1 // SPDX-License-Identifier: GPL-2.0 2 /* 3 BlueZ - Bluetooth protocol stack for Linux 4 5 Copyright (C) 2010 Nokia Corporation 6 Copyright (C) 2011-2012 Intel Corporation 7 8 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS 9 OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 10 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS. 11 IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY 12 CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES 13 WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN 14 ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF 15 OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. 16 17 ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS, 18 COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS 19 SOFTWARE IS DISCLAIMED. 20 */ 21 22 /* Bluetooth HCI Management interface */ 23 24 #include <linux/module.h> 25 #include <linux/unaligned.h> 26 27 #include <net/bluetooth/bluetooth.h> 28 #include <net/bluetooth/hci_core.h> 29 #include <net/bluetooth/hci_sock.h> 30 #include <net/bluetooth/l2cap.h> 31 #include <net/bluetooth/mgmt.h> 32 33 #include "smp.h" 34 #include "mgmt_util.h" 35 #include "mgmt_config.h" 36 #include "msft.h" 37 #include "eir.h" 38 #include "aosp.h" 39 40 #define MGMT_VERSION 1 41 #define MGMT_REVISION 23 42 43 static const u16 mgmt_commands[] = { 44 MGMT_OP_READ_INDEX_LIST, 45 MGMT_OP_READ_INFO, 46 MGMT_OP_SET_POWERED, 47 MGMT_OP_SET_DISCOVERABLE, 48 MGMT_OP_SET_CONNECTABLE, 49 MGMT_OP_SET_FAST_CONNECTABLE, 50 MGMT_OP_SET_BONDABLE, 51 MGMT_OP_SET_LINK_SECURITY, 52 MGMT_OP_SET_SSP, 53 MGMT_OP_SET_HS, 54 MGMT_OP_SET_LE, 55 MGMT_OP_SET_DEV_CLASS, 56 MGMT_OP_SET_LOCAL_NAME, 57 MGMT_OP_ADD_UUID, 58 MGMT_OP_REMOVE_UUID, 59 MGMT_OP_LOAD_LINK_KEYS, 60 MGMT_OP_LOAD_LONG_TERM_KEYS, 61 MGMT_OP_DISCONNECT, 62 MGMT_OP_GET_CONNECTIONS, 63 MGMT_OP_PIN_CODE_REPLY, 64 MGMT_OP_PIN_CODE_NEG_REPLY, 65 MGMT_OP_SET_IO_CAPABILITY, 66 MGMT_OP_PAIR_DEVICE, 67 MGMT_OP_CANCEL_PAIR_DEVICE, 68 MGMT_OP_UNPAIR_DEVICE, 69 MGMT_OP_USER_CONFIRM_REPLY, 70 MGMT_OP_USER_CONFIRM_NEG_REPLY, 71 MGMT_OP_USER_PASSKEY_REPLY, 72 MGMT_OP_USER_PASSKEY_NEG_REPLY, 73 MGMT_OP_READ_LOCAL_OOB_DATA, 74 MGMT_OP_ADD_REMOTE_OOB_DATA, 75 MGMT_OP_REMOVE_REMOTE_OOB_DATA, 76 MGMT_OP_START_DISCOVERY, 77 MGMT_OP_STOP_DISCOVERY, 78 MGMT_OP_CONFIRM_NAME, 79 MGMT_OP_BLOCK_DEVICE, 80 MGMT_OP_UNBLOCK_DEVICE, 81 MGMT_OP_SET_DEVICE_ID, 82 MGMT_OP_SET_ADVERTISING, 83 MGMT_OP_SET_BREDR, 84 MGMT_OP_SET_STATIC_ADDRESS, 85 MGMT_OP_SET_SCAN_PARAMS, 86 MGMT_OP_SET_SECURE_CONN, 87 MGMT_OP_SET_DEBUG_KEYS, 88 MGMT_OP_SET_PRIVACY, 89 MGMT_OP_LOAD_IRKS, 90 MGMT_OP_GET_CONN_INFO, 91 MGMT_OP_GET_CLOCK_INFO, 92 MGMT_OP_ADD_DEVICE, 93 MGMT_OP_REMOVE_DEVICE, 94 MGMT_OP_LOAD_CONN_PARAM, 95 MGMT_OP_READ_UNCONF_INDEX_LIST, 96 MGMT_OP_READ_CONFIG_INFO, 97 MGMT_OP_SET_EXTERNAL_CONFIG, 98 MGMT_OP_SET_PUBLIC_ADDRESS, 99 MGMT_OP_START_SERVICE_DISCOVERY, 100 MGMT_OP_READ_LOCAL_OOB_EXT_DATA, 101 MGMT_OP_READ_EXT_INDEX_LIST, 102 MGMT_OP_READ_ADV_FEATURES, 103 MGMT_OP_ADD_ADVERTISING, 104 MGMT_OP_REMOVE_ADVERTISING, 105 MGMT_OP_GET_ADV_SIZE_INFO, 106 MGMT_OP_START_LIMITED_DISCOVERY, 107 MGMT_OP_READ_EXT_INFO, 108 MGMT_OP_SET_APPEARANCE, 109 MGMT_OP_GET_PHY_CONFIGURATION, 110 MGMT_OP_SET_PHY_CONFIGURATION, 111 MGMT_OP_SET_BLOCKED_KEYS, 112 MGMT_OP_SET_WIDEBAND_SPEECH, 113 MGMT_OP_READ_CONTROLLER_CAP, 114 MGMT_OP_READ_EXP_FEATURES_INFO, 115 MGMT_OP_SET_EXP_FEATURE, 116 MGMT_OP_READ_DEF_SYSTEM_CONFIG, 117 MGMT_OP_SET_DEF_SYSTEM_CONFIG, 118 MGMT_OP_READ_DEF_RUNTIME_CONFIG, 119 MGMT_OP_SET_DEF_RUNTIME_CONFIG, 120 MGMT_OP_GET_DEVICE_FLAGS, 121 MGMT_OP_SET_DEVICE_FLAGS, 122 MGMT_OP_READ_ADV_MONITOR_FEATURES, 123 MGMT_OP_ADD_ADV_PATTERNS_MONITOR, 124 MGMT_OP_REMOVE_ADV_MONITOR, 125 MGMT_OP_ADD_EXT_ADV_PARAMS, 126 MGMT_OP_ADD_EXT_ADV_DATA, 127 MGMT_OP_ADD_ADV_PATTERNS_MONITOR_RSSI, 128 MGMT_OP_SET_MESH_RECEIVER, 129 MGMT_OP_MESH_READ_FEATURES, 130 MGMT_OP_MESH_SEND, 131 MGMT_OP_MESH_SEND_CANCEL, 132 MGMT_OP_HCI_CMD_SYNC, 133 }; 134 135 static const u16 mgmt_events[] = { 136 MGMT_EV_CONTROLLER_ERROR, 137 MGMT_EV_INDEX_ADDED, 138 MGMT_EV_INDEX_REMOVED, 139 MGMT_EV_NEW_SETTINGS, 140 MGMT_EV_CLASS_OF_DEV_CHANGED, 141 MGMT_EV_LOCAL_NAME_CHANGED, 142 MGMT_EV_NEW_LINK_KEY, 143 MGMT_EV_NEW_LONG_TERM_KEY, 144 MGMT_EV_DEVICE_CONNECTED, 145 MGMT_EV_DEVICE_DISCONNECTED, 146 MGMT_EV_CONNECT_FAILED, 147 MGMT_EV_PIN_CODE_REQUEST, 148 MGMT_EV_USER_CONFIRM_REQUEST, 149 MGMT_EV_USER_PASSKEY_REQUEST, 150 MGMT_EV_AUTH_FAILED, 151 MGMT_EV_DEVICE_FOUND, 152 MGMT_EV_DISCOVERING, 153 MGMT_EV_DEVICE_BLOCKED, 154 MGMT_EV_DEVICE_UNBLOCKED, 155 MGMT_EV_DEVICE_UNPAIRED, 156 MGMT_EV_PASSKEY_NOTIFY, 157 MGMT_EV_NEW_IRK, 158 MGMT_EV_NEW_CSRK, 159 MGMT_EV_DEVICE_ADDED, 160 MGMT_EV_DEVICE_REMOVED, 161 MGMT_EV_NEW_CONN_PARAM, 162 MGMT_EV_UNCONF_INDEX_ADDED, 163 MGMT_EV_UNCONF_INDEX_REMOVED, 164 MGMT_EV_NEW_CONFIG_OPTIONS, 165 MGMT_EV_EXT_INDEX_ADDED, 166 MGMT_EV_EXT_INDEX_REMOVED, 167 MGMT_EV_LOCAL_OOB_DATA_UPDATED, 168 MGMT_EV_ADVERTISING_ADDED, 169 MGMT_EV_ADVERTISING_REMOVED, 170 MGMT_EV_EXT_INFO_CHANGED, 171 MGMT_EV_PHY_CONFIGURATION_CHANGED, 172 MGMT_EV_EXP_FEATURE_CHANGED, 173 MGMT_EV_DEVICE_FLAGS_CHANGED, 174 MGMT_EV_ADV_MONITOR_ADDED, 175 MGMT_EV_ADV_MONITOR_REMOVED, 176 MGMT_EV_CONTROLLER_SUSPEND, 177 MGMT_EV_CONTROLLER_RESUME, 178 MGMT_EV_ADV_MONITOR_DEVICE_FOUND, 179 MGMT_EV_ADV_MONITOR_DEVICE_LOST, 180 }; 181 182 static const u16 mgmt_untrusted_commands[] = { 183 MGMT_OP_READ_INDEX_LIST, 184 MGMT_OP_READ_INFO, 185 MGMT_OP_READ_UNCONF_INDEX_LIST, 186 MGMT_OP_READ_CONFIG_INFO, 187 MGMT_OP_READ_EXT_INDEX_LIST, 188 MGMT_OP_READ_EXT_INFO, 189 MGMT_OP_READ_CONTROLLER_CAP, 190 MGMT_OP_READ_EXP_FEATURES_INFO, 191 MGMT_OP_READ_DEF_SYSTEM_CONFIG, 192 MGMT_OP_READ_DEF_RUNTIME_CONFIG, 193 }; 194 195 static const u16 mgmt_untrusted_events[] = { 196 MGMT_EV_INDEX_ADDED, 197 MGMT_EV_INDEX_REMOVED, 198 MGMT_EV_NEW_SETTINGS, 199 MGMT_EV_CLASS_OF_DEV_CHANGED, 200 MGMT_EV_LOCAL_NAME_CHANGED, 201 MGMT_EV_UNCONF_INDEX_ADDED, 202 MGMT_EV_UNCONF_INDEX_REMOVED, 203 MGMT_EV_NEW_CONFIG_OPTIONS, 204 MGMT_EV_EXT_INDEX_ADDED, 205 MGMT_EV_EXT_INDEX_REMOVED, 206 MGMT_EV_EXT_INFO_CHANGED, 207 MGMT_EV_EXP_FEATURE_CHANGED, 208 }; 209 210 #define CACHE_TIMEOUT secs_to_jiffies(2) 211 212 #define ZERO_KEY "\x00\x00\x00\x00\x00\x00\x00\x00" \ 213 "\x00\x00\x00\x00\x00\x00\x00\x00" 214 215 /* HCI to MGMT error code conversion table */ 216 static const u8 mgmt_status_table[] = { 217 MGMT_STATUS_SUCCESS, 218 MGMT_STATUS_UNKNOWN_COMMAND, /* Unknown Command */ 219 MGMT_STATUS_NOT_CONNECTED, /* No Connection */ 220 MGMT_STATUS_FAILED, /* Hardware Failure */ 221 MGMT_STATUS_CONNECT_FAILED, /* Page Timeout */ 222 MGMT_STATUS_AUTH_FAILED, /* Authentication Failed */ 223 MGMT_STATUS_AUTH_FAILED, /* PIN or Key Missing */ 224 MGMT_STATUS_NO_RESOURCES, /* Memory Full */ 225 MGMT_STATUS_TIMEOUT, /* Connection Timeout */ 226 MGMT_STATUS_NO_RESOURCES, /* Max Number of Connections */ 227 MGMT_STATUS_NO_RESOURCES, /* Max Number of SCO Connections */ 228 MGMT_STATUS_ALREADY_CONNECTED, /* ACL Connection Exists */ 229 MGMT_STATUS_BUSY, /* Command Disallowed */ 230 MGMT_STATUS_NO_RESOURCES, /* Rejected Limited Resources */ 231 MGMT_STATUS_REJECTED, /* Rejected Security */ 232 MGMT_STATUS_REJECTED, /* Rejected Personal */ 233 MGMT_STATUS_TIMEOUT, /* Host Timeout */ 234 MGMT_STATUS_NOT_SUPPORTED, /* Unsupported Feature */ 235 MGMT_STATUS_INVALID_PARAMS, /* Invalid Parameters */ 236 MGMT_STATUS_DISCONNECTED, /* OE User Ended Connection */ 237 MGMT_STATUS_NO_RESOURCES, /* OE Low Resources */ 238 MGMT_STATUS_DISCONNECTED, /* OE Power Off */ 239 MGMT_STATUS_DISCONNECTED, /* Connection Terminated */ 240 MGMT_STATUS_BUSY, /* Repeated Attempts */ 241 MGMT_STATUS_REJECTED, /* Pairing Not Allowed */ 242 MGMT_STATUS_FAILED, /* Unknown LMP PDU */ 243 MGMT_STATUS_NOT_SUPPORTED, /* Unsupported Remote Feature */ 244 MGMT_STATUS_REJECTED, /* SCO Offset Rejected */ 245 MGMT_STATUS_REJECTED, /* SCO Interval Rejected */ 246 MGMT_STATUS_REJECTED, /* Air Mode Rejected */ 247 MGMT_STATUS_INVALID_PARAMS, /* Invalid LMP Parameters */ 248 MGMT_STATUS_FAILED, /* Unspecified Error */ 249 MGMT_STATUS_NOT_SUPPORTED, /* Unsupported LMP Parameter Value */ 250 MGMT_STATUS_FAILED, /* Role Change Not Allowed */ 251 MGMT_STATUS_TIMEOUT, /* LMP Response Timeout */ 252 MGMT_STATUS_FAILED, /* LMP Error Transaction Collision */ 253 MGMT_STATUS_FAILED, /* LMP PDU Not Allowed */ 254 MGMT_STATUS_REJECTED, /* Encryption Mode Not Accepted */ 255 MGMT_STATUS_FAILED, /* Unit Link Key Used */ 256 MGMT_STATUS_NOT_SUPPORTED, /* QoS Not Supported */ 257 MGMT_STATUS_TIMEOUT, /* Instant Passed */ 258 MGMT_STATUS_NOT_SUPPORTED, /* Pairing Not Supported */ 259 MGMT_STATUS_FAILED, /* Transaction Collision */ 260 MGMT_STATUS_FAILED, /* Reserved for future use */ 261 MGMT_STATUS_INVALID_PARAMS, /* Unacceptable Parameter */ 262 MGMT_STATUS_REJECTED, /* QoS Rejected */ 263 MGMT_STATUS_NOT_SUPPORTED, /* Classification Not Supported */ 264 MGMT_STATUS_REJECTED, /* Insufficient Security */ 265 MGMT_STATUS_INVALID_PARAMS, /* Parameter Out Of Range */ 266 MGMT_STATUS_FAILED, /* Reserved for future use */ 267 MGMT_STATUS_BUSY, /* Role Switch Pending */ 268 MGMT_STATUS_FAILED, /* Reserved for future use */ 269 MGMT_STATUS_FAILED, /* Slot Violation */ 270 MGMT_STATUS_FAILED, /* Role Switch Failed */ 271 MGMT_STATUS_INVALID_PARAMS, /* EIR Too Large */ 272 MGMT_STATUS_NOT_SUPPORTED, /* Simple Pairing Not Supported */ 273 MGMT_STATUS_BUSY, /* Host Busy Pairing */ 274 MGMT_STATUS_REJECTED, /* Rejected, No Suitable Channel */ 275 MGMT_STATUS_BUSY, /* Controller Busy */ 276 MGMT_STATUS_INVALID_PARAMS, /* Unsuitable Connection Interval */ 277 MGMT_STATUS_TIMEOUT, /* Directed Advertising Timeout */ 278 MGMT_STATUS_AUTH_FAILED, /* Terminated Due to MIC Failure */ 279 MGMT_STATUS_CONNECT_FAILED, /* Connection Establishment Failed */ 280 MGMT_STATUS_CONNECT_FAILED, /* MAC Connection Failed */ 281 }; 282 283 static u8 mgmt_errno_status(int err) 284 { 285 switch (err) { 286 case 0: 287 return MGMT_STATUS_SUCCESS; 288 case -EPERM: 289 return MGMT_STATUS_REJECTED; 290 case -EINVAL: 291 return MGMT_STATUS_INVALID_PARAMS; 292 case -EOPNOTSUPP: 293 return MGMT_STATUS_NOT_SUPPORTED; 294 case -EBUSY: 295 return MGMT_STATUS_BUSY; 296 case -ETIMEDOUT: 297 return MGMT_STATUS_AUTH_FAILED; 298 case -ENOMEM: 299 return MGMT_STATUS_NO_RESOURCES; 300 case -EISCONN: 301 return MGMT_STATUS_ALREADY_CONNECTED; 302 case -ENOTCONN: 303 return MGMT_STATUS_DISCONNECTED; 304 } 305 306 return MGMT_STATUS_FAILED; 307 } 308 309 static u8 mgmt_status(int err) 310 { 311 if (err < 0) 312 return mgmt_errno_status(err); 313 314 if (err < ARRAY_SIZE(mgmt_status_table)) 315 return mgmt_status_table[err]; 316 317 return MGMT_STATUS_FAILED; 318 } 319 320 static int mgmt_index_event(u16 event, struct hci_dev *hdev, void *data, 321 u16 len, int flag) 322 { 323 return mgmt_send_event(event, hdev, HCI_CHANNEL_CONTROL, data, len, 324 flag, NULL); 325 } 326 327 static int mgmt_limited_event(u16 event, struct hci_dev *hdev, void *data, 328 u16 len, int flag, struct sock *skip_sk) 329 { 330 return mgmt_send_event(event, hdev, HCI_CHANNEL_CONTROL, data, len, 331 flag, skip_sk); 332 } 333 334 static int mgmt_event(u16 event, struct hci_dev *hdev, void *data, u16 len, 335 struct sock *skip_sk) 336 { 337 return mgmt_send_event(event, hdev, HCI_CHANNEL_CONTROL, data, len, 338 HCI_SOCK_TRUSTED, skip_sk); 339 } 340 341 static int mgmt_event_skb(struct sk_buff *skb, struct sock *skip_sk) 342 { 343 return mgmt_send_event_skb(HCI_CHANNEL_CONTROL, skb, HCI_SOCK_TRUSTED, 344 skip_sk); 345 } 346 347 static u8 le_addr_type(u8 mgmt_addr_type) 348 { 349 if (mgmt_addr_type == BDADDR_LE_PUBLIC) 350 return ADDR_LE_DEV_PUBLIC; 351 else 352 return ADDR_LE_DEV_RANDOM; 353 } 354 355 void mgmt_fill_version_info(void *ver) 356 { 357 struct mgmt_rp_read_version *rp = ver; 358 359 rp->version = MGMT_VERSION; 360 rp->revision = cpu_to_le16(MGMT_REVISION); 361 } 362 363 static int read_version(struct sock *sk, struct hci_dev *hdev, void *data, 364 u16 data_len) 365 { 366 struct mgmt_rp_read_version rp; 367 368 bt_dev_dbg(hdev, "sock %p", sk); 369 370 mgmt_fill_version_info(&rp); 371 372 return mgmt_cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_VERSION, 0, 373 &rp, sizeof(rp)); 374 } 375 376 static int read_commands(struct sock *sk, struct hci_dev *hdev, void *data, 377 u16 data_len) 378 { 379 struct mgmt_rp_read_commands *rp; 380 u16 num_commands, num_events; 381 size_t rp_size; 382 int i, err; 383 384 bt_dev_dbg(hdev, "sock %p", sk); 385 386 if (hci_sock_test_flag(sk, HCI_SOCK_TRUSTED)) { 387 num_commands = ARRAY_SIZE(mgmt_commands); 388 num_events = ARRAY_SIZE(mgmt_events); 389 } else { 390 num_commands = ARRAY_SIZE(mgmt_untrusted_commands); 391 num_events = ARRAY_SIZE(mgmt_untrusted_events); 392 } 393 394 rp_size = sizeof(*rp) + ((num_commands + num_events) * sizeof(u16)); 395 396 rp = kmalloc(rp_size, GFP_KERNEL); 397 if (!rp) 398 return -ENOMEM; 399 400 rp->num_commands = cpu_to_le16(num_commands); 401 rp->num_events = cpu_to_le16(num_events); 402 403 if (hci_sock_test_flag(sk, HCI_SOCK_TRUSTED)) { 404 __le16 *opcode = rp->opcodes; 405 406 for (i = 0; i < num_commands; i++, opcode++) 407 put_unaligned_le16(mgmt_commands[i], opcode); 408 409 for (i = 0; i < num_events; i++, opcode++) 410 put_unaligned_le16(mgmt_events[i], opcode); 411 } else { 412 __le16 *opcode = rp->opcodes; 413 414 for (i = 0; i < num_commands; i++, opcode++) 415 put_unaligned_le16(mgmt_untrusted_commands[i], opcode); 416 417 for (i = 0; i < num_events; i++, opcode++) 418 put_unaligned_le16(mgmt_untrusted_events[i], opcode); 419 } 420 421 err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_COMMANDS, 0, 422 rp, rp_size); 423 kfree(rp); 424 425 return err; 426 } 427 428 static int read_index_list(struct sock *sk, struct hci_dev *hdev, void *data, 429 u16 data_len) 430 { 431 struct mgmt_rp_read_index_list *rp; 432 struct hci_dev *d; 433 size_t rp_len; 434 u16 count; 435 int err; 436 437 bt_dev_dbg(hdev, "sock %p", sk); 438 439 read_lock(&hci_dev_list_lock); 440 441 count = 0; 442 list_for_each_entry(d, &hci_dev_list, list) { 443 if (!hci_dev_test_flag(d, HCI_UNCONFIGURED)) 444 count++; 445 } 446 447 rp_len = sizeof(*rp) + (2 * count); 448 rp = kmalloc(rp_len, GFP_ATOMIC); 449 if (!rp) { 450 read_unlock(&hci_dev_list_lock); 451 return -ENOMEM; 452 } 453 454 count = 0; 455 list_for_each_entry(d, &hci_dev_list, list) { 456 if (hci_dev_test_flag(d, HCI_SETUP) || 457 hci_dev_test_flag(d, HCI_CONFIG) || 458 hci_dev_test_flag(d, HCI_USER_CHANNEL)) 459 continue; 460 461 /* Devices marked as raw-only are neither configured 462 * nor unconfigured controllers. 463 */ 464 if (hci_test_quirk(d, HCI_QUIRK_RAW_DEVICE)) 465 continue; 466 467 if (!hci_dev_test_flag(d, HCI_UNCONFIGURED)) { 468 rp->index[count++] = cpu_to_le16(d->id); 469 bt_dev_dbg(hdev, "Added hci%u", d->id); 470 } 471 } 472 473 rp->num_controllers = cpu_to_le16(count); 474 rp_len = sizeof(*rp) + (2 * count); 475 476 read_unlock(&hci_dev_list_lock); 477 478 err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_INDEX_LIST, 479 0, rp, rp_len); 480 481 kfree(rp); 482 483 return err; 484 } 485 486 static int read_unconf_index_list(struct sock *sk, struct hci_dev *hdev, 487 void *data, u16 data_len) 488 { 489 struct mgmt_rp_read_unconf_index_list *rp; 490 struct hci_dev *d; 491 size_t rp_len; 492 u16 count; 493 int err; 494 495 bt_dev_dbg(hdev, "sock %p", sk); 496 497 read_lock(&hci_dev_list_lock); 498 499 count = 0; 500 list_for_each_entry(d, &hci_dev_list, list) { 501 if (hci_dev_test_flag(d, HCI_UNCONFIGURED)) 502 count++; 503 } 504 505 rp_len = sizeof(*rp) + (2 * count); 506 rp = kmalloc(rp_len, GFP_ATOMIC); 507 if (!rp) { 508 read_unlock(&hci_dev_list_lock); 509 return -ENOMEM; 510 } 511 512 count = 0; 513 list_for_each_entry(d, &hci_dev_list, list) { 514 if (hci_dev_test_flag(d, HCI_SETUP) || 515 hci_dev_test_flag(d, HCI_CONFIG) || 516 hci_dev_test_flag(d, HCI_USER_CHANNEL)) 517 continue; 518 519 /* Devices marked as raw-only are neither configured 520 * nor unconfigured controllers. 521 */ 522 if (hci_test_quirk(d, HCI_QUIRK_RAW_DEVICE)) 523 continue; 524 525 if (hci_dev_test_flag(d, HCI_UNCONFIGURED)) { 526 rp->index[count++] = cpu_to_le16(d->id); 527 bt_dev_dbg(hdev, "Added hci%u", d->id); 528 } 529 } 530 531 rp->num_controllers = cpu_to_le16(count); 532 rp_len = sizeof(*rp) + (2 * count); 533 534 read_unlock(&hci_dev_list_lock); 535 536 err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE, 537 MGMT_OP_READ_UNCONF_INDEX_LIST, 0, rp, rp_len); 538 539 kfree(rp); 540 541 return err; 542 } 543 544 static int read_ext_index_list(struct sock *sk, struct hci_dev *hdev, 545 void *data, u16 data_len) 546 { 547 struct mgmt_rp_read_ext_index_list *rp; 548 struct hci_dev *d; 549 u16 count; 550 int err; 551 552 bt_dev_dbg(hdev, "sock %p", sk); 553 554 read_lock(&hci_dev_list_lock); 555 556 count = 0; 557 list_for_each_entry(d, &hci_dev_list, list) 558 count++; 559 560 rp = kmalloc_flex(*rp, entry, count, GFP_ATOMIC); 561 if (!rp) { 562 read_unlock(&hci_dev_list_lock); 563 return -ENOMEM; 564 } 565 566 count = 0; 567 list_for_each_entry(d, &hci_dev_list, list) { 568 if (hci_dev_test_flag(d, HCI_SETUP) || 569 hci_dev_test_flag(d, HCI_CONFIG) || 570 hci_dev_test_flag(d, HCI_USER_CHANNEL)) 571 continue; 572 573 /* Devices marked as raw-only are neither configured 574 * nor unconfigured controllers. 575 */ 576 if (hci_test_quirk(d, HCI_QUIRK_RAW_DEVICE)) 577 continue; 578 579 if (hci_dev_test_flag(d, HCI_UNCONFIGURED)) 580 rp->entry[count].type = 0x01; 581 else 582 rp->entry[count].type = 0x00; 583 584 rp->entry[count].bus = d->bus; 585 rp->entry[count++].index = cpu_to_le16(d->id); 586 bt_dev_dbg(hdev, "Added hci%u", d->id); 587 } 588 589 rp->num_controllers = cpu_to_le16(count); 590 591 read_unlock(&hci_dev_list_lock); 592 593 /* If this command is called at least once, then all the 594 * default index and unconfigured index events are disabled 595 * and from now on only extended index events are used. 596 */ 597 hci_sock_set_flag(sk, HCI_MGMT_EXT_INDEX_EVENTS); 598 hci_sock_clear_flag(sk, HCI_MGMT_INDEX_EVENTS); 599 hci_sock_clear_flag(sk, HCI_MGMT_UNCONF_INDEX_EVENTS); 600 601 err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE, 602 MGMT_OP_READ_EXT_INDEX_LIST, 0, rp, 603 struct_size(rp, entry, count)); 604 605 kfree(rp); 606 607 return err; 608 } 609 610 static bool is_configured(struct hci_dev *hdev) 611 { 612 if (hci_test_quirk(hdev, HCI_QUIRK_EXTERNAL_CONFIG) && 613 !hci_dev_test_flag(hdev, HCI_EXT_CONFIGURED)) 614 return false; 615 616 if ((hci_test_quirk(hdev, HCI_QUIRK_INVALID_BDADDR) || 617 hci_test_quirk(hdev, HCI_QUIRK_USE_BDADDR_PROPERTY)) && 618 !bacmp(&hdev->public_addr, BDADDR_ANY)) 619 return false; 620 621 return true; 622 } 623 624 static __le32 get_missing_options(struct hci_dev *hdev) 625 { 626 u32 options = 0; 627 628 if (hci_test_quirk(hdev, HCI_QUIRK_EXTERNAL_CONFIG) && 629 !hci_dev_test_flag(hdev, HCI_EXT_CONFIGURED)) 630 options |= MGMT_OPTION_EXTERNAL_CONFIG; 631 632 if ((hci_test_quirk(hdev, HCI_QUIRK_INVALID_BDADDR) || 633 hci_test_quirk(hdev, HCI_QUIRK_USE_BDADDR_PROPERTY)) && 634 !bacmp(&hdev->public_addr, BDADDR_ANY)) 635 options |= MGMT_OPTION_PUBLIC_ADDRESS; 636 637 return cpu_to_le32(options); 638 } 639 640 static int new_options(struct hci_dev *hdev, struct sock *skip) 641 { 642 __le32 options = get_missing_options(hdev); 643 644 return mgmt_limited_event(MGMT_EV_NEW_CONFIG_OPTIONS, hdev, &options, 645 sizeof(options), HCI_MGMT_OPTION_EVENTS, skip); 646 } 647 648 static int send_options_rsp(struct sock *sk, u16 opcode, struct hci_dev *hdev) 649 { 650 __le32 options = get_missing_options(hdev); 651 652 return mgmt_cmd_complete(sk, hdev->id, opcode, 0, &options, 653 sizeof(options)); 654 } 655 656 static int read_config_info(struct sock *sk, struct hci_dev *hdev, 657 void *data, u16 data_len) 658 { 659 struct mgmt_rp_read_config_info rp; 660 u32 options = 0; 661 662 bt_dev_dbg(hdev, "sock %p", sk); 663 664 hci_dev_lock(hdev); 665 666 memset(&rp, 0, sizeof(rp)); 667 rp.manufacturer = cpu_to_le16(hdev->manufacturer); 668 669 if (hci_test_quirk(hdev, HCI_QUIRK_EXTERNAL_CONFIG)) 670 options |= MGMT_OPTION_EXTERNAL_CONFIG; 671 672 if (hdev->set_bdaddr) 673 options |= MGMT_OPTION_PUBLIC_ADDRESS; 674 675 rp.supported_options = cpu_to_le32(options); 676 rp.missing_options = get_missing_options(hdev); 677 678 hci_dev_unlock(hdev); 679 680 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_CONFIG_INFO, 0, 681 &rp, sizeof(rp)); 682 } 683 684 static u32 get_supported_phys(struct hci_dev *hdev) 685 { 686 u32 supported_phys = 0; 687 688 if (lmp_bredr_capable(hdev)) { 689 supported_phys |= MGMT_PHY_BR_1M_1SLOT; 690 691 if (hdev->features[0][0] & LMP_3SLOT) 692 supported_phys |= MGMT_PHY_BR_1M_3SLOT; 693 694 if (hdev->features[0][0] & LMP_5SLOT) 695 supported_phys |= MGMT_PHY_BR_1M_5SLOT; 696 697 if (lmp_edr_2m_capable(hdev)) { 698 supported_phys |= MGMT_PHY_EDR_2M_1SLOT; 699 700 if (lmp_edr_3slot_capable(hdev)) 701 supported_phys |= MGMT_PHY_EDR_2M_3SLOT; 702 703 if (lmp_edr_5slot_capable(hdev)) 704 supported_phys |= MGMT_PHY_EDR_2M_5SLOT; 705 706 if (lmp_edr_3m_capable(hdev)) { 707 supported_phys |= MGMT_PHY_EDR_3M_1SLOT; 708 709 if (lmp_edr_3slot_capable(hdev)) 710 supported_phys |= MGMT_PHY_EDR_3M_3SLOT; 711 712 if (lmp_edr_5slot_capable(hdev)) 713 supported_phys |= MGMT_PHY_EDR_3M_5SLOT; 714 } 715 } 716 } 717 718 if (lmp_le_capable(hdev)) { 719 supported_phys |= MGMT_PHY_LE_1M_TX; 720 supported_phys |= MGMT_PHY_LE_1M_RX; 721 722 if (hdev->le_features[1] & HCI_LE_PHY_2M) { 723 supported_phys |= MGMT_PHY_LE_2M_TX; 724 supported_phys |= MGMT_PHY_LE_2M_RX; 725 } 726 727 if (hdev->le_features[1] & HCI_LE_PHY_CODED) { 728 supported_phys |= MGMT_PHY_LE_CODED_TX; 729 supported_phys |= MGMT_PHY_LE_CODED_RX; 730 } 731 } 732 733 return supported_phys; 734 } 735 736 static u32 get_selected_phys(struct hci_dev *hdev) 737 { 738 u32 selected_phys = 0; 739 740 if (lmp_bredr_capable(hdev)) { 741 selected_phys |= MGMT_PHY_BR_1M_1SLOT; 742 743 if (hdev->pkt_type & (HCI_DM3 | HCI_DH3)) 744 selected_phys |= MGMT_PHY_BR_1M_3SLOT; 745 746 if (hdev->pkt_type & (HCI_DM5 | HCI_DH5)) 747 selected_phys |= MGMT_PHY_BR_1M_5SLOT; 748 749 if (lmp_edr_2m_capable(hdev)) { 750 if (!(hdev->pkt_type & HCI_2DH1)) 751 selected_phys |= MGMT_PHY_EDR_2M_1SLOT; 752 753 if (lmp_edr_3slot_capable(hdev) && 754 !(hdev->pkt_type & HCI_2DH3)) 755 selected_phys |= MGMT_PHY_EDR_2M_3SLOT; 756 757 if (lmp_edr_5slot_capable(hdev) && 758 !(hdev->pkt_type & HCI_2DH5)) 759 selected_phys |= MGMT_PHY_EDR_2M_5SLOT; 760 761 if (lmp_edr_3m_capable(hdev)) { 762 if (!(hdev->pkt_type & HCI_3DH1)) 763 selected_phys |= MGMT_PHY_EDR_3M_1SLOT; 764 765 if (lmp_edr_3slot_capable(hdev) && 766 !(hdev->pkt_type & HCI_3DH3)) 767 selected_phys |= MGMT_PHY_EDR_3M_3SLOT; 768 769 if (lmp_edr_5slot_capable(hdev) && 770 !(hdev->pkt_type & HCI_3DH5)) 771 selected_phys |= MGMT_PHY_EDR_3M_5SLOT; 772 } 773 } 774 } 775 776 if (lmp_le_capable(hdev)) { 777 if (hdev->le_tx_def_phys & HCI_LE_SET_PHY_1M) 778 selected_phys |= MGMT_PHY_LE_1M_TX; 779 780 if (hdev->le_rx_def_phys & HCI_LE_SET_PHY_1M) 781 selected_phys |= MGMT_PHY_LE_1M_RX; 782 783 if (hdev->le_tx_def_phys & HCI_LE_SET_PHY_2M) 784 selected_phys |= MGMT_PHY_LE_2M_TX; 785 786 if (hdev->le_rx_def_phys & HCI_LE_SET_PHY_2M) 787 selected_phys |= MGMT_PHY_LE_2M_RX; 788 789 if (hdev->le_tx_def_phys & HCI_LE_SET_PHY_CODED) 790 selected_phys |= MGMT_PHY_LE_CODED_TX; 791 792 if (hdev->le_rx_def_phys & HCI_LE_SET_PHY_CODED) 793 selected_phys |= MGMT_PHY_LE_CODED_RX; 794 } 795 796 return selected_phys; 797 } 798 799 static u32 get_configurable_phys(struct hci_dev *hdev) 800 { 801 return (get_supported_phys(hdev) & ~MGMT_PHY_BR_1M_1SLOT & 802 ~MGMT_PHY_LE_1M_TX & ~MGMT_PHY_LE_1M_RX); 803 } 804 805 static u32 get_supported_settings(struct hci_dev *hdev) 806 { 807 u32 settings = 0; 808 809 settings |= MGMT_SETTING_POWERED; 810 settings |= MGMT_SETTING_BONDABLE; 811 settings |= MGMT_SETTING_DEBUG_KEYS; 812 settings |= MGMT_SETTING_CONNECTABLE; 813 settings |= MGMT_SETTING_DISCOVERABLE; 814 815 if (lmp_bredr_capable(hdev)) { 816 if (hdev->hci_ver >= BLUETOOTH_VER_1_2) 817 settings |= MGMT_SETTING_FAST_CONNECTABLE; 818 settings |= MGMT_SETTING_BREDR; 819 settings |= MGMT_SETTING_LINK_SECURITY; 820 821 if (lmp_ssp_capable(hdev)) { 822 settings |= MGMT_SETTING_SSP; 823 } 824 825 if (lmp_sc_capable(hdev)) 826 settings |= MGMT_SETTING_SECURE_CONN; 827 828 if (hci_test_quirk(hdev, HCI_QUIRK_WIDEBAND_SPEECH_SUPPORTED)) 829 settings |= MGMT_SETTING_WIDEBAND_SPEECH; 830 } 831 832 if (lmp_le_capable(hdev)) { 833 settings |= MGMT_SETTING_LE; 834 settings |= MGMT_SETTING_SECURE_CONN; 835 settings |= MGMT_SETTING_PRIVACY; 836 settings |= MGMT_SETTING_STATIC_ADDRESS; 837 settings |= MGMT_SETTING_ADVERTISING; 838 } 839 840 if (hci_test_quirk(hdev, HCI_QUIRK_EXTERNAL_CONFIG) || hdev->set_bdaddr) 841 settings |= MGMT_SETTING_CONFIGURATION; 842 843 if (cis_central_capable(hdev)) 844 settings |= MGMT_SETTING_CIS_CENTRAL; 845 846 if (cis_peripheral_capable(hdev)) 847 settings |= MGMT_SETTING_CIS_PERIPHERAL; 848 849 if (bis_capable(hdev)) 850 settings |= MGMT_SETTING_ISO_BROADCASTER; 851 852 if (sync_recv_capable(hdev)) 853 settings |= MGMT_SETTING_ISO_SYNC_RECEIVER; 854 855 if (ll_privacy_capable(hdev)) 856 settings |= MGMT_SETTING_LL_PRIVACY; 857 858 if (past_sender_capable(hdev)) 859 settings |= MGMT_SETTING_PAST_SENDER; 860 861 if (past_receiver_capable(hdev)) 862 settings |= MGMT_SETTING_PAST_RECEIVER; 863 864 settings |= MGMT_SETTING_PHY_CONFIGURATION; 865 866 return settings; 867 } 868 869 static u32 get_current_settings(struct hci_dev *hdev) 870 { 871 u32 settings = 0; 872 873 if (hdev_is_powered(hdev)) 874 settings |= MGMT_SETTING_POWERED; 875 876 if (hci_dev_test_flag(hdev, HCI_CONNECTABLE)) 877 settings |= MGMT_SETTING_CONNECTABLE; 878 879 if (hci_dev_test_flag(hdev, HCI_FAST_CONNECTABLE)) 880 settings |= MGMT_SETTING_FAST_CONNECTABLE; 881 882 if (hci_dev_test_flag(hdev, HCI_DISCOVERABLE)) 883 settings |= MGMT_SETTING_DISCOVERABLE; 884 885 if (hci_dev_test_flag(hdev, HCI_BONDABLE)) 886 settings |= MGMT_SETTING_BONDABLE; 887 888 if (hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) 889 settings |= MGMT_SETTING_BREDR; 890 891 if (hci_dev_test_flag(hdev, HCI_LE_ENABLED)) 892 settings |= MGMT_SETTING_LE; 893 894 if (hci_dev_test_flag(hdev, HCI_LINK_SECURITY)) 895 settings |= MGMT_SETTING_LINK_SECURITY; 896 897 if (hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) 898 settings |= MGMT_SETTING_SSP; 899 900 if (hci_dev_test_flag(hdev, HCI_ADVERTISING)) 901 settings |= MGMT_SETTING_ADVERTISING; 902 903 if (hci_dev_test_flag(hdev, HCI_SC_ENABLED)) 904 settings |= MGMT_SETTING_SECURE_CONN; 905 906 if (hci_dev_test_flag(hdev, HCI_KEEP_DEBUG_KEYS)) 907 settings |= MGMT_SETTING_DEBUG_KEYS; 908 909 if (hci_dev_test_flag(hdev, HCI_PRIVACY)) 910 settings |= MGMT_SETTING_PRIVACY; 911 912 /* The current setting for static address has two purposes. The 913 * first is to indicate if the static address will be used and 914 * the second is to indicate if it is actually set. 915 * 916 * This means if the static address is not configured, this flag 917 * will never be set. If the address is configured, then if the 918 * address is actually used decides if the flag is set or not. 919 * 920 * For single mode LE only controllers and dual-mode controllers 921 * with BR/EDR disabled, the existence of the static address will 922 * be evaluated. 923 */ 924 if (hci_dev_test_flag(hdev, HCI_FORCE_STATIC_ADDR) || 925 !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) || 926 !bacmp(&hdev->bdaddr, BDADDR_ANY)) { 927 if (bacmp(&hdev->static_addr, BDADDR_ANY)) 928 settings |= MGMT_SETTING_STATIC_ADDRESS; 929 } 930 931 if (hci_dev_test_flag(hdev, HCI_WIDEBAND_SPEECH_ENABLED)) 932 settings |= MGMT_SETTING_WIDEBAND_SPEECH; 933 934 if (cis_central_enabled(hdev)) 935 settings |= MGMT_SETTING_CIS_CENTRAL; 936 937 if (cis_peripheral_enabled(hdev)) 938 settings |= MGMT_SETTING_CIS_PERIPHERAL; 939 940 if (bis_enabled(hdev)) 941 settings |= MGMT_SETTING_ISO_BROADCASTER; 942 943 if (sync_recv_enabled(hdev)) 944 settings |= MGMT_SETTING_ISO_SYNC_RECEIVER; 945 946 if (ll_privacy_enabled(hdev)) 947 settings |= MGMT_SETTING_LL_PRIVACY; 948 949 if (past_sender_enabled(hdev)) 950 settings |= MGMT_SETTING_PAST_SENDER; 951 952 if (past_receiver_enabled(hdev)) 953 settings |= MGMT_SETTING_PAST_RECEIVER; 954 955 return settings; 956 } 957 958 static struct mgmt_pending_cmd *pending_find(u16 opcode, struct hci_dev *hdev) 959 { 960 return mgmt_pending_find(HCI_CHANNEL_CONTROL, opcode, hdev); 961 } 962 963 u8 mgmt_get_adv_discov_flags(struct hci_dev *hdev) 964 { 965 struct mgmt_pending_cmd *cmd; 966 967 /* If there's a pending mgmt command the flags will not yet have 968 * their final values, so check for this first. 969 */ 970 cmd = pending_find(MGMT_OP_SET_DISCOVERABLE, hdev); 971 if (cmd) { 972 struct mgmt_mode *cp = cmd->param; 973 if (cp->val == 0x01) 974 return LE_AD_GENERAL; 975 else if (cp->val == 0x02) 976 return LE_AD_LIMITED; 977 } else { 978 if (hci_dev_test_flag(hdev, HCI_LIMITED_DISCOVERABLE)) 979 return LE_AD_LIMITED; 980 else if (hci_dev_test_flag(hdev, HCI_DISCOVERABLE)) 981 return LE_AD_GENERAL; 982 } 983 984 return 0; 985 } 986 987 bool mgmt_get_connectable(struct hci_dev *hdev) 988 { 989 struct mgmt_pending_cmd *cmd; 990 991 /* If there's a pending mgmt command the flag will not yet have 992 * it's final value, so check for this first. 993 */ 994 cmd = pending_find(MGMT_OP_SET_CONNECTABLE, hdev); 995 if (cmd) { 996 struct mgmt_mode *cp = cmd->param; 997 998 return cp->val; 999 } 1000 1001 return hci_dev_test_flag(hdev, HCI_CONNECTABLE); 1002 } 1003 1004 static int service_cache_sync(struct hci_dev *hdev, void *data) 1005 { 1006 hci_update_eir_sync(hdev); 1007 hci_update_class_sync(hdev); 1008 1009 return 0; 1010 } 1011 1012 static void service_cache_off(struct work_struct *work) 1013 { 1014 struct hci_dev *hdev = container_of(work, struct hci_dev, 1015 service_cache.work); 1016 1017 if (!hci_dev_test_and_clear_flag(hdev, HCI_SERVICE_CACHE)) 1018 return; 1019 1020 hci_cmd_sync_queue(hdev, service_cache_sync, NULL, NULL); 1021 } 1022 1023 static int rpa_expired_sync(struct hci_dev *hdev, void *data) 1024 { 1025 /* The generation of a new RPA and programming it into the 1026 * controller happens in the hci_req_enable_advertising() 1027 * function. 1028 */ 1029 if (ext_adv_capable(hdev)) 1030 return hci_start_ext_adv_sync(hdev, hdev->cur_adv_instance); 1031 else 1032 return hci_enable_advertising_sync(hdev); 1033 } 1034 1035 static void rpa_expired(struct work_struct *work) 1036 { 1037 struct hci_dev *hdev = container_of(work, struct hci_dev, 1038 rpa_expired.work); 1039 1040 bt_dev_dbg(hdev, ""); 1041 1042 hci_dev_set_flag(hdev, HCI_RPA_EXPIRED); 1043 1044 if (!hci_dev_test_flag(hdev, HCI_ADVERTISING)) 1045 return; 1046 1047 hci_cmd_sync_queue(hdev, rpa_expired_sync, NULL, NULL); 1048 } 1049 1050 static int set_discoverable_sync(struct hci_dev *hdev, void *data); 1051 1052 static void discov_off(struct work_struct *work) 1053 { 1054 struct hci_dev *hdev = container_of(work, struct hci_dev, 1055 discov_off.work); 1056 1057 bt_dev_dbg(hdev, ""); 1058 1059 hci_dev_lock(hdev); 1060 1061 /* When discoverable timeout triggers, then just make sure 1062 * the limited discoverable flag is cleared. Even in the case 1063 * of a timeout triggered from general discoverable, it is 1064 * safe to unconditionally clear the flag. 1065 */ 1066 hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE); 1067 hci_dev_clear_flag(hdev, HCI_DISCOVERABLE); 1068 hdev->discov_timeout = 0; 1069 1070 hci_cmd_sync_queue(hdev, set_discoverable_sync, NULL, NULL); 1071 1072 mgmt_new_settings(hdev); 1073 1074 hci_dev_unlock(hdev); 1075 } 1076 1077 static int send_settings_rsp(struct sock *sk, u16 opcode, struct hci_dev *hdev); 1078 1079 static void mesh_send_complete(struct hci_dev *hdev, 1080 struct mgmt_mesh_tx *mesh_tx, bool silent) 1081 { 1082 u8 handle = mesh_tx->handle; 1083 1084 if (!silent) 1085 mgmt_event(MGMT_EV_MESH_PACKET_CMPLT, hdev, &handle, 1086 sizeof(handle), NULL); 1087 1088 mgmt_mesh_remove(mesh_tx); 1089 } 1090 1091 static int mesh_send_done_sync(struct hci_dev *hdev, void *data) 1092 { 1093 struct mgmt_mesh_tx *mesh_tx; 1094 1095 hci_dev_clear_flag(hdev, HCI_MESH_SENDING); 1096 if (list_empty(&hdev->adv_instances)) 1097 hci_disable_advertising_sync(hdev); 1098 mesh_tx = mgmt_mesh_next(hdev, NULL); 1099 1100 if (mesh_tx) 1101 mesh_send_complete(hdev, mesh_tx, false); 1102 1103 return 0; 1104 } 1105 1106 static int mesh_send_sync(struct hci_dev *hdev, void *data); 1107 static void mesh_send_start_complete(struct hci_dev *hdev, void *data, int err); 1108 static void mesh_next(struct hci_dev *hdev, void *data, int err) 1109 { 1110 struct mgmt_mesh_tx *mesh_tx = mgmt_mesh_next(hdev, NULL); 1111 1112 if (!mesh_tx) 1113 return; 1114 1115 err = hci_cmd_sync_queue(hdev, mesh_send_sync, mesh_tx, 1116 mesh_send_start_complete); 1117 1118 if (err < 0) 1119 mesh_send_complete(hdev, mesh_tx, false); 1120 else 1121 hci_dev_set_flag(hdev, HCI_MESH_SENDING); 1122 } 1123 1124 static void mesh_send_done(struct work_struct *work) 1125 { 1126 struct hci_dev *hdev = container_of(work, struct hci_dev, 1127 mesh_send_done.work); 1128 1129 if (!hci_dev_test_flag(hdev, HCI_MESH_SENDING)) 1130 return; 1131 1132 hci_cmd_sync_queue(hdev, mesh_send_done_sync, NULL, mesh_next); 1133 } 1134 1135 static void mgmt_init_hdev(struct sock *sk, struct hci_dev *hdev) 1136 { 1137 if (hci_dev_test_flag(hdev, HCI_MGMT)) 1138 return; 1139 1140 BT_INFO("MGMT ver %d.%d", MGMT_VERSION, MGMT_REVISION); 1141 1142 INIT_DELAYED_WORK(&hdev->discov_off, discov_off); 1143 INIT_DELAYED_WORK(&hdev->service_cache, service_cache_off); 1144 INIT_DELAYED_WORK(&hdev->rpa_expired, rpa_expired); 1145 INIT_DELAYED_WORK(&hdev->mesh_send_done, mesh_send_done); 1146 1147 /* Non-mgmt controlled devices get this bit set 1148 * implicitly so that pairing works for them, however 1149 * for mgmt we require user-space to explicitly enable 1150 * it 1151 */ 1152 hci_dev_clear_flag(hdev, HCI_BONDABLE); 1153 1154 hci_dev_set_flag(hdev, HCI_MGMT); 1155 } 1156 1157 static int read_controller_info(struct sock *sk, struct hci_dev *hdev, 1158 void *data, u16 data_len) 1159 { 1160 struct mgmt_rp_read_info rp; 1161 1162 bt_dev_dbg(hdev, "sock %p", sk); 1163 1164 hci_dev_lock(hdev); 1165 1166 memset(&rp, 0, sizeof(rp)); 1167 1168 bacpy(&rp.bdaddr, &hdev->bdaddr); 1169 1170 rp.version = hdev->hci_ver; 1171 rp.manufacturer = cpu_to_le16(hdev->manufacturer); 1172 1173 rp.supported_settings = cpu_to_le32(get_supported_settings(hdev)); 1174 rp.current_settings = cpu_to_le32(get_current_settings(hdev)); 1175 1176 memcpy(rp.dev_class, hdev->dev_class, 3); 1177 1178 memcpy(rp.name, hdev->dev_name, sizeof(hdev->dev_name)); 1179 memcpy(rp.short_name, hdev->short_name, sizeof(hdev->short_name)); 1180 1181 hci_dev_unlock(hdev); 1182 1183 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_INFO, 0, &rp, 1184 sizeof(rp)); 1185 } 1186 1187 static u16 append_eir_data_to_buf(struct hci_dev *hdev, u8 *eir) 1188 { 1189 u16 eir_len = 0; 1190 size_t name_len; 1191 1192 if (hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) 1193 eir_len = eir_append_data(eir, eir_len, EIR_CLASS_OF_DEV, 1194 hdev->dev_class, 3); 1195 1196 if (hci_dev_test_flag(hdev, HCI_LE_ENABLED)) 1197 eir_len = eir_append_le16(eir, eir_len, EIR_APPEARANCE, 1198 hdev->appearance); 1199 1200 name_len = strnlen(hdev->dev_name, sizeof(hdev->dev_name)); 1201 eir_len = eir_append_data(eir, eir_len, EIR_NAME_COMPLETE, 1202 hdev->dev_name, name_len); 1203 1204 name_len = strnlen(hdev->short_name, sizeof(hdev->short_name)); 1205 eir_len = eir_append_data(eir, eir_len, EIR_NAME_SHORT, 1206 hdev->short_name, name_len); 1207 1208 return eir_len; 1209 } 1210 1211 static int read_ext_controller_info(struct sock *sk, struct hci_dev *hdev, 1212 void *data, u16 data_len) 1213 { 1214 char buf[512]; 1215 struct mgmt_rp_read_ext_info *rp = (void *)buf; 1216 u16 eir_len; 1217 1218 bt_dev_dbg(hdev, "sock %p", sk); 1219 1220 memset(&buf, 0, sizeof(buf)); 1221 1222 hci_dev_lock(hdev); 1223 1224 bacpy(&rp->bdaddr, &hdev->bdaddr); 1225 1226 rp->version = hdev->hci_ver; 1227 rp->manufacturer = cpu_to_le16(hdev->manufacturer); 1228 1229 rp->supported_settings = cpu_to_le32(get_supported_settings(hdev)); 1230 rp->current_settings = cpu_to_le32(get_current_settings(hdev)); 1231 1232 1233 eir_len = append_eir_data_to_buf(hdev, rp->eir); 1234 rp->eir_len = cpu_to_le16(eir_len); 1235 1236 hci_dev_unlock(hdev); 1237 1238 /* If this command is called at least once, then the events 1239 * for class of device and local name changes are disabled 1240 * and only the new extended controller information event 1241 * is used. 1242 */ 1243 hci_sock_set_flag(sk, HCI_MGMT_EXT_INFO_EVENTS); 1244 hci_sock_clear_flag(sk, HCI_MGMT_DEV_CLASS_EVENTS); 1245 hci_sock_clear_flag(sk, HCI_MGMT_LOCAL_NAME_EVENTS); 1246 1247 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_EXT_INFO, 0, rp, 1248 sizeof(*rp) + eir_len); 1249 } 1250 1251 static int ext_info_changed(struct hci_dev *hdev, struct sock *skip) 1252 { 1253 char buf[512]; 1254 struct mgmt_ev_ext_info_changed *ev = (void *)buf; 1255 u16 eir_len; 1256 1257 memset(buf, 0, sizeof(buf)); 1258 1259 eir_len = append_eir_data_to_buf(hdev, ev->eir); 1260 ev->eir_len = cpu_to_le16(eir_len); 1261 1262 return mgmt_limited_event(MGMT_EV_EXT_INFO_CHANGED, hdev, ev, 1263 sizeof(*ev) + eir_len, 1264 HCI_MGMT_EXT_INFO_EVENTS, skip); 1265 } 1266 1267 static int send_settings_rsp(struct sock *sk, u16 opcode, struct hci_dev *hdev) 1268 { 1269 __le32 settings = cpu_to_le32(get_current_settings(hdev)); 1270 1271 return mgmt_cmd_complete(sk, hdev->id, opcode, 0, &settings, 1272 sizeof(settings)); 1273 } 1274 1275 void mgmt_advertising_added(struct sock *sk, struct hci_dev *hdev, u8 instance) 1276 { 1277 struct mgmt_ev_advertising_added ev; 1278 1279 ev.instance = instance; 1280 1281 mgmt_event(MGMT_EV_ADVERTISING_ADDED, hdev, &ev, sizeof(ev), sk); 1282 } 1283 1284 void mgmt_advertising_removed(struct sock *sk, struct hci_dev *hdev, 1285 u8 instance) 1286 { 1287 struct mgmt_ev_advertising_removed ev; 1288 1289 ev.instance = instance; 1290 1291 mgmt_event(MGMT_EV_ADVERTISING_REMOVED, hdev, &ev, sizeof(ev), sk); 1292 } 1293 1294 static void cancel_adv_timeout(struct hci_dev *hdev) 1295 { 1296 if (hdev->adv_instance_timeout) { 1297 hdev->adv_instance_timeout = 0; 1298 cancel_delayed_work(&hdev->adv_instance_expire); 1299 } 1300 } 1301 1302 /* This function requires the caller holds hdev->lock */ 1303 static void restart_le_actions(struct hci_dev *hdev) 1304 { 1305 struct hci_conn_params *p; 1306 1307 list_for_each_entry(p, &hdev->le_conn_params, list) { 1308 /* Needed for AUTO_OFF case where might not "really" 1309 * have been powered off. 1310 */ 1311 hci_pend_le_list_del_init(p); 1312 1313 switch (p->auto_connect) { 1314 case HCI_AUTO_CONN_DIRECT: 1315 case HCI_AUTO_CONN_ALWAYS: 1316 hci_pend_le_list_add(p, &hdev->pend_le_conns); 1317 break; 1318 case HCI_AUTO_CONN_REPORT: 1319 hci_pend_le_list_add(p, &hdev->pend_le_reports); 1320 break; 1321 default: 1322 break; 1323 } 1324 } 1325 } 1326 1327 static int new_settings(struct hci_dev *hdev, struct sock *skip) 1328 { 1329 __le32 ev = cpu_to_le32(get_current_settings(hdev)); 1330 1331 return mgmt_limited_event(MGMT_EV_NEW_SETTINGS, hdev, &ev, 1332 sizeof(ev), HCI_MGMT_SETTING_EVENTS, skip); 1333 } 1334 1335 static void mgmt_set_powered_complete(struct hci_dev *hdev, void *data, int err) 1336 { 1337 struct mgmt_pending_cmd *cmd = data; 1338 struct mgmt_mode *cp; 1339 1340 /* Make sure cmd still outstanding. */ 1341 if (err == -ECANCELED || !mgmt_pending_valid(hdev, cmd)) 1342 return; 1343 1344 cp = cmd->param; 1345 1346 bt_dev_dbg(hdev, "err %d", err); 1347 1348 if (!err) { 1349 if (cp->val) { 1350 hci_dev_lock(hdev); 1351 restart_le_actions(hdev); 1352 hci_update_passive_scan(hdev); 1353 hci_dev_unlock(hdev); 1354 } 1355 1356 send_settings_rsp(cmd->sk, cmd->opcode, hdev); 1357 1358 /* Only call new_setting for power on as power off is deferred 1359 * to hdev->power_off work which does call hci_dev_do_close. 1360 */ 1361 if (cp->val) 1362 new_settings(hdev, cmd->sk); 1363 } else { 1364 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_POWERED, 1365 mgmt_status(err)); 1366 } 1367 1368 mgmt_pending_free(cmd); 1369 } 1370 1371 static int set_powered_sync(struct hci_dev *hdev, void *data) 1372 { 1373 struct mgmt_pending_cmd *cmd = data; 1374 struct mgmt_mode cp; 1375 1376 mutex_lock(&hdev->mgmt_pending_lock); 1377 1378 /* Make sure cmd still outstanding. */ 1379 if (!__mgmt_pending_listed(hdev, cmd)) { 1380 mutex_unlock(&hdev->mgmt_pending_lock); 1381 return -ECANCELED; 1382 } 1383 1384 memcpy(&cp, cmd->param, sizeof(cp)); 1385 1386 mutex_unlock(&hdev->mgmt_pending_lock); 1387 1388 BT_DBG("%s", hdev->name); 1389 1390 return hci_set_powered_sync(hdev, cp.val); 1391 } 1392 1393 static int set_powered(struct sock *sk, struct hci_dev *hdev, void *data, 1394 u16 len) 1395 { 1396 struct mgmt_mode *cp = data; 1397 struct mgmt_pending_cmd *cmd; 1398 int err; 1399 1400 bt_dev_dbg(hdev, "sock %p", sk); 1401 1402 if (cp->val != 0x00 && cp->val != 0x01) 1403 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED, 1404 MGMT_STATUS_INVALID_PARAMS); 1405 1406 hci_dev_lock(hdev); 1407 1408 if (!cp->val) { 1409 if (hci_dev_test_flag(hdev, HCI_POWERING_DOWN)) { 1410 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED, 1411 MGMT_STATUS_BUSY); 1412 goto failed; 1413 } 1414 } 1415 1416 if (pending_find(MGMT_OP_SET_POWERED, hdev)) { 1417 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED, 1418 MGMT_STATUS_BUSY); 1419 goto failed; 1420 } 1421 1422 if (!!cp->val == hdev_is_powered(hdev)) { 1423 err = send_settings_rsp(sk, MGMT_OP_SET_POWERED, hdev); 1424 goto failed; 1425 } 1426 1427 cmd = mgmt_pending_add(sk, MGMT_OP_SET_POWERED, hdev, data, len); 1428 if (!cmd) { 1429 err = -ENOMEM; 1430 goto failed; 1431 } 1432 1433 /* Cancel potentially blocking sync operation before power off */ 1434 if (cp->val == 0x00) { 1435 hci_cmd_sync_cancel_sync(hdev, -EHOSTDOWN); 1436 err = hci_cmd_sync_queue(hdev, set_powered_sync, cmd, 1437 mgmt_set_powered_complete); 1438 } else { 1439 /* Use hci_cmd_sync_submit since hdev might not be running */ 1440 err = hci_cmd_sync_submit(hdev, set_powered_sync, cmd, 1441 mgmt_set_powered_complete); 1442 } 1443 1444 if (err < 0) 1445 mgmt_pending_remove(cmd); 1446 1447 failed: 1448 hci_dev_unlock(hdev); 1449 return err; 1450 } 1451 1452 int mgmt_new_settings(struct hci_dev *hdev) 1453 { 1454 return new_settings(hdev, NULL); 1455 } 1456 1457 struct cmd_lookup { 1458 struct sock *sk; 1459 struct hci_dev *hdev; 1460 u8 mgmt_status; 1461 }; 1462 1463 static void settings_rsp(struct mgmt_pending_cmd *cmd, void *data) 1464 { 1465 struct cmd_lookup *match = data; 1466 1467 send_settings_rsp(cmd->sk, cmd->opcode, match->hdev); 1468 1469 if (match->sk == NULL) { 1470 match->sk = cmd->sk; 1471 sock_hold(match->sk); 1472 } 1473 } 1474 1475 static void cmd_status_rsp(struct mgmt_pending_cmd *cmd, void *data) 1476 { 1477 u8 *status = data; 1478 1479 mgmt_cmd_status(cmd->sk, cmd->hdev->id, cmd->opcode, *status); 1480 } 1481 1482 static void cmd_complete_rsp(struct mgmt_pending_cmd *cmd, void *data) 1483 { 1484 struct cmd_lookup *match = data; 1485 1486 /* dequeue cmd_sync entries using cmd as data as that is about to be 1487 * removed/freed. 1488 */ 1489 hci_cmd_sync_dequeue(match->hdev, NULL, cmd, NULL); 1490 1491 if (cmd->cmd_complete) { 1492 cmd->cmd_complete(cmd, match->mgmt_status); 1493 return; 1494 } 1495 1496 cmd_status_rsp(cmd, data); 1497 } 1498 1499 static int generic_cmd_complete(struct mgmt_pending_cmd *cmd, u8 status) 1500 { 1501 return mgmt_cmd_complete(cmd->sk, cmd->hdev->id, cmd->opcode, status, 1502 cmd->param, cmd->param_len); 1503 } 1504 1505 static int addr_cmd_complete(struct mgmt_pending_cmd *cmd, u8 status) 1506 { 1507 return mgmt_cmd_complete(cmd->sk, cmd->hdev->id, cmd->opcode, status, 1508 cmd->param, sizeof(struct mgmt_addr_info)); 1509 } 1510 1511 static u8 mgmt_bredr_support(struct hci_dev *hdev) 1512 { 1513 if (!lmp_bredr_capable(hdev)) 1514 return MGMT_STATUS_NOT_SUPPORTED; 1515 else if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) 1516 return MGMT_STATUS_REJECTED; 1517 else 1518 return MGMT_STATUS_SUCCESS; 1519 } 1520 1521 static u8 mgmt_le_support(struct hci_dev *hdev) 1522 { 1523 if (!lmp_le_capable(hdev)) 1524 return MGMT_STATUS_NOT_SUPPORTED; 1525 else if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED)) 1526 return MGMT_STATUS_REJECTED; 1527 else 1528 return MGMT_STATUS_SUCCESS; 1529 } 1530 1531 static void mgmt_set_discoverable_complete(struct hci_dev *hdev, void *data, 1532 int err) 1533 { 1534 struct mgmt_pending_cmd *cmd = data; 1535 1536 bt_dev_dbg(hdev, "err %d", err); 1537 1538 /* Make sure cmd still outstanding. */ 1539 if (err == -ECANCELED || !mgmt_pending_valid(hdev, cmd)) 1540 return; 1541 1542 hci_dev_lock(hdev); 1543 1544 if (err) { 1545 u8 mgmt_err = mgmt_status(err); 1546 mgmt_cmd_status(cmd->sk, cmd->hdev->id, cmd->opcode, mgmt_err); 1547 hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE); 1548 goto done; 1549 } 1550 1551 if (hci_dev_test_flag(hdev, HCI_DISCOVERABLE) && 1552 hdev->discov_timeout > 0) { 1553 int to = secs_to_jiffies(hdev->discov_timeout); 1554 queue_delayed_work(hdev->req_workqueue, &hdev->discov_off, to); 1555 } 1556 1557 send_settings_rsp(cmd->sk, MGMT_OP_SET_DISCOVERABLE, hdev); 1558 new_settings(hdev, cmd->sk); 1559 1560 done: 1561 mgmt_pending_free(cmd); 1562 hci_dev_unlock(hdev); 1563 } 1564 1565 static int set_discoverable_sync(struct hci_dev *hdev, void *data) 1566 { 1567 if (!mgmt_pending_listed(hdev, data)) 1568 return -ECANCELED; 1569 1570 BT_DBG("%s", hdev->name); 1571 1572 return hci_update_discoverable_sync(hdev); 1573 } 1574 1575 static int set_discoverable(struct sock *sk, struct hci_dev *hdev, void *data, 1576 u16 len) 1577 { 1578 struct mgmt_cp_set_discoverable *cp = data; 1579 struct mgmt_pending_cmd *cmd; 1580 u16 timeout; 1581 int err; 1582 1583 bt_dev_dbg(hdev, "sock %p", sk); 1584 1585 if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED) && 1586 !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) 1587 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE, 1588 MGMT_STATUS_REJECTED); 1589 1590 if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02) 1591 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE, 1592 MGMT_STATUS_INVALID_PARAMS); 1593 1594 timeout = __le16_to_cpu(cp->timeout); 1595 1596 /* Disabling discoverable requires that no timeout is set, 1597 * and enabling limited discoverable requires a timeout. 1598 */ 1599 if ((cp->val == 0x00 && timeout > 0) || 1600 (cp->val == 0x02 && timeout == 0)) 1601 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE, 1602 MGMT_STATUS_INVALID_PARAMS); 1603 1604 hci_dev_lock(hdev); 1605 1606 if (!hdev_is_powered(hdev) && timeout > 0) { 1607 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE, 1608 MGMT_STATUS_NOT_POWERED); 1609 goto failed; 1610 } 1611 1612 if (pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) || 1613 pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) { 1614 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE, 1615 MGMT_STATUS_BUSY); 1616 goto failed; 1617 } 1618 1619 if (!hci_dev_test_flag(hdev, HCI_CONNECTABLE)) { 1620 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE, 1621 MGMT_STATUS_REJECTED); 1622 goto failed; 1623 } 1624 1625 if (hdev->advertising_paused) { 1626 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE, 1627 MGMT_STATUS_BUSY); 1628 goto failed; 1629 } 1630 1631 if (!hdev_is_powered(hdev)) { 1632 bool changed = false; 1633 1634 /* Setting limited discoverable when powered off is 1635 * not a valid operation since it requires a timeout 1636 * and so no need to check HCI_LIMITED_DISCOVERABLE. 1637 */ 1638 if (!!cp->val != hci_dev_test_flag(hdev, HCI_DISCOVERABLE)) { 1639 hci_dev_change_flag(hdev, HCI_DISCOVERABLE); 1640 changed = true; 1641 } 1642 1643 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev); 1644 if (err < 0) 1645 goto failed; 1646 1647 if (changed) 1648 err = new_settings(hdev, sk); 1649 1650 goto failed; 1651 } 1652 1653 /* If the current mode is the same, then just update the timeout 1654 * value with the new value. And if only the timeout gets updated, 1655 * then no need for any HCI transactions. 1656 */ 1657 if (!!cp->val == hci_dev_test_flag(hdev, HCI_DISCOVERABLE) && 1658 (cp->val == 0x02) == hci_dev_test_flag(hdev, 1659 HCI_LIMITED_DISCOVERABLE)) { 1660 cancel_delayed_work(&hdev->discov_off); 1661 hdev->discov_timeout = timeout; 1662 1663 if (cp->val && hdev->discov_timeout > 0) { 1664 int to = secs_to_jiffies(hdev->discov_timeout); 1665 queue_delayed_work(hdev->req_workqueue, 1666 &hdev->discov_off, to); 1667 } 1668 1669 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev); 1670 goto failed; 1671 } 1672 1673 cmd = mgmt_pending_add(sk, MGMT_OP_SET_DISCOVERABLE, hdev, data, len); 1674 if (!cmd) { 1675 err = -ENOMEM; 1676 goto failed; 1677 } 1678 1679 /* Cancel any potential discoverable timeout that might be 1680 * still active and store new timeout value. The arming of 1681 * the timeout happens in the complete handler. 1682 */ 1683 cancel_delayed_work(&hdev->discov_off); 1684 hdev->discov_timeout = timeout; 1685 1686 if (cp->val) 1687 hci_dev_set_flag(hdev, HCI_DISCOVERABLE); 1688 else 1689 hci_dev_clear_flag(hdev, HCI_DISCOVERABLE); 1690 1691 /* Limited discoverable mode */ 1692 if (cp->val == 0x02) 1693 hci_dev_set_flag(hdev, HCI_LIMITED_DISCOVERABLE); 1694 else 1695 hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE); 1696 1697 err = hci_cmd_sync_queue(hdev, set_discoverable_sync, cmd, 1698 mgmt_set_discoverable_complete); 1699 1700 if (err < 0) 1701 mgmt_pending_remove(cmd); 1702 1703 failed: 1704 hci_dev_unlock(hdev); 1705 return err; 1706 } 1707 1708 static void mgmt_set_connectable_complete(struct hci_dev *hdev, void *data, 1709 int err) 1710 { 1711 struct mgmt_pending_cmd *cmd = data; 1712 1713 bt_dev_dbg(hdev, "err %d", err); 1714 1715 /* Make sure cmd still outstanding. */ 1716 if (err == -ECANCELED || !mgmt_pending_valid(hdev, cmd)) 1717 return; 1718 1719 hci_dev_lock(hdev); 1720 1721 if (err) { 1722 u8 mgmt_err = mgmt_status(err); 1723 mgmt_cmd_status(cmd->sk, cmd->hdev->id, cmd->opcode, mgmt_err); 1724 goto done; 1725 } 1726 1727 send_settings_rsp(cmd->sk, MGMT_OP_SET_CONNECTABLE, hdev); 1728 new_settings(hdev, cmd->sk); 1729 1730 done: 1731 mgmt_pending_free(cmd); 1732 1733 hci_dev_unlock(hdev); 1734 } 1735 1736 static int set_connectable_update_settings(struct hci_dev *hdev, 1737 struct sock *sk, u8 val) 1738 { 1739 bool changed = false; 1740 int err; 1741 1742 if (!!val != hci_dev_test_flag(hdev, HCI_CONNECTABLE)) 1743 changed = true; 1744 1745 if (val) { 1746 hci_dev_set_flag(hdev, HCI_CONNECTABLE); 1747 } else { 1748 hci_dev_clear_flag(hdev, HCI_CONNECTABLE); 1749 hci_dev_clear_flag(hdev, HCI_DISCOVERABLE); 1750 } 1751 1752 err = send_settings_rsp(sk, MGMT_OP_SET_CONNECTABLE, hdev); 1753 if (err < 0) 1754 return err; 1755 1756 if (changed) { 1757 hci_update_scan(hdev); 1758 hci_update_passive_scan(hdev); 1759 return new_settings(hdev, sk); 1760 } 1761 1762 return 0; 1763 } 1764 1765 static int set_connectable_sync(struct hci_dev *hdev, void *data) 1766 { 1767 if (!mgmt_pending_listed(hdev, data)) 1768 return -ECANCELED; 1769 1770 BT_DBG("%s", hdev->name); 1771 1772 return hci_update_connectable_sync(hdev); 1773 } 1774 1775 static int set_connectable(struct sock *sk, struct hci_dev *hdev, void *data, 1776 u16 len) 1777 { 1778 struct mgmt_mode *cp = data; 1779 struct mgmt_pending_cmd *cmd; 1780 int err; 1781 1782 bt_dev_dbg(hdev, "sock %p", sk); 1783 1784 if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED) && 1785 !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) 1786 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE, 1787 MGMT_STATUS_REJECTED); 1788 1789 if (cp->val != 0x00 && cp->val != 0x01) 1790 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE, 1791 MGMT_STATUS_INVALID_PARAMS); 1792 1793 hci_dev_lock(hdev); 1794 1795 if (!hdev_is_powered(hdev)) { 1796 err = set_connectable_update_settings(hdev, sk, cp->val); 1797 goto failed; 1798 } 1799 1800 if (pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) || 1801 pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) { 1802 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE, 1803 MGMT_STATUS_BUSY); 1804 goto failed; 1805 } 1806 1807 cmd = mgmt_pending_add(sk, MGMT_OP_SET_CONNECTABLE, hdev, data, len); 1808 if (!cmd) { 1809 err = -ENOMEM; 1810 goto failed; 1811 } 1812 1813 if (cp->val) { 1814 hci_dev_set_flag(hdev, HCI_CONNECTABLE); 1815 } else { 1816 if (hdev->discov_timeout > 0) 1817 cancel_delayed_work(&hdev->discov_off); 1818 1819 hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE); 1820 hci_dev_clear_flag(hdev, HCI_DISCOVERABLE); 1821 hci_dev_clear_flag(hdev, HCI_CONNECTABLE); 1822 } 1823 1824 err = hci_cmd_sync_queue(hdev, set_connectable_sync, cmd, 1825 mgmt_set_connectable_complete); 1826 1827 if (err < 0) 1828 mgmt_pending_remove(cmd); 1829 1830 failed: 1831 hci_dev_unlock(hdev); 1832 return err; 1833 } 1834 1835 static int set_bondable(struct sock *sk, struct hci_dev *hdev, void *data, 1836 u16 len) 1837 { 1838 struct mgmt_mode *cp = data; 1839 bool changed; 1840 int err; 1841 1842 bt_dev_dbg(hdev, "sock %p", sk); 1843 1844 if (cp->val != 0x00 && cp->val != 0x01) 1845 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BONDABLE, 1846 MGMT_STATUS_INVALID_PARAMS); 1847 1848 hci_dev_lock(hdev); 1849 1850 if (cp->val) 1851 changed = !hci_dev_test_and_set_flag(hdev, HCI_BONDABLE); 1852 else 1853 changed = hci_dev_test_and_clear_flag(hdev, HCI_BONDABLE); 1854 1855 err = send_settings_rsp(sk, MGMT_OP_SET_BONDABLE, hdev); 1856 if (err < 0) 1857 goto unlock; 1858 1859 if (changed) { 1860 /* In limited privacy mode the change of bondable mode 1861 * may affect the local advertising address. 1862 */ 1863 hci_update_discoverable(hdev); 1864 1865 err = new_settings(hdev, sk); 1866 } 1867 1868 unlock: 1869 hci_dev_unlock(hdev); 1870 return err; 1871 } 1872 1873 static int set_link_security(struct sock *sk, struct hci_dev *hdev, void *data, 1874 u16 len) 1875 { 1876 struct mgmt_mode *cp = data; 1877 struct mgmt_pending_cmd *cmd; 1878 u8 val, status; 1879 int err; 1880 1881 bt_dev_dbg(hdev, "sock %p", sk); 1882 1883 status = mgmt_bredr_support(hdev); 1884 if (status) 1885 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY, 1886 status); 1887 1888 if (cp->val != 0x00 && cp->val != 0x01) 1889 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY, 1890 MGMT_STATUS_INVALID_PARAMS); 1891 1892 hci_dev_lock(hdev); 1893 1894 if (!hdev_is_powered(hdev)) { 1895 bool changed = false; 1896 1897 if (!!cp->val != hci_dev_test_flag(hdev, HCI_LINK_SECURITY)) { 1898 hci_dev_change_flag(hdev, HCI_LINK_SECURITY); 1899 changed = true; 1900 } 1901 1902 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev); 1903 if (err < 0) 1904 goto failed; 1905 1906 if (changed) 1907 err = new_settings(hdev, sk); 1908 1909 goto failed; 1910 } 1911 1912 if (pending_find(MGMT_OP_SET_LINK_SECURITY, hdev)) { 1913 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY, 1914 MGMT_STATUS_BUSY); 1915 goto failed; 1916 } 1917 1918 val = !!cp->val; 1919 1920 if (test_bit(HCI_AUTH, &hdev->flags) == val) { 1921 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev); 1922 goto failed; 1923 } 1924 1925 cmd = mgmt_pending_add(sk, MGMT_OP_SET_LINK_SECURITY, hdev, data, len); 1926 if (!cmd) { 1927 err = -ENOMEM; 1928 goto failed; 1929 } 1930 1931 err = hci_send_cmd(hdev, HCI_OP_WRITE_AUTH_ENABLE, sizeof(val), &val); 1932 if (err < 0) { 1933 mgmt_pending_remove(cmd); 1934 goto failed; 1935 } 1936 1937 failed: 1938 hci_dev_unlock(hdev); 1939 return err; 1940 } 1941 1942 static void set_ssp_complete(struct hci_dev *hdev, void *data, int err) 1943 { 1944 struct cmd_lookup match = { NULL, hdev }; 1945 struct mgmt_pending_cmd *cmd = data; 1946 struct mgmt_mode *cp; 1947 u8 enable; 1948 bool changed; 1949 1950 /* Make sure cmd still outstanding. */ 1951 if (err == -ECANCELED || !mgmt_pending_valid(hdev, cmd)) 1952 return; 1953 1954 cp = cmd->param; 1955 enable = cp->val; 1956 1957 if (err) { 1958 u8 mgmt_err = mgmt_status(err); 1959 1960 if (enable && hci_dev_test_and_clear_flag(hdev, 1961 HCI_SSP_ENABLED)) { 1962 new_settings(hdev, NULL); 1963 } 1964 1965 mgmt_cmd_status(cmd->sk, cmd->hdev->id, cmd->opcode, mgmt_err); 1966 mgmt_pending_free(cmd); 1967 return; 1968 } 1969 1970 if (enable) { 1971 changed = !hci_dev_test_and_set_flag(hdev, HCI_SSP_ENABLED); 1972 } else { 1973 changed = hci_dev_test_and_clear_flag(hdev, HCI_SSP_ENABLED); 1974 } 1975 1976 settings_rsp(cmd, &match); 1977 1978 if (changed) 1979 new_settings(hdev, match.sk); 1980 1981 if (match.sk) 1982 sock_put(match.sk); 1983 1984 hci_update_eir_sync(hdev); 1985 mgmt_pending_free(cmd); 1986 } 1987 1988 static int set_ssp_sync(struct hci_dev *hdev, void *data) 1989 { 1990 struct mgmt_pending_cmd *cmd = data; 1991 struct mgmt_mode cp; 1992 bool changed = false; 1993 int err; 1994 1995 mutex_lock(&hdev->mgmt_pending_lock); 1996 1997 if (!__mgmt_pending_listed(hdev, cmd)) { 1998 mutex_unlock(&hdev->mgmt_pending_lock); 1999 return -ECANCELED; 2000 } 2001 2002 memcpy(&cp, cmd->param, sizeof(cp)); 2003 2004 mutex_unlock(&hdev->mgmt_pending_lock); 2005 2006 if (cp.val) 2007 changed = !hci_dev_test_and_set_flag(hdev, HCI_SSP_ENABLED); 2008 2009 err = hci_write_ssp_mode_sync(hdev, cp.val); 2010 2011 if (!err && changed) 2012 hci_dev_clear_flag(hdev, HCI_SSP_ENABLED); 2013 2014 return err; 2015 } 2016 2017 static int set_ssp(struct sock *sk, struct hci_dev *hdev, void *data, u16 len) 2018 { 2019 struct mgmt_mode *cp = data; 2020 struct mgmt_pending_cmd *cmd; 2021 u8 status; 2022 int err; 2023 2024 bt_dev_dbg(hdev, "sock %p", sk); 2025 2026 status = mgmt_bredr_support(hdev); 2027 if (status) 2028 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP, status); 2029 2030 if (!lmp_ssp_capable(hdev)) 2031 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP, 2032 MGMT_STATUS_NOT_SUPPORTED); 2033 2034 if (cp->val != 0x00 && cp->val != 0x01) 2035 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP, 2036 MGMT_STATUS_INVALID_PARAMS); 2037 2038 hci_dev_lock(hdev); 2039 2040 if (!hdev_is_powered(hdev)) { 2041 bool changed; 2042 2043 if (cp->val) { 2044 changed = !hci_dev_test_and_set_flag(hdev, 2045 HCI_SSP_ENABLED); 2046 } else { 2047 changed = hci_dev_test_and_clear_flag(hdev, 2048 HCI_SSP_ENABLED); 2049 } 2050 2051 err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev); 2052 if (err < 0) 2053 goto failed; 2054 2055 if (changed) 2056 err = new_settings(hdev, sk); 2057 2058 goto failed; 2059 } 2060 2061 if (pending_find(MGMT_OP_SET_SSP, hdev)) { 2062 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP, 2063 MGMT_STATUS_BUSY); 2064 goto failed; 2065 } 2066 2067 if (!!cp->val == hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) { 2068 err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev); 2069 goto failed; 2070 } 2071 2072 cmd = mgmt_pending_add(sk, MGMT_OP_SET_SSP, hdev, data, len); 2073 if (!cmd) 2074 err = -ENOMEM; 2075 else 2076 err = hci_cmd_sync_queue(hdev, set_ssp_sync, cmd, 2077 set_ssp_complete); 2078 2079 if (err < 0) { 2080 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP, 2081 MGMT_STATUS_FAILED); 2082 2083 if (cmd) 2084 mgmt_pending_remove(cmd); 2085 } 2086 2087 failed: 2088 hci_dev_unlock(hdev); 2089 return err; 2090 } 2091 2092 static int set_hs(struct sock *sk, struct hci_dev *hdev, void *data, u16 len) 2093 { 2094 bt_dev_dbg(hdev, "sock %p", sk); 2095 2096 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS, 2097 MGMT_STATUS_NOT_SUPPORTED); 2098 } 2099 2100 static void set_le_complete(struct hci_dev *hdev, void *data, int err) 2101 { 2102 struct mgmt_pending_cmd *cmd = data; 2103 struct cmd_lookup match = { NULL, hdev }; 2104 u8 status = mgmt_status(err); 2105 2106 bt_dev_dbg(hdev, "err %d", err); 2107 2108 if (err == -ECANCELED || !mgmt_pending_valid(hdev, data)) 2109 return; 2110 2111 if (status) { 2112 mgmt_cmd_status(cmd->sk, cmd->hdev->id, cmd->opcode, status); 2113 goto done; 2114 } 2115 2116 settings_rsp(cmd, &match); 2117 2118 new_settings(hdev, match.sk); 2119 2120 if (match.sk) 2121 sock_put(match.sk); 2122 2123 done: 2124 mgmt_pending_free(cmd); 2125 } 2126 2127 static int set_le_sync(struct hci_dev *hdev, void *data) 2128 { 2129 struct mgmt_pending_cmd *cmd = data; 2130 struct mgmt_mode cp; 2131 u8 val; 2132 int err; 2133 2134 mutex_lock(&hdev->mgmt_pending_lock); 2135 2136 if (!__mgmt_pending_listed(hdev, cmd)) { 2137 mutex_unlock(&hdev->mgmt_pending_lock); 2138 return -ECANCELED; 2139 } 2140 2141 memcpy(&cp, cmd->param, sizeof(cp)); 2142 val = !!cp.val; 2143 2144 mutex_unlock(&hdev->mgmt_pending_lock); 2145 2146 if (!val) { 2147 hci_clear_adv_instance_sync(hdev, NULL, 0x00, true); 2148 2149 if (hci_dev_test_flag(hdev, HCI_LE_ADV)) 2150 hci_disable_advertising_sync(hdev); 2151 2152 if (ext_adv_capable(hdev)) 2153 hci_remove_ext_adv_instance_sync(hdev, 0, cmd->sk); 2154 } else { 2155 hci_dev_set_flag(hdev, HCI_LE_ENABLED); 2156 } 2157 2158 err = hci_write_le_host_supported_sync(hdev, val, 0); 2159 2160 /* Make sure the controller has a good default for 2161 * advertising data. Restrict the update to when LE 2162 * has actually been enabled. During power on, the 2163 * update in powered_update_hci will take care of it. 2164 */ 2165 if (!err && hci_dev_test_flag(hdev, HCI_LE_ENABLED)) { 2166 if (ext_adv_capable(hdev)) { 2167 int status; 2168 2169 status = hci_setup_ext_adv_instance_sync(hdev, 0x00); 2170 if (!status) 2171 hci_update_scan_rsp_data_sync(hdev, 0x00); 2172 } else { 2173 hci_update_adv_data_sync(hdev, 0x00); 2174 hci_update_scan_rsp_data_sync(hdev, 0x00); 2175 } 2176 2177 hci_update_passive_scan(hdev); 2178 } 2179 2180 return err; 2181 } 2182 2183 static void set_mesh_complete(struct hci_dev *hdev, void *data, int err) 2184 { 2185 struct mgmt_pending_cmd *cmd = data; 2186 u8 status = mgmt_status(err); 2187 struct sock *sk; 2188 2189 if (err == -ECANCELED || !mgmt_pending_valid(hdev, cmd)) 2190 return; 2191 2192 sk = cmd->sk; 2193 2194 if (status) { 2195 mgmt_cmd_status(cmd->sk, hdev->id, cmd->opcode, status); 2196 goto done; 2197 } 2198 2199 mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_MESH_RECEIVER, 0, NULL, 0); 2200 2201 done: 2202 mgmt_pending_free(cmd); 2203 } 2204 2205 static int set_mesh_sync(struct hci_dev *hdev, void *data) 2206 { 2207 struct mgmt_pending_cmd *cmd = data; 2208 DEFINE_FLEX(struct mgmt_cp_set_mesh, cp, ad_types, num_ad_types, 2209 sizeof(hdev->mesh_ad_types)); 2210 size_t len; 2211 2212 mutex_lock(&hdev->mgmt_pending_lock); 2213 2214 if (!__mgmt_pending_listed(hdev, cmd)) { 2215 mutex_unlock(&hdev->mgmt_pending_lock); 2216 return -ECANCELED; 2217 } 2218 2219 len = cmd->param_len; 2220 memcpy(cp, cmd->param, min(__struct_size(cp), len)); 2221 2222 mutex_unlock(&hdev->mgmt_pending_lock); 2223 2224 memset(hdev->mesh_ad_types, 0, sizeof(hdev->mesh_ad_types)); 2225 2226 if (cp->enable) 2227 hci_dev_set_flag(hdev, HCI_MESH); 2228 else 2229 hci_dev_clear_flag(hdev, HCI_MESH); 2230 2231 hdev->le_scan_interval = __le16_to_cpu(cp->period); 2232 hdev->le_scan_window = __le16_to_cpu(cp->window); 2233 2234 len -= sizeof(struct mgmt_cp_set_mesh); 2235 2236 /* If filters don't fit, forward all adv pkts */ 2237 if (len <= sizeof(hdev->mesh_ad_types)) 2238 memcpy(hdev->mesh_ad_types, cp->ad_types, len); 2239 2240 hci_update_passive_scan_sync(hdev); 2241 return 0; 2242 } 2243 2244 static int set_mesh(struct sock *sk, struct hci_dev *hdev, void *data, u16 len) 2245 { 2246 struct mgmt_cp_set_mesh *cp = data; 2247 struct mgmt_pending_cmd *cmd; 2248 __u16 period, window; 2249 int err = 0; 2250 2251 bt_dev_dbg(hdev, "sock %p", sk); 2252 2253 if (!lmp_le_capable(hdev) || 2254 !hci_dev_test_flag(hdev, HCI_MESH_EXPERIMENTAL)) 2255 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_MESH_RECEIVER, 2256 MGMT_STATUS_NOT_SUPPORTED); 2257 2258 if (cp->enable != 0x00 && cp->enable != 0x01) 2259 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_MESH_RECEIVER, 2260 MGMT_STATUS_INVALID_PARAMS); 2261 2262 /* Keep allowed ranges in sync with set_scan_params() */ 2263 period = __le16_to_cpu(cp->period); 2264 2265 if (period < 0x0004 || period > 0x4000) 2266 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_MESH_RECEIVER, 2267 MGMT_STATUS_INVALID_PARAMS); 2268 2269 window = __le16_to_cpu(cp->window); 2270 2271 if (window < 0x0004 || window > 0x4000) 2272 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_MESH_RECEIVER, 2273 MGMT_STATUS_INVALID_PARAMS); 2274 2275 if (window > period) 2276 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_MESH_RECEIVER, 2277 MGMT_STATUS_INVALID_PARAMS); 2278 2279 hci_dev_lock(hdev); 2280 2281 cmd = mgmt_pending_add(sk, MGMT_OP_SET_MESH_RECEIVER, hdev, data, len); 2282 if (!cmd) 2283 err = -ENOMEM; 2284 else 2285 err = hci_cmd_sync_queue(hdev, set_mesh_sync, cmd, 2286 set_mesh_complete); 2287 2288 if (err < 0) { 2289 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_MESH_RECEIVER, 2290 MGMT_STATUS_FAILED); 2291 2292 if (cmd) 2293 mgmt_pending_remove(cmd); 2294 } 2295 2296 hci_dev_unlock(hdev); 2297 return err; 2298 } 2299 2300 static void mesh_send_start_complete(struct hci_dev *hdev, void *data, int err) 2301 { 2302 struct mgmt_mesh_tx *mesh_tx = data; 2303 struct mgmt_cp_mesh_send *send = (void *)mesh_tx->param; 2304 unsigned long mesh_send_interval; 2305 u8 mgmt_err = mgmt_status(err); 2306 2307 /* Report any errors here, but don't report completion */ 2308 2309 if (mgmt_err) { 2310 hci_dev_clear_flag(hdev, HCI_MESH_SENDING); 2311 /* Send Complete Error Code for handle */ 2312 mesh_send_complete(hdev, mesh_tx, false); 2313 return; 2314 } 2315 2316 mesh_send_interval = msecs_to_jiffies((send->cnt) * 25); 2317 queue_delayed_work(hdev->req_workqueue, &hdev->mesh_send_done, 2318 mesh_send_interval); 2319 } 2320 2321 static int mesh_send_sync(struct hci_dev *hdev, void *data) 2322 { 2323 struct mgmt_mesh_tx *mesh_tx = data; 2324 struct mgmt_cp_mesh_send *send = (void *)mesh_tx->param; 2325 struct adv_info *adv, *next_instance; 2326 u8 instance = hdev->le_num_of_adv_sets + 1; 2327 u16 timeout, duration; 2328 int err = 0; 2329 2330 if (hdev->le_num_of_adv_sets <= hdev->adv_instance_cnt) 2331 return MGMT_STATUS_BUSY; 2332 2333 timeout = 1000; 2334 duration = send->cnt * INTERVAL_TO_MS(hdev->le_adv_max_interval); 2335 adv = hci_add_adv_instance(hdev, instance, 0, 2336 send->adv_data_len, send->adv_data, 2337 0, NULL, 2338 timeout, duration, 2339 HCI_ADV_TX_POWER_NO_PREFERENCE, 2340 hdev->le_adv_min_interval, 2341 hdev->le_adv_max_interval, 2342 mesh_tx->handle); 2343 2344 if (!IS_ERR(adv)) 2345 mesh_tx->instance = instance; 2346 else 2347 err = PTR_ERR(adv); 2348 2349 if (hdev->cur_adv_instance == instance) { 2350 /* If the currently advertised instance is being changed then 2351 * cancel the current advertising and schedule the next 2352 * instance. If there is only one instance then the overridden 2353 * advertising data will be visible right away. 2354 */ 2355 cancel_adv_timeout(hdev); 2356 2357 next_instance = hci_get_next_instance(hdev, instance); 2358 if (next_instance) 2359 instance = next_instance->instance; 2360 else 2361 instance = 0; 2362 } else if (hdev->adv_instance_timeout) { 2363 /* Immediately advertise the new instance if no other, or 2364 * let it go naturally from queue if ADV is already happening 2365 */ 2366 instance = 0; 2367 } 2368 2369 if (instance) 2370 return hci_schedule_adv_instance_sync(hdev, instance, true); 2371 2372 return err; 2373 } 2374 2375 static void send_count(struct mgmt_mesh_tx *mesh_tx, void *data) 2376 { 2377 struct mgmt_rp_mesh_read_features *rp = data; 2378 2379 if (rp->used_handles >= rp->max_handles) 2380 return; 2381 2382 rp->handles[rp->used_handles++] = mesh_tx->handle; 2383 } 2384 2385 static int mesh_features(struct sock *sk, struct hci_dev *hdev, 2386 void *data, u16 len) 2387 { 2388 struct mgmt_rp_mesh_read_features rp; 2389 2390 if (!lmp_le_capable(hdev) || 2391 !hci_dev_test_flag(hdev, HCI_MESH_EXPERIMENTAL)) 2392 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_MESH_READ_FEATURES, 2393 MGMT_STATUS_NOT_SUPPORTED); 2394 2395 memset(&rp, 0, sizeof(rp)); 2396 rp.index = cpu_to_le16(hdev->id); 2397 if (hci_dev_test_flag(hdev, HCI_LE_ENABLED)) 2398 rp.max_handles = MESH_HANDLES_MAX; 2399 2400 hci_dev_lock(hdev); 2401 2402 if (rp.max_handles) 2403 mgmt_mesh_foreach(hdev, send_count, &rp, sk); 2404 2405 mgmt_cmd_complete(sk, hdev->id, MGMT_OP_MESH_READ_FEATURES, 0, &rp, 2406 rp.used_handles + sizeof(rp) - MESH_HANDLES_MAX); 2407 2408 hci_dev_unlock(hdev); 2409 return 0; 2410 } 2411 2412 static int send_cancel(struct hci_dev *hdev, void *data) 2413 { 2414 struct mgmt_pending_cmd *cmd = data; 2415 struct mgmt_cp_mesh_send_cancel *cancel = (void *)cmd->param; 2416 struct mgmt_mesh_tx *mesh_tx; 2417 2418 if (!cancel->handle) { 2419 do { 2420 mesh_tx = mgmt_mesh_next(hdev, cmd->sk); 2421 2422 if (mesh_tx) 2423 mesh_send_complete(hdev, mesh_tx, false); 2424 } while (mesh_tx); 2425 } else { 2426 mesh_tx = mgmt_mesh_find(hdev, cancel->handle); 2427 2428 if (mesh_tx && mesh_tx->sk == cmd->sk) 2429 mesh_send_complete(hdev, mesh_tx, false); 2430 } 2431 2432 mgmt_cmd_complete(cmd->sk, hdev->id, MGMT_OP_MESH_SEND_CANCEL, 2433 0, NULL, 0); 2434 mgmt_pending_free(cmd); 2435 2436 return 0; 2437 } 2438 2439 static int mesh_send_cancel(struct sock *sk, struct hci_dev *hdev, 2440 void *data, u16 len) 2441 { 2442 struct mgmt_pending_cmd *cmd; 2443 int err; 2444 2445 if (!lmp_le_capable(hdev) || 2446 !hci_dev_test_flag(hdev, HCI_MESH_EXPERIMENTAL)) 2447 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_MESH_SEND_CANCEL, 2448 MGMT_STATUS_NOT_SUPPORTED); 2449 2450 if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED)) 2451 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_MESH_SEND_CANCEL, 2452 MGMT_STATUS_REJECTED); 2453 2454 hci_dev_lock(hdev); 2455 cmd = mgmt_pending_new(sk, MGMT_OP_MESH_SEND_CANCEL, hdev, data, len); 2456 if (!cmd) 2457 err = -ENOMEM; 2458 else 2459 err = hci_cmd_sync_queue(hdev, send_cancel, cmd, NULL); 2460 2461 if (err < 0) { 2462 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_MESH_SEND_CANCEL, 2463 MGMT_STATUS_FAILED); 2464 2465 if (cmd) 2466 mgmt_pending_free(cmd); 2467 } 2468 2469 hci_dev_unlock(hdev); 2470 return err; 2471 } 2472 2473 static int mesh_send(struct sock *sk, struct hci_dev *hdev, void *data, u16 len) 2474 { 2475 struct mgmt_mesh_tx *mesh_tx; 2476 struct mgmt_cp_mesh_send *send = data; 2477 struct mgmt_rp_mesh_read_features rp; 2478 u16 expected_len; 2479 bool sending; 2480 int err = 0; 2481 2482 if (!lmp_le_capable(hdev) || 2483 !hci_dev_test_flag(hdev, HCI_MESH_EXPERIMENTAL)) 2484 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_MESH_SEND, 2485 MGMT_STATUS_NOT_SUPPORTED); 2486 if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED)) 2487 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_MESH_SEND, 2488 MGMT_STATUS_REJECTED); 2489 2490 if (!send->adv_data_len || send->adv_data_len > 31) 2491 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_MESH_SEND, 2492 MGMT_STATUS_REJECTED); 2493 2494 expected_len = struct_size(send, adv_data, send->adv_data_len); 2495 if (expected_len != len) 2496 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_MESH_SEND, 2497 MGMT_STATUS_INVALID_PARAMS); 2498 2499 hci_dev_lock(hdev); 2500 2501 memset(&rp, 0, sizeof(rp)); 2502 rp.max_handles = MESH_HANDLES_MAX; 2503 2504 mgmt_mesh_foreach(hdev, send_count, &rp, sk); 2505 2506 if (rp.max_handles <= rp.used_handles) { 2507 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_MESH_SEND, 2508 MGMT_STATUS_BUSY); 2509 goto done; 2510 } 2511 2512 sending = hci_dev_test_flag(hdev, HCI_MESH_SENDING); 2513 mesh_tx = mgmt_mesh_add(sk, hdev, send, len); 2514 2515 if (!mesh_tx) 2516 err = -ENOMEM; 2517 else if (!sending) 2518 err = hci_cmd_sync_queue(hdev, mesh_send_sync, mesh_tx, 2519 mesh_send_start_complete); 2520 2521 if (err < 0) { 2522 bt_dev_err(hdev, "Send Mesh Failed %d", err); 2523 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_MESH_SEND, 2524 MGMT_STATUS_FAILED); 2525 2526 if (mesh_tx) { 2527 if (sending) 2528 mgmt_mesh_remove(mesh_tx); 2529 } 2530 } else { 2531 hci_dev_set_flag(hdev, HCI_MESH_SENDING); 2532 2533 mgmt_cmd_complete(sk, hdev->id, MGMT_OP_MESH_SEND, 0, 2534 &mesh_tx->handle, 1); 2535 } 2536 2537 done: 2538 hci_dev_unlock(hdev); 2539 return err; 2540 } 2541 2542 static int set_le(struct sock *sk, struct hci_dev *hdev, void *data, u16 len) 2543 { 2544 struct mgmt_mode *cp = data; 2545 struct mgmt_pending_cmd *cmd; 2546 int err; 2547 u8 val, enabled; 2548 2549 bt_dev_dbg(hdev, "sock %p", sk); 2550 2551 if (!lmp_le_capable(hdev)) 2552 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE, 2553 MGMT_STATUS_NOT_SUPPORTED); 2554 2555 if (cp->val != 0x00 && cp->val != 0x01) 2556 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE, 2557 MGMT_STATUS_INVALID_PARAMS); 2558 2559 /* Bluetooth single mode LE only controllers or dual-mode 2560 * controllers configured as LE only devices, do not allow 2561 * switching LE off. These have either LE enabled explicitly 2562 * or BR/EDR has been previously switched off. 2563 * 2564 * When trying to enable an already enabled LE, then gracefully 2565 * send a positive response. Trying to disable it however will 2566 * result into rejection. 2567 */ 2568 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) { 2569 if (cp->val == 0x01) 2570 return send_settings_rsp(sk, MGMT_OP_SET_LE, hdev); 2571 2572 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE, 2573 MGMT_STATUS_REJECTED); 2574 } 2575 2576 hci_dev_lock(hdev); 2577 2578 val = !!cp->val; 2579 enabled = lmp_host_le_capable(hdev); 2580 2581 if (!hdev_is_powered(hdev) || val == enabled) { 2582 bool changed = false; 2583 2584 if (val != hci_dev_test_flag(hdev, HCI_LE_ENABLED)) { 2585 hci_dev_change_flag(hdev, HCI_LE_ENABLED); 2586 changed = true; 2587 } 2588 2589 if (!val && hci_dev_test_flag(hdev, HCI_ADVERTISING)) { 2590 hci_dev_clear_flag(hdev, HCI_ADVERTISING); 2591 changed = true; 2592 } 2593 2594 err = send_settings_rsp(sk, MGMT_OP_SET_LE, hdev); 2595 if (err < 0) 2596 goto unlock; 2597 2598 if (changed) 2599 err = new_settings(hdev, sk); 2600 2601 goto unlock; 2602 } 2603 2604 if (pending_find(MGMT_OP_SET_LE, hdev) || 2605 pending_find(MGMT_OP_SET_ADVERTISING, hdev)) { 2606 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE, 2607 MGMT_STATUS_BUSY); 2608 goto unlock; 2609 } 2610 2611 cmd = mgmt_pending_add(sk, MGMT_OP_SET_LE, hdev, data, len); 2612 if (!cmd) 2613 err = -ENOMEM; 2614 else 2615 err = hci_cmd_sync_queue(hdev, set_le_sync, cmd, 2616 set_le_complete); 2617 2618 if (err < 0) { 2619 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE, 2620 MGMT_STATUS_FAILED); 2621 2622 if (cmd) 2623 mgmt_pending_remove(cmd); 2624 } 2625 2626 unlock: 2627 hci_dev_unlock(hdev); 2628 return err; 2629 } 2630 2631 static int send_hci_cmd_sync(struct hci_dev *hdev, void *data) 2632 { 2633 struct mgmt_pending_cmd *cmd = data; 2634 struct mgmt_cp_hci_cmd_sync *cp = cmd->param; 2635 struct sk_buff *skb; 2636 2637 skb = __hci_cmd_sync_ev(hdev, le16_to_cpu(cp->opcode), 2638 le16_to_cpu(cp->params_len), cp->params, 2639 cp->event, cp->timeout ? 2640 secs_to_jiffies(cp->timeout) : 2641 HCI_CMD_TIMEOUT); 2642 if (IS_ERR(skb)) { 2643 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_HCI_CMD_SYNC, 2644 mgmt_status(PTR_ERR(skb))); 2645 goto done; 2646 } 2647 2648 mgmt_cmd_complete(cmd->sk, hdev->id, MGMT_OP_HCI_CMD_SYNC, 0, 2649 skb->data, skb->len); 2650 2651 kfree_skb(skb); 2652 2653 done: 2654 mgmt_pending_free(cmd); 2655 2656 return 0; 2657 } 2658 2659 static int mgmt_hci_cmd_sync(struct sock *sk, struct hci_dev *hdev, 2660 void *data, u16 len) 2661 { 2662 struct mgmt_cp_hci_cmd_sync *cp = data; 2663 struct mgmt_pending_cmd *cmd; 2664 int err; 2665 2666 if (len != (offsetof(struct mgmt_cp_hci_cmd_sync, params) + 2667 le16_to_cpu(cp->params_len))) 2668 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_HCI_CMD_SYNC, 2669 MGMT_STATUS_INVALID_PARAMS); 2670 2671 hci_dev_lock(hdev); 2672 cmd = mgmt_pending_new(sk, MGMT_OP_HCI_CMD_SYNC, hdev, data, len); 2673 if (!cmd) 2674 err = -ENOMEM; 2675 else 2676 err = hci_cmd_sync_queue(hdev, send_hci_cmd_sync, cmd, NULL); 2677 2678 if (err < 0) { 2679 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_HCI_CMD_SYNC, 2680 MGMT_STATUS_FAILED); 2681 2682 if (cmd) 2683 mgmt_pending_free(cmd); 2684 } 2685 2686 hci_dev_unlock(hdev); 2687 return err; 2688 } 2689 2690 /* This is a helper function to test for pending mgmt commands that can 2691 * cause CoD or EIR HCI commands. We can only allow one such pending 2692 * mgmt command at a time since otherwise we cannot easily track what 2693 * the current values are, will be, and based on that calculate if a new 2694 * HCI command needs to be sent and if yes with what value. 2695 */ 2696 static bool pending_eir_or_class(struct hci_dev *hdev) 2697 { 2698 struct mgmt_pending_cmd *cmd; 2699 2700 list_for_each_entry(cmd, &hdev->mgmt_pending, list) { 2701 switch (cmd->opcode) { 2702 case MGMT_OP_ADD_UUID: 2703 case MGMT_OP_REMOVE_UUID: 2704 case MGMT_OP_SET_DEV_CLASS: 2705 case MGMT_OP_SET_POWERED: 2706 return true; 2707 } 2708 } 2709 2710 return false; 2711 } 2712 2713 static const u8 bluetooth_base_uuid[] = { 2714 0xfb, 0x34, 0x9b, 0x5f, 0x80, 0x00, 0x00, 0x80, 2715 0x00, 0x10, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 2716 }; 2717 2718 static u8 get_uuid_size(const u8 *uuid) 2719 { 2720 u32 val; 2721 2722 if (memcmp(uuid, bluetooth_base_uuid, 12)) 2723 return 128; 2724 2725 val = get_unaligned_le32(&uuid[12]); 2726 if (val > 0xffff) 2727 return 32; 2728 2729 return 16; 2730 } 2731 2732 static void mgmt_class_complete(struct hci_dev *hdev, void *data, int err) 2733 { 2734 struct mgmt_pending_cmd *cmd = data; 2735 2736 bt_dev_dbg(hdev, "err %d", err); 2737 2738 mgmt_cmd_complete(cmd->sk, cmd->hdev->id, cmd->opcode, 2739 mgmt_status(err), hdev->dev_class, 3); 2740 2741 mgmt_pending_free(cmd); 2742 } 2743 2744 static int add_uuid_sync(struct hci_dev *hdev, void *data) 2745 { 2746 int err; 2747 2748 err = hci_update_class_sync(hdev); 2749 if (err) 2750 return err; 2751 2752 return hci_update_eir_sync(hdev); 2753 } 2754 2755 static int add_uuid(struct sock *sk, struct hci_dev *hdev, void *data, u16 len) 2756 { 2757 struct mgmt_cp_add_uuid *cp = data; 2758 struct mgmt_pending_cmd *cmd; 2759 struct bt_uuid *uuid; 2760 int err; 2761 2762 bt_dev_dbg(hdev, "sock %p", sk); 2763 2764 hci_dev_lock(hdev); 2765 2766 if (pending_eir_or_class(hdev)) { 2767 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_UUID, 2768 MGMT_STATUS_BUSY); 2769 goto failed; 2770 } 2771 2772 uuid = kmalloc_obj(*uuid); 2773 if (!uuid) { 2774 err = -ENOMEM; 2775 goto failed; 2776 } 2777 2778 memcpy(uuid->uuid, cp->uuid, 16); 2779 uuid->svc_hint = cp->svc_hint; 2780 uuid->size = get_uuid_size(cp->uuid); 2781 2782 list_add_tail(&uuid->list, &hdev->uuids); 2783 2784 cmd = mgmt_pending_new(sk, MGMT_OP_ADD_UUID, hdev, data, len); 2785 if (!cmd) { 2786 err = -ENOMEM; 2787 goto failed; 2788 } 2789 2790 /* MGMT_OP_ADD_UUID don't require adapter the UP/Running so use 2791 * hci_cmd_sync_submit instead of hci_cmd_sync_queue. 2792 */ 2793 err = hci_cmd_sync_submit(hdev, add_uuid_sync, cmd, 2794 mgmt_class_complete); 2795 if (err < 0) { 2796 mgmt_pending_free(cmd); 2797 goto failed; 2798 } 2799 2800 failed: 2801 hci_dev_unlock(hdev); 2802 return err; 2803 } 2804 2805 static bool enable_service_cache(struct hci_dev *hdev) 2806 { 2807 if (!hdev_is_powered(hdev)) 2808 return false; 2809 2810 if (!hci_dev_test_and_set_flag(hdev, HCI_SERVICE_CACHE)) { 2811 queue_delayed_work(hdev->workqueue, &hdev->service_cache, 2812 CACHE_TIMEOUT); 2813 return true; 2814 } 2815 2816 return false; 2817 } 2818 2819 static int remove_uuid_sync(struct hci_dev *hdev, void *data) 2820 { 2821 int err; 2822 2823 err = hci_update_class_sync(hdev); 2824 if (err) 2825 return err; 2826 2827 return hci_update_eir_sync(hdev); 2828 } 2829 2830 static int remove_uuid(struct sock *sk, struct hci_dev *hdev, void *data, 2831 u16 len) 2832 { 2833 struct mgmt_cp_remove_uuid *cp = data; 2834 struct mgmt_pending_cmd *cmd; 2835 struct bt_uuid *match, *tmp; 2836 static const u8 bt_uuid_any[] = { 2837 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 2838 }; 2839 int err, found; 2840 2841 bt_dev_dbg(hdev, "sock %p", sk); 2842 2843 hci_dev_lock(hdev); 2844 2845 if (pending_eir_or_class(hdev)) { 2846 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID, 2847 MGMT_STATUS_BUSY); 2848 goto unlock; 2849 } 2850 2851 if (memcmp(cp->uuid, bt_uuid_any, 16) == 0) { 2852 hci_uuids_clear(hdev); 2853 2854 if (enable_service_cache(hdev)) { 2855 err = mgmt_cmd_complete(sk, hdev->id, 2856 MGMT_OP_REMOVE_UUID, 2857 0, hdev->dev_class, 3); 2858 goto unlock; 2859 } 2860 2861 goto update_class; 2862 } 2863 2864 found = 0; 2865 2866 list_for_each_entry_safe(match, tmp, &hdev->uuids, list) { 2867 if (memcmp(match->uuid, cp->uuid, 16) != 0) 2868 continue; 2869 2870 list_del(&match->list); 2871 kfree(match); 2872 found++; 2873 } 2874 2875 if (found == 0) { 2876 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID, 2877 MGMT_STATUS_INVALID_PARAMS); 2878 goto unlock; 2879 } 2880 2881 update_class: 2882 cmd = mgmt_pending_new(sk, MGMT_OP_REMOVE_UUID, hdev, data, len); 2883 if (!cmd) { 2884 err = -ENOMEM; 2885 goto unlock; 2886 } 2887 2888 /* MGMT_OP_REMOVE_UUID don't require adapter the UP/Running so use 2889 * hci_cmd_sync_submit instead of hci_cmd_sync_queue. 2890 */ 2891 err = hci_cmd_sync_submit(hdev, remove_uuid_sync, cmd, 2892 mgmt_class_complete); 2893 if (err < 0) 2894 mgmt_pending_free(cmd); 2895 2896 unlock: 2897 hci_dev_unlock(hdev); 2898 return err; 2899 } 2900 2901 static int set_class_sync(struct hci_dev *hdev, void *data) 2902 { 2903 int err = 0; 2904 2905 if (hci_dev_test_and_clear_flag(hdev, HCI_SERVICE_CACHE)) { 2906 cancel_delayed_work_sync(&hdev->service_cache); 2907 err = hci_update_eir_sync(hdev); 2908 } 2909 2910 if (err) 2911 return err; 2912 2913 return hci_update_class_sync(hdev); 2914 } 2915 2916 static int set_dev_class(struct sock *sk, struct hci_dev *hdev, void *data, 2917 u16 len) 2918 { 2919 struct mgmt_cp_set_dev_class *cp = data; 2920 struct mgmt_pending_cmd *cmd; 2921 int err; 2922 2923 bt_dev_dbg(hdev, "sock %p", sk); 2924 2925 if (!lmp_bredr_capable(hdev)) 2926 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 2927 MGMT_STATUS_NOT_SUPPORTED); 2928 2929 hci_dev_lock(hdev); 2930 2931 if (pending_eir_or_class(hdev)) { 2932 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 2933 MGMT_STATUS_BUSY); 2934 goto unlock; 2935 } 2936 2937 if ((cp->minor & 0x03) != 0 || (cp->major & 0xe0) != 0) { 2938 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 2939 MGMT_STATUS_INVALID_PARAMS); 2940 goto unlock; 2941 } 2942 2943 hdev->major_class = cp->major; 2944 hdev->minor_class = cp->minor; 2945 2946 if (!hdev_is_powered(hdev)) { 2947 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 0, 2948 hdev->dev_class, 3); 2949 goto unlock; 2950 } 2951 2952 cmd = mgmt_pending_new(sk, MGMT_OP_SET_DEV_CLASS, hdev, data, len); 2953 if (!cmd) { 2954 err = -ENOMEM; 2955 goto unlock; 2956 } 2957 2958 /* MGMT_OP_SET_DEV_CLASS don't require adapter the UP/Running so use 2959 * hci_cmd_sync_submit instead of hci_cmd_sync_queue. 2960 */ 2961 err = hci_cmd_sync_submit(hdev, set_class_sync, cmd, 2962 mgmt_class_complete); 2963 if (err < 0) 2964 mgmt_pending_free(cmd); 2965 2966 unlock: 2967 hci_dev_unlock(hdev); 2968 return err; 2969 } 2970 2971 static int load_link_keys(struct sock *sk, struct hci_dev *hdev, void *data, 2972 u16 len) 2973 { 2974 struct mgmt_cp_load_link_keys *cp = data; 2975 const u16 max_key_count = ((U16_MAX - sizeof(*cp)) / 2976 sizeof(struct mgmt_link_key_info)); 2977 u16 key_count, expected_len; 2978 bool changed; 2979 int i; 2980 2981 bt_dev_dbg(hdev, "sock %p", sk); 2982 2983 if (!lmp_bredr_capable(hdev)) 2984 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS, 2985 MGMT_STATUS_NOT_SUPPORTED); 2986 2987 key_count = __le16_to_cpu(cp->key_count); 2988 if (key_count > max_key_count) { 2989 bt_dev_err(hdev, "load_link_keys: too big key_count value %u", 2990 key_count); 2991 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS, 2992 MGMT_STATUS_INVALID_PARAMS); 2993 } 2994 2995 expected_len = struct_size(cp, keys, key_count); 2996 if (expected_len != len) { 2997 bt_dev_err(hdev, "load_link_keys: expected %u bytes, got %u bytes", 2998 expected_len, len); 2999 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS, 3000 MGMT_STATUS_INVALID_PARAMS); 3001 } 3002 3003 if (cp->debug_keys != 0x00 && cp->debug_keys != 0x01) 3004 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS, 3005 MGMT_STATUS_INVALID_PARAMS); 3006 3007 bt_dev_dbg(hdev, "debug_keys %u key_count %u", cp->debug_keys, 3008 key_count); 3009 3010 hci_dev_lock(hdev); 3011 3012 hci_link_keys_clear(hdev); 3013 3014 if (cp->debug_keys) 3015 changed = !hci_dev_test_and_set_flag(hdev, HCI_KEEP_DEBUG_KEYS); 3016 else 3017 changed = hci_dev_test_and_clear_flag(hdev, 3018 HCI_KEEP_DEBUG_KEYS); 3019 3020 if (changed) 3021 new_settings(hdev, NULL); 3022 3023 for (i = 0; i < key_count; i++) { 3024 struct mgmt_link_key_info *key = &cp->keys[i]; 3025 3026 if (hci_is_blocked_key(hdev, 3027 HCI_BLOCKED_KEY_TYPE_LINKKEY, 3028 key->val)) { 3029 bt_dev_warn(hdev, "Skipping blocked link key for %pMR", 3030 &key->addr.bdaddr); 3031 continue; 3032 } 3033 3034 if (key->addr.type != BDADDR_BREDR) { 3035 bt_dev_warn(hdev, 3036 "Invalid link address type %u for %pMR", 3037 key->addr.type, &key->addr.bdaddr); 3038 continue; 3039 } 3040 3041 if (key->type > 0x08) { 3042 bt_dev_warn(hdev, "Invalid link key type %u for %pMR", 3043 key->type, &key->addr.bdaddr); 3044 continue; 3045 } 3046 3047 /* Always ignore debug keys and require a new pairing if 3048 * the user wants to use them. 3049 */ 3050 if (key->type == HCI_LK_DEBUG_COMBINATION) 3051 continue; 3052 3053 hci_add_link_key(hdev, NULL, &key->addr.bdaddr, key->val, 3054 key->type, key->pin_len, NULL); 3055 } 3056 3057 mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS, 0, NULL, 0); 3058 3059 hci_dev_unlock(hdev); 3060 3061 return 0; 3062 } 3063 3064 static int device_unpaired(struct hci_dev *hdev, bdaddr_t *bdaddr, 3065 u8 addr_type, struct sock *skip_sk) 3066 { 3067 struct mgmt_ev_device_unpaired ev; 3068 3069 bacpy(&ev.addr.bdaddr, bdaddr); 3070 ev.addr.type = addr_type; 3071 3072 return mgmt_event(MGMT_EV_DEVICE_UNPAIRED, hdev, &ev, sizeof(ev), 3073 skip_sk); 3074 } 3075 3076 static void unpair_device_complete(struct hci_dev *hdev, void *data, int err) 3077 { 3078 struct mgmt_pending_cmd *cmd = data; 3079 struct mgmt_cp_unpair_device *cp = cmd->param; 3080 3081 if (!err) 3082 device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, cmd->sk); 3083 3084 cmd->cmd_complete(cmd, err); 3085 mgmt_pending_free(cmd); 3086 } 3087 3088 static int unpair_device_sync(struct hci_dev *hdev, void *data) 3089 { 3090 struct mgmt_pending_cmd *cmd = data; 3091 struct mgmt_cp_unpair_device *cp = cmd->param; 3092 struct hci_conn *conn; 3093 3094 hci_dev_lock(hdev); 3095 3096 if (cp->addr.type == BDADDR_BREDR) 3097 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, 3098 &cp->addr.bdaddr); 3099 else 3100 conn = hci_conn_hash_lookup_le(hdev, &cp->addr.bdaddr, 3101 le_addr_type(cp->addr.type)); 3102 3103 if (conn) 3104 hci_conn_get(conn); 3105 3106 hci_dev_unlock(hdev); 3107 3108 if (!conn) 3109 return 0; 3110 3111 /* Disregard any possible error since the likes of hci_abort_conn_sync 3112 * will clean up the connection no matter the error. 3113 */ 3114 hci_abort_conn(conn, HCI_ERROR_REMOTE_USER_TERM); 3115 hci_conn_put(conn); 3116 3117 return 0; 3118 } 3119 3120 static int unpair_device(struct sock *sk, struct hci_dev *hdev, void *data, 3121 u16 len) 3122 { 3123 struct mgmt_cp_unpair_device *cp = data; 3124 struct mgmt_rp_unpair_device rp; 3125 struct hci_conn_params *params; 3126 struct mgmt_pending_cmd *cmd; 3127 struct hci_conn *conn; 3128 u8 addr_type; 3129 int err; 3130 3131 memset(&rp, 0, sizeof(rp)); 3132 bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr); 3133 rp.addr.type = cp->addr.type; 3134 3135 if (!bdaddr_type_is_valid(cp->addr.type)) 3136 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE, 3137 MGMT_STATUS_INVALID_PARAMS, 3138 &rp, sizeof(rp)); 3139 3140 if (cp->disconnect != 0x00 && cp->disconnect != 0x01) 3141 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE, 3142 MGMT_STATUS_INVALID_PARAMS, 3143 &rp, sizeof(rp)); 3144 3145 hci_dev_lock(hdev); 3146 3147 if (!hdev_is_powered(hdev)) { 3148 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE, 3149 MGMT_STATUS_NOT_POWERED, &rp, 3150 sizeof(rp)); 3151 goto unlock; 3152 } 3153 3154 if (cp->addr.type == BDADDR_BREDR) { 3155 /* If disconnection is requested, then look up the 3156 * connection. If the remote device is connected, it 3157 * will be later used to terminate the link. 3158 * 3159 * Setting it to NULL explicitly will cause no 3160 * termination of the link. 3161 */ 3162 if (cp->disconnect) 3163 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, 3164 &cp->addr.bdaddr); 3165 else 3166 conn = NULL; 3167 3168 err = hci_remove_link_key(hdev, &cp->addr.bdaddr); 3169 if (err < 0) { 3170 err = mgmt_cmd_complete(sk, hdev->id, 3171 MGMT_OP_UNPAIR_DEVICE, 3172 MGMT_STATUS_NOT_PAIRED, &rp, 3173 sizeof(rp)); 3174 goto unlock; 3175 } 3176 3177 goto done; 3178 } 3179 3180 /* LE address type */ 3181 addr_type = le_addr_type(cp->addr.type); 3182 3183 /* Abort any ongoing SMP pairing. Removes ltk and irk if they exist. */ 3184 err = smp_cancel_and_remove_pairing(hdev, &cp->addr.bdaddr, addr_type); 3185 if (err < 0) { 3186 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE, 3187 MGMT_STATUS_NOT_PAIRED, &rp, 3188 sizeof(rp)); 3189 goto unlock; 3190 } 3191 3192 conn = hci_conn_hash_lookup_le(hdev, &cp->addr.bdaddr, addr_type); 3193 if (!conn) { 3194 hci_conn_params_del(hdev, &cp->addr.bdaddr, addr_type); 3195 goto done; 3196 } 3197 3198 3199 /* Defer clearing up the connection parameters until closing to 3200 * give a chance of keeping them if a repairing happens. 3201 */ 3202 set_bit(HCI_CONN_PARAM_REMOVAL_PEND, &conn->flags); 3203 3204 /* Disable auto-connection parameters if present */ 3205 params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr, addr_type); 3206 if (params) { 3207 if (params->explicit_connect) 3208 params->auto_connect = HCI_AUTO_CONN_EXPLICIT; 3209 else 3210 params->auto_connect = HCI_AUTO_CONN_DISABLED; 3211 } 3212 3213 /* If disconnection is not requested, then clear the connection 3214 * variable so that the link is not terminated. 3215 */ 3216 if (!cp->disconnect) 3217 conn = NULL; 3218 3219 done: 3220 /* If the connection variable is set, then termination of the 3221 * link is requested. 3222 */ 3223 if (!conn) { 3224 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE, 0, 3225 &rp, sizeof(rp)); 3226 device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, sk); 3227 goto unlock; 3228 } 3229 3230 cmd = mgmt_pending_new(sk, MGMT_OP_UNPAIR_DEVICE, hdev, cp, 3231 sizeof(*cp)); 3232 if (!cmd) { 3233 err = -ENOMEM; 3234 goto unlock; 3235 } 3236 3237 cmd->cmd_complete = addr_cmd_complete; 3238 3239 err = hci_cmd_sync_queue(hdev, unpair_device_sync, cmd, 3240 unpair_device_complete); 3241 if (err < 0) 3242 mgmt_pending_free(cmd); 3243 3244 unlock: 3245 hci_dev_unlock(hdev); 3246 return err; 3247 } 3248 3249 static void disconnect_complete(struct hci_dev *hdev, void *data, int err) 3250 { 3251 struct mgmt_pending_cmd *cmd = data; 3252 3253 cmd->cmd_complete(cmd, mgmt_status(err)); 3254 mgmt_pending_free(cmd); 3255 } 3256 3257 static int disconnect_sync(struct hci_dev *hdev, void *data) 3258 { 3259 struct mgmt_pending_cmd *cmd = data; 3260 struct mgmt_cp_disconnect *cp = cmd->param; 3261 struct hci_conn *conn; 3262 3263 hci_dev_lock(hdev); 3264 3265 if (cp->addr.type == BDADDR_BREDR) 3266 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, 3267 &cp->addr.bdaddr); 3268 else 3269 conn = hci_conn_hash_lookup_le(hdev, &cp->addr.bdaddr, 3270 le_addr_type(cp->addr.type)); 3271 3272 if (conn) 3273 hci_conn_get(conn); 3274 3275 hci_dev_unlock(hdev); 3276 3277 if (!conn) 3278 return -ENOTCONN; 3279 3280 /* Disregard any possible error since the likes of hci_abort_conn_sync 3281 * will clean up the connection no matter the error. 3282 */ 3283 hci_abort_conn(conn, HCI_ERROR_REMOTE_USER_TERM); 3284 hci_conn_put(conn); 3285 3286 return 0; 3287 } 3288 3289 static int disconnect(struct sock *sk, struct hci_dev *hdev, void *data, 3290 u16 len) 3291 { 3292 struct mgmt_cp_disconnect *cp = data; 3293 struct mgmt_rp_disconnect rp; 3294 struct mgmt_pending_cmd *cmd; 3295 int err; 3296 3297 bt_dev_dbg(hdev, "sock %p", sk); 3298 3299 memset(&rp, 0, sizeof(rp)); 3300 bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr); 3301 rp.addr.type = cp->addr.type; 3302 3303 if (!bdaddr_type_is_valid(cp->addr.type)) 3304 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT, 3305 MGMT_STATUS_INVALID_PARAMS, 3306 &rp, sizeof(rp)); 3307 3308 hci_dev_lock(hdev); 3309 3310 if (!test_bit(HCI_UP, &hdev->flags)) { 3311 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT, 3312 MGMT_STATUS_NOT_POWERED, &rp, 3313 sizeof(rp)); 3314 goto failed; 3315 } 3316 3317 cmd = mgmt_pending_new(sk, MGMT_OP_DISCONNECT, hdev, data, len); 3318 if (!cmd) { 3319 err = -ENOMEM; 3320 goto failed; 3321 } 3322 3323 cmd->cmd_complete = generic_cmd_complete; 3324 3325 err = hci_cmd_sync_queue(hdev, disconnect_sync, cmd, 3326 disconnect_complete); 3327 if (err < 0) 3328 mgmt_pending_free(cmd); 3329 3330 failed: 3331 hci_dev_unlock(hdev); 3332 return err; 3333 } 3334 3335 static u8 link_to_bdaddr(u8 link_type, u8 addr_type) 3336 { 3337 switch (link_type) { 3338 case CIS_LINK: 3339 case BIS_LINK: 3340 case PA_LINK: 3341 case LE_LINK: 3342 switch (addr_type) { 3343 case ADDR_LE_DEV_PUBLIC: 3344 return BDADDR_LE_PUBLIC; 3345 3346 default: 3347 /* Fallback to LE Random address type */ 3348 return BDADDR_LE_RANDOM; 3349 } 3350 3351 default: 3352 /* Fallback to BR/EDR type */ 3353 return BDADDR_BREDR; 3354 } 3355 } 3356 3357 static int get_connections(struct sock *sk, struct hci_dev *hdev, void *data, 3358 u16 data_len) 3359 { 3360 struct mgmt_rp_get_connections *rp; 3361 struct hci_conn *c; 3362 int err; 3363 u16 i; 3364 3365 bt_dev_dbg(hdev, "sock %p", sk); 3366 3367 hci_dev_lock(hdev); 3368 3369 if (!hdev_is_powered(hdev)) { 3370 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_CONNECTIONS, 3371 MGMT_STATUS_NOT_POWERED); 3372 goto unlock; 3373 } 3374 3375 i = 0; 3376 list_for_each_entry(c, &hdev->conn_hash.list, list) { 3377 if (test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags)) 3378 i++; 3379 } 3380 3381 rp = kmalloc_flex(*rp, addr, i); 3382 if (!rp) { 3383 err = -ENOMEM; 3384 goto unlock; 3385 } 3386 3387 i = 0; 3388 list_for_each_entry(c, &hdev->conn_hash.list, list) { 3389 if (!test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags)) 3390 continue; 3391 bacpy(&rp->addr[i].bdaddr, &c->dst); 3392 rp->addr[i].type = link_to_bdaddr(c->type, c->dst_type); 3393 if (c->type == SCO_LINK || c->type == ESCO_LINK) 3394 continue; 3395 i++; 3396 } 3397 3398 rp->conn_count = cpu_to_le16(i); 3399 3400 /* Recalculate length in case of filtered SCO connections, etc */ 3401 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONNECTIONS, 0, rp, 3402 struct_size(rp, addr, i)); 3403 3404 kfree(rp); 3405 3406 unlock: 3407 hci_dev_unlock(hdev); 3408 return err; 3409 } 3410 3411 static int send_pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev, 3412 struct mgmt_cp_pin_code_neg_reply *cp) 3413 { 3414 struct mgmt_pending_cmd *cmd; 3415 int err; 3416 3417 cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_NEG_REPLY, hdev, cp, 3418 sizeof(*cp)); 3419 if (!cmd) 3420 return -ENOMEM; 3421 3422 cmd->cmd_complete = addr_cmd_complete; 3423 3424 err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_NEG_REPLY, 3425 sizeof(cp->addr.bdaddr), &cp->addr.bdaddr); 3426 if (err < 0) 3427 mgmt_pending_remove(cmd); 3428 3429 return err; 3430 } 3431 3432 static int pin_code_reply(struct sock *sk, struct hci_dev *hdev, void *data, 3433 u16 len) 3434 { 3435 struct hci_conn *conn; 3436 struct mgmt_cp_pin_code_reply *cp = data; 3437 struct hci_cp_pin_code_reply reply; 3438 struct mgmt_pending_cmd *cmd; 3439 int err; 3440 3441 bt_dev_dbg(hdev, "sock %p", sk); 3442 3443 hci_dev_lock(hdev); 3444 3445 if (!hdev_is_powered(hdev)) { 3446 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY, 3447 MGMT_STATUS_NOT_POWERED); 3448 goto failed; 3449 } 3450 3451 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->addr.bdaddr); 3452 if (!conn) { 3453 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY, 3454 MGMT_STATUS_NOT_CONNECTED); 3455 goto failed; 3456 } 3457 3458 if (conn->pending_sec_level == BT_SECURITY_HIGH && cp->pin_len != 16) { 3459 struct mgmt_cp_pin_code_neg_reply ncp; 3460 3461 memcpy(&ncp.addr, &cp->addr, sizeof(ncp.addr)); 3462 3463 bt_dev_err(hdev, "PIN code is not 16 bytes long"); 3464 3465 err = send_pin_code_neg_reply(sk, hdev, &ncp); 3466 if (err >= 0) 3467 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY, 3468 MGMT_STATUS_INVALID_PARAMS); 3469 3470 goto failed; 3471 } 3472 3473 cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_REPLY, hdev, data, len); 3474 if (!cmd) { 3475 err = -ENOMEM; 3476 goto failed; 3477 } 3478 3479 cmd->cmd_complete = addr_cmd_complete; 3480 3481 bacpy(&reply.bdaddr, &cp->addr.bdaddr); 3482 reply.pin_len = cp->pin_len; 3483 memcpy(reply.pin_code, cp->pin_code, sizeof(reply.pin_code)); 3484 3485 err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_REPLY, sizeof(reply), &reply); 3486 if (err < 0) 3487 mgmt_pending_remove(cmd); 3488 3489 failed: 3490 hci_dev_unlock(hdev); 3491 return err; 3492 } 3493 3494 static int set_io_capability(struct sock *sk, struct hci_dev *hdev, void *data, 3495 u16 len) 3496 { 3497 struct mgmt_cp_set_io_capability *cp = data; 3498 3499 bt_dev_dbg(hdev, "sock %p", sk); 3500 3501 if (cp->io_capability > SMP_IO_KEYBOARD_DISPLAY) 3502 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_IO_CAPABILITY, 3503 MGMT_STATUS_INVALID_PARAMS); 3504 3505 hci_dev_lock(hdev); 3506 3507 hdev->io_capability = cp->io_capability; 3508 3509 bt_dev_dbg(hdev, "IO capability set to 0x%02x", hdev->io_capability); 3510 3511 hci_dev_unlock(hdev); 3512 3513 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_IO_CAPABILITY, 0, 3514 NULL, 0); 3515 } 3516 3517 static struct mgmt_pending_cmd *find_pairing(struct hci_conn *conn) 3518 { 3519 struct hci_dev *hdev = conn->hdev; 3520 struct mgmt_pending_cmd *cmd; 3521 3522 list_for_each_entry(cmd, &hdev->mgmt_pending, list) { 3523 if (cmd->opcode != MGMT_OP_PAIR_DEVICE) 3524 continue; 3525 3526 if (cmd->user_data != conn) 3527 continue; 3528 3529 return cmd; 3530 } 3531 3532 return NULL; 3533 } 3534 3535 static int pairing_complete(struct mgmt_pending_cmd *cmd, u8 status) 3536 { 3537 struct mgmt_rp_pair_device rp; 3538 struct hci_conn *conn = cmd->user_data; 3539 int err; 3540 3541 bacpy(&rp.addr.bdaddr, &conn->dst); 3542 rp.addr.type = link_to_bdaddr(conn->type, conn->dst_type); 3543 3544 err = mgmt_cmd_complete(cmd->sk, cmd->hdev->id, MGMT_OP_PAIR_DEVICE, 3545 status, &rp, sizeof(rp)); 3546 3547 /* So we don't get further callbacks for this connection */ 3548 conn->connect_cfm_cb = NULL; 3549 conn->security_cfm_cb = NULL; 3550 conn->disconn_cfm_cb = NULL; 3551 3552 hci_conn_drop(conn); 3553 3554 /* The device is paired so there is no need to remove 3555 * its connection parameters anymore. 3556 */ 3557 clear_bit(HCI_CONN_PARAM_REMOVAL_PEND, &conn->flags); 3558 3559 hci_conn_put(conn); 3560 3561 return err; 3562 } 3563 3564 void mgmt_smp_complete(struct hci_conn *conn, bool complete) 3565 { 3566 u8 status = complete ? MGMT_STATUS_SUCCESS : MGMT_STATUS_FAILED; 3567 struct mgmt_pending_cmd *cmd; 3568 3569 cmd = find_pairing(conn); 3570 if (cmd) { 3571 cmd->cmd_complete(cmd, status); 3572 mgmt_pending_remove(cmd); 3573 } 3574 } 3575 3576 static void pairing_complete_cb(struct hci_conn *conn, u8 status) 3577 { 3578 struct mgmt_pending_cmd *cmd; 3579 3580 BT_DBG("status %u", status); 3581 3582 cmd = find_pairing(conn); 3583 if (!cmd) { 3584 BT_DBG("Unable to find a pending command"); 3585 return; 3586 } 3587 3588 cmd->cmd_complete(cmd, mgmt_status(status)); 3589 mgmt_pending_remove(cmd); 3590 } 3591 3592 static void le_pairing_complete_cb(struct hci_conn *conn, u8 status) 3593 { 3594 struct mgmt_pending_cmd *cmd; 3595 3596 BT_DBG("status %u", status); 3597 3598 if (!status) 3599 return; 3600 3601 cmd = find_pairing(conn); 3602 if (!cmd) { 3603 BT_DBG("Unable to find a pending command"); 3604 return; 3605 } 3606 3607 cmd->cmd_complete(cmd, mgmt_status(status)); 3608 mgmt_pending_remove(cmd); 3609 } 3610 3611 static int pair_device(struct sock *sk, struct hci_dev *hdev, void *data, 3612 u16 len) 3613 { 3614 struct mgmt_cp_pair_device *cp = data; 3615 struct mgmt_rp_pair_device rp; 3616 struct mgmt_pending_cmd *cmd; 3617 u8 sec_level, auth_type; 3618 struct hci_conn *conn; 3619 int err; 3620 3621 bt_dev_dbg(hdev, "sock %p", sk); 3622 3623 memset(&rp, 0, sizeof(rp)); 3624 bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr); 3625 rp.addr.type = cp->addr.type; 3626 3627 if (!bdaddr_type_is_valid(cp->addr.type)) 3628 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE, 3629 MGMT_STATUS_INVALID_PARAMS, 3630 &rp, sizeof(rp)); 3631 3632 if (cp->io_cap > SMP_IO_KEYBOARD_DISPLAY) 3633 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE, 3634 MGMT_STATUS_INVALID_PARAMS, 3635 &rp, sizeof(rp)); 3636 3637 hci_dev_lock(hdev); 3638 3639 if (!hdev_is_powered(hdev)) { 3640 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE, 3641 MGMT_STATUS_NOT_POWERED, &rp, 3642 sizeof(rp)); 3643 goto unlock; 3644 } 3645 3646 if (hci_bdaddr_is_paired(hdev, &cp->addr.bdaddr, cp->addr.type)) { 3647 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE, 3648 MGMT_STATUS_ALREADY_PAIRED, &rp, 3649 sizeof(rp)); 3650 goto unlock; 3651 } 3652 3653 sec_level = BT_SECURITY_MEDIUM; 3654 auth_type = HCI_AT_DEDICATED_BONDING; 3655 3656 if (cp->addr.type == BDADDR_BREDR) { 3657 conn = hci_connect_acl(hdev, &cp->addr.bdaddr, sec_level, 3658 auth_type, CONN_REASON_PAIR_DEVICE, 3659 HCI_ACL_CONN_TIMEOUT); 3660 } else { 3661 u8 addr_type = le_addr_type(cp->addr.type); 3662 struct hci_conn_params *p; 3663 3664 /* When pairing a new device, it is expected to remember 3665 * this device for future connections. Adding the connection 3666 * parameter information ahead of time allows tracking 3667 * of the peripheral preferred values and will speed up any 3668 * further connection establishment. 3669 * 3670 * If connection parameters already exist, then they 3671 * will be kept and this function does nothing. 3672 */ 3673 p = hci_conn_params_add(hdev, &cp->addr.bdaddr, addr_type); 3674 if (!p) { 3675 err = -EIO; 3676 goto unlock; 3677 } 3678 3679 if (p->auto_connect == HCI_AUTO_CONN_EXPLICIT) 3680 p->auto_connect = HCI_AUTO_CONN_DISABLED; 3681 3682 conn = hci_connect_le_scan(hdev, &cp->addr.bdaddr, addr_type, 3683 sec_level, HCI_LE_CONN_TIMEOUT, 3684 CONN_REASON_PAIR_DEVICE); 3685 } 3686 3687 if (IS_ERR(conn)) { 3688 int status; 3689 3690 if (PTR_ERR(conn) == -EBUSY) 3691 status = MGMT_STATUS_BUSY; 3692 else if (PTR_ERR(conn) == -EOPNOTSUPP) 3693 status = MGMT_STATUS_NOT_SUPPORTED; 3694 else if (PTR_ERR(conn) == -ECONNREFUSED) 3695 status = MGMT_STATUS_REJECTED; 3696 else 3697 status = MGMT_STATUS_CONNECT_FAILED; 3698 3699 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE, 3700 status, &rp, sizeof(rp)); 3701 goto unlock; 3702 } 3703 3704 if (conn->connect_cfm_cb) { 3705 hci_conn_drop(conn); 3706 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE, 3707 MGMT_STATUS_BUSY, &rp, sizeof(rp)); 3708 goto unlock; 3709 } 3710 3711 cmd = mgmt_pending_add(sk, MGMT_OP_PAIR_DEVICE, hdev, data, len); 3712 if (!cmd) { 3713 err = -ENOMEM; 3714 hci_conn_drop(conn); 3715 goto unlock; 3716 } 3717 3718 cmd->cmd_complete = pairing_complete; 3719 3720 /* For LE, just connecting isn't a proof that the pairing finished */ 3721 if (cp->addr.type == BDADDR_BREDR) { 3722 conn->connect_cfm_cb = pairing_complete_cb; 3723 conn->security_cfm_cb = pairing_complete_cb; 3724 conn->disconn_cfm_cb = pairing_complete_cb; 3725 } else { 3726 conn->connect_cfm_cb = le_pairing_complete_cb; 3727 conn->security_cfm_cb = le_pairing_complete_cb; 3728 conn->disconn_cfm_cb = le_pairing_complete_cb; 3729 } 3730 3731 conn->io_capability = cp->io_cap; 3732 cmd->user_data = hci_conn_get(conn); 3733 3734 if ((conn->state == BT_CONNECTED || conn->state == BT_CONFIG) && 3735 hci_conn_security(conn, sec_level, auth_type, true)) { 3736 cmd->cmd_complete(cmd, 0); 3737 mgmt_pending_remove(cmd); 3738 } 3739 3740 err = 0; 3741 3742 unlock: 3743 hci_dev_unlock(hdev); 3744 return err; 3745 } 3746 3747 static int cancel_pair_device(struct sock *sk, struct hci_dev *hdev, void *data, 3748 u16 len) 3749 { 3750 struct mgmt_addr_info *addr = data; 3751 struct mgmt_pending_cmd *cmd; 3752 struct hci_conn *conn; 3753 int err; 3754 3755 bt_dev_dbg(hdev, "sock %p", sk); 3756 3757 hci_dev_lock(hdev); 3758 3759 if (!hdev_is_powered(hdev)) { 3760 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE, 3761 MGMT_STATUS_NOT_POWERED); 3762 goto unlock; 3763 } 3764 3765 cmd = pending_find(MGMT_OP_PAIR_DEVICE, hdev); 3766 if (!cmd) { 3767 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE, 3768 MGMT_STATUS_INVALID_PARAMS); 3769 goto unlock; 3770 } 3771 3772 conn = cmd->user_data; 3773 3774 if (bacmp(&addr->bdaddr, &conn->dst) != 0) { 3775 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE, 3776 MGMT_STATUS_INVALID_PARAMS); 3777 goto unlock; 3778 } 3779 3780 cmd->cmd_complete(cmd, MGMT_STATUS_CANCELLED); 3781 mgmt_pending_remove(cmd); 3782 3783 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE, 0, 3784 addr, sizeof(*addr)); 3785 3786 /* Since user doesn't want to proceed with the connection, abort any 3787 * ongoing pairing and then terminate the link if it was created 3788 * because of the pair device action. 3789 */ 3790 if (addr->type == BDADDR_BREDR) 3791 hci_remove_link_key(hdev, &addr->bdaddr); 3792 else 3793 smp_cancel_and_remove_pairing(hdev, &addr->bdaddr, 3794 le_addr_type(addr->type)); 3795 3796 if (conn->conn_reason == CONN_REASON_PAIR_DEVICE) 3797 hci_abort_conn(conn, HCI_ERROR_REMOTE_USER_TERM); 3798 3799 unlock: 3800 hci_dev_unlock(hdev); 3801 return err; 3802 } 3803 3804 static int user_pairing_resp(struct sock *sk, struct hci_dev *hdev, 3805 struct mgmt_addr_info *addr, u16 mgmt_op, 3806 u16 hci_op, __le32 passkey) 3807 { 3808 struct mgmt_pending_cmd *cmd; 3809 struct hci_conn *conn; 3810 int err; 3811 3812 hci_dev_lock(hdev); 3813 3814 if (!hdev_is_powered(hdev)) { 3815 err = mgmt_cmd_complete(sk, hdev->id, mgmt_op, 3816 MGMT_STATUS_NOT_POWERED, addr, 3817 sizeof(*addr)); 3818 goto done; 3819 } 3820 3821 if (addr->type == BDADDR_BREDR) 3822 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &addr->bdaddr); 3823 else 3824 conn = hci_conn_hash_lookup_le(hdev, &addr->bdaddr, 3825 le_addr_type(addr->type)); 3826 3827 if (!conn) { 3828 err = mgmt_cmd_complete(sk, hdev->id, mgmt_op, 3829 MGMT_STATUS_NOT_CONNECTED, addr, 3830 sizeof(*addr)); 3831 goto done; 3832 } 3833 3834 if (addr->type == BDADDR_LE_PUBLIC || addr->type == BDADDR_LE_RANDOM) { 3835 err = smp_user_confirm_reply(conn, mgmt_op, passkey); 3836 if (!err) 3837 err = mgmt_cmd_complete(sk, hdev->id, mgmt_op, 3838 MGMT_STATUS_SUCCESS, addr, 3839 sizeof(*addr)); 3840 else 3841 err = mgmt_cmd_complete(sk, hdev->id, mgmt_op, 3842 MGMT_STATUS_FAILED, addr, 3843 sizeof(*addr)); 3844 3845 goto done; 3846 } 3847 3848 cmd = mgmt_pending_add(sk, mgmt_op, hdev, addr, sizeof(*addr)); 3849 if (!cmd) { 3850 err = -ENOMEM; 3851 goto done; 3852 } 3853 3854 cmd->cmd_complete = addr_cmd_complete; 3855 3856 /* Continue with pairing via HCI */ 3857 if (hci_op == HCI_OP_USER_PASSKEY_REPLY) { 3858 struct hci_cp_user_passkey_reply cp; 3859 3860 bacpy(&cp.bdaddr, &addr->bdaddr); 3861 cp.passkey = passkey; 3862 err = hci_send_cmd(hdev, hci_op, sizeof(cp), &cp); 3863 } else 3864 err = hci_send_cmd(hdev, hci_op, sizeof(addr->bdaddr), 3865 &addr->bdaddr); 3866 3867 if (err < 0) 3868 mgmt_pending_remove(cmd); 3869 3870 done: 3871 hci_dev_unlock(hdev); 3872 return err; 3873 } 3874 3875 static int pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev, 3876 void *data, u16 len) 3877 { 3878 struct mgmt_cp_pin_code_neg_reply *cp = data; 3879 3880 bt_dev_dbg(hdev, "sock %p", sk); 3881 3882 return user_pairing_resp(sk, hdev, &cp->addr, 3883 MGMT_OP_PIN_CODE_NEG_REPLY, 3884 HCI_OP_PIN_CODE_NEG_REPLY, 0); 3885 } 3886 3887 static int user_confirm_reply(struct sock *sk, struct hci_dev *hdev, void *data, 3888 u16 len) 3889 { 3890 struct mgmt_cp_user_confirm_reply *cp = data; 3891 3892 bt_dev_dbg(hdev, "sock %p", sk); 3893 3894 if (len != sizeof(*cp)) 3895 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_USER_CONFIRM_REPLY, 3896 MGMT_STATUS_INVALID_PARAMS); 3897 3898 return user_pairing_resp(sk, hdev, &cp->addr, 3899 MGMT_OP_USER_CONFIRM_REPLY, 3900 HCI_OP_USER_CONFIRM_REPLY, 0); 3901 } 3902 3903 static int user_confirm_neg_reply(struct sock *sk, struct hci_dev *hdev, 3904 void *data, u16 len) 3905 { 3906 struct mgmt_cp_user_confirm_neg_reply *cp = data; 3907 3908 bt_dev_dbg(hdev, "sock %p", sk); 3909 3910 return user_pairing_resp(sk, hdev, &cp->addr, 3911 MGMT_OP_USER_CONFIRM_NEG_REPLY, 3912 HCI_OP_USER_CONFIRM_NEG_REPLY, 0); 3913 } 3914 3915 static int user_passkey_reply(struct sock *sk, struct hci_dev *hdev, void *data, 3916 u16 len) 3917 { 3918 struct mgmt_cp_user_passkey_reply *cp = data; 3919 3920 bt_dev_dbg(hdev, "sock %p", sk); 3921 3922 return user_pairing_resp(sk, hdev, &cp->addr, 3923 MGMT_OP_USER_PASSKEY_REPLY, 3924 HCI_OP_USER_PASSKEY_REPLY, cp->passkey); 3925 } 3926 3927 static int user_passkey_neg_reply(struct sock *sk, struct hci_dev *hdev, 3928 void *data, u16 len) 3929 { 3930 struct mgmt_cp_user_passkey_neg_reply *cp = data; 3931 3932 bt_dev_dbg(hdev, "sock %p", sk); 3933 3934 return user_pairing_resp(sk, hdev, &cp->addr, 3935 MGMT_OP_USER_PASSKEY_NEG_REPLY, 3936 HCI_OP_USER_PASSKEY_NEG_REPLY, 0); 3937 } 3938 3939 static int adv_expire_sync(struct hci_dev *hdev, u32 flags) 3940 { 3941 struct adv_info *adv_instance; 3942 3943 adv_instance = hci_find_adv_instance(hdev, hdev->cur_adv_instance); 3944 if (!adv_instance) 3945 return 0; 3946 3947 /* stop if current instance doesn't need to be changed */ 3948 if (!(adv_instance->flags & flags)) 3949 return 0; 3950 3951 cancel_adv_timeout(hdev); 3952 3953 adv_instance = hci_get_next_instance(hdev, adv_instance->instance); 3954 if (!adv_instance) 3955 return 0; 3956 3957 hci_schedule_adv_instance_sync(hdev, adv_instance->instance, true); 3958 3959 return 0; 3960 } 3961 3962 static int name_changed_sync(struct hci_dev *hdev, void *data) 3963 { 3964 return adv_expire_sync(hdev, MGMT_ADV_FLAG_LOCAL_NAME); 3965 } 3966 3967 static void set_name_complete(struct hci_dev *hdev, void *data, int err) 3968 { 3969 struct mgmt_pending_cmd *cmd = data; 3970 struct mgmt_cp_set_local_name *cp; 3971 u8 status = mgmt_status(err); 3972 3973 bt_dev_dbg(hdev, "err %d", err); 3974 3975 if (err == -ECANCELED || !mgmt_pending_valid(hdev, cmd)) 3976 return; 3977 3978 cp = cmd->param; 3979 3980 if (status) { 3981 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 3982 status); 3983 } else { 3984 mgmt_cmd_complete(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0, 3985 cp, sizeof(*cp)); 3986 3987 if (hci_dev_test_flag(hdev, HCI_LE_ADV)) 3988 hci_cmd_sync_queue(hdev, name_changed_sync, NULL, NULL); 3989 } 3990 3991 mgmt_pending_free(cmd); 3992 } 3993 3994 static int set_name_sync(struct hci_dev *hdev, void *data) 3995 { 3996 struct mgmt_pending_cmd *cmd = data; 3997 struct mgmt_cp_set_local_name cp; 3998 3999 mutex_lock(&hdev->mgmt_pending_lock); 4000 4001 if (!__mgmt_pending_listed(hdev, cmd)) { 4002 mutex_unlock(&hdev->mgmt_pending_lock); 4003 return -ECANCELED; 4004 } 4005 4006 memcpy(&cp, cmd->param, sizeof(cp)); 4007 4008 mutex_unlock(&hdev->mgmt_pending_lock); 4009 4010 if (lmp_bredr_capable(hdev)) { 4011 hci_update_name_sync(hdev, cp.name); 4012 hci_update_eir_sync(hdev); 4013 } 4014 4015 /* The name is stored in the scan response data and so 4016 * no need to update the advertising data here. 4017 */ 4018 if (lmp_le_capable(hdev) && hci_dev_test_flag(hdev, HCI_ADVERTISING)) 4019 hci_update_scan_rsp_data_sync(hdev, hdev->cur_adv_instance); 4020 4021 return 0; 4022 } 4023 4024 static int set_local_name(struct sock *sk, struct hci_dev *hdev, void *data, 4025 u16 len) 4026 { 4027 struct mgmt_cp_set_local_name *cp = data; 4028 struct mgmt_pending_cmd *cmd; 4029 int err; 4030 4031 bt_dev_dbg(hdev, "sock %p", sk); 4032 4033 hci_dev_lock(hdev); 4034 4035 /* If the old values are the same as the new ones just return a 4036 * direct command complete event. 4037 */ 4038 if (!memcmp(hdev->dev_name, cp->name, sizeof(hdev->dev_name)) && 4039 !memcmp(hdev->short_name, cp->short_name, 4040 sizeof(hdev->short_name))) { 4041 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0, 4042 data, len); 4043 goto failed; 4044 } 4045 4046 memcpy(hdev->short_name, cp->short_name, sizeof(hdev->short_name)); 4047 4048 if (!hdev_is_powered(hdev)) { 4049 memcpy(hdev->dev_name, cp->name, sizeof(hdev->dev_name)); 4050 4051 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0, 4052 data, len); 4053 if (err < 0) 4054 goto failed; 4055 4056 err = mgmt_limited_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, data, 4057 len, HCI_MGMT_LOCAL_NAME_EVENTS, sk); 4058 ext_info_changed(hdev, sk); 4059 4060 goto failed; 4061 } 4062 4063 cmd = mgmt_pending_add(sk, MGMT_OP_SET_LOCAL_NAME, hdev, data, len); 4064 if (!cmd) 4065 err = -ENOMEM; 4066 else 4067 err = hci_cmd_sync_queue(hdev, set_name_sync, cmd, 4068 set_name_complete); 4069 4070 if (err < 0) { 4071 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 4072 MGMT_STATUS_FAILED); 4073 4074 if (cmd) 4075 mgmt_pending_remove(cmd); 4076 4077 goto failed; 4078 } 4079 4080 memcpy(hdev->dev_name, cp->name, sizeof(hdev->dev_name)); 4081 4082 failed: 4083 hci_dev_unlock(hdev); 4084 return err; 4085 } 4086 4087 static int appearance_changed_sync(struct hci_dev *hdev, void *data) 4088 { 4089 return adv_expire_sync(hdev, MGMT_ADV_FLAG_APPEARANCE); 4090 } 4091 4092 static int set_appearance(struct sock *sk, struct hci_dev *hdev, void *data, 4093 u16 len) 4094 { 4095 struct mgmt_cp_set_appearance *cp = data; 4096 u16 appearance; 4097 int err; 4098 4099 bt_dev_dbg(hdev, "sock %p", sk); 4100 4101 if (!lmp_le_capable(hdev)) 4102 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_APPEARANCE, 4103 MGMT_STATUS_NOT_SUPPORTED); 4104 4105 appearance = le16_to_cpu(cp->appearance); 4106 4107 hci_dev_lock(hdev); 4108 4109 if (hdev->appearance != appearance) { 4110 hdev->appearance = appearance; 4111 4112 if (hci_dev_test_flag(hdev, HCI_LE_ADV)) 4113 hci_cmd_sync_queue(hdev, appearance_changed_sync, NULL, 4114 NULL); 4115 4116 ext_info_changed(hdev, sk); 4117 } 4118 4119 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_APPEARANCE, 0, NULL, 4120 0); 4121 4122 hci_dev_unlock(hdev); 4123 4124 return err; 4125 } 4126 4127 static int get_phy_configuration(struct sock *sk, struct hci_dev *hdev, 4128 void *data, u16 len) 4129 { 4130 struct mgmt_rp_get_phy_configuration rp; 4131 4132 bt_dev_dbg(hdev, "sock %p", sk); 4133 4134 hci_dev_lock(hdev); 4135 4136 memset(&rp, 0, sizeof(rp)); 4137 4138 rp.supported_phys = cpu_to_le32(get_supported_phys(hdev)); 4139 rp.selected_phys = cpu_to_le32(get_selected_phys(hdev)); 4140 rp.configurable_phys = cpu_to_le32(get_configurable_phys(hdev)); 4141 4142 hci_dev_unlock(hdev); 4143 4144 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_PHY_CONFIGURATION, 0, 4145 &rp, sizeof(rp)); 4146 } 4147 4148 int mgmt_phy_configuration_changed(struct hci_dev *hdev, struct sock *skip) 4149 { 4150 struct mgmt_ev_phy_configuration_changed ev; 4151 4152 memset(&ev, 0, sizeof(ev)); 4153 4154 ev.selected_phys = cpu_to_le32(get_selected_phys(hdev)); 4155 4156 return mgmt_event(MGMT_EV_PHY_CONFIGURATION_CHANGED, hdev, &ev, 4157 sizeof(ev), skip); 4158 } 4159 4160 static void set_default_phy_complete(struct hci_dev *hdev, void *data, int err) 4161 { 4162 struct mgmt_pending_cmd *cmd = data; 4163 struct sk_buff *skb; 4164 u8 status = mgmt_status(err); 4165 4166 skb = cmd->skb; 4167 4168 if (!status) { 4169 if (!skb) 4170 status = MGMT_STATUS_FAILED; 4171 else if (IS_ERR(skb)) 4172 status = mgmt_status(PTR_ERR(skb)); 4173 else 4174 status = mgmt_status(skb->data[0]); 4175 } 4176 4177 bt_dev_dbg(hdev, "status %d", status); 4178 4179 if (status) { 4180 mgmt_cmd_status(cmd->sk, hdev->id, 4181 MGMT_OP_SET_PHY_CONFIGURATION, status); 4182 } else { 4183 mgmt_cmd_complete(cmd->sk, hdev->id, 4184 MGMT_OP_SET_PHY_CONFIGURATION, 0, 4185 NULL, 0); 4186 4187 mgmt_phy_configuration_changed(hdev, cmd->sk); 4188 } 4189 4190 if (skb && !IS_ERR(skb)) 4191 kfree_skb(skb); 4192 4193 mgmt_pending_free(cmd); 4194 } 4195 4196 static int set_default_phy_sync(struct hci_dev *hdev, void *data) 4197 { 4198 struct mgmt_pending_cmd *cmd = data; 4199 struct mgmt_cp_set_phy_configuration *cp = cmd->param; 4200 struct hci_cp_le_set_default_phy cp_phy; 4201 u32 selected_phys; 4202 4203 selected_phys = __le32_to_cpu(cp->selected_phys); 4204 4205 memset(&cp_phy, 0, sizeof(cp_phy)); 4206 4207 if (!(selected_phys & MGMT_PHY_LE_TX_MASK)) 4208 cp_phy.all_phys |= 0x01; 4209 4210 if (!(selected_phys & MGMT_PHY_LE_RX_MASK)) 4211 cp_phy.all_phys |= 0x02; 4212 4213 if (selected_phys & MGMT_PHY_LE_1M_TX) 4214 cp_phy.tx_phys |= HCI_LE_SET_PHY_1M; 4215 4216 if (selected_phys & MGMT_PHY_LE_2M_TX) 4217 cp_phy.tx_phys |= HCI_LE_SET_PHY_2M; 4218 4219 if (selected_phys & MGMT_PHY_LE_CODED_TX) 4220 cp_phy.tx_phys |= HCI_LE_SET_PHY_CODED; 4221 4222 if (selected_phys & MGMT_PHY_LE_1M_RX) 4223 cp_phy.rx_phys |= HCI_LE_SET_PHY_1M; 4224 4225 if (selected_phys & MGMT_PHY_LE_2M_RX) 4226 cp_phy.rx_phys |= HCI_LE_SET_PHY_2M; 4227 4228 if (selected_phys & MGMT_PHY_LE_CODED_RX) 4229 cp_phy.rx_phys |= HCI_LE_SET_PHY_CODED; 4230 4231 cmd->skb = __hci_cmd_sync(hdev, HCI_OP_LE_SET_DEFAULT_PHY, 4232 sizeof(cp_phy), &cp_phy, HCI_CMD_TIMEOUT); 4233 4234 return 0; 4235 } 4236 4237 static int set_phy_configuration(struct sock *sk, struct hci_dev *hdev, 4238 void *data, u16 len) 4239 { 4240 struct mgmt_cp_set_phy_configuration *cp = data; 4241 struct mgmt_pending_cmd *cmd; 4242 u32 selected_phys, configurable_phys, supported_phys, unconfigure_phys; 4243 u16 pkt_type = (HCI_DH1 | HCI_DM1); 4244 bool changed = false; 4245 int err; 4246 4247 bt_dev_dbg(hdev, "sock %p", sk); 4248 4249 configurable_phys = get_configurable_phys(hdev); 4250 supported_phys = get_supported_phys(hdev); 4251 selected_phys = __le32_to_cpu(cp->selected_phys); 4252 4253 if (selected_phys & ~supported_phys) 4254 return mgmt_cmd_status(sk, hdev->id, 4255 MGMT_OP_SET_PHY_CONFIGURATION, 4256 MGMT_STATUS_INVALID_PARAMS); 4257 4258 unconfigure_phys = supported_phys & ~configurable_phys; 4259 4260 if ((selected_phys & unconfigure_phys) != unconfigure_phys) 4261 return mgmt_cmd_status(sk, hdev->id, 4262 MGMT_OP_SET_PHY_CONFIGURATION, 4263 MGMT_STATUS_INVALID_PARAMS); 4264 4265 if (selected_phys == get_selected_phys(hdev)) 4266 return mgmt_cmd_complete(sk, hdev->id, 4267 MGMT_OP_SET_PHY_CONFIGURATION, 4268 0, NULL, 0); 4269 4270 hci_dev_lock(hdev); 4271 4272 if (!hdev_is_powered(hdev)) { 4273 err = mgmt_cmd_status(sk, hdev->id, 4274 MGMT_OP_SET_PHY_CONFIGURATION, 4275 MGMT_STATUS_REJECTED); 4276 goto unlock; 4277 } 4278 4279 if (pending_find(MGMT_OP_SET_PHY_CONFIGURATION, hdev)) { 4280 err = mgmt_cmd_status(sk, hdev->id, 4281 MGMT_OP_SET_PHY_CONFIGURATION, 4282 MGMT_STATUS_BUSY); 4283 goto unlock; 4284 } 4285 4286 if (selected_phys & MGMT_PHY_BR_1M_3SLOT) 4287 pkt_type |= (HCI_DH3 | HCI_DM3); 4288 else 4289 pkt_type &= ~(HCI_DH3 | HCI_DM3); 4290 4291 if (selected_phys & MGMT_PHY_BR_1M_5SLOT) 4292 pkt_type |= (HCI_DH5 | HCI_DM5); 4293 else 4294 pkt_type &= ~(HCI_DH5 | HCI_DM5); 4295 4296 if (selected_phys & MGMT_PHY_EDR_2M_1SLOT) 4297 pkt_type &= ~HCI_2DH1; 4298 else 4299 pkt_type |= HCI_2DH1; 4300 4301 if (selected_phys & MGMT_PHY_EDR_2M_3SLOT) 4302 pkt_type &= ~HCI_2DH3; 4303 else 4304 pkt_type |= HCI_2DH3; 4305 4306 if (selected_phys & MGMT_PHY_EDR_2M_5SLOT) 4307 pkt_type &= ~HCI_2DH5; 4308 else 4309 pkt_type |= HCI_2DH5; 4310 4311 if (selected_phys & MGMT_PHY_EDR_3M_1SLOT) 4312 pkt_type &= ~HCI_3DH1; 4313 else 4314 pkt_type |= HCI_3DH1; 4315 4316 if (selected_phys & MGMT_PHY_EDR_3M_3SLOT) 4317 pkt_type &= ~HCI_3DH3; 4318 else 4319 pkt_type |= HCI_3DH3; 4320 4321 if (selected_phys & MGMT_PHY_EDR_3M_5SLOT) 4322 pkt_type &= ~HCI_3DH5; 4323 else 4324 pkt_type |= HCI_3DH5; 4325 4326 if (pkt_type != hdev->pkt_type) { 4327 hdev->pkt_type = pkt_type; 4328 changed = true; 4329 } 4330 4331 if ((selected_phys & MGMT_PHY_LE_MASK) == 4332 (get_selected_phys(hdev) & MGMT_PHY_LE_MASK)) { 4333 if (changed) 4334 mgmt_phy_configuration_changed(hdev, sk); 4335 4336 err = mgmt_cmd_complete(sk, hdev->id, 4337 MGMT_OP_SET_PHY_CONFIGURATION, 4338 0, NULL, 0); 4339 4340 goto unlock; 4341 } 4342 4343 cmd = mgmt_pending_new(sk, MGMT_OP_SET_PHY_CONFIGURATION, hdev, data, 4344 len); 4345 if (!cmd) 4346 err = -ENOMEM; 4347 else 4348 err = hci_cmd_sync_queue(hdev, set_default_phy_sync, cmd, 4349 set_default_phy_complete); 4350 4351 if (err < 0) { 4352 err = mgmt_cmd_status(sk, hdev->id, 4353 MGMT_OP_SET_PHY_CONFIGURATION, 4354 MGMT_STATUS_FAILED); 4355 4356 if (cmd) 4357 mgmt_pending_remove(cmd); 4358 } 4359 4360 unlock: 4361 hci_dev_unlock(hdev); 4362 4363 return err; 4364 } 4365 4366 static int set_blocked_keys(struct sock *sk, struct hci_dev *hdev, void *data, 4367 u16 len) 4368 { 4369 int err = MGMT_STATUS_SUCCESS; 4370 struct mgmt_cp_set_blocked_keys *keys = data; 4371 const u16 max_key_count = ((U16_MAX - sizeof(*keys)) / 4372 sizeof(struct mgmt_blocked_key_info)); 4373 u16 key_count, expected_len; 4374 int i; 4375 4376 bt_dev_dbg(hdev, "sock %p", sk); 4377 4378 key_count = __le16_to_cpu(keys->key_count); 4379 if (key_count > max_key_count) { 4380 bt_dev_err(hdev, "too big key_count value %u", key_count); 4381 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BLOCKED_KEYS, 4382 MGMT_STATUS_INVALID_PARAMS); 4383 } 4384 4385 expected_len = struct_size(keys, keys, key_count); 4386 if (expected_len != len) { 4387 bt_dev_err(hdev, "expected %u bytes, got %u bytes", 4388 expected_len, len); 4389 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BLOCKED_KEYS, 4390 MGMT_STATUS_INVALID_PARAMS); 4391 } 4392 4393 hci_dev_lock(hdev); 4394 4395 hci_blocked_keys_clear(hdev); 4396 4397 for (i = 0; i < key_count; ++i) { 4398 struct blocked_key *b = kzalloc_obj(*b); 4399 4400 if (!b) { 4401 err = MGMT_STATUS_NO_RESOURCES; 4402 break; 4403 } 4404 4405 b->type = keys->keys[i].type; 4406 memcpy(b->val, keys->keys[i].val, sizeof(b->val)); 4407 list_add_rcu(&b->list, &hdev->blocked_keys); 4408 } 4409 hci_dev_unlock(hdev); 4410 4411 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_BLOCKED_KEYS, 4412 err, NULL, 0); 4413 } 4414 4415 static int set_wideband_speech(struct sock *sk, struct hci_dev *hdev, 4416 void *data, u16 len) 4417 { 4418 struct mgmt_mode *cp = data; 4419 int err; 4420 bool changed = false; 4421 4422 bt_dev_dbg(hdev, "sock %p", sk); 4423 4424 if (!hci_test_quirk(hdev, HCI_QUIRK_WIDEBAND_SPEECH_SUPPORTED)) 4425 return mgmt_cmd_status(sk, hdev->id, 4426 MGMT_OP_SET_WIDEBAND_SPEECH, 4427 MGMT_STATUS_NOT_SUPPORTED); 4428 4429 if (cp->val != 0x00 && cp->val != 0x01) 4430 return mgmt_cmd_status(sk, hdev->id, 4431 MGMT_OP_SET_WIDEBAND_SPEECH, 4432 MGMT_STATUS_INVALID_PARAMS); 4433 4434 hci_dev_lock(hdev); 4435 4436 if (hdev_is_powered(hdev) && 4437 !!cp->val != hci_dev_test_flag(hdev, 4438 HCI_WIDEBAND_SPEECH_ENABLED)) { 4439 err = mgmt_cmd_status(sk, hdev->id, 4440 MGMT_OP_SET_WIDEBAND_SPEECH, 4441 MGMT_STATUS_REJECTED); 4442 goto unlock; 4443 } 4444 4445 if (cp->val) 4446 changed = !hci_dev_test_and_set_flag(hdev, 4447 HCI_WIDEBAND_SPEECH_ENABLED); 4448 else 4449 changed = hci_dev_test_and_clear_flag(hdev, 4450 HCI_WIDEBAND_SPEECH_ENABLED); 4451 4452 err = send_settings_rsp(sk, MGMT_OP_SET_WIDEBAND_SPEECH, hdev); 4453 if (err < 0) 4454 goto unlock; 4455 4456 if (changed) 4457 err = new_settings(hdev, sk); 4458 4459 unlock: 4460 hci_dev_unlock(hdev); 4461 return err; 4462 } 4463 4464 static int read_controller_cap(struct sock *sk, struct hci_dev *hdev, 4465 void *data, u16 data_len) 4466 { 4467 char buf[20]; 4468 struct mgmt_rp_read_controller_cap *rp = (void *)buf; 4469 u16 cap_len = 0; 4470 u8 flags = 0; 4471 u8 tx_power_range[2]; 4472 4473 bt_dev_dbg(hdev, "sock %p", sk); 4474 4475 memset(&buf, 0, sizeof(buf)); 4476 4477 hci_dev_lock(hdev); 4478 4479 /* When the Read Simple Pairing Options command is supported, then 4480 * the remote public key validation is supported. 4481 * 4482 * Alternatively, when Microsoft extensions are available, they can 4483 * indicate support for public key validation as well. 4484 */ 4485 if ((hdev->commands[41] & 0x08) || msft_curve_validity(hdev)) 4486 flags |= 0x01; /* Remote public key validation (BR/EDR) */ 4487 4488 flags |= 0x02; /* Remote public key validation (LE) */ 4489 4490 /* When the Read Encryption Key Size command is supported, then the 4491 * encryption key size is enforced. 4492 */ 4493 if (hdev->commands[20] & 0x10) 4494 flags |= 0x04; /* Encryption key size enforcement (BR/EDR) */ 4495 4496 flags |= 0x08; /* Encryption key size enforcement (LE) */ 4497 4498 cap_len = eir_append_data(rp->cap, cap_len, MGMT_CAP_SEC_FLAGS, 4499 &flags, 1); 4500 4501 /* When the Read Simple Pairing Options command is supported, then 4502 * also max encryption key size information is provided. 4503 */ 4504 if (hdev->commands[41] & 0x08) 4505 cap_len = eir_append_le16(rp->cap, cap_len, 4506 MGMT_CAP_MAX_ENC_KEY_SIZE, 4507 hdev->max_enc_key_size); 4508 4509 cap_len = eir_append_le16(rp->cap, cap_len, 4510 MGMT_CAP_SMP_MAX_ENC_KEY_SIZE, 4511 SMP_MAX_ENC_KEY_SIZE); 4512 4513 /* Append the min/max LE tx power parameters if we were able to fetch 4514 * it from the controller 4515 */ 4516 if (hdev->commands[38] & 0x80) { 4517 memcpy(&tx_power_range[0], &hdev->min_le_tx_power, 1); 4518 memcpy(&tx_power_range[1], &hdev->max_le_tx_power, 1); 4519 cap_len = eir_append_data(rp->cap, cap_len, MGMT_CAP_LE_TX_PWR, 4520 tx_power_range, 2); 4521 } 4522 4523 rp->cap_len = cpu_to_le16(cap_len); 4524 4525 hci_dev_unlock(hdev); 4526 4527 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_CONTROLLER_CAP, 0, 4528 rp, sizeof(*rp) + cap_len); 4529 } 4530 4531 #ifdef CONFIG_BT_FEATURE_DEBUG 4532 /* d4992530-b9ec-469f-ab01-6c481c47da1c */ 4533 static const u8 debug_uuid[16] = { 4534 0x1c, 0xda, 0x47, 0x1c, 0x48, 0x6c, 0x01, 0xab, 4535 0x9f, 0x46, 0xec, 0xb9, 0x30, 0x25, 0x99, 0xd4, 4536 }; 4537 #endif 4538 4539 /* 330859bc-7506-492d-9370-9a6f0614037f */ 4540 static const u8 quality_report_uuid[16] = { 4541 0x7f, 0x03, 0x14, 0x06, 0x6f, 0x9a, 0x70, 0x93, 4542 0x2d, 0x49, 0x06, 0x75, 0xbc, 0x59, 0x08, 0x33, 4543 }; 4544 4545 /* a6695ace-ee7f-4fb9-881a-5fac66c629af */ 4546 static const u8 offload_codecs_uuid[16] = { 4547 0xaf, 0x29, 0xc6, 0x66, 0xac, 0x5f, 0x1a, 0x88, 4548 0xb9, 0x4f, 0x7f, 0xee, 0xce, 0x5a, 0x69, 0xa6, 4549 }; 4550 4551 /* 671b10b5-42c0-4696-9227-eb28d1b049d6 */ 4552 static const u8 le_simultaneous_roles_uuid[16] = { 4553 0xd6, 0x49, 0xb0, 0xd1, 0x28, 0xeb, 0x27, 0x92, 4554 0x96, 0x46, 0xc0, 0x42, 0xb5, 0x10, 0x1b, 0x67, 4555 }; 4556 4557 /* 6fbaf188-05e0-496a-9885-d6ddfdb4e03e */ 4558 static const u8 iso_socket_uuid[16] = { 4559 0x3e, 0xe0, 0xb4, 0xfd, 0xdd, 0xd6, 0x85, 0x98, 4560 0x6a, 0x49, 0xe0, 0x05, 0x88, 0xf1, 0xba, 0x6f, 4561 }; 4562 4563 /* 2ce463d7-7a03-4d8d-bf05-5f24e8f36e76 */ 4564 static const u8 mgmt_mesh_uuid[16] = { 4565 0x76, 0x6e, 0xf3, 0xe8, 0x24, 0x5f, 0x05, 0xbf, 4566 0x8d, 0x4d, 0x03, 0x7a, 0xd7, 0x63, 0xe4, 0x2c, 4567 }; 4568 4569 static int read_exp_features_info(struct sock *sk, struct hci_dev *hdev, 4570 void *data, u16 data_len) 4571 { 4572 struct mgmt_rp_read_exp_features_info *rp; 4573 size_t len; 4574 u16 idx = 0; 4575 u32 flags; 4576 int status; 4577 4578 bt_dev_dbg(hdev, "sock %p", sk); 4579 4580 /* Enough space for 7 features */ 4581 len = sizeof(*rp) + (sizeof(rp->features[0]) * 7); 4582 rp = kzalloc(len, GFP_KERNEL); 4583 if (!rp) 4584 return -ENOMEM; 4585 4586 #ifdef CONFIG_BT_FEATURE_DEBUG 4587 flags = bt_dbg_get() ? BIT(0) : 0; 4588 4589 memcpy(rp->features[idx].uuid, debug_uuid, 16); 4590 rp->features[idx].flags = cpu_to_le32(flags); 4591 idx++; 4592 #endif 4593 4594 if (hdev && hci_dev_le_state_simultaneous(hdev)) { 4595 if (hci_dev_test_flag(hdev, HCI_LE_SIMULTANEOUS_ROLES)) 4596 flags = BIT(0); 4597 else 4598 flags = 0; 4599 4600 memcpy(rp->features[idx].uuid, le_simultaneous_roles_uuid, 16); 4601 rp->features[idx].flags = cpu_to_le32(flags); 4602 idx++; 4603 } 4604 4605 if (hdev && (aosp_has_quality_report(hdev) || 4606 hdev->set_quality_report)) { 4607 if (hci_dev_test_flag(hdev, HCI_QUALITY_REPORT)) 4608 flags = BIT(0); 4609 else 4610 flags = 0; 4611 4612 memcpy(rp->features[idx].uuid, quality_report_uuid, 16); 4613 rp->features[idx].flags = cpu_to_le32(flags); 4614 idx++; 4615 } 4616 4617 if (hdev && hdev->get_data_path_id) { 4618 if (hci_dev_test_flag(hdev, HCI_OFFLOAD_CODECS_ENABLED)) 4619 flags = BIT(0); 4620 else 4621 flags = 0; 4622 4623 memcpy(rp->features[idx].uuid, offload_codecs_uuid, 16); 4624 rp->features[idx].flags = cpu_to_le32(flags); 4625 idx++; 4626 } 4627 4628 if (IS_ENABLED(CONFIG_BT_LE)) { 4629 flags = iso_inited() ? BIT(0) : 0; 4630 memcpy(rp->features[idx].uuid, iso_socket_uuid, 16); 4631 rp->features[idx].flags = cpu_to_le32(flags); 4632 idx++; 4633 } 4634 4635 if (hdev && lmp_le_capable(hdev)) { 4636 if (hci_dev_test_flag(hdev, HCI_MESH_EXPERIMENTAL)) 4637 flags = BIT(0); 4638 else 4639 flags = 0; 4640 4641 memcpy(rp->features[idx].uuid, mgmt_mesh_uuid, 16); 4642 rp->features[idx].flags = cpu_to_le32(flags); 4643 idx++; 4644 } 4645 4646 rp->feature_count = cpu_to_le16(idx); 4647 4648 /* After reading the experimental features information, enable 4649 * the events to update client on any future change. 4650 */ 4651 hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS); 4652 4653 status = mgmt_cmd_complete(sk, hdev ? hdev->id : MGMT_INDEX_NONE, 4654 MGMT_OP_READ_EXP_FEATURES_INFO, 4655 0, rp, sizeof(*rp) + (20 * idx)); 4656 4657 kfree(rp); 4658 return status; 4659 } 4660 4661 static int exp_feature_changed(struct hci_dev *hdev, const u8 *uuid, 4662 bool enabled, struct sock *skip) 4663 { 4664 struct mgmt_ev_exp_feature_changed ev; 4665 4666 memset(&ev, 0, sizeof(ev)); 4667 memcpy(ev.uuid, uuid, 16); 4668 ev.flags = cpu_to_le32(enabled ? BIT(0) : 0); 4669 4670 return mgmt_limited_event(MGMT_EV_EXP_FEATURE_CHANGED, hdev, 4671 &ev, sizeof(ev), 4672 HCI_MGMT_EXP_FEATURE_EVENTS, skip); 4673 } 4674 4675 #define EXP_FEAT(_uuid, _set_func) \ 4676 { \ 4677 .uuid = _uuid, \ 4678 .set_func = _set_func, \ 4679 } 4680 4681 /* The zero key uuid is special. Multiple exp features are set through it. */ 4682 static int set_zero_key_func(struct sock *sk, struct hci_dev *hdev, 4683 struct mgmt_cp_set_exp_feature *cp, u16 data_len) 4684 { 4685 struct mgmt_rp_set_exp_feature rp; 4686 4687 memset(rp.uuid, 0, 16); 4688 rp.flags = cpu_to_le32(0); 4689 4690 #ifdef CONFIG_BT_FEATURE_DEBUG 4691 if (!hdev) { 4692 bool changed = bt_dbg_get(); 4693 4694 bt_dbg_set(false); 4695 4696 if (changed) 4697 exp_feature_changed(NULL, ZERO_KEY, false, sk); 4698 } 4699 #endif 4700 4701 hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS); 4702 4703 return mgmt_cmd_complete(sk, hdev ? hdev->id : MGMT_INDEX_NONE, 4704 MGMT_OP_SET_EXP_FEATURE, 0, 4705 &rp, sizeof(rp)); 4706 } 4707 4708 #ifdef CONFIG_BT_FEATURE_DEBUG 4709 static int set_debug_func(struct sock *sk, struct hci_dev *hdev, 4710 struct mgmt_cp_set_exp_feature *cp, u16 data_len) 4711 { 4712 struct mgmt_rp_set_exp_feature rp; 4713 4714 bool val, changed; 4715 int err; 4716 4717 /* Command requires to use the non-controller index */ 4718 if (hdev) 4719 return mgmt_cmd_status(sk, hdev->id, 4720 MGMT_OP_SET_EXP_FEATURE, 4721 MGMT_STATUS_INVALID_INDEX); 4722 4723 /* Parameters are limited to a single octet */ 4724 if (data_len != MGMT_SET_EXP_FEATURE_SIZE + 1) 4725 return mgmt_cmd_status(sk, MGMT_INDEX_NONE, 4726 MGMT_OP_SET_EXP_FEATURE, 4727 MGMT_STATUS_INVALID_PARAMS); 4728 4729 /* Only boolean on/off is supported */ 4730 if (cp->param[0] != 0x00 && cp->param[0] != 0x01) 4731 return mgmt_cmd_status(sk, MGMT_INDEX_NONE, 4732 MGMT_OP_SET_EXP_FEATURE, 4733 MGMT_STATUS_INVALID_PARAMS); 4734 4735 val = !!cp->param[0]; 4736 changed = val ? !bt_dbg_get() : bt_dbg_get(); 4737 bt_dbg_set(val); 4738 4739 memcpy(rp.uuid, debug_uuid, 16); 4740 rp.flags = cpu_to_le32(val ? BIT(0) : 0); 4741 4742 hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS); 4743 4744 err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE, 4745 MGMT_OP_SET_EXP_FEATURE, 0, 4746 &rp, sizeof(rp)); 4747 4748 if (changed) 4749 exp_feature_changed(hdev, debug_uuid, val, sk); 4750 4751 return err; 4752 } 4753 #endif 4754 4755 static int set_mgmt_mesh_func(struct sock *sk, struct hci_dev *hdev, 4756 struct mgmt_cp_set_exp_feature *cp, u16 data_len) 4757 { 4758 struct mgmt_rp_set_exp_feature rp; 4759 bool val, changed; 4760 int err; 4761 4762 /* Command requires to use the controller index */ 4763 if (!hdev) 4764 return mgmt_cmd_status(sk, MGMT_INDEX_NONE, 4765 MGMT_OP_SET_EXP_FEATURE, 4766 MGMT_STATUS_INVALID_INDEX); 4767 4768 /* Parameters are limited to a single octet */ 4769 if (data_len != MGMT_SET_EXP_FEATURE_SIZE + 1) 4770 return mgmt_cmd_status(sk, hdev->id, 4771 MGMT_OP_SET_EXP_FEATURE, 4772 MGMT_STATUS_INVALID_PARAMS); 4773 4774 /* Only boolean on/off is supported */ 4775 if (cp->param[0] != 0x00 && cp->param[0] != 0x01) 4776 return mgmt_cmd_status(sk, hdev->id, 4777 MGMT_OP_SET_EXP_FEATURE, 4778 MGMT_STATUS_INVALID_PARAMS); 4779 4780 val = !!cp->param[0]; 4781 4782 if (val) { 4783 changed = !hci_dev_test_and_set_flag(hdev, 4784 HCI_MESH_EXPERIMENTAL); 4785 } else { 4786 hci_dev_clear_flag(hdev, HCI_MESH); 4787 changed = hci_dev_test_and_clear_flag(hdev, 4788 HCI_MESH_EXPERIMENTAL); 4789 } 4790 4791 memcpy(rp.uuid, mgmt_mesh_uuid, 16); 4792 rp.flags = cpu_to_le32(val ? BIT(0) : 0); 4793 4794 hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS); 4795 4796 err = mgmt_cmd_complete(sk, hdev->id, 4797 MGMT_OP_SET_EXP_FEATURE, 0, 4798 &rp, sizeof(rp)); 4799 4800 if (changed) 4801 exp_feature_changed(hdev, mgmt_mesh_uuid, val, sk); 4802 4803 return err; 4804 } 4805 4806 static int set_quality_report_func(struct sock *sk, struct hci_dev *hdev, 4807 struct mgmt_cp_set_exp_feature *cp, 4808 u16 data_len) 4809 { 4810 struct mgmt_rp_set_exp_feature rp; 4811 bool val, changed; 4812 int err; 4813 4814 /* Command requires to use a valid controller index */ 4815 if (!hdev) 4816 return mgmt_cmd_status(sk, MGMT_INDEX_NONE, 4817 MGMT_OP_SET_EXP_FEATURE, 4818 MGMT_STATUS_INVALID_INDEX); 4819 4820 /* Parameters are limited to a single octet */ 4821 if (data_len != MGMT_SET_EXP_FEATURE_SIZE + 1) 4822 return mgmt_cmd_status(sk, hdev->id, 4823 MGMT_OP_SET_EXP_FEATURE, 4824 MGMT_STATUS_INVALID_PARAMS); 4825 4826 /* Only boolean on/off is supported */ 4827 if (cp->param[0] != 0x00 && cp->param[0] != 0x01) 4828 return mgmt_cmd_status(sk, hdev->id, 4829 MGMT_OP_SET_EXP_FEATURE, 4830 MGMT_STATUS_INVALID_PARAMS); 4831 4832 hci_req_sync_lock(hdev); 4833 4834 val = !!cp->param[0]; 4835 changed = (val != hci_dev_test_flag(hdev, HCI_QUALITY_REPORT)); 4836 4837 if (!aosp_has_quality_report(hdev) && !hdev->set_quality_report) { 4838 err = mgmt_cmd_status(sk, hdev->id, 4839 MGMT_OP_SET_EXP_FEATURE, 4840 MGMT_STATUS_NOT_SUPPORTED); 4841 goto unlock_quality_report; 4842 } 4843 4844 if (changed) { 4845 if (hdev->set_quality_report) 4846 err = hdev->set_quality_report(hdev, val); 4847 else 4848 err = aosp_set_quality_report(hdev, val); 4849 4850 if (err) { 4851 err = mgmt_cmd_status(sk, hdev->id, 4852 MGMT_OP_SET_EXP_FEATURE, 4853 MGMT_STATUS_FAILED); 4854 goto unlock_quality_report; 4855 } 4856 4857 if (val) 4858 hci_dev_set_flag(hdev, HCI_QUALITY_REPORT); 4859 else 4860 hci_dev_clear_flag(hdev, HCI_QUALITY_REPORT); 4861 } 4862 4863 bt_dev_dbg(hdev, "quality report enable %d changed %d", val, changed); 4864 4865 memcpy(rp.uuid, quality_report_uuid, 16); 4866 rp.flags = cpu_to_le32(val ? BIT(0) : 0); 4867 hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS); 4868 4869 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_EXP_FEATURE, 0, 4870 &rp, sizeof(rp)); 4871 4872 if (changed) 4873 exp_feature_changed(hdev, quality_report_uuid, val, sk); 4874 4875 unlock_quality_report: 4876 hci_req_sync_unlock(hdev); 4877 return err; 4878 } 4879 4880 static int set_offload_codec_func(struct sock *sk, struct hci_dev *hdev, 4881 struct mgmt_cp_set_exp_feature *cp, 4882 u16 data_len) 4883 { 4884 bool val, changed; 4885 int err; 4886 struct mgmt_rp_set_exp_feature rp; 4887 4888 /* Command requires to use a valid controller index */ 4889 if (!hdev) 4890 return mgmt_cmd_status(sk, MGMT_INDEX_NONE, 4891 MGMT_OP_SET_EXP_FEATURE, 4892 MGMT_STATUS_INVALID_INDEX); 4893 4894 /* Parameters are limited to a single octet */ 4895 if (data_len != MGMT_SET_EXP_FEATURE_SIZE + 1) 4896 return mgmt_cmd_status(sk, hdev->id, 4897 MGMT_OP_SET_EXP_FEATURE, 4898 MGMT_STATUS_INVALID_PARAMS); 4899 4900 /* Only boolean on/off is supported */ 4901 if (cp->param[0] != 0x00 && cp->param[0] != 0x01) 4902 return mgmt_cmd_status(sk, hdev->id, 4903 MGMT_OP_SET_EXP_FEATURE, 4904 MGMT_STATUS_INVALID_PARAMS); 4905 4906 val = !!cp->param[0]; 4907 changed = (val != hci_dev_test_flag(hdev, HCI_OFFLOAD_CODECS_ENABLED)); 4908 4909 if (!hdev->get_data_path_id) { 4910 return mgmt_cmd_status(sk, hdev->id, 4911 MGMT_OP_SET_EXP_FEATURE, 4912 MGMT_STATUS_NOT_SUPPORTED); 4913 } 4914 4915 if (changed) { 4916 if (val) 4917 hci_dev_set_flag(hdev, HCI_OFFLOAD_CODECS_ENABLED); 4918 else 4919 hci_dev_clear_flag(hdev, HCI_OFFLOAD_CODECS_ENABLED); 4920 } 4921 4922 bt_dev_info(hdev, "offload codecs enable %d changed %d", 4923 val, changed); 4924 4925 memcpy(rp.uuid, offload_codecs_uuid, 16); 4926 rp.flags = cpu_to_le32(val ? BIT(0) : 0); 4927 hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS); 4928 err = mgmt_cmd_complete(sk, hdev->id, 4929 MGMT_OP_SET_EXP_FEATURE, 0, 4930 &rp, sizeof(rp)); 4931 4932 if (changed) 4933 exp_feature_changed(hdev, offload_codecs_uuid, val, sk); 4934 4935 return err; 4936 } 4937 4938 static int set_le_simultaneous_roles_func(struct sock *sk, struct hci_dev *hdev, 4939 struct mgmt_cp_set_exp_feature *cp, 4940 u16 data_len) 4941 { 4942 bool val, changed; 4943 int err; 4944 struct mgmt_rp_set_exp_feature rp; 4945 4946 /* Command requires to use a valid controller index */ 4947 if (!hdev) 4948 return mgmt_cmd_status(sk, MGMT_INDEX_NONE, 4949 MGMT_OP_SET_EXP_FEATURE, 4950 MGMT_STATUS_INVALID_INDEX); 4951 4952 /* Parameters are limited to a single octet */ 4953 if (data_len != MGMT_SET_EXP_FEATURE_SIZE + 1) 4954 return mgmt_cmd_status(sk, hdev->id, 4955 MGMT_OP_SET_EXP_FEATURE, 4956 MGMT_STATUS_INVALID_PARAMS); 4957 4958 /* Only boolean on/off is supported */ 4959 if (cp->param[0] != 0x00 && cp->param[0] != 0x01) 4960 return mgmt_cmd_status(sk, hdev->id, 4961 MGMT_OP_SET_EXP_FEATURE, 4962 MGMT_STATUS_INVALID_PARAMS); 4963 4964 val = !!cp->param[0]; 4965 changed = (val != hci_dev_test_flag(hdev, HCI_LE_SIMULTANEOUS_ROLES)); 4966 4967 if (!hci_dev_le_state_simultaneous(hdev)) { 4968 return mgmt_cmd_status(sk, hdev->id, 4969 MGMT_OP_SET_EXP_FEATURE, 4970 MGMT_STATUS_NOT_SUPPORTED); 4971 } 4972 4973 if (changed) { 4974 if (val) 4975 hci_dev_set_flag(hdev, HCI_LE_SIMULTANEOUS_ROLES); 4976 else 4977 hci_dev_clear_flag(hdev, HCI_LE_SIMULTANEOUS_ROLES); 4978 } 4979 4980 bt_dev_info(hdev, "LE simultaneous roles enable %d changed %d", 4981 val, changed); 4982 4983 memcpy(rp.uuid, le_simultaneous_roles_uuid, 16); 4984 rp.flags = cpu_to_le32(val ? BIT(0) : 0); 4985 hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS); 4986 err = mgmt_cmd_complete(sk, hdev->id, 4987 MGMT_OP_SET_EXP_FEATURE, 0, 4988 &rp, sizeof(rp)); 4989 4990 if (changed) 4991 exp_feature_changed(hdev, le_simultaneous_roles_uuid, val, sk); 4992 4993 return err; 4994 } 4995 4996 #ifdef CONFIG_BT_LE 4997 static int set_iso_socket_func(struct sock *sk, struct hci_dev *hdev, 4998 struct mgmt_cp_set_exp_feature *cp, u16 data_len) 4999 { 5000 struct mgmt_rp_set_exp_feature rp; 5001 bool val, changed = false; 5002 int err; 5003 5004 /* Command requires to use the non-controller index */ 5005 if (hdev) 5006 return mgmt_cmd_status(sk, hdev->id, 5007 MGMT_OP_SET_EXP_FEATURE, 5008 MGMT_STATUS_INVALID_INDEX); 5009 5010 /* Parameters are limited to a single octet */ 5011 if (data_len != MGMT_SET_EXP_FEATURE_SIZE + 1) 5012 return mgmt_cmd_status(sk, MGMT_INDEX_NONE, 5013 MGMT_OP_SET_EXP_FEATURE, 5014 MGMT_STATUS_INVALID_PARAMS); 5015 5016 /* Only boolean on/off is supported */ 5017 if (cp->param[0] != 0x00 && cp->param[0] != 0x01) 5018 return mgmt_cmd_status(sk, MGMT_INDEX_NONE, 5019 MGMT_OP_SET_EXP_FEATURE, 5020 MGMT_STATUS_INVALID_PARAMS); 5021 5022 val = cp->param[0] ? true : false; 5023 if (val) 5024 err = iso_init(); 5025 else 5026 err = iso_exit(); 5027 5028 if (!err) 5029 changed = true; 5030 5031 memcpy(rp.uuid, iso_socket_uuid, 16); 5032 rp.flags = cpu_to_le32(val ? BIT(0) : 0); 5033 5034 hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS); 5035 5036 err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE, 5037 MGMT_OP_SET_EXP_FEATURE, 0, 5038 &rp, sizeof(rp)); 5039 5040 if (changed) 5041 exp_feature_changed(hdev, iso_socket_uuid, val, sk); 5042 5043 return err; 5044 } 5045 #endif 5046 5047 static const struct mgmt_exp_feature { 5048 const u8 *uuid; 5049 int (*set_func)(struct sock *sk, struct hci_dev *hdev, 5050 struct mgmt_cp_set_exp_feature *cp, u16 data_len); 5051 } exp_features[] = { 5052 EXP_FEAT(ZERO_KEY, set_zero_key_func), 5053 #ifdef CONFIG_BT_FEATURE_DEBUG 5054 EXP_FEAT(debug_uuid, set_debug_func), 5055 #endif 5056 EXP_FEAT(mgmt_mesh_uuid, set_mgmt_mesh_func), 5057 EXP_FEAT(quality_report_uuid, set_quality_report_func), 5058 EXP_FEAT(offload_codecs_uuid, set_offload_codec_func), 5059 EXP_FEAT(le_simultaneous_roles_uuid, set_le_simultaneous_roles_func), 5060 #ifdef CONFIG_BT_LE 5061 EXP_FEAT(iso_socket_uuid, set_iso_socket_func), 5062 #endif 5063 5064 /* end with a null feature */ 5065 EXP_FEAT(NULL, NULL) 5066 }; 5067 5068 static int set_exp_feature(struct sock *sk, struct hci_dev *hdev, 5069 void *data, u16 data_len) 5070 { 5071 struct mgmt_cp_set_exp_feature *cp = data; 5072 size_t i = 0; 5073 5074 bt_dev_dbg(hdev, "sock %p", sk); 5075 5076 for (i = 0; exp_features[i].uuid; i++) { 5077 if (!memcmp(cp->uuid, exp_features[i].uuid, 16)) 5078 return exp_features[i].set_func(sk, hdev, cp, data_len); 5079 } 5080 5081 return mgmt_cmd_status(sk, hdev ? hdev->id : MGMT_INDEX_NONE, 5082 MGMT_OP_SET_EXP_FEATURE, 5083 MGMT_STATUS_NOT_SUPPORTED); 5084 } 5085 5086 static int get_device_flags(struct sock *sk, struct hci_dev *hdev, void *data, 5087 u16 data_len) 5088 { 5089 struct mgmt_cp_get_device_flags *cp = data; 5090 struct mgmt_rp_get_device_flags rp; 5091 struct bdaddr_list_with_flags *br_params; 5092 struct hci_conn_params *params; 5093 u32 supported_flags; 5094 u32 current_flags = 0; 5095 u8 status = MGMT_STATUS_INVALID_PARAMS; 5096 5097 bt_dev_dbg(hdev, "Get device flags %pMR (type 0x%x)\n", 5098 &cp->addr.bdaddr, cp->addr.type); 5099 5100 hci_dev_lock(hdev); 5101 5102 supported_flags = hdev->conn_flags; 5103 5104 memset(&rp, 0, sizeof(rp)); 5105 5106 if (cp->addr.type == BDADDR_BREDR) { 5107 br_params = hci_bdaddr_list_lookup_with_flags(&hdev->accept_list, 5108 &cp->addr.bdaddr, 5109 cp->addr.type); 5110 if (!br_params) 5111 goto done; 5112 5113 current_flags = br_params->flags; 5114 } else { 5115 params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr, 5116 le_addr_type(cp->addr.type)); 5117 if (!params) 5118 goto done; 5119 5120 current_flags = params->flags; 5121 } 5122 5123 bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr); 5124 rp.addr.type = cp->addr.type; 5125 rp.supported_flags = cpu_to_le32(supported_flags); 5126 rp.current_flags = cpu_to_le32(current_flags); 5127 5128 status = MGMT_STATUS_SUCCESS; 5129 5130 done: 5131 hci_dev_unlock(hdev); 5132 5133 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_DEVICE_FLAGS, status, 5134 &rp, sizeof(rp)); 5135 } 5136 5137 static void device_flags_changed(struct sock *sk, struct hci_dev *hdev, 5138 bdaddr_t *bdaddr, u8 bdaddr_type, 5139 u32 supported_flags, u32 current_flags) 5140 { 5141 struct mgmt_ev_device_flags_changed ev; 5142 5143 bacpy(&ev.addr.bdaddr, bdaddr); 5144 ev.addr.type = bdaddr_type; 5145 ev.supported_flags = cpu_to_le32(supported_flags); 5146 ev.current_flags = cpu_to_le32(current_flags); 5147 5148 mgmt_event(MGMT_EV_DEVICE_FLAGS_CHANGED, hdev, &ev, sizeof(ev), sk); 5149 } 5150 5151 static bool is_connected(struct hci_dev *hdev, bdaddr_t *addr, u8 type) 5152 { 5153 struct hci_conn *conn; 5154 5155 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, addr); 5156 if (!conn) 5157 return false; 5158 5159 if (conn->dst_type != type) 5160 return false; 5161 5162 if (conn->state != BT_CONNECTED) 5163 return false; 5164 5165 return true; 5166 } 5167 5168 /* This function requires the caller holds hdev->lock */ 5169 static struct hci_conn_params *hci_conn_params_set(struct hci_dev *hdev, 5170 bdaddr_t *addr, u8 addr_type, 5171 u8 auto_connect) 5172 { 5173 struct hci_conn_params *params; 5174 5175 params = hci_conn_params_add(hdev, addr, addr_type); 5176 if (!params) 5177 return NULL; 5178 5179 if (params->auto_connect == auto_connect) 5180 return params; 5181 5182 hci_pend_le_list_del_init(params); 5183 5184 switch (auto_connect) { 5185 case HCI_AUTO_CONN_DISABLED: 5186 case HCI_AUTO_CONN_LINK_LOSS: 5187 /* If auto connect is being disabled when we're trying to 5188 * connect to device, keep connecting. 5189 */ 5190 if (params->explicit_connect) 5191 hci_pend_le_list_add(params, &hdev->pend_le_conns); 5192 break; 5193 case HCI_AUTO_CONN_REPORT: 5194 if (params->explicit_connect) 5195 hci_pend_le_list_add(params, &hdev->pend_le_conns); 5196 else 5197 hci_pend_le_list_add(params, &hdev->pend_le_reports); 5198 break; 5199 case HCI_AUTO_CONN_DIRECT: 5200 case HCI_AUTO_CONN_ALWAYS: 5201 if (!is_connected(hdev, addr, addr_type)) 5202 hci_pend_le_list_add(params, &hdev->pend_le_conns); 5203 break; 5204 } 5205 5206 params->auto_connect = auto_connect; 5207 5208 bt_dev_dbg(hdev, "addr %pMR (type %u) auto_connect %u", 5209 addr, addr_type, auto_connect); 5210 5211 return params; 5212 } 5213 5214 static int set_device_flags(struct sock *sk, struct hci_dev *hdev, void *data, 5215 u16 len) 5216 { 5217 struct mgmt_cp_set_device_flags *cp = data; 5218 struct bdaddr_list_with_flags *br_params; 5219 struct hci_conn_params *params; 5220 u8 status = MGMT_STATUS_INVALID_PARAMS; 5221 u32 supported_flags; 5222 u32 current_flags = __le32_to_cpu(cp->current_flags); 5223 5224 bt_dev_dbg(hdev, "Set device flags %pMR (type 0x%x) = 0x%x", 5225 &cp->addr.bdaddr, cp->addr.type, current_flags); 5226 5227 // We should take hci_dev_lock() early, I think.. conn_flags can change 5228 supported_flags = hdev->conn_flags; 5229 5230 if ((supported_flags | current_flags) != supported_flags) { 5231 bt_dev_warn(hdev, "Bad flag given (0x%x) vs supported (0x%0x)", 5232 current_flags, supported_flags); 5233 goto done; 5234 } 5235 5236 hci_dev_lock(hdev); 5237 5238 if (cp->addr.type == BDADDR_BREDR) { 5239 br_params = hci_bdaddr_list_lookup_with_flags(&hdev->accept_list, 5240 &cp->addr.bdaddr, 5241 cp->addr.type); 5242 5243 if (br_params) { 5244 br_params->flags = current_flags; 5245 status = MGMT_STATUS_SUCCESS; 5246 } else { 5247 bt_dev_warn(hdev, "No such BR/EDR device %pMR (0x%x)", 5248 &cp->addr.bdaddr, cp->addr.type); 5249 } 5250 5251 goto unlock; 5252 } 5253 5254 params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr, 5255 le_addr_type(cp->addr.type)); 5256 if (!params) { 5257 /* Create a new hci_conn_params if it doesn't exist */ 5258 params = hci_conn_params_set(hdev, &cp->addr.bdaddr, 5259 le_addr_type(cp->addr.type), 5260 HCI_AUTO_CONN_DISABLED); 5261 if (!params) { 5262 bt_dev_warn(hdev, "No such LE device %pMR (0x%x)", 5263 &cp->addr.bdaddr, 5264 le_addr_type(cp->addr.type)); 5265 goto unlock; 5266 } 5267 } 5268 5269 supported_flags = hdev->conn_flags; 5270 5271 if ((supported_flags | current_flags) != supported_flags) { 5272 bt_dev_warn(hdev, "Bad flag given (0x%x) vs supported (0x%0x)", 5273 current_flags, supported_flags); 5274 goto unlock; 5275 } 5276 5277 WRITE_ONCE(params->flags, current_flags); 5278 status = MGMT_STATUS_SUCCESS; 5279 5280 /* Update passive scan if HCI_CONN_FLAG_DEVICE_PRIVACY 5281 * has been set. 5282 */ 5283 if (params->flags & HCI_CONN_FLAG_DEVICE_PRIVACY) 5284 hci_update_passive_scan(hdev); 5285 5286 unlock: 5287 hci_dev_unlock(hdev); 5288 5289 done: 5290 if (status == MGMT_STATUS_SUCCESS) 5291 device_flags_changed(sk, hdev, &cp->addr.bdaddr, cp->addr.type, 5292 supported_flags, current_flags); 5293 5294 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_DEVICE_FLAGS, status, 5295 &cp->addr, sizeof(cp->addr)); 5296 } 5297 5298 static void mgmt_adv_monitor_added(struct sock *sk, struct hci_dev *hdev, 5299 u16 handle) 5300 { 5301 struct mgmt_ev_adv_monitor_added ev; 5302 5303 ev.monitor_handle = cpu_to_le16(handle); 5304 5305 mgmt_event(MGMT_EV_ADV_MONITOR_ADDED, hdev, &ev, sizeof(ev), sk); 5306 } 5307 5308 static void mgmt_adv_monitor_removed(struct sock *sk, struct hci_dev *hdev, 5309 __le16 handle) 5310 { 5311 struct mgmt_ev_adv_monitor_removed ev; 5312 5313 ev.monitor_handle = handle; 5314 5315 mgmt_event(MGMT_EV_ADV_MONITOR_REMOVED, hdev, &ev, sizeof(ev), sk); 5316 } 5317 5318 static int read_adv_mon_features(struct sock *sk, struct hci_dev *hdev, 5319 void *data, u16 len) 5320 { 5321 struct adv_monitor *monitor = NULL; 5322 struct mgmt_rp_read_adv_monitor_features *rp = NULL; 5323 int handle, err; 5324 size_t rp_size = 0; 5325 __u32 supported = 0; 5326 __u32 enabled = 0; 5327 __u16 num_handles = 0; 5328 __u16 handles[HCI_MAX_ADV_MONITOR_NUM_HANDLES]; 5329 5330 BT_DBG("request for %s", hdev->name); 5331 5332 hci_dev_lock(hdev); 5333 5334 if (msft_monitor_supported(hdev)) 5335 supported |= MGMT_ADV_MONITOR_FEATURE_MASK_OR_PATTERNS; 5336 5337 idr_for_each_entry(&hdev->adv_monitors_idr, monitor, handle) 5338 handles[num_handles++] = monitor->handle; 5339 5340 hci_dev_unlock(hdev); 5341 5342 rp_size = sizeof(*rp) + (num_handles * sizeof(u16)); 5343 rp = kmalloc(rp_size, GFP_KERNEL); 5344 if (!rp) 5345 return -ENOMEM; 5346 5347 /* All supported features are currently enabled */ 5348 enabled = supported; 5349 5350 rp->supported_features = cpu_to_le32(supported); 5351 rp->enabled_features = cpu_to_le32(enabled); 5352 rp->max_num_handles = cpu_to_le16(HCI_MAX_ADV_MONITOR_NUM_HANDLES); 5353 rp->max_num_patterns = HCI_MAX_ADV_MONITOR_NUM_PATTERNS; 5354 rp->num_handles = cpu_to_le16(num_handles); 5355 if (num_handles) 5356 memcpy(&rp->handles, &handles, (num_handles * sizeof(u16))); 5357 5358 err = mgmt_cmd_complete(sk, hdev->id, 5359 MGMT_OP_READ_ADV_MONITOR_FEATURES, 5360 MGMT_STATUS_SUCCESS, rp, rp_size); 5361 5362 kfree(rp); 5363 5364 return err; 5365 } 5366 5367 static void mgmt_add_adv_patterns_monitor_complete(struct hci_dev *hdev, 5368 void *data, int status) 5369 { 5370 struct mgmt_rp_add_adv_patterns_monitor rp; 5371 struct mgmt_pending_cmd *cmd = data; 5372 struct adv_monitor *monitor; 5373 5374 /* This is likely the result of hdev being closed and mgmt_index_removed 5375 * is attempting to clean up any pending command so 5376 * hci_adv_monitors_clear is about to be called which will take care of 5377 * freeing the adv_monitor instances. 5378 */ 5379 if (status == -ECANCELED || !mgmt_pending_valid(hdev, cmd)) 5380 return; 5381 5382 monitor = cmd->user_data; 5383 5384 hci_dev_lock(hdev); 5385 5386 rp.monitor_handle = cpu_to_le16(monitor->handle); 5387 5388 if (!status) { 5389 mgmt_adv_monitor_added(cmd->sk, hdev, monitor->handle); 5390 hdev->adv_monitors_cnt++; 5391 if (monitor->state == ADV_MONITOR_STATE_NOT_REGISTERED) 5392 monitor->state = ADV_MONITOR_STATE_REGISTERED; 5393 hci_update_passive_scan(hdev); 5394 } else { 5395 hci_free_adv_monitor(hdev, monitor); 5396 } 5397 5398 mgmt_cmd_complete(cmd->sk, cmd->hdev->id, cmd->opcode, 5399 mgmt_status(status), &rp, sizeof(rp)); 5400 mgmt_pending_free(cmd); 5401 5402 hci_dev_unlock(hdev); 5403 bt_dev_dbg(hdev, "add monitor %d complete, status %d", 5404 rp.monitor_handle, status); 5405 } 5406 5407 static int mgmt_add_adv_patterns_monitor_sync(struct hci_dev *hdev, void *data) 5408 { 5409 struct mgmt_pending_cmd *cmd = data; 5410 struct adv_monitor *mon; 5411 5412 mutex_lock(&hdev->mgmt_pending_lock); 5413 5414 if (!__mgmt_pending_listed(hdev, cmd)) { 5415 mutex_unlock(&hdev->mgmt_pending_lock); 5416 return -ECANCELED; 5417 } 5418 5419 mon = cmd->user_data; 5420 5421 mutex_unlock(&hdev->mgmt_pending_lock); 5422 5423 return hci_add_adv_monitor(hdev, mon); 5424 } 5425 5426 static int __add_adv_patterns_monitor(struct sock *sk, struct hci_dev *hdev, 5427 struct adv_monitor *m, u8 status, 5428 void *data, u16 len, u16 op) 5429 { 5430 struct mgmt_pending_cmd *cmd; 5431 int err; 5432 5433 hci_dev_lock(hdev); 5434 5435 if (status) 5436 goto unlock; 5437 5438 if (pending_find(MGMT_OP_SET_LE, hdev) || 5439 pending_find(MGMT_OP_ADD_ADV_PATTERNS_MONITOR, hdev) || 5440 pending_find(MGMT_OP_ADD_ADV_PATTERNS_MONITOR_RSSI, hdev)) { 5441 status = MGMT_STATUS_BUSY; 5442 goto unlock; 5443 } 5444 5445 cmd = mgmt_pending_add(sk, op, hdev, data, len); 5446 if (!cmd) { 5447 status = MGMT_STATUS_NO_RESOURCES; 5448 goto unlock; 5449 } 5450 5451 cmd->user_data = m; 5452 err = hci_cmd_sync_queue(hdev, mgmt_add_adv_patterns_monitor_sync, cmd, 5453 mgmt_add_adv_patterns_monitor_complete); 5454 if (err) { 5455 if (err == -ENOMEM) 5456 status = MGMT_STATUS_NO_RESOURCES; 5457 else 5458 status = MGMT_STATUS_FAILED; 5459 5460 goto unlock; 5461 } 5462 5463 hci_dev_unlock(hdev); 5464 5465 return 0; 5466 5467 unlock: 5468 hci_free_adv_monitor(hdev, m); 5469 hci_dev_unlock(hdev); 5470 return mgmt_cmd_status(sk, hdev->id, op, status); 5471 } 5472 5473 static void parse_adv_monitor_rssi(struct adv_monitor *m, 5474 struct mgmt_adv_rssi_thresholds *rssi) 5475 { 5476 if (rssi) { 5477 m->rssi.low_threshold = rssi->low_threshold; 5478 m->rssi.low_threshold_timeout = 5479 __le16_to_cpu(rssi->low_threshold_timeout); 5480 m->rssi.high_threshold = rssi->high_threshold; 5481 m->rssi.high_threshold_timeout = 5482 __le16_to_cpu(rssi->high_threshold_timeout); 5483 m->rssi.sampling_period = rssi->sampling_period; 5484 } else { 5485 /* Default values. These numbers are the least constricting 5486 * parameters for MSFT API to work, so it behaves as if there 5487 * are no rssi parameter to consider. May need to be changed 5488 * if other API are to be supported. 5489 */ 5490 m->rssi.low_threshold = -127; 5491 m->rssi.low_threshold_timeout = 60; 5492 m->rssi.high_threshold = -127; 5493 m->rssi.high_threshold_timeout = 0; 5494 m->rssi.sampling_period = 0; 5495 } 5496 } 5497 5498 static u8 parse_adv_monitor_pattern(struct adv_monitor *m, u8 pattern_count, 5499 struct mgmt_adv_pattern *patterns) 5500 { 5501 u8 offset = 0, length = 0; 5502 struct adv_pattern *p = NULL; 5503 int i; 5504 5505 for (i = 0; i < pattern_count; i++) { 5506 offset = patterns[i].offset; 5507 length = patterns[i].length; 5508 if (offset >= HCI_MAX_AD_LENGTH || 5509 length > HCI_MAX_AD_LENGTH || 5510 (offset + length) > HCI_MAX_AD_LENGTH) 5511 return MGMT_STATUS_INVALID_PARAMS; 5512 5513 p = kmalloc_obj(*p); 5514 if (!p) 5515 return MGMT_STATUS_NO_RESOURCES; 5516 5517 p->ad_type = patterns[i].ad_type; 5518 p->offset = patterns[i].offset; 5519 p->length = patterns[i].length; 5520 memcpy(p->value, patterns[i].value, p->length); 5521 5522 INIT_LIST_HEAD(&p->list); 5523 list_add(&p->list, &m->patterns); 5524 } 5525 5526 return MGMT_STATUS_SUCCESS; 5527 } 5528 5529 static int add_adv_patterns_monitor(struct sock *sk, struct hci_dev *hdev, 5530 void *data, u16 len) 5531 { 5532 struct mgmt_cp_add_adv_patterns_monitor *cp = data; 5533 struct adv_monitor *m = NULL; 5534 u8 status = MGMT_STATUS_SUCCESS; 5535 size_t expected_size = sizeof(*cp); 5536 5537 BT_DBG("request for %s", hdev->name); 5538 5539 if (len <= sizeof(*cp)) { 5540 status = MGMT_STATUS_INVALID_PARAMS; 5541 goto done; 5542 } 5543 5544 expected_size += cp->pattern_count * sizeof(struct mgmt_adv_pattern); 5545 if (len != expected_size) { 5546 status = MGMT_STATUS_INVALID_PARAMS; 5547 goto done; 5548 } 5549 5550 m = kzalloc_obj(*m); 5551 if (!m) { 5552 status = MGMT_STATUS_NO_RESOURCES; 5553 goto done; 5554 } 5555 5556 INIT_LIST_HEAD(&m->patterns); 5557 5558 parse_adv_monitor_rssi(m, NULL); 5559 status = parse_adv_monitor_pattern(m, cp->pattern_count, cp->patterns); 5560 5561 done: 5562 return __add_adv_patterns_monitor(sk, hdev, m, status, data, len, 5563 MGMT_OP_ADD_ADV_PATTERNS_MONITOR); 5564 } 5565 5566 static int add_adv_patterns_monitor_rssi(struct sock *sk, struct hci_dev *hdev, 5567 void *data, u16 len) 5568 { 5569 struct mgmt_cp_add_adv_patterns_monitor_rssi *cp = data; 5570 struct adv_monitor *m = NULL; 5571 u8 status = MGMT_STATUS_SUCCESS; 5572 size_t expected_size = sizeof(*cp); 5573 5574 BT_DBG("request for %s", hdev->name); 5575 5576 if (len <= sizeof(*cp)) { 5577 status = MGMT_STATUS_INVALID_PARAMS; 5578 goto done; 5579 } 5580 5581 expected_size += cp->pattern_count * sizeof(struct mgmt_adv_pattern); 5582 if (len != expected_size) { 5583 status = MGMT_STATUS_INVALID_PARAMS; 5584 goto done; 5585 } 5586 5587 m = kzalloc_obj(*m); 5588 if (!m) { 5589 status = MGMT_STATUS_NO_RESOURCES; 5590 goto done; 5591 } 5592 5593 INIT_LIST_HEAD(&m->patterns); 5594 5595 parse_adv_monitor_rssi(m, &cp->rssi); 5596 status = parse_adv_monitor_pattern(m, cp->pattern_count, cp->patterns); 5597 5598 done: 5599 return __add_adv_patterns_monitor(sk, hdev, m, status, data, len, 5600 MGMT_OP_ADD_ADV_PATTERNS_MONITOR_RSSI); 5601 } 5602 5603 static void mgmt_remove_adv_monitor_complete(struct hci_dev *hdev, 5604 void *data, int status) 5605 { 5606 struct mgmt_rp_remove_adv_monitor rp; 5607 struct mgmt_pending_cmd *cmd = data; 5608 struct mgmt_cp_remove_adv_monitor *cp; 5609 5610 if (status == -ECANCELED) 5611 return; 5612 5613 hci_dev_lock(hdev); 5614 5615 cp = cmd->param; 5616 5617 rp.monitor_handle = cp->monitor_handle; 5618 5619 if (!status) { 5620 mgmt_adv_monitor_removed(cmd->sk, hdev, cp->monitor_handle); 5621 hci_update_passive_scan(hdev); 5622 } 5623 5624 mgmt_cmd_complete(cmd->sk, cmd->hdev->id, cmd->opcode, 5625 mgmt_status(status), &rp, sizeof(rp)); 5626 mgmt_pending_free(cmd); 5627 5628 hci_dev_unlock(hdev); 5629 bt_dev_dbg(hdev, "remove monitor %d complete, status %d", 5630 rp.monitor_handle, status); 5631 } 5632 5633 static int mgmt_remove_adv_monitor_sync(struct hci_dev *hdev, void *data) 5634 { 5635 struct mgmt_pending_cmd *cmd = data; 5636 struct mgmt_cp_remove_adv_monitor *cp = cmd->param; 5637 u16 handle = __le16_to_cpu(cp->monitor_handle); 5638 5639 if (!handle) 5640 return hci_remove_all_adv_monitor(hdev); 5641 5642 return hci_remove_single_adv_monitor(hdev, handle); 5643 } 5644 5645 static int remove_adv_monitor(struct sock *sk, struct hci_dev *hdev, 5646 void *data, u16 len) 5647 { 5648 struct mgmt_pending_cmd *cmd; 5649 int err, status; 5650 5651 hci_dev_lock(hdev); 5652 5653 if (pending_find(MGMT_OP_SET_LE, hdev) || 5654 pending_find(MGMT_OP_ADD_ADV_PATTERNS_MONITOR, hdev) || 5655 pending_find(MGMT_OP_ADD_ADV_PATTERNS_MONITOR_RSSI, hdev)) { 5656 status = MGMT_STATUS_BUSY; 5657 goto unlock; 5658 } 5659 5660 cmd = mgmt_pending_new(sk, MGMT_OP_REMOVE_ADV_MONITOR, hdev, data, len); 5661 if (!cmd) { 5662 status = MGMT_STATUS_NO_RESOURCES; 5663 goto unlock; 5664 } 5665 5666 err = hci_cmd_sync_submit(hdev, mgmt_remove_adv_monitor_sync, cmd, 5667 mgmt_remove_adv_monitor_complete); 5668 5669 if (err) { 5670 mgmt_pending_free(cmd); 5671 5672 if (err == -ENOMEM) 5673 status = MGMT_STATUS_NO_RESOURCES; 5674 else 5675 status = MGMT_STATUS_FAILED; 5676 5677 goto unlock; 5678 } 5679 5680 hci_dev_unlock(hdev); 5681 5682 return 0; 5683 5684 unlock: 5685 hci_dev_unlock(hdev); 5686 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_ADV_MONITOR, 5687 status); 5688 } 5689 5690 static void read_local_oob_data_complete(struct hci_dev *hdev, void *data, 5691 int err) 5692 { 5693 struct mgmt_rp_read_local_oob_data mgmt_rp; 5694 size_t rp_size = sizeof(mgmt_rp); 5695 struct mgmt_pending_cmd *cmd = data; 5696 struct sk_buff *skb = cmd->skb; 5697 u8 status = mgmt_status(err); 5698 5699 if (!status) { 5700 if (!skb) 5701 status = MGMT_STATUS_FAILED; 5702 else if (IS_ERR(skb)) 5703 status = mgmt_status(PTR_ERR(skb)); 5704 else 5705 status = mgmt_status(skb->data[0]); 5706 } 5707 5708 bt_dev_dbg(hdev, "status %d", status); 5709 5710 if (status) { 5711 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA, 5712 status); 5713 goto remove; 5714 } 5715 5716 memset(&mgmt_rp, 0, sizeof(mgmt_rp)); 5717 5718 if (!bredr_sc_enabled(hdev)) { 5719 struct hci_rp_read_local_oob_data *rp = (void *) skb->data; 5720 5721 if (skb->len < sizeof(*rp)) { 5722 mgmt_cmd_status(cmd->sk, hdev->id, 5723 MGMT_OP_READ_LOCAL_OOB_DATA, 5724 MGMT_STATUS_FAILED); 5725 goto remove; 5726 } 5727 5728 memcpy(mgmt_rp.hash192, rp->hash, sizeof(rp->hash)); 5729 memcpy(mgmt_rp.rand192, rp->rand, sizeof(rp->rand)); 5730 5731 rp_size -= sizeof(mgmt_rp.hash256) + sizeof(mgmt_rp.rand256); 5732 } else { 5733 struct hci_rp_read_local_oob_ext_data *rp = (void *) skb->data; 5734 5735 if (skb->len < sizeof(*rp)) { 5736 mgmt_cmd_status(cmd->sk, hdev->id, 5737 MGMT_OP_READ_LOCAL_OOB_DATA, 5738 MGMT_STATUS_FAILED); 5739 goto remove; 5740 } 5741 5742 memcpy(mgmt_rp.hash192, rp->hash192, sizeof(rp->hash192)); 5743 memcpy(mgmt_rp.rand192, rp->rand192, sizeof(rp->rand192)); 5744 5745 memcpy(mgmt_rp.hash256, rp->hash256, sizeof(rp->hash256)); 5746 memcpy(mgmt_rp.rand256, rp->rand256, sizeof(rp->rand256)); 5747 } 5748 5749 mgmt_cmd_complete(cmd->sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA, 5750 MGMT_STATUS_SUCCESS, &mgmt_rp, rp_size); 5751 5752 remove: 5753 if (skb && !IS_ERR(skb)) 5754 kfree_skb(skb); 5755 5756 mgmt_pending_free(cmd); 5757 } 5758 5759 static int read_local_oob_data_sync(struct hci_dev *hdev, void *data) 5760 { 5761 struct mgmt_pending_cmd *cmd = data; 5762 5763 if (bredr_sc_enabled(hdev)) 5764 cmd->skb = hci_read_local_oob_data_sync(hdev, true, cmd->sk); 5765 else 5766 cmd->skb = hci_read_local_oob_data_sync(hdev, false, cmd->sk); 5767 5768 if (IS_ERR(cmd->skb)) 5769 return PTR_ERR(cmd->skb); 5770 else 5771 return 0; 5772 } 5773 5774 static int read_local_oob_data(struct sock *sk, struct hci_dev *hdev, 5775 void *data, u16 data_len) 5776 { 5777 struct mgmt_pending_cmd *cmd; 5778 int err; 5779 5780 bt_dev_dbg(hdev, "sock %p", sk); 5781 5782 hci_dev_lock(hdev); 5783 5784 if (!hdev_is_powered(hdev)) { 5785 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA, 5786 MGMT_STATUS_NOT_POWERED); 5787 goto unlock; 5788 } 5789 5790 if (!lmp_ssp_capable(hdev)) { 5791 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA, 5792 MGMT_STATUS_NOT_SUPPORTED); 5793 goto unlock; 5794 } 5795 5796 cmd = mgmt_pending_new(sk, MGMT_OP_READ_LOCAL_OOB_DATA, hdev, NULL, 0); 5797 if (!cmd) 5798 err = -ENOMEM; 5799 else 5800 err = hci_cmd_sync_queue(hdev, read_local_oob_data_sync, cmd, 5801 read_local_oob_data_complete); 5802 5803 if (err < 0) { 5804 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA, 5805 MGMT_STATUS_FAILED); 5806 5807 if (cmd) 5808 mgmt_pending_free(cmd); 5809 } 5810 5811 unlock: 5812 hci_dev_unlock(hdev); 5813 return err; 5814 } 5815 5816 static int add_remote_oob_data(struct sock *sk, struct hci_dev *hdev, 5817 void *data, u16 len) 5818 { 5819 struct mgmt_addr_info *addr = data; 5820 int err; 5821 5822 bt_dev_dbg(hdev, "sock %p", sk); 5823 5824 if (!bdaddr_type_is_valid(addr->type)) 5825 return mgmt_cmd_complete(sk, hdev->id, 5826 MGMT_OP_ADD_REMOTE_OOB_DATA, 5827 MGMT_STATUS_INVALID_PARAMS, 5828 addr, sizeof(*addr)); 5829 5830 hci_dev_lock(hdev); 5831 5832 if (len == MGMT_ADD_REMOTE_OOB_DATA_SIZE) { 5833 struct mgmt_cp_add_remote_oob_data *cp = data; 5834 u8 status; 5835 5836 if (cp->addr.type != BDADDR_BREDR) { 5837 err = mgmt_cmd_complete(sk, hdev->id, 5838 MGMT_OP_ADD_REMOTE_OOB_DATA, 5839 MGMT_STATUS_INVALID_PARAMS, 5840 &cp->addr, sizeof(cp->addr)); 5841 goto unlock; 5842 } 5843 5844 err = hci_add_remote_oob_data(hdev, &cp->addr.bdaddr, 5845 cp->addr.type, cp->hash, 5846 cp->rand, NULL, NULL); 5847 if (err < 0) 5848 status = MGMT_STATUS_FAILED; 5849 else 5850 status = MGMT_STATUS_SUCCESS; 5851 5852 err = mgmt_cmd_complete(sk, hdev->id, 5853 MGMT_OP_ADD_REMOTE_OOB_DATA, status, 5854 &cp->addr, sizeof(cp->addr)); 5855 } else if (len == MGMT_ADD_REMOTE_OOB_EXT_DATA_SIZE) { 5856 struct mgmt_cp_add_remote_oob_ext_data *cp = data; 5857 u8 *rand192, *hash192, *rand256, *hash256; 5858 u8 status; 5859 5860 if (bdaddr_type_is_le(cp->addr.type)) { 5861 /* Enforce zero-valued 192-bit parameters as 5862 * long as legacy SMP OOB isn't implemented. 5863 */ 5864 if (memcmp(cp->rand192, ZERO_KEY, 16) || 5865 memcmp(cp->hash192, ZERO_KEY, 16)) { 5866 err = mgmt_cmd_complete(sk, hdev->id, 5867 MGMT_OP_ADD_REMOTE_OOB_DATA, 5868 MGMT_STATUS_INVALID_PARAMS, 5869 addr, sizeof(*addr)); 5870 goto unlock; 5871 } 5872 5873 rand192 = NULL; 5874 hash192 = NULL; 5875 } else { 5876 /* In case one of the P-192 values is set to zero, 5877 * then just disable OOB data for P-192. 5878 */ 5879 if (!memcmp(cp->rand192, ZERO_KEY, 16) || 5880 !memcmp(cp->hash192, ZERO_KEY, 16)) { 5881 rand192 = NULL; 5882 hash192 = NULL; 5883 } else { 5884 rand192 = cp->rand192; 5885 hash192 = cp->hash192; 5886 } 5887 } 5888 5889 /* In case one of the P-256 values is set to zero, then just 5890 * disable OOB data for P-256. 5891 */ 5892 if (!memcmp(cp->rand256, ZERO_KEY, 16) || 5893 !memcmp(cp->hash256, ZERO_KEY, 16)) { 5894 rand256 = NULL; 5895 hash256 = NULL; 5896 } else { 5897 rand256 = cp->rand256; 5898 hash256 = cp->hash256; 5899 } 5900 5901 err = hci_add_remote_oob_data(hdev, &cp->addr.bdaddr, 5902 cp->addr.type, hash192, rand192, 5903 hash256, rand256); 5904 if (err < 0) 5905 status = MGMT_STATUS_FAILED; 5906 else 5907 status = MGMT_STATUS_SUCCESS; 5908 5909 err = mgmt_cmd_complete(sk, hdev->id, 5910 MGMT_OP_ADD_REMOTE_OOB_DATA, 5911 status, &cp->addr, sizeof(cp->addr)); 5912 } else { 5913 bt_dev_err(hdev, "add_remote_oob_data: invalid len of %u bytes", 5914 len); 5915 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_REMOTE_OOB_DATA, 5916 MGMT_STATUS_INVALID_PARAMS); 5917 } 5918 5919 unlock: 5920 hci_dev_unlock(hdev); 5921 return err; 5922 } 5923 5924 static int remove_remote_oob_data(struct sock *sk, struct hci_dev *hdev, 5925 void *data, u16 len) 5926 { 5927 struct mgmt_cp_remove_remote_oob_data *cp = data; 5928 u8 status; 5929 int err; 5930 5931 bt_dev_dbg(hdev, "sock %p", sk); 5932 5933 if (cp->addr.type != BDADDR_BREDR) 5934 return mgmt_cmd_complete(sk, hdev->id, 5935 MGMT_OP_REMOVE_REMOTE_OOB_DATA, 5936 MGMT_STATUS_INVALID_PARAMS, 5937 &cp->addr, sizeof(cp->addr)); 5938 5939 hci_dev_lock(hdev); 5940 5941 if (!bacmp(&cp->addr.bdaddr, BDADDR_ANY)) { 5942 hci_remote_oob_data_clear(hdev); 5943 status = MGMT_STATUS_SUCCESS; 5944 goto done; 5945 } 5946 5947 err = hci_remove_remote_oob_data(hdev, &cp->addr.bdaddr, cp->addr.type); 5948 if (err < 0) 5949 status = MGMT_STATUS_INVALID_PARAMS; 5950 else 5951 status = MGMT_STATUS_SUCCESS; 5952 5953 done: 5954 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_REMOTE_OOB_DATA, 5955 status, &cp->addr, sizeof(cp->addr)); 5956 5957 hci_dev_unlock(hdev); 5958 return err; 5959 } 5960 5961 static bool discovery_type_is_valid(struct hci_dev *hdev, uint8_t type, 5962 uint8_t *mgmt_status) 5963 { 5964 switch (type) { 5965 case DISCOV_TYPE_LE: 5966 *mgmt_status = mgmt_le_support(hdev); 5967 if (*mgmt_status) 5968 return false; 5969 break; 5970 case DISCOV_TYPE_INTERLEAVED: 5971 *mgmt_status = mgmt_le_support(hdev); 5972 if (*mgmt_status) 5973 return false; 5974 fallthrough; 5975 case DISCOV_TYPE_BREDR: 5976 *mgmt_status = mgmt_bredr_support(hdev); 5977 if (*mgmt_status) 5978 return false; 5979 break; 5980 default: 5981 *mgmt_status = MGMT_STATUS_INVALID_PARAMS; 5982 return false; 5983 } 5984 5985 return true; 5986 } 5987 5988 static void start_discovery_complete(struct hci_dev *hdev, void *data, int err) 5989 { 5990 struct mgmt_pending_cmd *cmd = data; 5991 5992 bt_dev_dbg(hdev, "err %d", err); 5993 5994 if (err == -ECANCELED || !mgmt_pending_valid(hdev, cmd)) 5995 return; 5996 5997 mgmt_cmd_complete(cmd->sk, cmd->hdev->id, cmd->opcode, mgmt_status(err), 5998 cmd->param, 1); 5999 mgmt_pending_free(cmd); 6000 6001 hci_discovery_set_state(hdev, err ? DISCOVERY_STOPPED: 6002 DISCOVERY_FINDING); 6003 } 6004 6005 static int start_discovery_sync(struct hci_dev *hdev, void *data) 6006 { 6007 if (!mgmt_pending_listed(hdev, data)) 6008 return -ECANCELED; 6009 6010 return hci_start_discovery_sync(hdev); 6011 } 6012 6013 static int start_discovery_internal(struct sock *sk, struct hci_dev *hdev, 6014 u16 op, void *data, u16 len) 6015 { 6016 struct mgmt_cp_start_discovery *cp = data; 6017 struct mgmt_pending_cmd *cmd; 6018 u8 status; 6019 int err; 6020 6021 bt_dev_dbg(hdev, "sock %p", sk); 6022 6023 hci_dev_lock(hdev); 6024 6025 if (!hdev_is_powered(hdev)) { 6026 err = mgmt_cmd_complete(sk, hdev->id, op, 6027 MGMT_STATUS_NOT_POWERED, 6028 &cp->type, sizeof(cp->type)); 6029 goto failed; 6030 } 6031 6032 if (hdev->discovery.state != DISCOVERY_STOPPED || 6033 hci_dev_test_flag(hdev, HCI_PERIODIC_INQ)) { 6034 err = mgmt_cmd_complete(sk, hdev->id, op, MGMT_STATUS_BUSY, 6035 &cp->type, sizeof(cp->type)); 6036 goto failed; 6037 } 6038 6039 if (!discovery_type_is_valid(hdev, cp->type, &status)) { 6040 err = mgmt_cmd_complete(sk, hdev->id, op, status, 6041 &cp->type, sizeof(cp->type)); 6042 goto failed; 6043 } 6044 6045 /* Can't start discovery when it is paused */ 6046 if (hdev->discovery_paused) { 6047 err = mgmt_cmd_complete(sk, hdev->id, op, MGMT_STATUS_BUSY, 6048 &cp->type, sizeof(cp->type)); 6049 goto failed; 6050 } 6051 6052 /* Clear the discovery filter first to free any previously 6053 * allocated memory for the UUID list. 6054 */ 6055 hci_discovery_filter_clear(hdev); 6056 6057 hdev->discovery.type = cp->type; 6058 hdev->discovery.report_invalid_rssi = false; 6059 if (op == MGMT_OP_START_LIMITED_DISCOVERY) 6060 hdev->discovery.limited = true; 6061 else 6062 hdev->discovery.limited = false; 6063 6064 cmd = mgmt_pending_add(sk, op, hdev, data, len); 6065 if (!cmd) { 6066 err = -ENOMEM; 6067 goto failed; 6068 } 6069 6070 err = hci_cmd_sync_queue(hdev, start_discovery_sync, cmd, 6071 start_discovery_complete); 6072 if (err < 0) { 6073 mgmt_pending_remove(cmd); 6074 goto failed; 6075 } 6076 6077 hci_discovery_set_state(hdev, DISCOVERY_STARTING); 6078 6079 failed: 6080 hci_dev_unlock(hdev); 6081 return err; 6082 } 6083 6084 static int start_discovery(struct sock *sk, struct hci_dev *hdev, 6085 void *data, u16 len) 6086 { 6087 return start_discovery_internal(sk, hdev, MGMT_OP_START_DISCOVERY, 6088 data, len); 6089 } 6090 6091 static int start_limited_discovery(struct sock *sk, struct hci_dev *hdev, 6092 void *data, u16 len) 6093 { 6094 return start_discovery_internal(sk, hdev, 6095 MGMT_OP_START_LIMITED_DISCOVERY, 6096 data, len); 6097 } 6098 6099 static int start_service_discovery(struct sock *sk, struct hci_dev *hdev, 6100 void *data, u16 len) 6101 { 6102 struct mgmt_cp_start_service_discovery *cp = data; 6103 struct mgmt_pending_cmd *cmd; 6104 const u16 max_uuid_count = ((U16_MAX - sizeof(*cp)) / 16); 6105 u16 uuid_count, expected_len; 6106 u8 status; 6107 int err; 6108 6109 bt_dev_dbg(hdev, "sock %p", sk); 6110 6111 hci_dev_lock(hdev); 6112 6113 if (!hdev_is_powered(hdev)) { 6114 err = mgmt_cmd_complete(sk, hdev->id, 6115 MGMT_OP_START_SERVICE_DISCOVERY, 6116 MGMT_STATUS_NOT_POWERED, 6117 &cp->type, sizeof(cp->type)); 6118 goto failed; 6119 } 6120 6121 if (hdev->discovery.state != DISCOVERY_STOPPED || 6122 hci_dev_test_flag(hdev, HCI_PERIODIC_INQ)) { 6123 err = mgmt_cmd_complete(sk, hdev->id, 6124 MGMT_OP_START_SERVICE_DISCOVERY, 6125 MGMT_STATUS_BUSY, &cp->type, 6126 sizeof(cp->type)); 6127 goto failed; 6128 } 6129 6130 if (hdev->discovery_paused) { 6131 err = mgmt_cmd_complete(sk, hdev->id, 6132 MGMT_OP_START_SERVICE_DISCOVERY, 6133 MGMT_STATUS_BUSY, &cp->type, 6134 sizeof(cp->type)); 6135 goto failed; 6136 } 6137 6138 uuid_count = __le16_to_cpu(cp->uuid_count); 6139 if (uuid_count > max_uuid_count) { 6140 bt_dev_err(hdev, "service_discovery: too big uuid_count value %u", 6141 uuid_count); 6142 err = mgmt_cmd_complete(sk, hdev->id, 6143 MGMT_OP_START_SERVICE_DISCOVERY, 6144 MGMT_STATUS_INVALID_PARAMS, &cp->type, 6145 sizeof(cp->type)); 6146 goto failed; 6147 } 6148 6149 expected_len = sizeof(*cp) + uuid_count * 16; 6150 if (expected_len != len) { 6151 bt_dev_err(hdev, "service_discovery: expected %u bytes, got %u bytes", 6152 expected_len, len); 6153 err = mgmt_cmd_complete(sk, hdev->id, 6154 MGMT_OP_START_SERVICE_DISCOVERY, 6155 MGMT_STATUS_INVALID_PARAMS, &cp->type, 6156 sizeof(cp->type)); 6157 goto failed; 6158 } 6159 6160 if (!discovery_type_is_valid(hdev, cp->type, &status)) { 6161 err = mgmt_cmd_complete(sk, hdev->id, 6162 MGMT_OP_START_SERVICE_DISCOVERY, 6163 status, &cp->type, sizeof(cp->type)); 6164 goto failed; 6165 } 6166 6167 cmd = mgmt_pending_add(sk, MGMT_OP_START_SERVICE_DISCOVERY, 6168 hdev, data, len); 6169 if (!cmd) { 6170 err = -ENOMEM; 6171 goto failed; 6172 } 6173 6174 /* Clear the discovery filter first to free any previously 6175 * allocated memory for the UUID list. 6176 */ 6177 hci_discovery_filter_clear(hdev); 6178 6179 hdev->discovery.result_filtering = true; 6180 hdev->discovery.type = cp->type; 6181 hdev->discovery.rssi = cp->rssi; 6182 hdev->discovery.uuid_count = uuid_count; 6183 6184 if (uuid_count > 0) { 6185 hdev->discovery.uuids = kmemdup(cp->uuids, uuid_count * 16, 6186 GFP_KERNEL); 6187 if (!hdev->discovery.uuids) { 6188 err = mgmt_cmd_complete(sk, hdev->id, 6189 MGMT_OP_START_SERVICE_DISCOVERY, 6190 MGMT_STATUS_FAILED, 6191 &cp->type, sizeof(cp->type)); 6192 mgmt_pending_remove(cmd); 6193 goto failed; 6194 } 6195 } 6196 6197 err = hci_cmd_sync_queue(hdev, start_discovery_sync, cmd, 6198 start_discovery_complete); 6199 if (err < 0) { 6200 mgmt_pending_remove(cmd); 6201 goto failed; 6202 } 6203 6204 hci_discovery_set_state(hdev, DISCOVERY_STARTING); 6205 6206 failed: 6207 hci_dev_unlock(hdev); 6208 return err; 6209 } 6210 6211 static void stop_discovery_complete(struct hci_dev *hdev, void *data, int err) 6212 { 6213 struct mgmt_pending_cmd *cmd = data; 6214 6215 if (err == -ECANCELED || !mgmt_pending_valid(hdev, cmd)) 6216 return; 6217 6218 bt_dev_dbg(hdev, "err %d", err); 6219 6220 mgmt_cmd_complete(cmd->sk, cmd->hdev->id, cmd->opcode, mgmt_status(err), 6221 cmd->param, 1); 6222 mgmt_pending_free(cmd); 6223 6224 if (!err) 6225 hci_discovery_set_state(hdev, DISCOVERY_STOPPED); 6226 } 6227 6228 static int stop_discovery_sync(struct hci_dev *hdev, void *data) 6229 { 6230 if (!mgmt_pending_listed(hdev, data)) 6231 return -ECANCELED; 6232 6233 return hci_stop_discovery_sync(hdev); 6234 } 6235 6236 static int stop_discovery(struct sock *sk, struct hci_dev *hdev, void *data, 6237 u16 len) 6238 { 6239 struct mgmt_cp_stop_discovery *mgmt_cp = data; 6240 struct mgmt_pending_cmd *cmd; 6241 int err; 6242 6243 bt_dev_dbg(hdev, "sock %p", sk); 6244 6245 hci_dev_lock(hdev); 6246 6247 if (!hci_discovery_active(hdev)) { 6248 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY, 6249 MGMT_STATUS_REJECTED, &mgmt_cp->type, 6250 sizeof(mgmt_cp->type)); 6251 goto unlock; 6252 } 6253 6254 if (hdev->discovery.type != mgmt_cp->type) { 6255 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY, 6256 MGMT_STATUS_INVALID_PARAMS, 6257 &mgmt_cp->type, sizeof(mgmt_cp->type)); 6258 goto unlock; 6259 } 6260 6261 cmd = mgmt_pending_add(sk, MGMT_OP_STOP_DISCOVERY, hdev, data, len); 6262 if (!cmd) { 6263 err = -ENOMEM; 6264 goto unlock; 6265 } 6266 6267 err = hci_cmd_sync_queue(hdev, stop_discovery_sync, cmd, 6268 stop_discovery_complete); 6269 if (err < 0) { 6270 mgmt_pending_remove(cmd); 6271 goto unlock; 6272 } 6273 6274 hci_discovery_set_state(hdev, DISCOVERY_STOPPING); 6275 6276 unlock: 6277 hci_dev_unlock(hdev); 6278 return err; 6279 } 6280 6281 static int confirm_name(struct sock *sk, struct hci_dev *hdev, void *data, 6282 u16 len) 6283 { 6284 struct mgmt_cp_confirm_name *cp = data; 6285 struct inquiry_entry *e; 6286 int err; 6287 6288 bt_dev_dbg(hdev, "sock %p", sk); 6289 6290 hci_dev_lock(hdev); 6291 6292 if (!hci_discovery_active(hdev)) { 6293 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME, 6294 MGMT_STATUS_FAILED, &cp->addr, 6295 sizeof(cp->addr)); 6296 goto failed; 6297 } 6298 6299 e = hci_inquiry_cache_lookup_unknown(hdev, &cp->addr.bdaddr); 6300 if (!e) { 6301 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME, 6302 MGMT_STATUS_INVALID_PARAMS, &cp->addr, 6303 sizeof(cp->addr)); 6304 goto failed; 6305 } 6306 6307 if (cp->name_known) { 6308 e->name_state = NAME_KNOWN; 6309 list_del(&e->list); 6310 } else { 6311 e->name_state = NAME_NEEDED; 6312 hci_inquiry_cache_update_resolve(hdev, e); 6313 } 6314 6315 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME, 0, 6316 &cp->addr, sizeof(cp->addr)); 6317 6318 failed: 6319 hci_dev_unlock(hdev); 6320 return err; 6321 } 6322 6323 static int block_device(struct sock *sk, struct hci_dev *hdev, void *data, 6324 u16 len) 6325 { 6326 struct mgmt_cp_block_device *cp = data; 6327 u8 status; 6328 int err; 6329 6330 bt_dev_dbg(hdev, "sock %p", sk); 6331 6332 if (!bdaddr_type_is_valid(cp->addr.type)) 6333 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_BLOCK_DEVICE, 6334 MGMT_STATUS_INVALID_PARAMS, 6335 &cp->addr, sizeof(cp->addr)); 6336 6337 hci_dev_lock(hdev); 6338 6339 err = hci_bdaddr_list_add(&hdev->reject_list, &cp->addr.bdaddr, 6340 cp->addr.type); 6341 if (err < 0) { 6342 status = MGMT_STATUS_FAILED; 6343 goto done; 6344 } 6345 6346 mgmt_event(MGMT_EV_DEVICE_BLOCKED, hdev, &cp->addr, sizeof(cp->addr), 6347 sk); 6348 status = MGMT_STATUS_SUCCESS; 6349 6350 done: 6351 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_BLOCK_DEVICE, status, 6352 &cp->addr, sizeof(cp->addr)); 6353 6354 hci_dev_unlock(hdev); 6355 6356 return err; 6357 } 6358 6359 static int unblock_device(struct sock *sk, struct hci_dev *hdev, void *data, 6360 u16 len) 6361 { 6362 struct mgmt_cp_unblock_device *cp = data; 6363 u8 status; 6364 int err; 6365 6366 bt_dev_dbg(hdev, "sock %p", sk); 6367 6368 if (!bdaddr_type_is_valid(cp->addr.type)) 6369 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNBLOCK_DEVICE, 6370 MGMT_STATUS_INVALID_PARAMS, 6371 &cp->addr, sizeof(cp->addr)); 6372 6373 hci_dev_lock(hdev); 6374 6375 err = hci_bdaddr_list_del(&hdev->reject_list, &cp->addr.bdaddr, 6376 cp->addr.type); 6377 if (err < 0) { 6378 status = MGMT_STATUS_INVALID_PARAMS; 6379 goto done; 6380 } 6381 6382 mgmt_event(MGMT_EV_DEVICE_UNBLOCKED, hdev, &cp->addr, sizeof(cp->addr), 6383 sk); 6384 status = MGMT_STATUS_SUCCESS; 6385 6386 done: 6387 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNBLOCK_DEVICE, status, 6388 &cp->addr, sizeof(cp->addr)); 6389 6390 hci_dev_unlock(hdev); 6391 6392 return err; 6393 } 6394 6395 static int set_device_id_sync(struct hci_dev *hdev, void *data) 6396 { 6397 return hci_update_eir_sync(hdev); 6398 } 6399 6400 static int set_device_id(struct sock *sk, struct hci_dev *hdev, void *data, 6401 u16 len) 6402 { 6403 struct mgmt_cp_set_device_id *cp = data; 6404 int err; 6405 __u16 source; 6406 6407 bt_dev_dbg(hdev, "sock %p", sk); 6408 6409 source = __le16_to_cpu(cp->source); 6410 6411 if (source > 0x0002) 6412 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEVICE_ID, 6413 MGMT_STATUS_INVALID_PARAMS); 6414 6415 hci_dev_lock(hdev); 6416 6417 hdev->devid_source = source; 6418 hdev->devid_vendor = __le16_to_cpu(cp->vendor); 6419 hdev->devid_product = __le16_to_cpu(cp->product); 6420 hdev->devid_version = __le16_to_cpu(cp->version); 6421 6422 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_DEVICE_ID, 0, 6423 NULL, 0); 6424 6425 hci_cmd_sync_queue(hdev, set_device_id_sync, NULL, NULL); 6426 6427 hci_dev_unlock(hdev); 6428 6429 return err; 6430 } 6431 6432 static void enable_advertising_instance(struct hci_dev *hdev, int err) 6433 { 6434 if (err) 6435 bt_dev_err(hdev, "failed to re-configure advertising %d", err); 6436 else 6437 bt_dev_dbg(hdev, "status %d", err); 6438 } 6439 6440 static void set_advertising_complete(struct hci_dev *hdev, void *data, int err) 6441 { 6442 struct mgmt_pending_cmd *cmd = data; 6443 struct cmd_lookup match = { NULL, hdev }; 6444 u8 instance; 6445 struct adv_info *adv_instance; 6446 u8 status = mgmt_status(err); 6447 6448 if (err == -ECANCELED || !mgmt_pending_valid(hdev, data)) 6449 return; 6450 6451 if (status) { 6452 mgmt_cmd_status(cmd->sk, cmd->hdev->id, cmd->opcode, status); 6453 mgmt_pending_free(cmd); 6454 return; 6455 } 6456 6457 if (hci_dev_test_flag(hdev, HCI_LE_ADV)) 6458 hci_dev_set_flag(hdev, HCI_ADVERTISING); 6459 else 6460 hci_dev_clear_flag(hdev, HCI_ADVERTISING); 6461 6462 settings_rsp(cmd, &match); 6463 mgmt_pending_free(cmd); 6464 6465 new_settings(hdev, match.sk); 6466 6467 if (match.sk) 6468 sock_put(match.sk); 6469 6470 /* If "Set Advertising" was just disabled and instance advertising was 6471 * set up earlier, then re-enable multi-instance advertising. 6472 */ 6473 if (hci_dev_test_flag(hdev, HCI_ADVERTISING) || 6474 list_empty(&hdev->adv_instances)) 6475 return; 6476 6477 instance = hdev->cur_adv_instance; 6478 if (!instance) { 6479 adv_instance = list_first_entry_or_null(&hdev->adv_instances, 6480 struct adv_info, list); 6481 if (!adv_instance) 6482 return; 6483 6484 instance = adv_instance->instance; 6485 } 6486 6487 err = hci_schedule_adv_instance_sync(hdev, instance, true); 6488 6489 enable_advertising_instance(hdev, err); 6490 } 6491 6492 static int set_adv_sync(struct hci_dev *hdev, void *data) 6493 { 6494 struct mgmt_pending_cmd *cmd = data; 6495 struct mgmt_mode cp; 6496 u8 val; 6497 6498 mutex_lock(&hdev->mgmt_pending_lock); 6499 6500 if (!__mgmt_pending_listed(hdev, cmd)) { 6501 mutex_unlock(&hdev->mgmt_pending_lock); 6502 return -ECANCELED; 6503 } 6504 6505 memcpy(&cp, cmd->param, sizeof(cp)); 6506 6507 mutex_unlock(&hdev->mgmt_pending_lock); 6508 6509 val = !!cp.val; 6510 6511 if (cp.val == 0x02) 6512 hci_dev_set_flag(hdev, HCI_ADVERTISING_CONNECTABLE); 6513 else 6514 hci_dev_clear_flag(hdev, HCI_ADVERTISING_CONNECTABLE); 6515 6516 cancel_adv_timeout(hdev); 6517 6518 if (val) { 6519 /* Switch to instance "0" for the Set Advertising setting. 6520 * We cannot use update_[adv|scan_rsp]_data() here as the 6521 * HCI_ADVERTISING flag is not yet set. 6522 */ 6523 hdev->cur_adv_instance = 0x00; 6524 6525 if (ext_adv_capable(hdev)) { 6526 hci_start_ext_adv_sync(hdev, 0x00); 6527 } else { 6528 hci_update_adv_data_sync(hdev, 0x00); 6529 hci_update_scan_rsp_data_sync(hdev, 0x00); 6530 hci_enable_advertising_sync(hdev); 6531 } 6532 } else { 6533 hci_disable_advertising_sync(hdev); 6534 } 6535 6536 return 0; 6537 } 6538 6539 static int set_advertising(struct sock *sk, struct hci_dev *hdev, void *data, 6540 u16 len) 6541 { 6542 struct mgmt_mode *cp = data; 6543 struct mgmt_pending_cmd *cmd; 6544 u8 val, status; 6545 int err; 6546 6547 bt_dev_dbg(hdev, "sock %p", sk); 6548 6549 status = mgmt_le_support(hdev); 6550 if (status) 6551 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING, 6552 status); 6553 6554 if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02) 6555 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING, 6556 MGMT_STATUS_INVALID_PARAMS); 6557 6558 if (hdev->advertising_paused) 6559 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING, 6560 MGMT_STATUS_BUSY); 6561 6562 hci_dev_lock(hdev); 6563 6564 val = !!cp->val; 6565 6566 /* The following conditions are ones which mean that we should 6567 * not do any HCI communication but directly send a mgmt 6568 * response to user space (after toggling the flag if 6569 * necessary). 6570 */ 6571 if (!hdev_is_powered(hdev) || 6572 (val == hci_dev_test_flag(hdev, HCI_ADVERTISING) && 6573 (cp->val == 0x02) == hci_dev_test_flag(hdev, HCI_ADVERTISING_CONNECTABLE)) || 6574 hci_dev_test_flag(hdev, HCI_MESH) || 6575 hci_conn_num(hdev, LE_LINK) > 0 || 6576 (hci_dev_test_flag(hdev, HCI_LE_SCAN) && 6577 hdev->le_scan_type == LE_SCAN_ACTIVE)) { 6578 bool changed; 6579 6580 if (cp->val) { 6581 hdev->cur_adv_instance = 0x00; 6582 changed = !hci_dev_test_and_set_flag(hdev, HCI_ADVERTISING); 6583 if (cp->val == 0x02) 6584 hci_dev_set_flag(hdev, HCI_ADVERTISING_CONNECTABLE); 6585 else 6586 hci_dev_clear_flag(hdev, HCI_ADVERTISING_CONNECTABLE); 6587 } else { 6588 changed = hci_dev_test_and_clear_flag(hdev, HCI_ADVERTISING); 6589 hci_dev_clear_flag(hdev, HCI_ADVERTISING_CONNECTABLE); 6590 } 6591 6592 err = send_settings_rsp(sk, MGMT_OP_SET_ADVERTISING, hdev); 6593 if (err < 0) 6594 goto unlock; 6595 6596 if (changed) 6597 err = new_settings(hdev, sk); 6598 6599 goto unlock; 6600 } 6601 6602 if (pending_find(MGMT_OP_SET_ADVERTISING, hdev) || 6603 pending_find(MGMT_OP_SET_LE, hdev)) { 6604 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING, 6605 MGMT_STATUS_BUSY); 6606 goto unlock; 6607 } 6608 6609 cmd = mgmt_pending_add(sk, MGMT_OP_SET_ADVERTISING, hdev, data, len); 6610 if (!cmd) 6611 err = -ENOMEM; 6612 else 6613 err = hci_cmd_sync_queue(hdev, set_adv_sync, cmd, 6614 set_advertising_complete); 6615 6616 if (err < 0 && cmd) 6617 mgmt_pending_remove(cmd); 6618 6619 unlock: 6620 hci_dev_unlock(hdev); 6621 return err; 6622 } 6623 6624 static int set_static_address(struct sock *sk, struct hci_dev *hdev, 6625 void *data, u16 len) 6626 { 6627 struct mgmt_cp_set_static_address *cp = data; 6628 int err; 6629 6630 bt_dev_dbg(hdev, "sock %p", sk); 6631 6632 if (!lmp_le_capable(hdev)) 6633 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_STATIC_ADDRESS, 6634 MGMT_STATUS_NOT_SUPPORTED); 6635 6636 if (hdev_is_powered(hdev)) 6637 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_STATIC_ADDRESS, 6638 MGMT_STATUS_REJECTED); 6639 6640 if (bacmp(&cp->bdaddr, BDADDR_ANY)) { 6641 if (!bacmp(&cp->bdaddr, BDADDR_NONE)) 6642 return mgmt_cmd_status(sk, hdev->id, 6643 MGMT_OP_SET_STATIC_ADDRESS, 6644 MGMT_STATUS_INVALID_PARAMS); 6645 6646 /* Two most significant bits shall be set */ 6647 if ((cp->bdaddr.b[5] & 0xc0) != 0xc0) 6648 return mgmt_cmd_status(sk, hdev->id, 6649 MGMT_OP_SET_STATIC_ADDRESS, 6650 MGMT_STATUS_INVALID_PARAMS); 6651 } 6652 6653 hci_dev_lock(hdev); 6654 6655 bacpy(&hdev->static_addr, &cp->bdaddr); 6656 6657 err = send_settings_rsp(sk, MGMT_OP_SET_STATIC_ADDRESS, hdev); 6658 if (err < 0) 6659 goto unlock; 6660 6661 err = new_settings(hdev, sk); 6662 6663 unlock: 6664 hci_dev_unlock(hdev); 6665 return err; 6666 } 6667 6668 static int set_scan_params(struct sock *sk, struct hci_dev *hdev, 6669 void *data, u16 len) 6670 { 6671 struct mgmt_cp_set_scan_params *cp = data; 6672 __u16 interval, window; 6673 int err; 6674 6675 bt_dev_dbg(hdev, "sock %p", sk); 6676 6677 if (!lmp_le_capable(hdev)) 6678 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS, 6679 MGMT_STATUS_NOT_SUPPORTED); 6680 6681 /* Keep allowed ranges in sync with set_mesh() */ 6682 interval = __le16_to_cpu(cp->interval); 6683 6684 if (interval < 0x0004 || interval > 0x4000) 6685 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS, 6686 MGMT_STATUS_INVALID_PARAMS); 6687 6688 window = __le16_to_cpu(cp->window); 6689 6690 if (window < 0x0004 || window > 0x4000) 6691 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS, 6692 MGMT_STATUS_INVALID_PARAMS); 6693 6694 if (window > interval) 6695 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS, 6696 MGMT_STATUS_INVALID_PARAMS); 6697 6698 hci_dev_lock(hdev); 6699 6700 hdev->le_scan_interval = interval; 6701 hdev->le_scan_window = window; 6702 6703 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS, 0, 6704 NULL, 0); 6705 6706 /* If background scan is running, restart it so new parameters are 6707 * loaded. 6708 */ 6709 if (hci_dev_test_flag(hdev, HCI_LE_SCAN) && 6710 hdev->discovery.state == DISCOVERY_STOPPED) 6711 hci_update_passive_scan(hdev); 6712 6713 hci_dev_unlock(hdev); 6714 6715 return err; 6716 } 6717 6718 static void fast_connectable_complete(struct hci_dev *hdev, void *data, int err) 6719 { 6720 struct mgmt_pending_cmd *cmd = data; 6721 6722 bt_dev_dbg(hdev, "err %d", err); 6723 6724 if (err) { 6725 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE, 6726 mgmt_status(err)); 6727 } else { 6728 struct mgmt_mode *cp = cmd->param; 6729 6730 if (cp->val) 6731 hci_dev_set_flag(hdev, HCI_FAST_CONNECTABLE); 6732 else 6733 hci_dev_clear_flag(hdev, HCI_FAST_CONNECTABLE); 6734 6735 send_settings_rsp(cmd->sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev); 6736 new_settings(hdev, cmd->sk); 6737 } 6738 6739 mgmt_pending_free(cmd); 6740 } 6741 6742 static int write_fast_connectable_sync(struct hci_dev *hdev, void *data) 6743 { 6744 struct mgmt_pending_cmd *cmd = data; 6745 struct mgmt_mode *cp = cmd->param; 6746 6747 return hci_write_fast_connectable_sync(hdev, cp->val); 6748 } 6749 6750 static int set_fast_connectable(struct sock *sk, struct hci_dev *hdev, 6751 void *data, u16 len) 6752 { 6753 struct mgmt_mode *cp = data; 6754 struct mgmt_pending_cmd *cmd; 6755 int err; 6756 6757 bt_dev_dbg(hdev, "sock %p", sk); 6758 6759 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) || 6760 hdev->hci_ver < BLUETOOTH_VER_1_2) 6761 return mgmt_cmd_status(sk, hdev->id, 6762 MGMT_OP_SET_FAST_CONNECTABLE, 6763 MGMT_STATUS_NOT_SUPPORTED); 6764 6765 if (cp->val != 0x00 && cp->val != 0x01) 6766 return mgmt_cmd_status(sk, hdev->id, 6767 MGMT_OP_SET_FAST_CONNECTABLE, 6768 MGMT_STATUS_INVALID_PARAMS); 6769 6770 hci_dev_lock(hdev); 6771 6772 if (!!cp->val == hci_dev_test_flag(hdev, HCI_FAST_CONNECTABLE)) { 6773 err = send_settings_rsp(sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev); 6774 goto unlock; 6775 } 6776 6777 if (!hdev_is_powered(hdev)) { 6778 hci_dev_change_flag(hdev, HCI_FAST_CONNECTABLE); 6779 err = send_settings_rsp(sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev); 6780 new_settings(hdev, sk); 6781 goto unlock; 6782 } 6783 6784 cmd = mgmt_pending_new(sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev, data, 6785 len); 6786 if (!cmd) 6787 err = -ENOMEM; 6788 else 6789 err = hci_cmd_sync_queue(hdev, write_fast_connectable_sync, cmd, 6790 fast_connectable_complete); 6791 6792 if (err < 0) { 6793 mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE, 6794 MGMT_STATUS_FAILED); 6795 6796 if (cmd) 6797 mgmt_pending_free(cmd); 6798 } 6799 6800 unlock: 6801 hci_dev_unlock(hdev); 6802 6803 return err; 6804 } 6805 6806 static void set_bredr_complete(struct hci_dev *hdev, void *data, int err) 6807 { 6808 struct mgmt_pending_cmd *cmd = data; 6809 6810 bt_dev_dbg(hdev, "err %d", err); 6811 6812 if (err) { 6813 u8 mgmt_err = mgmt_status(err); 6814 6815 /* We need to restore the flag if related HCI commands 6816 * failed. 6817 */ 6818 hci_dev_clear_flag(hdev, HCI_BREDR_ENABLED); 6819 6820 mgmt_cmd_status(cmd->sk, cmd->hdev->id, cmd->opcode, mgmt_err); 6821 } else { 6822 send_settings_rsp(cmd->sk, MGMT_OP_SET_BREDR, hdev); 6823 new_settings(hdev, cmd->sk); 6824 } 6825 6826 mgmt_pending_free(cmd); 6827 } 6828 6829 static int set_bredr_sync(struct hci_dev *hdev, void *data) 6830 { 6831 int status; 6832 6833 status = hci_write_fast_connectable_sync(hdev, false); 6834 6835 if (!status) 6836 status = hci_update_scan_sync(hdev); 6837 6838 /* Since only the advertising data flags will change, there 6839 * is no need to update the scan response data. 6840 */ 6841 if (!status) 6842 status = hci_update_adv_data_sync(hdev, hdev->cur_adv_instance); 6843 6844 return status; 6845 } 6846 6847 static int set_bredr(struct sock *sk, struct hci_dev *hdev, void *data, u16 len) 6848 { 6849 struct mgmt_mode *cp = data; 6850 struct mgmt_pending_cmd *cmd; 6851 int err; 6852 6853 bt_dev_dbg(hdev, "sock %p", sk); 6854 6855 if (!lmp_bredr_capable(hdev) || !lmp_le_capable(hdev)) 6856 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR, 6857 MGMT_STATUS_NOT_SUPPORTED); 6858 6859 if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED)) 6860 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR, 6861 MGMT_STATUS_REJECTED); 6862 6863 if (cp->val != 0x00 && cp->val != 0x01) 6864 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR, 6865 MGMT_STATUS_INVALID_PARAMS); 6866 6867 hci_dev_lock(hdev); 6868 6869 if (cp->val == hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) { 6870 err = send_settings_rsp(sk, MGMT_OP_SET_BREDR, hdev); 6871 goto unlock; 6872 } 6873 6874 if (!hdev_is_powered(hdev)) { 6875 if (!cp->val) { 6876 hci_dev_clear_flag(hdev, HCI_DISCOVERABLE); 6877 hci_dev_clear_flag(hdev, HCI_SSP_ENABLED); 6878 hci_dev_clear_flag(hdev, HCI_LINK_SECURITY); 6879 hci_dev_clear_flag(hdev, HCI_FAST_CONNECTABLE); 6880 } 6881 6882 hci_dev_change_flag(hdev, HCI_BREDR_ENABLED); 6883 6884 err = send_settings_rsp(sk, MGMT_OP_SET_BREDR, hdev); 6885 if (err < 0) 6886 goto unlock; 6887 6888 err = new_settings(hdev, sk); 6889 goto unlock; 6890 } 6891 6892 /* Reject disabling when powered on */ 6893 if (!cp->val) { 6894 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR, 6895 MGMT_STATUS_REJECTED); 6896 goto unlock; 6897 } else { 6898 /* When configuring a dual-mode controller to operate 6899 * with LE only and using a static address, then switching 6900 * BR/EDR back on is not allowed. 6901 * 6902 * Dual-mode controllers shall operate with the public 6903 * address as its identity address for BR/EDR and LE. So 6904 * reject the attempt to create an invalid configuration. 6905 * 6906 * The same restrictions applies when secure connections 6907 * has been enabled. For BR/EDR this is a controller feature 6908 * while for LE it is a host stack feature. This means that 6909 * switching BR/EDR back on when secure connections has been 6910 * enabled is not a supported transaction. 6911 */ 6912 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) && 6913 (bacmp(&hdev->static_addr, BDADDR_ANY) || 6914 hci_dev_test_flag(hdev, HCI_SC_ENABLED))) { 6915 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR, 6916 MGMT_STATUS_REJECTED); 6917 goto unlock; 6918 } 6919 } 6920 6921 cmd = mgmt_pending_new(sk, MGMT_OP_SET_BREDR, hdev, data, len); 6922 if (!cmd) 6923 err = -ENOMEM; 6924 else 6925 err = hci_cmd_sync_queue(hdev, set_bredr_sync, cmd, 6926 set_bredr_complete); 6927 6928 if (err < 0) { 6929 mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR, 6930 MGMT_STATUS_FAILED); 6931 if (cmd) 6932 mgmt_pending_free(cmd); 6933 6934 goto unlock; 6935 } 6936 6937 /* We need to flip the bit already here so that 6938 * hci_req_update_adv_data generates the correct flags. 6939 */ 6940 hci_dev_set_flag(hdev, HCI_BREDR_ENABLED); 6941 6942 unlock: 6943 hci_dev_unlock(hdev); 6944 return err; 6945 } 6946 6947 static void set_secure_conn_complete(struct hci_dev *hdev, void *data, int err) 6948 { 6949 struct mgmt_pending_cmd *cmd = data; 6950 struct mgmt_mode *cp; 6951 6952 bt_dev_dbg(hdev, "err %d", err); 6953 6954 if (err) { 6955 u8 mgmt_err = mgmt_status(err); 6956 6957 mgmt_cmd_status(cmd->sk, cmd->hdev->id, cmd->opcode, mgmt_err); 6958 goto done; 6959 } 6960 6961 cp = cmd->param; 6962 6963 switch (cp->val) { 6964 case 0x00: 6965 hci_dev_clear_flag(hdev, HCI_SC_ENABLED); 6966 hci_dev_clear_flag(hdev, HCI_SC_ONLY); 6967 break; 6968 case 0x01: 6969 hci_dev_set_flag(hdev, HCI_SC_ENABLED); 6970 hci_dev_clear_flag(hdev, HCI_SC_ONLY); 6971 break; 6972 case 0x02: 6973 hci_dev_set_flag(hdev, HCI_SC_ENABLED); 6974 hci_dev_set_flag(hdev, HCI_SC_ONLY); 6975 break; 6976 } 6977 6978 send_settings_rsp(cmd->sk, cmd->opcode, hdev); 6979 new_settings(hdev, cmd->sk); 6980 6981 done: 6982 mgmt_pending_free(cmd); 6983 } 6984 6985 static int set_secure_conn_sync(struct hci_dev *hdev, void *data) 6986 { 6987 struct mgmt_pending_cmd *cmd = data; 6988 struct mgmt_mode *cp = cmd->param; 6989 u8 val = !!cp->val; 6990 6991 /* Force write of val */ 6992 hci_dev_set_flag(hdev, HCI_SC_ENABLED); 6993 6994 return hci_write_sc_support_sync(hdev, val); 6995 } 6996 6997 static int set_secure_conn(struct sock *sk, struct hci_dev *hdev, 6998 void *data, u16 len) 6999 { 7000 struct mgmt_mode *cp = data; 7001 struct mgmt_pending_cmd *cmd; 7002 u8 val; 7003 int err; 7004 7005 bt_dev_dbg(hdev, "sock %p", sk); 7006 7007 if (!lmp_sc_capable(hdev) && 7008 !hci_dev_test_flag(hdev, HCI_LE_ENABLED)) 7009 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN, 7010 MGMT_STATUS_NOT_SUPPORTED); 7011 7012 if (hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) && 7013 lmp_sc_capable(hdev) && 7014 !hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) 7015 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN, 7016 MGMT_STATUS_REJECTED); 7017 7018 if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02) 7019 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN, 7020 MGMT_STATUS_INVALID_PARAMS); 7021 7022 hci_dev_lock(hdev); 7023 7024 if (!hdev_is_powered(hdev) || !lmp_sc_capable(hdev) || 7025 !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) { 7026 bool changed; 7027 7028 if (cp->val) { 7029 changed = !hci_dev_test_and_set_flag(hdev, 7030 HCI_SC_ENABLED); 7031 if (cp->val == 0x02) 7032 hci_dev_set_flag(hdev, HCI_SC_ONLY); 7033 else 7034 hci_dev_clear_flag(hdev, HCI_SC_ONLY); 7035 } else { 7036 changed = hci_dev_test_and_clear_flag(hdev, 7037 HCI_SC_ENABLED); 7038 hci_dev_clear_flag(hdev, HCI_SC_ONLY); 7039 } 7040 7041 err = send_settings_rsp(sk, MGMT_OP_SET_SECURE_CONN, hdev); 7042 if (err < 0) 7043 goto failed; 7044 7045 if (changed) 7046 err = new_settings(hdev, sk); 7047 7048 goto failed; 7049 } 7050 7051 val = !!cp->val; 7052 7053 if (val == hci_dev_test_flag(hdev, HCI_SC_ENABLED) && 7054 (cp->val == 0x02) == hci_dev_test_flag(hdev, HCI_SC_ONLY)) { 7055 err = send_settings_rsp(sk, MGMT_OP_SET_SECURE_CONN, hdev); 7056 goto failed; 7057 } 7058 7059 cmd = mgmt_pending_new(sk, MGMT_OP_SET_SECURE_CONN, hdev, data, len); 7060 if (!cmd) 7061 err = -ENOMEM; 7062 else 7063 err = hci_cmd_sync_queue(hdev, set_secure_conn_sync, cmd, 7064 set_secure_conn_complete); 7065 7066 if (err < 0) { 7067 mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN, 7068 MGMT_STATUS_FAILED); 7069 if (cmd) 7070 mgmt_pending_free(cmd); 7071 } 7072 7073 failed: 7074 hci_dev_unlock(hdev); 7075 return err; 7076 } 7077 7078 static int set_debug_keys(struct sock *sk, struct hci_dev *hdev, 7079 void *data, u16 len) 7080 { 7081 struct mgmt_mode *cp = data; 7082 bool changed, use_changed; 7083 int err; 7084 7085 bt_dev_dbg(hdev, "sock %p", sk); 7086 7087 if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02) 7088 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEBUG_KEYS, 7089 MGMT_STATUS_INVALID_PARAMS); 7090 7091 hci_dev_lock(hdev); 7092 7093 if (cp->val) 7094 changed = !hci_dev_test_and_set_flag(hdev, HCI_KEEP_DEBUG_KEYS); 7095 else 7096 changed = hci_dev_test_and_clear_flag(hdev, 7097 HCI_KEEP_DEBUG_KEYS); 7098 7099 if (cp->val == 0x02) 7100 use_changed = !hci_dev_test_and_set_flag(hdev, 7101 HCI_USE_DEBUG_KEYS); 7102 else 7103 use_changed = hci_dev_test_and_clear_flag(hdev, 7104 HCI_USE_DEBUG_KEYS); 7105 7106 if (hdev_is_powered(hdev) && use_changed && 7107 hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) { 7108 u8 mode = (cp->val == 0x02) ? 0x01 : 0x00; 7109 hci_send_cmd(hdev, HCI_OP_WRITE_SSP_DEBUG_MODE, 7110 sizeof(mode), &mode); 7111 } 7112 7113 err = send_settings_rsp(sk, MGMT_OP_SET_DEBUG_KEYS, hdev); 7114 if (err < 0) 7115 goto unlock; 7116 7117 if (changed) 7118 err = new_settings(hdev, sk); 7119 7120 unlock: 7121 hci_dev_unlock(hdev); 7122 return err; 7123 } 7124 7125 static int set_privacy(struct sock *sk, struct hci_dev *hdev, void *cp_data, 7126 u16 len) 7127 { 7128 struct mgmt_cp_set_privacy *cp = cp_data; 7129 bool changed; 7130 int err; 7131 7132 bt_dev_dbg(hdev, "sock %p", sk); 7133 7134 if (!lmp_le_capable(hdev)) 7135 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY, 7136 MGMT_STATUS_NOT_SUPPORTED); 7137 7138 if (cp->privacy != 0x00 && cp->privacy != 0x01 && cp->privacy != 0x02) 7139 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY, 7140 MGMT_STATUS_INVALID_PARAMS); 7141 7142 if (hdev_is_powered(hdev)) 7143 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY, 7144 MGMT_STATUS_REJECTED); 7145 7146 hci_dev_lock(hdev); 7147 7148 /* If user space supports this command it is also expected to 7149 * handle IRKs. Therefore, set the HCI_RPA_RESOLVING flag. 7150 */ 7151 hci_dev_set_flag(hdev, HCI_RPA_RESOLVING); 7152 7153 if (cp->privacy) { 7154 changed = !hci_dev_test_and_set_flag(hdev, HCI_PRIVACY); 7155 memcpy(hdev->irk, cp->irk, sizeof(hdev->irk)); 7156 hci_dev_set_flag(hdev, HCI_RPA_EXPIRED); 7157 hci_adv_instances_set_rpa_expired(hdev, true); 7158 if (cp->privacy == 0x02) 7159 hci_dev_set_flag(hdev, HCI_LIMITED_PRIVACY); 7160 else 7161 hci_dev_clear_flag(hdev, HCI_LIMITED_PRIVACY); 7162 } else { 7163 changed = hci_dev_test_and_clear_flag(hdev, HCI_PRIVACY); 7164 memset(hdev->irk, 0, sizeof(hdev->irk)); 7165 hci_dev_clear_flag(hdev, HCI_RPA_EXPIRED); 7166 hci_adv_instances_set_rpa_expired(hdev, false); 7167 hci_dev_clear_flag(hdev, HCI_LIMITED_PRIVACY); 7168 } 7169 7170 err = send_settings_rsp(sk, MGMT_OP_SET_PRIVACY, hdev); 7171 if (err < 0) 7172 goto unlock; 7173 7174 if (changed) 7175 err = new_settings(hdev, sk); 7176 7177 unlock: 7178 hci_dev_unlock(hdev); 7179 return err; 7180 } 7181 7182 static bool irk_is_valid(struct mgmt_irk_info *irk) 7183 { 7184 switch (irk->addr.type) { 7185 case BDADDR_LE_PUBLIC: 7186 return true; 7187 7188 case BDADDR_LE_RANDOM: 7189 /* Two most significant bits shall be set */ 7190 if ((irk->addr.bdaddr.b[5] & 0xc0) != 0xc0) 7191 return false; 7192 return true; 7193 } 7194 7195 return false; 7196 } 7197 7198 static int load_irks(struct sock *sk, struct hci_dev *hdev, void *cp_data, 7199 u16 len) 7200 { 7201 struct mgmt_cp_load_irks *cp = cp_data; 7202 const u16 max_irk_count = ((U16_MAX - sizeof(*cp)) / 7203 sizeof(struct mgmt_irk_info)); 7204 u16 irk_count, expected_len; 7205 int i, err; 7206 7207 bt_dev_dbg(hdev, "sock %p", sk); 7208 7209 if (!lmp_le_capable(hdev)) 7210 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS, 7211 MGMT_STATUS_NOT_SUPPORTED); 7212 7213 irk_count = __le16_to_cpu(cp->irk_count); 7214 if (irk_count > max_irk_count) { 7215 bt_dev_err(hdev, "load_irks: too big irk_count value %u", 7216 irk_count); 7217 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS, 7218 MGMT_STATUS_INVALID_PARAMS); 7219 } 7220 7221 expected_len = struct_size(cp, irks, irk_count); 7222 if (expected_len != len) { 7223 bt_dev_err(hdev, "load_irks: expected %u bytes, got %u bytes", 7224 expected_len, len); 7225 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS, 7226 MGMT_STATUS_INVALID_PARAMS); 7227 } 7228 7229 bt_dev_dbg(hdev, "irk_count %u", irk_count); 7230 7231 for (i = 0; i < irk_count; i++) { 7232 struct mgmt_irk_info *key = &cp->irks[i]; 7233 7234 if (!irk_is_valid(key)) 7235 return mgmt_cmd_status(sk, hdev->id, 7236 MGMT_OP_LOAD_IRKS, 7237 MGMT_STATUS_INVALID_PARAMS); 7238 } 7239 7240 hci_dev_lock(hdev); 7241 7242 hci_smp_irks_clear(hdev); 7243 7244 for (i = 0; i < irk_count; i++) { 7245 struct mgmt_irk_info *irk = &cp->irks[i]; 7246 7247 if (hci_is_blocked_key(hdev, 7248 HCI_BLOCKED_KEY_TYPE_IRK, 7249 irk->val)) { 7250 bt_dev_warn(hdev, "Skipping blocked IRK for %pMR", 7251 &irk->addr.bdaddr); 7252 continue; 7253 } 7254 7255 hci_add_irk(hdev, &irk->addr.bdaddr, 7256 le_addr_type(irk->addr.type), irk->val, 7257 BDADDR_ANY); 7258 } 7259 7260 hci_dev_set_flag(hdev, HCI_RPA_RESOLVING); 7261 7262 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_IRKS, 0, NULL, 0); 7263 7264 hci_dev_unlock(hdev); 7265 7266 return err; 7267 } 7268 7269 static bool ltk_is_valid(struct mgmt_ltk_info *key) 7270 { 7271 if (key->initiator != 0x00 && key->initiator != 0x01) 7272 return false; 7273 7274 if (key->enc_size > sizeof(key->val)) 7275 return false; 7276 7277 switch (key->addr.type) { 7278 case BDADDR_LE_PUBLIC: 7279 return true; 7280 7281 case BDADDR_LE_RANDOM: 7282 /* Two most significant bits shall be set */ 7283 if ((key->addr.bdaddr.b[5] & 0xc0) != 0xc0) 7284 return false; 7285 return true; 7286 } 7287 7288 return false; 7289 } 7290 7291 static int load_long_term_keys(struct sock *sk, struct hci_dev *hdev, 7292 void *cp_data, u16 len) 7293 { 7294 struct mgmt_cp_load_long_term_keys *cp = cp_data; 7295 const u16 max_key_count = ((U16_MAX - sizeof(*cp)) / 7296 sizeof(struct mgmt_ltk_info)); 7297 u16 key_count, expected_len; 7298 int i, err; 7299 7300 bt_dev_dbg(hdev, "sock %p", sk); 7301 7302 if (!lmp_le_capable(hdev)) 7303 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS, 7304 MGMT_STATUS_NOT_SUPPORTED); 7305 7306 key_count = __le16_to_cpu(cp->key_count); 7307 if (key_count > max_key_count) { 7308 bt_dev_err(hdev, "load_ltks: too big key_count value %u", 7309 key_count); 7310 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS, 7311 MGMT_STATUS_INVALID_PARAMS); 7312 } 7313 7314 expected_len = struct_size(cp, keys, key_count); 7315 if (expected_len != len) { 7316 bt_dev_err(hdev, "load_keys: expected %u bytes, got %u bytes", 7317 expected_len, len); 7318 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS, 7319 MGMT_STATUS_INVALID_PARAMS); 7320 } 7321 7322 bt_dev_dbg(hdev, "key_count %u", key_count); 7323 7324 hci_dev_lock(hdev); 7325 7326 hci_smp_ltks_clear(hdev); 7327 7328 for (i = 0; i < key_count; i++) { 7329 struct mgmt_ltk_info *key = &cp->keys[i]; 7330 u8 type, authenticated; 7331 7332 if (hci_is_blocked_key(hdev, 7333 HCI_BLOCKED_KEY_TYPE_LTK, 7334 key->val)) { 7335 bt_dev_warn(hdev, "Skipping blocked LTK for %pMR", 7336 &key->addr.bdaddr); 7337 continue; 7338 } 7339 7340 if (!ltk_is_valid(key)) { 7341 bt_dev_warn(hdev, "Invalid LTK for %pMR", 7342 &key->addr.bdaddr); 7343 continue; 7344 } 7345 7346 switch (key->type) { 7347 case MGMT_LTK_UNAUTHENTICATED: 7348 authenticated = 0x00; 7349 type = key->initiator ? SMP_LTK : SMP_LTK_RESPONDER; 7350 break; 7351 case MGMT_LTK_AUTHENTICATED: 7352 authenticated = 0x01; 7353 type = key->initiator ? SMP_LTK : SMP_LTK_RESPONDER; 7354 break; 7355 case MGMT_LTK_P256_UNAUTH: 7356 authenticated = 0x00; 7357 type = SMP_LTK_P256; 7358 break; 7359 case MGMT_LTK_P256_AUTH: 7360 authenticated = 0x01; 7361 type = SMP_LTK_P256; 7362 break; 7363 case MGMT_LTK_P256_DEBUG: 7364 authenticated = 0x00; 7365 type = SMP_LTK_P256_DEBUG; 7366 fallthrough; 7367 default: 7368 continue; 7369 } 7370 7371 hci_add_ltk(hdev, &key->addr.bdaddr, 7372 le_addr_type(key->addr.type), type, authenticated, 7373 key->val, key->enc_size, key->ediv, key->rand); 7374 } 7375 7376 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS, 0, 7377 NULL, 0); 7378 7379 hci_dev_unlock(hdev); 7380 7381 return err; 7382 } 7383 7384 static void get_conn_info_complete(struct hci_dev *hdev, void *data, int err) 7385 { 7386 struct mgmt_pending_cmd *cmd = data; 7387 struct hci_conn *conn = cmd->user_data; 7388 struct mgmt_cp_get_conn_info *cp = cmd->param; 7389 struct mgmt_rp_get_conn_info rp; 7390 u8 status; 7391 7392 bt_dev_dbg(hdev, "err %d", err); 7393 7394 memcpy(&rp.addr, &cp->addr, sizeof(rp.addr)); 7395 7396 status = mgmt_status(err); 7397 if (status == MGMT_STATUS_SUCCESS) { 7398 rp.rssi = conn->rssi; 7399 rp.tx_power = conn->tx_power; 7400 rp.max_tx_power = conn->max_tx_power; 7401 } else { 7402 rp.rssi = HCI_RSSI_INVALID; 7403 rp.tx_power = HCI_TX_POWER_INVALID; 7404 rp.max_tx_power = HCI_TX_POWER_INVALID; 7405 } 7406 7407 if (conn) 7408 hci_conn_put(conn); 7409 7410 mgmt_cmd_complete(cmd->sk, cmd->hdev->id, MGMT_OP_GET_CONN_INFO, status, 7411 &rp, sizeof(rp)); 7412 7413 mgmt_pending_free(cmd); 7414 } 7415 7416 static int get_conn_info_sync(struct hci_dev *hdev, void *data) 7417 { 7418 struct mgmt_pending_cmd *cmd = data; 7419 struct mgmt_cp_get_conn_info *cp = cmd->param; 7420 struct hci_conn *conn; 7421 int err; 7422 __le16 handle; 7423 7424 hci_dev_lock(hdev); 7425 7426 /* Make sure we are still connected */ 7427 if (cp->addr.type == BDADDR_BREDR) 7428 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, 7429 &cp->addr.bdaddr); 7430 else 7431 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &cp->addr.bdaddr); 7432 7433 if (!conn || conn->state != BT_CONNECTED) { 7434 hci_dev_unlock(hdev); 7435 return MGMT_STATUS_NOT_CONNECTED; 7436 } 7437 7438 cmd->user_data = hci_conn_get(conn); 7439 handle = cpu_to_le16(conn->handle); 7440 7441 hci_dev_unlock(hdev); 7442 7443 /* Refresh RSSI each time */ 7444 err = hci_read_rssi_sync(hdev, handle); 7445 7446 /* For LE links TX power does not change thus we don't need to 7447 * query for it once value is known. 7448 */ 7449 if (!err && (!bdaddr_type_is_le(cp->addr.type) || 7450 conn->tx_power == HCI_TX_POWER_INVALID)) 7451 err = hci_read_tx_power_sync(hdev, handle, 0x00); 7452 7453 /* Max TX power needs to be read only once per connection */ 7454 if (!err && conn->max_tx_power == HCI_TX_POWER_INVALID) 7455 err = hci_read_tx_power_sync(hdev, handle, 0x01); 7456 7457 return err; 7458 } 7459 7460 static int get_conn_info(struct sock *sk, struct hci_dev *hdev, void *data, 7461 u16 len) 7462 { 7463 struct mgmt_cp_get_conn_info *cp = data; 7464 struct mgmt_rp_get_conn_info rp; 7465 struct hci_conn *conn; 7466 unsigned long conn_info_age; 7467 int err = 0; 7468 7469 bt_dev_dbg(hdev, "sock %p", sk); 7470 7471 memset(&rp, 0, sizeof(rp)); 7472 bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr); 7473 rp.addr.type = cp->addr.type; 7474 7475 if (!bdaddr_type_is_valid(cp->addr.type)) 7476 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO, 7477 MGMT_STATUS_INVALID_PARAMS, 7478 &rp, sizeof(rp)); 7479 7480 hci_dev_lock(hdev); 7481 7482 if (!hdev_is_powered(hdev)) { 7483 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO, 7484 MGMT_STATUS_NOT_POWERED, &rp, 7485 sizeof(rp)); 7486 goto unlock; 7487 } 7488 7489 if (cp->addr.type == BDADDR_BREDR) 7490 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, 7491 &cp->addr.bdaddr); 7492 else 7493 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &cp->addr.bdaddr); 7494 7495 if (!conn || conn->state != BT_CONNECTED) { 7496 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO, 7497 MGMT_STATUS_NOT_CONNECTED, &rp, 7498 sizeof(rp)); 7499 goto unlock; 7500 } 7501 7502 /* To avoid client trying to guess when to poll again for information we 7503 * calculate conn info age as random value between min/max set in hdev. 7504 */ 7505 conn_info_age = get_random_u32_inclusive(hdev->conn_info_min_age, 7506 hdev->conn_info_max_age - 1); 7507 7508 /* Query controller to refresh cached values if they are too old or were 7509 * never read. 7510 */ 7511 if (time_after(jiffies, conn->conn_info_timestamp + 7512 msecs_to_jiffies(conn_info_age)) || 7513 !conn->conn_info_timestamp) { 7514 struct mgmt_pending_cmd *cmd; 7515 7516 cmd = mgmt_pending_new(sk, MGMT_OP_GET_CONN_INFO, hdev, data, 7517 len); 7518 if (!cmd) { 7519 err = -ENOMEM; 7520 } else { 7521 err = hci_cmd_sync_queue(hdev, get_conn_info_sync, 7522 cmd, get_conn_info_complete); 7523 } 7524 7525 if (err < 0) { 7526 mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO, 7527 MGMT_STATUS_FAILED, &rp, sizeof(rp)); 7528 7529 if (cmd) 7530 mgmt_pending_free(cmd); 7531 7532 goto unlock; 7533 } 7534 7535 conn->conn_info_timestamp = jiffies; 7536 } else { 7537 /* Cache is valid, just reply with values cached in hci_conn */ 7538 rp.rssi = conn->rssi; 7539 rp.tx_power = conn->tx_power; 7540 rp.max_tx_power = conn->max_tx_power; 7541 7542 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO, 7543 MGMT_STATUS_SUCCESS, &rp, sizeof(rp)); 7544 } 7545 7546 unlock: 7547 hci_dev_unlock(hdev); 7548 return err; 7549 } 7550 7551 static void get_clock_info_complete(struct hci_dev *hdev, void *data, int err) 7552 { 7553 struct mgmt_pending_cmd *cmd = data; 7554 struct mgmt_cp_get_clock_info *cp = cmd->param; 7555 struct mgmt_rp_get_clock_info rp; 7556 struct hci_conn *conn = cmd->user_data; 7557 u8 status = mgmt_status(err); 7558 7559 bt_dev_dbg(hdev, "err %d", err); 7560 7561 memset(&rp, 0, sizeof(rp)); 7562 bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr); 7563 rp.addr.type = cp->addr.type; 7564 7565 if (err) 7566 goto complete; 7567 7568 rp.local_clock = cpu_to_le32(hdev->clock); 7569 7570 if (conn) { 7571 rp.piconet_clock = cpu_to_le32(conn->clock); 7572 rp.accuracy = cpu_to_le16(conn->clock_accuracy); 7573 } 7574 7575 complete: 7576 if (conn) 7577 hci_conn_put(conn); 7578 7579 mgmt_cmd_complete(cmd->sk, cmd->hdev->id, cmd->opcode, status, &rp, 7580 sizeof(rp)); 7581 7582 mgmt_pending_free(cmd); 7583 } 7584 7585 static int get_clock_info_sync(struct hci_dev *hdev, void *data) 7586 { 7587 struct mgmt_pending_cmd *cmd = data; 7588 struct mgmt_cp_get_clock_info *cp = cmd->param; 7589 struct hci_cp_read_clock hci_cp; 7590 struct hci_conn *conn; 7591 7592 memset(&hci_cp, 0, sizeof(hci_cp)); 7593 hci_read_clock_sync(hdev, &hci_cp); 7594 7595 hci_dev_lock(hdev); 7596 7597 /* Make sure connection still exists */ 7598 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->addr.bdaddr); 7599 if (!conn || conn->state != BT_CONNECTED) { 7600 hci_dev_unlock(hdev); 7601 return MGMT_STATUS_NOT_CONNECTED; 7602 } 7603 7604 cmd->user_data = hci_conn_get(conn); 7605 hci_cp.handle = cpu_to_le16(conn->handle); 7606 hci_cp.which = 0x01; /* Piconet clock */ 7607 7608 hci_dev_unlock(hdev); 7609 7610 return hci_read_clock_sync(hdev, &hci_cp); 7611 } 7612 7613 static int get_clock_info(struct sock *sk, struct hci_dev *hdev, void *data, 7614 u16 len) 7615 { 7616 struct mgmt_cp_get_clock_info *cp = data; 7617 struct mgmt_rp_get_clock_info rp; 7618 struct mgmt_pending_cmd *cmd; 7619 struct hci_conn *conn; 7620 int err; 7621 7622 bt_dev_dbg(hdev, "sock %p", sk); 7623 7624 memset(&rp, 0, sizeof(rp)); 7625 bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr); 7626 rp.addr.type = cp->addr.type; 7627 7628 if (cp->addr.type != BDADDR_BREDR) 7629 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CLOCK_INFO, 7630 MGMT_STATUS_INVALID_PARAMS, 7631 &rp, sizeof(rp)); 7632 7633 hci_dev_lock(hdev); 7634 7635 if (!hdev_is_powered(hdev)) { 7636 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CLOCK_INFO, 7637 MGMT_STATUS_NOT_POWERED, &rp, 7638 sizeof(rp)); 7639 goto unlock; 7640 } 7641 7642 if (bacmp(&cp->addr.bdaddr, BDADDR_ANY)) { 7643 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, 7644 &cp->addr.bdaddr); 7645 if (!conn || conn->state != BT_CONNECTED) { 7646 err = mgmt_cmd_complete(sk, hdev->id, 7647 MGMT_OP_GET_CLOCK_INFO, 7648 MGMT_STATUS_NOT_CONNECTED, 7649 &rp, sizeof(rp)); 7650 goto unlock; 7651 } 7652 } else { 7653 conn = NULL; 7654 } 7655 7656 cmd = mgmt_pending_new(sk, MGMT_OP_GET_CLOCK_INFO, hdev, data, len); 7657 if (!cmd) 7658 err = -ENOMEM; 7659 else 7660 err = hci_cmd_sync_queue(hdev, get_clock_info_sync, cmd, 7661 get_clock_info_complete); 7662 7663 if (err < 0) { 7664 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CLOCK_INFO, 7665 MGMT_STATUS_FAILED, &rp, sizeof(rp)); 7666 7667 if (cmd) 7668 mgmt_pending_free(cmd); 7669 } 7670 7671 7672 unlock: 7673 hci_dev_unlock(hdev); 7674 return err; 7675 } 7676 7677 static void device_added(struct sock *sk, struct hci_dev *hdev, 7678 bdaddr_t *bdaddr, u8 type, u8 action) 7679 { 7680 struct mgmt_ev_device_added ev; 7681 7682 bacpy(&ev.addr.bdaddr, bdaddr); 7683 ev.addr.type = type; 7684 ev.action = action; 7685 7686 mgmt_event(MGMT_EV_DEVICE_ADDED, hdev, &ev, sizeof(ev), sk); 7687 } 7688 7689 static void add_device_complete(struct hci_dev *hdev, void *data, int err) 7690 { 7691 struct mgmt_pending_cmd *cmd = data; 7692 struct mgmt_cp_add_device *cp = cmd->param; 7693 7694 if (!err) { 7695 struct hci_conn_params *params; 7696 7697 hci_dev_lock(hdev); 7698 7699 params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr, 7700 le_addr_type(cp->addr.type)); 7701 7702 device_added(cmd->sk, hdev, &cp->addr.bdaddr, cp->addr.type, 7703 cp->action); 7704 device_flags_changed(NULL, hdev, &cp->addr.bdaddr, 7705 cp->addr.type, hdev->conn_flags, 7706 params ? params->flags : 0); 7707 hci_dev_unlock(hdev); 7708 } 7709 7710 mgmt_cmd_complete(cmd->sk, hdev->id, MGMT_OP_ADD_DEVICE, 7711 mgmt_status(err), &cp->addr, sizeof(cp->addr)); 7712 mgmt_pending_free(cmd); 7713 } 7714 7715 static int add_device_sync(struct hci_dev *hdev, void *data) 7716 { 7717 return hci_update_passive_scan_sync(hdev); 7718 } 7719 7720 static int add_device(struct sock *sk, struct hci_dev *hdev, 7721 void *data, u16 len) 7722 { 7723 struct mgmt_pending_cmd *cmd; 7724 struct mgmt_cp_add_device *cp = data; 7725 u8 auto_conn, addr_type; 7726 struct hci_conn_params *params; 7727 int err; 7728 u32 current_flags = 0; 7729 u32 supported_flags; 7730 7731 bt_dev_dbg(hdev, "sock %p", sk); 7732 7733 if (!bdaddr_type_is_valid(cp->addr.type) || 7734 !bacmp(&cp->addr.bdaddr, BDADDR_ANY)) 7735 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE, 7736 MGMT_STATUS_INVALID_PARAMS, 7737 &cp->addr, sizeof(cp->addr)); 7738 7739 if (cp->action != 0x00 && cp->action != 0x01 && cp->action != 0x02) 7740 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE, 7741 MGMT_STATUS_INVALID_PARAMS, 7742 &cp->addr, sizeof(cp->addr)); 7743 7744 hci_dev_lock(hdev); 7745 7746 if (cp->addr.type == BDADDR_BREDR) { 7747 /* Only incoming connections action is supported for now */ 7748 if (cp->action != 0x01) { 7749 err = mgmt_cmd_complete(sk, hdev->id, 7750 MGMT_OP_ADD_DEVICE, 7751 MGMT_STATUS_INVALID_PARAMS, 7752 &cp->addr, sizeof(cp->addr)); 7753 goto unlock; 7754 } 7755 7756 err = hci_bdaddr_list_add_with_flags(&hdev->accept_list, 7757 &cp->addr.bdaddr, 7758 cp->addr.type, 0); 7759 if (err) 7760 goto unlock; 7761 7762 hci_update_scan(hdev); 7763 7764 goto added; 7765 } 7766 7767 addr_type = le_addr_type(cp->addr.type); 7768 7769 if (cp->action == 0x02) 7770 auto_conn = HCI_AUTO_CONN_ALWAYS; 7771 else if (cp->action == 0x01) 7772 auto_conn = HCI_AUTO_CONN_DIRECT; 7773 else 7774 auto_conn = HCI_AUTO_CONN_REPORT; 7775 7776 /* Kernel internally uses conn_params with resolvable private 7777 * address, but Add Device allows only identity addresses. 7778 * Make sure it is enforced before calling 7779 * hci_conn_params_lookup. 7780 */ 7781 if (!hci_is_identity_address(&cp->addr.bdaddr, addr_type)) { 7782 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE, 7783 MGMT_STATUS_INVALID_PARAMS, 7784 &cp->addr, sizeof(cp->addr)); 7785 goto unlock; 7786 } 7787 7788 /* If the connection parameters don't exist for this device, 7789 * they will be created and configured with defaults. 7790 */ 7791 params = hci_conn_params_set(hdev, &cp->addr.bdaddr, addr_type, 7792 auto_conn); 7793 if (!params) { 7794 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE, 7795 MGMT_STATUS_FAILED, &cp->addr, 7796 sizeof(cp->addr)); 7797 goto unlock; 7798 } 7799 7800 cmd = mgmt_pending_new(sk, MGMT_OP_ADD_DEVICE, hdev, data, len); 7801 if (!cmd) { 7802 err = -ENOMEM; 7803 goto unlock; 7804 } 7805 7806 err = hci_cmd_sync_queue(hdev, add_device_sync, cmd, 7807 add_device_complete); 7808 if (err < 0) { 7809 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE, 7810 MGMT_STATUS_FAILED, &cp->addr, 7811 sizeof(cp->addr)); 7812 mgmt_pending_free(cmd); 7813 } 7814 7815 goto unlock; 7816 7817 added: 7818 device_added(sk, hdev, &cp->addr.bdaddr, cp->addr.type, cp->action); 7819 supported_flags = hdev->conn_flags; 7820 device_flags_changed(NULL, hdev, &cp->addr.bdaddr, cp->addr.type, 7821 supported_flags, current_flags); 7822 7823 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE, 7824 MGMT_STATUS_SUCCESS, &cp->addr, 7825 sizeof(cp->addr)); 7826 7827 unlock: 7828 hci_dev_unlock(hdev); 7829 return err; 7830 } 7831 7832 static void device_removed(struct sock *sk, struct hci_dev *hdev, 7833 bdaddr_t *bdaddr, u8 type) 7834 { 7835 struct mgmt_ev_device_removed ev; 7836 7837 bacpy(&ev.addr.bdaddr, bdaddr); 7838 ev.addr.type = type; 7839 7840 mgmt_event(MGMT_EV_DEVICE_REMOVED, hdev, &ev, sizeof(ev), sk); 7841 } 7842 7843 static int remove_device_sync(struct hci_dev *hdev, void *data) 7844 { 7845 return hci_update_passive_scan_sync(hdev); 7846 } 7847 7848 static int remove_device(struct sock *sk, struct hci_dev *hdev, 7849 void *data, u16 len) 7850 { 7851 struct mgmt_cp_remove_device *cp = data; 7852 int err; 7853 7854 bt_dev_dbg(hdev, "sock %p", sk); 7855 7856 hci_dev_lock(hdev); 7857 7858 if (bacmp(&cp->addr.bdaddr, BDADDR_ANY)) { 7859 struct hci_conn_params *params; 7860 u8 addr_type; 7861 7862 if (!bdaddr_type_is_valid(cp->addr.type)) { 7863 err = mgmt_cmd_complete(sk, hdev->id, 7864 MGMT_OP_REMOVE_DEVICE, 7865 MGMT_STATUS_INVALID_PARAMS, 7866 &cp->addr, sizeof(cp->addr)); 7867 goto unlock; 7868 } 7869 7870 if (cp->addr.type == BDADDR_BREDR) { 7871 err = hci_bdaddr_list_del(&hdev->accept_list, 7872 &cp->addr.bdaddr, 7873 cp->addr.type); 7874 if (err) { 7875 err = mgmt_cmd_complete(sk, hdev->id, 7876 MGMT_OP_REMOVE_DEVICE, 7877 MGMT_STATUS_INVALID_PARAMS, 7878 &cp->addr, 7879 sizeof(cp->addr)); 7880 goto unlock; 7881 } 7882 7883 hci_update_scan(hdev); 7884 7885 device_removed(sk, hdev, &cp->addr.bdaddr, 7886 cp->addr.type); 7887 goto complete; 7888 } 7889 7890 addr_type = le_addr_type(cp->addr.type); 7891 7892 /* Kernel internally uses conn_params with resolvable private 7893 * address, but Remove Device allows only identity addresses. 7894 * Make sure it is enforced before calling 7895 * hci_conn_params_lookup. 7896 */ 7897 if (!hci_is_identity_address(&cp->addr.bdaddr, addr_type)) { 7898 err = mgmt_cmd_complete(sk, hdev->id, 7899 MGMT_OP_REMOVE_DEVICE, 7900 MGMT_STATUS_INVALID_PARAMS, 7901 &cp->addr, sizeof(cp->addr)); 7902 goto unlock; 7903 } 7904 7905 params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr, 7906 addr_type); 7907 if (!params) { 7908 err = mgmt_cmd_complete(sk, hdev->id, 7909 MGMT_OP_REMOVE_DEVICE, 7910 MGMT_STATUS_INVALID_PARAMS, 7911 &cp->addr, sizeof(cp->addr)); 7912 goto unlock; 7913 } 7914 7915 if (params->auto_connect == HCI_AUTO_CONN_DISABLED || 7916 params->auto_connect == HCI_AUTO_CONN_EXPLICIT) { 7917 err = mgmt_cmd_complete(sk, hdev->id, 7918 MGMT_OP_REMOVE_DEVICE, 7919 MGMT_STATUS_INVALID_PARAMS, 7920 &cp->addr, sizeof(cp->addr)); 7921 goto unlock; 7922 } 7923 7924 hci_conn_params_free(params); 7925 7926 device_removed(sk, hdev, &cp->addr.bdaddr, cp->addr.type); 7927 } else { 7928 struct hci_conn_params *p, *tmp; 7929 struct bdaddr_list *b, *btmp; 7930 7931 if (cp->addr.type) { 7932 err = mgmt_cmd_complete(sk, hdev->id, 7933 MGMT_OP_REMOVE_DEVICE, 7934 MGMT_STATUS_INVALID_PARAMS, 7935 &cp->addr, sizeof(cp->addr)); 7936 goto unlock; 7937 } 7938 7939 list_for_each_entry_safe(b, btmp, &hdev->accept_list, list) { 7940 device_removed(sk, hdev, &b->bdaddr, b->bdaddr_type); 7941 list_del(&b->list); 7942 kfree(b); 7943 } 7944 7945 hci_update_scan(hdev); 7946 7947 list_for_each_entry_safe(p, tmp, &hdev->le_conn_params, list) { 7948 if (p->auto_connect == HCI_AUTO_CONN_DISABLED) 7949 continue; 7950 device_removed(sk, hdev, &p->addr, p->addr_type); 7951 if (p->explicit_connect) { 7952 p->auto_connect = HCI_AUTO_CONN_EXPLICIT; 7953 continue; 7954 } 7955 hci_conn_params_free(p); 7956 } 7957 7958 bt_dev_dbg(hdev, "All LE connection parameters were removed"); 7959 } 7960 7961 hci_cmd_sync_queue(hdev, remove_device_sync, NULL, NULL); 7962 7963 complete: 7964 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_DEVICE, 7965 MGMT_STATUS_SUCCESS, &cp->addr, 7966 sizeof(cp->addr)); 7967 unlock: 7968 hci_dev_unlock(hdev); 7969 return err; 7970 } 7971 7972 static int conn_update_sync(struct hci_dev *hdev, void *data) 7973 { 7974 struct hci_conn *conn = data; 7975 struct hci_conn_params *params; 7976 struct hci_conn_params local = {}; 7977 7978 hci_dev_lock(hdev); 7979 7980 if (!hci_conn_valid(hdev, conn) || conn->role != HCI_ROLE_MASTER) 7981 goto cancel; 7982 7983 params = hci_conn_params_lookup(hdev, &conn->dst, conn->dst_type); 7984 if (!params) 7985 goto cancel; 7986 7987 local.conn_min_interval = params->conn_min_interval; 7988 local.conn_max_interval = params->conn_max_interval; 7989 local.conn_latency = params->conn_latency; 7990 local.supervision_timeout = params->supervision_timeout; 7991 7992 hci_dev_unlock(hdev); 7993 7994 return hci_le_conn_update_sync(hdev, conn, &local); 7995 7996 cancel: 7997 hci_dev_unlock(hdev); 7998 return -ECANCELED; 7999 } 8000 8001 static void conn_update_sync_destroy(struct hci_dev *hdev, void *data, int err) 8002 { 8003 hci_conn_put(data); 8004 } 8005 8006 static int load_conn_param(struct sock *sk, struct hci_dev *hdev, void *data, 8007 u16 len) 8008 { 8009 struct mgmt_cp_load_conn_param *cp = data; 8010 const u16 max_param_count = ((U16_MAX - sizeof(*cp)) / 8011 sizeof(struct mgmt_conn_param)); 8012 u16 param_count, expected_len; 8013 int i; 8014 8015 if (!lmp_le_capable(hdev)) 8016 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM, 8017 MGMT_STATUS_NOT_SUPPORTED); 8018 8019 param_count = __le16_to_cpu(cp->param_count); 8020 if (param_count > max_param_count) { 8021 bt_dev_err(hdev, "load_conn_param: too big param_count value %u", 8022 param_count); 8023 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM, 8024 MGMT_STATUS_INVALID_PARAMS); 8025 } 8026 8027 expected_len = struct_size(cp, params, param_count); 8028 if (expected_len != len) { 8029 bt_dev_err(hdev, "load_conn_param: expected %u bytes, got %u bytes", 8030 expected_len, len); 8031 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM, 8032 MGMT_STATUS_INVALID_PARAMS); 8033 } 8034 8035 bt_dev_dbg(hdev, "param_count %u", param_count); 8036 8037 hci_dev_lock(hdev); 8038 8039 if (param_count > 1) 8040 hci_conn_params_clear_disabled(hdev); 8041 8042 for (i = 0; i < param_count; i++) { 8043 struct mgmt_conn_param *param = &cp->params[i]; 8044 struct hci_conn_params *hci_param; 8045 u16 min, max, latency, timeout; 8046 bool update = false; 8047 u8 addr_type; 8048 8049 bt_dev_dbg(hdev, "Adding %pMR (type %u)", ¶m->addr.bdaddr, 8050 param->addr.type); 8051 8052 if (param->addr.type == BDADDR_LE_PUBLIC) { 8053 addr_type = ADDR_LE_DEV_PUBLIC; 8054 } else if (param->addr.type == BDADDR_LE_RANDOM) { 8055 addr_type = ADDR_LE_DEV_RANDOM; 8056 } else { 8057 bt_dev_err(hdev, "ignoring invalid connection parameters"); 8058 continue; 8059 } 8060 8061 min = le16_to_cpu(param->min_interval); 8062 max = le16_to_cpu(param->max_interval); 8063 latency = le16_to_cpu(param->latency); 8064 timeout = le16_to_cpu(param->timeout); 8065 8066 bt_dev_dbg(hdev, "min 0x%04x max 0x%04x latency 0x%04x timeout 0x%04x", 8067 min, max, latency, timeout); 8068 8069 if (hci_check_conn_params(min, max, latency, timeout) < 0) { 8070 bt_dev_err(hdev, "ignoring invalid connection parameters"); 8071 continue; 8072 } 8073 8074 /* Detect when the loading is for an existing parameter then 8075 * attempt to trigger the connection update procedure. 8076 */ 8077 if (!i && param_count == 1) { 8078 hci_param = hci_conn_params_lookup(hdev, 8079 ¶m->addr.bdaddr, 8080 addr_type); 8081 if (hci_param) 8082 update = true; 8083 else 8084 hci_conn_params_clear_disabled(hdev); 8085 } 8086 8087 hci_param = hci_conn_params_add(hdev, ¶m->addr.bdaddr, 8088 addr_type); 8089 if (!hci_param) { 8090 bt_dev_err(hdev, "failed to add connection parameters"); 8091 continue; 8092 } 8093 8094 hci_param->conn_min_interval = min; 8095 hci_param->conn_max_interval = max; 8096 hci_param->conn_latency = latency; 8097 hci_param->supervision_timeout = timeout; 8098 8099 /* Check if we need to trigger a connection update */ 8100 if (update) { 8101 struct hci_conn *conn; 8102 8103 /* Lookup for existing connection as central and check 8104 * if parameters match and if they don't then trigger 8105 * a connection update. 8106 */ 8107 conn = hci_conn_hash_lookup_le(hdev, &hci_param->addr, 8108 addr_type); 8109 if (conn && conn->role == HCI_ROLE_MASTER && 8110 (conn->le_conn_min_interval != min || 8111 conn->le_conn_max_interval != max || 8112 conn->le_conn_latency != latency || 8113 conn->le_supv_timeout != timeout)) { 8114 hci_conn_get(conn); 8115 if (hci_cmd_sync_queue(hdev, conn_update_sync, 8116 conn, 8117 conn_update_sync_destroy) < 0) 8118 hci_conn_put(conn); 8119 } 8120 } 8121 } 8122 8123 hci_dev_unlock(hdev); 8124 8125 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM, 0, 8126 NULL, 0); 8127 } 8128 8129 static int set_external_config(struct sock *sk, struct hci_dev *hdev, 8130 void *data, u16 len) 8131 { 8132 struct mgmt_cp_set_external_config *cp = data; 8133 bool changed; 8134 int err; 8135 8136 bt_dev_dbg(hdev, "sock %p", sk); 8137 8138 if (hdev_is_powered(hdev)) 8139 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_EXTERNAL_CONFIG, 8140 MGMT_STATUS_REJECTED); 8141 8142 if (cp->config != 0x00 && cp->config != 0x01) 8143 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_EXTERNAL_CONFIG, 8144 MGMT_STATUS_INVALID_PARAMS); 8145 8146 if (!hci_test_quirk(hdev, HCI_QUIRK_EXTERNAL_CONFIG)) 8147 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_EXTERNAL_CONFIG, 8148 MGMT_STATUS_NOT_SUPPORTED); 8149 8150 hci_dev_lock(hdev); 8151 8152 if (cp->config) 8153 changed = !hci_dev_test_and_set_flag(hdev, HCI_EXT_CONFIGURED); 8154 else 8155 changed = hci_dev_test_and_clear_flag(hdev, HCI_EXT_CONFIGURED); 8156 8157 err = send_options_rsp(sk, MGMT_OP_SET_EXTERNAL_CONFIG, hdev); 8158 if (err < 0) 8159 goto unlock; 8160 8161 if (!changed) 8162 goto unlock; 8163 8164 err = new_options(hdev, sk); 8165 8166 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED) == is_configured(hdev)) { 8167 mgmt_index_removed(hdev); 8168 8169 if (hci_dev_test_and_change_flag(hdev, HCI_UNCONFIGURED)) { 8170 hci_dev_set_flag(hdev, HCI_CONFIG); 8171 hci_dev_set_flag(hdev, HCI_AUTO_OFF); 8172 8173 queue_work(hdev->req_workqueue, &hdev->power_on); 8174 } else { 8175 set_bit(HCI_RAW, &hdev->flags); 8176 mgmt_index_added(hdev); 8177 } 8178 } 8179 8180 unlock: 8181 hci_dev_unlock(hdev); 8182 return err; 8183 } 8184 8185 static int set_public_address(struct sock *sk, struct hci_dev *hdev, 8186 void *data, u16 len) 8187 { 8188 struct mgmt_cp_set_public_address *cp = data; 8189 bool changed; 8190 int err; 8191 8192 bt_dev_dbg(hdev, "sock %p", sk); 8193 8194 if (hdev_is_powered(hdev)) 8195 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PUBLIC_ADDRESS, 8196 MGMT_STATUS_REJECTED); 8197 8198 if (!bacmp(&cp->bdaddr, BDADDR_ANY)) 8199 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PUBLIC_ADDRESS, 8200 MGMT_STATUS_INVALID_PARAMS); 8201 8202 if (!hdev->set_bdaddr) 8203 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PUBLIC_ADDRESS, 8204 MGMT_STATUS_NOT_SUPPORTED); 8205 8206 hci_dev_lock(hdev); 8207 8208 changed = !!bacmp(&hdev->public_addr, &cp->bdaddr); 8209 bacpy(&hdev->public_addr, &cp->bdaddr); 8210 8211 err = send_options_rsp(sk, MGMT_OP_SET_PUBLIC_ADDRESS, hdev); 8212 if (err < 0) 8213 goto unlock; 8214 8215 if (!changed) 8216 goto unlock; 8217 8218 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) 8219 err = new_options(hdev, sk); 8220 8221 if (is_configured(hdev)) { 8222 mgmt_index_removed(hdev); 8223 8224 hci_dev_clear_flag(hdev, HCI_UNCONFIGURED); 8225 8226 hci_dev_set_flag(hdev, HCI_CONFIG); 8227 hci_dev_set_flag(hdev, HCI_AUTO_OFF); 8228 8229 queue_work(hdev->req_workqueue, &hdev->power_on); 8230 } 8231 8232 unlock: 8233 hci_dev_unlock(hdev); 8234 return err; 8235 } 8236 8237 static void read_local_oob_ext_data_complete(struct hci_dev *hdev, void *data, 8238 int err) 8239 { 8240 const struct mgmt_cp_read_local_oob_ext_data *mgmt_cp; 8241 struct mgmt_rp_read_local_oob_ext_data *mgmt_rp; 8242 u8 *h192, *r192, *h256, *r256; 8243 struct mgmt_pending_cmd *cmd = data; 8244 struct sk_buff *skb = cmd->skb; 8245 u8 status = mgmt_status(err); 8246 u16 eir_len; 8247 8248 if (!status) { 8249 if (!skb) 8250 status = MGMT_STATUS_FAILED; 8251 else if (IS_ERR(skb)) 8252 status = mgmt_status(PTR_ERR(skb)); 8253 else 8254 status = mgmt_status(skb->data[0]); 8255 } 8256 8257 bt_dev_dbg(hdev, "status %u", status); 8258 8259 mgmt_cp = cmd->param; 8260 8261 if (status) { 8262 status = mgmt_status(status); 8263 eir_len = 0; 8264 8265 h192 = NULL; 8266 r192 = NULL; 8267 h256 = NULL; 8268 r256 = NULL; 8269 } else if (!bredr_sc_enabled(hdev)) { 8270 struct hci_rp_read_local_oob_data *rp; 8271 8272 if (skb->len != sizeof(*rp)) { 8273 status = MGMT_STATUS_FAILED; 8274 eir_len = 0; 8275 } else { 8276 status = MGMT_STATUS_SUCCESS; 8277 rp = (void *)skb->data; 8278 8279 eir_len = 5 + 18 + 18; 8280 h192 = rp->hash; 8281 r192 = rp->rand; 8282 h256 = NULL; 8283 r256 = NULL; 8284 } 8285 } else { 8286 struct hci_rp_read_local_oob_ext_data *rp; 8287 8288 if (skb->len != sizeof(*rp)) { 8289 status = MGMT_STATUS_FAILED; 8290 eir_len = 0; 8291 } else { 8292 status = MGMT_STATUS_SUCCESS; 8293 rp = (void *)skb->data; 8294 8295 if (hci_dev_test_flag(hdev, HCI_SC_ONLY)) { 8296 eir_len = 5 + 18 + 18; 8297 h192 = NULL; 8298 r192 = NULL; 8299 } else { 8300 eir_len = 5 + 18 + 18 + 18 + 18; 8301 h192 = rp->hash192; 8302 r192 = rp->rand192; 8303 } 8304 8305 h256 = rp->hash256; 8306 r256 = rp->rand256; 8307 } 8308 } 8309 8310 mgmt_rp = kmalloc(sizeof(*mgmt_rp) + eir_len, GFP_KERNEL); 8311 if (!mgmt_rp) 8312 goto done; 8313 8314 if (eir_len == 0) 8315 goto send_rsp; 8316 8317 eir_len = eir_append_data(mgmt_rp->eir, 0, EIR_CLASS_OF_DEV, 8318 hdev->dev_class, 3); 8319 8320 if (h192 && r192) { 8321 eir_len = eir_append_data(mgmt_rp->eir, eir_len, 8322 EIR_SSP_HASH_C192, h192, 16); 8323 eir_len = eir_append_data(mgmt_rp->eir, eir_len, 8324 EIR_SSP_RAND_R192, r192, 16); 8325 } 8326 8327 if (h256 && r256) { 8328 eir_len = eir_append_data(mgmt_rp->eir, eir_len, 8329 EIR_SSP_HASH_C256, h256, 16); 8330 eir_len = eir_append_data(mgmt_rp->eir, eir_len, 8331 EIR_SSP_RAND_R256, r256, 16); 8332 } 8333 8334 send_rsp: 8335 mgmt_rp->type = mgmt_cp->type; 8336 mgmt_rp->eir_len = cpu_to_le16(eir_len); 8337 8338 err = mgmt_cmd_complete(cmd->sk, hdev->id, 8339 MGMT_OP_READ_LOCAL_OOB_EXT_DATA, status, 8340 mgmt_rp, sizeof(*mgmt_rp) + eir_len); 8341 if (err < 0 || status) 8342 goto done; 8343 8344 hci_sock_set_flag(cmd->sk, HCI_MGMT_OOB_DATA_EVENTS); 8345 8346 err = mgmt_limited_event(MGMT_EV_LOCAL_OOB_DATA_UPDATED, hdev, 8347 mgmt_rp, sizeof(*mgmt_rp) + eir_len, 8348 HCI_MGMT_OOB_DATA_EVENTS, cmd->sk); 8349 done: 8350 if (skb && !IS_ERR(skb)) 8351 kfree_skb(skb); 8352 8353 kfree(mgmt_rp); 8354 mgmt_pending_free(cmd); 8355 } 8356 8357 static int read_local_ssp_oob_req(struct hci_dev *hdev, struct sock *sk, 8358 struct mgmt_cp_read_local_oob_ext_data *cp) 8359 { 8360 struct mgmt_pending_cmd *cmd; 8361 int err; 8362 8363 cmd = mgmt_pending_new(sk, MGMT_OP_READ_LOCAL_OOB_EXT_DATA, hdev, 8364 cp, sizeof(*cp)); 8365 if (!cmd) 8366 return -ENOMEM; 8367 8368 err = hci_cmd_sync_queue(hdev, read_local_oob_data_sync, cmd, 8369 read_local_oob_ext_data_complete); 8370 8371 if (err < 0) { 8372 mgmt_pending_remove(cmd); 8373 return err; 8374 } 8375 8376 return 0; 8377 } 8378 8379 static int read_local_oob_ext_data(struct sock *sk, struct hci_dev *hdev, 8380 void *data, u16 data_len) 8381 { 8382 struct mgmt_cp_read_local_oob_ext_data *cp = data; 8383 struct mgmt_rp_read_local_oob_ext_data *rp; 8384 size_t rp_len; 8385 u16 eir_len; 8386 u8 status, flags, role, addr[7], hash[16], rand[16]; 8387 int err; 8388 8389 bt_dev_dbg(hdev, "sock %p", sk); 8390 8391 if (hdev_is_powered(hdev)) { 8392 switch (cp->type) { 8393 case BIT(BDADDR_BREDR): 8394 status = mgmt_bredr_support(hdev); 8395 if (status) 8396 eir_len = 0; 8397 else 8398 eir_len = 5; 8399 break; 8400 case (BIT(BDADDR_LE_PUBLIC) | BIT(BDADDR_LE_RANDOM)): 8401 status = mgmt_le_support(hdev); 8402 if (status) 8403 eir_len = 0; 8404 else 8405 eir_len = 9 + 3 + 18 + 18 + 3; 8406 break; 8407 default: 8408 status = MGMT_STATUS_INVALID_PARAMS; 8409 eir_len = 0; 8410 break; 8411 } 8412 } else { 8413 status = MGMT_STATUS_NOT_POWERED; 8414 eir_len = 0; 8415 } 8416 8417 rp_len = sizeof(*rp) + eir_len; 8418 rp = kmalloc(rp_len, GFP_ATOMIC); 8419 if (!rp) 8420 return -ENOMEM; 8421 8422 if (!status && !lmp_ssp_capable(hdev)) { 8423 status = MGMT_STATUS_NOT_SUPPORTED; 8424 eir_len = 0; 8425 } 8426 8427 if (status) 8428 goto complete; 8429 8430 hci_dev_lock(hdev); 8431 8432 eir_len = 0; 8433 switch (cp->type) { 8434 case BIT(BDADDR_BREDR): 8435 if (hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) { 8436 err = read_local_ssp_oob_req(hdev, sk, cp); 8437 hci_dev_unlock(hdev); 8438 if (!err) 8439 goto done; 8440 8441 status = MGMT_STATUS_FAILED; 8442 goto complete; 8443 } else { 8444 eir_len = eir_append_data(rp->eir, eir_len, 8445 EIR_CLASS_OF_DEV, 8446 hdev->dev_class, 3); 8447 } 8448 break; 8449 case (BIT(BDADDR_LE_PUBLIC) | BIT(BDADDR_LE_RANDOM)): 8450 if (hci_dev_test_flag(hdev, HCI_SC_ENABLED) && 8451 smp_generate_oob(hdev, hash, rand) < 0) { 8452 hci_dev_unlock(hdev); 8453 status = MGMT_STATUS_FAILED; 8454 goto complete; 8455 } 8456 8457 /* This should return the active RPA, but since the RPA 8458 * is only programmed on demand, it is really hard to fill 8459 * this in at the moment. For now disallow retrieving 8460 * local out-of-band data when privacy is in use. 8461 * 8462 * Returning the identity address will not help here since 8463 * pairing happens before the identity resolving key is 8464 * known and thus the connection establishment happens 8465 * based on the RPA and not the identity address. 8466 */ 8467 if (hci_dev_test_flag(hdev, HCI_PRIVACY)) { 8468 hci_dev_unlock(hdev); 8469 status = MGMT_STATUS_REJECTED; 8470 goto complete; 8471 } 8472 8473 if (hci_dev_test_flag(hdev, HCI_FORCE_STATIC_ADDR) || 8474 !bacmp(&hdev->bdaddr, BDADDR_ANY) || 8475 (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) && 8476 bacmp(&hdev->static_addr, BDADDR_ANY))) { 8477 memcpy(addr, &hdev->static_addr, 6); 8478 addr[6] = 0x01; 8479 } else { 8480 memcpy(addr, &hdev->bdaddr, 6); 8481 addr[6] = 0x00; 8482 } 8483 8484 eir_len = eir_append_data(rp->eir, eir_len, EIR_LE_BDADDR, 8485 addr, sizeof(addr)); 8486 8487 if (hci_dev_test_flag(hdev, HCI_ADVERTISING)) 8488 role = 0x02; 8489 else 8490 role = 0x01; 8491 8492 eir_len = eir_append_data(rp->eir, eir_len, EIR_LE_ROLE, 8493 &role, sizeof(role)); 8494 8495 if (hci_dev_test_flag(hdev, HCI_SC_ENABLED)) { 8496 eir_len = eir_append_data(rp->eir, eir_len, 8497 EIR_LE_SC_CONFIRM, 8498 hash, sizeof(hash)); 8499 8500 eir_len = eir_append_data(rp->eir, eir_len, 8501 EIR_LE_SC_RANDOM, 8502 rand, sizeof(rand)); 8503 } 8504 8505 flags = mgmt_get_adv_discov_flags(hdev); 8506 8507 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) 8508 flags |= LE_AD_NO_BREDR; 8509 8510 eir_len = eir_append_data(rp->eir, eir_len, EIR_FLAGS, 8511 &flags, sizeof(flags)); 8512 break; 8513 } 8514 8515 hci_dev_unlock(hdev); 8516 8517 hci_sock_set_flag(sk, HCI_MGMT_OOB_DATA_EVENTS); 8518 8519 status = MGMT_STATUS_SUCCESS; 8520 8521 complete: 8522 rp->type = cp->type; 8523 rp->eir_len = cpu_to_le16(eir_len); 8524 8525 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_EXT_DATA, 8526 status, rp, sizeof(*rp) + eir_len); 8527 if (err < 0 || status) 8528 goto done; 8529 8530 err = mgmt_limited_event(MGMT_EV_LOCAL_OOB_DATA_UPDATED, hdev, 8531 rp, sizeof(*rp) + eir_len, 8532 HCI_MGMT_OOB_DATA_EVENTS, sk); 8533 8534 done: 8535 kfree(rp); 8536 8537 return err; 8538 } 8539 8540 static u32 get_supported_adv_flags(struct hci_dev *hdev) 8541 { 8542 u32 flags = 0; 8543 8544 flags |= MGMT_ADV_FLAG_CONNECTABLE; 8545 flags |= MGMT_ADV_FLAG_DISCOV; 8546 flags |= MGMT_ADV_FLAG_LIMITED_DISCOV; 8547 flags |= MGMT_ADV_FLAG_MANAGED_FLAGS; 8548 flags |= MGMT_ADV_FLAG_APPEARANCE; 8549 flags |= MGMT_ADV_FLAG_LOCAL_NAME; 8550 flags |= MGMT_ADV_PARAM_DURATION; 8551 flags |= MGMT_ADV_PARAM_TIMEOUT; 8552 flags |= MGMT_ADV_PARAM_INTERVALS; 8553 flags |= MGMT_ADV_PARAM_TX_POWER; 8554 flags |= MGMT_ADV_PARAM_SCAN_RSP; 8555 8556 /* In extended adv TX_POWER returned from Set Adv Param 8557 * will be always valid. 8558 */ 8559 if (hdev->adv_tx_power != HCI_TX_POWER_INVALID || ext_adv_capable(hdev)) 8560 flags |= MGMT_ADV_FLAG_TX_POWER; 8561 8562 if (ext_adv_capable(hdev)) { 8563 flags |= MGMT_ADV_FLAG_SEC_1M; 8564 flags |= MGMT_ADV_FLAG_HW_OFFLOAD; 8565 flags |= MGMT_ADV_FLAG_CAN_SET_TX_POWER; 8566 8567 if (le_2m_capable(hdev)) 8568 flags |= MGMT_ADV_FLAG_SEC_2M; 8569 8570 if (le_coded_capable(hdev)) 8571 flags |= MGMT_ADV_FLAG_SEC_CODED; 8572 } 8573 8574 return flags; 8575 } 8576 8577 static int read_adv_features(struct sock *sk, struct hci_dev *hdev, 8578 void *data, u16 data_len) 8579 { 8580 struct mgmt_rp_read_adv_features *rp; 8581 size_t rp_len; 8582 int err; 8583 struct adv_info *adv_instance; 8584 u32 supported_flags; 8585 u8 *instance; 8586 8587 bt_dev_dbg(hdev, "sock %p", sk); 8588 8589 if (!lmp_le_capable(hdev)) 8590 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_ADV_FEATURES, 8591 MGMT_STATUS_REJECTED); 8592 8593 hci_dev_lock(hdev); 8594 8595 rp_len = sizeof(*rp) + hdev->adv_instance_cnt; 8596 rp = kmalloc(rp_len, GFP_ATOMIC); 8597 if (!rp) { 8598 hci_dev_unlock(hdev); 8599 return -ENOMEM; 8600 } 8601 8602 supported_flags = get_supported_adv_flags(hdev); 8603 8604 rp->supported_flags = cpu_to_le32(supported_flags); 8605 rp->max_adv_data_len = max_adv_len(hdev); 8606 rp->max_scan_rsp_len = max_adv_len(hdev); 8607 rp->max_instances = hdev->le_num_of_adv_sets; 8608 rp->num_instances = hdev->adv_instance_cnt; 8609 8610 instance = rp->instance; 8611 list_for_each_entry(adv_instance, &hdev->adv_instances, list) { 8612 /* Only instances 1-le_num_of_adv_sets are externally visible */ 8613 if (adv_instance->instance <= hdev->adv_instance_cnt) { 8614 *instance = adv_instance->instance; 8615 instance++; 8616 } else { 8617 rp->num_instances--; 8618 rp_len--; 8619 } 8620 } 8621 8622 hci_dev_unlock(hdev); 8623 8624 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_ADV_FEATURES, 8625 MGMT_STATUS_SUCCESS, rp, rp_len); 8626 8627 kfree(rp); 8628 8629 return err; 8630 } 8631 8632 static u8 calculate_name_len(struct hci_dev *hdev) 8633 { 8634 u8 buf[HCI_MAX_SHORT_NAME_LENGTH + 2]; /* len + type + name */ 8635 8636 return eir_append_local_name(hdev, buf, 0); 8637 } 8638 8639 static u8 tlv_data_max_len(struct hci_dev *hdev, u32 adv_flags, 8640 bool is_adv_data) 8641 { 8642 u8 max_len = max_adv_len(hdev); 8643 8644 if (is_adv_data) { 8645 if (adv_flags & (MGMT_ADV_FLAG_DISCOV | 8646 MGMT_ADV_FLAG_LIMITED_DISCOV | 8647 MGMT_ADV_FLAG_MANAGED_FLAGS)) 8648 max_len -= 3; 8649 8650 if (adv_flags & MGMT_ADV_FLAG_TX_POWER) 8651 max_len -= 3; 8652 } else { 8653 if (adv_flags & MGMT_ADV_FLAG_LOCAL_NAME) 8654 max_len -= calculate_name_len(hdev); 8655 8656 if (adv_flags & (MGMT_ADV_FLAG_APPEARANCE)) 8657 max_len -= 4; 8658 } 8659 8660 return max_len; 8661 } 8662 8663 static bool flags_managed(u32 adv_flags) 8664 { 8665 return adv_flags & (MGMT_ADV_FLAG_DISCOV | 8666 MGMT_ADV_FLAG_LIMITED_DISCOV | 8667 MGMT_ADV_FLAG_MANAGED_FLAGS); 8668 } 8669 8670 static bool tx_power_managed(u32 adv_flags) 8671 { 8672 return adv_flags & MGMT_ADV_FLAG_TX_POWER; 8673 } 8674 8675 static bool name_managed(u32 adv_flags) 8676 { 8677 return adv_flags & MGMT_ADV_FLAG_LOCAL_NAME; 8678 } 8679 8680 static bool appearance_managed(u32 adv_flags) 8681 { 8682 return adv_flags & MGMT_ADV_FLAG_APPEARANCE; 8683 } 8684 8685 static bool tlv_data_is_valid(struct hci_dev *hdev, u32 adv_flags, u8 *data, 8686 u8 len, bool is_adv_data) 8687 { 8688 int i, cur_len; 8689 u8 max_len; 8690 8691 max_len = tlv_data_max_len(hdev, adv_flags, is_adv_data); 8692 8693 if (len > max_len) 8694 return false; 8695 8696 /* Make sure that the data is correctly formatted. */ 8697 for (i = 0; i < len; i += (cur_len + 1)) { 8698 cur_len = data[i]; 8699 8700 if (!cur_len) 8701 continue; 8702 8703 /* If the current field length would exceed the total data 8704 * length, then it's invalid. 8705 */ 8706 if (i + cur_len >= len) 8707 return false; 8708 8709 if (data[i + 1] == EIR_FLAGS && 8710 (!is_adv_data || flags_managed(adv_flags))) 8711 return false; 8712 8713 if (data[i + 1] == EIR_TX_POWER && tx_power_managed(adv_flags)) 8714 return false; 8715 8716 if (data[i + 1] == EIR_NAME_COMPLETE && name_managed(adv_flags)) 8717 return false; 8718 8719 if (data[i + 1] == EIR_NAME_SHORT && name_managed(adv_flags)) 8720 return false; 8721 8722 if (data[i + 1] == EIR_APPEARANCE && 8723 appearance_managed(adv_flags)) 8724 return false; 8725 } 8726 8727 return true; 8728 } 8729 8730 static bool requested_adv_flags_are_valid(struct hci_dev *hdev, u32 adv_flags) 8731 { 8732 u32 supported_flags, phy_flags; 8733 8734 /* The current implementation only supports a subset of the specified 8735 * flags. Also need to check mutual exclusiveness of sec flags. 8736 */ 8737 supported_flags = get_supported_adv_flags(hdev); 8738 phy_flags = adv_flags & MGMT_ADV_FLAG_SEC_MASK; 8739 if (adv_flags & ~supported_flags || 8740 ((phy_flags && (phy_flags ^ (phy_flags & -phy_flags))))) 8741 return false; 8742 8743 return true; 8744 } 8745 8746 static bool adv_busy(struct hci_dev *hdev) 8747 { 8748 return pending_find(MGMT_OP_SET_LE, hdev); 8749 } 8750 8751 static void add_adv_complete(struct hci_dev *hdev, struct sock *sk, u8 instance, 8752 int err) 8753 { 8754 struct adv_info *adv, *n; 8755 8756 bt_dev_dbg(hdev, "err %d", err); 8757 8758 hci_dev_lock(hdev); 8759 8760 list_for_each_entry_safe(adv, n, &hdev->adv_instances, list) { 8761 u8 instance; 8762 8763 if (!adv->pending) 8764 continue; 8765 8766 if (!err) { 8767 adv->pending = false; 8768 continue; 8769 } 8770 8771 instance = adv->instance; 8772 8773 if (hdev->cur_adv_instance == instance) 8774 cancel_adv_timeout(hdev); 8775 8776 hci_remove_adv_instance(hdev, instance); 8777 mgmt_advertising_removed(sk, hdev, instance); 8778 } 8779 8780 hci_dev_unlock(hdev); 8781 } 8782 8783 static void add_advertising_complete(struct hci_dev *hdev, void *data, int err) 8784 { 8785 struct mgmt_pending_cmd *cmd = data; 8786 struct mgmt_cp_add_advertising *cp = cmd->param; 8787 struct mgmt_rp_add_advertising rp; 8788 8789 memset(&rp, 0, sizeof(rp)); 8790 8791 rp.instance = cp->instance; 8792 8793 if (err) 8794 mgmt_cmd_status(cmd->sk, cmd->hdev->id, cmd->opcode, 8795 mgmt_status(err)); 8796 else 8797 mgmt_cmd_complete(cmd->sk, cmd->hdev->id, cmd->opcode, 8798 mgmt_status(err), &rp, sizeof(rp)); 8799 8800 add_adv_complete(hdev, cmd->sk, cp->instance, err); 8801 8802 mgmt_pending_free(cmd); 8803 } 8804 8805 static int add_advertising_sync(struct hci_dev *hdev, void *data) 8806 { 8807 struct mgmt_pending_cmd *cmd = data; 8808 struct mgmt_cp_add_advertising *cp = cmd->param; 8809 8810 return hci_schedule_adv_instance_sync(hdev, cp->instance, true); 8811 } 8812 8813 static int add_advertising(struct sock *sk, struct hci_dev *hdev, 8814 void *data, u16 data_len) 8815 { 8816 struct mgmt_cp_add_advertising *cp = data; 8817 struct mgmt_rp_add_advertising rp; 8818 u32 flags; 8819 u8 status; 8820 u16 timeout, duration; 8821 unsigned int prev_instance_cnt; 8822 u8 schedule_instance = 0; 8823 struct adv_info *adv, *next_instance; 8824 int err; 8825 struct mgmt_pending_cmd *cmd; 8826 8827 bt_dev_dbg(hdev, "sock %p", sk); 8828 8829 status = mgmt_le_support(hdev); 8830 if (status) 8831 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING, 8832 status); 8833 8834 if (cp->instance < 1 || cp->instance > hdev->le_num_of_adv_sets) 8835 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING, 8836 MGMT_STATUS_INVALID_PARAMS); 8837 8838 if (data_len != sizeof(*cp) + cp->adv_data_len + cp->scan_rsp_len) 8839 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING, 8840 MGMT_STATUS_INVALID_PARAMS); 8841 8842 flags = __le32_to_cpu(cp->flags); 8843 timeout = __le16_to_cpu(cp->timeout); 8844 duration = __le16_to_cpu(cp->duration); 8845 8846 if (!requested_adv_flags_are_valid(hdev, flags)) 8847 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING, 8848 MGMT_STATUS_INVALID_PARAMS); 8849 8850 hci_dev_lock(hdev); 8851 8852 if (timeout && !hdev_is_powered(hdev)) { 8853 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING, 8854 MGMT_STATUS_REJECTED); 8855 goto unlock; 8856 } 8857 8858 if (adv_busy(hdev)) { 8859 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING, 8860 MGMT_STATUS_BUSY); 8861 goto unlock; 8862 } 8863 8864 if (!tlv_data_is_valid(hdev, flags, cp->data, cp->adv_data_len, true) || 8865 !tlv_data_is_valid(hdev, flags, cp->data + cp->adv_data_len, 8866 cp->scan_rsp_len, false)) { 8867 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING, 8868 MGMT_STATUS_INVALID_PARAMS); 8869 goto unlock; 8870 } 8871 8872 prev_instance_cnt = hdev->adv_instance_cnt; 8873 8874 adv = hci_add_adv_instance(hdev, cp->instance, flags, 8875 cp->adv_data_len, cp->data, 8876 cp->scan_rsp_len, 8877 cp->data + cp->adv_data_len, 8878 timeout, duration, 8879 HCI_ADV_TX_POWER_NO_PREFERENCE, 8880 hdev->le_adv_min_interval, 8881 hdev->le_adv_max_interval, 0); 8882 if (IS_ERR(adv)) { 8883 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING, 8884 MGMT_STATUS_FAILED); 8885 goto unlock; 8886 } 8887 8888 /* Only trigger an advertising added event if a new instance was 8889 * actually added. 8890 */ 8891 if (hdev->adv_instance_cnt > prev_instance_cnt) 8892 mgmt_advertising_added(sk, hdev, cp->instance); 8893 8894 if (hdev->cur_adv_instance == cp->instance) { 8895 /* If the currently advertised instance is being changed then 8896 * cancel the current advertising and schedule the next 8897 * instance. If there is only one instance then the overridden 8898 * advertising data will be visible right away. 8899 */ 8900 cancel_adv_timeout(hdev); 8901 8902 next_instance = hci_get_next_instance(hdev, cp->instance); 8903 if (next_instance) 8904 schedule_instance = next_instance->instance; 8905 } else if (!hdev->adv_instance_timeout) { 8906 /* Immediately advertise the new instance if no other 8907 * instance is currently being advertised. 8908 */ 8909 schedule_instance = cp->instance; 8910 } 8911 8912 /* If the HCI_ADVERTISING flag is set or the device isn't powered or 8913 * there is no instance to be advertised then we have no HCI 8914 * communication to make. Simply return. 8915 */ 8916 if (!hdev_is_powered(hdev) || 8917 hci_dev_test_flag(hdev, HCI_ADVERTISING) || 8918 !schedule_instance) { 8919 rp.instance = cp->instance; 8920 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_ADVERTISING, 8921 MGMT_STATUS_SUCCESS, &rp, sizeof(rp)); 8922 goto unlock; 8923 } 8924 8925 /* We're good to go, update advertising data, parameters, and start 8926 * advertising. 8927 */ 8928 cmd = mgmt_pending_new(sk, MGMT_OP_ADD_ADVERTISING, hdev, data, 8929 data_len); 8930 if (!cmd) { 8931 err = -ENOMEM; 8932 goto unlock; 8933 } 8934 8935 cp->instance = schedule_instance; 8936 8937 err = hci_cmd_sync_queue(hdev, add_advertising_sync, cmd, 8938 add_advertising_complete); 8939 if (err < 0) 8940 mgmt_pending_free(cmd); 8941 8942 unlock: 8943 hci_dev_unlock(hdev); 8944 8945 return err; 8946 } 8947 8948 static void add_ext_adv_params_complete(struct hci_dev *hdev, void *data, 8949 int err) 8950 { 8951 struct mgmt_pending_cmd *cmd = data; 8952 struct mgmt_cp_add_ext_adv_params *cp = cmd->param; 8953 struct mgmt_rp_add_ext_adv_params rp; 8954 struct adv_info *adv; 8955 u32 flags; 8956 8957 BT_DBG("%s", hdev->name); 8958 8959 hci_dev_lock(hdev); 8960 8961 adv = hci_find_adv_instance(hdev, cp->instance); 8962 if (!adv) 8963 goto unlock; 8964 8965 rp.instance = cp->instance; 8966 rp.tx_power = adv->tx_power; 8967 8968 /* While we're at it, inform userspace of the available space for this 8969 * advertisement, given the flags that will be used. 8970 */ 8971 flags = __le32_to_cpu(cp->flags); 8972 rp.max_adv_data_len = tlv_data_max_len(hdev, flags, true); 8973 rp.max_scan_rsp_len = tlv_data_max_len(hdev, flags, false); 8974 8975 if (err) { 8976 /* If this advertisement was previously advertising and we 8977 * failed to update it, we signal that it has been removed and 8978 * delete its structure 8979 */ 8980 if (!adv->pending) 8981 mgmt_advertising_removed(cmd->sk, hdev, cp->instance); 8982 8983 hci_remove_adv_instance(hdev, cp->instance); 8984 8985 mgmt_cmd_status(cmd->sk, cmd->hdev->id, cmd->opcode, 8986 mgmt_status(err)); 8987 } else { 8988 mgmt_cmd_complete(cmd->sk, cmd->hdev->id, cmd->opcode, 8989 mgmt_status(err), &rp, sizeof(rp)); 8990 } 8991 8992 unlock: 8993 mgmt_pending_free(cmd); 8994 8995 hci_dev_unlock(hdev); 8996 } 8997 8998 static int add_ext_adv_params_sync(struct hci_dev *hdev, void *data) 8999 { 9000 struct mgmt_pending_cmd *cmd = data; 9001 struct mgmt_cp_add_ext_adv_params *cp = cmd->param; 9002 9003 return hci_setup_ext_adv_instance_sync(hdev, cp->instance); 9004 } 9005 9006 static int add_ext_adv_params(struct sock *sk, struct hci_dev *hdev, 9007 void *data, u16 data_len) 9008 { 9009 struct mgmt_cp_add_ext_adv_params *cp = data; 9010 struct mgmt_rp_add_ext_adv_params rp; 9011 struct mgmt_pending_cmd *cmd = NULL; 9012 struct adv_info *adv; 9013 u32 flags, min_interval, max_interval; 9014 u16 timeout, duration; 9015 u8 status; 9016 s8 tx_power; 9017 int err; 9018 9019 BT_DBG("%s", hdev->name); 9020 9021 status = mgmt_le_support(hdev); 9022 if (status) 9023 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_PARAMS, 9024 status); 9025 9026 if (cp->instance < 1 || cp->instance > hdev->le_num_of_adv_sets) 9027 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_PARAMS, 9028 MGMT_STATUS_INVALID_PARAMS); 9029 9030 /* The purpose of breaking add_advertising into two separate MGMT calls 9031 * for params and data is to allow more parameters to be added to this 9032 * structure in the future. For this reason, we verify that we have the 9033 * bare minimum structure we know of when the interface was defined. Any 9034 * extra parameters we don't know about will be ignored in this request. 9035 */ 9036 if (data_len < MGMT_ADD_EXT_ADV_PARAMS_MIN_SIZE) 9037 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_PARAMS, 9038 MGMT_STATUS_INVALID_PARAMS); 9039 9040 flags = __le32_to_cpu(cp->flags); 9041 9042 if (!requested_adv_flags_are_valid(hdev, flags)) 9043 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_PARAMS, 9044 MGMT_STATUS_INVALID_PARAMS); 9045 9046 hci_dev_lock(hdev); 9047 9048 /* In new interface, we require that we are powered to register */ 9049 if (!hdev_is_powered(hdev)) { 9050 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_PARAMS, 9051 MGMT_STATUS_REJECTED); 9052 goto unlock; 9053 } 9054 9055 if (adv_busy(hdev)) { 9056 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_PARAMS, 9057 MGMT_STATUS_BUSY); 9058 goto unlock; 9059 } 9060 9061 /* Parse defined parameters from request, use defaults otherwise */ 9062 timeout = (flags & MGMT_ADV_PARAM_TIMEOUT) ? 9063 __le16_to_cpu(cp->timeout) : 0; 9064 9065 duration = (flags & MGMT_ADV_PARAM_DURATION) ? 9066 __le16_to_cpu(cp->duration) : 9067 hdev->def_multi_adv_rotation_duration; 9068 9069 min_interval = (flags & MGMT_ADV_PARAM_INTERVALS) ? 9070 __le32_to_cpu(cp->min_interval) : 9071 hdev->le_adv_min_interval; 9072 9073 max_interval = (flags & MGMT_ADV_PARAM_INTERVALS) ? 9074 __le32_to_cpu(cp->max_interval) : 9075 hdev->le_adv_max_interval; 9076 9077 tx_power = (flags & MGMT_ADV_PARAM_TX_POWER) ? 9078 cp->tx_power : 9079 HCI_ADV_TX_POWER_NO_PREFERENCE; 9080 9081 /* Create advertising instance with no advertising or response data */ 9082 adv = hci_add_adv_instance(hdev, cp->instance, flags, 0, NULL, 0, NULL, 9083 timeout, duration, tx_power, min_interval, 9084 max_interval, 0); 9085 9086 if (IS_ERR(adv)) { 9087 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_PARAMS, 9088 MGMT_STATUS_FAILED); 9089 goto unlock; 9090 } 9091 9092 /* Submit request for advertising params if ext adv available */ 9093 if (ext_adv_capable(hdev)) { 9094 cmd = mgmt_pending_new(sk, MGMT_OP_ADD_EXT_ADV_PARAMS, hdev, 9095 data, data_len); 9096 if (!cmd) { 9097 err = -ENOMEM; 9098 hci_remove_adv_instance(hdev, cp->instance); 9099 goto unlock; 9100 } 9101 9102 err = hci_cmd_sync_queue(hdev, add_ext_adv_params_sync, cmd, 9103 add_ext_adv_params_complete); 9104 if (err < 0) 9105 mgmt_pending_free(cmd); 9106 } else { 9107 rp.instance = cp->instance; 9108 rp.tx_power = HCI_ADV_TX_POWER_NO_PREFERENCE; 9109 rp.max_adv_data_len = tlv_data_max_len(hdev, flags, true); 9110 rp.max_scan_rsp_len = tlv_data_max_len(hdev, flags, false); 9111 err = mgmt_cmd_complete(sk, hdev->id, 9112 MGMT_OP_ADD_EXT_ADV_PARAMS, 9113 MGMT_STATUS_SUCCESS, &rp, sizeof(rp)); 9114 } 9115 9116 unlock: 9117 hci_dev_unlock(hdev); 9118 9119 return err; 9120 } 9121 9122 static void add_ext_adv_data_complete(struct hci_dev *hdev, void *data, int err) 9123 { 9124 struct mgmt_pending_cmd *cmd = data; 9125 struct mgmt_cp_add_ext_adv_data *cp = cmd->param; 9126 struct mgmt_rp_add_advertising rp; 9127 9128 add_adv_complete(hdev, cmd->sk, cp->instance, err); 9129 9130 memset(&rp, 0, sizeof(rp)); 9131 9132 rp.instance = cp->instance; 9133 9134 if (err) 9135 mgmt_cmd_status(cmd->sk, cmd->hdev->id, cmd->opcode, 9136 mgmt_status(err)); 9137 else 9138 mgmt_cmd_complete(cmd->sk, cmd->hdev->id, cmd->opcode, 9139 mgmt_status(err), &rp, sizeof(rp)); 9140 9141 mgmt_pending_free(cmd); 9142 } 9143 9144 static int add_ext_adv_data_sync(struct hci_dev *hdev, void *data) 9145 { 9146 struct mgmt_pending_cmd *cmd = data; 9147 struct mgmt_cp_add_ext_adv_data *cp = cmd->param; 9148 int err; 9149 9150 if (ext_adv_capable(hdev)) { 9151 err = hci_update_adv_data_sync(hdev, cp->instance); 9152 if (err) 9153 return err; 9154 9155 err = hci_update_scan_rsp_data_sync(hdev, cp->instance); 9156 if (err) 9157 return err; 9158 9159 return hci_enable_ext_advertising_sync(hdev, cp->instance); 9160 } 9161 9162 return hci_schedule_adv_instance_sync(hdev, cp->instance, true); 9163 } 9164 9165 static int add_ext_adv_data(struct sock *sk, struct hci_dev *hdev, void *data, 9166 u16 data_len) 9167 { 9168 struct mgmt_cp_add_ext_adv_data *cp = data; 9169 struct mgmt_rp_add_ext_adv_data rp; 9170 u8 schedule_instance = 0; 9171 struct adv_info *next_instance; 9172 struct adv_info *adv_instance; 9173 int err = 0; 9174 struct mgmt_pending_cmd *cmd; 9175 u16 expected_len; 9176 9177 BT_DBG("%s", hdev->name); 9178 9179 expected_len = struct_size(cp, data, cp->adv_data_len + 9180 cp->scan_rsp_len); 9181 if (expected_len > data_len) 9182 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_DATA, 9183 MGMT_STATUS_INVALID_PARAMS); 9184 9185 hci_dev_lock(hdev); 9186 9187 adv_instance = hci_find_adv_instance(hdev, cp->instance); 9188 9189 if (!adv_instance) { 9190 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_DATA, 9191 MGMT_STATUS_INVALID_PARAMS); 9192 goto unlock; 9193 } 9194 9195 /* In new interface, we require that we are powered to register */ 9196 if (!hdev_is_powered(hdev)) { 9197 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_DATA, 9198 MGMT_STATUS_REJECTED); 9199 goto clear_new_instance; 9200 } 9201 9202 if (adv_busy(hdev)) { 9203 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_DATA, 9204 MGMT_STATUS_BUSY); 9205 goto clear_new_instance; 9206 } 9207 9208 /* Validate new data */ 9209 if (!tlv_data_is_valid(hdev, adv_instance->flags, cp->data, 9210 cp->adv_data_len, true) || 9211 !tlv_data_is_valid(hdev, adv_instance->flags, cp->data + 9212 cp->adv_data_len, cp->scan_rsp_len, false)) { 9213 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_DATA, 9214 MGMT_STATUS_INVALID_PARAMS); 9215 goto clear_new_instance; 9216 } 9217 9218 /* Set the data in the advertising instance */ 9219 hci_set_adv_instance_data(hdev, cp->instance, cp->adv_data_len, 9220 cp->data, cp->scan_rsp_len, 9221 cp->data + cp->adv_data_len); 9222 9223 /* If using software rotation, determine next instance to use */ 9224 if (hdev->cur_adv_instance == cp->instance) { 9225 /* If the currently advertised instance is being changed 9226 * then cancel the current advertising and schedule the 9227 * next instance. If there is only one instance then the 9228 * overridden advertising data will be visible right 9229 * away 9230 */ 9231 cancel_adv_timeout(hdev); 9232 9233 next_instance = hci_get_next_instance(hdev, cp->instance); 9234 if (next_instance) 9235 schedule_instance = next_instance->instance; 9236 } else if (!hdev->adv_instance_timeout) { 9237 /* Immediately advertise the new instance if no other 9238 * instance is currently being advertised. 9239 */ 9240 schedule_instance = cp->instance; 9241 } 9242 9243 /* If the HCI_ADVERTISING flag is set or there is no instance to 9244 * be advertised then we have no HCI communication to make. 9245 * Simply return. 9246 */ 9247 if (hci_dev_test_flag(hdev, HCI_ADVERTISING) || !schedule_instance) { 9248 if (adv_instance->pending) { 9249 mgmt_advertising_added(sk, hdev, cp->instance); 9250 adv_instance->pending = false; 9251 } 9252 rp.instance = cp->instance; 9253 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_DATA, 9254 MGMT_STATUS_SUCCESS, &rp, sizeof(rp)); 9255 goto unlock; 9256 } 9257 9258 cmd = mgmt_pending_new(sk, MGMT_OP_ADD_EXT_ADV_DATA, hdev, data, 9259 data_len); 9260 if (!cmd) { 9261 err = -ENOMEM; 9262 goto clear_new_instance; 9263 } 9264 9265 err = hci_cmd_sync_queue(hdev, add_ext_adv_data_sync, cmd, 9266 add_ext_adv_data_complete); 9267 if (err < 0) { 9268 mgmt_pending_free(cmd); 9269 goto clear_new_instance; 9270 } 9271 9272 /* We were successful in updating data, so trigger advertising_added 9273 * event if this is an instance that wasn't previously advertising. If 9274 * a failure occurs in the requests we initiated, we will remove the 9275 * instance again in add_advertising_complete 9276 */ 9277 if (adv_instance->pending) 9278 mgmt_advertising_added(sk, hdev, cp->instance); 9279 9280 goto unlock; 9281 9282 clear_new_instance: 9283 hci_remove_adv_instance(hdev, cp->instance); 9284 9285 unlock: 9286 hci_dev_unlock(hdev); 9287 9288 return err; 9289 } 9290 9291 static void remove_advertising_complete(struct hci_dev *hdev, void *data, 9292 int err) 9293 { 9294 struct mgmt_pending_cmd *cmd = data; 9295 struct mgmt_cp_remove_advertising *cp = cmd->param; 9296 struct mgmt_rp_remove_advertising rp; 9297 9298 bt_dev_dbg(hdev, "err %d", err); 9299 9300 memset(&rp, 0, sizeof(rp)); 9301 rp.instance = cp->instance; 9302 9303 if (err) 9304 mgmt_cmd_status(cmd->sk, cmd->hdev->id, cmd->opcode, 9305 mgmt_status(err)); 9306 else 9307 mgmt_cmd_complete(cmd->sk, cmd->hdev->id, cmd->opcode, 9308 MGMT_STATUS_SUCCESS, &rp, sizeof(rp)); 9309 9310 mgmt_pending_free(cmd); 9311 } 9312 9313 static int remove_advertising_sync(struct hci_dev *hdev, void *data) 9314 { 9315 struct mgmt_pending_cmd *cmd = data; 9316 struct mgmt_cp_remove_advertising *cp = cmd->param; 9317 int err; 9318 9319 err = hci_remove_advertising_sync(hdev, cmd->sk, cp->instance, true); 9320 if (err) 9321 return err; 9322 9323 if (list_empty(&hdev->adv_instances)) 9324 err = hci_disable_advertising_sync(hdev); 9325 9326 return err; 9327 } 9328 9329 static int remove_advertising(struct sock *sk, struct hci_dev *hdev, 9330 void *data, u16 data_len) 9331 { 9332 struct mgmt_cp_remove_advertising *cp = data; 9333 struct mgmt_pending_cmd *cmd; 9334 int err; 9335 9336 bt_dev_dbg(hdev, "sock %p", sk); 9337 9338 hci_dev_lock(hdev); 9339 9340 if (cp->instance && !hci_find_adv_instance(hdev, cp->instance)) { 9341 err = mgmt_cmd_status(sk, hdev->id, 9342 MGMT_OP_REMOVE_ADVERTISING, 9343 MGMT_STATUS_INVALID_PARAMS); 9344 goto unlock; 9345 } 9346 9347 if (pending_find(MGMT_OP_SET_LE, hdev)) { 9348 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_ADVERTISING, 9349 MGMT_STATUS_BUSY); 9350 goto unlock; 9351 } 9352 9353 if (list_empty(&hdev->adv_instances)) { 9354 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_ADVERTISING, 9355 MGMT_STATUS_INVALID_PARAMS); 9356 goto unlock; 9357 } 9358 9359 cmd = mgmt_pending_new(sk, MGMT_OP_REMOVE_ADVERTISING, hdev, data, 9360 data_len); 9361 if (!cmd) { 9362 err = -ENOMEM; 9363 goto unlock; 9364 } 9365 9366 err = hci_cmd_sync_queue(hdev, remove_advertising_sync, cmd, 9367 remove_advertising_complete); 9368 if (err < 0) 9369 mgmt_pending_free(cmd); 9370 9371 unlock: 9372 hci_dev_unlock(hdev); 9373 9374 return err; 9375 } 9376 9377 static int get_adv_size_info(struct sock *sk, struct hci_dev *hdev, 9378 void *data, u16 data_len) 9379 { 9380 struct mgmt_cp_get_adv_size_info *cp = data; 9381 struct mgmt_rp_get_adv_size_info rp; 9382 u32 flags, supported_flags; 9383 9384 bt_dev_dbg(hdev, "sock %p", sk); 9385 9386 if (!lmp_le_capable(hdev)) 9387 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_ADV_SIZE_INFO, 9388 MGMT_STATUS_REJECTED); 9389 9390 if (cp->instance < 1 || cp->instance > hdev->le_num_of_adv_sets) 9391 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_ADV_SIZE_INFO, 9392 MGMT_STATUS_INVALID_PARAMS); 9393 9394 flags = __le32_to_cpu(cp->flags); 9395 9396 /* The current implementation only supports a subset of the specified 9397 * flags. 9398 */ 9399 supported_flags = get_supported_adv_flags(hdev); 9400 if (flags & ~supported_flags) 9401 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_ADV_SIZE_INFO, 9402 MGMT_STATUS_INVALID_PARAMS); 9403 9404 rp.instance = cp->instance; 9405 rp.flags = cp->flags; 9406 rp.max_adv_data_len = tlv_data_max_len(hdev, flags, true); 9407 rp.max_scan_rsp_len = tlv_data_max_len(hdev, flags, false); 9408 9409 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_ADV_SIZE_INFO, 9410 MGMT_STATUS_SUCCESS, &rp, sizeof(rp)); 9411 } 9412 9413 static const struct hci_mgmt_handler mgmt_handlers[] = { 9414 { NULL }, /* 0x0000 (no command) */ 9415 { read_version, MGMT_READ_VERSION_SIZE, 9416 HCI_MGMT_NO_HDEV | 9417 HCI_MGMT_UNTRUSTED }, 9418 { read_commands, MGMT_READ_COMMANDS_SIZE, 9419 HCI_MGMT_NO_HDEV | 9420 HCI_MGMT_UNTRUSTED }, 9421 { read_index_list, MGMT_READ_INDEX_LIST_SIZE, 9422 HCI_MGMT_NO_HDEV | 9423 HCI_MGMT_UNTRUSTED }, 9424 { read_controller_info, MGMT_READ_INFO_SIZE, 9425 HCI_MGMT_UNTRUSTED }, 9426 { set_powered, MGMT_SETTING_SIZE }, 9427 { set_discoverable, MGMT_SET_DISCOVERABLE_SIZE }, 9428 { set_connectable, MGMT_SETTING_SIZE }, 9429 { set_fast_connectable, MGMT_SETTING_SIZE }, 9430 { set_bondable, MGMT_SETTING_SIZE }, 9431 { set_link_security, MGMT_SETTING_SIZE }, 9432 { set_ssp, MGMT_SETTING_SIZE }, 9433 { set_hs, MGMT_SETTING_SIZE }, 9434 { set_le, MGMT_SETTING_SIZE }, 9435 { set_dev_class, MGMT_SET_DEV_CLASS_SIZE }, 9436 { set_local_name, MGMT_SET_LOCAL_NAME_SIZE }, 9437 { add_uuid, MGMT_ADD_UUID_SIZE }, 9438 { remove_uuid, MGMT_REMOVE_UUID_SIZE }, 9439 { load_link_keys, MGMT_LOAD_LINK_KEYS_SIZE, 9440 HCI_MGMT_VAR_LEN }, 9441 { load_long_term_keys, MGMT_LOAD_LONG_TERM_KEYS_SIZE, 9442 HCI_MGMT_VAR_LEN }, 9443 { disconnect, MGMT_DISCONNECT_SIZE }, 9444 { get_connections, MGMT_GET_CONNECTIONS_SIZE }, 9445 { pin_code_reply, MGMT_PIN_CODE_REPLY_SIZE }, 9446 { pin_code_neg_reply, MGMT_PIN_CODE_NEG_REPLY_SIZE }, 9447 { set_io_capability, MGMT_SET_IO_CAPABILITY_SIZE }, 9448 { pair_device, MGMT_PAIR_DEVICE_SIZE }, 9449 { cancel_pair_device, MGMT_CANCEL_PAIR_DEVICE_SIZE }, 9450 { unpair_device, MGMT_UNPAIR_DEVICE_SIZE }, 9451 { user_confirm_reply, MGMT_USER_CONFIRM_REPLY_SIZE }, 9452 { user_confirm_neg_reply, MGMT_USER_CONFIRM_NEG_REPLY_SIZE }, 9453 { user_passkey_reply, MGMT_USER_PASSKEY_REPLY_SIZE }, 9454 { user_passkey_neg_reply, MGMT_USER_PASSKEY_NEG_REPLY_SIZE }, 9455 { read_local_oob_data, MGMT_READ_LOCAL_OOB_DATA_SIZE }, 9456 { add_remote_oob_data, MGMT_ADD_REMOTE_OOB_DATA_SIZE, 9457 HCI_MGMT_VAR_LEN }, 9458 { remove_remote_oob_data, MGMT_REMOVE_REMOTE_OOB_DATA_SIZE }, 9459 { start_discovery, MGMT_START_DISCOVERY_SIZE }, 9460 { stop_discovery, MGMT_STOP_DISCOVERY_SIZE }, 9461 { confirm_name, MGMT_CONFIRM_NAME_SIZE }, 9462 { block_device, MGMT_BLOCK_DEVICE_SIZE }, 9463 { unblock_device, MGMT_UNBLOCK_DEVICE_SIZE }, 9464 { set_device_id, MGMT_SET_DEVICE_ID_SIZE }, 9465 { set_advertising, MGMT_SETTING_SIZE }, 9466 { set_bredr, MGMT_SETTING_SIZE }, 9467 { set_static_address, MGMT_SET_STATIC_ADDRESS_SIZE }, 9468 { set_scan_params, MGMT_SET_SCAN_PARAMS_SIZE }, 9469 { set_secure_conn, MGMT_SETTING_SIZE }, 9470 { set_debug_keys, MGMT_SETTING_SIZE }, 9471 { set_privacy, MGMT_SET_PRIVACY_SIZE }, 9472 { load_irks, MGMT_LOAD_IRKS_SIZE, 9473 HCI_MGMT_VAR_LEN }, 9474 { get_conn_info, MGMT_GET_CONN_INFO_SIZE }, 9475 { get_clock_info, MGMT_GET_CLOCK_INFO_SIZE }, 9476 { add_device, MGMT_ADD_DEVICE_SIZE }, 9477 { remove_device, MGMT_REMOVE_DEVICE_SIZE }, 9478 { load_conn_param, MGMT_LOAD_CONN_PARAM_SIZE, 9479 HCI_MGMT_VAR_LEN }, 9480 { read_unconf_index_list, MGMT_READ_UNCONF_INDEX_LIST_SIZE, 9481 HCI_MGMT_NO_HDEV | 9482 HCI_MGMT_UNTRUSTED }, 9483 { read_config_info, MGMT_READ_CONFIG_INFO_SIZE, 9484 HCI_MGMT_UNCONFIGURED | 9485 HCI_MGMT_UNTRUSTED }, 9486 { set_external_config, MGMT_SET_EXTERNAL_CONFIG_SIZE, 9487 HCI_MGMT_UNCONFIGURED }, 9488 { set_public_address, MGMT_SET_PUBLIC_ADDRESS_SIZE, 9489 HCI_MGMT_UNCONFIGURED }, 9490 { start_service_discovery, MGMT_START_SERVICE_DISCOVERY_SIZE, 9491 HCI_MGMT_VAR_LEN }, 9492 { read_local_oob_ext_data, MGMT_READ_LOCAL_OOB_EXT_DATA_SIZE }, 9493 { read_ext_index_list, MGMT_READ_EXT_INDEX_LIST_SIZE, 9494 HCI_MGMT_NO_HDEV | 9495 HCI_MGMT_UNTRUSTED }, 9496 { read_adv_features, MGMT_READ_ADV_FEATURES_SIZE }, 9497 { add_advertising, MGMT_ADD_ADVERTISING_SIZE, 9498 HCI_MGMT_VAR_LEN }, 9499 { remove_advertising, MGMT_REMOVE_ADVERTISING_SIZE }, 9500 { get_adv_size_info, MGMT_GET_ADV_SIZE_INFO_SIZE }, 9501 { start_limited_discovery, MGMT_START_DISCOVERY_SIZE }, 9502 { read_ext_controller_info,MGMT_READ_EXT_INFO_SIZE, 9503 HCI_MGMT_UNTRUSTED }, 9504 { set_appearance, MGMT_SET_APPEARANCE_SIZE }, 9505 { get_phy_configuration, MGMT_GET_PHY_CONFIGURATION_SIZE }, 9506 { set_phy_configuration, MGMT_SET_PHY_CONFIGURATION_SIZE }, 9507 { set_blocked_keys, MGMT_OP_SET_BLOCKED_KEYS_SIZE, 9508 HCI_MGMT_VAR_LEN }, 9509 { set_wideband_speech, MGMT_SETTING_SIZE }, 9510 { read_controller_cap, MGMT_READ_CONTROLLER_CAP_SIZE, 9511 HCI_MGMT_UNTRUSTED }, 9512 { read_exp_features_info, MGMT_READ_EXP_FEATURES_INFO_SIZE, 9513 HCI_MGMT_UNTRUSTED | 9514 HCI_MGMT_HDEV_OPTIONAL }, 9515 { set_exp_feature, MGMT_SET_EXP_FEATURE_SIZE, 9516 HCI_MGMT_VAR_LEN | 9517 HCI_MGMT_HDEV_OPTIONAL }, 9518 { read_def_system_config, MGMT_READ_DEF_SYSTEM_CONFIG_SIZE, 9519 HCI_MGMT_UNTRUSTED }, 9520 { set_def_system_config, MGMT_SET_DEF_SYSTEM_CONFIG_SIZE, 9521 HCI_MGMT_VAR_LEN }, 9522 { read_def_runtime_config, MGMT_READ_DEF_RUNTIME_CONFIG_SIZE, 9523 HCI_MGMT_UNTRUSTED }, 9524 { set_def_runtime_config, MGMT_SET_DEF_RUNTIME_CONFIG_SIZE, 9525 HCI_MGMT_VAR_LEN }, 9526 { get_device_flags, MGMT_GET_DEVICE_FLAGS_SIZE }, 9527 { set_device_flags, MGMT_SET_DEVICE_FLAGS_SIZE }, 9528 { read_adv_mon_features, MGMT_READ_ADV_MONITOR_FEATURES_SIZE }, 9529 { add_adv_patterns_monitor,MGMT_ADD_ADV_PATTERNS_MONITOR_SIZE, 9530 HCI_MGMT_VAR_LEN }, 9531 { remove_adv_monitor, MGMT_REMOVE_ADV_MONITOR_SIZE }, 9532 { add_ext_adv_params, MGMT_ADD_EXT_ADV_PARAMS_MIN_SIZE, 9533 HCI_MGMT_VAR_LEN }, 9534 { add_ext_adv_data, MGMT_ADD_EXT_ADV_DATA_SIZE, 9535 HCI_MGMT_VAR_LEN }, 9536 { add_adv_patterns_monitor_rssi, 9537 MGMT_ADD_ADV_PATTERNS_MONITOR_RSSI_SIZE, 9538 HCI_MGMT_VAR_LEN }, 9539 { set_mesh, MGMT_SET_MESH_RECEIVER_SIZE, 9540 HCI_MGMT_VAR_LEN }, 9541 { mesh_features, MGMT_MESH_READ_FEATURES_SIZE }, 9542 { mesh_send, MGMT_MESH_SEND_SIZE, 9543 HCI_MGMT_VAR_LEN }, 9544 { mesh_send_cancel, MGMT_MESH_SEND_CANCEL_SIZE }, 9545 { mgmt_hci_cmd_sync, MGMT_HCI_CMD_SYNC_SIZE, HCI_MGMT_VAR_LEN }, 9546 }; 9547 9548 void mgmt_index_added(struct hci_dev *hdev) 9549 { 9550 struct mgmt_ev_ext_index ev; 9551 9552 if (hci_test_quirk(hdev, HCI_QUIRK_RAW_DEVICE)) 9553 return; 9554 9555 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) { 9556 mgmt_index_event(MGMT_EV_UNCONF_INDEX_ADDED, hdev, NULL, 0, 9557 HCI_MGMT_UNCONF_INDEX_EVENTS); 9558 ev.type = 0x01; 9559 } else { 9560 mgmt_index_event(MGMT_EV_INDEX_ADDED, hdev, NULL, 0, 9561 HCI_MGMT_INDEX_EVENTS); 9562 ev.type = 0x00; 9563 } 9564 9565 ev.bus = hdev->bus; 9566 9567 mgmt_index_event(MGMT_EV_EXT_INDEX_ADDED, hdev, &ev, sizeof(ev), 9568 HCI_MGMT_EXT_INDEX_EVENTS); 9569 } 9570 9571 void mgmt_index_removed(struct hci_dev *hdev) 9572 { 9573 struct mgmt_ev_ext_index ev; 9574 struct cmd_lookup match = { NULL, hdev, MGMT_STATUS_INVALID_INDEX }; 9575 9576 if (hci_test_quirk(hdev, HCI_QUIRK_RAW_DEVICE)) 9577 return; 9578 9579 mgmt_pending_foreach(0, hdev, true, cmd_complete_rsp, &match); 9580 9581 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) { 9582 mgmt_index_event(MGMT_EV_UNCONF_INDEX_REMOVED, hdev, NULL, 0, 9583 HCI_MGMT_UNCONF_INDEX_EVENTS); 9584 ev.type = 0x01; 9585 } else { 9586 mgmt_index_event(MGMT_EV_INDEX_REMOVED, hdev, NULL, 0, 9587 HCI_MGMT_INDEX_EVENTS); 9588 ev.type = 0x00; 9589 } 9590 9591 ev.bus = hdev->bus; 9592 9593 mgmt_index_event(MGMT_EV_EXT_INDEX_REMOVED, hdev, &ev, sizeof(ev), 9594 HCI_MGMT_EXT_INDEX_EVENTS); 9595 9596 /* Cancel any remaining timed work */ 9597 if (!hci_dev_test_flag(hdev, HCI_MGMT)) 9598 return; 9599 cancel_delayed_work_sync(&hdev->discov_off); 9600 cancel_delayed_work_sync(&hdev->service_cache); 9601 cancel_delayed_work_sync(&hdev->rpa_expired); 9602 cancel_delayed_work_sync(&hdev->mesh_send_done); 9603 } 9604 9605 void mgmt_power_on(struct hci_dev *hdev, int err) 9606 { 9607 struct cmd_lookup match = { NULL, hdev }; 9608 9609 bt_dev_dbg(hdev, "err %d", err); 9610 9611 hci_dev_lock(hdev); 9612 9613 if (!err) { 9614 restart_le_actions(hdev); 9615 hci_update_passive_scan(hdev); 9616 } 9617 9618 mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, true, settings_rsp, 9619 &match); 9620 9621 new_settings(hdev, match.sk); 9622 9623 if (match.sk) 9624 sock_put(match.sk); 9625 9626 hci_dev_unlock(hdev); 9627 } 9628 9629 void __mgmt_power_off(struct hci_dev *hdev) 9630 { 9631 struct cmd_lookup match = { NULL, hdev }; 9632 u8 zero_cod[] = { 0, 0, 0 }; 9633 9634 mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, true, settings_rsp, 9635 &match); 9636 9637 /* If the power off is because of hdev unregistration let 9638 * use the appropriate INVALID_INDEX status. Otherwise use 9639 * NOT_POWERED. We cover both scenarios here since later in 9640 * mgmt_index_removed() any hci_conn callbacks will have already 9641 * been triggered, potentially causing misleading DISCONNECTED 9642 * status responses. 9643 */ 9644 if (hci_dev_test_flag(hdev, HCI_UNREGISTER)) 9645 match.mgmt_status = MGMT_STATUS_INVALID_INDEX; 9646 else 9647 match.mgmt_status = MGMT_STATUS_NOT_POWERED; 9648 9649 mgmt_pending_foreach(0, hdev, true, cmd_complete_rsp, &match); 9650 9651 if (memcmp(hdev->dev_class, zero_cod, sizeof(zero_cod)) != 0) { 9652 mgmt_limited_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev, 9653 zero_cod, sizeof(zero_cod), 9654 HCI_MGMT_DEV_CLASS_EVENTS, NULL); 9655 ext_info_changed(hdev, NULL); 9656 } 9657 9658 new_settings(hdev, match.sk); 9659 9660 if (match.sk) 9661 sock_put(match.sk); 9662 } 9663 9664 void mgmt_set_powered_failed(struct hci_dev *hdev, int err) 9665 { 9666 struct mgmt_pending_cmd *cmd; 9667 u8 status; 9668 9669 cmd = pending_find(MGMT_OP_SET_POWERED, hdev); 9670 if (!cmd) 9671 return; 9672 9673 if (err == -ERFKILL) 9674 status = MGMT_STATUS_RFKILLED; 9675 else 9676 status = MGMT_STATUS_FAILED; 9677 9678 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_POWERED, status); 9679 9680 mgmt_pending_remove(cmd); 9681 } 9682 9683 void mgmt_new_link_key(struct hci_dev *hdev, struct link_key *key, 9684 bool persistent) 9685 { 9686 struct mgmt_ev_new_link_key ev; 9687 9688 memset(&ev, 0, sizeof(ev)); 9689 9690 ev.store_hint = persistent; 9691 bacpy(&ev.key.addr.bdaddr, &key->bdaddr); 9692 ev.key.addr.type = BDADDR_BREDR; 9693 ev.key.type = key->type; 9694 memcpy(ev.key.val, key->val, HCI_LINK_KEY_SIZE); 9695 ev.key.pin_len = key->pin_len; 9696 9697 mgmt_event(MGMT_EV_NEW_LINK_KEY, hdev, &ev, sizeof(ev), NULL); 9698 } 9699 9700 static u8 mgmt_ltk_type(struct smp_ltk *ltk) 9701 { 9702 switch (ltk->type) { 9703 case SMP_LTK: 9704 case SMP_LTK_RESPONDER: 9705 if (ltk->authenticated) 9706 return MGMT_LTK_AUTHENTICATED; 9707 return MGMT_LTK_UNAUTHENTICATED; 9708 case SMP_LTK_P256: 9709 if (ltk->authenticated) 9710 return MGMT_LTK_P256_AUTH; 9711 return MGMT_LTK_P256_UNAUTH; 9712 case SMP_LTK_P256_DEBUG: 9713 return MGMT_LTK_P256_DEBUG; 9714 } 9715 9716 return MGMT_LTK_UNAUTHENTICATED; 9717 } 9718 9719 void mgmt_new_ltk(struct hci_dev *hdev, struct smp_ltk *key, bool persistent) 9720 { 9721 struct mgmt_ev_new_long_term_key ev; 9722 9723 memset(&ev, 0, sizeof(ev)); 9724 9725 /* Devices using resolvable or non-resolvable random addresses 9726 * without providing an identity resolving key don't require 9727 * to store long term keys. Their addresses will change the 9728 * next time around. 9729 * 9730 * Only when a remote device provides an identity address 9731 * make sure the long term key is stored. If the remote 9732 * identity is known, the long term keys are internally 9733 * mapped to the identity address. So allow static random 9734 * and public addresses here. 9735 */ 9736 if (key->bdaddr_type == ADDR_LE_DEV_RANDOM && 9737 (key->bdaddr.b[5] & 0xc0) != 0xc0) 9738 ev.store_hint = 0x00; 9739 else 9740 ev.store_hint = persistent; 9741 9742 bacpy(&ev.key.addr.bdaddr, &key->bdaddr); 9743 ev.key.addr.type = link_to_bdaddr(LE_LINK, key->bdaddr_type); 9744 ev.key.type = mgmt_ltk_type(key); 9745 ev.key.enc_size = key->enc_size; 9746 ev.key.ediv = key->ediv; 9747 ev.key.rand = key->rand; 9748 9749 if (key->type == SMP_LTK) 9750 ev.key.initiator = 1; 9751 9752 /* Make sure we copy only the significant bytes based on the 9753 * encryption key size, and set the rest of the value to zeroes. 9754 */ 9755 memcpy(ev.key.val, key->val, key->enc_size); 9756 memset(ev.key.val + key->enc_size, 0, 9757 sizeof(ev.key.val) - key->enc_size); 9758 9759 mgmt_event(MGMT_EV_NEW_LONG_TERM_KEY, hdev, &ev, sizeof(ev), NULL); 9760 } 9761 9762 void mgmt_new_irk(struct hci_dev *hdev, struct smp_irk *irk, bool persistent) 9763 { 9764 struct mgmt_ev_new_irk ev; 9765 9766 memset(&ev, 0, sizeof(ev)); 9767 9768 ev.store_hint = persistent; 9769 9770 bacpy(&ev.rpa, &irk->rpa); 9771 bacpy(&ev.irk.addr.bdaddr, &irk->bdaddr); 9772 ev.irk.addr.type = link_to_bdaddr(LE_LINK, irk->addr_type); 9773 memcpy(ev.irk.val, irk->val, sizeof(irk->val)); 9774 9775 mgmt_event(MGMT_EV_NEW_IRK, hdev, &ev, sizeof(ev), NULL); 9776 } 9777 9778 void mgmt_new_csrk(struct hci_dev *hdev, struct smp_csrk *csrk, 9779 bool persistent) 9780 { 9781 struct mgmt_ev_new_csrk ev; 9782 9783 memset(&ev, 0, sizeof(ev)); 9784 9785 /* Devices using resolvable or non-resolvable random addresses 9786 * without providing an identity resolving key don't require 9787 * to store signature resolving keys. Their addresses will change 9788 * the next time around. 9789 * 9790 * Only when a remote device provides an identity address 9791 * make sure the signature resolving key is stored. So allow 9792 * static random and public addresses here. 9793 */ 9794 if (csrk->bdaddr_type == ADDR_LE_DEV_RANDOM && 9795 (csrk->bdaddr.b[5] & 0xc0) != 0xc0) 9796 ev.store_hint = 0x00; 9797 else 9798 ev.store_hint = persistent; 9799 9800 bacpy(&ev.key.addr.bdaddr, &csrk->bdaddr); 9801 ev.key.addr.type = link_to_bdaddr(LE_LINK, csrk->bdaddr_type); 9802 ev.key.type = csrk->type; 9803 memcpy(ev.key.val, csrk->val, sizeof(csrk->val)); 9804 9805 mgmt_event(MGMT_EV_NEW_CSRK, hdev, &ev, sizeof(ev), NULL); 9806 } 9807 9808 void mgmt_new_conn_param(struct hci_dev *hdev, bdaddr_t *bdaddr, 9809 u8 bdaddr_type, u8 store_hint, u16 min_interval, 9810 u16 max_interval, u16 latency, u16 timeout) 9811 { 9812 struct mgmt_ev_new_conn_param ev; 9813 9814 if (!hci_is_identity_address(bdaddr, bdaddr_type)) 9815 return; 9816 9817 memset(&ev, 0, sizeof(ev)); 9818 bacpy(&ev.addr.bdaddr, bdaddr); 9819 ev.addr.type = link_to_bdaddr(LE_LINK, bdaddr_type); 9820 ev.store_hint = store_hint; 9821 ev.min_interval = cpu_to_le16(min_interval); 9822 ev.max_interval = cpu_to_le16(max_interval); 9823 ev.latency = cpu_to_le16(latency); 9824 ev.timeout = cpu_to_le16(timeout); 9825 9826 mgmt_event(MGMT_EV_NEW_CONN_PARAM, hdev, &ev, sizeof(ev), NULL); 9827 } 9828 9829 void mgmt_device_connected(struct hci_dev *hdev, struct hci_conn *conn, 9830 u8 *name, u8 name_len) 9831 { 9832 struct sk_buff *skb; 9833 struct mgmt_ev_device_connected *ev; 9834 u16 eir_len = 0; 9835 u32 flags = 0; 9836 9837 if (test_and_set_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags)) 9838 return; 9839 9840 /* allocate buff for LE or BR/EDR adv */ 9841 if (conn->le_adv_data_len > 0) 9842 skb = mgmt_alloc_skb(hdev, MGMT_EV_DEVICE_CONNECTED, 9843 sizeof(*ev) + conn->le_adv_data_len); 9844 else 9845 skb = mgmt_alloc_skb(hdev, MGMT_EV_DEVICE_CONNECTED, 9846 sizeof(*ev) + (name ? eir_precalc_len(name_len) : 0) + 9847 eir_precalc_len(sizeof(conn->dev_class))); 9848 9849 if (!skb) 9850 return; 9851 9852 ev = skb_put(skb, sizeof(*ev)); 9853 bacpy(&ev->addr.bdaddr, &conn->dst); 9854 ev->addr.type = link_to_bdaddr(conn->type, conn->dst_type); 9855 9856 if (conn->out) 9857 flags |= MGMT_DEV_FOUND_INITIATED_CONN; 9858 9859 ev->flags = __cpu_to_le32(flags); 9860 9861 /* We must ensure that the EIR Data fields are ordered and 9862 * unique. Keep it simple for now and avoid the problem by not 9863 * adding any BR/EDR data to the LE adv. 9864 */ 9865 if (conn->le_adv_data_len > 0) { 9866 skb_put_data(skb, conn->le_adv_data, conn->le_adv_data_len); 9867 eir_len = conn->le_adv_data_len; 9868 } else { 9869 if (name) 9870 eir_len += eir_skb_put_data(skb, EIR_NAME_COMPLETE, name, name_len); 9871 9872 if (memcmp(conn->dev_class, "\0\0\0", sizeof(conn->dev_class))) 9873 eir_len += eir_skb_put_data(skb, EIR_CLASS_OF_DEV, 9874 conn->dev_class, sizeof(conn->dev_class)); 9875 } 9876 9877 ev->eir_len = cpu_to_le16(eir_len); 9878 9879 mgmt_event_skb(skb, NULL); 9880 } 9881 9882 static void unpair_device_rsp(struct mgmt_pending_cmd *cmd, void *data) 9883 { 9884 struct hci_dev *hdev = data; 9885 struct mgmt_cp_unpair_device *cp = cmd->param; 9886 9887 device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, cmd->sk); 9888 9889 cmd->cmd_complete(cmd, 0); 9890 } 9891 9892 bool mgmt_powering_down(struct hci_dev *hdev) 9893 { 9894 struct mgmt_pending_cmd *cmd; 9895 struct mgmt_mode *cp; 9896 9897 if (hci_dev_test_flag(hdev, HCI_POWERING_DOWN)) 9898 return true; 9899 9900 cmd = pending_find(MGMT_OP_SET_POWERED, hdev); 9901 if (!cmd) 9902 return false; 9903 9904 cp = cmd->param; 9905 if (!cp->val) 9906 return true; 9907 9908 return false; 9909 } 9910 9911 u8 hci_to_mgmt_reason(u8 err) 9912 { 9913 switch (err) { 9914 case HCI_ERROR_CONNECTION_TIMEOUT: 9915 return MGMT_DEV_DISCONN_TIMEOUT; 9916 case HCI_ERROR_REMOTE_USER_TERM: 9917 case HCI_ERROR_REMOTE_LOW_RESOURCES: 9918 case HCI_ERROR_REMOTE_POWER_OFF: 9919 return MGMT_DEV_DISCONN_REMOTE; 9920 case HCI_ERROR_LOCAL_HOST_TERM: 9921 return MGMT_DEV_DISCONN_LOCAL_HOST; 9922 default: 9923 return MGMT_DEV_DISCONN_UNKNOWN; 9924 } 9925 } 9926 9927 void mgmt_device_disconnected(struct hci_dev *hdev, bdaddr_t *bdaddr, 9928 u8 link_type, u8 addr_type, u8 reason, 9929 bool mgmt_connected) 9930 { 9931 struct mgmt_ev_device_disconnected ev; 9932 struct sock *sk = NULL; 9933 9934 if (!mgmt_connected) 9935 return; 9936 9937 if (link_type != ACL_LINK && 9938 link_type != LE_LINK && 9939 link_type != BIS_LINK) 9940 return; 9941 9942 bacpy(&ev.addr.bdaddr, bdaddr); 9943 ev.addr.type = link_to_bdaddr(link_type, addr_type); 9944 ev.reason = reason; 9945 9946 /* Report disconnects due to suspend */ 9947 if (hdev->suspended) 9948 ev.reason = MGMT_DEV_DISCONN_LOCAL_HOST_SUSPEND; 9949 9950 mgmt_event(MGMT_EV_DEVICE_DISCONNECTED, hdev, &ev, sizeof(ev), sk); 9951 9952 if (sk) 9953 sock_put(sk); 9954 } 9955 9956 void mgmt_disconnect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr, 9957 u8 link_type, u8 addr_type, u8 status) 9958 { 9959 u8 bdaddr_type = link_to_bdaddr(link_type, addr_type); 9960 struct mgmt_cp_disconnect *cp; 9961 struct mgmt_pending_cmd *cmd; 9962 9963 mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, true, 9964 unpair_device_rsp, hdev); 9965 9966 cmd = pending_find(MGMT_OP_DISCONNECT, hdev); 9967 if (!cmd) 9968 return; 9969 9970 cp = cmd->param; 9971 9972 if (bacmp(bdaddr, &cp->addr.bdaddr)) 9973 return; 9974 9975 if (cp->addr.type != bdaddr_type) 9976 return; 9977 9978 cmd->cmd_complete(cmd, mgmt_status(status)); 9979 mgmt_pending_remove(cmd); 9980 } 9981 9982 void mgmt_connect_failed(struct hci_dev *hdev, struct hci_conn *conn, u8 status) 9983 { 9984 struct mgmt_ev_connect_failed ev; 9985 9986 if (test_and_clear_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags)) { 9987 mgmt_device_disconnected(hdev, &conn->dst, conn->type, 9988 conn->dst_type, 9989 hci_to_mgmt_reason(status), true); 9990 return; 9991 } 9992 9993 bacpy(&ev.addr.bdaddr, &conn->dst); 9994 ev.addr.type = link_to_bdaddr(conn->type, conn->dst_type); 9995 ev.status = mgmt_status(status); 9996 9997 mgmt_event(MGMT_EV_CONNECT_FAILED, hdev, &ev, sizeof(ev), NULL); 9998 } 9999 10000 void mgmt_pin_code_request(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 secure) 10001 { 10002 struct mgmt_ev_pin_code_request ev; 10003 10004 bacpy(&ev.addr.bdaddr, bdaddr); 10005 ev.addr.type = BDADDR_BREDR; 10006 ev.secure = secure; 10007 10008 mgmt_event(MGMT_EV_PIN_CODE_REQUEST, hdev, &ev, sizeof(ev), NULL); 10009 } 10010 10011 void mgmt_pin_code_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr, 10012 u8 status) 10013 { 10014 struct mgmt_pending_cmd *cmd; 10015 10016 cmd = pending_find(MGMT_OP_PIN_CODE_REPLY, hdev); 10017 if (!cmd) 10018 return; 10019 10020 cmd->cmd_complete(cmd, mgmt_status(status)); 10021 mgmt_pending_remove(cmd); 10022 } 10023 10024 void mgmt_pin_code_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr, 10025 u8 status) 10026 { 10027 struct mgmt_pending_cmd *cmd; 10028 10029 cmd = pending_find(MGMT_OP_PIN_CODE_NEG_REPLY, hdev); 10030 if (!cmd) 10031 return; 10032 10033 cmd->cmd_complete(cmd, mgmt_status(status)); 10034 mgmt_pending_remove(cmd); 10035 } 10036 10037 int mgmt_user_confirm_request(struct hci_dev *hdev, bdaddr_t *bdaddr, 10038 u8 link_type, u8 addr_type, u32 value, 10039 u8 confirm_hint) 10040 { 10041 struct mgmt_ev_user_confirm_request ev; 10042 10043 bt_dev_dbg(hdev, "bdaddr %pMR", bdaddr); 10044 10045 bacpy(&ev.addr.bdaddr, bdaddr); 10046 ev.addr.type = link_to_bdaddr(link_type, addr_type); 10047 ev.confirm_hint = confirm_hint; 10048 ev.value = cpu_to_le32(value); 10049 10050 return mgmt_event(MGMT_EV_USER_CONFIRM_REQUEST, hdev, &ev, sizeof(ev), 10051 NULL); 10052 } 10053 10054 int mgmt_user_passkey_request(struct hci_dev *hdev, bdaddr_t *bdaddr, 10055 u8 link_type, u8 addr_type) 10056 { 10057 struct mgmt_ev_user_passkey_request ev; 10058 10059 bt_dev_dbg(hdev, "bdaddr %pMR", bdaddr); 10060 10061 bacpy(&ev.addr.bdaddr, bdaddr); 10062 ev.addr.type = link_to_bdaddr(link_type, addr_type); 10063 10064 return mgmt_event(MGMT_EV_USER_PASSKEY_REQUEST, hdev, &ev, sizeof(ev), 10065 NULL); 10066 } 10067 10068 static int user_pairing_resp_complete(struct hci_dev *hdev, bdaddr_t *bdaddr, 10069 u8 link_type, u8 addr_type, u8 status, 10070 u8 opcode) 10071 { 10072 struct mgmt_pending_cmd *cmd; 10073 10074 cmd = pending_find(opcode, hdev); 10075 if (!cmd) 10076 return -ENOENT; 10077 10078 cmd->cmd_complete(cmd, mgmt_status(status)); 10079 mgmt_pending_remove(cmd); 10080 10081 return 0; 10082 } 10083 10084 int mgmt_user_confirm_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr, 10085 u8 link_type, u8 addr_type, u8 status) 10086 { 10087 return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type, 10088 status, MGMT_OP_USER_CONFIRM_REPLY); 10089 } 10090 10091 int mgmt_user_confirm_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr, 10092 u8 link_type, u8 addr_type, u8 status) 10093 { 10094 return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type, 10095 status, 10096 MGMT_OP_USER_CONFIRM_NEG_REPLY); 10097 } 10098 10099 int mgmt_user_passkey_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr, 10100 u8 link_type, u8 addr_type, u8 status) 10101 { 10102 return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type, 10103 status, MGMT_OP_USER_PASSKEY_REPLY); 10104 } 10105 10106 int mgmt_user_passkey_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr, 10107 u8 link_type, u8 addr_type, u8 status) 10108 { 10109 return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type, 10110 status, 10111 MGMT_OP_USER_PASSKEY_NEG_REPLY); 10112 } 10113 10114 int mgmt_user_passkey_notify(struct hci_dev *hdev, bdaddr_t *bdaddr, 10115 u8 link_type, u8 addr_type, u32 passkey, 10116 u8 entered) 10117 { 10118 struct mgmt_ev_passkey_notify ev; 10119 10120 bt_dev_dbg(hdev, "bdaddr %pMR", bdaddr); 10121 10122 bacpy(&ev.addr.bdaddr, bdaddr); 10123 ev.addr.type = link_to_bdaddr(link_type, addr_type); 10124 ev.passkey = __cpu_to_le32(passkey); 10125 ev.entered = entered; 10126 10127 return mgmt_event(MGMT_EV_PASSKEY_NOTIFY, hdev, &ev, sizeof(ev), NULL); 10128 } 10129 10130 void mgmt_auth_failed(struct hci_conn *conn, u8 hci_status) 10131 { 10132 struct mgmt_ev_auth_failed ev; 10133 struct mgmt_pending_cmd *cmd; 10134 u8 status = mgmt_status(hci_status); 10135 10136 bacpy(&ev.addr.bdaddr, &conn->dst); 10137 ev.addr.type = link_to_bdaddr(conn->type, conn->dst_type); 10138 ev.status = status; 10139 10140 cmd = find_pairing(conn); 10141 10142 mgmt_event(MGMT_EV_AUTH_FAILED, conn->hdev, &ev, sizeof(ev), 10143 cmd ? cmd->sk : NULL); 10144 10145 if (cmd) { 10146 cmd->cmd_complete(cmd, status); 10147 mgmt_pending_remove(cmd); 10148 } 10149 } 10150 10151 void mgmt_auth_enable_complete(struct hci_dev *hdev, u8 status) 10152 { 10153 struct cmd_lookup match = { NULL, hdev }; 10154 bool changed; 10155 10156 if (status) { 10157 u8 mgmt_err = mgmt_status(status); 10158 mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev, true, 10159 cmd_status_rsp, &mgmt_err); 10160 return; 10161 } 10162 10163 if (test_bit(HCI_AUTH, &hdev->flags)) 10164 changed = !hci_dev_test_and_set_flag(hdev, HCI_LINK_SECURITY); 10165 else 10166 changed = hci_dev_test_and_clear_flag(hdev, HCI_LINK_SECURITY); 10167 10168 mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev, true, 10169 settings_rsp, &match); 10170 10171 if (changed) 10172 new_settings(hdev, match.sk); 10173 10174 if (match.sk) 10175 sock_put(match.sk); 10176 } 10177 10178 static void sk_lookup(struct mgmt_pending_cmd *cmd, void *data) 10179 { 10180 struct cmd_lookup *match = data; 10181 10182 if (match->sk == NULL) { 10183 match->sk = cmd->sk; 10184 sock_hold(match->sk); 10185 } 10186 } 10187 10188 void mgmt_set_class_of_dev_complete(struct hci_dev *hdev, u8 *dev_class, 10189 u8 status) 10190 { 10191 struct cmd_lookup match = { NULL, hdev, mgmt_status(status) }; 10192 10193 mgmt_pending_foreach(MGMT_OP_SET_DEV_CLASS, hdev, false, sk_lookup, 10194 &match); 10195 mgmt_pending_foreach(MGMT_OP_ADD_UUID, hdev, false, sk_lookup, 10196 &match); 10197 mgmt_pending_foreach(MGMT_OP_REMOVE_UUID, hdev, false, sk_lookup, 10198 &match); 10199 10200 if (!status) { 10201 mgmt_limited_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev, dev_class, 10202 3, HCI_MGMT_DEV_CLASS_EVENTS, NULL); 10203 ext_info_changed(hdev, NULL); 10204 } 10205 10206 if (match.sk) 10207 sock_put(match.sk); 10208 } 10209 10210 void mgmt_set_local_name_complete(struct hci_dev *hdev, u8 *name, u8 status) 10211 { 10212 struct mgmt_cp_set_local_name ev; 10213 struct mgmt_pending_cmd *cmd; 10214 10215 if (status) 10216 return; 10217 10218 memset(&ev, 0, sizeof(ev)); 10219 memcpy(ev.name, name, HCI_MAX_NAME_LENGTH); 10220 memcpy(ev.short_name, hdev->short_name, HCI_MAX_SHORT_NAME_LENGTH); 10221 10222 cmd = pending_find(MGMT_OP_SET_LOCAL_NAME, hdev); 10223 if (!cmd) { 10224 memcpy(hdev->dev_name, name, sizeof(hdev->dev_name)); 10225 10226 /* If this is a HCI command related to powering on the 10227 * HCI dev don't send any mgmt signals. 10228 */ 10229 if (hci_dev_test_flag(hdev, HCI_POWERING_DOWN)) 10230 return; 10231 10232 if (pending_find(MGMT_OP_SET_POWERED, hdev)) 10233 return; 10234 } 10235 10236 mgmt_limited_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, &ev, sizeof(ev), 10237 HCI_MGMT_LOCAL_NAME_EVENTS, cmd ? cmd->sk : NULL); 10238 ext_info_changed(hdev, cmd ? cmd->sk : NULL); 10239 } 10240 10241 static inline bool has_uuid(u8 *uuid, u16 uuid_count, u8 (*uuids)[16]) 10242 { 10243 int i; 10244 10245 for (i = 0; i < uuid_count; i++) { 10246 if (!memcmp(uuid, uuids[i], 16)) 10247 return true; 10248 } 10249 10250 return false; 10251 } 10252 10253 static bool eir_has_uuids(u8 *eir, u16 eir_len, u16 uuid_count, u8 (*uuids)[16]) 10254 { 10255 u16 parsed = 0; 10256 10257 while (parsed < eir_len) { 10258 u8 field_len = eir[0]; 10259 u8 uuid[16]; 10260 int i; 10261 10262 if (field_len == 0) 10263 break; 10264 10265 if (eir_len - parsed < field_len + 1) 10266 break; 10267 10268 switch (eir[1]) { 10269 case EIR_UUID16_ALL: 10270 case EIR_UUID16_SOME: 10271 for (i = 0; i + 3 <= field_len; i += 2) { 10272 memcpy(uuid, bluetooth_base_uuid, 16); 10273 uuid[13] = eir[i + 3]; 10274 uuid[12] = eir[i + 2]; 10275 if (has_uuid(uuid, uuid_count, uuids)) 10276 return true; 10277 } 10278 break; 10279 case EIR_UUID32_ALL: 10280 case EIR_UUID32_SOME: 10281 for (i = 0; i + 5 <= field_len; i += 4) { 10282 memcpy(uuid, bluetooth_base_uuid, 16); 10283 uuid[15] = eir[i + 5]; 10284 uuid[14] = eir[i + 4]; 10285 uuid[13] = eir[i + 3]; 10286 uuid[12] = eir[i + 2]; 10287 if (has_uuid(uuid, uuid_count, uuids)) 10288 return true; 10289 } 10290 break; 10291 case EIR_UUID128_ALL: 10292 case EIR_UUID128_SOME: 10293 for (i = 0; i + 17 <= field_len; i += 16) { 10294 memcpy(uuid, eir + i + 2, 16); 10295 if (has_uuid(uuid, uuid_count, uuids)) 10296 return true; 10297 } 10298 break; 10299 } 10300 10301 parsed += field_len + 1; 10302 eir += field_len + 1; 10303 } 10304 10305 return false; 10306 } 10307 10308 static bool is_filter_match(struct hci_dev *hdev, s8 rssi, u8 *eir, 10309 u16 eir_len, u8 *scan_rsp, u8 scan_rsp_len) 10310 { 10311 /* If a RSSI threshold has been specified, and 10312 * HCI_QUIRK_STRICT_DUPLICATE_FILTER is not set, then all results with 10313 * a RSSI smaller than the RSSI threshold will be dropped. If the quirk 10314 * is set, let it through for further processing, as we might need to 10315 * restart the scan. 10316 * 10317 * For BR/EDR devices (pre 1.2) providing no RSSI during inquiry, 10318 * the results are also dropped. 10319 */ 10320 if (hdev->discovery.rssi != HCI_RSSI_INVALID && 10321 (rssi == HCI_RSSI_INVALID || 10322 (rssi < hdev->discovery.rssi && 10323 !hci_test_quirk(hdev, HCI_QUIRK_STRICT_DUPLICATE_FILTER)))) 10324 return false; 10325 10326 if (hdev->discovery.uuid_count != 0) { 10327 /* If a list of UUIDs is provided in filter, results with no 10328 * matching UUID should be dropped. 10329 */ 10330 if (!eir_has_uuids(eir, eir_len, hdev->discovery.uuid_count, 10331 hdev->discovery.uuids) && 10332 !eir_has_uuids(scan_rsp, scan_rsp_len, 10333 hdev->discovery.uuid_count, 10334 hdev->discovery.uuids)) 10335 return false; 10336 } 10337 10338 /* If duplicate filtering does not report RSSI changes, then restart 10339 * scanning to ensure updated result with updated RSSI values. 10340 */ 10341 if (hci_test_quirk(hdev, HCI_QUIRK_STRICT_DUPLICATE_FILTER)) { 10342 /* Validate RSSI value against the RSSI threshold once more. */ 10343 if (hdev->discovery.rssi != HCI_RSSI_INVALID && 10344 rssi < hdev->discovery.rssi) 10345 return false; 10346 } 10347 10348 return true; 10349 } 10350 10351 void mgmt_adv_monitor_device_lost(struct hci_dev *hdev, u16 handle, 10352 bdaddr_t *bdaddr, u8 addr_type) 10353 { 10354 struct mgmt_ev_adv_monitor_device_lost ev; 10355 10356 ev.monitor_handle = cpu_to_le16(handle); 10357 bacpy(&ev.addr.bdaddr, bdaddr); 10358 ev.addr.type = addr_type; 10359 10360 mgmt_event(MGMT_EV_ADV_MONITOR_DEVICE_LOST, hdev, &ev, sizeof(ev), 10361 NULL); 10362 } 10363 10364 static void mgmt_send_adv_monitor_device_found(struct hci_dev *hdev, 10365 struct sk_buff *skb, 10366 struct sock *skip_sk, 10367 u16 handle) 10368 { 10369 struct sk_buff *advmon_skb; 10370 size_t advmon_skb_len; 10371 __le16 *monitor_handle; 10372 10373 if (!skb) 10374 return; 10375 10376 advmon_skb_len = (sizeof(struct mgmt_ev_adv_monitor_device_found) - 10377 sizeof(struct mgmt_ev_device_found)) + skb->len; 10378 advmon_skb = mgmt_alloc_skb(hdev, MGMT_EV_ADV_MONITOR_DEVICE_FOUND, 10379 advmon_skb_len); 10380 if (!advmon_skb) 10381 return; 10382 10383 /* ADV_MONITOR_DEVICE_FOUND is similar to DEVICE_FOUND event except 10384 * that it also has 'monitor_handle'. Make a copy of DEVICE_FOUND and 10385 * store monitor_handle of the matched monitor. 10386 */ 10387 monitor_handle = skb_put(advmon_skb, sizeof(*monitor_handle)); 10388 *monitor_handle = cpu_to_le16(handle); 10389 skb_put_data(advmon_skb, skb->data, skb->len); 10390 10391 mgmt_event_skb(advmon_skb, skip_sk); 10392 } 10393 10394 static void mgmt_adv_monitor_device_found(struct hci_dev *hdev, 10395 bdaddr_t *bdaddr, bool report_device, 10396 struct sk_buff *skb, 10397 struct sock *skip_sk) 10398 { 10399 struct monitored_device *dev, *tmp; 10400 bool matched = false; 10401 bool notified = false; 10402 10403 /* We have received the Advertisement Report because: 10404 * 1. the kernel has initiated active discovery 10405 * 2. if not, we have pend_le_reports > 0 in which case we are doing 10406 * passive scanning 10407 * 3. if none of the above is true, we have one or more active 10408 * Advertisement Monitor 10409 * 10410 * For case 1 and 2, report all advertisements via MGMT_EV_DEVICE_FOUND 10411 * and report ONLY one advertisement per device for the matched Monitor 10412 * via MGMT_EV_ADV_MONITOR_DEVICE_FOUND event. 10413 * 10414 * For case 3, since we are not active scanning and all advertisements 10415 * received are due to a matched Advertisement Monitor, report all 10416 * advertisements ONLY via MGMT_EV_ADV_MONITOR_DEVICE_FOUND event. 10417 */ 10418 if (report_device && !hdev->advmon_pend_notify) { 10419 mgmt_event_skb(skb, skip_sk); 10420 return; 10421 } 10422 10423 hdev->advmon_pend_notify = false; 10424 10425 list_for_each_entry_safe(dev, tmp, &hdev->monitored_devices, list) { 10426 if (!bacmp(&dev->bdaddr, bdaddr)) { 10427 matched = true; 10428 10429 if (!dev->notified) { 10430 mgmt_send_adv_monitor_device_found(hdev, skb, 10431 skip_sk, 10432 dev->handle); 10433 notified = true; 10434 dev->notified = true; 10435 } 10436 } 10437 10438 if (!dev->notified) 10439 hdev->advmon_pend_notify = true; 10440 } 10441 10442 if (!report_device && 10443 ((matched && !notified) || !msft_monitor_supported(hdev))) { 10444 /* Handle 0 indicates that we are not active scanning and this 10445 * is a subsequent advertisement report for an already matched 10446 * Advertisement Monitor or the controller offloading support 10447 * is not available. 10448 */ 10449 mgmt_send_adv_monitor_device_found(hdev, skb, skip_sk, 0); 10450 } 10451 10452 if (report_device) 10453 mgmt_event_skb(skb, skip_sk); 10454 else 10455 kfree_skb(skb); 10456 } 10457 10458 static void mesh_device_found(struct hci_dev *hdev, bdaddr_t *bdaddr, 10459 u8 addr_type, s8 rssi, u32 flags, u8 *eir, 10460 u16 eir_len, u8 *scan_rsp, u8 scan_rsp_len, 10461 u64 instant) 10462 { 10463 struct sk_buff *skb; 10464 struct mgmt_ev_mesh_device_found *ev; 10465 int i, j; 10466 10467 if (!hdev->mesh_ad_types[0]) 10468 goto accepted; 10469 10470 /* Scan for requested AD types */ 10471 if (eir_len > 0) { 10472 for (i = 0; i + 1 < eir_len; i += eir[i] + 1) { 10473 for (j = 0; j < sizeof(hdev->mesh_ad_types); j++) { 10474 if (!hdev->mesh_ad_types[j]) 10475 break; 10476 10477 if (hdev->mesh_ad_types[j] == eir[i + 1]) 10478 goto accepted; 10479 } 10480 } 10481 } 10482 10483 if (scan_rsp_len > 0) { 10484 for (i = 0; i + 1 < scan_rsp_len; i += scan_rsp[i] + 1) { 10485 for (j = 0; j < sizeof(hdev->mesh_ad_types); j++) { 10486 if (!hdev->mesh_ad_types[j]) 10487 break; 10488 10489 if (hdev->mesh_ad_types[j] == scan_rsp[i + 1]) 10490 goto accepted; 10491 } 10492 } 10493 } 10494 10495 return; 10496 10497 accepted: 10498 skb = mgmt_alloc_skb(hdev, MGMT_EV_MESH_DEVICE_FOUND, 10499 sizeof(*ev) + eir_len + scan_rsp_len); 10500 if (!skb) 10501 return; 10502 10503 ev = skb_put(skb, sizeof(*ev)); 10504 10505 bacpy(&ev->addr.bdaddr, bdaddr); 10506 ev->addr.type = link_to_bdaddr(LE_LINK, addr_type); 10507 ev->rssi = rssi; 10508 ev->flags = cpu_to_le32(flags); 10509 ev->instant = cpu_to_le64(instant); 10510 10511 if (eir_len > 0) 10512 /* Copy EIR or advertising data into event */ 10513 skb_put_data(skb, eir, eir_len); 10514 10515 if (scan_rsp_len > 0) 10516 /* Append scan response data to event */ 10517 skb_put_data(skb, scan_rsp, scan_rsp_len); 10518 10519 ev->eir_len = cpu_to_le16(eir_len + scan_rsp_len); 10520 10521 mgmt_event_skb(skb, NULL); 10522 } 10523 10524 void mgmt_device_found(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type, 10525 u8 addr_type, u8 *dev_class, s8 rssi, u32 flags, 10526 u8 *eir, u16 eir_len, u8 *scan_rsp, u8 scan_rsp_len, 10527 u64 instant) 10528 { 10529 struct sk_buff *skb; 10530 struct mgmt_ev_device_found *ev; 10531 bool report_device = hci_discovery_active(hdev); 10532 10533 if (hci_dev_test_flag(hdev, HCI_MESH) && link_type == LE_LINK) 10534 mesh_device_found(hdev, bdaddr, addr_type, rssi, flags, 10535 eir, eir_len, scan_rsp, scan_rsp_len, 10536 instant); 10537 10538 /* Don't send events for a non-kernel initiated discovery. With 10539 * LE one exception is if we have pend_le_reports > 0 in which 10540 * case we're doing passive scanning and want these events. 10541 */ 10542 if (!hci_discovery_active(hdev)) { 10543 if (link_type == ACL_LINK) 10544 return; 10545 if (link_type == LE_LINK && !list_empty(&hdev->pend_le_reports)) 10546 report_device = true; 10547 else if (!hci_is_adv_monitoring(hdev)) 10548 return; 10549 } 10550 10551 if (hdev->discovery.result_filtering) { 10552 /* We are using service discovery */ 10553 if (!is_filter_match(hdev, rssi, eir, eir_len, scan_rsp, 10554 scan_rsp_len)) 10555 return; 10556 } 10557 10558 if (hdev->discovery.limited) { 10559 /* Check for limited discoverable bit */ 10560 if (dev_class) { 10561 if (!(dev_class[1] & 0x20)) 10562 return; 10563 } else { 10564 u8 *flags = eir_get_data(eir, eir_len, EIR_FLAGS, NULL); 10565 if (!flags || !(flags[0] & LE_AD_LIMITED)) 10566 return; 10567 } 10568 } 10569 10570 /* Allocate skb. The 5 extra bytes are for the potential CoD field */ 10571 skb = mgmt_alloc_skb(hdev, MGMT_EV_DEVICE_FOUND, 10572 sizeof(*ev) + eir_len + scan_rsp_len + 5); 10573 if (!skb) 10574 return; 10575 10576 ev = skb_put(skb, sizeof(*ev)); 10577 10578 /* In case of device discovery with BR/EDR devices (pre 1.2), the 10579 * RSSI value was reported as 0 when not available. This behavior 10580 * is kept when using device discovery. This is required for full 10581 * backwards compatibility with the API. 10582 * 10583 * However when using service discovery, the value 127 will be 10584 * returned when the RSSI is not available. 10585 */ 10586 if (rssi == HCI_RSSI_INVALID && !hdev->discovery.report_invalid_rssi && 10587 link_type == ACL_LINK) 10588 rssi = 0; 10589 10590 bacpy(&ev->addr.bdaddr, bdaddr); 10591 ev->addr.type = link_to_bdaddr(link_type, addr_type); 10592 ev->rssi = rssi; 10593 ev->flags = cpu_to_le32(flags); 10594 10595 if (eir_len > 0) 10596 /* Copy EIR or advertising data into event */ 10597 skb_put_data(skb, eir, eir_len); 10598 10599 if (dev_class && !eir_get_data(eir, eir_len, EIR_CLASS_OF_DEV, NULL)) { 10600 u8 eir_cod[5]; 10601 10602 eir_len += eir_append_data(eir_cod, 0, EIR_CLASS_OF_DEV, 10603 dev_class, 3); 10604 skb_put_data(skb, eir_cod, sizeof(eir_cod)); 10605 } 10606 10607 if (scan_rsp_len > 0) 10608 /* Append scan response data to event */ 10609 skb_put_data(skb, scan_rsp, scan_rsp_len); 10610 10611 ev->eir_len = cpu_to_le16(eir_len + scan_rsp_len); 10612 10613 mgmt_adv_monitor_device_found(hdev, bdaddr, report_device, skb, NULL); 10614 } 10615 10616 void mgmt_remote_name(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type, 10617 u8 addr_type, s8 rssi, u8 *name, u8 name_len) 10618 { 10619 struct sk_buff *skb; 10620 struct mgmt_ev_device_found *ev; 10621 u16 eir_len = 0; 10622 u32 flags = 0; 10623 10624 skb = mgmt_alloc_skb(hdev, MGMT_EV_DEVICE_FOUND, 10625 sizeof(*ev) + (name ? eir_precalc_len(name_len) : 0)); 10626 if (!skb) 10627 return; 10628 10629 ev = skb_put(skb, sizeof(*ev)); 10630 bacpy(&ev->addr.bdaddr, bdaddr); 10631 ev->addr.type = link_to_bdaddr(link_type, addr_type); 10632 ev->rssi = rssi; 10633 10634 if (name) 10635 eir_len += eir_skb_put_data(skb, EIR_NAME_COMPLETE, name, name_len); 10636 else 10637 flags = MGMT_DEV_FOUND_NAME_REQUEST_FAILED; 10638 10639 ev->eir_len = cpu_to_le16(eir_len); 10640 ev->flags = cpu_to_le32(flags); 10641 10642 mgmt_event_skb(skb, NULL); 10643 } 10644 10645 void mgmt_discovering(struct hci_dev *hdev, u8 discovering) 10646 { 10647 struct mgmt_ev_discovering ev; 10648 10649 bt_dev_dbg(hdev, "discovering %u", discovering); 10650 10651 memset(&ev, 0, sizeof(ev)); 10652 ev.type = hdev->discovery.type; 10653 ev.discovering = discovering; 10654 10655 mgmt_event(MGMT_EV_DISCOVERING, hdev, &ev, sizeof(ev), NULL); 10656 } 10657 10658 void mgmt_suspending(struct hci_dev *hdev, u8 state) 10659 { 10660 struct mgmt_ev_controller_suspend ev; 10661 10662 ev.suspend_state = state; 10663 mgmt_event(MGMT_EV_CONTROLLER_SUSPEND, hdev, &ev, sizeof(ev), NULL); 10664 } 10665 10666 void mgmt_resuming(struct hci_dev *hdev, u8 reason, bdaddr_t *bdaddr, 10667 u8 addr_type) 10668 { 10669 struct mgmt_ev_controller_resume ev; 10670 10671 ev.wake_reason = reason; 10672 if (bdaddr) { 10673 bacpy(&ev.addr.bdaddr, bdaddr); 10674 ev.addr.type = addr_type; 10675 } else { 10676 memset(&ev.addr, 0, sizeof(ev.addr)); 10677 } 10678 10679 mgmt_event(MGMT_EV_CONTROLLER_RESUME, hdev, &ev, sizeof(ev), NULL); 10680 } 10681 10682 static struct hci_mgmt_chan chan = { 10683 .channel = HCI_CHANNEL_CONTROL, 10684 .handler_count = ARRAY_SIZE(mgmt_handlers), 10685 .handlers = mgmt_handlers, 10686 .hdev_init = mgmt_init_hdev, 10687 }; 10688 10689 int mgmt_init(void) 10690 { 10691 return hci_mgmt_chan_register(&chan); 10692 } 10693 10694 void mgmt_exit(void) 10695 { 10696 hci_mgmt_chan_unregister(&chan); 10697 } 10698 10699 void mgmt_cleanup(struct sock *sk) 10700 { 10701 struct mgmt_mesh_tx *mesh_tx; 10702 struct hci_dev *hdev; 10703 10704 read_lock(&hci_dev_list_lock); 10705 10706 list_for_each_entry(hdev, &hci_dev_list, list) { 10707 do { 10708 mesh_tx = mgmt_mesh_next(hdev, sk); 10709 10710 if (mesh_tx) 10711 mesh_send_complete(hdev, mesh_tx, true); 10712 } while (mesh_tx); 10713 } 10714 10715 read_unlock(&hci_dev_list_lock); 10716 } 10717