1 /* 2 BlueZ - Bluetooth protocol stack for Linux 3 4 Copyright (C) 2010 Nokia Corporation 5 Copyright (C) 2011-2012 Intel Corporation 6 7 This program is free software; you can redistribute it and/or modify 8 it under the terms of the GNU General Public License version 2 as 9 published by the Free Software Foundation; 10 11 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS 12 OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 13 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS. 14 IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY 15 CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES 16 WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN 17 ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF 18 OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. 19 20 ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS, 21 COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS 22 SOFTWARE IS DISCLAIMED. 23 */ 24 25 /* Bluetooth HCI Management interface */ 26 27 #include <linux/module.h> 28 #include <asm/unaligned.h> 29 30 #include <net/bluetooth/bluetooth.h> 31 #include <net/bluetooth/hci_core.h> 32 #include <net/bluetooth/hci_sock.h> 33 #include <net/bluetooth/l2cap.h> 34 #include <net/bluetooth/mgmt.h> 35 36 #include "hci_request.h" 37 #include "smp.h" 38 #include "mgmt_util.h" 39 #include "mgmt_config.h" 40 #include "msft.h" 41 42 #define MGMT_VERSION 1 43 #define MGMT_REVISION 19 44 45 static const u16 mgmt_commands[] = { 46 MGMT_OP_READ_INDEX_LIST, 47 MGMT_OP_READ_INFO, 48 MGMT_OP_SET_POWERED, 49 MGMT_OP_SET_DISCOVERABLE, 50 MGMT_OP_SET_CONNECTABLE, 51 MGMT_OP_SET_FAST_CONNECTABLE, 52 MGMT_OP_SET_BONDABLE, 53 MGMT_OP_SET_LINK_SECURITY, 54 MGMT_OP_SET_SSP, 55 MGMT_OP_SET_HS, 56 MGMT_OP_SET_LE, 57 MGMT_OP_SET_DEV_CLASS, 58 MGMT_OP_SET_LOCAL_NAME, 59 MGMT_OP_ADD_UUID, 60 MGMT_OP_REMOVE_UUID, 61 MGMT_OP_LOAD_LINK_KEYS, 62 MGMT_OP_LOAD_LONG_TERM_KEYS, 63 MGMT_OP_DISCONNECT, 64 MGMT_OP_GET_CONNECTIONS, 65 MGMT_OP_PIN_CODE_REPLY, 66 MGMT_OP_PIN_CODE_NEG_REPLY, 67 MGMT_OP_SET_IO_CAPABILITY, 68 MGMT_OP_PAIR_DEVICE, 69 MGMT_OP_CANCEL_PAIR_DEVICE, 70 MGMT_OP_UNPAIR_DEVICE, 71 MGMT_OP_USER_CONFIRM_REPLY, 72 MGMT_OP_USER_CONFIRM_NEG_REPLY, 73 MGMT_OP_USER_PASSKEY_REPLY, 74 MGMT_OP_USER_PASSKEY_NEG_REPLY, 75 MGMT_OP_READ_LOCAL_OOB_DATA, 76 MGMT_OP_ADD_REMOTE_OOB_DATA, 77 MGMT_OP_REMOVE_REMOTE_OOB_DATA, 78 MGMT_OP_START_DISCOVERY, 79 MGMT_OP_STOP_DISCOVERY, 80 MGMT_OP_CONFIRM_NAME, 81 MGMT_OP_BLOCK_DEVICE, 82 MGMT_OP_UNBLOCK_DEVICE, 83 MGMT_OP_SET_DEVICE_ID, 84 MGMT_OP_SET_ADVERTISING, 85 MGMT_OP_SET_BREDR, 86 MGMT_OP_SET_STATIC_ADDRESS, 87 MGMT_OP_SET_SCAN_PARAMS, 88 MGMT_OP_SET_SECURE_CONN, 89 MGMT_OP_SET_DEBUG_KEYS, 90 MGMT_OP_SET_PRIVACY, 91 MGMT_OP_LOAD_IRKS, 92 MGMT_OP_GET_CONN_INFO, 93 MGMT_OP_GET_CLOCK_INFO, 94 MGMT_OP_ADD_DEVICE, 95 MGMT_OP_REMOVE_DEVICE, 96 MGMT_OP_LOAD_CONN_PARAM, 97 MGMT_OP_READ_UNCONF_INDEX_LIST, 98 MGMT_OP_READ_CONFIG_INFO, 99 MGMT_OP_SET_EXTERNAL_CONFIG, 100 MGMT_OP_SET_PUBLIC_ADDRESS, 101 MGMT_OP_START_SERVICE_DISCOVERY, 102 MGMT_OP_READ_LOCAL_OOB_EXT_DATA, 103 MGMT_OP_READ_EXT_INDEX_LIST, 104 MGMT_OP_READ_ADV_FEATURES, 105 MGMT_OP_ADD_ADVERTISING, 106 MGMT_OP_REMOVE_ADVERTISING, 107 MGMT_OP_GET_ADV_SIZE_INFO, 108 MGMT_OP_START_LIMITED_DISCOVERY, 109 MGMT_OP_READ_EXT_INFO, 110 MGMT_OP_SET_APPEARANCE, 111 MGMT_OP_SET_BLOCKED_KEYS, 112 MGMT_OP_SET_WIDEBAND_SPEECH, 113 MGMT_OP_READ_CONTROLLER_CAP, 114 MGMT_OP_READ_EXP_FEATURES_INFO, 115 MGMT_OP_SET_EXP_FEATURE, 116 MGMT_OP_READ_DEF_SYSTEM_CONFIG, 117 MGMT_OP_SET_DEF_SYSTEM_CONFIG, 118 MGMT_OP_READ_DEF_RUNTIME_CONFIG, 119 MGMT_OP_SET_DEF_RUNTIME_CONFIG, 120 MGMT_OP_GET_DEVICE_FLAGS, 121 MGMT_OP_SET_DEVICE_FLAGS, 122 MGMT_OP_READ_ADV_MONITOR_FEATURES, 123 MGMT_OP_ADD_ADV_PATTERNS_MONITOR, 124 MGMT_OP_REMOVE_ADV_MONITOR, 125 MGMT_OP_ADD_EXT_ADV_PARAMS, 126 MGMT_OP_ADD_EXT_ADV_DATA, 127 MGMT_OP_ADD_ADV_PATTERNS_MONITOR_RSSI, 128 }; 129 130 static const u16 mgmt_events[] = { 131 MGMT_EV_CONTROLLER_ERROR, 132 MGMT_EV_INDEX_ADDED, 133 MGMT_EV_INDEX_REMOVED, 134 MGMT_EV_NEW_SETTINGS, 135 MGMT_EV_CLASS_OF_DEV_CHANGED, 136 MGMT_EV_LOCAL_NAME_CHANGED, 137 MGMT_EV_NEW_LINK_KEY, 138 MGMT_EV_NEW_LONG_TERM_KEY, 139 MGMT_EV_DEVICE_CONNECTED, 140 MGMT_EV_DEVICE_DISCONNECTED, 141 MGMT_EV_CONNECT_FAILED, 142 MGMT_EV_PIN_CODE_REQUEST, 143 MGMT_EV_USER_CONFIRM_REQUEST, 144 MGMT_EV_USER_PASSKEY_REQUEST, 145 MGMT_EV_AUTH_FAILED, 146 MGMT_EV_DEVICE_FOUND, 147 MGMT_EV_DISCOVERING, 148 MGMT_EV_DEVICE_BLOCKED, 149 MGMT_EV_DEVICE_UNBLOCKED, 150 MGMT_EV_DEVICE_UNPAIRED, 151 MGMT_EV_PASSKEY_NOTIFY, 152 MGMT_EV_NEW_IRK, 153 MGMT_EV_NEW_CSRK, 154 MGMT_EV_DEVICE_ADDED, 155 MGMT_EV_DEVICE_REMOVED, 156 MGMT_EV_NEW_CONN_PARAM, 157 MGMT_EV_UNCONF_INDEX_ADDED, 158 MGMT_EV_UNCONF_INDEX_REMOVED, 159 MGMT_EV_NEW_CONFIG_OPTIONS, 160 MGMT_EV_EXT_INDEX_ADDED, 161 MGMT_EV_EXT_INDEX_REMOVED, 162 MGMT_EV_LOCAL_OOB_DATA_UPDATED, 163 MGMT_EV_ADVERTISING_ADDED, 164 MGMT_EV_ADVERTISING_REMOVED, 165 MGMT_EV_EXT_INFO_CHANGED, 166 MGMT_EV_PHY_CONFIGURATION_CHANGED, 167 MGMT_EV_EXP_FEATURE_CHANGED, 168 MGMT_EV_DEVICE_FLAGS_CHANGED, 169 MGMT_EV_CONTROLLER_SUSPEND, 170 MGMT_EV_CONTROLLER_RESUME, 171 }; 172 173 static const u16 mgmt_untrusted_commands[] = { 174 MGMT_OP_READ_INDEX_LIST, 175 MGMT_OP_READ_INFO, 176 MGMT_OP_READ_UNCONF_INDEX_LIST, 177 MGMT_OP_READ_CONFIG_INFO, 178 MGMT_OP_READ_EXT_INDEX_LIST, 179 MGMT_OP_READ_EXT_INFO, 180 MGMT_OP_READ_CONTROLLER_CAP, 181 MGMT_OP_READ_EXP_FEATURES_INFO, 182 MGMT_OP_READ_DEF_SYSTEM_CONFIG, 183 MGMT_OP_READ_DEF_RUNTIME_CONFIG, 184 }; 185 186 static const u16 mgmt_untrusted_events[] = { 187 MGMT_EV_INDEX_ADDED, 188 MGMT_EV_INDEX_REMOVED, 189 MGMT_EV_NEW_SETTINGS, 190 MGMT_EV_CLASS_OF_DEV_CHANGED, 191 MGMT_EV_LOCAL_NAME_CHANGED, 192 MGMT_EV_UNCONF_INDEX_ADDED, 193 MGMT_EV_UNCONF_INDEX_REMOVED, 194 MGMT_EV_NEW_CONFIG_OPTIONS, 195 MGMT_EV_EXT_INDEX_ADDED, 196 MGMT_EV_EXT_INDEX_REMOVED, 197 MGMT_EV_EXT_INFO_CHANGED, 198 MGMT_EV_EXP_FEATURE_CHANGED, 199 MGMT_EV_ADV_MONITOR_ADDED, 200 MGMT_EV_ADV_MONITOR_REMOVED, 201 }; 202 203 #define CACHE_TIMEOUT msecs_to_jiffies(2 * 1000) 204 205 #define ZERO_KEY "\x00\x00\x00\x00\x00\x00\x00\x00" \ 206 "\x00\x00\x00\x00\x00\x00\x00\x00" 207 208 /* HCI to MGMT error code conversion table */ 209 static const u8 mgmt_status_table[] = { 210 MGMT_STATUS_SUCCESS, 211 MGMT_STATUS_UNKNOWN_COMMAND, /* Unknown Command */ 212 MGMT_STATUS_NOT_CONNECTED, /* No Connection */ 213 MGMT_STATUS_FAILED, /* Hardware Failure */ 214 MGMT_STATUS_CONNECT_FAILED, /* Page Timeout */ 215 MGMT_STATUS_AUTH_FAILED, /* Authentication Failed */ 216 MGMT_STATUS_AUTH_FAILED, /* PIN or Key Missing */ 217 MGMT_STATUS_NO_RESOURCES, /* Memory Full */ 218 MGMT_STATUS_TIMEOUT, /* Connection Timeout */ 219 MGMT_STATUS_NO_RESOURCES, /* Max Number of Connections */ 220 MGMT_STATUS_NO_RESOURCES, /* Max Number of SCO Connections */ 221 MGMT_STATUS_ALREADY_CONNECTED, /* ACL Connection Exists */ 222 MGMT_STATUS_BUSY, /* Command Disallowed */ 223 MGMT_STATUS_NO_RESOURCES, /* Rejected Limited Resources */ 224 MGMT_STATUS_REJECTED, /* Rejected Security */ 225 MGMT_STATUS_REJECTED, /* Rejected Personal */ 226 MGMT_STATUS_TIMEOUT, /* Host Timeout */ 227 MGMT_STATUS_NOT_SUPPORTED, /* Unsupported Feature */ 228 MGMT_STATUS_INVALID_PARAMS, /* Invalid Parameters */ 229 MGMT_STATUS_DISCONNECTED, /* OE User Ended Connection */ 230 MGMT_STATUS_NO_RESOURCES, /* OE Low Resources */ 231 MGMT_STATUS_DISCONNECTED, /* OE Power Off */ 232 MGMT_STATUS_DISCONNECTED, /* Connection Terminated */ 233 MGMT_STATUS_BUSY, /* Repeated Attempts */ 234 MGMT_STATUS_REJECTED, /* Pairing Not Allowed */ 235 MGMT_STATUS_FAILED, /* Unknown LMP PDU */ 236 MGMT_STATUS_NOT_SUPPORTED, /* Unsupported Remote Feature */ 237 MGMT_STATUS_REJECTED, /* SCO Offset Rejected */ 238 MGMT_STATUS_REJECTED, /* SCO Interval Rejected */ 239 MGMT_STATUS_REJECTED, /* Air Mode Rejected */ 240 MGMT_STATUS_INVALID_PARAMS, /* Invalid LMP Parameters */ 241 MGMT_STATUS_FAILED, /* Unspecified Error */ 242 MGMT_STATUS_NOT_SUPPORTED, /* Unsupported LMP Parameter Value */ 243 MGMT_STATUS_FAILED, /* Role Change Not Allowed */ 244 MGMT_STATUS_TIMEOUT, /* LMP Response Timeout */ 245 MGMT_STATUS_FAILED, /* LMP Error Transaction Collision */ 246 MGMT_STATUS_FAILED, /* LMP PDU Not Allowed */ 247 MGMT_STATUS_REJECTED, /* Encryption Mode Not Accepted */ 248 MGMT_STATUS_FAILED, /* Unit Link Key Used */ 249 MGMT_STATUS_NOT_SUPPORTED, /* QoS Not Supported */ 250 MGMT_STATUS_TIMEOUT, /* Instant Passed */ 251 MGMT_STATUS_NOT_SUPPORTED, /* Pairing Not Supported */ 252 MGMT_STATUS_FAILED, /* Transaction Collision */ 253 MGMT_STATUS_INVALID_PARAMS, /* Unacceptable Parameter */ 254 MGMT_STATUS_REJECTED, /* QoS Rejected */ 255 MGMT_STATUS_NOT_SUPPORTED, /* Classification Not Supported */ 256 MGMT_STATUS_REJECTED, /* Insufficient Security */ 257 MGMT_STATUS_INVALID_PARAMS, /* Parameter Out Of Range */ 258 MGMT_STATUS_BUSY, /* Role Switch Pending */ 259 MGMT_STATUS_FAILED, /* Slot Violation */ 260 MGMT_STATUS_FAILED, /* Role Switch Failed */ 261 MGMT_STATUS_INVALID_PARAMS, /* EIR Too Large */ 262 MGMT_STATUS_NOT_SUPPORTED, /* Simple Pairing Not Supported */ 263 MGMT_STATUS_BUSY, /* Host Busy Pairing */ 264 MGMT_STATUS_REJECTED, /* Rejected, No Suitable Channel */ 265 MGMT_STATUS_BUSY, /* Controller Busy */ 266 MGMT_STATUS_INVALID_PARAMS, /* Unsuitable Connection Interval */ 267 MGMT_STATUS_TIMEOUT, /* Directed Advertising Timeout */ 268 MGMT_STATUS_AUTH_FAILED, /* Terminated Due to MIC Failure */ 269 MGMT_STATUS_CONNECT_FAILED, /* Connection Establishment Failed */ 270 MGMT_STATUS_CONNECT_FAILED, /* MAC Connection Failed */ 271 }; 272 273 static u8 mgmt_status(u8 hci_status) 274 { 275 if (hci_status < ARRAY_SIZE(mgmt_status_table)) 276 return mgmt_status_table[hci_status]; 277 278 return MGMT_STATUS_FAILED; 279 } 280 281 static int mgmt_index_event(u16 event, struct hci_dev *hdev, void *data, 282 u16 len, int flag) 283 { 284 return mgmt_send_event(event, hdev, HCI_CHANNEL_CONTROL, data, len, 285 flag, NULL); 286 } 287 288 static int mgmt_limited_event(u16 event, struct hci_dev *hdev, void *data, 289 u16 len, int flag, struct sock *skip_sk) 290 { 291 return mgmt_send_event(event, hdev, HCI_CHANNEL_CONTROL, data, len, 292 flag, skip_sk); 293 } 294 295 static int mgmt_event(u16 event, struct hci_dev *hdev, void *data, u16 len, 296 struct sock *skip_sk) 297 { 298 return mgmt_send_event(event, hdev, HCI_CHANNEL_CONTROL, data, len, 299 HCI_SOCK_TRUSTED, skip_sk); 300 } 301 302 static u8 le_addr_type(u8 mgmt_addr_type) 303 { 304 if (mgmt_addr_type == BDADDR_LE_PUBLIC) 305 return ADDR_LE_DEV_PUBLIC; 306 else 307 return ADDR_LE_DEV_RANDOM; 308 } 309 310 void mgmt_fill_version_info(void *ver) 311 { 312 struct mgmt_rp_read_version *rp = ver; 313 314 rp->version = MGMT_VERSION; 315 rp->revision = cpu_to_le16(MGMT_REVISION); 316 } 317 318 static int read_version(struct sock *sk, struct hci_dev *hdev, void *data, 319 u16 data_len) 320 { 321 struct mgmt_rp_read_version rp; 322 323 bt_dev_dbg(hdev, "sock %p", sk); 324 325 mgmt_fill_version_info(&rp); 326 327 return mgmt_cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_VERSION, 0, 328 &rp, sizeof(rp)); 329 } 330 331 static int read_commands(struct sock *sk, struct hci_dev *hdev, void *data, 332 u16 data_len) 333 { 334 struct mgmt_rp_read_commands *rp; 335 u16 num_commands, num_events; 336 size_t rp_size; 337 int i, err; 338 339 bt_dev_dbg(hdev, "sock %p", sk); 340 341 if (hci_sock_test_flag(sk, HCI_SOCK_TRUSTED)) { 342 num_commands = ARRAY_SIZE(mgmt_commands); 343 num_events = ARRAY_SIZE(mgmt_events); 344 } else { 345 num_commands = ARRAY_SIZE(mgmt_untrusted_commands); 346 num_events = ARRAY_SIZE(mgmt_untrusted_events); 347 } 348 349 rp_size = sizeof(*rp) + ((num_commands + num_events) * sizeof(u16)); 350 351 rp = kmalloc(rp_size, GFP_KERNEL); 352 if (!rp) 353 return -ENOMEM; 354 355 rp->num_commands = cpu_to_le16(num_commands); 356 rp->num_events = cpu_to_le16(num_events); 357 358 if (hci_sock_test_flag(sk, HCI_SOCK_TRUSTED)) { 359 __le16 *opcode = rp->opcodes; 360 361 for (i = 0; i < num_commands; i++, opcode++) 362 put_unaligned_le16(mgmt_commands[i], opcode); 363 364 for (i = 0; i < num_events; i++, opcode++) 365 put_unaligned_le16(mgmt_events[i], opcode); 366 } else { 367 __le16 *opcode = rp->opcodes; 368 369 for (i = 0; i < num_commands; i++, opcode++) 370 put_unaligned_le16(mgmt_untrusted_commands[i], opcode); 371 372 for (i = 0; i < num_events; i++, opcode++) 373 put_unaligned_le16(mgmt_untrusted_events[i], opcode); 374 } 375 376 err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_COMMANDS, 0, 377 rp, rp_size); 378 kfree(rp); 379 380 return err; 381 } 382 383 static int read_index_list(struct sock *sk, struct hci_dev *hdev, void *data, 384 u16 data_len) 385 { 386 struct mgmt_rp_read_index_list *rp; 387 struct hci_dev *d; 388 size_t rp_len; 389 u16 count; 390 int err; 391 392 bt_dev_dbg(hdev, "sock %p", sk); 393 394 read_lock(&hci_dev_list_lock); 395 396 count = 0; 397 list_for_each_entry(d, &hci_dev_list, list) { 398 if (d->dev_type == HCI_PRIMARY && 399 !hci_dev_test_flag(d, HCI_UNCONFIGURED)) 400 count++; 401 } 402 403 rp_len = sizeof(*rp) + (2 * count); 404 rp = kmalloc(rp_len, GFP_ATOMIC); 405 if (!rp) { 406 read_unlock(&hci_dev_list_lock); 407 return -ENOMEM; 408 } 409 410 count = 0; 411 list_for_each_entry(d, &hci_dev_list, list) { 412 if (hci_dev_test_flag(d, HCI_SETUP) || 413 hci_dev_test_flag(d, HCI_CONFIG) || 414 hci_dev_test_flag(d, HCI_USER_CHANNEL)) 415 continue; 416 417 /* Devices marked as raw-only are neither configured 418 * nor unconfigured controllers. 419 */ 420 if (test_bit(HCI_QUIRK_RAW_DEVICE, &d->quirks)) 421 continue; 422 423 if (d->dev_type == HCI_PRIMARY && 424 !hci_dev_test_flag(d, HCI_UNCONFIGURED)) { 425 rp->index[count++] = cpu_to_le16(d->id); 426 bt_dev_dbg(hdev, "Added hci%u", d->id); 427 } 428 } 429 430 rp->num_controllers = cpu_to_le16(count); 431 rp_len = sizeof(*rp) + (2 * count); 432 433 read_unlock(&hci_dev_list_lock); 434 435 err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_INDEX_LIST, 436 0, rp, rp_len); 437 438 kfree(rp); 439 440 return err; 441 } 442 443 static int read_unconf_index_list(struct sock *sk, struct hci_dev *hdev, 444 void *data, u16 data_len) 445 { 446 struct mgmt_rp_read_unconf_index_list *rp; 447 struct hci_dev *d; 448 size_t rp_len; 449 u16 count; 450 int err; 451 452 bt_dev_dbg(hdev, "sock %p", sk); 453 454 read_lock(&hci_dev_list_lock); 455 456 count = 0; 457 list_for_each_entry(d, &hci_dev_list, list) { 458 if (d->dev_type == HCI_PRIMARY && 459 hci_dev_test_flag(d, HCI_UNCONFIGURED)) 460 count++; 461 } 462 463 rp_len = sizeof(*rp) + (2 * count); 464 rp = kmalloc(rp_len, GFP_ATOMIC); 465 if (!rp) { 466 read_unlock(&hci_dev_list_lock); 467 return -ENOMEM; 468 } 469 470 count = 0; 471 list_for_each_entry(d, &hci_dev_list, list) { 472 if (hci_dev_test_flag(d, HCI_SETUP) || 473 hci_dev_test_flag(d, HCI_CONFIG) || 474 hci_dev_test_flag(d, HCI_USER_CHANNEL)) 475 continue; 476 477 /* Devices marked as raw-only are neither configured 478 * nor unconfigured controllers. 479 */ 480 if (test_bit(HCI_QUIRK_RAW_DEVICE, &d->quirks)) 481 continue; 482 483 if (d->dev_type == HCI_PRIMARY && 484 hci_dev_test_flag(d, HCI_UNCONFIGURED)) { 485 rp->index[count++] = cpu_to_le16(d->id); 486 bt_dev_dbg(hdev, "Added hci%u", d->id); 487 } 488 } 489 490 rp->num_controllers = cpu_to_le16(count); 491 rp_len = sizeof(*rp) + (2 * count); 492 493 read_unlock(&hci_dev_list_lock); 494 495 err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE, 496 MGMT_OP_READ_UNCONF_INDEX_LIST, 0, rp, rp_len); 497 498 kfree(rp); 499 500 return err; 501 } 502 503 static int read_ext_index_list(struct sock *sk, struct hci_dev *hdev, 504 void *data, u16 data_len) 505 { 506 struct mgmt_rp_read_ext_index_list *rp; 507 struct hci_dev *d; 508 u16 count; 509 int err; 510 511 bt_dev_dbg(hdev, "sock %p", sk); 512 513 read_lock(&hci_dev_list_lock); 514 515 count = 0; 516 list_for_each_entry(d, &hci_dev_list, list) { 517 if (d->dev_type == HCI_PRIMARY || d->dev_type == HCI_AMP) 518 count++; 519 } 520 521 rp = kmalloc(struct_size(rp, entry, count), GFP_ATOMIC); 522 if (!rp) { 523 read_unlock(&hci_dev_list_lock); 524 return -ENOMEM; 525 } 526 527 count = 0; 528 list_for_each_entry(d, &hci_dev_list, list) { 529 if (hci_dev_test_flag(d, HCI_SETUP) || 530 hci_dev_test_flag(d, HCI_CONFIG) || 531 hci_dev_test_flag(d, HCI_USER_CHANNEL)) 532 continue; 533 534 /* Devices marked as raw-only are neither configured 535 * nor unconfigured controllers. 536 */ 537 if (test_bit(HCI_QUIRK_RAW_DEVICE, &d->quirks)) 538 continue; 539 540 if (d->dev_type == HCI_PRIMARY) { 541 if (hci_dev_test_flag(d, HCI_UNCONFIGURED)) 542 rp->entry[count].type = 0x01; 543 else 544 rp->entry[count].type = 0x00; 545 } else if (d->dev_type == HCI_AMP) { 546 rp->entry[count].type = 0x02; 547 } else { 548 continue; 549 } 550 551 rp->entry[count].bus = d->bus; 552 rp->entry[count++].index = cpu_to_le16(d->id); 553 bt_dev_dbg(hdev, "Added hci%u", d->id); 554 } 555 556 rp->num_controllers = cpu_to_le16(count); 557 558 read_unlock(&hci_dev_list_lock); 559 560 /* If this command is called at least once, then all the 561 * default index and unconfigured index events are disabled 562 * and from now on only extended index events are used. 563 */ 564 hci_sock_set_flag(sk, HCI_MGMT_EXT_INDEX_EVENTS); 565 hci_sock_clear_flag(sk, HCI_MGMT_INDEX_EVENTS); 566 hci_sock_clear_flag(sk, HCI_MGMT_UNCONF_INDEX_EVENTS); 567 568 err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE, 569 MGMT_OP_READ_EXT_INDEX_LIST, 0, rp, 570 struct_size(rp, entry, count)); 571 572 kfree(rp); 573 574 return err; 575 } 576 577 static bool is_configured(struct hci_dev *hdev) 578 { 579 if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks) && 580 !hci_dev_test_flag(hdev, HCI_EXT_CONFIGURED)) 581 return false; 582 583 if ((test_bit(HCI_QUIRK_INVALID_BDADDR, &hdev->quirks) || 584 test_bit(HCI_QUIRK_USE_BDADDR_PROPERTY, &hdev->quirks)) && 585 !bacmp(&hdev->public_addr, BDADDR_ANY)) 586 return false; 587 588 return true; 589 } 590 591 static __le32 get_missing_options(struct hci_dev *hdev) 592 { 593 u32 options = 0; 594 595 if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks) && 596 !hci_dev_test_flag(hdev, HCI_EXT_CONFIGURED)) 597 options |= MGMT_OPTION_EXTERNAL_CONFIG; 598 599 if ((test_bit(HCI_QUIRK_INVALID_BDADDR, &hdev->quirks) || 600 test_bit(HCI_QUIRK_USE_BDADDR_PROPERTY, &hdev->quirks)) && 601 !bacmp(&hdev->public_addr, BDADDR_ANY)) 602 options |= MGMT_OPTION_PUBLIC_ADDRESS; 603 604 return cpu_to_le32(options); 605 } 606 607 static int new_options(struct hci_dev *hdev, struct sock *skip) 608 { 609 __le32 options = get_missing_options(hdev); 610 611 return mgmt_limited_event(MGMT_EV_NEW_CONFIG_OPTIONS, hdev, &options, 612 sizeof(options), HCI_MGMT_OPTION_EVENTS, skip); 613 } 614 615 static int send_options_rsp(struct sock *sk, u16 opcode, struct hci_dev *hdev) 616 { 617 __le32 options = get_missing_options(hdev); 618 619 return mgmt_cmd_complete(sk, hdev->id, opcode, 0, &options, 620 sizeof(options)); 621 } 622 623 static int read_config_info(struct sock *sk, struct hci_dev *hdev, 624 void *data, u16 data_len) 625 { 626 struct mgmt_rp_read_config_info rp; 627 u32 options = 0; 628 629 bt_dev_dbg(hdev, "sock %p", sk); 630 631 hci_dev_lock(hdev); 632 633 memset(&rp, 0, sizeof(rp)); 634 rp.manufacturer = cpu_to_le16(hdev->manufacturer); 635 636 if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks)) 637 options |= MGMT_OPTION_EXTERNAL_CONFIG; 638 639 if (hdev->set_bdaddr) 640 options |= MGMT_OPTION_PUBLIC_ADDRESS; 641 642 rp.supported_options = cpu_to_le32(options); 643 rp.missing_options = get_missing_options(hdev); 644 645 hci_dev_unlock(hdev); 646 647 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_CONFIG_INFO, 0, 648 &rp, sizeof(rp)); 649 } 650 651 static u32 get_supported_phys(struct hci_dev *hdev) 652 { 653 u32 supported_phys = 0; 654 655 if (lmp_bredr_capable(hdev)) { 656 supported_phys |= MGMT_PHY_BR_1M_1SLOT; 657 658 if (hdev->features[0][0] & LMP_3SLOT) 659 supported_phys |= MGMT_PHY_BR_1M_3SLOT; 660 661 if (hdev->features[0][0] & LMP_5SLOT) 662 supported_phys |= MGMT_PHY_BR_1M_5SLOT; 663 664 if (lmp_edr_2m_capable(hdev)) { 665 supported_phys |= MGMT_PHY_EDR_2M_1SLOT; 666 667 if (lmp_edr_3slot_capable(hdev)) 668 supported_phys |= MGMT_PHY_EDR_2M_3SLOT; 669 670 if (lmp_edr_5slot_capable(hdev)) 671 supported_phys |= MGMT_PHY_EDR_2M_5SLOT; 672 673 if (lmp_edr_3m_capable(hdev)) { 674 supported_phys |= MGMT_PHY_EDR_3M_1SLOT; 675 676 if (lmp_edr_3slot_capable(hdev)) 677 supported_phys |= MGMT_PHY_EDR_3M_3SLOT; 678 679 if (lmp_edr_5slot_capable(hdev)) 680 supported_phys |= MGMT_PHY_EDR_3M_5SLOT; 681 } 682 } 683 } 684 685 if (lmp_le_capable(hdev)) { 686 supported_phys |= MGMT_PHY_LE_1M_TX; 687 supported_phys |= MGMT_PHY_LE_1M_RX; 688 689 if (hdev->le_features[1] & HCI_LE_PHY_2M) { 690 supported_phys |= MGMT_PHY_LE_2M_TX; 691 supported_phys |= MGMT_PHY_LE_2M_RX; 692 } 693 694 if (hdev->le_features[1] & HCI_LE_PHY_CODED) { 695 supported_phys |= MGMT_PHY_LE_CODED_TX; 696 supported_phys |= MGMT_PHY_LE_CODED_RX; 697 } 698 } 699 700 return supported_phys; 701 } 702 703 static u32 get_selected_phys(struct hci_dev *hdev) 704 { 705 u32 selected_phys = 0; 706 707 if (lmp_bredr_capable(hdev)) { 708 selected_phys |= MGMT_PHY_BR_1M_1SLOT; 709 710 if (hdev->pkt_type & (HCI_DM3 | HCI_DH3)) 711 selected_phys |= MGMT_PHY_BR_1M_3SLOT; 712 713 if (hdev->pkt_type & (HCI_DM5 | HCI_DH5)) 714 selected_phys |= MGMT_PHY_BR_1M_5SLOT; 715 716 if (lmp_edr_2m_capable(hdev)) { 717 if (!(hdev->pkt_type & HCI_2DH1)) 718 selected_phys |= MGMT_PHY_EDR_2M_1SLOT; 719 720 if (lmp_edr_3slot_capable(hdev) && 721 !(hdev->pkt_type & HCI_2DH3)) 722 selected_phys |= MGMT_PHY_EDR_2M_3SLOT; 723 724 if (lmp_edr_5slot_capable(hdev) && 725 !(hdev->pkt_type & HCI_2DH5)) 726 selected_phys |= MGMT_PHY_EDR_2M_5SLOT; 727 728 if (lmp_edr_3m_capable(hdev)) { 729 if (!(hdev->pkt_type & HCI_3DH1)) 730 selected_phys |= MGMT_PHY_EDR_3M_1SLOT; 731 732 if (lmp_edr_3slot_capable(hdev) && 733 !(hdev->pkt_type & HCI_3DH3)) 734 selected_phys |= MGMT_PHY_EDR_3M_3SLOT; 735 736 if (lmp_edr_5slot_capable(hdev) && 737 !(hdev->pkt_type & HCI_3DH5)) 738 selected_phys |= MGMT_PHY_EDR_3M_5SLOT; 739 } 740 } 741 } 742 743 if (lmp_le_capable(hdev)) { 744 if (hdev->le_tx_def_phys & HCI_LE_SET_PHY_1M) 745 selected_phys |= MGMT_PHY_LE_1M_TX; 746 747 if (hdev->le_rx_def_phys & HCI_LE_SET_PHY_1M) 748 selected_phys |= MGMT_PHY_LE_1M_RX; 749 750 if (hdev->le_tx_def_phys & HCI_LE_SET_PHY_2M) 751 selected_phys |= MGMT_PHY_LE_2M_TX; 752 753 if (hdev->le_rx_def_phys & HCI_LE_SET_PHY_2M) 754 selected_phys |= MGMT_PHY_LE_2M_RX; 755 756 if (hdev->le_tx_def_phys & HCI_LE_SET_PHY_CODED) 757 selected_phys |= MGMT_PHY_LE_CODED_TX; 758 759 if (hdev->le_rx_def_phys & HCI_LE_SET_PHY_CODED) 760 selected_phys |= MGMT_PHY_LE_CODED_RX; 761 } 762 763 return selected_phys; 764 } 765 766 static u32 get_configurable_phys(struct hci_dev *hdev) 767 { 768 return (get_supported_phys(hdev) & ~MGMT_PHY_BR_1M_1SLOT & 769 ~MGMT_PHY_LE_1M_TX & ~MGMT_PHY_LE_1M_RX); 770 } 771 772 static u32 get_supported_settings(struct hci_dev *hdev) 773 { 774 u32 settings = 0; 775 776 settings |= MGMT_SETTING_POWERED; 777 settings |= MGMT_SETTING_BONDABLE; 778 settings |= MGMT_SETTING_DEBUG_KEYS; 779 settings |= MGMT_SETTING_CONNECTABLE; 780 settings |= MGMT_SETTING_DISCOVERABLE; 781 782 if (lmp_bredr_capable(hdev)) { 783 if (hdev->hci_ver >= BLUETOOTH_VER_1_2) 784 settings |= MGMT_SETTING_FAST_CONNECTABLE; 785 settings |= MGMT_SETTING_BREDR; 786 settings |= MGMT_SETTING_LINK_SECURITY; 787 788 if (lmp_ssp_capable(hdev)) { 789 settings |= MGMT_SETTING_SSP; 790 if (IS_ENABLED(CONFIG_BT_HS)) 791 settings |= MGMT_SETTING_HS; 792 } 793 794 if (lmp_sc_capable(hdev)) 795 settings |= MGMT_SETTING_SECURE_CONN; 796 797 if (test_bit(HCI_QUIRK_WIDEBAND_SPEECH_SUPPORTED, 798 &hdev->quirks)) 799 settings |= MGMT_SETTING_WIDEBAND_SPEECH; 800 } 801 802 if (lmp_le_capable(hdev)) { 803 settings |= MGMT_SETTING_LE; 804 settings |= MGMT_SETTING_SECURE_CONN; 805 settings |= MGMT_SETTING_PRIVACY; 806 settings |= MGMT_SETTING_STATIC_ADDRESS; 807 808 /* When the experimental feature for LL Privacy support is 809 * enabled, then advertising is no longer supported. 810 */ 811 if (!hci_dev_test_flag(hdev, HCI_ENABLE_LL_PRIVACY)) 812 settings |= MGMT_SETTING_ADVERTISING; 813 } 814 815 if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks) || 816 hdev->set_bdaddr) 817 settings |= MGMT_SETTING_CONFIGURATION; 818 819 settings |= MGMT_SETTING_PHY_CONFIGURATION; 820 821 return settings; 822 } 823 824 static u32 get_current_settings(struct hci_dev *hdev) 825 { 826 u32 settings = 0; 827 828 if (hdev_is_powered(hdev)) 829 settings |= MGMT_SETTING_POWERED; 830 831 if (hci_dev_test_flag(hdev, HCI_CONNECTABLE)) 832 settings |= MGMT_SETTING_CONNECTABLE; 833 834 if (hci_dev_test_flag(hdev, HCI_FAST_CONNECTABLE)) 835 settings |= MGMT_SETTING_FAST_CONNECTABLE; 836 837 if (hci_dev_test_flag(hdev, HCI_DISCOVERABLE)) 838 settings |= MGMT_SETTING_DISCOVERABLE; 839 840 if (hci_dev_test_flag(hdev, HCI_BONDABLE)) 841 settings |= MGMT_SETTING_BONDABLE; 842 843 if (hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) 844 settings |= MGMT_SETTING_BREDR; 845 846 if (hci_dev_test_flag(hdev, HCI_LE_ENABLED)) 847 settings |= MGMT_SETTING_LE; 848 849 if (hci_dev_test_flag(hdev, HCI_LINK_SECURITY)) 850 settings |= MGMT_SETTING_LINK_SECURITY; 851 852 if (hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) 853 settings |= MGMT_SETTING_SSP; 854 855 if (hci_dev_test_flag(hdev, HCI_HS_ENABLED)) 856 settings |= MGMT_SETTING_HS; 857 858 if (hci_dev_test_flag(hdev, HCI_ADVERTISING)) 859 settings |= MGMT_SETTING_ADVERTISING; 860 861 if (hci_dev_test_flag(hdev, HCI_SC_ENABLED)) 862 settings |= MGMT_SETTING_SECURE_CONN; 863 864 if (hci_dev_test_flag(hdev, HCI_KEEP_DEBUG_KEYS)) 865 settings |= MGMT_SETTING_DEBUG_KEYS; 866 867 if (hci_dev_test_flag(hdev, HCI_PRIVACY)) 868 settings |= MGMT_SETTING_PRIVACY; 869 870 /* The current setting for static address has two purposes. The 871 * first is to indicate if the static address will be used and 872 * the second is to indicate if it is actually set. 873 * 874 * This means if the static address is not configured, this flag 875 * will never be set. If the address is configured, then if the 876 * address is actually used decides if the flag is set or not. 877 * 878 * For single mode LE only controllers and dual-mode controllers 879 * with BR/EDR disabled, the existence of the static address will 880 * be evaluated. 881 */ 882 if (hci_dev_test_flag(hdev, HCI_FORCE_STATIC_ADDR) || 883 !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) || 884 !bacmp(&hdev->bdaddr, BDADDR_ANY)) { 885 if (bacmp(&hdev->static_addr, BDADDR_ANY)) 886 settings |= MGMT_SETTING_STATIC_ADDRESS; 887 } 888 889 if (hci_dev_test_flag(hdev, HCI_WIDEBAND_SPEECH_ENABLED)) 890 settings |= MGMT_SETTING_WIDEBAND_SPEECH; 891 892 return settings; 893 } 894 895 static struct mgmt_pending_cmd *pending_find(u16 opcode, struct hci_dev *hdev) 896 { 897 return mgmt_pending_find(HCI_CHANNEL_CONTROL, opcode, hdev); 898 } 899 900 static struct mgmt_pending_cmd *pending_find_data(u16 opcode, 901 struct hci_dev *hdev, 902 const void *data) 903 { 904 return mgmt_pending_find_data(HCI_CHANNEL_CONTROL, opcode, hdev, data); 905 } 906 907 u8 mgmt_get_adv_discov_flags(struct hci_dev *hdev) 908 { 909 struct mgmt_pending_cmd *cmd; 910 911 /* If there's a pending mgmt command the flags will not yet have 912 * their final values, so check for this first. 913 */ 914 cmd = pending_find(MGMT_OP_SET_DISCOVERABLE, hdev); 915 if (cmd) { 916 struct mgmt_mode *cp = cmd->param; 917 if (cp->val == 0x01) 918 return LE_AD_GENERAL; 919 else if (cp->val == 0x02) 920 return LE_AD_LIMITED; 921 } else { 922 if (hci_dev_test_flag(hdev, HCI_LIMITED_DISCOVERABLE)) 923 return LE_AD_LIMITED; 924 else if (hci_dev_test_flag(hdev, HCI_DISCOVERABLE)) 925 return LE_AD_GENERAL; 926 } 927 928 return 0; 929 } 930 931 bool mgmt_get_connectable(struct hci_dev *hdev) 932 { 933 struct mgmt_pending_cmd *cmd; 934 935 /* If there's a pending mgmt command the flag will not yet have 936 * it's final value, so check for this first. 937 */ 938 cmd = pending_find(MGMT_OP_SET_CONNECTABLE, hdev); 939 if (cmd) { 940 struct mgmt_mode *cp = cmd->param; 941 942 return cp->val; 943 } 944 945 return hci_dev_test_flag(hdev, HCI_CONNECTABLE); 946 } 947 948 static void service_cache_off(struct work_struct *work) 949 { 950 struct hci_dev *hdev = container_of(work, struct hci_dev, 951 service_cache.work); 952 struct hci_request req; 953 954 if (!hci_dev_test_and_clear_flag(hdev, HCI_SERVICE_CACHE)) 955 return; 956 957 hci_req_init(&req, hdev); 958 959 hci_dev_lock(hdev); 960 961 __hci_req_update_eir(&req); 962 __hci_req_update_class(&req); 963 964 hci_dev_unlock(hdev); 965 966 hci_req_run(&req, NULL); 967 } 968 969 static void rpa_expired(struct work_struct *work) 970 { 971 struct hci_dev *hdev = container_of(work, struct hci_dev, 972 rpa_expired.work); 973 struct hci_request req; 974 975 bt_dev_dbg(hdev, ""); 976 977 hci_dev_set_flag(hdev, HCI_RPA_EXPIRED); 978 979 if (!hci_dev_test_flag(hdev, HCI_ADVERTISING)) 980 return; 981 982 /* The generation of a new RPA and programming it into the 983 * controller happens in the hci_req_enable_advertising() 984 * function. 985 */ 986 hci_req_init(&req, hdev); 987 if (ext_adv_capable(hdev)) 988 __hci_req_start_ext_adv(&req, hdev->cur_adv_instance); 989 else 990 __hci_req_enable_advertising(&req); 991 hci_req_run(&req, NULL); 992 } 993 994 static void mgmt_init_hdev(struct sock *sk, struct hci_dev *hdev) 995 { 996 if (hci_dev_test_and_set_flag(hdev, HCI_MGMT)) 997 return; 998 999 INIT_DELAYED_WORK(&hdev->service_cache, service_cache_off); 1000 INIT_DELAYED_WORK(&hdev->rpa_expired, rpa_expired); 1001 1002 /* Non-mgmt controlled devices get this bit set 1003 * implicitly so that pairing works for them, however 1004 * for mgmt we require user-space to explicitly enable 1005 * it 1006 */ 1007 hci_dev_clear_flag(hdev, HCI_BONDABLE); 1008 } 1009 1010 static int read_controller_info(struct sock *sk, struct hci_dev *hdev, 1011 void *data, u16 data_len) 1012 { 1013 struct mgmt_rp_read_info rp; 1014 1015 bt_dev_dbg(hdev, "sock %p", sk); 1016 1017 hci_dev_lock(hdev); 1018 1019 memset(&rp, 0, sizeof(rp)); 1020 1021 bacpy(&rp.bdaddr, &hdev->bdaddr); 1022 1023 rp.version = hdev->hci_ver; 1024 rp.manufacturer = cpu_to_le16(hdev->manufacturer); 1025 1026 rp.supported_settings = cpu_to_le32(get_supported_settings(hdev)); 1027 rp.current_settings = cpu_to_le32(get_current_settings(hdev)); 1028 1029 memcpy(rp.dev_class, hdev->dev_class, 3); 1030 1031 memcpy(rp.name, hdev->dev_name, sizeof(hdev->dev_name)); 1032 memcpy(rp.short_name, hdev->short_name, sizeof(hdev->short_name)); 1033 1034 hci_dev_unlock(hdev); 1035 1036 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_INFO, 0, &rp, 1037 sizeof(rp)); 1038 } 1039 1040 static u16 append_eir_data_to_buf(struct hci_dev *hdev, u8 *eir) 1041 { 1042 u16 eir_len = 0; 1043 size_t name_len; 1044 1045 if (hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) 1046 eir_len = eir_append_data(eir, eir_len, EIR_CLASS_OF_DEV, 1047 hdev->dev_class, 3); 1048 1049 if (hci_dev_test_flag(hdev, HCI_LE_ENABLED)) 1050 eir_len = eir_append_le16(eir, eir_len, EIR_APPEARANCE, 1051 hdev->appearance); 1052 1053 name_len = strlen(hdev->dev_name); 1054 eir_len = eir_append_data(eir, eir_len, EIR_NAME_COMPLETE, 1055 hdev->dev_name, name_len); 1056 1057 name_len = strlen(hdev->short_name); 1058 eir_len = eir_append_data(eir, eir_len, EIR_NAME_SHORT, 1059 hdev->short_name, name_len); 1060 1061 return eir_len; 1062 } 1063 1064 static int read_ext_controller_info(struct sock *sk, struct hci_dev *hdev, 1065 void *data, u16 data_len) 1066 { 1067 char buf[512]; 1068 struct mgmt_rp_read_ext_info *rp = (void *)buf; 1069 u16 eir_len; 1070 1071 bt_dev_dbg(hdev, "sock %p", sk); 1072 1073 memset(&buf, 0, sizeof(buf)); 1074 1075 hci_dev_lock(hdev); 1076 1077 bacpy(&rp->bdaddr, &hdev->bdaddr); 1078 1079 rp->version = hdev->hci_ver; 1080 rp->manufacturer = cpu_to_le16(hdev->manufacturer); 1081 1082 rp->supported_settings = cpu_to_le32(get_supported_settings(hdev)); 1083 rp->current_settings = cpu_to_le32(get_current_settings(hdev)); 1084 1085 1086 eir_len = append_eir_data_to_buf(hdev, rp->eir); 1087 rp->eir_len = cpu_to_le16(eir_len); 1088 1089 hci_dev_unlock(hdev); 1090 1091 /* If this command is called at least once, then the events 1092 * for class of device and local name changes are disabled 1093 * and only the new extended controller information event 1094 * is used. 1095 */ 1096 hci_sock_set_flag(sk, HCI_MGMT_EXT_INFO_EVENTS); 1097 hci_sock_clear_flag(sk, HCI_MGMT_DEV_CLASS_EVENTS); 1098 hci_sock_clear_flag(sk, HCI_MGMT_LOCAL_NAME_EVENTS); 1099 1100 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_EXT_INFO, 0, rp, 1101 sizeof(*rp) + eir_len); 1102 } 1103 1104 static int ext_info_changed(struct hci_dev *hdev, struct sock *skip) 1105 { 1106 char buf[512]; 1107 struct mgmt_ev_ext_info_changed *ev = (void *)buf; 1108 u16 eir_len; 1109 1110 memset(buf, 0, sizeof(buf)); 1111 1112 eir_len = append_eir_data_to_buf(hdev, ev->eir); 1113 ev->eir_len = cpu_to_le16(eir_len); 1114 1115 return mgmt_limited_event(MGMT_EV_EXT_INFO_CHANGED, hdev, ev, 1116 sizeof(*ev) + eir_len, 1117 HCI_MGMT_EXT_INFO_EVENTS, skip); 1118 } 1119 1120 static int send_settings_rsp(struct sock *sk, u16 opcode, struct hci_dev *hdev) 1121 { 1122 __le32 settings = cpu_to_le32(get_current_settings(hdev)); 1123 1124 return mgmt_cmd_complete(sk, hdev->id, opcode, 0, &settings, 1125 sizeof(settings)); 1126 } 1127 1128 static void clean_up_hci_complete(struct hci_dev *hdev, u8 status, u16 opcode) 1129 { 1130 bt_dev_dbg(hdev, "status 0x%02x", status); 1131 1132 if (hci_conn_count(hdev) == 0) { 1133 cancel_delayed_work(&hdev->power_off); 1134 queue_work(hdev->req_workqueue, &hdev->power_off.work); 1135 } 1136 } 1137 1138 void mgmt_advertising_added(struct sock *sk, struct hci_dev *hdev, u8 instance) 1139 { 1140 struct mgmt_ev_advertising_added ev; 1141 1142 ev.instance = instance; 1143 1144 mgmt_event(MGMT_EV_ADVERTISING_ADDED, hdev, &ev, sizeof(ev), sk); 1145 } 1146 1147 void mgmt_advertising_removed(struct sock *sk, struct hci_dev *hdev, 1148 u8 instance) 1149 { 1150 struct mgmt_ev_advertising_removed ev; 1151 1152 ev.instance = instance; 1153 1154 mgmt_event(MGMT_EV_ADVERTISING_REMOVED, hdev, &ev, sizeof(ev), sk); 1155 } 1156 1157 static void cancel_adv_timeout(struct hci_dev *hdev) 1158 { 1159 if (hdev->adv_instance_timeout) { 1160 hdev->adv_instance_timeout = 0; 1161 cancel_delayed_work(&hdev->adv_instance_expire); 1162 } 1163 } 1164 1165 static int clean_up_hci_state(struct hci_dev *hdev) 1166 { 1167 struct hci_request req; 1168 struct hci_conn *conn; 1169 bool discov_stopped; 1170 int err; 1171 1172 hci_req_init(&req, hdev); 1173 1174 if (test_bit(HCI_ISCAN, &hdev->flags) || 1175 test_bit(HCI_PSCAN, &hdev->flags)) { 1176 u8 scan = 0x00; 1177 hci_req_add(&req, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan); 1178 } 1179 1180 hci_req_clear_adv_instance(hdev, NULL, NULL, 0x00, false); 1181 1182 if (hci_dev_test_flag(hdev, HCI_LE_ADV)) 1183 __hci_req_disable_advertising(&req); 1184 1185 discov_stopped = hci_req_stop_discovery(&req); 1186 1187 list_for_each_entry(conn, &hdev->conn_hash.list, list) { 1188 /* 0x15 == Terminated due to Power Off */ 1189 __hci_abort_conn(&req, conn, 0x15); 1190 } 1191 1192 err = hci_req_run(&req, clean_up_hci_complete); 1193 if (!err && discov_stopped) 1194 hci_discovery_set_state(hdev, DISCOVERY_STOPPING); 1195 1196 return err; 1197 } 1198 1199 static int set_powered(struct sock *sk, struct hci_dev *hdev, void *data, 1200 u16 len) 1201 { 1202 struct mgmt_mode *cp = data; 1203 struct mgmt_pending_cmd *cmd; 1204 int err; 1205 1206 bt_dev_dbg(hdev, "sock %p", sk); 1207 1208 if (cp->val != 0x00 && cp->val != 0x01) 1209 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED, 1210 MGMT_STATUS_INVALID_PARAMS); 1211 1212 hci_dev_lock(hdev); 1213 1214 if (pending_find(MGMT_OP_SET_POWERED, hdev)) { 1215 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED, 1216 MGMT_STATUS_BUSY); 1217 goto failed; 1218 } 1219 1220 if (!!cp->val == hdev_is_powered(hdev)) { 1221 err = send_settings_rsp(sk, MGMT_OP_SET_POWERED, hdev); 1222 goto failed; 1223 } 1224 1225 cmd = mgmt_pending_add(sk, MGMT_OP_SET_POWERED, hdev, data, len); 1226 if (!cmd) { 1227 err = -ENOMEM; 1228 goto failed; 1229 } 1230 1231 if (cp->val) { 1232 queue_work(hdev->req_workqueue, &hdev->power_on); 1233 err = 0; 1234 } else { 1235 /* Disconnect connections, stop scans, etc */ 1236 err = clean_up_hci_state(hdev); 1237 if (!err) 1238 queue_delayed_work(hdev->req_workqueue, &hdev->power_off, 1239 HCI_POWER_OFF_TIMEOUT); 1240 1241 /* ENODATA means there were no HCI commands queued */ 1242 if (err == -ENODATA) { 1243 cancel_delayed_work(&hdev->power_off); 1244 queue_work(hdev->req_workqueue, &hdev->power_off.work); 1245 err = 0; 1246 } 1247 } 1248 1249 failed: 1250 hci_dev_unlock(hdev); 1251 return err; 1252 } 1253 1254 static int new_settings(struct hci_dev *hdev, struct sock *skip) 1255 { 1256 __le32 ev = cpu_to_le32(get_current_settings(hdev)); 1257 1258 return mgmt_limited_event(MGMT_EV_NEW_SETTINGS, hdev, &ev, 1259 sizeof(ev), HCI_MGMT_SETTING_EVENTS, skip); 1260 } 1261 1262 int mgmt_new_settings(struct hci_dev *hdev) 1263 { 1264 return new_settings(hdev, NULL); 1265 } 1266 1267 struct cmd_lookup { 1268 struct sock *sk; 1269 struct hci_dev *hdev; 1270 u8 mgmt_status; 1271 }; 1272 1273 static void settings_rsp(struct mgmt_pending_cmd *cmd, void *data) 1274 { 1275 struct cmd_lookup *match = data; 1276 1277 send_settings_rsp(cmd->sk, cmd->opcode, match->hdev); 1278 1279 list_del(&cmd->list); 1280 1281 if (match->sk == NULL) { 1282 match->sk = cmd->sk; 1283 sock_hold(match->sk); 1284 } 1285 1286 mgmt_pending_free(cmd); 1287 } 1288 1289 static void cmd_status_rsp(struct mgmt_pending_cmd *cmd, void *data) 1290 { 1291 u8 *status = data; 1292 1293 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, *status); 1294 mgmt_pending_remove(cmd); 1295 } 1296 1297 static void cmd_complete_rsp(struct mgmt_pending_cmd *cmd, void *data) 1298 { 1299 if (cmd->cmd_complete) { 1300 u8 *status = data; 1301 1302 cmd->cmd_complete(cmd, *status); 1303 mgmt_pending_remove(cmd); 1304 1305 return; 1306 } 1307 1308 cmd_status_rsp(cmd, data); 1309 } 1310 1311 static int generic_cmd_complete(struct mgmt_pending_cmd *cmd, u8 status) 1312 { 1313 return mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, status, 1314 cmd->param, cmd->param_len); 1315 } 1316 1317 static int addr_cmd_complete(struct mgmt_pending_cmd *cmd, u8 status) 1318 { 1319 return mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, status, 1320 cmd->param, sizeof(struct mgmt_addr_info)); 1321 } 1322 1323 static u8 mgmt_bredr_support(struct hci_dev *hdev) 1324 { 1325 if (!lmp_bredr_capable(hdev)) 1326 return MGMT_STATUS_NOT_SUPPORTED; 1327 else if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) 1328 return MGMT_STATUS_REJECTED; 1329 else 1330 return MGMT_STATUS_SUCCESS; 1331 } 1332 1333 static u8 mgmt_le_support(struct hci_dev *hdev) 1334 { 1335 if (!lmp_le_capable(hdev)) 1336 return MGMT_STATUS_NOT_SUPPORTED; 1337 else if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED)) 1338 return MGMT_STATUS_REJECTED; 1339 else 1340 return MGMT_STATUS_SUCCESS; 1341 } 1342 1343 void mgmt_set_discoverable_complete(struct hci_dev *hdev, u8 status) 1344 { 1345 struct mgmt_pending_cmd *cmd; 1346 1347 bt_dev_dbg(hdev, "status 0x%02x", status); 1348 1349 hci_dev_lock(hdev); 1350 1351 cmd = pending_find(MGMT_OP_SET_DISCOVERABLE, hdev); 1352 if (!cmd) 1353 goto unlock; 1354 1355 if (status) { 1356 u8 mgmt_err = mgmt_status(status); 1357 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err); 1358 hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE); 1359 goto remove_cmd; 1360 } 1361 1362 if (hci_dev_test_flag(hdev, HCI_DISCOVERABLE) && 1363 hdev->discov_timeout > 0) { 1364 int to = msecs_to_jiffies(hdev->discov_timeout * 1000); 1365 queue_delayed_work(hdev->req_workqueue, &hdev->discov_off, to); 1366 } 1367 1368 send_settings_rsp(cmd->sk, MGMT_OP_SET_DISCOVERABLE, hdev); 1369 new_settings(hdev, cmd->sk); 1370 1371 remove_cmd: 1372 mgmt_pending_remove(cmd); 1373 1374 unlock: 1375 hci_dev_unlock(hdev); 1376 } 1377 1378 static int set_discoverable(struct sock *sk, struct hci_dev *hdev, void *data, 1379 u16 len) 1380 { 1381 struct mgmt_cp_set_discoverable *cp = data; 1382 struct mgmt_pending_cmd *cmd; 1383 u16 timeout; 1384 int err; 1385 1386 bt_dev_dbg(hdev, "sock %p", sk); 1387 1388 if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED) && 1389 !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) 1390 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE, 1391 MGMT_STATUS_REJECTED); 1392 1393 if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02) 1394 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE, 1395 MGMT_STATUS_INVALID_PARAMS); 1396 1397 timeout = __le16_to_cpu(cp->timeout); 1398 1399 /* Disabling discoverable requires that no timeout is set, 1400 * and enabling limited discoverable requires a timeout. 1401 */ 1402 if ((cp->val == 0x00 && timeout > 0) || 1403 (cp->val == 0x02 && timeout == 0)) 1404 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE, 1405 MGMT_STATUS_INVALID_PARAMS); 1406 1407 hci_dev_lock(hdev); 1408 1409 if (!hdev_is_powered(hdev) && timeout > 0) { 1410 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE, 1411 MGMT_STATUS_NOT_POWERED); 1412 goto failed; 1413 } 1414 1415 if (pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) || 1416 pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) { 1417 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE, 1418 MGMT_STATUS_BUSY); 1419 goto failed; 1420 } 1421 1422 if (!hci_dev_test_flag(hdev, HCI_CONNECTABLE)) { 1423 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE, 1424 MGMT_STATUS_REJECTED); 1425 goto failed; 1426 } 1427 1428 if (hdev->advertising_paused) { 1429 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE, 1430 MGMT_STATUS_BUSY); 1431 goto failed; 1432 } 1433 1434 if (!hdev_is_powered(hdev)) { 1435 bool changed = false; 1436 1437 /* Setting limited discoverable when powered off is 1438 * not a valid operation since it requires a timeout 1439 * and so no need to check HCI_LIMITED_DISCOVERABLE. 1440 */ 1441 if (!!cp->val != hci_dev_test_flag(hdev, HCI_DISCOVERABLE)) { 1442 hci_dev_change_flag(hdev, HCI_DISCOVERABLE); 1443 changed = true; 1444 } 1445 1446 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev); 1447 if (err < 0) 1448 goto failed; 1449 1450 if (changed) 1451 err = new_settings(hdev, sk); 1452 1453 goto failed; 1454 } 1455 1456 /* If the current mode is the same, then just update the timeout 1457 * value with the new value. And if only the timeout gets updated, 1458 * then no need for any HCI transactions. 1459 */ 1460 if (!!cp->val == hci_dev_test_flag(hdev, HCI_DISCOVERABLE) && 1461 (cp->val == 0x02) == hci_dev_test_flag(hdev, 1462 HCI_LIMITED_DISCOVERABLE)) { 1463 cancel_delayed_work(&hdev->discov_off); 1464 hdev->discov_timeout = timeout; 1465 1466 if (cp->val && hdev->discov_timeout > 0) { 1467 int to = msecs_to_jiffies(hdev->discov_timeout * 1000); 1468 queue_delayed_work(hdev->req_workqueue, 1469 &hdev->discov_off, to); 1470 } 1471 1472 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev); 1473 goto failed; 1474 } 1475 1476 cmd = mgmt_pending_add(sk, MGMT_OP_SET_DISCOVERABLE, hdev, data, len); 1477 if (!cmd) { 1478 err = -ENOMEM; 1479 goto failed; 1480 } 1481 1482 /* Cancel any potential discoverable timeout that might be 1483 * still active and store new timeout value. The arming of 1484 * the timeout happens in the complete handler. 1485 */ 1486 cancel_delayed_work(&hdev->discov_off); 1487 hdev->discov_timeout = timeout; 1488 1489 if (cp->val) 1490 hci_dev_set_flag(hdev, HCI_DISCOVERABLE); 1491 else 1492 hci_dev_clear_flag(hdev, HCI_DISCOVERABLE); 1493 1494 /* Limited discoverable mode */ 1495 if (cp->val == 0x02) 1496 hci_dev_set_flag(hdev, HCI_LIMITED_DISCOVERABLE); 1497 else 1498 hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE); 1499 1500 queue_work(hdev->req_workqueue, &hdev->discoverable_update); 1501 err = 0; 1502 1503 failed: 1504 hci_dev_unlock(hdev); 1505 return err; 1506 } 1507 1508 void mgmt_set_connectable_complete(struct hci_dev *hdev, u8 status) 1509 { 1510 struct mgmt_pending_cmd *cmd; 1511 1512 bt_dev_dbg(hdev, "status 0x%02x", status); 1513 1514 hci_dev_lock(hdev); 1515 1516 cmd = pending_find(MGMT_OP_SET_CONNECTABLE, hdev); 1517 if (!cmd) 1518 goto unlock; 1519 1520 if (status) { 1521 u8 mgmt_err = mgmt_status(status); 1522 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err); 1523 goto remove_cmd; 1524 } 1525 1526 send_settings_rsp(cmd->sk, MGMT_OP_SET_CONNECTABLE, hdev); 1527 new_settings(hdev, cmd->sk); 1528 1529 remove_cmd: 1530 mgmt_pending_remove(cmd); 1531 1532 unlock: 1533 hci_dev_unlock(hdev); 1534 } 1535 1536 static int set_connectable_update_settings(struct hci_dev *hdev, 1537 struct sock *sk, u8 val) 1538 { 1539 bool changed = false; 1540 int err; 1541 1542 if (!!val != hci_dev_test_flag(hdev, HCI_CONNECTABLE)) 1543 changed = true; 1544 1545 if (val) { 1546 hci_dev_set_flag(hdev, HCI_CONNECTABLE); 1547 } else { 1548 hci_dev_clear_flag(hdev, HCI_CONNECTABLE); 1549 hci_dev_clear_flag(hdev, HCI_DISCOVERABLE); 1550 } 1551 1552 err = send_settings_rsp(sk, MGMT_OP_SET_CONNECTABLE, hdev); 1553 if (err < 0) 1554 return err; 1555 1556 if (changed) { 1557 hci_req_update_scan(hdev); 1558 hci_update_background_scan(hdev); 1559 return new_settings(hdev, sk); 1560 } 1561 1562 return 0; 1563 } 1564 1565 static int set_connectable(struct sock *sk, struct hci_dev *hdev, void *data, 1566 u16 len) 1567 { 1568 struct mgmt_mode *cp = data; 1569 struct mgmt_pending_cmd *cmd; 1570 int err; 1571 1572 bt_dev_dbg(hdev, "sock %p", sk); 1573 1574 if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED) && 1575 !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) 1576 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE, 1577 MGMT_STATUS_REJECTED); 1578 1579 if (cp->val != 0x00 && cp->val != 0x01) 1580 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE, 1581 MGMT_STATUS_INVALID_PARAMS); 1582 1583 hci_dev_lock(hdev); 1584 1585 if (!hdev_is_powered(hdev)) { 1586 err = set_connectable_update_settings(hdev, sk, cp->val); 1587 goto failed; 1588 } 1589 1590 if (pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) || 1591 pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) { 1592 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE, 1593 MGMT_STATUS_BUSY); 1594 goto failed; 1595 } 1596 1597 cmd = mgmt_pending_add(sk, MGMT_OP_SET_CONNECTABLE, hdev, data, len); 1598 if (!cmd) { 1599 err = -ENOMEM; 1600 goto failed; 1601 } 1602 1603 if (cp->val) { 1604 hci_dev_set_flag(hdev, HCI_CONNECTABLE); 1605 } else { 1606 if (hdev->discov_timeout > 0) 1607 cancel_delayed_work(&hdev->discov_off); 1608 1609 hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE); 1610 hci_dev_clear_flag(hdev, HCI_DISCOVERABLE); 1611 hci_dev_clear_flag(hdev, HCI_CONNECTABLE); 1612 } 1613 1614 queue_work(hdev->req_workqueue, &hdev->connectable_update); 1615 err = 0; 1616 1617 failed: 1618 hci_dev_unlock(hdev); 1619 return err; 1620 } 1621 1622 static int set_bondable(struct sock *sk, struct hci_dev *hdev, void *data, 1623 u16 len) 1624 { 1625 struct mgmt_mode *cp = data; 1626 bool changed; 1627 int err; 1628 1629 bt_dev_dbg(hdev, "sock %p", sk); 1630 1631 if (cp->val != 0x00 && cp->val != 0x01) 1632 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BONDABLE, 1633 MGMT_STATUS_INVALID_PARAMS); 1634 1635 hci_dev_lock(hdev); 1636 1637 if (cp->val) 1638 changed = !hci_dev_test_and_set_flag(hdev, HCI_BONDABLE); 1639 else 1640 changed = hci_dev_test_and_clear_flag(hdev, HCI_BONDABLE); 1641 1642 err = send_settings_rsp(sk, MGMT_OP_SET_BONDABLE, hdev); 1643 if (err < 0) 1644 goto unlock; 1645 1646 if (changed) { 1647 /* In limited privacy mode the change of bondable mode 1648 * may affect the local advertising address. 1649 */ 1650 if (hdev_is_powered(hdev) && 1651 hci_dev_test_flag(hdev, HCI_ADVERTISING) && 1652 hci_dev_test_flag(hdev, HCI_DISCOVERABLE) && 1653 hci_dev_test_flag(hdev, HCI_LIMITED_PRIVACY)) 1654 queue_work(hdev->req_workqueue, 1655 &hdev->discoverable_update); 1656 1657 err = new_settings(hdev, sk); 1658 } 1659 1660 unlock: 1661 hci_dev_unlock(hdev); 1662 return err; 1663 } 1664 1665 static int set_link_security(struct sock *sk, struct hci_dev *hdev, void *data, 1666 u16 len) 1667 { 1668 struct mgmt_mode *cp = data; 1669 struct mgmt_pending_cmd *cmd; 1670 u8 val, status; 1671 int err; 1672 1673 bt_dev_dbg(hdev, "sock %p", sk); 1674 1675 status = mgmt_bredr_support(hdev); 1676 if (status) 1677 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY, 1678 status); 1679 1680 if (cp->val != 0x00 && cp->val != 0x01) 1681 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY, 1682 MGMT_STATUS_INVALID_PARAMS); 1683 1684 hci_dev_lock(hdev); 1685 1686 if (!hdev_is_powered(hdev)) { 1687 bool changed = false; 1688 1689 if (!!cp->val != hci_dev_test_flag(hdev, HCI_LINK_SECURITY)) { 1690 hci_dev_change_flag(hdev, HCI_LINK_SECURITY); 1691 changed = true; 1692 } 1693 1694 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev); 1695 if (err < 0) 1696 goto failed; 1697 1698 if (changed) 1699 err = new_settings(hdev, sk); 1700 1701 goto failed; 1702 } 1703 1704 if (pending_find(MGMT_OP_SET_LINK_SECURITY, hdev)) { 1705 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY, 1706 MGMT_STATUS_BUSY); 1707 goto failed; 1708 } 1709 1710 val = !!cp->val; 1711 1712 if (test_bit(HCI_AUTH, &hdev->flags) == val) { 1713 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev); 1714 goto failed; 1715 } 1716 1717 cmd = mgmt_pending_add(sk, MGMT_OP_SET_LINK_SECURITY, hdev, data, len); 1718 if (!cmd) { 1719 err = -ENOMEM; 1720 goto failed; 1721 } 1722 1723 err = hci_send_cmd(hdev, HCI_OP_WRITE_AUTH_ENABLE, sizeof(val), &val); 1724 if (err < 0) { 1725 mgmt_pending_remove(cmd); 1726 goto failed; 1727 } 1728 1729 failed: 1730 hci_dev_unlock(hdev); 1731 return err; 1732 } 1733 1734 static int set_ssp(struct sock *sk, struct hci_dev *hdev, void *data, u16 len) 1735 { 1736 struct mgmt_mode *cp = data; 1737 struct mgmt_pending_cmd *cmd; 1738 u8 status; 1739 int err; 1740 1741 bt_dev_dbg(hdev, "sock %p", sk); 1742 1743 status = mgmt_bredr_support(hdev); 1744 if (status) 1745 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP, status); 1746 1747 if (!lmp_ssp_capable(hdev)) 1748 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP, 1749 MGMT_STATUS_NOT_SUPPORTED); 1750 1751 if (cp->val != 0x00 && cp->val != 0x01) 1752 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP, 1753 MGMT_STATUS_INVALID_PARAMS); 1754 1755 hci_dev_lock(hdev); 1756 1757 if (!hdev_is_powered(hdev)) { 1758 bool changed; 1759 1760 if (cp->val) { 1761 changed = !hci_dev_test_and_set_flag(hdev, 1762 HCI_SSP_ENABLED); 1763 } else { 1764 changed = hci_dev_test_and_clear_flag(hdev, 1765 HCI_SSP_ENABLED); 1766 if (!changed) 1767 changed = hci_dev_test_and_clear_flag(hdev, 1768 HCI_HS_ENABLED); 1769 else 1770 hci_dev_clear_flag(hdev, HCI_HS_ENABLED); 1771 } 1772 1773 err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev); 1774 if (err < 0) 1775 goto failed; 1776 1777 if (changed) 1778 err = new_settings(hdev, sk); 1779 1780 goto failed; 1781 } 1782 1783 if (pending_find(MGMT_OP_SET_SSP, hdev)) { 1784 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP, 1785 MGMT_STATUS_BUSY); 1786 goto failed; 1787 } 1788 1789 if (!!cp->val == hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) { 1790 err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev); 1791 goto failed; 1792 } 1793 1794 cmd = mgmt_pending_add(sk, MGMT_OP_SET_SSP, hdev, data, len); 1795 if (!cmd) { 1796 err = -ENOMEM; 1797 goto failed; 1798 } 1799 1800 if (!cp->val && hci_dev_test_flag(hdev, HCI_USE_DEBUG_KEYS)) 1801 hci_send_cmd(hdev, HCI_OP_WRITE_SSP_DEBUG_MODE, 1802 sizeof(cp->val), &cp->val); 1803 1804 err = hci_send_cmd(hdev, HCI_OP_WRITE_SSP_MODE, 1, &cp->val); 1805 if (err < 0) { 1806 mgmt_pending_remove(cmd); 1807 goto failed; 1808 } 1809 1810 failed: 1811 hci_dev_unlock(hdev); 1812 return err; 1813 } 1814 1815 static int set_hs(struct sock *sk, struct hci_dev *hdev, void *data, u16 len) 1816 { 1817 struct mgmt_mode *cp = data; 1818 bool changed; 1819 u8 status; 1820 int err; 1821 1822 bt_dev_dbg(hdev, "sock %p", sk); 1823 1824 if (!IS_ENABLED(CONFIG_BT_HS)) 1825 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS, 1826 MGMT_STATUS_NOT_SUPPORTED); 1827 1828 status = mgmt_bredr_support(hdev); 1829 if (status) 1830 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS, status); 1831 1832 if (!lmp_ssp_capable(hdev)) 1833 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS, 1834 MGMT_STATUS_NOT_SUPPORTED); 1835 1836 if (!hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) 1837 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS, 1838 MGMT_STATUS_REJECTED); 1839 1840 if (cp->val != 0x00 && cp->val != 0x01) 1841 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS, 1842 MGMT_STATUS_INVALID_PARAMS); 1843 1844 hci_dev_lock(hdev); 1845 1846 if (pending_find(MGMT_OP_SET_SSP, hdev)) { 1847 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS, 1848 MGMT_STATUS_BUSY); 1849 goto unlock; 1850 } 1851 1852 if (cp->val) { 1853 changed = !hci_dev_test_and_set_flag(hdev, HCI_HS_ENABLED); 1854 } else { 1855 if (hdev_is_powered(hdev)) { 1856 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS, 1857 MGMT_STATUS_REJECTED); 1858 goto unlock; 1859 } 1860 1861 changed = hci_dev_test_and_clear_flag(hdev, HCI_HS_ENABLED); 1862 } 1863 1864 err = send_settings_rsp(sk, MGMT_OP_SET_HS, hdev); 1865 if (err < 0) 1866 goto unlock; 1867 1868 if (changed) 1869 err = new_settings(hdev, sk); 1870 1871 unlock: 1872 hci_dev_unlock(hdev); 1873 return err; 1874 } 1875 1876 static void le_enable_complete(struct hci_dev *hdev, u8 status, u16 opcode) 1877 { 1878 struct cmd_lookup match = { NULL, hdev }; 1879 1880 hci_dev_lock(hdev); 1881 1882 if (status) { 1883 u8 mgmt_err = mgmt_status(status); 1884 1885 mgmt_pending_foreach(MGMT_OP_SET_LE, hdev, cmd_status_rsp, 1886 &mgmt_err); 1887 goto unlock; 1888 } 1889 1890 mgmt_pending_foreach(MGMT_OP_SET_LE, hdev, settings_rsp, &match); 1891 1892 new_settings(hdev, match.sk); 1893 1894 if (match.sk) 1895 sock_put(match.sk); 1896 1897 /* Make sure the controller has a good default for 1898 * advertising data. Restrict the update to when LE 1899 * has actually been enabled. During power on, the 1900 * update in powered_update_hci will take care of it. 1901 */ 1902 if (hci_dev_test_flag(hdev, HCI_LE_ENABLED)) { 1903 struct hci_request req; 1904 hci_req_init(&req, hdev); 1905 if (ext_adv_capable(hdev)) { 1906 int err; 1907 1908 err = __hci_req_setup_ext_adv_instance(&req, 0x00); 1909 if (!err) 1910 __hci_req_update_scan_rsp_data(&req, 0x00); 1911 } else { 1912 __hci_req_update_adv_data(&req, 0x00); 1913 __hci_req_update_scan_rsp_data(&req, 0x00); 1914 } 1915 hci_req_run(&req, NULL); 1916 hci_update_background_scan(hdev); 1917 } 1918 1919 unlock: 1920 hci_dev_unlock(hdev); 1921 } 1922 1923 static int set_le(struct sock *sk, struct hci_dev *hdev, void *data, u16 len) 1924 { 1925 struct mgmt_mode *cp = data; 1926 struct hci_cp_write_le_host_supported hci_cp; 1927 struct mgmt_pending_cmd *cmd; 1928 struct hci_request req; 1929 int err; 1930 u8 val, enabled; 1931 1932 bt_dev_dbg(hdev, "sock %p", sk); 1933 1934 if (!lmp_le_capable(hdev)) 1935 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE, 1936 MGMT_STATUS_NOT_SUPPORTED); 1937 1938 if (cp->val != 0x00 && cp->val != 0x01) 1939 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE, 1940 MGMT_STATUS_INVALID_PARAMS); 1941 1942 /* Bluetooth single mode LE only controllers or dual-mode 1943 * controllers configured as LE only devices, do not allow 1944 * switching LE off. These have either LE enabled explicitly 1945 * or BR/EDR has been previously switched off. 1946 * 1947 * When trying to enable an already enabled LE, then gracefully 1948 * send a positive response. Trying to disable it however will 1949 * result into rejection. 1950 */ 1951 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) { 1952 if (cp->val == 0x01) 1953 return send_settings_rsp(sk, MGMT_OP_SET_LE, hdev); 1954 1955 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE, 1956 MGMT_STATUS_REJECTED); 1957 } 1958 1959 hci_dev_lock(hdev); 1960 1961 val = !!cp->val; 1962 enabled = lmp_host_le_capable(hdev); 1963 1964 if (!val) 1965 hci_req_clear_adv_instance(hdev, NULL, NULL, 0x00, true); 1966 1967 if (!hdev_is_powered(hdev) || val == enabled) { 1968 bool changed = false; 1969 1970 if (val != hci_dev_test_flag(hdev, HCI_LE_ENABLED)) { 1971 hci_dev_change_flag(hdev, HCI_LE_ENABLED); 1972 changed = true; 1973 } 1974 1975 if (!val && hci_dev_test_flag(hdev, HCI_ADVERTISING)) { 1976 hci_dev_clear_flag(hdev, HCI_ADVERTISING); 1977 changed = true; 1978 } 1979 1980 err = send_settings_rsp(sk, MGMT_OP_SET_LE, hdev); 1981 if (err < 0) 1982 goto unlock; 1983 1984 if (changed) 1985 err = new_settings(hdev, sk); 1986 1987 goto unlock; 1988 } 1989 1990 if (pending_find(MGMT_OP_SET_LE, hdev) || 1991 pending_find(MGMT_OP_SET_ADVERTISING, hdev)) { 1992 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE, 1993 MGMT_STATUS_BUSY); 1994 goto unlock; 1995 } 1996 1997 cmd = mgmt_pending_add(sk, MGMT_OP_SET_LE, hdev, data, len); 1998 if (!cmd) { 1999 err = -ENOMEM; 2000 goto unlock; 2001 } 2002 2003 hci_req_init(&req, hdev); 2004 2005 memset(&hci_cp, 0, sizeof(hci_cp)); 2006 2007 if (val) { 2008 hci_cp.le = val; 2009 hci_cp.simul = 0x00; 2010 } else { 2011 if (hci_dev_test_flag(hdev, HCI_LE_ADV)) 2012 __hci_req_disable_advertising(&req); 2013 2014 if (ext_adv_capable(hdev)) 2015 __hci_req_clear_ext_adv_sets(&req); 2016 } 2017 2018 hci_req_add(&req, HCI_OP_WRITE_LE_HOST_SUPPORTED, sizeof(hci_cp), 2019 &hci_cp); 2020 2021 err = hci_req_run(&req, le_enable_complete); 2022 if (err < 0) 2023 mgmt_pending_remove(cmd); 2024 2025 unlock: 2026 hci_dev_unlock(hdev); 2027 return err; 2028 } 2029 2030 /* This is a helper function to test for pending mgmt commands that can 2031 * cause CoD or EIR HCI commands. We can only allow one such pending 2032 * mgmt command at a time since otherwise we cannot easily track what 2033 * the current values are, will be, and based on that calculate if a new 2034 * HCI command needs to be sent and if yes with what value. 2035 */ 2036 static bool pending_eir_or_class(struct hci_dev *hdev) 2037 { 2038 struct mgmt_pending_cmd *cmd; 2039 2040 list_for_each_entry(cmd, &hdev->mgmt_pending, list) { 2041 switch (cmd->opcode) { 2042 case MGMT_OP_ADD_UUID: 2043 case MGMT_OP_REMOVE_UUID: 2044 case MGMT_OP_SET_DEV_CLASS: 2045 case MGMT_OP_SET_POWERED: 2046 return true; 2047 } 2048 } 2049 2050 return false; 2051 } 2052 2053 static const u8 bluetooth_base_uuid[] = { 2054 0xfb, 0x34, 0x9b, 0x5f, 0x80, 0x00, 0x00, 0x80, 2055 0x00, 0x10, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 2056 }; 2057 2058 static u8 get_uuid_size(const u8 *uuid) 2059 { 2060 u32 val; 2061 2062 if (memcmp(uuid, bluetooth_base_uuid, 12)) 2063 return 128; 2064 2065 val = get_unaligned_le32(&uuid[12]); 2066 if (val > 0xffff) 2067 return 32; 2068 2069 return 16; 2070 } 2071 2072 static void mgmt_class_complete(struct hci_dev *hdev, u16 mgmt_op, u8 status) 2073 { 2074 struct mgmt_pending_cmd *cmd; 2075 2076 hci_dev_lock(hdev); 2077 2078 cmd = pending_find(mgmt_op, hdev); 2079 if (!cmd) 2080 goto unlock; 2081 2082 mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, 2083 mgmt_status(status), hdev->dev_class, 3); 2084 2085 mgmt_pending_remove(cmd); 2086 2087 unlock: 2088 hci_dev_unlock(hdev); 2089 } 2090 2091 static void add_uuid_complete(struct hci_dev *hdev, u8 status, u16 opcode) 2092 { 2093 bt_dev_dbg(hdev, "status 0x%02x", status); 2094 2095 mgmt_class_complete(hdev, MGMT_OP_ADD_UUID, status); 2096 } 2097 2098 static int add_uuid(struct sock *sk, struct hci_dev *hdev, void *data, u16 len) 2099 { 2100 struct mgmt_cp_add_uuid *cp = data; 2101 struct mgmt_pending_cmd *cmd; 2102 struct hci_request req; 2103 struct bt_uuid *uuid; 2104 int err; 2105 2106 bt_dev_dbg(hdev, "sock %p", sk); 2107 2108 hci_dev_lock(hdev); 2109 2110 if (pending_eir_or_class(hdev)) { 2111 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_UUID, 2112 MGMT_STATUS_BUSY); 2113 goto failed; 2114 } 2115 2116 uuid = kmalloc(sizeof(*uuid), GFP_KERNEL); 2117 if (!uuid) { 2118 err = -ENOMEM; 2119 goto failed; 2120 } 2121 2122 memcpy(uuid->uuid, cp->uuid, 16); 2123 uuid->svc_hint = cp->svc_hint; 2124 uuid->size = get_uuid_size(cp->uuid); 2125 2126 list_add_tail(&uuid->list, &hdev->uuids); 2127 2128 hci_req_init(&req, hdev); 2129 2130 __hci_req_update_class(&req); 2131 __hci_req_update_eir(&req); 2132 2133 err = hci_req_run(&req, add_uuid_complete); 2134 if (err < 0) { 2135 if (err != -ENODATA) 2136 goto failed; 2137 2138 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_UUID, 0, 2139 hdev->dev_class, 3); 2140 goto failed; 2141 } 2142 2143 cmd = mgmt_pending_add(sk, MGMT_OP_ADD_UUID, hdev, data, len); 2144 if (!cmd) { 2145 err = -ENOMEM; 2146 goto failed; 2147 } 2148 2149 err = 0; 2150 2151 failed: 2152 hci_dev_unlock(hdev); 2153 return err; 2154 } 2155 2156 static bool enable_service_cache(struct hci_dev *hdev) 2157 { 2158 if (!hdev_is_powered(hdev)) 2159 return false; 2160 2161 if (!hci_dev_test_and_set_flag(hdev, HCI_SERVICE_CACHE)) { 2162 queue_delayed_work(hdev->workqueue, &hdev->service_cache, 2163 CACHE_TIMEOUT); 2164 return true; 2165 } 2166 2167 return false; 2168 } 2169 2170 static void remove_uuid_complete(struct hci_dev *hdev, u8 status, u16 opcode) 2171 { 2172 bt_dev_dbg(hdev, "status 0x%02x", status); 2173 2174 mgmt_class_complete(hdev, MGMT_OP_REMOVE_UUID, status); 2175 } 2176 2177 static int remove_uuid(struct sock *sk, struct hci_dev *hdev, void *data, 2178 u16 len) 2179 { 2180 struct mgmt_cp_remove_uuid *cp = data; 2181 struct mgmt_pending_cmd *cmd; 2182 struct bt_uuid *match, *tmp; 2183 u8 bt_uuid_any[] = { 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 }; 2184 struct hci_request req; 2185 int err, found; 2186 2187 bt_dev_dbg(hdev, "sock %p", sk); 2188 2189 hci_dev_lock(hdev); 2190 2191 if (pending_eir_or_class(hdev)) { 2192 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID, 2193 MGMT_STATUS_BUSY); 2194 goto unlock; 2195 } 2196 2197 if (memcmp(cp->uuid, bt_uuid_any, 16) == 0) { 2198 hci_uuids_clear(hdev); 2199 2200 if (enable_service_cache(hdev)) { 2201 err = mgmt_cmd_complete(sk, hdev->id, 2202 MGMT_OP_REMOVE_UUID, 2203 0, hdev->dev_class, 3); 2204 goto unlock; 2205 } 2206 2207 goto update_class; 2208 } 2209 2210 found = 0; 2211 2212 list_for_each_entry_safe(match, tmp, &hdev->uuids, list) { 2213 if (memcmp(match->uuid, cp->uuid, 16) != 0) 2214 continue; 2215 2216 list_del(&match->list); 2217 kfree(match); 2218 found++; 2219 } 2220 2221 if (found == 0) { 2222 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID, 2223 MGMT_STATUS_INVALID_PARAMS); 2224 goto unlock; 2225 } 2226 2227 update_class: 2228 hci_req_init(&req, hdev); 2229 2230 __hci_req_update_class(&req); 2231 __hci_req_update_eir(&req); 2232 2233 err = hci_req_run(&req, remove_uuid_complete); 2234 if (err < 0) { 2235 if (err != -ENODATA) 2236 goto unlock; 2237 2238 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_UUID, 0, 2239 hdev->dev_class, 3); 2240 goto unlock; 2241 } 2242 2243 cmd = mgmt_pending_add(sk, MGMT_OP_REMOVE_UUID, hdev, data, len); 2244 if (!cmd) { 2245 err = -ENOMEM; 2246 goto unlock; 2247 } 2248 2249 err = 0; 2250 2251 unlock: 2252 hci_dev_unlock(hdev); 2253 return err; 2254 } 2255 2256 static void set_class_complete(struct hci_dev *hdev, u8 status, u16 opcode) 2257 { 2258 bt_dev_dbg(hdev, "status 0x%02x", status); 2259 2260 mgmt_class_complete(hdev, MGMT_OP_SET_DEV_CLASS, status); 2261 } 2262 2263 static int set_dev_class(struct sock *sk, struct hci_dev *hdev, void *data, 2264 u16 len) 2265 { 2266 struct mgmt_cp_set_dev_class *cp = data; 2267 struct mgmt_pending_cmd *cmd; 2268 struct hci_request req; 2269 int err; 2270 2271 bt_dev_dbg(hdev, "sock %p", sk); 2272 2273 if (!lmp_bredr_capable(hdev)) 2274 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 2275 MGMT_STATUS_NOT_SUPPORTED); 2276 2277 hci_dev_lock(hdev); 2278 2279 if (pending_eir_or_class(hdev)) { 2280 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 2281 MGMT_STATUS_BUSY); 2282 goto unlock; 2283 } 2284 2285 if ((cp->minor & 0x03) != 0 || (cp->major & 0xe0) != 0) { 2286 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 2287 MGMT_STATUS_INVALID_PARAMS); 2288 goto unlock; 2289 } 2290 2291 hdev->major_class = cp->major; 2292 hdev->minor_class = cp->minor; 2293 2294 if (!hdev_is_powered(hdev)) { 2295 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 0, 2296 hdev->dev_class, 3); 2297 goto unlock; 2298 } 2299 2300 hci_req_init(&req, hdev); 2301 2302 if (hci_dev_test_and_clear_flag(hdev, HCI_SERVICE_CACHE)) { 2303 hci_dev_unlock(hdev); 2304 cancel_delayed_work_sync(&hdev->service_cache); 2305 hci_dev_lock(hdev); 2306 __hci_req_update_eir(&req); 2307 } 2308 2309 __hci_req_update_class(&req); 2310 2311 err = hci_req_run(&req, set_class_complete); 2312 if (err < 0) { 2313 if (err != -ENODATA) 2314 goto unlock; 2315 2316 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 0, 2317 hdev->dev_class, 3); 2318 goto unlock; 2319 } 2320 2321 cmd = mgmt_pending_add(sk, MGMT_OP_SET_DEV_CLASS, hdev, data, len); 2322 if (!cmd) { 2323 err = -ENOMEM; 2324 goto unlock; 2325 } 2326 2327 err = 0; 2328 2329 unlock: 2330 hci_dev_unlock(hdev); 2331 return err; 2332 } 2333 2334 static int load_link_keys(struct sock *sk, struct hci_dev *hdev, void *data, 2335 u16 len) 2336 { 2337 struct mgmt_cp_load_link_keys *cp = data; 2338 const u16 max_key_count = ((U16_MAX - sizeof(*cp)) / 2339 sizeof(struct mgmt_link_key_info)); 2340 u16 key_count, expected_len; 2341 bool changed; 2342 int i; 2343 2344 bt_dev_dbg(hdev, "sock %p", sk); 2345 2346 if (!lmp_bredr_capable(hdev)) 2347 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS, 2348 MGMT_STATUS_NOT_SUPPORTED); 2349 2350 key_count = __le16_to_cpu(cp->key_count); 2351 if (key_count > max_key_count) { 2352 bt_dev_err(hdev, "load_link_keys: too big key_count value %u", 2353 key_count); 2354 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS, 2355 MGMT_STATUS_INVALID_PARAMS); 2356 } 2357 2358 expected_len = struct_size(cp, keys, key_count); 2359 if (expected_len != len) { 2360 bt_dev_err(hdev, "load_link_keys: expected %u bytes, got %u bytes", 2361 expected_len, len); 2362 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS, 2363 MGMT_STATUS_INVALID_PARAMS); 2364 } 2365 2366 if (cp->debug_keys != 0x00 && cp->debug_keys != 0x01) 2367 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS, 2368 MGMT_STATUS_INVALID_PARAMS); 2369 2370 bt_dev_dbg(hdev, "debug_keys %u key_count %u", cp->debug_keys, 2371 key_count); 2372 2373 for (i = 0; i < key_count; i++) { 2374 struct mgmt_link_key_info *key = &cp->keys[i]; 2375 2376 if (key->addr.type != BDADDR_BREDR || key->type > 0x08) 2377 return mgmt_cmd_status(sk, hdev->id, 2378 MGMT_OP_LOAD_LINK_KEYS, 2379 MGMT_STATUS_INVALID_PARAMS); 2380 } 2381 2382 hci_dev_lock(hdev); 2383 2384 hci_link_keys_clear(hdev); 2385 2386 if (cp->debug_keys) 2387 changed = !hci_dev_test_and_set_flag(hdev, HCI_KEEP_DEBUG_KEYS); 2388 else 2389 changed = hci_dev_test_and_clear_flag(hdev, 2390 HCI_KEEP_DEBUG_KEYS); 2391 2392 if (changed) 2393 new_settings(hdev, NULL); 2394 2395 for (i = 0; i < key_count; i++) { 2396 struct mgmt_link_key_info *key = &cp->keys[i]; 2397 2398 if (hci_is_blocked_key(hdev, 2399 HCI_BLOCKED_KEY_TYPE_LINKKEY, 2400 key->val)) { 2401 bt_dev_warn(hdev, "Skipping blocked link key for %pMR", 2402 &key->addr.bdaddr); 2403 continue; 2404 } 2405 2406 /* Always ignore debug keys and require a new pairing if 2407 * the user wants to use them. 2408 */ 2409 if (key->type == HCI_LK_DEBUG_COMBINATION) 2410 continue; 2411 2412 hci_add_link_key(hdev, NULL, &key->addr.bdaddr, key->val, 2413 key->type, key->pin_len, NULL); 2414 } 2415 2416 mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS, 0, NULL, 0); 2417 2418 hci_dev_unlock(hdev); 2419 2420 return 0; 2421 } 2422 2423 static int device_unpaired(struct hci_dev *hdev, bdaddr_t *bdaddr, 2424 u8 addr_type, struct sock *skip_sk) 2425 { 2426 struct mgmt_ev_device_unpaired ev; 2427 2428 bacpy(&ev.addr.bdaddr, bdaddr); 2429 ev.addr.type = addr_type; 2430 2431 return mgmt_event(MGMT_EV_DEVICE_UNPAIRED, hdev, &ev, sizeof(ev), 2432 skip_sk); 2433 } 2434 2435 static int unpair_device(struct sock *sk, struct hci_dev *hdev, void *data, 2436 u16 len) 2437 { 2438 struct mgmt_cp_unpair_device *cp = data; 2439 struct mgmt_rp_unpair_device rp; 2440 struct hci_conn_params *params; 2441 struct mgmt_pending_cmd *cmd; 2442 struct hci_conn *conn; 2443 u8 addr_type; 2444 int err; 2445 2446 memset(&rp, 0, sizeof(rp)); 2447 bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr); 2448 rp.addr.type = cp->addr.type; 2449 2450 if (!bdaddr_type_is_valid(cp->addr.type)) 2451 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE, 2452 MGMT_STATUS_INVALID_PARAMS, 2453 &rp, sizeof(rp)); 2454 2455 if (cp->disconnect != 0x00 && cp->disconnect != 0x01) 2456 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE, 2457 MGMT_STATUS_INVALID_PARAMS, 2458 &rp, sizeof(rp)); 2459 2460 hci_dev_lock(hdev); 2461 2462 if (!hdev_is_powered(hdev)) { 2463 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE, 2464 MGMT_STATUS_NOT_POWERED, &rp, 2465 sizeof(rp)); 2466 goto unlock; 2467 } 2468 2469 if (cp->addr.type == BDADDR_BREDR) { 2470 /* If disconnection is requested, then look up the 2471 * connection. If the remote device is connected, it 2472 * will be later used to terminate the link. 2473 * 2474 * Setting it to NULL explicitly will cause no 2475 * termination of the link. 2476 */ 2477 if (cp->disconnect) 2478 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, 2479 &cp->addr.bdaddr); 2480 else 2481 conn = NULL; 2482 2483 err = hci_remove_link_key(hdev, &cp->addr.bdaddr); 2484 if (err < 0) { 2485 err = mgmt_cmd_complete(sk, hdev->id, 2486 MGMT_OP_UNPAIR_DEVICE, 2487 MGMT_STATUS_NOT_PAIRED, &rp, 2488 sizeof(rp)); 2489 goto unlock; 2490 } 2491 2492 goto done; 2493 } 2494 2495 /* LE address type */ 2496 addr_type = le_addr_type(cp->addr.type); 2497 2498 /* Abort any ongoing SMP pairing. Removes ltk and irk if they exist. */ 2499 err = smp_cancel_and_remove_pairing(hdev, &cp->addr.bdaddr, addr_type); 2500 if (err < 0) { 2501 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE, 2502 MGMT_STATUS_NOT_PAIRED, &rp, 2503 sizeof(rp)); 2504 goto unlock; 2505 } 2506 2507 conn = hci_conn_hash_lookup_le(hdev, &cp->addr.bdaddr, addr_type); 2508 if (!conn) { 2509 hci_conn_params_del(hdev, &cp->addr.bdaddr, addr_type); 2510 goto done; 2511 } 2512 2513 2514 /* Defer clearing up the connection parameters until closing to 2515 * give a chance of keeping them if a repairing happens. 2516 */ 2517 set_bit(HCI_CONN_PARAM_REMOVAL_PEND, &conn->flags); 2518 2519 /* Disable auto-connection parameters if present */ 2520 params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr, addr_type); 2521 if (params) { 2522 if (params->explicit_connect) 2523 params->auto_connect = HCI_AUTO_CONN_EXPLICIT; 2524 else 2525 params->auto_connect = HCI_AUTO_CONN_DISABLED; 2526 } 2527 2528 /* If disconnection is not requested, then clear the connection 2529 * variable so that the link is not terminated. 2530 */ 2531 if (!cp->disconnect) 2532 conn = NULL; 2533 2534 done: 2535 /* If the connection variable is set, then termination of the 2536 * link is requested. 2537 */ 2538 if (!conn) { 2539 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE, 0, 2540 &rp, sizeof(rp)); 2541 device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, sk); 2542 goto unlock; 2543 } 2544 2545 cmd = mgmt_pending_add(sk, MGMT_OP_UNPAIR_DEVICE, hdev, cp, 2546 sizeof(*cp)); 2547 if (!cmd) { 2548 err = -ENOMEM; 2549 goto unlock; 2550 } 2551 2552 cmd->cmd_complete = addr_cmd_complete; 2553 2554 err = hci_abort_conn(conn, HCI_ERROR_REMOTE_USER_TERM); 2555 if (err < 0) 2556 mgmt_pending_remove(cmd); 2557 2558 unlock: 2559 hci_dev_unlock(hdev); 2560 return err; 2561 } 2562 2563 static int disconnect(struct sock *sk, struct hci_dev *hdev, void *data, 2564 u16 len) 2565 { 2566 struct mgmt_cp_disconnect *cp = data; 2567 struct mgmt_rp_disconnect rp; 2568 struct mgmt_pending_cmd *cmd; 2569 struct hci_conn *conn; 2570 int err; 2571 2572 bt_dev_dbg(hdev, "sock %p", sk); 2573 2574 memset(&rp, 0, sizeof(rp)); 2575 bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr); 2576 rp.addr.type = cp->addr.type; 2577 2578 if (!bdaddr_type_is_valid(cp->addr.type)) 2579 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT, 2580 MGMT_STATUS_INVALID_PARAMS, 2581 &rp, sizeof(rp)); 2582 2583 hci_dev_lock(hdev); 2584 2585 if (!test_bit(HCI_UP, &hdev->flags)) { 2586 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT, 2587 MGMT_STATUS_NOT_POWERED, &rp, 2588 sizeof(rp)); 2589 goto failed; 2590 } 2591 2592 if (pending_find(MGMT_OP_DISCONNECT, hdev)) { 2593 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT, 2594 MGMT_STATUS_BUSY, &rp, sizeof(rp)); 2595 goto failed; 2596 } 2597 2598 if (cp->addr.type == BDADDR_BREDR) 2599 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, 2600 &cp->addr.bdaddr); 2601 else 2602 conn = hci_conn_hash_lookup_le(hdev, &cp->addr.bdaddr, 2603 le_addr_type(cp->addr.type)); 2604 2605 if (!conn || conn->state == BT_OPEN || conn->state == BT_CLOSED) { 2606 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT, 2607 MGMT_STATUS_NOT_CONNECTED, &rp, 2608 sizeof(rp)); 2609 goto failed; 2610 } 2611 2612 cmd = mgmt_pending_add(sk, MGMT_OP_DISCONNECT, hdev, data, len); 2613 if (!cmd) { 2614 err = -ENOMEM; 2615 goto failed; 2616 } 2617 2618 cmd->cmd_complete = generic_cmd_complete; 2619 2620 err = hci_disconnect(conn, HCI_ERROR_REMOTE_USER_TERM); 2621 if (err < 0) 2622 mgmt_pending_remove(cmd); 2623 2624 failed: 2625 hci_dev_unlock(hdev); 2626 return err; 2627 } 2628 2629 static u8 link_to_bdaddr(u8 link_type, u8 addr_type) 2630 { 2631 switch (link_type) { 2632 case LE_LINK: 2633 switch (addr_type) { 2634 case ADDR_LE_DEV_PUBLIC: 2635 return BDADDR_LE_PUBLIC; 2636 2637 default: 2638 /* Fallback to LE Random address type */ 2639 return BDADDR_LE_RANDOM; 2640 } 2641 2642 default: 2643 /* Fallback to BR/EDR type */ 2644 return BDADDR_BREDR; 2645 } 2646 } 2647 2648 static int get_connections(struct sock *sk, struct hci_dev *hdev, void *data, 2649 u16 data_len) 2650 { 2651 struct mgmt_rp_get_connections *rp; 2652 struct hci_conn *c; 2653 int err; 2654 u16 i; 2655 2656 bt_dev_dbg(hdev, "sock %p", sk); 2657 2658 hci_dev_lock(hdev); 2659 2660 if (!hdev_is_powered(hdev)) { 2661 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_CONNECTIONS, 2662 MGMT_STATUS_NOT_POWERED); 2663 goto unlock; 2664 } 2665 2666 i = 0; 2667 list_for_each_entry(c, &hdev->conn_hash.list, list) { 2668 if (test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags)) 2669 i++; 2670 } 2671 2672 rp = kmalloc(struct_size(rp, addr, i), GFP_KERNEL); 2673 if (!rp) { 2674 err = -ENOMEM; 2675 goto unlock; 2676 } 2677 2678 i = 0; 2679 list_for_each_entry(c, &hdev->conn_hash.list, list) { 2680 if (!test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags)) 2681 continue; 2682 bacpy(&rp->addr[i].bdaddr, &c->dst); 2683 rp->addr[i].type = link_to_bdaddr(c->type, c->dst_type); 2684 if (c->type == SCO_LINK || c->type == ESCO_LINK) 2685 continue; 2686 i++; 2687 } 2688 2689 rp->conn_count = cpu_to_le16(i); 2690 2691 /* Recalculate length in case of filtered SCO connections, etc */ 2692 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONNECTIONS, 0, rp, 2693 struct_size(rp, addr, i)); 2694 2695 kfree(rp); 2696 2697 unlock: 2698 hci_dev_unlock(hdev); 2699 return err; 2700 } 2701 2702 static int send_pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev, 2703 struct mgmt_cp_pin_code_neg_reply *cp) 2704 { 2705 struct mgmt_pending_cmd *cmd; 2706 int err; 2707 2708 cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_NEG_REPLY, hdev, cp, 2709 sizeof(*cp)); 2710 if (!cmd) 2711 return -ENOMEM; 2712 2713 cmd->cmd_complete = addr_cmd_complete; 2714 2715 err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_NEG_REPLY, 2716 sizeof(cp->addr.bdaddr), &cp->addr.bdaddr); 2717 if (err < 0) 2718 mgmt_pending_remove(cmd); 2719 2720 return err; 2721 } 2722 2723 static int pin_code_reply(struct sock *sk, struct hci_dev *hdev, void *data, 2724 u16 len) 2725 { 2726 struct hci_conn *conn; 2727 struct mgmt_cp_pin_code_reply *cp = data; 2728 struct hci_cp_pin_code_reply reply; 2729 struct mgmt_pending_cmd *cmd; 2730 int err; 2731 2732 bt_dev_dbg(hdev, "sock %p", sk); 2733 2734 hci_dev_lock(hdev); 2735 2736 if (!hdev_is_powered(hdev)) { 2737 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY, 2738 MGMT_STATUS_NOT_POWERED); 2739 goto failed; 2740 } 2741 2742 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->addr.bdaddr); 2743 if (!conn) { 2744 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY, 2745 MGMT_STATUS_NOT_CONNECTED); 2746 goto failed; 2747 } 2748 2749 if (conn->pending_sec_level == BT_SECURITY_HIGH && cp->pin_len != 16) { 2750 struct mgmt_cp_pin_code_neg_reply ncp; 2751 2752 memcpy(&ncp.addr, &cp->addr, sizeof(ncp.addr)); 2753 2754 bt_dev_err(hdev, "PIN code is not 16 bytes long"); 2755 2756 err = send_pin_code_neg_reply(sk, hdev, &ncp); 2757 if (err >= 0) 2758 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY, 2759 MGMT_STATUS_INVALID_PARAMS); 2760 2761 goto failed; 2762 } 2763 2764 cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_REPLY, hdev, data, len); 2765 if (!cmd) { 2766 err = -ENOMEM; 2767 goto failed; 2768 } 2769 2770 cmd->cmd_complete = addr_cmd_complete; 2771 2772 bacpy(&reply.bdaddr, &cp->addr.bdaddr); 2773 reply.pin_len = cp->pin_len; 2774 memcpy(reply.pin_code, cp->pin_code, sizeof(reply.pin_code)); 2775 2776 err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_REPLY, sizeof(reply), &reply); 2777 if (err < 0) 2778 mgmt_pending_remove(cmd); 2779 2780 failed: 2781 hci_dev_unlock(hdev); 2782 return err; 2783 } 2784 2785 static int set_io_capability(struct sock *sk, struct hci_dev *hdev, void *data, 2786 u16 len) 2787 { 2788 struct mgmt_cp_set_io_capability *cp = data; 2789 2790 bt_dev_dbg(hdev, "sock %p", sk); 2791 2792 if (cp->io_capability > SMP_IO_KEYBOARD_DISPLAY) 2793 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_IO_CAPABILITY, 2794 MGMT_STATUS_INVALID_PARAMS); 2795 2796 hci_dev_lock(hdev); 2797 2798 hdev->io_capability = cp->io_capability; 2799 2800 bt_dev_dbg(hdev, "IO capability set to 0x%02x", hdev->io_capability); 2801 2802 hci_dev_unlock(hdev); 2803 2804 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_IO_CAPABILITY, 0, 2805 NULL, 0); 2806 } 2807 2808 static struct mgmt_pending_cmd *find_pairing(struct hci_conn *conn) 2809 { 2810 struct hci_dev *hdev = conn->hdev; 2811 struct mgmt_pending_cmd *cmd; 2812 2813 list_for_each_entry(cmd, &hdev->mgmt_pending, list) { 2814 if (cmd->opcode != MGMT_OP_PAIR_DEVICE) 2815 continue; 2816 2817 if (cmd->user_data != conn) 2818 continue; 2819 2820 return cmd; 2821 } 2822 2823 return NULL; 2824 } 2825 2826 static int pairing_complete(struct mgmt_pending_cmd *cmd, u8 status) 2827 { 2828 struct mgmt_rp_pair_device rp; 2829 struct hci_conn *conn = cmd->user_data; 2830 int err; 2831 2832 bacpy(&rp.addr.bdaddr, &conn->dst); 2833 rp.addr.type = link_to_bdaddr(conn->type, conn->dst_type); 2834 2835 err = mgmt_cmd_complete(cmd->sk, cmd->index, MGMT_OP_PAIR_DEVICE, 2836 status, &rp, sizeof(rp)); 2837 2838 /* So we don't get further callbacks for this connection */ 2839 conn->connect_cfm_cb = NULL; 2840 conn->security_cfm_cb = NULL; 2841 conn->disconn_cfm_cb = NULL; 2842 2843 hci_conn_drop(conn); 2844 2845 /* The device is paired so there is no need to remove 2846 * its connection parameters anymore. 2847 */ 2848 clear_bit(HCI_CONN_PARAM_REMOVAL_PEND, &conn->flags); 2849 2850 hci_conn_put(conn); 2851 2852 return err; 2853 } 2854 2855 void mgmt_smp_complete(struct hci_conn *conn, bool complete) 2856 { 2857 u8 status = complete ? MGMT_STATUS_SUCCESS : MGMT_STATUS_FAILED; 2858 struct mgmt_pending_cmd *cmd; 2859 2860 cmd = find_pairing(conn); 2861 if (cmd) { 2862 cmd->cmd_complete(cmd, status); 2863 mgmt_pending_remove(cmd); 2864 } 2865 } 2866 2867 static void pairing_complete_cb(struct hci_conn *conn, u8 status) 2868 { 2869 struct mgmt_pending_cmd *cmd; 2870 2871 BT_DBG("status %u", status); 2872 2873 cmd = find_pairing(conn); 2874 if (!cmd) { 2875 BT_DBG("Unable to find a pending command"); 2876 return; 2877 } 2878 2879 cmd->cmd_complete(cmd, mgmt_status(status)); 2880 mgmt_pending_remove(cmd); 2881 } 2882 2883 static void le_pairing_complete_cb(struct hci_conn *conn, u8 status) 2884 { 2885 struct mgmt_pending_cmd *cmd; 2886 2887 BT_DBG("status %u", status); 2888 2889 if (!status) 2890 return; 2891 2892 cmd = find_pairing(conn); 2893 if (!cmd) { 2894 BT_DBG("Unable to find a pending command"); 2895 return; 2896 } 2897 2898 cmd->cmd_complete(cmd, mgmt_status(status)); 2899 mgmt_pending_remove(cmd); 2900 } 2901 2902 static int pair_device(struct sock *sk, struct hci_dev *hdev, void *data, 2903 u16 len) 2904 { 2905 struct mgmt_cp_pair_device *cp = data; 2906 struct mgmt_rp_pair_device rp; 2907 struct mgmt_pending_cmd *cmd; 2908 u8 sec_level, auth_type; 2909 struct hci_conn *conn; 2910 int err; 2911 2912 bt_dev_dbg(hdev, "sock %p", sk); 2913 2914 memset(&rp, 0, sizeof(rp)); 2915 bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr); 2916 rp.addr.type = cp->addr.type; 2917 2918 if (!bdaddr_type_is_valid(cp->addr.type)) 2919 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE, 2920 MGMT_STATUS_INVALID_PARAMS, 2921 &rp, sizeof(rp)); 2922 2923 if (cp->io_cap > SMP_IO_KEYBOARD_DISPLAY) 2924 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE, 2925 MGMT_STATUS_INVALID_PARAMS, 2926 &rp, sizeof(rp)); 2927 2928 hci_dev_lock(hdev); 2929 2930 if (!hdev_is_powered(hdev)) { 2931 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE, 2932 MGMT_STATUS_NOT_POWERED, &rp, 2933 sizeof(rp)); 2934 goto unlock; 2935 } 2936 2937 if (hci_bdaddr_is_paired(hdev, &cp->addr.bdaddr, cp->addr.type)) { 2938 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE, 2939 MGMT_STATUS_ALREADY_PAIRED, &rp, 2940 sizeof(rp)); 2941 goto unlock; 2942 } 2943 2944 sec_level = BT_SECURITY_MEDIUM; 2945 auth_type = HCI_AT_DEDICATED_BONDING; 2946 2947 if (cp->addr.type == BDADDR_BREDR) { 2948 conn = hci_connect_acl(hdev, &cp->addr.bdaddr, sec_level, 2949 auth_type, CONN_REASON_PAIR_DEVICE); 2950 } else { 2951 u8 addr_type = le_addr_type(cp->addr.type); 2952 struct hci_conn_params *p; 2953 2954 /* When pairing a new device, it is expected to remember 2955 * this device for future connections. Adding the connection 2956 * parameter information ahead of time allows tracking 2957 * of the slave preferred values and will speed up any 2958 * further connection establishment. 2959 * 2960 * If connection parameters already exist, then they 2961 * will be kept and this function does nothing. 2962 */ 2963 p = hci_conn_params_add(hdev, &cp->addr.bdaddr, addr_type); 2964 2965 if (p->auto_connect == HCI_AUTO_CONN_EXPLICIT) 2966 p->auto_connect = HCI_AUTO_CONN_DISABLED; 2967 2968 conn = hci_connect_le_scan(hdev, &cp->addr.bdaddr, addr_type, 2969 sec_level, HCI_LE_CONN_TIMEOUT, 2970 CONN_REASON_PAIR_DEVICE); 2971 } 2972 2973 if (IS_ERR(conn)) { 2974 int status; 2975 2976 if (PTR_ERR(conn) == -EBUSY) 2977 status = MGMT_STATUS_BUSY; 2978 else if (PTR_ERR(conn) == -EOPNOTSUPP) 2979 status = MGMT_STATUS_NOT_SUPPORTED; 2980 else if (PTR_ERR(conn) == -ECONNREFUSED) 2981 status = MGMT_STATUS_REJECTED; 2982 else 2983 status = MGMT_STATUS_CONNECT_FAILED; 2984 2985 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE, 2986 status, &rp, sizeof(rp)); 2987 goto unlock; 2988 } 2989 2990 if (conn->connect_cfm_cb) { 2991 hci_conn_drop(conn); 2992 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE, 2993 MGMT_STATUS_BUSY, &rp, sizeof(rp)); 2994 goto unlock; 2995 } 2996 2997 cmd = mgmt_pending_add(sk, MGMT_OP_PAIR_DEVICE, hdev, data, len); 2998 if (!cmd) { 2999 err = -ENOMEM; 3000 hci_conn_drop(conn); 3001 goto unlock; 3002 } 3003 3004 cmd->cmd_complete = pairing_complete; 3005 3006 /* For LE, just connecting isn't a proof that the pairing finished */ 3007 if (cp->addr.type == BDADDR_BREDR) { 3008 conn->connect_cfm_cb = pairing_complete_cb; 3009 conn->security_cfm_cb = pairing_complete_cb; 3010 conn->disconn_cfm_cb = pairing_complete_cb; 3011 } else { 3012 conn->connect_cfm_cb = le_pairing_complete_cb; 3013 conn->security_cfm_cb = le_pairing_complete_cb; 3014 conn->disconn_cfm_cb = le_pairing_complete_cb; 3015 } 3016 3017 conn->io_capability = cp->io_cap; 3018 cmd->user_data = hci_conn_get(conn); 3019 3020 if ((conn->state == BT_CONNECTED || conn->state == BT_CONFIG) && 3021 hci_conn_security(conn, sec_level, auth_type, true)) { 3022 cmd->cmd_complete(cmd, 0); 3023 mgmt_pending_remove(cmd); 3024 } 3025 3026 err = 0; 3027 3028 unlock: 3029 hci_dev_unlock(hdev); 3030 return err; 3031 } 3032 3033 static int cancel_pair_device(struct sock *sk, struct hci_dev *hdev, void *data, 3034 u16 len) 3035 { 3036 struct mgmt_addr_info *addr = data; 3037 struct mgmt_pending_cmd *cmd; 3038 struct hci_conn *conn; 3039 int err; 3040 3041 bt_dev_dbg(hdev, "sock %p", sk); 3042 3043 hci_dev_lock(hdev); 3044 3045 if (!hdev_is_powered(hdev)) { 3046 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE, 3047 MGMT_STATUS_NOT_POWERED); 3048 goto unlock; 3049 } 3050 3051 cmd = pending_find(MGMT_OP_PAIR_DEVICE, hdev); 3052 if (!cmd) { 3053 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE, 3054 MGMT_STATUS_INVALID_PARAMS); 3055 goto unlock; 3056 } 3057 3058 conn = cmd->user_data; 3059 3060 if (bacmp(&addr->bdaddr, &conn->dst) != 0) { 3061 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE, 3062 MGMT_STATUS_INVALID_PARAMS); 3063 goto unlock; 3064 } 3065 3066 cmd->cmd_complete(cmd, MGMT_STATUS_CANCELLED); 3067 mgmt_pending_remove(cmd); 3068 3069 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE, 0, 3070 addr, sizeof(*addr)); 3071 3072 /* Since user doesn't want to proceed with the connection, abort any 3073 * ongoing pairing and then terminate the link if it was created 3074 * because of the pair device action. 3075 */ 3076 if (addr->type == BDADDR_BREDR) 3077 hci_remove_link_key(hdev, &addr->bdaddr); 3078 else 3079 smp_cancel_and_remove_pairing(hdev, &addr->bdaddr, 3080 le_addr_type(addr->type)); 3081 3082 if (conn->conn_reason == CONN_REASON_PAIR_DEVICE) 3083 hci_abort_conn(conn, HCI_ERROR_REMOTE_USER_TERM); 3084 3085 unlock: 3086 hci_dev_unlock(hdev); 3087 return err; 3088 } 3089 3090 static int user_pairing_resp(struct sock *sk, struct hci_dev *hdev, 3091 struct mgmt_addr_info *addr, u16 mgmt_op, 3092 u16 hci_op, __le32 passkey) 3093 { 3094 struct mgmt_pending_cmd *cmd; 3095 struct hci_conn *conn; 3096 int err; 3097 3098 hci_dev_lock(hdev); 3099 3100 if (!hdev_is_powered(hdev)) { 3101 err = mgmt_cmd_complete(sk, hdev->id, mgmt_op, 3102 MGMT_STATUS_NOT_POWERED, addr, 3103 sizeof(*addr)); 3104 goto done; 3105 } 3106 3107 if (addr->type == BDADDR_BREDR) 3108 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &addr->bdaddr); 3109 else 3110 conn = hci_conn_hash_lookup_le(hdev, &addr->bdaddr, 3111 le_addr_type(addr->type)); 3112 3113 if (!conn) { 3114 err = mgmt_cmd_complete(sk, hdev->id, mgmt_op, 3115 MGMT_STATUS_NOT_CONNECTED, addr, 3116 sizeof(*addr)); 3117 goto done; 3118 } 3119 3120 if (addr->type == BDADDR_LE_PUBLIC || addr->type == BDADDR_LE_RANDOM) { 3121 err = smp_user_confirm_reply(conn, mgmt_op, passkey); 3122 if (!err) 3123 err = mgmt_cmd_complete(sk, hdev->id, mgmt_op, 3124 MGMT_STATUS_SUCCESS, addr, 3125 sizeof(*addr)); 3126 else 3127 err = mgmt_cmd_complete(sk, hdev->id, mgmt_op, 3128 MGMT_STATUS_FAILED, addr, 3129 sizeof(*addr)); 3130 3131 goto done; 3132 } 3133 3134 cmd = mgmt_pending_add(sk, mgmt_op, hdev, addr, sizeof(*addr)); 3135 if (!cmd) { 3136 err = -ENOMEM; 3137 goto done; 3138 } 3139 3140 cmd->cmd_complete = addr_cmd_complete; 3141 3142 /* Continue with pairing via HCI */ 3143 if (hci_op == HCI_OP_USER_PASSKEY_REPLY) { 3144 struct hci_cp_user_passkey_reply cp; 3145 3146 bacpy(&cp.bdaddr, &addr->bdaddr); 3147 cp.passkey = passkey; 3148 err = hci_send_cmd(hdev, hci_op, sizeof(cp), &cp); 3149 } else 3150 err = hci_send_cmd(hdev, hci_op, sizeof(addr->bdaddr), 3151 &addr->bdaddr); 3152 3153 if (err < 0) 3154 mgmt_pending_remove(cmd); 3155 3156 done: 3157 hci_dev_unlock(hdev); 3158 return err; 3159 } 3160 3161 static int pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev, 3162 void *data, u16 len) 3163 { 3164 struct mgmt_cp_pin_code_neg_reply *cp = data; 3165 3166 bt_dev_dbg(hdev, "sock %p", sk); 3167 3168 return user_pairing_resp(sk, hdev, &cp->addr, 3169 MGMT_OP_PIN_CODE_NEG_REPLY, 3170 HCI_OP_PIN_CODE_NEG_REPLY, 0); 3171 } 3172 3173 static int user_confirm_reply(struct sock *sk, struct hci_dev *hdev, void *data, 3174 u16 len) 3175 { 3176 struct mgmt_cp_user_confirm_reply *cp = data; 3177 3178 bt_dev_dbg(hdev, "sock %p", sk); 3179 3180 if (len != sizeof(*cp)) 3181 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_USER_CONFIRM_REPLY, 3182 MGMT_STATUS_INVALID_PARAMS); 3183 3184 return user_pairing_resp(sk, hdev, &cp->addr, 3185 MGMT_OP_USER_CONFIRM_REPLY, 3186 HCI_OP_USER_CONFIRM_REPLY, 0); 3187 } 3188 3189 static int user_confirm_neg_reply(struct sock *sk, struct hci_dev *hdev, 3190 void *data, u16 len) 3191 { 3192 struct mgmt_cp_user_confirm_neg_reply *cp = data; 3193 3194 bt_dev_dbg(hdev, "sock %p", sk); 3195 3196 return user_pairing_resp(sk, hdev, &cp->addr, 3197 MGMT_OP_USER_CONFIRM_NEG_REPLY, 3198 HCI_OP_USER_CONFIRM_NEG_REPLY, 0); 3199 } 3200 3201 static int user_passkey_reply(struct sock *sk, struct hci_dev *hdev, void *data, 3202 u16 len) 3203 { 3204 struct mgmt_cp_user_passkey_reply *cp = data; 3205 3206 bt_dev_dbg(hdev, "sock %p", sk); 3207 3208 return user_pairing_resp(sk, hdev, &cp->addr, 3209 MGMT_OP_USER_PASSKEY_REPLY, 3210 HCI_OP_USER_PASSKEY_REPLY, cp->passkey); 3211 } 3212 3213 static int user_passkey_neg_reply(struct sock *sk, struct hci_dev *hdev, 3214 void *data, u16 len) 3215 { 3216 struct mgmt_cp_user_passkey_neg_reply *cp = data; 3217 3218 bt_dev_dbg(hdev, "sock %p", sk); 3219 3220 return user_pairing_resp(sk, hdev, &cp->addr, 3221 MGMT_OP_USER_PASSKEY_NEG_REPLY, 3222 HCI_OP_USER_PASSKEY_NEG_REPLY, 0); 3223 } 3224 3225 static void adv_expire(struct hci_dev *hdev, u32 flags) 3226 { 3227 struct adv_info *adv_instance; 3228 struct hci_request req; 3229 int err; 3230 3231 adv_instance = hci_find_adv_instance(hdev, hdev->cur_adv_instance); 3232 if (!adv_instance) 3233 return; 3234 3235 /* stop if current instance doesn't need to be changed */ 3236 if (!(adv_instance->flags & flags)) 3237 return; 3238 3239 cancel_adv_timeout(hdev); 3240 3241 adv_instance = hci_get_next_instance(hdev, adv_instance->instance); 3242 if (!adv_instance) 3243 return; 3244 3245 hci_req_init(&req, hdev); 3246 err = __hci_req_schedule_adv_instance(&req, adv_instance->instance, 3247 true); 3248 if (err) 3249 return; 3250 3251 hci_req_run(&req, NULL); 3252 } 3253 3254 static void set_name_complete(struct hci_dev *hdev, u8 status, u16 opcode) 3255 { 3256 struct mgmt_cp_set_local_name *cp; 3257 struct mgmt_pending_cmd *cmd; 3258 3259 bt_dev_dbg(hdev, "status 0x%02x", status); 3260 3261 hci_dev_lock(hdev); 3262 3263 cmd = pending_find(MGMT_OP_SET_LOCAL_NAME, hdev); 3264 if (!cmd) 3265 goto unlock; 3266 3267 cp = cmd->param; 3268 3269 if (status) { 3270 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 3271 mgmt_status(status)); 3272 } else { 3273 mgmt_cmd_complete(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0, 3274 cp, sizeof(*cp)); 3275 3276 if (hci_dev_test_flag(hdev, HCI_LE_ADV)) 3277 adv_expire(hdev, MGMT_ADV_FLAG_LOCAL_NAME); 3278 } 3279 3280 mgmt_pending_remove(cmd); 3281 3282 unlock: 3283 hci_dev_unlock(hdev); 3284 } 3285 3286 static int set_local_name(struct sock *sk, struct hci_dev *hdev, void *data, 3287 u16 len) 3288 { 3289 struct mgmt_cp_set_local_name *cp = data; 3290 struct mgmt_pending_cmd *cmd; 3291 struct hci_request req; 3292 int err; 3293 3294 bt_dev_dbg(hdev, "sock %p", sk); 3295 3296 hci_dev_lock(hdev); 3297 3298 /* If the old values are the same as the new ones just return a 3299 * direct command complete event. 3300 */ 3301 if (!memcmp(hdev->dev_name, cp->name, sizeof(hdev->dev_name)) && 3302 !memcmp(hdev->short_name, cp->short_name, 3303 sizeof(hdev->short_name))) { 3304 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0, 3305 data, len); 3306 goto failed; 3307 } 3308 3309 memcpy(hdev->short_name, cp->short_name, sizeof(hdev->short_name)); 3310 3311 if (!hdev_is_powered(hdev)) { 3312 memcpy(hdev->dev_name, cp->name, sizeof(hdev->dev_name)); 3313 3314 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0, 3315 data, len); 3316 if (err < 0) 3317 goto failed; 3318 3319 err = mgmt_limited_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, data, 3320 len, HCI_MGMT_LOCAL_NAME_EVENTS, sk); 3321 ext_info_changed(hdev, sk); 3322 3323 goto failed; 3324 } 3325 3326 cmd = mgmt_pending_add(sk, MGMT_OP_SET_LOCAL_NAME, hdev, data, len); 3327 if (!cmd) { 3328 err = -ENOMEM; 3329 goto failed; 3330 } 3331 3332 memcpy(hdev->dev_name, cp->name, sizeof(hdev->dev_name)); 3333 3334 hci_req_init(&req, hdev); 3335 3336 if (lmp_bredr_capable(hdev)) { 3337 __hci_req_update_name(&req); 3338 __hci_req_update_eir(&req); 3339 } 3340 3341 /* The name is stored in the scan response data and so 3342 * no need to udpate the advertising data here. 3343 */ 3344 if (lmp_le_capable(hdev) && hci_dev_test_flag(hdev, HCI_ADVERTISING)) 3345 __hci_req_update_scan_rsp_data(&req, hdev->cur_adv_instance); 3346 3347 err = hci_req_run(&req, set_name_complete); 3348 if (err < 0) 3349 mgmt_pending_remove(cmd); 3350 3351 failed: 3352 hci_dev_unlock(hdev); 3353 return err; 3354 } 3355 3356 static int set_appearance(struct sock *sk, struct hci_dev *hdev, void *data, 3357 u16 len) 3358 { 3359 struct mgmt_cp_set_appearance *cp = data; 3360 u16 appearance; 3361 int err; 3362 3363 bt_dev_dbg(hdev, "sock %p", sk); 3364 3365 if (!lmp_le_capable(hdev)) 3366 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_APPEARANCE, 3367 MGMT_STATUS_NOT_SUPPORTED); 3368 3369 appearance = le16_to_cpu(cp->appearance); 3370 3371 hci_dev_lock(hdev); 3372 3373 if (hdev->appearance != appearance) { 3374 hdev->appearance = appearance; 3375 3376 if (hci_dev_test_flag(hdev, HCI_LE_ADV)) 3377 adv_expire(hdev, MGMT_ADV_FLAG_APPEARANCE); 3378 3379 ext_info_changed(hdev, sk); 3380 } 3381 3382 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_APPEARANCE, 0, NULL, 3383 0); 3384 3385 hci_dev_unlock(hdev); 3386 3387 return err; 3388 } 3389 3390 static int get_phy_configuration(struct sock *sk, struct hci_dev *hdev, 3391 void *data, u16 len) 3392 { 3393 struct mgmt_rp_get_phy_configuration rp; 3394 3395 bt_dev_dbg(hdev, "sock %p", sk); 3396 3397 hci_dev_lock(hdev); 3398 3399 memset(&rp, 0, sizeof(rp)); 3400 3401 rp.supported_phys = cpu_to_le32(get_supported_phys(hdev)); 3402 rp.selected_phys = cpu_to_le32(get_selected_phys(hdev)); 3403 rp.configurable_phys = cpu_to_le32(get_configurable_phys(hdev)); 3404 3405 hci_dev_unlock(hdev); 3406 3407 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_PHY_CONFIGURATION, 0, 3408 &rp, sizeof(rp)); 3409 } 3410 3411 int mgmt_phy_configuration_changed(struct hci_dev *hdev, struct sock *skip) 3412 { 3413 struct mgmt_ev_phy_configuration_changed ev; 3414 3415 memset(&ev, 0, sizeof(ev)); 3416 3417 ev.selected_phys = cpu_to_le32(get_selected_phys(hdev)); 3418 3419 return mgmt_event(MGMT_EV_PHY_CONFIGURATION_CHANGED, hdev, &ev, 3420 sizeof(ev), skip); 3421 } 3422 3423 static void set_default_phy_complete(struct hci_dev *hdev, u8 status, 3424 u16 opcode, struct sk_buff *skb) 3425 { 3426 struct mgmt_pending_cmd *cmd; 3427 3428 bt_dev_dbg(hdev, "status 0x%02x", status); 3429 3430 hci_dev_lock(hdev); 3431 3432 cmd = pending_find(MGMT_OP_SET_PHY_CONFIGURATION, hdev); 3433 if (!cmd) 3434 goto unlock; 3435 3436 if (status) { 3437 mgmt_cmd_status(cmd->sk, hdev->id, 3438 MGMT_OP_SET_PHY_CONFIGURATION, 3439 mgmt_status(status)); 3440 } else { 3441 mgmt_cmd_complete(cmd->sk, hdev->id, 3442 MGMT_OP_SET_PHY_CONFIGURATION, 0, 3443 NULL, 0); 3444 3445 mgmt_phy_configuration_changed(hdev, cmd->sk); 3446 } 3447 3448 mgmt_pending_remove(cmd); 3449 3450 unlock: 3451 hci_dev_unlock(hdev); 3452 } 3453 3454 static int set_phy_configuration(struct sock *sk, struct hci_dev *hdev, 3455 void *data, u16 len) 3456 { 3457 struct mgmt_cp_set_phy_configuration *cp = data; 3458 struct hci_cp_le_set_default_phy cp_phy; 3459 struct mgmt_pending_cmd *cmd; 3460 struct hci_request req; 3461 u32 selected_phys, configurable_phys, supported_phys, unconfigure_phys; 3462 u16 pkt_type = (HCI_DH1 | HCI_DM1); 3463 bool changed = false; 3464 int err; 3465 3466 bt_dev_dbg(hdev, "sock %p", sk); 3467 3468 configurable_phys = get_configurable_phys(hdev); 3469 supported_phys = get_supported_phys(hdev); 3470 selected_phys = __le32_to_cpu(cp->selected_phys); 3471 3472 if (selected_phys & ~supported_phys) 3473 return mgmt_cmd_status(sk, hdev->id, 3474 MGMT_OP_SET_PHY_CONFIGURATION, 3475 MGMT_STATUS_INVALID_PARAMS); 3476 3477 unconfigure_phys = supported_phys & ~configurable_phys; 3478 3479 if ((selected_phys & unconfigure_phys) != unconfigure_phys) 3480 return mgmt_cmd_status(sk, hdev->id, 3481 MGMT_OP_SET_PHY_CONFIGURATION, 3482 MGMT_STATUS_INVALID_PARAMS); 3483 3484 if (selected_phys == get_selected_phys(hdev)) 3485 return mgmt_cmd_complete(sk, hdev->id, 3486 MGMT_OP_SET_PHY_CONFIGURATION, 3487 0, NULL, 0); 3488 3489 hci_dev_lock(hdev); 3490 3491 if (!hdev_is_powered(hdev)) { 3492 err = mgmt_cmd_status(sk, hdev->id, 3493 MGMT_OP_SET_PHY_CONFIGURATION, 3494 MGMT_STATUS_REJECTED); 3495 goto unlock; 3496 } 3497 3498 if (pending_find(MGMT_OP_SET_PHY_CONFIGURATION, hdev)) { 3499 err = mgmt_cmd_status(sk, hdev->id, 3500 MGMT_OP_SET_PHY_CONFIGURATION, 3501 MGMT_STATUS_BUSY); 3502 goto unlock; 3503 } 3504 3505 if (selected_phys & MGMT_PHY_BR_1M_3SLOT) 3506 pkt_type |= (HCI_DH3 | HCI_DM3); 3507 else 3508 pkt_type &= ~(HCI_DH3 | HCI_DM3); 3509 3510 if (selected_phys & MGMT_PHY_BR_1M_5SLOT) 3511 pkt_type |= (HCI_DH5 | HCI_DM5); 3512 else 3513 pkt_type &= ~(HCI_DH5 | HCI_DM5); 3514 3515 if (selected_phys & MGMT_PHY_EDR_2M_1SLOT) 3516 pkt_type &= ~HCI_2DH1; 3517 else 3518 pkt_type |= HCI_2DH1; 3519 3520 if (selected_phys & MGMT_PHY_EDR_2M_3SLOT) 3521 pkt_type &= ~HCI_2DH3; 3522 else 3523 pkt_type |= HCI_2DH3; 3524 3525 if (selected_phys & MGMT_PHY_EDR_2M_5SLOT) 3526 pkt_type &= ~HCI_2DH5; 3527 else 3528 pkt_type |= HCI_2DH5; 3529 3530 if (selected_phys & MGMT_PHY_EDR_3M_1SLOT) 3531 pkt_type &= ~HCI_3DH1; 3532 else 3533 pkt_type |= HCI_3DH1; 3534 3535 if (selected_phys & MGMT_PHY_EDR_3M_3SLOT) 3536 pkt_type &= ~HCI_3DH3; 3537 else 3538 pkt_type |= HCI_3DH3; 3539 3540 if (selected_phys & MGMT_PHY_EDR_3M_5SLOT) 3541 pkt_type &= ~HCI_3DH5; 3542 else 3543 pkt_type |= HCI_3DH5; 3544 3545 if (pkt_type != hdev->pkt_type) { 3546 hdev->pkt_type = pkt_type; 3547 changed = true; 3548 } 3549 3550 if ((selected_phys & MGMT_PHY_LE_MASK) == 3551 (get_selected_phys(hdev) & MGMT_PHY_LE_MASK)) { 3552 if (changed) 3553 mgmt_phy_configuration_changed(hdev, sk); 3554 3555 err = mgmt_cmd_complete(sk, hdev->id, 3556 MGMT_OP_SET_PHY_CONFIGURATION, 3557 0, NULL, 0); 3558 3559 goto unlock; 3560 } 3561 3562 cmd = mgmt_pending_add(sk, MGMT_OP_SET_PHY_CONFIGURATION, hdev, data, 3563 len); 3564 if (!cmd) { 3565 err = -ENOMEM; 3566 goto unlock; 3567 } 3568 3569 hci_req_init(&req, hdev); 3570 3571 memset(&cp_phy, 0, sizeof(cp_phy)); 3572 3573 if (!(selected_phys & MGMT_PHY_LE_TX_MASK)) 3574 cp_phy.all_phys |= 0x01; 3575 3576 if (!(selected_phys & MGMT_PHY_LE_RX_MASK)) 3577 cp_phy.all_phys |= 0x02; 3578 3579 if (selected_phys & MGMT_PHY_LE_1M_TX) 3580 cp_phy.tx_phys |= HCI_LE_SET_PHY_1M; 3581 3582 if (selected_phys & MGMT_PHY_LE_2M_TX) 3583 cp_phy.tx_phys |= HCI_LE_SET_PHY_2M; 3584 3585 if (selected_phys & MGMT_PHY_LE_CODED_TX) 3586 cp_phy.tx_phys |= HCI_LE_SET_PHY_CODED; 3587 3588 if (selected_phys & MGMT_PHY_LE_1M_RX) 3589 cp_phy.rx_phys |= HCI_LE_SET_PHY_1M; 3590 3591 if (selected_phys & MGMT_PHY_LE_2M_RX) 3592 cp_phy.rx_phys |= HCI_LE_SET_PHY_2M; 3593 3594 if (selected_phys & MGMT_PHY_LE_CODED_RX) 3595 cp_phy.rx_phys |= HCI_LE_SET_PHY_CODED; 3596 3597 hci_req_add(&req, HCI_OP_LE_SET_DEFAULT_PHY, sizeof(cp_phy), &cp_phy); 3598 3599 err = hci_req_run_skb(&req, set_default_phy_complete); 3600 if (err < 0) 3601 mgmt_pending_remove(cmd); 3602 3603 unlock: 3604 hci_dev_unlock(hdev); 3605 3606 return err; 3607 } 3608 3609 static int set_blocked_keys(struct sock *sk, struct hci_dev *hdev, void *data, 3610 u16 len) 3611 { 3612 int err = MGMT_STATUS_SUCCESS; 3613 struct mgmt_cp_set_blocked_keys *keys = data; 3614 const u16 max_key_count = ((U16_MAX - sizeof(*keys)) / 3615 sizeof(struct mgmt_blocked_key_info)); 3616 u16 key_count, expected_len; 3617 int i; 3618 3619 bt_dev_dbg(hdev, "sock %p", sk); 3620 3621 key_count = __le16_to_cpu(keys->key_count); 3622 if (key_count > max_key_count) { 3623 bt_dev_err(hdev, "too big key_count value %u", key_count); 3624 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BLOCKED_KEYS, 3625 MGMT_STATUS_INVALID_PARAMS); 3626 } 3627 3628 expected_len = struct_size(keys, keys, key_count); 3629 if (expected_len != len) { 3630 bt_dev_err(hdev, "expected %u bytes, got %u bytes", 3631 expected_len, len); 3632 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BLOCKED_KEYS, 3633 MGMT_STATUS_INVALID_PARAMS); 3634 } 3635 3636 hci_dev_lock(hdev); 3637 3638 hci_blocked_keys_clear(hdev); 3639 3640 for (i = 0; i < keys->key_count; ++i) { 3641 struct blocked_key *b = kzalloc(sizeof(*b), GFP_KERNEL); 3642 3643 if (!b) { 3644 err = MGMT_STATUS_NO_RESOURCES; 3645 break; 3646 } 3647 3648 b->type = keys->keys[i].type; 3649 memcpy(b->val, keys->keys[i].val, sizeof(b->val)); 3650 list_add_rcu(&b->list, &hdev->blocked_keys); 3651 } 3652 hci_dev_unlock(hdev); 3653 3654 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_BLOCKED_KEYS, 3655 err, NULL, 0); 3656 } 3657 3658 static int set_wideband_speech(struct sock *sk, struct hci_dev *hdev, 3659 void *data, u16 len) 3660 { 3661 struct mgmt_mode *cp = data; 3662 int err; 3663 bool changed = false; 3664 3665 bt_dev_dbg(hdev, "sock %p", sk); 3666 3667 if (!test_bit(HCI_QUIRK_WIDEBAND_SPEECH_SUPPORTED, &hdev->quirks)) 3668 return mgmt_cmd_status(sk, hdev->id, 3669 MGMT_OP_SET_WIDEBAND_SPEECH, 3670 MGMT_STATUS_NOT_SUPPORTED); 3671 3672 if (cp->val != 0x00 && cp->val != 0x01) 3673 return mgmt_cmd_status(sk, hdev->id, 3674 MGMT_OP_SET_WIDEBAND_SPEECH, 3675 MGMT_STATUS_INVALID_PARAMS); 3676 3677 hci_dev_lock(hdev); 3678 3679 if (pending_find(MGMT_OP_SET_WIDEBAND_SPEECH, hdev)) { 3680 err = mgmt_cmd_status(sk, hdev->id, 3681 MGMT_OP_SET_WIDEBAND_SPEECH, 3682 MGMT_STATUS_BUSY); 3683 goto unlock; 3684 } 3685 3686 if (hdev_is_powered(hdev) && 3687 !!cp->val != hci_dev_test_flag(hdev, 3688 HCI_WIDEBAND_SPEECH_ENABLED)) { 3689 err = mgmt_cmd_status(sk, hdev->id, 3690 MGMT_OP_SET_WIDEBAND_SPEECH, 3691 MGMT_STATUS_REJECTED); 3692 goto unlock; 3693 } 3694 3695 if (cp->val) 3696 changed = !hci_dev_test_and_set_flag(hdev, 3697 HCI_WIDEBAND_SPEECH_ENABLED); 3698 else 3699 changed = hci_dev_test_and_clear_flag(hdev, 3700 HCI_WIDEBAND_SPEECH_ENABLED); 3701 3702 err = send_settings_rsp(sk, MGMT_OP_SET_WIDEBAND_SPEECH, hdev); 3703 if (err < 0) 3704 goto unlock; 3705 3706 if (changed) 3707 err = new_settings(hdev, sk); 3708 3709 unlock: 3710 hci_dev_unlock(hdev); 3711 return err; 3712 } 3713 3714 static int read_controller_cap(struct sock *sk, struct hci_dev *hdev, 3715 void *data, u16 data_len) 3716 { 3717 char buf[20]; 3718 struct mgmt_rp_read_controller_cap *rp = (void *)buf; 3719 u16 cap_len = 0; 3720 u8 flags = 0; 3721 u8 tx_power_range[2]; 3722 3723 bt_dev_dbg(hdev, "sock %p", sk); 3724 3725 memset(&buf, 0, sizeof(buf)); 3726 3727 hci_dev_lock(hdev); 3728 3729 /* When the Read Simple Pairing Options command is supported, then 3730 * the remote public key validation is supported. 3731 */ 3732 if (hdev->commands[41] & 0x08) 3733 flags |= 0x01; /* Remote public key validation (BR/EDR) */ 3734 3735 flags |= 0x02; /* Remote public key validation (LE) */ 3736 3737 /* When the Read Encryption Key Size command is supported, then the 3738 * encryption key size is enforced. 3739 */ 3740 if (hdev->commands[20] & 0x10) 3741 flags |= 0x04; /* Encryption key size enforcement (BR/EDR) */ 3742 3743 flags |= 0x08; /* Encryption key size enforcement (LE) */ 3744 3745 cap_len = eir_append_data(rp->cap, cap_len, MGMT_CAP_SEC_FLAGS, 3746 &flags, 1); 3747 3748 /* When the Read Simple Pairing Options command is supported, then 3749 * also max encryption key size information is provided. 3750 */ 3751 if (hdev->commands[41] & 0x08) 3752 cap_len = eir_append_le16(rp->cap, cap_len, 3753 MGMT_CAP_MAX_ENC_KEY_SIZE, 3754 hdev->max_enc_key_size); 3755 3756 cap_len = eir_append_le16(rp->cap, cap_len, 3757 MGMT_CAP_SMP_MAX_ENC_KEY_SIZE, 3758 SMP_MAX_ENC_KEY_SIZE); 3759 3760 /* Append the min/max LE tx power parameters if we were able to fetch 3761 * it from the controller 3762 */ 3763 if (hdev->commands[38] & 0x80) { 3764 memcpy(&tx_power_range[0], &hdev->min_le_tx_power, 1); 3765 memcpy(&tx_power_range[1], &hdev->max_le_tx_power, 1); 3766 cap_len = eir_append_data(rp->cap, cap_len, MGMT_CAP_LE_TX_PWR, 3767 tx_power_range, 2); 3768 } 3769 3770 rp->cap_len = cpu_to_le16(cap_len); 3771 3772 hci_dev_unlock(hdev); 3773 3774 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_CONTROLLER_CAP, 0, 3775 rp, sizeof(*rp) + cap_len); 3776 } 3777 3778 #ifdef CONFIG_BT_FEATURE_DEBUG 3779 /* d4992530-b9ec-469f-ab01-6c481c47da1c */ 3780 static const u8 debug_uuid[16] = { 3781 0x1c, 0xda, 0x47, 0x1c, 0x48, 0x6c, 0x01, 0xab, 3782 0x9f, 0x46, 0xec, 0xb9, 0x30, 0x25, 0x99, 0xd4, 3783 }; 3784 #endif 3785 3786 /* 671b10b5-42c0-4696-9227-eb28d1b049d6 */ 3787 static const u8 simult_central_periph_uuid[16] = { 3788 0xd6, 0x49, 0xb0, 0xd1, 0x28, 0xeb, 0x27, 0x92, 3789 0x96, 0x46, 0xc0, 0x42, 0xb5, 0x10, 0x1b, 0x67, 3790 }; 3791 3792 /* 15c0a148-c273-11ea-b3de-0242ac130004 */ 3793 static const u8 rpa_resolution_uuid[16] = { 3794 0x04, 0x00, 0x13, 0xac, 0x42, 0x02, 0xde, 0xb3, 3795 0xea, 0x11, 0x73, 0xc2, 0x48, 0xa1, 0xc0, 0x15, 3796 }; 3797 3798 static int read_exp_features_info(struct sock *sk, struct hci_dev *hdev, 3799 void *data, u16 data_len) 3800 { 3801 char buf[62]; /* Enough space for 3 features */ 3802 struct mgmt_rp_read_exp_features_info *rp = (void *)buf; 3803 u16 idx = 0; 3804 u32 flags; 3805 3806 bt_dev_dbg(hdev, "sock %p", sk); 3807 3808 memset(&buf, 0, sizeof(buf)); 3809 3810 #ifdef CONFIG_BT_FEATURE_DEBUG 3811 if (!hdev) { 3812 flags = bt_dbg_get() ? BIT(0) : 0; 3813 3814 memcpy(rp->features[idx].uuid, debug_uuid, 16); 3815 rp->features[idx].flags = cpu_to_le32(flags); 3816 idx++; 3817 } 3818 #endif 3819 3820 if (hdev) { 3821 if (test_bit(HCI_QUIRK_VALID_LE_STATES, &hdev->quirks) && 3822 (hdev->le_states[4] & 0x08) && /* Central */ 3823 (hdev->le_states[4] & 0x40) && /* Peripheral */ 3824 (hdev->le_states[3] & 0x10)) /* Simultaneous */ 3825 flags = BIT(0); 3826 else 3827 flags = 0; 3828 3829 memcpy(rp->features[idx].uuid, simult_central_periph_uuid, 16); 3830 rp->features[idx].flags = cpu_to_le32(flags); 3831 idx++; 3832 } 3833 3834 if (hdev && use_ll_privacy(hdev)) { 3835 if (hci_dev_test_flag(hdev, HCI_ENABLE_LL_PRIVACY)) 3836 flags = BIT(0) | BIT(1); 3837 else 3838 flags = BIT(1); 3839 3840 memcpy(rp->features[idx].uuid, rpa_resolution_uuid, 16); 3841 rp->features[idx].flags = cpu_to_le32(flags); 3842 idx++; 3843 } 3844 3845 rp->feature_count = cpu_to_le16(idx); 3846 3847 /* After reading the experimental features information, enable 3848 * the events to update client on any future change. 3849 */ 3850 hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS); 3851 3852 return mgmt_cmd_complete(sk, hdev ? hdev->id : MGMT_INDEX_NONE, 3853 MGMT_OP_READ_EXP_FEATURES_INFO, 3854 0, rp, sizeof(*rp) + (20 * idx)); 3855 } 3856 3857 static int exp_ll_privacy_feature_changed(bool enabled, struct hci_dev *hdev, 3858 struct sock *skip) 3859 { 3860 struct mgmt_ev_exp_feature_changed ev; 3861 3862 memset(&ev, 0, sizeof(ev)); 3863 memcpy(ev.uuid, rpa_resolution_uuid, 16); 3864 ev.flags = cpu_to_le32((enabled ? BIT(0) : 0) | BIT(1)); 3865 3866 return mgmt_limited_event(MGMT_EV_EXP_FEATURE_CHANGED, hdev, 3867 &ev, sizeof(ev), 3868 HCI_MGMT_EXP_FEATURE_EVENTS, skip); 3869 3870 } 3871 3872 #ifdef CONFIG_BT_FEATURE_DEBUG 3873 static int exp_debug_feature_changed(bool enabled, struct sock *skip) 3874 { 3875 struct mgmt_ev_exp_feature_changed ev; 3876 3877 memset(&ev, 0, sizeof(ev)); 3878 memcpy(ev.uuid, debug_uuid, 16); 3879 ev.flags = cpu_to_le32(enabled ? BIT(0) : 0); 3880 3881 return mgmt_limited_event(MGMT_EV_EXP_FEATURE_CHANGED, NULL, 3882 &ev, sizeof(ev), 3883 HCI_MGMT_EXP_FEATURE_EVENTS, skip); 3884 } 3885 #endif 3886 3887 static int set_exp_feature(struct sock *sk, struct hci_dev *hdev, 3888 void *data, u16 data_len) 3889 { 3890 struct mgmt_cp_set_exp_feature *cp = data; 3891 struct mgmt_rp_set_exp_feature rp; 3892 3893 bt_dev_dbg(hdev, "sock %p", sk); 3894 3895 if (!memcmp(cp->uuid, ZERO_KEY, 16)) { 3896 memset(rp.uuid, 0, 16); 3897 rp.flags = cpu_to_le32(0); 3898 3899 #ifdef CONFIG_BT_FEATURE_DEBUG 3900 if (!hdev) { 3901 bool changed = bt_dbg_get(); 3902 3903 bt_dbg_set(false); 3904 3905 if (changed) 3906 exp_debug_feature_changed(false, sk); 3907 } 3908 #endif 3909 3910 if (hdev && use_ll_privacy(hdev) && !hdev_is_powered(hdev)) { 3911 bool changed = hci_dev_test_flag(hdev, 3912 HCI_ENABLE_LL_PRIVACY); 3913 3914 hci_dev_clear_flag(hdev, HCI_ENABLE_LL_PRIVACY); 3915 3916 if (changed) 3917 exp_ll_privacy_feature_changed(false, hdev, sk); 3918 } 3919 3920 hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS); 3921 3922 return mgmt_cmd_complete(sk, hdev ? hdev->id : MGMT_INDEX_NONE, 3923 MGMT_OP_SET_EXP_FEATURE, 0, 3924 &rp, sizeof(rp)); 3925 } 3926 3927 #ifdef CONFIG_BT_FEATURE_DEBUG 3928 if (!memcmp(cp->uuid, debug_uuid, 16)) { 3929 bool val, changed; 3930 int err; 3931 3932 /* Command requires to use the non-controller index */ 3933 if (hdev) 3934 return mgmt_cmd_status(sk, hdev->id, 3935 MGMT_OP_SET_EXP_FEATURE, 3936 MGMT_STATUS_INVALID_INDEX); 3937 3938 /* Parameters are limited to a single octet */ 3939 if (data_len != MGMT_SET_EXP_FEATURE_SIZE + 1) 3940 return mgmt_cmd_status(sk, MGMT_INDEX_NONE, 3941 MGMT_OP_SET_EXP_FEATURE, 3942 MGMT_STATUS_INVALID_PARAMS); 3943 3944 /* Only boolean on/off is supported */ 3945 if (cp->param[0] != 0x00 && cp->param[0] != 0x01) 3946 return mgmt_cmd_status(sk, MGMT_INDEX_NONE, 3947 MGMT_OP_SET_EXP_FEATURE, 3948 MGMT_STATUS_INVALID_PARAMS); 3949 3950 val = !!cp->param[0]; 3951 changed = val ? !bt_dbg_get() : bt_dbg_get(); 3952 bt_dbg_set(val); 3953 3954 memcpy(rp.uuid, debug_uuid, 16); 3955 rp.flags = cpu_to_le32(val ? BIT(0) : 0); 3956 3957 hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS); 3958 3959 err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE, 3960 MGMT_OP_SET_EXP_FEATURE, 0, 3961 &rp, sizeof(rp)); 3962 3963 if (changed) 3964 exp_debug_feature_changed(val, sk); 3965 3966 return err; 3967 } 3968 #endif 3969 3970 if (!memcmp(cp->uuid, rpa_resolution_uuid, 16)) { 3971 bool val, changed; 3972 int err; 3973 u32 flags; 3974 3975 /* Command requires to use the controller index */ 3976 if (!hdev) 3977 return mgmt_cmd_status(sk, MGMT_INDEX_NONE, 3978 MGMT_OP_SET_EXP_FEATURE, 3979 MGMT_STATUS_INVALID_INDEX); 3980 3981 /* Changes can only be made when controller is powered down */ 3982 if (hdev_is_powered(hdev)) 3983 return mgmt_cmd_status(sk, hdev->id, 3984 MGMT_OP_SET_EXP_FEATURE, 3985 MGMT_STATUS_NOT_POWERED); 3986 3987 /* Parameters are limited to a single octet */ 3988 if (data_len != MGMT_SET_EXP_FEATURE_SIZE + 1) 3989 return mgmt_cmd_status(sk, hdev->id, 3990 MGMT_OP_SET_EXP_FEATURE, 3991 MGMT_STATUS_INVALID_PARAMS); 3992 3993 /* Only boolean on/off is supported */ 3994 if (cp->param[0] != 0x00 && cp->param[0] != 0x01) 3995 return mgmt_cmd_status(sk, hdev->id, 3996 MGMT_OP_SET_EXP_FEATURE, 3997 MGMT_STATUS_INVALID_PARAMS); 3998 3999 val = !!cp->param[0]; 4000 4001 if (val) { 4002 changed = !hci_dev_test_flag(hdev, 4003 HCI_ENABLE_LL_PRIVACY); 4004 hci_dev_set_flag(hdev, HCI_ENABLE_LL_PRIVACY); 4005 hci_dev_clear_flag(hdev, HCI_ADVERTISING); 4006 4007 /* Enable LL privacy + supported settings changed */ 4008 flags = BIT(0) | BIT(1); 4009 } else { 4010 changed = hci_dev_test_flag(hdev, 4011 HCI_ENABLE_LL_PRIVACY); 4012 hci_dev_clear_flag(hdev, HCI_ENABLE_LL_PRIVACY); 4013 4014 /* Disable LL privacy + supported settings changed */ 4015 flags = BIT(1); 4016 } 4017 4018 memcpy(rp.uuid, rpa_resolution_uuid, 16); 4019 rp.flags = cpu_to_le32(flags); 4020 4021 hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS); 4022 4023 err = mgmt_cmd_complete(sk, hdev->id, 4024 MGMT_OP_SET_EXP_FEATURE, 0, 4025 &rp, sizeof(rp)); 4026 4027 if (changed) 4028 exp_ll_privacy_feature_changed(val, hdev, sk); 4029 4030 return err; 4031 } 4032 4033 return mgmt_cmd_status(sk, hdev ? hdev->id : MGMT_INDEX_NONE, 4034 MGMT_OP_SET_EXP_FEATURE, 4035 MGMT_STATUS_NOT_SUPPORTED); 4036 } 4037 4038 #define SUPPORTED_DEVICE_FLAGS() ((1U << HCI_CONN_FLAG_MAX) - 1) 4039 4040 static int get_device_flags(struct sock *sk, struct hci_dev *hdev, void *data, 4041 u16 data_len) 4042 { 4043 struct mgmt_cp_get_device_flags *cp = data; 4044 struct mgmt_rp_get_device_flags rp; 4045 struct bdaddr_list_with_flags *br_params; 4046 struct hci_conn_params *params; 4047 u32 supported_flags = SUPPORTED_DEVICE_FLAGS(); 4048 u32 current_flags = 0; 4049 u8 status = MGMT_STATUS_INVALID_PARAMS; 4050 4051 bt_dev_dbg(hdev, "Get device flags %pMR (type 0x%x)\n", 4052 &cp->addr.bdaddr, cp->addr.type); 4053 4054 hci_dev_lock(hdev); 4055 4056 if (cp->addr.type == BDADDR_BREDR) { 4057 br_params = hci_bdaddr_list_lookup_with_flags(&hdev->whitelist, 4058 &cp->addr.bdaddr, 4059 cp->addr.type); 4060 if (!br_params) 4061 goto done; 4062 4063 current_flags = br_params->current_flags; 4064 } else { 4065 params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr, 4066 le_addr_type(cp->addr.type)); 4067 4068 if (!params) 4069 goto done; 4070 4071 current_flags = params->current_flags; 4072 } 4073 4074 bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr); 4075 rp.addr.type = cp->addr.type; 4076 rp.supported_flags = cpu_to_le32(supported_flags); 4077 rp.current_flags = cpu_to_le32(current_flags); 4078 4079 status = MGMT_STATUS_SUCCESS; 4080 4081 done: 4082 hci_dev_unlock(hdev); 4083 4084 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_DEVICE_FLAGS, status, 4085 &rp, sizeof(rp)); 4086 } 4087 4088 static void device_flags_changed(struct sock *sk, struct hci_dev *hdev, 4089 bdaddr_t *bdaddr, u8 bdaddr_type, 4090 u32 supported_flags, u32 current_flags) 4091 { 4092 struct mgmt_ev_device_flags_changed ev; 4093 4094 bacpy(&ev.addr.bdaddr, bdaddr); 4095 ev.addr.type = bdaddr_type; 4096 ev.supported_flags = cpu_to_le32(supported_flags); 4097 ev.current_flags = cpu_to_le32(current_flags); 4098 4099 mgmt_event(MGMT_EV_DEVICE_FLAGS_CHANGED, hdev, &ev, sizeof(ev), sk); 4100 } 4101 4102 static int set_device_flags(struct sock *sk, struct hci_dev *hdev, void *data, 4103 u16 len) 4104 { 4105 struct mgmt_cp_set_device_flags *cp = data; 4106 struct bdaddr_list_with_flags *br_params; 4107 struct hci_conn_params *params; 4108 u8 status = MGMT_STATUS_INVALID_PARAMS; 4109 u32 supported_flags = SUPPORTED_DEVICE_FLAGS(); 4110 u32 current_flags = __le32_to_cpu(cp->current_flags); 4111 4112 bt_dev_dbg(hdev, "Set device flags %pMR (type 0x%x) = 0x%x", 4113 &cp->addr.bdaddr, cp->addr.type, 4114 __le32_to_cpu(current_flags)); 4115 4116 if ((supported_flags | current_flags) != supported_flags) { 4117 bt_dev_warn(hdev, "Bad flag given (0x%x) vs supported (0x%0x)", 4118 current_flags, supported_flags); 4119 goto done; 4120 } 4121 4122 hci_dev_lock(hdev); 4123 4124 if (cp->addr.type == BDADDR_BREDR) { 4125 br_params = hci_bdaddr_list_lookup_with_flags(&hdev->whitelist, 4126 &cp->addr.bdaddr, 4127 cp->addr.type); 4128 4129 if (br_params) { 4130 br_params->current_flags = current_flags; 4131 status = MGMT_STATUS_SUCCESS; 4132 } else { 4133 bt_dev_warn(hdev, "No such BR/EDR device %pMR (0x%x)", 4134 &cp->addr.bdaddr, cp->addr.type); 4135 } 4136 } else { 4137 params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr, 4138 le_addr_type(cp->addr.type)); 4139 if (params) { 4140 params->current_flags = current_flags; 4141 status = MGMT_STATUS_SUCCESS; 4142 } else { 4143 bt_dev_warn(hdev, "No such LE device %pMR (0x%x)", 4144 &cp->addr.bdaddr, 4145 le_addr_type(cp->addr.type)); 4146 } 4147 } 4148 4149 done: 4150 hci_dev_unlock(hdev); 4151 4152 if (status == MGMT_STATUS_SUCCESS) 4153 device_flags_changed(sk, hdev, &cp->addr.bdaddr, cp->addr.type, 4154 supported_flags, current_flags); 4155 4156 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_DEVICE_FLAGS, status, 4157 &cp->addr, sizeof(cp->addr)); 4158 } 4159 4160 static void mgmt_adv_monitor_added(struct sock *sk, struct hci_dev *hdev, 4161 u16 handle) 4162 { 4163 struct mgmt_ev_adv_monitor_added ev; 4164 4165 ev.monitor_handle = cpu_to_le16(handle); 4166 4167 mgmt_event(MGMT_EV_ADV_MONITOR_ADDED, hdev, &ev, sizeof(ev), sk); 4168 } 4169 4170 void mgmt_adv_monitor_removed(struct hci_dev *hdev, u16 handle) 4171 { 4172 struct mgmt_ev_adv_monitor_removed ev; 4173 struct mgmt_pending_cmd *cmd; 4174 struct sock *sk_skip = NULL; 4175 struct mgmt_cp_remove_adv_monitor *cp; 4176 4177 cmd = pending_find(MGMT_OP_REMOVE_ADV_MONITOR, hdev); 4178 if (cmd) { 4179 cp = cmd->param; 4180 4181 if (cp->monitor_handle) 4182 sk_skip = cmd->sk; 4183 } 4184 4185 ev.monitor_handle = cpu_to_le16(handle); 4186 4187 mgmt_event(MGMT_EV_ADV_MONITOR_REMOVED, hdev, &ev, sizeof(ev), sk_skip); 4188 } 4189 4190 static int read_adv_mon_features(struct sock *sk, struct hci_dev *hdev, 4191 void *data, u16 len) 4192 { 4193 struct adv_monitor *monitor = NULL; 4194 struct mgmt_rp_read_adv_monitor_features *rp = NULL; 4195 int handle, err; 4196 size_t rp_size = 0; 4197 __u32 supported = 0; 4198 __u32 enabled = 0; 4199 __u16 num_handles = 0; 4200 __u16 handles[HCI_MAX_ADV_MONITOR_NUM_HANDLES]; 4201 4202 BT_DBG("request for %s", hdev->name); 4203 4204 hci_dev_lock(hdev); 4205 4206 if (msft_monitor_supported(hdev)) 4207 supported |= MGMT_ADV_MONITOR_FEATURE_MASK_OR_PATTERNS; 4208 4209 idr_for_each_entry(&hdev->adv_monitors_idr, monitor, handle) 4210 handles[num_handles++] = monitor->handle; 4211 4212 hci_dev_unlock(hdev); 4213 4214 rp_size = sizeof(*rp) + (num_handles * sizeof(u16)); 4215 rp = kmalloc(rp_size, GFP_KERNEL); 4216 if (!rp) 4217 return -ENOMEM; 4218 4219 /* All supported features are currently enabled */ 4220 enabled = supported; 4221 4222 rp->supported_features = cpu_to_le32(supported); 4223 rp->enabled_features = cpu_to_le32(enabled); 4224 rp->max_num_handles = cpu_to_le16(HCI_MAX_ADV_MONITOR_NUM_HANDLES); 4225 rp->max_num_patterns = HCI_MAX_ADV_MONITOR_NUM_PATTERNS; 4226 rp->num_handles = cpu_to_le16(num_handles); 4227 if (num_handles) 4228 memcpy(&rp->handles, &handles, (num_handles * sizeof(u16))); 4229 4230 err = mgmt_cmd_complete(sk, hdev->id, 4231 MGMT_OP_READ_ADV_MONITOR_FEATURES, 4232 MGMT_STATUS_SUCCESS, rp, rp_size); 4233 4234 kfree(rp); 4235 4236 return err; 4237 } 4238 4239 int mgmt_add_adv_patterns_monitor_complete(struct hci_dev *hdev, u8 status) 4240 { 4241 struct mgmt_rp_add_adv_patterns_monitor rp; 4242 struct mgmt_pending_cmd *cmd; 4243 struct adv_monitor *monitor; 4244 int err = 0; 4245 4246 hci_dev_lock(hdev); 4247 4248 cmd = pending_find(MGMT_OP_ADD_ADV_PATTERNS_MONITOR_RSSI, hdev); 4249 if (!cmd) { 4250 cmd = pending_find(MGMT_OP_ADD_ADV_PATTERNS_MONITOR, hdev); 4251 if (!cmd) 4252 goto done; 4253 } 4254 4255 monitor = cmd->user_data; 4256 rp.monitor_handle = cpu_to_le16(monitor->handle); 4257 4258 if (!status) { 4259 mgmt_adv_monitor_added(cmd->sk, hdev, monitor->handle); 4260 hdev->adv_monitors_cnt++; 4261 if (monitor->state == ADV_MONITOR_STATE_NOT_REGISTERED) 4262 monitor->state = ADV_MONITOR_STATE_REGISTERED; 4263 hci_update_background_scan(hdev); 4264 } 4265 4266 err = mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, 4267 mgmt_status(status), &rp, sizeof(rp)); 4268 mgmt_pending_remove(cmd); 4269 4270 done: 4271 hci_dev_unlock(hdev); 4272 bt_dev_dbg(hdev, "add monitor %d complete, status %d", 4273 rp.monitor_handle, status); 4274 4275 return err; 4276 } 4277 4278 static int __add_adv_patterns_monitor(struct sock *sk, struct hci_dev *hdev, 4279 struct adv_monitor *m, u8 status, 4280 void *data, u16 len, u16 op) 4281 { 4282 struct mgmt_rp_add_adv_patterns_monitor rp; 4283 struct mgmt_pending_cmd *cmd; 4284 int err; 4285 bool pending; 4286 4287 hci_dev_lock(hdev); 4288 4289 if (status) 4290 goto unlock; 4291 4292 if (pending_find(MGMT_OP_SET_LE, hdev) || 4293 pending_find(MGMT_OP_ADD_ADV_PATTERNS_MONITOR, hdev) || 4294 pending_find(MGMT_OP_ADD_ADV_PATTERNS_MONITOR_RSSI, hdev) || 4295 pending_find(MGMT_OP_REMOVE_ADV_MONITOR, hdev)) { 4296 status = MGMT_STATUS_BUSY; 4297 goto unlock; 4298 } 4299 4300 cmd = mgmt_pending_add(sk, op, hdev, data, len); 4301 if (!cmd) { 4302 status = MGMT_STATUS_NO_RESOURCES; 4303 goto unlock; 4304 } 4305 4306 cmd->user_data = m; 4307 pending = hci_add_adv_monitor(hdev, m, &err); 4308 if (err) { 4309 if (err == -ENOSPC || err == -ENOMEM) 4310 status = MGMT_STATUS_NO_RESOURCES; 4311 else if (err == -EINVAL) 4312 status = MGMT_STATUS_INVALID_PARAMS; 4313 else 4314 status = MGMT_STATUS_FAILED; 4315 4316 mgmt_pending_remove(cmd); 4317 goto unlock; 4318 } 4319 4320 if (!pending) { 4321 mgmt_pending_remove(cmd); 4322 rp.monitor_handle = cpu_to_le16(m->handle); 4323 mgmt_adv_monitor_added(sk, hdev, m->handle); 4324 m->state = ADV_MONITOR_STATE_REGISTERED; 4325 hdev->adv_monitors_cnt++; 4326 4327 hci_dev_unlock(hdev); 4328 return mgmt_cmd_complete(sk, hdev->id, op, MGMT_STATUS_SUCCESS, 4329 &rp, sizeof(rp)); 4330 } 4331 4332 hci_dev_unlock(hdev); 4333 4334 return 0; 4335 4336 unlock: 4337 hci_free_adv_monitor(hdev, m); 4338 hci_dev_unlock(hdev); 4339 return mgmt_cmd_status(sk, hdev->id, op, status); 4340 } 4341 4342 static void parse_adv_monitor_rssi(struct adv_monitor *m, 4343 struct mgmt_adv_rssi_thresholds *rssi) 4344 { 4345 if (rssi) { 4346 m->rssi.low_threshold = rssi->low_threshold; 4347 m->rssi.low_threshold_timeout = 4348 __le16_to_cpu(rssi->low_threshold_timeout); 4349 m->rssi.high_threshold = rssi->high_threshold; 4350 m->rssi.high_threshold_timeout = 4351 __le16_to_cpu(rssi->high_threshold_timeout); 4352 m->rssi.sampling_period = rssi->sampling_period; 4353 } else { 4354 /* Default values. These numbers are the least constricting 4355 * parameters for MSFT API to work, so it behaves as if there 4356 * are no rssi parameter to consider. May need to be changed 4357 * if other API are to be supported. 4358 */ 4359 m->rssi.low_threshold = -127; 4360 m->rssi.low_threshold_timeout = 60; 4361 m->rssi.high_threshold = -127; 4362 m->rssi.high_threshold_timeout = 0; 4363 m->rssi.sampling_period = 0; 4364 } 4365 } 4366 4367 static u8 parse_adv_monitor_pattern(struct adv_monitor *m, u8 pattern_count, 4368 struct mgmt_adv_pattern *patterns) 4369 { 4370 u8 offset = 0, length = 0; 4371 struct adv_pattern *p = NULL; 4372 int i; 4373 4374 for (i = 0; i < pattern_count; i++) { 4375 offset = patterns[i].offset; 4376 length = patterns[i].length; 4377 if (offset >= HCI_MAX_AD_LENGTH || 4378 length > HCI_MAX_AD_LENGTH || 4379 (offset + length) > HCI_MAX_AD_LENGTH) 4380 return MGMT_STATUS_INVALID_PARAMS; 4381 4382 p = kmalloc(sizeof(*p), GFP_KERNEL); 4383 if (!p) 4384 return MGMT_STATUS_NO_RESOURCES; 4385 4386 p->ad_type = patterns[i].ad_type; 4387 p->offset = patterns[i].offset; 4388 p->length = patterns[i].length; 4389 memcpy(p->value, patterns[i].value, p->length); 4390 4391 INIT_LIST_HEAD(&p->list); 4392 list_add(&p->list, &m->patterns); 4393 } 4394 4395 return MGMT_STATUS_SUCCESS; 4396 } 4397 4398 static int add_adv_patterns_monitor(struct sock *sk, struct hci_dev *hdev, 4399 void *data, u16 len) 4400 { 4401 struct mgmt_cp_add_adv_patterns_monitor *cp = data; 4402 struct adv_monitor *m = NULL; 4403 u8 status = MGMT_STATUS_SUCCESS; 4404 size_t expected_size = sizeof(*cp); 4405 4406 BT_DBG("request for %s", hdev->name); 4407 4408 if (len <= sizeof(*cp)) { 4409 status = MGMT_STATUS_INVALID_PARAMS; 4410 goto done; 4411 } 4412 4413 expected_size += cp->pattern_count * sizeof(struct mgmt_adv_pattern); 4414 if (len != expected_size) { 4415 status = MGMT_STATUS_INVALID_PARAMS; 4416 goto done; 4417 } 4418 4419 m = kzalloc(sizeof(*m), GFP_KERNEL); 4420 if (!m) { 4421 status = MGMT_STATUS_NO_RESOURCES; 4422 goto done; 4423 } 4424 4425 INIT_LIST_HEAD(&m->patterns); 4426 4427 parse_adv_monitor_rssi(m, NULL); 4428 status = parse_adv_monitor_pattern(m, cp->pattern_count, cp->patterns); 4429 4430 done: 4431 return __add_adv_patterns_monitor(sk, hdev, m, status, data, len, 4432 MGMT_OP_ADD_ADV_PATTERNS_MONITOR); 4433 } 4434 4435 static int add_adv_patterns_monitor_rssi(struct sock *sk, struct hci_dev *hdev, 4436 void *data, u16 len) 4437 { 4438 struct mgmt_cp_add_adv_patterns_monitor_rssi *cp = data; 4439 struct adv_monitor *m = NULL; 4440 u8 status = MGMT_STATUS_SUCCESS; 4441 size_t expected_size = sizeof(*cp); 4442 4443 BT_DBG("request for %s", hdev->name); 4444 4445 if (len <= sizeof(*cp)) { 4446 status = MGMT_STATUS_INVALID_PARAMS; 4447 goto done; 4448 } 4449 4450 expected_size += cp->pattern_count * sizeof(struct mgmt_adv_pattern); 4451 if (len != expected_size) { 4452 status = MGMT_STATUS_INVALID_PARAMS; 4453 goto done; 4454 } 4455 4456 m = kzalloc(sizeof(*m), GFP_KERNEL); 4457 if (!m) { 4458 status = MGMT_STATUS_NO_RESOURCES; 4459 goto done; 4460 } 4461 4462 INIT_LIST_HEAD(&m->patterns); 4463 4464 parse_adv_monitor_rssi(m, &cp->rssi); 4465 status = parse_adv_monitor_pattern(m, cp->pattern_count, cp->patterns); 4466 4467 done: 4468 return __add_adv_patterns_monitor(sk, hdev, m, status, data, len, 4469 MGMT_OP_ADD_ADV_PATTERNS_MONITOR_RSSI); 4470 } 4471 4472 int mgmt_remove_adv_monitor_complete(struct hci_dev *hdev, u8 status) 4473 { 4474 struct mgmt_rp_remove_adv_monitor rp; 4475 struct mgmt_cp_remove_adv_monitor *cp; 4476 struct mgmt_pending_cmd *cmd; 4477 int err = 0; 4478 4479 hci_dev_lock(hdev); 4480 4481 cmd = pending_find(MGMT_OP_REMOVE_ADV_MONITOR, hdev); 4482 if (!cmd) 4483 goto done; 4484 4485 cp = cmd->param; 4486 rp.monitor_handle = cp->monitor_handle; 4487 4488 if (!status) 4489 hci_update_background_scan(hdev); 4490 4491 err = mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, 4492 mgmt_status(status), &rp, sizeof(rp)); 4493 mgmt_pending_remove(cmd); 4494 4495 done: 4496 hci_dev_unlock(hdev); 4497 bt_dev_dbg(hdev, "remove monitor %d complete, status %d", 4498 rp.monitor_handle, status); 4499 4500 return err; 4501 } 4502 4503 static int remove_adv_monitor(struct sock *sk, struct hci_dev *hdev, 4504 void *data, u16 len) 4505 { 4506 struct mgmt_cp_remove_adv_monitor *cp = data; 4507 struct mgmt_rp_remove_adv_monitor rp; 4508 struct mgmt_pending_cmd *cmd; 4509 u16 handle = __le16_to_cpu(cp->monitor_handle); 4510 int err, status; 4511 bool pending; 4512 4513 BT_DBG("request for %s", hdev->name); 4514 rp.monitor_handle = cp->monitor_handle; 4515 4516 hci_dev_lock(hdev); 4517 4518 if (pending_find(MGMT_OP_SET_LE, hdev) || 4519 pending_find(MGMT_OP_REMOVE_ADV_MONITOR, hdev) || 4520 pending_find(MGMT_OP_ADD_ADV_PATTERNS_MONITOR, hdev) || 4521 pending_find(MGMT_OP_ADD_ADV_PATTERNS_MONITOR_RSSI, hdev)) { 4522 status = MGMT_STATUS_BUSY; 4523 goto unlock; 4524 } 4525 4526 cmd = mgmt_pending_add(sk, MGMT_OP_REMOVE_ADV_MONITOR, hdev, data, len); 4527 if (!cmd) { 4528 status = MGMT_STATUS_NO_RESOURCES; 4529 goto unlock; 4530 } 4531 4532 if (handle) 4533 pending = hci_remove_single_adv_monitor(hdev, handle, &err); 4534 else 4535 pending = hci_remove_all_adv_monitor(hdev, &err); 4536 4537 if (err) { 4538 mgmt_pending_remove(cmd); 4539 4540 if (err == -ENOENT) 4541 status = MGMT_STATUS_INVALID_INDEX; 4542 else 4543 status = MGMT_STATUS_FAILED; 4544 4545 goto unlock; 4546 } 4547 4548 /* monitor can be removed without forwarding request to controller */ 4549 if (!pending) { 4550 mgmt_pending_remove(cmd); 4551 hci_dev_unlock(hdev); 4552 4553 return mgmt_cmd_complete(sk, hdev->id, 4554 MGMT_OP_REMOVE_ADV_MONITOR, 4555 MGMT_STATUS_SUCCESS, 4556 &rp, sizeof(rp)); 4557 } 4558 4559 hci_dev_unlock(hdev); 4560 return 0; 4561 4562 unlock: 4563 hci_dev_unlock(hdev); 4564 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_ADV_MONITOR, 4565 status); 4566 } 4567 4568 static void read_local_oob_data_complete(struct hci_dev *hdev, u8 status, 4569 u16 opcode, struct sk_buff *skb) 4570 { 4571 struct mgmt_rp_read_local_oob_data mgmt_rp; 4572 size_t rp_size = sizeof(mgmt_rp); 4573 struct mgmt_pending_cmd *cmd; 4574 4575 bt_dev_dbg(hdev, "status %u", status); 4576 4577 cmd = pending_find(MGMT_OP_READ_LOCAL_OOB_DATA, hdev); 4578 if (!cmd) 4579 return; 4580 4581 if (status || !skb) { 4582 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA, 4583 status ? mgmt_status(status) : MGMT_STATUS_FAILED); 4584 goto remove; 4585 } 4586 4587 memset(&mgmt_rp, 0, sizeof(mgmt_rp)); 4588 4589 if (opcode == HCI_OP_READ_LOCAL_OOB_DATA) { 4590 struct hci_rp_read_local_oob_data *rp = (void *) skb->data; 4591 4592 if (skb->len < sizeof(*rp)) { 4593 mgmt_cmd_status(cmd->sk, hdev->id, 4594 MGMT_OP_READ_LOCAL_OOB_DATA, 4595 MGMT_STATUS_FAILED); 4596 goto remove; 4597 } 4598 4599 memcpy(mgmt_rp.hash192, rp->hash, sizeof(rp->hash)); 4600 memcpy(mgmt_rp.rand192, rp->rand, sizeof(rp->rand)); 4601 4602 rp_size -= sizeof(mgmt_rp.hash256) + sizeof(mgmt_rp.rand256); 4603 } else { 4604 struct hci_rp_read_local_oob_ext_data *rp = (void *) skb->data; 4605 4606 if (skb->len < sizeof(*rp)) { 4607 mgmt_cmd_status(cmd->sk, hdev->id, 4608 MGMT_OP_READ_LOCAL_OOB_DATA, 4609 MGMT_STATUS_FAILED); 4610 goto remove; 4611 } 4612 4613 memcpy(mgmt_rp.hash192, rp->hash192, sizeof(rp->hash192)); 4614 memcpy(mgmt_rp.rand192, rp->rand192, sizeof(rp->rand192)); 4615 4616 memcpy(mgmt_rp.hash256, rp->hash256, sizeof(rp->hash256)); 4617 memcpy(mgmt_rp.rand256, rp->rand256, sizeof(rp->rand256)); 4618 } 4619 4620 mgmt_cmd_complete(cmd->sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA, 4621 MGMT_STATUS_SUCCESS, &mgmt_rp, rp_size); 4622 4623 remove: 4624 mgmt_pending_remove(cmd); 4625 } 4626 4627 static int read_local_oob_data(struct sock *sk, struct hci_dev *hdev, 4628 void *data, u16 data_len) 4629 { 4630 struct mgmt_pending_cmd *cmd; 4631 struct hci_request req; 4632 int err; 4633 4634 bt_dev_dbg(hdev, "sock %p", sk); 4635 4636 hci_dev_lock(hdev); 4637 4638 if (!hdev_is_powered(hdev)) { 4639 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA, 4640 MGMT_STATUS_NOT_POWERED); 4641 goto unlock; 4642 } 4643 4644 if (!lmp_ssp_capable(hdev)) { 4645 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA, 4646 MGMT_STATUS_NOT_SUPPORTED); 4647 goto unlock; 4648 } 4649 4650 if (pending_find(MGMT_OP_READ_LOCAL_OOB_DATA, hdev)) { 4651 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA, 4652 MGMT_STATUS_BUSY); 4653 goto unlock; 4654 } 4655 4656 cmd = mgmt_pending_add(sk, MGMT_OP_READ_LOCAL_OOB_DATA, hdev, NULL, 0); 4657 if (!cmd) { 4658 err = -ENOMEM; 4659 goto unlock; 4660 } 4661 4662 hci_req_init(&req, hdev); 4663 4664 if (bredr_sc_enabled(hdev)) 4665 hci_req_add(&req, HCI_OP_READ_LOCAL_OOB_EXT_DATA, 0, NULL); 4666 else 4667 hci_req_add(&req, HCI_OP_READ_LOCAL_OOB_DATA, 0, NULL); 4668 4669 err = hci_req_run_skb(&req, read_local_oob_data_complete); 4670 if (err < 0) 4671 mgmt_pending_remove(cmd); 4672 4673 unlock: 4674 hci_dev_unlock(hdev); 4675 return err; 4676 } 4677 4678 static int add_remote_oob_data(struct sock *sk, struct hci_dev *hdev, 4679 void *data, u16 len) 4680 { 4681 struct mgmt_addr_info *addr = data; 4682 int err; 4683 4684 bt_dev_dbg(hdev, "sock %p", sk); 4685 4686 if (!bdaddr_type_is_valid(addr->type)) 4687 return mgmt_cmd_complete(sk, hdev->id, 4688 MGMT_OP_ADD_REMOTE_OOB_DATA, 4689 MGMT_STATUS_INVALID_PARAMS, 4690 addr, sizeof(*addr)); 4691 4692 hci_dev_lock(hdev); 4693 4694 if (len == MGMT_ADD_REMOTE_OOB_DATA_SIZE) { 4695 struct mgmt_cp_add_remote_oob_data *cp = data; 4696 u8 status; 4697 4698 if (cp->addr.type != BDADDR_BREDR) { 4699 err = mgmt_cmd_complete(sk, hdev->id, 4700 MGMT_OP_ADD_REMOTE_OOB_DATA, 4701 MGMT_STATUS_INVALID_PARAMS, 4702 &cp->addr, sizeof(cp->addr)); 4703 goto unlock; 4704 } 4705 4706 err = hci_add_remote_oob_data(hdev, &cp->addr.bdaddr, 4707 cp->addr.type, cp->hash, 4708 cp->rand, NULL, NULL); 4709 if (err < 0) 4710 status = MGMT_STATUS_FAILED; 4711 else 4712 status = MGMT_STATUS_SUCCESS; 4713 4714 err = mgmt_cmd_complete(sk, hdev->id, 4715 MGMT_OP_ADD_REMOTE_OOB_DATA, status, 4716 &cp->addr, sizeof(cp->addr)); 4717 } else if (len == MGMT_ADD_REMOTE_OOB_EXT_DATA_SIZE) { 4718 struct mgmt_cp_add_remote_oob_ext_data *cp = data; 4719 u8 *rand192, *hash192, *rand256, *hash256; 4720 u8 status; 4721 4722 if (bdaddr_type_is_le(cp->addr.type)) { 4723 /* Enforce zero-valued 192-bit parameters as 4724 * long as legacy SMP OOB isn't implemented. 4725 */ 4726 if (memcmp(cp->rand192, ZERO_KEY, 16) || 4727 memcmp(cp->hash192, ZERO_KEY, 16)) { 4728 err = mgmt_cmd_complete(sk, hdev->id, 4729 MGMT_OP_ADD_REMOTE_OOB_DATA, 4730 MGMT_STATUS_INVALID_PARAMS, 4731 addr, sizeof(*addr)); 4732 goto unlock; 4733 } 4734 4735 rand192 = NULL; 4736 hash192 = NULL; 4737 } else { 4738 /* In case one of the P-192 values is set to zero, 4739 * then just disable OOB data for P-192. 4740 */ 4741 if (!memcmp(cp->rand192, ZERO_KEY, 16) || 4742 !memcmp(cp->hash192, ZERO_KEY, 16)) { 4743 rand192 = NULL; 4744 hash192 = NULL; 4745 } else { 4746 rand192 = cp->rand192; 4747 hash192 = cp->hash192; 4748 } 4749 } 4750 4751 /* In case one of the P-256 values is set to zero, then just 4752 * disable OOB data for P-256. 4753 */ 4754 if (!memcmp(cp->rand256, ZERO_KEY, 16) || 4755 !memcmp(cp->hash256, ZERO_KEY, 16)) { 4756 rand256 = NULL; 4757 hash256 = NULL; 4758 } else { 4759 rand256 = cp->rand256; 4760 hash256 = cp->hash256; 4761 } 4762 4763 err = hci_add_remote_oob_data(hdev, &cp->addr.bdaddr, 4764 cp->addr.type, hash192, rand192, 4765 hash256, rand256); 4766 if (err < 0) 4767 status = MGMT_STATUS_FAILED; 4768 else 4769 status = MGMT_STATUS_SUCCESS; 4770 4771 err = mgmt_cmd_complete(sk, hdev->id, 4772 MGMT_OP_ADD_REMOTE_OOB_DATA, 4773 status, &cp->addr, sizeof(cp->addr)); 4774 } else { 4775 bt_dev_err(hdev, "add_remote_oob_data: invalid len of %u bytes", 4776 len); 4777 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_REMOTE_OOB_DATA, 4778 MGMT_STATUS_INVALID_PARAMS); 4779 } 4780 4781 unlock: 4782 hci_dev_unlock(hdev); 4783 return err; 4784 } 4785 4786 static int remove_remote_oob_data(struct sock *sk, struct hci_dev *hdev, 4787 void *data, u16 len) 4788 { 4789 struct mgmt_cp_remove_remote_oob_data *cp = data; 4790 u8 status; 4791 int err; 4792 4793 bt_dev_dbg(hdev, "sock %p", sk); 4794 4795 if (cp->addr.type != BDADDR_BREDR) 4796 return mgmt_cmd_complete(sk, hdev->id, 4797 MGMT_OP_REMOVE_REMOTE_OOB_DATA, 4798 MGMT_STATUS_INVALID_PARAMS, 4799 &cp->addr, sizeof(cp->addr)); 4800 4801 hci_dev_lock(hdev); 4802 4803 if (!bacmp(&cp->addr.bdaddr, BDADDR_ANY)) { 4804 hci_remote_oob_data_clear(hdev); 4805 status = MGMT_STATUS_SUCCESS; 4806 goto done; 4807 } 4808 4809 err = hci_remove_remote_oob_data(hdev, &cp->addr.bdaddr, cp->addr.type); 4810 if (err < 0) 4811 status = MGMT_STATUS_INVALID_PARAMS; 4812 else 4813 status = MGMT_STATUS_SUCCESS; 4814 4815 done: 4816 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_REMOTE_OOB_DATA, 4817 status, &cp->addr, sizeof(cp->addr)); 4818 4819 hci_dev_unlock(hdev); 4820 return err; 4821 } 4822 4823 void mgmt_start_discovery_complete(struct hci_dev *hdev, u8 status) 4824 { 4825 struct mgmt_pending_cmd *cmd; 4826 4827 bt_dev_dbg(hdev, "status %d", status); 4828 4829 hci_dev_lock(hdev); 4830 4831 cmd = pending_find(MGMT_OP_START_DISCOVERY, hdev); 4832 if (!cmd) 4833 cmd = pending_find(MGMT_OP_START_SERVICE_DISCOVERY, hdev); 4834 4835 if (!cmd) 4836 cmd = pending_find(MGMT_OP_START_LIMITED_DISCOVERY, hdev); 4837 4838 if (cmd) { 4839 cmd->cmd_complete(cmd, mgmt_status(status)); 4840 mgmt_pending_remove(cmd); 4841 } 4842 4843 hci_dev_unlock(hdev); 4844 4845 /* Handle suspend notifier */ 4846 if (test_and_clear_bit(SUSPEND_UNPAUSE_DISCOVERY, 4847 hdev->suspend_tasks)) { 4848 bt_dev_dbg(hdev, "Unpaused discovery"); 4849 wake_up(&hdev->suspend_wait_q); 4850 } 4851 } 4852 4853 static bool discovery_type_is_valid(struct hci_dev *hdev, uint8_t type, 4854 uint8_t *mgmt_status) 4855 { 4856 switch (type) { 4857 case DISCOV_TYPE_LE: 4858 *mgmt_status = mgmt_le_support(hdev); 4859 if (*mgmt_status) 4860 return false; 4861 break; 4862 case DISCOV_TYPE_INTERLEAVED: 4863 *mgmt_status = mgmt_le_support(hdev); 4864 if (*mgmt_status) 4865 return false; 4866 fallthrough; 4867 case DISCOV_TYPE_BREDR: 4868 *mgmt_status = mgmt_bredr_support(hdev); 4869 if (*mgmt_status) 4870 return false; 4871 break; 4872 default: 4873 *mgmt_status = MGMT_STATUS_INVALID_PARAMS; 4874 return false; 4875 } 4876 4877 return true; 4878 } 4879 4880 static int start_discovery_internal(struct sock *sk, struct hci_dev *hdev, 4881 u16 op, void *data, u16 len) 4882 { 4883 struct mgmt_cp_start_discovery *cp = data; 4884 struct mgmt_pending_cmd *cmd; 4885 u8 status; 4886 int err; 4887 4888 bt_dev_dbg(hdev, "sock %p", sk); 4889 4890 hci_dev_lock(hdev); 4891 4892 if (!hdev_is_powered(hdev)) { 4893 err = mgmt_cmd_complete(sk, hdev->id, op, 4894 MGMT_STATUS_NOT_POWERED, 4895 &cp->type, sizeof(cp->type)); 4896 goto failed; 4897 } 4898 4899 if (hdev->discovery.state != DISCOVERY_STOPPED || 4900 hci_dev_test_flag(hdev, HCI_PERIODIC_INQ)) { 4901 err = mgmt_cmd_complete(sk, hdev->id, op, MGMT_STATUS_BUSY, 4902 &cp->type, sizeof(cp->type)); 4903 goto failed; 4904 } 4905 4906 if (!discovery_type_is_valid(hdev, cp->type, &status)) { 4907 err = mgmt_cmd_complete(sk, hdev->id, op, status, 4908 &cp->type, sizeof(cp->type)); 4909 goto failed; 4910 } 4911 4912 /* Can't start discovery when it is paused */ 4913 if (hdev->discovery_paused) { 4914 err = mgmt_cmd_complete(sk, hdev->id, op, MGMT_STATUS_BUSY, 4915 &cp->type, sizeof(cp->type)); 4916 goto failed; 4917 } 4918 4919 /* Clear the discovery filter first to free any previously 4920 * allocated memory for the UUID list. 4921 */ 4922 hci_discovery_filter_clear(hdev); 4923 4924 hdev->discovery.type = cp->type; 4925 hdev->discovery.report_invalid_rssi = false; 4926 if (op == MGMT_OP_START_LIMITED_DISCOVERY) 4927 hdev->discovery.limited = true; 4928 else 4929 hdev->discovery.limited = false; 4930 4931 cmd = mgmt_pending_add(sk, op, hdev, data, len); 4932 if (!cmd) { 4933 err = -ENOMEM; 4934 goto failed; 4935 } 4936 4937 cmd->cmd_complete = generic_cmd_complete; 4938 4939 hci_discovery_set_state(hdev, DISCOVERY_STARTING); 4940 queue_work(hdev->req_workqueue, &hdev->discov_update); 4941 err = 0; 4942 4943 failed: 4944 hci_dev_unlock(hdev); 4945 return err; 4946 } 4947 4948 static int start_discovery(struct sock *sk, struct hci_dev *hdev, 4949 void *data, u16 len) 4950 { 4951 return start_discovery_internal(sk, hdev, MGMT_OP_START_DISCOVERY, 4952 data, len); 4953 } 4954 4955 static int start_limited_discovery(struct sock *sk, struct hci_dev *hdev, 4956 void *data, u16 len) 4957 { 4958 return start_discovery_internal(sk, hdev, 4959 MGMT_OP_START_LIMITED_DISCOVERY, 4960 data, len); 4961 } 4962 4963 static int service_discovery_cmd_complete(struct mgmt_pending_cmd *cmd, 4964 u8 status) 4965 { 4966 return mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, status, 4967 cmd->param, 1); 4968 } 4969 4970 static int start_service_discovery(struct sock *sk, struct hci_dev *hdev, 4971 void *data, u16 len) 4972 { 4973 struct mgmt_cp_start_service_discovery *cp = data; 4974 struct mgmt_pending_cmd *cmd; 4975 const u16 max_uuid_count = ((U16_MAX - sizeof(*cp)) / 16); 4976 u16 uuid_count, expected_len; 4977 u8 status; 4978 int err; 4979 4980 bt_dev_dbg(hdev, "sock %p", sk); 4981 4982 hci_dev_lock(hdev); 4983 4984 if (!hdev_is_powered(hdev)) { 4985 err = mgmt_cmd_complete(sk, hdev->id, 4986 MGMT_OP_START_SERVICE_DISCOVERY, 4987 MGMT_STATUS_NOT_POWERED, 4988 &cp->type, sizeof(cp->type)); 4989 goto failed; 4990 } 4991 4992 if (hdev->discovery.state != DISCOVERY_STOPPED || 4993 hci_dev_test_flag(hdev, HCI_PERIODIC_INQ)) { 4994 err = mgmt_cmd_complete(sk, hdev->id, 4995 MGMT_OP_START_SERVICE_DISCOVERY, 4996 MGMT_STATUS_BUSY, &cp->type, 4997 sizeof(cp->type)); 4998 goto failed; 4999 } 5000 5001 if (hdev->discovery_paused) { 5002 err = mgmt_cmd_complete(sk, hdev->id, 5003 MGMT_OP_START_SERVICE_DISCOVERY, 5004 MGMT_STATUS_BUSY, &cp->type, 5005 sizeof(cp->type)); 5006 goto failed; 5007 } 5008 5009 uuid_count = __le16_to_cpu(cp->uuid_count); 5010 if (uuid_count > max_uuid_count) { 5011 bt_dev_err(hdev, "service_discovery: too big uuid_count value %u", 5012 uuid_count); 5013 err = mgmt_cmd_complete(sk, hdev->id, 5014 MGMT_OP_START_SERVICE_DISCOVERY, 5015 MGMT_STATUS_INVALID_PARAMS, &cp->type, 5016 sizeof(cp->type)); 5017 goto failed; 5018 } 5019 5020 expected_len = sizeof(*cp) + uuid_count * 16; 5021 if (expected_len != len) { 5022 bt_dev_err(hdev, "service_discovery: expected %u bytes, got %u bytes", 5023 expected_len, len); 5024 err = mgmt_cmd_complete(sk, hdev->id, 5025 MGMT_OP_START_SERVICE_DISCOVERY, 5026 MGMT_STATUS_INVALID_PARAMS, &cp->type, 5027 sizeof(cp->type)); 5028 goto failed; 5029 } 5030 5031 if (!discovery_type_is_valid(hdev, cp->type, &status)) { 5032 err = mgmt_cmd_complete(sk, hdev->id, 5033 MGMT_OP_START_SERVICE_DISCOVERY, 5034 status, &cp->type, sizeof(cp->type)); 5035 goto failed; 5036 } 5037 5038 cmd = mgmt_pending_add(sk, MGMT_OP_START_SERVICE_DISCOVERY, 5039 hdev, data, len); 5040 if (!cmd) { 5041 err = -ENOMEM; 5042 goto failed; 5043 } 5044 5045 cmd->cmd_complete = service_discovery_cmd_complete; 5046 5047 /* Clear the discovery filter first to free any previously 5048 * allocated memory for the UUID list. 5049 */ 5050 hci_discovery_filter_clear(hdev); 5051 5052 hdev->discovery.result_filtering = true; 5053 hdev->discovery.type = cp->type; 5054 hdev->discovery.rssi = cp->rssi; 5055 hdev->discovery.uuid_count = uuid_count; 5056 5057 if (uuid_count > 0) { 5058 hdev->discovery.uuids = kmemdup(cp->uuids, uuid_count * 16, 5059 GFP_KERNEL); 5060 if (!hdev->discovery.uuids) { 5061 err = mgmt_cmd_complete(sk, hdev->id, 5062 MGMT_OP_START_SERVICE_DISCOVERY, 5063 MGMT_STATUS_FAILED, 5064 &cp->type, sizeof(cp->type)); 5065 mgmt_pending_remove(cmd); 5066 goto failed; 5067 } 5068 } 5069 5070 hci_discovery_set_state(hdev, DISCOVERY_STARTING); 5071 queue_work(hdev->req_workqueue, &hdev->discov_update); 5072 err = 0; 5073 5074 failed: 5075 hci_dev_unlock(hdev); 5076 return err; 5077 } 5078 5079 void mgmt_stop_discovery_complete(struct hci_dev *hdev, u8 status) 5080 { 5081 struct mgmt_pending_cmd *cmd; 5082 5083 bt_dev_dbg(hdev, "status %d", status); 5084 5085 hci_dev_lock(hdev); 5086 5087 cmd = pending_find(MGMT_OP_STOP_DISCOVERY, hdev); 5088 if (cmd) { 5089 cmd->cmd_complete(cmd, mgmt_status(status)); 5090 mgmt_pending_remove(cmd); 5091 } 5092 5093 hci_dev_unlock(hdev); 5094 5095 /* Handle suspend notifier */ 5096 if (test_and_clear_bit(SUSPEND_PAUSE_DISCOVERY, hdev->suspend_tasks)) { 5097 bt_dev_dbg(hdev, "Paused discovery"); 5098 wake_up(&hdev->suspend_wait_q); 5099 } 5100 } 5101 5102 static int stop_discovery(struct sock *sk, struct hci_dev *hdev, void *data, 5103 u16 len) 5104 { 5105 struct mgmt_cp_stop_discovery *mgmt_cp = data; 5106 struct mgmt_pending_cmd *cmd; 5107 int err; 5108 5109 bt_dev_dbg(hdev, "sock %p", sk); 5110 5111 hci_dev_lock(hdev); 5112 5113 if (!hci_discovery_active(hdev)) { 5114 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY, 5115 MGMT_STATUS_REJECTED, &mgmt_cp->type, 5116 sizeof(mgmt_cp->type)); 5117 goto unlock; 5118 } 5119 5120 if (hdev->discovery.type != mgmt_cp->type) { 5121 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY, 5122 MGMT_STATUS_INVALID_PARAMS, 5123 &mgmt_cp->type, sizeof(mgmt_cp->type)); 5124 goto unlock; 5125 } 5126 5127 cmd = mgmt_pending_add(sk, MGMT_OP_STOP_DISCOVERY, hdev, data, len); 5128 if (!cmd) { 5129 err = -ENOMEM; 5130 goto unlock; 5131 } 5132 5133 cmd->cmd_complete = generic_cmd_complete; 5134 5135 hci_discovery_set_state(hdev, DISCOVERY_STOPPING); 5136 queue_work(hdev->req_workqueue, &hdev->discov_update); 5137 err = 0; 5138 5139 unlock: 5140 hci_dev_unlock(hdev); 5141 return err; 5142 } 5143 5144 static int confirm_name(struct sock *sk, struct hci_dev *hdev, void *data, 5145 u16 len) 5146 { 5147 struct mgmt_cp_confirm_name *cp = data; 5148 struct inquiry_entry *e; 5149 int err; 5150 5151 bt_dev_dbg(hdev, "sock %p", sk); 5152 5153 hci_dev_lock(hdev); 5154 5155 if (!hci_discovery_active(hdev)) { 5156 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME, 5157 MGMT_STATUS_FAILED, &cp->addr, 5158 sizeof(cp->addr)); 5159 goto failed; 5160 } 5161 5162 e = hci_inquiry_cache_lookup_unknown(hdev, &cp->addr.bdaddr); 5163 if (!e) { 5164 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME, 5165 MGMT_STATUS_INVALID_PARAMS, &cp->addr, 5166 sizeof(cp->addr)); 5167 goto failed; 5168 } 5169 5170 if (cp->name_known) { 5171 e->name_state = NAME_KNOWN; 5172 list_del(&e->list); 5173 } else { 5174 e->name_state = NAME_NEEDED; 5175 hci_inquiry_cache_update_resolve(hdev, e); 5176 } 5177 5178 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME, 0, 5179 &cp->addr, sizeof(cp->addr)); 5180 5181 failed: 5182 hci_dev_unlock(hdev); 5183 return err; 5184 } 5185 5186 static int block_device(struct sock *sk, struct hci_dev *hdev, void *data, 5187 u16 len) 5188 { 5189 struct mgmt_cp_block_device *cp = data; 5190 u8 status; 5191 int err; 5192 5193 bt_dev_dbg(hdev, "sock %p", sk); 5194 5195 if (!bdaddr_type_is_valid(cp->addr.type)) 5196 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_BLOCK_DEVICE, 5197 MGMT_STATUS_INVALID_PARAMS, 5198 &cp->addr, sizeof(cp->addr)); 5199 5200 hci_dev_lock(hdev); 5201 5202 err = hci_bdaddr_list_add(&hdev->blacklist, &cp->addr.bdaddr, 5203 cp->addr.type); 5204 if (err < 0) { 5205 status = MGMT_STATUS_FAILED; 5206 goto done; 5207 } 5208 5209 mgmt_event(MGMT_EV_DEVICE_BLOCKED, hdev, &cp->addr, sizeof(cp->addr), 5210 sk); 5211 status = MGMT_STATUS_SUCCESS; 5212 5213 done: 5214 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_BLOCK_DEVICE, status, 5215 &cp->addr, sizeof(cp->addr)); 5216 5217 hci_dev_unlock(hdev); 5218 5219 return err; 5220 } 5221 5222 static int unblock_device(struct sock *sk, struct hci_dev *hdev, void *data, 5223 u16 len) 5224 { 5225 struct mgmt_cp_unblock_device *cp = data; 5226 u8 status; 5227 int err; 5228 5229 bt_dev_dbg(hdev, "sock %p", sk); 5230 5231 if (!bdaddr_type_is_valid(cp->addr.type)) 5232 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNBLOCK_DEVICE, 5233 MGMT_STATUS_INVALID_PARAMS, 5234 &cp->addr, sizeof(cp->addr)); 5235 5236 hci_dev_lock(hdev); 5237 5238 err = hci_bdaddr_list_del(&hdev->blacklist, &cp->addr.bdaddr, 5239 cp->addr.type); 5240 if (err < 0) { 5241 status = MGMT_STATUS_INVALID_PARAMS; 5242 goto done; 5243 } 5244 5245 mgmt_event(MGMT_EV_DEVICE_UNBLOCKED, hdev, &cp->addr, sizeof(cp->addr), 5246 sk); 5247 status = MGMT_STATUS_SUCCESS; 5248 5249 done: 5250 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNBLOCK_DEVICE, status, 5251 &cp->addr, sizeof(cp->addr)); 5252 5253 hci_dev_unlock(hdev); 5254 5255 return err; 5256 } 5257 5258 static int set_device_id(struct sock *sk, struct hci_dev *hdev, void *data, 5259 u16 len) 5260 { 5261 struct mgmt_cp_set_device_id *cp = data; 5262 struct hci_request req; 5263 int err; 5264 __u16 source; 5265 5266 bt_dev_dbg(hdev, "sock %p", sk); 5267 5268 source = __le16_to_cpu(cp->source); 5269 5270 if (source > 0x0002) 5271 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEVICE_ID, 5272 MGMT_STATUS_INVALID_PARAMS); 5273 5274 hci_dev_lock(hdev); 5275 5276 hdev->devid_source = source; 5277 hdev->devid_vendor = __le16_to_cpu(cp->vendor); 5278 hdev->devid_product = __le16_to_cpu(cp->product); 5279 hdev->devid_version = __le16_to_cpu(cp->version); 5280 5281 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_DEVICE_ID, 0, 5282 NULL, 0); 5283 5284 hci_req_init(&req, hdev); 5285 __hci_req_update_eir(&req); 5286 hci_req_run(&req, NULL); 5287 5288 hci_dev_unlock(hdev); 5289 5290 return err; 5291 } 5292 5293 static void enable_advertising_instance(struct hci_dev *hdev, u8 status, 5294 u16 opcode) 5295 { 5296 bt_dev_dbg(hdev, "status %d", status); 5297 } 5298 5299 static void set_advertising_complete(struct hci_dev *hdev, u8 status, 5300 u16 opcode) 5301 { 5302 struct cmd_lookup match = { NULL, hdev }; 5303 struct hci_request req; 5304 u8 instance; 5305 struct adv_info *adv_instance; 5306 int err; 5307 5308 hci_dev_lock(hdev); 5309 5310 if (status) { 5311 u8 mgmt_err = mgmt_status(status); 5312 5313 mgmt_pending_foreach(MGMT_OP_SET_ADVERTISING, hdev, 5314 cmd_status_rsp, &mgmt_err); 5315 goto unlock; 5316 } 5317 5318 if (hci_dev_test_flag(hdev, HCI_LE_ADV)) 5319 hci_dev_set_flag(hdev, HCI_ADVERTISING); 5320 else 5321 hci_dev_clear_flag(hdev, HCI_ADVERTISING); 5322 5323 mgmt_pending_foreach(MGMT_OP_SET_ADVERTISING, hdev, settings_rsp, 5324 &match); 5325 5326 new_settings(hdev, match.sk); 5327 5328 if (match.sk) 5329 sock_put(match.sk); 5330 5331 /* Handle suspend notifier */ 5332 if (test_and_clear_bit(SUSPEND_PAUSE_ADVERTISING, 5333 hdev->suspend_tasks)) { 5334 bt_dev_dbg(hdev, "Paused advertising"); 5335 wake_up(&hdev->suspend_wait_q); 5336 } else if (test_and_clear_bit(SUSPEND_UNPAUSE_ADVERTISING, 5337 hdev->suspend_tasks)) { 5338 bt_dev_dbg(hdev, "Unpaused advertising"); 5339 wake_up(&hdev->suspend_wait_q); 5340 } 5341 5342 /* If "Set Advertising" was just disabled and instance advertising was 5343 * set up earlier, then re-enable multi-instance advertising. 5344 */ 5345 if (hci_dev_test_flag(hdev, HCI_ADVERTISING) || 5346 list_empty(&hdev->adv_instances)) 5347 goto unlock; 5348 5349 instance = hdev->cur_adv_instance; 5350 if (!instance) { 5351 adv_instance = list_first_entry_or_null(&hdev->adv_instances, 5352 struct adv_info, list); 5353 if (!adv_instance) 5354 goto unlock; 5355 5356 instance = adv_instance->instance; 5357 } 5358 5359 hci_req_init(&req, hdev); 5360 5361 err = __hci_req_schedule_adv_instance(&req, instance, true); 5362 5363 if (!err) 5364 err = hci_req_run(&req, enable_advertising_instance); 5365 5366 if (err) 5367 bt_dev_err(hdev, "failed to re-configure advertising"); 5368 5369 unlock: 5370 hci_dev_unlock(hdev); 5371 } 5372 5373 static int set_advertising(struct sock *sk, struct hci_dev *hdev, void *data, 5374 u16 len) 5375 { 5376 struct mgmt_mode *cp = data; 5377 struct mgmt_pending_cmd *cmd; 5378 struct hci_request req; 5379 u8 val, status; 5380 int err; 5381 5382 bt_dev_dbg(hdev, "sock %p", sk); 5383 5384 status = mgmt_le_support(hdev); 5385 if (status) 5386 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING, 5387 status); 5388 5389 /* Enabling the experimental LL Privay support disables support for 5390 * advertising. 5391 */ 5392 if (hci_dev_test_flag(hdev, HCI_ENABLE_LL_PRIVACY)) 5393 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING, 5394 MGMT_STATUS_NOT_SUPPORTED); 5395 5396 if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02) 5397 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING, 5398 MGMT_STATUS_INVALID_PARAMS); 5399 5400 if (hdev->advertising_paused) 5401 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING, 5402 MGMT_STATUS_BUSY); 5403 5404 hci_dev_lock(hdev); 5405 5406 val = !!cp->val; 5407 5408 /* The following conditions are ones which mean that we should 5409 * not do any HCI communication but directly send a mgmt 5410 * response to user space (after toggling the flag if 5411 * necessary). 5412 */ 5413 if (!hdev_is_powered(hdev) || 5414 (val == hci_dev_test_flag(hdev, HCI_ADVERTISING) && 5415 (cp->val == 0x02) == hci_dev_test_flag(hdev, HCI_ADVERTISING_CONNECTABLE)) || 5416 hci_conn_num(hdev, LE_LINK) > 0 || 5417 (hci_dev_test_flag(hdev, HCI_LE_SCAN) && 5418 hdev->le_scan_type == LE_SCAN_ACTIVE)) { 5419 bool changed; 5420 5421 if (cp->val) { 5422 hdev->cur_adv_instance = 0x00; 5423 changed = !hci_dev_test_and_set_flag(hdev, HCI_ADVERTISING); 5424 if (cp->val == 0x02) 5425 hci_dev_set_flag(hdev, HCI_ADVERTISING_CONNECTABLE); 5426 else 5427 hci_dev_clear_flag(hdev, HCI_ADVERTISING_CONNECTABLE); 5428 } else { 5429 changed = hci_dev_test_and_clear_flag(hdev, HCI_ADVERTISING); 5430 hci_dev_clear_flag(hdev, HCI_ADVERTISING_CONNECTABLE); 5431 } 5432 5433 err = send_settings_rsp(sk, MGMT_OP_SET_ADVERTISING, hdev); 5434 if (err < 0) 5435 goto unlock; 5436 5437 if (changed) 5438 err = new_settings(hdev, sk); 5439 5440 goto unlock; 5441 } 5442 5443 if (pending_find(MGMT_OP_SET_ADVERTISING, hdev) || 5444 pending_find(MGMT_OP_SET_LE, hdev)) { 5445 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING, 5446 MGMT_STATUS_BUSY); 5447 goto unlock; 5448 } 5449 5450 cmd = mgmt_pending_add(sk, MGMT_OP_SET_ADVERTISING, hdev, data, len); 5451 if (!cmd) { 5452 err = -ENOMEM; 5453 goto unlock; 5454 } 5455 5456 hci_req_init(&req, hdev); 5457 5458 if (cp->val == 0x02) 5459 hci_dev_set_flag(hdev, HCI_ADVERTISING_CONNECTABLE); 5460 else 5461 hci_dev_clear_flag(hdev, HCI_ADVERTISING_CONNECTABLE); 5462 5463 cancel_adv_timeout(hdev); 5464 5465 if (val) { 5466 /* Switch to instance "0" for the Set Advertising setting. 5467 * We cannot use update_[adv|scan_rsp]_data() here as the 5468 * HCI_ADVERTISING flag is not yet set. 5469 */ 5470 hdev->cur_adv_instance = 0x00; 5471 5472 if (ext_adv_capable(hdev)) { 5473 __hci_req_start_ext_adv(&req, 0x00); 5474 } else { 5475 __hci_req_update_adv_data(&req, 0x00); 5476 __hci_req_update_scan_rsp_data(&req, 0x00); 5477 __hci_req_enable_advertising(&req); 5478 } 5479 } else { 5480 __hci_req_disable_advertising(&req); 5481 } 5482 5483 err = hci_req_run(&req, set_advertising_complete); 5484 if (err < 0) 5485 mgmt_pending_remove(cmd); 5486 5487 unlock: 5488 hci_dev_unlock(hdev); 5489 return err; 5490 } 5491 5492 static int set_static_address(struct sock *sk, struct hci_dev *hdev, 5493 void *data, u16 len) 5494 { 5495 struct mgmt_cp_set_static_address *cp = data; 5496 int err; 5497 5498 bt_dev_dbg(hdev, "sock %p", sk); 5499 5500 if (!lmp_le_capable(hdev)) 5501 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_STATIC_ADDRESS, 5502 MGMT_STATUS_NOT_SUPPORTED); 5503 5504 if (hdev_is_powered(hdev)) 5505 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_STATIC_ADDRESS, 5506 MGMT_STATUS_REJECTED); 5507 5508 if (bacmp(&cp->bdaddr, BDADDR_ANY)) { 5509 if (!bacmp(&cp->bdaddr, BDADDR_NONE)) 5510 return mgmt_cmd_status(sk, hdev->id, 5511 MGMT_OP_SET_STATIC_ADDRESS, 5512 MGMT_STATUS_INVALID_PARAMS); 5513 5514 /* Two most significant bits shall be set */ 5515 if ((cp->bdaddr.b[5] & 0xc0) != 0xc0) 5516 return mgmt_cmd_status(sk, hdev->id, 5517 MGMT_OP_SET_STATIC_ADDRESS, 5518 MGMT_STATUS_INVALID_PARAMS); 5519 } 5520 5521 hci_dev_lock(hdev); 5522 5523 bacpy(&hdev->static_addr, &cp->bdaddr); 5524 5525 err = send_settings_rsp(sk, MGMT_OP_SET_STATIC_ADDRESS, hdev); 5526 if (err < 0) 5527 goto unlock; 5528 5529 err = new_settings(hdev, sk); 5530 5531 unlock: 5532 hci_dev_unlock(hdev); 5533 return err; 5534 } 5535 5536 static int set_scan_params(struct sock *sk, struct hci_dev *hdev, 5537 void *data, u16 len) 5538 { 5539 struct mgmt_cp_set_scan_params *cp = data; 5540 __u16 interval, window; 5541 int err; 5542 5543 bt_dev_dbg(hdev, "sock %p", sk); 5544 5545 if (!lmp_le_capable(hdev)) 5546 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS, 5547 MGMT_STATUS_NOT_SUPPORTED); 5548 5549 interval = __le16_to_cpu(cp->interval); 5550 5551 if (interval < 0x0004 || interval > 0x4000) 5552 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS, 5553 MGMT_STATUS_INVALID_PARAMS); 5554 5555 window = __le16_to_cpu(cp->window); 5556 5557 if (window < 0x0004 || window > 0x4000) 5558 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS, 5559 MGMT_STATUS_INVALID_PARAMS); 5560 5561 if (window > interval) 5562 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS, 5563 MGMT_STATUS_INVALID_PARAMS); 5564 5565 hci_dev_lock(hdev); 5566 5567 hdev->le_scan_interval = interval; 5568 hdev->le_scan_window = window; 5569 5570 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS, 0, 5571 NULL, 0); 5572 5573 /* If background scan is running, restart it so new parameters are 5574 * loaded. 5575 */ 5576 if (hci_dev_test_flag(hdev, HCI_LE_SCAN) && 5577 hdev->discovery.state == DISCOVERY_STOPPED) { 5578 struct hci_request req; 5579 5580 hci_req_init(&req, hdev); 5581 5582 hci_req_add_le_scan_disable(&req, false); 5583 hci_req_add_le_passive_scan(&req); 5584 5585 hci_req_run(&req, NULL); 5586 } 5587 5588 hci_dev_unlock(hdev); 5589 5590 return err; 5591 } 5592 5593 static void fast_connectable_complete(struct hci_dev *hdev, u8 status, 5594 u16 opcode) 5595 { 5596 struct mgmt_pending_cmd *cmd; 5597 5598 bt_dev_dbg(hdev, "status 0x%02x", status); 5599 5600 hci_dev_lock(hdev); 5601 5602 cmd = pending_find(MGMT_OP_SET_FAST_CONNECTABLE, hdev); 5603 if (!cmd) 5604 goto unlock; 5605 5606 if (status) { 5607 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE, 5608 mgmt_status(status)); 5609 } else { 5610 struct mgmt_mode *cp = cmd->param; 5611 5612 if (cp->val) 5613 hci_dev_set_flag(hdev, HCI_FAST_CONNECTABLE); 5614 else 5615 hci_dev_clear_flag(hdev, HCI_FAST_CONNECTABLE); 5616 5617 send_settings_rsp(cmd->sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev); 5618 new_settings(hdev, cmd->sk); 5619 } 5620 5621 mgmt_pending_remove(cmd); 5622 5623 unlock: 5624 hci_dev_unlock(hdev); 5625 } 5626 5627 static int set_fast_connectable(struct sock *sk, struct hci_dev *hdev, 5628 void *data, u16 len) 5629 { 5630 struct mgmt_mode *cp = data; 5631 struct mgmt_pending_cmd *cmd; 5632 struct hci_request req; 5633 int err; 5634 5635 bt_dev_dbg(hdev, "sock %p", sk); 5636 5637 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) || 5638 hdev->hci_ver < BLUETOOTH_VER_1_2) 5639 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE, 5640 MGMT_STATUS_NOT_SUPPORTED); 5641 5642 if (cp->val != 0x00 && cp->val != 0x01) 5643 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE, 5644 MGMT_STATUS_INVALID_PARAMS); 5645 5646 hci_dev_lock(hdev); 5647 5648 if (pending_find(MGMT_OP_SET_FAST_CONNECTABLE, hdev)) { 5649 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE, 5650 MGMT_STATUS_BUSY); 5651 goto unlock; 5652 } 5653 5654 if (!!cp->val == hci_dev_test_flag(hdev, HCI_FAST_CONNECTABLE)) { 5655 err = send_settings_rsp(sk, MGMT_OP_SET_FAST_CONNECTABLE, 5656 hdev); 5657 goto unlock; 5658 } 5659 5660 if (!hdev_is_powered(hdev)) { 5661 hci_dev_change_flag(hdev, HCI_FAST_CONNECTABLE); 5662 err = send_settings_rsp(sk, MGMT_OP_SET_FAST_CONNECTABLE, 5663 hdev); 5664 new_settings(hdev, sk); 5665 goto unlock; 5666 } 5667 5668 cmd = mgmt_pending_add(sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev, 5669 data, len); 5670 if (!cmd) { 5671 err = -ENOMEM; 5672 goto unlock; 5673 } 5674 5675 hci_req_init(&req, hdev); 5676 5677 __hci_req_write_fast_connectable(&req, cp->val); 5678 5679 err = hci_req_run(&req, fast_connectable_complete); 5680 if (err < 0) { 5681 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE, 5682 MGMT_STATUS_FAILED); 5683 mgmt_pending_remove(cmd); 5684 } 5685 5686 unlock: 5687 hci_dev_unlock(hdev); 5688 5689 return err; 5690 } 5691 5692 static void set_bredr_complete(struct hci_dev *hdev, u8 status, u16 opcode) 5693 { 5694 struct mgmt_pending_cmd *cmd; 5695 5696 bt_dev_dbg(hdev, "status 0x%02x", status); 5697 5698 hci_dev_lock(hdev); 5699 5700 cmd = pending_find(MGMT_OP_SET_BREDR, hdev); 5701 if (!cmd) 5702 goto unlock; 5703 5704 if (status) { 5705 u8 mgmt_err = mgmt_status(status); 5706 5707 /* We need to restore the flag if related HCI commands 5708 * failed. 5709 */ 5710 hci_dev_clear_flag(hdev, HCI_BREDR_ENABLED); 5711 5712 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err); 5713 } else { 5714 send_settings_rsp(cmd->sk, MGMT_OP_SET_BREDR, hdev); 5715 new_settings(hdev, cmd->sk); 5716 } 5717 5718 mgmt_pending_remove(cmd); 5719 5720 unlock: 5721 hci_dev_unlock(hdev); 5722 } 5723 5724 static int set_bredr(struct sock *sk, struct hci_dev *hdev, void *data, u16 len) 5725 { 5726 struct mgmt_mode *cp = data; 5727 struct mgmt_pending_cmd *cmd; 5728 struct hci_request req; 5729 int err; 5730 5731 bt_dev_dbg(hdev, "sock %p", sk); 5732 5733 if (!lmp_bredr_capable(hdev) || !lmp_le_capable(hdev)) 5734 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR, 5735 MGMT_STATUS_NOT_SUPPORTED); 5736 5737 if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED)) 5738 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR, 5739 MGMT_STATUS_REJECTED); 5740 5741 if (cp->val != 0x00 && cp->val != 0x01) 5742 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR, 5743 MGMT_STATUS_INVALID_PARAMS); 5744 5745 hci_dev_lock(hdev); 5746 5747 if (cp->val == hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) { 5748 err = send_settings_rsp(sk, MGMT_OP_SET_BREDR, hdev); 5749 goto unlock; 5750 } 5751 5752 if (!hdev_is_powered(hdev)) { 5753 if (!cp->val) { 5754 hci_dev_clear_flag(hdev, HCI_DISCOVERABLE); 5755 hci_dev_clear_flag(hdev, HCI_SSP_ENABLED); 5756 hci_dev_clear_flag(hdev, HCI_LINK_SECURITY); 5757 hci_dev_clear_flag(hdev, HCI_FAST_CONNECTABLE); 5758 hci_dev_clear_flag(hdev, HCI_HS_ENABLED); 5759 } 5760 5761 hci_dev_change_flag(hdev, HCI_BREDR_ENABLED); 5762 5763 err = send_settings_rsp(sk, MGMT_OP_SET_BREDR, hdev); 5764 if (err < 0) 5765 goto unlock; 5766 5767 err = new_settings(hdev, sk); 5768 goto unlock; 5769 } 5770 5771 /* Reject disabling when powered on */ 5772 if (!cp->val) { 5773 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR, 5774 MGMT_STATUS_REJECTED); 5775 goto unlock; 5776 } else { 5777 /* When configuring a dual-mode controller to operate 5778 * with LE only and using a static address, then switching 5779 * BR/EDR back on is not allowed. 5780 * 5781 * Dual-mode controllers shall operate with the public 5782 * address as its identity address for BR/EDR and LE. So 5783 * reject the attempt to create an invalid configuration. 5784 * 5785 * The same restrictions applies when secure connections 5786 * has been enabled. For BR/EDR this is a controller feature 5787 * while for LE it is a host stack feature. This means that 5788 * switching BR/EDR back on when secure connections has been 5789 * enabled is not a supported transaction. 5790 */ 5791 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) && 5792 (bacmp(&hdev->static_addr, BDADDR_ANY) || 5793 hci_dev_test_flag(hdev, HCI_SC_ENABLED))) { 5794 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR, 5795 MGMT_STATUS_REJECTED); 5796 goto unlock; 5797 } 5798 } 5799 5800 if (pending_find(MGMT_OP_SET_BREDR, hdev)) { 5801 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR, 5802 MGMT_STATUS_BUSY); 5803 goto unlock; 5804 } 5805 5806 cmd = mgmt_pending_add(sk, MGMT_OP_SET_BREDR, hdev, data, len); 5807 if (!cmd) { 5808 err = -ENOMEM; 5809 goto unlock; 5810 } 5811 5812 /* We need to flip the bit already here so that 5813 * hci_req_update_adv_data generates the correct flags. 5814 */ 5815 hci_dev_set_flag(hdev, HCI_BREDR_ENABLED); 5816 5817 hci_req_init(&req, hdev); 5818 5819 __hci_req_write_fast_connectable(&req, false); 5820 __hci_req_update_scan(&req); 5821 5822 /* Since only the advertising data flags will change, there 5823 * is no need to update the scan response data. 5824 */ 5825 __hci_req_update_adv_data(&req, hdev->cur_adv_instance); 5826 5827 err = hci_req_run(&req, set_bredr_complete); 5828 if (err < 0) 5829 mgmt_pending_remove(cmd); 5830 5831 unlock: 5832 hci_dev_unlock(hdev); 5833 return err; 5834 } 5835 5836 static void sc_enable_complete(struct hci_dev *hdev, u8 status, u16 opcode) 5837 { 5838 struct mgmt_pending_cmd *cmd; 5839 struct mgmt_mode *cp; 5840 5841 bt_dev_dbg(hdev, "status %u", status); 5842 5843 hci_dev_lock(hdev); 5844 5845 cmd = pending_find(MGMT_OP_SET_SECURE_CONN, hdev); 5846 if (!cmd) 5847 goto unlock; 5848 5849 if (status) { 5850 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, 5851 mgmt_status(status)); 5852 goto remove; 5853 } 5854 5855 cp = cmd->param; 5856 5857 switch (cp->val) { 5858 case 0x00: 5859 hci_dev_clear_flag(hdev, HCI_SC_ENABLED); 5860 hci_dev_clear_flag(hdev, HCI_SC_ONLY); 5861 break; 5862 case 0x01: 5863 hci_dev_set_flag(hdev, HCI_SC_ENABLED); 5864 hci_dev_clear_flag(hdev, HCI_SC_ONLY); 5865 break; 5866 case 0x02: 5867 hci_dev_set_flag(hdev, HCI_SC_ENABLED); 5868 hci_dev_set_flag(hdev, HCI_SC_ONLY); 5869 break; 5870 } 5871 5872 send_settings_rsp(cmd->sk, MGMT_OP_SET_SECURE_CONN, hdev); 5873 new_settings(hdev, cmd->sk); 5874 5875 remove: 5876 mgmt_pending_remove(cmd); 5877 unlock: 5878 hci_dev_unlock(hdev); 5879 } 5880 5881 static int set_secure_conn(struct sock *sk, struct hci_dev *hdev, 5882 void *data, u16 len) 5883 { 5884 struct mgmt_mode *cp = data; 5885 struct mgmt_pending_cmd *cmd; 5886 struct hci_request req; 5887 u8 val; 5888 int err; 5889 5890 bt_dev_dbg(hdev, "sock %p", sk); 5891 5892 if (!lmp_sc_capable(hdev) && 5893 !hci_dev_test_flag(hdev, HCI_LE_ENABLED)) 5894 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN, 5895 MGMT_STATUS_NOT_SUPPORTED); 5896 5897 if (hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) && 5898 lmp_sc_capable(hdev) && 5899 !hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) 5900 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN, 5901 MGMT_STATUS_REJECTED); 5902 5903 if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02) 5904 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN, 5905 MGMT_STATUS_INVALID_PARAMS); 5906 5907 hci_dev_lock(hdev); 5908 5909 if (!hdev_is_powered(hdev) || !lmp_sc_capable(hdev) || 5910 !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) { 5911 bool changed; 5912 5913 if (cp->val) { 5914 changed = !hci_dev_test_and_set_flag(hdev, 5915 HCI_SC_ENABLED); 5916 if (cp->val == 0x02) 5917 hci_dev_set_flag(hdev, HCI_SC_ONLY); 5918 else 5919 hci_dev_clear_flag(hdev, HCI_SC_ONLY); 5920 } else { 5921 changed = hci_dev_test_and_clear_flag(hdev, 5922 HCI_SC_ENABLED); 5923 hci_dev_clear_flag(hdev, HCI_SC_ONLY); 5924 } 5925 5926 err = send_settings_rsp(sk, MGMT_OP_SET_SECURE_CONN, hdev); 5927 if (err < 0) 5928 goto failed; 5929 5930 if (changed) 5931 err = new_settings(hdev, sk); 5932 5933 goto failed; 5934 } 5935 5936 if (pending_find(MGMT_OP_SET_SECURE_CONN, hdev)) { 5937 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN, 5938 MGMT_STATUS_BUSY); 5939 goto failed; 5940 } 5941 5942 val = !!cp->val; 5943 5944 if (val == hci_dev_test_flag(hdev, HCI_SC_ENABLED) && 5945 (cp->val == 0x02) == hci_dev_test_flag(hdev, HCI_SC_ONLY)) { 5946 err = send_settings_rsp(sk, MGMT_OP_SET_SECURE_CONN, hdev); 5947 goto failed; 5948 } 5949 5950 cmd = mgmt_pending_add(sk, MGMT_OP_SET_SECURE_CONN, hdev, data, len); 5951 if (!cmd) { 5952 err = -ENOMEM; 5953 goto failed; 5954 } 5955 5956 hci_req_init(&req, hdev); 5957 hci_req_add(&req, HCI_OP_WRITE_SC_SUPPORT, 1, &val); 5958 err = hci_req_run(&req, sc_enable_complete); 5959 if (err < 0) { 5960 mgmt_pending_remove(cmd); 5961 goto failed; 5962 } 5963 5964 failed: 5965 hci_dev_unlock(hdev); 5966 return err; 5967 } 5968 5969 static int set_debug_keys(struct sock *sk, struct hci_dev *hdev, 5970 void *data, u16 len) 5971 { 5972 struct mgmt_mode *cp = data; 5973 bool changed, use_changed; 5974 int err; 5975 5976 bt_dev_dbg(hdev, "sock %p", sk); 5977 5978 if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02) 5979 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEBUG_KEYS, 5980 MGMT_STATUS_INVALID_PARAMS); 5981 5982 hci_dev_lock(hdev); 5983 5984 if (cp->val) 5985 changed = !hci_dev_test_and_set_flag(hdev, HCI_KEEP_DEBUG_KEYS); 5986 else 5987 changed = hci_dev_test_and_clear_flag(hdev, 5988 HCI_KEEP_DEBUG_KEYS); 5989 5990 if (cp->val == 0x02) 5991 use_changed = !hci_dev_test_and_set_flag(hdev, 5992 HCI_USE_DEBUG_KEYS); 5993 else 5994 use_changed = hci_dev_test_and_clear_flag(hdev, 5995 HCI_USE_DEBUG_KEYS); 5996 5997 if (hdev_is_powered(hdev) && use_changed && 5998 hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) { 5999 u8 mode = (cp->val == 0x02) ? 0x01 : 0x00; 6000 hci_send_cmd(hdev, HCI_OP_WRITE_SSP_DEBUG_MODE, 6001 sizeof(mode), &mode); 6002 } 6003 6004 err = send_settings_rsp(sk, MGMT_OP_SET_DEBUG_KEYS, hdev); 6005 if (err < 0) 6006 goto unlock; 6007 6008 if (changed) 6009 err = new_settings(hdev, sk); 6010 6011 unlock: 6012 hci_dev_unlock(hdev); 6013 return err; 6014 } 6015 6016 static int set_privacy(struct sock *sk, struct hci_dev *hdev, void *cp_data, 6017 u16 len) 6018 { 6019 struct mgmt_cp_set_privacy *cp = cp_data; 6020 bool changed; 6021 int err; 6022 6023 bt_dev_dbg(hdev, "sock %p", sk); 6024 6025 if (!lmp_le_capable(hdev)) 6026 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY, 6027 MGMT_STATUS_NOT_SUPPORTED); 6028 6029 if (cp->privacy != 0x00 && cp->privacy != 0x01 && cp->privacy != 0x02) 6030 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY, 6031 MGMT_STATUS_INVALID_PARAMS); 6032 6033 if (hdev_is_powered(hdev)) 6034 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY, 6035 MGMT_STATUS_REJECTED); 6036 6037 hci_dev_lock(hdev); 6038 6039 /* If user space supports this command it is also expected to 6040 * handle IRKs. Therefore, set the HCI_RPA_RESOLVING flag. 6041 */ 6042 hci_dev_set_flag(hdev, HCI_RPA_RESOLVING); 6043 6044 if (cp->privacy) { 6045 changed = !hci_dev_test_and_set_flag(hdev, HCI_PRIVACY); 6046 memcpy(hdev->irk, cp->irk, sizeof(hdev->irk)); 6047 hci_dev_set_flag(hdev, HCI_RPA_EXPIRED); 6048 hci_adv_instances_set_rpa_expired(hdev, true); 6049 if (cp->privacy == 0x02) 6050 hci_dev_set_flag(hdev, HCI_LIMITED_PRIVACY); 6051 else 6052 hci_dev_clear_flag(hdev, HCI_LIMITED_PRIVACY); 6053 } else { 6054 changed = hci_dev_test_and_clear_flag(hdev, HCI_PRIVACY); 6055 memset(hdev->irk, 0, sizeof(hdev->irk)); 6056 hci_dev_clear_flag(hdev, HCI_RPA_EXPIRED); 6057 hci_adv_instances_set_rpa_expired(hdev, false); 6058 hci_dev_clear_flag(hdev, HCI_LIMITED_PRIVACY); 6059 } 6060 6061 err = send_settings_rsp(sk, MGMT_OP_SET_PRIVACY, hdev); 6062 if (err < 0) 6063 goto unlock; 6064 6065 if (changed) 6066 err = new_settings(hdev, sk); 6067 6068 unlock: 6069 hci_dev_unlock(hdev); 6070 return err; 6071 } 6072 6073 static bool irk_is_valid(struct mgmt_irk_info *irk) 6074 { 6075 switch (irk->addr.type) { 6076 case BDADDR_LE_PUBLIC: 6077 return true; 6078 6079 case BDADDR_LE_RANDOM: 6080 /* Two most significant bits shall be set */ 6081 if ((irk->addr.bdaddr.b[5] & 0xc0) != 0xc0) 6082 return false; 6083 return true; 6084 } 6085 6086 return false; 6087 } 6088 6089 static int load_irks(struct sock *sk, struct hci_dev *hdev, void *cp_data, 6090 u16 len) 6091 { 6092 struct mgmt_cp_load_irks *cp = cp_data; 6093 const u16 max_irk_count = ((U16_MAX - sizeof(*cp)) / 6094 sizeof(struct mgmt_irk_info)); 6095 u16 irk_count, expected_len; 6096 int i, err; 6097 6098 bt_dev_dbg(hdev, "sock %p", sk); 6099 6100 if (!lmp_le_capable(hdev)) 6101 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS, 6102 MGMT_STATUS_NOT_SUPPORTED); 6103 6104 irk_count = __le16_to_cpu(cp->irk_count); 6105 if (irk_count > max_irk_count) { 6106 bt_dev_err(hdev, "load_irks: too big irk_count value %u", 6107 irk_count); 6108 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS, 6109 MGMT_STATUS_INVALID_PARAMS); 6110 } 6111 6112 expected_len = struct_size(cp, irks, irk_count); 6113 if (expected_len != len) { 6114 bt_dev_err(hdev, "load_irks: expected %u bytes, got %u bytes", 6115 expected_len, len); 6116 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS, 6117 MGMT_STATUS_INVALID_PARAMS); 6118 } 6119 6120 bt_dev_dbg(hdev, "irk_count %u", irk_count); 6121 6122 for (i = 0; i < irk_count; i++) { 6123 struct mgmt_irk_info *key = &cp->irks[i]; 6124 6125 if (!irk_is_valid(key)) 6126 return mgmt_cmd_status(sk, hdev->id, 6127 MGMT_OP_LOAD_IRKS, 6128 MGMT_STATUS_INVALID_PARAMS); 6129 } 6130 6131 hci_dev_lock(hdev); 6132 6133 hci_smp_irks_clear(hdev); 6134 6135 for (i = 0; i < irk_count; i++) { 6136 struct mgmt_irk_info *irk = &cp->irks[i]; 6137 6138 if (hci_is_blocked_key(hdev, 6139 HCI_BLOCKED_KEY_TYPE_IRK, 6140 irk->val)) { 6141 bt_dev_warn(hdev, "Skipping blocked IRK for %pMR", 6142 &irk->addr.bdaddr); 6143 continue; 6144 } 6145 6146 hci_add_irk(hdev, &irk->addr.bdaddr, 6147 le_addr_type(irk->addr.type), irk->val, 6148 BDADDR_ANY); 6149 } 6150 6151 hci_dev_set_flag(hdev, HCI_RPA_RESOLVING); 6152 6153 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_IRKS, 0, NULL, 0); 6154 6155 hci_dev_unlock(hdev); 6156 6157 return err; 6158 } 6159 6160 static bool ltk_is_valid(struct mgmt_ltk_info *key) 6161 { 6162 if (key->master != 0x00 && key->master != 0x01) 6163 return false; 6164 6165 switch (key->addr.type) { 6166 case BDADDR_LE_PUBLIC: 6167 return true; 6168 6169 case BDADDR_LE_RANDOM: 6170 /* Two most significant bits shall be set */ 6171 if ((key->addr.bdaddr.b[5] & 0xc0) != 0xc0) 6172 return false; 6173 return true; 6174 } 6175 6176 return false; 6177 } 6178 6179 static int load_long_term_keys(struct sock *sk, struct hci_dev *hdev, 6180 void *cp_data, u16 len) 6181 { 6182 struct mgmt_cp_load_long_term_keys *cp = cp_data; 6183 const u16 max_key_count = ((U16_MAX - sizeof(*cp)) / 6184 sizeof(struct mgmt_ltk_info)); 6185 u16 key_count, expected_len; 6186 int i, err; 6187 6188 bt_dev_dbg(hdev, "sock %p", sk); 6189 6190 if (!lmp_le_capable(hdev)) 6191 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS, 6192 MGMT_STATUS_NOT_SUPPORTED); 6193 6194 key_count = __le16_to_cpu(cp->key_count); 6195 if (key_count > max_key_count) { 6196 bt_dev_err(hdev, "load_ltks: too big key_count value %u", 6197 key_count); 6198 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS, 6199 MGMT_STATUS_INVALID_PARAMS); 6200 } 6201 6202 expected_len = struct_size(cp, keys, key_count); 6203 if (expected_len != len) { 6204 bt_dev_err(hdev, "load_keys: expected %u bytes, got %u bytes", 6205 expected_len, len); 6206 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS, 6207 MGMT_STATUS_INVALID_PARAMS); 6208 } 6209 6210 bt_dev_dbg(hdev, "key_count %u", key_count); 6211 6212 for (i = 0; i < key_count; i++) { 6213 struct mgmt_ltk_info *key = &cp->keys[i]; 6214 6215 if (!ltk_is_valid(key)) 6216 return mgmt_cmd_status(sk, hdev->id, 6217 MGMT_OP_LOAD_LONG_TERM_KEYS, 6218 MGMT_STATUS_INVALID_PARAMS); 6219 } 6220 6221 hci_dev_lock(hdev); 6222 6223 hci_smp_ltks_clear(hdev); 6224 6225 for (i = 0; i < key_count; i++) { 6226 struct mgmt_ltk_info *key = &cp->keys[i]; 6227 u8 type, authenticated; 6228 6229 if (hci_is_blocked_key(hdev, 6230 HCI_BLOCKED_KEY_TYPE_LTK, 6231 key->val)) { 6232 bt_dev_warn(hdev, "Skipping blocked LTK for %pMR", 6233 &key->addr.bdaddr); 6234 continue; 6235 } 6236 6237 switch (key->type) { 6238 case MGMT_LTK_UNAUTHENTICATED: 6239 authenticated = 0x00; 6240 type = key->master ? SMP_LTK : SMP_LTK_SLAVE; 6241 break; 6242 case MGMT_LTK_AUTHENTICATED: 6243 authenticated = 0x01; 6244 type = key->master ? SMP_LTK : SMP_LTK_SLAVE; 6245 break; 6246 case MGMT_LTK_P256_UNAUTH: 6247 authenticated = 0x00; 6248 type = SMP_LTK_P256; 6249 break; 6250 case MGMT_LTK_P256_AUTH: 6251 authenticated = 0x01; 6252 type = SMP_LTK_P256; 6253 break; 6254 case MGMT_LTK_P256_DEBUG: 6255 authenticated = 0x00; 6256 type = SMP_LTK_P256_DEBUG; 6257 fallthrough; 6258 default: 6259 continue; 6260 } 6261 6262 hci_add_ltk(hdev, &key->addr.bdaddr, 6263 le_addr_type(key->addr.type), type, authenticated, 6264 key->val, key->enc_size, key->ediv, key->rand); 6265 } 6266 6267 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS, 0, 6268 NULL, 0); 6269 6270 hci_dev_unlock(hdev); 6271 6272 return err; 6273 } 6274 6275 static int conn_info_cmd_complete(struct mgmt_pending_cmd *cmd, u8 status) 6276 { 6277 struct hci_conn *conn = cmd->user_data; 6278 struct mgmt_rp_get_conn_info rp; 6279 int err; 6280 6281 memcpy(&rp.addr, cmd->param, sizeof(rp.addr)); 6282 6283 if (status == MGMT_STATUS_SUCCESS) { 6284 rp.rssi = conn->rssi; 6285 rp.tx_power = conn->tx_power; 6286 rp.max_tx_power = conn->max_tx_power; 6287 } else { 6288 rp.rssi = HCI_RSSI_INVALID; 6289 rp.tx_power = HCI_TX_POWER_INVALID; 6290 rp.max_tx_power = HCI_TX_POWER_INVALID; 6291 } 6292 6293 err = mgmt_cmd_complete(cmd->sk, cmd->index, MGMT_OP_GET_CONN_INFO, 6294 status, &rp, sizeof(rp)); 6295 6296 hci_conn_drop(conn); 6297 hci_conn_put(conn); 6298 6299 return err; 6300 } 6301 6302 static void conn_info_refresh_complete(struct hci_dev *hdev, u8 hci_status, 6303 u16 opcode) 6304 { 6305 struct hci_cp_read_rssi *cp; 6306 struct mgmt_pending_cmd *cmd; 6307 struct hci_conn *conn; 6308 u16 handle; 6309 u8 status; 6310 6311 bt_dev_dbg(hdev, "status 0x%02x", hci_status); 6312 6313 hci_dev_lock(hdev); 6314 6315 /* Commands sent in request are either Read RSSI or Read Transmit Power 6316 * Level so we check which one was last sent to retrieve connection 6317 * handle. Both commands have handle as first parameter so it's safe to 6318 * cast data on the same command struct. 6319 * 6320 * First command sent is always Read RSSI and we fail only if it fails. 6321 * In other case we simply override error to indicate success as we 6322 * already remembered if TX power value is actually valid. 6323 */ 6324 cp = hci_sent_cmd_data(hdev, HCI_OP_READ_RSSI); 6325 if (!cp) { 6326 cp = hci_sent_cmd_data(hdev, HCI_OP_READ_TX_POWER); 6327 status = MGMT_STATUS_SUCCESS; 6328 } else { 6329 status = mgmt_status(hci_status); 6330 } 6331 6332 if (!cp) { 6333 bt_dev_err(hdev, "invalid sent_cmd in conn_info response"); 6334 goto unlock; 6335 } 6336 6337 handle = __le16_to_cpu(cp->handle); 6338 conn = hci_conn_hash_lookup_handle(hdev, handle); 6339 if (!conn) { 6340 bt_dev_err(hdev, "unknown handle (%d) in conn_info response", 6341 handle); 6342 goto unlock; 6343 } 6344 6345 cmd = pending_find_data(MGMT_OP_GET_CONN_INFO, hdev, conn); 6346 if (!cmd) 6347 goto unlock; 6348 6349 cmd->cmd_complete(cmd, status); 6350 mgmt_pending_remove(cmd); 6351 6352 unlock: 6353 hci_dev_unlock(hdev); 6354 } 6355 6356 static int get_conn_info(struct sock *sk, struct hci_dev *hdev, void *data, 6357 u16 len) 6358 { 6359 struct mgmt_cp_get_conn_info *cp = data; 6360 struct mgmt_rp_get_conn_info rp; 6361 struct hci_conn *conn; 6362 unsigned long conn_info_age; 6363 int err = 0; 6364 6365 bt_dev_dbg(hdev, "sock %p", sk); 6366 6367 memset(&rp, 0, sizeof(rp)); 6368 bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr); 6369 rp.addr.type = cp->addr.type; 6370 6371 if (!bdaddr_type_is_valid(cp->addr.type)) 6372 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO, 6373 MGMT_STATUS_INVALID_PARAMS, 6374 &rp, sizeof(rp)); 6375 6376 hci_dev_lock(hdev); 6377 6378 if (!hdev_is_powered(hdev)) { 6379 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO, 6380 MGMT_STATUS_NOT_POWERED, &rp, 6381 sizeof(rp)); 6382 goto unlock; 6383 } 6384 6385 if (cp->addr.type == BDADDR_BREDR) 6386 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, 6387 &cp->addr.bdaddr); 6388 else 6389 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &cp->addr.bdaddr); 6390 6391 if (!conn || conn->state != BT_CONNECTED) { 6392 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO, 6393 MGMT_STATUS_NOT_CONNECTED, &rp, 6394 sizeof(rp)); 6395 goto unlock; 6396 } 6397 6398 if (pending_find_data(MGMT_OP_GET_CONN_INFO, hdev, conn)) { 6399 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO, 6400 MGMT_STATUS_BUSY, &rp, sizeof(rp)); 6401 goto unlock; 6402 } 6403 6404 /* To avoid client trying to guess when to poll again for information we 6405 * calculate conn info age as random value between min/max set in hdev. 6406 */ 6407 conn_info_age = hdev->conn_info_min_age + 6408 prandom_u32_max(hdev->conn_info_max_age - 6409 hdev->conn_info_min_age); 6410 6411 /* Query controller to refresh cached values if they are too old or were 6412 * never read. 6413 */ 6414 if (time_after(jiffies, conn->conn_info_timestamp + 6415 msecs_to_jiffies(conn_info_age)) || 6416 !conn->conn_info_timestamp) { 6417 struct hci_request req; 6418 struct hci_cp_read_tx_power req_txp_cp; 6419 struct hci_cp_read_rssi req_rssi_cp; 6420 struct mgmt_pending_cmd *cmd; 6421 6422 hci_req_init(&req, hdev); 6423 req_rssi_cp.handle = cpu_to_le16(conn->handle); 6424 hci_req_add(&req, HCI_OP_READ_RSSI, sizeof(req_rssi_cp), 6425 &req_rssi_cp); 6426 6427 /* For LE links TX power does not change thus we don't need to 6428 * query for it once value is known. 6429 */ 6430 if (!bdaddr_type_is_le(cp->addr.type) || 6431 conn->tx_power == HCI_TX_POWER_INVALID) { 6432 req_txp_cp.handle = cpu_to_le16(conn->handle); 6433 req_txp_cp.type = 0x00; 6434 hci_req_add(&req, HCI_OP_READ_TX_POWER, 6435 sizeof(req_txp_cp), &req_txp_cp); 6436 } 6437 6438 /* Max TX power needs to be read only once per connection */ 6439 if (conn->max_tx_power == HCI_TX_POWER_INVALID) { 6440 req_txp_cp.handle = cpu_to_le16(conn->handle); 6441 req_txp_cp.type = 0x01; 6442 hci_req_add(&req, HCI_OP_READ_TX_POWER, 6443 sizeof(req_txp_cp), &req_txp_cp); 6444 } 6445 6446 err = hci_req_run(&req, conn_info_refresh_complete); 6447 if (err < 0) 6448 goto unlock; 6449 6450 cmd = mgmt_pending_add(sk, MGMT_OP_GET_CONN_INFO, hdev, 6451 data, len); 6452 if (!cmd) { 6453 err = -ENOMEM; 6454 goto unlock; 6455 } 6456 6457 hci_conn_hold(conn); 6458 cmd->user_data = hci_conn_get(conn); 6459 cmd->cmd_complete = conn_info_cmd_complete; 6460 6461 conn->conn_info_timestamp = jiffies; 6462 } else { 6463 /* Cache is valid, just reply with values cached in hci_conn */ 6464 rp.rssi = conn->rssi; 6465 rp.tx_power = conn->tx_power; 6466 rp.max_tx_power = conn->max_tx_power; 6467 6468 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO, 6469 MGMT_STATUS_SUCCESS, &rp, sizeof(rp)); 6470 } 6471 6472 unlock: 6473 hci_dev_unlock(hdev); 6474 return err; 6475 } 6476 6477 static int clock_info_cmd_complete(struct mgmt_pending_cmd *cmd, u8 status) 6478 { 6479 struct hci_conn *conn = cmd->user_data; 6480 struct mgmt_rp_get_clock_info rp; 6481 struct hci_dev *hdev; 6482 int err; 6483 6484 memset(&rp, 0, sizeof(rp)); 6485 memcpy(&rp.addr, cmd->param, sizeof(rp.addr)); 6486 6487 if (status) 6488 goto complete; 6489 6490 hdev = hci_dev_get(cmd->index); 6491 if (hdev) { 6492 rp.local_clock = cpu_to_le32(hdev->clock); 6493 hci_dev_put(hdev); 6494 } 6495 6496 if (conn) { 6497 rp.piconet_clock = cpu_to_le32(conn->clock); 6498 rp.accuracy = cpu_to_le16(conn->clock_accuracy); 6499 } 6500 6501 complete: 6502 err = mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, status, &rp, 6503 sizeof(rp)); 6504 6505 if (conn) { 6506 hci_conn_drop(conn); 6507 hci_conn_put(conn); 6508 } 6509 6510 return err; 6511 } 6512 6513 static void get_clock_info_complete(struct hci_dev *hdev, u8 status, u16 opcode) 6514 { 6515 struct hci_cp_read_clock *hci_cp; 6516 struct mgmt_pending_cmd *cmd; 6517 struct hci_conn *conn; 6518 6519 bt_dev_dbg(hdev, "status %u", status); 6520 6521 hci_dev_lock(hdev); 6522 6523 hci_cp = hci_sent_cmd_data(hdev, HCI_OP_READ_CLOCK); 6524 if (!hci_cp) 6525 goto unlock; 6526 6527 if (hci_cp->which) { 6528 u16 handle = __le16_to_cpu(hci_cp->handle); 6529 conn = hci_conn_hash_lookup_handle(hdev, handle); 6530 } else { 6531 conn = NULL; 6532 } 6533 6534 cmd = pending_find_data(MGMT_OP_GET_CLOCK_INFO, hdev, conn); 6535 if (!cmd) 6536 goto unlock; 6537 6538 cmd->cmd_complete(cmd, mgmt_status(status)); 6539 mgmt_pending_remove(cmd); 6540 6541 unlock: 6542 hci_dev_unlock(hdev); 6543 } 6544 6545 static int get_clock_info(struct sock *sk, struct hci_dev *hdev, void *data, 6546 u16 len) 6547 { 6548 struct mgmt_cp_get_clock_info *cp = data; 6549 struct mgmt_rp_get_clock_info rp; 6550 struct hci_cp_read_clock hci_cp; 6551 struct mgmt_pending_cmd *cmd; 6552 struct hci_request req; 6553 struct hci_conn *conn; 6554 int err; 6555 6556 bt_dev_dbg(hdev, "sock %p", sk); 6557 6558 memset(&rp, 0, sizeof(rp)); 6559 bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr); 6560 rp.addr.type = cp->addr.type; 6561 6562 if (cp->addr.type != BDADDR_BREDR) 6563 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CLOCK_INFO, 6564 MGMT_STATUS_INVALID_PARAMS, 6565 &rp, sizeof(rp)); 6566 6567 hci_dev_lock(hdev); 6568 6569 if (!hdev_is_powered(hdev)) { 6570 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CLOCK_INFO, 6571 MGMT_STATUS_NOT_POWERED, &rp, 6572 sizeof(rp)); 6573 goto unlock; 6574 } 6575 6576 if (bacmp(&cp->addr.bdaddr, BDADDR_ANY)) { 6577 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, 6578 &cp->addr.bdaddr); 6579 if (!conn || conn->state != BT_CONNECTED) { 6580 err = mgmt_cmd_complete(sk, hdev->id, 6581 MGMT_OP_GET_CLOCK_INFO, 6582 MGMT_STATUS_NOT_CONNECTED, 6583 &rp, sizeof(rp)); 6584 goto unlock; 6585 } 6586 } else { 6587 conn = NULL; 6588 } 6589 6590 cmd = mgmt_pending_add(sk, MGMT_OP_GET_CLOCK_INFO, hdev, data, len); 6591 if (!cmd) { 6592 err = -ENOMEM; 6593 goto unlock; 6594 } 6595 6596 cmd->cmd_complete = clock_info_cmd_complete; 6597 6598 hci_req_init(&req, hdev); 6599 6600 memset(&hci_cp, 0, sizeof(hci_cp)); 6601 hci_req_add(&req, HCI_OP_READ_CLOCK, sizeof(hci_cp), &hci_cp); 6602 6603 if (conn) { 6604 hci_conn_hold(conn); 6605 cmd->user_data = hci_conn_get(conn); 6606 6607 hci_cp.handle = cpu_to_le16(conn->handle); 6608 hci_cp.which = 0x01; /* Piconet clock */ 6609 hci_req_add(&req, HCI_OP_READ_CLOCK, sizeof(hci_cp), &hci_cp); 6610 } 6611 6612 err = hci_req_run(&req, get_clock_info_complete); 6613 if (err < 0) 6614 mgmt_pending_remove(cmd); 6615 6616 unlock: 6617 hci_dev_unlock(hdev); 6618 return err; 6619 } 6620 6621 static bool is_connected(struct hci_dev *hdev, bdaddr_t *addr, u8 type) 6622 { 6623 struct hci_conn *conn; 6624 6625 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, addr); 6626 if (!conn) 6627 return false; 6628 6629 if (conn->dst_type != type) 6630 return false; 6631 6632 if (conn->state != BT_CONNECTED) 6633 return false; 6634 6635 return true; 6636 } 6637 6638 /* This function requires the caller holds hdev->lock */ 6639 static int hci_conn_params_set(struct hci_dev *hdev, bdaddr_t *addr, 6640 u8 addr_type, u8 auto_connect) 6641 { 6642 struct hci_conn_params *params; 6643 6644 params = hci_conn_params_add(hdev, addr, addr_type); 6645 if (!params) 6646 return -EIO; 6647 6648 if (params->auto_connect == auto_connect) 6649 return 0; 6650 6651 list_del_init(¶ms->action); 6652 6653 switch (auto_connect) { 6654 case HCI_AUTO_CONN_DISABLED: 6655 case HCI_AUTO_CONN_LINK_LOSS: 6656 /* If auto connect is being disabled when we're trying to 6657 * connect to device, keep connecting. 6658 */ 6659 if (params->explicit_connect) 6660 list_add(¶ms->action, &hdev->pend_le_conns); 6661 break; 6662 case HCI_AUTO_CONN_REPORT: 6663 if (params->explicit_connect) 6664 list_add(¶ms->action, &hdev->pend_le_conns); 6665 else 6666 list_add(¶ms->action, &hdev->pend_le_reports); 6667 break; 6668 case HCI_AUTO_CONN_DIRECT: 6669 case HCI_AUTO_CONN_ALWAYS: 6670 if (!is_connected(hdev, addr, addr_type)) 6671 list_add(¶ms->action, &hdev->pend_le_conns); 6672 break; 6673 } 6674 6675 params->auto_connect = auto_connect; 6676 6677 bt_dev_dbg(hdev, "addr %pMR (type %u) auto_connect %u", 6678 addr, addr_type, auto_connect); 6679 6680 return 0; 6681 } 6682 6683 static void device_added(struct sock *sk, struct hci_dev *hdev, 6684 bdaddr_t *bdaddr, u8 type, u8 action) 6685 { 6686 struct mgmt_ev_device_added ev; 6687 6688 bacpy(&ev.addr.bdaddr, bdaddr); 6689 ev.addr.type = type; 6690 ev.action = action; 6691 6692 mgmt_event(MGMT_EV_DEVICE_ADDED, hdev, &ev, sizeof(ev), sk); 6693 } 6694 6695 static int add_device(struct sock *sk, struct hci_dev *hdev, 6696 void *data, u16 len) 6697 { 6698 struct mgmt_cp_add_device *cp = data; 6699 u8 auto_conn, addr_type; 6700 struct hci_conn_params *params; 6701 int err; 6702 u32 current_flags = 0; 6703 6704 bt_dev_dbg(hdev, "sock %p", sk); 6705 6706 if (!bdaddr_type_is_valid(cp->addr.type) || 6707 !bacmp(&cp->addr.bdaddr, BDADDR_ANY)) 6708 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE, 6709 MGMT_STATUS_INVALID_PARAMS, 6710 &cp->addr, sizeof(cp->addr)); 6711 6712 if (cp->action != 0x00 && cp->action != 0x01 && cp->action != 0x02) 6713 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE, 6714 MGMT_STATUS_INVALID_PARAMS, 6715 &cp->addr, sizeof(cp->addr)); 6716 6717 hci_dev_lock(hdev); 6718 6719 if (cp->addr.type == BDADDR_BREDR) { 6720 /* Only incoming connections action is supported for now */ 6721 if (cp->action != 0x01) { 6722 err = mgmt_cmd_complete(sk, hdev->id, 6723 MGMT_OP_ADD_DEVICE, 6724 MGMT_STATUS_INVALID_PARAMS, 6725 &cp->addr, sizeof(cp->addr)); 6726 goto unlock; 6727 } 6728 6729 err = hci_bdaddr_list_add_with_flags(&hdev->whitelist, 6730 &cp->addr.bdaddr, 6731 cp->addr.type, 0); 6732 if (err) 6733 goto unlock; 6734 6735 hci_req_update_scan(hdev); 6736 6737 goto added; 6738 } 6739 6740 addr_type = le_addr_type(cp->addr.type); 6741 6742 if (cp->action == 0x02) 6743 auto_conn = HCI_AUTO_CONN_ALWAYS; 6744 else if (cp->action == 0x01) 6745 auto_conn = HCI_AUTO_CONN_DIRECT; 6746 else 6747 auto_conn = HCI_AUTO_CONN_REPORT; 6748 6749 /* Kernel internally uses conn_params with resolvable private 6750 * address, but Add Device allows only identity addresses. 6751 * Make sure it is enforced before calling 6752 * hci_conn_params_lookup. 6753 */ 6754 if (!hci_is_identity_address(&cp->addr.bdaddr, addr_type)) { 6755 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE, 6756 MGMT_STATUS_INVALID_PARAMS, 6757 &cp->addr, sizeof(cp->addr)); 6758 goto unlock; 6759 } 6760 6761 /* If the connection parameters don't exist for this device, 6762 * they will be created and configured with defaults. 6763 */ 6764 if (hci_conn_params_set(hdev, &cp->addr.bdaddr, addr_type, 6765 auto_conn) < 0) { 6766 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE, 6767 MGMT_STATUS_FAILED, &cp->addr, 6768 sizeof(cp->addr)); 6769 goto unlock; 6770 } else { 6771 params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr, 6772 addr_type); 6773 if (params) 6774 current_flags = params->current_flags; 6775 } 6776 6777 hci_update_background_scan(hdev); 6778 6779 added: 6780 device_added(sk, hdev, &cp->addr.bdaddr, cp->addr.type, cp->action); 6781 device_flags_changed(NULL, hdev, &cp->addr.bdaddr, cp->addr.type, 6782 SUPPORTED_DEVICE_FLAGS(), current_flags); 6783 6784 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE, 6785 MGMT_STATUS_SUCCESS, &cp->addr, 6786 sizeof(cp->addr)); 6787 6788 unlock: 6789 hci_dev_unlock(hdev); 6790 return err; 6791 } 6792 6793 static void device_removed(struct sock *sk, struct hci_dev *hdev, 6794 bdaddr_t *bdaddr, u8 type) 6795 { 6796 struct mgmt_ev_device_removed ev; 6797 6798 bacpy(&ev.addr.bdaddr, bdaddr); 6799 ev.addr.type = type; 6800 6801 mgmt_event(MGMT_EV_DEVICE_REMOVED, hdev, &ev, sizeof(ev), sk); 6802 } 6803 6804 static int remove_device(struct sock *sk, struct hci_dev *hdev, 6805 void *data, u16 len) 6806 { 6807 struct mgmt_cp_remove_device *cp = data; 6808 int err; 6809 6810 bt_dev_dbg(hdev, "sock %p", sk); 6811 6812 hci_dev_lock(hdev); 6813 6814 if (bacmp(&cp->addr.bdaddr, BDADDR_ANY)) { 6815 struct hci_conn_params *params; 6816 u8 addr_type; 6817 6818 if (!bdaddr_type_is_valid(cp->addr.type)) { 6819 err = mgmt_cmd_complete(sk, hdev->id, 6820 MGMT_OP_REMOVE_DEVICE, 6821 MGMT_STATUS_INVALID_PARAMS, 6822 &cp->addr, sizeof(cp->addr)); 6823 goto unlock; 6824 } 6825 6826 if (cp->addr.type == BDADDR_BREDR) { 6827 err = hci_bdaddr_list_del(&hdev->whitelist, 6828 &cp->addr.bdaddr, 6829 cp->addr.type); 6830 if (err) { 6831 err = mgmt_cmd_complete(sk, hdev->id, 6832 MGMT_OP_REMOVE_DEVICE, 6833 MGMT_STATUS_INVALID_PARAMS, 6834 &cp->addr, 6835 sizeof(cp->addr)); 6836 goto unlock; 6837 } 6838 6839 hci_req_update_scan(hdev); 6840 6841 device_removed(sk, hdev, &cp->addr.bdaddr, 6842 cp->addr.type); 6843 goto complete; 6844 } 6845 6846 addr_type = le_addr_type(cp->addr.type); 6847 6848 /* Kernel internally uses conn_params with resolvable private 6849 * address, but Remove Device allows only identity addresses. 6850 * Make sure it is enforced before calling 6851 * hci_conn_params_lookup. 6852 */ 6853 if (!hci_is_identity_address(&cp->addr.bdaddr, addr_type)) { 6854 err = mgmt_cmd_complete(sk, hdev->id, 6855 MGMT_OP_REMOVE_DEVICE, 6856 MGMT_STATUS_INVALID_PARAMS, 6857 &cp->addr, sizeof(cp->addr)); 6858 goto unlock; 6859 } 6860 6861 params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr, 6862 addr_type); 6863 if (!params) { 6864 err = mgmt_cmd_complete(sk, hdev->id, 6865 MGMT_OP_REMOVE_DEVICE, 6866 MGMT_STATUS_INVALID_PARAMS, 6867 &cp->addr, sizeof(cp->addr)); 6868 goto unlock; 6869 } 6870 6871 if (params->auto_connect == HCI_AUTO_CONN_DISABLED || 6872 params->auto_connect == HCI_AUTO_CONN_EXPLICIT) { 6873 err = mgmt_cmd_complete(sk, hdev->id, 6874 MGMT_OP_REMOVE_DEVICE, 6875 MGMT_STATUS_INVALID_PARAMS, 6876 &cp->addr, sizeof(cp->addr)); 6877 goto unlock; 6878 } 6879 6880 list_del(¶ms->action); 6881 list_del(¶ms->list); 6882 kfree(params); 6883 hci_update_background_scan(hdev); 6884 6885 device_removed(sk, hdev, &cp->addr.bdaddr, cp->addr.type); 6886 } else { 6887 struct hci_conn_params *p, *tmp; 6888 struct bdaddr_list *b, *btmp; 6889 6890 if (cp->addr.type) { 6891 err = mgmt_cmd_complete(sk, hdev->id, 6892 MGMT_OP_REMOVE_DEVICE, 6893 MGMT_STATUS_INVALID_PARAMS, 6894 &cp->addr, sizeof(cp->addr)); 6895 goto unlock; 6896 } 6897 6898 list_for_each_entry_safe(b, btmp, &hdev->whitelist, list) { 6899 device_removed(sk, hdev, &b->bdaddr, b->bdaddr_type); 6900 list_del(&b->list); 6901 kfree(b); 6902 } 6903 6904 hci_req_update_scan(hdev); 6905 6906 list_for_each_entry_safe(p, tmp, &hdev->le_conn_params, list) { 6907 if (p->auto_connect == HCI_AUTO_CONN_DISABLED) 6908 continue; 6909 device_removed(sk, hdev, &p->addr, p->addr_type); 6910 if (p->explicit_connect) { 6911 p->auto_connect = HCI_AUTO_CONN_EXPLICIT; 6912 continue; 6913 } 6914 list_del(&p->action); 6915 list_del(&p->list); 6916 kfree(p); 6917 } 6918 6919 bt_dev_dbg(hdev, "All LE connection parameters were removed"); 6920 6921 hci_update_background_scan(hdev); 6922 } 6923 6924 complete: 6925 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_DEVICE, 6926 MGMT_STATUS_SUCCESS, &cp->addr, 6927 sizeof(cp->addr)); 6928 unlock: 6929 hci_dev_unlock(hdev); 6930 return err; 6931 } 6932 6933 static int load_conn_param(struct sock *sk, struct hci_dev *hdev, void *data, 6934 u16 len) 6935 { 6936 struct mgmt_cp_load_conn_param *cp = data; 6937 const u16 max_param_count = ((U16_MAX - sizeof(*cp)) / 6938 sizeof(struct mgmt_conn_param)); 6939 u16 param_count, expected_len; 6940 int i; 6941 6942 if (!lmp_le_capable(hdev)) 6943 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM, 6944 MGMT_STATUS_NOT_SUPPORTED); 6945 6946 param_count = __le16_to_cpu(cp->param_count); 6947 if (param_count > max_param_count) { 6948 bt_dev_err(hdev, "load_conn_param: too big param_count value %u", 6949 param_count); 6950 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM, 6951 MGMT_STATUS_INVALID_PARAMS); 6952 } 6953 6954 expected_len = struct_size(cp, params, param_count); 6955 if (expected_len != len) { 6956 bt_dev_err(hdev, "load_conn_param: expected %u bytes, got %u bytes", 6957 expected_len, len); 6958 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM, 6959 MGMT_STATUS_INVALID_PARAMS); 6960 } 6961 6962 bt_dev_dbg(hdev, "param_count %u", param_count); 6963 6964 hci_dev_lock(hdev); 6965 6966 hci_conn_params_clear_disabled(hdev); 6967 6968 for (i = 0; i < param_count; i++) { 6969 struct mgmt_conn_param *param = &cp->params[i]; 6970 struct hci_conn_params *hci_param; 6971 u16 min, max, latency, timeout; 6972 u8 addr_type; 6973 6974 bt_dev_dbg(hdev, "Adding %pMR (type %u)", ¶m->addr.bdaddr, 6975 param->addr.type); 6976 6977 if (param->addr.type == BDADDR_LE_PUBLIC) { 6978 addr_type = ADDR_LE_DEV_PUBLIC; 6979 } else if (param->addr.type == BDADDR_LE_RANDOM) { 6980 addr_type = ADDR_LE_DEV_RANDOM; 6981 } else { 6982 bt_dev_err(hdev, "ignoring invalid connection parameters"); 6983 continue; 6984 } 6985 6986 min = le16_to_cpu(param->min_interval); 6987 max = le16_to_cpu(param->max_interval); 6988 latency = le16_to_cpu(param->latency); 6989 timeout = le16_to_cpu(param->timeout); 6990 6991 bt_dev_dbg(hdev, "min 0x%04x max 0x%04x latency 0x%04x timeout 0x%04x", 6992 min, max, latency, timeout); 6993 6994 if (hci_check_conn_params(min, max, latency, timeout) < 0) { 6995 bt_dev_err(hdev, "ignoring invalid connection parameters"); 6996 continue; 6997 } 6998 6999 hci_param = hci_conn_params_add(hdev, ¶m->addr.bdaddr, 7000 addr_type); 7001 if (!hci_param) { 7002 bt_dev_err(hdev, "failed to add connection parameters"); 7003 continue; 7004 } 7005 7006 hci_param->conn_min_interval = min; 7007 hci_param->conn_max_interval = max; 7008 hci_param->conn_latency = latency; 7009 hci_param->supervision_timeout = timeout; 7010 } 7011 7012 hci_dev_unlock(hdev); 7013 7014 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM, 0, 7015 NULL, 0); 7016 } 7017 7018 static int set_external_config(struct sock *sk, struct hci_dev *hdev, 7019 void *data, u16 len) 7020 { 7021 struct mgmt_cp_set_external_config *cp = data; 7022 bool changed; 7023 int err; 7024 7025 bt_dev_dbg(hdev, "sock %p", sk); 7026 7027 if (hdev_is_powered(hdev)) 7028 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_EXTERNAL_CONFIG, 7029 MGMT_STATUS_REJECTED); 7030 7031 if (cp->config != 0x00 && cp->config != 0x01) 7032 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_EXTERNAL_CONFIG, 7033 MGMT_STATUS_INVALID_PARAMS); 7034 7035 if (!test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks)) 7036 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_EXTERNAL_CONFIG, 7037 MGMT_STATUS_NOT_SUPPORTED); 7038 7039 hci_dev_lock(hdev); 7040 7041 if (cp->config) 7042 changed = !hci_dev_test_and_set_flag(hdev, HCI_EXT_CONFIGURED); 7043 else 7044 changed = hci_dev_test_and_clear_flag(hdev, HCI_EXT_CONFIGURED); 7045 7046 err = send_options_rsp(sk, MGMT_OP_SET_EXTERNAL_CONFIG, hdev); 7047 if (err < 0) 7048 goto unlock; 7049 7050 if (!changed) 7051 goto unlock; 7052 7053 err = new_options(hdev, sk); 7054 7055 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED) == is_configured(hdev)) { 7056 mgmt_index_removed(hdev); 7057 7058 if (hci_dev_test_and_change_flag(hdev, HCI_UNCONFIGURED)) { 7059 hci_dev_set_flag(hdev, HCI_CONFIG); 7060 hci_dev_set_flag(hdev, HCI_AUTO_OFF); 7061 7062 queue_work(hdev->req_workqueue, &hdev->power_on); 7063 } else { 7064 set_bit(HCI_RAW, &hdev->flags); 7065 mgmt_index_added(hdev); 7066 } 7067 } 7068 7069 unlock: 7070 hci_dev_unlock(hdev); 7071 return err; 7072 } 7073 7074 static int set_public_address(struct sock *sk, struct hci_dev *hdev, 7075 void *data, u16 len) 7076 { 7077 struct mgmt_cp_set_public_address *cp = data; 7078 bool changed; 7079 int err; 7080 7081 bt_dev_dbg(hdev, "sock %p", sk); 7082 7083 if (hdev_is_powered(hdev)) 7084 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PUBLIC_ADDRESS, 7085 MGMT_STATUS_REJECTED); 7086 7087 if (!bacmp(&cp->bdaddr, BDADDR_ANY)) 7088 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PUBLIC_ADDRESS, 7089 MGMT_STATUS_INVALID_PARAMS); 7090 7091 if (!hdev->set_bdaddr) 7092 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PUBLIC_ADDRESS, 7093 MGMT_STATUS_NOT_SUPPORTED); 7094 7095 hci_dev_lock(hdev); 7096 7097 changed = !!bacmp(&hdev->public_addr, &cp->bdaddr); 7098 bacpy(&hdev->public_addr, &cp->bdaddr); 7099 7100 err = send_options_rsp(sk, MGMT_OP_SET_PUBLIC_ADDRESS, hdev); 7101 if (err < 0) 7102 goto unlock; 7103 7104 if (!changed) 7105 goto unlock; 7106 7107 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) 7108 err = new_options(hdev, sk); 7109 7110 if (is_configured(hdev)) { 7111 mgmt_index_removed(hdev); 7112 7113 hci_dev_clear_flag(hdev, HCI_UNCONFIGURED); 7114 7115 hci_dev_set_flag(hdev, HCI_CONFIG); 7116 hci_dev_set_flag(hdev, HCI_AUTO_OFF); 7117 7118 queue_work(hdev->req_workqueue, &hdev->power_on); 7119 } 7120 7121 unlock: 7122 hci_dev_unlock(hdev); 7123 return err; 7124 } 7125 7126 static void read_local_oob_ext_data_complete(struct hci_dev *hdev, u8 status, 7127 u16 opcode, struct sk_buff *skb) 7128 { 7129 const struct mgmt_cp_read_local_oob_ext_data *mgmt_cp; 7130 struct mgmt_rp_read_local_oob_ext_data *mgmt_rp; 7131 u8 *h192, *r192, *h256, *r256; 7132 struct mgmt_pending_cmd *cmd; 7133 u16 eir_len; 7134 int err; 7135 7136 bt_dev_dbg(hdev, "status %u", status); 7137 7138 cmd = pending_find(MGMT_OP_READ_LOCAL_OOB_EXT_DATA, hdev); 7139 if (!cmd) 7140 return; 7141 7142 mgmt_cp = cmd->param; 7143 7144 if (status) { 7145 status = mgmt_status(status); 7146 eir_len = 0; 7147 7148 h192 = NULL; 7149 r192 = NULL; 7150 h256 = NULL; 7151 r256 = NULL; 7152 } else if (opcode == HCI_OP_READ_LOCAL_OOB_DATA) { 7153 struct hci_rp_read_local_oob_data *rp; 7154 7155 if (skb->len != sizeof(*rp)) { 7156 status = MGMT_STATUS_FAILED; 7157 eir_len = 0; 7158 } else { 7159 status = MGMT_STATUS_SUCCESS; 7160 rp = (void *)skb->data; 7161 7162 eir_len = 5 + 18 + 18; 7163 h192 = rp->hash; 7164 r192 = rp->rand; 7165 h256 = NULL; 7166 r256 = NULL; 7167 } 7168 } else { 7169 struct hci_rp_read_local_oob_ext_data *rp; 7170 7171 if (skb->len != sizeof(*rp)) { 7172 status = MGMT_STATUS_FAILED; 7173 eir_len = 0; 7174 } else { 7175 status = MGMT_STATUS_SUCCESS; 7176 rp = (void *)skb->data; 7177 7178 if (hci_dev_test_flag(hdev, HCI_SC_ONLY)) { 7179 eir_len = 5 + 18 + 18; 7180 h192 = NULL; 7181 r192 = NULL; 7182 } else { 7183 eir_len = 5 + 18 + 18 + 18 + 18; 7184 h192 = rp->hash192; 7185 r192 = rp->rand192; 7186 } 7187 7188 h256 = rp->hash256; 7189 r256 = rp->rand256; 7190 } 7191 } 7192 7193 mgmt_rp = kmalloc(sizeof(*mgmt_rp) + eir_len, GFP_KERNEL); 7194 if (!mgmt_rp) 7195 goto done; 7196 7197 if (status) 7198 goto send_rsp; 7199 7200 eir_len = eir_append_data(mgmt_rp->eir, 0, EIR_CLASS_OF_DEV, 7201 hdev->dev_class, 3); 7202 7203 if (h192 && r192) { 7204 eir_len = eir_append_data(mgmt_rp->eir, eir_len, 7205 EIR_SSP_HASH_C192, h192, 16); 7206 eir_len = eir_append_data(mgmt_rp->eir, eir_len, 7207 EIR_SSP_RAND_R192, r192, 16); 7208 } 7209 7210 if (h256 && r256) { 7211 eir_len = eir_append_data(mgmt_rp->eir, eir_len, 7212 EIR_SSP_HASH_C256, h256, 16); 7213 eir_len = eir_append_data(mgmt_rp->eir, eir_len, 7214 EIR_SSP_RAND_R256, r256, 16); 7215 } 7216 7217 send_rsp: 7218 mgmt_rp->type = mgmt_cp->type; 7219 mgmt_rp->eir_len = cpu_to_le16(eir_len); 7220 7221 err = mgmt_cmd_complete(cmd->sk, hdev->id, 7222 MGMT_OP_READ_LOCAL_OOB_EXT_DATA, status, 7223 mgmt_rp, sizeof(*mgmt_rp) + eir_len); 7224 if (err < 0 || status) 7225 goto done; 7226 7227 hci_sock_set_flag(cmd->sk, HCI_MGMT_OOB_DATA_EVENTS); 7228 7229 err = mgmt_limited_event(MGMT_EV_LOCAL_OOB_DATA_UPDATED, hdev, 7230 mgmt_rp, sizeof(*mgmt_rp) + eir_len, 7231 HCI_MGMT_OOB_DATA_EVENTS, cmd->sk); 7232 done: 7233 kfree(mgmt_rp); 7234 mgmt_pending_remove(cmd); 7235 } 7236 7237 static int read_local_ssp_oob_req(struct hci_dev *hdev, struct sock *sk, 7238 struct mgmt_cp_read_local_oob_ext_data *cp) 7239 { 7240 struct mgmt_pending_cmd *cmd; 7241 struct hci_request req; 7242 int err; 7243 7244 cmd = mgmt_pending_add(sk, MGMT_OP_READ_LOCAL_OOB_EXT_DATA, hdev, 7245 cp, sizeof(*cp)); 7246 if (!cmd) 7247 return -ENOMEM; 7248 7249 hci_req_init(&req, hdev); 7250 7251 if (bredr_sc_enabled(hdev)) 7252 hci_req_add(&req, HCI_OP_READ_LOCAL_OOB_EXT_DATA, 0, NULL); 7253 else 7254 hci_req_add(&req, HCI_OP_READ_LOCAL_OOB_DATA, 0, NULL); 7255 7256 err = hci_req_run_skb(&req, read_local_oob_ext_data_complete); 7257 if (err < 0) { 7258 mgmt_pending_remove(cmd); 7259 return err; 7260 } 7261 7262 return 0; 7263 } 7264 7265 static int read_local_oob_ext_data(struct sock *sk, struct hci_dev *hdev, 7266 void *data, u16 data_len) 7267 { 7268 struct mgmt_cp_read_local_oob_ext_data *cp = data; 7269 struct mgmt_rp_read_local_oob_ext_data *rp; 7270 size_t rp_len; 7271 u16 eir_len; 7272 u8 status, flags, role, addr[7], hash[16], rand[16]; 7273 int err; 7274 7275 bt_dev_dbg(hdev, "sock %p", sk); 7276 7277 if (hdev_is_powered(hdev)) { 7278 switch (cp->type) { 7279 case BIT(BDADDR_BREDR): 7280 status = mgmt_bredr_support(hdev); 7281 if (status) 7282 eir_len = 0; 7283 else 7284 eir_len = 5; 7285 break; 7286 case (BIT(BDADDR_LE_PUBLIC) | BIT(BDADDR_LE_RANDOM)): 7287 status = mgmt_le_support(hdev); 7288 if (status) 7289 eir_len = 0; 7290 else 7291 eir_len = 9 + 3 + 18 + 18 + 3; 7292 break; 7293 default: 7294 status = MGMT_STATUS_INVALID_PARAMS; 7295 eir_len = 0; 7296 break; 7297 } 7298 } else { 7299 status = MGMT_STATUS_NOT_POWERED; 7300 eir_len = 0; 7301 } 7302 7303 rp_len = sizeof(*rp) + eir_len; 7304 rp = kmalloc(rp_len, GFP_ATOMIC); 7305 if (!rp) 7306 return -ENOMEM; 7307 7308 if (status) 7309 goto complete; 7310 7311 hci_dev_lock(hdev); 7312 7313 eir_len = 0; 7314 switch (cp->type) { 7315 case BIT(BDADDR_BREDR): 7316 if (hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) { 7317 err = read_local_ssp_oob_req(hdev, sk, cp); 7318 hci_dev_unlock(hdev); 7319 if (!err) 7320 goto done; 7321 7322 status = MGMT_STATUS_FAILED; 7323 goto complete; 7324 } else { 7325 eir_len = eir_append_data(rp->eir, eir_len, 7326 EIR_CLASS_OF_DEV, 7327 hdev->dev_class, 3); 7328 } 7329 break; 7330 case (BIT(BDADDR_LE_PUBLIC) | BIT(BDADDR_LE_RANDOM)): 7331 if (hci_dev_test_flag(hdev, HCI_SC_ENABLED) && 7332 smp_generate_oob(hdev, hash, rand) < 0) { 7333 hci_dev_unlock(hdev); 7334 status = MGMT_STATUS_FAILED; 7335 goto complete; 7336 } 7337 7338 /* This should return the active RPA, but since the RPA 7339 * is only programmed on demand, it is really hard to fill 7340 * this in at the moment. For now disallow retrieving 7341 * local out-of-band data when privacy is in use. 7342 * 7343 * Returning the identity address will not help here since 7344 * pairing happens before the identity resolving key is 7345 * known and thus the connection establishment happens 7346 * based on the RPA and not the identity address. 7347 */ 7348 if (hci_dev_test_flag(hdev, HCI_PRIVACY)) { 7349 hci_dev_unlock(hdev); 7350 status = MGMT_STATUS_REJECTED; 7351 goto complete; 7352 } 7353 7354 if (hci_dev_test_flag(hdev, HCI_FORCE_STATIC_ADDR) || 7355 !bacmp(&hdev->bdaddr, BDADDR_ANY) || 7356 (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) && 7357 bacmp(&hdev->static_addr, BDADDR_ANY))) { 7358 memcpy(addr, &hdev->static_addr, 6); 7359 addr[6] = 0x01; 7360 } else { 7361 memcpy(addr, &hdev->bdaddr, 6); 7362 addr[6] = 0x00; 7363 } 7364 7365 eir_len = eir_append_data(rp->eir, eir_len, EIR_LE_BDADDR, 7366 addr, sizeof(addr)); 7367 7368 if (hci_dev_test_flag(hdev, HCI_ADVERTISING)) 7369 role = 0x02; 7370 else 7371 role = 0x01; 7372 7373 eir_len = eir_append_data(rp->eir, eir_len, EIR_LE_ROLE, 7374 &role, sizeof(role)); 7375 7376 if (hci_dev_test_flag(hdev, HCI_SC_ENABLED)) { 7377 eir_len = eir_append_data(rp->eir, eir_len, 7378 EIR_LE_SC_CONFIRM, 7379 hash, sizeof(hash)); 7380 7381 eir_len = eir_append_data(rp->eir, eir_len, 7382 EIR_LE_SC_RANDOM, 7383 rand, sizeof(rand)); 7384 } 7385 7386 flags = mgmt_get_adv_discov_flags(hdev); 7387 7388 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) 7389 flags |= LE_AD_NO_BREDR; 7390 7391 eir_len = eir_append_data(rp->eir, eir_len, EIR_FLAGS, 7392 &flags, sizeof(flags)); 7393 break; 7394 } 7395 7396 hci_dev_unlock(hdev); 7397 7398 hci_sock_set_flag(sk, HCI_MGMT_OOB_DATA_EVENTS); 7399 7400 status = MGMT_STATUS_SUCCESS; 7401 7402 complete: 7403 rp->type = cp->type; 7404 rp->eir_len = cpu_to_le16(eir_len); 7405 7406 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_EXT_DATA, 7407 status, rp, sizeof(*rp) + eir_len); 7408 if (err < 0 || status) 7409 goto done; 7410 7411 err = mgmt_limited_event(MGMT_EV_LOCAL_OOB_DATA_UPDATED, hdev, 7412 rp, sizeof(*rp) + eir_len, 7413 HCI_MGMT_OOB_DATA_EVENTS, sk); 7414 7415 done: 7416 kfree(rp); 7417 7418 return err; 7419 } 7420 7421 static u32 get_supported_adv_flags(struct hci_dev *hdev) 7422 { 7423 u32 flags = 0; 7424 7425 flags |= MGMT_ADV_FLAG_CONNECTABLE; 7426 flags |= MGMT_ADV_FLAG_DISCOV; 7427 flags |= MGMT_ADV_FLAG_LIMITED_DISCOV; 7428 flags |= MGMT_ADV_FLAG_MANAGED_FLAGS; 7429 flags |= MGMT_ADV_FLAG_APPEARANCE; 7430 flags |= MGMT_ADV_FLAG_LOCAL_NAME; 7431 flags |= MGMT_ADV_PARAM_DURATION; 7432 flags |= MGMT_ADV_PARAM_TIMEOUT; 7433 flags |= MGMT_ADV_PARAM_INTERVALS; 7434 flags |= MGMT_ADV_PARAM_TX_POWER; 7435 7436 /* In extended adv TX_POWER returned from Set Adv Param 7437 * will be always valid. 7438 */ 7439 if ((hdev->adv_tx_power != HCI_TX_POWER_INVALID) || 7440 ext_adv_capable(hdev)) 7441 flags |= MGMT_ADV_FLAG_TX_POWER; 7442 7443 if (ext_adv_capable(hdev)) { 7444 flags |= MGMT_ADV_FLAG_SEC_1M; 7445 flags |= MGMT_ADV_FLAG_HW_OFFLOAD; 7446 flags |= MGMT_ADV_FLAG_CAN_SET_TX_POWER; 7447 7448 if (hdev->le_features[1] & HCI_LE_PHY_2M) 7449 flags |= MGMT_ADV_FLAG_SEC_2M; 7450 7451 if (hdev->le_features[1] & HCI_LE_PHY_CODED) 7452 flags |= MGMT_ADV_FLAG_SEC_CODED; 7453 } 7454 7455 return flags; 7456 } 7457 7458 static int read_adv_features(struct sock *sk, struct hci_dev *hdev, 7459 void *data, u16 data_len) 7460 { 7461 struct mgmt_rp_read_adv_features *rp; 7462 size_t rp_len; 7463 int err; 7464 struct adv_info *adv_instance; 7465 u32 supported_flags; 7466 u8 *instance; 7467 7468 bt_dev_dbg(hdev, "sock %p", sk); 7469 7470 if (!lmp_le_capable(hdev)) 7471 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_ADV_FEATURES, 7472 MGMT_STATUS_REJECTED); 7473 7474 /* Enabling the experimental LL Privay support disables support for 7475 * advertising. 7476 */ 7477 if (hci_dev_test_flag(hdev, HCI_ENABLE_LL_PRIVACY)) 7478 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING, 7479 MGMT_STATUS_NOT_SUPPORTED); 7480 7481 hci_dev_lock(hdev); 7482 7483 rp_len = sizeof(*rp) + hdev->adv_instance_cnt; 7484 rp = kmalloc(rp_len, GFP_ATOMIC); 7485 if (!rp) { 7486 hci_dev_unlock(hdev); 7487 return -ENOMEM; 7488 } 7489 7490 supported_flags = get_supported_adv_flags(hdev); 7491 7492 rp->supported_flags = cpu_to_le32(supported_flags); 7493 rp->max_adv_data_len = HCI_MAX_AD_LENGTH; 7494 rp->max_scan_rsp_len = HCI_MAX_AD_LENGTH; 7495 rp->max_instances = hdev->le_num_of_adv_sets; 7496 rp->num_instances = hdev->adv_instance_cnt; 7497 7498 instance = rp->instance; 7499 list_for_each_entry(adv_instance, &hdev->adv_instances, list) { 7500 *instance = adv_instance->instance; 7501 instance++; 7502 } 7503 7504 hci_dev_unlock(hdev); 7505 7506 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_ADV_FEATURES, 7507 MGMT_STATUS_SUCCESS, rp, rp_len); 7508 7509 kfree(rp); 7510 7511 return err; 7512 } 7513 7514 static u8 calculate_name_len(struct hci_dev *hdev) 7515 { 7516 u8 buf[HCI_MAX_SHORT_NAME_LENGTH + 3]; 7517 7518 return append_local_name(hdev, buf, 0); 7519 } 7520 7521 static u8 tlv_data_max_len(struct hci_dev *hdev, u32 adv_flags, 7522 bool is_adv_data) 7523 { 7524 u8 max_len = HCI_MAX_AD_LENGTH; 7525 7526 if (is_adv_data) { 7527 if (adv_flags & (MGMT_ADV_FLAG_DISCOV | 7528 MGMT_ADV_FLAG_LIMITED_DISCOV | 7529 MGMT_ADV_FLAG_MANAGED_FLAGS)) 7530 max_len -= 3; 7531 7532 if (adv_flags & MGMT_ADV_FLAG_TX_POWER) 7533 max_len -= 3; 7534 } else { 7535 if (adv_flags & MGMT_ADV_FLAG_LOCAL_NAME) 7536 max_len -= calculate_name_len(hdev); 7537 7538 if (adv_flags & (MGMT_ADV_FLAG_APPEARANCE)) 7539 max_len -= 4; 7540 } 7541 7542 return max_len; 7543 } 7544 7545 static bool flags_managed(u32 adv_flags) 7546 { 7547 return adv_flags & (MGMT_ADV_FLAG_DISCOV | 7548 MGMT_ADV_FLAG_LIMITED_DISCOV | 7549 MGMT_ADV_FLAG_MANAGED_FLAGS); 7550 } 7551 7552 static bool tx_power_managed(u32 adv_flags) 7553 { 7554 return adv_flags & MGMT_ADV_FLAG_TX_POWER; 7555 } 7556 7557 static bool name_managed(u32 adv_flags) 7558 { 7559 return adv_flags & MGMT_ADV_FLAG_LOCAL_NAME; 7560 } 7561 7562 static bool appearance_managed(u32 adv_flags) 7563 { 7564 return adv_flags & MGMT_ADV_FLAG_APPEARANCE; 7565 } 7566 7567 static bool tlv_data_is_valid(struct hci_dev *hdev, u32 adv_flags, u8 *data, 7568 u8 len, bool is_adv_data) 7569 { 7570 int i, cur_len; 7571 u8 max_len; 7572 7573 max_len = tlv_data_max_len(hdev, adv_flags, is_adv_data); 7574 7575 if (len > max_len) 7576 return false; 7577 7578 /* Make sure that the data is correctly formatted. */ 7579 for (i = 0, cur_len = 0; i < len; i += (cur_len + 1)) { 7580 cur_len = data[i]; 7581 7582 if (data[i + 1] == EIR_FLAGS && 7583 (!is_adv_data || flags_managed(adv_flags))) 7584 return false; 7585 7586 if (data[i + 1] == EIR_TX_POWER && tx_power_managed(adv_flags)) 7587 return false; 7588 7589 if (data[i + 1] == EIR_NAME_COMPLETE && name_managed(adv_flags)) 7590 return false; 7591 7592 if (data[i + 1] == EIR_NAME_SHORT && name_managed(adv_flags)) 7593 return false; 7594 7595 if (data[i + 1] == EIR_APPEARANCE && 7596 appearance_managed(adv_flags)) 7597 return false; 7598 7599 /* If the current field length would exceed the total data 7600 * length, then it's invalid. 7601 */ 7602 if (i + cur_len >= len) 7603 return false; 7604 } 7605 7606 return true; 7607 } 7608 7609 static bool requested_adv_flags_are_valid(struct hci_dev *hdev, u32 adv_flags) 7610 { 7611 u32 supported_flags, phy_flags; 7612 7613 /* The current implementation only supports a subset of the specified 7614 * flags. Also need to check mutual exclusiveness of sec flags. 7615 */ 7616 supported_flags = get_supported_adv_flags(hdev); 7617 phy_flags = adv_flags & MGMT_ADV_FLAG_SEC_MASK; 7618 if (adv_flags & ~supported_flags || 7619 ((phy_flags && (phy_flags ^ (phy_flags & -phy_flags))))) 7620 return false; 7621 7622 return true; 7623 } 7624 7625 static bool adv_busy(struct hci_dev *hdev) 7626 { 7627 return (pending_find(MGMT_OP_ADD_ADVERTISING, hdev) || 7628 pending_find(MGMT_OP_REMOVE_ADVERTISING, hdev) || 7629 pending_find(MGMT_OP_SET_LE, hdev) || 7630 pending_find(MGMT_OP_ADD_EXT_ADV_PARAMS, hdev) || 7631 pending_find(MGMT_OP_ADD_EXT_ADV_DATA, hdev)); 7632 } 7633 7634 static void add_advertising_complete(struct hci_dev *hdev, u8 status, 7635 u16 opcode) 7636 { 7637 struct mgmt_pending_cmd *cmd; 7638 struct mgmt_cp_add_advertising *cp; 7639 struct mgmt_rp_add_advertising rp; 7640 struct adv_info *adv_instance, *n; 7641 u8 instance; 7642 7643 bt_dev_dbg(hdev, "status %d", status); 7644 7645 hci_dev_lock(hdev); 7646 7647 cmd = pending_find(MGMT_OP_ADD_ADVERTISING, hdev); 7648 if (!cmd) 7649 cmd = pending_find(MGMT_OP_ADD_EXT_ADV_DATA, hdev); 7650 7651 list_for_each_entry_safe(adv_instance, n, &hdev->adv_instances, list) { 7652 if (!adv_instance->pending) 7653 continue; 7654 7655 if (!status) { 7656 adv_instance->pending = false; 7657 continue; 7658 } 7659 7660 instance = adv_instance->instance; 7661 7662 if (hdev->cur_adv_instance == instance) 7663 cancel_adv_timeout(hdev); 7664 7665 hci_remove_adv_instance(hdev, instance); 7666 mgmt_advertising_removed(cmd ? cmd->sk : NULL, hdev, instance); 7667 } 7668 7669 if (!cmd) 7670 goto unlock; 7671 7672 cp = cmd->param; 7673 rp.instance = cp->instance; 7674 7675 if (status) 7676 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, 7677 mgmt_status(status)); 7678 else 7679 mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, 7680 mgmt_status(status), &rp, sizeof(rp)); 7681 7682 mgmt_pending_remove(cmd); 7683 7684 unlock: 7685 hci_dev_unlock(hdev); 7686 } 7687 7688 static int add_advertising(struct sock *sk, struct hci_dev *hdev, 7689 void *data, u16 data_len) 7690 { 7691 struct mgmt_cp_add_advertising *cp = data; 7692 struct mgmt_rp_add_advertising rp; 7693 u32 flags; 7694 u8 status; 7695 u16 timeout, duration; 7696 unsigned int prev_instance_cnt = hdev->adv_instance_cnt; 7697 u8 schedule_instance = 0; 7698 struct adv_info *next_instance; 7699 int err; 7700 struct mgmt_pending_cmd *cmd; 7701 struct hci_request req; 7702 7703 bt_dev_dbg(hdev, "sock %p", sk); 7704 7705 status = mgmt_le_support(hdev); 7706 if (status) 7707 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING, 7708 status); 7709 7710 /* Enabling the experimental LL Privay support disables support for 7711 * advertising. 7712 */ 7713 if (hci_dev_test_flag(hdev, HCI_ENABLE_LL_PRIVACY)) 7714 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING, 7715 MGMT_STATUS_NOT_SUPPORTED); 7716 7717 if (cp->instance < 1 || cp->instance > hdev->le_num_of_adv_sets) 7718 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING, 7719 MGMT_STATUS_INVALID_PARAMS); 7720 7721 if (data_len != sizeof(*cp) + cp->adv_data_len + cp->scan_rsp_len) 7722 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING, 7723 MGMT_STATUS_INVALID_PARAMS); 7724 7725 flags = __le32_to_cpu(cp->flags); 7726 timeout = __le16_to_cpu(cp->timeout); 7727 duration = __le16_to_cpu(cp->duration); 7728 7729 if (!requested_adv_flags_are_valid(hdev, flags)) 7730 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING, 7731 MGMT_STATUS_INVALID_PARAMS); 7732 7733 hci_dev_lock(hdev); 7734 7735 if (timeout && !hdev_is_powered(hdev)) { 7736 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING, 7737 MGMT_STATUS_REJECTED); 7738 goto unlock; 7739 } 7740 7741 if (adv_busy(hdev)) { 7742 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING, 7743 MGMT_STATUS_BUSY); 7744 goto unlock; 7745 } 7746 7747 if (!tlv_data_is_valid(hdev, flags, cp->data, cp->adv_data_len, true) || 7748 !tlv_data_is_valid(hdev, flags, cp->data + cp->adv_data_len, 7749 cp->scan_rsp_len, false)) { 7750 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING, 7751 MGMT_STATUS_INVALID_PARAMS); 7752 goto unlock; 7753 } 7754 7755 err = hci_add_adv_instance(hdev, cp->instance, flags, 7756 cp->adv_data_len, cp->data, 7757 cp->scan_rsp_len, 7758 cp->data + cp->adv_data_len, 7759 timeout, duration, 7760 HCI_ADV_TX_POWER_NO_PREFERENCE, 7761 hdev->le_adv_min_interval, 7762 hdev->le_adv_max_interval); 7763 if (err < 0) { 7764 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING, 7765 MGMT_STATUS_FAILED); 7766 goto unlock; 7767 } 7768 7769 /* Only trigger an advertising added event if a new instance was 7770 * actually added. 7771 */ 7772 if (hdev->adv_instance_cnt > prev_instance_cnt) 7773 mgmt_advertising_added(sk, hdev, cp->instance); 7774 7775 if (hdev->cur_adv_instance == cp->instance) { 7776 /* If the currently advertised instance is being changed then 7777 * cancel the current advertising and schedule the next 7778 * instance. If there is only one instance then the overridden 7779 * advertising data will be visible right away. 7780 */ 7781 cancel_adv_timeout(hdev); 7782 7783 next_instance = hci_get_next_instance(hdev, cp->instance); 7784 if (next_instance) 7785 schedule_instance = next_instance->instance; 7786 } else if (!hdev->adv_instance_timeout) { 7787 /* Immediately advertise the new instance if no other 7788 * instance is currently being advertised. 7789 */ 7790 schedule_instance = cp->instance; 7791 } 7792 7793 /* If the HCI_ADVERTISING flag is set or the device isn't powered or 7794 * there is no instance to be advertised then we have no HCI 7795 * communication to make. Simply return. 7796 */ 7797 if (!hdev_is_powered(hdev) || 7798 hci_dev_test_flag(hdev, HCI_ADVERTISING) || 7799 !schedule_instance) { 7800 rp.instance = cp->instance; 7801 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_ADVERTISING, 7802 MGMT_STATUS_SUCCESS, &rp, sizeof(rp)); 7803 goto unlock; 7804 } 7805 7806 /* We're good to go, update advertising data, parameters, and start 7807 * advertising. 7808 */ 7809 cmd = mgmt_pending_add(sk, MGMT_OP_ADD_ADVERTISING, hdev, data, 7810 data_len); 7811 if (!cmd) { 7812 err = -ENOMEM; 7813 goto unlock; 7814 } 7815 7816 hci_req_init(&req, hdev); 7817 7818 err = __hci_req_schedule_adv_instance(&req, schedule_instance, true); 7819 7820 if (!err) 7821 err = hci_req_run(&req, add_advertising_complete); 7822 7823 if (err < 0) { 7824 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING, 7825 MGMT_STATUS_FAILED); 7826 mgmt_pending_remove(cmd); 7827 } 7828 7829 unlock: 7830 hci_dev_unlock(hdev); 7831 7832 return err; 7833 } 7834 7835 static void add_ext_adv_params_complete(struct hci_dev *hdev, u8 status, 7836 u16 opcode) 7837 { 7838 struct mgmt_pending_cmd *cmd; 7839 struct mgmt_cp_add_ext_adv_params *cp; 7840 struct mgmt_rp_add_ext_adv_params rp; 7841 struct adv_info *adv_instance; 7842 u32 flags; 7843 7844 BT_DBG("%s", hdev->name); 7845 7846 hci_dev_lock(hdev); 7847 7848 cmd = pending_find(MGMT_OP_ADD_EXT_ADV_PARAMS, hdev); 7849 if (!cmd) 7850 goto unlock; 7851 7852 cp = cmd->param; 7853 adv_instance = hci_find_adv_instance(hdev, cp->instance); 7854 if (!adv_instance) 7855 goto unlock; 7856 7857 rp.instance = cp->instance; 7858 rp.tx_power = adv_instance->tx_power; 7859 7860 /* While we're at it, inform userspace of the available space for this 7861 * advertisement, given the flags that will be used. 7862 */ 7863 flags = __le32_to_cpu(cp->flags); 7864 rp.max_adv_data_len = tlv_data_max_len(hdev, flags, true); 7865 rp.max_scan_rsp_len = tlv_data_max_len(hdev, flags, false); 7866 7867 if (status) { 7868 /* If this advertisement was previously advertising and we 7869 * failed to update it, we signal that it has been removed and 7870 * delete its structure 7871 */ 7872 if (!adv_instance->pending) 7873 mgmt_advertising_removed(cmd->sk, hdev, cp->instance); 7874 7875 hci_remove_adv_instance(hdev, cp->instance); 7876 7877 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, 7878 mgmt_status(status)); 7879 7880 } else { 7881 mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, 7882 mgmt_status(status), &rp, sizeof(rp)); 7883 } 7884 7885 unlock: 7886 if (cmd) 7887 mgmt_pending_remove(cmd); 7888 7889 hci_dev_unlock(hdev); 7890 } 7891 7892 static int add_ext_adv_params(struct sock *sk, struct hci_dev *hdev, 7893 void *data, u16 data_len) 7894 { 7895 struct mgmt_cp_add_ext_adv_params *cp = data; 7896 struct mgmt_rp_add_ext_adv_params rp; 7897 struct mgmt_pending_cmd *cmd = NULL; 7898 struct adv_info *adv_instance; 7899 struct hci_request req; 7900 u32 flags, min_interval, max_interval; 7901 u16 timeout, duration; 7902 u8 status; 7903 s8 tx_power; 7904 int err; 7905 7906 BT_DBG("%s", hdev->name); 7907 7908 status = mgmt_le_support(hdev); 7909 if (status) 7910 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_PARAMS, 7911 status); 7912 7913 if (cp->instance < 1 || cp->instance > hdev->le_num_of_adv_sets) 7914 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_PARAMS, 7915 MGMT_STATUS_INVALID_PARAMS); 7916 7917 /* The purpose of breaking add_advertising into two separate MGMT calls 7918 * for params and data is to allow more parameters to be added to this 7919 * structure in the future. For this reason, we verify that we have the 7920 * bare minimum structure we know of when the interface was defined. Any 7921 * extra parameters we don't know about will be ignored in this request. 7922 */ 7923 if (data_len < MGMT_ADD_EXT_ADV_PARAMS_MIN_SIZE) 7924 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING, 7925 MGMT_STATUS_INVALID_PARAMS); 7926 7927 flags = __le32_to_cpu(cp->flags); 7928 7929 if (!requested_adv_flags_are_valid(hdev, flags)) 7930 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_PARAMS, 7931 MGMT_STATUS_INVALID_PARAMS); 7932 7933 hci_dev_lock(hdev); 7934 7935 /* In new interface, we require that we are powered to register */ 7936 if (!hdev_is_powered(hdev)) { 7937 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_PARAMS, 7938 MGMT_STATUS_REJECTED); 7939 goto unlock; 7940 } 7941 7942 if (adv_busy(hdev)) { 7943 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_PARAMS, 7944 MGMT_STATUS_BUSY); 7945 goto unlock; 7946 } 7947 7948 /* Parse defined parameters from request, use defaults otherwise */ 7949 timeout = (flags & MGMT_ADV_PARAM_TIMEOUT) ? 7950 __le16_to_cpu(cp->timeout) : 0; 7951 7952 duration = (flags & MGMT_ADV_PARAM_DURATION) ? 7953 __le16_to_cpu(cp->duration) : 7954 hdev->def_multi_adv_rotation_duration; 7955 7956 min_interval = (flags & MGMT_ADV_PARAM_INTERVALS) ? 7957 __le32_to_cpu(cp->min_interval) : 7958 hdev->le_adv_min_interval; 7959 7960 max_interval = (flags & MGMT_ADV_PARAM_INTERVALS) ? 7961 __le32_to_cpu(cp->max_interval) : 7962 hdev->le_adv_max_interval; 7963 7964 tx_power = (flags & MGMT_ADV_PARAM_TX_POWER) ? 7965 cp->tx_power : 7966 HCI_ADV_TX_POWER_NO_PREFERENCE; 7967 7968 /* Create advertising instance with no advertising or response data */ 7969 err = hci_add_adv_instance(hdev, cp->instance, flags, 7970 0, NULL, 0, NULL, timeout, duration, 7971 tx_power, min_interval, max_interval); 7972 7973 if (err < 0) { 7974 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_PARAMS, 7975 MGMT_STATUS_FAILED); 7976 goto unlock; 7977 } 7978 7979 hdev->cur_adv_instance = cp->instance; 7980 /* Submit request for advertising params if ext adv available */ 7981 if (ext_adv_capable(hdev)) { 7982 hci_req_init(&req, hdev); 7983 adv_instance = hci_find_adv_instance(hdev, cp->instance); 7984 7985 /* Updating parameters of an active instance will return a 7986 * Command Disallowed error, so we must first disable the 7987 * instance if it is active. 7988 */ 7989 if (!adv_instance->pending) 7990 __hci_req_disable_ext_adv_instance(&req, cp->instance); 7991 7992 __hci_req_setup_ext_adv_instance(&req, cp->instance); 7993 7994 err = hci_req_run(&req, add_ext_adv_params_complete); 7995 7996 if (!err) 7997 cmd = mgmt_pending_add(sk, MGMT_OP_ADD_EXT_ADV_PARAMS, 7998 hdev, data, data_len); 7999 if (!cmd) { 8000 err = -ENOMEM; 8001 hci_remove_adv_instance(hdev, cp->instance); 8002 goto unlock; 8003 } 8004 8005 } else { 8006 rp.instance = cp->instance; 8007 rp.tx_power = HCI_ADV_TX_POWER_NO_PREFERENCE; 8008 rp.max_adv_data_len = tlv_data_max_len(hdev, flags, true); 8009 rp.max_scan_rsp_len = tlv_data_max_len(hdev, flags, false); 8010 err = mgmt_cmd_complete(sk, hdev->id, 8011 MGMT_OP_ADD_EXT_ADV_PARAMS, 8012 MGMT_STATUS_SUCCESS, &rp, sizeof(rp)); 8013 } 8014 8015 unlock: 8016 hci_dev_unlock(hdev); 8017 8018 return err; 8019 } 8020 8021 static int add_ext_adv_data(struct sock *sk, struct hci_dev *hdev, void *data, 8022 u16 data_len) 8023 { 8024 struct mgmt_cp_add_ext_adv_data *cp = data; 8025 struct mgmt_rp_add_ext_adv_data rp; 8026 u8 schedule_instance = 0; 8027 struct adv_info *next_instance; 8028 struct adv_info *adv_instance; 8029 int err = 0; 8030 struct mgmt_pending_cmd *cmd; 8031 struct hci_request req; 8032 8033 BT_DBG("%s", hdev->name); 8034 8035 hci_dev_lock(hdev); 8036 8037 adv_instance = hci_find_adv_instance(hdev, cp->instance); 8038 8039 if (!adv_instance) { 8040 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_DATA, 8041 MGMT_STATUS_INVALID_PARAMS); 8042 goto unlock; 8043 } 8044 8045 /* In new interface, we require that we are powered to register */ 8046 if (!hdev_is_powered(hdev)) { 8047 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_DATA, 8048 MGMT_STATUS_REJECTED); 8049 goto clear_new_instance; 8050 } 8051 8052 if (adv_busy(hdev)) { 8053 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_DATA, 8054 MGMT_STATUS_BUSY); 8055 goto clear_new_instance; 8056 } 8057 8058 /* Validate new data */ 8059 if (!tlv_data_is_valid(hdev, adv_instance->flags, cp->data, 8060 cp->adv_data_len, true) || 8061 !tlv_data_is_valid(hdev, adv_instance->flags, cp->data + 8062 cp->adv_data_len, cp->scan_rsp_len, false)) { 8063 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_DATA, 8064 MGMT_STATUS_INVALID_PARAMS); 8065 goto clear_new_instance; 8066 } 8067 8068 /* Set the data in the advertising instance */ 8069 hci_set_adv_instance_data(hdev, cp->instance, cp->adv_data_len, 8070 cp->data, cp->scan_rsp_len, 8071 cp->data + cp->adv_data_len); 8072 8073 /* We're good to go, update advertising data, parameters, and start 8074 * advertising. 8075 */ 8076 8077 hci_req_init(&req, hdev); 8078 8079 hci_req_add(&req, HCI_OP_READ_LOCAL_NAME, 0, NULL); 8080 8081 if (ext_adv_capable(hdev)) { 8082 __hci_req_update_adv_data(&req, cp->instance); 8083 __hci_req_update_scan_rsp_data(&req, cp->instance); 8084 __hci_req_enable_ext_advertising(&req, cp->instance); 8085 8086 } else { 8087 /* If using software rotation, determine next instance to use */ 8088 8089 if (hdev->cur_adv_instance == cp->instance) { 8090 /* If the currently advertised instance is being changed 8091 * then cancel the current advertising and schedule the 8092 * next instance. If there is only one instance then the 8093 * overridden advertising data will be visible right 8094 * away 8095 */ 8096 cancel_adv_timeout(hdev); 8097 8098 next_instance = hci_get_next_instance(hdev, 8099 cp->instance); 8100 if (next_instance) 8101 schedule_instance = next_instance->instance; 8102 } else if (!hdev->adv_instance_timeout) { 8103 /* Immediately advertise the new instance if no other 8104 * instance is currently being advertised. 8105 */ 8106 schedule_instance = cp->instance; 8107 } 8108 8109 /* If the HCI_ADVERTISING flag is set or there is no instance to 8110 * be advertised then we have no HCI communication to make. 8111 * Simply return. 8112 */ 8113 if (hci_dev_test_flag(hdev, HCI_ADVERTISING) || 8114 !schedule_instance) { 8115 if (adv_instance->pending) { 8116 mgmt_advertising_added(sk, hdev, cp->instance); 8117 adv_instance->pending = false; 8118 } 8119 rp.instance = cp->instance; 8120 err = mgmt_cmd_complete(sk, hdev->id, 8121 MGMT_OP_ADD_EXT_ADV_DATA, 8122 MGMT_STATUS_SUCCESS, &rp, 8123 sizeof(rp)); 8124 goto unlock; 8125 } 8126 8127 err = __hci_req_schedule_adv_instance(&req, schedule_instance, 8128 true); 8129 } 8130 8131 cmd = mgmt_pending_add(sk, MGMT_OP_ADD_EXT_ADV_DATA, hdev, data, 8132 data_len); 8133 if (!cmd) { 8134 err = -ENOMEM; 8135 goto clear_new_instance; 8136 } 8137 8138 if (!err) 8139 err = hci_req_run(&req, add_advertising_complete); 8140 8141 if (err < 0) { 8142 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_DATA, 8143 MGMT_STATUS_FAILED); 8144 mgmt_pending_remove(cmd); 8145 goto clear_new_instance; 8146 } 8147 8148 /* We were successful in updating data, so trigger advertising_added 8149 * event if this is an instance that wasn't previously advertising. If 8150 * a failure occurs in the requests we initiated, we will remove the 8151 * instance again in add_advertising_complete 8152 */ 8153 if (adv_instance->pending) 8154 mgmt_advertising_added(sk, hdev, cp->instance); 8155 8156 goto unlock; 8157 8158 clear_new_instance: 8159 hci_remove_adv_instance(hdev, cp->instance); 8160 8161 unlock: 8162 hci_dev_unlock(hdev); 8163 8164 return err; 8165 } 8166 8167 static void remove_advertising_complete(struct hci_dev *hdev, u8 status, 8168 u16 opcode) 8169 { 8170 struct mgmt_pending_cmd *cmd; 8171 struct mgmt_cp_remove_advertising *cp; 8172 struct mgmt_rp_remove_advertising rp; 8173 8174 bt_dev_dbg(hdev, "status %d", status); 8175 8176 hci_dev_lock(hdev); 8177 8178 /* A failure status here only means that we failed to disable 8179 * advertising. Otherwise, the advertising instance has been removed, 8180 * so report success. 8181 */ 8182 cmd = pending_find(MGMT_OP_REMOVE_ADVERTISING, hdev); 8183 if (!cmd) 8184 goto unlock; 8185 8186 cp = cmd->param; 8187 rp.instance = cp->instance; 8188 8189 mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, MGMT_STATUS_SUCCESS, 8190 &rp, sizeof(rp)); 8191 mgmt_pending_remove(cmd); 8192 8193 unlock: 8194 hci_dev_unlock(hdev); 8195 } 8196 8197 static int remove_advertising(struct sock *sk, struct hci_dev *hdev, 8198 void *data, u16 data_len) 8199 { 8200 struct mgmt_cp_remove_advertising *cp = data; 8201 struct mgmt_rp_remove_advertising rp; 8202 struct mgmt_pending_cmd *cmd; 8203 struct hci_request req; 8204 int err; 8205 8206 bt_dev_dbg(hdev, "sock %p", sk); 8207 8208 /* Enabling the experimental LL Privay support disables support for 8209 * advertising. 8210 */ 8211 if (hci_dev_test_flag(hdev, HCI_ENABLE_LL_PRIVACY)) 8212 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING, 8213 MGMT_STATUS_NOT_SUPPORTED); 8214 8215 hci_dev_lock(hdev); 8216 8217 if (cp->instance && !hci_find_adv_instance(hdev, cp->instance)) { 8218 err = mgmt_cmd_status(sk, hdev->id, 8219 MGMT_OP_REMOVE_ADVERTISING, 8220 MGMT_STATUS_INVALID_PARAMS); 8221 goto unlock; 8222 } 8223 8224 if (pending_find(MGMT_OP_ADD_ADVERTISING, hdev) || 8225 pending_find(MGMT_OP_REMOVE_ADVERTISING, hdev) || 8226 pending_find(MGMT_OP_SET_LE, hdev)) { 8227 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_ADVERTISING, 8228 MGMT_STATUS_BUSY); 8229 goto unlock; 8230 } 8231 8232 if (list_empty(&hdev->adv_instances)) { 8233 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_ADVERTISING, 8234 MGMT_STATUS_INVALID_PARAMS); 8235 goto unlock; 8236 } 8237 8238 hci_req_init(&req, hdev); 8239 8240 /* If we use extended advertising, instance is disabled and removed */ 8241 if (ext_adv_capable(hdev)) { 8242 __hci_req_disable_ext_adv_instance(&req, cp->instance); 8243 __hci_req_remove_ext_adv_instance(&req, cp->instance); 8244 } 8245 8246 hci_req_clear_adv_instance(hdev, sk, &req, cp->instance, true); 8247 8248 if (list_empty(&hdev->adv_instances)) 8249 __hci_req_disable_advertising(&req); 8250 8251 /* If no HCI commands have been collected so far or the HCI_ADVERTISING 8252 * flag is set or the device isn't powered then we have no HCI 8253 * communication to make. Simply return. 8254 */ 8255 if (skb_queue_empty(&req.cmd_q) || 8256 !hdev_is_powered(hdev) || 8257 hci_dev_test_flag(hdev, HCI_ADVERTISING)) { 8258 hci_req_purge(&req); 8259 rp.instance = cp->instance; 8260 err = mgmt_cmd_complete(sk, hdev->id, 8261 MGMT_OP_REMOVE_ADVERTISING, 8262 MGMT_STATUS_SUCCESS, &rp, sizeof(rp)); 8263 goto unlock; 8264 } 8265 8266 cmd = mgmt_pending_add(sk, MGMT_OP_REMOVE_ADVERTISING, hdev, data, 8267 data_len); 8268 if (!cmd) { 8269 err = -ENOMEM; 8270 goto unlock; 8271 } 8272 8273 err = hci_req_run(&req, remove_advertising_complete); 8274 if (err < 0) 8275 mgmt_pending_remove(cmd); 8276 8277 unlock: 8278 hci_dev_unlock(hdev); 8279 8280 return err; 8281 } 8282 8283 static int get_adv_size_info(struct sock *sk, struct hci_dev *hdev, 8284 void *data, u16 data_len) 8285 { 8286 struct mgmt_cp_get_adv_size_info *cp = data; 8287 struct mgmt_rp_get_adv_size_info rp; 8288 u32 flags, supported_flags; 8289 int err; 8290 8291 bt_dev_dbg(hdev, "sock %p", sk); 8292 8293 if (!lmp_le_capable(hdev)) 8294 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_ADV_SIZE_INFO, 8295 MGMT_STATUS_REJECTED); 8296 8297 if (cp->instance < 1 || cp->instance > hdev->le_num_of_adv_sets) 8298 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_ADV_SIZE_INFO, 8299 MGMT_STATUS_INVALID_PARAMS); 8300 8301 flags = __le32_to_cpu(cp->flags); 8302 8303 /* The current implementation only supports a subset of the specified 8304 * flags. 8305 */ 8306 supported_flags = get_supported_adv_flags(hdev); 8307 if (flags & ~supported_flags) 8308 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_ADV_SIZE_INFO, 8309 MGMT_STATUS_INVALID_PARAMS); 8310 8311 rp.instance = cp->instance; 8312 rp.flags = cp->flags; 8313 rp.max_adv_data_len = tlv_data_max_len(hdev, flags, true); 8314 rp.max_scan_rsp_len = tlv_data_max_len(hdev, flags, false); 8315 8316 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_ADV_SIZE_INFO, 8317 MGMT_STATUS_SUCCESS, &rp, sizeof(rp)); 8318 8319 return err; 8320 } 8321 8322 static const struct hci_mgmt_handler mgmt_handlers[] = { 8323 { NULL }, /* 0x0000 (no command) */ 8324 { read_version, MGMT_READ_VERSION_SIZE, 8325 HCI_MGMT_NO_HDEV | 8326 HCI_MGMT_UNTRUSTED }, 8327 { read_commands, MGMT_READ_COMMANDS_SIZE, 8328 HCI_MGMT_NO_HDEV | 8329 HCI_MGMT_UNTRUSTED }, 8330 { read_index_list, MGMT_READ_INDEX_LIST_SIZE, 8331 HCI_MGMT_NO_HDEV | 8332 HCI_MGMT_UNTRUSTED }, 8333 { read_controller_info, MGMT_READ_INFO_SIZE, 8334 HCI_MGMT_UNTRUSTED }, 8335 { set_powered, MGMT_SETTING_SIZE }, 8336 { set_discoverable, MGMT_SET_DISCOVERABLE_SIZE }, 8337 { set_connectable, MGMT_SETTING_SIZE }, 8338 { set_fast_connectable, MGMT_SETTING_SIZE }, 8339 { set_bondable, MGMT_SETTING_SIZE }, 8340 { set_link_security, MGMT_SETTING_SIZE }, 8341 { set_ssp, MGMT_SETTING_SIZE }, 8342 { set_hs, MGMT_SETTING_SIZE }, 8343 { set_le, MGMT_SETTING_SIZE }, 8344 { set_dev_class, MGMT_SET_DEV_CLASS_SIZE }, 8345 { set_local_name, MGMT_SET_LOCAL_NAME_SIZE }, 8346 { add_uuid, MGMT_ADD_UUID_SIZE }, 8347 { remove_uuid, MGMT_REMOVE_UUID_SIZE }, 8348 { load_link_keys, MGMT_LOAD_LINK_KEYS_SIZE, 8349 HCI_MGMT_VAR_LEN }, 8350 { load_long_term_keys, MGMT_LOAD_LONG_TERM_KEYS_SIZE, 8351 HCI_MGMT_VAR_LEN }, 8352 { disconnect, MGMT_DISCONNECT_SIZE }, 8353 { get_connections, MGMT_GET_CONNECTIONS_SIZE }, 8354 { pin_code_reply, MGMT_PIN_CODE_REPLY_SIZE }, 8355 { pin_code_neg_reply, MGMT_PIN_CODE_NEG_REPLY_SIZE }, 8356 { set_io_capability, MGMT_SET_IO_CAPABILITY_SIZE }, 8357 { pair_device, MGMT_PAIR_DEVICE_SIZE }, 8358 { cancel_pair_device, MGMT_CANCEL_PAIR_DEVICE_SIZE }, 8359 { unpair_device, MGMT_UNPAIR_DEVICE_SIZE }, 8360 { user_confirm_reply, MGMT_USER_CONFIRM_REPLY_SIZE }, 8361 { user_confirm_neg_reply, MGMT_USER_CONFIRM_NEG_REPLY_SIZE }, 8362 { user_passkey_reply, MGMT_USER_PASSKEY_REPLY_SIZE }, 8363 { user_passkey_neg_reply, MGMT_USER_PASSKEY_NEG_REPLY_SIZE }, 8364 { read_local_oob_data, MGMT_READ_LOCAL_OOB_DATA_SIZE }, 8365 { add_remote_oob_data, MGMT_ADD_REMOTE_OOB_DATA_SIZE, 8366 HCI_MGMT_VAR_LEN }, 8367 { remove_remote_oob_data, MGMT_REMOVE_REMOTE_OOB_DATA_SIZE }, 8368 { start_discovery, MGMT_START_DISCOVERY_SIZE }, 8369 { stop_discovery, MGMT_STOP_DISCOVERY_SIZE }, 8370 { confirm_name, MGMT_CONFIRM_NAME_SIZE }, 8371 { block_device, MGMT_BLOCK_DEVICE_SIZE }, 8372 { unblock_device, MGMT_UNBLOCK_DEVICE_SIZE }, 8373 { set_device_id, MGMT_SET_DEVICE_ID_SIZE }, 8374 { set_advertising, MGMT_SETTING_SIZE }, 8375 { set_bredr, MGMT_SETTING_SIZE }, 8376 { set_static_address, MGMT_SET_STATIC_ADDRESS_SIZE }, 8377 { set_scan_params, MGMT_SET_SCAN_PARAMS_SIZE }, 8378 { set_secure_conn, MGMT_SETTING_SIZE }, 8379 { set_debug_keys, MGMT_SETTING_SIZE }, 8380 { set_privacy, MGMT_SET_PRIVACY_SIZE }, 8381 { load_irks, MGMT_LOAD_IRKS_SIZE, 8382 HCI_MGMT_VAR_LEN }, 8383 { get_conn_info, MGMT_GET_CONN_INFO_SIZE }, 8384 { get_clock_info, MGMT_GET_CLOCK_INFO_SIZE }, 8385 { add_device, MGMT_ADD_DEVICE_SIZE }, 8386 { remove_device, MGMT_REMOVE_DEVICE_SIZE }, 8387 { load_conn_param, MGMT_LOAD_CONN_PARAM_SIZE, 8388 HCI_MGMT_VAR_LEN }, 8389 { read_unconf_index_list, MGMT_READ_UNCONF_INDEX_LIST_SIZE, 8390 HCI_MGMT_NO_HDEV | 8391 HCI_MGMT_UNTRUSTED }, 8392 { read_config_info, MGMT_READ_CONFIG_INFO_SIZE, 8393 HCI_MGMT_UNCONFIGURED | 8394 HCI_MGMT_UNTRUSTED }, 8395 { set_external_config, MGMT_SET_EXTERNAL_CONFIG_SIZE, 8396 HCI_MGMT_UNCONFIGURED }, 8397 { set_public_address, MGMT_SET_PUBLIC_ADDRESS_SIZE, 8398 HCI_MGMT_UNCONFIGURED }, 8399 { start_service_discovery, MGMT_START_SERVICE_DISCOVERY_SIZE, 8400 HCI_MGMT_VAR_LEN }, 8401 { read_local_oob_ext_data, MGMT_READ_LOCAL_OOB_EXT_DATA_SIZE }, 8402 { read_ext_index_list, MGMT_READ_EXT_INDEX_LIST_SIZE, 8403 HCI_MGMT_NO_HDEV | 8404 HCI_MGMT_UNTRUSTED }, 8405 { read_adv_features, MGMT_READ_ADV_FEATURES_SIZE }, 8406 { add_advertising, MGMT_ADD_ADVERTISING_SIZE, 8407 HCI_MGMT_VAR_LEN }, 8408 { remove_advertising, MGMT_REMOVE_ADVERTISING_SIZE }, 8409 { get_adv_size_info, MGMT_GET_ADV_SIZE_INFO_SIZE }, 8410 { start_limited_discovery, MGMT_START_DISCOVERY_SIZE }, 8411 { read_ext_controller_info,MGMT_READ_EXT_INFO_SIZE, 8412 HCI_MGMT_UNTRUSTED }, 8413 { set_appearance, MGMT_SET_APPEARANCE_SIZE }, 8414 { get_phy_configuration, MGMT_GET_PHY_CONFIGURATION_SIZE }, 8415 { set_phy_configuration, MGMT_SET_PHY_CONFIGURATION_SIZE }, 8416 { set_blocked_keys, MGMT_OP_SET_BLOCKED_KEYS_SIZE, 8417 HCI_MGMT_VAR_LEN }, 8418 { set_wideband_speech, MGMT_SETTING_SIZE }, 8419 { read_controller_cap, MGMT_READ_CONTROLLER_CAP_SIZE, 8420 HCI_MGMT_UNTRUSTED }, 8421 { read_exp_features_info, MGMT_READ_EXP_FEATURES_INFO_SIZE, 8422 HCI_MGMT_UNTRUSTED | 8423 HCI_MGMT_HDEV_OPTIONAL }, 8424 { set_exp_feature, MGMT_SET_EXP_FEATURE_SIZE, 8425 HCI_MGMT_VAR_LEN | 8426 HCI_MGMT_HDEV_OPTIONAL }, 8427 { read_def_system_config, MGMT_READ_DEF_SYSTEM_CONFIG_SIZE, 8428 HCI_MGMT_UNTRUSTED }, 8429 { set_def_system_config, MGMT_SET_DEF_SYSTEM_CONFIG_SIZE, 8430 HCI_MGMT_VAR_LEN }, 8431 { read_def_runtime_config, MGMT_READ_DEF_RUNTIME_CONFIG_SIZE, 8432 HCI_MGMT_UNTRUSTED }, 8433 { set_def_runtime_config, MGMT_SET_DEF_RUNTIME_CONFIG_SIZE, 8434 HCI_MGMT_VAR_LEN }, 8435 { get_device_flags, MGMT_GET_DEVICE_FLAGS_SIZE }, 8436 { set_device_flags, MGMT_SET_DEVICE_FLAGS_SIZE }, 8437 { read_adv_mon_features, MGMT_READ_ADV_MONITOR_FEATURES_SIZE }, 8438 { add_adv_patterns_monitor,MGMT_ADD_ADV_PATTERNS_MONITOR_SIZE, 8439 HCI_MGMT_VAR_LEN }, 8440 { remove_adv_monitor, MGMT_REMOVE_ADV_MONITOR_SIZE }, 8441 { add_ext_adv_params, MGMT_ADD_EXT_ADV_PARAMS_MIN_SIZE, 8442 HCI_MGMT_VAR_LEN }, 8443 { add_ext_adv_data, MGMT_ADD_EXT_ADV_DATA_SIZE, 8444 HCI_MGMT_VAR_LEN }, 8445 { add_adv_patterns_monitor_rssi, 8446 MGMT_ADD_ADV_PATTERNS_MONITOR_RSSI_SIZE, 8447 HCI_MGMT_VAR_LEN }, 8448 }; 8449 8450 void mgmt_index_added(struct hci_dev *hdev) 8451 { 8452 struct mgmt_ev_ext_index ev; 8453 8454 if (test_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks)) 8455 return; 8456 8457 switch (hdev->dev_type) { 8458 case HCI_PRIMARY: 8459 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) { 8460 mgmt_index_event(MGMT_EV_UNCONF_INDEX_ADDED, hdev, 8461 NULL, 0, HCI_MGMT_UNCONF_INDEX_EVENTS); 8462 ev.type = 0x01; 8463 } else { 8464 mgmt_index_event(MGMT_EV_INDEX_ADDED, hdev, NULL, 0, 8465 HCI_MGMT_INDEX_EVENTS); 8466 ev.type = 0x00; 8467 } 8468 break; 8469 case HCI_AMP: 8470 ev.type = 0x02; 8471 break; 8472 default: 8473 return; 8474 } 8475 8476 ev.bus = hdev->bus; 8477 8478 mgmt_index_event(MGMT_EV_EXT_INDEX_ADDED, hdev, &ev, sizeof(ev), 8479 HCI_MGMT_EXT_INDEX_EVENTS); 8480 } 8481 8482 void mgmt_index_removed(struct hci_dev *hdev) 8483 { 8484 struct mgmt_ev_ext_index ev; 8485 u8 status = MGMT_STATUS_INVALID_INDEX; 8486 8487 if (test_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks)) 8488 return; 8489 8490 switch (hdev->dev_type) { 8491 case HCI_PRIMARY: 8492 mgmt_pending_foreach(0, hdev, cmd_complete_rsp, &status); 8493 8494 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) { 8495 mgmt_index_event(MGMT_EV_UNCONF_INDEX_REMOVED, hdev, 8496 NULL, 0, HCI_MGMT_UNCONF_INDEX_EVENTS); 8497 ev.type = 0x01; 8498 } else { 8499 mgmt_index_event(MGMT_EV_INDEX_REMOVED, hdev, NULL, 0, 8500 HCI_MGMT_INDEX_EVENTS); 8501 ev.type = 0x00; 8502 } 8503 break; 8504 case HCI_AMP: 8505 ev.type = 0x02; 8506 break; 8507 default: 8508 return; 8509 } 8510 8511 ev.bus = hdev->bus; 8512 8513 mgmt_index_event(MGMT_EV_EXT_INDEX_REMOVED, hdev, &ev, sizeof(ev), 8514 HCI_MGMT_EXT_INDEX_EVENTS); 8515 } 8516 8517 /* This function requires the caller holds hdev->lock */ 8518 static void restart_le_actions(struct hci_dev *hdev) 8519 { 8520 struct hci_conn_params *p; 8521 8522 list_for_each_entry(p, &hdev->le_conn_params, list) { 8523 /* Needed for AUTO_OFF case where might not "really" 8524 * have been powered off. 8525 */ 8526 list_del_init(&p->action); 8527 8528 switch (p->auto_connect) { 8529 case HCI_AUTO_CONN_DIRECT: 8530 case HCI_AUTO_CONN_ALWAYS: 8531 list_add(&p->action, &hdev->pend_le_conns); 8532 break; 8533 case HCI_AUTO_CONN_REPORT: 8534 list_add(&p->action, &hdev->pend_le_reports); 8535 break; 8536 default: 8537 break; 8538 } 8539 } 8540 } 8541 8542 void mgmt_power_on(struct hci_dev *hdev, int err) 8543 { 8544 struct cmd_lookup match = { NULL, hdev }; 8545 8546 bt_dev_dbg(hdev, "err %d", err); 8547 8548 hci_dev_lock(hdev); 8549 8550 if (!err) { 8551 restart_le_actions(hdev); 8552 hci_update_background_scan(hdev); 8553 } 8554 8555 mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp, &match); 8556 8557 new_settings(hdev, match.sk); 8558 8559 if (match.sk) 8560 sock_put(match.sk); 8561 8562 hci_dev_unlock(hdev); 8563 } 8564 8565 void __mgmt_power_off(struct hci_dev *hdev) 8566 { 8567 struct cmd_lookup match = { NULL, hdev }; 8568 u8 status, zero_cod[] = { 0, 0, 0 }; 8569 8570 mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp, &match); 8571 8572 /* If the power off is because of hdev unregistration let 8573 * use the appropriate INVALID_INDEX status. Otherwise use 8574 * NOT_POWERED. We cover both scenarios here since later in 8575 * mgmt_index_removed() any hci_conn callbacks will have already 8576 * been triggered, potentially causing misleading DISCONNECTED 8577 * status responses. 8578 */ 8579 if (hci_dev_test_flag(hdev, HCI_UNREGISTER)) 8580 status = MGMT_STATUS_INVALID_INDEX; 8581 else 8582 status = MGMT_STATUS_NOT_POWERED; 8583 8584 mgmt_pending_foreach(0, hdev, cmd_complete_rsp, &status); 8585 8586 if (memcmp(hdev->dev_class, zero_cod, sizeof(zero_cod)) != 0) { 8587 mgmt_limited_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev, 8588 zero_cod, sizeof(zero_cod), 8589 HCI_MGMT_DEV_CLASS_EVENTS, NULL); 8590 ext_info_changed(hdev, NULL); 8591 } 8592 8593 new_settings(hdev, match.sk); 8594 8595 if (match.sk) 8596 sock_put(match.sk); 8597 } 8598 8599 void mgmt_set_powered_failed(struct hci_dev *hdev, int err) 8600 { 8601 struct mgmt_pending_cmd *cmd; 8602 u8 status; 8603 8604 cmd = pending_find(MGMT_OP_SET_POWERED, hdev); 8605 if (!cmd) 8606 return; 8607 8608 if (err == -ERFKILL) 8609 status = MGMT_STATUS_RFKILLED; 8610 else 8611 status = MGMT_STATUS_FAILED; 8612 8613 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_POWERED, status); 8614 8615 mgmt_pending_remove(cmd); 8616 } 8617 8618 void mgmt_new_link_key(struct hci_dev *hdev, struct link_key *key, 8619 bool persistent) 8620 { 8621 struct mgmt_ev_new_link_key ev; 8622 8623 memset(&ev, 0, sizeof(ev)); 8624 8625 ev.store_hint = persistent; 8626 bacpy(&ev.key.addr.bdaddr, &key->bdaddr); 8627 ev.key.addr.type = BDADDR_BREDR; 8628 ev.key.type = key->type; 8629 memcpy(ev.key.val, key->val, HCI_LINK_KEY_SIZE); 8630 ev.key.pin_len = key->pin_len; 8631 8632 mgmt_event(MGMT_EV_NEW_LINK_KEY, hdev, &ev, sizeof(ev), NULL); 8633 } 8634 8635 static u8 mgmt_ltk_type(struct smp_ltk *ltk) 8636 { 8637 switch (ltk->type) { 8638 case SMP_LTK: 8639 case SMP_LTK_SLAVE: 8640 if (ltk->authenticated) 8641 return MGMT_LTK_AUTHENTICATED; 8642 return MGMT_LTK_UNAUTHENTICATED; 8643 case SMP_LTK_P256: 8644 if (ltk->authenticated) 8645 return MGMT_LTK_P256_AUTH; 8646 return MGMT_LTK_P256_UNAUTH; 8647 case SMP_LTK_P256_DEBUG: 8648 return MGMT_LTK_P256_DEBUG; 8649 } 8650 8651 return MGMT_LTK_UNAUTHENTICATED; 8652 } 8653 8654 void mgmt_new_ltk(struct hci_dev *hdev, struct smp_ltk *key, bool persistent) 8655 { 8656 struct mgmt_ev_new_long_term_key ev; 8657 8658 memset(&ev, 0, sizeof(ev)); 8659 8660 /* Devices using resolvable or non-resolvable random addresses 8661 * without providing an identity resolving key don't require 8662 * to store long term keys. Their addresses will change the 8663 * next time around. 8664 * 8665 * Only when a remote device provides an identity address 8666 * make sure the long term key is stored. If the remote 8667 * identity is known, the long term keys are internally 8668 * mapped to the identity address. So allow static random 8669 * and public addresses here. 8670 */ 8671 if (key->bdaddr_type == ADDR_LE_DEV_RANDOM && 8672 (key->bdaddr.b[5] & 0xc0) != 0xc0) 8673 ev.store_hint = 0x00; 8674 else 8675 ev.store_hint = persistent; 8676 8677 bacpy(&ev.key.addr.bdaddr, &key->bdaddr); 8678 ev.key.addr.type = link_to_bdaddr(LE_LINK, key->bdaddr_type); 8679 ev.key.type = mgmt_ltk_type(key); 8680 ev.key.enc_size = key->enc_size; 8681 ev.key.ediv = key->ediv; 8682 ev.key.rand = key->rand; 8683 8684 if (key->type == SMP_LTK) 8685 ev.key.master = 1; 8686 8687 /* Make sure we copy only the significant bytes based on the 8688 * encryption key size, and set the rest of the value to zeroes. 8689 */ 8690 memcpy(ev.key.val, key->val, key->enc_size); 8691 memset(ev.key.val + key->enc_size, 0, 8692 sizeof(ev.key.val) - key->enc_size); 8693 8694 mgmt_event(MGMT_EV_NEW_LONG_TERM_KEY, hdev, &ev, sizeof(ev), NULL); 8695 } 8696 8697 void mgmt_new_irk(struct hci_dev *hdev, struct smp_irk *irk, bool persistent) 8698 { 8699 struct mgmt_ev_new_irk ev; 8700 8701 memset(&ev, 0, sizeof(ev)); 8702 8703 ev.store_hint = persistent; 8704 8705 bacpy(&ev.rpa, &irk->rpa); 8706 bacpy(&ev.irk.addr.bdaddr, &irk->bdaddr); 8707 ev.irk.addr.type = link_to_bdaddr(LE_LINK, irk->addr_type); 8708 memcpy(ev.irk.val, irk->val, sizeof(irk->val)); 8709 8710 mgmt_event(MGMT_EV_NEW_IRK, hdev, &ev, sizeof(ev), NULL); 8711 } 8712 8713 void mgmt_new_csrk(struct hci_dev *hdev, struct smp_csrk *csrk, 8714 bool persistent) 8715 { 8716 struct mgmt_ev_new_csrk ev; 8717 8718 memset(&ev, 0, sizeof(ev)); 8719 8720 /* Devices using resolvable or non-resolvable random addresses 8721 * without providing an identity resolving key don't require 8722 * to store signature resolving keys. Their addresses will change 8723 * the next time around. 8724 * 8725 * Only when a remote device provides an identity address 8726 * make sure the signature resolving key is stored. So allow 8727 * static random and public addresses here. 8728 */ 8729 if (csrk->bdaddr_type == ADDR_LE_DEV_RANDOM && 8730 (csrk->bdaddr.b[5] & 0xc0) != 0xc0) 8731 ev.store_hint = 0x00; 8732 else 8733 ev.store_hint = persistent; 8734 8735 bacpy(&ev.key.addr.bdaddr, &csrk->bdaddr); 8736 ev.key.addr.type = link_to_bdaddr(LE_LINK, csrk->bdaddr_type); 8737 ev.key.type = csrk->type; 8738 memcpy(ev.key.val, csrk->val, sizeof(csrk->val)); 8739 8740 mgmt_event(MGMT_EV_NEW_CSRK, hdev, &ev, sizeof(ev), NULL); 8741 } 8742 8743 void mgmt_new_conn_param(struct hci_dev *hdev, bdaddr_t *bdaddr, 8744 u8 bdaddr_type, u8 store_hint, u16 min_interval, 8745 u16 max_interval, u16 latency, u16 timeout) 8746 { 8747 struct mgmt_ev_new_conn_param ev; 8748 8749 if (!hci_is_identity_address(bdaddr, bdaddr_type)) 8750 return; 8751 8752 memset(&ev, 0, sizeof(ev)); 8753 bacpy(&ev.addr.bdaddr, bdaddr); 8754 ev.addr.type = link_to_bdaddr(LE_LINK, bdaddr_type); 8755 ev.store_hint = store_hint; 8756 ev.min_interval = cpu_to_le16(min_interval); 8757 ev.max_interval = cpu_to_le16(max_interval); 8758 ev.latency = cpu_to_le16(latency); 8759 ev.timeout = cpu_to_le16(timeout); 8760 8761 mgmt_event(MGMT_EV_NEW_CONN_PARAM, hdev, &ev, sizeof(ev), NULL); 8762 } 8763 8764 void mgmt_device_connected(struct hci_dev *hdev, struct hci_conn *conn, 8765 u32 flags, u8 *name, u8 name_len) 8766 { 8767 char buf[512]; 8768 struct mgmt_ev_device_connected *ev = (void *) buf; 8769 u16 eir_len = 0; 8770 8771 bacpy(&ev->addr.bdaddr, &conn->dst); 8772 ev->addr.type = link_to_bdaddr(conn->type, conn->dst_type); 8773 8774 ev->flags = __cpu_to_le32(flags); 8775 8776 /* We must ensure that the EIR Data fields are ordered and 8777 * unique. Keep it simple for now and avoid the problem by not 8778 * adding any BR/EDR data to the LE adv. 8779 */ 8780 if (conn->le_adv_data_len > 0) { 8781 memcpy(&ev->eir[eir_len], 8782 conn->le_adv_data, conn->le_adv_data_len); 8783 eir_len = conn->le_adv_data_len; 8784 } else { 8785 if (name_len > 0) 8786 eir_len = eir_append_data(ev->eir, 0, EIR_NAME_COMPLETE, 8787 name, name_len); 8788 8789 if (memcmp(conn->dev_class, "\0\0\0", 3) != 0) 8790 eir_len = eir_append_data(ev->eir, eir_len, 8791 EIR_CLASS_OF_DEV, 8792 conn->dev_class, 3); 8793 } 8794 8795 ev->eir_len = cpu_to_le16(eir_len); 8796 8797 mgmt_event(MGMT_EV_DEVICE_CONNECTED, hdev, buf, 8798 sizeof(*ev) + eir_len, NULL); 8799 } 8800 8801 static void disconnect_rsp(struct mgmt_pending_cmd *cmd, void *data) 8802 { 8803 struct sock **sk = data; 8804 8805 cmd->cmd_complete(cmd, 0); 8806 8807 *sk = cmd->sk; 8808 sock_hold(*sk); 8809 8810 mgmt_pending_remove(cmd); 8811 } 8812 8813 static void unpair_device_rsp(struct mgmt_pending_cmd *cmd, void *data) 8814 { 8815 struct hci_dev *hdev = data; 8816 struct mgmt_cp_unpair_device *cp = cmd->param; 8817 8818 device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, cmd->sk); 8819 8820 cmd->cmd_complete(cmd, 0); 8821 mgmt_pending_remove(cmd); 8822 } 8823 8824 bool mgmt_powering_down(struct hci_dev *hdev) 8825 { 8826 struct mgmt_pending_cmd *cmd; 8827 struct mgmt_mode *cp; 8828 8829 cmd = pending_find(MGMT_OP_SET_POWERED, hdev); 8830 if (!cmd) 8831 return false; 8832 8833 cp = cmd->param; 8834 if (!cp->val) 8835 return true; 8836 8837 return false; 8838 } 8839 8840 void mgmt_device_disconnected(struct hci_dev *hdev, bdaddr_t *bdaddr, 8841 u8 link_type, u8 addr_type, u8 reason, 8842 bool mgmt_connected) 8843 { 8844 struct mgmt_ev_device_disconnected ev; 8845 struct sock *sk = NULL; 8846 8847 /* The connection is still in hci_conn_hash so test for 1 8848 * instead of 0 to know if this is the last one. 8849 */ 8850 if (mgmt_powering_down(hdev) && hci_conn_count(hdev) == 1) { 8851 cancel_delayed_work(&hdev->power_off); 8852 queue_work(hdev->req_workqueue, &hdev->power_off.work); 8853 } 8854 8855 if (!mgmt_connected) 8856 return; 8857 8858 if (link_type != ACL_LINK && link_type != LE_LINK) 8859 return; 8860 8861 mgmt_pending_foreach(MGMT_OP_DISCONNECT, hdev, disconnect_rsp, &sk); 8862 8863 bacpy(&ev.addr.bdaddr, bdaddr); 8864 ev.addr.type = link_to_bdaddr(link_type, addr_type); 8865 ev.reason = reason; 8866 8867 /* Report disconnects due to suspend */ 8868 if (hdev->suspended) 8869 ev.reason = MGMT_DEV_DISCONN_LOCAL_HOST_SUSPEND; 8870 8871 mgmt_event(MGMT_EV_DEVICE_DISCONNECTED, hdev, &ev, sizeof(ev), sk); 8872 8873 if (sk) 8874 sock_put(sk); 8875 8876 mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, unpair_device_rsp, 8877 hdev); 8878 } 8879 8880 void mgmt_disconnect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr, 8881 u8 link_type, u8 addr_type, u8 status) 8882 { 8883 u8 bdaddr_type = link_to_bdaddr(link_type, addr_type); 8884 struct mgmt_cp_disconnect *cp; 8885 struct mgmt_pending_cmd *cmd; 8886 8887 mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, unpair_device_rsp, 8888 hdev); 8889 8890 cmd = pending_find(MGMT_OP_DISCONNECT, hdev); 8891 if (!cmd) 8892 return; 8893 8894 cp = cmd->param; 8895 8896 if (bacmp(bdaddr, &cp->addr.bdaddr)) 8897 return; 8898 8899 if (cp->addr.type != bdaddr_type) 8900 return; 8901 8902 cmd->cmd_complete(cmd, mgmt_status(status)); 8903 mgmt_pending_remove(cmd); 8904 } 8905 8906 void mgmt_connect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type, 8907 u8 addr_type, u8 status) 8908 { 8909 struct mgmt_ev_connect_failed ev; 8910 8911 /* The connection is still in hci_conn_hash so test for 1 8912 * instead of 0 to know if this is the last one. 8913 */ 8914 if (mgmt_powering_down(hdev) && hci_conn_count(hdev) == 1) { 8915 cancel_delayed_work(&hdev->power_off); 8916 queue_work(hdev->req_workqueue, &hdev->power_off.work); 8917 } 8918 8919 bacpy(&ev.addr.bdaddr, bdaddr); 8920 ev.addr.type = link_to_bdaddr(link_type, addr_type); 8921 ev.status = mgmt_status(status); 8922 8923 mgmt_event(MGMT_EV_CONNECT_FAILED, hdev, &ev, sizeof(ev), NULL); 8924 } 8925 8926 void mgmt_pin_code_request(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 secure) 8927 { 8928 struct mgmt_ev_pin_code_request ev; 8929 8930 bacpy(&ev.addr.bdaddr, bdaddr); 8931 ev.addr.type = BDADDR_BREDR; 8932 ev.secure = secure; 8933 8934 mgmt_event(MGMT_EV_PIN_CODE_REQUEST, hdev, &ev, sizeof(ev), NULL); 8935 } 8936 8937 void mgmt_pin_code_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr, 8938 u8 status) 8939 { 8940 struct mgmt_pending_cmd *cmd; 8941 8942 cmd = pending_find(MGMT_OP_PIN_CODE_REPLY, hdev); 8943 if (!cmd) 8944 return; 8945 8946 cmd->cmd_complete(cmd, mgmt_status(status)); 8947 mgmt_pending_remove(cmd); 8948 } 8949 8950 void mgmt_pin_code_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr, 8951 u8 status) 8952 { 8953 struct mgmt_pending_cmd *cmd; 8954 8955 cmd = pending_find(MGMT_OP_PIN_CODE_NEG_REPLY, hdev); 8956 if (!cmd) 8957 return; 8958 8959 cmd->cmd_complete(cmd, mgmt_status(status)); 8960 mgmt_pending_remove(cmd); 8961 } 8962 8963 int mgmt_user_confirm_request(struct hci_dev *hdev, bdaddr_t *bdaddr, 8964 u8 link_type, u8 addr_type, u32 value, 8965 u8 confirm_hint) 8966 { 8967 struct mgmt_ev_user_confirm_request ev; 8968 8969 bt_dev_dbg(hdev, "bdaddr %pMR", bdaddr); 8970 8971 bacpy(&ev.addr.bdaddr, bdaddr); 8972 ev.addr.type = link_to_bdaddr(link_type, addr_type); 8973 ev.confirm_hint = confirm_hint; 8974 ev.value = cpu_to_le32(value); 8975 8976 return mgmt_event(MGMT_EV_USER_CONFIRM_REQUEST, hdev, &ev, sizeof(ev), 8977 NULL); 8978 } 8979 8980 int mgmt_user_passkey_request(struct hci_dev *hdev, bdaddr_t *bdaddr, 8981 u8 link_type, u8 addr_type) 8982 { 8983 struct mgmt_ev_user_passkey_request ev; 8984 8985 bt_dev_dbg(hdev, "bdaddr %pMR", bdaddr); 8986 8987 bacpy(&ev.addr.bdaddr, bdaddr); 8988 ev.addr.type = link_to_bdaddr(link_type, addr_type); 8989 8990 return mgmt_event(MGMT_EV_USER_PASSKEY_REQUEST, hdev, &ev, sizeof(ev), 8991 NULL); 8992 } 8993 8994 static int user_pairing_resp_complete(struct hci_dev *hdev, bdaddr_t *bdaddr, 8995 u8 link_type, u8 addr_type, u8 status, 8996 u8 opcode) 8997 { 8998 struct mgmt_pending_cmd *cmd; 8999 9000 cmd = pending_find(opcode, hdev); 9001 if (!cmd) 9002 return -ENOENT; 9003 9004 cmd->cmd_complete(cmd, mgmt_status(status)); 9005 mgmt_pending_remove(cmd); 9006 9007 return 0; 9008 } 9009 9010 int mgmt_user_confirm_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr, 9011 u8 link_type, u8 addr_type, u8 status) 9012 { 9013 return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type, 9014 status, MGMT_OP_USER_CONFIRM_REPLY); 9015 } 9016 9017 int mgmt_user_confirm_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr, 9018 u8 link_type, u8 addr_type, u8 status) 9019 { 9020 return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type, 9021 status, 9022 MGMT_OP_USER_CONFIRM_NEG_REPLY); 9023 } 9024 9025 int mgmt_user_passkey_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr, 9026 u8 link_type, u8 addr_type, u8 status) 9027 { 9028 return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type, 9029 status, MGMT_OP_USER_PASSKEY_REPLY); 9030 } 9031 9032 int mgmt_user_passkey_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr, 9033 u8 link_type, u8 addr_type, u8 status) 9034 { 9035 return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type, 9036 status, 9037 MGMT_OP_USER_PASSKEY_NEG_REPLY); 9038 } 9039 9040 int mgmt_user_passkey_notify(struct hci_dev *hdev, bdaddr_t *bdaddr, 9041 u8 link_type, u8 addr_type, u32 passkey, 9042 u8 entered) 9043 { 9044 struct mgmt_ev_passkey_notify ev; 9045 9046 bt_dev_dbg(hdev, "bdaddr %pMR", bdaddr); 9047 9048 bacpy(&ev.addr.bdaddr, bdaddr); 9049 ev.addr.type = link_to_bdaddr(link_type, addr_type); 9050 ev.passkey = __cpu_to_le32(passkey); 9051 ev.entered = entered; 9052 9053 return mgmt_event(MGMT_EV_PASSKEY_NOTIFY, hdev, &ev, sizeof(ev), NULL); 9054 } 9055 9056 void mgmt_auth_failed(struct hci_conn *conn, u8 hci_status) 9057 { 9058 struct mgmt_ev_auth_failed ev; 9059 struct mgmt_pending_cmd *cmd; 9060 u8 status = mgmt_status(hci_status); 9061 9062 bacpy(&ev.addr.bdaddr, &conn->dst); 9063 ev.addr.type = link_to_bdaddr(conn->type, conn->dst_type); 9064 ev.status = status; 9065 9066 cmd = find_pairing(conn); 9067 9068 mgmt_event(MGMT_EV_AUTH_FAILED, conn->hdev, &ev, sizeof(ev), 9069 cmd ? cmd->sk : NULL); 9070 9071 if (cmd) { 9072 cmd->cmd_complete(cmd, status); 9073 mgmt_pending_remove(cmd); 9074 } 9075 } 9076 9077 void mgmt_auth_enable_complete(struct hci_dev *hdev, u8 status) 9078 { 9079 struct cmd_lookup match = { NULL, hdev }; 9080 bool changed; 9081 9082 if (status) { 9083 u8 mgmt_err = mgmt_status(status); 9084 mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev, 9085 cmd_status_rsp, &mgmt_err); 9086 return; 9087 } 9088 9089 if (test_bit(HCI_AUTH, &hdev->flags)) 9090 changed = !hci_dev_test_and_set_flag(hdev, HCI_LINK_SECURITY); 9091 else 9092 changed = hci_dev_test_and_clear_flag(hdev, HCI_LINK_SECURITY); 9093 9094 mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev, settings_rsp, 9095 &match); 9096 9097 if (changed) 9098 new_settings(hdev, match.sk); 9099 9100 if (match.sk) 9101 sock_put(match.sk); 9102 } 9103 9104 static void clear_eir(struct hci_request *req) 9105 { 9106 struct hci_dev *hdev = req->hdev; 9107 struct hci_cp_write_eir cp; 9108 9109 if (!lmp_ext_inq_capable(hdev)) 9110 return; 9111 9112 memset(hdev->eir, 0, sizeof(hdev->eir)); 9113 9114 memset(&cp, 0, sizeof(cp)); 9115 9116 hci_req_add(req, HCI_OP_WRITE_EIR, sizeof(cp), &cp); 9117 } 9118 9119 void mgmt_ssp_enable_complete(struct hci_dev *hdev, u8 enable, u8 status) 9120 { 9121 struct cmd_lookup match = { NULL, hdev }; 9122 struct hci_request req; 9123 bool changed = false; 9124 9125 if (status) { 9126 u8 mgmt_err = mgmt_status(status); 9127 9128 if (enable && hci_dev_test_and_clear_flag(hdev, 9129 HCI_SSP_ENABLED)) { 9130 hci_dev_clear_flag(hdev, HCI_HS_ENABLED); 9131 new_settings(hdev, NULL); 9132 } 9133 9134 mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev, cmd_status_rsp, 9135 &mgmt_err); 9136 return; 9137 } 9138 9139 if (enable) { 9140 changed = !hci_dev_test_and_set_flag(hdev, HCI_SSP_ENABLED); 9141 } else { 9142 changed = hci_dev_test_and_clear_flag(hdev, HCI_SSP_ENABLED); 9143 if (!changed) 9144 changed = hci_dev_test_and_clear_flag(hdev, 9145 HCI_HS_ENABLED); 9146 else 9147 hci_dev_clear_flag(hdev, HCI_HS_ENABLED); 9148 } 9149 9150 mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev, settings_rsp, &match); 9151 9152 if (changed) 9153 new_settings(hdev, match.sk); 9154 9155 if (match.sk) 9156 sock_put(match.sk); 9157 9158 hci_req_init(&req, hdev); 9159 9160 if (hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) { 9161 if (hci_dev_test_flag(hdev, HCI_USE_DEBUG_KEYS)) 9162 hci_req_add(&req, HCI_OP_WRITE_SSP_DEBUG_MODE, 9163 sizeof(enable), &enable); 9164 __hci_req_update_eir(&req); 9165 } else { 9166 clear_eir(&req); 9167 } 9168 9169 hci_req_run(&req, NULL); 9170 } 9171 9172 static void sk_lookup(struct mgmt_pending_cmd *cmd, void *data) 9173 { 9174 struct cmd_lookup *match = data; 9175 9176 if (match->sk == NULL) { 9177 match->sk = cmd->sk; 9178 sock_hold(match->sk); 9179 } 9180 } 9181 9182 void mgmt_set_class_of_dev_complete(struct hci_dev *hdev, u8 *dev_class, 9183 u8 status) 9184 { 9185 struct cmd_lookup match = { NULL, hdev, mgmt_status(status) }; 9186 9187 mgmt_pending_foreach(MGMT_OP_SET_DEV_CLASS, hdev, sk_lookup, &match); 9188 mgmt_pending_foreach(MGMT_OP_ADD_UUID, hdev, sk_lookup, &match); 9189 mgmt_pending_foreach(MGMT_OP_REMOVE_UUID, hdev, sk_lookup, &match); 9190 9191 if (!status) { 9192 mgmt_limited_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev, dev_class, 9193 3, HCI_MGMT_DEV_CLASS_EVENTS, NULL); 9194 ext_info_changed(hdev, NULL); 9195 } 9196 9197 if (match.sk) 9198 sock_put(match.sk); 9199 } 9200 9201 void mgmt_set_local_name_complete(struct hci_dev *hdev, u8 *name, u8 status) 9202 { 9203 struct mgmt_cp_set_local_name ev; 9204 struct mgmt_pending_cmd *cmd; 9205 9206 if (status) 9207 return; 9208 9209 memset(&ev, 0, sizeof(ev)); 9210 memcpy(ev.name, name, HCI_MAX_NAME_LENGTH); 9211 memcpy(ev.short_name, hdev->short_name, HCI_MAX_SHORT_NAME_LENGTH); 9212 9213 cmd = pending_find(MGMT_OP_SET_LOCAL_NAME, hdev); 9214 if (!cmd) { 9215 memcpy(hdev->dev_name, name, sizeof(hdev->dev_name)); 9216 9217 /* If this is a HCI command related to powering on the 9218 * HCI dev don't send any mgmt signals. 9219 */ 9220 if (pending_find(MGMT_OP_SET_POWERED, hdev)) 9221 return; 9222 } 9223 9224 mgmt_limited_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, &ev, sizeof(ev), 9225 HCI_MGMT_LOCAL_NAME_EVENTS, cmd ? cmd->sk : NULL); 9226 ext_info_changed(hdev, cmd ? cmd->sk : NULL); 9227 } 9228 9229 static inline bool has_uuid(u8 *uuid, u16 uuid_count, u8 (*uuids)[16]) 9230 { 9231 int i; 9232 9233 for (i = 0; i < uuid_count; i++) { 9234 if (!memcmp(uuid, uuids[i], 16)) 9235 return true; 9236 } 9237 9238 return false; 9239 } 9240 9241 static bool eir_has_uuids(u8 *eir, u16 eir_len, u16 uuid_count, u8 (*uuids)[16]) 9242 { 9243 u16 parsed = 0; 9244 9245 while (parsed < eir_len) { 9246 u8 field_len = eir[0]; 9247 u8 uuid[16]; 9248 int i; 9249 9250 if (field_len == 0) 9251 break; 9252 9253 if (eir_len - parsed < field_len + 1) 9254 break; 9255 9256 switch (eir[1]) { 9257 case EIR_UUID16_ALL: 9258 case EIR_UUID16_SOME: 9259 for (i = 0; i + 3 <= field_len; i += 2) { 9260 memcpy(uuid, bluetooth_base_uuid, 16); 9261 uuid[13] = eir[i + 3]; 9262 uuid[12] = eir[i + 2]; 9263 if (has_uuid(uuid, uuid_count, uuids)) 9264 return true; 9265 } 9266 break; 9267 case EIR_UUID32_ALL: 9268 case EIR_UUID32_SOME: 9269 for (i = 0; i + 5 <= field_len; i += 4) { 9270 memcpy(uuid, bluetooth_base_uuid, 16); 9271 uuid[15] = eir[i + 5]; 9272 uuid[14] = eir[i + 4]; 9273 uuid[13] = eir[i + 3]; 9274 uuid[12] = eir[i + 2]; 9275 if (has_uuid(uuid, uuid_count, uuids)) 9276 return true; 9277 } 9278 break; 9279 case EIR_UUID128_ALL: 9280 case EIR_UUID128_SOME: 9281 for (i = 0; i + 17 <= field_len; i += 16) { 9282 memcpy(uuid, eir + i + 2, 16); 9283 if (has_uuid(uuid, uuid_count, uuids)) 9284 return true; 9285 } 9286 break; 9287 } 9288 9289 parsed += field_len + 1; 9290 eir += field_len + 1; 9291 } 9292 9293 return false; 9294 } 9295 9296 static void restart_le_scan(struct hci_dev *hdev) 9297 { 9298 /* If controller is not scanning we are done. */ 9299 if (!hci_dev_test_flag(hdev, HCI_LE_SCAN)) 9300 return; 9301 9302 if (time_after(jiffies + DISCOV_LE_RESTART_DELAY, 9303 hdev->discovery.scan_start + 9304 hdev->discovery.scan_duration)) 9305 return; 9306 9307 queue_delayed_work(hdev->req_workqueue, &hdev->le_scan_restart, 9308 DISCOV_LE_RESTART_DELAY); 9309 } 9310 9311 static bool is_filter_match(struct hci_dev *hdev, s8 rssi, u8 *eir, 9312 u16 eir_len, u8 *scan_rsp, u8 scan_rsp_len) 9313 { 9314 /* If a RSSI threshold has been specified, and 9315 * HCI_QUIRK_STRICT_DUPLICATE_FILTER is not set, then all results with 9316 * a RSSI smaller than the RSSI threshold will be dropped. If the quirk 9317 * is set, let it through for further processing, as we might need to 9318 * restart the scan. 9319 * 9320 * For BR/EDR devices (pre 1.2) providing no RSSI during inquiry, 9321 * the results are also dropped. 9322 */ 9323 if (hdev->discovery.rssi != HCI_RSSI_INVALID && 9324 (rssi == HCI_RSSI_INVALID || 9325 (rssi < hdev->discovery.rssi && 9326 !test_bit(HCI_QUIRK_STRICT_DUPLICATE_FILTER, &hdev->quirks)))) 9327 return false; 9328 9329 if (hdev->discovery.uuid_count != 0) { 9330 /* If a list of UUIDs is provided in filter, results with no 9331 * matching UUID should be dropped. 9332 */ 9333 if (!eir_has_uuids(eir, eir_len, hdev->discovery.uuid_count, 9334 hdev->discovery.uuids) && 9335 !eir_has_uuids(scan_rsp, scan_rsp_len, 9336 hdev->discovery.uuid_count, 9337 hdev->discovery.uuids)) 9338 return false; 9339 } 9340 9341 /* If duplicate filtering does not report RSSI changes, then restart 9342 * scanning to ensure updated result with updated RSSI values. 9343 */ 9344 if (test_bit(HCI_QUIRK_STRICT_DUPLICATE_FILTER, &hdev->quirks)) { 9345 restart_le_scan(hdev); 9346 9347 /* Validate RSSI value against the RSSI threshold once more. */ 9348 if (hdev->discovery.rssi != HCI_RSSI_INVALID && 9349 rssi < hdev->discovery.rssi) 9350 return false; 9351 } 9352 9353 return true; 9354 } 9355 9356 void mgmt_device_found(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type, 9357 u8 addr_type, u8 *dev_class, s8 rssi, u32 flags, 9358 u8 *eir, u16 eir_len, u8 *scan_rsp, u8 scan_rsp_len) 9359 { 9360 char buf[512]; 9361 struct mgmt_ev_device_found *ev = (void *)buf; 9362 size_t ev_size; 9363 9364 /* Don't send events for a non-kernel initiated discovery. With 9365 * LE one exception is if we have pend_le_reports > 0 in which 9366 * case we're doing passive scanning and want these events. 9367 */ 9368 if (!hci_discovery_active(hdev)) { 9369 if (link_type == ACL_LINK) 9370 return; 9371 if (link_type == LE_LINK && 9372 list_empty(&hdev->pend_le_reports) && 9373 !hci_is_adv_monitoring(hdev)) { 9374 return; 9375 } 9376 } 9377 9378 if (hdev->discovery.result_filtering) { 9379 /* We are using service discovery */ 9380 if (!is_filter_match(hdev, rssi, eir, eir_len, scan_rsp, 9381 scan_rsp_len)) 9382 return; 9383 } 9384 9385 if (hdev->discovery.limited) { 9386 /* Check for limited discoverable bit */ 9387 if (dev_class) { 9388 if (!(dev_class[1] & 0x20)) 9389 return; 9390 } else { 9391 u8 *flags = eir_get_data(eir, eir_len, EIR_FLAGS, NULL); 9392 if (!flags || !(flags[0] & LE_AD_LIMITED)) 9393 return; 9394 } 9395 } 9396 9397 /* Make sure that the buffer is big enough. The 5 extra bytes 9398 * are for the potential CoD field. 9399 */ 9400 if (sizeof(*ev) + eir_len + scan_rsp_len + 5 > sizeof(buf)) 9401 return; 9402 9403 memset(buf, 0, sizeof(buf)); 9404 9405 /* In case of device discovery with BR/EDR devices (pre 1.2), the 9406 * RSSI value was reported as 0 when not available. This behavior 9407 * is kept when using device discovery. This is required for full 9408 * backwards compatibility with the API. 9409 * 9410 * However when using service discovery, the value 127 will be 9411 * returned when the RSSI is not available. 9412 */ 9413 if (rssi == HCI_RSSI_INVALID && !hdev->discovery.report_invalid_rssi && 9414 link_type == ACL_LINK) 9415 rssi = 0; 9416 9417 bacpy(&ev->addr.bdaddr, bdaddr); 9418 ev->addr.type = link_to_bdaddr(link_type, addr_type); 9419 ev->rssi = rssi; 9420 ev->flags = cpu_to_le32(flags); 9421 9422 if (eir_len > 0) 9423 /* Copy EIR or advertising data into event */ 9424 memcpy(ev->eir, eir, eir_len); 9425 9426 if (dev_class && !eir_get_data(ev->eir, eir_len, EIR_CLASS_OF_DEV, 9427 NULL)) 9428 eir_len = eir_append_data(ev->eir, eir_len, EIR_CLASS_OF_DEV, 9429 dev_class, 3); 9430 9431 if (scan_rsp_len > 0) 9432 /* Append scan response data to event */ 9433 memcpy(ev->eir + eir_len, scan_rsp, scan_rsp_len); 9434 9435 ev->eir_len = cpu_to_le16(eir_len + scan_rsp_len); 9436 ev_size = sizeof(*ev) + eir_len + scan_rsp_len; 9437 9438 mgmt_event(MGMT_EV_DEVICE_FOUND, hdev, ev, ev_size, NULL); 9439 } 9440 9441 void mgmt_remote_name(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type, 9442 u8 addr_type, s8 rssi, u8 *name, u8 name_len) 9443 { 9444 struct mgmt_ev_device_found *ev; 9445 char buf[sizeof(*ev) + HCI_MAX_NAME_LENGTH + 2]; 9446 u16 eir_len; 9447 9448 ev = (struct mgmt_ev_device_found *) buf; 9449 9450 memset(buf, 0, sizeof(buf)); 9451 9452 bacpy(&ev->addr.bdaddr, bdaddr); 9453 ev->addr.type = link_to_bdaddr(link_type, addr_type); 9454 ev->rssi = rssi; 9455 9456 eir_len = eir_append_data(ev->eir, 0, EIR_NAME_COMPLETE, name, 9457 name_len); 9458 9459 ev->eir_len = cpu_to_le16(eir_len); 9460 9461 mgmt_event(MGMT_EV_DEVICE_FOUND, hdev, ev, sizeof(*ev) + eir_len, NULL); 9462 } 9463 9464 void mgmt_discovering(struct hci_dev *hdev, u8 discovering) 9465 { 9466 struct mgmt_ev_discovering ev; 9467 9468 bt_dev_dbg(hdev, "discovering %u", discovering); 9469 9470 memset(&ev, 0, sizeof(ev)); 9471 ev.type = hdev->discovery.type; 9472 ev.discovering = discovering; 9473 9474 mgmt_event(MGMT_EV_DISCOVERING, hdev, &ev, sizeof(ev), NULL); 9475 } 9476 9477 void mgmt_suspending(struct hci_dev *hdev, u8 state) 9478 { 9479 struct mgmt_ev_controller_suspend ev; 9480 9481 ev.suspend_state = state; 9482 mgmt_event(MGMT_EV_CONTROLLER_SUSPEND, hdev, &ev, sizeof(ev), NULL); 9483 } 9484 9485 void mgmt_resuming(struct hci_dev *hdev, u8 reason, bdaddr_t *bdaddr, 9486 u8 addr_type) 9487 { 9488 struct mgmt_ev_controller_resume ev; 9489 9490 ev.wake_reason = reason; 9491 if (bdaddr) { 9492 bacpy(&ev.addr.bdaddr, bdaddr); 9493 ev.addr.type = addr_type; 9494 } else { 9495 memset(&ev.addr, 0, sizeof(ev.addr)); 9496 } 9497 9498 mgmt_event(MGMT_EV_CONTROLLER_RESUME, hdev, &ev, sizeof(ev), NULL); 9499 } 9500 9501 static struct hci_mgmt_chan chan = { 9502 .channel = HCI_CHANNEL_CONTROL, 9503 .handler_count = ARRAY_SIZE(mgmt_handlers), 9504 .handlers = mgmt_handlers, 9505 .hdev_init = mgmt_init_hdev, 9506 }; 9507 9508 int mgmt_init(void) 9509 { 9510 return hci_mgmt_chan_register(&chan); 9511 } 9512 9513 void mgmt_exit(void) 9514 { 9515 hci_mgmt_chan_unregister(&chan); 9516 } 9517