1 // SPDX-License-Identifier: GPL-2.0 2 /* 3 BlueZ - Bluetooth protocol stack for Linux 4 5 Copyright (C) 2010 Nokia Corporation 6 Copyright (C) 2011-2012 Intel Corporation 7 8 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS 9 OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 10 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS. 11 IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY 12 CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES 13 WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN 14 ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF 15 OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. 16 17 ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS, 18 COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS 19 SOFTWARE IS DISCLAIMED. 20 */ 21 22 /* Bluetooth HCI Management interface */ 23 24 #include <linux/module.h> 25 #include <linux/unaligned.h> 26 27 #include <net/bluetooth/bluetooth.h> 28 #include <net/bluetooth/hci_core.h> 29 #include <net/bluetooth/hci_sock.h> 30 #include <net/bluetooth/l2cap.h> 31 #include <net/bluetooth/mgmt.h> 32 33 #include "smp.h" 34 #include "mgmt_util.h" 35 #include "mgmt_config.h" 36 #include "msft.h" 37 #include "eir.h" 38 #include "aosp.h" 39 40 #define MGMT_VERSION 1 41 #define MGMT_REVISION 23 42 43 static const u16 mgmt_commands[] = { 44 MGMT_OP_READ_INDEX_LIST, 45 MGMT_OP_READ_INFO, 46 MGMT_OP_SET_POWERED, 47 MGMT_OP_SET_DISCOVERABLE, 48 MGMT_OP_SET_CONNECTABLE, 49 MGMT_OP_SET_FAST_CONNECTABLE, 50 MGMT_OP_SET_BONDABLE, 51 MGMT_OP_SET_LINK_SECURITY, 52 MGMT_OP_SET_SSP, 53 MGMT_OP_SET_HS, 54 MGMT_OP_SET_LE, 55 MGMT_OP_SET_DEV_CLASS, 56 MGMT_OP_SET_LOCAL_NAME, 57 MGMT_OP_ADD_UUID, 58 MGMT_OP_REMOVE_UUID, 59 MGMT_OP_LOAD_LINK_KEYS, 60 MGMT_OP_LOAD_LONG_TERM_KEYS, 61 MGMT_OP_DISCONNECT, 62 MGMT_OP_GET_CONNECTIONS, 63 MGMT_OP_PIN_CODE_REPLY, 64 MGMT_OP_PIN_CODE_NEG_REPLY, 65 MGMT_OP_SET_IO_CAPABILITY, 66 MGMT_OP_PAIR_DEVICE, 67 MGMT_OP_CANCEL_PAIR_DEVICE, 68 MGMT_OP_UNPAIR_DEVICE, 69 MGMT_OP_USER_CONFIRM_REPLY, 70 MGMT_OP_USER_CONFIRM_NEG_REPLY, 71 MGMT_OP_USER_PASSKEY_REPLY, 72 MGMT_OP_USER_PASSKEY_NEG_REPLY, 73 MGMT_OP_READ_LOCAL_OOB_DATA, 74 MGMT_OP_ADD_REMOTE_OOB_DATA, 75 MGMT_OP_REMOVE_REMOTE_OOB_DATA, 76 MGMT_OP_START_DISCOVERY, 77 MGMT_OP_STOP_DISCOVERY, 78 MGMT_OP_CONFIRM_NAME, 79 MGMT_OP_BLOCK_DEVICE, 80 MGMT_OP_UNBLOCK_DEVICE, 81 MGMT_OP_SET_DEVICE_ID, 82 MGMT_OP_SET_ADVERTISING, 83 MGMT_OP_SET_BREDR, 84 MGMT_OP_SET_STATIC_ADDRESS, 85 MGMT_OP_SET_SCAN_PARAMS, 86 MGMT_OP_SET_SECURE_CONN, 87 MGMT_OP_SET_DEBUG_KEYS, 88 MGMT_OP_SET_PRIVACY, 89 MGMT_OP_LOAD_IRKS, 90 MGMT_OP_GET_CONN_INFO, 91 MGMT_OP_GET_CLOCK_INFO, 92 MGMT_OP_ADD_DEVICE, 93 MGMT_OP_REMOVE_DEVICE, 94 MGMT_OP_LOAD_CONN_PARAM, 95 MGMT_OP_READ_UNCONF_INDEX_LIST, 96 MGMT_OP_READ_CONFIG_INFO, 97 MGMT_OP_SET_EXTERNAL_CONFIG, 98 MGMT_OP_SET_PUBLIC_ADDRESS, 99 MGMT_OP_START_SERVICE_DISCOVERY, 100 MGMT_OP_READ_LOCAL_OOB_EXT_DATA, 101 MGMT_OP_READ_EXT_INDEX_LIST, 102 MGMT_OP_READ_ADV_FEATURES, 103 MGMT_OP_ADD_ADVERTISING, 104 MGMT_OP_REMOVE_ADVERTISING, 105 MGMT_OP_GET_ADV_SIZE_INFO, 106 MGMT_OP_START_LIMITED_DISCOVERY, 107 MGMT_OP_READ_EXT_INFO, 108 MGMT_OP_SET_APPEARANCE, 109 MGMT_OP_GET_PHY_CONFIGURATION, 110 MGMT_OP_SET_PHY_CONFIGURATION, 111 MGMT_OP_SET_BLOCKED_KEYS, 112 MGMT_OP_SET_WIDEBAND_SPEECH, 113 MGMT_OP_READ_CONTROLLER_CAP, 114 MGMT_OP_READ_EXP_FEATURES_INFO, 115 MGMT_OP_SET_EXP_FEATURE, 116 MGMT_OP_READ_DEF_SYSTEM_CONFIG, 117 MGMT_OP_SET_DEF_SYSTEM_CONFIG, 118 MGMT_OP_READ_DEF_RUNTIME_CONFIG, 119 MGMT_OP_SET_DEF_RUNTIME_CONFIG, 120 MGMT_OP_GET_DEVICE_FLAGS, 121 MGMT_OP_SET_DEVICE_FLAGS, 122 MGMT_OP_READ_ADV_MONITOR_FEATURES, 123 MGMT_OP_ADD_ADV_PATTERNS_MONITOR, 124 MGMT_OP_REMOVE_ADV_MONITOR, 125 MGMT_OP_ADD_EXT_ADV_PARAMS, 126 MGMT_OP_ADD_EXT_ADV_DATA, 127 MGMT_OP_ADD_ADV_PATTERNS_MONITOR_RSSI, 128 MGMT_OP_SET_MESH_RECEIVER, 129 MGMT_OP_MESH_READ_FEATURES, 130 MGMT_OP_MESH_SEND, 131 MGMT_OP_MESH_SEND_CANCEL, 132 MGMT_OP_HCI_CMD_SYNC, 133 }; 134 135 static const u16 mgmt_events[] = { 136 MGMT_EV_CONTROLLER_ERROR, 137 MGMT_EV_INDEX_ADDED, 138 MGMT_EV_INDEX_REMOVED, 139 MGMT_EV_NEW_SETTINGS, 140 MGMT_EV_CLASS_OF_DEV_CHANGED, 141 MGMT_EV_LOCAL_NAME_CHANGED, 142 MGMT_EV_NEW_LINK_KEY, 143 MGMT_EV_NEW_LONG_TERM_KEY, 144 MGMT_EV_DEVICE_CONNECTED, 145 MGMT_EV_DEVICE_DISCONNECTED, 146 MGMT_EV_CONNECT_FAILED, 147 MGMT_EV_PIN_CODE_REQUEST, 148 MGMT_EV_USER_CONFIRM_REQUEST, 149 MGMT_EV_USER_PASSKEY_REQUEST, 150 MGMT_EV_AUTH_FAILED, 151 MGMT_EV_DEVICE_FOUND, 152 MGMT_EV_DISCOVERING, 153 MGMT_EV_DEVICE_BLOCKED, 154 MGMT_EV_DEVICE_UNBLOCKED, 155 MGMT_EV_DEVICE_UNPAIRED, 156 MGMT_EV_PASSKEY_NOTIFY, 157 MGMT_EV_NEW_IRK, 158 MGMT_EV_NEW_CSRK, 159 MGMT_EV_DEVICE_ADDED, 160 MGMT_EV_DEVICE_REMOVED, 161 MGMT_EV_NEW_CONN_PARAM, 162 MGMT_EV_UNCONF_INDEX_ADDED, 163 MGMT_EV_UNCONF_INDEX_REMOVED, 164 MGMT_EV_NEW_CONFIG_OPTIONS, 165 MGMT_EV_EXT_INDEX_ADDED, 166 MGMT_EV_EXT_INDEX_REMOVED, 167 MGMT_EV_LOCAL_OOB_DATA_UPDATED, 168 MGMT_EV_ADVERTISING_ADDED, 169 MGMT_EV_ADVERTISING_REMOVED, 170 MGMT_EV_EXT_INFO_CHANGED, 171 MGMT_EV_PHY_CONFIGURATION_CHANGED, 172 MGMT_EV_EXP_FEATURE_CHANGED, 173 MGMT_EV_DEVICE_FLAGS_CHANGED, 174 MGMT_EV_ADV_MONITOR_ADDED, 175 MGMT_EV_ADV_MONITOR_REMOVED, 176 MGMT_EV_CONTROLLER_SUSPEND, 177 MGMT_EV_CONTROLLER_RESUME, 178 MGMT_EV_ADV_MONITOR_DEVICE_FOUND, 179 MGMT_EV_ADV_MONITOR_DEVICE_LOST, 180 }; 181 182 static const u16 mgmt_untrusted_commands[] = { 183 MGMT_OP_READ_INDEX_LIST, 184 MGMT_OP_READ_INFO, 185 MGMT_OP_READ_UNCONF_INDEX_LIST, 186 MGMT_OP_READ_CONFIG_INFO, 187 MGMT_OP_READ_EXT_INDEX_LIST, 188 MGMT_OP_READ_EXT_INFO, 189 MGMT_OP_READ_CONTROLLER_CAP, 190 MGMT_OP_READ_EXP_FEATURES_INFO, 191 MGMT_OP_READ_DEF_SYSTEM_CONFIG, 192 MGMT_OP_READ_DEF_RUNTIME_CONFIG, 193 }; 194 195 static const u16 mgmt_untrusted_events[] = { 196 MGMT_EV_INDEX_ADDED, 197 MGMT_EV_INDEX_REMOVED, 198 MGMT_EV_NEW_SETTINGS, 199 MGMT_EV_CLASS_OF_DEV_CHANGED, 200 MGMT_EV_LOCAL_NAME_CHANGED, 201 MGMT_EV_UNCONF_INDEX_ADDED, 202 MGMT_EV_UNCONF_INDEX_REMOVED, 203 MGMT_EV_NEW_CONFIG_OPTIONS, 204 MGMT_EV_EXT_INDEX_ADDED, 205 MGMT_EV_EXT_INDEX_REMOVED, 206 MGMT_EV_EXT_INFO_CHANGED, 207 MGMT_EV_EXP_FEATURE_CHANGED, 208 }; 209 210 #define CACHE_TIMEOUT secs_to_jiffies(2) 211 212 #define ZERO_KEY "\x00\x00\x00\x00\x00\x00\x00\x00" \ 213 "\x00\x00\x00\x00\x00\x00\x00\x00" 214 215 /* HCI to MGMT error code conversion table */ 216 static const u8 mgmt_status_table[] = { 217 MGMT_STATUS_SUCCESS, 218 MGMT_STATUS_UNKNOWN_COMMAND, /* Unknown Command */ 219 MGMT_STATUS_NOT_CONNECTED, /* No Connection */ 220 MGMT_STATUS_FAILED, /* Hardware Failure */ 221 MGMT_STATUS_CONNECT_FAILED, /* Page Timeout */ 222 MGMT_STATUS_AUTH_FAILED, /* Authentication Failed */ 223 MGMT_STATUS_AUTH_FAILED, /* PIN or Key Missing */ 224 MGMT_STATUS_NO_RESOURCES, /* Memory Full */ 225 MGMT_STATUS_TIMEOUT, /* Connection Timeout */ 226 MGMT_STATUS_NO_RESOURCES, /* Max Number of Connections */ 227 MGMT_STATUS_NO_RESOURCES, /* Max Number of SCO Connections */ 228 MGMT_STATUS_ALREADY_CONNECTED, /* ACL Connection Exists */ 229 MGMT_STATUS_BUSY, /* Command Disallowed */ 230 MGMT_STATUS_NO_RESOURCES, /* Rejected Limited Resources */ 231 MGMT_STATUS_REJECTED, /* Rejected Security */ 232 MGMT_STATUS_REJECTED, /* Rejected Personal */ 233 MGMT_STATUS_TIMEOUT, /* Host Timeout */ 234 MGMT_STATUS_NOT_SUPPORTED, /* Unsupported Feature */ 235 MGMT_STATUS_INVALID_PARAMS, /* Invalid Parameters */ 236 MGMT_STATUS_DISCONNECTED, /* OE User Ended Connection */ 237 MGMT_STATUS_NO_RESOURCES, /* OE Low Resources */ 238 MGMT_STATUS_DISCONNECTED, /* OE Power Off */ 239 MGMT_STATUS_DISCONNECTED, /* Connection Terminated */ 240 MGMT_STATUS_BUSY, /* Repeated Attempts */ 241 MGMT_STATUS_REJECTED, /* Pairing Not Allowed */ 242 MGMT_STATUS_FAILED, /* Unknown LMP PDU */ 243 MGMT_STATUS_NOT_SUPPORTED, /* Unsupported Remote Feature */ 244 MGMT_STATUS_REJECTED, /* SCO Offset Rejected */ 245 MGMT_STATUS_REJECTED, /* SCO Interval Rejected */ 246 MGMT_STATUS_REJECTED, /* Air Mode Rejected */ 247 MGMT_STATUS_INVALID_PARAMS, /* Invalid LMP Parameters */ 248 MGMT_STATUS_FAILED, /* Unspecified Error */ 249 MGMT_STATUS_NOT_SUPPORTED, /* Unsupported LMP Parameter Value */ 250 MGMT_STATUS_FAILED, /* Role Change Not Allowed */ 251 MGMT_STATUS_TIMEOUT, /* LMP Response Timeout */ 252 MGMT_STATUS_FAILED, /* LMP Error Transaction Collision */ 253 MGMT_STATUS_FAILED, /* LMP PDU Not Allowed */ 254 MGMT_STATUS_REJECTED, /* Encryption Mode Not Accepted */ 255 MGMT_STATUS_FAILED, /* Unit Link Key Used */ 256 MGMT_STATUS_NOT_SUPPORTED, /* QoS Not Supported */ 257 MGMT_STATUS_TIMEOUT, /* Instant Passed */ 258 MGMT_STATUS_NOT_SUPPORTED, /* Pairing Not Supported */ 259 MGMT_STATUS_FAILED, /* Transaction Collision */ 260 MGMT_STATUS_FAILED, /* Reserved for future use */ 261 MGMT_STATUS_INVALID_PARAMS, /* Unacceptable Parameter */ 262 MGMT_STATUS_REJECTED, /* QoS Rejected */ 263 MGMT_STATUS_NOT_SUPPORTED, /* Classification Not Supported */ 264 MGMT_STATUS_REJECTED, /* Insufficient Security */ 265 MGMT_STATUS_INVALID_PARAMS, /* Parameter Out Of Range */ 266 MGMT_STATUS_FAILED, /* Reserved for future use */ 267 MGMT_STATUS_BUSY, /* Role Switch Pending */ 268 MGMT_STATUS_FAILED, /* Reserved for future use */ 269 MGMT_STATUS_FAILED, /* Slot Violation */ 270 MGMT_STATUS_FAILED, /* Role Switch Failed */ 271 MGMT_STATUS_INVALID_PARAMS, /* EIR Too Large */ 272 MGMT_STATUS_NOT_SUPPORTED, /* Simple Pairing Not Supported */ 273 MGMT_STATUS_BUSY, /* Host Busy Pairing */ 274 MGMT_STATUS_REJECTED, /* Rejected, No Suitable Channel */ 275 MGMT_STATUS_BUSY, /* Controller Busy */ 276 MGMT_STATUS_INVALID_PARAMS, /* Unsuitable Connection Interval */ 277 MGMT_STATUS_TIMEOUT, /* Directed Advertising Timeout */ 278 MGMT_STATUS_AUTH_FAILED, /* Terminated Due to MIC Failure */ 279 MGMT_STATUS_CONNECT_FAILED, /* Connection Establishment Failed */ 280 MGMT_STATUS_CONNECT_FAILED, /* MAC Connection Failed */ 281 }; 282 283 static u8 mgmt_errno_status(int err) 284 { 285 switch (err) { 286 case 0: 287 return MGMT_STATUS_SUCCESS; 288 case -EPERM: 289 return MGMT_STATUS_REJECTED; 290 case -EINVAL: 291 return MGMT_STATUS_INVALID_PARAMS; 292 case -EOPNOTSUPP: 293 return MGMT_STATUS_NOT_SUPPORTED; 294 case -EBUSY: 295 return MGMT_STATUS_BUSY; 296 case -ETIMEDOUT: 297 return MGMT_STATUS_AUTH_FAILED; 298 case -ENOMEM: 299 return MGMT_STATUS_NO_RESOURCES; 300 case -EISCONN: 301 return MGMT_STATUS_ALREADY_CONNECTED; 302 case -ENOTCONN: 303 return MGMT_STATUS_DISCONNECTED; 304 } 305 306 return MGMT_STATUS_FAILED; 307 } 308 309 static u8 mgmt_status(int err) 310 { 311 if (err < 0) 312 return mgmt_errno_status(err); 313 314 if (err < ARRAY_SIZE(mgmt_status_table)) 315 return mgmt_status_table[err]; 316 317 return MGMT_STATUS_FAILED; 318 } 319 320 static int mgmt_index_event(u16 event, struct hci_dev *hdev, void *data, 321 u16 len, int flag) 322 { 323 return mgmt_send_event(event, hdev, HCI_CHANNEL_CONTROL, data, len, 324 flag, NULL); 325 } 326 327 static int mgmt_limited_event(u16 event, struct hci_dev *hdev, void *data, 328 u16 len, int flag, struct sock *skip_sk) 329 { 330 return mgmt_send_event(event, hdev, HCI_CHANNEL_CONTROL, data, len, 331 flag, skip_sk); 332 } 333 334 static int mgmt_event(u16 event, struct hci_dev *hdev, void *data, u16 len, 335 struct sock *skip_sk) 336 { 337 return mgmt_send_event(event, hdev, HCI_CHANNEL_CONTROL, data, len, 338 HCI_SOCK_TRUSTED, skip_sk); 339 } 340 341 static int mgmt_event_skb(struct sk_buff *skb, struct sock *skip_sk) 342 { 343 return mgmt_send_event_skb(HCI_CHANNEL_CONTROL, skb, HCI_SOCK_TRUSTED, 344 skip_sk); 345 } 346 347 static u8 le_addr_type(u8 mgmt_addr_type) 348 { 349 if (mgmt_addr_type == BDADDR_LE_PUBLIC) 350 return ADDR_LE_DEV_PUBLIC; 351 else 352 return ADDR_LE_DEV_RANDOM; 353 } 354 355 void mgmt_fill_version_info(void *ver) 356 { 357 struct mgmt_rp_read_version *rp = ver; 358 359 rp->version = MGMT_VERSION; 360 rp->revision = cpu_to_le16(MGMT_REVISION); 361 } 362 363 static int read_version(struct sock *sk, struct hci_dev *hdev, void *data, 364 u16 data_len) 365 { 366 struct mgmt_rp_read_version rp; 367 368 bt_dev_dbg(hdev, "sock %p", sk); 369 370 mgmt_fill_version_info(&rp); 371 372 return mgmt_cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_VERSION, 0, 373 &rp, sizeof(rp)); 374 } 375 376 static int read_commands(struct sock *sk, struct hci_dev *hdev, void *data, 377 u16 data_len) 378 { 379 struct mgmt_rp_read_commands *rp; 380 u16 num_commands, num_events; 381 size_t rp_size; 382 int i, err; 383 384 bt_dev_dbg(hdev, "sock %p", sk); 385 386 if (hci_sock_test_flag(sk, HCI_SOCK_TRUSTED)) { 387 num_commands = ARRAY_SIZE(mgmt_commands); 388 num_events = ARRAY_SIZE(mgmt_events); 389 } else { 390 num_commands = ARRAY_SIZE(mgmt_untrusted_commands); 391 num_events = ARRAY_SIZE(mgmt_untrusted_events); 392 } 393 394 rp_size = sizeof(*rp) + ((num_commands + num_events) * sizeof(u16)); 395 396 rp = kmalloc(rp_size, GFP_KERNEL); 397 if (!rp) 398 return -ENOMEM; 399 400 rp->num_commands = cpu_to_le16(num_commands); 401 rp->num_events = cpu_to_le16(num_events); 402 403 if (hci_sock_test_flag(sk, HCI_SOCK_TRUSTED)) { 404 __le16 *opcode = rp->opcodes; 405 406 for (i = 0; i < num_commands; i++, opcode++) 407 put_unaligned_le16(mgmt_commands[i], opcode); 408 409 for (i = 0; i < num_events; i++, opcode++) 410 put_unaligned_le16(mgmt_events[i], opcode); 411 } else { 412 __le16 *opcode = rp->opcodes; 413 414 for (i = 0; i < num_commands; i++, opcode++) 415 put_unaligned_le16(mgmt_untrusted_commands[i], opcode); 416 417 for (i = 0; i < num_events; i++, opcode++) 418 put_unaligned_le16(mgmt_untrusted_events[i], opcode); 419 } 420 421 err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_COMMANDS, 0, 422 rp, rp_size); 423 kfree(rp); 424 425 return err; 426 } 427 428 static int read_index_list(struct sock *sk, struct hci_dev *hdev, void *data, 429 u16 data_len) 430 { 431 struct mgmt_rp_read_index_list *rp; 432 struct hci_dev *d; 433 size_t rp_len; 434 u16 count; 435 int err; 436 437 bt_dev_dbg(hdev, "sock %p", sk); 438 439 read_lock(&hci_dev_list_lock); 440 441 count = 0; 442 list_for_each_entry(d, &hci_dev_list, list) { 443 if (!hci_dev_test_flag(d, HCI_UNCONFIGURED)) 444 count++; 445 } 446 447 rp_len = sizeof(*rp) + (2 * count); 448 rp = kmalloc(rp_len, GFP_ATOMIC); 449 if (!rp) { 450 read_unlock(&hci_dev_list_lock); 451 return -ENOMEM; 452 } 453 454 count = 0; 455 list_for_each_entry(d, &hci_dev_list, list) { 456 if (hci_dev_test_flag(d, HCI_SETUP) || 457 hci_dev_test_flag(d, HCI_CONFIG) || 458 hci_dev_test_flag(d, HCI_USER_CHANNEL)) 459 continue; 460 461 /* Devices marked as raw-only are neither configured 462 * nor unconfigured controllers. 463 */ 464 if (hci_test_quirk(d, HCI_QUIRK_RAW_DEVICE)) 465 continue; 466 467 if (!hci_dev_test_flag(d, HCI_UNCONFIGURED)) { 468 rp->index[count++] = cpu_to_le16(d->id); 469 bt_dev_dbg(hdev, "Added hci%u", d->id); 470 } 471 } 472 473 rp->num_controllers = cpu_to_le16(count); 474 rp_len = sizeof(*rp) + (2 * count); 475 476 read_unlock(&hci_dev_list_lock); 477 478 err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_INDEX_LIST, 479 0, rp, rp_len); 480 481 kfree(rp); 482 483 return err; 484 } 485 486 static int read_unconf_index_list(struct sock *sk, struct hci_dev *hdev, 487 void *data, u16 data_len) 488 { 489 struct mgmt_rp_read_unconf_index_list *rp; 490 struct hci_dev *d; 491 size_t rp_len; 492 u16 count; 493 int err; 494 495 bt_dev_dbg(hdev, "sock %p", sk); 496 497 read_lock(&hci_dev_list_lock); 498 499 count = 0; 500 list_for_each_entry(d, &hci_dev_list, list) { 501 if (hci_dev_test_flag(d, HCI_UNCONFIGURED)) 502 count++; 503 } 504 505 rp_len = sizeof(*rp) + (2 * count); 506 rp = kmalloc(rp_len, GFP_ATOMIC); 507 if (!rp) { 508 read_unlock(&hci_dev_list_lock); 509 return -ENOMEM; 510 } 511 512 count = 0; 513 list_for_each_entry(d, &hci_dev_list, list) { 514 if (hci_dev_test_flag(d, HCI_SETUP) || 515 hci_dev_test_flag(d, HCI_CONFIG) || 516 hci_dev_test_flag(d, HCI_USER_CHANNEL)) 517 continue; 518 519 /* Devices marked as raw-only are neither configured 520 * nor unconfigured controllers. 521 */ 522 if (hci_test_quirk(d, HCI_QUIRK_RAW_DEVICE)) 523 continue; 524 525 if (hci_dev_test_flag(d, HCI_UNCONFIGURED)) { 526 rp->index[count++] = cpu_to_le16(d->id); 527 bt_dev_dbg(hdev, "Added hci%u", d->id); 528 } 529 } 530 531 rp->num_controllers = cpu_to_le16(count); 532 rp_len = sizeof(*rp) + (2 * count); 533 534 read_unlock(&hci_dev_list_lock); 535 536 err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE, 537 MGMT_OP_READ_UNCONF_INDEX_LIST, 0, rp, rp_len); 538 539 kfree(rp); 540 541 return err; 542 } 543 544 static int read_ext_index_list(struct sock *sk, struct hci_dev *hdev, 545 void *data, u16 data_len) 546 { 547 struct mgmt_rp_read_ext_index_list *rp; 548 struct hci_dev *d; 549 u16 count; 550 int err; 551 552 bt_dev_dbg(hdev, "sock %p", sk); 553 554 read_lock(&hci_dev_list_lock); 555 556 count = 0; 557 list_for_each_entry(d, &hci_dev_list, list) 558 count++; 559 560 rp = kmalloc_flex(*rp, entry, count, GFP_ATOMIC); 561 if (!rp) { 562 read_unlock(&hci_dev_list_lock); 563 return -ENOMEM; 564 } 565 566 count = 0; 567 list_for_each_entry(d, &hci_dev_list, list) { 568 if (hci_dev_test_flag(d, HCI_SETUP) || 569 hci_dev_test_flag(d, HCI_CONFIG) || 570 hci_dev_test_flag(d, HCI_USER_CHANNEL)) 571 continue; 572 573 /* Devices marked as raw-only are neither configured 574 * nor unconfigured controllers. 575 */ 576 if (hci_test_quirk(d, HCI_QUIRK_RAW_DEVICE)) 577 continue; 578 579 if (hci_dev_test_flag(d, HCI_UNCONFIGURED)) 580 rp->entry[count].type = 0x01; 581 else 582 rp->entry[count].type = 0x00; 583 584 rp->entry[count].bus = d->bus; 585 rp->entry[count++].index = cpu_to_le16(d->id); 586 bt_dev_dbg(hdev, "Added hci%u", d->id); 587 } 588 589 rp->num_controllers = cpu_to_le16(count); 590 591 read_unlock(&hci_dev_list_lock); 592 593 /* If this command is called at least once, then all the 594 * default index and unconfigured index events are disabled 595 * and from now on only extended index events are used. 596 */ 597 hci_sock_set_flag(sk, HCI_MGMT_EXT_INDEX_EVENTS); 598 hci_sock_clear_flag(sk, HCI_MGMT_INDEX_EVENTS); 599 hci_sock_clear_flag(sk, HCI_MGMT_UNCONF_INDEX_EVENTS); 600 601 err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE, 602 MGMT_OP_READ_EXT_INDEX_LIST, 0, rp, 603 struct_size(rp, entry, count)); 604 605 kfree(rp); 606 607 return err; 608 } 609 610 static bool is_configured(struct hci_dev *hdev) 611 { 612 if (hci_test_quirk(hdev, HCI_QUIRK_EXTERNAL_CONFIG) && 613 !hci_dev_test_flag(hdev, HCI_EXT_CONFIGURED)) 614 return false; 615 616 if ((hci_test_quirk(hdev, HCI_QUIRK_INVALID_BDADDR) || 617 hci_test_quirk(hdev, HCI_QUIRK_USE_BDADDR_PROPERTY)) && 618 !bacmp(&hdev->public_addr, BDADDR_ANY)) 619 return false; 620 621 return true; 622 } 623 624 static __le32 get_missing_options(struct hci_dev *hdev) 625 { 626 u32 options = 0; 627 628 if (hci_test_quirk(hdev, HCI_QUIRK_EXTERNAL_CONFIG) && 629 !hci_dev_test_flag(hdev, HCI_EXT_CONFIGURED)) 630 options |= MGMT_OPTION_EXTERNAL_CONFIG; 631 632 if ((hci_test_quirk(hdev, HCI_QUIRK_INVALID_BDADDR) || 633 hci_test_quirk(hdev, HCI_QUIRK_USE_BDADDR_PROPERTY)) && 634 !bacmp(&hdev->public_addr, BDADDR_ANY)) 635 options |= MGMT_OPTION_PUBLIC_ADDRESS; 636 637 return cpu_to_le32(options); 638 } 639 640 static int new_options(struct hci_dev *hdev, struct sock *skip) 641 { 642 __le32 options = get_missing_options(hdev); 643 644 return mgmt_limited_event(MGMT_EV_NEW_CONFIG_OPTIONS, hdev, &options, 645 sizeof(options), HCI_MGMT_OPTION_EVENTS, skip); 646 } 647 648 static int send_options_rsp(struct sock *sk, u16 opcode, struct hci_dev *hdev) 649 { 650 __le32 options = get_missing_options(hdev); 651 652 return mgmt_cmd_complete(sk, hdev->id, opcode, 0, &options, 653 sizeof(options)); 654 } 655 656 static int read_config_info(struct sock *sk, struct hci_dev *hdev, 657 void *data, u16 data_len) 658 { 659 struct mgmt_rp_read_config_info rp; 660 u32 options = 0; 661 662 bt_dev_dbg(hdev, "sock %p", sk); 663 664 hci_dev_lock(hdev); 665 666 memset(&rp, 0, sizeof(rp)); 667 rp.manufacturer = cpu_to_le16(hdev->manufacturer); 668 669 if (hci_test_quirk(hdev, HCI_QUIRK_EXTERNAL_CONFIG)) 670 options |= MGMT_OPTION_EXTERNAL_CONFIG; 671 672 if (hdev->set_bdaddr) 673 options |= MGMT_OPTION_PUBLIC_ADDRESS; 674 675 rp.supported_options = cpu_to_le32(options); 676 rp.missing_options = get_missing_options(hdev); 677 678 hci_dev_unlock(hdev); 679 680 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_CONFIG_INFO, 0, 681 &rp, sizeof(rp)); 682 } 683 684 static u32 get_supported_phys(struct hci_dev *hdev) 685 { 686 u32 supported_phys = 0; 687 688 if (lmp_bredr_capable(hdev)) { 689 supported_phys |= MGMT_PHY_BR_1M_1SLOT; 690 691 if (hdev->features[0][0] & LMP_3SLOT) 692 supported_phys |= MGMT_PHY_BR_1M_3SLOT; 693 694 if (hdev->features[0][0] & LMP_5SLOT) 695 supported_phys |= MGMT_PHY_BR_1M_5SLOT; 696 697 if (lmp_edr_2m_capable(hdev)) { 698 supported_phys |= MGMT_PHY_EDR_2M_1SLOT; 699 700 if (lmp_edr_3slot_capable(hdev)) 701 supported_phys |= MGMT_PHY_EDR_2M_3SLOT; 702 703 if (lmp_edr_5slot_capable(hdev)) 704 supported_phys |= MGMT_PHY_EDR_2M_5SLOT; 705 706 if (lmp_edr_3m_capable(hdev)) { 707 supported_phys |= MGMT_PHY_EDR_3M_1SLOT; 708 709 if (lmp_edr_3slot_capable(hdev)) 710 supported_phys |= MGMT_PHY_EDR_3M_3SLOT; 711 712 if (lmp_edr_5slot_capable(hdev)) 713 supported_phys |= MGMT_PHY_EDR_3M_5SLOT; 714 } 715 } 716 } 717 718 if (lmp_le_capable(hdev)) { 719 supported_phys |= MGMT_PHY_LE_1M_TX; 720 supported_phys |= MGMT_PHY_LE_1M_RX; 721 722 if (hdev->le_features[1] & HCI_LE_PHY_2M) { 723 supported_phys |= MGMT_PHY_LE_2M_TX; 724 supported_phys |= MGMT_PHY_LE_2M_RX; 725 } 726 727 if (hdev->le_features[1] & HCI_LE_PHY_CODED) { 728 supported_phys |= MGMT_PHY_LE_CODED_TX; 729 supported_phys |= MGMT_PHY_LE_CODED_RX; 730 } 731 } 732 733 return supported_phys; 734 } 735 736 static u32 get_selected_phys(struct hci_dev *hdev) 737 { 738 u32 selected_phys = 0; 739 740 if (lmp_bredr_capable(hdev)) { 741 selected_phys |= MGMT_PHY_BR_1M_1SLOT; 742 743 if (hdev->pkt_type & (HCI_DM3 | HCI_DH3)) 744 selected_phys |= MGMT_PHY_BR_1M_3SLOT; 745 746 if (hdev->pkt_type & (HCI_DM5 | HCI_DH5)) 747 selected_phys |= MGMT_PHY_BR_1M_5SLOT; 748 749 if (lmp_edr_2m_capable(hdev)) { 750 if (!(hdev->pkt_type & HCI_2DH1)) 751 selected_phys |= MGMT_PHY_EDR_2M_1SLOT; 752 753 if (lmp_edr_3slot_capable(hdev) && 754 !(hdev->pkt_type & HCI_2DH3)) 755 selected_phys |= MGMT_PHY_EDR_2M_3SLOT; 756 757 if (lmp_edr_5slot_capable(hdev) && 758 !(hdev->pkt_type & HCI_2DH5)) 759 selected_phys |= MGMT_PHY_EDR_2M_5SLOT; 760 761 if (lmp_edr_3m_capable(hdev)) { 762 if (!(hdev->pkt_type & HCI_3DH1)) 763 selected_phys |= MGMT_PHY_EDR_3M_1SLOT; 764 765 if (lmp_edr_3slot_capable(hdev) && 766 !(hdev->pkt_type & HCI_3DH3)) 767 selected_phys |= MGMT_PHY_EDR_3M_3SLOT; 768 769 if (lmp_edr_5slot_capable(hdev) && 770 !(hdev->pkt_type & HCI_3DH5)) 771 selected_phys |= MGMT_PHY_EDR_3M_5SLOT; 772 } 773 } 774 } 775 776 if (lmp_le_capable(hdev)) { 777 if (hdev->le_tx_def_phys & HCI_LE_SET_PHY_1M) 778 selected_phys |= MGMT_PHY_LE_1M_TX; 779 780 if (hdev->le_rx_def_phys & HCI_LE_SET_PHY_1M) 781 selected_phys |= MGMT_PHY_LE_1M_RX; 782 783 if (hdev->le_tx_def_phys & HCI_LE_SET_PHY_2M) 784 selected_phys |= MGMT_PHY_LE_2M_TX; 785 786 if (hdev->le_rx_def_phys & HCI_LE_SET_PHY_2M) 787 selected_phys |= MGMT_PHY_LE_2M_RX; 788 789 if (hdev->le_tx_def_phys & HCI_LE_SET_PHY_CODED) 790 selected_phys |= MGMT_PHY_LE_CODED_TX; 791 792 if (hdev->le_rx_def_phys & HCI_LE_SET_PHY_CODED) 793 selected_phys |= MGMT_PHY_LE_CODED_RX; 794 } 795 796 return selected_phys; 797 } 798 799 static u32 get_configurable_phys(struct hci_dev *hdev) 800 { 801 return (get_supported_phys(hdev) & ~MGMT_PHY_BR_1M_1SLOT & 802 ~MGMT_PHY_LE_1M_TX & ~MGMT_PHY_LE_1M_RX); 803 } 804 805 static u32 get_supported_settings(struct hci_dev *hdev) 806 { 807 u32 settings = 0; 808 809 settings |= MGMT_SETTING_POWERED; 810 settings |= MGMT_SETTING_BONDABLE; 811 settings |= MGMT_SETTING_DEBUG_KEYS; 812 settings |= MGMT_SETTING_CONNECTABLE; 813 settings |= MGMT_SETTING_DISCOVERABLE; 814 815 if (lmp_bredr_capable(hdev)) { 816 if (hdev->hci_ver >= BLUETOOTH_VER_1_2) 817 settings |= MGMT_SETTING_FAST_CONNECTABLE; 818 settings |= MGMT_SETTING_BREDR; 819 settings |= MGMT_SETTING_LINK_SECURITY; 820 821 if (lmp_ssp_capable(hdev)) { 822 settings |= MGMT_SETTING_SSP; 823 } 824 825 if (lmp_sc_capable(hdev)) 826 settings |= MGMT_SETTING_SECURE_CONN; 827 828 if (hci_test_quirk(hdev, HCI_QUIRK_WIDEBAND_SPEECH_SUPPORTED)) 829 settings |= MGMT_SETTING_WIDEBAND_SPEECH; 830 } 831 832 if (lmp_le_capable(hdev)) { 833 settings |= MGMT_SETTING_LE; 834 settings |= MGMT_SETTING_SECURE_CONN; 835 settings |= MGMT_SETTING_PRIVACY; 836 settings |= MGMT_SETTING_STATIC_ADDRESS; 837 settings |= MGMT_SETTING_ADVERTISING; 838 } 839 840 if (hci_test_quirk(hdev, HCI_QUIRK_EXTERNAL_CONFIG) || hdev->set_bdaddr) 841 settings |= MGMT_SETTING_CONFIGURATION; 842 843 if (cis_central_capable(hdev)) 844 settings |= MGMT_SETTING_CIS_CENTRAL; 845 846 if (cis_peripheral_capable(hdev)) 847 settings |= MGMT_SETTING_CIS_PERIPHERAL; 848 849 if (bis_capable(hdev)) 850 settings |= MGMT_SETTING_ISO_BROADCASTER; 851 852 if (sync_recv_capable(hdev)) 853 settings |= MGMT_SETTING_ISO_SYNC_RECEIVER; 854 855 if (ll_privacy_capable(hdev)) 856 settings |= MGMT_SETTING_LL_PRIVACY; 857 858 if (past_sender_capable(hdev)) 859 settings |= MGMT_SETTING_PAST_SENDER; 860 861 if (past_receiver_capable(hdev)) 862 settings |= MGMT_SETTING_PAST_RECEIVER; 863 864 settings |= MGMT_SETTING_PHY_CONFIGURATION; 865 866 return settings; 867 } 868 869 static u32 get_current_settings(struct hci_dev *hdev) 870 { 871 u32 settings = 0; 872 873 if (hdev_is_powered(hdev)) 874 settings |= MGMT_SETTING_POWERED; 875 876 if (hci_dev_test_flag(hdev, HCI_CONNECTABLE)) 877 settings |= MGMT_SETTING_CONNECTABLE; 878 879 if (hci_dev_test_flag(hdev, HCI_FAST_CONNECTABLE)) 880 settings |= MGMT_SETTING_FAST_CONNECTABLE; 881 882 if (hci_dev_test_flag(hdev, HCI_DISCOVERABLE)) 883 settings |= MGMT_SETTING_DISCOVERABLE; 884 885 if (hci_dev_test_flag(hdev, HCI_BONDABLE)) 886 settings |= MGMT_SETTING_BONDABLE; 887 888 if (hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) 889 settings |= MGMT_SETTING_BREDR; 890 891 if (hci_dev_test_flag(hdev, HCI_LE_ENABLED)) 892 settings |= MGMT_SETTING_LE; 893 894 if (hci_dev_test_flag(hdev, HCI_LINK_SECURITY)) 895 settings |= MGMT_SETTING_LINK_SECURITY; 896 897 if (hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) 898 settings |= MGMT_SETTING_SSP; 899 900 if (hci_dev_test_flag(hdev, HCI_ADVERTISING)) 901 settings |= MGMT_SETTING_ADVERTISING; 902 903 if (hci_dev_test_flag(hdev, HCI_SC_ENABLED)) 904 settings |= MGMT_SETTING_SECURE_CONN; 905 906 if (hci_dev_test_flag(hdev, HCI_KEEP_DEBUG_KEYS)) 907 settings |= MGMT_SETTING_DEBUG_KEYS; 908 909 if (hci_dev_test_flag(hdev, HCI_PRIVACY)) 910 settings |= MGMT_SETTING_PRIVACY; 911 912 /* The current setting for static address has two purposes. The 913 * first is to indicate if the static address will be used and 914 * the second is to indicate if it is actually set. 915 * 916 * This means if the static address is not configured, this flag 917 * will never be set. If the address is configured, then if the 918 * address is actually used decides if the flag is set or not. 919 * 920 * For single mode LE only controllers and dual-mode controllers 921 * with BR/EDR disabled, the existence of the static address will 922 * be evaluated. 923 */ 924 if (hci_dev_test_flag(hdev, HCI_FORCE_STATIC_ADDR) || 925 !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) || 926 !bacmp(&hdev->bdaddr, BDADDR_ANY)) { 927 if (bacmp(&hdev->static_addr, BDADDR_ANY)) 928 settings |= MGMT_SETTING_STATIC_ADDRESS; 929 } 930 931 if (hci_dev_test_flag(hdev, HCI_WIDEBAND_SPEECH_ENABLED)) 932 settings |= MGMT_SETTING_WIDEBAND_SPEECH; 933 934 if (cis_central_enabled(hdev)) 935 settings |= MGMT_SETTING_CIS_CENTRAL; 936 937 if (cis_peripheral_enabled(hdev)) 938 settings |= MGMT_SETTING_CIS_PERIPHERAL; 939 940 if (bis_enabled(hdev)) 941 settings |= MGMT_SETTING_ISO_BROADCASTER; 942 943 if (sync_recv_enabled(hdev)) 944 settings |= MGMT_SETTING_ISO_SYNC_RECEIVER; 945 946 if (ll_privacy_enabled(hdev)) 947 settings |= MGMT_SETTING_LL_PRIVACY; 948 949 if (past_sender_enabled(hdev)) 950 settings |= MGMT_SETTING_PAST_SENDER; 951 952 if (past_receiver_enabled(hdev)) 953 settings |= MGMT_SETTING_PAST_RECEIVER; 954 955 return settings; 956 } 957 958 static struct mgmt_pending_cmd *pending_find(u16 opcode, struct hci_dev *hdev) 959 { 960 return mgmt_pending_find(HCI_CHANNEL_CONTROL, opcode, hdev); 961 } 962 963 u8 mgmt_get_adv_discov_flags(struct hci_dev *hdev) 964 { 965 struct mgmt_pending_cmd *cmd; 966 967 /* If there's a pending mgmt command the flags will not yet have 968 * their final values, so check for this first. 969 */ 970 cmd = pending_find(MGMT_OP_SET_DISCOVERABLE, hdev); 971 if (cmd) { 972 struct mgmt_mode *cp = cmd->param; 973 if (cp->val == 0x01) 974 return LE_AD_GENERAL; 975 else if (cp->val == 0x02) 976 return LE_AD_LIMITED; 977 } else { 978 if (hci_dev_test_flag(hdev, HCI_LIMITED_DISCOVERABLE)) 979 return LE_AD_LIMITED; 980 else if (hci_dev_test_flag(hdev, HCI_DISCOVERABLE)) 981 return LE_AD_GENERAL; 982 } 983 984 return 0; 985 } 986 987 bool mgmt_get_connectable(struct hci_dev *hdev) 988 { 989 struct mgmt_pending_cmd *cmd; 990 991 /* If there's a pending mgmt command the flag will not yet have 992 * it's final value, so check for this first. 993 */ 994 cmd = pending_find(MGMT_OP_SET_CONNECTABLE, hdev); 995 if (cmd) { 996 struct mgmt_mode *cp = cmd->param; 997 998 return cp->val; 999 } 1000 1001 return hci_dev_test_flag(hdev, HCI_CONNECTABLE); 1002 } 1003 1004 static int service_cache_sync(struct hci_dev *hdev, void *data) 1005 { 1006 hci_update_eir_sync(hdev); 1007 hci_update_class_sync(hdev); 1008 1009 return 0; 1010 } 1011 1012 static void service_cache_off(struct work_struct *work) 1013 { 1014 struct hci_dev *hdev = container_of(work, struct hci_dev, 1015 service_cache.work); 1016 1017 if (!hci_dev_test_and_clear_flag(hdev, HCI_SERVICE_CACHE)) 1018 return; 1019 1020 hci_cmd_sync_queue(hdev, service_cache_sync, NULL, NULL); 1021 } 1022 1023 static int rpa_expired_sync(struct hci_dev *hdev, void *data) 1024 { 1025 /* The generation of a new RPA and programming it into the 1026 * controller happens in the hci_req_enable_advertising() 1027 * function. 1028 */ 1029 if (ext_adv_capable(hdev)) 1030 return hci_start_ext_adv_sync(hdev, hdev->cur_adv_instance); 1031 else 1032 return hci_enable_advertising_sync(hdev); 1033 } 1034 1035 static void rpa_expired(struct work_struct *work) 1036 { 1037 struct hci_dev *hdev = container_of(work, struct hci_dev, 1038 rpa_expired.work); 1039 1040 bt_dev_dbg(hdev, ""); 1041 1042 hci_dev_set_flag(hdev, HCI_RPA_EXPIRED); 1043 1044 if (!hci_dev_test_flag(hdev, HCI_ADVERTISING)) 1045 return; 1046 1047 hci_cmd_sync_queue(hdev, rpa_expired_sync, NULL, NULL); 1048 } 1049 1050 static int set_discoverable_sync(struct hci_dev *hdev, void *data); 1051 1052 static void discov_off(struct work_struct *work) 1053 { 1054 struct hci_dev *hdev = container_of(work, struct hci_dev, 1055 discov_off.work); 1056 1057 bt_dev_dbg(hdev, ""); 1058 1059 hci_dev_lock(hdev); 1060 1061 /* When discoverable timeout triggers, then just make sure 1062 * the limited discoverable flag is cleared. Even in the case 1063 * of a timeout triggered from general discoverable, it is 1064 * safe to unconditionally clear the flag. 1065 */ 1066 hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE); 1067 hci_dev_clear_flag(hdev, HCI_DISCOVERABLE); 1068 hdev->discov_timeout = 0; 1069 1070 hci_cmd_sync_queue(hdev, set_discoverable_sync, NULL, NULL); 1071 1072 mgmt_new_settings(hdev); 1073 1074 hci_dev_unlock(hdev); 1075 } 1076 1077 static int send_settings_rsp(struct sock *sk, u16 opcode, struct hci_dev *hdev); 1078 1079 static void mesh_send_complete(struct hci_dev *hdev, 1080 struct mgmt_mesh_tx *mesh_tx, bool silent) 1081 { 1082 u8 handle = mesh_tx->handle; 1083 1084 if (!silent) 1085 mgmt_event(MGMT_EV_MESH_PACKET_CMPLT, hdev, &handle, 1086 sizeof(handle), NULL); 1087 1088 mgmt_mesh_remove(mesh_tx); 1089 } 1090 1091 static int mesh_send_done_sync(struct hci_dev *hdev, void *data) 1092 { 1093 struct mgmt_mesh_tx *mesh_tx; 1094 1095 hci_dev_clear_flag(hdev, HCI_MESH_SENDING); 1096 if (list_empty(&hdev->adv_instances)) 1097 hci_disable_advertising_sync(hdev); 1098 mesh_tx = mgmt_mesh_next(hdev, NULL); 1099 1100 if (mesh_tx) 1101 mesh_send_complete(hdev, mesh_tx, false); 1102 1103 return 0; 1104 } 1105 1106 static int mesh_send_sync(struct hci_dev *hdev, void *data); 1107 static void mesh_send_start_complete(struct hci_dev *hdev, void *data, int err); 1108 static void mesh_next(struct hci_dev *hdev, void *data, int err) 1109 { 1110 struct mgmt_mesh_tx *mesh_tx = mgmt_mesh_next(hdev, NULL); 1111 1112 if (!mesh_tx) 1113 return; 1114 1115 err = hci_cmd_sync_queue(hdev, mesh_send_sync, mesh_tx, 1116 mesh_send_start_complete); 1117 1118 if (err < 0) 1119 mesh_send_complete(hdev, mesh_tx, false); 1120 else 1121 hci_dev_set_flag(hdev, HCI_MESH_SENDING); 1122 } 1123 1124 static void mesh_send_done(struct work_struct *work) 1125 { 1126 struct hci_dev *hdev = container_of(work, struct hci_dev, 1127 mesh_send_done.work); 1128 1129 if (!hci_dev_test_flag(hdev, HCI_MESH_SENDING)) 1130 return; 1131 1132 hci_cmd_sync_queue(hdev, mesh_send_done_sync, NULL, mesh_next); 1133 } 1134 1135 static void mgmt_init_hdev(struct sock *sk, struct hci_dev *hdev) 1136 { 1137 if (hci_dev_test_flag(hdev, HCI_MGMT)) 1138 return; 1139 1140 BT_INFO("MGMT ver %d.%d", MGMT_VERSION, MGMT_REVISION); 1141 1142 INIT_DELAYED_WORK(&hdev->discov_off, discov_off); 1143 INIT_DELAYED_WORK(&hdev->service_cache, service_cache_off); 1144 INIT_DELAYED_WORK(&hdev->rpa_expired, rpa_expired); 1145 INIT_DELAYED_WORK(&hdev->mesh_send_done, mesh_send_done); 1146 1147 /* Non-mgmt controlled devices get this bit set 1148 * implicitly so that pairing works for them, however 1149 * for mgmt we require user-space to explicitly enable 1150 * it 1151 */ 1152 hci_dev_clear_flag(hdev, HCI_BONDABLE); 1153 1154 hci_dev_set_flag(hdev, HCI_MGMT); 1155 } 1156 1157 static int read_controller_info(struct sock *sk, struct hci_dev *hdev, 1158 void *data, u16 data_len) 1159 { 1160 struct mgmt_rp_read_info rp; 1161 1162 bt_dev_dbg(hdev, "sock %p", sk); 1163 1164 hci_dev_lock(hdev); 1165 1166 memset(&rp, 0, sizeof(rp)); 1167 1168 bacpy(&rp.bdaddr, &hdev->bdaddr); 1169 1170 rp.version = hdev->hci_ver; 1171 rp.manufacturer = cpu_to_le16(hdev->manufacturer); 1172 1173 rp.supported_settings = cpu_to_le32(get_supported_settings(hdev)); 1174 rp.current_settings = cpu_to_le32(get_current_settings(hdev)); 1175 1176 memcpy(rp.dev_class, hdev->dev_class, 3); 1177 1178 memcpy(rp.name, hdev->dev_name, sizeof(hdev->dev_name)); 1179 memcpy(rp.short_name, hdev->short_name, sizeof(hdev->short_name)); 1180 1181 hci_dev_unlock(hdev); 1182 1183 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_INFO, 0, &rp, 1184 sizeof(rp)); 1185 } 1186 1187 static u16 append_eir_data_to_buf(struct hci_dev *hdev, u8 *eir) 1188 { 1189 u16 eir_len = 0; 1190 size_t name_len; 1191 1192 if (hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) 1193 eir_len = eir_append_data(eir, eir_len, EIR_CLASS_OF_DEV, 1194 hdev->dev_class, 3); 1195 1196 if (hci_dev_test_flag(hdev, HCI_LE_ENABLED)) 1197 eir_len = eir_append_le16(eir, eir_len, EIR_APPEARANCE, 1198 hdev->appearance); 1199 1200 name_len = strnlen(hdev->dev_name, sizeof(hdev->dev_name)); 1201 eir_len = eir_append_data(eir, eir_len, EIR_NAME_COMPLETE, 1202 hdev->dev_name, name_len); 1203 1204 name_len = strnlen(hdev->short_name, sizeof(hdev->short_name)); 1205 eir_len = eir_append_data(eir, eir_len, EIR_NAME_SHORT, 1206 hdev->short_name, name_len); 1207 1208 return eir_len; 1209 } 1210 1211 static int read_ext_controller_info(struct sock *sk, struct hci_dev *hdev, 1212 void *data, u16 data_len) 1213 { 1214 char buf[512]; 1215 struct mgmt_rp_read_ext_info *rp = (void *)buf; 1216 u16 eir_len; 1217 1218 bt_dev_dbg(hdev, "sock %p", sk); 1219 1220 memset(&buf, 0, sizeof(buf)); 1221 1222 hci_dev_lock(hdev); 1223 1224 bacpy(&rp->bdaddr, &hdev->bdaddr); 1225 1226 rp->version = hdev->hci_ver; 1227 rp->manufacturer = cpu_to_le16(hdev->manufacturer); 1228 1229 rp->supported_settings = cpu_to_le32(get_supported_settings(hdev)); 1230 rp->current_settings = cpu_to_le32(get_current_settings(hdev)); 1231 1232 1233 eir_len = append_eir_data_to_buf(hdev, rp->eir); 1234 rp->eir_len = cpu_to_le16(eir_len); 1235 1236 hci_dev_unlock(hdev); 1237 1238 /* If this command is called at least once, then the events 1239 * for class of device and local name changes are disabled 1240 * and only the new extended controller information event 1241 * is used. 1242 */ 1243 hci_sock_set_flag(sk, HCI_MGMT_EXT_INFO_EVENTS); 1244 hci_sock_clear_flag(sk, HCI_MGMT_DEV_CLASS_EVENTS); 1245 hci_sock_clear_flag(sk, HCI_MGMT_LOCAL_NAME_EVENTS); 1246 1247 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_EXT_INFO, 0, rp, 1248 sizeof(*rp) + eir_len); 1249 } 1250 1251 static int ext_info_changed(struct hci_dev *hdev, struct sock *skip) 1252 { 1253 char buf[512]; 1254 struct mgmt_ev_ext_info_changed *ev = (void *)buf; 1255 u16 eir_len; 1256 1257 memset(buf, 0, sizeof(buf)); 1258 1259 eir_len = append_eir_data_to_buf(hdev, ev->eir); 1260 ev->eir_len = cpu_to_le16(eir_len); 1261 1262 return mgmt_limited_event(MGMT_EV_EXT_INFO_CHANGED, hdev, ev, 1263 sizeof(*ev) + eir_len, 1264 HCI_MGMT_EXT_INFO_EVENTS, skip); 1265 } 1266 1267 static int send_settings_rsp(struct sock *sk, u16 opcode, struct hci_dev *hdev) 1268 { 1269 __le32 settings = cpu_to_le32(get_current_settings(hdev)); 1270 1271 return mgmt_cmd_complete(sk, hdev->id, opcode, 0, &settings, 1272 sizeof(settings)); 1273 } 1274 1275 void mgmt_advertising_added(struct sock *sk, struct hci_dev *hdev, u8 instance) 1276 { 1277 struct mgmt_ev_advertising_added ev; 1278 1279 ev.instance = instance; 1280 1281 mgmt_event(MGMT_EV_ADVERTISING_ADDED, hdev, &ev, sizeof(ev), sk); 1282 } 1283 1284 void mgmt_advertising_removed(struct sock *sk, struct hci_dev *hdev, 1285 u8 instance) 1286 { 1287 struct mgmt_ev_advertising_removed ev; 1288 1289 ev.instance = instance; 1290 1291 mgmt_event(MGMT_EV_ADVERTISING_REMOVED, hdev, &ev, sizeof(ev), sk); 1292 } 1293 1294 static void cancel_adv_timeout(struct hci_dev *hdev) 1295 { 1296 if (hdev->adv_instance_timeout) { 1297 hdev->adv_instance_timeout = 0; 1298 cancel_delayed_work(&hdev->adv_instance_expire); 1299 } 1300 } 1301 1302 /* This function requires the caller holds hdev->lock */ 1303 static void restart_le_actions(struct hci_dev *hdev) 1304 { 1305 struct hci_conn_params *p; 1306 1307 list_for_each_entry(p, &hdev->le_conn_params, list) { 1308 /* Needed for AUTO_OFF case where might not "really" 1309 * have been powered off. 1310 */ 1311 hci_pend_le_list_del_init(p); 1312 1313 switch (p->auto_connect) { 1314 case HCI_AUTO_CONN_DIRECT: 1315 case HCI_AUTO_CONN_ALWAYS: 1316 hci_pend_le_list_add(p, &hdev->pend_le_conns); 1317 break; 1318 case HCI_AUTO_CONN_REPORT: 1319 hci_pend_le_list_add(p, &hdev->pend_le_reports); 1320 break; 1321 default: 1322 break; 1323 } 1324 } 1325 } 1326 1327 static int new_settings(struct hci_dev *hdev, struct sock *skip) 1328 { 1329 __le32 ev = cpu_to_le32(get_current_settings(hdev)); 1330 1331 return mgmt_limited_event(MGMT_EV_NEW_SETTINGS, hdev, &ev, 1332 sizeof(ev), HCI_MGMT_SETTING_EVENTS, skip); 1333 } 1334 1335 static void mgmt_set_powered_complete(struct hci_dev *hdev, void *data, int err) 1336 { 1337 struct mgmt_pending_cmd *cmd = data; 1338 struct mgmt_mode *cp; 1339 1340 /* Make sure cmd still outstanding. */ 1341 if (err == -ECANCELED || !mgmt_pending_valid(hdev, cmd)) 1342 return; 1343 1344 cp = cmd->param; 1345 1346 bt_dev_dbg(hdev, "err %d", err); 1347 1348 if (!err) { 1349 if (cp->val) { 1350 hci_dev_lock(hdev); 1351 restart_le_actions(hdev); 1352 hci_update_passive_scan(hdev); 1353 hci_dev_unlock(hdev); 1354 } 1355 1356 send_settings_rsp(cmd->sk, cmd->opcode, hdev); 1357 1358 /* Only call new_setting for power on as power off is deferred 1359 * to hdev->power_off work which does call hci_dev_do_close. 1360 */ 1361 if (cp->val) 1362 new_settings(hdev, cmd->sk); 1363 } else { 1364 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_POWERED, 1365 mgmt_status(err)); 1366 } 1367 1368 mgmt_pending_free(cmd); 1369 } 1370 1371 static int set_powered_sync(struct hci_dev *hdev, void *data) 1372 { 1373 struct mgmt_pending_cmd *cmd = data; 1374 struct mgmt_mode cp; 1375 1376 mutex_lock(&hdev->mgmt_pending_lock); 1377 1378 /* Make sure cmd still outstanding. */ 1379 if (!__mgmt_pending_listed(hdev, cmd)) { 1380 mutex_unlock(&hdev->mgmt_pending_lock); 1381 return -ECANCELED; 1382 } 1383 1384 memcpy(&cp, cmd->param, sizeof(cp)); 1385 1386 mutex_unlock(&hdev->mgmt_pending_lock); 1387 1388 BT_DBG("%s", hdev->name); 1389 1390 return hci_set_powered_sync(hdev, cp.val); 1391 } 1392 1393 static int set_powered(struct sock *sk, struct hci_dev *hdev, void *data, 1394 u16 len) 1395 { 1396 struct mgmt_mode *cp = data; 1397 struct mgmt_pending_cmd *cmd; 1398 int err; 1399 1400 bt_dev_dbg(hdev, "sock %p", sk); 1401 1402 if (cp->val != 0x00 && cp->val != 0x01) 1403 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED, 1404 MGMT_STATUS_INVALID_PARAMS); 1405 1406 hci_dev_lock(hdev); 1407 1408 if (!cp->val) { 1409 if (hci_dev_test_flag(hdev, HCI_POWERING_DOWN)) { 1410 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED, 1411 MGMT_STATUS_BUSY); 1412 goto failed; 1413 } 1414 } 1415 1416 if (pending_find(MGMT_OP_SET_POWERED, hdev)) { 1417 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED, 1418 MGMT_STATUS_BUSY); 1419 goto failed; 1420 } 1421 1422 if (!!cp->val == hdev_is_powered(hdev)) { 1423 err = send_settings_rsp(sk, MGMT_OP_SET_POWERED, hdev); 1424 goto failed; 1425 } 1426 1427 cmd = mgmt_pending_add(sk, MGMT_OP_SET_POWERED, hdev, data, len); 1428 if (!cmd) { 1429 err = -ENOMEM; 1430 goto failed; 1431 } 1432 1433 /* Cancel potentially blocking sync operation before power off */ 1434 if (cp->val == 0x00) { 1435 hci_cmd_sync_cancel_sync(hdev, -EHOSTDOWN); 1436 err = hci_cmd_sync_queue(hdev, set_powered_sync, cmd, 1437 mgmt_set_powered_complete); 1438 } else { 1439 /* Use hci_cmd_sync_submit since hdev might not be running */ 1440 err = hci_cmd_sync_submit(hdev, set_powered_sync, cmd, 1441 mgmt_set_powered_complete); 1442 } 1443 1444 if (err < 0) 1445 mgmt_pending_remove(cmd); 1446 1447 failed: 1448 hci_dev_unlock(hdev); 1449 return err; 1450 } 1451 1452 int mgmt_new_settings(struct hci_dev *hdev) 1453 { 1454 return new_settings(hdev, NULL); 1455 } 1456 1457 struct cmd_lookup { 1458 struct sock *sk; 1459 struct hci_dev *hdev; 1460 u8 mgmt_status; 1461 }; 1462 1463 static void settings_rsp(struct mgmt_pending_cmd *cmd, void *data) 1464 { 1465 struct cmd_lookup *match = data; 1466 1467 send_settings_rsp(cmd->sk, cmd->opcode, match->hdev); 1468 1469 if (match->sk == NULL) { 1470 match->sk = cmd->sk; 1471 sock_hold(match->sk); 1472 } 1473 } 1474 1475 static void cmd_status_rsp(struct mgmt_pending_cmd *cmd, void *data) 1476 { 1477 u8 *status = data; 1478 1479 mgmt_cmd_status(cmd->sk, cmd->hdev->id, cmd->opcode, *status); 1480 } 1481 1482 static void cmd_complete_rsp(struct mgmt_pending_cmd *cmd, void *data) 1483 { 1484 struct cmd_lookup *match = data; 1485 1486 /* dequeue cmd_sync entries using cmd as data as that is about to be 1487 * removed/freed. 1488 */ 1489 hci_cmd_sync_dequeue(match->hdev, NULL, cmd, NULL); 1490 1491 if (cmd->cmd_complete) { 1492 cmd->cmd_complete(cmd, match->mgmt_status); 1493 return; 1494 } 1495 1496 cmd_status_rsp(cmd, data); 1497 } 1498 1499 static int generic_cmd_complete(struct mgmt_pending_cmd *cmd, u8 status) 1500 { 1501 return mgmt_cmd_complete(cmd->sk, cmd->hdev->id, cmd->opcode, status, 1502 cmd->param, cmd->param_len); 1503 } 1504 1505 static int addr_cmd_complete(struct mgmt_pending_cmd *cmd, u8 status) 1506 { 1507 return mgmt_cmd_complete(cmd->sk, cmd->hdev->id, cmd->opcode, status, 1508 cmd->param, sizeof(struct mgmt_addr_info)); 1509 } 1510 1511 static u8 mgmt_bredr_support(struct hci_dev *hdev) 1512 { 1513 if (!lmp_bredr_capable(hdev)) 1514 return MGMT_STATUS_NOT_SUPPORTED; 1515 else if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) 1516 return MGMT_STATUS_REJECTED; 1517 else 1518 return MGMT_STATUS_SUCCESS; 1519 } 1520 1521 static u8 mgmt_le_support(struct hci_dev *hdev) 1522 { 1523 if (!lmp_le_capable(hdev)) 1524 return MGMT_STATUS_NOT_SUPPORTED; 1525 else if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED)) 1526 return MGMT_STATUS_REJECTED; 1527 else 1528 return MGMT_STATUS_SUCCESS; 1529 } 1530 1531 static void mgmt_set_discoverable_complete(struct hci_dev *hdev, void *data, 1532 int err) 1533 { 1534 struct mgmt_pending_cmd *cmd = data; 1535 1536 bt_dev_dbg(hdev, "err %d", err); 1537 1538 /* Make sure cmd still outstanding. */ 1539 if (err == -ECANCELED || !mgmt_pending_valid(hdev, cmd)) 1540 return; 1541 1542 hci_dev_lock(hdev); 1543 1544 if (err) { 1545 u8 mgmt_err = mgmt_status(err); 1546 mgmt_cmd_status(cmd->sk, cmd->hdev->id, cmd->opcode, mgmt_err); 1547 hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE); 1548 goto done; 1549 } 1550 1551 if (hci_dev_test_flag(hdev, HCI_DISCOVERABLE) && 1552 hdev->discov_timeout > 0) { 1553 int to = secs_to_jiffies(hdev->discov_timeout); 1554 queue_delayed_work(hdev->req_workqueue, &hdev->discov_off, to); 1555 } 1556 1557 send_settings_rsp(cmd->sk, MGMT_OP_SET_DISCOVERABLE, hdev); 1558 new_settings(hdev, cmd->sk); 1559 1560 done: 1561 mgmt_pending_free(cmd); 1562 hci_dev_unlock(hdev); 1563 } 1564 1565 static int set_discoverable_sync(struct hci_dev *hdev, void *data) 1566 { 1567 if (!mgmt_pending_listed(hdev, data)) 1568 return -ECANCELED; 1569 1570 BT_DBG("%s", hdev->name); 1571 1572 return hci_update_discoverable_sync(hdev); 1573 } 1574 1575 static int set_discoverable(struct sock *sk, struct hci_dev *hdev, void *data, 1576 u16 len) 1577 { 1578 struct mgmt_cp_set_discoverable *cp = data; 1579 struct mgmt_pending_cmd *cmd; 1580 u16 timeout; 1581 int err; 1582 1583 bt_dev_dbg(hdev, "sock %p", sk); 1584 1585 if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED) && 1586 !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) 1587 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE, 1588 MGMT_STATUS_REJECTED); 1589 1590 if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02) 1591 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE, 1592 MGMT_STATUS_INVALID_PARAMS); 1593 1594 timeout = __le16_to_cpu(cp->timeout); 1595 1596 /* Disabling discoverable requires that no timeout is set, 1597 * and enabling limited discoverable requires a timeout. 1598 */ 1599 if ((cp->val == 0x00 && timeout > 0) || 1600 (cp->val == 0x02 && timeout == 0)) 1601 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE, 1602 MGMT_STATUS_INVALID_PARAMS); 1603 1604 hci_dev_lock(hdev); 1605 1606 if (!hdev_is_powered(hdev) && timeout > 0) { 1607 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE, 1608 MGMT_STATUS_NOT_POWERED); 1609 goto failed; 1610 } 1611 1612 if (pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) || 1613 pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) { 1614 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE, 1615 MGMT_STATUS_BUSY); 1616 goto failed; 1617 } 1618 1619 if (!hci_dev_test_flag(hdev, HCI_CONNECTABLE)) { 1620 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE, 1621 MGMT_STATUS_REJECTED); 1622 goto failed; 1623 } 1624 1625 if (hdev->advertising_paused) { 1626 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE, 1627 MGMT_STATUS_BUSY); 1628 goto failed; 1629 } 1630 1631 if (!hdev_is_powered(hdev)) { 1632 bool changed = false; 1633 1634 /* Setting limited discoverable when powered off is 1635 * not a valid operation since it requires a timeout 1636 * and so no need to check HCI_LIMITED_DISCOVERABLE. 1637 */ 1638 if (!!cp->val != hci_dev_test_flag(hdev, HCI_DISCOVERABLE)) { 1639 hci_dev_change_flag(hdev, HCI_DISCOVERABLE); 1640 changed = true; 1641 } 1642 1643 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev); 1644 if (err < 0) 1645 goto failed; 1646 1647 if (changed) 1648 err = new_settings(hdev, sk); 1649 1650 goto failed; 1651 } 1652 1653 /* If the current mode is the same, then just update the timeout 1654 * value with the new value. And if only the timeout gets updated, 1655 * then no need for any HCI transactions. 1656 */ 1657 if (!!cp->val == hci_dev_test_flag(hdev, HCI_DISCOVERABLE) && 1658 (cp->val == 0x02) == hci_dev_test_flag(hdev, 1659 HCI_LIMITED_DISCOVERABLE)) { 1660 cancel_delayed_work(&hdev->discov_off); 1661 hdev->discov_timeout = timeout; 1662 1663 if (cp->val && hdev->discov_timeout > 0) { 1664 int to = secs_to_jiffies(hdev->discov_timeout); 1665 queue_delayed_work(hdev->req_workqueue, 1666 &hdev->discov_off, to); 1667 } 1668 1669 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev); 1670 goto failed; 1671 } 1672 1673 cmd = mgmt_pending_add(sk, MGMT_OP_SET_DISCOVERABLE, hdev, data, len); 1674 if (!cmd) { 1675 err = -ENOMEM; 1676 goto failed; 1677 } 1678 1679 /* Cancel any potential discoverable timeout that might be 1680 * still active and store new timeout value. The arming of 1681 * the timeout happens in the complete handler. 1682 */ 1683 cancel_delayed_work(&hdev->discov_off); 1684 hdev->discov_timeout = timeout; 1685 1686 if (cp->val) 1687 hci_dev_set_flag(hdev, HCI_DISCOVERABLE); 1688 else 1689 hci_dev_clear_flag(hdev, HCI_DISCOVERABLE); 1690 1691 /* Limited discoverable mode */ 1692 if (cp->val == 0x02) 1693 hci_dev_set_flag(hdev, HCI_LIMITED_DISCOVERABLE); 1694 else 1695 hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE); 1696 1697 err = hci_cmd_sync_queue(hdev, set_discoverable_sync, cmd, 1698 mgmt_set_discoverable_complete); 1699 1700 if (err < 0) 1701 mgmt_pending_remove(cmd); 1702 1703 failed: 1704 hci_dev_unlock(hdev); 1705 return err; 1706 } 1707 1708 static void mgmt_set_connectable_complete(struct hci_dev *hdev, void *data, 1709 int err) 1710 { 1711 struct mgmt_pending_cmd *cmd = data; 1712 1713 bt_dev_dbg(hdev, "err %d", err); 1714 1715 /* Make sure cmd still outstanding. */ 1716 if (err == -ECANCELED || !mgmt_pending_valid(hdev, cmd)) 1717 return; 1718 1719 hci_dev_lock(hdev); 1720 1721 if (err) { 1722 u8 mgmt_err = mgmt_status(err); 1723 mgmt_cmd_status(cmd->sk, cmd->hdev->id, cmd->opcode, mgmt_err); 1724 goto done; 1725 } 1726 1727 send_settings_rsp(cmd->sk, MGMT_OP_SET_CONNECTABLE, hdev); 1728 new_settings(hdev, cmd->sk); 1729 1730 done: 1731 mgmt_pending_free(cmd); 1732 1733 hci_dev_unlock(hdev); 1734 } 1735 1736 static int set_connectable_update_settings(struct hci_dev *hdev, 1737 struct sock *sk, u8 val) 1738 { 1739 bool changed = false; 1740 int err; 1741 1742 if (!!val != hci_dev_test_flag(hdev, HCI_CONNECTABLE)) 1743 changed = true; 1744 1745 if (val) { 1746 hci_dev_set_flag(hdev, HCI_CONNECTABLE); 1747 } else { 1748 hci_dev_clear_flag(hdev, HCI_CONNECTABLE); 1749 hci_dev_clear_flag(hdev, HCI_DISCOVERABLE); 1750 } 1751 1752 err = send_settings_rsp(sk, MGMT_OP_SET_CONNECTABLE, hdev); 1753 if (err < 0) 1754 return err; 1755 1756 if (changed) { 1757 hci_update_scan(hdev); 1758 hci_update_passive_scan(hdev); 1759 return new_settings(hdev, sk); 1760 } 1761 1762 return 0; 1763 } 1764 1765 static int set_connectable_sync(struct hci_dev *hdev, void *data) 1766 { 1767 if (!mgmt_pending_listed(hdev, data)) 1768 return -ECANCELED; 1769 1770 BT_DBG("%s", hdev->name); 1771 1772 return hci_update_connectable_sync(hdev); 1773 } 1774 1775 static int set_connectable(struct sock *sk, struct hci_dev *hdev, void *data, 1776 u16 len) 1777 { 1778 struct mgmt_mode *cp = data; 1779 struct mgmt_pending_cmd *cmd; 1780 int err; 1781 1782 bt_dev_dbg(hdev, "sock %p", sk); 1783 1784 if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED) && 1785 !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) 1786 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE, 1787 MGMT_STATUS_REJECTED); 1788 1789 if (cp->val != 0x00 && cp->val != 0x01) 1790 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE, 1791 MGMT_STATUS_INVALID_PARAMS); 1792 1793 hci_dev_lock(hdev); 1794 1795 if (!hdev_is_powered(hdev)) { 1796 err = set_connectable_update_settings(hdev, sk, cp->val); 1797 goto failed; 1798 } 1799 1800 if (pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) || 1801 pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) { 1802 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE, 1803 MGMT_STATUS_BUSY); 1804 goto failed; 1805 } 1806 1807 cmd = mgmt_pending_add(sk, MGMT_OP_SET_CONNECTABLE, hdev, data, len); 1808 if (!cmd) { 1809 err = -ENOMEM; 1810 goto failed; 1811 } 1812 1813 if (cp->val) { 1814 hci_dev_set_flag(hdev, HCI_CONNECTABLE); 1815 } else { 1816 if (hdev->discov_timeout > 0) 1817 cancel_delayed_work(&hdev->discov_off); 1818 1819 hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE); 1820 hci_dev_clear_flag(hdev, HCI_DISCOVERABLE); 1821 hci_dev_clear_flag(hdev, HCI_CONNECTABLE); 1822 } 1823 1824 err = hci_cmd_sync_queue(hdev, set_connectable_sync, cmd, 1825 mgmt_set_connectable_complete); 1826 1827 if (err < 0) 1828 mgmt_pending_remove(cmd); 1829 1830 failed: 1831 hci_dev_unlock(hdev); 1832 return err; 1833 } 1834 1835 static int set_bondable(struct sock *sk, struct hci_dev *hdev, void *data, 1836 u16 len) 1837 { 1838 struct mgmt_mode *cp = data; 1839 bool changed; 1840 int err; 1841 1842 bt_dev_dbg(hdev, "sock %p", sk); 1843 1844 if (cp->val != 0x00 && cp->val != 0x01) 1845 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BONDABLE, 1846 MGMT_STATUS_INVALID_PARAMS); 1847 1848 hci_dev_lock(hdev); 1849 1850 if (cp->val) 1851 changed = !hci_dev_test_and_set_flag(hdev, HCI_BONDABLE); 1852 else 1853 changed = hci_dev_test_and_clear_flag(hdev, HCI_BONDABLE); 1854 1855 err = send_settings_rsp(sk, MGMT_OP_SET_BONDABLE, hdev); 1856 if (err < 0) 1857 goto unlock; 1858 1859 if (changed) { 1860 /* In limited privacy mode the change of bondable mode 1861 * may affect the local advertising address. 1862 */ 1863 hci_update_discoverable(hdev); 1864 1865 err = new_settings(hdev, sk); 1866 } 1867 1868 unlock: 1869 hci_dev_unlock(hdev); 1870 return err; 1871 } 1872 1873 static int set_link_security(struct sock *sk, struct hci_dev *hdev, void *data, 1874 u16 len) 1875 { 1876 struct mgmt_mode *cp = data; 1877 struct mgmt_pending_cmd *cmd; 1878 u8 val, status; 1879 int err; 1880 1881 bt_dev_dbg(hdev, "sock %p", sk); 1882 1883 status = mgmt_bredr_support(hdev); 1884 if (status) 1885 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY, 1886 status); 1887 1888 if (cp->val != 0x00 && cp->val != 0x01) 1889 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY, 1890 MGMT_STATUS_INVALID_PARAMS); 1891 1892 hci_dev_lock(hdev); 1893 1894 if (!hdev_is_powered(hdev)) { 1895 bool changed = false; 1896 1897 if (!!cp->val != hci_dev_test_flag(hdev, HCI_LINK_SECURITY)) { 1898 hci_dev_change_flag(hdev, HCI_LINK_SECURITY); 1899 changed = true; 1900 } 1901 1902 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev); 1903 if (err < 0) 1904 goto failed; 1905 1906 if (changed) 1907 err = new_settings(hdev, sk); 1908 1909 goto failed; 1910 } 1911 1912 if (pending_find(MGMT_OP_SET_LINK_SECURITY, hdev)) { 1913 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY, 1914 MGMT_STATUS_BUSY); 1915 goto failed; 1916 } 1917 1918 val = !!cp->val; 1919 1920 if (test_bit(HCI_AUTH, &hdev->flags) == val) { 1921 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev); 1922 goto failed; 1923 } 1924 1925 cmd = mgmt_pending_add(sk, MGMT_OP_SET_LINK_SECURITY, hdev, data, len); 1926 if (!cmd) { 1927 err = -ENOMEM; 1928 goto failed; 1929 } 1930 1931 err = hci_send_cmd(hdev, HCI_OP_WRITE_AUTH_ENABLE, sizeof(val), &val); 1932 if (err < 0) { 1933 mgmt_pending_remove(cmd); 1934 goto failed; 1935 } 1936 1937 failed: 1938 hci_dev_unlock(hdev); 1939 return err; 1940 } 1941 1942 static void set_ssp_complete(struct hci_dev *hdev, void *data, int err) 1943 { 1944 struct cmd_lookup match = { NULL, hdev }; 1945 struct mgmt_pending_cmd *cmd = data; 1946 struct mgmt_mode *cp; 1947 u8 enable; 1948 bool changed; 1949 1950 /* Make sure cmd still outstanding. */ 1951 if (err == -ECANCELED || !mgmt_pending_valid(hdev, cmd)) 1952 return; 1953 1954 cp = cmd->param; 1955 enable = cp->val; 1956 1957 if (err) { 1958 u8 mgmt_err = mgmt_status(err); 1959 1960 if (enable && hci_dev_test_and_clear_flag(hdev, 1961 HCI_SSP_ENABLED)) { 1962 new_settings(hdev, NULL); 1963 } 1964 1965 mgmt_cmd_status(cmd->sk, cmd->hdev->id, cmd->opcode, mgmt_err); 1966 mgmt_pending_free(cmd); 1967 return; 1968 } 1969 1970 if (enable) { 1971 changed = !hci_dev_test_and_set_flag(hdev, HCI_SSP_ENABLED); 1972 } else { 1973 changed = hci_dev_test_and_clear_flag(hdev, HCI_SSP_ENABLED); 1974 } 1975 1976 settings_rsp(cmd, &match); 1977 1978 if (changed) 1979 new_settings(hdev, match.sk); 1980 1981 if (match.sk) 1982 sock_put(match.sk); 1983 1984 hci_update_eir_sync(hdev); 1985 mgmt_pending_free(cmd); 1986 } 1987 1988 static int set_ssp_sync(struct hci_dev *hdev, void *data) 1989 { 1990 struct mgmt_pending_cmd *cmd = data; 1991 struct mgmt_mode cp; 1992 bool changed = false; 1993 int err; 1994 1995 mutex_lock(&hdev->mgmt_pending_lock); 1996 1997 if (!__mgmt_pending_listed(hdev, cmd)) { 1998 mutex_unlock(&hdev->mgmt_pending_lock); 1999 return -ECANCELED; 2000 } 2001 2002 memcpy(&cp, cmd->param, sizeof(cp)); 2003 2004 mutex_unlock(&hdev->mgmt_pending_lock); 2005 2006 if (cp.val) 2007 changed = !hci_dev_test_and_set_flag(hdev, HCI_SSP_ENABLED); 2008 2009 err = hci_write_ssp_mode_sync(hdev, cp.val); 2010 2011 if (!err && changed) 2012 hci_dev_clear_flag(hdev, HCI_SSP_ENABLED); 2013 2014 return err; 2015 } 2016 2017 static int set_ssp(struct sock *sk, struct hci_dev *hdev, void *data, u16 len) 2018 { 2019 struct mgmt_mode *cp = data; 2020 struct mgmt_pending_cmd *cmd; 2021 u8 status; 2022 int err; 2023 2024 bt_dev_dbg(hdev, "sock %p", sk); 2025 2026 status = mgmt_bredr_support(hdev); 2027 if (status) 2028 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP, status); 2029 2030 if (!lmp_ssp_capable(hdev)) 2031 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP, 2032 MGMT_STATUS_NOT_SUPPORTED); 2033 2034 if (cp->val != 0x00 && cp->val != 0x01) 2035 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP, 2036 MGMT_STATUS_INVALID_PARAMS); 2037 2038 hci_dev_lock(hdev); 2039 2040 if (!hdev_is_powered(hdev)) { 2041 bool changed; 2042 2043 if (cp->val) { 2044 changed = !hci_dev_test_and_set_flag(hdev, 2045 HCI_SSP_ENABLED); 2046 } else { 2047 changed = hci_dev_test_and_clear_flag(hdev, 2048 HCI_SSP_ENABLED); 2049 } 2050 2051 err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev); 2052 if (err < 0) 2053 goto failed; 2054 2055 if (changed) 2056 err = new_settings(hdev, sk); 2057 2058 goto failed; 2059 } 2060 2061 if (pending_find(MGMT_OP_SET_SSP, hdev)) { 2062 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP, 2063 MGMT_STATUS_BUSY); 2064 goto failed; 2065 } 2066 2067 if (!!cp->val == hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) { 2068 err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev); 2069 goto failed; 2070 } 2071 2072 cmd = mgmt_pending_add(sk, MGMT_OP_SET_SSP, hdev, data, len); 2073 if (!cmd) 2074 err = -ENOMEM; 2075 else 2076 err = hci_cmd_sync_queue(hdev, set_ssp_sync, cmd, 2077 set_ssp_complete); 2078 2079 if (err < 0) { 2080 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP, 2081 MGMT_STATUS_FAILED); 2082 2083 if (cmd) 2084 mgmt_pending_remove(cmd); 2085 } 2086 2087 failed: 2088 hci_dev_unlock(hdev); 2089 return err; 2090 } 2091 2092 static int set_hs(struct sock *sk, struct hci_dev *hdev, void *data, u16 len) 2093 { 2094 bt_dev_dbg(hdev, "sock %p", sk); 2095 2096 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS, 2097 MGMT_STATUS_NOT_SUPPORTED); 2098 } 2099 2100 static void set_le_complete(struct hci_dev *hdev, void *data, int err) 2101 { 2102 struct mgmt_pending_cmd *cmd = data; 2103 struct cmd_lookup match = { NULL, hdev }; 2104 u8 status = mgmt_status(err); 2105 2106 bt_dev_dbg(hdev, "err %d", err); 2107 2108 if (err == -ECANCELED || !mgmt_pending_valid(hdev, data)) 2109 return; 2110 2111 if (status) { 2112 mgmt_cmd_status(cmd->sk, cmd->hdev->id, cmd->opcode, status); 2113 goto done; 2114 } 2115 2116 settings_rsp(cmd, &match); 2117 2118 new_settings(hdev, match.sk); 2119 2120 if (match.sk) 2121 sock_put(match.sk); 2122 2123 done: 2124 mgmt_pending_free(cmd); 2125 } 2126 2127 static int set_le_sync(struct hci_dev *hdev, void *data) 2128 { 2129 struct mgmt_pending_cmd *cmd = data; 2130 struct mgmt_mode cp; 2131 u8 val; 2132 int err; 2133 2134 mutex_lock(&hdev->mgmt_pending_lock); 2135 2136 if (!__mgmt_pending_listed(hdev, cmd)) { 2137 mutex_unlock(&hdev->mgmt_pending_lock); 2138 return -ECANCELED; 2139 } 2140 2141 memcpy(&cp, cmd->param, sizeof(cp)); 2142 val = !!cp.val; 2143 2144 mutex_unlock(&hdev->mgmt_pending_lock); 2145 2146 if (!val) { 2147 hci_clear_adv_instance_sync(hdev, NULL, 0x00, true); 2148 2149 if (hci_dev_test_flag(hdev, HCI_LE_ADV)) 2150 hci_disable_advertising_sync(hdev); 2151 2152 if (ext_adv_capable(hdev)) 2153 hci_remove_ext_adv_instance_sync(hdev, 0, cmd->sk); 2154 } else { 2155 hci_dev_set_flag(hdev, HCI_LE_ENABLED); 2156 } 2157 2158 err = hci_write_le_host_supported_sync(hdev, val, 0); 2159 2160 /* Make sure the controller has a good default for 2161 * advertising data. Restrict the update to when LE 2162 * has actually been enabled. During power on, the 2163 * update in powered_update_hci will take care of it. 2164 */ 2165 if (!err && hci_dev_test_flag(hdev, HCI_LE_ENABLED)) { 2166 if (ext_adv_capable(hdev)) { 2167 int status; 2168 2169 status = hci_setup_ext_adv_instance_sync(hdev, 0x00); 2170 if (!status) 2171 hci_update_scan_rsp_data_sync(hdev, 0x00); 2172 } else { 2173 hci_update_adv_data_sync(hdev, 0x00); 2174 hci_update_scan_rsp_data_sync(hdev, 0x00); 2175 } 2176 2177 hci_update_passive_scan(hdev); 2178 } 2179 2180 return err; 2181 } 2182 2183 static void set_mesh_complete(struct hci_dev *hdev, void *data, int err) 2184 { 2185 struct mgmt_pending_cmd *cmd = data; 2186 u8 status = mgmt_status(err); 2187 struct sock *sk; 2188 2189 if (err == -ECANCELED || !mgmt_pending_valid(hdev, cmd)) 2190 return; 2191 2192 sk = cmd->sk; 2193 2194 if (status) { 2195 mgmt_cmd_status(cmd->sk, hdev->id, cmd->opcode, status); 2196 goto done; 2197 } 2198 2199 mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_MESH_RECEIVER, 0, NULL, 0); 2200 2201 done: 2202 mgmt_pending_free(cmd); 2203 } 2204 2205 static int set_mesh_sync(struct hci_dev *hdev, void *data) 2206 { 2207 struct mgmt_pending_cmd *cmd = data; 2208 DEFINE_FLEX(struct mgmt_cp_set_mesh, cp, ad_types, num_ad_types, 2209 sizeof(hdev->mesh_ad_types)); 2210 size_t len; 2211 2212 mutex_lock(&hdev->mgmt_pending_lock); 2213 2214 if (!__mgmt_pending_listed(hdev, cmd)) { 2215 mutex_unlock(&hdev->mgmt_pending_lock); 2216 return -ECANCELED; 2217 } 2218 2219 len = cmd->param_len; 2220 memcpy(cp, cmd->param, min(__struct_size(cp), len)); 2221 2222 mutex_unlock(&hdev->mgmt_pending_lock); 2223 2224 memset(hdev->mesh_ad_types, 0, sizeof(hdev->mesh_ad_types)); 2225 2226 if (cp->enable) 2227 hci_dev_set_flag(hdev, HCI_MESH); 2228 else 2229 hci_dev_clear_flag(hdev, HCI_MESH); 2230 2231 hdev->le_scan_interval = __le16_to_cpu(cp->period); 2232 hdev->le_scan_window = __le16_to_cpu(cp->window); 2233 2234 len -= sizeof(struct mgmt_cp_set_mesh); 2235 2236 /* If filters don't fit, forward all adv pkts */ 2237 if (len <= sizeof(hdev->mesh_ad_types)) 2238 memcpy(hdev->mesh_ad_types, cp->ad_types, len); 2239 2240 hci_update_passive_scan_sync(hdev); 2241 return 0; 2242 } 2243 2244 static int set_mesh(struct sock *sk, struct hci_dev *hdev, void *data, u16 len) 2245 { 2246 struct mgmt_cp_set_mesh *cp = data; 2247 struct mgmt_pending_cmd *cmd; 2248 __u16 period, window; 2249 int err = 0; 2250 2251 bt_dev_dbg(hdev, "sock %p", sk); 2252 2253 if (!lmp_le_capable(hdev) || 2254 !hci_dev_test_flag(hdev, HCI_MESH_EXPERIMENTAL)) 2255 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_MESH_RECEIVER, 2256 MGMT_STATUS_NOT_SUPPORTED); 2257 2258 if (cp->enable != 0x00 && cp->enable != 0x01) 2259 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_MESH_RECEIVER, 2260 MGMT_STATUS_INVALID_PARAMS); 2261 2262 /* Keep allowed ranges in sync with set_scan_params() */ 2263 period = __le16_to_cpu(cp->period); 2264 2265 if (period < 0x0004 || period > 0x4000) 2266 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_MESH_RECEIVER, 2267 MGMT_STATUS_INVALID_PARAMS); 2268 2269 window = __le16_to_cpu(cp->window); 2270 2271 if (window < 0x0004 || window > 0x4000) 2272 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_MESH_RECEIVER, 2273 MGMT_STATUS_INVALID_PARAMS); 2274 2275 if (window > period) 2276 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_MESH_RECEIVER, 2277 MGMT_STATUS_INVALID_PARAMS); 2278 2279 hci_dev_lock(hdev); 2280 2281 cmd = mgmt_pending_add(sk, MGMT_OP_SET_MESH_RECEIVER, hdev, data, len); 2282 if (!cmd) 2283 err = -ENOMEM; 2284 else 2285 err = hci_cmd_sync_queue(hdev, set_mesh_sync, cmd, 2286 set_mesh_complete); 2287 2288 if (err < 0) { 2289 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_MESH_RECEIVER, 2290 MGMT_STATUS_FAILED); 2291 2292 if (cmd) 2293 mgmt_pending_remove(cmd); 2294 } 2295 2296 hci_dev_unlock(hdev); 2297 return err; 2298 } 2299 2300 static void mesh_send_start_complete(struct hci_dev *hdev, void *data, int err) 2301 { 2302 struct mgmt_mesh_tx *mesh_tx = data; 2303 struct mgmt_cp_mesh_send *send = (void *)mesh_tx->param; 2304 unsigned long mesh_send_interval; 2305 u8 mgmt_err = mgmt_status(err); 2306 2307 /* Report any errors here, but don't report completion */ 2308 2309 if (mgmt_err) { 2310 hci_dev_clear_flag(hdev, HCI_MESH_SENDING); 2311 /* Send Complete Error Code for handle */ 2312 mesh_send_complete(hdev, mesh_tx, false); 2313 return; 2314 } 2315 2316 mesh_send_interval = msecs_to_jiffies((send->cnt) * 25); 2317 queue_delayed_work(hdev->req_workqueue, &hdev->mesh_send_done, 2318 mesh_send_interval); 2319 } 2320 2321 static int mesh_send_sync(struct hci_dev *hdev, void *data) 2322 { 2323 struct mgmt_mesh_tx *mesh_tx = data; 2324 struct mgmt_cp_mesh_send *send = (void *)mesh_tx->param; 2325 struct adv_info *adv, *next_instance; 2326 u8 instance = hdev->le_num_of_adv_sets + 1; 2327 u16 timeout, duration; 2328 int err = 0; 2329 2330 if (hdev->le_num_of_adv_sets <= hdev->adv_instance_cnt) 2331 return MGMT_STATUS_BUSY; 2332 2333 timeout = 1000; 2334 duration = send->cnt * INTERVAL_TO_MS(hdev->le_adv_max_interval); 2335 adv = hci_add_adv_instance(hdev, instance, 0, 2336 send->adv_data_len, send->adv_data, 2337 0, NULL, 2338 timeout, duration, 2339 HCI_ADV_TX_POWER_NO_PREFERENCE, 2340 hdev->le_adv_min_interval, 2341 hdev->le_adv_max_interval, 2342 mesh_tx->handle); 2343 2344 if (!IS_ERR(adv)) 2345 mesh_tx->instance = instance; 2346 else 2347 err = PTR_ERR(adv); 2348 2349 if (hdev->cur_adv_instance == instance) { 2350 /* If the currently advertised instance is being changed then 2351 * cancel the current advertising and schedule the next 2352 * instance. If there is only one instance then the overridden 2353 * advertising data will be visible right away. 2354 */ 2355 cancel_adv_timeout(hdev); 2356 2357 next_instance = hci_get_next_instance(hdev, instance); 2358 if (next_instance) 2359 instance = next_instance->instance; 2360 else 2361 instance = 0; 2362 } else if (hdev->adv_instance_timeout) { 2363 /* Immediately advertise the new instance if no other, or 2364 * let it go naturally from queue if ADV is already happening 2365 */ 2366 instance = 0; 2367 } 2368 2369 if (instance) 2370 return hci_schedule_adv_instance_sync(hdev, instance, true); 2371 2372 return err; 2373 } 2374 2375 static void send_count(struct mgmt_mesh_tx *mesh_tx, void *data) 2376 { 2377 struct mgmt_rp_mesh_read_features *rp = data; 2378 2379 if (rp->used_handles >= rp->max_handles) 2380 return; 2381 2382 rp->handles[rp->used_handles++] = mesh_tx->handle; 2383 } 2384 2385 static int mesh_features(struct sock *sk, struct hci_dev *hdev, 2386 void *data, u16 len) 2387 { 2388 struct mgmt_rp_mesh_read_features rp; 2389 2390 if (!lmp_le_capable(hdev) || 2391 !hci_dev_test_flag(hdev, HCI_MESH_EXPERIMENTAL)) 2392 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_MESH_READ_FEATURES, 2393 MGMT_STATUS_NOT_SUPPORTED); 2394 2395 memset(&rp, 0, sizeof(rp)); 2396 rp.index = cpu_to_le16(hdev->id); 2397 if (hci_dev_test_flag(hdev, HCI_LE_ENABLED)) 2398 rp.max_handles = MESH_HANDLES_MAX; 2399 2400 hci_dev_lock(hdev); 2401 2402 if (rp.max_handles) 2403 mgmt_mesh_foreach(hdev, send_count, &rp, sk); 2404 2405 mgmt_cmd_complete(sk, hdev->id, MGMT_OP_MESH_READ_FEATURES, 0, &rp, 2406 rp.used_handles + sizeof(rp) - MESH_HANDLES_MAX); 2407 2408 hci_dev_unlock(hdev); 2409 return 0; 2410 } 2411 2412 static int send_cancel(struct hci_dev *hdev, void *data) 2413 { 2414 struct mgmt_pending_cmd *cmd = data; 2415 struct mgmt_cp_mesh_send_cancel *cancel = (void *)cmd->param; 2416 struct mgmt_mesh_tx *mesh_tx; 2417 2418 if (!cancel->handle) { 2419 do { 2420 mesh_tx = mgmt_mesh_next(hdev, cmd->sk); 2421 2422 if (mesh_tx) 2423 mesh_send_complete(hdev, mesh_tx, false); 2424 } while (mesh_tx); 2425 } else { 2426 mesh_tx = mgmt_mesh_find(hdev, cancel->handle); 2427 2428 if (mesh_tx && mesh_tx->sk == cmd->sk) 2429 mesh_send_complete(hdev, mesh_tx, false); 2430 } 2431 2432 mgmt_cmd_complete(cmd->sk, hdev->id, MGMT_OP_MESH_SEND_CANCEL, 2433 0, NULL, 0); 2434 mgmt_pending_free(cmd); 2435 2436 return 0; 2437 } 2438 2439 static int mesh_send_cancel(struct sock *sk, struct hci_dev *hdev, 2440 void *data, u16 len) 2441 { 2442 struct mgmt_pending_cmd *cmd; 2443 int err; 2444 2445 if (!lmp_le_capable(hdev) || 2446 !hci_dev_test_flag(hdev, HCI_MESH_EXPERIMENTAL)) 2447 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_MESH_SEND_CANCEL, 2448 MGMT_STATUS_NOT_SUPPORTED); 2449 2450 if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED)) 2451 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_MESH_SEND_CANCEL, 2452 MGMT_STATUS_REJECTED); 2453 2454 hci_dev_lock(hdev); 2455 cmd = mgmt_pending_new(sk, MGMT_OP_MESH_SEND_CANCEL, hdev, data, len); 2456 if (!cmd) 2457 err = -ENOMEM; 2458 else 2459 err = hci_cmd_sync_queue(hdev, send_cancel, cmd, NULL); 2460 2461 if (err < 0) { 2462 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_MESH_SEND_CANCEL, 2463 MGMT_STATUS_FAILED); 2464 2465 if (cmd) 2466 mgmt_pending_free(cmd); 2467 } 2468 2469 hci_dev_unlock(hdev); 2470 return err; 2471 } 2472 2473 static int mesh_send(struct sock *sk, struct hci_dev *hdev, void *data, u16 len) 2474 { 2475 struct mgmt_mesh_tx *mesh_tx; 2476 struct mgmt_cp_mesh_send *send = data; 2477 struct mgmt_rp_mesh_read_features rp; 2478 u16 expected_len; 2479 bool sending; 2480 int err = 0; 2481 2482 if (!lmp_le_capable(hdev) || 2483 !hci_dev_test_flag(hdev, HCI_MESH_EXPERIMENTAL)) 2484 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_MESH_SEND, 2485 MGMT_STATUS_NOT_SUPPORTED); 2486 if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED)) 2487 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_MESH_SEND, 2488 MGMT_STATUS_REJECTED); 2489 2490 if (!send->adv_data_len || send->adv_data_len > 31) 2491 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_MESH_SEND, 2492 MGMT_STATUS_REJECTED); 2493 2494 expected_len = struct_size(send, adv_data, send->adv_data_len); 2495 if (expected_len != len) 2496 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_MESH_SEND, 2497 MGMT_STATUS_INVALID_PARAMS); 2498 2499 hci_dev_lock(hdev); 2500 2501 memset(&rp, 0, sizeof(rp)); 2502 rp.max_handles = MESH_HANDLES_MAX; 2503 2504 mgmt_mesh_foreach(hdev, send_count, &rp, sk); 2505 2506 if (rp.max_handles <= rp.used_handles) { 2507 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_MESH_SEND, 2508 MGMT_STATUS_BUSY); 2509 goto done; 2510 } 2511 2512 sending = hci_dev_test_flag(hdev, HCI_MESH_SENDING); 2513 mesh_tx = mgmt_mesh_add(sk, hdev, send, len); 2514 2515 if (!mesh_tx) 2516 err = -ENOMEM; 2517 else if (!sending) 2518 err = hci_cmd_sync_queue(hdev, mesh_send_sync, mesh_tx, 2519 mesh_send_start_complete); 2520 2521 if (err < 0) { 2522 bt_dev_err(hdev, "Send Mesh Failed %d", err); 2523 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_MESH_SEND, 2524 MGMT_STATUS_FAILED); 2525 2526 if (mesh_tx) { 2527 if (sending) 2528 mgmt_mesh_remove(mesh_tx); 2529 } 2530 } else { 2531 hci_dev_set_flag(hdev, HCI_MESH_SENDING); 2532 2533 mgmt_cmd_complete(sk, hdev->id, MGMT_OP_MESH_SEND, 0, 2534 &mesh_tx->handle, 1); 2535 } 2536 2537 done: 2538 hci_dev_unlock(hdev); 2539 return err; 2540 } 2541 2542 static int set_le(struct sock *sk, struct hci_dev *hdev, void *data, u16 len) 2543 { 2544 struct mgmt_mode *cp = data; 2545 struct mgmt_pending_cmd *cmd; 2546 int err; 2547 u8 val, enabled; 2548 2549 bt_dev_dbg(hdev, "sock %p", sk); 2550 2551 if (!lmp_le_capable(hdev)) 2552 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE, 2553 MGMT_STATUS_NOT_SUPPORTED); 2554 2555 if (cp->val != 0x00 && cp->val != 0x01) 2556 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE, 2557 MGMT_STATUS_INVALID_PARAMS); 2558 2559 /* Bluetooth single mode LE only controllers or dual-mode 2560 * controllers configured as LE only devices, do not allow 2561 * switching LE off. These have either LE enabled explicitly 2562 * or BR/EDR has been previously switched off. 2563 * 2564 * When trying to enable an already enabled LE, then gracefully 2565 * send a positive response. Trying to disable it however will 2566 * result into rejection. 2567 */ 2568 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) { 2569 if (cp->val == 0x01) 2570 return send_settings_rsp(sk, MGMT_OP_SET_LE, hdev); 2571 2572 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE, 2573 MGMT_STATUS_REJECTED); 2574 } 2575 2576 hci_dev_lock(hdev); 2577 2578 val = !!cp->val; 2579 enabled = lmp_host_le_capable(hdev); 2580 2581 if (!hdev_is_powered(hdev) || val == enabled) { 2582 bool changed = false; 2583 2584 if (val != hci_dev_test_flag(hdev, HCI_LE_ENABLED)) { 2585 hci_dev_change_flag(hdev, HCI_LE_ENABLED); 2586 changed = true; 2587 } 2588 2589 if (!val && hci_dev_test_flag(hdev, HCI_ADVERTISING)) { 2590 hci_dev_clear_flag(hdev, HCI_ADVERTISING); 2591 changed = true; 2592 } 2593 2594 err = send_settings_rsp(sk, MGMT_OP_SET_LE, hdev); 2595 if (err < 0) 2596 goto unlock; 2597 2598 if (changed) 2599 err = new_settings(hdev, sk); 2600 2601 goto unlock; 2602 } 2603 2604 if (pending_find(MGMT_OP_SET_LE, hdev) || 2605 pending_find(MGMT_OP_SET_ADVERTISING, hdev)) { 2606 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE, 2607 MGMT_STATUS_BUSY); 2608 goto unlock; 2609 } 2610 2611 cmd = mgmt_pending_add(sk, MGMT_OP_SET_LE, hdev, data, len); 2612 if (!cmd) 2613 err = -ENOMEM; 2614 else 2615 err = hci_cmd_sync_queue(hdev, set_le_sync, cmd, 2616 set_le_complete); 2617 2618 if (err < 0) { 2619 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE, 2620 MGMT_STATUS_FAILED); 2621 2622 if (cmd) 2623 mgmt_pending_remove(cmd); 2624 } 2625 2626 unlock: 2627 hci_dev_unlock(hdev); 2628 return err; 2629 } 2630 2631 static int send_hci_cmd_sync(struct hci_dev *hdev, void *data) 2632 { 2633 struct mgmt_pending_cmd *cmd = data; 2634 struct mgmt_cp_hci_cmd_sync *cp = cmd->param; 2635 struct sk_buff *skb; 2636 2637 skb = __hci_cmd_sync_ev(hdev, le16_to_cpu(cp->opcode), 2638 le16_to_cpu(cp->params_len), cp->params, 2639 cp->event, cp->timeout ? 2640 secs_to_jiffies(cp->timeout) : 2641 HCI_CMD_TIMEOUT); 2642 if (IS_ERR(skb)) { 2643 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_HCI_CMD_SYNC, 2644 mgmt_status(PTR_ERR(skb))); 2645 goto done; 2646 } 2647 2648 mgmt_cmd_complete(cmd->sk, hdev->id, MGMT_OP_HCI_CMD_SYNC, 0, 2649 skb->data, skb->len); 2650 2651 kfree_skb(skb); 2652 2653 done: 2654 mgmt_pending_free(cmd); 2655 2656 return 0; 2657 } 2658 2659 static int mgmt_hci_cmd_sync(struct sock *sk, struct hci_dev *hdev, 2660 void *data, u16 len) 2661 { 2662 struct mgmt_cp_hci_cmd_sync *cp = data; 2663 struct mgmt_pending_cmd *cmd; 2664 int err; 2665 2666 if (len != (offsetof(struct mgmt_cp_hci_cmd_sync, params) + 2667 le16_to_cpu(cp->params_len))) 2668 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_HCI_CMD_SYNC, 2669 MGMT_STATUS_INVALID_PARAMS); 2670 2671 hci_dev_lock(hdev); 2672 cmd = mgmt_pending_new(sk, MGMT_OP_HCI_CMD_SYNC, hdev, data, len); 2673 if (!cmd) 2674 err = -ENOMEM; 2675 else 2676 err = hci_cmd_sync_queue(hdev, send_hci_cmd_sync, cmd, NULL); 2677 2678 if (err < 0) { 2679 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_HCI_CMD_SYNC, 2680 MGMT_STATUS_FAILED); 2681 2682 if (cmd) 2683 mgmt_pending_free(cmd); 2684 } 2685 2686 hci_dev_unlock(hdev); 2687 return err; 2688 } 2689 2690 /* This is a helper function to test for pending mgmt commands that can 2691 * cause CoD or EIR HCI commands. We can only allow one such pending 2692 * mgmt command at a time since otherwise we cannot easily track what 2693 * the current values are, will be, and based on that calculate if a new 2694 * HCI command needs to be sent and if yes with what value. 2695 */ 2696 static bool pending_eir_or_class(struct hci_dev *hdev) 2697 { 2698 struct mgmt_pending_cmd *cmd; 2699 2700 list_for_each_entry(cmd, &hdev->mgmt_pending, list) { 2701 switch (cmd->opcode) { 2702 case MGMT_OP_ADD_UUID: 2703 case MGMT_OP_REMOVE_UUID: 2704 case MGMT_OP_SET_DEV_CLASS: 2705 case MGMT_OP_SET_POWERED: 2706 return true; 2707 } 2708 } 2709 2710 return false; 2711 } 2712 2713 static const u8 bluetooth_base_uuid[] = { 2714 0xfb, 0x34, 0x9b, 0x5f, 0x80, 0x00, 0x00, 0x80, 2715 0x00, 0x10, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 2716 }; 2717 2718 static u8 get_uuid_size(const u8 *uuid) 2719 { 2720 u32 val; 2721 2722 if (memcmp(uuid, bluetooth_base_uuid, 12)) 2723 return 128; 2724 2725 val = get_unaligned_le32(&uuid[12]); 2726 if (val > 0xffff) 2727 return 32; 2728 2729 return 16; 2730 } 2731 2732 static void mgmt_class_complete(struct hci_dev *hdev, void *data, int err) 2733 { 2734 struct mgmt_pending_cmd *cmd = data; 2735 2736 bt_dev_dbg(hdev, "err %d", err); 2737 2738 mgmt_cmd_complete(cmd->sk, cmd->hdev->id, cmd->opcode, 2739 mgmt_status(err), hdev->dev_class, 3); 2740 2741 mgmt_pending_free(cmd); 2742 } 2743 2744 static int add_uuid_sync(struct hci_dev *hdev, void *data) 2745 { 2746 int err; 2747 2748 err = hci_update_class_sync(hdev); 2749 if (err) 2750 return err; 2751 2752 return hci_update_eir_sync(hdev); 2753 } 2754 2755 static int add_uuid(struct sock *sk, struct hci_dev *hdev, void *data, u16 len) 2756 { 2757 struct mgmt_cp_add_uuid *cp = data; 2758 struct mgmt_pending_cmd *cmd; 2759 struct bt_uuid *uuid; 2760 int err; 2761 2762 bt_dev_dbg(hdev, "sock %p", sk); 2763 2764 hci_dev_lock(hdev); 2765 2766 if (pending_eir_or_class(hdev)) { 2767 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_UUID, 2768 MGMT_STATUS_BUSY); 2769 goto failed; 2770 } 2771 2772 uuid = kmalloc_obj(*uuid); 2773 if (!uuid) { 2774 err = -ENOMEM; 2775 goto failed; 2776 } 2777 2778 memcpy(uuid->uuid, cp->uuid, 16); 2779 uuid->svc_hint = cp->svc_hint; 2780 uuid->size = get_uuid_size(cp->uuid); 2781 2782 list_add_tail(&uuid->list, &hdev->uuids); 2783 2784 cmd = mgmt_pending_new(sk, MGMT_OP_ADD_UUID, hdev, data, len); 2785 if (!cmd) { 2786 err = -ENOMEM; 2787 goto failed; 2788 } 2789 2790 /* MGMT_OP_ADD_UUID don't require adapter the UP/Running so use 2791 * hci_cmd_sync_submit instead of hci_cmd_sync_queue. 2792 */ 2793 err = hci_cmd_sync_submit(hdev, add_uuid_sync, cmd, 2794 mgmt_class_complete); 2795 if (err < 0) { 2796 mgmt_pending_free(cmd); 2797 goto failed; 2798 } 2799 2800 failed: 2801 hci_dev_unlock(hdev); 2802 return err; 2803 } 2804 2805 static bool enable_service_cache(struct hci_dev *hdev) 2806 { 2807 if (!hdev_is_powered(hdev)) 2808 return false; 2809 2810 if (!hci_dev_test_and_set_flag(hdev, HCI_SERVICE_CACHE)) { 2811 queue_delayed_work(hdev->workqueue, &hdev->service_cache, 2812 CACHE_TIMEOUT); 2813 return true; 2814 } 2815 2816 return false; 2817 } 2818 2819 static int remove_uuid_sync(struct hci_dev *hdev, void *data) 2820 { 2821 int err; 2822 2823 err = hci_update_class_sync(hdev); 2824 if (err) 2825 return err; 2826 2827 return hci_update_eir_sync(hdev); 2828 } 2829 2830 static int remove_uuid(struct sock *sk, struct hci_dev *hdev, void *data, 2831 u16 len) 2832 { 2833 struct mgmt_cp_remove_uuid *cp = data; 2834 struct mgmt_pending_cmd *cmd; 2835 struct bt_uuid *match, *tmp; 2836 static const u8 bt_uuid_any[] = { 2837 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 2838 }; 2839 int err, found; 2840 2841 bt_dev_dbg(hdev, "sock %p", sk); 2842 2843 hci_dev_lock(hdev); 2844 2845 if (pending_eir_or_class(hdev)) { 2846 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID, 2847 MGMT_STATUS_BUSY); 2848 goto unlock; 2849 } 2850 2851 if (memcmp(cp->uuid, bt_uuid_any, 16) == 0) { 2852 hci_uuids_clear(hdev); 2853 2854 if (enable_service_cache(hdev)) { 2855 err = mgmt_cmd_complete(sk, hdev->id, 2856 MGMT_OP_REMOVE_UUID, 2857 0, hdev->dev_class, 3); 2858 goto unlock; 2859 } 2860 2861 goto update_class; 2862 } 2863 2864 found = 0; 2865 2866 list_for_each_entry_safe(match, tmp, &hdev->uuids, list) { 2867 if (memcmp(match->uuid, cp->uuid, 16) != 0) 2868 continue; 2869 2870 list_del(&match->list); 2871 kfree(match); 2872 found++; 2873 } 2874 2875 if (found == 0) { 2876 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID, 2877 MGMT_STATUS_INVALID_PARAMS); 2878 goto unlock; 2879 } 2880 2881 update_class: 2882 cmd = mgmt_pending_new(sk, MGMT_OP_REMOVE_UUID, hdev, data, len); 2883 if (!cmd) { 2884 err = -ENOMEM; 2885 goto unlock; 2886 } 2887 2888 /* MGMT_OP_REMOVE_UUID don't require adapter the UP/Running so use 2889 * hci_cmd_sync_submit instead of hci_cmd_sync_queue. 2890 */ 2891 err = hci_cmd_sync_submit(hdev, remove_uuid_sync, cmd, 2892 mgmt_class_complete); 2893 if (err < 0) 2894 mgmt_pending_free(cmd); 2895 2896 unlock: 2897 hci_dev_unlock(hdev); 2898 return err; 2899 } 2900 2901 static int set_class_sync(struct hci_dev *hdev, void *data) 2902 { 2903 int err = 0; 2904 2905 if (hci_dev_test_and_clear_flag(hdev, HCI_SERVICE_CACHE)) { 2906 cancel_delayed_work_sync(&hdev->service_cache); 2907 err = hci_update_eir_sync(hdev); 2908 } 2909 2910 if (err) 2911 return err; 2912 2913 return hci_update_class_sync(hdev); 2914 } 2915 2916 static int set_dev_class(struct sock *sk, struct hci_dev *hdev, void *data, 2917 u16 len) 2918 { 2919 struct mgmt_cp_set_dev_class *cp = data; 2920 struct mgmt_pending_cmd *cmd; 2921 int err; 2922 2923 bt_dev_dbg(hdev, "sock %p", sk); 2924 2925 if (!lmp_bredr_capable(hdev)) 2926 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 2927 MGMT_STATUS_NOT_SUPPORTED); 2928 2929 hci_dev_lock(hdev); 2930 2931 if (pending_eir_or_class(hdev)) { 2932 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 2933 MGMT_STATUS_BUSY); 2934 goto unlock; 2935 } 2936 2937 if ((cp->minor & 0x03) != 0 || (cp->major & 0xe0) != 0) { 2938 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 2939 MGMT_STATUS_INVALID_PARAMS); 2940 goto unlock; 2941 } 2942 2943 hdev->major_class = cp->major; 2944 hdev->minor_class = cp->minor; 2945 2946 if (!hdev_is_powered(hdev)) { 2947 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 0, 2948 hdev->dev_class, 3); 2949 goto unlock; 2950 } 2951 2952 cmd = mgmt_pending_new(sk, MGMT_OP_SET_DEV_CLASS, hdev, data, len); 2953 if (!cmd) { 2954 err = -ENOMEM; 2955 goto unlock; 2956 } 2957 2958 /* MGMT_OP_SET_DEV_CLASS don't require adapter the UP/Running so use 2959 * hci_cmd_sync_submit instead of hci_cmd_sync_queue. 2960 */ 2961 err = hci_cmd_sync_submit(hdev, set_class_sync, cmd, 2962 mgmt_class_complete); 2963 if (err < 0) 2964 mgmt_pending_free(cmd); 2965 2966 unlock: 2967 hci_dev_unlock(hdev); 2968 return err; 2969 } 2970 2971 static int load_link_keys(struct sock *sk, struct hci_dev *hdev, void *data, 2972 u16 len) 2973 { 2974 struct mgmt_cp_load_link_keys *cp = data; 2975 const u16 max_key_count = ((U16_MAX - sizeof(*cp)) / 2976 sizeof(struct mgmt_link_key_info)); 2977 u16 key_count, expected_len; 2978 bool changed; 2979 int i; 2980 2981 bt_dev_dbg(hdev, "sock %p", sk); 2982 2983 if (!lmp_bredr_capable(hdev)) 2984 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS, 2985 MGMT_STATUS_NOT_SUPPORTED); 2986 2987 key_count = __le16_to_cpu(cp->key_count); 2988 if (key_count > max_key_count) { 2989 bt_dev_err(hdev, "load_link_keys: too big key_count value %u", 2990 key_count); 2991 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS, 2992 MGMT_STATUS_INVALID_PARAMS); 2993 } 2994 2995 expected_len = struct_size(cp, keys, key_count); 2996 if (expected_len != len) { 2997 bt_dev_err(hdev, "load_link_keys: expected %u bytes, got %u bytes", 2998 expected_len, len); 2999 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS, 3000 MGMT_STATUS_INVALID_PARAMS); 3001 } 3002 3003 if (cp->debug_keys != 0x00 && cp->debug_keys != 0x01) 3004 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS, 3005 MGMT_STATUS_INVALID_PARAMS); 3006 3007 bt_dev_dbg(hdev, "debug_keys %u key_count %u", cp->debug_keys, 3008 key_count); 3009 3010 hci_dev_lock(hdev); 3011 3012 hci_link_keys_clear(hdev); 3013 3014 if (cp->debug_keys) 3015 changed = !hci_dev_test_and_set_flag(hdev, HCI_KEEP_DEBUG_KEYS); 3016 else 3017 changed = hci_dev_test_and_clear_flag(hdev, 3018 HCI_KEEP_DEBUG_KEYS); 3019 3020 if (changed) 3021 new_settings(hdev, NULL); 3022 3023 for (i = 0; i < key_count; i++) { 3024 struct mgmt_link_key_info *key = &cp->keys[i]; 3025 3026 if (hci_is_blocked_key(hdev, 3027 HCI_BLOCKED_KEY_TYPE_LINKKEY, 3028 key->val)) { 3029 bt_dev_warn(hdev, "Skipping blocked link key for %pMR", 3030 &key->addr.bdaddr); 3031 continue; 3032 } 3033 3034 if (key->addr.type != BDADDR_BREDR) { 3035 bt_dev_warn(hdev, 3036 "Invalid link address type %u for %pMR", 3037 key->addr.type, &key->addr.bdaddr); 3038 continue; 3039 } 3040 3041 if (key->type > 0x08) { 3042 bt_dev_warn(hdev, "Invalid link key type %u for %pMR", 3043 key->type, &key->addr.bdaddr); 3044 continue; 3045 } 3046 3047 /* Always ignore debug keys and require a new pairing if 3048 * the user wants to use them. 3049 */ 3050 if (key->type == HCI_LK_DEBUG_COMBINATION) 3051 continue; 3052 3053 hci_add_link_key(hdev, NULL, &key->addr.bdaddr, key->val, 3054 key->type, key->pin_len, NULL); 3055 } 3056 3057 mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS, 0, NULL, 0); 3058 3059 hci_dev_unlock(hdev); 3060 3061 return 0; 3062 } 3063 3064 static int device_unpaired(struct hci_dev *hdev, bdaddr_t *bdaddr, 3065 u8 addr_type, struct sock *skip_sk) 3066 { 3067 struct mgmt_ev_device_unpaired ev; 3068 3069 bacpy(&ev.addr.bdaddr, bdaddr); 3070 ev.addr.type = addr_type; 3071 3072 return mgmt_event(MGMT_EV_DEVICE_UNPAIRED, hdev, &ev, sizeof(ev), 3073 skip_sk); 3074 } 3075 3076 static void unpair_device_complete(struct hci_dev *hdev, void *data, int err) 3077 { 3078 struct mgmt_pending_cmd *cmd = data; 3079 struct mgmt_cp_unpair_device *cp = cmd->param; 3080 3081 if (!err) 3082 device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, cmd->sk); 3083 3084 cmd->cmd_complete(cmd, err); 3085 mgmt_pending_free(cmd); 3086 } 3087 3088 static int unpair_device_sync(struct hci_dev *hdev, void *data) 3089 { 3090 struct mgmt_pending_cmd *cmd = data; 3091 struct mgmt_cp_unpair_device *cp = cmd->param; 3092 struct hci_conn *conn; 3093 3094 if (cp->addr.type == BDADDR_BREDR) 3095 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, 3096 &cp->addr.bdaddr); 3097 else 3098 conn = hci_conn_hash_lookup_le(hdev, &cp->addr.bdaddr, 3099 le_addr_type(cp->addr.type)); 3100 3101 if (!conn) 3102 return 0; 3103 3104 /* Disregard any possible error since the likes of hci_abort_conn_sync 3105 * will clean up the connection no matter the error. 3106 */ 3107 hci_abort_conn(conn, HCI_ERROR_REMOTE_USER_TERM); 3108 3109 return 0; 3110 } 3111 3112 static int unpair_device(struct sock *sk, struct hci_dev *hdev, void *data, 3113 u16 len) 3114 { 3115 struct mgmt_cp_unpair_device *cp = data; 3116 struct mgmt_rp_unpair_device rp; 3117 struct hci_conn_params *params; 3118 struct mgmt_pending_cmd *cmd; 3119 struct hci_conn *conn; 3120 u8 addr_type; 3121 int err; 3122 3123 memset(&rp, 0, sizeof(rp)); 3124 bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr); 3125 rp.addr.type = cp->addr.type; 3126 3127 if (!bdaddr_type_is_valid(cp->addr.type)) 3128 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE, 3129 MGMT_STATUS_INVALID_PARAMS, 3130 &rp, sizeof(rp)); 3131 3132 if (cp->disconnect != 0x00 && cp->disconnect != 0x01) 3133 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE, 3134 MGMT_STATUS_INVALID_PARAMS, 3135 &rp, sizeof(rp)); 3136 3137 hci_dev_lock(hdev); 3138 3139 if (!hdev_is_powered(hdev)) { 3140 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE, 3141 MGMT_STATUS_NOT_POWERED, &rp, 3142 sizeof(rp)); 3143 goto unlock; 3144 } 3145 3146 if (cp->addr.type == BDADDR_BREDR) { 3147 /* If disconnection is requested, then look up the 3148 * connection. If the remote device is connected, it 3149 * will be later used to terminate the link. 3150 * 3151 * Setting it to NULL explicitly will cause no 3152 * termination of the link. 3153 */ 3154 if (cp->disconnect) 3155 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, 3156 &cp->addr.bdaddr); 3157 else 3158 conn = NULL; 3159 3160 err = hci_remove_link_key(hdev, &cp->addr.bdaddr); 3161 if (err < 0) { 3162 err = mgmt_cmd_complete(sk, hdev->id, 3163 MGMT_OP_UNPAIR_DEVICE, 3164 MGMT_STATUS_NOT_PAIRED, &rp, 3165 sizeof(rp)); 3166 goto unlock; 3167 } 3168 3169 goto done; 3170 } 3171 3172 /* LE address type */ 3173 addr_type = le_addr_type(cp->addr.type); 3174 3175 /* Abort any ongoing SMP pairing. Removes ltk and irk if they exist. */ 3176 err = smp_cancel_and_remove_pairing(hdev, &cp->addr.bdaddr, addr_type); 3177 if (err < 0) { 3178 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE, 3179 MGMT_STATUS_NOT_PAIRED, &rp, 3180 sizeof(rp)); 3181 goto unlock; 3182 } 3183 3184 conn = hci_conn_hash_lookup_le(hdev, &cp->addr.bdaddr, addr_type); 3185 if (!conn) { 3186 hci_conn_params_del(hdev, &cp->addr.bdaddr, addr_type); 3187 goto done; 3188 } 3189 3190 3191 /* Defer clearing up the connection parameters until closing to 3192 * give a chance of keeping them if a repairing happens. 3193 */ 3194 set_bit(HCI_CONN_PARAM_REMOVAL_PEND, &conn->flags); 3195 3196 /* Disable auto-connection parameters if present */ 3197 params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr, addr_type); 3198 if (params) { 3199 if (params->explicit_connect) 3200 params->auto_connect = HCI_AUTO_CONN_EXPLICIT; 3201 else 3202 params->auto_connect = HCI_AUTO_CONN_DISABLED; 3203 } 3204 3205 /* If disconnection is not requested, then clear the connection 3206 * variable so that the link is not terminated. 3207 */ 3208 if (!cp->disconnect) 3209 conn = NULL; 3210 3211 done: 3212 /* If the connection variable is set, then termination of the 3213 * link is requested. 3214 */ 3215 if (!conn) { 3216 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE, 0, 3217 &rp, sizeof(rp)); 3218 device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, sk); 3219 goto unlock; 3220 } 3221 3222 cmd = mgmt_pending_new(sk, MGMT_OP_UNPAIR_DEVICE, hdev, cp, 3223 sizeof(*cp)); 3224 if (!cmd) { 3225 err = -ENOMEM; 3226 goto unlock; 3227 } 3228 3229 cmd->cmd_complete = addr_cmd_complete; 3230 3231 err = hci_cmd_sync_queue(hdev, unpair_device_sync, cmd, 3232 unpair_device_complete); 3233 if (err < 0) 3234 mgmt_pending_free(cmd); 3235 3236 unlock: 3237 hci_dev_unlock(hdev); 3238 return err; 3239 } 3240 3241 static void disconnect_complete(struct hci_dev *hdev, void *data, int err) 3242 { 3243 struct mgmt_pending_cmd *cmd = data; 3244 3245 cmd->cmd_complete(cmd, mgmt_status(err)); 3246 mgmt_pending_free(cmd); 3247 } 3248 3249 static int disconnect_sync(struct hci_dev *hdev, void *data) 3250 { 3251 struct mgmt_pending_cmd *cmd = data; 3252 struct mgmt_cp_disconnect *cp = cmd->param; 3253 struct hci_conn *conn; 3254 3255 if (cp->addr.type == BDADDR_BREDR) 3256 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, 3257 &cp->addr.bdaddr); 3258 else 3259 conn = hci_conn_hash_lookup_le(hdev, &cp->addr.bdaddr, 3260 le_addr_type(cp->addr.type)); 3261 3262 if (!conn) 3263 return -ENOTCONN; 3264 3265 /* Disregard any possible error since the likes of hci_abort_conn_sync 3266 * will clean up the connection no matter the error. 3267 */ 3268 hci_abort_conn(conn, HCI_ERROR_REMOTE_USER_TERM); 3269 3270 return 0; 3271 } 3272 3273 static int disconnect(struct sock *sk, struct hci_dev *hdev, void *data, 3274 u16 len) 3275 { 3276 struct mgmt_cp_disconnect *cp = data; 3277 struct mgmt_rp_disconnect rp; 3278 struct mgmt_pending_cmd *cmd; 3279 int err; 3280 3281 bt_dev_dbg(hdev, "sock %p", sk); 3282 3283 memset(&rp, 0, sizeof(rp)); 3284 bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr); 3285 rp.addr.type = cp->addr.type; 3286 3287 if (!bdaddr_type_is_valid(cp->addr.type)) 3288 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT, 3289 MGMT_STATUS_INVALID_PARAMS, 3290 &rp, sizeof(rp)); 3291 3292 hci_dev_lock(hdev); 3293 3294 if (!test_bit(HCI_UP, &hdev->flags)) { 3295 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT, 3296 MGMT_STATUS_NOT_POWERED, &rp, 3297 sizeof(rp)); 3298 goto failed; 3299 } 3300 3301 cmd = mgmt_pending_new(sk, MGMT_OP_DISCONNECT, hdev, data, len); 3302 if (!cmd) { 3303 err = -ENOMEM; 3304 goto failed; 3305 } 3306 3307 cmd->cmd_complete = generic_cmd_complete; 3308 3309 err = hci_cmd_sync_queue(hdev, disconnect_sync, cmd, 3310 disconnect_complete); 3311 if (err < 0) 3312 mgmt_pending_free(cmd); 3313 3314 failed: 3315 hci_dev_unlock(hdev); 3316 return err; 3317 } 3318 3319 static u8 link_to_bdaddr(u8 link_type, u8 addr_type) 3320 { 3321 switch (link_type) { 3322 case CIS_LINK: 3323 case BIS_LINK: 3324 case PA_LINK: 3325 case LE_LINK: 3326 switch (addr_type) { 3327 case ADDR_LE_DEV_PUBLIC: 3328 return BDADDR_LE_PUBLIC; 3329 3330 default: 3331 /* Fallback to LE Random address type */ 3332 return BDADDR_LE_RANDOM; 3333 } 3334 3335 default: 3336 /* Fallback to BR/EDR type */ 3337 return BDADDR_BREDR; 3338 } 3339 } 3340 3341 static int get_connections(struct sock *sk, struct hci_dev *hdev, void *data, 3342 u16 data_len) 3343 { 3344 struct mgmt_rp_get_connections *rp; 3345 struct hci_conn *c; 3346 int err; 3347 u16 i; 3348 3349 bt_dev_dbg(hdev, "sock %p", sk); 3350 3351 hci_dev_lock(hdev); 3352 3353 if (!hdev_is_powered(hdev)) { 3354 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_CONNECTIONS, 3355 MGMT_STATUS_NOT_POWERED); 3356 goto unlock; 3357 } 3358 3359 i = 0; 3360 list_for_each_entry(c, &hdev->conn_hash.list, list) { 3361 if (test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags)) 3362 i++; 3363 } 3364 3365 rp = kmalloc_flex(*rp, addr, i); 3366 if (!rp) { 3367 err = -ENOMEM; 3368 goto unlock; 3369 } 3370 3371 i = 0; 3372 list_for_each_entry(c, &hdev->conn_hash.list, list) { 3373 if (!test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags)) 3374 continue; 3375 bacpy(&rp->addr[i].bdaddr, &c->dst); 3376 rp->addr[i].type = link_to_bdaddr(c->type, c->dst_type); 3377 if (c->type == SCO_LINK || c->type == ESCO_LINK) 3378 continue; 3379 i++; 3380 } 3381 3382 rp->conn_count = cpu_to_le16(i); 3383 3384 /* Recalculate length in case of filtered SCO connections, etc */ 3385 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONNECTIONS, 0, rp, 3386 struct_size(rp, addr, i)); 3387 3388 kfree(rp); 3389 3390 unlock: 3391 hci_dev_unlock(hdev); 3392 return err; 3393 } 3394 3395 static int send_pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev, 3396 struct mgmt_cp_pin_code_neg_reply *cp) 3397 { 3398 struct mgmt_pending_cmd *cmd; 3399 int err; 3400 3401 cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_NEG_REPLY, hdev, cp, 3402 sizeof(*cp)); 3403 if (!cmd) 3404 return -ENOMEM; 3405 3406 cmd->cmd_complete = addr_cmd_complete; 3407 3408 err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_NEG_REPLY, 3409 sizeof(cp->addr.bdaddr), &cp->addr.bdaddr); 3410 if (err < 0) 3411 mgmt_pending_remove(cmd); 3412 3413 return err; 3414 } 3415 3416 static int pin_code_reply(struct sock *sk, struct hci_dev *hdev, void *data, 3417 u16 len) 3418 { 3419 struct hci_conn *conn; 3420 struct mgmt_cp_pin_code_reply *cp = data; 3421 struct hci_cp_pin_code_reply reply; 3422 struct mgmt_pending_cmd *cmd; 3423 int err; 3424 3425 bt_dev_dbg(hdev, "sock %p", sk); 3426 3427 hci_dev_lock(hdev); 3428 3429 if (!hdev_is_powered(hdev)) { 3430 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY, 3431 MGMT_STATUS_NOT_POWERED); 3432 goto failed; 3433 } 3434 3435 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->addr.bdaddr); 3436 if (!conn) { 3437 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY, 3438 MGMT_STATUS_NOT_CONNECTED); 3439 goto failed; 3440 } 3441 3442 if (conn->pending_sec_level == BT_SECURITY_HIGH && cp->pin_len != 16) { 3443 struct mgmt_cp_pin_code_neg_reply ncp; 3444 3445 memcpy(&ncp.addr, &cp->addr, sizeof(ncp.addr)); 3446 3447 bt_dev_err(hdev, "PIN code is not 16 bytes long"); 3448 3449 err = send_pin_code_neg_reply(sk, hdev, &ncp); 3450 if (err >= 0) 3451 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY, 3452 MGMT_STATUS_INVALID_PARAMS); 3453 3454 goto failed; 3455 } 3456 3457 cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_REPLY, hdev, data, len); 3458 if (!cmd) { 3459 err = -ENOMEM; 3460 goto failed; 3461 } 3462 3463 cmd->cmd_complete = addr_cmd_complete; 3464 3465 bacpy(&reply.bdaddr, &cp->addr.bdaddr); 3466 reply.pin_len = cp->pin_len; 3467 memcpy(reply.pin_code, cp->pin_code, sizeof(reply.pin_code)); 3468 3469 err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_REPLY, sizeof(reply), &reply); 3470 if (err < 0) 3471 mgmt_pending_remove(cmd); 3472 3473 failed: 3474 hci_dev_unlock(hdev); 3475 return err; 3476 } 3477 3478 static int set_io_capability(struct sock *sk, struct hci_dev *hdev, void *data, 3479 u16 len) 3480 { 3481 struct mgmt_cp_set_io_capability *cp = data; 3482 3483 bt_dev_dbg(hdev, "sock %p", sk); 3484 3485 if (cp->io_capability > SMP_IO_KEYBOARD_DISPLAY) 3486 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_IO_CAPABILITY, 3487 MGMT_STATUS_INVALID_PARAMS); 3488 3489 hci_dev_lock(hdev); 3490 3491 hdev->io_capability = cp->io_capability; 3492 3493 bt_dev_dbg(hdev, "IO capability set to 0x%02x", hdev->io_capability); 3494 3495 hci_dev_unlock(hdev); 3496 3497 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_IO_CAPABILITY, 0, 3498 NULL, 0); 3499 } 3500 3501 static struct mgmt_pending_cmd *find_pairing(struct hci_conn *conn) 3502 { 3503 struct hci_dev *hdev = conn->hdev; 3504 struct mgmt_pending_cmd *cmd; 3505 3506 list_for_each_entry(cmd, &hdev->mgmt_pending, list) { 3507 if (cmd->opcode != MGMT_OP_PAIR_DEVICE) 3508 continue; 3509 3510 if (cmd->user_data != conn) 3511 continue; 3512 3513 return cmd; 3514 } 3515 3516 return NULL; 3517 } 3518 3519 static int pairing_complete(struct mgmt_pending_cmd *cmd, u8 status) 3520 { 3521 struct mgmt_rp_pair_device rp; 3522 struct hci_conn *conn = cmd->user_data; 3523 int err; 3524 3525 bacpy(&rp.addr.bdaddr, &conn->dst); 3526 rp.addr.type = link_to_bdaddr(conn->type, conn->dst_type); 3527 3528 err = mgmt_cmd_complete(cmd->sk, cmd->hdev->id, MGMT_OP_PAIR_DEVICE, 3529 status, &rp, sizeof(rp)); 3530 3531 /* So we don't get further callbacks for this connection */ 3532 conn->connect_cfm_cb = NULL; 3533 conn->security_cfm_cb = NULL; 3534 conn->disconn_cfm_cb = NULL; 3535 3536 hci_conn_drop(conn); 3537 3538 /* The device is paired so there is no need to remove 3539 * its connection parameters anymore. 3540 */ 3541 clear_bit(HCI_CONN_PARAM_REMOVAL_PEND, &conn->flags); 3542 3543 hci_conn_put(conn); 3544 3545 return err; 3546 } 3547 3548 void mgmt_smp_complete(struct hci_conn *conn, bool complete) 3549 { 3550 u8 status = complete ? MGMT_STATUS_SUCCESS : MGMT_STATUS_FAILED; 3551 struct mgmt_pending_cmd *cmd; 3552 3553 cmd = find_pairing(conn); 3554 if (cmd) { 3555 cmd->cmd_complete(cmd, status); 3556 mgmt_pending_remove(cmd); 3557 } 3558 } 3559 3560 static void pairing_complete_cb(struct hci_conn *conn, u8 status) 3561 { 3562 struct mgmt_pending_cmd *cmd; 3563 3564 BT_DBG("status %u", status); 3565 3566 cmd = find_pairing(conn); 3567 if (!cmd) { 3568 BT_DBG("Unable to find a pending command"); 3569 return; 3570 } 3571 3572 cmd->cmd_complete(cmd, mgmt_status(status)); 3573 mgmt_pending_remove(cmd); 3574 } 3575 3576 static void le_pairing_complete_cb(struct hci_conn *conn, u8 status) 3577 { 3578 struct mgmt_pending_cmd *cmd; 3579 3580 BT_DBG("status %u", status); 3581 3582 if (!status) 3583 return; 3584 3585 cmd = find_pairing(conn); 3586 if (!cmd) { 3587 BT_DBG("Unable to find a pending command"); 3588 return; 3589 } 3590 3591 cmd->cmd_complete(cmd, mgmt_status(status)); 3592 mgmt_pending_remove(cmd); 3593 } 3594 3595 static int pair_device(struct sock *sk, struct hci_dev *hdev, void *data, 3596 u16 len) 3597 { 3598 struct mgmt_cp_pair_device *cp = data; 3599 struct mgmt_rp_pair_device rp; 3600 struct mgmt_pending_cmd *cmd; 3601 u8 sec_level, auth_type; 3602 struct hci_conn *conn; 3603 int err; 3604 3605 bt_dev_dbg(hdev, "sock %p", sk); 3606 3607 memset(&rp, 0, sizeof(rp)); 3608 bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr); 3609 rp.addr.type = cp->addr.type; 3610 3611 if (!bdaddr_type_is_valid(cp->addr.type)) 3612 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE, 3613 MGMT_STATUS_INVALID_PARAMS, 3614 &rp, sizeof(rp)); 3615 3616 if (cp->io_cap > SMP_IO_KEYBOARD_DISPLAY) 3617 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE, 3618 MGMT_STATUS_INVALID_PARAMS, 3619 &rp, sizeof(rp)); 3620 3621 hci_dev_lock(hdev); 3622 3623 if (!hdev_is_powered(hdev)) { 3624 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE, 3625 MGMT_STATUS_NOT_POWERED, &rp, 3626 sizeof(rp)); 3627 goto unlock; 3628 } 3629 3630 if (hci_bdaddr_is_paired(hdev, &cp->addr.bdaddr, cp->addr.type)) { 3631 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE, 3632 MGMT_STATUS_ALREADY_PAIRED, &rp, 3633 sizeof(rp)); 3634 goto unlock; 3635 } 3636 3637 sec_level = BT_SECURITY_MEDIUM; 3638 auth_type = HCI_AT_DEDICATED_BONDING; 3639 3640 if (cp->addr.type == BDADDR_BREDR) { 3641 conn = hci_connect_acl(hdev, &cp->addr.bdaddr, sec_level, 3642 auth_type, CONN_REASON_PAIR_DEVICE, 3643 HCI_ACL_CONN_TIMEOUT); 3644 } else { 3645 u8 addr_type = le_addr_type(cp->addr.type); 3646 struct hci_conn_params *p; 3647 3648 /* When pairing a new device, it is expected to remember 3649 * this device for future connections. Adding the connection 3650 * parameter information ahead of time allows tracking 3651 * of the peripheral preferred values and will speed up any 3652 * further connection establishment. 3653 * 3654 * If connection parameters already exist, then they 3655 * will be kept and this function does nothing. 3656 */ 3657 p = hci_conn_params_add(hdev, &cp->addr.bdaddr, addr_type); 3658 if (!p) { 3659 err = -EIO; 3660 goto unlock; 3661 } 3662 3663 if (p->auto_connect == HCI_AUTO_CONN_EXPLICIT) 3664 p->auto_connect = HCI_AUTO_CONN_DISABLED; 3665 3666 conn = hci_connect_le_scan(hdev, &cp->addr.bdaddr, addr_type, 3667 sec_level, HCI_LE_CONN_TIMEOUT, 3668 CONN_REASON_PAIR_DEVICE); 3669 } 3670 3671 if (IS_ERR(conn)) { 3672 int status; 3673 3674 if (PTR_ERR(conn) == -EBUSY) 3675 status = MGMT_STATUS_BUSY; 3676 else if (PTR_ERR(conn) == -EOPNOTSUPP) 3677 status = MGMT_STATUS_NOT_SUPPORTED; 3678 else if (PTR_ERR(conn) == -ECONNREFUSED) 3679 status = MGMT_STATUS_REJECTED; 3680 else 3681 status = MGMT_STATUS_CONNECT_FAILED; 3682 3683 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE, 3684 status, &rp, sizeof(rp)); 3685 goto unlock; 3686 } 3687 3688 if (conn->connect_cfm_cb) { 3689 hci_conn_drop(conn); 3690 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE, 3691 MGMT_STATUS_BUSY, &rp, sizeof(rp)); 3692 goto unlock; 3693 } 3694 3695 cmd = mgmt_pending_add(sk, MGMT_OP_PAIR_DEVICE, hdev, data, len); 3696 if (!cmd) { 3697 err = -ENOMEM; 3698 hci_conn_drop(conn); 3699 goto unlock; 3700 } 3701 3702 cmd->cmd_complete = pairing_complete; 3703 3704 /* For LE, just connecting isn't a proof that the pairing finished */ 3705 if (cp->addr.type == BDADDR_BREDR) { 3706 conn->connect_cfm_cb = pairing_complete_cb; 3707 conn->security_cfm_cb = pairing_complete_cb; 3708 conn->disconn_cfm_cb = pairing_complete_cb; 3709 } else { 3710 conn->connect_cfm_cb = le_pairing_complete_cb; 3711 conn->security_cfm_cb = le_pairing_complete_cb; 3712 conn->disconn_cfm_cb = le_pairing_complete_cb; 3713 } 3714 3715 conn->io_capability = cp->io_cap; 3716 cmd->user_data = hci_conn_get(conn); 3717 3718 if ((conn->state == BT_CONNECTED || conn->state == BT_CONFIG) && 3719 hci_conn_security(conn, sec_level, auth_type, true)) { 3720 cmd->cmd_complete(cmd, 0); 3721 mgmt_pending_remove(cmd); 3722 } 3723 3724 err = 0; 3725 3726 unlock: 3727 hci_dev_unlock(hdev); 3728 return err; 3729 } 3730 3731 static int cancel_pair_device(struct sock *sk, struct hci_dev *hdev, void *data, 3732 u16 len) 3733 { 3734 struct mgmt_addr_info *addr = data; 3735 struct mgmt_pending_cmd *cmd; 3736 struct hci_conn *conn; 3737 int err; 3738 3739 bt_dev_dbg(hdev, "sock %p", sk); 3740 3741 hci_dev_lock(hdev); 3742 3743 if (!hdev_is_powered(hdev)) { 3744 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE, 3745 MGMT_STATUS_NOT_POWERED); 3746 goto unlock; 3747 } 3748 3749 cmd = pending_find(MGMT_OP_PAIR_DEVICE, hdev); 3750 if (!cmd) { 3751 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE, 3752 MGMT_STATUS_INVALID_PARAMS); 3753 goto unlock; 3754 } 3755 3756 conn = cmd->user_data; 3757 3758 if (bacmp(&addr->bdaddr, &conn->dst) != 0) { 3759 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE, 3760 MGMT_STATUS_INVALID_PARAMS); 3761 goto unlock; 3762 } 3763 3764 cmd->cmd_complete(cmd, MGMT_STATUS_CANCELLED); 3765 mgmt_pending_remove(cmd); 3766 3767 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE, 0, 3768 addr, sizeof(*addr)); 3769 3770 /* Since user doesn't want to proceed with the connection, abort any 3771 * ongoing pairing and then terminate the link if it was created 3772 * because of the pair device action. 3773 */ 3774 if (addr->type == BDADDR_BREDR) 3775 hci_remove_link_key(hdev, &addr->bdaddr); 3776 else 3777 smp_cancel_and_remove_pairing(hdev, &addr->bdaddr, 3778 le_addr_type(addr->type)); 3779 3780 if (conn->conn_reason == CONN_REASON_PAIR_DEVICE) 3781 hci_abort_conn(conn, HCI_ERROR_REMOTE_USER_TERM); 3782 3783 unlock: 3784 hci_dev_unlock(hdev); 3785 return err; 3786 } 3787 3788 static int user_pairing_resp(struct sock *sk, struct hci_dev *hdev, 3789 struct mgmt_addr_info *addr, u16 mgmt_op, 3790 u16 hci_op, __le32 passkey) 3791 { 3792 struct mgmt_pending_cmd *cmd; 3793 struct hci_conn *conn; 3794 int err; 3795 3796 hci_dev_lock(hdev); 3797 3798 if (!hdev_is_powered(hdev)) { 3799 err = mgmt_cmd_complete(sk, hdev->id, mgmt_op, 3800 MGMT_STATUS_NOT_POWERED, addr, 3801 sizeof(*addr)); 3802 goto done; 3803 } 3804 3805 if (addr->type == BDADDR_BREDR) 3806 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &addr->bdaddr); 3807 else 3808 conn = hci_conn_hash_lookup_le(hdev, &addr->bdaddr, 3809 le_addr_type(addr->type)); 3810 3811 if (!conn) { 3812 err = mgmt_cmd_complete(sk, hdev->id, mgmt_op, 3813 MGMT_STATUS_NOT_CONNECTED, addr, 3814 sizeof(*addr)); 3815 goto done; 3816 } 3817 3818 if (addr->type == BDADDR_LE_PUBLIC || addr->type == BDADDR_LE_RANDOM) { 3819 err = smp_user_confirm_reply(conn, mgmt_op, passkey); 3820 if (!err) 3821 err = mgmt_cmd_complete(sk, hdev->id, mgmt_op, 3822 MGMT_STATUS_SUCCESS, addr, 3823 sizeof(*addr)); 3824 else 3825 err = mgmt_cmd_complete(sk, hdev->id, mgmt_op, 3826 MGMT_STATUS_FAILED, addr, 3827 sizeof(*addr)); 3828 3829 goto done; 3830 } 3831 3832 cmd = mgmt_pending_add(sk, mgmt_op, hdev, addr, sizeof(*addr)); 3833 if (!cmd) { 3834 err = -ENOMEM; 3835 goto done; 3836 } 3837 3838 cmd->cmd_complete = addr_cmd_complete; 3839 3840 /* Continue with pairing via HCI */ 3841 if (hci_op == HCI_OP_USER_PASSKEY_REPLY) { 3842 struct hci_cp_user_passkey_reply cp; 3843 3844 bacpy(&cp.bdaddr, &addr->bdaddr); 3845 cp.passkey = passkey; 3846 err = hci_send_cmd(hdev, hci_op, sizeof(cp), &cp); 3847 } else 3848 err = hci_send_cmd(hdev, hci_op, sizeof(addr->bdaddr), 3849 &addr->bdaddr); 3850 3851 if (err < 0) 3852 mgmt_pending_remove(cmd); 3853 3854 done: 3855 hci_dev_unlock(hdev); 3856 return err; 3857 } 3858 3859 static int pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev, 3860 void *data, u16 len) 3861 { 3862 struct mgmt_cp_pin_code_neg_reply *cp = data; 3863 3864 bt_dev_dbg(hdev, "sock %p", sk); 3865 3866 return user_pairing_resp(sk, hdev, &cp->addr, 3867 MGMT_OP_PIN_CODE_NEG_REPLY, 3868 HCI_OP_PIN_CODE_NEG_REPLY, 0); 3869 } 3870 3871 static int user_confirm_reply(struct sock *sk, struct hci_dev *hdev, void *data, 3872 u16 len) 3873 { 3874 struct mgmt_cp_user_confirm_reply *cp = data; 3875 3876 bt_dev_dbg(hdev, "sock %p", sk); 3877 3878 if (len != sizeof(*cp)) 3879 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_USER_CONFIRM_REPLY, 3880 MGMT_STATUS_INVALID_PARAMS); 3881 3882 return user_pairing_resp(sk, hdev, &cp->addr, 3883 MGMT_OP_USER_CONFIRM_REPLY, 3884 HCI_OP_USER_CONFIRM_REPLY, 0); 3885 } 3886 3887 static int user_confirm_neg_reply(struct sock *sk, struct hci_dev *hdev, 3888 void *data, u16 len) 3889 { 3890 struct mgmt_cp_user_confirm_neg_reply *cp = data; 3891 3892 bt_dev_dbg(hdev, "sock %p", sk); 3893 3894 return user_pairing_resp(sk, hdev, &cp->addr, 3895 MGMT_OP_USER_CONFIRM_NEG_REPLY, 3896 HCI_OP_USER_CONFIRM_NEG_REPLY, 0); 3897 } 3898 3899 static int user_passkey_reply(struct sock *sk, struct hci_dev *hdev, void *data, 3900 u16 len) 3901 { 3902 struct mgmt_cp_user_passkey_reply *cp = data; 3903 3904 bt_dev_dbg(hdev, "sock %p", sk); 3905 3906 return user_pairing_resp(sk, hdev, &cp->addr, 3907 MGMT_OP_USER_PASSKEY_REPLY, 3908 HCI_OP_USER_PASSKEY_REPLY, cp->passkey); 3909 } 3910 3911 static int user_passkey_neg_reply(struct sock *sk, struct hci_dev *hdev, 3912 void *data, u16 len) 3913 { 3914 struct mgmt_cp_user_passkey_neg_reply *cp = data; 3915 3916 bt_dev_dbg(hdev, "sock %p", sk); 3917 3918 return user_pairing_resp(sk, hdev, &cp->addr, 3919 MGMT_OP_USER_PASSKEY_NEG_REPLY, 3920 HCI_OP_USER_PASSKEY_NEG_REPLY, 0); 3921 } 3922 3923 static int adv_expire_sync(struct hci_dev *hdev, u32 flags) 3924 { 3925 struct adv_info *adv_instance; 3926 3927 adv_instance = hci_find_adv_instance(hdev, hdev->cur_adv_instance); 3928 if (!adv_instance) 3929 return 0; 3930 3931 /* stop if current instance doesn't need to be changed */ 3932 if (!(adv_instance->flags & flags)) 3933 return 0; 3934 3935 cancel_adv_timeout(hdev); 3936 3937 adv_instance = hci_get_next_instance(hdev, adv_instance->instance); 3938 if (!adv_instance) 3939 return 0; 3940 3941 hci_schedule_adv_instance_sync(hdev, adv_instance->instance, true); 3942 3943 return 0; 3944 } 3945 3946 static int name_changed_sync(struct hci_dev *hdev, void *data) 3947 { 3948 return adv_expire_sync(hdev, MGMT_ADV_FLAG_LOCAL_NAME); 3949 } 3950 3951 static void set_name_complete(struct hci_dev *hdev, void *data, int err) 3952 { 3953 struct mgmt_pending_cmd *cmd = data; 3954 struct mgmt_cp_set_local_name *cp; 3955 u8 status = mgmt_status(err); 3956 3957 bt_dev_dbg(hdev, "err %d", err); 3958 3959 if (err == -ECANCELED || !mgmt_pending_valid(hdev, cmd)) 3960 return; 3961 3962 cp = cmd->param; 3963 3964 if (status) { 3965 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 3966 status); 3967 } else { 3968 mgmt_cmd_complete(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0, 3969 cp, sizeof(*cp)); 3970 3971 if (hci_dev_test_flag(hdev, HCI_LE_ADV)) 3972 hci_cmd_sync_queue(hdev, name_changed_sync, NULL, NULL); 3973 } 3974 3975 mgmt_pending_free(cmd); 3976 } 3977 3978 static int set_name_sync(struct hci_dev *hdev, void *data) 3979 { 3980 struct mgmt_pending_cmd *cmd = data; 3981 struct mgmt_cp_set_local_name cp; 3982 3983 mutex_lock(&hdev->mgmt_pending_lock); 3984 3985 if (!__mgmt_pending_listed(hdev, cmd)) { 3986 mutex_unlock(&hdev->mgmt_pending_lock); 3987 return -ECANCELED; 3988 } 3989 3990 memcpy(&cp, cmd->param, sizeof(cp)); 3991 3992 mutex_unlock(&hdev->mgmt_pending_lock); 3993 3994 if (lmp_bredr_capable(hdev)) { 3995 hci_update_name_sync(hdev, cp.name); 3996 hci_update_eir_sync(hdev); 3997 } 3998 3999 /* The name is stored in the scan response data and so 4000 * no need to update the advertising data here. 4001 */ 4002 if (lmp_le_capable(hdev) && hci_dev_test_flag(hdev, HCI_ADVERTISING)) 4003 hci_update_scan_rsp_data_sync(hdev, hdev->cur_adv_instance); 4004 4005 return 0; 4006 } 4007 4008 static int set_local_name(struct sock *sk, struct hci_dev *hdev, void *data, 4009 u16 len) 4010 { 4011 struct mgmt_cp_set_local_name *cp = data; 4012 struct mgmt_pending_cmd *cmd; 4013 int err; 4014 4015 bt_dev_dbg(hdev, "sock %p", sk); 4016 4017 hci_dev_lock(hdev); 4018 4019 /* If the old values are the same as the new ones just return a 4020 * direct command complete event. 4021 */ 4022 if (!memcmp(hdev->dev_name, cp->name, sizeof(hdev->dev_name)) && 4023 !memcmp(hdev->short_name, cp->short_name, 4024 sizeof(hdev->short_name))) { 4025 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0, 4026 data, len); 4027 goto failed; 4028 } 4029 4030 memcpy(hdev->short_name, cp->short_name, sizeof(hdev->short_name)); 4031 4032 if (!hdev_is_powered(hdev)) { 4033 memcpy(hdev->dev_name, cp->name, sizeof(hdev->dev_name)); 4034 4035 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0, 4036 data, len); 4037 if (err < 0) 4038 goto failed; 4039 4040 err = mgmt_limited_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, data, 4041 len, HCI_MGMT_LOCAL_NAME_EVENTS, sk); 4042 ext_info_changed(hdev, sk); 4043 4044 goto failed; 4045 } 4046 4047 cmd = mgmt_pending_add(sk, MGMT_OP_SET_LOCAL_NAME, hdev, data, len); 4048 if (!cmd) 4049 err = -ENOMEM; 4050 else 4051 err = hci_cmd_sync_queue(hdev, set_name_sync, cmd, 4052 set_name_complete); 4053 4054 if (err < 0) { 4055 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 4056 MGMT_STATUS_FAILED); 4057 4058 if (cmd) 4059 mgmt_pending_remove(cmd); 4060 4061 goto failed; 4062 } 4063 4064 memcpy(hdev->dev_name, cp->name, sizeof(hdev->dev_name)); 4065 4066 failed: 4067 hci_dev_unlock(hdev); 4068 return err; 4069 } 4070 4071 static int appearance_changed_sync(struct hci_dev *hdev, void *data) 4072 { 4073 return adv_expire_sync(hdev, MGMT_ADV_FLAG_APPEARANCE); 4074 } 4075 4076 static int set_appearance(struct sock *sk, struct hci_dev *hdev, void *data, 4077 u16 len) 4078 { 4079 struct mgmt_cp_set_appearance *cp = data; 4080 u16 appearance; 4081 int err; 4082 4083 bt_dev_dbg(hdev, "sock %p", sk); 4084 4085 if (!lmp_le_capable(hdev)) 4086 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_APPEARANCE, 4087 MGMT_STATUS_NOT_SUPPORTED); 4088 4089 appearance = le16_to_cpu(cp->appearance); 4090 4091 hci_dev_lock(hdev); 4092 4093 if (hdev->appearance != appearance) { 4094 hdev->appearance = appearance; 4095 4096 if (hci_dev_test_flag(hdev, HCI_LE_ADV)) 4097 hci_cmd_sync_queue(hdev, appearance_changed_sync, NULL, 4098 NULL); 4099 4100 ext_info_changed(hdev, sk); 4101 } 4102 4103 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_APPEARANCE, 0, NULL, 4104 0); 4105 4106 hci_dev_unlock(hdev); 4107 4108 return err; 4109 } 4110 4111 static int get_phy_configuration(struct sock *sk, struct hci_dev *hdev, 4112 void *data, u16 len) 4113 { 4114 struct mgmt_rp_get_phy_configuration rp; 4115 4116 bt_dev_dbg(hdev, "sock %p", sk); 4117 4118 hci_dev_lock(hdev); 4119 4120 memset(&rp, 0, sizeof(rp)); 4121 4122 rp.supported_phys = cpu_to_le32(get_supported_phys(hdev)); 4123 rp.selected_phys = cpu_to_le32(get_selected_phys(hdev)); 4124 rp.configurable_phys = cpu_to_le32(get_configurable_phys(hdev)); 4125 4126 hci_dev_unlock(hdev); 4127 4128 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_PHY_CONFIGURATION, 0, 4129 &rp, sizeof(rp)); 4130 } 4131 4132 int mgmt_phy_configuration_changed(struct hci_dev *hdev, struct sock *skip) 4133 { 4134 struct mgmt_ev_phy_configuration_changed ev; 4135 4136 memset(&ev, 0, sizeof(ev)); 4137 4138 ev.selected_phys = cpu_to_le32(get_selected_phys(hdev)); 4139 4140 return mgmt_event(MGMT_EV_PHY_CONFIGURATION_CHANGED, hdev, &ev, 4141 sizeof(ev), skip); 4142 } 4143 4144 static void set_default_phy_complete(struct hci_dev *hdev, void *data, int err) 4145 { 4146 struct mgmt_pending_cmd *cmd = data; 4147 struct sk_buff *skb; 4148 u8 status = mgmt_status(err); 4149 4150 skb = cmd->skb; 4151 4152 if (!status) { 4153 if (!skb) 4154 status = MGMT_STATUS_FAILED; 4155 else if (IS_ERR(skb)) 4156 status = mgmt_status(PTR_ERR(skb)); 4157 else 4158 status = mgmt_status(skb->data[0]); 4159 } 4160 4161 bt_dev_dbg(hdev, "status %d", status); 4162 4163 if (status) { 4164 mgmt_cmd_status(cmd->sk, hdev->id, 4165 MGMT_OP_SET_PHY_CONFIGURATION, status); 4166 } else { 4167 mgmt_cmd_complete(cmd->sk, hdev->id, 4168 MGMT_OP_SET_PHY_CONFIGURATION, 0, 4169 NULL, 0); 4170 4171 mgmt_phy_configuration_changed(hdev, cmd->sk); 4172 } 4173 4174 if (skb && !IS_ERR(skb)) 4175 kfree_skb(skb); 4176 4177 mgmt_pending_free(cmd); 4178 } 4179 4180 static int set_default_phy_sync(struct hci_dev *hdev, void *data) 4181 { 4182 struct mgmt_pending_cmd *cmd = data; 4183 struct mgmt_cp_set_phy_configuration *cp = cmd->param; 4184 struct hci_cp_le_set_default_phy cp_phy; 4185 u32 selected_phys; 4186 4187 selected_phys = __le32_to_cpu(cp->selected_phys); 4188 4189 memset(&cp_phy, 0, sizeof(cp_phy)); 4190 4191 if (!(selected_phys & MGMT_PHY_LE_TX_MASK)) 4192 cp_phy.all_phys |= 0x01; 4193 4194 if (!(selected_phys & MGMT_PHY_LE_RX_MASK)) 4195 cp_phy.all_phys |= 0x02; 4196 4197 if (selected_phys & MGMT_PHY_LE_1M_TX) 4198 cp_phy.tx_phys |= HCI_LE_SET_PHY_1M; 4199 4200 if (selected_phys & MGMT_PHY_LE_2M_TX) 4201 cp_phy.tx_phys |= HCI_LE_SET_PHY_2M; 4202 4203 if (selected_phys & MGMT_PHY_LE_CODED_TX) 4204 cp_phy.tx_phys |= HCI_LE_SET_PHY_CODED; 4205 4206 if (selected_phys & MGMT_PHY_LE_1M_RX) 4207 cp_phy.rx_phys |= HCI_LE_SET_PHY_1M; 4208 4209 if (selected_phys & MGMT_PHY_LE_2M_RX) 4210 cp_phy.rx_phys |= HCI_LE_SET_PHY_2M; 4211 4212 if (selected_phys & MGMT_PHY_LE_CODED_RX) 4213 cp_phy.rx_phys |= HCI_LE_SET_PHY_CODED; 4214 4215 cmd->skb = __hci_cmd_sync(hdev, HCI_OP_LE_SET_DEFAULT_PHY, 4216 sizeof(cp_phy), &cp_phy, HCI_CMD_TIMEOUT); 4217 4218 return 0; 4219 } 4220 4221 static int set_phy_configuration(struct sock *sk, struct hci_dev *hdev, 4222 void *data, u16 len) 4223 { 4224 struct mgmt_cp_set_phy_configuration *cp = data; 4225 struct mgmt_pending_cmd *cmd; 4226 u32 selected_phys, configurable_phys, supported_phys, unconfigure_phys; 4227 u16 pkt_type = (HCI_DH1 | HCI_DM1); 4228 bool changed = false; 4229 int err; 4230 4231 bt_dev_dbg(hdev, "sock %p", sk); 4232 4233 configurable_phys = get_configurable_phys(hdev); 4234 supported_phys = get_supported_phys(hdev); 4235 selected_phys = __le32_to_cpu(cp->selected_phys); 4236 4237 if (selected_phys & ~supported_phys) 4238 return mgmt_cmd_status(sk, hdev->id, 4239 MGMT_OP_SET_PHY_CONFIGURATION, 4240 MGMT_STATUS_INVALID_PARAMS); 4241 4242 unconfigure_phys = supported_phys & ~configurable_phys; 4243 4244 if ((selected_phys & unconfigure_phys) != unconfigure_phys) 4245 return mgmt_cmd_status(sk, hdev->id, 4246 MGMT_OP_SET_PHY_CONFIGURATION, 4247 MGMT_STATUS_INVALID_PARAMS); 4248 4249 if (selected_phys == get_selected_phys(hdev)) 4250 return mgmt_cmd_complete(sk, hdev->id, 4251 MGMT_OP_SET_PHY_CONFIGURATION, 4252 0, NULL, 0); 4253 4254 hci_dev_lock(hdev); 4255 4256 if (!hdev_is_powered(hdev)) { 4257 err = mgmt_cmd_status(sk, hdev->id, 4258 MGMT_OP_SET_PHY_CONFIGURATION, 4259 MGMT_STATUS_REJECTED); 4260 goto unlock; 4261 } 4262 4263 if (pending_find(MGMT_OP_SET_PHY_CONFIGURATION, hdev)) { 4264 err = mgmt_cmd_status(sk, hdev->id, 4265 MGMT_OP_SET_PHY_CONFIGURATION, 4266 MGMT_STATUS_BUSY); 4267 goto unlock; 4268 } 4269 4270 if (selected_phys & MGMT_PHY_BR_1M_3SLOT) 4271 pkt_type |= (HCI_DH3 | HCI_DM3); 4272 else 4273 pkt_type &= ~(HCI_DH3 | HCI_DM3); 4274 4275 if (selected_phys & MGMT_PHY_BR_1M_5SLOT) 4276 pkt_type |= (HCI_DH5 | HCI_DM5); 4277 else 4278 pkt_type &= ~(HCI_DH5 | HCI_DM5); 4279 4280 if (selected_phys & MGMT_PHY_EDR_2M_1SLOT) 4281 pkt_type &= ~HCI_2DH1; 4282 else 4283 pkt_type |= HCI_2DH1; 4284 4285 if (selected_phys & MGMT_PHY_EDR_2M_3SLOT) 4286 pkt_type &= ~HCI_2DH3; 4287 else 4288 pkt_type |= HCI_2DH3; 4289 4290 if (selected_phys & MGMT_PHY_EDR_2M_5SLOT) 4291 pkt_type &= ~HCI_2DH5; 4292 else 4293 pkt_type |= HCI_2DH5; 4294 4295 if (selected_phys & MGMT_PHY_EDR_3M_1SLOT) 4296 pkt_type &= ~HCI_3DH1; 4297 else 4298 pkt_type |= HCI_3DH1; 4299 4300 if (selected_phys & MGMT_PHY_EDR_3M_3SLOT) 4301 pkt_type &= ~HCI_3DH3; 4302 else 4303 pkt_type |= HCI_3DH3; 4304 4305 if (selected_phys & MGMT_PHY_EDR_3M_5SLOT) 4306 pkt_type &= ~HCI_3DH5; 4307 else 4308 pkt_type |= HCI_3DH5; 4309 4310 if (pkt_type != hdev->pkt_type) { 4311 hdev->pkt_type = pkt_type; 4312 changed = true; 4313 } 4314 4315 if ((selected_phys & MGMT_PHY_LE_MASK) == 4316 (get_selected_phys(hdev) & MGMT_PHY_LE_MASK)) { 4317 if (changed) 4318 mgmt_phy_configuration_changed(hdev, sk); 4319 4320 err = mgmt_cmd_complete(sk, hdev->id, 4321 MGMT_OP_SET_PHY_CONFIGURATION, 4322 0, NULL, 0); 4323 4324 goto unlock; 4325 } 4326 4327 cmd = mgmt_pending_new(sk, MGMT_OP_SET_PHY_CONFIGURATION, hdev, data, 4328 len); 4329 if (!cmd) 4330 err = -ENOMEM; 4331 else 4332 err = hci_cmd_sync_queue(hdev, set_default_phy_sync, cmd, 4333 set_default_phy_complete); 4334 4335 if (err < 0) { 4336 err = mgmt_cmd_status(sk, hdev->id, 4337 MGMT_OP_SET_PHY_CONFIGURATION, 4338 MGMT_STATUS_FAILED); 4339 4340 if (cmd) 4341 mgmt_pending_remove(cmd); 4342 } 4343 4344 unlock: 4345 hci_dev_unlock(hdev); 4346 4347 return err; 4348 } 4349 4350 static int set_blocked_keys(struct sock *sk, struct hci_dev *hdev, void *data, 4351 u16 len) 4352 { 4353 int err = MGMT_STATUS_SUCCESS; 4354 struct mgmt_cp_set_blocked_keys *keys = data; 4355 const u16 max_key_count = ((U16_MAX - sizeof(*keys)) / 4356 sizeof(struct mgmt_blocked_key_info)); 4357 u16 key_count, expected_len; 4358 int i; 4359 4360 bt_dev_dbg(hdev, "sock %p", sk); 4361 4362 key_count = __le16_to_cpu(keys->key_count); 4363 if (key_count > max_key_count) { 4364 bt_dev_err(hdev, "too big key_count value %u", key_count); 4365 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BLOCKED_KEYS, 4366 MGMT_STATUS_INVALID_PARAMS); 4367 } 4368 4369 expected_len = struct_size(keys, keys, key_count); 4370 if (expected_len != len) { 4371 bt_dev_err(hdev, "expected %u bytes, got %u bytes", 4372 expected_len, len); 4373 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BLOCKED_KEYS, 4374 MGMT_STATUS_INVALID_PARAMS); 4375 } 4376 4377 hci_dev_lock(hdev); 4378 4379 hci_blocked_keys_clear(hdev); 4380 4381 for (i = 0; i < key_count; ++i) { 4382 struct blocked_key *b = kzalloc_obj(*b); 4383 4384 if (!b) { 4385 err = MGMT_STATUS_NO_RESOURCES; 4386 break; 4387 } 4388 4389 b->type = keys->keys[i].type; 4390 memcpy(b->val, keys->keys[i].val, sizeof(b->val)); 4391 list_add_rcu(&b->list, &hdev->blocked_keys); 4392 } 4393 hci_dev_unlock(hdev); 4394 4395 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_BLOCKED_KEYS, 4396 err, NULL, 0); 4397 } 4398 4399 static int set_wideband_speech(struct sock *sk, struct hci_dev *hdev, 4400 void *data, u16 len) 4401 { 4402 struct mgmt_mode *cp = data; 4403 int err; 4404 bool changed = false; 4405 4406 bt_dev_dbg(hdev, "sock %p", sk); 4407 4408 if (!hci_test_quirk(hdev, HCI_QUIRK_WIDEBAND_SPEECH_SUPPORTED)) 4409 return mgmt_cmd_status(sk, hdev->id, 4410 MGMT_OP_SET_WIDEBAND_SPEECH, 4411 MGMT_STATUS_NOT_SUPPORTED); 4412 4413 if (cp->val != 0x00 && cp->val != 0x01) 4414 return mgmt_cmd_status(sk, hdev->id, 4415 MGMT_OP_SET_WIDEBAND_SPEECH, 4416 MGMT_STATUS_INVALID_PARAMS); 4417 4418 hci_dev_lock(hdev); 4419 4420 if (hdev_is_powered(hdev) && 4421 !!cp->val != hci_dev_test_flag(hdev, 4422 HCI_WIDEBAND_SPEECH_ENABLED)) { 4423 err = mgmt_cmd_status(sk, hdev->id, 4424 MGMT_OP_SET_WIDEBAND_SPEECH, 4425 MGMT_STATUS_REJECTED); 4426 goto unlock; 4427 } 4428 4429 if (cp->val) 4430 changed = !hci_dev_test_and_set_flag(hdev, 4431 HCI_WIDEBAND_SPEECH_ENABLED); 4432 else 4433 changed = hci_dev_test_and_clear_flag(hdev, 4434 HCI_WIDEBAND_SPEECH_ENABLED); 4435 4436 err = send_settings_rsp(sk, MGMT_OP_SET_WIDEBAND_SPEECH, hdev); 4437 if (err < 0) 4438 goto unlock; 4439 4440 if (changed) 4441 err = new_settings(hdev, sk); 4442 4443 unlock: 4444 hci_dev_unlock(hdev); 4445 return err; 4446 } 4447 4448 static int read_controller_cap(struct sock *sk, struct hci_dev *hdev, 4449 void *data, u16 data_len) 4450 { 4451 char buf[20]; 4452 struct mgmt_rp_read_controller_cap *rp = (void *)buf; 4453 u16 cap_len = 0; 4454 u8 flags = 0; 4455 u8 tx_power_range[2]; 4456 4457 bt_dev_dbg(hdev, "sock %p", sk); 4458 4459 memset(&buf, 0, sizeof(buf)); 4460 4461 hci_dev_lock(hdev); 4462 4463 /* When the Read Simple Pairing Options command is supported, then 4464 * the remote public key validation is supported. 4465 * 4466 * Alternatively, when Microsoft extensions are available, they can 4467 * indicate support for public key validation as well. 4468 */ 4469 if ((hdev->commands[41] & 0x08) || msft_curve_validity(hdev)) 4470 flags |= 0x01; /* Remote public key validation (BR/EDR) */ 4471 4472 flags |= 0x02; /* Remote public key validation (LE) */ 4473 4474 /* When the Read Encryption Key Size command is supported, then the 4475 * encryption key size is enforced. 4476 */ 4477 if (hdev->commands[20] & 0x10) 4478 flags |= 0x04; /* Encryption key size enforcement (BR/EDR) */ 4479 4480 flags |= 0x08; /* Encryption key size enforcement (LE) */ 4481 4482 cap_len = eir_append_data(rp->cap, cap_len, MGMT_CAP_SEC_FLAGS, 4483 &flags, 1); 4484 4485 /* When the Read Simple Pairing Options command is supported, then 4486 * also max encryption key size information is provided. 4487 */ 4488 if (hdev->commands[41] & 0x08) 4489 cap_len = eir_append_le16(rp->cap, cap_len, 4490 MGMT_CAP_MAX_ENC_KEY_SIZE, 4491 hdev->max_enc_key_size); 4492 4493 cap_len = eir_append_le16(rp->cap, cap_len, 4494 MGMT_CAP_SMP_MAX_ENC_KEY_SIZE, 4495 SMP_MAX_ENC_KEY_SIZE); 4496 4497 /* Append the min/max LE tx power parameters if we were able to fetch 4498 * it from the controller 4499 */ 4500 if (hdev->commands[38] & 0x80) { 4501 memcpy(&tx_power_range[0], &hdev->min_le_tx_power, 1); 4502 memcpy(&tx_power_range[1], &hdev->max_le_tx_power, 1); 4503 cap_len = eir_append_data(rp->cap, cap_len, MGMT_CAP_LE_TX_PWR, 4504 tx_power_range, 2); 4505 } 4506 4507 rp->cap_len = cpu_to_le16(cap_len); 4508 4509 hci_dev_unlock(hdev); 4510 4511 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_CONTROLLER_CAP, 0, 4512 rp, sizeof(*rp) + cap_len); 4513 } 4514 4515 #ifdef CONFIG_BT_FEATURE_DEBUG 4516 /* d4992530-b9ec-469f-ab01-6c481c47da1c */ 4517 static const u8 debug_uuid[16] = { 4518 0x1c, 0xda, 0x47, 0x1c, 0x48, 0x6c, 0x01, 0xab, 4519 0x9f, 0x46, 0xec, 0xb9, 0x30, 0x25, 0x99, 0xd4, 4520 }; 4521 #endif 4522 4523 /* 330859bc-7506-492d-9370-9a6f0614037f */ 4524 static const u8 quality_report_uuid[16] = { 4525 0x7f, 0x03, 0x14, 0x06, 0x6f, 0x9a, 0x70, 0x93, 4526 0x2d, 0x49, 0x06, 0x75, 0xbc, 0x59, 0x08, 0x33, 4527 }; 4528 4529 /* a6695ace-ee7f-4fb9-881a-5fac66c629af */ 4530 static const u8 offload_codecs_uuid[16] = { 4531 0xaf, 0x29, 0xc6, 0x66, 0xac, 0x5f, 0x1a, 0x88, 4532 0xb9, 0x4f, 0x7f, 0xee, 0xce, 0x5a, 0x69, 0xa6, 4533 }; 4534 4535 /* 671b10b5-42c0-4696-9227-eb28d1b049d6 */ 4536 static const u8 le_simultaneous_roles_uuid[16] = { 4537 0xd6, 0x49, 0xb0, 0xd1, 0x28, 0xeb, 0x27, 0x92, 4538 0x96, 0x46, 0xc0, 0x42, 0xb5, 0x10, 0x1b, 0x67, 4539 }; 4540 4541 /* 6fbaf188-05e0-496a-9885-d6ddfdb4e03e */ 4542 static const u8 iso_socket_uuid[16] = { 4543 0x3e, 0xe0, 0xb4, 0xfd, 0xdd, 0xd6, 0x85, 0x98, 4544 0x6a, 0x49, 0xe0, 0x05, 0x88, 0xf1, 0xba, 0x6f, 4545 }; 4546 4547 /* 2ce463d7-7a03-4d8d-bf05-5f24e8f36e76 */ 4548 static const u8 mgmt_mesh_uuid[16] = { 4549 0x76, 0x6e, 0xf3, 0xe8, 0x24, 0x5f, 0x05, 0xbf, 4550 0x8d, 0x4d, 0x03, 0x7a, 0xd7, 0x63, 0xe4, 0x2c, 4551 }; 4552 4553 static int read_exp_features_info(struct sock *sk, struct hci_dev *hdev, 4554 void *data, u16 data_len) 4555 { 4556 struct mgmt_rp_read_exp_features_info *rp; 4557 size_t len; 4558 u16 idx = 0; 4559 u32 flags; 4560 int status; 4561 4562 bt_dev_dbg(hdev, "sock %p", sk); 4563 4564 /* Enough space for 7 features */ 4565 len = sizeof(*rp) + (sizeof(rp->features[0]) * 7); 4566 rp = kzalloc(len, GFP_KERNEL); 4567 if (!rp) 4568 return -ENOMEM; 4569 4570 #ifdef CONFIG_BT_FEATURE_DEBUG 4571 flags = bt_dbg_get() ? BIT(0) : 0; 4572 4573 memcpy(rp->features[idx].uuid, debug_uuid, 16); 4574 rp->features[idx].flags = cpu_to_le32(flags); 4575 idx++; 4576 #endif 4577 4578 if (hdev && hci_dev_le_state_simultaneous(hdev)) { 4579 if (hci_dev_test_flag(hdev, HCI_LE_SIMULTANEOUS_ROLES)) 4580 flags = BIT(0); 4581 else 4582 flags = 0; 4583 4584 memcpy(rp->features[idx].uuid, le_simultaneous_roles_uuid, 16); 4585 rp->features[idx].flags = cpu_to_le32(flags); 4586 idx++; 4587 } 4588 4589 if (hdev && (aosp_has_quality_report(hdev) || 4590 hdev->set_quality_report)) { 4591 if (hci_dev_test_flag(hdev, HCI_QUALITY_REPORT)) 4592 flags = BIT(0); 4593 else 4594 flags = 0; 4595 4596 memcpy(rp->features[idx].uuid, quality_report_uuid, 16); 4597 rp->features[idx].flags = cpu_to_le32(flags); 4598 idx++; 4599 } 4600 4601 if (hdev && hdev->get_data_path_id) { 4602 if (hci_dev_test_flag(hdev, HCI_OFFLOAD_CODECS_ENABLED)) 4603 flags = BIT(0); 4604 else 4605 flags = 0; 4606 4607 memcpy(rp->features[idx].uuid, offload_codecs_uuid, 16); 4608 rp->features[idx].flags = cpu_to_le32(flags); 4609 idx++; 4610 } 4611 4612 if (IS_ENABLED(CONFIG_BT_LE)) { 4613 flags = iso_inited() ? BIT(0) : 0; 4614 memcpy(rp->features[idx].uuid, iso_socket_uuid, 16); 4615 rp->features[idx].flags = cpu_to_le32(flags); 4616 idx++; 4617 } 4618 4619 if (hdev && lmp_le_capable(hdev)) { 4620 if (hci_dev_test_flag(hdev, HCI_MESH_EXPERIMENTAL)) 4621 flags = BIT(0); 4622 else 4623 flags = 0; 4624 4625 memcpy(rp->features[idx].uuid, mgmt_mesh_uuid, 16); 4626 rp->features[idx].flags = cpu_to_le32(flags); 4627 idx++; 4628 } 4629 4630 rp->feature_count = cpu_to_le16(idx); 4631 4632 /* After reading the experimental features information, enable 4633 * the events to update client on any future change. 4634 */ 4635 hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS); 4636 4637 status = mgmt_cmd_complete(sk, hdev ? hdev->id : MGMT_INDEX_NONE, 4638 MGMT_OP_READ_EXP_FEATURES_INFO, 4639 0, rp, sizeof(*rp) + (20 * idx)); 4640 4641 kfree(rp); 4642 return status; 4643 } 4644 4645 static int exp_feature_changed(struct hci_dev *hdev, const u8 *uuid, 4646 bool enabled, struct sock *skip) 4647 { 4648 struct mgmt_ev_exp_feature_changed ev; 4649 4650 memset(&ev, 0, sizeof(ev)); 4651 memcpy(ev.uuid, uuid, 16); 4652 ev.flags = cpu_to_le32(enabled ? BIT(0) : 0); 4653 4654 return mgmt_limited_event(MGMT_EV_EXP_FEATURE_CHANGED, hdev, 4655 &ev, sizeof(ev), 4656 HCI_MGMT_EXP_FEATURE_EVENTS, skip); 4657 } 4658 4659 #define EXP_FEAT(_uuid, _set_func) \ 4660 { \ 4661 .uuid = _uuid, \ 4662 .set_func = _set_func, \ 4663 } 4664 4665 /* The zero key uuid is special. Multiple exp features are set through it. */ 4666 static int set_zero_key_func(struct sock *sk, struct hci_dev *hdev, 4667 struct mgmt_cp_set_exp_feature *cp, u16 data_len) 4668 { 4669 struct mgmt_rp_set_exp_feature rp; 4670 4671 memset(rp.uuid, 0, 16); 4672 rp.flags = cpu_to_le32(0); 4673 4674 #ifdef CONFIG_BT_FEATURE_DEBUG 4675 if (!hdev) { 4676 bool changed = bt_dbg_get(); 4677 4678 bt_dbg_set(false); 4679 4680 if (changed) 4681 exp_feature_changed(NULL, ZERO_KEY, false, sk); 4682 } 4683 #endif 4684 4685 hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS); 4686 4687 return mgmt_cmd_complete(sk, hdev ? hdev->id : MGMT_INDEX_NONE, 4688 MGMT_OP_SET_EXP_FEATURE, 0, 4689 &rp, sizeof(rp)); 4690 } 4691 4692 #ifdef CONFIG_BT_FEATURE_DEBUG 4693 static int set_debug_func(struct sock *sk, struct hci_dev *hdev, 4694 struct mgmt_cp_set_exp_feature *cp, u16 data_len) 4695 { 4696 struct mgmt_rp_set_exp_feature rp; 4697 4698 bool val, changed; 4699 int err; 4700 4701 /* Command requires to use the non-controller index */ 4702 if (hdev) 4703 return mgmt_cmd_status(sk, hdev->id, 4704 MGMT_OP_SET_EXP_FEATURE, 4705 MGMT_STATUS_INVALID_INDEX); 4706 4707 /* Parameters are limited to a single octet */ 4708 if (data_len != MGMT_SET_EXP_FEATURE_SIZE + 1) 4709 return mgmt_cmd_status(sk, MGMT_INDEX_NONE, 4710 MGMT_OP_SET_EXP_FEATURE, 4711 MGMT_STATUS_INVALID_PARAMS); 4712 4713 /* Only boolean on/off is supported */ 4714 if (cp->param[0] != 0x00 && cp->param[0] != 0x01) 4715 return mgmt_cmd_status(sk, MGMT_INDEX_NONE, 4716 MGMT_OP_SET_EXP_FEATURE, 4717 MGMT_STATUS_INVALID_PARAMS); 4718 4719 val = !!cp->param[0]; 4720 changed = val ? !bt_dbg_get() : bt_dbg_get(); 4721 bt_dbg_set(val); 4722 4723 memcpy(rp.uuid, debug_uuid, 16); 4724 rp.flags = cpu_to_le32(val ? BIT(0) : 0); 4725 4726 hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS); 4727 4728 err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE, 4729 MGMT_OP_SET_EXP_FEATURE, 0, 4730 &rp, sizeof(rp)); 4731 4732 if (changed) 4733 exp_feature_changed(hdev, debug_uuid, val, sk); 4734 4735 return err; 4736 } 4737 #endif 4738 4739 static int set_mgmt_mesh_func(struct sock *sk, struct hci_dev *hdev, 4740 struct mgmt_cp_set_exp_feature *cp, u16 data_len) 4741 { 4742 struct mgmt_rp_set_exp_feature rp; 4743 bool val, changed; 4744 int err; 4745 4746 /* Command requires to use the controller index */ 4747 if (!hdev) 4748 return mgmt_cmd_status(sk, MGMT_INDEX_NONE, 4749 MGMT_OP_SET_EXP_FEATURE, 4750 MGMT_STATUS_INVALID_INDEX); 4751 4752 /* Parameters are limited to a single octet */ 4753 if (data_len != MGMT_SET_EXP_FEATURE_SIZE + 1) 4754 return mgmt_cmd_status(sk, hdev->id, 4755 MGMT_OP_SET_EXP_FEATURE, 4756 MGMT_STATUS_INVALID_PARAMS); 4757 4758 /* Only boolean on/off is supported */ 4759 if (cp->param[0] != 0x00 && cp->param[0] != 0x01) 4760 return mgmt_cmd_status(sk, hdev->id, 4761 MGMT_OP_SET_EXP_FEATURE, 4762 MGMT_STATUS_INVALID_PARAMS); 4763 4764 val = !!cp->param[0]; 4765 4766 if (val) { 4767 changed = !hci_dev_test_and_set_flag(hdev, 4768 HCI_MESH_EXPERIMENTAL); 4769 } else { 4770 hci_dev_clear_flag(hdev, HCI_MESH); 4771 changed = hci_dev_test_and_clear_flag(hdev, 4772 HCI_MESH_EXPERIMENTAL); 4773 } 4774 4775 memcpy(rp.uuid, mgmt_mesh_uuid, 16); 4776 rp.flags = cpu_to_le32(val ? BIT(0) : 0); 4777 4778 hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS); 4779 4780 err = mgmt_cmd_complete(sk, hdev->id, 4781 MGMT_OP_SET_EXP_FEATURE, 0, 4782 &rp, sizeof(rp)); 4783 4784 if (changed) 4785 exp_feature_changed(hdev, mgmt_mesh_uuid, val, sk); 4786 4787 return err; 4788 } 4789 4790 static int set_quality_report_func(struct sock *sk, struct hci_dev *hdev, 4791 struct mgmt_cp_set_exp_feature *cp, 4792 u16 data_len) 4793 { 4794 struct mgmt_rp_set_exp_feature rp; 4795 bool val, changed; 4796 int err; 4797 4798 /* Command requires to use a valid controller index */ 4799 if (!hdev) 4800 return mgmt_cmd_status(sk, MGMT_INDEX_NONE, 4801 MGMT_OP_SET_EXP_FEATURE, 4802 MGMT_STATUS_INVALID_INDEX); 4803 4804 /* Parameters are limited to a single octet */ 4805 if (data_len != MGMT_SET_EXP_FEATURE_SIZE + 1) 4806 return mgmt_cmd_status(sk, hdev->id, 4807 MGMT_OP_SET_EXP_FEATURE, 4808 MGMT_STATUS_INVALID_PARAMS); 4809 4810 /* Only boolean on/off is supported */ 4811 if (cp->param[0] != 0x00 && cp->param[0] != 0x01) 4812 return mgmt_cmd_status(sk, hdev->id, 4813 MGMT_OP_SET_EXP_FEATURE, 4814 MGMT_STATUS_INVALID_PARAMS); 4815 4816 hci_req_sync_lock(hdev); 4817 4818 val = !!cp->param[0]; 4819 changed = (val != hci_dev_test_flag(hdev, HCI_QUALITY_REPORT)); 4820 4821 if (!aosp_has_quality_report(hdev) && !hdev->set_quality_report) { 4822 err = mgmt_cmd_status(sk, hdev->id, 4823 MGMT_OP_SET_EXP_FEATURE, 4824 MGMT_STATUS_NOT_SUPPORTED); 4825 goto unlock_quality_report; 4826 } 4827 4828 if (changed) { 4829 if (hdev->set_quality_report) 4830 err = hdev->set_quality_report(hdev, val); 4831 else 4832 err = aosp_set_quality_report(hdev, val); 4833 4834 if (err) { 4835 err = mgmt_cmd_status(sk, hdev->id, 4836 MGMT_OP_SET_EXP_FEATURE, 4837 MGMT_STATUS_FAILED); 4838 goto unlock_quality_report; 4839 } 4840 4841 if (val) 4842 hci_dev_set_flag(hdev, HCI_QUALITY_REPORT); 4843 else 4844 hci_dev_clear_flag(hdev, HCI_QUALITY_REPORT); 4845 } 4846 4847 bt_dev_dbg(hdev, "quality report enable %d changed %d", val, changed); 4848 4849 memcpy(rp.uuid, quality_report_uuid, 16); 4850 rp.flags = cpu_to_le32(val ? BIT(0) : 0); 4851 hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS); 4852 4853 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_EXP_FEATURE, 0, 4854 &rp, sizeof(rp)); 4855 4856 if (changed) 4857 exp_feature_changed(hdev, quality_report_uuid, val, sk); 4858 4859 unlock_quality_report: 4860 hci_req_sync_unlock(hdev); 4861 return err; 4862 } 4863 4864 static int set_offload_codec_func(struct sock *sk, struct hci_dev *hdev, 4865 struct mgmt_cp_set_exp_feature *cp, 4866 u16 data_len) 4867 { 4868 bool val, changed; 4869 int err; 4870 struct mgmt_rp_set_exp_feature rp; 4871 4872 /* Command requires to use a valid controller index */ 4873 if (!hdev) 4874 return mgmt_cmd_status(sk, MGMT_INDEX_NONE, 4875 MGMT_OP_SET_EXP_FEATURE, 4876 MGMT_STATUS_INVALID_INDEX); 4877 4878 /* Parameters are limited to a single octet */ 4879 if (data_len != MGMT_SET_EXP_FEATURE_SIZE + 1) 4880 return mgmt_cmd_status(sk, hdev->id, 4881 MGMT_OP_SET_EXP_FEATURE, 4882 MGMT_STATUS_INVALID_PARAMS); 4883 4884 /* Only boolean on/off is supported */ 4885 if (cp->param[0] != 0x00 && cp->param[0] != 0x01) 4886 return mgmt_cmd_status(sk, hdev->id, 4887 MGMT_OP_SET_EXP_FEATURE, 4888 MGMT_STATUS_INVALID_PARAMS); 4889 4890 val = !!cp->param[0]; 4891 changed = (val != hci_dev_test_flag(hdev, HCI_OFFLOAD_CODECS_ENABLED)); 4892 4893 if (!hdev->get_data_path_id) { 4894 return mgmt_cmd_status(sk, hdev->id, 4895 MGMT_OP_SET_EXP_FEATURE, 4896 MGMT_STATUS_NOT_SUPPORTED); 4897 } 4898 4899 if (changed) { 4900 if (val) 4901 hci_dev_set_flag(hdev, HCI_OFFLOAD_CODECS_ENABLED); 4902 else 4903 hci_dev_clear_flag(hdev, HCI_OFFLOAD_CODECS_ENABLED); 4904 } 4905 4906 bt_dev_info(hdev, "offload codecs enable %d changed %d", 4907 val, changed); 4908 4909 memcpy(rp.uuid, offload_codecs_uuid, 16); 4910 rp.flags = cpu_to_le32(val ? BIT(0) : 0); 4911 hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS); 4912 err = mgmt_cmd_complete(sk, hdev->id, 4913 MGMT_OP_SET_EXP_FEATURE, 0, 4914 &rp, sizeof(rp)); 4915 4916 if (changed) 4917 exp_feature_changed(hdev, offload_codecs_uuid, val, sk); 4918 4919 return err; 4920 } 4921 4922 static int set_le_simultaneous_roles_func(struct sock *sk, struct hci_dev *hdev, 4923 struct mgmt_cp_set_exp_feature *cp, 4924 u16 data_len) 4925 { 4926 bool val, changed; 4927 int err; 4928 struct mgmt_rp_set_exp_feature rp; 4929 4930 /* Command requires to use a valid controller index */ 4931 if (!hdev) 4932 return mgmt_cmd_status(sk, MGMT_INDEX_NONE, 4933 MGMT_OP_SET_EXP_FEATURE, 4934 MGMT_STATUS_INVALID_INDEX); 4935 4936 /* Parameters are limited to a single octet */ 4937 if (data_len != MGMT_SET_EXP_FEATURE_SIZE + 1) 4938 return mgmt_cmd_status(sk, hdev->id, 4939 MGMT_OP_SET_EXP_FEATURE, 4940 MGMT_STATUS_INVALID_PARAMS); 4941 4942 /* Only boolean on/off is supported */ 4943 if (cp->param[0] != 0x00 && cp->param[0] != 0x01) 4944 return mgmt_cmd_status(sk, hdev->id, 4945 MGMT_OP_SET_EXP_FEATURE, 4946 MGMT_STATUS_INVALID_PARAMS); 4947 4948 val = !!cp->param[0]; 4949 changed = (val != hci_dev_test_flag(hdev, HCI_LE_SIMULTANEOUS_ROLES)); 4950 4951 if (!hci_dev_le_state_simultaneous(hdev)) { 4952 return mgmt_cmd_status(sk, hdev->id, 4953 MGMT_OP_SET_EXP_FEATURE, 4954 MGMT_STATUS_NOT_SUPPORTED); 4955 } 4956 4957 if (changed) { 4958 if (val) 4959 hci_dev_set_flag(hdev, HCI_LE_SIMULTANEOUS_ROLES); 4960 else 4961 hci_dev_clear_flag(hdev, HCI_LE_SIMULTANEOUS_ROLES); 4962 } 4963 4964 bt_dev_info(hdev, "LE simultaneous roles enable %d changed %d", 4965 val, changed); 4966 4967 memcpy(rp.uuid, le_simultaneous_roles_uuid, 16); 4968 rp.flags = cpu_to_le32(val ? BIT(0) : 0); 4969 hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS); 4970 err = mgmt_cmd_complete(sk, hdev->id, 4971 MGMT_OP_SET_EXP_FEATURE, 0, 4972 &rp, sizeof(rp)); 4973 4974 if (changed) 4975 exp_feature_changed(hdev, le_simultaneous_roles_uuid, val, sk); 4976 4977 return err; 4978 } 4979 4980 #ifdef CONFIG_BT_LE 4981 static int set_iso_socket_func(struct sock *sk, struct hci_dev *hdev, 4982 struct mgmt_cp_set_exp_feature *cp, u16 data_len) 4983 { 4984 struct mgmt_rp_set_exp_feature rp; 4985 bool val, changed = false; 4986 int err; 4987 4988 /* Command requires to use the non-controller index */ 4989 if (hdev) 4990 return mgmt_cmd_status(sk, hdev->id, 4991 MGMT_OP_SET_EXP_FEATURE, 4992 MGMT_STATUS_INVALID_INDEX); 4993 4994 /* Parameters are limited to a single octet */ 4995 if (data_len != MGMT_SET_EXP_FEATURE_SIZE + 1) 4996 return mgmt_cmd_status(sk, MGMT_INDEX_NONE, 4997 MGMT_OP_SET_EXP_FEATURE, 4998 MGMT_STATUS_INVALID_PARAMS); 4999 5000 /* Only boolean on/off is supported */ 5001 if (cp->param[0] != 0x00 && cp->param[0] != 0x01) 5002 return mgmt_cmd_status(sk, MGMT_INDEX_NONE, 5003 MGMT_OP_SET_EXP_FEATURE, 5004 MGMT_STATUS_INVALID_PARAMS); 5005 5006 val = cp->param[0] ? true : false; 5007 if (val) 5008 err = iso_init(); 5009 else 5010 err = iso_exit(); 5011 5012 if (!err) 5013 changed = true; 5014 5015 memcpy(rp.uuid, iso_socket_uuid, 16); 5016 rp.flags = cpu_to_le32(val ? BIT(0) : 0); 5017 5018 hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS); 5019 5020 err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE, 5021 MGMT_OP_SET_EXP_FEATURE, 0, 5022 &rp, sizeof(rp)); 5023 5024 if (changed) 5025 exp_feature_changed(hdev, iso_socket_uuid, val, sk); 5026 5027 return err; 5028 } 5029 #endif 5030 5031 static const struct mgmt_exp_feature { 5032 const u8 *uuid; 5033 int (*set_func)(struct sock *sk, struct hci_dev *hdev, 5034 struct mgmt_cp_set_exp_feature *cp, u16 data_len); 5035 } exp_features[] = { 5036 EXP_FEAT(ZERO_KEY, set_zero_key_func), 5037 #ifdef CONFIG_BT_FEATURE_DEBUG 5038 EXP_FEAT(debug_uuid, set_debug_func), 5039 #endif 5040 EXP_FEAT(mgmt_mesh_uuid, set_mgmt_mesh_func), 5041 EXP_FEAT(quality_report_uuid, set_quality_report_func), 5042 EXP_FEAT(offload_codecs_uuid, set_offload_codec_func), 5043 EXP_FEAT(le_simultaneous_roles_uuid, set_le_simultaneous_roles_func), 5044 #ifdef CONFIG_BT_LE 5045 EXP_FEAT(iso_socket_uuid, set_iso_socket_func), 5046 #endif 5047 5048 /* end with a null feature */ 5049 EXP_FEAT(NULL, NULL) 5050 }; 5051 5052 static int set_exp_feature(struct sock *sk, struct hci_dev *hdev, 5053 void *data, u16 data_len) 5054 { 5055 struct mgmt_cp_set_exp_feature *cp = data; 5056 size_t i = 0; 5057 5058 bt_dev_dbg(hdev, "sock %p", sk); 5059 5060 for (i = 0; exp_features[i].uuid; i++) { 5061 if (!memcmp(cp->uuid, exp_features[i].uuid, 16)) 5062 return exp_features[i].set_func(sk, hdev, cp, data_len); 5063 } 5064 5065 return mgmt_cmd_status(sk, hdev ? hdev->id : MGMT_INDEX_NONE, 5066 MGMT_OP_SET_EXP_FEATURE, 5067 MGMT_STATUS_NOT_SUPPORTED); 5068 } 5069 5070 static int get_device_flags(struct sock *sk, struct hci_dev *hdev, void *data, 5071 u16 data_len) 5072 { 5073 struct mgmt_cp_get_device_flags *cp = data; 5074 struct mgmt_rp_get_device_flags rp; 5075 struct bdaddr_list_with_flags *br_params; 5076 struct hci_conn_params *params; 5077 u32 supported_flags; 5078 u32 current_flags = 0; 5079 u8 status = MGMT_STATUS_INVALID_PARAMS; 5080 5081 bt_dev_dbg(hdev, "Get device flags %pMR (type 0x%x)\n", 5082 &cp->addr.bdaddr, cp->addr.type); 5083 5084 hci_dev_lock(hdev); 5085 5086 supported_flags = hdev->conn_flags; 5087 5088 memset(&rp, 0, sizeof(rp)); 5089 5090 if (cp->addr.type == BDADDR_BREDR) { 5091 br_params = hci_bdaddr_list_lookup_with_flags(&hdev->accept_list, 5092 &cp->addr.bdaddr, 5093 cp->addr.type); 5094 if (!br_params) 5095 goto done; 5096 5097 current_flags = br_params->flags; 5098 } else { 5099 params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr, 5100 le_addr_type(cp->addr.type)); 5101 if (!params) 5102 goto done; 5103 5104 current_flags = params->flags; 5105 } 5106 5107 bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr); 5108 rp.addr.type = cp->addr.type; 5109 rp.supported_flags = cpu_to_le32(supported_flags); 5110 rp.current_flags = cpu_to_le32(current_flags); 5111 5112 status = MGMT_STATUS_SUCCESS; 5113 5114 done: 5115 hci_dev_unlock(hdev); 5116 5117 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_DEVICE_FLAGS, status, 5118 &rp, sizeof(rp)); 5119 } 5120 5121 static void device_flags_changed(struct sock *sk, struct hci_dev *hdev, 5122 bdaddr_t *bdaddr, u8 bdaddr_type, 5123 u32 supported_flags, u32 current_flags) 5124 { 5125 struct mgmt_ev_device_flags_changed ev; 5126 5127 bacpy(&ev.addr.bdaddr, bdaddr); 5128 ev.addr.type = bdaddr_type; 5129 ev.supported_flags = cpu_to_le32(supported_flags); 5130 ev.current_flags = cpu_to_le32(current_flags); 5131 5132 mgmt_event(MGMT_EV_DEVICE_FLAGS_CHANGED, hdev, &ev, sizeof(ev), sk); 5133 } 5134 5135 static bool is_connected(struct hci_dev *hdev, bdaddr_t *addr, u8 type) 5136 { 5137 struct hci_conn *conn; 5138 5139 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, addr); 5140 if (!conn) 5141 return false; 5142 5143 if (conn->dst_type != type) 5144 return false; 5145 5146 if (conn->state != BT_CONNECTED) 5147 return false; 5148 5149 return true; 5150 } 5151 5152 /* This function requires the caller holds hdev->lock */ 5153 static struct hci_conn_params *hci_conn_params_set(struct hci_dev *hdev, 5154 bdaddr_t *addr, u8 addr_type, 5155 u8 auto_connect) 5156 { 5157 struct hci_conn_params *params; 5158 5159 params = hci_conn_params_add(hdev, addr, addr_type); 5160 if (!params) 5161 return NULL; 5162 5163 if (params->auto_connect == auto_connect) 5164 return params; 5165 5166 hci_pend_le_list_del_init(params); 5167 5168 switch (auto_connect) { 5169 case HCI_AUTO_CONN_DISABLED: 5170 case HCI_AUTO_CONN_LINK_LOSS: 5171 /* If auto connect is being disabled when we're trying to 5172 * connect to device, keep connecting. 5173 */ 5174 if (params->explicit_connect) 5175 hci_pend_le_list_add(params, &hdev->pend_le_conns); 5176 break; 5177 case HCI_AUTO_CONN_REPORT: 5178 if (params->explicit_connect) 5179 hci_pend_le_list_add(params, &hdev->pend_le_conns); 5180 else 5181 hci_pend_le_list_add(params, &hdev->pend_le_reports); 5182 break; 5183 case HCI_AUTO_CONN_DIRECT: 5184 case HCI_AUTO_CONN_ALWAYS: 5185 if (!is_connected(hdev, addr, addr_type)) 5186 hci_pend_le_list_add(params, &hdev->pend_le_conns); 5187 break; 5188 } 5189 5190 params->auto_connect = auto_connect; 5191 5192 bt_dev_dbg(hdev, "addr %pMR (type %u) auto_connect %u", 5193 addr, addr_type, auto_connect); 5194 5195 return params; 5196 } 5197 5198 static int set_device_flags(struct sock *sk, struct hci_dev *hdev, void *data, 5199 u16 len) 5200 { 5201 struct mgmt_cp_set_device_flags *cp = data; 5202 struct bdaddr_list_with_flags *br_params; 5203 struct hci_conn_params *params; 5204 u8 status = MGMT_STATUS_INVALID_PARAMS; 5205 u32 supported_flags; 5206 u32 current_flags = __le32_to_cpu(cp->current_flags); 5207 5208 bt_dev_dbg(hdev, "Set device flags %pMR (type 0x%x) = 0x%x", 5209 &cp->addr.bdaddr, cp->addr.type, current_flags); 5210 5211 // We should take hci_dev_lock() early, I think.. conn_flags can change 5212 supported_flags = hdev->conn_flags; 5213 5214 if ((supported_flags | current_flags) != supported_flags) { 5215 bt_dev_warn(hdev, "Bad flag given (0x%x) vs supported (0x%0x)", 5216 current_flags, supported_flags); 5217 goto done; 5218 } 5219 5220 hci_dev_lock(hdev); 5221 5222 if (cp->addr.type == BDADDR_BREDR) { 5223 br_params = hci_bdaddr_list_lookup_with_flags(&hdev->accept_list, 5224 &cp->addr.bdaddr, 5225 cp->addr.type); 5226 5227 if (br_params) { 5228 br_params->flags = current_flags; 5229 status = MGMT_STATUS_SUCCESS; 5230 } else { 5231 bt_dev_warn(hdev, "No such BR/EDR device %pMR (0x%x)", 5232 &cp->addr.bdaddr, cp->addr.type); 5233 } 5234 5235 goto unlock; 5236 } 5237 5238 params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr, 5239 le_addr_type(cp->addr.type)); 5240 if (!params) { 5241 /* Create a new hci_conn_params if it doesn't exist */ 5242 params = hci_conn_params_set(hdev, &cp->addr.bdaddr, 5243 le_addr_type(cp->addr.type), 5244 HCI_AUTO_CONN_DISABLED); 5245 if (!params) { 5246 bt_dev_warn(hdev, "No such LE device %pMR (0x%x)", 5247 &cp->addr.bdaddr, 5248 le_addr_type(cp->addr.type)); 5249 goto unlock; 5250 } 5251 } 5252 5253 supported_flags = hdev->conn_flags; 5254 5255 if ((supported_flags | current_flags) != supported_flags) { 5256 bt_dev_warn(hdev, "Bad flag given (0x%x) vs supported (0x%0x)", 5257 current_flags, supported_flags); 5258 goto unlock; 5259 } 5260 5261 WRITE_ONCE(params->flags, current_flags); 5262 status = MGMT_STATUS_SUCCESS; 5263 5264 /* Update passive scan if HCI_CONN_FLAG_DEVICE_PRIVACY 5265 * has been set. 5266 */ 5267 if (params->flags & HCI_CONN_FLAG_DEVICE_PRIVACY) 5268 hci_update_passive_scan(hdev); 5269 5270 unlock: 5271 hci_dev_unlock(hdev); 5272 5273 done: 5274 if (status == MGMT_STATUS_SUCCESS) 5275 device_flags_changed(sk, hdev, &cp->addr.bdaddr, cp->addr.type, 5276 supported_flags, current_flags); 5277 5278 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_DEVICE_FLAGS, status, 5279 &cp->addr, sizeof(cp->addr)); 5280 } 5281 5282 static void mgmt_adv_monitor_added(struct sock *sk, struct hci_dev *hdev, 5283 u16 handle) 5284 { 5285 struct mgmt_ev_adv_monitor_added ev; 5286 5287 ev.monitor_handle = cpu_to_le16(handle); 5288 5289 mgmt_event(MGMT_EV_ADV_MONITOR_ADDED, hdev, &ev, sizeof(ev), sk); 5290 } 5291 5292 static void mgmt_adv_monitor_removed(struct sock *sk, struct hci_dev *hdev, 5293 __le16 handle) 5294 { 5295 struct mgmt_ev_adv_monitor_removed ev; 5296 5297 ev.monitor_handle = handle; 5298 5299 mgmt_event(MGMT_EV_ADV_MONITOR_REMOVED, hdev, &ev, sizeof(ev), sk); 5300 } 5301 5302 static int read_adv_mon_features(struct sock *sk, struct hci_dev *hdev, 5303 void *data, u16 len) 5304 { 5305 struct adv_monitor *monitor = NULL; 5306 struct mgmt_rp_read_adv_monitor_features *rp = NULL; 5307 int handle, err; 5308 size_t rp_size = 0; 5309 __u32 supported = 0; 5310 __u32 enabled = 0; 5311 __u16 num_handles = 0; 5312 __u16 handles[HCI_MAX_ADV_MONITOR_NUM_HANDLES]; 5313 5314 BT_DBG("request for %s", hdev->name); 5315 5316 hci_dev_lock(hdev); 5317 5318 if (msft_monitor_supported(hdev)) 5319 supported |= MGMT_ADV_MONITOR_FEATURE_MASK_OR_PATTERNS; 5320 5321 idr_for_each_entry(&hdev->adv_monitors_idr, monitor, handle) 5322 handles[num_handles++] = monitor->handle; 5323 5324 hci_dev_unlock(hdev); 5325 5326 rp_size = sizeof(*rp) + (num_handles * sizeof(u16)); 5327 rp = kmalloc(rp_size, GFP_KERNEL); 5328 if (!rp) 5329 return -ENOMEM; 5330 5331 /* All supported features are currently enabled */ 5332 enabled = supported; 5333 5334 rp->supported_features = cpu_to_le32(supported); 5335 rp->enabled_features = cpu_to_le32(enabled); 5336 rp->max_num_handles = cpu_to_le16(HCI_MAX_ADV_MONITOR_NUM_HANDLES); 5337 rp->max_num_patterns = HCI_MAX_ADV_MONITOR_NUM_PATTERNS; 5338 rp->num_handles = cpu_to_le16(num_handles); 5339 if (num_handles) 5340 memcpy(&rp->handles, &handles, (num_handles * sizeof(u16))); 5341 5342 err = mgmt_cmd_complete(sk, hdev->id, 5343 MGMT_OP_READ_ADV_MONITOR_FEATURES, 5344 MGMT_STATUS_SUCCESS, rp, rp_size); 5345 5346 kfree(rp); 5347 5348 return err; 5349 } 5350 5351 static void mgmt_add_adv_patterns_monitor_complete(struct hci_dev *hdev, 5352 void *data, int status) 5353 { 5354 struct mgmt_rp_add_adv_patterns_monitor rp; 5355 struct mgmt_pending_cmd *cmd = data; 5356 struct adv_monitor *monitor; 5357 5358 /* This is likely the result of hdev being closed and mgmt_index_removed 5359 * is attempting to clean up any pending command so 5360 * hci_adv_monitors_clear is about to be called which will take care of 5361 * freeing the adv_monitor instances. 5362 */ 5363 if (status == -ECANCELED || !mgmt_pending_valid(hdev, cmd)) 5364 return; 5365 5366 monitor = cmd->user_data; 5367 5368 hci_dev_lock(hdev); 5369 5370 rp.monitor_handle = cpu_to_le16(monitor->handle); 5371 5372 if (!status) { 5373 mgmt_adv_monitor_added(cmd->sk, hdev, monitor->handle); 5374 hdev->adv_monitors_cnt++; 5375 if (monitor->state == ADV_MONITOR_STATE_NOT_REGISTERED) 5376 monitor->state = ADV_MONITOR_STATE_REGISTERED; 5377 hci_update_passive_scan(hdev); 5378 } else { 5379 hci_free_adv_monitor(hdev, monitor); 5380 } 5381 5382 mgmt_cmd_complete(cmd->sk, cmd->hdev->id, cmd->opcode, 5383 mgmt_status(status), &rp, sizeof(rp)); 5384 mgmt_pending_free(cmd); 5385 5386 hci_dev_unlock(hdev); 5387 bt_dev_dbg(hdev, "add monitor %d complete, status %d", 5388 rp.monitor_handle, status); 5389 } 5390 5391 static int mgmt_add_adv_patterns_monitor_sync(struct hci_dev *hdev, void *data) 5392 { 5393 struct mgmt_pending_cmd *cmd = data; 5394 struct adv_monitor *mon; 5395 5396 mutex_lock(&hdev->mgmt_pending_lock); 5397 5398 if (!__mgmt_pending_listed(hdev, cmd)) { 5399 mutex_unlock(&hdev->mgmt_pending_lock); 5400 return -ECANCELED; 5401 } 5402 5403 mon = cmd->user_data; 5404 5405 mutex_unlock(&hdev->mgmt_pending_lock); 5406 5407 return hci_add_adv_monitor(hdev, mon); 5408 } 5409 5410 static int __add_adv_patterns_monitor(struct sock *sk, struct hci_dev *hdev, 5411 struct adv_monitor *m, u8 status, 5412 void *data, u16 len, u16 op) 5413 { 5414 struct mgmt_pending_cmd *cmd; 5415 int err; 5416 5417 hci_dev_lock(hdev); 5418 5419 if (status) 5420 goto unlock; 5421 5422 if (pending_find(MGMT_OP_SET_LE, hdev) || 5423 pending_find(MGMT_OP_ADD_ADV_PATTERNS_MONITOR, hdev) || 5424 pending_find(MGMT_OP_ADD_ADV_PATTERNS_MONITOR_RSSI, hdev)) { 5425 status = MGMT_STATUS_BUSY; 5426 goto unlock; 5427 } 5428 5429 cmd = mgmt_pending_add(sk, op, hdev, data, len); 5430 if (!cmd) { 5431 status = MGMT_STATUS_NO_RESOURCES; 5432 goto unlock; 5433 } 5434 5435 cmd->user_data = m; 5436 err = hci_cmd_sync_queue(hdev, mgmt_add_adv_patterns_monitor_sync, cmd, 5437 mgmt_add_adv_patterns_monitor_complete); 5438 if (err) { 5439 if (err == -ENOMEM) 5440 status = MGMT_STATUS_NO_RESOURCES; 5441 else 5442 status = MGMT_STATUS_FAILED; 5443 5444 goto unlock; 5445 } 5446 5447 hci_dev_unlock(hdev); 5448 5449 return 0; 5450 5451 unlock: 5452 hci_free_adv_monitor(hdev, m); 5453 hci_dev_unlock(hdev); 5454 return mgmt_cmd_status(sk, hdev->id, op, status); 5455 } 5456 5457 static void parse_adv_monitor_rssi(struct adv_monitor *m, 5458 struct mgmt_adv_rssi_thresholds *rssi) 5459 { 5460 if (rssi) { 5461 m->rssi.low_threshold = rssi->low_threshold; 5462 m->rssi.low_threshold_timeout = 5463 __le16_to_cpu(rssi->low_threshold_timeout); 5464 m->rssi.high_threshold = rssi->high_threshold; 5465 m->rssi.high_threshold_timeout = 5466 __le16_to_cpu(rssi->high_threshold_timeout); 5467 m->rssi.sampling_period = rssi->sampling_period; 5468 } else { 5469 /* Default values. These numbers are the least constricting 5470 * parameters for MSFT API to work, so it behaves as if there 5471 * are no rssi parameter to consider. May need to be changed 5472 * if other API are to be supported. 5473 */ 5474 m->rssi.low_threshold = -127; 5475 m->rssi.low_threshold_timeout = 60; 5476 m->rssi.high_threshold = -127; 5477 m->rssi.high_threshold_timeout = 0; 5478 m->rssi.sampling_period = 0; 5479 } 5480 } 5481 5482 static u8 parse_adv_monitor_pattern(struct adv_monitor *m, u8 pattern_count, 5483 struct mgmt_adv_pattern *patterns) 5484 { 5485 u8 offset = 0, length = 0; 5486 struct adv_pattern *p = NULL; 5487 int i; 5488 5489 for (i = 0; i < pattern_count; i++) { 5490 offset = patterns[i].offset; 5491 length = patterns[i].length; 5492 if (offset >= HCI_MAX_AD_LENGTH || 5493 length > HCI_MAX_AD_LENGTH || 5494 (offset + length) > HCI_MAX_AD_LENGTH) 5495 return MGMT_STATUS_INVALID_PARAMS; 5496 5497 p = kmalloc_obj(*p); 5498 if (!p) 5499 return MGMT_STATUS_NO_RESOURCES; 5500 5501 p->ad_type = patterns[i].ad_type; 5502 p->offset = patterns[i].offset; 5503 p->length = patterns[i].length; 5504 memcpy(p->value, patterns[i].value, p->length); 5505 5506 INIT_LIST_HEAD(&p->list); 5507 list_add(&p->list, &m->patterns); 5508 } 5509 5510 return MGMT_STATUS_SUCCESS; 5511 } 5512 5513 static int add_adv_patterns_monitor(struct sock *sk, struct hci_dev *hdev, 5514 void *data, u16 len) 5515 { 5516 struct mgmt_cp_add_adv_patterns_monitor *cp = data; 5517 struct adv_monitor *m = NULL; 5518 u8 status = MGMT_STATUS_SUCCESS; 5519 size_t expected_size = sizeof(*cp); 5520 5521 BT_DBG("request for %s", hdev->name); 5522 5523 if (len <= sizeof(*cp)) { 5524 status = MGMT_STATUS_INVALID_PARAMS; 5525 goto done; 5526 } 5527 5528 expected_size += cp->pattern_count * sizeof(struct mgmt_adv_pattern); 5529 if (len != expected_size) { 5530 status = MGMT_STATUS_INVALID_PARAMS; 5531 goto done; 5532 } 5533 5534 m = kzalloc_obj(*m); 5535 if (!m) { 5536 status = MGMT_STATUS_NO_RESOURCES; 5537 goto done; 5538 } 5539 5540 INIT_LIST_HEAD(&m->patterns); 5541 5542 parse_adv_monitor_rssi(m, NULL); 5543 status = parse_adv_monitor_pattern(m, cp->pattern_count, cp->patterns); 5544 5545 done: 5546 return __add_adv_patterns_monitor(sk, hdev, m, status, data, len, 5547 MGMT_OP_ADD_ADV_PATTERNS_MONITOR); 5548 } 5549 5550 static int add_adv_patterns_monitor_rssi(struct sock *sk, struct hci_dev *hdev, 5551 void *data, u16 len) 5552 { 5553 struct mgmt_cp_add_adv_patterns_monitor_rssi *cp = data; 5554 struct adv_monitor *m = NULL; 5555 u8 status = MGMT_STATUS_SUCCESS; 5556 size_t expected_size = sizeof(*cp); 5557 5558 BT_DBG("request for %s", hdev->name); 5559 5560 if (len <= sizeof(*cp)) { 5561 status = MGMT_STATUS_INVALID_PARAMS; 5562 goto done; 5563 } 5564 5565 expected_size += cp->pattern_count * sizeof(struct mgmt_adv_pattern); 5566 if (len != expected_size) { 5567 status = MGMT_STATUS_INVALID_PARAMS; 5568 goto done; 5569 } 5570 5571 m = kzalloc_obj(*m); 5572 if (!m) { 5573 status = MGMT_STATUS_NO_RESOURCES; 5574 goto done; 5575 } 5576 5577 INIT_LIST_HEAD(&m->patterns); 5578 5579 parse_adv_monitor_rssi(m, &cp->rssi); 5580 status = parse_adv_monitor_pattern(m, cp->pattern_count, cp->patterns); 5581 5582 done: 5583 return __add_adv_patterns_monitor(sk, hdev, m, status, data, len, 5584 MGMT_OP_ADD_ADV_PATTERNS_MONITOR_RSSI); 5585 } 5586 5587 static void mgmt_remove_adv_monitor_complete(struct hci_dev *hdev, 5588 void *data, int status) 5589 { 5590 struct mgmt_rp_remove_adv_monitor rp; 5591 struct mgmt_pending_cmd *cmd = data; 5592 struct mgmt_cp_remove_adv_monitor *cp; 5593 5594 if (status == -ECANCELED) 5595 return; 5596 5597 hci_dev_lock(hdev); 5598 5599 cp = cmd->param; 5600 5601 rp.monitor_handle = cp->monitor_handle; 5602 5603 if (!status) { 5604 mgmt_adv_monitor_removed(cmd->sk, hdev, cp->monitor_handle); 5605 hci_update_passive_scan(hdev); 5606 } 5607 5608 mgmt_cmd_complete(cmd->sk, cmd->hdev->id, cmd->opcode, 5609 mgmt_status(status), &rp, sizeof(rp)); 5610 mgmt_pending_free(cmd); 5611 5612 hci_dev_unlock(hdev); 5613 bt_dev_dbg(hdev, "remove monitor %d complete, status %d", 5614 rp.monitor_handle, status); 5615 } 5616 5617 static int mgmt_remove_adv_monitor_sync(struct hci_dev *hdev, void *data) 5618 { 5619 struct mgmt_pending_cmd *cmd = data; 5620 struct mgmt_cp_remove_adv_monitor *cp = cmd->param; 5621 u16 handle = __le16_to_cpu(cp->monitor_handle); 5622 5623 if (!handle) 5624 return hci_remove_all_adv_monitor(hdev); 5625 5626 return hci_remove_single_adv_monitor(hdev, handle); 5627 } 5628 5629 static int remove_adv_monitor(struct sock *sk, struct hci_dev *hdev, 5630 void *data, u16 len) 5631 { 5632 struct mgmt_pending_cmd *cmd; 5633 int err, status; 5634 5635 hci_dev_lock(hdev); 5636 5637 if (pending_find(MGMT_OP_SET_LE, hdev) || 5638 pending_find(MGMT_OP_ADD_ADV_PATTERNS_MONITOR, hdev) || 5639 pending_find(MGMT_OP_ADD_ADV_PATTERNS_MONITOR_RSSI, hdev)) { 5640 status = MGMT_STATUS_BUSY; 5641 goto unlock; 5642 } 5643 5644 cmd = mgmt_pending_new(sk, MGMT_OP_REMOVE_ADV_MONITOR, hdev, data, len); 5645 if (!cmd) { 5646 status = MGMT_STATUS_NO_RESOURCES; 5647 goto unlock; 5648 } 5649 5650 err = hci_cmd_sync_submit(hdev, mgmt_remove_adv_monitor_sync, cmd, 5651 mgmt_remove_adv_monitor_complete); 5652 5653 if (err) { 5654 mgmt_pending_free(cmd); 5655 5656 if (err == -ENOMEM) 5657 status = MGMT_STATUS_NO_RESOURCES; 5658 else 5659 status = MGMT_STATUS_FAILED; 5660 5661 goto unlock; 5662 } 5663 5664 hci_dev_unlock(hdev); 5665 5666 return 0; 5667 5668 unlock: 5669 hci_dev_unlock(hdev); 5670 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_ADV_MONITOR, 5671 status); 5672 } 5673 5674 static void read_local_oob_data_complete(struct hci_dev *hdev, void *data, 5675 int err) 5676 { 5677 struct mgmt_rp_read_local_oob_data mgmt_rp; 5678 size_t rp_size = sizeof(mgmt_rp); 5679 struct mgmt_pending_cmd *cmd = data; 5680 struct sk_buff *skb = cmd->skb; 5681 u8 status = mgmt_status(err); 5682 5683 if (!status) { 5684 if (!skb) 5685 status = MGMT_STATUS_FAILED; 5686 else if (IS_ERR(skb)) 5687 status = mgmt_status(PTR_ERR(skb)); 5688 else 5689 status = mgmt_status(skb->data[0]); 5690 } 5691 5692 bt_dev_dbg(hdev, "status %d", status); 5693 5694 if (status) { 5695 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA, 5696 status); 5697 goto remove; 5698 } 5699 5700 memset(&mgmt_rp, 0, sizeof(mgmt_rp)); 5701 5702 if (!bredr_sc_enabled(hdev)) { 5703 struct hci_rp_read_local_oob_data *rp = (void *) skb->data; 5704 5705 if (skb->len < sizeof(*rp)) { 5706 mgmt_cmd_status(cmd->sk, hdev->id, 5707 MGMT_OP_READ_LOCAL_OOB_DATA, 5708 MGMT_STATUS_FAILED); 5709 goto remove; 5710 } 5711 5712 memcpy(mgmt_rp.hash192, rp->hash, sizeof(rp->hash)); 5713 memcpy(mgmt_rp.rand192, rp->rand, sizeof(rp->rand)); 5714 5715 rp_size -= sizeof(mgmt_rp.hash256) + sizeof(mgmt_rp.rand256); 5716 } else { 5717 struct hci_rp_read_local_oob_ext_data *rp = (void *) skb->data; 5718 5719 if (skb->len < sizeof(*rp)) { 5720 mgmt_cmd_status(cmd->sk, hdev->id, 5721 MGMT_OP_READ_LOCAL_OOB_DATA, 5722 MGMT_STATUS_FAILED); 5723 goto remove; 5724 } 5725 5726 memcpy(mgmt_rp.hash192, rp->hash192, sizeof(rp->hash192)); 5727 memcpy(mgmt_rp.rand192, rp->rand192, sizeof(rp->rand192)); 5728 5729 memcpy(mgmt_rp.hash256, rp->hash256, sizeof(rp->hash256)); 5730 memcpy(mgmt_rp.rand256, rp->rand256, sizeof(rp->rand256)); 5731 } 5732 5733 mgmt_cmd_complete(cmd->sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA, 5734 MGMT_STATUS_SUCCESS, &mgmt_rp, rp_size); 5735 5736 remove: 5737 if (skb && !IS_ERR(skb)) 5738 kfree_skb(skb); 5739 5740 mgmt_pending_free(cmd); 5741 } 5742 5743 static int read_local_oob_data_sync(struct hci_dev *hdev, void *data) 5744 { 5745 struct mgmt_pending_cmd *cmd = data; 5746 5747 if (bredr_sc_enabled(hdev)) 5748 cmd->skb = hci_read_local_oob_data_sync(hdev, true, cmd->sk); 5749 else 5750 cmd->skb = hci_read_local_oob_data_sync(hdev, false, cmd->sk); 5751 5752 if (IS_ERR(cmd->skb)) 5753 return PTR_ERR(cmd->skb); 5754 else 5755 return 0; 5756 } 5757 5758 static int read_local_oob_data(struct sock *sk, struct hci_dev *hdev, 5759 void *data, u16 data_len) 5760 { 5761 struct mgmt_pending_cmd *cmd; 5762 int err; 5763 5764 bt_dev_dbg(hdev, "sock %p", sk); 5765 5766 hci_dev_lock(hdev); 5767 5768 if (!hdev_is_powered(hdev)) { 5769 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA, 5770 MGMT_STATUS_NOT_POWERED); 5771 goto unlock; 5772 } 5773 5774 if (!lmp_ssp_capable(hdev)) { 5775 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA, 5776 MGMT_STATUS_NOT_SUPPORTED); 5777 goto unlock; 5778 } 5779 5780 cmd = mgmt_pending_new(sk, MGMT_OP_READ_LOCAL_OOB_DATA, hdev, NULL, 0); 5781 if (!cmd) 5782 err = -ENOMEM; 5783 else 5784 err = hci_cmd_sync_queue(hdev, read_local_oob_data_sync, cmd, 5785 read_local_oob_data_complete); 5786 5787 if (err < 0) { 5788 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA, 5789 MGMT_STATUS_FAILED); 5790 5791 if (cmd) 5792 mgmt_pending_free(cmd); 5793 } 5794 5795 unlock: 5796 hci_dev_unlock(hdev); 5797 return err; 5798 } 5799 5800 static int add_remote_oob_data(struct sock *sk, struct hci_dev *hdev, 5801 void *data, u16 len) 5802 { 5803 struct mgmt_addr_info *addr = data; 5804 int err; 5805 5806 bt_dev_dbg(hdev, "sock %p", sk); 5807 5808 if (!bdaddr_type_is_valid(addr->type)) 5809 return mgmt_cmd_complete(sk, hdev->id, 5810 MGMT_OP_ADD_REMOTE_OOB_DATA, 5811 MGMT_STATUS_INVALID_PARAMS, 5812 addr, sizeof(*addr)); 5813 5814 hci_dev_lock(hdev); 5815 5816 if (len == MGMT_ADD_REMOTE_OOB_DATA_SIZE) { 5817 struct mgmt_cp_add_remote_oob_data *cp = data; 5818 u8 status; 5819 5820 if (cp->addr.type != BDADDR_BREDR) { 5821 err = mgmt_cmd_complete(sk, hdev->id, 5822 MGMT_OP_ADD_REMOTE_OOB_DATA, 5823 MGMT_STATUS_INVALID_PARAMS, 5824 &cp->addr, sizeof(cp->addr)); 5825 goto unlock; 5826 } 5827 5828 err = hci_add_remote_oob_data(hdev, &cp->addr.bdaddr, 5829 cp->addr.type, cp->hash, 5830 cp->rand, NULL, NULL); 5831 if (err < 0) 5832 status = MGMT_STATUS_FAILED; 5833 else 5834 status = MGMT_STATUS_SUCCESS; 5835 5836 err = mgmt_cmd_complete(sk, hdev->id, 5837 MGMT_OP_ADD_REMOTE_OOB_DATA, status, 5838 &cp->addr, sizeof(cp->addr)); 5839 } else if (len == MGMT_ADD_REMOTE_OOB_EXT_DATA_SIZE) { 5840 struct mgmt_cp_add_remote_oob_ext_data *cp = data; 5841 u8 *rand192, *hash192, *rand256, *hash256; 5842 u8 status; 5843 5844 if (bdaddr_type_is_le(cp->addr.type)) { 5845 /* Enforce zero-valued 192-bit parameters as 5846 * long as legacy SMP OOB isn't implemented. 5847 */ 5848 if (memcmp(cp->rand192, ZERO_KEY, 16) || 5849 memcmp(cp->hash192, ZERO_KEY, 16)) { 5850 err = mgmt_cmd_complete(sk, hdev->id, 5851 MGMT_OP_ADD_REMOTE_OOB_DATA, 5852 MGMT_STATUS_INVALID_PARAMS, 5853 addr, sizeof(*addr)); 5854 goto unlock; 5855 } 5856 5857 rand192 = NULL; 5858 hash192 = NULL; 5859 } else { 5860 /* In case one of the P-192 values is set to zero, 5861 * then just disable OOB data for P-192. 5862 */ 5863 if (!memcmp(cp->rand192, ZERO_KEY, 16) || 5864 !memcmp(cp->hash192, ZERO_KEY, 16)) { 5865 rand192 = NULL; 5866 hash192 = NULL; 5867 } else { 5868 rand192 = cp->rand192; 5869 hash192 = cp->hash192; 5870 } 5871 } 5872 5873 /* In case one of the P-256 values is set to zero, then just 5874 * disable OOB data for P-256. 5875 */ 5876 if (!memcmp(cp->rand256, ZERO_KEY, 16) || 5877 !memcmp(cp->hash256, ZERO_KEY, 16)) { 5878 rand256 = NULL; 5879 hash256 = NULL; 5880 } else { 5881 rand256 = cp->rand256; 5882 hash256 = cp->hash256; 5883 } 5884 5885 err = hci_add_remote_oob_data(hdev, &cp->addr.bdaddr, 5886 cp->addr.type, hash192, rand192, 5887 hash256, rand256); 5888 if (err < 0) 5889 status = MGMT_STATUS_FAILED; 5890 else 5891 status = MGMT_STATUS_SUCCESS; 5892 5893 err = mgmt_cmd_complete(sk, hdev->id, 5894 MGMT_OP_ADD_REMOTE_OOB_DATA, 5895 status, &cp->addr, sizeof(cp->addr)); 5896 } else { 5897 bt_dev_err(hdev, "add_remote_oob_data: invalid len of %u bytes", 5898 len); 5899 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_REMOTE_OOB_DATA, 5900 MGMT_STATUS_INVALID_PARAMS); 5901 } 5902 5903 unlock: 5904 hci_dev_unlock(hdev); 5905 return err; 5906 } 5907 5908 static int remove_remote_oob_data(struct sock *sk, struct hci_dev *hdev, 5909 void *data, u16 len) 5910 { 5911 struct mgmt_cp_remove_remote_oob_data *cp = data; 5912 u8 status; 5913 int err; 5914 5915 bt_dev_dbg(hdev, "sock %p", sk); 5916 5917 if (cp->addr.type != BDADDR_BREDR) 5918 return mgmt_cmd_complete(sk, hdev->id, 5919 MGMT_OP_REMOVE_REMOTE_OOB_DATA, 5920 MGMT_STATUS_INVALID_PARAMS, 5921 &cp->addr, sizeof(cp->addr)); 5922 5923 hci_dev_lock(hdev); 5924 5925 if (!bacmp(&cp->addr.bdaddr, BDADDR_ANY)) { 5926 hci_remote_oob_data_clear(hdev); 5927 status = MGMT_STATUS_SUCCESS; 5928 goto done; 5929 } 5930 5931 err = hci_remove_remote_oob_data(hdev, &cp->addr.bdaddr, cp->addr.type); 5932 if (err < 0) 5933 status = MGMT_STATUS_INVALID_PARAMS; 5934 else 5935 status = MGMT_STATUS_SUCCESS; 5936 5937 done: 5938 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_REMOTE_OOB_DATA, 5939 status, &cp->addr, sizeof(cp->addr)); 5940 5941 hci_dev_unlock(hdev); 5942 return err; 5943 } 5944 5945 static bool discovery_type_is_valid(struct hci_dev *hdev, uint8_t type, 5946 uint8_t *mgmt_status) 5947 { 5948 switch (type) { 5949 case DISCOV_TYPE_LE: 5950 *mgmt_status = mgmt_le_support(hdev); 5951 if (*mgmt_status) 5952 return false; 5953 break; 5954 case DISCOV_TYPE_INTERLEAVED: 5955 *mgmt_status = mgmt_le_support(hdev); 5956 if (*mgmt_status) 5957 return false; 5958 fallthrough; 5959 case DISCOV_TYPE_BREDR: 5960 *mgmt_status = mgmt_bredr_support(hdev); 5961 if (*mgmt_status) 5962 return false; 5963 break; 5964 default: 5965 *mgmt_status = MGMT_STATUS_INVALID_PARAMS; 5966 return false; 5967 } 5968 5969 return true; 5970 } 5971 5972 static void start_discovery_complete(struct hci_dev *hdev, void *data, int err) 5973 { 5974 struct mgmt_pending_cmd *cmd = data; 5975 5976 bt_dev_dbg(hdev, "err %d", err); 5977 5978 if (err == -ECANCELED || !mgmt_pending_valid(hdev, cmd)) 5979 return; 5980 5981 mgmt_cmd_complete(cmd->sk, cmd->hdev->id, cmd->opcode, mgmt_status(err), 5982 cmd->param, 1); 5983 mgmt_pending_free(cmd); 5984 5985 hci_discovery_set_state(hdev, err ? DISCOVERY_STOPPED: 5986 DISCOVERY_FINDING); 5987 } 5988 5989 static int start_discovery_sync(struct hci_dev *hdev, void *data) 5990 { 5991 if (!mgmt_pending_listed(hdev, data)) 5992 return -ECANCELED; 5993 5994 return hci_start_discovery_sync(hdev); 5995 } 5996 5997 static int start_discovery_internal(struct sock *sk, struct hci_dev *hdev, 5998 u16 op, void *data, u16 len) 5999 { 6000 struct mgmt_cp_start_discovery *cp = data; 6001 struct mgmt_pending_cmd *cmd; 6002 u8 status; 6003 int err; 6004 6005 bt_dev_dbg(hdev, "sock %p", sk); 6006 6007 hci_dev_lock(hdev); 6008 6009 if (!hdev_is_powered(hdev)) { 6010 err = mgmt_cmd_complete(sk, hdev->id, op, 6011 MGMT_STATUS_NOT_POWERED, 6012 &cp->type, sizeof(cp->type)); 6013 goto failed; 6014 } 6015 6016 if (hdev->discovery.state != DISCOVERY_STOPPED || 6017 hci_dev_test_flag(hdev, HCI_PERIODIC_INQ)) { 6018 err = mgmt_cmd_complete(sk, hdev->id, op, MGMT_STATUS_BUSY, 6019 &cp->type, sizeof(cp->type)); 6020 goto failed; 6021 } 6022 6023 if (!discovery_type_is_valid(hdev, cp->type, &status)) { 6024 err = mgmt_cmd_complete(sk, hdev->id, op, status, 6025 &cp->type, sizeof(cp->type)); 6026 goto failed; 6027 } 6028 6029 /* Can't start discovery when it is paused */ 6030 if (hdev->discovery_paused) { 6031 err = mgmt_cmd_complete(sk, hdev->id, op, MGMT_STATUS_BUSY, 6032 &cp->type, sizeof(cp->type)); 6033 goto failed; 6034 } 6035 6036 /* Clear the discovery filter first to free any previously 6037 * allocated memory for the UUID list. 6038 */ 6039 hci_discovery_filter_clear(hdev); 6040 6041 hdev->discovery.type = cp->type; 6042 hdev->discovery.report_invalid_rssi = false; 6043 if (op == MGMT_OP_START_LIMITED_DISCOVERY) 6044 hdev->discovery.limited = true; 6045 else 6046 hdev->discovery.limited = false; 6047 6048 cmd = mgmt_pending_add(sk, op, hdev, data, len); 6049 if (!cmd) { 6050 err = -ENOMEM; 6051 goto failed; 6052 } 6053 6054 err = hci_cmd_sync_queue(hdev, start_discovery_sync, cmd, 6055 start_discovery_complete); 6056 if (err < 0) { 6057 mgmt_pending_remove(cmd); 6058 goto failed; 6059 } 6060 6061 hci_discovery_set_state(hdev, DISCOVERY_STARTING); 6062 6063 failed: 6064 hci_dev_unlock(hdev); 6065 return err; 6066 } 6067 6068 static int start_discovery(struct sock *sk, struct hci_dev *hdev, 6069 void *data, u16 len) 6070 { 6071 return start_discovery_internal(sk, hdev, MGMT_OP_START_DISCOVERY, 6072 data, len); 6073 } 6074 6075 static int start_limited_discovery(struct sock *sk, struct hci_dev *hdev, 6076 void *data, u16 len) 6077 { 6078 return start_discovery_internal(sk, hdev, 6079 MGMT_OP_START_LIMITED_DISCOVERY, 6080 data, len); 6081 } 6082 6083 static int start_service_discovery(struct sock *sk, struct hci_dev *hdev, 6084 void *data, u16 len) 6085 { 6086 struct mgmt_cp_start_service_discovery *cp = data; 6087 struct mgmt_pending_cmd *cmd; 6088 const u16 max_uuid_count = ((U16_MAX - sizeof(*cp)) / 16); 6089 u16 uuid_count, expected_len; 6090 u8 status; 6091 int err; 6092 6093 bt_dev_dbg(hdev, "sock %p", sk); 6094 6095 hci_dev_lock(hdev); 6096 6097 if (!hdev_is_powered(hdev)) { 6098 err = mgmt_cmd_complete(sk, hdev->id, 6099 MGMT_OP_START_SERVICE_DISCOVERY, 6100 MGMT_STATUS_NOT_POWERED, 6101 &cp->type, sizeof(cp->type)); 6102 goto failed; 6103 } 6104 6105 if (hdev->discovery.state != DISCOVERY_STOPPED || 6106 hci_dev_test_flag(hdev, HCI_PERIODIC_INQ)) { 6107 err = mgmt_cmd_complete(sk, hdev->id, 6108 MGMT_OP_START_SERVICE_DISCOVERY, 6109 MGMT_STATUS_BUSY, &cp->type, 6110 sizeof(cp->type)); 6111 goto failed; 6112 } 6113 6114 if (hdev->discovery_paused) { 6115 err = mgmt_cmd_complete(sk, hdev->id, 6116 MGMT_OP_START_SERVICE_DISCOVERY, 6117 MGMT_STATUS_BUSY, &cp->type, 6118 sizeof(cp->type)); 6119 goto failed; 6120 } 6121 6122 uuid_count = __le16_to_cpu(cp->uuid_count); 6123 if (uuid_count > max_uuid_count) { 6124 bt_dev_err(hdev, "service_discovery: too big uuid_count value %u", 6125 uuid_count); 6126 err = mgmt_cmd_complete(sk, hdev->id, 6127 MGMT_OP_START_SERVICE_DISCOVERY, 6128 MGMT_STATUS_INVALID_PARAMS, &cp->type, 6129 sizeof(cp->type)); 6130 goto failed; 6131 } 6132 6133 expected_len = sizeof(*cp) + uuid_count * 16; 6134 if (expected_len != len) { 6135 bt_dev_err(hdev, "service_discovery: expected %u bytes, got %u bytes", 6136 expected_len, len); 6137 err = mgmt_cmd_complete(sk, hdev->id, 6138 MGMT_OP_START_SERVICE_DISCOVERY, 6139 MGMT_STATUS_INVALID_PARAMS, &cp->type, 6140 sizeof(cp->type)); 6141 goto failed; 6142 } 6143 6144 if (!discovery_type_is_valid(hdev, cp->type, &status)) { 6145 err = mgmt_cmd_complete(sk, hdev->id, 6146 MGMT_OP_START_SERVICE_DISCOVERY, 6147 status, &cp->type, sizeof(cp->type)); 6148 goto failed; 6149 } 6150 6151 cmd = mgmt_pending_add(sk, MGMT_OP_START_SERVICE_DISCOVERY, 6152 hdev, data, len); 6153 if (!cmd) { 6154 err = -ENOMEM; 6155 goto failed; 6156 } 6157 6158 /* Clear the discovery filter first to free any previously 6159 * allocated memory for the UUID list. 6160 */ 6161 hci_discovery_filter_clear(hdev); 6162 6163 hdev->discovery.result_filtering = true; 6164 hdev->discovery.type = cp->type; 6165 hdev->discovery.rssi = cp->rssi; 6166 hdev->discovery.uuid_count = uuid_count; 6167 6168 if (uuid_count > 0) { 6169 hdev->discovery.uuids = kmemdup(cp->uuids, uuid_count * 16, 6170 GFP_KERNEL); 6171 if (!hdev->discovery.uuids) { 6172 err = mgmt_cmd_complete(sk, hdev->id, 6173 MGMT_OP_START_SERVICE_DISCOVERY, 6174 MGMT_STATUS_FAILED, 6175 &cp->type, sizeof(cp->type)); 6176 mgmt_pending_remove(cmd); 6177 goto failed; 6178 } 6179 } 6180 6181 err = hci_cmd_sync_queue(hdev, start_discovery_sync, cmd, 6182 start_discovery_complete); 6183 if (err < 0) { 6184 mgmt_pending_remove(cmd); 6185 goto failed; 6186 } 6187 6188 hci_discovery_set_state(hdev, DISCOVERY_STARTING); 6189 6190 failed: 6191 hci_dev_unlock(hdev); 6192 return err; 6193 } 6194 6195 static void stop_discovery_complete(struct hci_dev *hdev, void *data, int err) 6196 { 6197 struct mgmt_pending_cmd *cmd = data; 6198 6199 if (err == -ECANCELED || !mgmt_pending_valid(hdev, cmd)) 6200 return; 6201 6202 bt_dev_dbg(hdev, "err %d", err); 6203 6204 mgmt_cmd_complete(cmd->sk, cmd->hdev->id, cmd->opcode, mgmt_status(err), 6205 cmd->param, 1); 6206 mgmt_pending_free(cmd); 6207 6208 if (!err) 6209 hci_discovery_set_state(hdev, DISCOVERY_STOPPED); 6210 } 6211 6212 static int stop_discovery_sync(struct hci_dev *hdev, void *data) 6213 { 6214 if (!mgmt_pending_listed(hdev, data)) 6215 return -ECANCELED; 6216 6217 return hci_stop_discovery_sync(hdev); 6218 } 6219 6220 static int stop_discovery(struct sock *sk, struct hci_dev *hdev, void *data, 6221 u16 len) 6222 { 6223 struct mgmt_cp_stop_discovery *mgmt_cp = data; 6224 struct mgmt_pending_cmd *cmd; 6225 int err; 6226 6227 bt_dev_dbg(hdev, "sock %p", sk); 6228 6229 hci_dev_lock(hdev); 6230 6231 if (!hci_discovery_active(hdev)) { 6232 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY, 6233 MGMT_STATUS_REJECTED, &mgmt_cp->type, 6234 sizeof(mgmt_cp->type)); 6235 goto unlock; 6236 } 6237 6238 if (hdev->discovery.type != mgmt_cp->type) { 6239 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY, 6240 MGMT_STATUS_INVALID_PARAMS, 6241 &mgmt_cp->type, sizeof(mgmt_cp->type)); 6242 goto unlock; 6243 } 6244 6245 cmd = mgmt_pending_add(sk, MGMT_OP_STOP_DISCOVERY, hdev, data, len); 6246 if (!cmd) { 6247 err = -ENOMEM; 6248 goto unlock; 6249 } 6250 6251 err = hci_cmd_sync_queue(hdev, stop_discovery_sync, cmd, 6252 stop_discovery_complete); 6253 if (err < 0) { 6254 mgmt_pending_remove(cmd); 6255 goto unlock; 6256 } 6257 6258 hci_discovery_set_state(hdev, DISCOVERY_STOPPING); 6259 6260 unlock: 6261 hci_dev_unlock(hdev); 6262 return err; 6263 } 6264 6265 static int confirm_name(struct sock *sk, struct hci_dev *hdev, void *data, 6266 u16 len) 6267 { 6268 struct mgmt_cp_confirm_name *cp = data; 6269 struct inquiry_entry *e; 6270 int err; 6271 6272 bt_dev_dbg(hdev, "sock %p", sk); 6273 6274 hci_dev_lock(hdev); 6275 6276 if (!hci_discovery_active(hdev)) { 6277 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME, 6278 MGMT_STATUS_FAILED, &cp->addr, 6279 sizeof(cp->addr)); 6280 goto failed; 6281 } 6282 6283 e = hci_inquiry_cache_lookup_unknown(hdev, &cp->addr.bdaddr); 6284 if (!e) { 6285 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME, 6286 MGMT_STATUS_INVALID_PARAMS, &cp->addr, 6287 sizeof(cp->addr)); 6288 goto failed; 6289 } 6290 6291 if (cp->name_known) { 6292 e->name_state = NAME_KNOWN; 6293 list_del(&e->list); 6294 } else { 6295 e->name_state = NAME_NEEDED; 6296 hci_inquiry_cache_update_resolve(hdev, e); 6297 } 6298 6299 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME, 0, 6300 &cp->addr, sizeof(cp->addr)); 6301 6302 failed: 6303 hci_dev_unlock(hdev); 6304 return err; 6305 } 6306 6307 static int block_device(struct sock *sk, struct hci_dev *hdev, void *data, 6308 u16 len) 6309 { 6310 struct mgmt_cp_block_device *cp = data; 6311 u8 status; 6312 int err; 6313 6314 bt_dev_dbg(hdev, "sock %p", sk); 6315 6316 if (!bdaddr_type_is_valid(cp->addr.type)) 6317 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_BLOCK_DEVICE, 6318 MGMT_STATUS_INVALID_PARAMS, 6319 &cp->addr, sizeof(cp->addr)); 6320 6321 hci_dev_lock(hdev); 6322 6323 err = hci_bdaddr_list_add(&hdev->reject_list, &cp->addr.bdaddr, 6324 cp->addr.type); 6325 if (err < 0) { 6326 status = MGMT_STATUS_FAILED; 6327 goto done; 6328 } 6329 6330 mgmt_event(MGMT_EV_DEVICE_BLOCKED, hdev, &cp->addr, sizeof(cp->addr), 6331 sk); 6332 status = MGMT_STATUS_SUCCESS; 6333 6334 done: 6335 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_BLOCK_DEVICE, status, 6336 &cp->addr, sizeof(cp->addr)); 6337 6338 hci_dev_unlock(hdev); 6339 6340 return err; 6341 } 6342 6343 static int unblock_device(struct sock *sk, struct hci_dev *hdev, void *data, 6344 u16 len) 6345 { 6346 struct mgmt_cp_unblock_device *cp = data; 6347 u8 status; 6348 int err; 6349 6350 bt_dev_dbg(hdev, "sock %p", sk); 6351 6352 if (!bdaddr_type_is_valid(cp->addr.type)) 6353 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNBLOCK_DEVICE, 6354 MGMT_STATUS_INVALID_PARAMS, 6355 &cp->addr, sizeof(cp->addr)); 6356 6357 hci_dev_lock(hdev); 6358 6359 err = hci_bdaddr_list_del(&hdev->reject_list, &cp->addr.bdaddr, 6360 cp->addr.type); 6361 if (err < 0) { 6362 status = MGMT_STATUS_INVALID_PARAMS; 6363 goto done; 6364 } 6365 6366 mgmt_event(MGMT_EV_DEVICE_UNBLOCKED, hdev, &cp->addr, sizeof(cp->addr), 6367 sk); 6368 status = MGMT_STATUS_SUCCESS; 6369 6370 done: 6371 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNBLOCK_DEVICE, status, 6372 &cp->addr, sizeof(cp->addr)); 6373 6374 hci_dev_unlock(hdev); 6375 6376 return err; 6377 } 6378 6379 static int set_device_id_sync(struct hci_dev *hdev, void *data) 6380 { 6381 return hci_update_eir_sync(hdev); 6382 } 6383 6384 static int set_device_id(struct sock *sk, struct hci_dev *hdev, void *data, 6385 u16 len) 6386 { 6387 struct mgmt_cp_set_device_id *cp = data; 6388 int err; 6389 __u16 source; 6390 6391 bt_dev_dbg(hdev, "sock %p", sk); 6392 6393 source = __le16_to_cpu(cp->source); 6394 6395 if (source > 0x0002) 6396 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEVICE_ID, 6397 MGMT_STATUS_INVALID_PARAMS); 6398 6399 hci_dev_lock(hdev); 6400 6401 hdev->devid_source = source; 6402 hdev->devid_vendor = __le16_to_cpu(cp->vendor); 6403 hdev->devid_product = __le16_to_cpu(cp->product); 6404 hdev->devid_version = __le16_to_cpu(cp->version); 6405 6406 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_DEVICE_ID, 0, 6407 NULL, 0); 6408 6409 hci_cmd_sync_queue(hdev, set_device_id_sync, NULL, NULL); 6410 6411 hci_dev_unlock(hdev); 6412 6413 return err; 6414 } 6415 6416 static void enable_advertising_instance(struct hci_dev *hdev, int err) 6417 { 6418 if (err) 6419 bt_dev_err(hdev, "failed to re-configure advertising %d", err); 6420 else 6421 bt_dev_dbg(hdev, "status %d", err); 6422 } 6423 6424 static void set_advertising_complete(struct hci_dev *hdev, void *data, int err) 6425 { 6426 struct mgmt_pending_cmd *cmd = data; 6427 struct cmd_lookup match = { NULL, hdev }; 6428 u8 instance; 6429 struct adv_info *adv_instance; 6430 u8 status = mgmt_status(err); 6431 6432 if (err == -ECANCELED || !mgmt_pending_valid(hdev, data)) 6433 return; 6434 6435 if (status) { 6436 mgmt_cmd_status(cmd->sk, cmd->hdev->id, cmd->opcode, status); 6437 mgmt_pending_free(cmd); 6438 return; 6439 } 6440 6441 if (hci_dev_test_flag(hdev, HCI_LE_ADV)) 6442 hci_dev_set_flag(hdev, HCI_ADVERTISING); 6443 else 6444 hci_dev_clear_flag(hdev, HCI_ADVERTISING); 6445 6446 settings_rsp(cmd, &match); 6447 mgmt_pending_free(cmd); 6448 6449 new_settings(hdev, match.sk); 6450 6451 if (match.sk) 6452 sock_put(match.sk); 6453 6454 /* If "Set Advertising" was just disabled and instance advertising was 6455 * set up earlier, then re-enable multi-instance advertising. 6456 */ 6457 if (hci_dev_test_flag(hdev, HCI_ADVERTISING) || 6458 list_empty(&hdev->adv_instances)) 6459 return; 6460 6461 instance = hdev->cur_adv_instance; 6462 if (!instance) { 6463 adv_instance = list_first_entry_or_null(&hdev->adv_instances, 6464 struct adv_info, list); 6465 if (!adv_instance) 6466 return; 6467 6468 instance = adv_instance->instance; 6469 } 6470 6471 err = hci_schedule_adv_instance_sync(hdev, instance, true); 6472 6473 enable_advertising_instance(hdev, err); 6474 } 6475 6476 static int set_adv_sync(struct hci_dev *hdev, void *data) 6477 { 6478 struct mgmt_pending_cmd *cmd = data; 6479 struct mgmt_mode cp; 6480 u8 val; 6481 6482 mutex_lock(&hdev->mgmt_pending_lock); 6483 6484 if (!__mgmt_pending_listed(hdev, cmd)) { 6485 mutex_unlock(&hdev->mgmt_pending_lock); 6486 return -ECANCELED; 6487 } 6488 6489 memcpy(&cp, cmd->param, sizeof(cp)); 6490 6491 mutex_unlock(&hdev->mgmt_pending_lock); 6492 6493 val = !!cp.val; 6494 6495 if (cp.val == 0x02) 6496 hci_dev_set_flag(hdev, HCI_ADVERTISING_CONNECTABLE); 6497 else 6498 hci_dev_clear_flag(hdev, HCI_ADVERTISING_CONNECTABLE); 6499 6500 cancel_adv_timeout(hdev); 6501 6502 if (val) { 6503 /* Switch to instance "0" for the Set Advertising setting. 6504 * We cannot use update_[adv|scan_rsp]_data() here as the 6505 * HCI_ADVERTISING flag is not yet set. 6506 */ 6507 hdev->cur_adv_instance = 0x00; 6508 6509 if (ext_adv_capable(hdev)) { 6510 hci_start_ext_adv_sync(hdev, 0x00); 6511 } else { 6512 hci_update_adv_data_sync(hdev, 0x00); 6513 hci_update_scan_rsp_data_sync(hdev, 0x00); 6514 hci_enable_advertising_sync(hdev); 6515 } 6516 } else { 6517 hci_disable_advertising_sync(hdev); 6518 } 6519 6520 return 0; 6521 } 6522 6523 static int set_advertising(struct sock *sk, struct hci_dev *hdev, void *data, 6524 u16 len) 6525 { 6526 struct mgmt_mode *cp = data; 6527 struct mgmt_pending_cmd *cmd; 6528 u8 val, status; 6529 int err; 6530 6531 bt_dev_dbg(hdev, "sock %p", sk); 6532 6533 status = mgmt_le_support(hdev); 6534 if (status) 6535 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING, 6536 status); 6537 6538 if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02) 6539 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING, 6540 MGMT_STATUS_INVALID_PARAMS); 6541 6542 if (hdev->advertising_paused) 6543 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING, 6544 MGMT_STATUS_BUSY); 6545 6546 hci_dev_lock(hdev); 6547 6548 val = !!cp->val; 6549 6550 /* The following conditions are ones which mean that we should 6551 * not do any HCI communication but directly send a mgmt 6552 * response to user space (after toggling the flag if 6553 * necessary). 6554 */ 6555 if (!hdev_is_powered(hdev) || 6556 (val == hci_dev_test_flag(hdev, HCI_ADVERTISING) && 6557 (cp->val == 0x02) == hci_dev_test_flag(hdev, HCI_ADVERTISING_CONNECTABLE)) || 6558 hci_dev_test_flag(hdev, HCI_MESH) || 6559 hci_conn_num(hdev, LE_LINK) > 0 || 6560 (hci_dev_test_flag(hdev, HCI_LE_SCAN) && 6561 hdev->le_scan_type == LE_SCAN_ACTIVE)) { 6562 bool changed; 6563 6564 if (cp->val) { 6565 hdev->cur_adv_instance = 0x00; 6566 changed = !hci_dev_test_and_set_flag(hdev, HCI_ADVERTISING); 6567 if (cp->val == 0x02) 6568 hci_dev_set_flag(hdev, HCI_ADVERTISING_CONNECTABLE); 6569 else 6570 hci_dev_clear_flag(hdev, HCI_ADVERTISING_CONNECTABLE); 6571 } else { 6572 changed = hci_dev_test_and_clear_flag(hdev, HCI_ADVERTISING); 6573 hci_dev_clear_flag(hdev, HCI_ADVERTISING_CONNECTABLE); 6574 } 6575 6576 err = send_settings_rsp(sk, MGMT_OP_SET_ADVERTISING, hdev); 6577 if (err < 0) 6578 goto unlock; 6579 6580 if (changed) 6581 err = new_settings(hdev, sk); 6582 6583 goto unlock; 6584 } 6585 6586 if (pending_find(MGMT_OP_SET_ADVERTISING, hdev) || 6587 pending_find(MGMT_OP_SET_LE, hdev)) { 6588 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING, 6589 MGMT_STATUS_BUSY); 6590 goto unlock; 6591 } 6592 6593 cmd = mgmt_pending_add(sk, MGMT_OP_SET_ADVERTISING, hdev, data, len); 6594 if (!cmd) 6595 err = -ENOMEM; 6596 else 6597 err = hci_cmd_sync_queue(hdev, set_adv_sync, cmd, 6598 set_advertising_complete); 6599 6600 if (err < 0 && cmd) 6601 mgmt_pending_remove(cmd); 6602 6603 unlock: 6604 hci_dev_unlock(hdev); 6605 return err; 6606 } 6607 6608 static int set_static_address(struct sock *sk, struct hci_dev *hdev, 6609 void *data, u16 len) 6610 { 6611 struct mgmt_cp_set_static_address *cp = data; 6612 int err; 6613 6614 bt_dev_dbg(hdev, "sock %p", sk); 6615 6616 if (!lmp_le_capable(hdev)) 6617 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_STATIC_ADDRESS, 6618 MGMT_STATUS_NOT_SUPPORTED); 6619 6620 if (hdev_is_powered(hdev)) 6621 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_STATIC_ADDRESS, 6622 MGMT_STATUS_REJECTED); 6623 6624 if (bacmp(&cp->bdaddr, BDADDR_ANY)) { 6625 if (!bacmp(&cp->bdaddr, BDADDR_NONE)) 6626 return mgmt_cmd_status(sk, hdev->id, 6627 MGMT_OP_SET_STATIC_ADDRESS, 6628 MGMT_STATUS_INVALID_PARAMS); 6629 6630 /* Two most significant bits shall be set */ 6631 if ((cp->bdaddr.b[5] & 0xc0) != 0xc0) 6632 return mgmt_cmd_status(sk, hdev->id, 6633 MGMT_OP_SET_STATIC_ADDRESS, 6634 MGMT_STATUS_INVALID_PARAMS); 6635 } 6636 6637 hci_dev_lock(hdev); 6638 6639 bacpy(&hdev->static_addr, &cp->bdaddr); 6640 6641 err = send_settings_rsp(sk, MGMT_OP_SET_STATIC_ADDRESS, hdev); 6642 if (err < 0) 6643 goto unlock; 6644 6645 err = new_settings(hdev, sk); 6646 6647 unlock: 6648 hci_dev_unlock(hdev); 6649 return err; 6650 } 6651 6652 static int set_scan_params(struct sock *sk, struct hci_dev *hdev, 6653 void *data, u16 len) 6654 { 6655 struct mgmt_cp_set_scan_params *cp = data; 6656 __u16 interval, window; 6657 int err; 6658 6659 bt_dev_dbg(hdev, "sock %p", sk); 6660 6661 if (!lmp_le_capable(hdev)) 6662 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS, 6663 MGMT_STATUS_NOT_SUPPORTED); 6664 6665 /* Keep allowed ranges in sync with set_mesh() */ 6666 interval = __le16_to_cpu(cp->interval); 6667 6668 if (interval < 0x0004 || interval > 0x4000) 6669 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS, 6670 MGMT_STATUS_INVALID_PARAMS); 6671 6672 window = __le16_to_cpu(cp->window); 6673 6674 if (window < 0x0004 || window > 0x4000) 6675 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS, 6676 MGMT_STATUS_INVALID_PARAMS); 6677 6678 if (window > interval) 6679 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS, 6680 MGMT_STATUS_INVALID_PARAMS); 6681 6682 hci_dev_lock(hdev); 6683 6684 hdev->le_scan_interval = interval; 6685 hdev->le_scan_window = window; 6686 6687 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS, 0, 6688 NULL, 0); 6689 6690 /* If background scan is running, restart it so new parameters are 6691 * loaded. 6692 */ 6693 if (hci_dev_test_flag(hdev, HCI_LE_SCAN) && 6694 hdev->discovery.state == DISCOVERY_STOPPED) 6695 hci_update_passive_scan(hdev); 6696 6697 hci_dev_unlock(hdev); 6698 6699 return err; 6700 } 6701 6702 static void fast_connectable_complete(struct hci_dev *hdev, void *data, int err) 6703 { 6704 struct mgmt_pending_cmd *cmd = data; 6705 6706 bt_dev_dbg(hdev, "err %d", err); 6707 6708 if (err) { 6709 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE, 6710 mgmt_status(err)); 6711 } else { 6712 struct mgmt_mode *cp = cmd->param; 6713 6714 if (cp->val) 6715 hci_dev_set_flag(hdev, HCI_FAST_CONNECTABLE); 6716 else 6717 hci_dev_clear_flag(hdev, HCI_FAST_CONNECTABLE); 6718 6719 send_settings_rsp(cmd->sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev); 6720 new_settings(hdev, cmd->sk); 6721 } 6722 6723 mgmt_pending_free(cmd); 6724 } 6725 6726 static int write_fast_connectable_sync(struct hci_dev *hdev, void *data) 6727 { 6728 struct mgmt_pending_cmd *cmd = data; 6729 struct mgmt_mode *cp = cmd->param; 6730 6731 return hci_write_fast_connectable_sync(hdev, cp->val); 6732 } 6733 6734 static int set_fast_connectable(struct sock *sk, struct hci_dev *hdev, 6735 void *data, u16 len) 6736 { 6737 struct mgmt_mode *cp = data; 6738 struct mgmt_pending_cmd *cmd; 6739 int err; 6740 6741 bt_dev_dbg(hdev, "sock %p", sk); 6742 6743 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) || 6744 hdev->hci_ver < BLUETOOTH_VER_1_2) 6745 return mgmt_cmd_status(sk, hdev->id, 6746 MGMT_OP_SET_FAST_CONNECTABLE, 6747 MGMT_STATUS_NOT_SUPPORTED); 6748 6749 if (cp->val != 0x00 && cp->val != 0x01) 6750 return mgmt_cmd_status(sk, hdev->id, 6751 MGMT_OP_SET_FAST_CONNECTABLE, 6752 MGMT_STATUS_INVALID_PARAMS); 6753 6754 hci_dev_lock(hdev); 6755 6756 if (!!cp->val == hci_dev_test_flag(hdev, HCI_FAST_CONNECTABLE)) { 6757 err = send_settings_rsp(sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev); 6758 goto unlock; 6759 } 6760 6761 if (!hdev_is_powered(hdev)) { 6762 hci_dev_change_flag(hdev, HCI_FAST_CONNECTABLE); 6763 err = send_settings_rsp(sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev); 6764 new_settings(hdev, sk); 6765 goto unlock; 6766 } 6767 6768 cmd = mgmt_pending_new(sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev, data, 6769 len); 6770 if (!cmd) 6771 err = -ENOMEM; 6772 else 6773 err = hci_cmd_sync_queue(hdev, write_fast_connectable_sync, cmd, 6774 fast_connectable_complete); 6775 6776 if (err < 0) { 6777 mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE, 6778 MGMT_STATUS_FAILED); 6779 6780 if (cmd) 6781 mgmt_pending_free(cmd); 6782 } 6783 6784 unlock: 6785 hci_dev_unlock(hdev); 6786 6787 return err; 6788 } 6789 6790 static void set_bredr_complete(struct hci_dev *hdev, void *data, int err) 6791 { 6792 struct mgmt_pending_cmd *cmd = data; 6793 6794 bt_dev_dbg(hdev, "err %d", err); 6795 6796 if (err) { 6797 u8 mgmt_err = mgmt_status(err); 6798 6799 /* We need to restore the flag if related HCI commands 6800 * failed. 6801 */ 6802 hci_dev_clear_flag(hdev, HCI_BREDR_ENABLED); 6803 6804 mgmt_cmd_status(cmd->sk, cmd->hdev->id, cmd->opcode, mgmt_err); 6805 } else { 6806 send_settings_rsp(cmd->sk, MGMT_OP_SET_BREDR, hdev); 6807 new_settings(hdev, cmd->sk); 6808 } 6809 6810 mgmt_pending_free(cmd); 6811 } 6812 6813 static int set_bredr_sync(struct hci_dev *hdev, void *data) 6814 { 6815 int status; 6816 6817 status = hci_write_fast_connectable_sync(hdev, false); 6818 6819 if (!status) 6820 status = hci_update_scan_sync(hdev); 6821 6822 /* Since only the advertising data flags will change, there 6823 * is no need to update the scan response data. 6824 */ 6825 if (!status) 6826 status = hci_update_adv_data_sync(hdev, hdev->cur_adv_instance); 6827 6828 return status; 6829 } 6830 6831 static int set_bredr(struct sock *sk, struct hci_dev *hdev, void *data, u16 len) 6832 { 6833 struct mgmt_mode *cp = data; 6834 struct mgmt_pending_cmd *cmd; 6835 int err; 6836 6837 bt_dev_dbg(hdev, "sock %p", sk); 6838 6839 if (!lmp_bredr_capable(hdev) || !lmp_le_capable(hdev)) 6840 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR, 6841 MGMT_STATUS_NOT_SUPPORTED); 6842 6843 if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED)) 6844 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR, 6845 MGMT_STATUS_REJECTED); 6846 6847 if (cp->val != 0x00 && cp->val != 0x01) 6848 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR, 6849 MGMT_STATUS_INVALID_PARAMS); 6850 6851 hci_dev_lock(hdev); 6852 6853 if (cp->val == hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) { 6854 err = send_settings_rsp(sk, MGMT_OP_SET_BREDR, hdev); 6855 goto unlock; 6856 } 6857 6858 if (!hdev_is_powered(hdev)) { 6859 if (!cp->val) { 6860 hci_dev_clear_flag(hdev, HCI_DISCOVERABLE); 6861 hci_dev_clear_flag(hdev, HCI_SSP_ENABLED); 6862 hci_dev_clear_flag(hdev, HCI_LINK_SECURITY); 6863 hci_dev_clear_flag(hdev, HCI_FAST_CONNECTABLE); 6864 } 6865 6866 hci_dev_change_flag(hdev, HCI_BREDR_ENABLED); 6867 6868 err = send_settings_rsp(sk, MGMT_OP_SET_BREDR, hdev); 6869 if (err < 0) 6870 goto unlock; 6871 6872 err = new_settings(hdev, sk); 6873 goto unlock; 6874 } 6875 6876 /* Reject disabling when powered on */ 6877 if (!cp->val) { 6878 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR, 6879 MGMT_STATUS_REJECTED); 6880 goto unlock; 6881 } else { 6882 /* When configuring a dual-mode controller to operate 6883 * with LE only and using a static address, then switching 6884 * BR/EDR back on is not allowed. 6885 * 6886 * Dual-mode controllers shall operate with the public 6887 * address as its identity address for BR/EDR and LE. So 6888 * reject the attempt to create an invalid configuration. 6889 * 6890 * The same restrictions applies when secure connections 6891 * has been enabled. For BR/EDR this is a controller feature 6892 * while for LE it is a host stack feature. This means that 6893 * switching BR/EDR back on when secure connections has been 6894 * enabled is not a supported transaction. 6895 */ 6896 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) && 6897 (bacmp(&hdev->static_addr, BDADDR_ANY) || 6898 hci_dev_test_flag(hdev, HCI_SC_ENABLED))) { 6899 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR, 6900 MGMT_STATUS_REJECTED); 6901 goto unlock; 6902 } 6903 } 6904 6905 cmd = mgmt_pending_new(sk, MGMT_OP_SET_BREDR, hdev, data, len); 6906 if (!cmd) 6907 err = -ENOMEM; 6908 else 6909 err = hci_cmd_sync_queue(hdev, set_bredr_sync, cmd, 6910 set_bredr_complete); 6911 6912 if (err < 0) { 6913 mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR, 6914 MGMT_STATUS_FAILED); 6915 if (cmd) 6916 mgmt_pending_free(cmd); 6917 6918 goto unlock; 6919 } 6920 6921 /* We need to flip the bit already here so that 6922 * hci_req_update_adv_data generates the correct flags. 6923 */ 6924 hci_dev_set_flag(hdev, HCI_BREDR_ENABLED); 6925 6926 unlock: 6927 hci_dev_unlock(hdev); 6928 return err; 6929 } 6930 6931 static void set_secure_conn_complete(struct hci_dev *hdev, void *data, int err) 6932 { 6933 struct mgmt_pending_cmd *cmd = data; 6934 struct mgmt_mode *cp; 6935 6936 bt_dev_dbg(hdev, "err %d", err); 6937 6938 if (err) { 6939 u8 mgmt_err = mgmt_status(err); 6940 6941 mgmt_cmd_status(cmd->sk, cmd->hdev->id, cmd->opcode, mgmt_err); 6942 goto done; 6943 } 6944 6945 cp = cmd->param; 6946 6947 switch (cp->val) { 6948 case 0x00: 6949 hci_dev_clear_flag(hdev, HCI_SC_ENABLED); 6950 hci_dev_clear_flag(hdev, HCI_SC_ONLY); 6951 break; 6952 case 0x01: 6953 hci_dev_set_flag(hdev, HCI_SC_ENABLED); 6954 hci_dev_clear_flag(hdev, HCI_SC_ONLY); 6955 break; 6956 case 0x02: 6957 hci_dev_set_flag(hdev, HCI_SC_ENABLED); 6958 hci_dev_set_flag(hdev, HCI_SC_ONLY); 6959 break; 6960 } 6961 6962 send_settings_rsp(cmd->sk, cmd->opcode, hdev); 6963 new_settings(hdev, cmd->sk); 6964 6965 done: 6966 mgmt_pending_free(cmd); 6967 } 6968 6969 static int set_secure_conn_sync(struct hci_dev *hdev, void *data) 6970 { 6971 struct mgmt_pending_cmd *cmd = data; 6972 struct mgmt_mode *cp = cmd->param; 6973 u8 val = !!cp->val; 6974 6975 /* Force write of val */ 6976 hci_dev_set_flag(hdev, HCI_SC_ENABLED); 6977 6978 return hci_write_sc_support_sync(hdev, val); 6979 } 6980 6981 static int set_secure_conn(struct sock *sk, struct hci_dev *hdev, 6982 void *data, u16 len) 6983 { 6984 struct mgmt_mode *cp = data; 6985 struct mgmt_pending_cmd *cmd; 6986 u8 val; 6987 int err; 6988 6989 bt_dev_dbg(hdev, "sock %p", sk); 6990 6991 if (!lmp_sc_capable(hdev) && 6992 !hci_dev_test_flag(hdev, HCI_LE_ENABLED)) 6993 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN, 6994 MGMT_STATUS_NOT_SUPPORTED); 6995 6996 if (hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) && 6997 lmp_sc_capable(hdev) && 6998 !hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) 6999 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN, 7000 MGMT_STATUS_REJECTED); 7001 7002 if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02) 7003 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN, 7004 MGMT_STATUS_INVALID_PARAMS); 7005 7006 hci_dev_lock(hdev); 7007 7008 if (!hdev_is_powered(hdev) || !lmp_sc_capable(hdev) || 7009 !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) { 7010 bool changed; 7011 7012 if (cp->val) { 7013 changed = !hci_dev_test_and_set_flag(hdev, 7014 HCI_SC_ENABLED); 7015 if (cp->val == 0x02) 7016 hci_dev_set_flag(hdev, HCI_SC_ONLY); 7017 else 7018 hci_dev_clear_flag(hdev, HCI_SC_ONLY); 7019 } else { 7020 changed = hci_dev_test_and_clear_flag(hdev, 7021 HCI_SC_ENABLED); 7022 hci_dev_clear_flag(hdev, HCI_SC_ONLY); 7023 } 7024 7025 err = send_settings_rsp(sk, MGMT_OP_SET_SECURE_CONN, hdev); 7026 if (err < 0) 7027 goto failed; 7028 7029 if (changed) 7030 err = new_settings(hdev, sk); 7031 7032 goto failed; 7033 } 7034 7035 val = !!cp->val; 7036 7037 if (val == hci_dev_test_flag(hdev, HCI_SC_ENABLED) && 7038 (cp->val == 0x02) == hci_dev_test_flag(hdev, HCI_SC_ONLY)) { 7039 err = send_settings_rsp(sk, MGMT_OP_SET_SECURE_CONN, hdev); 7040 goto failed; 7041 } 7042 7043 cmd = mgmt_pending_new(sk, MGMT_OP_SET_SECURE_CONN, hdev, data, len); 7044 if (!cmd) 7045 err = -ENOMEM; 7046 else 7047 err = hci_cmd_sync_queue(hdev, set_secure_conn_sync, cmd, 7048 set_secure_conn_complete); 7049 7050 if (err < 0) { 7051 mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN, 7052 MGMT_STATUS_FAILED); 7053 if (cmd) 7054 mgmt_pending_free(cmd); 7055 } 7056 7057 failed: 7058 hci_dev_unlock(hdev); 7059 return err; 7060 } 7061 7062 static int set_debug_keys(struct sock *sk, struct hci_dev *hdev, 7063 void *data, u16 len) 7064 { 7065 struct mgmt_mode *cp = data; 7066 bool changed, use_changed; 7067 int err; 7068 7069 bt_dev_dbg(hdev, "sock %p", sk); 7070 7071 if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02) 7072 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEBUG_KEYS, 7073 MGMT_STATUS_INVALID_PARAMS); 7074 7075 hci_dev_lock(hdev); 7076 7077 if (cp->val) 7078 changed = !hci_dev_test_and_set_flag(hdev, HCI_KEEP_DEBUG_KEYS); 7079 else 7080 changed = hci_dev_test_and_clear_flag(hdev, 7081 HCI_KEEP_DEBUG_KEYS); 7082 7083 if (cp->val == 0x02) 7084 use_changed = !hci_dev_test_and_set_flag(hdev, 7085 HCI_USE_DEBUG_KEYS); 7086 else 7087 use_changed = hci_dev_test_and_clear_flag(hdev, 7088 HCI_USE_DEBUG_KEYS); 7089 7090 if (hdev_is_powered(hdev) && use_changed && 7091 hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) { 7092 u8 mode = (cp->val == 0x02) ? 0x01 : 0x00; 7093 hci_send_cmd(hdev, HCI_OP_WRITE_SSP_DEBUG_MODE, 7094 sizeof(mode), &mode); 7095 } 7096 7097 err = send_settings_rsp(sk, MGMT_OP_SET_DEBUG_KEYS, hdev); 7098 if (err < 0) 7099 goto unlock; 7100 7101 if (changed) 7102 err = new_settings(hdev, sk); 7103 7104 unlock: 7105 hci_dev_unlock(hdev); 7106 return err; 7107 } 7108 7109 static int set_privacy(struct sock *sk, struct hci_dev *hdev, void *cp_data, 7110 u16 len) 7111 { 7112 struct mgmt_cp_set_privacy *cp = cp_data; 7113 bool changed; 7114 int err; 7115 7116 bt_dev_dbg(hdev, "sock %p", sk); 7117 7118 if (!lmp_le_capable(hdev)) 7119 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY, 7120 MGMT_STATUS_NOT_SUPPORTED); 7121 7122 if (cp->privacy != 0x00 && cp->privacy != 0x01 && cp->privacy != 0x02) 7123 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY, 7124 MGMT_STATUS_INVALID_PARAMS); 7125 7126 if (hdev_is_powered(hdev)) 7127 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY, 7128 MGMT_STATUS_REJECTED); 7129 7130 hci_dev_lock(hdev); 7131 7132 /* If user space supports this command it is also expected to 7133 * handle IRKs. Therefore, set the HCI_RPA_RESOLVING flag. 7134 */ 7135 hci_dev_set_flag(hdev, HCI_RPA_RESOLVING); 7136 7137 if (cp->privacy) { 7138 changed = !hci_dev_test_and_set_flag(hdev, HCI_PRIVACY); 7139 memcpy(hdev->irk, cp->irk, sizeof(hdev->irk)); 7140 hci_dev_set_flag(hdev, HCI_RPA_EXPIRED); 7141 hci_adv_instances_set_rpa_expired(hdev, true); 7142 if (cp->privacy == 0x02) 7143 hci_dev_set_flag(hdev, HCI_LIMITED_PRIVACY); 7144 else 7145 hci_dev_clear_flag(hdev, HCI_LIMITED_PRIVACY); 7146 } else { 7147 changed = hci_dev_test_and_clear_flag(hdev, HCI_PRIVACY); 7148 memset(hdev->irk, 0, sizeof(hdev->irk)); 7149 hci_dev_clear_flag(hdev, HCI_RPA_EXPIRED); 7150 hci_adv_instances_set_rpa_expired(hdev, false); 7151 hci_dev_clear_flag(hdev, HCI_LIMITED_PRIVACY); 7152 } 7153 7154 err = send_settings_rsp(sk, MGMT_OP_SET_PRIVACY, hdev); 7155 if (err < 0) 7156 goto unlock; 7157 7158 if (changed) 7159 err = new_settings(hdev, sk); 7160 7161 unlock: 7162 hci_dev_unlock(hdev); 7163 return err; 7164 } 7165 7166 static bool irk_is_valid(struct mgmt_irk_info *irk) 7167 { 7168 switch (irk->addr.type) { 7169 case BDADDR_LE_PUBLIC: 7170 return true; 7171 7172 case BDADDR_LE_RANDOM: 7173 /* Two most significant bits shall be set */ 7174 if ((irk->addr.bdaddr.b[5] & 0xc0) != 0xc0) 7175 return false; 7176 return true; 7177 } 7178 7179 return false; 7180 } 7181 7182 static int load_irks(struct sock *sk, struct hci_dev *hdev, void *cp_data, 7183 u16 len) 7184 { 7185 struct mgmt_cp_load_irks *cp = cp_data; 7186 const u16 max_irk_count = ((U16_MAX - sizeof(*cp)) / 7187 sizeof(struct mgmt_irk_info)); 7188 u16 irk_count, expected_len; 7189 int i, err; 7190 7191 bt_dev_dbg(hdev, "sock %p", sk); 7192 7193 if (!lmp_le_capable(hdev)) 7194 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS, 7195 MGMT_STATUS_NOT_SUPPORTED); 7196 7197 irk_count = __le16_to_cpu(cp->irk_count); 7198 if (irk_count > max_irk_count) { 7199 bt_dev_err(hdev, "load_irks: too big irk_count value %u", 7200 irk_count); 7201 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS, 7202 MGMT_STATUS_INVALID_PARAMS); 7203 } 7204 7205 expected_len = struct_size(cp, irks, irk_count); 7206 if (expected_len != len) { 7207 bt_dev_err(hdev, "load_irks: expected %u bytes, got %u bytes", 7208 expected_len, len); 7209 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS, 7210 MGMT_STATUS_INVALID_PARAMS); 7211 } 7212 7213 bt_dev_dbg(hdev, "irk_count %u", irk_count); 7214 7215 for (i = 0; i < irk_count; i++) { 7216 struct mgmt_irk_info *key = &cp->irks[i]; 7217 7218 if (!irk_is_valid(key)) 7219 return mgmt_cmd_status(sk, hdev->id, 7220 MGMT_OP_LOAD_IRKS, 7221 MGMT_STATUS_INVALID_PARAMS); 7222 } 7223 7224 hci_dev_lock(hdev); 7225 7226 hci_smp_irks_clear(hdev); 7227 7228 for (i = 0; i < irk_count; i++) { 7229 struct mgmt_irk_info *irk = &cp->irks[i]; 7230 7231 if (hci_is_blocked_key(hdev, 7232 HCI_BLOCKED_KEY_TYPE_IRK, 7233 irk->val)) { 7234 bt_dev_warn(hdev, "Skipping blocked IRK for %pMR", 7235 &irk->addr.bdaddr); 7236 continue; 7237 } 7238 7239 hci_add_irk(hdev, &irk->addr.bdaddr, 7240 le_addr_type(irk->addr.type), irk->val, 7241 BDADDR_ANY); 7242 } 7243 7244 hci_dev_set_flag(hdev, HCI_RPA_RESOLVING); 7245 7246 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_IRKS, 0, NULL, 0); 7247 7248 hci_dev_unlock(hdev); 7249 7250 return err; 7251 } 7252 7253 static bool ltk_is_valid(struct mgmt_ltk_info *key) 7254 { 7255 if (key->initiator != 0x00 && key->initiator != 0x01) 7256 return false; 7257 7258 if (key->enc_size > sizeof(key->val)) 7259 return false; 7260 7261 switch (key->addr.type) { 7262 case BDADDR_LE_PUBLIC: 7263 return true; 7264 7265 case BDADDR_LE_RANDOM: 7266 /* Two most significant bits shall be set */ 7267 if ((key->addr.bdaddr.b[5] & 0xc0) != 0xc0) 7268 return false; 7269 return true; 7270 } 7271 7272 return false; 7273 } 7274 7275 static int load_long_term_keys(struct sock *sk, struct hci_dev *hdev, 7276 void *cp_data, u16 len) 7277 { 7278 struct mgmt_cp_load_long_term_keys *cp = cp_data; 7279 const u16 max_key_count = ((U16_MAX - sizeof(*cp)) / 7280 sizeof(struct mgmt_ltk_info)); 7281 u16 key_count, expected_len; 7282 int i, err; 7283 7284 bt_dev_dbg(hdev, "sock %p", sk); 7285 7286 if (!lmp_le_capable(hdev)) 7287 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS, 7288 MGMT_STATUS_NOT_SUPPORTED); 7289 7290 key_count = __le16_to_cpu(cp->key_count); 7291 if (key_count > max_key_count) { 7292 bt_dev_err(hdev, "load_ltks: too big key_count value %u", 7293 key_count); 7294 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS, 7295 MGMT_STATUS_INVALID_PARAMS); 7296 } 7297 7298 expected_len = struct_size(cp, keys, key_count); 7299 if (expected_len != len) { 7300 bt_dev_err(hdev, "load_keys: expected %u bytes, got %u bytes", 7301 expected_len, len); 7302 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS, 7303 MGMT_STATUS_INVALID_PARAMS); 7304 } 7305 7306 bt_dev_dbg(hdev, "key_count %u", key_count); 7307 7308 hci_dev_lock(hdev); 7309 7310 hci_smp_ltks_clear(hdev); 7311 7312 for (i = 0; i < key_count; i++) { 7313 struct mgmt_ltk_info *key = &cp->keys[i]; 7314 u8 type, authenticated; 7315 7316 if (hci_is_blocked_key(hdev, 7317 HCI_BLOCKED_KEY_TYPE_LTK, 7318 key->val)) { 7319 bt_dev_warn(hdev, "Skipping blocked LTK for %pMR", 7320 &key->addr.bdaddr); 7321 continue; 7322 } 7323 7324 if (!ltk_is_valid(key)) { 7325 bt_dev_warn(hdev, "Invalid LTK for %pMR", 7326 &key->addr.bdaddr); 7327 continue; 7328 } 7329 7330 switch (key->type) { 7331 case MGMT_LTK_UNAUTHENTICATED: 7332 authenticated = 0x00; 7333 type = key->initiator ? SMP_LTK : SMP_LTK_RESPONDER; 7334 break; 7335 case MGMT_LTK_AUTHENTICATED: 7336 authenticated = 0x01; 7337 type = key->initiator ? SMP_LTK : SMP_LTK_RESPONDER; 7338 break; 7339 case MGMT_LTK_P256_UNAUTH: 7340 authenticated = 0x00; 7341 type = SMP_LTK_P256; 7342 break; 7343 case MGMT_LTK_P256_AUTH: 7344 authenticated = 0x01; 7345 type = SMP_LTK_P256; 7346 break; 7347 case MGMT_LTK_P256_DEBUG: 7348 authenticated = 0x00; 7349 type = SMP_LTK_P256_DEBUG; 7350 fallthrough; 7351 default: 7352 continue; 7353 } 7354 7355 hci_add_ltk(hdev, &key->addr.bdaddr, 7356 le_addr_type(key->addr.type), type, authenticated, 7357 key->val, key->enc_size, key->ediv, key->rand); 7358 } 7359 7360 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS, 0, 7361 NULL, 0); 7362 7363 hci_dev_unlock(hdev); 7364 7365 return err; 7366 } 7367 7368 static void get_conn_info_complete(struct hci_dev *hdev, void *data, int err) 7369 { 7370 struct mgmt_pending_cmd *cmd = data; 7371 struct hci_conn *conn = cmd->user_data; 7372 struct mgmt_cp_get_conn_info *cp = cmd->param; 7373 struct mgmt_rp_get_conn_info rp; 7374 u8 status; 7375 7376 bt_dev_dbg(hdev, "err %d", err); 7377 7378 memcpy(&rp.addr, &cp->addr, sizeof(rp.addr)); 7379 7380 status = mgmt_status(err); 7381 if (status == MGMT_STATUS_SUCCESS) { 7382 rp.rssi = conn->rssi; 7383 rp.tx_power = conn->tx_power; 7384 rp.max_tx_power = conn->max_tx_power; 7385 } else { 7386 rp.rssi = HCI_RSSI_INVALID; 7387 rp.tx_power = HCI_TX_POWER_INVALID; 7388 rp.max_tx_power = HCI_TX_POWER_INVALID; 7389 } 7390 7391 mgmt_cmd_complete(cmd->sk, cmd->hdev->id, MGMT_OP_GET_CONN_INFO, status, 7392 &rp, sizeof(rp)); 7393 7394 mgmt_pending_free(cmd); 7395 } 7396 7397 static int get_conn_info_sync(struct hci_dev *hdev, void *data) 7398 { 7399 struct mgmt_pending_cmd *cmd = data; 7400 struct mgmt_cp_get_conn_info *cp = cmd->param; 7401 struct hci_conn *conn; 7402 int err; 7403 __le16 handle; 7404 7405 /* Make sure we are still connected */ 7406 if (cp->addr.type == BDADDR_BREDR) 7407 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, 7408 &cp->addr.bdaddr); 7409 else 7410 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &cp->addr.bdaddr); 7411 7412 if (!conn || conn->state != BT_CONNECTED) 7413 return MGMT_STATUS_NOT_CONNECTED; 7414 7415 cmd->user_data = conn; 7416 handle = cpu_to_le16(conn->handle); 7417 7418 /* Refresh RSSI each time */ 7419 err = hci_read_rssi_sync(hdev, handle); 7420 7421 /* For LE links TX power does not change thus we don't need to 7422 * query for it once value is known. 7423 */ 7424 if (!err && (!bdaddr_type_is_le(cp->addr.type) || 7425 conn->tx_power == HCI_TX_POWER_INVALID)) 7426 err = hci_read_tx_power_sync(hdev, handle, 0x00); 7427 7428 /* Max TX power needs to be read only once per connection */ 7429 if (!err && conn->max_tx_power == HCI_TX_POWER_INVALID) 7430 err = hci_read_tx_power_sync(hdev, handle, 0x01); 7431 7432 return err; 7433 } 7434 7435 static int get_conn_info(struct sock *sk, struct hci_dev *hdev, void *data, 7436 u16 len) 7437 { 7438 struct mgmt_cp_get_conn_info *cp = data; 7439 struct mgmt_rp_get_conn_info rp; 7440 struct hci_conn *conn; 7441 unsigned long conn_info_age; 7442 int err = 0; 7443 7444 bt_dev_dbg(hdev, "sock %p", sk); 7445 7446 memset(&rp, 0, sizeof(rp)); 7447 bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr); 7448 rp.addr.type = cp->addr.type; 7449 7450 if (!bdaddr_type_is_valid(cp->addr.type)) 7451 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO, 7452 MGMT_STATUS_INVALID_PARAMS, 7453 &rp, sizeof(rp)); 7454 7455 hci_dev_lock(hdev); 7456 7457 if (!hdev_is_powered(hdev)) { 7458 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO, 7459 MGMT_STATUS_NOT_POWERED, &rp, 7460 sizeof(rp)); 7461 goto unlock; 7462 } 7463 7464 if (cp->addr.type == BDADDR_BREDR) 7465 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, 7466 &cp->addr.bdaddr); 7467 else 7468 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &cp->addr.bdaddr); 7469 7470 if (!conn || conn->state != BT_CONNECTED) { 7471 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO, 7472 MGMT_STATUS_NOT_CONNECTED, &rp, 7473 sizeof(rp)); 7474 goto unlock; 7475 } 7476 7477 /* To avoid client trying to guess when to poll again for information we 7478 * calculate conn info age as random value between min/max set in hdev. 7479 */ 7480 conn_info_age = get_random_u32_inclusive(hdev->conn_info_min_age, 7481 hdev->conn_info_max_age - 1); 7482 7483 /* Query controller to refresh cached values if they are too old or were 7484 * never read. 7485 */ 7486 if (time_after(jiffies, conn->conn_info_timestamp + 7487 msecs_to_jiffies(conn_info_age)) || 7488 !conn->conn_info_timestamp) { 7489 struct mgmt_pending_cmd *cmd; 7490 7491 cmd = mgmt_pending_new(sk, MGMT_OP_GET_CONN_INFO, hdev, data, 7492 len); 7493 if (!cmd) { 7494 err = -ENOMEM; 7495 } else { 7496 err = hci_cmd_sync_queue(hdev, get_conn_info_sync, 7497 cmd, get_conn_info_complete); 7498 } 7499 7500 if (err < 0) { 7501 mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO, 7502 MGMT_STATUS_FAILED, &rp, sizeof(rp)); 7503 7504 if (cmd) 7505 mgmt_pending_free(cmd); 7506 7507 goto unlock; 7508 } 7509 7510 conn->conn_info_timestamp = jiffies; 7511 } else { 7512 /* Cache is valid, just reply with values cached in hci_conn */ 7513 rp.rssi = conn->rssi; 7514 rp.tx_power = conn->tx_power; 7515 rp.max_tx_power = conn->max_tx_power; 7516 7517 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO, 7518 MGMT_STATUS_SUCCESS, &rp, sizeof(rp)); 7519 } 7520 7521 unlock: 7522 hci_dev_unlock(hdev); 7523 return err; 7524 } 7525 7526 static void get_clock_info_complete(struct hci_dev *hdev, void *data, int err) 7527 { 7528 struct mgmt_pending_cmd *cmd = data; 7529 struct mgmt_cp_get_clock_info *cp = cmd->param; 7530 struct mgmt_rp_get_clock_info rp; 7531 struct hci_conn *conn = cmd->user_data; 7532 u8 status = mgmt_status(err); 7533 7534 bt_dev_dbg(hdev, "err %d", err); 7535 7536 memset(&rp, 0, sizeof(rp)); 7537 bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr); 7538 rp.addr.type = cp->addr.type; 7539 7540 if (err) 7541 goto complete; 7542 7543 rp.local_clock = cpu_to_le32(hdev->clock); 7544 7545 if (conn) { 7546 rp.piconet_clock = cpu_to_le32(conn->clock); 7547 rp.accuracy = cpu_to_le16(conn->clock_accuracy); 7548 } 7549 7550 complete: 7551 mgmt_cmd_complete(cmd->sk, cmd->hdev->id, cmd->opcode, status, &rp, 7552 sizeof(rp)); 7553 7554 mgmt_pending_free(cmd); 7555 } 7556 7557 static int get_clock_info_sync(struct hci_dev *hdev, void *data) 7558 { 7559 struct mgmt_pending_cmd *cmd = data; 7560 struct mgmt_cp_get_clock_info *cp = cmd->param; 7561 struct hci_cp_read_clock hci_cp; 7562 struct hci_conn *conn; 7563 7564 memset(&hci_cp, 0, sizeof(hci_cp)); 7565 hci_read_clock_sync(hdev, &hci_cp); 7566 7567 /* Make sure connection still exists */ 7568 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->addr.bdaddr); 7569 if (!conn || conn->state != BT_CONNECTED) 7570 return MGMT_STATUS_NOT_CONNECTED; 7571 7572 cmd->user_data = conn; 7573 hci_cp.handle = cpu_to_le16(conn->handle); 7574 hci_cp.which = 0x01; /* Piconet clock */ 7575 7576 return hci_read_clock_sync(hdev, &hci_cp); 7577 } 7578 7579 static int get_clock_info(struct sock *sk, struct hci_dev *hdev, void *data, 7580 u16 len) 7581 { 7582 struct mgmt_cp_get_clock_info *cp = data; 7583 struct mgmt_rp_get_clock_info rp; 7584 struct mgmt_pending_cmd *cmd; 7585 struct hci_conn *conn; 7586 int err; 7587 7588 bt_dev_dbg(hdev, "sock %p", sk); 7589 7590 memset(&rp, 0, sizeof(rp)); 7591 bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr); 7592 rp.addr.type = cp->addr.type; 7593 7594 if (cp->addr.type != BDADDR_BREDR) 7595 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CLOCK_INFO, 7596 MGMT_STATUS_INVALID_PARAMS, 7597 &rp, sizeof(rp)); 7598 7599 hci_dev_lock(hdev); 7600 7601 if (!hdev_is_powered(hdev)) { 7602 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CLOCK_INFO, 7603 MGMT_STATUS_NOT_POWERED, &rp, 7604 sizeof(rp)); 7605 goto unlock; 7606 } 7607 7608 if (bacmp(&cp->addr.bdaddr, BDADDR_ANY)) { 7609 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, 7610 &cp->addr.bdaddr); 7611 if (!conn || conn->state != BT_CONNECTED) { 7612 err = mgmt_cmd_complete(sk, hdev->id, 7613 MGMT_OP_GET_CLOCK_INFO, 7614 MGMT_STATUS_NOT_CONNECTED, 7615 &rp, sizeof(rp)); 7616 goto unlock; 7617 } 7618 } else { 7619 conn = NULL; 7620 } 7621 7622 cmd = mgmt_pending_new(sk, MGMT_OP_GET_CLOCK_INFO, hdev, data, len); 7623 if (!cmd) 7624 err = -ENOMEM; 7625 else 7626 err = hci_cmd_sync_queue(hdev, get_clock_info_sync, cmd, 7627 get_clock_info_complete); 7628 7629 if (err < 0) { 7630 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CLOCK_INFO, 7631 MGMT_STATUS_FAILED, &rp, sizeof(rp)); 7632 7633 if (cmd) 7634 mgmt_pending_free(cmd); 7635 } 7636 7637 7638 unlock: 7639 hci_dev_unlock(hdev); 7640 return err; 7641 } 7642 7643 static void device_added(struct sock *sk, struct hci_dev *hdev, 7644 bdaddr_t *bdaddr, u8 type, u8 action) 7645 { 7646 struct mgmt_ev_device_added ev; 7647 7648 bacpy(&ev.addr.bdaddr, bdaddr); 7649 ev.addr.type = type; 7650 ev.action = action; 7651 7652 mgmt_event(MGMT_EV_DEVICE_ADDED, hdev, &ev, sizeof(ev), sk); 7653 } 7654 7655 static void add_device_complete(struct hci_dev *hdev, void *data, int err) 7656 { 7657 struct mgmt_pending_cmd *cmd = data; 7658 struct mgmt_cp_add_device *cp = cmd->param; 7659 7660 if (!err) { 7661 struct hci_conn_params *params; 7662 7663 hci_dev_lock(hdev); 7664 7665 params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr, 7666 le_addr_type(cp->addr.type)); 7667 7668 device_added(cmd->sk, hdev, &cp->addr.bdaddr, cp->addr.type, 7669 cp->action); 7670 device_flags_changed(NULL, hdev, &cp->addr.bdaddr, 7671 cp->addr.type, hdev->conn_flags, 7672 params ? params->flags : 0); 7673 hci_dev_unlock(hdev); 7674 } 7675 7676 mgmt_cmd_complete(cmd->sk, hdev->id, MGMT_OP_ADD_DEVICE, 7677 mgmt_status(err), &cp->addr, sizeof(cp->addr)); 7678 mgmt_pending_free(cmd); 7679 } 7680 7681 static int add_device_sync(struct hci_dev *hdev, void *data) 7682 { 7683 return hci_update_passive_scan_sync(hdev); 7684 } 7685 7686 static int add_device(struct sock *sk, struct hci_dev *hdev, 7687 void *data, u16 len) 7688 { 7689 struct mgmt_pending_cmd *cmd; 7690 struct mgmt_cp_add_device *cp = data; 7691 u8 auto_conn, addr_type; 7692 struct hci_conn_params *params; 7693 int err; 7694 u32 current_flags = 0; 7695 u32 supported_flags; 7696 7697 bt_dev_dbg(hdev, "sock %p", sk); 7698 7699 if (!bdaddr_type_is_valid(cp->addr.type) || 7700 !bacmp(&cp->addr.bdaddr, BDADDR_ANY)) 7701 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE, 7702 MGMT_STATUS_INVALID_PARAMS, 7703 &cp->addr, sizeof(cp->addr)); 7704 7705 if (cp->action != 0x00 && cp->action != 0x01 && cp->action != 0x02) 7706 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE, 7707 MGMT_STATUS_INVALID_PARAMS, 7708 &cp->addr, sizeof(cp->addr)); 7709 7710 hci_dev_lock(hdev); 7711 7712 if (cp->addr.type == BDADDR_BREDR) { 7713 /* Only incoming connections action is supported for now */ 7714 if (cp->action != 0x01) { 7715 err = mgmt_cmd_complete(sk, hdev->id, 7716 MGMT_OP_ADD_DEVICE, 7717 MGMT_STATUS_INVALID_PARAMS, 7718 &cp->addr, sizeof(cp->addr)); 7719 goto unlock; 7720 } 7721 7722 err = hci_bdaddr_list_add_with_flags(&hdev->accept_list, 7723 &cp->addr.bdaddr, 7724 cp->addr.type, 0); 7725 if (err) 7726 goto unlock; 7727 7728 hci_update_scan(hdev); 7729 7730 goto added; 7731 } 7732 7733 addr_type = le_addr_type(cp->addr.type); 7734 7735 if (cp->action == 0x02) 7736 auto_conn = HCI_AUTO_CONN_ALWAYS; 7737 else if (cp->action == 0x01) 7738 auto_conn = HCI_AUTO_CONN_DIRECT; 7739 else 7740 auto_conn = HCI_AUTO_CONN_REPORT; 7741 7742 /* Kernel internally uses conn_params with resolvable private 7743 * address, but Add Device allows only identity addresses. 7744 * Make sure it is enforced before calling 7745 * hci_conn_params_lookup. 7746 */ 7747 if (!hci_is_identity_address(&cp->addr.bdaddr, addr_type)) { 7748 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE, 7749 MGMT_STATUS_INVALID_PARAMS, 7750 &cp->addr, sizeof(cp->addr)); 7751 goto unlock; 7752 } 7753 7754 /* If the connection parameters don't exist for this device, 7755 * they will be created and configured with defaults. 7756 */ 7757 params = hci_conn_params_set(hdev, &cp->addr.bdaddr, addr_type, 7758 auto_conn); 7759 if (!params) { 7760 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE, 7761 MGMT_STATUS_FAILED, &cp->addr, 7762 sizeof(cp->addr)); 7763 goto unlock; 7764 } 7765 7766 cmd = mgmt_pending_new(sk, MGMT_OP_ADD_DEVICE, hdev, data, len); 7767 if (!cmd) { 7768 err = -ENOMEM; 7769 goto unlock; 7770 } 7771 7772 err = hci_cmd_sync_queue(hdev, add_device_sync, cmd, 7773 add_device_complete); 7774 if (err < 0) { 7775 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE, 7776 MGMT_STATUS_FAILED, &cp->addr, 7777 sizeof(cp->addr)); 7778 mgmt_pending_free(cmd); 7779 } 7780 7781 goto unlock; 7782 7783 added: 7784 device_added(sk, hdev, &cp->addr.bdaddr, cp->addr.type, cp->action); 7785 supported_flags = hdev->conn_flags; 7786 device_flags_changed(NULL, hdev, &cp->addr.bdaddr, cp->addr.type, 7787 supported_flags, current_flags); 7788 7789 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE, 7790 MGMT_STATUS_SUCCESS, &cp->addr, 7791 sizeof(cp->addr)); 7792 7793 unlock: 7794 hci_dev_unlock(hdev); 7795 return err; 7796 } 7797 7798 static void device_removed(struct sock *sk, struct hci_dev *hdev, 7799 bdaddr_t *bdaddr, u8 type) 7800 { 7801 struct mgmt_ev_device_removed ev; 7802 7803 bacpy(&ev.addr.bdaddr, bdaddr); 7804 ev.addr.type = type; 7805 7806 mgmt_event(MGMT_EV_DEVICE_REMOVED, hdev, &ev, sizeof(ev), sk); 7807 } 7808 7809 static int remove_device_sync(struct hci_dev *hdev, void *data) 7810 { 7811 return hci_update_passive_scan_sync(hdev); 7812 } 7813 7814 static int remove_device(struct sock *sk, struct hci_dev *hdev, 7815 void *data, u16 len) 7816 { 7817 struct mgmt_cp_remove_device *cp = data; 7818 int err; 7819 7820 bt_dev_dbg(hdev, "sock %p", sk); 7821 7822 hci_dev_lock(hdev); 7823 7824 if (bacmp(&cp->addr.bdaddr, BDADDR_ANY)) { 7825 struct hci_conn_params *params; 7826 u8 addr_type; 7827 7828 if (!bdaddr_type_is_valid(cp->addr.type)) { 7829 err = mgmt_cmd_complete(sk, hdev->id, 7830 MGMT_OP_REMOVE_DEVICE, 7831 MGMT_STATUS_INVALID_PARAMS, 7832 &cp->addr, sizeof(cp->addr)); 7833 goto unlock; 7834 } 7835 7836 if (cp->addr.type == BDADDR_BREDR) { 7837 err = hci_bdaddr_list_del(&hdev->accept_list, 7838 &cp->addr.bdaddr, 7839 cp->addr.type); 7840 if (err) { 7841 err = mgmt_cmd_complete(sk, hdev->id, 7842 MGMT_OP_REMOVE_DEVICE, 7843 MGMT_STATUS_INVALID_PARAMS, 7844 &cp->addr, 7845 sizeof(cp->addr)); 7846 goto unlock; 7847 } 7848 7849 hci_update_scan(hdev); 7850 7851 device_removed(sk, hdev, &cp->addr.bdaddr, 7852 cp->addr.type); 7853 goto complete; 7854 } 7855 7856 addr_type = le_addr_type(cp->addr.type); 7857 7858 /* Kernel internally uses conn_params with resolvable private 7859 * address, but Remove Device allows only identity addresses. 7860 * Make sure it is enforced before calling 7861 * hci_conn_params_lookup. 7862 */ 7863 if (!hci_is_identity_address(&cp->addr.bdaddr, addr_type)) { 7864 err = mgmt_cmd_complete(sk, hdev->id, 7865 MGMT_OP_REMOVE_DEVICE, 7866 MGMT_STATUS_INVALID_PARAMS, 7867 &cp->addr, sizeof(cp->addr)); 7868 goto unlock; 7869 } 7870 7871 params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr, 7872 addr_type); 7873 if (!params) { 7874 err = mgmt_cmd_complete(sk, hdev->id, 7875 MGMT_OP_REMOVE_DEVICE, 7876 MGMT_STATUS_INVALID_PARAMS, 7877 &cp->addr, sizeof(cp->addr)); 7878 goto unlock; 7879 } 7880 7881 if (params->auto_connect == HCI_AUTO_CONN_DISABLED || 7882 params->auto_connect == HCI_AUTO_CONN_EXPLICIT) { 7883 err = mgmt_cmd_complete(sk, hdev->id, 7884 MGMT_OP_REMOVE_DEVICE, 7885 MGMT_STATUS_INVALID_PARAMS, 7886 &cp->addr, sizeof(cp->addr)); 7887 goto unlock; 7888 } 7889 7890 hci_conn_params_free(params); 7891 7892 device_removed(sk, hdev, &cp->addr.bdaddr, cp->addr.type); 7893 } else { 7894 struct hci_conn_params *p, *tmp; 7895 struct bdaddr_list *b, *btmp; 7896 7897 if (cp->addr.type) { 7898 err = mgmt_cmd_complete(sk, hdev->id, 7899 MGMT_OP_REMOVE_DEVICE, 7900 MGMT_STATUS_INVALID_PARAMS, 7901 &cp->addr, sizeof(cp->addr)); 7902 goto unlock; 7903 } 7904 7905 list_for_each_entry_safe(b, btmp, &hdev->accept_list, list) { 7906 device_removed(sk, hdev, &b->bdaddr, b->bdaddr_type); 7907 list_del(&b->list); 7908 kfree(b); 7909 } 7910 7911 hci_update_scan(hdev); 7912 7913 list_for_each_entry_safe(p, tmp, &hdev->le_conn_params, list) { 7914 if (p->auto_connect == HCI_AUTO_CONN_DISABLED) 7915 continue; 7916 device_removed(sk, hdev, &p->addr, p->addr_type); 7917 if (p->explicit_connect) { 7918 p->auto_connect = HCI_AUTO_CONN_EXPLICIT; 7919 continue; 7920 } 7921 hci_conn_params_free(p); 7922 } 7923 7924 bt_dev_dbg(hdev, "All LE connection parameters were removed"); 7925 } 7926 7927 hci_cmd_sync_queue(hdev, remove_device_sync, NULL, NULL); 7928 7929 complete: 7930 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_DEVICE, 7931 MGMT_STATUS_SUCCESS, &cp->addr, 7932 sizeof(cp->addr)); 7933 unlock: 7934 hci_dev_unlock(hdev); 7935 return err; 7936 } 7937 7938 static int conn_update_sync(struct hci_dev *hdev, void *data) 7939 { 7940 struct hci_conn_params *params = data; 7941 struct hci_conn *conn; 7942 7943 conn = hci_conn_hash_lookup_le(hdev, ¶ms->addr, params->addr_type); 7944 if (!conn) 7945 return -ECANCELED; 7946 7947 return hci_le_conn_update_sync(hdev, conn, params); 7948 } 7949 7950 static int load_conn_param(struct sock *sk, struct hci_dev *hdev, void *data, 7951 u16 len) 7952 { 7953 struct mgmt_cp_load_conn_param *cp = data; 7954 const u16 max_param_count = ((U16_MAX - sizeof(*cp)) / 7955 sizeof(struct mgmt_conn_param)); 7956 u16 param_count, expected_len; 7957 int i; 7958 7959 if (!lmp_le_capable(hdev)) 7960 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM, 7961 MGMT_STATUS_NOT_SUPPORTED); 7962 7963 param_count = __le16_to_cpu(cp->param_count); 7964 if (param_count > max_param_count) { 7965 bt_dev_err(hdev, "load_conn_param: too big param_count value %u", 7966 param_count); 7967 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM, 7968 MGMT_STATUS_INVALID_PARAMS); 7969 } 7970 7971 expected_len = struct_size(cp, params, param_count); 7972 if (expected_len != len) { 7973 bt_dev_err(hdev, "load_conn_param: expected %u bytes, got %u bytes", 7974 expected_len, len); 7975 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM, 7976 MGMT_STATUS_INVALID_PARAMS); 7977 } 7978 7979 bt_dev_dbg(hdev, "param_count %u", param_count); 7980 7981 hci_dev_lock(hdev); 7982 7983 if (param_count > 1) 7984 hci_conn_params_clear_disabled(hdev); 7985 7986 for (i = 0; i < param_count; i++) { 7987 struct mgmt_conn_param *param = &cp->params[i]; 7988 struct hci_conn_params *hci_param; 7989 u16 min, max, latency, timeout; 7990 bool update = false; 7991 u8 addr_type; 7992 7993 bt_dev_dbg(hdev, "Adding %pMR (type %u)", ¶m->addr.bdaddr, 7994 param->addr.type); 7995 7996 if (param->addr.type == BDADDR_LE_PUBLIC) { 7997 addr_type = ADDR_LE_DEV_PUBLIC; 7998 } else if (param->addr.type == BDADDR_LE_RANDOM) { 7999 addr_type = ADDR_LE_DEV_RANDOM; 8000 } else { 8001 bt_dev_err(hdev, "ignoring invalid connection parameters"); 8002 continue; 8003 } 8004 8005 min = le16_to_cpu(param->min_interval); 8006 max = le16_to_cpu(param->max_interval); 8007 latency = le16_to_cpu(param->latency); 8008 timeout = le16_to_cpu(param->timeout); 8009 8010 bt_dev_dbg(hdev, "min 0x%04x max 0x%04x latency 0x%04x timeout 0x%04x", 8011 min, max, latency, timeout); 8012 8013 if (hci_check_conn_params(min, max, latency, timeout) < 0) { 8014 bt_dev_err(hdev, "ignoring invalid connection parameters"); 8015 continue; 8016 } 8017 8018 /* Detect when the loading is for an existing parameter then 8019 * attempt to trigger the connection update procedure. 8020 */ 8021 if (!i && param_count == 1) { 8022 hci_param = hci_conn_params_lookup(hdev, 8023 ¶m->addr.bdaddr, 8024 addr_type); 8025 if (hci_param) 8026 update = true; 8027 else 8028 hci_conn_params_clear_disabled(hdev); 8029 } 8030 8031 hci_param = hci_conn_params_add(hdev, ¶m->addr.bdaddr, 8032 addr_type); 8033 if (!hci_param) { 8034 bt_dev_err(hdev, "failed to add connection parameters"); 8035 continue; 8036 } 8037 8038 hci_param->conn_min_interval = min; 8039 hci_param->conn_max_interval = max; 8040 hci_param->conn_latency = latency; 8041 hci_param->supervision_timeout = timeout; 8042 8043 /* Check if we need to trigger a connection update */ 8044 if (update) { 8045 struct hci_conn *conn; 8046 8047 /* Lookup for existing connection as central and check 8048 * if parameters match and if they don't then trigger 8049 * a connection update. 8050 */ 8051 conn = hci_conn_hash_lookup_le(hdev, &hci_param->addr, 8052 addr_type); 8053 if (conn && conn->role == HCI_ROLE_MASTER && 8054 (conn->le_conn_min_interval != min || 8055 conn->le_conn_max_interval != max || 8056 conn->le_conn_latency != latency || 8057 conn->le_supv_timeout != timeout)) 8058 hci_cmd_sync_queue(hdev, conn_update_sync, 8059 hci_param, NULL); 8060 } 8061 } 8062 8063 hci_dev_unlock(hdev); 8064 8065 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM, 0, 8066 NULL, 0); 8067 } 8068 8069 static int set_external_config(struct sock *sk, struct hci_dev *hdev, 8070 void *data, u16 len) 8071 { 8072 struct mgmt_cp_set_external_config *cp = data; 8073 bool changed; 8074 int err; 8075 8076 bt_dev_dbg(hdev, "sock %p", sk); 8077 8078 if (hdev_is_powered(hdev)) 8079 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_EXTERNAL_CONFIG, 8080 MGMT_STATUS_REJECTED); 8081 8082 if (cp->config != 0x00 && cp->config != 0x01) 8083 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_EXTERNAL_CONFIG, 8084 MGMT_STATUS_INVALID_PARAMS); 8085 8086 if (!hci_test_quirk(hdev, HCI_QUIRK_EXTERNAL_CONFIG)) 8087 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_EXTERNAL_CONFIG, 8088 MGMT_STATUS_NOT_SUPPORTED); 8089 8090 hci_dev_lock(hdev); 8091 8092 if (cp->config) 8093 changed = !hci_dev_test_and_set_flag(hdev, HCI_EXT_CONFIGURED); 8094 else 8095 changed = hci_dev_test_and_clear_flag(hdev, HCI_EXT_CONFIGURED); 8096 8097 err = send_options_rsp(sk, MGMT_OP_SET_EXTERNAL_CONFIG, hdev); 8098 if (err < 0) 8099 goto unlock; 8100 8101 if (!changed) 8102 goto unlock; 8103 8104 err = new_options(hdev, sk); 8105 8106 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED) == is_configured(hdev)) { 8107 mgmt_index_removed(hdev); 8108 8109 if (hci_dev_test_and_change_flag(hdev, HCI_UNCONFIGURED)) { 8110 hci_dev_set_flag(hdev, HCI_CONFIG); 8111 hci_dev_set_flag(hdev, HCI_AUTO_OFF); 8112 8113 queue_work(hdev->req_workqueue, &hdev->power_on); 8114 } else { 8115 set_bit(HCI_RAW, &hdev->flags); 8116 mgmt_index_added(hdev); 8117 } 8118 } 8119 8120 unlock: 8121 hci_dev_unlock(hdev); 8122 return err; 8123 } 8124 8125 static int set_public_address(struct sock *sk, struct hci_dev *hdev, 8126 void *data, u16 len) 8127 { 8128 struct mgmt_cp_set_public_address *cp = data; 8129 bool changed; 8130 int err; 8131 8132 bt_dev_dbg(hdev, "sock %p", sk); 8133 8134 if (hdev_is_powered(hdev)) 8135 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PUBLIC_ADDRESS, 8136 MGMT_STATUS_REJECTED); 8137 8138 if (!bacmp(&cp->bdaddr, BDADDR_ANY)) 8139 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PUBLIC_ADDRESS, 8140 MGMT_STATUS_INVALID_PARAMS); 8141 8142 if (!hdev->set_bdaddr) 8143 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PUBLIC_ADDRESS, 8144 MGMT_STATUS_NOT_SUPPORTED); 8145 8146 hci_dev_lock(hdev); 8147 8148 changed = !!bacmp(&hdev->public_addr, &cp->bdaddr); 8149 bacpy(&hdev->public_addr, &cp->bdaddr); 8150 8151 err = send_options_rsp(sk, MGMT_OP_SET_PUBLIC_ADDRESS, hdev); 8152 if (err < 0) 8153 goto unlock; 8154 8155 if (!changed) 8156 goto unlock; 8157 8158 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) 8159 err = new_options(hdev, sk); 8160 8161 if (is_configured(hdev)) { 8162 mgmt_index_removed(hdev); 8163 8164 hci_dev_clear_flag(hdev, HCI_UNCONFIGURED); 8165 8166 hci_dev_set_flag(hdev, HCI_CONFIG); 8167 hci_dev_set_flag(hdev, HCI_AUTO_OFF); 8168 8169 queue_work(hdev->req_workqueue, &hdev->power_on); 8170 } 8171 8172 unlock: 8173 hci_dev_unlock(hdev); 8174 return err; 8175 } 8176 8177 static void read_local_oob_ext_data_complete(struct hci_dev *hdev, void *data, 8178 int err) 8179 { 8180 const struct mgmt_cp_read_local_oob_ext_data *mgmt_cp; 8181 struct mgmt_rp_read_local_oob_ext_data *mgmt_rp; 8182 u8 *h192, *r192, *h256, *r256; 8183 struct mgmt_pending_cmd *cmd = data; 8184 struct sk_buff *skb = cmd->skb; 8185 u8 status = mgmt_status(err); 8186 u16 eir_len; 8187 8188 if (!status) { 8189 if (!skb) 8190 status = MGMT_STATUS_FAILED; 8191 else if (IS_ERR(skb)) 8192 status = mgmt_status(PTR_ERR(skb)); 8193 else 8194 status = mgmt_status(skb->data[0]); 8195 } 8196 8197 bt_dev_dbg(hdev, "status %u", status); 8198 8199 mgmt_cp = cmd->param; 8200 8201 if (status) { 8202 status = mgmt_status(status); 8203 eir_len = 0; 8204 8205 h192 = NULL; 8206 r192 = NULL; 8207 h256 = NULL; 8208 r256 = NULL; 8209 } else if (!bredr_sc_enabled(hdev)) { 8210 struct hci_rp_read_local_oob_data *rp; 8211 8212 if (skb->len != sizeof(*rp)) { 8213 status = MGMT_STATUS_FAILED; 8214 eir_len = 0; 8215 } else { 8216 status = MGMT_STATUS_SUCCESS; 8217 rp = (void *)skb->data; 8218 8219 eir_len = 5 + 18 + 18; 8220 h192 = rp->hash; 8221 r192 = rp->rand; 8222 h256 = NULL; 8223 r256 = NULL; 8224 } 8225 } else { 8226 struct hci_rp_read_local_oob_ext_data *rp; 8227 8228 if (skb->len != sizeof(*rp)) { 8229 status = MGMT_STATUS_FAILED; 8230 eir_len = 0; 8231 } else { 8232 status = MGMT_STATUS_SUCCESS; 8233 rp = (void *)skb->data; 8234 8235 if (hci_dev_test_flag(hdev, HCI_SC_ONLY)) { 8236 eir_len = 5 + 18 + 18; 8237 h192 = NULL; 8238 r192 = NULL; 8239 } else { 8240 eir_len = 5 + 18 + 18 + 18 + 18; 8241 h192 = rp->hash192; 8242 r192 = rp->rand192; 8243 } 8244 8245 h256 = rp->hash256; 8246 r256 = rp->rand256; 8247 } 8248 } 8249 8250 mgmt_rp = kmalloc(sizeof(*mgmt_rp) + eir_len, GFP_KERNEL); 8251 if (!mgmt_rp) 8252 goto done; 8253 8254 if (eir_len == 0) 8255 goto send_rsp; 8256 8257 eir_len = eir_append_data(mgmt_rp->eir, 0, EIR_CLASS_OF_DEV, 8258 hdev->dev_class, 3); 8259 8260 if (h192 && r192) { 8261 eir_len = eir_append_data(mgmt_rp->eir, eir_len, 8262 EIR_SSP_HASH_C192, h192, 16); 8263 eir_len = eir_append_data(mgmt_rp->eir, eir_len, 8264 EIR_SSP_RAND_R192, r192, 16); 8265 } 8266 8267 if (h256 && r256) { 8268 eir_len = eir_append_data(mgmt_rp->eir, eir_len, 8269 EIR_SSP_HASH_C256, h256, 16); 8270 eir_len = eir_append_data(mgmt_rp->eir, eir_len, 8271 EIR_SSP_RAND_R256, r256, 16); 8272 } 8273 8274 send_rsp: 8275 mgmt_rp->type = mgmt_cp->type; 8276 mgmt_rp->eir_len = cpu_to_le16(eir_len); 8277 8278 err = mgmt_cmd_complete(cmd->sk, hdev->id, 8279 MGMT_OP_READ_LOCAL_OOB_EXT_DATA, status, 8280 mgmt_rp, sizeof(*mgmt_rp) + eir_len); 8281 if (err < 0 || status) 8282 goto done; 8283 8284 hci_sock_set_flag(cmd->sk, HCI_MGMT_OOB_DATA_EVENTS); 8285 8286 err = mgmt_limited_event(MGMT_EV_LOCAL_OOB_DATA_UPDATED, hdev, 8287 mgmt_rp, sizeof(*mgmt_rp) + eir_len, 8288 HCI_MGMT_OOB_DATA_EVENTS, cmd->sk); 8289 done: 8290 if (skb && !IS_ERR(skb)) 8291 kfree_skb(skb); 8292 8293 kfree(mgmt_rp); 8294 mgmt_pending_free(cmd); 8295 } 8296 8297 static int read_local_ssp_oob_req(struct hci_dev *hdev, struct sock *sk, 8298 struct mgmt_cp_read_local_oob_ext_data *cp) 8299 { 8300 struct mgmt_pending_cmd *cmd; 8301 int err; 8302 8303 cmd = mgmt_pending_new(sk, MGMT_OP_READ_LOCAL_OOB_EXT_DATA, hdev, 8304 cp, sizeof(*cp)); 8305 if (!cmd) 8306 return -ENOMEM; 8307 8308 err = hci_cmd_sync_queue(hdev, read_local_oob_data_sync, cmd, 8309 read_local_oob_ext_data_complete); 8310 8311 if (err < 0) { 8312 mgmt_pending_remove(cmd); 8313 return err; 8314 } 8315 8316 return 0; 8317 } 8318 8319 static int read_local_oob_ext_data(struct sock *sk, struct hci_dev *hdev, 8320 void *data, u16 data_len) 8321 { 8322 struct mgmt_cp_read_local_oob_ext_data *cp = data; 8323 struct mgmt_rp_read_local_oob_ext_data *rp; 8324 size_t rp_len; 8325 u16 eir_len; 8326 u8 status, flags, role, addr[7], hash[16], rand[16]; 8327 int err; 8328 8329 bt_dev_dbg(hdev, "sock %p", sk); 8330 8331 if (hdev_is_powered(hdev)) { 8332 switch (cp->type) { 8333 case BIT(BDADDR_BREDR): 8334 status = mgmt_bredr_support(hdev); 8335 if (status) 8336 eir_len = 0; 8337 else 8338 eir_len = 5; 8339 break; 8340 case (BIT(BDADDR_LE_PUBLIC) | BIT(BDADDR_LE_RANDOM)): 8341 status = mgmt_le_support(hdev); 8342 if (status) 8343 eir_len = 0; 8344 else 8345 eir_len = 9 + 3 + 18 + 18 + 3; 8346 break; 8347 default: 8348 status = MGMT_STATUS_INVALID_PARAMS; 8349 eir_len = 0; 8350 break; 8351 } 8352 } else { 8353 status = MGMT_STATUS_NOT_POWERED; 8354 eir_len = 0; 8355 } 8356 8357 rp_len = sizeof(*rp) + eir_len; 8358 rp = kmalloc(rp_len, GFP_ATOMIC); 8359 if (!rp) 8360 return -ENOMEM; 8361 8362 if (!status && !lmp_ssp_capable(hdev)) { 8363 status = MGMT_STATUS_NOT_SUPPORTED; 8364 eir_len = 0; 8365 } 8366 8367 if (status) 8368 goto complete; 8369 8370 hci_dev_lock(hdev); 8371 8372 eir_len = 0; 8373 switch (cp->type) { 8374 case BIT(BDADDR_BREDR): 8375 if (hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) { 8376 err = read_local_ssp_oob_req(hdev, sk, cp); 8377 hci_dev_unlock(hdev); 8378 if (!err) 8379 goto done; 8380 8381 status = MGMT_STATUS_FAILED; 8382 goto complete; 8383 } else { 8384 eir_len = eir_append_data(rp->eir, eir_len, 8385 EIR_CLASS_OF_DEV, 8386 hdev->dev_class, 3); 8387 } 8388 break; 8389 case (BIT(BDADDR_LE_PUBLIC) | BIT(BDADDR_LE_RANDOM)): 8390 if (hci_dev_test_flag(hdev, HCI_SC_ENABLED) && 8391 smp_generate_oob(hdev, hash, rand) < 0) { 8392 hci_dev_unlock(hdev); 8393 status = MGMT_STATUS_FAILED; 8394 goto complete; 8395 } 8396 8397 /* This should return the active RPA, but since the RPA 8398 * is only programmed on demand, it is really hard to fill 8399 * this in at the moment. For now disallow retrieving 8400 * local out-of-band data when privacy is in use. 8401 * 8402 * Returning the identity address will not help here since 8403 * pairing happens before the identity resolving key is 8404 * known and thus the connection establishment happens 8405 * based on the RPA and not the identity address. 8406 */ 8407 if (hci_dev_test_flag(hdev, HCI_PRIVACY)) { 8408 hci_dev_unlock(hdev); 8409 status = MGMT_STATUS_REJECTED; 8410 goto complete; 8411 } 8412 8413 if (hci_dev_test_flag(hdev, HCI_FORCE_STATIC_ADDR) || 8414 !bacmp(&hdev->bdaddr, BDADDR_ANY) || 8415 (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) && 8416 bacmp(&hdev->static_addr, BDADDR_ANY))) { 8417 memcpy(addr, &hdev->static_addr, 6); 8418 addr[6] = 0x01; 8419 } else { 8420 memcpy(addr, &hdev->bdaddr, 6); 8421 addr[6] = 0x00; 8422 } 8423 8424 eir_len = eir_append_data(rp->eir, eir_len, EIR_LE_BDADDR, 8425 addr, sizeof(addr)); 8426 8427 if (hci_dev_test_flag(hdev, HCI_ADVERTISING)) 8428 role = 0x02; 8429 else 8430 role = 0x01; 8431 8432 eir_len = eir_append_data(rp->eir, eir_len, EIR_LE_ROLE, 8433 &role, sizeof(role)); 8434 8435 if (hci_dev_test_flag(hdev, HCI_SC_ENABLED)) { 8436 eir_len = eir_append_data(rp->eir, eir_len, 8437 EIR_LE_SC_CONFIRM, 8438 hash, sizeof(hash)); 8439 8440 eir_len = eir_append_data(rp->eir, eir_len, 8441 EIR_LE_SC_RANDOM, 8442 rand, sizeof(rand)); 8443 } 8444 8445 flags = mgmt_get_adv_discov_flags(hdev); 8446 8447 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) 8448 flags |= LE_AD_NO_BREDR; 8449 8450 eir_len = eir_append_data(rp->eir, eir_len, EIR_FLAGS, 8451 &flags, sizeof(flags)); 8452 break; 8453 } 8454 8455 hci_dev_unlock(hdev); 8456 8457 hci_sock_set_flag(sk, HCI_MGMT_OOB_DATA_EVENTS); 8458 8459 status = MGMT_STATUS_SUCCESS; 8460 8461 complete: 8462 rp->type = cp->type; 8463 rp->eir_len = cpu_to_le16(eir_len); 8464 8465 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_EXT_DATA, 8466 status, rp, sizeof(*rp) + eir_len); 8467 if (err < 0 || status) 8468 goto done; 8469 8470 err = mgmt_limited_event(MGMT_EV_LOCAL_OOB_DATA_UPDATED, hdev, 8471 rp, sizeof(*rp) + eir_len, 8472 HCI_MGMT_OOB_DATA_EVENTS, sk); 8473 8474 done: 8475 kfree(rp); 8476 8477 return err; 8478 } 8479 8480 static u32 get_supported_adv_flags(struct hci_dev *hdev) 8481 { 8482 u32 flags = 0; 8483 8484 flags |= MGMT_ADV_FLAG_CONNECTABLE; 8485 flags |= MGMT_ADV_FLAG_DISCOV; 8486 flags |= MGMT_ADV_FLAG_LIMITED_DISCOV; 8487 flags |= MGMT_ADV_FLAG_MANAGED_FLAGS; 8488 flags |= MGMT_ADV_FLAG_APPEARANCE; 8489 flags |= MGMT_ADV_FLAG_LOCAL_NAME; 8490 flags |= MGMT_ADV_PARAM_DURATION; 8491 flags |= MGMT_ADV_PARAM_TIMEOUT; 8492 flags |= MGMT_ADV_PARAM_INTERVALS; 8493 flags |= MGMT_ADV_PARAM_TX_POWER; 8494 flags |= MGMT_ADV_PARAM_SCAN_RSP; 8495 8496 /* In extended adv TX_POWER returned from Set Adv Param 8497 * will be always valid. 8498 */ 8499 if (hdev->adv_tx_power != HCI_TX_POWER_INVALID || ext_adv_capable(hdev)) 8500 flags |= MGMT_ADV_FLAG_TX_POWER; 8501 8502 if (ext_adv_capable(hdev)) { 8503 flags |= MGMT_ADV_FLAG_SEC_1M; 8504 flags |= MGMT_ADV_FLAG_HW_OFFLOAD; 8505 flags |= MGMT_ADV_FLAG_CAN_SET_TX_POWER; 8506 8507 if (le_2m_capable(hdev)) 8508 flags |= MGMT_ADV_FLAG_SEC_2M; 8509 8510 if (le_coded_capable(hdev)) 8511 flags |= MGMT_ADV_FLAG_SEC_CODED; 8512 } 8513 8514 return flags; 8515 } 8516 8517 static int read_adv_features(struct sock *sk, struct hci_dev *hdev, 8518 void *data, u16 data_len) 8519 { 8520 struct mgmt_rp_read_adv_features *rp; 8521 size_t rp_len; 8522 int err; 8523 struct adv_info *adv_instance; 8524 u32 supported_flags; 8525 u8 *instance; 8526 8527 bt_dev_dbg(hdev, "sock %p", sk); 8528 8529 if (!lmp_le_capable(hdev)) 8530 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_ADV_FEATURES, 8531 MGMT_STATUS_REJECTED); 8532 8533 hci_dev_lock(hdev); 8534 8535 rp_len = sizeof(*rp) + hdev->adv_instance_cnt; 8536 rp = kmalloc(rp_len, GFP_ATOMIC); 8537 if (!rp) { 8538 hci_dev_unlock(hdev); 8539 return -ENOMEM; 8540 } 8541 8542 supported_flags = get_supported_adv_flags(hdev); 8543 8544 rp->supported_flags = cpu_to_le32(supported_flags); 8545 rp->max_adv_data_len = max_adv_len(hdev); 8546 rp->max_scan_rsp_len = max_adv_len(hdev); 8547 rp->max_instances = hdev->le_num_of_adv_sets; 8548 rp->num_instances = hdev->adv_instance_cnt; 8549 8550 instance = rp->instance; 8551 list_for_each_entry(adv_instance, &hdev->adv_instances, list) { 8552 /* Only instances 1-le_num_of_adv_sets are externally visible */ 8553 if (adv_instance->instance <= hdev->adv_instance_cnt) { 8554 *instance = adv_instance->instance; 8555 instance++; 8556 } else { 8557 rp->num_instances--; 8558 rp_len--; 8559 } 8560 } 8561 8562 hci_dev_unlock(hdev); 8563 8564 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_ADV_FEATURES, 8565 MGMT_STATUS_SUCCESS, rp, rp_len); 8566 8567 kfree(rp); 8568 8569 return err; 8570 } 8571 8572 static u8 calculate_name_len(struct hci_dev *hdev) 8573 { 8574 u8 buf[HCI_MAX_SHORT_NAME_LENGTH + 2]; /* len + type + name */ 8575 8576 return eir_append_local_name(hdev, buf, 0); 8577 } 8578 8579 static u8 tlv_data_max_len(struct hci_dev *hdev, u32 adv_flags, 8580 bool is_adv_data) 8581 { 8582 u8 max_len = max_adv_len(hdev); 8583 8584 if (is_adv_data) { 8585 if (adv_flags & (MGMT_ADV_FLAG_DISCOV | 8586 MGMT_ADV_FLAG_LIMITED_DISCOV | 8587 MGMT_ADV_FLAG_MANAGED_FLAGS)) 8588 max_len -= 3; 8589 8590 if (adv_flags & MGMT_ADV_FLAG_TX_POWER) 8591 max_len -= 3; 8592 } else { 8593 if (adv_flags & MGMT_ADV_FLAG_LOCAL_NAME) 8594 max_len -= calculate_name_len(hdev); 8595 8596 if (adv_flags & (MGMT_ADV_FLAG_APPEARANCE)) 8597 max_len -= 4; 8598 } 8599 8600 return max_len; 8601 } 8602 8603 static bool flags_managed(u32 adv_flags) 8604 { 8605 return adv_flags & (MGMT_ADV_FLAG_DISCOV | 8606 MGMT_ADV_FLAG_LIMITED_DISCOV | 8607 MGMT_ADV_FLAG_MANAGED_FLAGS); 8608 } 8609 8610 static bool tx_power_managed(u32 adv_flags) 8611 { 8612 return adv_flags & MGMT_ADV_FLAG_TX_POWER; 8613 } 8614 8615 static bool name_managed(u32 adv_flags) 8616 { 8617 return adv_flags & MGMT_ADV_FLAG_LOCAL_NAME; 8618 } 8619 8620 static bool appearance_managed(u32 adv_flags) 8621 { 8622 return adv_flags & MGMT_ADV_FLAG_APPEARANCE; 8623 } 8624 8625 static bool tlv_data_is_valid(struct hci_dev *hdev, u32 adv_flags, u8 *data, 8626 u8 len, bool is_adv_data) 8627 { 8628 int i, cur_len; 8629 u8 max_len; 8630 8631 max_len = tlv_data_max_len(hdev, adv_flags, is_adv_data); 8632 8633 if (len > max_len) 8634 return false; 8635 8636 /* Make sure that the data is correctly formatted. */ 8637 for (i = 0; i < len; i += (cur_len + 1)) { 8638 cur_len = data[i]; 8639 8640 if (!cur_len) 8641 continue; 8642 8643 /* If the current field length would exceed the total data 8644 * length, then it's invalid. 8645 */ 8646 if (i + cur_len >= len) 8647 return false; 8648 8649 if (data[i + 1] == EIR_FLAGS && 8650 (!is_adv_data || flags_managed(adv_flags))) 8651 return false; 8652 8653 if (data[i + 1] == EIR_TX_POWER && tx_power_managed(adv_flags)) 8654 return false; 8655 8656 if (data[i + 1] == EIR_NAME_COMPLETE && name_managed(adv_flags)) 8657 return false; 8658 8659 if (data[i + 1] == EIR_NAME_SHORT && name_managed(adv_flags)) 8660 return false; 8661 8662 if (data[i + 1] == EIR_APPEARANCE && 8663 appearance_managed(adv_flags)) 8664 return false; 8665 } 8666 8667 return true; 8668 } 8669 8670 static bool requested_adv_flags_are_valid(struct hci_dev *hdev, u32 adv_flags) 8671 { 8672 u32 supported_flags, phy_flags; 8673 8674 /* The current implementation only supports a subset of the specified 8675 * flags. Also need to check mutual exclusiveness of sec flags. 8676 */ 8677 supported_flags = get_supported_adv_flags(hdev); 8678 phy_flags = adv_flags & MGMT_ADV_FLAG_SEC_MASK; 8679 if (adv_flags & ~supported_flags || 8680 ((phy_flags && (phy_flags ^ (phy_flags & -phy_flags))))) 8681 return false; 8682 8683 return true; 8684 } 8685 8686 static bool adv_busy(struct hci_dev *hdev) 8687 { 8688 return pending_find(MGMT_OP_SET_LE, hdev); 8689 } 8690 8691 static void add_adv_complete(struct hci_dev *hdev, struct sock *sk, u8 instance, 8692 int err) 8693 { 8694 struct adv_info *adv, *n; 8695 8696 bt_dev_dbg(hdev, "err %d", err); 8697 8698 hci_dev_lock(hdev); 8699 8700 list_for_each_entry_safe(adv, n, &hdev->adv_instances, list) { 8701 u8 instance; 8702 8703 if (!adv->pending) 8704 continue; 8705 8706 if (!err) { 8707 adv->pending = false; 8708 continue; 8709 } 8710 8711 instance = adv->instance; 8712 8713 if (hdev->cur_adv_instance == instance) 8714 cancel_adv_timeout(hdev); 8715 8716 hci_remove_adv_instance(hdev, instance); 8717 mgmt_advertising_removed(sk, hdev, instance); 8718 } 8719 8720 hci_dev_unlock(hdev); 8721 } 8722 8723 static void add_advertising_complete(struct hci_dev *hdev, void *data, int err) 8724 { 8725 struct mgmt_pending_cmd *cmd = data; 8726 struct mgmt_cp_add_advertising *cp = cmd->param; 8727 struct mgmt_rp_add_advertising rp; 8728 8729 memset(&rp, 0, sizeof(rp)); 8730 8731 rp.instance = cp->instance; 8732 8733 if (err) 8734 mgmt_cmd_status(cmd->sk, cmd->hdev->id, cmd->opcode, 8735 mgmt_status(err)); 8736 else 8737 mgmt_cmd_complete(cmd->sk, cmd->hdev->id, cmd->opcode, 8738 mgmt_status(err), &rp, sizeof(rp)); 8739 8740 add_adv_complete(hdev, cmd->sk, cp->instance, err); 8741 8742 mgmt_pending_free(cmd); 8743 } 8744 8745 static int add_advertising_sync(struct hci_dev *hdev, void *data) 8746 { 8747 struct mgmt_pending_cmd *cmd = data; 8748 struct mgmt_cp_add_advertising *cp = cmd->param; 8749 8750 return hci_schedule_adv_instance_sync(hdev, cp->instance, true); 8751 } 8752 8753 static int add_advertising(struct sock *sk, struct hci_dev *hdev, 8754 void *data, u16 data_len) 8755 { 8756 struct mgmt_cp_add_advertising *cp = data; 8757 struct mgmt_rp_add_advertising rp; 8758 u32 flags; 8759 u8 status; 8760 u16 timeout, duration; 8761 unsigned int prev_instance_cnt; 8762 u8 schedule_instance = 0; 8763 struct adv_info *adv, *next_instance; 8764 int err; 8765 struct mgmt_pending_cmd *cmd; 8766 8767 bt_dev_dbg(hdev, "sock %p", sk); 8768 8769 status = mgmt_le_support(hdev); 8770 if (status) 8771 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING, 8772 status); 8773 8774 if (cp->instance < 1 || cp->instance > hdev->le_num_of_adv_sets) 8775 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING, 8776 MGMT_STATUS_INVALID_PARAMS); 8777 8778 if (data_len != sizeof(*cp) + cp->adv_data_len + cp->scan_rsp_len) 8779 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING, 8780 MGMT_STATUS_INVALID_PARAMS); 8781 8782 flags = __le32_to_cpu(cp->flags); 8783 timeout = __le16_to_cpu(cp->timeout); 8784 duration = __le16_to_cpu(cp->duration); 8785 8786 if (!requested_adv_flags_are_valid(hdev, flags)) 8787 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING, 8788 MGMT_STATUS_INVALID_PARAMS); 8789 8790 hci_dev_lock(hdev); 8791 8792 if (timeout && !hdev_is_powered(hdev)) { 8793 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING, 8794 MGMT_STATUS_REJECTED); 8795 goto unlock; 8796 } 8797 8798 if (adv_busy(hdev)) { 8799 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING, 8800 MGMT_STATUS_BUSY); 8801 goto unlock; 8802 } 8803 8804 if (!tlv_data_is_valid(hdev, flags, cp->data, cp->adv_data_len, true) || 8805 !tlv_data_is_valid(hdev, flags, cp->data + cp->adv_data_len, 8806 cp->scan_rsp_len, false)) { 8807 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING, 8808 MGMT_STATUS_INVALID_PARAMS); 8809 goto unlock; 8810 } 8811 8812 prev_instance_cnt = hdev->adv_instance_cnt; 8813 8814 adv = hci_add_adv_instance(hdev, cp->instance, flags, 8815 cp->adv_data_len, cp->data, 8816 cp->scan_rsp_len, 8817 cp->data + cp->adv_data_len, 8818 timeout, duration, 8819 HCI_ADV_TX_POWER_NO_PREFERENCE, 8820 hdev->le_adv_min_interval, 8821 hdev->le_adv_max_interval, 0); 8822 if (IS_ERR(adv)) { 8823 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING, 8824 MGMT_STATUS_FAILED); 8825 goto unlock; 8826 } 8827 8828 /* Only trigger an advertising added event if a new instance was 8829 * actually added. 8830 */ 8831 if (hdev->adv_instance_cnt > prev_instance_cnt) 8832 mgmt_advertising_added(sk, hdev, cp->instance); 8833 8834 if (hdev->cur_adv_instance == cp->instance) { 8835 /* If the currently advertised instance is being changed then 8836 * cancel the current advertising and schedule the next 8837 * instance. If there is only one instance then the overridden 8838 * advertising data will be visible right away. 8839 */ 8840 cancel_adv_timeout(hdev); 8841 8842 next_instance = hci_get_next_instance(hdev, cp->instance); 8843 if (next_instance) 8844 schedule_instance = next_instance->instance; 8845 } else if (!hdev->adv_instance_timeout) { 8846 /* Immediately advertise the new instance if no other 8847 * instance is currently being advertised. 8848 */ 8849 schedule_instance = cp->instance; 8850 } 8851 8852 /* If the HCI_ADVERTISING flag is set or the device isn't powered or 8853 * there is no instance to be advertised then we have no HCI 8854 * communication to make. Simply return. 8855 */ 8856 if (!hdev_is_powered(hdev) || 8857 hci_dev_test_flag(hdev, HCI_ADVERTISING) || 8858 !schedule_instance) { 8859 rp.instance = cp->instance; 8860 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_ADVERTISING, 8861 MGMT_STATUS_SUCCESS, &rp, sizeof(rp)); 8862 goto unlock; 8863 } 8864 8865 /* We're good to go, update advertising data, parameters, and start 8866 * advertising. 8867 */ 8868 cmd = mgmt_pending_new(sk, MGMT_OP_ADD_ADVERTISING, hdev, data, 8869 data_len); 8870 if (!cmd) { 8871 err = -ENOMEM; 8872 goto unlock; 8873 } 8874 8875 cp->instance = schedule_instance; 8876 8877 err = hci_cmd_sync_queue(hdev, add_advertising_sync, cmd, 8878 add_advertising_complete); 8879 if (err < 0) 8880 mgmt_pending_free(cmd); 8881 8882 unlock: 8883 hci_dev_unlock(hdev); 8884 8885 return err; 8886 } 8887 8888 static void add_ext_adv_params_complete(struct hci_dev *hdev, void *data, 8889 int err) 8890 { 8891 struct mgmt_pending_cmd *cmd = data; 8892 struct mgmt_cp_add_ext_adv_params *cp = cmd->param; 8893 struct mgmt_rp_add_ext_adv_params rp; 8894 struct adv_info *adv; 8895 u32 flags; 8896 8897 BT_DBG("%s", hdev->name); 8898 8899 hci_dev_lock(hdev); 8900 8901 adv = hci_find_adv_instance(hdev, cp->instance); 8902 if (!adv) 8903 goto unlock; 8904 8905 rp.instance = cp->instance; 8906 rp.tx_power = adv->tx_power; 8907 8908 /* While we're at it, inform userspace of the available space for this 8909 * advertisement, given the flags that will be used. 8910 */ 8911 flags = __le32_to_cpu(cp->flags); 8912 rp.max_adv_data_len = tlv_data_max_len(hdev, flags, true); 8913 rp.max_scan_rsp_len = tlv_data_max_len(hdev, flags, false); 8914 8915 if (err) { 8916 /* If this advertisement was previously advertising and we 8917 * failed to update it, we signal that it has been removed and 8918 * delete its structure 8919 */ 8920 if (!adv->pending) 8921 mgmt_advertising_removed(cmd->sk, hdev, cp->instance); 8922 8923 hci_remove_adv_instance(hdev, cp->instance); 8924 8925 mgmt_cmd_status(cmd->sk, cmd->hdev->id, cmd->opcode, 8926 mgmt_status(err)); 8927 } else { 8928 mgmt_cmd_complete(cmd->sk, cmd->hdev->id, cmd->opcode, 8929 mgmt_status(err), &rp, sizeof(rp)); 8930 } 8931 8932 unlock: 8933 mgmt_pending_free(cmd); 8934 8935 hci_dev_unlock(hdev); 8936 } 8937 8938 static int add_ext_adv_params_sync(struct hci_dev *hdev, void *data) 8939 { 8940 struct mgmt_pending_cmd *cmd = data; 8941 struct mgmt_cp_add_ext_adv_params *cp = cmd->param; 8942 8943 return hci_setup_ext_adv_instance_sync(hdev, cp->instance); 8944 } 8945 8946 static int add_ext_adv_params(struct sock *sk, struct hci_dev *hdev, 8947 void *data, u16 data_len) 8948 { 8949 struct mgmt_cp_add_ext_adv_params *cp = data; 8950 struct mgmt_rp_add_ext_adv_params rp; 8951 struct mgmt_pending_cmd *cmd = NULL; 8952 struct adv_info *adv; 8953 u32 flags, min_interval, max_interval; 8954 u16 timeout, duration; 8955 u8 status; 8956 s8 tx_power; 8957 int err; 8958 8959 BT_DBG("%s", hdev->name); 8960 8961 status = mgmt_le_support(hdev); 8962 if (status) 8963 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_PARAMS, 8964 status); 8965 8966 if (cp->instance < 1 || cp->instance > hdev->le_num_of_adv_sets) 8967 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_PARAMS, 8968 MGMT_STATUS_INVALID_PARAMS); 8969 8970 /* The purpose of breaking add_advertising into two separate MGMT calls 8971 * for params and data is to allow more parameters to be added to this 8972 * structure in the future. For this reason, we verify that we have the 8973 * bare minimum structure we know of when the interface was defined. Any 8974 * extra parameters we don't know about will be ignored in this request. 8975 */ 8976 if (data_len < MGMT_ADD_EXT_ADV_PARAMS_MIN_SIZE) 8977 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_PARAMS, 8978 MGMT_STATUS_INVALID_PARAMS); 8979 8980 flags = __le32_to_cpu(cp->flags); 8981 8982 if (!requested_adv_flags_are_valid(hdev, flags)) 8983 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_PARAMS, 8984 MGMT_STATUS_INVALID_PARAMS); 8985 8986 hci_dev_lock(hdev); 8987 8988 /* In new interface, we require that we are powered to register */ 8989 if (!hdev_is_powered(hdev)) { 8990 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_PARAMS, 8991 MGMT_STATUS_REJECTED); 8992 goto unlock; 8993 } 8994 8995 if (adv_busy(hdev)) { 8996 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_PARAMS, 8997 MGMT_STATUS_BUSY); 8998 goto unlock; 8999 } 9000 9001 /* Parse defined parameters from request, use defaults otherwise */ 9002 timeout = (flags & MGMT_ADV_PARAM_TIMEOUT) ? 9003 __le16_to_cpu(cp->timeout) : 0; 9004 9005 duration = (flags & MGMT_ADV_PARAM_DURATION) ? 9006 __le16_to_cpu(cp->duration) : 9007 hdev->def_multi_adv_rotation_duration; 9008 9009 min_interval = (flags & MGMT_ADV_PARAM_INTERVALS) ? 9010 __le32_to_cpu(cp->min_interval) : 9011 hdev->le_adv_min_interval; 9012 9013 max_interval = (flags & MGMT_ADV_PARAM_INTERVALS) ? 9014 __le32_to_cpu(cp->max_interval) : 9015 hdev->le_adv_max_interval; 9016 9017 tx_power = (flags & MGMT_ADV_PARAM_TX_POWER) ? 9018 cp->tx_power : 9019 HCI_ADV_TX_POWER_NO_PREFERENCE; 9020 9021 /* Create advertising instance with no advertising or response data */ 9022 adv = hci_add_adv_instance(hdev, cp->instance, flags, 0, NULL, 0, NULL, 9023 timeout, duration, tx_power, min_interval, 9024 max_interval, 0); 9025 9026 if (IS_ERR(adv)) { 9027 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_PARAMS, 9028 MGMT_STATUS_FAILED); 9029 goto unlock; 9030 } 9031 9032 /* Submit request for advertising params if ext adv available */ 9033 if (ext_adv_capable(hdev)) { 9034 cmd = mgmt_pending_new(sk, MGMT_OP_ADD_EXT_ADV_PARAMS, hdev, 9035 data, data_len); 9036 if (!cmd) { 9037 err = -ENOMEM; 9038 hci_remove_adv_instance(hdev, cp->instance); 9039 goto unlock; 9040 } 9041 9042 err = hci_cmd_sync_queue(hdev, add_ext_adv_params_sync, cmd, 9043 add_ext_adv_params_complete); 9044 if (err < 0) 9045 mgmt_pending_free(cmd); 9046 } else { 9047 rp.instance = cp->instance; 9048 rp.tx_power = HCI_ADV_TX_POWER_NO_PREFERENCE; 9049 rp.max_adv_data_len = tlv_data_max_len(hdev, flags, true); 9050 rp.max_scan_rsp_len = tlv_data_max_len(hdev, flags, false); 9051 err = mgmt_cmd_complete(sk, hdev->id, 9052 MGMT_OP_ADD_EXT_ADV_PARAMS, 9053 MGMT_STATUS_SUCCESS, &rp, sizeof(rp)); 9054 } 9055 9056 unlock: 9057 hci_dev_unlock(hdev); 9058 9059 return err; 9060 } 9061 9062 static void add_ext_adv_data_complete(struct hci_dev *hdev, void *data, int err) 9063 { 9064 struct mgmt_pending_cmd *cmd = data; 9065 struct mgmt_cp_add_ext_adv_data *cp = cmd->param; 9066 struct mgmt_rp_add_advertising rp; 9067 9068 add_adv_complete(hdev, cmd->sk, cp->instance, err); 9069 9070 memset(&rp, 0, sizeof(rp)); 9071 9072 rp.instance = cp->instance; 9073 9074 if (err) 9075 mgmt_cmd_status(cmd->sk, cmd->hdev->id, cmd->opcode, 9076 mgmt_status(err)); 9077 else 9078 mgmt_cmd_complete(cmd->sk, cmd->hdev->id, cmd->opcode, 9079 mgmt_status(err), &rp, sizeof(rp)); 9080 9081 mgmt_pending_free(cmd); 9082 } 9083 9084 static int add_ext_adv_data_sync(struct hci_dev *hdev, void *data) 9085 { 9086 struct mgmt_pending_cmd *cmd = data; 9087 struct mgmt_cp_add_ext_adv_data *cp = cmd->param; 9088 int err; 9089 9090 if (ext_adv_capable(hdev)) { 9091 err = hci_update_adv_data_sync(hdev, cp->instance); 9092 if (err) 9093 return err; 9094 9095 err = hci_update_scan_rsp_data_sync(hdev, cp->instance); 9096 if (err) 9097 return err; 9098 9099 return hci_enable_ext_advertising_sync(hdev, cp->instance); 9100 } 9101 9102 return hci_schedule_adv_instance_sync(hdev, cp->instance, true); 9103 } 9104 9105 static int add_ext_adv_data(struct sock *sk, struct hci_dev *hdev, void *data, 9106 u16 data_len) 9107 { 9108 struct mgmt_cp_add_ext_adv_data *cp = data; 9109 struct mgmt_rp_add_ext_adv_data rp; 9110 u8 schedule_instance = 0; 9111 struct adv_info *next_instance; 9112 struct adv_info *adv_instance; 9113 int err = 0; 9114 struct mgmt_pending_cmd *cmd; 9115 u16 expected_len; 9116 9117 BT_DBG("%s", hdev->name); 9118 9119 expected_len = struct_size(cp, data, cp->adv_data_len + 9120 cp->scan_rsp_len); 9121 if (expected_len > data_len) 9122 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_DATA, 9123 MGMT_STATUS_INVALID_PARAMS); 9124 9125 hci_dev_lock(hdev); 9126 9127 adv_instance = hci_find_adv_instance(hdev, cp->instance); 9128 9129 if (!adv_instance) { 9130 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_DATA, 9131 MGMT_STATUS_INVALID_PARAMS); 9132 goto unlock; 9133 } 9134 9135 /* In new interface, we require that we are powered to register */ 9136 if (!hdev_is_powered(hdev)) { 9137 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_DATA, 9138 MGMT_STATUS_REJECTED); 9139 goto clear_new_instance; 9140 } 9141 9142 if (adv_busy(hdev)) { 9143 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_DATA, 9144 MGMT_STATUS_BUSY); 9145 goto clear_new_instance; 9146 } 9147 9148 /* Validate new data */ 9149 if (!tlv_data_is_valid(hdev, adv_instance->flags, cp->data, 9150 cp->adv_data_len, true) || 9151 !tlv_data_is_valid(hdev, adv_instance->flags, cp->data + 9152 cp->adv_data_len, cp->scan_rsp_len, false)) { 9153 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_DATA, 9154 MGMT_STATUS_INVALID_PARAMS); 9155 goto clear_new_instance; 9156 } 9157 9158 /* Set the data in the advertising instance */ 9159 hci_set_adv_instance_data(hdev, cp->instance, cp->adv_data_len, 9160 cp->data, cp->scan_rsp_len, 9161 cp->data + cp->adv_data_len); 9162 9163 /* If using software rotation, determine next instance to use */ 9164 if (hdev->cur_adv_instance == cp->instance) { 9165 /* If the currently advertised instance is being changed 9166 * then cancel the current advertising and schedule the 9167 * next instance. If there is only one instance then the 9168 * overridden advertising data will be visible right 9169 * away 9170 */ 9171 cancel_adv_timeout(hdev); 9172 9173 next_instance = hci_get_next_instance(hdev, cp->instance); 9174 if (next_instance) 9175 schedule_instance = next_instance->instance; 9176 } else if (!hdev->adv_instance_timeout) { 9177 /* Immediately advertise the new instance if no other 9178 * instance is currently being advertised. 9179 */ 9180 schedule_instance = cp->instance; 9181 } 9182 9183 /* If the HCI_ADVERTISING flag is set or there is no instance to 9184 * be advertised then we have no HCI communication to make. 9185 * Simply return. 9186 */ 9187 if (hci_dev_test_flag(hdev, HCI_ADVERTISING) || !schedule_instance) { 9188 if (adv_instance->pending) { 9189 mgmt_advertising_added(sk, hdev, cp->instance); 9190 adv_instance->pending = false; 9191 } 9192 rp.instance = cp->instance; 9193 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_DATA, 9194 MGMT_STATUS_SUCCESS, &rp, sizeof(rp)); 9195 goto unlock; 9196 } 9197 9198 cmd = mgmt_pending_new(sk, MGMT_OP_ADD_EXT_ADV_DATA, hdev, data, 9199 data_len); 9200 if (!cmd) { 9201 err = -ENOMEM; 9202 goto clear_new_instance; 9203 } 9204 9205 err = hci_cmd_sync_queue(hdev, add_ext_adv_data_sync, cmd, 9206 add_ext_adv_data_complete); 9207 if (err < 0) { 9208 mgmt_pending_free(cmd); 9209 goto clear_new_instance; 9210 } 9211 9212 /* We were successful in updating data, so trigger advertising_added 9213 * event if this is an instance that wasn't previously advertising. If 9214 * a failure occurs in the requests we initiated, we will remove the 9215 * instance again in add_advertising_complete 9216 */ 9217 if (adv_instance->pending) 9218 mgmt_advertising_added(sk, hdev, cp->instance); 9219 9220 goto unlock; 9221 9222 clear_new_instance: 9223 hci_remove_adv_instance(hdev, cp->instance); 9224 9225 unlock: 9226 hci_dev_unlock(hdev); 9227 9228 return err; 9229 } 9230 9231 static void remove_advertising_complete(struct hci_dev *hdev, void *data, 9232 int err) 9233 { 9234 struct mgmt_pending_cmd *cmd = data; 9235 struct mgmt_cp_remove_advertising *cp = cmd->param; 9236 struct mgmt_rp_remove_advertising rp; 9237 9238 bt_dev_dbg(hdev, "err %d", err); 9239 9240 memset(&rp, 0, sizeof(rp)); 9241 rp.instance = cp->instance; 9242 9243 if (err) 9244 mgmt_cmd_status(cmd->sk, cmd->hdev->id, cmd->opcode, 9245 mgmt_status(err)); 9246 else 9247 mgmt_cmd_complete(cmd->sk, cmd->hdev->id, cmd->opcode, 9248 MGMT_STATUS_SUCCESS, &rp, sizeof(rp)); 9249 9250 mgmt_pending_free(cmd); 9251 } 9252 9253 static int remove_advertising_sync(struct hci_dev *hdev, void *data) 9254 { 9255 struct mgmt_pending_cmd *cmd = data; 9256 struct mgmt_cp_remove_advertising *cp = cmd->param; 9257 int err; 9258 9259 err = hci_remove_advertising_sync(hdev, cmd->sk, cp->instance, true); 9260 if (err) 9261 return err; 9262 9263 if (list_empty(&hdev->adv_instances)) 9264 err = hci_disable_advertising_sync(hdev); 9265 9266 return err; 9267 } 9268 9269 static int remove_advertising(struct sock *sk, struct hci_dev *hdev, 9270 void *data, u16 data_len) 9271 { 9272 struct mgmt_cp_remove_advertising *cp = data; 9273 struct mgmt_pending_cmd *cmd; 9274 int err; 9275 9276 bt_dev_dbg(hdev, "sock %p", sk); 9277 9278 hci_dev_lock(hdev); 9279 9280 if (cp->instance && !hci_find_adv_instance(hdev, cp->instance)) { 9281 err = mgmt_cmd_status(sk, hdev->id, 9282 MGMT_OP_REMOVE_ADVERTISING, 9283 MGMT_STATUS_INVALID_PARAMS); 9284 goto unlock; 9285 } 9286 9287 if (pending_find(MGMT_OP_SET_LE, hdev)) { 9288 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_ADVERTISING, 9289 MGMT_STATUS_BUSY); 9290 goto unlock; 9291 } 9292 9293 if (list_empty(&hdev->adv_instances)) { 9294 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_ADVERTISING, 9295 MGMT_STATUS_INVALID_PARAMS); 9296 goto unlock; 9297 } 9298 9299 cmd = mgmt_pending_new(sk, MGMT_OP_REMOVE_ADVERTISING, hdev, data, 9300 data_len); 9301 if (!cmd) { 9302 err = -ENOMEM; 9303 goto unlock; 9304 } 9305 9306 err = hci_cmd_sync_queue(hdev, remove_advertising_sync, cmd, 9307 remove_advertising_complete); 9308 if (err < 0) 9309 mgmt_pending_free(cmd); 9310 9311 unlock: 9312 hci_dev_unlock(hdev); 9313 9314 return err; 9315 } 9316 9317 static int get_adv_size_info(struct sock *sk, struct hci_dev *hdev, 9318 void *data, u16 data_len) 9319 { 9320 struct mgmt_cp_get_adv_size_info *cp = data; 9321 struct mgmt_rp_get_adv_size_info rp; 9322 u32 flags, supported_flags; 9323 9324 bt_dev_dbg(hdev, "sock %p", sk); 9325 9326 if (!lmp_le_capable(hdev)) 9327 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_ADV_SIZE_INFO, 9328 MGMT_STATUS_REJECTED); 9329 9330 if (cp->instance < 1 || cp->instance > hdev->le_num_of_adv_sets) 9331 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_ADV_SIZE_INFO, 9332 MGMT_STATUS_INVALID_PARAMS); 9333 9334 flags = __le32_to_cpu(cp->flags); 9335 9336 /* The current implementation only supports a subset of the specified 9337 * flags. 9338 */ 9339 supported_flags = get_supported_adv_flags(hdev); 9340 if (flags & ~supported_flags) 9341 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_ADV_SIZE_INFO, 9342 MGMT_STATUS_INVALID_PARAMS); 9343 9344 rp.instance = cp->instance; 9345 rp.flags = cp->flags; 9346 rp.max_adv_data_len = tlv_data_max_len(hdev, flags, true); 9347 rp.max_scan_rsp_len = tlv_data_max_len(hdev, flags, false); 9348 9349 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_ADV_SIZE_INFO, 9350 MGMT_STATUS_SUCCESS, &rp, sizeof(rp)); 9351 } 9352 9353 static const struct hci_mgmt_handler mgmt_handlers[] = { 9354 { NULL }, /* 0x0000 (no command) */ 9355 { read_version, MGMT_READ_VERSION_SIZE, 9356 HCI_MGMT_NO_HDEV | 9357 HCI_MGMT_UNTRUSTED }, 9358 { read_commands, MGMT_READ_COMMANDS_SIZE, 9359 HCI_MGMT_NO_HDEV | 9360 HCI_MGMT_UNTRUSTED }, 9361 { read_index_list, MGMT_READ_INDEX_LIST_SIZE, 9362 HCI_MGMT_NO_HDEV | 9363 HCI_MGMT_UNTRUSTED }, 9364 { read_controller_info, MGMT_READ_INFO_SIZE, 9365 HCI_MGMT_UNTRUSTED }, 9366 { set_powered, MGMT_SETTING_SIZE }, 9367 { set_discoverable, MGMT_SET_DISCOVERABLE_SIZE }, 9368 { set_connectable, MGMT_SETTING_SIZE }, 9369 { set_fast_connectable, MGMT_SETTING_SIZE }, 9370 { set_bondable, MGMT_SETTING_SIZE }, 9371 { set_link_security, MGMT_SETTING_SIZE }, 9372 { set_ssp, MGMT_SETTING_SIZE }, 9373 { set_hs, MGMT_SETTING_SIZE }, 9374 { set_le, MGMT_SETTING_SIZE }, 9375 { set_dev_class, MGMT_SET_DEV_CLASS_SIZE }, 9376 { set_local_name, MGMT_SET_LOCAL_NAME_SIZE }, 9377 { add_uuid, MGMT_ADD_UUID_SIZE }, 9378 { remove_uuid, MGMT_REMOVE_UUID_SIZE }, 9379 { load_link_keys, MGMT_LOAD_LINK_KEYS_SIZE, 9380 HCI_MGMT_VAR_LEN }, 9381 { load_long_term_keys, MGMT_LOAD_LONG_TERM_KEYS_SIZE, 9382 HCI_MGMT_VAR_LEN }, 9383 { disconnect, MGMT_DISCONNECT_SIZE }, 9384 { get_connections, MGMT_GET_CONNECTIONS_SIZE }, 9385 { pin_code_reply, MGMT_PIN_CODE_REPLY_SIZE }, 9386 { pin_code_neg_reply, MGMT_PIN_CODE_NEG_REPLY_SIZE }, 9387 { set_io_capability, MGMT_SET_IO_CAPABILITY_SIZE }, 9388 { pair_device, MGMT_PAIR_DEVICE_SIZE }, 9389 { cancel_pair_device, MGMT_CANCEL_PAIR_DEVICE_SIZE }, 9390 { unpair_device, MGMT_UNPAIR_DEVICE_SIZE }, 9391 { user_confirm_reply, MGMT_USER_CONFIRM_REPLY_SIZE }, 9392 { user_confirm_neg_reply, MGMT_USER_CONFIRM_NEG_REPLY_SIZE }, 9393 { user_passkey_reply, MGMT_USER_PASSKEY_REPLY_SIZE }, 9394 { user_passkey_neg_reply, MGMT_USER_PASSKEY_NEG_REPLY_SIZE }, 9395 { read_local_oob_data, MGMT_READ_LOCAL_OOB_DATA_SIZE }, 9396 { add_remote_oob_data, MGMT_ADD_REMOTE_OOB_DATA_SIZE, 9397 HCI_MGMT_VAR_LEN }, 9398 { remove_remote_oob_data, MGMT_REMOVE_REMOTE_OOB_DATA_SIZE }, 9399 { start_discovery, MGMT_START_DISCOVERY_SIZE }, 9400 { stop_discovery, MGMT_STOP_DISCOVERY_SIZE }, 9401 { confirm_name, MGMT_CONFIRM_NAME_SIZE }, 9402 { block_device, MGMT_BLOCK_DEVICE_SIZE }, 9403 { unblock_device, MGMT_UNBLOCK_DEVICE_SIZE }, 9404 { set_device_id, MGMT_SET_DEVICE_ID_SIZE }, 9405 { set_advertising, MGMT_SETTING_SIZE }, 9406 { set_bredr, MGMT_SETTING_SIZE }, 9407 { set_static_address, MGMT_SET_STATIC_ADDRESS_SIZE }, 9408 { set_scan_params, MGMT_SET_SCAN_PARAMS_SIZE }, 9409 { set_secure_conn, MGMT_SETTING_SIZE }, 9410 { set_debug_keys, MGMT_SETTING_SIZE }, 9411 { set_privacy, MGMT_SET_PRIVACY_SIZE }, 9412 { load_irks, MGMT_LOAD_IRKS_SIZE, 9413 HCI_MGMT_VAR_LEN }, 9414 { get_conn_info, MGMT_GET_CONN_INFO_SIZE }, 9415 { get_clock_info, MGMT_GET_CLOCK_INFO_SIZE }, 9416 { add_device, MGMT_ADD_DEVICE_SIZE }, 9417 { remove_device, MGMT_REMOVE_DEVICE_SIZE }, 9418 { load_conn_param, MGMT_LOAD_CONN_PARAM_SIZE, 9419 HCI_MGMT_VAR_LEN }, 9420 { read_unconf_index_list, MGMT_READ_UNCONF_INDEX_LIST_SIZE, 9421 HCI_MGMT_NO_HDEV | 9422 HCI_MGMT_UNTRUSTED }, 9423 { read_config_info, MGMT_READ_CONFIG_INFO_SIZE, 9424 HCI_MGMT_UNCONFIGURED | 9425 HCI_MGMT_UNTRUSTED }, 9426 { set_external_config, MGMT_SET_EXTERNAL_CONFIG_SIZE, 9427 HCI_MGMT_UNCONFIGURED }, 9428 { set_public_address, MGMT_SET_PUBLIC_ADDRESS_SIZE, 9429 HCI_MGMT_UNCONFIGURED }, 9430 { start_service_discovery, MGMT_START_SERVICE_DISCOVERY_SIZE, 9431 HCI_MGMT_VAR_LEN }, 9432 { read_local_oob_ext_data, MGMT_READ_LOCAL_OOB_EXT_DATA_SIZE }, 9433 { read_ext_index_list, MGMT_READ_EXT_INDEX_LIST_SIZE, 9434 HCI_MGMT_NO_HDEV | 9435 HCI_MGMT_UNTRUSTED }, 9436 { read_adv_features, MGMT_READ_ADV_FEATURES_SIZE }, 9437 { add_advertising, MGMT_ADD_ADVERTISING_SIZE, 9438 HCI_MGMT_VAR_LEN }, 9439 { remove_advertising, MGMT_REMOVE_ADVERTISING_SIZE }, 9440 { get_adv_size_info, MGMT_GET_ADV_SIZE_INFO_SIZE }, 9441 { start_limited_discovery, MGMT_START_DISCOVERY_SIZE }, 9442 { read_ext_controller_info,MGMT_READ_EXT_INFO_SIZE, 9443 HCI_MGMT_UNTRUSTED }, 9444 { set_appearance, MGMT_SET_APPEARANCE_SIZE }, 9445 { get_phy_configuration, MGMT_GET_PHY_CONFIGURATION_SIZE }, 9446 { set_phy_configuration, MGMT_SET_PHY_CONFIGURATION_SIZE }, 9447 { set_blocked_keys, MGMT_OP_SET_BLOCKED_KEYS_SIZE, 9448 HCI_MGMT_VAR_LEN }, 9449 { set_wideband_speech, MGMT_SETTING_SIZE }, 9450 { read_controller_cap, MGMT_READ_CONTROLLER_CAP_SIZE, 9451 HCI_MGMT_UNTRUSTED }, 9452 { read_exp_features_info, MGMT_READ_EXP_FEATURES_INFO_SIZE, 9453 HCI_MGMT_UNTRUSTED | 9454 HCI_MGMT_HDEV_OPTIONAL }, 9455 { set_exp_feature, MGMT_SET_EXP_FEATURE_SIZE, 9456 HCI_MGMT_VAR_LEN | 9457 HCI_MGMT_HDEV_OPTIONAL }, 9458 { read_def_system_config, MGMT_READ_DEF_SYSTEM_CONFIG_SIZE, 9459 HCI_MGMT_UNTRUSTED }, 9460 { set_def_system_config, MGMT_SET_DEF_SYSTEM_CONFIG_SIZE, 9461 HCI_MGMT_VAR_LEN }, 9462 { read_def_runtime_config, MGMT_READ_DEF_RUNTIME_CONFIG_SIZE, 9463 HCI_MGMT_UNTRUSTED }, 9464 { set_def_runtime_config, MGMT_SET_DEF_RUNTIME_CONFIG_SIZE, 9465 HCI_MGMT_VAR_LEN }, 9466 { get_device_flags, MGMT_GET_DEVICE_FLAGS_SIZE }, 9467 { set_device_flags, MGMT_SET_DEVICE_FLAGS_SIZE }, 9468 { read_adv_mon_features, MGMT_READ_ADV_MONITOR_FEATURES_SIZE }, 9469 { add_adv_patterns_monitor,MGMT_ADD_ADV_PATTERNS_MONITOR_SIZE, 9470 HCI_MGMT_VAR_LEN }, 9471 { remove_adv_monitor, MGMT_REMOVE_ADV_MONITOR_SIZE }, 9472 { add_ext_adv_params, MGMT_ADD_EXT_ADV_PARAMS_MIN_SIZE, 9473 HCI_MGMT_VAR_LEN }, 9474 { add_ext_adv_data, MGMT_ADD_EXT_ADV_DATA_SIZE, 9475 HCI_MGMT_VAR_LEN }, 9476 { add_adv_patterns_monitor_rssi, 9477 MGMT_ADD_ADV_PATTERNS_MONITOR_RSSI_SIZE, 9478 HCI_MGMT_VAR_LEN }, 9479 { set_mesh, MGMT_SET_MESH_RECEIVER_SIZE, 9480 HCI_MGMT_VAR_LEN }, 9481 { mesh_features, MGMT_MESH_READ_FEATURES_SIZE }, 9482 { mesh_send, MGMT_MESH_SEND_SIZE, 9483 HCI_MGMT_VAR_LEN }, 9484 { mesh_send_cancel, MGMT_MESH_SEND_CANCEL_SIZE }, 9485 { mgmt_hci_cmd_sync, MGMT_HCI_CMD_SYNC_SIZE, HCI_MGMT_VAR_LEN }, 9486 }; 9487 9488 void mgmt_index_added(struct hci_dev *hdev) 9489 { 9490 struct mgmt_ev_ext_index ev; 9491 9492 if (hci_test_quirk(hdev, HCI_QUIRK_RAW_DEVICE)) 9493 return; 9494 9495 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) { 9496 mgmt_index_event(MGMT_EV_UNCONF_INDEX_ADDED, hdev, NULL, 0, 9497 HCI_MGMT_UNCONF_INDEX_EVENTS); 9498 ev.type = 0x01; 9499 } else { 9500 mgmt_index_event(MGMT_EV_INDEX_ADDED, hdev, NULL, 0, 9501 HCI_MGMT_INDEX_EVENTS); 9502 ev.type = 0x00; 9503 } 9504 9505 ev.bus = hdev->bus; 9506 9507 mgmt_index_event(MGMT_EV_EXT_INDEX_ADDED, hdev, &ev, sizeof(ev), 9508 HCI_MGMT_EXT_INDEX_EVENTS); 9509 } 9510 9511 void mgmt_index_removed(struct hci_dev *hdev) 9512 { 9513 struct mgmt_ev_ext_index ev; 9514 struct cmd_lookup match = { NULL, hdev, MGMT_STATUS_INVALID_INDEX }; 9515 9516 if (hci_test_quirk(hdev, HCI_QUIRK_RAW_DEVICE)) 9517 return; 9518 9519 mgmt_pending_foreach(0, hdev, true, cmd_complete_rsp, &match); 9520 9521 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) { 9522 mgmt_index_event(MGMT_EV_UNCONF_INDEX_REMOVED, hdev, NULL, 0, 9523 HCI_MGMT_UNCONF_INDEX_EVENTS); 9524 ev.type = 0x01; 9525 } else { 9526 mgmt_index_event(MGMT_EV_INDEX_REMOVED, hdev, NULL, 0, 9527 HCI_MGMT_INDEX_EVENTS); 9528 ev.type = 0x00; 9529 } 9530 9531 ev.bus = hdev->bus; 9532 9533 mgmt_index_event(MGMT_EV_EXT_INDEX_REMOVED, hdev, &ev, sizeof(ev), 9534 HCI_MGMT_EXT_INDEX_EVENTS); 9535 9536 /* Cancel any remaining timed work */ 9537 if (!hci_dev_test_flag(hdev, HCI_MGMT)) 9538 return; 9539 cancel_delayed_work_sync(&hdev->discov_off); 9540 cancel_delayed_work_sync(&hdev->service_cache); 9541 cancel_delayed_work_sync(&hdev->rpa_expired); 9542 cancel_delayed_work_sync(&hdev->mesh_send_done); 9543 } 9544 9545 void mgmt_power_on(struct hci_dev *hdev, int err) 9546 { 9547 struct cmd_lookup match = { NULL, hdev }; 9548 9549 bt_dev_dbg(hdev, "err %d", err); 9550 9551 hci_dev_lock(hdev); 9552 9553 if (!err) { 9554 restart_le_actions(hdev); 9555 hci_update_passive_scan(hdev); 9556 } 9557 9558 mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, true, settings_rsp, 9559 &match); 9560 9561 new_settings(hdev, match.sk); 9562 9563 if (match.sk) 9564 sock_put(match.sk); 9565 9566 hci_dev_unlock(hdev); 9567 } 9568 9569 void __mgmt_power_off(struct hci_dev *hdev) 9570 { 9571 struct cmd_lookup match = { NULL, hdev }; 9572 u8 zero_cod[] = { 0, 0, 0 }; 9573 9574 mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, true, settings_rsp, 9575 &match); 9576 9577 /* If the power off is because of hdev unregistration let 9578 * use the appropriate INVALID_INDEX status. Otherwise use 9579 * NOT_POWERED. We cover both scenarios here since later in 9580 * mgmt_index_removed() any hci_conn callbacks will have already 9581 * been triggered, potentially causing misleading DISCONNECTED 9582 * status responses. 9583 */ 9584 if (hci_dev_test_flag(hdev, HCI_UNREGISTER)) 9585 match.mgmt_status = MGMT_STATUS_INVALID_INDEX; 9586 else 9587 match.mgmt_status = MGMT_STATUS_NOT_POWERED; 9588 9589 mgmt_pending_foreach(0, hdev, true, cmd_complete_rsp, &match); 9590 9591 if (memcmp(hdev->dev_class, zero_cod, sizeof(zero_cod)) != 0) { 9592 mgmt_limited_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev, 9593 zero_cod, sizeof(zero_cod), 9594 HCI_MGMT_DEV_CLASS_EVENTS, NULL); 9595 ext_info_changed(hdev, NULL); 9596 } 9597 9598 new_settings(hdev, match.sk); 9599 9600 if (match.sk) 9601 sock_put(match.sk); 9602 } 9603 9604 void mgmt_set_powered_failed(struct hci_dev *hdev, int err) 9605 { 9606 struct mgmt_pending_cmd *cmd; 9607 u8 status; 9608 9609 cmd = pending_find(MGMT_OP_SET_POWERED, hdev); 9610 if (!cmd) 9611 return; 9612 9613 if (err == -ERFKILL) 9614 status = MGMT_STATUS_RFKILLED; 9615 else 9616 status = MGMT_STATUS_FAILED; 9617 9618 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_POWERED, status); 9619 9620 mgmt_pending_remove(cmd); 9621 } 9622 9623 void mgmt_new_link_key(struct hci_dev *hdev, struct link_key *key, 9624 bool persistent) 9625 { 9626 struct mgmt_ev_new_link_key ev; 9627 9628 memset(&ev, 0, sizeof(ev)); 9629 9630 ev.store_hint = persistent; 9631 bacpy(&ev.key.addr.bdaddr, &key->bdaddr); 9632 ev.key.addr.type = BDADDR_BREDR; 9633 ev.key.type = key->type; 9634 memcpy(ev.key.val, key->val, HCI_LINK_KEY_SIZE); 9635 ev.key.pin_len = key->pin_len; 9636 9637 mgmt_event(MGMT_EV_NEW_LINK_KEY, hdev, &ev, sizeof(ev), NULL); 9638 } 9639 9640 static u8 mgmt_ltk_type(struct smp_ltk *ltk) 9641 { 9642 switch (ltk->type) { 9643 case SMP_LTK: 9644 case SMP_LTK_RESPONDER: 9645 if (ltk->authenticated) 9646 return MGMT_LTK_AUTHENTICATED; 9647 return MGMT_LTK_UNAUTHENTICATED; 9648 case SMP_LTK_P256: 9649 if (ltk->authenticated) 9650 return MGMT_LTK_P256_AUTH; 9651 return MGMT_LTK_P256_UNAUTH; 9652 case SMP_LTK_P256_DEBUG: 9653 return MGMT_LTK_P256_DEBUG; 9654 } 9655 9656 return MGMT_LTK_UNAUTHENTICATED; 9657 } 9658 9659 void mgmt_new_ltk(struct hci_dev *hdev, struct smp_ltk *key, bool persistent) 9660 { 9661 struct mgmt_ev_new_long_term_key ev; 9662 9663 memset(&ev, 0, sizeof(ev)); 9664 9665 /* Devices using resolvable or non-resolvable random addresses 9666 * without providing an identity resolving key don't require 9667 * to store long term keys. Their addresses will change the 9668 * next time around. 9669 * 9670 * Only when a remote device provides an identity address 9671 * make sure the long term key is stored. If the remote 9672 * identity is known, the long term keys are internally 9673 * mapped to the identity address. So allow static random 9674 * and public addresses here. 9675 */ 9676 if (key->bdaddr_type == ADDR_LE_DEV_RANDOM && 9677 (key->bdaddr.b[5] & 0xc0) != 0xc0) 9678 ev.store_hint = 0x00; 9679 else 9680 ev.store_hint = persistent; 9681 9682 bacpy(&ev.key.addr.bdaddr, &key->bdaddr); 9683 ev.key.addr.type = link_to_bdaddr(LE_LINK, key->bdaddr_type); 9684 ev.key.type = mgmt_ltk_type(key); 9685 ev.key.enc_size = key->enc_size; 9686 ev.key.ediv = key->ediv; 9687 ev.key.rand = key->rand; 9688 9689 if (key->type == SMP_LTK) 9690 ev.key.initiator = 1; 9691 9692 /* Make sure we copy only the significant bytes based on the 9693 * encryption key size, and set the rest of the value to zeroes. 9694 */ 9695 memcpy(ev.key.val, key->val, key->enc_size); 9696 memset(ev.key.val + key->enc_size, 0, 9697 sizeof(ev.key.val) - key->enc_size); 9698 9699 mgmt_event(MGMT_EV_NEW_LONG_TERM_KEY, hdev, &ev, sizeof(ev), NULL); 9700 } 9701 9702 void mgmt_new_irk(struct hci_dev *hdev, struct smp_irk *irk, bool persistent) 9703 { 9704 struct mgmt_ev_new_irk ev; 9705 9706 memset(&ev, 0, sizeof(ev)); 9707 9708 ev.store_hint = persistent; 9709 9710 bacpy(&ev.rpa, &irk->rpa); 9711 bacpy(&ev.irk.addr.bdaddr, &irk->bdaddr); 9712 ev.irk.addr.type = link_to_bdaddr(LE_LINK, irk->addr_type); 9713 memcpy(ev.irk.val, irk->val, sizeof(irk->val)); 9714 9715 mgmt_event(MGMT_EV_NEW_IRK, hdev, &ev, sizeof(ev), NULL); 9716 } 9717 9718 void mgmt_new_csrk(struct hci_dev *hdev, struct smp_csrk *csrk, 9719 bool persistent) 9720 { 9721 struct mgmt_ev_new_csrk ev; 9722 9723 memset(&ev, 0, sizeof(ev)); 9724 9725 /* Devices using resolvable or non-resolvable random addresses 9726 * without providing an identity resolving key don't require 9727 * to store signature resolving keys. Their addresses will change 9728 * the next time around. 9729 * 9730 * Only when a remote device provides an identity address 9731 * make sure the signature resolving key is stored. So allow 9732 * static random and public addresses here. 9733 */ 9734 if (csrk->bdaddr_type == ADDR_LE_DEV_RANDOM && 9735 (csrk->bdaddr.b[5] & 0xc0) != 0xc0) 9736 ev.store_hint = 0x00; 9737 else 9738 ev.store_hint = persistent; 9739 9740 bacpy(&ev.key.addr.bdaddr, &csrk->bdaddr); 9741 ev.key.addr.type = link_to_bdaddr(LE_LINK, csrk->bdaddr_type); 9742 ev.key.type = csrk->type; 9743 memcpy(ev.key.val, csrk->val, sizeof(csrk->val)); 9744 9745 mgmt_event(MGMT_EV_NEW_CSRK, hdev, &ev, sizeof(ev), NULL); 9746 } 9747 9748 void mgmt_new_conn_param(struct hci_dev *hdev, bdaddr_t *bdaddr, 9749 u8 bdaddr_type, u8 store_hint, u16 min_interval, 9750 u16 max_interval, u16 latency, u16 timeout) 9751 { 9752 struct mgmt_ev_new_conn_param ev; 9753 9754 if (!hci_is_identity_address(bdaddr, bdaddr_type)) 9755 return; 9756 9757 memset(&ev, 0, sizeof(ev)); 9758 bacpy(&ev.addr.bdaddr, bdaddr); 9759 ev.addr.type = link_to_bdaddr(LE_LINK, bdaddr_type); 9760 ev.store_hint = store_hint; 9761 ev.min_interval = cpu_to_le16(min_interval); 9762 ev.max_interval = cpu_to_le16(max_interval); 9763 ev.latency = cpu_to_le16(latency); 9764 ev.timeout = cpu_to_le16(timeout); 9765 9766 mgmt_event(MGMT_EV_NEW_CONN_PARAM, hdev, &ev, sizeof(ev), NULL); 9767 } 9768 9769 void mgmt_device_connected(struct hci_dev *hdev, struct hci_conn *conn, 9770 u8 *name, u8 name_len) 9771 { 9772 struct sk_buff *skb; 9773 struct mgmt_ev_device_connected *ev; 9774 u16 eir_len = 0; 9775 u32 flags = 0; 9776 9777 if (test_and_set_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags)) 9778 return; 9779 9780 /* allocate buff for LE or BR/EDR adv */ 9781 if (conn->le_adv_data_len > 0) 9782 skb = mgmt_alloc_skb(hdev, MGMT_EV_DEVICE_CONNECTED, 9783 sizeof(*ev) + conn->le_adv_data_len); 9784 else 9785 skb = mgmt_alloc_skb(hdev, MGMT_EV_DEVICE_CONNECTED, 9786 sizeof(*ev) + (name ? eir_precalc_len(name_len) : 0) + 9787 eir_precalc_len(sizeof(conn->dev_class))); 9788 9789 if (!skb) 9790 return; 9791 9792 ev = skb_put(skb, sizeof(*ev)); 9793 bacpy(&ev->addr.bdaddr, &conn->dst); 9794 ev->addr.type = link_to_bdaddr(conn->type, conn->dst_type); 9795 9796 if (conn->out) 9797 flags |= MGMT_DEV_FOUND_INITIATED_CONN; 9798 9799 ev->flags = __cpu_to_le32(flags); 9800 9801 /* We must ensure that the EIR Data fields are ordered and 9802 * unique. Keep it simple for now and avoid the problem by not 9803 * adding any BR/EDR data to the LE adv. 9804 */ 9805 if (conn->le_adv_data_len > 0) { 9806 skb_put_data(skb, conn->le_adv_data, conn->le_adv_data_len); 9807 eir_len = conn->le_adv_data_len; 9808 } else { 9809 if (name) 9810 eir_len += eir_skb_put_data(skb, EIR_NAME_COMPLETE, name, name_len); 9811 9812 if (memcmp(conn->dev_class, "\0\0\0", sizeof(conn->dev_class))) 9813 eir_len += eir_skb_put_data(skb, EIR_CLASS_OF_DEV, 9814 conn->dev_class, sizeof(conn->dev_class)); 9815 } 9816 9817 ev->eir_len = cpu_to_le16(eir_len); 9818 9819 mgmt_event_skb(skb, NULL); 9820 } 9821 9822 static void unpair_device_rsp(struct mgmt_pending_cmd *cmd, void *data) 9823 { 9824 struct hci_dev *hdev = data; 9825 struct mgmt_cp_unpair_device *cp = cmd->param; 9826 9827 device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, cmd->sk); 9828 9829 cmd->cmd_complete(cmd, 0); 9830 } 9831 9832 bool mgmt_powering_down(struct hci_dev *hdev) 9833 { 9834 struct mgmt_pending_cmd *cmd; 9835 struct mgmt_mode *cp; 9836 9837 if (hci_dev_test_flag(hdev, HCI_POWERING_DOWN)) 9838 return true; 9839 9840 cmd = pending_find(MGMT_OP_SET_POWERED, hdev); 9841 if (!cmd) 9842 return false; 9843 9844 cp = cmd->param; 9845 if (!cp->val) 9846 return true; 9847 9848 return false; 9849 } 9850 9851 void mgmt_device_disconnected(struct hci_dev *hdev, bdaddr_t *bdaddr, 9852 u8 link_type, u8 addr_type, u8 reason, 9853 bool mgmt_connected) 9854 { 9855 struct mgmt_ev_device_disconnected ev; 9856 struct sock *sk = NULL; 9857 9858 if (!mgmt_connected) 9859 return; 9860 9861 if (link_type != ACL_LINK && 9862 link_type != LE_LINK && 9863 link_type != BIS_LINK) 9864 return; 9865 9866 bacpy(&ev.addr.bdaddr, bdaddr); 9867 ev.addr.type = link_to_bdaddr(link_type, addr_type); 9868 ev.reason = reason; 9869 9870 /* Report disconnects due to suspend */ 9871 if (hdev->suspended) 9872 ev.reason = MGMT_DEV_DISCONN_LOCAL_HOST_SUSPEND; 9873 9874 mgmt_event(MGMT_EV_DEVICE_DISCONNECTED, hdev, &ev, sizeof(ev), sk); 9875 9876 if (sk) 9877 sock_put(sk); 9878 } 9879 9880 void mgmt_disconnect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr, 9881 u8 link_type, u8 addr_type, u8 status) 9882 { 9883 u8 bdaddr_type = link_to_bdaddr(link_type, addr_type); 9884 struct mgmt_cp_disconnect *cp; 9885 struct mgmt_pending_cmd *cmd; 9886 9887 mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, true, 9888 unpair_device_rsp, hdev); 9889 9890 cmd = pending_find(MGMT_OP_DISCONNECT, hdev); 9891 if (!cmd) 9892 return; 9893 9894 cp = cmd->param; 9895 9896 if (bacmp(bdaddr, &cp->addr.bdaddr)) 9897 return; 9898 9899 if (cp->addr.type != bdaddr_type) 9900 return; 9901 9902 cmd->cmd_complete(cmd, mgmt_status(status)); 9903 mgmt_pending_remove(cmd); 9904 } 9905 9906 void mgmt_connect_failed(struct hci_dev *hdev, struct hci_conn *conn, u8 status) 9907 { 9908 struct mgmt_ev_connect_failed ev; 9909 9910 if (test_and_clear_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags)) { 9911 mgmt_device_disconnected(hdev, &conn->dst, conn->type, 9912 conn->dst_type, status, true); 9913 return; 9914 } 9915 9916 bacpy(&ev.addr.bdaddr, &conn->dst); 9917 ev.addr.type = link_to_bdaddr(conn->type, conn->dst_type); 9918 ev.status = mgmt_status(status); 9919 9920 mgmt_event(MGMT_EV_CONNECT_FAILED, hdev, &ev, sizeof(ev), NULL); 9921 } 9922 9923 void mgmt_pin_code_request(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 secure) 9924 { 9925 struct mgmt_ev_pin_code_request ev; 9926 9927 bacpy(&ev.addr.bdaddr, bdaddr); 9928 ev.addr.type = BDADDR_BREDR; 9929 ev.secure = secure; 9930 9931 mgmt_event(MGMT_EV_PIN_CODE_REQUEST, hdev, &ev, sizeof(ev), NULL); 9932 } 9933 9934 void mgmt_pin_code_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr, 9935 u8 status) 9936 { 9937 struct mgmt_pending_cmd *cmd; 9938 9939 cmd = pending_find(MGMT_OP_PIN_CODE_REPLY, hdev); 9940 if (!cmd) 9941 return; 9942 9943 cmd->cmd_complete(cmd, mgmt_status(status)); 9944 mgmt_pending_remove(cmd); 9945 } 9946 9947 void mgmt_pin_code_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr, 9948 u8 status) 9949 { 9950 struct mgmt_pending_cmd *cmd; 9951 9952 cmd = pending_find(MGMT_OP_PIN_CODE_NEG_REPLY, hdev); 9953 if (!cmd) 9954 return; 9955 9956 cmd->cmd_complete(cmd, mgmt_status(status)); 9957 mgmt_pending_remove(cmd); 9958 } 9959 9960 int mgmt_user_confirm_request(struct hci_dev *hdev, bdaddr_t *bdaddr, 9961 u8 link_type, u8 addr_type, u32 value, 9962 u8 confirm_hint) 9963 { 9964 struct mgmt_ev_user_confirm_request ev; 9965 9966 bt_dev_dbg(hdev, "bdaddr %pMR", bdaddr); 9967 9968 bacpy(&ev.addr.bdaddr, bdaddr); 9969 ev.addr.type = link_to_bdaddr(link_type, addr_type); 9970 ev.confirm_hint = confirm_hint; 9971 ev.value = cpu_to_le32(value); 9972 9973 return mgmt_event(MGMT_EV_USER_CONFIRM_REQUEST, hdev, &ev, sizeof(ev), 9974 NULL); 9975 } 9976 9977 int mgmt_user_passkey_request(struct hci_dev *hdev, bdaddr_t *bdaddr, 9978 u8 link_type, u8 addr_type) 9979 { 9980 struct mgmt_ev_user_passkey_request ev; 9981 9982 bt_dev_dbg(hdev, "bdaddr %pMR", bdaddr); 9983 9984 bacpy(&ev.addr.bdaddr, bdaddr); 9985 ev.addr.type = link_to_bdaddr(link_type, addr_type); 9986 9987 return mgmt_event(MGMT_EV_USER_PASSKEY_REQUEST, hdev, &ev, sizeof(ev), 9988 NULL); 9989 } 9990 9991 static int user_pairing_resp_complete(struct hci_dev *hdev, bdaddr_t *bdaddr, 9992 u8 link_type, u8 addr_type, u8 status, 9993 u8 opcode) 9994 { 9995 struct mgmt_pending_cmd *cmd; 9996 9997 cmd = pending_find(opcode, hdev); 9998 if (!cmd) 9999 return -ENOENT; 10000 10001 cmd->cmd_complete(cmd, mgmt_status(status)); 10002 mgmt_pending_remove(cmd); 10003 10004 return 0; 10005 } 10006 10007 int mgmt_user_confirm_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr, 10008 u8 link_type, u8 addr_type, u8 status) 10009 { 10010 return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type, 10011 status, MGMT_OP_USER_CONFIRM_REPLY); 10012 } 10013 10014 int mgmt_user_confirm_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr, 10015 u8 link_type, u8 addr_type, u8 status) 10016 { 10017 return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type, 10018 status, 10019 MGMT_OP_USER_CONFIRM_NEG_REPLY); 10020 } 10021 10022 int mgmt_user_passkey_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr, 10023 u8 link_type, u8 addr_type, u8 status) 10024 { 10025 return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type, 10026 status, MGMT_OP_USER_PASSKEY_REPLY); 10027 } 10028 10029 int mgmt_user_passkey_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr, 10030 u8 link_type, u8 addr_type, u8 status) 10031 { 10032 return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type, 10033 status, 10034 MGMT_OP_USER_PASSKEY_NEG_REPLY); 10035 } 10036 10037 int mgmt_user_passkey_notify(struct hci_dev *hdev, bdaddr_t *bdaddr, 10038 u8 link_type, u8 addr_type, u32 passkey, 10039 u8 entered) 10040 { 10041 struct mgmt_ev_passkey_notify ev; 10042 10043 bt_dev_dbg(hdev, "bdaddr %pMR", bdaddr); 10044 10045 bacpy(&ev.addr.bdaddr, bdaddr); 10046 ev.addr.type = link_to_bdaddr(link_type, addr_type); 10047 ev.passkey = __cpu_to_le32(passkey); 10048 ev.entered = entered; 10049 10050 return mgmt_event(MGMT_EV_PASSKEY_NOTIFY, hdev, &ev, sizeof(ev), NULL); 10051 } 10052 10053 void mgmt_auth_failed(struct hci_conn *conn, u8 hci_status) 10054 { 10055 struct mgmt_ev_auth_failed ev; 10056 struct mgmt_pending_cmd *cmd; 10057 u8 status = mgmt_status(hci_status); 10058 10059 bacpy(&ev.addr.bdaddr, &conn->dst); 10060 ev.addr.type = link_to_bdaddr(conn->type, conn->dst_type); 10061 ev.status = status; 10062 10063 cmd = find_pairing(conn); 10064 10065 mgmt_event(MGMT_EV_AUTH_FAILED, conn->hdev, &ev, sizeof(ev), 10066 cmd ? cmd->sk : NULL); 10067 10068 if (cmd) { 10069 cmd->cmd_complete(cmd, status); 10070 mgmt_pending_remove(cmd); 10071 } 10072 } 10073 10074 void mgmt_auth_enable_complete(struct hci_dev *hdev, u8 status) 10075 { 10076 struct cmd_lookup match = { NULL, hdev }; 10077 bool changed; 10078 10079 if (status) { 10080 u8 mgmt_err = mgmt_status(status); 10081 mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev, true, 10082 cmd_status_rsp, &mgmt_err); 10083 return; 10084 } 10085 10086 if (test_bit(HCI_AUTH, &hdev->flags)) 10087 changed = !hci_dev_test_and_set_flag(hdev, HCI_LINK_SECURITY); 10088 else 10089 changed = hci_dev_test_and_clear_flag(hdev, HCI_LINK_SECURITY); 10090 10091 mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev, true, 10092 settings_rsp, &match); 10093 10094 if (changed) 10095 new_settings(hdev, match.sk); 10096 10097 if (match.sk) 10098 sock_put(match.sk); 10099 } 10100 10101 static void sk_lookup(struct mgmt_pending_cmd *cmd, void *data) 10102 { 10103 struct cmd_lookup *match = data; 10104 10105 if (match->sk == NULL) { 10106 match->sk = cmd->sk; 10107 sock_hold(match->sk); 10108 } 10109 } 10110 10111 void mgmt_set_class_of_dev_complete(struct hci_dev *hdev, u8 *dev_class, 10112 u8 status) 10113 { 10114 struct cmd_lookup match = { NULL, hdev, mgmt_status(status) }; 10115 10116 mgmt_pending_foreach(MGMT_OP_SET_DEV_CLASS, hdev, false, sk_lookup, 10117 &match); 10118 mgmt_pending_foreach(MGMT_OP_ADD_UUID, hdev, false, sk_lookup, 10119 &match); 10120 mgmt_pending_foreach(MGMT_OP_REMOVE_UUID, hdev, false, sk_lookup, 10121 &match); 10122 10123 if (!status) { 10124 mgmt_limited_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev, dev_class, 10125 3, HCI_MGMT_DEV_CLASS_EVENTS, NULL); 10126 ext_info_changed(hdev, NULL); 10127 } 10128 10129 if (match.sk) 10130 sock_put(match.sk); 10131 } 10132 10133 void mgmt_set_local_name_complete(struct hci_dev *hdev, u8 *name, u8 status) 10134 { 10135 struct mgmt_cp_set_local_name ev; 10136 struct mgmt_pending_cmd *cmd; 10137 10138 if (status) 10139 return; 10140 10141 memset(&ev, 0, sizeof(ev)); 10142 memcpy(ev.name, name, HCI_MAX_NAME_LENGTH); 10143 memcpy(ev.short_name, hdev->short_name, HCI_MAX_SHORT_NAME_LENGTH); 10144 10145 cmd = pending_find(MGMT_OP_SET_LOCAL_NAME, hdev); 10146 if (!cmd) { 10147 memcpy(hdev->dev_name, name, sizeof(hdev->dev_name)); 10148 10149 /* If this is a HCI command related to powering on the 10150 * HCI dev don't send any mgmt signals. 10151 */ 10152 if (hci_dev_test_flag(hdev, HCI_POWERING_DOWN)) 10153 return; 10154 10155 if (pending_find(MGMT_OP_SET_POWERED, hdev)) 10156 return; 10157 } 10158 10159 mgmt_limited_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, &ev, sizeof(ev), 10160 HCI_MGMT_LOCAL_NAME_EVENTS, cmd ? cmd->sk : NULL); 10161 ext_info_changed(hdev, cmd ? cmd->sk : NULL); 10162 } 10163 10164 static inline bool has_uuid(u8 *uuid, u16 uuid_count, u8 (*uuids)[16]) 10165 { 10166 int i; 10167 10168 for (i = 0; i < uuid_count; i++) { 10169 if (!memcmp(uuid, uuids[i], 16)) 10170 return true; 10171 } 10172 10173 return false; 10174 } 10175 10176 static bool eir_has_uuids(u8 *eir, u16 eir_len, u16 uuid_count, u8 (*uuids)[16]) 10177 { 10178 u16 parsed = 0; 10179 10180 while (parsed < eir_len) { 10181 u8 field_len = eir[0]; 10182 u8 uuid[16]; 10183 int i; 10184 10185 if (field_len == 0) 10186 break; 10187 10188 if (eir_len - parsed < field_len + 1) 10189 break; 10190 10191 switch (eir[1]) { 10192 case EIR_UUID16_ALL: 10193 case EIR_UUID16_SOME: 10194 for (i = 0; i + 3 <= field_len; i += 2) { 10195 memcpy(uuid, bluetooth_base_uuid, 16); 10196 uuid[13] = eir[i + 3]; 10197 uuid[12] = eir[i + 2]; 10198 if (has_uuid(uuid, uuid_count, uuids)) 10199 return true; 10200 } 10201 break; 10202 case EIR_UUID32_ALL: 10203 case EIR_UUID32_SOME: 10204 for (i = 0; i + 5 <= field_len; i += 4) { 10205 memcpy(uuid, bluetooth_base_uuid, 16); 10206 uuid[15] = eir[i + 5]; 10207 uuid[14] = eir[i + 4]; 10208 uuid[13] = eir[i + 3]; 10209 uuid[12] = eir[i + 2]; 10210 if (has_uuid(uuid, uuid_count, uuids)) 10211 return true; 10212 } 10213 break; 10214 case EIR_UUID128_ALL: 10215 case EIR_UUID128_SOME: 10216 for (i = 0; i + 17 <= field_len; i += 16) { 10217 memcpy(uuid, eir + i + 2, 16); 10218 if (has_uuid(uuid, uuid_count, uuids)) 10219 return true; 10220 } 10221 break; 10222 } 10223 10224 parsed += field_len + 1; 10225 eir += field_len + 1; 10226 } 10227 10228 return false; 10229 } 10230 10231 static bool is_filter_match(struct hci_dev *hdev, s8 rssi, u8 *eir, 10232 u16 eir_len, u8 *scan_rsp, u8 scan_rsp_len) 10233 { 10234 /* If a RSSI threshold has been specified, and 10235 * HCI_QUIRK_STRICT_DUPLICATE_FILTER is not set, then all results with 10236 * a RSSI smaller than the RSSI threshold will be dropped. If the quirk 10237 * is set, let it through for further processing, as we might need to 10238 * restart the scan. 10239 * 10240 * For BR/EDR devices (pre 1.2) providing no RSSI during inquiry, 10241 * the results are also dropped. 10242 */ 10243 if (hdev->discovery.rssi != HCI_RSSI_INVALID && 10244 (rssi == HCI_RSSI_INVALID || 10245 (rssi < hdev->discovery.rssi && 10246 !hci_test_quirk(hdev, HCI_QUIRK_STRICT_DUPLICATE_FILTER)))) 10247 return false; 10248 10249 if (hdev->discovery.uuid_count != 0) { 10250 /* If a list of UUIDs is provided in filter, results with no 10251 * matching UUID should be dropped. 10252 */ 10253 if (!eir_has_uuids(eir, eir_len, hdev->discovery.uuid_count, 10254 hdev->discovery.uuids) && 10255 !eir_has_uuids(scan_rsp, scan_rsp_len, 10256 hdev->discovery.uuid_count, 10257 hdev->discovery.uuids)) 10258 return false; 10259 } 10260 10261 /* If duplicate filtering does not report RSSI changes, then restart 10262 * scanning to ensure updated result with updated RSSI values. 10263 */ 10264 if (hci_test_quirk(hdev, HCI_QUIRK_STRICT_DUPLICATE_FILTER)) { 10265 /* Validate RSSI value against the RSSI threshold once more. */ 10266 if (hdev->discovery.rssi != HCI_RSSI_INVALID && 10267 rssi < hdev->discovery.rssi) 10268 return false; 10269 } 10270 10271 return true; 10272 } 10273 10274 void mgmt_adv_monitor_device_lost(struct hci_dev *hdev, u16 handle, 10275 bdaddr_t *bdaddr, u8 addr_type) 10276 { 10277 struct mgmt_ev_adv_monitor_device_lost ev; 10278 10279 ev.monitor_handle = cpu_to_le16(handle); 10280 bacpy(&ev.addr.bdaddr, bdaddr); 10281 ev.addr.type = addr_type; 10282 10283 mgmt_event(MGMT_EV_ADV_MONITOR_DEVICE_LOST, hdev, &ev, sizeof(ev), 10284 NULL); 10285 } 10286 10287 static void mgmt_send_adv_monitor_device_found(struct hci_dev *hdev, 10288 struct sk_buff *skb, 10289 struct sock *skip_sk, 10290 u16 handle) 10291 { 10292 struct sk_buff *advmon_skb; 10293 size_t advmon_skb_len; 10294 __le16 *monitor_handle; 10295 10296 if (!skb) 10297 return; 10298 10299 advmon_skb_len = (sizeof(struct mgmt_ev_adv_monitor_device_found) - 10300 sizeof(struct mgmt_ev_device_found)) + skb->len; 10301 advmon_skb = mgmt_alloc_skb(hdev, MGMT_EV_ADV_MONITOR_DEVICE_FOUND, 10302 advmon_skb_len); 10303 if (!advmon_skb) 10304 return; 10305 10306 /* ADV_MONITOR_DEVICE_FOUND is similar to DEVICE_FOUND event except 10307 * that it also has 'monitor_handle'. Make a copy of DEVICE_FOUND and 10308 * store monitor_handle of the matched monitor. 10309 */ 10310 monitor_handle = skb_put(advmon_skb, sizeof(*monitor_handle)); 10311 *monitor_handle = cpu_to_le16(handle); 10312 skb_put_data(advmon_skb, skb->data, skb->len); 10313 10314 mgmt_event_skb(advmon_skb, skip_sk); 10315 } 10316 10317 static void mgmt_adv_monitor_device_found(struct hci_dev *hdev, 10318 bdaddr_t *bdaddr, bool report_device, 10319 struct sk_buff *skb, 10320 struct sock *skip_sk) 10321 { 10322 struct monitored_device *dev, *tmp; 10323 bool matched = false; 10324 bool notified = false; 10325 10326 /* We have received the Advertisement Report because: 10327 * 1. the kernel has initiated active discovery 10328 * 2. if not, we have pend_le_reports > 0 in which case we are doing 10329 * passive scanning 10330 * 3. if none of the above is true, we have one or more active 10331 * Advertisement Monitor 10332 * 10333 * For case 1 and 2, report all advertisements via MGMT_EV_DEVICE_FOUND 10334 * and report ONLY one advertisement per device for the matched Monitor 10335 * via MGMT_EV_ADV_MONITOR_DEVICE_FOUND event. 10336 * 10337 * For case 3, since we are not active scanning and all advertisements 10338 * received are due to a matched Advertisement Monitor, report all 10339 * advertisements ONLY via MGMT_EV_ADV_MONITOR_DEVICE_FOUND event. 10340 */ 10341 if (report_device && !hdev->advmon_pend_notify) { 10342 mgmt_event_skb(skb, skip_sk); 10343 return; 10344 } 10345 10346 hdev->advmon_pend_notify = false; 10347 10348 list_for_each_entry_safe(dev, tmp, &hdev->monitored_devices, list) { 10349 if (!bacmp(&dev->bdaddr, bdaddr)) { 10350 matched = true; 10351 10352 if (!dev->notified) { 10353 mgmt_send_adv_monitor_device_found(hdev, skb, 10354 skip_sk, 10355 dev->handle); 10356 notified = true; 10357 dev->notified = true; 10358 } 10359 } 10360 10361 if (!dev->notified) 10362 hdev->advmon_pend_notify = true; 10363 } 10364 10365 if (!report_device && 10366 ((matched && !notified) || !msft_monitor_supported(hdev))) { 10367 /* Handle 0 indicates that we are not active scanning and this 10368 * is a subsequent advertisement report for an already matched 10369 * Advertisement Monitor or the controller offloading support 10370 * is not available. 10371 */ 10372 mgmt_send_adv_monitor_device_found(hdev, skb, skip_sk, 0); 10373 } 10374 10375 if (report_device) 10376 mgmt_event_skb(skb, skip_sk); 10377 else 10378 kfree_skb(skb); 10379 } 10380 10381 static void mesh_device_found(struct hci_dev *hdev, bdaddr_t *bdaddr, 10382 u8 addr_type, s8 rssi, u32 flags, u8 *eir, 10383 u16 eir_len, u8 *scan_rsp, u8 scan_rsp_len, 10384 u64 instant) 10385 { 10386 struct sk_buff *skb; 10387 struct mgmt_ev_mesh_device_found *ev; 10388 int i, j; 10389 10390 if (!hdev->mesh_ad_types[0]) 10391 goto accepted; 10392 10393 /* Scan for requested AD types */ 10394 if (eir_len > 0) { 10395 for (i = 0; i + 1 < eir_len; i += eir[i] + 1) { 10396 for (j = 0; j < sizeof(hdev->mesh_ad_types); j++) { 10397 if (!hdev->mesh_ad_types[j]) 10398 break; 10399 10400 if (hdev->mesh_ad_types[j] == eir[i + 1]) 10401 goto accepted; 10402 } 10403 } 10404 } 10405 10406 if (scan_rsp_len > 0) { 10407 for (i = 0; i + 1 < scan_rsp_len; i += scan_rsp[i] + 1) { 10408 for (j = 0; j < sizeof(hdev->mesh_ad_types); j++) { 10409 if (!hdev->mesh_ad_types[j]) 10410 break; 10411 10412 if (hdev->mesh_ad_types[j] == scan_rsp[i + 1]) 10413 goto accepted; 10414 } 10415 } 10416 } 10417 10418 return; 10419 10420 accepted: 10421 skb = mgmt_alloc_skb(hdev, MGMT_EV_MESH_DEVICE_FOUND, 10422 sizeof(*ev) + eir_len + scan_rsp_len); 10423 if (!skb) 10424 return; 10425 10426 ev = skb_put(skb, sizeof(*ev)); 10427 10428 bacpy(&ev->addr.bdaddr, bdaddr); 10429 ev->addr.type = link_to_bdaddr(LE_LINK, addr_type); 10430 ev->rssi = rssi; 10431 ev->flags = cpu_to_le32(flags); 10432 ev->instant = cpu_to_le64(instant); 10433 10434 if (eir_len > 0) 10435 /* Copy EIR or advertising data into event */ 10436 skb_put_data(skb, eir, eir_len); 10437 10438 if (scan_rsp_len > 0) 10439 /* Append scan response data to event */ 10440 skb_put_data(skb, scan_rsp, scan_rsp_len); 10441 10442 ev->eir_len = cpu_to_le16(eir_len + scan_rsp_len); 10443 10444 mgmt_event_skb(skb, NULL); 10445 } 10446 10447 void mgmt_device_found(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type, 10448 u8 addr_type, u8 *dev_class, s8 rssi, u32 flags, 10449 u8 *eir, u16 eir_len, u8 *scan_rsp, u8 scan_rsp_len, 10450 u64 instant) 10451 { 10452 struct sk_buff *skb; 10453 struct mgmt_ev_device_found *ev; 10454 bool report_device = hci_discovery_active(hdev); 10455 10456 if (hci_dev_test_flag(hdev, HCI_MESH) && link_type == LE_LINK) 10457 mesh_device_found(hdev, bdaddr, addr_type, rssi, flags, 10458 eir, eir_len, scan_rsp, scan_rsp_len, 10459 instant); 10460 10461 /* Don't send events for a non-kernel initiated discovery. With 10462 * LE one exception is if we have pend_le_reports > 0 in which 10463 * case we're doing passive scanning and want these events. 10464 */ 10465 if (!hci_discovery_active(hdev)) { 10466 if (link_type == ACL_LINK) 10467 return; 10468 if (link_type == LE_LINK && !list_empty(&hdev->pend_le_reports)) 10469 report_device = true; 10470 else if (!hci_is_adv_monitoring(hdev)) 10471 return; 10472 } 10473 10474 if (hdev->discovery.result_filtering) { 10475 /* We are using service discovery */ 10476 if (!is_filter_match(hdev, rssi, eir, eir_len, scan_rsp, 10477 scan_rsp_len)) 10478 return; 10479 } 10480 10481 if (hdev->discovery.limited) { 10482 /* Check for limited discoverable bit */ 10483 if (dev_class) { 10484 if (!(dev_class[1] & 0x20)) 10485 return; 10486 } else { 10487 u8 *flags = eir_get_data(eir, eir_len, EIR_FLAGS, NULL); 10488 if (!flags || !(flags[0] & LE_AD_LIMITED)) 10489 return; 10490 } 10491 } 10492 10493 /* Allocate skb. The 5 extra bytes are for the potential CoD field */ 10494 skb = mgmt_alloc_skb(hdev, MGMT_EV_DEVICE_FOUND, 10495 sizeof(*ev) + eir_len + scan_rsp_len + 5); 10496 if (!skb) 10497 return; 10498 10499 ev = skb_put(skb, sizeof(*ev)); 10500 10501 /* In case of device discovery with BR/EDR devices (pre 1.2), the 10502 * RSSI value was reported as 0 when not available. This behavior 10503 * is kept when using device discovery. This is required for full 10504 * backwards compatibility with the API. 10505 * 10506 * However when using service discovery, the value 127 will be 10507 * returned when the RSSI is not available. 10508 */ 10509 if (rssi == HCI_RSSI_INVALID && !hdev->discovery.report_invalid_rssi && 10510 link_type == ACL_LINK) 10511 rssi = 0; 10512 10513 bacpy(&ev->addr.bdaddr, bdaddr); 10514 ev->addr.type = link_to_bdaddr(link_type, addr_type); 10515 ev->rssi = rssi; 10516 ev->flags = cpu_to_le32(flags); 10517 10518 if (eir_len > 0) 10519 /* Copy EIR or advertising data into event */ 10520 skb_put_data(skb, eir, eir_len); 10521 10522 if (dev_class && !eir_get_data(eir, eir_len, EIR_CLASS_OF_DEV, NULL)) { 10523 u8 eir_cod[5]; 10524 10525 eir_len += eir_append_data(eir_cod, 0, EIR_CLASS_OF_DEV, 10526 dev_class, 3); 10527 skb_put_data(skb, eir_cod, sizeof(eir_cod)); 10528 } 10529 10530 if (scan_rsp_len > 0) 10531 /* Append scan response data to event */ 10532 skb_put_data(skb, scan_rsp, scan_rsp_len); 10533 10534 ev->eir_len = cpu_to_le16(eir_len + scan_rsp_len); 10535 10536 mgmt_adv_monitor_device_found(hdev, bdaddr, report_device, skb, NULL); 10537 } 10538 10539 void mgmt_remote_name(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type, 10540 u8 addr_type, s8 rssi, u8 *name, u8 name_len) 10541 { 10542 struct sk_buff *skb; 10543 struct mgmt_ev_device_found *ev; 10544 u16 eir_len = 0; 10545 u32 flags = 0; 10546 10547 skb = mgmt_alloc_skb(hdev, MGMT_EV_DEVICE_FOUND, 10548 sizeof(*ev) + (name ? eir_precalc_len(name_len) : 0)); 10549 if (!skb) 10550 return; 10551 10552 ev = skb_put(skb, sizeof(*ev)); 10553 bacpy(&ev->addr.bdaddr, bdaddr); 10554 ev->addr.type = link_to_bdaddr(link_type, addr_type); 10555 ev->rssi = rssi; 10556 10557 if (name) 10558 eir_len += eir_skb_put_data(skb, EIR_NAME_COMPLETE, name, name_len); 10559 else 10560 flags = MGMT_DEV_FOUND_NAME_REQUEST_FAILED; 10561 10562 ev->eir_len = cpu_to_le16(eir_len); 10563 ev->flags = cpu_to_le32(flags); 10564 10565 mgmt_event_skb(skb, NULL); 10566 } 10567 10568 void mgmt_discovering(struct hci_dev *hdev, u8 discovering) 10569 { 10570 struct mgmt_ev_discovering ev; 10571 10572 bt_dev_dbg(hdev, "discovering %u", discovering); 10573 10574 memset(&ev, 0, sizeof(ev)); 10575 ev.type = hdev->discovery.type; 10576 ev.discovering = discovering; 10577 10578 mgmt_event(MGMT_EV_DISCOVERING, hdev, &ev, sizeof(ev), NULL); 10579 } 10580 10581 void mgmt_suspending(struct hci_dev *hdev, u8 state) 10582 { 10583 struct mgmt_ev_controller_suspend ev; 10584 10585 ev.suspend_state = state; 10586 mgmt_event(MGMT_EV_CONTROLLER_SUSPEND, hdev, &ev, sizeof(ev), NULL); 10587 } 10588 10589 void mgmt_resuming(struct hci_dev *hdev, u8 reason, bdaddr_t *bdaddr, 10590 u8 addr_type) 10591 { 10592 struct mgmt_ev_controller_resume ev; 10593 10594 ev.wake_reason = reason; 10595 if (bdaddr) { 10596 bacpy(&ev.addr.bdaddr, bdaddr); 10597 ev.addr.type = addr_type; 10598 } else { 10599 memset(&ev.addr, 0, sizeof(ev.addr)); 10600 } 10601 10602 mgmt_event(MGMT_EV_CONTROLLER_RESUME, hdev, &ev, sizeof(ev), NULL); 10603 } 10604 10605 static struct hci_mgmt_chan chan = { 10606 .channel = HCI_CHANNEL_CONTROL, 10607 .handler_count = ARRAY_SIZE(mgmt_handlers), 10608 .handlers = mgmt_handlers, 10609 .hdev_init = mgmt_init_hdev, 10610 }; 10611 10612 int mgmt_init(void) 10613 { 10614 return hci_mgmt_chan_register(&chan); 10615 } 10616 10617 void mgmt_exit(void) 10618 { 10619 hci_mgmt_chan_unregister(&chan); 10620 } 10621 10622 void mgmt_cleanup(struct sock *sk) 10623 { 10624 struct mgmt_mesh_tx *mesh_tx; 10625 struct hci_dev *hdev; 10626 10627 read_lock(&hci_dev_list_lock); 10628 10629 list_for_each_entry(hdev, &hci_dev_list, list) { 10630 do { 10631 mesh_tx = mgmt_mesh_next(hdev, sk); 10632 10633 if (mesh_tx) 10634 mesh_send_complete(hdev, mesh_tx, true); 10635 } while (mesh_tx); 10636 } 10637 10638 read_unlock(&hci_dev_list_lock); 10639 } 10640