1 // SPDX-License-Identifier: GPL-2.0 2 /* 3 BlueZ - Bluetooth protocol stack for Linux 4 5 Copyright (C) 2010 Nokia Corporation 6 Copyright (C) 2011-2012 Intel Corporation 7 8 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS 9 OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 10 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS. 11 IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY 12 CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES 13 WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN 14 ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF 15 OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. 16 17 ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS, 18 COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS 19 SOFTWARE IS DISCLAIMED. 20 */ 21 22 /* Bluetooth HCI Management interface */ 23 24 #include <linux/module.h> 25 #include <linux/unaligned.h> 26 27 #include <net/bluetooth/bluetooth.h> 28 #include <net/bluetooth/hci_core.h> 29 #include <net/bluetooth/hci_sock.h> 30 #include <net/bluetooth/l2cap.h> 31 #include <net/bluetooth/mgmt.h> 32 33 #include "smp.h" 34 #include "mgmt_util.h" 35 #include "mgmt_config.h" 36 #include "msft.h" 37 #include "eir.h" 38 #include "aosp.h" 39 40 #define MGMT_VERSION 1 41 #define MGMT_REVISION 23 42 43 static const u16 mgmt_commands[] = { 44 MGMT_OP_READ_INDEX_LIST, 45 MGMT_OP_READ_INFO, 46 MGMT_OP_SET_POWERED, 47 MGMT_OP_SET_DISCOVERABLE, 48 MGMT_OP_SET_CONNECTABLE, 49 MGMT_OP_SET_FAST_CONNECTABLE, 50 MGMT_OP_SET_BONDABLE, 51 MGMT_OP_SET_LINK_SECURITY, 52 MGMT_OP_SET_SSP, 53 MGMT_OP_SET_HS, 54 MGMT_OP_SET_LE, 55 MGMT_OP_SET_DEV_CLASS, 56 MGMT_OP_SET_LOCAL_NAME, 57 MGMT_OP_ADD_UUID, 58 MGMT_OP_REMOVE_UUID, 59 MGMT_OP_LOAD_LINK_KEYS, 60 MGMT_OP_LOAD_LONG_TERM_KEYS, 61 MGMT_OP_DISCONNECT, 62 MGMT_OP_GET_CONNECTIONS, 63 MGMT_OP_PIN_CODE_REPLY, 64 MGMT_OP_PIN_CODE_NEG_REPLY, 65 MGMT_OP_SET_IO_CAPABILITY, 66 MGMT_OP_PAIR_DEVICE, 67 MGMT_OP_CANCEL_PAIR_DEVICE, 68 MGMT_OP_UNPAIR_DEVICE, 69 MGMT_OP_USER_CONFIRM_REPLY, 70 MGMT_OP_USER_CONFIRM_NEG_REPLY, 71 MGMT_OP_USER_PASSKEY_REPLY, 72 MGMT_OP_USER_PASSKEY_NEG_REPLY, 73 MGMT_OP_READ_LOCAL_OOB_DATA, 74 MGMT_OP_ADD_REMOTE_OOB_DATA, 75 MGMT_OP_REMOVE_REMOTE_OOB_DATA, 76 MGMT_OP_START_DISCOVERY, 77 MGMT_OP_STOP_DISCOVERY, 78 MGMT_OP_CONFIRM_NAME, 79 MGMT_OP_BLOCK_DEVICE, 80 MGMT_OP_UNBLOCK_DEVICE, 81 MGMT_OP_SET_DEVICE_ID, 82 MGMT_OP_SET_ADVERTISING, 83 MGMT_OP_SET_BREDR, 84 MGMT_OP_SET_STATIC_ADDRESS, 85 MGMT_OP_SET_SCAN_PARAMS, 86 MGMT_OP_SET_SECURE_CONN, 87 MGMT_OP_SET_DEBUG_KEYS, 88 MGMT_OP_SET_PRIVACY, 89 MGMT_OP_LOAD_IRKS, 90 MGMT_OP_GET_CONN_INFO, 91 MGMT_OP_GET_CLOCK_INFO, 92 MGMT_OP_ADD_DEVICE, 93 MGMT_OP_REMOVE_DEVICE, 94 MGMT_OP_LOAD_CONN_PARAM, 95 MGMT_OP_READ_UNCONF_INDEX_LIST, 96 MGMT_OP_READ_CONFIG_INFO, 97 MGMT_OP_SET_EXTERNAL_CONFIG, 98 MGMT_OP_SET_PUBLIC_ADDRESS, 99 MGMT_OP_START_SERVICE_DISCOVERY, 100 MGMT_OP_READ_LOCAL_OOB_EXT_DATA, 101 MGMT_OP_READ_EXT_INDEX_LIST, 102 MGMT_OP_READ_ADV_FEATURES, 103 MGMT_OP_ADD_ADVERTISING, 104 MGMT_OP_REMOVE_ADVERTISING, 105 MGMT_OP_GET_ADV_SIZE_INFO, 106 MGMT_OP_START_LIMITED_DISCOVERY, 107 MGMT_OP_READ_EXT_INFO, 108 MGMT_OP_SET_APPEARANCE, 109 MGMT_OP_GET_PHY_CONFIGURATION, 110 MGMT_OP_SET_PHY_CONFIGURATION, 111 MGMT_OP_SET_BLOCKED_KEYS, 112 MGMT_OP_SET_WIDEBAND_SPEECH, 113 MGMT_OP_READ_CONTROLLER_CAP, 114 MGMT_OP_READ_EXP_FEATURES_INFO, 115 MGMT_OP_SET_EXP_FEATURE, 116 MGMT_OP_READ_DEF_SYSTEM_CONFIG, 117 MGMT_OP_SET_DEF_SYSTEM_CONFIG, 118 MGMT_OP_READ_DEF_RUNTIME_CONFIG, 119 MGMT_OP_SET_DEF_RUNTIME_CONFIG, 120 MGMT_OP_GET_DEVICE_FLAGS, 121 MGMT_OP_SET_DEVICE_FLAGS, 122 MGMT_OP_READ_ADV_MONITOR_FEATURES, 123 MGMT_OP_ADD_ADV_PATTERNS_MONITOR, 124 MGMT_OP_REMOVE_ADV_MONITOR, 125 MGMT_OP_ADD_EXT_ADV_PARAMS, 126 MGMT_OP_ADD_EXT_ADV_DATA, 127 MGMT_OP_ADD_ADV_PATTERNS_MONITOR_RSSI, 128 MGMT_OP_SET_MESH_RECEIVER, 129 MGMT_OP_MESH_READ_FEATURES, 130 MGMT_OP_MESH_SEND, 131 MGMT_OP_MESH_SEND_CANCEL, 132 MGMT_OP_HCI_CMD_SYNC, 133 }; 134 135 static const u16 mgmt_events[] = { 136 MGMT_EV_CONTROLLER_ERROR, 137 MGMT_EV_INDEX_ADDED, 138 MGMT_EV_INDEX_REMOVED, 139 MGMT_EV_NEW_SETTINGS, 140 MGMT_EV_CLASS_OF_DEV_CHANGED, 141 MGMT_EV_LOCAL_NAME_CHANGED, 142 MGMT_EV_NEW_LINK_KEY, 143 MGMT_EV_NEW_LONG_TERM_KEY, 144 MGMT_EV_DEVICE_CONNECTED, 145 MGMT_EV_DEVICE_DISCONNECTED, 146 MGMT_EV_CONNECT_FAILED, 147 MGMT_EV_PIN_CODE_REQUEST, 148 MGMT_EV_USER_CONFIRM_REQUEST, 149 MGMT_EV_USER_PASSKEY_REQUEST, 150 MGMT_EV_AUTH_FAILED, 151 MGMT_EV_DEVICE_FOUND, 152 MGMT_EV_DISCOVERING, 153 MGMT_EV_DEVICE_BLOCKED, 154 MGMT_EV_DEVICE_UNBLOCKED, 155 MGMT_EV_DEVICE_UNPAIRED, 156 MGMT_EV_PASSKEY_NOTIFY, 157 MGMT_EV_NEW_IRK, 158 MGMT_EV_NEW_CSRK, 159 MGMT_EV_DEVICE_ADDED, 160 MGMT_EV_DEVICE_REMOVED, 161 MGMT_EV_NEW_CONN_PARAM, 162 MGMT_EV_UNCONF_INDEX_ADDED, 163 MGMT_EV_UNCONF_INDEX_REMOVED, 164 MGMT_EV_NEW_CONFIG_OPTIONS, 165 MGMT_EV_EXT_INDEX_ADDED, 166 MGMT_EV_EXT_INDEX_REMOVED, 167 MGMT_EV_LOCAL_OOB_DATA_UPDATED, 168 MGMT_EV_ADVERTISING_ADDED, 169 MGMT_EV_ADVERTISING_REMOVED, 170 MGMT_EV_EXT_INFO_CHANGED, 171 MGMT_EV_PHY_CONFIGURATION_CHANGED, 172 MGMT_EV_EXP_FEATURE_CHANGED, 173 MGMT_EV_DEVICE_FLAGS_CHANGED, 174 MGMT_EV_ADV_MONITOR_ADDED, 175 MGMT_EV_ADV_MONITOR_REMOVED, 176 MGMT_EV_CONTROLLER_SUSPEND, 177 MGMT_EV_CONTROLLER_RESUME, 178 MGMT_EV_ADV_MONITOR_DEVICE_FOUND, 179 MGMT_EV_ADV_MONITOR_DEVICE_LOST, 180 }; 181 182 static const u16 mgmt_untrusted_commands[] = { 183 MGMT_OP_READ_INDEX_LIST, 184 MGMT_OP_READ_INFO, 185 MGMT_OP_READ_UNCONF_INDEX_LIST, 186 MGMT_OP_READ_CONFIG_INFO, 187 MGMT_OP_READ_EXT_INDEX_LIST, 188 MGMT_OP_READ_EXT_INFO, 189 MGMT_OP_READ_CONTROLLER_CAP, 190 MGMT_OP_READ_EXP_FEATURES_INFO, 191 MGMT_OP_READ_DEF_SYSTEM_CONFIG, 192 MGMT_OP_READ_DEF_RUNTIME_CONFIG, 193 }; 194 195 static const u16 mgmt_untrusted_events[] = { 196 MGMT_EV_INDEX_ADDED, 197 MGMT_EV_INDEX_REMOVED, 198 MGMT_EV_NEW_SETTINGS, 199 MGMT_EV_CLASS_OF_DEV_CHANGED, 200 MGMT_EV_LOCAL_NAME_CHANGED, 201 MGMT_EV_UNCONF_INDEX_ADDED, 202 MGMT_EV_UNCONF_INDEX_REMOVED, 203 MGMT_EV_NEW_CONFIG_OPTIONS, 204 MGMT_EV_EXT_INDEX_ADDED, 205 MGMT_EV_EXT_INDEX_REMOVED, 206 MGMT_EV_EXT_INFO_CHANGED, 207 MGMT_EV_EXP_FEATURE_CHANGED, 208 }; 209 210 #define CACHE_TIMEOUT secs_to_jiffies(2) 211 212 #define ZERO_KEY "\x00\x00\x00\x00\x00\x00\x00\x00" \ 213 "\x00\x00\x00\x00\x00\x00\x00\x00" 214 215 /* HCI to MGMT error code conversion table */ 216 static const u8 mgmt_status_table[] = { 217 MGMT_STATUS_SUCCESS, 218 MGMT_STATUS_UNKNOWN_COMMAND, /* Unknown Command */ 219 MGMT_STATUS_NOT_CONNECTED, /* No Connection */ 220 MGMT_STATUS_FAILED, /* Hardware Failure */ 221 MGMT_STATUS_CONNECT_FAILED, /* Page Timeout */ 222 MGMT_STATUS_AUTH_FAILED, /* Authentication Failed */ 223 MGMT_STATUS_AUTH_FAILED, /* PIN or Key Missing */ 224 MGMT_STATUS_NO_RESOURCES, /* Memory Full */ 225 MGMT_STATUS_TIMEOUT, /* Connection Timeout */ 226 MGMT_STATUS_NO_RESOURCES, /* Max Number of Connections */ 227 MGMT_STATUS_NO_RESOURCES, /* Max Number of SCO Connections */ 228 MGMT_STATUS_ALREADY_CONNECTED, /* ACL Connection Exists */ 229 MGMT_STATUS_BUSY, /* Command Disallowed */ 230 MGMT_STATUS_NO_RESOURCES, /* Rejected Limited Resources */ 231 MGMT_STATUS_REJECTED, /* Rejected Security */ 232 MGMT_STATUS_REJECTED, /* Rejected Personal */ 233 MGMT_STATUS_TIMEOUT, /* Host Timeout */ 234 MGMT_STATUS_NOT_SUPPORTED, /* Unsupported Feature */ 235 MGMT_STATUS_INVALID_PARAMS, /* Invalid Parameters */ 236 MGMT_STATUS_DISCONNECTED, /* OE User Ended Connection */ 237 MGMT_STATUS_NO_RESOURCES, /* OE Low Resources */ 238 MGMT_STATUS_DISCONNECTED, /* OE Power Off */ 239 MGMT_STATUS_DISCONNECTED, /* Connection Terminated */ 240 MGMT_STATUS_BUSY, /* Repeated Attempts */ 241 MGMT_STATUS_REJECTED, /* Pairing Not Allowed */ 242 MGMT_STATUS_FAILED, /* Unknown LMP PDU */ 243 MGMT_STATUS_NOT_SUPPORTED, /* Unsupported Remote Feature */ 244 MGMT_STATUS_REJECTED, /* SCO Offset Rejected */ 245 MGMT_STATUS_REJECTED, /* SCO Interval Rejected */ 246 MGMT_STATUS_REJECTED, /* Air Mode Rejected */ 247 MGMT_STATUS_INVALID_PARAMS, /* Invalid LMP Parameters */ 248 MGMT_STATUS_FAILED, /* Unspecified Error */ 249 MGMT_STATUS_NOT_SUPPORTED, /* Unsupported LMP Parameter Value */ 250 MGMT_STATUS_FAILED, /* Role Change Not Allowed */ 251 MGMT_STATUS_TIMEOUT, /* LMP Response Timeout */ 252 MGMT_STATUS_FAILED, /* LMP Error Transaction Collision */ 253 MGMT_STATUS_FAILED, /* LMP PDU Not Allowed */ 254 MGMT_STATUS_REJECTED, /* Encryption Mode Not Accepted */ 255 MGMT_STATUS_FAILED, /* Unit Link Key Used */ 256 MGMT_STATUS_NOT_SUPPORTED, /* QoS Not Supported */ 257 MGMT_STATUS_TIMEOUT, /* Instant Passed */ 258 MGMT_STATUS_NOT_SUPPORTED, /* Pairing Not Supported */ 259 MGMT_STATUS_FAILED, /* Transaction Collision */ 260 MGMT_STATUS_FAILED, /* Reserved for future use */ 261 MGMT_STATUS_INVALID_PARAMS, /* Unacceptable Parameter */ 262 MGMT_STATUS_REJECTED, /* QoS Rejected */ 263 MGMT_STATUS_NOT_SUPPORTED, /* Classification Not Supported */ 264 MGMT_STATUS_REJECTED, /* Insufficient Security */ 265 MGMT_STATUS_INVALID_PARAMS, /* Parameter Out Of Range */ 266 MGMT_STATUS_FAILED, /* Reserved for future use */ 267 MGMT_STATUS_BUSY, /* Role Switch Pending */ 268 MGMT_STATUS_FAILED, /* Reserved for future use */ 269 MGMT_STATUS_FAILED, /* Slot Violation */ 270 MGMT_STATUS_FAILED, /* Role Switch Failed */ 271 MGMT_STATUS_INVALID_PARAMS, /* EIR Too Large */ 272 MGMT_STATUS_NOT_SUPPORTED, /* Simple Pairing Not Supported */ 273 MGMT_STATUS_BUSY, /* Host Busy Pairing */ 274 MGMT_STATUS_REJECTED, /* Rejected, No Suitable Channel */ 275 MGMT_STATUS_BUSY, /* Controller Busy */ 276 MGMT_STATUS_INVALID_PARAMS, /* Unsuitable Connection Interval */ 277 MGMT_STATUS_TIMEOUT, /* Directed Advertising Timeout */ 278 MGMT_STATUS_AUTH_FAILED, /* Terminated Due to MIC Failure */ 279 MGMT_STATUS_CONNECT_FAILED, /* Connection Establishment Failed */ 280 MGMT_STATUS_CONNECT_FAILED, /* MAC Connection Failed */ 281 }; 282 283 static u8 mgmt_errno_status(int err) 284 { 285 switch (err) { 286 case 0: 287 return MGMT_STATUS_SUCCESS; 288 case -EPERM: 289 return MGMT_STATUS_REJECTED; 290 case -EINVAL: 291 return MGMT_STATUS_INVALID_PARAMS; 292 case -EOPNOTSUPP: 293 return MGMT_STATUS_NOT_SUPPORTED; 294 case -EBUSY: 295 return MGMT_STATUS_BUSY; 296 case -ETIMEDOUT: 297 return MGMT_STATUS_AUTH_FAILED; 298 case -ENOMEM: 299 return MGMT_STATUS_NO_RESOURCES; 300 case -EISCONN: 301 return MGMT_STATUS_ALREADY_CONNECTED; 302 case -ENOTCONN: 303 return MGMT_STATUS_DISCONNECTED; 304 } 305 306 return MGMT_STATUS_FAILED; 307 } 308 309 static u8 mgmt_status(int err) 310 { 311 if (err < 0) 312 return mgmt_errno_status(err); 313 314 if (err < ARRAY_SIZE(mgmt_status_table)) 315 return mgmt_status_table[err]; 316 317 return MGMT_STATUS_FAILED; 318 } 319 320 static int mgmt_index_event(u16 event, struct hci_dev *hdev, void *data, 321 u16 len, int flag) 322 { 323 return mgmt_send_event(event, hdev, HCI_CHANNEL_CONTROL, data, len, 324 flag, NULL); 325 } 326 327 static int mgmt_limited_event(u16 event, struct hci_dev *hdev, void *data, 328 u16 len, int flag, struct sock *skip_sk) 329 { 330 return mgmt_send_event(event, hdev, HCI_CHANNEL_CONTROL, data, len, 331 flag, skip_sk); 332 } 333 334 static int mgmt_event(u16 event, struct hci_dev *hdev, void *data, u16 len, 335 struct sock *skip_sk) 336 { 337 return mgmt_send_event(event, hdev, HCI_CHANNEL_CONTROL, data, len, 338 HCI_SOCK_TRUSTED, skip_sk); 339 } 340 341 static int mgmt_event_skb(struct sk_buff *skb, struct sock *skip_sk) 342 { 343 return mgmt_send_event_skb(HCI_CHANNEL_CONTROL, skb, HCI_SOCK_TRUSTED, 344 skip_sk); 345 } 346 347 static u8 le_addr_type(u8 mgmt_addr_type) 348 { 349 if (mgmt_addr_type == BDADDR_LE_PUBLIC) 350 return ADDR_LE_DEV_PUBLIC; 351 else 352 return ADDR_LE_DEV_RANDOM; 353 } 354 355 void mgmt_fill_version_info(void *ver) 356 { 357 struct mgmt_rp_read_version *rp = ver; 358 359 rp->version = MGMT_VERSION; 360 rp->revision = cpu_to_le16(MGMT_REVISION); 361 } 362 363 static int read_version(struct sock *sk, struct hci_dev *hdev, void *data, 364 u16 data_len) 365 { 366 struct mgmt_rp_read_version rp; 367 368 bt_dev_dbg(hdev, "sock %p", sk); 369 370 mgmt_fill_version_info(&rp); 371 372 return mgmt_cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_VERSION, 0, 373 &rp, sizeof(rp)); 374 } 375 376 static int read_commands(struct sock *sk, struct hci_dev *hdev, void *data, 377 u16 data_len) 378 { 379 struct mgmt_rp_read_commands *rp; 380 u16 num_commands, num_events; 381 size_t rp_size; 382 int i, err; 383 384 bt_dev_dbg(hdev, "sock %p", sk); 385 386 if (hci_sock_test_flag(sk, HCI_SOCK_TRUSTED)) { 387 num_commands = ARRAY_SIZE(mgmt_commands); 388 num_events = ARRAY_SIZE(mgmt_events); 389 } else { 390 num_commands = ARRAY_SIZE(mgmt_untrusted_commands); 391 num_events = ARRAY_SIZE(mgmt_untrusted_events); 392 } 393 394 rp_size = sizeof(*rp) + ((num_commands + num_events) * sizeof(u16)); 395 396 rp = kmalloc(rp_size, GFP_KERNEL); 397 if (!rp) 398 return -ENOMEM; 399 400 rp->num_commands = cpu_to_le16(num_commands); 401 rp->num_events = cpu_to_le16(num_events); 402 403 if (hci_sock_test_flag(sk, HCI_SOCK_TRUSTED)) { 404 __le16 *opcode = rp->opcodes; 405 406 for (i = 0; i < num_commands; i++, opcode++) 407 put_unaligned_le16(mgmt_commands[i], opcode); 408 409 for (i = 0; i < num_events; i++, opcode++) 410 put_unaligned_le16(mgmt_events[i], opcode); 411 } else { 412 __le16 *opcode = rp->opcodes; 413 414 for (i = 0; i < num_commands; i++, opcode++) 415 put_unaligned_le16(mgmt_untrusted_commands[i], opcode); 416 417 for (i = 0; i < num_events; i++, opcode++) 418 put_unaligned_le16(mgmt_untrusted_events[i], opcode); 419 } 420 421 err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_COMMANDS, 0, 422 rp, rp_size); 423 kfree(rp); 424 425 return err; 426 } 427 428 static int read_index_list(struct sock *sk, struct hci_dev *hdev, void *data, 429 u16 data_len) 430 { 431 struct mgmt_rp_read_index_list *rp; 432 struct hci_dev *d; 433 size_t rp_len; 434 u16 count; 435 int err; 436 437 bt_dev_dbg(hdev, "sock %p", sk); 438 439 read_lock(&hci_dev_list_lock); 440 441 count = 0; 442 list_for_each_entry(d, &hci_dev_list, list) { 443 if (!hci_dev_test_flag(d, HCI_UNCONFIGURED)) 444 count++; 445 } 446 447 rp_len = sizeof(*rp) + (2 * count); 448 rp = kmalloc(rp_len, GFP_ATOMIC); 449 if (!rp) { 450 read_unlock(&hci_dev_list_lock); 451 return -ENOMEM; 452 } 453 454 count = 0; 455 list_for_each_entry(d, &hci_dev_list, list) { 456 if (hci_dev_test_flag(d, HCI_SETUP) || 457 hci_dev_test_flag(d, HCI_CONFIG) || 458 hci_dev_test_flag(d, HCI_USER_CHANNEL)) 459 continue; 460 461 /* Devices marked as raw-only are neither configured 462 * nor unconfigured controllers. 463 */ 464 if (hci_test_quirk(d, HCI_QUIRK_RAW_DEVICE)) 465 continue; 466 467 if (!hci_dev_test_flag(d, HCI_UNCONFIGURED)) { 468 rp->index[count++] = cpu_to_le16(d->id); 469 bt_dev_dbg(hdev, "Added hci%u", d->id); 470 } 471 } 472 473 rp->num_controllers = cpu_to_le16(count); 474 rp_len = sizeof(*rp) + (2 * count); 475 476 read_unlock(&hci_dev_list_lock); 477 478 err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_INDEX_LIST, 479 0, rp, rp_len); 480 481 kfree(rp); 482 483 return err; 484 } 485 486 static int read_unconf_index_list(struct sock *sk, struct hci_dev *hdev, 487 void *data, u16 data_len) 488 { 489 struct mgmt_rp_read_unconf_index_list *rp; 490 struct hci_dev *d; 491 size_t rp_len; 492 u16 count; 493 int err; 494 495 bt_dev_dbg(hdev, "sock %p", sk); 496 497 read_lock(&hci_dev_list_lock); 498 499 count = 0; 500 list_for_each_entry(d, &hci_dev_list, list) { 501 if (hci_dev_test_flag(d, HCI_UNCONFIGURED)) 502 count++; 503 } 504 505 rp_len = sizeof(*rp) + (2 * count); 506 rp = kmalloc(rp_len, GFP_ATOMIC); 507 if (!rp) { 508 read_unlock(&hci_dev_list_lock); 509 return -ENOMEM; 510 } 511 512 count = 0; 513 list_for_each_entry(d, &hci_dev_list, list) { 514 if (hci_dev_test_flag(d, HCI_SETUP) || 515 hci_dev_test_flag(d, HCI_CONFIG) || 516 hci_dev_test_flag(d, HCI_USER_CHANNEL)) 517 continue; 518 519 /* Devices marked as raw-only are neither configured 520 * nor unconfigured controllers. 521 */ 522 if (hci_test_quirk(d, HCI_QUIRK_RAW_DEVICE)) 523 continue; 524 525 if (hci_dev_test_flag(d, HCI_UNCONFIGURED)) { 526 rp->index[count++] = cpu_to_le16(d->id); 527 bt_dev_dbg(hdev, "Added hci%u", d->id); 528 } 529 } 530 531 rp->num_controllers = cpu_to_le16(count); 532 rp_len = sizeof(*rp) + (2 * count); 533 534 read_unlock(&hci_dev_list_lock); 535 536 err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE, 537 MGMT_OP_READ_UNCONF_INDEX_LIST, 0, rp, rp_len); 538 539 kfree(rp); 540 541 return err; 542 } 543 544 static int read_ext_index_list(struct sock *sk, struct hci_dev *hdev, 545 void *data, u16 data_len) 546 { 547 struct mgmt_rp_read_ext_index_list *rp; 548 struct hci_dev *d; 549 u16 count; 550 int err; 551 552 bt_dev_dbg(hdev, "sock %p", sk); 553 554 read_lock(&hci_dev_list_lock); 555 556 count = 0; 557 list_for_each_entry(d, &hci_dev_list, list) 558 count++; 559 560 rp = kmalloc_flex(*rp, entry, count, GFP_ATOMIC); 561 if (!rp) { 562 read_unlock(&hci_dev_list_lock); 563 return -ENOMEM; 564 } 565 566 count = 0; 567 list_for_each_entry(d, &hci_dev_list, list) { 568 if (hci_dev_test_flag(d, HCI_SETUP) || 569 hci_dev_test_flag(d, HCI_CONFIG) || 570 hci_dev_test_flag(d, HCI_USER_CHANNEL)) 571 continue; 572 573 /* Devices marked as raw-only are neither configured 574 * nor unconfigured controllers. 575 */ 576 if (hci_test_quirk(d, HCI_QUIRK_RAW_DEVICE)) 577 continue; 578 579 if (hci_dev_test_flag(d, HCI_UNCONFIGURED)) 580 rp->entry[count].type = 0x01; 581 else 582 rp->entry[count].type = 0x00; 583 584 rp->entry[count].bus = d->bus; 585 rp->entry[count++].index = cpu_to_le16(d->id); 586 bt_dev_dbg(hdev, "Added hci%u", d->id); 587 } 588 589 rp->num_controllers = cpu_to_le16(count); 590 591 read_unlock(&hci_dev_list_lock); 592 593 /* If this command is called at least once, then all the 594 * default index and unconfigured index events are disabled 595 * and from now on only extended index events are used. 596 */ 597 hci_sock_set_flag(sk, HCI_MGMT_EXT_INDEX_EVENTS); 598 hci_sock_clear_flag(sk, HCI_MGMT_INDEX_EVENTS); 599 hci_sock_clear_flag(sk, HCI_MGMT_UNCONF_INDEX_EVENTS); 600 601 err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE, 602 MGMT_OP_READ_EXT_INDEX_LIST, 0, rp, 603 struct_size(rp, entry, count)); 604 605 kfree(rp); 606 607 return err; 608 } 609 610 static bool is_configured(struct hci_dev *hdev) 611 { 612 if (hci_test_quirk(hdev, HCI_QUIRK_EXTERNAL_CONFIG) && 613 !hci_dev_test_flag(hdev, HCI_EXT_CONFIGURED)) 614 return false; 615 616 if ((hci_test_quirk(hdev, HCI_QUIRK_INVALID_BDADDR) || 617 hci_test_quirk(hdev, HCI_QUIRK_USE_BDADDR_PROPERTY)) && 618 !bacmp(&hdev->public_addr, BDADDR_ANY)) 619 return false; 620 621 return true; 622 } 623 624 static __le32 get_missing_options(struct hci_dev *hdev) 625 { 626 u32 options = 0; 627 628 if (hci_test_quirk(hdev, HCI_QUIRK_EXTERNAL_CONFIG) && 629 !hci_dev_test_flag(hdev, HCI_EXT_CONFIGURED)) 630 options |= MGMT_OPTION_EXTERNAL_CONFIG; 631 632 if ((hci_test_quirk(hdev, HCI_QUIRK_INVALID_BDADDR) || 633 hci_test_quirk(hdev, HCI_QUIRK_USE_BDADDR_PROPERTY)) && 634 !bacmp(&hdev->public_addr, BDADDR_ANY)) 635 options |= MGMT_OPTION_PUBLIC_ADDRESS; 636 637 return cpu_to_le32(options); 638 } 639 640 static int new_options(struct hci_dev *hdev, struct sock *skip) 641 { 642 __le32 options = get_missing_options(hdev); 643 644 return mgmt_limited_event(MGMT_EV_NEW_CONFIG_OPTIONS, hdev, &options, 645 sizeof(options), HCI_MGMT_OPTION_EVENTS, skip); 646 } 647 648 static int send_options_rsp(struct sock *sk, u16 opcode, struct hci_dev *hdev) 649 { 650 __le32 options = get_missing_options(hdev); 651 652 return mgmt_cmd_complete(sk, hdev->id, opcode, 0, &options, 653 sizeof(options)); 654 } 655 656 static int read_config_info(struct sock *sk, struct hci_dev *hdev, 657 void *data, u16 data_len) 658 { 659 struct mgmt_rp_read_config_info rp; 660 u32 options = 0; 661 662 bt_dev_dbg(hdev, "sock %p", sk); 663 664 hci_dev_lock(hdev); 665 666 memset(&rp, 0, sizeof(rp)); 667 rp.manufacturer = cpu_to_le16(hdev->manufacturer); 668 669 if (hci_test_quirk(hdev, HCI_QUIRK_EXTERNAL_CONFIG)) 670 options |= MGMT_OPTION_EXTERNAL_CONFIG; 671 672 if (hdev->set_bdaddr) 673 options |= MGMT_OPTION_PUBLIC_ADDRESS; 674 675 rp.supported_options = cpu_to_le32(options); 676 rp.missing_options = get_missing_options(hdev); 677 678 hci_dev_unlock(hdev); 679 680 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_CONFIG_INFO, 0, 681 &rp, sizeof(rp)); 682 } 683 684 static u32 get_supported_phys(struct hci_dev *hdev) 685 { 686 u32 supported_phys = 0; 687 688 if (lmp_bredr_capable(hdev)) { 689 supported_phys |= MGMT_PHY_BR_1M_1SLOT; 690 691 if (hdev->features[0][0] & LMP_3SLOT) 692 supported_phys |= MGMT_PHY_BR_1M_3SLOT; 693 694 if (hdev->features[0][0] & LMP_5SLOT) 695 supported_phys |= MGMT_PHY_BR_1M_5SLOT; 696 697 if (lmp_edr_2m_capable(hdev)) { 698 supported_phys |= MGMT_PHY_EDR_2M_1SLOT; 699 700 if (lmp_edr_3slot_capable(hdev)) 701 supported_phys |= MGMT_PHY_EDR_2M_3SLOT; 702 703 if (lmp_edr_5slot_capable(hdev)) 704 supported_phys |= MGMT_PHY_EDR_2M_5SLOT; 705 706 if (lmp_edr_3m_capable(hdev)) { 707 supported_phys |= MGMT_PHY_EDR_3M_1SLOT; 708 709 if (lmp_edr_3slot_capable(hdev)) 710 supported_phys |= MGMT_PHY_EDR_3M_3SLOT; 711 712 if (lmp_edr_5slot_capable(hdev)) 713 supported_phys |= MGMT_PHY_EDR_3M_5SLOT; 714 } 715 } 716 } 717 718 if (lmp_le_capable(hdev)) { 719 supported_phys |= MGMT_PHY_LE_1M_TX; 720 supported_phys |= MGMT_PHY_LE_1M_RX; 721 722 if (hdev->le_features[1] & HCI_LE_PHY_2M) { 723 supported_phys |= MGMT_PHY_LE_2M_TX; 724 supported_phys |= MGMT_PHY_LE_2M_RX; 725 } 726 727 if (hdev->le_features[1] & HCI_LE_PHY_CODED) { 728 supported_phys |= MGMT_PHY_LE_CODED_TX; 729 supported_phys |= MGMT_PHY_LE_CODED_RX; 730 } 731 } 732 733 return supported_phys; 734 } 735 736 static u32 get_selected_phys(struct hci_dev *hdev) 737 { 738 u32 selected_phys = 0; 739 740 if (lmp_bredr_capable(hdev)) { 741 selected_phys |= MGMT_PHY_BR_1M_1SLOT; 742 743 if (hdev->pkt_type & (HCI_DM3 | HCI_DH3)) 744 selected_phys |= MGMT_PHY_BR_1M_3SLOT; 745 746 if (hdev->pkt_type & (HCI_DM5 | HCI_DH5)) 747 selected_phys |= MGMT_PHY_BR_1M_5SLOT; 748 749 if (lmp_edr_2m_capable(hdev)) { 750 if (!(hdev->pkt_type & HCI_2DH1)) 751 selected_phys |= MGMT_PHY_EDR_2M_1SLOT; 752 753 if (lmp_edr_3slot_capable(hdev) && 754 !(hdev->pkt_type & HCI_2DH3)) 755 selected_phys |= MGMT_PHY_EDR_2M_3SLOT; 756 757 if (lmp_edr_5slot_capable(hdev) && 758 !(hdev->pkt_type & HCI_2DH5)) 759 selected_phys |= MGMT_PHY_EDR_2M_5SLOT; 760 761 if (lmp_edr_3m_capable(hdev)) { 762 if (!(hdev->pkt_type & HCI_3DH1)) 763 selected_phys |= MGMT_PHY_EDR_3M_1SLOT; 764 765 if (lmp_edr_3slot_capable(hdev) && 766 !(hdev->pkt_type & HCI_3DH3)) 767 selected_phys |= MGMT_PHY_EDR_3M_3SLOT; 768 769 if (lmp_edr_5slot_capable(hdev) && 770 !(hdev->pkt_type & HCI_3DH5)) 771 selected_phys |= MGMT_PHY_EDR_3M_5SLOT; 772 } 773 } 774 } 775 776 if (lmp_le_capable(hdev)) { 777 if (hdev->le_tx_def_phys & HCI_LE_SET_PHY_1M) 778 selected_phys |= MGMT_PHY_LE_1M_TX; 779 780 if (hdev->le_rx_def_phys & HCI_LE_SET_PHY_1M) 781 selected_phys |= MGMT_PHY_LE_1M_RX; 782 783 if (hdev->le_tx_def_phys & HCI_LE_SET_PHY_2M) 784 selected_phys |= MGMT_PHY_LE_2M_TX; 785 786 if (hdev->le_rx_def_phys & HCI_LE_SET_PHY_2M) 787 selected_phys |= MGMT_PHY_LE_2M_RX; 788 789 if (hdev->le_tx_def_phys & HCI_LE_SET_PHY_CODED) 790 selected_phys |= MGMT_PHY_LE_CODED_TX; 791 792 if (hdev->le_rx_def_phys & HCI_LE_SET_PHY_CODED) 793 selected_phys |= MGMT_PHY_LE_CODED_RX; 794 } 795 796 return selected_phys; 797 } 798 799 static u32 get_configurable_phys(struct hci_dev *hdev) 800 { 801 return (get_supported_phys(hdev) & ~MGMT_PHY_BR_1M_1SLOT & 802 ~MGMT_PHY_LE_1M_TX & ~MGMT_PHY_LE_1M_RX); 803 } 804 805 static u32 get_supported_settings(struct hci_dev *hdev) 806 { 807 u32 settings = 0; 808 809 settings |= MGMT_SETTING_POWERED; 810 settings |= MGMT_SETTING_BONDABLE; 811 settings |= MGMT_SETTING_DEBUG_KEYS; 812 settings |= MGMT_SETTING_CONNECTABLE; 813 settings |= MGMT_SETTING_DISCOVERABLE; 814 815 if (lmp_bredr_capable(hdev)) { 816 if (hdev->hci_ver >= BLUETOOTH_VER_1_2) 817 settings |= MGMT_SETTING_FAST_CONNECTABLE; 818 settings |= MGMT_SETTING_BREDR; 819 settings |= MGMT_SETTING_LINK_SECURITY; 820 821 if (lmp_ssp_capable(hdev)) { 822 settings |= MGMT_SETTING_SSP; 823 } 824 825 if (lmp_sc_capable(hdev)) 826 settings |= MGMT_SETTING_SECURE_CONN; 827 828 if (hci_test_quirk(hdev, HCI_QUIRK_WIDEBAND_SPEECH_SUPPORTED)) 829 settings |= MGMT_SETTING_WIDEBAND_SPEECH; 830 } 831 832 if (lmp_le_capable(hdev)) { 833 settings |= MGMT_SETTING_LE; 834 settings |= MGMT_SETTING_SECURE_CONN; 835 settings |= MGMT_SETTING_PRIVACY; 836 settings |= MGMT_SETTING_STATIC_ADDRESS; 837 settings |= MGMT_SETTING_ADVERTISING; 838 } 839 840 if (hci_test_quirk(hdev, HCI_QUIRK_EXTERNAL_CONFIG) || hdev->set_bdaddr) 841 settings |= MGMT_SETTING_CONFIGURATION; 842 843 if (cis_central_capable(hdev)) 844 settings |= MGMT_SETTING_CIS_CENTRAL; 845 846 if (cis_peripheral_capable(hdev)) 847 settings |= MGMT_SETTING_CIS_PERIPHERAL; 848 849 if (bis_capable(hdev)) 850 settings |= MGMT_SETTING_ISO_BROADCASTER; 851 852 if (sync_recv_capable(hdev)) 853 settings |= MGMT_SETTING_ISO_SYNC_RECEIVER; 854 855 if (ll_privacy_capable(hdev)) 856 settings |= MGMT_SETTING_LL_PRIVACY; 857 858 if (past_sender_capable(hdev)) 859 settings |= MGMT_SETTING_PAST_SENDER; 860 861 if (past_receiver_capable(hdev)) 862 settings |= MGMT_SETTING_PAST_RECEIVER; 863 864 settings |= MGMT_SETTING_PHY_CONFIGURATION; 865 866 return settings; 867 } 868 869 static u32 get_current_settings(struct hci_dev *hdev) 870 { 871 u32 settings = 0; 872 873 if (hdev_is_powered(hdev)) 874 settings |= MGMT_SETTING_POWERED; 875 876 if (hci_dev_test_flag(hdev, HCI_CONNECTABLE)) 877 settings |= MGMT_SETTING_CONNECTABLE; 878 879 if (hci_dev_test_flag(hdev, HCI_FAST_CONNECTABLE)) 880 settings |= MGMT_SETTING_FAST_CONNECTABLE; 881 882 if (hci_dev_test_flag(hdev, HCI_DISCOVERABLE)) 883 settings |= MGMT_SETTING_DISCOVERABLE; 884 885 if (hci_dev_test_flag(hdev, HCI_BONDABLE)) 886 settings |= MGMT_SETTING_BONDABLE; 887 888 if (hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) 889 settings |= MGMT_SETTING_BREDR; 890 891 if (hci_dev_test_flag(hdev, HCI_LE_ENABLED)) 892 settings |= MGMT_SETTING_LE; 893 894 if (hci_dev_test_flag(hdev, HCI_LINK_SECURITY)) 895 settings |= MGMT_SETTING_LINK_SECURITY; 896 897 if (hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) 898 settings |= MGMT_SETTING_SSP; 899 900 if (hci_dev_test_flag(hdev, HCI_ADVERTISING)) 901 settings |= MGMT_SETTING_ADVERTISING; 902 903 if (hci_dev_test_flag(hdev, HCI_SC_ENABLED)) 904 settings |= MGMT_SETTING_SECURE_CONN; 905 906 if (hci_dev_test_flag(hdev, HCI_KEEP_DEBUG_KEYS)) 907 settings |= MGMT_SETTING_DEBUG_KEYS; 908 909 if (hci_dev_test_flag(hdev, HCI_PRIVACY)) 910 settings |= MGMT_SETTING_PRIVACY; 911 912 /* The current setting for static address has two purposes. The 913 * first is to indicate if the static address will be used and 914 * the second is to indicate if it is actually set. 915 * 916 * This means if the static address is not configured, this flag 917 * will never be set. If the address is configured, then if the 918 * address is actually used decides if the flag is set or not. 919 * 920 * For single mode LE only controllers and dual-mode controllers 921 * with BR/EDR disabled, the existence of the static address will 922 * be evaluated. 923 */ 924 if (hci_dev_test_flag(hdev, HCI_FORCE_STATIC_ADDR) || 925 !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) || 926 !bacmp(&hdev->bdaddr, BDADDR_ANY)) { 927 if (bacmp(&hdev->static_addr, BDADDR_ANY)) 928 settings |= MGMT_SETTING_STATIC_ADDRESS; 929 } 930 931 if (hci_dev_test_flag(hdev, HCI_WIDEBAND_SPEECH_ENABLED)) 932 settings |= MGMT_SETTING_WIDEBAND_SPEECH; 933 934 if (cis_central_enabled(hdev)) 935 settings |= MGMT_SETTING_CIS_CENTRAL; 936 937 if (cis_peripheral_enabled(hdev)) 938 settings |= MGMT_SETTING_CIS_PERIPHERAL; 939 940 if (bis_enabled(hdev)) 941 settings |= MGMT_SETTING_ISO_BROADCASTER; 942 943 if (sync_recv_enabled(hdev)) 944 settings |= MGMT_SETTING_ISO_SYNC_RECEIVER; 945 946 if (ll_privacy_enabled(hdev)) 947 settings |= MGMT_SETTING_LL_PRIVACY; 948 949 if (past_sender_enabled(hdev)) 950 settings |= MGMT_SETTING_PAST_SENDER; 951 952 if (past_receiver_enabled(hdev)) 953 settings |= MGMT_SETTING_PAST_RECEIVER; 954 955 return settings; 956 } 957 958 static struct mgmt_pending_cmd *pending_find(u16 opcode, struct hci_dev *hdev) 959 { 960 return mgmt_pending_find(HCI_CHANNEL_CONTROL, opcode, hdev); 961 } 962 963 u8 mgmt_get_adv_discov_flags(struct hci_dev *hdev) 964 { 965 struct mgmt_pending_cmd *cmd; 966 967 /* If there's a pending mgmt command the flags will not yet have 968 * their final values, so check for this first. 969 */ 970 cmd = pending_find(MGMT_OP_SET_DISCOVERABLE, hdev); 971 if (cmd) { 972 struct mgmt_mode *cp = cmd->param; 973 if (cp->val == 0x01) 974 return LE_AD_GENERAL; 975 else if (cp->val == 0x02) 976 return LE_AD_LIMITED; 977 } else { 978 if (hci_dev_test_flag(hdev, HCI_LIMITED_DISCOVERABLE)) 979 return LE_AD_LIMITED; 980 else if (hci_dev_test_flag(hdev, HCI_DISCOVERABLE)) 981 return LE_AD_GENERAL; 982 } 983 984 return 0; 985 } 986 987 bool mgmt_get_connectable(struct hci_dev *hdev) 988 { 989 struct mgmt_pending_cmd *cmd; 990 991 /* If there's a pending mgmt command the flag will not yet have 992 * it's final value, so check for this first. 993 */ 994 cmd = pending_find(MGMT_OP_SET_CONNECTABLE, hdev); 995 if (cmd) { 996 struct mgmt_mode *cp = cmd->param; 997 998 return cp->val; 999 } 1000 1001 return hci_dev_test_flag(hdev, HCI_CONNECTABLE); 1002 } 1003 1004 static int service_cache_sync(struct hci_dev *hdev, void *data) 1005 { 1006 hci_update_eir_sync(hdev); 1007 hci_update_class_sync(hdev); 1008 1009 return 0; 1010 } 1011 1012 static void service_cache_off(struct work_struct *work) 1013 { 1014 struct hci_dev *hdev = container_of(work, struct hci_dev, 1015 service_cache.work); 1016 1017 if (!hci_dev_test_and_clear_flag(hdev, HCI_SERVICE_CACHE)) 1018 return; 1019 1020 hci_cmd_sync_queue(hdev, service_cache_sync, NULL, NULL); 1021 } 1022 1023 static int rpa_expired_sync(struct hci_dev *hdev, void *data) 1024 { 1025 /* The generation of a new RPA and programming it into the 1026 * controller happens in the hci_req_enable_advertising() 1027 * function. 1028 */ 1029 if (ext_adv_capable(hdev)) 1030 return hci_start_ext_adv_sync(hdev, hdev->cur_adv_instance); 1031 else 1032 return hci_enable_advertising_sync(hdev); 1033 } 1034 1035 static void rpa_expired(struct work_struct *work) 1036 { 1037 struct hci_dev *hdev = container_of(work, struct hci_dev, 1038 rpa_expired.work); 1039 1040 bt_dev_dbg(hdev, ""); 1041 1042 hci_dev_set_flag(hdev, HCI_RPA_EXPIRED); 1043 1044 if (!hci_dev_test_flag(hdev, HCI_ADVERTISING)) 1045 return; 1046 1047 hci_cmd_sync_queue(hdev, rpa_expired_sync, NULL, NULL); 1048 } 1049 1050 static int set_discoverable_sync(struct hci_dev *hdev, void *data); 1051 1052 static void discov_off(struct work_struct *work) 1053 { 1054 struct hci_dev *hdev = container_of(work, struct hci_dev, 1055 discov_off.work); 1056 1057 bt_dev_dbg(hdev, ""); 1058 1059 hci_dev_lock(hdev); 1060 1061 /* When discoverable timeout triggers, then just make sure 1062 * the limited discoverable flag is cleared. Even in the case 1063 * of a timeout triggered from general discoverable, it is 1064 * safe to unconditionally clear the flag. 1065 */ 1066 hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE); 1067 hci_dev_clear_flag(hdev, HCI_DISCOVERABLE); 1068 hdev->discov_timeout = 0; 1069 1070 hci_cmd_sync_queue(hdev, set_discoverable_sync, NULL, NULL); 1071 1072 mgmt_new_settings(hdev); 1073 1074 hci_dev_unlock(hdev); 1075 } 1076 1077 static int send_settings_rsp(struct sock *sk, u16 opcode, struct hci_dev *hdev); 1078 1079 static void mesh_send_complete(struct hci_dev *hdev, 1080 struct mgmt_mesh_tx *mesh_tx, bool silent) 1081 { 1082 u8 handle = mesh_tx->handle; 1083 1084 if (!silent) 1085 mgmt_event(MGMT_EV_MESH_PACKET_CMPLT, hdev, &handle, 1086 sizeof(handle), NULL); 1087 1088 mgmt_mesh_remove(mesh_tx); 1089 } 1090 1091 static int mesh_send_done_sync(struct hci_dev *hdev, void *data) 1092 { 1093 struct mgmt_mesh_tx *mesh_tx; 1094 1095 hci_dev_clear_flag(hdev, HCI_MESH_SENDING); 1096 if (list_empty(&hdev->adv_instances)) 1097 hci_disable_advertising_sync(hdev); 1098 mesh_tx = mgmt_mesh_next(hdev, NULL); 1099 1100 if (mesh_tx) 1101 mesh_send_complete(hdev, mesh_tx, false); 1102 1103 return 0; 1104 } 1105 1106 static int mesh_send_sync(struct hci_dev *hdev, void *data); 1107 static void mesh_send_start_complete(struct hci_dev *hdev, void *data, int err); 1108 static void mesh_next(struct hci_dev *hdev, void *data, int err) 1109 { 1110 struct mgmt_mesh_tx *mesh_tx = mgmt_mesh_next(hdev, NULL); 1111 1112 if (!mesh_tx) 1113 return; 1114 1115 err = hci_cmd_sync_queue(hdev, mesh_send_sync, mesh_tx, 1116 mesh_send_start_complete); 1117 1118 if (err < 0) 1119 mesh_send_complete(hdev, mesh_tx, false); 1120 else 1121 hci_dev_set_flag(hdev, HCI_MESH_SENDING); 1122 } 1123 1124 static void mesh_send_done(struct work_struct *work) 1125 { 1126 struct hci_dev *hdev = container_of(work, struct hci_dev, 1127 mesh_send_done.work); 1128 1129 if (!hci_dev_test_flag(hdev, HCI_MESH_SENDING)) 1130 return; 1131 1132 hci_cmd_sync_queue(hdev, mesh_send_done_sync, NULL, mesh_next); 1133 } 1134 1135 static void mgmt_init_hdev(struct sock *sk, struct hci_dev *hdev) 1136 { 1137 if (hci_dev_test_flag(hdev, HCI_MGMT)) 1138 return; 1139 1140 BT_INFO("MGMT ver %d.%d", MGMT_VERSION, MGMT_REVISION); 1141 1142 INIT_DELAYED_WORK(&hdev->discov_off, discov_off); 1143 INIT_DELAYED_WORK(&hdev->service_cache, service_cache_off); 1144 INIT_DELAYED_WORK(&hdev->rpa_expired, rpa_expired); 1145 INIT_DELAYED_WORK(&hdev->mesh_send_done, mesh_send_done); 1146 1147 /* Non-mgmt controlled devices get this bit set 1148 * implicitly so that pairing works for them, however 1149 * for mgmt we require user-space to explicitly enable 1150 * it 1151 */ 1152 hci_dev_clear_flag(hdev, HCI_BONDABLE); 1153 1154 hci_dev_set_flag(hdev, HCI_MGMT); 1155 } 1156 1157 static int read_controller_info(struct sock *sk, struct hci_dev *hdev, 1158 void *data, u16 data_len) 1159 { 1160 struct mgmt_rp_read_info rp; 1161 1162 bt_dev_dbg(hdev, "sock %p", sk); 1163 1164 hci_dev_lock(hdev); 1165 1166 memset(&rp, 0, sizeof(rp)); 1167 1168 bacpy(&rp.bdaddr, &hdev->bdaddr); 1169 1170 rp.version = hdev->hci_ver; 1171 rp.manufacturer = cpu_to_le16(hdev->manufacturer); 1172 1173 rp.supported_settings = cpu_to_le32(get_supported_settings(hdev)); 1174 rp.current_settings = cpu_to_le32(get_current_settings(hdev)); 1175 1176 memcpy(rp.dev_class, hdev->dev_class, 3); 1177 1178 memcpy(rp.name, hdev->dev_name, sizeof(hdev->dev_name)); 1179 memcpy(rp.short_name, hdev->short_name, sizeof(hdev->short_name)); 1180 1181 hci_dev_unlock(hdev); 1182 1183 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_INFO, 0, &rp, 1184 sizeof(rp)); 1185 } 1186 1187 static u16 append_eir_data_to_buf(struct hci_dev *hdev, u8 *eir) 1188 { 1189 u16 eir_len = 0; 1190 size_t name_len; 1191 1192 if (hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) 1193 eir_len = eir_append_data(eir, eir_len, EIR_CLASS_OF_DEV, 1194 hdev->dev_class, 3); 1195 1196 if (hci_dev_test_flag(hdev, HCI_LE_ENABLED)) 1197 eir_len = eir_append_le16(eir, eir_len, EIR_APPEARANCE, 1198 hdev->appearance); 1199 1200 name_len = strnlen(hdev->dev_name, sizeof(hdev->dev_name)); 1201 eir_len = eir_append_data(eir, eir_len, EIR_NAME_COMPLETE, 1202 hdev->dev_name, name_len); 1203 1204 name_len = strnlen(hdev->short_name, sizeof(hdev->short_name)); 1205 eir_len = eir_append_data(eir, eir_len, EIR_NAME_SHORT, 1206 hdev->short_name, name_len); 1207 1208 return eir_len; 1209 } 1210 1211 static int read_ext_controller_info(struct sock *sk, struct hci_dev *hdev, 1212 void *data, u16 data_len) 1213 { 1214 char buf[512]; 1215 struct mgmt_rp_read_ext_info *rp = (void *)buf; 1216 u16 eir_len; 1217 1218 bt_dev_dbg(hdev, "sock %p", sk); 1219 1220 memset(&buf, 0, sizeof(buf)); 1221 1222 hci_dev_lock(hdev); 1223 1224 bacpy(&rp->bdaddr, &hdev->bdaddr); 1225 1226 rp->version = hdev->hci_ver; 1227 rp->manufacturer = cpu_to_le16(hdev->manufacturer); 1228 1229 rp->supported_settings = cpu_to_le32(get_supported_settings(hdev)); 1230 rp->current_settings = cpu_to_le32(get_current_settings(hdev)); 1231 1232 1233 eir_len = append_eir_data_to_buf(hdev, rp->eir); 1234 rp->eir_len = cpu_to_le16(eir_len); 1235 1236 hci_dev_unlock(hdev); 1237 1238 /* If this command is called at least once, then the events 1239 * for class of device and local name changes are disabled 1240 * and only the new extended controller information event 1241 * is used. 1242 */ 1243 hci_sock_set_flag(sk, HCI_MGMT_EXT_INFO_EVENTS); 1244 hci_sock_clear_flag(sk, HCI_MGMT_DEV_CLASS_EVENTS); 1245 hci_sock_clear_flag(sk, HCI_MGMT_LOCAL_NAME_EVENTS); 1246 1247 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_EXT_INFO, 0, rp, 1248 sizeof(*rp) + eir_len); 1249 } 1250 1251 static int ext_info_changed(struct hci_dev *hdev, struct sock *skip) 1252 { 1253 char buf[512]; 1254 struct mgmt_ev_ext_info_changed *ev = (void *)buf; 1255 u16 eir_len; 1256 1257 memset(buf, 0, sizeof(buf)); 1258 1259 eir_len = append_eir_data_to_buf(hdev, ev->eir); 1260 ev->eir_len = cpu_to_le16(eir_len); 1261 1262 return mgmt_limited_event(MGMT_EV_EXT_INFO_CHANGED, hdev, ev, 1263 sizeof(*ev) + eir_len, 1264 HCI_MGMT_EXT_INFO_EVENTS, skip); 1265 } 1266 1267 static int send_settings_rsp(struct sock *sk, u16 opcode, struct hci_dev *hdev) 1268 { 1269 __le32 settings = cpu_to_le32(get_current_settings(hdev)); 1270 1271 return mgmt_cmd_complete(sk, hdev->id, opcode, 0, &settings, 1272 sizeof(settings)); 1273 } 1274 1275 void mgmt_advertising_added(struct sock *sk, struct hci_dev *hdev, u8 instance) 1276 { 1277 struct mgmt_ev_advertising_added ev; 1278 1279 ev.instance = instance; 1280 1281 mgmt_event(MGMT_EV_ADVERTISING_ADDED, hdev, &ev, sizeof(ev), sk); 1282 } 1283 1284 void mgmt_advertising_removed(struct sock *sk, struct hci_dev *hdev, 1285 u8 instance) 1286 { 1287 struct mgmt_ev_advertising_removed ev; 1288 1289 ev.instance = instance; 1290 1291 mgmt_event(MGMT_EV_ADVERTISING_REMOVED, hdev, &ev, sizeof(ev), sk); 1292 } 1293 1294 static void cancel_adv_timeout(struct hci_dev *hdev) 1295 { 1296 if (hdev->adv_instance_timeout) { 1297 hdev->adv_instance_timeout = 0; 1298 cancel_delayed_work(&hdev->adv_instance_expire); 1299 } 1300 } 1301 1302 /* This function requires the caller holds hdev->lock */ 1303 static void restart_le_actions(struct hci_dev *hdev) 1304 { 1305 struct hci_conn_params *p; 1306 1307 list_for_each_entry(p, &hdev->le_conn_params, list) { 1308 /* Needed for AUTO_OFF case where might not "really" 1309 * have been powered off. 1310 */ 1311 hci_pend_le_list_del_init(p); 1312 1313 switch (p->auto_connect) { 1314 case HCI_AUTO_CONN_DIRECT: 1315 case HCI_AUTO_CONN_ALWAYS: 1316 hci_pend_le_list_add(p, &hdev->pend_le_conns); 1317 break; 1318 case HCI_AUTO_CONN_REPORT: 1319 hci_pend_le_list_add(p, &hdev->pend_le_reports); 1320 break; 1321 default: 1322 break; 1323 } 1324 } 1325 } 1326 1327 static int new_settings(struct hci_dev *hdev, struct sock *skip) 1328 { 1329 __le32 ev = cpu_to_le32(get_current_settings(hdev)); 1330 1331 return mgmt_limited_event(MGMT_EV_NEW_SETTINGS, hdev, &ev, 1332 sizeof(ev), HCI_MGMT_SETTING_EVENTS, skip); 1333 } 1334 1335 static void mgmt_set_powered_complete(struct hci_dev *hdev, void *data, int err) 1336 { 1337 struct mgmt_pending_cmd *cmd = data; 1338 struct mgmt_mode *cp; 1339 1340 /* Make sure cmd still outstanding. */ 1341 if (err == -ECANCELED || !mgmt_pending_valid(hdev, cmd)) 1342 return; 1343 1344 cp = cmd->param; 1345 1346 bt_dev_dbg(hdev, "err %d", err); 1347 1348 if (!err) { 1349 if (cp->val) { 1350 hci_dev_lock(hdev); 1351 restart_le_actions(hdev); 1352 hci_update_passive_scan(hdev); 1353 hci_dev_unlock(hdev); 1354 } 1355 1356 send_settings_rsp(cmd->sk, cmd->opcode, hdev); 1357 1358 /* Only call new_setting for power on as power off is deferred 1359 * to hdev->power_off work which does call hci_dev_do_close. 1360 */ 1361 if (cp->val) 1362 new_settings(hdev, cmd->sk); 1363 } else { 1364 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_POWERED, 1365 mgmt_status(err)); 1366 } 1367 1368 mgmt_pending_free(cmd); 1369 } 1370 1371 static int set_powered_sync(struct hci_dev *hdev, void *data) 1372 { 1373 struct mgmt_pending_cmd *cmd = data; 1374 struct mgmt_mode cp; 1375 1376 mutex_lock(&hdev->mgmt_pending_lock); 1377 1378 /* Make sure cmd still outstanding. */ 1379 if (!__mgmt_pending_listed(hdev, cmd)) { 1380 mutex_unlock(&hdev->mgmt_pending_lock); 1381 return -ECANCELED; 1382 } 1383 1384 memcpy(&cp, cmd->param, sizeof(cp)); 1385 1386 mutex_unlock(&hdev->mgmt_pending_lock); 1387 1388 BT_DBG("%s", hdev->name); 1389 1390 return hci_set_powered_sync(hdev, cp.val); 1391 } 1392 1393 static int set_powered(struct sock *sk, struct hci_dev *hdev, void *data, 1394 u16 len) 1395 { 1396 struct mgmt_mode *cp = data; 1397 struct mgmt_pending_cmd *cmd; 1398 int err; 1399 1400 bt_dev_dbg(hdev, "sock %p", sk); 1401 1402 if (cp->val != 0x00 && cp->val != 0x01) 1403 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED, 1404 MGMT_STATUS_INVALID_PARAMS); 1405 1406 hci_dev_lock(hdev); 1407 1408 if (!cp->val) { 1409 if (hci_dev_test_flag(hdev, HCI_POWERING_DOWN)) { 1410 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED, 1411 MGMT_STATUS_BUSY); 1412 goto failed; 1413 } 1414 } 1415 1416 if (pending_find(MGMT_OP_SET_POWERED, hdev)) { 1417 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED, 1418 MGMT_STATUS_BUSY); 1419 goto failed; 1420 } 1421 1422 if (!!cp->val == hdev_is_powered(hdev)) { 1423 err = send_settings_rsp(sk, MGMT_OP_SET_POWERED, hdev); 1424 goto failed; 1425 } 1426 1427 cmd = mgmt_pending_add(sk, MGMT_OP_SET_POWERED, hdev, data, len); 1428 if (!cmd) { 1429 err = -ENOMEM; 1430 goto failed; 1431 } 1432 1433 /* Cancel potentially blocking sync operation before power off */ 1434 if (cp->val == 0x00) { 1435 hci_cmd_sync_cancel_sync(hdev, -EHOSTDOWN); 1436 err = hci_cmd_sync_queue(hdev, set_powered_sync, cmd, 1437 mgmt_set_powered_complete); 1438 } else { 1439 /* Use hci_cmd_sync_submit since hdev might not be running */ 1440 err = hci_cmd_sync_submit(hdev, set_powered_sync, cmd, 1441 mgmt_set_powered_complete); 1442 } 1443 1444 if (err < 0) 1445 mgmt_pending_remove(cmd); 1446 1447 failed: 1448 hci_dev_unlock(hdev); 1449 return err; 1450 } 1451 1452 int mgmt_new_settings(struct hci_dev *hdev) 1453 { 1454 return new_settings(hdev, NULL); 1455 } 1456 1457 struct cmd_lookup { 1458 struct sock *sk; 1459 struct hci_dev *hdev; 1460 u8 mgmt_status; 1461 }; 1462 1463 static void settings_rsp(struct mgmt_pending_cmd *cmd, void *data) 1464 { 1465 struct cmd_lookup *match = data; 1466 1467 send_settings_rsp(cmd->sk, cmd->opcode, match->hdev); 1468 1469 if (match->sk == NULL) { 1470 match->sk = cmd->sk; 1471 sock_hold(match->sk); 1472 } 1473 } 1474 1475 static void cmd_status_rsp(struct mgmt_pending_cmd *cmd, void *data) 1476 { 1477 u8 *status = data; 1478 1479 mgmt_cmd_status(cmd->sk, cmd->hdev->id, cmd->opcode, *status); 1480 } 1481 1482 static void cmd_complete_rsp(struct mgmt_pending_cmd *cmd, void *data) 1483 { 1484 struct cmd_lookup *match = data; 1485 1486 /* dequeue cmd_sync entries using cmd as data as that is about to be 1487 * removed/freed. 1488 */ 1489 hci_cmd_sync_dequeue(match->hdev, NULL, cmd, NULL); 1490 1491 if (cmd->cmd_complete) { 1492 cmd->cmd_complete(cmd, match->mgmt_status); 1493 return; 1494 } 1495 1496 cmd_status_rsp(cmd, data); 1497 } 1498 1499 static int generic_cmd_complete(struct mgmt_pending_cmd *cmd, u8 status) 1500 { 1501 return mgmt_cmd_complete(cmd->sk, cmd->hdev->id, cmd->opcode, status, 1502 cmd->param, cmd->param_len); 1503 } 1504 1505 static int addr_cmd_complete(struct mgmt_pending_cmd *cmd, u8 status) 1506 { 1507 return mgmt_cmd_complete(cmd->sk, cmd->hdev->id, cmd->opcode, status, 1508 cmd->param, sizeof(struct mgmt_addr_info)); 1509 } 1510 1511 static u8 mgmt_bredr_support(struct hci_dev *hdev) 1512 { 1513 if (!lmp_bredr_capable(hdev)) 1514 return MGMT_STATUS_NOT_SUPPORTED; 1515 else if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) 1516 return MGMT_STATUS_REJECTED; 1517 else 1518 return MGMT_STATUS_SUCCESS; 1519 } 1520 1521 static u8 mgmt_le_support(struct hci_dev *hdev) 1522 { 1523 if (!lmp_le_capable(hdev)) 1524 return MGMT_STATUS_NOT_SUPPORTED; 1525 else if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED)) 1526 return MGMT_STATUS_REJECTED; 1527 else 1528 return MGMT_STATUS_SUCCESS; 1529 } 1530 1531 static void mgmt_set_discoverable_complete(struct hci_dev *hdev, void *data, 1532 int err) 1533 { 1534 struct mgmt_pending_cmd *cmd = data; 1535 1536 bt_dev_dbg(hdev, "err %d", err); 1537 1538 /* Make sure cmd still outstanding. */ 1539 if (err == -ECANCELED || !mgmt_pending_valid(hdev, cmd)) 1540 return; 1541 1542 hci_dev_lock(hdev); 1543 1544 if (err) { 1545 u8 mgmt_err = mgmt_status(err); 1546 mgmt_cmd_status(cmd->sk, cmd->hdev->id, cmd->opcode, mgmt_err); 1547 hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE); 1548 goto done; 1549 } 1550 1551 if (hci_dev_test_flag(hdev, HCI_DISCOVERABLE) && 1552 hdev->discov_timeout > 0) { 1553 int to = secs_to_jiffies(hdev->discov_timeout); 1554 queue_delayed_work(hdev->req_workqueue, &hdev->discov_off, to); 1555 } 1556 1557 send_settings_rsp(cmd->sk, MGMT_OP_SET_DISCOVERABLE, hdev); 1558 new_settings(hdev, cmd->sk); 1559 1560 done: 1561 mgmt_pending_free(cmd); 1562 hci_dev_unlock(hdev); 1563 } 1564 1565 static int set_discoverable_sync(struct hci_dev *hdev, void *data) 1566 { 1567 if (!mgmt_pending_listed(hdev, data)) 1568 return -ECANCELED; 1569 1570 BT_DBG("%s", hdev->name); 1571 1572 return hci_update_discoverable_sync(hdev); 1573 } 1574 1575 static int set_discoverable(struct sock *sk, struct hci_dev *hdev, void *data, 1576 u16 len) 1577 { 1578 struct mgmt_cp_set_discoverable *cp = data; 1579 struct mgmt_pending_cmd *cmd; 1580 u16 timeout; 1581 int err; 1582 1583 bt_dev_dbg(hdev, "sock %p", sk); 1584 1585 if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED) && 1586 !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) 1587 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE, 1588 MGMT_STATUS_REJECTED); 1589 1590 if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02) 1591 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE, 1592 MGMT_STATUS_INVALID_PARAMS); 1593 1594 timeout = __le16_to_cpu(cp->timeout); 1595 1596 /* Disabling discoverable requires that no timeout is set, 1597 * and enabling limited discoverable requires a timeout. 1598 */ 1599 if ((cp->val == 0x00 && timeout > 0) || 1600 (cp->val == 0x02 && timeout == 0)) 1601 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE, 1602 MGMT_STATUS_INVALID_PARAMS); 1603 1604 hci_dev_lock(hdev); 1605 1606 if (!hdev_is_powered(hdev) && timeout > 0) { 1607 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE, 1608 MGMT_STATUS_NOT_POWERED); 1609 goto failed; 1610 } 1611 1612 if (pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) || 1613 pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) { 1614 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE, 1615 MGMT_STATUS_BUSY); 1616 goto failed; 1617 } 1618 1619 if (!hci_dev_test_flag(hdev, HCI_CONNECTABLE)) { 1620 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE, 1621 MGMT_STATUS_REJECTED); 1622 goto failed; 1623 } 1624 1625 if (hdev->advertising_paused) { 1626 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE, 1627 MGMT_STATUS_BUSY); 1628 goto failed; 1629 } 1630 1631 if (!hdev_is_powered(hdev)) { 1632 bool changed = false; 1633 1634 /* Setting limited discoverable when powered off is 1635 * not a valid operation since it requires a timeout 1636 * and so no need to check HCI_LIMITED_DISCOVERABLE. 1637 */ 1638 if (!!cp->val != hci_dev_test_flag(hdev, HCI_DISCOVERABLE)) { 1639 hci_dev_change_flag(hdev, HCI_DISCOVERABLE); 1640 changed = true; 1641 } 1642 1643 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev); 1644 if (err < 0) 1645 goto failed; 1646 1647 if (changed) 1648 err = new_settings(hdev, sk); 1649 1650 goto failed; 1651 } 1652 1653 /* If the current mode is the same, then just update the timeout 1654 * value with the new value. And if only the timeout gets updated, 1655 * then no need for any HCI transactions. 1656 */ 1657 if (!!cp->val == hci_dev_test_flag(hdev, HCI_DISCOVERABLE) && 1658 (cp->val == 0x02) == hci_dev_test_flag(hdev, 1659 HCI_LIMITED_DISCOVERABLE)) { 1660 cancel_delayed_work(&hdev->discov_off); 1661 hdev->discov_timeout = timeout; 1662 1663 if (cp->val && hdev->discov_timeout > 0) { 1664 int to = secs_to_jiffies(hdev->discov_timeout); 1665 queue_delayed_work(hdev->req_workqueue, 1666 &hdev->discov_off, to); 1667 } 1668 1669 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev); 1670 goto failed; 1671 } 1672 1673 cmd = mgmt_pending_add(sk, MGMT_OP_SET_DISCOVERABLE, hdev, data, len); 1674 if (!cmd) { 1675 err = -ENOMEM; 1676 goto failed; 1677 } 1678 1679 /* Cancel any potential discoverable timeout that might be 1680 * still active and store new timeout value. The arming of 1681 * the timeout happens in the complete handler. 1682 */ 1683 cancel_delayed_work(&hdev->discov_off); 1684 hdev->discov_timeout = timeout; 1685 1686 if (cp->val) 1687 hci_dev_set_flag(hdev, HCI_DISCOVERABLE); 1688 else 1689 hci_dev_clear_flag(hdev, HCI_DISCOVERABLE); 1690 1691 /* Limited discoverable mode */ 1692 if (cp->val == 0x02) 1693 hci_dev_set_flag(hdev, HCI_LIMITED_DISCOVERABLE); 1694 else 1695 hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE); 1696 1697 err = hci_cmd_sync_queue(hdev, set_discoverable_sync, cmd, 1698 mgmt_set_discoverable_complete); 1699 1700 if (err < 0) 1701 mgmt_pending_remove(cmd); 1702 1703 failed: 1704 hci_dev_unlock(hdev); 1705 return err; 1706 } 1707 1708 static void mgmt_set_connectable_complete(struct hci_dev *hdev, void *data, 1709 int err) 1710 { 1711 struct mgmt_pending_cmd *cmd = data; 1712 1713 bt_dev_dbg(hdev, "err %d", err); 1714 1715 /* Make sure cmd still outstanding. */ 1716 if (err == -ECANCELED || !mgmt_pending_valid(hdev, cmd)) 1717 return; 1718 1719 hci_dev_lock(hdev); 1720 1721 if (err) { 1722 u8 mgmt_err = mgmt_status(err); 1723 mgmt_cmd_status(cmd->sk, cmd->hdev->id, cmd->opcode, mgmt_err); 1724 goto done; 1725 } 1726 1727 send_settings_rsp(cmd->sk, MGMT_OP_SET_CONNECTABLE, hdev); 1728 new_settings(hdev, cmd->sk); 1729 1730 done: 1731 mgmt_pending_free(cmd); 1732 1733 hci_dev_unlock(hdev); 1734 } 1735 1736 static int set_connectable_update_settings(struct hci_dev *hdev, 1737 struct sock *sk, u8 val) 1738 { 1739 bool changed = false; 1740 int err; 1741 1742 if (!!val != hci_dev_test_flag(hdev, HCI_CONNECTABLE)) 1743 changed = true; 1744 1745 if (val) { 1746 hci_dev_set_flag(hdev, HCI_CONNECTABLE); 1747 } else { 1748 hci_dev_clear_flag(hdev, HCI_CONNECTABLE); 1749 hci_dev_clear_flag(hdev, HCI_DISCOVERABLE); 1750 } 1751 1752 err = send_settings_rsp(sk, MGMT_OP_SET_CONNECTABLE, hdev); 1753 if (err < 0) 1754 return err; 1755 1756 if (changed) { 1757 hci_update_scan(hdev); 1758 hci_update_passive_scan(hdev); 1759 return new_settings(hdev, sk); 1760 } 1761 1762 return 0; 1763 } 1764 1765 static int set_connectable_sync(struct hci_dev *hdev, void *data) 1766 { 1767 if (!mgmt_pending_listed(hdev, data)) 1768 return -ECANCELED; 1769 1770 BT_DBG("%s", hdev->name); 1771 1772 return hci_update_connectable_sync(hdev); 1773 } 1774 1775 static int set_connectable(struct sock *sk, struct hci_dev *hdev, void *data, 1776 u16 len) 1777 { 1778 struct mgmt_mode *cp = data; 1779 struct mgmt_pending_cmd *cmd; 1780 int err; 1781 1782 bt_dev_dbg(hdev, "sock %p", sk); 1783 1784 if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED) && 1785 !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) 1786 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE, 1787 MGMT_STATUS_REJECTED); 1788 1789 if (cp->val != 0x00 && cp->val != 0x01) 1790 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE, 1791 MGMT_STATUS_INVALID_PARAMS); 1792 1793 hci_dev_lock(hdev); 1794 1795 if (!hdev_is_powered(hdev)) { 1796 err = set_connectable_update_settings(hdev, sk, cp->val); 1797 goto failed; 1798 } 1799 1800 if (pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) || 1801 pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) { 1802 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE, 1803 MGMT_STATUS_BUSY); 1804 goto failed; 1805 } 1806 1807 cmd = mgmt_pending_add(sk, MGMT_OP_SET_CONNECTABLE, hdev, data, len); 1808 if (!cmd) { 1809 err = -ENOMEM; 1810 goto failed; 1811 } 1812 1813 if (cp->val) { 1814 hci_dev_set_flag(hdev, HCI_CONNECTABLE); 1815 } else { 1816 if (hdev->discov_timeout > 0) 1817 cancel_delayed_work(&hdev->discov_off); 1818 1819 hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE); 1820 hci_dev_clear_flag(hdev, HCI_DISCOVERABLE); 1821 hci_dev_clear_flag(hdev, HCI_CONNECTABLE); 1822 } 1823 1824 err = hci_cmd_sync_queue(hdev, set_connectable_sync, cmd, 1825 mgmt_set_connectable_complete); 1826 1827 if (err < 0) 1828 mgmt_pending_remove(cmd); 1829 1830 failed: 1831 hci_dev_unlock(hdev); 1832 return err; 1833 } 1834 1835 static int set_bondable(struct sock *sk, struct hci_dev *hdev, void *data, 1836 u16 len) 1837 { 1838 struct mgmt_mode *cp = data; 1839 bool changed; 1840 int err; 1841 1842 bt_dev_dbg(hdev, "sock %p", sk); 1843 1844 if (cp->val != 0x00 && cp->val != 0x01) 1845 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BONDABLE, 1846 MGMT_STATUS_INVALID_PARAMS); 1847 1848 hci_dev_lock(hdev); 1849 1850 if (cp->val) 1851 changed = !hci_dev_test_and_set_flag(hdev, HCI_BONDABLE); 1852 else 1853 changed = hci_dev_test_and_clear_flag(hdev, HCI_BONDABLE); 1854 1855 err = send_settings_rsp(sk, MGMT_OP_SET_BONDABLE, hdev); 1856 if (err < 0) 1857 goto unlock; 1858 1859 if (changed) { 1860 /* In limited privacy mode the change of bondable mode 1861 * may affect the local advertising address. 1862 */ 1863 hci_update_discoverable(hdev); 1864 1865 err = new_settings(hdev, sk); 1866 } 1867 1868 unlock: 1869 hci_dev_unlock(hdev); 1870 return err; 1871 } 1872 1873 static int set_link_security(struct sock *sk, struct hci_dev *hdev, void *data, 1874 u16 len) 1875 { 1876 struct mgmt_mode *cp = data; 1877 struct mgmt_pending_cmd *cmd; 1878 u8 val, status; 1879 int err; 1880 1881 bt_dev_dbg(hdev, "sock %p", sk); 1882 1883 status = mgmt_bredr_support(hdev); 1884 if (status) 1885 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY, 1886 status); 1887 1888 if (cp->val != 0x00 && cp->val != 0x01) 1889 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY, 1890 MGMT_STATUS_INVALID_PARAMS); 1891 1892 hci_dev_lock(hdev); 1893 1894 if (!hdev_is_powered(hdev)) { 1895 bool changed = false; 1896 1897 if (!!cp->val != hci_dev_test_flag(hdev, HCI_LINK_SECURITY)) { 1898 hci_dev_change_flag(hdev, HCI_LINK_SECURITY); 1899 changed = true; 1900 } 1901 1902 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev); 1903 if (err < 0) 1904 goto failed; 1905 1906 if (changed) 1907 err = new_settings(hdev, sk); 1908 1909 goto failed; 1910 } 1911 1912 if (pending_find(MGMT_OP_SET_LINK_SECURITY, hdev)) { 1913 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY, 1914 MGMT_STATUS_BUSY); 1915 goto failed; 1916 } 1917 1918 val = !!cp->val; 1919 1920 if (test_bit(HCI_AUTH, &hdev->flags) == val) { 1921 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev); 1922 goto failed; 1923 } 1924 1925 cmd = mgmt_pending_add(sk, MGMT_OP_SET_LINK_SECURITY, hdev, data, len); 1926 if (!cmd) { 1927 err = -ENOMEM; 1928 goto failed; 1929 } 1930 1931 err = hci_send_cmd(hdev, HCI_OP_WRITE_AUTH_ENABLE, sizeof(val), &val); 1932 if (err < 0) { 1933 mgmt_pending_remove(cmd); 1934 goto failed; 1935 } 1936 1937 failed: 1938 hci_dev_unlock(hdev); 1939 return err; 1940 } 1941 1942 static void set_ssp_complete(struct hci_dev *hdev, void *data, int err) 1943 { 1944 struct cmd_lookup match = { NULL, hdev }; 1945 struct mgmt_pending_cmd *cmd = data; 1946 struct mgmt_mode *cp; 1947 u8 enable; 1948 bool changed; 1949 1950 /* Make sure cmd still outstanding. */ 1951 if (err == -ECANCELED || !mgmt_pending_valid(hdev, cmd)) 1952 return; 1953 1954 cp = cmd->param; 1955 enable = cp->val; 1956 1957 if (err) { 1958 u8 mgmt_err = mgmt_status(err); 1959 1960 if (enable && hci_dev_test_and_clear_flag(hdev, 1961 HCI_SSP_ENABLED)) { 1962 new_settings(hdev, NULL); 1963 } 1964 1965 mgmt_cmd_status(cmd->sk, cmd->hdev->id, cmd->opcode, mgmt_err); 1966 mgmt_pending_free(cmd); 1967 return; 1968 } 1969 1970 if (enable) { 1971 changed = !hci_dev_test_and_set_flag(hdev, HCI_SSP_ENABLED); 1972 } else { 1973 changed = hci_dev_test_and_clear_flag(hdev, HCI_SSP_ENABLED); 1974 } 1975 1976 settings_rsp(cmd, &match); 1977 1978 if (changed) 1979 new_settings(hdev, match.sk); 1980 1981 if (match.sk) 1982 sock_put(match.sk); 1983 1984 hci_update_eir_sync(hdev); 1985 mgmt_pending_free(cmd); 1986 } 1987 1988 static int set_ssp_sync(struct hci_dev *hdev, void *data) 1989 { 1990 struct mgmt_pending_cmd *cmd = data; 1991 struct mgmt_mode cp; 1992 bool changed = false; 1993 int err; 1994 1995 mutex_lock(&hdev->mgmt_pending_lock); 1996 1997 if (!__mgmt_pending_listed(hdev, cmd)) { 1998 mutex_unlock(&hdev->mgmt_pending_lock); 1999 return -ECANCELED; 2000 } 2001 2002 memcpy(&cp, cmd->param, sizeof(cp)); 2003 2004 mutex_unlock(&hdev->mgmt_pending_lock); 2005 2006 if (cp.val) 2007 changed = !hci_dev_test_and_set_flag(hdev, HCI_SSP_ENABLED); 2008 2009 err = hci_write_ssp_mode_sync(hdev, cp.val); 2010 2011 if (!err && changed) 2012 hci_dev_clear_flag(hdev, HCI_SSP_ENABLED); 2013 2014 return err; 2015 } 2016 2017 static int set_ssp(struct sock *sk, struct hci_dev *hdev, void *data, u16 len) 2018 { 2019 struct mgmt_mode *cp = data; 2020 struct mgmt_pending_cmd *cmd; 2021 u8 status; 2022 int err; 2023 2024 bt_dev_dbg(hdev, "sock %p", sk); 2025 2026 status = mgmt_bredr_support(hdev); 2027 if (status) 2028 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP, status); 2029 2030 if (!lmp_ssp_capable(hdev)) 2031 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP, 2032 MGMT_STATUS_NOT_SUPPORTED); 2033 2034 if (cp->val != 0x00 && cp->val != 0x01) 2035 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP, 2036 MGMT_STATUS_INVALID_PARAMS); 2037 2038 hci_dev_lock(hdev); 2039 2040 if (!hdev_is_powered(hdev)) { 2041 bool changed; 2042 2043 if (cp->val) { 2044 changed = !hci_dev_test_and_set_flag(hdev, 2045 HCI_SSP_ENABLED); 2046 } else { 2047 changed = hci_dev_test_and_clear_flag(hdev, 2048 HCI_SSP_ENABLED); 2049 } 2050 2051 err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev); 2052 if (err < 0) 2053 goto failed; 2054 2055 if (changed) 2056 err = new_settings(hdev, sk); 2057 2058 goto failed; 2059 } 2060 2061 if (pending_find(MGMT_OP_SET_SSP, hdev)) { 2062 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP, 2063 MGMT_STATUS_BUSY); 2064 goto failed; 2065 } 2066 2067 if (!!cp->val == hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) { 2068 err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev); 2069 goto failed; 2070 } 2071 2072 cmd = mgmt_pending_add(sk, MGMT_OP_SET_SSP, hdev, data, len); 2073 if (!cmd) 2074 err = -ENOMEM; 2075 else 2076 err = hci_cmd_sync_queue(hdev, set_ssp_sync, cmd, 2077 set_ssp_complete); 2078 2079 if (err < 0) { 2080 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP, 2081 MGMT_STATUS_FAILED); 2082 2083 if (cmd) 2084 mgmt_pending_remove(cmd); 2085 } 2086 2087 failed: 2088 hci_dev_unlock(hdev); 2089 return err; 2090 } 2091 2092 static int set_hs(struct sock *sk, struct hci_dev *hdev, void *data, u16 len) 2093 { 2094 bt_dev_dbg(hdev, "sock %p", sk); 2095 2096 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS, 2097 MGMT_STATUS_NOT_SUPPORTED); 2098 } 2099 2100 static void set_le_complete(struct hci_dev *hdev, void *data, int err) 2101 { 2102 struct mgmt_pending_cmd *cmd = data; 2103 struct cmd_lookup match = { NULL, hdev }; 2104 u8 status = mgmt_status(err); 2105 2106 bt_dev_dbg(hdev, "err %d", err); 2107 2108 if (err == -ECANCELED || !mgmt_pending_valid(hdev, data)) 2109 return; 2110 2111 if (status) { 2112 mgmt_cmd_status(cmd->sk, cmd->hdev->id, cmd->opcode, status); 2113 goto done; 2114 } 2115 2116 settings_rsp(cmd, &match); 2117 2118 new_settings(hdev, match.sk); 2119 2120 if (match.sk) 2121 sock_put(match.sk); 2122 2123 done: 2124 mgmt_pending_free(cmd); 2125 } 2126 2127 static int set_le_sync(struct hci_dev *hdev, void *data) 2128 { 2129 struct mgmt_pending_cmd *cmd = data; 2130 struct mgmt_mode cp; 2131 u8 val; 2132 int err; 2133 2134 mutex_lock(&hdev->mgmt_pending_lock); 2135 2136 if (!__mgmt_pending_listed(hdev, cmd)) { 2137 mutex_unlock(&hdev->mgmt_pending_lock); 2138 return -ECANCELED; 2139 } 2140 2141 memcpy(&cp, cmd->param, sizeof(cp)); 2142 val = !!cp.val; 2143 2144 mutex_unlock(&hdev->mgmt_pending_lock); 2145 2146 if (!val) { 2147 hci_clear_adv_instance_sync(hdev, NULL, 0x00, true); 2148 2149 if (hci_dev_test_flag(hdev, HCI_LE_ADV)) 2150 hci_disable_advertising_sync(hdev); 2151 2152 if (ext_adv_capable(hdev)) 2153 hci_remove_ext_adv_instance_sync(hdev, 0, cmd->sk); 2154 } else { 2155 hci_dev_set_flag(hdev, HCI_LE_ENABLED); 2156 } 2157 2158 err = hci_write_le_host_supported_sync(hdev, val, 0); 2159 2160 /* Make sure the controller has a good default for 2161 * advertising data. Restrict the update to when LE 2162 * has actually been enabled. During power on, the 2163 * update in powered_update_hci will take care of it. 2164 */ 2165 if (!err && hci_dev_test_flag(hdev, HCI_LE_ENABLED)) { 2166 if (ext_adv_capable(hdev)) { 2167 int status; 2168 2169 status = hci_setup_ext_adv_instance_sync(hdev, 0x00); 2170 if (!status) 2171 hci_update_scan_rsp_data_sync(hdev, 0x00); 2172 } else { 2173 hci_update_adv_data_sync(hdev, 0x00); 2174 hci_update_scan_rsp_data_sync(hdev, 0x00); 2175 } 2176 2177 hci_update_passive_scan(hdev); 2178 } 2179 2180 return err; 2181 } 2182 2183 static void set_mesh_complete(struct hci_dev *hdev, void *data, int err) 2184 { 2185 struct mgmt_pending_cmd *cmd = data; 2186 u8 status = mgmt_status(err); 2187 struct sock *sk; 2188 2189 if (err == -ECANCELED || !mgmt_pending_valid(hdev, cmd)) 2190 return; 2191 2192 sk = cmd->sk; 2193 2194 if (status) { 2195 mgmt_cmd_status(cmd->sk, hdev->id, cmd->opcode, status); 2196 goto done; 2197 } 2198 2199 mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_MESH_RECEIVER, 0, NULL, 0); 2200 2201 done: 2202 mgmt_pending_free(cmd); 2203 } 2204 2205 static int set_mesh_sync(struct hci_dev *hdev, void *data) 2206 { 2207 struct mgmt_pending_cmd *cmd = data; 2208 DEFINE_FLEX(struct mgmt_cp_set_mesh, cp, ad_types, num_ad_types, 2209 sizeof(hdev->mesh_ad_types)); 2210 size_t len; 2211 2212 mutex_lock(&hdev->mgmt_pending_lock); 2213 2214 if (!__mgmt_pending_listed(hdev, cmd)) { 2215 mutex_unlock(&hdev->mgmt_pending_lock); 2216 return -ECANCELED; 2217 } 2218 2219 len = cmd->param_len; 2220 memcpy(cp, cmd->param, min(__struct_size(cp), len)); 2221 2222 mutex_unlock(&hdev->mgmt_pending_lock); 2223 2224 memset(hdev->mesh_ad_types, 0, sizeof(hdev->mesh_ad_types)); 2225 2226 if (cp->enable) 2227 hci_dev_set_flag(hdev, HCI_MESH); 2228 else 2229 hci_dev_clear_flag(hdev, HCI_MESH); 2230 2231 hdev->le_scan_interval = __le16_to_cpu(cp->period); 2232 hdev->le_scan_window = __le16_to_cpu(cp->window); 2233 2234 len -= sizeof(struct mgmt_cp_set_mesh); 2235 2236 /* If filters don't fit, forward all adv pkts */ 2237 if (len <= sizeof(hdev->mesh_ad_types)) 2238 memcpy(hdev->mesh_ad_types, cp->ad_types, len); 2239 2240 hci_update_passive_scan_sync(hdev); 2241 return 0; 2242 } 2243 2244 static int set_mesh(struct sock *sk, struct hci_dev *hdev, void *data, u16 len) 2245 { 2246 struct mgmt_cp_set_mesh *cp = data; 2247 struct mgmt_pending_cmd *cmd; 2248 __u16 period, window; 2249 int err = 0; 2250 2251 bt_dev_dbg(hdev, "sock %p", sk); 2252 2253 if (!lmp_le_capable(hdev) || 2254 !hci_dev_test_flag(hdev, HCI_MESH_EXPERIMENTAL)) 2255 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_MESH_RECEIVER, 2256 MGMT_STATUS_NOT_SUPPORTED); 2257 2258 if (cp->enable != 0x00 && cp->enable != 0x01) 2259 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_MESH_RECEIVER, 2260 MGMT_STATUS_INVALID_PARAMS); 2261 2262 /* Keep allowed ranges in sync with set_scan_params() */ 2263 period = __le16_to_cpu(cp->period); 2264 2265 if (period < 0x0004 || period > 0x4000) 2266 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_MESH_RECEIVER, 2267 MGMT_STATUS_INVALID_PARAMS); 2268 2269 window = __le16_to_cpu(cp->window); 2270 2271 if (window < 0x0004 || window > 0x4000) 2272 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_MESH_RECEIVER, 2273 MGMT_STATUS_INVALID_PARAMS); 2274 2275 if (window > period) 2276 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_MESH_RECEIVER, 2277 MGMT_STATUS_INVALID_PARAMS); 2278 2279 hci_dev_lock(hdev); 2280 2281 cmd = mgmt_pending_add(sk, MGMT_OP_SET_MESH_RECEIVER, hdev, data, len); 2282 if (!cmd) 2283 err = -ENOMEM; 2284 else 2285 err = hci_cmd_sync_queue(hdev, set_mesh_sync, cmd, 2286 set_mesh_complete); 2287 2288 if (err < 0) { 2289 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_MESH_RECEIVER, 2290 MGMT_STATUS_FAILED); 2291 2292 if (cmd) 2293 mgmt_pending_remove(cmd); 2294 } 2295 2296 hci_dev_unlock(hdev); 2297 return err; 2298 } 2299 2300 static void mesh_send_start_complete(struct hci_dev *hdev, void *data, int err) 2301 { 2302 struct mgmt_mesh_tx *mesh_tx = data; 2303 struct mgmt_cp_mesh_send *send = (void *)mesh_tx->param; 2304 unsigned long mesh_send_interval; 2305 u8 mgmt_err = mgmt_status(err); 2306 2307 /* Report any errors here, but don't report completion */ 2308 2309 if (mgmt_err) { 2310 hci_dev_clear_flag(hdev, HCI_MESH_SENDING); 2311 /* Send Complete Error Code for handle */ 2312 mesh_send_complete(hdev, mesh_tx, false); 2313 return; 2314 } 2315 2316 mesh_send_interval = msecs_to_jiffies((send->cnt) * 25); 2317 queue_delayed_work(hdev->req_workqueue, &hdev->mesh_send_done, 2318 mesh_send_interval); 2319 } 2320 2321 static int mesh_send_sync(struct hci_dev *hdev, void *data) 2322 { 2323 struct mgmt_mesh_tx *mesh_tx = data; 2324 struct mgmt_cp_mesh_send *send = (void *)mesh_tx->param; 2325 struct adv_info *adv, *next_instance; 2326 u8 instance = hdev->le_num_of_adv_sets + 1; 2327 u16 timeout, duration; 2328 int err = 0; 2329 2330 if (hdev->le_num_of_adv_sets <= hdev->adv_instance_cnt) 2331 return MGMT_STATUS_BUSY; 2332 2333 timeout = 1000; 2334 duration = send->cnt * INTERVAL_TO_MS(hdev->le_adv_max_interval); 2335 adv = hci_add_adv_instance(hdev, instance, 0, 2336 send->adv_data_len, send->adv_data, 2337 0, NULL, 2338 timeout, duration, 2339 HCI_ADV_TX_POWER_NO_PREFERENCE, 2340 hdev->le_adv_min_interval, 2341 hdev->le_adv_max_interval, 2342 mesh_tx->handle); 2343 2344 if (!IS_ERR(adv)) 2345 mesh_tx->instance = instance; 2346 else 2347 err = PTR_ERR(adv); 2348 2349 if (hdev->cur_adv_instance == instance) { 2350 /* If the currently advertised instance is being changed then 2351 * cancel the current advertising and schedule the next 2352 * instance. If there is only one instance then the overridden 2353 * advertising data will be visible right away. 2354 */ 2355 cancel_adv_timeout(hdev); 2356 2357 next_instance = hci_get_next_instance(hdev, instance); 2358 if (next_instance) 2359 instance = next_instance->instance; 2360 else 2361 instance = 0; 2362 } else if (hdev->adv_instance_timeout) { 2363 /* Immediately advertise the new instance if no other, or 2364 * let it go naturally from queue if ADV is already happening 2365 */ 2366 instance = 0; 2367 } 2368 2369 if (instance) 2370 return hci_schedule_adv_instance_sync(hdev, instance, true); 2371 2372 return err; 2373 } 2374 2375 static void send_count(struct mgmt_mesh_tx *mesh_tx, void *data) 2376 { 2377 struct mgmt_rp_mesh_read_features *rp = data; 2378 2379 if (rp->used_handles >= rp->max_handles) 2380 return; 2381 2382 rp->handles[rp->used_handles++] = mesh_tx->handle; 2383 } 2384 2385 static int mesh_features(struct sock *sk, struct hci_dev *hdev, 2386 void *data, u16 len) 2387 { 2388 struct mgmt_rp_mesh_read_features rp; 2389 2390 if (!lmp_le_capable(hdev) || 2391 !hci_dev_test_flag(hdev, HCI_MESH_EXPERIMENTAL)) 2392 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_MESH_READ_FEATURES, 2393 MGMT_STATUS_NOT_SUPPORTED); 2394 2395 memset(&rp, 0, sizeof(rp)); 2396 rp.index = cpu_to_le16(hdev->id); 2397 if (hci_dev_test_flag(hdev, HCI_LE_ENABLED)) 2398 rp.max_handles = MESH_HANDLES_MAX; 2399 2400 hci_dev_lock(hdev); 2401 2402 if (rp.max_handles) 2403 mgmt_mesh_foreach(hdev, send_count, &rp, sk); 2404 2405 mgmt_cmd_complete(sk, hdev->id, MGMT_OP_MESH_READ_FEATURES, 0, &rp, 2406 rp.used_handles + sizeof(rp) - MESH_HANDLES_MAX); 2407 2408 hci_dev_unlock(hdev); 2409 return 0; 2410 } 2411 2412 static int send_cancel(struct hci_dev *hdev, void *data) 2413 { 2414 struct mgmt_pending_cmd *cmd = data; 2415 struct mgmt_cp_mesh_send_cancel *cancel = (void *)cmd->param; 2416 struct mgmt_mesh_tx *mesh_tx; 2417 2418 if (!cancel->handle) { 2419 do { 2420 mesh_tx = mgmt_mesh_next(hdev, cmd->sk); 2421 2422 if (mesh_tx) 2423 mesh_send_complete(hdev, mesh_tx, false); 2424 } while (mesh_tx); 2425 } else { 2426 mesh_tx = mgmt_mesh_find(hdev, cancel->handle); 2427 2428 if (mesh_tx && mesh_tx->sk == cmd->sk) 2429 mesh_send_complete(hdev, mesh_tx, false); 2430 } 2431 2432 mgmt_cmd_complete(cmd->sk, hdev->id, MGMT_OP_MESH_SEND_CANCEL, 2433 0, NULL, 0); 2434 mgmt_pending_free(cmd); 2435 2436 return 0; 2437 } 2438 2439 static int mesh_send_cancel(struct sock *sk, struct hci_dev *hdev, 2440 void *data, u16 len) 2441 { 2442 struct mgmt_pending_cmd *cmd; 2443 int err; 2444 2445 if (!lmp_le_capable(hdev) || 2446 !hci_dev_test_flag(hdev, HCI_MESH_EXPERIMENTAL)) 2447 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_MESH_SEND_CANCEL, 2448 MGMT_STATUS_NOT_SUPPORTED); 2449 2450 if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED)) 2451 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_MESH_SEND_CANCEL, 2452 MGMT_STATUS_REJECTED); 2453 2454 hci_dev_lock(hdev); 2455 cmd = mgmt_pending_new(sk, MGMT_OP_MESH_SEND_CANCEL, hdev, data, len); 2456 if (!cmd) 2457 err = -ENOMEM; 2458 else 2459 err = hci_cmd_sync_queue(hdev, send_cancel, cmd, NULL); 2460 2461 if (err < 0) { 2462 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_MESH_SEND_CANCEL, 2463 MGMT_STATUS_FAILED); 2464 2465 if (cmd) 2466 mgmt_pending_free(cmd); 2467 } 2468 2469 hci_dev_unlock(hdev); 2470 return err; 2471 } 2472 2473 static int mesh_send(struct sock *sk, struct hci_dev *hdev, void *data, u16 len) 2474 { 2475 struct mgmt_mesh_tx *mesh_tx; 2476 struct mgmt_cp_mesh_send *send = data; 2477 struct mgmt_rp_mesh_read_features rp; 2478 u16 expected_len; 2479 bool sending; 2480 int err = 0; 2481 2482 if (!lmp_le_capable(hdev) || 2483 !hci_dev_test_flag(hdev, HCI_MESH_EXPERIMENTAL)) 2484 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_MESH_SEND, 2485 MGMT_STATUS_NOT_SUPPORTED); 2486 if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED)) 2487 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_MESH_SEND, 2488 MGMT_STATUS_REJECTED); 2489 2490 if (!send->adv_data_len || send->adv_data_len > 31) 2491 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_MESH_SEND, 2492 MGMT_STATUS_REJECTED); 2493 2494 expected_len = struct_size(send, adv_data, send->adv_data_len); 2495 if (expected_len != len) 2496 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_MESH_SEND, 2497 MGMT_STATUS_INVALID_PARAMS); 2498 2499 hci_dev_lock(hdev); 2500 2501 memset(&rp, 0, sizeof(rp)); 2502 rp.max_handles = MESH_HANDLES_MAX; 2503 2504 mgmt_mesh_foreach(hdev, send_count, &rp, sk); 2505 2506 if (rp.max_handles <= rp.used_handles) { 2507 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_MESH_SEND, 2508 MGMT_STATUS_BUSY); 2509 goto done; 2510 } 2511 2512 sending = hci_dev_test_flag(hdev, HCI_MESH_SENDING); 2513 mesh_tx = mgmt_mesh_add(sk, hdev, send, len); 2514 2515 if (!mesh_tx) 2516 err = -ENOMEM; 2517 else if (!sending) 2518 err = hci_cmd_sync_queue(hdev, mesh_send_sync, mesh_tx, 2519 mesh_send_start_complete); 2520 2521 if (err < 0) { 2522 bt_dev_err(hdev, "Send Mesh Failed %d", err); 2523 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_MESH_SEND, 2524 MGMT_STATUS_FAILED); 2525 2526 if (mesh_tx) { 2527 if (sending) 2528 mgmt_mesh_remove(mesh_tx); 2529 } 2530 } else { 2531 hci_dev_set_flag(hdev, HCI_MESH_SENDING); 2532 2533 mgmt_cmd_complete(sk, hdev->id, MGMT_OP_MESH_SEND, 0, 2534 &mesh_tx->handle, 1); 2535 } 2536 2537 done: 2538 hci_dev_unlock(hdev); 2539 return err; 2540 } 2541 2542 static int set_le(struct sock *sk, struct hci_dev *hdev, void *data, u16 len) 2543 { 2544 struct mgmt_mode *cp = data; 2545 struct mgmt_pending_cmd *cmd; 2546 int err; 2547 u8 val, enabled; 2548 2549 bt_dev_dbg(hdev, "sock %p", sk); 2550 2551 if (!lmp_le_capable(hdev)) 2552 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE, 2553 MGMT_STATUS_NOT_SUPPORTED); 2554 2555 if (cp->val != 0x00 && cp->val != 0x01) 2556 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE, 2557 MGMT_STATUS_INVALID_PARAMS); 2558 2559 /* Bluetooth single mode LE only controllers or dual-mode 2560 * controllers configured as LE only devices, do not allow 2561 * switching LE off. These have either LE enabled explicitly 2562 * or BR/EDR has been previously switched off. 2563 * 2564 * When trying to enable an already enabled LE, then gracefully 2565 * send a positive response. Trying to disable it however will 2566 * result into rejection. 2567 */ 2568 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) { 2569 if (cp->val == 0x01) 2570 return send_settings_rsp(sk, MGMT_OP_SET_LE, hdev); 2571 2572 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE, 2573 MGMT_STATUS_REJECTED); 2574 } 2575 2576 hci_dev_lock(hdev); 2577 2578 val = !!cp->val; 2579 enabled = lmp_host_le_capable(hdev); 2580 2581 if (!hdev_is_powered(hdev) || val == enabled) { 2582 bool changed = false; 2583 2584 if (val != hci_dev_test_flag(hdev, HCI_LE_ENABLED)) { 2585 hci_dev_change_flag(hdev, HCI_LE_ENABLED); 2586 changed = true; 2587 } 2588 2589 if (!val && hci_dev_test_flag(hdev, HCI_ADVERTISING)) { 2590 hci_dev_clear_flag(hdev, HCI_ADVERTISING); 2591 changed = true; 2592 } 2593 2594 err = send_settings_rsp(sk, MGMT_OP_SET_LE, hdev); 2595 if (err < 0) 2596 goto unlock; 2597 2598 if (changed) 2599 err = new_settings(hdev, sk); 2600 2601 goto unlock; 2602 } 2603 2604 if (pending_find(MGMT_OP_SET_LE, hdev) || 2605 pending_find(MGMT_OP_SET_ADVERTISING, hdev)) { 2606 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE, 2607 MGMT_STATUS_BUSY); 2608 goto unlock; 2609 } 2610 2611 cmd = mgmt_pending_add(sk, MGMT_OP_SET_LE, hdev, data, len); 2612 if (!cmd) 2613 err = -ENOMEM; 2614 else 2615 err = hci_cmd_sync_queue(hdev, set_le_sync, cmd, 2616 set_le_complete); 2617 2618 if (err < 0) { 2619 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE, 2620 MGMT_STATUS_FAILED); 2621 2622 if (cmd) 2623 mgmt_pending_remove(cmd); 2624 } 2625 2626 unlock: 2627 hci_dev_unlock(hdev); 2628 return err; 2629 } 2630 2631 static int send_hci_cmd_sync(struct hci_dev *hdev, void *data) 2632 { 2633 struct mgmt_pending_cmd *cmd = data; 2634 struct mgmt_cp_hci_cmd_sync *cp = cmd->param; 2635 struct sk_buff *skb; 2636 2637 skb = __hci_cmd_sync_ev(hdev, le16_to_cpu(cp->opcode), 2638 le16_to_cpu(cp->params_len), cp->params, 2639 cp->event, cp->timeout ? 2640 secs_to_jiffies(cp->timeout) : 2641 HCI_CMD_TIMEOUT); 2642 if (IS_ERR(skb)) { 2643 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_HCI_CMD_SYNC, 2644 mgmt_status(PTR_ERR(skb))); 2645 goto done; 2646 } 2647 2648 mgmt_cmd_complete(cmd->sk, hdev->id, MGMT_OP_HCI_CMD_SYNC, 0, 2649 skb->data, skb->len); 2650 2651 kfree_skb(skb); 2652 2653 done: 2654 mgmt_pending_free(cmd); 2655 2656 return 0; 2657 } 2658 2659 static int mgmt_hci_cmd_sync(struct sock *sk, struct hci_dev *hdev, 2660 void *data, u16 len) 2661 { 2662 struct mgmt_cp_hci_cmd_sync *cp = data; 2663 struct mgmt_pending_cmd *cmd; 2664 int err; 2665 2666 if (len != (offsetof(struct mgmt_cp_hci_cmd_sync, params) + 2667 le16_to_cpu(cp->params_len))) 2668 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_HCI_CMD_SYNC, 2669 MGMT_STATUS_INVALID_PARAMS); 2670 2671 hci_dev_lock(hdev); 2672 cmd = mgmt_pending_new(sk, MGMT_OP_HCI_CMD_SYNC, hdev, data, len); 2673 if (!cmd) 2674 err = -ENOMEM; 2675 else 2676 err = hci_cmd_sync_queue(hdev, send_hci_cmd_sync, cmd, NULL); 2677 2678 if (err < 0) { 2679 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_HCI_CMD_SYNC, 2680 MGMT_STATUS_FAILED); 2681 2682 if (cmd) 2683 mgmt_pending_free(cmd); 2684 } 2685 2686 hci_dev_unlock(hdev); 2687 return err; 2688 } 2689 2690 /* This is a helper function to test for pending mgmt commands that can 2691 * cause CoD or EIR HCI commands. We can only allow one such pending 2692 * mgmt command at a time since otherwise we cannot easily track what 2693 * the current values are, will be, and based on that calculate if a new 2694 * HCI command needs to be sent and if yes with what value. 2695 */ 2696 static bool pending_eir_or_class(struct hci_dev *hdev) 2697 { 2698 struct mgmt_pending_cmd *cmd; 2699 bool pending = false; 2700 2701 mutex_lock(&hdev->mgmt_pending_lock); 2702 2703 list_for_each_entry(cmd, &hdev->mgmt_pending, list) { 2704 switch (cmd->opcode) { 2705 case MGMT_OP_ADD_UUID: 2706 case MGMT_OP_REMOVE_UUID: 2707 case MGMT_OP_SET_DEV_CLASS: 2708 case MGMT_OP_SET_LOCAL_NAME: 2709 case MGMT_OP_SET_POWERED: 2710 pending = true; 2711 break; 2712 } 2713 2714 if (pending) 2715 break; 2716 } 2717 2718 mutex_unlock(&hdev->mgmt_pending_lock); 2719 2720 return pending; 2721 } 2722 2723 static const u8 bluetooth_base_uuid[] = { 2724 0xfb, 0x34, 0x9b, 0x5f, 0x80, 0x00, 0x00, 0x80, 2725 0x00, 0x10, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 2726 }; 2727 2728 static u8 get_uuid_size(const u8 *uuid) 2729 { 2730 u32 val; 2731 2732 if (memcmp(uuid, bluetooth_base_uuid, 12)) 2733 return 128; 2734 2735 val = get_unaligned_le32(&uuid[12]); 2736 if (val > 0xffff) 2737 return 32; 2738 2739 return 16; 2740 } 2741 2742 static void mgmt_class_complete(struct hci_dev *hdev, void *data, int err) 2743 { 2744 struct mgmt_pending_cmd *cmd = data; 2745 2746 bt_dev_dbg(hdev, "err %d", err); 2747 2748 mgmt_cmd_complete(cmd->sk, cmd->hdev->id, cmd->opcode, 2749 mgmt_status(err), hdev->dev_class, 3); 2750 2751 mgmt_pending_free(cmd); 2752 } 2753 2754 static int add_uuid_sync(struct hci_dev *hdev, void *data) 2755 { 2756 int err; 2757 2758 err = hci_update_class_sync(hdev); 2759 if (err) 2760 return err; 2761 2762 return hci_update_eir_sync(hdev); 2763 } 2764 2765 static int add_uuid(struct sock *sk, struct hci_dev *hdev, void *data, u16 len) 2766 { 2767 struct mgmt_cp_add_uuid *cp = data; 2768 struct mgmt_pending_cmd *cmd; 2769 struct bt_uuid *uuid; 2770 int err; 2771 2772 bt_dev_dbg(hdev, "sock %p", sk); 2773 2774 hci_dev_lock(hdev); 2775 2776 if (pending_eir_or_class(hdev)) { 2777 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_UUID, 2778 MGMT_STATUS_BUSY); 2779 goto failed; 2780 } 2781 2782 uuid = kmalloc_obj(*uuid); 2783 if (!uuid) { 2784 err = -ENOMEM; 2785 goto failed; 2786 } 2787 2788 memcpy(uuid->uuid, cp->uuid, 16); 2789 uuid->svc_hint = cp->svc_hint; 2790 uuid->size = get_uuid_size(cp->uuid); 2791 2792 list_add_tail(&uuid->list, &hdev->uuids); 2793 2794 cmd = mgmt_pending_new(sk, MGMT_OP_ADD_UUID, hdev, data, len); 2795 if (!cmd) { 2796 err = -ENOMEM; 2797 goto failed; 2798 } 2799 2800 /* MGMT_OP_ADD_UUID don't require adapter the UP/Running so use 2801 * hci_cmd_sync_submit instead of hci_cmd_sync_queue. 2802 */ 2803 err = hci_cmd_sync_submit(hdev, add_uuid_sync, cmd, 2804 mgmt_class_complete); 2805 if (err < 0) { 2806 mgmt_pending_free(cmd); 2807 goto failed; 2808 } 2809 2810 failed: 2811 hci_dev_unlock(hdev); 2812 return err; 2813 } 2814 2815 static bool enable_service_cache(struct hci_dev *hdev) 2816 { 2817 if (!hdev_is_powered(hdev)) 2818 return false; 2819 2820 if (!hci_dev_test_and_set_flag(hdev, HCI_SERVICE_CACHE)) { 2821 queue_delayed_work(hdev->workqueue, &hdev->service_cache, 2822 CACHE_TIMEOUT); 2823 return true; 2824 } 2825 2826 return false; 2827 } 2828 2829 static int remove_uuid_sync(struct hci_dev *hdev, void *data) 2830 { 2831 int err; 2832 2833 err = hci_update_class_sync(hdev); 2834 if (err) 2835 return err; 2836 2837 return hci_update_eir_sync(hdev); 2838 } 2839 2840 static int remove_uuid(struct sock *sk, struct hci_dev *hdev, void *data, 2841 u16 len) 2842 { 2843 struct mgmt_cp_remove_uuid *cp = data; 2844 struct mgmt_pending_cmd *cmd; 2845 struct bt_uuid *match, *tmp; 2846 static const u8 bt_uuid_any[] = { 2847 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 2848 }; 2849 int err, found; 2850 2851 bt_dev_dbg(hdev, "sock %p", sk); 2852 2853 hci_dev_lock(hdev); 2854 2855 if (pending_eir_or_class(hdev)) { 2856 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID, 2857 MGMT_STATUS_BUSY); 2858 goto unlock; 2859 } 2860 2861 if (memcmp(cp->uuid, bt_uuid_any, 16) == 0) { 2862 hci_uuids_clear(hdev); 2863 2864 if (enable_service_cache(hdev)) { 2865 err = mgmt_cmd_complete(sk, hdev->id, 2866 MGMT_OP_REMOVE_UUID, 2867 0, hdev->dev_class, 3); 2868 goto unlock; 2869 } 2870 2871 goto update_class; 2872 } 2873 2874 found = 0; 2875 2876 list_for_each_entry_safe(match, tmp, &hdev->uuids, list) { 2877 if (memcmp(match->uuid, cp->uuid, 16) != 0) 2878 continue; 2879 2880 list_del(&match->list); 2881 kfree(match); 2882 found++; 2883 } 2884 2885 if (found == 0) { 2886 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID, 2887 MGMT_STATUS_INVALID_PARAMS); 2888 goto unlock; 2889 } 2890 2891 update_class: 2892 cmd = mgmt_pending_new(sk, MGMT_OP_REMOVE_UUID, hdev, data, len); 2893 if (!cmd) { 2894 err = -ENOMEM; 2895 goto unlock; 2896 } 2897 2898 /* MGMT_OP_REMOVE_UUID don't require adapter the UP/Running so use 2899 * hci_cmd_sync_submit instead of hci_cmd_sync_queue. 2900 */ 2901 err = hci_cmd_sync_submit(hdev, remove_uuid_sync, cmd, 2902 mgmt_class_complete); 2903 if (err < 0) 2904 mgmt_pending_free(cmd); 2905 2906 unlock: 2907 hci_dev_unlock(hdev); 2908 return err; 2909 } 2910 2911 static int set_class_sync(struct hci_dev *hdev, void *data) 2912 { 2913 int err = 0; 2914 2915 if (hci_dev_test_and_clear_flag(hdev, HCI_SERVICE_CACHE)) { 2916 cancel_delayed_work_sync(&hdev->service_cache); 2917 err = hci_update_eir_sync(hdev); 2918 } 2919 2920 if (err) 2921 return err; 2922 2923 return hci_update_class_sync(hdev); 2924 } 2925 2926 static int set_dev_class(struct sock *sk, struct hci_dev *hdev, void *data, 2927 u16 len) 2928 { 2929 struct mgmt_cp_set_dev_class *cp = data; 2930 struct mgmt_pending_cmd *cmd; 2931 int err; 2932 2933 bt_dev_dbg(hdev, "sock %p", sk); 2934 2935 if (!lmp_bredr_capable(hdev)) 2936 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 2937 MGMT_STATUS_NOT_SUPPORTED); 2938 2939 hci_dev_lock(hdev); 2940 2941 if (pending_eir_or_class(hdev)) { 2942 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 2943 MGMT_STATUS_BUSY); 2944 goto unlock; 2945 } 2946 2947 if ((cp->minor & 0x03) != 0 || (cp->major & 0xe0) != 0) { 2948 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 2949 MGMT_STATUS_INVALID_PARAMS); 2950 goto unlock; 2951 } 2952 2953 hdev->major_class = cp->major; 2954 hdev->minor_class = cp->minor; 2955 2956 if (!hdev_is_powered(hdev)) { 2957 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 0, 2958 hdev->dev_class, 3); 2959 goto unlock; 2960 } 2961 2962 cmd = mgmt_pending_new(sk, MGMT_OP_SET_DEV_CLASS, hdev, data, len); 2963 if (!cmd) { 2964 err = -ENOMEM; 2965 goto unlock; 2966 } 2967 2968 /* MGMT_OP_SET_DEV_CLASS don't require adapter the UP/Running so use 2969 * hci_cmd_sync_submit instead of hci_cmd_sync_queue. 2970 */ 2971 err = hci_cmd_sync_submit(hdev, set_class_sync, cmd, 2972 mgmt_class_complete); 2973 if (err < 0) 2974 mgmt_pending_free(cmd); 2975 2976 unlock: 2977 hci_dev_unlock(hdev); 2978 return err; 2979 } 2980 2981 static int load_link_keys(struct sock *sk, struct hci_dev *hdev, void *data, 2982 u16 len) 2983 { 2984 struct mgmt_cp_load_link_keys *cp = data; 2985 const u16 max_key_count = ((U16_MAX - sizeof(*cp)) / 2986 sizeof(struct mgmt_link_key_info)); 2987 u16 key_count, expected_len; 2988 bool changed; 2989 int i; 2990 2991 bt_dev_dbg(hdev, "sock %p", sk); 2992 2993 if (!lmp_bredr_capable(hdev)) 2994 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS, 2995 MGMT_STATUS_NOT_SUPPORTED); 2996 2997 key_count = __le16_to_cpu(cp->key_count); 2998 if (key_count > max_key_count) { 2999 bt_dev_err(hdev, "load_link_keys: too big key_count value %u", 3000 key_count); 3001 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS, 3002 MGMT_STATUS_INVALID_PARAMS); 3003 } 3004 3005 expected_len = struct_size(cp, keys, key_count); 3006 if (expected_len != len) { 3007 bt_dev_err(hdev, "load_link_keys: expected %u bytes, got %u bytes", 3008 expected_len, len); 3009 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS, 3010 MGMT_STATUS_INVALID_PARAMS); 3011 } 3012 3013 if (cp->debug_keys != 0x00 && cp->debug_keys != 0x01) 3014 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS, 3015 MGMT_STATUS_INVALID_PARAMS); 3016 3017 bt_dev_dbg(hdev, "debug_keys %u key_count %u", cp->debug_keys, 3018 key_count); 3019 3020 hci_dev_lock(hdev); 3021 3022 hci_link_keys_clear(hdev); 3023 3024 if (cp->debug_keys) 3025 changed = !hci_dev_test_and_set_flag(hdev, HCI_KEEP_DEBUG_KEYS); 3026 else 3027 changed = hci_dev_test_and_clear_flag(hdev, 3028 HCI_KEEP_DEBUG_KEYS); 3029 3030 if (changed) 3031 new_settings(hdev, NULL); 3032 3033 for (i = 0; i < key_count; i++) { 3034 struct mgmt_link_key_info *key = &cp->keys[i]; 3035 3036 if (hci_is_blocked_key(hdev, 3037 HCI_BLOCKED_KEY_TYPE_LINKKEY, 3038 key->val)) { 3039 bt_dev_warn(hdev, "Skipping blocked link key for %pMR", 3040 &key->addr.bdaddr); 3041 continue; 3042 } 3043 3044 if (key->addr.type != BDADDR_BREDR) { 3045 bt_dev_warn(hdev, 3046 "Invalid link address type %u for %pMR", 3047 key->addr.type, &key->addr.bdaddr); 3048 continue; 3049 } 3050 3051 if (key->type > 0x08) { 3052 bt_dev_warn(hdev, "Invalid link key type %u for %pMR", 3053 key->type, &key->addr.bdaddr); 3054 continue; 3055 } 3056 3057 /* Always ignore debug keys and require a new pairing if 3058 * the user wants to use them. 3059 */ 3060 if (key->type == HCI_LK_DEBUG_COMBINATION) 3061 continue; 3062 3063 hci_add_link_key(hdev, NULL, &key->addr.bdaddr, key->val, 3064 key->type, key->pin_len, NULL); 3065 } 3066 3067 mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS, 0, NULL, 0); 3068 3069 hci_dev_unlock(hdev); 3070 3071 return 0; 3072 } 3073 3074 static int device_unpaired(struct hci_dev *hdev, bdaddr_t *bdaddr, 3075 u8 addr_type, struct sock *skip_sk) 3076 { 3077 struct mgmt_ev_device_unpaired ev; 3078 3079 bacpy(&ev.addr.bdaddr, bdaddr); 3080 ev.addr.type = addr_type; 3081 3082 return mgmt_event(MGMT_EV_DEVICE_UNPAIRED, hdev, &ev, sizeof(ev), 3083 skip_sk); 3084 } 3085 3086 static void unpair_device_complete(struct hci_dev *hdev, void *data, int err) 3087 { 3088 struct mgmt_pending_cmd *cmd = data; 3089 struct mgmt_cp_unpair_device *cp = cmd->param; 3090 3091 if (!err) 3092 device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, cmd->sk); 3093 3094 cmd->cmd_complete(cmd, err); 3095 mgmt_pending_free(cmd); 3096 } 3097 3098 static int unpair_device_sync(struct hci_dev *hdev, void *data) 3099 { 3100 struct mgmt_pending_cmd *cmd = data; 3101 struct mgmt_cp_unpair_device *cp = cmd->param; 3102 struct hci_conn *conn; 3103 3104 hci_dev_lock(hdev); 3105 3106 if (cp->addr.type == BDADDR_BREDR) 3107 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, 3108 &cp->addr.bdaddr); 3109 else 3110 conn = hci_conn_hash_lookup_le(hdev, &cp->addr.bdaddr, 3111 le_addr_type(cp->addr.type)); 3112 3113 if (conn) 3114 hci_conn_get(conn); 3115 3116 hci_dev_unlock(hdev); 3117 3118 if (!conn) 3119 return 0; 3120 3121 /* Disregard any possible error since the likes of hci_abort_conn_sync 3122 * will clean up the connection no matter the error. 3123 */ 3124 hci_abort_conn(conn, HCI_ERROR_REMOTE_USER_TERM); 3125 hci_conn_put(conn); 3126 3127 return 0; 3128 } 3129 3130 static int unpair_device(struct sock *sk, struct hci_dev *hdev, void *data, 3131 u16 len) 3132 { 3133 struct mgmt_cp_unpair_device *cp = data; 3134 struct mgmt_rp_unpair_device rp; 3135 struct hci_conn_params *params; 3136 struct mgmt_pending_cmd *cmd; 3137 struct hci_conn *conn; 3138 u8 addr_type; 3139 int err; 3140 3141 memset(&rp, 0, sizeof(rp)); 3142 bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr); 3143 rp.addr.type = cp->addr.type; 3144 3145 if (!bdaddr_type_is_valid(cp->addr.type)) 3146 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE, 3147 MGMT_STATUS_INVALID_PARAMS, 3148 &rp, sizeof(rp)); 3149 3150 if (cp->disconnect != 0x00 && cp->disconnect != 0x01) 3151 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE, 3152 MGMT_STATUS_INVALID_PARAMS, 3153 &rp, sizeof(rp)); 3154 3155 hci_dev_lock(hdev); 3156 3157 if (!hdev_is_powered(hdev)) { 3158 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE, 3159 MGMT_STATUS_NOT_POWERED, &rp, 3160 sizeof(rp)); 3161 goto unlock; 3162 } 3163 3164 if (cp->addr.type == BDADDR_BREDR) { 3165 /* If disconnection is requested, then look up the 3166 * connection. If the remote device is connected, it 3167 * will be later used to terminate the link. 3168 * 3169 * Setting it to NULL explicitly will cause no 3170 * termination of the link. 3171 */ 3172 if (cp->disconnect) 3173 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, 3174 &cp->addr.bdaddr); 3175 else 3176 conn = NULL; 3177 3178 err = hci_remove_link_key(hdev, &cp->addr.bdaddr); 3179 if (err < 0) { 3180 err = mgmt_cmd_complete(sk, hdev->id, 3181 MGMT_OP_UNPAIR_DEVICE, 3182 MGMT_STATUS_NOT_PAIRED, &rp, 3183 sizeof(rp)); 3184 goto unlock; 3185 } 3186 3187 goto done; 3188 } 3189 3190 /* LE address type */ 3191 addr_type = le_addr_type(cp->addr.type); 3192 3193 /* Abort any ongoing SMP pairing. Removes ltk and irk if they exist. */ 3194 err = smp_cancel_and_remove_pairing(hdev, &cp->addr.bdaddr, addr_type); 3195 if (err < 0) { 3196 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE, 3197 MGMT_STATUS_NOT_PAIRED, &rp, 3198 sizeof(rp)); 3199 goto unlock; 3200 } 3201 3202 conn = hci_conn_hash_lookup_le(hdev, &cp->addr.bdaddr, addr_type); 3203 if (!conn) { 3204 hci_conn_params_del(hdev, &cp->addr.bdaddr, addr_type); 3205 goto done; 3206 } 3207 3208 3209 /* Defer clearing up the connection parameters until closing to 3210 * give a chance of keeping them if a repairing happens. 3211 */ 3212 set_bit(HCI_CONN_PARAM_REMOVAL_PEND, &conn->flags); 3213 3214 /* Disable auto-connection parameters if present */ 3215 params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr, addr_type); 3216 if (params) { 3217 if (params->explicit_connect) 3218 params->auto_connect = HCI_AUTO_CONN_EXPLICIT; 3219 else 3220 params->auto_connect = HCI_AUTO_CONN_DISABLED; 3221 } 3222 3223 /* If disconnection is not requested, then clear the connection 3224 * variable so that the link is not terminated. 3225 */ 3226 if (!cp->disconnect) 3227 conn = NULL; 3228 3229 done: 3230 /* If the connection variable is set, then termination of the 3231 * link is requested. 3232 */ 3233 if (!conn) { 3234 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE, 0, 3235 &rp, sizeof(rp)); 3236 device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, sk); 3237 goto unlock; 3238 } 3239 3240 cmd = mgmt_pending_new(sk, MGMT_OP_UNPAIR_DEVICE, hdev, cp, 3241 sizeof(*cp)); 3242 if (!cmd) { 3243 err = -ENOMEM; 3244 goto unlock; 3245 } 3246 3247 cmd->cmd_complete = addr_cmd_complete; 3248 3249 err = hci_cmd_sync_queue(hdev, unpair_device_sync, cmd, 3250 unpair_device_complete); 3251 if (err < 0) 3252 mgmt_pending_free(cmd); 3253 3254 unlock: 3255 hci_dev_unlock(hdev); 3256 return err; 3257 } 3258 3259 static void disconnect_complete(struct hci_dev *hdev, void *data, int err) 3260 { 3261 struct mgmt_pending_cmd *cmd = data; 3262 3263 cmd->cmd_complete(cmd, mgmt_status(err)); 3264 mgmt_pending_free(cmd); 3265 } 3266 3267 static int disconnect_sync(struct hci_dev *hdev, void *data) 3268 { 3269 struct mgmt_pending_cmd *cmd = data; 3270 struct mgmt_cp_disconnect *cp = cmd->param; 3271 struct hci_conn *conn; 3272 3273 hci_dev_lock(hdev); 3274 3275 if (cp->addr.type == BDADDR_BREDR) 3276 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, 3277 &cp->addr.bdaddr); 3278 else 3279 conn = hci_conn_hash_lookup_le(hdev, &cp->addr.bdaddr, 3280 le_addr_type(cp->addr.type)); 3281 3282 if (conn) 3283 hci_conn_get(conn); 3284 3285 hci_dev_unlock(hdev); 3286 3287 if (!conn) 3288 return -ENOTCONN; 3289 3290 /* Disregard any possible error since the likes of hci_abort_conn_sync 3291 * will clean up the connection no matter the error. 3292 */ 3293 hci_abort_conn(conn, HCI_ERROR_REMOTE_USER_TERM); 3294 hci_conn_put(conn); 3295 3296 return 0; 3297 } 3298 3299 static int disconnect(struct sock *sk, struct hci_dev *hdev, void *data, 3300 u16 len) 3301 { 3302 struct mgmt_cp_disconnect *cp = data; 3303 struct mgmt_rp_disconnect rp; 3304 struct mgmt_pending_cmd *cmd; 3305 int err; 3306 3307 bt_dev_dbg(hdev, "sock %p", sk); 3308 3309 memset(&rp, 0, sizeof(rp)); 3310 bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr); 3311 rp.addr.type = cp->addr.type; 3312 3313 if (!bdaddr_type_is_valid(cp->addr.type)) 3314 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT, 3315 MGMT_STATUS_INVALID_PARAMS, 3316 &rp, sizeof(rp)); 3317 3318 hci_dev_lock(hdev); 3319 3320 if (!test_bit(HCI_UP, &hdev->flags)) { 3321 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT, 3322 MGMT_STATUS_NOT_POWERED, &rp, 3323 sizeof(rp)); 3324 goto failed; 3325 } 3326 3327 cmd = mgmt_pending_new(sk, MGMT_OP_DISCONNECT, hdev, data, len); 3328 if (!cmd) { 3329 err = -ENOMEM; 3330 goto failed; 3331 } 3332 3333 cmd->cmd_complete = generic_cmd_complete; 3334 3335 err = hci_cmd_sync_queue(hdev, disconnect_sync, cmd, 3336 disconnect_complete); 3337 if (err < 0) 3338 mgmt_pending_free(cmd); 3339 3340 failed: 3341 hci_dev_unlock(hdev); 3342 return err; 3343 } 3344 3345 static u8 link_to_bdaddr(u8 link_type, u8 addr_type) 3346 { 3347 switch (link_type) { 3348 case CIS_LINK: 3349 case BIS_LINK: 3350 case PA_LINK: 3351 case LE_LINK: 3352 switch (addr_type) { 3353 case ADDR_LE_DEV_PUBLIC: 3354 return BDADDR_LE_PUBLIC; 3355 3356 default: 3357 /* Fallback to LE Random address type */ 3358 return BDADDR_LE_RANDOM; 3359 } 3360 3361 default: 3362 /* Fallback to BR/EDR type */ 3363 return BDADDR_BREDR; 3364 } 3365 } 3366 3367 static int get_connections(struct sock *sk, struct hci_dev *hdev, void *data, 3368 u16 data_len) 3369 { 3370 struct mgmt_rp_get_connections *rp; 3371 struct hci_conn *c; 3372 int err; 3373 u16 i; 3374 3375 bt_dev_dbg(hdev, "sock %p", sk); 3376 3377 hci_dev_lock(hdev); 3378 3379 if (!hdev_is_powered(hdev)) { 3380 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_CONNECTIONS, 3381 MGMT_STATUS_NOT_POWERED); 3382 goto unlock; 3383 } 3384 3385 i = 0; 3386 list_for_each_entry(c, &hdev->conn_hash.list, list) { 3387 if (test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags)) 3388 i++; 3389 } 3390 3391 rp = kmalloc_flex(*rp, addr, i); 3392 if (!rp) { 3393 err = -ENOMEM; 3394 goto unlock; 3395 } 3396 3397 i = 0; 3398 list_for_each_entry(c, &hdev->conn_hash.list, list) { 3399 if (!test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags)) 3400 continue; 3401 bacpy(&rp->addr[i].bdaddr, &c->dst); 3402 rp->addr[i].type = link_to_bdaddr(c->type, c->dst_type); 3403 if (c->type == SCO_LINK || c->type == ESCO_LINK) 3404 continue; 3405 i++; 3406 } 3407 3408 rp->conn_count = cpu_to_le16(i); 3409 3410 /* Recalculate length in case of filtered SCO connections, etc */ 3411 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONNECTIONS, 0, rp, 3412 struct_size(rp, addr, i)); 3413 3414 kfree(rp); 3415 3416 unlock: 3417 hci_dev_unlock(hdev); 3418 return err; 3419 } 3420 3421 static int send_pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev, 3422 struct mgmt_cp_pin_code_neg_reply *cp) 3423 { 3424 struct mgmt_pending_cmd *cmd; 3425 int err; 3426 3427 cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_NEG_REPLY, hdev, cp, 3428 sizeof(*cp)); 3429 if (!cmd) 3430 return -ENOMEM; 3431 3432 cmd->cmd_complete = addr_cmd_complete; 3433 3434 err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_NEG_REPLY, 3435 sizeof(cp->addr.bdaddr), &cp->addr.bdaddr); 3436 if (err < 0) 3437 mgmt_pending_remove(cmd); 3438 3439 return err; 3440 } 3441 3442 static int pin_code_reply(struct sock *sk, struct hci_dev *hdev, void *data, 3443 u16 len) 3444 { 3445 struct hci_conn *conn; 3446 struct mgmt_cp_pin_code_reply *cp = data; 3447 struct hci_cp_pin_code_reply reply; 3448 struct mgmt_pending_cmd *cmd; 3449 int err; 3450 3451 bt_dev_dbg(hdev, "sock %p", sk); 3452 3453 hci_dev_lock(hdev); 3454 3455 if (!hdev_is_powered(hdev)) { 3456 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY, 3457 MGMT_STATUS_NOT_POWERED); 3458 goto failed; 3459 } 3460 3461 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->addr.bdaddr); 3462 if (!conn) { 3463 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY, 3464 MGMT_STATUS_NOT_CONNECTED); 3465 goto failed; 3466 } 3467 3468 if (conn->pending_sec_level == BT_SECURITY_HIGH && cp->pin_len != 16) { 3469 struct mgmt_cp_pin_code_neg_reply ncp; 3470 3471 memcpy(&ncp.addr, &cp->addr, sizeof(ncp.addr)); 3472 3473 bt_dev_err(hdev, "PIN code is not 16 bytes long"); 3474 3475 err = send_pin_code_neg_reply(sk, hdev, &ncp); 3476 if (err >= 0) 3477 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY, 3478 MGMT_STATUS_INVALID_PARAMS); 3479 3480 goto failed; 3481 } 3482 3483 cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_REPLY, hdev, data, len); 3484 if (!cmd) { 3485 err = -ENOMEM; 3486 goto failed; 3487 } 3488 3489 cmd->cmd_complete = addr_cmd_complete; 3490 3491 bacpy(&reply.bdaddr, &cp->addr.bdaddr); 3492 reply.pin_len = cp->pin_len; 3493 memcpy(reply.pin_code, cp->pin_code, sizeof(reply.pin_code)); 3494 3495 err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_REPLY, sizeof(reply), &reply); 3496 if (err < 0) 3497 mgmt_pending_remove(cmd); 3498 3499 failed: 3500 hci_dev_unlock(hdev); 3501 return err; 3502 } 3503 3504 static int set_io_capability(struct sock *sk, struct hci_dev *hdev, void *data, 3505 u16 len) 3506 { 3507 struct mgmt_cp_set_io_capability *cp = data; 3508 3509 bt_dev_dbg(hdev, "sock %p", sk); 3510 3511 if (cp->io_capability > SMP_IO_KEYBOARD_DISPLAY) 3512 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_IO_CAPABILITY, 3513 MGMT_STATUS_INVALID_PARAMS); 3514 3515 hci_dev_lock(hdev); 3516 3517 hdev->io_capability = cp->io_capability; 3518 3519 bt_dev_dbg(hdev, "IO capability set to 0x%02x", hdev->io_capability); 3520 3521 hci_dev_unlock(hdev); 3522 3523 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_IO_CAPABILITY, 0, 3524 NULL, 0); 3525 } 3526 3527 static struct mgmt_pending_cmd *remove_pairing(struct hci_conn *conn) 3528 { 3529 struct hci_dev *hdev = conn->hdev; 3530 struct mgmt_pending_cmd *cmd; 3531 3532 mutex_lock(&hdev->mgmt_pending_lock); 3533 3534 list_for_each_entry(cmd, &hdev->mgmt_pending, list) { 3535 if (cmd->opcode != MGMT_OP_PAIR_DEVICE) 3536 continue; 3537 3538 if (cmd->user_data != conn) 3539 continue; 3540 3541 list_del(&cmd->list); 3542 mutex_unlock(&hdev->mgmt_pending_lock); 3543 return cmd; 3544 } 3545 3546 mutex_unlock(&hdev->mgmt_pending_lock); 3547 3548 return NULL; 3549 } 3550 3551 static struct mgmt_pending_cmd *remove_pairing_by_addr(struct hci_dev *hdev, 3552 bdaddr_t *bdaddr) 3553 { 3554 struct mgmt_pending_cmd *cmd; 3555 struct hci_conn *conn; 3556 3557 mutex_lock(&hdev->mgmt_pending_lock); 3558 3559 list_for_each_entry(cmd, &hdev->mgmt_pending, list) { 3560 if (cmd->opcode != MGMT_OP_PAIR_DEVICE) 3561 continue; 3562 3563 conn = cmd->user_data; 3564 if (bacmp(bdaddr, &conn->dst) != 0) 3565 continue; 3566 3567 list_del(&cmd->list); 3568 mutex_unlock(&hdev->mgmt_pending_lock); 3569 return cmd; 3570 } 3571 3572 mutex_unlock(&hdev->mgmt_pending_lock); 3573 3574 return NULL; 3575 } 3576 3577 static int pairing_complete(struct mgmt_pending_cmd *cmd, u8 status) 3578 { 3579 struct mgmt_rp_pair_device rp; 3580 struct hci_conn *conn = cmd->user_data; 3581 int err; 3582 3583 bacpy(&rp.addr.bdaddr, &conn->dst); 3584 rp.addr.type = link_to_bdaddr(conn->type, conn->dst_type); 3585 3586 err = mgmt_cmd_complete(cmd->sk, cmd->hdev->id, MGMT_OP_PAIR_DEVICE, 3587 status, &rp, sizeof(rp)); 3588 3589 /* So we don't get further callbacks for this connection */ 3590 conn->connect_cfm_cb = NULL; 3591 conn->security_cfm_cb = NULL; 3592 conn->disconn_cfm_cb = NULL; 3593 3594 hci_conn_drop(conn); 3595 3596 /* The device is paired so there is no need to remove 3597 * its connection parameters anymore. 3598 */ 3599 clear_bit(HCI_CONN_PARAM_REMOVAL_PEND, &conn->flags); 3600 3601 hci_conn_put(conn); 3602 3603 return err; 3604 } 3605 3606 void mgmt_smp_complete(struct hci_conn *conn, bool complete) 3607 { 3608 u8 status = complete ? MGMT_STATUS_SUCCESS : MGMT_STATUS_FAILED; 3609 struct mgmt_pending_cmd *cmd; 3610 3611 cmd = remove_pairing(conn); 3612 if (cmd) { 3613 cmd->cmd_complete(cmd, status); 3614 mgmt_pending_free(cmd); 3615 } 3616 } 3617 3618 static void pairing_complete_cb(struct hci_conn *conn, u8 status) 3619 { 3620 struct mgmt_pending_cmd *cmd; 3621 3622 BT_DBG("status %u", status); 3623 3624 cmd = remove_pairing(conn); 3625 if (!cmd) { 3626 BT_DBG("Unable to find a pending command"); 3627 return; 3628 } 3629 3630 cmd->cmd_complete(cmd, mgmt_status(status)); 3631 mgmt_pending_free(cmd); 3632 } 3633 3634 static void le_pairing_complete_cb(struct hci_conn *conn, u8 status) 3635 { 3636 struct mgmt_pending_cmd *cmd; 3637 3638 BT_DBG("status %u", status); 3639 3640 if (!status) 3641 return; 3642 3643 cmd = remove_pairing(conn); 3644 if (!cmd) { 3645 BT_DBG("Unable to find a pending command"); 3646 return; 3647 } 3648 3649 cmd->cmd_complete(cmd, mgmt_status(status)); 3650 mgmt_pending_free(cmd); 3651 } 3652 3653 static int pair_device(struct sock *sk, struct hci_dev *hdev, void *data, 3654 u16 len) 3655 { 3656 struct mgmt_cp_pair_device *cp = data; 3657 struct mgmt_rp_pair_device rp; 3658 struct mgmt_pending_cmd *cmd; 3659 u8 sec_level, auth_type; 3660 struct hci_conn *conn; 3661 int err; 3662 3663 bt_dev_dbg(hdev, "sock %p", sk); 3664 3665 memset(&rp, 0, sizeof(rp)); 3666 bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr); 3667 rp.addr.type = cp->addr.type; 3668 3669 if (!bdaddr_type_is_valid(cp->addr.type)) 3670 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE, 3671 MGMT_STATUS_INVALID_PARAMS, 3672 &rp, sizeof(rp)); 3673 3674 if (cp->io_cap > SMP_IO_KEYBOARD_DISPLAY) 3675 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE, 3676 MGMT_STATUS_INVALID_PARAMS, 3677 &rp, sizeof(rp)); 3678 3679 hci_dev_lock(hdev); 3680 3681 if (!hdev_is_powered(hdev)) { 3682 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE, 3683 MGMT_STATUS_NOT_POWERED, &rp, 3684 sizeof(rp)); 3685 goto unlock; 3686 } 3687 3688 if (hci_bdaddr_is_paired(hdev, &cp->addr.bdaddr, cp->addr.type)) { 3689 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE, 3690 MGMT_STATUS_ALREADY_PAIRED, &rp, 3691 sizeof(rp)); 3692 goto unlock; 3693 } 3694 3695 sec_level = BT_SECURITY_MEDIUM; 3696 auth_type = HCI_AT_DEDICATED_BONDING; 3697 3698 if (cp->addr.type == BDADDR_BREDR) { 3699 conn = hci_connect_acl(hdev, &cp->addr.bdaddr, sec_level, 3700 auth_type, CONN_REASON_PAIR_DEVICE, 3701 HCI_ACL_CONN_TIMEOUT); 3702 } else { 3703 u8 addr_type = le_addr_type(cp->addr.type); 3704 struct hci_conn_params *p; 3705 3706 /* When pairing a new device, it is expected to remember 3707 * this device for future connections. Adding the connection 3708 * parameter information ahead of time allows tracking 3709 * of the peripheral preferred values and will speed up any 3710 * further connection establishment. 3711 * 3712 * If connection parameters already exist, then they 3713 * will be kept and this function does nothing. 3714 */ 3715 p = hci_conn_params_add(hdev, &cp->addr.bdaddr, addr_type); 3716 if (!p) { 3717 err = -EIO; 3718 goto unlock; 3719 } 3720 3721 if (p->auto_connect == HCI_AUTO_CONN_EXPLICIT) 3722 p->auto_connect = HCI_AUTO_CONN_DISABLED; 3723 3724 conn = hci_connect_le_scan(hdev, &cp->addr.bdaddr, addr_type, 3725 sec_level, HCI_LE_CONN_TIMEOUT, 3726 CONN_REASON_PAIR_DEVICE); 3727 } 3728 3729 if (IS_ERR(conn)) { 3730 int status; 3731 3732 if (PTR_ERR(conn) == -EBUSY) 3733 status = MGMT_STATUS_BUSY; 3734 else if (PTR_ERR(conn) == -EOPNOTSUPP) 3735 status = MGMT_STATUS_NOT_SUPPORTED; 3736 else if (PTR_ERR(conn) == -ECONNREFUSED) 3737 status = MGMT_STATUS_REJECTED; 3738 else 3739 status = MGMT_STATUS_CONNECT_FAILED; 3740 3741 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE, 3742 status, &rp, sizeof(rp)); 3743 goto unlock; 3744 } 3745 3746 if (conn->connect_cfm_cb) { 3747 hci_conn_drop(conn); 3748 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE, 3749 MGMT_STATUS_BUSY, &rp, sizeof(rp)); 3750 goto unlock; 3751 } 3752 3753 cmd = mgmt_pending_add(sk, MGMT_OP_PAIR_DEVICE, hdev, data, len); 3754 if (!cmd) { 3755 err = -ENOMEM; 3756 hci_conn_drop(conn); 3757 goto unlock; 3758 } 3759 3760 cmd->cmd_complete = pairing_complete; 3761 3762 /* For LE, just connecting isn't a proof that the pairing finished */ 3763 if (cp->addr.type == BDADDR_BREDR) { 3764 conn->connect_cfm_cb = pairing_complete_cb; 3765 conn->security_cfm_cb = pairing_complete_cb; 3766 conn->disconn_cfm_cb = pairing_complete_cb; 3767 } else { 3768 conn->connect_cfm_cb = le_pairing_complete_cb; 3769 conn->security_cfm_cb = le_pairing_complete_cb; 3770 conn->disconn_cfm_cb = le_pairing_complete_cb; 3771 } 3772 3773 conn->io_capability = cp->io_cap; 3774 cmd->user_data = hci_conn_get(conn); 3775 3776 if ((conn->state == BT_CONNECTED || conn->state == BT_CONFIG) && 3777 hci_conn_security(conn, sec_level, auth_type, true)) { 3778 cmd->cmd_complete(cmd, 0); 3779 mgmt_pending_remove(cmd); 3780 } 3781 3782 err = 0; 3783 3784 unlock: 3785 hci_dev_unlock(hdev); 3786 return err; 3787 } 3788 3789 static int cancel_pair_device(struct sock *sk, struct hci_dev *hdev, void *data, 3790 u16 len) 3791 { 3792 struct mgmt_addr_info *addr = data; 3793 struct mgmt_pending_cmd *cmd; 3794 struct hci_conn *conn; 3795 int err; 3796 3797 bt_dev_dbg(hdev, "sock %p", sk); 3798 3799 hci_dev_lock(hdev); 3800 3801 if (!hdev_is_powered(hdev)) { 3802 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE, 3803 MGMT_STATUS_NOT_POWERED); 3804 goto unlock; 3805 } 3806 3807 cmd = remove_pairing_by_addr(hdev, &addr->bdaddr); 3808 if (!cmd) { 3809 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE, 3810 MGMT_STATUS_INVALID_PARAMS); 3811 goto unlock; 3812 } 3813 3814 conn = hci_conn_get(cmd->user_data); 3815 3816 cmd->cmd_complete(cmd, MGMT_STATUS_CANCELLED); 3817 mgmt_pending_free(cmd); 3818 3819 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE, 0, 3820 addr, sizeof(*addr)); 3821 3822 /* Since user doesn't want to proceed with the connection, abort any 3823 * ongoing pairing and then terminate the link if it was created 3824 * because of the pair device action. 3825 */ 3826 if (addr->type == BDADDR_BREDR) 3827 hci_remove_link_key(hdev, &addr->bdaddr); 3828 else 3829 smp_cancel_and_remove_pairing(hdev, &addr->bdaddr, 3830 le_addr_type(addr->type)); 3831 3832 if (conn->conn_reason == CONN_REASON_PAIR_DEVICE) 3833 hci_abort_conn(conn, HCI_ERROR_REMOTE_USER_TERM); 3834 3835 hci_conn_put(conn); 3836 3837 unlock: 3838 hci_dev_unlock(hdev); 3839 return err; 3840 } 3841 3842 static int user_pairing_resp(struct sock *sk, struct hci_dev *hdev, 3843 struct mgmt_addr_info *addr, u16 mgmt_op, 3844 u16 hci_op, __le32 passkey) 3845 { 3846 struct mgmt_pending_cmd *cmd; 3847 struct hci_conn *conn; 3848 int err; 3849 3850 hci_dev_lock(hdev); 3851 3852 if (!hdev_is_powered(hdev)) { 3853 err = mgmt_cmd_complete(sk, hdev->id, mgmt_op, 3854 MGMT_STATUS_NOT_POWERED, addr, 3855 sizeof(*addr)); 3856 goto done; 3857 } 3858 3859 if (addr->type == BDADDR_BREDR) 3860 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &addr->bdaddr); 3861 else 3862 conn = hci_conn_hash_lookup_le(hdev, &addr->bdaddr, 3863 le_addr_type(addr->type)); 3864 3865 if (!conn) { 3866 err = mgmt_cmd_complete(sk, hdev->id, mgmt_op, 3867 MGMT_STATUS_NOT_CONNECTED, addr, 3868 sizeof(*addr)); 3869 goto done; 3870 } 3871 3872 if (addr->type == BDADDR_LE_PUBLIC || addr->type == BDADDR_LE_RANDOM) { 3873 err = smp_user_confirm_reply(conn, mgmt_op, passkey); 3874 if (!err) 3875 err = mgmt_cmd_complete(sk, hdev->id, mgmt_op, 3876 MGMT_STATUS_SUCCESS, addr, 3877 sizeof(*addr)); 3878 else 3879 err = mgmt_cmd_complete(sk, hdev->id, mgmt_op, 3880 MGMT_STATUS_FAILED, addr, 3881 sizeof(*addr)); 3882 3883 goto done; 3884 } 3885 3886 cmd = mgmt_pending_add(sk, mgmt_op, hdev, addr, sizeof(*addr)); 3887 if (!cmd) { 3888 err = -ENOMEM; 3889 goto done; 3890 } 3891 3892 cmd->cmd_complete = addr_cmd_complete; 3893 3894 /* Continue with pairing via HCI */ 3895 if (hci_op == HCI_OP_USER_PASSKEY_REPLY) { 3896 struct hci_cp_user_passkey_reply cp; 3897 3898 bacpy(&cp.bdaddr, &addr->bdaddr); 3899 cp.passkey = passkey; 3900 err = hci_send_cmd(hdev, hci_op, sizeof(cp), &cp); 3901 } else 3902 err = hci_send_cmd(hdev, hci_op, sizeof(addr->bdaddr), 3903 &addr->bdaddr); 3904 3905 if (err < 0) 3906 mgmt_pending_remove(cmd); 3907 3908 done: 3909 hci_dev_unlock(hdev); 3910 return err; 3911 } 3912 3913 static int pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev, 3914 void *data, u16 len) 3915 { 3916 struct mgmt_cp_pin_code_neg_reply *cp = data; 3917 3918 bt_dev_dbg(hdev, "sock %p", sk); 3919 3920 return user_pairing_resp(sk, hdev, &cp->addr, 3921 MGMT_OP_PIN_CODE_NEG_REPLY, 3922 HCI_OP_PIN_CODE_NEG_REPLY, 0); 3923 } 3924 3925 static int user_confirm_reply(struct sock *sk, struct hci_dev *hdev, void *data, 3926 u16 len) 3927 { 3928 struct mgmt_cp_user_confirm_reply *cp = data; 3929 3930 bt_dev_dbg(hdev, "sock %p", sk); 3931 3932 if (len != sizeof(*cp)) 3933 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_USER_CONFIRM_REPLY, 3934 MGMT_STATUS_INVALID_PARAMS); 3935 3936 return user_pairing_resp(sk, hdev, &cp->addr, 3937 MGMT_OP_USER_CONFIRM_REPLY, 3938 HCI_OP_USER_CONFIRM_REPLY, 0); 3939 } 3940 3941 static int user_confirm_neg_reply(struct sock *sk, struct hci_dev *hdev, 3942 void *data, u16 len) 3943 { 3944 struct mgmt_cp_user_confirm_neg_reply *cp = data; 3945 3946 bt_dev_dbg(hdev, "sock %p", sk); 3947 3948 return user_pairing_resp(sk, hdev, &cp->addr, 3949 MGMT_OP_USER_CONFIRM_NEG_REPLY, 3950 HCI_OP_USER_CONFIRM_NEG_REPLY, 0); 3951 } 3952 3953 static int user_passkey_reply(struct sock *sk, struct hci_dev *hdev, void *data, 3954 u16 len) 3955 { 3956 struct mgmt_cp_user_passkey_reply *cp = data; 3957 3958 bt_dev_dbg(hdev, "sock %p", sk); 3959 3960 return user_pairing_resp(sk, hdev, &cp->addr, 3961 MGMT_OP_USER_PASSKEY_REPLY, 3962 HCI_OP_USER_PASSKEY_REPLY, cp->passkey); 3963 } 3964 3965 static int user_passkey_neg_reply(struct sock *sk, struct hci_dev *hdev, 3966 void *data, u16 len) 3967 { 3968 struct mgmt_cp_user_passkey_neg_reply *cp = data; 3969 3970 bt_dev_dbg(hdev, "sock %p", sk); 3971 3972 return user_pairing_resp(sk, hdev, &cp->addr, 3973 MGMT_OP_USER_PASSKEY_NEG_REPLY, 3974 HCI_OP_USER_PASSKEY_NEG_REPLY, 0); 3975 } 3976 3977 static int adv_expire_sync(struct hci_dev *hdev, u32 flags) 3978 { 3979 struct adv_info *adv_instance; 3980 3981 adv_instance = hci_find_adv_instance(hdev, hdev->cur_adv_instance); 3982 if (!adv_instance) 3983 return 0; 3984 3985 /* stop if current instance doesn't need to be changed */ 3986 if (!(adv_instance->flags & flags)) 3987 return 0; 3988 3989 cancel_adv_timeout(hdev); 3990 3991 adv_instance = hci_get_next_instance(hdev, adv_instance->instance); 3992 if (!adv_instance) 3993 return 0; 3994 3995 hci_schedule_adv_instance_sync(hdev, adv_instance->instance, true); 3996 3997 return 0; 3998 } 3999 4000 static int name_changed_sync(struct hci_dev *hdev, void *data) 4001 { 4002 return adv_expire_sync(hdev, MGMT_ADV_FLAG_LOCAL_NAME); 4003 } 4004 4005 static void set_name_complete(struct hci_dev *hdev, void *data, int err) 4006 { 4007 struct mgmt_pending_cmd *cmd = data; 4008 struct mgmt_cp_set_local_name *cp; 4009 u8 status = mgmt_status(err); 4010 4011 bt_dev_dbg(hdev, "err %d", err); 4012 4013 if (err == -ECANCELED || !mgmt_pending_valid(hdev, cmd)) 4014 return; 4015 4016 cp = cmd->param; 4017 4018 if (status) { 4019 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 4020 status); 4021 } else { 4022 mgmt_cmd_complete(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0, 4023 cp, sizeof(*cp)); 4024 4025 if (hci_dev_test_flag(hdev, HCI_LE_ADV)) 4026 hci_cmd_sync_queue(hdev, name_changed_sync, NULL, NULL); 4027 } 4028 4029 mgmt_pending_free(cmd); 4030 } 4031 4032 static int set_name_sync(struct hci_dev *hdev, void *data) 4033 { 4034 struct mgmt_pending_cmd *cmd = data; 4035 struct mgmt_cp_set_local_name cp; 4036 4037 mutex_lock(&hdev->mgmt_pending_lock); 4038 4039 if (!__mgmt_pending_listed(hdev, cmd)) { 4040 mutex_unlock(&hdev->mgmt_pending_lock); 4041 return -ECANCELED; 4042 } 4043 4044 memcpy(&cp, cmd->param, sizeof(cp)); 4045 4046 mutex_unlock(&hdev->mgmt_pending_lock); 4047 4048 if (lmp_bredr_capable(hdev)) { 4049 hci_update_name_sync(hdev, cp.name); 4050 hci_update_eir_sync(hdev); 4051 } 4052 4053 /* The name is stored in the scan response data and so 4054 * no need to update the advertising data here. 4055 */ 4056 if (lmp_le_capable(hdev) && hci_dev_test_flag(hdev, HCI_ADVERTISING)) 4057 hci_update_scan_rsp_data_sync(hdev, hdev->cur_adv_instance); 4058 4059 return 0; 4060 } 4061 4062 static int set_local_name(struct sock *sk, struct hci_dev *hdev, void *data, 4063 u16 len) 4064 { 4065 struct mgmt_cp_set_local_name *cp = data; 4066 struct mgmt_pending_cmd *cmd; 4067 int err; 4068 4069 bt_dev_dbg(hdev, "sock %p", sk); 4070 4071 hci_dev_lock(hdev); 4072 4073 /* If the old values are the same as the new ones just return a 4074 * direct command complete event. 4075 */ 4076 if (!memcmp(hdev->dev_name, cp->name, sizeof(hdev->dev_name)) && 4077 !memcmp(hdev->short_name, cp->short_name, 4078 sizeof(hdev->short_name))) { 4079 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0, 4080 data, len); 4081 goto failed; 4082 } 4083 4084 if (hdev_is_powered(hdev) && pending_eir_or_class(hdev)) { 4085 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 4086 MGMT_STATUS_BUSY); 4087 goto failed; 4088 } 4089 4090 memcpy(hdev->short_name, cp->short_name, sizeof(hdev->short_name)); 4091 4092 if (!hdev_is_powered(hdev)) { 4093 memcpy(hdev->dev_name, cp->name, sizeof(hdev->dev_name)); 4094 4095 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0, 4096 data, len); 4097 if (err < 0) 4098 goto failed; 4099 4100 err = mgmt_limited_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, data, 4101 len, HCI_MGMT_LOCAL_NAME_EVENTS, sk); 4102 ext_info_changed(hdev, sk); 4103 4104 goto failed; 4105 } 4106 4107 cmd = mgmt_pending_add(sk, MGMT_OP_SET_LOCAL_NAME, hdev, data, len); 4108 if (!cmd) 4109 err = -ENOMEM; 4110 else 4111 err = hci_cmd_sync_queue(hdev, set_name_sync, cmd, 4112 set_name_complete); 4113 4114 if (err < 0) { 4115 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 4116 MGMT_STATUS_FAILED); 4117 4118 if (cmd) 4119 mgmt_pending_remove(cmd); 4120 4121 goto failed; 4122 } 4123 4124 memcpy(hdev->dev_name, cp->name, sizeof(hdev->dev_name)); 4125 4126 failed: 4127 hci_dev_unlock(hdev); 4128 return err; 4129 } 4130 4131 static int appearance_changed_sync(struct hci_dev *hdev, void *data) 4132 { 4133 return adv_expire_sync(hdev, MGMT_ADV_FLAG_APPEARANCE); 4134 } 4135 4136 static int set_appearance(struct sock *sk, struct hci_dev *hdev, void *data, 4137 u16 len) 4138 { 4139 struct mgmt_cp_set_appearance *cp = data; 4140 u16 appearance; 4141 int err; 4142 4143 bt_dev_dbg(hdev, "sock %p", sk); 4144 4145 if (!lmp_le_capable(hdev)) 4146 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_APPEARANCE, 4147 MGMT_STATUS_NOT_SUPPORTED); 4148 4149 appearance = le16_to_cpu(cp->appearance); 4150 4151 hci_dev_lock(hdev); 4152 4153 if (hdev->appearance != appearance) { 4154 hdev->appearance = appearance; 4155 4156 if (hci_dev_test_flag(hdev, HCI_LE_ADV)) 4157 hci_cmd_sync_queue(hdev, appearance_changed_sync, NULL, 4158 NULL); 4159 4160 ext_info_changed(hdev, sk); 4161 } 4162 4163 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_APPEARANCE, 0, NULL, 4164 0); 4165 4166 hci_dev_unlock(hdev); 4167 4168 return err; 4169 } 4170 4171 static int get_phy_configuration(struct sock *sk, struct hci_dev *hdev, 4172 void *data, u16 len) 4173 { 4174 struct mgmt_rp_get_phy_configuration rp; 4175 4176 bt_dev_dbg(hdev, "sock %p", sk); 4177 4178 hci_dev_lock(hdev); 4179 4180 memset(&rp, 0, sizeof(rp)); 4181 4182 rp.supported_phys = cpu_to_le32(get_supported_phys(hdev)); 4183 rp.selected_phys = cpu_to_le32(get_selected_phys(hdev)); 4184 rp.configurable_phys = cpu_to_le32(get_configurable_phys(hdev)); 4185 4186 hci_dev_unlock(hdev); 4187 4188 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_PHY_CONFIGURATION, 0, 4189 &rp, sizeof(rp)); 4190 } 4191 4192 int mgmt_phy_configuration_changed(struct hci_dev *hdev, struct sock *skip) 4193 { 4194 struct mgmt_ev_phy_configuration_changed ev; 4195 4196 memset(&ev, 0, sizeof(ev)); 4197 4198 ev.selected_phys = cpu_to_le32(get_selected_phys(hdev)); 4199 4200 return mgmt_event(MGMT_EV_PHY_CONFIGURATION_CHANGED, hdev, &ev, 4201 sizeof(ev), skip); 4202 } 4203 4204 static void set_default_phy_complete(struct hci_dev *hdev, void *data, int err) 4205 { 4206 struct mgmt_pending_cmd *cmd = data; 4207 struct sk_buff *skb; 4208 u8 status = mgmt_status(err); 4209 4210 skb = cmd->skb; 4211 4212 if (!status) { 4213 if (!skb) 4214 status = MGMT_STATUS_FAILED; 4215 else if (IS_ERR(skb)) 4216 status = mgmt_status(PTR_ERR(skb)); 4217 else 4218 status = mgmt_status(skb->data[0]); 4219 } 4220 4221 bt_dev_dbg(hdev, "status %d", status); 4222 4223 if (status) { 4224 mgmt_cmd_status(cmd->sk, hdev->id, 4225 MGMT_OP_SET_PHY_CONFIGURATION, status); 4226 } else { 4227 mgmt_cmd_complete(cmd->sk, hdev->id, 4228 MGMT_OP_SET_PHY_CONFIGURATION, 0, 4229 NULL, 0); 4230 4231 mgmt_phy_configuration_changed(hdev, cmd->sk); 4232 } 4233 4234 if (skb && !IS_ERR(skb)) 4235 kfree_skb(skb); 4236 4237 mgmt_pending_free(cmd); 4238 } 4239 4240 static int set_default_phy_sync(struct hci_dev *hdev, void *data) 4241 { 4242 struct mgmt_pending_cmd *cmd = data; 4243 struct mgmt_cp_set_phy_configuration *cp = cmd->param; 4244 struct hci_cp_le_set_default_phy cp_phy; 4245 u32 selected_phys; 4246 4247 selected_phys = __le32_to_cpu(cp->selected_phys); 4248 4249 memset(&cp_phy, 0, sizeof(cp_phy)); 4250 4251 if (!(selected_phys & MGMT_PHY_LE_TX_MASK)) 4252 cp_phy.all_phys |= 0x01; 4253 4254 if (!(selected_phys & MGMT_PHY_LE_RX_MASK)) 4255 cp_phy.all_phys |= 0x02; 4256 4257 if (selected_phys & MGMT_PHY_LE_1M_TX) 4258 cp_phy.tx_phys |= HCI_LE_SET_PHY_1M; 4259 4260 if (selected_phys & MGMT_PHY_LE_2M_TX) 4261 cp_phy.tx_phys |= HCI_LE_SET_PHY_2M; 4262 4263 if (selected_phys & MGMT_PHY_LE_CODED_TX) 4264 cp_phy.tx_phys |= HCI_LE_SET_PHY_CODED; 4265 4266 if (selected_phys & MGMT_PHY_LE_1M_RX) 4267 cp_phy.rx_phys |= HCI_LE_SET_PHY_1M; 4268 4269 if (selected_phys & MGMT_PHY_LE_2M_RX) 4270 cp_phy.rx_phys |= HCI_LE_SET_PHY_2M; 4271 4272 if (selected_phys & MGMT_PHY_LE_CODED_RX) 4273 cp_phy.rx_phys |= HCI_LE_SET_PHY_CODED; 4274 4275 cmd->skb = __hci_cmd_sync(hdev, HCI_OP_LE_SET_DEFAULT_PHY, 4276 sizeof(cp_phy), &cp_phy, HCI_CMD_TIMEOUT); 4277 4278 return 0; 4279 } 4280 4281 static int set_phy_configuration(struct sock *sk, struct hci_dev *hdev, 4282 void *data, u16 len) 4283 { 4284 struct mgmt_cp_set_phy_configuration *cp = data; 4285 struct mgmt_pending_cmd *cmd; 4286 u32 selected_phys, configurable_phys, supported_phys, unconfigure_phys; 4287 u16 pkt_type = (HCI_DH1 | HCI_DM1); 4288 bool changed = false; 4289 int err; 4290 4291 bt_dev_dbg(hdev, "sock %p", sk); 4292 4293 configurable_phys = get_configurable_phys(hdev); 4294 supported_phys = get_supported_phys(hdev); 4295 selected_phys = __le32_to_cpu(cp->selected_phys); 4296 4297 if (selected_phys & ~supported_phys) 4298 return mgmt_cmd_status(sk, hdev->id, 4299 MGMT_OP_SET_PHY_CONFIGURATION, 4300 MGMT_STATUS_INVALID_PARAMS); 4301 4302 unconfigure_phys = supported_phys & ~configurable_phys; 4303 4304 if ((selected_phys & unconfigure_phys) != unconfigure_phys) 4305 return mgmt_cmd_status(sk, hdev->id, 4306 MGMT_OP_SET_PHY_CONFIGURATION, 4307 MGMT_STATUS_INVALID_PARAMS); 4308 4309 if (selected_phys == get_selected_phys(hdev)) 4310 return mgmt_cmd_complete(sk, hdev->id, 4311 MGMT_OP_SET_PHY_CONFIGURATION, 4312 0, NULL, 0); 4313 4314 hci_dev_lock(hdev); 4315 4316 if (!hdev_is_powered(hdev)) { 4317 err = mgmt_cmd_status(sk, hdev->id, 4318 MGMT_OP_SET_PHY_CONFIGURATION, 4319 MGMT_STATUS_REJECTED); 4320 goto unlock; 4321 } 4322 4323 if (pending_find(MGMT_OP_SET_PHY_CONFIGURATION, hdev)) { 4324 err = mgmt_cmd_status(sk, hdev->id, 4325 MGMT_OP_SET_PHY_CONFIGURATION, 4326 MGMT_STATUS_BUSY); 4327 goto unlock; 4328 } 4329 4330 if (selected_phys & MGMT_PHY_BR_1M_3SLOT) 4331 pkt_type |= (HCI_DH3 | HCI_DM3); 4332 else 4333 pkt_type &= ~(HCI_DH3 | HCI_DM3); 4334 4335 if (selected_phys & MGMT_PHY_BR_1M_5SLOT) 4336 pkt_type |= (HCI_DH5 | HCI_DM5); 4337 else 4338 pkt_type &= ~(HCI_DH5 | HCI_DM5); 4339 4340 if (selected_phys & MGMT_PHY_EDR_2M_1SLOT) 4341 pkt_type &= ~HCI_2DH1; 4342 else 4343 pkt_type |= HCI_2DH1; 4344 4345 if (selected_phys & MGMT_PHY_EDR_2M_3SLOT) 4346 pkt_type &= ~HCI_2DH3; 4347 else 4348 pkt_type |= HCI_2DH3; 4349 4350 if (selected_phys & MGMT_PHY_EDR_2M_5SLOT) 4351 pkt_type &= ~HCI_2DH5; 4352 else 4353 pkt_type |= HCI_2DH5; 4354 4355 if (selected_phys & MGMT_PHY_EDR_3M_1SLOT) 4356 pkt_type &= ~HCI_3DH1; 4357 else 4358 pkt_type |= HCI_3DH1; 4359 4360 if (selected_phys & MGMT_PHY_EDR_3M_3SLOT) 4361 pkt_type &= ~HCI_3DH3; 4362 else 4363 pkt_type |= HCI_3DH3; 4364 4365 if (selected_phys & MGMT_PHY_EDR_3M_5SLOT) 4366 pkt_type &= ~HCI_3DH5; 4367 else 4368 pkt_type |= HCI_3DH5; 4369 4370 if (pkt_type != hdev->pkt_type) { 4371 hdev->pkt_type = pkt_type; 4372 changed = true; 4373 } 4374 4375 if ((selected_phys & MGMT_PHY_LE_MASK) == 4376 (get_selected_phys(hdev) & MGMT_PHY_LE_MASK)) { 4377 if (changed) 4378 mgmt_phy_configuration_changed(hdev, sk); 4379 4380 err = mgmt_cmd_complete(sk, hdev->id, 4381 MGMT_OP_SET_PHY_CONFIGURATION, 4382 0, NULL, 0); 4383 4384 goto unlock; 4385 } 4386 4387 cmd = mgmt_pending_new(sk, MGMT_OP_SET_PHY_CONFIGURATION, hdev, data, 4388 len); 4389 if (!cmd) 4390 err = -ENOMEM; 4391 else 4392 err = hci_cmd_sync_queue(hdev, set_default_phy_sync, cmd, 4393 set_default_phy_complete); 4394 4395 if (err < 0) { 4396 err = mgmt_cmd_status(sk, hdev->id, 4397 MGMT_OP_SET_PHY_CONFIGURATION, 4398 MGMT_STATUS_FAILED); 4399 4400 if (cmd) 4401 mgmt_pending_remove(cmd); 4402 } 4403 4404 unlock: 4405 hci_dev_unlock(hdev); 4406 4407 return err; 4408 } 4409 4410 static int set_blocked_keys(struct sock *sk, struct hci_dev *hdev, void *data, 4411 u16 len) 4412 { 4413 int err = MGMT_STATUS_SUCCESS; 4414 struct mgmt_cp_set_blocked_keys *keys = data; 4415 const u16 max_key_count = ((U16_MAX - sizeof(*keys)) / 4416 sizeof(struct mgmt_blocked_key_info)); 4417 u16 key_count, expected_len; 4418 int i; 4419 4420 bt_dev_dbg(hdev, "sock %p", sk); 4421 4422 key_count = __le16_to_cpu(keys->key_count); 4423 if (key_count > max_key_count) { 4424 bt_dev_err(hdev, "too big key_count value %u", key_count); 4425 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BLOCKED_KEYS, 4426 MGMT_STATUS_INVALID_PARAMS); 4427 } 4428 4429 expected_len = struct_size(keys, keys, key_count); 4430 if (expected_len != len) { 4431 bt_dev_err(hdev, "expected %u bytes, got %u bytes", 4432 expected_len, len); 4433 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BLOCKED_KEYS, 4434 MGMT_STATUS_INVALID_PARAMS); 4435 } 4436 4437 hci_dev_lock(hdev); 4438 4439 hci_blocked_keys_clear(hdev); 4440 4441 for (i = 0; i < key_count; ++i) { 4442 struct blocked_key *b = kzalloc_obj(*b); 4443 4444 if (!b) { 4445 err = MGMT_STATUS_NO_RESOURCES; 4446 break; 4447 } 4448 4449 b->type = keys->keys[i].type; 4450 memcpy(b->val, keys->keys[i].val, sizeof(b->val)); 4451 list_add_rcu(&b->list, &hdev->blocked_keys); 4452 } 4453 hci_dev_unlock(hdev); 4454 4455 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_BLOCKED_KEYS, 4456 err, NULL, 0); 4457 } 4458 4459 static int set_wideband_speech(struct sock *sk, struct hci_dev *hdev, 4460 void *data, u16 len) 4461 { 4462 struct mgmt_mode *cp = data; 4463 int err; 4464 bool changed = false; 4465 4466 bt_dev_dbg(hdev, "sock %p", sk); 4467 4468 if (!hci_test_quirk(hdev, HCI_QUIRK_WIDEBAND_SPEECH_SUPPORTED)) 4469 return mgmt_cmd_status(sk, hdev->id, 4470 MGMT_OP_SET_WIDEBAND_SPEECH, 4471 MGMT_STATUS_NOT_SUPPORTED); 4472 4473 if (cp->val != 0x00 && cp->val != 0x01) 4474 return mgmt_cmd_status(sk, hdev->id, 4475 MGMT_OP_SET_WIDEBAND_SPEECH, 4476 MGMT_STATUS_INVALID_PARAMS); 4477 4478 hci_dev_lock(hdev); 4479 4480 if (hdev_is_powered(hdev) && 4481 !!cp->val != hci_dev_test_flag(hdev, 4482 HCI_WIDEBAND_SPEECH_ENABLED)) { 4483 err = mgmt_cmd_status(sk, hdev->id, 4484 MGMT_OP_SET_WIDEBAND_SPEECH, 4485 MGMT_STATUS_REJECTED); 4486 goto unlock; 4487 } 4488 4489 if (cp->val) 4490 changed = !hci_dev_test_and_set_flag(hdev, 4491 HCI_WIDEBAND_SPEECH_ENABLED); 4492 else 4493 changed = hci_dev_test_and_clear_flag(hdev, 4494 HCI_WIDEBAND_SPEECH_ENABLED); 4495 4496 err = send_settings_rsp(sk, MGMT_OP_SET_WIDEBAND_SPEECH, hdev); 4497 if (err < 0) 4498 goto unlock; 4499 4500 if (changed) 4501 err = new_settings(hdev, sk); 4502 4503 unlock: 4504 hci_dev_unlock(hdev); 4505 return err; 4506 } 4507 4508 static int read_controller_cap(struct sock *sk, struct hci_dev *hdev, 4509 void *data, u16 data_len) 4510 { 4511 char buf[20]; 4512 struct mgmt_rp_read_controller_cap *rp = (void *)buf; 4513 u16 cap_len = 0; 4514 u8 flags = 0; 4515 u8 tx_power_range[2]; 4516 4517 bt_dev_dbg(hdev, "sock %p", sk); 4518 4519 memset(&buf, 0, sizeof(buf)); 4520 4521 hci_dev_lock(hdev); 4522 4523 /* When the Read Simple Pairing Options command is supported, then 4524 * the remote public key validation is supported. 4525 * 4526 * Alternatively, when Microsoft extensions are available, they can 4527 * indicate support for public key validation as well. 4528 */ 4529 if ((hdev->commands[41] & 0x08) || msft_curve_validity(hdev)) 4530 flags |= 0x01; /* Remote public key validation (BR/EDR) */ 4531 4532 flags |= 0x02; /* Remote public key validation (LE) */ 4533 4534 /* When the Read Encryption Key Size command is supported, then the 4535 * encryption key size is enforced. 4536 */ 4537 if (hdev->commands[20] & 0x10) 4538 flags |= 0x04; /* Encryption key size enforcement (BR/EDR) */ 4539 4540 flags |= 0x08; /* Encryption key size enforcement (LE) */ 4541 4542 cap_len = eir_append_data(rp->cap, cap_len, MGMT_CAP_SEC_FLAGS, 4543 &flags, 1); 4544 4545 /* When the Read Simple Pairing Options command is supported, then 4546 * also max encryption key size information is provided. 4547 */ 4548 if (hdev->commands[41] & 0x08) 4549 cap_len = eir_append_le16(rp->cap, cap_len, 4550 MGMT_CAP_MAX_ENC_KEY_SIZE, 4551 hdev->max_enc_key_size); 4552 4553 cap_len = eir_append_le16(rp->cap, cap_len, 4554 MGMT_CAP_SMP_MAX_ENC_KEY_SIZE, 4555 SMP_MAX_ENC_KEY_SIZE); 4556 4557 /* Append the min/max LE tx power parameters if we were able to fetch 4558 * it from the controller 4559 */ 4560 if (hdev->commands[38] & 0x80) { 4561 memcpy(&tx_power_range[0], &hdev->min_le_tx_power, 1); 4562 memcpy(&tx_power_range[1], &hdev->max_le_tx_power, 1); 4563 cap_len = eir_append_data(rp->cap, cap_len, MGMT_CAP_LE_TX_PWR, 4564 tx_power_range, 2); 4565 } 4566 4567 rp->cap_len = cpu_to_le16(cap_len); 4568 4569 hci_dev_unlock(hdev); 4570 4571 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_CONTROLLER_CAP, 0, 4572 rp, sizeof(*rp) + cap_len); 4573 } 4574 4575 #ifdef CONFIG_BT_FEATURE_DEBUG 4576 /* d4992530-b9ec-469f-ab01-6c481c47da1c */ 4577 static const u8 debug_uuid[16] = { 4578 0x1c, 0xda, 0x47, 0x1c, 0x48, 0x6c, 0x01, 0xab, 4579 0x9f, 0x46, 0xec, 0xb9, 0x30, 0x25, 0x99, 0xd4, 4580 }; 4581 #endif 4582 4583 /* 330859bc-7506-492d-9370-9a6f0614037f */ 4584 static const u8 quality_report_uuid[16] = { 4585 0x7f, 0x03, 0x14, 0x06, 0x6f, 0x9a, 0x70, 0x93, 4586 0x2d, 0x49, 0x06, 0x75, 0xbc, 0x59, 0x08, 0x33, 4587 }; 4588 4589 /* a6695ace-ee7f-4fb9-881a-5fac66c629af */ 4590 static const u8 offload_codecs_uuid[16] = { 4591 0xaf, 0x29, 0xc6, 0x66, 0xac, 0x5f, 0x1a, 0x88, 4592 0xb9, 0x4f, 0x7f, 0xee, 0xce, 0x5a, 0x69, 0xa6, 4593 }; 4594 4595 /* 671b10b5-42c0-4696-9227-eb28d1b049d6 */ 4596 static const u8 le_simultaneous_roles_uuid[16] = { 4597 0xd6, 0x49, 0xb0, 0xd1, 0x28, 0xeb, 0x27, 0x92, 4598 0x96, 0x46, 0xc0, 0x42, 0xb5, 0x10, 0x1b, 0x67, 4599 }; 4600 4601 /* 6fbaf188-05e0-496a-9885-d6ddfdb4e03e */ 4602 static const u8 iso_socket_uuid[16] = { 4603 0x3e, 0xe0, 0xb4, 0xfd, 0xdd, 0xd6, 0x85, 0x98, 4604 0x6a, 0x49, 0xe0, 0x05, 0x88, 0xf1, 0xba, 0x6f, 4605 }; 4606 4607 /* 2ce463d7-7a03-4d8d-bf05-5f24e8f36e76 */ 4608 static const u8 mgmt_mesh_uuid[16] = { 4609 0x76, 0x6e, 0xf3, 0xe8, 0x24, 0x5f, 0x05, 0xbf, 4610 0x8d, 0x4d, 0x03, 0x7a, 0xd7, 0x63, 0xe4, 0x2c, 4611 }; 4612 4613 static int read_exp_features_info(struct sock *sk, struct hci_dev *hdev, 4614 void *data, u16 data_len) 4615 { 4616 struct mgmt_rp_read_exp_features_info *rp; 4617 size_t len; 4618 u16 idx = 0; 4619 u32 flags; 4620 int status; 4621 4622 bt_dev_dbg(hdev, "sock %p", sk); 4623 4624 /* Enough space for 7 features */ 4625 len = sizeof(*rp) + (sizeof(rp->features[0]) * 7); 4626 rp = kzalloc(len, GFP_KERNEL); 4627 if (!rp) 4628 return -ENOMEM; 4629 4630 #ifdef CONFIG_BT_FEATURE_DEBUG 4631 flags = bt_dbg_get() ? BIT(0) : 0; 4632 4633 memcpy(rp->features[idx].uuid, debug_uuid, 16); 4634 rp->features[idx].flags = cpu_to_le32(flags); 4635 idx++; 4636 #endif 4637 4638 if (hdev && hci_dev_le_state_simultaneous(hdev)) { 4639 if (hci_dev_test_flag(hdev, HCI_LE_SIMULTANEOUS_ROLES)) 4640 flags = BIT(0); 4641 else 4642 flags = 0; 4643 4644 memcpy(rp->features[idx].uuid, le_simultaneous_roles_uuid, 16); 4645 rp->features[idx].flags = cpu_to_le32(flags); 4646 idx++; 4647 } 4648 4649 if (hdev && (aosp_has_quality_report(hdev) || 4650 hdev->set_quality_report)) { 4651 if (hci_dev_test_flag(hdev, HCI_QUALITY_REPORT)) 4652 flags = BIT(0); 4653 else 4654 flags = 0; 4655 4656 memcpy(rp->features[idx].uuid, quality_report_uuid, 16); 4657 rp->features[idx].flags = cpu_to_le32(flags); 4658 idx++; 4659 } 4660 4661 if (hdev && hdev->get_data_path_id) { 4662 if (hci_dev_test_flag(hdev, HCI_OFFLOAD_CODECS_ENABLED)) 4663 flags = BIT(0); 4664 else 4665 flags = 0; 4666 4667 memcpy(rp->features[idx].uuid, offload_codecs_uuid, 16); 4668 rp->features[idx].flags = cpu_to_le32(flags); 4669 idx++; 4670 } 4671 4672 if (IS_ENABLED(CONFIG_BT_LE)) { 4673 flags = iso_inited() ? BIT(0) : 0; 4674 memcpy(rp->features[idx].uuid, iso_socket_uuid, 16); 4675 rp->features[idx].flags = cpu_to_le32(flags); 4676 idx++; 4677 } 4678 4679 if (hdev && lmp_le_capable(hdev)) { 4680 if (hci_dev_test_flag(hdev, HCI_MESH_EXPERIMENTAL)) 4681 flags = BIT(0); 4682 else 4683 flags = 0; 4684 4685 memcpy(rp->features[idx].uuid, mgmt_mesh_uuid, 16); 4686 rp->features[idx].flags = cpu_to_le32(flags); 4687 idx++; 4688 } 4689 4690 rp->feature_count = cpu_to_le16(idx); 4691 4692 /* After reading the experimental features information, enable 4693 * the events to update client on any future change. 4694 */ 4695 hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS); 4696 4697 status = mgmt_cmd_complete(sk, hdev ? hdev->id : MGMT_INDEX_NONE, 4698 MGMT_OP_READ_EXP_FEATURES_INFO, 4699 0, rp, sizeof(*rp) + (20 * idx)); 4700 4701 kfree(rp); 4702 return status; 4703 } 4704 4705 static int exp_feature_changed(struct hci_dev *hdev, const u8 *uuid, 4706 bool enabled, struct sock *skip) 4707 { 4708 struct mgmt_ev_exp_feature_changed ev; 4709 4710 memset(&ev, 0, sizeof(ev)); 4711 memcpy(ev.uuid, uuid, 16); 4712 ev.flags = cpu_to_le32(enabled ? BIT(0) : 0); 4713 4714 return mgmt_limited_event(MGMT_EV_EXP_FEATURE_CHANGED, hdev, 4715 &ev, sizeof(ev), 4716 HCI_MGMT_EXP_FEATURE_EVENTS, skip); 4717 } 4718 4719 #define EXP_FEAT(_uuid, _set_func) \ 4720 { \ 4721 .uuid = _uuid, \ 4722 .set_func = _set_func, \ 4723 } 4724 4725 /* The zero key uuid is special. Multiple exp features are set through it. */ 4726 static int set_zero_key_func(struct sock *sk, struct hci_dev *hdev, 4727 struct mgmt_cp_set_exp_feature *cp, u16 data_len) 4728 { 4729 struct mgmt_rp_set_exp_feature rp; 4730 4731 memset(rp.uuid, 0, 16); 4732 rp.flags = cpu_to_le32(0); 4733 4734 #ifdef CONFIG_BT_FEATURE_DEBUG 4735 if (!hdev) { 4736 bool changed = bt_dbg_get(); 4737 4738 bt_dbg_set(false); 4739 4740 if (changed) 4741 exp_feature_changed(NULL, ZERO_KEY, false, sk); 4742 } 4743 #endif 4744 4745 hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS); 4746 4747 return mgmt_cmd_complete(sk, hdev ? hdev->id : MGMT_INDEX_NONE, 4748 MGMT_OP_SET_EXP_FEATURE, 0, 4749 &rp, sizeof(rp)); 4750 } 4751 4752 #ifdef CONFIG_BT_FEATURE_DEBUG 4753 static int set_debug_func(struct sock *sk, struct hci_dev *hdev, 4754 struct mgmt_cp_set_exp_feature *cp, u16 data_len) 4755 { 4756 struct mgmt_rp_set_exp_feature rp; 4757 4758 bool val, changed; 4759 int err; 4760 4761 /* Command requires to use the non-controller index */ 4762 if (hdev) 4763 return mgmt_cmd_status(sk, hdev->id, 4764 MGMT_OP_SET_EXP_FEATURE, 4765 MGMT_STATUS_INVALID_INDEX); 4766 4767 /* Parameters are limited to a single octet */ 4768 if (data_len != MGMT_SET_EXP_FEATURE_SIZE + 1) 4769 return mgmt_cmd_status(sk, MGMT_INDEX_NONE, 4770 MGMT_OP_SET_EXP_FEATURE, 4771 MGMT_STATUS_INVALID_PARAMS); 4772 4773 /* Only boolean on/off is supported */ 4774 if (cp->param[0] != 0x00 && cp->param[0] != 0x01) 4775 return mgmt_cmd_status(sk, MGMT_INDEX_NONE, 4776 MGMT_OP_SET_EXP_FEATURE, 4777 MGMT_STATUS_INVALID_PARAMS); 4778 4779 val = !!cp->param[0]; 4780 changed = val ? !bt_dbg_get() : bt_dbg_get(); 4781 bt_dbg_set(val); 4782 4783 memcpy(rp.uuid, debug_uuid, 16); 4784 rp.flags = cpu_to_le32(val ? BIT(0) : 0); 4785 4786 hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS); 4787 4788 err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE, 4789 MGMT_OP_SET_EXP_FEATURE, 0, 4790 &rp, sizeof(rp)); 4791 4792 if (changed) 4793 exp_feature_changed(hdev, debug_uuid, val, sk); 4794 4795 return err; 4796 } 4797 #endif 4798 4799 static int set_mgmt_mesh_func(struct sock *sk, struct hci_dev *hdev, 4800 struct mgmt_cp_set_exp_feature *cp, u16 data_len) 4801 { 4802 struct mgmt_rp_set_exp_feature rp; 4803 bool val, changed; 4804 int err; 4805 4806 /* Command requires to use the controller index */ 4807 if (!hdev) 4808 return mgmt_cmd_status(sk, MGMT_INDEX_NONE, 4809 MGMT_OP_SET_EXP_FEATURE, 4810 MGMT_STATUS_INVALID_INDEX); 4811 4812 /* Parameters are limited to a single octet */ 4813 if (data_len != MGMT_SET_EXP_FEATURE_SIZE + 1) 4814 return mgmt_cmd_status(sk, hdev->id, 4815 MGMT_OP_SET_EXP_FEATURE, 4816 MGMT_STATUS_INVALID_PARAMS); 4817 4818 /* Only boolean on/off is supported */ 4819 if (cp->param[0] != 0x00 && cp->param[0] != 0x01) 4820 return mgmt_cmd_status(sk, hdev->id, 4821 MGMT_OP_SET_EXP_FEATURE, 4822 MGMT_STATUS_INVALID_PARAMS); 4823 4824 val = !!cp->param[0]; 4825 4826 if (val) { 4827 changed = !hci_dev_test_and_set_flag(hdev, 4828 HCI_MESH_EXPERIMENTAL); 4829 } else { 4830 hci_dev_clear_flag(hdev, HCI_MESH); 4831 changed = hci_dev_test_and_clear_flag(hdev, 4832 HCI_MESH_EXPERIMENTAL); 4833 } 4834 4835 memcpy(rp.uuid, mgmt_mesh_uuid, 16); 4836 rp.flags = cpu_to_le32(val ? BIT(0) : 0); 4837 4838 hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS); 4839 4840 err = mgmt_cmd_complete(sk, hdev->id, 4841 MGMT_OP_SET_EXP_FEATURE, 0, 4842 &rp, sizeof(rp)); 4843 4844 if (changed) 4845 exp_feature_changed(hdev, mgmt_mesh_uuid, val, sk); 4846 4847 return err; 4848 } 4849 4850 static int set_quality_report_func(struct sock *sk, struct hci_dev *hdev, 4851 struct mgmt_cp_set_exp_feature *cp, 4852 u16 data_len) 4853 { 4854 struct mgmt_rp_set_exp_feature rp; 4855 bool val, changed; 4856 int err; 4857 4858 /* Command requires to use a valid controller index */ 4859 if (!hdev) 4860 return mgmt_cmd_status(sk, MGMT_INDEX_NONE, 4861 MGMT_OP_SET_EXP_FEATURE, 4862 MGMT_STATUS_INVALID_INDEX); 4863 4864 /* Parameters are limited to a single octet */ 4865 if (data_len != MGMT_SET_EXP_FEATURE_SIZE + 1) 4866 return mgmt_cmd_status(sk, hdev->id, 4867 MGMT_OP_SET_EXP_FEATURE, 4868 MGMT_STATUS_INVALID_PARAMS); 4869 4870 /* Only boolean on/off is supported */ 4871 if (cp->param[0] != 0x00 && cp->param[0] != 0x01) 4872 return mgmt_cmd_status(sk, hdev->id, 4873 MGMT_OP_SET_EXP_FEATURE, 4874 MGMT_STATUS_INVALID_PARAMS); 4875 4876 hci_req_sync_lock(hdev); 4877 4878 val = !!cp->param[0]; 4879 changed = (val != hci_dev_test_flag(hdev, HCI_QUALITY_REPORT)); 4880 4881 if (!aosp_has_quality_report(hdev) && !hdev->set_quality_report) { 4882 err = mgmt_cmd_status(sk, hdev->id, 4883 MGMT_OP_SET_EXP_FEATURE, 4884 MGMT_STATUS_NOT_SUPPORTED); 4885 goto unlock_quality_report; 4886 } 4887 4888 if (changed) { 4889 if (hdev->set_quality_report) 4890 err = hdev->set_quality_report(hdev, val); 4891 else 4892 err = aosp_set_quality_report(hdev, val); 4893 4894 if (err) { 4895 err = mgmt_cmd_status(sk, hdev->id, 4896 MGMT_OP_SET_EXP_FEATURE, 4897 MGMT_STATUS_FAILED); 4898 goto unlock_quality_report; 4899 } 4900 4901 if (val) 4902 hci_dev_set_flag(hdev, HCI_QUALITY_REPORT); 4903 else 4904 hci_dev_clear_flag(hdev, HCI_QUALITY_REPORT); 4905 } 4906 4907 bt_dev_dbg(hdev, "quality report enable %d changed %d", val, changed); 4908 4909 memcpy(rp.uuid, quality_report_uuid, 16); 4910 rp.flags = cpu_to_le32(val ? BIT(0) : 0); 4911 hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS); 4912 4913 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_EXP_FEATURE, 0, 4914 &rp, sizeof(rp)); 4915 4916 if (changed) 4917 exp_feature_changed(hdev, quality_report_uuid, val, sk); 4918 4919 unlock_quality_report: 4920 hci_req_sync_unlock(hdev); 4921 return err; 4922 } 4923 4924 static int set_offload_codec_func(struct sock *sk, struct hci_dev *hdev, 4925 struct mgmt_cp_set_exp_feature *cp, 4926 u16 data_len) 4927 { 4928 bool val, changed; 4929 int err; 4930 struct mgmt_rp_set_exp_feature rp; 4931 4932 /* Command requires to use a valid controller index */ 4933 if (!hdev) 4934 return mgmt_cmd_status(sk, MGMT_INDEX_NONE, 4935 MGMT_OP_SET_EXP_FEATURE, 4936 MGMT_STATUS_INVALID_INDEX); 4937 4938 /* Parameters are limited to a single octet */ 4939 if (data_len != MGMT_SET_EXP_FEATURE_SIZE + 1) 4940 return mgmt_cmd_status(sk, hdev->id, 4941 MGMT_OP_SET_EXP_FEATURE, 4942 MGMT_STATUS_INVALID_PARAMS); 4943 4944 /* Only boolean on/off is supported */ 4945 if (cp->param[0] != 0x00 && cp->param[0] != 0x01) 4946 return mgmt_cmd_status(sk, hdev->id, 4947 MGMT_OP_SET_EXP_FEATURE, 4948 MGMT_STATUS_INVALID_PARAMS); 4949 4950 val = !!cp->param[0]; 4951 changed = (val != hci_dev_test_flag(hdev, HCI_OFFLOAD_CODECS_ENABLED)); 4952 4953 if (!hdev->get_data_path_id) { 4954 return mgmt_cmd_status(sk, hdev->id, 4955 MGMT_OP_SET_EXP_FEATURE, 4956 MGMT_STATUS_NOT_SUPPORTED); 4957 } 4958 4959 if (changed) { 4960 if (val) 4961 hci_dev_set_flag(hdev, HCI_OFFLOAD_CODECS_ENABLED); 4962 else 4963 hci_dev_clear_flag(hdev, HCI_OFFLOAD_CODECS_ENABLED); 4964 } 4965 4966 bt_dev_info(hdev, "offload codecs enable %d changed %d", 4967 val, changed); 4968 4969 memcpy(rp.uuid, offload_codecs_uuid, 16); 4970 rp.flags = cpu_to_le32(val ? BIT(0) : 0); 4971 hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS); 4972 err = mgmt_cmd_complete(sk, hdev->id, 4973 MGMT_OP_SET_EXP_FEATURE, 0, 4974 &rp, sizeof(rp)); 4975 4976 if (changed) 4977 exp_feature_changed(hdev, offload_codecs_uuid, val, sk); 4978 4979 return err; 4980 } 4981 4982 static int set_le_simultaneous_roles_func(struct sock *sk, struct hci_dev *hdev, 4983 struct mgmt_cp_set_exp_feature *cp, 4984 u16 data_len) 4985 { 4986 bool val, changed; 4987 int err; 4988 struct mgmt_rp_set_exp_feature rp; 4989 4990 /* Command requires to use a valid controller index */ 4991 if (!hdev) 4992 return mgmt_cmd_status(sk, MGMT_INDEX_NONE, 4993 MGMT_OP_SET_EXP_FEATURE, 4994 MGMT_STATUS_INVALID_INDEX); 4995 4996 /* Parameters are limited to a single octet */ 4997 if (data_len != MGMT_SET_EXP_FEATURE_SIZE + 1) 4998 return mgmt_cmd_status(sk, hdev->id, 4999 MGMT_OP_SET_EXP_FEATURE, 5000 MGMT_STATUS_INVALID_PARAMS); 5001 5002 /* Only boolean on/off is supported */ 5003 if (cp->param[0] != 0x00 && cp->param[0] != 0x01) 5004 return mgmt_cmd_status(sk, hdev->id, 5005 MGMT_OP_SET_EXP_FEATURE, 5006 MGMT_STATUS_INVALID_PARAMS); 5007 5008 val = !!cp->param[0]; 5009 changed = (val != hci_dev_test_flag(hdev, HCI_LE_SIMULTANEOUS_ROLES)); 5010 5011 if (!hci_dev_le_state_simultaneous(hdev)) { 5012 return mgmt_cmd_status(sk, hdev->id, 5013 MGMT_OP_SET_EXP_FEATURE, 5014 MGMT_STATUS_NOT_SUPPORTED); 5015 } 5016 5017 if (changed) { 5018 if (val) 5019 hci_dev_set_flag(hdev, HCI_LE_SIMULTANEOUS_ROLES); 5020 else 5021 hci_dev_clear_flag(hdev, HCI_LE_SIMULTANEOUS_ROLES); 5022 } 5023 5024 bt_dev_info(hdev, "LE simultaneous roles enable %d changed %d", 5025 val, changed); 5026 5027 memcpy(rp.uuid, le_simultaneous_roles_uuid, 16); 5028 rp.flags = cpu_to_le32(val ? BIT(0) : 0); 5029 hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS); 5030 err = mgmt_cmd_complete(sk, hdev->id, 5031 MGMT_OP_SET_EXP_FEATURE, 0, 5032 &rp, sizeof(rp)); 5033 5034 if (changed) 5035 exp_feature_changed(hdev, le_simultaneous_roles_uuid, val, sk); 5036 5037 return err; 5038 } 5039 5040 #ifdef CONFIG_BT_LE 5041 static int set_iso_socket_func(struct sock *sk, struct hci_dev *hdev, 5042 struct mgmt_cp_set_exp_feature *cp, u16 data_len) 5043 { 5044 struct mgmt_rp_set_exp_feature rp; 5045 bool val, changed = false; 5046 int err; 5047 5048 /* Command requires to use the non-controller index */ 5049 if (hdev) 5050 return mgmt_cmd_status(sk, hdev->id, 5051 MGMT_OP_SET_EXP_FEATURE, 5052 MGMT_STATUS_INVALID_INDEX); 5053 5054 /* Parameters are limited to a single octet */ 5055 if (data_len != MGMT_SET_EXP_FEATURE_SIZE + 1) 5056 return mgmt_cmd_status(sk, MGMT_INDEX_NONE, 5057 MGMT_OP_SET_EXP_FEATURE, 5058 MGMT_STATUS_INVALID_PARAMS); 5059 5060 /* Only boolean on/off is supported */ 5061 if (cp->param[0] != 0x00 && cp->param[0] != 0x01) 5062 return mgmt_cmd_status(sk, MGMT_INDEX_NONE, 5063 MGMT_OP_SET_EXP_FEATURE, 5064 MGMT_STATUS_INVALID_PARAMS); 5065 5066 val = cp->param[0] ? true : false; 5067 if (val) 5068 err = iso_init(); 5069 else 5070 err = iso_exit(); 5071 5072 if (!err) 5073 changed = true; 5074 5075 memcpy(rp.uuid, iso_socket_uuid, 16); 5076 rp.flags = cpu_to_le32(val ? BIT(0) : 0); 5077 5078 hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS); 5079 5080 err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE, 5081 MGMT_OP_SET_EXP_FEATURE, 0, 5082 &rp, sizeof(rp)); 5083 5084 if (changed) 5085 exp_feature_changed(hdev, iso_socket_uuid, val, sk); 5086 5087 return err; 5088 } 5089 #endif 5090 5091 static const struct mgmt_exp_feature { 5092 const u8 *uuid; 5093 int (*set_func)(struct sock *sk, struct hci_dev *hdev, 5094 struct mgmt_cp_set_exp_feature *cp, u16 data_len); 5095 } exp_features[] = { 5096 EXP_FEAT(ZERO_KEY, set_zero_key_func), 5097 #ifdef CONFIG_BT_FEATURE_DEBUG 5098 EXP_FEAT(debug_uuid, set_debug_func), 5099 #endif 5100 EXP_FEAT(mgmt_mesh_uuid, set_mgmt_mesh_func), 5101 EXP_FEAT(quality_report_uuid, set_quality_report_func), 5102 EXP_FEAT(offload_codecs_uuid, set_offload_codec_func), 5103 EXP_FEAT(le_simultaneous_roles_uuid, set_le_simultaneous_roles_func), 5104 #ifdef CONFIG_BT_LE 5105 EXP_FEAT(iso_socket_uuid, set_iso_socket_func), 5106 #endif 5107 5108 /* end with a null feature */ 5109 EXP_FEAT(NULL, NULL) 5110 }; 5111 5112 static int set_exp_feature(struct sock *sk, struct hci_dev *hdev, 5113 void *data, u16 data_len) 5114 { 5115 struct mgmt_cp_set_exp_feature *cp = data; 5116 size_t i = 0; 5117 5118 bt_dev_dbg(hdev, "sock %p", sk); 5119 5120 for (i = 0; exp_features[i].uuid; i++) { 5121 if (!memcmp(cp->uuid, exp_features[i].uuid, 16)) 5122 return exp_features[i].set_func(sk, hdev, cp, data_len); 5123 } 5124 5125 return mgmt_cmd_status(sk, hdev ? hdev->id : MGMT_INDEX_NONE, 5126 MGMT_OP_SET_EXP_FEATURE, 5127 MGMT_STATUS_NOT_SUPPORTED); 5128 } 5129 5130 static int get_device_flags(struct sock *sk, struct hci_dev *hdev, void *data, 5131 u16 data_len) 5132 { 5133 struct mgmt_cp_get_device_flags *cp = data; 5134 struct mgmt_rp_get_device_flags rp; 5135 struct bdaddr_list_with_flags *br_params; 5136 struct hci_conn_params *params; 5137 u32 supported_flags; 5138 u32 current_flags = 0; 5139 u8 status = MGMT_STATUS_INVALID_PARAMS; 5140 5141 bt_dev_dbg(hdev, "Get device flags %pMR (type 0x%x)\n", 5142 &cp->addr.bdaddr, cp->addr.type); 5143 5144 hci_dev_lock(hdev); 5145 5146 supported_flags = hdev->conn_flags; 5147 5148 memset(&rp, 0, sizeof(rp)); 5149 5150 if (cp->addr.type == BDADDR_BREDR) { 5151 br_params = hci_bdaddr_list_lookup_with_flags(&hdev->accept_list, 5152 &cp->addr.bdaddr, 5153 cp->addr.type); 5154 if (!br_params) 5155 goto done; 5156 5157 current_flags = br_params->flags; 5158 } else { 5159 params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr, 5160 le_addr_type(cp->addr.type)); 5161 if (!params) 5162 goto done; 5163 5164 current_flags = params->flags; 5165 } 5166 5167 bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr); 5168 rp.addr.type = cp->addr.type; 5169 rp.supported_flags = cpu_to_le32(supported_flags); 5170 rp.current_flags = cpu_to_le32(current_flags); 5171 5172 status = MGMT_STATUS_SUCCESS; 5173 5174 done: 5175 hci_dev_unlock(hdev); 5176 5177 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_DEVICE_FLAGS, status, 5178 &rp, sizeof(rp)); 5179 } 5180 5181 static void device_flags_changed(struct sock *sk, struct hci_dev *hdev, 5182 bdaddr_t *bdaddr, u8 bdaddr_type, 5183 u32 supported_flags, u32 current_flags) 5184 { 5185 struct mgmt_ev_device_flags_changed ev; 5186 5187 bacpy(&ev.addr.bdaddr, bdaddr); 5188 ev.addr.type = bdaddr_type; 5189 ev.supported_flags = cpu_to_le32(supported_flags); 5190 ev.current_flags = cpu_to_le32(current_flags); 5191 5192 mgmt_event(MGMT_EV_DEVICE_FLAGS_CHANGED, hdev, &ev, sizeof(ev), sk); 5193 } 5194 5195 static bool is_connected(struct hci_dev *hdev, bdaddr_t *addr, u8 type) 5196 { 5197 struct hci_conn *conn; 5198 5199 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, addr); 5200 if (!conn) 5201 return false; 5202 5203 if (conn->dst_type != type) 5204 return false; 5205 5206 if (conn->state != BT_CONNECTED) 5207 return false; 5208 5209 return true; 5210 } 5211 5212 /* This function requires the caller holds hdev->lock */ 5213 static struct hci_conn_params *hci_conn_params_set(struct hci_dev *hdev, 5214 bdaddr_t *addr, u8 addr_type, 5215 u8 auto_connect) 5216 { 5217 struct hci_conn_params *params; 5218 5219 params = hci_conn_params_add(hdev, addr, addr_type); 5220 if (!params) 5221 return NULL; 5222 5223 if (params->auto_connect == auto_connect) 5224 return params; 5225 5226 hci_pend_le_list_del_init(params); 5227 5228 switch (auto_connect) { 5229 case HCI_AUTO_CONN_DISABLED: 5230 case HCI_AUTO_CONN_LINK_LOSS: 5231 /* If auto connect is being disabled when we're trying to 5232 * connect to device, keep connecting. 5233 */ 5234 if (params->explicit_connect) 5235 hci_pend_le_list_add(params, &hdev->pend_le_conns); 5236 break; 5237 case HCI_AUTO_CONN_REPORT: 5238 if (params->explicit_connect) 5239 hci_pend_le_list_add(params, &hdev->pend_le_conns); 5240 else 5241 hci_pend_le_list_add(params, &hdev->pend_le_reports); 5242 break; 5243 case HCI_AUTO_CONN_DIRECT: 5244 case HCI_AUTO_CONN_ALWAYS: 5245 if (!is_connected(hdev, addr, addr_type)) 5246 hci_pend_le_list_add(params, &hdev->pend_le_conns); 5247 break; 5248 } 5249 5250 params->auto_connect = auto_connect; 5251 5252 bt_dev_dbg(hdev, "addr %pMR (type %u) auto_connect %u", 5253 addr, addr_type, auto_connect); 5254 5255 return params; 5256 } 5257 5258 static int set_device_flags(struct sock *sk, struct hci_dev *hdev, void *data, 5259 u16 len) 5260 { 5261 struct mgmt_cp_set_device_flags *cp = data; 5262 struct bdaddr_list_with_flags *br_params; 5263 struct hci_conn_params *params; 5264 u8 status = MGMT_STATUS_INVALID_PARAMS; 5265 u32 supported_flags; 5266 u32 current_flags = __le32_to_cpu(cp->current_flags); 5267 5268 bt_dev_dbg(hdev, "Set device flags %pMR (type 0x%x) = 0x%x", 5269 &cp->addr.bdaddr, cp->addr.type, current_flags); 5270 5271 // We should take hci_dev_lock() early, I think.. conn_flags can change 5272 supported_flags = hdev->conn_flags; 5273 5274 if ((supported_flags | current_flags) != supported_flags) { 5275 bt_dev_warn(hdev, "Bad flag given (0x%x) vs supported (0x%0x)", 5276 current_flags, supported_flags); 5277 goto done; 5278 } 5279 5280 hci_dev_lock(hdev); 5281 5282 if (cp->addr.type == BDADDR_BREDR) { 5283 br_params = hci_bdaddr_list_lookup_with_flags(&hdev->accept_list, 5284 &cp->addr.bdaddr, 5285 cp->addr.type); 5286 5287 if (br_params) { 5288 br_params->flags = current_flags; 5289 status = MGMT_STATUS_SUCCESS; 5290 } else { 5291 bt_dev_warn(hdev, "No such BR/EDR device %pMR (0x%x)", 5292 &cp->addr.bdaddr, cp->addr.type); 5293 } 5294 5295 goto unlock; 5296 } 5297 5298 params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr, 5299 le_addr_type(cp->addr.type)); 5300 if (!params) { 5301 /* Create a new hci_conn_params if it doesn't exist */ 5302 params = hci_conn_params_set(hdev, &cp->addr.bdaddr, 5303 le_addr_type(cp->addr.type), 5304 HCI_AUTO_CONN_DISABLED); 5305 if (!params) { 5306 bt_dev_warn(hdev, "No such LE device %pMR (0x%x)", 5307 &cp->addr.bdaddr, 5308 le_addr_type(cp->addr.type)); 5309 goto unlock; 5310 } 5311 } 5312 5313 supported_flags = hdev->conn_flags; 5314 5315 if ((supported_flags | current_flags) != supported_flags) { 5316 bt_dev_warn(hdev, "Bad flag given (0x%x) vs supported (0x%0x)", 5317 current_flags, supported_flags); 5318 goto unlock; 5319 } 5320 5321 WRITE_ONCE(params->flags, current_flags); 5322 status = MGMT_STATUS_SUCCESS; 5323 5324 /* Update passive scan if HCI_CONN_FLAG_DEVICE_PRIVACY 5325 * has been set. 5326 */ 5327 if (params->flags & HCI_CONN_FLAG_DEVICE_PRIVACY) 5328 hci_update_passive_scan(hdev); 5329 5330 unlock: 5331 hci_dev_unlock(hdev); 5332 5333 done: 5334 if (status == MGMT_STATUS_SUCCESS) 5335 device_flags_changed(sk, hdev, &cp->addr.bdaddr, cp->addr.type, 5336 supported_flags, current_flags); 5337 5338 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_DEVICE_FLAGS, status, 5339 &cp->addr, sizeof(cp->addr)); 5340 } 5341 5342 static void mgmt_adv_monitor_added(struct sock *sk, struct hci_dev *hdev, 5343 u16 handle) 5344 { 5345 struct mgmt_ev_adv_monitor_added ev; 5346 5347 ev.monitor_handle = cpu_to_le16(handle); 5348 5349 mgmt_event(MGMT_EV_ADV_MONITOR_ADDED, hdev, &ev, sizeof(ev), sk); 5350 } 5351 5352 static void mgmt_adv_monitor_removed(struct sock *sk, struct hci_dev *hdev, 5353 __le16 handle) 5354 { 5355 struct mgmt_ev_adv_monitor_removed ev; 5356 5357 ev.monitor_handle = handle; 5358 5359 mgmt_event(MGMT_EV_ADV_MONITOR_REMOVED, hdev, &ev, sizeof(ev), sk); 5360 } 5361 5362 static int read_adv_mon_features(struct sock *sk, struct hci_dev *hdev, 5363 void *data, u16 len) 5364 { 5365 struct adv_monitor *monitor = NULL; 5366 struct mgmt_rp_read_adv_monitor_features *rp = NULL; 5367 int handle, err; 5368 size_t rp_size = 0; 5369 __u32 supported = 0; 5370 __u32 enabled = 0; 5371 __u16 num_handles = 0; 5372 __u16 handles[HCI_MAX_ADV_MONITOR_NUM_HANDLES]; 5373 5374 BT_DBG("request for %s", hdev->name); 5375 5376 hci_dev_lock(hdev); 5377 5378 if (msft_monitor_supported(hdev)) 5379 supported |= MGMT_ADV_MONITOR_FEATURE_MASK_OR_PATTERNS; 5380 5381 idr_for_each_entry(&hdev->adv_monitors_idr, monitor, handle) 5382 handles[num_handles++] = monitor->handle; 5383 5384 hci_dev_unlock(hdev); 5385 5386 rp_size = sizeof(*rp) + (num_handles * sizeof(u16)); 5387 rp = kmalloc(rp_size, GFP_KERNEL); 5388 if (!rp) 5389 return -ENOMEM; 5390 5391 /* All supported features are currently enabled */ 5392 enabled = supported; 5393 5394 rp->supported_features = cpu_to_le32(supported); 5395 rp->enabled_features = cpu_to_le32(enabled); 5396 rp->max_num_handles = cpu_to_le16(HCI_MAX_ADV_MONITOR_NUM_HANDLES); 5397 rp->max_num_patterns = HCI_MAX_ADV_MONITOR_NUM_PATTERNS; 5398 rp->num_handles = cpu_to_le16(num_handles); 5399 if (num_handles) 5400 memcpy(&rp->handles, &handles, (num_handles * sizeof(u16))); 5401 5402 err = mgmt_cmd_complete(sk, hdev->id, 5403 MGMT_OP_READ_ADV_MONITOR_FEATURES, 5404 MGMT_STATUS_SUCCESS, rp, rp_size); 5405 5406 kfree(rp); 5407 5408 return err; 5409 } 5410 5411 static void mgmt_add_adv_patterns_monitor_complete(struct hci_dev *hdev, 5412 void *data, int status) 5413 { 5414 struct mgmt_rp_add_adv_patterns_monitor rp; 5415 struct mgmt_pending_cmd *cmd = data; 5416 struct adv_monitor *monitor; 5417 5418 /* This is likely the result of hdev being closed and mgmt_index_removed 5419 * is attempting to clean up any pending command so 5420 * hci_adv_monitors_clear is about to be called which will take care of 5421 * freeing the adv_monitor instances. 5422 */ 5423 if (status == -ECANCELED || !mgmt_pending_valid(hdev, cmd)) 5424 return; 5425 5426 monitor = cmd->user_data; 5427 5428 hci_dev_lock(hdev); 5429 5430 rp.monitor_handle = cpu_to_le16(monitor->handle); 5431 5432 if (!status) { 5433 mgmt_adv_monitor_added(cmd->sk, hdev, monitor->handle); 5434 hdev->adv_monitors_cnt++; 5435 if (monitor->state == ADV_MONITOR_STATE_NOT_REGISTERED) 5436 monitor->state = ADV_MONITOR_STATE_REGISTERED; 5437 hci_update_passive_scan(hdev); 5438 } else { 5439 hci_free_adv_monitor(hdev, monitor); 5440 } 5441 5442 mgmt_cmd_complete(cmd->sk, cmd->hdev->id, cmd->opcode, 5443 mgmt_status(status), &rp, sizeof(rp)); 5444 mgmt_pending_free(cmd); 5445 5446 hci_dev_unlock(hdev); 5447 bt_dev_dbg(hdev, "add monitor %d complete, status %d", 5448 rp.monitor_handle, status); 5449 } 5450 5451 static int mgmt_add_adv_patterns_monitor_sync(struct hci_dev *hdev, void *data) 5452 { 5453 struct mgmt_pending_cmd *cmd = data; 5454 struct adv_monitor *mon; 5455 5456 mutex_lock(&hdev->mgmt_pending_lock); 5457 5458 if (!__mgmt_pending_listed(hdev, cmd)) { 5459 mutex_unlock(&hdev->mgmt_pending_lock); 5460 return -ECANCELED; 5461 } 5462 5463 mon = cmd->user_data; 5464 5465 mutex_unlock(&hdev->mgmt_pending_lock); 5466 5467 return hci_add_adv_monitor(hdev, mon); 5468 } 5469 5470 static int __add_adv_patterns_monitor(struct sock *sk, struct hci_dev *hdev, 5471 struct adv_monitor *m, u8 status, 5472 void *data, u16 len, u16 op) 5473 { 5474 struct mgmt_pending_cmd *cmd; 5475 int err; 5476 5477 hci_dev_lock(hdev); 5478 5479 if (status) 5480 goto unlock; 5481 5482 if (pending_find(MGMT_OP_SET_LE, hdev) || 5483 pending_find(MGMT_OP_ADD_ADV_PATTERNS_MONITOR, hdev) || 5484 pending_find(MGMT_OP_ADD_ADV_PATTERNS_MONITOR_RSSI, hdev)) { 5485 status = MGMT_STATUS_BUSY; 5486 goto unlock; 5487 } 5488 5489 cmd = mgmt_pending_add(sk, op, hdev, data, len); 5490 if (!cmd) { 5491 status = MGMT_STATUS_NO_RESOURCES; 5492 goto unlock; 5493 } 5494 5495 cmd->user_data = m; 5496 err = hci_cmd_sync_queue(hdev, mgmt_add_adv_patterns_monitor_sync, cmd, 5497 mgmt_add_adv_patterns_monitor_complete); 5498 if (err) { 5499 if (err == -ENOMEM) 5500 status = MGMT_STATUS_NO_RESOURCES; 5501 else 5502 status = MGMT_STATUS_FAILED; 5503 5504 goto unlock; 5505 } 5506 5507 hci_dev_unlock(hdev); 5508 5509 return 0; 5510 5511 unlock: 5512 hci_free_adv_monitor(hdev, m); 5513 hci_dev_unlock(hdev); 5514 return mgmt_cmd_status(sk, hdev->id, op, status); 5515 } 5516 5517 static void parse_adv_monitor_rssi(struct adv_monitor *m, 5518 struct mgmt_adv_rssi_thresholds *rssi) 5519 { 5520 if (rssi) { 5521 m->rssi.low_threshold = rssi->low_threshold; 5522 m->rssi.low_threshold_timeout = 5523 __le16_to_cpu(rssi->low_threshold_timeout); 5524 m->rssi.high_threshold = rssi->high_threshold; 5525 m->rssi.high_threshold_timeout = 5526 __le16_to_cpu(rssi->high_threshold_timeout); 5527 m->rssi.sampling_period = rssi->sampling_period; 5528 } else { 5529 /* Default values. These numbers are the least constricting 5530 * parameters for MSFT API to work, so it behaves as if there 5531 * are no rssi parameter to consider. May need to be changed 5532 * if other API are to be supported. 5533 */ 5534 m->rssi.low_threshold = -127; 5535 m->rssi.low_threshold_timeout = 60; 5536 m->rssi.high_threshold = -127; 5537 m->rssi.high_threshold_timeout = 0; 5538 m->rssi.sampling_period = 0; 5539 } 5540 } 5541 5542 static u8 parse_adv_monitor_pattern(struct adv_monitor *m, u8 pattern_count, 5543 struct mgmt_adv_pattern *patterns) 5544 { 5545 u8 offset = 0, length = 0; 5546 struct adv_pattern *p = NULL; 5547 int i; 5548 5549 for (i = 0; i < pattern_count; i++) { 5550 offset = patterns[i].offset; 5551 length = patterns[i].length; 5552 if (offset >= HCI_MAX_AD_LENGTH || 5553 length > HCI_MAX_AD_LENGTH || 5554 (offset + length) > HCI_MAX_AD_LENGTH) 5555 return MGMT_STATUS_INVALID_PARAMS; 5556 5557 p = kmalloc_obj(*p); 5558 if (!p) 5559 return MGMT_STATUS_NO_RESOURCES; 5560 5561 p->ad_type = patterns[i].ad_type; 5562 p->offset = patterns[i].offset; 5563 p->length = patterns[i].length; 5564 memcpy(p->value, patterns[i].value, p->length); 5565 5566 INIT_LIST_HEAD(&p->list); 5567 list_add(&p->list, &m->patterns); 5568 } 5569 5570 return MGMT_STATUS_SUCCESS; 5571 } 5572 5573 static int add_adv_patterns_monitor(struct sock *sk, struct hci_dev *hdev, 5574 void *data, u16 len) 5575 { 5576 struct mgmt_cp_add_adv_patterns_monitor *cp = data; 5577 struct adv_monitor *m = NULL; 5578 u8 status = MGMT_STATUS_SUCCESS; 5579 size_t expected_size = sizeof(*cp); 5580 5581 BT_DBG("request for %s", hdev->name); 5582 5583 if (len <= sizeof(*cp)) { 5584 status = MGMT_STATUS_INVALID_PARAMS; 5585 goto done; 5586 } 5587 5588 expected_size += cp->pattern_count * sizeof(struct mgmt_adv_pattern); 5589 if (len != expected_size) { 5590 status = MGMT_STATUS_INVALID_PARAMS; 5591 goto done; 5592 } 5593 5594 m = kzalloc_obj(*m); 5595 if (!m) { 5596 status = MGMT_STATUS_NO_RESOURCES; 5597 goto done; 5598 } 5599 5600 INIT_LIST_HEAD(&m->patterns); 5601 5602 parse_adv_monitor_rssi(m, NULL); 5603 status = parse_adv_monitor_pattern(m, cp->pattern_count, cp->patterns); 5604 5605 done: 5606 return __add_adv_patterns_monitor(sk, hdev, m, status, data, len, 5607 MGMT_OP_ADD_ADV_PATTERNS_MONITOR); 5608 } 5609 5610 static int add_adv_patterns_monitor_rssi(struct sock *sk, struct hci_dev *hdev, 5611 void *data, u16 len) 5612 { 5613 struct mgmt_cp_add_adv_patterns_monitor_rssi *cp = data; 5614 struct adv_monitor *m = NULL; 5615 u8 status = MGMT_STATUS_SUCCESS; 5616 size_t expected_size = sizeof(*cp); 5617 5618 BT_DBG("request for %s", hdev->name); 5619 5620 if (len <= sizeof(*cp)) { 5621 status = MGMT_STATUS_INVALID_PARAMS; 5622 goto done; 5623 } 5624 5625 expected_size += cp->pattern_count * sizeof(struct mgmt_adv_pattern); 5626 if (len != expected_size) { 5627 status = MGMT_STATUS_INVALID_PARAMS; 5628 goto done; 5629 } 5630 5631 m = kzalloc_obj(*m); 5632 if (!m) { 5633 status = MGMT_STATUS_NO_RESOURCES; 5634 goto done; 5635 } 5636 5637 INIT_LIST_HEAD(&m->patterns); 5638 5639 parse_adv_monitor_rssi(m, &cp->rssi); 5640 status = parse_adv_monitor_pattern(m, cp->pattern_count, cp->patterns); 5641 5642 done: 5643 return __add_adv_patterns_monitor(sk, hdev, m, status, data, len, 5644 MGMT_OP_ADD_ADV_PATTERNS_MONITOR_RSSI); 5645 } 5646 5647 static void mgmt_remove_adv_monitor_complete(struct hci_dev *hdev, 5648 void *data, int status) 5649 { 5650 struct mgmt_rp_remove_adv_monitor rp; 5651 struct mgmt_pending_cmd *cmd = data; 5652 struct mgmt_cp_remove_adv_monitor *cp; 5653 5654 if (status == -ECANCELED) 5655 return; 5656 5657 hci_dev_lock(hdev); 5658 5659 cp = cmd->param; 5660 5661 rp.monitor_handle = cp->monitor_handle; 5662 5663 if (!status) { 5664 mgmt_adv_monitor_removed(cmd->sk, hdev, cp->monitor_handle); 5665 hci_update_passive_scan(hdev); 5666 } 5667 5668 mgmt_cmd_complete(cmd->sk, cmd->hdev->id, cmd->opcode, 5669 mgmt_status(status), &rp, sizeof(rp)); 5670 mgmt_pending_free(cmd); 5671 5672 hci_dev_unlock(hdev); 5673 bt_dev_dbg(hdev, "remove monitor %d complete, status %d", 5674 rp.monitor_handle, status); 5675 } 5676 5677 static int mgmt_remove_adv_monitor_sync(struct hci_dev *hdev, void *data) 5678 { 5679 struct mgmt_pending_cmd *cmd = data; 5680 struct mgmt_cp_remove_adv_monitor *cp = cmd->param; 5681 u16 handle = __le16_to_cpu(cp->monitor_handle); 5682 5683 if (!handle) 5684 return hci_remove_all_adv_monitor(hdev); 5685 5686 return hci_remove_single_adv_monitor(hdev, handle); 5687 } 5688 5689 static int remove_adv_monitor(struct sock *sk, struct hci_dev *hdev, 5690 void *data, u16 len) 5691 { 5692 struct mgmt_pending_cmd *cmd; 5693 int err, status; 5694 5695 hci_dev_lock(hdev); 5696 5697 if (pending_find(MGMT_OP_SET_LE, hdev) || 5698 pending_find(MGMT_OP_ADD_ADV_PATTERNS_MONITOR, hdev) || 5699 pending_find(MGMT_OP_ADD_ADV_PATTERNS_MONITOR_RSSI, hdev)) { 5700 status = MGMT_STATUS_BUSY; 5701 goto unlock; 5702 } 5703 5704 cmd = mgmt_pending_new(sk, MGMT_OP_REMOVE_ADV_MONITOR, hdev, data, len); 5705 if (!cmd) { 5706 status = MGMT_STATUS_NO_RESOURCES; 5707 goto unlock; 5708 } 5709 5710 err = hci_cmd_sync_submit(hdev, mgmt_remove_adv_monitor_sync, cmd, 5711 mgmt_remove_adv_monitor_complete); 5712 5713 if (err) { 5714 mgmt_pending_free(cmd); 5715 5716 if (err == -ENOMEM) 5717 status = MGMT_STATUS_NO_RESOURCES; 5718 else 5719 status = MGMT_STATUS_FAILED; 5720 5721 goto unlock; 5722 } 5723 5724 hci_dev_unlock(hdev); 5725 5726 return 0; 5727 5728 unlock: 5729 hci_dev_unlock(hdev); 5730 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_ADV_MONITOR, 5731 status); 5732 } 5733 5734 static void read_local_oob_data_complete(struct hci_dev *hdev, void *data, 5735 int err) 5736 { 5737 struct mgmt_rp_read_local_oob_data mgmt_rp; 5738 size_t rp_size = sizeof(mgmt_rp); 5739 struct mgmt_pending_cmd *cmd = data; 5740 struct sk_buff *skb = cmd->skb; 5741 u8 status = mgmt_status(err); 5742 5743 if (!status) { 5744 if (!skb) 5745 status = MGMT_STATUS_FAILED; 5746 else if (IS_ERR(skb)) 5747 status = mgmt_status(PTR_ERR(skb)); 5748 else 5749 status = mgmt_status(skb->data[0]); 5750 } 5751 5752 bt_dev_dbg(hdev, "status %d", status); 5753 5754 if (status) { 5755 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA, 5756 status); 5757 goto remove; 5758 } 5759 5760 memset(&mgmt_rp, 0, sizeof(mgmt_rp)); 5761 5762 if (!bredr_sc_enabled(hdev)) { 5763 struct hci_rp_read_local_oob_data *rp = (void *) skb->data; 5764 5765 if (skb->len < sizeof(*rp)) { 5766 mgmt_cmd_status(cmd->sk, hdev->id, 5767 MGMT_OP_READ_LOCAL_OOB_DATA, 5768 MGMT_STATUS_FAILED); 5769 goto remove; 5770 } 5771 5772 memcpy(mgmt_rp.hash192, rp->hash, sizeof(rp->hash)); 5773 memcpy(mgmt_rp.rand192, rp->rand, sizeof(rp->rand)); 5774 5775 rp_size -= sizeof(mgmt_rp.hash256) + sizeof(mgmt_rp.rand256); 5776 } else { 5777 struct hci_rp_read_local_oob_ext_data *rp = (void *) skb->data; 5778 5779 if (skb->len < sizeof(*rp)) { 5780 mgmt_cmd_status(cmd->sk, hdev->id, 5781 MGMT_OP_READ_LOCAL_OOB_DATA, 5782 MGMT_STATUS_FAILED); 5783 goto remove; 5784 } 5785 5786 memcpy(mgmt_rp.hash192, rp->hash192, sizeof(rp->hash192)); 5787 memcpy(mgmt_rp.rand192, rp->rand192, sizeof(rp->rand192)); 5788 5789 memcpy(mgmt_rp.hash256, rp->hash256, sizeof(rp->hash256)); 5790 memcpy(mgmt_rp.rand256, rp->rand256, sizeof(rp->rand256)); 5791 } 5792 5793 mgmt_cmd_complete(cmd->sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA, 5794 MGMT_STATUS_SUCCESS, &mgmt_rp, rp_size); 5795 5796 remove: 5797 if (skb && !IS_ERR(skb)) 5798 kfree_skb(skb); 5799 5800 mgmt_pending_free(cmd); 5801 } 5802 5803 static int read_local_oob_data_sync(struct hci_dev *hdev, void *data) 5804 { 5805 struct mgmt_pending_cmd *cmd = data; 5806 5807 if (bredr_sc_enabled(hdev)) 5808 cmd->skb = hci_read_local_oob_data_sync(hdev, true, cmd->sk); 5809 else 5810 cmd->skb = hci_read_local_oob_data_sync(hdev, false, cmd->sk); 5811 5812 if (IS_ERR(cmd->skb)) 5813 return PTR_ERR(cmd->skb); 5814 else 5815 return 0; 5816 } 5817 5818 static int read_local_oob_data(struct sock *sk, struct hci_dev *hdev, 5819 void *data, u16 data_len) 5820 { 5821 struct mgmt_pending_cmd *cmd; 5822 int err; 5823 5824 bt_dev_dbg(hdev, "sock %p", sk); 5825 5826 hci_dev_lock(hdev); 5827 5828 if (!hdev_is_powered(hdev)) { 5829 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA, 5830 MGMT_STATUS_NOT_POWERED); 5831 goto unlock; 5832 } 5833 5834 if (!lmp_ssp_capable(hdev)) { 5835 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA, 5836 MGMT_STATUS_NOT_SUPPORTED); 5837 goto unlock; 5838 } 5839 5840 cmd = mgmt_pending_new(sk, MGMT_OP_READ_LOCAL_OOB_DATA, hdev, NULL, 0); 5841 if (!cmd) 5842 err = -ENOMEM; 5843 else 5844 err = hci_cmd_sync_queue(hdev, read_local_oob_data_sync, cmd, 5845 read_local_oob_data_complete); 5846 5847 if (err < 0) { 5848 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA, 5849 MGMT_STATUS_FAILED); 5850 5851 if (cmd) 5852 mgmt_pending_free(cmd); 5853 } 5854 5855 unlock: 5856 hci_dev_unlock(hdev); 5857 return err; 5858 } 5859 5860 static int add_remote_oob_data(struct sock *sk, struct hci_dev *hdev, 5861 void *data, u16 len) 5862 { 5863 struct mgmt_addr_info *addr = data; 5864 int err; 5865 5866 bt_dev_dbg(hdev, "sock %p", sk); 5867 5868 if (!bdaddr_type_is_valid(addr->type)) 5869 return mgmt_cmd_complete(sk, hdev->id, 5870 MGMT_OP_ADD_REMOTE_OOB_DATA, 5871 MGMT_STATUS_INVALID_PARAMS, 5872 addr, sizeof(*addr)); 5873 5874 hci_dev_lock(hdev); 5875 5876 if (len == MGMT_ADD_REMOTE_OOB_DATA_SIZE) { 5877 struct mgmt_cp_add_remote_oob_data *cp = data; 5878 u8 status; 5879 5880 if (cp->addr.type != BDADDR_BREDR) { 5881 err = mgmt_cmd_complete(sk, hdev->id, 5882 MGMT_OP_ADD_REMOTE_OOB_DATA, 5883 MGMT_STATUS_INVALID_PARAMS, 5884 &cp->addr, sizeof(cp->addr)); 5885 goto unlock; 5886 } 5887 5888 err = hci_add_remote_oob_data(hdev, &cp->addr.bdaddr, 5889 cp->addr.type, cp->hash, 5890 cp->rand, NULL, NULL); 5891 if (err < 0) 5892 status = MGMT_STATUS_FAILED; 5893 else 5894 status = MGMT_STATUS_SUCCESS; 5895 5896 err = mgmt_cmd_complete(sk, hdev->id, 5897 MGMT_OP_ADD_REMOTE_OOB_DATA, status, 5898 &cp->addr, sizeof(cp->addr)); 5899 } else if (len == MGMT_ADD_REMOTE_OOB_EXT_DATA_SIZE) { 5900 struct mgmt_cp_add_remote_oob_ext_data *cp = data; 5901 u8 *rand192, *hash192, *rand256, *hash256; 5902 u8 status; 5903 5904 if (bdaddr_type_is_le(cp->addr.type)) { 5905 /* Enforce zero-valued 192-bit parameters as 5906 * long as legacy SMP OOB isn't implemented. 5907 */ 5908 if (memcmp(cp->rand192, ZERO_KEY, 16) || 5909 memcmp(cp->hash192, ZERO_KEY, 16)) { 5910 err = mgmt_cmd_complete(sk, hdev->id, 5911 MGMT_OP_ADD_REMOTE_OOB_DATA, 5912 MGMT_STATUS_INVALID_PARAMS, 5913 addr, sizeof(*addr)); 5914 goto unlock; 5915 } 5916 5917 rand192 = NULL; 5918 hash192 = NULL; 5919 } else { 5920 /* In case one of the P-192 values is set to zero, 5921 * then just disable OOB data for P-192. 5922 */ 5923 if (!memcmp(cp->rand192, ZERO_KEY, 16) || 5924 !memcmp(cp->hash192, ZERO_KEY, 16)) { 5925 rand192 = NULL; 5926 hash192 = NULL; 5927 } else { 5928 rand192 = cp->rand192; 5929 hash192 = cp->hash192; 5930 } 5931 } 5932 5933 /* In case one of the P-256 values is set to zero, then just 5934 * disable OOB data for P-256. 5935 */ 5936 if (!memcmp(cp->rand256, ZERO_KEY, 16) || 5937 !memcmp(cp->hash256, ZERO_KEY, 16)) { 5938 rand256 = NULL; 5939 hash256 = NULL; 5940 } else { 5941 rand256 = cp->rand256; 5942 hash256 = cp->hash256; 5943 } 5944 5945 err = hci_add_remote_oob_data(hdev, &cp->addr.bdaddr, 5946 cp->addr.type, hash192, rand192, 5947 hash256, rand256); 5948 if (err < 0) 5949 status = MGMT_STATUS_FAILED; 5950 else 5951 status = MGMT_STATUS_SUCCESS; 5952 5953 err = mgmt_cmd_complete(sk, hdev->id, 5954 MGMT_OP_ADD_REMOTE_OOB_DATA, 5955 status, &cp->addr, sizeof(cp->addr)); 5956 } else { 5957 bt_dev_err(hdev, "add_remote_oob_data: invalid len of %u bytes", 5958 len); 5959 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_REMOTE_OOB_DATA, 5960 MGMT_STATUS_INVALID_PARAMS); 5961 } 5962 5963 unlock: 5964 hci_dev_unlock(hdev); 5965 return err; 5966 } 5967 5968 static int remove_remote_oob_data(struct sock *sk, struct hci_dev *hdev, 5969 void *data, u16 len) 5970 { 5971 struct mgmt_cp_remove_remote_oob_data *cp = data; 5972 u8 status; 5973 int err; 5974 5975 bt_dev_dbg(hdev, "sock %p", sk); 5976 5977 if (cp->addr.type != BDADDR_BREDR) 5978 return mgmt_cmd_complete(sk, hdev->id, 5979 MGMT_OP_REMOVE_REMOTE_OOB_DATA, 5980 MGMT_STATUS_INVALID_PARAMS, 5981 &cp->addr, sizeof(cp->addr)); 5982 5983 hci_dev_lock(hdev); 5984 5985 if (!bacmp(&cp->addr.bdaddr, BDADDR_ANY)) { 5986 hci_remote_oob_data_clear(hdev); 5987 status = MGMT_STATUS_SUCCESS; 5988 goto done; 5989 } 5990 5991 err = hci_remove_remote_oob_data(hdev, &cp->addr.bdaddr, cp->addr.type); 5992 if (err < 0) 5993 status = MGMT_STATUS_INVALID_PARAMS; 5994 else 5995 status = MGMT_STATUS_SUCCESS; 5996 5997 done: 5998 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_REMOTE_OOB_DATA, 5999 status, &cp->addr, sizeof(cp->addr)); 6000 6001 hci_dev_unlock(hdev); 6002 return err; 6003 } 6004 6005 static bool discovery_type_is_valid(struct hci_dev *hdev, uint8_t type, 6006 uint8_t *mgmt_status) 6007 { 6008 switch (type) { 6009 case DISCOV_TYPE_LE: 6010 *mgmt_status = mgmt_le_support(hdev); 6011 if (*mgmt_status) 6012 return false; 6013 break; 6014 case DISCOV_TYPE_INTERLEAVED: 6015 *mgmt_status = mgmt_le_support(hdev); 6016 if (*mgmt_status) 6017 return false; 6018 fallthrough; 6019 case DISCOV_TYPE_BREDR: 6020 *mgmt_status = mgmt_bredr_support(hdev); 6021 if (*mgmt_status) 6022 return false; 6023 break; 6024 default: 6025 *mgmt_status = MGMT_STATUS_INVALID_PARAMS; 6026 return false; 6027 } 6028 6029 return true; 6030 } 6031 6032 static void start_discovery_complete(struct hci_dev *hdev, void *data, int err) 6033 { 6034 struct mgmt_pending_cmd *cmd = data; 6035 6036 bt_dev_dbg(hdev, "err %d", err); 6037 6038 if (err == -ECANCELED || !mgmt_pending_valid(hdev, cmd)) 6039 return; 6040 6041 mgmt_cmd_complete(cmd->sk, cmd->hdev->id, cmd->opcode, mgmt_status(err), 6042 cmd->param, 1); 6043 mgmt_pending_free(cmd); 6044 6045 hci_discovery_set_state(hdev, err ? DISCOVERY_STOPPED: 6046 DISCOVERY_FINDING); 6047 } 6048 6049 static int start_discovery_sync(struct hci_dev *hdev, void *data) 6050 { 6051 if (!mgmt_pending_listed(hdev, data)) 6052 return -ECANCELED; 6053 6054 return hci_start_discovery_sync(hdev); 6055 } 6056 6057 static int start_discovery_internal(struct sock *sk, struct hci_dev *hdev, 6058 u16 op, void *data, u16 len) 6059 { 6060 struct mgmt_cp_start_discovery *cp = data; 6061 struct mgmt_pending_cmd *cmd; 6062 u8 status; 6063 int err; 6064 6065 bt_dev_dbg(hdev, "sock %p", sk); 6066 6067 hci_dev_lock(hdev); 6068 6069 if (!hdev_is_powered(hdev)) { 6070 err = mgmt_cmd_complete(sk, hdev->id, op, 6071 MGMT_STATUS_NOT_POWERED, 6072 &cp->type, sizeof(cp->type)); 6073 goto failed; 6074 } 6075 6076 if (hdev->discovery.state != DISCOVERY_STOPPED || 6077 hci_dev_test_flag(hdev, HCI_PERIODIC_INQ)) { 6078 err = mgmt_cmd_complete(sk, hdev->id, op, MGMT_STATUS_BUSY, 6079 &cp->type, sizeof(cp->type)); 6080 goto failed; 6081 } 6082 6083 if (!discovery_type_is_valid(hdev, cp->type, &status)) { 6084 err = mgmt_cmd_complete(sk, hdev->id, op, status, 6085 &cp->type, sizeof(cp->type)); 6086 goto failed; 6087 } 6088 6089 /* Can't start discovery when it is paused */ 6090 if (hdev->discovery_paused) { 6091 err = mgmt_cmd_complete(sk, hdev->id, op, MGMT_STATUS_BUSY, 6092 &cp->type, sizeof(cp->type)); 6093 goto failed; 6094 } 6095 6096 /* Clear the discovery filter first to free any previously 6097 * allocated memory for the UUID list. 6098 */ 6099 hci_discovery_filter_clear(hdev); 6100 6101 hdev->discovery.type = cp->type; 6102 hdev->discovery.report_invalid_rssi = false; 6103 if (op == MGMT_OP_START_LIMITED_DISCOVERY) 6104 hdev->discovery.limited = true; 6105 else 6106 hdev->discovery.limited = false; 6107 6108 cmd = mgmt_pending_add(sk, op, hdev, data, len); 6109 if (!cmd) { 6110 err = -ENOMEM; 6111 goto failed; 6112 } 6113 6114 err = hci_cmd_sync_queue(hdev, start_discovery_sync, cmd, 6115 start_discovery_complete); 6116 if (err < 0) { 6117 mgmt_pending_remove(cmd); 6118 goto failed; 6119 } 6120 6121 hci_discovery_set_state(hdev, DISCOVERY_STARTING); 6122 6123 failed: 6124 hci_dev_unlock(hdev); 6125 return err; 6126 } 6127 6128 static int start_discovery(struct sock *sk, struct hci_dev *hdev, 6129 void *data, u16 len) 6130 { 6131 return start_discovery_internal(sk, hdev, MGMT_OP_START_DISCOVERY, 6132 data, len); 6133 } 6134 6135 static int start_limited_discovery(struct sock *sk, struct hci_dev *hdev, 6136 void *data, u16 len) 6137 { 6138 return start_discovery_internal(sk, hdev, 6139 MGMT_OP_START_LIMITED_DISCOVERY, 6140 data, len); 6141 } 6142 6143 static int start_service_discovery(struct sock *sk, struct hci_dev *hdev, 6144 void *data, u16 len) 6145 { 6146 struct mgmt_cp_start_service_discovery *cp = data; 6147 struct mgmt_pending_cmd *cmd; 6148 const u16 max_uuid_count = ((U16_MAX - sizeof(*cp)) / 16); 6149 u16 uuid_count, expected_len; 6150 u8 status; 6151 int err; 6152 6153 bt_dev_dbg(hdev, "sock %p", sk); 6154 6155 hci_dev_lock(hdev); 6156 6157 if (!hdev_is_powered(hdev)) { 6158 err = mgmt_cmd_complete(sk, hdev->id, 6159 MGMT_OP_START_SERVICE_DISCOVERY, 6160 MGMT_STATUS_NOT_POWERED, 6161 &cp->type, sizeof(cp->type)); 6162 goto failed; 6163 } 6164 6165 if (hdev->discovery.state != DISCOVERY_STOPPED || 6166 hci_dev_test_flag(hdev, HCI_PERIODIC_INQ)) { 6167 err = mgmt_cmd_complete(sk, hdev->id, 6168 MGMT_OP_START_SERVICE_DISCOVERY, 6169 MGMT_STATUS_BUSY, &cp->type, 6170 sizeof(cp->type)); 6171 goto failed; 6172 } 6173 6174 if (hdev->discovery_paused) { 6175 err = mgmt_cmd_complete(sk, hdev->id, 6176 MGMT_OP_START_SERVICE_DISCOVERY, 6177 MGMT_STATUS_BUSY, &cp->type, 6178 sizeof(cp->type)); 6179 goto failed; 6180 } 6181 6182 uuid_count = __le16_to_cpu(cp->uuid_count); 6183 if (uuid_count > max_uuid_count) { 6184 bt_dev_err(hdev, "service_discovery: too big uuid_count value %u", 6185 uuid_count); 6186 err = mgmt_cmd_complete(sk, hdev->id, 6187 MGMT_OP_START_SERVICE_DISCOVERY, 6188 MGMT_STATUS_INVALID_PARAMS, &cp->type, 6189 sizeof(cp->type)); 6190 goto failed; 6191 } 6192 6193 expected_len = sizeof(*cp) + uuid_count * 16; 6194 if (expected_len != len) { 6195 bt_dev_err(hdev, "service_discovery: expected %u bytes, got %u bytes", 6196 expected_len, len); 6197 err = mgmt_cmd_complete(sk, hdev->id, 6198 MGMT_OP_START_SERVICE_DISCOVERY, 6199 MGMT_STATUS_INVALID_PARAMS, &cp->type, 6200 sizeof(cp->type)); 6201 goto failed; 6202 } 6203 6204 if (!discovery_type_is_valid(hdev, cp->type, &status)) { 6205 err = mgmt_cmd_complete(sk, hdev->id, 6206 MGMT_OP_START_SERVICE_DISCOVERY, 6207 status, &cp->type, sizeof(cp->type)); 6208 goto failed; 6209 } 6210 6211 cmd = mgmt_pending_add(sk, MGMT_OP_START_SERVICE_DISCOVERY, 6212 hdev, data, len); 6213 if (!cmd) { 6214 err = -ENOMEM; 6215 goto failed; 6216 } 6217 6218 /* Clear the discovery filter first to free any previously 6219 * allocated memory for the UUID list. 6220 */ 6221 hci_discovery_filter_clear(hdev); 6222 6223 hdev->discovery.result_filtering = true; 6224 hdev->discovery.type = cp->type; 6225 hdev->discovery.rssi = cp->rssi; 6226 hdev->discovery.uuid_count = uuid_count; 6227 6228 if (uuid_count > 0) { 6229 hdev->discovery.uuids = kmemdup(cp->uuids, uuid_count * 16, 6230 GFP_KERNEL); 6231 if (!hdev->discovery.uuids) { 6232 err = mgmt_cmd_complete(sk, hdev->id, 6233 MGMT_OP_START_SERVICE_DISCOVERY, 6234 MGMT_STATUS_FAILED, 6235 &cp->type, sizeof(cp->type)); 6236 mgmt_pending_remove(cmd); 6237 goto failed; 6238 } 6239 } 6240 6241 err = hci_cmd_sync_queue(hdev, start_discovery_sync, cmd, 6242 start_discovery_complete); 6243 if (err < 0) { 6244 mgmt_pending_remove(cmd); 6245 goto failed; 6246 } 6247 6248 hci_discovery_set_state(hdev, DISCOVERY_STARTING); 6249 6250 failed: 6251 hci_dev_unlock(hdev); 6252 return err; 6253 } 6254 6255 static void stop_discovery_complete(struct hci_dev *hdev, void *data, int err) 6256 { 6257 struct mgmt_pending_cmd *cmd = data; 6258 6259 if (err == -ECANCELED || !mgmt_pending_valid(hdev, cmd)) 6260 return; 6261 6262 bt_dev_dbg(hdev, "err %d", err); 6263 6264 mgmt_cmd_complete(cmd->sk, cmd->hdev->id, cmd->opcode, mgmt_status(err), 6265 cmd->param, 1); 6266 mgmt_pending_free(cmd); 6267 6268 if (!err) 6269 hci_discovery_set_state(hdev, DISCOVERY_STOPPED); 6270 } 6271 6272 static int stop_discovery_sync(struct hci_dev *hdev, void *data) 6273 { 6274 if (!mgmt_pending_listed(hdev, data)) 6275 return -ECANCELED; 6276 6277 return hci_stop_discovery_sync(hdev); 6278 } 6279 6280 static int stop_discovery(struct sock *sk, struct hci_dev *hdev, void *data, 6281 u16 len) 6282 { 6283 struct mgmt_cp_stop_discovery *mgmt_cp = data; 6284 struct mgmt_pending_cmd *cmd; 6285 int err; 6286 6287 bt_dev_dbg(hdev, "sock %p", sk); 6288 6289 hci_dev_lock(hdev); 6290 6291 if (!hci_discovery_active(hdev)) { 6292 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY, 6293 MGMT_STATUS_REJECTED, &mgmt_cp->type, 6294 sizeof(mgmt_cp->type)); 6295 goto unlock; 6296 } 6297 6298 if (hdev->discovery.type != mgmt_cp->type) { 6299 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY, 6300 MGMT_STATUS_INVALID_PARAMS, 6301 &mgmt_cp->type, sizeof(mgmt_cp->type)); 6302 goto unlock; 6303 } 6304 6305 cmd = mgmt_pending_add(sk, MGMT_OP_STOP_DISCOVERY, hdev, data, len); 6306 if (!cmd) { 6307 err = -ENOMEM; 6308 goto unlock; 6309 } 6310 6311 err = hci_cmd_sync_queue(hdev, stop_discovery_sync, cmd, 6312 stop_discovery_complete); 6313 if (err < 0) { 6314 mgmt_pending_remove(cmd); 6315 goto unlock; 6316 } 6317 6318 hci_discovery_set_state(hdev, DISCOVERY_STOPPING); 6319 6320 unlock: 6321 hci_dev_unlock(hdev); 6322 return err; 6323 } 6324 6325 static int confirm_name(struct sock *sk, struct hci_dev *hdev, void *data, 6326 u16 len) 6327 { 6328 struct mgmt_cp_confirm_name *cp = data; 6329 struct inquiry_entry *e; 6330 int err; 6331 6332 bt_dev_dbg(hdev, "sock %p", sk); 6333 6334 hci_dev_lock(hdev); 6335 6336 if (!hci_discovery_active(hdev)) { 6337 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME, 6338 MGMT_STATUS_FAILED, &cp->addr, 6339 sizeof(cp->addr)); 6340 goto failed; 6341 } 6342 6343 e = hci_inquiry_cache_lookup_unknown(hdev, &cp->addr.bdaddr); 6344 if (!e) { 6345 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME, 6346 MGMT_STATUS_INVALID_PARAMS, &cp->addr, 6347 sizeof(cp->addr)); 6348 goto failed; 6349 } 6350 6351 if (cp->name_known) { 6352 e->name_state = NAME_KNOWN; 6353 list_del(&e->list); 6354 } else { 6355 e->name_state = NAME_NEEDED; 6356 hci_inquiry_cache_update_resolve(hdev, e); 6357 } 6358 6359 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME, 0, 6360 &cp->addr, sizeof(cp->addr)); 6361 6362 failed: 6363 hci_dev_unlock(hdev); 6364 return err; 6365 } 6366 6367 static int block_device(struct sock *sk, struct hci_dev *hdev, void *data, 6368 u16 len) 6369 { 6370 struct mgmt_cp_block_device *cp = data; 6371 u8 status; 6372 int err; 6373 6374 bt_dev_dbg(hdev, "sock %p", sk); 6375 6376 if (!bdaddr_type_is_valid(cp->addr.type)) 6377 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_BLOCK_DEVICE, 6378 MGMT_STATUS_INVALID_PARAMS, 6379 &cp->addr, sizeof(cp->addr)); 6380 6381 hci_dev_lock(hdev); 6382 6383 err = hci_bdaddr_list_add(&hdev->reject_list, &cp->addr.bdaddr, 6384 cp->addr.type); 6385 if (err < 0) { 6386 status = MGMT_STATUS_FAILED; 6387 goto done; 6388 } 6389 6390 mgmt_event(MGMT_EV_DEVICE_BLOCKED, hdev, &cp->addr, sizeof(cp->addr), 6391 sk); 6392 status = MGMT_STATUS_SUCCESS; 6393 6394 done: 6395 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_BLOCK_DEVICE, status, 6396 &cp->addr, sizeof(cp->addr)); 6397 6398 hci_dev_unlock(hdev); 6399 6400 return err; 6401 } 6402 6403 static int unblock_device(struct sock *sk, struct hci_dev *hdev, void *data, 6404 u16 len) 6405 { 6406 struct mgmt_cp_unblock_device *cp = data; 6407 u8 status; 6408 int err; 6409 6410 bt_dev_dbg(hdev, "sock %p", sk); 6411 6412 if (!bdaddr_type_is_valid(cp->addr.type)) 6413 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNBLOCK_DEVICE, 6414 MGMT_STATUS_INVALID_PARAMS, 6415 &cp->addr, sizeof(cp->addr)); 6416 6417 hci_dev_lock(hdev); 6418 6419 err = hci_bdaddr_list_del(&hdev->reject_list, &cp->addr.bdaddr, 6420 cp->addr.type); 6421 if (err < 0) { 6422 status = MGMT_STATUS_INVALID_PARAMS; 6423 goto done; 6424 } 6425 6426 mgmt_event(MGMT_EV_DEVICE_UNBLOCKED, hdev, &cp->addr, sizeof(cp->addr), 6427 sk); 6428 status = MGMT_STATUS_SUCCESS; 6429 6430 done: 6431 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNBLOCK_DEVICE, status, 6432 &cp->addr, sizeof(cp->addr)); 6433 6434 hci_dev_unlock(hdev); 6435 6436 return err; 6437 } 6438 6439 static int set_device_id_sync(struct hci_dev *hdev, void *data) 6440 { 6441 return hci_update_eir_sync(hdev); 6442 } 6443 6444 static int set_device_id(struct sock *sk, struct hci_dev *hdev, void *data, 6445 u16 len) 6446 { 6447 struct mgmt_cp_set_device_id *cp = data; 6448 int err; 6449 __u16 source; 6450 6451 bt_dev_dbg(hdev, "sock %p", sk); 6452 6453 source = __le16_to_cpu(cp->source); 6454 6455 if (source > 0x0002) 6456 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEVICE_ID, 6457 MGMT_STATUS_INVALID_PARAMS); 6458 6459 hci_dev_lock(hdev); 6460 6461 hdev->devid_source = source; 6462 hdev->devid_vendor = __le16_to_cpu(cp->vendor); 6463 hdev->devid_product = __le16_to_cpu(cp->product); 6464 hdev->devid_version = __le16_to_cpu(cp->version); 6465 6466 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_DEVICE_ID, 0, 6467 NULL, 0); 6468 6469 hci_cmd_sync_queue(hdev, set_device_id_sync, NULL, NULL); 6470 6471 hci_dev_unlock(hdev); 6472 6473 return err; 6474 } 6475 6476 static void enable_advertising_instance(struct hci_dev *hdev, int err) 6477 { 6478 if (err) 6479 bt_dev_err(hdev, "failed to re-configure advertising %d", err); 6480 else 6481 bt_dev_dbg(hdev, "status %d", err); 6482 } 6483 6484 static void set_advertising_complete(struct hci_dev *hdev, void *data, int err) 6485 { 6486 struct mgmt_pending_cmd *cmd = data; 6487 struct cmd_lookup match = { NULL, hdev }; 6488 u8 instance; 6489 struct adv_info *adv_instance; 6490 u8 status = mgmt_status(err); 6491 6492 if (err == -ECANCELED || !mgmt_pending_valid(hdev, data)) 6493 return; 6494 6495 if (status) { 6496 mgmt_cmd_status(cmd->sk, cmd->hdev->id, cmd->opcode, status); 6497 mgmt_pending_free(cmd); 6498 return; 6499 } 6500 6501 if (hci_dev_test_flag(hdev, HCI_LE_ADV)) 6502 hci_dev_set_flag(hdev, HCI_ADVERTISING); 6503 else 6504 hci_dev_clear_flag(hdev, HCI_ADVERTISING); 6505 6506 settings_rsp(cmd, &match); 6507 mgmt_pending_free(cmd); 6508 6509 new_settings(hdev, match.sk); 6510 6511 if (match.sk) 6512 sock_put(match.sk); 6513 6514 /* If "Set Advertising" was just disabled and instance advertising was 6515 * set up earlier, then re-enable multi-instance advertising. 6516 */ 6517 if (hci_dev_test_flag(hdev, HCI_ADVERTISING) || 6518 list_empty(&hdev->adv_instances)) 6519 return; 6520 6521 instance = hdev->cur_adv_instance; 6522 if (!instance) { 6523 adv_instance = list_first_entry_or_null(&hdev->adv_instances, 6524 struct adv_info, list); 6525 if (!adv_instance) 6526 return; 6527 6528 instance = adv_instance->instance; 6529 } 6530 6531 err = hci_schedule_adv_instance_sync(hdev, instance, true); 6532 6533 enable_advertising_instance(hdev, err); 6534 } 6535 6536 static int set_adv_sync(struct hci_dev *hdev, void *data) 6537 { 6538 struct mgmt_pending_cmd *cmd = data; 6539 struct mgmt_mode cp; 6540 u8 val; 6541 6542 mutex_lock(&hdev->mgmt_pending_lock); 6543 6544 if (!__mgmt_pending_listed(hdev, cmd)) { 6545 mutex_unlock(&hdev->mgmt_pending_lock); 6546 return -ECANCELED; 6547 } 6548 6549 memcpy(&cp, cmd->param, sizeof(cp)); 6550 6551 mutex_unlock(&hdev->mgmt_pending_lock); 6552 6553 val = !!cp.val; 6554 6555 if (cp.val == 0x02) 6556 hci_dev_set_flag(hdev, HCI_ADVERTISING_CONNECTABLE); 6557 else 6558 hci_dev_clear_flag(hdev, HCI_ADVERTISING_CONNECTABLE); 6559 6560 cancel_adv_timeout(hdev); 6561 6562 if (val) { 6563 /* Switch to instance "0" for the Set Advertising setting. 6564 * We cannot use update_[adv|scan_rsp]_data() here as the 6565 * HCI_ADVERTISING flag is not yet set. 6566 */ 6567 hdev->cur_adv_instance = 0x00; 6568 6569 if (ext_adv_capable(hdev)) { 6570 hci_start_ext_adv_sync(hdev, 0x00); 6571 } else { 6572 hci_update_adv_data_sync(hdev, 0x00); 6573 hci_update_scan_rsp_data_sync(hdev, 0x00); 6574 hci_enable_advertising_sync(hdev); 6575 } 6576 } else { 6577 hci_disable_advertising_sync(hdev); 6578 } 6579 6580 return 0; 6581 } 6582 6583 static int set_advertising(struct sock *sk, struct hci_dev *hdev, void *data, 6584 u16 len) 6585 { 6586 struct mgmt_mode *cp = data; 6587 struct mgmt_pending_cmd *cmd; 6588 u8 val, status; 6589 int err; 6590 6591 bt_dev_dbg(hdev, "sock %p", sk); 6592 6593 status = mgmt_le_support(hdev); 6594 if (status) 6595 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING, 6596 status); 6597 6598 if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02) 6599 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING, 6600 MGMT_STATUS_INVALID_PARAMS); 6601 6602 if (hdev->advertising_paused) 6603 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING, 6604 MGMT_STATUS_BUSY); 6605 6606 hci_dev_lock(hdev); 6607 6608 val = !!cp->val; 6609 6610 /* The following conditions are ones which mean that we should 6611 * not do any HCI communication but directly send a mgmt 6612 * response to user space (after toggling the flag if 6613 * necessary). 6614 */ 6615 if (!hdev_is_powered(hdev) || 6616 (val == hci_dev_test_flag(hdev, HCI_ADVERTISING) && 6617 (cp->val == 0x02) == hci_dev_test_flag(hdev, HCI_ADVERTISING_CONNECTABLE)) || 6618 hci_dev_test_flag(hdev, HCI_MESH) || 6619 hci_conn_num(hdev, LE_LINK) > 0 || 6620 (hci_dev_test_flag(hdev, HCI_LE_SCAN) && 6621 hdev->le_scan_type == LE_SCAN_ACTIVE)) { 6622 bool changed; 6623 6624 if (cp->val) { 6625 hdev->cur_adv_instance = 0x00; 6626 changed = !hci_dev_test_and_set_flag(hdev, HCI_ADVERTISING); 6627 if (cp->val == 0x02) 6628 hci_dev_set_flag(hdev, HCI_ADVERTISING_CONNECTABLE); 6629 else 6630 hci_dev_clear_flag(hdev, HCI_ADVERTISING_CONNECTABLE); 6631 } else { 6632 changed = hci_dev_test_and_clear_flag(hdev, HCI_ADVERTISING); 6633 hci_dev_clear_flag(hdev, HCI_ADVERTISING_CONNECTABLE); 6634 } 6635 6636 err = send_settings_rsp(sk, MGMT_OP_SET_ADVERTISING, hdev); 6637 if (err < 0) 6638 goto unlock; 6639 6640 if (changed) 6641 err = new_settings(hdev, sk); 6642 6643 goto unlock; 6644 } 6645 6646 if (pending_find(MGMT_OP_SET_ADVERTISING, hdev) || 6647 pending_find(MGMT_OP_SET_LE, hdev)) { 6648 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING, 6649 MGMT_STATUS_BUSY); 6650 goto unlock; 6651 } 6652 6653 cmd = mgmt_pending_add(sk, MGMT_OP_SET_ADVERTISING, hdev, data, len); 6654 if (!cmd) 6655 err = -ENOMEM; 6656 else 6657 err = hci_cmd_sync_queue(hdev, set_adv_sync, cmd, 6658 set_advertising_complete); 6659 6660 if (err < 0 && cmd) 6661 mgmt_pending_remove(cmd); 6662 6663 unlock: 6664 hci_dev_unlock(hdev); 6665 return err; 6666 } 6667 6668 static int set_static_address(struct sock *sk, struct hci_dev *hdev, 6669 void *data, u16 len) 6670 { 6671 struct mgmt_cp_set_static_address *cp = data; 6672 int err; 6673 6674 bt_dev_dbg(hdev, "sock %p", sk); 6675 6676 if (!lmp_le_capable(hdev)) 6677 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_STATIC_ADDRESS, 6678 MGMT_STATUS_NOT_SUPPORTED); 6679 6680 if (hdev_is_powered(hdev)) 6681 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_STATIC_ADDRESS, 6682 MGMT_STATUS_REJECTED); 6683 6684 if (bacmp(&cp->bdaddr, BDADDR_ANY)) { 6685 if (!bacmp(&cp->bdaddr, BDADDR_NONE)) 6686 return mgmt_cmd_status(sk, hdev->id, 6687 MGMT_OP_SET_STATIC_ADDRESS, 6688 MGMT_STATUS_INVALID_PARAMS); 6689 6690 /* Two most significant bits shall be set */ 6691 if ((cp->bdaddr.b[5] & 0xc0) != 0xc0) 6692 return mgmt_cmd_status(sk, hdev->id, 6693 MGMT_OP_SET_STATIC_ADDRESS, 6694 MGMT_STATUS_INVALID_PARAMS); 6695 } 6696 6697 hci_dev_lock(hdev); 6698 6699 bacpy(&hdev->static_addr, &cp->bdaddr); 6700 6701 err = send_settings_rsp(sk, MGMT_OP_SET_STATIC_ADDRESS, hdev); 6702 if (err < 0) 6703 goto unlock; 6704 6705 err = new_settings(hdev, sk); 6706 6707 unlock: 6708 hci_dev_unlock(hdev); 6709 return err; 6710 } 6711 6712 static int set_scan_params(struct sock *sk, struct hci_dev *hdev, 6713 void *data, u16 len) 6714 { 6715 struct mgmt_cp_set_scan_params *cp = data; 6716 __u16 interval, window; 6717 int err; 6718 6719 bt_dev_dbg(hdev, "sock %p", sk); 6720 6721 if (!lmp_le_capable(hdev)) 6722 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS, 6723 MGMT_STATUS_NOT_SUPPORTED); 6724 6725 /* Keep allowed ranges in sync with set_mesh() */ 6726 interval = __le16_to_cpu(cp->interval); 6727 6728 if (interval < 0x0004 || interval > 0x4000) 6729 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS, 6730 MGMT_STATUS_INVALID_PARAMS); 6731 6732 window = __le16_to_cpu(cp->window); 6733 6734 if (window < 0x0004 || window > 0x4000) 6735 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS, 6736 MGMT_STATUS_INVALID_PARAMS); 6737 6738 if (window > interval) 6739 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS, 6740 MGMT_STATUS_INVALID_PARAMS); 6741 6742 hci_dev_lock(hdev); 6743 6744 hdev->le_scan_interval = interval; 6745 hdev->le_scan_window = window; 6746 6747 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS, 0, 6748 NULL, 0); 6749 6750 /* If background scan is running, restart it so new parameters are 6751 * loaded. 6752 */ 6753 if (hci_dev_test_flag(hdev, HCI_LE_SCAN) && 6754 hdev->discovery.state == DISCOVERY_STOPPED) 6755 hci_update_passive_scan(hdev); 6756 6757 hci_dev_unlock(hdev); 6758 6759 return err; 6760 } 6761 6762 static void fast_connectable_complete(struct hci_dev *hdev, void *data, int err) 6763 { 6764 struct mgmt_pending_cmd *cmd = data; 6765 6766 bt_dev_dbg(hdev, "err %d", err); 6767 6768 if (err) { 6769 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE, 6770 mgmt_status(err)); 6771 } else { 6772 struct mgmt_mode *cp = cmd->param; 6773 6774 if (cp->val) 6775 hci_dev_set_flag(hdev, HCI_FAST_CONNECTABLE); 6776 else 6777 hci_dev_clear_flag(hdev, HCI_FAST_CONNECTABLE); 6778 6779 send_settings_rsp(cmd->sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev); 6780 new_settings(hdev, cmd->sk); 6781 } 6782 6783 mgmt_pending_free(cmd); 6784 } 6785 6786 static int write_fast_connectable_sync(struct hci_dev *hdev, void *data) 6787 { 6788 struct mgmt_pending_cmd *cmd = data; 6789 struct mgmt_mode *cp = cmd->param; 6790 6791 return hci_write_fast_connectable_sync(hdev, cp->val); 6792 } 6793 6794 static int set_fast_connectable(struct sock *sk, struct hci_dev *hdev, 6795 void *data, u16 len) 6796 { 6797 struct mgmt_mode *cp = data; 6798 struct mgmt_pending_cmd *cmd; 6799 int err; 6800 6801 bt_dev_dbg(hdev, "sock %p", sk); 6802 6803 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) || 6804 hdev->hci_ver < BLUETOOTH_VER_1_2) 6805 return mgmt_cmd_status(sk, hdev->id, 6806 MGMT_OP_SET_FAST_CONNECTABLE, 6807 MGMT_STATUS_NOT_SUPPORTED); 6808 6809 if (cp->val != 0x00 && cp->val != 0x01) 6810 return mgmt_cmd_status(sk, hdev->id, 6811 MGMT_OP_SET_FAST_CONNECTABLE, 6812 MGMT_STATUS_INVALID_PARAMS); 6813 6814 hci_dev_lock(hdev); 6815 6816 if (!!cp->val == hci_dev_test_flag(hdev, HCI_FAST_CONNECTABLE)) { 6817 err = send_settings_rsp(sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev); 6818 goto unlock; 6819 } 6820 6821 if (!hdev_is_powered(hdev)) { 6822 hci_dev_change_flag(hdev, HCI_FAST_CONNECTABLE); 6823 err = send_settings_rsp(sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev); 6824 new_settings(hdev, sk); 6825 goto unlock; 6826 } 6827 6828 cmd = mgmt_pending_new(sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev, data, 6829 len); 6830 if (!cmd) 6831 err = -ENOMEM; 6832 else 6833 err = hci_cmd_sync_queue(hdev, write_fast_connectable_sync, cmd, 6834 fast_connectable_complete); 6835 6836 if (err < 0) { 6837 mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE, 6838 MGMT_STATUS_FAILED); 6839 6840 if (cmd) 6841 mgmt_pending_free(cmd); 6842 } 6843 6844 unlock: 6845 hci_dev_unlock(hdev); 6846 6847 return err; 6848 } 6849 6850 static void set_bredr_complete(struct hci_dev *hdev, void *data, int err) 6851 { 6852 struct mgmt_pending_cmd *cmd = data; 6853 6854 bt_dev_dbg(hdev, "err %d", err); 6855 6856 if (err) { 6857 u8 mgmt_err = mgmt_status(err); 6858 6859 /* We need to restore the flag if related HCI commands 6860 * failed. 6861 */ 6862 hci_dev_clear_flag(hdev, HCI_BREDR_ENABLED); 6863 6864 mgmt_cmd_status(cmd->sk, cmd->hdev->id, cmd->opcode, mgmt_err); 6865 } else { 6866 send_settings_rsp(cmd->sk, MGMT_OP_SET_BREDR, hdev); 6867 new_settings(hdev, cmd->sk); 6868 } 6869 6870 mgmt_pending_free(cmd); 6871 } 6872 6873 static int set_bredr_sync(struct hci_dev *hdev, void *data) 6874 { 6875 int status; 6876 6877 status = hci_write_fast_connectable_sync(hdev, false); 6878 6879 if (!status) 6880 status = hci_update_scan_sync(hdev); 6881 6882 /* Since only the advertising data flags will change, there 6883 * is no need to update the scan response data. 6884 */ 6885 if (!status) 6886 status = hci_update_adv_data_sync(hdev, hdev->cur_adv_instance); 6887 6888 return status; 6889 } 6890 6891 static int set_bredr(struct sock *sk, struct hci_dev *hdev, void *data, u16 len) 6892 { 6893 struct mgmt_mode *cp = data; 6894 struct mgmt_pending_cmd *cmd; 6895 int err; 6896 6897 bt_dev_dbg(hdev, "sock %p", sk); 6898 6899 if (!lmp_bredr_capable(hdev) || !lmp_le_capable(hdev)) 6900 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR, 6901 MGMT_STATUS_NOT_SUPPORTED); 6902 6903 if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED)) 6904 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR, 6905 MGMT_STATUS_REJECTED); 6906 6907 if (cp->val != 0x00 && cp->val != 0x01) 6908 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR, 6909 MGMT_STATUS_INVALID_PARAMS); 6910 6911 hci_dev_lock(hdev); 6912 6913 if (cp->val == hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) { 6914 err = send_settings_rsp(sk, MGMT_OP_SET_BREDR, hdev); 6915 goto unlock; 6916 } 6917 6918 if (!hdev_is_powered(hdev)) { 6919 if (!cp->val) { 6920 hci_dev_clear_flag(hdev, HCI_DISCOVERABLE); 6921 hci_dev_clear_flag(hdev, HCI_SSP_ENABLED); 6922 hci_dev_clear_flag(hdev, HCI_LINK_SECURITY); 6923 hci_dev_clear_flag(hdev, HCI_FAST_CONNECTABLE); 6924 } 6925 6926 hci_dev_change_flag(hdev, HCI_BREDR_ENABLED); 6927 6928 err = send_settings_rsp(sk, MGMT_OP_SET_BREDR, hdev); 6929 if (err < 0) 6930 goto unlock; 6931 6932 err = new_settings(hdev, sk); 6933 goto unlock; 6934 } 6935 6936 /* Reject disabling when powered on */ 6937 if (!cp->val) { 6938 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR, 6939 MGMT_STATUS_REJECTED); 6940 goto unlock; 6941 } else { 6942 /* When configuring a dual-mode controller to operate 6943 * with LE only and using a static address, then switching 6944 * BR/EDR back on is not allowed. 6945 * 6946 * Dual-mode controllers shall operate with the public 6947 * address as its identity address for BR/EDR and LE. So 6948 * reject the attempt to create an invalid configuration. 6949 * 6950 * The same restrictions applies when secure connections 6951 * has been enabled. For BR/EDR this is a controller feature 6952 * while for LE it is a host stack feature. This means that 6953 * switching BR/EDR back on when secure connections has been 6954 * enabled is not a supported transaction. 6955 */ 6956 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) && 6957 (bacmp(&hdev->static_addr, BDADDR_ANY) || 6958 hci_dev_test_flag(hdev, HCI_SC_ENABLED))) { 6959 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR, 6960 MGMT_STATUS_REJECTED); 6961 goto unlock; 6962 } 6963 } 6964 6965 cmd = mgmt_pending_new(sk, MGMT_OP_SET_BREDR, hdev, data, len); 6966 if (!cmd) 6967 err = -ENOMEM; 6968 else 6969 err = hci_cmd_sync_queue(hdev, set_bredr_sync, cmd, 6970 set_bredr_complete); 6971 6972 if (err < 0) { 6973 mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR, 6974 MGMT_STATUS_FAILED); 6975 if (cmd) 6976 mgmt_pending_free(cmd); 6977 6978 goto unlock; 6979 } 6980 6981 /* We need to flip the bit already here so that 6982 * hci_req_update_adv_data generates the correct flags. 6983 */ 6984 hci_dev_set_flag(hdev, HCI_BREDR_ENABLED); 6985 6986 unlock: 6987 hci_dev_unlock(hdev); 6988 return err; 6989 } 6990 6991 static void set_secure_conn_complete(struct hci_dev *hdev, void *data, int err) 6992 { 6993 struct mgmt_pending_cmd *cmd = data; 6994 struct mgmt_mode *cp; 6995 6996 bt_dev_dbg(hdev, "err %d", err); 6997 6998 if (err) { 6999 u8 mgmt_err = mgmt_status(err); 7000 7001 mgmt_cmd_status(cmd->sk, cmd->hdev->id, cmd->opcode, mgmt_err); 7002 goto done; 7003 } 7004 7005 cp = cmd->param; 7006 7007 switch (cp->val) { 7008 case 0x00: 7009 hci_dev_clear_flag(hdev, HCI_SC_ENABLED); 7010 hci_dev_clear_flag(hdev, HCI_SC_ONLY); 7011 break; 7012 case 0x01: 7013 hci_dev_set_flag(hdev, HCI_SC_ENABLED); 7014 hci_dev_clear_flag(hdev, HCI_SC_ONLY); 7015 break; 7016 case 0x02: 7017 hci_dev_set_flag(hdev, HCI_SC_ENABLED); 7018 hci_dev_set_flag(hdev, HCI_SC_ONLY); 7019 break; 7020 } 7021 7022 send_settings_rsp(cmd->sk, cmd->opcode, hdev); 7023 new_settings(hdev, cmd->sk); 7024 7025 done: 7026 mgmt_pending_free(cmd); 7027 } 7028 7029 static int set_secure_conn_sync(struct hci_dev *hdev, void *data) 7030 { 7031 struct mgmt_pending_cmd *cmd = data; 7032 struct mgmt_mode *cp = cmd->param; 7033 u8 val = !!cp->val; 7034 7035 /* Force write of val */ 7036 hci_dev_set_flag(hdev, HCI_SC_ENABLED); 7037 7038 return hci_write_sc_support_sync(hdev, val); 7039 } 7040 7041 static int set_secure_conn(struct sock *sk, struct hci_dev *hdev, 7042 void *data, u16 len) 7043 { 7044 struct mgmt_mode *cp = data; 7045 struct mgmt_pending_cmd *cmd; 7046 u8 val; 7047 int err; 7048 7049 bt_dev_dbg(hdev, "sock %p", sk); 7050 7051 if (!lmp_sc_capable(hdev) && 7052 !hci_dev_test_flag(hdev, HCI_LE_ENABLED)) 7053 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN, 7054 MGMT_STATUS_NOT_SUPPORTED); 7055 7056 if (hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) && 7057 lmp_sc_capable(hdev) && 7058 !hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) 7059 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN, 7060 MGMT_STATUS_REJECTED); 7061 7062 if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02) 7063 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN, 7064 MGMT_STATUS_INVALID_PARAMS); 7065 7066 hci_dev_lock(hdev); 7067 7068 if (!hdev_is_powered(hdev) || !lmp_sc_capable(hdev) || 7069 !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) { 7070 bool changed; 7071 7072 if (cp->val) { 7073 changed = !hci_dev_test_and_set_flag(hdev, 7074 HCI_SC_ENABLED); 7075 if (cp->val == 0x02) 7076 hci_dev_set_flag(hdev, HCI_SC_ONLY); 7077 else 7078 hci_dev_clear_flag(hdev, HCI_SC_ONLY); 7079 } else { 7080 changed = hci_dev_test_and_clear_flag(hdev, 7081 HCI_SC_ENABLED); 7082 hci_dev_clear_flag(hdev, HCI_SC_ONLY); 7083 } 7084 7085 err = send_settings_rsp(sk, MGMT_OP_SET_SECURE_CONN, hdev); 7086 if (err < 0) 7087 goto failed; 7088 7089 if (changed) 7090 err = new_settings(hdev, sk); 7091 7092 goto failed; 7093 } 7094 7095 val = !!cp->val; 7096 7097 if (val == hci_dev_test_flag(hdev, HCI_SC_ENABLED) && 7098 (cp->val == 0x02) == hci_dev_test_flag(hdev, HCI_SC_ONLY)) { 7099 err = send_settings_rsp(sk, MGMT_OP_SET_SECURE_CONN, hdev); 7100 goto failed; 7101 } 7102 7103 cmd = mgmt_pending_new(sk, MGMT_OP_SET_SECURE_CONN, hdev, data, len); 7104 if (!cmd) 7105 err = -ENOMEM; 7106 else 7107 err = hci_cmd_sync_queue(hdev, set_secure_conn_sync, cmd, 7108 set_secure_conn_complete); 7109 7110 if (err < 0) { 7111 mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN, 7112 MGMT_STATUS_FAILED); 7113 if (cmd) 7114 mgmt_pending_free(cmd); 7115 } 7116 7117 failed: 7118 hci_dev_unlock(hdev); 7119 return err; 7120 } 7121 7122 static int set_debug_keys(struct sock *sk, struct hci_dev *hdev, 7123 void *data, u16 len) 7124 { 7125 struct mgmt_mode *cp = data; 7126 bool changed, use_changed; 7127 int err; 7128 7129 bt_dev_dbg(hdev, "sock %p", sk); 7130 7131 if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02) 7132 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEBUG_KEYS, 7133 MGMT_STATUS_INVALID_PARAMS); 7134 7135 hci_dev_lock(hdev); 7136 7137 if (cp->val) 7138 changed = !hci_dev_test_and_set_flag(hdev, HCI_KEEP_DEBUG_KEYS); 7139 else 7140 changed = hci_dev_test_and_clear_flag(hdev, 7141 HCI_KEEP_DEBUG_KEYS); 7142 7143 if (cp->val == 0x02) 7144 use_changed = !hci_dev_test_and_set_flag(hdev, 7145 HCI_USE_DEBUG_KEYS); 7146 else 7147 use_changed = hci_dev_test_and_clear_flag(hdev, 7148 HCI_USE_DEBUG_KEYS); 7149 7150 if (hdev_is_powered(hdev) && use_changed && 7151 hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) { 7152 u8 mode = (cp->val == 0x02) ? 0x01 : 0x00; 7153 hci_send_cmd(hdev, HCI_OP_WRITE_SSP_DEBUG_MODE, 7154 sizeof(mode), &mode); 7155 } 7156 7157 err = send_settings_rsp(sk, MGMT_OP_SET_DEBUG_KEYS, hdev); 7158 if (err < 0) 7159 goto unlock; 7160 7161 if (changed) 7162 err = new_settings(hdev, sk); 7163 7164 unlock: 7165 hci_dev_unlock(hdev); 7166 return err; 7167 } 7168 7169 static int set_privacy(struct sock *sk, struct hci_dev *hdev, void *cp_data, 7170 u16 len) 7171 { 7172 struct mgmt_cp_set_privacy *cp = cp_data; 7173 bool changed; 7174 int err; 7175 7176 bt_dev_dbg(hdev, "sock %p", sk); 7177 7178 if (!lmp_le_capable(hdev)) 7179 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY, 7180 MGMT_STATUS_NOT_SUPPORTED); 7181 7182 if (cp->privacy != 0x00 && cp->privacy != 0x01 && cp->privacy != 0x02) 7183 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY, 7184 MGMT_STATUS_INVALID_PARAMS); 7185 7186 if (hdev_is_powered(hdev)) 7187 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY, 7188 MGMT_STATUS_REJECTED); 7189 7190 hci_dev_lock(hdev); 7191 7192 /* If user space supports this command it is also expected to 7193 * handle IRKs. Therefore, set the HCI_RPA_RESOLVING flag. 7194 */ 7195 hci_dev_set_flag(hdev, HCI_RPA_RESOLVING); 7196 7197 if (cp->privacy) { 7198 changed = !hci_dev_test_and_set_flag(hdev, HCI_PRIVACY); 7199 memcpy(hdev->irk, cp->irk, sizeof(hdev->irk)); 7200 hci_dev_set_flag(hdev, HCI_RPA_EXPIRED); 7201 hci_adv_instances_set_rpa_expired(hdev, true); 7202 if (cp->privacy == 0x02) 7203 hci_dev_set_flag(hdev, HCI_LIMITED_PRIVACY); 7204 else 7205 hci_dev_clear_flag(hdev, HCI_LIMITED_PRIVACY); 7206 } else { 7207 changed = hci_dev_test_and_clear_flag(hdev, HCI_PRIVACY); 7208 memset(hdev->irk, 0, sizeof(hdev->irk)); 7209 hci_dev_clear_flag(hdev, HCI_RPA_EXPIRED); 7210 hci_adv_instances_set_rpa_expired(hdev, false); 7211 hci_dev_clear_flag(hdev, HCI_LIMITED_PRIVACY); 7212 } 7213 7214 err = send_settings_rsp(sk, MGMT_OP_SET_PRIVACY, hdev); 7215 if (err < 0) 7216 goto unlock; 7217 7218 if (changed) 7219 err = new_settings(hdev, sk); 7220 7221 unlock: 7222 hci_dev_unlock(hdev); 7223 return err; 7224 } 7225 7226 static bool irk_is_valid(struct mgmt_irk_info *irk) 7227 { 7228 switch (irk->addr.type) { 7229 case BDADDR_LE_PUBLIC: 7230 return true; 7231 7232 case BDADDR_LE_RANDOM: 7233 /* Two most significant bits shall be set */ 7234 if ((irk->addr.bdaddr.b[5] & 0xc0) != 0xc0) 7235 return false; 7236 return true; 7237 } 7238 7239 return false; 7240 } 7241 7242 static int load_irks(struct sock *sk, struct hci_dev *hdev, void *cp_data, 7243 u16 len) 7244 { 7245 struct mgmt_cp_load_irks *cp = cp_data; 7246 const u16 max_irk_count = ((U16_MAX - sizeof(*cp)) / 7247 sizeof(struct mgmt_irk_info)); 7248 u16 irk_count, expected_len; 7249 int i, err; 7250 7251 bt_dev_dbg(hdev, "sock %p", sk); 7252 7253 if (!lmp_le_capable(hdev)) 7254 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS, 7255 MGMT_STATUS_NOT_SUPPORTED); 7256 7257 irk_count = __le16_to_cpu(cp->irk_count); 7258 if (irk_count > max_irk_count) { 7259 bt_dev_err(hdev, "load_irks: too big irk_count value %u", 7260 irk_count); 7261 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS, 7262 MGMT_STATUS_INVALID_PARAMS); 7263 } 7264 7265 expected_len = struct_size(cp, irks, irk_count); 7266 if (expected_len != len) { 7267 bt_dev_err(hdev, "load_irks: expected %u bytes, got %u bytes", 7268 expected_len, len); 7269 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS, 7270 MGMT_STATUS_INVALID_PARAMS); 7271 } 7272 7273 bt_dev_dbg(hdev, "irk_count %u", irk_count); 7274 7275 for (i = 0; i < irk_count; i++) { 7276 struct mgmt_irk_info *key = &cp->irks[i]; 7277 7278 if (!irk_is_valid(key)) 7279 return mgmt_cmd_status(sk, hdev->id, 7280 MGMT_OP_LOAD_IRKS, 7281 MGMT_STATUS_INVALID_PARAMS); 7282 } 7283 7284 hci_dev_lock(hdev); 7285 7286 hci_smp_irks_clear(hdev); 7287 7288 for (i = 0; i < irk_count; i++) { 7289 struct mgmt_irk_info *irk = &cp->irks[i]; 7290 7291 if (hci_is_blocked_key(hdev, 7292 HCI_BLOCKED_KEY_TYPE_IRK, 7293 irk->val)) { 7294 bt_dev_warn(hdev, "Skipping blocked IRK for %pMR", 7295 &irk->addr.bdaddr); 7296 continue; 7297 } 7298 7299 hci_add_irk(hdev, &irk->addr.bdaddr, 7300 le_addr_type(irk->addr.type), irk->val, 7301 BDADDR_ANY); 7302 } 7303 7304 hci_dev_set_flag(hdev, HCI_RPA_RESOLVING); 7305 7306 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_IRKS, 0, NULL, 0); 7307 7308 hci_dev_unlock(hdev); 7309 7310 return err; 7311 } 7312 7313 static bool ltk_is_valid(struct mgmt_ltk_info *key) 7314 { 7315 if (key->initiator != 0x00 && key->initiator != 0x01) 7316 return false; 7317 7318 if (key->enc_size > sizeof(key->val)) 7319 return false; 7320 7321 switch (key->addr.type) { 7322 case BDADDR_LE_PUBLIC: 7323 return true; 7324 7325 case BDADDR_LE_RANDOM: 7326 /* Two most significant bits shall be set */ 7327 if ((key->addr.bdaddr.b[5] & 0xc0) != 0xc0) 7328 return false; 7329 return true; 7330 } 7331 7332 return false; 7333 } 7334 7335 static int load_long_term_keys(struct sock *sk, struct hci_dev *hdev, 7336 void *cp_data, u16 len) 7337 { 7338 struct mgmt_cp_load_long_term_keys *cp = cp_data; 7339 const u16 max_key_count = ((U16_MAX - sizeof(*cp)) / 7340 sizeof(struct mgmt_ltk_info)); 7341 u16 key_count, expected_len; 7342 int i, err; 7343 7344 bt_dev_dbg(hdev, "sock %p", sk); 7345 7346 if (!lmp_le_capable(hdev)) 7347 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS, 7348 MGMT_STATUS_NOT_SUPPORTED); 7349 7350 key_count = __le16_to_cpu(cp->key_count); 7351 if (key_count > max_key_count) { 7352 bt_dev_err(hdev, "load_ltks: too big key_count value %u", 7353 key_count); 7354 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS, 7355 MGMT_STATUS_INVALID_PARAMS); 7356 } 7357 7358 expected_len = struct_size(cp, keys, key_count); 7359 if (expected_len != len) { 7360 bt_dev_err(hdev, "load_keys: expected %u bytes, got %u bytes", 7361 expected_len, len); 7362 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS, 7363 MGMT_STATUS_INVALID_PARAMS); 7364 } 7365 7366 bt_dev_dbg(hdev, "key_count %u", key_count); 7367 7368 hci_dev_lock(hdev); 7369 7370 hci_smp_ltks_clear(hdev); 7371 7372 for (i = 0; i < key_count; i++) { 7373 struct mgmt_ltk_info *key = &cp->keys[i]; 7374 u8 type, authenticated; 7375 7376 if (hci_is_blocked_key(hdev, 7377 HCI_BLOCKED_KEY_TYPE_LTK, 7378 key->val)) { 7379 bt_dev_warn(hdev, "Skipping blocked LTK for %pMR", 7380 &key->addr.bdaddr); 7381 continue; 7382 } 7383 7384 if (!ltk_is_valid(key)) { 7385 bt_dev_warn(hdev, "Invalid LTK for %pMR", 7386 &key->addr.bdaddr); 7387 continue; 7388 } 7389 7390 switch (key->type) { 7391 case MGMT_LTK_UNAUTHENTICATED: 7392 authenticated = 0x00; 7393 type = key->initiator ? SMP_LTK : SMP_LTK_RESPONDER; 7394 break; 7395 case MGMT_LTK_AUTHENTICATED: 7396 authenticated = 0x01; 7397 type = key->initiator ? SMP_LTK : SMP_LTK_RESPONDER; 7398 break; 7399 case MGMT_LTK_P256_UNAUTH: 7400 authenticated = 0x00; 7401 type = SMP_LTK_P256; 7402 break; 7403 case MGMT_LTK_P256_AUTH: 7404 authenticated = 0x01; 7405 type = SMP_LTK_P256; 7406 break; 7407 case MGMT_LTK_P256_DEBUG: 7408 authenticated = 0x00; 7409 type = SMP_LTK_P256_DEBUG; 7410 fallthrough; 7411 default: 7412 continue; 7413 } 7414 7415 hci_add_ltk(hdev, &key->addr.bdaddr, 7416 le_addr_type(key->addr.type), type, authenticated, 7417 key->val, key->enc_size, key->ediv, key->rand); 7418 } 7419 7420 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS, 0, 7421 NULL, 0); 7422 7423 hci_dev_unlock(hdev); 7424 7425 return err; 7426 } 7427 7428 static void get_conn_info_complete(struct hci_dev *hdev, void *data, int err) 7429 { 7430 struct mgmt_pending_cmd *cmd = data; 7431 struct hci_conn *conn = cmd->user_data; 7432 struct mgmt_cp_get_conn_info *cp = cmd->param; 7433 struct mgmt_rp_get_conn_info rp; 7434 u8 status; 7435 7436 bt_dev_dbg(hdev, "err %d", err); 7437 7438 memcpy(&rp.addr, &cp->addr, sizeof(rp.addr)); 7439 7440 status = mgmt_status(err); 7441 if (status == MGMT_STATUS_SUCCESS) { 7442 rp.rssi = conn->rssi; 7443 rp.tx_power = conn->tx_power; 7444 rp.max_tx_power = conn->max_tx_power; 7445 } else { 7446 rp.rssi = HCI_RSSI_INVALID; 7447 rp.tx_power = HCI_TX_POWER_INVALID; 7448 rp.max_tx_power = HCI_TX_POWER_INVALID; 7449 } 7450 7451 if (conn) 7452 hci_conn_put(conn); 7453 7454 mgmt_cmd_complete(cmd->sk, cmd->hdev->id, MGMT_OP_GET_CONN_INFO, status, 7455 &rp, sizeof(rp)); 7456 7457 mgmt_pending_free(cmd); 7458 } 7459 7460 static int get_conn_info_sync(struct hci_dev *hdev, void *data) 7461 { 7462 struct mgmt_pending_cmd *cmd = data; 7463 struct mgmt_cp_get_conn_info *cp = cmd->param; 7464 struct hci_conn *conn; 7465 int err; 7466 __le16 handle; 7467 7468 hci_dev_lock(hdev); 7469 7470 /* Make sure we are still connected */ 7471 if (cp->addr.type == BDADDR_BREDR) 7472 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, 7473 &cp->addr.bdaddr); 7474 else 7475 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &cp->addr.bdaddr); 7476 7477 if (!conn || conn->state != BT_CONNECTED) { 7478 hci_dev_unlock(hdev); 7479 return MGMT_STATUS_NOT_CONNECTED; 7480 } 7481 7482 cmd->user_data = hci_conn_get(conn); 7483 handle = cpu_to_le16(conn->handle); 7484 7485 hci_dev_unlock(hdev); 7486 7487 /* Refresh RSSI each time */ 7488 err = hci_read_rssi_sync(hdev, handle); 7489 7490 /* For LE links TX power does not change thus we don't need to 7491 * query for it once value is known. 7492 */ 7493 if (!err && (!bdaddr_type_is_le(cp->addr.type) || 7494 conn->tx_power == HCI_TX_POWER_INVALID)) 7495 err = hci_read_tx_power_sync(hdev, handle, 0x00); 7496 7497 /* Max TX power needs to be read only once per connection */ 7498 if (!err && conn->max_tx_power == HCI_TX_POWER_INVALID) 7499 err = hci_read_tx_power_sync(hdev, handle, 0x01); 7500 7501 return err; 7502 } 7503 7504 static int get_conn_info(struct sock *sk, struct hci_dev *hdev, void *data, 7505 u16 len) 7506 { 7507 struct mgmt_cp_get_conn_info *cp = data; 7508 struct mgmt_rp_get_conn_info rp; 7509 struct hci_conn *conn; 7510 unsigned long conn_info_age; 7511 int err = 0; 7512 7513 bt_dev_dbg(hdev, "sock %p", sk); 7514 7515 memset(&rp, 0, sizeof(rp)); 7516 bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr); 7517 rp.addr.type = cp->addr.type; 7518 7519 if (!bdaddr_type_is_valid(cp->addr.type)) 7520 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO, 7521 MGMT_STATUS_INVALID_PARAMS, 7522 &rp, sizeof(rp)); 7523 7524 hci_dev_lock(hdev); 7525 7526 if (!hdev_is_powered(hdev)) { 7527 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO, 7528 MGMT_STATUS_NOT_POWERED, &rp, 7529 sizeof(rp)); 7530 goto unlock; 7531 } 7532 7533 if (cp->addr.type == BDADDR_BREDR) 7534 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, 7535 &cp->addr.bdaddr); 7536 else 7537 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &cp->addr.bdaddr); 7538 7539 if (!conn || conn->state != BT_CONNECTED) { 7540 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO, 7541 MGMT_STATUS_NOT_CONNECTED, &rp, 7542 sizeof(rp)); 7543 goto unlock; 7544 } 7545 7546 /* To avoid client trying to guess when to poll again for information we 7547 * calculate conn info age as random value between min/max set in hdev. 7548 */ 7549 conn_info_age = get_random_u32_inclusive(hdev->conn_info_min_age, 7550 hdev->conn_info_max_age - 1); 7551 7552 /* Query controller to refresh cached values if they are too old or were 7553 * never read. 7554 */ 7555 if (time_after(jiffies, conn->conn_info_timestamp + 7556 msecs_to_jiffies(conn_info_age)) || 7557 !conn->conn_info_timestamp) { 7558 struct mgmt_pending_cmd *cmd; 7559 7560 cmd = mgmt_pending_new(sk, MGMT_OP_GET_CONN_INFO, hdev, data, 7561 len); 7562 if (!cmd) { 7563 err = -ENOMEM; 7564 } else { 7565 err = hci_cmd_sync_queue(hdev, get_conn_info_sync, 7566 cmd, get_conn_info_complete); 7567 } 7568 7569 if (err < 0) { 7570 mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO, 7571 MGMT_STATUS_FAILED, &rp, sizeof(rp)); 7572 7573 if (cmd) 7574 mgmt_pending_free(cmd); 7575 7576 goto unlock; 7577 } 7578 7579 conn->conn_info_timestamp = jiffies; 7580 } else { 7581 /* Cache is valid, just reply with values cached in hci_conn */ 7582 rp.rssi = conn->rssi; 7583 rp.tx_power = conn->tx_power; 7584 rp.max_tx_power = conn->max_tx_power; 7585 7586 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO, 7587 MGMT_STATUS_SUCCESS, &rp, sizeof(rp)); 7588 } 7589 7590 unlock: 7591 hci_dev_unlock(hdev); 7592 return err; 7593 } 7594 7595 static void get_clock_info_complete(struct hci_dev *hdev, void *data, int err) 7596 { 7597 struct mgmt_pending_cmd *cmd = data; 7598 struct mgmt_cp_get_clock_info *cp = cmd->param; 7599 struct mgmt_rp_get_clock_info rp; 7600 struct hci_conn *conn = cmd->user_data; 7601 u8 status = mgmt_status(err); 7602 7603 bt_dev_dbg(hdev, "err %d", err); 7604 7605 memset(&rp, 0, sizeof(rp)); 7606 bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr); 7607 rp.addr.type = cp->addr.type; 7608 7609 if (err) 7610 goto complete; 7611 7612 rp.local_clock = cpu_to_le32(hdev->clock); 7613 7614 if (conn) { 7615 rp.piconet_clock = cpu_to_le32(conn->clock); 7616 rp.accuracy = cpu_to_le16(conn->clock_accuracy); 7617 } 7618 7619 complete: 7620 if (conn) 7621 hci_conn_put(conn); 7622 7623 mgmt_cmd_complete(cmd->sk, cmd->hdev->id, cmd->opcode, status, &rp, 7624 sizeof(rp)); 7625 7626 mgmt_pending_free(cmd); 7627 } 7628 7629 static int get_clock_info_sync(struct hci_dev *hdev, void *data) 7630 { 7631 struct mgmt_pending_cmd *cmd = data; 7632 struct mgmt_cp_get_clock_info *cp = cmd->param; 7633 struct hci_cp_read_clock hci_cp; 7634 struct hci_conn *conn; 7635 7636 memset(&hci_cp, 0, sizeof(hci_cp)); 7637 hci_read_clock_sync(hdev, &hci_cp); 7638 7639 hci_dev_lock(hdev); 7640 7641 /* Make sure connection still exists */ 7642 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->addr.bdaddr); 7643 if (!conn || conn->state != BT_CONNECTED) { 7644 hci_dev_unlock(hdev); 7645 return MGMT_STATUS_NOT_CONNECTED; 7646 } 7647 7648 cmd->user_data = hci_conn_get(conn); 7649 hci_cp.handle = cpu_to_le16(conn->handle); 7650 hci_cp.which = 0x01; /* Piconet clock */ 7651 7652 hci_dev_unlock(hdev); 7653 7654 return hci_read_clock_sync(hdev, &hci_cp); 7655 } 7656 7657 static int get_clock_info(struct sock *sk, struct hci_dev *hdev, void *data, 7658 u16 len) 7659 { 7660 struct mgmt_cp_get_clock_info *cp = data; 7661 struct mgmt_rp_get_clock_info rp; 7662 struct mgmt_pending_cmd *cmd; 7663 struct hci_conn *conn; 7664 int err; 7665 7666 bt_dev_dbg(hdev, "sock %p", sk); 7667 7668 memset(&rp, 0, sizeof(rp)); 7669 bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr); 7670 rp.addr.type = cp->addr.type; 7671 7672 if (cp->addr.type != BDADDR_BREDR) 7673 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CLOCK_INFO, 7674 MGMT_STATUS_INVALID_PARAMS, 7675 &rp, sizeof(rp)); 7676 7677 hci_dev_lock(hdev); 7678 7679 if (!hdev_is_powered(hdev)) { 7680 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CLOCK_INFO, 7681 MGMT_STATUS_NOT_POWERED, &rp, 7682 sizeof(rp)); 7683 goto unlock; 7684 } 7685 7686 if (bacmp(&cp->addr.bdaddr, BDADDR_ANY)) { 7687 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, 7688 &cp->addr.bdaddr); 7689 if (!conn || conn->state != BT_CONNECTED) { 7690 err = mgmt_cmd_complete(sk, hdev->id, 7691 MGMT_OP_GET_CLOCK_INFO, 7692 MGMT_STATUS_NOT_CONNECTED, 7693 &rp, sizeof(rp)); 7694 goto unlock; 7695 } 7696 } else { 7697 conn = NULL; 7698 } 7699 7700 cmd = mgmt_pending_new(sk, MGMT_OP_GET_CLOCK_INFO, hdev, data, len); 7701 if (!cmd) 7702 err = -ENOMEM; 7703 else 7704 err = hci_cmd_sync_queue(hdev, get_clock_info_sync, cmd, 7705 get_clock_info_complete); 7706 7707 if (err < 0) { 7708 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CLOCK_INFO, 7709 MGMT_STATUS_FAILED, &rp, sizeof(rp)); 7710 7711 if (cmd) 7712 mgmt_pending_free(cmd); 7713 } 7714 7715 7716 unlock: 7717 hci_dev_unlock(hdev); 7718 return err; 7719 } 7720 7721 static void device_added(struct sock *sk, struct hci_dev *hdev, 7722 bdaddr_t *bdaddr, u8 type, u8 action) 7723 { 7724 struct mgmt_ev_device_added ev; 7725 7726 bacpy(&ev.addr.bdaddr, bdaddr); 7727 ev.addr.type = type; 7728 ev.action = action; 7729 7730 mgmt_event(MGMT_EV_DEVICE_ADDED, hdev, &ev, sizeof(ev), sk); 7731 } 7732 7733 static void add_device_complete(struct hci_dev *hdev, void *data, int err) 7734 { 7735 struct mgmt_pending_cmd *cmd = data; 7736 struct mgmt_cp_add_device *cp = cmd->param; 7737 7738 if (!err) { 7739 struct hci_conn_params *params; 7740 7741 hci_dev_lock(hdev); 7742 7743 params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr, 7744 le_addr_type(cp->addr.type)); 7745 7746 device_added(cmd->sk, hdev, &cp->addr.bdaddr, cp->addr.type, 7747 cp->action); 7748 device_flags_changed(NULL, hdev, &cp->addr.bdaddr, 7749 cp->addr.type, hdev->conn_flags, 7750 params ? params->flags : 0); 7751 hci_dev_unlock(hdev); 7752 } 7753 7754 mgmt_cmd_complete(cmd->sk, hdev->id, MGMT_OP_ADD_DEVICE, 7755 mgmt_status(err), &cp->addr, sizeof(cp->addr)); 7756 mgmt_pending_free(cmd); 7757 } 7758 7759 static int add_device_sync(struct hci_dev *hdev, void *data) 7760 { 7761 return hci_update_passive_scan_sync(hdev); 7762 } 7763 7764 static int add_device(struct sock *sk, struct hci_dev *hdev, 7765 void *data, u16 len) 7766 { 7767 struct mgmt_pending_cmd *cmd; 7768 struct mgmt_cp_add_device *cp = data; 7769 u8 auto_conn, addr_type; 7770 struct hci_conn_params *params; 7771 int err; 7772 u32 current_flags = 0; 7773 u32 supported_flags; 7774 7775 bt_dev_dbg(hdev, "sock %p", sk); 7776 7777 if (!bdaddr_type_is_valid(cp->addr.type) || 7778 !bacmp(&cp->addr.bdaddr, BDADDR_ANY)) 7779 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE, 7780 MGMT_STATUS_INVALID_PARAMS, 7781 &cp->addr, sizeof(cp->addr)); 7782 7783 if (cp->action != 0x00 && cp->action != 0x01 && cp->action != 0x02) 7784 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE, 7785 MGMT_STATUS_INVALID_PARAMS, 7786 &cp->addr, sizeof(cp->addr)); 7787 7788 hci_dev_lock(hdev); 7789 7790 if (cp->addr.type == BDADDR_BREDR) { 7791 /* Only incoming connections action is supported for now */ 7792 if (cp->action != 0x01) { 7793 err = mgmt_cmd_complete(sk, hdev->id, 7794 MGMT_OP_ADD_DEVICE, 7795 MGMT_STATUS_INVALID_PARAMS, 7796 &cp->addr, sizeof(cp->addr)); 7797 goto unlock; 7798 } 7799 7800 err = hci_bdaddr_list_add_with_flags(&hdev->accept_list, 7801 &cp->addr.bdaddr, 7802 cp->addr.type, 0); 7803 if (err) 7804 goto unlock; 7805 7806 hci_update_scan(hdev); 7807 7808 goto added; 7809 } 7810 7811 addr_type = le_addr_type(cp->addr.type); 7812 7813 if (cp->action == 0x02) 7814 auto_conn = HCI_AUTO_CONN_ALWAYS; 7815 else if (cp->action == 0x01) 7816 auto_conn = HCI_AUTO_CONN_DIRECT; 7817 else 7818 auto_conn = HCI_AUTO_CONN_REPORT; 7819 7820 /* Kernel internally uses conn_params with resolvable private 7821 * address, but Add Device allows only identity addresses. 7822 * Make sure it is enforced before calling 7823 * hci_conn_params_lookup. 7824 */ 7825 if (!hci_is_identity_address(&cp->addr.bdaddr, addr_type)) { 7826 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE, 7827 MGMT_STATUS_INVALID_PARAMS, 7828 &cp->addr, sizeof(cp->addr)); 7829 goto unlock; 7830 } 7831 7832 /* If the connection parameters don't exist for this device, 7833 * they will be created and configured with defaults. 7834 */ 7835 params = hci_conn_params_set(hdev, &cp->addr.bdaddr, addr_type, 7836 auto_conn); 7837 if (!params) { 7838 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE, 7839 MGMT_STATUS_FAILED, &cp->addr, 7840 sizeof(cp->addr)); 7841 goto unlock; 7842 } 7843 7844 cmd = mgmt_pending_new(sk, MGMT_OP_ADD_DEVICE, hdev, data, len); 7845 if (!cmd) { 7846 err = -ENOMEM; 7847 goto unlock; 7848 } 7849 7850 err = hci_cmd_sync_queue(hdev, add_device_sync, cmd, 7851 add_device_complete); 7852 if (err < 0) { 7853 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE, 7854 MGMT_STATUS_FAILED, &cp->addr, 7855 sizeof(cp->addr)); 7856 mgmt_pending_free(cmd); 7857 } 7858 7859 goto unlock; 7860 7861 added: 7862 device_added(sk, hdev, &cp->addr.bdaddr, cp->addr.type, cp->action); 7863 supported_flags = hdev->conn_flags; 7864 device_flags_changed(NULL, hdev, &cp->addr.bdaddr, cp->addr.type, 7865 supported_flags, current_flags); 7866 7867 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE, 7868 MGMT_STATUS_SUCCESS, &cp->addr, 7869 sizeof(cp->addr)); 7870 7871 unlock: 7872 hci_dev_unlock(hdev); 7873 return err; 7874 } 7875 7876 static void device_removed(struct sock *sk, struct hci_dev *hdev, 7877 bdaddr_t *bdaddr, u8 type) 7878 { 7879 struct mgmt_ev_device_removed ev; 7880 7881 bacpy(&ev.addr.bdaddr, bdaddr); 7882 ev.addr.type = type; 7883 7884 mgmt_event(MGMT_EV_DEVICE_REMOVED, hdev, &ev, sizeof(ev), sk); 7885 } 7886 7887 static int remove_device_sync(struct hci_dev *hdev, void *data) 7888 { 7889 return hci_update_passive_scan_sync(hdev); 7890 } 7891 7892 static int remove_device(struct sock *sk, struct hci_dev *hdev, 7893 void *data, u16 len) 7894 { 7895 struct mgmt_cp_remove_device *cp = data; 7896 int err; 7897 7898 bt_dev_dbg(hdev, "sock %p", sk); 7899 7900 hci_dev_lock(hdev); 7901 7902 if (bacmp(&cp->addr.bdaddr, BDADDR_ANY)) { 7903 struct hci_conn_params *params; 7904 u8 addr_type; 7905 7906 if (!bdaddr_type_is_valid(cp->addr.type)) { 7907 err = mgmt_cmd_complete(sk, hdev->id, 7908 MGMT_OP_REMOVE_DEVICE, 7909 MGMT_STATUS_INVALID_PARAMS, 7910 &cp->addr, sizeof(cp->addr)); 7911 goto unlock; 7912 } 7913 7914 if (cp->addr.type == BDADDR_BREDR) { 7915 err = hci_bdaddr_list_del(&hdev->accept_list, 7916 &cp->addr.bdaddr, 7917 cp->addr.type); 7918 if (err) { 7919 err = mgmt_cmd_complete(sk, hdev->id, 7920 MGMT_OP_REMOVE_DEVICE, 7921 MGMT_STATUS_INVALID_PARAMS, 7922 &cp->addr, 7923 sizeof(cp->addr)); 7924 goto unlock; 7925 } 7926 7927 hci_update_scan(hdev); 7928 7929 device_removed(sk, hdev, &cp->addr.bdaddr, 7930 cp->addr.type); 7931 goto complete; 7932 } 7933 7934 addr_type = le_addr_type(cp->addr.type); 7935 7936 /* Kernel internally uses conn_params with resolvable private 7937 * address, but Remove Device allows only identity addresses. 7938 * Make sure it is enforced before calling 7939 * hci_conn_params_lookup. 7940 */ 7941 if (!hci_is_identity_address(&cp->addr.bdaddr, addr_type)) { 7942 err = mgmt_cmd_complete(sk, hdev->id, 7943 MGMT_OP_REMOVE_DEVICE, 7944 MGMT_STATUS_INVALID_PARAMS, 7945 &cp->addr, sizeof(cp->addr)); 7946 goto unlock; 7947 } 7948 7949 params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr, 7950 addr_type); 7951 if (!params) { 7952 err = mgmt_cmd_complete(sk, hdev->id, 7953 MGMT_OP_REMOVE_DEVICE, 7954 MGMT_STATUS_INVALID_PARAMS, 7955 &cp->addr, sizeof(cp->addr)); 7956 goto unlock; 7957 } 7958 7959 if (params->auto_connect == HCI_AUTO_CONN_DISABLED || 7960 params->auto_connect == HCI_AUTO_CONN_EXPLICIT) { 7961 err = mgmt_cmd_complete(sk, hdev->id, 7962 MGMT_OP_REMOVE_DEVICE, 7963 MGMT_STATUS_INVALID_PARAMS, 7964 &cp->addr, sizeof(cp->addr)); 7965 goto unlock; 7966 } 7967 7968 hci_conn_params_free(params); 7969 7970 device_removed(sk, hdev, &cp->addr.bdaddr, cp->addr.type); 7971 } else { 7972 struct hci_conn_params *p, *tmp; 7973 struct bdaddr_list *b, *btmp; 7974 7975 if (cp->addr.type) { 7976 err = mgmt_cmd_complete(sk, hdev->id, 7977 MGMT_OP_REMOVE_DEVICE, 7978 MGMT_STATUS_INVALID_PARAMS, 7979 &cp->addr, sizeof(cp->addr)); 7980 goto unlock; 7981 } 7982 7983 list_for_each_entry_safe(b, btmp, &hdev->accept_list, list) { 7984 device_removed(sk, hdev, &b->bdaddr, b->bdaddr_type); 7985 list_del(&b->list); 7986 kfree(b); 7987 } 7988 7989 hci_update_scan(hdev); 7990 7991 list_for_each_entry_safe(p, tmp, &hdev->le_conn_params, list) { 7992 if (p->auto_connect == HCI_AUTO_CONN_DISABLED) 7993 continue; 7994 device_removed(sk, hdev, &p->addr, p->addr_type); 7995 if (p->explicit_connect) { 7996 p->auto_connect = HCI_AUTO_CONN_EXPLICIT; 7997 continue; 7998 } 7999 hci_conn_params_free(p); 8000 } 8001 8002 bt_dev_dbg(hdev, "All LE connection parameters were removed"); 8003 } 8004 8005 hci_cmd_sync_queue(hdev, remove_device_sync, NULL, NULL); 8006 8007 complete: 8008 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_DEVICE, 8009 MGMT_STATUS_SUCCESS, &cp->addr, 8010 sizeof(cp->addr)); 8011 unlock: 8012 hci_dev_unlock(hdev); 8013 return err; 8014 } 8015 8016 static int conn_update_sync(struct hci_dev *hdev, void *data) 8017 { 8018 struct hci_conn *conn = data; 8019 struct hci_conn_params *params; 8020 struct hci_conn_params local = {}; 8021 8022 hci_dev_lock(hdev); 8023 8024 if (!hci_conn_valid(hdev, conn) || conn->role != HCI_ROLE_MASTER) 8025 goto cancel; 8026 8027 params = hci_conn_params_lookup(hdev, &conn->dst, conn->dst_type); 8028 if (!params) 8029 goto cancel; 8030 8031 local.conn_min_interval = params->conn_min_interval; 8032 local.conn_max_interval = params->conn_max_interval; 8033 local.conn_latency = params->conn_latency; 8034 local.supervision_timeout = params->supervision_timeout; 8035 8036 hci_dev_unlock(hdev); 8037 8038 return hci_le_conn_update_sync(hdev, conn, &local); 8039 8040 cancel: 8041 hci_dev_unlock(hdev); 8042 return -ECANCELED; 8043 } 8044 8045 static void conn_update_sync_destroy(struct hci_dev *hdev, void *data, int err) 8046 { 8047 hci_conn_put(data); 8048 } 8049 8050 static int load_conn_param(struct sock *sk, struct hci_dev *hdev, void *data, 8051 u16 len) 8052 { 8053 struct mgmt_cp_load_conn_param *cp = data; 8054 const u16 max_param_count = ((U16_MAX - sizeof(*cp)) / 8055 sizeof(struct mgmt_conn_param)); 8056 u16 param_count, expected_len; 8057 int i; 8058 8059 if (!lmp_le_capable(hdev)) 8060 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM, 8061 MGMT_STATUS_NOT_SUPPORTED); 8062 8063 param_count = __le16_to_cpu(cp->param_count); 8064 if (param_count > max_param_count) { 8065 bt_dev_err(hdev, "load_conn_param: too big param_count value %u", 8066 param_count); 8067 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM, 8068 MGMT_STATUS_INVALID_PARAMS); 8069 } 8070 8071 expected_len = struct_size(cp, params, param_count); 8072 if (expected_len != len) { 8073 bt_dev_err(hdev, "load_conn_param: expected %u bytes, got %u bytes", 8074 expected_len, len); 8075 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM, 8076 MGMT_STATUS_INVALID_PARAMS); 8077 } 8078 8079 bt_dev_dbg(hdev, "param_count %u", param_count); 8080 8081 hci_dev_lock(hdev); 8082 8083 if (param_count > 1) 8084 hci_conn_params_clear_disabled(hdev); 8085 8086 for (i = 0; i < param_count; i++) { 8087 struct mgmt_conn_param *param = &cp->params[i]; 8088 struct hci_conn_params *hci_param; 8089 u16 min, max, latency, timeout; 8090 bool update = false; 8091 u8 addr_type; 8092 8093 bt_dev_dbg(hdev, "Adding %pMR (type %u)", ¶m->addr.bdaddr, 8094 param->addr.type); 8095 8096 if (param->addr.type == BDADDR_LE_PUBLIC) { 8097 addr_type = ADDR_LE_DEV_PUBLIC; 8098 } else if (param->addr.type == BDADDR_LE_RANDOM) { 8099 addr_type = ADDR_LE_DEV_RANDOM; 8100 } else { 8101 bt_dev_err(hdev, "ignoring invalid connection parameters"); 8102 continue; 8103 } 8104 8105 min = le16_to_cpu(param->min_interval); 8106 max = le16_to_cpu(param->max_interval); 8107 latency = le16_to_cpu(param->latency); 8108 timeout = le16_to_cpu(param->timeout); 8109 8110 bt_dev_dbg(hdev, "min 0x%04x max 0x%04x latency 0x%04x timeout 0x%04x", 8111 min, max, latency, timeout); 8112 8113 if (hci_check_conn_params(min, max, latency, timeout) < 0) { 8114 bt_dev_err(hdev, "ignoring invalid connection parameters"); 8115 continue; 8116 } 8117 8118 /* Detect when the loading is for an existing parameter then 8119 * attempt to trigger the connection update procedure. 8120 */ 8121 if (!i && param_count == 1) { 8122 hci_param = hci_conn_params_lookup(hdev, 8123 ¶m->addr.bdaddr, 8124 addr_type); 8125 if (hci_param) 8126 update = true; 8127 else 8128 hci_conn_params_clear_disabled(hdev); 8129 } 8130 8131 hci_param = hci_conn_params_add(hdev, ¶m->addr.bdaddr, 8132 addr_type); 8133 if (!hci_param) { 8134 bt_dev_err(hdev, "failed to add connection parameters"); 8135 continue; 8136 } 8137 8138 hci_param->conn_min_interval = min; 8139 hci_param->conn_max_interval = max; 8140 hci_param->conn_latency = latency; 8141 hci_param->supervision_timeout = timeout; 8142 8143 /* Check if we need to trigger a connection update */ 8144 if (update) { 8145 struct hci_conn *conn; 8146 8147 /* Lookup for existing connection as central and check 8148 * if parameters match and if they don't then trigger 8149 * a connection update. 8150 */ 8151 conn = hci_conn_hash_lookup_le(hdev, &hci_param->addr, 8152 addr_type); 8153 if (conn && conn->role == HCI_ROLE_MASTER && 8154 (conn->le_conn_min_interval != min || 8155 conn->le_conn_max_interval != max || 8156 conn->le_conn_latency != latency || 8157 conn->le_supv_timeout != timeout)) { 8158 hci_conn_get(conn); 8159 if (hci_cmd_sync_queue(hdev, conn_update_sync, 8160 conn, 8161 conn_update_sync_destroy) < 0) 8162 hci_conn_put(conn); 8163 } 8164 } 8165 } 8166 8167 hci_dev_unlock(hdev); 8168 8169 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM, 0, 8170 NULL, 0); 8171 } 8172 8173 static int set_external_config(struct sock *sk, struct hci_dev *hdev, 8174 void *data, u16 len) 8175 { 8176 struct mgmt_cp_set_external_config *cp = data; 8177 bool changed; 8178 int err; 8179 8180 bt_dev_dbg(hdev, "sock %p", sk); 8181 8182 if (hdev_is_powered(hdev)) 8183 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_EXTERNAL_CONFIG, 8184 MGMT_STATUS_REJECTED); 8185 8186 if (cp->config != 0x00 && cp->config != 0x01) 8187 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_EXTERNAL_CONFIG, 8188 MGMT_STATUS_INVALID_PARAMS); 8189 8190 if (!hci_test_quirk(hdev, HCI_QUIRK_EXTERNAL_CONFIG)) 8191 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_EXTERNAL_CONFIG, 8192 MGMT_STATUS_NOT_SUPPORTED); 8193 8194 hci_dev_lock(hdev); 8195 8196 if (cp->config) 8197 changed = !hci_dev_test_and_set_flag(hdev, HCI_EXT_CONFIGURED); 8198 else 8199 changed = hci_dev_test_and_clear_flag(hdev, HCI_EXT_CONFIGURED); 8200 8201 err = send_options_rsp(sk, MGMT_OP_SET_EXTERNAL_CONFIG, hdev); 8202 if (err < 0) 8203 goto unlock; 8204 8205 if (!changed) 8206 goto unlock; 8207 8208 err = new_options(hdev, sk); 8209 8210 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED) == is_configured(hdev)) { 8211 mgmt_index_removed(hdev); 8212 8213 if (hci_dev_test_and_change_flag(hdev, HCI_UNCONFIGURED)) { 8214 hci_dev_set_flag(hdev, HCI_CONFIG); 8215 hci_dev_set_flag(hdev, HCI_AUTO_OFF); 8216 8217 queue_work(hdev->req_workqueue, &hdev->power_on); 8218 } else { 8219 set_bit(HCI_RAW, &hdev->flags); 8220 mgmt_index_added(hdev); 8221 } 8222 } 8223 8224 unlock: 8225 hci_dev_unlock(hdev); 8226 return err; 8227 } 8228 8229 static int set_public_address(struct sock *sk, struct hci_dev *hdev, 8230 void *data, u16 len) 8231 { 8232 struct mgmt_cp_set_public_address *cp = data; 8233 bool changed; 8234 int err; 8235 8236 bt_dev_dbg(hdev, "sock %p", sk); 8237 8238 if (hdev_is_powered(hdev)) 8239 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PUBLIC_ADDRESS, 8240 MGMT_STATUS_REJECTED); 8241 8242 if (!bacmp(&cp->bdaddr, BDADDR_ANY)) 8243 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PUBLIC_ADDRESS, 8244 MGMT_STATUS_INVALID_PARAMS); 8245 8246 if (!hdev->set_bdaddr) 8247 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PUBLIC_ADDRESS, 8248 MGMT_STATUS_NOT_SUPPORTED); 8249 8250 hci_dev_lock(hdev); 8251 8252 changed = !!bacmp(&hdev->public_addr, &cp->bdaddr); 8253 bacpy(&hdev->public_addr, &cp->bdaddr); 8254 8255 err = send_options_rsp(sk, MGMT_OP_SET_PUBLIC_ADDRESS, hdev); 8256 if (err < 0) 8257 goto unlock; 8258 8259 if (!changed) 8260 goto unlock; 8261 8262 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) 8263 err = new_options(hdev, sk); 8264 8265 if (is_configured(hdev)) { 8266 mgmt_index_removed(hdev); 8267 8268 hci_dev_clear_flag(hdev, HCI_UNCONFIGURED); 8269 8270 hci_dev_set_flag(hdev, HCI_CONFIG); 8271 hci_dev_set_flag(hdev, HCI_AUTO_OFF); 8272 8273 queue_work(hdev->req_workqueue, &hdev->power_on); 8274 } 8275 8276 unlock: 8277 hci_dev_unlock(hdev); 8278 return err; 8279 } 8280 8281 static void read_local_oob_ext_data_complete(struct hci_dev *hdev, void *data, 8282 int err) 8283 { 8284 const struct mgmt_cp_read_local_oob_ext_data *mgmt_cp; 8285 struct mgmt_rp_read_local_oob_ext_data *mgmt_rp; 8286 u8 *h192, *r192, *h256, *r256; 8287 struct mgmt_pending_cmd *cmd = data; 8288 struct sk_buff *skb = cmd->skb; 8289 u8 status = mgmt_status(err); 8290 u16 eir_len; 8291 8292 if (!status) { 8293 if (!skb) 8294 status = MGMT_STATUS_FAILED; 8295 else if (IS_ERR(skb)) 8296 status = mgmt_status(PTR_ERR(skb)); 8297 else 8298 status = mgmt_status(skb->data[0]); 8299 } 8300 8301 bt_dev_dbg(hdev, "status %u", status); 8302 8303 mgmt_cp = cmd->param; 8304 8305 if (status) { 8306 status = mgmt_status(status); 8307 eir_len = 0; 8308 8309 h192 = NULL; 8310 r192 = NULL; 8311 h256 = NULL; 8312 r256 = NULL; 8313 } else if (!bredr_sc_enabled(hdev)) { 8314 struct hci_rp_read_local_oob_data *rp; 8315 8316 if (skb->len != sizeof(*rp)) { 8317 status = MGMT_STATUS_FAILED; 8318 eir_len = 0; 8319 } else { 8320 status = MGMT_STATUS_SUCCESS; 8321 rp = (void *)skb->data; 8322 8323 eir_len = 5 + 18 + 18; 8324 h192 = rp->hash; 8325 r192 = rp->rand; 8326 h256 = NULL; 8327 r256 = NULL; 8328 } 8329 } else { 8330 struct hci_rp_read_local_oob_ext_data *rp; 8331 8332 if (skb->len != sizeof(*rp)) { 8333 status = MGMT_STATUS_FAILED; 8334 eir_len = 0; 8335 } else { 8336 status = MGMT_STATUS_SUCCESS; 8337 rp = (void *)skb->data; 8338 8339 if (hci_dev_test_flag(hdev, HCI_SC_ONLY)) { 8340 eir_len = 5 + 18 + 18; 8341 h192 = NULL; 8342 r192 = NULL; 8343 } else { 8344 eir_len = 5 + 18 + 18 + 18 + 18; 8345 h192 = rp->hash192; 8346 r192 = rp->rand192; 8347 } 8348 8349 h256 = rp->hash256; 8350 r256 = rp->rand256; 8351 } 8352 } 8353 8354 mgmt_rp = kmalloc(sizeof(*mgmt_rp) + eir_len, GFP_KERNEL); 8355 if (!mgmt_rp) 8356 goto done; 8357 8358 if (eir_len == 0) 8359 goto send_rsp; 8360 8361 eir_len = eir_append_data(mgmt_rp->eir, 0, EIR_CLASS_OF_DEV, 8362 hdev->dev_class, 3); 8363 8364 if (h192 && r192) { 8365 eir_len = eir_append_data(mgmt_rp->eir, eir_len, 8366 EIR_SSP_HASH_C192, h192, 16); 8367 eir_len = eir_append_data(mgmt_rp->eir, eir_len, 8368 EIR_SSP_RAND_R192, r192, 16); 8369 } 8370 8371 if (h256 && r256) { 8372 eir_len = eir_append_data(mgmt_rp->eir, eir_len, 8373 EIR_SSP_HASH_C256, h256, 16); 8374 eir_len = eir_append_data(mgmt_rp->eir, eir_len, 8375 EIR_SSP_RAND_R256, r256, 16); 8376 } 8377 8378 send_rsp: 8379 mgmt_rp->type = mgmt_cp->type; 8380 mgmt_rp->eir_len = cpu_to_le16(eir_len); 8381 8382 err = mgmt_cmd_complete(cmd->sk, hdev->id, 8383 MGMT_OP_READ_LOCAL_OOB_EXT_DATA, status, 8384 mgmt_rp, sizeof(*mgmt_rp) + eir_len); 8385 if (err < 0 || status) 8386 goto done; 8387 8388 hci_sock_set_flag(cmd->sk, HCI_MGMT_OOB_DATA_EVENTS); 8389 8390 err = mgmt_limited_event(MGMT_EV_LOCAL_OOB_DATA_UPDATED, hdev, 8391 mgmt_rp, sizeof(*mgmt_rp) + eir_len, 8392 HCI_MGMT_OOB_DATA_EVENTS, cmd->sk); 8393 done: 8394 if (skb && !IS_ERR(skb)) 8395 kfree_skb(skb); 8396 8397 kfree(mgmt_rp); 8398 mgmt_pending_free(cmd); 8399 } 8400 8401 static int read_local_ssp_oob_req(struct hci_dev *hdev, struct sock *sk, 8402 struct mgmt_cp_read_local_oob_ext_data *cp) 8403 { 8404 struct mgmt_pending_cmd *cmd; 8405 int err; 8406 8407 cmd = mgmt_pending_new(sk, MGMT_OP_READ_LOCAL_OOB_EXT_DATA, hdev, 8408 cp, sizeof(*cp)); 8409 if (!cmd) 8410 return -ENOMEM; 8411 8412 err = hci_cmd_sync_queue(hdev, read_local_oob_data_sync, cmd, 8413 read_local_oob_ext_data_complete); 8414 8415 if (err < 0) { 8416 mgmt_pending_remove(cmd); 8417 return err; 8418 } 8419 8420 return 0; 8421 } 8422 8423 static int read_local_oob_ext_data(struct sock *sk, struct hci_dev *hdev, 8424 void *data, u16 data_len) 8425 { 8426 struct mgmt_cp_read_local_oob_ext_data *cp = data; 8427 struct mgmt_rp_read_local_oob_ext_data *rp; 8428 size_t rp_len; 8429 u16 eir_len; 8430 u8 status, flags, role, addr[7], hash[16], rand[16]; 8431 int err; 8432 8433 bt_dev_dbg(hdev, "sock %p", sk); 8434 8435 if (hdev_is_powered(hdev)) { 8436 switch (cp->type) { 8437 case BIT(BDADDR_BREDR): 8438 status = mgmt_bredr_support(hdev); 8439 if (status) 8440 eir_len = 0; 8441 else 8442 eir_len = 5; 8443 break; 8444 case (BIT(BDADDR_LE_PUBLIC) | BIT(BDADDR_LE_RANDOM)): 8445 status = mgmt_le_support(hdev); 8446 if (status) 8447 eir_len = 0; 8448 else 8449 eir_len = 9 + 3 + 18 + 18 + 3; 8450 break; 8451 default: 8452 status = MGMT_STATUS_INVALID_PARAMS; 8453 eir_len = 0; 8454 break; 8455 } 8456 } else { 8457 status = MGMT_STATUS_NOT_POWERED; 8458 eir_len = 0; 8459 } 8460 8461 rp_len = sizeof(*rp) + eir_len; 8462 rp = kmalloc(rp_len, GFP_ATOMIC); 8463 if (!rp) 8464 return -ENOMEM; 8465 8466 if (!status && !lmp_ssp_capable(hdev)) { 8467 status = MGMT_STATUS_NOT_SUPPORTED; 8468 eir_len = 0; 8469 } 8470 8471 if (status) 8472 goto complete; 8473 8474 hci_dev_lock(hdev); 8475 8476 eir_len = 0; 8477 switch (cp->type) { 8478 case BIT(BDADDR_BREDR): 8479 if (hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) { 8480 err = read_local_ssp_oob_req(hdev, sk, cp); 8481 hci_dev_unlock(hdev); 8482 if (!err) 8483 goto done; 8484 8485 status = MGMT_STATUS_FAILED; 8486 goto complete; 8487 } else { 8488 eir_len = eir_append_data(rp->eir, eir_len, 8489 EIR_CLASS_OF_DEV, 8490 hdev->dev_class, 3); 8491 } 8492 break; 8493 case (BIT(BDADDR_LE_PUBLIC) | BIT(BDADDR_LE_RANDOM)): 8494 if (hci_dev_test_flag(hdev, HCI_SC_ENABLED) && 8495 smp_generate_oob(hdev, hash, rand) < 0) { 8496 hci_dev_unlock(hdev); 8497 status = MGMT_STATUS_FAILED; 8498 goto complete; 8499 } 8500 8501 /* This should return the active RPA, but since the RPA 8502 * is only programmed on demand, it is really hard to fill 8503 * this in at the moment. For now disallow retrieving 8504 * local out-of-band data when privacy is in use. 8505 * 8506 * Returning the identity address will not help here since 8507 * pairing happens before the identity resolving key is 8508 * known and thus the connection establishment happens 8509 * based on the RPA and not the identity address. 8510 */ 8511 if (hci_dev_test_flag(hdev, HCI_PRIVACY)) { 8512 hci_dev_unlock(hdev); 8513 status = MGMT_STATUS_REJECTED; 8514 goto complete; 8515 } 8516 8517 if (hci_dev_test_flag(hdev, HCI_FORCE_STATIC_ADDR) || 8518 !bacmp(&hdev->bdaddr, BDADDR_ANY) || 8519 (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) && 8520 bacmp(&hdev->static_addr, BDADDR_ANY))) { 8521 memcpy(addr, &hdev->static_addr, 6); 8522 addr[6] = 0x01; 8523 } else { 8524 memcpy(addr, &hdev->bdaddr, 6); 8525 addr[6] = 0x00; 8526 } 8527 8528 eir_len = eir_append_data(rp->eir, eir_len, EIR_LE_BDADDR, 8529 addr, sizeof(addr)); 8530 8531 if (hci_dev_test_flag(hdev, HCI_ADVERTISING)) 8532 role = 0x02; 8533 else 8534 role = 0x01; 8535 8536 eir_len = eir_append_data(rp->eir, eir_len, EIR_LE_ROLE, 8537 &role, sizeof(role)); 8538 8539 if (hci_dev_test_flag(hdev, HCI_SC_ENABLED)) { 8540 eir_len = eir_append_data(rp->eir, eir_len, 8541 EIR_LE_SC_CONFIRM, 8542 hash, sizeof(hash)); 8543 8544 eir_len = eir_append_data(rp->eir, eir_len, 8545 EIR_LE_SC_RANDOM, 8546 rand, sizeof(rand)); 8547 } 8548 8549 flags = mgmt_get_adv_discov_flags(hdev); 8550 8551 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) 8552 flags |= LE_AD_NO_BREDR; 8553 8554 eir_len = eir_append_data(rp->eir, eir_len, EIR_FLAGS, 8555 &flags, sizeof(flags)); 8556 break; 8557 } 8558 8559 hci_dev_unlock(hdev); 8560 8561 hci_sock_set_flag(sk, HCI_MGMT_OOB_DATA_EVENTS); 8562 8563 status = MGMT_STATUS_SUCCESS; 8564 8565 complete: 8566 rp->type = cp->type; 8567 rp->eir_len = cpu_to_le16(eir_len); 8568 8569 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_EXT_DATA, 8570 status, rp, sizeof(*rp) + eir_len); 8571 if (err < 0 || status) 8572 goto done; 8573 8574 err = mgmt_limited_event(MGMT_EV_LOCAL_OOB_DATA_UPDATED, hdev, 8575 rp, sizeof(*rp) + eir_len, 8576 HCI_MGMT_OOB_DATA_EVENTS, sk); 8577 8578 done: 8579 kfree(rp); 8580 8581 return err; 8582 } 8583 8584 static u32 get_supported_adv_flags(struct hci_dev *hdev) 8585 { 8586 u32 flags = 0; 8587 8588 flags |= MGMT_ADV_FLAG_CONNECTABLE; 8589 flags |= MGMT_ADV_FLAG_DISCOV; 8590 flags |= MGMT_ADV_FLAG_LIMITED_DISCOV; 8591 flags |= MGMT_ADV_FLAG_MANAGED_FLAGS; 8592 flags |= MGMT_ADV_FLAG_APPEARANCE; 8593 flags |= MGMT_ADV_FLAG_LOCAL_NAME; 8594 flags |= MGMT_ADV_PARAM_DURATION; 8595 flags |= MGMT_ADV_PARAM_TIMEOUT; 8596 flags |= MGMT_ADV_PARAM_INTERVALS; 8597 flags |= MGMT_ADV_PARAM_TX_POWER; 8598 flags |= MGMT_ADV_PARAM_SCAN_RSP; 8599 8600 /* In extended adv TX_POWER returned from Set Adv Param 8601 * will be always valid. 8602 */ 8603 if (hdev->adv_tx_power != HCI_TX_POWER_INVALID || ext_adv_capable(hdev)) 8604 flags |= MGMT_ADV_FLAG_TX_POWER; 8605 8606 if (ext_adv_capable(hdev)) { 8607 flags |= MGMT_ADV_FLAG_SEC_1M; 8608 flags |= MGMT_ADV_FLAG_HW_OFFLOAD; 8609 flags |= MGMT_ADV_FLAG_CAN_SET_TX_POWER; 8610 8611 if (le_2m_capable(hdev)) 8612 flags |= MGMT_ADV_FLAG_SEC_2M; 8613 8614 if (le_coded_capable(hdev)) 8615 flags |= MGMT_ADV_FLAG_SEC_CODED; 8616 } 8617 8618 return flags; 8619 } 8620 8621 static int read_adv_features(struct sock *sk, struct hci_dev *hdev, 8622 void *data, u16 data_len) 8623 { 8624 struct mgmt_rp_read_adv_features *rp; 8625 size_t rp_len; 8626 int err; 8627 struct adv_info *adv_instance; 8628 u32 supported_flags; 8629 u8 *instance; 8630 8631 bt_dev_dbg(hdev, "sock %p", sk); 8632 8633 if (!lmp_le_capable(hdev)) 8634 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_ADV_FEATURES, 8635 MGMT_STATUS_REJECTED); 8636 8637 hci_dev_lock(hdev); 8638 8639 rp_len = sizeof(*rp) + hdev->adv_instance_cnt; 8640 rp = kmalloc(rp_len, GFP_ATOMIC); 8641 if (!rp) { 8642 hci_dev_unlock(hdev); 8643 return -ENOMEM; 8644 } 8645 8646 supported_flags = get_supported_adv_flags(hdev); 8647 8648 rp->supported_flags = cpu_to_le32(supported_flags); 8649 rp->max_adv_data_len = max_adv_len(hdev); 8650 rp->max_scan_rsp_len = max_adv_len(hdev); 8651 rp->max_instances = hdev->le_num_of_adv_sets; 8652 rp->num_instances = hdev->adv_instance_cnt; 8653 8654 instance = rp->instance; 8655 list_for_each_entry(adv_instance, &hdev->adv_instances, list) { 8656 /* Only instances 1-le_num_of_adv_sets are externally visible */ 8657 if (adv_instance->instance <= hdev->adv_instance_cnt) { 8658 *instance = adv_instance->instance; 8659 instance++; 8660 } else { 8661 rp->num_instances--; 8662 rp_len--; 8663 } 8664 } 8665 8666 hci_dev_unlock(hdev); 8667 8668 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_ADV_FEATURES, 8669 MGMT_STATUS_SUCCESS, rp, rp_len); 8670 8671 kfree(rp); 8672 8673 return err; 8674 } 8675 8676 static u8 calculate_name_len(struct hci_dev *hdev) 8677 { 8678 u8 buf[HCI_MAX_SHORT_NAME_LENGTH + 2]; /* len + type + name */ 8679 8680 return eir_append_local_name(hdev, buf, 0); 8681 } 8682 8683 static u8 tlv_data_max_len(struct hci_dev *hdev, u32 adv_flags, 8684 bool is_adv_data) 8685 { 8686 u8 max_len = max_adv_len(hdev); 8687 8688 if (is_adv_data) { 8689 if (adv_flags & (MGMT_ADV_FLAG_DISCOV | 8690 MGMT_ADV_FLAG_LIMITED_DISCOV | 8691 MGMT_ADV_FLAG_MANAGED_FLAGS)) 8692 max_len -= 3; 8693 8694 if (adv_flags & MGMT_ADV_FLAG_TX_POWER) 8695 max_len -= 3; 8696 } else { 8697 if (adv_flags & MGMT_ADV_FLAG_LOCAL_NAME) 8698 max_len -= calculate_name_len(hdev); 8699 8700 if (adv_flags & (MGMT_ADV_FLAG_APPEARANCE)) 8701 max_len -= 4; 8702 } 8703 8704 return max_len; 8705 } 8706 8707 static bool flags_managed(u32 adv_flags) 8708 { 8709 return adv_flags & (MGMT_ADV_FLAG_DISCOV | 8710 MGMT_ADV_FLAG_LIMITED_DISCOV | 8711 MGMT_ADV_FLAG_MANAGED_FLAGS); 8712 } 8713 8714 static bool tx_power_managed(u32 adv_flags) 8715 { 8716 return adv_flags & MGMT_ADV_FLAG_TX_POWER; 8717 } 8718 8719 static bool name_managed(u32 adv_flags) 8720 { 8721 return adv_flags & MGMT_ADV_FLAG_LOCAL_NAME; 8722 } 8723 8724 static bool appearance_managed(u32 adv_flags) 8725 { 8726 return adv_flags & MGMT_ADV_FLAG_APPEARANCE; 8727 } 8728 8729 static bool tlv_data_is_valid(struct hci_dev *hdev, u32 adv_flags, u8 *data, 8730 u8 len, bool is_adv_data) 8731 { 8732 int i, cur_len; 8733 u8 max_len; 8734 8735 max_len = tlv_data_max_len(hdev, adv_flags, is_adv_data); 8736 8737 if (len > max_len) 8738 return false; 8739 8740 /* Make sure that the data is correctly formatted. */ 8741 for (i = 0; i < len; i += (cur_len + 1)) { 8742 cur_len = data[i]; 8743 8744 if (!cur_len) 8745 continue; 8746 8747 /* If the current field length would exceed the total data 8748 * length, then it's invalid. 8749 */ 8750 if (i + cur_len >= len) 8751 return false; 8752 8753 if (data[i + 1] == EIR_FLAGS && 8754 (!is_adv_data || flags_managed(adv_flags))) 8755 return false; 8756 8757 if (data[i + 1] == EIR_TX_POWER && tx_power_managed(adv_flags)) 8758 return false; 8759 8760 if (data[i + 1] == EIR_NAME_COMPLETE && name_managed(adv_flags)) 8761 return false; 8762 8763 if (data[i + 1] == EIR_NAME_SHORT && name_managed(adv_flags)) 8764 return false; 8765 8766 if (data[i + 1] == EIR_APPEARANCE && 8767 appearance_managed(adv_flags)) 8768 return false; 8769 } 8770 8771 return true; 8772 } 8773 8774 static bool requested_adv_flags_are_valid(struct hci_dev *hdev, u32 adv_flags) 8775 { 8776 u32 supported_flags, phy_flags; 8777 8778 /* The current implementation only supports a subset of the specified 8779 * flags. Also need to check mutual exclusiveness of sec flags. 8780 */ 8781 supported_flags = get_supported_adv_flags(hdev); 8782 phy_flags = adv_flags & MGMT_ADV_FLAG_SEC_MASK; 8783 if (adv_flags & ~supported_flags || 8784 ((phy_flags && (phy_flags ^ (phy_flags & -phy_flags))))) 8785 return false; 8786 8787 return true; 8788 } 8789 8790 static bool adv_busy(struct hci_dev *hdev) 8791 { 8792 return pending_find(MGMT_OP_SET_LE, hdev); 8793 } 8794 8795 static void add_adv_complete(struct hci_dev *hdev, struct sock *sk, u8 instance, 8796 int err) 8797 { 8798 struct adv_info *adv, *n; 8799 8800 bt_dev_dbg(hdev, "err %d", err); 8801 8802 hci_dev_lock(hdev); 8803 8804 list_for_each_entry_safe(adv, n, &hdev->adv_instances, list) { 8805 u8 instance; 8806 8807 if (!adv->pending) 8808 continue; 8809 8810 if (!err) { 8811 adv->pending = false; 8812 continue; 8813 } 8814 8815 instance = adv->instance; 8816 8817 if (hdev->cur_adv_instance == instance) 8818 cancel_adv_timeout(hdev); 8819 8820 hci_remove_adv_instance(hdev, instance); 8821 mgmt_advertising_removed(sk, hdev, instance); 8822 } 8823 8824 hci_dev_unlock(hdev); 8825 } 8826 8827 static void add_advertising_complete(struct hci_dev *hdev, void *data, int err) 8828 { 8829 struct mgmt_pending_cmd *cmd = data; 8830 struct mgmt_cp_add_advertising *cp = cmd->param; 8831 struct mgmt_rp_add_advertising rp; 8832 8833 memset(&rp, 0, sizeof(rp)); 8834 8835 rp.instance = cp->instance; 8836 8837 if (err) 8838 mgmt_cmd_status(cmd->sk, cmd->hdev->id, cmd->opcode, 8839 mgmt_status(err)); 8840 else 8841 mgmt_cmd_complete(cmd->sk, cmd->hdev->id, cmd->opcode, 8842 mgmt_status(err), &rp, sizeof(rp)); 8843 8844 add_adv_complete(hdev, cmd->sk, cp->instance, err); 8845 8846 mgmt_pending_free(cmd); 8847 } 8848 8849 static int add_advertising_sync(struct hci_dev *hdev, void *data) 8850 { 8851 struct mgmt_pending_cmd *cmd = data; 8852 struct mgmt_cp_add_advertising *cp = cmd->param; 8853 8854 return hci_schedule_adv_instance_sync(hdev, cp->instance, true); 8855 } 8856 8857 static int add_advertising(struct sock *sk, struct hci_dev *hdev, 8858 void *data, u16 data_len) 8859 { 8860 struct mgmt_cp_add_advertising *cp = data; 8861 struct mgmt_rp_add_advertising rp; 8862 u32 flags; 8863 u8 status; 8864 u16 timeout, duration; 8865 unsigned int prev_instance_cnt; 8866 u8 schedule_instance = 0; 8867 struct adv_info *adv, *next_instance; 8868 int err; 8869 struct mgmt_pending_cmd *cmd; 8870 8871 bt_dev_dbg(hdev, "sock %p", sk); 8872 8873 status = mgmt_le_support(hdev); 8874 if (status) 8875 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING, 8876 status); 8877 8878 if (cp->instance < 1 || cp->instance > hdev->le_num_of_adv_sets) 8879 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING, 8880 MGMT_STATUS_INVALID_PARAMS); 8881 8882 if (data_len != sizeof(*cp) + cp->adv_data_len + cp->scan_rsp_len) 8883 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING, 8884 MGMT_STATUS_INVALID_PARAMS); 8885 8886 flags = __le32_to_cpu(cp->flags); 8887 timeout = __le16_to_cpu(cp->timeout); 8888 duration = __le16_to_cpu(cp->duration); 8889 8890 if (!requested_adv_flags_are_valid(hdev, flags)) 8891 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING, 8892 MGMT_STATUS_INVALID_PARAMS); 8893 8894 hci_dev_lock(hdev); 8895 8896 if (timeout && !hdev_is_powered(hdev)) { 8897 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING, 8898 MGMT_STATUS_REJECTED); 8899 goto unlock; 8900 } 8901 8902 if (adv_busy(hdev)) { 8903 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING, 8904 MGMT_STATUS_BUSY); 8905 goto unlock; 8906 } 8907 8908 if (!tlv_data_is_valid(hdev, flags, cp->data, cp->adv_data_len, true) || 8909 !tlv_data_is_valid(hdev, flags, cp->data + cp->adv_data_len, 8910 cp->scan_rsp_len, false)) { 8911 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING, 8912 MGMT_STATUS_INVALID_PARAMS); 8913 goto unlock; 8914 } 8915 8916 prev_instance_cnt = hdev->adv_instance_cnt; 8917 8918 adv = hci_add_adv_instance(hdev, cp->instance, flags, 8919 cp->adv_data_len, cp->data, 8920 cp->scan_rsp_len, 8921 cp->data + cp->adv_data_len, 8922 timeout, duration, 8923 HCI_ADV_TX_POWER_NO_PREFERENCE, 8924 hdev->le_adv_min_interval, 8925 hdev->le_adv_max_interval, 0); 8926 if (IS_ERR(adv)) { 8927 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING, 8928 MGMT_STATUS_FAILED); 8929 goto unlock; 8930 } 8931 8932 /* Only trigger an advertising added event if a new instance was 8933 * actually added. 8934 */ 8935 if (hdev->adv_instance_cnt > prev_instance_cnt) 8936 mgmt_advertising_added(sk, hdev, cp->instance); 8937 8938 if (hdev->cur_adv_instance == cp->instance) { 8939 /* If the currently advertised instance is being changed then 8940 * cancel the current advertising and schedule the next 8941 * instance. If there is only one instance then the overridden 8942 * advertising data will be visible right away. 8943 */ 8944 cancel_adv_timeout(hdev); 8945 8946 next_instance = hci_get_next_instance(hdev, cp->instance); 8947 if (next_instance) 8948 schedule_instance = next_instance->instance; 8949 } else if (!hdev->adv_instance_timeout) { 8950 /* Immediately advertise the new instance if no other 8951 * instance is currently being advertised. 8952 */ 8953 schedule_instance = cp->instance; 8954 } 8955 8956 /* If the HCI_ADVERTISING flag is set or the device isn't powered or 8957 * there is no instance to be advertised then we have no HCI 8958 * communication to make. Simply return. 8959 */ 8960 if (!hdev_is_powered(hdev) || 8961 hci_dev_test_flag(hdev, HCI_ADVERTISING) || 8962 !schedule_instance) { 8963 rp.instance = cp->instance; 8964 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_ADVERTISING, 8965 MGMT_STATUS_SUCCESS, &rp, sizeof(rp)); 8966 goto unlock; 8967 } 8968 8969 /* We're good to go, update advertising data, parameters, and start 8970 * advertising. 8971 */ 8972 cmd = mgmt_pending_new(sk, MGMT_OP_ADD_ADVERTISING, hdev, data, 8973 data_len); 8974 if (!cmd) { 8975 err = -ENOMEM; 8976 goto unlock; 8977 } 8978 8979 cp->instance = schedule_instance; 8980 8981 err = hci_cmd_sync_queue(hdev, add_advertising_sync, cmd, 8982 add_advertising_complete); 8983 if (err < 0) 8984 mgmt_pending_free(cmd); 8985 8986 unlock: 8987 hci_dev_unlock(hdev); 8988 8989 return err; 8990 } 8991 8992 static void add_ext_adv_params_complete(struct hci_dev *hdev, void *data, 8993 int err) 8994 { 8995 struct mgmt_pending_cmd *cmd = data; 8996 struct mgmt_cp_add_ext_adv_params *cp = cmd->param; 8997 struct mgmt_rp_add_ext_adv_params rp; 8998 struct adv_info *adv; 8999 u32 flags; 9000 9001 BT_DBG("%s", hdev->name); 9002 9003 hci_dev_lock(hdev); 9004 9005 adv = hci_find_adv_instance(hdev, cp->instance); 9006 if (!adv) 9007 goto unlock; 9008 9009 rp.instance = cp->instance; 9010 rp.tx_power = adv->tx_power; 9011 9012 /* While we're at it, inform userspace of the available space for this 9013 * advertisement, given the flags that will be used. 9014 */ 9015 flags = __le32_to_cpu(cp->flags); 9016 rp.max_adv_data_len = tlv_data_max_len(hdev, flags, true); 9017 rp.max_scan_rsp_len = tlv_data_max_len(hdev, flags, false); 9018 9019 if (err) { 9020 /* If this advertisement was previously advertising and we 9021 * failed to update it, we signal that it has been removed and 9022 * delete its structure 9023 */ 9024 if (!adv->pending) 9025 mgmt_advertising_removed(cmd->sk, hdev, cp->instance); 9026 9027 hci_remove_adv_instance(hdev, cp->instance); 9028 9029 mgmt_cmd_status(cmd->sk, cmd->hdev->id, cmd->opcode, 9030 mgmt_status(err)); 9031 } else { 9032 mgmt_cmd_complete(cmd->sk, cmd->hdev->id, cmd->opcode, 9033 mgmt_status(err), &rp, sizeof(rp)); 9034 } 9035 9036 unlock: 9037 mgmt_pending_free(cmd); 9038 9039 hci_dev_unlock(hdev); 9040 } 9041 9042 static int add_ext_adv_params_sync(struct hci_dev *hdev, void *data) 9043 { 9044 struct mgmt_pending_cmd *cmd = data; 9045 struct mgmt_cp_add_ext_adv_params *cp = cmd->param; 9046 9047 return hci_setup_ext_adv_instance_sync(hdev, cp->instance); 9048 } 9049 9050 static int add_ext_adv_params(struct sock *sk, struct hci_dev *hdev, 9051 void *data, u16 data_len) 9052 { 9053 struct mgmt_cp_add_ext_adv_params *cp = data; 9054 struct mgmt_rp_add_ext_adv_params rp; 9055 struct mgmt_pending_cmd *cmd = NULL; 9056 struct adv_info *adv; 9057 u32 flags, min_interval, max_interval; 9058 u16 timeout, duration; 9059 u8 status; 9060 s8 tx_power; 9061 int err; 9062 9063 BT_DBG("%s", hdev->name); 9064 9065 status = mgmt_le_support(hdev); 9066 if (status) 9067 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_PARAMS, 9068 status); 9069 9070 if (cp->instance < 1 || cp->instance > hdev->le_num_of_adv_sets) 9071 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_PARAMS, 9072 MGMT_STATUS_INVALID_PARAMS); 9073 9074 /* The purpose of breaking add_advertising into two separate MGMT calls 9075 * for params and data is to allow more parameters to be added to this 9076 * structure in the future. For this reason, we verify that we have the 9077 * bare minimum structure we know of when the interface was defined. Any 9078 * extra parameters we don't know about will be ignored in this request. 9079 */ 9080 if (data_len < MGMT_ADD_EXT_ADV_PARAMS_MIN_SIZE) 9081 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_PARAMS, 9082 MGMT_STATUS_INVALID_PARAMS); 9083 9084 flags = __le32_to_cpu(cp->flags); 9085 9086 if (!requested_adv_flags_are_valid(hdev, flags)) 9087 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_PARAMS, 9088 MGMT_STATUS_INVALID_PARAMS); 9089 9090 hci_dev_lock(hdev); 9091 9092 /* In new interface, we require that we are powered to register */ 9093 if (!hdev_is_powered(hdev)) { 9094 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_PARAMS, 9095 MGMT_STATUS_REJECTED); 9096 goto unlock; 9097 } 9098 9099 if (adv_busy(hdev)) { 9100 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_PARAMS, 9101 MGMT_STATUS_BUSY); 9102 goto unlock; 9103 } 9104 9105 /* Parse defined parameters from request, use defaults otherwise */ 9106 timeout = (flags & MGMT_ADV_PARAM_TIMEOUT) ? 9107 __le16_to_cpu(cp->timeout) : 0; 9108 9109 duration = (flags & MGMT_ADV_PARAM_DURATION) ? 9110 __le16_to_cpu(cp->duration) : 9111 hdev->def_multi_adv_rotation_duration; 9112 9113 min_interval = (flags & MGMT_ADV_PARAM_INTERVALS) ? 9114 __le32_to_cpu(cp->min_interval) : 9115 hdev->le_adv_min_interval; 9116 9117 max_interval = (flags & MGMT_ADV_PARAM_INTERVALS) ? 9118 __le32_to_cpu(cp->max_interval) : 9119 hdev->le_adv_max_interval; 9120 9121 tx_power = (flags & MGMT_ADV_PARAM_TX_POWER) ? 9122 cp->tx_power : 9123 HCI_ADV_TX_POWER_NO_PREFERENCE; 9124 9125 /* Create advertising instance with no advertising or response data */ 9126 adv = hci_add_adv_instance(hdev, cp->instance, flags, 0, NULL, 0, NULL, 9127 timeout, duration, tx_power, min_interval, 9128 max_interval, 0); 9129 9130 if (IS_ERR(adv)) { 9131 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_PARAMS, 9132 MGMT_STATUS_FAILED); 9133 goto unlock; 9134 } 9135 9136 /* Submit request for advertising params if ext adv available */ 9137 if (ext_adv_capable(hdev)) { 9138 cmd = mgmt_pending_new(sk, MGMT_OP_ADD_EXT_ADV_PARAMS, hdev, 9139 data, data_len); 9140 if (!cmd) { 9141 err = -ENOMEM; 9142 hci_remove_adv_instance(hdev, cp->instance); 9143 goto unlock; 9144 } 9145 9146 err = hci_cmd_sync_queue(hdev, add_ext_adv_params_sync, cmd, 9147 add_ext_adv_params_complete); 9148 if (err < 0) 9149 mgmt_pending_free(cmd); 9150 } else { 9151 rp.instance = cp->instance; 9152 rp.tx_power = HCI_ADV_TX_POWER_NO_PREFERENCE; 9153 rp.max_adv_data_len = tlv_data_max_len(hdev, flags, true); 9154 rp.max_scan_rsp_len = tlv_data_max_len(hdev, flags, false); 9155 err = mgmt_cmd_complete(sk, hdev->id, 9156 MGMT_OP_ADD_EXT_ADV_PARAMS, 9157 MGMT_STATUS_SUCCESS, &rp, sizeof(rp)); 9158 } 9159 9160 unlock: 9161 hci_dev_unlock(hdev); 9162 9163 return err; 9164 } 9165 9166 static void add_ext_adv_data_complete(struct hci_dev *hdev, void *data, int err) 9167 { 9168 struct mgmt_pending_cmd *cmd = data; 9169 struct mgmt_cp_add_ext_adv_data *cp = cmd->param; 9170 struct mgmt_rp_add_advertising rp; 9171 9172 add_adv_complete(hdev, cmd->sk, cp->instance, err); 9173 9174 memset(&rp, 0, sizeof(rp)); 9175 9176 rp.instance = cp->instance; 9177 9178 if (err) 9179 mgmt_cmd_status(cmd->sk, cmd->hdev->id, cmd->opcode, 9180 mgmt_status(err)); 9181 else 9182 mgmt_cmd_complete(cmd->sk, cmd->hdev->id, cmd->opcode, 9183 mgmt_status(err), &rp, sizeof(rp)); 9184 9185 mgmt_pending_free(cmd); 9186 } 9187 9188 static int add_ext_adv_data_sync(struct hci_dev *hdev, void *data) 9189 { 9190 struct mgmt_pending_cmd *cmd = data; 9191 struct mgmt_cp_add_ext_adv_data *cp = cmd->param; 9192 int err; 9193 9194 if (ext_adv_capable(hdev)) { 9195 err = hci_update_adv_data_sync(hdev, cp->instance); 9196 if (err) 9197 return err; 9198 9199 err = hci_update_scan_rsp_data_sync(hdev, cp->instance); 9200 if (err) 9201 return err; 9202 9203 return hci_enable_ext_advertising_sync(hdev, cp->instance); 9204 } 9205 9206 return hci_schedule_adv_instance_sync(hdev, cp->instance, true); 9207 } 9208 9209 static int add_ext_adv_data(struct sock *sk, struct hci_dev *hdev, void *data, 9210 u16 data_len) 9211 { 9212 struct mgmt_cp_add_ext_adv_data *cp = data; 9213 struct mgmt_rp_add_ext_adv_data rp; 9214 u8 schedule_instance = 0; 9215 struct adv_info *next_instance; 9216 struct adv_info *adv_instance; 9217 int err = 0; 9218 struct mgmt_pending_cmd *cmd; 9219 u16 expected_len; 9220 9221 BT_DBG("%s", hdev->name); 9222 9223 expected_len = struct_size(cp, data, cp->adv_data_len + 9224 cp->scan_rsp_len); 9225 if (expected_len > data_len) 9226 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_DATA, 9227 MGMT_STATUS_INVALID_PARAMS); 9228 9229 hci_dev_lock(hdev); 9230 9231 adv_instance = hci_find_adv_instance(hdev, cp->instance); 9232 9233 if (!adv_instance) { 9234 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_DATA, 9235 MGMT_STATUS_INVALID_PARAMS); 9236 goto unlock; 9237 } 9238 9239 /* In new interface, we require that we are powered to register */ 9240 if (!hdev_is_powered(hdev)) { 9241 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_DATA, 9242 MGMT_STATUS_REJECTED); 9243 goto clear_new_instance; 9244 } 9245 9246 if (adv_busy(hdev)) { 9247 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_DATA, 9248 MGMT_STATUS_BUSY); 9249 goto clear_new_instance; 9250 } 9251 9252 /* Validate new data */ 9253 if (!tlv_data_is_valid(hdev, adv_instance->flags, cp->data, 9254 cp->adv_data_len, true) || 9255 !tlv_data_is_valid(hdev, adv_instance->flags, cp->data + 9256 cp->adv_data_len, cp->scan_rsp_len, false)) { 9257 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_DATA, 9258 MGMT_STATUS_INVALID_PARAMS); 9259 goto clear_new_instance; 9260 } 9261 9262 /* Set the data in the advertising instance */ 9263 hci_set_adv_instance_data(hdev, cp->instance, cp->adv_data_len, 9264 cp->data, cp->scan_rsp_len, 9265 cp->data + cp->adv_data_len); 9266 9267 /* If using software rotation, determine next instance to use */ 9268 if (hdev->cur_adv_instance == cp->instance) { 9269 /* If the currently advertised instance is being changed 9270 * then cancel the current advertising and schedule the 9271 * next instance. If there is only one instance then the 9272 * overridden advertising data will be visible right 9273 * away 9274 */ 9275 cancel_adv_timeout(hdev); 9276 9277 next_instance = hci_get_next_instance(hdev, cp->instance); 9278 if (next_instance) 9279 schedule_instance = next_instance->instance; 9280 } else if (!hdev->adv_instance_timeout) { 9281 /* Immediately advertise the new instance if no other 9282 * instance is currently being advertised. 9283 */ 9284 schedule_instance = cp->instance; 9285 } 9286 9287 /* If the HCI_ADVERTISING flag is set or there is no instance to 9288 * be advertised then we have no HCI communication to make. 9289 * Simply return. 9290 */ 9291 if (hci_dev_test_flag(hdev, HCI_ADVERTISING) || !schedule_instance) { 9292 if (adv_instance->pending) { 9293 mgmt_advertising_added(sk, hdev, cp->instance); 9294 adv_instance->pending = false; 9295 } 9296 rp.instance = cp->instance; 9297 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_DATA, 9298 MGMT_STATUS_SUCCESS, &rp, sizeof(rp)); 9299 goto unlock; 9300 } 9301 9302 cmd = mgmt_pending_new(sk, MGMT_OP_ADD_EXT_ADV_DATA, hdev, data, 9303 data_len); 9304 if (!cmd) { 9305 err = -ENOMEM; 9306 goto clear_new_instance; 9307 } 9308 9309 err = hci_cmd_sync_queue(hdev, add_ext_adv_data_sync, cmd, 9310 add_ext_adv_data_complete); 9311 if (err < 0) { 9312 mgmt_pending_free(cmd); 9313 goto clear_new_instance; 9314 } 9315 9316 /* We were successful in updating data, so trigger advertising_added 9317 * event if this is an instance that wasn't previously advertising. If 9318 * a failure occurs in the requests we initiated, we will remove the 9319 * instance again in add_advertising_complete 9320 */ 9321 if (adv_instance->pending) 9322 mgmt_advertising_added(sk, hdev, cp->instance); 9323 9324 goto unlock; 9325 9326 clear_new_instance: 9327 hci_remove_adv_instance(hdev, cp->instance); 9328 9329 unlock: 9330 hci_dev_unlock(hdev); 9331 9332 return err; 9333 } 9334 9335 static void remove_advertising_complete(struct hci_dev *hdev, void *data, 9336 int err) 9337 { 9338 struct mgmt_pending_cmd *cmd = data; 9339 struct mgmt_cp_remove_advertising *cp = cmd->param; 9340 struct mgmt_rp_remove_advertising rp; 9341 9342 bt_dev_dbg(hdev, "err %d", err); 9343 9344 memset(&rp, 0, sizeof(rp)); 9345 rp.instance = cp->instance; 9346 9347 if (err) 9348 mgmt_cmd_status(cmd->sk, cmd->hdev->id, cmd->opcode, 9349 mgmt_status(err)); 9350 else 9351 mgmt_cmd_complete(cmd->sk, cmd->hdev->id, cmd->opcode, 9352 MGMT_STATUS_SUCCESS, &rp, sizeof(rp)); 9353 9354 mgmt_pending_free(cmd); 9355 } 9356 9357 static int remove_advertising_sync(struct hci_dev *hdev, void *data) 9358 { 9359 struct mgmt_pending_cmd *cmd = data; 9360 struct mgmt_cp_remove_advertising *cp = cmd->param; 9361 int err; 9362 9363 err = hci_remove_advertising_sync(hdev, cmd->sk, cp->instance, true); 9364 if (err) 9365 return err; 9366 9367 if (list_empty(&hdev->adv_instances)) 9368 err = hci_disable_advertising_sync(hdev); 9369 9370 return err; 9371 } 9372 9373 static int remove_advertising(struct sock *sk, struct hci_dev *hdev, 9374 void *data, u16 data_len) 9375 { 9376 struct mgmt_cp_remove_advertising *cp = data; 9377 struct mgmt_pending_cmd *cmd; 9378 int err; 9379 9380 bt_dev_dbg(hdev, "sock %p", sk); 9381 9382 hci_dev_lock(hdev); 9383 9384 if (cp->instance && !hci_find_adv_instance(hdev, cp->instance)) { 9385 err = mgmt_cmd_status(sk, hdev->id, 9386 MGMT_OP_REMOVE_ADVERTISING, 9387 MGMT_STATUS_INVALID_PARAMS); 9388 goto unlock; 9389 } 9390 9391 if (pending_find(MGMT_OP_SET_LE, hdev)) { 9392 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_ADVERTISING, 9393 MGMT_STATUS_BUSY); 9394 goto unlock; 9395 } 9396 9397 if (list_empty(&hdev->adv_instances)) { 9398 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_ADVERTISING, 9399 MGMT_STATUS_INVALID_PARAMS); 9400 goto unlock; 9401 } 9402 9403 cmd = mgmt_pending_new(sk, MGMT_OP_REMOVE_ADVERTISING, hdev, data, 9404 data_len); 9405 if (!cmd) { 9406 err = -ENOMEM; 9407 goto unlock; 9408 } 9409 9410 err = hci_cmd_sync_queue(hdev, remove_advertising_sync, cmd, 9411 remove_advertising_complete); 9412 if (err < 0) 9413 mgmt_pending_free(cmd); 9414 9415 unlock: 9416 hci_dev_unlock(hdev); 9417 9418 return err; 9419 } 9420 9421 static int get_adv_size_info(struct sock *sk, struct hci_dev *hdev, 9422 void *data, u16 data_len) 9423 { 9424 struct mgmt_cp_get_adv_size_info *cp = data; 9425 struct mgmt_rp_get_adv_size_info rp; 9426 u32 flags, supported_flags; 9427 9428 bt_dev_dbg(hdev, "sock %p", sk); 9429 9430 if (!lmp_le_capable(hdev)) 9431 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_ADV_SIZE_INFO, 9432 MGMT_STATUS_REJECTED); 9433 9434 if (cp->instance < 1 || cp->instance > hdev->le_num_of_adv_sets) 9435 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_ADV_SIZE_INFO, 9436 MGMT_STATUS_INVALID_PARAMS); 9437 9438 flags = __le32_to_cpu(cp->flags); 9439 9440 /* The current implementation only supports a subset of the specified 9441 * flags. 9442 */ 9443 supported_flags = get_supported_adv_flags(hdev); 9444 if (flags & ~supported_flags) 9445 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_ADV_SIZE_INFO, 9446 MGMT_STATUS_INVALID_PARAMS); 9447 9448 rp.instance = cp->instance; 9449 rp.flags = cp->flags; 9450 rp.max_adv_data_len = tlv_data_max_len(hdev, flags, true); 9451 rp.max_scan_rsp_len = tlv_data_max_len(hdev, flags, false); 9452 9453 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_ADV_SIZE_INFO, 9454 MGMT_STATUS_SUCCESS, &rp, sizeof(rp)); 9455 } 9456 9457 static const struct hci_mgmt_handler mgmt_handlers[] = { 9458 { NULL }, /* 0x0000 (no command) */ 9459 { read_version, MGMT_READ_VERSION_SIZE, 9460 HCI_MGMT_NO_HDEV | 9461 HCI_MGMT_UNTRUSTED }, 9462 { read_commands, MGMT_READ_COMMANDS_SIZE, 9463 HCI_MGMT_NO_HDEV | 9464 HCI_MGMT_UNTRUSTED }, 9465 { read_index_list, MGMT_READ_INDEX_LIST_SIZE, 9466 HCI_MGMT_NO_HDEV | 9467 HCI_MGMT_UNTRUSTED }, 9468 { read_controller_info, MGMT_READ_INFO_SIZE, 9469 HCI_MGMT_UNTRUSTED }, 9470 { set_powered, MGMT_SETTING_SIZE }, 9471 { set_discoverable, MGMT_SET_DISCOVERABLE_SIZE }, 9472 { set_connectable, MGMT_SETTING_SIZE }, 9473 { set_fast_connectable, MGMT_SETTING_SIZE }, 9474 { set_bondable, MGMT_SETTING_SIZE }, 9475 { set_link_security, MGMT_SETTING_SIZE }, 9476 { set_ssp, MGMT_SETTING_SIZE }, 9477 { set_hs, MGMT_SETTING_SIZE }, 9478 { set_le, MGMT_SETTING_SIZE }, 9479 { set_dev_class, MGMT_SET_DEV_CLASS_SIZE }, 9480 { set_local_name, MGMT_SET_LOCAL_NAME_SIZE }, 9481 { add_uuid, MGMT_ADD_UUID_SIZE }, 9482 { remove_uuid, MGMT_REMOVE_UUID_SIZE }, 9483 { load_link_keys, MGMT_LOAD_LINK_KEYS_SIZE, 9484 HCI_MGMT_VAR_LEN }, 9485 { load_long_term_keys, MGMT_LOAD_LONG_TERM_KEYS_SIZE, 9486 HCI_MGMT_VAR_LEN }, 9487 { disconnect, MGMT_DISCONNECT_SIZE }, 9488 { get_connections, MGMT_GET_CONNECTIONS_SIZE }, 9489 { pin_code_reply, MGMT_PIN_CODE_REPLY_SIZE }, 9490 { pin_code_neg_reply, MGMT_PIN_CODE_NEG_REPLY_SIZE }, 9491 { set_io_capability, MGMT_SET_IO_CAPABILITY_SIZE }, 9492 { pair_device, MGMT_PAIR_DEVICE_SIZE }, 9493 { cancel_pair_device, MGMT_CANCEL_PAIR_DEVICE_SIZE }, 9494 { unpair_device, MGMT_UNPAIR_DEVICE_SIZE }, 9495 { user_confirm_reply, MGMT_USER_CONFIRM_REPLY_SIZE }, 9496 { user_confirm_neg_reply, MGMT_USER_CONFIRM_NEG_REPLY_SIZE }, 9497 { user_passkey_reply, MGMT_USER_PASSKEY_REPLY_SIZE }, 9498 { user_passkey_neg_reply, MGMT_USER_PASSKEY_NEG_REPLY_SIZE }, 9499 { read_local_oob_data, MGMT_READ_LOCAL_OOB_DATA_SIZE }, 9500 { add_remote_oob_data, MGMT_ADD_REMOTE_OOB_DATA_SIZE, 9501 HCI_MGMT_VAR_LEN }, 9502 { remove_remote_oob_data, MGMT_REMOVE_REMOTE_OOB_DATA_SIZE }, 9503 { start_discovery, MGMT_START_DISCOVERY_SIZE }, 9504 { stop_discovery, MGMT_STOP_DISCOVERY_SIZE }, 9505 { confirm_name, MGMT_CONFIRM_NAME_SIZE }, 9506 { block_device, MGMT_BLOCK_DEVICE_SIZE }, 9507 { unblock_device, MGMT_UNBLOCK_DEVICE_SIZE }, 9508 { set_device_id, MGMT_SET_DEVICE_ID_SIZE }, 9509 { set_advertising, MGMT_SETTING_SIZE }, 9510 { set_bredr, MGMT_SETTING_SIZE }, 9511 { set_static_address, MGMT_SET_STATIC_ADDRESS_SIZE }, 9512 { set_scan_params, MGMT_SET_SCAN_PARAMS_SIZE }, 9513 { set_secure_conn, MGMT_SETTING_SIZE }, 9514 { set_debug_keys, MGMT_SETTING_SIZE }, 9515 { set_privacy, MGMT_SET_PRIVACY_SIZE }, 9516 { load_irks, MGMT_LOAD_IRKS_SIZE, 9517 HCI_MGMT_VAR_LEN }, 9518 { get_conn_info, MGMT_GET_CONN_INFO_SIZE }, 9519 { get_clock_info, MGMT_GET_CLOCK_INFO_SIZE }, 9520 { add_device, MGMT_ADD_DEVICE_SIZE }, 9521 { remove_device, MGMT_REMOVE_DEVICE_SIZE }, 9522 { load_conn_param, MGMT_LOAD_CONN_PARAM_SIZE, 9523 HCI_MGMT_VAR_LEN }, 9524 { read_unconf_index_list, MGMT_READ_UNCONF_INDEX_LIST_SIZE, 9525 HCI_MGMT_NO_HDEV | 9526 HCI_MGMT_UNTRUSTED }, 9527 { read_config_info, MGMT_READ_CONFIG_INFO_SIZE, 9528 HCI_MGMT_UNCONFIGURED | 9529 HCI_MGMT_UNTRUSTED }, 9530 { set_external_config, MGMT_SET_EXTERNAL_CONFIG_SIZE, 9531 HCI_MGMT_UNCONFIGURED }, 9532 { set_public_address, MGMT_SET_PUBLIC_ADDRESS_SIZE, 9533 HCI_MGMT_UNCONFIGURED }, 9534 { start_service_discovery, MGMT_START_SERVICE_DISCOVERY_SIZE, 9535 HCI_MGMT_VAR_LEN }, 9536 { read_local_oob_ext_data, MGMT_READ_LOCAL_OOB_EXT_DATA_SIZE }, 9537 { read_ext_index_list, MGMT_READ_EXT_INDEX_LIST_SIZE, 9538 HCI_MGMT_NO_HDEV | 9539 HCI_MGMT_UNTRUSTED }, 9540 { read_adv_features, MGMT_READ_ADV_FEATURES_SIZE }, 9541 { add_advertising, MGMT_ADD_ADVERTISING_SIZE, 9542 HCI_MGMT_VAR_LEN }, 9543 { remove_advertising, MGMT_REMOVE_ADVERTISING_SIZE }, 9544 { get_adv_size_info, MGMT_GET_ADV_SIZE_INFO_SIZE }, 9545 { start_limited_discovery, MGMT_START_DISCOVERY_SIZE }, 9546 { read_ext_controller_info,MGMT_READ_EXT_INFO_SIZE, 9547 HCI_MGMT_UNTRUSTED }, 9548 { set_appearance, MGMT_SET_APPEARANCE_SIZE }, 9549 { get_phy_configuration, MGMT_GET_PHY_CONFIGURATION_SIZE }, 9550 { set_phy_configuration, MGMT_SET_PHY_CONFIGURATION_SIZE }, 9551 { set_blocked_keys, MGMT_OP_SET_BLOCKED_KEYS_SIZE, 9552 HCI_MGMT_VAR_LEN }, 9553 { set_wideband_speech, MGMT_SETTING_SIZE }, 9554 { read_controller_cap, MGMT_READ_CONTROLLER_CAP_SIZE, 9555 HCI_MGMT_UNTRUSTED }, 9556 { read_exp_features_info, MGMT_READ_EXP_FEATURES_INFO_SIZE, 9557 HCI_MGMT_UNTRUSTED | 9558 HCI_MGMT_HDEV_OPTIONAL }, 9559 { set_exp_feature, MGMT_SET_EXP_FEATURE_SIZE, 9560 HCI_MGMT_VAR_LEN | 9561 HCI_MGMT_HDEV_OPTIONAL }, 9562 { read_def_system_config, MGMT_READ_DEF_SYSTEM_CONFIG_SIZE, 9563 HCI_MGMT_UNTRUSTED }, 9564 { set_def_system_config, MGMT_SET_DEF_SYSTEM_CONFIG_SIZE, 9565 HCI_MGMT_VAR_LEN }, 9566 { read_def_runtime_config, MGMT_READ_DEF_RUNTIME_CONFIG_SIZE, 9567 HCI_MGMT_UNTRUSTED }, 9568 { set_def_runtime_config, MGMT_SET_DEF_RUNTIME_CONFIG_SIZE, 9569 HCI_MGMT_VAR_LEN }, 9570 { get_device_flags, MGMT_GET_DEVICE_FLAGS_SIZE }, 9571 { set_device_flags, MGMT_SET_DEVICE_FLAGS_SIZE }, 9572 { read_adv_mon_features, MGMT_READ_ADV_MONITOR_FEATURES_SIZE }, 9573 { add_adv_patterns_monitor,MGMT_ADD_ADV_PATTERNS_MONITOR_SIZE, 9574 HCI_MGMT_VAR_LEN }, 9575 { remove_adv_monitor, MGMT_REMOVE_ADV_MONITOR_SIZE }, 9576 { add_ext_adv_params, MGMT_ADD_EXT_ADV_PARAMS_MIN_SIZE, 9577 HCI_MGMT_VAR_LEN }, 9578 { add_ext_adv_data, MGMT_ADD_EXT_ADV_DATA_SIZE, 9579 HCI_MGMT_VAR_LEN }, 9580 { add_adv_patterns_monitor_rssi, 9581 MGMT_ADD_ADV_PATTERNS_MONITOR_RSSI_SIZE, 9582 HCI_MGMT_VAR_LEN }, 9583 { set_mesh, MGMT_SET_MESH_RECEIVER_SIZE, 9584 HCI_MGMT_VAR_LEN }, 9585 { mesh_features, MGMT_MESH_READ_FEATURES_SIZE }, 9586 { mesh_send, MGMT_MESH_SEND_SIZE, 9587 HCI_MGMT_VAR_LEN }, 9588 { mesh_send_cancel, MGMT_MESH_SEND_CANCEL_SIZE }, 9589 { mgmt_hci_cmd_sync, MGMT_HCI_CMD_SYNC_SIZE, HCI_MGMT_VAR_LEN }, 9590 }; 9591 9592 void mgmt_index_added(struct hci_dev *hdev) 9593 { 9594 struct mgmt_ev_ext_index ev; 9595 9596 if (hci_test_quirk(hdev, HCI_QUIRK_RAW_DEVICE)) 9597 return; 9598 9599 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) { 9600 mgmt_index_event(MGMT_EV_UNCONF_INDEX_ADDED, hdev, NULL, 0, 9601 HCI_MGMT_UNCONF_INDEX_EVENTS); 9602 ev.type = 0x01; 9603 } else { 9604 mgmt_index_event(MGMT_EV_INDEX_ADDED, hdev, NULL, 0, 9605 HCI_MGMT_INDEX_EVENTS); 9606 ev.type = 0x00; 9607 } 9608 9609 ev.bus = hdev->bus; 9610 9611 mgmt_index_event(MGMT_EV_EXT_INDEX_ADDED, hdev, &ev, sizeof(ev), 9612 HCI_MGMT_EXT_INDEX_EVENTS); 9613 } 9614 9615 void mgmt_index_removed(struct hci_dev *hdev) 9616 { 9617 struct mgmt_ev_ext_index ev; 9618 struct cmd_lookup match = { NULL, hdev, MGMT_STATUS_INVALID_INDEX }; 9619 9620 if (hci_test_quirk(hdev, HCI_QUIRK_RAW_DEVICE)) 9621 return; 9622 9623 mgmt_pending_foreach(0, hdev, true, cmd_complete_rsp, &match); 9624 9625 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) { 9626 mgmt_index_event(MGMT_EV_UNCONF_INDEX_REMOVED, hdev, NULL, 0, 9627 HCI_MGMT_UNCONF_INDEX_EVENTS); 9628 ev.type = 0x01; 9629 } else { 9630 mgmt_index_event(MGMT_EV_INDEX_REMOVED, hdev, NULL, 0, 9631 HCI_MGMT_INDEX_EVENTS); 9632 ev.type = 0x00; 9633 } 9634 9635 ev.bus = hdev->bus; 9636 9637 mgmt_index_event(MGMT_EV_EXT_INDEX_REMOVED, hdev, &ev, sizeof(ev), 9638 HCI_MGMT_EXT_INDEX_EVENTS); 9639 9640 /* Cancel any remaining timed work */ 9641 if (!hci_dev_test_flag(hdev, HCI_MGMT)) 9642 return; 9643 cancel_delayed_work_sync(&hdev->discov_off); 9644 cancel_delayed_work_sync(&hdev->service_cache); 9645 cancel_delayed_work_sync(&hdev->rpa_expired); 9646 cancel_delayed_work_sync(&hdev->mesh_send_done); 9647 } 9648 9649 void mgmt_power_on(struct hci_dev *hdev, int err) 9650 { 9651 struct cmd_lookup match = { NULL, hdev }; 9652 9653 bt_dev_dbg(hdev, "err %d", err); 9654 9655 hci_dev_lock(hdev); 9656 9657 if (!err) { 9658 restart_le_actions(hdev); 9659 hci_update_passive_scan(hdev); 9660 } 9661 9662 mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, true, settings_rsp, 9663 &match); 9664 9665 new_settings(hdev, match.sk); 9666 9667 if (match.sk) 9668 sock_put(match.sk); 9669 9670 hci_dev_unlock(hdev); 9671 } 9672 9673 void __mgmt_power_off(struct hci_dev *hdev) 9674 { 9675 struct cmd_lookup match = { NULL, hdev }; 9676 u8 zero_cod[] = { 0, 0, 0 }; 9677 9678 mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, true, settings_rsp, 9679 &match); 9680 9681 /* If the power off is because of hdev unregistration let 9682 * use the appropriate INVALID_INDEX status. Otherwise use 9683 * NOT_POWERED. We cover both scenarios here since later in 9684 * mgmt_index_removed() any hci_conn callbacks will have already 9685 * been triggered, potentially causing misleading DISCONNECTED 9686 * status responses. 9687 */ 9688 if (hci_dev_test_flag(hdev, HCI_UNREGISTER)) 9689 match.mgmt_status = MGMT_STATUS_INVALID_INDEX; 9690 else 9691 match.mgmt_status = MGMT_STATUS_NOT_POWERED; 9692 9693 mgmt_pending_foreach(0, hdev, true, cmd_complete_rsp, &match); 9694 9695 if (memcmp(hdev->dev_class, zero_cod, sizeof(zero_cod)) != 0) { 9696 mgmt_limited_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev, 9697 zero_cod, sizeof(zero_cod), 9698 HCI_MGMT_DEV_CLASS_EVENTS, NULL); 9699 ext_info_changed(hdev, NULL); 9700 } 9701 9702 new_settings(hdev, match.sk); 9703 9704 if (match.sk) 9705 sock_put(match.sk); 9706 } 9707 9708 void mgmt_set_powered_failed(struct hci_dev *hdev, int err) 9709 { 9710 struct mgmt_pending_cmd *cmd; 9711 u8 status; 9712 9713 cmd = pending_find(MGMT_OP_SET_POWERED, hdev); 9714 if (!cmd) 9715 return; 9716 9717 if (err == -ERFKILL) 9718 status = MGMT_STATUS_RFKILLED; 9719 else 9720 status = MGMT_STATUS_FAILED; 9721 9722 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_POWERED, status); 9723 9724 mgmt_pending_remove(cmd); 9725 } 9726 9727 void mgmt_new_link_key(struct hci_dev *hdev, struct link_key *key, 9728 bool persistent) 9729 { 9730 struct mgmt_ev_new_link_key ev; 9731 9732 memset(&ev, 0, sizeof(ev)); 9733 9734 ev.store_hint = persistent; 9735 bacpy(&ev.key.addr.bdaddr, &key->bdaddr); 9736 ev.key.addr.type = BDADDR_BREDR; 9737 ev.key.type = key->type; 9738 memcpy(ev.key.val, key->val, HCI_LINK_KEY_SIZE); 9739 ev.key.pin_len = key->pin_len; 9740 9741 mgmt_event(MGMT_EV_NEW_LINK_KEY, hdev, &ev, sizeof(ev), NULL); 9742 } 9743 9744 static u8 mgmt_ltk_type(struct smp_ltk *ltk) 9745 { 9746 switch (ltk->type) { 9747 case SMP_LTK: 9748 case SMP_LTK_RESPONDER: 9749 if (ltk->authenticated) 9750 return MGMT_LTK_AUTHENTICATED; 9751 return MGMT_LTK_UNAUTHENTICATED; 9752 case SMP_LTK_P256: 9753 if (ltk->authenticated) 9754 return MGMT_LTK_P256_AUTH; 9755 return MGMT_LTK_P256_UNAUTH; 9756 case SMP_LTK_P256_DEBUG: 9757 return MGMT_LTK_P256_DEBUG; 9758 } 9759 9760 return MGMT_LTK_UNAUTHENTICATED; 9761 } 9762 9763 void mgmt_new_ltk(struct hci_dev *hdev, struct smp_ltk *key, bool persistent) 9764 { 9765 struct mgmt_ev_new_long_term_key ev; 9766 9767 memset(&ev, 0, sizeof(ev)); 9768 9769 /* Devices using resolvable or non-resolvable random addresses 9770 * without providing an identity resolving key don't require 9771 * to store long term keys. Their addresses will change the 9772 * next time around. 9773 * 9774 * Only when a remote device provides an identity address 9775 * make sure the long term key is stored. If the remote 9776 * identity is known, the long term keys are internally 9777 * mapped to the identity address. So allow static random 9778 * and public addresses here. 9779 */ 9780 if (key->bdaddr_type == ADDR_LE_DEV_RANDOM && 9781 (key->bdaddr.b[5] & 0xc0) != 0xc0) 9782 ev.store_hint = 0x00; 9783 else 9784 ev.store_hint = persistent; 9785 9786 bacpy(&ev.key.addr.bdaddr, &key->bdaddr); 9787 ev.key.addr.type = link_to_bdaddr(LE_LINK, key->bdaddr_type); 9788 ev.key.type = mgmt_ltk_type(key); 9789 ev.key.enc_size = key->enc_size; 9790 ev.key.ediv = key->ediv; 9791 ev.key.rand = key->rand; 9792 9793 if (key->type == SMP_LTK) 9794 ev.key.initiator = 1; 9795 9796 /* Make sure we copy only the significant bytes based on the 9797 * encryption key size, and set the rest of the value to zeroes. 9798 */ 9799 memcpy(ev.key.val, key->val, key->enc_size); 9800 memset(ev.key.val + key->enc_size, 0, 9801 sizeof(ev.key.val) - key->enc_size); 9802 9803 mgmt_event(MGMT_EV_NEW_LONG_TERM_KEY, hdev, &ev, sizeof(ev), NULL); 9804 } 9805 9806 void mgmt_new_irk(struct hci_dev *hdev, struct smp_irk *irk, bool persistent) 9807 { 9808 struct mgmt_ev_new_irk ev; 9809 9810 memset(&ev, 0, sizeof(ev)); 9811 9812 ev.store_hint = persistent; 9813 9814 bacpy(&ev.rpa, &irk->rpa); 9815 bacpy(&ev.irk.addr.bdaddr, &irk->bdaddr); 9816 ev.irk.addr.type = link_to_bdaddr(LE_LINK, irk->addr_type); 9817 memcpy(ev.irk.val, irk->val, sizeof(irk->val)); 9818 9819 mgmt_event(MGMT_EV_NEW_IRK, hdev, &ev, sizeof(ev), NULL); 9820 } 9821 9822 void mgmt_new_csrk(struct hci_dev *hdev, struct smp_csrk *csrk, 9823 bool persistent) 9824 { 9825 struct mgmt_ev_new_csrk ev; 9826 9827 memset(&ev, 0, sizeof(ev)); 9828 9829 /* Devices using resolvable or non-resolvable random addresses 9830 * without providing an identity resolving key don't require 9831 * to store signature resolving keys. Their addresses will change 9832 * the next time around. 9833 * 9834 * Only when a remote device provides an identity address 9835 * make sure the signature resolving key is stored. So allow 9836 * static random and public addresses here. 9837 */ 9838 if (csrk->bdaddr_type == ADDR_LE_DEV_RANDOM && 9839 (csrk->bdaddr.b[5] & 0xc0) != 0xc0) 9840 ev.store_hint = 0x00; 9841 else 9842 ev.store_hint = persistent; 9843 9844 bacpy(&ev.key.addr.bdaddr, &csrk->bdaddr); 9845 ev.key.addr.type = link_to_bdaddr(LE_LINK, csrk->bdaddr_type); 9846 ev.key.type = csrk->type; 9847 memcpy(ev.key.val, csrk->val, sizeof(csrk->val)); 9848 9849 mgmt_event(MGMT_EV_NEW_CSRK, hdev, &ev, sizeof(ev), NULL); 9850 } 9851 9852 void mgmt_new_conn_param(struct hci_dev *hdev, bdaddr_t *bdaddr, 9853 u8 bdaddr_type, u8 store_hint, u16 min_interval, 9854 u16 max_interval, u16 latency, u16 timeout) 9855 { 9856 struct mgmt_ev_new_conn_param ev; 9857 9858 if (!hci_is_identity_address(bdaddr, bdaddr_type)) 9859 return; 9860 9861 memset(&ev, 0, sizeof(ev)); 9862 bacpy(&ev.addr.bdaddr, bdaddr); 9863 ev.addr.type = link_to_bdaddr(LE_LINK, bdaddr_type); 9864 ev.store_hint = store_hint; 9865 ev.min_interval = cpu_to_le16(min_interval); 9866 ev.max_interval = cpu_to_le16(max_interval); 9867 ev.latency = cpu_to_le16(latency); 9868 ev.timeout = cpu_to_le16(timeout); 9869 9870 mgmt_event(MGMT_EV_NEW_CONN_PARAM, hdev, &ev, sizeof(ev), NULL); 9871 } 9872 9873 void mgmt_device_connected(struct hci_dev *hdev, struct hci_conn *conn, 9874 u8 *name, u8 name_len) 9875 { 9876 struct sk_buff *skb; 9877 struct mgmt_ev_device_connected *ev; 9878 u16 eir_len = 0; 9879 u32 flags = 0; 9880 9881 if (test_and_set_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags)) 9882 return; 9883 9884 /* allocate buff for LE or BR/EDR adv */ 9885 if (conn->le_adv_data_len > 0) 9886 skb = mgmt_alloc_skb(hdev, MGMT_EV_DEVICE_CONNECTED, 9887 sizeof(*ev) + conn->le_adv_data_len); 9888 else 9889 skb = mgmt_alloc_skb(hdev, MGMT_EV_DEVICE_CONNECTED, 9890 sizeof(*ev) + (name ? eir_precalc_len(name_len) : 0) + 9891 eir_precalc_len(sizeof(conn->dev_class))); 9892 9893 if (!skb) 9894 return; 9895 9896 ev = skb_put(skb, sizeof(*ev)); 9897 bacpy(&ev->addr.bdaddr, &conn->dst); 9898 ev->addr.type = link_to_bdaddr(conn->type, conn->dst_type); 9899 9900 if (conn->out) 9901 flags |= MGMT_DEV_FOUND_INITIATED_CONN; 9902 9903 ev->flags = __cpu_to_le32(flags); 9904 9905 /* We must ensure that the EIR Data fields are ordered and 9906 * unique. Keep it simple for now and avoid the problem by not 9907 * adding any BR/EDR data to the LE adv. 9908 */ 9909 if (conn->le_adv_data_len > 0) { 9910 skb_put_data(skb, conn->le_adv_data, conn->le_adv_data_len); 9911 eir_len = conn->le_adv_data_len; 9912 } else { 9913 if (name) 9914 eir_len += eir_skb_put_data(skb, EIR_NAME_COMPLETE, name, name_len); 9915 9916 if (memcmp(conn->dev_class, "\0\0\0", sizeof(conn->dev_class))) 9917 eir_len += eir_skb_put_data(skb, EIR_CLASS_OF_DEV, 9918 conn->dev_class, sizeof(conn->dev_class)); 9919 } 9920 9921 ev->eir_len = cpu_to_le16(eir_len); 9922 9923 mgmt_event_skb(skb, NULL); 9924 } 9925 9926 static void unpair_device_rsp(struct mgmt_pending_cmd *cmd, void *data) 9927 { 9928 struct hci_dev *hdev = data; 9929 struct mgmt_cp_unpair_device *cp = cmd->param; 9930 9931 device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, cmd->sk); 9932 9933 cmd->cmd_complete(cmd, 0); 9934 } 9935 9936 bool mgmt_powering_down(struct hci_dev *hdev) 9937 { 9938 struct mgmt_pending_cmd *cmd; 9939 struct mgmt_mode *cp; 9940 9941 if (hci_dev_test_flag(hdev, HCI_POWERING_DOWN)) 9942 return true; 9943 9944 cmd = pending_find(MGMT_OP_SET_POWERED, hdev); 9945 if (!cmd) 9946 return false; 9947 9948 cp = cmd->param; 9949 if (!cp->val) 9950 return true; 9951 9952 return false; 9953 } 9954 9955 u8 hci_to_mgmt_reason(u8 err) 9956 { 9957 switch (err) { 9958 case HCI_ERROR_CONNECTION_TIMEOUT: 9959 return MGMT_DEV_DISCONN_TIMEOUT; 9960 case HCI_ERROR_REMOTE_USER_TERM: 9961 case HCI_ERROR_REMOTE_LOW_RESOURCES: 9962 case HCI_ERROR_REMOTE_POWER_OFF: 9963 return MGMT_DEV_DISCONN_REMOTE; 9964 case HCI_ERROR_LOCAL_HOST_TERM: 9965 return MGMT_DEV_DISCONN_LOCAL_HOST; 9966 default: 9967 return MGMT_DEV_DISCONN_UNKNOWN; 9968 } 9969 } 9970 9971 void mgmt_device_disconnected(struct hci_dev *hdev, bdaddr_t *bdaddr, 9972 u8 link_type, u8 addr_type, u8 reason, 9973 bool mgmt_connected) 9974 { 9975 struct mgmt_ev_device_disconnected ev; 9976 struct sock *sk = NULL; 9977 9978 if (!mgmt_connected) 9979 return; 9980 9981 if (link_type != ACL_LINK && 9982 link_type != LE_LINK && 9983 link_type != BIS_LINK) 9984 return; 9985 9986 bacpy(&ev.addr.bdaddr, bdaddr); 9987 ev.addr.type = link_to_bdaddr(link_type, addr_type); 9988 ev.reason = reason; 9989 9990 /* Report disconnects due to suspend */ 9991 if (hdev->suspended) 9992 ev.reason = MGMT_DEV_DISCONN_LOCAL_HOST_SUSPEND; 9993 9994 mgmt_event(MGMT_EV_DEVICE_DISCONNECTED, hdev, &ev, sizeof(ev), sk); 9995 9996 if (sk) 9997 sock_put(sk); 9998 } 9999 10000 void mgmt_disconnect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr, 10001 u8 link_type, u8 addr_type, u8 status) 10002 { 10003 u8 bdaddr_type = link_to_bdaddr(link_type, addr_type); 10004 struct mgmt_cp_disconnect *cp; 10005 struct mgmt_pending_cmd *cmd; 10006 10007 mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, true, 10008 unpair_device_rsp, hdev); 10009 10010 cmd = pending_find(MGMT_OP_DISCONNECT, hdev); 10011 if (!cmd) 10012 return; 10013 10014 cp = cmd->param; 10015 10016 if (bacmp(bdaddr, &cp->addr.bdaddr)) 10017 return; 10018 10019 if (cp->addr.type != bdaddr_type) 10020 return; 10021 10022 cmd->cmd_complete(cmd, mgmt_status(status)); 10023 mgmt_pending_remove(cmd); 10024 } 10025 10026 void mgmt_connect_failed(struct hci_dev *hdev, struct hci_conn *conn, u8 status) 10027 { 10028 struct mgmt_ev_connect_failed ev; 10029 10030 if (test_and_clear_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags)) { 10031 mgmt_device_disconnected(hdev, &conn->dst, conn->type, 10032 conn->dst_type, 10033 hci_to_mgmt_reason(status), true); 10034 return; 10035 } 10036 10037 bacpy(&ev.addr.bdaddr, &conn->dst); 10038 ev.addr.type = link_to_bdaddr(conn->type, conn->dst_type); 10039 ev.status = mgmt_status(status); 10040 10041 mgmt_event(MGMT_EV_CONNECT_FAILED, hdev, &ev, sizeof(ev), NULL); 10042 } 10043 10044 void mgmt_pin_code_request(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 secure) 10045 { 10046 struct mgmt_ev_pin_code_request ev; 10047 10048 bacpy(&ev.addr.bdaddr, bdaddr); 10049 ev.addr.type = BDADDR_BREDR; 10050 ev.secure = secure; 10051 10052 mgmt_event(MGMT_EV_PIN_CODE_REQUEST, hdev, &ev, sizeof(ev), NULL); 10053 } 10054 10055 void mgmt_pin_code_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr, 10056 u8 status) 10057 { 10058 struct mgmt_pending_cmd *cmd; 10059 10060 cmd = pending_find(MGMT_OP_PIN_CODE_REPLY, hdev); 10061 if (!cmd) 10062 return; 10063 10064 cmd->cmd_complete(cmd, mgmt_status(status)); 10065 mgmt_pending_remove(cmd); 10066 } 10067 10068 void mgmt_pin_code_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr, 10069 u8 status) 10070 { 10071 struct mgmt_pending_cmd *cmd; 10072 10073 cmd = pending_find(MGMT_OP_PIN_CODE_NEG_REPLY, hdev); 10074 if (!cmd) 10075 return; 10076 10077 cmd->cmd_complete(cmd, mgmt_status(status)); 10078 mgmt_pending_remove(cmd); 10079 } 10080 10081 int mgmt_user_confirm_request(struct hci_dev *hdev, bdaddr_t *bdaddr, 10082 u8 link_type, u8 addr_type, u32 value, 10083 u8 confirm_hint) 10084 { 10085 struct mgmt_ev_user_confirm_request ev; 10086 10087 bt_dev_dbg(hdev, "bdaddr %pMR", bdaddr); 10088 10089 bacpy(&ev.addr.bdaddr, bdaddr); 10090 ev.addr.type = link_to_bdaddr(link_type, addr_type); 10091 ev.confirm_hint = confirm_hint; 10092 ev.value = cpu_to_le32(value); 10093 10094 return mgmt_event(MGMT_EV_USER_CONFIRM_REQUEST, hdev, &ev, sizeof(ev), 10095 NULL); 10096 } 10097 10098 int mgmt_user_passkey_request(struct hci_dev *hdev, bdaddr_t *bdaddr, 10099 u8 link_type, u8 addr_type) 10100 { 10101 struct mgmt_ev_user_passkey_request ev; 10102 10103 bt_dev_dbg(hdev, "bdaddr %pMR", bdaddr); 10104 10105 bacpy(&ev.addr.bdaddr, bdaddr); 10106 ev.addr.type = link_to_bdaddr(link_type, addr_type); 10107 10108 return mgmt_event(MGMT_EV_USER_PASSKEY_REQUEST, hdev, &ev, sizeof(ev), 10109 NULL); 10110 } 10111 10112 static int user_pairing_resp_complete(struct hci_dev *hdev, bdaddr_t *bdaddr, 10113 u8 link_type, u8 addr_type, u8 status, 10114 u8 opcode) 10115 { 10116 struct mgmt_pending_cmd *cmd; 10117 10118 cmd = pending_find(opcode, hdev); 10119 if (!cmd) 10120 return -ENOENT; 10121 10122 cmd->cmd_complete(cmd, mgmt_status(status)); 10123 mgmt_pending_remove(cmd); 10124 10125 return 0; 10126 } 10127 10128 int mgmt_user_confirm_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr, 10129 u8 link_type, u8 addr_type, u8 status) 10130 { 10131 return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type, 10132 status, MGMT_OP_USER_CONFIRM_REPLY); 10133 } 10134 10135 int mgmt_user_confirm_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr, 10136 u8 link_type, u8 addr_type, u8 status) 10137 { 10138 return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type, 10139 status, 10140 MGMT_OP_USER_CONFIRM_NEG_REPLY); 10141 } 10142 10143 int mgmt_user_passkey_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr, 10144 u8 link_type, u8 addr_type, u8 status) 10145 { 10146 return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type, 10147 status, MGMT_OP_USER_PASSKEY_REPLY); 10148 } 10149 10150 int mgmt_user_passkey_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr, 10151 u8 link_type, u8 addr_type, u8 status) 10152 { 10153 return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type, 10154 status, 10155 MGMT_OP_USER_PASSKEY_NEG_REPLY); 10156 } 10157 10158 int mgmt_user_passkey_notify(struct hci_dev *hdev, bdaddr_t *bdaddr, 10159 u8 link_type, u8 addr_type, u32 passkey, 10160 u8 entered) 10161 { 10162 struct mgmt_ev_passkey_notify ev; 10163 10164 bt_dev_dbg(hdev, "bdaddr %pMR", bdaddr); 10165 10166 bacpy(&ev.addr.bdaddr, bdaddr); 10167 ev.addr.type = link_to_bdaddr(link_type, addr_type); 10168 ev.passkey = __cpu_to_le32(passkey); 10169 ev.entered = entered; 10170 10171 return mgmt_event(MGMT_EV_PASSKEY_NOTIFY, hdev, &ev, sizeof(ev), NULL); 10172 } 10173 10174 void mgmt_auth_failed(struct hci_conn *conn, u8 hci_status) 10175 { 10176 struct mgmt_ev_auth_failed ev; 10177 struct mgmt_pending_cmd *cmd; 10178 u8 status = mgmt_status(hci_status); 10179 10180 bacpy(&ev.addr.bdaddr, &conn->dst); 10181 ev.addr.type = link_to_bdaddr(conn->type, conn->dst_type); 10182 ev.status = status; 10183 10184 cmd = remove_pairing(conn); 10185 10186 mgmt_event(MGMT_EV_AUTH_FAILED, conn->hdev, &ev, sizeof(ev), 10187 cmd ? cmd->sk : NULL); 10188 10189 if (cmd) { 10190 cmd->cmd_complete(cmd, status); 10191 mgmt_pending_free(cmd); 10192 } 10193 } 10194 10195 void mgmt_auth_enable_complete(struct hci_dev *hdev, u8 status) 10196 { 10197 struct cmd_lookup match = { NULL, hdev }; 10198 bool changed; 10199 10200 if (status) { 10201 u8 mgmt_err = mgmt_status(status); 10202 mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev, true, 10203 cmd_status_rsp, &mgmt_err); 10204 return; 10205 } 10206 10207 if (test_bit(HCI_AUTH, &hdev->flags)) 10208 changed = !hci_dev_test_and_set_flag(hdev, HCI_LINK_SECURITY); 10209 else 10210 changed = hci_dev_test_and_clear_flag(hdev, HCI_LINK_SECURITY); 10211 10212 mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev, true, 10213 settings_rsp, &match); 10214 10215 if (changed) 10216 new_settings(hdev, match.sk); 10217 10218 if (match.sk) 10219 sock_put(match.sk); 10220 } 10221 10222 static void sk_lookup(struct mgmt_pending_cmd *cmd, void *data) 10223 { 10224 struct cmd_lookup *match = data; 10225 10226 if (match->sk == NULL) { 10227 match->sk = cmd->sk; 10228 sock_hold(match->sk); 10229 } 10230 } 10231 10232 void mgmt_set_class_of_dev_complete(struct hci_dev *hdev, u8 *dev_class, 10233 u8 status) 10234 { 10235 struct cmd_lookup match = { NULL, hdev, mgmt_status(status) }; 10236 10237 mgmt_pending_foreach(MGMT_OP_SET_DEV_CLASS, hdev, false, sk_lookup, 10238 &match); 10239 mgmt_pending_foreach(MGMT_OP_ADD_UUID, hdev, false, sk_lookup, 10240 &match); 10241 mgmt_pending_foreach(MGMT_OP_REMOVE_UUID, hdev, false, sk_lookup, 10242 &match); 10243 10244 if (!status) { 10245 mgmt_limited_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev, dev_class, 10246 3, HCI_MGMT_DEV_CLASS_EVENTS, NULL); 10247 ext_info_changed(hdev, NULL); 10248 } 10249 10250 if (match.sk) 10251 sock_put(match.sk); 10252 } 10253 10254 void mgmt_set_local_name_complete(struct hci_dev *hdev, u8 *name, u8 status) 10255 { 10256 struct mgmt_cp_set_local_name ev; 10257 struct mgmt_pending_cmd *cmd; 10258 10259 if (status) 10260 return; 10261 10262 memset(&ev, 0, sizeof(ev)); 10263 memcpy(ev.name, name, HCI_MAX_NAME_LENGTH); 10264 memcpy(ev.short_name, hdev->short_name, HCI_MAX_SHORT_NAME_LENGTH); 10265 10266 cmd = pending_find(MGMT_OP_SET_LOCAL_NAME, hdev); 10267 if (!cmd) { 10268 memcpy(hdev->dev_name, name, sizeof(hdev->dev_name)); 10269 10270 /* If this is a HCI command related to powering on the 10271 * HCI dev don't send any mgmt signals. 10272 */ 10273 if (hci_dev_test_flag(hdev, HCI_POWERING_DOWN)) 10274 return; 10275 10276 if (pending_find(MGMT_OP_SET_POWERED, hdev)) 10277 return; 10278 } 10279 10280 mgmt_limited_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, &ev, sizeof(ev), 10281 HCI_MGMT_LOCAL_NAME_EVENTS, cmd ? cmd->sk : NULL); 10282 ext_info_changed(hdev, cmd ? cmd->sk : NULL); 10283 } 10284 10285 static inline bool has_uuid(u8 *uuid, u16 uuid_count, u8 (*uuids)[16]) 10286 { 10287 int i; 10288 10289 for (i = 0; i < uuid_count; i++) { 10290 if (!memcmp(uuid, uuids[i], 16)) 10291 return true; 10292 } 10293 10294 return false; 10295 } 10296 10297 static bool eir_has_uuids(u8 *eir, u16 eir_len, u16 uuid_count, u8 (*uuids)[16]) 10298 { 10299 u16 parsed = 0; 10300 10301 while (parsed < eir_len) { 10302 u8 field_len = eir[0]; 10303 u8 uuid[16]; 10304 int i; 10305 10306 if (field_len == 0) 10307 break; 10308 10309 if (eir_len - parsed < field_len + 1) 10310 break; 10311 10312 switch (eir[1]) { 10313 case EIR_UUID16_ALL: 10314 case EIR_UUID16_SOME: 10315 for (i = 0; i + 3 <= field_len; i += 2) { 10316 memcpy(uuid, bluetooth_base_uuid, 16); 10317 uuid[13] = eir[i + 3]; 10318 uuid[12] = eir[i + 2]; 10319 if (has_uuid(uuid, uuid_count, uuids)) 10320 return true; 10321 } 10322 break; 10323 case EIR_UUID32_ALL: 10324 case EIR_UUID32_SOME: 10325 for (i = 0; i + 5 <= field_len; i += 4) { 10326 memcpy(uuid, bluetooth_base_uuid, 16); 10327 uuid[15] = eir[i + 5]; 10328 uuid[14] = eir[i + 4]; 10329 uuid[13] = eir[i + 3]; 10330 uuid[12] = eir[i + 2]; 10331 if (has_uuid(uuid, uuid_count, uuids)) 10332 return true; 10333 } 10334 break; 10335 case EIR_UUID128_ALL: 10336 case EIR_UUID128_SOME: 10337 for (i = 0; i + 17 <= field_len; i += 16) { 10338 memcpy(uuid, eir + i + 2, 16); 10339 if (has_uuid(uuid, uuid_count, uuids)) 10340 return true; 10341 } 10342 break; 10343 } 10344 10345 parsed += field_len + 1; 10346 eir += field_len + 1; 10347 } 10348 10349 return false; 10350 } 10351 10352 static bool is_filter_match(struct hci_dev *hdev, s8 rssi, u8 *eir, 10353 u16 eir_len, u8 *scan_rsp, u8 scan_rsp_len) 10354 { 10355 /* If a RSSI threshold has been specified, and 10356 * HCI_QUIRK_STRICT_DUPLICATE_FILTER is not set, then all results with 10357 * a RSSI smaller than the RSSI threshold will be dropped. If the quirk 10358 * is set, let it through for further processing, as we might need to 10359 * restart the scan. 10360 * 10361 * For BR/EDR devices (pre 1.2) providing no RSSI during inquiry, 10362 * the results are also dropped. 10363 */ 10364 if (hdev->discovery.rssi != HCI_RSSI_INVALID && 10365 (rssi == HCI_RSSI_INVALID || 10366 (rssi < hdev->discovery.rssi && 10367 !hci_test_quirk(hdev, HCI_QUIRK_STRICT_DUPLICATE_FILTER)))) 10368 return false; 10369 10370 if (hdev->discovery.uuid_count != 0) { 10371 /* If a list of UUIDs is provided in filter, results with no 10372 * matching UUID should be dropped. 10373 */ 10374 if (!eir_has_uuids(eir, eir_len, hdev->discovery.uuid_count, 10375 hdev->discovery.uuids) && 10376 !eir_has_uuids(scan_rsp, scan_rsp_len, 10377 hdev->discovery.uuid_count, 10378 hdev->discovery.uuids)) 10379 return false; 10380 } 10381 10382 /* If duplicate filtering does not report RSSI changes, then restart 10383 * scanning to ensure updated result with updated RSSI values. 10384 */ 10385 if (hci_test_quirk(hdev, HCI_QUIRK_STRICT_DUPLICATE_FILTER)) { 10386 /* Validate RSSI value against the RSSI threshold once more. */ 10387 if (hdev->discovery.rssi != HCI_RSSI_INVALID && 10388 rssi < hdev->discovery.rssi) 10389 return false; 10390 } 10391 10392 return true; 10393 } 10394 10395 void mgmt_adv_monitor_device_lost(struct hci_dev *hdev, u16 handle, 10396 bdaddr_t *bdaddr, u8 addr_type) 10397 { 10398 struct mgmt_ev_adv_monitor_device_lost ev; 10399 10400 ev.monitor_handle = cpu_to_le16(handle); 10401 bacpy(&ev.addr.bdaddr, bdaddr); 10402 ev.addr.type = addr_type; 10403 10404 mgmt_event(MGMT_EV_ADV_MONITOR_DEVICE_LOST, hdev, &ev, sizeof(ev), 10405 NULL); 10406 } 10407 10408 static void mgmt_send_adv_monitor_device_found(struct hci_dev *hdev, 10409 struct sk_buff *skb, 10410 struct sock *skip_sk, 10411 u16 handle) 10412 { 10413 struct sk_buff *advmon_skb; 10414 size_t advmon_skb_len; 10415 __le16 *monitor_handle; 10416 10417 if (!skb) 10418 return; 10419 10420 advmon_skb_len = (sizeof(struct mgmt_ev_adv_monitor_device_found) - 10421 sizeof(struct mgmt_ev_device_found)) + skb->len; 10422 advmon_skb = mgmt_alloc_skb(hdev, MGMT_EV_ADV_MONITOR_DEVICE_FOUND, 10423 advmon_skb_len); 10424 if (!advmon_skb) 10425 return; 10426 10427 /* ADV_MONITOR_DEVICE_FOUND is similar to DEVICE_FOUND event except 10428 * that it also has 'monitor_handle'. Make a copy of DEVICE_FOUND and 10429 * store monitor_handle of the matched monitor. 10430 */ 10431 monitor_handle = skb_put(advmon_skb, sizeof(*monitor_handle)); 10432 *monitor_handle = cpu_to_le16(handle); 10433 skb_put_data(advmon_skb, skb->data, skb->len); 10434 10435 mgmt_event_skb(advmon_skb, skip_sk); 10436 } 10437 10438 static void mgmt_adv_monitor_device_found(struct hci_dev *hdev, 10439 bdaddr_t *bdaddr, bool report_device, 10440 struct sk_buff *skb, 10441 struct sock *skip_sk) 10442 { 10443 struct monitored_device *dev, *tmp; 10444 bool matched = false; 10445 bool notified = false; 10446 10447 /* We have received the Advertisement Report because: 10448 * 1. the kernel has initiated active discovery 10449 * 2. if not, we have pend_le_reports > 0 in which case we are doing 10450 * passive scanning 10451 * 3. if none of the above is true, we have one or more active 10452 * Advertisement Monitor 10453 * 10454 * For case 1 and 2, report all advertisements via MGMT_EV_DEVICE_FOUND 10455 * and report ONLY one advertisement per device for the matched Monitor 10456 * via MGMT_EV_ADV_MONITOR_DEVICE_FOUND event. 10457 * 10458 * For case 3, since we are not active scanning and all advertisements 10459 * received are due to a matched Advertisement Monitor, report all 10460 * advertisements ONLY via MGMT_EV_ADV_MONITOR_DEVICE_FOUND event. 10461 */ 10462 if (report_device && !hdev->advmon_pend_notify) { 10463 mgmt_event_skb(skb, skip_sk); 10464 return; 10465 } 10466 10467 hdev->advmon_pend_notify = false; 10468 10469 list_for_each_entry_safe(dev, tmp, &hdev->monitored_devices, list) { 10470 if (!bacmp(&dev->bdaddr, bdaddr)) { 10471 matched = true; 10472 10473 if (!dev->notified) { 10474 mgmt_send_adv_monitor_device_found(hdev, skb, 10475 skip_sk, 10476 dev->handle); 10477 notified = true; 10478 dev->notified = true; 10479 } 10480 } 10481 10482 if (!dev->notified) 10483 hdev->advmon_pend_notify = true; 10484 } 10485 10486 if (!report_device && 10487 ((matched && !notified) || !msft_monitor_supported(hdev))) { 10488 /* Handle 0 indicates that we are not active scanning and this 10489 * is a subsequent advertisement report for an already matched 10490 * Advertisement Monitor or the controller offloading support 10491 * is not available. 10492 */ 10493 mgmt_send_adv_monitor_device_found(hdev, skb, skip_sk, 0); 10494 } 10495 10496 if (report_device) 10497 mgmt_event_skb(skb, skip_sk); 10498 else 10499 kfree_skb(skb); 10500 } 10501 10502 static void mesh_device_found(struct hci_dev *hdev, bdaddr_t *bdaddr, 10503 u8 addr_type, s8 rssi, u32 flags, u8 *eir, 10504 u16 eir_len, u8 *scan_rsp, u8 scan_rsp_len, 10505 u64 instant) 10506 { 10507 struct sk_buff *skb; 10508 struct mgmt_ev_mesh_device_found *ev; 10509 int i, j; 10510 10511 if (!hdev->mesh_ad_types[0]) 10512 goto accepted; 10513 10514 /* Scan for requested AD types */ 10515 if (eir_len > 0) { 10516 for (i = 0; i + 1 < eir_len; i += eir[i] + 1) { 10517 for (j = 0; j < sizeof(hdev->mesh_ad_types); j++) { 10518 if (!hdev->mesh_ad_types[j]) 10519 break; 10520 10521 if (hdev->mesh_ad_types[j] == eir[i + 1]) 10522 goto accepted; 10523 } 10524 } 10525 } 10526 10527 if (scan_rsp_len > 0) { 10528 for (i = 0; i + 1 < scan_rsp_len; i += scan_rsp[i] + 1) { 10529 for (j = 0; j < sizeof(hdev->mesh_ad_types); j++) { 10530 if (!hdev->mesh_ad_types[j]) 10531 break; 10532 10533 if (hdev->mesh_ad_types[j] == scan_rsp[i + 1]) 10534 goto accepted; 10535 } 10536 } 10537 } 10538 10539 return; 10540 10541 accepted: 10542 skb = mgmt_alloc_skb(hdev, MGMT_EV_MESH_DEVICE_FOUND, 10543 sizeof(*ev) + eir_len + scan_rsp_len); 10544 if (!skb) 10545 return; 10546 10547 ev = skb_put(skb, sizeof(*ev)); 10548 10549 bacpy(&ev->addr.bdaddr, bdaddr); 10550 ev->addr.type = link_to_bdaddr(LE_LINK, addr_type); 10551 ev->rssi = rssi; 10552 ev->flags = cpu_to_le32(flags); 10553 ev->instant = cpu_to_le64(instant); 10554 10555 if (eir_len > 0) 10556 /* Copy EIR or advertising data into event */ 10557 skb_put_data(skb, eir, eir_len); 10558 10559 if (scan_rsp_len > 0) 10560 /* Append scan response data to event */ 10561 skb_put_data(skb, scan_rsp, scan_rsp_len); 10562 10563 ev->eir_len = cpu_to_le16(eir_len + scan_rsp_len); 10564 10565 mgmt_event_skb(skb, NULL); 10566 } 10567 10568 void mgmt_device_found(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type, 10569 u8 addr_type, u8 *dev_class, s8 rssi, u32 flags, 10570 u8 *eir, u16 eir_len, u8 *scan_rsp, u8 scan_rsp_len, 10571 u64 instant) 10572 { 10573 struct sk_buff *skb; 10574 struct mgmt_ev_device_found *ev; 10575 bool report_device = hci_discovery_active(hdev); 10576 10577 if (hci_dev_test_flag(hdev, HCI_MESH) && link_type == LE_LINK) 10578 mesh_device_found(hdev, bdaddr, addr_type, rssi, flags, 10579 eir, eir_len, scan_rsp, scan_rsp_len, 10580 instant); 10581 10582 /* Don't send events for a non-kernel initiated discovery. With 10583 * LE one exception is if we have pend_le_reports > 0 in which 10584 * case we're doing passive scanning and want these events. 10585 */ 10586 if (!hci_discovery_active(hdev)) { 10587 if (link_type == ACL_LINK) 10588 return; 10589 if (link_type == LE_LINK && !list_empty(&hdev->pend_le_reports)) 10590 report_device = true; 10591 else if (!hci_is_adv_monitoring(hdev)) 10592 return; 10593 } 10594 10595 if (hdev->discovery.result_filtering) { 10596 /* We are using service discovery */ 10597 if (!is_filter_match(hdev, rssi, eir, eir_len, scan_rsp, 10598 scan_rsp_len)) 10599 return; 10600 } 10601 10602 if (hdev->discovery.limited) { 10603 /* Check for limited discoverable bit */ 10604 if (dev_class) { 10605 if (!(dev_class[1] & 0x20)) 10606 return; 10607 } else { 10608 u8 *flags = eir_get_data(eir, eir_len, EIR_FLAGS, NULL); 10609 if (!flags || !(flags[0] & LE_AD_LIMITED)) 10610 return; 10611 } 10612 } 10613 10614 /* Allocate skb. The 5 extra bytes are for the potential CoD field */ 10615 skb = mgmt_alloc_skb(hdev, MGMT_EV_DEVICE_FOUND, 10616 sizeof(*ev) + eir_len + scan_rsp_len + 5); 10617 if (!skb) 10618 return; 10619 10620 ev = skb_put(skb, sizeof(*ev)); 10621 10622 /* In case of device discovery with BR/EDR devices (pre 1.2), the 10623 * RSSI value was reported as 0 when not available. This behavior 10624 * is kept when using device discovery. This is required for full 10625 * backwards compatibility with the API. 10626 * 10627 * However when using service discovery, the value 127 will be 10628 * returned when the RSSI is not available. 10629 */ 10630 if (rssi == HCI_RSSI_INVALID && !hdev->discovery.report_invalid_rssi && 10631 link_type == ACL_LINK) 10632 rssi = 0; 10633 10634 bacpy(&ev->addr.bdaddr, bdaddr); 10635 ev->addr.type = link_to_bdaddr(link_type, addr_type); 10636 ev->rssi = rssi; 10637 ev->flags = cpu_to_le32(flags); 10638 10639 if (eir_len > 0) 10640 /* Copy EIR or advertising data into event */ 10641 skb_put_data(skb, eir, eir_len); 10642 10643 if (dev_class && !eir_get_data(eir, eir_len, EIR_CLASS_OF_DEV, NULL)) { 10644 u8 eir_cod[5]; 10645 10646 eir_len += eir_append_data(eir_cod, 0, EIR_CLASS_OF_DEV, 10647 dev_class, 3); 10648 skb_put_data(skb, eir_cod, sizeof(eir_cod)); 10649 } 10650 10651 if (scan_rsp_len > 0) 10652 /* Append scan response data to event */ 10653 skb_put_data(skb, scan_rsp, scan_rsp_len); 10654 10655 ev->eir_len = cpu_to_le16(eir_len + scan_rsp_len); 10656 10657 mgmt_adv_monitor_device_found(hdev, bdaddr, report_device, skb, NULL); 10658 } 10659 10660 void mgmt_remote_name(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type, 10661 u8 addr_type, s8 rssi, u8 *name, u8 name_len) 10662 { 10663 struct sk_buff *skb; 10664 struct mgmt_ev_device_found *ev; 10665 u16 eir_len = 0; 10666 u32 flags = 0; 10667 10668 skb = mgmt_alloc_skb(hdev, MGMT_EV_DEVICE_FOUND, 10669 sizeof(*ev) + (name ? eir_precalc_len(name_len) : 0)); 10670 if (!skb) 10671 return; 10672 10673 ev = skb_put(skb, sizeof(*ev)); 10674 bacpy(&ev->addr.bdaddr, bdaddr); 10675 ev->addr.type = link_to_bdaddr(link_type, addr_type); 10676 ev->rssi = rssi; 10677 10678 if (name) 10679 eir_len += eir_skb_put_data(skb, EIR_NAME_COMPLETE, name, name_len); 10680 else 10681 flags = MGMT_DEV_FOUND_NAME_REQUEST_FAILED; 10682 10683 ev->eir_len = cpu_to_le16(eir_len); 10684 ev->flags = cpu_to_le32(flags); 10685 10686 mgmt_event_skb(skb, NULL); 10687 } 10688 10689 void mgmt_discovering(struct hci_dev *hdev, u8 discovering) 10690 { 10691 struct mgmt_ev_discovering ev; 10692 10693 bt_dev_dbg(hdev, "discovering %u", discovering); 10694 10695 memset(&ev, 0, sizeof(ev)); 10696 ev.type = hdev->discovery.type; 10697 ev.discovering = discovering; 10698 10699 mgmt_event(MGMT_EV_DISCOVERING, hdev, &ev, sizeof(ev), NULL); 10700 } 10701 10702 void mgmt_suspending(struct hci_dev *hdev, u8 state) 10703 { 10704 struct mgmt_ev_controller_suspend ev; 10705 10706 ev.suspend_state = state; 10707 mgmt_event(MGMT_EV_CONTROLLER_SUSPEND, hdev, &ev, sizeof(ev), NULL); 10708 } 10709 10710 void mgmt_resuming(struct hci_dev *hdev, u8 reason, bdaddr_t *bdaddr, 10711 u8 addr_type) 10712 { 10713 struct mgmt_ev_controller_resume ev; 10714 10715 ev.wake_reason = reason; 10716 if (bdaddr) { 10717 bacpy(&ev.addr.bdaddr, bdaddr); 10718 ev.addr.type = addr_type; 10719 } else { 10720 memset(&ev.addr, 0, sizeof(ev.addr)); 10721 } 10722 10723 mgmt_event(MGMT_EV_CONTROLLER_RESUME, hdev, &ev, sizeof(ev), NULL); 10724 } 10725 10726 static struct hci_mgmt_chan chan = { 10727 .channel = HCI_CHANNEL_CONTROL, 10728 .handler_count = ARRAY_SIZE(mgmt_handlers), 10729 .handlers = mgmt_handlers, 10730 .hdev_init = mgmt_init_hdev, 10731 }; 10732 10733 int mgmt_init(void) 10734 { 10735 return hci_mgmt_chan_register(&chan); 10736 } 10737 10738 void mgmt_exit(void) 10739 { 10740 hci_mgmt_chan_unregister(&chan); 10741 } 10742 10743 void mgmt_cleanup(struct sock *sk) 10744 { 10745 struct mgmt_mesh_tx *mesh_tx; 10746 struct hci_dev *hdev; 10747 10748 read_lock(&hci_dev_list_lock); 10749 10750 list_for_each_entry(hdev, &hci_dev_list, list) { 10751 do { 10752 mesh_tx = mgmt_mesh_next(hdev, sk); 10753 10754 if (mesh_tx) 10755 mesh_send_complete(hdev, mesh_tx, true); 10756 } while (mesh_tx); 10757 } 10758 10759 read_unlock(&hci_dev_list_lock); 10760 } 10761