DATA, 5053 status, &cp->addr, sizeof(cp->addr)); 5054 5055 hci_dev_unlock(hdev); 5056 return err; 5057 } 5058 5059 void mgmt_start_discovery_complete(struct hci_dev *hdev, u8 status) 5060 { 5061 struct mgmt_pending_cmd *cmd; 5062 5063 bt_dev_dbg(hdev, "status %u", status); 5064 5065 hci_dev_lock(hdev); 5066 5067 cmd = pending_find(MGMT_OP_START_DISCOVERY, hdev); 5068 if (!cmd) 5069 cmd = pending_find(MGMT_OP_START_SERVICE_DISCOVERY, hdev); 5070 5071 if (!cmd) 5072 cmd = pending_find(MGMT_OP_START_LIMITED_DISCOVERY, hdev); 5073 5074 if (cmd) { 5075 cmd->cmd_complete(cmd, mgmt_status(status)); 5076 mgmt_pending_remove(cmd); 5077 } 5078 5079 hci_dev_unlock(hdev); 5080 5081 /* Handle suspend notifier */ 5082 if (test_and_clear_bit(SUSPEND_UNPAUSE_DISCOVERY, 5083 hdev->suspend_tasks)) { 5084 bt_dev_dbg(hdev, "Unpaused discovery"); 5085 wake_up(&hdev->suspend_wait_q); 5086 } 5087 } 5088 5089 static bool discovery_type_is_valid(struct hci_dev *hdev, uint8_t type, 5090 uint8_t *mgmt_status) 5091 { 5092 switch (type) { 5093 case DISCOV_TYPE_LE: 5094 *mgmt_status = mgmt_le_support(hdev); 5095 if (*mgmt_status) 5096 return false; 5097 break; 5098 case DISCOV_TYPE_INTERLEAVED: 5099 *mgmt_status = mgmt_le_support(hdev); 5100 if (*mgmt_status) 5101 return false; 5102 fallthrough; 5103 case DISCOV_TYPE_BREDR: 5104 *mgmt_status = mgmt_bredr_support(hdev); 5105 if (*mgmt_status) 5106 return false; 5107 break; 5108 default: 5109 *mgmt_status = MGMT_STATUS_INVALID_PARAMS; 5110 return false; 5111 } 5112 5113 return true; 5114 } 5115 5116 static int start_discovery_internal(struct sock *sk, struct hci_dev *hdev, 5117 u16 op, void *data, u16 len) 5118 { 5119 struct mgmt_cp_start_discovery *cp = data; 5120 struct mgmt_pending_cmd *cmd; 5121 u8 status; 5122 int err; 5123 5124 bt_dev_dbg(hdev, "sock %p", sk); 5125 5126 hci_dev_lock(hdev); 5127 5128 if (!hdev_is_powered(hdev)) { 5129 err = mgmt_cmd_complete(sk, hdev->id, op, 5130 MGMT_STATUS_NOT_POWERED, 5131 &cp->type, sizeof(cp->type)); 5132 goto failed; 5133 } 5134 5135 if (hdev->discovery.state != DISCOVERY_STOPPED || 5136 hci_dev_test_flag(hdev, HCI_PERIODIC_INQ)) { 5137 err = mgmt_cmd_complete(sk, hdev->id, op, MGMT_STATUS_BUSY, 5138 &cp->type, sizeof(cp->type)); 5139 goto failed; 5140 } 5141 5142 if (!discovery_type_is_valid(hdev, cp->type, &status)) { 5143 err = mgmt_cmd_complete(sk, hdev->id, op, status, 5144 &cp->type, sizeof(cp->type)); 5145 goto failed; 5146 } 5147 5148 /* Can't start discovery when it is paused */ 5149 if (hdev->discovery_paused) { 5150 err = mgmt_cmd_complete(sk, hdev->id, op, MGMT_STATUS_BUSY, 5151 &cp->type, sizeof(cp->type)); 5152 goto failed; 5153 } 5154 5155 /* Clear the discovery filter first to free any previously 5156 * allocated memory for the UUID list. 5157 */ 5158 hci_discovery_filter_clear(hdev); 5159 5160 hdev->discovery.type = cp->type; 5161 hdev->discovery.report_invalid_rssi = false; 5162 if (op == MGMT_OP_START_LIMITED_DISCOVERY) 5163 hdev->discovery.limited = true; 5164 else 5165 hdev->discovery.limited = false; 5166 5167 cmd = mgmt_pending_add(sk, op, hdev, data, len); 5168 if (!cmd) { 5169 err = -ENOMEM; 5170 goto failed; 5171 } 5172 5173 cmd->cmd_complete = generic_cmd_complete; 5174 5175 hci_discovery_set_state(hdev, DISCOVERY_STARTING); 5176 queue_work(hdev->req_workqueue, &hdev->discov_update); 5177 err = 0; 5178 5179 failed: 5180 hci_dev_unlock(hdev); 5181 return err; 5182 } 5183 5184 static int start_discovery(struct sock *sk, struct hci_dev *hdev, 5185 void *data, u16 len) 5186 { 5187 return start_discovery_internal(sk, hdev, MGMT_OP_START_DISCOVERY, 5188 data, len); 5189 } 5190 5191 static int start_limited_discovery(struct sock *sk, struct hci_dev *hdev, 5192 void *data, u16 len) 5193 { 5194 return start_discovery_internal(sk, hdev, 5195 MGMT_OP_START_LIMITED_DISCOVERY, 5196 data, len); 5197 } 5198 5199 static int service_discovery_cmd_complete(struct mgmt_pending_cmd *cmd, 5200 u8 status) 5201 { 5202 return mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, status, 5203 cmd->param, 1); 5204 } 5205 5206 static int start_service_discovery(struct sock *sk, struct hci_dev *hdev, 5207 void *data, u16 len) 5208 { 5209 struct mgmt_cp_start_service_discovery *cp = data; 5210 struct mgmt_pending_cmd *cmd; 5211 const u16 max_uuid_count = ((U16_MAX - sizeof(*cp)) / 16); 5212 u16 uuid_count, expected_len; 5213 u8 status; 5214 int err; 5215 5216 bt_dev_dbg(hdev, "sock %p", sk); 5217 5218 hci_dev_lock(hdev); 5219 5220 if (!hdev_is_powered(hdev)) { 5221 err = mgmt_cmd_complete(sk, hdev->id, 5222 MGMT_OP_START_SERVICE_DISCOVERY, 5223 MGMT_STATUS_NOT_POWERED, 5224 &cp->type, sizeof(cp->type)); 5225 goto failed; 5226 } 5227 5228 if (hdev->discovery.state != DISCOVERY_STOPPED || 5229 hci_dev_test_flag(hdev, HCI_PERIODIC_INQ)) { 5230 err = mgmt_cmd_complete(sk, hdev->id, 5231 MGMT_OP_START_SERVICE_DISCOVERY, 5232 MGMT_STATUS_BUSY, &cp->type, 5233 sizeof(cp->type)); 5234 goto failed; 5235 } 5236 5237 if (hdev->discovery_paused) { 5238 err = mgmt_cmd_complete(sk, hdev->id, 5239 MGMT_OP_START_SERVICE_DISCOVERY, 5240 MGMT_STATUS_BUSY, &cp->type, 5241 sizeof(cp->type)); 5242 goto failed; 5243 } 5244 5245 uuid_count = __le16_to_cpu(cp->uuid_count); 5246 if (uuid_count > max_uuid_count) { 5247 bt_dev_err(hdev, "service_discovery: too big uuid_count value %u", 5248 uuid_count); 5249 err = mgmt_cmd_complete(sk, hdev->id, 5250 MGMT_OP_START_SERVICE_DISCOVERY, 5251 MGMT_STATUS_INVALID_PARAMS, &cp->type, 5252 sizeof(cp->type)); 5253 goto failed; 5254 } 5255 5256 expected_len = sizeof(*cp) + uuid_count * 16; 5257 if (expected_len != len) { 5258 bt_dev_err(hdev, "service_discovery: expected %u bytes, got %u bytes", 5259 expected_len, len); 5260 err = mgmt_cmd_complete(sk, hdev->id, 5261 MGMT_OP_START_SERVICE_DISCOVERY, 5262 MGMT_STATUS_INVALID_PARAMS, &cp->type, 5263 sizeof(cp->type)); 5264 goto failed; 5265 } 5266 5267 if (!discovery_type_is_valid(hdev, cp->type, &status)) { 5268 err = mgmt_cmd_complete(sk, hdev->id, 5269 MGMT_OP_START_SERVICE_DISCOVERY, 5270 status, &cp->type, sizeof(cp->type)); 5271 goto failed; 5272 } 5273 5274 cmd = mgmt_pending_add(sk, MGMT_OP_START_SERVICE_DISCOVERY, 5275 hdev, data, len); 5276 if (!cmd) { 5277 err = -ENOMEM; 5278 goto failed; 5279 } 5280 5281 cmd->cmd_complete = service_discovery_cmd_complete; 5282 5283 /* Clear the discovery filter first to free any previously 5284 * allocated memory for the UUID list. 5285 */ 5286 hci_discovery_filter_clear(hdev); 5287 5288 hdev->discovery.result_filtering = true; 5289 hdev->discovery.type = cp->type; 5290 hdev->discovery.rssi = cp->rssi; 5291 hdev->discovery.uuid_count = uuid_count; 5292 5293 if (uuid_count > 0) { 5294 hdev->discovery.uuids = kmemdup(cp->uuids, uuid_count * 16, 5295 GFP_KERNEL); 5296 if (!hdev->discovery.uuids) { 5297 err = mgmt_cmd_complete(sk, hdev->id, 5298 MGMT_OP_START_SERVICE_DISCOVERY, 5299 MGMT_STATUS_FAILED, 5300 &cp->type, sizeof(cp->type)); 5301 mgmt_pending_remove(cmd); 5302 goto failed; 5303 } 5304 } 5305 5306 hci_discovery_set_state(hdev, DISCOVERY_STARTING); 5307 queue_work(hdev->req_workqueue, &hdev->discov_update); 5308 err = 0; 5309 5310 failed: 5311 hci_dev_unlock(hdev); 5312 return err; 5313 } 5314 5315 void mgmt_stop_discovery_complete(struct hci_dev *hdev, u8 status) 5316 { 5317 struct mgmt_pending_cmd *cmd; 5318 5319 bt_dev_dbg(hdev, "status %u", status); 5320 5321 hci_dev_lock(hdev); 5322 5323 cmd = pending_find(MGMT_OP_STOP_DISCOVERY, hdev); 5324 if (cmd) { 5325 cmd->cmd_complete(cmd, mgmt_status(status)); 5326 mgmt_pending_remove(cmd); 5327 } 5328 5329 hci_dev_unlock(hdev); 5330 5331 /* Handle suspend notifier */ 5332 if (test_and_clear_bit(SUSPEND_PAUSE_DISCOVERY, hdev->suspend_tasks)) { 5333 bt_dev_dbg(hdev, "Paused discovery"); 5334 wake_up(&hdev->suspend_wait_q); 5335 } 5336 } 5337 5338 static int stop_discovery(struct sock *sk, struct hci_dev *hdev, void *data, 5339 u16 len) 5340 { 5341 struct mgmt_cp_stop_discovery *mgmt_cp = data; 5342 struct mgmt_pending_cmd *cmd; 5343 int err; 5344 5345 bt_dev_dbg(hdev, "sock %p", sk); 5346 5347 hci_dev_lock(hdev); 5348 5349 if (!hci_discovery_active(hdev)) { 5350 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY, 5351 MGMT_STATUS_REJECTED, &mgmt_cp->type, 5352 sizeof(mgmt_cp->type)); 5353 goto unlock; 5354 } 5355 5356 if (hdev->discovery.type != mgmt_cp->type) { 5357 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY, 5358 MGMT_STATUS_INVALID_PARAMS, 5359 &mgmt_cp->type, sizeof(mgmt_cp->type)); 5360 goto unlock; 5361 } 5362 5363 cmd = mgmt_pending_add(sk, MGMT_OP_STOP_DISCOVERY, hdev, data, len); 5364 if (!cmd) { 5365 err = -ENOMEM; 5366 goto unlock; 5367 } 5368 5369 cmd->cmd_complete = generic_cmd_complete; 5370 5371 hci_discovery_set_state(hdev, DISCOVERY_STOPPING); 5372 queue_work(hdev->req_workqueue, &hdev->discov_update); 5373 err = 0; 5374 5375 unlock: 5376 hci_dev_unlock(hdev); 5377 return err; 5378 } 5379 5380 static int confirm_name(struct sock *sk, struct hci_dev *hdev, void *data, 5381 u16 len) 5382 { 5383 struct mgmt_cp_confirm_name *cp = data; 5384 struct inquiry_entry *e; 5385 int err; 5386 5387 bt_dev_dbg(hdev, "sock %p", sk); 5388 5389 hci_dev_lock(hdev); 5390 5391 if (!hci_discovery_active(hdev)) { 5392 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME, 5393 MGMT_STATUS_FAILED, &cp->addr, 5394 sizeof(cp->addr)); 5395 goto failed; 5396 } 5397 5398 e = hci_inquiry_cache_lookup_unknown(hdev, &cp->addr.bdaddr); 5399 if (!e) { 5400 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME, 5401 MGMT_STATUS_INVALID_PARAMS, &cp->addr, 5402 sizeof(cp->addr)); 5403 goto failed; 5404 } 5405 5406 if (cp->name_known) { 5407 e->name_state = NAME_KNOWN; 5408 list_del(&e->list); 5409 } else { 5410 e->name_state = NAME_NEEDED; 5411 hci_inquiry_cache_update_resolve(hdev, e); 5412 } 5413 5414 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME, 0, 5415 &cp->addr, sizeof(cp->addr)); 5416 5417 failed: 5418 hci_dev_unlock(hdev); 5419 return err; 5420 } 5421 5422 static int block_device(struct sock *sk, struct hci_dev *hdev, void *data, 5423 u16 len) 5424 { 5425 struct mgmt_cp_block_device *cp = data; 5426 u8 status; 5427 int err; 5428 5429 bt_dev_dbg(hdev, "sock %p", sk); 5430 5431 if (!bdaddr_type_is_valid(cp->addr.type)) 5432 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_BLOCK_DEVICE, 5433 MGMT_STATUS_INVALID_PARAMS, 5434 &cp->addr, sizeof(cp->addr)); 5435 5436 hci_dev_lock(hdev); 5437 5438 err = hci_bdaddr_list_add(&hdev->reject_list, &cp->addr.bdaddr, 5439 cp->addr.type); 5440 if (err < 0) { 5441 status = MGMT_STATUS_FAILED; 5442 goto done; 5443 } 5444 5445 mgmt_event(MGMT_EV_DEVICE_BLOCKED, hdev, &cp->addr, sizeof(cp->addr), 5446 sk); 5447 status = MGMT_STATUS_SUCCESS; 5448 5449 done: 5450 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_BLOCK_DEVICE, status, 5451 &cp->addr, sizeof(cp->addr)); 5452 5453 hci_dev_unlock(hdev); 5454 5455 return err; 5456 } 5457 5458 static int unblock_device(struct sock *sk, struct hci_dev *hdev, void *data, 5459 u16 len) 5460 { 5461 struct mgmt_cp_unblock_device *cp = data; 5462 u8 status; 5463 int err; 5464 5465 bt_dev_dbg(hdev, "sock %p", sk); 5466 5467 if (!bdaddr_type_is_valid(cp->addr.type)) 5468 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNBLOCK_DEVICE, 5469 MGMT_STATUS_INVALID_PARAMS, 5470 &cp->addr, sizeof(cp->addr)); 5471 5472 hci_dev_lock(hdev); 5473 5474 err = hci_bdaddr_list_del(&hdev->reject_list, &cp->addr.bdaddr, 5475 cp->addr.type); 5476 if (err < 0) { 5477 status = MGMT_STATUS_INVALID_PARAMS; 5478 goto done; 5479 } 5480 5481 mgmt_event(MGMT_EV_DEVICE_UNBLOCKED, hdev, &cp->addr, sizeof(cp->addr), 5482 sk); 5483 status = MGMT_STATUS_SUCCESS; 5484 5485 done: 5486 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNBLOCK_DEVICE, status, 5487 &cp->addr, sizeof(cp->addr)); 5488 5489 hci_dev_unlock(hdev); 5490 5491 return err; 5492 } 5493 5494 static int set_device_id(struct sock *sk, struct hci_dev *hdev, void *data, 5495 u16 len) 5496 { 5497 struct mgmt_cp_set_device_id *cp = data; 5498 struct hci_request req; 5499 int err; 5500 __u16 source; 5501 5502 bt_dev_dbg(hdev, "sock %p", sk); 5503 5504 source = __le16_to_cpu(cp->source); 5505 5506 if (source > 0x0002) 5507 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEVICE_ID, 5508 MGMT_STATUS_INVALID_PARAMS); 5509 5510 hci_dev_lock(hdev); 5511 5512 hdev->devid_source = source; 5513 hdev->devid_vendor = __le16_to_cpu(cp->vendor); 5514 hdev->devid_product = __le16_to_cpu(cp->product); 5515 hdev->devid_version = __le16_to_cpu(cp->version); 5516 5517 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_DEVICE_ID, 0, 5518 NULL, 0); 5519 5520 hci_req_init(&req, hdev); 5521 __hci_req_update_eir(&req); 5522 hci_req_run(&req, NULL); 5523 5524 hci_dev_unlock(hdev); 5525 5526 return err; 5527 } 5528 5529 static void enable_advertising_instance(struct hci_dev *hdev, u8 status, 5530 u16 opcode) 5531 { 5532 bt_dev_dbg(hdev, "status %u", status); 5533 } 5534 5535 static void set_advertising_complete(struct hci_dev *hdev, u8 status, 5536 u16 opcode) 5537 { 5538 struct cmd_lookup match = { NULL, hdev }; 5539 struct hci_request req; 5540 u8 instance; 5541 struct adv_info *adv_instance; 5542 int err; 5543 5544 hci_dev_lock(hdev); 5545 5546 if (status) { 5547 u8 mgmt_err = mgmt_status(status); 5548 5549 mgmt_pending_foreach(MGMT_OP_SET_ADVERTISING, hdev, 5550 cmd_status_rsp, &mgmt_err); 5551 goto unlock; 5552 } 5553 5554 if (hci_dev_test_flag(hdev, HCI_LE_ADV)) 5555 hci_dev_set_flag(hdev, HCI_ADVERTISING); 5556 else 5557 hci_dev_clear_flag(hdev, HCI_ADVERTISING); 5558 5559 mgmt_pending_foreach(MGMT_OP_SET_ADVERTISING, hdev, settings_rsp, 5560 &match); 5561 5562 new_settings(hdev, match.sk); 5563 5564 if (match.sk) 5565 sock_put(match.sk); 5566 5567 /* Handle suspend notifier */ 5568 if (test_and_clear_bit(SUSPEND_PAUSE_ADVERTISING, 5569 hdev->suspend_tasks)) { 5570 bt_dev_dbg(hdev, "Paused advertising"); 5571 wake_up(&hdev->suspend_wait_q); 5572 } else if (test_and_clear_bit(SUSPEND_UNPAUSE_ADVERTISING, 5573 hdev->suspend_tasks)) { 5574 bt_dev_dbg(hdev, "Unpaused advertising"); 5575 wake_up(&hdev->suspend_wait_q); 5576 } 5577 5578 /* If "Set Advertising" was just disabled and instance advertising was 5579 * set up earlier, then re-enable multi-instance advertising. 5580 */ 5581 if (hci_dev_test_flag(hdev, HCI_ADVERTISING) || 5582 list_empty(&hdev->adv_instances)) 5583 goto unlock; 5584 5585 instance = hdev->cur_adv_instance; 5586 if (!instance) { 5587 adv_instance = list_first_entry_or_null(&hdev->adv_instances, 5588 struct adv_info, list); 5589 if (!adv_instance) 5590 goto unlock; 5591 5592 instance = adv_instance->instance; 5593 } 5594 5595 hci_req_init(&req, hdev); 5596 5597 err = __hci_req_schedule_adv_instance(&req, instance, true); 5598 5599 if (!err) 5600 err = hci_req_run(&req, enable_advertising_instance); 5601 5602 if (err) 5603 bt_dev_err(hdev, "failed to re-configure advertising"); 5604 5605 unlock: 5606 hci_dev_unlock(hdev); 5607 } 5608 5609 static int set_advertising(struct sock *sk, struct hci_dev *hdev, void *data, 5610 u16 len) 5611 { 5612 struct mgmt_mode *cp = data; 5613 struct mgmt_pending_cmd *cmd; 5614 struct hci_request req; 5615 u8 val, status; 5616 int err; 5617 5618 bt_dev_dbg(hdev, "sock %p", sk); 5619 5620 status = mgmt_le_support(hdev); 5621 if (status) 5622 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING, 5623 status); 5624 5625 /* Enabling the experimental LL Privay support disables support for 5626 * advertising. 5627 */ 5628 if (hci_dev_test_flag(hdev, HCI_ENABLE_LL_PRIVACY)) 5629 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING, 5630 MGMT_STATUS_NOT_SUPPORTED); 5631 5632 if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02) 5633 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING, 5634 MGMT_STATUS_INVALID_PARAMS); 5635 5636 if (hdev->advertising_paused) 5637 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING, 5638 MGMT_STATUS_BUSY); 5639 5640 hci_dev_lock(hdev); 5641 5642 val = !!cp->val; 5643 5644 /* The following conditions are ones which mean that we should 5645 * not do any HCI communication but directly send a mgmt 5646 * response to user space (after toggling the flag if 5647 * necessary). 5648 */ 5649 if (!hdev_is_powered(hdev) || 5650 (val == hci_dev_test_flag(hdev, HCI_ADVERTISING) && 5651 (cp->val == 0x02) == hci_dev_test_flag(hdev, HCI_ADVERTISING_CONNECTABLE)) || 5652 hci_conn_num(hdev, LE_LINK) > 0 || 5653 (hci_dev_test_flag(hdev, HCI_LE_SCAN) && 5654 hdev->le_scan_type == LE_SCAN_ACTIVE)) { 5655 bool changed; 5656 5657 if (cp->val) { 5658 hdev->cur_adv_instance = 0x00; 5659 changed = !hci_dev_test_and_set_flag(hdev, HCI_ADVERTISING); 5660 if (cp->val == 0x02) 5661 hci_dev_set_flag(hdev, HCI_ADVERTISING_CONNECTABLE); 5662 else 5663 hci_dev_clear_flag(hdev, HCI_ADVERTISING_CONNECTABLE); 5664 } else { 5665 changed = hci_dev_test_and_clear_flag(hdev, HCI_ADVERTISING); 5666 hci_dev_clear_flag(hdev, HCI_ADVERTISING_CONNECTABLE); 5667 } 5668 5669 err = send_settings_rsp(sk, MGMT_OP_SET_ADVERTISING, hdev); 5670 if (err < 0) 5671 goto unlock; 5672 5673 if (changed) 5674 err = new_settings(hdev, sk); 5675 5676 goto unlock; 5677 } 5678 5679 if (pending_find(MGMT_OP_SET_ADVERTISING, hdev) || 5680 pending_find(MGMT_OP_SET_LE, hdev)) { 5681 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING, 5682 MGMT_STATUS_BUSY); 5683 goto unlock; 5684 } 5685 5686 cmd = mgmt_pending_add(sk, MGMT_OP_SET_ADVERTISING, hdev, data, len); 5687 if (!cmd) { 5688 err = -ENOMEM; 5689 goto unlock; 5690 } 5691 5692 hci_req_init(&req, hdev); 5693 5694 if (cp->val == 0x02) 5695 hci_dev_set_flag(hdev, HCI_ADVERTISING_CONNECTABLE); 5696 else 5697 hci_dev_clear_flag(hdev, HCI_ADVERTISING_CONNECTABLE); 5698 5699 cancel_adv_timeout(hdev); 5700 5701 if (val) { 5702 /* Switch to instance "0" for the Set Advertising setting. 5703 * We cannot use update_[adv|scan_rsp]_data() here as the 5704 * HCI_ADVERTISING flag is not yet set. 5705 */ 5706 hdev->cur_adv_instance = 0x00; 5707 5708 if (ext_adv_capable(hdev)) { 5709 __hci_req_start_ext_adv(&req, 0x00); 5710 } else { 5711 __hci_req_update_adv_data(&req, 0x00); 5712 __hci_req_update_scan_rsp_data(&req, 0x00); 5713 __hci_req_enable_advertising(&req); 5714 } 5715 } else { 5716 __hci_req_disable_advertising(&req); 5717 } 5718 5719 err = hci_req_run(&req, set_advertising_complete); 5720 if (err < 0) 5721 mgmt_pending_remove(cmd); 5722 5723 unlock: 5724 hci_dev_unlock(hdev); 5725 return err; 5726 } 5727 5728 static int set_static_address(struct sock *sk, struct hci_dev *hdev, 5729 void *data, u16 len) 5730 { 5731 struct mgmt_cp_set_static_address *cp = data; 5732 int err; 5733 5734 bt_dev_dbg(hdev, "sock %p", sk); 5735 5736 if (!lmp_le_capable(hdev)) 5737 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_STATIC_ADDRESS, 5738 MGMT_STATUS_NOT_SUPPORTED); 5739 5740 if (hdev_is_powered(hdev)) 5741 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_STATIC_ADDRESS, 5742 MGMT_STATUS_REJECTED); 5743 5744 if (bacmp(&cp->bdaddr, BDADDR_ANY)) { 5745 if (!bacmp(&cp->bdaddr, BDADDR_NONE)) 5746 return mgmt_cmd_status(sk, hdev->id, 5747 MGMT_OP_SET_STATIC_ADDRESS, 5748 MGMT_STATUS_INVALID_PARAMS); 5749 5750 /* Two most significant bits shall be set */ 5751 if ((cp->bdaddr.b[5] & 0xc0) != 0xc0) 5752 return mgmt_cmd_status(sk, hdev->id, 5753 MGMT_OP_SET_STATIC_ADDRESS, 5754 MGMT_STATUS_INVALID_PARAMS); 5755 } 5756 5757 hci_dev_lock(hdev); 5758 5759 bacpy(&hdev->static_addr, &cp->bdaddr); 5760 5761 err = send_settings_rsp(sk, MGMT_OP_SET_STATIC_ADDRESS, hdev); 5762 if (err < 0) 5763 goto unlock; 5764 5765 err = new_settings(hdev, sk); 5766 5767 unlock: 5768 hci_dev_unlock(hdev); 5769 return err; 5770 } 5771 5772 static int set_scan_params(struct sock *sk, struct hci_dev *hdev, 5773 void *data, u16 len) 5774 { 5775 struct mgmt_cp_set_scan_params *cp = data; 5776 __u16 interval, window; 5777 int err; 5778 5779 bt_dev_dbg(hdev, "sock %p", sk); 5780 5781 if (!lmp_le_capable(hdev)) 5782 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS, 5783 MGMT_STATUS_NOT_SUPPORTED); 5784 5785 interval = __le16_to_cpu(cp->interval); 5786 5787 if (interval < 0x0004 || interval > 0x4000) 5788 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS, 5789 MGMT_STATUS_INVALID_PARAMS); 5790 5791 window = __le16_to_cpu(cp->window); 5792 5793 if (window < 0x0004 || window > 0x4000) 5794 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS, 5795 MGMT_STATUS_INVALID_PARAMS); 5796 5797 if (window > interval) 5798 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS, 5799 MGMT_STATUS_INVALID_PARAMS); 5800 5801 hci_dev_lock(hdev); 5802 5803 hdev->le_scan_interval = interval; 5804 hdev->le_scan_window = window; 5805 5806 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS, 0, 5807 NULL, 0); 5808 5809 /* If background scan is running, restart it so new parameters are 5810 * loaded. 5811 */ 5812 if (hci_dev_test_flag(hdev, HCI_LE_SCAN) && 5813 hdev->discovery.state == DISCOVERY_STOPPED) { 5814 struct hci_request req; 5815 5816 hci_req_init(&req, hdev); 5817 5818 hci_req_add_le_scan_disable(&req, false); 5819 hci_req_add_le_passive_scan(&req); 5820 5821 hci_req_run(&req, NULL); 5822 } 5823 5824 hci_dev_unlock(hdev); 5825 5826 return err; 5827 } 5828 5829 static void fast_connectable_complete(struct hci_dev *hdev, u8 status, 5830 u16 opcode) 5831 { 5832 struct mgmt_pending_cmd *cmd; 5833 5834 bt_dev_dbg(hdev, "status 0x%02x", status); 5835 5836 hci_dev_lock(hdev); 5837 5838 cmd = pending_find(MGMT_OP_SET_FAST_CONNECTABLE, hdev); 5839 if (!cmd) 5840 goto unlock; 5841 5842 if (status) { 5843 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE, 5844 mgmt_status(status)); 5845 } else { 5846 struct mgmt_mode *cp = cmd->param; 5847 5848 if (cp->val) 5849 hci_dev_set_flag(hdev, HCI_FAST_CONNECTABLE); 5850 else 5851 hci_dev_clear_flag(hdev, HCI_FAST_CONNECTABLE); 5852 5853 send_settings_rsp(cmd->sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev); 5854 new_settings(hdev, cmd->sk); 5855 } 5856 5857 mgmt_pending_remove(cmd); 5858 5859 unlock: 5860 hci_dev_unlock(hdev); 5861 } 5862 5863 static int set_fast_connectable(struct sock *sk, struct hci_dev *hdev, 5864 void *data, u16 len) 5865 { 5866 struct mgmt_mode *cp = data; 5867 struct mgmt_pending_cmd *cmd; 5868 struct hci_request req; 5869 int err; 5870 5871 bt_dev_dbg(hdev, "sock %p", sk); 5872 5873 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) || 5874 hdev->hci_ver < BLUETOOTH_VER_1_2) 5875 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE, 5876 MGMT_STATUS_NOT_SUPPORTED); 5877 5878 if (cp->val != 0x00 && cp->val != 0x01) 5879 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE, 5880 MGMT_STATUS_INVALID_PARAMS); 5881 5882 hci_dev_lock(hdev); 5883 5884 if (pending_find(MGMT_OP_SET_FAST_CONNECTABLE, hdev)) { 5885 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE, 5886 MGMT_STATUS_BUSY); 5887 goto unlock; 5888 } 5889 5890 if (!!cp->val == hci_dev_test_flag(hdev, HCI_FAST_CONNECTABLE)) { 5891 err = send_settings_rsp(sk, MGMT_OP_SET_FAST_CONNECTABLE, 5892 hdev); 5893 goto unlock; 5894 } 5895 5896 if (!hdev_is_powered(hdev)) { 5897 hci_dev_change_flag(hdev, HCI_FAST_CONNECTABLE); 5898 err = send_settings_rsp(sk, MGMT_OP_SET_FAST_CONNECTABLE, 5899 hdev); 5900 new_settings(hdev, sk); 5901 goto unlock; 5902 } 5903 5904 cmd = mgmt_pending_add(sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev, 5905 data, len); 5906 if (!cmd) { 5907 err = -ENOMEM; 5908 goto unlock; 5909 } 5910 5911 hci_req_init(&req, hdev); 5912 5913 __hci_req_write_fast_connectable(&req, cp->val); 5914 5915 err = hci_req_run(&req, fast_connectable_complete); 5916 if (err < 0) { 5917 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE, 5918 MGMT_STATUS_FAILED); 5919 mgmt_pending_remove(cmd); 5920 } 5921 5922 unlock: 5923 hci_dev_unlock(hdev); 5924 5925 return err; 5926 } 5927 5928 static void set_bredr_complete(struct hci_dev *hdev, u8 status, u16 opcode) 5929 { 5930 struct mgmt_pending_cmd *cmd; 5931 5932 bt_dev_dbg(hdev, "status 0x%02x", status); 5933 5934 hci_dev_lock(hdev); 5935 5936 cmd = pending_find(MGMT_OP_SET_BREDR, hdev); 5937 if (!cmd) 5938 goto unlock; 5939 5940 if (status) { 5941 u8 mgmt_err = mgmt_status(status); 5942 5943 /* We need to restore the flag if related HCI commands 5944 * failed. 5945 */ 5946 hci_dev_clear_flag(hdev, HCI_BREDR_ENABLED); 5947 5948 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err); 5949 } else { 5950 send_settings_rsp(cmd->sk, MGMT_OP_SET_BREDR, hdev); 5951 new_settings(hdev, cmd->sk); 5952 } 5953 5954 mgmt_pending_remove(cmd); 5955 5956 unlock: 5957 hci_dev_unlock(hdev); 5958 } 5959 5960 static int set_bredr(struct sock *sk, struct hci_dev *hdev, void *data, u16 len) 5961 { 5962 struct mgmt_mode *cp = data; 5963 struct mgmt_pending_cmd *cmd; 5964 struct hci_request req; 5965 int err; 5966 5967 bt_dev_dbg(hdev, "sock %p", sk); 5968 5969 if (!lmp_bredr_capable(hdev) || !lmp_le_capable(hdev)) 5970 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR, 5971 MGMT_STATUS_NOT_SUPPORTED); 5972 5973 if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED)) 5974 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR, 5975 MGMT_STATUS_REJECTED); 5976 5977 if (cp->val != 0x00 && cp->val != 0x01) 5978 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR, 5979 MGMT_STATUS_INVALID_PARAMS); 5980 5981 hci_dev_lock(hdev); 5982 5983 if (cp->val == hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) { 5984 err = send_settings_rsp(sk, MGMT_OP_SET_BREDR, hdev); 5985 goto unlock; 5986 } 5987 5988 if (!hdev_is_powered(hdev)) { 5989 if (!cp->val) { 5990 hci_dev_clear_flag(hdev, HCI_DISCOVERABLE); 5991 hci_dev_clear_flag(hdev, HCI_SSP_ENABLED); 5992 hci_dev_clear_flag(hdev, HCI_LINK_SECURITY); 5993 hci_dev_clear_flag(hdev, HCI_FAST_CONNECTABLE); 5994 hci_dev_clear_flag(hdev, HCI_HS_ENABLED); 5995 } 5996 5997 hci_dev_change_flag(hdev, HCI_BREDR_ENABLED); 5998 5999 err = send_settings_rsp(sk, MGMT_OP_SET_BREDR, hdev); 6000 if (err < 0) 6001 goto unlock; 6002 6003 err = new_settings(hdev, sk); 6004 goto unlock; 6005 } 6006 6007 /* Reject disabling when powered on */ 6008 if (!cp->val) { 6009 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR, 6010 MGMT_STATUS_REJECTED); 6011 goto unlock; 6012 } else { 6013 /* When configuring a dual-mode controller to operate 6014 * with LE only and using a static address, then switching 6015 * BR/EDR back on is not allowed. 6016 * 6017 * Dual-mode controllers shall operate with the public 6018 * address as its identity address for BR/EDR and LE. So 6019 * reject the attempt to create an invalid configuration. 6020 * 6021 * The same restrictions applies when secure connections 6022 * has been enabled. For BR/EDR this is a controller feature 6023 * while for LE it is a host stack feature. This means that 6024 * switching BR/EDR back on when secure connections has been 6025 * enabled is not a supported transaction. 6026 */ 6027 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) && 6028 (bacmp(&hdev->static_addr, BDADDR_ANY) || 6029 hci_dev_test_flag(hdev, HCI_SC_ENABLED))) { 6030 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR, 6031 MGMT_STATUS_REJECTED); 6032 goto unlock; 6033 } 6034 } 6035 6036 if (pending_find(MGMT_OP_SET_BREDR, hdev)) { 6037 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR, 6038 MGMT_STATUS_BUSY); 6039 goto unlock; 6040 } 6041 6042 cmd = mgmt_pending_add(sk, MGMT_OP_SET_BREDR, hdev, data, len); 6043 if (!cmd) { 6044 err = -ENOMEM; 6045 goto unlock; 6046 } 6047 6048 /* We need to flip the bit already here so that 6049 * hci_req_update_adv_data generates the correct flags. 6050 */ 6051 hci_dev_set_flag(hdev, HCI_BREDR_ENABLED); 6052 6053 hci_req_init(&req, hdev); 6054 6055 __hci_req_write_fast_connectable(&req, false); 6056 __hci_req_update_scan(&req); 6057 6058 /* Since only the advertising data flags will change, there 6059 * is no need to update the scan response data. 6060 */ 6061 __hci_req_update_adv_data(&req, hdev->cur_adv_instance); 6062 6063 err = hci_req_run(&req, set_bredr_complete); 6064 if (err < 0) 6065 mgmt_pending_remove(cmd); 6066 6067 unlock: 6068 hci_dev_unlock(hdev); 6069 return err; 6070 } 6071 6072 static void sc_enable_complete(struct hci_dev *hdev, u8 status, u16 opcode) 6073 { 6074 struct mgmt_pending_cmd *cmd; 6075 struct mgmt_mode *cp; 6076 6077 bt_dev_dbg(hdev, "status %u", status); 6078 6079 hci_dev_lock(hdev); 6080 6081 cmd = pending_find(MGMT_OP_SET_SECURE_CONN, hdev); 6082 if (!cmd) 6083 goto unlock; 6084 6085 if (status) { 6086 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, 6087 mgmt_status(status)); 6088 goto remove; 6089 } 6090 6091 cp = cmd->param; 6092 6093 switch (cp->val) { 6094 case 0x00: 6095 hci_dev_clear_flag(hdev, HCI_SC_ENABLED); 6096 hci_dev_clear_flag(hdev, HCI_SC_ONLY); 6097 break; 6098 case 0x01: 6099 hci_dev_set_flag(hdev, HCI_SC_ENABLED); 6100 hci_dev_clear_flag(hdev, HCI_SC_ONLY); 6101 break; 6102 case 0x02: 6103 hci_dev_set_flag(hdev, HCI_SC_ENABLED); 6104 hci_dev_set_flag(hdev, HCI_SC_ONLY); 6105 break; 6106 } 6107 6108 send_settings_rsp(cmd->sk, MGMT_OP_SET_SECURE_CONN, hdev); 6109 new_settings(hdev, cmd->sk); 6110 6111 remove: 6112 mgmt_pending_remove(cmd); 6113 unlock: 6114 hci_dev_unlock(hdev); 6115 } 6116 6117 static int set_secure_conn(struct sock *sk, struct hci_dev *hdev, 6118 void *data, u16 len) 6119 { 6120 struct mgmt_mode *cp = data; 6121 struct mgmt_pending_cmd *cmd; 6122 struct hci_request req; 6123 u8 val; 6124 int err; 6125 6126 bt_dev_dbg(hdev, "sock %p", sk); 6127 6128 if (!lmp_sc_capable(hdev) && 6129 !hci_dev_test_flag(hdev, HCI_LE_ENABLED)) 6130 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN, 6131 MGMT_STATUS_NOT_SUPPORTED); 6132 6133 if (hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) && 6134 lmp_sc_capable(hdev) && 6135 !hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) 6136 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN, 6137 MGMT_STATUS_REJECTED); 6138 6139 if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02) 6140 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN, 6141 MGMT_STATUS_INVALID_PARAMS); 6142 6143 hci_dev_lock(hdev); 6144 6145 if (!hdev_is_powered(hdev) || !lmp_sc_capable(hdev) || 6146 !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) { 6147 bool changed; 6148 6149 if (cp->val) { 6150 changed = !hci_dev_test_and_set_flag(hdev, 6151 HCI_SC_ENABLED); 6152 if (cp->val == 0x02) 6153 hci_dev_set_flag(hdev, HCI_SC_ONLY); 6154 else 6155 hci_dev_clear_flag(hdev, HCI_SC_ONLY); 6156 } else { 6157 changed = hci_dev_test_and_clear_flag(hdev, 6158 HCI_SC_ENABLED); 6159 hci_dev_clear_flag(hdev, HCI_SC_ONLY); 6160 } 6161 6162 err = send_settings_rsp(sk, MGMT_OP_SET_SECURE_CONN, hdev); 6163 if (err < 0) 6164 goto failed; 6165 6166 if (changed) 6167 err = new_settings(hdev, sk); 6168 6169 goto failed; 6170 } 6171 6172 if (pending_find(MGMT_OP_SET_SECURE_CONN, hdev)) { 6173 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN, 6174 MGMT_STATUS_BUSY); 6175 goto failed; 6176 } 6177 6178 val = !!cp->val; 6179 6180 if (val == hci_dev_test_flag(hdev, HCI_SC_ENABLED) && 6181 (cp->val == 0x02) == hci_dev_test_flag(hdev, HCI_SC_ONLY)) { 6182 err = send_settings_rsp(sk, MGMT_OP_SET_SECURE_CONN, hdev); 6183 goto failed; 6184 } 6185 6186 cmd = mgmt_pending_add(sk, MGMT_OP_SET_SECURE_CONN, hdev, data, len); 6187 if (!cmd) { 6188 err = -ENOMEM; 6189 goto failed; 6190 } 6191 6192 hci_req_init(&req, hdev); 6193 hci_req_add(&req, HCI_OP_WRITE_SC_SUPPORT, 1, &val); 6194 err = hci_req_run(&req, sc_enable_complete); 6195 if (err < 0) { 6196 mgmt_pending_remove(cmd); 6197 goto failed; 6198 } 6199 6200 failed: 6201 hci_dev_unlock(hdev); 6202 return err; 6203 } 6204 6205 static int set_debug_keys(struct sock *sk, struct hci_dev *hdev, 6206 void *data, u16 len) 6207 { 6208 struct mgmt_mode *cp = data; 6209 bool changed, use_changed; 6210 int err; 6211 6212 bt_dev_dbg(hdev, "sock %p", sk); 6213 6214 if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02) 6215 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEBUG_KEYS, 6216 MGMT_STATUS_INVALID_PARAMS); 6217 6218 hci_dev_lock(hdev); 6219 6220 if (cp->val) 6221 changed = !hci_dev_test_and_set_flag(hdev, HCI_KEEP_DEBUG_KEYS); 6222 else 6223 changed = hci_dev_test_and_clear_flag(hdev, 6224 HCI_KEEP_DEBUG_KEYS); 6225 6226 if (cp->val == 0x02) 6227 use_changed = !hci_dev_test_and_set_flag(hdev, 6228 HCI_USE_DEBUG_KEYS); 6229 else 6230 use_changed = hci_dev_test_and_clear_flag(hdev, 6231 HCI_USE_DEBUG_KEYS); 6232 6233 if (hdev_is_powered(hdev) && use_changed && 6234 hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) { 6235 u8 mode = (cp->val == 0x02) ? 0x01 : 0x00; 6236 hci_send_cmd(hdev, HCI_OP_WRITE_SSP_DEBUG_MODE, 6237 sizeof(mode), &mode); 6238 } 6239 6240 err = send_settings_rsp(sk, MGMT_OP_SET_DEBUG_KEYS, hdev); 6241 if (err < 0) 6242 goto unlock; 6243 6244 if (changed) 6245 err = new_settings(hdev, sk); 6246 6247 unlock: 6248 hci_dev_unlock(hdev); 6249 return err; 6250 } 6251 6252 static int set_privacy(struct sock *sk, struct hci_dev *hdev, void *cp_data, 6253 u16 len) 6254 { 6255 struct mgmt_cp_set_privacy *cp = cp_data; 6256 bool changed; 6257 int err; 6258 6259 bt_dev_dbg(hdev, "sock %p", sk); 6260 6261 if (!lmp_le_capable(hdev)) 6262 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY, 6263 MGMT_STATUS_NOT_SUPPORTED); 6264 6265 if (cp->privacy != 0x00 && cp->privacy != 0x01 && cp->privacy != 0x02) 6266 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY, 6267 MGMT_STATUS_INVALID_PARAMS); 6268 6269 if (hdev_is_powered(hdev)) 6270 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY, 6271 MGMT_STATUS_REJECTED); 6272 6273 hci_dev_lock(hdev); 6274 6275 /* If user space supports this command it is also expected to 6276 * handle IRKs. Therefore, set the HCI_RPA_RESOLVING flag. 6277 */ 6278 hci_dev_set_flag(hdev, HCI_RPA_RESOLVING); 6279 6280 if (cp->privacy) { 6281 changed = !hci_dev_test_and_set_flag(hdev, HCI_PRIVACY); 6282 memcpy(hdev->irk, cp->irk, sizeof(hdev->irk)); 6283 hci_dev_set_flag(hdev, HCI_RPA_EXPIRED); 6284 hci_adv_instances_set_rpa_expired(hdev, true); 6285 if (cp->privacy == 0x02) 6286 hci_dev_set_flag(hdev, HCI_LIMITED_PRIVACY); 6287 else 6288 hci_dev_clear_flag(hdev, HCI_LIMITED_PRIVACY); 6289 } else { 6290 changed = hci_dev_test_and_clear_flag(hdev, HCI_PRIVACY); 6291 memset(hdev->irk, 0, sizeof(hdev->irk)); 6292 hci_dev_clear_flag(hdev, HCI_RPA_EXPIRED); 6293 hci_adv_instances_set_rpa_expired(hdev, false); 6294 hci_dev_clear_flag(hdev, HCI_LIMITED_PRIVACY); 6295 } 6296 6297 err = send_settings_rsp(sk, MGMT_OP_SET_PRIVACY, hdev); 6298 if (err < 0) 6299 goto unlock; 6300 6301 if (changed) 6302 err = new_settings(hdev, sk); 6303 6304 unlock: 6305 hci_dev_unlock(hdev); 6306 return err; 6307 } 6308 6309 static bool irk_is_valid(struct mgmt_irk_info *irk) 6310 { 6311 switch (irk->addr.type) { 6312 case BDADDR_LE_PUBLIC: 6313 return true; 6314 6315 case BDADDR_LE_RANDOM: 6316 /* Two most significant bits shall be set */ 6317 if ((irk->addr.bdaddr.b[5] & 0xc0) != 0xc0) 6318 return false; 6319 return true; 6320 } 6321 6322 return false; 6323 } 6324 6325 static int load_irks(struct sock *sk, struct hci_dev *hdev, void *cp_data, 6326 u16 len) 6327 { 6328 struct mgmt_cp_load_irks *cp = cp_data; 6329 const u16 max_irk_count = ((U16_MAX - sizeof(*cp)) / 6330 sizeof(struct mgmt_irk_info)); 6331 u16 irk_count, expected_len; 6332 int i, err; 6333 6334 bt_dev_dbg(hdev, "sock %p", sk); 6335 6336 if (!lmp_le_capable(hdev)) 6337 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS, 6338 MGMT_STATUS_NOT_SUPPORTED); 6339 6340 irk_count = __le16_to_cpu(cp->irk_count); 6341 if (irk_count > max_irk_count) { 6342 bt_dev_err(hdev, "load_irks: too big irk_count value %u", 6343 irk_count); 6344 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS, 6345 MGMT_STATUS_INVALID_PARAMS); 6346 } 6347 6348 expected_len = struct_size(cp, irks, irk_count); 6349 if (expected_len != len) { 6350 bt_dev_err(hdev, "load_irks: expected %u bytes, got %u bytes", 6351 expected_len, len); 6352 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS, 6353 MGMT_STATUS_INVALID_PARAMS); 6354 } 6355 6356 bt_dev_dbg(hdev, "irk_count %u", irk_count); 6357 6358 for (i = 0; i < irk_count; i++) { 6359 struct mgmt_irk_info *key = &cp->irks[i]; 6360 6361 if (!irk_is_valid(key)) 6362 return mgmt_cmd_status(sk, hdev->id, 6363 MGMT_OP_LOAD_IRKS, 6364 MGMT_STATUS_INVALID_PARAMS); 6365 } 6366 6367 hci_dev_lock(hdev); 6368 6369 hci_smp_irks_clear(hdev); 6370 6371 for (i = 0; i < irk_count; i++) { 6372 struct mgmt_irk_info *irk = &cp->irks[i]; 6373 6374 if (hci_is_blocked_key(hdev, 6375 HCI_BLOCKED_KEY_TYPE_IRK, 6376 irk->val)) { 6377 bt_dev_warn(hdev, "Skipping blocked IRK for %pMR", 6378 &irk->addr.bdaddr); 6379 continue; 6380 } 6381 6382 hci_add_irk(hdev, &irk->addr.bdaddr, 6383 le_addr_type(irk->addr.type), irk->val, 6384 BDADDR_ANY); 6385 } 6386 6387 hci_dev_set_flag(hdev, HCI_RPA_RESOLVING); 6388 6389 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_IRKS, 0, NULL, 0); 6390 6391 hci_dev_unlock(hdev); 6392 6393 return err; 6394 } 6395 6396 static bool ltk_is_valid(struct mgmt_ltk_info *key) 6397 { 6398 if (key->initiator != 0x00 && key->initiator != 0x01) 6399 return false; 6400 6401 switch (key->addr.type) { 6402 case BDADDR_LE_PUBLIC: 6403 return true; 6404 6405 case BDADDR_LE_RANDOM: 6406 /* Two most significant bits shall be set */ 6407 if ((key->addr.bdaddr.b[5] & 0xc0) != 0xc0) 6408 return false; 6409 return true; 6410 } 6411 6412 return false; 6413 } 6414 6415 static int load_long_term_keys(struct sock *sk, struct hci_dev *hdev, 6416 void *cp_data, u16 len) 6417 { 6418 struct mgmt_cp_load_long_term_keys *cp = cp_data; 6419 const u16 max_key_count = ((U16_MAX - sizeof(*cp)) / 6420 sizeof(struct mgmt_ltk_info)); 6421 u16 key_count, expected_len; 6422 int i, err; 6423 6424 bt_dev_dbg(hdev, "sock %p", sk); 6425 6426 if (!lmp_le_capable(hdev)) 6427 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS, 6428 MGMT_STATUS_NOT_SUPPORTED); 6429 6430 key_count = __le16_to_cpu(cp->key_count); 6431 if (key_count > max_key_count) { 6432 bt_dev_err(hdev, "load_ltks: too big key_count value %u", 6433 key_count); 6434 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS, 6435 MGMT_STATUS_INVALID_PARAMS); 6436 } 6437 6438 expected_len = struct_size(cp, keys, key_count); 6439 if (expected_len != len) { 6440 bt_dev_err(hdev, "load_keys: expected %u bytes, got %u bytes", 6441 expected_len, len); 6442 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS, 6443 MGMT_STATUS_INVALID_PARAMS); 6444 } 6445 6446 bt_dev_dbg(hdev, "key_count %u", key_count); 6447 6448 for (i = 0; i < key_count; i++) { 6449 struct mgmt_ltk_info *key = &cp->keys[i]; 6450 6451 if (!ltk_is_valid(key)) 6452 return mgmt_cmd_status(sk, hdev->id, 6453 MGMT_OP_LOAD_LONG_TERM_KEYS, 6454 MGMT_STATUS_INVALID_PARAMS); 6455 } 6456 6457 hci_dev_lock(hdev); 6458 6459 hci_smp_ltks_clear(hdev); 6460 6461 for (i = 0; i < key_count; i++) { 6462 struct mgmt_ltk_info *key = &cp->keys[i]; 6463 u8 type, authenticated; 6464 6465 if (hci_is_blocked_key(hdev, 6466 HCI_BLOCKED_KEY_TYPE_LTK, 6467 key->val)) { 6468 bt_dev_warn(hdev, "Skipping blocked LTK for %pMR", 6469 &key->addr.bdaddr); 6470 continue; 6471 } 6472 6473 switch (key->type) { 6474 case MGMT_LTK_UNAUTHENTICATED: 6475 authenticated = 0x00; 6476 type = key->initiator ? SMP_LTK : SMP_LTK_RESPONDER; 6477 break; 6478 case MGMT_LTK_AUTHENTICATED: 6479 authenticated = 0x01; 6480 type = key->initiator ? SMP_LTK : SMP_LTK_RESPONDER; 6481 break; 6482 case MGMT_LTK_P256_UNAUTH: 6483 authenticated = 0x00; 6484 type = SMP_LTK_P256; 6485 break; 6486 case MGMT_LTK_P256_AUTH: 6487 authenticated = 0x01; 6488 type = SMP_LTK_P256; 6489 break; 6490 case MGMT_LTK_P256_DEBUG: 6491 authenticated = 0x00; 6492 type = SMP_LTK_P256_DEBUG; 6493 fallthrough; 6494 default: 6495 continue; 6496 } 6497 6498 hci_add_ltk(hdev, &key->addr.bdaddr, 6499 le_addr_type(key->addr.type), type, authenticated, 6500 key->val, key->enc_size, key->ediv, key->rand); 6501 } 6502 6503 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS, 0, 6504 NULL, 0); 6505 6506 hci_dev_unlock(hdev); 6507 6508 return err; 6509 } 6510 6511 static int conn_info_cmd_complete(struct mgmt_pending_cmd *cmd, u8 status) 6512 { 6513 struct hci_conn *conn = cmd->user_data; 6514 struct mgmt_rp_get_conn_info rp; 6515 int err; 6516 6517 memcpy(&rp.addr, cmd->param, sizeof(rp.addr)); 6518 6519 if (status == MGMT_STATUS_SUCCESS) { 6520 rp.rssi = conn->rssi; 6521 rp.tx_power = conn->tx_power; 6522 rp.max_tx_power = conn->max_tx_power; 6523 } else { 6524 rp.rssi = HCI_RSSI_INVALID; 6525 rp.tx_power = HCI_TX_POWER_INVALID; 6526 rp.max_tx_power = HCI_TX_POWER_INVALID; 6527 } 6528 6529 err = mgmt_cmd_complete(cmd->sk, cmd->index, MGMT_OP_GET_CONN_INFO, 6530 status, &rp, sizeof(rp)); 6531 6532 hci_conn_drop(conn); 6533 hci_conn_put(conn); 6534 6535 return err; 6536 } 6537 6538 static void conn_info_refresh_complete(struct hci_dev *hdev, u8 hci_status, 6539 u16 opcode) 6540 { 6541 struct hci_cp_read_rssi *cp; 6542 struct mgmt_pending_cmd *cmd; 6543 struct hci_conn *conn; 6544 u16 handle; 6545 u8 status; 6546 6547 bt_dev_dbg(hdev, "status 0x%02x", hci_status); 6548 6549 hci_dev_lock(hdev); 6550 6551 /* Commands sent in request are either Read RSSI or Read Transmit Power 6552 * Level so we check which one was last sent to retrieve connection 6553 * handle. Both commands have handle as first parameter so it's safe to 6554 * cast data on the same command struct. 6555 * 6556 * First command sent is always Read RSSI and we fail only if it fails. 6557 * In other case we simply override error to indicate success as we 6558 * already remembered if TX power value is actually valid. 6559 */ 6560 cp = hci_sent_cmd_data(hdev, HCI_OP_READ_RSSI); 6561 if (!cp) { 6562 cp = hci_sent_cmd_data(hdev, HCI_OP_READ_TX_POWER); 6563 status = MGMT_STATUS_SUCCESS; 6564 } else { 6565 status = mgmt_status(hci_status); 6566 } 6567 6568 if (!cp) { 6569 bt_dev_err(hdev, "invalid sent_cmd in conn_info response"); 6570 goto unlock; 6571 } 6572 6573 handle = __le16_to_cpu(cp->handle); 6574 conn = hci_conn_hash_lookup_handle(hdev, handle); 6575 if (!conn) { 6576 bt_dev_err(hdev, "unknown handle (%u) in conn_info response", 6577 handle); 6578 goto unlock; 6579 } 6580 6581 cmd = pending_find_data(MGMT_OP_GET_CONN_INFO, hdev, conn); 6582 if (!cmd) 6583 goto unlock; 6584 6585 cmd->cmd_complete(cmd, status); 6586 mgmt_pending_remove(cmd); 6587 6588 unlock: 6589 hci_dev_unlock(hdev); 6590 } 6591 6592 static int get_conn_info(struct sock *sk, struct hci_dev *hdev, void *data, 6593 u16 len) 6594 { 6595 struct mgmt_cp_get_conn_info *cp = data; 6596 struct mgmt_rp_get_conn_info rp; 6597 struct hci_conn *conn; 6598 unsigned long conn_info_age; 6599 int err = 0; 6600 6601 bt_dev_dbg(hdev, "sock %p", sk); 6602 6603 memset(&rp, 0, sizeof(rp)); 6604 bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr); 6605 rp.addr.type = cp->addr.type; 6606 6607 if (!bdaddr_type_is_valid(cp->addr.type)) 6608 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO, 6609 MGMT_STATUS_INVALID_PARAMS, 6610 &rp, sizeof(rp)); 6611 6612 hci_dev_lock(hdev); 6613 6614 if (!hdev_is_powered(hdev)) { 6615 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO, 6616 MGMT_STATUS_NOT_POWERED, &rp, 6617 sizeof(rp)); 6618 goto unlock; 6619 } 6620 6621 if (cp->addr.type == BDADDR_BREDR) 6622 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, 6623 &cp->addr.bdaddr); 6624 else 6625 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &cp->addr.bdaddr); 6626 6627 if (!conn || conn->state != BT_CONNECTED) { 6628 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO, 6629 MGMT_STATUS_NOT_CONNECTED, &rp, 6630 sizeof(rp)); 6631 goto unlock; 6632 } 6633 6634 if (pending_find_data(MGMT_OP_GET_CONN_INFO, hdev, conn)) { 6635 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO, 6636 MGMT_STATUS_BUSY, &rp, sizeof(rp)); 6637 goto unlock; 6638 } 6639 6640 /* To avoid client trying to guess when to poll again for information we 6641 * calculate conn info age as random value between min/max set in hdev. 6642 */ 6643 conn_info_age = hdev->conn_info_min_age + 6644 prandom_u32_max(hdev->conn_info_max_age - 6645 hdev->conn_info_min_age); 6646 6647 /* Query controller to refresh cached values if they are too old or were 6648 * never read. 6649 */ 6650 if (time_after(jiffies, conn->conn_info_timestamp + 6651 msecs_to_jiffies(conn_info_age)) || 6652 !conn->conn_info_timestamp) { 6653 struct hci_request req; 6654 struct hci_cp_read_tx_power req_txp_cp; 6655 struct hci_cp_read_rssi req_rssi_cp; 6656 struct mgmt_pending_cmd *cmd; 6657 6658 hci_req_init(&req, hdev); 6659 req_rssi_cp.handle = cpu_to_le16(conn->handle); 6660 hci_req_add(&req, HCI_OP_READ_RSSI, sizeof(req_rssi_cp), 6661 &req_rssi_cp); 6662 6663 /* For LE links TX power does not change thus we don't need to 6664 * query for it once value is known. 6665 */ 6666 if (!bdaddr_type_is_le(cp->addr.type) || 6667 conn->tx_power == HCI_TX_POWER_INVALID) { 6668 req_txp_cp.handle = cpu_to_le16(conn->handle); 6669 req_txp_cp.type = 0x00; 6670 hci_req_add(&req, HCI_OP_READ_TX_POWER, 6671 sizeof(req_txp_cp), &req_txp_cp); 6672 } 6673 6674 /* Max TX power needs to be read only once per connection */ 6675 if (conn->max_tx_power == HCI_TX_POWER_INVALID) { 6676 req_txp_cp.handle = cpu_to_le16(conn->handle); 6677 req_txp_cp.type = 0x01; 6678 hci_req_add(&req, HCI_OP_READ_TX_POWER, 6679 sizeof(req_txp_cp), &req_txp_cp); 6680 } 6681 6682 err = hci_req_run(&req, conn_info_refresh_complete); 6683 if (err < 0) 6684 goto unlock; 6685 6686 cmd = mgmt_pending_add(sk, MGMT_OP_GET_CONN_INFO, hdev, 6687 data, len); 6688 if (!cmd) { 6689 err = -ENOMEM; 6690 goto unlock; 6691 } 6692 6693 hci_conn_hold(conn); 6694 cmd->user_data = hci_conn_get(conn); 6695 cmd->cmd_complete = conn_info_cmd_complete; 6696 6697 conn->conn_info_timestamp = jiffies; 6698 } else { 6699 /* Cache is valid, just reply with values cached in hci_conn */ 6700 rp.rssi = conn->rssi; 6701 rp.tx_power = conn->tx_power; 6702 rp.max_tx_power = conn->max_tx_power; 6703 6704 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO, 6705 MGMT_STATUS_SUCCESS, &rp, sizeof(rp)); 6706 } 6707 6708 unlock: 6709 hci_dev_unlock(hdev); 6710 return err; 6711 } 6712 6713 static int clock_info_cmd_complete(struct mgmt_pending_cmd *cmd, u8 status) 6714 { 6715 struct hci_conn *conn = cmd->user_data; 6716 struct mgmt_rp_get_clock_info rp; 6717 struct hci_dev *hdev; 6718 int err; 6719 6720 memset(&rp, 0, sizeof(rp)); 6721 memcpy(&rp.addr, cmd->param, sizeof(rp.addr)); 6722 6723 if (status) 6724 goto complete; 6725 6726 hdev = hci_dev_get(cmd->index); 6727 if (hdev) { 6728 rp.local_clock = cpu_to_le32(hdev->clock); 6729 hci_dev_put(hdev); 6730 } 6731 6732 if (conn) { 6733 rp.piconet_clock = cpu_to_le32(conn->clock); 6734 rp.accuracy = cpu_to_le16(conn->clock_accuracy); 6735 } 6736 6737 complete: 6738 err = mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, status, &rp, 6739 sizeof(rp)); 6740 6741 if (conn) { 6742 hci_conn_drop(conn); 6743 hci_conn_put(conn); 6744 } 6745 6746 return err; 6747 } 6748 6749 static void get_clock_info_complete(struct hci_dev *hdev, u8 status, u16 opcode) 6750 { 6751 struct hci_cp_read_clock *hci_cp; 6752 struct mgmt_pending_cmd *cmd; 6753 struct hci_conn *conn; 6754 6755 bt_dev_dbg(hdev, "status %u", status); 6756 6757 hci_dev_lock(hdev); 6758 6759 hci_cp = hci_sent_cmd_data(hdev, HCI_OP_READ_CLOCK); 6760 if (!hci_cp) 6761 goto unlock; 6762 6763 if (hci_cp->which) { 6764 u16 handle = __le16_to_cpu(hci_cp->handle); 6765 conn = hci_conn_hash_lookup_handle(hdev, handle); 6766 } else { 6767 conn = NULL; 6768 } 6769 6770 cmd = pending_find_data(MGMT_OP_GET_CLOCK_INFO, hdev, conn); 6771 if (!cmd) 6772 goto unlock; 6773 6774 cmd->cmd_complete(cmd, mgmt_status(status)); 6775 mgmt_pending_remove(cmd); 6776 6777 unlock: 6778 hci_dev_unlock(hdev); 6779 } 6780 6781 static int get_clock_info(struct sock *sk, struct hci_dev *hdev, void *data, 6782 u16 len) 6783 { 6784 struct mgmt_cp_get_clock_info *cp = data; 6785 struct mgmt_rp_get_clock_info rp; 6786 struct hci_cp_read_clock hci_cp; 6787 struct mgmt_pending_cmd *cmd; 6788 struct hci_request req; 6789 struct hci_conn *conn; 6790 int err; 6791 6792 bt_dev_dbg(hdev, "sock %p", sk); 6793 6794 memset(&rp, 0, sizeof(rp)); 6795 bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr); 6796 rp.addr.type = cp->addr.type; 6797 6798 if (cp->addr.type != BDADDR_BREDR) 6799 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CLOCK_INFO, 6800 MGMT_STATUS_INVALID_PARAMS, 6801 &rp, sizeof(rp)); 6802 6803 hci_dev_lock(hdev); 6804 6805 if (!hdev_is_powered(hdev)) { 6806 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CLOCK_INFO, 6807 MGMT_STATUS_NOT_POWERED, &rp, 6808 sizeof(rp)); 6809 goto unlock; 6810 } 6811 6812 if (bacmp(&cp->addr.bdaddr, BDADDR_ANY)) { 6813 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, 6814 &cp->addr.bdaddr); 6815 if (!conn || conn->state != BT_CONNECTED) { 6816 err = mgmt_cmd_complete(sk, hdev->id, 6817 MGMT_OP_GET_CLOCK_INFO, 6818 MGMT_STATUS_NOT_CONNECTED, 6819 &rp, sizeof(rp)); 6820 goto unlock; 6821 } 6822 } else { 6823 conn = NULL; 6824 } 6825 6826 cmd = mgmt_pending_add(sk, MGMT_OP_GET_CLOCK_INFO, hdev, data, len); 6827 if (!cmd) { 6828 err = -ENOMEM; 6829 goto unlock; 6830 } 6831 6832 cmd->cmd_complete = clock_info_cmd_complete; 6833 6834 hci_req_init(&req, hdev); 6835 6836 memset(&hci_cp, 0, sizeof(hci_cp)); 6837 hci_req_add(&req, HCI_OP_READ_CLOCK, sizeof(hci_cp), &hci_cp); 6838 6839 if (conn) { 6840 hci_conn_hold(conn); 6841 cmd->user_data = hci_conn_get(conn); 6842 6843 hci_cp.handle = cpu_to_le16(conn->handle); 6844 hci_cp.which = 0x01; /* Piconet clock */ 6845 hci_req_add(&req, HCI_OP_READ_CLOCK, sizeof(hci_cp), &hci_cp); 6846 } 6847 6848 err = hci_req_run(&req, get_clock_info_complete); 6849 if (err < 0) 6850 mgmt_pending_remove(cmd); 6851 6852 unlock: 6853 hci_dev_unlock(hdev); 6854 return err; 6855 } 6856 6857 static bool is_connected(struct hci_dev *hdev, bdaddr_t *addr, u8 type) 6858 { 6859 struct hci_conn *conn; 6860 6861 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, addr); 6862 if (!conn) 6863 return false; 6864 6865 if (conn->dst_type != type) 6866 return false; 6867 6868 if (conn->state != BT_CONNECTED) 6869 return false; 6870 6871 return true; 6872 } 6873 6874 /* This function requires the caller holds hdev->lock */ 6875 static int hci_conn_params_set(struct hci_dev *hdev, bdaddr_t *addr, 6876 u8 addr_type, u8 auto_connect) 6877 { 6878 struct hci_conn_params *params; 6879 6880 params = hci_conn_params_add(hdev, addr, addr_type); 6881 if (!params) 6882 return -EIO; 6883 6884 if (params->auto_connect == auto_connect) 6885 return 0; 6886 6887 list_del_init(¶ms->action); 6888 6889 switch (auto_connect) { 6890 case HCI_AUTO_CONN_DISABLED: 6891 case HCI_AUTO_CONN_LINK_LOSS: 6892 /* If auto connect is being disabled when we're trying to 6893 * connect to device, keep connecting. 6894 */ 6895 if (params->explicit_connect) 6896 list_add(¶ms->action, &hdev->pend_le_conns); 6897 break; 6898 case HCI_AUTO_CONN_REPORT: 6899 if (params->explicit_connect) 6900 list_add(¶ms->action, &hdev->pend_le_conns); 6901 else 6902 list_add(¶ms->action, &hdev->pend_le_reports); 6903 break; 6904 case HCI_AUTO_CONN_DIRECT: 6905 case HCI_AUTO_CONN_ALWAYS: 6906 if (!is_connected(hdev, addr, addr_type)) 6907 list_add(¶ms->action, &hdev->pend_le_conns); 6908 break; 6909 } 6910 6911 params->auto_connect = auto_connect; 6912 6913 bt_dev_dbg(hdev, "addr %pMR (type %u) auto_connect %u", 6914 addr, addr_type, auto_connect); 6915 6916 return 0; 6917 } 6918 6919 static void device_added(struct sock *sk, struct hci_dev *hdev, 6920 bdaddr_t *bdaddr, u8 type, u8 action) 6921 { 6922 struct mgmt_ev_device_added ev; 6923 6924 bacpy(&ev.addr.bdaddr, bdaddr); 6925 ev.addr.type = type; 6926 ev.action = action; 6927 6928 mgmt_event(MGMT_EV_DEVICE_ADDED, hdev, &ev, sizeof(ev), sk); 6929 } 6930 6931 static int add_device(struct sock *sk, struct hci_dev *hdev, 6932 void *data, u16 len) 6933 { 6934 struct mgmt_cp_add_device *cp = data; 6935 u8 auto_conn, addr_type; 6936 struct hci_conn_params *params; 6937 int err; 6938 u32 current_flags = 0; 6939 6940 bt_dev_dbg(hdev, "sock %p", sk); 6941 6942 if (!bdaddr_type_is_valid(cp->addr.type) || 6943 !bacmp(&cp->addr.bdaddr, BDADDR_ANY)) 6944 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE, 6945 MGMT_STATUS_INVALID_PARAMS, 6946 &cp->addr, sizeof(cp->addr)); 6947 6948 if (cp->action != 0x00 && cp->action != 0x01 && cp->action != 0x02) 6949 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE, 6950 MGMT_STATUS_INVALID_PARAMS, 6951 &cp->addr, sizeof(cp->addr)); 6952 6953 hci_dev_lock(hdev); 6954 6955 if (cp->addr.type == BDADDR_BREDR) { 6956 /* Only incoming connections action is supported for now */ 6957 if (cp->action != 0x01) { 6958 err = mgmt_cmd_complete(sk, hdev->id, 6959 MGMT_OP_ADD_DEVICE, 6960 MGMT_STATUS_INVALID_PARAMS, 6961 &cp->addr, sizeof(cp->addr)); 6962 goto unlock; 6963 } 6964 6965 err = hci_bdaddr_list_add_with_flags(&hdev->accept_list, 6966 &cp->addr.bdaddr, 6967 cp->addr.type, 0); 6968 if (err) 6969 goto unlock; 6970 6971 hci_req_update_scan(hdev); 6972 6973 goto added; 6974 } 6975 6976 addr_type = le_addr_type(cp->addr.type); 6977 6978 if (cp->action == 0x02) 6979 auto_conn = HCI_AUTO_CONN_ALWAYS; 6980 else if (cp->action == 0x01) 6981 auto_conn = HCI_AUTO_CONN_DIRECT; 6982 else 6983 auto_conn = HCI_AUTO_CONN_REPORT; 6984 6985 /* Kernel internally uses conn_params with resolvable private 6986 * address, but Add Device allows only identity addresses. 6987 * Make sure it is enforced before calling 6988 * hci_conn_params_lookup. 6989 */ 6990 if (!hci_is_identity_address(&cp->addr.bdaddr, addr_type)) { 6991 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE, 6992 MGMT_STATUS_INVALID_PARAMS, 6993 &cp->addr, sizeof(cp->addr)); 6994 goto unlock; 6995 } 6996 6997 /* If the connection parameters don't exist for this device, 6998 * they will be created and configured with defaults. 6999 */ 7000 if (hci_conn_params_set(hdev, &cp->addr.bdaddr, addr_type, 7001 auto_conn) < 0) { 7002 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE, 7003 MGMT_STATUS_FAILED, &cp->addr, 7004 sizeof(cp->addr)); 7005 goto unlock; 7006 } else { 7007 params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr, 7008 addr_type); 7009 if (params) 7010 current_flags = params->current_flags; 7011 } 7012 7013 hci_update_background_scan(hdev); 7014 7015 added: 7016 device_added(sk, hdev, &cp->addr.bdaddr, cp->addr.type, cp->action); 7017 device_flags_changed(NULL, hdev, &cp->addr.bdaddr, cp->addr.type, 7018 SUPPORTED_DEVICE_FLAGS(), current_flags); 7019 7020 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE, 7021 MGMT_STATUS_SUCCESS, &cp->addr, 7022 sizeof(cp->addr)); 7023 7024 unlock: 7025 hci_dev_unlock(hdev); 7026 return err; 7027 } 7028 7029 static void device_removed(struct sock *sk, struct hci_dev *hdev, 7030 bdaddr_t *bdaddr, u8 type) 7031 { 7032 struct mgmt_ev_device_removed ev; 7033 7034 bacpy(&ev.addr.bdaddr, bdaddr); 7035 ev.addr.type = type; 7036 7037 mgmt_event(MGMT_EV_DEVICE_REMOVED, hdev, &ev, sizeof(ev), sk); 7038 } 7039 7040 static int remove_device(struct sock *sk, struct hci_dev *hdev, 7041 void *data, u16 len) 7042 { 7043 struct mgmt_cp_remove_device *cp = data; 7044 int err; 7045 7046 bt_dev_dbg(hdev, "sock %p", sk); 7047 7048 hci_dev_lock(hdev); 7049 7050 if (bacmp(&cp->addr.bdaddr, BDADDR_ANY)) { 7051 struct hci_conn_params *params; 7052 u8 addr_type; 7053 7054 if (!bdaddr_type_is_valid(cp->addr.type)) { 7055 err = mgmt_cmd_complete(sk, hdev->id, 7056 MGMT_OP_REMOVE_DEVICE, 7057 MGMT_STATUS_INVALID_PARAMS, 7058 &cp->addr, sizeof(cp->addr)); 7059 goto unlock; 7060 } 7061 7062 if (cp->addr.type == BDADDR_BREDR) { 7063 err = hci_bdaddr_list_del(&hdev->accept_list, 7064 &cp->addr.bdaddr, 7065 cp->addr.type); 7066 if (err) { 7067 err = mgmt_cmd_complete(sk, hdev->id, 7068 MGMT_OP_REMOVE_DEVICE, 7069 MGMT_STATUS_INVALID_PARAMS, 7070 &cp->addr, 7071 sizeof(cp->addr)); 7072 goto unlock; 7073 } 7074 7075 hci_req_update_scan(hdev); 7076 7077 device_removed(sk, hdev, &cp->addr.bdaddr, 7078 cp->addr.type); 7079 goto complete; 7080 } 7081 7082 addr_type = le_addr_type(cp->addr.type); 7083 7084 /* Kernel internally uses conn_params with resolvable private 7085 * address, but Remove Device allows only identity addresses. 7086 * Make sure it is enforced before calling 7087 * hci_conn_params_lookup. 7088 */ 7089 if (!hci_is_identity_address(&cp->addr.bdaddr, addr_type)) { 7090 err = mgmt_cmd_complete(sk, hdev->id, 7091 MGMT_OP_REMOVE_DEVICE, 7092 MGMT_STATUS_INVALID_PARAMS, 7093 &cp->addr, sizeof(cp->addr)); 7094 goto unlock; 7095 } 7096 7097 params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr, 7098 addr_type); 7099 if (!params) { 7100 err = mgmt_cmd_complete(sk, hdev->id, 7101 MGMT_OP_REMOVE_DEVICE, 7102 MGMT_STATUS_INVALID_PARAMS, 7103 &cp->addr, sizeof(cp->addr)); 7104 goto unlock; 7105 } 7106 7107 if (params->auto_connect == HCI_AUTO_CONN_DISABLED || 7108 params->auto_connect == HCI_AUTO_CONN_EXPLICIT) { 7109 err = mgmt_cmd_complete(sk, hdev->id, 7110 MGMT_OP_REMOVE_DEVICE, 7111 MGMT_STATUS_INVALID_PARAMS, 7112 &cp->addr, sizeof(cp->addr)); 7113 goto unlock; 7114 } 7115 7116 list_del(¶ms->action); 7117 list_del(¶ms->list); 7118 kfree(params); 7119 hci_update_background_scan(hdev); 7120 7121 device_removed(sk, hdev, &cp->addr.bdaddr, cp->addr.type); 7122 } else { 7123 struct hci_conn_params *p, *tmp; 7124 struct bdaddr_list *b, *btmp; 7125 7126 if (cp->addr.type) { 7127 err = mgmt_cmd_complete(sk, hdev->id, 7128 MGMT_OP_REMOVE_DEVICE, 7129 MGMT_STATUS_INVALID_PARAMS, 7130 &cp->addr, sizeof(cp->addr)); 7131 goto unlock; 7132 } 7133 7134 list_for_each_entry_safe(b, btmp, &hdev->accept_list, list) { 7135 device_removed(sk, hdev, &b->bdaddr, b->bdaddr_type); 7136 list_del(&b->list); 7137 kfree(b); 7138 } 7139 7140 hci_req_update_scan(hdev); 7141 7142 list_for_each_entry_safe(p, tmp, &hdev->le_conn_params, list) { 7143 if (p->auto_connect == HCI_AUTO_CONN_DISABLED) 7144 continue; 7145 device_removed(sk, hdev, &p->addr, p->addr_type); 7146 if (p->explicit_connect) { 7147 p->auto_connect = HCI_AUTO_CONN_EXPLICIT; 7148 continue; 7149 } 7150 list_del(&p->action); 7151 list_del(&p->list); 7152 kfree(p); 7153 } 7154 7155 bt_dev_dbg(hdev, "All LE connection parameters were removed"); 7156 7157 hci_update_background_scan(hdev); 7158 } 7159 7160 complete: 7161 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_DEVICE, 7162 MGMT_STATUS_SUCCESS, &cp->addr, 7163 sizeof(cp->addr)); 7164 unlock: 7165 hci_dev_unlock(hdev); 7166 return err; 7167 } 7168 7169 static int load_conn_param(struct sock *sk, struct hci_dev *hdev, void *data, 7170 u16 len) 7171 { 7172 struct mgmt_cp_load_conn_param *cp = data; 7173 const u16 max_param_count = ((U16_MAX - sizeof(*cp)) / 7174 sizeof(struct mgmt_conn_param)); 7175 u16 param_count, expected_len; 7176 int i; 7177 7178 if (!lmp_le_capable(hdev)) 7179 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM, 7180 MGMT_STATUS_NOT_SUPPORTED); 7181 7182 param_count = __le16_to_cpu(cp->param_count); 7183 if (param_count > max_param_count) { 7184 bt_dev_err(hdev, "load_conn_param: too big param_count value %u", 7185 param_count); 7186 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM, 7187 MGMT_STATUS_INVALID_PARAMS); 7188 } 7189 7190 expected_len = struct_size(cp, params, param_count); 7191 if (expected_len != len) { 7192 bt_dev_err(hdev, "load_conn_param: expected %u bytes, got %u bytes", 7193 expected_len, len); 7194 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM, 7195 MGMT_STATUS_INVALID_PARAMS); 7196 } 7197 7198 bt_dev_dbg(hdev, "param_count %u", param_count); 7199 7200 hci_dev_lock(hdev); 7201 7202 hci_conn_params_clear_disabled(hdev); 7203 7204 for (i = 0; i < param_count; i++) { 7205 struct mgmt_conn_param *param = &cp->params[i]; 7206 struct hci_conn_params *hci_param; 7207 u16 min, max, latency, timeout; 7208 u8 addr_type; 7209 7210 bt_dev_dbg(hdev, "Adding %pMR (type %u)", ¶m->addr.bdaddr, 7211 param->addr.type); 7212 7213 if (param->addr.type == BDADDR_LE_PUBLIC) { 7214 addr_type = ADDR_LE_DEV_PUBLIC; 7215 } else if (param->addr.type == BDADDR_LE_RANDOM) { 7216 addr_type = ADDR_LE_DEV_RANDOM; 7217 } else { 7218 bt_dev_err(hdev, "ignoring invalid connection parameters"); 7219 continue; 7220 } 7221 7222 min = le16_to_cpu(param->min_interval); 7223 max = le16_to_cpu(param->max_interval); 7224 latency = le16_to_cpu(param->latency); 7225 timeout = le16_to_cpu(param->timeout); 7226 7227 bt_dev_dbg(hdev, "min 0x%04x max 0x%04x latency 0x%04x timeout 0x%04x", 7228 min, max, latency, timeout); 7229 7230 if (hci_check_conn_params(min, max, latency, timeout) < 0) { 7231 bt_dev_err(hdev, "ignoring invalid connection parameters"); 7232 continue; 7233 } 7234 7235 hci_param = hci_conn_params_add(hdev, ¶m->addr.bdaddr, 7236 addr_type); 7237 if (!hci_param) { 7238 bt_dev_err(hdev, "failed to add connection parameters"); 7239 continue; 7240 } 7241 7242 hci_param->conn_min_interval = min; 7243 hci_param->conn_max_interval = max; 7244 hci_param->conn_latency = latency; 7245 hci_param->supervision_timeout = timeout; 7246 } 7247 7248 hci_dev_unlock(hdev); 7249 7250 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM, 0, 7251 NULL, 0); 7252 } 7253 7254 static int set_external_config(struct sock *sk, struct hci_dev *hdev, 7255 void *data, u16 len) 7256 { 7257 struct mgmt_cp_set_external_config *cp = data; 7258 bool changed; 7259 int err; 7260 7261 bt_dev_dbg(hdev, "sock %p", sk); 7262 7263 if (hdev_is_powered(hdev)) 7264 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_EXTERNAL_CONFIG, 7265 MGMT_STATUS_REJECTED); 7266 7267 if (cp->config != 0x00 && cp->config != 0x01) 7268 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_EXTERNAL_CONFIG, 7269 MGMT_STATUS_INVALID_PARAMS); 7270 7271 if (!test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks)) 7272 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_EXTERNAL_CONFIG, 7273 MGMT_STATUS_NOT_SUPPORTED); 7274 7275 hci_dev_lock(hdev); 7276 7277 if (cp->config) 7278 changed = !hci_dev_test_and_set_flag(hdev, HCI_EXT_CONFIGURED); 7279 else 7280 changed = hci_dev_test_and_clear_flag(hdev, HCI_EXT_CONFIGURED); 7281 7282 err = send_options_rsp(sk, MGMT_OP_SET_EXTERNAL_CONFIG, hdev); 7283 if (err < 0) 7284 goto unlock; 7285 7286 if (!changed) 7287 goto unlock; 7288 7289 err = new_options(hdev, sk); 7290 7291 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED) == is_configured(hdev)) { 7292 mgmt_index_removed(hdev); 7293 7294 if (hci_dev_test_and_change_flag(hdev, HCI_UNCONFIGURED)) { 7295 hci_dev_set_flag(hdev, HCI_CONFIG); 7296 hci_dev_set_flag(hdev, HCI_AUTO_OFF); 7297 7298 queue_work(hdev->req_workqueue, &hdev->power_on); 7299 } else { 7300 set_bit(HCI_RAW, &hdev->flags); 7301 mgmt_index_added(hdev); 7302 } 7303 } 7304 7305 unlock: 7306 hci_dev_unlock(hdev); 7307 return err; 7308 } 7309 7310 static int set_public_address(struct sock *sk, struct hci_dev *hdev, 7311 void *data, u16 len) 7312 { 7313 struct mgmt_cp_set_public_address *cp = data; 7314 bool changed; 7315 int err; 7316 7317 bt_dev_dbg(hdev, "sock %p", sk); 7318 7319 if (hdev_is_powered(hdev)) 7320 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PUBLIC_ADDRESS, 7321 MGMT_STATUS_REJECTED); 7322 7323 if (!bacmp(&cp->bdaddr, BDADDR_ANY)) 7324 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PUBLIC_ADDRESS, 7325 MGMT_STATUS_INVALID_PARAMS); 7326 7327 if (!hdev->set_bdaddr) 7328 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PUBLIC_ADDRESS, 7329 MGMT_STATUS_NOT_SUPPORTED); 7330 7331 hci_dev_lock(hdev); 7332 7333 changed = !!bacmp(&hdev->public_addr, &cp->bdaddr); 7334 bacpy(&hdev->public_addr, &cp->bdaddr); 7335 7336 err = send_options_rsp(sk, MGMT_OP_SET_PUBLIC_ADDRESS, hdev); 7337 if (err < 0) 7338 goto unlock; 7339 7340 if (!changed) 7341 goto unlock; 7342 7343 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) 7344 err = new_options(hdev, sk); 7345 7346 if (is_configured(hdev)) { 7347 mgmt_index_removed(hdev); 7348 7349 hci_dev_clear_flag(hdev, HCI_UNCONFIGURED); 7350 7351 hci_dev_set_flag(hdev, HCI_CONFIG); 7352 hci_dev_set_flag(hdev, HCI_AUTO_OFF); 7353 7354 queue_work(hdev->req_workqueue, &hdev->power_on); 7355 } 7356 7357 unlock: 7358 hci_dev_unlock(hdev); 7359 return err; 7360 } 7361 7362 static void read_local_oob_ext_data_complete(struct hci_dev *hdev, u8 status, 7363 u16 opcode, struct sk_buff *skb) 7364 { 7365 const struct mgmt_cp_read_local_oob_ext_data *mgmt_cp; 7366 struct mgmt_rp_read_local_oob_ext_data *mgmt_rp; 7367 u8 *h192, *r192, *h256, *r256; 7368 struct mgmt_pending_cmd *cmd; 7369 u16 eir_len; 7370 int err; 7371 7372 bt_dev_dbg(hdev, "status %u", status); 7373 7374 cmd = pending_find(MGMT_OP_READ_LOCAL_OOB_EXT_DATA, hdev); 7375 if (!cmd) 7376 return; 7377 7378 mgmt_cp = cmd->param; 7379 7380 if (status) { 7381 status = mgmt_status(status); 7382 eir_len = 0; 7383 7384 h192 = NULL; 7385 r192 = NULL; 7386 h256 = NULL; 7387 r256 = NULL; 7388 } else if (opcode == HCI_OP_READ_LOCAL_OOB_DATA) { 7389 struct hci_rp_read_local_oob_data *rp; 7390 7391 if (skb->len != sizeof(*rp)) { 7392 status = MGMT_STATUS_FAILED; 7393 eir_len = 0; 7394 } else { 7395 status = MGMT_STATUS_SUCCESS; 7396 rp = (void *)skb->data; 7397 7398 eir_len = 5 + 18 + 18; 7399 h192 = rp->hash; 7400 r192 = rp->rand; 7401 h256 = NULL; 7402 r256 = NULL; 7403 } 7404 } else { 7405 struct hci_rp_read_local_oob_ext_data *rp; 7406 7407 if (skb->len != sizeof(*rp)) { 7408 status = MGMT_STATUS_FAILED; 7409 eir_len = 0; 7410 } else { 7411 status = MGMT_STATUS_SUCCESS; 7412 rp = (void *)skb->data; 7413 7414 if (hci_dev_test_flag(hdev, HCI_SC_ONLY)) { 7415 eir_len = 5 + 18 + 18; 7416 h192 = NULL; 7417 r192 = NULL; 7418 } else { 7419 eir_len = 5 + 18 + 18 + 18 + 18; 7420 h192 = rp->hash192; 7421 r192 = rp->rand192; 7422 } 7423 7424 h256 = rp->hash256; 7425 r256 = rp->rand256; 7426 } 7427 } 7428 7429 mgmt_rp = kmalloc(sizeof(*mgmt_rp) + eir_len, GFP_KERNEL); 7430 if (!mgmt_rp) 7431 goto done; 7432 7433 if (eir_len == 0) 7434 goto send_rsp; 7435 7436 eir_len = eir_append_data(mgmt_rp->eir, 0, EIR_CLASS_OF_DEV, 7437 hdev->dev_class, 3); 7438 7439 if (h192 && r192) { 7440 eir_len = eir_append_data(mgmt_rp->eir, eir_len, 7441 EIR_SSP_HASH_C192, h192, 16); 7442 eir_len = eir_append_data(mgmt_rp->eir, eir_len, 7443 EIR_SSP_RAND_R192, r192, 16); 7444 } 7445 7446 if (h256 && r256) { 7447 eir_len = eir_append_data(mgmt_rp->eir, eir_len, 7448 EIR_SSP_HASH_C256, h256, 16); 7449 eir_len = eir_append_data(mgmt_rp->eir, eir_len, 7450 EIR_SSP_RAND_R256, r256, 16); 7451 } 7452 7453 send_rsp: 7454 mgmt_rp->type = mgmt_cp->type; 7455 mgmt_rp->eir_len = cpu_to_le16(eir_len); 7456 7457 err = mgmt_cmd_complete(cmd->sk, hdev->id, 7458 MGMT_OP_READ_LOCAL_OOB_EXT_DATA, status, 7459 mgmt_rp, sizeof(*mgmt_rp) + eir_len); 7460 if (err < 0 || status) 7461 goto done; 7462 7463 hci_sock_set_flag(cmd->sk, HCI_MGMT_OOB_DATA_EVENTS); 7464 7465 err = mgmt_limited_event(MGMT_EV_LOCAL_OOB_DATA_UPDATED, hdev, 7466 mgmt_rp, sizeof(*mgmt_rp) + eir_len, 7467 HCI_MGMT_OOB_DATA_EVENTS, cmd->sk); 7468 done: 7469 kfree(mgmt_rp); 7470 mgmt_pending_remove(cmd); 7471 } 7472 7473 static int read_local_ssp_oob_req(struct hci_dev *hdev, struct sock *sk, 7474 struct mgmt_cp_read_local_oob_ext_data *cp) 7475 { 7476 struct mgmt_pending_cmd *cmd; 7477 struct hci_request req; 7478 int err; 7479 7480 cmd = mgmt_pending_add(sk, MGMT_OP_READ_LOCAL_OOB_EXT_DATA, hdev, 7481 cp, sizeof(*cp)); 7482 if (!cmd) 7483 return -ENOMEM; 7484 7485 hci_req_init(&req, hdev); 7486 7487 if (bredr_sc_enabled(hdev)) 7488 hci_req_add(&req, HCI_OP_READ_LOCAL_OOB_EXT_DATA, 0, NULL); 7489 else 7490 hci_req_add(&req, HCI_OP_READ_LOCAL_OOB_DATA, 0, NULL); 7491 7492 err = hci_req_run_skb(&req, read_local_oob_ext_data_complete); 7493 if (err < 0) { 7494 mgmt_pending_remove(cmd); 7495 return err; 7496 } 7497 7498 return 0; 7499 } 7500 7501 static int read_local_oob_ext_data(struct sock *sk, struct hci_dev *hdev, 7502 void *data, u16 data_len) 7503 { 7504 struct mgmt_cp_read_local_oob_ext_data *cp = data; 7505 struct mgmt_rp_read_local_oob_ext_data *rp; 7506 size_t rp_len; 7507 u16 eir_len; 7508 u8 status, flags, role, addr[7], hash[16], rand[16]; 7509 int err; 7510 7511 bt_dev_dbg(hdev, "sock %p", sk); 7512 7513 if (hdev_is_powered(hdev)) { 7514 switch (cp->type) { 7515 case BIT(BDADDR_BREDR): 7516 status = mgmt_bredr_support(hdev); 7517 if (status) 7518 eir_len = 0; 7519 else 7520 eir_len = 5; 7521 break; 7522 case (BIT(BDADDR_LE_PUBLIC) | BIT(BDADDR_LE_RANDOM)): 7523 status = mgmt_le_support(hdev); 7524 if (status) 7525 eir_len = 0; 7526 else 7527 eir_len = 9 + 3 + 18 + 18 + 3; 7528 break; 7529 default: 7530 status = MGMT_STATUS_INVALID_PARAMS; 7531 eir_len = 0; 7532 break; 7533 } 7534 } else { 7535 status = MGMT_STATUS_NOT_POWERED; 7536 eir_len = 0; 7537 } 7538 7539 rp_len = sizeof(*rp) + eir_len; 7540 rp = kmalloc(rp_len, GFP_ATOMIC); 7541 if (!rp) 7542 return -ENOMEM; 7543 7544 if (!status && !lmp_ssp_capable(hdev)) { 7545 status = MGMT_STATUS_NOT_SUPPORTED; 7546 eir_len = 0; 7547 } 7548 7549 if (status) 7550 goto complete; 7551 7552 hci_dev_lock(hdev); 7553 7554 eir_len = 0; 7555 switch (cp->type) { 7556 case BIT(BDADDR_BREDR): 7557 if (hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) { 7558 err = read_local_ssp_oob_req(hdev, sk, cp); 7559 hci_dev_unlock(hdev); 7560 if (!err) 7561 goto done; 7562 7563 status = MGMT_STATUS_FAILED; 7564 goto complete; 7565 } else { 7566 eir_len = eir_append_data(rp->eir, eir_len, 7567 EIR_CLASS_OF_DEV, 7568 hdev->dev_class, 3); 7569 } 7570 break; 7571 case (BIT(BDADDR_LE_PUBLIC) | BIT(BDADDR_LE_RANDOM)): 7572 if (hci_dev_test_flag(hdev, HCI_SC_ENABLED) && 7573 smp_generate_oob(hdev, hash, rand) < 0) { 7574 hci_dev_unlock(hdev); 7575 status = MGMT_STATUS_FAILED; 7576 goto complete; 7577 } 7578 7579 /* This should return the active RPA, but since the RPA 7580 * is only programmed on demand, it is really hard to fill 7581 * this in at the moment. For now disallow retrieving 7582 * local out-of-band data when privacy is in use. 7583 * 7584 * Returning the identity address will not help here since 7585 * pairing happens before the identity resolving key is 7586 * known and thus the connection establishment happens 7587 * based on the RPA and not the identity address. 7588 */ 7589 if (hci_dev_test_flag(hdev, HCI_PRIVACY)) { 7590 hci_dev_unlock(hdev); 7591 status = MGMT_STATUS_REJECTED; 7592 goto complete; 7593 } 7594 7595 if (hci_dev_test_flag(hdev, HCI_FORCE_STATIC_ADDR) || 7596 !bacmp(&hdev->bdaddr, BDADDR_ANY) || 7597 (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) && 7598 bacmp(&hdev->static_addr, BDADDR_ANY))) { 7599 memcpy(addr, &hdev->static_addr, 6); 7600 addr[6] = 0x01; 7601 } else { 7602 memcpy(addr, &hdev->bdaddr, 6); 7603 addr[6] = 0x00; 7604 } 7605 7606 eir_len = eir_append_data(rp->eir, eir_len, EIR_LE_BDADDR, 7607 addr, sizeof(addr)); 7608 7609 if (hci_dev_test_flag(hdev, HCI_ADVERTISING)) 7610 role = 0x02; 7611 else 7612 role = 0x01; 7613 7614 eir_len = eir_append_data(rp->eir, eir_len, EIR_LE_ROLE, 7615 &role, sizeof(role)); 7616 7617 if (hci_dev_test_flag(hdev, HCI_SC_ENABLED)) { 7618 eir_len = eir_append_data(rp->eir, eir_len, 7619 EIR_LE_SC_CONFIRM, 7620 hash, sizeof(hash)); 7621 7622 eir_len = eir_append_data(rp->eir, eir_len, 7623 EIR_LE_SC_RANDOM, 7624 rand, sizeof(rand)); 7625 } 7626 7627 flags = mgmt_get_adv_discov_flags(hdev); 7628 7629 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) 7630 flags |= LE_AD_NO_BREDR; 7631 7632 eir_len = eir_append_data(rp->eir, eir_len, EIR_FLAGS, 7633 &flags, sizeof(flags)); 7634 break; 7635 } 7636 7637 hci_dev_unlock(hdev); 7638 7639 hci_sock_set_flag(sk, HCI_MGMT_OOB_DATA_EVENTS); 7640 7641 status = MGMT_STATUS_SUCCESS; 7642 7643 complete: 7644 rp->type = cp->type; 7645 rp->eir_len = cpu_to_le16(eir_len); 7646 7647 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_EXT_DATA, 7648 status, rp, sizeof(*rp) + eir_len); 7649 if (err < 0 || status) 7650 goto done; 7651 7652 err = mgmt_limited_event(MGMT_EV_LOCAL_OOB_DATA_UPDATED, hdev, 7653 rp, sizeof(*rp) + eir_len, 7654 HCI_MGMT_OOB_DATA_EVENTS, sk); 7655 7656 done: 7657 kfree(rp); 7658 7659 return err; 7660 } 7661 7662 static u32 get_supported_adv_flags(struct hci_dev *hdev) 7663 { 7664 u32 flags = 0; 7665 7666 flags |= MGMT_ADV_FLAG_CONNECTABLE; 7667 flags |= MGMT_ADV_FLAG_DISCOV; 7668 flags |= MGMT_ADV_FLAG_LIMITED_DISCOV; 7669 flags |= MGMT_ADV_FLAG_MANAGED_FLAGS; 7670 flags |= MGMT_ADV_FLAG_APPEARANCE; 7671 flags |= MGMT_ADV_FLAG_LOCAL_NAME; 7672 flags |= MGMT_ADV_PARAM_DURATION; 7673 flags |= MGMT_ADV_PARAM_TIMEOUT; 7674 flags |= MGMT_ADV_PARAM_INTERVALS; 7675 flags |= MGMT_ADV_PARAM_TX_POWER; 7676 flags |= MGMT_ADV_PARAM_SCAN_RSP; 7677 7678 /* In extended adv TX_POWER returned from Set Adv Param 7679 * will be always valid. 7680 */ 7681 if ((hdev->adv_tx_power != HCI_TX_POWER_INVALID) || 7682 ext_adv_capable(hdev)) 7683 flags |= MGMT_ADV_FLAG_TX_POWER; 7684 7685 if (ext_adv_capable(hdev)) { 7686 flags |= MGMT_ADV_FLAG_SEC_1M; 7687 flags |= MGMT_ADV_FLAG_HW_OFFLOAD; 7688 flags |= MGMT_ADV_FLAG_CAN_SET_TX_POWER; 7689 7690 if (hdev->le_features[1] & HCI_LE_PHY_2M) 7691 flags |= MGMT_ADV_FLAG_SEC_2M; 7692 7693 if (hdev->le_features[1] & HCI_LE_PHY_CODED) 7694 flags |= MGMT_ADV_FLAG_SEC_CODED; 7695 } 7696 7697 return flags; 7698 } 7699 7700 static int read_adv_features(struct sock *sk, struct hci_dev *hdev, 7701 void *data, u16 data_len) 7702 { 7703 struct mgmt_rp_read_adv_features *rp; 7704 size_t rp_len; 7705 int err; 7706 struct adv_info *adv_instance; 7707 u32 supported_flags; 7708 u8 *instance; 7709 7710 bt_dev_dbg(hdev, "sock %p", sk); 7711 7712 if (!lmp_le_capable(hdev)) 7713 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_ADV_FEATURES, 7714 MGMT_STATUS_REJECTED); 7715 7716 /* Enabling the experimental LL Privay support disables support for 7717 * advertising. 7718 */ 7719 if (hci_dev_test_flag(hdev, HCI_ENABLE_LL_PRIVACY)) 7720 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_ADV_FEATURES, 7721 MGMT_STATUS_NOT_SUPPORTED); 7722 7723 hci_dev_lock(hdev); 7724 7725 rp_len = sizeof(*rp) + hdev->adv_instance_cnt; 7726 rp = kmalloc(rp_len, GFP_ATOMIC); 7727 if (!rp) { 7728 hci_dev_unlock(hdev); 7729 return -ENOMEM; 7730 } 7731 7732 supported_flags = get_supported_adv_flags(hdev); 7733 7734 rp->supported_flags = cpu_to_le32(supported_flags); 7735 rp->max_adv_data_len = HCI_MAX_AD_LENGTH; 7736 rp->max_scan_rsp_len = HCI_MAX_AD_LENGTH; 7737 rp->max_instances = hdev->le_num_of_adv_sets; 7738 rp->num_instances = hdev->adv_instance_cnt; 7739 7740 instance = rp->instance; 7741 list_for_each_entry(adv_instance, &hdev->adv_instances, list) { 7742 *instance = adv_instance->instance; 7743 instance++; 7744 } 7745 7746 hci_dev_unlock(hdev); 7747 7748 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_ADV_FEATURES, 7749 MGMT_STATUS_SUCCESS, rp, rp_len); 7750 7751 kfree(rp); 7752 7753 return err; 7754 } 7755 7756 static u8 calculate_name_len(struct hci_dev *hdev) 7757 { 7758 u8 buf[HCI_MAX_SHORT_NAME_LENGTH + 3]; 7759 7760 return eir_append_local_name(hdev, buf, 0); 7761 } 7762 7763 static u8 tlv_data_max_len(struct hci_dev *hdev, u32 adv_flags, 7764 bool is_adv_data) 7765 { 7766 u8 max_len = HCI_MAX_AD_LENGTH; 7767 7768 if (is_adv_data) { 7769 if (adv_flags & (MGMT_ADV_FLAG_DISCOV | 7770 MGMT_ADV_FLAG_LIMITED_DISCOV | 7771 MGMT_ADV_FLAG_MANAGED_FLAGS)) 7772 max_len -= 3; 7773 7774 if (adv_flags & MGMT_ADV_FLAG_TX_POWER) 7775 max_len -= 3; 7776 } else { 7777 if (adv_flags & MGMT_ADV_FLAG_LOCAL_NAME) 7778 max_len -= calculate_name_len(hdev); 7779 7780 if (adv_flags & (MGMT_ADV_FLAG_APPEARANCE)) 7781 max_len -= 4; 7782 } 7783 7784 return max_len; 7785 } 7786 7787 static bool flags_managed(u32 adv_flags) 7788 { 7789 return adv_flags & (MGMT_ADV_FLAG_DISCOV | 7790 MGMT_ADV_FLAG_LIMITED_DISCOV | 7791 MGMT_ADV_FLAG_MANAGED_FLAGS); 7792 } 7793 7794 static bool tx_power_managed(u32 adv_flags) 7795 { 7796 return adv_flags & MGMT_ADV_FLAG_TX_POWER; 7797 } 7798 7799 static bool name_managed(u32 adv_flags) 7800 { 7801 return adv_flags & MGMT_ADV_FLAG_LOCAL_NAME; 7802 } 7803 7804 static bool appearance_managed(u32 adv_flags) 7805 { 7806 return adv_flags & MGMT_ADV_FLAG_APPEARANCE; 7807 } 7808 7809 static bool tlv_data_is_valid(struct hci_dev *hdev, u32 adv_flags, u8 *data, 7810 u8 len, bool is_adv_data) 7811 { 7812 int i, cur_len; 7813 u8 max_len; 7814 7815 max_len = tlv_data_max_len(hdev, adv_flags, is_adv_data); 7816 7817 if (len > max_len) 7818 return false; 7819 7820 /* Make sure that the data is correctly formatted. */ 7821 for (i = 0, cur_len = 0; i < len; i += (cur_len + 1)) { 7822 cur_len = data[i]; 7823 7824 if (!cur_len) 7825 continue; 7826 7827 if (data[i + 1] == EIR_FLAGS && 7828 (!is_adv_data || flags_managed(adv_flags))) 7829 return false; 7830 7831 if (data[i + 1] == EIR_TX_POWER && tx_power_managed(adv_flags)) 7832 return false; 7833 7834 if (data[i + 1] == EIR_NAME_COMPLETE && name_managed(adv_flags)) 7835 return false; 7836 7837 if (data[i + 1] == EIR_NAME_SHORT && name_managed(adv_flags)) 7838 return false; 7839 7840 if (data[i + 1] == EIR_APPEARANCE && 7841 appearance_managed(adv_flags)) 7842 return false; 7843 7844 /* If the current field length would exceed the total data 7845 * length, then it's invalid. 7846 */ 7847 if (i + cur_len >= len) 7848 return false; 7849 } 7850 7851 return true; 7852 } 7853 7854 static bool requested_adv_flags_are_valid(struct hci_dev *hdev, u32 adv_flags) 7855 { 7856 u32 supported_flags, phy_flags; 7857 7858 /* The current implementation only supports a subset of the specified 7859 * flags. Also need to check mutual exclusiveness of sec flags. 7860 */ 7861 supported_flags = get_supported_adv_flags(hdev); 7862 phy_flags = adv_flags & MGMT_ADV_FLAG_SEC_MASK; 7863 if (adv_flags & ~supported_flags || 7864 ((phy_flags && (phy_flags ^ (phy_flags & -phy_flags))))) 7865 return false; 7866 7867 return true; 7868 } 7869 7870 static bool adv_busy(struct hci_dev *hdev) 7871 { 7872 return (pending_find(MGMT_OP_ADD_ADVERTISING, hdev) || 7873 pending_find(MGMT_OP_REMOVE_ADVERTISING, hdev) || 7874 pending_find(MGMT_OP_SET_LE, hdev) || 7875 pending_find(MGMT_OP_ADD_EXT_ADV_PARAMS, hdev) || 7876 pending_find(MGMT_OP_ADD_EXT_ADV_DATA, hdev)); 7877 } 7878 7879 static void add_advertising_complete(struct hci_dev *hdev, u8 status, 7880 u16 opcode) 7881 { 7882 struct mgmt_pending_cmd *cmd; 7883 struct mgmt_cp_add_advertising *cp; 7884 struct mgmt_rp_add_advertising rp; 7885 struct adv_info *adv_instance, *n; 7886 u8 instance; 7887 7888 bt_dev_dbg(hdev, "status %u", status); 7889 7890 hci_dev_lock(hdev); 7891 7892 cmd = pending_find(MGMT_OP_ADD_ADVERTISING, hdev); 7893 if (!cmd) 7894 cmd = pending_find(MGMT_OP_ADD_EXT_ADV_DATA, hdev); 7895 7896 list_for_each_entry_safe(adv_instance, n, &hdev->adv_instances, list) { 7897 if (!adv_instance->pending) 7898 continue; 7899 7900 if (!status) { 7901 adv_instance->pending = false; 7902 continue; 7903 } 7904 7905 instance = adv_instance->instance; 7906 7907 if (hdev->cur_adv_instance == instance) 7908 cancel_adv_timeout(hdev); 7909 7910 hci_remove_adv_instance(hdev, instance); 7911 mgmt_advertising_removed(cmd ? cmd->sk : NULL, hdev, instance); 7912 } 7913 7914 if (!cmd) 7915 goto unlock; 7916 7917 cp = cmd->param; 7918 rp.instance = cp->instance; 7919 7920 if (status) 7921 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, 7922 mgmt_status(status)); 7923 else 7924 mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, 7925 mgmt_status(status), &rp, sizeof(rp)); 7926 7927 mgmt_pending_remove(cmd); 7928 7929 unlock: 7930 hci_dev_unlock(hdev); 7931 } 7932 7933 static int add_advertising(struct sock *sk, struct hci_dev *hdev, 7934 void *data, u16 data_len) 7935 { 7936 struct mgmt_cp_add_advertising *cp = data; 7937 struct mgmt_rp_add_advertising rp; 7938 u32 flags; 7939 u8 status; 7940 u16 timeout, duration; 7941 unsigned int prev_instance_cnt = hdev->adv_instance_cnt; 7942 u8 schedule_instance = 0; 7943 struct adv_info *next_instance; 7944 int err; 7945 struct mgmt_pending_cmd *cmd; 7946 struct hci_request req; 7947 7948 bt_dev_dbg(hdev, "sock %p", sk); 7949 7950 status = mgmt_le_support(hdev); 7951 if (status) 7952 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING, 7953 status); 7954 7955 /* Enabling the experimental LL Privay support disables support for 7956 * advertising. 7957 */ 7958 if (hci_dev_test_flag(hdev, HCI_ENABLE_LL_PRIVACY)) 7959 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING, 7960 MGMT_STATUS_NOT_SUPPORTED); 7961 7962 if (cp->instance < 1 || cp->instance > hdev->le_num_of_adv_sets) 7963 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING, 7964 MGMT_STATUS_INVALID_PARAMS); 7965 7966 if (data_len != sizeof(*cp) + cp->adv_data_len + cp->scan_rsp_len) 7967 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING, 7968 MGMT_STATUS_INVALID_PARAMS); 7969 7970 flags = __le32_to_cpu(cp->flags); 7971 timeout = __le16_to_cpu(cp->timeout); 7972 duration = __le16_to_cpu(cp->duration); 7973 7974 if (!requested_adv_flags_are_valid(hdev, flags)) 7975 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING, 7976 MGMT_STATUS_INVALID_PARAMS); 7977 7978 hci_dev_lock(hdev); 7979 7980 if (timeout && !hdev_is_powered(hdev)) { 7981 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING, 7982 MGMT_STATUS_REJECTED); 7983 goto unlock; 7984 } 7985 7986 if (adv_busy(hdev)) { 7987 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING, 7988 MGMT_STATUS_BUSY); 7989 goto unlock; 7990 } 7991 7992 if (!tlv_data_is_valid(hdev, flags, cp->data, cp->adv_data_len, true) || 7993 !tlv_data_is_valid(hdev, flags, cp->data + cp->adv_data_len, 7994 cp->scan_rsp_len, false)) { 7995 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING, 7996 MGMT_STATUS_INVALID_PARAMS); 7997 goto unlock; 7998 } 7999 8000 err = hci_add_adv_instance(hdev, cp->instance, flags, 8001 cp->adv_data_len, cp->data, 8002 cp->scan_rsp_len, 8003 cp->data + cp->adv_data_len, 8004 timeout, duration, 8005 HCI_ADV_TX_POWER_NO_PREFERENCE, 8006 hdev->le_adv_min_interval, 8007 hdev->le_adv_max_interval); 8008 if (err < 0) { 8009 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING, 8010 MGMT_STATUS_FAILED); 8011 goto unlock; 8012 } 8013 8014 /* Only trigger an advertising added event if a new instance was 8015 * actually added. 8016 */ 8017 if (hdev->adv_instance_cnt > prev_instance_cnt) 8018 mgmt_advertising_added(sk, hdev, cp->instance); 8019 8020 if (hdev->cur_adv_instance == cp->instance) { 8021 /* If the currently advertised instance is being changed then 8022 * cancel the current advertising and schedule the next 8023 * instance. If there is only one instance then the overridden 8024 * advertising data will be visible right away. 8025 */ 8026 cancel_adv_timeout(hdev); 8027 8028 next_instance = hci_get_next_instance(hdev, cp->instance); 8029 if (next_instance) 8030 schedule_instance = next_instance->instance; 8031 } else if (!hdev->adv_instance_timeout) { 8032 /* Immediately advertise the new instance if no other 8033 * instance is currently being advertised. 8034 */ 8035 schedule_instance = cp->instance; 8036 } 8037 8038 /* If the HCI_ADVERTISING flag is set or the device isn't powered or 8039 * there is no instance to be advertised then we have no HCI 8040 * communication to make. Simply return. 8041 */ 8042 if (!hdev_is_powered(hdev) || 8043 hci_dev_test_flag(hdev, HCI_ADVERTISING) || 8044 !schedule_instance) { 8045 rp.instance = cp->instance; 8046 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_ADVERTISING, 8047 MGMT_STATUS_SUCCESS, &rp, sizeof(rp)); 8048 goto unlock; 8049 } 8050 8051 /* We're good to go, update advertising data, parameters, and start 8052 * advertising. 8053 */ 8054 cmd = mgmt_pending_add(sk, MGMT_OP_ADD_ADVERTISING, hdev, data, 8055 data_len); 8056 if (!cmd) { 8057 err = -ENOMEM; 8058 goto unlock; 8059 } 8060 8061 hci_req_init(&req, hdev); 8062 8063 err = __hci_req_schedule_adv_instance(&req, schedule_instance, true); 8064 8065 if (!err) 8066 err = hci_req_run(&req, add_advertising_complete); 8067 8068 if (err < 0) { 8069 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING, 8070 MGMT_STATUS_FAILED); 8071 mgmt_pending_remove(cmd); 8072 } 8073 8074 unlock: 8075 hci_dev_unlock(hdev); 8076 8077 return err; 8078 } 8079 8080 static void add_ext_adv_params_complete(struct hci_dev *hdev, u8 status, 8081 u16 opcode) 8082 { 8083 struct mgmt_pending_cmd *cmd; 8084 struct mgmt_cp_add_ext_adv_params *cp; 8085 struct mgmt_rp_add_ext_adv_params rp; 8086 struct adv_info *adv_instance; 8087 u32 flags; 8088 8089 BT_DBG("%s", hdev->name); 8090 8091 hci_dev_lock(hdev); 8092 8093 cmd = pending_find(MGMT_OP_ADD_EXT_ADV_PARAMS, hdev); 8094 if (!cmd) 8095 goto unlock; 8096 8097 cp = cmd->param; 8098 adv_instance = hci_find_adv_instance(hdev, cp->instance); 8099 if (!adv_instance) 8100 goto unlock; 8101 8102 rp.instance = cp->instance; 8103 rp.tx_power = adv_instance->tx_power; 8104 8105 /* While we're at it, inform userspace of the available space for this 8106 * advertisement, given the flags that will be used. 8107 */ 8108 flags = __le32_to_cpu(cp->flags); 8109 rp.max_adv_data_len = tlv_data_max_len(hdev, flags, true); 8110 rp.max_scan_rsp_len = tlv_data_max_len(hdev, flags, false); 8111 8112 if (status) { 8113 /* If this advertisement was previously advertising and we 8114 * failed to update it, we signal that it has been removed and 8115 * delete its structure 8116 */ 8117 if (!adv_instance->pending) 8118 mgmt_advertising_removed(cmd->sk, hdev, cp->instance); 8119 8120 hci_remove_adv_instance(hdev, cp->instance); 8121 8122 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, 8123 mgmt_status(status)); 8124 8125 } else { 8126 mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, 8127 mgmt_status(status), &rp, sizeof(rp)); 8128 } 8129 8130 unlock: 8131 if (cmd) 8132 mgmt_pending_remove(cmd); 8133 8134 hci_dev_unlock(hdev); 8135 } 8136 8137 static int add_ext_adv_params(struct sock *sk, struct hci_dev *hdev, 8138 void *data, u16 data_len) 8139 { 8140 struct mgmt_cp_add_ext_adv_params *cp = data; 8141 struct mgmt_rp_add_ext_adv_params rp; 8142 struct mgmt_pending_cmd *cmd = NULL; 8143 struct adv_info *adv_instance; 8144 struct hci_request req; 8145 u32 flags, min_interval, max_interval; 8146 u16 timeout, duration; 8147 u8 status; 8148 s8 tx_power; 8149 int err; 8150 8151 BT_DBG("%s", hdev->name); 8152 8153 status = mgmt_le_support(hdev); 8154 if (status) 8155 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_PARAMS, 8156 status); 8157 8158 if (cp->instance < 1 || cp->instance > hdev->le_num_of_adv_sets) 8159 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_PARAMS, 8160 MGMT_STATUS_INVALID_PARAMS); 8161 8162 /* The purpose of breaking add_advertising into two separate MGMT calls 8163 * for params and data is to allow more parameters to be added to this 8164 * structure in the future. For this reason, we verify that we have the 8165 * bare minimum structure we know of when the interface was defined. Any 8166 * extra parameters we don't know about will be ignored in this request. 8167 */ 8168 if (data_len < MGMT_ADD_EXT_ADV_PARAMS_MIN_SIZE) 8169 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING, 8170 MGMT_STATUS_INVALID_PARAMS); 8171 8172 flags = __le32_to_cpu(cp->flags); 8173 8174 if (!requested_adv_flags_are_valid(hdev, flags)) 8175 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_PARAMS, 8176 MGMT_STATUS_INVALID_PARAMS); 8177 8178 hci_dev_lock(hdev); 8179 8180 /* In new interface, we require that we are powered to register */ 8181 if (!hdev_is_powered(hdev)) { 8182 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_PARAMS, 8183 MGMT_STATUS_REJECTED); 8184 goto unlock; 8185 } 8186 8187 if (adv_busy(hdev)) { 8188 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_PARAMS, 8189 MGMT_STATUS_BUSY); 8190 goto unlock; 8191 } 8192 8193 /* Parse defined parameters from request, use defaults otherwise */ 8194 timeout = (flags & MGMT_ADV_PARAM_TIMEOUT) ? 8195 __le16_to_cpu(cp->timeout) : 0; 8196 8197 duration = (flags & MGMT_ADV_PARAM_DURATION) ? 8198 __le16_to_cpu(cp->duration) : 8199 hdev->def_multi_adv_rotation_duration; 8200 8201 min_interval = (flags & MGMT_ADV_PARAM_INTERVALS) ? 8202 __le32_to_cpu(cp->min_interval) : 8203 hdev->le_adv_min_interval; 8204 8205 max_interval = (flags & MGMT_ADV_PARAM_INTERVALS) ? 8206 __le32_to_cpu(cp->max_interval) : 8207 hdev->le_adv_max_interval; 8208 8209 tx_power = (flags & MGMT_ADV_PARAM_TX_POWER) ? 8210 cp->tx_power : 8211 HCI_ADV_TX_POWER_NO_PREFERENCE; 8212 8213 /* Create advertising instance with no advertising or response data */ 8214 err = hci_add_adv_instance(hdev, cp->instance, flags, 8215 0, NULL, 0, NULL, timeout, duration, 8216 tx_power, min_interval, max_interval); 8217 8218 if (err < 0) { 8219 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_PARAMS, 8220 MGMT_STATUS_FAILED); 8221 goto unlock; 8222 } 8223 8224 /* Submit request for advertising params if ext adv available */ 8225 if (ext_adv_capable(hdev)) { 8226 hci_req_init(&req, hdev); 8227 adv_instance = hci_find_adv_instance(hdev, cp->instance); 8228 8229 /* Updating parameters of an active instance will return a 8230 * Command Disallowed error, so we must first disable the 8231 * instance if it is active. 8232 */ 8233 if (!adv_instance->pending) 8234 __hci_req_disable_ext_adv_instance(&req, cp->instance); 8235 8236 __hci_req_setup_ext_adv_instance(&req, cp->instance); 8237 8238 err = hci_req_run(&req, add_ext_adv_params_complete); 8239 8240 if (!err) 8241 cmd = mgmt_pending_add(sk, MGMT_OP_ADD_EXT_ADV_PARAMS, 8242 hdev, data, data_len); 8243 if (!cmd) { 8244 err = -ENOMEM; 8245 hci_remove_adv_instance(hdev, cp->instance); 8246 goto unlock; 8247 } 8248 8249 } else { 8250 rp.instance = cp->instance; 8251 rp.tx_power = HCI_ADV_TX_POWER_NO_PREFERENCE; 8252 rp.max_adv_data_len = tlv_data_max_len(hdev, flags, true); 8253 rp.max_scan_rsp_len = tlv_data_max_len(hdev, flags, false); 8254 err = mgmt_cmd_complete(sk, hdev->id, 8255 MGMT_OP_ADD_EXT_ADV_PARAMS, 8256 MGMT_STATUS_SUCCESS, &rp, sizeof(rp)); 8257 } 8258 8259 unlock: 8260 hci_dev_unlock(hdev); 8261 8262 return err; 8263 } 8264 8265 static int add_ext_adv_data(struct sock *sk, struct hci_dev *hdev, void *data, 8266 u16 data_len) 8267 { 8268 struct mgmt_cp_add_ext_adv_data *cp = data; 8269 struct mgmt_rp_add_ext_adv_data rp; 8270 u8 schedule_instance = 0; 8271 struct adv_info *next_instance; 8272 struct adv_info *adv_instance; 8273 int err = 0; 8274 struct mgmt_pending_cmd *cmd; 8275 struct hci_request req; 8276 8277 BT_DBG("%s", hdev->name); 8278 8279 hci_dev_lock(hdev); 8280 8281 adv_instance = hci_find_adv_instance(hdev, cp->instance); 8282 8283 if (!adv_instance) { 8284 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_DATA, 8285 MGMT_STATUS_INVALID_PARAMS); 8286 goto unlock; 8287 } 8288 8289 /* In new interface, we require that we are powered to register */ 8290 if (!hdev_is_powered(hdev)) { 8291 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_DATA, 8292 MGMT_STATUS_REJECTED); 8293 goto clear_new_instance; 8294 } 8295 8296 if (adv_busy(hdev)) { 8297 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_DATA, 8298 MGMT_STATUS_BUSY); 8299 goto clear_new_instance; 8300 } 8301 8302 /* Validate new data */ 8303 if (!tlv_data_is_valid(hdev, adv_instance->flags, cp->data, 8304 cp->adv_data_len, true) || 8305 !tlv_data_is_valid(hdev, adv_instance->flags, cp->data + 8306 cp->adv_data_len, cp->scan_rsp_len, false)) { 8307 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_DATA, 8308 MGMT_STATUS_INVALID_PARAMS); 8309 goto clear_new_instance; 8310 } 8311 8312 /* Set the data in the advertising instance */ 8313 hci_set_adv_instance_data(hdev, cp->instance, cp->adv_data_len, 8314 cp->data, cp->scan_rsp_len, 8315 cp->data + cp->adv_data_len); 8316 8317 /* We're good to go, update advertising data, parameters, and start 8318 * advertising. 8319 */ 8320 8321 hci_req_init(&req, hdev); 8322 8323 hci_req_add(&req, HCI_OP_READ_LOCAL_NAME, 0, NULL); 8324 8325 if (ext_adv_capable(hdev)) { 8326 __hci_req_update_adv_data(&req, cp->instance); 8327 __hci_req_update_scan_rsp_data(&req, cp->instance); 8328 __hci_req_enable_ext_advertising(&req, cp->instance); 8329 8330 } else { 8331 /* If using software rotation, determine next instance to use */ 8332 8333 if (hdev->cur_adv_instance == cp->instance) { 8334 /* If the currently advertised instance is being changed 8335 * then cancel the current advertising and schedule the 8336 * next instance. If there is only one instance then the 8337 * overridden advertising data will be visible right 8338 * away 8339 */ 8340 cancel_adv_timeout(hdev); 8341 8342 next_instance = hci_get_next_instance(hdev, 8343 cp->instance); 8344 if (next_instance) 8345 schedule_instance = next_instance->instance; 8346 } else if (!hdev->adv_instance_timeout) { 8347 /* Immediately advertise the new instance if no other 8348 * instance is currently being advertised. 8349 */ 8350 schedule_instance = cp->instance; 8351 } 8352 8353 /* If the HCI_ADVERTISING flag is set or there is no instance to 8354 * be advertised then we have no HCI communication to make. 8355 * Simply return. 8356 */ 8357 if (hci_dev_test_flag(hdev, HCI_ADVERTISING) || 8358 !schedule_instance) { 8359 if (adv_instance->pending) { 8360 mgmt_advertising_added(sk, hdev, cp->instance); 8361 adv_instance->pending = false; 8362 } 8363 rp.instance = cp->instance; 8364 err = mgmt_cmd_complete(sk, hdev->id, 8365 MGMT_OP_ADD_EXT_ADV_DATA, 8366 MGMT_STATUS_SUCCESS, &rp, 8367 sizeof(rp)); 8368 goto unlock; 8369 } 8370 8371 err = __hci_req_schedule_adv_instance(&req, schedule_instance, 8372 true); 8373 } 8374 8375 cmd = mgmt_pending_add(sk, MGMT_OP_ADD_EXT_ADV_DATA, hdev, data, 8376 data_len); 8377 if (!cmd) { 8378 err = -ENOMEM; 8379 goto clear_new_instance; 8380 } 8381 8382 if (!err) 8383 err = hci_req_run(&req, add_advertising_complete); 8384 8385 if (err < 0) { 8386 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_DATA, 8387 MGMT_STATUS_FAILED); 8388 mgmt_pending_remove(cmd); 8389 goto clear_new_instance; 8390 } 8391 8392 /* We were successful in updating data, so trigger advertising_added 8393 * event if this is an instance that wasn't previously advertising. If 8394 * a failure occurs in the requests we initiated, we will remove the 8395 * instance again in add_advertising_complete 8396 */ 8397 if (adv_instance->pending) 8398 mgmt_advertising_added(sk, hdev, cp->instance); 8399 8400 goto unlock; 8401 8402 clear_new_instance: 8403 hci_remove_adv_instance(hdev, cp->instance); 8404 8405 unlock: 8406 hci_dev_unlock(hdev); 8407 8408 return err; 8409 } 8410 8411 static void remove_advertising_complete(struct hci_dev *hdev, u8 status, 8412 u16 opcode) 8413 { 8414 struct mgmt_pending_cmd *cmd; 8415 struct mgmt_cp_remove_advertising *cp; 8416 struct mgmt_rp_remove_advertising rp; 8417 8418 bt_dev_dbg(hdev, "status %u", status); 8419 8420 hci_dev_lock(hdev); 8421 8422 /* A failure status here only means that we failed to disable 8423 * advertising. Otherwise, the advertising instance has been removed, 8424 * so report success. 8425 */ 8426 cmd = pending_find(MGMT_OP_REMOVE_ADVERTISING, hdev); 8427 if (!cmd) 8428 goto unlock; 8429 8430 cp = cmd->param; 8431 rp.instance = cp->instance; 8432 8433 mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, MGMT_STATUS_SUCCESS, 8434 &rp, sizeof(rp)); 8435 mgmt_pending_remove(cmd); 8436 8437 unlock: 8438 hci_dev_unlock(hdev); 8439 } 8440 8441 static int remove_advertising(struct sock *sk, struct hci_dev *hdev, 8442 void *data, u16 data_len) 8443 { 8444 struct mgmt_cp_remove_advertising *cp = data; 8445 struct mgmt_rp_remove_advertising rp; 8446 struct mgmt_pending_cmd *cmd; 8447 struct hci_request req; 8448 int err; 8449 8450 bt_dev_dbg(hdev, "sock %p", sk); 8451 8452 /* Enabling the experimental LL Privay support disables support for 8453 * advertising. 8454 */ 8455 if (hci_dev_test_flag(hdev, HCI_ENABLE_LL_PRIVACY)) 8456 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_ADVERTISING, 8457 MGMT_STATUS_NOT_SUPPORTED); 8458 8459 hci_dev_lock(hdev); 8460 8461 if (cp->instance && !hci_find_adv_instance(hdev, cp->instance)) { 8462 err = mgmt_cmd_status(sk, hdev->id, 8463 MGMT_OP_REMOVE_ADVERTISING, 8464 MGMT_STATUS_INVALID_PARAMS); 8465 goto unlock; 8466 } 8467 8468 if (pending_find(MGMT_OP_ADD_ADVERTISING, hdev) || 8469 pending_find(MGMT_OP_REMOVE_ADVERTISING, hdev) || 8470 pending_find(MGMT_OP_SET_LE, hdev)) { 8471 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_ADVERTISING, 8472 MGMT_STATUS_BUSY); 8473 goto unlock; 8474 } 8475 8476 if (list_empty(&hdev->adv_instances)) { 8477 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_ADVERTISING, 8478 MGMT_STATUS_INVALID_PARAMS); 8479 goto unlock; 8480 } 8481 8482 hci_req_init(&req, hdev); 8483 8484 /* If we use extended advertising, instance is disabled and removed */ 8485 if (ext_adv_capable(hdev)) { 8486 __hci_req_disable_ext_adv_instance(&req, cp->instance); 8487 __hci_req_remove_ext_adv_instance(&req, cp->instance); 8488 } 8489 8490 hci_req_clear_adv_instance(hdev, sk, &req, cp->instance, true); 8491 8492 if (list_empty(&hdev->adv_instances)) 8493 __hci_req_disable_advertising(&req); 8494 8495 /* If no HCI commands have been collected so far or the HCI_ADVERTISING 8496 * flag is set or the device isn't powered then we have no HCI 8497 * communication to make. Simply return. 8498 */ 8499 if (skb_queue_empty(&req.cmd_q) || 8500 !hdev_is_powered(hdev) || 8501 hci_dev_test_flag(hdev, HCI_ADVERTISING)) { 8502 hci_req_purge(&req); 8503 rp.instance = cp->instance; 8504 err = mgmt_cmd_complete(sk, hdev->id, 8505 MGMT_OP_REMOVE_ADVERTISING, 8506 MGMT_STATUS_SUCCESS, &rp, sizeof(rp)); 8507 goto unlock; 8508 } 8509 8510 cmd = mgmt_pending_add(sk, MGMT_OP_REMOVE_ADVERTISING, hdev, data, 8511 data_len); 8512 if (!cmd) { 8513 err = -ENOMEM; 8514 goto unlock; 8515 } 8516 8517 err = hci_req_run(&req, remove_advertising_complete); 8518 if (err < 0) 8519 mgmt_pending_remove(cmd); 8520 8521 unlock: 8522 hci_dev_unlock(hdev); 8523 8524 return err; 8525 } 8526 8527 static int get_adv_size_info(struct sock *sk, struct hci_dev *hdev, 8528 void *data, u16 data_len) 8529 { 8530 struct mgmt_cp_get_adv_size_info *cp = data; 8531 struct mgmt_rp_get_adv_size_info rp; 8532 u32 flags, supported_flags; 8533 int err; 8534 8535 bt_dev_dbg(hdev, "sock %p", sk); 8536 8537 if (!lmp_le_capable(hdev)) 8538 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_ADV_SIZE_INFO, 8539 MGMT_STATUS_REJECTED); 8540 8541 if (cp->instance < 1 || cp->instance > hdev->le_num_of_adv_sets) 8542 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_ADV_SIZE_INFO, 8543 MGMT_STATUS_INVALID_PARAMS); 8544 8545 flags = __le32_to_cpu(cp->flags); 8546 8547 /* The current implementation only supports a subset of the specified 8548 * flags. 8549 */ 8550 supported_flags = get_supported_adv_flags(hdev); 8551 if (flags & ~supported_flags) 8552 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_ADV_SIZE_INFO, 8553 MGMT_STATUS_INVALID_PARAMS); 8554 8555 rp.instance = cp->instance; 8556 rp.flags = cp->flags; 8557 rp.max_adv_data_len = tlv_data_max_len(hdev, flags, true); 8558 rp.max_scan_rsp_len = tlv_data_max_len(hdev, flags, false); 8559 8560 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_ADV_SIZE_INFO, 8561 MGMT_STATUS_SUCCESS, &rp, sizeof(rp)); 8562 8563 return err; 8564 } 8565 8566 static const struct hci_mgmt_handler mgmt_handlers[] = { 8567 { NULL }, /* 0x0000 (no command) */ 8568 { read_version, MGMT_READ_VERSION_SIZE, 8569 HCI_MGMT_NO_HDEV | 8570 HCI_MGMT_UNTRUSTED }, 8571 { read_commands, MGMT_READ_COMMANDS_SIZE, 8572 HCI_MGMT_NO_HDEV | 8573 HCI_MGMT_UNTRUSTED }, 8574 { read_index_list, MGMT_READ_INDEX_LIST_SIZE, 8575 HCI_MGMT_NO_HDEV | 8576 HCI_MGMT_UNTRUSTED }, 8577 { read_controller_info, MGMT_READ_INFO_SIZE, 8578 HCI_MGMT_UNTRUSTED }, 8579 { set_powered, MGMT_SETTING_SIZE }, 8580 { set_discoverable, MGMT_SET_DISCOVERABLE_SIZE }, 8581 { set_connectable, MGMT_SETTING_SIZE }, 8582 { set_fast_connectable, MGMT_SETTING_SIZE }, 8583 { set_bondable, MGMT_SETTING_SIZE }, 8584 { set_link_security, MGMT_SETTING_SIZE }, 8585 { set_ssp, MGMT_SETTING_SIZE }, 8586 { set_hs, MGMT_SETTING_SIZE }, 8587 { set_le, MGMT_SETTING_SIZE }, 8588 { set_dev_class, MGMT_SET_DEV_CLASS_SIZE }, 8589 { set_local_name, MGMT_SET_LOCAL_NAME_SIZE }, 8590 { add_uuid, MGMT_ADD_UUID_SIZE }, 8591 { remove_uuid, MGMT_REMOVE_UUID_SIZE }, 8592 { load_link_keys, MGMT_LOAD_LINK_KEYS_SIZE, 8593 HCI_MGMT_VAR_LEN }, 8594 { load_long_term_keys, MGMT_LOAD_LONG_TERM_KEYS_SIZE, 8595 HCI_MGMT_VAR_LEN }, 8596 { disconnect, MGMT_DISCONNECT_SIZE }, 8597 { get_connections, MGMT_GET_CONNECTIONS_SIZE }, 8598 { pin_code_reply, MGMT_PIN_CODE_REPLY_SIZE }, 8599 { pin_code_neg_reply, MGMT_PIN_CODE_NEG_REPLY_SIZE }, 8600 { set_io_capability, MGMT_SET_IO_CAPABILITY_SIZE }, 8601 { pair_device, MGMT_PAIR_DEVICE_SIZE }, 8602 { cancel_pair_device, MGMT_CANCEL_PAIR_DEVICE_SIZE }, 8603 { unpair_device, MGMT_UNPAIR_DEVICE_SIZE }, 8604 { user_confirm_reply, MGMT_USER_CONFIRM_REPLY_SIZE }, 8605 { user_confirm_neg_reply, MGMT_USER_CONFIRM_NEG_REPLY_SIZE }, 8606 { user_passkey_reply, MGMT_USER_PASSKEY_REPLY_SIZE }, 8607 { user_passkey_neg_reply, MGMT_USER_PASSKEY_NEG_REPLY_SIZE }, 8608 { read_local_oob_data, MGMT_READ_LOCAL_OOB_DATA_SIZE }, 8609 { add_remote_oob_data, MGMT_ADD_REMOTE_OOB_DATA_SIZE, 8610 HCI_MGMT_VAR_LEN }, 8611 { remove_remote_oob_data, MGMT_REMOVE_REMOTE_OOB_DATA_SIZE }, 8612 { start_discovery, MGMT_START_DISCOVERY_SIZE }, 8613 { stop_discovery, MGMT_STOP_DISCOVERY_SIZE }, 8614 { confirm_name, MGMT_CONFIRM_NAME_SIZE }, 8615 { block_device, MGMT_BLOCK_DEVICE_SIZE }, 8616 { unblock_device, MGMT_UNBLOCK_DEVICE_SIZE }, 8617 { set_device_id, MGMT_SET_DEVICE_ID_SIZE }, 8618 { set_advertising, MGMT_SETTING_SIZE }, 8619 { set_bredr, MGMT_SETTING_SIZE }, 8620 { set_static_address, MGMT_SET_STATIC_ADDRESS_SIZE }, 8621 { set_scan_params, MGMT_SET_SCAN_PARAMS_SIZE }, 8622 { set_secure_conn, MGMT_SETTING_SIZE }, 8623 { set_debug_keys, MGMT_SETTING_SIZE }, 8624 { set_privacy, MGMT_SET_PRIVACY_SIZE }, 8625 { load_irks, MGMT_LOAD_IRKS_SIZE, 8626 HCI_MGMT_VAR_LEN }, 8627 { get_conn_info, MGMT_GET_CONN_INFO_SIZE }, 8628 { get_clock_info, MGMT_GET_CLOCK_INFO_SIZE }, 8629 { add_device, MGMT_ADD_DEVICE_SIZE }, 8630 { remove_device, MGMT_REMOVE_DEVICE_SIZE }, 8631 { load_conn_param, MGMT_LOAD_CONN_PARAM_SIZE, 8632 HCI_MGMT_VAR_LEN }, 8633 { read_unconf_index_list, MGMT_READ_UNCONF_INDEX_LIST_SIZE, 8634 HCI_MGMT_NO_HDEV | 8635 HCI_MGMT_UNTRUSTED }, 8636 { read_config_info, MGMT_READ_CONFIG_INFO_SIZE, 8637 HCI_MGMT_UNCONFIGURED | 8638 HCI_MGMT_UNTRUSTED }, 8639 { set_external_config, MGMT_SET_EXTERNAL_CONFIG_SIZE, 8640 HCI_MGMT_UNCONFIGURED }, 8641 { set_public_address, MGMT_SET_PUBLIC_ADDRESS_SIZE, 8642 HCI_MGMT_UNCONFIGURED }, 8643 { start_service_discovery, MGMT_START_SERVICE_DISCOVERY_SIZE, 8644 HCI_MGMT_VAR_LEN }, 8645 { read_local_oob_ext_data, MGMT_READ_LOCAL_OOB_EXT_DATA_SIZE }, 8646 { read_ext_index_list, MGMT_READ_EXT_INDEX_LIST_SIZE, 8647 HCI_MGMT_NO_HDEV | 8648 HCI_MGMT_UNTRUSTED }, 8649 { read_adv_features, MGMT_READ_ADV_FEATURES_SIZE }, 8650 { add_advertising, MGMT_ADD_ADVERTISING_SIZE, 8651 HCI_MGMT_VAR_LEN }, 8652 { remove_advertising, MGMT_REMOVE_ADVERTISING_SIZE }, 8653 { get_adv_size_info, MGMT_GET_ADV_SIZE_INFO_SIZE }, 8654 { start_limited_discovery, MGMT_START_DISCOVERY_SIZE }, 8655 { read_ext_controller_info,MGMT_READ_EXT_INFO_SIZE, 8656 HCI_MGMT_UNTRUSTED }, 8657 { set_appearance, MGMT_SET_APPEARANCE_SIZE }, 8658 { get_phy_configuration, MGMT_GET_PHY_CONFIGURATION_SIZE }, 8659 { set_phy_configuration, MGMT_SET_PHY_CONFIGURATION_SIZE }, 8660 { set_blocked_keys, MGMT_OP_SET_BLOCKED_KEYS_SIZE, 8661 HCI_MGMT_VAR_LEN }, 8662 { set_wideband_speech, MGMT_SETTING_SIZE }, 8663 { read_controller_cap, MGMT_READ_CONTROLLER_CAP_SIZE, 8664 HCI_MGMT_UNTRUSTED }, 8665 { read_exp_features_info, MGMT_READ_EXP_FEATURES_INFO_SIZE, 8666 HCI_MGMT_UNTRUSTED | 8667 HCI_MGMT_HDEV_OPTIONAL }, 8668 { set_exp_feature, MGMT_SET_EXP_FEATURE_SIZE, 8669 HCI_MGMT_VAR_LEN | 8670 HCI_MGMT_HDEV_OPTIONAL }, 8671 { read_def_system_config, MGMT_READ_DEF_SYSTEM_CONFIG_SIZE, 8672 HCI_MGMT_UNTRUSTED }, 8673 { set_def_system_config, MGMT_SET_DEF_SYSTEM_CONFIG_SIZE, 8674 HCI_MGMT_VAR_LEN }, 8675 { read_def_runtime_config, MGMT_READ_DEF_RUNTIME_CONFIG_SIZE, 8676 HCI_MGMT_UNTRUSTED }, 8677 { set_def_runtime_config, MGMT_SET_DEF_RUNTIME_CONFIG_SIZE, 8678 HCI_MGMT_VAR_LEN }, 8679 { get_device_flags, MGMT_GET_DEVICE_FLAGS_SIZE }, 8680 { set_device_flags, MGMT_SET_DEVICE_FLAGS_SIZE }, 8681 { read_adv_mon_features, MGMT_READ_ADV_MONITOR_FEATURES_SIZE }, 8682 { add_adv_patterns_monitor,MGMT_ADD_ADV_PATTERNS_MONITOR_SIZE, 8683 HCI_MGMT_VAR_LEN }, 8684 { remove_adv_monitor, MGMT_REMOVE_ADV_MONITOR_SIZE }, 8685 { add_ext_adv_params, MGMT_ADD_EXT_ADV_PARAMS_MIN_SIZE, 8686 HCI_MGMT_VAR_LEN }, 8687 { add_ext_adv_data, MGMT_ADD_EXT_ADV_DATA_SIZE, 8688 HCI_MGMT_VAR_LEN }, 8689 { add_adv_patterns_monitor_rssi, 8690 MGMT_ADD_ADV_PATTERNS_MONITOR_RSSI_SIZE, 8691 HCI_MGMT_VAR_LEN }, 8692 }; 8693 8694 void mgmt_index_added(struct hci_dev *hdev) 8695 { 8696 struct mgmt_ev_ext_index ev; 8697 8698 if (test_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks)) 8699 return; 8700 8701 switch (hdev->dev_type) { 8702 case HCI_PRIMARY: 8703 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) { 8704 mgmt_index_event(MGMT_EV_UNCONF_INDEX_ADDED, hdev, 8705 NULL, 0, HCI_MGMT_UNCONF_INDEX_EVENTS); 8706 ev.type = 0x01; 8707 } else { 8708 mgmt_index_event(MGMT_EV_INDEX_ADDED, hdev, NULL, 0, 8709 HCI_MGMT_INDEX_EVENTS); 8710 ev.type = 0x00; 8711 } 8712 break; 8713 case HCI_AMP: 8714 ev.type = 0x02; 8715 break; 8716 default: 8717 return; 8718 } 8719 8720 ev.bus = hdev->bus; 8721 8722 mgmt_index_event(MGMT_EV_EXT_INDEX_ADDED, hdev, &ev, sizeof(ev), 8723 HCI_MGMT_EXT_INDEX_EVENTS); 8724 } 8725 8726 void mgmt_index_removed(struct hci_dev *hdev) 8727 { 8728 struct mgmt_ev_ext_index ev; 8729 u8 status = MGMT_STATUS_INVALID_INDEX; 8730 8731 if (test_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks)) 8732 return; 8733 8734 switch (hdev->dev_type) { 8735 case HCI_PRIMARY: 8736 mgmt_pending_foreach(0, hdev, cmd_complete_rsp, &status); 8737 8738 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) { 8739 mgmt_index_event(MGMT_EV_UNCONF_INDEX_REMOVED, hdev, 8740 NULL, 0, HCI_MGMT_UNCONF_INDEX_EVENTS); 8741 ev.type = 0x01; 8742 } else { 8743 mgmt_index_event(MGMT_EV_INDEX_REMOVED, hdev, NULL, 0, 8744 HCI_MGMT_INDEX_EVENTS); 8745 ev.type = 0x00; 8746 } 8747 break; 8748 case HCI_AMP: 8749 ev.type = 0x02; 8750 break; 8751 default: 8752 return; 8753 } 8754 8755 ev.bus = hdev->bus; 8756 8757 mgmt_index_event(MGMT_EV_EXT_INDEX_REMOVED, hdev, &ev, sizeof(ev), 8758 HCI_MGMT_EXT_INDEX_EVENTS); 8759 } 8760 8761 /* This function requires the caller holds hdev->lock */ 8762 static void restart_le_actions(struct hci_dev *hdev) 8763 { 8764 struct hci_conn_params *p; 8765 8766 list_for_each_entry(p, &hdev->le_conn_params, list) { 8767 /* Needed for AUTO_OFF case where might not "really" 8768 * have been powered off. 8769 */ 8770 list_del_init(&p->action); 8771 8772 switch (p->auto_connect) { 8773 case HCI_AUTO_CONN_DIRECT: 8774 case HCI_AUTO_CONN_ALWAYS: 8775 list_add(&p->action, &hdev->pend_le_conns); 8776 break; 8777 case HCI_AUTO_CONN_REPORT: 8778 list_add(&p->action, &hdev->pend_le_reports); 8779 break; 8780 default: 8781 break; 8782 } 8783 } 8784 } 8785 8786 void mgmt_power_on(struct hci_dev *hdev, int err) 8787 { 8788 struct cmd_lookup match = { NULL, hdev }; 8789 8790 bt_dev_dbg(hdev, "err %d", err); 8791 8792 hci_dev_lock(hdev); 8793 8794 if (!err) { 8795 restart_le_actions(hdev); 8796 hci_update_background_scan(hdev); 8797 } 8798 8799 mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp, &match); 8800 8801 new_settings(hdev, match.sk); 8802 8803 if (match.sk) 8804 sock_put(match.sk); 8805 8806 hci_dev_unlock(hdev); 8807 } 8808 8809 void __mgmt_power_off(struct hci_dev *hdev) 8810 { 8811 struct cmd_lookup match = { NULL, hdev }; 8812 u8 status, zero_cod[] = { 0, 0, 0 }; 8813 8814 mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp, &match); 8815 8816 /* If the power off is because of hdev unregistration let 8817 * use the appropriate INVALID_INDEX status. Otherwise use 8818 * NOT_POWERED. We cover both scenarios here since later in 8819 * mgmt_index_removed() any hci_conn callbacks will have already 8820 * been triggered, potentially causing misleading DISCONNECTED 8821 * status responses. 8822 */ 8823 if (hci_dev_test_flag(hdev, HCI_UNREGISTER)) 8824 status = MGMT_STATUS_INVALID_INDEX; 8825 else 8826 status = MGMT_STATUS_NOT_POWERED; 8827 8828 mgmt_pending_foreach(0, hdev, cmd_complete_rsp, &status); 8829 8830 if (memcmp(hdev->dev_class, zero_cod, sizeof(zero_cod)) != 0) { 8831 mgmt_limited_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev, 8832 zero_cod, sizeof(zero_cod), 8833 HCI_MGMT_DEV_CLASS_EVENTS, NULL); 8834 ext_info_changed(hdev, NULL); 8835 } 8836 8837 new_settings(hdev, match.sk); 8838 8839 if (match.sk) 8840 sock_put(match.sk); 8841 } 8842 8843 void mgmt_set_powered_failed(struct hci_dev *hdev, int err) 8844 { 8845 struct mgmt_pending_cmd *cmd; 8846 u8 status; 8847 8848 cmd = pending_find(MGMT_OP_SET_POWERED, hdev); 8849 if (!cmd) 8850 return; 8851 8852 if (err == -ERFKILL) 8853 status = MGMT_STATUS_RFKILLED; 8854 else 8855 status = MGMT_STATUS_FAILED; 8856 8857 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_POWERED, status); 8858 8859 mgmt_pending_remove(cmd); 8860 } 8861 8862 void mgmt_new_link_key(struct hci_dev *hdev, struct link_key *key, 8863 bool persistent) 8864 { 8865 struct mgmt_ev_new_link_key ev; 8866 8867 memset(&ev, 0, sizeof(ev)); 8868 8869 ev.store_hint = persistent; 8870 bacpy(&ev.key.addr.bdaddr, &key->bdaddr); 8871 ev.key.addr.type = BDADDR_BREDR; 8872 ev.key.type = key->type; 8873 memcpy(ev.key.val, key->val, HCI_LINK_KEY_SIZE); 8874 ev.key.pin_len = key->pin_len; 8875 8876 mgmt_event(MGMT_EV_NEW_LINK_KEY, hdev, &ev, sizeof(ev), NULL); 8877 } 8878 8879 static u8 mgmt_ltk_type(struct smp_ltk *ltk) 8880 { 8881 switch (ltk->type) { 8882 case SMP_LTK: 8883 case SMP_LTK_RESPONDER: 8884 if (ltk->authenticated) 8885 return MGMT_LTK_AUTHENTICATED; 8886 return MGMT_LTK_UNAUTHENTICATED; 8887 case SMP_LTK_P256: 8888 if (ltk->authenticated) 8889 return MGMT_LTK_P256_AUTH; 8890 return MGMT_LTK_P256_UNAUTH; 8891 case SMP_LTK_P256_DEBUG: 8892 return MGMT_LTK_P256_DEBUG; 8893 } 8894 8895 return MGMT_LTK_UNAUTHENTICATED; 8896 } 8897 8898 void mgmt_new_ltk(struct hci_dev *hdev, struct smp_ltk *key, bool persistent) 8899 { 8900 struct mgmt_ev_new_long_term_key ev; 8901 8902 memset(&ev, 0, sizeof(ev)); 8903 8904 /* Devices using resolvable or non-resolvable random addresses 8905 * without providing an identity resolving key don't require 8906 * to store long term keys. Their addresses will change the 8907 * next time around. 8908 * 8909 * Only when a remote device provides an identity address 8910 * make sure the long term key is stored. If the remote 8911 * identity is known, the long term keys are internally 8912 * mapped to the identity address. So allow static random 8913 * and public addresses here. 8914 */ 8915 if (key->bdaddr_type == ADDR_LE_DEV_RANDOM && 8916 (key->bdaddr.b[5] & 0xc0) != 0xc0) 8917 ev.store_hint = 0x00; 8918 else 8919 ev.store_hint = persistent; 8920 8921 bacpy(&ev.key.addr.bdaddr, &key->bdaddr); 8922 ev.key.addr.type = link_to_bdaddr(LE_LINK, key->bdaddr_type); 8923 ev.key.type = mgmt_ltk_type(key); 8924 ev.key.enc_size = key->enc_size; 8925 ev.key.ediv = key->ediv; 8926 ev.key.rand = key->rand; 8927 8928 if (key->type == SMP_LTK) 8929 ev.key.initiator = 1; 8930 8931 /* Make sure we copy only the significant bytes based on the 8932 * encryption key size, and set the rest of the value to zeroes. 8933 */ 8934 memcpy(ev.key.val, key->val, key->enc_size); 8935 memset(ev.key.val + key->enc_size, 0, 8936 sizeof(ev.key.val) - key->enc_size); 8937 8938 mgmt_event(MGMT_EV_NEW_LONG_TERM_KEY, hdev, &ev, sizeof(ev), NULL); 8939 } 8940 8941 void mgmt_new_irk(struct hci_dev *hdev, struct smp_irk *irk, bool persistent) 8942 { 8943 struct mgmt_ev_new_irk ev; 8944 8945 memset(&ev, 0, sizeof(ev)); 8946 8947 ev.store_hint = persistent; 8948 8949 bacpy(&ev.rpa, &irk->rpa); 8950 bacpy(&ev.irk.addr.bdaddr, &irk->bdaddr); 8951 ev.irk.addr.type = link_to_bdaddr(LE_LINK, irk->addr_type); 8952 memcpy(ev.irk.val, irk->val, sizeof(irk->val)); 8953 8954 mgmt_event(MGMT_EV_NEW_IRK, hdev, &ev, sizeof(ev), NULL); 8955 } 8956 8957 void mgmt_new_csrk(struct hci_dev *hdev, struct smp_csrk *csrk, 8958 bool persistent) 8959 { 8960 struct mgmt_ev_new_csrk ev; 8961 8962 memset(&ev, 0, sizeof(ev)); 8963 8964 /* Devices using resolvable or non-resolvable random addresses 8965 * without providing an identity resolving key don't require 8966 * to store signature resolving keys. Their addresses will change 8967 * the next time around. 8968 * 8969 * Only when a remote device provides an identity address 8970 * make sure the signature resolving key is stored. So allow 8971 * static random and public addresses here. 8972 */ 8973 if (csrk->bdaddr_type == ADDR_LE_DEV_RANDOM && 8974 (csrk->bdaddr.b[5] & 0xc0) != 0xc0) 8975 ev.store_hint = 0x00; 8976 else 8977 ev.store_hint = persistent; 8978 8979 bacpy(&ev.key.addr.bdaddr, &csrk->bdaddr); 8980 ev.key.addr.type = link_to_bdaddr(LE_LINK, csrk->bdaddr_type); 8981 ev.key.type = csrk->type; 8982 memcpy(ev.key.val, csrk->val, sizeof(csrk->val)); 8983 8984 mgmt_event(MGMT_EV_NEW_CSRK, hdev, &ev, sizeof(ev), NULL); 8985 } 8986 8987 void mgmt_new_conn_param(struct hci_dev *hdev, bdaddr_t *bdaddr, 8988 u8 bdaddr_type, u8 store_hint, u16 min_interval, 8989 u16 max_interval, u16 latency, u16 timeout) 8990 { 8991 struct mgmt_ev_new_conn_param ev; 8992 8993 if (!hci_is_identity_address(bdaddr, bdaddr_type)) 8994 return; 8995 8996 memset(&ev, 0, sizeof(ev)); 8997 bacpy(&ev.addr.bdaddr, bdaddr); 8998 ev.addr.type = link_to_bdaddr(LE_LINK, bdaddr_type); 8999 ev.store_hint = store_hint; 9000 ev.min_interval = cpu_to_le16(min_interval); 9001 ev.max_interval = cpu_to_le16(max_interval); 9002 ev.latency = cpu_to_le16(latency); 9003 ev.timeout = cpu_to_le16(timeout); 9004 9005 mgmt_event(MGMT_EV_NEW_CONN_PARAM, hdev, &ev, sizeof(ev), NULL); 9006 } 9007 9008 void mgmt_device_connected(struct hci_dev *hdev, struct hci_conn *conn, 9009 u8 *name, u8 name_len) 9010 { 9011 char buf[512]; 9012 struct mgmt_ev_device_connected *ev = (void *) buf; 9013 u16 eir_len = 0; 9014 u32 flags = 0; 9015 9016 bacpy(&ev->addr.bdaddr, &conn->dst); 9017 ev->addr.type = link_to_bdaddr(conn->type, conn->dst_type); 9018 9019 if (conn->out) 9020 flags |= MGMT_DEV_FOUND_INITIATED_CONN; 9021 9022 ev->flags = __cpu_to_le32(flags); 9023 9024 /* We must ensure that the EIR Data fields are ordered and 9025 * unique. Keep it simple for now and avoid the problem by not 9026 * adding any BR/EDR data to the LE adv. 9027 */ 9028 if (conn->le_adv_data_len > 0) { 9029 memcpy(&ev->eir[eir_len], 9030 conn->le_adv_data, conn->le_adv_data_len); 9031 eir_len = conn->le_adv_data_len; 9032 } else { 9033 if (name_len > 0) 9034 eir_len = eir_append_data(ev->eir, 0, EIR_NAME_COMPLETE, 9035 name, name_len); 9036 9037 if (memcmp(conn->dev_class, "\0\0\0", 3) != 0) 9038 eir_len = eir_append_data(ev->eir, eir_len, 9039 EIR_CLASS_OF_DEV, 9040 conn->dev_class, 3); 9041 } 9042 9043 ev->eir_len = cpu_to_le16(eir_len); 9044 9045 mgmt_event(MGMT_EV_DEVICE_CONNECTED, hdev, buf, 9046 sizeof(*ev) + eir_len, NULL); 9047 } 9048 9049 static void disconnect_rsp(struct mgmt_pending_cmd *cmd, void *data) 9050 { 9051 struct sock **sk = data; 9052 9053 cmd->cmd_complete(cmd, 0); 9054 9055 *sk = cmd->sk; 9056 sock_hold(*sk); 9057 9058 mgmt_pending_remove(cmd); 9059 } 9060 9061 static void unpair_device_rsp(struct mgmt_pending_cmd *cmd, void *data) 9062 { 9063 struct hci_dev *hdev = data; 9064 struct mgmt_cp_unpair_device *cp = cmd->param; 9065 9066 device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, cmd->sk); 9067 9068 cmd->cmd_complete(cmd, 0); 9069 mgmt_pending_remove(cmd); 9070 } 9071 9072 bool mgmt_powering_down(struct hci_dev *hdev) 9073 { 9074 struct mgmt_pending_cmd *cmd; 9075 struct mgmt_mode *cp; 9076 9077 cmd = pending_find(MGMT_OP_SET_POWERED, hdev); 9078 if (!cmd) 9079 return false; 9080 9081 cp = cmd->param; 9082 if (!cp->val) 9083 return true; 9084 9085 return false; 9086 } 9087 9088 void mgmt_device_disconnected(struct hci_dev *hdev, bdaddr_t *bdaddr, 9089 u8 link_type, u8 addr_type, u8 reason, 9090 bool mgmt_connected) 9091 { 9092 struct mgmt_ev_device_disconnected ev; 9093 struct sock *sk = NULL; 9094 9095 /* The connection is still in hci_conn_hash so test for 1 9096 * instead of 0 to know if this is the last one. 9097 */ 9098 if (mgmt_powering_down(hdev) && hci_conn_count(hdev) == 1) { 9099 cancel_delayed_work(&hdev->power_off); 9100 queue_work(hdev->req_workqueue, &hdev->power_off.work); 9101 } 9102 9103 if (!mgmt_connected) 9104 return; 9105 9106 if (link_type != ACL_LINK && link_type != LE_LINK) 9107 return; 9108 9109 mgmt_pending_foreach(MGMT_OP_DISCONNECT, hdev, disconnect_rsp, &sk); 9110 9111 bacpy(&ev.addr.bdaddr, bdaddr); 9112 ev.addr.type = link_to_bdaddr(link_type, addr_type); 9113 ev.reason = reason; 9114 9115 /* Report disconnects due to suspend */ 9116 if (hdev->suspended) 9117 ev.reason = MGMT_DEV_DISCONN_LOCAL_HOST_SUSPEND; 9118 9119 mgmt_event(MGMT_EV_DEVICE_DISCONNECTED, hdev, &ev, sizeof(ev), sk); 9120 9121 if (sk) 9122 sock_put(sk); 9123 9124 mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, unpair_device_rsp, 9125 hdev); 9126 } 9127 9128 void mgmt_disconnect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr, 9129 u8 link_type, u8 addr_type, u8 status) 9130 { 9131 u8 bdaddr_type = link_to_bdaddr(link_type, addr_type); 9132 struct mgmt_cp_disconnect *cp; 9133 struct mgmt_pending_cmd *cmd; 9134 9135 mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, unpair_device_rsp, 9136 hdev); 9137 9138 cmd = pending_find(MGMT_OP_DISCONNECT, hdev); 9139 if (!cmd) 9140 return; 9141 9142 cp = cmd->param; 9143 9144 if (bacmp(bdaddr, &cp->addr.bdaddr)) 9145 return; 9146 9147 if (cp->addr.type != bdaddr_type) 9148 return; 9149 9150 cmd->cmd_complete(cmd, mgmt_status(status)); 9151 mgmt_pending_remove(cmd); 9152 } 9153 9154 void mgmt_connect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type, 9155 u8 addr_type, u8 status) 9156 { 9157 struct mgmt_ev_connect_failed ev; 9158 9159 /* The connection is still in hci_conn_hash so test for 1 9160 * instead of 0 to know if this is the last one. 9161 */ 9162 if (mgmt_powering_down(hdev) && hci_conn_count(hdev) == 1) { 9163 cancel_delayed_work(&hdev->power_off); 9164 queue_work(hdev->req_workqueue, &hdev->power_off.work); 9165 } 9166 9167 bacpy(&ev.addr.bdaddr, bdaddr); 9168 ev.addr.type = link_to_bdaddr(link_type, addr_type); 9169 ev.status = mgmt_status(status); 9170 9171 mgmt_event(MGMT_EV_CONNECT_FAILED, hdev, &ev, sizeof(ev), NULL); 9172 } 9173 9174 void mgmt_pin_code_request(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 secure) 9175 { 9176 struct mgmt_ev_pin_code_request ev; 9177 9178 bacpy(&ev.addr.bdaddr, bdaddr); 9179 ev.addr.type = BDADDR_BREDR; 9180 ev.secure = secure; 9181 9182 mgmt_event(MGMT_EV_PIN_CODE_REQUEST, hdev, &ev, sizeof(ev), NULL); 9183 } 9184 9185 void mgmt_pin_code_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr, 9186 u8 status) 9187 { 9188 struct mgmt_pending_cmd *cmd; 9189 9190 cmd = pending_find(MGMT_OP_PIN_CODE_REPLY, hdev); 9191 if (!cmd) 9192 return; 9193 9194 cmd->cmd_complete(cmd, mgmt_status(status)); 9195 mgmt_pending_remove(cmd); 9196 } 9197 9198 void mgmt_pin_code_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr, 9199 u8 status) 9200 { 9201 struct mgmt_pending_cmd *cmd; 9202 9203 cmd = pending_find(MGMT_OP_PIN_CODE_NEG_REPLY, hdev); 9204 if (!cmd) 9205 return; 9206 9207 cmd->cmd_complete(cmd, mgmt_status(status)); 9208 mgmt_pending_remove(cmd); 9209 } 9210 9211 int mgmt_user_confirm_request(struct hci_dev *hdev, bdaddr_t *bdaddr, 9212 u8 link_type, u8 addr_type, u32 value, 9213 u8 confirm_hint) 9214 { 9215 struct mgmt_ev_user_confirm_request ev; 9216 9217 bt_dev_dbg(hdev, "bdaddr %pMR", bdaddr); 9218 9219 bacpy(&ev.addr.bdaddr, bdaddr); 9220 ev.addr.type = link_to_bdaddr(link_type, addr_type); 9221 ev.confirm_hint = confirm_hint; 9222 ev.value = cpu_to_le32(value); 9223 9224 return mgmt_event(MGMT_EV_USER_CONFIRM_REQUEST, hdev, &ev, sizeof(ev), 9225 NULL); 9226 } 9227 9228 int mgmt_user_passkey_request(struct hci_dev *hdev, bdaddr_t *bdaddr, 9229 u8 link_type, u8 addr_type) 9230 { 9231 struct mgmt_ev_user_passkey_request ev; 9232 9233 bt_dev_dbg(hdev, "bdaddr %pMR", bdaddr); 9234 9235 bacpy(&ev.addr.bdaddr, bdaddr); 9236 ev.addr.type = link_to_bdaddr(link_type, addr_type); 9237 9238 return mgmt_event(MGMT_EV_USER_PASSKEY_REQUEST, hdev, &ev, sizeof(ev), 9239 NULL); 9240 } 9241 9242 static int user_pairing_resp_complete(struct hci_dev *hdev, bdaddr_t *bdaddr, 9243 u8 link_type, u8 addr_type, u8 status, 9244 u8 opcode) 9245 { 9246 struct mgmt_pending_cmd *cmd; 9247 9248 cmd = pending_find(opcode, hdev); 9249 if (!cmd) 9250 return -ENOENT; 9251 9252 cmd->cmd_complete(cmd, mgmt_status(status)); 9253 mgmt_pending_remove(cmd); 9254 9255 return 0; 9256 } 9257 9258 int mgmt_user_confirm_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr, 9259 u8 link_type, u8 addr_type, u8 status) 9260 { 9261 return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type, 9262 status, MGMT_OP_USER_CONFIRM_REPLY); 9263 } 9264 9265 int mgmt_user_confirm_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr, 9266 u8 link_type, u8 addr_type, u8 status) 9267 { 9268 return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type, 9269 status, 9270 MGMT_OP_USER_CONFIRM_NEG_REPLY); 9271 } 9272 9273 int mgmt_user_passkey_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr, 9274 u8 link_type, u8 addr_type, u8 status) 9275 { 9276 return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type, 9277 status, MGMT_OP_USER_PASSKEY_REPLY); 9278 } 9279 9280 int mgmt_user_passkey_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr, 9281 u8 link_type, u8 addr_type, u8 status) 9282 { 9283 return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type, 9284 status, 9285 MGMT_OP_USER_PASSKEY_NEG_REPLY); 9286 } 9287 9288 int mgmt_user_passkey_notify(struct hci_dev *hdev, bdaddr_t *bdaddr, 9289 u8 link_type, u8 addr_type, u32 passkey, 9290 u8 entered) 9291 { 9292 struct mgmt_ev_passkey_notify ev; 9293 9294 bt_dev_dbg(hdev, "bdaddr %pMR", bdaddr); 9295 9296 bacpy(&ev.addr.bdaddr, bdaddr); 9297 ev.addr.type = link_to_bdaddr(link_type, addr_type); 9298 ev.passkey = __cpu_to_le32(passkey); 9299 ev.entered = entered; 9300 9301 return mgmt_event(MGMT_EV_PASSKEY_NOTIFY, hdev, &ev, sizeof(ev), NULL); 9302 } 9303 9304 void mgmt_auth_failed(struct hci_conn *conn, u8 hci_status) 9305 { 9306 struct mgmt_ev_auth_failed ev; 9307 struct mgmt_pending_cmd *cmd; 9308 u8 status = mgmt_status(hci_status); 9309 9310 bacpy(&ev.addr.bdaddr, &conn->dst); 9311 ev.addr.type = link_to_bdaddr(conn->type, conn->dst_type); 9312 ev.status = status; 9313 9314 cmd = find_pairing(conn); 9315 9316 mgmt_event(MGMT_EV_AUTH_FAILED, conn->hdev, &ev, sizeof(ev), 9317 cmd ? cmd->sk : NULL); 9318 9319 if (cmd) { 9320 cmd->cmd_complete(cmd, status); 9321 mgmt_pending_remove(cmd); 9322 } 9323 } 9324 9325 void mgmt_auth_enable_complete(struct hci_dev *hdev, u8 status) 9326 { 9327 struct cmd_lookup match = { NULL, hdev }; 9328 bool changed; 9329 9330 if (status) { 9331 u8 mgmt_err = mgmt_status(status); 9332 mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev, 9333 cmd_status_rsp, &mgmt_err); 9334 return; 9335 } 9336 9337 if (test_bit(HCI_AUTH, &hdev->flags)) 9338 changed = !hci_dev_test_and_set_flag(hdev, HCI_LINK_SECURITY); 9339 else 9340 changed = hci_dev_test_and_clear_flag(hdev, HCI_LINK_SECURITY); 9341 9342 mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev, settings_rsp, 9343 &match); 9344 9345 if (changed) 9346 new_settings(hdev, match.sk); 9347 9348 if (match.sk) 9349 sock_put(match.sk); 9350 } 9351 9352 static void clear_eir(struct hci_request *req) 9353 { 9354 struct hci_dev *hdev = req->hdev; 9355 struct hci_cp_write_eir cp; 9356 9357 if (!lmp_ext_inq_capable(hdev)) 9358 return; 9359 9360 memset(hdev->eir, 0, sizeof(hdev->eir)); 9361 9362 memset(&cp, 0, sizeof(cp)); 9363 9364 hci_req_add(req, HCI_OP_WRITE_EIR, sizeof(cp), &cp); 9365 } 9366 9367 void mgmt_ssp_enable_complete(struct hci_dev *hdev, u8 enable, u8 status) 9368 { 9369 struct cmd_lookup match = { NULL, hdev }; 9370 struct hci_request req; 9371 bool changed = false; 9372 9373 if (status) { 9374 u8 mgmt_err = mgmt_status(status); 9375 9376 if (enable && hci_dev_test_and_clear_flag(hdev, 9377 HCI_SSP_ENABLED)) { 9378 hci_dev_clear_flag(hdev, HCI_HS_ENABLED); 9379 new_settings(hdev, NULL); 9380 } 9381 9382 mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev, cmd_status_rsp, 9383 &mgmt_err); 9384 return; 9385 } 9386 9387 if (enable) { 9388 changed = !hci_dev_test_and_set_flag(hdev, HCI_SSP_ENABLED); 9389 } else { 9390 changed = hci_dev_test_and_clear_flag(hdev, HCI_SSP_ENABLED); 9391 if (!changed) 9392 changed = hci_dev_test_and_clear_flag(hdev, 9393 HCI_HS_ENABLED); 9394 else 9395 hci_dev_clear_flag(hdev, HCI_HS_ENABLED); 9396 } 9397 9398 mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev, settings_rsp, &match); 9399 9400 if (changed) 9401 new_settings(hdev, match.sk); 9402 9403 if (match.sk) 9404 sock_put(match.sk); 9405 9406 hci_req_init(&req, hdev); 9407 9408 if (hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) { 9409 if (hci_dev_test_flag(hdev, HCI_USE_DEBUG_KEYS)) 9410 hci_req_add(&req, HCI_OP_WRITE_SSP_DEBUG_MODE, 9411 sizeof(enable), &enable); 9412 __hci_req_update_eir(&req); 9413 } else { 9414 clear_eir(&req); 9415 } 9416 9417 hci_req_run(&req, NULL); 9418 } 9419 9420 static void sk_lookup(struct mgmt_pending_cmd *cmd, void *data) 9421 { 9422 struct cmd_lookup *match = data; 9423 9424 if (match->sk == NULL) { 9425 match->sk = cmd->sk; 9426 sock_hold(match->sk); 9427 } 9428 } 9429 9430 void mgmt_set_class_of_dev_complete(struct hci_dev *hdev, u8 *dev_class, 9431 u8 status) 9432 { 9433 struct cmd_lookup match = { NULL, hdev, mgmt_status(status) }; 9434 9435 mgmt_pending_foreach(MGMT_OP_SET_DEV_CLASS, hdev, sk_lookup, &match); 9436 mgmt_pending_foreach(MGMT_OP_ADD_UUID, hdev, sk_lookup, &match); 9437 mgmt_pending_foreach(MGMT_OP_REMOVE_UUID, hdev, sk_lookup, &match); 9438 9439 if (!status) { 9440 mgmt_limited_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev, dev_class, 9441 3, HCI_MGMT_DEV_CLASS_EVENTS, NULL); 9442 ext_info_changed(hdev, NULL); 9443 } 9444 9445 if (match.sk) 9446 sock_put(match.sk); 9447 } 9448 9449 void mgmt_set_local_name_complete(struct hci_dev *hdev, u8 *name, u8 status) 9450 { 9451 struct mgmt_cp_set_local_name ev; 9452 struct mgmt_pending_cmd *cmd; 9453 9454 if (status) 9455 return; 9456 9457 memset(&ev, 0, sizeof(ev)); 9458 memcpy(ev.name, name, HCI_MAX_NAME_LENGTH); 9459 memcpy(ev.short_name, hdev->short_name, HCI_MAX_SHORT_NAME_LENGTH); 9460 9461 cmd = pending_find(MGMT_OP_SET_LOCAL_NAME, hdev); 9462 if (!cmd) { 9463 memcpy(hdev->dev_name, name, sizeof(hdev->dev_name)); 9464 9465 /* If this is a HCI command related to powering on the 9466 * HCI dev don't send any mgmt signals. 9467 */ 9468 if (pending_find(MGMT_OP_SET_POWERED, hdev)) 9469 return; 9470 } 9471 9472 mgmt_limited_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, &ev, sizeof(ev), 9473 HCI_MGMT_LOCAL_NAME_EVENTS, cmd ? cmd->sk : NULL); 9474 ext_info_changed(hdev, cmd ? cmd->sk : NULL); 9475 } 9476 9477 static inline bool has_uuid(u8 *uuid, u16 uuid_count, u8 (*uuids)[16]) 9478 { 9479 int i; 9480 9481 for (i = 0; i < uuid_count; i++) { 9482 if (!memcmp(uuid, uuids[i], 16)) 9483 return true; 9484 } 9485 9486 return false; 9487 } 9488 9489 static bool eir_has_uuids(u8 *eir, u16 eir_len, u16 uuid_count, u8 (*uuids)[16]) 9490 { 9491 u16 parsed = 0; 9492 9493 while (parsed < eir_len) { 9494 u8 field_len = eir[0]; 9495 u8 uuid[16]; 9496 int i; 9497 9498 if (field_len == 0) 9499 break; 9500 9501 if (eir_len - parsed < field_len + 1) 9502 break; 9503 9504 switch (eir[1]) { 9505 case EIR_UUID16_ALL: 9506 case EIR_UUID16_SOME: 9507 for (i = 0; i + 3 <= field_len; i += 2) { 9508 memcpy(uuid, bluetooth_base_uuid, 16); 9509 uuid[13] = eir[i + 3]; 9510 uuid[12] = eir[i + 2]; 9511 if (has_uuid(uuid, uuid_count, uuids)) 9512 return true; 9513 } 9514 break; 9515 case EIR_UUID32_ALL: 9516 case EIR_UUID32_SOME: 9517 for (i = 0; i + 5 <= field_len; i += 4) { 9518 memcpy(uuid, bluetooth_base_uuid, 16); 9519 uuid[15] = eir[i + 5]; 9520 uuid[14] = eir[i + 4]; 9521 uuid[13] = eir[i + 3]; 9522 uuid[12] = eir[i + 2]; 9523 if (has_uuid(uuid, uuid_count, uuids)) 9524 return true; 9525 } 9526 break; 9527 case EIR_UUID128_ALL: 9528 case EIR_UUID128_SOME: 9529 for (i = 0; i + 17 <= field_len; i += 16) { 9530 memcpy(uuid, eir + i + 2, 16); 9531 if (has_uuid(uuid, uuid_count, uuids)) 9532 return true; 9533 } 9534 break; 9535 } 9536 9537 parsed += field_len + 1; 9538 eir += field_len + 1; 9539 } 9540 9541 return false; 9542 } 9543 9544 static void restart_le_scan(struct hci_dev *hdev) 9545 { 9546 /* If controller is not scanning we are done. */ 9547 if (!hci_dev_test_flag(hdev, HCI_LE_SCAN)) 9548 return; 9549 9550 if (time_after(jiffies + DISCOV_LE_RESTART_DELAY, 9551 hdev->discovery.scan_start + 9552 hdev->discovery.scan_duration)) 9553 return; 9554 9555 queue_delayed_work(hdev->req_workqueue, &hdev->le_scan_restart, 9556 DISCOV_LE_RESTART_DELAY); 9557 } 9558 9559 static bool is_filter_match(struct hci_dev *hdev, s8 rssi, u8 *eir, 9560 u16 eir_len, u8 *scan_rsp, u8 scan_rsp_len) 9561 { 9562 /* If a RSSI threshold has been specified, and 9563 * HCI_QUIRK_STRICT_DUPLICATE_FILTER is not set, then all results with 9564 * a RSSI smaller than the RSSI threshold will be dropped. If the quirk 9565 * is set, let it through for further processing, as we might need to 9566 * restart the scan. 9567 * 9568 * For BR/EDR devices (pre 1.2) providing no RSSI during inquiry, 9569 * the results are also dropped. 9570 */ 9571 if (hdev->discovery.rssi != HCI_RSSI_INVALID && 9572 (rssi == HCI_RSSI_INVALID || 9573 (rssi < hdev->discovery.rssi && 9574 !test_bit(HCI_QUIRK_STRICT_DUPLICATE_FILTER, &hdev->quirks)))) 9575 return false; 9576 9577 if (hdev->discovery.uuid_count != 0) { 9578 /* If a list of UUIDs is provided in filter, results with no 9579 * matching UUID should be dropped. 9580 */ 9581 if (!eir_has_uuids(eir, eir_len, hdev->discovery.uuid_count, 9582 hdev->discovery.uuids) && 9583 !eir_has_uuids(scan_rsp, scan_rsp_len, 9584 hdev->discovery.uuid_count, 9585 hdev->discovery.uuids)) 9586 return false; 9587 } 9588 9589 /* If duplicate filtering does not report RSSI changes, then restart 9590 * scanning to ensure updated result with updated RSSI values. 9591 */ 9592 if (test_bit(HCI_QUIRK_STRICT_DUPLICATE_FILTER, &hdev->quirks)) { 9593 restart_le_scan(hdev); 9594 9595 /* Validate RSSI value against the RSSI threshold once more. */ 9596 if (hdev->discovery.rssi != HCI_RSSI_INVALID && 9597 rssi < hdev->discovery.rssi) 9598 return false; 9599 } 9600 9601 return true; 9602 } 9603 9604 void mgmt_device_found(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type, 9605 u8 addr_type, u8 *dev_class, s8 rssi, u32 flags, 9606 u8 *eir, u16 eir_len, u8 *scan_rsp, u8 scan_rsp_len) 9607 { 9608 char buf[512]; 9609 struct mgmt_ev_device_found *ev = (void *)buf; 9610 size_t ev_size; 9611 9612 /* Don't send events for a non-kernel initiated discovery. With 9613 * LE one exception is if we have pend_le_reports > 0 in which 9614 * case we're doing passive scanning and want these events. 9615 */ 9616 if (!hci_discovery_active(hdev)) { 9617 if (link_type == ACL_LINK) 9618 return; 9619 if (link_type == LE_LINK && 9620 list_empty(&hdev->pend_le_reports) && 9621 !hci_is_adv_monitoring(hdev)) { 9622 return; 9623 } 9624 } 9625 9626 if (hdev->discovery.result_filtering) { 9627 /* We are using service discovery */ 9628 if (!is_filter_match(hdev, rssi, eir, eir_len, scan_rsp, 9629 scan_rsp_len)) 9630 return; 9631 } 9632 9633 if (hdev->discovery.limited) { 9634 /* Check for limited discoverable bit */ 9635 if (dev_class) { 9636 if (!(dev_class[1] & 0x20)) 9637 return; 9638 } else { 9639 u8 *flags = eir_get_data(eir, eir_len, EIR_FLAGS, NULL); 9640 if (!flags || !(flags[0] & LE_AD_LIMITED)) 9641 return; 9642 } 9643 } 9644 9645 /* Make sure that the buffer is big enough. The 5 extra bytes 9646 * are for the potential CoD field. 9647 */ 9648 if (sizeof(*ev) + eir_len + scan_rsp_len + 5 > sizeof(buf)) 9649 return; 9650 9651 memset(buf, 0, sizeof(buf)); 9652 9653 /* In case of device discovery with BR/EDR devices (pre 1.2), the 9654 * RSSI value was reported as 0 when not available. This behavior 9655 * is kept when using device discovery. This is required for full 9656 * backwards compatibility with the API. 9657 * 9658 * However when using service discovery, the value 127 will be 9659 * returned when the RSSI is not available. 9660 */ 9661 if (rssi == HCI_RSSI_INVALID && !hdev->discovery.report_invalid_rssi && 9662 link_type == ACL_LINK) 9663 rssi = 0; 9664 9665 bacpy(&ev->addr.bdaddr, bdaddr); 9666 ev->addr.type = link_to_bdaddr(link_type, addr_type); 9667 ev->rssi = rssi; 9668 ev->flags = cpu_to_le32(flags); 9669 9670 if (eir_len > 0) 9671 /* Copy EIR or advertising data into event */ 9672 memcpy(ev->eir, eir, eir_len); 9673 9674 if (dev_class && !eir_get_data(ev->eir, eir_len, EIR_CLASS_OF_DEV, 9675 NULL)) 9676 eir_len = eir_append_data(ev->eir, eir_len, EIR_CLASS_OF_DEV, 9677 dev_class, 3); 9678 9679 if (scan_rsp_len > 0) 9680 /* Append scan response data to event */ 9681 memcpy(ev->eir + eir_len, scan_rsp, scan_rsp_len); 9682 9683 ev->eir_len = cpu_to_le16(eir_len + scan_rsp_len); 9684 ev_size = sizeof(*ev) + eir_len + scan_rsp_len; 9685 9686 mgmt_event(MGMT_EV_DEVICE_FOUND, hdev, ev, ev_size, NULL); 9687 } 9688 9689 void mgmt_remote_name(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type, 9690 u8 addr_type, s8 rssi, u8 *name, u8 name_len) 9691 { 9692 struct mgmt_ev_device_found *ev; 9693 char buf[sizeof(*ev) + HCI_MAX_NAME_LENGTH + 2]; 9694 u16 eir_len; 9695 9696 ev = (struct mgmt_ev_device_found *) buf; 9697 9698 memset(buf, 0, sizeof(buf)); 9699 9700 bacpy(&ev->addr.bdaddr, bdaddr); 9701 ev->addr.type = link_to_bdaddr(link_type, addr_type); 9702 ev->rssi = rssi; 9703 9704 eir_len = eir_append_data(ev->eir, 0, EIR_NAME_COMPLETE, name, 9705 name_len); 9706 9707 ev->eir_len = cpu_to_le16(eir_len); 9708 9709 mgmt_event(MGMT_EV_DEVICE_FOUND, hdev, ev, sizeof(*ev) + eir_len, NULL); 9710 } 9711 9712 void mgmt_discovering(struct hci_dev *hdev, u8 discovering) 9713 { 9714 struct mgmt_ev_discovering ev; 9715 9716 bt_dev_dbg(hdev, "discovering %u", discovering); 9717 9718 memset(&ev, 0, sizeof(ev)); 9719 ev.type = hdev->discovery.type; 9720 ev.discovering = discovering; 9721 9722 mgmt_event(MGMT_EV_DISCOVERING, hdev, &ev, sizeof(ev), NULL); 9723 } 9724 9725 void mgmt_suspending(struct hci_dev *hdev, u8 state) 9726 { 9727 struct mgmt_ev_controller_suspend ev; 9728 9729 ev.suspend_state = state; 9730 mgmt_event(MGMT_EV_CONTROLLER_SUSPEND, hdev, &ev, sizeof(ev), NULL); 9731 } 9732 9733 void mgmt_resuming(struct hci_dev *hdev, u8 reason, bdaddr_t *bdaddr, 9734 u8 addr_type) 9735 { 9736 struct mgmt_ev_controller_resume ev; 9737 9738 ev.wake_reason = reason; 9739 if (bdaddr) { 9740 bacpy(&ev.addr.bdaddr, bdaddr); 9741 ev.addr.type = addr_type; 9742 } else { 9743 memset(&ev.addr, 0, sizeof(ev.addr)); 9744 } 9745 9746 mgmt_event(MGMT_EV_CONTROLLER_RESUME, hdev, &ev, sizeof(ev), NULL); 9747 } 9748 9749 static struct hci_mgmt_chan chan = { 9750 .channel = HCI_CHANNEL_CONTROL, 9751 .handler_count = ARRAY_SIZE(mgmt_handlers), 9752 .handlers = mgmt_handlers, 9753 .hdev_init = mgmt_init_hdev, 9754 }; 9755 9756 int mgmt_init(void) 9757 { 9758 return hci_mgmt_chan_register(&chan); 9759 } 9760 9761 void mgmt_exit(void) 9762 { 9763 hci_mgmt_chan_unregister(&chan); 9764 } 9765