1 /* 2 BlueZ - Bluetooth protocol stack for Linux 3 4 Copyright (C) 2010 Nokia Corporation 5 Copyright (C) 2011-2012 Intel Corporation 6 7 This program is free software; you can redistribute it and/or modify 8 it under the terms of the GNU General Public License version 2 as 9 published by the Free Software Foundation; 10 11 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS 12 OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 13 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS. 14 IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY 15 CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES 16 WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN 17 ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF 18 OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. 19 20 ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS, 21 COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS 22 SOFTWARE IS DISCLAIMED. 23 */ 24 25 /* Bluetooth HCI Management interface */ 26 27 #include <linux/module.h> 28 #include <asm/unaligned.h> 29 30 #include <net/bluetooth/bluetooth.h> 31 #include <net/bluetooth/hci_core.h> 32 #include <net/bluetooth/hci_sock.h> 33 #include <net/bluetooth/l2cap.h> 34 #include <net/bluetooth/mgmt.h> 35 36 #include "hci_request.h" 37 #include "smp.h" 38 #include "mgmt_util.h" 39 #include "mgmt_config.h" 40 #include "msft.h" 41 #include "eir.h" 42 #include "aosp.h" 43 44 #define MGMT_VERSION 1 45 #define MGMT_REVISION 22 46 47 static const u16 mgmt_commands[] = { 48 MGMT_OP_READ_INDEX_LIST, 49 MGMT_OP_READ_INFO, 50 MGMT_OP_SET_POWERED, 51 MGMT_OP_SET_DISCOVERABLE, 52 MGMT_OP_SET_CONNECTABLE, 53 MGMT_OP_SET_FAST_CONNECTABLE, 54 MGMT_OP_SET_BONDABLE, 55 MGMT_OP_SET_LINK_SECURITY, 56 MGMT_OP_SET_SSP, 57 MGMT_OP_SET_HS, 58 MGMT_OP_SET_LE, 59 MGMT_OP_SET_DEV_CLASS, 60 MGMT_OP_SET_LOCAL_NAME, 61 MGMT_OP_ADD_UUID, 62 MGMT_OP_REMOVE_UUID, 63 MGMT_OP_LOAD_LINK_KEYS, 64 MGMT_OP_LOAD_LONG_TERM_KEYS, 65 MGMT_OP_DISCONNECT, 66 MGMT_OP_GET_CONNECTIONS, 67 MGMT_OP_PIN_CODE_REPLY, 68 MGMT_OP_PIN_CODE_NEG_REPLY, 69 MGMT_OP_SET_IO_CAPABILITY, 70 MGMT_OP_PAIR_DEVICE, 71 MGMT_OP_CANCEL_PAIR_DEVICE, 72 MGMT_OP_UNPAIR_DEVICE, 73 MGMT_OP_USER_CONFIRM_REPLY, 74 MGMT_OP_USER_CONFIRM_NEG_REPLY, 75 MGMT_OP_USER_PASSKEY_REPLY, 76 MGMT_OP_USER_PASSKEY_NEG_REPLY, 77 MGMT_OP_READ_LOCAL_OOB_DATA, 78 MGMT_OP_ADD_REMOTE_OOB_DATA, 79 MGMT_OP_REMOVE_REMOTE_OOB_DATA, 80 MGMT_OP_START_DISCOVERY, 81 MGMT_OP_STOP_DISCOVERY, 82 MGMT_OP_CONFIRM_NAME, 83 MGMT_OP_BLOCK_DEVICE, 84 MGMT_OP_UNBLOCK_DEVICE, 85 MGMT_OP_SET_DEVICE_ID, 86 MGMT_OP_SET_ADVERTISING, 87 MGMT_OP_SET_BREDR, 88 MGMT_OP_SET_STATIC_ADDRESS, 89 MGMT_OP_SET_SCAN_PARAMS, 90 MGMT_OP_SET_SECURE_CONN, 91 MGMT_OP_SET_DEBUG_KEYS, 92 MGMT_OP_SET_PRIVACY, 93 MGMT_OP_LOAD_IRKS, 94 MGMT_OP_GET_CONN_INFO, 95 MGMT_OP_GET_CLOCK_INFO, 96 MGMT_OP_ADD_DEVICE, 97 MGMT_OP_REMOVE_DEVICE, 98 MGMT_OP_LOAD_CONN_PARAM, 99 MGMT_OP_READ_UNCONF_INDEX_LIST, 100 MGMT_OP_READ_CONFIG_INFO, 101 MGMT_OP_SET_EXTERNAL_CONFIG, 102 MGMT_OP_SET_PUBLIC_ADDRESS, 103 MGMT_OP_START_SERVICE_DISCOVERY, 104 MGMT_OP_READ_LOCAL_OOB_EXT_DATA, 105 MGMT_OP_READ_EXT_INDEX_LIST, 106 MGMT_OP_READ_ADV_FEATURES, 107 MGMT_OP_ADD_ADVERTISING, 108 MGMT_OP_REMOVE_ADVERTISING, 109 MGMT_OP_GET_ADV_SIZE_INFO, 110 MGMT_OP_START_LIMITED_DISCOVERY, 111 MGMT_OP_READ_EXT_INFO, 112 MGMT_OP_SET_APPEARANCE, 113 MGMT_OP_GET_PHY_CONFIGURATION, 114 MGMT_OP_SET_PHY_CONFIGURATION, 115 MGMT_OP_SET_BLOCKED_KEYS, 116 MGMT_OP_SET_WIDEBAND_SPEECH, 117 MGMT_OP_READ_CONTROLLER_CAP, 118 MGMT_OP_READ_EXP_FEATURES_INFO, 119 MGMT_OP_SET_EXP_FEATURE, 120 MGMT_OP_READ_DEF_SYSTEM_CONFIG, 121 MGMT_OP_SET_DEF_SYSTEM_CONFIG, 122 MGMT_OP_READ_DEF_RUNTIME_CONFIG, 123 MGMT_OP_SET_DEF_RUNTIME_CONFIG, 124 MGMT_OP_GET_DEVICE_FLAGS, 125 MGMT_OP_SET_DEVICE_FLAGS, 126 MGMT_OP_READ_ADV_MONITOR_FEATURES, 127 MGMT_OP_ADD_ADV_PATTERNS_MONITOR, 128 MGMT_OP_REMOVE_ADV_MONITOR, 129 MGMT_OP_ADD_EXT_ADV_PARAMS, 130 MGMT_OP_ADD_EXT_ADV_DATA, 131 MGMT_OP_ADD_ADV_PATTERNS_MONITOR_RSSI, 132 MGMT_OP_SET_MESH_RECEIVER, 133 MGMT_OP_MESH_READ_FEATURES, 134 MGMT_OP_MESH_SEND, 135 MGMT_OP_MESH_SEND_CANCEL, 136 }; 137 138 static const u16 mgmt_events[] = { 139 MGMT_EV_CONTROLLER_ERROR, 140 MGMT_EV_INDEX_ADDED, 141 MGMT_EV_INDEX_REMOVED, 142 MGMT_EV_NEW_SETTINGS, 143 MGMT_EV_CLASS_OF_DEV_CHANGED, 144 MGMT_EV_LOCAL_NAME_CHANGED, 145 MGMT_EV_NEW_LINK_KEY, 146 MGMT_EV_NEW_LONG_TERM_KEY, 147 MGMT_EV_DEVICE_CONNECTED, 148 MGMT_EV_DEVICE_DISCONNECTED, 149 MGMT_EV_CONNECT_FAILED, 150 MGMT_EV_PIN_CODE_REQUEST, 151 MGMT_EV_USER_CONFIRM_REQUEST, 152 MGMT_EV_USER_PASSKEY_REQUEST, 153 MGMT_EV_AUTH_FAILED, 154 MGMT_EV_DEVICE_FOUND, 155 MGMT_EV_DISCOVERING, 156 MGMT_EV_DEVICE_BLOCKED, 157 MGMT_EV_DEVICE_UNBLOCKED, 158 MGMT_EV_DEVICE_UNPAIRED, 159 MGMT_EV_PASSKEY_NOTIFY, 160 MGMT_EV_NEW_IRK, 161 MGMT_EV_NEW_CSRK, 162 MGMT_EV_DEVICE_ADDED, 163 MGMT_EV_DEVICE_REMOVED, 164 MGMT_EV_NEW_CONN_PARAM, 165 MGMT_EV_UNCONF_INDEX_ADDED, 166 MGMT_EV_UNCONF_INDEX_REMOVED, 167 MGMT_EV_NEW_CONFIG_OPTIONS, 168 MGMT_EV_EXT_INDEX_ADDED, 169 MGMT_EV_EXT_INDEX_REMOVED, 170 MGMT_EV_LOCAL_OOB_DATA_UPDATED, 171 MGMT_EV_ADVERTISING_ADDED, 172 MGMT_EV_ADVERTISING_REMOVED, 173 MGMT_EV_EXT_INFO_CHANGED, 174 MGMT_EV_PHY_CONFIGURATION_CHANGED, 175 MGMT_EV_EXP_FEATURE_CHANGED, 176 MGMT_EV_DEVICE_FLAGS_CHANGED, 177 MGMT_EV_ADV_MONITOR_ADDED, 178 MGMT_EV_ADV_MONITOR_REMOVED, 179 MGMT_EV_CONTROLLER_SUSPEND, 180 MGMT_EV_CONTROLLER_RESUME, 181 MGMT_EV_ADV_MONITOR_DEVICE_FOUND, 182 MGMT_EV_ADV_MONITOR_DEVICE_LOST, 183 }; 184 185 static const u16 mgmt_untrusted_commands[] = { 186 MGMT_OP_READ_INDEX_LIST, 187 MGMT_OP_READ_INFO, 188 MGMT_OP_READ_UNCONF_INDEX_LIST, 189 MGMT_OP_READ_CONFIG_INFO, 190 MGMT_OP_READ_EXT_INDEX_LIST, 191 MGMT_OP_READ_EXT_INFO, 192 MGMT_OP_READ_CONTROLLER_CAP, 193 MGMT_OP_READ_EXP_FEATURES_INFO, 194 MGMT_OP_READ_DEF_SYSTEM_CONFIG, 195 MGMT_OP_READ_DEF_RUNTIME_CONFIG, 196 }; 197 198 static const u16 mgmt_untrusted_events[] = { 199 MGMT_EV_INDEX_ADDED, 200 MGMT_EV_INDEX_REMOVED, 201 MGMT_EV_NEW_SETTINGS, 202 MGMT_EV_CLASS_OF_DEV_CHANGED, 203 MGMT_EV_LOCAL_NAME_CHANGED, 204 MGMT_EV_UNCONF_INDEX_ADDED, 205 MGMT_EV_UNCONF_INDEX_REMOVED, 206 MGMT_EV_NEW_CONFIG_OPTIONS, 207 MGMT_EV_EXT_INDEX_ADDED, 208 MGMT_EV_EXT_INDEX_REMOVED, 209 MGMT_EV_EXT_INFO_CHANGED, 210 MGMT_EV_EXP_FEATURE_CHANGED, 211 }; 212 213 #define CACHE_TIMEOUT msecs_to_jiffies(2 * 1000) 214 215 #define ZERO_KEY "\x00\x00\x00\x00\x00\x00\x00\x00" \ 216 "\x00\x00\x00\x00\x00\x00\x00\x00" 217 218 /* HCI to MGMT error code conversion table */ 219 static const u8 mgmt_status_table[] = { 220 MGMT_STATUS_SUCCESS, 221 MGMT_STATUS_UNKNOWN_COMMAND, /* Unknown Command */ 222 MGMT_STATUS_NOT_CONNECTED, /* No Connection */ 223 MGMT_STATUS_FAILED, /* Hardware Failure */ 224 MGMT_STATUS_CONNECT_FAILED, /* Page Timeout */ 225 MGMT_STATUS_AUTH_FAILED, /* Authentication Failed */ 226 MGMT_STATUS_AUTH_FAILED, /* PIN or Key Missing */ 227 MGMT_STATUS_NO_RESOURCES, /* Memory Full */ 228 MGMT_STATUS_TIMEOUT, /* Connection Timeout */ 229 MGMT_STATUS_NO_RESOURCES, /* Max Number of Connections */ 230 MGMT_STATUS_NO_RESOURCES, /* Max Number of SCO Connections */ 231 MGMT_STATUS_ALREADY_CONNECTED, /* ACL Connection Exists */ 232 MGMT_STATUS_BUSY, /* Command Disallowed */ 233 MGMT_STATUS_NO_RESOURCES, /* Rejected Limited Resources */ 234 MGMT_STATUS_REJECTED, /* Rejected Security */ 235 MGMT_STATUS_REJECTED, /* Rejected Personal */ 236 MGMT_STATUS_TIMEOUT, /* Host Timeout */ 237 MGMT_STATUS_NOT_SUPPORTED, /* Unsupported Feature */ 238 MGMT_STATUS_INVALID_PARAMS, /* Invalid Parameters */ 239 MGMT_STATUS_DISCONNECTED, /* OE User Ended Connection */ 240 MGMT_STATUS_NO_RESOURCES, /* OE Low Resources */ 241 MGMT_STATUS_DISCONNECTED, /* OE Power Off */ 242 MGMT_STATUS_DISCONNECTED, /* Connection Terminated */ 243 MGMT_STATUS_BUSY, /* Repeated Attempts */ 244 MGMT_STATUS_REJECTED, /* Pairing Not Allowed */ 245 MGMT_STATUS_FAILED, /* Unknown LMP PDU */ 246 MGMT_STATUS_NOT_SUPPORTED, /* Unsupported Remote Feature */ 247 MGMT_STATUS_REJECTED, /* SCO Offset Rejected */ 248 MGMT_STATUS_REJECTED, /* SCO Interval Rejected */ 249 MGMT_STATUS_REJECTED, /* Air Mode Rejected */ 250 MGMT_STATUS_INVALID_PARAMS, /* Invalid LMP Parameters */ 251 MGMT_STATUS_FAILED, /* Unspecified Error */ 252 MGMT_STATUS_NOT_SUPPORTED, /* Unsupported LMP Parameter Value */ 253 MGMT_STATUS_FAILED, /* Role Change Not Allowed */ 254 MGMT_STATUS_TIMEOUT, /* LMP Response Timeout */ 255 MGMT_STATUS_FAILED, /* LMP Error Transaction Collision */ 256 MGMT_STATUS_FAILED, /* LMP PDU Not Allowed */ 257 MGMT_STATUS_REJECTED, /* Encryption Mode Not Accepted */ 258 MGMT_STATUS_FAILED, /* Unit Link Key Used */ 259 MGMT_STATUS_NOT_SUPPORTED, /* QoS Not Supported */ 260 MGMT_STATUS_TIMEOUT, /* Instant Passed */ 261 MGMT_STATUS_NOT_SUPPORTED, /* Pairing Not Supported */ 262 MGMT_STATUS_FAILED, /* Transaction Collision */ 263 MGMT_STATUS_FAILED, /* Reserved for future use */ 264 MGMT_STATUS_INVALID_PARAMS, /* Unacceptable Parameter */ 265 MGMT_STATUS_REJECTED, /* QoS Rejected */ 266 MGMT_STATUS_NOT_SUPPORTED, /* Classification Not Supported */ 267 MGMT_STATUS_REJECTED, /* Insufficient Security */ 268 MGMT_STATUS_INVALID_PARAMS, /* Parameter Out Of Range */ 269 MGMT_STATUS_FAILED, /* Reserved for future use */ 270 MGMT_STATUS_BUSY, /* Role Switch Pending */ 271 MGMT_STATUS_FAILED, /* Reserved for future use */ 272 MGMT_STATUS_FAILED, /* Slot Violation */ 273 MGMT_STATUS_FAILED, /* Role Switch Failed */ 274 MGMT_STATUS_INVALID_PARAMS, /* EIR Too Large */ 275 MGMT_STATUS_NOT_SUPPORTED, /* Simple Pairing Not Supported */ 276 MGMT_STATUS_BUSY, /* Host Busy Pairing */ 277 MGMT_STATUS_REJECTED, /* Rejected, No Suitable Channel */ 278 MGMT_STATUS_BUSY, /* Controller Busy */ 279 MGMT_STATUS_INVALID_PARAMS, /* Unsuitable Connection Interval */ 280 MGMT_STATUS_TIMEOUT, /* Directed Advertising Timeout */ 281 MGMT_STATUS_AUTH_FAILED, /* Terminated Due to MIC Failure */ 282 MGMT_STATUS_CONNECT_FAILED, /* Connection Establishment Failed */ 283 MGMT_STATUS_CONNECT_FAILED, /* MAC Connection Failed */ 284 }; 285 286 static u8 mgmt_errno_status(int err) 287 { 288 switch (err) { 289 case 0: 290 return MGMT_STATUS_SUCCESS; 291 case -EPERM: 292 return MGMT_STATUS_REJECTED; 293 case -EINVAL: 294 return MGMT_STATUS_INVALID_PARAMS; 295 case -EOPNOTSUPP: 296 return MGMT_STATUS_NOT_SUPPORTED; 297 case -EBUSY: 298 return MGMT_STATUS_BUSY; 299 case -ETIMEDOUT: 300 return MGMT_STATUS_AUTH_FAILED; 301 case -ENOMEM: 302 return MGMT_STATUS_NO_RESOURCES; 303 case -EISCONN: 304 return MGMT_STATUS_ALREADY_CONNECTED; 305 case -ENOTCONN: 306 return MGMT_STATUS_DISCONNECTED; 307 } 308 309 return MGMT_STATUS_FAILED; 310 } 311 312 static u8 mgmt_status(int err) 313 { 314 if (err < 0) 315 return mgmt_errno_status(err); 316 317 if (err < ARRAY_SIZE(mgmt_status_table)) 318 return mgmt_status_table[err]; 319 320 return MGMT_STATUS_FAILED; 321 } 322 323 static int mgmt_index_event(u16 event, struct hci_dev *hdev, void *data, 324 u16 len, int flag) 325 { 326 return mgmt_send_event(event, hdev, HCI_CHANNEL_CONTROL, data, len, 327 flag, NULL); 328 } 329 330 static int mgmt_limited_event(u16 event, struct hci_dev *hdev, void *data, 331 u16 len, int flag, struct sock *skip_sk) 332 { 333 return mgmt_send_event(event, hdev, HCI_CHANNEL_CONTROL, data, len, 334 flag, skip_sk); 335 } 336 337 static int mgmt_event(u16 event, struct hci_dev *hdev, void *data, u16 len, 338 struct sock *skip_sk) 339 { 340 return mgmt_send_event(event, hdev, HCI_CHANNEL_CONTROL, data, len, 341 HCI_SOCK_TRUSTED, skip_sk); 342 } 343 344 static int mgmt_event_skb(struct sk_buff *skb, struct sock *skip_sk) 345 { 346 return mgmt_send_event_skb(HCI_CHANNEL_CONTROL, skb, HCI_SOCK_TRUSTED, 347 skip_sk); 348 } 349 350 static u8 le_addr_type(u8 mgmt_addr_type) 351 { 352 if (mgmt_addr_type == BDADDR_LE_PUBLIC) 353 return ADDR_LE_DEV_PUBLIC; 354 else 355 return ADDR_LE_DEV_RANDOM; 356 } 357 358 void mgmt_fill_version_info(void *ver) 359 { 360 struct mgmt_rp_read_version *rp = ver; 361 362 rp->version = MGMT_VERSION; 363 rp->revision = cpu_to_le16(MGMT_REVISION); 364 } 365 366 static int read_version(struct sock *sk, struct hci_dev *hdev, void *data, 367 u16 data_len) 368 { 369 struct mgmt_rp_read_version rp; 370 371 bt_dev_dbg(hdev, "sock %p", sk); 372 373 mgmt_fill_version_info(&rp); 374 375 return mgmt_cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_VERSION, 0, 376 &rp, sizeof(rp)); 377 } 378 379 static int read_commands(struct sock *sk, struct hci_dev *hdev, void *data, 380 u16 data_len) 381 { 382 struct mgmt_rp_read_commands *rp; 383 u16 num_commands, num_events; 384 size_t rp_size; 385 int i, err; 386 387 bt_dev_dbg(hdev, "sock %p", sk); 388 389 if (hci_sock_test_flag(sk, HCI_SOCK_TRUSTED)) { 390 num_commands = ARRAY_SIZE(mgmt_commands); 391 num_events = ARRAY_SIZE(mgmt_events); 392 } else { 393 num_commands = ARRAY_SIZE(mgmt_untrusted_commands); 394 num_events = ARRAY_SIZE(mgmt_untrusted_events); 395 } 396 397 rp_size = sizeof(*rp) + ((num_commands + num_events) * sizeof(u16)); 398 399 rp = kmalloc(rp_size, GFP_KERNEL); 400 if (!rp) 401 return -ENOMEM; 402 403 rp->num_commands = cpu_to_le16(num_commands); 404 rp->num_events = cpu_to_le16(num_events); 405 406 if (hci_sock_test_flag(sk, HCI_SOCK_TRUSTED)) { 407 __le16 *opcode = rp->opcodes; 408 409 for (i = 0; i < num_commands; i++, opcode++) 410 put_unaligned_le16(mgmt_commands[i], opcode); 411 412 for (i = 0; i < num_events; i++, opcode++) 413 put_unaligned_le16(mgmt_events[i], opcode); 414 } else { 415 __le16 *opcode = rp->opcodes; 416 417 for (i = 0; i < num_commands; i++, opcode++) 418 put_unaligned_le16(mgmt_untrusted_commands[i], opcode); 419 420 for (i = 0; i < num_events; i++, opcode++) 421 put_unaligned_le16(mgmt_untrusted_events[i], opcode); 422 } 423 424 err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_COMMANDS, 0, 425 rp, rp_size); 426 kfree(rp); 427 428 return err; 429 } 430 431 static int read_index_list(struct sock *sk, struct hci_dev *hdev, void *data, 432 u16 data_len) 433 { 434 struct mgmt_rp_read_index_list *rp; 435 struct hci_dev *d; 436 size_t rp_len; 437 u16 count; 438 int err; 439 440 bt_dev_dbg(hdev, "sock %p", sk); 441 442 read_lock(&hci_dev_list_lock); 443 444 count = 0; 445 list_for_each_entry(d, &hci_dev_list, list) { 446 if (d->dev_type == HCI_PRIMARY && 447 !hci_dev_test_flag(d, HCI_UNCONFIGURED)) 448 count++; 449 } 450 451 rp_len = sizeof(*rp) + (2 * count); 452 rp = kmalloc(rp_len, GFP_ATOMIC); 453 if (!rp) { 454 read_unlock(&hci_dev_list_lock); 455 return -ENOMEM; 456 } 457 458 count = 0; 459 list_for_each_entry(d, &hci_dev_list, list) { 460 if (hci_dev_test_flag(d, HCI_SETUP) || 461 hci_dev_test_flag(d, HCI_CONFIG) || 462 hci_dev_test_flag(d, HCI_USER_CHANNEL)) 463 continue; 464 465 /* Devices marked as raw-only are neither configured 466 * nor unconfigured controllers. 467 */ 468 if (test_bit(HCI_QUIRK_RAW_DEVICE, &d->quirks)) 469 continue; 470 471 if (d->dev_type == HCI_PRIMARY && 472 !hci_dev_test_flag(d, HCI_UNCONFIGURED)) { 473 rp->index[count++] = cpu_to_le16(d->id); 474 bt_dev_dbg(hdev, "Added hci%u", d->id); 475 } 476 } 477 478 rp->num_controllers = cpu_to_le16(count); 479 rp_len = sizeof(*rp) + (2 * count); 480 481 read_unlock(&hci_dev_list_lock); 482 483 err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_INDEX_LIST, 484 0, rp, rp_len); 485 486 kfree(rp); 487 488 return err; 489 } 490 491 static int read_unconf_index_list(struct sock *sk, struct hci_dev *hdev, 492 void *data, u16 data_len) 493 { 494 struct mgmt_rp_read_unconf_index_list *rp; 495 struct hci_dev *d; 496 size_t rp_len; 497 u16 count; 498 int err; 499 500 bt_dev_dbg(hdev, "sock %p", sk); 501 502 read_lock(&hci_dev_list_lock); 503 504 count = 0; 505 list_for_each_entry(d, &hci_dev_list, list) { 506 if (d->dev_type == HCI_PRIMARY && 507 hci_dev_test_flag(d, HCI_UNCONFIGURED)) 508 count++; 509 } 510 511 rp_len = sizeof(*rp) + (2 * count); 512 rp = kmalloc(rp_len, GFP_ATOMIC); 513 if (!rp) { 514 read_unlock(&hci_dev_list_lock); 515 return -ENOMEM; 516 } 517 518 count = 0; 519 list_for_each_entry(d, &hci_dev_list, list) { 520 if (hci_dev_test_flag(d, HCI_SETUP) || 521 hci_dev_test_flag(d, HCI_CONFIG) || 522 hci_dev_test_flag(d, HCI_USER_CHANNEL)) 523 continue; 524 525 /* Devices marked as raw-only are neither configured 526 * nor unconfigured controllers. 527 */ 528 if (test_bit(HCI_QUIRK_RAW_DEVICE, &d->quirks)) 529 continue; 530 531 if (d->dev_type == HCI_PRIMARY && 532 hci_dev_test_flag(d, HCI_UNCONFIGURED)) { 533 rp->index[count++] = cpu_to_le16(d->id); 534 bt_dev_dbg(hdev, "Added hci%u", d->id); 535 } 536 } 537 538 rp->num_controllers = cpu_to_le16(count); 539 rp_len = sizeof(*rp) + (2 * count); 540 541 read_unlock(&hci_dev_list_lock); 542 543 err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE, 544 MGMT_OP_READ_UNCONF_INDEX_LIST, 0, rp, rp_len); 545 546 kfree(rp); 547 548 return err; 549 } 550 551 static int read_ext_index_list(struct sock *sk, struct hci_dev *hdev, 552 void *data, u16 data_len) 553 { 554 struct mgmt_rp_read_ext_index_list *rp; 555 struct hci_dev *d; 556 u16 count; 557 int err; 558 559 bt_dev_dbg(hdev, "sock %p", sk); 560 561 read_lock(&hci_dev_list_lock); 562 563 count = 0; 564 list_for_each_entry(d, &hci_dev_list, list) { 565 if (d->dev_type == HCI_PRIMARY || d->dev_type == HCI_AMP) 566 count++; 567 } 568 569 rp = kmalloc(struct_size(rp, entry, count), GFP_ATOMIC); 570 if (!rp) { 571 read_unlock(&hci_dev_list_lock); 572 return -ENOMEM; 573 } 574 575 count = 0; 576 list_for_each_entry(d, &hci_dev_list, list) { 577 if (hci_dev_test_flag(d, HCI_SETUP) || 578 hci_dev_test_flag(d, HCI_CONFIG) || 579 hci_dev_test_flag(d, HCI_USER_CHANNEL)) 580 continue; 581 582 /* Devices marked as raw-only are neither configured 583 * nor unconfigured controllers. 584 */ 585 if (test_bit(HCI_QUIRK_RAW_DEVICE, &d->quirks)) 586 continue; 587 588 if (d->dev_type == HCI_PRIMARY) { 589 if (hci_dev_test_flag(d, HCI_UNCONFIGURED)) 590 rp->entry[count].type = 0x01; 591 else 592 rp->entry[count].type = 0x00; 593 } else if (d->dev_type == HCI_AMP) { 594 rp->entry[count].type = 0x02; 595 } else { 596 continue; 597 } 598 599 rp->entry[count].bus = d->bus; 600 rp->entry[count++].index = cpu_to_le16(d->id); 601 bt_dev_dbg(hdev, "Added hci%u", d->id); 602 } 603 604 rp->num_controllers = cpu_to_le16(count); 605 606 read_unlock(&hci_dev_list_lock); 607 608 /* If this command is called at least once, then all the 609 * default index and unconfigured index events are disabled 610 * and from now on only extended index events are used. 611 */ 612 hci_sock_set_flag(sk, HCI_MGMT_EXT_INDEX_EVENTS); 613 hci_sock_clear_flag(sk, HCI_MGMT_INDEX_EVENTS); 614 hci_sock_clear_flag(sk, HCI_MGMT_UNCONF_INDEX_EVENTS); 615 616 err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE, 617 MGMT_OP_READ_EXT_INDEX_LIST, 0, rp, 618 struct_size(rp, entry, count)); 619 620 kfree(rp); 621 622 return err; 623 } 624 625 static bool is_configured(struct hci_dev *hdev) 626 { 627 if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks) && 628 !hci_dev_test_flag(hdev, HCI_EXT_CONFIGURED)) 629 return false; 630 631 if ((test_bit(HCI_QUIRK_INVALID_BDADDR, &hdev->quirks) || 632 test_bit(HCI_QUIRK_USE_BDADDR_PROPERTY, &hdev->quirks)) && 633 !bacmp(&hdev->public_addr, BDADDR_ANY)) 634 return false; 635 636 return true; 637 } 638 639 static __le32 get_missing_options(struct hci_dev *hdev) 640 { 641 u32 options = 0; 642 643 if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks) && 644 !hci_dev_test_flag(hdev, HCI_EXT_CONFIGURED)) 645 options |= MGMT_OPTION_EXTERNAL_CONFIG; 646 647 if ((test_bit(HCI_QUIRK_INVALID_BDADDR, &hdev->quirks) || 648 test_bit(HCI_QUIRK_USE_BDADDR_PROPERTY, &hdev->quirks)) && 649 !bacmp(&hdev->public_addr, BDADDR_ANY)) 650 options |= MGMT_OPTION_PUBLIC_ADDRESS; 651 652 return cpu_to_le32(options); 653 } 654 655 static int new_options(struct hci_dev *hdev, struct sock *skip) 656 { 657 __le32 options = get_missing_options(hdev); 658 659 return mgmt_limited_event(MGMT_EV_NEW_CONFIG_OPTIONS, hdev, &options, 660 sizeof(options), HCI_MGMT_OPTION_EVENTS, skip); 661 } 662 663 static int send_options_rsp(struct sock *sk, u16 opcode, struct hci_dev *hdev) 664 { 665 __le32 options = get_missing_options(hdev); 666 667 return mgmt_cmd_complete(sk, hdev->id, opcode, 0, &options, 668 sizeof(options)); 669 } 670 671 static int read_config_info(struct sock *sk, struct hci_dev *hdev, 672 void *data, u16 data_len) 673 { 674 struct mgmt_rp_read_config_info rp; 675 u32 options = 0; 676 677 bt_dev_dbg(hdev, "sock %p", sk); 678 679 hci_dev_lock(hdev); 680 681 memset(&rp, 0, sizeof(rp)); 682 rp.manufacturer = cpu_to_le16(hdev->manufacturer); 683 684 if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks)) 685 options |= MGMT_OPTION_EXTERNAL_CONFIG; 686 687 if (hdev->set_bdaddr) 688 options |= MGMT_OPTION_PUBLIC_ADDRESS; 689 690 rp.supported_options = cpu_to_le32(options); 691 rp.missing_options = get_missing_options(hdev); 692 693 hci_dev_unlock(hdev); 694 695 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_CONFIG_INFO, 0, 696 &rp, sizeof(rp)); 697 } 698 699 static u32 get_supported_phys(struct hci_dev *hdev) 700 { 701 u32 supported_phys = 0; 702 703 if (lmp_bredr_capable(hdev)) { 704 supported_phys |= MGMT_PHY_BR_1M_1SLOT; 705 706 if (hdev->features[0][0] & LMP_3SLOT) 707 supported_phys |= MGMT_PHY_BR_1M_3SLOT; 708 709 if (hdev->features[0][0] & LMP_5SLOT) 710 supported_phys |= MGMT_PHY_BR_1M_5SLOT; 711 712 if (lmp_edr_2m_capable(hdev)) { 713 supported_phys |= MGMT_PHY_EDR_2M_1SLOT; 714 715 if (lmp_edr_3slot_capable(hdev)) 716 supported_phys |= MGMT_PHY_EDR_2M_3SLOT; 717 718 if (lmp_edr_5slot_capable(hdev)) 719 supported_phys |= MGMT_PHY_EDR_2M_5SLOT; 720 721 if (lmp_edr_3m_capable(hdev)) { 722 supported_phys |= MGMT_PHY_EDR_3M_1SLOT; 723 724 if (lmp_edr_3slot_capable(hdev)) 725 supported_phys |= MGMT_PHY_EDR_3M_3SLOT; 726 727 if (lmp_edr_5slot_capable(hdev)) 728 supported_phys |= MGMT_PHY_EDR_3M_5SLOT; 729 } 730 } 731 } 732 733 if (lmp_le_capable(hdev)) { 734 supported_phys |= MGMT_PHY_LE_1M_TX; 735 supported_phys |= MGMT_PHY_LE_1M_RX; 736 737 if (hdev->le_features[1] & HCI_LE_PHY_2M) { 738 supported_phys |= MGMT_PHY_LE_2M_TX; 739 supported_phys |= MGMT_PHY_LE_2M_RX; 740 } 741 742 if (hdev->le_features[1] & HCI_LE_PHY_CODED) { 743 supported_phys |= MGMT_PHY_LE_CODED_TX; 744 supported_phys |= MGMT_PHY_LE_CODED_RX; 745 } 746 } 747 748 return supported_phys; 749 } 750 751 static u32 get_selected_phys(struct hci_dev *hdev) 752 { 753 u32 selected_phys = 0; 754 755 if (lmp_bredr_capable(hdev)) { 756 selected_phys |= MGMT_PHY_BR_1M_1SLOT; 757 758 if (hdev->pkt_type & (HCI_DM3 | HCI_DH3)) 759 selected_phys |= MGMT_PHY_BR_1M_3SLOT; 760 761 if (hdev->pkt_type & (HCI_DM5 | HCI_DH5)) 762 selected_phys |= MGMT_PHY_BR_1M_5SLOT; 763 764 if (lmp_edr_2m_capable(hdev)) { 765 if (!(hdev->pkt_type & HCI_2DH1)) 766 selected_phys |= MGMT_PHY_EDR_2M_1SLOT; 767 768 if (lmp_edr_3slot_capable(hdev) && 769 !(hdev->pkt_type & HCI_2DH3)) 770 selected_phys |= MGMT_PHY_EDR_2M_3SLOT; 771 772 if (lmp_edr_5slot_capable(hdev) && 773 !(hdev->pkt_type & HCI_2DH5)) 774 selected_phys |= MGMT_PHY_EDR_2M_5SLOT; 775 776 if (lmp_edr_3m_capable(hdev)) { 777 if (!(hdev->pkt_type & HCI_3DH1)) 778 selected_phys |= MGMT_PHY_EDR_3M_1SLOT; 779 780 if (lmp_edr_3slot_capable(hdev) && 781 !(hdev->pkt_type & HCI_3DH3)) 782 selected_phys |= MGMT_PHY_EDR_3M_3SLOT; 783 784 if (lmp_edr_5slot_capable(hdev) && 785 !(hdev->pkt_type & HCI_3DH5)) 786 selected_phys |= MGMT_PHY_EDR_3M_5SLOT; 787 } 788 } 789 } 790 791 if (lmp_le_capable(hdev)) { 792 if (hdev->le_tx_def_phys & HCI_LE_SET_PHY_1M) 793 selected_phys |= MGMT_PHY_LE_1M_TX; 794 795 if (hdev->le_rx_def_phys & HCI_LE_SET_PHY_1M) 796 selected_phys |= MGMT_PHY_LE_1M_RX; 797 798 if (hdev->le_tx_def_phys & HCI_LE_SET_PHY_2M) 799 selected_phys |= MGMT_PHY_LE_2M_TX; 800 801 if (hdev->le_rx_def_phys & HCI_LE_SET_PHY_2M) 802 selected_phys |= MGMT_PHY_LE_2M_RX; 803 804 if (hdev->le_tx_def_phys & HCI_LE_SET_PHY_CODED) 805 selected_phys |= MGMT_PHY_LE_CODED_TX; 806 807 if (hdev->le_rx_def_phys & HCI_LE_SET_PHY_CODED) 808 selected_phys |= MGMT_PHY_LE_CODED_RX; 809 } 810 811 return selected_phys; 812 } 813 814 static u32 get_configurable_phys(struct hci_dev *hdev) 815 { 816 return (get_supported_phys(hdev) & ~MGMT_PHY_BR_1M_1SLOT & 817 ~MGMT_PHY_LE_1M_TX & ~MGMT_PHY_LE_1M_RX); 818 } 819 820 static u32 get_supported_settings(struct hci_dev *hdev) 821 { 822 u32 settings = 0; 823 824 settings |= MGMT_SETTING_POWERED; 825 settings |= MGMT_SETTING_BONDABLE; 826 settings |= MGMT_SETTING_DEBUG_KEYS; 827 settings |= MGMT_SETTING_CONNECTABLE; 828 settings |= MGMT_SETTING_DISCOVERABLE; 829 830 if (lmp_bredr_capable(hdev)) { 831 if (hdev->hci_ver >= BLUETOOTH_VER_1_2) 832 settings |= MGMT_SETTING_FAST_CONNECTABLE; 833 settings |= MGMT_SETTING_BREDR; 834 settings |= MGMT_SETTING_LINK_SECURITY; 835 836 if (lmp_ssp_capable(hdev)) { 837 settings |= MGMT_SETTING_SSP; 838 if (IS_ENABLED(CONFIG_BT_HS)) 839 settings |= MGMT_SETTING_HS; 840 } 841 842 if (lmp_sc_capable(hdev)) 843 settings |= MGMT_SETTING_SECURE_CONN; 844 845 if (test_bit(HCI_QUIRK_WIDEBAND_SPEECH_SUPPORTED, 846 &hdev->quirks)) 847 settings |= MGMT_SETTING_WIDEBAND_SPEECH; 848 } 849 850 if (lmp_le_capable(hdev)) { 851 settings |= MGMT_SETTING_LE; 852 settings |= MGMT_SETTING_SECURE_CONN; 853 settings |= MGMT_SETTING_PRIVACY; 854 settings |= MGMT_SETTING_STATIC_ADDRESS; 855 settings |= MGMT_SETTING_ADVERTISING; 856 } 857 858 if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks) || 859 hdev->set_bdaddr) 860 settings |= MGMT_SETTING_CONFIGURATION; 861 862 if (cis_central_capable(hdev)) 863 settings |= MGMT_SETTING_CIS_CENTRAL; 864 865 if (cis_peripheral_capable(hdev)) 866 settings |= MGMT_SETTING_CIS_PERIPHERAL; 867 868 settings |= MGMT_SETTING_PHY_CONFIGURATION; 869 870 return settings; 871 } 872 873 static u32 get_current_settings(struct hci_dev *hdev) 874 { 875 u32 settings = 0; 876 877 if (hdev_is_powered(hdev)) 878 settings |= MGMT_SETTING_POWERED; 879 880 if (hci_dev_test_flag(hdev, HCI_CONNECTABLE)) 881 settings |= MGMT_SETTING_CONNECTABLE; 882 883 if (hci_dev_test_flag(hdev, HCI_FAST_CONNECTABLE)) 884 settings |= MGMT_SETTING_FAST_CONNECTABLE; 885 886 if (hci_dev_test_flag(hdev, HCI_DISCOVERABLE)) 887 settings |= MGMT_SETTING_DISCOVERABLE; 888 889 if (hci_dev_test_flag(hdev, HCI_BONDABLE)) 890 settings |= MGMT_SETTING_BONDABLE; 891 892 if (hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) 893 settings |= MGMT_SETTING_BREDR; 894 895 if (hci_dev_test_flag(hdev, HCI_LE_ENABLED)) 896 settings |= MGMT_SETTING_LE; 897 898 if (hci_dev_test_flag(hdev, HCI_LINK_SECURITY)) 899 settings |= MGMT_SETTING_LINK_SECURITY; 900 901 if (hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) 902 settings |= MGMT_SETTING_SSP; 903 904 if (hci_dev_test_flag(hdev, HCI_HS_ENABLED)) 905 settings |= MGMT_SETTING_HS; 906 907 if (hci_dev_test_flag(hdev, HCI_ADVERTISING)) 908 settings |= MGMT_SETTING_ADVERTISING; 909 910 if (hci_dev_test_flag(hdev, HCI_SC_ENABLED)) 911 settings |= MGMT_SETTING_SECURE_CONN; 912 913 if (hci_dev_test_flag(hdev, HCI_KEEP_DEBUG_KEYS)) 914 settings |= MGMT_SETTING_DEBUG_KEYS; 915 916 if (hci_dev_test_flag(hdev, HCI_PRIVACY)) 917 settings |= MGMT_SETTING_PRIVACY; 918 919 /* The current setting for static address has two purposes. The 920 * first is to indicate if the static address will be used and 921 * the second is to indicate if it is actually set. 922 * 923 * This means if the static address is not configured, this flag 924 * will never be set. If the address is configured, then if the 925 * address is actually used decides if the flag is set or not. 926 * 927 * For single mode LE only controllers and dual-mode controllers 928 * with BR/EDR disabled, the existence of the static address will 929 * be evaluated. 930 */ 931 if (hci_dev_test_flag(hdev, HCI_FORCE_STATIC_ADDR) || 932 !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) || 933 !bacmp(&hdev->bdaddr, BDADDR_ANY)) { 934 if (bacmp(&hdev->static_addr, BDADDR_ANY)) 935 settings |= MGMT_SETTING_STATIC_ADDRESS; 936 } 937 938 if (hci_dev_test_flag(hdev, HCI_WIDEBAND_SPEECH_ENABLED)) 939 settings |= MGMT_SETTING_WIDEBAND_SPEECH; 940 941 if (cis_central_capable(hdev)) 942 settings |= MGMT_SETTING_CIS_CENTRAL; 943 944 if (cis_peripheral_capable(hdev)) 945 settings |= MGMT_SETTING_CIS_PERIPHERAL; 946 947 if (bis_capable(hdev)) 948 settings |= MGMT_SETTING_ISO_BROADCASTER; 949 950 if (sync_recv_capable(hdev)) 951 settings |= MGMT_SETTING_ISO_SYNC_RECEIVER; 952 953 return settings; 954 } 955 956 static struct mgmt_pending_cmd *pending_find(u16 opcode, struct hci_dev *hdev) 957 { 958 return mgmt_pending_find(HCI_CHANNEL_CONTROL, opcode, hdev); 959 } 960 961 u8 mgmt_get_adv_discov_flags(struct hci_dev *hdev) 962 { 963 struct mgmt_pending_cmd *cmd; 964 965 /* If there's a pending mgmt command the flags will not yet have 966 * their final values, so check for this first. 967 */ 968 cmd = pending_find(MGMT_OP_SET_DISCOVERABLE, hdev); 969 if (cmd) { 970 struct mgmt_mode *cp = cmd->param; 971 if (cp->val == 0x01) 972 return LE_AD_GENERAL; 973 else if (cp->val == 0x02) 974 return LE_AD_LIMITED; 975 } else { 976 if (hci_dev_test_flag(hdev, HCI_LIMITED_DISCOVERABLE)) 977 return LE_AD_LIMITED; 978 else if (hci_dev_test_flag(hdev, HCI_DISCOVERABLE)) 979 return LE_AD_GENERAL; 980 } 981 982 return 0; 983 } 984 985 bool mgmt_get_connectable(struct hci_dev *hdev) 986 { 987 struct mgmt_pending_cmd *cmd; 988 989 /* If there's a pending mgmt command the flag will not yet have 990 * it's final value, so check for this first. 991 */ 992 cmd = pending_find(MGMT_OP_SET_CONNECTABLE, hdev); 993 if (cmd) { 994 struct mgmt_mode *cp = cmd->param; 995 996 return cp->val; 997 } 998 999 return hci_dev_test_flag(hdev, HCI_CONNECTABLE); 1000 } 1001 1002 static int service_cache_sync(struct hci_dev *hdev, void *data) 1003 { 1004 hci_update_eir_sync(hdev); 1005 hci_update_class_sync(hdev); 1006 1007 return 0; 1008 } 1009 1010 static void service_cache_off(struct work_struct *work) 1011 { 1012 struct hci_dev *hdev = container_of(work, struct hci_dev, 1013 service_cache.work); 1014 1015 if (!hci_dev_test_and_clear_flag(hdev, HCI_SERVICE_CACHE)) 1016 return; 1017 1018 hci_cmd_sync_queue(hdev, service_cache_sync, NULL, NULL); 1019 } 1020 1021 static int rpa_expired_sync(struct hci_dev *hdev, void *data) 1022 { 1023 /* The generation of a new RPA and programming it into the 1024 * controller happens in the hci_req_enable_advertising() 1025 * function. 1026 */ 1027 if (ext_adv_capable(hdev)) 1028 return hci_start_ext_adv_sync(hdev, hdev->cur_adv_instance); 1029 else 1030 return hci_enable_advertising_sync(hdev); 1031 } 1032 1033 static void rpa_expired(struct work_struct *work) 1034 { 1035 struct hci_dev *hdev = container_of(work, struct hci_dev, 1036 rpa_expired.work); 1037 1038 bt_dev_dbg(hdev, ""); 1039 1040 hci_dev_set_flag(hdev, HCI_RPA_EXPIRED); 1041 1042 if (!hci_dev_test_flag(hdev, HCI_ADVERTISING)) 1043 return; 1044 1045 hci_cmd_sync_queue(hdev, rpa_expired_sync, NULL, NULL); 1046 } 1047 1048 static void discov_off(struct work_struct *work) 1049 { 1050 struct hci_dev *hdev = container_of(work, struct hci_dev, 1051 discov_off.work); 1052 1053 bt_dev_dbg(hdev, ""); 1054 1055 hci_dev_lock(hdev); 1056 1057 /* When discoverable timeout triggers, then just make sure 1058 * the limited discoverable flag is cleared. Even in the case 1059 * of a timeout triggered from general discoverable, it is 1060 * safe to unconditionally clear the flag. 1061 */ 1062 hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE); 1063 hci_dev_clear_flag(hdev, HCI_DISCOVERABLE); 1064 hdev->discov_timeout = 0; 1065 1066 hci_update_discoverable(hdev); 1067 1068 mgmt_new_settings(hdev); 1069 1070 hci_dev_unlock(hdev); 1071 } 1072 1073 static int send_settings_rsp(struct sock *sk, u16 opcode, struct hci_dev *hdev); 1074 1075 static void mesh_send_complete(struct hci_dev *hdev, 1076 struct mgmt_mesh_tx *mesh_tx, bool silent) 1077 { 1078 u8 handle = mesh_tx->handle; 1079 1080 if (!silent) 1081 mgmt_event(MGMT_EV_MESH_PACKET_CMPLT, hdev, &handle, 1082 sizeof(handle), NULL); 1083 1084 mgmt_mesh_remove(mesh_tx); 1085 } 1086 1087 static int mesh_send_done_sync(struct hci_dev *hdev, void *data) 1088 { 1089 struct mgmt_mesh_tx *mesh_tx; 1090 1091 hci_dev_clear_flag(hdev, HCI_MESH_SENDING); 1092 hci_disable_advertising_sync(hdev); 1093 mesh_tx = mgmt_mesh_next(hdev, NULL); 1094 1095 if (mesh_tx) 1096 mesh_send_complete(hdev, mesh_tx, false); 1097 1098 return 0; 1099 } 1100 1101 static int mesh_send_sync(struct hci_dev *hdev, void *data); 1102 static void mesh_send_start_complete(struct hci_dev *hdev, void *data, int err); 1103 static void mesh_next(struct hci_dev *hdev, void *data, int err) 1104 { 1105 struct mgmt_mesh_tx *mesh_tx = mgmt_mesh_next(hdev, NULL); 1106 1107 if (!mesh_tx) 1108 return; 1109 1110 err = hci_cmd_sync_queue(hdev, mesh_send_sync, mesh_tx, 1111 mesh_send_start_complete); 1112 1113 if (err < 0) 1114 mesh_send_complete(hdev, mesh_tx, false); 1115 else 1116 hci_dev_set_flag(hdev, HCI_MESH_SENDING); 1117 } 1118 1119 static void mesh_send_done(struct work_struct *work) 1120 { 1121 struct hci_dev *hdev = container_of(work, struct hci_dev, 1122 mesh_send_done.work); 1123 1124 if (!hci_dev_test_flag(hdev, HCI_MESH_SENDING)) 1125 return; 1126 1127 hci_cmd_sync_queue(hdev, mesh_send_done_sync, NULL, mesh_next); 1128 } 1129 1130 static void mgmt_init_hdev(struct sock *sk, struct hci_dev *hdev) 1131 { 1132 if (hci_dev_test_flag(hdev, HCI_MGMT)) 1133 return; 1134 1135 BT_INFO("MGMT ver %d.%d", MGMT_VERSION, MGMT_REVISION); 1136 1137 INIT_DELAYED_WORK(&hdev->discov_off, discov_off); 1138 INIT_DELAYED_WORK(&hdev->service_cache, service_cache_off); 1139 INIT_DELAYED_WORK(&hdev->rpa_expired, rpa_expired); 1140 INIT_DELAYED_WORK(&hdev->mesh_send_done, mesh_send_done); 1141 1142 /* Non-mgmt controlled devices get this bit set 1143 * implicitly so that pairing works for them, however 1144 * for mgmt we require user-space to explicitly enable 1145 * it 1146 */ 1147 hci_dev_clear_flag(hdev, HCI_BONDABLE); 1148 1149 hci_dev_set_flag(hdev, HCI_MGMT); 1150 } 1151 1152 static int read_controller_info(struct sock *sk, struct hci_dev *hdev, 1153 void *data, u16 data_len) 1154 { 1155 struct mgmt_rp_read_info rp; 1156 1157 bt_dev_dbg(hdev, "sock %p", sk); 1158 1159 hci_dev_lock(hdev); 1160 1161 memset(&rp, 0, sizeof(rp)); 1162 1163 bacpy(&rp.bdaddr, &hdev->bdaddr); 1164 1165 rp.version = hdev->hci_ver; 1166 rp.manufacturer = cpu_to_le16(hdev->manufacturer); 1167 1168 rp.supported_settings = cpu_to_le32(get_supported_settings(hdev)); 1169 rp.current_settings = cpu_to_le32(get_current_settings(hdev)); 1170 1171 memcpy(rp.dev_class, hdev->dev_class, 3); 1172 1173 memcpy(rp.name, hdev->dev_name, sizeof(hdev->dev_name)); 1174 memcpy(rp.short_name, hdev->short_name, sizeof(hdev->short_name)); 1175 1176 hci_dev_unlock(hdev); 1177 1178 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_INFO, 0, &rp, 1179 sizeof(rp)); 1180 } 1181 1182 static u16 append_eir_data_to_buf(struct hci_dev *hdev, u8 *eir) 1183 { 1184 u16 eir_len = 0; 1185 size_t name_len; 1186 1187 if (hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) 1188 eir_len = eir_append_data(eir, eir_len, EIR_CLASS_OF_DEV, 1189 hdev->dev_class, 3); 1190 1191 if (hci_dev_test_flag(hdev, HCI_LE_ENABLED)) 1192 eir_len = eir_append_le16(eir, eir_len, EIR_APPEARANCE, 1193 hdev->appearance); 1194 1195 name_len = strnlen(hdev->dev_name, sizeof(hdev->dev_name)); 1196 eir_len = eir_append_data(eir, eir_len, EIR_NAME_COMPLETE, 1197 hdev->dev_name, name_len); 1198 1199 name_len = strnlen(hdev->short_name, sizeof(hdev->short_name)); 1200 eir_len = eir_append_data(eir, eir_len, EIR_NAME_SHORT, 1201 hdev->short_name, name_len); 1202 1203 return eir_len; 1204 } 1205 1206 static int read_ext_controller_info(struct sock *sk, struct hci_dev *hdev, 1207 void *data, u16 data_len) 1208 { 1209 char buf[512]; 1210 struct mgmt_rp_read_ext_info *rp = (void *)buf; 1211 u16 eir_len; 1212 1213 bt_dev_dbg(hdev, "sock %p", sk); 1214 1215 memset(&buf, 0, sizeof(buf)); 1216 1217 hci_dev_lock(hdev); 1218 1219 bacpy(&rp->bdaddr, &hdev->bdaddr); 1220 1221 rp->version = hdev->hci_ver; 1222 rp->manufacturer = cpu_to_le16(hdev->manufacturer); 1223 1224 rp->supported_settings = cpu_to_le32(get_supported_settings(hdev)); 1225 rp->current_settings = cpu_to_le32(get_current_settings(hdev)); 1226 1227 1228 eir_len = append_eir_data_to_buf(hdev, rp->eir); 1229 rp->eir_len = cpu_to_le16(eir_len); 1230 1231 hci_dev_unlock(hdev); 1232 1233 /* If this command is called at least once, then the events 1234 * for class of device and local name changes are disabled 1235 * and only the new extended controller information event 1236 * is used. 1237 */ 1238 hci_sock_set_flag(sk, HCI_MGMT_EXT_INFO_EVENTS); 1239 hci_sock_clear_flag(sk, HCI_MGMT_DEV_CLASS_EVENTS); 1240 hci_sock_clear_flag(sk, HCI_MGMT_LOCAL_NAME_EVENTS); 1241 1242 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_EXT_INFO, 0, rp, 1243 sizeof(*rp) + eir_len); 1244 } 1245 1246 static int ext_info_changed(struct hci_dev *hdev, struct sock *skip) 1247 { 1248 char buf[512]; 1249 struct mgmt_ev_ext_info_changed *ev = (void *)buf; 1250 u16 eir_len; 1251 1252 memset(buf, 0, sizeof(buf)); 1253 1254 eir_len = append_eir_data_to_buf(hdev, ev->eir); 1255 ev->eir_len = cpu_to_le16(eir_len); 1256 1257 return mgmt_limited_event(MGMT_EV_EXT_INFO_CHANGED, hdev, ev, 1258 sizeof(*ev) + eir_len, 1259 HCI_MGMT_EXT_INFO_EVENTS, skip); 1260 } 1261 1262 static int send_settings_rsp(struct sock *sk, u16 opcode, struct hci_dev *hdev) 1263 { 1264 __le32 settings = cpu_to_le32(get_current_settings(hdev)); 1265 1266 return mgmt_cmd_complete(sk, hdev->id, opcode, 0, &settings, 1267 sizeof(settings)); 1268 } 1269 1270 void mgmt_advertising_added(struct sock *sk, struct hci_dev *hdev, u8 instance) 1271 { 1272 struct mgmt_ev_advertising_added ev; 1273 1274 ev.instance = instance; 1275 1276 mgmt_event(MGMT_EV_ADVERTISING_ADDED, hdev, &ev, sizeof(ev), sk); 1277 } 1278 1279 void mgmt_advertising_removed(struct sock *sk, struct hci_dev *hdev, 1280 u8 instance) 1281 { 1282 struct mgmt_ev_advertising_removed ev; 1283 1284 ev.instance = instance; 1285 1286 mgmt_event(MGMT_EV_ADVERTISING_REMOVED, hdev, &ev, sizeof(ev), sk); 1287 } 1288 1289 static void cancel_adv_timeout(struct hci_dev *hdev) 1290 { 1291 if (hdev->adv_instance_timeout) { 1292 hdev->adv_instance_timeout = 0; 1293 cancel_delayed_work(&hdev->adv_instance_expire); 1294 } 1295 } 1296 1297 /* This function requires the caller holds hdev->lock */ 1298 static void restart_le_actions(struct hci_dev *hdev) 1299 { 1300 struct hci_conn_params *p; 1301 1302 list_for_each_entry(p, &hdev->le_conn_params, list) { 1303 /* Needed for AUTO_OFF case where might not "really" 1304 * have been powered off. 1305 */ 1306 hci_pend_le_list_del_init(p); 1307 1308 switch (p->auto_connect) { 1309 case HCI_AUTO_CONN_DIRECT: 1310 case HCI_AUTO_CONN_ALWAYS: 1311 hci_pend_le_list_add(p, &hdev->pend_le_conns); 1312 break; 1313 case HCI_AUTO_CONN_REPORT: 1314 hci_pend_le_list_add(p, &hdev->pend_le_reports); 1315 break; 1316 default: 1317 break; 1318 } 1319 } 1320 } 1321 1322 static int new_settings(struct hci_dev *hdev, struct sock *skip) 1323 { 1324 __le32 ev = cpu_to_le32(get_current_settings(hdev)); 1325 1326 return mgmt_limited_event(MGMT_EV_NEW_SETTINGS, hdev, &ev, 1327 sizeof(ev), HCI_MGMT_SETTING_EVENTS, skip); 1328 } 1329 1330 static void mgmt_set_powered_complete(struct hci_dev *hdev, void *data, int err) 1331 { 1332 struct mgmt_pending_cmd *cmd = data; 1333 struct mgmt_mode *cp; 1334 1335 /* Make sure cmd still outstanding. */ 1336 if (cmd != pending_find(MGMT_OP_SET_POWERED, hdev)) 1337 return; 1338 1339 cp = cmd->param; 1340 1341 bt_dev_dbg(hdev, "err %d", err); 1342 1343 if (!err) { 1344 if (cp->val) { 1345 hci_dev_lock(hdev); 1346 restart_le_actions(hdev); 1347 hci_update_passive_scan(hdev); 1348 hci_dev_unlock(hdev); 1349 } 1350 1351 send_settings_rsp(cmd->sk, cmd->opcode, hdev); 1352 1353 /* Only call new_setting for power on as power off is deferred 1354 * to hdev->power_off work which does call hci_dev_do_close. 1355 */ 1356 if (cp->val) 1357 new_settings(hdev, cmd->sk); 1358 } else { 1359 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_POWERED, 1360 mgmt_status(err)); 1361 } 1362 1363 mgmt_pending_remove(cmd); 1364 } 1365 1366 static int set_powered_sync(struct hci_dev *hdev, void *data) 1367 { 1368 struct mgmt_pending_cmd *cmd = data; 1369 struct mgmt_mode *cp = cmd->param; 1370 1371 BT_DBG("%s", hdev->name); 1372 1373 return hci_set_powered_sync(hdev, cp->val); 1374 } 1375 1376 static int set_powered(struct sock *sk, struct hci_dev *hdev, void *data, 1377 u16 len) 1378 { 1379 struct mgmt_mode *cp = data; 1380 struct mgmt_pending_cmd *cmd; 1381 int err; 1382 1383 bt_dev_dbg(hdev, "sock %p", sk); 1384 1385 if (cp->val != 0x00 && cp->val != 0x01) 1386 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED, 1387 MGMT_STATUS_INVALID_PARAMS); 1388 1389 hci_dev_lock(hdev); 1390 1391 if (pending_find(MGMT_OP_SET_POWERED, hdev)) { 1392 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED, 1393 MGMT_STATUS_BUSY); 1394 goto failed; 1395 } 1396 1397 if (!!cp->val == hdev_is_powered(hdev)) { 1398 err = send_settings_rsp(sk, MGMT_OP_SET_POWERED, hdev); 1399 goto failed; 1400 } 1401 1402 cmd = mgmt_pending_add(sk, MGMT_OP_SET_POWERED, hdev, data, len); 1403 if (!cmd) { 1404 err = -ENOMEM; 1405 goto failed; 1406 } 1407 1408 /* Cancel potentially blocking sync operation before power off */ 1409 if (cp->val == 0x00) { 1410 __hci_cmd_sync_cancel(hdev, -EHOSTDOWN); 1411 err = hci_cmd_sync_queue(hdev, set_powered_sync, cmd, 1412 mgmt_set_powered_complete); 1413 } else { 1414 /* Use hci_cmd_sync_submit since hdev might not be running */ 1415 err = hci_cmd_sync_submit(hdev, set_powered_sync, cmd, 1416 mgmt_set_powered_complete); 1417 } 1418 1419 if (err < 0) 1420 mgmt_pending_remove(cmd); 1421 1422 failed: 1423 hci_dev_unlock(hdev); 1424 return err; 1425 } 1426 1427 int mgmt_new_settings(struct hci_dev *hdev) 1428 { 1429 return new_settings(hdev, NULL); 1430 } 1431 1432 struct cmd_lookup { 1433 struct sock *sk; 1434 struct hci_dev *hdev; 1435 u8 mgmt_status; 1436 }; 1437 1438 static void settings_rsp(struct mgmt_pending_cmd *cmd, void *data) 1439 { 1440 struct cmd_lookup *match = data; 1441 1442 send_settings_rsp(cmd->sk, cmd->opcode, match->hdev); 1443 1444 list_del(&cmd->list); 1445 1446 if (match->sk == NULL) { 1447 match->sk = cmd->sk; 1448 sock_hold(match->sk); 1449 } 1450 1451 mgmt_pending_free(cmd); 1452 } 1453 1454 static void cmd_status_rsp(struct mgmt_pending_cmd *cmd, void *data) 1455 { 1456 u8 *status = data; 1457 1458 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, *status); 1459 mgmt_pending_remove(cmd); 1460 } 1461 1462 static void cmd_complete_rsp(struct mgmt_pending_cmd *cmd, void *data) 1463 { 1464 if (cmd->cmd_complete) { 1465 u8 *status = data; 1466 1467 cmd->cmd_complete(cmd, *status); 1468 mgmt_pending_remove(cmd); 1469 1470 return; 1471 } 1472 1473 cmd_status_rsp(cmd, data); 1474 } 1475 1476 static int generic_cmd_complete(struct mgmt_pending_cmd *cmd, u8 status) 1477 { 1478 return mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, status, 1479 cmd->param, cmd->param_len); 1480 } 1481 1482 static int addr_cmd_complete(struct mgmt_pending_cmd *cmd, u8 status) 1483 { 1484 return mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, status, 1485 cmd->param, sizeof(struct mgmt_addr_info)); 1486 } 1487 1488 static u8 mgmt_bredr_support(struct hci_dev *hdev) 1489 { 1490 if (!lmp_bredr_capable(hdev)) 1491 return MGMT_STATUS_NOT_SUPPORTED; 1492 else if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) 1493 return MGMT_STATUS_REJECTED; 1494 else 1495 return MGMT_STATUS_SUCCESS; 1496 } 1497 1498 static u8 mgmt_le_support(struct hci_dev *hdev) 1499 { 1500 if (!lmp_le_capable(hdev)) 1501 return MGMT_STATUS_NOT_SUPPORTED; 1502 else if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED)) 1503 return MGMT_STATUS_REJECTED; 1504 else 1505 return MGMT_STATUS_SUCCESS; 1506 } 1507 1508 static void mgmt_set_discoverable_complete(struct hci_dev *hdev, void *data, 1509 int err) 1510 { 1511 struct mgmt_pending_cmd *cmd = data; 1512 1513 bt_dev_dbg(hdev, "err %d", err); 1514 1515 /* Make sure cmd still outstanding. */ 1516 if (cmd != pending_find(MGMT_OP_SET_DISCOVERABLE, hdev)) 1517 return; 1518 1519 hci_dev_lock(hdev); 1520 1521 if (err) { 1522 u8 mgmt_err = mgmt_status(err); 1523 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err); 1524 hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE); 1525 goto done; 1526 } 1527 1528 if (hci_dev_test_flag(hdev, HCI_DISCOVERABLE) && 1529 hdev->discov_timeout > 0) { 1530 int to = msecs_to_jiffies(hdev->discov_timeout * 1000); 1531 queue_delayed_work(hdev->req_workqueue, &hdev->discov_off, to); 1532 } 1533 1534 send_settings_rsp(cmd->sk, MGMT_OP_SET_DISCOVERABLE, hdev); 1535 new_settings(hdev, cmd->sk); 1536 1537 done: 1538 mgmt_pending_remove(cmd); 1539 hci_dev_unlock(hdev); 1540 } 1541 1542 static int set_discoverable_sync(struct hci_dev *hdev, void *data) 1543 { 1544 BT_DBG("%s", hdev->name); 1545 1546 return hci_update_discoverable_sync(hdev); 1547 } 1548 1549 static int set_discoverable(struct sock *sk, struct hci_dev *hdev, void *data, 1550 u16 len) 1551 { 1552 struct mgmt_cp_set_discoverable *cp = data; 1553 struct mgmt_pending_cmd *cmd; 1554 u16 timeout; 1555 int err; 1556 1557 bt_dev_dbg(hdev, "sock %p", sk); 1558 1559 if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED) && 1560 !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) 1561 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE, 1562 MGMT_STATUS_REJECTED); 1563 1564 if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02) 1565 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE, 1566 MGMT_STATUS_INVALID_PARAMS); 1567 1568 timeout = __le16_to_cpu(cp->timeout); 1569 1570 /* Disabling discoverable requires that no timeout is set, 1571 * and enabling limited discoverable requires a timeout. 1572 */ 1573 if ((cp->val == 0x00 && timeout > 0) || 1574 (cp->val == 0x02 && timeout == 0)) 1575 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE, 1576 MGMT_STATUS_INVALID_PARAMS); 1577 1578 hci_dev_lock(hdev); 1579 1580 if (!hdev_is_powered(hdev) && timeout > 0) { 1581 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE, 1582 MGMT_STATUS_NOT_POWERED); 1583 goto failed; 1584 } 1585 1586 if (pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) || 1587 pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) { 1588 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE, 1589 MGMT_STATUS_BUSY); 1590 goto failed; 1591 } 1592 1593 if (!hci_dev_test_flag(hdev, HCI_CONNECTABLE)) { 1594 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE, 1595 MGMT_STATUS_REJECTED); 1596 goto failed; 1597 } 1598 1599 if (hdev->advertising_paused) { 1600 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE, 1601 MGMT_STATUS_BUSY); 1602 goto failed; 1603 } 1604 1605 if (!hdev_is_powered(hdev)) { 1606 bool changed = false; 1607 1608 /* Setting limited discoverable when powered off is 1609 * not a valid operation since it requires a timeout 1610 * and so no need to check HCI_LIMITED_DISCOVERABLE. 1611 */ 1612 if (!!cp->val != hci_dev_test_flag(hdev, HCI_DISCOVERABLE)) { 1613 hci_dev_change_flag(hdev, HCI_DISCOVERABLE); 1614 changed = true; 1615 } 1616 1617 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev); 1618 if (err < 0) 1619 goto failed; 1620 1621 if (changed) 1622 err = new_settings(hdev, sk); 1623 1624 goto failed; 1625 } 1626 1627 /* If the current mode is the same, then just update the timeout 1628 * value with the new value. And if only the timeout gets updated, 1629 * then no need for any HCI transactions. 1630 */ 1631 if (!!cp->val == hci_dev_test_flag(hdev, HCI_DISCOVERABLE) && 1632 (cp->val == 0x02) == hci_dev_test_flag(hdev, 1633 HCI_LIMITED_DISCOVERABLE)) { 1634 cancel_delayed_work(&hdev->discov_off); 1635 hdev->discov_timeout = timeout; 1636 1637 if (cp->val && hdev->discov_timeout > 0) { 1638 int to = msecs_to_jiffies(hdev->discov_timeout * 1000); 1639 queue_delayed_work(hdev->req_workqueue, 1640 &hdev->discov_off, to); 1641 } 1642 1643 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev); 1644 goto failed; 1645 } 1646 1647 cmd = mgmt_pending_add(sk, MGMT_OP_SET_DISCOVERABLE, hdev, data, len); 1648 if (!cmd) { 1649 err = -ENOMEM; 1650 goto failed; 1651 } 1652 1653 /* Cancel any potential discoverable timeout that might be 1654 * still active and store new timeout value. The arming of 1655 * the timeout happens in the complete handler. 1656 */ 1657 cancel_delayed_work(&hdev->discov_off); 1658 hdev->discov_timeout = timeout; 1659 1660 if (cp->val) 1661 hci_dev_set_flag(hdev, HCI_DISCOVERABLE); 1662 else 1663 hci_dev_clear_flag(hdev, HCI_DISCOVERABLE); 1664 1665 /* Limited discoverable mode */ 1666 if (cp->val == 0x02) 1667 hci_dev_set_flag(hdev, HCI_LIMITED_DISCOVERABLE); 1668 else 1669 hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE); 1670 1671 err = hci_cmd_sync_queue(hdev, set_discoverable_sync, cmd, 1672 mgmt_set_discoverable_complete); 1673 1674 if (err < 0) 1675 mgmt_pending_remove(cmd); 1676 1677 failed: 1678 hci_dev_unlock(hdev); 1679 return err; 1680 } 1681 1682 static void mgmt_set_connectable_complete(struct hci_dev *hdev, void *data, 1683 int err) 1684 { 1685 struct mgmt_pending_cmd *cmd = data; 1686 1687 bt_dev_dbg(hdev, "err %d", err); 1688 1689 /* Make sure cmd still outstanding. */ 1690 if (cmd != pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) 1691 return; 1692 1693 hci_dev_lock(hdev); 1694 1695 if (err) { 1696 u8 mgmt_err = mgmt_status(err); 1697 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err); 1698 goto done; 1699 } 1700 1701 send_settings_rsp(cmd->sk, MGMT_OP_SET_CONNECTABLE, hdev); 1702 new_settings(hdev, cmd->sk); 1703 1704 done: 1705 if (cmd) 1706 mgmt_pending_remove(cmd); 1707 1708 hci_dev_unlock(hdev); 1709 } 1710 1711 static int set_connectable_update_settings(struct hci_dev *hdev, 1712 struct sock *sk, u8 val) 1713 { 1714 bool changed = false; 1715 int err; 1716 1717 if (!!val != hci_dev_test_flag(hdev, HCI_CONNECTABLE)) 1718 changed = true; 1719 1720 if (val) { 1721 hci_dev_set_flag(hdev, HCI_CONNECTABLE); 1722 } else { 1723 hci_dev_clear_flag(hdev, HCI_CONNECTABLE); 1724 hci_dev_clear_flag(hdev, HCI_DISCOVERABLE); 1725 } 1726 1727 err = send_settings_rsp(sk, MGMT_OP_SET_CONNECTABLE, hdev); 1728 if (err < 0) 1729 return err; 1730 1731 if (changed) { 1732 hci_update_scan(hdev); 1733 hci_update_passive_scan(hdev); 1734 return new_settings(hdev, sk); 1735 } 1736 1737 return 0; 1738 } 1739 1740 static int set_connectable_sync(struct hci_dev *hdev, void *data) 1741 { 1742 BT_DBG("%s", hdev->name); 1743 1744 return hci_update_connectable_sync(hdev); 1745 } 1746 1747 static int set_connectable(struct sock *sk, struct hci_dev *hdev, void *data, 1748 u16 len) 1749 { 1750 struct mgmt_mode *cp = data; 1751 struct mgmt_pending_cmd *cmd; 1752 int err; 1753 1754 bt_dev_dbg(hdev, "sock %p", sk); 1755 1756 if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED) && 1757 !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) 1758 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE, 1759 MGMT_STATUS_REJECTED); 1760 1761 if (cp->val != 0x00 && cp->val != 0x01) 1762 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE, 1763 MGMT_STATUS_INVALID_PARAMS); 1764 1765 hci_dev_lock(hdev); 1766 1767 if (!hdev_is_powered(hdev)) { 1768 err = set_connectable_update_settings(hdev, sk, cp->val); 1769 goto failed; 1770 } 1771 1772 if (pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) || 1773 pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) { 1774 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE, 1775 MGMT_STATUS_BUSY); 1776 goto failed; 1777 } 1778 1779 cmd = mgmt_pending_add(sk, MGMT_OP_SET_CONNECTABLE, hdev, data, len); 1780 if (!cmd) { 1781 err = -ENOMEM; 1782 goto failed; 1783 } 1784 1785 if (cp->val) { 1786 hci_dev_set_flag(hdev, HCI_CONNECTABLE); 1787 } else { 1788 if (hdev->discov_timeout > 0) 1789 cancel_delayed_work(&hdev->discov_off); 1790 1791 hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE); 1792 hci_dev_clear_flag(hdev, HCI_DISCOVERABLE); 1793 hci_dev_clear_flag(hdev, HCI_CONNECTABLE); 1794 } 1795 1796 err = hci_cmd_sync_queue(hdev, set_connectable_sync, cmd, 1797 mgmt_set_connectable_complete); 1798 1799 if (err < 0) 1800 mgmt_pending_remove(cmd); 1801 1802 failed: 1803 hci_dev_unlock(hdev); 1804 return err; 1805 } 1806 1807 static int set_bondable(struct sock *sk, struct hci_dev *hdev, void *data, 1808 u16 len) 1809 { 1810 struct mgmt_mode *cp = data; 1811 bool changed; 1812 int err; 1813 1814 bt_dev_dbg(hdev, "sock %p", sk); 1815 1816 if (cp->val != 0x00 && cp->val != 0x01) 1817 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BONDABLE, 1818 MGMT_STATUS_INVALID_PARAMS); 1819 1820 hci_dev_lock(hdev); 1821 1822 if (cp->val) 1823 changed = !hci_dev_test_and_set_flag(hdev, HCI_BONDABLE); 1824 else 1825 changed = hci_dev_test_and_clear_flag(hdev, HCI_BONDABLE); 1826 1827 err = send_settings_rsp(sk, MGMT_OP_SET_BONDABLE, hdev); 1828 if (err < 0) 1829 goto unlock; 1830 1831 if (changed) { 1832 /* In limited privacy mode the change of bondable mode 1833 * may affect the local advertising address. 1834 */ 1835 hci_update_discoverable(hdev); 1836 1837 err = new_settings(hdev, sk); 1838 } 1839 1840 unlock: 1841 hci_dev_unlock(hdev); 1842 return err; 1843 } 1844 1845 static int set_link_security(struct sock *sk, struct hci_dev *hdev, void *data, 1846 u16 len) 1847 { 1848 struct mgmt_mode *cp = data; 1849 struct mgmt_pending_cmd *cmd; 1850 u8 val, status; 1851 int err; 1852 1853 bt_dev_dbg(hdev, "sock %p", sk); 1854 1855 status = mgmt_bredr_support(hdev); 1856 if (status) 1857 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY, 1858 status); 1859 1860 if (cp->val != 0x00 && cp->val != 0x01) 1861 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY, 1862 MGMT_STATUS_INVALID_PARAMS); 1863 1864 hci_dev_lock(hdev); 1865 1866 if (!hdev_is_powered(hdev)) { 1867 bool changed = false; 1868 1869 if (!!cp->val != hci_dev_test_flag(hdev, HCI_LINK_SECURITY)) { 1870 hci_dev_change_flag(hdev, HCI_LINK_SECURITY); 1871 changed = true; 1872 } 1873 1874 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev); 1875 if (err < 0) 1876 goto failed; 1877 1878 if (changed) 1879 err = new_settings(hdev, sk); 1880 1881 goto failed; 1882 } 1883 1884 if (pending_find(MGMT_OP_SET_LINK_SECURITY, hdev)) { 1885 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY, 1886 MGMT_STATUS_BUSY); 1887 goto failed; 1888 } 1889 1890 val = !!cp->val; 1891 1892 if (test_bit(HCI_AUTH, &hdev->flags) == val) { 1893 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev); 1894 goto failed; 1895 } 1896 1897 cmd = mgmt_pending_add(sk, MGMT_OP_SET_LINK_SECURITY, hdev, data, len); 1898 if (!cmd) { 1899 err = -ENOMEM; 1900 goto failed; 1901 } 1902 1903 err = hci_send_cmd(hdev, HCI_OP_WRITE_AUTH_ENABLE, sizeof(val), &val); 1904 if (err < 0) { 1905 mgmt_pending_remove(cmd); 1906 goto failed; 1907 } 1908 1909 failed: 1910 hci_dev_unlock(hdev); 1911 return err; 1912 } 1913 1914 static void set_ssp_complete(struct hci_dev *hdev, void *data, int err) 1915 { 1916 struct cmd_lookup match = { NULL, hdev }; 1917 struct mgmt_pending_cmd *cmd = data; 1918 struct mgmt_mode *cp = cmd->param; 1919 u8 enable = cp->val; 1920 bool changed; 1921 1922 /* Make sure cmd still outstanding. */ 1923 if (cmd != pending_find(MGMT_OP_SET_SSP, hdev)) 1924 return; 1925 1926 if (err) { 1927 u8 mgmt_err = mgmt_status(err); 1928 1929 if (enable && hci_dev_test_and_clear_flag(hdev, 1930 HCI_SSP_ENABLED)) { 1931 hci_dev_clear_flag(hdev, HCI_HS_ENABLED); 1932 new_settings(hdev, NULL); 1933 } 1934 1935 mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev, cmd_status_rsp, 1936 &mgmt_err); 1937 return; 1938 } 1939 1940 if (enable) { 1941 changed = !hci_dev_test_and_set_flag(hdev, HCI_SSP_ENABLED); 1942 } else { 1943 changed = hci_dev_test_and_clear_flag(hdev, HCI_SSP_ENABLED); 1944 1945 if (!changed) 1946 changed = hci_dev_test_and_clear_flag(hdev, 1947 HCI_HS_ENABLED); 1948 else 1949 hci_dev_clear_flag(hdev, HCI_HS_ENABLED); 1950 } 1951 1952 mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev, settings_rsp, &match); 1953 1954 if (changed) 1955 new_settings(hdev, match.sk); 1956 1957 if (match.sk) 1958 sock_put(match.sk); 1959 1960 hci_update_eir_sync(hdev); 1961 } 1962 1963 static int set_ssp_sync(struct hci_dev *hdev, void *data) 1964 { 1965 struct mgmt_pending_cmd *cmd = data; 1966 struct mgmt_mode *cp = cmd->param; 1967 bool changed = false; 1968 int err; 1969 1970 if (cp->val) 1971 changed = !hci_dev_test_and_set_flag(hdev, HCI_SSP_ENABLED); 1972 1973 err = hci_write_ssp_mode_sync(hdev, cp->val); 1974 1975 if (!err && changed) 1976 hci_dev_clear_flag(hdev, HCI_SSP_ENABLED); 1977 1978 return err; 1979 } 1980 1981 static int set_ssp(struct sock *sk, struct hci_dev *hdev, void *data, u16 len) 1982 { 1983 struct mgmt_mode *cp = data; 1984 struct mgmt_pending_cmd *cmd; 1985 u8 status; 1986 int err; 1987 1988 bt_dev_dbg(hdev, "sock %p", sk); 1989 1990 status = mgmt_bredr_support(hdev); 1991 if (status) 1992 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP, status); 1993 1994 if (!lmp_ssp_capable(hdev)) 1995 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP, 1996 MGMT_STATUS_NOT_SUPPORTED); 1997 1998 if (cp->val != 0x00 && cp->val != 0x01) 1999 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP, 2000 MGMT_STATUS_INVALID_PARAMS); 2001 2002 hci_dev_lock(hdev); 2003 2004 if (!hdev_is_powered(hdev)) { 2005 bool changed; 2006 2007 if (cp->val) { 2008 changed = !hci_dev_test_and_set_flag(hdev, 2009 HCI_SSP_ENABLED); 2010 } else { 2011 changed = hci_dev_test_and_clear_flag(hdev, 2012 HCI_SSP_ENABLED); 2013 if (!changed) 2014 changed = hci_dev_test_and_clear_flag(hdev, 2015 HCI_HS_ENABLED); 2016 else 2017 hci_dev_clear_flag(hdev, HCI_HS_ENABLED); 2018 } 2019 2020 err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev); 2021 if (err < 0) 2022 goto failed; 2023 2024 if (changed) 2025 err = new_settings(hdev, sk); 2026 2027 goto failed; 2028 } 2029 2030 if (pending_find(MGMT_OP_SET_SSP, hdev)) { 2031 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP, 2032 MGMT_STATUS_BUSY); 2033 goto failed; 2034 } 2035 2036 if (!!cp->val == hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) { 2037 err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev); 2038 goto failed; 2039 } 2040 2041 cmd = mgmt_pending_add(sk, MGMT_OP_SET_SSP, hdev, data, len); 2042 if (!cmd) 2043 err = -ENOMEM; 2044 else 2045 err = hci_cmd_sync_queue(hdev, set_ssp_sync, cmd, 2046 set_ssp_complete); 2047 2048 if (err < 0) { 2049 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP, 2050 MGMT_STATUS_FAILED); 2051 2052 if (cmd) 2053 mgmt_pending_remove(cmd); 2054 } 2055 2056 failed: 2057 hci_dev_unlock(hdev); 2058 return err; 2059 } 2060 2061 static int set_hs(struct sock *sk, struct hci_dev *hdev, void *data, u16 len) 2062 { 2063 struct mgmt_mode *cp = data; 2064 bool changed; 2065 u8 status; 2066 int err; 2067 2068 bt_dev_dbg(hdev, "sock %p", sk); 2069 2070 if (!IS_ENABLED(CONFIG_BT_HS)) 2071 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS, 2072 MGMT_STATUS_NOT_SUPPORTED); 2073 2074 status = mgmt_bredr_support(hdev); 2075 if (status) 2076 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS, status); 2077 2078 if (!lmp_ssp_capable(hdev)) 2079 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS, 2080 MGMT_STATUS_NOT_SUPPORTED); 2081 2082 if (!hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) 2083 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS, 2084 MGMT_STATUS_REJECTED); 2085 2086 if (cp->val != 0x00 && cp->val != 0x01) 2087 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS, 2088 MGMT_STATUS_INVALID_PARAMS); 2089 2090 hci_dev_lock(hdev); 2091 2092 if (pending_find(MGMT_OP_SET_SSP, hdev)) { 2093 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS, 2094 MGMT_STATUS_BUSY); 2095 goto unlock; 2096 } 2097 2098 if (cp->val) { 2099 changed = !hci_dev_test_and_set_flag(hdev, HCI_HS_ENABLED); 2100 } else { 2101 if (hdev_is_powered(hdev)) { 2102 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS, 2103 MGMT_STATUS_REJECTED); 2104 goto unlock; 2105 } 2106 2107 changed = hci_dev_test_and_clear_flag(hdev, HCI_HS_ENABLED); 2108 } 2109 2110 err = send_settings_rsp(sk, MGMT_OP_SET_HS, hdev); 2111 if (err < 0) 2112 goto unlock; 2113 2114 if (changed) 2115 err = new_settings(hdev, sk); 2116 2117 unlock: 2118 hci_dev_unlock(hdev); 2119 return err; 2120 } 2121 2122 static void set_le_complete(struct hci_dev *hdev, void *data, int err) 2123 { 2124 struct cmd_lookup match = { NULL, hdev }; 2125 u8 status = mgmt_status(err); 2126 2127 bt_dev_dbg(hdev, "err %d", err); 2128 2129 if (status) { 2130 mgmt_pending_foreach(MGMT_OP_SET_LE, hdev, cmd_status_rsp, 2131 &status); 2132 return; 2133 } 2134 2135 mgmt_pending_foreach(MGMT_OP_SET_LE, hdev, settings_rsp, &match); 2136 2137 new_settings(hdev, match.sk); 2138 2139 if (match.sk) 2140 sock_put(match.sk); 2141 } 2142 2143 static int set_le_sync(struct hci_dev *hdev, void *data) 2144 { 2145 struct mgmt_pending_cmd *cmd = data; 2146 struct mgmt_mode *cp = cmd->param; 2147 u8 val = !!cp->val; 2148 int err; 2149 2150 if (!val) { 2151 hci_clear_adv_instance_sync(hdev, NULL, 0x00, true); 2152 2153 if (hci_dev_test_flag(hdev, HCI_LE_ADV)) 2154 hci_disable_advertising_sync(hdev); 2155 2156 if (ext_adv_capable(hdev)) 2157 hci_remove_ext_adv_instance_sync(hdev, 0, cmd->sk); 2158 } else { 2159 hci_dev_set_flag(hdev, HCI_LE_ENABLED); 2160 } 2161 2162 err = hci_write_le_host_supported_sync(hdev, val, 0); 2163 2164 /* Make sure the controller has a good default for 2165 * advertising data. Restrict the update to when LE 2166 * has actually been enabled. During power on, the 2167 * update in powered_update_hci will take care of it. 2168 */ 2169 if (!err && hci_dev_test_flag(hdev, HCI_LE_ENABLED)) { 2170 if (ext_adv_capable(hdev)) { 2171 int status; 2172 2173 status = hci_setup_ext_adv_instance_sync(hdev, 0x00); 2174 if (!status) 2175 hci_update_scan_rsp_data_sync(hdev, 0x00); 2176 } else { 2177 hci_update_adv_data_sync(hdev, 0x00); 2178 hci_update_scan_rsp_data_sync(hdev, 0x00); 2179 } 2180 2181 hci_update_passive_scan(hdev); 2182 } 2183 2184 return err; 2185 } 2186 2187 static void set_mesh_complete(struct hci_dev *hdev, void *data, int err) 2188 { 2189 struct mgmt_pending_cmd *cmd = data; 2190 u8 status = mgmt_status(err); 2191 struct sock *sk = cmd->sk; 2192 2193 if (status) { 2194 mgmt_pending_foreach(MGMT_OP_SET_MESH_RECEIVER, hdev, 2195 cmd_status_rsp, &status); 2196 return; 2197 } 2198 2199 mgmt_pending_remove(cmd); 2200 mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_MESH_RECEIVER, 0, NULL, 0); 2201 } 2202 2203 static int set_mesh_sync(struct hci_dev *hdev, void *data) 2204 { 2205 struct mgmt_pending_cmd *cmd = data; 2206 struct mgmt_cp_set_mesh *cp = cmd->param; 2207 size_t len = cmd->param_len; 2208 2209 memset(hdev->mesh_ad_types, 0, sizeof(hdev->mesh_ad_types)); 2210 2211 if (cp->enable) 2212 hci_dev_set_flag(hdev, HCI_MESH); 2213 else 2214 hci_dev_clear_flag(hdev, HCI_MESH); 2215 2216 len -= sizeof(*cp); 2217 2218 /* If filters don't fit, forward all adv pkts */ 2219 if (len <= sizeof(hdev->mesh_ad_types)) 2220 memcpy(hdev->mesh_ad_types, cp->ad_types, len); 2221 2222 hci_update_passive_scan_sync(hdev); 2223 return 0; 2224 } 2225 2226 static int set_mesh(struct sock *sk, struct hci_dev *hdev, void *data, u16 len) 2227 { 2228 struct mgmt_cp_set_mesh *cp = data; 2229 struct mgmt_pending_cmd *cmd; 2230 int err = 0; 2231 2232 bt_dev_dbg(hdev, "sock %p", sk); 2233 2234 if (!lmp_le_capable(hdev) || 2235 !hci_dev_test_flag(hdev, HCI_MESH_EXPERIMENTAL)) 2236 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_MESH_RECEIVER, 2237 MGMT_STATUS_NOT_SUPPORTED); 2238 2239 if (cp->enable != 0x00 && cp->enable != 0x01) 2240 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_MESH_RECEIVER, 2241 MGMT_STATUS_INVALID_PARAMS); 2242 2243 hci_dev_lock(hdev); 2244 2245 cmd = mgmt_pending_add(sk, MGMT_OP_SET_MESH_RECEIVER, hdev, data, len); 2246 if (!cmd) 2247 err = -ENOMEM; 2248 else 2249 err = hci_cmd_sync_queue(hdev, set_mesh_sync, cmd, 2250 set_mesh_complete); 2251 2252 if (err < 0) { 2253 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_MESH_RECEIVER, 2254 MGMT_STATUS_FAILED); 2255 2256 if (cmd) 2257 mgmt_pending_remove(cmd); 2258 } 2259 2260 hci_dev_unlock(hdev); 2261 return err; 2262 } 2263 2264 static void mesh_send_start_complete(struct hci_dev *hdev, void *data, int err) 2265 { 2266 struct mgmt_mesh_tx *mesh_tx = data; 2267 struct mgmt_cp_mesh_send *send = (void *)mesh_tx->param; 2268 unsigned long mesh_send_interval; 2269 u8 mgmt_err = mgmt_status(err); 2270 2271 /* Report any errors here, but don't report completion */ 2272 2273 if (mgmt_err) { 2274 hci_dev_clear_flag(hdev, HCI_MESH_SENDING); 2275 /* Send Complete Error Code for handle */ 2276 mesh_send_complete(hdev, mesh_tx, false); 2277 return; 2278 } 2279 2280 mesh_send_interval = msecs_to_jiffies((send->cnt) * 25); 2281 queue_delayed_work(hdev->req_workqueue, &hdev->mesh_send_done, 2282 mesh_send_interval); 2283 } 2284 2285 static int mesh_send_sync(struct hci_dev *hdev, void *data) 2286 { 2287 struct mgmt_mesh_tx *mesh_tx = data; 2288 struct mgmt_cp_mesh_send *send = (void *)mesh_tx->param; 2289 struct adv_info *adv, *next_instance; 2290 u8 instance = hdev->le_num_of_adv_sets + 1; 2291 u16 timeout, duration; 2292 int err = 0; 2293 2294 if (hdev->le_num_of_adv_sets <= hdev->adv_instance_cnt) 2295 return MGMT_STATUS_BUSY; 2296 2297 timeout = 1000; 2298 duration = send->cnt * INTERVAL_TO_MS(hdev->le_adv_max_interval); 2299 adv = hci_add_adv_instance(hdev, instance, 0, 2300 send->adv_data_len, send->adv_data, 2301 0, NULL, 2302 timeout, duration, 2303 HCI_ADV_TX_POWER_NO_PREFERENCE, 2304 hdev->le_adv_min_interval, 2305 hdev->le_adv_max_interval, 2306 mesh_tx->handle); 2307 2308 if (!IS_ERR(adv)) 2309 mesh_tx->instance = instance; 2310 else 2311 err = PTR_ERR(adv); 2312 2313 if (hdev->cur_adv_instance == instance) { 2314 /* If the currently advertised instance is being changed then 2315 * cancel the current advertising and schedule the next 2316 * instance. If there is only one instance then the overridden 2317 * advertising data will be visible right away. 2318 */ 2319 cancel_adv_timeout(hdev); 2320 2321 next_instance = hci_get_next_instance(hdev, instance); 2322 if (next_instance) 2323 instance = next_instance->instance; 2324 else 2325 instance = 0; 2326 } else if (hdev->adv_instance_timeout) { 2327 /* Immediately advertise the new instance if no other, or 2328 * let it go naturally from queue if ADV is already happening 2329 */ 2330 instance = 0; 2331 } 2332 2333 if (instance) 2334 return hci_schedule_adv_instance_sync(hdev, instance, true); 2335 2336 return err; 2337 } 2338 2339 static void send_count(struct mgmt_mesh_tx *mesh_tx, void *data) 2340 { 2341 struct mgmt_rp_mesh_read_features *rp = data; 2342 2343 if (rp->used_handles >= rp->max_handles) 2344 return; 2345 2346 rp->handles[rp->used_handles++] = mesh_tx->handle; 2347 } 2348 2349 static int mesh_features(struct sock *sk, struct hci_dev *hdev, 2350 void *data, u16 len) 2351 { 2352 struct mgmt_rp_mesh_read_features rp; 2353 2354 if (!lmp_le_capable(hdev) || 2355 !hci_dev_test_flag(hdev, HCI_MESH_EXPERIMENTAL)) 2356 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_MESH_READ_FEATURES, 2357 MGMT_STATUS_NOT_SUPPORTED); 2358 2359 memset(&rp, 0, sizeof(rp)); 2360 rp.index = cpu_to_le16(hdev->id); 2361 if (hci_dev_test_flag(hdev, HCI_LE_ENABLED)) 2362 rp.max_handles = MESH_HANDLES_MAX; 2363 2364 hci_dev_lock(hdev); 2365 2366 if (rp.max_handles) 2367 mgmt_mesh_foreach(hdev, send_count, &rp, sk); 2368 2369 mgmt_cmd_complete(sk, hdev->id, MGMT_OP_MESH_READ_FEATURES, 0, &rp, 2370 rp.used_handles + sizeof(rp) - MESH_HANDLES_MAX); 2371 2372 hci_dev_unlock(hdev); 2373 return 0; 2374 } 2375 2376 static int send_cancel(struct hci_dev *hdev, void *data) 2377 { 2378 struct mgmt_pending_cmd *cmd = data; 2379 struct mgmt_cp_mesh_send_cancel *cancel = (void *)cmd->param; 2380 struct mgmt_mesh_tx *mesh_tx; 2381 2382 if (!cancel->handle) { 2383 do { 2384 mesh_tx = mgmt_mesh_next(hdev, cmd->sk); 2385 2386 if (mesh_tx) 2387 mesh_send_complete(hdev, mesh_tx, false); 2388 } while (mesh_tx); 2389 } else { 2390 mesh_tx = mgmt_mesh_find(hdev, cancel->handle); 2391 2392 if (mesh_tx && mesh_tx->sk == cmd->sk) 2393 mesh_send_complete(hdev, mesh_tx, false); 2394 } 2395 2396 mgmt_cmd_complete(cmd->sk, hdev->id, MGMT_OP_MESH_SEND_CANCEL, 2397 0, NULL, 0); 2398 mgmt_pending_free(cmd); 2399 2400 return 0; 2401 } 2402 2403 static int mesh_send_cancel(struct sock *sk, struct hci_dev *hdev, 2404 void *data, u16 len) 2405 { 2406 struct mgmt_pending_cmd *cmd; 2407 int err; 2408 2409 if (!lmp_le_capable(hdev) || 2410 !hci_dev_test_flag(hdev, HCI_MESH_EXPERIMENTAL)) 2411 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_MESH_SEND_CANCEL, 2412 MGMT_STATUS_NOT_SUPPORTED); 2413 2414 if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED)) 2415 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_MESH_SEND_CANCEL, 2416 MGMT_STATUS_REJECTED); 2417 2418 hci_dev_lock(hdev); 2419 cmd = mgmt_pending_new(sk, MGMT_OP_MESH_SEND_CANCEL, hdev, data, len); 2420 if (!cmd) 2421 err = -ENOMEM; 2422 else 2423 err = hci_cmd_sync_queue(hdev, send_cancel, cmd, NULL); 2424 2425 if (err < 0) { 2426 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_MESH_SEND_CANCEL, 2427 MGMT_STATUS_FAILED); 2428 2429 if (cmd) 2430 mgmt_pending_free(cmd); 2431 } 2432 2433 hci_dev_unlock(hdev); 2434 return err; 2435 } 2436 2437 static int mesh_send(struct sock *sk, struct hci_dev *hdev, void *data, u16 len) 2438 { 2439 struct mgmt_mesh_tx *mesh_tx; 2440 struct mgmt_cp_mesh_send *send = data; 2441 struct mgmt_rp_mesh_read_features rp; 2442 bool sending; 2443 int err = 0; 2444 2445 if (!lmp_le_capable(hdev) || 2446 !hci_dev_test_flag(hdev, HCI_MESH_EXPERIMENTAL)) 2447 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_MESH_SEND, 2448 MGMT_STATUS_NOT_SUPPORTED); 2449 if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED) || 2450 len <= MGMT_MESH_SEND_SIZE || 2451 len > (MGMT_MESH_SEND_SIZE + 31)) 2452 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_MESH_SEND, 2453 MGMT_STATUS_REJECTED); 2454 2455 hci_dev_lock(hdev); 2456 2457 memset(&rp, 0, sizeof(rp)); 2458 rp.max_handles = MESH_HANDLES_MAX; 2459 2460 mgmt_mesh_foreach(hdev, send_count, &rp, sk); 2461 2462 if (rp.max_handles <= rp.used_handles) { 2463 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_MESH_SEND, 2464 MGMT_STATUS_BUSY); 2465 goto done; 2466 } 2467 2468 sending = hci_dev_test_flag(hdev, HCI_MESH_SENDING); 2469 mesh_tx = mgmt_mesh_add(sk, hdev, send, len); 2470 2471 if (!mesh_tx) 2472 err = -ENOMEM; 2473 else if (!sending) 2474 err = hci_cmd_sync_queue(hdev, mesh_send_sync, mesh_tx, 2475 mesh_send_start_complete); 2476 2477 if (err < 0) { 2478 bt_dev_err(hdev, "Send Mesh Failed %d", err); 2479 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_MESH_SEND, 2480 MGMT_STATUS_FAILED); 2481 2482 if (mesh_tx) { 2483 if (sending) 2484 mgmt_mesh_remove(mesh_tx); 2485 } 2486 } else { 2487 hci_dev_set_flag(hdev, HCI_MESH_SENDING); 2488 2489 mgmt_cmd_complete(sk, hdev->id, MGMT_OP_MESH_SEND, 0, 2490 &mesh_tx->handle, 1); 2491 } 2492 2493 done: 2494 hci_dev_unlock(hdev); 2495 return err; 2496 } 2497 2498 static int set_le(struct sock *sk, struct hci_dev *hdev, void *data, u16 len) 2499 { 2500 struct mgmt_mode *cp = data; 2501 struct mgmt_pending_cmd *cmd; 2502 int err; 2503 u8 val, enabled; 2504 2505 bt_dev_dbg(hdev, "sock %p", sk); 2506 2507 if (!lmp_le_capable(hdev)) 2508 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE, 2509 MGMT_STATUS_NOT_SUPPORTED); 2510 2511 if (cp->val != 0x00 && cp->val != 0x01) 2512 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE, 2513 MGMT_STATUS_INVALID_PARAMS); 2514 2515 /* Bluetooth single mode LE only controllers or dual-mode 2516 * controllers configured as LE only devices, do not allow 2517 * switching LE off. These have either LE enabled explicitly 2518 * or BR/EDR has been previously switched off. 2519 * 2520 * When trying to enable an already enabled LE, then gracefully 2521 * send a positive response. Trying to disable it however will 2522 * result into rejection. 2523 */ 2524 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) { 2525 if (cp->val == 0x01) 2526 return send_settings_rsp(sk, MGMT_OP_SET_LE, hdev); 2527 2528 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE, 2529 MGMT_STATUS_REJECTED); 2530 } 2531 2532 hci_dev_lock(hdev); 2533 2534 val = !!cp->val; 2535 enabled = lmp_host_le_capable(hdev); 2536 2537 if (!hdev_is_powered(hdev) || val == enabled) { 2538 bool changed = false; 2539 2540 if (val != hci_dev_test_flag(hdev, HCI_LE_ENABLED)) { 2541 hci_dev_change_flag(hdev, HCI_LE_ENABLED); 2542 changed = true; 2543 } 2544 2545 if (!val && hci_dev_test_flag(hdev, HCI_ADVERTISING)) { 2546 hci_dev_clear_flag(hdev, HCI_ADVERTISING); 2547 changed = true; 2548 } 2549 2550 err = send_settings_rsp(sk, MGMT_OP_SET_LE, hdev); 2551 if (err < 0) 2552 goto unlock; 2553 2554 if (changed) 2555 err = new_settings(hdev, sk); 2556 2557 goto unlock; 2558 } 2559 2560 if (pending_find(MGMT_OP_SET_LE, hdev) || 2561 pending_find(MGMT_OP_SET_ADVERTISING, hdev)) { 2562 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE, 2563 MGMT_STATUS_BUSY); 2564 goto unlock; 2565 } 2566 2567 cmd = mgmt_pending_add(sk, MGMT_OP_SET_LE, hdev, data, len); 2568 if (!cmd) 2569 err = -ENOMEM; 2570 else 2571 err = hci_cmd_sync_queue(hdev, set_le_sync, cmd, 2572 set_le_complete); 2573 2574 if (err < 0) { 2575 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE, 2576 MGMT_STATUS_FAILED); 2577 2578 if (cmd) 2579 mgmt_pending_remove(cmd); 2580 } 2581 2582 unlock: 2583 hci_dev_unlock(hdev); 2584 return err; 2585 } 2586 2587 /* This is a helper function to test for pending mgmt commands that can 2588 * cause CoD or EIR HCI commands. We can only allow one such pending 2589 * mgmt command at a time since otherwise we cannot easily track what 2590 * the current values are, will be, and based on that calculate if a new 2591 * HCI command needs to be sent and if yes with what value. 2592 */ 2593 static bool pending_eir_or_class(struct hci_dev *hdev) 2594 { 2595 struct mgmt_pending_cmd *cmd; 2596 2597 list_for_each_entry(cmd, &hdev->mgmt_pending, list) { 2598 switch (cmd->opcode) { 2599 case MGMT_OP_ADD_UUID: 2600 case MGMT_OP_REMOVE_UUID: 2601 case MGMT_OP_SET_DEV_CLASS: 2602 case MGMT_OP_SET_POWERED: 2603 return true; 2604 } 2605 } 2606 2607 return false; 2608 } 2609 2610 static const u8 bluetooth_base_uuid[] = { 2611 0xfb, 0x34, 0x9b, 0x5f, 0x80, 0x00, 0x00, 0x80, 2612 0x00, 0x10, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 2613 }; 2614 2615 static u8 get_uuid_size(const u8 *uuid) 2616 { 2617 u32 val; 2618 2619 if (memcmp(uuid, bluetooth_base_uuid, 12)) 2620 return 128; 2621 2622 val = get_unaligned_le32(&uuid[12]); 2623 if (val > 0xffff) 2624 return 32; 2625 2626 return 16; 2627 } 2628 2629 static void mgmt_class_complete(struct hci_dev *hdev, void *data, int err) 2630 { 2631 struct mgmt_pending_cmd *cmd = data; 2632 2633 bt_dev_dbg(hdev, "err %d", err); 2634 2635 mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, 2636 mgmt_status(err), hdev->dev_class, 3); 2637 2638 mgmt_pending_free(cmd); 2639 } 2640 2641 static int add_uuid_sync(struct hci_dev *hdev, void *data) 2642 { 2643 int err; 2644 2645 err = hci_update_class_sync(hdev); 2646 if (err) 2647 return err; 2648 2649 return hci_update_eir_sync(hdev); 2650 } 2651 2652 static int add_uuid(struct sock *sk, struct hci_dev *hdev, void *data, u16 len) 2653 { 2654 struct mgmt_cp_add_uuid *cp = data; 2655 struct mgmt_pending_cmd *cmd; 2656 struct bt_uuid *uuid; 2657 int err; 2658 2659 bt_dev_dbg(hdev, "sock %p", sk); 2660 2661 hci_dev_lock(hdev); 2662 2663 if (pending_eir_or_class(hdev)) { 2664 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_UUID, 2665 MGMT_STATUS_BUSY); 2666 goto failed; 2667 } 2668 2669 uuid = kmalloc(sizeof(*uuid), GFP_KERNEL); 2670 if (!uuid) { 2671 err = -ENOMEM; 2672 goto failed; 2673 } 2674 2675 memcpy(uuid->uuid, cp->uuid, 16); 2676 uuid->svc_hint = cp->svc_hint; 2677 uuid->size = get_uuid_size(cp->uuid); 2678 2679 list_add_tail(&uuid->list, &hdev->uuids); 2680 2681 cmd = mgmt_pending_new(sk, MGMT_OP_ADD_UUID, hdev, data, len); 2682 if (!cmd) { 2683 err = -ENOMEM; 2684 goto failed; 2685 } 2686 2687 err = hci_cmd_sync_queue(hdev, add_uuid_sync, cmd, mgmt_class_complete); 2688 if (err < 0) { 2689 mgmt_pending_free(cmd); 2690 goto failed; 2691 } 2692 2693 failed: 2694 hci_dev_unlock(hdev); 2695 return err; 2696 } 2697 2698 static bool enable_service_cache(struct hci_dev *hdev) 2699 { 2700 if (!hdev_is_powered(hdev)) 2701 return false; 2702 2703 if (!hci_dev_test_and_set_flag(hdev, HCI_SERVICE_CACHE)) { 2704 queue_delayed_work(hdev->workqueue, &hdev->service_cache, 2705 CACHE_TIMEOUT); 2706 return true; 2707 } 2708 2709 return false; 2710 } 2711 2712 static int remove_uuid_sync(struct hci_dev *hdev, void *data) 2713 { 2714 int err; 2715 2716 err = hci_update_class_sync(hdev); 2717 if (err) 2718 return err; 2719 2720 return hci_update_eir_sync(hdev); 2721 } 2722 2723 static int remove_uuid(struct sock *sk, struct hci_dev *hdev, void *data, 2724 u16 len) 2725 { 2726 struct mgmt_cp_remove_uuid *cp = data; 2727 struct mgmt_pending_cmd *cmd; 2728 struct bt_uuid *match, *tmp; 2729 static const u8 bt_uuid_any[] = { 2730 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 2731 }; 2732 int err, found; 2733 2734 bt_dev_dbg(hdev, "sock %p", sk); 2735 2736 hci_dev_lock(hdev); 2737 2738 if (pending_eir_or_class(hdev)) { 2739 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID, 2740 MGMT_STATUS_BUSY); 2741 goto unlock; 2742 } 2743 2744 if (memcmp(cp->uuid, bt_uuid_any, 16) == 0) { 2745 hci_uuids_clear(hdev); 2746 2747 if (enable_service_cache(hdev)) { 2748 err = mgmt_cmd_complete(sk, hdev->id, 2749 MGMT_OP_REMOVE_UUID, 2750 0, hdev->dev_class, 3); 2751 goto unlock; 2752 } 2753 2754 goto update_class; 2755 } 2756 2757 found = 0; 2758 2759 list_for_each_entry_safe(match, tmp, &hdev->uuids, list) { 2760 if (memcmp(match->uuid, cp->uuid, 16) != 0) 2761 continue; 2762 2763 list_del(&match->list); 2764 kfree(match); 2765 found++; 2766 } 2767 2768 if (found == 0) { 2769 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID, 2770 MGMT_STATUS_INVALID_PARAMS); 2771 goto unlock; 2772 } 2773 2774 update_class: 2775 cmd = mgmt_pending_new(sk, MGMT_OP_REMOVE_UUID, hdev, data, len); 2776 if (!cmd) { 2777 err = -ENOMEM; 2778 goto unlock; 2779 } 2780 2781 err = hci_cmd_sync_queue(hdev, remove_uuid_sync, cmd, 2782 mgmt_class_complete); 2783 if (err < 0) 2784 mgmt_pending_free(cmd); 2785 2786 unlock: 2787 hci_dev_unlock(hdev); 2788 return err; 2789 } 2790 2791 static int set_class_sync(struct hci_dev *hdev, void *data) 2792 { 2793 int err = 0; 2794 2795 if (hci_dev_test_and_clear_flag(hdev, HCI_SERVICE_CACHE)) { 2796 cancel_delayed_work_sync(&hdev->service_cache); 2797 err = hci_update_eir_sync(hdev); 2798 } 2799 2800 if (err) 2801 return err; 2802 2803 return hci_update_class_sync(hdev); 2804 } 2805 2806 static int set_dev_class(struct sock *sk, struct hci_dev *hdev, void *data, 2807 u16 len) 2808 { 2809 struct mgmt_cp_set_dev_class *cp = data; 2810 struct mgmt_pending_cmd *cmd; 2811 int err; 2812 2813 bt_dev_dbg(hdev, "sock %p", sk); 2814 2815 if (!lmp_bredr_capable(hdev)) 2816 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 2817 MGMT_STATUS_NOT_SUPPORTED); 2818 2819 hci_dev_lock(hdev); 2820 2821 if (pending_eir_or_class(hdev)) { 2822 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 2823 MGMT_STATUS_BUSY); 2824 goto unlock; 2825 } 2826 2827 if ((cp->minor & 0x03) != 0 || (cp->major & 0xe0) != 0) { 2828 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 2829 MGMT_STATUS_INVALID_PARAMS); 2830 goto unlock; 2831 } 2832 2833 hdev->major_class = cp->major; 2834 hdev->minor_class = cp->minor; 2835 2836 if (!hdev_is_powered(hdev)) { 2837 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 0, 2838 hdev->dev_class, 3); 2839 goto unlock; 2840 } 2841 2842 cmd = mgmt_pending_new(sk, MGMT_OP_SET_DEV_CLASS, hdev, data, len); 2843 if (!cmd) { 2844 err = -ENOMEM; 2845 goto unlock; 2846 } 2847 2848 err = hci_cmd_sync_queue(hdev, set_class_sync, cmd, 2849 mgmt_class_complete); 2850 if (err < 0) 2851 mgmt_pending_free(cmd); 2852 2853 unlock: 2854 hci_dev_unlock(hdev); 2855 return err; 2856 } 2857 2858 static int load_link_keys(struct sock *sk, struct hci_dev *hdev, void *data, 2859 u16 len) 2860 { 2861 struct mgmt_cp_load_link_keys *cp = data; 2862 const u16 max_key_count = ((U16_MAX - sizeof(*cp)) / 2863 sizeof(struct mgmt_link_key_info)); 2864 u16 key_count, expected_len; 2865 bool changed; 2866 int i; 2867 2868 bt_dev_dbg(hdev, "sock %p", sk); 2869 2870 if (!lmp_bredr_capable(hdev)) 2871 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS, 2872 MGMT_STATUS_NOT_SUPPORTED); 2873 2874 key_count = __le16_to_cpu(cp->key_count); 2875 if (key_count > max_key_count) { 2876 bt_dev_err(hdev, "load_link_keys: too big key_count value %u", 2877 key_count); 2878 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS, 2879 MGMT_STATUS_INVALID_PARAMS); 2880 } 2881 2882 expected_len = struct_size(cp, keys, key_count); 2883 if (expected_len != len) { 2884 bt_dev_err(hdev, "load_link_keys: expected %u bytes, got %u bytes", 2885 expected_len, len); 2886 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS, 2887 MGMT_STATUS_INVALID_PARAMS); 2888 } 2889 2890 if (cp->debug_keys != 0x00 && cp->debug_keys != 0x01) 2891 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS, 2892 MGMT_STATUS_INVALID_PARAMS); 2893 2894 bt_dev_dbg(hdev, "debug_keys %u key_count %u", cp->debug_keys, 2895 key_count); 2896 2897 for (i = 0; i < key_count; i++) { 2898 struct mgmt_link_key_info *key = &cp->keys[i]; 2899 2900 if (key->addr.type != BDADDR_BREDR || key->type > 0x08) 2901 return mgmt_cmd_status(sk, hdev->id, 2902 MGMT_OP_LOAD_LINK_KEYS, 2903 MGMT_STATUS_INVALID_PARAMS); 2904 } 2905 2906 hci_dev_lock(hdev); 2907 2908 hci_link_keys_clear(hdev); 2909 2910 if (cp->debug_keys) 2911 changed = !hci_dev_test_and_set_flag(hdev, HCI_KEEP_DEBUG_KEYS); 2912 else 2913 changed = hci_dev_test_and_clear_flag(hdev, 2914 HCI_KEEP_DEBUG_KEYS); 2915 2916 if (changed) 2917 new_settings(hdev, NULL); 2918 2919 for (i = 0; i < key_count; i++) { 2920 struct mgmt_link_key_info *key = &cp->keys[i]; 2921 2922 if (hci_is_blocked_key(hdev, 2923 HCI_BLOCKED_KEY_TYPE_LINKKEY, 2924 key->val)) { 2925 bt_dev_warn(hdev, "Skipping blocked link key for %pMR", 2926 &key->addr.bdaddr); 2927 continue; 2928 } 2929 2930 /* Always ignore debug keys and require a new pairing if 2931 * the user wants to use them. 2932 */ 2933 if (key->type == HCI_LK_DEBUG_COMBINATION) 2934 continue; 2935 2936 hci_add_link_key(hdev, NULL, &key->addr.bdaddr, key->val, 2937 key->type, key->pin_len, NULL); 2938 } 2939 2940 mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS, 0, NULL, 0); 2941 2942 hci_dev_unlock(hdev); 2943 2944 return 0; 2945 } 2946 2947 static int device_unpaired(struct hci_dev *hdev, bdaddr_t *bdaddr, 2948 u8 addr_type, struct sock *skip_sk) 2949 { 2950 struct mgmt_ev_device_unpaired ev; 2951 2952 bacpy(&ev.addr.bdaddr, bdaddr); 2953 ev.addr.type = addr_type; 2954 2955 return mgmt_event(MGMT_EV_DEVICE_UNPAIRED, hdev, &ev, sizeof(ev), 2956 skip_sk); 2957 } 2958 2959 static void unpair_device_complete(struct hci_dev *hdev, void *data, int err) 2960 { 2961 struct mgmt_pending_cmd *cmd = data; 2962 struct mgmt_cp_unpair_device *cp = cmd->param; 2963 2964 if (!err) 2965 device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, cmd->sk); 2966 2967 cmd->cmd_complete(cmd, err); 2968 mgmt_pending_free(cmd); 2969 } 2970 2971 static int unpair_device_sync(struct hci_dev *hdev, void *data) 2972 { 2973 struct mgmt_pending_cmd *cmd = data; 2974 struct mgmt_cp_unpair_device *cp = cmd->param; 2975 struct hci_conn *conn; 2976 2977 if (cp->addr.type == BDADDR_BREDR) 2978 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, 2979 &cp->addr.bdaddr); 2980 else 2981 conn = hci_conn_hash_lookup_le(hdev, &cp->addr.bdaddr, 2982 le_addr_type(cp->addr.type)); 2983 2984 if (!conn) 2985 return 0; 2986 2987 return hci_abort_conn_sync(hdev, conn, HCI_ERROR_REMOTE_USER_TERM); 2988 } 2989 2990 static int unpair_device(struct sock *sk, struct hci_dev *hdev, void *data, 2991 u16 len) 2992 { 2993 struct mgmt_cp_unpair_device *cp = data; 2994 struct mgmt_rp_unpair_device rp; 2995 struct hci_conn_params *params; 2996 struct mgmt_pending_cmd *cmd; 2997 struct hci_conn *conn; 2998 u8 addr_type; 2999 int err; 3000 3001 memset(&rp, 0, sizeof(rp)); 3002 bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr); 3003 rp.addr.type = cp->addr.type; 3004 3005 if (!bdaddr_type_is_valid(cp->addr.type)) 3006 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE, 3007 MGMT_STATUS_INVALID_PARAMS, 3008 &rp, sizeof(rp)); 3009 3010 if (cp->disconnect != 0x00 && cp->disconnect != 0x01) 3011 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE, 3012 MGMT_STATUS_INVALID_PARAMS, 3013 &rp, sizeof(rp)); 3014 3015 hci_dev_lock(hdev); 3016 3017 if (!hdev_is_powered(hdev)) { 3018 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE, 3019 MGMT_STATUS_NOT_POWERED, &rp, 3020 sizeof(rp)); 3021 goto unlock; 3022 } 3023 3024 if (cp->addr.type == BDADDR_BREDR) { 3025 /* If disconnection is requested, then look up the 3026 * connection. If the remote device is connected, it 3027 * will be later used to terminate the link. 3028 * 3029 * Setting it to NULL explicitly will cause no 3030 * termination of the link. 3031 */ 3032 if (cp->disconnect) 3033 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, 3034 &cp->addr.bdaddr); 3035 else 3036 conn = NULL; 3037 3038 err = hci_remove_link_key(hdev, &cp->addr.bdaddr); 3039 if (err < 0) { 3040 err = mgmt_cmd_complete(sk, hdev->id, 3041 MGMT_OP_UNPAIR_DEVICE, 3042 MGMT_STATUS_NOT_PAIRED, &rp, 3043 sizeof(rp)); 3044 goto unlock; 3045 } 3046 3047 goto done; 3048 } 3049 3050 /* LE address type */ 3051 addr_type = le_addr_type(cp->addr.type); 3052 3053 /* Abort any ongoing SMP pairing. Removes ltk and irk if they exist. */ 3054 err = smp_cancel_and_remove_pairing(hdev, &cp->addr.bdaddr, addr_type); 3055 if (err < 0) { 3056 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE, 3057 MGMT_STATUS_NOT_PAIRED, &rp, 3058 sizeof(rp)); 3059 goto unlock; 3060 } 3061 3062 conn = hci_conn_hash_lookup_le(hdev, &cp->addr.bdaddr, addr_type); 3063 if (!conn) { 3064 hci_conn_params_del(hdev, &cp->addr.bdaddr, addr_type); 3065 goto done; 3066 } 3067 3068 3069 /* Defer clearing up the connection parameters until closing to 3070 * give a chance of keeping them if a repairing happens. 3071 */ 3072 set_bit(HCI_CONN_PARAM_REMOVAL_PEND, &conn->flags); 3073 3074 /* Disable auto-connection parameters if present */ 3075 params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr, addr_type); 3076 if (params) { 3077 if (params->explicit_connect) 3078 params->auto_connect = HCI_AUTO_CONN_EXPLICIT; 3079 else 3080 params->auto_connect = HCI_AUTO_CONN_DISABLED; 3081 } 3082 3083 /* If disconnection is not requested, then clear the connection 3084 * variable so that the link is not terminated. 3085 */ 3086 if (!cp->disconnect) 3087 conn = NULL; 3088 3089 done: 3090 /* If the connection variable is set, then termination of the 3091 * link is requested. 3092 */ 3093 if (!conn) { 3094 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE, 0, 3095 &rp, sizeof(rp)); 3096 device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, sk); 3097 goto unlock; 3098 } 3099 3100 cmd = mgmt_pending_new(sk, MGMT_OP_UNPAIR_DEVICE, hdev, cp, 3101 sizeof(*cp)); 3102 if (!cmd) { 3103 err = -ENOMEM; 3104 goto unlock; 3105 } 3106 3107 cmd->cmd_complete = addr_cmd_complete; 3108 3109 err = hci_cmd_sync_queue(hdev, unpair_device_sync, cmd, 3110 unpair_device_complete); 3111 if (err < 0) 3112 mgmt_pending_free(cmd); 3113 3114 unlock: 3115 hci_dev_unlock(hdev); 3116 return err; 3117 } 3118 3119 static int disconnect(struct sock *sk, struct hci_dev *hdev, void *data, 3120 u16 len) 3121 { 3122 struct mgmt_cp_disconnect *cp = data; 3123 struct mgmt_rp_disconnect rp; 3124 struct mgmt_pending_cmd *cmd; 3125 struct hci_conn *conn; 3126 int err; 3127 3128 bt_dev_dbg(hdev, "sock %p", sk); 3129 3130 memset(&rp, 0, sizeof(rp)); 3131 bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr); 3132 rp.addr.type = cp->addr.type; 3133 3134 if (!bdaddr_type_is_valid(cp->addr.type)) 3135 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT, 3136 MGMT_STATUS_INVALID_PARAMS, 3137 &rp, sizeof(rp)); 3138 3139 hci_dev_lock(hdev); 3140 3141 if (!test_bit(HCI_UP, &hdev->flags)) { 3142 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT, 3143 MGMT_STATUS_NOT_POWERED, &rp, 3144 sizeof(rp)); 3145 goto failed; 3146 } 3147 3148 if (pending_find(MGMT_OP_DISCONNECT, hdev)) { 3149 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT, 3150 MGMT_STATUS_BUSY, &rp, sizeof(rp)); 3151 goto failed; 3152 } 3153 3154 if (cp->addr.type == BDADDR_BREDR) 3155 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, 3156 &cp->addr.bdaddr); 3157 else 3158 conn = hci_conn_hash_lookup_le(hdev, &cp->addr.bdaddr, 3159 le_addr_type(cp->addr.type)); 3160 3161 if (!conn || conn->state == BT_OPEN || conn->state == BT_CLOSED) { 3162 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT, 3163 MGMT_STATUS_NOT_CONNECTED, &rp, 3164 sizeof(rp)); 3165 goto failed; 3166 } 3167 3168 cmd = mgmt_pending_add(sk, MGMT_OP_DISCONNECT, hdev, data, len); 3169 if (!cmd) { 3170 err = -ENOMEM; 3171 goto failed; 3172 } 3173 3174 cmd->cmd_complete = generic_cmd_complete; 3175 3176 err = hci_disconnect(conn, HCI_ERROR_REMOTE_USER_TERM); 3177 if (err < 0) 3178 mgmt_pending_remove(cmd); 3179 3180 failed: 3181 hci_dev_unlock(hdev); 3182 return err; 3183 } 3184 3185 static u8 link_to_bdaddr(u8 link_type, u8 addr_type) 3186 { 3187 switch (link_type) { 3188 case LE_LINK: 3189 switch (addr_type) { 3190 case ADDR_LE_DEV_PUBLIC: 3191 return BDADDR_LE_PUBLIC; 3192 3193 default: 3194 /* Fallback to LE Random address type */ 3195 return BDADDR_LE_RANDOM; 3196 } 3197 3198 default: 3199 /* Fallback to BR/EDR type */ 3200 return BDADDR_BREDR; 3201 } 3202 } 3203 3204 static int get_connections(struct sock *sk, struct hci_dev *hdev, void *data, 3205 u16 data_len) 3206 { 3207 struct mgmt_rp_get_connections *rp; 3208 struct hci_conn *c; 3209 int err; 3210 u16 i; 3211 3212 bt_dev_dbg(hdev, "sock %p", sk); 3213 3214 hci_dev_lock(hdev); 3215 3216 if (!hdev_is_powered(hdev)) { 3217 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_CONNECTIONS, 3218 MGMT_STATUS_NOT_POWERED); 3219 goto unlock; 3220 } 3221 3222 i = 0; 3223 list_for_each_entry(c, &hdev->conn_hash.list, list) { 3224 if (test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags)) 3225 i++; 3226 } 3227 3228 rp = kmalloc(struct_size(rp, addr, i), GFP_KERNEL); 3229 if (!rp) { 3230 err = -ENOMEM; 3231 goto unlock; 3232 } 3233 3234 i = 0; 3235 list_for_each_entry(c, &hdev->conn_hash.list, list) { 3236 if (!test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags)) 3237 continue; 3238 bacpy(&rp->addr[i].bdaddr, &c->dst); 3239 rp->addr[i].type = link_to_bdaddr(c->type, c->dst_type); 3240 if (c->type == SCO_LINK || c->type == ESCO_LINK) 3241 continue; 3242 i++; 3243 } 3244 3245 rp->conn_count = cpu_to_le16(i); 3246 3247 /* Recalculate length in case of filtered SCO connections, etc */ 3248 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONNECTIONS, 0, rp, 3249 struct_size(rp, addr, i)); 3250 3251 kfree(rp); 3252 3253 unlock: 3254 hci_dev_unlock(hdev); 3255 return err; 3256 } 3257 3258 static int send_pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev, 3259 struct mgmt_cp_pin_code_neg_reply *cp) 3260 { 3261 struct mgmt_pending_cmd *cmd; 3262 int err; 3263 3264 cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_NEG_REPLY, hdev, cp, 3265 sizeof(*cp)); 3266 if (!cmd) 3267 return -ENOMEM; 3268 3269 cmd->cmd_complete = addr_cmd_complete; 3270 3271 err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_NEG_REPLY, 3272 sizeof(cp->addr.bdaddr), &cp->addr.bdaddr); 3273 if (err < 0) 3274 mgmt_pending_remove(cmd); 3275 3276 return err; 3277 } 3278 3279 static int pin_code_reply(struct sock *sk, struct hci_dev *hdev, void *data, 3280 u16 len) 3281 { 3282 struct hci_conn *conn; 3283 struct mgmt_cp_pin_code_reply *cp = data; 3284 struct hci_cp_pin_code_reply reply; 3285 struct mgmt_pending_cmd *cmd; 3286 int err; 3287 3288 bt_dev_dbg(hdev, "sock %p", sk); 3289 3290 hci_dev_lock(hdev); 3291 3292 if (!hdev_is_powered(hdev)) { 3293 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY, 3294 MGMT_STATUS_NOT_POWERED); 3295 goto failed; 3296 } 3297 3298 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->addr.bdaddr); 3299 if (!conn) { 3300 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY, 3301 MGMT_STATUS_NOT_CONNECTED); 3302 goto failed; 3303 } 3304 3305 if (conn->pending_sec_level == BT_SECURITY_HIGH && cp->pin_len != 16) { 3306 struct mgmt_cp_pin_code_neg_reply ncp; 3307 3308 memcpy(&ncp.addr, &cp->addr, sizeof(ncp.addr)); 3309 3310 bt_dev_err(hdev, "PIN code is not 16 bytes long"); 3311 3312 err = send_pin_code_neg_reply(sk, hdev, &ncp); 3313 if (err >= 0) 3314 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY, 3315 MGMT_STATUS_INVALID_PARAMS); 3316 3317 goto failed; 3318 } 3319 3320 cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_REPLY, hdev, data, len); 3321 if (!cmd) { 3322 err = -ENOMEM; 3323 goto failed; 3324 } 3325 3326 cmd->cmd_complete = addr_cmd_complete; 3327 3328 bacpy(&reply.bdaddr, &cp->addr.bdaddr); 3329 reply.pin_len = cp->pin_len; 3330 memcpy(reply.pin_code, cp->pin_code, sizeof(reply.pin_code)); 3331 3332 err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_REPLY, sizeof(reply), &reply); 3333 if (err < 0) 3334 mgmt_pending_remove(cmd); 3335 3336 failed: 3337 hci_dev_unlock(hdev); 3338 return err; 3339 } 3340 3341 static int set_io_capability(struct sock *sk, struct hci_dev *hdev, void *data, 3342 u16 len) 3343 { 3344 struct mgmt_cp_set_io_capability *cp = data; 3345 3346 bt_dev_dbg(hdev, "sock %p", sk); 3347 3348 if (cp->io_capability > SMP_IO_KEYBOARD_DISPLAY) 3349 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_IO_CAPABILITY, 3350 MGMT_STATUS_INVALID_PARAMS); 3351 3352 hci_dev_lock(hdev); 3353 3354 hdev->io_capability = cp->io_capability; 3355 3356 bt_dev_dbg(hdev, "IO capability set to 0x%02x", hdev->io_capability); 3357 3358 hci_dev_unlock(hdev); 3359 3360 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_IO_CAPABILITY, 0, 3361 NULL, 0); 3362 } 3363 3364 static struct mgmt_pending_cmd *find_pairing(struct hci_conn *conn) 3365 { 3366 struct hci_dev *hdev = conn->hdev; 3367 struct mgmt_pending_cmd *cmd; 3368 3369 list_for_each_entry(cmd, &hdev->mgmt_pending, list) { 3370 if (cmd->opcode != MGMT_OP_PAIR_DEVICE) 3371 continue; 3372 3373 if (cmd->user_data != conn) 3374 continue; 3375 3376 return cmd; 3377 } 3378 3379 return NULL; 3380 } 3381 3382 static int pairing_complete(struct mgmt_pending_cmd *cmd, u8 status) 3383 { 3384 struct mgmt_rp_pair_device rp; 3385 struct hci_conn *conn = cmd->user_data; 3386 int err; 3387 3388 bacpy(&rp.addr.bdaddr, &conn->dst); 3389 rp.addr.type = link_to_bdaddr(conn->type, conn->dst_type); 3390 3391 err = mgmt_cmd_complete(cmd->sk, cmd->index, MGMT_OP_PAIR_DEVICE, 3392 status, &rp, sizeof(rp)); 3393 3394 /* So we don't get further callbacks for this connection */ 3395 conn->connect_cfm_cb = NULL; 3396 conn->security_cfm_cb = NULL; 3397 conn->disconn_cfm_cb = NULL; 3398 3399 hci_conn_drop(conn); 3400 3401 /* The device is paired so there is no need to remove 3402 * its connection parameters anymore. 3403 */ 3404 clear_bit(HCI_CONN_PARAM_REMOVAL_PEND, &conn->flags); 3405 3406 hci_conn_put(conn); 3407 3408 return err; 3409 } 3410 3411 void mgmt_smp_complete(struct hci_conn *conn, bool complete) 3412 { 3413 u8 status = complete ? MGMT_STATUS_SUCCESS : MGMT_STATUS_FAILED; 3414 struct mgmt_pending_cmd *cmd; 3415 3416 cmd = find_pairing(conn); 3417 if (cmd) { 3418 cmd->cmd_complete(cmd, status); 3419 mgmt_pending_remove(cmd); 3420 } 3421 } 3422 3423 static void pairing_complete_cb(struct hci_conn *conn, u8 status) 3424 { 3425 struct mgmt_pending_cmd *cmd; 3426 3427 BT_DBG("status %u", status); 3428 3429 cmd = find_pairing(conn); 3430 if (!cmd) { 3431 BT_DBG("Unable to find a pending command"); 3432 return; 3433 } 3434 3435 cmd->cmd_complete(cmd, mgmt_status(status)); 3436 mgmt_pending_remove(cmd); 3437 } 3438 3439 static void le_pairing_complete_cb(struct hci_conn *conn, u8 status) 3440 { 3441 struct mgmt_pending_cmd *cmd; 3442 3443 BT_DBG("status %u", status); 3444 3445 if (!status) 3446 return; 3447 3448 cmd = find_pairing(conn); 3449 if (!cmd) { 3450 BT_DBG("Unable to find a pending command"); 3451 return; 3452 } 3453 3454 cmd->cmd_complete(cmd, mgmt_status(status)); 3455 mgmt_pending_remove(cmd); 3456 } 3457 3458 static int pair_device(struct sock *sk, struct hci_dev *hdev, void *data, 3459 u16 len) 3460 { 3461 struct mgmt_cp_pair_device *cp = data; 3462 struct mgmt_rp_pair_device rp; 3463 struct mgmt_pending_cmd *cmd; 3464 u8 sec_level, auth_type; 3465 struct hci_conn *conn; 3466 int err; 3467 3468 bt_dev_dbg(hdev, "sock %p", sk); 3469 3470 memset(&rp, 0, sizeof(rp)); 3471 bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr); 3472 rp.addr.type = cp->addr.type; 3473 3474 if (!bdaddr_type_is_valid(cp->addr.type)) 3475 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE, 3476 MGMT_STATUS_INVALID_PARAMS, 3477 &rp, sizeof(rp)); 3478 3479 if (cp->io_cap > SMP_IO_KEYBOARD_DISPLAY) 3480 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE, 3481 MGMT_STATUS_INVALID_PARAMS, 3482 &rp, sizeof(rp)); 3483 3484 hci_dev_lock(hdev); 3485 3486 if (!hdev_is_powered(hdev)) { 3487 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE, 3488 MGMT_STATUS_NOT_POWERED, &rp, 3489 sizeof(rp)); 3490 goto unlock; 3491 } 3492 3493 if (hci_bdaddr_is_paired(hdev, &cp->addr.bdaddr, cp->addr.type)) { 3494 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE, 3495 MGMT_STATUS_ALREADY_PAIRED, &rp, 3496 sizeof(rp)); 3497 goto unlock; 3498 } 3499 3500 sec_level = BT_SECURITY_MEDIUM; 3501 auth_type = HCI_AT_DEDICATED_BONDING; 3502 3503 if (cp->addr.type == BDADDR_BREDR) { 3504 conn = hci_connect_acl(hdev, &cp->addr.bdaddr, sec_level, 3505 auth_type, CONN_REASON_PAIR_DEVICE); 3506 } else { 3507 u8 addr_type = le_addr_type(cp->addr.type); 3508 struct hci_conn_params *p; 3509 3510 /* When pairing a new device, it is expected to remember 3511 * this device for future connections. Adding the connection 3512 * parameter information ahead of time allows tracking 3513 * of the peripheral preferred values and will speed up any 3514 * further connection establishment. 3515 * 3516 * If connection parameters already exist, then they 3517 * will be kept and this function does nothing. 3518 */ 3519 p = hci_conn_params_add(hdev, &cp->addr.bdaddr, addr_type); 3520 3521 if (p->auto_connect == HCI_AUTO_CONN_EXPLICIT) 3522 p->auto_connect = HCI_AUTO_CONN_DISABLED; 3523 3524 conn = hci_connect_le_scan(hdev, &cp->addr.bdaddr, addr_type, 3525 sec_level, HCI_LE_CONN_TIMEOUT, 3526 CONN_REASON_PAIR_DEVICE); 3527 } 3528 3529 if (IS_ERR(conn)) { 3530 int status; 3531 3532 if (PTR_ERR(conn) == -EBUSY) 3533 status = MGMT_STATUS_BUSY; 3534 else if (PTR_ERR(conn) == -EOPNOTSUPP) 3535 status = MGMT_STATUS_NOT_SUPPORTED; 3536 else if (PTR_ERR(conn) == -ECONNREFUSED) 3537 status = MGMT_STATUS_REJECTED; 3538 else 3539 status = MGMT_STATUS_CONNECT_FAILED; 3540 3541 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE, 3542 status, &rp, sizeof(rp)); 3543 goto unlock; 3544 } 3545 3546 if (conn->connect_cfm_cb) { 3547 hci_conn_drop(conn); 3548 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE, 3549 MGMT_STATUS_BUSY, &rp, sizeof(rp)); 3550 goto unlock; 3551 } 3552 3553 cmd = mgmt_pending_add(sk, MGMT_OP_PAIR_DEVICE, hdev, data, len); 3554 if (!cmd) { 3555 err = -ENOMEM; 3556 hci_conn_drop(conn); 3557 goto unlock; 3558 } 3559 3560 cmd->cmd_complete = pairing_complete; 3561 3562 /* For LE, just connecting isn't a proof that the pairing finished */ 3563 if (cp->addr.type == BDADDR_BREDR) { 3564 conn->connect_cfm_cb = pairing_complete_cb; 3565 conn->security_cfm_cb = pairing_complete_cb; 3566 conn->disconn_cfm_cb = pairing_complete_cb; 3567 } else { 3568 conn->connect_cfm_cb = le_pairing_complete_cb; 3569 conn->security_cfm_cb = le_pairing_complete_cb; 3570 conn->disconn_cfm_cb = le_pairing_complete_cb; 3571 } 3572 3573 conn->io_capability = cp->io_cap; 3574 cmd->user_data = hci_conn_get(conn); 3575 3576 if ((conn->state == BT_CONNECTED || conn->state == BT_CONFIG) && 3577 hci_conn_security(conn, sec_level, auth_type, true)) { 3578 cmd->cmd_complete(cmd, 0); 3579 mgmt_pending_remove(cmd); 3580 } 3581 3582 err = 0; 3583 3584 unlock: 3585 hci_dev_unlock(hdev); 3586 return err; 3587 } 3588 3589 static int cancel_pair_device(struct sock *sk, struct hci_dev *hdev, void *data, 3590 u16 len) 3591 { 3592 struct mgmt_addr_info *addr = data; 3593 struct mgmt_pending_cmd *cmd; 3594 struct hci_conn *conn; 3595 int err; 3596 3597 bt_dev_dbg(hdev, "sock %p", sk); 3598 3599 hci_dev_lock(hdev); 3600 3601 if (!hdev_is_powered(hdev)) { 3602 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE, 3603 MGMT_STATUS_NOT_POWERED); 3604 goto unlock; 3605 } 3606 3607 cmd = pending_find(MGMT_OP_PAIR_DEVICE, hdev); 3608 if (!cmd) { 3609 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE, 3610 MGMT_STATUS_INVALID_PARAMS); 3611 goto unlock; 3612 } 3613 3614 conn = cmd->user_data; 3615 3616 if (bacmp(&addr->bdaddr, &conn->dst) != 0) { 3617 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE, 3618 MGMT_STATUS_INVALID_PARAMS); 3619 goto unlock; 3620 } 3621 3622 cmd->cmd_complete(cmd, MGMT_STATUS_CANCELLED); 3623 mgmt_pending_remove(cmd); 3624 3625 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE, 0, 3626 addr, sizeof(*addr)); 3627 3628 /* Since user doesn't want to proceed with the connection, abort any 3629 * ongoing pairing and then terminate the link if it was created 3630 * because of the pair device action. 3631 */ 3632 if (addr->type == BDADDR_BREDR) 3633 hci_remove_link_key(hdev, &addr->bdaddr); 3634 else 3635 smp_cancel_and_remove_pairing(hdev, &addr->bdaddr, 3636 le_addr_type(addr->type)); 3637 3638 if (conn->conn_reason == CONN_REASON_PAIR_DEVICE) 3639 hci_abort_conn(conn, HCI_ERROR_REMOTE_USER_TERM); 3640 3641 unlock: 3642 hci_dev_unlock(hdev); 3643 return err; 3644 } 3645 3646 static int user_pairing_resp(struct sock *sk, struct hci_dev *hdev, 3647 struct mgmt_addr_info *addr, u16 mgmt_op, 3648 u16 hci_op, __le32 passkey) 3649 { 3650 struct mgmt_pending_cmd *cmd; 3651 struct hci_conn *conn; 3652 int err; 3653 3654 hci_dev_lock(hdev); 3655 3656 if (!hdev_is_powered(hdev)) { 3657 err = mgmt_cmd_complete(sk, hdev->id, mgmt_op, 3658 MGMT_STATUS_NOT_POWERED, addr, 3659 sizeof(*addr)); 3660 goto done; 3661 } 3662 3663 if (addr->type == BDADDR_BREDR) 3664 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &addr->bdaddr); 3665 else 3666 conn = hci_conn_hash_lookup_le(hdev, &addr->bdaddr, 3667 le_addr_type(addr->type)); 3668 3669 if (!conn) { 3670 err = mgmt_cmd_complete(sk, hdev->id, mgmt_op, 3671 MGMT_STATUS_NOT_CONNECTED, addr, 3672 sizeof(*addr)); 3673 goto done; 3674 } 3675 3676 if (addr->type == BDADDR_LE_PUBLIC || addr->type == BDADDR_LE_RANDOM) { 3677 err = smp_user_confirm_reply(conn, mgmt_op, passkey); 3678 if (!err) 3679 err = mgmt_cmd_complete(sk, hdev->id, mgmt_op, 3680 MGMT_STATUS_SUCCESS, addr, 3681 sizeof(*addr)); 3682 else 3683 err = mgmt_cmd_complete(sk, hdev->id, mgmt_op, 3684 MGMT_STATUS_FAILED, addr, 3685 sizeof(*addr)); 3686 3687 goto done; 3688 } 3689 3690 cmd = mgmt_pending_add(sk, mgmt_op, hdev, addr, sizeof(*addr)); 3691 if (!cmd) { 3692 err = -ENOMEM; 3693 goto done; 3694 } 3695 3696 cmd->cmd_complete = addr_cmd_complete; 3697 3698 /* Continue with pairing via HCI */ 3699 if (hci_op == HCI_OP_USER_PASSKEY_REPLY) { 3700 struct hci_cp_user_passkey_reply cp; 3701 3702 bacpy(&cp.bdaddr, &addr->bdaddr); 3703 cp.passkey = passkey; 3704 err = hci_send_cmd(hdev, hci_op, sizeof(cp), &cp); 3705 } else 3706 err = hci_send_cmd(hdev, hci_op, sizeof(addr->bdaddr), 3707 &addr->bdaddr); 3708 3709 if (err < 0) 3710 mgmt_pending_remove(cmd); 3711 3712 done: 3713 hci_dev_unlock(hdev); 3714 return err; 3715 } 3716 3717 static int pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev, 3718 void *data, u16 len) 3719 { 3720 struct mgmt_cp_pin_code_neg_reply *cp = data; 3721 3722 bt_dev_dbg(hdev, "sock %p", sk); 3723 3724 return user_pairing_resp(sk, hdev, &cp->addr, 3725 MGMT_OP_PIN_CODE_NEG_REPLY, 3726 HCI_OP_PIN_CODE_NEG_REPLY, 0); 3727 } 3728 3729 static int user_confirm_reply(struct sock *sk, struct hci_dev *hdev, void *data, 3730 u16 len) 3731 { 3732 struct mgmt_cp_user_confirm_reply *cp = data; 3733 3734 bt_dev_dbg(hdev, "sock %p", sk); 3735 3736 if (len != sizeof(*cp)) 3737 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_USER_CONFIRM_REPLY, 3738 MGMT_STATUS_INVALID_PARAMS); 3739 3740 return user_pairing_resp(sk, hdev, &cp->addr, 3741 MGMT_OP_USER_CONFIRM_REPLY, 3742 HCI_OP_USER_CONFIRM_REPLY, 0); 3743 } 3744 3745 static int user_confirm_neg_reply(struct sock *sk, struct hci_dev *hdev, 3746 void *data, u16 len) 3747 { 3748 struct mgmt_cp_user_confirm_neg_reply *cp = data; 3749 3750 bt_dev_dbg(hdev, "sock %p", sk); 3751 3752 return user_pairing_resp(sk, hdev, &cp->addr, 3753 MGMT_OP_USER_CONFIRM_NEG_REPLY, 3754 HCI_OP_USER_CONFIRM_NEG_REPLY, 0); 3755 } 3756 3757 static int user_passkey_reply(struct sock *sk, struct hci_dev *hdev, void *data, 3758 u16 len) 3759 { 3760 struct mgmt_cp_user_passkey_reply *cp = data; 3761 3762 bt_dev_dbg(hdev, "sock %p", sk); 3763 3764 return user_pairing_resp(sk, hdev, &cp->addr, 3765 MGMT_OP_USER_PASSKEY_REPLY, 3766 HCI_OP_USER_PASSKEY_REPLY, cp->passkey); 3767 } 3768 3769 static int user_passkey_neg_reply(struct sock *sk, struct hci_dev *hdev, 3770 void *data, u16 len) 3771 { 3772 struct mgmt_cp_user_passkey_neg_reply *cp = data; 3773 3774 bt_dev_dbg(hdev, "sock %p", sk); 3775 3776 return user_pairing_resp(sk, hdev, &cp->addr, 3777 MGMT_OP_USER_PASSKEY_NEG_REPLY, 3778 HCI_OP_USER_PASSKEY_NEG_REPLY, 0); 3779 } 3780 3781 static int adv_expire_sync(struct hci_dev *hdev, u32 flags) 3782 { 3783 struct adv_info *adv_instance; 3784 3785 adv_instance = hci_find_adv_instance(hdev, hdev->cur_adv_instance); 3786 if (!adv_instance) 3787 return 0; 3788 3789 /* stop if current instance doesn't need to be changed */ 3790 if (!(adv_instance->flags & flags)) 3791 return 0; 3792 3793 cancel_adv_timeout(hdev); 3794 3795 adv_instance = hci_get_next_instance(hdev, adv_instance->instance); 3796 if (!adv_instance) 3797 return 0; 3798 3799 hci_schedule_adv_instance_sync(hdev, adv_instance->instance, true); 3800 3801 return 0; 3802 } 3803 3804 static int name_changed_sync(struct hci_dev *hdev, void *data) 3805 { 3806 return adv_expire_sync(hdev, MGMT_ADV_FLAG_LOCAL_NAME); 3807 } 3808 3809 static void set_name_complete(struct hci_dev *hdev, void *data, int err) 3810 { 3811 struct mgmt_pending_cmd *cmd = data; 3812 struct mgmt_cp_set_local_name *cp = cmd->param; 3813 u8 status = mgmt_status(err); 3814 3815 bt_dev_dbg(hdev, "err %d", err); 3816 3817 if (cmd != pending_find(MGMT_OP_SET_LOCAL_NAME, hdev)) 3818 return; 3819 3820 if (status) { 3821 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 3822 status); 3823 } else { 3824 mgmt_cmd_complete(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0, 3825 cp, sizeof(*cp)); 3826 3827 if (hci_dev_test_flag(hdev, HCI_LE_ADV)) 3828 hci_cmd_sync_queue(hdev, name_changed_sync, NULL, NULL); 3829 } 3830 3831 mgmt_pending_remove(cmd); 3832 } 3833 3834 static int set_name_sync(struct hci_dev *hdev, void *data) 3835 { 3836 if (lmp_bredr_capable(hdev)) { 3837 hci_update_name_sync(hdev); 3838 hci_update_eir_sync(hdev); 3839 } 3840 3841 /* The name is stored in the scan response data and so 3842 * no need to update the advertising data here. 3843 */ 3844 if (lmp_le_capable(hdev) && hci_dev_test_flag(hdev, HCI_ADVERTISING)) 3845 hci_update_scan_rsp_data_sync(hdev, hdev->cur_adv_instance); 3846 3847 return 0; 3848 } 3849 3850 static int set_local_name(struct sock *sk, struct hci_dev *hdev, void *data, 3851 u16 len) 3852 { 3853 struct mgmt_cp_set_local_name *cp = data; 3854 struct mgmt_pending_cmd *cmd; 3855 int err; 3856 3857 bt_dev_dbg(hdev, "sock %p", sk); 3858 3859 hci_dev_lock(hdev); 3860 3861 /* If the old values are the same as the new ones just return a 3862 * direct command complete event. 3863 */ 3864 if (!memcmp(hdev->dev_name, cp->name, sizeof(hdev->dev_name)) && 3865 !memcmp(hdev->short_name, cp->short_name, 3866 sizeof(hdev->short_name))) { 3867 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0, 3868 data, len); 3869 goto failed; 3870 } 3871 3872 memcpy(hdev->short_name, cp->short_name, sizeof(hdev->short_name)); 3873 3874 if (!hdev_is_powered(hdev)) { 3875 memcpy(hdev->dev_name, cp->name, sizeof(hdev->dev_name)); 3876 3877 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0, 3878 data, len); 3879 if (err < 0) 3880 goto failed; 3881 3882 err = mgmt_limited_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, data, 3883 len, HCI_MGMT_LOCAL_NAME_EVENTS, sk); 3884 ext_info_changed(hdev, sk); 3885 3886 goto failed; 3887 } 3888 3889 cmd = mgmt_pending_add(sk, MGMT_OP_SET_LOCAL_NAME, hdev, data, len); 3890 if (!cmd) 3891 err = -ENOMEM; 3892 else 3893 err = hci_cmd_sync_queue(hdev, set_name_sync, cmd, 3894 set_name_complete); 3895 3896 if (err < 0) { 3897 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 3898 MGMT_STATUS_FAILED); 3899 3900 if (cmd) 3901 mgmt_pending_remove(cmd); 3902 3903 goto failed; 3904 } 3905 3906 memcpy(hdev->dev_name, cp->name, sizeof(hdev->dev_name)); 3907 3908 failed: 3909 hci_dev_unlock(hdev); 3910 return err; 3911 } 3912 3913 static int appearance_changed_sync(struct hci_dev *hdev, void *data) 3914 { 3915 return adv_expire_sync(hdev, MGMT_ADV_FLAG_APPEARANCE); 3916 } 3917 3918 static int set_appearance(struct sock *sk, struct hci_dev *hdev, void *data, 3919 u16 len) 3920 { 3921 struct mgmt_cp_set_appearance *cp = data; 3922 u16 appearance; 3923 int err; 3924 3925 bt_dev_dbg(hdev, "sock %p", sk); 3926 3927 if (!lmp_le_capable(hdev)) 3928 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_APPEARANCE, 3929 MGMT_STATUS_NOT_SUPPORTED); 3930 3931 appearance = le16_to_cpu(cp->appearance); 3932 3933 hci_dev_lock(hdev); 3934 3935 if (hdev->appearance != appearance) { 3936 hdev->appearance = appearance; 3937 3938 if (hci_dev_test_flag(hdev, HCI_LE_ADV)) 3939 hci_cmd_sync_queue(hdev, appearance_changed_sync, NULL, 3940 NULL); 3941 3942 ext_info_changed(hdev, sk); 3943 } 3944 3945 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_APPEARANCE, 0, NULL, 3946 0); 3947 3948 hci_dev_unlock(hdev); 3949 3950 return err; 3951 } 3952 3953 static int get_phy_configuration(struct sock *sk, struct hci_dev *hdev, 3954 void *data, u16 len) 3955 { 3956 struct mgmt_rp_get_phy_configuration rp; 3957 3958 bt_dev_dbg(hdev, "sock %p", sk); 3959 3960 hci_dev_lock(hdev); 3961 3962 memset(&rp, 0, sizeof(rp)); 3963 3964 rp.supported_phys = cpu_to_le32(get_supported_phys(hdev)); 3965 rp.selected_phys = cpu_to_le32(get_selected_phys(hdev)); 3966 rp.configurable_phys = cpu_to_le32(get_configurable_phys(hdev)); 3967 3968 hci_dev_unlock(hdev); 3969 3970 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_PHY_CONFIGURATION, 0, 3971 &rp, sizeof(rp)); 3972 } 3973 3974 int mgmt_phy_configuration_changed(struct hci_dev *hdev, struct sock *skip) 3975 { 3976 struct mgmt_ev_phy_configuration_changed ev; 3977 3978 memset(&ev, 0, sizeof(ev)); 3979 3980 ev.selected_phys = cpu_to_le32(get_selected_phys(hdev)); 3981 3982 return mgmt_event(MGMT_EV_PHY_CONFIGURATION_CHANGED, hdev, &ev, 3983 sizeof(ev), skip); 3984 } 3985 3986 static void set_default_phy_complete(struct hci_dev *hdev, void *data, int err) 3987 { 3988 struct mgmt_pending_cmd *cmd = data; 3989 struct sk_buff *skb = cmd->skb; 3990 u8 status = mgmt_status(err); 3991 3992 if (cmd != pending_find(MGMT_OP_SET_PHY_CONFIGURATION, hdev)) 3993 return; 3994 3995 if (!status) { 3996 if (!skb) 3997 status = MGMT_STATUS_FAILED; 3998 else if (IS_ERR(skb)) 3999 status = mgmt_status(PTR_ERR(skb)); 4000 else 4001 status = mgmt_status(skb->data[0]); 4002 } 4003 4004 bt_dev_dbg(hdev, "status %d", status); 4005 4006 if (status) { 4007 mgmt_cmd_status(cmd->sk, hdev->id, 4008 MGMT_OP_SET_PHY_CONFIGURATION, status); 4009 } else { 4010 mgmt_cmd_complete(cmd->sk, hdev->id, 4011 MGMT_OP_SET_PHY_CONFIGURATION, 0, 4012 NULL, 0); 4013 4014 mgmt_phy_configuration_changed(hdev, cmd->sk); 4015 } 4016 4017 if (skb && !IS_ERR(skb)) 4018 kfree_skb(skb); 4019 4020 mgmt_pending_remove(cmd); 4021 } 4022 4023 static int set_default_phy_sync(struct hci_dev *hdev, void *data) 4024 { 4025 struct mgmt_pending_cmd *cmd = data; 4026 struct mgmt_cp_set_phy_configuration *cp = cmd->param; 4027 struct hci_cp_le_set_default_phy cp_phy; 4028 u32 selected_phys = __le32_to_cpu(cp->selected_phys); 4029 4030 memset(&cp_phy, 0, sizeof(cp_phy)); 4031 4032 if (!(selected_phys & MGMT_PHY_LE_TX_MASK)) 4033 cp_phy.all_phys |= 0x01; 4034 4035 if (!(selected_phys & MGMT_PHY_LE_RX_MASK)) 4036 cp_phy.all_phys |= 0x02; 4037 4038 if (selected_phys & MGMT_PHY_LE_1M_TX) 4039 cp_phy.tx_phys |= HCI_LE_SET_PHY_1M; 4040 4041 if (selected_phys & MGMT_PHY_LE_2M_TX) 4042 cp_phy.tx_phys |= HCI_LE_SET_PHY_2M; 4043 4044 if (selected_phys & MGMT_PHY_LE_CODED_TX) 4045 cp_phy.tx_phys |= HCI_LE_SET_PHY_CODED; 4046 4047 if (selected_phys & MGMT_PHY_LE_1M_RX) 4048 cp_phy.rx_phys |= HCI_LE_SET_PHY_1M; 4049 4050 if (selected_phys & MGMT_PHY_LE_2M_RX) 4051 cp_phy.rx_phys |= HCI_LE_SET_PHY_2M; 4052 4053 if (selected_phys & MGMT_PHY_LE_CODED_RX) 4054 cp_phy.rx_phys |= HCI_LE_SET_PHY_CODED; 4055 4056 cmd->skb = __hci_cmd_sync(hdev, HCI_OP_LE_SET_DEFAULT_PHY, 4057 sizeof(cp_phy), &cp_phy, HCI_CMD_TIMEOUT); 4058 4059 return 0; 4060 } 4061 4062 static int set_phy_configuration(struct sock *sk, struct hci_dev *hdev, 4063 void *data, u16 len) 4064 { 4065 struct mgmt_cp_set_phy_configuration *cp = data; 4066 struct mgmt_pending_cmd *cmd; 4067 u32 selected_phys, configurable_phys, supported_phys, unconfigure_phys; 4068 u16 pkt_type = (HCI_DH1 | HCI_DM1); 4069 bool changed = false; 4070 int err; 4071 4072 bt_dev_dbg(hdev, "sock %p", sk); 4073 4074 configurable_phys = get_configurable_phys(hdev); 4075 supported_phys = get_supported_phys(hdev); 4076 selected_phys = __le32_to_cpu(cp->selected_phys); 4077 4078 if (selected_phys & ~supported_phys) 4079 return mgmt_cmd_status(sk, hdev->id, 4080 MGMT_OP_SET_PHY_CONFIGURATION, 4081 MGMT_STATUS_INVALID_PARAMS); 4082 4083 unconfigure_phys = supported_phys & ~configurable_phys; 4084 4085 if ((selected_phys & unconfigure_phys) != unconfigure_phys) 4086 return mgmt_cmd_status(sk, hdev->id, 4087 MGMT_OP_SET_PHY_CONFIGURATION, 4088 MGMT_STATUS_INVALID_PARAMS); 4089 4090 if (selected_phys == get_selected_phys(hdev)) 4091 return mgmt_cmd_complete(sk, hdev->id, 4092 MGMT_OP_SET_PHY_CONFIGURATION, 4093 0, NULL, 0); 4094 4095 hci_dev_lock(hdev); 4096 4097 if (!hdev_is_powered(hdev)) { 4098 err = mgmt_cmd_status(sk, hdev->id, 4099 MGMT_OP_SET_PHY_CONFIGURATION, 4100 MGMT_STATUS_REJECTED); 4101 goto unlock; 4102 } 4103 4104 if (pending_find(MGMT_OP_SET_PHY_CONFIGURATION, hdev)) { 4105 err = mgmt_cmd_status(sk, hdev->id, 4106 MGMT_OP_SET_PHY_CONFIGURATION, 4107 MGMT_STATUS_BUSY); 4108 goto unlock; 4109 } 4110 4111 if (selected_phys & MGMT_PHY_BR_1M_3SLOT) 4112 pkt_type |= (HCI_DH3 | HCI_DM3); 4113 else 4114 pkt_type &= ~(HCI_DH3 | HCI_DM3); 4115 4116 if (selected_phys & MGMT_PHY_BR_1M_5SLOT) 4117 pkt_type |= (HCI_DH5 | HCI_DM5); 4118 else 4119 pkt_type &= ~(HCI_DH5 | HCI_DM5); 4120 4121 if (selected_phys & MGMT_PHY_EDR_2M_1SLOT) 4122 pkt_type &= ~HCI_2DH1; 4123 else 4124 pkt_type |= HCI_2DH1; 4125 4126 if (selected_phys & MGMT_PHY_EDR_2M_3SLOT) 4127 pkt_type &= ~HCI_2DH3; 4128 else 4129 pkt_type |= HCI_2DH3; 4130 4131 if (selected_phys & MGMT_PHY_EDR_2M_5SLOT) 4132 pkt_type &= ~HCI_2DH5; 4133 else 4134 pkt_type |= HCI_2DH5; 4135 4136 if (selected_phys & MGMT_PHY_EDR_3M_1SLOT) 4137 pkt_type &= ~HCI_3DH1; 4138 else 4139 pkt_type |= HCI_3DH1; 4140 4141 if (selected_phys & MGMT_PHY_EDR_3M_3SLOT) 4142 pkt_type &= ~HCI_3DH3; 4143 else 4144 pkt_type |= HCI_3DH3; 4145 4146 if (selected_phys & MGMT_PHY_EDR_3M_5SLOT) 4147 pkt_type &= ~HCI_3DH5; 4148 else 4149 pkt_type |= HCI_3DH5; 4150 4151 if (pkt_type != hdev->pkt_type) { 4152 hdev->pkt_type = pkt_type; 4153 changed = true; 4154 } 4155 4156 if ((selected_phys & MGMT_PHY_LE_MASK) == 4157 (get_selected_phys(hdev) & MGMT_PHY_LE_MASK)) { 4158 if (changed) 4159 mgmt_phy_configuration_changed(hdev, sk); 4160 4161 err = mgmt_cmd_complete(sk, hdev->id, 4162 MGMT_OP_SET_PHY_CONFIGURATION, 4163 0, NULL, 0); 4164 4165 goto unlock; 4166 } 4167 4168 cmd = mgmt_pending_add(sk, MGMT_OP_SET_PHY_CONFIGURATION, hdev, data, 4169 len); 4170 if (!cmd) 4171 err = -ENOMEM; 4172 else 4173 err = hci_cmd_sync_queue(hdev, set_default_phy_sync, cmd, 4174 set_default_phy_complete); 4175 4176 if (err < 0) { 4177 err = mgmt_cmd_status(sk, hdev->id, 4178 MGMT_OP_SET_PHY_CONFIGURATION, 4179 MGMT_STATUS_FAILED); 4180 4181 if (cmd) 4182 mgmt_pending_remove(cmd); 4183 } 4184 4185 unlock: 4186 hci_dev_unlock(hdev); 4187 4188 return err; 4189 } 4190 4191 static int set_blocked_keys(struct sock *sk, struct hci_dev *hdev, void *data, 4192 u16 len) 4193 { 4194 int err = MGMT_STATUS_SUCCESS; 4195 struct mgmt_cp_set_blocked_keys *keys = data; 4196 const u16 max_key_count = ((U16_MAX - sizeof(*keys)) / 4197 sizeof(struct mgmt_blocked_key_info)); 4198 u16 key_count, expected_len; 4199 int i; 4200 4201 bt_dev_dbg(hdev, "sock %p", sk); 4202 4203 key_count = __le16_to_cpu(keys->key_count); 4204 if (key_count > max_key_count) { 4205 bt_dev_err(hdev, "too big key_count value %u", key_count); 4206 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BLOCKED_KEYS, 4207 MGMT_STATUS_INVALID_PARAMS); 4208 } 4209 4210 expected_len = struct_size(keys, keys, key_count); 4211 if (expected_len != len) { 4212 bt_dev_err(hdev, "expected %u bytes, got %u bytes", 4213 expected_len, len); 4214 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BLOCKED_KEYS, 4215 MGMT_STATUS_INVALID_PARAMS); 4216 } 4217 4218 hci_dev_lock(hdev); 4219 4220 hci_blocked_keys_clear(hdev); 4221 4222 for (i = 0; i < key_count; ++i) { 4223 struct blocked_key *b = kzalloc(sizeof(*b), GFP_KERNEL); 4224 4225 if (!b) { 4226 err = MGMT_STATUS_NO_RESOURCES; 4227 break; 4228 } 4229 4230 b->type = keys->keys[i].type; 4231 memcpy(b->val, keys->keys[i].val, sizeof(b->val)); 4232 list_add_rcu(&b->list, &hdev->blocked_keys); 4233 } 4234 hci_dev_unlock(hdev); 4235 4236 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_BLOCKED_KEYS, 4237 err, NULL, 0); 4238 } 4239 4240 static int set_wideband_speech(struct sock *sk, struct hci_dev *hdev, 4241 void *data, u16 len) 4242 { 4243 struct mgmt_mode *cp = data; 4244 int err; 4245 bool changed = false; 4246 4247 bt_dev_dbg(hdev, "sock %p", sk); 4248 4249 if (!test_bit(HCI_QUIRK_WIDEBAND_SPEECH_SUPPORTED, &hdev->quirks)) 4250 return mgmt_cmd_status(sk, hdev->id, 4251 MGMT_OP_SET_WIDEBAND_SPEECH, 4252 MGMT_STATUS_NOT_SUPPORTED); 4253 4254 if (cp->val != 0x00 && cp->val != 0x01) 4255 return mgmt_cmd_status(sk, hdev->id, 4256 MGMT_OP_SET_WIDEBAND_SPEECH, 4257 MGMT_STATUS_INVALID_PARAMS); 4258 4259 hci_dev_lock(hdev); 4260 4261 if (hdev_is_powered(hdev) && 4262 !!cp->val != hci_dev_test_flag(hdev, 4263 HCI_WIDEBAND_SPEECH_ENABLED)) { 4264 err = mgmt_cmd_status(sk, hdev->id, 4265 MGMT_OP_SET_WIDEBAND_SPEECH, 4266 MGMT_STATUS_REJECTED); 4267 goto unlock; 4268 } 4269 4270 if (cp->val) 4271 changed = !hci_dev_test_and_set_flag(hdev, 4272 HCI_WIDEBAND_SPEECH_ENABLED); 4273 else 4274 changed = hci_dev_test_and_clear_flag(hdev, 4275 HCI_WIDEBAND_SPEECH_ENABLED); 4276 4277 err = send_settings_rsp(sk, MGMT_OP_SET_WIDEBAND_SPEECH, hdev); 4278 if (err < 0) 4279 goto unlock; 4280 4281 if (changed) 4282 err = new_settings(hdev, sk); 4283 4284 unlock: 4285 hci_dev_unlock(hdev); 4286 return err; 4287 } 4288 4289 static int read_controller_cap(struct sock *sk, struct hci_dev *hdev, 4290 void *data, u16 data_len) 4291 { 4292 char buf[20]; 4293 struct mgmt_rp_read_controller_cap *rp = (void *)buf; 4294 u16 cap_len = 0; 4295 u8 flags = 0; 4296 u8 tx_power_range[2]; 4297 4298 bt_dev_dbg(hdev, "sock %p", sk); 4299 4300 memset(&buf, 0, sizeof(buf)); 4301 4302 hci_dev_lock(hdev); 4303 4304 /* When the Read Simple Pairing Options command is supported, then 4305 * the remote public key validation is supported. 4306 * 4307 * Alternatively, when Microsoft extensions are available, they can 4308 * indicate support for public key validation as well. 4309 */ 4310 if ((hdev->commands[41] & 0x08) || msft_curve_validity(hdev)) 4311 flags |= 0x01; /* Remote public key validation (BR/EDR) */ 4312 4313 flags |= 0x02; /* Remote public key validation (LE) */ 4314 4315 /* When the Read Encryption Key Size command is supported, then the 4316 * encryption key size is enforced. 4317 */ 4318 if (hdev->commands[20] & 0x10) 4319 flags |= 0x04; /* Encryption key size enforcement (BR/EDR) */ 4320 4321 flags |= 0x08; /* Encryption key size enforcement (LE) */ 4322 4323 cap_len = eir_append_data(rp->cap, cap_len, MGMT_CAP_SEC_FLAGS, 4324 &flags, 1); 4325 4326 /* When the Read Simple Pairing Options command is supported, then 4327 * also max encryption key size information is provided. 4328 */ 4329 if (hdev->commands[41] & 0x08) 4330 cap_len = eir_append_le16(rp->cap, cap_len, 4331 MGMT_CAP_MAX_ENC_KEY_SIZE, 4332 hdev->max_enc_key_size); 4333 4334 cap_len = eir_append_le16(rp->cap, cap_len, 4335 MGMT_CAP_SMP_MAX_ENC_KEY_SIZE, 4336 SMP_MAX_ENC_KEY_SIZE); 4337 4338 /* Append the min/max LE tx power parameters if we were able to fetch 4339 * it from the controller 4340 */ 4341 if (hdev->commands[38] & 0x80) { 4342 memcpy(&tx_power_range[0], &hdev->min_le_tx_power, 1); 4343 memcpy(&tx_power_range[1], &hdev->max_le_tx_power, 1); 4344 cap_len = eir_append_data(rp->cap, cap_len, MGMT_CAP_LE_TX_PWR, 4345 tx_power_range, 2); 4346 } 4347 4348 rp->cap_len = cpu_to_le16(cap_len); 4349 4350 hci_dev_unlock(hdev); 4351 4352 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_CONTROLLER_CAP, 0, 4353 rp, sizeof(*rp) + cap_len); 4354 } 4355 4356 #ifdef CONFIG_BT_FEATURE_DEBUG 4357 /* d4992530-b9ec-469f-ab01-6c481c47da1c */ 4358 static const u8 debug_uuid[16] = { 4359 0x1c, 0xda, 0x47, 0x1c, 0x48, 0x6c, 0x01, 0xab, 4360 0x9f, 0x46, 0xec, 0xb9, 0x30, 0x25, 0x99, 0xd4, 4361 }; 4362 #endif 4363 4364 /* 330859bc-7506-492d-9370-9a6f0614037f */ 4365 static const u8 quality_report_uuid[16] = { 4366 0x7f, 0x03, 0x14, 0x06, 0x6f, 0x9a, 0x70, 0x93, 4367 0x2d, 0x49, 0x06, 0x75, 0xbc, 0x59, 0x08, 0x33, 4368 }; 4369 4370 /* a6695ace-ee7f-4fb9-881a-5fac66c629af */ 4371 static const u8 offload_codecs_uuid[16] = { 4372 0xaf, 0x29, 0xc6, 0x66, 0xac, 0x5f, 0x1a, 0x88, 4373 0xb9, 0x4f, 0x7f, 0xee, 0xce, 0x5a, 0x69, 0xa6, 4374 }; 4375 4376 /* 671b10b5-42c0-4696-9227-eb28d1b049d6 */ 4377 static const u8 le_simultaneous_roles_uuid[16] = { 4378 0xd6, 0x49, 0xb0, 0xd1, 0x28, 0xeb, 0x27, 0x92, 4379 0x96, 0x46, 0xc0, 0x42, 0xb5, 0x10, 0x1b, 0x67, 4380 }; 4381 4382 /* 15c0a148-c273-11ea-b3de-0242ac130004 */ 4383 static const u8 rpa_resolution_uuid[16] = { 4384 0x04, 0x00, 0x13, 0xac, 0x42, 0x02, 0xde, 0xb3, 4385 0xea, 0x11, 0x73, 0xc2, 0x48, 0xa1, 0xc0, 0x15, 4386 }; 4387 4388 /* 6fbaf188-05e0-496a-9885-d6ddfdb4e03e */ 4389 static const u8 iso_socket_uuid[16] = { 4390 0x3e, 0xe0, 0xb4, 0xfd, 0xdd, 0xd6, 0x85, 0x98, 4391 0x6a, 0x49, 0xe0, 0x05, 0x88, 0xf1, 0xba, 0x6f, 4392 }; 4393 4394 /* 2ce463d7-7a03-4d8d-bf05-5f24e8f36e76 */ 4395 static const u8 mgmt_mesh_uuid[16] = { 4396 0x76, 0x6e, 0xf3, 0xe8, 0x24, 0x5f, 0x05, 0xbf, 4397 0x8d, 0x4d, 0x03, 0x7a, 0xd7, 0x63, 0xe4, 0x2c, 4398 }; 4399 4400 static int read_exp_features_info(struct sock *sk, struct hci_dev *hdev, 4401 void *data, u16 data_len) 4402 { 4403 struct mgmt_rp_read_exp_features_info *rp; 4404 size_t len; 4405 u16 idx = 0; 4406 u32 flags; 4407 int status; 4408 4409 bt_dev_dbg(hdev, "sock %p", sk); 4410 4411 /* Enough space for 7 features */ 4412 len = sizeof(*rp) + (sizeof(rp->features[0]) * 7); 4413 rp = kzalloc(len, GFP_KERNEL); 4414 if (!rp) 4415 return -ENOMEM; 4416 4417 #ifdef CONFIG_BT_FEATURE_DEBUG 4418 if (!hdev) { 4419 flags = bt_dbg_get() ? BIT(0) : 0; 4420 4421 memcpy(rp->features[idx].uuid, debug_uuid, 16); 4422 rp->features[idx].flags = cpu_to_le32(flags); 4423 idx++; 4424 } 4425 #endif 4426 4427 if (hdev && hci_dev_le_state_simultaneous(hdev)) { 4428 if (hci_dev_test_flag(hdev, HCI_LE_SIMULTANEOUS_ROLES)) 4429 flags = BIT(0); 4430 else 4431 flags = 0; 4432 4433 memcpy(rp->features[idx].uuid, le_simultaneous_roles_uuid, 16); 4434 rp->features[idx].flags = cpu_to_le32(flags); 4435 idx++; 4436 } 4437 4438 if (hdev && ll_privacy_capable(hdev)) { 4439 if (hci_dev_test_flag(hdev, HCI_ENABLE_LL_PRIVACY)) 4440 flags = BIT(0) | BIT(1); 4441 else 4442 flags = BIT(1); 4443 4444 memcpy(rp->features[idx].uuid, rpa_resolution_uuid, 16); 4445 rp->features[idx].flags = cpu_to_le32(flags); 4446 idx++; 4447 } 4448 4449 if (hdev && (aosp_has_quality_report(hdev) || 4450 hdev->set_quality_report)) { 4451 if (hci_dev_test_flag(hdev, HCI_QUALITY_REPORT)) 4452 flags = BIT(0); 4453 else 4454 flags = 0; 4455 4456 memcpy(rp->features[idx].uuid, quality_report_uuid, 16); 4457 rp->features[idx].flags = cpu_to_le32(flags); 4458 idx++; 4459 } 4460 4461 if (hdev && hdev->get_data_path_id) { 4462 if (hci_dev_test_flag(hdev, HCI_OFFLOAD_CODECS_ENABLED)) 4463 flags = BIT(0); 4464 else 4465 flags = 0; 4466 4467 memcpy(rp->features[idx].uuid, offload_codecs_uuid, 16); 4468 rp->features[idx].flags = cpu_to_le32(flags); 4469 idx++; 4470 } 4471 4472 if (IS_ENABLED(CONFIG_BT_LE)) { 4473 flags = iso_enabled() ? BIT(0) : 0; 4474 memcpy(rp->features[idx].uuid, iso_socket_uuid, 16); 4475 rp->features[idx].flags = cpu_to_le32(flags); 4476 idx++; 4477 } 4478 4479 if (hdev && lmp_le_capable(hdev)) { 4480 if (hci_dev_test_flag(hdev, HCI_MESH_EXPERIMENTAL)) 4481 flags = BIT(0); 4482 else 4483 flags = 0; 4484 4485 memcpy(rp->features[idx].uuid, mgmt_mesh_uuid, 16); 4486 rp->features[idx].flags = cpu_to_le32(flags); 4487 idx++; 4488 } 4489 4490 rp->feature_count = cpu_to_le16(idx); 4491 4492 /* After reading the experimental features information, enable 4493 * the events to update client on any future change. 4494 */ 4495 hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS); 4496 4497 status = mgmt_cmd_complete(sk, hdev ? hdev->id : MGMT_INDEX_NONE, 4498 MGMT_OP_READ_EXP_FEATURES_INFO, 4499 0, rp, sizeof(*rp) + (20 * idx)); 4500 4501 kfree(rp); 4502 return status; 4503 } 4504 4505 static int exp_ll_privacy_feature_changed(bool enabled, struct hci_dev *hdev, 4506 struct sock *skip) 4507 { 4508 struct mgmt_ev_exp_feature_changed ev; 4509 4510 memset(&ev, 0, sizeof(ev)); 4511 memcpy(ev.uuid, rpa_resolution_uuid, 16); 4512 ev.flags = cpu_to_le32((enabled ? BIT(0) : 0) | BIT(1)); 4513 4514 // Do we need to be atomic with the conn_flags? 4515 if (enabled && privacy_mode_capable(hdev)) 4516 hdev->conn_flags |= HCI_CONN_FLAG_DEVICE_PRIVACY; 4517 else 4518 hdev->conn_flags &= ~HCI_CONN_FLAG_DEVICE_PRIVACY; 4519 4520 return mgmt_limited_event(MGMT_EV_EXP_FEATURE_CHANGED, hdev, 4521 &ev, sizeof(ev), 4522 HCI_MGMT_EXP_FEATURE_EVENTS, skip); 4523 4524 } 4525 4526 static int exp_feature_changed(struct hci_dev *hdev, const u8 *uuid, 4527 bool enabled, struct sock *skip) 4528 { 4529 struct mgmt_ev_exp_feature_changed ev; 4530 4531 memset(&ev, 0, sizeof(ev)); 4532 memcpy(ev.uuid, uuid, 16); 4533 ev.flags = cpu_to_le32(enabled ? BIT(0) : 0); 4534 4535 return mgmt_limited_event(MGMT_EV_EXP_FEATURE_CHANGED, hdev, 4536 &ev, sizeof(ev), 4537 HCI_MGMT_EXP_FEATURE_EVENTS, skip); 4538 } 4539 4540 #define EXP_FEAT(_uuid, _set_func) \ 4541 { \ 4542 .uuid = _uuid, \ 4543 .set_func = _set_func, \ 4544 } 4545 4546 /* The zero key uuid is special. Multiple exp features are set through it. */ 4547 static int set_zero_key_func(struct sock *sk, struct hci_dev *hdev, 4548 struct mgmt_cp_set_exp_feature *cp, u16 data_len) 4549 { 4550 struct mgmt_rp_set_exp_feature rp; 4551 4552 memset(rp.uuid, 0, 16); 4553 rp.flags = cpu_to_le32(0); 4554 4555 #ifdef CONFIG_BT_FEATURE_DEBUG 4556 if (!hdev) { 4557 bool changed = bt_dbg_get(); 4558 4559 bt_dbg_set(false); 4560 4561 if (changed) 4562 exp_feature_changed(NULL, ZERO_KEY, false, sk); 4563 } 4564 #endif 4565 4566 if (hdev && use_ll_privacy(hdev) && !hdev_is_powered(hdev)) { 4567 bool changed; 4568 4569 changed = hci_dev_test_and_clear_flag(hdev, 4570 HCI_ENABLE_LL_PRIVACY); 4571 if (changed) 4572 exp_feature_changed(hdev, rpa_resolution_uuid, false, 4573 sk); 4574 } 4575 4576 hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS); 4577 4578 return mgmt_cmd_complete(sk, hdev ? hdev->id : MGMT_INDEX_NONE, 4579 MGMT_OP_SET_EXP_FEATURE, 0, 4580 &rp, sizeof(rp)); 4581 } 4582 4583 #ifdef CONFIG_BT_FEATURE_DEBUG 4584 static int set_debug_func(struct sock *sk, struct hci_dev *hdev, 4585 struct mgmt_cp_set_exp_feature *cp, u16 data_len) 4586 { 4587 struct mgmt_rp_set_exp_feature rp; 4588 4589 bool val, changed; 4590 int err; 4591 4592 /* Command requires to use the non-controller index */ 4593 if (hdev) 4594 return mgmt_cmd_status(sk, hdev->id, 4595 MGMT_OP_SET_EXP_FEATURE, 4596 MGMT_STATUS_INVALID_INDEX); 4597 4598 /* Parameters are limited to a single octet */ 4599 if (data_len != MGMT_SET_EXP_FEATURE_SIZE + 1) 4600 return mgmt_cmd_status(sk, MGMT_INDEX_NONE, 4601 MGMT_OP_SET_EXP_FEATURE, 4602 MGMT_STATUS_INVALID_PARAMS); 4603 4604 /* Only boolean on/off is supported */ 4605 if (cp->param[0] != 0x00 && cp->param[0] != 0x01) 4606 return mgmt_cmd_status(sk, MGMT_INDEX_NONE, 4607 MGMT_OP_SET_EXP_FEATURE, 4608 MGMT_STATUS_INVALID_PARAMS); 4609 4610 val = !!cp->param[0]; 4611 changed = val ? !bt_dbg_get() : bt_dbg_get(); 4612 bt_dbg_set(val); 4613 4614 memcpy(rp.uuid, debug_uuid, 16); 4615 rp.flags = cpu_to_le32(val ? BIT(0) : 0); 4616 4617 hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS); 4618 4619 err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE, 4620 MGMT_OP_SET_EXP_FEATURE, 0, 4621 &rp, sizeof(rp)); 4622 4623 if (changed) 4624 exp_feature_changed(hdev, debug_uuid, val, sk); 4625 4626 return err; 4627 } 4628 #endif 4629 4630 static int set_mgmt_mesh_func(struct sock *sk, struct hci_dev *hdev, 4631 struct mgmt_cp_set_exp_feature *cp, u16 data_len) 4632 { 4633 struct mgmt_rp_set_exp_feature rp; 4634 bool val, changed; 4635 int err; 4636 4637 /* Command requires to use the controller index */ 4638 if (!hdev) 4639 return mgmt_cmd_status(sk, MGMT_INDEX_NONE, 4640 MGMT_OP_SET_EXP_FEATURE, 4641 MGMT_STATUS_INVALID_INDEX); 4642 4643 /* Parameters are limited to a single octet */ 4644 if (data_len != MGMT_SET_EXP_FEATURE_SIZE + 1) 4645 return mgmt_cmd_status(sk, hdev->id, 4646 MGMT_OP_SET_EXP_FEATURE, 4647 MGMT_STATUS_INVALID_PARAMS); 4648 4649 /* Only boolean on/off is supported */ 4650 if (cp->param[0] != 0x00 && cp->param[0] != 0x01) 4651 return mgmt_cmd_status(sk, hdev->id, 4652 MGMT_OP_SET_EXP_FEATURE, 4653 MGMT_STATUS_INVALID_PARAMS); 4654 4655 val = !!cp->param[0]; 4656 4657 if (val) { 4658 changed = !hci_dev_test_and_set_flag(hdev, 4659 HCI_MESH_EXPERIMENTAL); 4660 } else { 4661 hci_dev_clear_flag(hdev, HCI_MESH); 4662 changed = hci_dev_test_and_clear_flag(hdev, 4663 HCI_MESH_EXPERIMENTAL); 4664 } 4665 4666 memcpy(rp.uuid, mgmt_mesh_uuid, 16); 4667 rp.flags = cpu_to_le32(val ? BIT(0) : 0); 4668 4669 hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS); 4670 4671 err = mgmt_cmd_complete(sk, hdev->id, 4672 MGMT_OP_SET_EXP_FEATURE, 0, 4673 &rp, sizeof(rp)); 4674 4675 if (changed) 4676 exp_feature_changed(hdev, mgmt_mesh_uuid, val, sk); 4677 4678 return err; 4679 } 4680 4681 static int set_rpa_resolution_func(struct sock *sk, struct hci_dev *hdev, 4682 struct mgmt_cp_set_exp_feature *cp, 4683 u16 data_len) 4684 { 4685 struct mgmt_rp_set_exp_feature rp; 4686 bool val, changed; 4687 int err; 4688 u32 flags; 4689 4690 /* Command requires to use the controller index */ 4691 if (!hdev) 4692 return mgmt_cmd_status(sk, MGMT_INDEX_NONE, 4693 MGMT_OP_SET_EXP_FEATURE, 4694 MGMT_STATUS_INVALID_INDEX); 4695 4696 /* Changes can only be made when controller is powered down */ 4697 if (hdev_is_powered(hdev)) 4698 return mgmt_cmd_status(sk, hdev->id, 4699 MGMT_OP_SET_EXP_FEATURE, 4700 MGMT_STATUS_REJECTED); 4701 4702 /* Parameters are limited to a single octet */ 4703 if (data_len != MGMT_SET_EXP_FEATURE_SIZE + 1) 4704 return mgmt_cmd_status(sk, hdev->id, 4705 MGMT_OP_SET_EXP_FEATURE, 4706 MGMT_STATUS_INVALID_PARAMS); 4707 4708 /* Only boolean on/off is supported */ 4709 if (cp->param[0] != 0x00 && cp->param[0] != 0x01) 4710 return mgmt_cmd_status(sk, hdev->id, 4711 MGMT_OP_SET_EXP_FEATURE, 4712 MGMT_STATUS_INVALID_PARAMS); 4713 4714 val = !!cp->param[0]; 4715 4716 if (val) { 4717 changed = !hci_dev_test_and_set_flag(hdev, 4718 HCI_ENABLE_LL_PRIVACY); 4719 hci_dev_clear_flag(hdev, HCI_ADVERTISING); 4720 4721 /* Enable LL privacy + supported settings changed */ 4722 flags = BIT(0) | BIT(1); 4723 } else { 4724 changed = hci_dev_test_and_clear_flag(hdev, 4725 HCI_ENABLE_LL_PRIVACY); 4726 4727 /* Disable LL privacy + supported settings changed */ 4728 flags = BIT(1); 4729 } 4730 4731 memcpy(rp.uuid, rpa_resolution_uuid, 16); 4732 rp.flags = cpu_to_le32(flags); 4733 4734 hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS); 4735 4736 err = mgmt_cmd_complete(sk, hdev->id, 4737 MGMT_OP_SET_EXP_FEATURE, 0, 4738 &rp, sizeof(rp)); 4739 4740 if (changed) 4741 exp_ll_privacy_feature_changed(val, hdev, sk); 4742 4743 return err; 4744 } 4745 4746 static int set_quality_report_func(struct sock *sk, struct hci_dev *hdev, 4747 struct mgmt_cp_set_exp_feature *cp, 4748 u16 data_len) 4749 { 4750 struct mgmt_rp_set_exp_feature rp; 4751 bool val, changed; 4752 int err; 4753 4754 /* Command requires to use a valid controller index */ 4755 if (!hdev) 4756 return mgmt_cmd_status(sk, MGMT_INDEX_NONE, 4757 MGMT_OP_SET_EXP_FEATURE, 4758 MGMT_STATUS_INVALID_INDEX); 4759 4760 /* Parameters are limited to a single octet */ 4761 if (data_len != MGMT_SET_EXP_FEATURE_SIZE + 1) 4762 return mgmt_cmd_status(sk, hdev->id, 4763 MGMT_OP_SET_EXP_FEATURE, 4764 MGMT_STATUS_INVALID_PARAMS); 4765 4766 /* Only boolean on/off is supported */ 4767 if (cp->param[0] != 0x00 && cp->param[0] != 0x01) 4768 return mgmt_cmd_status(sk, hdev->id, 4769 MGMT_OP_SET_EXP_FEATURE, 4770 MGMT_STATUS_INVALID_PARAMS); 4771 4772 hci_req_sync_lock(hdev); 4773 4774 val = !!cp->param[0]; 4775 changed = (val != hci_dev_test_flag(hdev, HCI_QUALITY_REPORT)); 4776 4777 if (!aosp_has_quality_report(hdev) && !hdev->set_quality_report) { 4778 err = mgmt_cmd_status(sk, hdev->id, 4779 MGMT_OP_SET_EXP_FEATURE, 4780 MGMT_STATUS_NOT_SUPPORTED); 4781 goto unlock_quality_report; 4782 } 4783 4784 if (changed) { 4785 if (hdev->set_quality_report) 4786 err = hdev->set_quality_report(hdev, val); 4787 else 4788 err = aosp_set_quality_report(hdev, val); 4789 4790 if (err) { 4791 err = mgmt_cmd_status(sk, hdev->id, 4792 MGMT_OP_SET_EXP_FEATURE, 4793 MGMT_STATUS_FAILED); 4794 goto unlock_quality_report; 4795 } 4796 4797 if (val) 4798 hci_dev_set_flag(hdev, HCI_QUALITY_REPORT); 4799 else 4800 hci_dev_clear_flag(hdev, HCI_QUALITY_REPORT); 4801 } 4802 4803 bt_dev_dbg(hdev, "quality report enable %d changed %d", val, changed); 4804 4805 memcpy(rp.uuid, quality_report_uuid, 16); 4806 rp.flags = cpu_to_le32(val ? BIT(0) : 0); 4807 hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS); 4808 4809 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_EXP_FEATURE, 0, 4810 &rp, sizeof(rp)); 4811 4812 if (changed) 4813 exp_feature_changed(hdev, quality_report_uuid, val, sk); 4814 4815 unlock_quality_report: 4816 hci_req_sync_unlock(hdev); 4817 return err; 4818 } 4819 4820 static int set_offload_codec_func(struct sock *sk, struct hci_dev *hdev, 4821 struct mgmt_cp_set_exp_feature *cp, 4822 u16 data_len) 4823 { 4824 bool val, changed; 4825 int err; 4826 struct mgmt_rp_set_exp_feature rp; 4827 4828 /* Command requires to use a valid controller index */ 4829 if (!hdev) 4830 return mgmt_cmd_status(sk, MGMT_INDEX_NONE, 4831 MGMT_OP_SET_EXP_FEATURE, 4832 MGMT_STATUS_INVALID_INDEX); 4833 4834 /* Parameters are limited to a single octet */ 4835 if (data_len != MGMT_SET_EXP_FEATURE_SIZE + 1) 4836 return mgmt_cmd_status(sk, hdev->id, 4837 MGMT_OP_SET_EXP_FEATURE, 4838 MGMT_STATUS_INVALID_PARAMS); 4839 4840 /* Only boolean on/off is supported */ 4841 if (cp->param[0] != 0x00 && cp->param[0] != 0x01) 4842 return mgmt_cmd_status(sk, hdev->id, 4843 MGMT_OP_SET_EXP_FEATURE, 4844 MGMT_STATUS_INVALID_PARAMS); 4845 4846 val = !!cp->param[0]; 4847 changed = (val != hci_dev_test_flag(hdev, HCI_OFFLOAD_CODECS_ENABLED)); 4848 4849 if (!hdev->get_data_path_id) { 4850 return mgmt_cmd_status(sk, hdev->id, 4851 MGMT_OP_SET_EXP_FEATURE, 4852 MGMT_STATUS_NOT_SUPPORTED); 4853 } 4854 4855 if (changed) { 4856 if (val) 4857 hci_dev_set_flag(hdev, HCI_OFFLOAD_CODECS_ENABLED); 4858 else 4859 hci_dev_clear_flag(hdev, HCI_OFFLOAD_CODECS_ENABLED); 4860 } 4861 4862 bt_dev_info(hdev, "offload codecs enable %d changed %d", 4863 val, changed); 4864 4865 memcpy(rp.uuid, offload_codecs_uuid, 16); 4866 rp.flags = cpu_to_le32(val ? BIT(0) : 0); 4867 hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS); 4868 err = mgmt_cmd_complete(sk, hdev->id, 4869 MGMT_OP_SET_EXP_FEATURE, 0, 4870 &rp, sizeof(rp)); 4871 4872 if (changed) 4873 exp_feature_changed(hdev, offload_codecs_uuid, val, sk); 4874 4875 return err; 4876 } 4877 4878 static int set_le_simultaneous_roles_func(struct sock *sk, struct hci_dev *hdev, 4879 struct mgmt_cp_set_exp_feature *cp, 4880 u16 data_len) 4881 { 4882 bool val, changed; 4883 int err; 4884 struct mgmt_rp_set_exp_feature rp; 4885 4886 /* Command requires to use a valid controller index */ 4887 if (!hdev) 4888 return mgmt_cmd_status(sk, MGMT_INDEX_NONE, 4889 MGMT_OP_SET_EXP_FEATURE, 4890 MGMT_STATUS_INVALID_INDEX); 4891 4892 /* Parameters are limited to a single octet */ 4893 if (data_len != MGMT_SET_EXP_FEATURE_SIZE + 1) 4894 return mgmt_cmd_status(sk, hdev->id, 4895 MGMT_OP_SET_EXP_FEATURE, 4896 MGMT_STATUS_INVALID_PARAMS); 4897 4898 /* Only boolean on/off is supported */ 4899 if (cp->param[0] != 0x00 && cp->param[0] != 0x01) 4900 return mgmt_cmd_status(sk, hdev->id, 4901 MGMT_OP_SET_EXP_FEATURE, 4902 MGMT_STATUS_INVALID_PARAMS); 4903 4904 val = !!cp->param[0]; 4905 changed = (val != hci_dev_test_flag(hdev, HCI_LE_SIMULTANEOUS_ROLES)); 4906 4907 if (!hci_dev_le_state_simultaneous(hdev)) { 4908 return mgmt_cmd_status(sk, hdev->id, 4909 MGMT_OP_SET_EXP_FEATURE, 4910 MGMT_STATUS_NOT_SUPPORTED); 4911 } 4912 4913 if (changed) { 4914 if (val) 4915 hci_dev_set_flag(hdev, HCI_LE_SIMULTANEOUS_ROLES); 4916 else 4917 hci_dev_clear_flag(hdev, HCI_LE_SIMULTANEOUS_ROLES); 4918 } 4919 4920 bt_dev_info(hdev, "LE simultaneous roles enable %d changed %d", 4921 val, changed); 4922 4923 memcpy(rp.uuid, le_simultaneous_roles_uuid, 16); 4924 rp.flags = cpu_to_le32(val ? BIT(0) : 0); 4925 hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS); 4926 err = mgmt_cmd_complete(sk, hdev->id, 4927 MGMT_OP_SET_EXP_FEATURE, 0, 4928 &rp, sizeof(rp)); 4929 4930 if (changed) 4931 exp_feature_changed(hdev, le_simultaneous_roles_uuid, val, sk); 4932 4933 return err; 4934 } 4935 4936 #ifdef CONFIG_BT_LE 4937 static int set_iso_socket_func(struct sock *sk, struct hci_dev *hdev, 4938 struct mgmt_cp_set_exp_feature *cp, u16 data_len) 4939 { 4940 struct mgmt_rp_set_exp_feature rp; 4941 bool val, changed = false; 4942 int err; 4943 4944 /* Command requires to use the non-controller index */ 4945 if (hdev) 4946 return mgmt_cmd_status(sk, hdev->id, 4947 MGMT_OP_SET_EXP_FEATURE, 4948 MGMT_STATUS_INVALID_INDEX); 4949 4950 /* Parameters are limited to a single octet */ 4951 if (data_len != MGMT_SET_EXP_FEATURE_SIZE + 1) 4952 return mgmt_cmd_status(sk, MGMT_INDEX_NONE, 4953 MGMT_OP_SET_EXP_FEATURE, 4954 MGMT_STATUS_INVALID_PARAMS); 4955 4956 /* Only boolean on/off is supported */ 4957 if (cp->param[0] != 0x00 && cp->param[0] != 0x01) 4958 return mgmt_cmd_status(sk, MGMT_INDEX_NONE, 4959 MGMT_OP_SET_EXP_FEATURE, 4960 MGMT_STATUS_INVALID_PARAMS); 4961 4962 val = cp->param[0] ? true : false; 4963 if (val) 4964 err = iso_init(); 4965 else 4966 err = iso_exit(); 4967 4968 if (!err) 4969 changed = true; 4970 4971 memcpy(rp.uuid, iso_socket_uuid, 16); 4972 rp.flags = cpu_to_le32(val ? BIT(0) : 0); 4973 4974 hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS); 4975 4976 err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE, 4977 MGMT_OP_SET_EXP_FEATURE, 0, 4978 &rp, sizeof(rp)); 4979 4980 if (changed) 4981 exp_feature_changed(hdev, iso_socket_uuid, val, sk); 4982 4983 return err; 4984 } 4985 #endif 4986 4987 static const struct mgmt_exp_feature { 4988 const u8 *uuid; 4989 int (*set_func)(struct sock *sk, struct hci_dev *hdev, 4990 struct mgmt_cp_set_exp_feature *cp, u16 data_len); 4991 } exp_features[] = { 4992 EXP_FEAT(ZERO_KEY, set_zero_key_func), 4993 #ifdef CONFIG_BT_FEATURE_DEBUG 4994 EXP_FEAT(debug_uuid, set_debug_func), 4995 #endif 4996 EXP_FEAT(mgmt_mesh_uuid, set_mgmt_mesh_func), 4997 EXP_FEAT(rpa_resolution_uuid, set_rpa_resolution_func), 4998 EXP_FEAT(quality_report_uuid, set_quality_report_func), 4999 EXP_FEAT(offload_codecs_uuid, set_offload_codec_func), 5000 EXP_FEAT(le_simultaneous_roles_uuid, set_le_simultaneous_roles_func), 5001 #ifdef CONFIG_BT_LE 5002 EXP_FEAT(iso_socket_uuid, set_iso_socket_func), 5003 #endif 5004 5005 /* end with a null feature */ 5006 EXP_FEAT(NULL, NULL) 5007 }; 5008 5009 static int set_exp_feature(struct sock *sk, struct hci_dev *hdev, 5010 void *data, u16 data_len) 5011 { 5012 struct mgmt_cp_set_exp_feature *cp = data; 5013 size_t i = 0; 5014 5015 bt_dev_dbg(hdev, "sock %p", sk); 5016 5017 for (i = 0; exp_features[i].uuid; i++) { 5018 if (!memcmp(cp->uuid, exp_features[i].uuid, 16)) 5019 return exp_features[i].set_func(sk, hdev, cp, data_len); 5020 } 5021 5022 return mgmt_cmd_status(sk, hdev ? hdev->id : MGMT_INDEX_NONE, 5023 MGMT_OP_SET_EXP_FEATURE, 5024 MGMT_STATUS_NOT_SUPPORTED); 5025 } 5026 5027 static u32 get_params_flags(struct hci_dev *hdev, 5028 struct hci_conn_params *params) 5029 { 5030 u32 flags = hdev->conn_flags; 5031 5032 /* Devices using RPAs can only be programmed in the acceptlist if 5033 * LL Privacy has been enable otherwise they cannot mark 5034 * HCI_CONN_FLAG_REMOTE_WAKEUP. 5035 */ 5036 if ((flags & HCI_CONN_FLAG_REMOTE_WAKEUP) && !use_ll_privacy(hdev) && 5037 hci_find_irk_by_addr(hdev, ¶ms->addr, params->addr_type)) 5038 flags &= ~HCI_CONN_FLAG_REMOTE_WAKEUP; 5039 5040 return flags; 5041 } 5042 5043 static int get_device_flags(struct sock *sk, struct hci_dev *hdev, void *data, 5044 u16 data_len) 5045 { 5046 struct mgmt_cp_get_device_flags *cp = data; 5047 struct mgmt_rp_get_device_flags rp; 5048 struct bdaddr_list_with_flags *br_params; 5049 struct hci_conn_params *params; 5050 u32 supported_flags; 5051 u32 current_flags = 0; 5052 u8 status = MGMT_STATUS_INVALID_PARAMS; 5053 5054 bt_dev_dbg(hdev, "Get device flags %pMR (type 0x%x)\n", 5055 &cp->addr.bdaddr, cp->addr.type); 5056 5057 hci_dev_lock(hdev); 5058 5059 supported_flags = hdev->conn_flags; 5060 5061 memset(&rp, 0, sizeof(rp)); 5062 5063 if (cp->addr.type == BDADDR_BREDR) { 5064 br_params = hci_bdaddr_list_lookup_with_flags(&hdev->accept_list, 5065 &cp->addr.bdaddr, 5066 cp->addr.type); 5067 if (!br_params) 5068 goto done; 5069 5070 current_flags = br_params->flags; 5071 } else { 5072 params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr, 5073 le_addr_type(cp->addr.type)); 5074 if (!params) 5075 goto done; 5076 5077 supported_flags = get_params_flags(hdev, params); 5078 current_flags = params->flags; 5079 } 5080 5081 bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr); 5082 rp.addr.type = cp->addr.type; 5083 rp.supported_flags = cpu_to_le32(supported_flags); 5084 rp.current_flags = cpu_to_le32(current_flags); 5085 5086 status = MGMT_STATUS_SUCCESS; 5087 5088 done: 5089 hci_dev_unlock(hdev); 5090 5091 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_DEVICE_FLAGS, status, 5092 &rp, sizeof(rp)); 5093 } 5094 5095 static void device_flags_changed(struct sock *sk, struct hci_dev *hdev, 5096 bdaddr_t *bdaddr, u8 bdaddr_type, 5097 u32 supported_flags, u32 current_flags) 5098 { 5099 struct mgmt_ev_device_flags_changed ev; 5100 5101 bacpy(&ev.addr.bdaddr, bdaddr); 5102 ev.addr.type = bdaddr_type; 5103 ev.supported_flags = cpu_to_le32(supported_flags); 5104 ev.current_flags = cpu_to_le32(current_flags); 5105 5106 mgmt_event(MGMT_EV_DEVICE_FLAGS_CHANGED, hdev, &ev, sizeof(ev), sk); 5107 } 5108 5109 static int set_device_flags(struct sock *sk, struct hci_dev *hdev, void *data, 5110 u16 len) 5111 { 5112 struct mgmt_cp_set_device_flags *cp = data; 5113 struct bdaddr_list_with_flags *br_params; 5114 struct hci_conn_params *params; 5115 u8 status = MGMT_STATUS_INVALID_PARAMS; 5116 u32 supported_flags; 5117 u32 current_flags = __le32_to_cpu(cp->current_flags); 5118 5119 bt_dev_dbg(hdev, "Set device flags %pMR (type 0x%x) = 0x%x", 5120 &cp->addr.bdaddr, cp->addr.type, current_flags); 5121 5122 // We should take hci_dev_lock() early, I think.. conn_flags can change 5123 supported_flags = hdev->conn_flags; 5124 5125 if ((supported_flags | current_flags) != supported_flags) { 5126 bt_dev_warn(hdev, "Bad flag given (0x%x) vs supported (0x%0x)", 5127 current_flags, supported_flags); 5128 goto done; 5129 } 5130 5131 hci_dev_lock(hdev); 5132 5133 if (cp->addr.type == BDADDR_BREDR) { 5134 br_params = hci_bdaddr_list_lookup_with_flags(&hdev->accept_list, 5135 &cp->addr.bdaddr, 5136 cp->addr.type); 5137 5138 if (br_params) { 5139 br_params->flags = current_flags; 5140 status = MGMT_STATUS_SUCCESS; 5141 } else { 5142 bt_dev_warn(hdev, "No such BR/EDR device %pMR (0x%x)", 5143 &cp->addr.bdaddr, cp->addr.type); 5144 } 5145 5146 goto unlock; 5147 } 5148 5149 params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr, 5150 le_addr_type(cp->addr.type)); 5151 if (!params) { 5152 bt_dev_warn(hdev, "No such LE device %pMR (0x%x)", 5153 &cp->addr.bdaddr, le_addr_type(cp->addr.type)); 5154 goto unlock; 5155 } 5156 5157 supported_flags = get_params_flags(hdev, params); 5158 5159 if ((supported_flags | current_flags) != supported_flags) { 5160 bt_dev_warn(hdev, "Bad flag given (0x%x) vs supported (0x%0x)", 5161 current_flags, supported_flags); 5162 goto unlock; 5163 } 5164 5165 WRITE_ONCE(params->flags, current_flags); 5166 status = MGMT_STATUS_SUCCESS; 5167 5168 /* Update passive scan if HCI_CONN_FLAG_DEVICE_PRIVACY 5169 * has been set. 5170 */ 5171 if (params->flags & HCI_CONN_FLAG_DEVICE_PRIVACY) 5172 hci_update_passive_scan(hdev); 5173 5174 unlock: 5175 hci_dev_unlock(hdev); 5176 5177 done: 5178 if (status == MGMT_STATUS_SUCCESS) 5179 device_flags_changed(sk, hdev, &cp->addr.bdaddr, cp->addr.type, 5180 supported_flags, current_flags); 5181 5182 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_DEVICE_FLAGS, status, 5183 &cp->addr, sizeof(cp->addr)); 5184 } 5185 5186 static void mgmt_adv_monitor_added(struct sock *sk, struct hci_dev *hdev, 5187 u16 handle) 5188 { 5189 struct mgmt_ev_adv_monitor_added ev; 5190 5191 ev.monitor_handle = cpu_to_le16(handle); 5192 5193 mgmt_event(MGMT_EV_ADV_MONITOR_ADDED, hdev, &ev, sizeof(ev), sk); 5194 } 5195 5196 void mgmt_adv_monitor_removed(struct hci_dev *hdev, u16 handle) 5197 { 5198 struct mgmt_ev_adv_monitor_removed ev; 5199 struct mgmt_pending_cmd *cmd; 5200 struct sock *sk_skip = NULL; 5201 struct mgmt_cp_remove_adv_monitor *cp; 5202 5203 cmd = pending_find(MGMT_OP_REMOVE_ADV_MONITOR, hdev); 5204 if (cmd) { 5205 cp = cmd->param; 5206 5207 if (cp->monitor_handle) 5208 sk_skip = cmd->sk; 5209 } 5210 5211 ev.monitor_handle = cpu_to_le16(handle); 5212 5213 mgmt_event(MGMT_EV_ADV_MONITOR_REMOVED, hdev, &ev, sizeof(ev), sk_skip); 5214 } 5215 5216 static int read_adv_mon_features(struct sock *sk, struct hci_dev *hdev, 5217 void *data, u16 len) 5218 { 5219 struct adv_monitor *monitor = NULL; 5220 struct mgmt_rp_read_adv_monitor_features *rp = NULL; 5221 int handle, err; 5222 size_t rp_size = 0; 5223 __u32 supported = 0; 5224 __u32 enabled = 0; 5225 __u16 num_handles = 0; 5226 __u16 handles[HCI_MAX_ADV_MONITOR_NUM_HANDLES]; 5227 5228 BT_DBG("request for %s", hdev->name); 5229 5230 hci_dev_lock(hdev); 5231 5232 if (msft_monitor_supported(hdev)) 5233 supported |= MGMT_ADV_MONITOR_FEATURE_MASK_OR_PATTERNS; 5234 5235 idr_for_each_entry(&hdev->adv_monitors_idr, monitor, handle) 5236 handles[num_handles++] = monitor->handle; 5237 5238 hci_dev_unlock(hdev); 5239 5240 rp_size = sizeof(*rp) + (num_handles * sizeof(u16)); 5241 rp = kmalloc(rp_size, GFP_KERNEL); 5242 if (!rp) 5243 return -ENOMEM; 5244 5245 /* All supported features are currently enabled */ 5246 enabled = supported; 5247 5248 rp->supported_features = cpu_to_le32(supported); 5249 rp->enabled_features = cpu_to_le32(enabled); 5250 rp->max_num_handles = cpu_to_le16(HCI_MAX_ADV_MONITOR_NUM_HANDLES); 5251 rp->max_num_patterns = HCI_MAX_ADV_MONITOR_NUM_PATTERNS; 5252 rp->num_handles = cpu_to_le16(num_handles); 5253 if (num_handles) 5254 memcpy(&rp->handles, &handles, (num_handles * sizeof(u16))); 5255 5256 err = mgmt_cmd_complete(sk, hdev->id, 5257 MGMT_OP_READ_ADV_MONITOR_FEATURES, 5258 MGMT_STATUS_SUCCESS, rp, rp_size); 5259 5260 kfree(rp); 5261 5262 return err; 5263 } 5264 5265 static void mgmt_add_adv_patterns_monitor_complete(struct hci_dev *hdev, 5266 void *data, int status) 5267 { 5268 struct mgmt_rp_add_adv_patterns_monitor rp; 5269 struct mgmt_pending_cmd *cmd = data; 5270 struct adv_monitor *monitor = cmd->user_data; 5271 5272 hci_dev_lock(hdev); 5273 5274 rp.monitor_handle = cpu_to_le16(monitor->handle); 5275 5276 if (!status) { 5277 mgmt_adv_monitor_added(cmd->sk, hdev, monitor->handle); 5278 hdev->adv_monitors_cnt++; 5279 if (monitor->state == ADV_MONITOR_STATE_NOT_REGISTERED) 5280 monitor->state = ADV_MONITOR_STATE_REGISTERED; 5281 hci_update_passive_scan(hdev); 5282 } 5283 5284 mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, 5285 mgmt_status(status), &rp, sizeof(rp)); 5286 mgmt_pending_remove(cmd); 5287 5288 hci_dev_unlock(hdev); 5289 bt_dev_dbg(hdev, "add monitor %d complete, status %d", 5290 rp.monitor_handle, status); 5291 } 5292 5293 static int mgmt_add_adv_patterns_monitor_sync(struct hci_dev *hdev, void *data) 5294 { 5295 struct mgmt_pending_cmd *cmd = data; 5296 struct adv_monitor *monitor = cmd->user_data; 5297 5298 return hci_add_adv_monitor(hdev, monitor); 5299 } 5300 5301 static int __add_adv_patterns_monitor(struct sock *sk, struct hci_dev *hdev, 5302 struct adv_monitor *m, u8 status, 5303 void *data, u16 len, u16 op) 5304 { 5305 struct mgmt_pending_cmd *cmd; 5306 int err; 5307 5308 hci_dev_lock(hdev); 5309 5310 if (status) 5311 goto unlock; 5312 5313 if (pending_find(MGMT_OP_SET_LE, hdev) || 5314 pending_find(MGMT_OP_ADD_ADV_PATTERNS_MONITOR, hdev) || 5315 pending_find(MGMT_OP_ADD_ADV_PATTERNS_MONITOR_RSSI, hdev) || 5316 pending_find(MGMT_OP_REMOVE_ADV_MONITOR, hdev)) { 5317 status = MGMT_STATUS_BUSY; 5318 goto unlock; 5319 } 5320 5321 cmd = mgmt_pending_add(sk, op, hdev, data, len); 5322 if (!cmd) { 5323 status = MGMT_STATUS_NO_RESOURCES; 5324 goto unlock; 5325 } 5326 5327 cmd->user_data = m; 5328 err = hci_cmd_sync_queue(hdev, mgmt_add_adv_patterns_monitor_sync, cmd, 5329 mgmt_add_adv_patterns_monitor_complete); 5330 if (err) { 5331 if (err == -ENOMEM) 5332 status = MGMT_STATUS_NO_RESOURCES; 5333 else 5334 status = MGMT_STATUS_FAILED; 5335 5336 goto unlock; 5337 } 5338 5339 hci_dev_unlock(hdev); 5340 5341 return 0; 5342 5343 unlock: 5344 hci_free_adv_monitor(hdev, m); 5345 hci_dev_unlock(hdev); 5346 return mgmt_cmd_status(sk, hdev->id, op, status); 5347 } 5348 5349 static void parse_adv_monitor_rssi(struct adv_monitor *m, 5350 struct mgmt_adv_rssi_thresholds *rssi) 5351 { 5352 if (rssi) { 5353 m->rssi.low_threshold = rssi->low_threshold; 5354 m->rssi.low_threshold_timeout = 5355 __le16_to_cpu(rssi->low_threshold_timeout); 5356 m->rssi.high_threshold = rssi->high_threshold; 5357 m->rssi.high_threshold_timeout = 5358 __le16_to_cpu(rssi->high_threshold_timeout); 5359 m->rssi.sampling_period = rssi->sampling_period; 5360 } else { 5361 /* Default values. These numbers are the least constricting 5362 * parameters for MSFT API to work, so it behaves as if there 5363 * are no rssi parameter to consider. May need to be changed 5364 * if other API are to be supported. 5365 */ 5366 m->rssi.low_threshold = -127; 5367 m->rssi.low_threshold_timeout = 60; 5368 m->rssi.high_threshold = -127; 5369 m->rssi.high_threshold_timeout = 0; 5370 m->rssi.sampling_period = 0; 5371 } 5372 } 5373 5374 static u8 parse_adv_monitor_pattern(struct adv_monitor *m, u8 pattern_count, 5375 struct mgmt_adv_pattern *patterns) 5376 { 5377 u8 offset = 0, length = 0; 5378 struct adv_pattern *p = NULL; 5379 int i; 5380 5381 for (i = 0; i < pattern_count; i++) { 5382 offset = patterns[i].offset; 5383 length = patterns[i].length; 5384 if (offset >= HCI_MAX_EXT_AD_LENGTH || 5385 length > HCI_MAX_EXT_AD_LENGTH || 5386 (offset + length) > HCI_MAX_EXT_AD_LENGTH) 5387 return MGMT_STATUS_INVALID_PARAMS; 5388 5389 p = kmalloc(sizeof(*p), GFP_KERNEL); 5390 if (!p) 5391 return MGMT_STATUS_NO_RESOURCES; 5392 5393 p->ad_type = patterns[i].ad_type; 5394 p->offset = patterns[i].offset; 5395 p->length = patterns[i].length; 5396 memcpy(p->value, patterns[i].value, p->length); 5397 5398 INIT_LIST_HEAD(&p->list); 5399 list_add(&p->list, &m->patterns); 5400 } 5401 5402 return MGMT_STATUS_SUCCESS; 5403 } 5404 5405 static int add_adv_patterns_monitor(struct sock *sk, struct hci_dev *hdev, 5406 void *data, u16 len) 5407 { 5408 struct mgmt_cp_add_adv_patterns_monitor *cp = data; 5409 struct adv_monitor *m = NULL; 5410 u8 status = MGMT_STATUS_SUCCESS; 5411 size_t expected_size = sizeof(*cp); 5412 5413 BT_DBG("request for %s", hdev->name); 5414 5415 if (len <= sizeof(*cp)) { 5416 status = MGMT_STATUS_INVALID_PARAMS; 5417 goto done; 5418 } 5419 5420 expected_size += cp->pattern_count * sizeof(struct mgmt_adv_pattern); 5421 if (len != expected_size) { 5422 status = MGMT_STATUS_INVALID_PARAMS; 5423 goto done; 5424 } 5425 5426 m = kzalloc(sizeof(*m), GFP_KERNEL); 5427 if (!m) { 5428 status = MGMT_STATUS_NO_RESOURCES; 5429 goto done; 5430 } 5431 5432 INIT_LIST_HEAD(&m->patterns); 5433 5434 parse_adv_monitor_rssi(m, NULL); 5435 status = parse_adv_monitor_pattern(m, cp->pattern_count, cp->patterns); 5436 5437 done: 5438 return __add_adv_patterns_monitor(sk, hdev, m, status, data, len, 5439 MGMT_OP_ADD_ADV_PATTERNS_MONITOR); 5440 } 5441 5442 static int add_adv_patterns_monitor_rssi(struct sock *sk, struct hci_dev *hdev, 5443 void *data, u16 len) 5444 { 5445 struct mgmt_cp_add_adv_patterns_monitor_rssi *cp = data; 5446 struct adv_monitor *m = NULL; 5447 u8 status = MGMT_STATUS_SUCCESS; 5448 size_t expected_size = sizeof(*cp); 5449 5450 BT_DBG("request for %s", hdev->name); 5451 5452 if (len <= sizeof(*cp)) { 5453 status = MGMT_STATUS_INVALID_PARAMS; 5454 goto done; 5455 } 5456 5457 expected_size += cp->pattern_count * sizeof(struct mgmt_adv_pattern); 5458 if (len != expected_size) { 5459 status = MGMT_STATUS_INVALID_PARAMS; 5460 goto done; 5461 } 5462 5463 m = kzalloc(sizeof(*m), GFP_KERNEL); 5464 if (!m) { 5465 status = MGMT_STATUS_NO_RESOURCES; 5466 goto done; 5467 } 5468 5469 INIT_LIST_HEAD(&m->patterns); 5470 5471 parse_adv_monitor_rssi(m, &cp->rssi); 5472 status = parse_adv_monitor_pattern(m, cp->pattern_count, cp->patterns); 5473 5474 done: 5475 return __add_adv_patterns_monitor(sk, hdev, m, status, data, len, 5476 MGMT_OP_ADD_ADV_PATTERNS_MONITOR_RSSI); 5477 } 5478 5479 static void mgmt_remove_adv_monitor_complete(struct hci_dev *hdev, 5480 void *data, int status) 5481 { 5482 struct mgmt_rp_remove_adv_monitor rp; 5483 struct mgmt_pending_cmd *cmd = data; 5484 struct mgmt_cp_remove_adv_monitor *cp = cmd->param; 5485 5486 hci_dev_lock(hdev); 5487 5488 rp.monitor_handle = cp->monitor_handle; 5489 5490 if (!status) 5491 hci_update_passive_scan(hdev); 5492 5493 mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, 5494 mgmt_status(status), &rp, sizeof(rp)); 5495 mgmt_pending_remove(cmd); 5496 5497 hci_dev_unlock(hdev); 5498 bt_dev_dbg(hdev, "remove monitor %d complete, status %d", 5499 rp.monitor_handle, status); 5500 } 5501 5502 static int mgmt_remove_adv_monitor_sync(struct hci_dev *hdev, void *data) 5503 { 5504 struct mgmt_pending_cmd *cmd = data; 5505 struct mgmt_cp_remove_adv_monitor *cp = cmd->param; 5506 u16 handle = __le16_to_cpu(cp->monitor_handle); 5507 5508 if (!handle) 5509 return hci_remove_all_adv_monitor(hdev); 5510 5511 return hci_remove_single_adv_monitor(hdev, handle); 5512 } 5513 5514 static int remove_adv_monitor(struct sock *sk, struct hci_dev *hdev, 5515 void *data, u16 len) 5516 { 5517 struct mgmt_pending_cmd *cmd; 5518 int err, status; 5519 5520 hci_dev_lock(hdev); 5521 5522 if (pending_find(MGMT_OP_SET_LE, hdev) || 5523 pending_find(MGMT_OP_REMOVE_ADV_MONITOR, hdev) || 5524 pending_find(MGMT_OP_ADD_ADV_PATTERNS_MONITOR, hdev) || 5525 pending_find(MGMT_OP_ADD_ADV_PATTERNS_MONITOR_RSSI, hdev)) { 5526 status = MGMT_STATUS_BUSY; 5527 goto unlock; 5528 } 5529 5530 cmd = mgmt_pending_add(sk, MGMT_OP_REMOVE_ADV_MONITOR, hdev, data, len); 5531 if (!cmd) { 5532 status = MGMT_STATUS_NO_RESOURCES; 5533 goto unlock; 5534 } 5535 5536 err = hci_cmd_sync_queue(hdev, mgmt_remove_adv_monitor_sync, cmd, 5537 mgmt_remove_adv_monitor_complete); 5538 5539 if (err) { 5540 mgmt_pending_remove(cmd); 5541 5542 if (err == -ENOMEM) 5543 status = MGMT_STATUS_NO_RESOURCES; 5544 else 5545 status = MGMT_STATUS_FAILED; 5546 5547 goto unlock; 5548 } 5549 5550 hci_dev_unlock(hdev); 5551 5552 return 0; 5553 5554 unlock: 5555 hci_dev_unlock(hdev); 5556 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_ADV_MONITOR, 5557 status); 5558 } 5559 5560 static void read_local_oob_data_complete(struct hci_dev *hdev, void *data, int err) 5561 { 5562 struct mgmt_rp_read_local_oob_data mgmt_rp; 5563 size_t rp_size = sizeof(mgmt_rp); 5564 struct mgmt_pending_cmd *cmd = data; 5565 struct sk_buff *skb = cmd->skb; 5566 u8 status = mgmt_status(err); 5567 5568 if (!status) { 5569 if (!skb) 5570 status = MGMT_STATUS_FAILED; 5571 else if (IS_ERR(skb)) 5572 status = mgmt_status(PTR_ERR(skb)); 5573 else 5574 status = mgmt_status(skb->data[0]); 5575 } 5576 5577 bt_dev_dbg(hdev, "status %d", status); 5578 5579 if (status) { 5580 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA, status); 5581 goto remove; 5582 } 5583 5584 memset(&mgmt_rp, 0, sizeof(mgmt_rp)); 5585 5586 if (!bredr_sc_enabled(hdev)) { 5587 struct hci_rp_read_local_oob_data *rp = (void *) skb->data; 5588 5589 if (skb->len < sizeof(*rp)) { 5590 mgmt_cmd_status(cmd->sk, hdev->id, 5591 MGMT_OP_READ_LOCAL_OOB_DATA, 5592 MGMT_STATUS_FAILED); 5593 goto remove; 5594 } 5595 5596 memcpy(mgmt_rp.hash192, rp->hash, sizeof(rp->hash)); 5597 memcpy(mgmt_rp.rand192, rp->rand, sizeof(rp->rand)); 5598 5599 rp_size -= sizeof(mgmt_rp.hash256) + sizeof(mgmt_rp.rand256); 5600 } else { 5601 struct hci_rp_read_local_oob_ext_data *rp = (void *) skb->data; 5602 5603 if (skb->len < sizeof(*rp)) { 5604 mgmt_cmd_status(cmd->sk, hdev->id, 5605 MGMT_OP_READ_LOCAL_OOB_DATA, 5606 MGMT_STATUS_FAILED); 5607 goto remove; 5608 } 5609 5610 memcpy(mgmt_rp.hash192, rp->hash192, sizeof(rp->hash192)); 5611 memcpy(mgmt_rp.rand192, rp->rand192, sizeof(rp->rand192)); 5612 5613 memcpy(mgmt_rp.hash256, rp->hash256, sizeof(rp->hash256)); 5614 memcpy(mgmt_rp.rand256, rp->rand256, sizeof(rp->rand256)); 5615 } 5616 5617 mgmt_cmd_complete(cmd->sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA, 5618 MGMT_STATUS_SUCCESS, &mgmt_rp, rp_size); 5619 5620 remove: 5621 if (skb && !IS_ERR(skb)) 5622 kfree_skb(skb); 5623 5624 mgmt_pending_free(cmd); 5625 } 5626 5627 static int read_local_oob_data_sync(struct hci_dev *hdev, void *data) 5628 { 5629 struct mgmt_pending_cmd *cmd = data; 5630 5631 if (bredr_sc_enabled(hdev)) 5632 cmd->skb = hci_read_local_oob_data_sync(hdev, true, cmd->sk); 5633 else 5634 cmd->skb = hci_read_local_oob_data_sync(hdev, false, cmd->sk); 5635 5636 if (IS_ERR(cmd->skb)) 5637 return PTR_ERR(cmd->skb); 5638 else 5639 return 0; 5640 } 5641 5642 static int read_local_oob_data(struct sock *sk, struct hci_dev *hdev, 5643 void *data, u16 data_len) 5644 { 5645 struct mgmt_pending_cmd *cmd; 5646 int err; 5647 5648 bt_dev_dbg(hdev, "sock %p", sk); 5649 5650 hci_dev_lock(hdev); 5651 5652 if (!hdev_is_powered(hdev)) { 5653 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA, 5654 MGMT_STATUS_NOT_POWERED); 5655 goto unlock; 5656 } 5657 5658 if (!lmp_ssp_capable(hdev)) { 5659 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA, 5660 MGMT_STATUS_NOT_SUPPORTED); 5661 goto unlock; 5662 } 5663 5664 cmd = mgmt_pending_new(sk, MGMT_OP_READ_LOCAL_OOB_DATA, hdev, NULL, 0); 5665 if (!cmd) 5666 err = -ENOMEM; 5667 else 5668 err = hci_cmd_sync_queue(hdev, read_local_oob_data_sync, cmd, 5669 read_local_oob_data_complete); 5670 5671 if (err < 0) { 5672 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA, 5673 MGMT_STATUS_FAILED); 5674 5675 if (cmd) 5676 mgmt_pending_free(cmd); 5677 } 5678 5679 unlock: 5680 hci_dev_unlock(hdev); 5681 return err; 5682 } 5683 5684 static int add_remote_oob_data(struct sock *sk, struct hci_dev *hdev, 5685 void *data, u16 len) 5686 { 5687 struct mgmt_addr_info *addr = data; 5688 int err; 5689 5690 bt_dev_dbg(hdev, "sock %p", sk); 5691 5692 if (!bdaddr_type_is_valid(addr->type)) 5693 return mgmt_cmd_complete(sk, hdev->id, 5694 MGMT_OP_ADD_REMOTE_OOB_DATA, 5695 MGMT_STATUS_INVALID_PARAMS, 5696 addr, sizeof(*addr)); 5697 5698 hci_dev_lock(hdev); 5699 5700 if (len == MGMT_ADD_REMOTE_OOB_DATA_SIZE) { 5701 struct mgmt_cp_add_remote_oob_data *cp = data; 5702 u8 status; 5703 5704 if (cp->addr.type != BDADDR_BREDR) { 5705 err = mgmt_cmd_complete(sk, hdev->id, 5706 MGMT_OP_ADD_REMOTE_OOB_DATA, 5707 MGMT_STATUS_INVALID_PARAMS, 5708 &cp->addr, sizeof(cp->addr)); 5709 goto unlock; 5710 } 5711 5712 err = hci_add_remote_oob_data(hdev, &cp->addr.bdaddr, 5713 cp->addr.type, cp->hash, 5714 cp->rand, NULL, NULL); 5715 if (err < 0) 5716 status = MGMT_STATUS_FAILED; 5717 else 5718 status = MGMT_STATUS_SUCCESS; 5719 5720 err = mgmt_cmd_complete(sk, hdev->id, 5721 MGMT_OP_ADD_REMOTE_OOB_DATA, status, 5722 &cp->addr, sizeof(cp->addr)); 5723 } else if (len == MGMT_ADD_REMOTE_OOB_EXT_DATA_SIZE) { 5724 struct mgmt_cp_add_remote_oob_ext_data *cp = data; 5725 u8 *rand192, *hash192, *rand256, *hash256; 5726 u8 status; 5727 5728 if (bdaddr_type_is_le(cp->addr.type)) { 5729 /* Enforce zero-valued 192-bit parameters as 5730 * long as legacy SMP OOB isn't implemented. 5731 */ 5732 if (memcmp(cp->rand192, ZERO_KEY, 16) || 5733 memcmp(cp->hash192, ZERO_KEY, 16)) { 5734 err = mgmt_cmd_complete(sk, hdev->id, 5735 MGMT_OP_ADD_REMOTE_OOB_DATA, 5736 MGMT_STATUS_INVALID_PARAMS, 5737 addr, sizeof(*addr)); 5738 goto unlock; 5739 } 5740 5741 rand192 = NULL; 5742 hash192 = NULL; 5743 } else { 5744 /* In case one of the P-192 values is set to zero, 5745 * then just disable OOB data for P-192. 5746 */ 5747 if (!memcmp(cp->rand192, ZERO_KEY, 16) || 5748 !memcmp(cp->hash192, ZERO_KEY, 16)) { 5749 rand192 = NULL; 5750 hash192 = NULL; 5751 } else { 5752 rand192 = cp->rand192; 5753 hash192 = cp->hash192; 5754 } 5755 } 5756 5757 /* In case one of the P-256 values is set to zero, then just 5758 * disable OOB data for P-256. 5759 */ 5760 if (!memcmp(cp->rand256, ZERO_KEY, 16) || 5761 !memcmp(cp->hash256, ZERO_KEY, 16)) { 5762 rand256 = NULL; 5763 hash256 = NULL; 5764 } else { 5765 rand256 = cp->rand256; 5766 hash256 = cp->hash256; 5767 } 5768 5769 err = hci_add_remote_oob_data(hdev, &cp->addr.bdaddr, 5770 cp->addr.type, hash192, rand192, 5771 hash256, rand256); 5772 if (err < 0) 5773 status = MGMT_STATUS_FAILED; 5774 else 5775 status = MGMT_STATUS_SUCCESS; 5776 5777 err = mgmt_cmd_complete(sk, hdev->id, 5778 MGMT_OP_ADD_REMOTE_OOB_DATA, 5779 status, &cp->addr, sizeof(cp->addr)); 5780 } else { 5781 bt_dev_err(hdev, "add_remote_oob_data: invalid len of %u bytes", 5782 len); 5783 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_REMOTE_OOB_DATA, 5784 MGMT_STATUS_INVALID_PARAMS); 5785 } 5786 5787 unlock: 5788 hci_dev_unlock(hdev); 5789 return err; 5790 } 5791 5792 static int remove_remote_oob_data(struct sock *sk, struct hci_dev *hdev, 5793 void *data, u16 len) 5794 { 5795 struct mgmt_cp_remove_remote_oob_data *cp = data; 5796 u8 status; 5797 int err; 5798 5799 bt_dev_dbg(hdev, "sock %p", sk); 5800 5801 if (cp->addr.type != BDADDR_BREDR) 5802 return mgmt_cmd_complete(sk, hdev->id, 5803 MGMT_OP_REMOVE_REMOTE_OOB_DATA, 5804 MGMT_STATUS_INVALID_PARAMS, 5805 &cp->addr, sizeof(cp->addr)); 5806 5807 hci_dev_lock(hdev); 5808 5809 if (!bacmp(&cp->addr.bdaddr, BDADDR_ANY)) { 5810 hci_remote_oob_data_clear(hdev); 5811 status = MGMT_STATUS_SUCCESS; 5812 goto done; 5813 } 5814 5815 err = hci_remove_remote_oob_data(hdev, &cp->addr.bdaddr, cp->addr.type); 5816 if (err < 0) 5817 status = MGMT_STATUS_INVALID_PARAMS; 5818 else 5819 status = MGMT_STATUS_SUCCESS; 5820 5821 done: 5822 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_REMOTE_OOB_DATA, 5823 status, &cp->addr, sizeof(cp->addr)); 5824 5825 hci_dev_unlock(hdev); 5826 return err; 5827 } 5828 5829 void mgmt_start_discovery_complete(struct hci_dev *hdev, u8 status) 5830 { 5831 struct mgmt_pending_cmd *cmd; 5832 5833 bt_dev_dbg(hdev, "status %u", status); 5834 5835 hci_dev_lock(hdev); 5836 5837 cmd = pending_find(MGMT_OP_START_DISCOVERY, hdev); 5838 if (!cmd) 5839 cmd = pending_find(MGMT_OP_START_SERVICE_DISCOVERY, hdev); 5840 5841 if (!cmd) 5842 cmd = pending_find(MGMT_OP_START_LIMITED_DISCOVERY, hdev); 5843 5844 if (cmd) { 5845 cmd->cmd_complete(cmd, mgmt_status(status)); 5846 mgmt_pending_remove(cmd); 5847 } 5848 5849 hci_dev_unlock(hdev); 5850 } 5851 5852 static bool discovery_type_is_valid(struct hci_dev *hdev, uint8_t type, 5853 uint8_t *mgmt_status) 5854 { 5855 switch (type) { 5856 case DISCOV_TYPE_LE: 5857 *mgmt_status = mgmt_le_support(hdev); 5858 if (*mgmt_status) 5859 return false; 5860 break; 5861 case DISCOV_TYPE_INTERLEAVED: 5862 *mgmt_status = mgmt_le_support(hdev); 5863 if (*mgmt_status) 5864 return false; 5865 fallthrough; 5866 case DISCOV_TYPE_BREDR: 5867 *mgmt_status = mgmt_bredr_support(hdev); 5868 if (*mgmt_status) 5869 return false; 5870 break; 5871 default: 5872 *mgmt_status = MGMT_STATUS_INVALID_PARAMS; 5873 return false; 5874 } 5875 5876 return true; 5877 } 5878 5879 static void start_discovery_complete(struct hci_dev *hdev, void *data, int err) 5880 { 5881 struct mgmt_pending_cmd *cmd = data; 5882 5883 if (cmd != pending_find(MGMT_OP_START_DISCOVERY, hdev) && 5884 cmd != pending_find(MGMT_OP_START_LIMITED_DISCOVERY, hdev) && 5885 cmd != pending_find(MGMT_OP_START_SERVICE_DISCOVERY, hdev)) 5886 return; 5887 5888 bt_dev_dbg(hdev, "err %d", err); 5889 5890 mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, mgmt_status(err), 5891 cmd->param, 1); 5892 mgmt_pending_remove(cmd); 5893 5894 hci_discovery_set_state(hdev, err ? DISCOVERY_STOPPED: 5895 DISCOVERY_FINDING); 5896 } 5897 5898 static int start_discovery_sync(struct hci_dev *hdev, void *data) 5899 { 5900 return hci_start_discovery_sync(hdev); 5901 } 5902 5903 static int start_discovery_internal(struct sock *sk, struct hci_dev *hdev, 5904 u16 op, void *data, u16 len) 5905 { 5906 struct mgmt_cp_start_discovery *cp = data; 5907 struct mgmt_pending_cmd *cmd; 5908 u8 status; 5909 int err; 5910 5911 bt_dev_dbg(hdev, "sock %p", sk); 5912 5913 hci_dev_lock(hdev); 5914 5915 if (!hdev_is_powered(hdev)) { 5916 err = mgmt_cmd_complete(sk, hdev->id, op, 5917 MGMT_STATUS_NOT_POWERED, 5918 &cp->type, sizeof(cp->type)); 5919 goto failed; 5920 } 5921 5922 if (hdev->discovery.state != DISCOVERY_STOPPED || 5923 hci_dev_test_flag(hdev, HCI_PERIODIC_INQ)) { 5924 err = mgmt_cmd_complete(sk, hdev->id, op, MGMT_STATUS_BUSY, 5925 &cp->type, sizeof(cp->type)); 5926 goto failed; 5927 } 5928 5929 if (!discovery_type_is_valid(hdev, cp->type, &status)) { 5930 err = mgmt_cmd_complete(sk, hdev->id, op, status, 5931 &cp->type, sizeof(cp->type)); 5932 goto failed; 5933 } 5934 5935 /* Can't start discovery when it is paused */ 5936 if (hdev->discovery_paused) { 5937 err = mgmt_cmd_complete(sk, hdev->id, op, MGMT_STATUS_BUSY, 5938 &cp->type, sizeof(cp->type)); 5939 goto failed; 5940 } 5941 5942 /* Clear the discovery filter first to free any previously 5943 * allocated memory for the UUID list. 5944 */ 5945 hci_discovery_filter_clear(hdev); 5946 5947 hdev->discovery.type = cp->type; 5948 hdev->discovery.report_invalid_rssi = false; 5949 if (op == MGMT_OP_START_LIMITED_DISCOVERY) 5950 hdev->discovery.limited = true; 5951 else 5952 hdev->discovery.limited = false; 5953 5954 cmd = mgmt_pending_add(sk, op, hdev, data, len); 5955 if (!cmd) { 5956 err = -ENOMEM; 5957 goto failed; 5958 } 5959 5960 err = hci_cmd_sync_queue(hdev, start_discovery_sync, cmd, 5961 start_discovery_complete); 5962 if (err < 0) { 5963 mgmt_pending_remove(cmd); 5964 goto failed; 5965 } 5966 5967 hci_discovery_set_state(hdev, DISCOVERY_STARTING); 5968 5969 failed: 5970 hci_dev_unlock(hdev); 5971 return err; 5972 } 5973 5974 static int start_discovery(struct sock *sk, struct hci_dev *hdev, 5975 void *data, u16 len) 5976 { 5977 return start_discovery_internal(sk, hdev, MGMT_OP_START_DISCOVERY, 5978 data, len); 5979 } 5980 5981 static int start_limited_discovery(struct sock *sk, struct hci_dev *hdev, 5982 void *data, u16 len) 5983 { 5984 return start_discovery_internal(sk, hdev, 5985 MGMT_OP_START_LIMITED_DISCOVERY, 5986 data, len); 5987 } 5988 5989 static int start_service_discovery(struct sock *sk, struct hci_dev *hdev, 5990 void *data, u16 len) 5991 { 5992 struct mgmt_cp_start_service_discovery *cp = data; 5993 struct mgmt_pending_cmd *cmd; 5994 const u16 max_uuid_count = ((U16_MAX - sizeof(*cp)) / 16); 5995 u16 uuid_count, expected_len; 5996 u8 status; 5997 int err; 5998 5999 bt_dev_dbg(hdev, "sock %p", sk); 6000 6001 hci_dev_lock(hdev); 6002 6003 if (!hdev_is_powered(hdev)) { 6004 err = mgmt_cmd_complete(sk, hdev->id, 6005 MGMT_OP_START_SERVICE_DISCOVERY, 6006 MGMT_STATUS_NOT_POWERED, 6007 &cp->type, sizeof(cp->type)); 6008 goto failed; 6009 } 6010 6011 if (hdev->discovery.state != DISCOVERY_STOPPED || 6012 hci_dev_test_flag(hdev, HCI_PERIODIC_INQ)) { 6013 err = mgmt_cmd_complete(sk, hdev->id, 6014 MGMT_OP_START_SERVICE_DISCOVERY, 6015 MGMT_STATUS_BUSY, &cp->type, 6016 sizeof(cp->type)); 6017 goto failed; 6018 } 6019 6020 if (hdev->discovery_paused) { 6021 err = mgmt_cmd_complete(sk, hdev->id, 6022 MGMT_OP_START_SERVICE_DISCOVERY, 6023 MGMT_STATUS_BUSY, &cp->type, 6024 sizeof(cp->type)); 6025 goto failed; 6026 } 6027 6028 uuid_count = __le16_to_cpu(cp->uuid_count); 6029 if (uuid_count > max_uuid_count) { 6030 bt_dev_err(hdev, "service_discovery: too big uuid_count value %u", 6031 uuid_count); 6032 err = mgmt_cmd_complete(sk, hdev->id, 6033 MGMT_OP_START_SERVICE_DISCOVERY, 6034 MGMT_STATUS_INVALID_PARAMS, &cp->type, 6035 sizeof(cp->type)); 6036 goto failed; 6037 } 6038 6039 expected_len = sizeof(*cp) + uuid_count * 16; 6040 if (expected_len != len) { 6041 bt_dev_err(hdev, "service_discovery: expected %u bytes, got %u bytes", 6042 expected_len, len); 6043 err = mgmt_cmd_complete(sk, hdev->id, 6044 MGMT_OP_START_SERVICE_DISCOVERY, 6045 MGMT_STATUS_INVALID_PARAMS, &cp->type, 6046 sizeof(cp->type)); 6047 goto failed; 6048 } 6049 6050 if (!discovery_type_is_valid(hdev, cp->type, &status)) { 6051 err = mgmt_cmd_complete(sk, hdev->id, 6052 MGMT_OP_START_SERVICE_DISCOVERY, 6053 status, &cp->type, sizeof(cp->type)); 6054 goto failed; 6055 } 6056 6057 cmd = mgmt_pending_add(sk, MGMT_OP_START_SERVICE_DISCOVERY, 6058 hdev, data, len); 6059 if (!cmd) { 6060 err = -ENOMEM; 6061 goto failed; 6062 } 6063 6064 /* Clear the discovery filter first to free any previously 6065 * allocated memory for the UUID list. 6066 */ 6067 hci_discovery_filter_clear(hdev); 6068 6069 hdev->discovery.result_filtering = true; 6070 hdev->discovery.type = cp->type; 6071 hdev->discovery.rssi = cp->rssi; 6072 hdev->discovery.uuid_count = uuid_count; 6073 6074 if (uuid_count > 0) { 6075 hdev->discovery.uuids = kmemdup(cp->uuids, uuid_count * 16, 6076 GFP_KERNEL); 6077 if (!hdev->discovery.uuids) { 6078 err = mgmt_cmd_complete(sk, hdev->id, 6079 MGMT_OP_START_SERVICE_DISCOVERY, 6080 MGMT_STATUS_FAILED, 6081 &cp->type, sizeof(cp->type)); 6082 mgmt_pending_remove(cmd); 6083 goto failed; 6084 } 6085 } 6086 6087 err = hci_cmd_sync_queue(hdev, start_discovery_sync, cmd, 6088 start_discovery_complete); 6089 if (err < 0) { 6090 mgmt_pending_remove(cmd); 6091 goto failed; 6092 } 6093 6094 hci_discovery_set_state(hdev, DISCOVERY_STARTING); 6095 6096 failed: 6097 hci_dev_unlock(hdev); 6098 return err; 6099 } 6100 6101 void mgmt_stop_discovery_complete(struct hci_dev *hdev, u8 status) 6102 { 6103 struct mgmt_pending_cmd *cmd; 6104 6105 bt_dev_dbg(hdev, "status %u", status); 6106 6107 hci_dev_lock(hdev); 6108 6109 cmd = pending_find(MGMT_OP_STOP_DISCOVERY, hdev); 6110 if (cmd) { 6111 cmd->cmd_complete(cmd, mgmt_status(status)); 6112 mgmt_pending_remove(cmd); 6113 } 6114 6115 hci_dev_unlock(hdev); 6116 } 6117 6118 static void stop_discovery_complete(struct hci_dev *hdev, void *data, int err) 6119 { 6120 struct mgmt_pending_cmd *cmd = data; 6121 6122 if (cmd != pending_find(MGMT_OP_STOP_DISCOVERY, hdev)) 6123 return; 6124 6125 bt_dev_dbg(hdev, "err %d", err); 6126 6127 mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, mgmt_status(err), 6128 cmd->param, 1); 6129 mgmt_pending_remove(cmd); 6130 6131 if (!err) 6132 hci_discovery_set_state(hdev, DISCOVERY_STOPPED); 6133 } 6134 6135 static int stop_discovery_sync(struct hci_dev *hdev, void *data) 6136 { 6137 return hci_stop_discovery_sync(hdev); 6138 } 6139 6140 static int stop_discovery(struct sock *sk, struct hci_dev *hdev, void *data, 6141 u16 len) 6142 { 6143 struct mgmt_cp_stop_discovery *mgmt_cp = data; 6144 struct mgmt_pending_cmd *cmd; 6145 int err; 6146 6147 bt_dev_dbg(hdev, "sock %p", sk); 6148 6149 hci_dev_lock(hdev); 6150 6151 if (!hci_discovery_active(hdev)) { 6152 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY, 6153 MGMT_STATUS_REJECTED, &mgmt_cp->type, 6154 sizeof(mgmt_cp->type)); 6155 goto unlock; 6156 } 6157 6158 if (hdev->discovery.type != mgmt_cp->type) { 6159 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY, 6160 MGMT_STATUS_INVALID_PARAMS, 6161 &mgmt_cp->type, sizeof(mgmt_cp->type)); 6162 goto unlock; 6163 } 6164 6165 cmd = mgmt_pending_add(sk, MGMT_OP_STOP_DISCOVERY, hdev, data, len); 6166 if (!cmd) { 6167 err = -ENOMEM; 6168 goto unlock; 6169 } 6170 6171 err = hci_cmd_sync_queue(hdev, stop_discovery_sync, cmd, 6172 stop_discovery_complete); 6173 if (err < 0) { 6174 mgmt_pending_remove(cmd); 6175 goto unlock; 6176 } 6177 6178 hci_discovery_set_state(hdev, DISCOVERY_STOPPING); 6179 6180 unlock: 6181 hci_dev_unlock(hdev); 6182 return err; 6183 } 6184 6185 static int confirm_name(struct sock *sk, struct hci_dev *hdev, void *data, 6186 u16 len) 6187 { 6188 struct mgmt_cp_confirm_name *cp = data; 6189 struct inquiry_entry *e; 6190 int err; 6191 6192 bt_dev_dbg(hdev, "sock %p", sk); 6193 6194 hci_dev_lock(hdev); 6195 6196 if (!hci_discovery_active(hdev)) { 6197 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME, 6198 MGMT_STATUS_FAILED, &cp->addr, 6199 sizeof(cp->addr)); 6200 goto failed; 6201 } 6202 6203 e = hci_inquiry_cache_lookup_unknown(hdev, &cp->addr.bdaddr); 6204 if (!e) { 6205 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME, 6206 MGMT_STATUS_INVALID_PARAMS, &cp->addr, 6207 sizeof(cp->addr)); 6208 goto failed; 6209 } 6210 6211 if (cp->name_known) { 6212 e->name_state = NAME_KNOWN; 6213 list_del(&e->list); 6214 } else { 6215 e->name_state = NAME_NEEDED; 6216 hci_inquiry_cache_update_resolve(hdev, e); 6217 } 6218 6219 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME, 0, 6220 &cp->addr, sizeof(cp->addr)); 6221 6222 failed: 6223 hci_dev_unlock(hdev); 6224 return err; 6225 } 6226 6227 static int block_device(struct sock *sk, struct hci_dev *hdev, void *data, 6228 u16 len) 6229 { 6230 struct mgmt_cp_block_device *cp = data; 6231 u8 status; 6232 int err; 6233 6234 bt_dev_dbg(hdev, "sock %p", sk); 6235 6236 if (!bdaddr_type_is_valid(cp->addr.type)) 6237 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_BLOCK_DEVICE, 6238 MGMT_STATUS_INVALID_PARAMS, 6239 &cp->addr, sizeof(cp->addr)); 6240 6241 hci_dev_lock(hdev); 6242 6243 err = hci_bdaddr_list_add(&hdev->reject_list, &cp->addr.bdaddr, 6244 cp->addr.type); 6245 if (err < 0) { 6246 status = MGMT_STATUS_FAILED; 6247 goto done; 6248 } 6249 6250 mgmt_event(MGMT_EV_DEVICE_BLOCKED, hdev, &cp->addr, sizeof(cp->addr), 6251 sk); 6252 status = MGMT_STATUS_SUCCESS; 6253 6254 done: 6255 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_BLOCK_DEVICE, status, 6256 &cp->addr, sizeof(cp->addr)); 6257 6258 hci_dev_unlock(hdev); 6259 6260 return err; 6261 } 6262 6263 static int unblock_device(struct sock *sk, struct hci_dev *hdev, void *data, 6264 u16 len) 6265 { 6266 struct mgmt_cp_unblock_device *cp = data; 6267 u8 status; 6268 int err; 6269 6270 bt_dev_dbg(hdev, "sock %p", sk); 6271 6272 if (!bdaddr_type_is_valid(cp->addr.type)) 6273 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNBLOCK_DEVICE, 6274 MGMT_STATUS_INVALID_PARAMS, 6275 &cp->addr, sizeof(cp->addr)); 6276 6277 hci_dev_lock(hdev); 6278 6279 err = hci_bdaddr_list_del(&hdev->reject_list, &cp->addr.bdaddr, 6280 cp->addr.type); 6281 if (err < 0) { 6282 status = MGMT_STATUS_INVALID_PARAMS; 6283 goto done; 6284 } 6285 6286 mgmt_event(MGMT_EV_DEVICE_UNBLOCKED, hdev, &cp->addr, sizeof(cp->addr), 6287 sk); 6288 status = MGMT_STATUS_SUCCESS; 6289 6290 done: 6291 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNBLOCK_DEVICE, status, 6292 &cp->addr, sizeof(cp->addr)); 6293 6294 hci_dev_unlock(hdev); 6295 6296 return err; 6297 } 6298 6299 static int set_device_id_sync(struct hci_dev *hdev, void *data) 6300 { 6301 return hci_update_eir_sync(hdev); 6302 } 6303 6304 static int set_device_id(struct sock *sk, struct hci_dev *hdev, void *data, 6305 u16 len) 6306 { 6307 struct mgmt_cp_set_device_id *cp = data; 6308 int err; 6309 __u16 source; 6310 6311 bt_dev_dbg(hdev, "sock %p", sk); 6312 6313 source = __le16_to_cpu(cp->source); 6314 6315 if (source > 0x0002) 6316 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEVICE_ID, 6317 MGMT_STATUS_INVALID_PARAMS); 6318 6319 hci_dev_lock(hdev); 6320 6321 hdev->devid_source = source; 6322 hdev->devid_vendor = __le16_to_cpu(cp->vendor); 6323 hdev->devid_product = __le16_to_cpu(cp->product); 6324 hdev->devid_version = __le16_to_cpu(cp->version); 6325 6326 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_DEVICE_ID, 0, 6327 NULL, 0); 6328 6329 hci_cmd_sync_queue(hdev, set_device_id_sync, NULL, NULL); 6330 6331 hci_dev_unlock(hdev); 6332 6333 return err; 6334 } 6335 6336 static void enable_advertising_instance(struct hci_dev *hdev, int err) 6337 { 6338 if (err) 6339 bt_dev_err(hdev, "failed to re-configure advertising %d", err); 6340 else 6341 bt_dev_dbg(hdev, "status %d", err); 6342 } 6343 6344 static void set_advertising_complete(struct hci_dev *hdev, void *data, int err) 6345 { 6346 struct cmd_lookup match = { NULL, hdev }; 6347 u8 instance; 6348 struct adv_info *adv_instance; 6349 u8 status = mgmt_status(err); 6350 6351 if (status) { 6352 mgmt_pending_foreach(MGMT_OP_SET_ADVERTISING, hdev, 6353 cmd_status_rsp, &status); 6354 return; 6355 } 6356 6357 if (hci_dev_test_flag(hdev, HCI_LE_ADV)) 6358 hci_dev_set_flag(hdev, HCI_ADVERTISING); 6359 else 6360 hci_dev_clear_flag(hdev, HCI_ADVERTISING); 6361 6362 mgmt_pending_foreach(MGMT_OP_SET_ADVERTISING, hdev, settings_rsp, 6363 &match); 6364 6365 new_settings(hdev, match.sk); 6366 6367 if (match.sk) 6368 sock_put(match.sk); 6369 6370 /* If "Set Advertising" was just disabled and instance advertising was 6371 * set up earlier, then re-enable multi-instance advertising. 6372 */ 6373 if (hci_dev_test_flag(hdev, HCI_ADVERTISING) || 6374 list_empty(&hdev->adv_instances)) 6375 return; 6376 6377 instance = hdev->cur_adv_instance; 6378 if (!instance) { 6379 adv_instance = list_first_entry_or_null(&hdev->adv_instances, 6380 struct adv_info, list); 6381 if (!adv_instance) 6382 return; 6383 6384 instance = adv_instance->instance; 6385 } 6386 6387 err = hci_schedule_adv_instance_sync(hdev, instance, true); 6388 6389 enable_advertising_instance(hdev, err); 6390 } 6391 6392 static int set_adv_sync(struct hci_dev *hdev, void *data) 6393 { 6394 struct mgmt_pending_cmd *cmd = data; 6395 struct mgmt_mode *cp = cmd->param; 6396 u8 val = !!cp->val; 6397 6398 if (cp->val == 0x02) 6399 hci_dev_set_flag(hdev, HCI_ADVERTISING_CONNECTABLE); 6400 else 6401 hci_dev_clear_flag(hdev, HCI_ADVERTISING_CONNECTABLE); 6402 6403 cancel_adv_timeout(hdev); 6404 6405 if (val) { 6406 /* Switch to instance "0" for the Set Advertising setting. 6407 * We cannot use update_[adv|scan_rsp]_data() here as the 6408 * HCI_ADVERTISING flag is not yet set. 6409 */ 6410 hdev->cur_adv_instance = 0x00; 6411 6412 if (ext_adv_capable(hdev)) { 6413 hci_start_ext_adv_sync(hdev, 0x00); 6414 } else { 6415 hci_update_adv_data_sync(hdev, 0x00); 6416 hci_update_scan_rsp_data_sync(hdev, 0x00); 6417 hci_enable_advertising_sync(hdev); 6418 } 6419 } else { 6420 hci_disable_advertising_sync(hdev); 6421 } 6422 6423 return 0; 6424 } 6425 6426 static int set_advertising(struct sock *sk, struct hci_dev *hdev, void *data, 6427 u16 len) 6428 { 6429 struct mgmt_mode *cp = data; 6430 struct mgmt_pending_cmd *cmd; 6431 u8 val, status; 6432 int err; 6433 6434 bt_dev_dbg(hdev, "sock %p", sk); 6435 6436 status = mgmt_le_support(hdev); 6437 if (status) 6438 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING, 6439 status); 6440 6441 if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02) 6442 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING, 6443 MGMT_STATUS_INVALID_PARAMS); 6444 6445 if (hdev->advertising_paused) 6446 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING, 6447 MGMT_STATUS_BUSY); 6448 6449 hci_dev_lock(hdev); 6450 6451 val = !!cp->val; 6452 6453 /* The following conditions are ones which mean that we should 6454 * not do any HCI communication but directly send a mgmt 6455 * response to user space (after toggling the flag if 6456 * necessary). 6457 */ 6458 if (!hdev_is_powered(hdev) || 6459 (val == hci_dev_test_flag(hdev, HCI_ADVERTISING) && 6460 (cp->val == 0x02) == hci_dev_test_flag(hdev, HCI_ADVERTISING_CONNECTABLE)) || 6461 hci_dev_test_flag(hdev, HCI_MESH) || 6462 hci_conn_num(hdev, LE_LINK) > 0 || 6463 (hci_dev_test_flag(hdev, HCI_LE_SCAN) && 6464 hdev->le_scan_type == LE_SCAN_ACTIVE)) { 6465 bool changed; 6466 6467 if (cp->val) { 6468 hdev->cur_adv_instance = 0x00; 6469 changed = !hci_dev_test_and_set_flag(hdev, HCI_ADVERTISING); 6470 if (cp->val == 0x02) 6471 hci_dev_set_flag(hdev, HCI_ADVERTISING_CONNECTABLE); 6472 else 6473 hci_dev_clear_flag(hdev, HCI_ADVERTISING_CONNECTABLE); 6474 } else { 6475 changed = hci_dev_test_and_clear_flag(hdev, HCI_ADVERTISING); 6476 hci_dev_clear_flag(hdev, HCI_ADVERTISING_CONNECTABLE); 6477 } 6478 6479 err = send_settings_rsp(sk, MGMT_OP_SET_ADVERTISING, hdev); 6480 if (err < 0) 6481 goto unlock; 6482 6483 if (changed) 6484 err = new_settings(hdev, sk); 6485 6486 goto unlock; 6487 } 6488 6489 if (pending_find(MGMT_OP_SET_ADVERTISING, hdev) || 6490 pending_find(MGMT_OP_SET_LE, hdev)) { 6491 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING, 6492 MGMT_STATUS_BUSY); 6493 goto unlock; 6494 } 6495 6496 cmd = mgmt_pending_add(sk, MGMT_OP_SET_ADVERTISING, hdev, data, len); 6497 if (!cmd) 6498 err = -ENOMEM; 6499 else 6500 err = hci_cmd_sync_queue(hdev, set_adv_sync, cmd, 6501 set_advertising_complete); 6502 6503 if (err < 0 && cmd) 6504 mgmt_pending_remove(cmd); 6505 6506 unlock: 6507 hci_dev_unlock(hdev); 6508 return err; 6509 } 6510 6511 static int set_static_address(struct sock *sk, struct hci_dev *hdev, 6512 void *data, u16 len) 6513 { 6514 struct mgmt_cp_set_static_address *cp = data; 6515 int err; 6516 6517 bt_dev_dbg(hdev, "sock %p", sk); 6518 6519 if (!lmp_le_capable(hdev)) 6520 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_STATIC_ADDRESS, 6521 MGMT_STATUS_NOT_SUPPORTED); 6522 6523 if (hdev_is_powered(hdev)) 6524 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_STATIC_ADDRESS, 6525 MGMT_STATUS_REJECTED); 6526 6527 if (bacmp(&cp->bdaddr, BDADDR_ANY)) { 6528 if (!bacmp(&cp->bdaddr, BDADDR_NONE)) 6529 return mgmt_cmd_status(sk, hdev->id, 6530 MGMT_OP_SET_STATIC_ADDRESS, 6531 MGMT_STATUS_INVALID_PARAMS); 6532 6533 /* Two most significant bits shall be set */ 6534 if ((cp->bdaddr.b[5] & 0xc0) != 0xc0) 6535 return mgmt_cmd_status(sk, hdev->id, 6536 MGMT_OP_SET_STATIC_ADDRESS, 6537 MGMT_STATUS_INVALID_PARAMS); 6538 } 6539 6540 hci_dev_lock(hdev); 6541 6542 bacpy(&hdev->static_addr, &cp->bdaddr); 6543 6544 err = send_settings_rsp(sk, MGMT_OP_SET_STATIC_ADDRESS, hdev); 6545 if (err < 0) 6546 goto unlock; 6547 6548 err = new_settings(hdev, sk); 6549 6550 unlock: 6551 hci_dev_unlock(hdev); 6552 return err; 6553 } 6554 6555 static int set_scan_params(struct sock *sk, struct hci_dev *hdev, 6556 void *data, u16 len) 6557 { 6558 struct mgmt_cp_set_scan_params *cp = data; 6559 __u16 interval, window; 6560 int err; 6561 6562 bt_dev_dbg(hdev, "sock %p", sk); 6563 6564 if (!lmp_le_capable(hdev)) 6565 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS, 6566 MGMT_STATUS_NOT_SUPPORTED); 6567 6568 interval = __le16_to_cpu(cp->interval); 6569 6570 if (interval < 0x0004 || interval > 0x4000) 6571 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS, 6572 MGMT_STATUS_INVALID_PARAMS); 6573 6574 window = __le16_to_cpu(cp->window); 6575 6576 if (window < 0x0004 || window > 0x4000) 6577 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS, 6578 MGMT_STATUS_INVALID_PARAMS); 6579 6580 if (window > interval) 6581 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS, 6582 MGMT_STATUS_INVALID_PARAMS); 6583 6584 hci_dev_lock(hdev); 6585 6586 hdev->le_scan_interval = interval; 6587 hdev->le_scan_window = window; 6588 6589 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS, 0, 6590 NULL, 0); 6591 6592 /* If background scan is running, restart it so new parameters are 6593 * loaded. 6594 */ 6595 if (hci_dev_test_flag(hdev, HCI_LE_SCAN) && 6596 hdev->discovery.state == DISCOVERY_STOPPED) 6597 hci_update_passive_scan(hdev); 6598 6599 hci_dev_unlock(hdev); 6600 6601 return err; 6602 } 6603 6604 static void fast_connectable_complete(struct hci_dev *hdev, void *data, int err) 6605 { 6606 struct mgmt_pending_cmd *cmd = data; 6607 6608 bt_dev_dbg(hdev, "err %d", err); 6609 6610 if (err) { 6611 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE, 6612 mgmt_status(err)); 6613 } else { 6614 struct mgmt_mode *cp = cmd->param; 6615 6616 if (cp->val) 6617 hci_dev_set_flag(hdev, HCI_FAST_CONNECTABLE); 6618 else 6619 hci_dev_clear_flag(hdev, HCI_FAST_CONNECTABLE); 6620 6621 send_settings_rsp(cmd->sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev); 6622 new_settings(hdev, cmd->sk); 6623 } 6624 6625 mgmt_pending_free(cmd); 6626 } 6627 6628 static int write_fast_connectable_sync(struct hci_dev *hdev, void *data) 6629 { 6630 struct mgmt_pending_cmd *cmd = data; 6631 struct mgmt_mode *cp = cmd->param; 6632 6633 return hci_write_fast_connectable_sync(hdev, cp->val); 6634 } 6635 6636 static int set_fast_connectable(struct sock *sk, struct hci_dev *hdev, 6637 void *data, u16 len) 6638 { 6639 struct mgmt_mode *cp = data; 6640 struct mgmt_pending_cmd *cmd; 6641 int err; 6642 6643 bt_dev_dbg(hdev, "sock %p", sk); 6644 6645 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) || 6646 hdev->hci_ver < BLUETOOTH_VER_1_2) 6647 return mgmt_cmd_status(sk, hdev->id, 6648 MGMT_OP_SET_FAST_CONNECTABLE, 6649 MGMT_STATUS_NOT_SUPPORTED); 6650 6651 if (cp->val != 0x00 && cp->val != 0x01) 6652 return mgmt_cmd_status(sk, hdev->id, 6653 MGMT_OP_SET_FAST_CONNECTABLE, 6654 MGMT_STATUS_INVALID_PARAMS); 6655 6656 hci_dev_lock(hdev); 6657 6658 if (!!cp->val == hci_dev_test_flag(hdev, HCI_FAST_CONNECTABLE)) { 6659 err = send_settings_rsp(sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev); 6660 goto unlock; 6661 } 6662 6663 if (!hdev_is_powered(hdev)) { 6664 hci_dev_change_flag(hdev, HCI_FAST_CONNECTABLE); 6665 err = send_settings_rsp(sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev); 6666 new_settings(hdev, sk); 6667 goto unlock; 6668 } 6669 6670 cmd = mgmt_pending_new(sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev, data, 6671 len); 6672 if (!cmd) 6673 err = -ENOMEM; 6674 else 6675 err = hci_cmd_sync_queue(hdev, write_fast_connectable_sync, cmd, 6676 fast_connectable_complete); 6677 6678 if (err < 0) { 6679 mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE, 6680 MGMT_STATUS_FAILED); 6681 6682 if (cmd) 6683 mgmt_pending_free(cmd); 6684 } 6685 6686 unlock: 6687 hci_dev_unlock(hdev); 6688 6689 return err; 6690 } 6691 6692 static void set_bredr_complete(struct hci_dev *hdev, void *data, int err) 6693 { 6694 struct mgmt_pending_cmd *cmd = data; 6695 6696 bt_dev_dbg(hdev, "err %d", err); 6697 6698 if (err) { 6699 u8 mgmt_err = mgmt_status(err); 6700 6701 /* We need to restore the flag if related HCI commands 6702 * failed. 6703 */ 6704 hci_dev_clear_flag(hdev, HCI_BREDR_ENABLED); 6705 6706 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err); 6707 } else { 6708 send_settings_rsp(cmd->sk, MGMT_OP_SET_BREDR, hdev); 6709 new_settings(hdev, cmd->sk); 6710 } 6711 6712 mgmt_pending_free(cmd); 6713 } 6714 6715 static int set_bredr_sync(struct hci_dev *hdev, void *data) 6716 { 6717 int status; 6718 6719 status = hci_write_fast_connectable_sync(hdev, false); 6720 6721 if (!status) 6722 status = hci_update_scan_sync(hdev); 6723 6724 /* Since only the advertising data flags will change, there 6725 * is no need to update the scan response data. 6726 */ 6727 if (!status) 6728 status = hci_update_adv_data_sync(hdev, hdev->cur_adv_instance); 6729 6730 return status; 6731 } 6732 6733 static int set_bredr(struct sock *sk, struct hci_dev *hdev, void *data, u16 len) 6734 { 6735 struct mgmt_mode *cp = data; 6736 struct mgmt_pending_cmd *cmd; 6737 int err; 6738 6739 bt_dev_dbg(hdev, "sock %p", sk); 6740 6741 if (!lmp_bredr_capable(hdev) || !lmp_le_capable(hdev)) 6742 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR, 6743 MGMT_STATUS_NOT_SUPPORTED); 6744 6745 if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED)) 6746 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR, 6747 MGMT_STATUS_REJECTED); 6748 6749 if (cp->val != 0x00 && cp->val != 0x01) 6750 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR, 6751 MGMT_STATUS_INVALID_PARAMS); 6752 6753 hci_dev_lock(hdev); 6754 6755 if (cp->val == hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) { 6756 err = send_settings_rsp(sk, MGMT_OP_SET_BREDR, hdev); 6757 goto unlock; 6758 } 6759 6760 if (!hdev_is_powered(hdev)) { 6761 if (!cp->val) { 6762 hci_dev_clear_flag(hdev, HCI_DISCOVERABLE); 6763 hci_dev_clear_flag(hdev, HCI_SSP_ENABLED); 6764 hci_dev_clear_flag(hdev, HCI_LINK_SECURITY); 6765 hci_dev_clear_flag(hdev, HCI_FAST_CONNECTABLE); 6766 hci_dev_clear_flag(hdev, HCI_HS_ENABLED); 6767 } 6768 6769 hci_dev_change_flag(hdev, HCI_BREDR_ENABLED); 6770 6771 err = send_settings_rsp(sk, MGMT_OP_SET_BREDR, hdev); 6772 if (err < 0) 6773 goto unlock; 6774 6775 err = new_settings(hdev, sk); 6776 goto unlock; 6777 } 6778 6779 /* Reject disabling when powered on */ 6780 if (!cp->val) { 6781 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR, 6782 MGMT_STATUS_REJECTED); 6783 goto unlock; 6784 } else { 6785 /* When configuring a dual-mode controller to operate 6786 * with LE only and using a static address, then switching 6787 * BR/EDR back on is not allowed. 6788 * 6789 * Dual-mode controllers shall operate with the public 6790 * address as its identity address for BR/EDR and LE. So 6791 * reject the attempt to create an invalid configuration. 6792 * 6793 * The same restrictions applies when secure connections 6794 * has been enabled. For BR/EDR this is a controller feature 6795 * while for LE it is a host stack feature. This means that 6796 * switching BR/EDR back on when secure connections has been 6797 * enabled is not a supported transaction. 6798 */ 6799 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) && 6800 (bacmp(&hdev->static_addr, BDADDR_ANY) || 6801 hci_dev_test_flag(hdev, HCI_SC_ENABLED))) { 6802 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR, 6803 MGMT_STATUS_REJECTED); 6804 goto unlock; 6805 } 6806 } 6807 6808 cmd = mgmt_pending_new(sk, MGMT_OP_SET_BREDR, hdev, data, len); 6809 if (!cmd) 6810 err = -ENOMEM; 6811 else 6812 err = hci_cmd_sync_queue(hdev, set_bredr_sync, cmd, 6813 set_bredr_complete); 6814 6815 if (err < 0) { 6816 mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR, 6817 MGMT_STATUS_FAILED); 6818 if (cmd) 6819 mgmt_pending_free(cmd); 6820 6821 goto unlock; 6822 } 6823 6824 /* We need to flip the bit already here so that 6825 * hci_req_update_adv_data generates the correct flags. 6826 */ 6827 hci_dev_set_flag(hdev, HCI_BREDR_ENABLED); 6828 6829 unlock: 6830 hci_dev_unlock(hdev); 6831 return err; 6832 } 6833 6834 static void set_secure_conn_complete(struct hci_dev *hdev, void *data, int err) 6835 { 6836 struct mgmt_pending_cmd *cmd = data; 6837 struct mgmt_mode *cp; 6838 6839 bt_dev_dbg(hdev, "err %d", err); 6840 6841 if (err) { 6842 u8 mgmt_err = mgmt_status(err); 6843 6844 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err); 6845 goto done; 6846 } 6847 6848 cp = cmd->param; 6849 6850 switch (cp->val) { 6851 case 0x00: 6852 hci_dev_clear_flag(hdev, HCI_SC_ENABLED); 6853 hci_dev_clear_flag(hdev, HCI_SC_ONLY); 6854 break; 6855 case 0x01: 6856 hci_dev_set_flag(hdev, HCI_SC_ENABLED); 6857 hci_dev_clear_flag(hdev, HCI_SC_ONLY); 6858 break; 6859 case 0x02: 6860 hci_dev_set_flag(hdev, HCI_SC_ENABLED); 6861 hci_dev_set_flag(hdev, HCI_SC_ONLY); 6862 break; 6863 } 6864 6865 send_settings_rsp(cmd->sk, cmd->opcode, hdev); 6866 new_settings(hdev, cmd->sk); 6867 6868 done: 6869 mgmt_pending_free(cmd); 6870 } 6871 6872 static int set_secure_conn_sync(struct hci_dev *hdev, void *data) 6873 { 6874 struct mgmt_pending_cmd *cmd = data; 6875 struct mgmt_mode *cp = cmd->param; 6876 u8 val = !!cp->val; 6877 6878 /* Force write of val */ 6879 hci_dev_set_flag(hdev, HCI_SC_ENABLED); 6880 6881 return hci_write_sc_support_sync(hdev, val); 6882 } 6883 6884 static int set_secure_conn(struct sock *sk, struct hci_dev *hdev, 6885 void *data, u16 len) 6886 { 6887 struct mgmt_mode *cp = data; 6888 struct mgmt_pending_cmd *cmd; 6889 u8 val; 6890 int err; 6891 6892 bt_dev_dbg(hdev, "sock %p", sk); 6893 6894 if (!lmp_sc_capable(hdev) && 6895 !hci_dev_test_flag(hdev, HCI_LE_ENABLED)) 6896 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN, 6897 MGMT_STATUS_NOT_SUPPORTED); 6898 6899 if (hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) && 6900 lmp_sc_capable(hdev) && 6901 !hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) 6902 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN, 6903 MGMT_STATUS_REJECTED); 6904 6905 if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02) 6906 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN, 6907 MGMT_STATUS_INVALID_PARAMS); 6908 6909 hci_dev_lock(hdev); 6910 6911 if (!hdev_is_powered(hdev) || !lmp_sc_capable(hdev) || 6912 !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) { 6913 bool changed; 6914 6915 if (cp->val) { 6916 changed = !hci_dev_test_and_set_flag(hdev, 6917 HCI_SC_ENABLED); 6918 if (cp->val == 0x02) 6919 hci_dev_set_flag(hdev, HCI_SC_ONLY); 6920 else 6921 hci_dev_clear_flag(hdev, HCI_SC_ONLY); 6922 } else { 6923 changed = hci_dev_test_and_clear_flag(hdev, 6924 HCI_SC_ENABLED); 6925 hci_dev_clear_flag(hdev, HCI_SC_ONLY); 6926 } 6927 6928 err = send_settings_rsp(sk, MGMT_OP_SET_SECURE_CONN, hdev); 6929 if (err < 0) 6930 goto failed; 6931 6932 if (changed) 6933 err = new_settings(hdev, sk); 6934 6935 goto failed; 6936 } 6937 6938 val = !!cp->val; 6939 6940 if (val == hci_dev_test_flag(hdev, HCI_SC_ENABLED) && 6941 (cp->val == 0x02) == hci_dev_test_flag(hdev, HCI_SC_ONLY)) { 6942 err = send_settings_rsp(sk, MGMT_OP_SET_SECURE_CONN, hdev); 6943 goto failed; 6944 } 6945 6946 cmd = mgmt_pending_new(sk, MGMT_OP_SET_SECURE_CONN, hdev, data, len); 6947 if (!cmd) 6948 err = -ENOMEM; 6949 else 6950 err = hci_cmd_sync_queue(hdev, set_secure_conn_sync, cmd, 6951 set_secure_conn_complete); 6952 6953 if (err < 0) { 6954 mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN, 6955 MGMT_STATUS_FAILED); 6956 if (cmd) 6957 mgmt_pending_free(cmd); 6958 } 6959 6960 failed: 6961 hci_dev_unlock(hdev); 6962 return err; 6963 } 6964 6965 static int set_debug_keys(struct sock *sk, struct hci_dev *hdev, 6966 void *data, u16 len) 6967 { 6968 struct mgmt_mode *cp = data; 6969 bool changed, use_changed; 6970 int err; 6971 6972 bt_dev_dbg(hdev, "sock %p", sk); 6973 6974 if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02) 6975 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEBUG_KEYS, 6976 MGMT_STATUS_INVALID_PARAMS); 6977 6978 hci_dev_lock(hdev); 6979 6980 if (cp->val) 6981 changed = !hci_dev_test_and_set_flag(hdev, HCI_KEEP_DEBUG_KEYS); 6982 else 6983 changed = hci_dev_test_and_clear_flag(hdev, 6984 HCI_KEEP_DEBUG_KEYS); 6985 6986 if (cp->val == 0x02) 6987 use_changed = !hci_dev_test_and_set_flag(hdev, 6988 HCI_USE_DEBUG_KEYS); 6989 else 6990 use_changed = hci_dev_test_and_clear_flag(hdev, 6991 HCI_USE_DEBUG_KEYS); 6992 6993 if (hdev_is_powered(hdev) && use_changed && 6994 hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) { 6995 u8 mode = (cp->val == 0x02) ? 0x01 : 0x00; 6996 hci_send_cmd(hdev, HCI_OP_WRITE_SSP_DEBUG_MODE, 6997 sizeof(mode), &mode); 6998 } 6999 7000 err = send_settings_rsp(sk, MGMT_OP_SET_DEBUG_KEYS, hdev); 7001 if (err < 0) 7002 goto unlock; 7003 7004 if (changed) 7005 err = new_settings(hdev, sk); 7006 7007 unlock: 7008 hci_dev_unlock(hdev); 7009 return err; 7010 } 7011 7012 static int set_privacy(struct sock *sk, struct hci_dev *hdev, void *cp_data, 7013 u16 len) 7014 { 7015 struct mgmt_cp_set_privacy *cp = cp_data; 7016 bool changed; 7017 int err; 7018 7019 bt_dev_dbg(hdev, "sock %p", sk); 7020 7021 if (!lmp_le_capable(hdev)) 7022 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY, 7023 MGMT_STATUS_NOT_SUPPORTED); 7024 7025 if (cp->privacy != 0x00 && cp->privacy != 0x01 && cp->privacy != 0x02) 7026 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY, 7027 MGMT_STATUS_INVALID_PARAMS); 7028 7029 if (hdev_is_powered(hdev)) 7030 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY, 7031 MGMT_STATUS_REJECTED); 7032 7033 hci_dev_lock(hdev); 7034 7035 /* If user space supports this command it is also expected to 7036 * handle IRKs. Therefore, set the HCI_RPA_RESOLVING flag. 7037 */ 7038 hci_dev_set_flag(hdev, HCI_RPA_RESOLVING); 7039 7040 if (cp->privacy) { 7041 changed = !hci_dev_test_and_set_flag(hdev, HCI_PRIVACY); 7042 memcpy(hdev->irk, cp->irk, sizeof(hdev->irk)); 7043 hci_dev_set_flag(hdev, HCI_RPA_EXPIRED); 7044 hci_adv_instances_set_rpa_expired(hdev, true); 7045 if (cp->privacy == 0x02) 7046 hci_dev_set_flag(hdev, HCI_LIMITED_PRIVACY); 7047 else 7048 hci_dev_clear_flag(hdev, HCI_LIMITED_PRIVACY); 7049 } else { 7050 changed = hci_dev_test_and_clear_flag(hdev, HCI_PRIVACY); 7051 memset(hdev->irk, 0, sizeof(hdev->irk)); 7052 hci_dev_clear_flag(hdev, HCI_RPA_EXPIRED); 7053 hci_adv_instances_set_rpa_expired(hdev, false); 7054 hci_dev_clear_flag(hdev, HCI_LIMITED_PRIVACY); 7055 } 7056 7057 err = send_settings_rsp(sk, MGMT_OP_SET_PRIVACY, hdev); 7058 if (err < 0) 7059 goto unlock; 7060 7061 if (changed) 7062 err = new_settings(hdev, sk); 7063 7064 unlock: 7065 hci_dev_unlock(hdev); 7066 return err; 7067 } 7068 7069 static bool irk_is_valid(struct mgmt_irk_info *irk) 7070 { 7071 switch (irk->addr.type) { 7072 case BDADDR_LE_PUBLIC: 7073 return true; 7074 7075 case BDADDR_LE_RANDOM: 7076 /* Two most significant bits shall be set */ 7077 if ((irk->addr.bdaddr.b[5] & 0xc0) != 0xc0) 7078 return false; 7079 return true; 7080 } 7081 7082 return false; 7083 } 7084 7085 static int load_irks(struct sock *sk, struct hci_dev *hdev, void *cp_data, 7086 u16 len) 7087 { 7088 struct mgmt_cp_load_irks *cp = cp_data; 7089 const u16 max_irk_count = ((U16_MAX - sizeof(*cp)) / 7090 sizeof(struct mgmt_irk_info)); 7091 u16 irk_count, expected_len; 7092 int i, err; 7093 7094 bt_dev_dbg(hdev, "sock %p", sk); 7095 7096 if (!lmp_le_capable(hdev)) 7097 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS, 7098 MGMT_STATUS_NOT_SUPPORTED); 7099 7100 irk_count = __le16_to_cpu(cp->irk_count); 7101 if (irk_count > max_irk_count) { 7102 bt_dev_err(hdev, "load_irks: too big irk_count value %u", 7103 irk_count); 7104 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS, 7105 MGMT_STATUS_INVALID_PARAMS); 7106 } 7107 7108 expected_len = struct_size(cp, irks, irk_count); 7109 if (expected_len != len) { 7110 bt_dev_err(hdev, "load_irks: expected %u bytes, got %u bytes", 7111 expected_len, len); 7112 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS, 7113 MGMT_STATUS_INVALID_PARAMS); 7114 } 7115 7116 bt_dev_dbg(hdev, "irk_count %u", irk_count); 7117 7118 for (i = 0; i < irk_count; i++) { 7119 struct mgmt_irk_info *key = &cp->irks[i]; 7120 7121 if (!irk_is_valid(key)) 7122 return mgmt_cmd_status(sk, hdev->id, 7123 MGMT_OP_LOAD_IRKS, 7124 MGMT_STATUS_INVALID_PARAMS); 7125 } 7126 7127 hci_dev_lock(hdev); 7128 7129 hci_smp_irks_clear(hdev); 7130 7131 for (i = 0; i < irk_count; i++) { 7132 struct mgmt_irk_info *irk = &cp->irks[i]; 7133 7134 if (hci_is_blocked_key(hdev, 7135 HCI_BLOCKED_KEY_TYPE_IRK, 7136 irk->val)) { 7137 bt_dev_warn(hdev, "Skipping blocked IRK for %pMR", 7138 &irk->addr.bdaddr); 7139 continue; 7140 } 7141 7142 hci_add_irk(hdev, &irk->addr.bdaddr, 7143 le_addr_type(irk->addr.type), irk->val, 7144 BDADDR_ANY); 7145 } 7146 7147 hci_dev_set_flag(hdev, HCI_RPA_RESOLVING); 7148 7149 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_IRKS, 0, NULL, 0); 7150 7151 hci_dev_unlock(hdev); 7152 7153 return err; 7154 } 7155 7156 static bool ltk_is_valid(struct mgmt_ltk_info *key) 7157 { 7158 if (key->initiator != 0x00 && key->initiator != 0x01) 7159 return false; 7160 7161 switch (key->addr.type) { 7162 case BDADDR_LE_PUBLIC: 7163 return true; 7164 7165 case BDADDR_LE_RANDOM: 7166 /* Two most significant bits shall be set */ 7167 if ((key->addr.bdaddr.b[5] & 0xc0) != 0xc0) 7168 return false; 7169 return true; 7170 } 7171 7172 return false; 7173 } 7174 7175 static int load_long_term_keys(struct sock *sk, struct hci_dev *hdev, 7176 void *cp_data, u16 len) 7177 { 7178 struct mgmt_cp_load_long_term_keys *cp = cp_data; 7179 const u16 max_key_count = ((U16_MAX - sizeof(*cp)) / 7180 sizeof(struct mgmt_ltk_info)); 7181 u16 key_count, expected_len; 7182 int i, err; 7183 7184 bt_dev_dbg(hdev, "sock %p", sk); 7185 7186 if (!lmp_le_capable(hdev)) 7187 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS, 7188 MGMT_STATUS_NOT_SUPPORTED); 7189 7190 key_count = __le16_to_cpu(cp->key_count); 7191 if (key_count > max_key_count) { 7192 bt_dev_err(hdev, "load_ltks: too big key_count value %u", 7193 key_count); 7194 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS, 7195 MGMT_STATUS_INVALID_PARAMS); 7196 } 7197 7198 expected_len = struct_size(cp, keys, key_count); 7199 if (expected_len != len) { 7200 bt_dev_err(hdev, "load_keys: expected %u bytes, got %u bytes", 7201 expected_len, len); 7202 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS, 7203 MGMT_STATUS_INVALID_PARAMS); 7204 } 7205 7206 bt_dev_dbg(hdev, "key_count %u", key_count); 7207 7208 for (i = 0; i < key_count; i++) { 7209 struct mgmt_ltk_info *key = &cp->keys[i]; 7210 7211 if (!ltk_is_valid(key)) 7212 return mgmt_cmd_status(sk, hdev->id, 7213 MGMT_OP_LOAD_LONG_TERM_KEYS, 7214 MGMT_STATUS_INVALID_PARAMS); 7215 } 7216 7217 hci_dev_lock(hdev); 7218 7219 hci_smp_ltks_clear(hdev); 7220 7221 for (i = 0; i < key_count; i++) { 7222 struct mgmt_ltk_info *key = &cp->keys[i]; 7223 u8 type, authenticated; 7224 7225 if (hci_is_blocked_key(hdev, 7226 HCI_BLOCKED_KEY_TYPE_LTK, 7227 key->val)) { 7228 bt_dev_warn(hdev, "Skipping blocked LTK for %pMR", 7229 &key->addr.bdaddr); 7230 continue; 7231 } 7232 7233 switch (key->type) { 7234 case MGMT_LTK_UNAUTHENTICATED: 7235 authenticated = 0x00; 7236 type = key->initiator ? SMP_LTK : SMP_LTK_RESPONDER; 7237 break; 7238 case MGMT_LTK_AUTHENTICATED: 7239 authenticated = 0x01; 7240 type = key->initiator ? SMP_LTK : SMP_LTK_RESPONDER; 7241 break; 7242 case MGMT_LTK_P256_UNAUTH: 7243 authenticated = 0x00; 7244 type = SMP_LTK_P256; 7245 break; 7246 case MGMT_LTK_P256_AUTH: 7247 authenticated = 0x01; 7248 type = SMP_LTK_P256; 7249 break; 7250 case MGMT_LTK_P256_DEBUG: 7251 authenticated = 0x00; 7252 type = SMP_LTK_P256_DEBUG; 7253 fallthrough; 7254 default: 7255 continue; 7256 } 7257 7258 hci_add_ltk(hdev, &key->addr.bdaddr, 7259 le_addr_type(key->addr.type), type, authenticated, 7260 key->val, key->enc_size, key->ediv, key->rand); 7261 } 7262 7263 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS, 0, 7264 NULL, 0); 7265 7266 hci_dev_unlock(hdev); 7267 7268 return err; 7269 } 7270 7271 static void get_conn_info_complete(struct hci_dev *hdev, void *data, int err) 7272 { 7273 struct mgmt_pending_cmd *cmd = data; 7274 struct hci_conn *conn = cmd->user_data; 7275 struct mgmt_cp_get_conn_info *cp = cmd->param; 7276 struct mgmt_rp_get_conn_info rp; 7277 u8 status; 7278 7279 bt_dev_dbg(hdev, "err %d", err); 7280 7281 memcpy(&rp.addr, &cp->addr, sizeof(rp.addr)); 7282 7283 status = mgmt_status(err); 7284 if (status == MGMT_STATUS_SUCCESS) { 7285 rp.rssi = conn->rssi; 7286 rp.tx_power = conn->tx_power; 7287 rp.max_tx_power = conn->max_tx_power; 7288 } else { 7289 rp.rssi = HCI_RSSI_INVALID; 7290 rp.tx_power = HCI_TX_POWER_INVALID; 7291 rp.max_tx_power = HCI_TX_POWER_INVALID; 7292 } 7293 7294 mgmt_cmd_complete(cmd->sk, cmd->index, MGMT_OP_GET_CONN_INFO, status, 7295 &rp, sizeof(rp)); 7296 7297 mgmt_pending_free(cmd); 7298 } 7299 7300 static int get_conn_info_sync(struct hci_dev *hdev, void *data) 7301 { 7302 struct mgmt_pending_cmd *cmd = data; 7303 struct mgmt_cp_get_conn_info *cp = cmd->param; 7304 struct hci_conn *conn; 7305 int err; 7306 __le16 handle; 7307 7308 /* Make sure we are still connected */ 7309 if (cp->addr.type == BDADDR_BREDR) 7310 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, 7311 &cp->addr.bdaddr); 7312 else 7313 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &cp->addr.bdaddr); 7314 7315 if (!conn || conn->state != BT_CONNECTED) 7316 return MGMT_STATUS_NOT_CONNECTED; 7317 7318 cmd->user_data = conn; 7319 handle = cpu_to_le16(conn->handle); 7320 7321 /* Refresh RSSI each time */ 7322 err = hci_read_rssi_sync(hdev, handle); 7323 7324 /* For LE links TX power does not change thus we don't need to 7325 * query for it once value is known. 7326 */ 7327 if (!err && (!bdaddr_type_is_le(cp->addr.type) || 7328 conn->tx_power == HCI_TX_POWER_INVALID)) 7329 err = hci_read_tx_power_sync(hdev, handle, 0x00); 7330 7331 /* Max TX power needs to be read only once per connection */ 7332 if (!err && conn->max_tx_power == HCI_TX_POWER_INVALID) 7333 err = hci_read_tx_power_sync(hdev, handle, 0x01); 7334 7335 return err; 7336 } 7337 7338 static int get_conn_info(struct sock *sk, struct hci_dev *hdev, void *data, 7339 u16 len) 7340 { 7341 struct mgmt_cp_get_conn_info *cp = data; 7342 struct mgmt_rp_get_conn_info rp; 7343 struct hci_conn *conn; 7344 unsigned long conn_info_age; 7345 int err = 0; 7346 7347 bt_dev_dbg(hdev, "sock %p", sk); 7348 7349 memset(&rp, 0, sizeof(rp)); 7350 bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr); 7351 rp.addr.type = cp->addr.type; 7352 7353 if (!bdaddr_type_is_valid(cp->addr.type)) 7354 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO, 7355 MGMT_STATUS_INVALID_PARAMS, 7356 &rp, sizeof(rp)); 7357 7358 hci_dev_lock(hdev); 7359 7360 if (!hdev_is_powered(hdev)) { 7361 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO, 7362 MGMT_STATUS_NOT_POWERED, &rp, 7363 sizeof(rp)); 7364 goto unlock; 7365 } 7366 7367 if (cp->addr.type == BDADDR_BREDR) 7368 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, 7369 &cp->addr.bdaddr); 7370 else 7371 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &cp->addr.bdaddr); 7372 7373 if (!conn || conn->state != BT_CONNECTED) { 7374 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO, 7375 MGMT_STATUS_NOT_CONNECTED, &rp, 7376 sizeof(rp)); 7377 goto unlock; 7378 } 7379 7380 /* To avoid client trying to guess when to poll again for information we 7381 * calculate conn info age as random value between min/max set in hdev. 7382 */ 7383 conn_info_age = get_random_u32_inclusive(hdev->conn_info_min_age, 7384 hdev->conn_info_max_age - 1); 7385 7386 /* Query controller to refresh cached values if they are too old or were 7387 * never read. 7388 */ 7389 if (time_after(jiffies, conn->conn_info_timestamp + 7390 msecs_to_jiffies(conn_info_age)) || 7391 !conn->conn_info_timestamp) { 7392 struct mgmt_pending_cmd *cmd; 7393 7394 cmd = mgmt_pending_new(sk, MGMT_OP_GET_CONN_INFO, hdev, data, 7395 len); 7396 if (!cmd) { 7397 err = -ENOMEM; 7398 } else { 7399 err = hci_cmd_sync_queue(hdev, get_conn_info_sync, 7400 cmd, get_conn_info_complete); 7401 } 7402 7403 if (err < 0) { 7404 mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO, 7405 MGMT_STATUS_FAILED, &rp, sizeof(rp)); 7406 7407 if (cmd) 7408 mgmt_pending_free(cmd); 7409 7410 goto unlock; 7411 } 7412 7413 conn->conn_info_timestamp = jiffies; 7414 } else { 7415 /* Cache is valid, just reply with values cached in hci_conn */ 7416 rp.rssi = conn->rssi; 7417 rp.tx_power = conn->tx_power; 7418 rp.max_tx_power = conn->max_tx_power; 7419 7420 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO, 7421 MGMT_STATUS_SUCCESS, &rp, sizeof(rp)); 7422 } 7423 7424 unlock: 7425 hci_dev_unlock(hdev); 7426 return err; 7427 } 7428 7429 static void get_clock_info_complete(struct hci_dev *hdev, void *data, int err) 7430 { 7431 struct mgmt_pending_cmd *cmd = data; 7432 struct mgmt_cp_get_clock_info *cp = cmd->param; 7433 struct mgmt_rp_get_clock_info rp; 7434 struct hci_conn *conn = cmd->user_data; 7435 u8 status = mgmt_status(err); 7436 7437 bt_dev_dbg(hdev, "err %d", err); 7438 7439 memset(&rp, 0, sizeof(rp)); 7440 bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr); 7441 rp.addr.type = cp->addr.type; 7442 7443 if (err) 7444 goto complete; 7445 7446 rp.local_clock = cpu_to_le32(hdev->clock); 7447 7448 if (conn) { 7449 rp.piconet_clock = cpu_to_le32(conn->clock); 7450 rp.accuracy = cpu_to_le16(conn->clock_accuracy); 7451 } 7452 7453 complete: 7454 mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, status, &rp, 7455 sizeof(rp)); 7456 7457 mgmt_pending_free(cmd); 7458 } 7459 7460 static int get_clock_info_sync(struct hci_dev *hdev, void *data) 7461 { 7462 struct mgmt_pending_cmd *cmd = data; 7463 struct mgmt_cp_get_clock_info *cp = cmd->param; 7464 struct hci_cp_read_clock hci_cp; 7465 struct hci_conn *conn; 7466 7467 memset(&hci_cp, 0, sizeof(hci_cp)); 7468 hci_read_clock_sync(hdev, &hci_cp); 7469 7470 /* Make sure connection still exists */ 7471 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->addr.bdaddr); 7472 if (!conn || conn->state != BT_CONNECTED) 7473 return MGMT_STATUS_NOT_CONNECTED; 7474 7475 cmd->user_data = conn; 7476 hci_cp.handle = cpu_to_le16(conn->handle); 7477 hci_cp.which = 0x01; /* Piconet clock */ 7478 7479 return hci_read_clock_sync(hdev, &hci_cp); 7480 } 7481 7482 static int get_clock_info(struct sock *sk, struct hci_dev *hdev, void *data, 7483 u16 len) 7484 { 7485 struct mgmt_cp_get_clock_info *cp = data; 7486 struct mgmt_rp_get_clock_info rp; 7487 struct mgmt_pending_cmd *cmd; 7488 struct hci_conn *conn; 7489 int err; 7490 7491 bt_dev_dbg(hdev, "sock %p", sk); 7492 7493 memset(&rp, 0, sizeof(rp)); 7494 bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr); 7495 rp.addr.type = cp->addr.type; 7496 7497 if (cp->addr.type != BDADDR_BREDR) 7498 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CLOCK_INFO, 7499 MGMT_STATUS_INVALID_PARAMS, 7500 &rp, sizeof(rp)); 7501 7502 hci_dev_lock(hdev); 7503 7504 if (!hdev_is_powered(hdev)) { 7505 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CLOCK_INFO, 7506 MGMT_STATUS_NOT_POWERED, &rp, 7507 sizeof(rp)); 7508 goto unlock; 7509 } 7510 7511 if (bacmp(&cp->addr.bdaddr, BDADDR_ANY)) { 7512 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, 7513 &cp->addr.bdaddr); 7514 if (!conn || conn->state != BT_CONNECTED) { 7515 err = mgmt_cmd_complete(sk, hdev->id, 7516 MGMT_OP_GET_CLOCK_INFO, 7517 MGMT_STATUS_NOT_CONNECTED, 7518 &rp, sizeof(rp)); 7519 goto unlock; 7520 } 7521 } else { 7522 conn = NULL; 7523 } 7524 7525 cmd = mgmt_pending_new(sk, MGMT_OP_GET_CLOCK_INFO, hdev, data, len); 7526 if (!cmd) 7527 err = -ENOMEM; 7528 else 7529 err = hci_cmd_sync_queue(hdev, get_clock_info_sync, cmd, 7530 get_clock_info_complete); 7531 7532 if (err < 0) { 7533 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CLOCK_INFO, 7534 MGMT_STATUS_FAILED, &rp, sizeof(rp)); 7535 7536 if (cmd) 7537 mgmt_pending_free(cmd); 7538 } 7539 7540 7541 unlock: 7542 hci_dev_unlock(hdev); 7543 return err; 7544 } 7545 7546 static bool is_connected(struct hci_dev *hdev, bdaddr_t *addr, u8 type) 7547 { 7548 struct hci_conn *conn; 7549 7550 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, addr); 7551 if (!conn) 7552 return false; 7553 7554 if (conn->dst_type != type) 7555 return false; 7556 7557 if (conn->state != BT_CONNECTED) 7558 return false; 7559 7560 return true; 7561 } 7562 7563 /* This function requires the caller holds hdev->lock */ 7564 static int hci_conn_params_set(struct hci_dev *hdev, bdaddr_t *addr, 7565 u8 addr_type, u8 auto_connect) 7566 { 7567 struct hci_conn_params *params; 7568 7569 params = hci_conn_params_add(hdev, addr, addr_type); 7570 if (!params) 7571 return -EIO; 7572 7573 if (params->auto_connect == auto_connect) 7574 return 0; 7575 7576 hci_pend_le_list_del_init(params); 7577 7578 switch (auto_connect) { 7579 case HCI_AUTO_CONN_DISABLED: 7580 case HCI_AUTO_CONN_LINK_LOSS: 7581 /* If auto connect is being disabled when we're trying to 7582 * connect to device, keep connecting. 7583 */ 7584 if (params->explicit_connect) 7585 hci_pend_le_list_add(params, &hdev->pend_le_conns); 7586 break; 7587 case HCI_AUTO_CONN_REPORT: 7588 if (params->explicit_connect) 7589 hci_pend_le_list_add(params, &hdev->pend_le_conns); 7590 else 7591 hci_pend_le_list_add(params, &hdev->pend_le_reports); 7592 break; 7593 case HCI_AUTO_CONN_DIRECT: 7594 case HCI_AUTO_CONN_ALWAYS: 7595 if (!is_connected(hdev, addr, addr_type)) 7596 hci_pend_le_list_add(params, &hdev->pend_le_conns); 7597 break; 7598 } 7599 7600 params->auto_connect = auto_connect; 7601 7602 bt_dev_dbg(hdev, "addr %pMR (type %u) auto_connect %u", 7603 addr, addr_type, auto_connect); 7604 7605 return 0; 7606 } 7607 7608 static void device_added(struct sock *sk, struct hci_dev *hdev, 7609 bdaddr_t *bdaddr, u8 type, u8 action) 7610 { 7611 struct mgmt_ev_device_added ev; 7612 7613 bacpy(&ev.addr.bdaddr, bdaddr); 7614 ev.addr.type = type; 7615 ev.action = action; 7616 7617 mgmt_event(MGMT_EV_DEVICE_ADDED, hdev, &ev, sizeof(ev), sk); 7618 } 7619 7620 static int add_device_sync(struct hci_dev *hdev, void *data) 7621 { 7622 return hci_update_passive_scan_sync(hdev); 7623 } 7624 7625 static int add_device(struct sock *sk, struct hci_dev *hdev, 7626 void *data, u16 len) 7627 { 7628 struct mgmt_cp_add_device *cp = data; 7629 u8 auto_conn, addr_type; 7630 struct hci_conn_params *params; 7631 int err; 7632 u32 current_flags = 0; 7633 u32 supported_flags; 7634 7635 bt_dev_dbg(hdev, "sock %p", sk); 7636 7637 if (!bdaddr_type_is_valid(cp->addr.type) || 7638 !bacmp(&cp->addr.bdaddr, BDADDR_ANY)) 7639 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE, 7640 MGMT_STATUS_INVALID_PARAMS, 7641 &cp->addr, sizeof(cp->addr)); 7642 7643 if (cp->action != 0x00 && cp->action != 0x01 && cp->action != 0x02) 7644 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE, 7645 MGMT_STATUS_INVALID_PARAMS, 7646 &cp->addr, sizeof(cp->addr)); 7647 7648 hci_dev_lock(hdev); 7649 7650 if (cp->addr.type == BDADDR_BREDR) { 7651 /* Only incoming connections action is supported for now */ 7652 if (cp->action != 0x01) { 7653 err = mgmt_cmd_complete(sk, hdev->id, 7654 MGMT_OP_ADD_DEVICE, 7655 MGMT_STATUS_INVALID_PARAMS, 7656 &cp->addr, sizeof(cp->addr)); 7657 goto unlock; 7658 } 7659 7660 err = hci_bdaddr_list_add_with_flags(&hdev->accept_list, 7661 &cp->addr.bdaddr, 7662 cp->addr.type, 0); 7663 if (err) 7664 goto unlock; 7665 7666 hci_update_scan(hdev); 7667 7668 goto added; 7669 } 7670 7671 addr_type = le_addr_type(cp->addr.type); 7672 7673 if (cp->action == 0x02) 7674 auto_conn = HCI_AUTO_CONN_ALWAYS; 7675 else if (cp->action == 0x01) 7676 auto_conn = HCI_AUTO_CONN_DIRECT; 7677 else 7678 auto_conn = HCI_AUTO_CONN_REPORT; 7679 7680 /* Kernel internally uses conn_params with resolvable private 7681 * address, but Add Device allows only identity addresses. 7682 * Make sure it is enforced before calling 7683 * hci_conn_params_lookup. 7684 */ 7685 if (!hci_is_identity_address(&cp->addr.bdaddr, addr_type)) { 7686 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE, 7687 MGMT_STATUS_INVALID_PARAMS, 7688 &cp->addr, sizeof(cp->addr)); 7689 goto unlock; 7690 } 7691 7692 /* If the connection parameters don't exist for this device, 7693 * they will be created and configured with defaults. 7694 */ 7695 if (hci_conn_params_set(hdev, &cp->addr.bdaddr, addr_type, 7696 auto_conn) < 0) { 7697 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE, 7698 MGMT_STATUS_FAILED, &cp->addr, 7699 sizeof(cp->addr)); 7700 goto unlock; 7701 } else { 7702 params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr, 7703 addr_type); 7704 if (params) 7705 current_flags = params->flags; 7706 } 7707 7708 err = hci_cmd_sync_queue(hdev, add_device_sync, NULL, NULL); 7709 if (err < 0) 7710 goto unlock; 7711 7712 added: 7713 device_added(sk, hdev, &cp->addr.bdaddr, cp->addr.type, cp->action); 7714 supported_flags = hdev->conn_flags; 7715 device_flags_changed(NULL, hdev, &cp->addr.bdaddr, cp->addr.type, 7716 supported_flags, current_flags); 7717 7718 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE, 7719 MGMT_STATUS_SUCCESS, &cp->addr, 7720 sizeof(cp->addr)); 7721 7722 unlock: 7723 hci_dev_unlock(hdev); 7724 return err; 7725 } 7726 7727 static void device_removed(struct sock *sk, struct hci_dev *hdev, 7728 bdaddr_t *bdaddr, u8 type) 7729 { 7730 struct mgmt_ev_device_removed ev; 7731 7732 bacpy(&ev.addr.bdaddr, bdaddr); 7733 ev.addr.type = type; 7734 7735 mgmt_event(MGMT_EV_DEVICE_REMOVED, hdev, &ev, sizeof(ev), sk); 7736 } 7737 7738 static int remove_device_sync(struct hci_dev *hdev, void *data) 7739 { 7740 return hci_update_passive_scan_sync(hdev); 7741 } 7742 7743 static int remove_device(struct sock *sk, struct hci_dev *hdev, 7744 void *data, u16 len) 7745 { 7746 struct mgmt_cp_remove_device *cp = data; 7747 int err; 7748 7749 bt_dev_dbg(hdev, "sock %p", sk); 7750 7751 hci_dev_lock(hdev); 7752 7753 if (bacmp(&cp->addr.bdaddr, BDADDR_ANY)) { 7754 struct hci_conn_params *params; 7755 u8 addr_type; 7756 7757 if (!bdaddr_type_is_valid(cp->addr.type)) { 7758 err = mgmt_cmd_complete(sk, hdev->id, 7759 MGMT_OP_REMOVE_DEVICE, 7760 MGMT_STATUS_INVALID_PARAMS, 7761 &cp->addr, sizeof(cp->addr)); 7762 goto unlock; 7763 } 7764 7765 if (cp->addr.type == BDADDR_BREDR) { 7766 err = hci_bdaddr_list_del(&hdev->accept_list, 7767 &cp->addr.bdaddr, 7768 cp->addr.type); 7769 if (err) { 7770 err = mgmt_cmd_complete(sk, hdev->id, 7771 MGMT_OP_REMOVE_DEVICE, 7772 MGMT_STATUS_INVALID_PARAMS, 7773 &cp->addr, 7774 sizeof(cp->addr)); 7775 goto unlock; 7776 } 7777 7778 hci_update_scan(hdev); 7779 7780 device_removed(sk, hdev, &cp->addr.bdaddr, 7781 cp->addr.type); 7782 goto complete; 7783 } 7784 7785 addr_type = le_addr_type(cp->addr.type); 7786 7787 /* Kernel internally uses conn_params with resolvable private 7788 * address, but Remove Device allows only identity addresses. 7789 * Make sure it is enforced before calling 7790 * hci_conn_params_lookup. 7791 */ 7792 if (!hci_is_identity_address(&cp->addr.bdaddr, addr_type)) { 7793 err = mgmt_cmd_complete(sk, hdev->id, 7794 MGMT_OP_REMOVE_DEVICE, 7795 MGMT_STATUS_INVALID_PARAMS, 7796 &cp->addr, sizeof(cp->addr)); 7797 goto unlock; 7798 } 7799 7800 params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr, 7801 addr_type); 7802 if (!params) { 7803 err = mgmt_cmd_complete(sk, hdev->id, 7804 MGMT_OP_REMOVE_DEVICE, 7805 MGMT_STATUS_INVALID_PARAMS, 7806 &cp->addr, sizeof(cp->addr)); 7807 goto unlock; 7808 } 7809 7810 if (params->auto_connect == HCI_AUTO_CONN_DISABLED || 7811 params->auto_connect == HCI_AUTO_CONN_EXPLICIT) { 7812 err = mgmt_cmd_complete(sk, hdev->id, 7813 MGMT_OP_REMOVE_DEVICE, 7814 MGMT_STATUS_INVALID_PARAMS, 7815 &cp->addr, sizeof(cp->addr)); 7816 goto unlock; 7817 } 7818 7819 hci_conn_params_free(params); 7820 7821 device_removed(sk, hdev, &cp->addr.bdaddr, cp->addr.type); 7822 } else { 7823 struct hci_conn_params *p, *tmp; 7824 struct bdaddr_list *b, *btmp; 7825 7826 if (cp->addr.type) { 7827 err = mgmt_cmd_complete(sk, hdev->id, 7828 MGMT_OP_REMOVE_DEVICE, 7829 MGMT_STATUS_INVALID_PARAMS, 7830 &cp->addr, sizeof(cp->addr)); 7831 goto unlock; 7832 } 7833 7834 list_for_each_entry_safe(b, btmp, &hdev->accept_list, list) { 7835 device_removed(sk, hdev, &b->bdaddr, b->bdaddr_type); 7836 list_del(&b->list); 7837 kfree(b); 7838 } 7839 7840 hci_update_scan(hdev); 7841 7842 list_for_each_entry_safe(p, tmp, &hdev->le_conn_params, list) { 7843 if (p->auto_connect == HCI_AUTO_CONN_DISABLED) 7844 continue; 7845 device_removed(sk, hdev, &p->addr, p->addr_type); 7846 if (p->explicit_connect) { 7847 p->auto_connect = HCI_AUTO_CONN_EXPLICIT; 7848 continue; 7849 } 7850 hci_conn_params_free(p); 7851 } 7852 7853 bt_dev_dbg(hdev, "All LE connection parameters were removed"); 7854 } 7855 7856 hci_cmd_sync_queue(hdev, remove_device_sync, NULL, NULL); 7857 7858 complete: 7859 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_DEVICE, 7860 MGMT_STATUS_SUCCESS, &cp->addr, 7861 sizeof(cp->addr)); 7862 unlock: 7863 hci_dev_unlock(hdev); 7864 return err; 7865 } 7866 7867 static int load_conn_param(struct sock *sk, struct hci_dev *hdev, void *data, 7868 u16 len) 7869 { 7870 struct mgmt_cp_load_conn_param *cp = data; 7871 const u16 max_param_count = ((U16_MAX - sizeof(*cp)) / 7872 sizeof(struct mgmt_conn_param)); 7873 u16 param_count, expected_len; 7874 int i; 7875 7876 if (!lmp_le_capable(hdev)) 7877 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM, 7878 MGMT_STATUS_NOT_SUPPORTED); 7879 7880 param_count = __le16_to_cpu(cp->param_count); 7881 if (param_count > max_param_count) { 7882 bt_dev_err(hdev, "load_conn_param: too big param_count value %u", 7883 param_count); 7884 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM, 7885 MGMT_STATUS_INVALID_PARAMS); 7886 } 7887 7888 expected_len = struct_size(cp, params, param_count); 7889 if (expected_len != len) { 7890 bt_dev_err(hdev, "load_conn_param: expected %u bytes, got %u bytes", 7891 expected_len, len); 7892 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM, 7893 MGMT_STATUS_INVALID_PARAMS); 7894 } 7895 7896 bt_dev_dbg(hdev, "param_count %u", param_count); 7897 7898 hci_dev_lock(hdev); 7899 7900 hci_conn_params_clear_disabled(hdev); 7901 7902 for (i = 0; i < param_count; i++) { 7903 struct mgmt_conn_param *param = &cp->params[i]; 7904 struct hci_conn_params *hci_param; 7905 u16 min, max, latency, timeout; 7906 u8 addr_type; 7907 7908 bt_dev_dbg(hdev, "Adding %pMR (type %u)", ¶m->addr.bdaddr, 7909 param->addr.type); 7910 7911 if (param->addr.type == BDADDR_LE_PUBLIC) { 7912 addr_type = ADDR_LE_DEV_PUBLIC; 7913 } else if (param->addr.type == BDADDR_LE_RANDOM) { 7914 addr_type = ADDR_LE_DEV_RANDOM; 7915 } else { 7916 bt_dev_err(hdev, "ignoring invalid connection parameters"); 7917 continue; 7918 } 7919 7920 min = le16_to_cpu(param->min_interval); 7921 max = le16_to_cpu(param->max_interval); 7922 latency = le16_to_cpu(param->latency); 7923 timeout = le16_to_cpu(param->timeout); 7924 7925 bt_dev_dbg(hdev, "min 0x%04x max 0x%04x latency 0x%04x timeout 0x%04x", 7926 min, max, latency, timeout); 7927 7928 if (hci_check_conn_params(min, max, latency, timeout) < 0) { 7929 bt_dev_err(hdev, "ignoring invalid connection parameters"); 7930 continue; 7931 } 7932 7933 hci_param = hci_conn_params_add(hdev, ¶m->addr.bdaddr, 7934 addr_type); 7935 if (!hci_param) { 7936 bt_dev_err(hdev, "failed to add connection parameters"); 7937 continue; 7938 } 7939 7940 hci_param->conn_min_interval = min; 7941 hci_param->conn_max_interval = max; 7942 hci_param->conn_latency = latency; 7943 hci_param->supervision_timeout = timeout; 7944 } 7945 7946 hci_dev_unlock(hdev); 7947 7948 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM, 0, 7949 NULL, 0); 7950 } 7951 7952 static int set_external_config(struct sock *sk, struct hci_dev *hdev, 7953 void *data, u16 len) 7954 { 7955 struct mgmt_cp_set_external_config *cp = data; 7956 bool changed; 7957 int err; 7958 7959 bt_dev_dbg(hdev, "sock %p", sk); 7960 7961 if (hdev_is_powered(hdev)) 7962 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_EXTERNAL_CONFIG, 7963 MGMT_STATUS_REJECTED); 7964 7965 if (cp->config != 0x00 && cp->config != 0x01) 7966 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_EXTERNAL_CONFIG, 7967 MGMT_STATUS_INVALID_PARAMS); 7968 7969 if (!test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks)) 7970 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_EXTERNAL_CONFIG, 7971 MGMT_STATUS_NOT_SUPPORTED); 7972 7973 hci_dev_lock(hdev); 7974 7975 if (cp->config) 7976 changed = !hci_dev_test_and_set_flag(hdev, HCI_EXT_CONFIGURED); 7977 else 7978 changed = hci_dev_test_and_clear_flag(hdev, HCI_EXT_CONFIGURED); 7979 7980 err = send_options_rsp(sk, MGMT_OP_SET_EXTERNAL_CONFIG, hdev); 7981 if (err < 0) 7982 goto unlock; 7983 7984 if (!changed) 7985 goto unlock; 7986 7987 err = new_options(hdev, sk); 7988 7989 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED) == is_configured(hdev)) { 7990 mgmt_index_removed(hdev); 7991 7992 if (hci_dev_test_and_change_flag(hdev, HCI_UNCONFIGURED)) { 7993 hci_dev_set_flag(hdev, HCI_CONFIG); 7994 hci_dev_set_flag(hdev, HCI_AUTO_OFF); 7995 7996 queue_work(hdev->req_workqueue, &hdev->power_on); 7997 } else { 7998 set_bit(HCI_RAW, &hdev->flags); 7999 mgmt_index_added(hdev); 8000 } 8001 } 8002 8003 unlock: 8004 hci_dev_unlock(hdev); 8005 return err; 8006 } 8007 8008 static int set_public_address(struct sock *sk, struct hci_dev *hdev, 8009 void *data, u16 len) 8010 { 8011 struct mgmt_cp_set_public_address *cp = data; 8012 bool changed; 8013 int err; 8014 8015 bt_dev_dbg(hdev, "sock %p", sk); 8016 8017 if (hdev_is_powered(hdev)) 8018 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PUBLIC_ADDRESS, 8019 MGMT_STATUS_REJECTED); 8020 8021 if (!bacmp(&cp->bdaddr, BDADDR_ANY)) 8022 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PUBLIC_ADDRESS, 8023 MGMT_STATUS_INVALID_PARAMS); 8024 8025 if (!hdev->set_bdaddr) 8026 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PUBLIC_ADDRESS, 8027 MGMT_STATUS_NOT_SUPPORTED); 8028 8029 hci_dev_lock(hdev); 8030 8031 changed = !!bacmp(&hdev->public_addr, &cp->bdaddr); 8032 bacpy(&hdev->public_addr, &cp->bdaddr); 8033 8034 err = send_options_rsp(sk, MGMT_OP_SET_PUBLIC_ADDRESS, hdev); 8035 if (err < 0) 8036 goto unlock; 8037 8038 if (!changed) 8039 goto unlock; 8040 8041 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) 8042 err = new_options(hdev, sk); 8043 8044 if (is_configured(hdev)) { 8045 mgmt_index_removed(hdev); 8046 8047 hci_dev_clear_flag(hdev, HCI_UNCONFIGURED); 8048 8049 hci_dev_set_flag(hdev, HCI_CONFIG); 8050 hci_dev_set_flag(hdev, HCI_AUTO_OFF); 8051 8052 queue_work(hdev->req_workqueue, &hdev->power_on); 8053 } 8054 8055 unlock: 8056 hci_dev_unlock(hdev); 8057 return err; 8058 } 8059 8060 static void read_local_oob_ext_data_complete(struct hci_dev *hdev, void *data, 8061 int err) 8062 { 8063 const struct mgmt_cp_read_local_oob_ext_data *mgmt_cp; 8064 struct mgmt_rp_read_local_oob_ext_data *mgmt_rp; 8065 u8 *h192, *r192, *h256, *r256; 8066 struct mgmt_pending_cmd *cmd = data; 8067 struct sk_buff *skb = cmd->skb; 8068 u8 status = mgmt_status(err); 8069 u16 eir_len; 8070 8071 if (cmd != pending_find(MGMT_OP_READ_LOCAL_OOB_EXT_DATA, hdev)) 8072 return; 8073 8074 if (!status) { 8075 if (!skb) 8076 status = MGMT_STATUS_FAILED; 8077 else if (IS_ERR(skb)) 8078 status = mgmt_status(PTR_ERR(skb)); 8079 else 8080 status = mgmt_status(skb->data[0]); 8081 } 8082 8083 bt_dev_dbg(hdev, "status %u", status); 8084 8085 mgmt_cp = cmd->param; 8086 8087 if (status) { 8088 status = mgmt_status(status); 8089 eir_len = 0; 8090 8091 h192 = NULL; 8092 r192 = NULL; 8093 h256 = NULL; 8094 r256 = NULL; 8095 } else if (!bredr_sc_enabled(hdev)) { 8096 struct hci_rp_read_local_oob_data *rp; 8097 8098 if (skb->len != sizeof(*rp)) { 8099 status = MGMT_STATUS_FAILED; 8100 eir_len = 0; 8101 } else { 8102 status = MGMT_STATUS_SUCCESS; 8103 rp = (void *)skb->data; 8104 8105 eir_len = 5 + 18 + 18; 8106 h192 = rp->hash; 8107 r192 = rp->rand; 8108 h256 = NULL; 8109 r256 = NULL; 8110 } 8111 } else { 8112 struct hci_rp_read_local_oob_ext_data *rp; 8113 8114 if (skb->len != sizeof(*rp)) { 8115 status = MGMT_STATUS_FAILED; 8116 eir_len = 0; 8117 } else { 8118 status = MGMT_STATUS_SUCCESS; 8119 rp = (void *)skb->data; 8120 8121 if (hci_dev_test_flag(hdev, HCI_SC_ONLY)) { 8122 eir_len = 5 + 18 + 18; 8123 h192 = NULL; 8124 r192 = NULL; 8125 } else { 8126 eir_len = 5 + 18 + 18 + 18 + 18; 8127 h192 = rp->hash192; 8128 r192 = rp->rand192; 8129 } 8130 8131 h256 = rp->hash256; 8132 r256 = rp->rand256; 8133 } 8134 } 8135 8136 mgmt_rp = kmalloc(sizeof(*mgmt_rp) + eir_len, GFP_KERNEL); 8137 if (!mgmt_rp) 8138 goto done; 8139 8140 if (eir_len == 0) 8141 goto send_rsp; 8142 8143 eir_len = eir_append_data(mgmt_rp->eir, 0, EIR_CLASS_OF_DEV, 8144 hdev->dev_class, 3); 8145 8146 if (h192 && r192) { 8147 eir_len = eir_append_data(mgmt_rp->eir, eir_len, 8148 EIR_SSP_HASH_C192, h192, 16); 8149 eir_len = eir_append_data(mgmt_rp->eir, eir_len, 8150 EIR_SSP_RAND_R192, r192, 16); 8151 } 8152 8153 if (h256 && r256) { 8154 eir_len = eir_append_data(mgmt_rp->eir, eir_len, 8155 EIR_SSP_HASH_C256, h256, 16); 8156 eir_len = eir_append_data(mgmt_rp->eir, eir_len, 8157 EIR_SSP_RAND_R256, r256, 16); 8158 } 8159 8160 send_rsp: 8161 mgmt_rp->type = mgmt_cp->type; 8162 mgmt_rp->eir_len = cpu_to_le16(eir_len); 8163 8164 err = mgmt_cmd_complete(cmd->sk, hdev->id, 8165 MGMT_OP_READ_LOCAL_OOB_EXT_DATA, status, 8166 mgmt_rp, sizeof(*mgmt_rp) + eir_len); 8167 if (err < 0 || status) 8168 goto done; 8169 8170 hci_sock_set_flag(cmd->sk, HCI_MGMT_OOB_DATA_EVENTS); 8171 8172 err = mgmt_limited_event(MGMT_EV_LOCAL_OOB_DATA_UPDATED, hdev, 8173 mgmt_rp, sizeof(*mgmt_rp) + eir_len, 8174 HCI_MGMT_OOB_DATA_EVENTS, cmd->sk); 8175 done: 8176 if (skb && !IS_ERR(skb)) 8177 kfree_skb(skb); 8178 8179 kfree(mgmt_rp); 8180 mgmt_pending_remove(cmd); 8181 } 8182 8183 static int read_local_ssp_oob_req(struct hci_dev *hdev, struct sock *sk, 8184 struct mgmt_cp_read_local_oob_ext_data *cp) 8185 { 8186 struct mgmt_pending_cmd *cmd; 8187 int err; 8188 8189 cmd = mgmt_pending_add(sk, MGMT_OP_READ_LOCAL_OOB_EXT_DATA, hdev, 8190 cp, sizeof(*cp)); 8191 if (!cmd) 8192 return -ENOMEM; 8193 8194 err = hci_cmd_sync_queue(hdev, read_local_oob_data_sync, cmd, 8195 read_local_oob_ext_data_complete); 8196 8197 if (err < 0) { 8198 mgmt_pending_remove(cmd); 8199 return err; 8200 } 8201 8202 return 0; 8203 } 8204 8205 static int read_local_oob_ext_data(struct sock *sk, struct hci_dev *hdev, 8206 void *data, u16 data_len) 8207 { 8208 struct mgmt_cp_read_local_oob_ext_data *cp = data; 8209 struct mgmt_rp_read_local_oob_ext_data *rp; 8210 size_t rp_len; 8211 u16 eir_len; 8212 u8 status, flags, role, addr[7], hash[16], rand[16]; 8213 int err; 8214 8215 bt_dev_dbg(hdev, "sock %p", sk); 8216 8217 if (hdev_is_powered(hdev)) { 8218 switch (cp->type) { 8219 case BIT(BDADDR_BREDR): 8220 status = mgmt_bredr_support(hdev); 8221 if (status) 8222 eir_len = 0; 8223 else 8224 eir_len = 5; 8225 break; 8226 case (BIT(BDADDR_LE_PUBLIC) | BIT(BDADDR_LE_RANDOM)): 8227 status = mgmt_le_support(hdev); 8228 if (status) 8229 eir_len = 0; 8230 else 8231 eir_len = 9 + 3 + 18 + 18 + 3; 8232 break; 8233 default: 8234 status = MGMT_STATUS_INVALID_PARAMS; 8235 eir_len = 0; 8236 break; 8237 } 8238 } else { 8239 status = MGMT_STATUS_NOT_POWERED; 8240 eir_len = 0; 8241 } 8242 8243 rp_len = sizeof(*rp) + eir_len; 8244 rp = kmalloc(rp_len, GFP_ATOMIC); 8245 if (!rp) 8246 return -ENOMEM; 8247 8248 if (!status && !lmp_ssp_capable(hdev)) { 8249 status = MGMT_STATUS_NOT_SUPPORTED; 8250 eir_len = 0; 8251 } 8252 8253 if (status) 8254 goto complete; 8255 8256 hci_dev_lock(hdev); 8257 8258 eir_len = 0; 8259 switch (cp->type) { 8260 case BIT(BDADDR_BREDR): 8261 if (hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) { 8262 err = read_local_ssp_oob_req(hdev, sk, cp); 8263 hci_dev_unlock(hdev); 8264 if (!err) 8265 goto done; 8266 8267 status = MGMT_STATUS_FAILED; 8268 goto complete; 8269 } else { 8270 eir_len = eir_append_data(rp->eir, eir_len, 8271 EIR_CLASS_OF_DEV, 8272 hdev->dev_class, 3); 8273 } 8274 break; 8275 case (BIT(BDADDR_LE_PUBLIC) | BIT(BDADDR_LE_RANDOM)): 8276 if (hci_dev_test_flag(hdev, HCI_SC_ENABLED) && 8277 smp_generate_oob(hdev, hash, rand) < 0) { 8278 hci_dev_unlock(hdev); 8279 status = MGMT_STATUS_FAILED; 8280 goto complete; 8281 } 8282 8283 /* This should return the active RPA, but since the RPA 8284 * is only programmed on demand, it is really hard to fill 8285 * this in at the moment. For now disallow retrieving 8286 * local out-of-band data when privacy is in use. 8287 * 8288 * Returning the identity address will not help here since 8289 * pairing happens before the identity resolving key is 8290 * known and thus the connection establishment happens 8291 * based on the RPA and not the identity address. 8292 */ 8293 if (hci_dev_test_flag(hdev, HCI_PRIVACY)) { 8294 hci_dev_unlock(hdev); 8295 status = MGMT_STATUS_REJECTED; 8296 goto complete; 8297 } 8298 8299 if (hci_dev_test_flag(hdev, HCI_FORCE_STATIC_ADDR) || 8300 !bacmp(&hdev->bdaddr, BDADDR_ANY) || 8301 (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) && 8302 bacmp(&hdev->static_addr, BDADDR_ANY))) { 8303 memcpy(addr, &hdev->static_addr, 6); 8304 addr[6] = 0x01; 8305 } else { 8306 memcpy(addr, &hdev->bdaddr, 6); 8307 addr[6] = 0x00; 8308 } 8309 8310 eir_len = eir_append_data(rp->eir, eir_len, EIR_LE_BDADDR, 8311 addr, sizeof(addr)); 8312 8313 if (hci_dev_test_flag(hdev, HCI_ADVERTISING)) 8314 role = 0x02; 8315 else 8316 role = 0x01; 8317 8318 eir_len = eir_append_data(rp->eir, eir_len, EIR_LE_ROLE, 8319 &role, sizeof(role)); 8320 8321 if (hci_dev_test_flag(hdev, HCI_SC_ENABLED)) { 8322 eir_len = eir_append_data(rp->eir, eir_len, 8323 EIR_LE_SC_CONFIRM, 8324 hash, sizeof(hash)); 8325 8326 eir_len = eir_append_data(rp->eir, eir_len, 8327 EIR_LE_SC_RANDOM, 8328 rand, sizeof(rand)); 8329 } 8330 8331 flags = mgmt_get_adv_discov_flags(hdev); 8332 8333 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) 8334 flags |= LE_AD_NO_BREDR; 8335 8336 eir_len = eir_append_data(rp->eir, eir_len, EIR_FLAGS, 8337 &flags, sizeof(flags)); 8338 break; 8339 } 8340 8341 hci_dev_unlock(hdev); 8342 8343 hci_sock_set_flag(sk, HCI_MGMT_OOB_DATA_EVENTS); 8344 8345 status = MGMT_STATUS_SUCCESS; 8346 8347 complete: 8348 rp->type = cp->type; 8349 rp->eir_len = cpu_to_le16(eir_len); 8350 8351 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_EXT_DATA, 8352 status, rp, sizeof(*rp) + eir_len); 8353 if (err < 0 || status) 8354 goto done; 8355 8356 err = mgmt_limited_event(MGMT_EV_LOCAL_OOB_DATA_UPDATED, hdev, 8357 rp, sizeof(*rp) + eir_len, 8358 HCI_MGMT_OOB_DATA_EVENTS, sk); 8359 8360 done: 8361 kfree(rp); 8362 8363 return err; 8364 } 8365 8366 static u32 get_supported_adv_flags(struct hci_dev *hdev) 8367 { 8368 u32 flags = 0; 8369 8370 flags |= MGMT_ADV_FLAG_CONNECTABLE; 8371 flags |= MGMT_ADV_FLAG_DISCOV; 8372 flags |= MGMT_ADV_FLAG_LIMITED_DISCOV; 8373 flags |= MGMT_ADV_FLAG_MANAGED_FLAGS; 8374 flags |= MGMT_ADV_FLAG_APPEARANCE; 8375 flags |= MGMT_ADV_FLAG_LOCAL_NAME; 8376 flags |= MGMT_ADV_PARAM_DURATION; 8377 flags |= MGMT_ADV_PARAM_TIMEOUT; 8378 flags |= MGMT_ADV_PARAM_INTERVALS; 8379 flags |= MGMT_ADV_PARAM_TX_POWER; 8380 flags |= MGMT_ADV_PARAM_SCAN_RSP; 8381 8382 /* In extended adv TX_POWER returned from Set Adv Param 8383 * will be always valid. 8384 */ 8385 if (hdev->adv_tx_power != HCI_TX_POWER_INVALID || ext_adv_capable(hdev)) 8386 flags |= MGMT_ADV_FLAG_TX_POWER; 8387 8388 if (ext_adv_capable(hdev)) { 8389 flags |= MGMT_ADV_FLAG_SEC_1M; 8390 flags |= MGMT_ADV_FLAG_HW_OFFLOAD; 8391 flags |= MGMT_ADV_FLAG_CAN_SET_TX_POWER; 8392 8393 if (le_2m_capable(hdev)) 8394 flags |= MGMT_ADV_FLAG_SEC_2M; 8395 8396 if (le_coded_capable(hdev)) 8397 flags |= MGMT_ADV_FLAG_SEC_CODED; 8398 } 8399 8400 return flags; 8401 } 8402 8403 static int read_adv_features(struct sock *sk, struct hci_dev *hdev, 8404 void *data, u16 data_len) 8405 { 8406 struct mgmt_rp_read_adv_features *rp; 8407 size_t rp_len; 8408 int err; 8409 struct adv_info *adv_instance; 8410 u32 supported_flags; 8411 u8 *instance; 8412 8413 bt_dev_dbg(hdev, "sock %p", sk); 8414 8415 if (!lmp_le_capable(hdev)) 8416 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_ADV_FEATURES, 8417 MGMT_STATUS_REJECTED); 8418 8419 hci_dev_lock(hdev); 8420 8421 rp_len = sizeof(*rp) + hdev->adv_instance_cnt; 8422 rp = kmalloc(rp_len, GFP_ATOMIC); 8423 if (!rp) { 8424 hci_dev_unlock(hdev); 8425 return -ENOMEM; 8426 } 8427 8428 supported_flags = get_supported_adv_flags(hdev); 8429 8430 rp->supported_flags = cpu_to_le32(supported_flags); 8431 rp->max_adv_data_len = max_adv_len(hdev); 8432 rp->max_scan_rsp_len = max_adv_len(hdev); 8433 rp->max_instances = hdev->le_num_of_adv_sets; 8434 rp->num_instances = hdev->adv_instance_cnt; 8435 8436 instance = rp->instance; 8437 list_for_each_entry(adv_instance, &hdev->adv_instances, list) { 8438 /* Only instances 1-le_num_of_adv_sets are externally visible */ 8439 if (adv_instance->instance <= hdev->adv_instance_cnt) { 8440 *instance = adv_instance->instance; 8441 instance++; 8442 } else { 8443 rp->num_instances--; 8444 rp_len--; 8445 } 8446 } 8447 8448 hci_dev_unlock(hdev); 8449 8450 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_ADV_FEATURES, 8451 MGMT_STATUS_SUCCESS, rp, rp_len); 8452 8453 kfree(rp); 8454 8455 return err; 8456 } 8457 8458 static u8 calculate_name_len(struct hci_dev *hdev) 8459 { 8460 u8 buf[HCI_MAX_SHORT_NAME_LENGTH + 3]; 8461 8462 return eir_append_local_name(hdev, buf, 0); 8463 } 8464 8465 static u8 tlv_data_max_len(struct hci_dev *hdev, u32 adv_flags, 8466 bool is_adv_data) 8467 { 8468 u8 max_len = max_adv_len(hdev); 8469 8470 if (is_adv_data) { 8471 if (adv_flags & (MGMT_ADV_FLAG_DISCOV | 8472 MGMT_ADV_FLAG_LIMITED_DISCOV | 8473 MGMT_ADV_FLAG_MANAGED_FLAGS)) 8474 max_len -= 3; 8475 8476 if (adv_flags & MGMT_ADV_FLAG_TX_POWER) 8477 max_len -= 3; 8478 } else { 8479 if (adv_flags & MGMT_ADV_FLAG_LOCAL_NAME) 8480 max_len -= calculate_name_len(hdev); 8481 8482 if (adv_flags & (MGMT_ADV_FLAG_APPEARANCE)) 8483 max_len -= 4; 8484 } 8485 8486 return max_len; 8487 } 8488 8489 static bool flags_managed(u32 adv_flags) 8490 { 8491 return adv_flags & (MGMT_ADV_FLAG_DISCOV | 8492 MGMT_ADV_FLAG_LIMITED_DISCOV | 8493 MGMT_ADV_FLAG_MANAGED_FLAGS); 8494 } 8495 8496 static bool tx_power_managed(u32 adv_flags) 8497 { 8498 return adv_flags & MGMT_ADV_FLAG_TX_POWER; 8499 } 8500 8501 static bool name_managed(u32 adv_flags) 8502 { 8503 return adv_flags & MGMT_ADV_FLAG_LOCAL_NAME; 8504 } 8505 8506 static bool appearance_managed(u32 adv_flags) 8507 { 8508 return adv_flags & MGMT_ADV_FLAG_APPEARANCE; 8509 } 8510 8511 static bool tlv_data_is_valid(struct hci_dev *hdev, u32 adv_flags, u8 *data, 8512 u8 len, bool is_adv_data) 8513 { 8514 int i, cur_len; 8515 u8 max_len; 8516 8517 max_len = tlv_data_max_len(hdev, adv_flags, is_adv_data); 8518 8519 if (len > max_len) 8520 return false; 8521 8522 /* Make sure that the data is correctly formatted. */ 8523 for (i = 0; i < len; i += (cur_len + 1)) { 8524 cur_len = data[i]; 8525 8526 if (!cur_len) 8527 continue; 8528 8529 if (data[i + 1] == EIR_FLAGS && 8530 (!is_adv_data || flags_managed(adv_flags))) 8531 return false; 8532 8533 if (data[i + 1] == EIR_TX_POWER && tx_power_managed(adv_flags)) 8534 return false; 8535 8536 if (data[i + 1] == EIR_NAME_COMPLETE && name_managed(adv_flags)) 8537 return false; 8538 8539 if (data[i + 1] == EIR_NAME_SHORT && name_managed(adv_flags)) 8540 return false; 8541 8542 if (data[i + 1] == EIR_APPEARANCE && 8543 appearance_managed(adv_flags)) 8544 return false; 8545 8546 /* If the current field length would exceed the total data 8547 * length, then it's invalid. 8548 */ 8549 if (i + cur_len >= len) 8550 return false; 8551 } 8552 8553 return true; 8554 } 8555 8556 static bool requested_adv_flags_are_valid(struct hci_dev *hdev, u32 adv_flags) 8557 { 8558 u32 supported_flags, phy_flags; 8559 8560 /* The current implementation only supports a subset of the specified 8561 * flags. Also need to check mutual exclusiveness of sec flags. 8562 */ 8563 supported_flags = get_supported_adv_flags(hdev); 8564 phy_flags = adv_flags & MGMT_ADV_FLAG_SEC_MASK; 8565 if (adv_flags & ~supported_flags || 8566 ((phy_flags && (phy_flags ^ (phy_flags & -phy_flags))))) 8567 return false; 8568 8569 return true; 8570 } 8571 8572 static bool adv_busy(struct hci_dev *hdev) 8573 { 8574 return pending_find(MGMT_OP_SET_LE, hdev); 8575 } 8576 8577 static void add_adv_complete(struct hci_dev *hdev, struct sock *sk, u8 instance, 8578 int err) 8579 { 8580 struct adv_info *adv, *n; 8581 8582 bt_dev_dbg(hdev, "err %d", err); 8583 8584 hci_dev_lock(hdev); 8585 8586 list_for_each_entry_safe(adv, n, &hdev->adv_instances, list) { 8587 u8 instance; 8588 8589 if (!adv->pending) 8590 continue; 8591 8592 if (!err) { 8593 adv->pending = false; 8594 continue; 8595 } 8596 8597 instance = adv->instance; 8598 8599 if (hdev->cur_adv_instance == instance) 8600 cancel_adv_timeout(hdev); 8601 8602 hci_remove_adv_instance(hdev, instance); 8603 mgmt_advertising_removed(sk, hdev, instance); 8604 } 8605 8606 hci_dev_unlock(hdev); 8607 } 8608 8609 static void add_advertising_complete(struct hci_dev *hdev, void *data, int err) 8610 { 8611 struct mgmt_pending_cmd *cmd = data; 8612 struct mgmt_cp_add_advertising *cp = cmd->param; 8613 struct mgmt_rp_add_advertising rp; 8614 8615 memset(&rp, 0, sizeof(rp)); 8616 8617 rp.instance = cp->instance; 8618 8619 if (err) 8620 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, 8621 mgmt_status(err)); 8622 else 8623 mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, 8624 mgmt_status(err), &rp, sizeof(rp)); 8625 8626 add_adv_complete(hdev, cmd->sk, cp->instance, err); 8627 8628 mgmt_pending_free(cmd); 8629 } 8630 8631 static int add_advertising_sync(struct hci_dev *hdev, void *data) 8632 { 8633 struct mgmt_pending_cmd *cmd = data; 8634 struct mgmt_cp_add_advertising *cp = cmd->param; 8635 8636 return hci_schedule_adv_instance_sync(hdev, cp->instance, true); 8637 } 8638 8639 static int add_advertising(struct sock *sk, struct hci_dev *hdev, 8640 void *data, u16 data_len) 8641 { 8642 struct mgmt_cp_add_advertising *cp = data; 8643 struct mgmt_rp_add_advertising rp; 8644 u32 flags; 8645 u8 status; 8646 u16 timeout, duration; 8647 unsigned int prev_instance_cnt; 8648 u8 schedule_instance = 0; 8649 struct adv_info *adv, *next_instance; 8650 int err; 8651 struct mgmt_pending_cmd *cmd; 8652 8653 bt_dev_dbg(hdev, "sock %p", sk); 8654 8655 status = mgmt_le_support(hdev); 8656 if (status) 8657 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING, 8658 status); 8659 8660 if (cp->instance < 1 || cp->instance > hdev->le_num_of_adv_sets) 8661 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING, 8662 MGMT_STATUS_INVALID_PARAMS); 8663 8664 if (data_len != sizeof(*cp) + cp->adv_data_len + cp->scan_rsp_len) 8665 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING, 8666 MGMT_STATUS_INVALID_PARAMS); 8667 8668 flags = __le32_to_cpu(cp->flags); 8669 timeout = __le16_to_cpu(cp->timeout); 8670 duration = __le16_to_cpu(cp->duration); 8671 8672 if (!requested_adv_flags_are_valid(hdev, flags)) 8673 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING, 8674 MGMT_STATUS_INVALID_PARAMS); 8675 8676 hci_dev_lock(hdev); 8677 8678 if (timeout && !hdev_is_powered(hdev)) { 8679 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING, 8680 MGMT_STATUS_REJECTED); 8681 goto unlock; 8682 } 8683 8684 if (adv_busy(hdev)) { 8685 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING, 8686 MGMT_STATUS_BUSY); 8687 goto unlock; 8688 } 8689 8690 if (!tlv_data_is_valid(hdev, flags, cp->data, cp->adv_data_len, true) || 8691 !tlv_data_is_valid(hdev, flags, cp->data + cp->adv_data_len, 8692 cp->scan_rsp_len, false)) { 8693 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING, 8694 MGMT_STATUS_INVALID_PARAMS); 8695 goto unlock; 8696 } 8697 8698 prev_instance_cnt = hdev->adv_instance_cnt; 8699 8700 adv = hci_add_adv_instance(hdev, cp->instance, flags, 8701 cp->adv_data_len, cp->data, 8702 cp->scan_rsp_len, 8703 cp->data + cp->adv_data_len, 8704 timeout, duration, 8705 HCI_ADV_TX_POWER_NO_PREFERENCE, 8706 hdev->le_adv_min_interval, 8707 hdev->le_adv_max_interval, 0); 8708 if (IS_ERR(adv)) { 8709 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING, 8710 MGMT_STATUS_FAILED); 8711 goto unlock; 8712 } 8713 8714 /* Only trigger an advertising added event if a new instance was 8715 * actually added. 8716 */ 8717 if (hdev->adv_instance_cnt > prev_instance_cnt) 8718 mgmt_advertising_added(sk, hdev, cp->instance); 8719 8720 if (hdev->cur_adv_instance == cp->instance) { 8721 /* If the currently advertised instance is being changed then 8722 * cancel the current advertising and schedule the next 8723 * instance. If there is only one instance then the overridden 8724 * advertising data will be visible right away. 8725 */ 8726 cancel_adv_timeout(hdev); 8727 8728 next_instance = hci_get_next_instance(hdev, cp->instance); 8729 if (next_instance) 8730 schedule_instance = next_instance->instance; 8731 } else if (!hdev->adv_instance_timeout) { 8732 /* Immediately advertise the new instance if no other 8733 * instance is currently being advertised. 8734 */ 8735 schedule_instance = cp->instance; 8736 } 8737 8738 /* If the HCI_ADVERTISING flag is set or the device isn't powered or 8739 * there is no instance to be advertised then we have no HCI 8740 * communication to make. Simply return. 8741 */ 8742 if (!hdev_is_powered(hdev) || 8743 hci_dev_test_flag(hdev, HCI_ADVERTISING) || 8744 !schedule_instance) { 8745 rp.instance = cp->instance; 8746 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_ADVERTISING, 8747 MGMT_STATUS_SUCCESS, &rp, sizeof(rp)); 8748 goto unlock; 8749 } 8750 8751 /* We're good to go, update advertising data, parameters, and start 8752 * advertising. 8753 */ 8754 cmd = mgmt_pending_new(sk, MGMT_OP_ADD_ADVERTISING, hdev, data, 8755 data_len); 8756 if (!cmd) { 8757 err = -ENOMEM; 8758 goto unlock; 8759 } 8760 8761 cp->instance = schedule_instance; 8762 8763 err = hci_cmd_sync_queue(hdev, add_advertising_sync, cmd, 8764 add_advertising_complete); 8765 if (err < 0) 8766 mgmt_pending_free(cmd); 8767 8768 unlock: 8769 hci_dev_unlock(hdev); 8770 8771 return err; 8772 } 8773 8774 static void add_ext_adv_params_complete(struct hci_dev *hdev, void *data, 8775 int err) 8776 { 8777 struct mgmt_pending_cmd *cmd = data; 8778 struct mgmt_cp_add_ext_adv_params *cp = cmd->param; 8779 struct mgmt_rp_add_ext_adv_params rp; 8780 struct adv_info *adv; 8781 u32 flags; 8782 8783 BT_DBG("%s", hdev->name); 8784 8785 hci_dev_lock(hdev); 8786 8787 adv = hci_find_adv_instance(hdev, cp->instance); 8788 if (!adv) 8789 goto unlock; 8790 8791 rp.instance = cp->instance; 8792 rp.tx_power = adv->tx_power; 8793 8794 /* While we're at it, inform userspace of the available space for this 8795 * advertisement, given the flags that will be used. 8796 */ 8797 flags = __le32_to_cpu(cp->flags); 8798 rp.max_adv_data_len = tlv_data_max_len(hdev, flags, true); 8799 rp.max_scan_rsp_len = tlv_data_max_len(hdev, flags, false); 8800 8801 if (err) { 8802 /* If this advertisement was previously advertising and we 8803 * failed to update it, we signal that it has been removed and 8804 * delete its structure 8805 */ 8806 if (!adv->pending) 8807 mgmt_advertising_removed(cmd->sk, hdev, cp->instance); 8808 8809 hci_remove_adv_instance(hdev, cp->instance); 8810 8811 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, 8812 mgmt_status(err)); 8813 } else { 8814 mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, 8815 mgmt_status(err), &rp, sizeof(rp)); 8816 } 8817 8818 unlock: 8819 if (cmd) 8820 mgmt_pending_free(cmd); 8821 8822 hci_dev_unlock(hdev); 8823 } 8824 8825 static int add_ext_adv_params_sync(struct hci_dev *hdev, void *data) 8826 { 8827 struct mgmt_pending_cmd *cmd = data; 8828 struct mgmt_cp_add_ext_adv_params *cp = cmd->param; 8829 8830 return hci_setup_ext_adv_instance_sync(hdev, cp->instance); 8831 } 8832 8833 static int add_ext_adv_params(struct sock *sk, struct hci_dev *hdev, 8834 void *data, u16 data_len) 8835 { 8836 struct mgmt_cp_add_ext_adv_params *cp = data; 8837 struct mgmt_rp_add_ext_adv_params rp; 8838 struct mgmt_pending_cmd *cmd = NULL; 8839 struct adv_info *adv; 8840 u32 flags, min_interval, max_interval; 8841 u16 timeout, duration; 8842 u8 status; 8843 s8 tx_power; 8844 int err; 8845 8846 BT_DBG("%s", hdev->name); 8847 8848 status = mgmt_le_support(hdev); 8849 if (status) 8850 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_PARAMS, 8851 status); 8852 8853 if (cp->instance < 1 || cp->instance > hdev->le_num_of_adv_sets) 8854 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_PARAMS, 8855 MGMT_STATUS_INVALID_PARAMS); 8856 8857 /* The purpose of breaking add_advertising into two separate MGMT calls 8858 * for params and data is to allow more parameters to be added to this 8859 * structure in the future. For this reason, we verify that we have the 8860 * bare minimum structure we know of when the interface was defined. Any 8861 * extra parameters we don't know about will be ignored in this request. 8862 */ 8863 if (data_len < MGMT_ADD_EXT_ADV_PARAMS_MIN_SIZE) 8864 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_PARAMS, 8865 MGMT_STATUS_INVALID_PARAMS); 8866 8867 flags = __le32_to_cpu(cp->flags); 8868 8869 if (!requested_adv_flags_are_valid(hdev, flags)) 8870 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_PARAMS, 8871 MGMT_STATUS_INVALID_PARAMS); 8872 8873 hci_dev_lock(hdev); 8874 8875 /* In new interface, we require that we are powered to register */ 8876 if (!hdev_is_powered(hdev)) { 8877 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_PARAMS, 8878 MGMT_STATUS_REJECTED); 8879 goto unlock; 8880 } 8881 8882 if (adv_busy(hdev)) { 8883 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_PARAMS, 8884 MGMT_STATUS_BUSY); 8885 goto unlock; 8886 } 8887 8888 /* Parse defined parameters from request, use defaults otherwise */ 8889 timeout = (flags & MGMT_ADV_PARAM_TIMEOUT) ? 8890 __le16_to_cpu(cp->timeout) : 0; 8891 8892 duration = (flags & MGMT_ADV_PARAM_DURATION) ? 8893 __le16_to_cpu(cp->duration) : 8894 hdev->def_multi_adv_rotation_duration; 8895 8896 min_interval = (flags & MGMT_ADV_PARAM_INTERVALS) ? 8897 __le32_to_cpu(cp->min_interval) : 8898 hdev->le_adv_min_interval; 8899 8900 max_interval = (flags & MGMT_ADV_PARAM_INTERVALS) ? 8901 __le32_to_cpu(cp->max_interval) : 8902 hdev->le_adv_max_interval; 8903 8904 tx_power = (flags & MGMT_ADV_PARAM_TX_POWER) ? 8905 cp->tx_power : 8906 HCI_ADV_TX_POWER_NO_PREFERENCE; 8907 8908 /* Create advertising instance with no advertising or response data */ 8909 adv = hci_add_adv_instance(hdev, cp->instance, flags, 0, NULL, 0, NULL, 8910 timeout, duration, tx_power, min_interval, 8911 max_interval, 0); 8912 8913 if (IS_ERR(adv)) { 8914 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_PARAMS, 8915 MGMT_STATUS_FAILED); 8916 goto unlock; 8917 } 8918 8919 /* Submit request for advertising params if ext adv available */ 8920 if (ext_adv_capable(hdev)) { 8921 cmd = mgmt_pending_new(sk, MGMT_OP_ADD_EXT_ADV_PARAMS, hdev, 8922 data, data_len); 8923 if (!cmd) { 8924 err = -ENOMEM; 8925 hci_remove_adv_instance(hdev, cp->instance); 8926 goto unlock; 8927 } 8928 8929 err = hci_cmd_sync_queue(hdev, add_ext_adv_params_sync, cmd, 8930 add_ext_adv_params_complete); 8931 if (err < 0) 8932 mgmt_pending_free(cmd); 8933 } else { 8934 rp.instance = cp->instance; 8935 rp.tx_power = HCI_ADV_TX_POWER_NO_PREFERENCE; 8936 rp.max_adv_data_len = tlv_data_max_len(hdev, flags, true); 8937 rp.max_scan_rsp_len = tlv_data_max_len(hdev, flags, false); 8938 err = mgmt_cmd_complete(sk, hdev->id, 8939 MGMT_OP_ADD_EXT_ADV_PARAMS, 8940 MGMT_STATUS_SUCCESS, &rp, sizeof(rp)); 8941 } 8942 8943 unlock: 8944 hci_dev_unlock(hdev); 8945 8946 return err; 8947 } 8948 8949 static void add_ext_adv_data_complete(struct hci_dev *hdev, void *data, int err) 8950 { 8951 struct mgmt_pending_cmd *cmd = data; 8952 struct mgmt_cp_add_ext_adv_data *cp = cmd->param; 8953 struct mgmt_rp_add_advertising rp; 8954 8955 add_adv_complete(hdev, cmd->sk, cp->instance, err); 8956 8957 memset(&rp, 0, sizeof(rp)); 8958 8959 rp.instance = cp->instance; 8960 8961 if (err) 8962 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, 8963 mgmt_status(err)); 8964 else 8965 mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, 8966 mgmt_status(err), &rp, sizeof(rp)); 8967 8968 mgmt_pending_free(cmd); 8969 } 8970 8971 static int add_ext_adv_data_sync(struct hci_dev *hdev, void *data) 8972 { 8973 struct mgmt_pending_cmd *cmd = data; 8974 struct mgmt_cp_add_ext_adv_data *cp = cmd->param; 8975 int err; 8976 8977 if (ext_adv_capable(hdev)) { 8978 err = hci_update_adv_data_sync(hdev, cp->instance); 8979 if (err) 8980 return err; 8981 8982 err = hci_update_scan_rsp_data_sync(hdev, cp->instance); 8983 if (err) 8984 return err; 8985 8986 return hci_enable_ext_advertising_sync(hdev, cp->instance); 8987 } 8988 8989 return hci_schedule_adv_instance_sync(hdev, cp->instance, true); 8990 } 8991 8992 static int add_ext_adv_data(struct sock *sk, struct hci_dev *hdev, void *data, 8993 u16 data_len) 8994 { 8995 struct mgmt_cp_add_ext_adv_data *cp = data; 8996 struct mgmt_rp_add_ext_adv_data rp; 8997 u8 schedule_instance = 0; 8998 struct adv_info *next_instance; 8999 struct adv_info *adv_instance; 9000 int err = 0; 9001 struct mgmt_pending_cmd *cmd; 9002 9003 BT_DBG("%s", hdev->name); 9004 9005 hci_dev_lock(hdev); 9006 9007 adv_instance = hci_find_adv_instance(hdev, cp->instance); 9008 9009 if (!adv_instance) { 9010 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_DATA, 9011 MGMT_STATUS_INVALID_PARAMS); 9012 goto unlock; 9013 } 9014 9015 /* In new interface, we require that we are powered to register */ 9016 if (!hdev_is_powered(hdev)) { 9017 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_DATA, 9018 MGMT_STATUS_REJECTED); 9019 goto clear_new_instance; 9020 } 9021 9022 if (adv_busy(hdev)) { 9023 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_DATA, 9024 MGMT_STATUS_BUSY); 9025 goto clear_new_instance; 9026 } 9027 9028 /* Validate new data */ 9029 if (!tlv_data_is_valid(hdev, adv_instance->flags, cp->data, 9030 cp->adv_data_len, true) || 9031 !tlv_data_is_valid(hdev, adv_instance->flags, cp->data + 9032 cp->adv_data_len, cp->scan_rsp_len, false)) { 9033 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_DATA, 9034 MGMT_STATUS_INVALID_PARAMS); 9035 goto clear_new_instance; 9036 } 9037 9038 /* Set the data in the advertising instance */ 9039 hci_set_adv_instance_data(hdev, cp->instance, cp->adv_data_len, 9040 cp->data, cp->scan_rsp_len, 9041 cp->data + cp->adv_data_len); 9042 9043 /* If using software rotation, determine next instance to use */ 9044 if (hdev->cur_adv_instance == cp->instance) { 9045 /* If the currently advertised instance is being changed 9046 * then cancel the current advertising and schedule the 9047 * next instance. If there is only one instance then the 9048 * overridden advertising data will be visible right 9049 * away 9050 */ 9051 cancel_adv_timeout(hdev); 9052 9053 next_instance = hci_get_next_instance(hdev, cp->instance); 9054 if (next_instance) 9055 schedule_instance = next_instance->instance; 9056 } else if (!hdev->adv_instance_timeout) { 9057 /* Immediately advertise the new instance if no other 9058 * instance is currently being advertised. 9059 */ 9060 schedule_instance = cp->instance; 9061 } 9062 9063 /* If the HCI_ADVERTISING flag is set or there is no instance to 9064 * be advertised then we have no HCI communication to make. 9065 * Simply return. 9066 */ 9067 if (hci_dev_test_flag(hdev, HCI_ADVERTISING) || !schedule_instance) { 9068 if (adv_instance->pending) { 9069 mgmt_advertising_added(sk, hdev, cp->instance); 9070 adv_instance->pending = false; 9071 } 9072 rp.instance = cp->instance; 9073 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_DATA, 9074 MGMT_STATUS_SUCCESS, &rp, sizeof(rp)); 9075 goto unlock; 9076 } 9077 9078 cmd = mgmt_pending_new(sk, MGMT_OP_ADD_EXT_ADV_DATA, hdev, data, 9079 data_len); 9080 if (!cmd) { 9081 err = -ENOMEM; 9082 goto clear_new_instance; 9083 } 9084 9085 err = hci_cmd_sync_queue(hdev, add_ext_adv_data_sync, cmd, 9086 add_ext_adv_data_complete); 9087 if (err < 0) { 9088 mgmt_pending_free(cmd); 9089 goto clear_new_instance; 9090 } 9091 9092 /* We were successful in updating data, so trigger advertising_added 9093 * event if this is an instance that wasn't previously advertising. If 9094 * a failure occurs in the requests we initiated, we will remove the 9095 * instance again in add_advertising_complete 9096 */ 9097 if (adv_instance->pending) 9098 mgmt_advertising_added(sk, hdev, cp->instance); 9099 9100 goto unlock; 9101 9102 clear_new_instance: 9103 hci_remove_adv_instance(hdev, cp->instance); 9104 9105 unlock: 9106 hci_dev_unlock(hdev); 9107 9108 return err; 9109 } 9110 9111 static void remove_advertising_complete(struct hci_dev *hdev, void *data, 9112 int err) 9113 { 9114 struct mgmt_pending_cmd *cmd = data; 9115 struct mgmt_cp_remove_advertising *cp = cmd->param; 9116 struct mgmt_rp_remove_advertising rp; 9117 9118 bt_dev_dbg(hdev, "err %d", err); 9119 9120 memset(&rp, 0, sizeof(rp)); 9121 rp.instance = cp->instance; 9122 9123 if (err) 9124 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, 9125 mgmt_status(err)); 9126 else 9127 mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, 9128 MGMT_STATUS_SUCCESS, &rp, sizeof(rp)); 9129 9130 mgmt_pending_free(cmd); 9131 } 9132 9133 static int remove_advertising_sync(struct hci_dev *hdev, void *data) 9134 { 9135 struct mgmt_pending_cmd *cmd = data; 9136 struct mgmt_cp_remove_advertising *cp = cmd->param; 9137 int err; 9138 9139 err = hci_remove_advertising_sync(hdev, cmd->sk, cp->instance, true); 9140 if (err) 9141 return err; 9142 9143 if (list_empty(&hdev->adv_instances)) 9144 err = hci_disable_advertising_sync(hdev); 9145 9146 return err; 9147 } 9148 9149 static int remove_advertising(struct sock *sk, struct hci_dev *hdev, 9150 void *data, u16 data_len) 9151 { 9152 struct mgmt_cp_remove_advertising *cp = data; 9153 struct mgmt_pending_cmd *cmd; 9154 int err; 9155 9156 bt_dev_dbg(hdev, "sock %p", sk); 9157 9158 hci_dev_lock(hdev); 9159 9160 if (cp->instance && !hci_find_adv_instance(hdev, cp->instance)) { 9161 err = mgmt_cmd_status(sk, hdev->id, 9162 MGMT_OP_REMOVE_ADVERTISING, 9163 MGMT_STATUS_INVALID_PARAMS); 9164 goto unlock; 9165 } 9166 9167 if (pending_find(MGMT_OP_SET_LE, hdev)) { 9168 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_ADVERTISING, 9169 MGMT_STATUS_BUSY); 9170 goto unlock; 9171 } 9172 9173 if (list_empty(&hdev->adv_instances)) { 9174 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_ADVERTISING, 9175 MGMT_STATUS_INVALID_PARAMS); 9176 goto unlock; 9177 } 9178 9179 cmd = mgmt_pending_new(sk, MGMT_OP_REMOVE_ADVERTISING, hdev, data, 9180 data_len); 9181 if (!cmd) { 9182 err = -ENOMEM; 9183 goto unlock; 9184 } 9185 9186 err = hci_cmd_sync_queue(hdev, remove_advertising_sync, cmd, 9187 remove_advertising_complete); 9188 if (err < 0) 9189 mgmt_pending_free(cmd); 9190 9191 unlock: 9192 hci_dev_unlock(hdev); 9193 9194 return err; 9195 } 9196 9197 static int get_adv_size_info(struct sock *sk, struct hci_dev *hdev, 9198 void *data, u16 data_len) 9199 { 9200 struct mgmt_cp_get_adv_size_info *cp = data; 9201 struct mgmt_rp_get_adv_size_info rp; 9202 u32 flags, supported_flags; 9203 9204 bt_dev_dbg(hdev, "sock %p", sk); 9205 9206 if (!lmp_le_capable(hdev)) 9207 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_ADV_SIZE_INFO, 9208 MGMT_STATUS_REJECTED); 9209 9210 if (cp->instance < 1 || cp->instance > hdev->le_num_of_adv_sets) 9211 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_ADV_SIZE_INFO, 9212 MGMT_STATUS_INVALID_PARAMS); 9213 9214 flags = __le32_to_cpu(cp->flags); 9215 9216 /* The current implementation only supports a subset of the specified 9217 * flags. 9218 */ 9219 supported_flags = get_supported_adv_flags(hdev); 9220 if (flags & ~supported_flags) 9221 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_ADV_SIZE_INFO, 9222 MGMT_STATUS_INVALID_PARAMS); 9223 9224 rp.instance = cp->instance; 9225 rp.flags = cp->flags; 9226 rp.max_adv_data_len = tlv_data_max_len(hdev, flags, true); 9227 rp.max_scan_rsp_len = tlv_data_max_len(hdev, flags, false); 9228 9229 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_ADV_SIZE_INFO, 9230 MGMT_STATUS_SUCCESS, &rp, sizeof(rp)); 9231 } 9232 9233 static const struct hci_mgmt_handler mgmt_handlers[] = { 9234 { NULL }, /* 0x0000 (no command) */ 9235 { read_version, MGMT_READ_VERSION_SIZE, 9236 HCI_MGMT_NO_HDEV | 9237 HCI_MGMT_UNTRUSTED }, 9238 { read_commands, MGMT_READ_COMMANDS_SIZE, 9239 HCI_MGMT_NO_HDEV | 9240 HCI_MGMT_UNTRUSTED }, 9241 { read_index_list, MGMT_READ_INDEX_LIST_SIZE, 9242 HCI_MGMT_NO_HDEV | 9243 HCI_MGMT_UNTRUSTED }, 9244 { read_controller_info, MGMT_READ_INFO_SIZE, 9245 HCI_MGMT_UNTRUSTED }, 9246 { set_powered, MGMT_SETTING_SIZE }, 9247 { set_discoverable, MGMT_SET_DISCOVERABLE_SIZE }, 9248 { set_connectable, MGMT_SETTING_SIZE }, 9249 { set_fast_connectable, MGMT_SETTING_SIZE }, 9250 { set_bondable, MGMT_SETTING_SIZE }, 9251 { set_link_security, MGMT_SETTING_SIZE }, 9252 { set_ssp, MGMT_SETTING_SIZE }, 9253 { set_hs, MGMT_SETTING_SIZE }, 9254 { set_le, MGMT_SETTING_SIZE }, 9255 { set_dev_class, MGMT_SET_DEV_CLASS_SIZE }, 9256 { set_local_name, MGMT_SET_LOCAL_NAME_SIZE }, 9257 { add_uuid, MGMT_ADD_UUID_SIZE }, 9258 { remove_uuid, MGMT_REMOVE_UUID_SIZE }, 9259 { load_link_keys, MGMT_LOAD_LINK_KEYS_SIZE, 9260 HCI_MGMT_VAR_LEN }, 9261 { load_long_term_keys, MGMT_LOAD_LONG_TERM_KEYS_SIZE, 9262 HCI_MGMT_VAR_LEN }, 9263 { disconnect, MGMT_DISCONNECT_SIZE }, 9264 { get_connections, MGMT_GET_CONNECTIONS_SIZE }, 9265 { pin_code_reply, MGMT_PIN_CODE_REPLY_SIZE }, 9266 { pin_code_neg_reply, MGMT_PIN_CODE_NEG_REPLY_SIZE }, 9267 { set_io_capability, MGMT_SET_IO_CAPABILITY_SIZE }, 9268 { pair_device, MGMT_PAIR_DEVICE_SIZE }, 9269 { cancel_pair_device, MGMT_CANCEL_PAIR_DEVICE_SIZE }, 9270 { unpair_device, MGMT_UNPAIR_DEVICE_SIZE }, 9271 { user_confirm_reply, MGMT_USER_CONFIRM_REPLY_SIZE }, 9272 { user_confirm_neg_reply, MGMT_USER_CONFIRM_NEG_REPLY_SIZE }, 9273 { user_passkey_reply, MGMT_USER_PASSKEY_REPLY_SIZE }, 9274 { user_passkey_neg_reply, MGMT_USER_PASSKEY_NEG_REPLY_SIZE }, 9275 { read_local_oob_data, MGMT_READ_LOCAL_OOB_DATA_SIZE }, 9276 { add_remote_oob_data, MGMT_ADD_REMOTE_OOB_DATA_SIZE, 9277 HCI_MGMT_VAR_LEN }, 9278 { remove_remote_oob_data, MGMT_REMOVE_REMOTE_OOB_DATA_SIZE }, 9279 { start_discovery, MGMT_START_DISCOVERY_SIZE }, 9280 { stop_discovery, MGMT_STOP_DISCOVERY_SIZE }, 9281 { confirm_name, MGMT_CONFIRM_NAME_SIZE }, 9282 { block_device, MGMT_BLOCK_DEVICE_SIZE }, 9283 { unblock_device, MGMT_UNBLOCK_DEVICE_SIZE }, 9284 { set_device_id, MGMT_SET_DEVICE_ID_SIZE }, 9285 { set_advertising, MGMT_SETTING_SIZE }, 9286 { set_bredr, MGMT_SETTING_SIZE }, 9287 { set_static_address, MGMT_SET_STATIC_ADDRESS_SIZE }, 9288 { set_scan_params, MGMT_SET_SCAN_PARAMS_SIZE }, 9289 { set_secure_conn, MGMT_SETTING_SIZE }, 9290 { set_debug_keys, MGMT_SETTING_SIZE }, 9291 { set_privacy, MGMT_SET_PRIVACY_SIZE }, 9292 { load_irks, MGMT_LOAD_IRKS_SIZE, 9293 HCI_MGMT_VAR_LEN }, 9294 { get_conn_info, MGMT_GET_CONN_INFO_SIZE }, 9295 { get_clock_info, MGMT_GET_CLOCK_INFO_SIZE }, 9296 { add_device, MGMT_ADD_DEVICE_SIZE }, 9297 { remove_device, MGMT_REMOVE_DEVICE_SIZE }, 9298 { load_conn_param, MGMT_LOAD_CONN_PARAM_SIZE, 9299 HCI_MGMT_VAR_LEN }, 9300 { read_unconf_index_list, MGMT_READ_UNCONF_INDEX_LIST_SIZE, 9301 HCI_MGMT_NO_HDEV | 9302 HCI_MGMT_UNTRUSTED }, 9303 { read_config_info, MGMT_READ_CONFIG_INFO_SIZE, 9304 HCI_MGMT_UNCONFIGURED | 9305 HCI_MGMT_UNTRUSTED }, 9306 { set_external_config, MGMT_SET_EXTERNAL_CONFIG_SIZE, 9307 HCI_MGMT_UNCONFIGURED }, 9308 { set_public_address, MGMT_SET_PUBLIC_ADDRESS_SIZE, 9309 HCI_MGMT_UNCONFIGURED }, 9310 { start_service_discovery, MGMT_START_SERVICE_DISCOVERY_SIZE, 9311 HCI_MGMT_VAR_LEN }, 9312 { read_local_oob_ext_data, MGMT_READ_LOCAL_OOB_EXT_DATA_SIZE }, 9313 { read_ext_index_list, MGMT_READ_EXT_INDEX_LIST_SIZE, 9314 HCI_MGMT_NO_HDEV | 9315 HCI_MGMT_UNTRUSTED }, 9316 { read_adv_features, MGMT_READ_ADV_FEATURES_SIZE }, 9317 { add_advertising, MGMT_ADD_ADVERTISING_SIZE, 9318 HCI_MGMT_VAR_LEN }, 9319 { remove_advertising, MGMT_REMOVE_ADVERTISING_SIZE }, 9320 { get_adv_size_info, MGMT_GET_ADV_SIZE_INFO_SIZE }, 9321 { start_limited_discovery, MGMT_START_DISCOVERY_SIZE }, 9322 { read_ext_controller_info,MGMT_READ_EXT_INFO_SIZE, 9323 HCI_MGMT_UNTRUSTED }, 9324 { set_appearance, MGMT_SET_APPEARANCE_SIZE }, 9325 { get_phy_configuration, MGMT_GET_PHY_CONFIGURATION_SIZE }, 9326 { set_phy_configuration, MGMT_SET_PHY_CONFIGURATION_SIZE }, 9327 { set_blocked_keys, MGMT_OP_SET_BLOCKED_KEYS_SIZE, 9328 HCI_MGMT_VAR_LEN }, 9329 { set_wideband_speech, MGMT_SETTING_SIZE }, 9330 { read_controller_cap, MGMT_READ_CONTROLLER_CAP_SIZE, 9331 HCI_MGMT_UNTRUSTED }, 9332 { read_exp_features_info, MGMT_READ_EXP_FEATURES_INFO_SIZE, 9333 HCI_MGMT_UNTRUSTED | 9334 HCI_MGMT_HDEV_OPTIONAL }, 9335 { set_exp_feature, MGMT_SET_EXP_FEATURE_SIZE, 9336 HCI_MGMT_VAR_LEN | 9337 HCI_MGMT_HDEV_OPTIONAL }, 9338 { read_def_system_config, MGMT_READ_DEF_SYSTEM_CONFIG_SIZE, 9339 HCI_MGMT_UNTRUSTED }, 9340 { set_def_system_config, MGMT_SET_DEF_SYSTEM_CONFIG_SIZE, 9341 HCI_MGMT_VAR_LEN }, 9342 { read_def_runtime_config, MGMT_READ_DEF_RUNTIME_CONFIG_SIZE, 9343 HCI_MGMT_UNTRUSTED }, 9344 { set_def_runtime_config, MGMT_SET_DEF_RUNTIME_CONFIG_SIZE, 9345 HCI_MGMT_VAR_LEN }, 9346 { get_device_flags, MGMT_GET_DEVICE_FLAGS_SIZE }, 9347 { set_device_flags, MGMT_SET_DEVICE_FLAGS_SIZE }, 9348 { read_adv_mon_features, MGMT_READ_ADV_MONITOR_FEATURES_SIZE }, 9349 { add_adv_patterns_monitor,MGMT_ADD_ADV_PATTERNS_MONITOR_SIZE, 9350 HCI_MGMT_VAR_LEN }, 9351 { remove_adv_monitor, MGMT_REMOVE_ADV_MONITOR_SIZE }, 9352 { add_ext_adv_params, MGMT_ADD_EXT_ADV_PARAMS_MIN_SIZE, 9353 HCI_MGMT_VAR_LEN }, 9354 { add_ext_adv_data, MGMT_ADD_EXT_ADV_DATA_SIZE, 9355 HCI_MGMT_VAR_LEN }, 9356 { add_adv_patterns_monitor_rssi, 9357 MGMT_ADD_ADV_PATTERNS_MONITOR_RSSI_SIZE, 9358 HCI_MGMT_VAR_LEN }, 9359 { set_mesh, MGMT_SET_MESH_RECEIVER_SIZE, 9360 HCI_MGMT_VAR_LEN }, 9361 { mesh_features, MGMT_MESH_READ_FEATURES_SIZE }, 9362 { mesh_send, MGMT_MESH_SEND_SIZE, 9363 HCI_MGMT_VAR_LEN }, 9364 { mesh_send_cancel, MGMT_MESH_SEND_CANCEL_SIZE }, 9365 }; 9366 9367 void mgmt_index_added(struct hci_dev *hdev) 9368 { 9369 struct mgmt_ev_ext_index ev; 9370 9371 if (test_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks)) 9372 return; 9373 9374 switch (hdev->dev_type) { 9375 case HCI_PRIMARY: 9376 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) { 9377 mgmt_index_event(MGMT_EV_UNCONF_INDEX_ADDED, hdev, 9378 NULL, 0, HCI_MGMT_UNCONF_INDEX_EVENTS); 9379 ev.type = 0x01; 9380 } else { 9381 mgmt_index_event(MGMT_EV_INDEX_ADDED, hdev, NULL, 0, 9382 HCI_MGMT_INDEX_EVENTS); 9383 ev.type = 0x00; 9384 } 9385 break; 9386 case HCI_AMP: 9387 ev.type = 0x02; 9388 break; 9389 default: 9390 return; 9391 } 9392 9393 ev.bus = hdev->bus; 9394 9395 mgmt_index_event(MGMT_EV_EXT_INDEX_ADDED, hdev, &ev, sizeof(ev), 9396 HCI_MGMT_EXT_INDEX_EVENTS); 9397 } 9398 9399 void mgmt_index_removed(struct hci_dev *hdev) 9400 { 9401 struct mgmt_ev_ext_index ev; 9402 u8 status = MGMT_STATUS_INVALID_INDEX; 9403 9404 if (test_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks)) 9405 return; 9406 9407 switch (hdev->dev_type) { 9408 case HCI_PRIMARY: 9409 mgmt_pending_foreach(0, hdev, cmd_complete_rsp, &status); 9410 9411 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) { 9412 mgmt_index_event(MGMT_EV_UNCONF_INDEX_REMOVED, hdev, 9413 NULL, 0, HCI_MGMT_UNCONF_INDEX_EVENTS); 9414 ev.type = 0x01; 9415 } else { 9416 mgmt_index_event(MGMT_EV_INDEX_REMOVED, hdev, NULL, 0, 9417 HCI_MGMT_INDEX_EVENTS); 9418 ev.type = 0x00; 9419 } 9420 break; 9421 case HCI_AMP: 9422 ev.type = 0x02; 9423 break; 9424 default: 9425 return; 9426 } 9427 9428 ev.bus = hdev->bus; 9429 9430 mgmt_index_event(MGMT_EV_EXT_INDEX_REMOVED, hdev, &ev, sizeof(ev), 9431 HCI_MGMT_EXT_INDEX_EVENTS); 9432 9433 /* Cancel any remaining timed work */ 9434 if (!hci_dev_test_flag(hdev, HCI_MGMT)) 9435 return; 9436 cancel_delayed_work_sync(&hdev->discov_off); 9437 cancel_delayed_work_sync(&hdev->service_cache); 9438 cancel_delayed_work_sync(&hdev->rpa_expired); 9439 } 9440 9441 void mgmt_power_on(struct hci_dev *hdev, int err) 9442 { 9443 struct cmd_lookup match = { NULL, hdev }; 9444 9445 bt_dev_dbg(hdev, "err %d", err); 9446 9447 hci_dev_lock(hdev); 9448 9449 if (!err) { 9450 restart_le_actions(hdev); 9451 hci_update_passive_scan(hdev); 9452 } 9453 9454 mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp, &match); 9455 9456 new_settings(hdev, match.sk); 9457 9458 if (match.sk) 9459 sock_put(match.sk); 9460 9461 hci_dev_unlock(hdev); 9462 } 9463 9464 void __mgmt_power_off(struct hci_dev *hdev) 9465 { 9466 struct cmd_lookup match = { NULL, hdev }; 9467 u8 status, zero_cod[] = { 0, 0, 0 }; 9468 9469 mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp, &match); 9470 9471 /* If the power off is because of hdev unregistration let 9472 * use the appropriate INVALID_INDEX status. Otherwise use 9473 * NOT_POWERED. We cover both scenarios here since later in 9474 * mgmt_index_removed() any hci_conn callbacks will have already 9475 * been triggered, potentially causing misleading DISCONNECTED 9476 * status responses. 9477 */ 9478 if (hci_dev_test_flag(hdev, HCI_UNREGISTER)) 9479 status = MGMT_STATUS_INVALID_INDEX; 9480 else 9481 status = MGMT_STATUS_NOT_POWERED; 9482 9483 mgmt_pending_foreach(0, hdev, cmd_complete_rsp, &status); 9484 9485 if (memcmp(hdev->dev_class, zero_cod, sizeof(zero_cod)) != 0) { 9486 mgmt_limited_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev, 9487 zero_cod, sizeof(zero_cod), 9488 HCI_MGMT_DEV_CLASS_EVENTS, NULL); 9489 ext_info_changed(hdev, NULL); 9490 } 9491 9492 new_settings(hdev, match.sk); 9493 9494 if (match.sk) 9495 sock_put(match.sk); 9496 } 9497 9498 void mgmt_set_powered_failed(struct hci_dev *hdev, int err) 9499 { 9500 struct mgmt_pending_cmd *cmd; 9501 u8 status; 9502 9503 cmd = pending_find(MGMT_OP_SET_POWERED, hdev); 9504 if (!cmd) 9505 return; 9506 9507 if (err == -ERFKILL) 9508 status = MGMT_STATUS_RFKILLED; 9509 else 9510 status = MGMT_STATUS_FAILED; 9511 9512 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_POWERED, status); 9513 9514 mgmt_pending_remove(cmd); 9515 } 9516 9517 void mgmt_new_link_key(struct hci_dev *hdev, struct link_key *key, 9518 bool persistent) 9519 { 9520 struct mgmt_ev_new_link_key ev; 9521 9522 memset(&ev, 0, sizeof(ev)); 9523 9524 ev.store_hint = persistent; 9525 bacpy(&ev.key.addr.bdaddr, &key->bdaddr); 9526 ev.key.addr.type = BDADDR_BREDR; 9527 ev.key.type = key->type; 9528 memcpy(ev.key.val, key->val, HCI_LINK_KEY_SIZE); 9529 ev.key.pin_len = key->pin_len; 9530 9531 mgmt_event(MGMT_EV_NEW_LINK_KEY, hdev, &ev, sizeof(ev), NULL); 9532 } 9533 9534 static u8 mgmt_ltk_type(struct smp_ltk *ltk) 9535 { 9536 switch (ltk->type) { 9537 case SMP_LTK: 9538 case SMP_LTK_RESPONDER: 9539 if (ltk->authenticated) 9540 return MGMT_LTK_AUTHENTICATED; 9541 return MGMT_LTK_UNAUTHENTICATED; 9542 case SMP_LTK_P256: 9543 if (ltk->authenticated) 9544 return MGMT_LTK_P256_AUTH; 9545 return MGMT_LTK_P256_UNAUTH; 9546 case SMP_LTK_P256_DEBUG: 9547 return MGMT_LTK_P256_DEBUG; 9548 } 9549 9550 return MGMT_LTK_UNAUTHENTICATED; 9551 } 9552 9553 void mgmt_new_ltk(struct hci_dev *hdev, struct smp_ltk *key, bool persistent) 9554 { 9555 struct mgmt_ev_new_long_term_key ev; 9556 9557 memset(&ev, 0, sizeof(ev)); 9558 9559 /* Devices using resolvable or non-resolvable random addresses 9560 * without providing an identity resolving key don't require 9561 * to store long term keys. Their addresses will change the 9562 * next time around. 9563 * 9564 * Only when a remote device provides an identity address 9565 * make sure the long term key is stored. If the remote 9566 * identity is known, the long term keys are internally 9567 * mapped to the identity address. So allow static random 9568 * and public addresses here. 9569 */ 9570 if (key->bdaddr_type == ADDR_LE_DEV_RANDOM && 9571 (key->bdaddr.b[5] & 0xc0) != 0xc0) 9572 ev.store_hint = 0x00; 9573 else 9574 ev.store_hint = persistent; 9575 9576 bacpy(&ev.key.addr.bdaddr, &key->bdaddr); 9577 ev.key.addr.type = link_to_bdaddr(LE_LINK, key->bdaddr_type); 9578 ev.key.type = mgmt_ltk_type(key); 9579 ev.key.enc_size = key->enc_size; 9580 ev.key.ediv = key->ediv; 9581 ev.key.rand = key->rand; 9582 9583 if (key->type == SMP_LTK) 9584 ev.key.initiator = 1; 9585 9586 /* Make sure we copy only the significant bytes based on the 9587 * encryption key size, and set the rest of the value to zeroes. 9588 */ 9589 memcpy(ev.key.val, key->val, key->enc_size); 9590 memset(ev.key.val + key->enc_size, 0, 9591 sizeof(ev.key.val) - key->enc_size); 9592 9593 mgmt_event(MGMT_EV_NEW_LONG_TERM_KEY, hdev, &ev, sizeof(ev), NULL); 9594 } 9595 9596 void mgmt_new_irk(struct hci_dev *hdev, struct smp_irk *irk, bool persistent) 9597 { 9598 struct mgmt_ev_new_irk ev; 9599 9600 memset(&ev, 0, sizeof(ev)); 9601 9602 ev.store_hint = persistent; 9603 9604 bacpy(&ev.rpa, &irk->rpa); 9605 bacpy(&ev.irk.addr.bdaddr, &irk->bdaddr); 9606 ev.irk.addr.type = link_to_bdaddr(LE_LINK, irk->addr_type); 9607 memcpy(ev.irk.val, irk->val, sizeof(irk->val)); 9608 9609 mgmt_event(MGMT_EV_NEW_IRK, hdev, &ev, sizeof(ev), NULL); 9610 } 9611 9612 void mgmt_new_csrk(struct hci_dev *hdev, struct smp_csrk *csrk, 9613 bool persistent) 9614 { 9615 struct mgmt_ev_new_csrk ev; 9616 9617 memset(&ev, 0, sizeof(ev)); 9618 9619 /* Devices using resolvable or non-resolvable random addresses 9620 * without providing an identity resolving key don't require 9621 * to store signature resolving keys. Their addresses will change 9622 * the next time around. 9623 * 9624 * Only when a remote device provides an identity address 9625 * make sure the signature resolving key is stored. So allow 9626 * static random and public addresses here. 9627 */ 9628 if (csrk->bdaddr_type == ADDR_LE_DEV_RANDOM && 9629 (csrk->bdaddr.b[5] & 0xc0) != 0xc0) 9630 ev.store_hint = 0x00; 9631 else 9632 ev.store_hint = persistent; 9633 9634 bacpy(&ev.key.addr.bdaddr, &csrk->bdaddr); 9635 ev.key.addr.type = link_to_bdaddr(LE_LINK, csrk->bdaddr_type); 9636 ev.key.type = csrk->type; 9637 memcpy(ev.key.val, csrk->val, sizeof(csrk->val)); 9638 9639 mgmt_event(MGMT_EV_NEW_CSRK, hdev, &ev, sizeof(ev), NULL); 9640 } 9641 9642 void mgmt_new_conn_param(struct hci_dev *hdev, bdaddr_t *bdaddr, 9643 u8 bdaddr_type, u8 store_hint, u16 min_interval, 9644 u16 max_interval, u16 latency, u16 timeout) 9645 { 9646 struct mgmt_ev_new_conn_param ev; 9647 9648 if (!hci_is_identity_address(bdaddr, bdaddr_type)) 9649 return; 9650 9651 memset(&ev, 0, sizeof(ev)); 9652 bacpy(&ev.addr.bdaddr, bdaddr); 9653 ev.addr.type = link_to_bdaddr(LE_LINK, bdaddr_type); 9654 ev.store_hint = store_hint; 9655 ev.min_interval = cpu_to_le16(min_interval); 9656 ev.max_interval = cpu_to_le16(max_interval); 9657 ev.latency = cpu_to_le16(latency); 9658 ev.timeout = cpu_to_le16(timeout); 9659 9660 mgmt_event(MGMT_EV_NEW_CONN_PARAM, hdev, &ev, sizeof(ev), NULL); 9661 } 9662 9663 void mgmt_device_connected(struct hci_dev *hdev, struct hci_conn *conn, 9664 u8 *name, u8 name_len) 9665 { 9666 struct sk_buff *skb; 9667 struct mgmt_ev_device_connected *ev; 9668 u16 eir_len = 0; 9669 u32 flags = 0; 9670 9671 /* allocate buff for LE or BR/EDR adv */ 9672 if (conn->le_adv_data_len > 0) 9673 skb = mgmt_alloc_skb(hdev, MGMT_EV_DEVICE_CONNECTED, 9674 sizeof(*ev) + conn->le_adv_data_len); 9675 else 9676 skb = mgmt_alloc_skb(hdev, MGMT_EV_DEVICE_CONNECTED, 9677 sizeof(*ev) + (name ? eir_precalc_len(name_len) : 0) + 9678 eir_precalc_len(sizeof(conn->dev_class))); 9679 9680 ev = skb_put(skb, sizeof(*ev)); 9681 bacpy(&ev->addr.bdaddr, &conn->dst); 9682 ev->addr.type = link_to_bdaddr(conn->type, conn->dst_type); 9683 9684 if (conn->out) 9685 flags |= MGMT_DEV_FOUND_INITIATED_CONN; 9686 9687 ev->flags = __cpu_to_le32(flags); 9688 9689 /* We must ensure that the EIR Data fields are ordered and 9690 * unique. Keep it simple for now and avoid the problem by not 9691 * adding any BR/EDR data to the LE adv. 9692 */ 9693 if (conn->le_adv_data_len > 0) { 9694 skb_put_data(skb, conn->le_adv_data, conn->le_adv_data_len); 9695 eir_len = conn->le_adv_data_len; 9696 } else { 9697 if (name) 9698 eir_len += eir_skb_put_data(skb, EIR_NAME_COMPLETE, name, name_len); 9699 9700 if (memcmp(conn->dev_class, "\0\0\0", sizeof(conn->dev_class))) 9701 eir_len += eir_skb_put_data(skb, EIR_CLASS_OF_DEV, 9702 conn->dev_class, sizeof(conn->dev_class)); 9703 } 9704 9705 ev->eir_len = cpu_to_le16(eir_len); 9706 9707 mgmt_event_skb(skb, NULL); 9708 } 9709 9710 static void disconnect_rsp(struct mgmt_pending_cmd *cmd, void *data) 9711 { 9712 struct sock **sk = data; 9713 9714 cmd->cmd_complete(cmd, 0); 9715 9716 *sk = cmd->sk; 9717 sock_hold(*sk); 9718 9719 mgmt_pending_remove(cmd); 9720 } 9721 9722 static void unpair_device_rsp(struct mgmt_pending_cmd *cmd, void *data) 9723 { 9724 struct hci_dev *hdev = data; 9725 struct mgmt_cp_unpair_device *cp = cmd->param; 9726 9727 device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, cmd->sk); 9728 9729 cmd->cmd_complete(cmd, 0); 9730 mgmt_pending_remove(cmd); 9731 } 9732 9733 bool mgmt_powering_down(struct hci_dev *hdev) 9734 { 9735 struct mgmt_pending_cmd *cmd; 9736 struct mgmt_mode *cp; 9737 9738 cmd = pending_find(MGMT_OP_SET_POWERED, hdev); 9739 if (!cmd) 9740 return false; 9741 9742 cp = cmd->param; 9743 if (!cp->val) 9744 return true; 9745 9746 return false; 9747 } 9748 9749 void mgmt_device_disconnected(struct hci_dev *hdev, bdaddr_t *bdaddr, 9750 u8 link_type, u8 addr_type, u8 reason, 9751 bool mgmt_connected) 9752 { 9753 struct mgmt_ev_device_disconnected ev; 9754 struct sock *sk = NULL; 9755 9756 /* The connection is still in hci_conn_hash so test for 1 9757 * instead of 0 to know if this is the last one. 9758 */ 9759 if (mgmt_powering_down(hdev) && hci_conn_count(hdev) == 1) { 9760 cancel_delayed_work(&hdev->power_off); 9761 queue_work(hdev->req_workqueue, &hdev->power_off.work); 9762 } 9763 9764 if (!mgmt_connected) 9765 return; 9766 9767 if (link_type != ACL_LINK && link_type != LE_LINK) 9768 return; 9769 9770 mgmt_pending_foreach(MGMT_OP_DISCONNECT, hdev, disconnect_rsp, &sk); 9771 9772 bacpy(&ev.addr.bdaddr, bdaddr); 9773 ev.addr.type = link_to_bdaddr(link_type, addr_type); 9774 ev.reason = reason; 9775 9776 /* Report disconnects due to suspend */ 9777 if (hdev->suspended) 9778 ev.reason = MGMT_DEV_DISCONN_LOCAL_HOST_SUSPEND; 9779 9780 mgmt_event(MGMT_EV_DEVICE_DISCONNECTED, hdev, &ev, sizeof(ev), sk); 9781 9782 if (sk) 9783 sock_put(sk); 9784 9785 mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, unpair_device_rsp, 9786 hdev); 9787 } 9788 9789 void mgmt_disconnect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr, 9790 u8 link_type, u8 addr_type, u8 status) 9791 { 9792 u8 bdaddr_type = link_to_bdaddr(link_type, addr_type); 9793 struct mgmt_cp_disconnect *cp; 9794 struct mgmt_pending_cmd *cmd; 9795 9796 mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, unpair_device_rsp, 9797 hdev); 9798 9799 cmd = pending_find(MGMT_OP_DISCONNECT, hdev); 9800 if (!cmd) 9801 return; 9802 9803 cp = cmd->param; 9804 9805 if (bacmp(bdaddr, &cp->addr.bdaddr)) 9806 return; 9807 9808 if (cp->addr.type != bdaddr_type) 9809 return; 9810 9811 cmd->cmd_complete(cmd, mgmt_status(status)); 9812 mgmt_pending_remove(cmd); 9813 } 9814 9815 void mgmt_connect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type, 9816 u8 addr_type, u8 status) 9817 { 9818 struct mgmt_ev_connect_failed ev; 9819 9820 /* The connection is still in hci_conn_hash so test for 1 9821 * instead of 0 to know if this is the last one. 9822 */ 9823 if (mgmt_powering_down(hdev) && hci_conn_count(hdev) == 1) { 9824 cancel_delayed_work(&hdev->power_off); 9825 queue_work(hdev->req_workqueue, &hdev->power_off.work); 9826 } 9827 9828 bacpy(&ev.addr.bdaddr, bdaddr); 9829 ev.addr.type = link_to_bdaddr(link_type, addr_type); 9830 ev.status = mgmt_status(status); 9831 9832 mgmt_event(MGMT_EV_CONNECT_FAILED, hdev, &ev, sizeof(ev), NULL); 9833 } 9834 9835 void mgmt_pin_code_request(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 secure) 9836 { 9837 struct mgmt_ev_pin_code_request ev; 9838 9839 bacpy(&ev.addr.bdaddr, bdaddr); 9840 ev.addr.type = BDADDR_BREDR; 9841 ev.secure = secure; 9842 9843 mgmt_event(MGMT_EV_PIN_CODE_REQUEST, hdev, &ev, sizeof(ev), NULL); 9844 } 9845 9846 void mgmt_pin_code_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr, 9847 u8 status) 9848 { 9849 struct mgmt_pending_cmd *cmd; 9850 9851 cmd = pending_find(MGMT_OP_PIN_CODE_REPLY, hdev); 9852 if (!cmd) 9853 return; 9854 9855 cmd->cmd_complete(cmd, mgmt_status(status)); 9856 mgmt_pending_remove(cmd); 9857 } 9858 9859 void mgmt_pin_code_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr, 9860 u8 status) 9861 { 9862 struct mgmt_pending_cmd *cmd; 9863 9864 cmd = pending_find(MGMT_OP_PIN_CODE_NEG_REPLY, hdev); 9865 if (!cmd) 9866 return; 9867 9868 cmd->cmd_complete(cmd, mgmt_status(status)); 9869 mgmt_pending_remove(cmd); 9870 } 9871 9872 int mgmt_user_confirm_request(struct hci_dev *hdev, bdaddr_t *bdaddr, 9873 u8 link_type, u8 addr_type, u32 value, 9874 u8 confirm_hint) 9875 { 9876 struct mgmt_ev_user_confirm_request ev; 9877 9878 bt_dev_dbg(hdev, "bdaddr %pMR", bdaddr); 9879 9880 bacpy(&ev.addr.bdaddr, bdaddr); 9881 ev.addr.type = link_to_bdaddr(link_type, addr_type); 9882 ev.confirm_hint = confirm_hint; 9883 ev.value = cpu_to_le32(value); 9884 9885 return mgmt_event(MGMT_EV_USER_CONFIRM_REQUEST, hdev, &ev, sizeof(ev), 9886 NULL); 9887 } 9888 9889 int mgmt_user_passkey_request(struct hci_dev *hdev, bdaddr_t *bdaddr, 9890 u8 link_type, u8 addr_type) 9891 { 9892 struct mgmt_ev_user_passkey_request ev; 9893 9894 bt_dev_dbg(hdev, "bdaddr %pMR", bdaddr); 9895 9896 bacpy(&ev.addr.bdaddr, bdaddr); 9897 ev.addr.type = link_to_bdaddr(link_type, addr_type); 9898 9899 return mgmt_event(MGMT_EV_USER_PASSKEY_REQUEST, hdev, &ev, sizeof(ev), 9900 NULL); 9901 } 9902 9903 static int user_pairing_resp_complete(struct hci_dev *hdev, bdaddr_t *bdaddr, 9904 u8 link_type, u8 addr_type, u8 status, 9905 u8 opcode) 9906 { 9907 struct mgmt_pending_cmd *cmd; 9908 9909 cmd = pending_find(opcode, hdev); 9910 if (!cmd) 9911 return -ENOENT; 9912 9913 cmd->cmd_complete(cmd, mgmt_status(status)); 9914 mgmt_pending_remove(cmd); 9915 9916 return 0; 9917 } 9918 9919 int mgmt_user_confirm_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr, 9920 u8 link_type, u8 addr_type, u8 status) 9921 { 9922 return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type, 9923 status, MGMT_OP_USER_CONFIRM_REPLY); 9924 } 9925 9926 int mgmt_user_confirm_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr, 9927 u8 link_type, u8 addr_type, u8 status) 9928 { 9929 return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type, 9930 status, 9931 MGMT_OP_USER_CONFIRM_NEG_REPLY); 9932 } 9933 9934 int mgmt_user_passkey_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr, 9935 u8 link_type, u8 addr_type, u8 status) 9936 { 9937 return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type, 9938 status, MGMT_OP_USER_PASSKEY_REPLY); 9939 } 9940 9941 int mgmt_user_passkey_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr, 9942 u8 link_type, u8 addr_type, u8 status) 9943 { 9944 return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type, 9945 status, 9946 MGMT_OP_USER_PASSKEY_NEG_REPLY); 9947 } 9948 9949 int mgmt_user_passkey_notify(struct hci_dev *hdev, bdaddr_t *bdaddr, 9950 u8 link_type, u8 addr_type, u32 passkey, 9951 u8 entered) 9952 { 9953 struct mgmt_ev_passkey_notify ev; 9954 9955 bt_dev_dbg(hdev, "bdaddr %pMR", bdaddr); 9956 9957 bacpy(&ev.addr.bdaddr, bdaddr); 9958 ev.addr.type = link_to_bdaddr(link_type, addr_type); 9959 ev.passkey = __cpu_to_le32(passkey); 9960 ev.entered = entered; 9961 9962 return mgmt_event(MGMT_EV_PASSKEY_NOTIFY, hdev, &ev, sizeof(ev), NULL); 9963 } 9964 9965 void mgmt_auth_failed(struct hci_conn *conn, u8 hci_status) 9966 { 9967 struct mgmt_ev_auth_failed ev; 9968 struct mgmt_pending_cmd *cmd; 9969 u8 status = mgmt_status(hci_status); 9970 9971 bacpy(&ev.addr.bdaddr, &conn->dst); 9972 ev.addr.type = link_to_bdaddr(conn->type, conn->dst_type); 9973 ev.status = status; 9974 9975 cmd = find_pairing(conn); 9976 9977 mgmt_event(MGMT_EV_AUTH_FAILED, conn->hdev, &ev, sizeof(ev), 9978 cmd ? cmd->sk : NULL); 9979 9980 if (cmd) { 9981 cmd->cmd_complete(cmd, status); 9982 mgmt_pending_remove(cmd); 9983 } 9984 } 9985 9986 void mgmt_auth_enable_complete(struct hci_dev *hdev, u8 status) 9987 { 9988 struct cmd_lookup match = { NULL, hdev }; 9989 bool changed; 9990 9991 if (status) { 9992 u8 mgmt_err = mgmt_status(status); 9993 mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev, 9994 cmd_status_rsp, &mgmt_err); 9995 return; 9996 } 9997 9998 if (test_bit(HCI_AUTH, &hdev->flags)) 9999 changed = !hci_dev_test_and_set_flag(hdev, HCI_LINK_SECURITY); 10000 else 10001 changed = hci_dev_test_and_clear_flag(hdev, HCI_LINK_SECURITY); 10002 10003 mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev, settings_rsp, 10004 &match); 10005 10006 if (changed) 10007 new_settings(hdev, match.sk); 10008 10009 if (match.sk) 10010 sock_put(match.sk); 10011 } 10012 10013 static void sk_lookup(struct mgmt_pending_cmd *cmd, void *data) 10014 { 10015 struct cmd_lookup *match = data; 10016 10017 if (match->sk == NULL) { 10018 match->sk = cmd->sk; 10019 sock_hold(match->sk); 10020 } 10021 } 10022 10023 void mgmt_set_class_of_dev_complete(struct hci_dev *hdev, u8 *dev_class, 10024 u8 status) 10025 { 10026 struct cmd_lookup match = { NULL, hdev, mgmt_status(status) }; 10027 10028 mgmt_pending_foreach(MGMT_OP_SET_DEV_CLASS, hdev, sk_lookup, &match); 10029 mgmt_pending_foreach(MGMT_OP_ADD_UUID, hdev, sk_lookup, &match); 10030 mgmt_pending_foreach(MGMT_OP_REMOVE_UUID, hdev, sk_lookup, &match); 10031 10032 if (!status) { 10033 mgmt_limited_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev, dev_class, 10034 3, HCI_MGMT_DEV_CLASS_EVENTS, NULL); 10035 ext_info_changed(hdev, NULL); 10036 } 10037 10038 if (match.sk) 10039 sock_put(match.sk); 10040 } 10041 10042 void mgmt_set_local_name_complete(struct hci_dev *hdev, u8 *name, u8 status) 10043 { 10044 struct mgmt_cp_set_local_name ev; 10045 struct mgmt_pending_cmd *cmd; 10046 10047 if (status) 10048 return; 10049 10050 memset(&ev, 0, sizeof(ev)); 10051 memcpy(ev.name, name, HCI_MAX_NAME_LENGTH); 10052 memcpy(ev.short_name, hdev->short_name, HCI_MAX_SHORT_NAME_LENGTH); 10053 10054 cmd = pending_find(MGMT_OP_SET_LOCAL_NAME, hdev); 10055 if (!cmd) { 10056 memcpy(hdev->dev_name, name, sizeof(hdev->dev_name)); 10057 10058 /* If this is a HCI command related to powering on the 10059 * HCI dev don't send any mgmt signals. 10060 */ 10061 if (pending_find(MGMT_OP_SET_POWERED, hdev)) 10062 return; 10063 } 10064 10065 mgmt_limited_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, &ev, sizeof(ev), 10066 HCI_MGMT_LOCAL_NAME_EVENTS, cmd ? cmd->sk : NULL); 10067 ext_info_changed(hdev, cmd ? cmd->sk : NULL); 10068 } 10069 10070 static inline bool has_uuid(u8 *uuid, u16 uuid_count, u8 (*uuids)[16]) 10071 { 10072 int i; 10073 10074 for (i = 0; i < uuid_count; i++) { 10075 if (!memcmp(uuid, uuids[i], 16)) 10076 return true; 10077 } 10078 10079 return false; 10080 } 10081 10082 static bool eir_has_uuids(u8 *eir, u16 eir_len, u16 uuid_count, u8 (*uuids)[16]) 10083 { 10084 u16 parsed = 0; 10085 10086 while (parsed < eir_len) { 10087 u8 field_len = eir[0]; 10088 u8 uuid[16]; 10089 int i; 10090 10091 if (field_len == 0) 10092 break; 10093 10094 if (eir_len - parsed < field_len + 1) 10095 break; 10096 10097 switch (eir[1]) { 10098 case EIR_UUID16_ALL: 10099 case EIR_UUID16_SOME: 10100 for (i = 0; i + 3 <= field_len; i += 2) { 10101 memcpy(uuid, bluetooth_base_uuid, 16); 10102 uuid[13] = eir[i + 3]; 10103 uuid[12] = eir[i + 2]; 10104 if (has_uuid(uuid, uuid_count, uuids)) 10105 return true; 10106 } 10107 break; 10108 case EIR_UUID32_ALL: 10109 case EIR_UUID32_SOME: 10110 for (i = 0; i + 5 <= field_len; i += 4) { 10111 memcpy(uuid, bluetooth_base_uuid, 16); 10112 uuid[15] = eir[i + 5]; 10113 uuid[14] = eir[i + 4]; 10114 uuid[13] = eir[i + 3]; 10115 uuid[12] = eir[i + 2]; 10116 if (has_uuid(uuid, uuid_count, uuids)) 10117 return true; 10118 } 10119 break; 10120 case EIR_UUID128_ALL: 10121 case EIR_UUID128_SOME: 10122 for (i = 0; i + 17 <= field_len; i += 16) { 10123 memcpy(uuid, eir + i + 2, 16); 10124 if (has_uuid(uuid, uuid_count, uuids)) 10125 return true; 10126 } 10127 break; 10128 } 10129 10130 parsed += field_len + 1; 10131 eir += field_len + 1; 10132 } 10133 10134 return false; 10135 } 10136 10137 static void restart_le_scan(struct hci_dev *hdev) 10138 { 10139 /* If controller is not scanning we are done. */ 10140 if (!hci_dev_test_flag(hdev, HCI_LE_SCAN)) 10141 return; 10142 10143 if (time_after(jiffies + DISCOV_LE_RESTART_DELAY, 10144 hdev->discovery.scan_start + 10145 hdev->discovery.scan_duration)) 10146 return; 10147 10148 queue_delayed_work(hdev->req_workqueue, &hdev->le_scan_restart, 10149 DISCOV_LE_RESTART_DELAY); 10150 } 10151 10152 static bool is_filter_match(struct hci_dev *hdev, s8 rssi, u8 *eir, 10153 u16 eir_len, u8 *scan_rsp, u8 scan_rsp_len) 10154 { 10155 /* If a RSSI threshold has been specified, and 10156 * HCI_QUIRK_STRICT_DUPLICATE_FILTER is not set, then all results with 10157 * a RSSI smaller than the RSSI threshold will be dropped. If the quirk 10158 * is set, let it through for further processing, as we might need to 10159 * restart the scan. 10160 * 10161 * For BR/EDR devices (pre 1.2) providing no RSSI during inquiry, 10162 * the results are also dropped. 10163 */ 10164 if (hdev->discovery.rssi != HCI_RSSI_INVALID && 10165 (rssi == HCI_RSSI_INVALID || 10166 (rssi < hdev->discovery.rssi && 10167 !test_bit(HCI_QUIRK_STRICT_DUPLICATE_FILTER, &hdev->quirks)))) 10168 return false; 10169 10170 if (hdev->discovery.uuid_count != 0) { 10171 /* If a list of UUIDs is provided in filter, results with no 10172 * matching UUID should be dropped. 10173 */ 10174 if (!eir_has_uuids(eir, eir_len, hdev->discovery.uuid_count, 10175 hdev->discovery.uuids) && 10176 !eir_has_uuids(scan_rsp, scan_rsp_len, 10177 hdev->discovery.uuid_count, 10178 hdev->discovery.uuids)) 10179 return false; 10180 } 10181 10182 /* If duplicate filtering does not report RSSI changes, then restart 10183 * scanning to ensure updated result with updated RSSI values. 10184 */ 10185 if (test_bit(HCI_QUIRK_STRICT_DUPLICATE_FILTER, &hdev->quirks)) { 10186 restart_le_scan(hdev); 10187 10188 /* Validate RSSI value against the RSSI threshold once more. */ 10189 if (hdev->discovery.rssi != HCI_RSSI_INVALID && 10190 rssi < hdev->discovery.rssi) 10191 return false; 10192 } 10193 10194 return true; 10195 } 10196 10197 void mgmt_adv_monitor_device_lost(struct hci_dev *hdev, u16 handle, 10198 bdaddr_t *bdaddr, u8 addr_type) 10199 { 10200 struct mgmt_ev_adv_monitor_device_lost ev; 10201 10202 ev.monitor_handle = cpu_to_le16(handle); 10203 bacpy(&ev.addr.bdaddr, bdaddr); 10204 ev.addr.type = addr_type; 10205 10206 mgmt_event(MGMT_EV_ADV_MONITOR_DEVICE_LOST, hdev, &ev, sizeof(ev), 10207 NULL); 10208 } 10209 10210 static void mgmt_send_adv_monitor_device_found(struct hci_dev *hdev, 10211 struct sk_buff *skb, 10212 struct sock *skip_sk, 10213 u16 handle) 10214 { 10215 struct sk_buff *advmon_skb; 10216 size_t advmon_skb_len; 10217 __le16 *monitor_handle; 10218 10219 if (!skb) 10220 return; 10221 10222 advmon_skb_len = (sizeof(struct mgmt_ev_adv_monitor_device_found) - 10223 sizeof(struct mgmt_ev_device_found)) + skb->len; 10224 advmon_skb = mgmt_alloc_skb(hdev, MGMT_EV_ADV_MONITOR_DEVICE_FOUND, 10225 advmon_skb_len); 10226 if (!advmon_skb) 10227 return; 10228 10229 /* ADV_MONITOR_DEVICE_FOUND is similar to DEVICE_FOUND event except 10230 * that it also has 'monitor_handle'. Make a copy of DEVICE_FOUND and 10231 * store monitor_handle of the matched monitor. 10232 */ 10233 monitor_handle = skb_put(advmon_skb, sizeof(*monitor_handle)); 10234 *monitor_handle = cpu_to_le16(handle); 10235 skb_put_data(advmon_skb, skb->data, skb->len); 10236 10237 mgmt_event_skb(advmon_skb, skip_sk); 10238 } 10239 10240 static void mgmt_adv_monitor_device_found(struct hci_dev *hdev, 10241 bdaddr_t *bdaddr, bool report_device, 10242 struct sk_buff *skb, 10243 struct sock *skip_sk) 10244 { 10245 struct monitored_device *dev, *tmp; 10246 bool matched = false; 10247 bool notified = false; 10248 10249 /* We have received the Advertisement Report because: 10250 * 1. the kernel has initiated active discovery 10251 * 2. if not, we have pend_le_reports > 0 in which case we are doing 10252 * passive scanning 10253 * 3. if none of the above is true, we have one or more active 10254 * Advertisement Monitor 10255 * 10256 * For case 1 and 2, report all advertisements via MGMT_EV_DEVICE_FOUND 10257 * and report ONLY one advertisement per device for the matched Monitor 10258 * via MGMT_EV_ADV_MONITOR_DEVICE_FOUND event. 10259 * 10260 * For case 3, since we are not active scanning and all advertisements 10261 * received are due to a matched Advertisement Monitor, report all 10262 * advertisements ONLY via MGMT_EV_ADV_MONITOR_DEVICE_FOUND event. 10263 */ 10264 if (report_device && !hdev->advmon_pend_notify) { 10265 mgmt_event_skb(skb, skip_sk); 10266 return; 10267 } 10268 10269 hdev->advmon_pend_notify = false; 10270 10271 list_for_each_entry_safe(dev, tmp, &hdev->monitored_devices, list) { 10272 if (!bacmp(&dev->bdaddr, bdaddr)) { 10273 matched = true; 10274 10275 if (!dev->notified) { 10276 mgmt_send_adv_monitor_device_found(hdev, skb, 10277 skip_sk, 10278 dev->handle); 10279 notified = true; 10280 dev->notified = true; 10281 } 10282 } 10283 10284 if (!dev->notified) 10285 hdev->advmon_pend_notify = true; 10286 } 10287 10288 if (!report_device && 10289 ((matched && !notified) || !msft_monitor_supported(hdev))) { 10290 /* Handle 0 indicates that we are not active scanning and this 10291 * is a subsequent advertisement report for an already matched 10292 * Advertisement Monitor or the controller offloading support 10293 * is not available. 10294 */ 10295 mgmt_send_adv_monitor_device_found(hdev, skb, skip_sk, 0); 10296 } 10297 10298 if (report_device) 10299 mgmt_event_skb(skb, skip_sk); 10300 else 10301 kfree_skb(skb); 10302 } 10303 10304 static void mesh_device_found(struct hci_dev *hdev, bdaddr_t *bdaddr, 10305 u8 addr_type, s8 rssi, u32 flags, u8 *eir, 10306 u16 eir_len, u8 *scan_rsp, u8 scan_rsp_len, 10307 u64 instant) 10308 { 10309 struct sk_buff *skb; 10310 struct mgmt_ev_mesh_device_found *ev; 10311 int i, j; 10312 10313 if (!hdev->mesh_ad_types[0]) 10314 goto accepted; 10315 10316 /* Scan for requested AD types */ 10317 if (eir_len > 0) { 10318 for (i = 0; i + 1 < eir_len; i += eir[i] + 1) { 10319 for (j = 0; j < sizeof(hdev->mesh_ad_types); j++) { 10320 if (!hdev->mesh_ad_types[j]) 10321 break; 10322 10323 if (hdev->mesh_ad_types[j] == eir[i + 1]) 10324 goto accepted; 10325 } 10326 } 10327 } 10328 10329 if (scan_rsp_len > 0) { 10330 for (i = 0; i + 1 < scan_rsp_len; i += scan_rsp[i] + 1) { 10331 for (j = 0; j < sizeof(hdev->mesh_ad_types); j++) { 10332 if (!hdev->mesh_ad_types[j]) 10333 break; 10334 10335 if (hdev->mesh_ad_types[j] == scan_rsp[i + 1]) 10336 goto accepted; 10337 } 10338 } 10339 } 10340 10341 return; 10342 10343 accepted: 10344 skb = mgmt_alloc_skb(hdev, MGMT_EV_MESH_DEVICE_FOUND, 10345 sizeof(*ev) + eir_len + scan_rsp_len); 10346 if (!skb) 10347 return; 10348 10349 ev = skb_put(skb, sizeof(*ev)); 10350 10351 bacpy(&ev->addr.bdaddr, bdaddr); 10352 ev->addr.type = link_to_bdaddr(LE_LINK, addr_type); 10353 ev->rssi = rssi; 10354 ev->flags = cpu_to_le32(flags); 10355 ev->instant = cpu_to_le64(instant); 10356 10357 if (eir_len > 0) 10358 /* Copy EIR or advertising data into event */ 10359 skb_put_data(skb, eir, eir_len); 10360 10361 if (scan_rsp_len > 0) 10362 /* Append scan response data to event */ 10363 skb_put_data(skb, scan_rsp, scan_rsp_len); 10364 10365 ev->eir_len = cpu_to_le16(eir_len + scan_rsp_len); 10366 10367 mgmt_event_skb(skb, NULL); 10368 } 10369 10370 void mgmt_device_found(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type, 10371 u8 addr_type, u8 *dev_class, s8 rssi, u32 flags, 10372 u8 *eir, u16 eir_len, u8 *scan_rsp, u8 scan_rsp_len, 10373 u64 instant) 10374 { 10375 struct sk_buff *skb; 10376 struct mgmt_ev_device_found *ev; 10377 bool report_device = hci_discovery_active(hdev); 10378 10379 if (hci_dev_test_flag(hdev, HCI_MESH) && link_type == LE_LINK) 10380 mesh_device_found(hdev, bdaddr, addr_type, rssi, flags, 10381 eir, eir_len, scan_rsp, scan_rsp_len, 10382 instant); 10383 10384 /* Don't send events for a non-kernel initiated discovery. With 10385 * LE one exception is if we have pend_le_reports > 0 in which 10386 * case we're doing passive scanning and want these events. 10387 */ 10388 if (!hci_discovery_active(hdev)) { 10389 if (link_type == ACL_LINK) 10390 return; 10391 if (link_type == LE_LINK && !list_empty(&hdev->pend_le_reports)) 10392 report_device = true; 10393 else if (!hci_is_adv_monitoring(hdev)) 10394 return; 10395 } 10396 10397 if (hdev->discovery.result_filtering) { 10398 /* We are using service discovery */ 10399 if (!is_filter_match(hdev, rssi, eir, eir_len, scan_rsp, 10400 scan_rsp_len)) 10401 return; 10402 } 10403 10404 if (hdev->discovery.limited) { 10405 /* Check for limited discoverable bit */ 10406 if (dev_class) { 10407 if (!(dev_class[1] & 0x20)) 10408 return; 10409 } else { 10410 u8 *flags = eir_get_data(eir, eir_len, EIR_FLAGS, NULL); 10411 if (!flags || !(flags[0] & LE_AD_LIMITED)) 10412 return; 10413 } 10414 } 10415 10416 /* Allocate skb. The 5 extra bytes are for the potential CoD field */ 10417 skb = mgmt_alloc_skb(hdev, MGMT_EV_DEVICE_FOUND, 10418 sizeof(*ev) + eir_len + scan_rsp_len + 5); 10419 if (!skb) 10420 return; 10421 10422 ev = skb_put(skb, sizeof(*ev)); 10423 10424 /* In case of device discovery with BR/EDR devices (pre 1.2), the 10425 * RSSI value was reported as 0 when not available. This behavior 10426 * is kept when using device discovery. This is required for full 10427 * backwards compatibility with the API. 10428 * 10429 * However when using service discovery, the value 127 will be 10430 * returned when the RSSI is not available. 10431 */ 10432 if (rssi == HCI_RSSI_INVALID && !hdev->discovery.report_invalid_rssi && 10433 link_type == ACL_LINK) 10434 rssi = 0; 10435 10436 bacpy(&ev->addr.bdaddr, bdaddr); 10437 ev->addr.type = link_to_bdaddr(link_type, addr_type); 10438 ev->rssi = rssi; 10439 ev->flags = cpu_to_le32(flags); 10440 10441 if (eir_len > 0) 10442 /* Copy EIR or advertising data into event */ 10443 skb_put_data(skb, eir, eir_len); 10444 10445 if (dev_class && !eir_get_data(eir, eir_len, EIR_CLASS_OF_DEV, NULL)) { 10446 u8 eir_cod[5]; 10447 10448 eir_len += eir_append_data(eir_cod, 0, EIR_CLASS_OF_DEV, 10449 dev_class, 3); 10450 skb_put_data(skb, eir_cod, sizeof(eir_cod)); 10451 } 10452 10453 if (scan_rsp_len > 0) 10454 /* Append scan response data to event */ 10455 skb_put_data(skb, scan_rsp, scan_rsp_len); 10456 10457 ev->eir_len = cpu_to_le16(eir_len + scan_rsp_len); 10458 10459 mgmt_adv_monitor_device_found(hdev, bdaddr, report_device, skb, NULL); 10460 } 10461 10462 void mgmt_remote_name(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type, 10463 u8 addr_type, s8 rssi, u8 *name, u8 name_len) 10464 { 10465 struct sk_buff *skb; 10466 struct mgmt_ev_device_found *ev; 10467 u16 eir_len = 0; 10468 u32 flags = 0; 10469 10470 skb = mgmt_alloc_skb(hdev, MGMT_EV_DEVICE_FOUND, 10471 sizeof(*ev) + (name ? eir_precalc_len(name_len) : 0)); 10472 10473 ev = skb_put(skb, sizeof(*ev)); 10474 bacpy(&ev->addr.bdaddr, bdaddr); 10475 ev->addr.type = link_to_bdaddr(link_type, addr_type); 10476 ev->rssi = rssi; 10477 10478 if (name) 10479 eir_len += eir_skb_put_data(skb, EIR_NAME_COMPLETE, name, name_len); 10480 else 10481 flags = MGMT_DEV_FOUND_NAME_REQUEST_FAILED; 10482 10483 ev->eir_len = cpu_to_le16(eir_len); 10484 ev->flags = cpu_to_le32(flags); 10485 10486 mgmt_event_skb(skb, NULL); 10487 } 10488 10489 void mgmt_discovering(struct hci_dev *hdev, u8 discovering) 10490 { 10491 struct mgmt_ev_discovering ev; 10492 10493 bt_dev_dbg(hdev, "discovering %u", discovering); 10494 10495 memset(&ev, 0, sizeof(ev)); 10496 ev.type = hdev->discovery.type; 10497 ev.discovering = discovering; 10498 10499 mgmt_event(MGMT_EV_DISCOVERING, hdev, &ev, sizeof(ev), NULL); 10500 } 10501 10502 void mgmt_suspending(struct hci_dev *hdev, u8 state) 10503 { 10504 struct mgmt_ev_controller_suspend ev; 10505 10506 ev.suspend_state = state; 10507 mgmt_event(MGMT_EV_CONTROLLER_SUSPEND, hdev, &ev, sizeof(ev), NULL); 10508 } 10509 10510 void mgmt_resuming(struct hci_dev *hdev, u8 reason, bdaddr_t *bdaddr, 10511 u8 addr_type) 10512 { 10513 struct mgmt_ev_controller_resume ev; 10514 10515 ev.wake_reason = reason; 10516 if (bdaddr) { 10517 bacpy(&ev.addr.bdaddr, bdaddr); 10518 ev.addr.type = addr_type; 10519 } else { 10520 memset(&ev.addr, 0, sizeof(ev.addr)); 10521 } 10522 10523 mgmt_event(MGMT_EV_CONTROLLER_RESUME, hdev, &ev, sizeof(ev), NULL); 10524 } 10525 10526 static struct hci_mgmt_chan chan = { 10527 .channel = HCI_CHANNEL_CONTROL, 10528 .handler_count = ARRAY_SIZE(mgmt_handlers), 10529 .handlers = mgmt_handlers, 10530 .hdev_init = mgmt_init_hdev, 10531 }; 10532 10533 int mgmt_init(void) 10534 { 10535 return hci_mgmt_chan_register(&chan); 10536 } 10537 10538 void mgmt_exit(void) 10539 { 10540 hci_mgmt_chan_unregister(&chan); 10541 } 10542 10543 void mgmt_cleanup(struct sock *sk) 10544 { 10545 struct mgmt_mesh_tx *mesh_tx; 10546 struct hci_dev *hdev; 10547 10548 read_lock(&hci_dev_list_lock); 10549 10550 list_for_each_entry(hdev, &hci_dev_list, list) { 10551 do { 10552 mesh_tx = mgmt_mesh_next(hdev, sk); 10553 10554 if (mesh_tx) 10555 mesh_send_complete(hdev, mesh_tx, true); 10556 } while (mesh_tx); 10557 } 10558 10559 read_unlock(&hci_dev_list_lock); 10560 } 10561