1 // SPDX-License-Identifier: GPL-2.0 2 /* 3 BlueZ - Bluetooth protocol stack for Linux 4 5 Copyright (C) 2010 Nokia Corporation 6 Copyright (C) 2011-2012 Intel Corporation 7 8 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS 9 OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 10 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS. 11 IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY 12 CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES 13 WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN 14 ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF 15 OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. 16 17 ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS, 18 COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS 19 SOFTWARE IS DISCLAIMED. 20 */ 21 22 /* Bluetooth HCI Management interface */ 23 24 #include <linux/module.h> 25 #include <linux/unaligned.h> 26 27 #include <net/bluetooth/bluetooth.h> 28 #include <net/bluetooth/hci_core.h> 29 #include <net/bluetooth/hci_sock.h> 30 #include <net/bluetooth/l2cap.h> 31 #include <net/bluetooth/mgmt.h> 32 33 #include "smp.h" 34 #include "mgmt_util.h" 35 #include "mgmt_config.h" 36 #include "msft.h" 37 #include "eir.h" 38 #include "aosp.h" 39 40 #define MGMT_VERSION 1 41 #define MGMT_REVISION 23 42 43 static const u16 mgmt_commands[] = { 44 MGMT_OP_READ_INDEX_LIST, 45 MGMT_OP_READ_INFO, 46 MGMT_OP_SET_POWERED, 47 MGMT_OP_SET_DISCOVERABLE, 48 MGMT_OP_SET_CONNECTABLE, 49 MGMT_OP_SET_FAST_CONNECTABLE, 50 MGMT_OP_SET_BONDABLE, 51 MGMT_OP_SET_LINK_SECURITY, 52 MGMT_OP_SET_SSP, 53 MGMT_OP_SET_HS, 54 MGMT_OP_SET_LE, 55 MGMT_OP_SET_DEV_CLASS, 56 MGMT_OP_SET_LOCAL_NAME, 57 MGMT_OP_ADD_UUID, 58 MGMT_OP_REMOVE_UUID, 59 MGMT_OP_LOAD_LINK_KEYS, 60 MGMT_OP_LOAD_LONG_TERM_KEYS, 61 MGMT_OP_DISCONNECT, 62 MGMT_OP_GET_CONNECTIONS, 63 MGMT_OP_PIN_CODE_REPLY, 64 MGMT_OP_PIN_CODE_NEG_REPLY, 65 MGMT_OP_SET_IO_CAPABILITY, 66 MGMT_OP_PAIR_DEVICE, 67 MGMT_OP_CANCEL_PAIR_DEVICE, 68 MGMT_OP_UNPAIR_DEVICE, 69 MGMT_OP_USER_CONFIRM_REPLY, 70 MGMT_OP_USER_CONFIRM_NEG_REPLY, 71 MGMT_OP_USER_PASSKEY_REPLY, 72 MGMT_OP_USER_PASSKEY_NEG_REPLY, 73 MGMT_OP_READ_LOCAL_OOB_DATA, 74 MGMT_OP_ADD_REMOTE_OOB_DATA, 75 MGMT_OP_REMOVE_REMOTE_OOB_DATA, 76 MGMT_OP_START_DISCOVERY, 77 MGMT_OP_STOP_DISCOVERY, 78 MGMT_OP_CONFIRM_NAME, 79 MGMT_OP_BLOCK_DEVICE, 80 MGMT_OP_UNBLOCK_DEVICE, 81 MGMT_OP_SET_DEVICE_ID, 82 MGMT_OP_SET_ADVERTISING, 83 MGMT_OP_SET_BREDR, 84 MGMT_OP_SET_STATIC_ADDRESS, 85 MGMT_OP_SET_SCAN_PARAMS, 86 MGMT_OP_SET_SECURE_CONN, 87 MGMT_OP_SET_DEBUG_KEYS, 88 MGMT_OP_SET_PRIVACY, 89 MGMT_OP_LOAD_IRKS, 90 MGMT_OP_GET_CONN_INFO, 91 MGMT_OP_GET_CLOCK_INFO, 92 MGMT_OP_ADD_DEVICE, 93 MGMT_OP_REMOVE_DEVICE, 94 MGMT_OP_LOAD_CONN_PARAM, 95 MGMT_OP_READ_UNCONF_INDEX_LIST, 96 MGMT_OP_READ_CONFIG_INFO, 97 MGMT_OP_SET_EXTERNAL_CONFIG, 98 MGMT_OP_SET_PUBLIC_ADDRESS, 99 MGMT_OP_START_SERVICE_DISCOVERY, 100 MGMT_OP_READ_LOCAL_OOB_EXT_DATA, 101 MGMT_OP_READ_EXT_INDEX_LIST, 102 MGMT_OP_READ_ADV_FEATURES, 103 MGMT_OP_ADD_ADVERTISING, 104 MGMT_OP_REMOVE_ADVERTISING, 105 MGMT_OP_GET_ADV_SIZE_INFO, 106 MGMT_OP_START_LIMITED_DISCOVERY, 107 MGMT_OP_READ_EXT_INFO, 108 MGMT_OP_SET_APPEARANCE, 109 MGMT_OP_GET_PHY_CONFIGURATION, 110 MGMT_OP_SET_PHY_CONFIGURATION, 111 MGMT_OP_SET_BLOCKED_KEYS, 112 MGMT_OP_SET_WIDEBAND_SPEECH, 113 MGMT_OP_READ_CONTROLLER_CAP, 114 MGMT_OP_READ_EXP_FEATURES_INFO, 115 MGMT_OP_SET_EXP_FEATURE, 116 MGMT_OP_READ_DEF_SYSTEM_CONFIG, 117 MGMT_OP_SET_DEF_SYSTEM_CONFIG, 118 MGMT_OP_READ_DEF_RUNTIME_CONFIG, 119 MGMT_OP_SET_DEF_RUNTIME_CONFIG, 120 MGMT_OP_GET_DEVICE_FLAGS, 121 MGMT_OP_SET_DEVICE_FLAGS, 122 MGMT_OP_READ_ADV_MONITOR_FEATURES, 123 MGMT_OP_ADD_ADV_PATTERNS_MONITOR, 124 MGMT_OP_REMOVE_ADV_MONITOR, 125 MGMT_OP_ADD_EXT_ADV_PARAMS, 126 MGMT_OP_ADD_EXT_ADV_DATA, 127 MGMT_OP_ADD_ADV_PATTERNS_MONITOR_RSSI, 128 MGMT_OP_SET_MESH_RECEIVER, 129 MGMT_OP_MESH_READ_FEATURES, 130 MGMT_OP_MESH_SEND, 131 MGMT_OP_MESH_SEND_CANCEL, 132 MGMT_OP_HCI_CMD_SYNC, 133 }; 134 135 static const u16 mgmt_events[] = { 136 MGMT_EV_CONTROLLER_ERROR, 137 MGMT_EV_INDEX_ADDED, 138 MGMT_EV_INDEX_REMOVED, 139 MGMT_EV_NEW_SETTINGS, 140 MGMT_EV_CLASS_OF_DEV_CHANGED, 141 MGMT_EV_LOCAL_NAME_CHANGED, 142 MGMT_EV_NEW_LINK_KEY, 143 MGMT_EV_NEW_LONG_TERM_KEY, 144 MGMT_EV_DEVICE_CONNECTED, 145 MGMT_EV_DEVICE_DISCONNECTED, 146 MGMT_EV_CONNECT_FAILED, 147 MGMT_EV_PIN_CODE_REQUEST, 148 MGMT_EV_USER_CONFIRM_REQUEST, 149 MGMT_EV_USER_PASSKEY_REQUEST, 150 MGMT_EV_AUTH_FAILED, 151 MGMT_EV_DEVICE_FOUND, 152 MGMT_EV_DISCOVERING, 153 MGMT_EV_DEVICE_BLOCKED, 154 MGMT_EV_DEVICE_UNBLOCKED, 155 MGMT_EV_DEVICE_UNPAIRED, 156 MGMT_EV_PASSKEY_NOTIFY, 157 MGMT_EV_NEW_IRK, 158 MGMT_EV_NEW_CSRK, 159 MGMT_EV_DEVICE_ADDED, 160 MGMT_EV_DEVICE_REMOVED, 161 MGMT_EV_NEW_CONN_PARAM, 162 MGMT_EV_UNCONF_INDEX_ADDED, 163 MGMT_EV_UNCONF_INDEX_REMOVED, 164 MGMT_EV_NEW_CONFIG_OPTIONS, 165 MGMT_EV_EXT_INDEX_ADDED, 166 MGMT_EV_EXT_INDEX_REMOVED, 167 MGMT_EV_LOCAL_OOB_DATA_UPDATED, 168 MGMT_EV_ADVERTISING_ADDED, 169 MGMT_EV_ADVERTISING_REMOVED, 170 MGMT_EV_EXT_INFO_CHANGED, 171 MGMT_EV_PHY_CONFIGURATION_CHANGED, 172 MGMT_EV_EXP_FEATURE_CHANGED, 173 MGMT_EV_DEVICE_FLAGS_CHANGED, 174 MGMT_EV_ADV_MONITOR_ADDED, 175 MGMT_EV_ADV_MONITOR_REMOVED, 176 MGMT_EV_CONTROLLER_SUSPEND, 177 MGMT_EV_CONTROLLER_RESUME, 178 MGMT_EV_ADV_MONITOR_DEVICE_FOUND, 179 MGMT_EV_ADV_MONITOR_DEVICE_LOST, 180 }; 181 182 static const u16 mgmt_untrusted_commands[] = { 183 MGMT_OP_READ_INDEX_LIST, 184 MGMT_OP_READ_INFO, 185 MGMT_OP_READ_UNCONF_INDEX_LIST, 186 MGMT_OP_READ_CONFIG_INFO, 187 MGMT_OP_READ_EXT_INDEX_LIST, 188 MGMT_OP_READ_EXT_INFO, 189 MGMT_OP_READ_CONTROLLER_CAP, 190 MGMT_OP_READ_EXP_FEATURES_INFO, 191 MGMT_OP_READ_DEF_SYSTEM_CONFIG, 192 MGMT_OP_READ_DEF_RUNTIME_CONFIG, 193 }; 194 195 static const u16 mgmt_untrusted_events[] = { 196 MGMT_EV_INDEX_ADDED, 197 MGMT_EV_INDEX_REMOVED, 198 MGMT_EV_NEW_SETTINGS, 199 MGMT_EV_CLASS_OF_DEV_CHANGED, 200 MGMT_EV_LOCAL_NAME_CHANGED, 201 MGMT_EV_UNCONF_INDEX_ADDED, 202 MGMT_EV_UNCONF_INDEX_REMOVED, 203 MGMT_EV_NEW_CONFIG_OPTIONS, 204 MGMT_EV_EXT_INDEX_ADDED, 205 MGMT_EV_EXT_INDEX_REMOVED, 206 MGMT_EV_EXT_INFO_CHANGED, 207 MGMT_EV_EXP_FEATURE_CHANGED, 208 }; 209 210 #define CACHE_TIMEOUT secs_to_jiffies(2) 211 212 #define ZERO_KEY "\x00\x00\x00\x00\x00\x00\x00\x00" \ 213 "\x00\x00\x00\x00\x00\x00\x00\x00" 214 215 /* HCI to MGMT error code conversion table */ 216 static const u8 mgmt_status_table[] = { 217 MGMT_STATUS_SUCCESS, 218 MGMT_STATUS_UNKNOWN_COMMAND, /* Unknown Command */ 219 MGMT_STATUS_NOT_CONNECTED, /* No Connection */ 220 MGMT_STATUS_FAILED, /* Hardware Failure */ 221 MGMT_STATUS_CONNECT_FAILED, /* Page Timeout */ 222 MGMT_STATUS_AUTH_FAILED, /* Authentication Failed */ 223 MGMT_STATUS_AUTH_FAILED, /* PIN or Key Missing */ 224 MGMT_STATUS_NO_RESOURCES, /* Memory Full */ 225 MGMT_STATUS_TIMEOUT, /* Connection Timeout */ 226 MGMT_STATUS_NO_RESOURCES, /* Max Number of Connections */ 227 MGMT_STATUS_NO_RESOURCES, /* Max Number of SCO Connections */ 228 MGMT_STATUS_ALREADY_CONNECTED, /* ACL Connection Exists */ 229 MGMT_STATUS_BUSY, /* Command Disallowed */ 230 MGMT_STATUS_NO_RESOURCES, /* Rejected Limited Resources */ 231 MGMT_STATUS_REJECTED, /* Rejected Security */ 232 MGMT_STATUS_REJECTED, /* Rejected Personal */ 233 MGMT_STATUS_TIMEOUT, /* Host Timeout */ 234 MGMT_STATUS_NOT_SUPPORTED, /* Unsupported Feature */ 235 MGMT_STATUS_INVALID_PARAMS, /* Invalid Parameters */ 236 MGMT_STATUS_DISCONNECTED, /* OE User Ended Connection */ 237 MGMT_STATUS_NO_RESOURCES, /* OE Low Resources */ 238 MGMT_STATUS_DISCONNECTED, /* OE Power Off */ 239 MGMT_STATUS_DISCONNECTED, /* Connection Terminated */ 240 MGMT_STATUS_BUSY, /* Repeated Attempts */ 241 MGMT_STATUS_REJECTED, /* Pairing Not Allowed */ 242 MGMT_STATUS_FAILED, /* Unknown LMP PDU */ 243 MGMT_STATUS_NOT_SUPPORTED, /* Unsupported Remote Feature */ 244 MGMT_STATUS_REJECTED, /* SCO Offset Rejected */ 245 MGMT_STATUS_REJECTED, /* SCO Interval Rejected */ 246 MGMT_STATUS_REJECTED, /* Air Mode Rejected */ 247 MGMT_STATUS_INVALID_PARAMS, /* Invalid LMP Parameters */ 248 MGMT_STATUS_FAILED, /* Unspecified Error */ 249 MGMT_STATUS_NOT_SUPPORTED, /* Unsupported LMP Parameter Value */ 250 MGMT_STATUS_FAILED, /* Role Change Not Allowed */ 251 MGMT_STATUS_TIMEOUT, /* LMP Response Timeout */ 252 MGMT_STATUS_FAILED, /* LMP Error Transaction Collision */ 253 MGMT_STATUS_FAILED, /* LMP PDU Not Allowed */ 254 MGMT_STATUS_REJECTED, /* Encryption Mode Not Accepted */ 255 MGMT_STATUS_FAILED, /* Unit Link Key Used */ 256 MGMT_STATUS_NOT_SUPPORTED, /* QoS Not Supported */ 257 MGMT_STATUS_TIMEOUT, /* Instant Passed */ 258 MGMT_STATUS_NOT_SUPPORTED, /* Pairing Not Supported */ 259 MGMT_STATUS_FAILED, /* Transaction Collision */ 260 MGMT_STATUS_FAILED, /* Reserved for future use */ 261 MGMT_STATUS_INVALID_PARAMS, /* Unacceptable Parameter */ 262 MGMT_STATUS_REJECTED, /* QoS Rejected */ 263 MGMT_STATUS_NOT_SUPPORTED, /* Classification Not Supported */ 264 MGMT_STATUS_REJECTED, /* Insufficient Security */ 265 MGMT_STATUS_INVALID_PARAMS, /* Parameter Out Of Range */ 266 MGMT_STATUS_FAILED, /* Reserved for future use */ 267 MGMT_STATUS_BUSY, /* Role Switch Pending */ 268 MGMT_STATUS_FAILED, /* Reserved for future use */ 269 MGMT_STATUS_FAILED, /* Slot Violation */ 270 MGMT_STATUS_FAILED, /* Role Switch Failed */ 271 MGMT_STATUS_INVALID_PARAMS, /* EIR Too Large */ 272 MGMT_STATUS_NOT_SUPPORTED, /* Simple Pairing Not Supported */ 273 MGMT_STATUS_BUSY, /* Host Busy Pairing */ 274 MGMT_STATUS_REJECTED, /* Rejected, No Suitable Channel */ 275 MGMT_STATUS_BUSY, /* Controller Busy */ 276 MGMT_STATUS_INVALID_PARAMS, /* Unsuitable Connection Interval */ 277 MGMT_STATUS_TIMEOUT, /* Directed Advertising Timeout */ 278 MGMT_STATUS_AUTH_FAILED, /* Terminated Due to MIC Failure */ 279 MGMT_STATUS_CONNECT_FAILED, /* Connection Establishment Failed */ 280 MGMT_STATUS_CONNECT_FAILED, /* MAC Connection Failed */ 281 }; 282 283 static u8 mgmt_errno_status(int err) 284 { 285 switch (err) { 286 case 0: 287 return MGMT_STATUS_SUCCESS; 288 case -EPERM: 289 return MGMT_STATUS_REJECTED; 290 case -EINVAL: 291 return MGMT_STATUS_INVALID_PARAMS; 292 case -EOPNOTSUPP: 293 return MGMT_STATUS_NOT_SUPPORTED; 294 case -EBUSY: 295 return MGMT_STATUS_BUSY; 296 case -ETIMEDOUT: 297 return MGMT_STATUS_AUTH_FAILED; 298 case -ENOMEM: 299 return MGMT_STATUS_NO_RESOURCES; 300 case -EISCONN: 301 return MGMT_STATUS_ALREADY_CONNECTED; 302 case -ENOTCONN: 303 return MGMT_STATUS_DISCONNECTED; 304 } 305 306 return MGMT_STATUS_FAILED; 307 } 308 309 static u8 mgmt_status(int err) 310 { 311 if (err < 0) 312 return mgmt_errno_status(err); 313 314 if (err < ARRAY_SIZE(mgmt_status_table)) 315 return mgmt_status_table[err]; 316 317 return MGMT_STATUS_FAILED; 318 } 319 320 static int mgmt_index_event(u16 event, struct hci_dev *hdev, void *data, 321 u16 len, int flag) 322 { 323 return mgmt_send_event(event, hdev, HCI_CHANNEL_CONTROL, data, len, 324 flag, NULL); 325 } 326 327 static int mgmt_limited_event(u16 event, struct hci_dev *hdev, void *data, 328 u16 len, int flag, struct sock *skip_sk) 329 { 330 return mgmt_send_event(event, hdev, HCI_CHANNEL_CONTROL, data, len, 331 flag, skip_sk); 332 } 333 334 static int mgmt_event(u16 event, struct hci_dev *hdev, void *data, u16 len, 335 struct sock *skip_sk) 336 { 337 return mgmt_send_event(event, hdev, HCI_CHANNEL_CONTROL, data, len, 338 HCI_SOCK_TRUSTED, skip_sk); 339 } 340 341 static int mgmt_event_skb(struct sk_buff *skb, struct sock *skip_sk) 342 { 343 return mgmt_send_event_skb(HCI_CHANNEL_CONTROL, skb, HCI_SOCK_TRUSTED, 344 skip_sk); 345 } 346 347 static u8 le_addr_type(u8 mgmt_addr_type) 348 { 349 if (mgmt_addr_type == BDADDR_LE_PUBLIC) 350 return ADDR_LE_DEV_PUBLIC; 351 else 352 return ADDR_LE_DEV_RANDOM; 353 } 354 355 void mgmt_fill_version_info(void *ver) 356 { 357 struct mgmt_rp_read_version *rp = ver; 358 359 rp->version = MGMT_VERSION; 360 rp->revision = cpu_to_le16(MGMT_REVISION); 361 } 362 363 static int read_version(struct sock *sk, struct hci_dev *hdev, void *data, 364 u16 data_len) 365 { 366 struct mgmt_rp_read_version rp; 367 368 bt_dev_dbg(hdev, "sock %p", sk); 369 370 mgmt_fill_version_info(&rp); 371 372 return mgmt_cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_VERSION, 0, 373 &rp, sizeof(rp)); 374 } 375 376 static int read_commands(struct sock *sk, struct hci_dev *hdev, void *data, 377 u16 data_len) 378 { 379 struct mgmt_rp_read_commands *rp; 380 u16 num_commands, num_events; 381 size_t rp_size; 382 int i, err; 383 384 bt_dev_dbg(hdev, "sock %p", sk); 385 386 if (hci_sock_test_flag(sk, HCI_SOCK_TRUSTED)) { 387 num_commands = ARRAY_SIZE(mgmt_commands); 388 num_events = ARRAY_SIZE(mgmt_events); 389 } else { 390 num_commands = ARRAY_SIZE(mgmt_untrusted_commands); 391 num_events = ARRAY_SIZE(mgmt_untrusted_events); 392 } 393 394 rp_size = sizeof(*rp) + ((num_commands + num_events) * sizeof(u16)); 395 396 rp = kmalloc(rp_size, GFP_KERNEL); 397 if (!rp) 398 return -ENOMEM; 399 400 rp->num_commands = cpu_to_le16(num_commands); 401 rp->num_events = cpu_to_le16(num_events); 402 403 if (hci_sock_test_flag(sk, HCI_SOCK_TRUSTED)) { 404 __le16 *opcode = rp->opcodes; 405 406 for (i = 0; i < num_commands; i++, opcode++) 407 put_unaligned_le16(mgmt_commands[i], opcode); 408 409 for (i = 0; i < num_events; i++, opcode++) 410 put_unaligned_le16(mgmt_events[i], opcode); 411 } else { 412 __le16 *opcode = rp->opcodes; 413 414 for (i = 0; i < num_commands; i++, opcode++) 415 put_unaligned_le16(mgmt_untrusted_commands[i], opcode); 416 417 for (i = 0; i < num_events; i++, opcode++) 418 put_unaligned_le16(mgmt_untrusted_events[i], opcode); 419 } 420 421 err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_COMMANDS, 0, 422 rp, rp_size); 423 kfree(rp); 424 425 return err; 426 } 427 428 static int read_index_list(struct sock *sk, struct hci_dev *hdev, void *data, 429 u16 data_len) 430 { 431 struct mgmt_rp_read_index_list *rp; 432 struct hci_dev *d; 433 size_t rp_len; 434 u16 count; 435 int err; 436 437 bt_dev_dbg(hdev, "sock %p", sk); 438 439 read_lock(&hci_dev_list_lock); 440 441 count = 0; 442 list_for_each_entry(d, &hci_dev_list, list) { 443 if (!hci_dev_test_flag(d, HCI_UNCONFIGURED)) 444 count++; 445 } 446 447 rp_len = sizeof(*rp) + (2 * count); 448 rp = kmalloc(rp_len, GFP_ATOMIC); 449 if (!rp) { 450 read_unlock(&hci_dev_list_lock); 451 return -ENOMEM; 452 } 453 454 count = 0; 455 list_for_each_entry(d, &hci_dev_list, list) { 456 if (hci_dev_test_flag(d, HCI_SETUP) || 457 hci_dev_test_flag(d, HCI_CONFIG) || 458 hci_dev_test_flag(d, HCI_USER_CHANNEL)) 459 continue; 460 461 /* Devices marked as raw-only are neither configured 462 * nor unconfigured controllers. 463 */ 464 if (hci_test_quirk(d, HCI_QUIRK_RAW_DEVICE)) 465 continue; 466 467 if (!hci_dev_test_flag(d, HCI_UNCONFIGURED)) { 468 rp->index[count++] = cpu_to_le16(d->id); 469 bt_dev_dbg(hdev, "Added hci%u", d->id); 470 } 471 } 472 473 rp->num_controllers = cpu_to_le16(count); 474 rp_len = sizeof(*rp) + (2 * count); 475 476 read_unlock(&hci_dev_list_lock); 477 478 err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_INDEX_LIST, 479 0, rp, rp_len); 480 481 kfree(rp); 482 483 return err; 484 } 485 486 static int read_unconf_index_list(struct sock *sk, struct hci_dev *hdev, 487 void *data, u16 data_len) 488 { 489 struct mgmt_rp_read_unconf_index_list *rp; 490 struct hci_dev *d; 491 size_t rp_len; 492 u16 count; 493 int err; 494 495 bt_dev_dbg(hdev, "sock %p", sk); 496 497 read_lock(&hci_dev_list_lock); 498 499 count = 0; 500 list_for_each_entry(d, &hci_dev_list, list) { 501 if (hci_dev_test_flag(d, HCI_UNCONFIGURED)) 502 count++; 503 } 504 505 rp_len = sizeof(*rp) + (2 * count); 506 rp = kmalloc(rp_len, GFP_ATOMIC); 507 if (!rp) { 508 read_unlock(&hci_dev_list_lock); 509 return -ENOMEM; 510 } 511 512 count = 0; 513 list_for_each_entry(d, &hci_dev_list, list) { 514 if (hci_dev_test_flag(d, HCI_SETUP) || 515 hci_dev_test_flag(d, HCI_CONFIG) || 516 hci_dev_test_flag(d, HCI_USER_CHANNEL)) 517 continue; 518 519 /* Devices marked as raw-only are neither configured 520 * nor unconfigured controllers. 521 */ 522 if (hci_test_quirk(d, HCI_QUIRK_RAW_DEVICE)) 523 continue; 524 525 if (hci_dev_test_flag(d, HCI_UNCONFIGURED)) { 526 rp->index[count++] = cpu_to_le16(d->id); 527 bt_dev_dbg(hdev, "Added hci%u", d->id); 528 } 529 } 530 531 rp->num_controllers = cpu_to_le16(count); 532 rp_len = sizeof(*rp) + (2 * count); 533 534 read_unlock(&hci_dev_list_lock); 535 536 err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE, 537 MGMT_OP_READ_UNCONF_INDEX_LIST, 0, rp, rp_len); 538 539 kfree(rp); 540 541 return err; 542 } 543 544 static int read_ext_index_list(struct sock *sk, struct hci_dev *hdev, 545 void *data, u16 data_len) 546 { 547 struct mgmt_rp_read_ext_index_list *rp; 548 struct hci_dev *d; 549 u16 count; 550 int err; 551 552 bt_dev_dbg(hdev, "sock %p", sk); 553 554 read_lock(&hci_dev_list_lock); 555 556 count = 0; 557 list_for_each_entry(d, &hci_dev_list, list) 558 count++; 559 560 rp = kmalloc_flex(*rp, entry, count, GFP_ATOMIC); 561 if (!rp) { 562 read_unlock(&hci_dev_list_lock); 563 return -ENOMEM; 564 } 565 566 count = 0; 567 list_for_each_entry(d, &hci_dev_list, list) { 568 if (hci_dev_test_flag(d, HCI_SETUP) || 569 hci_dev_test_flag(d, HCI_CONFIG) || 570 hci_dev_test_flag(d, HCI_USER_CHANNEL)) 571 continue; 572 573 /* Devices marked as raw-only are neither configured 574 * nor unconfigured controllers. 575 */ 576 if (hci_test_quirk(d, HCI_QUIRK_RAW_DEVICE)) 577 continue; 578 579 if (hci_dev_test_flag(d, HCI_UNCONFIGURED)) 580 rp->entry[count].type = 0x01; 581 else 582 rp->entry[count].type = 0x00; 583 584 rp->entry[count].bus = d->bus; 585 rp->entry[count++].index = cpu_to_le16(d->id); 586 bt_dev_dbg(hdev, "Added hci%u", d->id); 587 } 588 589 rp->num_controllers = cpu_to_le16(count); 590 591 read_unlock(&hci_dev_list_lock); 592 593 /* If this command is called at least once, then all the 594 * default index and unconfigured index events are disabled 595 * and from now on only extended index events are used. 596 */ 597 hci_sock_set_flag(sk, HCI_MGMT_EXT_INDEX_EVENTS); 598 hci_sock_clear_flag(sk, HCI_MGMT_INDEX_EVENTS); 599 hci_sock_clear_flag(sk, HCI_MGMT_UNCONF_INDEX_EVENTS); 600 601 err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE, 602 MGMT_OP_READ_EXT_INDEX_LIST, 0, rp, 603 struct_size(rp, entry, count)); 604 605 kfree(rp); 606 607 return err; 608 } 609 610 static bool is_configured(struct hci_dev *hdev) 611 { 612 if (hci_test_quirk(hdev, HCI_QUIRK_EXTERNAL_CONFIG) && 613 !hci_dev_test_flag(hdev, HCI_EXT_CONFIGURED)) 614 return false; 615 616 if ((hci_test_quirk(hdev, HCI_QUIRK_INVALID_BDADDR) || 617 hci_test_quirk(hdev, HCI_QUIRK_USE_BDADDR_PROPERTY)) && 618 !bacmp(&hdev->public_addr, BDADDR_ANY)) 619 return false; 620 621 return true; 622 } 623 624 static __le32 get_missing_options(struct hci_dev *hdev) 625 { 626 u32 options = 0; 627 628 if (hci_test_quirk(hdev, HCI_QUIRK_EXTERNAL_CONFIG) && 629 !hci_dev_test_flag(hdev, HCI_EXT_CONFIGURED)) 630 options |= MGMT_OPTION_EXTERNAL_CONFIG; 631 632 if ((hci_test_quirk(hdev, HCI_QUIRK_INVALID_BDADDR) || 633 hci_test_quirk(hdev, HCI_QUIRK_USE_BDADDR_PROPERTY)) && 634 !bacmp(&hdev->public_addr, BDADDR_ANY)) 635 options |= MGMT_OPTION_PUBLIC_ADDRESS; 636 637 return cpu_to_le32(options); 638 } 639 640 static int new_options(struct hci_dev *hdev, struct sock *skip) 641 { 642 __le32 options = get_missing_options(hdev); 643 644 return mgmt_limited_event(MGMT_EV_NEW_CONFIG_OPTIONS, hdev, &options, 645 sizeof(options), HCI_MGMT_OPTION_EVENTS, skip); 646 } 647 648 static int send_options_rsp(struct sock *sk, u16 opcode, struct hci_dev *hdev) 649 { 650 __le32 options = get_missing_options(hdev); 651 652 return mgmt_cmd_complete(sk, hdev->id, opcode, 0, &options, 653 sizeof(options)); 654 } 655 656 static int read_config_info(struct sock *sk, struct hci_dev *hdev, 657 void *data, u16 data_len) 658 { 659 struct mgmt_rp_read_config_info rp; 660 u32 options = 0; 661 662 bt_dev_dbg(hdev, "sock %p", sk); 663 664 hci_dev_lock(hdev); 665 666 memset(&rp, 0, sizeof(rp)); 667 rp.manufacturer = cpu_to_le16(hdev->manufacturer); 668 669 if (hci_test_quirk(hdev, HCI_QUIRK_EXTERNAL_CONFIG)) 670 options |= MGMT_OPTION_EXTERNAL_CONFIG; 671 672 if (hdev->set_bdaddr) 673 options |= MGMT_OPTION_PUBLIC_ADDRESS; 674 675 rp.supported_options = cpu_to_le32(options); 676 rp.missing_options = get_missing_options(hdev); 677 678 hci_dev_unlock(hdev); 679 680 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_CONFIG_INFO, 0, 681 &rp, sizeof(rp)); 682 } 683 684 static u32 get_supported_phys(struct hci_dev *hdev) 685 { 686 u32 supported_phys = 0; 687 688 if (lmp_bredr_capable(hdev)) { 689 supported_phys |= MGMT_PHY_BR_1M_1SLOT; 690 691 if (hdev->features[0][0] & LMP_3SLOT) 692 supported_phys |= MGMT_PHY_BR_1M_3SLOT; 693 694 if (hdev->features[0][0] & LMP_5SLOT) 695 supported_phys |= MGMT_PHY_BR_1M_5SLOT; 696 697 if (lmp_edr_2m_capable(hdev)) { 698 supported_phys |= MGMT_PHY_EDR_2M_1SLOT; 699 700 if (lmp_edr_3slot_capable(hdev)) 701 supported_phys |= MGMT_PHY_EDR_2M_3SLOT; 702 703 if (lmp_edr_5slot_capable(hdev)) 704 supported_phys |= MGMT_PHY_EDR_2M_5SLOT; 705 706 if (lmp_edr_3m_capable(hdev)) { 707 supported_phys |= MGMT_PHY_EDR_3M_1SLOT; 708 709 if (lmp_edr_3slot_capable(hdev)) 710 supported_phys |= MGMT_PHY_EDR_3M_3SLOT; 711 712 if (lmp_edr_5slot_capable(hdev)) 713 supported_phys |= MGMT_PHY_EDR_3M_5SLOT; 714 } 715 } 716 } 717 718 if (lmp_le_capable(hdev)) { 719 supported_phys |= MGMT_PHY_LE_1M_TX; 720 supported_phys |= MGMT_PHY_LE_1M_RX; 721 722 if (hdev->le_features[1] & HCI_LE_PHY_2M) { 723 supported_phys |= MGMT_PHY_LE_2M_TX; 724 supported_phys |= MGMT_PHY_LE_2M_RX; 725 } 726 727 if (hdev->le_features[1] & HCI_LE_PHY_CODED) { 728 supported_phys |= MGMT_PHY_LE_CODED_TX; 729 supported_phys |= MGMT_PHY_LE_CODED_RX; 730 } 731 } 732 733 return supported_phys; 734 } 735 736 static u32 get_selected_phys(struct hci_dev *hdev) 737 { 738 u32 selected_phys = 0; 739 740 if (lmp_bredr_capable(hdev)) { 741 selected_phys |= MGMT_PHY_BR_1M_1SLOT; 742 743 if (hdev->pkt_type & (HCI_DM3 | HCI_DH3)) 744 selected_phys |= MGMT_PHY_BR_1M_3SLOT; 745 746 if (hdev->pkt_type & (HCI_DM5 | HCI_DH5)) 747 selected_phys |= MGMT_PHY_BR_1M_5SLOT; 748 749 if (lmp_edr_2m_capable(hdev)) { 750 if (!(hdev->pkt_type & HCI_2DH1)) 751 selected_phys |= MGMT_PHY_EDR_2M_1SLOT; 752 753 if (lmp_edr_3slot_capable(hdev) && 754 !(hdev->pkt_type & HCI_2DH3)) 755 selected_phys |= MGMT_PHY_EDR_2M_3SLOT; 756 757 if (lmp_edr_5slot_capable(hdev) && 758 !(hdev->pkt_type & HCI_2DH5)) 759 selected_phys |= MGMT_PHY_EDR_2M_5SLOT; 760 761 if (lmp_edr_3m_capable(hdev)) { 762 if (!(hdev->pkt_type & HCI_3DH1)) 763 selected_phys |= MGMT_PHY_EDR_3M_1SLOT; 764 765 if (lmp_edr_3slot_capable(hdev) && 766 !(hdev->pkt_type & HCI_3DH3)) 767 selected_phys |= MGMT_PHY_EDR_3M_3SLOT; 768 769 if (lmp_edr_5slot_capable(hdev) && 770 !(hdev->pkt_type & HCI_3DH5)) 771 selected_phys |= MGMT_PHY_EDR_3M_5SLOT; 772 } 773 } 774 } 775 776 if (lmp_le_capable(hdev)) { 777 if (hdev->le_tx_def_phys & HCI_LE_SET_PHY_1M) 778 selected_phys |= MGMT_PHY_LE_1M_TX; 779 780 if (hdev->le_rx_def_phys & HCI_LE_SET_PHY_1M) 781 selected_phys |= MGMT_PHY_LE_1M_RX; 782 783 if (hdev->le_tx_def_phys & HCI_LE_SET_PHY_2M) 784 selected_phys |= MGMT_PHY_LE_2M_TX; 785 786 if (hdev->le_rx_def_phys & HCI_LE_SET_PHY_2M) 787 selected_phys |= MGMT_PHY_LE_2M_RX; 788 789 if (hdev->le_tx_def_phys & HCI_LE_SET_PHY_CODED) 790 selected_phys |= MGMT_PHY_LE_CODED_TX; 791 792 if (hdev->le_rx_def_phys & HCI_LE_SET_PHY_CODED) 793 selected_phys |= MGMT_PHY_LE_CODED_RX; 794 } 795 796 return selected_phys; 797 } 798 799 static u32 get_configurable_phys(struct hci_dev *hdev) 800 { 801 return (get_supported_phys(hdev) & ~MGMT_PHY_BR_1M_1SLOT & 802 ~MGMT_PHY_LE_1M_TX & ~MGMT_PHY_LE_1M_RX); 803 } 804 805 static u32 get_supported_settings(struct hci_dev *hdev) 806 { 807 u32 settings = 0; 808 809 settings |= MGMT_SETTING_POWERED; 810 settings |= MGMT_SETTING_BONDABLE; 811 settings |= MGMT_SETTING_DEBUG_KEYS; 812 settings |= MGMT_SETTING_CONNECTABLE; 813 settings |= MGMT_SETTING_DISCOVERABLE; 814 815 if (lmp_bredr_capable(hdev)) { 816 if (hdev->hci_ver >= BLUETOOTH_VER_1_2) 817 settings |= MGMT_SETTING_FAST_CONNECTABLE; 818 settings |= MGMT_SETTING_BREDR; 819 settings |= MGMT_SETTING_LINK_SECURITY; 820 821 if (lmp_ssp_capable(hdev)) { 822 settings |= MGMT_SETTING_SSP; 823 } 824 825 if (lmp_sc_capable(hdev)) 826 settings |= MGMT_SETTING_SECURE_CONN; 827 828 if (hci_test_quirk(hdev, HCI_QUIRK_WIDEBAND_SPEECH_SUPPORTED)) 829 settings |= MGMT_SETTING_WIDEBAND_SPEECH; 830 } 831 832 if (lmp_le_capable(hdev)) { 833 settings |= MGMT_SETTING_LE; 834 settings |= MGMT_SETTING_SECURE_CONN; 835 settings |= MGMT_SETTING_PRIVACY; 836 settings |= MGMT_SETTING_STATIC_ADDRESS; 837 settings |= MGMT_SETTING_ADVERTISING; 838 } 839 840 if (hci_test_quirk(hdev, HCI_QUIRK_EXTERNAL_CONFIG) || hdev->set_bdaddr) 841 settings |= MGMT_SETTING_CONFIGURATION; 842 843 if (cis_central_capable(hdev)) 844 settings |= MGMT_SETTING_CIS_CENTRAL; 845 846 if (cis_peripheral_capable(hdev)) 847 settings |= MGMT_SETTING_CIS_PERIPHERAL; 848 849 if (bis_capable(hdev)) 850 settings |= MGMT_SETTING_ISO_BROADCASTER; 851 852 if (sync_recv_capable(hdev)) 853 settings |= MGMT_SETTING_ISO_SYNC_RECEIVER; 854 855 if (ll_privacy_capable(hdev)) 856 settings |= MGMT_SETTING_LL_PRIVACY; 857 858 if (past_sender_capable(hdev)) 859 settings |= MGMT_SETTING_PAST_SENDER; 860 861 if (past_receiver_capable(hdev)) 862 settings |= MGMT_SETTING_PAST_RECEIVER; 863 864 settings |= MGMT_SETTING_PHY_CONFIGURATION; 865 866 return settings; 867 } 868 869 static u32 get_current_settings(struct hci_dev *hdev) 870 { 871 u32 settings = 0; 872 873 if (hdev_is_powered(hdev)) 874 settings |= MGMT_SETTING_POWERED; 875 876 if (hci_dev_test_flag(hdev, HCI_CONNECTABLE)) 877 settings |= MGMT_SETTING_CONNECTABLE; 878 879 if (hci_dev_test_flag(hdev, HCI_FAST_CONNECTABLE)) 880 settings |= MGMT_SETTING_FAST_CONNECTABLE; 881 882 if (hci_dev_test_flag(hdev, HCI_DISCOVERABLE)) 883 settings |= MGMT_SETTING_DISCOVERABLE; 884 885 if (hci_dev_test_flag(hdev, HCI_BONDABLE)) 886 settings |= MGMT_SETTING_BONDABLE; 887 888 if (hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) 889 settings |= MGMT_SETTING_BREDR; 890 891 if (hci_dev_test_flag(hdev, HCI_LE_ENABLED)) 892 settings |= MGMT_SETTING_LE; 893 894 if (hci_dev_test_flag(hdev, HCI_LINK_SECURITY)) 895 settings |= MGMT_SETTING_LINK_SECURITY; 896 897 if (hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) 898 settings |= MGMT_SETTING_SSP; 899 900 if (hci_dev_test_flag(hdev, HCI_ADVERTISING)) 901 settings |= MGMT_SETTING_ADVERTISING; 902 903 if (hci_dev_test_flag(hdev, HCI_SC_ENABLED)) 904 settings |= MGMT_SETTING_SECURE_CONN; 905 906 if (hci_dev_test_flag(hdev, HCI_KEEP_DEBUG_KEYS)) 907 settings |= MGMT_SETTING_DEBUG_KEYS; 908 909 if (hci_dev_test_flag(hdev, HCI_PRIVACY)) 910 settings |= MGMT_SETTING_PRIVACY; 911 912 /* The current setting for static address has two purposes. The 913 * first is to indicate if the static address will be used and 914 * the second is to indicate if it is actually set. 915 * 916 * This means if the static address is not configured, this flag 917 * will never be set. If the address is configured, then if the 918 * address is actually used decides if the flag is set or not. 919 * 920 * For single mode LE only controllers and dual-mode controllers 921 * with BR/EDR disabled, the existence of the static address will 922 * be evaluated. 923 */ 924 if (hci_dev_test_flag(hdev, HCI_FORCE_STATIC_ADDR) || 925 !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) || 926 !bacmp(&hdev->bdaddr, BDADDR_ANY)) { 927 if (bacmp(&hdev->static_addr, BDADDR_ANY)) 928 settings |= MGMT_SETTING_STATIC_ADDRESS; 929 } 930 931 if (hci_dev_test_flag(hdev, HCI_WIDEBAND_SPEECH_ENABLED)) 932 settings |= MGMT_SETTING_WIDEBAND_SPEECH; 933 934 if (cis_central_enabled(hdev)) 935 settings |= MGMT_SETTING_CIS_CENTRAL; 936 937 if (cis_peripheral_enabled(hdev)) 938 settings |= MGMT_SETTING_CIS_PERIPHERAL; 939 940 if (bis_enabled(hdev)) 941 settings |= MGMT_SETTING_ISO_BROADCASTER; 942 943 if (sync_recv_enabled(hdev)) 944 settings |= MGMT_SETTING_ISO_SYNC_RECEIVER; 945 946 if (ll_privacy_enabled(hdev)) 947 settings |= MGMT_SETTING_LL_PRIVACY; 948 949 if (past_sender_enabled(hdev)) 950 settings |= MGMT_SETTING_PAST_SENDER; 951 952 if (past_receiver_enabled(hdev)) 953 settings |= MGMT_SETTING_PAST_RECEIVER; 954 955 return settings; 956 } 957 958 static struct mgmt_pending_cmd *pending_find(u16 opcode, struct hci_dev *hdev) 959 { 960 return mgmt_pending_find(HCI_CHANNEL_CONTROL, opcode, hdev); 961 } 962 963 u8 mgmt_get_adv_discov_flags(struct hci_dev *hdev) 964 { 965 struct mgmt_pending_cmd *cmd; 966 967 /* If there's a pending mgmt command the flags will not yet have 968 * their final values, so check for this first. 969 */ 970 cmd = pending_find(MGMT_OP_SET_DISCOVERABLE, hdev); 971 if (cmd) { 972 struct mgmt_mode *cp = cmd->param; 973 if (cp->val == 0x01) 974 return LE_AD_GENERAL; 975 else if (cp->val == 0x02) 976 return LE_AD_LIMITED; 977 } else { 978 if (hci_dev_test_flag(hdev, HCI_LIMITED_DISCOVERABLE)) 979 return LE_AD_LIMITED; 980 else if (hci_dev_test_flag(hdev, HCI_DISCOVERABLE)) 981 return LE_AD_GENERAL; 982 } 983 984 return 0; 985 } 986 987 bool mgmt_get_connectable(struct hci_dev *hdev) 988 { 989 struct mgmt_pending_cmd *cmd; 990 991 /* If there's a pending mgmt command the flag will not yet have 992 * it's final value, so check for this first. 993 */ 994 cmd = pending_find(MGMT_OP_SET_CONNECTABLE, hdev); 995 if (cmd) { 996 struct mgmt_mode *cp = cmd->param; 997 998 return cp->val; 999 } 1000 1001 return hci_dev_test_flag(hdev, HCI_CONNECTABLE); 1002 } 1003 1004 static int service_cache_sync(struct hci_dev *hdev, void *data) 1005 { 1006 hci_update_eir_sync(hdev); 1007 hci_update_class_sync(hdev); 1008 1009 return 0; 1010 } 1011 1012 static void service_cache_off(struct work_struct *work) 1013 { 1014 struct hci_dev *hdev = container_of(work, struct hci_dev, 1015 service_cache.work); 1016 1017 if (!hci_dev_test_and_clear_flag(hdev, HCI_SERVICE_CACHE)) 1018 return; 1019 1020 hci_cmd_sync_queue(hdev, service_cache_sync, NULL, NULL); 1021 } 1022 1023 static int rpa_expired_sync(struct hci_dev *hdev, void *data) 1024 { 1025 /* The generation of a new RPA and programming it into the 1026 * controller happens in the hci_req_enable_advertising() 1027 * function. 1028 */ 1029 if (ext_adv_capable(hdev)) 1030 return hci_start_ext_adv_sync(hdev, hdev->cur_adv_instance); 1031 else 1032 return hci_enable_advertising_sync(hdev); 1033 } 1034 1035 static void rpa_expired(struct work_struct *work) 1036 { 1037 struct hci_dev *hdev = container_of(work, struct hci_dev, 1038 rpa_expired.work); 1039 1040 bt_dev_dbg(hdev, ""); 1041 1042 hci_dev_set_flag(hdev, HCI_RPA_EXPIRED); 1043 1044 if (!hci_dev_test_flag(hdev, HCI_ADVERTISING)) 1045 return; 1046 1047 hci_cmd_sync_queue(hdev, rpa_expired_sync, NULL, NULL); 1048 } 1049 1050 static int set_discoverable_sync(struct hci_dev *hdev, void *data); 1051 1052 static void discov_off(struct work_struct *work) 1053 { 1054 struct hci_dev *hdev = container_of(work, struct hci_dev, 1055 discov_off.work); 1056 1057 bt_dev_dbg(hdev, ""); 1058 1059 hci_dev_lock(hdev); 1060 1061 /* When discoverable timeout triggers, then just make sure 1062 * the limited discoverable flag is cleared. Even in the case 1063 * of a timeout triggered from general discoverable, it is 1064 * safe to unconditionally clear the flag. 1065 */ 1066 hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE); 1067 hci_dev_clear_flag(hdev, HCI_DISCOVERABLE); 1068 hdev->discov_timeout = 0; 1069 1070 hci_cmd_sync_queue(hdev, set_discoverable_sync, NULL, NULL); 1071 1072 mgmt_new_settings(hdev); 1073 1074 hci_dev_unlock(hdev); 1075 } 1076 1077 static int send_settings_rsp(struct sock *sk, u16 opcode, struct hci_dev *hdev); 1078 1079 static void mesh_send_complete(struct hci_dev *hdev, 1080 struct mgmt_mesh_tx *mesh_tx, bool silent) 1081 { 1082 u8 handle = mesh_tx->handle; 1083 1084 if (!silent) 1085 mgmt_event(MGMT_EV_MESH_PACKET_CMPLT, hdev, &handle, 1086 sizeof(handle), NULL); 1087 1088 mgmt_mesh_remove(mesh_tx); 1089 } 1090 1091 static int mesh_send_done_sync(struct hci_dev *hdev, void *data) 1092 { 1093 struct mgmt_mesh_tx *mesh_tx; 1094 1095 hci_dev_clear_flag(hdev, HCI_MESH_SENDING); 1096 if (list_empty(&hdev->adv_instances)) 1097 hci_disable_advertising_sync(hdev); 1098 mesh_tx = mgmt_mesh_next(hdev, NULL); 1099 1100 if (mesh_tx) 1101 mesh_send_complete(hdev, mesh_tx, false); 1102 1103 return 0; 1104 } 1105 1106 static int mesh_send_sync(struct hci_dev *hdev, void *data); 1107 static void mesh_send_start_complete(struct hci_dev *hdev, void *data, int err); 1108 static void mesh_next(struct hci_dev *hdev, void *data, int err) 1109 { 1110 struct mgmt_mesh_tx *mesh_tx = mgmt_mesh_next(hdev, NULL); 1111 1112 if (!mesh_tx) 1113 return; 1114 1115 err = hci_cmd_sync_queue(hdev, mesh_send_sync, mesh_tx, 1116 mesh_send_start_complete); 1117 1118 if (err < 0) 1119 mesh_send_complete(hdev, mesh_tx, false); 1120 else 1121 hci_dev_set_flag(hdev, HCI_MESH_SENDING); 1122 } 1123 1124 static void mesh_send_done(struct work_struct *work) 1125 { 1126 struct hci_dev *hdev = container_of(work, struct hci_dev, 1127 mesh_send_done.work); 1128 1129 if (!hci_dev_test_flag(hdev, HCI_MESH_SENDING)) 1130 return; 1131 1132 hci_cmd_sync_queue(hdev, mesh_send_done_sync, NULL, mesh_next); 1133 } 1134 1135 static void mgmt_init_hdev(struct sock *sk, struct hci_dev *hdev) 1136 { 1137 if (hci_dev_test_flag(hdev, HCI_MGMT)) 1138 return; 1139 1140 BT_INFO("MGMT ver %d.%d", MGMT_VERSION, MGMT_REVISION); 1141 1142 INIT_DELAYED_WORK(&hdev->discov_off, discov_off); 1143 INIT_DELAYED_WORK(&hdev->service_cache, service_cache_off); 1144 INIT_DELAYED_WORK(&hdev->rpa_expired, rpa_expired); 1145 INIT_DELAYED_WORK(&hdev->mesh_send_done, mesh_send_done); 1146 1147 /* Non-mgmt controlled devices get this bit set 1148 * implicitly so that pairing works for them, however 1149 * for mgmt we require user-space to explicitly enable 1150 * it 1151 */ 1152 hci_dev_clear_flag(hdev, HCI_BONDABLE); 1153 1154 hci_dev_set_flag(hdev, HCI_MGMT); 1155 } 1156 1157 static int read_controller_info(struct sock *sk, struct hci_dev *hdev, 1158 void *data, u16 data_len) 1159 { 1160 struct mgmt_rp_read_info rp; 1161 1162 bt_dev_dbg(hdev, "sock %p", sk); 1163 1164 hci_dev_lock(hdev); 1165 1166 memset(&rp, 0, sizeof(rp)); 1167 1168 bacpy(&rp.bdaddr, &hdev->bdaddr); 1169 1170 rp.version = hdev->hci_ver; 1171 rp.manufacturer = cpu_to_le16(hdev->manufacturer); 1172 1173 rp.supported_settings = cpu_to_le32(get_supported_settings(hdev)); 1174 rp.current_settings = cpu_to_le32(get_current_settings(hdev)); 1175 1176 memcpy(rp.dev_class, hdev->dev_class, 3); 1177 1178 memcpy(rp.name, hdev->dev_name, sizeof(hdev->dev_name)); 1179 memcpy(rp.short_name, hdev->short_name, sizeof(hdev->short_name)); 1180 1181 hci_dev_unlock(hdev); 1182 1183 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_INFO, 0, &rp, 1184 sizeof(rp)); 1185 } 1186 1187 static u16 append_eir_data_to_buf(struct hci_dev *hdev, u8 *eir) 1188 { 1189 u16 eir_len = 0; 1190 size_t name_len; 1191 1192 if (hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) 1193 eir_len = eir_append_data(eir, eir_len, EIR_CLASS_OF_DEV, 1194 hdev->dev_class, 3); 1195 1196 if (hci_dev_test_flag(hdev, HCI_LE_ENABLED)) 1197 eir_len = eir_append_le16(eir, eir_len, EIR_APPEARANCE, 1198 hdev->appearance); 1199 1200 name_len = strnlen(hdev->dev_name, sizeof(hdev->dev_name)); 1201 eir_len = eir_append_data(eir, eir_len, EIR_NAME_COMPLETE, 1202 hdev->dev_name, name_len); 1203 1204 name_len = strnlen(hdev->short_name, sizeof(hdev->short_name)); 1205 eir_len = eir_append_data(eir, eir_len, EIR_NAME_SHORT, 1206 hdev->short_name, name_len); 1207 1208 return eir_len; 1209 } 1210 1211 static int read_ext_controller_info(struct sock *sk, struct hci_dev *hdev, 1212 void *data, u16 data_len) 1213 { 1214 char buf[512]; 1215 struct mgmt_rp_read_ext_info *rp = (void *)buf; 1216 u16 eir_len; 1217 1218 bt_dev_dbg(hdev, "sock %p", sk); 1219 1220 memset(&buf, 0, sizeof(buf)); 1221 1222 hci_dev_lock(hdev); 1223 1224 bacpy(&rp->bdaddr, &hdev->bdaddr); 1225 1226 rp->version = hdev->hci_ver; 1227 rp->manufacturer = cpu_to_le16(hdev->manufacturer); 1228 1229 rp->supported_settings = cpu_to_le32(get_supported_settings(hdev)); 1230 rp->current_settings = cpu_to_le32(get_current_settings(hdev)); 1231 1232 1233 eir_len = append_eir_data_to_buf(hdev, rp->eir); 1234 rp->eir_len = cpu_to_le16(eir_len); 1235 1236 hci_dev_unlock(hdev); 1237 1238 /* If this command is called at least once, then the events 1239 * for class of device and local name changes are disabled 1240 * and only the new extended controller information event 1241 * is used. 1242 */ 1243 hci_sock_set_flag(sk, HCI_MGMT_EXT_INFO_EVENTS); 1244 hci_sock_clear_flag(sk, HCI_MGMT_DEV_CLASS_EVENTS); 1245 hci_sock_clear_flag(sk, HCI_MGMT_LOCAL_NAME_EVENTS); 1246 1247 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_EXT_INFO, 0, rp, 1248 sizeof(*rp) + eir_len); 1249 } 1250 1251 static int ext_info_changed(struct hci_dev *hdev, struct sock *skip) 1252 { 1253 char buf[512]; 1254 struct mgmt_ev_ext_info_changed *ev = (void *)buf; 1255 u16 eir_len; 1256 1257 memset(buf, 0, sizeof(buf)); 1258 1259 eir_len = append_eir_data_to_buf(hdev, ev->eir); 1260 ev->eir_len = cpu_to_le16(eir_len); 1261 1262 return mgmt_limited_event(MGMT_EV_EXT_INFO_CHANGED, hdev, ev, 1263 sizeof(*ev) + eir_len, 1264 HCI_MGMT_EXT_INFO_EVENTS, skip); 1265 } 1266 1267 static int send_settings_rsp(struct sock *sk, u16 opcode, struct hci_dev *hdev) 1268 { 1269 __le32 settings = cpu_to_le32(get_current_settings(hdev)); 1270 1271 return mgmt_cmd_complete(sk, hdev->id, opcode, 0, &settings, 1272 sizeof(settings)); 1273 } 1274 1275 void mgmt_advertising_added(struct sock *sk, struct hci_dev *hdev, u8 instance) 1276 { 1277 struct mgmt_ev_advertising_added ev; 1278 1279 ev.instance = instance; 1280 1281 mgmt_event(MGMT_EV_ADVERTISING_ADDED, hdev, &ev, sizeof(ev), sk); 1282 } 1283 1284 void mgmt_advertising_removed(struct sock *sk, struct hci_dev *hdev, 1285 u8 instance) 1286 { 1287 struct mgmt_ev_advertising_removed ev; 1288 1289 ev.instance = instance; 1290 1291 mgmt_event(MGMT_EV_ADVERTISING_REMOVED, hdev, &ev, sizeof(ev), sk); 1292 } 1293 1294 static void cancel_adv_timeout(struct hci_dev *hdev) 1295 { 1296 if (hdev->adv_instance_timeout) { 1297 hdev->adv_instance_timeout = 0; 1298 cancel_delayed_work(&hdev->adv_instance_expire); 1299 } 1300 } 1301 1302 /* This function requires the caller holds hdev->lock */ 1303 static void restart_le_actions(struct hci_dev *hdev) 1304 { 1305 struct hci_conn_params *p; 1306 1307 list_for_each_entry(p, &hdev->le_conn_params, list) { 1308 /* Needed for AUTO_OFF case where might not "really" 1309 * have been powered off. 1310 */ 1311 hci_pend_le_list_del_init(p); 1312 1313 switch (p->auto_connect) { 1314 case HCI_AUTO_CONN_DIRECT: 1315 case HCI_AUTO_CONN_ALWAYS: 1316 hci_pend_le_list_add(p, &hdev->pend_le_conns); 1317 break; 1318 case HCI_AUTO_CONN_REPORT: 1319 hci_pend_le_list_add(p, &hdev->pend_le_reports); 1320 break; 1321 default: 1322 break; 1323 } 1324 } 1325 } 1326 1327 static int new_settings(struct hci_dev *hdev, struct sock *skip) 1328 { 1329 __le32 ev = cpu_to_le32(get_current_settings(hdev)); 1330 1331 return mgmt_limited_event(MGMT_EV_NEW_SETTINGS, hdev, &ev, 1332 sizeof(ev), HCI_MGMT_SETTING_EVENTS, skip); 1333 } 1334 1335 static void mgmt_set_powered_complete(struct hci_dev *hdev, void *data, int err) 1336 { 1337 struct mgmt_pending_cmd *cmd = data; 1338 struct mgmt_mode *cp; 1339 1340 /* Make sure cmd still outstanding. */ 1341 if (err == -ECANCELED || !mgmt_pending_valid(hdev, cmd)) 1342 return; 1343 1344 cp = cmd->param; 1345 1346 bt_dev_dbg(hdev, "err %d", err); 1347 1348 if (!err) { 1349 if (cp->val) { 1350 hci_dev_lock(hdev); 1351 restart_le_actions(hdev); 1352 hci_update_passive_scan(hdev); 1353 hci_dev_unlock(hdev); 1354 } 1355 1356 send_settings_rsp(cmd->sk, cmd->opcode, hdev); 1357 1358 /* Only call new_setting for power on as power off is deferred 1359 * to hdev->power_off work which does call hci_dev_do_close. 1360 */ 1361 if (cp->val) 1362 new_settings(hdev, cmd->sk); 1363 } else { 1364 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_POWERED, 1365 mgmt_status(err)); 1366 } 1367 1368 mgmt_pending_free(cmd); 1369 } 1370 1371 static int set_powered_sync(struct hci_dev *hdev, void *data) 1372 { 1373 struct mgmt_pending_cmd *cmd = data; 1374 struct mgmt_mode cp; 1375 1376 mutex_lock(&hdev->mgmt_pending_lock); 1377 1378 /* Make sure cmd still outstanding. */ 1379 if (!__mgmt_pending_listed(hdev, cmd)) { 1380 mutex_unlock(&hdev->mgmt_pending_lock); 1381 return -ECANCELED; 1382 } 1383 1384 memcpy(&cp, cmd->param, sizeof(cp)); 1385 1386 mutex_unlock(&hdev->mgmt_pending_lock); 1387 1388 BT_DBG("%s", hdev->name); 1389 1390 return hci_set_powered_sync(hdev, cp.val); 1391 } 1392 1393 static int set_powered(struct sock *sk, struct hci_dev *hdev, void *data, 1394 u16 len) 1395 { 1396 struct mgmt_mode *cp = data; 1397 struct mgmt_pending_cmd *cmd; 1398 int err; 1399 1400 bt_dev_dbg(hdev, "sock %p", sk); 1401 1402 if (cp->val != 0x00 && cp->val != 0x01) 1403 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED, 1404 MGMT_STATUS_INVALID_PARAMS); 1405 1406 hci_dev_lock(hdev); 1407 1408 if (!cp->val) { 1409 if (hci_dev_test_flag(hdev, HCI_POWERING_DOWN)) { 1410 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED, 1411 MGMT_STATUS_BUSY); 1412 goto failed; 1413 } 1414 } 1415 1416 if (pending_find(MGMT_OP_SET_POWERED, hdev)) { 1417 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED, 1418 MGMT_STATUS_BUSY); 1419 goto failed; 1420 } 1421 1422 if (!!cp->val == hdev_is_powered(hdev)) { 1423 err = send_settings_rsp(sk, MGMT_OP_SET_POWERED, hdev); 1424 goto failed; 1425 } 1426 1427 cmd = mgmt_pending_add(sk, MGMT_OP_SET_POWERED, hdev, data, len); 1428 if (!cmd) { 1429 err = -ENOMEM; 1430 goto failed; 1431 } 1432 1433 /* Cancel potentially blocking sync operation before power off */ 1434 if (cp->val == 0x00) { 1435 hci_cmd_sync_cancel_sync(hdev, -EHOSTDOWN); 1436 err = hci_cmd_sync_queue(hdev, set_powered_sync, cmd, 1437 mgmt_set_powered_complete); 1438 } else { 1439 /* Use hci_cmd_sync_submit since hdev might not be running */ 1440 err = hci_cmd_sync_submit(hdev, set_powered_sync, cmd, 1441 mgmt_set_powered_complete); 1442 } 1443 1444 if (err < 0) 1445 mgmt_pending_remove(cmd); 1446 1447 failed: 1448 hci_dev_unlock(hdev); 1449 return err; 1450 } 1451 1452 int mgmt_new_settings(struct hci_dev *hdev) 1453 { 1454 return new_settings(hdev, NULL); 1455 } 1456 1457 struct cmd_lookup { 1458 struct sock *sk; 1459 struct hci_dev *hdev; 1460 u8 mgmt_status; 1461 }; 1462 1463 static void settings_rsp(struct mgmt_pending_cmd *cmd, void *data) 1464 { 1465 struct cmd_lookup *match = data; 1466 1467 send_settings_rsp(cmd->sk, cmd->opcode, match->hdev); 1468 1469 if (match->sk == NULL) { 1470 match->sk = cmd->sk; 1471 sock_hold(match->sk); 1472 } 1473 } 1474 1475 static void cmd_status_rsp(struct mgmt_pending_cmd *cmd, void *data) 1476 { 1477 u8 *status = data; 1478 1479 mgmt_cmd_status(cmd->sk, cmd->hdev->id, cmd->opcode, *status); 1480 } 1481 1482 static void cmd_complete_rsp(struct mgmt_pending_cmd *cmd, void *data) 1483 { 1484 struct cmd_lookup *match = data; 1485 1486 /* dequeue cmd_sync entries using cmd as data as that is about to be 1487 * removed/freed. 1488 */ 1489 hci_cmd_sync_dequeue(match->hdev, NULL, cmd, NULL); 1490 1491 if (cmd->cmd_complete) { 1492 cmd->cmd_complete(cmd, match->mgmt_status); 1493 return; 1494 } 1495 1496 cmd_status_rsp(cmd, data); 1497 } 1498 1499 static int generic_cmd_complete(struct mgmt_pending_cmd *cmd, u8 status) 1500 { 1501 return mgmt_cmd_complete(cmd->sk, cmd->hdev->id, cmd->opcode, status, 1502 cmd->param, cmd->param_len); 1503 } 1504 1505 static int addr_cmd_complete(struct mgmt_pending_cmd *cmd, u8 status) 1506 { 1507 return mgmt_cmd_complete(cmd->sk, cmd->hdev->id, cmd->opcode, status, 1508 cmd->param, sizeof(struct mgmt_addr_info)); 1509 } 1510 1511 static u8 mgmt_bredr_support(struct hci_dev *hdev) 1512 { 1513 if (!lmp_bredr_capable(hdev)) 1514 return MGMT_STATUS_NOT_SUPPORTED; 1515 else if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) 1516 return MGMT_STATUS_REJECTED; 1517 else 1518 return MGMT_STATUS_SUCCESS; 1519 } 1520 1521 static u8 mgmt_le_support(struct hci_dev *hdev) 1522 { 1523 if (!lmp_le_capable(hdev)) 1524 return MGMT_STATUS_NOT_SUPPORTED; 1525 else if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED)) 1526 return MGMT_STATUS_REJECTED; 1527 else 1528 return MGMT_STATUS_SUCCESS; 1529 } 1530 1531 static void mgmt_set_discoverable_complete(struct hci_dev *hdev, void *data, 1532 int err) 1533 { 1534 struct mgmt_pending_cmd *cmd = data; 1535 1536 bt_dev_dbg(hdev, "err %d", err); 1537 1538 /* Make sure cmd still outstanding. */ 1539 if (err == -ECANCELED || !mgmt_pending_valid(hdev, cmd)) 1540 return; 1541 1542 hci_dev_lock(hdev); 1543 1544 if (err) { 1545 u8 mgmt_err = mgmt_status(err); 1546 mgmt_cmd_status(cmd->sk, cmd->hdev->id, cmd->opcode, mgmt_err); 1547 hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE); 1548 goto done; 1549 } 1550 1551 if (hci_dev_test_flag(hdev, HCI_DISCOVERABLE) && 1552 hdev->discov_timeout > 0) { 1553 int to = secs_to_jiffies(hdev->discov_timeout); 1554 queue_delayed_work(hdev->req_workqueue, &hdev->discov_off, to); 1555 } 1556 1557 send_settings_rsp(cmd->sk, MGMT_OP_SET_DISCOVERABLE, hdev); 1558 new_settings(hdev, cmd->sk); 1559 1560 done: 1561 mgmt_pending_free(cmd); 1562 hci_dev_unlock(hdev); 1563 } 1564 1565 static int set_discoverable_sync(struct hci_dev *hdev, void *data) 1566 { 1567 if (!mgmt_pending_listed(hdev, data)) 1568 return -ECANCELED; 1569 1570 BT_DBG("%s", hdev->name); 1571 1572 return hci_update_discoverable_sync(hdev); 1573 } 1574 1575 static int set_discoverable(struct sock *sk, struct hci_dev *hdev, void *data, 1576 u16 len) 1577 { 1578 struct mgmt_cp_set_discoverable *cp = data; 1579 struct mgmt_pending_cmd *cmd; 1580 u16 timeout; 1581 int err; 1582 1583 bt_dev_dbg(hdev, "sock %p", sk); 1584 1585 if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED) && 1586 !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) 1587 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE, 1588 MGMT_STATUS_REJECTED); 1589 1590 if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02) 1591 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE, 1592 MGMT_STATUS_INVALID_PARAMS); 1593 1594 timeout = __le16_to_cpu(cp->timeout); 1595 1596 /* Disabling discoverable requires that no timeout is set, 1597 * and enabling limited discoverable requires a timeout. 1598 */ 1599 if ((cp->val == 0x00 && timeout > 0) || 1600 (cp->val == 0x02 && timeout == 0)) 1601 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE, 1602 MGMT_STATUS_INVALID_PARAMS); 1603 1604 hci_dev_lock(hdev); 1605 1606 if (!hdev_is_powered(hdev) && timeout > 0) { 1607 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE, 1608 MGMT_STATUS_NOT_POWERED); 1609 goto failed; 1610 } 1611 1612 if (pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) || 1613 pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) { 1614 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE, 1615 MGMT_STATUS_BUSY); 1616 goto failed; 1617 } 1618 1619 if (!hci_dev_test_flag(hdev, HCI_CONNECTABLE)) { 1620 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE, 1621 MGMT_STATUS_REJECTED); 1622 goto failed; 1623 } 1624 1625 if (hdev->advertising_paused) { 1626 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE, 1627 MGMT_STATUS_BUSY); 1628 goto failed; 1629 } 1630 1631 if (!hdev_is_powered(hdev)) { 1632 bool changed = false; 1633 1634 /* Setting limited discoverable when powered off is 1635 * not a valid operation since it requires a timeout 1636 * and so no need to check HCI_LIMITED_DISCOVERABLE. 1637 */ 1638 if (!!cp->val != hci_dev_test_flag(hdev, HCI_DISCOVERABLE)) { 1639 hci_dev_change_flag(hdev, HCI_DISCOVERABLE); 1640 changed = true; 1641 } 1642 1643 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev); 1644 if (err < 0) 1645 goto failed; 1646 1647 if (changed) 1648 err = new_settings(hdev, sk); 1649 1650 goto failed; 1651 } 1652 1653 /* If the current mode is the same, then just update the timeout 1654 * value with the new value. And if only the timeout gets updated, 1655 * then no need for any HCI transactions. 1656 */ 1657 if (!!cp->val == hci_dev_test_flag(hdev, HCI_DISCOVERABLE) && 1658 (cp->val == 0x02) == hci_dev_test_flag(hdev, 1659 HCI_LIMITED_DISCOVERABLE)) { 1660 cancel_delayed_work(&hdev->discov_off); 1661 hdev->discov_timeout = timeout; 1662 1663 if (cp->val && hdev->discov_timeout > 0) { 1664 int to = secs_to_jiffies(hdev->discov_timeout); 1665 queue_delayed_work(hdev->req_workqueue, 1666 &hdev->discov_off, to); 1667 } 1668 1669 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev); 1670 goto failed; 1671 } 1672 1673 cmd = mgmt_pending_add(sk, MGMT_OP_SET_DISCOVERABLE, hdev, data, len); 1674 if (!cmd) { 1675 err = -ENOMEM; 1676 goto failed; 1677 } 1678 1679 /* Cancel any potential discoverable timeout that might be 1680 * still active and store new timeout value. The arming of 1681 * the timeout happens in the complete handler. 1682 */ 1683 cancel_delayed_work(&hdev->discov_off); 1684 hdev->discov_timeout = timeout; 1685 1686 if (cp->val) 1687 hci_dev_set_flag(hdev, HCI_DISCOVERABLE); 1688 else 1689 hci_dev_clear_flag(hdev, HCI_DISCOVERABLE); 1690 1691 /* Limited discoverable mode */ 1692 if (cp->val == 0x02) 1693 hci_dev_set_flag(hdev, HCI_LIMITED_DISCOVERABLE); 1694 else 1695 hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE); 1696 1697 err = hci_cmd_sync_queue(hdev, set_discoverable_sync, cmd, 1698 mgmt_set_discoverable_complete); 1699 1700 if (err < 0) 1701 mgmt_pending_remove(cmd); 1702 1703 failed: 1704 hci_dev_unlock(hdev); 1705 return err; 1706 } 1707 1708 static void mgmt_set_connectable_complete(struct hci_dev *hdev, void *data, 1709 int err) 1710 { 1711 struct mgmt_pending_cmd *cmd = data; 1712 1713 bt_dev_dbg(hdev, "err %d", err); 1714 1715 /* Make sure cmd still outstanding. */ 1716 if (err == -ECANCELED || !mgmt_pending_valid(hdev, cmd)) 1717 return; 1718 1719 hci_dev_lock(hdev); 1720 1721 if (err) { 1722 u8 mgmt_err = mgmt_status(err); 1723 mgmt_cmd_status(cmd->sk, cmd->hdev->id, cmd->opcode, mgmt_err); 1724 goto done; 1725 } 1726 1727 send_settings_rsp(cmd->sk, MGMT_OP_SET_CONNECTABLE, hdev); 1728 new_settings(hdev, cmd->sk); 1729 1730 done: 1731 mgmt_pending_free(cmd); 1732 1733 hci_dev_unlock(hdev); 1734 } 1735 1736 static int set_connectable_update_settings(struct hci_dev *hdev, 1737 struct sock *sk, u8 val) 1738 { 1739 bool changed = false; 1740 int err; 1741 1742 if (!!val != hci_dev_test_flag(hdev, HCI_CONNECTABLE)) 1743 changed = true; 1744 1745 if (val) { 1746 hci_dev_set_flag(hdev, HCI_CONNECTABLE); 1747 } else { 1748 hci_dev_clear_flag(hdev, HCI_CONNECTABLE); 1749 hci_dev_clear_flag(hdev, HCI_DISCOVERABLE); 1750 } 1751 1752 err = send_settings_rsp(sk, MGMT_OP_SET_CONNECTABLE, hdev); 1753 if (err < 0) 1754 return err; 1755 1756 if (changed) { 1757 hci_update_scan(hdev); 1758 hci_update_passive_scan(hdev); 1759 return new_settings(hdev, sk); 1760 } 1761 1762 return 0; 1763 } 1764 1765 static int set_connectable_sync(struct hci_dev *hdev, void *data) 1766 { 1767 if (!mgmt_pending_listed(hdev, data)) 1768 return -ECANCELED; 1769 1770 BT_DBG("%s", hdev->name); 1771 1772 return hci_update_connectable_sync(hdev); 1773 } 1774 1775 static int set_connectable(struct sock *sk, struct hci_dev *hdev, void *data, 1776 u16 len) 1777 { 1778 struct mgmt_mode *cp = data; 1779 struct mgmt_pending_cmd *cmd; 1780 int err; 1781 1782 bt_dev_dbg(hdev, "sock %p", sk); 1783 1784 if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED) && 1785 !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) 1786 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE, 1787 MGMT_STATUS_REJECTED); 1788 1789 if (cp->val != 0x00 && cp->val != 0x01) 1790 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE, 1791 MGMT_STATUS_INVALID_PARAMS); 1792 1793 hci_dev_lock(hdev); 1794 1795 if (!hdev_is_powered(hdev)) { 1796 err = set_connectable_update_settings(hdev, sk, cp->val); 1797 goto failed; 1798 } 1799 1800 if (pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) || 1801 pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) { 1802 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE, 1803 MGMT_STATUS_BUSY); 1804 goto failed; 1805 } 1806 1807 cmd = mgmt_pending_add(sk, MGMT_OP_SET_CONNECTABLE, hdev, data, len); 1808 if (!cmd) { 1809 err = -ENOMEM; 1810 goto failed; 1811 } 1812 1813 if (cp->val) { 1814 hci_dev_set_flag(hdev, HCI_CONNECTABLE); 1815 } else { 1816 if (hdev->discov_timeout > 0) 1817 cancel_delayed_work(&hdev->discov_off); 1818 1819 hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE); 1820 hci_dev_clear_flag(hdev, HCI_DISCOVERABLE); 1821 hci_dev_clear_flag(hdev, HCI_CONNECTABLE); 1822 } 1823 1824 err = hci_cmd_sync_queue(hdev, set_connectable_sync, cmd, 1825 mgmt_set_connectable_complete); 1826 1827 if (err < 0) 1828 mgmt_pending_remove(cmd); 1829 1830 failed: 1831 hci_dev_unlock(hdev); 1832 return err; 1833 } 1834 1835 static int set_bondable(struct sock *sk, struct hci_dev *hdev, void *data, 1836 u16 len) 1837 { 1838 struct mgmt_mode *cp = data; 1839 bool changed; 1840 int err; 1841 1842 bt_dev_dbg(hdev, "sock %p", sk); 1843 1844 if (cp->val != 0x00 && cp->val != 0x01) 1845 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BONDABLE, 1846 MGMT_STATUS_INVALID_PARAMS); 1847 1848 hci_dev_lock(hdev); 1849 1850 if (cp->val) 1851 changed = !hci_dev_test_and_set_flag(hdev, HCI_BONDABLE); 1852 else 1853 changed = hci_dev_test_and_clear_flag(hdev, HCI_BONDABLE); 1854 1855 err = send_settings_rsp(sk, MGMT_OP_SET_BONDABLE, hdev); 1856 if (err < 0) 1857 goto unlock; 1858 1859 if (changed) { 1860 /* In limited privacy mode the change of bondable mode 1861 * may affect the local advertising address. 1862 */ 1863 hci_update_discoverable(hdev); 1864 1865 err = new_settings(hdev, sk); 1866 } 1867 1868 unlock: 1869 hci_dev_unlock(hdev); 1870 return err; 1871 } 1872 1873 static int set_link_security(struct sock *sk, struct hci_dev *hdev, void *data, 1874 u16 len) 1875 { 1876 struct mgmt_mode *cp = data; 1877 struct mgmt_pending_cmd *cmd; 1878 u8 val, status; 1879 int err; 1880 1881 bt_dev_dbg(hdev, "sock %p", sk); 1882 1883 status = mgmt_bredr_support(hdev); 1884 if (status) 1885 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY, 1886 status); 1887 1888 if (cp->val != 0x00 && cp->val != 0x01) 1889 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY, 1890 MGMT_STATUS_INVALID_PARAMS); 1891 1892 hci_dev_lock(hdev); 1893 1894 if (!hdev_is_powered(hdev)) { 1895 bool changed = false; 1896 1897 if (!!cp->val != hci_dev_test_flag(hdev, HCI_LINK_SECURITY)) { 1898 hci_dev_change_flag(hdev, HCI_LINK_SECURITY); 1899 changed = true; 1900 } 1901 1902 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev); 1903 if (err < 0) 1904 goto failed; 1905 1906 if (changed) 1907 err = new_settings(hdev, sk); 1908 1909 goto failed; 1910 } 1911 1912 if (pending_find(MGMT_OP_SET_LINK_SECURITY, hdev)) { 1913 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY, 1914 MGMT_STATUS_BUSY); 1915 goto failed; 1916 } 1917 1918 val = !!cp->val; 1919 1920 if (test_bit(HCI_AUTH, &hdev->flags) == val) { 1921 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev); 1922 goto failed; 1923 } 1924 1925 cmd = mgmt_pending_add(sk, MGMT_OP_SET_LINK_SECURITY, hdev, data, len); 1926 if (!cmd) { 1927 err = -ENOMEM; 1928 goto failed; 1929 } 1930 1931 err = hci_send_cmd(hdev, HCI_OP_WRITE_AUTH_ENABLE, sizeof(val), &val); 1932 if (err < 0) { 1933 mgmt_pending_remove(cmd); 1934 goto failed; 1935 } 1936 1937 failed: 1938 hci_dev_unlock(hdev); 1939 return err; 1940 } 1941 1942 static void set_ssp_complete(struct hci_dev *hdev, void *data, int err) 1943 { 1944 struct cmd_lookup match = { NULL, hdev }; 1945 struct mgmt_pending_cmd *cmd = data; 1946 struct mgmt_mode *cp; 1947 u8 enable; 1948 bool changed; 1949 1950 /* Make sure cmd still outstanding. */ 1951 if (err == -ECANCELED || !mgmt_pending_valid(hdev, cmd)) 1952 return; 1953 1954 cp = cmd->param; 1955 enable = cp->val; 1956 1957 if (err) { 1958 u8 mgmt_err = mgmt_status(err); 1959 1960 if (enable && hci_dev_test_and_clear_flag(hdev, 1961 HCI_SSP_ENABLED)) { 1962 new_settings(hdev, NULL); 1963 } 1964 1965 mgmt_cmd_status(cmd->sk, cmd->hdev->id, cmd->opcode, mgmt_err); 1966 mgmt_pending_free(cmd); 1967 return; 1968 } 1969 1970 if (enable) { 1971 changed = !hci_dev_test_and_set_flag(hdev, HCI_SSP_ENABLED); 1972 } else { 1973 changed = hci_dev_test_and_clear_flag(hdev, HCI_SSP_ENABLED); 1974 } 1975 1976 settings_rsp(cmd, &match); 1977 1978 if (changed) 1979 new_settings(hdev, match.sk); 1980 1981 if (match.sk) 1982 sock_put(match.sk); 1983 1984 hci_update_eir_sync(hdev); 1985 mgmt_pending_free(cmd); 1986 } 1987 1988 static int set_ssp_sync(struct hci_dev *hdev, void *data) 1989 { 1990 struct mgmt_pending_cmd *cmd = data; 1991 struct mgmt_mode cp; 1992 bool changed = false; 1993 int err; 1994 1995 mutex_lock(&hdev->mgmt_pending_lock); 1996 1997 if (!__mgmt_pending_listed(hdev, cmd)) { 1998 mutex_unlock(&hdev->mgmt_pending_lock); 1999 return -ECANCELED; 2000 } 2001 2002 memcpy(&cp, cmd->param, sizeof(cp)); 2003 2004 mutex_unlock(&hdev->mgmt_pending_lock); 2005 2006 if (cp.val) 2007 changed = !hci_dev_test_and_set_flag(hdev, HCI_SSP_ENABLED); 2008 2009 err = hci_write_ssp_mode_sync(hdev, cp.val); 2010 2011 if (!err && changed) 2012 hci_dev_clear_flag(hdev, HCI_SSP_ENABLED); 2013 2014 return err; 2015 } 2016 2017 static int set_ssp(struct sock *sk, struct hci_dev *hdev, void *data, u16 len) 2018 { 2019 struct mgmt_mode *cp = data; 2020 struct mgmt_pending_cmd *cmd; 2021 u8 status; 2022 int err; 2023 2024 bt_dev_dbg(hdev, "sock %p", sk); 2025 2026 status = mgmt_bredr_support(hdev); 2027 if (status) 2028 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP, status); 2029 2030 if (!lmp_ssp_capable(hdev)) 2031 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP, 2032 MGMT_STATUS_NOT_SUPPORTED); 2033 2034 if (cp->val != 0x00 && cp->val != 0x01) 2035 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP, 2036 MGMT_STATUS_INVALID_PARAMS); 2037 2038 hci_dev_lock(hdev); 2039 2040 if (!hdev_is_powered(hdev)) { 2041 bool changed; 2042 2043 if (cp->val) { 2044 changed = !hci_dev_test_and_set_flag(hdev, 2045 HCI_SSP_ENABLED); 2046 } else { 2047 changed = hci_dev_test_and_clear_flag(hdev, 2048 HCI_SSP_ENABLED); 2049 } 2050 2051 err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev); 2052 if (err < 0) 2053 goto failed; 2054 2055 if (changed) 2056 err = new_settings(hdev, sk); 2057 2058 goto failed; 2059 } 2060 2061 if (pending_find(MGMT_OP_SET_SSP, hdev)) { 2062 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP, 2063 MGMT_STATUS_BUSY); 2064 goto failed; 2065 } 2066 2067 if (!!cp->val == hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) { 2068 err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev); 2069 goto failed; 2070 } 2071 2072 cmd = mgmt_pending_add(sk, MGMT_OP_SET_SSP, hdev, data, len); 2073 if (!cmd) 2074 err = -ENOMEM; 2075 else 2076 err = hci_cmd_sync_queue(hdev, set_ssp_sync, cmd, 2077 set_ssp_complete); 2078 2079 if (err < 0) { 2080 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP, 2081 MGMT_STATUS_FAILED); 2082 2083 if (cmd) 2084 mgmt_pending_remove(cmd); 2085 } 2086 2087 failed: 2088 hci_dev_unlock(hdev); 2089 return err; 2090 } 2091 2092 static int set_hs(struct sock *sk, struct hci_dev *hdev, void *data, u16 len) 2093 { 2094 bt_dev_dbg(hdev, "sock %p", sk); 2095 2096 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS, 2097 MGMT_STATUS_NOT_SUPPORTED); 2098 } 2099 2100 static void set_le_complete(struct hci_dev *hdev, void *data, int err) 2101 { 2102 struct mgmt_pending_cmd *cmd = data; 2103 struct cmd_lookup match = { NULL, hdev }; 2104 u8 status = mgmt_status(err); 2105 2106 bt_dev_dbg(hdev, "err %d", err); 2107 2108 if (err == -ECANCELED || !mgmt_pending_valid(hdev, data)) 2109 return; 2110 2111 if (status) { 2112 mgmt_cmd_status(cmd->sk, cmd->hdev->id, cmd->opcode, status); 2113 goto done; 2114 } 2115 2116 settings_rsp(cmd, &match); 2117 2118 new_settings(hdev, match.sk); 2119 2120 if (match.sk) 2121 sock_put(match.sk); 2122 2123 done: 2124 mgmt_pending_free(cmd); 2125 } 2126 2127 static int set_le_sync(struct hci_dev *hdev, void *data) 2128 { 2129 struct mgmt_pending_cmd *cmd = data; 2130 struct mgmt_mode cp; 2131 u8 val; 2132 int err; 2133 2134 mutex_lock(&hdev->mgmt_pending_lock); 2135 2136 if (!__mgmt_pending_listed(hdev, cmd)) { 2137 mutex_unlock(&hdev->mgmt_pending_lock); 2138 return -ECANCELED; 2139 } 2140 2141 memcpy(&cp, cmd->param, sizeof(cp)); 2142 val = !!cp.val; 2143 2144 mutex_unlock(&hdev->mgmt_pending_lock); 2145 2146 if (!val) { 2147 hci_clear_adv_instance_sync(hdev, NULL, 0x00, true); 2148 2149 if (hci_dev_test_flag(hdev, HCI_LE_ADV)) 2150 hci_disable_advertising_sync(hdev); 2151 2152 if (ext_adv_capable(hdev)) 2153 hci_remove_ext_adv_instance_sync(hdev, 0, cmd->sk); 2154 } else { 2155 hci_dev_set_flag(hdev, HCI_LE_ENABLED); 2156 } 2157 2158 err = hci_write_le_host_supported_sync(hdev, val, 0); 2159 2160 /* Make sure the controller has a good default for 2161 * advertising data. Restrict the update to when LE 2162 * has actually been enabled. During power on, the 2163 * update in powered_update_hci will take care of it. 2164 */ 2165 if (!err && hci_dev_test_flag(hdev, HCI_LE_ENABLED)) { 2166 if (ext_adv_capable(hdev)) { 2167 int status; 2168 2169 status = hci_setup_ext_adv_instance_sync(hdev, 0x00); 2170 if (!status) 2171 hci_update_scan_rsp_data_sync(hdev, 0x00); 2172 } else { 2173 hci_update_adv_data_sync(hdev, 0x00); 2174 hci_update_scan_rsp_data_sync(hdev, 0x00); 2175 } 2176 2177 hci_update_passive_scan(hdev); 2178 } 2179 2180 return err; 2181 } 2182 2183 static void set_mesh_complete(struct hci_dev *hdev, void *data, int err) 2184 { 2185 struct mgmt_pending_cmd *cmd = data; 2186 u8 status = mgmt_status(err); 2187 struct sock *sk; 2188 2189 if (err == -ECANCELED || !mgmt_pending_valid(hdev, cmd)) 2190 return; 2191 2192 sk = cmd->sk; 2193 2194 if (status) { 2195 mgmt_cmd_status(cmd->sk, hdev->id, cmd->opcode, status); 2196 goto done; 2197 } 2198 2199 mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_MESH_RECEIVER, 0, NULL, 0); 2200 2201 done: 2202 mgmt_pending_free(cmd); 2203 } 2204 2205 static int set_mesh_sync(struct hci_dev *hdev, void *data) 2206 { 2207 struct mgmt_pending_cmd *cmd = data; 2208 DEFINE_FLEX(struct mgmt_cp_set_mesh, cp, ad_types, num_ad_types, 2209 sizeof(hdev->mesh_ad_types)); 2210 size_t len; 2211 2212 mutex_lock(&hdev->mgmt_pending_lock); 2213 2214 if (!__mgmt_pending_listed(hdev, cmd)) { 2215 mutex_unlock(&hdev->mgmt_pending_lock); 2216 return -ECANCELED; 2217 } 2218 2219 len = cmd->param_len; 2220 memcpy(cp, cmd->param, min(__struct_size(cp), len)); 2221 2222 mutex_unlock(&hdev->mgmt_pending_lock); 2223 2224 memset(hdev->mesh_ad_types, 0, sizeof(hdev->mesh_ad_types)); 2225 2226 if (cp->enable) 2227 hci_dev_set_flag(hdev, HCI_MESH); 2228 else 2229 hci_dev_clear_flag(hdev, HCI_MESH); 2230 2231 hdev->le_scan_interval = __le16_to_cpu(cp->period); 2232 hdev->le_scan_window = __le16_to_cpu(cp->window); 2233 2234 len -= sizeof(struct mgmt_cp_set_mesh); 2235 2236 /* If filters don't fit, forward all adv pkts */ 2237 if (len <= sizeof(hdev->mesh_ad_types)) 2238 memcpy(hdev->mesh_ad_types, cp->ad_types, len); 2239 2240 hci_update_passive_scan_sync(hdev); 2241 return 0; 2242 } 2243 2244 static int set_mesh(struct sock *sk, struct hci_dev *hdev, void *data, u16 len) 2245 { 2246 struct mgmt_cp_set_mesh *cp = data; 2247 struct mgmt_pending_cmd *cmd; 2248 __u16 period, window; 2249 int err = 0; 2250 2251 bt_dev_dbg(hdev, "sock %p", sk); 2252 2253 if (!lmp_le_capable(hdev) || 2254 !hci_dev_test_flag(hdev, HCI_MESH_EXPERIMENTAL)) 2255 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_MESH_RECEIVER, 2256 MGMT_STATUS_NOT_SUPPORTED); 2257 2258 if (cp->enable != 0x00 && cp->enable != 0x01) 2259 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_MESH_RECEIVER, 2260 MGMT_STATUS_INVALID_PARAMS); 2261 2262 /* Keep allowed ranges in sync with set_scan_params() */ 2263 period = __le16_to_cpu(cp->period); 2264 2265 if (period < 0x0004 || period > 0x4000) 2266 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_MESH_RECEIVER, 2267 MGMT_STATUS_INVALID_PARAMS); 2268 2269 window = __le16_to_cpu(cp->window); 2270 2271 if (window < 0x0004 || window > 0x4000) 2272 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_MESH_RECEIVER, 2273 MGMT_STATUS_INVALID_PARAMS); 2274 2275 if (window > period) 2276 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_MESH_RECEIVER, 2277 MGMT_STATUS_INVALID_PARAMS); 2278 2279 hci_dev_lock(hdev); 2280 2281 cmd = mgmt_pending_add(sk, MGMT_OP_SET_MESH_RECEIVER, hdev, data, len); 2282 if (!cmd) 2283 err = -ENOMEM; 2284 else 2285 err = hci_cmd_sync_queue(hdev, set_mesh_sync, cmd, 2286 set_mesh_complete); 2287 2288 if (err < 0) { 2289 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_MESH_RECEIVER, 2290 MGMT_STATUS_FAILED); 2291 2292 if (cmd) 2293 mgmt_pending_remove(cmd); 2294 } 2295 2296 hci_dev_unlock(hdev); 2297 return err; 2298 } 2299 2300 static void mesh_send_start_complete(struct hci_dev *hdev, void *data, int err) 2301 { 2302 struct mgmt_mesh_tx *mesh_tx = data; 2303 struct mgmt_cp_mesh_send *send = (void *)mesh_tx->param; 2304 unsigned long mesh_send_interval; 2305 u8 mgmt_err = mgmt_status(err); 2306 2307 /* Report any errors here, but don't report completion */ 2308 2309 if (mgmt_err) { 2310 hci_dev_clear_flag(hdev, HCI_MESH_SENDING); 2311 /* Send Complete Error Code for handle */ 2312 mesh_send_complete(hdev, mesh_tx, false); 2313 return; 2314 } 2315 2316 mesh_send_interval = msecs_to_jiffies((send->cnt) * 25); 2317 queue_delayed_work(hdev->req_workqueue, &hdev->mesh_send_done, 2318 mesh_send_interval); 2319 } 2320 2321 static int mesh_send_sync(struct hci_dev *hdev, void *data) 2322 { 2323 struct mgmt_mesh_tx *mesh_tx = data; 2324 struct mgmt_cp_mesh_send *send = (void *)mesh_tx->param; 2325 struct adv_info *adv, *next_instance; 2326 u8 instance = hdev->le_num_of_adv_sets + 1; 2327 u16 timeout, duration; 2328 int err = 0; 2329 2330 if (hdev->le_num_of_adv_sets <= hdev->adv_instance_cnt) 2331 return MGMT_STATUS_BUSY; 2332 2333 timeout = 1000; 2334 duration = send->cnt * INTERVAL_TO_MS(hdev->le_adv_max_interval); 2335 adv = hci_add_adv_instance(hdev, instance, 0, 2336 send->adv_data_len, send->adv_data, 2337 0, NULL, 2338 timeout, duration, 2339 HCI_ADV_TX_POWER_NO_PREFERENCE, 2340 hdev->le_adv_min_interval, 2341 hdev->le_adv_max_interval, 2342 mesh_tx->handle); 2343 2344 if (!IS_ERR(adv)) 2345 mesh_tx->instance = instance; 2346 else 2347 err = PTR_ERR(adv); 2348 2349 if (hdev->cur_adv_instance == instance) { 2350 /* If the currently advertised instance is being changed then 2351 * cancel the current advertising and schedule the next 2352 * instance. If there is only one instance then the overridden 2353 * advertising data will be visible right away. 2354 */ 2355 cancel_adv_timeout(hdev); 2356 2357 next_instance = hci_get_next_instance(hdev, instance); 2358 if (next_instance) 2359 instance = next_instance->instance; 2360 else 2361 instance = 0; 2362 } else if (hdev->adv_instance_timeout) { 2363 /* Immediately advertise the new instance if no other, or 2364 * let it go naturally from queue if ADV is already happening 2365 */ 2366 instance = 0; 2367 } 2368 2369 if (instance) 2370 return hci_schedule_adv_instance_sync(hdev, instance, true); 2371 2372 return err; 2373 } 2374 2375 static void send_count(struct mgmt_mesh_tx *mesh_tx, void *data) 2376 { 2377 struct mgmt_rp_mesh_read_features *rp = data; 2378 2379 if (rp->used_handles >= rp->max_handles) 2380 return; 2381 2382 rp->handles[rp->used_handles++] = mesh_tx->handle; 2383 } 2384 2385 static int mesh_features(struct sock *sk, struct hci_dev *hdev, 2386 void *data, u16 len) 2387 { 2388 struct mgmt_rp_mesh_read_features rp; 2389 2390 if (!lmp_le_capable(hdev) || 2391 !hci_dev_test_flag(hdev, HCI_MESH_EXPERIMENTAL)) 2392 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_MESH_READ_FEATURES, 2393 MGMT_STATUS_NOT_SUPPORTED); 2394 2395 memset(&rp, 0, sizeof(rp)); 2396 rp.index = cpu_to_le16(hdev->id); 2397 if (hci_dev_test_flag(hdev, HCI_LE_ENABLED)) 2398 rp.max_handles = MESH_HANDLES_MAX; 2399 2400 hci_dev_lock(hdev); 2401 2402 if (rp.max_handles) 2403 mgmt_mesh_foreach(hdev, send_count, &rp, sk); 2404 2405 mgmt_cmd_complete(sk, hdev->id, MGMT_OP_MESH_READ_FEATURES, 0, &rp, 2406 rp.used_handles + sizeof(rp) - MESH_HANDLES_MAX); 2407 2408 hci_dev_unlock(hdev); 2409 return 0; 2410 } 2411 2412 static int send_cancel(struct hci_dev *hdev, void *data) 2413 { 2414 struct mgmt_pending_cmd *cmd = data; 2415 struct mgmt_cp_mesh_send_cancel *cancel = (void *)cmd->param; 2416 struct mgmt_mesh_tx *mesh_tx; 2417 2418 if (!cancel->handle) { 2419 do { 2420 mesh_tx = mgmt_mesh_next(hdev, cmd->sk); 2421 2422 if (mesh_tx) 2423 mesh_send_complete(hdev, mesh_tx, false); 2424 } while (mesh_tx); 2425 } else { 2426 mesh_tx = mgmt_mesh_find(hdev, cancel->handle); 2427 2428 if (mesh_tx && mesh_tx->sk == cmd->sk) 2429 mesh_send_complete(hdev, mesh_tx, false); 2430 } 2431 2432 mgmt_cmd_complete(cmd->sk, hdev->id, MGMT_OP_MESH_SEND_CANCEL, 2433 0, NULL, 0); 2434 mgmt_pending_free(cmd); 2435 2436 return 0; 2437 } 2438 2439 static int mesh_send_cancel(struct sock *sk, struct hci_dev *hdev, 2440 void *data, u16 len) 2441 { 2442 struct mgmt_pending_cmd *cmd; 2443 int err; 2444 2445 if (!lmp_le_capable(hdev) || 2446 !hci_dev_test_flag(hdev, HCI_MESH_EXPERIMENTAL)) 2447 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_MESH_SEND_CANCEL, 2448 MGMT_STATUS_NOT_SUPPORTED); 2449 2450 if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED)) 2451 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_MESH_SEND_CANCEL, 2452 MGMT_STATUS_REJECTED); 2453 2454 hci_dev_lock(hdev); 2455 cmd = mgmt_pending_new(sk, MGMT_OP_MESH_SEND_CANCEL, hdev, data, len); 2456 if (!cmd) 2457 err = -ENOMEM; 2458 else 2459 err = hci_cmd_sync_queue(hdev, send_cancel, cmd, NULL); 2460 2461 if (err < 0) { 2462 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_MESH_SEND_CANCEL, 2463 MGMT_STATUS_FAILED); 2464 2465 if (cmd) 2466 mgmt_pending_free(cmd); 2467 } 2468 2469 hci_dev_unlock(hdev); 2470 return err; 2471 } 2472 2473 static int mesh_send(struct sock *sk, struct hci_dev *hdev, void *data, u16 len) 2474 { 2475 struct mgmt_mesh_tx *mesh_tx; 2476 struct mgmt_cp_mesh_send *send = data; 2477 struct mgmt_rp_mesh_read_features rp; 2478 u16 expected_len; 2479 bool sending; 2480 int err = 0; 2481 2482 if (!lmp_le_capable(hdev) || 2483 !hci_dev_test_flag(hdev, HCI_MESH_EXPERIMENTAL)) 2484 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_MESH_SEND, 2485 MGMT_STATUS_NOT_SUPPORTED); 2486 if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED)) 2487 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_MESH_SEND, 2488 MGMT_STATUS_REJECTED); 2489 2490 if (!send->adv_data_len || send->adv_data_len > 31) 2491 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_MESH_SEND, 2492 MGMT_STATUS_REJECTED); 2493 2494 expected_len = struct_size(send, adv_data, send->adv_data_len); 2495 if (expected_len != len) 2496 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_MESH_SEND, 2497 MGMT_STATUS_INVALID_PARAMS); 2498 2499 hci_dev_lock(hdev); 2500 2501 memset(&rp, 0, sizeof(rp)); 2502 rp.max_handles = MESH_HANDLES_MAX; 2503 2504 mgmt_mesh_foreach(hdev, send_count, &rp, sk); 2505 2506 if (rp.max_handles <= rp.used_handles) { 2507 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_MESH_SEND, 2508 MGMT_STATUS_BUSY); 2509 goto done; 2510 } 2511 2512 sending = hci_dev_test_flag(hdev, HCI_MESH_SENDING); 2513 mesh_tx = mgmt_mesh_add(sk, hdev, send, len); 2514 2515 if (!mesh_tx) 2516 err = -ENOMEM; 2517 else if (!sending) 2518 err = hci_cmd_sync_queue(hdev, mesh_send_sync, mesh_tx, 2519 mesh_send_start_complete); 2520 2521 if (err < 0) { 2522 bt_dev_err(hdev, "Send Mesh Failed %d", err); 2523 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_MESH_SEND, 2524 MGMT_STATUS_FAILED); 2525 2526 if (mesh_tx) { 2527 if (sending) 2528 mgmt_mesh_remove(mesh_tx); 2529 } 2530 } else { 2531 hci_dev_set_flag(hdev, HCI_MESH_SENDING); 2532 2533 mgmt_cmd_complete(sk, hdev->id, MGMT_OP_MESH_SEND, 0, 2534 &mesh_tx->handle, 1); 2535 } 2536 2537 done: 2538 hci_dev_unlock(hdev); 2539 return err; 2540 } 2541 2542 static int set_le(struct sock *sk, struct hci_dev *hdev, void *data, u16 len) 2543 { 2544 struct mgmt_mode *cp = data; 2545 struct mgmt_pending_cmd *cmd; 2546 int err; 2547 u8 val, enabled; 2548 2549 bt_dev_dbg(hdev, "sock %p", sk); 2550 2551 if (!lmp_le_capable(hdev)) 2552 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE, 2553 MGMT_STATUS_NOT_SUPPORTED); 2554 2555 if (cp->val != 0x00 && cp->val != 0x01) 2556 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE, 2557 MGMT_STATUS_INVALID_PARAMS); 2558 2559 /* Bluetooth single mode LE only controllers or dual-mode 2560 * controllers configured as LE only devices, do not allow 2561 * switching LE off. These have either LE enabled explicitly 2562 * or BR/EDR has been previously switched off. 2563 * 2564 * When trying to enable an already enabled LE, then gracefully 2565 * send a positive response. Trying to disable it however will 2566 * result into rejection. 2567 */ 2568 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) { 2569 if (cp->val == 0x01) 2570 return send_settings_rsp(sk, MGMT_OP_SET_LE, hdev); 2571 2572 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE, 2573 MGMT_STATUS_REJECTED); 2574 } 2575 2576 hci_dev_lock(hdev); 2577 2578 val = !!cp->val; 2579 enabled = lmp_host_le_capable(hdev); 2580 2581 if (!hdev_is_powered(hdev) || val == enabled) { 2582 bool changed = false; 2583 2584 if (val != hci_dev_test_flag(hdev, HCI_LE_ENABLED)) { 2585 hci_dev_change_flag(hdev, HCI_LE_ENABLED); 2586 changed = true; 2587 } 2588 2589 if (!val && hci_dev_test_flag(hdev, HCI_ADVERTISING)) { 2590 hci_dev_clear_flag(hdev, HCI_ADVERTISING); 2591 changed = true; 2592 } 2593 2594 err = send_settings_rsp(sk, MGMT_OP_SET_LE, hdev); 2595 if (err < 0) 2596 goto unlock; 2597 2598 if (changed) 2599 err = new_settings(hdev, sk); 2600 2601 goto unlock; 2602 } 2603 2604 if (pending_find(MGMT_OP_SET_LE, hdev) || 2605 pending_find(MGMT_OP_SET_ADVERTISING, hdev)) { 2606 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE, 2607 MGMT_STATUS_BUSY); 2608 goto unlock; 2609 } 2610 2611 cmd = mgmt_pending_add(sk, MGMT_OP_SET_LE, hdev, data, len); 2612 if (!cmd) 2613 err = -ENOMEM; 2614 else 2615 err = hci_cmd_sync_queue(hdev, set_le_sync, cmd, 2616 set_le_complete); 2617 2618 if (err < 0) { 2619 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE, 2620 MGMT_STATUS_FAILED); 2621 2622 if (cmd) 2623 mgmt_pending_remove(cmd); 2624 } 2625 2626 unlock: 2627 hci_dev_unlock(hdev); 2628 return err; 2629 } 2630 2631 static int send_hci_cmd_sync(struct hci_dev *hdev, void *data) 2632 { 2633 struct mgmt_pending_cmd *cmd = data; 2634 struct mgmt_cp_hci_cmd_sync *cp = cmd->param; 2635 struct sk_buff *skb; 2636 2637 skb = __hci_cmd_sync_ev(hdev, le16_to_cpu(cp->opcode), 2638 le16_to_cpu(cp->params_len), cp->params, 2639 cp->event, cp->timeout ? 2640 secs_to_jiffies(cp->timeout) : 2641 HCI_CMD_TIMEOUT); 2642 if (IS_ERR(skb)) { 2643 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_HCI_CMD_SYNC, 2644 mgmt_status(PTR_ERR(skb))); 2645 goto done; 2646 } 2647 2648 mgmt_cmd_complete(cmd->sk, hdev->id, MGMT_OP_HCI_CMD_SYNC, 0, 2649 skb->data, skb->len); 2650 2651 kfree_skb(skb); 2652 2653 done: 2654 mgmt_pending_free(cmd); 2655 2656 return 0; 2657 } 2658 2659 static int mgmt_hci_cmd_sync(struct sock *sk, struct hci_dev *hdev, 2660 void *data, u16 len) 2661 { 2662 struct mgmt_cp_hci_cmd_sync *cp = data; 2663 struct mgmt_pending_cmd *cmd; 2664 int err; 2665 2666 if (len != (offsetof(struct mgmt_cp_hci_cmd_sync, params) + 2667 le16_to_cpu(cp->params_len))) 2668 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_HCI_CMD_SYNC, 2669 MGMT_STATUS_INVALID_PARAMS); 2670 2671 hci_dev_lock(hdev); 2672 cmd = mgmt_pending_new(sk, MGMT_OP_HCI_CMD_SYNC, hdev, data, len); 2673 if (!cmd) 2674 err = -ENOMEM; 2675 else 2676 err = hci_cmd_sync_queue(hdev, send_hci_cmd_sync, cmd, NULL); 2677 2678 if (err < 0) { 2679 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_HCI_CMD_SYNC, 2680 MGMT_STATUS_FAILED); 2681 2682 if (cmd) 2683 mgmt_pending_free(cmd); 2684 } 2685 2686 hci_dev_unlock(hdev); 2687 return err; 2688 } 2689 2690 /* This is a helper function to test for pending mgmt commands that can 2691 * cause CoD or EIR HCI commands. We can only allow one such pending 2692 * mgmt command at a time since otherwise we cannot easily track what 2693 * the current values are, will be, and based on that calculate if a new 2694 * HCI command needs to be sent and if yes with what value. 2695 */ 2696 static bool pending_eir_or_class(struct hci_dev *hdev) 2697 { 2698 struct mgmt_pending_cmd *cmd; 2699 2700 list_for_each_entry(cmd, &hdev->mgmt_pending, list) { 2701 switch (cmd->opcode) { 2702 case MGMT_OP_ADD_UUID: 2703 case MGMT_OP_REMOVE_UUID: 2704 case MGMT_OP_SET_DEV_CLASS: 2705 case MGMT_OP_SET_POWERED: 2706 return true; 2707 } 2708 } 2709 2710 return false; 2711 } 2712 2713 static const u8 bluetooth_base_uuid[] = { 2714 0xfb, 0x34, 0x9b, 0x5f, 0x80, 0x00, 0x00, 0x80, 2715 0x00, 0x10, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 2716 }; 2717 2718 static u8 get_uuid_size(const u8 *uuid) 2719 { 2720 u32 val; 2721 2722 if (memcmp(uuid, bluetooth_base_uuid, 12)) 2723 return 128; 2724 2725 val = get_unaligned_le32(&uuid[12]); 2726 if (val > 0xffff) 2727 return 32; 2728 2729 return 16; 2730 } 2731 2732 static void mgmt_class_complete(struct hci_dev *hdev, void *data, int err) 2733 { 2734 struct mgmt_pending_cmd *cmd = data; 2735 2736 bt_dev_dbg(hdev, "err %d", err); 2737 2738 mgmt_cmd_complete(cmd->sk, cmd->hdev->id, cmd->opcode, 2739 mgmt_status(err), hdev->dev_class, 3); 2740 2741 mgmt_pending_free(cmd); 2742 } 2743 2744 static int add_uuid_sync(struct hci_dev *hdev, void *data) 2745 { 2746 int err; 2747 2748 err = hci_update_class_sync(hdev); 2749 if (err) 2750 return err; 2751 2752 return hci_update_eir_sync(hdev); 2753 } 2754 2755 static int add_uuid(struct sock *sk, struct hci_dev *hdev, void *data, u16 len) 2756 { 2757 struct mgmt_cp_add_uuid *cp = data; 2758 struct mgmt_pending_cmd *cmd; 2759 struct bt_uuid *uuid; 2760 int err; 2761 2762 bt_dev_dbg(hdev, "sock %p", sk); 2763 2764 hci_dev_lock(hdev); 2765 2766 if (pending_eir_or_class(hdev)) { 2767 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_UUID, 2768 MGMT_STATUS_BUSY); 2769 goto failed; 2770 } 2771 2772 uuid = kmalloc_obj(*uuid); 2773 if (!uuid) { 2774 err = -ENOMEM; 2775 goto failed; 2776 } 2777 2778 memcpy(uuid->uuid, cp->uuid, 16); 2779 uuid->svc_hint = cp->svc_hint; 2780 uuid->size = get_uuid_size(cp->uuid); 2781 2782 list_add_tail(&uuid->list, &hdev->uuids); 2783 2784 cmd = mgmt_pending_new(sk, MGMT_OP_ADD_UUID, hdev, data, len); 2785 if (!cmd) { 2786 err = -ENOMEM; 2787 goto failed; 2788 } 2789 2790 /* MGMT_OP_ADD_UUID don't require adapter the UP/Running so use 2791 * hci_cmd_sync_submit instead of hci_cmd_sync_queue. 2792 */ 2793 err = hci_cmd_sync_submit(hdev, add_uuid_sync, cmd, 2794 mgmt_class_complete); 2795 if (err < 0) { 2796 mgmt_pending_free(cmd); 2797 goto failed; 2798 } 2799 2800 failed: 2801 hci_dev_unlock(hdev); 2802 return err; 2803 } 2804 2805 static bool enable_service_cache(struct hci_dev *hdev) 2806 { 2807 if (!hdev_is_powered(hdev)) 2808 return false; 2809 2810 if (!hci_dev_test_and_set_flag(hdev, HCI_SERVICE_CACHE)) { 2811 queue_delayed_work(hdev->workqueue, &hdev->service_cache, 2812 CACHE_TIMEOUT); 2813 return true; 2814 } 2815 2816 return false; 2817 } 2818 2819 static int remove_uuid_sync(struct hci_dev *hdev, void *data) 2820 { 2821 int err; 2822 2823 err = hci_update_class_sync(hdev); 2824 if (err) 2825 return err; 2826 2827 return hci_update_eir_sync(hdev); 2828 } 2829 2830 static int remove_uuid(struct sock *sk, struct hci_dev *hdev, void *data, 2831 u16 len) 2832 { 2833 struct mgmt_cp_remove_uuid *cp = data; 2834 struct mgmt_pending_cmd *cmd; 2835 struct bt_uuid *match, *tmp; 2836 static const u8 bt_uuid_any[] = { 2837 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 2838 }; 2839 int err, found; 2840 2841 bt_dev_dbg(hdev, "sock %p", sk); 2842 2843 hci_dev_lock(hdev); 2844 2845 if (pending_eir_or_class(hdev)) { 2846 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID, 2847 MGMT_STATUS_BUSY); 2848 goto unlock; 2849 } 2850 2851 if (memcmp(cp->uuid, bt_uuid_any, 16) == 0) { 2852 hci_uuids_clear(hdev); 2853 2854 if (enable_service_cache(hdev)) { 2855 err = mgmt_cmd_complete(sk, hdev->id, 2856 MGMT_OP_REMOVE_UUID, 2857 0, hdev->dev_class, 3); 2858 goto unlock; 2859 } 2860 2861 goto update_class; 2862 } 2863 2864 found = 0; 2865 2866 list_for_each_entry_safe(match, tmp, &hdev->uuids, list) { 2867 if (memcmp(match->uuid, cp->uuid, 16) != 0) 2868 continue; 2869 2870 list_del(&match->list); 2871 kfree(match); 2872 found++; 2873 } 2874 2875 if (found == 0) { 2876 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID, 2877 MGMT_STATUS_INVALID_PARAMS); 2878 goto unlock; 2879 } 2880 2881 update_class: 2882 cmd = mgmt_pending_new(sk, MGMT_OP_REMOVE_UUID, hdev, data, len); 2883 if (!cmd) { 2884 err = -ENOMEM; 2885 goto unlock; 2886 } 2887 2888 /* MGMT_OP_REMOVE_UUID don't require adapter the UP/Running so use 2889 * hci_cmd_sync_submit instead of hci_cmd_sync_queue. 2890 */ 2891 err = hci_cmd_sync_submit(hdev, remove_uuid_sync, cmd, 2892 mgmt_class_complete); 2893 if (err < 0) 2894 mgmt_pending_free(cmd); 2895 2896 unlock: 2897 hci_dev_unlock(hdev); 2898 return err; 2899 } 2900 2901 static int set_class_sync(struct hci_dev *hdev, void *data) 2902 { 2903 int err = 0; 2904 2905 if (hci_dev_test_and_clear_flag(hdev, HCI_SERVICE_CACHE)) { 2906 cancel_delayed_work_sync(&hdev->service_cache); 2907 err = hci_update_eir_sync(hdev); 2908 } 2909 2910 if (err) 2911 return err; 2912 2913 return hci_update_class_sync(hdev); 2914 } 2915 2916 static int set_dev_class(struct sock *sk, struct hci_dev *hdev, void *data, 2917 u16 len) 2918 { 2919 struct mgmt_cp_set_dev_class *cp = data; 2920 struct mgmt_pending_cmd *cmd; 2921 int err; 2922 2923 bt_dev_dbg(hdev, "sock %p", sk); 2924 2925 if (!lmp_bredr_capable(hdev)) 2926 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 2927 MGMT_STATUS_NOT_SUPPORTED); 2928 2929 hci_dev_lock(hdev); 2930 2931 if (pending_eir_or_class(hdev)) { 2932 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 2933 MGMT_STATUS_BUSY); 2934 goto unlock; 2935 } 2936 2937 if ((cp->minor & 0x03) != 0 || (cp->major & 0xe0) != 0) { 2938 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 2939 MGMT_STATUS_INVALID_PARAMS); 2940 goto unlock; 2941 } 2942 2943 hdev->major_class = cp->major; 2944 hdev->minor_class = cp->minor; 2945 2946 if (!hdev_is_powered(hdev)) { 2947 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 0, 2948 hdev->dev_class, 3); 2949 goto unlock; 2950 } 2951 2952 cmd = mgmt_pending_new(sk, MGMT_OP_SET_DEV_CLASS, hdev, data, len); 2953 if (!cmd) { 2954 err = -ENOMEM; 2955 goto unlock; 2956 } 2957 2958 /* MGMT_OP_SET_DEV_CLASS don't require adapter the UP/Running so use 2959 * hci_cmd_sync_submit instead of hci_cmd_sync_queue. 2960 */ 2961 err = hci_cmd_sync_submit(hdev, set_class_sync, cmd, 2962 mgmt_class_complete); 2963 if (err < 0) 2964 mgmt_pending_free(cmd); 2965 2966 unlock: 2967 hci_dev_unlock(hdev); 2968 return err; 2969 } 2970 2971 static int load_link_keys(struct sock *sk, struct hci_dev *hdev, void *data, 2972 u16 len) 2973 { 2974 struct mgmt_cp_load_link_keys *cp = data; 2975 const u16 max_key_count = ((U16_MAX - sizeof(*cp)) / 2976 sizeof(struct mgmt_link_key_info)); 2977 u16 key_count, expected_len; 2978 bool changed; 2979 int i; 2980 2981 bt_dev_dbg(hdev, "sock %p", sk); 2982 2983 if (!lmp_bredr_capable(hdev)) 2984 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS, 2985 MGMT_STATUS_NOT_SUPPORTED); 2986 2987 key_count = __le16_to_cpu(cp->key_count); 2988 if (key_count > max_key_count) { 2989 bt_dev_err(hdev, "load_link_keys: too big key_count value %u", 2990 key_count); 2991 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS, 2992 MGMT_STATUS_INVALID_PARAMS); 2993 } 2994 2995 expected_len = struct_size(cp, keys, key_count); 2996 if (expected_len != len) { 2997 bt_dev_err(hdev, "load_link_keys: expected %u bytes, got %u bytes", 2998 expected_len, len); 2999 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS, 3000 MGMT_STATUS_INVALID_PARAMS); 3001 } 3002 3003 if (cp->debug_keys != 0x00 && cp->debug_keys != 0x01) 3004 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS, 3005 MGMT_STATUS_INVALID_PARAMS); 3006 3007 bt_dev_dbg(hdev, "debug_keys %u key_count %u", cp->debug_keys, 3008 key_count); 3009 3010 hci_dev_lock(hdev); 3011 3012 hci_link_keys_clear(hdev); 3013 3014 if (cp->debug_keys) 3015 changed = !hci_dev_test_and_set_flag(hdev, HCI_KEEP_DEBUG_KEYS); 3016 else 3017 changed = hci_dev_test_and_clear_flag(hdev, 3018 HCI_KEEP_DEBUG_KEYS); 3019 3020 if (changed) 3021 new_settings(hdev, NULL); 3022 3023 for (i = 0; i < key_count; i++) { 3024 struct mgmt_link_key_info *key = &cp->keys[i]; 3025 3026 if (hci_is_blocked_key(hdev, 3027 HCI_BLOCKED_KEY_TYPE_LINKKEY, 3028 key->val)) { 3029 bt_dev_warn(hdev, "Skipping blocked link key for %pMR", 3030 &key->addr.bdaddr); 3031 continue; 3032 } 3033 3034 if (key->addr.type != BDADDR_BREDR) { 3035 bt_dev_warn(hdev, 3036 "Invalid link address type %u for %pMR", 3037 key->addr.type, &key->addr.bdaddr); 3038 continue; 3039 } 3040 3041 if (key->type > 0x08) { 3042 bt_dev_warn(hdev, "Invalid link key type %u for %pMR", 3043 key->type, &key->addr.bdaddr); 3044 continue; 3045 } 3046 3047 /* Always ignore debug keys and require a new pairing if 3048 * the user wants to use them. 3049 */ 3050 if (key->type == HCI_LK_DEBUG_COMBINATION) 3051 continue; 3052 3053 hci_add_link_key(hdev, NULL, &key->addr.bdaddr, key->val, 3054 key->type, key->pin_len, NULL); 3055 } 3056 3057 mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS, 0, NULL, 0); 3058 3059 hci_dev_unlock(hdev); 3060 3061 return 0; 3062 } 3063 3064 static int device_unpaired(struct hci_dev *hdev, bdaddr_t *bdaddr, 3065 u8 addr_type, struct sock *skip_sk) 3066 { 3067 struct mgmt_ev_device_unpaired ev; 3068 3069 bacpy(&ev.addr.bdaddr, bdaddr); 3070 ev.addr.type = addr_type; 3071 3072 return mgmt_event(MGMT_EV_DEVICE_UNPAIRED, hdev, &ev, sizeof(ev), 3073 skip_sk); 3074 } 3075 3076 static void unpair_device_complete(struct hci_dev *hdev, void *data, int err) 3077 { 3078 struct mgmt_pending_cmd *cmd = data; 3079 struct mgmt_cp_unpair_device *cp = cmd->param; 3080 3081 if (!err) 3082 device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, cmd->sk); 3083 3084 cmd->cmd_complete(cmd, err); 3085 mgmt_pending_free(cmd); 3086 } 3087 3088 static int unpair_device_sync(struct hci_dev *hdev, void *data) 3089 { 3090 struct mgmt_pending_cmd *cmd = data; 3091 struct mgmt_cp_unpair_device *cp = cmd->param; 3092 struct hci_conn *conn; 3093 3094 if (cp->addr.type == BDADDR_BREDR) 3095 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, 3096 &cp->addr.bdaddr); 3097 else 3098 conn = hci_conn_hash_lookup_le(hdev, &cp->addr.bdaddr, 3099 le_addr_type(cp->addr.type)); 3100 3101 if (!conn) 3102 return 0; 3103 3104 /* Disregard any possible error since the likes of hci_abort_conn_sync 3105 * will clean up the connection no matter the error. 3106 */ 3107 hci_abort_conn(conn, HCI_ERROR_REMOTE_USER_TERM); 3108 3109 return 0; 3110 } 3111 3112 static int unpair_device(struct sock *sk, struct hci_dev *hdev, void *data, 3113 u16 len) 3114 { 3115 struct mgmt_cp_unpair_device *cp = data; 3116 struct mgmt_rp_unpair_device rp; 3117 struct hci_conn_params *params; 3118 struct mgmt_pending_cmd *cmd; 3119 struct hci_conn *conn; 3120 u8 addr_type; 3121 int err; 3122 3123 memset(&rp, 0, sizeof(rp)); 3124 bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr); 3125 rp.addr.type = cp->addr.type; 3126 3127 if (!bdaddr_type_is_valid(cp->addr.type)) 3128 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE, 3129 MGMT_STATUS_INVALID_PARAMS, 3130 &rp, sizeof(rp)); 3131 3132 if (cp->disconnect != 0x00 && cp->disconnect != 0x01) 3133 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE, 3134 MGMT_STATUS_INVALID_PARAMS, 3135 &rp, sizeof(rp)); 3136 3137 hci_dev_lock(hdev); 3138 3139 if (!hdev_is_powered(hdev)) { 3140 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE, 3141 MGMT_STATUS_NOT_POWERED, &rp, 3142 sizeof(rp)); 3143 goto unlock; 3144 } 3145 3146 if (cp->addr.type == BDADDR_BREDR) { 3147 /* If disconnection is requested, then look up the 3148 * connection. If the remote device is connected, it 3149 * will be later used to terminate the link. 3150 * 3151 * Setting it to NULL explicitly will cause no 3152 * termination of the link. 3153 */ 3154 if (cp->disconnect) 3155 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, 3156 &cp->addr.bdaddr); 3157 else 3158 conn = NULL; 3159 3160 err = hci_remove_link_key(hdev, &cp->addr.bdaddr); 3161 if (err < 0) { 3162 err = mgmt_cmd_complete(sk, hdev->id, 3163 MGMT_OP_UNPAIR_DEVICE, 3164 MGMT_STATUS_NOT_PAIRED, &rp, 3165 sizeof(rp)); 3166 goto unlock; 3167 } 3168 3169 goto done; 3170 } 3171 3172 /* LE address type */ 3173 addr_type = le_addr_type(cp->addr.type); 3174 3175 /* Abort any ongoing SMP pairing. Removes ltk and irk if they exist. */ 3176 err = smp_cancel_and_remove_pairing(hdev, &cp->addr.bdaddr, addr_type); 3177 if (err < 0) { 3178 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE, 3179 MGMT_STATUS_NOT_PAIRED, &rp, 3180 sizeof(rp)); 3181 goto unlock; 3182 } 3183 3184 conn = hci_conn_hash_lookup_le(hdev, &cp->addr.bdaddr, addr_type); 3185 if (!conn) { 3186 hci_conn_params_del(hdev, &cp->addr.bdaddr, addr_type); 3187 goto done; 3188 } 3189 3190 3191 /* Defer clearing up the connection parameters until closing to 3192 * give a chance of keeping them if a repairing happens. 3193 */ 3194 set_bit(HCI_CONN_PARAM_REMOVAL_PEND, &conn->flags); 3195 3196 /* Disable auto-connection parameters if present */ 3197 params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr, addr_type); 3198 if (params) { 3199 if (params->explicit_connect) 3200 params->auto_connect = HCI_AUTO_CONN_EXPLICIT; 3201 else 3202 params->auto_connect = HCI_AUTO_CONN_DISABLED; 3203 } 3204 3205 /* If disconnection is not requested, then clear the connection 3206 * variable so that the link is not terminated. 3207 */ 3208 if (!cp->disconnect) 3209 conn = NULL; 3210 3211 done: 3212 /* If the connection variable is set, then termination of the 3213 * link is requested. 3214 */ 3215 if (!conn) { 3216 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE, 0, 3217 &rp, sizeof(rp)); 3218 device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, sk); 3219 goto unlock; 3220 } 3221 3222 cmd = mgmt_pending_new(sk, MGMT_OP_UNPAIR_DEVICE, hdev, cp, 3223 sizeof(*cp)); 3224 if (!cmd) { 3225 err = -ENOMEM; 3226 goto unlock; 3227 } 3228 3229 cmd->cmd_complete = addr_cmd_complete; 3230 3231 err = hci_cmd_sync_queue(hdev, unpair_device_sync, cmd, 3232 unpair_device_complete); 3233 if (err < 0) 3234 mgmt_pending_free(cmd); 3235 3236 unlock: 3237 hci_dev_unlock(hdev); 3238 return err; 3239 } 3240 3241 static void disconnect_complete(struct hci_dev *hdev, void *data, int err) 3242 { 3243 struct mgmt_pending_cmd *cmd = data; 3244 3245 cmd->cmd_complete(cmd, mgmt_status(err)); 3246 mgmt_pending_free(cmd); 3247 } 3248 3249 static int disconnect_sync(struct hci_dev *hdev, void *data) 3250 { 3251 struct mgmt_pending_cmd *cmd = data; 3252 struct mgmt_cp_disconnect *cp = cmd->param; 3253 struct hci_conn *conn; 3254 3255 if (cp->addr.type == BDADDR_BREDR) 3256 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, 3257 &cp->addr.bdaddr); 3258 else 3259 conn = hci_conn_hash_lookup_le(hdev, &cp->addr.bdaddr, 3260 le_addr_type(cp->addr.type)); 3261 3262 if (!conn) 3263 return -ENOTCONN; 3264 3265 /* Disregard any possible error since the likes of hci_abort_conn_sync 3266 * will clean up the connection no matter the error. 3267 */ 3268 hci_abort_conn(conn, HCI_ERROR_REMOTE_USER_TERM); 3269 3270 return 0; 3271 } 3272 3273 static int disconnect(struct sock *sk, struct hci_dev *hdev, void *data, 3274 u16 len) 3275 { 3276 struct mgmt_cp_disconnect *cp = data; 3277 struct mgmt_rp_disconnect rp; 3278 struct mgmt_pending_cmd *cmd; 3279 int err; 3280 3281 bt_dev_dbg(hdev, "sock %p", sk); 3282 3283 memset(&rp, 0, sizeof(rp)); 3284 bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr); 3285 rp.addr.type = cp->addr.type; 3286 3287 if (!bdaddr_type_is_valid(cp->addr.type)) 3288 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT, 3289 MGMT_STATUS_INVALID_PARAMS, 3290 &rp, sizeof(rp)); 3291 3292 hci_dev_lock(hdev); 3293 3294 if (!test_bit(HCI_UP, &hdev->flags)) { 3295 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT, 3296 MGMT_STATUS_NOT_POWERED, &rp, 3297 sizeof(rp)); 3298 goto failed; 3299 } 3300 3301 cmd = mgmt_pending_new(sk, MGMT_OP_DISCONNECT, hdev, data, len); 3302 if (!cmd) { 3303 err = -ENOMEM; 3304 goto failed; 3305 } 3306 3307 cmd->cmd_complete = generic_cmd_complete; 3308 3309 err = hci_cmd_sync_queue(hdev, disconnect_sync, cmd, 3310 disconnect_complete); 3311 if (err < 0) 3312 mgmt_pending_free(cmd); 3313 3314 failed: 3315 hci_dev_unlock(hdev); 3316 return err; 3317 } 3318 3319 static u8 link_to_bdaddr(u8 link_type, u8 addr_type) 3320 { 3321 switch (link_type) { 3322 case CIS_LINK: 3323 case BIS_LINK: 3324 case PA_LINK: 3325 case LE_LINK: 3326 switch (addr_type) { 3327 case ADDR_LE_DEV_PUBLIC: 3328 return BDADDR_LE_PUBLIC; 3329 3330 default: 3331 /* Fallback to LE Random address type */ 3332 return BDADDR_LE_RANDOM; 3333 } 3334 3335 default: 3336 /* Fallback to BR/EDR type */ 3337 return BDADDR_BREDR; 3338 } 3339 } 3340 3341 static int get_connections(struct sock *sk, struct hci_dev *hdev, void *data, 3342 u16 data_len) 3343 { 3344 struct mgmt_rp_get_connections *rp; 3345 struct hci_conn *c; 3346 int err; 3347 u16 i; 3348 3349 bt_dev_dbg(hdev, "sock %p", sk); 3350 3351 hci_dev_lock(hdev); 3352 3353 if (!hdev_is_powered(hdev)) { 3354 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_CONNECTIONS, 3355 MGMT_STATUS_NOT_POWERED); 3356 goto unlock; 3357 } 3358 3359 i = 0; 3360 list_for_each_entry(c, &hdev->conn_hash.list, list) { 3361 if (test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags)) 3362 i++; 3363 } 3364 3365 rp = kmalloc_flex(*rp, addr, i); 3366 if (!rp) { 3367 err = -ENOMEM; 3368 goto unlock; 3369 } 3370 3371 i = 0; 3372 list_for_each_entry(c, &hdev->conn_hash.list, list) { 3373 if (!test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags)) 3374 continue; 3375 bacpy(&rp->addr[i].bdaddr, &c->dst); 3376 rp->addr[i].type = link_to_bdaddr(c->type, c->dst_type); 3377 if (c->type == SCO_LINK || c->type == ESCO_LINK) 3378 continue; 3379 i++; 3380 } 3381 3382 rp->conn_count = cpu_to_le16(i); 3383 3384 /* Recalculate length in case of filtered SCO connections, etc */ 3385 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONNECTIONS, 0, rp, 3386 struct_size(rp, addr, i)); 3387 3388 kfree(rp); 3389 3390 unlock: 3391 hci_dev_unlock(hdev); 3392 return err; 3393 } 3394 3395 static int send_pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev, 3396 struct mgmt_cp_pin_code_neg_reply *cp) 3397 { 3398 struct mgmt_pending_cmd *cmd; 3399 int err; 3400 3401 cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_NEG_REPLY, hdev, cp, 3402 sizeof(*cp)); 3403 if (!cmd) 3404 return -ENOMEM; 3405 3406 cmd->cmd_complete = addr_cmd_complete; 3407 3408 err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_NEG_REPLY, 3409 sizeof(cp->addr.bdaddr), &cp->addr.bdaddr); 3410 if (err < 0) 3411 mgmt_pending_remove(cmd); 3412 3413 return err; 3414 } 3415 3416 static int pin_code_reply(struct sock *sk, struct hci_dev *hdev, void *data, 3417 u16 len) 3418 { 3419 struct hci_conn *conn; 3420 struct mgmt_cp_pin_code_reply *cp = data; 3421 struct hci_cp_pin_code_reply reply; 3422 struct mgmt_pending_cmd *cmd; 3423 int err; 3424 3425 bt_dev_dbg(hdev, "sock %p", sk); 3426 3427 hci_dev_lock(hdev); 3428 3429 if (!hdev_is_powered(hdev)) { 3430 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY, 3431 MGMT_STATUS_NOT_POWERED); 3432 goto failed; 3433 } 3434 3435 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->addr.bdaddr); 3436 if (!conn) { 3437 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY, 3438 MGMT_STATUS_NOT_CONNECTED); 3439 goto failed; 3440 } 3441 3442 if (conn->pending_sec_level == BT_SECURITY_HIGH && cp->pin_len != 16) { 3443 struct mgmt_cp_pin_code_neg_reply ncp; 3444 3445 memcpy(&ncp.addr, &cp->addr, sizeof(ncp.addr)); 3446 3447 bt_dev_err(hdev, "PIN code is not 16 bytes long"); 3448 3449 err = send_pin_code_neg_reply(sk, hdev, &ncp); 3450 if (err >= 0) 3451 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY, 3452 MGMT_STATUS_INVALID_PARAMS); 3453 3454 goto failed; 3455 } 3456 3457 cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_REPLY, hdev, data, len); 3458 if (!cmd) { 3459 err = -ENOMEM; 3460 goto failed; 3461 } 3462 3463 cmd->cmd_complete = addr_cmd_complete; 3464 3465 bacpy(&reply.bdaddr, &cp->addr.bdaddr); 3466 reply.pin_len = cp->pin_len; 3467 memcpy(reply.pin_code, cp->pin_code, sizeof(reply.pin_code)); 3468 3469 err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_REPLY, sizeof(reply), &reply); 3470 if (err < 0) 3471 mgmt_pending_remove(cmd); 3472 3473 failed: 3474 hci_dev_unlock(hdev); 3475 return err; 3476 } 3477 3478 static int set_io_capability(struct sock *sk, struct hci_dev *hdev, void *data, 3479 u16 len) 3480 { 3481 struct mgmt_cp_set_io_capability *cp = data; 3482 3483 bt_dev_dbg(hdev, "sock %p", sk); 3484 3485 if (cp->io_capability > SMP_IO_KEYBOARD_DISPLAY) 3486 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_IO_CAPABILITY, 3487 MGMT_STATUS_INVALID_PARAMS); 3488 3489 hci_dev_lock(hdev); 3490 3491 hdev->io_capability = cp->io_capability; 3492 3493 bt_dev_dbg(hdev, "IO capability set to 0x%02x", hdev->io_capability); 3494 3495 hci_dev_unlock(hdev); 3496 3497 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_IO_CAPABILITY, 0, 3498 NULL, 0); 3499 } 3500 3501 static struct mgmt_pending_cmd *find_pairing(struct hci_conn *conn) 3502 { 3503 struct hci_dev *hdev = conn->hdev; 3504 struct mgmt_pending_cmd *cmd; 3505 3506 list_for_each_entry(cmd, &hdev->mgmt_pending, list) { 3507 if (cmd->opcode != MGMT_OP_PAIR_DEVICE) 3508 continue; 3509 3510 if (cmd->user_data != conn) 3511 continue; 3512 3513 return cmd; 3514 } 3515 3516 return NULL; 3517 } 3518 3519 static int pairing_complete(struct mgmt_pending_cmd *cmd, u8 status) 3520 { 3521 struct mgmt_rp_pair_device rp; 3522 struct hci_conn *conn = cmd->user_data; 3523 int err; 3524 3525 bacpy(&rp.addr.bdaddr, &conn->dst); 3526 rp.addr.type = link_to_bdaddr(conn->type, conn->dst_type); 3527 3528 err = mgmt_cmd_complete(cmd->sk, cmd->hdev->id, MGMT_OP_PAIR_DEVICE, 3529 status, &rp, sizeof(rp)); 3530 3531 /* So we don't get further callbacks for this connection */ 3532 conn->connect_cfm_cb = NULL; 3533 conn->security_cfm_cb = NULL; 3534 conn->disconn_cfm_cb = NULL; 3535 3536 hci_conn_drop(conn); 3537 3538 /* The device is paired so there is no need to remove 3539 * its connection parameters anymore. 3540 */ 3541 clear_bit(HCI_CONN_PARAM_REMOVAL_PEND, &conn->flags); 3542 3543 hci_conn_put(conn); 3544 3545 return err; 3546 } 3547 3548 void mgmt_smp_complete(struct hci_conn *conn, bool complete) 3549 { 3550 u8 status = complete ? MGMT_STATUS_SUCCESS : MGMT_STATUS_FAILED; 3551 struct mgmt_pending_cmd *cmd; 3552 3553 cmd = find_pairing(conn); 3554 if (cmd) { 3555 cmd->cmd_complete(cmd, status); 3556 mgmt_pending_remove(cmd); 3557 } 3558 } 3559 3560 static void pairing_complete_cb(struct hci_conn *conn, u8 status) 3561 { 3562 struct mgmt_pending_cmd *cmd; 3563 3564 BT_DBG("status %u", status); 3565 3566 cmd = find_pairing(conn); 3567 if (!cmd) { 3568 BT_DBG("Unable to find a pending command"); 3569 return; 3570 } 3571 3572 cmd->cmd_complete(cmd, mgmt_status(status)); 3573 mgmt_pending_remove(cmd); 3574 } 3575 3576 static void le_pairing_complete_cb(struct hci_conn *conn, u8 status) 3577 { 3578 struct mgmt_pending_cmd *cmd; 3579 3580 BT_DBG("status %u", status); 3581 3582 if (!status) 3583 return; 3584 3585 cmd = find_pairing(conn); 3586 if (!cmd) { 3587 BT_DBG("Unable to find a pending command"); 3588 return; 3589 } 3590 3591 cmd->cmd_complete(cmd, mgmt_status(status)); 3592 mgmt_pending_remove(cmd); 3593 } 3594 3595 static int pair_device(struct sock *sk, struct hci_dev *hdev, void *data, 3596 u16 len) 3597 { 3598 struct mgmt_cp_pair_device *cp = data; 3599 struct mgmt_rp_pair_device rp; 3600 struct mgmt_pending_cmd *cmd; 3601 u8 sec_level, auth_type; 3602 struct hci_conn *conn; 3603 int err; 3604 3605 bt_dev_dbg(hdev, "sock %p", sk); 3606 3607 memset(&rp, 0, sizeof(rp)); 3608 bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr); 3609 rp.addr.type = cp->addr.type; 3610 3611 if (!bdaddr_type_is_valid(cp->addr.type)) 3612 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE, 3613 MGMT_STATUS_INVALID_PARAMS, 3614 &rp, sizeof(rp)); 3615 3616 if (cp->io_cap > SMP_IO_KEYBOARD_DISPLAY) 3617 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE, 3618 MGMT_STATUS_INVALID_PARAMS, 3619 &rp, sizeof(rp)); 3620 3621 hci_dev_lock(hdev); 3622 3623 if (!hdev_is_powered(hdev)) { 3624 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE, 3625 MGMT_STATUS_NOT_POWERED, &rp, 3626 sizeof(rp)); 3627 goto unlock; 3628 } 3629 3630 if (hci_bdaddr_is_paired(hdev, &cp->addr.bdaddr, cp->addr.type)) { 3631 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE, 3632 MGMT_STATUS_ALREADY_PAIRED, &rp, 3633 sizeof(rp)); 3634 goto unlock; 3635 } 3636 3637 sec_level = BT_SECURITY_MEDIUM; 3638 auth_type = HCI_AT_DEDICATED_BONDING; 3639 3640 if (cp->addr.type == BDADDR_BREDR) { 3641 conn = hci_connect_acl(hdev, &cp->addr.bdaddr, sec_level, 3642 auth_type, CONN_REASON_PAIR_DEVICE, 3643 HCI_ACL_CONN_TIMEOUT); 3644 } else { 3645 u8 addr_type = le_addr_type(cp->addr.type); 3646 struct hci_conn_params *p; 3647 3648 /* When pairing a new device, it is expected to remember 3649 * this device for future connections. Adding the connection 3650 * parameter information ahead of time allows tracking 3651 * of the peripheral preferred values and will speed up any 3652 * further connection establishment. 3653 * 3654 * If connection parameters already exist, then they 3655 * will be kept and this function does nothing. 3656 */ 3657 p = hci_conn_params_add(hdev, &cp->addr.bdaddr, addr_type); 3658 if (!p) { 3659 err = -EIO; 3660 goto unlock; 3661 } 3662 3663 if (p->auto_connect == HCI_AUTO_CONN_EXPLICIT) 3664 p->auto_connect = HCI_AUTO_CONN_DISABLED; 3665 3666 conn = hci_connect_le_scan(hdev, &cp->addr.bdaddr, addr_type, 3667 sec_level, HCI_LE_CONN_TIMEOUT, 3668 CONN_REASON_PAIR_DEVICE); 3669 } 3670 3671 if (IS_ERR(conn)) { 3672 int status; 3673 3674 if (PTR_ERR(conn) == -EBUSY) 3675 status = MGMT_STATUS_BUSY; 3676 else if (PTR_ERR(conn) == -EOPNOTSUPP) 3677 status = MGMT_STATUS_NOT_SUPPORTED; 3678 else if (PTR_ERR(conn) == -ECONNREFUSED) 3679 status = MGMT_STATUS_REJECTED; 3680 else 3681 status = MGMT_STATUS_CONNECT_FAILED; 3682 3683 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE, 3684 status, &rp, sizeof(rp)); 3685 goto unlock; 3686 } 3687 3688 if (conn->connect_cfm_cb) { 3689 hci_conn_drop(conn); 3690 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE, 3691 MGMT_STATUS_BUSY, &rp, sizeof(rp)); 3692 goto unlock; 3693 } 3694 3695 cmd = mgmt_pending_add(sk, MGMT_OP_PAIR_DEVICE, hdev, data, len); 3696 if (!cmd) { 3697 err = -ENOMEM; 3698 hci_conn_drop(conn); 3699 goto unlock; 3700 } 3701 3702 cmd->cmd_complete = pairing_complete; 3703 3704 /* For LE, just connecting isn't a proof that the pairing finished */ 3705 if (cp->addr.type == BDADDR_BREDR) { 3706 conn->connect_cfm_cb = pairing_complete_cb; 3707 conn->security_cfm_cb = pairing_complete_cb; 3708 conn->disconn_cfm_cb = pairing_complete_cb; 3709 } else { 3710 conn->connect_cfm_cb = le_pairing_complete_cb; 3711 conn->security_cfm_cb = le_pairing_complete_cb; 3712 conn->disconn_cfm_cb = le_pairing_complete_cb; 3713 } 3714 3715 conn->io_capability = cp->io_cap; 3716 cmd->user_data = hci_conn_get(conn); 3717 3718 if ((conn->state == BT_CONNECTED || conn->state == BT_CONFIG) && 3719 hci_conn_security(conn, sec_level, auth_type, true)) { 3720 cmd->cmd_complete(cmd, 0); 3721 mgmt_pending_remove(cmd); 3722 } 3723 3724 err = 0; 3725 3726 unlock: 3727 hci_dev_unlock(hdev); 3728 return err; 3729 } 3730 3731 static int cancel_pair_device(struct sock *sk, struct hci_dev *hdev, void *data, 3732 u16 len) 3733 { 3734 struct mgmt_addr_info *addr = data; 3735 struct mgmt_pending_cmd *cmd; 3736 struct hci_conn *conn; 3737 int err; 3738 3739 bt_dev_dbg(hdev, "sock %p", sk); 3740 3741 hci_dev_lock(hdev); 3742 3743 if (!hdev_is_powered(hdev)) { 3744 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE, 3745 MGMT_STATUS_NOT_POWERED); 3746 goto unlock; 3747 } 3748 3749 cmd = pending_find(MGMT_OP_PAIR_DEVICE, hdev); 3750 if (!cmd) { 3751 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE, 3752 MGMT_STATUS_INVALID_PARAMS); 3753 goto unlock; 3754 } 3755 3756 conn = cmd->user_data; 3757 3758 if (bacmp(&addr->bdaddr, &conn->dst) != 0) { 3759 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE, 3760 MGMT_STATUS_INVALID_PARAMS); 3761 goto unlock; 3762 } 3763 3764 cmd->cmd_complete(cmd, MGMT_STATUS_CANCELLED); 3765 mgmt_pending_remove(cmd); 3766 3767 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE, 0, 3768 addr, sizeof(*addr)); 3769 3770 /* Since user doesn't want to proceed with the connection, abort any 3771 * ongoing pairing and then terminate the link if it was created 3772 * because of the pair device action. 3773 */ 3774 if (addr->type == BDADDR_BREDR) 3775 hci_remove_link_key(hdev, &addr->bdaddr); 3776 else 3777 smp_cancel_and_remove_pairing(hdev, &addr->bdaddr, 3778 le_addr_type(addr->type)); 3779 3780 if (conn->conn_reason == CONN_REASON_PAIR_DEVICE) 3781 hci_abort_conn(conn, HCI_ERROR_REMOTE_USER_TERM); 3782 3783 unlock: 3784 hci_dev_unlock(hdev); 3785 return err; 3786 } 3787 3788 static int user_pairing_resp(struct sock *sk, struct hci_dev *hdev, 3789 struct mgmt_addr_info *addr, u16 mgmt_op, 3790 u16 hci_op, __le32 passkey) 3791 { 3792 struct mgmt_pending_cmd *cmd; 3793 struct hci_conn *conn; 3794 int err; 3795 3796 hci_dev_lock(hdev); 3797 3798 if (!hdev_is_powered(hdev)) { 3799 err = mgmt_cmd_complete(sk, hdev->id, mgmt_op, 3800 MGMT_STATUS_NOT_POWERED, addr, 3801 sizeof(*addr)); 3802 goto done; 3803 } 3804 3805 if (addr->type == BDADDR_BREDR) 3806 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &addr->bdaddr); 3807 else 3808 conn = hci_conn_hash_lookup_le(hdev, &addr->bdaddr, 3809 le_addr_type(addr->type)); 3810 3811 if (!conn) { 3812 err = mgmt_cmd_complete(sk, hdev->id, mgmt_op, 3813 MGMT_STATUS_NOT_CONNECTED, addr, 3814 sizeof(*addr)); 3815 goto done; 3816 } 3817 3818 if (addr->type == BDADDR_LE_PUBLIC || addr->type == BDADDR_LE_RANDOM) { 3819 err = smp_user_confirm_reply(conn, mgmt_op, passkey); 3820 if (!err) 3821 err = mgmt_cmd_complete(sk, hdev->id, mgmt_op, 3822 MGMT_STATUS_SUCCESS, addr, 3823 sizeof(*addr)); 3824 else 3825 err = mgmt_cmd_complete(sk, hdev->id, mgmt_op, 3826 MGMT_STATUS_FAILED, addr, 3827 sizeof(*addr)); 3828 3829 goto done; 3830 } 3831 3832 cmd = mgmt_pending_add(sk, mgmt_op, hdev, addr, sizeof(*addr)); 3833 if (!cmd) { 3834 err = -ENOMEM; 3835 goto done; 3836 } 3837 3838 cmd->cmd_complete = addr_cmd_complete; 3839 3840 /* Continue with pairing via HCI */ 3841 if (hci_op == HCI_OP_USER_PASSKEY_REPLY) { 3842 struct hci_cp_user_passkey_reply cp; 3843 3844 bacpy(&cp.bdaddr, &addr->bdaddr); 3845 cp.passkey = passkey; 3846 err = hci_send_cmd(hdev, hci_op, sizeof(cp), &cp); 3847 } else 3848 err = hci_send_cmd(hdev, hci_op, sizeof(addr->bdaddr), 3849 &addr->bdaddr); 3850 3851 if (err < 0) 3852 mgmt_pending_remove(cmd); 3853 3854 done: 3855 hci_dev_unlock(hdev); 3856 return err; 3857 } 3858 3859 static int pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev, 3860 void *data, u16 len) 3861 { 3862 struct mgmt_cp_pin_code_neg_reply *cp = data; 3863 3864 bt_dev_dbg(hdev, "sock %p", sk); 3865 3866 return user_pairing_resp(sk, hdev, &cp->addr, 3867 MGMT_OP_PIN_CODE_NEG_REPLY, 3868 HCI_OP_PIN_CODE_NEG_REPLY, 0); 3869 } 3870 3871 static int user_confirm_reply(struct sock *sk, struct hci_dev *hdev, void *data, 3872 u16 len) 3873 { 3874 struct mgmt_cp_user_confirm_reply *cp = data; 3875 3876 bt_dev_dbg(hdev, "sock %p", sk); 3877 3878 if (len != sizeof(*cp)) 3879 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_USER_CONFIRM_REPLY, 3880 MGMT_STATUS_INVALID_PARAMS); 3881 3882 return user_pairing_resp(sk, hdev, &cp->addr, 3883 MGMT_OP_USER_CONFIRM_REPLY, 3884 HCI_OP_USER_CONFIRM_REPLY, 0); 3885 } 3886 3887 static int user_confirm_neg_reply(struct sock *sk, struct hci_dev *hdev, 3888 void *data, u16 len) 3889 { 3890 struct mgmt_cp_user_confirm_neg_reply *cp = data; 3891 3892 bt_dev_dbg(hdev, "sock %p", sk); 3893 3894 return user_pairing_resp(sk, hdev, &cp->addr, 3895 MGMT_OP_USER_CONFIRM_NEG_REPLY, 3896 HCI_OP_USER_CONFIRM_NEG_REPLY, 0); 3897 } 3898 3899 static int user_passkey_reply(struct sock *sk, struct hci_dev *hdev, void *data, 3900 u16 len) 3901 { 3902 struct mgmt_cp_user_passkey_reply *cp = data; 3903 3904 bt_dev_dbg(hdev, "sock %p", sk); 3905 3906 return user_pairing_resp(sk, hdev, &cp->addr, 3907 MGMT_OP_USER_PASSKEY_REPLY, 3908 HCI_OP_USER_PASSKEY_REPLY, cp->passkey); 3909 } 3910 3911 static int user_passkey_neg_reply(struct sock *sk, struct hci_dev *hdev, 3912 void *data, u16 len) 3913 { 3914 struct mgmt_cp_user_passkey_neg_reply *cp = data; 3915 3916 bt_dev_dbg(hdev, "sock %p", sk); 3917 3918 return user_pairing_resp(sk, hdev, &cp->addr, 3919 MGMT_OP_USER_PASSKEY_NEG_REPLY, 3920 HCI_OP_USER_PASSKEY_NEG_REPLY, 0); 3921 } 3922 3923 static int adv_expire_sync(struct hci_dev *hdev, u32 flags) 3924 { 3925 struct adv_info *adv_instance; 3926 3927 adv_instance = hci_find_adv_instance(hdev, hdev->cur_adv_instance); 3928 if (!adv_instance) 3929 return 0; 3930 3931 /* stop if current instance doesn't need to be changed */ 3932 if (!(adv_instance->flags & flags)) 3933 return 0; 3934 3935 cancel_adv_timeout(hdev); 3936 3937 adv_instance = hci_get_next_instance(hdev, adv_instance->instance); 3938 if (!adv_instance) 3939 return 0; 3940 3941 hci_schedule_adv_instance_sync(hdev, adv_instance->instance, true); 3942 3943 return 0; 3944 } 3945 3946 static int name_changed_sync(struct hci_dev *hdev, void *data) 3947 { 3948 return adv_expire_sync(hdev, MGMT_ADV_FLAG_LOCAL_NAME); 3949 } 3950 3951 static void set_name_complete(struct hci_dev *hdev, void *data, int err) 3952 { 3953 struct mgmt_pending_cmd *cmd = data; 3954 struct mgmt_cp_set_local_name *cp; 3955 u8 status = mgmt_status(err); 3956 3957 bt_dev_dbg(hdev, "err %d", err); 3958 3959 if (err == -ECANCELED || !mgmt_pending_valid(hdev, cmd)) 3960 return; 3961 3962 cp = cmd->param; 3963 3964 if (status) { 3965 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 3966 status); 3967 } else { 3968 mgmt_cmd_complete(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0, 3969 cp, sizeof(*cp)); 3970 3971 if (hci_dev_test_flag(hdev, HCI_LE_ADV)) 3972 hci_cmd_sync_queue(hdev, name_changed_sync, NULL, NULL); 3973 } 3974 3975 mgmt_pending_free(cmd); 3976 } 3977 3978 static int set_name_sync(struct hci_dev *hdev, void *data) 3979 { 3980 struct mgmt_pending_cmd *cmd = data; 3981 struct mgmt_cp_set_local_name cp; 3982 3983 mutex_lock(&hdev->mgmt_pending_lock); 3984 3985 if (!__mgmt_pending_listed(hdev, cmd)) { 3986 mutex_unlock(&hdev->mgmt_pending_lock); 3987 return -ECANCELED; 3988 } 3989 3990 memcpy(&cp, cmd->param, sizeof(cp)); 3991 3992 mutex_unlock(&hdev->mgmt_pending_lock); 3993 3994 if (lmp_bredr_capable(hdev)) { 3995 hci_update_name_sync(hdev, cp.name); 3996 hci_update_eir_sync(hdev); 3997 } 3998 3999 /* The name is stored in the scan response data and so 4000 * no need to update the advertising data here. 4001 */ 4002 if (lmp_le_capable(hdev) && hci_dev_test_flag(hdev, HCI_ADVERTISING)) 4003 hci_update_scan_rsp_data_sync(hdev, hdev->cur_adv_instance); 4004 4005 return 0; 4006 } 4007 4008 static int set_local_name(struct sock *sk, struct hci_dev *hdev, void *data, 4009 u16 len) 4010 { 4011 struct mgmt_cp_set_local_name *cp = data; 4012 struct mgmt_pending_cmd *cmd; 4013 int err; 4014 4015 bt_dev_dbg(hdev, "sock %p", sk); 4016 4017 hci_dev_lock(hdev); 4018 4019 /* If the old values are the same as the new ones just return a 4020 * direct command complete event. 4021 */ 4022 if (!memcmp(hdev->dev_name, cp->name, sizeof(hdev->dev_name)) && 4023 !memcmp(hdev->short_name, cp->short_name, 4024 sizeof(hdev->short_name))) { 4025 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0, 4026 data, len); 4027 goto failed; 4028 } 4029 4030 memcpy(hdev->short_name, cp->short_name, sizeof(hdev->short_name)); 4031 4032 if (!hdev_is_powered(hdev)) { 4033 memcpy(hdev->dev_name, cp->name, sizeof(hdev->dev_name)); 4034 4035 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0, 4036 data, len); 4037 if (err < 0) 4038 goto failed; 4039 4040 err = mgmt_limited_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, data, 4041 len, HCI_MGMT_LOCAL_NAME_EVENTS, sk); 4042 ext_info_changed(hdev, sk); 4043 4044 goto failed; 4045 } 4046 4047 cmd = mgmt_pending_add(sk, MGMT_OP_SET_LOCAL_NAME, hdev, data, len); 4048 if (!cmd) 4049 err = -ENOMEM; 4050 else 4051 err = hci_cmd_sync_queue(hdev, set_name_sync, cmd, 4052 set_name_complete); 4053 4054 if (err < 0) { 4055 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 4056 MGMT_STATUS_FAILED); 4057 4058 if (cmd) 4059 mgmt_pending_remove(cmd); 4060 4061 goto failed; 4062 } 4063 4064 memcpy(hdev->dev_name, cp->name, sizeof(hdev->dev_name)); 4065 4066 failed: 4067 hci_dev_unlock(hdev); 4068 return err; 4069 } 4070 4071 static int appearance_changed_sync(struct hci_dev *hdev, void *data) 4072 { 4073 return adv_expire_sync(hdev, MGMT_ADV_FLAG_APPEARANCE); 4074 } 4075 4076 static int set_appearance(struct sock *sk, struct hci_dev *hdev, void *data, 4077 u16 len) 4078 { 4079 struct mgmt_cp_set_appearance *cp = data; 4080 u16 appearance; 4081 int err; 4082 4083 bt_dev_dbg(hdev, "sock %p", sk); 4084 4085 if (!lmp_le_capable(hdev)) 4086 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_APPEARANCE, 4087 MGMT_STATUS_NOT_SUPPORTED); 4088 4089 appearance = le16_to_cpu(cp->appearance); 4090 4091 hci_dev_lock(hdev); 4092 4093 if (hdev->appearance != appearance) { 4094 hdev->appearance = appearance; 4095 4096 if (hci_dev_test_flag(hdev, HCI_LE_ADV)) 4097 hci_cmd_sync_queue(hdev, appearance_changed_sync, NULL, 4098 NULL); 4099 4100 ext_info_changed(hdev, sk); 4101 } 4102 4103 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_APPEARANCE, 0, NULL, 4104 0); 4105 4106 hci_dev_unlock(hdev); 4107 4108 return err; 4109 } 4110 4111 static int get_phy_configuration(struct sock *sk, struct hci_dev *hdev, 4112 void *data, u16 len) 4113 { 4114 struct mgmt_rp_get_phy_configuration rp; 4115 4116 bt_dev_dbg(hdev, "sock %p", sk); 4117 4118 hci_dev_lock(hdev); 4119 4120 memset(&rp, 0, sizeof(rp)); 4121 4122 rp.supported_phys = cpu_to_le32(get_supported_phys(hdev)); 4123 rp.selected_phys = cpu_to_le32(get_selected_phys(hdev)); 4124 rp.configurable_phys = cpu_to_le32(get_configurable_phys(hdev)); 4125 4126 hci_dev_unlock(hdev); 4127 4128 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_PHY_CONFIGURATION, 0, 4129 &rp, sizeof(rp)); 4130 } 4131 4132 int mgmt_phy_configuration_changed(struct hci_dev *hdev, struct sock *skip) 4133 { 4134 struct mgmt_ev_phy_configuration_changed ev; 4135 4136 memset(&ev, 0, sizeof(ev)); 4137 4138 ev.selected_phys = cpu_to_le32(get_selected_phys(hdev)); 4139 4140 return mgmt_event(MGMT_EV_PHY_CONFIGURATION_CHANGED, hdev, &ev, 4141 sizeof(ev), skip); 4142 } 4143 4144 static void set_default_phy_complete(struct hci_dev *hdev, void *data, int err) 4145 { 4146 struct mgmt_pending_cmd *cmd = data; 4147 struct sk_buff *skb; 4148 u8 status = mgmt_status(err); 4149 4150 skb = cmd->skb; 4151 4152 if (!status) { 4153 if (!skb) 4154 status = MGMT_STATUS_FAILED; 4155 else if (IS_ERR(skb)) 4156 status = mgmt_status(PTR_ERR(skb)); 4157 else 4158 status = mgmt_status(skb->data[0]); 4159 } 4160 4161 bt_dev_dbg(hdev, "status %d", status); 4162 4163 if (status) { 4164 mgmt_cmd_status(cmd->sk, hdev->id, 4165 MGMT_OP_SET_PHY_CONFIGURATION, status); 4166 } else { 4167 mgmt_cmd_complete(cmd->sk, hdev->id, 4168 MGMT_OP_SET_PHY_CONFIGURATION, 0, 4169 NULL, 0); 4170 4171 mgmt_phy_configuration_changed(hdev, cmd->sk); 4172 } 4173 4174 if (skb && !IS_ERR(skb)) 4175 kfree_skb(skb); 4176 4177 mgmt_pending_free(cmd); 4178 } 4179 4180 static int set_default_phy_sync(struct hci_dev *hdev, void *data) 4181 { 4182 struct mgmt_pending_cmd *cmd = data; 4183 struct mgmt_cp_set_phy_configuration *cp = cmd->param; 4184 struct hci_cp_le_set_default_phy cp_phy; 4185 u32 selected_phys; 4186 4187 selected_phys = __le32_to_cpu(cp->selected_phys); 4188 4189 memset(&cp_phy, 0, sizeof(cp_phy)); 4190 4191 if (!(selected_phys & MGMT_PHY_LE_TX_MASK)) 4192 cp_phy.all_phys |= 0x01; 4193 4194 if (!(selected_phys & MGMT_PHY_LE_RX_MASK)) 4195 cp_phy.all_phys |= 0x02; 4196 4197 if (selected_phys & MGMT_PHY_LE_1M_TX) 4198 cp_phy.tx_phys |= HCI_LE_SET_PHY_1M; 4199 4200 if (selected_phys & MGMT_PHY_LE_2M_TX) 4201 cp_phy.tx_phys |= HCI_LE_SET_PHY_2M; 4202 4203 if (selected_phys & MGMT_PHY_LE_CODED_TX) 4204 cp_phy.tx_phys |= HCI_LE_SET_PHY_CODED; 4205 4206 if (selected_phys & MGMT_PHY_LE_1M_RX) 4207 cp_phy.rx_phys |= HCI_LE_SET_PHY_1M; 4208 4209 if (selected_phys & MGMT_PHY_LE_2M_RX) 4210 cp_phy.rx_phys |= HCI_LE_SET_PHY_2M; 4211 4212 if (selected_phys & MGMT_PHY_LE_CODED_RX) 4213 cp_phy.rx_phys |= HCI_LE_SET_PHY_CODED; 4214 4215 cmd->skb = __hci_cmd_sync(hdev, HCI_OP_LE_SET_DEFAULT_PHY, 4216 sizeof(cp_phy), &cp_phy, HCI_CMD_TIMEOUT); 4217 4218 return 0; 4219 } 4220 4221 static int set_phy_configuration(struct sock *sk, struct hci_dev *hdev, 4222 void *data, u16 len) 4223 { 4224 struct mgmt_cp_set_phy_configuration *cp = data; 4225 struct mgmt_pending_cmd *cmd; 4226 u32 selected_phys, configurable_phys, supported_phys, unconfigure_phys; 4227 u16 pkt_type = (HCI_DH1 | HCI_DM1); 4228 bool changed = false; 4229 int err; 4230 4231 bt_dev_dbg(hdev, "sock %p", sk); 4232 4233 configurable_phys = get_configurable_phys(hdev); 4234 supported_phys = get_supported_phys(hdev); 4235 selected_phys = __le32_to_cpu(cp->selected_phys); 4236 4237 if (selected_phys & ~supported_phys) 4238 return mgmt_cmd_status(sk, hdev->id, 4239 MGMT_OP_SET_PHY_CONFIGURATION, 4240 MGMT_STATUS_INVALID_PARAMS); 4241 4242 unconfigure_phys = supported_phys & ~configurable_phys; 4243 4244 if ((selected_phys & unconfigure_phys) != unconfigure_phys) 4245 return mgmt_cmd_status(sk, hdev->id, 4246 MGMT_OP_SET_PHY_CONFIGURATION, 4247 MGMT_STATUS_INVALID_PARAMS); 4248 4249 if (selected_phys == get_selected_phys(hdev)) 4250 return mgmt_cmd_complete(sk, hdev->id, 4251 MGMT_OP_SET_PHY_CONFIGURATION, 4252 0, NULL, 0); 4253 4254 hci_dev_lock(hdev); 4255 4256 if (!hdev_is_powered(hdev)) { 4257 err = mgmt_cmd_status(sk, hdev->id, 4258 MGMT_OP_SET_PHY_CONFIGURATION, 4259 MGMT_STATUS_REJECTED); 4260 goto unlock; 4261 } 4262 4263 if (pending_find(MGMT_OP_SET_PHY_CONFIGURATION, hdev)) { 4264 err = mgmt_cmd_status(sk, hdev->id, 4265 MGMT_OP_SET_PHY_CONFIGURATION, 4266 MGMT_STATUS_BUSY); 4267 goto unlock; 4268 } 4269 4270 if (selected_phys & MGMT_PHY_BR_1M_3SLOT) 4271 pkt_type |= (HCI_DH3 | HCI_DM3); 4272 else 4273 pkt_type &= ~(HCI_DH3 | HCI_DM3); 4274 4275 if (selected_phys & MGMT_PHY_BR_1M_5SLOT) 4276 pkt_type |= (HCI_DH5 | HCI_DM5); 4277 else 4278 pkt_type &= ~(HCI_DH5 | HCI_DM5); 4279 4280 if (selected_phys & MGMT_PHY_EDR_2M_1SLOT) 4281 pkt_type &= ~HCI_2DH1; 4282 else 4283 pkt_type |= HCI_2DH1; 4284 4285 if (selected_phys & MGMT_PHY_EDR_2M_3SLOT) 4286 pkt_type &= ~HCI_2DH3; 4287 else 4288 pkt_type |= HCI_2DH3; 4289 4290 if (selected_phys & MGMT_PHY_EDR_2M_5SLOT) 4291 pkt_type &= ~HCI_2DH5; 4292 else 4293 pkt_type |= HCI_2DH5; 4294 4295 if (selected_phys & MGMT_PHY_EDR_3M_1SLOT) 4296 pkt_type &= ~HCI_3DH1; 4297 else 4298 pkt_type |= HCI_3DH1; 4299 4300 if (selected_phys & MGMT_PHY_EDR_3M_3SLOT) 4301 pkt_type &= ~HCI_3DH3; 4302 else 4303 pkt_type |= HCI_3DH3; 4304 4305 if (selected_phys & MGMT_PHY_EDR_3M_5SLOT) 4306 pkt_type &= ~HCI_3DH5; 4307 else 4308 pkt_type |= HCI_3DH5; 4309 4310 if (pkt_type != hdev->pkt_type) { 4311 hdev->pkt_type = pkt_type; 4312 changed = true; 4313 } 4314 4315 if ((selected_phys & MGMT_PHY_LE_MASK) == 4316 (get_selected_phys(hdev) & MGMT_PHY_LE_MASK)) { 4317 if (changed) 4318 mgmt_phy_configuration_changed(hdev, sk); 4319 4320 err = mgmt_cmd_complete(sk, hdev->id, 4321 MGMT_OP_SET_PHY_CONFIGURATION, 4322 0, NULL, 0); 4323 4324 goto unlock; 4325 } 4326 4327 cmd = mgmt_pending_new(sk, MGMT_OP_SET_PHY_CONFIGURATION, hdev, data, 4328 len); 4329 if (!cmd) 4330 err = -ENOMEM; 4331 else 4332 err = hci_cmd_sync_queue(hdev, set_default_phy_sync, cmd, 4333 set_default_phy_complete); 4334 4335 if (err < 0) { 4336 err = mgmt_cmd_status(sk, hdev->id, 4337 MGMT_OP_SET_PHY_CONFIGURATION, 4338 MGMT_STATUS_FAILED); 4339 4340 if (cmd) 4341 mgmt_pending_remove(cmd); 4342 } 4343 4344 unlock: 4345 hci_dev_unlock(hdev); 4346 4347 return err; 4348 } 4349 4350 static int set_blocked_keys(struct sock *sk, struct hci_dev *hdev, void *data, 4351 u16 len) 4352 { 4353 int err = MGMT_STATUS_SUCCESS; 4354 struct mgmt_cp_set_blocked_keys *keys = data; 4355 const u16 max_key_count = ((U16_MAX - sizeof(*keys)) / 4356 sizeof(struct mgmt_blocked_key_info)); 4357 u16 key_count, expected_len; 4358 int i; 4359 4360 bt_dev_dbg(hdev, "sock %p", sk); 4361 4362 key_count = __le16_to_cpu(keys->key_count); 4363 if (key_count > max_key_count) { 4364 bt_dev_err(hdev, "too big key_count value %u", key_count); 4365 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BLOCKED_KEYS, 4366 MGMT_STATUS_INVALID_PARAMS); 4367 } 4368 4369 expected_len = struct_size(keys, keys, key_count); 4370 if (expected_len != len) { 4371 bt_dev_err(hdev, "expected %u bytes, got %u bytes", 4372 expected_len, len); 4373 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BLOCKED_KEYS, 4374 MGMT_STATUS_INVALID_PARAMS); 4375 } 4376 4377 hci_dev_lock(hdev); 4378 4379 hci_blocked_keys_clear(hdev); 4380 4381 for (i = 0; i < key_count; ++i) { 4382 struct blocked_key *b = kzalloc_obj(*b); 4383 4384 if (!b) { 4385 err = MGMT_STATUS_NO_RESOURCES; 4386 break; 4387 } 4388 4389 b->type = keys->keys[i].type; 4390 memcpy(b->val, keys->keys[i].val, sizeof(b->val)); 4391 list_add_rcu(&b->list, &hdev->blocked_keys); 4392 } 4393 hci_dev_unlock(hdev); 4394 4395 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_BLOCKED_KEYS, 4396 err, NULL, 0); 4397 } 4398 4399 static int set_wideband_speech(struct sock *sk, struct hci_dev *hdev, 4400 void *data, u16 len) 4401 { 4402 struct mgmt_mode *cp = data; 4403 int err; 4404 bool changed = false; 4405 4406 bt_dev_dbg(hdev, "sock %p", sk); 4407 4408 if (!hci_test_quirk(hdev, HCI_QUIRK_WIDEBAND_SPEECH_SUPPORTED)) 4409 return mgmt_cmd_status(sk, hdev->id, 4410 MGMT_OP_SET_WIDEBAND_SPEECH, 4411 MGMT_STATUS_NOT_SUPPORTED); 4412 4413 if (cp->val != 0x00 && cp->val != 0x01) 4414 return mgmt_cmd_status(sk, hdev->id, 4415 MGMT_OP_SET_WIDEBAND_SPEECH, 4416 MGMT_STATUS_INVALID_PARAMS); 4417 4418 hci_dev_lock(hdev); 4419 4420 if (hdev_is_powered(hdev) && 4421 !!cp->val != hci_dev_test_flag(hdev, 4422 HCI_WIDEBAND_SPEECH_ENABLED)) { 4423 err = mgmt_cmd_status(sk, hdev->id, 4424 MGMT_OP_SET_WIDEBAND_SPEECH, 4425 MGMT_STATUS_REJECTED); 4426 goto unlock; 4427 } 4428 4429 if (cp->val) 4430 changed = !hci_dev_test_and_set_flag(hdev, 4431 HCI_WIDEBAND_SPEECH_ENABLED); 4432 else 4433 changed = hci_dev_test_and_clear_flag(hdev, 4434 HCI_WIDEBAND_SPEECH_ENABLED); 4435 4436 err = send_settings_rsp(sk, MGMT_OP_SET_WIDEBAND_SPEECH, hdev); 4437 if (err < 0) 4438 goto unlock; 4439 4440 if (changed) 4441 err = new_settings(hdev, sk); 4442 4443 unlock: 4444 hci_dev_unlock(hdev); 4445 return err; 4446 } 4447 4448 static int read_controller_cap(struct sock *sk, struct hci_dev *hdev, 4449 void *data, u16 data_len) 4450 { 4451 char buf[20]; 4452 struct mgmt_rp_read_controller_cap *rp = (void *)buf; 4453 u16 cap_len = 0; 4454 u8 flags = 0; 4455 u8 tx_power_range[2]; 4456 4457 bt_dev_dbg(hdev, "sock %p", sk); 4458 4459 memset(&buf, 0, sizeof(buf)); 4460 4461 hci_dev_lock(hdev); 4462 4463 /* When the Read Simple Pairing Options command is supported, then 4464 * the remote public key validation is supported. 4465 * 4466 * Alternatively, when Microsoft extensions are available, they can 4467 * indicate support for public key validation as well. 4468 */ 4469 if ((hdev->commands[41] & 0x08) || msft_curve_validity(hdev)) 4470 flags |= 0x01; /* Remote public key validation (BR/EDR) */ 4471 4472 flags |= 0x02; /* Remote public key validation (LE) */ 4473 4474 /* When the Read Encryption Key Size command is supported, then the 4475 * encryption key size is enforced. 4476 */ 4477 if (hdev->commands[20] & 0x10) 4478 flags |= 0x04; /* Encryption key size enforcement (BR/EDR) */ 4479 4480 flags |= 0x08; /* Encryption key size enforcement (LE) */ 4481 4482 cap_len = eir_append_data(rp->cap, cap_len, MGMT_CAP_SEC_FLAGS, 4483 &flags, 1); 4484 4485 /* When the Read Simple Pairing Options command is supported, then 4486 * also max encryption key size information is provided. 4487 */ 4488 if (hdev->commands[41] & 0x08) 4489 cap_len = eir_append_le16(rp->cap, cap_len, 4490 MGMT_CAP_MAX_ENC_KEY_SIZE, 4491 hdev->max_enc_key_size); 4492 4493 cap_len = eir_append_le16(rp->cap, cap_len, 4494 MGMT_CAP_SMP_MAX_ENC_KEY_SIZE, 4495 SMP_MAX_ENC_KEY_SIZE); 4496 4497 /* Append the min/max LE tx power parameters if we were able to fetch 4498 * it from the controller 4499 */ 4500 if (hdev->commands[38] & 0x80) { 4501 memcpy(&tx_power_range[0], &hdev->min_le_tx_power, 1); 4502 memcpy(&tx_power_range[1], &hdev->max_le_tx_power, 1); 4503 cap_len = eir_append_data(rp->cap, cap_len, MGMT_CAP_LE_TX_PWR, 4504 tx_power_range, 2); 4505 } 4506 4507 rp->cap_len = cpu_to_le16(cap_len); 4508 4509 hci_dev_unlock(hdev); 4510 4511 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_CONTROLLER_CAP, 0, 4512 rp, sizeof(*rp) + cap_len); 4513 } 4514 4515 #ifdef CONFIG_BT_FEATURE_DEBUG 4516 /* d4992530-b9ec-469f-ab01-6c481c47da1c */ 4517 static const u8 debug_uuid[16] = { 4518 0x1c, 0xda, 0x47, 0x1c, 0x48, 0x6c, 0x01, 0xab, 4519 0x9f, 0x46, 0xec, 0xb9, 0x30, 0x25, 0x99, 0xd4, 4520 }; 4521 #endif 4522 4523 /* 330859bc-7506-492d-9370-9a6f0614037f */ 4524 static const u8 quality_report_uuid[16] = { 4525 0x7f, 0x03, 0x14, 0x06, 0x6f, 0x9a, 0x70, 0x93, 4526 0x2d, 0x49, 0x06, 0x75, 0xbc, 0x59, 0x08, 0x33, 4527 }; 4528 4529 /* a6695ace-ee7f-4fb9-881a-5fac66c629af */ 4530 static const u8 offload_codecs_uuid[16] = { 4531 0xaf, 0x29, 0xc6, 0x66, 0xac, 0x5f, 0x1a, 0x88, 4532 0xb9, 0x4f, 0x7f, 0xee, 0xce, 0x5a, 0x69, 0xa6, 4533 }; 4534 4535 /* 671b10b5-42c0-4696-9227-eb28d1b049d6 */ 4536 static const u8 le_simultaneous_roles_uuid[16] = { 4537 0xd6, 0x49, 0xb0, 0xd1, 0x28, 0xeb, 0x27, 0x92, 4538 0x96, 0x46, 0xc0, 0x42, 0xb5, 0x10, 0x1b, 0x67, 4539 }; 4540 4541 /* 6fbaf188-05e0-496a-9885-d6ddfdb4e03e */ 4542 static const u8 iso_socket_uuid[16] = { 4543 0x3e, 0xe0, 0xb4, 0xfd, 0xdd, 0xd6, 0x85, 0x98, 4544 0x6a, 0x49, 0xe0, 0x05, 0x88, 0xf1, 0xba, 0x6f, 4545 }; 4546 4547 /* 2ce463d7-7a03-4d8d-bf05-5f24e8f36e76 */ 4548 static const u8 mgmt_mesh_uuid[16] = { 4549 0x76, 0x6e, 0xf3, 0xe8, 0x24, 0x5f, 0x05, 0xbf, 4550 0x8d, 0x4d, 0x03, 0x7a, 0xd7, 0x63, 0xe4, 0x2c, 4551 }; 4552 4553 static int read_exp_features_info(struct sock *sk, struct hci_dev *hdev, 4554 void *data, u16 data_len) 4555 { 4556 struct mgmt_rp_read_exp_features_info *rp; 4557 size_t len; 4558 u16 idx = 0; 4559 u32 flags; 4560 int status; 4561 4562 bt_dev_dbg(hdev, "sock %p", sk); 4563 4564 /* Enough space for 7 features */ 4565 len = sizeof(*rp) + (sizeof(rp->features[0]) * 7); 4566 rp = kzalloc(len, GFP_KERNEL); 4567 if (!rp) 4568 return -ENOMEM; 4569 4570 #ifdef CONFIG_BT_FEATURE_DEBUG 4571 flags = bt_dbg_get() ? BIT(0) : 0; 4572 4573 memcpy(rp->features[idx].uuid, debug_uuid, 16); 4574 rp->features[idx].flags = cpu_to_le32(flags); 4575 idx++; 4576 #endif 4577 4578 if (hdev && hci_dev_le_state_simultaneous(hdev)) { 4579 if (hci_dev_test_flag(hdev, HCI_LE_SIMULTANEOUS_ROLES)) 4580 flags = BIT(0); 4581 else 4582 flags = 0; 4583 4584 memcpy(rp->features[idx].uuid, le_simultaneous_roles_uuid, 16); 4585 rp->features[idx].flags = cpu_to_le32(flags); 4586 idx++; 4587 } 4588 4589 if (hdev && (aosp_has_quality_report(hdev) || 4590 hdev->set_quality_report)) { 4591 if (hci_dev_test_flag(hdev, HCI_QUALITY_REPORT)) 4592 flags = BIT(0); 4593 else 4594 flags = 0; 4595 4596 memcpy(rp->features[idx].uuid, quality_report_uuid, 16); 4597 rp->features[idx].flags = cpu_to_le32(flags); 4598 idx++; 4599 } 4600 4601 if (hdev && hdev->get_data_path_id) { 4602 if (hci_dev_test_flag(hdev, HCI_OFFLOAD_CODECS_ENABLED)) 4603 flags = BIT(0); 4604 else 4605 flags = 0; 4606 4607 memcpy(rp->features[idx].uuid, offload_codecs_uuid, 16); 4608 rp->features[idx].flags = cpu_to_le32(flags); 4609 idx++; 4610 } 4611 4612 if (IS_ENABLED(CONFIG_BT_LE)) { 4613 flags = iso_inited() ? BIT(0) : 0; 4614 memcpy(rp->features[idx].uuid, iso_socket_uuid, 16); 4615 rp->features[idx].flags = cpu_to_le32(flags); 4616 idx++; 4617 } 4618 4619 if (hdev && lmp_le_capable(hdev)) { 4620 if (hci_dev_test_flag(hdev, HCI_MESH_EXPERIMENTAL)) 4621 flags = BIT(0); 4622 else 4623 flags = 0; 4624 4625 memcpy(rp->features[idx].uuid, mgmt_mesh_uuid, 16); 4626 rp->features[idx].flags = cpu_to_le32(flags); 4627 idx++; 4628 } 4629 4630 rp->feature_count = cpu_to_le16(idx); 4631 4632 /* After reading the experimental features information, enable 4633 * the events to update client on any future change. 4634 */ 4635 hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS); 4636 4637 status = mgmt_cmd_complete(sk, hdev ? hdev->id : MGMT_INDEX_NONE, 4638 MGMT_OP_READ_EXP_FEATURES_INFO, 4639 0, rp, sizeof(*rp) + (20 * idx)); 4640 4641 kfree(rp); 4642 return status; 4643 } 4644 4645 static int exp_feature_changed(struct hci_dev *hdev, const u8 *uuid, 4646 bool enabled, struct sock *skip) 4647 { 4648 struct mgmt_ev_exp_feature_changed ev; 4649 4650 memset(&ev, 0, sizeof(ev)); 4651 memcpy(ev.uuid, uuid, 16); 4652 ev.flags = cpu_to_le32(enabled ? BIT(0) : 0); 4653 4654 return mgmt_limited_event(MGMT_EV_EXP_FEATURE_CHANGED, hdev, 4655 &ev, sizeof(ev), 4656 HCI_MGMT_EXP_FEATURE_EVENTS, skip); 4657 } 4658 4659 #define EXP_FEAT(_uuid, _set_func) \ 4660 { \ 4661 .uuid = _uuid, \ 4662 .set_func = _set_func, \ 4663 } 4664 4665 /* The zero key uuid is special. Multiple exp features are set through it. */ 4666 static int set_zero_key_func(struct sock *sk, struct hci_dev *hdev, 4667 struct mgmt_cp_set_exp_feature *cp, u16 data_len) 4668 { 4669 struct mgmt_rp_set_exp_feature rp; 4670 4671 memset(rp.uuid, 0, 16); 4672 rp.flags = cpu_to_le32(0); 4673 4674 #ifdef CONFIG_BT_FEATURE_DEBUG 4675 if (!hdev) { 4676 bool changed = bt_dbg_get(); 4677 4678 bt_dbg_set(false); 4679 4680 if (changed) 4681 exp_feature_changed(NULL, ZERO_KEY, false, sk); 4682 } 4683 #endif 4684 4685 hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS); 4686 4687 return mgmt_cmd_complete(sk, hdev ? hdev->id : MGMT_INDEX_NONE, 4688 MGMT_OP_SET_EXP_FEATURE, 0, 4689 &rp, sizeof(rp)); 4690 } 4691 4692 #ifdef CONFIG_BT_FEATURE_DEBUG 4693 static int set_debug_func(struct sock *sk, struct hci_dev *hdev, 4694 struct mgmt_cp_set_exp_feature *cp, u16 data_len) 4695 { 4696 struct mgmt_rp_set_exp_feature rp; 4697 4698 bool val, changed; 4699 int err; 4700 4701 /* Command requires to use the non-controller index */ 4702 if (hdev) 4703 return mgmt_cmd_status(sk, hdev->id, 4704 MGMT_OP_SET_EXP_FEATURE, 4705 MGMT_STATUS_INVALID_INDEX); 4706 4707 /* Parameters are limited to a single octet */ 4708 if (data_len != MGMT_SET_EXP_FEATURE_SIZE + 1) 4709 return mgmt_cmd_status(sk, MGMT_INDEX_NONE, 4710 MGMT_OP_SET_EXP_FEATURE, 4711 MGMT_STATUS_INVALID_PARAMS); 4712 4713 /* Only boolean on/off is supported */ 4714 if (cp->param[0] != 0x00 && cp->param[0] != 0x01) 4715 return mgmt_cmd_status(sk, MGMT_INDEX_NONE, 4716 MGMT_OP_SET_EXP_FEATURE, 4717 MGMT_STATUS_INVALID_PARAMS); 4718 4719 val = !!cp->param[0]; 4720 changed = val ? !bt_dbg_get() : bt_dbg_get(); 4721 bt_dbg_set(val); 4722 4723 memcpy(rp.uuid, debug_uuid, 16); 4724 rp.flags = cpu_to_le32(val ? BIT(0) : 0); 4725 4726 hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS); 4727 4728 err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE, 4729 MGMT_OP_SET_EXP_FEATURE, 0, 4730 &rp, sizeof(rp)); 4731 4732 if (changed) 4733 exp_feature_changed(hdev, debug_uuid, val, sk); 4734 4735 return err; 4736 } 4737 #endif 4738 4739 static int set_mgmt_mesh_func(struct sock *sk, struct hci_dev *hdev, 4740 struct mgmt_cp_set_exp_feature *cp, u16 data_len) 4741 { 4742 struct mgmt_rp_set_exp_feature rp; 4743 bool val, changed; 4744 int err; 4745 4746 /* Command requires to use the controller index */ 4747 if (!hdev) 4748 return mgmt_cmd_status(sk, MGMT_INDEX_NONE, 4749 MGMT_OP_SET_EXP_FEATURE, 4750 MGMT_STATUS_INVALID_INDEX); 4751 4752 /* Parameters are limited to a single octet */ 4753 if (data_len != MGMT_SET_EXP_FEATURE_SIZE + 1) 4754 return mgmt_cmd_status(sk, hdev->id, 4755 MGMT_OP_SET_EXP_FEATURE, 4756 MGMT_STATUS_INVALID_PARAMS); 4757 4758 /* Only boolean on/off is supported */ 4759 if (cp->param[0] != 0x00 && cp->param[0] != 0x01) 4760 return mgmt_cmd_status(sk, hdev->id, 4761 MGMT_OP_SET_EXP_FEATURE, 4762 MGMT_STATUS_INVALID_PARAMS); 4763 4764 val = !!cp->param[0]; 4765 4766 if (val) { 4767 changed = !hci_dev_test_and_set_flag(hdev, 4768 HCI_MESH_EXPERIMENTAL); 4769 } else { 4770 hci_dev_clear_flag(hdev, HCI_MESH); 4771 changed = hci_dev_test_and_clear_flag(hdev, 4772 HCI_MESH_EXPERIMENTAL); 4773 } 4774 4775 memcpy(rp.uuid, mgmt_mesh_uuid, 16); 4776 rp.flags = cpu_to_le32(val ? BIT(0) : 0); 4777 4778 hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS); 4779 4780 err = mgmt_cmd_complete(sk, hdev->id, 4781 MGMT_OP_SET_EXP_FEATURE, 0, 4782 &rp, sizeof(rp)); 4783 4784 if (changed) 4785 exp_feature_changed(hdev, mgmt_mesh_uuid, val, sk); 4786 4787 return err; 4788 } 4789 4790 static int set_quality_report_func(struct sock *sk, struct hci_dev *hdev, 4791 struct mgmt_cp_set_exp_feature *cp, 4792 u16 data_len) 4793 { 4794 struct mgmt_rp_set_exp_feature rp; 4795 bool val, changed; 4796 int err; 4797 4798 /* Command requires to use a valid controller index */ 4799 if (!hdev) 4800 return mgmt_cmd_status(sk, MGMT_INDEX_NONE, 4801 MGMT_OP_SET_EXP_FEATURE, 4802 MGMT_STATUS_INVALID_INDEX); 4803 4804 /* Parameters are limited to a single octet */ 4805 if (data_len != MGMT_SET_EXP_FEATURE_SIZE + 1) 4806 return mgmt_cmd_status(sk, hdev->id, 4807 MGMT_OP_SET_EXP_FEATURE, 4808 MGMT_STATUS_INVALID_PARAMS); 4809 4810 /* Only boolean on/off is supported */ 4811 if (cp->param[0] != 0x00 && cp->param[0] != 0x01) 4812 return mgmt_cmd_status(sk, hdev->id, 4813 MGMT_OP_SET_EXP_FEATURE, 4814 MGMT_STATUS_INVALID_PARAMS); 4815 4816 hci_req_sync_lock(hdev); 4817 4818 val = !!cp->param[0]; 4819 changed = (val != hci_dev_test_flag(hdev, HCI_QUALITY_REPORT)); 4820 4821 if (!aosp_has_quality_report(hdev) && !hdev->set_quality_report) { 4822 err = mgmt_cmd_status(sk, hdev->id, 4823 MGMT_OP_SET_EXP_FEATURE, 4824 MGMT_STATUS_NOT_SUPPORTED); 4825 goto unlock_quality_report; 4826 } 4827 4828 if (changed) { 4829 if (hdev->set_quality_report) 4830 err = hdev->set_quality_report(hdev, val); 4831 else 4832 err = aosp_set_quality_report(hdev, val); 4833 4834 if (err) { 4835 err = mgmt_cmd_status(sk, hdev->id, 4836 MGMT_OP_SET_EXP_FEATURE, 4837 MGMT_STATUS_FAILED); 4838 goto unlock_quality_report; 4839 } 4840 4841 if (val) 4842 hci_dev_set_flag(hdev, HCI_QUALITY_REPORT); 4843 else 4844 hci_dev_clear_flag(hdev, HCI_QUALITY_REPORT); 4845 } 4846 4847 bt_dev_dbg(hdev, "quality report enable %d changed %d", val, changed); 4848 4849 memcpy(rp.uuid, quality_report_uuid, 16); 4850 rp.flags = cpu_to_le32(val ? BIT(0) : 0); 4851 hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS); 4852 4853 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_EXP_FEATURE, 0, 4854 &rp, sizeof(rp)); 4855 4856 if (changed) 4857 exp_feature_changed(hdev, quality_report_uuid, val, sk); 4858 4859 unlock_quality_report: 4860 hci_req_sync_unlock(hdev); 4861 return err; 4862 } 4863 4864 static int set_offload_codec_func(struct sock *sk, struct hci_dev *hdev, 4865 struct mgmt_cp_set_exp_feature *cp, 4866 u16 data_len) 4867 { 4868 bool val, changed; 4869 int err; 4870 struct mgmt_rp_set_exp_feature rp; 4871 4872 /* Command requires to use a valid controller index */ 4873 if (!hdev) 4874 return mgmt_cmd_status(sk, MGMT_INDEX_NONE, 4875 MGMT_OP_SET_EXP_FEATURE, 4876 MGMT_STATUS_INVALID_INDEX); 4877 4878 /* Parameters are limited to a single octet */ 4879 if (data_len != MGMT_SET_EXP_FEATURE_SIZE + 1) 4880 return mgmt_cmd_status(sk, hdev->id, 4881 MGMT_OP_SET_EXP_FEATURE, 4882 MGMT_STATUS_INVALID_PARAMS); 4883 4884 /* Only boolean on/off is supported */ 4885 if (cp->param[0] != 0x00 && cp->param[0] != 0x01) 4886 return mgmt_cmd_status(sk, hdev->id, 4887 MGMT_OP_SET_EXP_FEATURE, 4888 MGMT_STATUS_INVALID_PARAMS); 4889 4890 val = !!cp->param[0]; 4891 changed = (val != hci_dev_test_flag(hdev, HCI_OFFLOAD_CODECS_ENABLED)); 4892 4893 if (!hdev->get_data_path_id) { 4894 return mgmt_cmd_status(sk, hdev->id, 4895 MGMT_OP_SET_EXP_FEATURE, 4896 MGMT_STATUS_NOT_SUPPORTED); 4897 } 4898 4899 if (changed) { 4900 if (val) 4901 hci_dev_set_flag(hdev, HCI_OFFLOAD_CODECS_ENABLED); 4902 else 4903 hci_dev_clear_flag(hdev, HCI_OFFLOAD_CODECS_ENABLED); 4904 } 4905 4906 bt_dev_info(hdev, "offload codecs enable %d changed %d", 4907 val, changed); 4908 4909 memcpy(rp.uuid, offload_codecs_uuid, 16); 4910 rp.flags = cpu_to_le32(val ? BIT(0) : 0); 4911 hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS); 4912 err = mgmt_cmd_complete(sk, hdev->id, 4913 MGMT_OP_SET_EXP_FEATURE, 0, 4914 &rp, sizeof(rp)); 4915 4916 if (changed) 4917 exp_feature_changed(hdev, offload_codecs_uuid, val, sk); 4918 4919 return err; 4920 } 4921 4922 static int set_le_simultaneous_roles_func(struct sock *sk, struct hci_dev *hdev, 4923 struct mgmt_cp_set_exp_feature *cp, 4924 u16 data_len) 4925 { 4926 bool val, changed; 4927 int err; 4928 struct mgmt_rp_set_exp_feature rp; 4929 4930 /* Command requires to use a valid controller index */ 4931 if (!hdev) 4932 return mgmt_cmd_status(sk, MGMT_INDEX_NONE, 4933 MGMT_OP_SET_EXP_FEATURE, 4934 MGMT_STATUS_INVALID_INDEX); 4935 4936 /* Parameters are limited to a single octet */ 4937 if (data_len != MGMT_SET_EXP_FEATURE_SIZE + 1) 4938 return mgmt_cmd_status(sk, hdev->id, 4939 MGMT_OP_SET_EXP_FEATURE, 4940 MGMT_STATUS_INVALID_PARAMS); 4941 4942 /* Only boolean on/off is supported */ 4943 if (cp->param[0] != 0x00 && cp->param[0] != 0x01) 4944 return mgmt_cmd_status(sk, hdev->id, 4945 MGMT_OP_SET_EXP_FEATURE, 4946 MGMT_STATUS_INVALID_PARAMS); 4947 4948 val = !!cp->param[0]; 4949 changed = (val != hci_dev_test_flag(hdev, HCI_LE_SIMULTANEOUS_ROLES)); 4950 4951 if (!hci_dev_le_state_simultaneous(hdev)) { 4952 return mgmt_cmd_status(sk, hdev->id, 4953 MGMT_OP_SET_EXP_FEATURE, 4954 MGMT_STATUS_NOT_SUPPORTED); 4955 } 4956 4957 if (changed) { 4958 if (val) 4959 hci_dev_set_flag(hdev, HCI_LE_SIMULTANEOUS_ROLES); 4960 else 4961 hci_dev_clear_flag(hdev, HCI_LE_SIMULTANEOUS_ROLES); 4962 } 4963 4964 bt_dev_info(hdev, "LE simultaneous roles enable %d changed %d", 4965 val, changed); 4966 4967 memcpy(rp.uuid, le_simultaneous_roles_uuid, 16); 4968 rp.flags = cpu_to_le32(val ? BIT(0) : 0); 4969 hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS); 4970 err = mgmt_cmd_complete(sk, hdev->id, 4971 MGMT_OP_SET_EXP_FEATURE, 0, 4972 &rp, sizeof(rp)); 4973 4974 if (changed) 4975 exp_feature_changed(hdev, le_simultaneous_roles_uuid, val, sk); 4976 4977 return err; 4978 } 4979 4980 #ifdef CONFIG_BT_LE 4981 static int set_iso_socket_func(struct sock *sk, struct hci_dev *hdev, 4982 struct mgmt_cp_set_exp_feature *cp, u16 data_len) 4983 { 4984 struct mgmt_rp_set_exp_feature rp; 4985 bool val, changed = false; 4986 int err; 4987 4988 /* Command requires to use the non-controller index */ 4989 if (hdev) 4990 return mgmt_cmd_status(sk, hdev->id, 4991 MGMT_OP_SET_EXP_FEATURE, 4992 MGMT_STATUS_INVALID_INDEX); 4993 4994 /* Parameters are limited to a single octet */ 4995 if (data_len != MGMT_SET_EXP_FEATURE_SIZE + 1) 4996 return mgmt_cmd_status(sk, MGMT_INDEX_NONE, 4997 MGMT_OP_SET_EXP_FEATURE, 4998 MGMT_STATUS_INVALID_PARAMS); 4999 5000 /* Only boolean on/off is supported */ 5001 if (cp->param[0] != 0x00 && cp->param[0] != 0x01) 5002 return mgmt_cmd_status(sk, MGMT_INDEX_NONE, 5003 MGMT_OP_SET_EXP_FEATURE, 5004 MGMT_STATUS_INVALID_PARAMS); 5005 5006 val = cp->param[0] ? true : false; 5007 if (val) 5008 err = iso_init(); 5009 else 5010 err = iso_exit(); 5011 5012 if (!err) 5013 changed = true; 5014 5015 memcpy(rp.uuid, iso_socket_uuid, 16); 5016 rp.flags = cpu_to_le32(val ? BIT(0) : 0); 5017 5018 hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS); 5019 5020 err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE, 5021 MGMT_OP_SET_EXP_FEATURE, 0, 5022 &rp, sizeof(rp)); 5023 5024 if (changed) 5025 exp_feature_changed(hdev, iso_socket_uuid, val, sk); 5026 5027 return err; 5028 } 5029 #endif 5030 5031 static const struct mgmt_exp_feature { 5032 const u8 *uuid; 5033 int (*set_func)(struct sock *sk, struct hci_dev *hdev, 5034 struct mgmt_cp_set_exp_feature *cp, u16 data_len); 5035 } exp_features[] = { 5036 EXP_FEAT(ZERO_KEY, set_zero_key_func), 5037 #ifdef CONFIG_BT_FEATURE_DEBUG 5038 EXP_FEAT(debug_uuid, set_debug_func), 5039 #endif 5040 EXP_FEAT(mgmt_mesh_uuid, set_mgmt_mesh_func), 5041 EXP_FEAT(quality_report_uuid, set_quality_report_func), 5042 EXP_FEAT(offload_codecs_uuid, set_offload_codec_func), 5043 EXP_FEAT(le_simultaneous_roles_uuid, set_le_simultaneous_roles_func), 5044 #ifdef CONFIG_BT_LE 5045 EXP_FEAT(iso_socket_uuid, set_iso_socket_func), 5046 #endif 5047 5048 /* end with a null feature */ 5049 EXP_FEAT(NULL, NULL) 5050 }; 5051 5052 static int set_exp_feature(struct sock *sk, struct hci_dev *hdev, 5053 void *data, u16 data_len) 5054 { 5055 struct mgmt_cp_set_exp_feature *cp = data; 5056 size_t i = 0; 5057 5058 bt_dev_dbg(hdev, "sock %p", sk); 5059 5060 for (i = 0; exp_features[i].uuid; i++) { 5061 if (!memcmp(cp->uuid, exp_features[i].uuid, 16)) 5062 return exp_features[i].set_func(sk, hdev, cp, data_len); 5063 } 5064 5065 return mgmt_cmd_status(sk, hdev ? hdev->id : MGMT_INDEX_NONE, 5066 MGMT_OP_SET_EXP_FEATURE, 5067 MGMT_STATUS_NOT_SUPPORTED); 5068 } 5069 5070 static int get_device_flags(struct sock *sk, struct hci_dev *hdev, void *data, 5071 u16 data_len) 5072 { 5073 struct mgmt_cp_get_device_flags *cp = data; 5074 struct mgmt_rp_get_device_flags rp; 5075 struct bdaddr_list_with_flags *br_params; 5076 struct hci_conn_params *params; 5077 u32 supported_flags; 5078 u32 current_flags = 0; 5079 u8 status = MGMT_STATUS_INVALID_PARAMS; 5080 5081 bt_dev_dbg(hdev, "Get device flags %pMR (type 0x%x)\n", 5082 &cp->addr.bdaddr, cp->addr.type); 5083 5084 hci_dev_lock(hdev); 5085 5086 supported_flags = hdev->conn_flags; 5087 5088 memset(&rp, 0, sizeof(rp)); 5089 5090 if (cp->addr.type == BDADDR_BREDR) { 5091 br_params = hci_bdaddr_list_lookup_with_flags(&hdev->accept_list, 5092 &cp->addr.bdaddr, 5093 cp->addr.type); 5094 if (!br_params) 5095 goto done; 5096 5097 current_flags = br_params->flags; 5098 } else { 5099 params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr, 5100 le_addr_type(cp->addr.type)); 5101 if (!params) 5102 goto done; 5103 5104 current_flags = params->flags; 5105 } 5106 5107 bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr); 5108 rp.addr.type = cp->addr.type; 5109 rp.supported_flags = cpu_to_le32(supported_flags); 5110 rp.current_flags = cpu_to_le32(current_flags); 5111 5112 status = MGMT_STATUS_SUCCESS; 5113 5114 done: 5115 hci_dev_unlock(hdev); 5116 5117 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_DEVICE_FLAGS, status, 5118 &rp, sizeof(rp)); 5119 } 5120 5121 static void device_flags_changed(struct sock *sk, struct hci_dev *hdev, 5122 bdaddr_t *bdaddr, u8 bdaddr_type, 5123 u32 supported_flags, u32 current_flags) 5124 { 5125 struct mgmt_ev_device_flags_changed ev; 5126 5127 bacpy(&ev.addr.bdaddr, bdaddr); 5128 ev.addr.type = bdaddr_type; 5129 ev.supported_flags = cpu_to_le32(supported_flags); 5130 ev.current_flags = cpu_to_le32(current_flags); 5131 5132 mgmt_event(MGMT_EV_DEVICE_FLAGS_CHANGED, hdev, &ev, sizeof(ev), sk); 5133 } 5134 5135 static bool is_connected(struct hci_dev *hdev, bdaddr_t *addr, u8 type) 5136 { 5137 struct hci_conn *conn; 5138 5139 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, addr); 5140 if (!conn) 5141 return false; 5142 5143 if (conn->dst_type != type) 5144 return false; 5145 5146 if (conn->state != BT_CONNECTED) 5147 return false; 5148 5149 return true; 5150 } 5151 5152 /* This function requires the caller holds hdev->lock */ 5153 static struct hci_conn_params *hci_conn_params_set(struct hci_dev *hdev, 5154 bdaddr_t *addr, u8 addr_type, 5155 u8 auto_connect) 5156 { 5157 struct hci_conn_params *params; 5158 5159 params = hci_conn_params_add(hdev, addr, addr_type); 5160 if (!params) 5161 return NULL; 5162 5163 if (params->auto_connect == auto_connect) 5164 return params; 5165 5166 hci_pend_le_list_del_init(params); 5167 5168 switch (auto_connect) { 5169 case HCI_AUTO_CONN_DISABLED: 5170 case HCI_AUTO_CONN_LINK_LOSS: 5171 /* If auto connect is being disabled when we're trying to 5172 * connect to device, keep connecting. 5173 */ 5174 if (params->explicit_connect) 5175 hci_pend_le_list_add(params, &hdev->pend_le_conns); 5176 break; 5177 case HCI_AUTO_CONN_REPORT: 5178 if (params->explicit_connect) 5179 hci_pend_le_list_add(params, &hdev->pend_le_conns); 5180 else 5181 hci_pend_le_list_add(params, &hdev->pend_le_reports); 5182 break; 5183 case HCI_AUTO_CONN_DIRECT: 5184 case HCI_AUTO_CONN_ALWAYS: 5185 if (!is_connected(hdev, addr, addr_type)) 5186 hci_pend_le_list_add(params, &hdev->pend_le_conns); 5187 break; 5188 } 5189 5190 params->auto_connect = auto_connect; 5191 5192 bt_dev_dbg(hdev, "addr %pMR (type %u) auto_connect %u", 5193 addr, addr_type, auto_connect); 5194 5195 return params; 5196 } 5197 5198 static int set_device_flags(struct sock *sk, struct hci_dev *hdev, void *data, 5199 u16 len) 5200 { 5201 struct mgmt_cp_set_device_flags *cp = data; 5202 struct bdaddr_list_with_flags *br_params; 5203 struct hci_conn_params *params; 5204 u8 status = MGMT_STATUS_INVALID_PARAMS; 5205 u32 supported_flags; 5206 u32 current_flags = __le32_to_cpu(cp->current_flags); 5207 5208 bt_dev_dbg(hdev, "Set device flags %pMR (type 0x%x) = 0x%x", 5209 &cp->addr.bdaddr, cp->addr.type, current_flags); 5210 5211 // We should take hci_dev_lock() early, I think.. conn_flags can change 5212 supported_flags = hdev->conn_flags; 5213 5214 if ((supported_flags | current_flags) != supported_flags) { 5215 bt_dev_warn(hdev, "Bad flag given (0x%x) vs supported (0x%0x)", 5216 current_flags, supported_flags); 5217 goto done; 5218 } 5219 5220 hci_dev_lock(hdev); 5221 5222 if (cp->addr.type == BDADDR_BREDR) { 5223 br_params = hci_bdaddr_list_lookup_with_flags(&hdev->accept_list, 5224 &cp->addr.bdaddr, 5225 cp->addr.type); 5226 5227 if (br_params) { 5228 br_params->flags = current_flags; 5229 status = MGMT_STATUS_SUCCESS; 5230 } else { 5231 bt_dev_warn(hdev, "No such BR/EDR device %pMR (0x%x)", 5232 &cp->addr.bdaddr, cp->addr.type); 5233 } 5234 5235 goto unlock; 5236 } 5237 5238 params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr, 5239 le_addr_type(cp->addr.type)); 5240 if (!params) { 5241 /* Create a new hci_conn_params if it doesn't exist */ 5242 params = hci_conn_params_set(hdev, &cp->addr.bdaddr, 5243 le_addr_type(cp->addr.type), 5244 HCI_AUTO_CONN_DISABLED); 5245 if (!params) { 5246 bt_dev_warn(hdev, "No such LE device %pMR (0x%x)", 5247 &cp->addr.bdaddr, 5248 le_addr_type(cp->addr.type)); 5249 goto unlock; 5250 } 5251 } 5252 5253 supported_flags = hdev->conn_flags; 5254 5255 if ((supported_flags | current_flags) != supported_flags) { 5256 bt_dev_warn(hdev, "Bad flag given (0x%x) vs supported (0x%0x)", 5257 current_flags, supported_flags); 5258 goto unlock; 5259 } 5260 5261 WRITE_ONCE(params->flags, current_flags); 5262 status = MGMT_STATUS_SUCCESS; 5263 5264 /* Update passive scan if HCI_CONN_FLAG_DEVICE_PRIVACY 5265 * has been set. 5266 */ 5267 if (params->flags & HCI_CONN_FLAG_DEVICE_PRIVACY) 5268 hci_update_passive_scan(hdev); 5269 5270 unlock: 5271 hci_dev_unlock(hdev); 5272 5273 done: 5274 if (status == MGMT_STATUS_SUCCESS) 5275 device_flags_changed(sk, hdev, &cp->addr.bdaddr, cp->addr.type, 5276 supported_flags, current_flags); 5277 5278 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_DEVICE_FLAGS, status, 5279 &cp->addr, sizeof(cp->addr)); 5280 } 5281 5282 static void mgmt_adv_monitor_added(struct sock *sk, struct hci_dev *hdev, 5283 u16 handle) 5284 { 5285 struct mgmt_ev_adv_monitor_added ev; 5286 5287 ev.monitor_handle = cpu_to_le16(handle); 5288 5289 mgmt_event(MGMT_EV_ADV_MONITOR_ADDED, hdev, &ev, sizeof(ev), sk); 5290 } 5291 5292 static void mgmt_adv_monitor_removed(struct sock *sk, struct hci_dev *hdev, 5293 __le16 handle) 5294 { 5295 struct mgmt_ev_adv_monitor_removed ev; 5296 5297 ev.monitor_handle = handle; 5298 5299 mgmt_event(MGMT_EV_ADV_MONITOR_REMOVED, hdev, &ev, sizeof(ev), sk); 5300 } 5301 5302 static int read_adv_mon_features(struct sock *sk, struct hci_dev *hdev, 5303 void *data, u16 len) 5304 { 5305 struct adv_monitor *monitor = NULL; 5306 struct mgmt_rp_read_adv_monitor_features *rp = NULL; 5307 int handle, err; 5308 size_t rp_size = 0; 5309 __u32 supported = 0; 5310 __u32 enabled = 0; 5311 __u16 num_handles = 0; 5312 __u16 handles[HCI_MAX_ADV_MONITOR_NUM_HANDLES]; 5313 5314 BT_DBG("request for %s", hdev->name); 5315 5316 hci_dev_lock(hdev); 5317 5318 if (msft_monitor_supported(hdev)) 5319 supported |= MGMT_ADV_MONITOR_FEATURE_MASK_OR_PATTERNS; 5320 5321 idr_for_each_entry(&hdev->adv_monitors_idr, monitor, handle) 5322 handles[num_handles++] = monitor->handle; 5323 5324 hci_dev_unlock(hdev); 5325 5326 rp_size = sizeof(*rp) + (num_handles * sizeof(u16)); 5327 rp = kmalloc(rp_size, GFP_KERNEL); 5328 if (!rp) 5329 return -ENOMEM; 5330 5331 /* All supported features are currently enabled */ 5332 enabled = supported; 5333 5334 rp->supported_features = cpu_to_le32(supported); 5335 rp->enabled_features = cpu_to_le32(enabled); 5336 rp->max_num_handles = cpu_to_le16(HCI_MAX_ADV_MONITOR_NUM_HANDLES); 5337 rp->max_num_patterns = HCI_MAX_ADV_MONITOR_NUM_PATTERNS; 5338 rp->num_handles = cpu_to_le16(num_handles); 5339 if (num_handles) 5340 memcpy(&rp->handles, &handles, (num_handles * sizeof(u16))); 5341 5342 err = mgmt_cmd_complete(sk, hdev->id, 5343 MGMT_OP_READ_ADV_MONITOR_FEATURES, 5344 MGMT_STATUS_SUCCESS, rp, rp_size); 5345 5346 kfree(rp); 5347 5348 return err; 5349 } 5350 5351 static void mgmt_add_adv_patterns_monitor_complete(struct hci_dev *hdev, 5352 void *data, int status) 5353 { 5354 struct mgmt_rp_add_adv_patterns_monitor rp; 5355 struct mgmt_pending_cmd *cmd = data; 5356 struct adv_monitor *monitor; 5357 5358 /* This is likely the result of hdev being closed and mgmt_index_removed 5359 * is attempting to clean up any pending command so 5360 * hci_adv_monitors_clear is about to be called which will take care of 5361 * freeing the adv_monitor instances. 5362 */ 5363 if (status == -ECANCELED || !mgmt_pending_valid(hdev, cmd)) 5364 return; 5365 5366 monitor = cmd->user_data; 5367 5368 hci_dev_lock(hdev); 5369 5370 rp.monitor_handle = cpu_to_le16(monitor->handle); 5371 5372 if (!status) { 5373 mgmt_adv_monitor_added(cmd->sk, hdev, monitor->handle); 5374 hdev->adv_monitors_cnt++; 5375 if (monitor->state == ADV_MONITOR_STATE_NOT_REGISTERED) 5376 monitor->state = ADV_MONITOR_STATE_REGISTERED; 5377 hci_update_passive_scan(hdev); 5378 } 5379 5380 mgmt_cmd_complete(cmd->sk, cmd->hdev->id, cmd->opcode, 5381 mgmt_status(status), &rp, sizeof(rp)); 5382 mgmt_pending_free(cmd); 5383 5384 hci_dev_unlock(hdev); 5385 bt_dev_dbg(hdev, "add monitor %d complete, status %d", 5386 rp.monitor_handle, status); 5387 } 5388 5389 static int mgmt_add_adv_patterns_monitor_sync(struct hci_dev *hdev, void *data) 5390 { 5391 struct mgmt_pending_cmd *cmd = data; 5392 struct adv_monitor *mon; 5393 5394 mutex_lock(&hdev->mgmt_pending_lock); 5395 5396 if (!__mgmt_pending_listed(hdev, cmd)) { 5397 mutex_unlock(&hdev->mgmt_pending_lock); 5398 return -ECANCELED; 5399 } 5400 5401 mon = cmd->user_data; 5402 5403 mutex_unlock(&hdev->mgmt_pending_lock); 5404 5405 return hci_add_adv_monitor(hdev, mon); 5406 } 5407 5408 static int __add_adv_patterns_monitor(struct sock *sk, struct hci_dev *hdev, 5409 struct adv_monitor *m, u8 status, 5410 void *data, u16 len, u16 op) 5411 { 5412 struct mgmt_pending_cmd *cmd; 5413 int err; 5414 5415 hci_dev_lock(hdev); 5416 5417 if (status) 5418 goto unlock; 5419 5420 if (pending_find(MGMT_OP_SET_LE, hdev) || 5421 pending_find(MGMT_OP_ADD_ADV_PATTERNS_MONITOR, hdev) || 5422 pending_find(MGMT_OP_ADD_ADV_PATTERNS_MONITOR_RSSI, hdev)) { 5423 status = MGMT_STATUS_BUSY; 5424 goto unlock; 5425 } 5426 5427 cmd = mgmt_pending_add(sk, op, hdev, data, len); 5428 if (!cmd) { 5429 status = MGMT_STATUS_NO_RESOURCES; 5430 goto unlock; 5431 } 5432 5433 cmd->user_data = m; 5434 err = hci_cmd_sync_queue(hdev, mgmt_add_adv_patterns_monitor_sync, cmd, 5435 mgmt_add_adv_patterns_monitor_complete); 5436 if (err) { 5437 if (err == -ENOMEM) 5438 status = MGMT_STATUS_NO_RESOURCES; 5439 else 5440 status = MGMT_STATUS_FAILED; 5441 5442 goto unlock; 5443 } 5444 5445 hci_dev_unlock(hdev); 5446 5447 return 0; 5448 5449 unlock: 5450 hci_free_adv_monitor(hdev, m); 5451 hci_dev_unlock(hdev); 5452 return mgmt_cmd_status(sk, hdev->id, op, status); 5453 } 5454 5455 static void parse_adv_monitor_rssi(struct adv_monitor *m, 5456 struct mgmt_adv_rssi_thresholds *rssi) 5457 { 5458 if (rssi) { 5459 m->rssi.low_threshold = rssi->low_threshold; 5460 m->rssi.low_threshold_timeout = 5461 __le16_to_cpu(rssi->low_threshold_timeout); 5462 m->rssi.high_threshold = rssi->high_threshold; 5463 m->rssi.high_threshold_timeout = 5464 __le16_to_cpu(rssi->high_threshold_timeout); 5465 m->rssi.sampling_period = rssi->sampling_period; 5466 } else { 5467 /* Default values. These numbers are the least constricting 5468 * parameters for MSFT API to work, so it behaves as if there 5469 * are no rssi parameter to consider. May need to be changed 5470 * if other API are to be supported. 5471 */ 5472 m->rssi.low_threshold = -127; 5473 m->rssi.low_threshold_timeout = 60; 5474 m->rssi.high_threshold = -127; 5475 m->rssi.high_threshold_timeout = 0; 5476 m->rssi.sampling_period = 0; 5477 } 5478 } 5479 5480 static u8 parse_adv_monitor_pattern(struct adv_monitor *m, u8 pattern_count, 5481 struct mgmt_adv_pattern *patterns) 5482 { 5483 u8 offset = 0, length = 0; 5484 struct adv_pattern *p = NULL; 5485 int i; 5486 5487 for (i = 0; i < pattern_count; i++) { 5488 offset = patterns[i].offset; 5489 length = patterns[i].length; 5490 if (offset >= HCI_MAX_AD_LENGTH || 5491 length > HCI_MAX_AD_LENGTH || 5492 (offset + length) > HCI_MAX_AD_LENGTH) 5493 return MGMT_STATUS_INVALID_PARAMS; 5494 5495 p = kmalloc_obj(*p); 5496 if (!p) 5497 return MGMT_STATUS_NO_RESOURCES; 5498 5499 p->ad_type = patterns[i].ad_type; 5500 p->offset = patterns[i].offset; 5501 p->length = patterns[i].length; 5502 memcpy(p->value, patterns[i].value, p->length); 5503 5504 INIT_LIST_HEAD(&p->list); 5505 list_add(&p->list, &m->patterns); 5506 } 5507 5508 return MGMT_STATUS_SUCCESS; 5509 } 5510 5511 static int add_adv_patterns_monitor(struct sock *sk, struct hci_dev *hdev, 5512 void *data, u16 len) 5513 { 5514 struct mgmt_cp_add_adv_patterns_monitor *cp = data; 5515 struct adv_monitor *m = NULL; 5516 u8 status = MGMT_STATUS_SUCCESS; 5517 size_t expected_size = sizeof(*cp); 5518 5519 BT_DBG("request for %s", hdev->name); 5520 5521 if (len <= sizeof(*cp)) { 5522 status = MGMT_STATUS_INVALID_PARAMS; 5523 goto done; 5524 } 5525 5526 expected_size += cp->pattern_count * sizeof(struct mgmt_adv_pattern); 5527 if (len != expected_size) { 5528 status = MGMT_STATUS_INVALID_PARAMS; 5529 goto done; 5530 } 5531 5532 m = kzalloc_obj(*m); 5533 if (!m) { 5534 status = MGMT_STATUS_NO_RESOURCES; 5535 goto done; 5536 } 5537 5538 INIT_LIST_HEAD(&m->patterns); 5539 5540 parse_adv_monitor_rssi(m, NULL); 5541 status = parse_adv_monitor_pattern(m, cp->pattern_count, cp->patterns); 5542 5543 done: 5544 return __add_adv_patterns_monitor(sk, hdev, m, status, data, len, 5545 MGMT_OP_ADD_ADV_PATTERNS_MONITOR); 5546 } 5547 5548 static int add_adv_patterns_monitor_rssi(struct sock *sk, struct hci_dev *hdev, 5549 void *data, u16 len) 5550 { 5551 struct mgmt_cp_add_adv_patterns_monitor_rssi *cp = data; 5552 struct adv_monitor *m = NULL; 5553 u8 status = MGMT_STATUS_SUCCESS; 5554 size_t expected_size = sizeof(*cp); 5555 5556 BT_DBG("request for %s", hdev->name); 5557 5558 if (len <= sizeof(*cp)) { 5559 status = MGMT_STATUS_INVALID_PARAMS; 5560 goto done; 5561 } 5562 5563 expected_size += cp->pattern_count * sizeof(struct mgmt_adv_pattern); 5564 if (len != expected_size) { 5565 status = MGMT_STATUS_INVALID_PARAMS; 5566 goto done; 5567 } 5568 5569 m = kzalloc_obj(*m); 5570 if (!m) { 5571 status = MGMT_STATUS_NO_RESOURCES; 5572 goto done; 5573 } 5574 5575 INIT_LIST_HEAD(&m->patterns); 5576 5577 parse_adv_monitor_rssi(m, &cp->rssi); 5578 status = parse_adv_monitor_pattern(m, cp->pattern_count, cp->patterns); 5579 5580 done: 5581 return __add_adv_patterns_monitor(sk, hdev, m, status, data, len, 5582 MGMT_OP_ADD_ADV_PATTERNS_MONITOR_RSSI); 5583 } 5584 5585 static void mgmt_remove_adv_monitor_complete(struct hci_dev *hdev, 5586 void *data, int status) 5587 { 5588 struct mgmt_rp_remove_adv_monitor rp; 5589 struct mgmt_pending_cmd *cmd = data; 5590 struct mgmt_cp_remove_adv_monitor *cp; 5591 5592 if (status == -ECANCELED) 5593 return; 5594 5595 hci_dev_lock(hdev); 5596 5597 cp = cmd->param; 5598 5599 rp.monitor_handle = cp->monitor_handle; 5600 5601 if (!status) { 5602 mgmt_adv_monitor_removed(cmd->sk, hdev, cp->monitor_handle); 5603 hci_update_passive_scan(hdev); 5604 } 5605 5606 mgmt_cmd_complete(cmd->sk, cmd->hdev->id, cmd->opcode, 5607 mgmt_status(status), &rp, sizeof(rp)); 5608 mgmt_pending_free(cmd); 5609 5610 hci_dev_unlock(hdev); 5611 bt_dev_dbg(hdev, "remove monitor %d complete, status %d", 5612 rp.monitor_handle, status); 5613 } 5614 5615 static int mgmt_remove_adv_monitor_sync(struct hci_dev *hdev, void *data) 5616 { 5617 struct mgmt_pending_cmd *cmd = data; 5618 struct mgmt_cp_remove_adv_monitor *cp = cmd->param; 5619 u16 handle = __le16_to_cpu(cp->monitor_handle); 5620 5621 if (!handle) 5622 return hci_remove_all_adv_monitor(hdev); 5623 5624 return hci_remove_single_adv_monitor(hdev, handle); 5625 } 5626 5627 static int remove_adv_monitor(struct sock *sk, struct hci_dev *hdev, 5628 void *data, u16 len) 5629 { 5630 struct mgmt_pending_cmd *cmd; 5631 int err, status; 5632 5633 hci_dev_lock(hdev); 5634 5635 if (pending_find(MGMT_OP_SET_LE, hdev) || 5636 pending_find(MGMT_OP_ADD_ADV_PATTERNS_MONITOR, hdev) || 5637 pending_find(MGMT_OP_ADD_ADV_PATTERNS_MONITOR_RSSI, hdev)) { 5638 status = MGMT_STATUS_BUSY; 5639 goto unlock; 5640 } 5641 5642 cmd = mgmt_pending_new(sk, MGMT_OP_REMOVE_ADV_MONITOR, hdev, data, len); 5643 if (!cmd) { 5644 status = MGMT_STATUS_NO_RESOURCES; 5645 goto unlock; 5646 } 5647 5648 err = hci_cmd_sync_submit(hdev, mgmt_remove_adv_monitor_sync, cmd, 5649 mgmt_remove_adv_monitor_complete); 5650 5651 if (err) { 5652 mgmt_pending_free(cmd); 5653 5654 if (err == -ENOMEM) 5655 status = MGMT_STATUS_NO_RESOURCES; 5656 else 5657 status = MGMT_STATUS_FAILED; 5658 5659 goto unlock; 5660 } 5661 5662 hci_dev_unlock(hdev); 5663 5664 return 0; 5665 5666 unlock: 5667 hci_dev_unlock(hdev); 5668 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_ADV_MONITOR, 5669 status); 5670 } 5671 5672 static void read_local_oob_data_complete(struct hci_dev *hdev, void *data, 5673 int err) 5674 { 5675 struct mgmt_rp_read_local_oob_data mgmt_rp; 5676 size_t rp_size = sizeof(mgmt_rp); 5677 struct mgmt_pending_cmd *cmd = data; 5678 struct sk_buff *skb = cmd->skb; 5679 u8 status = mgmt_status(err); 5680 5681 if (!status) { 5682 if (!skb) 5683 status = MGMT_STATUS_FAILED; 5684 else if (IS_ERR(skb)) 5685 status = mgmt_status(PTR_ERR(skb)); 5686 else 5687 status = mgmt_status(skb->data[0]); 5688 } 5689 5690 bt_dev_dbg(hdev, "status %d", status); 5691 5692 if (status) { 5693 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA, 5694 status); 5695 goto remove; 5696 } 5697 5698 memset(&mgmt_rp, 0, sizeof(mgmt_rp)); 5699 5700 if (!bredr_sc_enabled(hdev)) { 5701 struct hci_rp_read_local_oob_data *rp = (void *) skb->data; 5702 5703 if (skb->len < sizeof(*rp)) { 5704 mgmt_cmd_status(cmd->sk, hdev->id, 5705 MGMT_OP_READ_LOCAL_OOB_DATA, 5706 MGMT_STATUS_FAILED); 5707 goto remove; 5708 } 5709 5710 memcpy(mgmt_rp.hash192, rp->hash, sizeof(rp->hash)); 5711 memcpy(mgmt_rp.rand192, rp->rand, sizeof(rp->rand)); 5712 5713 rp_size -= sizeof(mgmt_rp.hash256) + sizeof(mgmt_rp.rand256); 5714 } else { 5715 struct hci_rp_read_local_oob_ext_data *rp = (void *) skb->data; 5716 5717 if (skb->len < sizeof(*rp)) { 5718 mgmt_cmd_status(cmd->sk, hdev->id, 5719 MGMT_OP_READ_LOCAL_OOB_DATA, 5720 MGMT_STATUS_FAILED); 5721 goto remove; 5722 } 5723 5724 memcpy(mgmt_rp.hash192, rp->hash192, sizeof(rp->hash192)); 5725 memcpy(mgmt_rp.rand192, rp->rand192, sizeof(rp->rand192)); 5726 5727 memcpy(mgmt_rp.hash256, rp->hash256, sizeof(rp->hash256)); 5728 memcpy(mgmt_rp.rand256, rp->rand256, sizeof(rp->rand256)); 5729 } 5730 5731 mgmt_cmd_complete(cmd->sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA, 5732 MGMT_STATUS_SUCCESS, &mgmt_rp, rp_size); 5733 5734 remove: 5735 if (skb && !IS_ERR(skb)) 5736 kfree_skb(skb); 5737 5738 mgmt_pending_free(cmd); 5739 } 5740 5741 static int read_local_oob_data_sync(struct hci_dev *hdev, void *data) 5742 { 5743 struct mgmt_pending_cmd *cmd = data; 5744 5745 if (bredr_sc_enabled(hdev)) 5746 cmd->skb = hci_read_local_oob_data_sync(hdev, true, cmd->sk); 5747 else 5748 cmd->skb = hci_read_local_oob_data_sync(hdev, false, cmd->sk); 5749 5750 if (IS_ERR(cmd->skb)) 5751 return PTR_ERR(cmd->skb); 5752 else 5753 return 0; 5754 } 5755 5756 static int read_local_oob_data(struct sock *sk, struct hci_dev *hdev, 5757 void *data, u16 data_len) 5758 { 5759 struct mgmt_pending_cmd *cmd; 5760 int err; 5761 5762 bt_dev_dbg(hdev, "sock %p", sk); 5763 5764 hci_dev_lock(hdev); 5765 5766 if (!hdev_is_powered(hdev)) { 5767 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA, 5768 MGMT_STATUS_NOT_POWERED); 5769 goto unlock; 5770 } 5771 5772 if (!lmp_ssp_capable(hdev)) { 5773 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA, 5774 MGMT_STATUS_NOT_SUPPORTED); 5775 goto unlock; 5776 } 5777 5778 cmd = mgmt_pending_new(sk, MGMT_OP_READ_LOCAL_OOB_DATA, hdev, NULL, 0); 5779 if (!cmd) 5780 err = -ENOMEM; 5781 else 5782 err = hci_cmd_sync_queue(hdev, read_local_oob_data_sync, cmd, 5783 read_local_oob_data_complete); 5784 5785 if (err < 0) { 5786 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA, 5787 MGMT_STATUS_FAILED); 5788 5789 if (cmd) 5790 mgmt_pending_free(cmd); 5791 } 5792 5793 unlock: 5794 hci_dev_unlock(hdev); 5795 return err; 5796 } 5797 5798 static int add_remote_oob_data(struct sock *sk, struct hci_dev *hdev, 5799 void *data, u16 len) 5800 { 5801 struct mgmt_addr_info *addr = data; 5802 int err; 5803 5804 bt_dev_dbg(hdev, "sock %p", sk); 5805 5806 if (!bdaddr_type_is_valid(addr->type)) 5807 return mgmt_cmd_complete(sk, hdev->id, 5808 MGMT_OP_ADD_REMOTE_OOB_DATA, 5809 MGMT_STATUS_INVALID_PARAMS, 5810 addr, sizeof(*addr)); 5811 5812 hci_dev_lock(hdev); 5813 5814 if (len == MGMT_ADD_REMOTE_OOB_DATA_SIZE) { 5815 struct mgmt_cp_add_remote_oob_data *cp = data; 5816 u8 status; 5817 5818 if (cp->addr.type != BDADDR_BREDR) { 5819 err = mgmt_cmd_complete(sk, hdev->id, 5820 MGMT_OP_ADD_REMOTE_OOB_DATA, 5821 MGMT_STATUS_INVALID_PARAMS, 5822 &cp->addr, sizeof(cp->addr)); 5823 goto unlock; 5824 } 5825 5826 err = hci_add_remote_oob_data(hdev, &cp->addr.bdaddr, 5827 cp->addr.type, cp->hash, 5828 cp->rand, NULL, NULL); 5829 if (err < 0) 5830 status = MGMT_STATUS_FAILED; 5831 else 5832 status = MGMT_STATUS_SUCCESS; 5833 5834 err = mgmt_cmd_complete(sk, hdev->id, 5835 MGMT_OP_ADD_REMOTE_OOB_DATA, status, 5836 &cp->addr, sizeof(cp->addr)); 5837 } else if (len == MGMT_ADD_REMOTE_OOB_EXT_DATA_SIZE) { 5838 struct mgmt_cp_add_remote_oob_ext_data *cp = data; 5839 u8 *rand192, *hash192, *rand256, *hash256; 5840 u8 status; 5841 5842 if (bdaddr_type_is_le(cp->addr.type)) { 5843 /* Enforce zero-valued 192-bit parameters as 5844 * long as legacy SMP OOB isn't implemented. 5845 */ 5846 if (memcmp(cp->rand192, ZERO_KEY, 16) || 5847 memcmp(cp->hash192, ZERO_KEY, 16)) { 5848 err = mgmt_cmd_complete(sk, hdev->id, 5849 MGMT_OP_ADD_REMOTE_OOB_DATA, 5850 MGMT_STATUS_INVALID_PARAMS, 5851 addr, sizeof(*addr)); 5852 goto unlock; 5853 } 5854 5855 rand192 = NULL; 5856 hash192 = NULL; 5857 } else { 5858 /* In case one of the P-192 values is set to zero, 5859 * then just disable OOB data for P-192. 5860 */ 5861 if (!memcmp(cp->rand192, ZERO_KEY, 16) || 5862 !memcmp(cp->hash192, ZERO_KEY, 16)) { 5863 rand192 = NULL; 5864 hash192 = NULL; 5865 } else { 5866 rand192 = cp->rand192; 5867 hash192 = cp->hash192; 5868 } 5869 } 5870 5871 /* In case one of the P-256 values is set to zero, then just 5872 * disable OOB data for P-256. 5873 */ 5874 if (!memcmp(cp->rand256, ZERO_KEY, 16) || 5875 !memcmp(cp->hash256, ZERO_KEY, 16)) { 5876 rand256 = NULL; 5877 hash256 = NULL; 5878 } else { 5879 rand256 = cp->rand256; 5880 hash256 = cp->hash256; 5881 } 5882 5883 err = hci_add_remote_oob_data(hdev, &cp->addr.bdaddr, 5884 cp->addr.type, hash192, rand192, 5885 hash256, rand256); 5886 if (err < 0) 5887 status = MGMT_STATUS_FAILED; 5888 else 5889 status = MGMT_STATUS_SUCCESS; 5890 5891 err = mgmt_cmd_complete(sk, hdev->id, 5892 MGMT_OP_ADD_REMOTE_OOB_DATA, 5893 status, &cp->addr, sizeof(cp->addr)); 5894 } else { 5895 bt_dev_err(hdev, "add_remote_oob_data: invalid len of %u bytes", 5896 len); 5897 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_REMOTE_OOB_DATA, 5898 MGMT_STATUS_INVALID_PARAMS); 5899 } 5900 5901 unlock: 5902 hci_dev_unlock(hdev); 5903 return err; 5904 } 5905 5906 static int remove_remote_oob_data(struct sock *sk, struct hci_dev *hdev, 5907 void *data, u16 len) 5908 { 5909 struct mgmt_cp_remove_remote_oob_data *cp = data; 5910 u8 status; 5911 int err; 5912 5913 bt_dev_dbg(hdev, "sock %p", sk); 5914 5915 if (cp->addr.type != BDADDR_BREDR) 5916 return mgmt_cmd_complete(sk, hdev->id, 5917 MGMT_OP_REMOVE_REMOTE_OOB_DATA, 5918 MGMT_STATUS_INVALID_PARAMS, 5919 &cp->addr, sizeof(cp->addr)); 5920 5921 hci_dev_lock(hdev); 5922 5923 if (!bacmp(&cp->addr.bdaddr, BDADDR_ANY)) { 5924 hci_remote_oob_data_clear(hdev); 5925 status = MGMT_STATUS_SUCCESS; 5926 goto done; 5927 } 5928 5929 err = hci_remove_remote_oob_data(hdev, &cp->addr.bdaddr, cp->addr.type); 5930 if (err < 0) 5931 status = MGMT_STATUS_INVALID_PARAMS; 5932 else 5933 status = MGMT_STATUS_SUCCESS; 5934 5935 done: 5936 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_REMOTE_OOB_DATA, 5937 status, &cp->addr, sizeof(cp->addr)); 5938 5939 hci_dev_unlock(hdev); 5940 return err; 5941 } 5942 5943 static bool discovery_type_is_valid(struct hci_dev *hdev, uint8_t type, 5944 uint8_t *mgmt_status) 5945 { 5946 switch (type) { 5947 case DISCOV_TYPE_LE: 5948 *mgmt_status = mgmt_le_support(hdev); 5949 if (*mgmt_status) 5950 return false; 5951 break; 5952 case DISCOV_TYPE_INTERLEAVED: 5953 *mgmt_status = mgmt_le_support(hdev); 5954 if (*mgmt_status) 5955 return false; 5956 fallthrough; 5957 case DISCOV_TYPE_BREDR: 5958 *mgmt_status = mgmt_bredr_support(hdev); 5959 if (*mgmt_status) 5960 return false; 5961 break; 5962 default: 5963 *mgmt_status = MGMT_STATUS_INVALID_PARAMS; 5964 return false; 5965 } 5966 5967 return true; 5968 } 5969 5970 static void start_discovery_complete(struct hci_dev *hdev, void *data, int err) 5971 { 5972 struct mgmt_pending_cmd *cmd = data; 5973 5974 bt_dev_dbg(hdev, "err %d", err); 5975 5976 if (err == -ECANCELED || !mgmt_pending_valid(hdev, cmd)) 5977 return; 5978 5979 mgmt_cmd_complete(cmd->sk, cmd->hdev->id, cmd->opcode, mgmt_status(err), 5980 cmd->param, 1); 5981 mgmt_pending_free(cmd); 5982 5983 hci_discovery_set_state(hdev, err ? DISCOVERY_STOPPED: 5984 DISCOVERY_FINDING); 5985 } 5986 5987 static int start_discovery_sync(struct hci_dev *hdev, void *data) 5988 { 5989 if (!mgmt_pending_listed(hdev, data)) 5990 return -ECANCELED; 5991 5992 return hci_start_discovery_sync(hdev); 5993 } 5994 5995 static int start_discovery_internal(struct sock *sk, struct hci_dev *hdev, 5996 u16 op, void *data, u16 len) 5997 { 5998 struct mgmt_cp_start_discovery *cp = data; 5999 struct mgmt_pending_cmd *cmd; 6000 u8 status; 6001 int err; 6002 6003 bt_dev_dbg(hdev, "sock %p", sk); 6004 6005 hci_dev_lock(hdev); 6006 6007 if (!hdev_is_powered(hdev)) { 6008 err = mgmt_cmd_complete(sk, hdev->id, op, 6009 MGMT_STATUS_NOT_POWERED, 6010 &cp->type, sizeof(cp->type)); 6011 goto failed; 6012 } 6013 6014 if (hdev->discovery.state != DISCOVERY_STOPPED || 6015 hci_dev_test_flag(hdev, HCI_PERIODIC_INQ)) { 6016 err = mgmt_cmd_complete(sk, hdev->id, op, MGMT_STATUS_BUSY, 6017 &cp->type, sizeof(cp->type)); 6018 goto failed; 6019 } 6020 6021 if (!discovery_type_is_valid(hdev, cp->type, &status)) { 6022 err = mgmt_cmd_complete(sk, hdev->id, op, status, 6023 &cp->type, sizeof(cp->type)); 6024 goto failed; 6025 } 6026 6027 /* Can't start discovery when it is paused */ 6028 if (hdev->discovery_paused) { 6029 err = mgmt_cmd_complete(sk, hdev->id, op, MGMT_STATUS_BUSY, 6030 &cp->type, sizeof(cp->type)); 6031 goto failed; 6032 } 6033 6034 /* Clear the discovery filter first to free any previously 6035 * allocated memory for the UUID list. 6036 */ 6037 hci_discovery_filter_clear(hdev); 6038 6039 hdev->discovery.type = cp->type; 6040 hdev->discovery.report_invalid_rssi = false; 6041 if (op == MGMT_OP_START_LIMITED_DISCOVERY) 6042 hdev->discovery.limited = true; 6043 else 6044 hdev->discovery.limited = false; 6045 6046 cmd = mgmt_pending_add(sk, op, hdev, data, len); 6047 if (!cmd) { 6048 err = -ENOMEM; 6049 goto failed; 6050 } 6051 6052 err = hci_cmd_sync_queue(hdev, start_discovery_sync, cmd, 6053 start_discovery_complete); 6054 if (err < 0) { 6055 mgmt_pending_remove(cmd); 6056 goto failed; 6057 } 6058 6059 hci_discovery_set_state(hdev, DISCOVERY_STARTING); 6060 6061 failed: 6062 hci_dev_unlock(hdev); 6063 return err; 6064 } 6065 6066 static int start_discovery(struct sock *sk, struct hci_dev *hdev, 6067 void *data, u16 len) 6068 { 6069 return start_discovery_internal(sk, hdev, MGMT_OP_START_DISCOVERY, 6070 data, len); 6071 } 6072 6073 static int start_limited_discovery(struct sock *sk, struct hci_dev *hdev, 6074 void *data, u16 len) 6075 { 6076 return start_discovery_internal(sk, hdev, 6077 MGMT_OP_START_LIMITED_DISCOVERY, 6078 data, len); 6079 } 6080 6081 static int start_service_discovery(struct sock *sk, struct hci_dev *hdev, 6082 void *data, u16 len) 6083 { 6084 struct mgmt_cp_start_service_discovery *cp = data; 6085 struct mgmt_pending_cmd *cmd; 6086 const u16 max_uuid_count = ((U16_MAX - sizeof(*cp)) / 16); 6087 u16 uuid_count, expected_len; 6088 u8 status; 6089 int err; 6090 6091 bt_dev_dbg(hdev, "sock %p", sk); 6092 6093 hci_dev_lock(hdev); 6094 6095 if (!hdev_is_powered(hdev)) { 6096 err = mgmt_cmd_complete(sk, hdev->id, 6097 MGMT_OP_START_SERVICE_DISCOVERY, 6098 MGMT_STATUS_NOT_POWERED, 6099 &cp->type, sizeof(cp->type)); 6100 goto failed; 6101 } 6102 6103 if (hdev->discovery.state != DISCOVERY_STOPPED || 6104 hci_dev_test_flag(hdev, HCI_PERIODIC_INQ)) { 6105 err = mgmt_cmd_complete(sk, hdev->id, 6106 MGMT_OP_START_SERVICE_DISCOVERY, 6107 MGMT_STATUS_BUSY, &cp->type, 6108 sizeof(cp->type)); 6109 goto failed; 6110 } 6111 6112 if (hdev->discovery_paused) { 6113 err = mgmt_cmd_complete(sk, hdev->id, 6114 MGMT_OP_START_SERVICE_DISCOVERY, 6115 MGMT_STATUS_BUSY, &cp->type, 6116 sizeof(cp->type)); 6117 goto failed; 6118 } 6119 6120 uuid_count = __le16_to_cpu(cp->uuid_count); 6121 if (uuid_count > max_uuid_count) { 6122 bt_dev_err(hdev, "service_discovery: too big uuid_count value %u", 6123 uuid_count); 6124 err = mgmt_cmd_complete(sk, hdev->id, 6125 MGMT_OP_START_SERVICE_DISCOVERY, 6126 MGMT_STATUS_INVALID_PARAMS, &cp->type, 6127 sizeof(cp->type)); 6128 goto failed; 6129 } 6130 6131 expected_len = sizeof(*cp) + uuid_count * 16; 6132 if (expected_len != len) { 6133 bt_dev_err(hdev, "service_discovery: expected %u bytes, got %u bytes", 6134 expected_len, len); 6135 err = mgmt_cmd_complete(sk, hdev->id, 6136 MGMT_OP_START_SERVICE_DISCOVERY, 6137 MGMT_STATUS_INVALID_PARAMS, &cp->type, 6138 sizeof(cp->type)); 6139 goto failed; 6140 } 6141 6142 if (!discovery_type_is_valid(hdev, cp->type, &status)) { 6143 err = mgmt_cmd_complete(sk, hdev->id, 6144 MGMT_OP_START_SERVICE_DISCOVERY, 6145 status, &cp->type, sizeof(cp->type)); 6146 goto failed; 6147 } 6148 6149 cmd = mgmt_pending_add(sk, MGMT_OP_START_SERVICE_DISCOVERY, 6150 hdev, data, len); 6151 if (!cmd) { 6152 err = -ENOMEM; 6153 goto failed; 6154 } 6155 6156 /* Clear the discovery filter first to free any previously 6157 * allocated memory for the UUID list. 6158 */ 6159 hci_discovery_filter_clear(hdev); 6160 6161 hdev->discovery.result_filtering = true; 6162 hdev->discovery.type = cp->type; 6163 hdev->discovery.rssi = cp->rssi; 6164 hdev->discovery.uuid_count = uuid_count; 6165 6166 if (uuid_count > 0) { 6167 hdev->discovery.uuids = kmemdup(cp->uuids, uuid_count * 16, 6168 GFP_KERNEL); 6169 if (!hdev->discovery.uuids) { 6170 err = mgmt_cmd_complete(sk, hdev->id, 6171 MGMT_OP_START_SERVICE_DISCOVERY, 6172 MGMT_STATUS_FAILED, 6173 &cp->type, sizeof(cp->type)); 6174 mgmt_pending_remove(cmd); 6175 goto failed; 6176 } 6177 } 6178 6179 err = hci_cmd_sync_queue(hdev, start_discovery_sync, cmd, 6180 start_discovery_complete); 6181 if (err < 0) { 6182 mgmt_pending_remove(cmd); 6183 goto failed; 6184 } 6185 6186 hci_discovery_set_state(hdev, DISCOVERY_STARTING); 6187 6188 failed: 6189 hci_dev_unlock(hdev); 6190 return err; 6191 } 6192 6193 static void stop_discovery_complete(struct hci_dev *hdev, void *data, int err) 6194 { 6195 struct mgmt_pending_cmd *cmd = data; 6196 6197 if (err == -ECANCELED || !mgmt_pending_valid(hdev, cmd)) 6198 return; 6199 6200 bt_dev_dbg(hdev, "err %d", err); 6201 6202 mgmt_cmd_complete(cmd->sk, cmd->hdev->id, cmd->opcode, mgmt_status(err), 6203 cmd->param, 1); 6204 mgmt_pending_free(cmd); 6205 6206 if (!err) 6207 hci_discovery_set_state(hdev, DISCOVERY_STOPPED); 6208 } 6209 6210 static int stop_discovery_sync(struct hci_dev *hdev, void *data) 6211 { 6212 if (!mgmt_pending_listed(hdev, data)) 6213 return -ECANCELED; 6214 6215 return hci_stop_discovery_sync(hdev); 6216 } 6217 6218 static int stop_discovery(struct sock *sk, struct hci_dev *hdev, void *data, 6219 u16 len) 6220 { 6221 struct mgmt_cp_stop_discovery *mgmt_cp = data; 6222 struct mgmt_pending_cmd *cmd; 6223 int err; 6224 6225 bt_dev_dbg(hdev, "sock %p", sk); 6226 6227 hci_dev_lock(hdev); 6228 6229 if (!hci_discovery_active(hdev)) { 6230 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY, 6231 MGMT_STATUS_REJECTED, &mgmt_cp->type, 6232 sizeof(mgmt_cp->type)); 6233 goto unlock; 6234 } 6235 6236 if (hdev->discovery.type != mgmt_cp->type) { 6237 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY, 6238 MGMT_STATUS_INVALID_PARAMS, 6239 &mgmt_cp->type, sizeof(mgmt_cp->type)); 6240 goto unlock; 6241 } 6242 6243 cmd = mgmt_pending_add(sk, MGMT_OP_STOP_DISCOVERY, hdev, data, len); 6244 if (!cmd) { 6245 err = -ENOMEM; 6246 goto unlock; 6247 } 6248 6249 err = hci_cmd_sync_queue(hdev, stop_discovery_sync, cmd, 6250 stop_discovery_complete); 6251 if (err < 0) { 6252 mgmt_pending_remove(cmd); 6253 goto unlock; 6254 } 6255 6256 hci_discovery_set_state(hdev, DISCOVERY_STOPPING); 6257 6258 unlock: 6259 hci_dev_unlock(hdev); 6260 return err; 6261 } 6262 6263 static int confirm_name(struct sock *sk, struct hci_dev *hdev, void *data, 6264 u16 len) 6265 { 6266 struct mgmt_cp_confirm_name *cp = data; 6267 struct inquiry_entry *e; 6268 int err; 6269 6270 bt_dev_dbg(hdev, "sock %p", sk); 6271 6272 hci_dev_lock(hdev); 6273 6274 if (!hci_discovery_active(hdev)) { 6275 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME, 6276 MGMT_STATUS_FAILED, &cp->addr, 6277 sizeof(cp->addr)); 6278 goto failed; 6279 } 6280 6281 e = hci_inquiry_cache_lookup_unknown(hdev, &cp->addr.bdaddr); 6282 if (!e) { 6283 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME, 6284 MGMT_STATUS_INVALID_PARAMS, &cp->addr, 6285 sizeof(cp->addr)); 6286 goto failed; 6287 } 6288 6289 if (cp->name_known) { 6290 e->name_state = NAME_KNOWN; 6291 list_del(&e->list); 6292 } else { 6293 e->name_state = NAME_NEEDED; 6294 hci_inquiry_cache_update_resolve(hdev, e); 6295 } 6296 6297 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME, 0, 6298 &cp->addr, sizeof(cp->addr)); 6299 6300 failed: 6301 hci_dev_unlock(hdev); 6302 return err; 6303 } 6304 6305 static int block_device(struct sock *sk, struct hci_dev *hdev, void *data, 6306 u16 len) 6307 { 6308 struct mgmt_cp_block_device *cp = data; 6309 u8 status; 6310 int err; 6311 6312 bt_dev_dbg(hdev, "sock %p", sk); 6313 6314 if (!bdaddr_type_is_valid(cp->addr.type)) 6315 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_BLOCK_DEVICE, 6316 MGMT_STATUS_INVALID_PARAMS, 6317 &cp->addr, sizeof(cp->addr)); 6318 6319 hci_dev_lock(hdev); 6320 6321 err = hci_bdaddr_list_add(&hdev->reject_list, &cp->addr.bdaddr, 6322 cp->addr.type); 6323 if (err < 0) { 6324 status = MGMT_STATUS_FAILED; 6325 goto done; 6326 } 6327 6328 mgmt_event(MGMT_EV_DEVICE_BLOCKED, hdev, &cp->addr, sizeof(cp->addr), 6329 sk); 6330 status = MGMT_STATUS_SUCCESS; 6331 6332 done: 6333 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_BLOCK_DEVICE, status, 6334 &cp->addr, sizeof(cp->addr)); 6335 6336 hci_dev_unlock(hdev); 6337 6338 return err; 6339 } 6340 6341 static int unblock_device(struct sock *sk, struct hci_dev *hdev, void *data, 6342 u16 len) 6343 { 6344 struct mgmt_cp_unblock_device *cp = data; 6345 u8 status; 6346 int err; 6347 6348 bt_dev_dbg(hdev, "sock %p", sk); 6349 6350 if (!bdaddr_type_is_valid(cp->addr.type)) 6351 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNBLOCK_DEVICE, 6352 MGMT_STATUS_INVALID_PARAMS, 6353 &cp->addr, sizeof(cp->addr)); 6354 6355 hci_dev_lock(hdev); 6356 6357 err = hci_bdaddr_list_del(&hdev->reject_list, &cp->addr.bdaddr, 6358 cp->addr.type); 6359 if (err < 0) { 6360 status = MGMT_STATUS_INVALID_PARAMS; 6361 goto done; 6362 } 6363 6364 mgmt_event(MGMT_EV_DEVICE_UNBLOCKED, hdev, &cp->addr, sizeof(cp->addr), 6365 sk); 6366 status = MGMT_STATUS_SUCCESS; 6367 6368 done: 6369 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNBLOCK_DEVICE, status, 6370 &cp->addr, sizeof(cp->addr)); 6371 6372 hci_dev_unlock(hdev); 6373 6374 return err; 6375 } 6376 6377 static int set_device_id_sync(struct hci_dev *hdev, void *data) 6378 { 6379 return hci_update_eir_sync(hdev); 6380 } 6381 6382 static int set_device_id(struct sock *sk, struct hci_dev *hdev, void *data, 6383 u16 len) 6384 { 6385 struct mgmt_cp_set_device_id *cp = data; 6386 int err; 6387 __u16 source; 6388 6389 bt_dev_dbg(hdev, "sock %p", sk); 6390 6391 source = __le16_to_cpu(cp->source); 6392 6393 if (source > 0x0002) 6394 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEVICE_ID, 6395 MGMT_STATUS_INVALID_PARAMS); 6396 6397 hci_dev_lock(hdev); 6398 6399 hdev->devid_source = source; 6400 hdev->devid_vendor = __le16_to_cpu(cp->vendor); 6401 hdev->devid_product = __le16_to_cpu(cp->product); 6402 hdev->devid_version = __le16_to_cpu(cp->version); 6403 6404 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_DEVICE_ID, 0, 6405 NULL, 0); 6406 6407 hci_cmd_sync_queue(hdev, set_device_id_sync, NULL, NULL); 6408 6409 hci_dev_unlock(hdev); 6410 6411 return err; 6412 } 6413 6414 static void enable_advertising_instance(struct hci_dev *hdev, int err) 6415 { 6416 if (err) 6417 bt_dev_err(hdev, "failed to re-configure advertising %d", err); 6418 else 6419 bt_dev_dbg(hdev, "status %d", err); 6420 } 6421 6422 static void set_advertising_complete(struct hci_dev *hdev, void *data, int err) 6423 { 6424 struct mgmt_pending_cmd *cmd = data; 6425 struct cmd_lookup match = { NULL, hdev }; 6426 u8 instance; 6427 struct adv_info *adv_instance; 6428 u8 status = mgmt_status(err); 6429 6430 if (err == -ECANCELED || !mgmt_pending_valid(hdev, data)) 6431 return; 6432 6433 if (status) { 6434 mgmt_cmd_status(cmd->sk, cmd->hdev->id, cmd->opcode, status); 6435 mgmt_pending_free(cmd); 6436 return; 6437 } 6438 6439 if (hci_dev_test_flag(hdev, HCI_LE_ADV)) 6440 hci_dev_set_flag(hdev, HCI_ADVERTISING); 6441 else 6442 hci_dev_clear_flag(hdev, HCI_ADVERTISING); 6443 6444 settings_rsp(cmd, &match); 6445 mgmt_pending_free(cmd); 6446 6447 new_settings(hdev, match.sk); 6448 6449 if (match.sk) 6450 sock_put(match.sk); 6451 6452 /* If "Set Advertising" was just disabled and instance advertising was 6453 * set up earlier, then re-enable multi-instance advertising. 6454 */ 6455 if (hci_dev_test_flag(hdev, HCI_ADVERTISING) || 6456 list_empty(&hdev->adv_instances)) 6457 return; 6458 6459 instance = hdev->cur_adv_instance; 6460 if (!instance) { 6461 adv_instance = list_first_entry_or_null(&hdev->adv_instances, 6462 struct adv_info, list); 6463 if (!adv_instance) 6464 return; 6465 6466 instance = adv_instance->instance; 6467 } 6468 6469 err = hci_schedule_adv_instance_sync(hdev, instance, true); 6470 6471 enable_advertising_instance(hdev, err); 6472 } 6473 6474 static int set_adv_sync(struct hci_dev *hdev, void *data) 6475 { 6476 struct mgmt_pending_cmd *cmd = data; 6477 struct mgmt_mode cp; 6478 u8 val; 6479 6480 mutex_lock(&hdev->mgmt_pending_lock); 6481 6482 if (!__mgmt_pending_listed(hdev, cmd)) { 6483 mutex_unlock(&hdev->mgmt_pending_lock); 6484 return -ECANCELED; 6485 } 6486 6487 memcpy(&cp, cmd->param, sizeof(cp)); 6488 6489 mutex_unlock(&hdev->mgmt_pending_lock); 6490 6491 val = !!cp.val; 6492 6493 if (cp.val == 0x02) 6494 hci_dev_set_flag(hdev, HCI_ADVERTISING_CONNECTABLE); 6495 else 6496 hci_dev_clear_flag(hdev, HCI_ADVERTISING_CONNECTABLE); 6497 6498 cancel_adv_timeout(hdev); 6499 6500 if (val) { 6501 /* Switch to instance "0" for the Set Advertising setting. 6502 * We cannot use update_[adv|scan_rsp]_data() here as the 6503 * HCI_ADVERTISING flag is not yet set. 6504 */ 6505 hdev->cur_adv_instance = 0x00; 6506 6507 if (ext_adv_capable(hdev)) { 6508 hci_start_ext_adv_sync(hdev, 0x00); 6509 } else { 6510 hci_update_adv_data_sync(hdev, 0x00); 6511 hci_update_scan_rsp_data_sync(hdev, 0x00); 6512 hci_enable_advertising_sync(hdev); 6513 } 6514 } else { 6515 hci_disable_advertising_sync(hdev); 6516 } 6517 6518 return 0; 6519 } 6520 6521 static int set_advertising(struct sock *sk, struct hci_dev *hdev, void *data, 6522 u16 len) 6523 { 6524 struct mgmt_mode *cp = data; 6525 struct mgmt_pending_cmd *cmd; 6526 u8 val, status; 6527 int err; 6528 6529 bt_dev_dbg(hdev, "sock %p", sk); 6530 6531 status = mgmt_le_support(hdev); 6532 if (status) 6533 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING, 6534 status); 6535 6536 if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02) 6537 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING, 6538 MGMT_STATUS_INVALID_PARAMS); 6539 6540 if (hdev->advertising_paused) 6541 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING, 6542 MGMT_STATUS_BUSY); 6543 6544 hci_dev_lock(hdev); 6545 6546 val = !!cp->val; 6547 6548 /* The following conditions are ones which mean that we should 6549 * not do any HCI communication but directly send a mgmt 6550 * response to user space (after toggling the flag if 6551 * necessary). 6552 */ 6553 if (!hdev_is_powered(hdev) || 6554 (val == hci_dev_test_flag(hdev, HCI_ADVERTISING) && 6555 (cp->val == 0x02) == hci_dev_test_flag(hdev, HCI_ADVERTISING_CONNECTABLE)) || 6556 hci_dev_test_flag(hdev, HCI_MESH) || 6557 hci_conn_num(hdev, LE_LINK) > 0 || 6558 (hci_dev_test_flag(hdev, HCI_LE_SCAN) && 6559 hdev->le_scan_type == LE_SCAN_ACTIVE)) { 6560 bool changed; 6561 6562 if (cp->val) { 6563 hdev->cur_adv_instance = 0x00; 6564 changed = !hci_dev_test_and_set_flag(hdev, HCI_ADVERTISING); 6565 if (cp->val == 0x02) 6566 hci_dev_set_flag(hdev, HCI_ADVERTISING_CONNECTABLE); 6567 else 6568 hci_dev_clear_flag(hdev, HCI_ADVERTISING_CONNECTABLE); 6569 } else { 6570 changed = hci_dev_test_and_clear_flag(hdev, HCI_ADVERTISING); 6571 hci_dev_clear_flag(hdev, HCI_ADVERTISING_CONNECTABLE); 6572 } 6573 6574 err = send_settings_rsp(sk, MGMT_OP_SET_ADVERTISING, hdev); 6575 if (err < 0) 6576 goto unlock; 6577 6578 if (changed) 6579 err = new_settings(hdev, sk); 6580 6581 goto unlock; 6582 } 6583 6584 if (pending_find(MGMT_OP_SET_ADVERTISING, hdev) || 6585 pending_find(MGMT_OP_SET_LE, hdev)) { 6586 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING, 6587 MGMT_STATUS_BUSY); 6588 goto unlock; 6589 } 6590 6591 cmd = mgmt_pending_add(sk, MGMT_OP_SET_ADVERTISING, hdev, data, len); 6592 if (!cmd) 6593 err = -ENOMEM; 6594 else 6595 err = hci_cmd_sync_queue(hdev, set_adv_sync, cmd, 6596 set_advertising_complete); 6597 6598 if (err < 0 && cmd) 6599 mgmt_pending_remove(cmd); 6600 6601 unlock: 6602 hci_dev_unlock(hdev); 6603 return err; 6604 } 6605 6606 static int set_static_address(struct sock *sk, struct hci_dev *hdev, 6607 void *data, u16 len) 6608 { 6609 struct mgmt_cp_set_static_address *cp = data; 6610 int err; 6611 6612 bt_dev_dbg(hdev, "sock %p", sk); 6613 6614 if (!lmp_le_capable(hdev)) 6615 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_STATIC_ADDRESS, 6616 MGMT_STATUS_NOT_SUPPORTED); 6617 6618 if (hdev_is_powered(hdev)) 6619 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_STATIC_ADDRESS, 6620 MGMT_STATUS_REJECTED); 6621 6622 if (bacmp(&cp->bdaddr, BDADDR_ANY)) { 6623 if (!bacmp(&cp->bdaddr, BDADDR_NONE)) 6624 return mgmt_cmd_status(sk, hdev->id, 6625 MGMT_OP_SET_STATIC_ADDRESS, 6626 MGMT_STATUS_INVALID_PARAMS); 6627 6628 /* Two most significant bits shall be set */ 6629 if ((cp->bdaddr.b[5] & 0xc0) != 0xc0) 6630 return mgmt_cmd_status(sk, hdev->id, 6631 MGMT_OP_SET_STATIC_ADDRESS, 6632 MGMT_STATUS_INVALID_PARAMS); 6633 } 6634 6635 hci_dev_lock(hdev); 6636 6637 bacpy(&hdev->static_addr, &cp->bdaddr); 6638 6639 err = send_settings_rsp(sk, MGMT_OP_SET_STATIC_ADDRESS, hdev); 6640 if (err < 0) 6641 goto unlock; 6642 6643 err = new_settings(hdev, sk); 6644 6645 unlock: 6646 hci_dev_unlock(hdev); 6647 return err; 6648 } 6649 6650 static int set_scan_params(struct sock *sk, struct hci_dev *hdev, 6651 void *data, u16 len) 6652 { 6653 struct mgmt_cp_set_scan_params *cp = data; 6654 __u16 interval, window; 6655 int err; 6656 6657 bt_dev_dbg(hdev, "sock %p", sk); 6658 6659 if (!lmp_le_capable(hdev)) 6660 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS, 6661 MGMT_STATUS_NOT_SUPPORTED); 6662 6663 /* Keep allowed ranges in sync with set_mesh() */ 6664 interval = __le16_to_cpu(cp->interval); 6665 6666 if (interval < 0x0004 || interval > 0x4000) 6667 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS, 6668 MGMT_STATUS_INVALID_PARAMS); 6669 6670 window = __le16_to_cpu(cp->window); 6671 6672 if (window < 0x0004 || window > 0x4000) 6673 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS, 6674 MGMT_STATUS_INVALID_PARAMS); 6675 6676 if (window > interval) 6677 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS, 6678 MGMT_STATUS_INVALID_PARAMS); 6679 6680 hci_dev_lock(hdev); 6681 6682 hdev->le_scan_interval = interval; 6683 hdev->le_scan_window = window; 6684 6685 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS, 0, 6686 NULL, 0); 6687 6688 /* If background scan is running, restart it so new parameters are 6689 * loaded. 6690 */ 6691 if (hci_dev_test_flag(hdev, HCI_LE_SCAN) && 6692 hdev->discovery.state == DISCOVERY_STOPPED) 6693 hci_update_passive_scan(hdev); 6694 6695 hci_dev_unlock(hdev); 6696 6697 return err; 6698 } 6699 6700 static void fast_connectable_complete(struct hci_dev *hdev, void *data, int err) 6701 { 6702 struct mgmt_pending_cmd *cmd = data; 6703 6704 bt_dev_dbg(hdev, "err %d", err); 6705 6706 if (err) { 6707 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE, 6708 mgmt_status(err)); 6709 } else { 6710 struct mgmt_mode *cp = cmd->param; 6711 6712 if (cp->val) 6713 hci_dev_set_flag(hdev, HCI_FAST_CONNECTABLE); 6714 else 6715 hci_dev_clear_flag(hdev, HCI_FAST_CONNECTABLE); 6716 6717 send_settings_rsp(cmd->sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev); 6718 new_settings(hdev, cmd->sk); 6719 } 6720 6721 mgmt_pending_free(cmd); 6722 } 6723 6724 static int write_fast_connectable_sync(struct hci_dev *hdev, void *data) 6725 { 6726 struct mgmt_pending_cmd *cmd = data; 6727 struct mgmt_mode *cp = cmd->param; 6728 6729 return hci_write_fast_connectable_sync(hdev, cp->val); 6730 } 6731 6732 static int set_fast_connectable(struct sock *sk, struct hci_dev *hdev, 6733 void *data, u16 len) 6734 { 6735 struct mgmt_mode *cp = data; 6736 struct mgmt_pending_cmd *cmd; 6737 int err; 6738 6739 bt_dev_dbg(hdev, "sock %p", sk); 6740 6741 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) || 6742 hdev->hci_ver < BLUETOOTH_VER_1_2) 6743 return mgmt_cmd_status(sk, hdev->id, 6744 MGMT_OP_SET_FAST_CONNECTABLE, 6745 MGMT_STATUS_NOT_SUPPORTED); 6746 6747 if (cp->val != 0x00 && cp->val != 0x01) 6748 return mgmt_cmd_status(sk, hdev->id, 6749 MGMT_OP_SET_FAST_CONNECTABLE, 6750 MGMT_STATUS_INVALID_PARAMS); 6751 6752 hci_dev_lock(hdev); 6753 6754 if (!!cp->val == hci_dev_test_flag(hdev, HCI_FAST_CONNECTABLE)) { 6755 err = send_settings_rsp(sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev); 6756 goto unlock; 6757 } 6758 6759 if (!hdev_is_powered(hdev)) { 6760 hci_dev_change_flag(hdev, HCI_FAST_CONNECTABLE); 6761 err = send_settings_rsp(sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev); 6762 new_settings(hdev, sk); 6763 goto unlock; 6764 } 6765 6766 cmd = mgmt_pending_new(sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev, data, 6767 len); 6768 if (!cmd) 6769 err = -ENOMEM; 6770 else 6771 err = hci_cmd_sync_queue(hdev, write_fast_connectable_sync, cmd, 6772 fast_connectable_complete); 6773 6774 if (err < 0) { 6775 mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE, 6776 MGMT_STATUS_FAILED); 6777 6778 if (cmd) 6779 mgmt_pending_free(cmd); 6780 } 6781 6782 unlock: 6783 hci_dev_unlock(hdev); 6784 6785 return err; 6786 } 6787 6788 static void set_bredr_complete(struct hci_dev *hdev, void *data, int err) 6789 { 6790 struct mgmt_pending_cmd *cmd = data; 6791 6792 bt_dev_dbg(hdev, "err %d", err); 6793 6794 if (err) { 6795 u8 mgmt_err = mgmt_status(err); 6796 6797 /* We need to restore the flag if related HCI commands 6798 * failed. 6799 */ 6800 hci_dev_clear_flag(hdev, HCI_BREDR_ENABLED); 6801 6802 mgmt_cmd_status(cmd->sk, cmd->hdev->id, cmd->opcode, mgmt_err); 6803 } else { 6804 send_settings_rsp(cmd->sk, MGMT_OP_SET_BREDR, hdev); 6805 new_settings(hdev, cmd->sk); 6806 } 6807 6808 mgmt_pending_free(cmd); 6809 } 6810 6811 static int set_bredr_sync(struct hci_dev *hdev, void *data) 6812 { 6813 int status; 6814 6815 status = hci_write_fast_connectable_sync(hdev, false); 6816 6817 if (!status) 6818 status = hci_update_scan_sync(hdev); 6819 6820 /* Since only the advertising data flags will change, there 6821 * is no need to update the scan response data. 6822 */ 6823 if (!status) 6824 status = hci_update_adv_data_sync(hdev, hdev->cur_adv_instance); 6825 6826 return status; 6827 } 6828 6829 static int set_bredr(struct sock *sk, struct hci_dev *hdev, void *data, u16 len) 6830 { 6831 struct mgmt_mode *cp = data; 6832 struct mgmt_pending_cmd *cmd; 6833 int err; 6834 6835 bt_dev_dbg(hdev, "sock %p", sk); 6836 6837 if (!lmp_bredr_capable(hdev) || !lmp_le_capable(hdev)) 6838 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR, 6839 MGMT_STATUS_NOT_SUPPORTED); 6840 6841 if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED)) 6842 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR, 6843 MGMT_STATUS_REJECTED); 6844 6845 if (cp->val != 0x00 && cp->val != 0x01) 6846 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR, 6847 MGMT_STATUS_INVALID_PARAMS); 6848 6849 hci_dev_lock(hdev); 6850 6851 if (cp->val == hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) { 6852 err = send_settings_rsp(sk, MGMT_OP_SET_BREDR, hdev); 6853 goto unlock; 6854 } 6855 6856 if (!hdev_is_powered(hdev)) { 6857 if (!cp->val) { 6858 hci_dev_clear_flag(hdev, HCI_DISCOVERABLE); 6859 hci_dev_clear_flag(hdev, HCI_SSP_ENABLED); 6860 hci_dev_clear_flag(hdev, HCI_LINK_SECURITY); 6861 hci_dev_clear_flag(hdev, HCI_FAST_CONNECTABLE); 6862 } 6863 6864 hci_dev_change_flag(hdev, HCI_BREDR_ENABLED); 6865 6866 err = send_settings_rsp(sk, MGMT_OP_SET_BREDR, hdev); 6867 if (err < 0) 6868 goto unlock; 6869 6870 err = new_settings(hdev, sk); 6871 goto unlock; 6872 } 6873 6874 /* Reject disabling when powered on */ 6875 if (!cp->val) { 6876 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR, 6877 MGMT_STATUS_REJECTED); 6878 goto unlock; 6879 } else { 6880 /* When configuring a dual-mode controller to operate 6881 * with LE only and using a static address, then switching 6882 * BR/EDR back on is not allowed. 6883 * 6884 * Dual-mode controllers shall operate with the public 6885 * address as its identity address for BR/EDR and LE. So 6886 * reject the attempt to create an invalid configuration. 6887 * 6888 * The same restrictions applies when secure connections 6889 * has been enabled. For BR/EDR this is a controller feature 6890 * while for LE it is a host stack feature. This means that 6891 * switching BR/EDR back on when secure connections has been 6892 * enabled is not a supported transaction. 6893 */ 6894 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) && 6895 (bacmp(&hdev->static_addr, BDADDR_ANY) || 6896 hci_dev_test_flag(hdev, HCI_SC_ENABLED))) { 6897 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR, 6898 MGMT_STATUS_REJECTED); 6899 goto unlock; 6900 } 6901 } 6902 6903 cmd = mgmt_pending_new(sk, MGMT_OP_SET_BREDR, hdev, data, len); 6904 if (!cmd) 6905 err = -ENOMEM; 6906 else 6907 err = hci_cmd_sync_queue(hdev, set_bredr_sync, cmd, 6908 set_bredr_complete); 6909 6910 if (err < 0) { 6911 mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR, 6912 MGMT_STATUS_FAILED); 6913 if (cmd) 6914 mgmt_pending_free(cmd); 6915 6916 goto unlock; 6917 } 6918 6919 /* We need to flip the bit already here so that 6920 * hci_req_update_adv_data generates the correct flags. 6921 */ 6922 hci_dev_set_flag(hdev, HCI_BREDR_ENABLED); 6923 6924 unlock: 6925 hci_dev_unlock(hdev); 6926 return err; 6927 } 6928 6929 static void set_secure_conn_complete(struct hci_dev *hdev, void *data, int err) 6930 { 6931 struct mgmt_pending_cmd *cmd = data; 6932 struct mgmt_mode *cp; 6933 6934 bt_dev_dbg(hdev, "err %d", err); 6935 6936 if (err) { 6937 u8 mgmt_err = mgmt_status(err); 6938 6939 mgmt_cmd_status(cmd->sk, cmd->hdev->id, cmd->opcode, mgmt_err); 6940 goto done; 6941 } 6942 6943 cp = cmd->param; 6944 6945 switch (cp->val) { 6946 case 0x00: 6947 hci_dev_clear_flag(hdev, HCI_SC_ENABLED); 6948 hci_dev_clear_flag(hdev, HCI_SC_ONLY); 6949 break; 6950 case 0x01: 6951 hci_dev_set_flag(hdev, HCI_SC_ENABLED); 6952 hci_dev_clear_flag(hdev, HCI_SC_ONLY); 6953 break; 6954 case 0x02: 6955 hci_dev_set_flag(hdev, HCI_SC_ENABLED); 6956 hci_dev_set_flag(hdev, HCI_SC_ONLY); 6957 break; 6958 } 6959 6960 send_settings_rsp(cmd->sk, cmd->opcode, hdev); 6961 new_settings(hdev, cmd->sk); 6962 6963 done: 6964 mgmt_pending_free(cmd); 6965 } 6966 6967 static int set_secure_conn_sync(struct hci_dev *hdev, void *data) 6968 { 6969 struct mgmt_pending_cmd *cmd = data; 6970 struct mgmt_mode *cp = cmd->param; 6971 u8 val = !!cp->val; 6972 6973 /* Force write of val */ 6974 hci_dev_set_flag(hdev, HCI_SC_ENABLED); 6975 6976 return hci_write_sc_support_sync(hdev, val); 6977 } 6978 6979 static int set_secure_conn(struct sock *sk, struct hci_dev *hdev, 6980 void *data, u16 len) 6981 { 6982 struct mgmt_mode *cp = data; 6983 struct mgmt_pending_cmd *cmd; 6984 u8 val; 6985 int err; 6986 6987 bt_dev_dbg(hdev, "sock %p", sk); 6988 6989 if (!lmp_sc_capable(hdev) && 6990 !hci_dev_test_flag(hdev, HCI_LE_ENABLED)) 6991 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN, 6992 MGMT_STATUS_NOT_SUPPORTED); 6993 6994 if (hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) && 6995 lmp_sc_capable(hdev) && 6996 !hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) 6997 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN, 6998 MGMT_STATUS_REJECTED); 6999 7000 if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02) 7001 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN, 7002 MGMT_STATUS_INVALID_PARAMS); 7003 7004 hci_dev_lock(hdev); 7005 7006 if (!hdev_is_powered(hdev) || !lmp_sc_capable(hdev) || 7007 !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) { 7008 bool changed; 7009 7010 if (cp->val) { 7011 changed = !hci_dev_test_and_set_flag(hdev, 7012 HCI_SC_ENABLED); 7013 if (cp->val == 0x02) 7014 hci_dev_set_flag(hdev, HCI_SC_ONLY); 7015 else 7016 hci_dev_clear_flag(hdev, HCI_SC_ONLY); 7017 } else { 7018 changed = hci_dev_test_and_clear_flag(hdev, 7019 HCI_SC_ENABLED); 7020 hci_dev_clear_flag(hdev, HCI_SC_ONLY); 7021 } 7022 7023 err = send_settings_rsp(sk, MGMT_OP_SET_SECURE_CONN, hdev); 7024 if (err < 0) 7025 goto failed; 7026 7027 if (changed) 7028 err = new_settings(hdev, sk); 7029 7030 goto failed; 7031 } 7032 7033 val = !!cp->val; 7034 7035 if (val == hci_dev_test_flag(hdev, HCI_SC_ENABLED) && 7036 (cp->val == 0x02) == hci_dev_test_flag(hdev, HCI_SC_ONLY)) { 7037 err = send_settings_rsp(sk, MGMT_OP_SET_SECURE_CONN, hdev); 7038 goto failed; 7039 } 7040 7041 cmd = mgmt_pending_new(sk, MGMT_OP_SET_SECURE_CONN, hdev, data, len); 7042 if (!cmd) 7043 err = -ENOMEM; 7044 else 7045 err = hci_cmd_sync_queue(hdev, set_secure_conn_sync, cmd, 7046 set_secure_conn_complete); 7047 7048 if (err < 0) { 7049 mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN, 7050 MGMT_STATUS_FAILED); 7051 if (cmd) 7052 mgmt_pending_free(cmd); 7053 } 7054 7055 failed: 7056 hci_dev_unlock(hdev); 7057 return err; 7058 } 7059 7060 static int set_debug_keys(struct sock *sk, struct hci_dev *hdev, 7061 void *data, u16 len) 7062 { 7063 struct mgmt_mode *cp = data; 7064 bool changed, use_changed; 7065 int err; 7066 7067 bt_dev_dbg(hdev, "sock %p", sk); 7068 7069 if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02) 7070 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEBUG_KEYS, 7071 MGMT_STATUS_INVALID_PARAMS); 7072 7073 hci_dev_lock(hdev); 7074 7075 if (cp->val) 7076 changed = !hci_dev_test_and_set_flag(hdev, HCI_KEEP_DEBUG_KEYS); 7077 else 7078 changed = hci_dev_test_and_clear_flag(hdev, 7079 HCI_KEEP_DEBUG_KEYS); 7080 7081 if (cp->val == 0x02) 7082 use_changed = !hci_dev_test_and_set_flag(hdev, 7083 HCI_USE_DEBUG_KEYS); 7084 else 7085 use_changed = hci_dev_test_and_clear_flag(hdev, 7086 HCI_USE_DEBUG_KEYS); 7087 7088 if (hdev_is_powered(hdev) && use_changed && 7089 hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) { 7090 u8 mode = (cp->val == 0x02) ? 0x01 : 0x00; 7091 hci_send_cmd(hdev, HCI_OP_WRITE_SSP_DEBUG_MODE, 7092 sizeof(mode), &mode); 7093 } 7094 7095 err = send_settings_rsp(sk, MGMT_OP_SET_DEBUG_KEYS, hdev); 7096 if (err < 0) 7097 goto unlock; 7098 7099 if (changed) 7100 err = new_settings(hdev, sk); 7101 7102 unlock: 7103 hci_dev_unlock(hdev); 7104 return err; 7105 } 7106 7107 static int set_privacy(struct sock *sk, struct hci_dev *hdev, void *cp_data, 7108 u16 len) 7109 { 7110 struct mgmt_cp_set_privacy *cp = cp_data; 7111 bool changed; 7112 int err; 7113 7114 bt_dev_dbg(hdev, "sock %p", sk); 7115 7116 if (!lmp_le_capable(hdev)) 7117 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY, 7118 MGMT_STATUS_NOT_SUPPORTED); 7119 7120 if (cp->privacy != 0x00 && cp->privacy != 0x01 && cp->privacy != 0x02) 7121 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY, 7122 MGMT_STATUS_INVALID_PARAMS); 7123 7124 if (hdev_is_powered(hdev)) 7125 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY, 7126 MGMT_STATUS_REJECTED); 7127 7128 hci_dev_lock(hdev); 7129 7130 /* If user space supports this command it is also expected to 7131 * handle IRKs. Therefore, set the HCI_RPA_RESOLVING flag. 7132 */ 7133 hci_dev_set_flag(hdev, HCI_RPA_RESOLVING); 7134 7135 if (cp->privacy) { 7136 changed = !hci_dev_test_and_set_flag(hdev, HCI_PRIVACY); 7137 memcpy(hdev->irk, cp->irk, sizeof(hdev->irk)); 7138 hci_dev_set_flag(hdev, HCI_RPA_EXPIRED); 7139 hci_adv_instances_set_rpa_expired(hdev, true); 7140 if (cp->privacy == 0x02) 7141 hci_dev_set_flag(hdev, HCI_LIMITED_PRIVACY); 7142 else 7143 hci_dev_clear_flag(hdev, HCI_LIMITED_PRIVACY); 7144 } else { 7145 changed = hci_dev_test_and_clear_flag(hdev, HCI_PRIVACY); 7146 memset(hdev->irk, 0, sizeof(hdev->irk)); 7147 hci_dev_clear_flag(hdev, HCI_RPA_EXPIRED); 7148 hci_adv_instances_set_rpa_expired(hdev, false); 7149 hci_dev_clear_flag(hdev, HCI_LIMITED_PRIVACY); 7150 } 7151 7152 err = send_settings_rsp(sk, MGMT_OP_SET_PRIVACY, hdev); 7153 if (err < 0) 7154 goto unlock; 7155 7156 if (changed) 7157 err = new_settings(hdev, sk); 7158 7159 unlock: 7160 hci_dev_unlock(hdev); 7161 return err; 7162 } 7163 7164 static bool irk_is_valid(struct mgmt_irk_info *irk) 7165 { 7166 switch (irk->addr.type) { 7167 case BDADDR_LE_PUBLIC: 7168 return true; 7169 7170 case BDADDR_LE_RANDOM: 7171 /* Two most significant bits shall be set */ 7172 if ((irk->addr.bdaddr.b[5] & 0xc0) != 0xc0) 7173 return false; 7174 return true; 7175 } 7176 7177 return false; 7178 } 7179 7180 static int load_irks(struct sock *sk, struct hci_dev *hdev, void *cp_data, 7181 u16 len) 7182 { 7183 struct mgmt_cp_load_irks *cp = cp_data; 7184 const u16 max_irk_count = ((U16_MAX - sizeof(*cp)) / 7185 sizeof(struct mgmt_irk_info)); 7186 u16 irk_count, expected_len; 7187 int i, err; 7188 7189 bt_dev_dbg(hdev, "sock %p", sk); 7190 7191 if (!lmp_le_capable(hdev)) 7192 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS, 7193 MGMT_STATUS_NOT_SUPPORTED); 7194 7195 irk_count = __le16_to_cpu(cp->irk_count); 7196 if (irk_count > max_irk_count) { 7197 bt_dev_err(hdev, "load_irks: too big irk_count value %u", 7198 irk_count); 7199 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS, 7200 MGMT_STATUS_INVALID_PARAMS); 7201 } 7202 7203 expected_len = struct_size(cp, irks, irk_count); 7204 if (expected_len != len) { 7205 bt_dev_err(hdev, "load_irks: expected %u bytes, got %u bytes", 7206 expected_len, len); 7207 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS, 7208 MGMT_STATUS_INVALID_PARAMS); 7209 } 7210 7211 bt_dev_dbg(hdev, "irk_count %u", irk_count); 7212 7213 for (i = 0; i < irk_count; i++) { 7214 struct mgmt_irk_info *key = &cp->irks[i]; 7215 7216 if (!irk_is_valid(key)) 7217 return mgmt_cmd_status(sk, hdev->id, 7218 MGMT_OP_LOAD_IRKS, 7219 MGMT_STATUS_INVALID_PARAMS); 7220 } 7221 7222 hci_dev_lock(hdev); 7223 7224 hci_smp_irks_clear(hdev); 7225 7226 for (i = 0; i < irk_count; i++) { 7227 struct mgmt_irk_info *irk = &cp->irks[i]; 7228 7229 if (hci_is_blocked_key(hdev, 7230 HCI_BLOCKED_KEY_TYPE_IRK, 7231 irk->val)) { 7232 bt_dev_warn(hdev, "Skipping blocked IRK for %pMR", 7233 &irk->addr.bdaddr); 7234 continue; 7235 } 7236 7237 hci_add_irk(hdev, &irk->addr.bdaddr, 7238 le_addr_type(irk->addr.type), irk->val, 7239 BDADDR_ANY); 7240 } 7241 7242 hci_dev_set_flag(hdev, HCI_RPA_RESOLVING); 7243 7244 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_IRKS, 0, NULL, 0); 7245 7246 hci_dev_unlock(hdev); 7247 7248 return err; 7249 } 7250 7251 static bool ltk_is_valid(struct mgmt_ltk_info *key) 7252 { 7253 if (key->initiator != 0x00 && key->initiator != 0x01) 7254 return false; 7255 7256 if (key->enc_size > sizeof(key->val)) 7257 return false; 7258 7259 switch (key->addr.type) { 7260 case BDADDR_LE_PUBLIC: 7261 return true; 7262 7263 case BDADDR_LE_RANDOM: 7264 /* Two most significant bits shall be set */ 7265 if ((key->addr.bdaddr.b[5] & 0xc0) != 0xc0) 7266 return false; 7267 return true; 7268 } 7269 7270 return false; 7271 } 7272 7273 static int load_long_term_keys(struct sock *sk, struct hci_dev *hdev, 7274 void *cp_data, u16 len) 7275 { 7276 struct mgmt_cp_load_long_term_keys *cp = cp_data; 7277 const u16 max_key_count = ((U16_MAX - sizeof(*cp)) / 7278 sizeof(struct mgmt_ltk_info)); 7279 u16 key_count, expected_len; 7280 int i, err; 7281 7282 bt_dev_dbg(hdev, "sock %p", sk); 7283 7284 if (!lmp_le_capable(hdev)) 7285 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS, 7286 MGMT_STATUS_NOT_SUPPORTED); 7287 7288 key_count = __le16_to_cpu(cp->key_count); 7289 if (key_count > max_key_count) { 7290 bt_dev_err(hdev, "load_ltks: too big key_count value %u", 7291 key_count); 7292 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS, 7293 MGMT_STATUS_INVALID_PARAMS); 7294 } 7295 7296 expected_len = struct_size(cp, keys, key_count); 7297 if (expected_len != len) { 7298 bt_dev_err(hdev, "load_keys: expected %u bytes, got %u bytes", 7299 expected_len, len); 7300 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS, 7301 MGMT_STATUS_INVALID_PARAMS); 7302 } 7303 7304 bt_dev_dbg(hdev, "key_count %u", key_count); 7305 7306 hci_dev_lock(hdev); 7307 7308 hci_smp_ltks_clear(hdev); 7309 7310 for (i = 0; i < key_count; i++) { 7311 struct mgmt_ltk_info *key = &cp->keys[i]; 7312 u8 type, authenticated; 7313 7314 if (hci_is_blocked_key(hdev, 7315 HCI_BLOCKED_KEY_TYPE_LTK, 7316 key->val)) { 7317 bt_dev_warn(hdev, "Skipping blocked LTK for %pMR", 7318 &key->addr.bdaddr); 7319 continue; 7320 } 7321 7322 if (!ltk_is_valid(key)) { 7323 bt_dev_warn(hdev, "Invalid LTK for %pMR", 7324 &key->addr.bdaddr); 7325 continue; 7326 } 7327 7328 switch (key->type) { 7329 case MGMT_LTK_UNAUTHENTICATED: 7330 authenticated = 0x00; 7331 type = key->initiator ? SMP_LTK : SMP_LTK_RESPONDER; 7332 break; 7333 case MGMT_LTK_AUTHENTICATED: 7334 authenticated = 0x01; 7335 type = key->initiator ? SMP_LTK : SMP_LTK_RESPONDER; 7336 break; 7337 case MGMT_LTK_P256_UNAUTH: 7338 authenticated = 0x00; 7339 type = SMP_LTK_P256; 7340 break; 7341 case MGMT_LTK_P256_AUTH: 7342 authenticated = 0x01; 7343 type = SMP_LTK_P256; 7344 break; 7345 case MGMT_LTK_P256_DEBUG: 7346 authenticated = 0x00; 7347 type = SMP_LTK_P256_DEBUG; 7348 fallthrough; 7349 default: 7350 continue; 7351 } 7352 7353 hci_add_ltk(hdev, &key->addr.bdaddr, 7354 le_addr_type(key->addr.type), type, authenticated, 7355 key->val, key->enc_size, key->ediv, key->rand); 7356 } 7357 7358 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS, 0, 7359 NULL, 0); 7360 7361 hci_dev_unlock(hdev); 7362 7363 return err; 7364 } 7365 7366 static void get_conn_info_complete(struct hci_dev *hdev, void *data, int err) 7367 { 7368 struct mgmt_pending_cmd *cmd = data; 7369 struct hci_conn *conn = cmd->user_data; 7370 struct mgmt_cp_get_conn_info *cp = cmd->param; 7371 struct mgmt_rp_get_conn_info rp; 7372 u8 status; 7373 7374 bt_dev_dbg(hdev, "err %d", err); 7375 7376 memcpy(&rp.addr, &cp->addr, sizeof(rp.addr)); 7377 7378 status = mgmt_status(err); 7379 if (status == MGMT_STATUS_SUCCESS) { 7380 rp.rssi = conn->rssi; 7381 rp.tx_power = conn->tx_power; 7382 rp.max_tx_power = conn->max_tx_power; 7383 } else { 7384 rp.rssi = HCI_RSSI_INVALID; 7385 rp.tx_power = HCI_TX_POWER_INVALID; 7386 rp.max_tx_power = HCI_TX_POWER_INVALID; 7387 } 7388 7389 mgmt_cmd_complete(cmd->sk, cmd->hdev->id, MGMT_OP_GET_CONN_INFO, status, 7390 &rp, sizeof(rp)); 7391 7392 mgmt_pending_free(cmd); 7393 } 7394 7395 static int get_conn_info_sync(struct hci_dev *hdev, void *data) 7396 { 7397 struct mgmt_pending_cmd *cmd = data; 7398 struct mgmt_cp_get_conn_info *cp = cmd->param; 7399 struct hci_conn *conn; 7400 int err; 7401 __le16 handle; 7402 7403 /* Make sure we are still connected */ 7404 if (cp->addr.type == BDADDR_BREDR) 7405 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, 7406 &cp->addr.bdaddr); 7407 else 7408 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &cp->addr.bdaddr); 7409 7410 if (!conn || conn->state != BT_CONNECTED) 7411 return MGMT_STATUS_NOT_CONNECTED; 7412 7413 cmd->user_data = conn; 7414 handle = cpu_to_le16(conn->handle); 7415 7416 /* Refresh RSSI each time */ 7417 err = hci_read_rssi_sync(hdev, handle); 7418 7419 /* For LE links TX power does not change thus we don't need to 7420 * query for it once value is known. 7421 */ 7422 if (!err && (!bdaddr_type_is_le(cp->addr.type) || 7423 conn->tx_power == HCI_TX_POWER_INVALID)) 7424 err = hci_read_tx_power_sync(hdev, handle, 0x00); 7425 7426 /* Max TX power needs to be read only once per connection */ 7427 if (!err && conn->max_tx_power == HCI_TX_POWER_INVALID) 7428 err = hci_read_tx_power_sync(hdev, handle, 0x01); 7429 7430 return err; 7431 } 7432 7433 static int get_conn_info(struct sock *sk, struct hci_dev *hdev, void *data, 7434 u16 len) 7435 { 7436 struct mgmt_cp_get_conn_info *cp = data; 7437 struct mgmt_rp_get_conn_info rp; 7438 struct hci_conn *conn; 7439 unsigned long conn_info_age; 7440 int err = 0; 7441 7442 bt_dev_dbg(hdev, "sock %p", sk); 7443 7444 memset(&rp, 0, sizeof(rp)); 7445 bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr); 7446 rp.addr.type = cp->addr.type; 7447 7448 if (!bdaddr_type_is_valid(cp->addr.type)) 7449 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO, 7450 MGMT_STATUS_INVALID_PARAMS, 7451 &rp, sizeof(rp)); 7452 7453 hci_dev_lock(hdev); 7454 7455 if (!hdev_is_powered(hdev)) { 7456 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO, 7457 MGMT_STATUS_NOT_POWERED, &rp, 7458 sizeof(rp)); 7459 goto unlock; 7460 } 7461 7462 if (cp->addr.type == BDADDR_BREDR) 7463 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, 7464 &cp->addr.bdaddr); 7465 else 7466 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &cp->addr.bdaddr); 7467 7468 if (!conn || conn->state != BT_CONNECTED) { 7469 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO, 7470 MGMT_STATUS_NOT_CONNECTED, &rp, 7471 sizeof(rp)); 7472 goto unlock; 7473 } 7474 7475 /* To avoid client trying to guess when to poll again for information we 7476 * calculate conn info age as random value between min/max set in hdev. 7477 */ 7478 conn_info_age = get_random_u32_inclusive(hdev->conn_info_min_age, 7479 hdev->conn_info_max_age - 1); 7480 7481 /* Query controller to refresh cached values if they are too old or were 7482 * never read. 7483 */ 7484 if (time_after(jiffies, conn->conn_info_timestamp + 7485 msecs_to_jiffies(conn_info_age)) || 7486 !conn->conn_info_timestamp) { 7487 struct mgmt_pending_cmd *cmd; 7488 7489 cmd = mgmt_pending_new(sk, MGMT_OP_GET_CONN_INFO, hdev, data, 7490 len); 7491 if (!cmd) { 7492 err = -ENOMEM; 7493 } else { 7494 err = hci_cmd_sync_queue(hdev, get_conn_info_sync, 7495 cmd, get_conn_info_complete); 7496 } 7497 7498 if (err < 0) { 7499 mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO, 7500 MGMT_STATUS_FAILED, &rp, sizeof(rp)); 7501 7502 if (cmd) 7503 mgmt_pending_free(cmd); 7504 7505 goto unlock; 7506 } 7507 7508 conn->conn_info_timestamp = jiffies; 7509 } else { 7510 /* Cache is valid, just reply with values cached in hci_conn */ 7511 rp.rssi = conn->rssi; 7512 rp.tx_power = conn->tx_power; 7513 rp.max_tx_power = conn->max_tx_power; 7514 7515 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO, 7516 MGMT_STATUS_SUCCESS, &rp, sizeof(rp)); 7517 } 7518 7519 unlock: 7520 hci_dev_unlock(hdev); 7521 return err; 7522 } 7523 7524 static void get_clock_info_complete(struct hci_dev *hdev, void *data, int err) 7525 { 7526 struct mgmt_pending_cmd *cmd = data; 7527 struct mgmt_cp_get_clock_info *cp = cmd->param; 7528 struct mgmt_rp_get_clock_info rp; 7529 struct hci_conn *conn = cmd->user_data; 7530 u8 status = mgmt_status(err); 7531 7532 bt_dev_dbg(hdev, "err %d", err); 7533 7534 memset(&rp, 0, sizeof(rp)); 7535 bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr); 7536 rp.addr.type = cp->addr.type; 7537 7538 if (err) 7539 goto complete; 7540 7541 rp.local_clock = cpu_to_le32(hdev->clock); 7542 7543 if (conn) { 7544 rp.piconet_clock = cpu_to_le32(conn->clock); 7545 rp.accuracy = cpu_to_le16(conn->clock_accuracy); 7546 } 7547 7548 complete: 7549 mgmt_cmd_complete(cmd->sk, cmd->hdev->id, cmd->opcode, status, &rp, 7550 sizeof(rp)); 7551 7552 mgmt_pending_free(cmd); 7553 } 7554 7555 static int get_clock_info_sync(struct hci_dev *hdev, void *data) 7556 { 7557 struct mgmt_pending_cmd *cmd = data; 7558 struct mgmt_cp_get_clock_info *cp = cmd->param; 7559 struct hci_cp_read_clock hci_cp; 7560 struct hci_conn *conn; 7561 7562 memset(&hci_cp, 0, sizeof(hci_cp)); 7563 hci_read_clock_sync(hdev, &hci_cp); 7564 7565 /* Make sure connection still exists */ 7566 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->addr.bdaddr); 7567 if (!conn || conn->state != BT_CONNECTED) 7568 return MGMT_STATUS_NOT_CONNECTED; 7569 7570 cmd->user_data = conn; 7571 hci_cp.handle = cpu_to_le16(conn->handle); 7572 hci_cp.which = 0x01; /* Piconet clock */ 7573 7574 return hci_read_clock_sync(hdev, &hci_cp); 7575 } 7576 7577 static int get_clock_info(struct sock *sk, struct hci_dev *hdev, void *data, 7578 u16 len) 7579 { 7580 struct mgmt_cp_get_clock_info *cp = data; 7581 struct mgmt_rp_get_clock_info rp; 7582 struct mgmt_pending_cmd *cmd; 7583 struct hci_conn *conn; 7584 int err; 7585 7586 bt_dev_dbg(hdev, "sock %p", sk); 7587 7588 memset(&rp, 0, sizeof(rp)); 7589 bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr); 7590 rp.addr.type = cp->addr.type; 7591 7592 if (cp->addr.type != BDADDR_BREDR) 7593 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CLOCK_INFO, 7594 MGMT_STATUS_INVALID_PARAMS, 7595 &rp, sizeof(rp)); 7596 7597 hci_dev_lock(hdev); 7598 7599 if (!hdev_is_powered(hdev)) { 7600 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CLOCK_INFO, 7601 MGMT_STATUS_NOT_POWERED, &rp, 7602 sizeof(rp)); 7603 goto unlock; 7604 } 7605 7606 if (bacmp(&cp->addr.bdaddr, BDADDR_ANY)) { 7607 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, 7608 &cp->addr.bdaddr); 7609 if (!conn || conn->state != BT_CONNECTED) { 7610 err = mgmt_cmd_complete(sk, hdev->id, 7611 MGMT_OP_GET_CLOCK_INFO, 7612 MGMT_STATUS_NOT_CONNECTED, 7613 &rp, sizeof(rp)); 7614 goto unlock; 7615 } 7616 } else { 7617 conn = NULL; 7618 } 7619 7620 cmd = mgmt_pending_new(sk, MGMT_OP_GET_CLOCK_INFO, hdev, data, len); 7621 if (!cmd) 7622 err = -ENOMEM; 7623 else 7624 err = hci_cmd_sync_queue(hdev, get_clock_info_sync, cmd, 7625 get_clock_info_complete); 7626 7627 if (err < 0) { 7628 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CLOCK_INFO, 7629 MGMT_STATUS_FAILED, &rp, sizeof(rp)); 7630 7631 if (cmd) 7632 mgmt_pending_free(cmd); 7633 } 7634 7635 7636 unlock: 7637 hci_dev_unlock(hdev); 7638 return err; 7639 } 7640 7641 static void device_added(struct sock *sk, struct hci_dev *hdev, 7642 bdaddr_t *bdaddr, u8 type, u8 action) 7643 { 7644 struct mgmt_ev_device_added ev; 7645 7646 bacpy(&ev.addr.bdaddr, bdaddr); 7647 ev.addr.type = type; 7648 ev.action = action; 7649 7650 mgmt_event(MGMT_EV_DEVICE_ADDED, hdev, &ev, sizeof(ev), sk); 7651 } 7652 7653 static void add_device_complete(struct hci_dev *hdev, void *data, int err) 7654 { 7655 struct mgmt_pending_cmd *cmd = data; 7656 struct mgmt_cp_add_device *cp = cmd->param; 7657 7658 if (!err) { 7659 struct hci_conn_params *params; 7660 7661 params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr, 7662 le_addr_type(cp->addr.type)); 7663 7664 device_added(cmd->sk, hdev, &cp->addr.bdaddr, cp->addr.type, 7665 cp->action); 7666 device_flags_changed(NULL, hdev, &cp->addr.bdaddr, 7667 cp->addr.type, hdev->conn_flags, 7668 params ? params->flags : 0); 7669 } 7670 7671 mgmt_cmd_complete(cmd->sk, hdev->id, MGMT_OP_ADD_DEVICE, 7672 mgmt_status(err), &cp->addr, sizeof(cp->addr)); 7673 mgmt_pending_free(cmd); 7674 } 7675 7676 static int add_device_sync(struct hci_dev *hdev, void *data) 7677 { 7678 return hci_update_passive_scan_sync(hdev); 7679 } 7680 7681 static int add_device(struct sock *sk, struct hci_dev *hdev, 7682 void *data, u16 len) 7683 { 7684 struct mgmt_pending_cmd *cmd; 7685 struct mgmt_cp_add_device *cp = data; 7686 u8 auto_conn, addr_type; 7687 struct hci_conn_params *params; 7688 int err; 7689 u32 current_flags = 0; 7690 u32 supported_flags; 7691 7692 bt_dev_dbg(hdev, "sock %p", sk); 7693 7694 if (!bdaddr_type_is_valid(cp->addr.type) || 7695 !bacmp(&cp->addr.bdaddr, BDADDR_ANY)) 7696 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE, 7697 MGMT_STATUS_INVALID_PARAMS, 7698 &cp->addr, sizeof(cp->addr)); 7699 7700 if (cp->action != 0x00 && cp->action != 0x01 && cp->action != 0x02) 7701 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE, 7702 MGMT_STATUS_INVALID_PARAMS, 7703 &cp->addr, sizeof(cp->addr)); 7704 7705 hci_dev_lock(hdev); 7706 7707 if (cp->addr.type == BDADDR_BREDR) { 7708 /* Only incoming connections action is supported for now */ 7709 if (cp->action != 0x01) { 7710 err = mgmt_cmd_complete(sk, hdev->id, 7711 MGMT_OP_ADD_DEVICE, 7712 MGMT_STATUS_INVALID_PARAMS, 7713 &cp->addr, sizeof(cp->addr)); 7714 goto unlock; 7715 } 7716 7717 err = hci_bdaddr_list_add_with_flags(&hdev->accept_list, 7718 &cp->addr.bdaddr, 7719 cp->addr.type, 0); 7720 if (err) 7721 goto unlock; 7722 7723 hci_update_scan(hdev); 7724 7725 goto added; 7726 } 7727 7728 addr_type = le_addr_type(cp->addr.type); 7729 7730 if (cp->action == 0x02) 7731 auto_conn = HCI_AUTO_CONN_ALWAYS; 7732 else if (cp->action == 0x01) 7733 auto_conn = HCI_AUTO_CONN_DIRECT; 7734 else 7735 auto_conn = HCI_AUTO_CONN_REPORT; 7736 7737 /* Kernel internally uses conn_params with resolvable private 7738 * address, but Add Device allows only identity addresses. 7739 * Make sure it is enforced before calling 7740 * hci_conn_params_lookup. 7741 */ 7742 if (!hci_is_identity_address(&cp->addr.bdaddr, addr_type)) { 7743 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE, 7744 MGMT_STATUS_INVALID_PARAMS, 7745 &cp->addr, sizeof(cp->addr)); 7746 goto unlock; 7747 } 7748 7749 /* If the connection parameters don't exist for this device, 7750 * they will be created and configured with defaults. 7751 */ 7752 params = hci_conn_params_set(hdev, &cp->addr.bdaddr, addr_type, 7753 auto_conn); 7754 if (!params) { 7755 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE, 7756 MGMT_STATUS_FAILED, &cp->addr, 7757 sizeof(cp->addr)); 7758 goto unlock; 7759 } 7760 7761 cmd = mgmt_pending_new(sk, MGMT_OP_ADD_DEVICE, hdev, data, len); 7762 if (!cmd) { 7763 err = -ENOMEM; 7764 goto unlock; 7765 } 7766 7767 err = hci_cmd_sync_queue(hdev, add_device_sync, cmd, 7768 add_device_complete); 7769 if (err < 0) { 7770 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE, 7771 MGMT_STATUS_FAILED, &cp->addr, 7772 sizeof(cp->addr)); 7773 mgmt_pending_free(cmd); 7774 } 7775 7776 goto unlock; 7777 7778 added: 7779 device_added(sk, hdev, &cp->addr.bdaddr, cp->addr.type, cp->action); 7780 supported_flags = hdev->conn_flags; 7781 device_flags_changed(NULL, hdev, &cp->addr.bdaddr, cp->addr.type, 7782 supported_flags, current_flags); 7783 7784 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE, 7785 MGMT_STATUS_SUCCESS, &cp->addr, 7786 sizeof(cp->addr)); 7787 7788 unlock: 7789 hci_dev_unlock(hdev); 7790 return err; 7791 } 7792 7793 static void device_removed(struct sock *sk, struct hci_dev *hdev, 7794 bdaddr_t *bdaddr, u8 type) 7795 { 7796 struct mgmt_ev_device_removed ev; 7797 7798 bacpy(&ev.addr.bdaddr, bdaddr); 7799 ev.addr.type = type; 7800 7801 mgmt_event(MGMT_EV_DEVICE_REMOVED, hdev, &ev, sizeof(ev), sk); 7802 } 7803 7804 static int remove_device_sync(struct hci_dev *hdev, void *data) 7805 { 7806 return hci_update_passive_scan_sync(hdev); 7807 } 7808 7809 static int remove_device(struct sock *sk, struct hci_dev *hdev, 7810 void *data, u16 len) 7811 { 7812 struct mgmt_cp_remove_device *cp = data; 7813 int err; 7814 7815 bt_dev_dbg(hdev, "sock %p", sk); 7816 7817 hci_dev_lock(hdev); 7818 7819 if (bacmp(&cp->addr.bdaddr, BDADDR_ANY)) { 7820 struct hci_conn_params *params; 7821 u8 addr_type; 7822 7823 if (!bdaddr_type_is_valid(cp->addr.type)) { 7824 err = mgmt_cmd_complete(sk, hdev->id, 7825 MGMT_OP_REMOVE_DEVICE, 7826 MGMT_STATUS_INVALID_PARAMS, 7827 &cp->addr, sizeof(cp->addr)); 7828 goto unlock; 7829 } 7830 7831 if (cp->addr.type == BDADDR_BREDR) { 7832 err = hci_bdaddr_list_del(&hdev->accept_list, 7833 &cp->addr.bdaddr, 7834 cp->addr.type); 7835 if (err) { 7836 err = mgmt_cmd_complete(sk, hdev->id, 7837 MGMT_OP_REMOVE_DEVICE, 7838 MGMT_STATUS_INVALID_PARAMS, 7839 &cp->addr, 7840 sizeof(cp->addr)); 7841 goto unlock; 7842 } 7843 7844 hci_update_scan(hdev); 7845 7846 device_removed(sk, hdev, &cp->addr.bdaddr, 7847 cp->addr.type); 7848 goto complete; 7849 } 7850 7851 addr_type = le_addr_type(cp->addr.type); 7852 7853 /* Kernel internally uses conn_params with resolvable private 7854 * address, but Remove Device allows only identity addresses. 7855 * Make sure it is enforced before calling 7856 * hci_conn_params_lookup. 7857 */ 7858 if (!hci_is_identity_address(&cp->addr.bdaddr, addr_type)) { 7859 err = mgmt_cmd_complete(sk, hdev->id, 7860 MGMT_OP_REMOVE_DEVICE, 7861 MGMT_STATUS_INVALID_PARAMS, 7862 &cp->addr, sizeof(cp->addr)); 7863 goto unlock; 7864 } 7865 7866 params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr, 7867 addr_type); 7868 if (!params) { 7869 err = mgmt_cmd_complete(sk, hdev->id, 7870 MGMT_OP_REMOVE_DEVICE, 7871 MGMT_STATUS_INVALID_PARAMS, 7872 &cp->addr, sizeof(cp->addr)); 7873 goto unlock; 7874 } 7875 7876 if (params->auto_connect == HCI_AUTO_CONN_DISABLED || 7877 params->auto_connect == HCI_AUTO_CONN_EXPLICIT) { 7878 err = mgmt_cmd_complete(sk, hdev->id, 7879 MGMT_OP_REMOVE_DEVICE, 7880 MGMT_STATUS_INVALID_PARAMS, 7881 &cp->addr, sizeof(cp->addr)); 7882 goto unlock; 7883 } 7884 7885 hci_conn_params_free(params); 7886 7887 device_removed(sk, hdev, &cp->addr.bdaddr, cp->addr.type); 7888 } else { 7889 struct hci_conn_params *p, *tmp; 7890 struct bdaddr_list *b, *btmp; 7891 7892 if (cp->addr.type) { 7893 err = mgmt_cmd_complete(sk, hdev->id, 7894 MGMT_OP_REMOVE_DEVICE, 7895 MGMT_STATUS_INVALID_PARAMS, 7896 &cp->addr, sizeof(cp->addr)); 7897 goto unlock; 7898 } 7899 7900 list_for_each_entry_safe(b, btmp, &hdev->accept_list, list) { 7901 device_removed(sk, hdev, &b->bdaddr, b->bdaddr_type); 7902 list_del(&b->list); 7903 kfree(b); 7904 } 7905 7906 hci_update_scan(hdev); 7907 7908 list_for_each_entry_safe(p, tmp, &hdev->le_conn_params, list) { 7909 if (p->auto_connect == HCI_AUTO_CONN_DISABLED) 7910 continue; 7911 device_removed(sk, hdev, &p->addr, p->addr_type); 7912 if (p->explicit_connect) { 7913 p->auto_connect = HCI_AUTO_CONN_EXPLICIT; 7914 continue; 7915 } 7916 hci_conn_params_free(p); 7917 } 7918 7919 bt_dev_dbg(hdev, "All LE connection parameters were removed"); 7920 } 7921 7922 hci_cmd_sync_queue(hdev, remove_device_sync, NULL, NULL); 7923 7924 complete: 7925 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_DEVICE, 7926 MGMT_STATUS_SUCCESS, &cp->addr, 7927 sizeof(cp->addr)); 7928 unlock: 7929 hci_dev_unlock(hdev); 7930 return err; 7931 } 7932 7933 static int conn_update_sync(struct hci_dev *hdev, void *data) 7934 { 7935 struct hci_conn_params *params = data; 7936 struct hci_conn *conn; 7937 7938 conn = hci_conn_hash_lookup_le(hdev, ¶ms->addr, params->addr_type); 7939 if (!conn) 7940 return -ECANCELED; 7941 7942 return hci_le_conn_update_sync(hdev, conn, params); 7943 } 7944 7945 static int load_conn_param(struct sock *sk, struct hci_dev *hdev, void *data, 7946 u16 len) 7947 { 7948 struct mgmt_cp_load_conn_param *cp = data; 7949 const u16 max_param_count = ((U16_MAX - sizeof(*cp)) / 7950 sizeof(struct mgmt_conn_param)); 7951 u16 param_count, expected_len; 7952 int i; 7953 7954 if (!lmp_le_capable(hdev)) 7955 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM, 7956 MGMT_STATUS_NOT_SUPPORTED); 7957 7958 param_count = __le16_to_cpu(cp->param_count); 7959 if (param_count > max_param_count) { 7960 bt_dev_err(hdev, "load_conn_param: too big param_count value %u", 7961 param_count); 7962 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM, 7963 MGMT_STATUS_INVALID_PARAMS); 7964 } 7965 7966 expected_len = struct_size(cp, params, param_count); 7967 if (expected_len != len) { 7968 bt_dev_err(hdev, "load_conn_param: expected %u bytes, got %u bytes", 7969 expected_len, len); 7970 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM, 7971 MGMT_STATUS_INVALID_PARAMS); 7972 } 7973 7974 bt_dev_dbg(hdev, "param_count %u", param_count); 7975 7976 hci_dev_lock(hdev); 7977 7978 if (param_count > 1) 7979 hci_conn_params_clear_disabled(hdev); 7980 7981 for (i = 0; i < param_count; i++) { 7982 struct mgmt_conn_param *param = &cp->params[i]; 7983 struct hci_conn_params *hci_param; 7984 u16 min, max, latency, timeout; 7985 bool update = false; 7986 u8 addr_type; 7987 7988 bt_dev_dbg(hdev, "Adding %pMR (type %u)", ¶m->addr.bdaddr, 7989 param->addr.type); 7990 7991 if (param->addr.type == BDADDR_LE_PUBLIC) { 7992 addr_type = ADDR_LE_DEV_PUBLIC; 7993 } else if (param->addr.type == BDADDR_LE_RANDOM) { 7994 addr_type = ADDR_LE_DEV_RANDOM; 7995 } else { 7996 bt_dev_err(hdev, "ignoring invalid connection parameters"); 7997 continue; 7998 } 7999 8000 min = le16_to_cpu(param->min_interval); 8001 max = le16_to_cpu(param->max_interval); 8002 latency = le16_to_cpu(param->latency); 8003 timeout = le16_to_cpu(param->timeout); 8004 8005 bt_dev_dbg(hdev, "min 0x%04x max 0x%04x latency 0x%04x timeout 0x%04x", 8006 min, max, latency, timeout); 8007 8008 if (hci_check_conn_params(min, max, latency, timeout) < 0) { 8009 bt_dev_err(hdev, "ignoring invalid connection parameters"); 8010 continue; 8011 } 8012 8013 /* Detect when the loading is for an existing parameter then 8014 * attempt to trigger the connection update procedure. 8015 */ 8016 if (!i && param_count == 1) { 8017 hci_param = hci_conn_params_lookup(hdev, 8018 ¶m->addr.bdaddr, 8019 addr_type); 8020 if (hci_param) 8021 update = true; 8022 else 8023 hci_conn_params_clear_disabled(hdev); 8024 } 8025 8026 hci_param = hci_conn_params_add(hdev, ¶m->addr.bdaddr, 8027 addr_type); 8028 if (!hci_param) { 8029 bt_dev_err(hdev, "failed to add connection parameters"); 8030 continue; 8031 } 8032 8033 hci_param->conn_min_interval = min; 8034 hci_param->conn_max_interval = max; 8035 hci_param->conn_latency = latency; 8036 hci_param->supervision_timeout = timeout; 8037 8038 /* Check if we need to trigger a connection update */ 8039 if (update) { 8040 struct hci_conn *conn; 8041 8042 /* Lookup for existing connection as central and check 8043 * if parameters match and if they don't then trigger 8044 * a connection update. 8045 */ 8046 conn = hci_conn_hash_lookup_le(hdev, &hci_param->addr, 8047 addr_type); 8048 if (conn && conn->role == HCI_ROLE_MASTER && 8049 (conn->le_conn_min_interval != min || 8050 conn->le_conn_max_interval != max || 8051 conn->le_conn_latency != latency || 8052 conn->le_supv_timeout != timeout)) 8053 hci_cmd_sync_queue(hdev, conn_update_sync, 8054 hci_param, NULL); 8055 } 8056 } 8057 8058 hci_dev_unlock(hdev); 8059 8060 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM, 0, 8061 NULL, 0); 8062 } 8063 8064 static int set_external_config(struct sock *sk, struct hci_dev *hdev, 8065 void *data, u16 len) 8066 { 8067 struct mgmt_cp_set_external_config *cp = data; 8068 bool changed; 8069 int err; 8070 8071 bt_dev_dbg(hdev, "sock %p", sk); 8072 8073 if (hdev_is_powered(hdev)) 8074 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_EXTERNAL_CONFIG, 8075 MGMT_STATUS_REJECTED); 8076 8077 if (cp->config != 0x00 && cp->config != 0x01) 8078 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_EXTERNAL_CONFIG, 8079 MGMT_STATUS_INVALID_PARAMS); 8080 8081 if (!hci_test_quirk(hdev, HCI_QUIRK_EXTERNAL_CONFIG)) 8082 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_EXTERNAL_CONFIG, 8083 MGMT_STATUS_NOT_SUPPORTED); 8084 8085 hci_dev_lock(hdev); 8086 8087 if (cp->config) 8088 changed = !hci_dev_test_and_set_flag(hdev, HCI_EXT_CONFIGURED); 8089 else 8090 changed = hci_dev_test_and_clear_flag(hdev, HCI_EXT_CONFIGURED); 8091 8092 err = send_options_rsp(sk, MGMT_OP_SET_EXTERNAL_CONFIG, hdev); 8093 if (err < 0) 8094 goto unlock; 8095 8096 if (!changed) 8097 goto unlock; 8098 8099 err = new_options(hdev, sk); 8100 8101 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED) == is_configured(hdev)) { 8102 mgmt_index_removed(hdev); 8103 8104 if (hci_dev_test_and_change_flag(hdev, HCI_UNCONFIGURED)) { 8105 hci_dev_set_flag(hdev, HCI_CONFIG); 8106 hci_dev_set_flag(hdev, HCI_AUTO_OFF); 8107 8108 queue_work(hdev->req_workqueue, &hdev->power_on); 8109 } else { 8110 set_bit(HCI_RAW, &hdev->flags); 8111 mgmt_index_added(hdev); 8112 } 8113 } 8114 8115 unlock: 8116 hci_dev_unlock(hdev); 8117 return err; 8118 } 8119 8120 static int set_public_address(struct sock *sk, struct hci_dev *hdev, 8121 void *data, u16 len) 8122 { 8123 struct mgmt_cp_set_public_address *cp = data; 8124 bool changed; 8125 int err; 8126 8127 bt_dev_dbg(hdev, "sock %p", sk); 8128 8129 if (hdev_is_powered(hdev)) 8130 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PUBLIC_ADDRESS, 8131 MGMT_STATUS_REJECTED); 8132 8133 if (!bacmp(&cp->bdaddr, BDADDR_ANY)) 8134 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PUBLIC_ADDRESS, 8135 MGMT_STATUS_INVALID_PARAMS); 8136 8137 if (!hdev->set_bdaddr) 8138 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PUBLIC_ADDRESS, 8139 MGMT_STATUS_NOT_SUPPORTED); 8140 8141 hci_dev_lock(hdev); 8142 8143 changed = !!bacmp(&hdev->public_addr, &cp->bdaddr); 8144 bacpy(&hdev->public_addr, &cp->bdaddr); 8145 8146 err = send_options_rsp(sk, MGMT_OP_SET_PUBLIC_ADDRESS, hdev); 8147 if (err < 0) 8148 goto unlock; 8149 8150 if (!changed) 8151 goto unlock; 8152 8153 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) 8154 err = new_options(hdev, sk); 8155 8156 if (is_configured(hdev)) { 8157 mgmt_index_removed(hdev); 8158 8159 hci_dev_clear_flag(hdev, HCI_UNCONFIGURED); 8160 8161 hci_dev_set_flag(hdev, HCI_CONFIG); 8162 hci_dev_set_flag(hdev, HCI_AUTO_OFF); 8163 8164 queue_work(hdev->req_workqueue, &hdev->power_on); 8165 } 8166 8167 unlock: 8168 hci_dev_unlock(hdev); 8169 return err; 8170 } 8171 8172 static void read_local_oob_ext_data_complete(struct hci_dev *hdev, void *data, 8173 int err) 8174 { 8175 const struct mgmt_cp_read_local_oob_ext_data *mgmt_cp; 8176 struct mgmt_rp_read_local_oob_ext_data *mgmt_rp; 8177 u8 *h192, *r192, *h256, *r256; 8178 struct mgmt_pending_cmd *cmd = data; 8179 struct sk_buff *skb = cmd->skb; 8180 u8 status = mgmt_status(err); 8181 u16 eir_len; 8182 8183 if (!status) { 8184 if (!skb) 8185 status = MGMT_STATUS_FAILED; 8186 else if (IS_ERR(skb)) 8187 status = mgmt_status(PTR_ERR(skb)); 8188 else 8189 status = mgmt_status(skb->data[0]); 8190 } 8191 8192 bt_dev_dbg(hdev, "status %u", status); 8193 8194 mgmt_cp = cmd->param; 8195 8196 if (status) { 8197 status = mgmt_status(status); 8198 eir_len = 0; 8199 8200 h192 = NULL; 8201 r192 = NULL; 8202 h256 = NULL; 8203 r256 = NULL; 8204 } else if (!bredr_sc_enabled(hdev)) { 8205 struct hci_rp_read_local_oob_data *rp; 8206 8207 if (skb->len != sizeof(*rp)) { 8208 status = MGMT_STATUS_FAILED; 8209 eir_len = 0; 8210 } else { 8211 status = MGMT_STATUS_SUCCESS; 8212 rp = (void *)skb->data; 8213 8214 eir_len = 5 + 18 + 18; 8215 h192 = rp->hash; 8216 r192 = rp->rand; 8217 h256 = NULL; 8218 r256 = NULL; 8219 } 8220 } else { 8221 struct hci_rp_read_local_oob_ext_data *rp; 8222 8223 if (skb->len != sizeof(*rp)) { 8224 status = MGMT_STATUS_FAILED; 8225 eir_len = 0; 8226 } else { 8227 status = MGMT_STATUS_SUCCESS; 8228 rp = (void *)skb->data; 8229 8230 if (hci_dev_test_flag(hdev, HCI_SC_ONLY)) { 8231 eir_len = 5 + 18 + 18; 8232 h192 = NULL; 8233 r192 = NULL; 8234 } else { 8235 eir_len = 5 + 18 + 18 + 18 + 18; 8236 h192 = rp->hash192; 8237 r192 = rp->rand192; 8238 } 8239 8240 h256 = rp->hash256; 8241 r256 = rp->rand256; 8242 } 8243 } 8244 8245 mgmt_rp = kmalloc(sizeof(*mgmt_rp) + eir_len, GFP_KERNEL); 8246 if (!mgmt_rp) 8247 goto done; 8248 8249 if (eir_len == 0) 8250 goto send_rsp; 8251 8252 eir_len = eir_append_data(mgmt_rp->eir, 0, EIR_CLASS_OF_DEV, 8253 hdev->dev_class, 3); 8254 8255 if (h192 && r192) { 8256 eir_len = eir_append_data(mgmt_rp->eir, eir_len, 8257 EIR_SSP_HASH_C192, h192, 16); 8258 eir_len = eir_append_data(mgmt_rp->eir, eir_len, 8259 EIR_SSP_RAND_R192, r192, 16); 8260 } 8261 8262 if (h256 && r256) { 8263 eir_len = eir_append_data(mgmt_rp->eir, eir_len, 8264 EIR_SSP_HASH_C256, h256, 16); 8265 eir_len = eir_append_data(mgmt_rp->eir, eir_len, 8266 EIR_SSP_RAND_R256, r256, 16); 8267 } 8268 8269 send_rsp: 8270 mgmt_rp->type = mgmt_cp->type; 8271 mgmt_rp->eir_len = cpu_to_le16(eir_len); 8272 8273 err = mgmt_cmd_complete(cmd->sk, hdev->id, 8274 MGMT_OP_READ_LOCAL_OOB_EXT_DATA, status, 8275 mgmt_rp, sizeof(*mgmt_rp) + eir_len); 8276 if (err < 0 || status) 8277 goto done; 8278 8279 hci_sock_set_flag(cmd->sk, HCI_MGMT_OOB_DATA_EVENTS); 8280 8281 err = mgmt_limited_event(MGMT_EV_LOCAL_OOB_DATA_UPDATED, hdev, 8282 mgmt_rp, sizeof(*mgmt_rp) + eir_len, 8283 HCI_MGMT_OOB_DATA_EVENTS, cmd->sk); 8284 done: 8285 if (skb && !IS_ERR(skb)) 8286 kfree_skb(skb); 8287 8288 kfree(mgmt_rp); 8289 mgmt_pending_free(cmd); 8290 } 8291 8292 static int read_local_ssp_oob_req(struct hci_dev *hdev, struct sock *sk, 8293 struct mgmt_cp_read_local_oob_ext_data *cp) 8294 { 8295 struct mgmt_pending_cmd *cmd; 8296 int err; 8297 8298 cmd = mgmt_pending_new(sk, MGMT_OP_READ_LOCAL_OOB_EXT_DATA, hdev, 8299 cp, sizeof(*cp)); 8300 if (!cmd) 8301 return -ENOMEM; 8302 8303 err = hci_cmd_sync_queue(hdev, read_local_oob_data_sync, cmd, 8304 read_local_oob_ext_data_complete); 8305 8306 if (err < 0) { 8307 mgmt_pending_remove(cmd); 8308 return err; 8309 } 8310 8311 return 0; 8312 } 8313 8314 static int read_local_oob_ext_data(struct sock *sk, struct hci_dev *hdev, 8315 void *data, u16 data_len) 8316 { 8317 struct mgmt_cp_read_local_oob_ext_data *cp = data; 8318 struct mgmt_rp_read_local_oob_ext_data *rp; 8319 size_t rp_len; 8320 u16 eir_len; 8321 u8 status, flags, role, addr[7], hash[16], rand[16]; 8322 int err; 8323 8324 bt_dev_dbg(hdev, "sock %p", sk); 8325 8326 if (hdev_is_powered(hdev)) { 8327 switch (cp->type) { 8328 case BIT(BDADDR_BREDR): 8329 status = mgmt_bredr_support(hdev); 8330 if (status) 8331 eir_len = 0; 8332 else 8333 eir_len = 5; 8334 break; 8335 case (BIT(BDADDR_LE_PUBLIC) | BIT(BDADDR_LE_RANDOM)): 8336 status = mgmt_le_support(hdev); 8337 if (status) 8338 eir_len = 0; 8339 else 8340 eir_len = 9 + 3 + 18 + 18 + 3; 8341 break; 8342 default: 8343 status = MGMT_STATUS_INVALID_PARAMS; 8344 eir_len = 0; 8345 break; 8346 } 8347 } else { 8348 status = MGMT_STATUS_NOT_POWERED; 8349 eir_len = 0; 8350 } 8351 8352 rp_len = sizeof(*rp) + eir_len; 8353 rp = kmalloc(rp_len, GFP_ATOMIC); 8354 if (!rp) 8355 return -ENOMEM; 8356 8357 if (!status && !lmp_ssp_capable(hdev)) { 8358 status = MGMT_STATUS_NOT_SUPPORTED; 8359 eir_len = 0; 8360 } 8361 8362 if (status) 8363 goto complete; 8364 8365 hci_dev_lock(hdev); 8366 8367 eir_len = 0; 8368 switch (cp->type) { 8369 case BIT(BDADDR_BREDR): 8370 if (hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) { 8371 err = read_local_ssp_oob_req(hdev, sk, cp); 8372 hci_dev_unlock(hdev); 8373 if (!err) 8374 goto done; 8375 8376 status = MGMT_STATUS_FAILED; 8377 goto complete; 8378 } else { 8379 eir_len = eir_append_data(rp->eir, eir_len, 8380 EIR_CLASS_OF_DEV, 8381 hdev->dev_class, 3); 8382 } 8383 break; 8384 case (BIT(BDADDR_LE_PUBLIC) | BIT(BDADDR_LE_RANDOM)): 8385 if (hci_dev_test_flag(hdev, HCI_SC_ENABLED) && 8386 smp_generate_oob(hdev, hash, rand) < 0) { 8387 hci_dev_unlock(hdev); 8388 status = MGMT_STATUS_FAILED; 8389 goto complete; 8390 } 8391 8392 /* This should return the active RPA, but since the RPA 8393 * is only programmed on demand, it is really hard to fill 8394 * this in at the moment. For now disallow retrieving 8395 * local out-of-band data when privacy is in use. 8396 * 8397 * Returning the identity address will not help here since 8398 * pairing happens before the identity resolving key is 8399 * known and thus the connection establishment happens 8400 * based on the RPA and not the identity address. 8401 */ 8402 if (hci_dev_test_flag(hdev, HCI_PRIVACY)) { 8403 hci_dev_unlock(hdev); 8404 status = MGMT_STATUS_REJECTED; 8405 goto complete; 8406 } 8407 8408 if (hci_dev_test_flag(hdev, HCI_FORCE_STATIC_ADDR) || 8409 !bacmp(&hdev->bdaddr, BDADDR_ANY) || 8410 (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) && 8411 bacmp(&hdev->static_addr, BDADDR_ANY))) { 8412 memcpy(addr, &hdev->static_addr, 6); 8413 addr[6] = 0x01; 8414 } else { 8415 memcpy(addr, &hdev->bdaddr, 6); 8416 addr[6] = 0x00; 8417 } 8418 8419 eir_len = eir_append_data(rp->eir, eir_len, EIR_LE_BDADDR, 8420 addr, sizeof(addr)); 8421 8422 if (hci_dev_test_flag(hdev, HCI_ADVERTISING)) 8423 role = 0x02; 8424 else 8425 role = 0x01; 8426 8427 eir_len = eir_append_data(rp->eir, eir_len, EIR_LE_ROLE, 8428 &role, sizeof(role)); 8429 8430 if (hci_dev_test_flag(hdev, HCI_SC_ENABLED)) { 8431 eir_len = eir_append_data(rp->eir, eir_len, 8432 EIR_LE_SC_CONFIRM, 8433 hash, sizeof(hash)); 8434 8435 eir_len = eir_append_data(rp->eir, eir_len, 8436 EIR_LE_SC_RANDOM, 8437 rand, sizeof(rand)); 8438 } 8439 8440 flags = mgmt_get_adv_discov_flags(hdev); 8441 8442 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) 8443 flags |= LE_AD_NO_BREDR; 8444 8445 eir_len = eir_append_data(rp->eir, eir_len, EIR_FLAGS, 8446 &flags, sizeof(flags)); 8447 break; 8448 } 8449 8450 hci_dev_unlock(hdev); 8451 8452 hci_sock_set_flag(sk, HCI_MGMT_OOB_DATA_EVENTS); 8453 8454 status = MGMT_STATUS_SUCCESS; 8455 8456 complete: 8457 rp->type = cp->type; 8458 rp->eir_len = cpu_to_le16(eir_len); 8459 8460 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_EXT_DATA, 8461 status, rp, sizeof(*rp) + eir_len); 8462 if (err < 0 || status) 8463 goto done; 8464 8465 err = mgmt_limited_event(MGMT_EV_LOCAL_OOB_DATA_UPDATED, hdev, 8466 rp, sizeof(*rp) + eir_len, 8467 HCI_MGMT_OOB_DATA_EVENTS, sk); 8468 8469 done: 8470 kfree(rp); 8471 8472 return err; 8473 } 8474 8475 static u32 get_supported_adv_flags(struct hci_dev *hdev) 8476 { 8477 u32 flags = 0; 8478 8479 flags |= MGMT_ADV_FLAG_CONNECTABLE; 8480 flags |= MGMT_ADV_FLAG_DISCOV; 8481 flags |= MGMT_ADV_FLAG_LIMITED_DISCOV; 8482 flags |= MGMT_ADV_FLAG_MANAGED_FLAGS; 8483 flags |= MGMT_ADV_FLAG_APPEARANCE; 8484 flags |= MGMT_ADV_FLAG_LOCAL_NAME; 8485 flags |= MGMT_ADV_PARAM_DURATION; 8486 flags |= MGMT_ADV_PARAM_TIMEOUT; 8487 flags |= MGMT_ADV_PARAM_INTERVALS; 8488 flags |= MGMT_ADV_PARAM_TX_POWER; 8489 flags |= MGMT_ADV_PARAM_SCAN_RSP; 8490 8491 /* In extended adv TX_POWER returned from Set Adv Param 8492 * will be always valid. 8493 */ 8494 if (hdev->adv_tx_power != HCI_TX_POWER_INVALID || ext_adv_capable(hdev)) 8495 flags |= MGMT_ADV_FLAG_TX_POWER; 8496 8497 if (ext_adv_capable(hdev)) { 8498 flags |= MGMT_ADV_FLAG_SEC_1M; 8499 flags |= MGMT_ADV_FLAG_HW_OFFLOAD; 8500 flags |= MGMT_ADV_FLAG_CAN_SET_TX_POWER; 8501 8502 if (le_2m_capable(hdev)) 8503 flags |= MGMT_ADV_FLAG_SEC_2M; 8504 8505 if (le_coded_capable(hdev)) 8506 flags |= MGMT_ADV_FLAG_SEC_CODED; 8507 } 8508 8509 return flags; 8510 } 8511 8512 static int read_adv_features(struct sock *sk, struct hci_dev *hdev, 8513 void *data, u16 data_len) 8514 { 8515 struct mgmt_rp_read_adv_features *rp; 8516 size_t rp_len; 8517 int err; 8518 struct adv_info *adv_instance; 8519 u32 supported_flags; 8520 u8 *instance; 8521 8522 bt_dev_dbg(hdev, "sock %p", sk); 8523 8524 if (!lmp_le_capable(hdev)) 8525 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_ADV_FEATURES, 8526 MGMT_STATUS_REJECTED); 8527 8528 hci_dev_lock(hdev); 8529 8530 rp_len = sizeof(*rp) + hdev->adv_instance_cnt; 8531 rp = kmalloc(rp_len, GFP_ATOMIC); 8532 if (!rp) { 8533 hci_dev_unlock(hdev); 8534 return -ENOMEM; 8535 } 8536 8537 supported_flags = get_supported_adv_flags(hdev); 8538 8539 rp->supported_flags = cpu_to_le32(supported_flags); 8540 rp->max_adv_data_len = max_adv_len(hdev); 8541 rp->max_scan_rsp_len = max_adv_len(hdev); 8542 rp->max_instances = hdev->le_num_of_adv_sets; 8543 rp->num_instances = hdev->adv_instance_cnt; 8544 8545 instance = rp->instance; 8546 list_for_each_entry(adv_instance, &hdev->adv_instances, list) { 8547 /* Only instances 1-le_num_of_adv_sets are externally visible */ 8548 if (adv_instance->instance <= hdev->adv_instance_cnt) { 8549 *instance = adv_instance->instance; 8550 instance++; 8551 } else { 8552 rp->num_instances--; 8553 rp_len--; 8554 } 8555 } 8556 8557 hci_dev_unlock(hdev); 8558 8559 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_ADV_FEATURES, 8560 MGMT_STATUS_SUCCESS, rp, rp_len); 8561 8562 kfree(rp); 8563 8564 return err; 8565 } 8566 8567 static u8 calculate_name_len(struct hci_dev *hdev) 8568 { 8569 u8 buf[HCI_MAX_SHORT_NAME_LENGTH + 2]; /* len + type + name */ 8570 8571 return eir_append_local_name(hdev, buf, 0); 8572 } 8573 8574 static u8 tlv_data_max_len(struct hci_dev *hdev, u32 adv_flags, 8575 bool is_adv_data) 8576 { 8577 u8 max_len = max_adv_len(hdev); 8578 8579 if (is_adv_data) { 8580 if (adv_flags & (MGMT_ADV_FLAG_DISCOV | 8581 MGMT_ADV_FLAG_LIMITED_DISCOV | 8582 MGMT_ADV_FLAG_MANAGED_FLAGS)) 8583 max_len -= 3; 8584 8585 if (adv_flags & MGMT_ADV_FLAG_TX_POWER) 8586 max_len -= 3; 8587 } else { 8588 if (adv_flags & MGMT_ADV_FLAG_LOCAL_NAME) 8589 max_len -= calculate_name_len(hdev); 8590 8591 if (adv_flags & (MGMT_ADV_FLAG_APPEARANCE)) 8592 max_len -= 4; 8593 } 8594 8595 return max_len; 8596 } 8597 8598 static bool flags_managed(u32 adv_flags) 8599 { 8600 return adv_flags & (MGMT_ADV_FLAG_DISCOV | 8601 MGMT_ADV_FLAG_LIMITED_DISCOV | 8602 MGMT_ADV_FLAG_MANAGED_FLAGS); 8603 } 8604 8605 static bool tx_power_managed(u32 adv_flags) 8606 { 8607 return adv_flags & MGMT_ADV_FLAG_TX_POWER; 8608 } 8609 8610 static bool name_managed(u32 adv_flags) 8611 { 8612 return adv_flags & MGMT_ADV_FLAG_LOCAL_NAME; 8613 } 8614 8615 static bool appearance_managed(u32 adv_flags) 8616 { 8617 return adv_flags & MGMT_ADV_FLAG_APPEARANCE; 8618 } 8619 8620 static bool tlv_data_is_valid(struct hci_dev *hdev, u32 adv_flags, u8 *data, 8621 u8 len, bool is_adv_data) 8622 { 8623 int i, cur_len; 8624 u8 max_len; 8625 8626 max_len = tlv_data_max_len(hdev, adv_flags, is_adv_data); 8627 8628 if (len > max_len) 8629 return false; 8630 8631 /* Make sure that the data is correctly formatted. */ 8632 for (i = 0; i < len; i += (cur_len + 1)) { 8633 cur_len = data[i]; 8634 8635 if (!cur_len) 8636 continue; 8637 8638 /* If the current field length would exceed the total data 8639 * length, then it's invalid. 8640 */ 8641 if (i + cur_len >= len) 8642 return false; 8643 8644 if (data[i + 1] == EIR_FLAGS && 8645 (!is_adv_data || flags_managed(adv_flags))) 8646 return false; 8647 8648 if (data[i + 1] == EIR_TX_POWER && tx_power_managed(adv_flags)) 8649 return false; 8650 8651 if (data[i + 1] == EIR_NAME_COMPLETE && name_managed(adv_flags)) 8652 return false; 8653 8654 if (data[i + 1] == EIR_NAME_SHORT && name_managed(adv_flags)) 8655 return false; 8656 8657 if (data[i + 1] == EIR_APPEARANCE && 8658 appearance_managed(adv_flags)) 8659 return false; 8660 } 8661 8662 return true; 8663 } 8664 8665 static bool requested_adv_flags_are_valid(struct hci_dev *hdev, u32 adv_flags) 8666 { 8667 u32 supported_flags, phy_flags; 8668 8669 /* The current implementation only supports a subset of the specified 8670 * flags. Also need to check mutual exclusiveness of sec flags. 8671 */ 8672 supported_flags = get_supported_adv_flags(hdev); 8673 phy_flags = adv_flags & MGMT_ADV_FLAG_SEC_MASK; 8674 if (adv_flags & ~supported_flags || 8675 ((phy_flags && (phy_flags ^ (phy_flags & -phy_flags))))) 8676 return false; 8677 8678 return true; 8679 } 8680 8681 static bool adv_busy(struct hci_dev *hdev) 8682 { 8683 return pending_find(MGMT_OP_SET_LE, hdev); 8684 } 8685 8686 static void add_adv_complete(struct hci_dev *hdev, struct sock *sk, u8 instance, 8687 int err) 8688 { 8689 struct adv_info *adv, *n; 8690 8691 bt_dev_dbg(hdev, "err %d", err); 8692 8693 hci_dev_lock(hdev); 8694 8695 list_for_each_entry_safe(adv, n, &hdev->adv_instances, list) { 8696 u8 instance; 8697 8698 if (!adv->pending) 8699 continue; 8700 8701 if (!err) { 8702 adv->pending = false; 8703 continue; 8704 } 8705 8706 instance = adv->instance; 8707 8708 if (hdev->cur_adv_instance == instance) 8709 cancel_adv_timeout(hdev); 8710 8711 hci_remove_adv_instance(hdev, instance); 8712 mgmt_advertising_removed(sk, hdev, instance); 8713 } 8714 8715 hci_dev_unlock(hdev); 8716 } 8717 8718 static void add_advertising_complete(struct hci_dev *hdev, void *data, int err) 8719 { 8720 struct mgmt_pending_cmd *cmd = data; 8721 struct mgmt_cp_add_advertising *cp = cmd->param; 8722 struct mgmt_rp_add_advertising rp; 8723 8724 memset(&rp, 0, sizeof(rp)); 8725 8726 rp.instance = cp->instance; 8727 8728 if (err) 8729 mgmt_cmd_status(cmd->sk, cmd->hdev->id, cmd->opcode, 8730 mgmt_status(err)); 8731 else 8732 mgmt_cmd_complete(cmd->sk, cmd->hdev->id, cmd->opcode, 8733 mgmt_status(err), &rp, sizeof(rp)); 8734 8735 add_adv_complete(hdev, cmd->sk, cp->instance, err); 8736 8737 mgmt_pending_free(cmd); 8738 } 8739 8740 static int add_advertising_sync(struct hci_dev *hdev, void *data) 8741 { 8742 struct mgmt_pending_cmd *cmd = data; 8743 struct mgmt_cp_add_advertising *cp = cmd->param; 8744 8745 return hci_schedule_adv_instance_sync(hdev, cp->instance, true); 8746 } 8747 8748 static int add_advertising(struct sock *sk, struct hci_dev *hdev, 8749 void *data, u16 data_len) 8750 { 8751 struct mgmt_cp_add_advertising *cp = data; 8752 struct mgmt_rp_add_advertising rp; 8753 u32 flags; 8754 u8 status; 8755 u16 timeout, duration; 8756 unsigned int prev_instance_cnt; 8757 u8 schedule_instance = 0; 8758 struct adv_info *adv, *next_instance; 8759 int err; 8760 struct mgmt_pending_cmd *cmd; 8761 8762 bt_dev_dbg(hdev, "sock %p", sk); 8763 8764 status = mgmt_le_support(hdev); 8765 if (status) 8766 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING, 8767 status); 8768 8769 if (cp->instance < 1 || cp->instance > hdev->le_num_of_adv_sets) 8770 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING, 8771 MGMT_STATUS_INVALID_PARAMS); 8772 8773 if (data_len != sizeof(*cp) + cp->adv_data_len + cp->scan_rsp_len) 8774 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING, 8775 MGMT_STATUS_INVALID_PARAMS); 8776 8777 flags = __le32_to_cpu(cp->flags); 8778 timeout = __le16_to_cpu(cp->timeout); 8779 duration = __le16_to_cpu(cp->duration); 8780 8781 if (!requested_adv_flags_are_valid(hdev, flags)) 8782 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING, 8783 MGMT_STATUS_INVALID_PARAMS); 8784 8785 hci_dev_lock(hdev); 8786 8787 if (timeout && !hdev_is_powered(hdev)) { 8788 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING, 8789 MGMT_STATUS_REJECTED); 8790 goto unlock; 8791 } 8792 8793 if (adv_busy(hdev)) { 8794 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING, 8795 MGMT_STATUS_BUSY); 8796 goto unlock; 8797 } 8798 8799 if (!tlv_data_is_valid(hdev, flags, cp->data, cp->adv_data_len, true) || 8800 !tlv_data_is_valid(hdev, flags, cp->data + cp->adv_data_len, 8801 cp->scan_rsp_len, false)) { 8802 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING, 8803 MGMT_STATUS_INVALID_PARAMS); 8804 goto unlock; 8805 } 8806 8807 prev_instance_cnt = hdev->adv_instance_cnt; 8808 8809 adv = hci_add_adv_instance(hdev, cp->instance, flags, 8810 cp->adv_data_len, cp->data, 8811 cp->scan_rsp_len, 8812 cp->data + cp->adv_data_len, 8813 timeout, duration, 8814 HCI_ADV_TX_POWER_NO_PREFERENCE, 8815 hdev->le_adv_min_interval, 8816 hdev->le_adv_max_interval, 0); 8817 if (IS_ERR(adv)) { 8818 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING, 8819 MGMT_STATUS_FAILED); 8820 goto unlock; 8821 } 8822 8823 /* Only trigger an advertising added event if a new instance was 8824 * actually added. 8825 */ 8826 if (hdev->adv_instance_cnt > prev_instance_cnt) 8827 mgmt_advertising_added(sk, hdev, cp->instance); 8828 8829 if (hdev->cur_adv_instance == cp->instance) { 8830 /* If the currently advertised instance is being changed then 8831 * cancel the current advertising and schedule the next 8832 * instance. If there is only one instance then the overridden 8833 * advertising data will be visible right away. 8834 */ 8835 cancel_adv_timeout(hdev); 8836 8837 next_instance = hci_get_next_instance(hdev, cp->instance); 8838 if (next_instance) 8839 schedule_instance = next_instance->instance; 8840 } else if (!hdev->adv_instance_timeout) { 8841 /* Immediately advertise the new instance if no other 8842 * instance is currently being advertised. 8843 */ 8844 schedule_instance = cp->instance; 8845 } 8846 8847 /* If the HCI_ADVERTISING flag is set or the device isn't powered or 8848 * there is no instance to be advertised then we have no HCI 8849 * communication to make. Simply return. 8850 */ 8851 if (!hdev_is_powered(hdev) || 8852 hci_dev_test_flag(hdev, HCI_ADVERTISING) || 8853 !schedule_instance) { 8854 rp.instance = cp->instance; 8855 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_ADVERTISING, 8856 MGMT_STATUS_SUCCESS, &rp, sizeof(rp)); 8857 goto unlock; 8858 } 8859 8860 /* We're good to go, update advertising data, parameters, and start 8861 * advertising. 8862 */ 8863 cmd = mgmt_pending_new(sk, MGMT_OP_ADD_ADVERTISING, hdev, data, 8864 data_len); 8865 if (!cmd) { 8866 err = -ENOMEM; 8867 goto unlock; 8868 } 8869 8870 cp->instance = schedule_instance; 8871 8872 err = hci_cmd_sync_queue(hdev, add_advertising_sync, cmd, 8873 add_advertising_complete); 8874 if (err < 0) 8875 mgmt_pending_free(cmd); 8876 8877 unlock: 8878 hci_dev_unlock(hdev); 8879 8880 return err; 8881 } 8882 8883 static void add_ext_adv_params_complete(struct hci_dev *hdev, void *data, 8884 int err) 8885 { 8886 struct mgmt_pending_cmd *cmd = data; 8887 struct mgmt_cp_add_ext_adv_params *cp = cmd->param; 8888 struct mgmt_rp_add_ext_adv_params rp; 8889 struct adv_info *adv; 8890 u32 flags; 8891 8892 BT_DBG("%s", hdev->name); 8893 8894 hci_dev_lock(hdev); 8895 8896 adv = hci_find_adv_instance(hdev, cp->instance); 8897 if (!adv) 8898 goto unlock; 8899 8900 rp.instance = cp->instance; 8901 rp.tx_power = adv->tx_power; 8902 8903 /* While we're at it, inform userspace of the available space for this 8904 * advertisement, given the flags that will be used. 8905 */ 8906 flags = __le32_to_cpu(cp->flags); 8907 rp.max_adv_data_len = tlv_data_max_len(hdev, flags, true); 8908 rp.max_scan_rsp_len = tlv_data_max_len(hdev, flags, false); 8909 8910 if (err) { 8911 /* If this advertisement was previously advertising and we 8912 * failed to update it, we signal that it has been removed and 8913 * delete its structure 8914 */ 8915 if (!adv->pending) 8916 mgmt_advertising_removed(cmd->sk, hdev, cp->instance); 8917 8918 hci_remove_adv_instance(hdev, cp->instance); 8919 8920 mgmt_cmd_status(cmd->sk, cmd->hdev->id, cmd->opcode, 8921 mgmt_status(err)); 8922 } else { 8923 mgmt_cmd_complete(cmd->sk, cmd->hdev->id, cmd->opcode, 8924 mgmt_status(err), &rp, sizeof(rp)); 8925 } 8926 8927 unlock: 8928 mgmt_pending_free(cmd); 8929 8930 hci_dev_unlock(hdev); 8931 } 8932 8933 static int add_ext_adv_params_sync(struct hci_dev *hdev, void *data) 8934 { 8935 struct mgmt_pending_cmd *cmd = data; 8936 struct mgmt_cp_add_ext_adv_params *cp = cmd->param; 8937 8938 return hci_setup_ext_adv_instance_sync(hdev, cp->instance); 8939 } 8940 8941 static int add_ext_adv_params(struct sock *sk, struct hci_dev *hdev, 8942 void *data, u16 data_len) 8943 { 8944 struct mgmt_cp_add_ext_adv_params *cp = data; 8945 struct mgmt_rp_add_ext_adv_params rp; 8946 struct mgmt_pending_cmd *cmd = NULL; 8947 struct adv_info *adv; 8948 u32 flags, min_interval, max_interval; 8949 u16 timeout, duration; 8950 u8 status; 8951 s8 tx_power; 8952 int err; 8953 8954 BT_DBG("%s", hdev->name); 8955 8956 status = mgmt_le_support(hdev); 8957 if (status) 8958 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_PARAMS, 8959 status); 8960 8961 if (cp->instance < 1 || cp->instance > hdev->le_num_of_adv_sets) 8962 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_PARAMS, 8963 MGMT_STATUS_INVALID_PARAMS); 8964 8965 /* The purpose of breaking add_advertising into two separate MGMT calls 8966 * for params and data is to allow more parameters to be added to this 8967 * structure in the future. For this reason, we verify that we have the 8968 * bare minimum structure we know of when the interface was defined. Any 8969 * extra parameters we don't know about will be ignored in this request. 8970 */ 8971 if (data_len < MGMT_ADD_EXT_ADV_PARAMS_MIN_SIZE) 8972 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_PARAMS, 8973 MGMT_STATUS_INVALID_PARAMS); 8974 8975 flags = __le32_to_cpu(cp->flags); 8976 8977 if (!requested_adv_flags_are_valid(hdev, flags)) 8978 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_PARAMS, 8979 MGMT_STATUS_INVALID_PARAMS); 8980 8981 hci_dev_lock(hdev); 8982 8983 /* In new interface, we require that we are powered to register */ 8984 if (!hdev_is_powered(hdev)) { 8985 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_PARAMS, 8986 MGMT_STATUS_REJECTED); 8987 goto unlock; 8988 } 8989 8990 if (adv_busy(hdev)) { 8991 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_PARAMS, 8992 MGMT_STATUS_BUSY); 8993 goto unlock; 8994 } 8995 8996 /* Parse defined parameters from request, use defaults otherwise */ 8997 timeout = (flags & MGMT_ADV_PARAM_TIMEOUT) ? 8998 __le16_to_cpu(cp->timeout) : 0; 8999 9000 duration = (flags & MGMT_ADV_PARAM_DURATION) ? 9001 __le16_to_cpu(cp->duration) : 9002 hdev->def_multi_adv_rotation_duration; 9003 9004 min_interval = (flags & MGMT_ADV_PARAM_INTERVALS) ? 9005 __le32_to_cpu(cp->min_interval) : 9006 hdev->le_adv_min_interval; 9007 9008 max_interval = (flags & MGMT_ADV_PARAM_INTERVALS) ? 9009 __le32_to_cpu(cp->max_interval) : 9010 hdev->le_adv_max_interval; 9011 9012 tx_power = (flags & MGMT_ADV_PARAM_TX_POWER) ? 9013 cp->tx_power : 9014 HCI_ADV_TX_POWER_NO_PREFERENCE; 9015 9016 /* Create advertising instance with no advertising or response data */ 9017 adv = hci_add_adv_instance(hdev, cp->instance, flags, 0, NULL, 0, NULL, 9018 timeout, duration, tx_power, min_interval, 9019 max_interval, 0); 9020 9021 if (IS_ERR(adv)) { 9022 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_PARAMS, 9023 MGMT_STATUS_FAILED); 9024 goto unlock; 9025 } 9026 9027 /* Submit request for advertising params if ext adv available */ 9028 if (ext_adv_capable(hdev)) { 9029 cmd = mgmt_pending_new(sk, MGMT_OP_ADD_EXT_ADV_PARAMS, hdev, 9030 data, data_len); 9031 if (!cmd) { 9032 err = -ENOMEM; 9033 hci_remove_adv_instance(hdev, cp->instance); 9034 goto unlock; 9035 } 9036 9037 err = hci_cmd_sync_queue(hdev, add_ext_adv_params_sync, cmd, 9038 add_ext_adv_params_complete); 9039 if (err < 0) 9040 mgmt_pending_free(cmd); 9041 } else { 9042 rp.instance = cp->instance; 9043 rp.tx_power = HCI_ADV_TX_POWER_NO_PREFERENCE; 9044 rp.max_adv_data_len = tlv_data_max_len(hdev, flags, true); 9045 rp.max_scan_rsp_len = tlv_data_max_len(hdev, flags, false); 9046 err = mgmt_cmd_complete(sk, hdev->id, 9047 MGMT_OP_ADD_EXT_ADV_PARAMS, 9048 MGMT_STATUS_SUCCESS, &rp, sizeof(rp)); 9049 } 9050 9051 unlock: 9052 hci_dev_unlock(hdev); 9053 9054 return err; 9055 } 9056 9057 static void add_ext_adv_data_complete(struct hci_dev *hdev, void *data, int err) 9058 { 9059 struct mgmt_pending_cmd *cmd = data; 9060 struct mgmt_cp_add_ext_adv_data *cp = cmd->param; 9061 struct mgmt_rp_add_advertising rp; 9062 9063 add_adv_complete(hdev, cmd->sk, cp->instance, err); 9064 9065 memset(&rp, 0, sizeof(rp)); 9066 9067 rp.instance = cp->instance; 9068 9069 if (err) 9070 mgmt_cmd_status(cmd->sk, cmd->hdev->id, cmd->opcode, 9071 mgmt_status(err)); 9072 else 9073 mgmt_cmd_complete(cmd->sk, cmd->hdev->id, cmd->opcode, 9074 mgmt_status(err), &rp, sizeof(rp)); 9075 9076 mgmt_pending_free(cmd); 9077 } 9078 9079 static int add_ext_adv_data_sync(struct hci_dev *hdev, void *data) 9080 { 9081 struct mgmt_pending_cmd *cmd = data; 9082 struct mgmt_cp_add_ext_adv_data *cp = cmd->param; 9083 int err; 9084 9085 if (ext_adv_capable(hdev)) { 9086 err = hci_update_adv_data_sync(hdev, cp->instance); 9087 if (err) 9088 return err; 9089 9090 err = hci_update_scan_rsp_data_sync(hdev, cp->instance); 9091 if (err) 9092 return err; 9093 9094 return hci_enable_ext_advertising_sync(hdev, cp->instance); 9095 } 9096 9097 return hci_schedule_adv_instance_sync(hdev, cp->instance, true); 9098 } 9099 9100 static int add_ext_adv_data(struct sock *sk, struct hci_dev *hdev, void *data, 9101 u16 data_len) 9102 { 9103 struct mgmt_cp_add_ext_adv_data *cp = data; 9104 struct mgmt_rp_add_ext_adv_data rp; 9105 u8 schedule_instance = 0; 9106 struct adv_info *next_instance; 9107 struct adv_info *adv_instance; 9108 int err = 0; 9109 struct mgmt_pending_cmd *cmd; 9110 u16 expected_len; 9111 9112 BT_DBG("%s", hdev->name); 9113 9114 expected_len = struct_size(cp, data, cp->adv_data_len + 9115 cp->scan_rsp_len); 9116 if (expected_len > data_len) 9117 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_DATA, 9118 MGMT_STATUS_INVALID_PARAMS); 9119 9120 hci_dev_lock(hdev); 9121 9122 adv_instance = hci_find_adv_instance(hdev, cp->instance); 9123 9124 if (!adv_instance) { 9125 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_DATA, 9126 MGMT_STATUS_INVALID_PARAMS); 9127 goto unlock; 9128 } 9129 9130 /* In new interface, we require that we are powered to register */ 9131 if (!hdev_is_powered(hdev)) { 9132 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_DATA, 9133 MGMT_STATUS_REJECTED); 9134 goto clear_new_instance; 9135 } 9136 9137 if (adv_busy(hdev)) { 9138 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_DATA, 9139 MGMT_STATUS_BUSY); 9140 goto clear_new_instance; 9141 } 9142 9143 /* Validate new data */ 9144 if (!tlv_data_is_valid(hdev, adv_instance->flags, cp->data, 9145 cp->adv_data_len, true) || 9146 !tlv_data_is_valid(hdev, adv_instance->flags, cp->data + 9147 cp->adv_data_len, cp->scan_rsp_len, false)) { 9148 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_DATA, 9149 MGMT_STATUS_INVALID_PARAMS); 9150 goto clear_new_instance; 9151 } 9152 9153 /* Set the data in the advertising instance */ 9154 hci_set_adv_instance_data(hdev, cp->instance, cp->adv_data_len, 9155 cp->data, cp->scan_rsp_len, 9156 cp->data + cp->adv_data_len); 9157 9158 /* If using software rotation, determine next instance to use */ 9159 if (hdev->cur_adv_instance == cp->instance) { 9160 /* If the currently advertised instance is being changed 9161 * then cancel the current advertising and schedule the 9162 * next instance. If there is only one instance then the 9163 * overridden advertising data will be visible right 9164 * away 9165 */ 9166 cancel_adv_timeout(hdev); 9167 9168 next_instance = hci_get_next_instance(hdev, cp->instance); 9169 if (next_instance) 9170 schedule_instance = next_instance->instance; 9171 } else if (!hdev->adv_instance_timeout) { 9172 /* Immediately advertise the new instance if no other 9173 * instance is currently being advertised. 9174 */ 9175 schedule_instance = cp->instance; 9176 } 9177 9178 /* If the HCI_ADVERTISING flag is set or there is no instance to 9179 * be advertised then we have no HCI communication to make. 9180 * Simply return. 9181 */ 9182 if (hci_dev_test_flag(hdev, HCI_ADVERTISING) || !schedule_instance) { 9183 if (adv_instance->pending) { 9184 mgmt_advertising_added(sk, hdev, cp->instance); 9185 adv_instance->pending = false; 9186 } 9187 rp.instance = cp->instance; 9188 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_DATA, 9189 MGMT_STATUS_SUCCESS, &rp, sizeof(rp)); 9190 goto unlock; 9191 } 9192 9193 cmd = mgmt_pending_new(sk, MGMT_OP_ADD_EXT_ADV_DATA, hdev, data, 9194 data_len); 9195 if (!cmd) { 9196 err = -ENOMEM; 9197 goto clear_new_instance; 9198 } 9199 9200 err = hci_cmd_sync_queue(hdev, add_ext_adv_data_sync, cmd, 9201 add_ext_adv_data_complete); 9202 if (err < 0) { 9203 mgmt_pending_free(cmd); 9204 goto clear_new_instance; 9205 } 9206 9207 /* We were successful in updating data, so trigger advertising_added 9208 * event if this is an instance that wasn't previously advertising. If 9209 * a failure occurs in the requests we initiated, we will remove the 9210 * instance again in add_advertising_complete 9211 */ 9212 if (adv_instance->pending) 9213 mgmt_advertising_added(sk, hdev, cp->instance); 9214 9215 goto unlock; 9216 9217 clear_new_instance: 9218 hci_remove_adv_instance(hdev, cp->instance); 9219 9220 unlock: 9221 hci_dev_unlock(hdev); 9222 9223 return err; 9224 } 9225 9226 static void remove_advertising_complete(struct hci_dev *hdev, void *data, 9227 int err) 9228 { 9229 struct mgmt_pending_cmd *cmd = data; 9230 struct mgmt_cp_remove_advertising *cp = cmd->param; 9231 struct mgmt_rp_remove_advertising rp; 9232 9233 bt_dev_dbg(hdev, "err %d", err); 9234 9235 memset(&rp, 0, sizeof(rp)); 9236 rp.instance = cp->instance; 9237 9238 if (err) 9239 mgmt_cmd_status(cmd->sk, cmd->hdev->id, cmd->opcode, 9240 mgmt_status(err)); 9241 else 9242 mgmt_cmd_complete(cmd->sk, cmd->hdev->id, cmd->opcode, 9243 MGMT_STATUS_SUCCESS, &rp, sizeof(rp)); 9244 9245 mgmt_pending_free(cmd); 9246 } 9247 9248 static int remove_advertising_sync(struct hci_dev *hdev, void *data) 9249 { 9250 struct mgmt_pending_cmd *cmd = data; 9251 struct mgmt_cp_remove_advertising *cp = cmd->param; 9252 int err; 9253 9254 err = hci_remove_advertising_sync(hdev, cmd->sk, cp->instance, true); 9255 if (err) 9256 return err; 9257 9258 if (list_empty(&hdev->adv_instances)) 9259 err = hci_disable_advertising_sync(hdev); 9260 9261 return err; 9262 } 9263 9264 static int remove_advertising(struct sock *sk, struct hci_dev *hdev, 9265 void *data, u16 data_len) 9266 { 9267 struct mgmt_cp_remove_advertising *cp = data; 9268 struct mgmt_pending_cmd *cmd; 9269 int err; 9270 9271 bt_dev_dbg(hdev, "sock %p", sk); 9272 9273 hci_dev_lock(hdev); 9274 9275 if (cp->instance && !hci_find_adv_instance(hdev, cp->instance)) { 9276 err = mgmt_cmd_status(sk, hdev->id, 9277 MGMT_OP_REMOVE_ADVERTISING, 9278 MGMT_STATUS_INVALID_PARAMS); 9279 goto unlock; 9280 } 9281 9282 if (pending_find(MGMT_OP_SET_LE, hdev)) { 9283 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_ADVERTISING, 9284 MGMT_STATUS_BUSY); 9285 goto unlock; 9286 } 9287 9288 if (list_empty(&hdev->adv_instances)) { 9289 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_ADVERTISING, 9290 MGMT_STATUS_INVALID_PARAMS); 9291 goto unlock; 9292 } 9293 9294 cmd = mgmt_pending_new(sk, MGMT_OP_REMOVE_ADVERTISING, hdev, data, 9295 data_len); 9296 if (!cmd) { 9297 err = -ENOMEM; 9298 goto unlock; 9299 } 9300 9301 err = hci_cmd_sync_queue(hdev, remove_advertising_sync, cmd, 9302 remove_advertising_complete); 9303 if (err < 0) 9304 mgmt_pending_free(cmd); 9305 9306 unlock: 9307 hci_dev_unlock(hdev); 9308 9309 return err; 9310 } 9311 9312 static int get_adv_size_info(struct sock *sk, struct hci_dev *hdev, 9313 void *data, u16 data_len) 9314 { 9315 struct mgmt_cp_get_adv_size_info *cp = data; 9316 struct mgmt_rp_get_adv_size_info rp; 9317 u32 flags, supported_flags; 9318 9319 bt_dev_dbg(hdev, "sock %p", sk); 9320 9321 if (!lmp_le_capable(hdev)) 9322 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_ADV_SIZE_INFO, 9323 MGMT_STATUS_REJECTED); 9324 9325 if (cp->instance < 1 || cp->instance > hdev->le_num_of_adv_sets) 9326 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_ADV_SIZE_INFO, 9327 MGMT_STATUS_INVALID_PARAMS); 9328 9329 flags = __le32_to_cpu(cp->flags); 9330 9331 /* The current implementation only supports a subset of the specified 9332 * flags. 9333 */ 9334 supported_flags = get_supported_adv_flags(hdev); 9335 if (flags & ~supported_flags) 9336 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_ADV_SIZE_INFO, 9337 MGMT_STATUS_INVALID_PARAMS); 9338 9339 rp.instance = cp->instance; 9340 rp.flags = cp->flags; 9341 rp.max_adv_data_len = tlv_data_max_len(hdev, flags, true); 9342 rp.max_scan_rsp_len = tlv_data_max_len(hdev, flags, false); 9343 9344 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_ADV_SIZE_INFO, 9345 MGMT_STATUS_SUCCESS, &rp, sizeof(rp)); 9346 } 9347 9348 static const struct hci_mgmt_handler mgmt_handlers[] = { 9349 { NULL }, /* 0x0000 (no command) */ 9350 { read_version, MGMT_READ_VERSION_SIZE, 9351 HCI_MGMT_NO_HDEV | 9352 HCI_MGMT_UNTRUSTED }, 9353 { read_commands, MGMT_READ_COMMANDS_SIZE, 9354 HCI_MGMT_NO_HDEV | 9355 HCI_MGMT_UNTRUSTED }, 9356 { read_index_list, MGMT_READ_INDEX_LIST_SIZE, 9357 HCI_MGMT_NO_HDEV | 9358 HCI_MGMT_UNTRUSTED }, 9359 { read_controller_info, MGMT_READ_INFO_SIZE, 9360 HCI_MGMT_UNTRUSTED }, 9361 { set_powered, MGMT_SETTING_SIZE }, 9362 { set_discoverable, MGMT_SET_DISCOVERABLE_SIZE }, 9363 { set_connectable, MGMT_SETTING_SIZE }, 9364 { set_fast_connectable, MGMT_SETTING_SIZE }, 9365 { set_bondable, MGMT_SETTING_SIZE }, 9366 { set_link_security, MGMT_SETTING_SIZE }, 9367 { set_ssp, MGMT_SETTING_SIZE }, 9368 { set_hs, MGMT_SETTING_SIZE }, 9369 { set_le, MGMT_SETTING_SIZE }, 9370 { set_dev_class, MGMT_SET_DEV_CLASS_SIZE }, 9371 { set_local_name, MGMT_SET_LOCAL_NAME_SIZE }, 9372 { add_uuid, MGMT_ADD_UUID_SIZE }, 9373 { remove_uuid, MGMT_REMOVE_UUID_SIZE }, 9374 { load_link_keys, MGMT_LOAD_LINK_KEYS_SIZE, 9375 HCI_MGMT_VAR_LEN }, 9376 { load_long_term_keys, MGMT_LOAD_LONG_TERM_KEYS_SIZE, 9377 HCI_MGMT_VAR_LEN }, 9378 { disconnect, MGMT_DISCONNECT_SIZE }, 9379 { get_connections, MGMT_GET_CONNECTIONS_SIZE }, 9380 { pin_code_reply, MGMT_PIN_CODE_REPLY_SIZE }, 9381 { pin_code_neg_reply, MGMT_PIN_CODE_NEG_REPLY_SIZE }, 9382 { set_io_capability, MGMT_SET_IO_CAPABILITY_SIZE }, 9383 { pair_device, MGMT_PAIR_DEVICE_SIZE }, 9384 { cancel_pair_device, MGMT_CANCEL_PAIR_DEVICE_SIZE }, 9385 { unpair_device, MGMT_UNPAIR_DEVICE_SIZE }, 9386 { user_confirm_reply, MGMT_USER_CONFIRM_REPLY_SIZE }, 9387 { user_confirm_neg_reply, MGMT_USER_CONFIRM_NEG_REPLY_SIZE }, 9388 { user_passkey_reply, MGMT_USER_PASSKEY_REPLY_SIZE }, 9389 { user_passkey_neg_reply, MGMT_USER_PASSKEY_NEG_REPLY_SIZE }, 9390 { read_local_oob_data, MGMT_READ_LOCAL_OOB_DATA_SIZE }, 9391 { add_remote_oob_data, MGMT_ADD_REMOTE_OOB_DATA_SIZE, 9392 HCI_MGMT_VAR_LEN }, 9393 { remove_remote_oob_data, MGMT_REMOVE_REMOTE_OOB_DATA_SIZE }, 9394 { start_discovery, MGMT_START_DISCOVERY_SIZE }, 9395 { stop_discovery, MGMT_STOP_DISCOVERY_SIZE }, 9396 { confirm_name, MGMT_CONFIRM_NAME_SIZE }, 9397 { block_device, MGMT_BLOCK_DEVICE_SIZE }, 9398 { unblock_device, MGMT_UNBLOCK_DEVICE_SIZE }, 9399 { set_device_id, MGMT_SET_DEVICE_ID_SIZE }, 9400 { set_advertising, MGMT_SETTING_SIZE }, 9401 { set_bredr, MGMT_SETTING_SIZE }, 9402 { set_static_address, MGMT_SET_STATIC_ADDRESS_SIZE }, 9403 { set_scan_params, MGMT_SET_SCAN_PARAMS_SIZE }, 9404 { set_secure_conn, MGMT_SETTING_SIZE }, 9405 { set_debug_keys, MGMT_SETTING_SIZE }, 9406 { set_privacy, MGMT_SET_PRIVACY_SIZE }, 9407 { load_irks, MGMT_LOAD_IRKS_SIZE, 9408 HCI_MGMT_VAR_LEN }, 9409 { get_conn_info, MGMT_GET_CONN_INFO_SIZE }, 9410 { get_clock_info, MGMT_GET_CLOCK_INFO_SIZE }, 9411 { add_device, MGMT_ADD_DEVICE_SIZE }, 9412 { remove_device, MGMT_REMOVE_DEVICE_SIZE }, 9413 { load_conn_param, MGMT_LOAD_CONN_PARAM_SIZE, 9414 HCI_MGMT_VAR_LEN }, 9415 { read_unconf_index_list, MGMT_READ_UNCONF_INDEX_LIST_SIZE, 9416 HCI_MGMT_NO_HDEV | 9417 HCI_MGMT_UNTRUSTED }, 9418 { read_config_info, MGMT_READ_CONFIG_INFO_SIZE, 9419 HCI_MGMT_UNCONFIGURED | 9420 HCI_MGMT_UNTRUSTED }, 9421 { set_external_config, MGMT_SET_EXTERNAL_CONFIG_SIZE, 9422 HCI_MGMT_UNCONFIGURED }, 9423 { set_public_address, MGMT_SET_PUBLIC_ADDRESS_SIZE, 9424 HCI_MGMT_UNCONFIGURED }, 9425 { start_service_discovery, MGMT_START_SERVICE_DISCOVERY_SIZE, 9426 HCI_MGMT_VAR_LEN }, 9427 { read_local_oob_ext_data, MGMT_READ_LOCAL_OOB_EXT_DATA_SIZE }, 9428 { read_ext_index_list, MGMT_READ_EXT_INDEX_LIST_SIZE, 9429 HCI_MGMT_NO_HDEV | 9430 HCI_MGMT_UNTRUSTED }, 9431 { read_adv_features, MGMT_READ_ADV_FEATURES_SIZE }, 9432 { add_advertising, MGMT_ADD_ADVERTISING_SIZE, 9433 HCI_MGMT_VAR_LEN }, 9434 { remove_advertising, MGMT_REMOVE_ADVERTISING_SIZE }, 9435 { get_adv_size_info, MGMT_GET_ADV_SIZE_INFO_SIZE }, 9436 { start_limited_discovery, MGMT_START_DISCOVERY_SIZE }, 9437 { read_ext_controller_info,MGMT_READ_EXT_INFO_SIZE, 9438 HCI_MGMT_UNTRUSTED }, 9439 { set_appearance, MGMT_SET_APPEARANCE_SIZE }, 9440 { get_phy_configuration, MGMT_GET_PHY_CONFIGURATION_SIZE }, 9441 { set_phy_configuration, MGMT_SET_PHY_CONFIGURATION_SIZE }, 9442 { set_blocked_keys, MGMT_OP_SET_BLOCKED_KEYS_SIZE, 9443 HCI_MGMT_VAR_LEN }, 9444 { set_wideband_speech, MGMT_SETTING_SIZE }, 9445 { read_controller_cap, MGMT_READ_CONTROLLER_CAP_SIZE, 9446 HCI_MGMT_UNTRUSTED }, 9447 { read_exp_features_info, MGMT_READ_EXP_FEATURES_INFO_SIZE, 9448 HCI_MGMT_UNTRUSTED | 9449 HCI_MGMT_HDEV_OPTIONAL }, 9450 { set_exp_feature, MGMT_SET_EXP_FEATURE_SIZE, 9451 HCI_MGMT_VAR_LEN | 9452 HCI_MGMT_HDEV_OPTIONAL }, 9453 { read_def_system_config, MGMT_READ_DEF_SYSTEM_CONFIG_SIZE, 9454 HCI_MGMT_UNTRUSTED }, 9455 { set_def_system_config, MGMT_SET_DEF_SYSTEM_CONFIG_SIZE, 9456 HCI_MGMT_VAR_LEN }, 9457 { read_def_runtime_config, MGMT_READ_DEF_RUNTIME_CONFIG_SIZE, 9458 HCI_MGMT_UNTRUSTED }, 9459 { set_def_runtime_config, MGMT_SET_DEF_RUNTIME_CONFIG_SIZE, 9460 HCI_MGMT_VAR_LEN }, 9461 { get_device_flags, MGMT_GET_DEVICE_FLAGS_SIZE }, 9462 { set_device_flags, MGMT_SET_DEVICE_FLAGS_SIZE }, 9463 { read_adv_mon_features, MGMT_READ_ADV_MONITOR_FEATURES_SIZE }, 9464 { add_adv_patterns_monitor,MGMT_ADD_ADV_PATTERNS_MONITOR_SIZE, 9465 HCI_MGMT_VAR_LEN }, 9466 { remove_adv_monitor, MGMT_REMOVE_ADV_MONITOR_SIZE }, 9467 { add_ext_adv_params, MGMT_ADD_EXT_ADV_PARAMS_MIN_SIZE, 9468 HCI_MGMT_VAR_LEN }, 9469 { add_ext_adv_data, MGMT_ADD_EXT_ADV_DATA_SIZE, 9470 HCI_MGMT_VAR_LEN }, 9471 { add_adv_patterns_monitor_rssi, 9472 MGMT_ADD_ADV_PATTERNS_MONITOR_RSSI_SIZE, 9473 HCI_MGMT_VAR_LEN }, 9474 { set_mesh, MGMT_SET_MESH_RECEIVER_SIZE, 9475 HCI_MGMT_VAR_LEN }, 9476 { mesh_features, MGMT_MESH_READ_FEATURES_SIZE }, 9477 { mesh_send, MGMT_MESH_SEND_SIZE, 9478 HCI_MGMT_VAR_LEN }, 9479 { mesh_send_cancel, MGMT_MESH_SEND_CANCEL_SIZE }, 9480 { mgmt_hci_cmd_sync, MGMT_HCI_CMD_SYNC_SIZE, HCI_MGMT_VAR_LEN }, 9481 }; 9482 9483 void mgmt_index_added(struct hci_dev *hdev) 9484 { 9485 struct mgmt_ev_ext_index ev; 9486 9487 if (hci_test_quirk(hdev, HCI_QUIRK_RAW_DEVICE)) 9488 return; 9489 9490 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) { 9491 mgmt_index_event(MGMT_EV_UNCONF_INDEX_ADDED, hdev, NULL, 0, 9492 HCI_MGMT_UNCONF_INDEX_EVENTS); 9493 ev.type = 0x01; 9494 } else { 9495 mgmt_index_event(MGMT_EV_INDEX_ADDED, hdev, NULL, 0, 9496 HCI_MGMT_INDEX_EVENTS); 9497 ev.type = 0x00; 9498 } 9499 9500 ev.bus = hdev->bus; 9501 9502 mgmt_index_event(MGMT_EV_EXT_INDEX_ADDED, hdev, &ev, sizeof(ev), 9503 HCI_MGMT_EXT_INDEX_EVENTS); 9504 } 9505 9506 void mgmt_index_removed(struct hci_dev *hdev) 9507 { 9508 struct mgmt_ev_ext_index ev; 9509 struct cmd_lookup match = { NULL, hdev, MGMT_STATUS_INVALID_INDEX }; 9510 9511 if (hci_test_quirk(hdev, HCI_QUIRK_RAW_DEVICE)) 9512 return; 9513 9514 mgmt_pending_foreach(0, hdev, true, cmd_complete_rsp, &match); 9515 9516 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) { 9517 mgmt_index_event(MGMT_EV_UNCONF_INDEX_REMOVED, hdev, NULL, 0, 9518 HCI_MGMT_UNCONF_INDEX_EVENTS); 9519 ev.type = 0x01; 9520 } else { 9521 mgmt_index_event(MGMT_EV_INDEX_REMOVED, hdev, NULL, 0, 9522 HCI_MGMT_INDEX_EVENTS); 9523 ev.type = 0x00; 9524 } 9525 9526 ev.bus = hdev->bus; 9527 9528 mgmt_index_event(MGMT_EV_EXT_INDEX_REMOVED, hdev, &ev, sizeof(ev), 9529 HCI_MGMT_EXT_INDEX_EVENTS); 9530 9531 /* Cancel any remaining timed work */ 9532 if (!hci_dev_test_flag(hdev, HCI_MGMT)) 9533 return; 9534 cancel_delayed_work_sync(&hdev->discov_off); 9535 cancel_delayed_work_sync(&hdev->service_cache); 9536 cancel_delayed_work_sync(&hdev->rpa_expired); 9537 cancel_delayed_work_sync(&hdev->mesh_send_done); 9538 } 9539 9540 void mgmt_power_on(struct hci_dev *hdev, int err) 9541 { 9542 struct cmd_lookup match = { NULL, hdev }; 9543 9544 bt_dev_dbg(hdev, "err %d", err); 9545 9546 hci_dev_lock(hdev); 9547 9548 if (!err) { 9549 restart_le_actions(hdev); 9550 hci_update_passive_scan(hdev); 9551 } 9552 9553 mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, true, settings_rsp, 9554 &match); 9555 9556 new_settings(hdev, match.sk); 9557 9558 if (match.sk) 9559 sock_put(match.sk); 9560 9561 hci_dev_unlock(hdev); 9562 } 9563 9564 void __mgmt_power_off(struct hci_dev *hdev) 9565 { 9566 struct cmd_lookup match = { NULL, hdev }; 9567 u8 zero_cod[] = { 0, 0, 0 }; 9568 9569 mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, true, settings_rsp, 9570 &match); 9571 9572 /* If the power off is because of hdev unregistration let 9573 * use the appropriate INVALID_INDEX status. Otherwise use 9574 * NOT_POWERED. We cover both scenarios here since later in 9575 * mgmt_index_removed() any hci_conn callbacks will have already 9576 * been triggered, potentially causing misleading DISCONNECTED 9577 * status responses. 9578 */ 9579 if (hci_dev_test_flag(hdev, HCI_UNREGISTER)) 9580 match.mgmt_status = MGMT_STATUS_INVALID_INDEX; 9581 else 9582 match.mgmt_status = MGMT_STATUS_NOT_POWERED; 9583 9584 mgmt_pending_foreach(0, hdev, true, cmd_complete_rsp, &match); 9585 9586 if (memcmp(hdev->dev_class, zero_cod, sizeof(zero_cod)) != 0) { 9587 mgmt_limited_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev, 9588 zero_cod, sizeof(zero_cod), 9589 HCI_MGMT_DEV_CLASS_EVENTS, NULL); 9590 ext_info_changed(hdev, NULL); 9591 } 9592 9593 new_settings(hdev, match.sk); 9594 9595 if (match.sk) 9596 sock_put(match.sk); 9597 } 9598 9599 void mgmt_set_powered_failed(struct hci_dev *hdev, int err) 9600 { 9601 struct mgmt_pending_cmd *cmd; 9602 u8 status; 9603 9604 cmd = pending_find(MGMT_OP_SET_POWERED, hdev); 9605 if (!cmd) 9606 return; 9607 9608 if (err == -ERFKILL) 9609 status = MGMT_STATUS_RFKILLED; 9610 else 9611 status = MGMT_STATUS_FAILED; 9612 9613 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_POWERED, status); 9614 9615 mgmt_pending_remove(cmd); 9616 } 9617 9618 void mgmt_new_link_key(struct hci_dev *hdev, struct link_key *key, 9619 bool persistent) 9620 { 9621 struct mgmt_ev_new_link_key ev; 9622 9623 memset(&ev, 0, sizeof(ev)); 9624 9625 ev.store_hint = persistent; 9626 bacpy(&ev.key.addr.bdaddr, &key->bdaddr); 9627 ev.key.addr.type = BDADDR_BREDR; 9628 ev.key.type = key->type; 9629 memcpy(ev.key.val, key->val, HCI_LINK_KEY_SIZE); 9630 ev.key.pin_len = key->pin_len; 9631 9632 mgmt_event(MGMT_EV_NEW_LINK_KEY, hdev, &ev, sizeof(ev), NULL); 9633 } 9634 9635 static u8 mgmt_ltk_type(struct smp_ltk *ltk) 9636 { 9637 switch (ltk->type) { 9638 case SMP_LTK: 9639 case SMP_LTK_RESPONDER: 9640 if (ltk->authenticated) 9641 return MGMT_LTK_AUTHENTICATED; 9642 return MGMT_LTK_UNAUTHENTICATED; 9643 case SMP_LTK_P256: 9644 if (ltk->authenticated) 9645 return MGMT_LTK_P256_AUTH; 9646 return MGMT_LTK_P256_UNAUTH; 9647 case SMP_LTK_P256_DEBUG: 9648 return MGMT_LTK_P256_DEBUG; 9649 } 9650 9651 return MGMT_LTK_UNAUTHENTICATED; 9652 } 9653 9654 void mgmt_new_ltk(struct hci_dev *hdev, struct smp_ltk *key, bool persistent) 9655 { 9656 struct mgmt_ev_new_long_term_key ev; 9657 9658 memset(&ev, 0, sizeof(ev)); 9659 9660 /* Devices using resolvable or non-resolvable random addresses 9661 * without providing an identity resolving key don't require 9662 * to store long term keys. Their addresses will change the 9663 * next time around. 9664 * 9665 * Only when a remote device provides an identity address 9666 * make sure the long term key is stored. If the remote 9667 * identity is known, the long term keys are internally 9668 * mapped to the identity address. So allow static random 9669 * and public addresses here. 9670 */ 9671 if (key->bdaddr_type == ADDR_LE_DEV_RANDOM && 9672 (key->bdaddr.b[5] & 0xc0) != 0xc0) 9673 ev.store_hint = 0x00; 9674 else 9675 ev.store_hint = persistent; 9676 9677 bacpy(&ev.key.addr.bdaddr, &key->bdaddr); 9678 ev.key.addr.type = link_to_bdaddr(LE_LINK, key->bdaddr_type); 9679 ev.key.type = mgmt_ltk_type(key); 9680 ev.key.enc_size = key->enc_size; 9681 ev.key.ediv = key->ediv; 9682 ev.key.rand = key->rand; 9683 9684 if (key->type == SMP_LTK) 9685 ev.key.initiator = 1; 9686 9687 /* Make sure we copy only the significant bytes based on the 9688 * encryption key size, and set the rest of the value to zeroes. 9689 */ 9690 memcpy(ev.key.val, key->val, key->enc_size); 9691 memset(ev.key.val + key->enc_size, 0, 9692 sizeof(ev.key.val) - key->enc_size); 9693 9694 mgmt_event(MGMT_EV_NEW_LONG_TERM_KEY, hdev, &ev, sizeof(ev), NULL); 9695 } 9696 9697 void mgmt_new_irk(struct hci_dev *hdev, struct smp_irk *irk, bool persistent) 9698 { 9699 struct mgmt_ev_new_irk ev; 9700 9701 memset(&ev, 0, sizeof(ev)); 9702 9703 ev.store_hint = persistent; 9704 9705 bacpy(&ev.rpa, &irk->rpa); 9706 bacpy(&ev.irk.addr.bdaddr, &irk->bdaddr); 9707 ev.irk.addr.type = link_to_bdaddr(LE_LINK, irk->addr_type); 9708 memcpy(ev.irk.val, irk->val, sizeof(irk->val)); 9709 9710 mgmt_event(MGMT_EV_NEW_IRK, hdev, &ev, sizeof(ev), NULL); 9711 } 9712 9713 void mgmt_new_csrk(struct hci_dev *hdev, struct smp_csrk *csrk, 9714 bool persistent) 9715 { 9716 struct mgmt_ev_new_csrk ev; 9717 9718 memset(&ev, 0, sizeof(ev)); 9719 9720 /* Devices using resolvable or non-resolvable random addresses 9721 * without providing an identity resolving key don't require 9722 * to store signature resolving keys. Their addresses will change 9723 * the next time around. 9724 * 9725 * Only when a remote device provides an identity address 9726 * make sure the signature resolving key is stored. So allow 9727 * static random and public addresses here. 9728 */ 9729 if (csrk->bdaddr_type == ADDR_LE_DEV_RANDOM && 9730 (csrk->bdaddr.b[5] & 0xc0) != 0xc0) 9731 ev.store_hint = 0x00; 9732 else 9733 ev.store_hint = persistent; 9734 9735 bacpy(&ev.key.addr.bdaddr, &csrk->bdaddr); 9736 ev.key.addr.type = link_to_bdaddr(LE_LINK, csrk->bdaddr_type); 9737 ev.key.type = csrk->type; 9738 memcpy(ev.key.val, csrk->val, sizeof(csrk->val)); 9739 9740 mgmt_event(MGMT_EV_NEW_CSRK, hdev, &ev, sizeof(ev), NULL); 9741 } 9742 9743 void mgmt_new_conn_param(struct hci_dev *hdev, bdaddr_t *bdaddr, 9744 u8 bdaddr_type, u8 store_hint, u16 min_interval, 9745 u16 max_interval, u16 latency, u16 timeout) 9746 { 9747 struct mgmt_ev_new_conn_param ev; 9748 9749 if (!hci_is_identity_address(bdaddr, bdaddr_type)) 9750 return; 9751 9752 memset(&ev, 0, sizeof(ev)); 9753 bacpy(&ev.addr.bdaddr, bdaddr); 9754 ev.addr.type = link_to_bdaddr(LE_LINK, bdaddr_type); 9755 ev.store_hint = store_hint; 9756 ev.min_interval = cpu_to_le16(min_interval); 9757 ev.max_interval = cpu_to_le16(max_interval); 9758 ev.latency = cpu_to_le16(latency); 9759 ev.timeout = cpu_to_le16(timeout); 9760 9761 mgmt_event(MGMT_EV_NEW_CONN_PARAM, hdev, &ev, sizeof(ev), NULL); 9762 } 9763 9764 void mgmt_device_connected(struct hci_dev *hdev, struct hci_conn *conn, 9765 u8 *name, u8 name_len) 9766 { 9767 struct sk_buff *skb; 9768 struct mgmt_ev_device_connected *ev; 9769 u16 eir_len = 0; 9770 u32 flags = 0; 9771 9772 if (test_and_set_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags)) 9773 return; 9774 9775 /* allocate buff for LE or BR/EDR adv */ 9776 if (conn->le_adv_data_len > 0) 9777 skb = mgmt_alloc_skb(hdev, MGMT_EV_DEVICE_CONNECTED, 9778 sizeof(*ev) + conn->le_adv_data_len); 9779 else 9780 skb = mgmt_alloc_skb(hdev, MGMT_EV_DEVICE_CONNECTED, 9781 sizeof(*ev) + (name ? eir_precalc_len(name_len) : 0) + 9782 eir_precalc_len(sizeof(conn->dev_class))); 9783 9784 if (!skb) 9785 return; 9786 9787 ev = skb_put(skb, sizeof(*ev)); 9788 bacpy(&ev->addr.bdaddr, &conn->dst); 9789 ev->addr.type = link_to_bdaddr(conn->type, conn->dst_type); 9790 9791 if (conn->out) 9792 flags |= MGMT_DEV_FOUND_INITIATED_CONN; 9793 9794 ev->flags = __cpu_to_le32(flags); 9795 9796 /* We must ensure that the EIR Data fields are ordered and 9797 * unique. Keep it simple for now and avoid the problem by not 9798 * adding any BR/EDR data to the LE adv. 9799 */ 9800 if (conn->le_adv_data_len > 0) { 9801 skb_put_data(skb, conn->le_adv_data, conn->le_adv_data_len); 9802 eir_len = conn->le_adv_data_len; 9803 } else { 9804 if (name) 9805 eir_len += eir_skb_put_data(skb, EIR_NAME_COMPLETE, name, name_len); 9806 9807 if (memcmp(conn->dev_class, "\0\0\0", sizeof(conn->dev_class))) 9808 eir_len += eir_skb_put_data(skb, EIR_CLASS_OF_DEV, 9809 conn->dev_class, sizeof(conn->dev_class)); 9810 } 9811 9812 ev->eir_len = cpu_to_le16(eir_len); 9813 9814 mgmt_event_skb(skb, NULL); 9815 } 9816 9817 static void unpair_device_rsp(struct mgmt_pending_cmd *cmd, void *data) 9818 { 9819 struct hci_dev *hdev = data; 9820 struct mgmt_cp_unpair_device *cp = cmd->param; 9821 9822 device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, cmd->sk); 9823 9824 cmd->cmd_complete(cmd, 0); 9825 } 9826 9827 bool mgmt_powering_down(struct hci_dev *hdev) 9828 { 9829 struct mgmt_pending_cmd *cmd; 9830 struct mgmt_mode *cp; 9831 9832 if (hci_dev_test_flag(hdev, HCI_POWERING_DOWN)) 9833 return true; 9834 9835 cmd = pending_find(MGMT_OP_SET_POWERED, hdev); 9836 if (!cmd) 9837 return false; 9838 9839 cp = cmd->param; 9840 if (!cp->val) 9841 return true; 9842 9843 return false; 9844 } 9845 9846 void mgmt_device_disconnected(struct hci_dev *hdev, bdaddr_t *bdaddr, 9847 u8 link_type, u8 addr_type, u8 reason, 9848 bool mgmt_connected) 9849 { 9850 struct mgmt_ev_device_disconnected ev; 9851 struct sock *sk = NULL; 9852 9853 if (!mgmt_connected) 9854 return; 9855 9856 if (link_type != ACL_LINK && 9857 link_type != LE_LINK && 9858 link_type != BIS_LINK) 9859 return; 9860 9861 bacpy(&ev.addr.bdaddr, bdaddr); 9862 ev.addr.type = link_to_bdaddr(link_type, addr_type); 9863 ev.reason = reason; 9864 9865 /* Report disconnects due to suspend */ 9866 if (hdev->suspended) 9867 ev.reason = MGMT_DEV_DISCONN_LOCAL_HOST_SUSPEND; 9868 9869 mgmt_event(MGMT_EV_DEVICE_DISCONNECTED, hdev, &ev, sizeof(ev), sk); 9870 9871 if (sk) 9872 sock_put(sk); 9873 } 9874 9875 void mgmt_disconnect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr, 9876 u8 link_type, u8 addr_type, u8 status) 9877 { 9878 u8 bdaddr_type = link_to_bdaddr(link_type, addr_type); 9879 struct mgmt_cp_disconnect *cp; 9880 struct mgmt_pending_cmd *cmd; 9881 9882 mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, true, 9883 unpair_device_rsp, hdev); 9884 9885 cmd = pending_find(MGMT_OP_DISCONNECT, hdev); 9886 if (!cmd) 9887 return; 9888 9889 cp = cmd->param; 9890 9891 if (bacmp(bdaddr, &cp->addr.bdaddr)) 9892 return; 9893 9894 if (cp->addr.type != bdaddr_type) 9895 return; 9896 9897 cmd->cmd_complete(cmd, mgmt_status(status)); 9898 mgmt_pending_remove(cmd); 9899 } 9900 9901 void mgmt_connect_failed(struct hci_dev *hdev, struct hci_conn *conn, u8 status) 9902 { 9903 struct mgmt_ev_connect_failed ev; 9904 9905 if (test_and_clear_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags)) { 9906 mgmt_device_disconnected(hdev, &conn->dst, conn->type, 9907 conn->dst_type, status, true); 9908 return; 9909 } 9910 9911 bacpy(&ev.addr.bdaddr, &conn->dst); 9912 ev.addr.type = link_to_bdaddr(conn->type, conn->dst_type); 9913 ev.status = mgmt_status(status); 9914 9915 mgmt_event(MGMT_EV_CONNECT_FAILED, hdev, &ev, sizeof(ev), NULL); 9916 } 9917 9918 void mgmt_pin_code_request(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 secure) 9919 { 9920 struct mgmt_ev_pin_code_request ev; 9921 9922 bacpy(&ev.addr.bdaddr, bdaddr); 9923 ev.addr.type = BDADDR_BREDR; 9924 ev.secure = secure; 9925 9926 mgmt_event(MGMT_EV_PIN_CODE_REQUEST, hdev, &ev, sizeof(ev), NULL); 9927 } 9928 9929 void mgmt_pin_code_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr, 9930 u8 status) 9931 { 9932 struct mgmt_pending_cmd *cmd; 9933 9934 cmd = pending_find(MGMT_OP_PIN_CODE_REPLY, hdev); 9935 if (!cmd) 9936 return; 9937 9938 cmd->cmd_complete(cmd, mgmt_status(status)); 9939 mgmt_pending_remove(cmd); 9940 } 9941 9942 void mgmt_pin_code_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr, 9943 u8 status) 9944 { 9945 struct mgmt_pending_cmd *cmd; 9946 9947 cmd = pending_find(MGMT_OP_PIN_CODE_NEG_REPLY, hdev); 9948 if (!cmd) 9949 return; 9950 9951 cmd->cmd_complete(cmd, mgmt_status(status)); 9952 mgmt_pending_remove(cmd); 9953 } 9954 9955 int mgmt_user_confirm_request(struct hci_dev *hdev, bdaddr_t *bdaddr, 9956 u8 link_type, u8 addr_type, u32 value, 9957 u8 confirm_hint) 9958 { 9959 struct mgmt_ev_user_confirm_request ev; 9960 9961 bt_dev_dbg(hdev, "bdaddr %pMR", bdaddr); 9962 9963 bacpy(&ev.addr.bdaddr, bdaddr); 9964 ev.addr.type = link_to_bdaddr(link_type, addr_type); 9965 ev.confirm_hint = confirm_hint; 9966 ev.value = cpu_to_le32(value); 9967 9968 return mgmt_event(MGMT_EV_USER_CONFIRM_REQUEST, hdev, &ev, sizeof(ev), 9969 NULL); 9970 } 9971 9972 int mgmt_user_passkey_request(struct hci_dev *hdev, bdaddr_t *bdaddr, 9973 u8 link_type, u8 addr_type) 9974 { 9975 struct mgmt_ev_user_passkey_request ev; 9976 9977 bt_dev_dbg(hdev, "bdaddr %pMR", bdaddr); 9978 9979 bacpy(&ev.addr.bdaddr, bdaddr); 9980 ev.addr.type = link_to_bdaddr(link_type, addr_type); 9981 9982 return mgmt_event(MGMT_EV_USER_PASSKEY_REQUEST, hdev, &ev, sizeof(ev), 9983 NULL); 9984 } 9985 9986 static int user_pairing_resp_complete(struct hci_dev *hdev, bdaddr_t *bdaddr, 9987 u8 link_type, u8 addr_type, u8 status, 9988 u8 opcode) 9989 { 9990 struct mgmt_pending_cmd *cmd; 9991 9992 cmd = pending_find(opcode, hdev); 9993 if (!cmd) 9994 return -ENOENT; 9995 9996 cmd->cmd_complete(cmd, mgmt_status(status)); 9997 mgmt_pending_remove(cmd); 9998 9999 return 0; 10000 } 10001 10002 int mgmt_user_confirm_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr, 10003 u8 link_type, u8 addr_type, u8 status) 10004 { 10005 return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type, 10006 status, MGMT_OP_USER_CONFIRM_REPLY); 10007 } 10008 10009 int mgmt_user_confirm_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr, 10010 u8 link_type, u8 addr_type, u8 status) 10011 { 10012 return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type, 10013 status, 10014 MGMT_OP_USER_CONFIRM_NEG_REPLY); 10015 } 10016 10017 int mgmt_user_passkey_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr, 10018 u8 link_type, u8 addr_type, u8 status) 10019 { 10020 return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type, 10021 status, MGMT_OP_USER_PASSKEY_REPLY); 10022 } 10023 10024 int mgmt_user_passkey_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr, 10025 u8 link_type, u8 addr_type, u8 status) 10026 { 10027 return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type, 10028 status, 10029 MGMT_OP_USER_PASSKEY_NEG_REPLY); 10030 } 10031 10032 int mgmt_user_passkey_notify(struct hci_dev *hdev, bdaddr_t *bdaddr, 10033 u8 link_type, u8 addr_type, u32 passkey, 10034 u8 entered) 10035 { 10036 struct mgmt_ev_passkey_notify ev; 10037 10038 bt_dev_dbg(hdev, "bdaddr %pMR", bdaddr); 10039 10040 bacpy(&ev.addr.bdaddr, bdaddr); 10041 ev.addr.type = link_to_bdaddr(link_type, addr_type); 10042 ev.passkey = __cpu_to_le32(passkey); 10043 ev.entered = entered; 10044 10045 return mgmt_event(MGMT_EV_PASSKEY_NOTIFY, hdev, &ev, sizeof(ev), NULL); 10046 } 10047 10048 void mgmt_auth_failed(struct hci_conn *conn, u8 hci_status) 10049 { 10050 struct mgmt_ev_auth_failed ev; 10051 struct mgmt_pending_cmd *cmd; 10052 u8 status = mgmt_status(hci_status); 10053 10054 bacpy(&ev.addr.bdaddr, &conn->dst); 10055 ev.addr.type = link_to_bdaddr(conn->type, conn->dst_type); 10056 ev.status = status; 10057 10058 cmd = find_pairing(conn); 10059 10060 mgmt_event(MGMT_EV_AUTH_FAILED, conn->hdev, &ev, sizeof(ev), 10061 cmd ? cmd->sk : NULL); 10062 10063 if (cmd) { 10064 cmd->cmd_complete(cmd, status); 10065 mgmt_pending_remove(cmd); 10066 } 10067 } 10068 10069 void mgmt_auth_enable_complete(struct hci_dev *hdev, u8 status) 10070 { 10071 struct cmd_lookup match = { NULL, hdev }; 10072 bool changed; 10073 10074 if (status) { 10075 u8 mgmt_err = mgmt_status(status); 10076 mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev, true, 10077 cmd_status_rsp, &mgmt_err); 10078 return; 10079 } 10080 10081 if (test_bit(HCI_AUTH, &hdev->flags)) 10082 changed = !hci_dev_test_and_set_flag(hdev, HCI_LINK_SECURITY); 10083 else 10084 changed = hci_dev_test_and_clear_flag(hdev, HCI_LINK_SECURITY); 10085 10086 mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev, true, 10087 settings_rsp, &match); 10088 10089 if (changed) 10090 new_settings(hdev, match.sk); 10091 10092 if (match.sk) 10093 sock_put(match.sk); 10094 } 10095 10096 static void sk_lookup(struct mgmt_pending_cmd *cmd, void *data) 10097 { 10098 struct cmd_lookup *match = data; 10099 10100 if (match->sk == NULL) { 10101 match->sk = cmd->sk; 10102 sock_hold(match->sk); 10103 } 10104 } 10105 10106 void mgmt_set_class_of_dev_complete(struct hci_dev *hdev, u8 *dev_class, 10107 u8 status) 10108 { 10109 struct cmd_lookup match = { NULL, hdev, mgmt_status(status) }; 10110 10111 mgmt_pending_foreach(MGMT_OP_SET_DEV_CLASS, hdev, false, sk_lookup, 10112 &match); 10113 mgmt_pending_foreach(MGMT_OP_ADD_UUID, hdev, false, sk_lookup, 10114 &match); 10115 mgmt_pending_foreach(MGMT_OP_REMOVE_UUID, hdev, false, sk_lookup, 10116 &match); 10117 10118 if (!status) { 10119 mgmt_limited_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev, dev_class, 10120 3, HCI_MGMT_DEV_CLASS_EVENTS, NULL); 10121 ext_info_changed(hdev, NULL); 10122 } 10123 10124 if (match.sk) 10125 sock_put(match.sk); 10126 } 10127 10128 void mgmt_set_local_name_complete(struct hci_dev *hdev, u8 *name, u8 status) 10129 { 10130 struct mgmt_cp_set_local_name ev; 10131 struct mgmt_pending_cmd *cmd; 10132 10133 if (status) 10134 return; 10135 10136 memset(&ev, 0, sizeof(ev)); 10137 memcpy(ev.name, name, HCI_MAX_NAME_LENGTH); 10138 memcpy(ev.short_name, hdev->short_name, HCI_MAX_SHORT_NAME_LENGTH); 10139 10140 cmd = pending_find(MGMT_OP_SET_LOCAL_NAME, hdev); 10141 if (!cmd) { 10142 memcpy(hdev->dev_name, name, sizeof(hdev->dev_name)); 10143 10144 /* If this is a HCI command related to powering on the 10145 * HCI dev don't send any mgmt signals. 10146 */ 10147 if (hci_dev_test_flag(hdev, HCI_POWERING_DOWN)) 10148 return; 10149 10150 if (pending_find(MGMT_OP_SET_POWERED, hdev)) 10151 return; 10152 } 10153 10154 mgmt_limited_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, &ev, sizeof(ev), 10155 HCI_MGMT_LOCAL_NAME_EVENTS, cmd ? cmd->sk : NULL); 10156 ext_info_changed(hdev, cmd ? cmd->sk : NULL); 10157 } 10158 10159 static inline bool has_uuid(u8 *uuid, u16 uuid_count, u8 (*uuids)[16]) 10160 { 10161 int i; 10162 10163 for (i = 0; i < uuid_count; i++) { 10164 if (!memcmp(uuid, uuids[i], 16)) 10165 return true; 10166 } 10167 10168 return false; 10169 } 10170 10171 static bool eir_has_uuids(u8 *eir, u16 eir_len, u16 uuid_count, u8 (*uuids)[16]) 10172 { 10173 u16 parsed = 0; 10174 10175 while (parsed < eir_len) { 10176 u8 field_len = eir[0]; 10177 u8 uuid[16]; 10178 int i; 10179 10180 if (field_len == 0) 10181 break; 10182 10183 if (eir_len - parsed < field_len + 1) 10184 break; 10185 10186 switch (eir[1]) { 10187 case EIR_UUID16_ALL: 10188 case EIR_UUID16_SOME: 10189 for (i = 0; i + 3 <= field_len; i += 2) { 10190 memcpy(uuid, bluetooth_base_uuid, 16); 10191 uuid[13] = eir[i + 3]; 10192 uuid[12] = eir[i + 2]; 10193 if (has_uuid(uuid, uuid_count, uuids)) 10194 return true; 10195 } 10196 break; 10197 case EIR_UUID32_ALL: 10198 case EIR_UUID32_SOME: 10199 for (i = 0; i + 5 <= field_len; i += 4) { 10200 memcpy(uuid, bluetooth_base_uuid, 16); 10201 uuid[15] = eir[i + 5]; 10202 uuid[14] = eir[i + 4]; 10203 uuid[13] = eir[i + 3]; 10204 uuid[12] = eir[i + 2]; 10205 if (has_uuid(uuid, uuid_count, uuids)) 10206 return true; 10207 } 10208 break; 10209 case EIR_UUID128_ALL: 10210 case EIR_UUID128_SOME: 10211 for (i = 0; i + 17 <= field_len; i += 16) { 10212 memcpy(uuid, eir + i + 2, 16); 10213 if (has_uuid(uuid, uuid_count, uuids)) 10214 return true; 10215 } 10216 break; 10217 } 10218 10219 parsed += field_len + 1; 10220 eir += field_len + 1; 10221 } 10222 10223 return false; 10224 } 10225 10226 static bool is_filter_match(struct hci_dev *hdev, s8 rssi, u8 *eir, 10227 u16 eir_len, u8 *scan_rsp, u8 scan_rsp_len) 10228 { 10229 /* If a RSSI threshold has been specified, and 10230 * HCI_QUIRK_STRICT_DUPLICATE_FILTER is not set, then all results with 10231 * a RSSI smaller than the RSSI threshold will be dropped. If the quirk 10232 * is set, let it through for further processing, as we might need to 10233 * restart the scan. 10234 * 10235 * For BR/EDR devices (pre 1.2) providing no RSSI during inquiry, 10236 * the results are also dropped. 10237 */ 10238 if (hdev->discovery.rssi != HCI_RSSI_INVALID && 10239 (rssi == HCI_RSSI_INVALID || 10240 (rssi < hdev->discovery.rssi && 10241 !hci_test_quirk(hdev, HCI_QUIRK_STRICT_DUPLICATE_FILTER)))) 10242 return false; 10243 10244 if (hdev->discovery.uuid_count != 0) { 10245 /* If a list of UUIDs is provided in filter, results with no 10246 * matching UUID should be dropped. 10247 */ 10248 if (!eir_has_uuids(eir, eir_len, hdev->discovery.uuid_count, 10249 hdev->discovery.uuids) && 10250 !eir_has_uuids(scan_rsp, scan_rsp_len, 10251 hdev->discovery.uuid_count, 10252 hdev->discovery.uuids)) 10253 return false; 10254 } 10255 10256 /* If duplicate filtering does not report RSSI changes, then restart 10257 * scanning to ensure updated result with updated RSSI values. 10258 */ 10259 if (hci_test_quirk(hdev, HCI_QUIRK_STRICT_DUPLICATE_FILTER)) { 10260 /* Validate RSSI value against the RSSI threshold once more. */ 10261 if (hdev->discovery.rssi != HCI_RSSI_INVALID && 10262 rssi < hdev->discovery.rssi) 10263 return false; 10264 } 10265 10266 return true; 10267 } 10268 10269 void mgmt_adv_monitor_device_lost(struct hci_dev *hdev, u16 handle, 10270 bdaddr_t *bdaddr, u8 addr_type) 10271 { 10272 struct mgmt_ev_adv_monitor_device_lost ev; 10273 10274 ev.monitor_handle = cpu_to_le16(handle); 10275 bacpy(&ev.addr.bdaddr, bdaddr); 10276 ev.addr.type = addr_type; 10277 10278 mgmt_event(MGMT_EV_ADV_MONITOR_DEVICE_LOST, hdev, &ev, sizeof(ev), 10279 NULL); 10280 } 10281 10282 static void mgmt_send_adv_monitor_device_found(struct hci_dev *hdev, 10283 struct sk_buff *skb, 10284 struct sock *skip_sk, 10285 u16 handle) 10286 { 10287 struct sk_buff *advmon_skb; 10288 size_t advmon_skb_len; 10289 __le16 *monitor_handle; 10290 10291 if (!skb) 10292 return; 10293 10294 advmon_skb_len = (sizeof(struct mgmt_ev_adv_monitor_device_found) - 10295 sizeof(struct mgmt_ev_device_found)) + skb->len; 10296 advmon_skb = mgmt_alloc_skb(hdev, MGMT_EV_ADV_MONITOR_DEVICE_FOUND, 10297 advmon_skb_len); 10298 if (!advmon_skb) 10299 return; 10300 10301 /* ADV_MONITOR_DEVICE_FOUND is similar to DEVICE_FOUND event except 10302 * that it also has 'monitor_handle'. Make a copy of DEVICE_FOUND and 10303 * store monitor_handle of the matched monitor. 10304 */ 10305 monitor_handle = skb_put(advmon_skb, sizeof(*monitor_handle)); 10306 *monitor_handle = cpu_to_le16(handle); 10307 skb_put_data(advmon_skb, skb->data, skb->len); 10308 10309 mgmt_event_skb(advmon_skb, skip_sk); 10310 } 10311 10312 static void mgmt_adv_monitor_device_found(struct hci_dev *hdev, 10313 bdaddr_t *bdaddr, bool report_device, 10314 struct sk_buff *skb, 10315 struct sock *skip_sk) 10316 { 10317 struct monitored_device *dev, *tmp; 10318 bool matched = false; 10319 bool notified = false; 10320 10321 /* We have received the Advertisement Report because: 10322 * 1. the kernel has initiated active discovery 10323 * 2. if not, we have pend_le_reports > 0 in which case we are doing 10324 * passive scanning 10325 * 3. if none of the above is true, we have one or more active 10326 * Advertisement Monitor 10327 * 10328 * For case 1 and 2, report all advertisements via MGMT_EV_DEVICE_FOUND 10329 * and report ONLY one advertisement per device for the matched Monitor 10330 * via MGMT_EV_ADV_MONITOR_DEVICE_FOUND event. 10331 * 10332 * For case 3, since we are not active scanning and all advertisements 10333 * received are due to a matched Advertisement Monitor, report all 10334 * advertisements ONLY via MGMT_EV_ADV_MONITOR_DEVICE_FOUND event. 10335 */ 10336 if (report_device && !hdev->advmon_pend_notify) { 10337 mgmt_event_skb(skb, skip_sk); 10338 return; 10339 } 10340 10341 hdev->advmon_pend_notify = false; 10342 10343 list_for_each_entry_safe(dev, tmp, &hdev->monitored_devices, list) { 10344 if (!bacmp(&dev->bdaddr, bdaddr)) { 10345 matched = true; 10346 10347 if (!dev->notified) { 10348 mgmt_send_adv_monitor_device_found(hdev, skb, 10349 skip_sk, 10350 dev->handle); 10351 notified = true; 10352 dev->notified = true; 10353 } 10354 } 10355 10356 if (!dev->notified) 10357 hdev->advmon_pend_notify = true; 10358 } 10359 10360 if (!report_device && 10361 ((matched && !notified) || !msft_monitor_supported(hdev))) { 10362 /* Handle 0 indicates that we are not active scanning and this 10363 * is a subsequent advertisement report for an already matched 10364 * Advertisement Monitor or the controller offloading support 10365 * is not available. 10366 */ 10367 mgmt_send_adv_monitor_device_found(hdev, skb, skip_sk, 0); 10368 } 10369 10370 if (report_device) 10371 mgmt_event_skb(skb, skip_sk); 10372 else 10373 kfree_skb(skb); 10374 } 10375 10376 static void mesh_device_found(struct hci_dev *hdev, bdaddr_t *bdaddr, 10377 u8 addr_type, s8 rssi, u32 flags, u8 *eir, 10378 u16 eir_len, u8 *scan_rsp, u8 scan_rsp_len, 10379 u64 instant) 10380 { 10381 struct sk_buff *skb; 10382 struct mgmt_ev_mesh_device_found *ev; 10383 int i, j; 10384 10385 if (!hdev->mesh_ad_types[0]) 10386 goto accepted; 10387 10388 /* Scan for requested AD types */ 10389 if (eir_len > 0) { 10390 for (i = 0; i + 1 < eir_len; i += eir[i] + 1) { 10391 for (j = 0; j < sizeof(hdev->mesh_ad_types); j++) { 10392 if (!hdev->mesh_ad_types[j]) 10393 break; 10394 10395 if (hdev->mesh_ad_types[j] == eir[i + 1]) 10396 goto accepted; 10397 } 10398 } 10399 } 10400 10401 if (scan_rsp_len > 0) { 10402 for (i = 0; i + 1 < scan_rsp_len; i += scan_rsp[i] + 1) { 10403 for (j = 0; j < sizeof(hdev->mesh_ad_types); j++) { 10404 if (!hdev->mesh_ad_types[j]) 10405 break; 10406 10407 if (hdev->mesh_ad_types[j] == scan_rsp[i + 1]) 10408 goto accepted; 10409 } 10410 } 10411 } 10412 10413 return; 10414 10415 accepted: 10416 skb = mgmt_alloc_skb(hdev, MGMT_EV_MESH_DEVICE_FOUND, 10417 sizeof(*ev) + eir_len + scan_rsp_len); 10418 if (!skb) 10419 return; 10420 10421 ev = skb_put(skb, sizeof(*ev)); 10422 10423 bacpy(&ev->addr.bdaddr, bdaddr); 10424 ev->addr.type = link_to_bdaddr(LE_LINK, addr_type); 10425 ev->rssi = rssi; 10426 ev->flags = cpu_to_le32(flags); 10427 ev->instant = cpu_to_le64(instant); 10428 10429 if (eir_len > 0) 10430 /* Copy EIR or advertising data into event */ 10431 skb_put_data(skb, eir, eir_len); 10432 10433 if (scan_rsp_len > 0) 10434 /* Append scan response data to event */ 10435 skb_put_data(skb, scan_rsp, scan_rsp_len); 10436 10437 ev->eir_len = cpu_to_le16(eir_len + scan_rsp_len); 10438 10439 mgmt_event_skb(skb, NULL); 10440 } 10441 10442 void mgmt_device_found(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type, 10443 u8 addr_type, u8 *dev_class, s8 rssi, u32 flags, 10444 u8 *eir, u16 eir_len, u8 *scan_rsp, u8 scan_rsp_len, 10445 u64 instant) 10446 { 10447 struct sk_buff *skb; 10448 struct mgmt_ev_device_found *ev; 10449 bool report_device = hci_discovery_active(hdev); 10450 10451 if (hci_dev_test_flag(hdev, HCI_MESH) && link_type == LE_LINK) 10452 mesh_device_found(hdev, bdaddr, addr_type, rssi, flags, 10453 eir, eir_len, scan_rsp, scan_rsp_len, 10454 instant); 10455 10456 /* Don't send events for a non-kernel initiated discovery. With 10457 * LE one exception is if we have pend_le_reports > 0 in which 10458 * case we're doing passive scanning and want these events. 10459 */ 10460 if (!hci_discovery_active(hdev)) { 10461 if (link_type == ACL_LINK) 10462 return; 10463 if (link_type == LE_LINK && !list_empty(&hdev->pend_le_reports)) 10464 report_device = true; 10465 else if (!hci_is_adv_monitoring(hdev)) 10466 return; 10467 } 10468 10469 if (hdev->discovery.result_filtering) { 10470 /* We are using service discovery */ 10471 if (!is_filter_match(hdev, rssi, eir, eir_len, scan_rsp, 10472 scan_rsp_len)) 10473 return; 10474 } 10475 10476 if (hdev->discovery.limited) { 10477 /* Check for limited discoverable bit */ 10478 if (dev_class) { 10479 if (!(dev_class[1] & 0x20)) 10480 return; 10481 } else { 10482 u8 *flags = eir_get_data(eir, eir_len, EIR_FLAGS, NULL); 10483 if (!flags || !(flags[0] & LE_AD_LIMITED)) 10484 return; 10485 } 10486 } 10487 10488 /* Allocate skb. The 5 extra bytes are for the potential CoD field */ 10489 skb = mgmt_alloc_skb(hdev, MGMT_EV_DEVICE_FOUND, 10490 sizeof(*ev) + eir_len + scan_rsp_len + 5); 10491 if (!skb) 10492 return; 10493 10494 ev = skb_put(skb, sizeof(*ev)); 10495 10496 /* In case of device discovery with BR/EDR devices (pre 1.2), the 10497 * RSSI value was reported as 0 when not available. This behavior 10498 * is kept when using device discovery. This is required for full 10499 * backwards compatibility with the API. 10500 * 10501 * However when using service discovery, the value 127 will be 10502 * returned when the RSSI is not available. 10503 */ 10504 if (rssi == HCI_RSSI_INVALID && !hdev->discovery.report_invalid_rssi && 10505 link_type == ACL_LINK) 10506 rssi = 0; 10507 10508 bacpy(&ev->addr.bdaddr, bdaddr); 10509 ev->addr.type = link_to_bdaddr(link_type, addr_type); 10510 ev->rssi = rssi; 10511 ev->flags = cpu_to_le32(flags); 10512 10513 if (eir_len > 0) 10514 /* Copy EIR or advertising data into event */ 10515 skb_put_data(skb, eir, eir_len); 10516 10517 if (dev_class && !eir_get_data(eir, eir_len, EIR_CLASS_OF_DEV, NULL)) { 10518 u8 eir_cod[5]; 10519 10520 eir_len += eir_append_data(eir_cod, 0, EIR_CLASS_OF_DEV, 10521 dev_class, 3); 10522 skb_put_data(skb, eir_cod, sizeof(eir_cod)); 10523 } 10524 10525 if (scan_rsp_len > 0) 10526 /* Append scan response data to event */ 10527 skb_put_data(skb, scan_rsp, scan_rsp_len); 10528 10529 ev->eir_len = cpu_to_le16(eir_len + scan_rsp_len); 10530 10531 mgmt_adv_monitor_device_found(hdev, bdaddr, report_device, skb, NULL); 10532 } 10533 10534 void mgmt_remote_name(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type, 10535 u8 addr_type, s8 rssi, u8 *name, u8 name_len) 10536 { 10537 struct sk_buff *skb; 10538 struct mgmt_ev_device_found *ev; 10539 u16 eir_len = 0; 10540 u32 flags = 0; 10541 10542 skb = mgmt_alloc_skb(hdev, MGMT_EV_DEVICE_FOUND, 10543 sizeof(*ev) + (name ? eir_precalc_len(name_len) : 0)); 10544 if (!skb) 10545 return; 10546 10547 ev = skb_put(skb, sizeof(*ev)); 10548 bacpy(&ev->addr.bdaddr, bdaddr); 10549 ev->addr.type = link_to_bdaddr(link_type, addr_type); 10550 ev->rssi = rssi; 10551 10552 if (name) 10553 eir_len += eir_skb_put_data(skb, EIR_NAME_COMPLETE, name, name_len); 10554 else 10555 flags = MGMT_DEV_FOUND_NAME_REQUEST_FAILED; 10556 10557 ev->eir_len = cpu_to_le16(eir_len); 10558 ev->flags = cpu_to_le32(flags); 10559 10560 mgmt_event_skb(skb, NULL); 10561 } 10562 10563 void mgmt_discovering(struct hci_dev *hdev, u8 discovering) 10564 { 10565 struct mgmt_ev_discovering ev; 10566 10567 bt_dev_dbg(hdev, "discovering %u", discovering); 10568 10569 memset(&ev, 0, sizeof(ev)); 10570 ev.type = hdev->discovery.type; 10571 ev.discovering = discovering; 10572 10573 mgmt_event(MGMT_EV_DISCOVERING, hdev, &ev, sizeof(ev), NULL); 10574 } 10575 10576 void mgmt_suspending(struct hci_dev *hdev, u8 state) 10577 { 10578 struct mgmt_ev_controller_suspend ev; 10579 10580 ev.suspend_state = state; 10581 mgmt_event(MGMT_EV_CONTROLLER_SUSPEND, hdev, &ev, sizeof(ev), NULL); 10582 } 10583 10584 void mgmt_resuming(struct hci_dev *hdev, u8 reason, bdaddr_t *bdaddr, 10585 u8 addr_type) 10586 { 10587 struct mgmt_ev_controller_resume ev; 10588 10589 ev.wake_reason = reason; 10590 if (bdaddr) { 10591 bacpy(&ev.addr.bdaddr, bdaddr); 10592 ev.addr.type = addr_type; 10593 } else { 10594 memset(&ev.addr, 0, sizeof(ev.addr)); 10595 } 10596 10597 mgmt_event(MGMT_EV_CONTROLLER_RESUME, hdev, &ev, sizeof(ev), NULL); 10598 } 10599 10600 static struct hci_mgmt_chan chan = { 10601 .channel = HCI_CHANNEL_CONTROL, 10602 .handler_count = ARRAY_SIZE(mgmt_handlers), 10603 .handlers = mgmt_handlers, 10604 .hdev_init = mgmt_init_hdev, 10605 }; 10606 10607 int mgmt_init(void) 10608 { 10609 return hci_mgmt_chan_register(&chan); 10610 } 10611 10612 void mgmt_exit(void) 10613 { 10614 hci_mgmt_chan_unregister(&chan); 10615 } 10616 10617 void mgmt_cleanup(struct sock *sk) 10618 { 10619 struct mgmt_mesh_tx *mesh_tx; 10620 struct hci_dev *hdev; 10621 10622 read_lock(&hci_dev_list_lock); 10623 10624 list_for_each_entry(hdev, &hci_dev_list, list) { 10625 do { 10626 mesh_tx = mgmt_mesh_next(hdev, sk); 10627 10628 if (mesh_tx) 10629 mesh_send_complete(hdev, mesh_tx, true); 10630 } while (mesh_tx); 10631 } 10632 10633 read_unlock(&hci_dev_list_lock); 10634 } 10635