1 /* 2 BlueZ - Bluetooth protocol stack for Linux 3 4 Copyright (C) 2010 Nokia Corporation 5 Copyright (C) 2011-2012 Intel Corporation 6 7 This program is free software; you can redistribute it and/or modify 8 it under the terms of the GNU General Public License version 2 as 9 published by the Free Software Foundation; 10 11 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS 12 OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 13 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS. 14 IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY 15 CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES 16 WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN 17 ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF 18 OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. 19 20 ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS, 21 COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS 22 SOFTWARE IS DISCLAIMED. 23 */ 24 25 /* Bluetooth HCI Management interface */ 26 27 #include <linux/module.h> 28 #include <asm/unaligned.h> 29 30 #include <net/bluetooth/bluetooth.h> 31 #include <net/bluetooth/hci_core.h> 32 #include <net/bluetooth/hci_sock.h> 33 #include <net/bluetooth/l2cap.h> 34 #include <net/bluetooth/mgmt.h> 35 36 #include "hci_request.h" 37 #include "smp.h" 38 #include "mgmt_util.h" 39 #include "mgmt_config.h" 40 #include "msft.h" 41 #include "eir.h" 42 #include "aosp.h" 43 44 #define MGMT_VERSION 1 45 #define MGMT_REVISION 22 46 47 static const u16 mgmt_commands[] = { 48 MGMT_OP_READ_INDEX_LIST, 49 MGMT_OP_READ_INFO, 50 MGMT_OP_SET_POWERED, 51 MGMT_OP_SET_DISCOVERABLE, 52 MGMT_OP_SET_CONNECTABLE, 53 MGMT_OP_SET_FAST_CONNECTABLE, 54 MGMT_OP_SET_BONDABLE, 55 MGMT_OP_SET_LINK_SECURITY, 56 MGMT_OP_SET_SSP, 57 MGMT_OP_SET_HS, 58 MGMT_OP_SET_LE, 59 MGMT_OP_SET_DEV_CLASS, 60 MGMT_OP_SET_LOCAL_NAME, 61 MGMT_OP_ADD_UUID, 62 MGMT_OP_REMOVE_UUID, 63 MGMT_OP_LOAD_LINK_KEYS, 64 MGMT_OP_LOAD_LONG_TERM_KEYS, 65 MGMT_OP_DISCONNECT, 66 MGMT_OP_GET_CONNECTIONS, 67 MGMT_OP_PIN_CODE_REPLY, 68 MGMT_OP_PIN_CODE_NEG_REPLY, 69 MGMT_OP_SET_IO_CAPABILITY, 70 MGMT_OP_PAIR_DEVICE, 71 MGMT_OP_CANCEL_PAIR_DEVICE, 72 MGMT_OP_UNPAIR_DEVICE, 73 MGMT_OP_USER_CONFIRM_REPLY, 74 MGMT_OP_USER_CONFIRM_NEG_REPLY, 75 MGMT_OP_USER_PASSKEY_REPLY, 76 MGMT_OP_USER_PASSKEY_NEG_REPLY, 77 MGMT_OP_READ_LOCAL_OOB_DATA, 78 MGMT_OP_ADD_REMOTE_OOB_DATA, 79 MGMT_OP_REMOVE_REMOTE_OOB_DATA, 80 MGMT_OP_START_DISCOVERY, 81 MGMT_OP_STOP_DISCOVERY, 82 MGMT_OP_CONFIRM_NAME, 83 MGMT_OP_BLOCK_DEVICE, 84 MGMT_OP_UNBLOCK_DEVICE, 85 MGMT_OP_SET_DEVICE_ID, 86 MGMT_OP_SET_ADVERTISING, 87 MGMT_OP_SET_BREDR, 88 MGMT_OP_SET_STATIC_ADDRESS, 89 MGMT_OP_SET_SCAN_PARAMS, 90 MGMT_OP_SET_SECURE_CONN, 91 MGMT_OP_SET_DEBUG_KEYS, 92 MGMT_OP_SET_PRIVACY, 93 MGMT_OP_LOAD_IRKS, 94 MGMT_OP_GET_CONN_INFO, 95 MGMT_OP_GET_CLOCK_INFO, 96 MGMT_OP_ADD_DEVICE, 97 MGMT_OP_REMOVE_DEVICE, 98 MGMT_OP_LOAD_CONN_PARAM, 99 MGMT_OP_READ_UNCONF_INDEX_LIST, 100 MGMT_OP_READ_CONFIG_INFO, 101 MGMT_OP_SET_EXTERNAL_CONFIG, 102 MGMT_OP_SET_PUBLIC_ADDRESS, 103 MGMT_OP_START_SERVICE_DISCOVERY, 104 MGMT_OP_READ_LOCAL_OOB_EXT_DATA, 105 MGMT_OP_READ_EXT_INDEX_LIST, 106 MGMT_OP_READ_ADV_FEATURES, 107 MGMT_OP_ADD_ADVERTISING, 108 MGMT_OP_REMOVE_ADVERTISING, 109 MGMT_OP_GET_ADV_SIZE_INFO, 110 MGMT_OP_START_LIMITED_DISCOVERY, 111 MGMT_OP_READ_EXT_INFO, 112 MGMT_OP_SET_APPEARANCE, 113 MGMT_OP_GET_PHY_CONFIGURATION, 114 MGMT_OP_SET_PHY_CONFIGURATION, 115 MGMT_OP_SET_BLOCKED_KEYS, 116 MGMT_OP_SET_WIDEBAND_SPEECH, 117 MGMT_OP_READ_CONTROLLER_CAP, 118 MGMT_OP_READ_EXP_FEATURES_INFO, 119 MGMT_OP_SET_EXP_FEATURE, 120 MGMT_OP_READ_DEF_SYSTEM_CONFIG, 121 MGMT_OP_SET_DEF_SYSTEM_CONFIG, 122 MGMT_OP_READ_DEF_RUNTIME_CONFIG, 123 MGMT_OP_SET_DEF_RUNTIME_CONFIG, 124 MGMT_OP_GET_DEVICE_FLAGS, 125 MGMT_OP_SET_DEVICE_FLAGS, 126 MGMT_OP_READ_ADV_MONITOR_FEATURES, 127 MGMT_OP_ADD_ADV_PATTERNS_MONITOR, 128 MGMT_OP_REMOVE_ADV_MONITOR, 129 MGMT_OP_ADD_EXT_ADV_PARAMS, 130 MGMT_OP_ADD_EXT_ADV_DATA, 131 MGMT_OP_ADD_ADV_PATTERNS_MONITOR_RSSI, 132 MGMT_OP_SET_MESH_RECEIVER, 133 MGMT_OP_MESH_READ_FEATURES, 134 MGMT_OP_MESH_SEND, 135 MGMT_OP_MESH_SEND_CANCEL, 136 }; 137 138 static const u16 mgmt_events[] = { 139 MGMT_EV_CONTROLLER_ERROR, 140 MGMT_EV_INDEX_ADDED, 141 MGMT_EV_INDEX_REMOVED, 142 MGMT_EV_NEW_SETTINGS, 143 MGMT_EV_CLASS_OF_DEV_CHANGED, 144 MGMT_EV_LOCAL_NAME_CHANGED, 145 MGMT_EV_NEW_LINK_KEY, 146 MGMT_EV_NEW_LONG_TERM_KEY, 147 MGMT_EV_DEVICE_CONNECTED, 148 MGMT_EV_DEVICE_DISCONNECTED, 149 MGMT_EV_CONNECT_FAILED, 150 MGMT_EV_PIN_CODE_REQUEST, 151 MGMT_EV_USER_CONFIRM_REQUEST, 152 MGMT_EV_USER_PASSKEY_REQUEST, 153 MGMT_EV_AUTH_FAILED, 154 MGMT_EV_DEVICE_FOUND, 155 MGMT_EV_DISCOVERING, 156 MGMT_EV_DEVICE_BLOCKED, 157 MGMT_EV_DEVICE_UNBLOCKED, 158 MGMT_EV_DEVICE_UNPAIRED, 159 MGMT_EV_PASSKEY_NOTIFY, 160 MGMT_EV_NEW_IRK, 161 MGMT_EV_NEW_CSRK, 162 MGMT_EV_DEVICE_ADDED, 163 MGMT_EV_DEVICE_REMOVED, 164 MGMT_EV_NEW_CONN_PARAM, 165 MGMT_EV_UNCONF_INDEX_ADDED, 166 MGMT_EV_UNCONF_INDEX_REMOVED, 167 MGMT_EV_NEW_CONFIG_OPTIONS, 168 MGMT_EV_EXT_INDEX_ADDED, 169 MGMT_EV_EXT_INDEX_REMOVED, 170 MGMT_EV_LOCAL_OOB_DATA_UPDATED, 171 MGMT_EV_ADVERTISING_ADDED, 172 MGMT_EV_ADVERTISING_REMOVED, 173 MGMT_EV_EXT_INFO_CHANGED, 174 MGMT_EV_PHY_CONFIGURATION_CHANGED, 175 MGMT_EV_EXP_FEATURE_CHANGED, 176 MGMT_EV_DEVICE_FLAGS_CHANGED, 177 MGMT_EV_ADV_MONITOR_ADDED, 178 MGMT_EV_ADV_MONITOR_REMOVED, 179 MGMT_EV_CONTROLLER_SUSPEND, 180 MGMT_EV_CONTROLLER_RESUME, 181 MGMT_EV_ADV_MONITOR_DEVICE_FOUND, 182 MGMT_EV_ADV_MONITOR_DEVICE_LOST, 183 }; 184 185 static const u16 mgmt_untrusted_commands[] = { 186 MGMT_OP_READ_INDEX_LIST, 187 MGMT_OP_READ_INFO, 188 MGMT_OP_READ_UNCONF_INDEX_LIST, 189 MGMT_OP_READ_CONFIG_INFO, 190 MGMT_OP_READ_EXT_INDEX_LIST, 191 MGMT_OP_READ_EXT_INFO, 192 MGMT_OP_READ_CONTROLLER_CAP, 193 MGMT_OP_READ_EXP_FEATURES_INFO, 194 MGMT_OP_READ_DEF_SYSTEM_CONFIG, 195 MGMT_OP_READ_DEF_RUNTIME_CONFIG, 196 }; 197 198 static const u16 mgmt_untrusted_events[] = { 199 MGMT_EV_INDEX_ADDED, 200 MGMT_EV_INDEX_REMOVED, 201 MGMT_EV_NEW_SETTINGS, 202 MGMT_EV_CLASS_OF_DEV_CHANGED, 203 MGMT_EV_LOCAL_NAME_CHANGED, 204 MGMT_EV_UNCONF_INDEX_ADDED, 205 MGMT_EV_UNCONF_INDEX_REMOVED, 206 MGMT_EV_NEW_CONFIG_OPTIONS, 207 MGMT_EV_EXT_INDEX_ADDED, 208 MGMT_EV_EXT_INDEX_REMOVED, 209 MGMT_EV_EXT_INFO_CHANGED, 210 MGMT_EV_EXP_FEATURE_CHANGED, 211 }; 212 213 #define CACHE_TIMEOUT msecs_to_jiffies(2 * 1000) 214 215 #define ZERO_KEY "\x00\x00\x00\x00\x00\x00\x00\x00" \ 216 "\x00\x00\x00\x00\x00\x00\x00\x00" 217 218 /* HCI to MGMT error code conversion table */ 219 static const u8 mgmt_status_table[] = { 220 MGMT_STATUS_SUCCESS, 221 MGMT_STATUS_UNKNOWN_COMMAND, /* Unknown Command */ 222 MGMT_STATUS_NOT_CONNECTED, /* No Connection */ 223 MGMT_STATUS_FAILED, /* Hardware Failure */ 224 MGMT_STATUS_CONNECT_FAILED, /* Page Timeout */ 225 MGMT_STATUS_AUTH_FAILED, /* Authentication Failed */ 226 MGMT_STATUS_AUTH_FAILED, /* PIN or Key Missing */ 227 MGMT_STATUS_NO_RESOURCES, /* Memory Full */ 228 MGMT_STATUS_TIMEOUT, /* Connection Timeout */ 229 MGMT_STATUS_NO_RESOURCES, /* Max Number of Connections */ 230 MGMT_STATUS_NO_RESOURCES, /* Max Number of SCO Connections */ 231 MGMT_STATUS_ALREADY_CONNECTED, /* ACL Connection Exists */ 232 MGMT_STATUS_BUSY, /* Command Disallowed */ 233 MGMT_STATUS_NO_RESOURCES, /* Rejected Limited Resources */ 234 MGMT_STATUS_REJECTED, /* Rejected Security */ 235 MGMT_STATUS_REJECTED, /* Rejected Personal */ 236 MGMT_STATUS_TIMEOUT, /* Host Timeout */ 237 MGMT_STATUS_NOT_SUPPORTED, /* Unsupported Feature */ 238 MGMT_STATUS_INVALID_PARAMS, /* Invalid Parameters */ 239 MGMT_STATUS_DISCONNECTED, /* OE User Ended Connection */ 240 MGMT_STATUS_NO_RESOURCES, /* OE Low Resources */ 241 MGMT_STATUS_DISCONNECTED, /* OE Power Off */ 242 MGMT_STATUS_DISCONNECTED, /* Connection Terminated */ 243 MGMT_STATUS_BUSY, /* Repeated Attempts */ 244 MGMT_STATUS_REJECTED, /* Pairing Not Allowed */ 245 MGMT_STATUS_FAILED, /* Unknown LMP PDU */ 246 MGMT_STATUS_NOT_SUPPORTED, /* Unsupported Remote Feature */ 247 MGMT_STATUS_REJECTED, /* SCO Offset Rejected */ 248 MGMT_STATUS_REJECTED, /* SCO Interval Rejected */ 249 MGMT_STATUS_REJECTED, /* Air Mode Rejected */ 250 MGMT_STATUS_INVALID_PARAMS, /* Invalid LMP Parameters */ 251 MGMT_STATUS_FAILED, /* Unspecified Error */ 252 MGMT_STATUS_NOT_SUPPORTED, /* Unsupported LMP Parameter Value */ 253 MGMT_STATUS_FAILED, /* Role Change Not Allowed */ 254 MGMT_STATUS_TIMEOUT, /* LMP Response Timeout */ 255 MGMT_STATUS_FAILED, /* LMP Error Transaction Collision */ 256 MGMT_STATUS_FAILED, /* LMP PDU Not Allowed */ 257 MGMT_STATUS_REJECTED, /* Encryption Mode Not Accepted */ 258 MGMT_STATUS_FAILED, /* Unit Link Key Used */ 259 MGMT_STATUS_NOT_SUPPORTED, /* QoS Not Supported */ 260 MGMT_STATUS_TIMEOUT, /* Instant Passed */ 261 MGMT_STATUS_NOT_SUPPORTED, /* Pairing Not Supported */ 262 MGMT_STATUS_FAILED, /* Transaction Collision */ 263 MGMT_STATUS_FAILED, /* Reserved for future use */ 264 MGMT_STATUS_INVALID_PARAMS, /* Unacceptable Parameter */ 265 MGMT_STATUS_REJECTED, /* QoS Rejected */ 266 MGMT_STATUS_NOT_SUPPORTED, /* Classification Not Supported */ 267 MGMT_STATUS_REJECTED, /* Insufficient Security */ 268 MGMT_STATUS_INVALID_PARAMS, /* Parameter Out Of Range */ 269 MGMT_STATUS_FAILED, /* Reserved for future use */ 270 MGMT_STATUS_BUSY, /* Role Switch Pending */ 271 MGMT_STATUS_FAILED, /* Reserved for future use */ 272 MGMT_STATUS_FAILED, /* Slot Violation */ 273 MGMT_STATUS_FAILED, /* Role Switch Failed */ 274 MGMT_STATUS_INVALID_PARAMS, /* EIR Too Large */ 275 MGMT_STATUS_NOT_SUPPORTED, /* Simple Pairing Not Supported */ 276 MGMT_STATUS_BUSY, /* Host Busy Pairing */ 277 MGMT_STATUS_REJECTED, /* Rejected, No Suitable Channel */ 278 MGMT_STATUS_BUSY, /* Controller Busy */ 279 MGMT_STATUS_INVALID_PARAMS, /* Unsuitable Connection Interval */ 280 MGMT_STATUS_TIMEOUT, /* Directed Advertising Timeout */ 281 MGMT_STATUS_AUTH_FAILED, /* Terminated Due to MIC Failure */ 282 MGMT_STATUS_CONNECT_FAILED, /* Connection Establishment Failed */ 283 MGMT_STATUS_CONNECT_FAILED, /* MAC Connection Failed */ 284 }; 285 286 static u8 mgmt_errno_status(int err) 287 { 288 switch (err) { 289 case 0: 290 return MGMT_STATUS_SUCCESS; 291 case -EPERM: 292 return MGMT_STATUS_REJECTED; 293 case -EINVAL: 294 return MGMT_STATUS_INVALID_PARAMS; 295 case -EOPNOTSUPP: 296 return MGMT_STATUS_NOT_SUPPORTED; 297 case -EBUSY: 298 return MGMT_STATUS_BUSY; 299 case -ETIMEDOUT: 300 return MGMT_STATUS_AUTH_FAILED; 301 case -ENOMEM: 302 return MGMT_STATUS_NO_RESOURCES; 303 case -EISCONN: 304 return MGMT_STATUS_ALREADY_CONNECTED; 305 case -ENOTCONN: 306 return MGMT_STATUS_DISCONNECTED; 307 } 308 309 return MGMT_STATUS_FAILED; 310 } 311 312 static u8 mgmt_status(int err) 313 { 314 if (err < 0) 315 return mgmt_errno_status(err); 316 317 if (err < ARRAY_SIZE(mgmt_status_table)) 318 return mgmt_status_table[err]; 319 320 return MGMT_STATUS_FAILED; 321 } 322 323 static int mgmt_index_event(u16 event, struct hci_dev *hdev, void *data, 324 u16 len, int flag) 325 { 326 return mgmt_send_event(event, hdev, HCI_CHANNEL_CONTROL, data, len, 327 flag, NULL); 328 } 329 330 static int mgmt_limited_event(u16 event, struct hci_dev *hdev, void *data, 331 u16 len, int flag, struct sock *skip_sk) 332 { 333 return mgmt_send_event(event, hdev, HCI_CHANNEL_CONTROL, data, len, 334 flag, skip_sk); 335 } 336 337 static int mgmt_event(u16 event, struct hci_dev *hdev, void *data, u16 len, 338 struct sock *skip_sk) 339 { 340 return mgmt_send_event(event, hdev, HCI_CHANNEL_CONTROL, data, len, 341 HCI_SOCK_TRUSTED, skip_sk); 342 } 343 344 static int mgmt_event_skb(struct sk_buff *skb, struct sock *skip_sk) 345 { 346 return mgmt_send_event_skb(HCI_CHANNEL_CONTROL, skb, HCI_SOCK_TRUSTED, 347 skip_sk); 348 } 349 350 static u8 le_addr_type(u8 mgmt_addr_type) 351 { 352 if (mgmt_addr_type == BDADDR_LE_PUBLIC) 353 return ADDR_LE_DEV_PUBLIC; 354 else 355 return ADDR_LE_DEV_RANDOM; 356 } 357 358 void mgmt_fill_version_info(void *ver) 359 { 360 struct mgmt_rp_read_version *rp = ver; 361 362 rp->version = MGMT_VERSION; 363 rp->revision = cpu_to_le16(MGMT_REVISION); 364 } 365 366 static int read_version(struct sock *sk, struct hci_dev *hdev, void *data, 367 u16 data_len) 368 { 369 struct mgmt_rp_read_version rp; 370 371 bt_dev_dbg(hdev, "sock %p", sk); 372 373 mgmt_fill_version_info(&rp); 374 375 return mgmt_cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_VERSION, 0, 376 &rp, sizeof(rp)); 377 } 378 379 static int read_commands(struct sock *sk, struct hci_dev *hdev, void *data, 380 u16 data_len) 381 { 382 struct mgmt_rp_read_commands *rp; 383 u16 num_commands, num_events; 384 size_t rp_size; 385 int i, err; 386 387 bt_dev_dbg(hdev, "sock %p", sk); 388 389 if (hci_sock_test_flag(sk, HCI_SOCK_TRUSTED)) { 390 num_commands = ARRAY_SIZE(mgmt_commands); 391 num_events = ARRAY_SIZE(mgmt_events); 392 } else { 393 num_commands = ARRAY_SIZE(mgmt_untrusted_commands); 394 num_events = ARRAY_SIZE(mgmt_untrusted_events); 395 } 396 397 rp_size = sizeof(*rp) + ((num_commands + num_events) * sizeof(u16)); 398 399 rp = kmalloc(rp_size, GFP_KERNEL); 400 if (!rp) 401 return -ENOMEM; 402 403 rp->num_commands = cpu_to_le16(num_commands); 404 rp->num_events = cpu_to_le16(num_events); 405 406 if (hci_sock_test_flag(sk, HCI_SOCK_TRUSTED)) { 407 __le16 *opcode = rp->opcodes; 408 409 for (i = 0; i < num_commands; i++, opcode++) 410 put_unaligned_le16(mgmt_commands[i], opcode); 411 412 for (i = 0; i < num_events; i++, opcode++) 413 put_unaligned_le16(mgmt_events[i], opcode); 414 } else { 415 __le16 *opcode = rp->opcodes; 416 417 for (i = 0; i < num_commands; i++, opcode++) 418 put_unaligned_le16(mgmt_untrusted_commands[i], opcode); 419 420 for (i = 0; i < num_events; i++, opcode++) 421 put_unaligned_le16(mgmt_untrusted_events[i], opcode); 422 } 423 424 err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_COMMANDS, 0, 425 rp, rp_size); 426 kfree(rp); 427 428 return err; 429 } 430 431 static int read_index_list(struct sock *sk, struct hci_dev *hdev, void *data, 432 u16 data_len) 433 { 434 struct mgmt_rp_read_index_list *rp; 435 struct hci_dev *d; 436 size_t rp_len; 437 u16 count; 438 int err; 439 440 bt_dev_dbg(hdev, "sock %p", sk); 441 442 read_lock(&hci_dev_list_lock); 443 444 count = 0; 445 list_for_each_entry(d, &hci_dev_list, list) { 446 if (d->dev_type == HCI_PRIMARY && 447 !hci_dev_test_flag(d, HCI_UNCONFIGURED)) 448 count++; 449 } 450 451 rp_len = sizeof(*rp) + (2 * count); 452 rp = kmalloc(rp_len, GFP_ATOMIC); 453 if (!rp) { 454 read_unlock(&hci_dev_list_lock); 455 return -ENOMEM; 456 } 457 458 count = 0; 459 list_for_each_entry(d, &hci_dev_list, list) { 460 if (hci_dev_test_flag(d, HCI_SETUP) || 461 hci_dev_test_flag(d, HCI_CONFIG) || 462 hci_dev_test_flag(d, HCI_USER_CHANNEL)) 463 continue; 464 465 /* Devices marked as raw-only are neither configured 466 * nor unconfigured controllers. 467 */ 468 if (test_bit(HCI_QUIRK_RAW_DEVICE, &d->quirks)) 469 continue; 470 471 if (d->dev_type == HCI_PRIMARY && 472 !hci_dev_test_flag(d, HCI_UNCONFIGURED)) { 473 rp->index[count++] = cpu_to_le16(d->id); 474 bt_dev_dbg(hdev, "Added hci%u", d->id); 475 } 476 } 477 478 rp->num_controllers = cpu_to_le16(count); 479 rp_len = sizeof(*rp) + (2 * count); 480 481 read_unlock(&hci_dev_list_lock); 482 483 err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_INDEX_LIST, 484 0, rp, rp_len); 485 486 kfree(rp); 487 488 return err; 489 } 490 491 static int read_unconf_index_list(struct sock *sk, struct hci_dev *hdev, 492 void *data, u16 data_len) 493 { 494 struct mgmt_rp_read_unconf_index_list *rp; 495 struct hci_dev *d; 496 size_t rp_len; 497 u16 count; 498 int err; 499 500 bt_dev_dbg(hdev, "sock %p", sk); 501 502 read_lock(&hci_dev_list_lock); 503 504 count = 0; 505 list_for_each_entry(d, &hci_dev_list, list) { 506 if (d->dev_type == HCI_PRIMARY && 507 hci_dev_test_flag(d, HCI_UNCONFIGURED)) 508 count++; 509 } 510 511 rp_len = sizeof(*rp) + (2 * count); 512 rp = kmalloc(rp_len, GFP_ATOMIC); 513 if (!rp) { 514 read_unlock(&hci_dev_list_lock); 515 return -ENOMEM; 516 } 517 518 count = 0; 519 list_for_each_entry(d, &hci_dev_list, list) { 520 if (hci_dev_test_flag(d, HCI_SETUP) || 521 hci_dev_test_flag(d, HCI_CONFIG) || 522 hci_dev_test_flag(d, HCI_USER_CHANNEL)) 523 continue; 524 525 /* Devices marked as raw-only are neither configured 526 * nor unconfigured controllers. 527 */ 528 if (test_bit(HCI_QUIRK_RAW_DEVICE, &d->quirks)) 529 continue; 530 531 if (d->dev_type == HCI_PRIMARY && 532 hci_dev_test_flag(d, HCI_UNCONFIGURED)) { 533 rp->index[count++] = cpu_to_le16(d->id); 534 bt_dev_dbg(hdev, "Added hci%u", d->id); 535 } 536 } 537 538 rp->num_controllers = cpu_to_le16(count); 539 rp_len = sizeof(*rp) + (2 * count); 540 541 read_unlock(&hci_dev_list_lock); 542 543 err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE, 544 MGMT_OP_READ_UNCONF_INDEX_LIST, 0, rp, rp_len); 545 546 kfree(rp); 547 548 return err; 549 } 550 551 static int read_ext_index_list(struct sock *sk, struct hci_dev *hdev, 552 void *data, u16 data_len) 553 { 554 struct mgmt_rp_read_ext_index_list *rp; 555 struct hci_dev *d; 556 u16 count; 557 int err; 558 559 bt_dev_dbg(hdev, "sock %p", sk); 560 561 read_lock(&hci_dev_list_lock); 562 563 count = 0; 564 list_for_each_entry(d, &hci_dev_list, list) { 565 if (d->dev_type == HCI_PRIMARY || d->dev_type == HCI_AMP) 566 count++; 567 } 568 569 rp = kmalloc(struct_size(rp, entry, count), GFP_ATOMIC); 570 if (!rp) { 571 read_unlock(&hci_dev_list_lock); 572 return -ENOMEM; 573 } 574 575 count = 0; 576 list_for_each_entry(d, &hci_dev_list, list) { 577 if (hci_dev_test_flag(d, HCI_SETUP) || 578 hci_dev_test_flag(d, HCI_CONFIG) || 579 hci_dev_test_flag(d, HCI_USER_CHANNEL)) 580 continue; 581 582 /* Devices marked as raw-only are neither configured 583 * nor unconfigured controllers. 584 */ 585 if (test_bit(HCI_QUIRK_RAW_DEVICE, &d->quirks)) 586 continue; 587 588 if (d->dev_type == HCI_PRIMARY) { 589 if (hci_dev_test_flag(d, HCI_UNCONFIGURED)) 590 rp->entry[count].type = 0x01; 591 else 592 rp->entry[count].type = 0x00; 593 } else if (d->dev_type == HCI_AMP) { 594 rp->entry[count].type = 0x02; 595 } else { 596 continue; 597 } 598 599 rp->entry[count].bus = d->bus; 600 rp->entry[count++].index = cpu_to_le16(d->id); 601 bt_dev_dbg(hdev, "Added hci%u", d->id); 602 } 603 604 rp->num_controllers = cpu_to_le16(count); 605 606 read_unlock(&hci_dev_list_lock); 607 608 /* If this command is called at least once, then all the 609 * default index and unconfigured index events are disabled 610 * and from now on only extended index events are used. 611 */ 612 hci_sock_set_flag(sk, HCI_MGMT_EXT_INDEX_EVENTS); 613 hci_sock_clear_flag(sk, HCI_MGMT_INDEX_EVENTS); 614 hci_sock_clear_flag(sk, HCI_MGMT_UNCONF_INDEX_EVENTS); 615 616 err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE, 617 MGMT_OP_READ_EXT_INDEX_LIST, 0, rp, 618 struct_size(rp, entry, count)); 619 620 kfree(rp); 621 622 return err; 623 } 624 625 static bool is_configured(struct hci_dev *hdev) 626 { 627 if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks) && 628 !hci_dev_test_flag(hdev, HCI_EXT_CONFIGURED)) 629 return false; 630 631 if ((test_bit(HCI_QUIRK_INVALID_BDADDR, &hdev->quirks) || 632 test_bit(HCI_QUIRK_USE_BDADDR_PROPERTY, &hdev->quirks)) && 633 !bacmp(&hdev->public_addr, BDADDR_ANY)) 634 return false; 635 636 return true; 637 } 638 639 static __le32 get_missing_options(struct hci_dev *hdev) 640 { 641 u32 options = 0; 642 643 if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks) && 644 !hci_dev_test_flag(hdev, HCI_EXT_CONFIGURED)) 645 options |= MGMT_OPTION_EXTERNAL_CONFIG; 646 647 if ((test_bit(HCI_QUIRK_INVALID_BDADDR, &hdev->quirks) || 648 test_bit(HCI_QUIRK_USE_BDADDR_PROPERTY, &hdev->quirks)) && 649 !bacmp(&hdev->public_addr, BDADDR_ANY)) 650 options |= MGMT_OPTION_PUBLIC_ADDRESS; 651 652 return cpu_to_le32(options); 653 } 654 655 static int new_options(struct hci_dev *hdev, struct sock *skip) 656 { 657 __le32 options = get_missing_options(hdev); 658 659 return mgmt_limited_event(MGMT_EV_NEW_CONFIG_OPTIONS, hdev, &options, 660 sizeof(options), HCI_MGMT_OPTION_EVENTS, skip); 661 } 662 663 static int send_options_rsp(struct sock *sk, u16 opcode, struct hci_dev *hdev) 664 { 665 __le32 options = get_missing_options(hdev); 666 667 return mgmt_cmd_complete(sk, hdev->id, opcode, 0, &options, 668 sizeof(options)); 669 } 670 671 static int read_config_info(struct sock *sk, struct hci_dev *hdev, 672 void *data, u16 data_len) 673 { 674 struct mgmt_rp_read_config_info rp; 675 u32 options = 0; 676 677 bt_dev_dbg(hdev, "sock %p", sk); 678 679 hci_dev_lock(hdev); 680 681 memset(&rp, 0, sizeof(rp)); 682 rp.manufacturer = cpu_to_le16(hdev->manufacturer); 683 684 if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks)) 685 options |= MGMT_OPTION_EXTERNAL_CONFIG; 686 687 if (hdev->set_bdaddr) 688 options |= MGMT_OPTION_PUBLIC_ADDRESS; 689 690 rp.supported_options = cpu_to_le32(options); 691 rp.missing_options = get_missing_options(hdev); 692 693 hci_dev_unlock(hdev); 694 695 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_CONFIG_INFO, 0, 696 &rp, sizeof(rp)); 697 } 698 699 static u32 get_supported_phys(struct hci_dev *hdev) 700 { 701 u32 supported_phys = 0; 702 703 if (lmp_bredr_capable(hdev)) { 704 supported_phys |= MGMT_PHY_BR_1M_1SLOT; 705 706 if (hdev->features[0][0] & LMP_3SLOT) 707 supported_phys |= MGMT_PHY_BR_1M_3SLOT; 708 709 if (hdev->features[0][0] & LMP_5SLOT) 710 supported_phys |= MGMT_PHY_BR_1M_5SLOT; 711 712 if (lmp_edr_2m_capable(hdev)) { 713 supported_phys |= MGMT_PHY_EDR_2M_1SLOT; 714 715 if (lmp_edr_3slot_capable(hdev)) 716 supported_phys |= MGMT_PHY_EDR_2M_3SLOT; 717 718 if (lmp_edr_5slot_capable(hdev)) 719 supported_phys |= MGMT_PHY_EDR_2M_5SLOT; 720 721 if (lmp_edr_3m_capable(hdev)) { 722 supported_phys |= MGMT_PHY_EDR_3M_1SLOT; 723 724 if (lmp_edr_3slot_capable(hdev)) 725 supported_phys |= MGMT_PHY_EDR_3M_3SLOT; 726 727 if (lmp_edr_5slot_capable(hdev)) 728 supported_phys |= MGMT_PHY_EDR_3M_5SLOT; 729 } 730 } 731 } 732 733 if (lmp_le_capable(hdev)) { 734 supported_phys |= MGMT_PHY_LE_1M_TX; 735 supported_phys |= MGMT_PHY_LE_1M_RX; 736 737 if (hdev->le_features[1] & HCI_LE_PHY_2M) { 738 supported_phys |= MGMT_PHY_LE_2M_TX; 739 supported_phys |= MGMT_PHY_LE_2M_RX; 740 } 741 742 if (hdev->le_features[1] & HCI_LE_PHY_CODED) { 743 supported_phys |= MGMT_PHY_LE_CODED_TX; 744 supported_phys |= MGMT_PHY_LE_CODED_RX; 745 } 746 } 747 748 return supported_phys; 749 } 750 751 static u32 get_selected_phys(struct hci_dev *hdev) 752 { 753 u32 selected_phys = 0; 754 755 if (lmp_bredr_capable(hdev)) { 756 selected_phys |= MGMT_PHY_BR_1M_1SLOT; 757 758 if (hdev->pkt_type & (HCI_DM3 | HCI_DH3)) 759 selected_phys |= MGMT_PHY_BR_1M_3SLOT; 760 761 if (hdev->pkt_type & (HCI_DM5 | HCI_DH5)) 762 selected_phys |= MGMT_PHY_BR_1M_5SLOT; 763 764 if (lmp_edr_2m_capable(hdev)) { 765 if (!(hdev->pkt_type & HCI_2DH1)) 766 selected_phys |= MGMT_PHY_EDR_2M_1SLOT; 767 768 if (lmp_edr_3slot_capable(hdev) && 769 !(hdev->pkt_type & HCI_2DH3)) 770 selected_phys |= MGMT_PHY_EDR_2M_3SLOT; 771 772 if (lmp_edr_5slot_capable(hdev) && 773 !(hdev->pkt_type & HCI_2DH5)) 774 selected_phys |= MGMT_PHY_EDR_2M_5SLOT; 775 776 if (lmp_edr_3m_capable(hdev)) { 777 if (!(hdev->pkt_type & HCI_3DH1)) 778 selected_phys |= MGMT_PHY_EDR_3M_1SLOT; 779 780 if (lmp_edr_3slot_capable(hdev) && 781 !(hdev->pkt_type & HCI_3DH3)) 782 selected_phys |= MGMT_PHY_EDR_3M_3SLOT; 783 784 if (lmp_edr_5slot_capable(hdev) && 785 !(hdev->pkt_type & HCI_3DH5)) 786 selected_phys |= MGMT_PHY_EDR_3M_5SLOT; 787 } 788 } 789 } 790 791 if (lmp_le_capable(hdev)) { 792 if (hdev->le_tx_def_phys & HCI_LE_SET_PHY_1M) 793 selected_phys |= MGMT_PHY_LE_1M_TX; 794 795 if (hdev->le_rx_def_phys & HCI_LE_SET_PHY_1M) 796 selected_phys |= MGMT_PHY_LE_1M_RX; 797 798 if (hdev->le_tx_def_phys & HCI_LE_SET_PHY_2M) 799 selected_phys |= MGMT_PHY_LE_2M_TX; 800 801 if (hdev->le_rx_def_phys & HCI_LE_SET_PHY_2M) 802 selected_phys |= MGMT_PHY_LE_2M_RX; 803 804 if (hdev->le_tx_def_phys & HCI_LE_SET_PHY_CODED) 805 selected_phys |= MGMT_PHY_LE_CODED_TX; 806 807 if (hdev->le_rx_def_phys & HCI_LE_SET_PHY_CODED) 808 selected_phys |= MGMT_PHY_LE_CODED_RX; 809 } 810 811 return selected_phys; 812 } 813 814 static u32 get_configurable_phys(struct hci_dev *hdev) 815 { 816 return (get_supported_phys(hdev) & ~MGMT_PHY_BR_1M_1SLOT & 817 ~MGMT_PHY_LE_1M_TX & ~MGMT_PHY_LE_1M_RX); 818 } 819 820 static u32 get_supported_settings(struct hci_dev *hdev) 821 { 822 u32 settings = 0; 823 824 settings |= MGMT_SETTING_POWERED; 825 settings |= MGMT_SETTING_BONDABLE; 826 settings |= MGMT_SETTING_DEBUG_KEYS; 827 settings |= MGMT_SETTING_CONNECTABLE; 828 settings |= MGMT_SETTING_DISCOVERABLE; 829 830 if (lmp_bredr_capable(hdev)) { 831 if (hdev->hci_ver >= BLUETOOTH_VER_1_2) 832 settings |= MGMT_SETTING_FAST_CONNECTABLE; 833 settings |= MGMT_SETTING_BREDR; 834 settings |= MGMT_SETTING_LINK_SECURITY; 835 836 if (lmp_ssp_capable(hdev)) { 837 settings |= MGMT_SETTING_SSP; 838 if (IS_ENABLED(CONFIG_BT_HS)) 839 settings |= MGMT_SETTING_HS; 840 } 841 842 if (lmp_sc_capable(hdev)) 843 settings |= MGMT_SETTING_SECURE_CONN; 844 845 if (test_bit(HCI_QUIRK_WIDEBAND_SPEECH_SUPPORTED, 846 &hdev->quirks)) 847 settings |= MGMT_SETTING_WIDEBAND_SPEECH; 848 } 849 850 if (lmp_le_capable(hdev)) { 851 settings |= MGMT_SETTING_LE; 852 settings |= MGMT_SETTING_SECURE_CONN; 853 settings |= MGMT_SETTING_PRIVACY; 854 settings |= MGMT_SETTING_STATIC_ADDRESS; 855 settings |= MGMT_SETTING_ADVERTISING; 856 } 857 858 if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks) || 859 hdev->set_bdaddr) 860 settings |= MGMT_SETTING_CONFIGURATION; 861 862 if (cis_central_capable(hdev)) 863 settings |= MGMT_SETTING_CIS_CENTRAL; 864 865 if (cis_peripheral_capable(hdev)) 866 settings |= MGMT_SETTING_CIS_PERIPHERAL; 867 868 settings |= MGMT_SETTING_PHY_CONFIGURATION; 869 870 return settings; 871 } 872 873 static u32 get_current_settings(struct hci_dev *hdev) 874 { 875 u32 settings = 0; 876 877 if (hdev_is_powered(hdev)) 878 settings |= MGMT_SETTING_POWERED; 879 880 if (hci_dev_test_flag(hdev, HCI_CONNECTABLE)) 881 settings |= MGMT_SETTING_CONNECTABLE; 882 883 if (hci_dev_test_flag(hdev, HCI_FAST_CONNECTABLE)) 884 settings |= MGMT_SETTING_FAST_CONNECTABLE; 885 886 if (hci_dev_test_flag(hdev, HCI_DISCOVERABLE)) 887 settings |= MGMT_SETTING_DISCOVERABLE; 888 889 if (hci_dev_test_flag(hdev, HCI_BONDABLE)) 890 settings |= MGMT_SETTING_BONDABLE; 891 892 if (hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) 893 settings |= MGMT_SETTING_BREDR; 894 895 if (hci_dev_test_flag(hdev, HCI_LE_ENABLED)) 896 settings |= MGMT_SETTING_LE; 897 898 if (hci_dev_test_flag(hdev, HCI_LINK_SECURITY)) 899 settings |= MGMT_SETTING_LINK_SECURITY; 900 901 if (hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) 902 settings |= MGMT_SETTING_SSP; 903 904 if (hci_dev_test_flag(hdev, HCI_HS_ENABLED)) 905 settings |= MGMT_SETTING_HS; 906 907 if (hci_dev_test_flag(hdev, HCI_ADVERTISING)) 908 settings |= MGMT_SETTING_ADVERTISING; 909 910 if (hci_dev_test_flag(hdev, HCI_SC_ENABLED)) 911 settings |= MGMT_SETTING_SECURE_CONN; 912 913 if (hci_dev_test_flag(hdev, HCI_KEEP_DEBUG_KEYS)) 914 settings |= MGMT_SETTING_DEBUG_KEYS; 915 916 if (hci_dev_test_flag(hdev, HCI_PRIVACY)) 917 settings |= MGMT_SETTING_PRIVACY; 918 919 /* The current setting for static address has two purposes. The 920 * first is to indicate if the static address will be used and 921 * the second is to indicate if it is actually set. 922 * 923 * This means if the static address is not configured, this flag 924 * will never be set. If the address is configured, then if the 925 * address is actually used decides if the flag is set or not. 926 * 927 * For single mode LE only controllers and dual-mode controllers 928 * with BR/EDR disabled, the existence of the static address will 929 * be evaluated. 930 */ 931 if (hci_dev_test_flag(hdev, HCI_FORCE_STATIC_ADDR) || 932 !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) || 933 !bacmp(&hdev->bdaddr, BDADDR_ANY)) { 934 if (bacmp(&hdev->static_addr, BDADDR_ANY)) 935 settings |= MGMT_SETTING_STATIC_ADDRESS; 936 } 937 938 if (hci_dev_test_flag(hdev, HCI_WIDEBAND_SPEECH_ENABLED)) 939 settings |= MGMT_SETTING_WIDEBAND_SPEECH; 940 941 if (cis_central_capable(hdev)) 942 settings |= MGMT_SETTING_CIS_CENTRAL; 943 944 if (cis_peripheral_capable(hdev)) 945 settings |= MGMT_SETTING_CIS_PERIPHERAL; 946 947 if (bis_capable(hdev)) 948 settings |= MGMT_SETTING_ISO_BROADCASTER; 949 950 if (sync_recv_capable(hdev)) 951 settings |= MGMT_SETTING_ISO_SYNC_RECEIVER; 952 953 return settings; 954 } 955 956 static struct mgmt_pending_cmd *pending_find(u16 opcode, struct hci_dev *hdev) 957 { 958 return mgmt_pending_find(HCI_CHANNEL_CONTROL, opcode, hdev); 959 } 960 961 u8 mgmt_get_adv_discov_flags(struct hci_dev *hdev) 962 { 963 struct mgmt_pending_cmd *cmd; 964 965 /* If there's a pending mgmt command the flags will not yet have 966 * their final values, so check for this first. 967 */ 968 cmd = pending_find(MGMT_OP_SET_DISCOVERABLE, hdev); 969 if (cmd) { 970 struct mgmt_mode *cp = cmd->param; 971 if (cp->val == 0x01) 972 return LE_AD_GENERAL; 973 else if (cp->val == 0x02) 974 return LE_AD_LIMITED; 975 } else { 976 if (hci_dev_test_flag(hdev, HCI_LIMITED_DISCOVERABLE)) 977 return LE_AD_LIMITED; 978 else if (hci_dev_test_flag(hdev, HCI_DISCOVERABLE)) 979 return LE_AD_GENERAL; 980 } 981 982 return 0; 983 } 984 985 bool mgmt_get_connectable(struct hci_dev *hdev) 986 { 987 struct mgmt_pending_cmd *cmd; 988 989 /* If there's a pending mgmt command the flag will not yet have 990 * it's final value, so check for this first. 991 */ 992 cmd = pending_find(MGMT_OP_SET_CONNECTABLE, hdev); 993 if (cmd) { 994 struct mgmt_mode *cp = cmd->param; 995 996 return cp->val; 997 } 998 999 return hci_dev_test_flag(hdev, HCI_CONNECTABLE); 1000 } 1001 1002 static int service_cache_sync(struct hci_dev *hdev, void *data) 1003 { 1004 hci_update_eir_sync(hdev); 1005 hci_update_class_sync(hdev); 1006 1007 return 0; 1008 } 1009 1010 static void service_cache_off(struct work_struct *work) 1011 { 1012 struct hci_dev *hdev = container_of(work, struct hci_dev, 1013 service_cache.work); 1014 1015 if (!hci_dev_test_and_clear_flag(hdev, HCI_SERVICE_CACHE)) 1016 return; 1017 1018 hci_cmd_sync_queue(hdev, service_cache_sync, NULL, NULL); 1019 } 1020 1021 static int rpa_expired_sync(struct hci_dev *hdev, void *data) 1022 { 1023 /* The generation of a new RPA and programming it into the 1024 * controller happens in the hci_req_enable_advertising() 1025 * function. 1026 */ 1027 if (ext_adv_capable(hdev)) 1028 return hci_start_ext_adv_sync(hdev, hdev->cur_adv_instance); 1029 else 1030 return hci_enable_advertising_sync(hdev); 1031 } 1032 1033 static void rpa_expired(struct work_struct *work) 1034 { 1035 struct hci_dev *hdev = container_of(work, struct hci_dev, 1036 rpa_expired.work); 1037 1038 bt_dev_dbg(hdev, ""); 1039 1040 hci_dev_set_flag(hdev, HCI_RPA_EXPIRED); 1041 1042 if (!hci_dev_test_flag(hdev, HCI_ADVERTISING)) 1043 return; 1044 1045 hci_cmd_sync_queue(hdev, rpa_expired_sync, NULL, NULL); 1046 } 1047 1048 static int set_discoverable_sync(struct hci_dev *hdev, void *data); 1049 1050 static void discov_off(struct work_struct *work) 1051 { 1052 struct hci_dev *hdev = container_of(work, struct hci_dev, 1053 discov_off.work); 1054 1055 bt_dev_dbg(hdev, ""); 1056 1057 hci_dev_lock(hdev); 1058 1059 /* When discoverable timeout triggers, then just make sure 1060 * the limited discoverable flag is cleared. Even in the case 1061 * of a timeout triggered from general discoverable, it is 1062 * safe to unconditionally clear the flag. 1063 */ 1064 hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE); 1065 hci_dev_clear_flag(hdev, HCI_DISCOVERABLE); 1066 hdev->discov_timeout = 0; 1067 1068 hci_cmd_sync_queue(hdev, set_discoverable_sync, NULL, NULL); 1069 1070 mgmt_new_settings(hdev); 1071 1072 hci_dev_unlock(hdev); 1073 } 1074 1075 static int send_settings_rsp(struct sock *sk, u16 opcode, struct hci_dev *hdev); 1076 1077 static void mesh_send_complete(struct hci_dev *hdev, 1078 struct mgmt_mesh_tx *mesh_tx, bool silent) 1079 { 1080 u8 handle = mesh_tx->handle; 1081 1082 if (!silent) 1083 mgmt_event(MGMT_EV_MESH_PACKET_CMPLT, hdev, &handle, 1084 sizeof(handle), NULL); 1085 1086 mgmt_mesh_remove(mesh_tx); 1087 } 1088 1089 static int mesh_send_done_sync(struct hci_dev *hdev, void *data) 1090 { 1091 struct mgmt_mesh_tx *mesh_tx; 1092 1093 hci_dev_clear_flag(hdev, HCI_MESH_SENDING); 1094 hci_disable_advertising_sync(hdev); 1095 mesh_tx = mgmt_mesh_next(hdev, NULL); 1096 1097 if (mesh_tx) 1098 mesh_send_complete(hdev, mesh_tx, false); 1099 1100 return 0; 1101 } 1102 1103 static int mesh_send_sync(struct hci_dev *hdev, void *data); 1104 static void mesh_send_start_complete(struct hci_dev *hdev, void *data, int err); 1105 static void mesh_next(struct hci_dev *hdev, void *data, int err) 1106 { 1107 struct mgmt_mesh_tx *mesh_tx = mgmt_mesh_next(hdev, NULL); 1108 1109 if (!mesh_tx) 1110 return; 1111 1112 err = hci_cmd_sync_queue(hdev, mesh_send_sync, mesh_tx, 1113 mesh_send_start_complete); 1114 1115 if (err < 0) 1116 mesh_send_complete(hdev, mesh_tx, false); 1117 else 1118 hci_dev_set_flag(hdev, HCI_MESH_SENDING); 1119 } 1120 1121 static void mesh_send_done(struct work_struct *work) 1122 { 1123 struct hci_dev *hdev = container_of(work, struct hci_dev, 1124 mesh_send_done.work); 1125 1126 if (!hci_dev_test_flag(hdev, HCI_MESH_SENDING)) 1127 return; 1128 1129 hci_cmd_sync_queue(hdev, mesh_send_done_sync, NULL, mesh_next); 1130 } 1131 1132 static void mgmt_init_hdev(struct sock *sk, struct hci_dev *hdev) 1133 { 1134 if (hci_dev_test_flag(hdev, HCI_MGMT)) 1135 return; 1136 1137 BT_INFO("MGMT ver %d.%d", MGMT_VERSION, MGMT_REVISION); 1138 1139 INIT_DELAYED_WORK(&hdev->discov_off, discov_off); 1140 INIT_DELAYED_WORK(&hdev->service_cache, service_cache_off); 1141 INIT_DELAYED_WORK(&hdev->rpa_expired, rpa_expired); 1142 INIT_DELAYED_WORK(&hdev->mesh_send_done, mesh_send_done); 1143 1144 /* Non-mgmt controlled devices get this bit set 1145 * implicitly so that pairing works for them, however 1146 * for mgmt we require user-space to explicitly enable 1147 * it 1148 */ 1149 hci_dev_clear_flag(hdev, HCI_BONDABLE); 1150 1151 hci_dev_set_flag(hdev, HCI_MGMT); 1152 } 1153 1154 static int read_controller_info(struct sock *sk, struct hci_dev *hdev, 1155 void *data, u16 data_len) 1156 { 1157 struct mgmt_rp_read_info rp; 1158 1159 bt_dev_dbg(hdev, "sock %p", sk); 1160 1161 hci_dev_lock(hdev); 1162 1163 memset(&rp, 0, sizeof(rp)); 1164 1165 bacpy(&rp.bdaddr, &hdev->bdaddr); 1166 1167 rp.version = hdev->hci_ver; 1168 rp.manufacturer = cpu_to_le16(hdev->manufacturer); 1169 1170 rp.supported_settings = cpu_to_le32(get_supported_settings(hdev)); 1171 rp.current_settings = cpu_to_le32(get_current_settings(hdev)); 1172 1173 memcpy(rp.dev_class, hdev->dev_class, 3); 1174 1175 memcpy(rp.name, hdev->dev_name, sizeof(hdev->dev_name)); 1176 memcpy(rp.short_name, hdev->short_name, sizeof(hdev->short_name)); 1177 1178 hci_dev_unlock(hdev); 1179 1180 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_INFO, 0, &rp, 1181 sizeof(rp)); 1182 } 1183 1184 static u16 append_eir_data_to_buf(struct hci_dev *hdev, u8 *eir) 1185 { 1186 u16 eir_len = 0; 1187 size_t name_len; 1188 1189 if (hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) 1190 eir_len = eir_append_data(eir, eir_len, EIR_CLASS_OF_DEV, 1191 hdev->dev_class, 3); 1192 1193 if (hci_dev_test_flag(hdev, HCI_LE_ENABLED)) 1194 eir_len = eir_append_le16(eir, eir_len, EIR_APPEARANCE, 1195 hdev->appearance); 1196 1197 name_len = strnlen(hdev->dev_name, sizeof(hdev->dev_name)); 1198 eir_len = eir_append_data(eir, eir_len, EIR_NAME_COMPLETE, 1199 hdev->dev_name, name_len); 1200 1201 name_len = strnlen(hdev->short_name, sizeof(hdev->short_name)); 1202 eir_len = eir_append_data(eir, eir_len, EIR_NAME_SHORT, 1203 hdev->short_name, name_len); 1204 1205 return eir_len; 1206 } 1207 1208 static int read_ext_controller_info(struct sock *sk, struct hci_dev *hdev, 1209 void *data, u16 data_len) 1210 { 1211 char buf[512]; 1212 struct mgmt_rp_read_ext_info *rp = (void *)buf; 1213 u16 eir_len; 1214 1215 bt_dev_dbg(hdev, "sock %p", sk); 1216 1217 memset(&buf, 0, sizeof(buf)); 1218 1219 hci_dev_lock(hdev); 1220 1221 bacpy(&rp->bdaddr, &hdev->bdaddr); 1222 1223 rp->version = hdev->hci_ver; 1224 rp->manufacturer = cpu_to_le16(hdev->manufacturer); 1225 1226 rp->supported_settings = cpu_to_le32(get_supported_settings(hdev)); 1227 rp->current_settings = cpu_to_le32(get_current_settings(hdev)); 1228 1229 1230 eir_len = append_eir_data_to_buf(hdev, rp->eir); 1231 rp->eir_len = cpu_to_le16(eir_len); 1232 1233 hci_dev_unlock(hdev); 1234 1235 /* If this command is called at least once, then the events 1236 * for class of device and local name changes are disabled 1237 * and only the new extended controller information event 1238 * is used. 1239 */ 1240 hci_sock_set_flag(sk, HCI_MGMT_EXT_INFO_EVENTS); 1241 hci_sock_clear_flag(sk, HCI_MGMT_DEV_CLASS_EVENTS); 1242 hci_sock_clear_flag(sk, HCI_MGMT_LOCAL_NAME_EVENTS); 1243 1244 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_EXT_INFO, 0, rp, 1245 sizeof(*rp) + eir_len); 1246 } 1247 1248 static int ext_info_changed(struct hci_dev *hdev, struct sock *skip) 1249 { 1250 char buf[512]; 1251 struct mgmt_ev_ext_info_changed *ev = (void *)buf; 1252 u16 eir_len; 1253 1254 memset(buf, 0, sizeof(buf)); 1255 1256 eir_len = append_eir_data_to_buf(hdev, ev->eir); 1257 ev->eir_len = cpu_to_le16(eir_len); 1258 1259 return mgmt_limited_event(MGMT_EV_EXT_INFO_CHANGED, hdev, ev, 1260 sizeof(*ev) + eir_len, 1261 HCI_MGMT_EXT_INFO_EVENTS, skip); 1262 } 1263 1264 static int send_settings_rsp(struct sock *sk, u16 opcode, struct hci_dev *hdev) 1265 { 1266 __le32 settings = cpu_to_le32(get_current_settings(hdev)); 1267 1268 return mgmt_cmd_complete(sk, hdev->id, opcode, 0, &settings, 1269 sizeof(settings)); 1270 } 1271 1272 void mgmt_advertising_added(struct sock *sk, struct hci_dev *hdev, u8 instance) 1273 { 1274 struct mgmt_ev_advertising_added ev; 1275 1276 ev.instance = instance; 1277 1278 mgmt_event(MGMT_EV_ADVERTISING_ADDED, hdev, &ev, sizeof(ev), sk); 1279 } 1280 1281 void mgmt_advertising_removed(struct sock *sk, struct hci_dev *hdev, 1282 u8 instance) 1283 { 1284 struct mgmt_ev_advertising_removed ev; 1285 1286 ev.instance = instance; 1287 1288 mgmt_event(MGMT_EV_ADVERTISING_REMOVED, hdev, &ev, sizeof(ev), sk); 1289 } 1290 1291 static void cancel_adv_timeout(struct hci_dev *hdev) 1292 { 1293 if (hdev->adv_instance_timeout) { 1294 hdev->adv_instance_timeout = 0; 1295 cancel_delayed_work(&hdev->adv_instance_expire); 1296 } 1297 } 1298 1299 /* This function requires the caller holds hdev->lock */ 1300 static void restart_le_actions(struct hci_dev *hdev) 1301 { 1302 struct hci_conn_params *p; 1303 1304 list_for_each_entry(p, &hdev->le_conn_params, list) { 1305 /* Needed for AUTO_OFF case where might not "really" 1306 * have been powered off. 1307 */ 1308 hci_pend_le_list_del_init(p); 1309 1310 switch (p->auto_connect) { 1311 case HCI_AUTO_CONN_DIRECT: 1312 case HCI_AUTO_CONN_ALWAYS: 1313 hci_pend_le_list_add(p, &hdev->pend_le_conns); 1314 break; 1315 case HCI_AUTO_CONN_REPORT: 1316 hci_pend_le_list_add(p, &hdev->pend_le_reports); 1317 break; 1318 default: 1319 break; 1320 } 1321 } 1322 } 1323 1324 static int new_settings(struct hci_dev *hdev, struct sock *skip) 1325 { 1326 __le32 ev = cpu_to_le32(get_current_settings(hdev)); 1327 1328 return mgmt_limited_event(MGMT_EV_NEW_SETTINGS, hdev, &ev, 1329 sizeof(ev), HCI_MGMT_SETTING_EVENTS, skip); 1330 } 1331 1332 static void mgmt_set_powered_complete(struct hci_dev *hdev, void *data, int err) 1333 { 1334 struct mgmt_pending_cmd *cmd = data; 1335 struct mgmt_mode *cp; 1336 1337 /* Make sure cmd still outstanding. */ 1338 if (cmd != pending_find(MGMT_OP_SET_POWERED, hdev)) 1339 return; 1340 1341 cp = cmd->param; 1342 1343 bt_dev_dbg(hdev, "err %d", err); 1344 1345 if (!err) { 1346 if (cp->val) { 1347 hci_dev_lock(hdev); 1348 restart_le_actions(hdev); 1349 hci_update_passive_scan(hdev); 1350 hci_dev_unlock(hdev); 1351 } 1352 1353 send_settings_rsp(cmd->sk, cmd->opcode, hdev); 1354 1355 /* Only call new_setting for power on as power off is deferred 1356 * to hdev->power_off work which does call hci_dev_do_close. 1357 */ 1358 if (cp->val) 1359 new_settings(hdev, cmd->sk); 1360 } else { 1361 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_POWERED, 1362 mgmt_status(err)); 1363 } 1364 1365 mgmt_pending_remove(cmd); 1366 } 1367 1368 static int set_powered_sync(struct hci_dev *hdev, void *data) 1369 { 1370 struct mgmt_pending_cmd *cmd = data; 1371 struct mgmt_mode *cp = cmd->param; 1372 1373 BT_DBG("%s", hdev->name); 1374 1375 return hci_set_powered_sync(hdev, cp->val); 1376 } 1377 1378 static int set_powered(struct sock *sk, struct hci_dev *hdev, void *data, 1379 u16 len) 1380 { 1381 struct mgmt_mode *cp = data; 1382 struct mgmt_pending_cmd *cmd; 1383 int err; 1384 1385 bt_dev_dbg(hdev, "sock %p", sk); 1386 1387 if (cp->val != 0x00 && cp->val != 0x01) 1388 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED, 1389 MGMT_STATUS_INVALID_PARAMS); 1390 1391 hci_dev_lock(hdev); 1392 1393 if (pending_find(MGMT_OP_SET_POWERED, hdev)) { 1394 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED, 1395 MGMT_STATUS_BUSY); 1396 goto failed; 1397 } 1398 1399 if (!!cp->val == hdev_is_powered(hdev)) { 1400 err = send_settings_rsp(sk, MGMT_OP_SET_POWERED, hdev); 1401 goto failed; 1402 } 1403 1404 cmd = mgmt_pending_add(sk, MGMT_OP_SET_POWERED, hdev, data, len); 1405 if (!cmd) { 1406 err = -ENOMEM; 1407 goto failed; 1408 } 1409 1410 /* Cancel potentially blocking sync operation before power off */ 1411 if (cp->val == 0x00) { 1412 __hci_cmd_sync_cancel(hdev, -EHOSTDOWN); 1413 err = hci_cmd_sync_queue(hdev, set_powered_sync, cmd, 1414 mgmt_set_powered_complete); 1415 } else { 1416 /* Use hci_cmd_sync_submit since hdev might not be running */ 1417 err = hci_cmd_sync_submit(hdev, set_powered_sync, cmd, 1418 mgmt_set_powered_complete); 1419 } 1420 1421 if (err < 0) 1422 mgmt_pending_remove(cmd); 1423 1424 failed: 1425 hci_dev_unlock(hdev); 1426 return err; 1427 } 1428 1429 int mgmt_new_settings(struct hci_dev *hdev) 1430 { 1431 return new_settings(hdev, NULL); 1432 } 1433 1434 struct cmd_lookup { 1435 struct sock *sk; 1436 struct hci_dev *hdev; 1437 u8 mgmt_status; 1438 }; 1439 1440 static void settings_rsp(struct mgmt_pending_cmd *cmd, void *data) 1441 { 1442 struct cmd_lookup *match = data; 1443 1444 send_settings_rsp(cmd->sk, cmd->opcode, match->hdev); 1445 1446 list_del(&cmd->list); 1447 1448 if (match->sk == NULL) { 1449 match->sk = cmd->sk; 1450 sock_hold(match->sk); 1451 } 1452 1453 mgmt_pending_free(cmd); 1454 } 1455 1456 static void cmd_status_rsp(struct mgmt_pending_cmd *cmd, void *data) 1457 { 1458 u8 *status = data; 1459 1460 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, *status); 1461 mgmt_pending_remove(cmd); 1462 } 1463 1464 static void cmd_complete_rsp(struct mgmt_pending_cmd *cmd, void *data) 1465 { 1466 if (cmd->cmd_complete) { 1467 u8 *status = data; 1468 1469 cmd->cmd_complete(cmd, *status); 1470 mgmt_pending_remove(cmd); 1471 1472 return; 1473 } 1474 1475 cmd_status_rsp(cmd, data); 1476 } 1477 1478 static int generic_cmd_complete(struct mgmt_pending_cmd *cmd, u8 status) 1479 { 1480 return mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, status, 1481 cmd->param, cmd->param_len); 1482 } 1483 1484 static int addr_cmd_complete(struct mgmt_pending_cmd *cmd, u8 status) 1485 { 1486 return mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, status, 1487 cmd->param, sizeof(struct mgmt_addr_info)); 1488 } 1489 1490 static u8 mgmt_bredr_support(struct hci_dev *hdev) 1491 { 1492 if (!lmp_bredr_capable(hdev)) 1493 return MGMT_STATUS_NOT_SUPPORTED; 1494 else if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) 1495 return MGMT_STATUS_REJECTED; 1496 else 1497 return MGMT_STATUS_SUCCESS; 1498 } 1499 1500 static u8 mgmt_le_support(struct hci_dev *hdev) 1501 { 1502 if (!lmp_le_capable(hdev)) 1503 return MGMT_STATUS_NOT_SUPPORTED; 1504 else if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED)) 1505 return MGMT_STATUS_REJECTED; 1506 else 1507 return MGMT_STATUS_SUCCESS; 1508 } 1509 1510 static void mgmt_set_discoverable_complete(struct hci_dev *hdev, void *data, 1511 int err) 1512 { 1513 struct mgmt_pending_cmd *cmd = data; 1514 1515 bt_dev_dbg(hdev, "err %d", err); 1516 1517 /* Make sure cmd still outstanding. */ 1518 if (cmd != pending_find(MGMT_OP_SET_DISCOVERABLE, hdev)) 1519 return; 1520 1521 hci_dev_lock(hdev); 1522 1523 if (err) { 1524 u8 mgmt_err = mgmt_status(err); 1525 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err); 1526 hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE); 1527 goto done; 1528 } 1529 1530 if (hci_dev_test_flag(hdev, HCI_DISCOVERABLE) && 1531 hdev->discov_timeout > 0) { 1532 int to = msecs_to_jiffies(hdev->discov_timeout * 1000); 1533 queue_delayed_work(hdev->req_workqueue, &hdev->discov_off, to); 1534 } 1535 1536 send_settings_rsp(cmd->sk, MGMT_OP_SET_DISCOVERABLE, hdev); 1537 new_settings(hdev, cmd->sk); 1538 1539 done: 1540 mgmt_pending_remove(cmd); 1541 hci_dev_unlock(hdev); 1542 } 1543 1544 static int set_discoverable_sync(struct hci_dev *hdev, void *data) 1545 { 1546 BT_DBG("%s", hdev->name); 1547 1548 return hci_update_discoverable_sync(hdev); 1549 } 1550 1551 static int set_discoverable(struct sock *sk, struct hci_dev *hdev, void *data, 1552 u16 len) 1553 { 1554 struct mgmt_cp_set_discoverable *cp = data; 1555 struct mgmt_pending_cmd *cmd; 1556 u16 timeout; 1557 int err; 1558 1559 bt_dev_dbg(hdev, "sock %p", sk); 1560 1561 if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED) && 1562 !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) 1563 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE, 1564 MGMT_STATUS_REJECTED); 1565 1566 if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02) 1567 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE, 1568 MGMT_STATUS_INVALID_PARAMS); 1569 1570 timeout = __le16_to_cpu(cp->timeout); 1571 1572 /* Disabling discoverable requires that no timeout is set, 1573 * and enabling limited discoverable requires a timeout. 1574 */ 1575 if ((cp->val == 0x00 && timeout > 0) || 1576 (cp->val == 0x02 && timeout == 0)) 1577 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE, 1578 MGMT_STATUS_INVALID_PARAMS); 1579 1580 hci_dev_lock(hdev); 1581 1582 if (!hdev_is_powered(hdev) && timeout > 0) { 1583 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE, 1584 MGMT_STATUS_NOT_POWERED); 1585 goto failed; 1586 } 1587 1588 if (pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) || 1589 pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) { 1590 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE, 1591 MGMT_STATUS_BUSY); 1592 goto failed; 1593 } 1594 1595 if (!hci_dev_test_flag(hdev, HCI_CONNECTABLE)) { 1596 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE, 1597 MGMT_STATUS_REJECTED); 1598 goto failed; 1599 } 1600 1601 if (hdev->advertising_paused) { 1602 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE, 1603 MGMT_STATUS_BUSY); 1604 goto failed; 1605 } 1606 1607 if (!hdev_is_powered(hdev)) { 1608 bool changed = false; 1609 1610 /* Setting limited discoverable when powered off is 1611 * not a valid operation since it requires a timeout 1612 * and so no need to check HCI_LIMITED_DISCOVERABLE. 1613 */ 1614 if (!!cp->val != hci_dev_test_flag(hdev, HCI_DISCOVERABLE)) { 1615 hci_dev_change_flag(hdev, HCI_DISCOVERABLE); 1616 changed = true; 1617 } 1618 1619 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev); 1620 if (err < 0) 1621 goto failed; 1622 1623 if (changed) 1624 err = new_settings(hdev, sk); 1625 1626 goto failed; 1627 } 1628 1629 /* If the current mode is the same, then just update the timeout 1630 * value with the new value. And if only the timeout gets updated, 1631 * then no need for any HCI transactions. 1632 */ 1633 if (!!cp->val == hci_dev_test_flag(hdev, HCI_DISCOVERABLE) && 1634 (cp->val == 0x02) == hci_dev_test_flag(hdev, 1635 HCI_LIMITED_DISCOVERABLE)) { 1636 cancel_delayed_work(&hdev->discov_off); 1637 hdev->discov_timeout = timeout; 1638 1639 if (cp->val && hdev->discov_timeout > 0) { 1640 int to = msecs_to_jiffies(hdev->discov_timeout * 1000); 1641 queue_delayed_work(hdev->req_workqueue, 1642 &hdev->discov_off, to); 1643 } 1644 1645 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev); 1646 goto failed; 1647 } 1648 1649 cmd = mgmt_pending_add(sk, MGMT_OP_SET_DISCOVERABLE, hdev, data, len); 1650 if (!cmd) { 1651 err = -ENOMEM; 1652 goto failed; 1653 } 1654 1655 /* Cancel any potential discoverable timeout that might be 1656 * still active and store new timeout value. The arming of 1657 * the timeout happens in the complete handler. 1658 */ 1659 cancel_delayed_work(&hdev->discov_off); 1660 hdev->discov_timeout = timeout; 1661 1662 if (cp->val) 1663 hci_dev_set_flag(hdev, HCI_DISCOVERABLE); 1664 else 1665 hci_dev_clear_flag(hdev, HCI_DISCOVERABLE); 1666 1667 /* Limited discoverable mode */ 1668 if (cp->val == 0x02) 1669 hci_dev_set_flag(hdev, HCI_LIMITED_DISCOVERABLE); 1670 else 1671 hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE); 1672 1673 err = hci_cmd_sync_queue(hdev, set_discoverable_sync, cmd, 1674 mgmt_set_discoverable_complete); 1675 1676 if (err < 0) 1677 mgmt_pending_remove(cmd); 1678 1679 failed: 1680 hci_dev_unlock(hdev); 1681 return err; 1682 } 1683 1684 static void mgmt_set_connectable_complete(struct hci_dev *hdev, void *data, 1685 int err) 1686 { 1687 struct mgmt_pending_cmd *cmd = data; 1688 1689 bt_dev_dbg(hdev, "err %d", err); 1690 1691 /* Make sure cmd still outstanding. */ 1692 if (cmd != pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) 1693 return; 1694 1695 hci_dev_lock(hdev); 1696 1697 if (err) { 1698 u8 mgmt_err = mgmt_status(err); 1699 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err); 1700 goto done; 1701 } 1702 1703 send_settings_rsp(cmd->sk, MGMT_OP_SET_CONNECTABLE, hdev); 1704 new_settings(hdev, cmd->sk); 1705 1706 done: 1707 if (cmd) 1708 mgmt_pending_remove(cmd); 1709 1710 hci_dev_unlock(hdev); 1711 } 1712 1713 static int set_connectable_update_settings(struct hci_dev *hdev, 1714 struct sock *sk, u8 val) 1715 { 1716 bool changed = false; 1717 int err; 1718 1719 if (!!val != hci_dev_test_flag(hdev, HCI_CONNECTABLE)) 1720 changed = true; 1721 1722 if (val) { 1723 hci_dev_set_flag(hdev, HCI_CONNECTABLE); 1724 } else { 1725 hci_dev_clear_flag(hdev, HCI_CONNECTABLE); 1726 hci_dev_clear_flag(hdev, HCI_DISCOVERABLE); 1727 } 1728 1729 err = send_settings_rsp(sk, MGMT_OP_SET_CONNECTABLE, hdev); 1730 if (err < 0) 1731 return err; 1732 1733 if (changed) { 1734 hci_update_scan(hdev); 1735 hci_update_passive_scan(hdev); 1736 return new_settings(hdev, sk); 1737 } 1738 1739 return 0; 1740 } 1741 1742 static int set_connectable_sync(struct hci_dev *hdev, void *data) 1743 { 1744 BT_DBG("%s", hdev->name); 1745 1746 return hci_update_connectable_sync(hdev); 1747 } 1748 1749 static int set_connectable(struct sock *sk, struct hci_dev *hdev, void *data, 1750 u16 len) 1751 { 1752 struct mgmt_mode *cp = data; 1753 struct mgmt_pending_cmd *cmd; 1754 int err; 1755 1756 bt_dev_dbg(hdev, "sock %p", sk); 1757 1758 if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED) && 1759 !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) 1760 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE, 1761 MGMT_STATUS_REJECTED); 1762 1763 if (cp->val != 0x00 && cp->val != 0x01) 1764 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE, 1765 MGMT_STATUS_INVALID_PARAMS); 1766 1767 hci_dev_lock(hdev); 1768 1769 if (!hdev_is_powered(hdev)) { 1770 err = set_connectable_update_settings(hdev, sk, cp->val); 1771 goto failed; 1772 } 1773 1774 if (pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) || 1775 pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) { 1776 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE, 1777 MGMT_STATUS_BUSY); 1778 goto failed; 1779 } 1780 1781 cmd = mgmt_pending_add(sk, MGMT_OP_SET_CONNECTABLE, hdev, data, len); 1782 if (!cmd) { 1783 err = -ENOMEM; 1784 goto failed; 1785 } 1786 1787 if (cp->val) { 1788 hci_dev_set_flag(hdev, HCI_CONNECTABLE); 1789 } else { 1790 if (hdev->discov_timeout > 0) 1791 cancel_delayed_work(&hdev->discov_off); 1792 1793 hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE); 1794 hci_dev_clear_flag(hdev, HCI_DISCOVERABLE); 1795 hci_dev_clear_flag(hdev, HCI_CONNECTABLE); 1796 } 1797 1798 err = hci_cmd_sync_queue(hdev, set_connectable_sync, cmd, 1799 mgmt_set_connectable_complete); 1800 1801 if (err < 0) 1802 mgmt_pending_remove(cmd); 1803 1804 failed: 1805 hci_dev_unlock(hdev); 1806 return err; 1807 } 1808 1809 static int set_bondable(struct sock *sk, struct hci_dev *hdev, void *data, 1810 u16 len) 1811 { 1812 struct mgmt_mode *cp = data; 1813 bool changed; 1814 int err; 1815 1816 bt_dev_dbg(hdev, "sock %p", sk); 1817 1818 if (cp->val != 0x00 && cp->val != 0x01) 1819 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BONDABLE, 1820 MGMT_STATUS_INVALID_PARAMS); 1821 1822 hci_dev_lock(hdev); 1823 1824 if (cp->val) 1825 changed = !hci_dev_test_and_set_flag(hdev, HCI_BONDABLE); 1826 else 1827 changed = hci_dev_test_and_clear_flag(hdev, HCI_BONDABLE); 1828 1829 err = send_settings_rsp(sk, MGMT_OP_SET_BONDABLE, hdev); 1830 if (err < 0) 1831 goto unlock; 1832 1833 if (changed) { 1834 /* In limited privacy mode the change of bondable mode 1835 * may affect the local advertising address. 1836 */ 1837 hci_update_discoverable(hdev); 1838 1839 err = new_settings(hdev, sk); 1840 } 1841 1842 unlock: 1843 hci_dev_unlock(hdev); 1844 return err; 1845 } 1846 1847 static int set_link_security(struct sock *sk, struct hci_dev *hdev, void *data, 1848 u16 len) 1849 { 1850 struct mgmt_mode *cp = data; 1851 struct mgmt_pending_cmd *cmd; 1852 u8 val, status; 1853 int err; 1854 1855 bt_dev_dbg(hdev, "sock %p", sk); 1856 1857 status = mgmt_bredr_support(hdev); 1858 if (status) 1859 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY, 1860 status); 1861 1862 if (cp->val != 0x00 && cp->val != 0x01) 1863 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY, 1864 MGMT_STATUS_INVALID_PARAMS); 1865 1866 hci_dev_lock(hdev); 1867 1868 if (!hdev_is_powered(hdev)) { 1869 bool changed = false; 1870 1871 if (!!cp->val != hci_dev_test_flag(hdev, HCI_LINK_SECURITY)) { 1872 hci_dev_change_flag(hdev, HCI_LINK_SECURITY); 1873 changed = true; 1874 } 1875 1876 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev); 1877 if (err < 0) 1878 goto failed; 1879 1880 if (changed) 1881 err = new_settings(hdev, sk); 1882 1883 goto failed; 1884 } 1885 1886 if (pending_find(MGMT_OP_SET_LINK_SECURITY, hdev)) { 1887 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY, 1888 MGMT_STATUS_BUSY); 1889 goto failed; 1890 } 1891 1892 val = !!cp->val; 1893 1894 if (test_bit(HCI_AUTH, &hdev->flags) == val) { 1895 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev); 1896 goto failed; 1897 } 1898 1899 cmd = mgmt_pending_add(sk, MGMT_OP_SET_LINK_SECURITY, hdev, data, len); 1900 if (!cmd) { 1901 err = -ENOMEM; 1902 goto failed; 1903 } 1904 1905 err = hci_send_cmd(hdev, HCI_OP_WRITE_AUTH_ENABLE, sizeof(val), &val); 1906 if (err < 0) { 1907 mgmt_pending_remove(cmd); 1908 goto failed; 1909 } 1910 1911 failed: 1912 hci_dev_unlock(hdev); 1913 return err; 1914 } 1915 1916 static void set_ssp_complete(struct hci_dev *hdev, void *data, int err) 1917 { 1918 struct cmd_lookup match = { NULL, hdev }; 1919 struct mgmt_pending_cmd *cmd = data; 1920 struct mgmt_mode *cp = cmd->param; 1921 u8 enable = cp->val; 1922 bool changed; 1923 1924 /* Make sure cmd still outstanding. */ 1925 if (cmd != pending_find(MGMT_OP_SET_SSP, hdev)) 1926 return; 1927 1928 if (err) { 1929 u8 mgmt_err = mgmt_status(err); 1930 1931 if (enable && hci_dev_test_and_clear_flag(hdev, 1932 HCI_SSP_ENABLED)) { 1933 hci_dev_clear_flag(hdev, HCI_HS_ENABLED); 1934 new_settings(hdev, NULL); 1935 } 1936 1937 mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev, cmd_status_rsp, 1938 &mgmt_err); 1939 return; 1940 } 1941 1942 if (enable) { 1943 changed = !hci_dev_test_and_set_flag(hdev, HCI_SSP_ENABLED); 1944 } else { 1945 changed = hci_dev_test_and_clear_flag(hdev, HCI_SSP_ENABLED); 1946 1947 if (!changed) 1948 changed = hci_dev_test_and_clear_flag(hdev, 1949 HCI_HS_ENABLED); 1950 else 1951 hci_dev_clear_flag(hdev, HCI_HS_ENABLED); 1952 } 1953 1954 mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev, settings_rsp, &match); 1955 1956 if (changed) 1957 new_settings(hdev, match.sk); 1958 1959 if (match.sk) 1960 sock_put(match.sk); 1961 1962 hci_update_eir_sync(hdev); 1963 } 1964 1965 static int set_ssp_sync(struct hci_dev *hdev, void *data) 1966 { 1967 struct mgmt_pending_cmd *cmd = data; 1968 struct mgmt_mode *cp = cmd->param; 1969 bool changed = false; 1970 int err; 1971 1972 if (cp->val) 1973 changed = !hci_dev_test_and_set_flag(hdev, HCI_SSP_ENABLED); 1974 1975 err = hci_write_ssp_mode_sync(hdev, cp->val); 1976 1977 if (!err && changed) 1978 hci_dev_clear_flag(hdev, HCI_SSP_ENABLED); 1979 1980 return err; 1981 } 1982 1983 static int set_ssp(struct sock *sk, struct hci_dev *hdev, void *data, u16 len) 1984 { 1985 struct mgmt_mode *cp = data; 1986 struct mgmt_pending_cmd *cmd; 1987 u8 status; 1988 int err; 1989 1990 bt_dev_dbg(hdev, "sock %p", sk); 1991 1992 status = mgmt_bredr_support(hdev); 1993 if (status) 1994 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP, status); 1995 1996 if (!lmp_ssp_capable(hdev)) 1997 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP, 1998 MGMT_STATUS_NOT_SUPPORTED); 1999 2000 if (cp->val != 0x00 && cp->val != 0x01) 2001 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP, 2002 MGMT_STATUS_INVALID_PARAMS); 2003 2004 hci_dev_lock(hdev); 2005 2006 if (!hdev_is_powered(hdev)) { 2007 bool changed; 2008 2009 if (cp->val) { 2010 changed = !hci_dev_test_and_set_flag(hdev, 2011 HCI_SSP_ENABLED); 2012 } else { 2013 changed = hci_dev_test_and_clear_flag(hdev, 2014 HCI_SSP_ENABLED); 2015 if (!changed) 2016 changed = hci_dev_test_and_clear_flag(hdev, 2017 HCI_HS_ENABLED); 2018 else 2019 hci_dev_clear_flag(hdev, HCI_HS_ENABLED); 2020 } 2021 2022 err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev); 2023 if (err < 0) 2024 goto failed; 2025 2026 if (changed) 2027 err = new_settings(hdev, sk); 2028 2029 goto failed; 2030 } 2031 2032 if (pending_find(MGMT_OP_SET_SSP, hdev)) { 2033 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP, 2034 MGMT_STATUS_BUSY); 2035 goto failed; 2036 } 2037 2038 if (!!cp->val == hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) { 2039 err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev); 2040 goto failed; 2041 } 2042 2043 cmd = mgmt_pending_add(sk, MGMT_OP_SET_SSP, hdev, data, len); 2044 if (!cmd) 2045 err = -ENOMEM; 2046 else 2047 err = hci_cmd_sync_queue(hdev, set_ssp_sync, cmd, 2048 set_ssp_complete); 2049 2050 if (err < 0) { 2051 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP, 2052 MGMT_STATUS_FAILED); 2053 2054 if (cmd) 2055 mgmt_pending_remove(cmd); 2056 } 2057 2058 failed: 2059 hci_dev_unlock(hdev); 2060 return err; 2061 } 2062 2063 static int set_hs(struct sock *sk, struct hci_dev *hdev, void *data, u16 len) 2064 { 2065 struct mgmt_mode *cp = data; 2066 bool changed; 2067 u8 status; 2068 int err; 2069 2070 bt_dev_dbg(hdev, "sock %p", sk); 2071 2072 if (!IS_ENABLED(CONFIG_BT_HS)) 2073 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS, 2074 MGMT_STATUS_NOT_SUPPORTED); 2075 2076 status = mgmt_bredr_support(hdev); 2077 if (status) 2078 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS, status); 2079 2080 if (!lmp_ssp_capable(hdev)) 2081 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS, 2082 MGMT_STATUS_NOT_SUPPORTED); 2083 2084 if (!hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) 2085 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS, 2086 MGMT_STATUS_REJECTED); 2087 2088 if (cp->val != 0x00 && cp->val != 0x01) 2089 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS, 2090 MGMT_STATUS_INVALID_PARAMS); 2091 2092 hci_dev_lock(hdev); 2093 2094 if (pending_find(MGMT_OP_SET_SSP, hdev)) { 2095 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS, 2096 MGMT_STATUS_BUSY); 2097 goto unlock; 2098 } 2099 2100 if (cp->val) { 2101 changed = !hci_dev_test_and_set_flag(hdev, HCI_HS_ENABLED); 2102 } else { 2103 if (hdev_is_powered(hdev)) { 2104 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS, 2105 MGMT_STATUS_REJECTED); 2106 goto unlock; 2107 } 2108 2109 changed = hci_dev_test_and_clear_flag(hdev, HCI_HS_ENABLED); 2110 } 2111 2112 err = send_settings_rsp(sk, MGMT_OP_SET_HS, hdev); 2113 if (err < 0) 2114 goto unlock; 2115 2116 if (changed) 2117 err = new_settings(hdev, sk); 2118 2119 unlock: 2120 hci_dev_unlock(hdev); 2121 return err; 2122 } 2123 2124 static void set_le_complete(struct hci_dev *hdev, void *data, int err) 2125 { 2126 struct cmd_lookup match = { NULL, hdev }; 2127 u8 status = mgmt_status(err); 2128 2129 bt_dev_dbg(hdev, "err %d", err); 2130 2131 if (status) { 2132 mgmt_pending_foreach(MGMT_OP_SET_LE, hdev, cmd_status_rsp, 2133 &status); 2134 return; 2135 } 2136 2137 mgmt_pending_foreach(MGMT_OP_SET_LE, hdev, settings_rsp, &match); 2138 2139 new_settings(hdev, match.sk); 2140 2141 if (match.sk) 2142 sock_put(match.sk); 2143 } 2144 2145 static int set_le_sync(struct hci_dev *hdev, void *data) 2146 { 2147 struct mgmt_pending_cmd *cmd = data; 2148 struct mgmt_mode *cp = cmd->param; 2149 u8 val = !!cp->val; 2150 int err; 2151 2152 if (!val) { 2153 hci_clear_adv_instance_sync(hdev, NULL, 0x00, true); 2154 2155 if (hci_dev_test_flag(hdev, HCI_LE_ADV)) 2156 hci_disable_advertising_sync(hdev); 2157 2158 if (ext_adv_capable(hdev)) 2159 hci_remove_ext_adv_instance_sync(hdev, 0, cmd->sk); 2160 } else { 2161 hci_dev_set_flag(hdev, HCI_LE_ENABLED); 2162 } 2163 2164 err = hci_write_le_host_supported_sync(hdev, val, 0); 2165 2166 /* Make sure the controller has a good default for 2167 * advertising data. Restrict the update to when LE 2168 * has actually been enabled. During power on, the 2169 * update in powered_update_hci will take care of it. 2170 */ 2171 if (!err && hci_dev_test_flag(hdev, HCI_LE_ENABLED)) { 2172 if (ext_adv_capable(hdev)) { 2173 int status; 2174 2175 status = hci_setup_ext_adv_instance_sync(hdev, 0x00); 2176 if (!status) 2177 hci_update_scan_rsp_data_sync(hdev, 0x00); 2178 } else { 2179 hci_update_adv_data_sync(hdev, 0x00); 2180 hci_update_scan_rsp_data_sync(hdev, 0x00); 2181 } 2182 2183 hci_update_passive_scan(hdev); 2184 } 2185 2186 return err; 2187 } 2188 2189 static void set_mesh_complete(struct hci_dev *hdev, void *data, int err) 2190 { 2191 struct mgmt_pending_cmd *cmd = data; 2192 u8 status = mgmt_status(err); 2193 struct sock *sk = cmd->sk; 2194 2195 if (status) { 2196 mgmt_pending_foreach(MGMT_OP_SET_MESH_RECEIVER, hdev, 2197 cmd_status_rsp, &status); 2198 return; 2199 } 2200 2201 mgmt_pending_remove(cmd); 2202 mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_MESH_RECEIVER, 0, NULL, 0); 2203 } 2204 2205 static int set_mesh_sync(struct hci_dev *hdev, void *data) 2206 { 2207 struct mgmt_pending_cmd *cmd = data; 2208 struct mgmt_cp_set_mesh *cp = cmd->param; 2209 size_t len = cmd->param_len; 2210 2211 memset(hdev->mesh_ad_types, 0, sizeof(hdev->mesh_ad_types)); 2212 2213 if (cp->enable) 2214 hci_dev_set_flag(hdev, HCI_MESH); 2215 else 2216 hci_dev_clear_flag(hdev, HCI_MESH); 2217 2218 len -= sizeof(*cp); 2219 2220 /* If filters don't fit, forward all adv pkts */ 2221 if (len <= sizeof(hdev->mesh_ad_types)) 2222 memcpy(hdev->mesh_ad_types, cp->ad_types, len); 2223 2224 hci_update_passive_scan_sync(hdev); 2225 return 0; 2226 } 2227 2228 static int set_mesh(struct sock *sk, struct hci_dev *hdev, void *data, u16 len) 2229 { 2230 struct mgmt_cp_set_mesh *cp = data; 2231 struct mgmt_pending_cmd *cmd; 2232 int err = 0; 2233 2234 bt_dev_dbg(hdev, "sock %p", sk); 2235 2236 if (!lmp_le_capable(hdev) || 2237 !hci_dev_test_flag(hdev, HCI_MESH_EXPERIMENTAL)) 2238 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_MESH_RECEIVER, 2239 MGMT_STATUS_NOT_SUPPORTED); 2240 2241 if (cp->enable != 0x00 && cp->enable != 0x01) 2242 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_MESH_RECEIVER, 2243 MGMT_STATUS_INVALID_PARAMS); 2244 2245 hci_dev_lock(hdev); 2246 2247 cmd = mgmt_pending_add(sk, MGMT_OP_SET_MESH_RECEIVER, hdev, data, len); 2248 if (!cmd) 2249 err = -ENOMEM; 2250 else 2251 err = hci_cmd_sync_queue(hdev, set_mesh_sync, cmd, 2252 set_mesh_complete); 2253 2254 if (err < 0) { 2255 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_MESH_RECEIVER, 2256 MGMT_STATUS_FAILED); 2257 2258 if (cmd) 2259 mgmt_pending_remove(cmd); 2260 } 2261 2262 hci_dev_unlock(hdev); 2263 return err; 2264 } 2265 2266 static void mesh_send_start_complete(struct hci_dev *hdev, void *data, int err) 2267 { 2268 struct mgmt_mesh_tx *mesh_tx = data; 2269 struct mgmt_cp_mesh_send *send = (void *)mesh_tx->param; 2270 unsigned long mesh_send_interval; 2271 u8 mgmt_err = mgmt_status(err); 2272 2273 /* Report any errors here, but don't report completion */ 2274 2275 if (mgmt_err) { 2276 hci_dev_clear_flag(hdev, HCI_MESH_SENDING); 2277 /* Send Complete Error Code for handle */ 2278 mesh_send_complete(hdev, mesh_tx, false); 2279 return; 2280 } 2281 2282 mesh_send_interval = msecs_to_jiffies((send->cnt) * 25); 2283 queue_delayed_work(hdev->req_workqueue, &hdev->mesh_send_done, 2284 mesh_send_interval); 2285 } 2286 2287 static int mesh_send_sync(struct hci_dev *hdev, void *data) 2288 { 2289 struct mgmt_mesh_tx *mesh_tx = data; 2290 struct mgmt_cp_mesh_send *send = (void *)mesh_tx->param; 2291 struct adv_info *adv, *next_instance; 2292 u8 instance = hdev->le_num_of_adv_sets + 1; 2293 u16 timeout, duration; 2294 int err = 0; 2295 2296 if (hdev->le_num_of_adv_sets <= hdev->adv_instance_cnt) 2297 return MGMT_STATUS_BUSY; 2298 2299 timeout = 1000; 2300 duration = send->cnt * INTERVAL_TO_MS(hdev->le_adv_max_interval); 2301 adv = hci_add_adv_instance(hdev, instance, 0, 2302 send->adv_data_len, send->adv_data, 2303 0, NULL, 2304 timeout, duration, 2305 HCI_ADV_TX_POWER_NO_PREFERENCE, 2306 hdev->le_adv_min_interval, 2307 hdev->le_adv_max_interval, 2308 mesh_tx->handle); 2309 2310 if (!IS_ERR(adv)) 2311 mesh_tx->instance = instance; 2312 else 2313 err = PTR_ERR(adv); 2314 2315 if (hdev->cur_adv_instance == instance) { 2316 /* If the currently advertised instance is being changed then 2317 * cancel the current advertising and schedule the next 2318 * instance. If there is only one instance then the overridden 2319 * advertising data will be visible right away. 2320 */ 2321 cancel_adv_timeout(hdev); 2322 2323 next_instance = hci_get_next_instance(hdev, instance); 2324 if (next_instance) 2325 instance = next_instance->instance; 2326 else 2327 instance = 0; 2328 } else if (hdev->adv_instance_timeout) { 2329 /* Immediately advertise the new instance if no other, or 2330 * let it go naturally from queue if ADV is already happening 2331 */ 2332 instance = 0; 2333 } 2334 2335 if (instance) 2336 return hci_schedule_adv_instance_sync(hdev, instance, true); 2337 2338 return err; 2339 } 2340 2341 static void send_count(struct mgmt_mesh_tx *mesh_tx, void *data) 2342 { 2343 struct mgmt_rp_mesh_read_features *rp = data; 2344 2345 if (rp->used_handles >= rp->max_handles) 2346 return; 2347 2348 rp->handles[rp->used_handles++] = mesh_tx->handle; 2349 } 2350 2351 static int mesh_features(struct sock *sk, struct hci_dev *hdev, 2352 void *data, u16 len) 2353 { 2354 struct mgmt_rp_mesh_read_features rp; 2355 2356 if (!lmp_le_capable(hdev) || 2357 !hci_dev_test_flag(hdev, HCI_MESH_EXPERIMENTAL)) 2358 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_MESH_READ_FEATURES, 2359 MGMT_STATUS_NOT_SUPPORTED); 2360 2361 memset(&rp, 0, sizeof(rp)); 2362 rp.index = cpu_to_le16(hdev->id); 2363 if (hci_dev_test_flag(hdev, HCI_LE_ENABLED)) 2364 rp.max_handles = MESH_HANDLES_MAX; 2365 2366 hci_dev_lock(hdev); 2367 2368 if (rp.max_handles) 2369 mgmt_mesh_foreach(hdev, send_count, &rp, sk); 2370 2371 mgmt_cmd_complete(sk, hdev->id, MGMT_OP_MESH_READ_FEATURES, 0, &rp, 2372 rp.used_handles + sizeof(rp) - MESH_HANDLES_MAX); 2373 2374 hci_dev_unlock(hdev); 2375 return 0; 2376 } 2377 2378 static int send_cancel(struct hci_dev *hdev, void *data) 2379 { 2380 struct mgmt_pending_cmd *cmd = data; 2381 struct mgmt_cp_mesh_send_cancel *cancel = (void *)cmd->param; 2382 struct mgmt_mesh_tx *mesh_tx; 2383 2384 if (!cancel->handle) { 2385 do { 2386 mesh_tx = mgmt_mesh_next(hdev, cmd->sk); 2387 2388 if (mesh_tx) 2389 mesh_send_complete(hdev, mesh_tx, false); 2390 } while (mesh_tx); 2391 } else { 2392 mesh_tx = mgmt_mesh_find(hdev, cancel->handle); 2393 2394 if (mesh_tx && mesh_tx->sk == cmd->sk) 2395 mesh_send_complete(hdev, mesh_tx, false); 2396 } 2397 2398 mgmt_cmd_complete(cmd->sk, hdev->id, MGMT_OP_MESH_SEND_CANCEL, 2399 0, NULL, 0); 2400 mgmt_pending_free(cmd); 2401 2402 return 0; 2403 } 2404 2405 static int mesh_send_cancel(struct sock *sk, struct hci_dev *hdev, 2406 void *data, u16 len) 2407 { 2408 struct mgmt_pending_cmd *cmd; 2409 int err; 2410 2411 if (!lmp_le_capable(hdev) || 2412 !hci_dev_test_flag(hdev, HCI_MESH_EXPERIMENTAL)) 2413 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_MESH_SEND_CANCEL, 2414 MGMT_STATUS_NOT_SUPPORTED); 2415 2416 if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED)) 2417 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_MESH_SEND_CANCEL, 2418 MGMT_STATUS_REJECTED); 2419 2420 hci_dev_lock(hdev); 2421 cmd = mgmt_pending_new(sk, MGMT_OP_MESH_SEND_CANCEL, hdev, data, len); 2422 if (!cmd) 2423 err = -ENOMEM; 2424 else 2425 err = hci_cmd_sync_queue(hdev, send_cancel, cmd, NULL); 2426 2427 if (err < 0) { 2428 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_MESH_SEND_CANCEL, 2429 MGMT_STATUS_FAILED); 2430 2431 if (cmd) 2432 mgmt_pending_free(cmd); 2433 } 2434 2435 hci_dev_unlock(hdev); 2436 return err; 2437 } 2438 2439 static int mesh_send(struct sock *sk, struct hci_dev *hdev, void *data, u16 len) 2440 { 2441 struct mgmt_mesh_tx *mesh_tx; 2442 struct mgmt_cp_mesh_send *send = data; 2443 struct mgmt_rp_mesh_read_features rp; 2444 bool sending; 2445 int err = 0; 2446 2447 if (!lmp_le_capable(hdev) || 2448 !hci_dev_test_flag(hdev, HCI_MESH_EXPERIMENTAL)) 2449 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_MESH_SEND, 2450 MGMT_STATUS_NOT_SUPPORTED); 2451 if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED) || 2452 len <= MGMT_MESH_SEND_SIZE || 2453 len > (MGMT_MESH_SEND_SIZE + 31)) 2454 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_MESH_SEND, 2455 MGMT_STATUS_REJECTED); 2456 2457 hci_dev_lock(hdev); 2458 2459 memset(&rp, 0, sizeof(rp)); 2460 rp.max_handles = MESH_HANDLES_MAX; 2461 2462 mgmt_mesh_foreach(hdev, send_count, &rp, sk); 2463 2464 if (rp.max_handles <= rp.used_handles) { 2465 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_MESH_SEND, 2466 MGMT_STATUS_BUSY); 2467 goto done; 2468 } 2469 2470 sending = hci_dev_test_flag(hdev, HCI_MESH_SENDING); 2471 mesh_tx = mgmt_mesh_add(sk, hdev, send, len); 2472 2473 if (!mesh_tx) 2474 err = -ENOMEM; 2475 else if (!sending) 2476 err = hci_cmd_sync_queue(hdev, mesh_send_sync, mesh_tx, 2477 mesh_send_start_complete); 2478 2479 if (err < 0) { 2480 bt_dev_err(hdev, "Send Mesh Failed %d", err); 2481 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_MESH_SEND, 2482 MGMT_STATUS_FAILED); 2483 2484 if (mesh_tx) { 2485 if (sending) 2486 mgmt_mesh_remove(mesh_tx); 2487 } 2488 } else { 2489 hci_dev_set_flag(hdev, HCI_MESH_SENDING); 2490 2491 mgmt_cmd_complete(sk, hdev->id, MGMT_OP_MESH_SEND, 0, 2492 &mesh_tx->handle, 1); 2493 } 2494 2495 done: 2496 hci_dev_unlock(hdev); 2497 return err; 2498 } 2499 2500 static int set_le(struct sock *sk, struct hci_dev *hdev, void *data, u16 len) 2501 { 2502 struct mgmt_mode *cp = data; 2503 struct mgmt_pending_cmd *cmd; 2504 int err; 2505 u8 val, enabled; 2506 2507 bt_dev_dbg(hdev, "sock %p", sk); 2508 2509 if (!lmp_le_capable(hdev)) 2510 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE, 2511 MGMT_STATUS_NOT_SUPPORTED); 2512 2513 if (cp->val != 0x00 && cp->val != 0x01) 2514 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE, 2515 MGMT_STATUS_INVALID_PARAMS); 2516 2517 /* Bluetooth single mode LE only controllers or dual-mode 2518 * controllers configured as LE only devices, do not allow 2519 * switching LE off. These have either LE enabled explicitly 2520 * or BR/EDR has been previously switched off. 2521 * 2522 * When trying to enable an already enabled LE, then gracefully 2523 * send a positive response. Trying to disable it however will 2524 * result into rejection. 2525 */ 2526 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) { 2527 if (cp->val == 0x01) 2528 return send_settings_rsp(sk, MGMT_OP_SET_LE, hdev); 2529 2530 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE, 2531 MGMT_STATUS_REJECTED); 2532 } 2533 2534 hci_dev_lock(hdev); 2535 2536 val = !!cp->val; 2537 enabled = lmp_host_le_capable(hdev); 2538 2539 if (!hdev_is_powered(hdev) || val == enabled) { 2540 bool changed = false; 2541 2542 if (val != hci_dev_test_flag(hdev, HCI_LE_ENABLED)) { 2543 hci_dev_change_flag(hdev, HCI_LE_ENABLED); 2544 changed = true; 2545 } 2546 2547 if (!val && hci_dev_test_flag(hdev, HCI_ADVERTISING)) { 2548 hci_dev_clear_flag(hdev, HCI_ADVERTISING); 2549 changed = true; 2550 } 2551 2552 err = send_settings_rsp(sk, MGMT_OP_SET_LE, hdev); 2553 if (err < 0) 2554 goto unlock; 2555 2556 if (changed) 2557 err = new_settings(hdev, sk); 2558 2559 goto unlock; 2560 } 2561 2562 if (pending_find(MGMT_OP_SET_LE, hdev) || 2563 pending_find(MGMT_OP_SET_ADVERTISING, hdev)) { 2564 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE, 2565 MGMT_STATUS_BUSY); 2566 goto unlock; 2567 } 2568 2569 cmd = mgmt_pending_add(sk, MGMT_OP_SET_LE, hdev, data, len); 2570 if (!cmd) 2571 err = -ENOMEM; 2572 else 2573 err = hci_cmd_sync_queue(hdev, set_le_sync, cmd, 2574 set_le_complete); 2575 2576 if (err < 0) { 2577 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE, 2578 MGMT_STATUS_FAILED); 2579 2580 if (cmd) 2581 mgmt_pending_remove(cmd); 2582 } 2583 2584 unlock: 2585 hci_dev_unlock(hdev); 2586 return err; 2587 } 2588 2589 /* This is a helper function to test for pending mgmt commands that can 2590 * cause CoD or EIR HCI commands. We can only allow one such pending 2591 * mgmt command at a time since otherwise we cannot easily track what 2592 * the current values are, will be, and based on that calculate if a new 2593 * HCI command needs to be sent and if yes with what value. 2594 */ 2595 static bool pending_eir_or_class(struct hci_dev *hdev) 2596 { 2597 struct mgmt_pending_cmd *cmd; 2598 2599 list_for_each_entry(cmd, &hdev->mgmt_pending, list) { 2600 switch (cmd->opcode) { 2601 case MGMT_OP_ADD_UUID: 2602 case MGMT_OP_REMOVE_UUID: 2603 case MGMT_OP_SET_DEV_CLASS: 2604 case MGMT_OP_SET_POWERED: 2605 return true; 2606 } 2607 } 2608 2609 return false; 2610 } 2611 2612 static const u8 bluetooth_base_uuid[] = { 2613 0xfb, 0x34, 0x9b, 0x5f, 0x80, 0x00, 0x00, 0x80, 2614 0x00, 0x10, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 2615 }; 2616 2617 static u8 get_uuid_size(const u8 *uuid) 2618 { 2619 u32 val; 2620 2621 if (memcmp(uuid, bluetooth_base_uuid, 12)) 2622 return 128; 2623 2624 val = get_unaligned_le32(&uuid[12]); 2625 if (val > 0xffff) 2626 return 32; 2627 2628 return 16; 2629 } 2630 2631 static void mgmt_class_complete(struct hci_dev *hdev, void *data, int err) 2632 { 2633 struct mgmt_pending_cmd *cmd = data; 2634 2635 bt_dev_dbg(hdev, "err %d", err); 2636 2637 mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, 2638 mgmt_status(err), hdev->dev_class, 3); 2639 2640 mgmt_pending_free(cmd); 2641 } 2642 2643 static int add_uuid_sync(struct hci_dev *hdev, void *data) 2644 { 2645 int err; 2646 2647 err = hci_update_class_sync(hdev); 2648 if (err) 2649 return err; 2650 2651 return hci_update_eir_sync(hdev); 2652 } 2653 2654 static int add_uuid(struct sock *sk, struct hci_dev *hdev, void *data, u16 len) 2655 { 2656 struct mgmt_cp_add_uuid *cp = data; 2657 struct mgmt_pending_cmd *cmd; 2658 struct bt_uuid *uuid; 2659 int err; 2660 2661 bt_dev_dbg(hdev, "sock %p", sk); 2662 2663 hci_dev_lock(hdev); 2664 2665 if (pending_eir_or_class(hdev)) { 2666 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_UUID, 2667 MGMT_STATUS_BUSY); 2668 goto failed; 2669 } 2670 2671 uuid = kmalloc(sizeof(*uuid), GFP_KERNEL); 2672 if (!uuid) { 2673 err = -ENOMEM; 2674 goto failed; 2675 } 2676 2677 memcpy(uuid->uuid, cp->uuid, 16); 2678 uuid->svc_hint = cp->svc_hint; 2679 uuid->size = get_uuid_size(cp->uuid); 2680 2681 list_add_tail(&uuid->list, &hdev->uuids); 2682 2683 cmd = mgmt_pending_new(sk, MGMT_OP_ADD_UUID, hdev, data, len); 2684 if (!cmd) { 2685 err = -ENOMEM; 2686 goto failed; 2687 } 2688 2689 err = hci_cmd_sync_queue(hdev, add_uuid_sync, cmd, mgmt_class_complete); 2690 if (err < 0) { 2691 mgmt_pending_free(cmd); 2692 goto failed; 2693 } 2694 2695 failed: 2696 hci_dev_unlock(hdev); 2697 return err; 2698 } 2699 2700 static bool enable_service_cache(struct hci_dev *hdev) 2701 { 2702 if (!hdev_is_powered(hdev)) 2703 return false; 2704 2705 if (!hci_dev_test_and_set_flag(hdev, HCI_SERVICE_CACHE)) { 2706 queue_delayed_work(hdev->workqueue, &hdev->service_cache, 2707 CACHE_TIMEOUT); 2708 return true; 2709 } 2710 2711 return false; 2712 } 2713 2714 static int remove_uuid_sync(struct hci_dev *hdev, void *data) 2715 { 2716 int err; 2717 2718 err = hci_update_class_sync(hdev); 2719 if (err) 2720 return err; 2721 2722 return hci_update_eir_sync(hdev); 2723 } 2724 2725 static int remove_uuid(struct sock *sk, struct hci_dev *hdev, void *data, 2726 u16 len) 2727 { 2728 struct mgmt_cp_remove_uuid *cp = data; 2729 struct mgmt_pending_cmd *cmd; 2730 struct bt_uuid *match, *tmp; 2731 static const u8 bt_uuid_any[] = { 2732 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 2733 }; 2734 int err, found; 2735 2736 bt_dev_dbg(hdev, "sock %p", sk); 2737 2738 hci_dev_lock(hdev); 2739 2740 if (pending_eir_or_class(hdev)) { 2741 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID, 2742 MGMT_STATUS_BUSY); 2743 goto unlock; 2744 } 2745 2746 if (memcmp(cp->uuid, bt_uuid_any, 16) == 0) { 2747 hci_uuids_clear(hdev); 2748 2749 if (enable_service_cache(hdev)) { 2750 err = mgmt_cmd_complete(sk, hdev->id, 2751 MGMT_OP_REMOVE_UUID, 2752 0, hdev->dev_class, 3); 2753 goto unlock; 2754 } 2755 2756 goto update_class; 2757 } 2758 2759 found = 0; 2760 2761 list_for_each_entry_safe(match, tmp, &hdev->uuids, list) { 2762 if (memcmp(match->uuid, cp->uuid, 16) != 0) 2763 continue; 2764 2765 list_del(&match->list); 2766 kfree(match); 2767 found++; 2768 } 2769 2770 if (found == 0) { 2771 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID, 2772 MGMT_STATUS_INVALID_PARAMS); 2773 goto unlock; 2774 } 2775 2776 update_class: 2777 cmd = mgmt_pending_new(sk, MGMT_OP_REMOVE_UUID, hdev, data, len); 2778 if (!cmd) { 2779 err = -ENOMEM; 2780 goto unlock; 2781 } 2782 2783 err = hci_cmd_sync_queue(hdev, remove_uuid_sync, cmd, 2784 mgmt_class_complete); 2785 if (err < 0) 2786 mgmt_pending_free(cmd); 2787 2788 unlock: 2789 hci_dev_unlock(hdev); 2790 return err; 2791 } 2792 2793 static int set_class_sync(struct hci_dev *hdev, void *data) 2794 { 2795 int err = 0; 2796 2797 if (hci_dev_test_and_clear_flag(hdev, HCI_SERVICE_CACHE)) { 2798 cancel_delayed_work_sync(&hdev->service_cache); 2799 err = hci_update_eir_sync(hdev); 2800 } 2801 2802 if (err) 2803 return err; 2804 2805 return hci_update_class_sync(hdev); 2806 } 2807 2808 static int set_dev_class(struct sock *sk, struct hci_dev *hdev, void *data, 2809 u16 len) 2810 { 2811 struct mgmt_cp_set_dev_class *cp = data; 2812 struct mgmt_pending_cmd *cmd; 2813 int err; 2814 2815 bt_dev_dbg(hdev, "sock %p", sk); 2816 2817 if (!lmp_bredr_capable(hdev)) 2818 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 2819 MGMT_STATUS_NOT_SUPPORTED); 2820 2821 hci_dev_lock(hdev); 2822 2823 if (pending_eir_or_class(hdev)) { 2824 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 2825 MGMT_STATUS_BUSY); 2826 goto unlock; 2827 } 2828 2829 if ((cp->minor & 0x03) != 0 || (cp->major & 0xe0) != 0) { 2830 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 2831 MGMT_STATUS_INVALID_PARAMS); 2832 goto unlock; 2833 } 2834 2835 hdev->major_class = cp->major; 2836 hdev->minor_class = cp->minor; 2837 2838 if (!hdev_is_powered(hdev)) { 2839 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 0, 2840 hdev->dev_class, 3); 2841 goto unlock; 2842 } 2843 2844 cmd = mgmt_pending_new(sk, MGMT_OP_SET_DEV_CLASS, hdev, data, len); 2845 if (!cmd) { 2846 err = -ENOMEM; 2847 goto unlock; 2848 } 2849 2850 err = hci_cmd_sync_queue(hdev, set_class_sync, cmd, 2851 mgmt_class_complete); 2852 if (err < 0) 2853 mgmt_pending_free(cmd); 2854 2855 unlock: 2856 hci_dev_unlock(hdev); 2857 return err; 2858 } 2859 2860 static int load_link_keys(struct sock *sk, struct hci_dev *hdev, void *data, 2861 u16 len) 2862 { 2863 struct mgmt_cp_load_link_keys *cp = data; 2864 const u16 max_key_count = ((U16_MAX - sizeof(*cp)) / 2865 sizeof(struct mgmt_link_key_info)); 2866 u16 key_count, expected_len; 2867 bool changed; 2868 int i; 2869 2870 bt_dev_dbg(hdev, "sock %p", sk); 2871 2872 if (!lmp_bredr_capable(hdev)) 2873 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS, 2874 MGMT_STATUS_NOT_SUPPORTED); 2875 2876 key_count = __le16_to_cpu(cp->key_count); 2877 if (key_count > max_key_count) { 2878 bt_dev_err(hdev, "load_link_keys: too big key_count value %u", 2879 key_count); 2880 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS, 2881 MGMT_STATUS_INVALID_PARAMS); 2882 } 2883 2884 expected_len = struct_size(cp, keys, key_count); 2885 if (expected_len != len) { 2886 bt_dev_err(hdev, "load_link_keys: expected %u bytes, got %u bytes", 2887 expected_len, len); 2888 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS, 2889 MGMT_STATUS_INVALID_PARAMS); 2890 } 2891 2892 if (cp->debug_keys != 0x00 && cp->debug_keys != 0x01) 2893 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS, 2894 MGMT_STATUS_INVALID_PARAMS); 2895 2896 bt_dev_dbg(hdev, "debug_keys %u key_count %u", cp->debug_keys, 2897 key_count); 2898 2899 for (i = 0; i < key_count; i++) { 2900 struct mgmt_link_key_info *key = &cp->keys[i]; 2901 2902 /* Considering SMP over BREDR/LE, there is no need to check addr_type */ 2903 if (key->type > 0x08) 2904 return mgmt_cmd_status(sk, hdev->id, 2905 MGMT_OP_LOAD_LINK_KEYS, 2906 MGMT_STATUS_INVALID_PARAMS); 2907 } 2908 2909 hci_dev_lock(hdev); 2910 2911 hci_link_keys_clear(hdev); 2912 2913 if (cp->debug_keys) 2914 changed = !hci_dev_test_and_set_flag(hdev, HCI_KEEP_DEBUG_KEYS); 2915 else 2916 changed = hci_dev_test_and_clear_flag(hdev, 2917 HCI_KEEP_DEBUG_KEYS); 2918 2919 if (changed) 2920 new_settings(hdev, NULL); 2921 2922 for (i = 0; i < key_count; i++) { 2923 struct mgmt_link_key_info *key = &cp->keys[i]; 2924 2925 if (hci_is_blocked_key(hdev, 2926 HCI_BLOCKED_KEY_TYPE_LINKKEY, 2927 key->val)) { 2928 bt_dev_warn(hdev, "Skipping blocked link key for %pMR", 2929 &key->addr.bdaddr); 2930 continue; 2931 } 2932 2933 /* Always ignore debug keys and require a new pairing if 2934 * the user wants to use them. 2935 */ 2936 if (key->type == HCI_LK_DEBUG_COMBINATION) 2937 continue; 2938 2939 hci_add_link_key(hdev, NULL, &key->addr.bdaddr, key->val, 2940 key->type, key->pin_len, NULL); 2941 } 2942 2943 mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS, 0, NULL, 0); 2944 2945 hci_dev_unlock(hdev); 2946 2947 return 0; 2948 } 2949 2950 static int device_unpaired(struct hci_dev *hdev, bdaddr_t *bdaddr, 2951 u8 addr_type, struct sock *skip_sk) 2952 { 2953 struct mgmt_ev_device_unpaired ev; 2954 2955 bacpy(&ev.addr.bdaddr, bdaddr); 2956 ev.addr.type = addr_type; 2957 2958 return mgmt_event(MGMT_EV_DEVICE_UNPAIRED, hdev, &ev, sizeof(ev), 2959 skip_sk); 2960 } 2961 2962 static void unpair_device_complete(struct hci_dev *hdev, void *data, int err) 2963 { 2964 struct mgmt_pending_cmd *cmd = data; 2965 struct mgmt_cp_unpair_device *cp = cmd->param; 2966 2967 if (!err) 2968 device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, cmd->sk); 2969 2970 cmd->cmd_complete(cmd, err); 2971 mgmt_pending_free(cmd); 2972 } 2973 2974 static int unpair_device_sync(struct hci_dev *hdev, void *data) 2975 { 2976 struct mgmt_pending_cmd *cmd = data; 2977 struct mgmt_cp_unpair_device *cp = cmd->param; 2978 struct hci_conn *conn; 2979 2980 if (cp->addr.type == BDADDR_BREDR) 2981 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, 2982 &cp->addr.bdaddr); 2983 else 2984 conn = hci_conn_hash_lookup_le(hdev, &cp->addr.bdaddr, 2985 le_addr_type(cp->addr.type)); 2986 2987 if (!conn) 2988 return 0; 2989 2990 return hci_abort_conn_sync(hdev, conn, HCI_ERROR_REMOTE_USER_TERM); 2991 } 2992 2993 static int unpair_device(struct sock *sk, struct hci_dev *hdev, void *data, 2994 u16 len) 2995 { 2996 struct mgmt_cp_unpair_device *cp = data; 2997 struct mgmt_rp_unpair_device rp; 2998 struct hci_conn_params *params; 2999 struct mgmt_pending_cmd *cmd; 3000 struct hci_conn *conn; 3001 u8 addr_type; 3002 int err; 3003 3004 memset(&rp, 0, sizeof(rp)); 3005 bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr); 3006 rp.addr.type = cp->addr.type; 3007 3008 if (!bdaddr_type_is_valid(cp->addr.type)) 3009 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE, 3010 MGMT_STATUS_INVALID_PARAMS, 3011 &rp, sizeof(rp)); 3012 3013 if (cp->disconnect != 0x00 && cp->disconnect != 0x01) 3014 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE, 3015 MGMT_STATUS_INVALID_PARAMS, 3016 &rp, sizeof(rp)); 3017 3018 hci_dev_lock(hdev); 3019 3020 if (!hdev_is_powered(hdev)) { 3021 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE, 3022 MGMT_STATUS_NOT_POWERED, &rp, 3023 sizeof(rp)); 3024 goto unlock; 3025 } 3026 3027 if (cp->addr.type == BDADDR_BREDR) { 3028 /* If disconnection is requested, then look up the 3029 * connection. If the remote device is connected, it 3030 * will be later used to terminate the link. 3031 * 3032 * Setting it to NULL explicitly will cause no 3033 * termination of the link. 3034 */ 3035 if (cp->disconnect) 3036 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, 3037 &cp->addr.bdaddr); 3038 else 3039 conn = NULL; 3040 3041 err = hci_remove_link_key(hdev, &cp->addr.bdaddr); 3042 if (err < 0) { 3043 err = mgmt_cmd_complete(sk, hdev->id, 3044 MGMT_OP_UNPAIR_DEVICE, 3045 MGMT_STATUS_NOT_PAIRED, &rp, 3046 sizeof(rp)); 3047 goto unlock; 3048 } 3049 3050 goto done; 3051 } 3052 3053 /* LE address type */ 3054 addr_type = le_addr_type(cp->addr.type); 3055 3056 /* Abort any ongoing SMP pairing. Removes ltk and irk if they exist. */ 3057 err = smp_cancel_and_remove_pairing(hdev, &cp->addr.bdaddr, addr_type); 3058 if (err < 0) { 3059 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE, 3060 MGMT_STATUS_NOT_PAIRED, &rp, 3061 sizeof(rp)); 3062 goto unlock; 3063 } 3064 3065 conn = hci_conn_hash_lookup_le(hdev, &cp->addr.bdaddr, addr_type); 3066 if (!conn) { 3067 hci_conn_params_del(hdev, &cp->addr.bdaddr, addr_type); 3068 goto done; 3069 } 3070 3071 3072 /* Defer clearing up the connection parameters until closing to 3073 * give a chance of keeping them if a repairing happens. 3074 */ 3075 set_bit(HCI_CONN_PARAM_REMOVAL_PEND, &conn->flags); 3076 3077 /* Disable auto-connection parameters if present */ 3078 params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr, addr_type); 3079 if (params) { 3080 if (params->explicit_connect) 3081 params->auto_connect = HCI_AUTO_CONN_EXPLICIT; 3082 else 3083 params->auto_connect = HCI_AUTO_CONN_DISABLED; 3084 } 3085 3086 /* If disconnection is not requested, then clear the connection 3087 * variable so that the link is not terminated. 3088 */ 3089 if (!cp->disconnect) 3090 conn = NULL; 3091 3092 done: 3093 /* If the connection variable is set, then termination of the 3094 * link is requested. 3095 */ 3096 if (!conn) { 3097 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE, 0, 3098 &rp, sizeof(rp)); 3099 device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, sk); 3100 goto unlock; 3101 } 3102 3103 cmd = mgmt_pending_new(sk, MGMT_OP_UNPAIR_DEVICE, hdev, cp, 3104 sizeof(*cp)); 3105 if (!cmd) { 3106 err = -ENOMEM; 3107 goto unlock; 3108 } 3109 3110 cmd->cmd_complete = addr_cmd_complete; 3111 3112 err = hci_cmd_sync_queue(hdev, unpair_device_sync, cmd, 3113 unpair_device_complete); 3114 if (err < 0) 3115 mgmt_pending_free(cmd); 3116 3117 unlock: 3118 hci_dev_unlock(hdev); 3119 return err; 3120 } 3121 3122 static int disconnect(struct sock *sk, struct hci_dev *hdev, void *data, 3123 u16 len) 3124 { 3125 struct mgmt_cp_disconnect *cp = data; 3126 struct mgmt_rp_disconnect rp; 3127 struct mgmt_pending_cmd *cmd; 3128 struct hci_conn *conn; 3129 int err; 3130 3131 bt_dev_dbg(hdev, "sock %p", sk); 3132 3133 memset(&rp, 0, sizeof(rp)); 3134 bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr); 3135 rp.addr.type = cp->addr.type; 3136 3137 if (!bdaddr_type_is_valid(cp->addr.type)) 3138 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT, 3139 MGMT_STATUS_INVALID_PARAMS, 3140 &rp, sizeof(rp)); 3141 3142 hci_dev_lock(hdev); 3143 3144 if (!test_bit(HCI_UP, &hdev->flags)) { 3145 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT, 3146 MGMT_STATUS_NOT_POWERED, &rp, 3147 sizeof(rp)); 3148 goto failed; 3149 } 3150 3151 if (pending_find(MGMT_OP_DISCONNECT, hdev)) { 3152 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT, 3153 MGMT_STATUS_BUSY, &rp, sizeof(rp)); 3154 goto failed; 3155 } 3156 3157 if (cp->addr.type == BDADDR_BREDR) 3158 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, 3159 &cp->addr.bdaddr); 3160 else 3161 conn = hci_conn_hash_lookup_le(hdev, &cp->addr.bdaddr, 3162 le_addr_type(cp->addr.type)); 3163 3164 if (!conn || conn->state == BT_OPEN || conn->state == BT_CLOSED) { 3165 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT, 3166 MGMT_STATUS_NOT_CONNECTED, &rp, 3167 sizeof(rp)); 3168 goto failed; 3169 } 3170 3171 cmd = mgmt_pending_add(sk, MGMT_OP_DISCONNECT, hdev, data, len); 3172 if (!cmd) { 3173 err = -ENOMEM; 3174 goto failed; 3175 } 3176 3177 cmd->cmd_complete = generic_cmd_complete; 3178 3179 err = hci_disconnect(conn, HCI_ERROR_REMOTE_USER_TERM); 3180 if (err < 0) 3181 mgmt_pending_remove(cmd); 3182 3183 failed: 3184 hci_dev_unlock(hdev); 3185 return err; 3186 } 3187 3188 static u8 link_to_bdaddr(u8 link_type, u8 addr_type) 3189 { 3190 switch (link_type) { 3191 case LE_LINK: 3192 switch (addr_type) { 3193 case ADDR_LE_DEV_PUBLIC: 3194 return BDADDR_LE_PUBLIC; 3195 3196 default: 3197 /* Fallback to LE Random address type */ 3198 return BDADDR_LE_RANDOM; 3199 } 3200 3201 default: 3202 /* Fallback to BR/EDR type */ 3203 return BDADDR_BREDR; 3204 } 3205 } 3206 3207 static int get_connections(struct sock *sk, struct hci_dev *hdev, void *data, 3208 u16 data_len) 3209 { 3210 struct mgmt_rp_get_connections *rp; 3211 struct hci_conn *c; 3212 int err; 3213 u16 i; 3214 3215 bt_dev_dbg(hdev, "sock %p", sk); 3216 3217 hci_dev_lock(hdev); 3218 3219 if (!hdev_is_powered(hdev)) { 3220 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_CONNECTIONS, 3221 MGMT_STATUS_NOT_POWERED); 3222 goto unlock; 3223 } 3224 3225 i = 0; 3226 list_for_each_entry(c, &hdev->conn_hash.list, list) { 3227 if (test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags)) 3228 i++; 3229 } 3230 3231 rp = kmalloc(struct_size(rp, addr, i), GFP_KERNEL); 3232 if (!rp) { 3233 err = -ENOMEM; 3234 goto unlock; 3235 } 3236 3237 i = 0; 3238 list_for_each_entry(c, &hdev->conn_hash.list, list) { 3239 if (!test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags)) 3240 continue; 3241 bacpy(&rp->addr[i].bdaddr, &c->dst); 3242 rp->addr[i].type = link_to_bdaddr(c->type, c->dst_type); 3243 if (c->type == SCO_LINK || c->type == ESCO_LINK) 3244 continue; 3245 i++; 3246 } 3247 3248 rp->conn_count = cpu_to_le16(i); 3249 3250 /* Recalculate length in case of filtered SCO connections, etc */ 3251 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONNECTIONS, 0, rp, 3252 struct_size(rp, addr, i)); 3253 3254 kfree(rp); 3255 3256 unlock: 3257 hci_dev_unlock(hdev); 3258 return err; 3259 } 3260 3261 static int send_pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev, 3262 struct mgmt_cp_pin_code_neg_reply *cp) 3263 { 3264 struct mgmt_pending_cmd *cmd; 3265 int err; 3266 3267 cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_NEG_REPLY, hdev, cp, 3268 sizeof(*cp)); 3269 if (!cmd) 3270 return -ENOMEM; 3271 3272 cmd->cmd_complete = addr_cmd_complete; 3273 3274 err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_NEG_REPLY, 3275 sizeof(cp->addr.bdaddr), &cp->addr.bdaddr); 3276 if (err < 0) 3277 mgmt_pending_remove(cmd); 3278 3279 return err; 3280 } 3281 3282 static int pin_code_reply(struct sock *sk, struct hci_dev *hdev, void *data, 3283 u16 len) 3284 { 3285 struct hci_conn *conn; 3286 struct mgmt_cp_pin_code_reply *cp = data; 3287 struct hci_cp_pin_code_reply reply; 3288 struct mgmt_pending_cmd *cmd; 3289 int err; 3290 3291 bt_dev_dbg(hdev, "sock %p", sk); 3292 3293 hci_dev_lock(hdev); 3294 3295 if (!hdev_is_powered(hdev)) { 3296 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY, 3297 MGMT_STATUS_NOT_POWERED); 3298 goto failed; 3299 } 3300 3301 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->addr.bdaddr); 3302 if (!conn) { 3303 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY, 3304 MGMT_STATUS_NOT_CONNECTED); 3305 goto failed; 3306 } 3307 3308 if (conn->pending_sec_level == BT_SECURITY_HIGH && cp->pin_len != 16) { 3309 struct mgmt_cp_pin_code_neg_reply ncp; 3310 3311 memcpy(&ncp.addr, &cp->addr, sizeof(ncp.addr)); 3312 3313 bt_dev_err(hdev, "PIN code is not 16 bytes long"); 3314 3315 err = send_pin_code_neg_reply(sk, hdev, &ncp); 3316 if (err >= 0) 3317 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY, 3318 MGMT_STATUS_INVALID_PARAMS); 3319 3320 goto failed; 3321 } 3322 3323 cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_REPLY, hdev, data, len); 3324 if (!cmd) { 3325 err = -ENOMEM; 3326 goto failed; 3327 } 3328 3329 cmd->cmd_complete = addr_cmd_complete; 3330 3331 bacpy(&reply.bdaddr, &cp->addr.bdaddr); 3332 reply.pin_len = cp->pin_len; 3333 memcpy(reply.pin_code, cp->pin_code, sizeof(reply.pin_code)); 3334 3335 err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_REPLY, sizeof(reply), &reply); 3336 if (err < 0) 3337 mgmt_pending_remove(cmd); 3338 3339 failed: 3340 hci_dev_unlock(hdev); 3341 return err; 3342 } 3343 3344 static int set_io_capability(struct sock *sk, struct hci_dev *hdev, void *data, 3345 u16 len) 3346 { 3347 struct mgmt_cp_set_io_capability *cp = data; 3348 3349 bt_dev_dbg(hdev, "sock %p", sk); 3350 3351 if (cp->io_capability > SMP_IO_KEYBOARD_DISPLAY) 3352 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_IO_CAPABILITY, 3353 MGMT_STATUS_INVALID_PARAMS); 3354 3355 hci_dev_lock(hdev); 3356 3357 hdev->io_capability = cp->io_capability; 3358 3359 bt_dev_dbg(hdev, "IO capability set to 0x%02x", hdev->io_capability); 3360 3361 hci_dev_unlock(hdev); 3362 3363 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_IO_CAPABILITY, 0, 3364 NULL, 0); 3365 } 3366 3367 static struct mgmt_pending_cmd *find_pairing(struct hci_conn *conn) 3368 { 3369 struct hci_dev *hdev = conn->hdev; 3370 struct mgmt_pending_cmd *cmd; 3371 3372 list_for_each_entry(cmd, &hdev->mgmt_pending, list) { 3373 if (cmd->opcode != MGMT_OP_PAIR_DEVICE) 3374 continue; 3375 3376 if (cmd->user_data != conn) 3377 continue; 3378 3379 return cmd; 3380 } 3381 3382 return NULL; 3383 } 3384 3385 static int pairing_complete(struct mgmt_pending_cmd *cmd, u8 status) 3386 { 3387 struct mgmt_rp_pair_device rp; 3388 struct hci_conn *conn = cmd->user_data; 3389 int err; 3390 3391 bacpy(&rp.addr.bdaddr, &conn->dst); 3392 rp.addr.type = link_to_bdaddr(conn->type, conn->dst_type); 3393 3394 err = mgmt_cmd_complete(cmd->sk, cmd->index, MGMT_OP_PAIR_DEVICE, 3395 status, &rp, sizeof(rp)); 3396 3397 /* So we don't get further callbacks for this connection */ 3398 conn->connect_cfm_cb = NULL; 3399 conn->security_cfm_cb = NULL; 3400 conn->disconn_cfm_cb = NULL; 3401 3402 hci_conn_drop(conn); 3403 3404 /* The device is paired so there is no need to remove 3405 * its connection parameters anymore. 3406 */ 3407 clear_bit(HCI_CONN_PARAM_REMOVAL_PEND, &conn->flags); 3408 3409 hci_conn_put(conn); 3410 3411 return err; 3412 } 3413 3414 void mgmt_smp_complete(struct hci_conn *conn, bool complete) 3415 { 3416 u8 status = complete ? MGMT_STATUS_SUCCESS : MGMT_STATUS_FAILED; 3417 struct mgmt_pending_cmd *cmd; 3418 3419 cmd = find_pairing(conn); 3420 if (cmd) { 3421 cmd->cmd_complete(cmd, status); 3422 mgmt_pending_remove(cmd); 3423 } 3424 } 3425 3426 static void pairing_complete_cb(struct hci_conn *conn, u8 status) 3427 { 3428 struct mgmt_pending_cmd *cmd; 3429 3430 BT_DBG("status %u", status); 3431 3432 cmd = find_pairing(conn); 3433 if (!cmd) { 3434 BT_DBG("Unable to find a pending command"); 3435 return; 3436 } 3437 3438 cmd->cmd_complete(cmd, mgmt_status(status)); 3439 mgmt_pending_remove(cmd); 3440 } 3441 3442 static void le_pairing_complete_cb(struct hci_conn *conn, u8 status) 3443 { 3444 struct mgmt_pending_cmd *cmd; 3445 3446 BT_DBG("status %u", status); 3447 3448 if (!status) 3449 return; 3450 3451 cmd = find_pairing(conn); 3452 if (!cmd) { 3453 BT_DBG("Unable to find a pending command"); 3454 return; 3455 } 3456 3457 cmd->cmd_complete(cmd, mgmt_status(status)); 3458 mgmt_pending_remove(cmd); 3459 } 3460 3461 static int pair_device(struct sock *sk, struct hci_dev *hdev, void *data, 3462 u16 len) 3463 { 3464 struct mgmt_cp_pair_device *cp = data; 3465 struct mgmt_rp_pair_device rp; 3466 struct mgmt_pending_cmd *cmd; 3467 u8 sec_level, auth_type; 3468 struct hci_conn *conn; 3469 int err; 3470 3471 bt_dev_dbg(hdev, "sock %p", sk); 3472 3473 memset(&rp, 0, sizeof(rp)); 3474 bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr); 3475 rp.addr.type = cp->addr.type; 3476 3477 if (!bdaddr_type_is_valid(cp->addr.type)) 3478 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE, 3479 MGMT_STATUS_INVALID_PARAMS, 3480 &rp, sizeof(rp)); 3481 3482 if (cp->io_cap > SMP_IO_KEYBOARD_DISPLAY) 3483 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE, 3484 MGMT_STATUS_INVALID_PARAMS, 3485 &rp, sizeof(rp)); 3486 3487 hci_dev_lock(hdev); 3488 3489 if (!hdev_is_powered(hdev)) { 3490 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE, 3491 MGMT_STATUS_NOT_POWERED, &rp, 3492 sizeof(rp)); 3493 goto unlock; 3494 } 3495 3496 if (hci_bdaddr_is_paired(hdev, &cp->addr.bdaddr, cp->addr.type)) { 3497 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE, 3498 MGMT_STATUS_ALREADY_PAIRED, &rp, 3499 sizeof(rp)); 3500 goto unlock; 3501 } 3502 3503 sec_level = BT_SECURITY_MEDIUM; 3504 auth_type = HCI_AT_DEDICATED_BONDING; 3505 3506 if (cp->addr.type == BDADDR_BREDR) { 3507 conn = hci_connect_acl(hdev, &cp->addr.bdaddr, sec_level, 3508 auth_type, CONN_REASON_PAIR_DEVICE); 3509 } else { 3510 u8 addr_type = le_addr_type(cp->addr.type); 3511 struct hci_conn_params *p; 3512 3513 /* When pairing a new device, it is expected to remember 3514 * this device for future connections. Adding the connection 3515 * parameter information ahead of time allows tracking 3516 * of the peripheral preferred values and will speed up any 3517 * further connection establishment. 3518 * 3519 * If connection parameters already exist, then they 3520 * will be kept and this function does nothing. 3521 */ 3522 p = hci_conn_params_add(hdev, &cp->addr.bdaddr, addr_type); 3523 3524 if (p->auto_connect == HCI_AUTO_CONN_EXPLICIT) 3525 p->auto_connect = HCI_AUTO_CONN_DISABLED; 3526 3527 conn = hci_connect_le_scan(hdev, &cp->addr.bdaddr, addr_type, 3528 sec_level, HCI_LE_CONN_TIMEOUT, 3529 CONN_REASON_PAIR_DEVICE); 3530 } 3531 3532 if (IS_ERR(conn)) { 3533 int status; 3534 3535 if (PTR_ERR(conn) == -EBUSY) 3536 status = MGMT_STATUS_BUSY; 3537 else if (PTR_ERR(conn) == -EOPNOTSUPP) 3538 status = MGMT_STATUS_NOT_SUPPORTED; 3539 else if (PTR_ERR(conn) == -ECONNREFUSED) 3540 status = MGMT_STATUS_REJECTED; 3541 else 3542 status = MGMT_STATUS_CONNECT_FAILED; 3543 3544 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE, 3545 status, &rp, sizeof(rp)); 3546 goto unlock; 3547 } 3548 3549 if (conn->connect_cfm_cb) { 3550 hci_conn_drop(conn); 3551 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE, 3552 MGMT_STATUS_BUSY, &rp, sizeof(rp)); 3553 goto unlock; 3554 } 3555 3556 cmd = mgmt_pending_add(sk, MGMT_OP_PAIR_DEVICE, hdev, data, len); 3557 if (!cmd) { 3558 err = -ENOMEM; 3559 hci_conn_drop(conn); 3560 goto unlock; 3561 } 3562 3563 cmd->cmd_complete = pairing_complete; 3564 3565 /* For LE, just connecting isn't a proof that the pairing finished */ 3566 if (cp->addr.type == BDADDR_BREDR) { 3567 conn->connect_cfm_cb = pairing_complete_cb; 3568 conn->security_cfm_cb = pairing_complete_cb; 3569 conn->disconn_cfm_cb = pairing_complete_cb; 3570 } else { 3571 conn->connect_cfm_cb = le_pairing_complete_cb; 3572 conn->security_cfm_cb = le_pairing_complete_cb; 3573 conn->disconn_cfm_cb = le_pairing_complete_cb; 3574 } 3575 3576 conn->io_capability = cp->io_cap; 3577 cmd->user_data = hci_conn_get(conn); 3578 3579 if ((conn->state == BT_CONNECTED || conn->state == BT_CONFIG) && 3580 hci_conn_security(conn, sec_level, auth_type, true)) { 3581 cmd->cmd_complete(cmd, 0); 3582 mgmt_pending_remove(cmd); 3583 } 3584 3585 err = 0; 3586 3587 unlock: 3588 hci_dev_unlock(hdev); 3589 return err; 3590 } 3591 3592 static int cancel_pair_device(struct sock *sk, struct hci_dev *hdev, void *data, 3593 u16 len) 3594 { 3595 struct mgmt_addr_info *addr = data; 3596 struct mgmt_pending_cmd *cmd; 3597 struct hci_conn *conn; 3598 int err; 3599 3600 bt_dev_dbg(hdev, "sock %p", sk); 3601 3602 hci_dev_lock(hdev); 3603 3604 if (!hdev_is_powered(hdev)) { 3605 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE, 3606 MGMT_STATUS_NOT_POWERED); 3607 goto unlock; 3608 } 3609 3610 cmd = pending_find(MGMT_OP_PAIR_DEVICE, hdev); 3611 if (!cmd) { 3612 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE, 3613 MGMT_STATUS_INVALID_PARAMS); 3614 goto unlock; 3615 } 3616 3617 conn = cmd->user_data; 3618 3619 if (bacmp(&addr->bdaddr, &conn->dst) != 0) { 3620 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE, 3621 MGMT_STATUS_INVALID_PARAMS); 3622 goto unlock; 3623 } 3624 3625 cmd->cmd_complete(cmd, MGMT_STATUS_CANCELLED); 3626 mgmt_pending_remove(cmd); 3627 3628 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE, 0, 3629 addr, sizeof(*addr)); 3630 3631 /* Since user doesn't want to proceed with the connection, abort any 3632 * ongoing pairing and then terminate the link if it was created 3633 * because of the pair device action. 3634 */ 3635 if (addr->type == BDADDR_BREDR) 3636 hci_remove_link_key(hdev, &addr->bdaddr); 3637 else 3638 smp_cancel_and_remove_pairing(hdev, &addr->bdaddr, 3639 le_addr_type(addr->type)); 3640 3641 if (conn->conn_reason == CONN_REASON_PAIR_DEVICE) 3642 hci_abort_conn(conn, HCI_ERROR_REMOTE_USER_TERM); 3643 3644 unlock: 3645 hci_dev_unlock(hdev); 3646 return err; 3647 } 3648 3649 static int user_pairing_resp(struct sock *sk, struct hci_dev *hdev, 3650 struct mgmt_addr_info *addr, u16 mgmt_op, 3651 u16 hci_op, __le32 passkey) 3652 { 3653 struct mgmt_pending_cmd *cmd; 3654 struct hci_conn *conn; 3655 int err; 3656 3657 hci_dev_lock(hdev); 3658 3659 if (!hdev_is_powered(hdev)) { 3660 err = mgmt_cmd_complete(sk, hdev->id, mgmt_op, 3661 MGMT_STATUS_NOT_POWERED, addr, 3662 sizeof(*addr)); 3663 goto done; 3664 } 3665 3666 if (addr->type == BDADDR_BREDR) 3667 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &addr->bdaddr); 3668 else 3669 conn = hci_conn_hash_lookup_le(hdev, &addr->bdaddr, 3670 le_addr_type(addr->type)); 3671 3672 if (!conn) { 3673 err = mgmt_cmd_complete(sk, hdev->id, mgmt_op, 3674 MGMT_STATUS_NOT_CONNECTED, addr, 3675 sizeof(*addr)); 3676 goto done; 3677 } 3678 3679 if (addr->type == BDADDR_LE_PUBLIC || addr->type == BDADDR_LE_RANDOM) { 3680 err = smp_user_confirm_reply(conn, mgmt_op, passkey); 3681 if (!err) 3682 err = mgmt_cmd_complete(sk, hdev->id, mgmt_op, 3683 MGMT_STATUS_SUCCESS, addr, 3684 sizeof(*addr)); 3685 else 3686 err = mgmt_cmd_complete(sk, hdev->id, mgmt_op, 3687 MGMT_STATUS_FAILED, addr, 3688 sizeof(*addr)); 3689 3690 goto done; 3691 } 3692 3693 cmd = mgmt_pending_add(sk, mgmt_op, hdev, addr, sizeof(*addr)); 3694 if (!cmd) { 3695 err = -ENOMEM; 3696 goto done; 3697 } 3698 3699 cmd->cmd_complete = addr_cmd_complete; 3700 3701 /* Continue with pairing via HCI */ 3702 if (hci_op == HCI_OP_USER_PASSKEY_REPLY) { 3703 struct hci_cp_user_passkey_reply cp; 3704 3705 bacpy(&cp.bdaddr, &addr->bdaddr); 3706 cp.passkey = passkey; 3707 err = hci_send_cmd(hdev, hci_op, sizeof(cp), &cp); 3708 } else 3709 err = hci_send_cmd(hdev, hci_op, sizeof(addr->bdaddr), 3710 &addr->bdaddr); 3711 3712 if (err < 0) 3713 mgmt_pending_remove(cmd); 3714 3715 done: 3716 hci_dev_unlock(hdev); 3717 return err; 3718 } 3719 3720 static int pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev, 3721 void *data, u16 len) 3722 { 3723 struct mgmt_cp_pin_code_neg_reply *cp = data; 3724 3725 bt_dev_dbg(hdev, "sock %p", sk); 3726 3727 return user_pairing_resp(sk, hdev, &cp->addr, 3728 MGMT_OP_PIN_CODE_NEG_REPLY, 3729 HCI_OP_PIN_CODE_NEG_REPLY, 0); 3730 } 3731 3732 static int user_confirm_reply(struct sock *sk, struct hci_dev *hdev, void *data, 3733 u16 len) 3734 { 3735 struct mgmt_cp_user_confirm_reply *cp = data; 3736 3737 bt_dev_dbg(hdev, "sock %p", sk); 3738 3739 if (len != sizeof(*cp)) 3740 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_USER_CONFIRM_REPLY, 3741 MGMT_STATUS_INVALID_PARAMS); 3742 3743 return user_pairing_resp(sk, hdev, &cp->addr, 3744 MGMT_OP_USER_CONFIRM_REPLY, 3745 HCI_OP_USER_CONFIRM_REPLY, 0); 3746 } 3747 3748 static int user_confirm_neg_reply(struct sock *sk, struct hci_dev *hdev, 3749 void *data, u16 len) 3750 { 3751 struct mgmt_cp_user_confirm_neg_reply *cp = data; 3752 3753 bt_dev_dbg(hdev, "sock %p", sk); 3754 3755 return user_pairing_resp(sk, hdev, &cp->addr, 3756 MGMT_OP_USER_CONFIRM_NEG_REPLY, 3757 HCI_OP_USER_CONFIRM_NEG_REPLY, 0); 3758 } 3759 3760 static int user_passkey_reply(struct sock *sk, struct hci_dev *hdev, void *data, 3761 u16 len) 3762 { 3763 struct mgmt_cp_user_passkey_reply *cp = data; 3764 3765 bt_dev_dbg(hdev, "sock %p", sk); 3766 3767 return user_pairing_resp(sk, hdev, &cp->addr, 3768 MGMT_OP_USER_PASSKEY_REPLY, 3769 HCI_OP_USER_PASSKEY_REPLY, cp->passkey); 3770 } 3771 3772 static int user_passkey_neg_reply(struct sock *sk, struct hci_dev *hdev, 3773 void *data, u16 len) 3774 { 3775 struct mgmt_cp_user_passkey_neg_reply *cp = data; 3776 3777 bt_dev_dbg(hdev, "sock %p", sk); 3778 3779 return user_pairing_resp(sk, hdev, &cp->addr, 3780 MGMT_OP_USER_PASSKEY_NEG_REPLY, 3781 HCI_OP_USER_PASSKEY_NEG_REPLY, 0); 3782 } 3783 3784 static int adv_expire_sync(struct hci_dev *hdev, u32 flags) 3785 { 3786 struct adv_info *adv_instance; 3787 3788 adv_instance = hci_find_adv_instance(hdev, hdev->cur_adv_instance); 3789 if (!adv_instance) 3790 return 0; 3791 3792 /* stop if current instance doesn't need to be changed */ 3793 if (!(adv_instance->flags & flags)) 3794 return 0; 3795 3796 cancel_adv_timeout(hdev); 3797 3798 adv_instance = hci_get_next_instance(hdev, adv_instance->instance); 3799 if (!adv_instance) 3800 return 0; 3801 3802 hci_schedule_adv_instance_sync(hdev, adv_instance->instance, true); 3803 3804 return 0; 3805 } 3806 3807 static int name_changed_sync(struct hci_dev *hdev, void *data) 3808 { 3809 return adv_expire_sync(hdev, MGMT_ADV_FLAG_LOCAL_NAME); 3810 } 3811 3812 static void set_name_complete(struct hci_dev *hdev, void *data, int err) 3813 { 3814 struct mgmt_pending_cmd *cmd = data; 3815 struct mgmt_cp_set_local_name *cp = cmd->param; 3816 u8 status = mgmt_status(err); 3817 3818 bt_dev_dbg(hdev, "err %d", err); 3819 3820 if (cmd != pending_find(MGMT_OP_SET_LOCAL_NAME, hdev)) 3821 return; 3822 3823 if (status) { 3824 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 3825 status); 3826 } else { 3827 mgmt_cmd_complete(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0, 3828 cp, sizeof(*cp)); 3829 3830 if (hci_dev_test_flag(hdev, HCI_LE_ADV)) 3831 hci_cmd_sync_queue(hdev, name_changed_sync, NULL, NULL); 3832 } 3833 3834 mgmt_pending_remove(cmd); 3835 } 3836 3837 static int set_name_sync(struct hci_dev *hdev, void *data) 3838 { 3839 if (lmp_bredr_capable(hdev)) { 3840 hci_update_name_sync(hdev); 3841 hci_update_eir_sync(hdev); 3842 } 3843 3844 /* The name is stored in the scan response data and so 3845 * no need to update the advertising data here. 3846 */ 3847 if (lmp_le_capable(hdev) && hci_dev_test_flag(hdev, HCI_ADVERTISING)) 3848 hci_update_scan_rsp_data_sync(hdev, hdev->cur_adv_instance); 3849 3850 return 0; 3851 } 3852 3853 static int set_local_name(struct sock *sk, struct hci_dev *hdev, void *data, 3854 u16 len) 3855 { 3856 struct mgmt_cp_set_local_name *cp = data; 3857 struct mgmt_pending_cmd *cmd; 3858 int err; 3859 3860 bt_dev_dbg(hdev, "sock %p", sk); 3861 3862 hci_dev_lock(hdev); 3863 3864 /* If the old values are the same as the new ones just return a 3865 * direct command complete event. 3866 */ 3867 if (!memcmp(hdev->dev_name, cp->name, sizeof(hdev->dev_name)) && 3868 !memcmp(hdev->short_name, cp->short_name, 3869 sizeof(hdev->short_name))) { 3870 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0, 3871 data, len); 3872 goto failed; 3873 } 3874 3875 memcpy(hdev->short_name, cp->short_name, sizeof(hdev->short_name)); 3876 3877 if (!hdev_is_powered(hdev)) { 3878 memcpy(hdev->dev_name, cp->name, sizeof(hdev->dev_name)); 3879 3880 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0, 3881 data, len); 3882 if (err < 0) 3883 goto failed; 3884 3885 err = mgmt_limited_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, data, 3886 len, HCI_MGMT_LOCAL_NAME_EVENTS, sk); 3887 ext_info_changed(hdev, sk); 3888 3889 goto failed; 3890 } 3891 3892 cmd = mgmt_pending_add(sk, MGMT_OP_SET_LOCAL_NAME, hdev, data, len); 3893 if (!cmd) 3894 err = -ENOMEM; 3895 else 3896 err = hci_cmd_sync_queue(hdev, set_name_sync, cmd, 3897 set_name_complete); 3898 3899 if (err < 0) { 3900 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 3901 MGMT_STATUS_FAILED); 3902 3903 if (cmd) 3904 mgmt_pending_remove(cmd); 3905 3906 goto failed; 3907 } 3908 3909 memcpy(hdev->dev_name, cp->name, sizeof(hdev->dev_name)); 3910 3911 failed: 3912 hci_dev_unlock(hdev); 3913 return err; 3914 } 3915 3916 static int appearance_changed_sync(struct hci_dev *hdev, void *data) 3917 { 3918 return adv_expire_sync(hdev, MGMT_ADV_FLAG_APPEARANCE); 3919 } 3920 3921 static int set_appearance(struct sock *sk, struct hci_dev *hdev, void *data, 3922 u16 len) 3923 { 3924 struct mgmt_cp_set_appearance *cp = data; 3925 u16 appearance; 3926 int err; 3927 3928 bt_dev_dbg(hdev, "sock %p", sk); 3929 3930 if (!lmp_le_capable(hdev)) 3931 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_APPEARANCE, 3932 MGMT_STATUS_NOT_SUPPORTED); 3933 3934 appearance = le16_to_cpu(cp->appearance); 3935 3936 hci_dev_lock(hdev); 3937 3938 if (hdev->appearance != appearance) { 3939 hdev->appearance = appearance; 3940 3941 if (hci_dev_test_flag(hdev, HCI_LE_ADV)) 3942 hci_cmd_sync_queue(hdev, appearance_changed_sync, NULL, 3943 NULL); 3944 3945 ext_info_changed(hdev, sk); 3946 } 3947 3948 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_APPEARANCE, 0, NULL, 3949 0); 3950 3951 hci_dev_unlock(hdev); 3952 3953 return err; 3954 } 3955 3956 static int get_phy_configuration(struct sock *sk, struct hci_dev *hdev, 3957 void *data, u16 len) 3958 { 3959 struct mgmt_rp_get_phy_configuration rp; 3960 3961 bt_dev_dbg(hdev, "sock %p", sk); 3962 3963 hci_dev_lock(hdev); 3964 3965 memset(&rp, 0, sizeof(rp)); 3966 3967 rp.supported_phys = cpu_to_le32(get_supported_phys(hdev)); 3968 rp.selected_phys = cpu_to_le32(get_selected_phys(hdev)); 3969 rp.configurable_phys = cpu_to_le32(get_configurable_phys(hdev)); 3970 3971 hci_dev_unlock(hdev); 3972 3973 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_PHY_CONFIGURATION, 0, 3974 &rp, sizeof(rp)); 3975 } 3976 3977 int mgmt_phy_configuration_changed(struct hci_dev *hdev, struct sock *skip) 3978 { 3979 struct mgmt_ev_phy_configuration_changed ev; 3980 3981 memset(&ev, 0, sizeof(ev)); 3982 3983 ev.selected_phys = cpu_to_le32(get_selected_phys(hdev)); 3984 3985 return mgmt_event(MGMT_EV_PHY_CONFIGURATION_CHANGED, hdev, &ev, 3986 sizeof(ev), skip); 3987 } 3988 3989 static void set_default_phy_complete(struct hci_dev *hdev, void *data, int err) 3990 { 3991 struct mgmt_pending_cmd *cmd = data; 3992 struct sk_buff *skb = cmd->skb; 3993 u8 status = mgmt_status(err); 3994 3995 if (cmd != pending_find(MGMT_OP_SET_PHY_CONFIGURATION, hdev)) 3996 return; 3997 3998 if (!status) { 3999 if (!skb) 4000 status = MGMT_STATUS_FAILED; 4001 else if (IS_ERR(skb)) 4002 status = mgmt_status(PTR_ERR(skb)); 4003 else 4004 status = mgmt_status(skb->data[0]); 4005 } 4006 4007 bt_dev_dbg(hdev, "status %d", status); 4008 4009 if (status) { 4010 mgmt_cmd_status(cmd->sk, hdev->id, 4011 MGMT_OP_SET_PHY_CONFIGURATION, status); 4012 } else { 4013 mgmt_cmd_complete(cmd->sk, hdev->id, 4014 MGMT_OP_SET_PHY_CONFIGURATION, 0, 4015 NULL, 0); 4016 4017 mgmt_phy_configuration_changed(hdev, cmd->sk); 4018 } 4019 4020 if (skb && !IS_ERR(skb)) 4021 kfree_skb(skb); 4022 4023 mgmt_pending_remove(cmd); 4024 } 4025 4026 static int set_default_phy_sync(struct hci_dev *hdev, void *data) 4027 { 4028 struct mgmt_pending_cmd *cmd = data; 4029 struct mgmt_cp_set_phy_configuration *cp = cmd->param; 4030 struct hci_cp_le_set_default_phy cp_phy; 4031 u32 selected_phys = __le32_to_cpu(cp->selected_phys); 4032 4033 memset(&cp_phy, 0, sizeof(cp_phy)); 4034 4035 if (!(selected_phys & MGMT_PHY_LE_TX_MASK)) 4036 cp_phy.all_phys |= 0x01; 4037 4038 if (!(selected_phys & MGMT_PHY_LE_RX_MASK)) 4039 cp_phy.all_phys |= 0x02; 4040 4041 if (selected_phys & MGMT_PHY_LE_1M_TX) 4042 cp_phy.tx_phys |= HCI_LE_SET_PHY_1M; 4043 4044 if (selected_phys & MGMT_PHY_LE_2M_TX) 4045 cp_phy.tx_phys |= HCI_LE_SET_PHY_2M; 4046 4047 if (selected_phys & MGMT_PHY_LE_CODED_TX) 4048 cp_phy.tx_phys |= HCI_LE_SET_PHY_CODED; 4049 4050 if (selected_phys & MGMT_PHY_LE_1M_RX) 4051 cp_phy.rx_phys |= HCI_LE_SET_PHY_1M; 4052 4053 if (selected_phys & MGMT_PHY_LE_2M_RX) 4054 cp_phy.rx_phys |= HCI_LE_SET_PHY_2M; 4055 4056 if (selected_phys & MGMT_PHY_LE_CODED_RX) 4057 cp_phy.rx_phys |= HCI_LE_SET_PHY_CODED; 4058 4059 cmd->skb = __hci_cmd_sync(hdev, HCI_OP_LE_SET_DEFAULT_PHY, 4060 sizeof(cp_phy), &cp_phy, HCI_CMD_TIMEOUT); 4061 4062 return 0; 4063 } 4064 4065 static int set_phy_configuration(struct sock *sk, struct hci_dev *hdev, 4066 void *data, u16 len) 4067 { 4068 struct mgmt_cp_set_phy_configuration *cp = data; 4069 struct mgmt_pending_cmd *cmd; 4070 u32 selected_phys, configurable_phys, supported_phys, unconfigure_phys; 4071 u16 pkt_type = (HCI_DH1 | HCI_DM1); 4072 bool changed = false; 4073 int err; 4074 4075 bt_dev_dbg(hdev, "sock %p", sk); 4076 4077 configurable_phys = get_configurable_phys(hdev); 4078 supported_phys = get_supported_phys(hdev); 4079 selected_phys = __le32_to_cpu(cp->selected_phys); 4080 4081 if (selected_phys & ~supported_phys) 4082 return mgmt_cmd_status(sk, hdev->id, 4083 MGMT_OP_SET_PHY_CONFIGURATION, 4084 MGMT_STATUS_INVALID_PARAMS); 4085 4086 unconfigure_phys = supported_phys & ~configurable_phys; 4087 4088 if ((selected_phys & unconfigure_phys) != unconfigure_phys) 4089 return mgmt_cmd_status(sk, hdev->id, 4090 MGMT_OP_SET_PHY_CONFIGURATION, 4091 MGMT_STATUS_INVALID_PARAMS); 4092 4093 if (selected_phys == get_selected_phys(hdev)) 4094 return mgmt_cmd_complete(sk, hdev->id, 4095 MGMT_OP_SET_PHY_CONFIGURATION, 4096 0, NULL, 0); 4097 4098 hci_dev_lock(hdev); 4099 4100 if (!hdev_is_powered(hdev)) { 4101 err = mgmt_cmd_status(sk, hdev->id, 4102 MGMT_OP_SET_PHY_CONFIGURATION, 4103 MGMT_STATUS_REJECTED); 4104 goto unlock; 4105 } 4106 4107 if (pending_find(MGMT_OP_SET_PHY_CONFIGURATION, hdev)) { 4108 err = mgmt_cmd_status(sk, hdev->id, 4109 MGMT_OP_SET_PHY_CONFIGURATION, 4110 MGMT_STATUS_BUSY); 4111 goto unlock; 4112 } 4113 4114 if (selected_phys & MGMT_PHY_BR_1M_3SLOT) 4115 pkt_type |= (HCI_DH3 | HCI_DM3); 4116 else 4117 pkt_type &= ~(HCI_DH3 | HCI_DM3); 4118 4119 if (selected_phys & MGMT_PHY_BR_1M_5SLOT) 4120 pkt_type |= (HCI_DH5 | HCI_DM5); 4121 else 4122 pkt_type &= ~(HCI_DH5 | HCI_DM5); 4123 4124 if (selected_phys & MGMT_PHY_EDR_2M_1SLOT) 4125 pkt_type &= ~HCI_2DH1; 4126 else 4127 pkt_type |= HCI_2DH1; 4128 4129 if (selected_phys & MGMT_PHY_EDR_2M_3SLOT) 4130 pkt_type &= ~HCI_2DH3; 4131 else 4132 pkt_type |= HCI_2DH3; 4133 4134 if (selected_phys & MGMT_PHY_EDR_2M_5SLOT) 4135 pkt_type &= ~HCI_2DH5; 4136 else 4137 pkt_type |= HCI_2DH5; 4138 4139 if (selected_phys & MGMT_PHY_EDR_3M_1SLOT) 4140 pkt_type &= ~HCI_3DH1; 4141 else 4142 pkt_type |= HCI_3DH1; 4143 4144 if (selected_phys & MGMT_PHY_EDR_3M_3SLOT) 4145 pkt_type &= ~HCI_3DH3; 4146 else 4147 pkt_type |= HCI_3DH3; 4148 4149 if (selected_phys & MGMT_PHY_EDR_3M_5SLOT) 4150 pkt_type &= ~HCI_3DH5; 4151 else 4152 pkt_type |= HCI_3DH5; 4153 4154 if (pkt_type != hdev->pkt_type) { 4155 hdev->pkt_type = pkt_type; 4156 changed = true; 4157 } 4158 4159 if ((selected_phys & MGMT_PHY_LE_MASK) == 4160 (get_selected_phys(hdev) & MGMT_PHY_LE_MASK)) { 4161 if (changed) 4162 mgmt_phy_configuration_changed(hdev, sk); 4163 4164 err = mgmt_cmd_complete(sk, hdev->id, 4165 MGMT_OP_SET_PHY_CONFIGURATION, 4166 0, NULL, 0); 4167 4168 goto unlock; 4169 } 4170 4171 cmd = mgmt_pending_add(sk, MGMT_OP_SET_PHY_CONFIGURATION, hdev, data, 4172 len); 4173 if (!cmd) 4174 err = -ENOMEM; 4175 else 4176 err = hci_cmd_sync_queue(hdev, set_default_phy_sync, cmd, 4177 set_default_phy_complete); 4178 4179 if (err < 0) { 4180 err = mgmt_cmd_status(sk, hdev->id, 4181 MGMT_OP_SET_PHY_CONFIGURATION, 4182 MGMT_STATUS_FAILED); 4183 4184 if (cmd) 4185 mgmt_pending_remove(cmd); 4186 } 4187 4188 unlock: 4189 hci_dev_unlock(hdev); 4190 4191 return err; 4192 } 4193 4194 static int set_blocked_keys(struct sock *sk, struct hci_dev *hdev, void *data, 4195 u16 len) 4196 { 4197 int err = MGMT_STATUS_SUCCESS; 4198 struct mgmt_cp_set_blocked_keys *keys = data; 4199 const u16 max_key_count = ((U16_MAX - sizeof(*keys)) / 4200 sizeof(struct mgmt_blocked_key_info)); 4201 u16 key_count, expected_len; 4202 int i; 4203 4204 bt_dev_dbg(hdev, "sock %p", sk); 4205 4206 key_count = __le16_to_cpu(keys->key_count); 4207 if (key_count > max_key_count) { 4208 bt_dev_err(hdev, "too big key_count value %u", key_count); 4209 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BLOCKED_KEYS, 4210 MGMT_STATUS_INVALID_PARAMS); 4211 } 4212 4213 expected_len = struct_size(keys, keys, key_count); 4214 if (expected_len != len) { 4215 bt_dev_err(hdev, "expected %u bytes, got %u bytes", 4216 expected_len, len); 4217 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BLOCKED_KEYS, 4218 MGMT_STATUS_INVALID_PARAMS); 4219 } 4220 4221 hci_dev_lock(hdev); 4222 4223 hci_blocked_keys_clear(hdev); 4224 4225 for (i = 0; i < key_count; ++i) { 4226 struct blocked_key *b = kzalloc(sizeof(*b), GFP_KERNEL); 4227 4228 if (!b) { 4229 err = MGMT_STATUS_NO_RESOURCES; 4230 break; 4231 } 4232 4233 b->type = keys->keys[i].type; 4234 memcpy(b->val, keys->keys[i].val, sizeof(b->val)); 4235 list_add_rcu(&b->list, &hdev->blocked_keys); 4236 } 4237 hci_dev_unlock(hdev); 4238 4239 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_BLOCKED_KEYS, 4240 err, NULL, 0); 4241 } 4242 4243 static int set_wideband_speech(struct sock *sk, struct hci_dev *hdev, 4244 void *data, u16 len) 4245 { 4246 struct mgmt_mode *cp = data; 4247 int err; 4248 bool changed = false; 4249 4250 bt_dev_dbg(hdev, "sock %p", sk); 4251 4252 if (!test_bit(HCI_QUIRK_WIDEBAND_SPEECH_SUPPORTED, &hdev->quirks)) 4253 return mgmt_cmd_status(sk, hdev->id, 4254 MGMT_OP_SET_WIDEBAND_SPEECH, 4255 MGMT_STATUS_NOT_SUPPORTED); 4256 4257 if (cp->val != 0x00 && cp->val != 0x01) 4258 return mgmt_cmd_status(sk, hdev->id, 4259 MGMT_OP_SET_WIDEBAND_SPEECH, 4260 MGMT_STATUS_INVALID_PARAMS); 4261 4262 hci_dev_lock(hdev); 4263 4264 if (hdev_is_powered(hdev) && 4265 !!cp->val != hci_dev_test_flag(hdev, 4266 HCI_WIDEBAND_SPEECH_ENABLED)) { 4267 err = mgmt_cmd_status(sk, hdev->id, 4268 MGMT_OP_SET_WIDEBAND_SPEECH, 4269 MGMT_STATUS_REJECTED); 4270 goto unlock; 4271 } 4272 4273 if (cp->val) 4274 changed = !hci_dev_test_and_set_flag(hdev, 4275 HCI_WIDEBAND_SPEECH_ENABLED); 4276 else 4277 changed = hci_dev_test_and_clear_flag(hdev, 4278 HCI_WIDEBAND_SPEECH_ENABLED); 4279 4280 err = send_settings_rsp(sk, MGMT_OP_SET_WIDEBAND_SPEECH, hdev); 4281 if (err < 0) 4282 goto unlock; 4283 4284 if (changed) 4285 err = new_settings(hdev, sk); 4286 4287 unlock: 4288 hci_dev_unlock(hdev); 4289 return err; 4290 } 4291 4292 static int read_controller_cap(struct sock *sk, struct hci_dev *hdev, 4293 void *data, u16 data_len) 4294 { 4295 char buf[20]; 4296 struct mgmt_rp_read_controller_cap *rp = (void *)buf; 4297 u16 cap_len = 0; 4298 u8 flags = 0; 4299 u8 tx_power_range[2]; 4300 4301 bt_dev_dbg(hdev, "sock %p", sk); 4302 4303 memset(&buf, 0, sizeof(buf)); 4304 4305 hci_dev_lock(hdev); 4306 4307 /* When the Read Simple Pairing Options command is supported, then 4308 * the remote public key validation is supported. 4309 * 4310 * Alternatively, when Microsoft extensions are available, they can 4311 * indicate support for public key validation as well. 4312 */ 4313 if ((hdev->commands[41] & 0x08) || msft_curve_validity(hdev)) 4314 flags |= 0x01; /* Remote public key validation (BR/EDR) */ 4315 4316 flags |= 0x02; /* Remote public key validation (LE) */ 4317 4318 /* When the Read Encryption Key Size command is supported, then the 4319 * encryption key size is enforced. 4320 */ 4321 if (hdev->commands[20] & 0x10) 4322 flags |= 0x04; /* Encryption key size enforcement (BR/EDR) */ 4323 4324 flags |= 0x08; /* Encryption key size enforcement (LE) */ 4325 4326 cap_len = eir_append_data(rp->cap, cap_len, MGMT_CAP_SEC_FLAGS, 4327 &flags, 1); 4328 4329 /* When the Read Simple Pairing Options command is supported, then 4330 * also max encryption key size information is provided. 4331 */ 4332 if (hdev->commands[41] & 0x08) 4333 cap_len = eir_append_le16(rp->cap, cap_len, 4334 MGMT_CAP_MAX_ENC_KEY_SIZE, 4335 hdev->max_enc_key_size); 4336 4337 cap_len = eir_append_le16(rp->cap, cap_len, 4338 MGMT_CAP_SMP_MAX_ENC_KEY_SIZE, 4339 SMP_MAX_ENC_KEY_SIZE); 4340 4341 /* Append the min/max LE tx power parameters if we were able to fetch 4342 * it from the controller 4343 */ 4344 if (hdev->commands[38] & 0x80) { 4345 memcpy(&tx_power_range[0], &hdev->min_le_tx_power, 1); 4346 memcpy(&tx_power_range[1], &hdev->max_le_tx_power, 1); 4347 cap_len = eir_append_data(rp->cap, cap_len, MGMT_CAP_LE_TX_PWR, 4348 tx_power_range, 2); 4349 } 4350 4351 rp->cap_len = cpu_to_le16(cap_len); 4352 4353 hci_dev_unlock(hdev); 4354 4355 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_CONTROLLER_CAP, 0, 4356 rp, sizeof(*rp) + cap_len); 4357 } 4358 4359 #ifdef CONFIG_BT_FEATURE_DEBUG 4360 /* d4992530-b9ec-469f-ab01-6c481c47da1c */ 4361 static const u8 debug_uuid[16] = { 4362 0x1c, 0xda, 0x47, 0x1c, 0x48, 0x6c, 0x01, 0xab, 4363 0x9f, 0x46, 0xec, 0xb9, 0x30, 0x25, 0x99, 0xd4, 4364 }; 4365 #endif 4366 4367 /* 330859bc-7506-492d-9370-9a6f0614037f */ 4368 static const u8 quality_report_uuid[16] = { 4369 0x7f, 0x03, 0x14, 0x06, 0x6f, 0x9a, 0x70, 0x93, 4370 0x2d, 0x49, 0x06, 0x75, 0xbc, 0x59, 0x08, 0x33, 4371 }; 4372 4373 /* a6695ace-ee7f-4fb9-881a-5fac66c629af */ 4374 static const u8 offload_codecs_uuid[16] = { 4375 0xaf, 0x29, 0xc6, 0x66, 0xac, 0x5f, 0x1a, 0x88, 4376 0xb9, 0x4f, 0x7f, 0xee, 0xce, 0x5a, 0x69, 0xa6, 4377 }; 4378 4379 /* 671b10b5-42c0-4696-9227-eb28d1b049d6 */ 4380 static const u8 le_simultaneous_roles_uuid[16] = { 4381 0xd6, 0x49, 0xb0, 0xd1, 0x28, 0xeb, 0x27, 0x92, 4382 0x96, 0x46, 0xc0, 0x42, 0xb5, 0x10, 0x1b, 0x67, 4383 }; 4384 4385 /* 15c0a148-c273-11ea-b3de-0242ac130004 */ 4386 static const u8 rpa_resolution_uuid[16] = { 4387 0x04, 0x00, 0x13, 0xac, 0x42, 0x02, 0xde, 0xb3, 4388 0xea, 0x11, 0x73, 0xc2, 0x48, 0xa1, 0xc0, 0x15, 4389 }; 4390 4391 /* 6fbaf188-05e0-496a-9885-d6ddfdb4e03e */ 4392 static const u8 iso_socket_uuid[16] = { 4393 0x3e, 0xe0, 0xb4, 0xfd, 0xdd, 0xd6, 0x85, 0x98, 4394 0x6a, 0x49, 0xe0, 0x05, 0x88, 0xf1, 0xba, 0x6f, 4395 }; 4396 4397 /* 2ce463d7-7a03-4d8d-bf05-5f24e8f36e76 */ 4398 static const u8 mgmt_mesh_uuid[16] = { 4399 0x76, 0x6e, 0xf3, 0xe8, 0x24, 0x5f, 0x05, 0xbf, 4400 0x8d, 0x4d, 0x03, 0x7a, 0xd7, 0x63, 0xe4, 0x2c, 4401 }; 4402 4403 static int read_exp_features_info(struct sock *sk, struct hci_dev *hdev, 4404 void *data, u16 data_len) 4405 { 4406 struct mgmt_rp_read_exp_features_info *rp; 4407 size_t len; 4408 u16 idx = 0; 4409 u32 flags; 4410 int status; 4411 4412 bt_dev_dbg(hdev, "sock %p", sk); 4413 4414 /* Enough space for 7 features */ 4415 len = sizeof(*rp) + (sizeof(rp->features[0]) * 7); 4416 rp = kzalloc(len, GFP_KERNEL); 4417 if (!rp) 4418 return -ENOMEM; 4419 4420 #ifdef CONFIG_BT_FEATURE_DEBUG 4421 if (!hdev) { 4422 flags = bt_dbg_get() ? BIT(0) : 0; 4423 4424 memcpy(rp->features[idx].uuid, debug_uuid, 16); 4425 rp->features[idx].flags = cpu_to_le32(flags); 4426 idx++; 4427 } 4428 #endif 4429 4430 if (hdev && hci_dev_le_state_simultaneous(hdev)) { 4431 if (hci_dev_test_flag(hdev, HCI_LE_SIMULTANEOUS_ROLES)) 4432 flags = BIT(0); 4433 else 4434 flags = 0; 4435 4436 memcpy(rp->features[idx].uuid, le_simultaneous_roles_uuid, 16); 4437 rp->features[idx].flags = cpu_to_le32(flags); 4438 idx++; 4439 } 4440 4441 if (hdev && ll_privacy_capable(hdev)) { 4442 if (hci_dev_test_flag(hdev, HCI_ENABLE_LL_PRIVACY)) 4443 flags = BIT(0) | BIT(1); 4444 else 4445 flags = BIT(1); 4446 4447 memcpy(rp->features[idx].uuid, rpa_resolution_uuid, 16); 4448 rp->features[idx].flags = cpu_to_le32(flags); 4449 idx++; 4450 } 4451 4452 if (hdev && (aosp_has_quality_report(hdev) || 4453 hdev->set_quality_report)) { 4454 if (hci_dev_test_flag(hdev, HCI_QUALITY_REPORT)) 4455 flags = BIT(0); 4456 else 4457 flags = 0; 4458 4459 memcpy(rp->features[idx].uuid, quality_report_uuid, 16); 4460 rp->features[idx].flags = cpu_to_le32(flags); 4461 idx++; 4462 } 4463 4464 if (hdev && hdev->get_data_path_id) { 4465 if (hci_dev_test_flag(hdev, HCI_OFFLOAD_CODECS_ENABLED)) 4466 flags = BIT(0); 4467 else 4468 flags = 0; 4469 4470 memcpy(rp->features[idx].uuid, offload_codecs_uuid, 16); 4471 rp->features[idx].flags = cpu_to_le32(flags); 4472 idx++; 4473 } 4474 4475 if (IS_ENABLED(CONFIG_BT_LE)) { 4476 flags = iso_enabled() ? BIT(0) : 0; 4477 memcpy(rp->features[idx].uuid, iso_socket_uuid, 16); 4478 rp->features[idx].flags = cpu_to_le32(flags); 4479 idx++; 4480 } 4481 4482 if (hdev && lmp_le_capable(hdev)) { 4483 if (hci_dev_test_flag(hdev, HCI_MESH_EXPERIMENTAL)) 4484 flags = BIT(0); 4485 else 4486 flags = 0; 4487 4488 memcpy(rp->features[idx].uuid, mgmt_mesh_uuid, 16); 4489 rp->features[idx].flags = cpu_to_le32(flags); 4490 idx++; 4491 } 4492 4493 rp->feature_count = cpu_to_le16(idx); 4494 4495 /* After reading the experimental features information, enable 4496 * the events to update client on any future change. 4497 */ 4498 hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS); 4499 4500 status = mgmt_cmd_complete(sk, hdev ? hdev->id : MGMT_INDEX_NONE, 4501 MGMT_OP_READ_EXP_FEATURES_INFO, 4502 0, rp, sizeof(*rp) + (20 * idx)); 4503 4504 kfree(rp); 4505 return status; 4506 } 4507 4508 static int exp_ll_privacy_feature_changed(bool enabled, struct hci_dev *hdev, 4509 struct sock *skip) 4510 { 4511 struct mgmt_ev_exp_feature_changed ev; 4512 4513 memset(&ev, 0, sizeof(ev)); 4514 memcpy(ev.uuid, rpa_resolution_uuid, 16); 4515 ev.flags = cpu_to_le32((enabled ? BIT(0) : 0) | BIT(1)); 4516 4517 // Do we need to be atomic with the conn_flags? 4518 if (enabled && privacy_mode_capable(hdev)) 4519 hdev->conn_flags |= HCI_CONN_FLAG_DEVICE_PRIVACY; 4520 else 4521 hdev->conn_flags &= ~HCI_CONN_FLAG_DEVICE_PRIVACY; 4522 4523 return mgmt_limited_event(MGMT_EV_EXP_FEATURE_CHANGED, hdev, 4524 &ev, sizeof(ev), 4525 HCI_MGMT_EXP_FEATURE_EVENTS, skip); 4526 4527 } 4528 4529 static int exp_feature_changed(struct hci_dev *hdev, const u8 *uuid, 4530 bool enabled, struct sock *skip) 4531 { 4532 struct mgmt_ev_exp_feature_changed ev; 4533 4534 memset(&ev, 0, sizeof(ev)); 4535 memcpy(ev.uuid, uuid, 16); 4536 ev.flags = cpu_to_le32(enabled ? BIT(0) : 0); 4537 4538 return mgmt_limited_event(MGMT_EV_EXP_FEATURE_CHANGED, hdev, 4539 &ev, sizeof(ev), 4540 HCI_MGMT_EXP_FEATURE_EVENTS, skip); 4541 } 4542 4543 #define EXP_FEAT(_uuid, _set_func) \ 4544 { \ 4545 .uuid = _uuid, \ 4546 .set_func = _set_func, \ 4547 } 4548 4549 /* The zero key uuid is special. Multiple exp features are set through it. */ 4550 static int set_zero_key_func(struct sock *sk, struct hci_dev *hdev, 4551 struct mgmt_cp_set_exp_feature *cp, u16 data_len) 4552 { 4553 struct mgmt_rp_set_exp_feature rp; 4554 4555 memset(rp.uuid, 0, 16); 4556 rp.flags = cpu_to_le32(0); 4557 4558 #ifdef CONFIG_BT_FEATURE_DEBUG 4559 if (!hdev) { 4560 bool changed = bt_dbg_get(); 4561 4562 bt_dbg_set(false); 4563 4564 if (changed) 4565 exp_feature_changed(NULL, ZERO_KEY, false, sk); 4566 } 4567 #endif 4568 4569 if (hdev && use_ll_privacy(hdev) && !hdev_is_powered(hdev)) { 4570 bool changed; 4571 4572 changed = hci_dev_test_and_clear_flag(hdev, 4573 HCI_ENABLE_LL_PRIVACY); 4574 if (changed) 4575 exp_feature_changed(hdev, rpa_resolution_uuid, false, 4576 sk); 4577 } 4578 4579 hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS); 4580 4581 return mgmt_cmd_complete(sk, hdev ? hdev->id : MGMT_INDEX_NONE, 4582 MGMT_OP_SET_EXP_FEATURE, 0, 4583 &rp, sizeof(rp)); 4584 } 4585 4586 #ifdef CONFIG_BT_FEATURE_DEBUG 4587 static int set_debug_func(struct sock *sk, struct hci_dev *hdev, 4588 struct mgmt_cp_set_exp_feature *cp, u16 data_len) 4589 { 4590 struct mgmt_rp_set_exp_feature rp; 4591 4592 bool val, changed; 4593 int err; 4594 4595 /* Command requires to use the non-controller index */ 4596 if (hdev) 4597 return mgmt_cmd_status(sk, hdev->id, 4598 MGMT_OP_SET_EXP_FEATURE, 4599 MGMT_STATUS_INVALID_INDEX); 4600 4601 /* Parameters are limited to a single octet */ 4602 if (data_len != MGMT_SET_EXP_FEATURE_SIZE + 1) 4603 return mgmt_cmd_status(sk, MGMT_INDEX_NONE, 4604 MGMT_OP_SET_EXP_FEATURE, 4605 MGMT_STATUS_INVALID_PARAMS); 4606 4607 /* Only boolean on/off is supported */ 4608 if (cp->param[0] != 0x00 && cp->param[0] != 0x01) 4609 return mgmt_cmd_status(sk, MGMT_INDEX_NONE, 4610 MGMT_OP_SET_EXP_FEATURE, 4611 MGMT_STATUS_INVALID_PARAMS); 4612 4613 val = !!cp->param[0]; 4614 changed = val ? !bt_dbg_get() : bt_dbg_get(); 4615 bt_dbg_set(val); 4616 4617 memcpy(rp.uuid, debug_uuid, 16); 4618 rp.flags = cpu_to_le32(val ? BIT(0) : 0); 4619 4620 hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS); 4621 4622 err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE, 4623 MGMT_OP_SET_EXP_FEATURE, 0, 4624 &rp, sizeof(rp)); 4625 4626 if (changed) 4627 exp_feature_changed(hdev, debug_uuid, val, sk); 4628 4629 return err; 4630 } 4631 #endif 4632 4633 static int set_mgmt_mesh_func(struct sock *sk, struct hci_dev *hdev, 4634 struct mgmt_cp_set_exp_feature *cp, u16 data_len) 4635 { 4636 struct mgmt_rp_set_exp_feature rp; 4637 bool val, changed; 4638 int err; 4639 4640 /* Command requires to use the controller index */ 4641 if (!hdev) 4642 return mgmt_cmd_status(sk, MGMT_INDEX_NONE, 4643 MGMT_OP_SET_EXP_FEATURE, 4644 MGMT_STATUS_INVALID_INDEX); 4645 4646 /* Parameters are limited to a single octet */ 4647 if (data_len != MGMT_SET_EXP_FEATURE_SIZE + 1) 4648 return mgmt_cmd_status(sk, hdev->id, 4649 MGMT_OP_SET_EXP_FEATURE, 4650 MGMT_STATUS_INVALID_PARAMS); 4651 4652 /* Only boolean on/off is supported */ 4653 if (cp->param[0] != 0x00 && cp->param[0] != 0x01) 4654 return mgmt_cmd_status(sk, hdev->id, 4655 MGMT_OP_SET_EXP_FEATURE, 4656 MGMT_STATUS_INVALID_PARAMS); 4657 4658 val = !!cp->param[0]; 4659 4660 if (val) { 4661 changed = !hci_dev_test_and_set_flag(hdev, 4662 HCI_MESH_EXPERIMENTAL); 4663 } else { 4664 hci_dev_clear_flag(hdev, HCI_MESH); 4665 changed = hci_dev_test_and_clear_flag(hdev, 4666 HCI_MESH_EXPERIMENTAL); 4667 } 4668 4669 memcpy(rp.uuid, mgmt_mesh_uuid, 16); 4670 rp.flags = cpu_to_le32(val ? BIT(0) : 0); 4671 4672 hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS); 4673 4674 err = mgmt_cmd_complete(sk, hdev->id, 4675 MGMT_OP_SET_EXP_FEATURE, 0, 4676 &rp, sizeof(rp)); 4677 4678 if (changed) 4679 exp_feature_changed(hdev, mgmt_mesh_uuid, val, sk); 4680 4681 return err; 4682 } 4683 4684 static int set_rpa_resolution_func(struct sock *sk, struct hci_dev *hdev, 4685 struct mgmt_cp_set_exp_feature *cp, 4686 u16 data_len) 4687 { 4688 struct mgmt_rp_set_exp_feature rp; 4689 bool val, changed; 4690 int err; 4691 u32 flags; 4692 4693 /* Command requires to use the controller index */ 4694 if (!hdev) 4695 return mgmt_cmd_status(sk, MGMT_INDEX_NONE, 4696 MGMT_OP_SET_EXP_FEATURE, 4697 MGMT_STATUS_INVALID_INDEX); 4698 4699 /* Changes can only be made when controller is powered down */ 4700 if (hdev_is_powered(hdev)) 4701 return mgmt_cmd_status(sk, hdev->id, 4702 MGMT_OP_SET_EXP_FEATURE, 4703 MGMT_STATUS_REJECTED); 4704 4705 /* Parameters are limited to a single octet */ 4706 if (data_len != MGMT_SET_EXP_FEATURE_SIZE + 1) 4707 return mgmt_cmd_status(sk, hdev->id, 4708 MGMT_OP_SET_EXP_FEATURE, 4709 MGMT_STATUS_INVALID_PARAMS); 4710 4711 /* Only boolean on/off is supported */ 4712 if (cp->param[0] != 0x00 && cp->param[0] != 0x01) 4713 return mgmt_cmd_status(sk, hdev->id, 4714 MGMT_OP_SET_EXP_FEATURE, 4715 MGMT_STATUS_INVALID_PARAMS); 4716 4717 val = !!cp->param[0]; 4718 4719 if (val) { 4720 changed = !hci_dev_test_and_set_flag(hdev, 4721 HCI_ENABLE_LL_PRIVACY); 4722 hci_dev_clear_flag(hdev, HCI_ADVERTISING); 4723 4724 /* Enable LL privacy + supported settings changed */ 4725 flags = BIT(0) | BIT(1); 4726 } else { 4727 changed = hci_dev_test_and_clear_flag(hdev, 4728 HCI_ENABLE_LL_PRIVACY); 4729 4730 /* Disable LL privacy + supported settings changed */ 4731 flags = BIT(1); 4732 } 4733 4734 memcpy(rp.uuid, rpa_resolution_uuid, 16); 4735 rp.flags = cpu_to_le32(flags); 4736 4737 hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS); 4738 4739 err = mgmt_cmd_complete(sk, hdev->id, 4740 MGMT_OP_SET_EXP_FEATURE, 0, 4741 &rp, sizeof(rp)); 4742 4743 if (changed) 4744 exp_ll_privacy_feature_changed(val, hdev, sk); 4745 4746 return err; 4747 } 4748 4749 static int set_quality_report_func(struct sock *sk, struct hci_dev *hdev, 4750 struct mgmt_cp_set_exp_feature *cp, 4751 u16 data_len) 4752 { 4753 struct mgmt_rp_set_exp_feature rp; 4754 bool val, changed; 4755 int err; 4756 4757 /* Command requires to use a valid controller index */ 4758 if (!hdev) 4759 return mgmt_cmd_status(sk, MGMT_INDEX_NONE, 4760 MGMT_OP_SET_EXP_FEATURE, 4761 MGMT_STATUS_INVALID_INDEX); 4762 4763 /* Parameters are limited to a single octet */ 4764 if (data_len != MGMT_SET_EXP_FEATURE_SIZE + 1) 4765 return mgmt_cmd_status(sk, hdev->id, 4766 MGMT_OP_SET_EXP_FEATURE, 4767 MGMT_STATUS_INVALID_PARAMS); 4768 4769 /* Only boolean on/off is supported */ 4770 if (cp->param[0] != 0x00 && cp->param[0] != 0x01) 4771 return mgmt_cmd_status(sk, hdev->id, 4772 MGMT_OP_SET_EXP_FEATURE, 4773 MGMT_STATUS_INVALID_PARAMS); 4774 4775 hci_req_sync_lock(hdev); 4776 4777 val = !!cp->param[0]; 4778 changed = (val != hci_dev_test_flag(hdev, HCI_QUALITY_REPORT)); 4779 4780 if (!aosp_has_quality_report(hdev) && !hdev->set_quality_report) { 4781 err = mgmt_cmd_status(sk, hdev->id, 4782 MGMT_OP_SET_EXP_FEATURE, 4783 MGMT_STATUS_NOT_SUPPORTED); 4784 goto unlock_quality_report; 4785 } 4786 4787 if (changed) { 4788 if (hdev->set_quality_report) 4789 err = hdev->set_quality_report(hdev, val); 4790 else 4791 err = aosp_set_quality_report(hdev, val); 4792 4793 if (err) { 4794 err = mgmt_cmd_status(sk, hdev->id, 4795 MGMT_OP_SET_EXP_FEATURE, 4796 MGMT_STATUS_FAILED); 4797 goto unlock_quality_report; 4798 } 4799 4800 if (val) 4801 hci_dev_set_flag(hdev, HCI_QUALITY_REPORT); 4802 else 4803 hci_dev_clear_flag(hdev, HCI_QUALITY_REPORT); 4804 } 4805 4806 bt_dev_dbg(hdev, "quality report enable %d changed %d", val, changed); 4807 4808 memcpy(rp.uuid, quality_report_uuid, 16); 4809 rp.flags = cpu_to_le32(val ? BIT(0) : 0); 4810 hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS); 4811 4812 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_EXP_FEATURE, 0, 4813 &rp, sizeof(rp)); 4814 4815 if (changed) 4816 exp_feature_changed(hdev, quality_report_uuid, val, sk); 4817 4818 unlock_quality_report: 4819 hci_req_sync_unlock(hdev); 4820 return err; 4821 } 4822 4823 static int set_offload_codec_func(struct sock *sk, struct hci_dev *hdev, 4824 struct mgmt_cp_set_exp_feature *cp, 4825 u16 data_len) 4826 { 4827 bool val, changed; 4828 int err; 4829 struct mgmt_rp_set_exp_feature rp; 4830 4831 /* Command requires to use a valid controller index */ 4832 if (!hdev) 4833 return mgmt_cmd_status(sk, MGMT_INDEX_NONE, 4834 MGMT_OP_SET_EXP_FEATURE, 4835 MGMT_STATUS_INVALID_INDEX); 4836 4837 /* Parameters are limited to a single octet */ 4838 if (data_len != MGMT_SET_EXP_FEATURE_SIZE + 1) 4839 return mgmt_cmd_status(sk, hdev->id, 4840 MGMT_OP_SET_EXP_FEATURE, 4841 MGMT_STATUS_INVALID_PARAMS); 4842 4843 /* Only boolean on/off is supported */ 4844 if (cp->param[0] != 0x00 && cp->param[0] != 0x01) 4845 return mgmt_cmd_status(sk, hdev->id, 4846 MGMT_OP_SET_EXP_FEATURE, 4847 MGMT_STATUS_INVALID_PARAMS); 4848 4849 val = !!cp->param[0]; 4850 changed = (val != hci_dev_test_flag(hdev, HCI_OFFLOAD_CODECS_ENABLED)); 4851 4852 if (!hdev->get_data_path_id) { 4853 return mgmt_cmd_status(sk, hdev->id, 4854 MGMT_OP_SET_EXP_FEATURE, 4855 MGMT_STATUS_NOT_SUPPORTED); 4856 } 4857 4858 if (changed) { 4859 if (val) 4860 hci_dev_set_flag(hdev, HCI_OFFLOAD_CODECS_ENABLED); 4861 else 4862 hci_dev_clear_flag(hdev, HCI_OFFLOAD_CODECS_ENABLED); 4863 } 4864 4865 bt_dev_info(hdev, "offload codecs enable %d changed %d", 4866 val, changed); 4867 4868 memcpy(rp.uuid, offload_codecs_uuid, 16); 4869 rp.flags = cpu_to_le32(val ? BIT(0) : 0); 4870 hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS); 4871 err = mgmt_cmd_complete(sk, hdev->id, 4872 MGMT_OP_SET_EXP_FEATURE, 0, 4873 &rp, sizeof(rp)); 4874 4875 if (changed) 4876 exp_feature_changed(hdev, offload_codecs_uuid, val, sk); 4877 4878 return err; 4879 } 4880 4881 static int set_le_simultaneous_roles_func(struct sock *sk, struct hci_dev *hdev, 4882 struct mgmt_cp_set_exp_feature *cp, 4883 u16 data_len) 4884 { 4885 bool val, changed; 4886 int err; 4887 struct mgmt_rp_set_exp_feature rp; 4888 4889 /* Command requires to use a valid controller index */ 4890 if (!hdev) 4891 return mgmt_cmd_status(sk, MGMT_INDEX_NONE, 4892 MGMT_OP_SET_EXP_FEATURE, 4893 MGMT_STATUS_INVALID_INDEX); 4894 4895 /* Parameters are limited to a single octet */ 4896 if (data_len != MGMT_SET_EXP_FEATURE_SIZE + 1) 4897 return mgmt_cmd_status(sk, hdev->id, 4898 MGMT_OP_SET_EXP_FEATURE, 4899 MGMT_STATUS_INVALID_PARAMS); 4900 4901 /* Only boolean on/off is supported */ 4902 if (cp->param[0] != 0x00 && cp->param[0] != 0x01) 4903 return mgmt_cmd_status(sk, hdev->id, 4904 MGMT_OP_SET_EXP_FEATURE, 4905 MGMT_STATUS_INVALID_PARAMS); 4906 4907 val = !!cp->param[0]; 4908 changed = (val != hci_dev_test_flag(hdev, HCI_LE_SIMULTANEOUS_ROLES)); 4909 4910 if (!hci_dev_le_state_simultaneous(hdev)) { 4911 return mgmt_cmd_status(sk, hdev->id, 4912 MGMT_OP_SET_EXP_FEATURE, 4913 MGMT_STATUS_NOT_SUPPORTED); 4914 } 4915 4916 if (changed) { 4917 if (val) 4918 hci_dev_set_flag(hdev, HCI_LE_SIMULTANEOUS_ROLES); 4919 else 4920 hci_dev_clear_flag(hdev, HCI_LE_SIMULTANEOUS_ROLES); 4921 } 4922 4923 bt_dev_info(hdev, "LE simultaneous roles enable %d changed %d", 4924 val, changed); 4925 4926 memcpy(rp.uuid, le_simultaneous_roles_uuid, 16); 4927 rp.flags = cpu_to_le32(val ? BIT(0) : 0); 4928 hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS); 4929 err = mgmt_cmd_complete(sk, hdev->id, 4930 MGMT_OP_SET_EXP_FEATURE, 0, 4931 &rp, sizeof(rp)); 4932 4933 if (changed) 4934 exp_feature_changed(hdev, le_simultaneous_roles_uuid, val, sk); 4935 4936 return err; 4937 } 4938 4939 #ifdef CONFIG_BT_LE 4940 static int set_iso_socket_func(struct sock *sk, struct hci_dev *hdev, 4941 struct mgmt_cp_set_exp_feature *cp, u16 data_len) 4942 { 4943 struct mgmt_rp_set_exp_feature rp; 4944 bool val, changed = false; 4945 int err; 4946 4947 /* Command requires to use the non-controller index */ 4948 if (hdev) 4949 return mgmt_cmd_status(sk, hdev->id, 4950 MGMT_OP_SET_EXP_FEATURE, 4951 MGMT_STATUS_INVALID_INDEX); 4952 4953 /* Parameters are limited to a single octet */ 4954 if (data_len != MGMT_SET_EXP_FEATURE_SIZE + 1) 4955 return mgmt_cmd_status(sk, MGMT_INDEX_NONE, 4956 MGMT_OP_SET_EXP_FEATURE, 4957 MGMT_STATUS_INVALID_PARAMS); 4958 4959 /* Only boolean on/off is supported */ 4960 if (cp->param[0] != 0x00 && cp->param[0] != 0x01) 4961 return mgmt_cmd_status(sk, MGMT_INDEX_NONE, 4962 MGMT_OP_SET_EXP_FEATURE, 4963 MGMT_STATUS_INVALID_PARAMS); 4964 4965 val = cp->param[0] ? true : false; 4966 if (val) 4967 err = iso_init(); 4968 else 4969 err = iso_exit(); 4970 4971 if (!err) 4972 changed = true; 4973 4974 memcpy(rp.uuid, iso_socket_uuid, 16); 4975 rp.flags = cpu_to_le32(val ? BIT(0) : 0); 4976 4977 hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS); 4978 4979 err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE, 4980 MGMT_OP_SET_EXP_FEATURE, 0, 4981 &rp, sizeof(rp)); 4982 4983 if (changed) 4984 exp_feature_changed(hdev, iso_socket_uuid, val, sk); 4985 4986 return err; 4987 } 4988 #endif 4989 4990 static const struct mgmt_exp_feature { 4991 const u8 *uuid; 4992 int (*set_func)(struct sock *sk, struct hci_dev *hdev, 4993 struct mgmt_cp_set_exp_feature *cp, u16 data_len); 4994 } exp_features[] = { 4995 EXP_FEAT(ZERO_KEY, set_zero_key_func), 4996 #ifdef CONFIG_BT_FEATURE_DEBUG 4997 EXP_FEAT(debug_uuid, set_debug_func), 4998 #endif 4999 EXP_FEAT(mgmt_mesh_uuid, set_mgmt_mesh_func), 5000 EXP_FEAT(rpa_resolution_uuid, set_rpa_resolution_func), 5001 EXP_FEAT(quality_report_uuid, set_quality_report_func), 5002 EXP_FEAT(offload_codecs_uuid, set_offload_codec_func), 5003 EXP_FEAT(le_simultaneous_roles_uuid, set_le_simultaneous_roles_func), 5004 #ifdef CONFIG_BT_LE 5005 EXP_FEAT(iso_socket_uuid, set_iso_socket_func), 5006 #endif 5007 5008 /* end with a null feature */ 5009 EXP_FEAT(NULL, NULL) 5010 }; 5011 5012 static int set_exp_feature(struct sock *sk, struct hci_dev *hdev, 5013 void *data, u16 data_len) 5014 { 5015 struct mgmt_cp_set_exp_feature *cp = data; 5016 size_t i = 0; 5017 5018 bt_dev_dbg(hdev, "sock %p", sk); 5019 5020 for (i = 0; exp_features[i].uuid; i++) { 5021 if (!memcmp(cp->uuid, exp_features[i].uuid, 16)) 5022 return exp_features[i].set_func(sk, hdev, cp, data_len); 5023 } 5024 5025 return mgmt_cmd_status(sk, hdev ? hdev->id : MGMT_INDEX_NONE, 5026 MGMT_OP_SET_EXP_FEATURE, 5027 MGMT_STATUS_NOT_SUPPORTED); 5028 } 5029 5030 static u32 get_params_flags(struct hci_dev *hdev, 5031 struct hci_conn_params *params) 5032 { 5033 u32 flags = hdev->conn_flags; 5034 5035 /* Devices using RPAs can only be programmed in the acceptlist if 5036 * LL Privacy has been enable otherwise they cannot mark 5037 * HCI_CONN_FLAG_REMOTE_WAKEUP. 5038 */ 5039 if ((flags & HCI_CONN_FLAG_REMOTE_WAKEUP) && !use_ll_privacy(hdev) && 5040 hci_find_irk_by_addr(hdev, ¶ms->addr, params->addr_type)) 5041 flags &= ~HCI_CONN_FLAG_REMOTE_WAKEUP; 5042 5043 return flags; 5044 } 5045 5046 static int get_device_flags(struct sock *sk, struct hci_dev *hdev, void *data, 5047 u16 data_len) 5048 { 5049 struct mgmt_cp_get_device_flags *cp = data; 5050 struct mgmt_rp_get_device_flags rp; 5051 struct bdaddr_list_with_flags *br_params; 5052 struct hci_conn_params *params; 5053 u32 supported_flags; 5054 u32 current_flags = 0; 5055 u8 status = MGMT_STATUS_INVALID_PARAMS; 5056 5057 bt_dev_dbg(hdev, "Get device flags %pMR (type 0x%x)\n", 5058 &cp->addr.bdaddr, cp->addr.type); 5059 5060 hci_dev_lock(hdev); 5061 5062 supported_flags = hdev->conn_flags; 5063 5064 memset(&rp, 0, sizeof(rp)); 5065 5066 if (cp->addr.type == BDADDR_BREDR) { 5067 br_params = hci_bdaddr_list_lookup_with_flags(&hdev->accept_list, 5068 &cp->addr.bdaddr, 5069 cp->addr.type); 5070 if (!br_params) 5071 goto done; 5072 5073 current_flags = br_params->flags; 5074 } else { 5075 params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr, 5076 le_addr_type(cp->addr.type)); 5077 if (!params) 5078 goto done; 5079 5080 supported_flags = get_params_flags(hdev, params); 5081 current_flags = params->flags; 5082 } 5083 5084 bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr); 5085 rp.addr.type = cp->addr.type; 5086 rp.supported_flags = cpu_to_le32(supported_flags); 5087 rp.current_flags = cpu_to_le32(current_flags); 5088 5089 status = MGMT_STATUS_SUCCESS; 5090 5091 done: 5092 hci_dev_unlock(hdev); 5093 5094 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_DEVICE_FLAGS, status, 5095 &rp, sizeof(rp)); 5096 } 5097 5098 static void device_flags_changed(struct sock *sk, struct hci_dev *hdev, 5099 bdaddr_t *bdaddr, u8 bdaddr_type, 5100 u32 supported_flags, u32 current_flags) 5101 { 5102 struct mgmt_ev_device_flags_changed ev; 5103 5104 bacpy(&ev.addr.bdaddr, bdaddr); 5105 ev.addr.type = bdaddr_type; 5106 ev.supported_flags = cpu_to_le32(supported_flags); 5107 ev.current_flags = cpu_to_le32(current_flags); 5108 5109 mgmt_event(MGMT_EV_DEVICE_FLAGS_CHANGED, hdev, &ev, sizeof(ev), sk); 5110 } 5111 5112 static int set_device_flags(struct sock *sk, struct hci_dev *hdev, void *data, 5113 u16 len) 5114 { 5115 struct mgmt_cp_set_device_flags *cp = data; 5116 struct bdaddr_list_with_flags *br_params; 5117 struct hci_conn_params *params; 5118 u8 status = MGMT_STATUS_INVALID_PARAMS; 5119 u32 supported_flags; 5120 u32 current_flags = __le32_to_cpu(cp->current_flags); 5121 5122 bt_dev_dbg(hdev, "Set device flags %pMR (type 0x%x) = 0x%x", 5123 &cp->addr.bdaddr, cp->addr.type, current_flags); 5124 5125 // We should take hci_dev_lock() early, I think.. conn_flags can change 5126 supported_flags = hdev->conn_flags; 5127 5128 if ((supported_flags | current_flags) != supported_flags) { 5129 bt_dev_warn(hdev, "Bad flag given (0x%x) vs supported (0x%0x)", 5130 current_flags, supported_flags); 5131 goto done; 5132 } 5133 5134 hci_dev_lock(hdev); 5135 5136 if (cp->addr.type == BDADDR_BREDR) { 5137 br_params = hci_bdaddr_list_lookup_with_flags(&hdev->accept_list, 5138 &cp->addr.bdaddr, 5139 cp->addr.type); 5140 5141 if (br_params) { 5142 br_params->flags = current_flags; 5143 status = MGMT_STATUS_SUCCESS; 5144 } else { 5145 bt_dev_warn(hdev, "No such BR/EDR device %pMR (0x%x)", 5146 &cp->addr.bdaddr, cp->addr.type); 5147 } 5148 5149 goto unlock; 5150 } 5151 5152 params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr, 5153 le_addr_type(cp->addr.type)); 5154 if (!params) { 5155 bt_dev_warn(hdev, "No such LE device %pMR (0x%x)", 5156 &cp->addr.bdaddr, le_addr_type(cp->addr.type)); 5157 goto unlock; 5158 } 5159 5160 supported_flags = get_params_flags(hdev, params); 5161 5162 if ((supported_flags | current_flags) != supported_flags) { 5163 bt_dev_warn(hdev, "Bad flag given (0x%x) vs supported (0x%0x)", 5164 current_flags, supported_flags); 5165 goto unlock; 5166 } 5167 5168 WRITE_ONCE(params->flags, current_flags); 5169 status = MGMT_STATUS_SUCCESS; 5170 5171 /* Update passive scan if HCI_CONN_FLAG_DEVICE_PRIVACY 5172 * has been set. 5173 */ 5174 if (params->flags & HCI_CONN_FLAG_DEVICE_PRIVACY) 5175 hci_update_passive_scan(hdev); 5176 5177 unlock: 5178 hci_dev_unlock(hdev); 5179 5180 done: 5181 if (status == MGMT_STATUS_SUCCESS) 5182 device_flags_changed(sk, hdev, &cp->addr.bdaddr, cp->addr.type, 5183 supported_flags, current_flags); 5184 5185 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_DEVICE_FLAGS, status, 5186 &cp->addr, sizeof(cp->addr)); 5187 } 5188 5189 static void mgmt_adv_monitor_added(struct sock *sk, struct hci_dev *hdev, 5190 u16 handle) 5191 { 5192 struct mgmt_ev_adv_monitor_added ev; 5193 5194 ev.monitor_handle = cpu_to_le16(handle); 5195 5196 mgmt_event(MGMT_EV_ADV_MONITOR_ADDED, hdev, &ev, sizeof(ev), sk); 5197 } 5198 5199 void mgmt_adv_monitor_removed(struct hci_dev *hdev, u16 handle) 5200 { 5201 struct mgmt_ev_adv_monitor_removed ev; 5202 struct mgmt_pending_cmd *cmd; 5203 struct sock *sk_skip = NULL; 5204 struct mgmt_cp_remove_adv_monitor *cp; 5205 5206 cmd = pending_find(MGMT_OP_REMOVE_ADV_MONITOR, hdev); 5207 if (cmd) { 5208 cp = cmd->param; 5209 5210 if (cp->monitor_handle) 5211 sk_skip = cmd->sk; 5212 } 5213 5214 ev.monitor_handle = cpu_to_le16(handle); 5215 5216 mgmt_event(MGMT_EV_ADV_MONITOR_REMOVED, hdev, &ev, sizeof(ev), sk_skip); 5217 } 5218 5219 static int read_adv_mon_features(struct sock *sk, struct hci_dev *hdev, 5220 void *data, u16 len) 5221 { 5222 struct adv_monitor *monitor = NULL; 5223 struct mgmt_rp_read_adv_monitor_features *rp = NULL; 5224 int handle, err; 5225 size_t rp_size = 0; 5226 __u32 supported = 0; 5227 __u32 enabled = 0; 5228 __u16 num_handles = 0; 5229 __u16 handles[HCI_MAX_ADV_MONITOR_NUM_HANDLES]; 5230 5231 BT_DBG("request for %s", hdev->name); 5232 5233 hci_dev_lock(hdev); 5234 5235 if (msft_monitor_supported(hdev)) 5236 supported |= MGMT_ADV_MONITOR_FEATURE_MASK_OR_PATTERNS; 5237 5238 idr_for_each_entry(&hdev->adv_monitors_idr, monitor, handle) 5239 handles[num_handles++] = monitor->handle; 5240 5241 hci_dev_unlock(hdev); 5242 5243 rp_size = sizeof(*rp) + (num_handles * sizeof(u16)); 5244 rp = kmalloc(rp_size, GFP_KERNEL); 5245 if (!rp) 5246 return -ENOMEM; 5247 5248 /* All supported features are currently enabled */ 5249 enabled = supported; 5250 5251 rp->supported_features = cpu_to_le32(supported); 5252 rp->enabled_features = cpu_to_le32(enabled); 5253 rp->max_num_handles = cpu_to_le16(HCI_MAX_ADV_MONITOR_NUM_HANDLES); 5254 rp->max_num_patterns = HCI_MAX_ADV_MONITOR_NUM_PATTERNS; 5255 rp->num_handles = cpu_to_le16(num_handles); 5256 if (num_handles) 5257 memcpy(&rp->handles, &handles, (num_handles * sizeof(u16))); 5258 5259 err = mgmt_cmd_complete(sk, hdev->id, 5260 MGMT_OP_READ_ADV_MONITOR_FEATURES, 5261 MGMT_STATUS_SUCCESS, rp, rp_size); 5262 5263 kfree(rp); 5264 5265 return err; 5266 } 5267 5268 static void mgmt_add_adv_patterns_monitor_complete(struct hci_dev *hdev, 5269 void *data, int status) 5270 { 5271 struct mgmt_rp_add_adv_patterns_monitor rp; 5272 struct mgmt_pending_cmd *cmd = data; 5273 struct adv_monitor *monitor = cmd->user_data; 5274 5275 hci_dev_lock(hdev); 5276 5277 rp.monitor_handle = cpu_to_le16(monitor->handle); 5278 5279 if (!status) { 5280 mgmt_adv_monitor_added(cmd->sk, hdev, monitor->handle); 5281 hdev->adv_monitors_cnt++; 5282 if (monitor->state == ADV_MONITOR_STATE_NOT_REGISTERED) 5283 monitor->state = ADV_MONITOR_STATE_REGISTERED; 5284 hci_update_passive_scan(hdev); 5285 } 5286 5287 mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, 5288 mgmt_status(status), &rp, sizeof(rp)); 5289 mgmt_pending_remove(cmd); 5290 5291 hci_dev_unlock(hdev); 5292 bt_dev_dbg(hdev, "add monitor %d complete, status %d", 5293 rp.monitor_handle, status); 5294 } 5295 5296 static int mgmt_add_adv_patterns_monitor_sync(struct hci_dev *hdev, void *data) 5297 { 5298 struct mgmt_pending_cmd *cmd = data; 5299 struct adv_monitor *monitor = cmd->user_data; 5300 5301 return hci_add_adv_monitor(hdev, monitor); 5302 } 5303 5304 static int __add_adv_patterns_monitor(struct sock *sk, struct hci_dev *hdev, 5305 struct adv_monitor *m, u8 status, 5306 void *data, u16 len, u16 op) 5307 { 5308 struct mgmt_pending_cmd *cmd; 5309 int err; 5310 5311 hci_dev_lock(hdev); 5312 5313 if (status) 5314 goto unlock; 5315 5316 if (pending_find(MGMT_OP_SET_LE, hdev) || 5317 pending_find(MGMT_OP_ADD_ADV_PATTERNS_MONITOR, hdev) || 5318 pending_find(MGMT_OP_ADD_ADV_PATTERNS_MONITOR_RSSI, hdev) || 5319 pending_find(MGMT_OP_REMOVE_ADV_MONITOR, hdev)) { 5320 status = MGMT_STATUS_BUSY; 5321 goto unlock; 5322 } 5323 5324 cmd = mgmt_pending_add(sk, op, hdev, data, len); 5325 if (!cmd) { 5326 status = MGMT_STATUS_NO_RESOURCES; 5327 goto unlock; 5328 } 5329 5330 cmd->user_data = m; 5331 err = hci_cmd_sync_queue(hdev, mgmt_add_adv_patterns_monitor_sync, cmd, 5332 mgmt_add_adv_patterns_monitor_complete); 5333 if (err) { 5334 if (err == -ENOMEM) 5335 status = MGMT_STATUS_NO_RESOURCES; 5336 else 5337 status = MGMT_STATUS_FAILED; 5338 5339 goto unlock; 5340 } 5341 5342 hci_dev_unlock(hdev); 5343 5344 return 0; 5345 5346 unlock: 5347 hci_free_adv_monitor(hdev, m); 5348 hci_dev_unlock(hdev); 5349 return mgmt_cmd_status(sk, hdev->id, op, status); 5350 } 5351 5352 static void parse_adv_monitor_rssi(struct adv_monitor *m, 5353 struct mgmt_adv_rssi_thresholds *rssi) 5354 { 5355 if (rssi) { 5356 m->rssi.low_threshold = rssi->low_threshold; 5357 m->rssi.low_threshold_timeout = 5358 __le16_to_cpu(rssi->low_threshold_timeout); 5359 m->rssi.high_threshold = rssi->high_threshold; 5360 m->rssi.high_threshold_timeout = 5361 __le16_to_cpu(rssi->high_threshold_timeout); 5362 m->rssi.sampling_period = rssi->sampling_period; 5363 } else { 5364 /* Default values. These numbers are the least constricting 5365 * parameters for MSFT API to work, so it behaves as if there 5366 * are no rssi parameter to consider. May need to be changed 5367 * if other API are to be supported. 5368 */ 5369 m->rssi.low_threshold = -127; 5370 m->rssi.low_threshold_timeout = 60; 5371 m->rssi.high_threshold = -127; 5372 m->rssi.high_threshold_timeout = 0; 5373 m->rssi.sampling_period = 0; 5374 } 5375 } 5376 5377 static u8 parse_adv_monitor_pattern(struct adv_monitor *m, u8 pattern_count, 5378 struct mgmt_adv_pattern *patterns) 5379 { 5380 u8 offset = 0, length = 0; 5381 struct adv_pattern *p = NULL; 5382 int i; 5383 5384 for (i = 0; i < pattern_count; i++) { 5385 offset = patterns[i].offset; 5386 length = patterns[i].length; 5387 if (offset >= HCI_MAX_EXT_AD_LENGTH || 5388 length > HCI_MAX_EXT_AD_LENGTH || 5389 (offset + length) > HCI_MAX_EXT_AD_LENGTH) 5390 return MGMT_STATUS_INVALID_PARAMS; 5391 5392 p = kmalloc(sizeof(*p), GFP_KERNEL); 5393 if (!p) 5394 return MGMT_STATUS_NO_RESOURCES; 5395 5396 p->ad_type = patterns[i].ad_type; 5397 p->offset = patterns[i].offset; 5398 p->length = patterns[i].length; 5399 memcpy(p->value, patterns[i].value, p->length); 5400 5401 INIT_LIST_HEAD(&p->list); 5402 list_add(&p->list, &m->patterns); 5403 } 5404 5405 return MGMT_STATUS_SUCCESS; 5406 } 5407 5408 static int add_adv_patterns_monitor(struct sock *sk, struct hci_dev *hdev, 5409 void *data, u16 len) 5410 { 5411 struct mgmt_cp_add_adv_patterns_monitor *cp = data; 5412 struct adv_monitor *m = NULL; 5413 u8 status = MGMT_STATUS_SUCCESS; 5414 size_t expected_size = sizeof(*cp); 5415 5416 BT_DBG("request for %s", hdev->name); 5417 5418 if (len <= sizeof(*cp)) { 5419 status = MGMT_STATUS_INVALID_PARAMS; 5420 goto done; 5421 } 5422 5423 expected_size += cp->pattern_count * sizeof(struct mgmt_adv_pattern); 5424 if (len != expected_size) { 5425 status = MGMT_STATUS_INVALID_PARAMS; 5426 goto done; 5427 } 5428 5429 m = kzalloc(sizeof(*m), GFP_KERNEL); 5430 if (!m) { 5431 status = MGMT_STATUS_NO_RESOURCES; 5432 goto done; 5433 } 5434 5435 INIT_LIST_HEAD(&m->patterns); 5436 5437 parse_adv_monitor_rssi(m, NULL); 5438 status = parse_adv_monitor_pattern(m, cp->pattern_count, cp->patterns); 5439 5440 done: 5441 return __add_adv_patterns_monitor(sk, hdev, m, status, data, len, 5442 MGMT_OP_ADD_ADV_PATTERNS_MONITOR); 5443 } 5444 5445 static int add_adv_patterns_monitor_rssi(struct sock *sk, struct hci_dev *hdev, 5446 void *data, u16 len) 5447 { 5448 struct mgmt_cp_add_adv_patterns_monitor_rssi *cp = data; 5449 struct adv_monitor *m = NULL; 5450 u8 status = MGMT_STATUS_SUCCESS; 5451 size_t expected_size = sizeof(*cp); 5452 5453 BT_DBG("request for %s", hdev->name); 5454 5455 if (len <= sizeof(*cp)) { 5456 status = MGMT_STATUS_INVALID_PARAMS; 5457 goto done; 5458 } 5459 5460 expected_size += cp->pattern_count * sizeof(struct mgmt_adv_pattern); 5461 if (len != expected_size) { 5462 status = MGMT_STATUS_INVALID_PARAMS; 5463 goto done; 5464 } 5465 5466 m = kzalloc(sizeof(*m), GFP_KERNEL); 5467 if (!m) { 5468 status = MGMT_STATUS_NO_RESOURCES; 5469 goto done; 5470 } 5471 5472 INIT_LIST_HEAD(&m->patterns); 5473 5474 parse_adv_monitor_rssi(m, &cp->rssi); 5475 status = parse_adv_monitor_pattern(m, cp->pattern_count, cp->patterns); 5476 5477 done: 5478 return __add_adv_patterns_monitor(sk, hdev, m, status, data, len, 5479 MGMT_OP_ADD_ADV_PATTERNS_MONITOR_RSSI); 5480 } 5481 5482 static void mgmt_remove_adv_monitor_complete(struct hci_dev *hdev, 5483 void *data, int status) 5484 { 5485 struct mgmt_rp_remove_adv_monitor rp; 5486 struct mgmt_pending_cmd *cmd = data; 5487 struct mgmt_cp_remove_adv_monitor *cp = cmd->param; 5488 5489 hci_dev_lock(hdev); 5490 5491 rp.monitor_handle = cp->monitor_handle; 5492 5493 if (!status) 5494 hci_update_passive_scan(hdev); 5495 5496 mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, 5497 mgmt_status(status), &rp, sizeof(rp)); 5498 mgmt_pending_remove(cmd); 5499 5500 hci_dev_unlock(hdev); 5501 bt_dev_dbg(hdev, "remove monitor %d complete, status %d", 5502 rp.monitor_handle, status); 5503 } 5504 5505 static int mgmt_remove_adv_monitor_sync(struct hci_dev *hdev, void *data) 5506 { 5507 struct mgmt_pending_cmd *cmd = data; 5508 struct mgmt_cp_remove_adv_monitor *cp = cmd->param; 5509 u16 handle = __le16_to_cpu(cp->monitor_handle); 5510 5511 if (!handle) 5512 return hci_remove_all_adv_monitor(hdev); 5513 5514 return hci_remove_single_adv_monitor(hdev, handle); 5515 } 5516 5517 static int remove_adv_monitor(struct sock *sk, struct hci_dev *hdev, 5518 void *data, u16 len) 5519 { 5520 struct mgmt_pending_cmd *cmd; 5521 int err, status; 5522 5523 hci_dev_lock(hdev); 5524 5525 if (pending_find(MGMT_OP_SET_LE, hdev) || 5526 pending_find(MGMT_OP_REMOVE_ADV_MONITOR, hdev) || 5527 pending_find(MGMT_OP_ADD_ADV_PATTERNS_MONITOR, hdev) || 5528 pending_find(MGMT_OP_ADD_ADV_PATTERNS_MONITOR_RSSI, hdev)) { 5529 status = MGMT_STATUS_BUSY; 5530 goto unlock; 5531 } 5532 5533 cmd = mgmt_pending_add(sk, MGMT_OP_REMOVE_ADV_MONITOR, hdev, data, len); 5534 if (!cmd) { 5535 status = MGMT_STATUS_NO_RESOURCES; 5536 goto unlock; 5537 } 5538 5539 err = hci_cmd_sync_queue(hdev, mgmt_remove_adv_monitor_sync, cmd, 5540 mgmt_remove_adv_monitor_complete); 5541 5542 if (err) { 5543 mgmt_pending_remove(cmd); 5544 5545 if (err == -ENOMEM) 5546 status = MGMT_STATUS_NO_RESOURCES; 5547 else 5548 status = MGMT_STATUS_FAILED; 5549 5550 goto unlock; 5551 } 5552 5553 hci_dev_unlock(hdev); 5554 5555 return 0; 5556 5557 unlock: 5558 hci_dev_unlock(hdev); 5559 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_ADV_MONITOR, 5560 status); 5561 } 5562 5563 static void read_local_oob_data_complete(struct hci_dev *hdev, void *data, int err) 5564 { 5565 struct mgmt_rp_read_local_oob_data mgmt_rp; 5566 size_t rp_size = sizeof(mgmt_rp); 5567 struct mgmt_pending_cmd *cmd = data; 5568 struct sk_buff *skb = cmd->skb; 5569 u8 status = mgmt_status(err); 5570 5571 if (!status) { 5572 if (!skb) 5573 status = MGMT_STATUS_FAILED; 5574 else if (IS_ERR(skb)) 5575 status = mgmt_status(PTR_ERR(skb)); 5576 else 5577 status = mgmt_status(skb->data[0]); 5578 } 5579 5580 bt_dev_dbg(hdev, "status %d", status); 5581 5582 if (status) { 5583 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA, status); 5584 goto remove; 5585 } 5586 5587 memset(&mgmt_rp, 0, sizeof(mgmt_rp)); 5588 5589 if (!bredr_sc_enabled(hdev)) { 5590 struct hci_rp_read_local_oob_data *rp = (void *) skb->data; 5591 5592 if (skb->len < sizeof(*rp)) { 5593 mgmt_cmd_status(cmd->sk, hdev->id, 5594 MGMT_OP_READ_LOCAL_OOB_DATA, 5595 MGMT_STATUS_FAILED); 5596 goto remove; 5597 } 5598 5599 memcpy(mgmt_rp.hash192, rp->hash, sizeof(rp->hash)); 5600 memcpy(mgmt_rp.rand192, rp->rand, sizeof(rp->rand)); 5601 5602 rp_size -= sizeof(mgmt_rp.hash256) + sizeof(mgmt_rp.rand256); 5603 } else { 5604 struct hci_rp_read_local_oob_ext_data *rp = (void *) skb->data; 5605 5606 if (skb->len < sizeof(*rp)) { 5607 mgmt_cmd_status(cmd->sk, hdev->id, 5608 MGMT_OP_READ_LOCAL_OOB_DATA, 5609 MGMT_STATUS_FAILED); 5610 goto remove; 5611 } 5612 5613 memcpy(mgmt_rp.hash192, rp->hash192, sizeof(rp->hash192)); 5614 memcpy(mgmt_rp.rand192, rp->rand192, sizeof(rp->rand192)); 5615 5616 memcpy(mgmt_rp.hash256, rp->hash256, sizeof(rp->hash256)); 5617 memcpy(mgmt_rp.rand256, rp->rand256, sizeof(rp->rand256)); 5618 } 5619 5620 mgmt_cmd_complete(cmd->sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA, 5621 MGMT_STATUS_SUCCESS, &mgmt_rp, rp_size); 5622 5623 remove: 5624 if (skb && !IS_ERR(skb)) 5625 kfree_skb(skb); 5626 5627 mgmt_pending_free(cmd); 5628 } 5629 5630 static int read_local_oob_data_sync(struct hci_dev *hdev, void *data) 5631 { 5632 struct mgmt_pending_cmd *cmd = data; 5633 5634 if (bredr_sc_enabled(hdev)) 5635 cmd->skb = hci_read_local_oob_data_sync(hdev, true, cmd->sk); 5636 else 5637 cmd->skb = hci_read_local_oob_data_sync(hdev, false, cmd->sk); 5638 5639 if (IS_ERR(cmd->skb)) 5640 return PTR_ERR(cmd->skb); 5641 else 5642 return 0; 5643 } 5644 5645 static int read_local_oob_data(struct sock *sk, struct hci_dev *hdev, 5646 void *data, u16 data_len) 5647 { 5648 struct mgmt_pending_cmd *cmd; 5649 int err; 5650 5651 bt_dev_dbg(hdev, "sock %p", sk); 5652 5653 hci_dev_lock(hdev); 5654 5655 if (!hdev_is_powered(hdev)) { 5656 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA, 5657 MGMT_STATUS_NOT_POWERED); 5658 goto unlock; 5659 } 5660 5661 if (!lmp_ssp_capable(hdev)) { 5662 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA, 5663 MGMT_STATUS_NOT_SUPPORTED); 5664 goto unlock; 5665 } 5666 5667 cmd = mgmt_pending_new(sk, MGMT_OP_READ_LOCAL_OOB_DATA, hdev, NULL, 0); 5668 if (!cmd) 5669 err = -ENOMEM; 5670 else 5671 err = hci_cmd_sync_queue(hdev, read_local_oob_data_sync, cmd, 5672 read_local_oob_data_complete); 5673 5674 if (err < 0) { 5675 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA, 5676 MGMT_STATUS_FAILED); 5677 5678 if (cmd) 5679 mgmt_pending_free(cmd); 5680 } 5681 5682 unlock: 5683 hci_dev_unlock(hdev); 5684 return err; 5685 } 5686 5687 static int add_remote_oob_data(struct sock *sk, struct hci_dev *hdev, 5688 void *data, u16 len) 5689 { 5690 struct mgmt_addr_info *addr = data; 5691 int err; 5692 5693 bt_dev_dbg(hdev, "sock %p", sk); 5694 5695 if (!bdaddr_type_is_valid(addr->type)) 5696 return mgmt_cmd_complete(sk, hdev->id, 5697 MGMT_OP_ADD_REMOTE_OOB_DATA, 5698 MGMT_STATUS_INVALID_PARAMS, 5699 addr, sizeof(*addr)); 5700 5701 hci_dev_lock(hdev); 5702 5703 if (len == MGMT_ADD_REMOTE_OOB_DATA_SIZE) { 5704 struct mgmt_cp_add_remote_oob_data *cp = data; 5705 u8 status; 5706 5707 if (cp->addr.type != BDADDR_BREDR) { 5708 err = mgmt_cmd_complete(sk, hdev->id, 5709 MGMT_OP_ADD_REMOTE_OOB_DATA, 5710 MGMT_STATUS_INVALID_PARAMS, 5711 &cp->addr, sizeof(cp->addr)); 5712 goto unlock; 5713 } 5714 5715 err = hci_add_remote_oob_data(hdev, &cp->addr.bdaddr, 5716 cp->addr.type, cp->hash, 5717 cp->rand, NULL, NULL); 5718 if (err < 0) 5719 status = MGMT_STATUS_FAILED; 5720 else 5721 status = MGMT_STATUS_SUCCESS; 5722 5723 err = mgmt_cmd_complete(sk, hdev->id, 5724 MGMT_OP_ADD_REMOTE_OOB_DATA, status, 5725 &cp->addr, sizeof(cp->addr)); 5726 } else if (len == MGMT_ADD_REMOTE_OOB_EXT_DATA_SIZE) { 5727 struct mgmt_cp_add_remote_oob_ext_data *cp = data; 5728 u8 *rand192, *hash192, *rand256, *hash256; 5729 u8 status; 5730 5731 if (bdaddr_type_is_le(cp->addr.type)) { 5732 /* Enforce zero-valued 192-bit parameters as 5733 * long as legacy SMP OOB isn't implemented. 5734 */ 5735 if (memcmp(cp->rand192, ZERO_KEY, 16) || 5736 memcmp(cp->hash192, ZERO_KEY, 16)) { 5737 err = mgmt_cmd_complete(sk, hdev->id, 5738 MGMT_OP_ADD_REMOTE_OOB_DATA, 5739 MGMT_STATUS_INVALID_PARAMS, 5740 addr, sizeof(*addr)); 5741 goto unlock; 5742 } 5743 5744 rand192 = NULL; 5745 hash192 = NULL; 5746 } else { 5747 /* In case one of the P-192 values is set to zero, 5748 * then just disable OOB data for P-192. 5749 */ 5750 if (!memcmp(cp->rand192, ZERO_KEY, 16) || 5751 !memcmp(cp->hash192, ZERO_KEY, 16)) { 5752 rand192 = NULL; 5753 hash192 = NULL; 5754 } else { 5755 rand192 = cp->rand192; 5756 hash192 = cp->hash192; 5757 } 5758 } 5759 5760 /* In case one of the P-256 values is set to zero, then just 5761 * disable OOB data for P-256. 5762 */ 5763 if (!memcmp(cp->rand256, ZERO_KEY, 16) || 5764 !memcmp(cp->hash256, ZERO_KEY, 16)) { 5765 rand256 = NULL; 5766 hash256 = NULL; 5767 } else { 5768 rand256 = cp->rand256; 5769 hash256 = cp->hash256; 5770 } 5771 5772 err = hci_add_remote_oob_data(hdev, &cp->addr.bdaddr, 5773 cp->addr.type, hash192, rand192, 5774 hash256, rand256); 5775 if (err < 0) 5776 status = MGMT_STATUS_FAILED; 5777 else 5778 status = MGMT_STATUS_SUCCESS; 5779 5780 err = mgmt_cmd_complete(sk, hdev->id, 5781 MGMT_OP_ADD_REMOTE_OOB_DATA, 5782 status, &cp->addr, sizeof(cp->addr)); 5783 } else { 5784 bt_dev_err(hdev, "add_remote_oob_data: invalid len of %u bytes", 5785 len); 5786 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_REMOTE_OOB_DATA, 5787 MGMT_STATUS_INVALID_PARAMS); 5788 } 5789 5790 unlock: 5791 hci_dev_unlock(hdev); 5792 return err; 5793 } 5794 5795 static int remove_remote_oob_data(struct sock *sk, struct hci_dev *hdev, 5796 void *data, u16 len) 5797 { 5798 struct mgmt_cp_remove_remote_oob_data *cp = data; 5799 u8 status; 5800 int err; 5801 5802 bt_dev_dbg(hdev, "sock %p", sk); 5803 5804 if (cp->addr.type != BDADDR_BREDR) 5805 return mgmt_cmd_complete(sk, hdev->id, 5806 MGMT_OP_REMOVE_REMOTE_OOB_DATA, 5807 MGMT_STATUS_INVALID_PARAMS, 5808 &cp->addr, sizeof(cp->addr)); 5809 5810 hci_dev_lock(hdev); 5811 5812 if (!bacmp(&cp->addr.bdaddr, BDADDR_ANY)) { 5813 hci_remote_oob_data_clear(hdev); 5814 status = MGMT_STATUS_SUCCESS; 5815 goto done; 5816 } 5817 5818 err = hci_remove_remote_oob_data(hdev, &cp->addr.bdaddr, cp->addr.type); 5819 if (err < 0) 5820 status = MGMT_STATUS_INVALID_PARAMS; 5821 else 5822 status = MGMT_STATUS_SUCCESS; 5823 5824 done: 5825 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_REMOTE_OOB_DATA, 5826 status, &cp->addr, sizeof(cp->addr)); 5827 5828 hci_dev_unlock(hdev); 5829 return err; 5830 } 5831 5832 void mgmt_start_discovery_complete(struct hci_dev *hdev, u8 status) 5833 { 5834 struct mgmt_pending_cmd *cmd; 5835 5836 bt_dev_dbg(hdev, "status %u", status); 5837 5838 hci_dev_lock(hdev); 5839 5840 cmd = pending_find(MGMT_OP_START_DISCOVERY, hdev); 5841 if (!cmd) 5842 cmd = pending_find(MGMT_OP_START_SERVICE_DISCOVERY, hdev); 5843 5844 if (!cmd) 5845 cmd = pending_find(MGMT_OP_START_LIMITED_DISCOVERY, hdev); 5846 5847 if (cmd) { 5848 cmd->cmd_complete(cmd, mgmt_status(status)); 5849 mgmt_pending_remove(cmd); 5850 } 5851 5852 hci_dev_unlock(hdev); 5853 } 5854 5855 static bool discovery_type_is_valid(struct hci_dev *hdev, uint8_t type, 5856 uint8_t *mgmt_status) 5857 { 5858 switch (type) { 5859 case DISCOV_TYPE_LE: 5860 *mgmt_status = mgmt_le_support(hdev); 5861 if (*mgmt_status) 5862 return false; 5863 break; 5864 case DISCOV_TYPE_INTERLEAVED: 5865 *mgmt_status = mgmt_le_support(hdev); 5866 if (*mgmt_status) 5867 return false; 5868 fallthrough; 5869 case DISCOV_TYPE_BREDR: 5870 *mgmt_status = mgmt_bredr_support(hdev); 5871 if (*mgmt_status) 5872 return false; 5873 break; 5874 default: 5875 *mgmt_status = MGMT_STATUS_INVALID_PARAMS; 5876 return false; 5877 } 5878 5879 return true; 5880 } 5881 5882 static void start_discovery_complete(struct hci_dev *hdev, void *data, int err) 5883 { 5884 struct mgmt_pending_cmd *cmd = data; 5885 5886 if (cmd != pending_find(MGMT_OP_START_DISCOVERY, hdev) && 5887 cmd != pending_find(MGMT_OP_START_LIMITED_DISCOVERY, hdev) && 5888 cmd != pending_find(MGMT_OP_START_SERVICE_DISCOVERY, hdev)) 5889 return; 5890 5891 bt_dev_dbg(hdev, "err %d", err); 5892 5893 mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, mgmt_status(err), 5894 cmd->param, 1); 5895 mgmt_pending_remove(cmd); 5896 5897 hci_discovery_set_state(hdev, err ? DISCOVERY_STOPPED: 5898 DISCOVERY_FINDING); 5899 } 5900 5901 static int start_discovery_sync(struct hci_dev *hdev, void *data) 5902 { 5903 return hci_start_discovery_sync(hdev); 5904 } 5905 5906 static int start_discovery_internal(struct sock *sk, struct hci_dev *hdev, 5907 u16 op, void *data, u16 len) 5908 { 5909 struct mgmt_cp_start_discovery *cp = data; 5910 struct mgmt_pending_cmd *cmd; 5911 u8 status; 5912 int err; 5913 5914 bt_dev_dbg(hdev, "sock %p", sk); 5915 5916 hci_dev_lock(hdev); 5917 5918 if (!hdev_is_powered(hdev)) { 5919 err = mgmt_cmd_complete(sk, hdev->id, op, 5920 MGMT_STATUS_NOT_POWERED, 5921 &cp->type, sizeof(cp->type)); 5922 goto failed; 5923 } 5924 5925 if (hdev->discovery.state != DISCOVERY_STOPPED || 5926 hci_dev_test_flag(hdev, HCI_PERIODIC_INQ)) { 5927 err = mgmt_cmd_complete(sk, hdev->id, op, MGMT_STATUS_BUSY, 5928 &cp->type, sizeof(cp->type)); 5929 goto failed; 5930 } 5931 5932 if (!discovery_type_is_valid(hdev, cp->type, &status)) { 5933 err = mgmt_cmd_complete(sk, hdev->id, op, status, 5934 &cp->type, sizeof(cp->type)); 5935 goto failed; 5936 } 5937 5938 /* Can't start discovery when it is paused */ 5939 if (hdev->discovery_paused) { 5940 err = mgmt_cmd_complete(sk, hdev->id, op, MGMT_STATUS_BUSY, 5941 &cp->type, sizeof(cp->type)); 5942 goto failed; 5943 } 5944 5945 /* Clear the discovery filter first to free any previously 5946 * allocated memory for the UUID list. 5947 */ 5948 hci_discovery_filter_clear(hdev); 5949 5950 hdev->discovery.type = cp->type; 5951 hdev->discovery.report_invalid_rssi = false; 5952 if (op == MGMT_OP_START_LIMITED_DISCOVERY) 5953 hdev->discovery.limited = true; 5954 else 5955 hdev->discovery.limited = false; 5956 5957 cmd = mgmt_pending_add(sk, op, hdev, data, len); 5958 if (!cmd) { 5959 err = -ENOMEM; 5960 goto failed; 5961 } 5962 5963 err = hci_cmd_sync_queue(hdev, start_discovery_sync, cmd, 5964 start_discovery_complete); 5965 if (err < 0) { 5966 mgmt_pending_remove(cmd); 5967 goto failed; 5968 } 5969 5970 hci_discovery_set_state(hdev, DISCOVERY_STARTING); 5971 5972 failed: 5973 hci_dev_unlock(hdev); 5974 return err; 5975 } 5976 5977 static int start_discovery(struct sock *sk, struct hci_dev *hdev, 5978 void *data, u16 len) 5979 { 5980 return start_discovery_internal(sk, hdev, MGMT_OP_START_DISCOVERY, 5981 data, len); 5982 } 5983 5984 static int start_limited_discovery(struct sock *sk, struct hci_dev *hdev, 5985 void *data, u16 len) 5986 { 5987 return start_discovery_internal(sk, hdev, 5988 MGMT_OP_START_LIMITED_DISCOVERY, 5989 data, len); 5990 } 5991 5992 static int start_service_discovery(struct sock *sk, struct hci_dev *hdev, 5993 void *data, u16 len) 5994 { 5995 struct mgmt_cp_start_service_discovery *cp = data; 5996 struct mgmt_pending_cmd *cmd; 5997 const u16 max_uuid_count = ((U16_MAX - sizeof(*cp)) / 16); 5998 u16 uuid_count, expected_len; 5999 u8 status; 6000 int err; 6001 6002 bt_dev_dbg(hdev, "sock %p", sk); 6003 6004 hci_dev_lock(hdev); 6005 6006 if (!hdev_is_powered(hdev)) { 6007 err = mgmt_cmd_complete(sk, hdev->id, 6008 MGMT_OP_START_SERVICE_DISCOVERY, 6009 MGMT_STATUS_NOT_POWERED, 6010 &cp->type, sizeof(cp->type)); 6011 goto failed; 6012 } 6013 6014 if (hdev->discovery.state != DISCOVERY_STOPPED || 6015 hci_dev_test_flag(hdev, HCI_PERIODIC_INQ)) { 6016 err = mgmt_cmd_complete(sk, hdev->id, 6017 MGMT_OP_START_SERVICE_DISCOVERY, 6018 MGMT_STATUS_BUSY, &cp->type, 6019 sizeof(cp->type)); 6020 goto failed; 6021 } 6022 6023 if (hdev->discovery_paused) { 6024 err = mgmt_cmd_complete(sk, hdev->id, 6025 MGMT_OP_START_SERVICE_DISCOVERY, 6026 MGMT_STATUS_BUSY, &cp->type, 6027 sizeof(cp->type)); 6028 goto failed; 6029 } 6030 6031 uuid_count = __le16_to_cpu(cp->uuid_count); 6032 if (uuid_count > max_uuid_count) { 6033 bt_dev_err(hdev, "service_discovery: too big uuid_count value %u", 6034 uuid_count); 6035 err = mgmt_cmd_complete(sk, hdev->id, 6036 MGMT_OP_START_SERVICE_DISCOVERY, 6037 MGMT_STATUS_INVALID_PARAMS, &cp->type, 6038 sizeof(cp->type)); 6039 goto failed; 6040 } 6041 6042 expected_len = sizeof(*cp) + uuid_count * 16; 6043 if (expected_len != len) { 6044 bt_dev_err(hdev, "service_discovery: expected %u bytes, got %u bytes", 6045 expected_len, len); 6046 err = mgmt_cmd_complete(sk, hdev->id, 6047 MGMT_OP_START_SERVICE_DISCOVERY, 6048 MGMT_STATUS_INVALID_PARAMS, &cp->type, 6049 sizeof(cp->type)); 6050 goto failed; 6051 } 6052 6053 if (!discovery_type_is_valid(hdev, cp->type, &status)) { 6054 err = mgmt_cmd_complete(sk, hdev->id, 6055 MGMT_OP_START_SERVICE_DISCOVERY, 6056 status, &cp->type, sizeof(cp->type)); 6057 goto failed; 6058 } 6059 6060 cmd = mgmt_pending_add(sk, MGMT_OP_START_SERVICE_DISCOVERY, 6061 hdev, data, len); 6062 if (!cmd) { 6063 err = -ENOMEM; 6064 goto failed; 6065 } 6066 6067 /* Clear the discovery filter first to free any previously 6068 * allocated memory for the UUID list. 6069 */ 6070 hci_discovery_filter_clear(hdev); 6071 6072 hdev->discovery.result_filtering = true; 6073 hdev->discovery.type = cp->type; 6074 hdev->discovery.rssi = cp->rssi; 6075 hdev->discovery.uuid_count = uuid_count; 6076 6077 if (uuid_count > 0) { 6078 hdev->discovery.uuids = kmemdup(cp->uuids, uuid_count * 16, 6079 GFP_KERNEL); 6080 if (!hdev->discovery.uuids) { 6081 err = mgmt_cmd_complete(sk, hdev->id, 6082 MGMT_OP_START_SERVICE_DISCOVERY, 6083 MGMT_STATUS_FAILED, 6084 &cp->type, sizeof(cp->type)); 6085 mgmt_pending_remove(cmd); 6086 goto failed; 6087 } 6088 } 6089 6090 err = hci_cmd_sync_queue(hdev, start_discovery_sync, cmd, 6091 start_discovery_complete); 6092 if (err < 0) { 6093 mgmt_pending_remove(cmd); 6094 goto failed; 6095 } 6096 6097 hci_discovery_set_state(hdev, DISCOVERY_STARTING); 6098 6099 failed: 6100 hci_dev_unlock(hdev); 6101 return err; 6102 } 6103 6104 void mgmt_stop_discovery_complete(struct hci_dev *hdev, u8 status) 6105 { 6106 struct mgmt_pending_cmd *cmd; 6107 6108 bt_dev_dbg(hdev, "status %u", status); 6109 6110 hci_dev_lock(hdev); 6111 6112 cmd = pending_find(MGMT_OP_STOP_DISCOVERY, hdev); 6113 if (cmd) { 6114 cmd->cmd_complete(cmd, mgmt_status(status)); 6115 mgmt_pending_remove(cmd); 6116 } 6117 6118 hci_dev_unlock(hdev); 6119 } 6120 6121 static void stop_discovery_complete(struct hci_dev *hdev, void *data, int err) 6122 { 6123 struct mgmt_pending_cmd *cmd = data; 6124 6125 if (cmd != pending_find(MGMT_OP_STOP_DISCOVERY, hdev)) 6126 return; 6127 6128 bt_dev_dbg(hdev, "err %d", err); 6129 6130 mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, mgmt_status(err), 6131 cmd->param, 1); 6132 mgmt_pending_remove(cmd); 6133 6134 if (!err) 6135 hci_discovery_set_state(hdev, DISCOVERY_STOPPED); 6136 } 6137 6138 static int stop_discovery_sync(struct hci_dev *hdev, void *data) 6139 { 6140 return hci_stop_discovery_sync(hdev); 6141 } 6142 6143 static int stop_discovery(struct sock *sk, struct hci_dev *hdev, void *data, 6144 u16 len) 6145 { 6146 struct mgmt_cp_stop_discovery *mgmt_cp = data; 6147 struct mgmt_pending_cmd *cmd; 6148 int err; 6149 6150 bt_dev_dbg(hdev, "sock %p", sk); 6151 6152 hci_dev_lock(hdev); 6153 6154 if (!hci_discovery_active(hdev)) { 6155 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY, 6156 MGMT_STATUS_REJECTED, &mgmt_cp->type, 6157 sizeof(mgmt_cp->type)); 6158 goto unlock; 6159 } 6160 6161 if (hdev->discovery.type != mgmt_cp->type) { 6162 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY, 6163 MGMT_STATUS_INVALID_PARAMS, 6164 &mgmt_cp->type, sizeof(mgmt_cp->type)); 6165 goto unlock; 6166 } 6167 6168 cmd = mgmt_pending_add(sk, MGMT_OP_STOP_DISCOVERY, hdev, data, len); 6169 if (!cmd) { 6170 err = -ENOMEM; 6171 goto unlock; 6172 } 6173 6174 err = hci_cmd_sync_queue(hdev, stop_discovery_sync, cmd, 6175 stop_discovery_complete); 6176 if (err < 0) { 6177 mgmt_pending_remove(cmd); 6178 goto unlock; 6179 } 6180 6181 hci_discovery_set_state(hdev, DISCOVERY_STOPPING); 6182 6183 unlock: 6184 hci_dev_unlock(hdev); 6185 return err; 6186 } 6187 6188 static int confirm_name(struct sock *sk, struct hci_dev *hdev, void *data, 6189 u16 len) 6190 { 6191 struct mgmt_cp_confirm_name *cp = data; 6192 struct inquiry_entry *e; 6193 int err; 6194 6195 bt_dev_dbg(hdev, "sock %p", sk); 6196 6197 hci_dev_lock(hdev); 6198 6199 if (!hci_discovery_active(hdev)) { 6200 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME, 6201 MGMT_STATUS_FAILED, &cp->addr, 6202 sizeof(cp->addr)); 6203 goto failed; 6204 } 6205 6206 e = hci_inquiry_cache_lookup_unknown(hdev, &cp->addr.bdaddr); 6207 if (!e) { 6208 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME, 6209 MGMT_STATUS_INVALID_PARAMS, &cp->addr, 6210 sizeof(cp->addr)); 6211 goto failed; 6212 } 6213 6214 if (cp->name_known) { 6215 e->name_state = NAME_KNOWN; 6216 list_del(&e->list); 6217 } else { 6218 e->name_state = NAME_NEEDED; 6219 hci_inquiry_cache_update_resolve(hdev, e); 6220 } 6221 6222 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME, 0, 6223 &cp->addr, sizeof(cp->addr)); 6224 6225 failed: 6226 hci_dev_unlock(hdev); 6227 return err; 6228 } 6229 6230 static int block_device(struct sock *sk, struct hci_dev *hdev, void *data, 6231 u16 len) 6232 { 6233 struct mgmt_cp_block_device *cp = data; 6234 u8 status; 6235 int err; 6236 6237 bt_dev_dbg(hdev, "sock %p", sk); 6238 6239 if (!bdaddr_type_is_valid(cp->addr.type)) 6240 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_BLOCK_DEVICE, 6241 MGMT_STATUS_INVALID_PARAMS, 6242 &cp->addr, sizeof(cp->addr)); 6243 6244 hci_dev_lock(hdev); 6245 6246 err = hci_bdaddr_list_add(&hdev->reject_list, &cp->addr.bdaddr, 6247 cp->addr.type); 6248 if (err < 0) { 6249 status = MGMT_STATUS_FAILED; 6250 goto done; 6251 } 6252 6253 mgmt_event(MGMT_EV_DEVICE_BLOCKED, hdev, &cp->addr, sizeof(cp->addr), 6254 sk); 6255 status = MGMT_STATUS_SUCCESS; 6256 6257 done: 6258 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_BLOCK_DEVICE, status, 6259 &cp->addr, sizeof(cp->addr)); 6260 6261 hci_dev_unlock(hdev); 6262 6263 return err; 6264 } 6265 6266 static int unblock_device(struct sock *sk, struct hci_dev *hdev, void *data, 6267 u16 len) 6268 { 6269 struct mgmt_cp_unblock_device *cp = data; 6270 u8 status; 6271 int err; 6272 6273 bt_dev_dbg(hdev, "sock %p", sk); 6274 6275 if (!bdaddr_type_is_valid(cp->addr.type)) 6276 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNBLOCK_DEVICE, 6277 MGMT_STATUS_INVALID_PARAMS, 6278 &cp->addr, sizeof(cp->addr)); 6279 6280 hci_dev_lock(hdev); 6281 6282 err = hci_bdaddr_list_del(&hdev->reject_list, &cp->addr.bdaddr, 6283 cp->addr.type); 6284 if (err < 0) { 6285 status = MGMT_STATUS_INVALID_PARAMS; 6286 goto done; 6287 } 6288 6289 mgmt_event(MGMT_EV_DEVICE_UNBLOCKED, hdev, &cp->addr, sizeof(cp->addr), 6290 sk); 6291 status = MGMT_STATUS_SUCCESS; 6292 6293 done: 6294 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNBLOCK_DEVICE, status, 6295 &cp->addr, sizeof(cp->addr)); 6296 6297 hci_dev_unlock(hdev); 6298 6299 return err; 6300 } 6301 6302 static int set_device_id_sync(struct hci_dev *hdev, void *data) 6303 { 6304 return hci_update_eir_sync(hdev); 6305 } 6306 6307 static int set_device_id(struct sock *sk, struct hci_dev *hdev, void *data, 6308 u16 len) 6309 { 6310 struct mgmt_cp_set_device_id *cp = data; 6311 int err; 6312 __u16 source; 6313 6314 bt_dev_dbg(hdev, "sock %p", sk); 6315 6316 source = __le16_to_cpu(cp->source); 6317 6318 if (source > 0x0002) 6319 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEVICE_ID, 6320 MGMT_STATUS_INVALID_PARAMS); 6321 6322 hci_dev_lock(hdev); 6323 6324 hdev->devid_source = source; 6325 hdev->devid_vendor = __le16_to_cpu(cp->vendor); 6326 hdev->devid_product = __le16_to_cpu(cp->product); 6327 hdev->devid_version = __le16_to_cpu(cp->version); 6328 6329 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_DEVICE_ID, 0, 6330 NULL, 0); 6331 6332 hci_cmd_sync_queue(hdev, set_device_id_sync, NULL, NULL); 6333 6334 hci_dev_unlock(hdev); 6335 6336 return err; 6337 } 6338 6339 static void enable_advertising_instance(struct hci_dev *hdev, int err) 6340 { 6341 if (err) 6342 bt_dev_err(hdev, "failed to re-configure advertising %d", err); 6343 else 6344 bt_dev_dbg(hdev, "status %d", err); 6345 } 6346 6347 static void set_advertising_complete(struct hci_dev *hdev, void *data, int err) 6348 { 6349 struct cmd_lookup match = { NULL, hdev }; 6350 u8 instance; 6351 struct adv_info *adv_instance; 6352 u8 status = mgmt_status(err); 6353 6354 if (status) { 6355 mgmt_pending_foreach(MGMT_OP_SET_ADVERTISING, hdev, 6356 cmd_status_rsp, &status); 6357 return; 6358 } 6359 6360 if (hci_dev_test_flag(hdev, HCI_LE_ADV)) 6361 hci_dev_set_flag(hdev, HCI_ADVERTISING); 6362 else 6363 hci_dev_clear_flag(hdev, HCI_ADVERTISING); 6364 6365 mgmt_pending_foreach(MGMT_OP_SET_ADVERTISING, hdev, settings_rsp, 6366 &match); 6367 6368 new_settings(hdev, match.sk); 6369 6370 if (match.sk) 6371 sock_put(match.sk); 6372 6373 /* If "Set Advertising" was just disabled and instance advertising was 6374 * set up earlier, then re-enable multi-instance advertising. 6375 */ 6376 if (hci_dev_test_flag(hdev, HCI_ADVERTISING) || 6377 list_empty(&hdev->adv_instances)) 6378 return; 6379 6380 instance = hdev->cur_adv_instance; 6381 if (!instance) { 6382 adv_instance = list_first_entry_or_null(&hdev->adv_instances, 6383 struct adv_info, list); 6384 if (!adv_instance) 6385 return; 6386 6387 instance = adv_instance->instance; 6388 } 6389 6390 err = hci_schedule_adv_instance_sync(hdev, instance, true); 6391 6392 enable_advertising_instance(hdev, err); 6393 } 6394 6395 static int set_adv_sync(struct hci_dev *hdev, void *data) 6396 { 6397 struct mgmt_pending_cmd *cmd = data; 6398 struct mgmt_mode *cp = cmd->param; 6399 u8 val = !!cp->val; 6400 6401 if (cp->val == 0x02) 6402 hci_dev_set_flag(hdev, HCI_ADVERTISING_CONNECTABLE); 6403 else 6404 hci_dev_clear_flag(hdev, HCI_ADVERTISING_CONNECTABLE); 6405 6406 cancel_adv_timeout(hdev); 6407 6408 if (val) { 6409 /* Switch to instance "0" for the Set Advertising setting. 6410 * We cannot use update_[adv|scan_rsp]_data() here as the 6411 * HCI_ADVERTISING flag is not yet set. 6412 */ 6413 hdev->cur_adv_instance = 0x00; 6414 6415 if (ext_adv_capable(hdev)) { 6416 hci_start_ext_adv_sync(hdev, 0x00); 6417 } else { 6418 hci_update_adv_data_sync(hdev, 0x00); 6419 hci_update_scan_rsp_data_sync(hdev, 0x00); 6420 hci_enable_advertising_sync(hdev); 6421 } 6422 } else { 6423 hci_disable_advertising_sync(hdev); 6424 } 6425 6426 return 0; 6427 } 6428 6429 static int set_advertising(struct sock *sk, struct hci_dev *hdev, void *data, 6430 u16 len) 6431 { 6432 struct mgmt_mode *cp = data; 6433 struct mgmt_pending_cmd *cmd; 6434 u8 val, status; 6435 int err; 6436 6437 bt_dev_dbg(hdev, "sock %p", sk); 6438 6439 status = mgmt_le_support(hdev); 6440 if (status) 6441 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING, 6442 status); 6443 6444 if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02) 6445 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING, 6446 MGMT_STATUS_INVALID_PARAMS); 6447 6448 if (hdev->advertising_paused) 6449 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING, 6450 MGMT_STATUS_BUSY); 6451 6452 hci_dev_lock(hdev); 6453 6454 val = !!cp->val; 6455 6456 /* The following conditions are ones which mean that we should 6457 * not do any HCI communication but directly send a mgmt 6458 * response to user space (after toggling the flag if 6459 * necessary). 6460 */ 6461 if (!hdev_is_powered(hdev) || 6462 (val == hci_dev_test_flag(hdev, HCI_ADVERTISING) && 6463 (cp->val == 0x02) == hci_dev_test_flag(hdev, HCI_ADVERTISING_CONNECTABLE)) || 6464 hci_dev_test_flag(hdev, HCI_MESH) || 6465 hci_conn_num(hdev, LE_LINK) > 0 || 6466 (hci_dev_test_flag(hdev, HCI_LE_SCAN) && 6467 hdev->le_scan_type == LE_SCAN_ACTIVE)) { 6468 bool changed; 6469 6470 if (cp->val) { 6471 hdev->cur_adv_instance = 0x00; 6472 changed = !hci_dev_test_and_set_flag(hdev, HCI_ADVERTISING); 6473 if (cp->val == 0x02) 6474 hci_dev_set_flag(hdev, HCI_ADVERTISING_CONNECTABLE); 6475 else 6476 hci_dev_clear_flag(hdev, HCI_ADVERTISING_CONNECTABLE); 6477 } else { 6478 changed = hci_dev_test_and_clear_flag(hdev, HCI_ADVERTISING); 6479 hci_dev_clear_flag(hdev, HCI_ADVERTISING_CONNECTABLE); 6480 } 6481 6482 err = send_settings_rsp(sk, MGMT_OP_SET_ADVERTISING, hdev); 6483 if (err < 0) 6484 goto unlock; 6485 6486 if (changed) 6487 err = new_settings(hdev, sk); 6488 6489 goto unlock; 6490 } 6491 6492 if (pending_find(MGMT_OP_SET_ADVERTISING, hdev) || 6493 pending_find(MGMT_OP_SET_LE, hdev)) { 6494 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING, 6495 MGMT_STATUS_BUSY); 6496 goto unlock; 6497 } 6498 6499 cmd = mgmt_pending_add(sk, MGMT_OP_SET_ADVERTISING, hdev, data, len); 6500 if (!cmd) 6501 err = -ENOMEM; 6502 else 6503 err = hci_cmd_sync_queue(hdev, set_adv_sync, cmd, 6504 set_advertising_complete); 6505 6506 if (err < 0 && cmd) 6507 mgmt_pending_remove(cmd); 6508 6509 unlock: 6510 hci_dev_unlock(hdev); 6511 return err; 6512 } 6513 6514 static int set_static_address(struct sock *sk, struct hci_dev *hdev, 6515 void *data, u16 len) 6516 { 6517 struct mgmt_cp_set_static_address *cp = data; 6518 int err; 6519 6520 bt_dev_dbg(hdev, "sock %p", sk); 6521 6522 if (!lmp_le_capable(hdev)) 6523 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_STATIC_ADDRESS, 6524 MGMT_STATUS_NOT_SUPPORTED); 6525 6526 if (hdev_is_powered(hdev)) 6527 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_STATIC_ADDRESS, 6528 MGMT_STATUS_REJECTED); 6529 6530 if (bacmp(&cp->bdaddr, BDADDR_ANY)) { 6531 if (!bacmp(&cp->bdaddr, BDADDR_NONE)) 6532 return mgmt_cmd_status(sk, hdev->id, 6533 MGMT_OP_SET_STATIC_ADDRESS, 6534 MGMT_STATUS_INVALID_PARAMS); 6535 6536 /* Two most significant bits shall be set */ 6537 if ((cp->bdaddr.b[5] & 0xc0) != 0xc0) 6538 return mgmt_cmd_status(sk, hdev->id, 6539 MGMT_OP_SET_STATIC_ADDRESS, 6540 MGMT_STATUS_INVALID_PARAMS); 6541 } 6542 6543 hci_dev_lock(hdev); 6544 6545 bacpy(&hdev->static_addr, &cp->bdaddr); 6546 6547 err = send_settings_rsp(sk, MGMT_OP_SET_STATIC_ADDRESS, hdev); 6548 if (err < 0) 6549 goto unlock; 6550 6551 err = new_settings(hdev, sk); 6552 6553 unlock: 6554 hci_dev_unlock(hdev); 6555 return err; 6556 } 6557 6558 static int set_scan_params(struct sock *sk, struct hci_dev *hdev, 6559 void *data, u16 len) 6560 { 6561 struct mgmt_cp_set_scan_params *cp = data; 6562 __u16 interval, window; 6563 int err; 6564 6565 bt_dev_dbg(hdev, "sock %p", sk); 6566 6567 if (!lmp_le_capable(hdev)) 6568 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS, 6569 MGMT_STATUS_NOT_SUPPORTED); 6570 6571 interval = __le16_to_cpu(cp->interval); 6572 6573 if (interval < 0x0004 || interval > 0x4000) 6574 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS, 6575 MGMT_STATUS_INVALID_PARAMS); 6576 6577 window = __le16_to_cpu(cp->window); 6578 6579 if (window < 0x0004 || window > 0x4000) 6580 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS, 6581 MGMT_STATUS_INVALID_PARAMS); 6582 6583 if (window > interval) 6584 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS, 6585 MGMT_STATUS_INVALID_PARAMS); 6586 6587 hci_dev_lock(hdev); 6588 6589 hdev->le_scan_interval = interval; 6590 hdev->le_scan_window = window; 6591 6592 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS, 0, 6593 NULL, 0); 6594 6595 /* If background scan is running, restart it so new parameters are 6596 * loaded. 6597 */ 6598 if (hci_dev_test_flag(hdev, HCI_LE_SCAN) && 6599 hdev->discovery.state == DISCOVERY_STOPPED) 6600 hci_update_passive_scan(hdev); 6601 6602 hci_dev_unlock(hdev); 6603 6604 return err; 6605 } 6606 6607 static void fast_connectable_complete(struct hci_dev *hdev, void *data, int err) 6608 { 6609 struct mgmt_pending_cmd *cmd = data; 6610 6611 bt_dev_dbg(hdev, "err %d", err); 6612 6613 if (err) { 6614 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE, 6615 mgmt_status(err)); 6616 } else { 6617 struct mgmt_mode *cp = cmd->param; 6618 6619 if (cp->val) 6620 hci_dev_set_flag(hdev, HCI_FAST_CONNECTABLE); 6621 else 6622 hci_dev_clear_flag(hdev, HCI_FAST_CONNECTABLE); 6623 6624 send_settings_rsp(cmd->sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev); 6625 new_settings(hdev, cmd->sk); 6626 } 6627 6628 mgmt_pending_free(cmd); 6629 } 6630 6631 static int write_fast_connectable_sync(struct hci_dev *hdev, void *data) 6632 { 6633 struct mgmt_pending_cmd *cmd = data; 6634 struct mgmt_mode *cp = cmd->param; 6635 6636 return hci_write_fast_connectable_sync(hdev, cp->val); 6637 } 6638 6639 static int set_fast_connectable(struct sock *sk, struct hci_dev *hdev, 6640 void *data, u16 len) 6641 { 6642 struct mgmt_mode *cp = data; 6643 struct mgmt_pending_cmd *cmd; 6644 int err; 6645 6646 bt_dev_dbg(hdev, "sock %p", sk); 6647 6648 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) || 6649 hdev->hci_ver < BLUETOOTH_VER_1_2) 6650 return mgmt_cmd_status(sk, hdev->id, 6651 MGMT_OP_SET_FAST_CONNECTABLE, 6652 MGMT_STATUS_NOT_SUPPORTED); 6653 6654 if (cp->val != 0x00 && cp->val != 0x01) 6655 return mgmt_cmd_status(sk, hdev->id, 6656 MGMT_OP_SET_FAST_CONNECTABLE, 6657 MGMT_STATUS_INVALID_PARAMS); 6658 6659 hci_dev_lock(hdev); 6660 6661 if (!!cp->val == hci_dev_test_flag(hdev, HCI_FAST_CONNECTABLE)) { 6662 err = send_settings_rsp(sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev); 6663 goto unlock; 6664 } 6665 6666 if (!hdev_is_powered(hdev)) { 6667 hci_dev_change_flag(hdev, HCI_FAST_CONNECTABLE); 6668 err = send_settings_rsp(sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev); 6669 new_settings(hdev, sk); 6670 goto unlock; 6671 } 6672 6673 cmd = mgmt_pending_new(sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev, data, 6674 len); 6675 if (!cmd) 6676 err = -ENOMEM; 6677 else 6678 err = hci_cmd_sync_queue(hdev, write_fast_connectable_sync, cmd, 6679 fast_connectable_complete); 6680 6681 if (err < 0) { 6682 mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE, 6683 MGMT_STATUS_FAILED); 6684 6685 if (cmd) 6686 mgmt_pending_free(cmd); 6687 } 6688 6689 unlock: 6690 hci_dev_unlock(hdev); 6691 6692 return err; 6693 } 6694 6695 static void set_bredr_complete(struct hci_dev *hdev, void *data, int err) 6696 { 6697 struct mgmt_pending_cmd *cmd = data; 6698 6699 bt_dev_dbg(hdev, "err %d", err); 6700 6701 if (err) { 6702 u8 mgmt_err = mgmt_status(err); 6703 6704 /* We need to restore the flag if related HCI commands 6705 * failed. 6706 */ 6707 hci_dev_clear_flag(hdev, HCI_BREDR_ENABLED); 6708 6709 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err); 6710 } else { 6711 send_settings_rsp(cmd->sk, MGMT_OP_SET_BREDR, hdev); 6712 new_settings(hdev, cmd->sk); 6713 } 6714 6715 mgmt_pending_free(cmd); 6716 } 6717 6718 static int set_bredr_sync(struct hci_dev *hdev, void *data) 6719 { 6720 int status; 6721 6722 status = hci_write_fast_connectable_sync(hdev, false); 6723 6724 if (!status) 6725 status = hci_update_scan_sync(hdev); 6726 6727 /* Since only the advertising data flags will change, there 6728 * is no need to update the scan response data. 6729 */ 6730 if (!status) 6731 status = hci_update_adv_data_sync(hdev, hdev->cur_adv_instance); 6732 6733 return status; 6734 } 6735 6736 static int set_bredr(struct sock *sk, struct hci_dev *hdev, void *data, u16 len) 6737 { 6738 struct mgmt_mode *cp = data; 6739 struct mgmt_pending_cmd *cmd; 6740 int err; 6741 6742 bt_dev_dbg(hdev, "sock %p", sk); 6743 6744 if (!lmp_bredr_capable(hdev) || !lmp_le_capable(hdev)) 6745 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR, 6746 MGMT_STATUS_NOT_SUPPORTED); 6747 6748 if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED)) 6749 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR, 6750 MGMT_STATUS_REJECTED); 6751 6752 if (cp->val != 0x00 && cp->val != 0x01) 6753 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR, 6754 MGMT_STATUS_INVALID_PARAMS); 6755 6756 hci_dev_lock(hdev); 6757 6758 if (cp->val == hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) { 6759 err = send_settings_rsp(sk, MGMT_OP_SET_BREDR, hdev); 6760 goto unlock; 6761 } 6762 6763 if (!hdev_is_powered(hdev)) { 6764 if (!cp->val) { 6765 hci_dev_clear_flag(hdev, HCI_DISCOVERABLE); 6766 hci_dev_clear_flag(hdev, HCI_SSP_ENABLED); 6767 hci_dev_clear_flag(hdev, HCI_LINK_SECURITY); 6768 hci_dev_clear_flag(hdev, HCI_FAST_CONNECTABLE); 6769 hci_dev_clear_flag(hdev, HCI_HS_ENABLED); 6770 } 6771 6772 hci_dev_change_flag(hdev, HCI_BREDR_ENABLED); 6773 6774 err = send_settings_rsp(sk, MGMT_OP_SET_BREDR, hdev); 6775 if (err < 0) 6776 goto unlock; 6777 6778 err = new_settings(hdev, sk); 6779 goto unlock; 6780 } 6781 6782 /* Reject disabling when powered on */ 6783 if (!cp->val) { 6784 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR, 6785 MGMT_STATUS_REJECTED); 6786 goto unlock; 6787 } else { 6788 /* When configuring a dual-mode controller to operate 6789 * with LE only and using a static address, then switching 6790 * BR/EDR back on is not allowed. 6791 * 6792 * Dual-mode controllers shall operate with the public 6793 * address as its identity address for BR/EDR and LE. So 6794 * reject the attempt to create an invalid configuration. 6795 * 6796 * The same restrictions applies when secure connections 6797 * has been enabled. For BR/EDR this is a controller feature 6798 * while for LE it is a host stack feature. This means that 6799 * switching BR/EDR back on when secure connections has been 6800 * enabled is not a supported transaction. 6801 */ 6802 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) && 6803 (bacmp(&hdev->static_addr, BDADDR_ANY) || 6804 hci_dev_test_flag(hdev, HCI_SC_ENABLED))) { 6805 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR, 6806 MGMT_STATUS_REJECTED); 6807 goto unlock; 6808 } 6809 } 6810 6811 cmd = mgmt_pending_new(sk, MGMT_OP_SET_BREDR, hdev, data, len); 6812 if (!cmd) 6813 err = -ENOMEM; 6814 else 6815 err = hci_cmd_sync_queue(hdev, set_bredr_sync, cmd, 6816 set_bredr_complete); 6817 6818 if (err < 0) { 6819 mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR, 6820 MGMT_STATUS_FAILED); 6821 if (cmd) 6822 mgmt_pending_free(cmd); 6823 6824 goto unlock; 6825 } 6826 6827 /* We need to flip the bit already here so that 6828 * hci_req_update_adv_data generates the correct flags. 6829 */ 6830 hci_dev_set_flag(hdev, HCI_BREDR_ENABLED); 6831 6832 unlock: 6833 hci_dev_unlock(hdev); 6834 return err; 6835 } 6836 6837 static void set_secure_conn_complete(struct hci_dev *hdev, void *data, int err) 6838 { 6839 struct mgmt_pending_cmd *cmd = data; 6840 struct mgmt_mode *cp; 6841 6842 bt_dev_dbg(hdev, "err %d", err); 6843 6844 if (err) { 6845 u8 mgmt_err = mgmt_status(err); 6846 6847 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err); 6848 goto done; 6849 } 6850 6851 cp = cmd->param; 6852 6853 switch (cp->val) { 6854 case 0x00: 6855 hci_dev_clear_flag(hdev, HCI_SC_ENABLED); 6856 hci_dev_clear_flag(hdev, HCI_SC_ONLY); 6857 break; 6858 case 0x01: 6859 hci_dev_set_flag(hdev, HCI_SC_ENABLED); 6860 hci_dev_clear_flag(hdev, HCI_SC_ONLY); 6861 break; 6862 case 0x02: 6863 hci_dev_set_flag(hdev, HCI_SC_ENABLED); 6864 hci_dev_set_flag(hdev, HCI_SC_ONLY); 6865 break; 6866 } 6867 6868 send_settings_rsp(cmd->sk, cmd->opcode, hdev); 6869 new_settings(hdev, cmd->sk); 6870 6871 done: 6872 mgmt_pending_free(cmd); 6873 } 6874 6875 static int set_secure_conn_sync(struct hci_dev *hdev, void *data) 6876 { 6877 struct mgmt_pending_cmd *cmd = data; 6878 struct mgmt_mode *cp = cmd->param; 6879 u8 val = !!cp->val; 6880 6881 /* Force write of val */ 6882 hci_dev_set_flag(hdev, HCI_SC_ENABLED); 6883 6884 return hci_write_sc_support_sync(hdev, val); 6885 } 6886 6887 static int set_secure_conn(struct sock *sk, struct hci_dev *hdev, 6888 void *data, u16 len) 6889 { 6890 struct mgmt_mode *cp = data; 6891 struct mgmt_pending_cmd *cmd; 6892 u8 val; 6893 int err; 6894 6895 bt_dev_dbg(hdev, "sock %p", sk); 6896 6897 if (!lmp_sc_capable(hdev) && 6898 !hci_dev_test_flag(hdev, HCI_LE_ENABLED)) 6899 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN, 6900 MGMT_STATUS_NOT_SUPPORTED); 6901 6902 if (hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) && 6903 lmp_sc_capable(hdev) && 6904 !hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) 6905 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN, 6906 MGMT_STATUS_REJECTED); 6907 6908 if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02) 6909 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN, 6910 MGMT_STATUS_INVALID_PARAMS); 6911 6912 hci_dev_lock(hdev); 6913 6914 if (!hdev_is_powered(hdev) || !lmp_sc_capable(hdev) || 6915 !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) { 6916 bool changed; 6917 6918 if (cp->val) { 6919 changed = !hci_dev_test_and_set_flag(hdev, 6920 HCI_SC_ENABLED); 6921 if (cp->val == 0x02) 6922 hci_dev_set_flag(hdev, HCI_SC_ONLY); 6923 else 6924 hci_dev_clear_flag(hdev, HCI_SC_ONLY); 6925 } else { 6926 changed = hci_dev_test_and_clear_flag(hdev, 6927 HCI_SC_ENABLED); 6928 hci_dev_clear_flag(hdev, HCI_SC_ONLY); 6929 } 6930 6931 err = send_settings_rsp(sk, MGMT_OP_SET_SECURE_CONN, hdev); 6932 if (err < 0) 6933 goto failed; 6934 6935 if (changed) 6936 err = new_settings(hdev, sk); 6937 6938 goto failed; 6939 } 6940 6941 val = !!cp->val; 6942 6943 if (val == hci_dev_test_flag(hdev, HCI_SC_ENABLED) && 6944 (cp->val == 0x02) == hci_dev_test_flag(hdev, HCI_SC_ONLY)) { 6945 err = send_settings_rsp(sk, MGMT_OP_SET_SECURE_CONN, hdev); 6946 goto failed; 6947 } 6948 6949 cmd = mgmt_pending_new(sk, MGMT_OP_SET_SECURE_CONN, hdev, data, len); 6950 if (!cmd) 6951 err = -ENOMEM; 6952 else 6953 err = hci_cmd_sync_queue(hdev, set_secure_conn_sync, cmd, 6954 set_secure_conn_complete); 6955 6956 if (err < 0) { 6957 mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN, 6958 MGMT_STATUS_FAILED); 6959 if (cmd) 6960 mgmt_pending_free(cmd); 6961 } 6962 6963 failed: 6964 hci_dev_unlock(hdev); 6965 return err; 6966 } 6967 6968 static int set_debug_keys(struct sock *sk, struct hci_dev *hdev, 6969 void *data, u16 len) 6970 { 6971 struct mgmt_mode *cp = data; 6972 bool changed, use_changed; 6973 int err; 6974 6975 bt_dev_dbg(hdev, "sock %p", sk); 6976 6977 if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02) 6978 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEBUG_KEYS, 6979 MGMT_STATUS_INVALID_PARAMS); 6980 6981 hci_dev_lock(hdev); 6982 6983 if (cp->val) 6984 changed = !hci_dev_test_and_set_flag(hdev, HCI_KEEP_DEBUG_KEYS); 6985 else 6986 changed = hci_dev_test_and_clear_flag(hdev, 6987 HCI_KEEP_DEBUG_KEYS); 6988 6989 if (cp->val == 0x02) 6990 use_changed = !hci_dev_test_and_set_flag(hdev, 6991 HCI_USE_DEBUG_KEYS); 6992 else 6993 use_changed = hci_dev_test_and_clear_flag(hdev, 6994 HCI_USE_DEBUG_KEYS); 6995 6996 if (hdev_is_powered(hdev) && use_changed && 6997 hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) { 6998 u8 mode = (cp->val == 0x02) ? 0x01 : 0x00; 6999 hci_send_cmd(hdev, HCI_OP_WRITE_SSP_DEBUG_MODE, 7000 sizeof(mode), &mode); 7001 } 7002 7003 err = send_settings_rsp(sk, MGMT_OP_SET_DEBUG_KEYS, hdev); 7004 if (err < 0) 7005 goto unlock; 7006 7007 if (changed) 7008 err = new_settings(hdev, sk); 7009 7010 unlock: 7011 hci_dev_unlock(hdev); 7012 return err; 7013 } 7014 7015 static int set_privacy(struct sock *sk, struct hci_dev *hdev, void *cp_data, 7016 u16 len) 7017 { 7018 struct mgmt_cp_set_privacy *cp = cp_data; 7019 bool changed; 7020 int err; 7021 7022 bt_dev_dbg(hdev, "sock %p", sk); 7023 7024 if (!lmp_le_capable(hdev)) 7025 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY, 7026 MGMT_STATUS_NOT_SUPPORTED); 7027 7028 if (cp->privacy != 0x00 && cp->privacy != 0x01 && cp->privacy != 0x02) 7029 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY, 7030 MGMT_STATUS_INVALID_PARAMS); 7031 7032 if (hdev_is_powered(hdev)) 7033 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY, 7034 MGMT_STATUS_REJECTED); 7035 7036 hci_dev_lock(hdev); 7037 7038 /* If user space supports this command it is also expected to 7039 * handle IRKs. Therefore, set the HCI_RPA_RESOLVING flag. 7040 */ 7041 hci_dev_set_flag(hdev, HCI_RPA_RESOLVING); 7042 7043 if (cp->privacy) { 7044 changed = !hci_dev_test_and_set_flag(hdev, HCI_PRIVACY); 7045 memcpy(hdev->irk, cp->irk, sizeof(hdev->irk)); 7046 hci_dev_set_flag(hdev, HCI_RPA_EXPIRED); 7047 hci_adv_instances_set_rpa_expired(hdev, true); 7048 if (cp->privacy == 0x02) 7049 hci_dev_set_flag(hdev, HCI_LIMITED_PRIVACY); 7050 else 7051 hci_dev_clear_flag(hdev, HCI_LIMITED_PRIVACY); 7052 } else { 7053 changed = hci_dev_test_and_clear_flag(hdev, HCI_PRIVACY); 7054 memset(hdev->irk, 0, sizeof(hdev->irk)); 7055 hci_dev_clear_flag(hdev, HCI_RPA_EXPIRED); 7056 hci_adv_instances_set_rpa_expired(hdev, false); 7057 hci_dev_clear_flag(hdev, HCI_LIMITED_PRIVACY); 7058 } 7059 7060 err = send_settings_rsp(sk, MGMT_OP_SET_PRIVACY, hdev); 7061 if (err < 0) 7062 goto unlock; 7063 7064 if (changed) 7065 err = new_settings(hdev, sk); 7066 7067 unlock: 7068 hci_dev_unlock(hdev); 7069 return err; 7070 } 7071 7072 static bool irk_is_valid(struct mgmt_irk_info *irk) 7073 { 7074 switch (irk->addr.type) { 7075 case BDADDR_LE_PUBLIC: 7076 return true; 7077 7078 case BDADDR_LE_RANDOM: 7079 /* Two most significant bits shall be set */ 7080 if ((irk->addr.bdaddr.b[5] & 0xc0) != 0xc0) 7081 return false; 7082 return true; 7083 } 7084 7085 return false; 7086 } 7087 7088 static int load_irks(struct sock *sk, struct hci_dev *hdev, void *cp_data, 7089 u16 len) 7090 { 7091 struct mgmt_cp_load_irks *cp = cp_data; 7092 const u16 max_irk_count = ((U16_MAX - sizeof(*cp)) / 7093 sizeof(struct mgmt_irk_info)); 7094 u16 irk_count, expected_len; 7095 int i, err; 7096 7097 bt_dev_dbg(hdev, "sock %p", sk); 7098 7099 if (!lmp_le_capable(hdev)) 7100 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS, 7101 MGMT_STATUS_NOT_SUPPORTED); 7102 7103 irk_count = __le16_to_cpu(cp->irk_count); 7104 if (irk_count > max_irk_count) { 7105 bt_dev_err(hdev, "load_irks: too big irk_count value %u", 7106 irk_count); 7107 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS, 7108 MGMT_STATUS_INVALID_PARAMS); 7109 } 7110 7111 expected_len = struct_size(cp, irks, irk_count); 7112 if (expected_len != len) { 7113 bt_dev_err(hdev, "load_irks: expected %u bytes, got %u bytes", 7114 expected_len, len); 7115 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS, 7116 MGMT_STATUS_INVALID_PARAMS); 7117 } 7118 7119 bt_dev_dbg(hdev, "irk_count %u", irk_count); 7120 7121 for (i = 0; i < irk_count; i++) { 7122 struct mgmt_irk_info *key = &cp->irks[i]; 7123 7124 if (!irk_is_valid(key)) 7125 return mgmt_cmd_status(sk, hdev->id, 7126 MGMT_OP_LOAD_IRKS, 7127 MGMT_STATUS_INVALID_PARAMS); 7128 } 7129 7130 hci_dev_lock(hdev); 7131 7132 hci_smp_irks_clear(hdev); 7133 7134 for (i = 0; i < irk_count; i++) { 7135 struct mgmt_irk_info *irk = &cp->irks[i]; 7136 u8 addr_type = le_addr_type(irk->addr.type); 7137 7138 if (hci_is_blocked_key(hdev, 7139 HCI_BLOCKED_KEY_TYPE_IRK, 7140 irk->val)) { 7141 bt_dev_warn(hdev, "Skipping blocked IRK for %pMR", 7142 &irk->addr.bdaddr); 7143 continue; 7144 } 7145 7146 /* When using SMP over BR/EDR, the addr type should be set to BREDR */ 7147 if (irk->addr.type == BDADDR_BREDR) 7148 addr_type = BDADDR_BREDR; 7149 7150 hci_add_irk(hdev, &irk->addr.bdaddr, 7151 addr_type, irk->val, 7152 BDADDR_ANY); 7153 } 7154 7155 hci_dev_set_flag(hdev, HCI_RPA_RESOLVING); 7156 7157 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_IRKS, 0, NULL, 0); 7158 7159 hci_dev_unlock(hdev); 7160 7161 return err; 7162 } 7163 7164 static bool ltk_is_valid(struct mgmt_ltk_info *key) 7165 { 7166 if (key->initiator != 0x00 && key->initiator != 0x01) 7167 return false; 7168 7169 switch (key->addr.type) { 7170 case BDADDR_LE_PUBLIC: 7171 return true; 7172 7173 case BDADDR_LE_RANDOM: 7174 /* Two most significant bits shall be set */ 7175 if ((key->addr.bdaddr.b[5] & 0xc0) != 0xc0) 7176 return false; 7177 return true; 7178 } 7179 7180 return false; 7181 } 7182 7183 static int load_long_term_keys(struct sock *sk, struct hci_dev *hdev, 7184 void *cp_data, u16 len) 7185 { 7186 struct mgmt_cp_load_long_term_keys *cp = cp_data; 7187 const u16 max_key_count = ((U16_MAX - sizeof(*cp)) / 7188 sizeof(struct mgmt_ltk_info)); 7189 u16 key_count, expected_len; 7190 int i, err; 7191 7192 bt_dev_dbg(hdev, "sock %p", sk); 7193 7194 if (!lmp_le_capable(hdev)) 7195 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS, 7196 MGMT_STATUS_NOT_SUPPORTED); 7197 7198 key_count = __le16_to_cpu(cp->key_count); 7199 if (key_count > max_key_count) { 7200 bt_dev_err(hdev, "load_ltks: too big key_count value %u", 7201 key_count); 7202 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS, 7203 MGMT_STATUS_INVALID_PARAMS); 7204 } 7205 7206 expected_len = struct_size(cp, keys, key_count); 7207 if (expected_len != len) { 7208 bt_dev_err(hdev, "load_keys: expected %u bytes, got %u bytes", 7209 expected_len, len); 7210 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS, 7211 MGMT_STATUS_INVALID_PARAMS); 7212 } 7213 7214 bt_dev_dbg(hdev, "key_count %u", key_count); 7215 7216 for (i = 0; i < key_count; i++) { 7217 struct mgmt_ltk_info *key = &cp->keys[i]; 7218 7219 if (!ltk_is_valid(key)) 7220 return mgmt_cmd_status(sk, hdev->id, 7221 MGMT_OP_LOAD_LONG_TERM_KEYS, 7222 MGMT_STATUS_INVALID_PARAMS); 7223 } 7224 7225 hci_dev_lock(hdev); 7226 7227 hci_smp_ltks_clear(hdev); 7228 7229 for (i = 0; i < key_count; i++) { 7230 struct mgmt_ltk_info *key = &cp->keys[i]; 7231 u8 type, authenticated; 7232 u8 addr_type = le_addr_type(key->addr.type); 7233 7234 if (hci_is_blocked_key(hdev, 7235 HCI_BLOCKED_KEY_TYPE_LTK, 7236 key->val)) { 7237 bt_dev_warn(hdev, "Skipping blocked LTK for %pMR", 7238 &key->addr.bdaddr); 7239 continue; 7240 } 7241 7242 switch (key->type) { 7243 case MGMT_LTK_UNAUTHENTICATED: 7244 authenticated = 0x00; 7245 type = key->initiator ? SMP_LTK : SMP_LTK_RESPONDER; 7246 break; 7247 case MGMT_LTK_AUTHENTICATED: 7248 authenticated = 0x01; 7249 type = key->initiator ? SMP_LTK : SMP_LTK_RESPONDER; 7250 break; 7251 case MGMT_LTK_P256_UNAUTH: 7252 authenticated = 0x00; 7253 type = SMP_LTK_P256; 7254 break; 7255 case MGMT_LTK_P256_AUTH: 7256 authenticated = 0x01; 7257 type = SMP_LTK_P256; 7258 break; 7259 case MGMT_LTK_P256_DEBUG: 7260 authenticated = 0x00; 7261 type = SMP_LTK_P256_DEBUG; 7262 fallthrough; 7263 default: 7264 continue; 7265 } 7266 7267 /* When using SMP over BR/EDR, the addr type should be set to BREDR */ 7268 if (key->addr.type == BDADDR_BREDR) 7269 addr_type = BDADDR_BREDR; 7270 7271 hci_add_ltk(hdev, &key->addr.bdaddr, 7272 addr_type, type, authenticated, 7273 key->val, key->enc_size, key->ediv, key->rand); 7274 } 7275 7276 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS, 0, 7277 NULL, 0); 7278 7279 hci_dev_unlock(hdev); 7280 7281 return err; 7282 } 7283 7284 static void get_conn_info_complete(struct hci_dev *hdev, void *data, int err) 7285 { 7286 struct mgmt_pending_cmd *cmd = data; 7287 struct hci_conn *conn = cmd->user_data; 7288 struct mgmt_cp_get_conn_info *cp = cmd->param; 7289 struct mgmt_rp_get_conn_info rp; 7290 u8 status; 7291 7292 bt_dev_dbg(hdev, "err %d", err); 7293 7294 memcpy(&rp.addr, &cp->addr, sizeof(rp.addr)); 7295 7296 status = mgmt_status(err); 7297 if (status == MGMT_STATUS_SUCCESS) { 7298 rp.rssi = conn->rssi; 7299 rp.tx_power = conn->tx_power; 7300 rp.max_tx_power = conn->max_tx_power; 7301 } else { 7302 rp.rssi = HCI_RSSI_INVALID; 7303 rp.tx_power = HCI_TX_POWER_INVALID; 7304 rp.max_tx_power = HCI_TX_POWER_INVALID; 7305 } 7306 7307 mgmt_cmd_complete(cmd->sk, cmd->index, MGMT_OP_GET_CONN_INFO, status, 7308 &rp, sizeof(rp)); 7309 7310 mgmt_pending_free(cmd); 7311 } 7312 7313 static int get_conn_info_sync(struct hci_dev *hdev, void *data) 7314 { 7315 struct mgmt_pending_cmd *cmd = data; 7316 struct mgmt_cp_get_conn_info *cp = cmd->param; 7317 struct hci_conn *conn; 7318 int err; 7319 __le16 handle; 7320 7321 /* Make sure we are still connected */ 7322 if (cp->addr.type == BDADDR_BREDR) 7323 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, 7324 &cp->addr.bdaddr); 7325 else 7326 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &cp->addr.bdaddr); 7327 7328 if (!conn || conn->state != BT_CONNECTED) 7329 return MGMT_STATUS_NOT_CONNECTED; 7330 7331 cmd->user_data = conn; 7332 handle = cpu_to_le16(conn->handle); 7333 7334 /* Refresh RSSI each time */ 7335 err = hci_read_rssi_sync(hdev, handle); 7336 7337 /* For LE links TX power does not change thus we don't need to 7338 * query for it once value is known. 7339 */ 7340 if (!err && (!bdaddr_type_is_le(cp->addr.type) || 7341 conn->tx_power == HCI_TX_POWER_INVALID)) 7342 err = hci_read_tx_power_sync(hdev, handle, 0x00); 7343 7344 /* Max TX power needs to be read only once per connection */ 7345 if (!err && conn->max_tx_power == HCI_TX_POWER_INVALID) 7346 err = hci_read_tx_power_sync(hdev, handle, 0x01); 7347 7348 return err; 7349 } 7350 7351 static int get_conn_info(struct sock *sk, struct hci_dev *hdev, void *data, 7352 u16 len) 7353 { 7354 struct mgmt_cp_get_conn_info *cp = data; 7355 struct mgmt_rp_get_conn_info rp; 7356 struct hci_conn *conn; 7357 unsigned long conn_info_age; 7358 int err = 0; 7359 7360 bt_dev_dbg(hdev, "sock %p", sk); 7361 7362 memset(&rp, 0, sizeof(rp)); 7363 bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr); 7364 rp.addr.type = cp->addr.type; 7365 7366 if (!bdaddr_type_is_valid(cp->addr.type)) 7367 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO, 7368 MGMT_STATUS_INVALID_PARAMS, 7369 &rp, sizeof(rp)); 7370 7371 hci_dev_lock(hdev); 7372 7373 if (!hdev_is_powered(hdev)) { 7374 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO, 7375 MGMT_STATUS_NOT_POWERED, &rp, 7376 sizeof(rp)); 7377 goto unlock; 7378 } 7379 7380 if (cp->addr.type == BDADDR_BREDR) 7381 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, 7382 &cp->addr.bdaddr); 7383 else 7384 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &cp->addr.bdaddr); 7385 7386 if (!conn || conn->state != BT_CONNECTED) { 7387 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO, 7388 MGMT_STATUS_NOT_CONNECTED, &rp, 7389 sizeof(rp)); 7390 goto unlock; 7391 } 7392 7393 /* To avoid client trying to guess when to poll again for information we 7394 * calculate conn info age as random value between min/max set in hdev. 7395 */ 7396 conn_info_age = get_random_u32_inclusive(hdev->conn_info_min_age, 7397 hdev->conn_info_max_age - 1); 7398 7399 /* Query controller to refresh cached values if they are too old or were 7400 * never read. 7401 */ 7402 if (time_after(jiffies, conn->conn_info_timestamp + 7403 msecs_to_jiffies(conn_info_age)) || 7404 !conn->conn_info_timestamp) { 7405 struct mgmt_pending_cmd *cmd; 7406 7407 cmd = mgmt_pending_new(sk, MGMT_OP_GET_CONN_INFO, hdev, data, 7408 len); 7409 if (!cmd) { 7410 err = -ENOMEM; 7411 } else { 7412 err = hci_cmd_sync_queue(hdev, get_conn_info_sync, 7413 cmd, get_conn_info_complete); 7414 } 7415 7416 if (err < 0) { 7417 mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO, 7418 MGMT_STATUS_FAILED, &rp, sizeof(rp)); 7419 7420 if (cmd) 7421 mgmt_pending_free(cmd); 7422 7423 goto unlock; 7424 } 7425 7426 conn->conn_info_timestamp = jiffies; 7427 } else { 7428 /* Cache is valid, just reply with values cached in hci_conn */ 7429 rp.rssi = conn->rssi; 7430 rp.tx_power = conn->tx_power; 7431 rp.max_tx_power = conn->max_tx_power; 7432 7433 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO, 7434 MGMT_STATUS_SUCCESS, &rp, sizeof(rp)); 7435 } 7436 7437 unlock: 7438 hci_dev_unlock(hdev); 7439 return err; 7440 } 7441 7442 static void get_clock_info_complete(struct hci_dev *hdev, void *data, int err) 7443 { 7444 struct mgmt_pending_cmd *cmd = data; 7445 struct mgmt_cp_get_clock_info *cp = cmd->param; 7446 struct mgmt_rp_get_clock_info rp; 7447 struct hci_conn *conn = cmd->user_data; 7448 u8 status = mgmt_status(err); 7449 7450 bt_dev_dbg(hdev, "err %d", err); 7451 7452 memset(&rp, 0, sizeof(rp)); 7453 bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr); 7454 rp.addr.type = cp->addr.type; 7455 7456 if (err) 7457 goto complete; 7458 7459 rp.local_clock = cpu_to_le32(hdev->clock); 7460 7461 if (conn) { 7462 rp.piconet_clock = cpu_to_le32(conn->clock); 7463 rp.accuracy = cpu_to_le16(conn->clock_accuracy); 7464 } 7465 7466 complete: 7467 mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, status, &rp, 7468 sizeof(rp)); 7469 7470 mgmt_pending_free(cmd); 7471 } 7472 7473 static int get_clock_info_sync(struct hci_dev *hdev, void *data) 7474 { 7475 struct mgmt_pending_cmd *cmd = data; 7476 struct mgmt_cp_get_clock_info *cp = cmd->param; 7477 struct hci_cp_read_clock hci_cp; 7478 struct hci_conn *conn; 7479 7480 memset(&hci_cp, 0, sizeof(hci_cp)); 7481 hci_read_clock_sync(hdev, &hci_cp); 7482 7483 /* Make sure connection still exists */ 7484 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->addr.bdaddr); 7485 if (!conn || conn->state != BT_CONNECTED) 7486 return MGMT_STATUS_NOT_CONNECTED; 7487 7488 cmd->user_data = conn; 7489 hci_cp.handle = cpu_to_le16(conn->handle); 7490 hci_cp.which = 0x01; /* Piconet clock */ 7491 7492 return hci_read_clock_sync(hdev, &hci_cp); 7493 } 7494 7495 static int get_clock_info(struct sock *sk, struct hci_dev *hdev, void *data, 7496 u16 len) 7497 { 7498 struct mgmt_cp_get_clock_info *cp = data; 7499 struct mgmt_rp_get_clock_info rp; 7500 struct mgmt_pending_cmd *cmd; 7501 struct hci_conn *conn; 7502 int err; 7503 7504 bt_dev_dbg(hdev, "sock %p", sk); 7505 7506 memset(&rp, 0, sizeof(rp)); 7507 bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr); 7508 rp.addr.type = cp->addr.type; 7509 7510 if (cp->addr.type != BDADDR_BREDR) 7511 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CLOCK_INFO, 7512 MGMT_STATUS_INVALID_PARAMS, 7513 &rp, sizeof(rp)); 7514 7515 hci_dev_lock(hdev); 7516 7517 if (!hdev_is_powered(hdev)) { 7518 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CLOCK_INFO, 7519 MGMT_STATUS_NOT_POWERED, &rp, 7520 sizeof(rp)); 7521 goto unlock; 7522 } 7523 7524 if (bacmp(&cp->addr.bdaddr, BDADDR_ANY)) { 7525 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, 7526 &cp->addr.bdaddr); 7527 if (!conn || conn->state != BT_CONNECTED) { 7528 err = mgmt_cmd_complete(sk, hdev->id, 7529 MGMT_OP_GET_CLOCK_INFO, 7530 MGMT_STATUS_NOT_CONNECTED, 7531 &rp, sizeof(rp)); 7532 goto unlock; 7533 } 7534 } else { 7535 conn = NULL; 7536 } 7537 7538 cmd = mgmt_pending_new(sk, MGMT_OP_GET_CLOCK_INFO, hdev, data, len); 7539 if (!cmd) 7540 err = -ENOMEM; 7541 else 7542 err = hci_cmd_sync_queue(hdev, get_clock_info_sync, cmd, 7543 get_clock_info_complete); 7544 7545 if (err < 0) { 7546 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CLOCK_INFO, 7547 MGMT_STATUS_FAILED, &rp, sizeof(rp)); 7548 7549 if (cmd) 7550 mgmt_pending_free(cmd); 7551 } 7552 7553 7554 unlock: 7555 hci_dev_unlock(hdev); 7556 return err; 7557 } 7558 7559 static bool is_connected(struct hci_dev *hdev, bdaddr_t *addr, u8 type) 7560 { 7561 struct hci_conn *conn; 7562 7563 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, addr); 7564 if (!conn) 7565 return false; 7566 7567 if (conn->dst_type != type) 7568 return false; 7569 7570 if (conn->state != BT_CONNECTED) 7571 return false; 7572 7573 return true; 7574 } 7575 7576 /* This function requires the caller holds hdev->lock */ 7577 static int hci_conn_params_set(struct hci_dev *hdev, bdaddr_t *addr, 7578 u8 addr_type, u8 auto_connect) 7579 { 7580 struct hci_conn_params *params; 7581 7582 params = hci_conn_params_add(hdev, addr, addr_type); 7583 if (!params) 7584 return -EIO; 7585 7586 if (params->auto_connect == auto_connect) 7587 return 0; 7588 7589 hci_pend_le_list_del_init(params); 7590 7591 switch (auto_connect) { 7592 case HCI_AUTO_CONN_DISABLED: 7593 case HCI_AUTO_CONN_LINK_LOSS: 7594 /* If auto connect is being disabled when we're trying to 7595 * connect to device, keep connecting. 7596 */ 7597 if (params->explicit_connect) 7598 hci_pend_le_list_add(params, &hdev->pend_le_conns); 7599 break; 7600 case HCI_AUTO_CONN_REPORT: 7601 if (params->explicit_connect) 7602 hci_pend_le_list_add(params, &hdev->pend_le_conns); 7603 else 7604 hci_pend_le_list_add(params, &hdev->pend_le_reports); 7605 break; 7606 case HCI_AUTO_CONN_DIRECT: 7607 case HCI_AUTO_CONN_ALWAYS: 7608 if (!is_connected(hdev, addr, addr_type)) 7609 hci_pend_le_list_add(params, &hdev->pend_le_conns); 7610 break; 7611 } 7612 7613 params->auto_connect = auto_connect; 7614 7615 bt_dev_dbg(hdev, "addr %pMR (type %u) auto_connect %u", 7616 addr, addr_type, auto_connect); 7617 7618 return 0; 7619 } 7620 7621 static void device_added(struct sock *sk, struct hci_dev *hdev, 7622 bdaddr_t *bdaddr, u8 type, u8 action) 7623 { 7624 struct mgmt_ev_device_added ev; 7625 7626 bacpy(&ev.addr.bdaddr, bdaddr); 7627 ev.addr.type = type; 7628 ev.action = action; 7629 7630 mgmt_event(MGMT_EV_DEVICE_ADDED, hdev, &ev, sizeof(ev), sk); 7631 } 7632 7633 static int add_device_sync(struct hci_dev *hdev, void *data) 7634 { 7635 return hci_update_passive_scan_sync(hdev); 7636 } 7637 7638 static int add_device(struct sock *sk, struct hci_dev *hdev, 7639 void *data, u16 len) 7640 { 7641 struct mgmt_cp_add_device *cp = data; 7642 u8 auto_conn, addr_type; 7643 struct hci_conn_params *params; 7644 int err; 7645 u32 current_flags = 0; 7646 u32 supported_flags; 7647 7648 bt_dev_dbg(hdev, "sock %p", sk); 7649 7650 if (!bdaddr_type_is_valid(cp->addr.type) || 7651 !bacmp(&cp->addr.bdaddr, BDADDR_ANY)) 7652 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE, 7653 MGMT_STATUS_INVALID_PARAMS, 7654 &cp->addr, sizeof(cp->addr)); 7655 7656 if (cp->action != 0x00 && cp->action != 0x01 && cp->action != 0x02) 7657 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE, 7658 MGMT_STATUS_INVALID_PARAMS, 7659 &cp->addr, sizeof(cp->addr)); 7660 7661 hci_dev_lock(hdev); 7662 7663 if (cp->addr.type == BDADDR_BREDR) { 7664 /* Only incoming connections action is supported for now */ 7665 if (cp->action != 0x01) { 7666 err = mgmt_cmd_complete(sk, hdev->id, 7667 MGMT_OP_ADD_DEVICE, 7668 MGMT_STATUS_INVALID_PARAMS, 7669 &cp->addr, sizeof(cp->addr)); 7670 goto unlock; 7671 } 7672 7673 err = hci_bdaddr_list_add_with_flags(&hdev->accept_list, 7674 &cp->addr.bdaddr, 7675 cp->addr.type, 0); 7676 if (err) 7677 goto unlock; 7678 7679 hci_update_scan(hdev); 7680 7681 goto added; 7682 } 7683 7684 addr_type = le_addr_type(cp->addr.type); 7685 7686 if (cp->action == 0x02) 7687 auto_conn = HCI_AUTO_CONN_ALWAYS; 7688 else if (cp->action == 0x01) 7689 auto_conn = HCI_AUTO_CONN_DIRECT; 7690 else 7691 auto_conn = HCI_AUTO_CONN_REPORT; 7692 7693 /* Kernel internally uses conn_params with resolvable private 7694 * address, but Add Device allows only identity addresses. 7695 * Make sure it is enforced before calling 7696 * hci_conn_params_lookup. 7697 */ 7698 if (!hci_is_identity_address(&cp->addr.bdaddr, addr_type)) { 7699 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE, 7700 MGMT_STATUS_INVALID_PARAMS, 7701 &cp->addr, sizeof(cp->addr)); 7702 goto unlock; 7703 } 7704 7705 /* If the connection parameters don't exist for this device, 7706 * they will be created and configured with defaults. 7707 */ 7708 if (hci_conn_params_set(hdev, &cp->addr.bdaddr, addr_type, 7709 auto_conn) < 0) { 7710 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE, 7711 MGMT_STATUS_FAILED, &cp->addr, 7712 sizeof(cp->addr)); 7713 goto unlock; 7714 } else { 7715 params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr, 7716 addr_type); 7717 if (params) 7718 current_flags = params->flags; 7719 } 7720 7721 err = hci_cmd_sync_queue(hdev, add_device_sync, NULL, NULL); 7722 if (err < 0) 7723 goto unlock; 7724 7725 added: 7726 device_added(sk, hdev, &cp->addr.bdaddr, cp->addr.type, cp->action); 7727 supported_flags = hdev->conn_flags; 7728 device_flags_changed(NULL, hdev, &cp->addr.bdaddr, cp->addr.type, 7729 supported_flags, current_flags); 7730 7731 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE, 7732 MGMT_STATUS_SUCCESS, &cp->addr, 7733 sizeof(cp->addr)); 7734 7735 unlock: 7736 hci_dev_unlock(hdev); 7737 return err; 7738 } 7739 7740 static void device_removed(struct sock *sk, struct hci_dev *hdev, 7741 bdaddr_t *bdaddr, u8 type) 7742 { 7743 struct mgmt_ev_device_removed ev; 7744 7745 bacpy(&ev.addr.bdaddr, bdaddr); 7746 ev.addr.type = type; 7747 7748 mgmt_event(MGMT_EV_DEVICE_REMOVED, hdev, &ev, sizeof(ev), sk); 7749 } 7750 7751 static int remove_device_sync(struct hci_dev *hdev, void *data) 7752 { 7753 return hci_update_passive_scan_sync(hdev); 7754 } 7755 7756 static int remove_device(struct sock *sk, struct hci_dev *hdev, 7757 void *data, u16 len) 7758 { 7759 struct mgmt_cp_remove_device *cp = data; 7760 int err; 7761 7762 bt_dev_dbg(hdev, "sock %p", sk); 7763 7764 hci_dev_lock(hdev); 7765 7766 if (bacmp(&cp->addr.bdaddr, BDADDR_ANY)) { 7767 struct hci_conn_params *params; 7768 u8 addr_type; 7769 7770 if (!bdaddr_type_is_valid(cp->addr.type)) { 7771 err = mgmt_cmd_complete(sk, hdev->id, 7772 MGMT_OP_REMOVE_DEVICE, 7773 MGMT_STATUS_INVALID_PARAMS, 7774 &cp->addr, sizeof(cp->addr)); 7775 goto unlock; 7776 } 7777 7778 if (cp->addr.type == BDADDR_BREDR) { 7779 err = hci_bdaddr_list_del(&hdev->accept_list, 7780 &cp->addr.bdaddr, 7781 cp->addr.type); 7782 if (err) { 7783 err = mgmt_cmd_complete(sk, hdev->id, 7784 MGMT_OP_REMOVE_DEVICE, 7785 MGMT_STATUS_INVALID_PARAMS, 7786 &cp->addr, 7787 sizeof(cp->addr)); 7788 goto unlock; 7789 } 7790 7791 hci_update_scan(hdev); 7792 7793 device_removed(sk, hdev, &cp->addr.bdaddr, 7794 cp->addr.type); 7795 goto complete; 7796 } 7797 7798 addr_type = le_addr_type(cp->addr.type); 7799 7800 /* Kernel internally uses conn_params with resolvable private 7801 * address, but Remove Device allows only identity addresses. 7802 * Make sure it is enforced before calling 7803 * hci_conn_params_lookup. 7804 */ 7805 if (!hci_is_identity_address(&cp->addr.bdaddr, addr_type)) { 7806 err = mgmt_cmd_complete(sk, hdev->id, 7807 MGMT_OP_REMOVE_DEVICE, 7808 MGMT_STATUS_INVALID_PARAMS, 7809 &cp->addr, sizeof(cp->addr)); 7810 goto unlock; 7811 } 7812 7813 params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr, 7814 addr_type); 7815 if (!params) { 7816 err = mgmt_cmd_complete(sk, hdev->id, 7817 MGMT_OP_REMOVE_DEVICE, 7818 MGMT_STATUS_INVALID_PARAMS, 7819 &cp->addr, sizeof(cp->addr)); 7820 goto unlock; 7821 } 7822 7823 if (params->auto_connect == HCI_AUTO_CONN_DISABLED || 7824 params->auto_connect == HCI_AUTO_CONN_EXPLICIT) { 7825 err = mgmt_cmd_complete(sk, hdev->id, 7826 MGMT_OP_REMOVE_DEVICE, 7827 MGMT_STATUS_INVALID_PARAMS, 7828 &cp->addr, sizeof(cp->addr)); 7829 goto unlock; 7830 } 7831 7832 hci_conn_params_free(params); 7833 7834 device_removed(sk, hdev, &cp->addr.bdaddr, cp->addr.type); 7835 } else { 7836 struct hci_conn_params *p, *tmp; 7837 struct bdaddr_list *b, *btmp; 7838 7839 if (cp->addr.type) { 7840 err = mgmt_cmd_complete(sk, hdev->id, 7841 MGMT_OP_REMOVE_DEVICE, 7842 MGMT_STATUS_INVALID_PARAMS, 7843 &cp->addr, sizeof(cp->addr)); 7844 goto unlock; 7845 } 7846 7847 list_for_each_entry_safe(b, btmp, &hdev->accept_list, list) { 7848 device_removed(sk, hdev, &b->bdaddr, b->bdaddr_type); 7849 list_del(&b->list); 7850 kfree(b); 7851 } 7852 7853 hci_update_scan(hdev); 7854 7855 list_for_each_entry_safe(p, tmp, &hdev->le_conn_params, list) { 7856 if (p->auto_connect == HCI_AUTO_CONN_DISABLED) 7857 continue; 7858 device_removed(sk, hdev, &p->addr, p->addr_type); 7859 if (p->explicit_connect) { 7860 p->auto_connect = HCI_AUTO_CONN_EXPLICIT; 7861 continue; 7862 } 7863 hci_conn_params_free(p); 7864 } 7865 7866 bt_dev_dbg(hdev, "All LE connection parameters were removed"); 7867 } 7868 7869 hci_cmd_sync_queue(hdev, remove_device_sync, NULL, NULL); 7870 7871 complete: 7872 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_DEVICE, 7873 MGMT_STATUS_SUCCESS, &cp->addr, 7874 sizeof(cp->addr)); 7875 unlock: 7876 hci_dev_unlock(hdev); 7877 return err; 7878 } 7879 7880 static int load_conn_param(struct sock *sk, struct hci_dev *hdev, void *data, 7881 u16 len) 7882 { 7883 struct mgmt_cp_load_conn_param *cp = data; 7884 const u16 max_param_count = ((U16_MAX - sizeof(*cp)) / 7885 sizeof(struct mgmt_conn_param)); 7886 u16 param_count, expected_len; 7887 int i; 7888 7889 if (!lmp_le_capable(hdev)) 7890 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM, 7891 MGMT_STATUS_NOT_SUPPORTED); 7892 7893 param_count = __le16_to_cpu(cp->param_count); 7894 if (param_count > max_param_count) { 7895 bt_dev_err(hdev, "load_conn_param: too big param_count value %u", 7896 param_count); 7897 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM, 7898 MGMT_STATUS_INVALID_PARAMS); 7899 } 7900 7901 expected_len = struct_size(cp, params, param_count); 7902 if (expected_len != len) { 7903 bt_dev_err(hdev, "load_conn_param: expected %u bytes, got %u bytes", 7904 expected_len, len); 7905 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM, 7906 MGMT_STATUS_INVALID_PARAMS); 7907 } 7908 7909 bt_dev_dbg(hdev, "param_count %u", param_count); 7910 7911 hci_dev_lock(hdev); 7912 7913 hci_conn_params_clear_disabled(hdev); 7914 7915 for (i = 0; i < param_count; i++) { 7916 struct mgmt_conn_param *param = &cp->params[i]; 7917 struct hci_conn_params *hci_param; 7918 u16 min, max, latency, timeout; 7919 u8 addr_type; 7920 7921 bt_dev_dbg(hdev, "Adding %pMR (type %u)", ¶m->addr.bdaddr, 7922 param->addr.type); 7923 7924 if (param->addr.type == BDADDR_LE_PUBLIC) { 7925 addr_type = ADDR_LE_DEV_PUBLIC; 7926 } else if (param->addr.type == BDADDR_LE_RANDOM) { 7927 addr_type = ADDR_LE_DEV_RANDOM; 7928 } else { 7929 bt_dev_err(hdev, "ignoring invalid connection parameters"); 7930 continue; 7931 } 7932 7933 min = le16_to_cpu(param->min_interval); 7934 max = le16_to_cpu(param->max_interval); 7935 latency = le16_to_cpu(param->latency); 7936 timeout = le16_to_cpu(param->timeout); 7937 7938 bt_dev_dbg(hdev, "min 0x%04x max 0x%04x latency 0x%04x timeout 0x%04x", 7939 min, max, latency, timeout); 7940 7941 if (hci_check_conn_params(min, max, latency, timeout) < 0) { 7942 bt_dev_err(hdev, "ignoring invalid connection parameters"); 7943 continue; 7944 } 7945 7946 hci_param = hci_conn_params_add(hdev, ¶m->addr.bdaddr, 7947 addr_type); 7948 if (!hci_param) { 7949 bt_dev_err(hdev, "failed to add connection parameters"); 7950 continue; 7951 } 7952 7953 hci_param->conn_min_interval = min; 7954 hci_param->conn_max_interval = max; 7955 hci_param->conn_latency = latency; 7956 hci_param->supervision_timeout = timeout; 7957 } 7958 7959 hci_dev_unlock(hdev); 7960 7961 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM, 0, 7962 NULL, 0); 7963 } 7964 7965 static int set_external_config(struct sock *sk, struct hci_dev *hdev, 7966 void *data, u16 len) 7967 { 7968 struct mgmt_cp_set_external_config *cp = data; 7969 bool changed; 7970 int err; 7971 7972 bt_dev_dbg(hdev, "sock %p", sk); 7973 7974 if (hdev_is_powered(hdev)) 7975 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_EXTERNAL_CONFIG, 7976 MGMT_STATUS_REJECTED); 7977 7978 if (cp->config != 0x00 && cp->config != 0x01) 7979 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_EXTERNAL_CONFIG, 7980 MGMT_STATUS_INVALID_PARAMS); 7981 7982 if (!test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks)) 7983 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_EXTERNAL_CONFIG, 7984 MGMT_STATUS_NOT_SUPPORTED); 7985 7986 hci_dev_lock(hdev); 7987 7988 if (cp->config) 7989 changed = !hci_dev_test_and_set_flag(hdev, HCI_EXT_CONFIGURED); 7990 else 7991 changed = hci_dev_test_and_clear_flag(hdev, HCI_EXT_CONFIGURED); 7992 7993 err = send_options_rsp(sk, MGMT_OP_SET_EXTERNAL_CONFIG, hdev); 7994 if (err < 0) 7995 goto unlock; 7996 7997 if (!changed) 7998 goto unlock; 7999 8000 err = new_options(hdev, sk); 8001 8002 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED) == is_configured(hdev)) { 8003 mgmt_index_removed(hdev); 8004 8005 if (hci_dev_test_and_change_flag(hdev, HCI_UNCONFIGURED)) { 8006 hci_dev_set_flag(hdev, HCI_CONFIG); 8007 hci_dev_set_flag(hdev, HCI_AUTO_OFF); 8008 8009 queue_work(hdev->req_workqueue, &hdev->power_on); 8010 } else { 8011 set_bit(HCI_RAW, &hdev->flags); 8012 mgmt_index_added(hdev); 8013 } 8014 } 8015 8016 unlock: 8017 hci_dev_unlock(hdev); 8018 return err; 8019 } 8020 8021 static int set_public_address(struct sock *sk, struct hci_dev *hdev, 8022 void *data, u16 len) 8023 { 8024 struct mgmt_cp_set_public_address *cp = data; 8025 bool changed; 8026 int err; 8027 8028 bt_dev_dbg(hdev, "sock %p", sk); 8029 8030 if (hdev_is_powered(hdev)) 8031 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PUBLIC_ADDRESS, 8032 MGMT_STATUS_REJECTED); 8033 8034 if (!bacmp(&cp->bdaddr, BDADDR_ANY)) 8035 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PUBLIC_ADDRESS, 8036 MGMT_STATUS_INVALID_PARAMS); 8037 8038 if (!hdev->set_bdaddr) 8039 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PUBLIC_ADDRESS, 8040 MGMT_STATUS_NOT_SUPPORTED); 8041 8042 hci_dev_lock(hdev); 8043 8044 changed = !!bacmp(&hdev->public_addr, &cp->bdaddr); 8045 bacpy(&hdev->public_addr, &cp->bdaddr); 8046 8047 err = send_options_rsp(sk, MGMT_OP_SET_PUBLIC_ADDRESS, hdev); 8048 if (err < 0) 8049 goto unlock; 8050 8051 if (!changed) 8052 goto unlock; 8053 8054 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) 8055 err = new_options(hdev, sk); 8056 8057 if (is_configured(hdev)) { 8058 mgmt_index_removed(hdev); 8059 8060 hci_dev_clear_flag(hdev, HCI_UNCONFIGURED); 8061 8062 hci_dev_set_flag(hdev, HCI_CONFIG); 8063 hci_dev_set_flag(hdev, HCI_AUTO_OFF); 8064 8065 queue_work(hdev->req_workqueue, &hdev->power_on); 8066 } 8067 8068 unlock: 8069 hci_dev_unlock(hdev); 8070 return err; 8071 } 8072 8073 static void read_local_oob_ext_data_complete(struct hci_dev *hdev, void *data, 8074 int err) 8075 { 8076 const struct mgmt_cp_read_local_oob_ext_data *mgmt_cp; 8077 struct mgmt_rp_read_local_oob_ext_data *mgmt_rp; 8078 u8 *h192, *r192, *h256, *r256; 8079 struct mgmt_pending_cmd *cmd = data; 8080 struct sk_buff *skb = cmd->skb; 8081 u8 status = mgmt_status(err); 8082 u16 eir_len; 8083 8084 if (cmd != pending_find(MGMT_OP_READ_LOCAL_OOB_EXT_DATA, hdev)) 8085 return; 8086 8087 if (!status) { 8088 if (!skb) 8089 status = MGMT_STATUS_FAILED; 8090 else if (IS_ERR(skb)) 8091 status = mgmt_status(PTR_ERR(skb)); 8092 else 8093 status = mgmt_status(skb->data[0]); 8094 } 8095 8096 bt_dev_dbg(hdev, "status %u", status); 8097 8098 mgmt_cp = cmd->param; 8099 8100 if (status) { 8101 status = mgmt_status(status); 8102 eir_len = 0; 8103 8104 h192 = NULL; 8105 r192 = NULL; 8106 h256 = NULL; 8107 r256 = NULL; 8108 } else if (!bredr_sc_enabled(hdev)) { 8109 struct hci_rp_read_local_oob_data *rp; 8110 8111 if (skb->len != sizeof(*rp)) { 8112 status = MGMT_STATUS_FAILED; 8113 eir_len = 0; 8114 } else { 8115 status = MGMT_STATUS_SUCCESS; 8116 rp = (void *)skb->data; 8117 8118 eir_len = 5 + 18 + 18; 8119 h192 = rp->hash; 8120 r192 = rp->rand; 8121 h256 = NULL; 8122 r256 = NULL; 8123 } 8124 } else { 8125 struct hci_rp_read_local_oob_ext_data *rp; 8126 8127 if (skb->len != sizeof(*rp)) { 8128 status = MGMT_STATUS_FAILED; 8129 eir_len = 0; 8130 } else { 8131 status = MGMT_STATUS_SUCCESS; 8132 rp = (void *)skb->data; 8133 8134 if (hci_dev_test_flag(hdev, HCI_SC_ONLY)) { 8135 eir_len = 5 + 18 + 18; 8136 h192 = NULL; 8137 r192 = NULL; 8138 } else { 8139 eir_len = 5 + 18 + 18 + 18 + 18; 8140 h192 = rp->hash192; 8141 r192 = rp->rand192; 8142 } 8143 8144 h256 = rp->hash256; 8145 r256 = rp->rand256; 8146 } 8147 } 8148 8149 mgmt_rp = kmalloc(sizeof(*mgmt_rp) + eir_len, GFP_KERNEL); 8150 if (!mgmt_rp) 8151 goto done; 8152 8153 if (eir_len == 0) 8154 goto send_rsp; 8155 8156 eir_len = eir_append_data(mgmt_rp->eir, 0, EIR_CLASS_OF_DEV, 8157 hdev->dev_class, 3); 8158 8159 if (h192 && r192) { 8160 eir_len = eir_append_data(mgmt_rp->eir, eir_len, 8161 EIR_SSP_HASH_C192, h192, 16); 8162 eir_len = eir_append_data(mgmt_rp->eir, eir_len, 8163 EIR_SSP_RAND_R192, r192, 16); 8164 } 8165 8166 if (h256 && r256) { 8167 eir_len = eir_append_data(mgmt_rp->eir, eir_len, 8168 EIR_SSP_HASH_C256, h256, 16); 8169 eir_len = eir_append_data(mgmt_rp->eir, eir_len, 8170 EIR_SSP_RAND_R256, r256, 16); 8171 } 8172 8173 send_rsp: 8174 mgmt_rp->type = mgmt_cp->type; 8175 mgmt_rp->eir_len = cpu_to_le16(eir_len); 8176 8177 err = mgmt_cmd_complete(cmd->sk, hdev->id, 8178 MGMT_OP_READ_LOCAL_OOB_EXT_DATA, status, 8179 mgmt_rp, sizeof(*mgmt_rp) + eir_len); 8180 if (err < 0 || status) 8181 goto done; 8182 8183 hci_sock_set_flag(cmd->sk, HCI_MGMT_OOB_DATA_EVENTS); 8184 8185 err = mgmt_limited_event(MGMT_EV_LOCAL_OOB_DATA_UPDATED, hdev, 8186 mgmt_rp, sizeof(*mgmt_rp) + eir_len, 8187 HCI_MGMT_OOB_DATA_EVENTS, cmd->sk); 8188 done: 8189 if (skb && !IS_ERR(skb)) 8190 kfree_skb(skb); 8191 8192 kfree(mgmt_rp); 8193 mgmt_pending_remove(cmd); 8194 } 8195 8196 static int read_local_ssp_oob_req(struct hci_dev *hdev, struct sock *sk, 8197 struct mgmt_cp_read_local_oob_ext_data *cp) 8198 { 8199 struct mgmt_pending_cmd *cmd; 8200 int err; 8201 8202 cmd = mgmt_pending_add(sk, MGMT_OP_READ_LOCAL_OOB_EXT_DATA, hdev, 8203 cp, sizeof(*cp)); 8204 if (!cmd) 8205 return -ENOMEM; 8206 8207 err = hci_cmd_sync_queue(hdev, read_local_oob_data_sync, cmd, 8208 read_local_oob_ext_data_complete); 8209 8210 if (err < 0) { 8211 mgmt_pending_remove(cmd); 8212 return err; 8213 } 8214 8215 return 0; 8216 } 8217 8218 static int read_local_oob_ext_data(struct sock *sk, struct hci_dev *hdev, 8219 void *data, u16 data_len) 8220 { 8221 struct mgmt_cp_read_local_oob_ext_data *cp = data; 8222 struct mgmt_rp_read_local_oob_ext_data *rp; 8223 size_t rp_len; 8224 u16 eir_len; 8225 u8 status, flags, role, addr[7], hash[16], rand[16]; 8226 int err; 8227 8228 bt_dev_dbg(hdev, "sock %p", sk); 8229 8230 if (hdev_is_powered(hdev)) { 8231 switch (cp->type) { 8232 case BIT(BDADDR_BREDR): 8233 status = mgmt_bredr_support(hdev); 8234 if (status) 8235 eir_len = 0; 8236 else 8237 eir_len = 5; 8238 break; 8239 case (BIT(BDADDR_LE_PUBLIC) | BIT(BDADDR_LE_RANDOM)): 8240 status = mgmt_le_support(hdev); 8241 if (status) 8242 eir_len = 0; 8243 else 8244 eir_len = 9 + 3 + 18 + 18 + 3; 8245 break; 8246 default: 8247 status = MGMT_STATUS_INVALID_PARAMS; 8248 eir_len = 0; 8249 break; 8250 } 8251 } else { 8252 status = MGMT_STATUS_NOT_POWERED; 8253 eir_len = 0; 8254 } 8255 8256 rp_len = sizeof(*rp) + eir_len; 8257 rp = kmalloc(rp_len, GFP_ATOMIC); 8258 if (!rp) 8259 return -ENOMEM; 8260 8261 if (!status && !lmp_ssp_capable(hdev)) { 8262 status = MGMT_STATUS_NOT_SUPPORTED; 8263 eir_len = 0; 8264 } 8265 8266 if (status) 8267 goto complete; 8268 8269 hci_dev_lock(hdev); 8270 8271 eir_len = 0; 8272 switch (cp->type) { 8273 case BIT(BDADDR_BREDR): 8274 if (hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) { 8275 err = read_local_ssp_oob_req(hdev, sk, cp); 8276 hci_dev_unlock(hdev); 8277 if (!err) 8278 goto done; 8279 8280 status = MGMT_STATUS_FAILED; 8281 goto complete; 8282 } else { 8283 eir_len = eir_append_data(rp->eir, eir_len, 8284 EIR_CLASS_OF_DEV, 8285 hdev->dev_class, 3); 8286 } 8287 break; 8288 case (BIT(BDADDR_LE_PUBLIC) | BIT(BDADDR_LE_RANDOM)): 8289 if (hci_dev_test_flag(hdev, HCI_SC_ENABLED) && 8290 smp_generate_oob(hdev, hash, rand) < 0) { 8291 hci_dev_unlock(hdev); 8292 status = MGMT_STATUS_FAILED; 8293 goto complete; 8294 } 8295 8296 /* This should return the active RPA, but since the RPA 8297 * is only programmed on demand, it is really hard to fill 8298 * this in at the moment. For now disallow retrieving 8299 * local out-of-band data when privacy is in use. 8300 * 8301 * Returning the identity address will not help here since 8302 * pairing happens before the identity resolving key is 8303 * known and thus the connection establishment happens 8304 * based on the RPA and not the identity address. 8305 */ 8306 if (hci_dev_test_flag(hdev, HCI_PRIVACY)) { 8307 hci_dev_unlock(hdev); 8308 status = MGMT_STATUS_REJECTED; 8309 goto complete; 8310 } 8311 8312 if (hci_dev_test_flag(hdev, HCI_FORCE_STATIC_ADDR) || 8313 !bacmp(&hdev->bdaddr, BDADDR_ANY) || 8314 (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) && 8315 bacmp(&hdev->static_addr, BDADDR_ANY))) { 8316 memcpy(addr, &hdev->static_addr, 6); 8317 addr[6] = 0x01; 8318 } else { 8319 memcpy(addr, &hdev->bdaddr, 6); 8320 addr[6] = 0x00; 8321 } 8322 8323 eir_len = eir_append_data(rp->eir, eir_len, EIR_LE_BDADDR, 8324 addr, sizeof(addr)); 8325 8326 if (hci_dev_test_flag(hdev, HCI_ADVERTISING)) 8327 role = 0x02; 8328 else 8329 role = 0x01; 8330 8331 eir_len = eir_append_data(rp->eir, eir_len, EIR_LE_ROLE, 8332 &role, sizeof(role)); 8333 8334 if (hci_dev_test_flag(hdev, HCI_SC_ENABLED)) { 8335 eir_len = eir_append_data(rp->eir, eir_len, 8336 EIR_LE_SC_CONFIRM, 8337 hash, sizeof(hash)); 8338 8339 eir_len = eir_append_data(rp->eir, eir_len, 8340 EIR_LE_SC_RANDOM, 8341 rand, sizeof(rand)); 8342 } 8343 8344 flags = mgmt_get_adv_discov_flags(hdev); 8345 8346 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) 8347 flags |= LE_AD_NO_BREDR; 8348 8349 eir_len = eir_append_data(rp->eir, eir_len, EIR_FLAGS, 8350 &flags, sizeof(flags)); 8351 break; 8352 } 8353 8354 hci_dev_unlock(hdev); 8355 8356 hci_sock_set_flag(sk, HCI_MGMT_OOB_DATA_EVENTS); 8357 8358 status = MGMT_STATUS_SUCCESS; 8359 8360 complete: 8361 rp->type = cp->type; 8362 rp->eir_len = cpu_to_le16(eir_len); 8363 8364 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_EXT_DATA, 8365 status, rp, sizeof(*rp) + eir_len); 8366 if (err < 0 || status) 8367 goto done; 8368 8369 err = mgmt_limited_event(MGMT_EV_LOCAL_OOB_DATA_UPDATED, hdev, 8370 rp, sizeof(*rp) + eir_len, 8371 HCI_MGMT_OOB_DATA_EVENTS, sk); 8372 8373 done: 8374 kfree(rp); 8375 8376 return err; 8377 } 8378 8379 static u32 get_supported_adv_flags(struct hci_dev *hdev) 8380 { 8381 u32 flags = 0; 8382 8383 flags |= MGMT_ADV_FLAG_CONNECTABLE; 8384 flags |= MGMT_ADV_FLAG_DISCOV; 8385 flags |= MGMT_ADV_FLAG_LIMITED_DISCOV; 8386 flags |= MGMT_ADV_FLAG_MANAGED_FLAGS; 8387 flags |= MGMT_ADV_FLAG_APPEARANCE; 8388 flags |= MGMT_ADV_FLAG_LOCAL_NAME; 8389 flags |= MGMT_ADV_PARAM_DURATION; 8390 flags |= MGMT_ADV_PARAM_TIMEOUT; 8391 flags |= MGMT_ADV_PARAM_INTERVALS; 8392 flags |= MGMT_ADV_PARAM_TX_POWER; 8393 flags |= MGMT_ADV_PARAM_SCAN_RSP; 8394 8395 /* In extended adv TX_POWER returned from Set Adv Param 8396 * will be always valid. 8397 */ 8398 if (hdev->adv_tx_power != HCI_TX_POWER_INVALID || ext_adv_capable(hdev)) 8399 flags |= MGMT_ADV_FLAG_TX_POWER; 8400 8401 if (ext_adv_capable(hdev)) { 8402 flags |= MGMT_ADV_FLAG_SEC_1M; 8403 flags |= MGMT_ADV_FLAG_HW_OFFLOAD; 8404 flags |= MGMT_ADV_FLAG_CAN_SET_TX_POWER; 8405 8406 if (le_2m_capable(hdev)) 8407 flags |= MGMT_ADV_FLAG_SEC_2M; 8408 8409 if (le_coded_capable(hdev)) 8410 flags |= MGMT_ADV_FLAG_SEC_CODED; 8411 } 8412 8413 return flags; 8414 } 8415 8416 static int read_adv_features(struct sock *sk, struct hci_dev *hdev, 8417 void *data, u16 data_len) 8418 { 8419 struct mgmt_rp_read_adv_features *rp; 8420 size_t rp_len; 8421 int err; 8422 struct adv_info *adv_instance; 8423 u32 supported_flags; 8424 u8 *instance; 8425 8426 bt_dev_dbg(hdev, "sock %p", sk); 8427 8428 if (!lmp_le_capable(hdev)) 8429 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_ADV_FEATURES, 8430 MGMT_STATUS_REJECTED); 8431 8432 hci_dev_lock(hdev); 8433 8434 rp_len = sizeof(*rp) + hdev->adv_instance_cnt; 8435 rp = kmalloc(rp_len, GFP_ATOMIC); 8436 if (!rp) { 8437 hci_dev_unlock(hdev); 8438 return -ENOMEM; 8439 } 8440 8441 supported_flags = get_supported_adv_flags(hdev); 8442 8443 rp->supported_flags = cpu_to_le32(supported_flags); 8444 rp->max_adv_data_len = max_adv_len(hdev); 8445 rp->max_scan_rsp_len = max_adv_len(hdev); 8446 rp->max_instances = hdev->le_num_of_adv_sets; 8447 rp->num_instances = hdev->adv_instance_cnt; 8448 8449 instance = rp->instance; 8450 list_for_each_entry(adv_instance, &hdev->adv_instances, list) { 8451 /* Only instances 1-le_num_of_adv_sets are externally visible */ 8452 if (adv_instance->instance <= hdev->adv_instance_cnt) { 8453 *instance = adv_instance->instance; 8454 instance++; 8455 } else { 8456 rp->num_instances--; 8457 rp_len--; 8458 } 8459 } 8460 8461 hci_dev_unlock(hdev); 8462 8463 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_ADV_FEATURES, 8464 MGMT_STATUS_SUCCESS, rp, rp_len); 8465 8466 kfree(rp); 8467 8468 return err; 8469 } 8470 8471 static u8 calculate_name_len(struct hci_dev *hdev) 8472 { 8473 u8 buf[HCI_MAX_SHORT_NAME_LENGTH + 3]; 8474 8475 return eir_append_local_name(hdev, buf, 0); 8476 } 8477 8478 static u8 tlv_data_max_len(struct hci_dev *hdev, u32 adv_flags, 8479 bool is_adv_data) 8480 { 8481 u8 max_len = max_adv_len(hdev); 8482 8483 if (is_adv_data) { 8484 if (adv_flags & (MGMT_ADV_FLAG_DISCOV | 8485 MGMT_ADV_FLAG_LIMITED_DISCOV | 8486 MGMT_ADV_FLAG_MANAGED_FLAGS)) 8487 max_len -= 3; 8488 8489 if (adv_flags & MGMT_ADV_FLAG_TX_POWER) 8490 max_len -= 3; 8491 } else { 8492 if (adv_flags & MGMT_ADV_FLAG_LOCAL_NAME) 8493 max_len -= calculate_name_len(hdev); 8494 8495 if (adv_flags & (MGMT_ADV_FLAG_APPEARANCE)) 8496 max_len -= 4; 8497 } 8498 8499 return max_len; 8500 } 8501 8502 static bool flags_managed(u32 adv_flags) 8503 { 8504 return adv_flags & (MGMT_ADV_FLAG_DISCOV | 8505 MGMT_ADV_FLAG_LIMITED_DISCOV | 8506 MGMT_ADV_FLAG_MANAGED_FLAGS); 8507 } 8508 8509 static bool tx_power_managed(u32 adv_flags) 8510 { 8511 return adv_flags & MGMT_ADV_FLAG_TX_POWER; 8512 } 8513 8514 static bool name_managed(u32 adv_flags) 8515 { 8516 return adv_flags & MGMT_ADV_FLAG_LOCAL_NAME; 8517 } 8518 8519 static bool appearance_managed(u32 adv_flags) 8520 { 8521 return adv_flags & MGMT_ADV_FLAG_APPEARANCE; 8522 } 8523 8524 static bool tlv_data_is_valid(struct hci_dev *hdev, u32 adv_flags, u8 *data, 8525 u8 len, bool is_adv_data) 8526 { 8527 int i, cur_len; 8528 u8 max_len; 8529 8530 max_len = tlv_data_max_len(hdev, adv_flags, is_adv_data); 8531 8532 if (len > max_len) 8533 return false; 8534 8535 /* Make sure that the data is correctly formatted. */ 8536 for (i = 0; i < len; i += (cur_len + 1)) { 8537 cur_len = data[i]; 8538 8539 if (!cur_len) 8540 continue; 8541 8542 if (data[i + 1] == EIR_FLAGS && 8543 (!is_adv_data || flags_managed(adv_flags))) 8544 return false; 8545 8546 if (data[i + 1] == EIR_TX_POWER && tx_power_managed(adv_flags)) 8547 return false; 8548 8549 if (data[i + 1] == EIR_NAME_COMPLETE && name_managed(adv_flags)) 8550 return false; 8551 8552 if (data[i + 1] == EIR_NAME_SHORT && name_managed(adv_flags)) 8553 return false; 8554 8555 if (data[i + 1] == EIR_APPEARANCE && 8556 appearance_managed(adv_flags)) 8557 return false; 8558 8559 /* If the current field length would exceed the total data 8560 * length, then it's invalid. 8561 */ 8562 if (i + cur_len >= len) 8563 return false; 8564 } 8565 8566 return true; 8567 } 8568 8569 static bool requested_adv_flags_are_valid(struct hci_dev *hdev, u32 adv_flags) 8570 { 8571 u32 supported_flags, phy_flags; 8572 8573 /* The current implementation only supports a subset of the specified 8574 * flags. Also need to check mutual exclusiveness of sec flags. 8575 */ 8576 supported_flags = get_supported_adv_flags(hdev); 8577 phy_flags = adv_flags & MGMT_ADV_FLAG_SEC_MASK; 8578 if (adv_flags & ~supported_flags || 8579 ((phy_flags && (phy_flags ^ (phy_flags & -phy_flags))))) 8580 return false; 8581 8582 return true; 8583 } 8584 8585 static bool adv_busy(struct hci_dev *hdev) 8586 { 8587 return pending_find(MGMT_OP_SET_LE, hdev); 8588 } 8589 8590 static void add_adv_complete(struct hci_dev *hdev, struct sock *sk, u8 instance, 8591 int err) 8592 { 8593 struct adv_info *adv, *n; 8594 8595 bt_dev_dbg(hdev, "err %d", err); 8596 8597 hci_dev_lock(hdev); 8598 8599 list_for_each_entry_safe(adv, n, &hdev->adv_instances, list) { 8600 u8 instance; 8601 8602 if (!adv->pending) 8603 continue; 8604 8605 if (!err) { 8606 adv->pending = false; 8607 continue; 8608 } 8609 8610 instance = adv->instance; 8611 8612 if (hdev->cur_adv_instance == instance) 8613 cancel_adv_timeout(hdev); 8614 8615 hci_remove_adv_instance(hdev, instance); 8616 mgmt_advertising_removed(sk, hdev, instance); 8617 } 8618 8619 hci_dev_unlock(hdev); 8620 } 8621 8622 static void add_advertising_complete(struct hci_dev *hdev, void *data, int err) 8623 { 8624 struct mgmt_pending_cmd *cmd = data; 8625 struct mgmt_cp_add_advertising *cp = cmd->param; 8626 struct mgmt_rp_add_advertising rp; 8627 8628 memset(&rp, 0, sizeof(rp)); 8629 8630 rp.instance = cp->instance; 8631 8632 if (err) 8633 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, 8634 mgmt_status(err)); 8635 else 8636 mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, 8637 mgmt_status(err), &rp, sizeof(rp)); 8638 8639 add_adv_complete(hdev, cmd->sk, cp->instance, err); 8640 8641 mgmt_pending_free(cmd); 8642 } 8643 8644 static int add_advertising_sync(struct hci_dev *hdev, void *data) 8645 { 8646 struct mgmt_pending_cmd *cmd = data; 8647 struct mgmt_cp_add_advertising *cp = cmd->param; 8648 8649 return hci_schedule_adv_instance_sync(hdev, cp->instance, true); 8650 } 8651 8652 static int add_advertising(struct sock *sk, struct hci_dev *hdev, 8653 void *data, u16 data_len) 8654 { 8655 struct mgmt_cp_add_advertising *cp = data; 8656 struct mgmt_rp_add_advertising rp; 8657 u32 flags; 8658 u8 status; 8659 u16 timeout, duration; 8660 unsigned int prev_instance_cnt; 8661 u8 schedule_instance = 0; 8662 struct adv_info *adv, *next_instance; 8663 int err; 8664 struct mgmt_pending_cmd *cmd; 8665 8666 bt_dev_dbg(hdev, "sock %p", sk); 8667 8668 status = mgmt_le_support(hdev); 8669 if (status) 8670 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING, 8671 status); 8672 8673 if (cp->instance < 1 || cp->instance > hdev->le_num_of_adv_sets) 8674 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING, 8675 MGMT_STATUS_INVALID_PARAMS); 8676 8677 if (data_len != sizeof(*cp) + cp->adv_data_len + cp->scan_rsp_len) 8678 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING, 8679 MGMT_STATUS_INVALID_PARAMS); 8680 8681 flags = __le32_to_cpu(cp->flags); 8682 timeout = __le16_to_cpu(cp->timeout); 8683 duration = __le16_to_cpu(cp->duration); 8684 8685 if (!requested_adv_flags_are_valid(hdev, flags)) 8686 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING, 8687 MGMT_STATUS_INVALID_PARAMS); 8688 8689 hci_dev_lock(hdev); 8690 8691 if (timeout && !hdev_is_powered(hdev)) { 8692 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING, 8693 MGMT_STATUS_REJECTED); 8694 goto unlock; 8695 } 8696 8697 if (adv_busy(hdev)) { 8698 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING, 8699 MGMT_STATUS_BUSY); 8700 goto unlock; 8701 } 8702 8703 if (!tlv_data_is_valid(hdev, flags, cp->data, cp->adv_data_len, true) || 8704 !tlv_data_is_valid(hdev, flags, cp->data + cp->adv_data_len, 8705 cp->scan_rsp_len, false)) { 8706 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING, 8707 MGMT_STATUS_INVALID_PARAMS); 8708 goto unlock; 8709 } 8710 8711 prev_instance_cnt = hdev->adv_instance_cnt; 8712 8713 adv = hci_add_adv_instance(hdev, cp->instance, flags, 8714 cp->adv_data_len, cp->data, 8715 cp->scan_rsp_len, 8716 cp->data + cp->adv_data_len, 8717 timeout, duration, 8718 HCI_ADV_TX_POWER_NO_PREFERENCE, 8719 hdev->le_adv_min_interval, 8720 hdev->le_adv_max_interval, 0); 8721 if (IS_ERR(adv)) { 8722 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING, 8723 MGMT_STATUS_FAILED); 8724 goto unlock; 8725 } 8726 8727 /* Only trigger an advertising added event if a new instance was 8728 * actually added. 8729 */ 8730 if (hdev->adv_instance_cnt > prev_instance_cnt) 8731 mgmt_advertising_added(sk, hdev, cp->instance); 8732 8733 if (hdev->cur_adv_instance == cp->instance) { 8734 /* If the currently advertised instance is being changed then 8735 * cancel the current advertising and schedule the next 8736 * instance. If there is only one instance then the overridden 8737 * advertising data will be visible right away. 8738 */ 8739 cancel_adv_timeout(hdev); 8740 8741 next_instance = hci_get_next_instance(hdev, cp->instance); 8742 if (next_instance) 8743 schedule_instance = next_instance->instance; 8744 } else if (!hdev->adv_instance_timeout) { 8745 /* Immediately advertise the new instance if no other 8746 * instance is currently being advertised. 8747 */ 8748 schedule_instance = cp->instance; 8749 } 8750 8751 /* If the HCI_ADVERTISING flag is set or the device isn't powered or 8752 * there is no instance to be advertised then we have no HCI 8753 * communication to make. Simply return. 8754 */ 8755 if (!hdev_is_powered(hdev) || 8756 hci_dev_test_flag(hdev, HCI_ADVERTISING) || 8757 !schedule_instance) { 8758 rp.instance = cp->instance; 8759 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_ADVERTISING, 8760 MGMT_STATUS_SUCCESS, &rp, sizeof(rp)); 8761 goto unlock; 8762 } 8763 8764 /* We're good to go, update advertising data, parameters, and start 8765 * advertising. 8766 */ 8767 cmd = mgmt_pending_new(sk, MGMT_OP_ADD_ADVERTISING, hdev, data, 8768 data_len); 8769 if (!cmd) { 8770 err = -ENOMEM; 8771 goto unlock; 8772 } 8773 8774 cp->instance = schedule_instance; 8775 8776 err = hci_cmd_sync_queue(hdev, add_advertising_sync, cmd, 8777 add_advertising_complete); 8778 if (err < 0) 8779 mgmt_pending_free(cmd); 8780 8781 unlock: 8782 hci_dev_unlock(hdev); 8783 8784 return err; 8785 } 8786 8787 static void add_ext_adv_params_complete(struct hci_dev *hdev, void *data, 8788 int err) 8789 { 8790 struct mgmt_pending_cmd *cmd = data; 8791 struct mgmt_cp_add_ext_adv_params *cp = cmd->param; 8792 struct mgmt_rp_add_ext_adv_params rp; 8793 struct adv_info *adv; 8794 u32 flags; 8795 8796 BT_DBG("%s", hdev->name); 8797 8798 hci_dev_lock(hdev); 8799 8800 adv = hci_find_adv_instance(hdev, cp->instance); 8801 if (!adv) 8802 goto unlock; 8803 8804 rp.instance = cp->instance; 8805 rp.tx_power = adv->tx_power; 8806 8807 /* While we're at it, inform userspace of the available space for this 8808 * advertisement, given the flags that will be used. 8809 */ 8810 flags = __le32_to_cpu(cp->flags); 8811 rp.max_adv_data_len = tlv_data_max_len(hdev, flags, true); 8812 rp.max_scan_rsp_len = tlv_data_max_len(hdev, flags, false); 8813 8814 if (err) { 8815 /* If this advertisement was previously advertising and we 8816 * failed to update it, we signal that it has been removed and 8817 * delete its structure 8818 */ 8819 if (!adv->pending) 8820 mgmt_advertising_removed(cmd->sk, hdev, cp->instance); 8821 8822 hci_remove_adv_instance(hdev, cp->instance); 8823 8824 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, 8825 mgmt_status(err)); 8826 } else { 8827 mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, 8828 mgmt_status(err), &rp, sizeof(rp)); 8829 } 8830 8831 unlock: 8832 if (cmd) 8833 mgmt_pending_free(cmd); 8834 8835 hci_dev_unlock(hdev); 8836 } 8837 8838 static int add_ext_adv_params_sync(struct hci_dev *hdev, void *data) 8839 { 8840 struct mgmt_pending_cmd *cmd = data; 8841 struct mgmt_cp_add_ext_adv_params *cp = cmd->param; 8842 8843 return hci_setup_ext_adv_instance_sync(hdev, cp->instance); 8844 } 8845 8846 static int add_ext_adv_params(struct sock *sk, struct hci_dev *hdev, 8847 void *data, u16 data_len) 8848 { 8849 struct mgmt_cp_add_ext_adv_params *cp = data; 8850 struct mgmt_rp_add_ext_adv_params rp; 8851 struct mgmt_pending_cmd *cmd = NULL; 8852 struct adv_info *adv; 8853 u32 flags, min_interval, max_interval; 8854 u16 timeout, duration; 8855 u8 status; 8856 s8 tx_power; 8857 int err; 8858 8859 BT_DBG("%s", hdev->name); 8860 8861 status = mgmt_le_support(hdev); 8862 if (status) 8863 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_PARAMS, 8864 status); 8865 8866 if (cp->instance < 1 || cp->instance > hdev->le_num_of_adv_sets) 8867 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_PARAMS, 8868 MGMT_STATUS_INVALID_PARAMS); 8869 8870 /* The purpose of breaking add_advertising into two separate MGMT calls 8871 * for params and data is to allow more parameters to be added to this 8872 * structure in the future. For this reason, we verify that we have the 8873 * bare minimum structure we know of when the interface was defined. Any 8874 * extra parameters we don't know about will be ignored in this request. 8875 */ 8876 if (data_len < MGMT_ADD_EXT_ADV_PARAMS_MIN_SIZE) 8877 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_PARAMS, 8878 MGMT_STATUS_INVALID_PARAMS); 8879 8880 flags = __le32_to_cpu(cp->flags); 8881 8882 if (!requested_adv_flags_are_valid(hdev, flags)) 8883 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_PARAMS, 8884 MGMT_STATUS_INVALID_PARAMS); 8885 8886 hci_dev_lock(hdev); 8887 8888 /* In new interface, we require that we are powered to register */ 8889 if (!hdev_is_powered(hdev)) { 8890 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_PARAMS, 8891 MGMT_STATUS_REJECTED); 8892 goto unlock; 8893 } 8894 8895 if (adv_busy(hdev)) { 8896 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_PARAMS, 8897 MGMT_STATUS_BUSY); 8898 goto unlock; 8899 } 8900 8901 /* Parse defined parameters from request, use defaults otherwise */ 8902 timeout = (flags & MGMT_ADV_PARAM_TIMEOUT) ? 8903 __le16_to_cpu(cp->timeout) : 0; 8904 8905 duration = (flags & MGMT_ADV_PARAM_DURATION) ? 8906 __le16_to_cpu(cp->duration) : 8907 hdev->def_multi_adv_rotation_duration; 8908 8909 min_interval = (flags & MGMT_ADV_PARAM_INTERVALS) ? 8910 __le32_to_cpu(cp->min_interval) : 8911 hdev->le_adv_min_interval; 8912 8913 max_interval = (flags & MGMT_ADV_PARAM_INTERVALS) ? 8914 __le32_to_cpu(cp->max_interval) : 8915 hdev->le_adv_max_interval; 8916 8917 tx_power = (flags & MGMT_ADV_PARAM_TX_POWER) ? 8918 cp->tx_power : 8919 HCI_ADV_TX_POWER_NO_PREFERENCE; 8920 8921 /* Create advertising instance with no advertising or response data */ 8922 adv = hci_add_adv_instance(hdev, cp->instance, flags, 0, NULL, 0, NULL, 8923 timeout, duration, tx_power, min_interval, 8924 max_interval, 0); 8925 8926 if (IS_ERR(adv)) { 8927 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_PARAMS, 8928 MGMT_STATUS_FAILED); 8929 goto unlock; 8930 } 8931 8932 /* Submit request for advertising params if ext adv available */ 8933 if (ext_adv_capable(hdev)) { 8934 cmd = mgmt_pending_new(sk, MGMT_OP_ADD_EXT_ADV_PARAMS, hdev, 8935 data, data_len); 8936 if (!cmd) { 8937 err = -ENOMEM; 8938 hci_remove_adv_instance(hdev, cp->instance); 8939 goto unlock; 8940 } 8941 8942 err = hci_cmd_sync_queue(hdev, add_ext_adv_params_sync, cmd, 8943 add_ext_adv_params_complete); 8944 if (err < 0) 8945 mgmt_pending_free(cmd); 8946 } else { 8947 rp.instance = cp->instance; 8948 rp.tx_power = HCI_ADV_TX_POWER_NO_PREFERENCE; 8949 rp.max_adv_data_len = tlv_data_max_len(hdev, flags, true); 8950 rp.max_scan_rsp_len = tlv_data_max_len(hdev, flags, false); 8951 err = mgmt_cmd_complete(sk, hdev->id, 8952 MGMT_OP_ADD_EXT_ADV_PARAMS, 8953 MGMT_STATUS_SUCCESS, &rp, sizeof(rp)); 8954 } 8955 8956 unlock: 8957 hci_dev_unlock(hdev); 8958 8959 return err; 8960 } 8961 8962 static void add_ext_adv_data_complete(struct hci_dev *hdev, void *data, int err) 8963 { 8964 struct mgmt_pending_cmd *cmd = data; 8965 struct mgmt_cp_add_ext_adv_data *cp = cmd->param; 8966 struct mgmt_rp_add_advertising rp; 8967 8968 add_adv_complete(hdev, cmd->sk, cp->instance, err); 8969 8970 memset(&rp, 0, sizeof(rp)); 8971 8972 rp.instance = cp->instance; 8973 8974 if (err) 8975 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, 8976 mgmt_status(err)); 8977 else 8978 mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, 8979 mgmt_status(err), &rp, sizeof(rp)); 8980 8981 mgmt_pending_free(cmd); 8982 } 8983 8984 static int add_ext_adv_data_sync(struct hci_dev *hdev, void *data) 8985 { 8986 struct mgmt_pending_cmd *cmd = data; 8987 struct mgmt_cp_add_ext_adv_data *cp = cmd->param; 8988 int err; 8989 8990 if (ext_adv_capable(hdev)) { 8991 err = hci_update_adv_data_sync(hdev, cp->instance); 8992 if (err) 8993 return err; 8994 8995 err = hci_update_scan_rsp_data_sync(hdev, cp->instance); 8996 if (err) 8997 return err; 8998 8999 return hci_enable_ext_advertising_sync(hdev, cp->instance); 9000 } 9001 9002 return hci_schedule_adv_instance_sync(hdev, cp->instance, true); 9003 } 9004 9005 static int add_ext_adv_data(struct sock *sk, struct hci_dev *hdev, void *data, 9006 u16 data_len) 9007 { 9008 struct mgmt_cp_add_ext_adv_data *cp = data; 9009 struct mgmt_rp_add_ext_adv_data rp; 9010 u8 schedule_instance = 0; 9011 struct adv_info *next_instance; 9012 struct adv_info *adv_instance; 9013 int err = 0; 9014 struct mgmt_pending_cmd *cmd; 9015 9016 BT_DBG("%s", hdev->name); 9017 9018 hci_dev_lock(hdev); 9019 9020 adv_instance = hci_find_adv_instance(hdev, cp->instance); 9021 9022 if (!adv_instance) { 9023 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_DATA, 9024 MGMT_STATUS_INVALID_PARAMS); 9025 goto unlock; 9026 } 9027 9028 /* In new interface, we require that we are powered to register */ 9029 if (!hdev_is_powered(hdev)) { 9030 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_DATA, 9031 MGMT_STATUS_REJECTED); 9032 goto clear_new_instance; 9033 } 9034 9035 if (adv_busy(hdev)) { 9036 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_DATA, 9037 MGMT_STATUS_BUSY); 9038 goto clear_new_instance; 9039 } 9040 9041 /* Validate new data */ 9042 if (!tlv_data_is_valid(hdev, adv_instance->flags, cp->data, 9043 cp->adv_data_len, true) || 9044 !tlv_data_is_valid(hdev, adv_instance->flags, cp->data + 9045 cp->adv_data_len, cp->scan_rsp_len, false)) { 9046 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_DATA, 9047 MGMT_STATUS_INVALID_PARAMS); 9048 goto clear_new_instance; 9049 } 9050 9051 /* Set the data in the advertising instance */ 9052 hci_set_adv_instance_data(hdev, cp->instance, cp->adv_data_len, 9053 cp->data, cp->scan_rsp_len, 9054 cp->data + cp->adv_data_len); 9055 9056 /* If using software rotation, determine next instance to use */ 9057 if (hdev->cur_adv_instance == cp->instance) { 9058 /* If the currently advertised instance is being changed 9059 * then cancel the current advertising and schedule the 9060 * next instance. If there is only one instance then the 9061 * overridden advertising data will be visible right 9062 * away 9063 */ 9064 cancel_adv_timeout(hdev); 9065 9066 next_instance = hci_get_next_instance(hdev, cp->instance); 9067 if (next_instance) 9068 schedule_instance = next_instance->instance; 9069 } else if (!hdev->adv_instance_timeout) { 9070 /* Immediately advertise the new instance if no other 9071 * instance is currently being advertised. 9072 */ 9073 schedule_instance = cp->instance; 9074 } 9075 9076 /* If the HCI_ADVERTISING flag is set or there is no instance to 9077 * be advertised then we have no HCI communication to make. 9078 * Simply return. 9079 */ 9080 if (hci_dev_test_flag(hdev, HCI_ADVERTISING) || !schedule_instance) { 9081 if (adv_instance->pending) { 9082 mgmt_advertising_added(sk, hdev, cp->instance); 9083 adv_instance->pending = false; 9084 } 9085 rp.instance = cp->instance; 9086 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_DATA, 9087 MGMT_STATUS_SUCCESS, &rp, sizeof(rp)); 9088 goto unlock; 9089 } 9090 9091 cmd = mgmt_pending_new(sk, MGMT_OP_ADD_EXT_ADV_DATA, hdev, data, 9092 data_len); 9093 if (!cmd) { 9094 err = -ENOMEM; 9095 goto clear_new_instance; 9096 } 9097 9098 err = hci_cmd_sync_queue(hdev, add_ext_adv_data_sync, cmd, 9099 add_ext_adv_data_complete); 9100 if (err < 0) { 9101 mgmt_pending_free(cmd); 9102 goto clear_new_instance; 9103 } 9104 9105 /* We were successful in updating data, so trigger advertising_added 9106 * event if this is an instance that wasn't previously advertising. If 9107 * a failure occurs in the requests we initiated, we will remove the 9108 * instance again in add_advertising_complete 9109 */ 9110 if (adv_instance->pending) 9111 mgmt_advertising_added(sk, hdev, cp->instance); 9112 9113 goto unlock; 9114 9115 clear_new_instance: 9116 hci_remove_adv_instance(hdev, cp->instance); 9117 9118 unlock: 9119 hci_dev_unlock(hdev); 9120 9121 return err; 9122 } 9123 9124 static void remove_advertising_complete(struct hci_dev *hdev, void *data, 9125 int err) 9126 { 9127 struct mgmt_pending_cmd *cmd = data; 9128 struct mgmt_cp_remove_advertising *cp = cmd->param; 9129 struct mgmt_rp_remove_advertising rp; 9130 9131 bt_dev_dbg(hdev, "err %d", err); 9132 9133 memset(&rp, 0, sizeof(rp)); 9134 rp.instance = cp->instance; 9135 9136 if (err) 9137 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, 9138 mgmt_status(err)); 9139 else 9140 mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, 9141 MGMT_STATUS_SUCCESS, &rp, sizeof(rp)); 9142 9143 mgmt_pending_free(cmd); 9144 } 9145 9146 static int remove_advertising_sync(struct hci_dev *hdev, void *data) 9147 { 9148 struct mgmt_pending_cmd *cmd = data; 9149 struct mgmt_cp_remove_advertising *cp = cmd->param; 9150 int err; 9151 9152 err = hci_remove_advertising_sync(hdev, cmd->sk, cp->instance, true); 9153 if (err) 9154 return err; 9155 9156 if (list_empty(&hdev->adv_instances)) 9157 err = hci_disable_advertising_sync(hdev); 9158 9159 return err; 9160 } 9161 9162 static int remove_advertising(struct sock *sk, struct hci_dev *hdev, 9163 void *data, u16 data_len) 9164 { 9165 struct mgmt_cp_remove_advertising *cp = data; 9166 struct mgmt_pending_cmd *cmd; 9167 int err; 9168 9169 bt_dev_dbg(hdev, "sock %p", sk); 9170 9171 hci_dev_lock(hdev); 9172 9173 if (cp->instance && !hci_find_adv_instance(hdev, cp->instance)) { 9174 err = mgmt_cmd_status(sk, hdev->id, 9175 MGMT_OP_REMOVE_ADVERTISING, 9176 MGMT_STATUS_INVALID_PARAMS); 9177 goto unlock; 9178 } 9179 9180 if (pending_find(MGMT_OP_SET_LE, hdev)) { 9181 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_ADVERTISING, 9182 MGMT_STATUS_BUSY); 9183 goto unlock; 9184 } 9185 9186 if (list_empty(&hdev->adv_instances)) { 9187 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_ADVERTISING, 9188 MGMT_STATUS_INVALID_PARAMS); 9189 goto unlock; 9190 } 9191 9192 cmd = mgmt_pending_new(sk, MGMT_OP_REMOVE_ADVERTISING, hdev, data, 9193 data_len); 9194 if (!cmd) { 9195 err = -ENOMEM; 9196 goto unlock; 9197 } 9198 9199 err = hci_cmd_sync_queue(hdev, remove_advertising_sync, cmd, 9200 remove_advertising_complete); 9201 if (err < 0) 9202 mgmt_pending_free(cmd); 9203 9204 unlock: 9205 hci_dev_unlock(hdev); 9206 9207 return err; 9208 } 9209 9210 static int get_adv_size_info(struct sock *sk, struct hci_dev *hdev, 9211 void *data, u16 data_len) 9212 { 9213 struct mgmt_cp_get_adv_size_info *cp = data; 9214 struct mgmt_rp_get_adv_size_info rp; 9215 u32 flags, supported_flags; 9216 9217 bt_dev_dbg(hdev, "sock %p", sk); 9218 9219 if (!lmp_le_capable(hdev)) 9220 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_ADV_SIZE_INFO, 9221 MGMT_STATUS_REJECTED); 9222 9223 if (cp->instance < 1 || cp->instance > hdev->le_num_of_adv_sets) 9224 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_ADV_SIZE_INFO, 9225 MGMT_STATUS_INVALID_PARAMS); 9226 9227 flags = __le32_to_cpu(cp->flags); 9228 9229 /* The current implementation only supports a subset of the specified 9230 * flags. 9231 */ 9232 supported_flags = get_supported_adv_flags(hdev); 9233 if (flags & ~supported_flags) 9234 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_ADV_SIZE_INFO, 9235 MGMT_STATUS_INVALID_PARAMS); 9236 9237 rp.instance = cp->instance; 9238 rp.flags = cp->flags; 9239 rp.max_adv_data_len = tlv_data_max_len(hdev, flags, true); 9240 rp.max_scan_rsp_len = tlv_data_max_len(hdev, flags, false); 9241 9242 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_ADV_SIZE_INFO, 9243 MGMT_STATUS_SUCCESS, &rp, sizeof(rp)); 9244 } 9245 9246 static const struct hci_mgmt_handler mgmt_handlers[] = { 9247 { NULL }, /* 0x0000 (no command) */ 9248 { read_version, MGMT_READ_VERSION_SIZE, 9249 HCI_MGMT_NO_HDEV | 9250 HCI_MGMT_UNTRUSTED }, 9251 { read_commands, MGMT_READ_COMMANDS_SIZE, 9252 HCI_MGMT_NO_HDEV | 9253 HCI_MGMT_UNTRUSTED }, 9254 { read_index_list, MGMT_READ_INDEX_LIST_SIZE, 9255 HCI_MGMT_NO_HDEV | 9256 HCI_MGMT_UNTRUSTED }, 9257 { read_controller_info, MGMT_READ_INFO_SIZE, 9258 HCI_MGMT_UNTRUSTED }, 9259 { set_powered, MGMT_SETTING_SIZE }, 9260 { set_discoverable, MGMT_SET_DISCOVERABLE_SIZE }, 9261 { set_connectable, MGMT_SETTING_SIZE }, 9262 { set_fast_connectable, MGMT_SETTING_SIZE }, 9263 { set_bondable, MGMT_SETTING_SIZE }, 9264 { set_link_security, MGMT_SETTING_SIZE }, 9265 { set_ssp, MGMT_SETTING_SIZE }, 9266 { set_hs, MGMT_SETTING_SIZE }, 9267 { set_le, MGMT_SETTING_SIZE }, 9268 { set_dev_class, MGMT_SET_DEV_CLASS_SIZE }, 9269 { set_local_name, MGMT_SET_LOCAL_NAME_SIZE }, 9270 { add_uuid, MGMT_ADD_UUID_SIZE }, 9271 { remove_uuid, MGMT_REMOVE_UUID_SIZE }, 9272 { load_link_keys, MGMT_LOAD_LINK_KEYS_SIZE, 9273 HCI_MGMT_VAR_LEN }, 9274 { load_long_term_keys, MGMT_LOAD_LONG_TERM_KEYS_SIZE, 9275 HCI_MGMT_VAR_LEN }, 9276 { disconnect, MGMT_DISCONNECT_SIZE }, 9277 { get_connections, MGMT_GET_CONNECTIONS_SIZE }, 9278 { pin_code_reply, MGMT_PIN_CODE_REPLY_SIZE }, 9279 { pin_code_neg_reply, MGMT_PIN_CODE_NEG_REPLY_SIZE }, 9280 { set_io_capability, MGMT_SET_IO_CAPABILITY_SIZE }, 9281 { pair_device, MGMT_PAIR_DEVICE_SIZE }, 9282 { cancel_pair_device, MGMT_CANCEL_PAIR_DEVICE_SIZE }, 9283 { unpair_device, MGMT_UNPAIR_DEVICE_SIZE }, 9284 { user_confirm_reply, MGMT_USER_CONFIRM_REPLY_SIZE }, 9285 { user_confirm_neg_reply, MGMT_USER_CONFIRM_NEG_REPLY_SIZE }, 9286 { user_passkey_reply, MGMT_USER_PASSKEY_REPLY_SIZE }, 9287 { user_passkey_neg_reply, MGMT_USER_PASSKEY_NEG_REPLY_SIZE }, 9288 { read_local_oob_data, MGMT_READ_LOCAL_OOB_DATA_SIZE }, 9289 { add_remote_oob_data, MGMT_ADD_REMOTE_OOB_DATA_SIZE, 9290 HCI_MGMT_VAR_LEN }, 9291 { remove_remote_oob_data, MGMT_REMOVE_REMOTE_OOB_DATA_SIZE }, 9292 { start_discovery, MGMT_START_DISCOVERY_SIZE }, 9293 { stop_discovery, MGMT_STOP_DISCOVERY_SIZE }, 9294 { confirm_name, MGMT_CONFIRM_NAME_SIZE }, 9295 { block_device, MGMT_BLOCK_DEVICE_SIZE }, 9296 { unblock_device, MGMT_UNBLOCK_DEVICE_SIZE }, 9297 { set_device_id, MGMT_SET_DEVICE_ID_SIZE }, 9298 { set_advertising, MGMT_SETTING_SIZE }, 9299 { set_bredr, MGMT_SETTING_SIZE }, 9300 { set_static_address, MGMT_SET_STATIC_ADDRESS_SIZE }, 9301 { set_scan_params, MGMT_SET_SCAN_PARAMS_SIZE }, 9302 { set_secure_conn, MGMT_SETTING_SIZE }, 9303 { set_debug_keys, MGMT_SETTING_SIZE }, 9304 { set_privacy, MGMT_SET_PRIVACY_SIZE }, 9305 { load_irks, MGMT_LOAD_IRKS_SIZE, 9306 HCI_MGMT_VAR_LEN }, 9307 { get_conn_info, MGMT_GET_CONN_INFO_SIZE }, 9308 { get_clock_info, MGMT_GET_CLOCK_INFO_SIZE }, 9309 { add_device, MGMT_ADD_DEVICE_SIZE }, 9310 { remove_device, MGMT_REMOVE_DEVICE_SIZE }, 9311 { load_conn_param, MGMT_LOAD_CONN_PARAM_SIZE, 9312 HCI_MGMT_VAR_LEN }, 9313 { read_unconf_index_list, MGMT_READ_UNCONF_INDEX_LIST_SIZE, 9314 HCI_MGMT_NO_HDEV | 9315 HCI_MGMT_UNTRUSTED }, 9316 { read_config_info, MGMT_READ_CONFIG_INFO_SIZE, 9317 HCI_MGMT_UNCONFIGURED | 9318 HCI_MGMT_UNTRUSTED }, 9319 { set_external_config, MGMT_SET_EXTERNAL_CONFIG_SIZE, 9320 HCI_MGMT_UNCONFIGURED }, 9321 { set_public_address, MGMT_SET_PUBLIC_ADDRESS_SIZE, 9322 HCI_MGMT_UNCONFIGURED }, 9323 { start_service_discovery, MGMT_START_SERVICE_DISCOVERY_SIZE, 9324 HCI_MGMT_VAR_LEN }, 9325 { read_local_oob_ext_data, MGMT_READ_LOCAL_OOB_EXT_DATA_SIZE }, 9326 { read_ext_index_list, MGMT_READ_EXT_INDEX_LIST_SIZE, 9327 HCI_MGMT_NO_HDEV | 9328 HCI_MGMT_UNTRUSTED }, 9329 { read_adv_features, MGMT_READ_ADV_FEATURES_SIZE }, 9330 { add_advertising, MGMT_ADD_ADVERTISING_SIZE, 9331 HCI_MGMT_VAR_LEN }, 9332 { remove_advertising, MGMT_REMOVE_ADVERTISING_SIZE }, 9333 { get_adv_size_info, MGMT_GET_ADV_SIZE_INFO_SIZE }, 9334 { start_limited_discovery, MGMT_START_DISCOVERY_SIZE }, 9335 { read_ext_controller_info,MGMT_READ_EXT_INFO_SIZE, 9336 HCI_MGMT_UNTRUSTED }, 9337 { set_appearance, MGMT_SET_APPEARANCE_SIZE }, 9338 { get_phy_configuration, MGMT_GET_PHY_CONFIGURATION_SIZE }, 9339 { set_phy_configuration, MGMT_SET_PHY_CONFIGURATION_SIZE }, 9340 { set_blocked_keys, MGMT_OP_SET_BLOCKED_KEYS_SIZE, 9341 HCI_MGMT_VAR_LEN }, 9342 { set_wideband_speech, MGMT_SETTING_SIZE }, 9343 { read_controller_cap, MGMT_READ_CONTROLLER_CAP_SIZE, 9344 HCI_MGMT_UNTRUSTED }, 9345 { read_exp_features_info, MGMT_READ_EXP_FEATURES_INFO_SIZE, 9346 HCI_MGMT_UNTRUSTED | 9347 HCI_MGMT_HDEV_OPTIONAL }, 9348 { set_exp_feature, MGMT_SET_EXP_FEATURE_SIZE, 9349 HCI_MGMT_VAR_LEN | 9350 HCI_MGMT_HDEV_OPTIONAL }, 9351 { read_def_system_config, MGMT_READ_DEF_SYSTEM_CONFIG_SIZE, 9352 HCI_MGMT_UNTRUSTED }, 9353 { set_def_system_config, MGMT_SET_DEF_SYSTEM_CONFIG_SIZE, 9354 HCI_MGMT_VAR_LEN }, 9355 { read_def_runtime_config, MGMT_READ_DEF_RUNTIME_CONFIG_SIZE, 9356 HCI_MGMT_UNTRUSTED }, 9357 { set_def_runtime_config, MGMT_SET_DEF_RUNTIME_CONFIG_SIZE, 9358 HCI_MGMT_VAR_LEN }, 9359 { get_device_flags, MGMT_GET_DEVICE_FLAGS_SIZE }, 9360 { set_device_flags, MGMT_SET_DEVICE_FLAGS_SIZE }, 9361 { read_adv_mon_features, MGMT_READ_ADV_MONITOR_FEATURES_SIZE }, 9362 { add_adv_patterns_monitor,MGMT_ADD_ADV_PATTERNS_MONITOR_SIZE, 9363 HCI_MGMT_VAR_LEN }, 9364 { remove_adv_monitor, MGMT_REMOVE_ADV_MONITOR_SIZE }, 9365 { add_ext_adv_params, MGMT_ADD_EXT_ADV_PARAMS_MIN_SIZE, 9366 HCI_MGMT_VAR_LEN }, 9367 { add_ext_adv_data, MGMT_ADD_EXT_ADV_DATA_SIZE, 9368 HCI_MGMT_VAR_LEN }, 9369 { add_adv_patterns_monitor_rssi, 9370 MGMT_ADD_ADV_PATTERNS_MONITOR_RSSI_SIZE, 9371 HCI_MGMT_VAR_LEN }, 9372 { set_mesh, MGMT_SET_MESH_RECEIVER_SIZE, 9373 HCI_MGMT_VAR_LEN }, 9374 { mesh_features, MGMT_MESH_READ_FEATURES_SIZE }, 9375 { mesh_send, MGMT_MESH_SEND_SIZE, 9376 HCI_MGMT_VAR_LEN }, 9377 { mesh_send_cancel, MGMT_MESH_SEND_CANCEL_SIZE }, 9378 }; 9379 9380 void mgmt_index_added(struct hci_dev *hdev) 9381 { 9382 struct mgmt_ev_ext_index ev; 9383 9384 if (test_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks)) 9385 return; 9386 9387 switch (hdev->dev_type) { 9388 case HCI_PRIMARY: 9389 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) { 9390 mgmt_index_event(MGMT_EV_UNCONF_INDEX_ADDED, hdev, 9391 NULL, 0, HCI_MGMT_UNCONF_INDEX_EVENTS); 9392 ev.type = 0x01; 9393 } else { 9394 mgmt_index_event(MGMT_EV_INDEX_ADDED, hdev, NULL, 0, 9395 HCI_MGMT_INDEX_EVENTS); 9396 ev.type = 0x00; 9397 } 9398 break; 9399 case HCI_AMP: 9400 ev.type = 0x02; 9401 break; 9402 default: 9403 return; 9404 } 9405 9406 ev.bus = hdev->bus; 9407 9408 mgmt_index_event(MGMT_EV_EXT_INDEX_ADDED, hdev, &ev, sizeof(ev), 9409 HCI_MGMT_EXT_INDEX_EVENTS); 9410 } 9411 9412 void mgmt_index_removed(struct hci_dev *hdev) 9413 { 9414 struct mgmt_ev_ext_index ev; 9415 u8 status = MGMT_STATUS_INVALID_INDEX; 9416 9417 if (test_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks)) 9418 return; 9419 9420 switch (hdev->dev_type) { 9421 case HCI_PRIMARY: 9422 mgmt_pending_foreach(0, hdev, cmd_complete_rsp, &status); 9423 9424 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) { 9425 mgmt_index_event(MGMT_EV_UNCONF_INDEX_REMOVED, hdev, 9426 NULL, 0, HCI_MGMT_UNCONF_INDEX_EVENTS); 9427 ev.type = 0x01; 9428 } else { 9429 mgmt_index_event(MGMT_EV_INDEX_REMOVED, hdev, NULL, 0, 9430 HCI_MGMT_INDEX_EVENTS); 9431 ev.type = 0x00; 9432 } 9433 break; 9434 case HCI_AMP: 9435 ev.type = 0x02; 9436 break; 9437 default: 9438 return; 9439 } 9440 9441 ev.bus = hdev->bus; 9442 9443 mgmt_index_event(MGMT_EV_EXT_INDEX_REMOVED, hdev, &ev, sizeof(ev), 9444 HCI_MGMT_EXT_INDEX_EVENTS); 9445 9446 /* Cancel any remaining timed work */ 9447 if (!hci_dev_test_flag(hdev, HCI_MGMT)) 9448 return; 9449 cancel_delayed_work_sync(&hdev->discov_off); 9450 cancel_delayed_work_sync(&hdev->service_cache); 9451 cancel_delayed_work_sync(&hdev->rpa_expired); 9452 } 9453 9454 void mgmt_power_on(struct hci_dev *hdev, int err) 9455 { 9456 struct cmd_lookup match = { NULL, hdev }; 9457 9458 bt_dev_dbg(hdev, "err %d", err); 9459 9460 hci_dev_lock(hdev); 9461 9462 if (!err) { 9463 restart_le_actions(hdev); 9464 hci_update_passive_scan(hdev); 9465 } 9466 9467 mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp, &match); 9468 9469 new_settings(hdev, match.sk); 9470 9471 if (match.sk) 9472 sock_put(match.sk); 9473 9474 hci_dev_unlock(hdev); 9475 } 9476 9477 void __mgmt_power_off(struct hci_dev *hdev) 9478 { 9479 struct cmd_lookup match = { NULL, hdev }; 9480 u8 status, zero_cod[] = { 0, 0, 0 }; 9481 9482 mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp, &match); 9483 9484 /* If the power off is because of hdev unregistration let 9485 * use the appropriate INVALID_INDEX status. Otherwise use 9486 * NOT_POWERED. We cover both scenarios here since later in 9487 * mgmt_index_removed() any hci_conn callbacks will have already 9488 * been triggered, potentially causing misleading DISCONNECTED 9489 * status responses. 9490 */ 9491 if (hci_dev_test_flag(hdev, HCI_UNREGISTER)) 9492 status = MGMT_STATUS_INVALID_INDEX; 9493 else 9494 status = MGMT_STATUS_NOT_POWERED; 9495 9496 mgmt_pending_foreach(0, hdev, cmd_complete_rsp, &status); 9497 9498 if (memcmp(hdev->dev_class, zero_cod, sizeof(zero_cod)) != 0) { 9499 mgmt_limited_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev, 9500 zero_cod, sizeof(zero_cod), 9501 HCI_MGMT_DEV_CLASS_EVENTS, NULL); 9502 ext_info_changed(hdev, NULL); 9503 } 9504 9505 new_settings(hdev, match.sk); 9506 9507 if (match.sk) 9508 sock_put(match.sk); 9509 } 9510 9511 void mgmt_set_powered_failed(struct hci_dev *hdev, int err) 9512 { 9513 struct mgmt_pending_cmd *cmd; 9514 u8 status; 9515 9516 cmd = pending_find(MGMT_OP_SET_POWERED, hdev); 9517 if (!cmd) 9518 return; 9519 9520 if (err == -ERFKILL) 9521 status = MGMT_STATUS_RFKILLED; 9522 else 9523 status = MGMT_STATUS_FAILED; 9524 9525 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_POWERED, status); 9526 9527 mgmt_pending_remove(cmd); 9528 } 9529 9530 void mgmt_new_link_key(struct hci_dev *hdev, struct link_key *key, 9531 bool persistent) 9532 { 9533 struct mgmt_ev_new_link_key ev; 9534 9535 memset(&ev, 0, sizeof(ev)); 9536 9537 ev.store_hint = persistent; 9538 bacpy(&ev.key.addr.bdaddr, &key->bdaddr); 9539 ev.key.addr.type = link_to_bdaddr(key->link_type, key->bdaddr_type); 9540 ev.key.type = key->type; 9541 memcpy(ev.key.val, key->val, HCI_LINK_KEY_SIZE); 9542 ev.key.pin_len = key->pin_len; 9543 9544 mgmt_event(MGMT_EV_NEW_LINK_KEY, hdev, &ev, sizeof(ev), NULL); 9545 } 9546 9547 static u8 mgmt_ltk_type(struct smp_ltk *ltk) 9548 { 9549 switch (ltk->type) { 9550 case SMP_LTK: 9551 case SMP_LTK_RESPONDER: 9552 if (ltk->authenticated) 9553 return MGMT_LTK_AUTHENTICATED; 9554 return MGMT_LTK_UNAUTHENTICATED; 9555 case SMP_LTK_P256: 9556 if (ltk->authenticated) 9557 return MGMT_LTK_P256_AUTH; 9558 return MGMT_LTK_P256_UNAUTH; 9559 case SMP_LTK_P256_DEBUG: 9560 return MGMT_LTK_P256_DEBUG; 9561 } 9562 9563 return MGMT_LTK_UNAUTHENTICATED; 9564 } 9565 9566 void mgmt_new_ltk(struct hci_dev *hdev, struct smp_ltk *key, bool persistent) 9567 { 9568 struct mgmt_ev_new_long_term_key ev; 9569 9570 memset(&ev, 0, sizeof(ev)); 9571 9572 /* Devices using resolvable or non-resolvable random addresses 9573 * without providing an identity resolving key don't require 9574 * to store long term keys. Their addresses will change the 9575 * next time around. 9576 * 9577 * Only when a remote device provides an identity address 9578 * make sure the long term key is stored. If the remote 9579 * identity is known, the long term keys are internally 9580 * mapped to the identity address. So allow static random 9581 * and public addresses here. 9582 */ 9583 if (key->bdaddr_type == ADDR_LE_DEV_RANDOM && 9584 (key->bdaddr.b[5] & 0xc0) != 0xc0) 9585 ev.store_hint = 0x00; 9586 else 9587 ev.store_hint = persistent; 9588 9589 bacpy(&ev.key.addr.bdaddr, &key->bdaddr); 9590 ev.key.addr.type = link_to_bdaddr(key->link_type, key->bdaddr_type); 9591 ev.key.type = mgmt_ltk_type(key); 9592 ev.key.enc_size = key->enc_size; 9593 ev.key.ediv = key->ediv; 9594 ev.key.rand = key->rand; 9595 9596 if (key->type == SMP_LTK) 9597 ev.key.initiator = 1; 9598 9599 /* Make sure we copy only the significant bytes based on the 9600 * encryption key size, and set the rest of the value to zeroes. 9601 */ 9602 memcpy(ev.key.val, key->val, key->enc_size); 9603 memset(ev.key.val + key->enc_size, 0, 9604 sizeof(ev.key.val) - key->enc_size); 9605 9606 mgmt_event(MGMT_EV_NEW_LONG_TERM_KEY, hdev, &ev, sizeof(ev), NULL); 9607 } 9608 9609 void mgmt_new_irk(struct hci_dev *hdev, struct smp_irk *irk, bool persistent) 9610 { 9611 struct mgmt_ev_new_irk ev; 9612 9613 memset(&ev, 0, sizeof(ev)); 9614 9615 ev.store_hint = persistent; 9616 9617 bacpy(&ev.rpa, &irk->rpa); 9618 bacpy(&ev.irk.addr.bdaddr, &irk->bdaddr); 9619 ev.irk.addr.type = link_to_bdaddr(irk->link_type, irk->addr_type); 9620 memcpy(ev.irk.val, irk->val, sizeof(irk->val)); 9621 9622 mgmt_event(MGMT_EV_NEW_IRK, hdev, &ev, sizeof(ev), NULL); 9623 } 9624 9625 void mgmt_new_csrk(struct hci_dev *hdev, struct smp_csrk *csrk, 9626 bool persistent) 9627 { 9628 struct mgmt_ev_new_csrk ev; 9629 9630 memset(&ev, 0, sizeof(ev)); 9631 9632 /* Devices using resolvable or non-resolvable random addresses 9633 * without providing an identity resolving key don't require 9634 * to store signature resolving keys. Their addresses will change 9635 * the next time around. 9636 * 9637 * Only when a remote device provides an identity address 9638 * make sure the signature resolving key is stored. So allow 9639 * static random and public addresses here. 9640 */ 9641 if (csrk->bdaddr_type == ADDR_LE_DEV_RANDOM && 9642 (csrk->bdaddr.b[5] & 0xc0) != 0xc0) 9643 ev.store_hint = 0x00; 9644 else 9645 ev.store_hint = persistent; 9646 9647 bacpy(&ev.key.addr.bdaddr, &csrk->bdaddr); 9648 ev.key.addr.type = link_to_bdaddr(csrk->link_type, csrk->bdaddr_type); 9649 ev.key.type = csrk->type; 9650 memcpy(ev.key.val, csrk->val, sizeof(csrk->val)); 9651 9652 mgmt_event(MGMT_EV_NEW_CSRK, hdev, &ev, sizeof(ev), NULL); 9653 } 9654 9655 void mgmt_new_conn_param(struct hci_dev *hdev, bdaddr_t *bdaddr, 9656 u8 bdaddr_type, u8 store_hint, u16 min_interval, 9657 u16 max_interval, u16 latency, u16 timeout) 9658 { 9659 struct mgmt_ev_new_conn_param ev; 9660 9661 if (!hci_is_identity_address(bdaddr, bdaddr_type)) 9662 return; 9663 9664 memset(&ev, 0, sizeof(ev)); 9665 bacpy(&ev.addr.bdaddr, bdaddr); 9666 ev.addr.type = link_to_bdaddr(LE_LINK, bdaddr_type); 9667 ev.store_hint = store_hint; 9668 ev.min_interval = cpu_to_le16(min_interval); 9669 ev.max_interval = cpu_to_le16(max_interval); 9670 ev.latency = cpu_to_le16(latency); 9671 ev.timeout = cpu_to_le16(timeout); 9672 9673 mgmt_event(MGMT_EV_NEW_CONN_PARAM, hdev, &ev, sizeof(ev), NULL); 9674 } 9675 9676 void mgmt_device_connected(struct hci_dev *hdev, struct hci_conn *conn, 9677 u8 *name, u8 name_len) 9678 { 9679 struct sk_buff *skb; 9680 struct mgmt_ev_device_connected *ev; 9681 u16 eir_len = 0; 9682 u32 flags = 0; 9683 9684 /* allocate buff for LE or BR/EDR adv */ 9685 if (conn->le_adv_data_len > 0) 9686 skb = mgmt_alloc_skb(hdev, MGMT_EV_DEVICE_CONNECTED, 9687 sizeof(*ev) + conn->le_adv_data_len); 9688 else 9689 skb = mgmt_alloc_skb(hdev, MGMT_EV_DEVICE_CONNECTED, 9690 sizeof(*ev) + (name ? eir_precalc_len(name_len) : 0) + 9691 eir_precalc_len(sizeof(conn->dev_class))); 9692 9693 ev = skb_put(skb, sizeof(*ev)); 9694 bacpy(&ev->addr.bdaddr, &conn->dst); 9695 ev->addr.type = link_to_bdaddr(conn->type, conn->dst_type); 9696 9697 if (conn->out) 9698 flags |= MGMT_DEV_FOUND_INITIATED_CONN; 9699 9700 ev->flags = __cpu_to_le32(flags); 9701 9702 /* We must ensure that the EIR Data fields are ordered and 9703 * unique. Keep it simple for now and avoid the problem by not 9704 * adding any BR/EDR data to the LE adv. 9705 */ 9706 if (conn->le_adv_data_len > 0) { 9707 skb_put_data(skb, conn->le_adv_data, conn->le_adv_data_len); 9708 eir_len = conn->le_adv_data_len; 9709 } else { 9710 if (name) 9711 eir_len += eir_skb_put_data(skb, EIR_NAME_COMPLETE, name, name_len); 9712 9713 if (memcmp(conn->dev_class, "\0\0\0", sizeof(conn->dev_class))) 9714 eir_len += eir_skb_put_data(skb, EIR_CLASS_OF_DEV, 9715 conn->dev_class, sizeof(conn->dev_class)); 9716 } 9717 9718 ev->eir_len = cpu_to_le16(eir_len); 9719 9720 mgmt_event_skb(skb, NULL); 9721 } 9722 9723 static void disconnect_rsp(struct mgmt_pending_cmd *cmd, void *data) 9724 { 9725 struct sock **sk = data; 9726 9727 cmd->cmd_complete(cmd, 0); 9728 9729 *sk = cmd->sk; 9730 sock_hold(*sk); 9731 9732 mgmt_pending_remove(cmd); 9733 } 9734 9735 static void unpair_device_rsp(struct mgmt_pending_cmd *cmd, void *data) 9736 { 9737 struct hci_dev *hdev = data; 9738 struct mgmt_cp_unpair_device *cp = cmd->param; 9739 9740 device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, cmd->sk); 9741 9742 cmd->cmd_complete(cmd, 0); 9743 mgmt_pending_remove(cmd); 9744 } 9745 9746 bool mgmt_powering_down(struct hci_dev *hdev) 9747 { 9748 struct mgmt_pending_cmd *cmd; 9749 struct mgmt_mode *cp; 9750 9751 cmd = pending_find(MGMT_OP_SET_POWERED, hdev); 9752 if (!cmd) 9753 return false; 9754 9755 cp = cmd->param; 9756 if (!cp->val) 9757 return true; 9758 9759 return false; 9760 } 9761 9762 void mgmt_device_disconnected(struct hci_dev *hdev, bdaddr_t *bdaddr, 9763 u8 link_type, u8 addr_type, u8 reason, 9764 bool mgmt_connected) 9765 { 9766 struct mgmt_ev_device_disconnected ev; 9767 struct sock *sk = NULL; 9768 9769 /* The connection is still in hci_conn_hash so test for 1 9770 * instead of 0 to know if this is the last one. 9771 */ 9772 if (mgmt_powering_down(hdev) && hci_conn_count(hdev) == 1) { 9773 cancel_delayed_work(&hdev->power_off); 9774 queue_work(hdev->req_workqueue, &hdev->power_off.work); 9775 } 9776 9777 if (!mgmt_connected) 9778 return; 9779 9780 if (link_type != ACL_LINK && link_type != LE_LINK) 9781 return; 9782 9783 mgmt_pending_foreach(MGMT_OP_DISCONNECT, hdev, disconnect_rsp, &sk); 9784 9785 bacpy(&ev.addr.bdaddr, bdaddr); 9786 ev.addr.type = link_to_bdaddr(link_type, addr_type); 9787 ev.reason = reason; 9788 9789 /* Report disconnects due to suspend */ 9790 if (hdev->suspended) 9791 ev.reason = MGMT_DEV_DISCONN_LOCAL_HOST_SUSPEND; 9792 9793 mgmt_event(MGMT_EV_DEVICE_DISCONNECTED, hdev, &ev, sizeof(ev), sk); 9794 9795 if (sk) 9796 sock_put(sk); 9797 9798 mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, unpair_device_rsp, 9799 hdev); 9800 } 9801 9802 void mgmt_disconnect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr, 9803 u8 link_type, u8 addr_type, u8 status) 9804 { 9805 u8 bdaddr_type = link_to_bdaddr(link_type, addr_type); 9806 struct mgmt_cp_disconnect *cp; 9807 struct mgmt_pending_cmd *cmd; 9808 9809 mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, unpair_device_rsp, 9810 hdev); 9811 9812 cmd = pending_find(MGMT_OP_DISCONNECT, hdev); 9813 if (!cmd) 9814 return; 9815 9816 cp = cmd->param; 9817 9818 if (bacmp(bdaddr, &cp->addr.bdaddr)) 9819 return; 9820 9821 if (cp->addr.type != bdaddr_type) 9822 return; 9823 9824 cmd->cmd_complete(cmd, mgmt_status(status)); 9825 mgmt_pending_remove(cmd); 9826 } 9827 9828 void mgmt_connect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type, 9829 u8 addr_type, u8 status) 9830 { 9831 struct mgmt_ev_connect_failed ev; 9832 9833 /* The connection is still in hci_conn_hash so test for 1 9834 * instead of 0 to know if this is the last one. 9835 */ 9836 if (mgmt_powering_down(hdev) && hci_conn_count(hdev) == 1) { 9837 cancel_delayed_work(&hdev->power_off); 9838 queue_work(hdev->req_workqueue, &hdev->power_off.work); 9839 } 9840 9841 bacpy(&ev.addr.bdaddr, bdaddr); 9842 ev.addr.type = link_to_bdaddr(link_type, addr_type); 9843 ev.status = mgmt_status(status); 9844 9845 mgmt_event(MGMT_EV_CONNECT_FAILED, hdev, &ev, sizeof(ev), NULL); 9846 } 9847 9848 void mgmt_pin_code_request(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 secure) 9849 { 9850 struct mgmt_ev_pin_code_request ev; 9851 9852 bacpy(&ev.addr.bdaddr, bdaddr); 9853 ev.addr.type = BDADDR_BREDR; 9854 ev.secure = secure; 9855 9856 mgmt_event(MGMT_EV_PIN_CODE_REQUEST, hdev, &ev, sizeof(ev), NULL); 9857 } 9858 9859 void mgmt_pin_code_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr, 9860 u8 status) 9861 { 9862 struct mgmt_pending_cmd *cmd; 9863 9864 cmd = pending_find(MGMT_OP_PIN_CODE_REPLY, hdev); 9865 if (!cmd) 9866 return; 9867 9868 cmd->cmd_complete(cmd, mgmt_status(status)); 9869 mgmt_pending_remove(cmd); 9870 } 9871 9872 void mgmt_pin_code_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr, 9873 u8 status) 9874 { 9875 struct mgmt_pending_cmd *cmd; 9876 9877 cmd = pending_find(MGMT_OP_PIN_CODE_NEG_REPLY, hdev); 9878 if (!cmd) 9879 return; 9880 9881 cmd->cmd_complete(cmd, mgmt_status(status)); 9882 mgmt_pending_remove(cmd); 9883 } 9884 9885 int mgmt_user_confirm_request(struct hci_dev *hdev, bdaddr_t *bdaddr, 9886 u8 link_type, u8 addr_type, u32 value, 9887 u8 confirm_hint) 9888 { 9889 struct mgmt_ev_user_confirm_request ev; 9890 9891 bt_dev_dbg(hdev, "bdaddr %pMR", bdaddr); 9892 9893 bacpy(&ev.addr.bdaddr, bdaddr); 9894 ev.addr.type = link_to_bdaddr(link_type, addr_type); 9895 ev.confirm_hint = confirm_hint; 9896 ev.value = cpu_to_le32(value); 9897 9898 return mgmt_event(MGMT_EV_USER_CONFIRM_REQUEST, hdev, &ev, sizeof(ev), 9899 NULL); 9900 } 9901 9902 int mgmt_user_passkey_request(struct hci_dev *hdev, bdaddr_t *bdaddr, 9903 u8 link_type, u8 addr_type) 9904 { 9905 struct mgmt_ev_user_passkey_request ev; 9906 9907 bt_dev_dbg(hdev, "bdaddr %pMR", bdaddr); 9908 9909 bacpy(&ev.addr.bdaddr, bdaddr); 9910 ev.addr.type = link_to_bdaddr(link_type, addr_type); 9911 9912 return mgmt_event(MGMT_EV_USER_PASSKEY_REQUEST, hdev, &ev, sizeof(ev), 9913 NULL); 9914 } 9915 9916 static int user_pairing_resp_complete(struct hci_dev *hdev, bdaddr_t *bdaddr, 9917 u8 link_type, u8 addr_type, u8 status, 9918 u8 opcode) 9919 { 9920 struct mgmt_pending_cmd *cmd; 9921 9922 cmd = pending_find(opcode, hdev); 9923 if (!cmd) 9924 return -ENOENT; 9925 9926 cmd->cmd_complete(cmd, mgmt_status(status)); 9927 mgmt_pending_remove(cmd); 9928 9929 return 0; 9930 } 9931 9932 int mgmt_user_confirm_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr, 9933 u8 link_type, u8 addr_type, u8 status) 9934 { 9935 return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type, 9936 status, MGMT_OP_USER_CONFIRM_REPLY); 9937 } 9938 9939 int mgmt_user_confirm_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr, 9940 u8 link_type, u8 addr_type, u8 status) 9941 { 9942 return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type, 9943 status, 9944 MGMT_OP_USER_CONFIRM_NEG_REPLY); 9945 } 9946 9947 int mgmt_user_passkey_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr, 9948 u8 link_type, u8 addr_type, u8 status) 9949 { 9950 return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type, 9951 status, MGMT_OP_USER_PASSKEY_REPLY); 9952 } 9953 9954 int mgmt_user_passkey_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr, 9955 u8 link_type, u8 addr_type, u8 status) 9956 { 9957 return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type, 9958 status, 9959 MGMT_OP_USER_PASSKEY_NEG_REPLY); 9960 } 9961 9962 int mgmt_user_passkey_notify(struct hci_dev *hdev, bdaddr_t *bdaddr, 9963 u8 link_type, u8 addr_type, u32 passkey, 9964 u8 entered) 9965 { 9966 struct mgmt_ev_passkey_notify ev; 9967 9968 bt_dev_dbg(hdev, "bdaddr %pMR", bdaddr); 9969 9970 bacpy(&ev.addr.bdaddr, bdaddr); 9971 ev.addr.type = link_to_bdaddr(link_type, addr_type); 9972 ev.passkey = __cpu_to_le32(passkey); 9973 ev.entered = entered; 9974 9975 return mgmt_event(MGMT_EV_PASSKEY_NOTIFY, hdev, &ev, sizeof(ev), NULL); 9976 } 9977 9978 void mgmt_auth_failed(struct hci_conn *conn, u8 hci_status) 9979 { 9980 struct mgmt_ev_auth_failed ev; 9981 struct mgmt_pending_cmd *cmd; 9982 u8 status = mgmt_status(hci_status); 9983 9984 bacpy(&ev.addr.bdaddr, &conn->dst); 9985 ev.addr.type = link_to_bdaddr(conn->type, conn->dst_type); 9986 ev.status = status; 9987 9988 cmd = find_pairing(conn); 9989 9990 mgmt_event(MGMT_EV_AUTH_FAILED, conn->hdev, &ev, sizeof(ev), 9991 cmd ? cmd->sk : NULL); 9992 9993 if (cmd) { 9994 cmd->cmd_complete(cmd, status); 9995 mgmt_pending_remove(cmd); 9996 } 9997 } 9998 9999 void mgmt_auth_enable_complete(struct hci_dev *hdev, u8 status) 10000 { 10001 struct cmd_lookup match = { NULL, hdev }; 10002 bool changed; 10003 10004 if (status) { 10005 u8 mgmt_err = mgmt_status(status); 10006 mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev, 10007 cmd_status_rsp, &mgmt_err); 10008 return; 10009 } 10010 10011 if (test_bit(HCI_AUTH, &hdev->flags)) 10012 changed = !hci_dev_test_and_set_flag(hdev, HCI_LINK_SECURITY); 10013 else 10014 changed = hci_dev_test_and_clear_flag(hdev, HCI_LINK_SECURITY); 10015 10016 mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev, settings_rsp, 10017 &match); 10018 10019 if (changed) 10020 new_settings(hdev, match.sk); 10021 10022 if (match.sk) 10023 sock_put(match.sk); 10024 } 10025 10026 static void sk_lookup(struct mgmt_pending_cmd *cmd, void *data) 10027 { 10028 struct cmd_lookup *match = data; 10029 10030 if (match->sk == NULL) { 10031 match->sk = cmd->sk; 10032 sock_hold(match->sk); 10033 } 10034 } 10035 10036 void mgmt_set_class_of_dev_complete(struct hci_dev *hdev, u8 *dev_class, 10037 u8 status) 10038 { 10039 struct cmd_lookup match = { NULL, hdev, mgmt_status(status) }; 10040 10041 mgmt_pending_foreach(MGMT_OP_SET_DEV_CLASS, hdev, sk_lookup, &match); 10042 mgmt_pending_foreach(MGMT_OP_ADD_UUID, hdev, sk_lookup, &match); 10043 mgmt_pending_foreach(MGMT_OP_REMOVE_UUID, hdev, sk_lookup, &match); 10044 10045 if (!status) { 10046 mgmt_limited_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev, dev_class, 10047 3, HCI_MGMT_DEV_CLASS_EVENTS, NULL); 10048 ext_info_changed(hdev, NULL); 10049 } 10050 10051 if (match.sk) 10052 sock_put(match.sk); 10053 } 10054 10055 void mgmt_set_local_name_complete(struct hci_dev *hdev, u8 *name, u8 status) 10056 { 10057 struct mgmt_cp_set_local_name ev; 10058 struct mgmt_pending_cmd *cmd; 10059 10060 if (status) 10061 return; 10062 10063 memset(&ev, 0, sizeof(ev)); 10064 memcpy(ev.name, name, HCI_MAX_NAME_LENGTH); 10065 memcpy(ev.short_name, hdev->short_name, HCI_MAX_SHORT_NAME_LENGTH); 10066 10067 cmd = pending_find(MGMT_OP_SET_LOCAL_NAME, hdev); 10068 if (!cmd) { 10069 memcpy(hdev->dev_name, name, sizeof(hdev->dev_name)); 10070 10071 /* If this is a HCI command related to powering on the 10072 * HCI dev don't send any mgmt signals. 10073 */ 10074 if (pending_find(MGMT_OP_SET_POWERED, hdev)) 10075 return; 10076 } 10077 10078 mgmt_limited_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, &ev, sizeof(ev), 10079 HCI_MGMT_LOCAL_NAME_EVENTS, cmd ? cmd->sk : NULL); 10080 ext_info_changed(hdev, cmd ? cmd->sk : NULL); 10081 } 10082 10083 static inline bool has_uuid(u8 *uuid, u16 uuid_count, u8 (*uuids)[16]) 10084 { 10085 int i; 10086 10087 for (i = 0; i < uuid_count; i++) { 10088 if (!memcmp(uuid, uuids[i], 16)) 10089 return true; 10090 } 10091 10092 return false; 10093 } 10094 10095 static bool eir_has_uuids(u8 *eir, u16 eir_len, u16 uuid_count, u8 (*uuids)[16]) 10096 { 10097 u16 parsed = 0; 10098 10099 while (parsed < eir_len) { 10100 u8 field_len = eir[0]; 10101 u8 uuid[16]; 10102 int i; 10103 10104 if (field_len == 0) 10105 break; 10106 10107 if (eir_len - parsed < field_len + 1) 10108 break; 10109 10110 switch (eir[1]) { 10111 case EIR_UUID16_ALL: 10112 case EIR_UUID16_SOME: 10113 for (i = 0; i + 3 <= field_len; i += 2) { 10114 memcpy(uuid, bluetooth_base_uuid, 16); 10115 uuid[13] = eir[i + 3]; 10116 uuid[12] = eir[i + 2]; 10117 if (has_uuid(uuid, uuid_count, uuids)) 10118 return true; 10119 } 10120 break; 10121 case EIR_UUID32_ALL: 10122 case EIR_UUID32_SOME: 10123 for (i = 0; i + 5 <= field_len; i += 4) { 10124 memcpy(uuid, bluetooth_base_uuid, 16); 10125 uuid[15] = eir[i + 5]; 10126 uuid[14] = eir[i + 4]; 10127 uuid[13] = eir[i + 3]; 10128 uuid[12] = eir[i + 2]; 10129 if (has_uuid(uuid, uuid_count, uuids)) 10130 return true; 10131 } 10132 break; 10133 case EIR_UUID128_ALL: 10134 case EIR_UUID128_SOME: 10135 for (i = 0; i + 17 <= field_len; i += 16) { 10136 memcpy(uuid, eir + i + 2, 16); 10137 if (has_uuid(uuid, uuid_count, uuids)) 10138 return true; 10139 } 10140 break; 10141 } 10142 10143 parsed += field_len + 1; 10144 eir += field_len + 1; 10145 } 10146 10147 return false; 10148 } 10149 10150 static void restart_le_scan(struct hci_dev *hdev) 10151 { 10152 /* If controller is not scanning we are done. */ 10153 if (!hci_dev_test_flag(hdev, HCI_LE_SCAN)) 10154 return; 10155 10156 if (time_after(jiffies + DISCOV_LE_RESTART_DELAY, 10157 hdev->discovery.scan_start + 10158 hdev->discovery.scan_duration)) 10159 return; 10160 10161 queue_delayed_work(hdev->req_workqueue, &hdev->le_scan_restart, 10162 DISCOV_LE_RESTART_DELAY); 10163 } 10164 10165 static bool is_filter_match(struct hci_dev *hdev, s8 rssi, u8 *eir, 10166 u16 eir_len, u8 *scan_rsp, u8 scan_rsp_len) 10167 { 10168 /* If a RSSI threshold has been specified, and 10169 * HCI_QUIRK_STRICT_DUPLICATE_FILTER is not set, then all results with 10170 * a RSSI smaller than the RSSI threshold will be dropped. If the quirk 10171 * is set, let it through for further processing, as we might need to 10172 * restart the scan. 10173 * 10174 * For BR/EDR devices (pre 1.2) providing no RSSI during inquiry, 10175 * the results are also dropped. 10176 */ 10177 if (hdev->discovery.rssi != HCI_RSSI_INVALID && 10178 (rssi == HCI_RSSI_INVALID || 10179 (rssi < hdev->discovery.rssi && 10180 !test_bit(HCI_QUIRK_STRICT_DUPLICATE_FILTER, &hdev->quirks)))) 10181 return false; 10182 10183 if (hdev->discovery.uuid_count != 0) { 10184 /* If a list of UUIDs is provided in filter, results with no 10185 * matching UUID should be dropped. 10186 */ 10187 if (!eir_has_uuids(eir, eir_len, hdev->discovery.uuid_count, 10188 hdev->discovery.uuids) && 10189 !eir_has_uuids(scan_rsp, scan_rsp_len, 10190 hdev->discovery.uuid_count, 10191 hdev->discovery.uuids)) 10192 return false; 10193 } 10194 10195 /* If duplicate filtering does not report RSSI changes, then restart 10196 * scanning to ensure updated result with updated RSSI values. 10197 */ 10198 if (test_bit(HCI_QUIRK_STRICT_DUPLICATE_FILTER, &hdev->quirks)) { 10199 restart_le_scan(hdev); 10200 10201 /* Validate RSSI value against the RSSI threshold once more. */ 10202 if (hdev->discovery.rssi != HCI_RSSI_INVALID && 10203 rssi < hdev->discovery.rssi) 10204 return false; 10205 } 10206 10207 return true; 10208 } 10209 10210 void mgmt_adv_monitor_device_lost(struct hci_dev *hdev, u16 handle, 10211 bdaddr_t *bdaddr, u8 addr_type) 10212 { 10213 struct mgmt_ev_adv_monitor_device_lost ev; 10214 10215 ev.monitor_handle = cpu_to_le16(handle); 10216 bacpy(&ev.addr.bdaddr, bdaddr); 10217 ev.addr.type = addr_type; 10218 10219 mgmt_event(MGMT_EV_ADV_MONITOR_DEVICE_LOST, hdev, &ev, sizeof(ev), 10220 NULL); 10221 } 10222 10223 static void mgmt_send_adv_monitor_device_found(struct hci_dev *hdev, 10224 struct sk_buff *skb, 10225 struct sock *skip_sk, 10226 u16 handle) 10227 { 10228 struct sk_buff *advmon_skb; 10229 size_t advmon_skb_len; 10230 __le16 *monitor_handle; 10231 10232 if (!skb) 10233 return; 10234 10235 advmon_skb_len = (sizeof(struct mgmt_ev_adv_monitor_device_found) - 10236 sizeof(struct mgmt_ev_device_found)) + skb->len; 10237 advmon_skb = mgmt_alloc_skb(hdev, MGMT_EV_ADV_MONITOR_DEVICE_FOUND, 10238 advmon_skb_len); 10239 if (!advmon_skb) 10240 return; 10241 10242 /* ADV_MONITOR_DEVICE_FOUND is similar to DEVICE_FOUND event except 10243 * that it also has 'monitor_handle'. Make a copy of DEVICE_FOUND and 10244 * store monitor_handle of the matched monitor. 10245 */ 10246 monitor_handle = skb_put(advmon_skb, sizeof(*monitor_handle)); 10247 *monitor_handle = cpu_to_le16(handle); 10248 skb_put_data(advmon_skb, skb->data, skb->len); 10249 10250 mgmt_event_skb(advmon_skb, skip_sk); 10251 } 10252 10253 static void mgmt_adv_monitor_device_found(struct hci_dev *hdev, 10254 bdaddr_t *bdaddr, bool report_device, 10255 struct sk_buff *skb, 10256 struct sock *skip_sk) 10257 { 10258 struct monitored_device *dev, *tmp; 10259 bool matched = false; 10260 bool notified = false; 10261 10262 /* We have received the Advertisement Report because: 10263 * 1. the kernel has initiated active discovery 10264 * 2. if not, we have pend_le_reports > 0 in which case we are doing 10265 * passive scanning 10266 * 3. if none of the above is true, we have one or more active 10267 * Advertisement Monitor 10268 * 10269 * For case 1 and 2, report all advertisements via MGMT_EV_DEVICE_FOUND 10270 * and report ONLY one advertisement per device for the matched Monitor 10271 * via MGMT_EV_ADV_MONITOR_DEVICE_FOUND event. 10272 * 10273 * For case 3, since we are not active scanning and all advertisements 10274 * received are due to a matched Advertisement Monitor, report all 10275 * advertisements ONLY via MGMT_EV_ADV_MONITOR_DEVICE_FOUND event. 10276 */ 10277 if (report_device && !hdev->advmon_pend_notify) { 10278 mgmt_event_skb(skb, skip_sk); 10279 return; 10280 } 10281 10282 hdev->advmon_pend_notify = false; 10283 10284 list_for_each_entry_safe(dev, tmp, &hdev->monitored_devices, list) { 10285 if (!bacmp(&dev->bdaddr, bdaddr)) { 10286 matched = true; 10287 10288 if (!dev->notified) { 10289 mgmt_send_adv_monitor_device_found(hdev, skb, 10290 skip_sk, 10291 dev->handle); 10292 notified = true; 10293 dev->notified = true; 10294 } 10295 } 10296 10297 if (!dev->notified) 10298 hdev->advmon_pend_notify = true; 10299 } 10300 10301 if (!report_device && 10302 ((matched && !notified) || !msft_monitor_supported(hdev))) { 10303 /* Handle 0 indicates that we are not active scanning and this 10304 * is a subsequent advertisement report for an already matched 10305 * Advertisement Monitor or the controller offloading support 10306 * is not available. 10307 */ 10308 mgmt_send_adv_monitor_device_found(hdev, skb, skip_sk, 0); 10309 } 10310 10311 if (report_device) 10312 mgmt_event_skb(skb, skip_sk); 10313 else 10314 kfree_skb(skb); 10315 } 10316 10317 static void mesh_device_found(struct hci_dev *hdev, bdaddr_t *bdaddr, 10318 u8 addr_type, s8 rssi, u32 flags, u8 *eir, 10319 u16 eir_len, u8 *scan_rsp, u8 scan_rsp_len, 10320 u64 instant) 10321 { 10322 struct sk_buff *skb; 10323 struct mgmt_ev_mesh_device_found *ev; 10324 int i, j; 10325 10326 if (!hdev->mesh_ad_types[0]) 10327 goto accepted; 10328 10329 /* Scan for requested AD types */ 10330 if (eir_len > 0) { 10331 for (i = 0; i + 1 < eir_len; i += eir[i] + 1) { 10332 for (j = 0; j < sizeof(hdev->mesh_ad_types); j++) { 10333 if (!hdev->mesh_ad_types[j]) 10334 break; 10335 10336 if (hdev->mesh_ad_types[j] == eir[i + 1]) 10337 goto accepted; 10338 } 10339 } 10340 } 10341 10342 if (scan_rsp_len > 0) { 10343 for (i = 0; i + 1 < scan_rsp_len; i += scan_rsp[i] + 1) { 10344 for (j = 0; j < sizeof(hdev->mesh_ad_types); j++) { 10345 if (!hdev->mesh_ad_types[j]) 10346 break; 10347 10348 if (hdev->mesh_ad_types[j] == scan_rsp[i + 1]) 10349 goto accepted; 10350 } 10351 } 10352 } 10353 10354 return; 10355 10356 accepted: 10357 skb = mgmt_alloc_skb(hdev, MGMT_EV_MESH_DEVICE_FOUND, 10358 sizeof(*ev) + eir_len + scan_rsp_len); 10359 if (!skb) 10360 return; 10361 10362 ev = skb_put(skb, sizeof(*ev)); 10363 10364 bacpy(&ev->addr.bdaddr, bdaddr); 10365 ev->addr.type = link_to_bdaddr(LE_LINK, addr_type); 10366 ev->rssi = rssi; 10367 ev->flags = cpu_to_le32(flags); 10368 ev->instant = cpu_to_le64(instant); 10369 10370 if (eir_len > 0) 10371 /* Copy EIR or advertising data into event */ 10372 skb_put_data(skb, eir, eir_len); 10373 10374 if (scan_rsp_len > 0) 10375 /* Append scan response data to event */ 10376 skb_put_data(skb, scan_rsp, scan_rsp_len); 10377 10378 ev->eir_len = cpu_to_le16(eir_len + scan_rsp_len); 10379 10380 mgmt_event_skb(skb, NULL); 10381 } 10382 10383 void mgmt_device_found(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type, 10384 u8 addr_type, u8 *dev_class, s8 rssi, u32 flags, 10385 u8 *eir, u16 eir_len, u8 *scan_rsp, u8 scan_rsp_len, 10386 u64 instant) 10387 { 10388 struct sk_buff *skb; 10389 struct mgmt_ev_device_found *ev; 10390 bool report_device = hci_discovery_active(hdev); 10391 10392 if (hci_dev_test_flag(hdev, HCI_MESH) && link_type == LE_LINK) 10393 mesh_device_found(hdev, bdaddr, addr_type, rssi, flags, 10394 eir, eir_len, scan_rsp, scan_rsp_len, 10395 instant); 10396 10397 /* Don't send events for a non-kernel initiated discovery. With 10398 * LE one exception is if we have pend_le_reports > 0 in which 10399 * case we're doing passive scanning and want these events. 10400 */ 10401 if (!hci_discovery_active(hdev)) { 10402 if (link_type == ACL_LINK) 10403 return; 10404 if (link_type == LE_LINK && !list_empty(&hdev->pend_le_reports)) 10405 report_device = true; 10406 else if (!hci_is_adv_monitoring(hdev)) 10407 return; 10408 } 10409 10410 if (hdev->discovery.result_filtering) { 10411 /* We are using service discovery */ 10412 if (!is_filter_match(hdev, rssi, eir, eir_len, scan_rsp, 10413 scan_rsp_len)) 10414 return; 10415 } 10416 10417 if (hdev->discovery.limited) { 10418 /* Check for limited discoverable bit */ 10419 if (dev_class) { 10420 if (!(dev_class[1] & 0x20)) 10421 return; 10422 } else { 10423 u8 *flags = eir_get_data(eir, eir_len, EIR_FLAGS, NULL); 10424 if (!flags || !(flags[0] & LE_AD_LIMITED)) 10425 return; 10426 } 10427 } 10428 10429 /* Allocate skb. The 5 extra bytes are for the potential CoD field */ 10430 skb = mgmt_alloc_skb(hdev, MGMT_EV_DEVICE_FOUND, 10431 sizeof(*ev) + eir_len + scan_rsp_len + 5); 10432 if (!skb) 10433 return; 10434 10435 ev = skb_put(skb, sizeof(*ev)); 10436 10437 /* In case of device discovery with BR/EDR devices (pre 1.2), the 10438 * RSSI value was reported as 0 when not available. This behavior 10439 * is kept when using device discovery. This is required for full 10440 * backwards compatibility with the API. 10441 * 10442 * However when using service discovery, the value 127 will be 10443 * returned when the RSSI is not available. 10444 */ 10445 if (rssi == HCI_RSSI_INVALID && !hdev->discovery.report_invalid_rssi && 10446 link_type == ACL_LINK) 10447 rssi = 0; 10448 10449 bacpy(&ev->addr.bdaddr, bdaddr); 10450 ev->addr.type = link_to_bdaddr(link_type, addr_type); 10451 ev->rssi = rssi; 10452 ev->flags = cpu_to_le32(flags); 10453 10454 if (eir_len > 0) 10455 /* Copy EIR or advertising data into event */ 10456 skb_put_data(skb, eir, eir_len); 10457 10458 if (dev_class && !eir_get_data(eir, eir_len, EIR_CLASS_OF_DEV, NULL)) { 10459 u8 eir_cod[5]; 10460 10461 eir_len += eir_append_data(eir_cod, 0, EIR_CLASS_OF_DEV, 10462 dev_class, 3); 10463 skb_put_data(skb, eir_cod, sizeof(eir_cod)); 10464 } 10465 10466 if (scan_rsp_len > 0) 10467 /* Append scan response data to event */ 10468 skb_put_data(skb, scan_rsp, scan_rsp_len); 10469 10470 ev->eir_len = cpu_to_le16(eir_len + scan_rsp_len); 10471 10472 mgmt_adv_monitor_device_found(hdev, bdaddr, report_device, skb, NULL); 10473 } 10474 10475 void mgmt_remote_name(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type, 10476 u8 addr_type, s8 rssi, u8 *name, u8 name_len) 10477 { 10478 struct sk_buff *skb; 10479 struct mgmt_ev_device_found *ev; 10480 u16 eir_len = 0; 10481 u32 flags = 0; 10482 10483 skb = mgmt_alloc_skb(hdev, MGMT_EV_DEVICE_FOUND, 10484 sizeof(*ev) + (name ? eir_precalc_len(name_len) : 0)); 10485 10486 ev = skb_put(skb, sizeof(*ev)); 10487 bacpy(&ev->addr.bdaddr, bdaddr); 10488 ev->addr.type = link_to_bdaddr(link_type, addr_type); 10489 ev->rssi = rssi; 10490 10491 if (name) 10492 eir_len += eir_skb_put_data(skb, EIR_NAME_COMPLETE, name, name_len); 10493 else 10494 flags = MGMT_DEV_FOUND_NAME_REQUEST_FAILED; 10495 10496 ev->eir_len = cpu_to_le16(eir_len); 10497 ev->flags = cpu_to_le32(flags); 10498 10499 mgmt_event_skb(skb, NULL); 10500 } 10501 10502 void mgmt_discovering(struct hci_dev *hdev, u8 discovering) 10503 { 10504 struct mgmt_ev_discovering ev; 10505 10506 bt_dev_dbg(hdev, "discovering %u", discovering); 10507 10508 memset(&ev, 0, sizeof(ev)); 10509 ev.type = hdev->discovery.type; 10510 ev.discovering = discovering; 10511 10512 mgmt_event(MGMT_EV_DISCOVERING, hdev, &ev, sizeof(ev), NULL); 10513 } 10514 10515 void mgmt_suspending(struct hci_dev *hdev, u8 state) 10516 { 10517 struct mgmt_ev_controller_suspend ev; 10518 10519 ev.suspend_state = state; 10520 mgmt_event(MGMT_EV_CONTROLLER_SUSPEND, hdev, &ev, sizeof(ev), NULL); 10521 } 10522 10523 void mgmt_resuming(struct hci_dev *hdev, u8 reason, bdaddr_t *bdaddr, 10524 u8 addr_type) 10525 { 10526 struct mgmt_ev_controller_resume ev; 10527 10528 ev.wake_reason = reason; 10529 if (bdaddr) { 10530 bacpy(&ev.addr.bdaddr, bdaddr); 10531 ev.addr.type = addr_type; 10532 } else { 10533 memset(&ev.addr, 0, sizeof(ev.addr)); 10534 } 10535 10536 mgmt_event(MGMT_EV_CONTROLLER_RESUME, hdev, &ev, sizeof(ev), NULL); 10537 } 10538 10539 static struct hci_mgmt_chan chan = { 10540 .channel = HCI_CHANNEL_CONTROL, 10541 .handler_count = ARRAY_SIZE(mgmt_handlers), 10542 .handlers = mgmt_handlers, 10543 .hdev_init = mgmt_init_hdev, 10544 }; 10545 10546 int mgmt_init(void) 10547 { 10548 return hci_mgmt_chan_register(&chan); 10549 } 10550 10551 void mgmt_exit(void) 10552 { 10553 hci_mgmt_chan_unregister(&chan); 10554 } 10555 10556 void mgmt_cleanup(struct sock *sk) 10557 { 10558 struct mgmt_mesh_tx *mesh_tx; 10559 struct hci_dev *hdev; 10560 10561 read_lock(&hci_dev_list_lock); 10562 10563 list_for_each_entry(hdev, &hci_dev_list, list) { 10564 do { 10565 mesh_tx = mgmt_mesh_next(hdev, sk); 10566 10567 if (mesh_tx) 10568 mesh_send_complete(hdev, mesh_tx, true); 10569 } while (mesh_tx); 10570 } 10571 10572 read_unlock(&hci_dev_list_lock); 10573 } 10574