1 /* 2 BlueZ - Bluetooth protocol stack for Linux 3 4 Copyright (C) 2010 Nokia Corporation 5 Copyright (C) 2011-2012 Intel Corporation 6 7 This program is free software; you can redistribute it and/or modify 8 it under the terms of the GNU General Public License version 2 as 9 published by the Free Software Foundation; 10 11 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS 12 OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 13 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS. 14 IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY 15 CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES 16 WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN 17 ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF 18 OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. 19 20 ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS, 21 COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS 22 SOFTWARE IS DISCLAIMED. 23 */ 24 25 /* Bluetooth HCI Management interface */ 26 27 #include <linux/module.h> 28 #include <asm/unaligned.h> 29 30 #include <net/bluetooth/bluetooth.h> 31 #include <net/bluetooth/hci_core.h> 32 #include <net/bluetooth/hci_sock.h> 33 #include <net/bluetooth/l2cap.h> 34 #include <net/bluetooth/mgmt.h> 35 36 #include "hci_request.h" 37 #include "smp.h" 38 #include "mgmt_util.h" 39 #include "mgmt_config.h" 40 #include "msft.h" 41 #include "eir.h" 42 #include "aosp.h" 43 44 #define MGMT_VERSION 1 45 #define MGMT_REVISION 22 46 47 static const u16 mgmt_commands[] = { 48 MGMT_OP_READ_INDEX_LIST, 49 MGMT_OP_READ_INFO, 50 MGMT_OP_SET_POWERED, 51 MGMT_OP_SET_DISCOVERABLE, 52 MGMT_OP_SET_CONNECTABLE, 53 MGMT_OP_SET_FAST_CONNECTABLE, 54 MGMT_OP_SET_BONDABLE, 55 MGMT_OP_SET_LINK_SECURITY, 56 MGMT_OP_SET_SSP, 57 MGMT_OP_SET_HS, 58 MGMT_OP_SET_LE, 59 MGMT_OP_SET_DEV_CLASS, 60 MGMT_OP_SET_LOCAL_NAME, 61 MGMT_OP_ADD_UUID, 62 MGMT_OP_REMOVE_UUID, 63 MGMT_OP_LOAD_LINK_KEYS, 64 MGMT_OP_LOAD_LONG_TERM_KEYS, 65 MGMT_OP_DISCONNECT, 66 MGMT_OP_GET_CONNECTIONS, 67 MGMT_OP_PIN_CODE_REPLY, 68 MGMT_OP_PIN_CODE_NEG_REPLY, 69 MGMT_OP_SET_IO_CAPABILITY, 70 MGMT_OP_PAIR_DEVICE, 71 MGMT_OP_CANCEL_PAIR_DEVICE, 72 MGMT_OP_UNPAIR_DEVICE, 73 MGMT_OP_USER_CONFIRM_REPLY, 74 MGMT_OP_USER_CONFIRM_NEG_REPLY, 75 MGMT_OP_USER_PASSKEY_REPLY, 76 MGMT_OP_USER_PASSKEY_NEG_REPLY, 77 MGMT_OP_READ_LOCAL_OOB_DATA, 78 MGMT_OP_ADD_REMOTE_OOB_DATA, 79 MGMT_OP_REMOVE_REMOTE_OOB_DATA, 80 MGMT_OP_START_DISCOVERY, 81 MGMT_OP_STOP_DISCOVERY, 82 MGMT_OP_CONFIRM_NAME, 83 MGMT_OP_BLOCK_DEVICE, 84 MGMT_OP_UNBLOCK_DEVICE, 85 MGMT_OP_SET_DEVICE_ID, 86 MGMT_OP_SET_ADVERTISING, 87 MGMT_OP_SET_BREDR, 88 MGMT_OP_SET_STATIC_ADDRESS, 89 MGMT_OP_SET_SCAN_PARAMS, 90 MGMT_OP_SET_SECURE_CONN, 91 MGMT_OP_SET_DEBUG_KEYS, 92 MGMT_OP_SET_PRIVACY, 93 MGMT_OP_LOAD_IRKS, 94 MGMT_OP_GET_CONN_INFO, 95 MGMT_OP_GET_CLOCK_INFO, 96 MGMT_OP_ADD_DEVICE, 97 MGMT_OP_REMOVE_DEVICE, 98 MGMT_OP_LOAD_CONN_PARAM, 99 MGMT_OP_READ_UNCONF_INDEX_LIST, 100 MGMT_OP_READ_CONFIG_INFO, 101 MGMT_OP_SET_EXTERNAL_CONFIG, 102 MGMT_OP_SET_PUBLIC_ADDRESS, 103 MGMT_OP_START_SERVICE_DISCOVERY, 104 MGMT_OP_READ_LOCAL_OOB_EXT_DATA, 105 MGMT_OP_READ_EXT_INDEX_LIST, 106 MGMT_OP_READ_ADV_FEATURES, 107 MGMT_OP_ADD_ADVERTISING, 108 MGMT_OP_REMOVE_ADVERTISING, 109 MGMT_OP_GET_ADV_SIZE_INFO, 110 MGMT_OP_START_LIMITED_DISCOVERY, 111 MGMT_OP_READ_EXT_INFO, 112 MGMT_OP_SET_APPEARANCE, 113 MGMT_OP_GET_PHY_CONFIGURATION, 114 MGMT_OP_SET_PHY_CONFIGURATION, 115 MGMT_OP_SET_BLOCKED_KEYS, 116 MGMT_OP_SET_WIDEBAND_SPEECH, 117 MGMT_OP_READ_CONTROLLER_CAP, 118 MGMT_OP_READ_EXP_FEATURES_INFO, 119 MGMT_OP_SET_EXP_FEATURE, 120 MGMT_OP_READ_DEF_SYSTEM_CONFIG, 121 MGMT_OP_SET_DEF_SYSTEM_CONFIG, 122 MGMT_OP_READ_DEF_RUNTIME_CONFIG, 123 MGMT_OP_SET_DEF_RUNTIME_CONFIG, 124 MGMT_OP_GET_DEVICE_FLAGS, 125 MGMT_OP_SET_DEVICE_FLAGS, 126 MGMT_OP_READ_ADV_MONITOR_FEATURES, 127 MGMT_OP_ADD_ADV_PATTERNS_MONITOR, 128 MGMT_OP_REMOVE_ADV_MONITOR, 129 MGMT_OP_ADD_EXT_ADV_PARAMS, 130 MGMT_OP_ADD_EXT_ADV_DATA, 131 MGMT_OP_ADD_ADV_PATTERNS_MONITOR_RSSI, 132 MGMT_OP_SET_MESH_RECEIVER, 133 MGMT_OP_MESH_READ_FEATURES, 134 MGMT_OP_MESH_SEND, 135 MGMT_OP_MESH_SEND_CANCEL, 136 }; 137 138 static const u16 mgmt_events[] = { 139 MGMT_EV_CONTROLLER_ERROR, 140 MGMT_EV_INDEX_ADDED, 141 MGMT_EV_INDEX_REMOVED, 142 MGMT_EV_NEW_SETTINGS, 143 MGMT_EV_CLASS_OF_DEV_CHANGED, 144 MGMT_EV_LOCAL_NAME_CHANGED, 145 MGMT_EV_NEW_LINK_KEY, 146 MGMT_EV_NEW_LONG_TERM_KEY, 147 MGMT_EV_DEVICE_CONNECTED, 148 MGMT_EV_DEVICE_DISCONNECTED, 149 MGMT_EV_CONNECT_FAILED, 150 MGMT_EV_PIN_CODE_REQUEST, 151 MGMT_EV_USER_CONFIRM_REQUEST, 152 MGMT_EV_USER_PASSKEY_REQUEST, 153 MGMT_EV_AUTH_FAILED, 154 MGMT_EV_DEVICE_FOUND, 155 MGMT_EV_DISCOVERING, 156 MGMT_EV_DEVICE_BLOCKED, 157 MGMT_EV_DEVICE_UNBLOCKED, 158 MGMT_EV_DEVICE_UNPAIRED, 159 MGMT_EV_PASSKEY_NOTIFY, 160 MGMT_EV_NEW_IRK, 161 MGMT_EV_NEW_CSRK, 162 MGMT_EV_DEVICE_ADDED, 163 MGMT_EV_DEVICE_REMOVED, 164 MGMT_EV_NEW_CONN_PARAM, 165 MGMT_EV_UNCONF_INDEX_ADDED, 166 MGMT_EV_UNCONF_INDEX_REMOVED, 167 MGMT_EV_NEW_CONFIG_OPTIONS, 168 MGMT_EV_EXT_INDEX_ADDED, 169 MGMT_EV_EXT_INDEX_REMOVED, 170 MGMT_EV_LOCAL_OOB_DATA_UPDATED, 171 MGMT_EV_ADVERTISING_ADDED, 172 MGMT_EV_ADVERTISING_REMOVED, 173 MGMT_EV_EXT_INFO_CHANGED, 174 MGMT_EV_PHY_CONFIGURATION_CHANGED, 175 MGMT_EV_EXP_FEATURE_CHANGED, 176 MGMT_EV_DEVICE_FLAGS_CHANGED, 177 MGMT_EV_ADV_MONITOR_ADDED, 178 MGMT_EV_ADV_MONITOR_REMOVED, 179 MGMT_EV_CONTROLLER_SUSPEND, 180 MGMT_EV_CONTROLLER_RESUME, 181 MGMT_EV_ADV_MONITOR_DEVICE_FOUND, 182 MGMT_EV_ADV_MONITOR_DEVICE_LOST, 183 }; 184 185 static const u16 mgmt_untrusted_commands[] = { 186 MGMT_OP_READ_INDEX_LIST, 187 MGMT_OP_READ_INFO, 188 MGMT_OP_READ_UNCONF_INDEX_LIST, 189 MGMT_OP_READ_CONFIG_INFO, 190 MGMT_OP_READ_EXT_INDEX_LIST, 191 MGMT_OP_READ_EXT_INFO, 192 MGMT_OP_READ_CONTROLLER_CAP, 193 MGMT_OP_READ_EXP_FEATURES_INFO, 194 MGMT_OP_READ_DEF_SYSTEM_CONFIG, 195 MGMT_OP_READ_DEF_RUNTIME_CONFIG, 196 }; 197 198 static const u16 mgmt_untrusted_events[] = { 199 MGMT_EV_INDEX_ADDED, 200 MGMT_EV_INDEX_REMOVED, 201 MGMT_EV_NEW_SETTINGS, 202 MGMT_EV_CLASS_OF_DEV_CHANGED, 203 MGMT_EV_LOCAL_NAME_CHANGED, 204 MGMT_EV_UNCONF_INDEX_ADDED, 205 MGMT_EV_UNCONF_INDEX_REMOVED, 206 MGMT_EV_NEW_CONFIG_OPTIONS, 207 MGMT_EV_EXT_INDEX_ADDED, 208 MGMT_EV_EXT_INDEX_REMOVED, 209 MGMT_EV_EXT_INFO_CHANGED, 210 MGMT_EV_EXP_FEATURE_CHANGED, 211 }; 212 213 #define CACHE_TIMEOUT msecs_to_jiffies(2 * 1000) 214 215 #define ZERO_KEY "\x00\x00\x00\x00\x00\x00\x00\x00" \ 216 "\x00\x00\x00\x00\x00\x00\x00\x00" 217 218 /* HCI to MGMT error code conversion table */ 219 static const u8 mgmt_status_table[] = { 220 MGMT_STATUS_SUCCESS, 221 MGMT_STATUS_UNKNOWN_COMMAND, /* Unknown Command */ 222 MGMT_STATUS_NOT_CONNECTED, /* No Connection */ 223 MGMT_STATUS_FAILED, /* Hardware Failure */ 224 MGMT_STATUS_CONNECT_FAILED, /* Page Timeout */ 225 MGMT_STATUS_AUTH_FAILED, /* Authentication Failed */ 226 MGMT_STATUS_AUTH_FAILED, /* PIN or Key Missing */ 227 MGMT_STATUS_NO_RESOURCES, /* Memory Full */ 228 MGMT_STATUS_TIMEOUT, /* Connection Timeout */ 229 MGMT_STATUS_NO_RESOURCES, /* Max Number of Connections */ 230 MGMT_STATUS_NO_RESOURCES, /* Max Number of SCO Connections */ 231 MGMT_STATUS_ALREADY_CONNECTED, /* ACL Connection Exists */ 232 MGMT_STATUS_BUSY, /* Command Disallowed */ 233 MGMT_STATUS_NO_RESOURCES, /* Rejected Limited Resources */ 234 MGMT_STATUS_REJECTED, /* Rejected Security */ 235 MGMT_STATUS_REJECTED, /* Rejected Personal */ 236 MGMT_STATUS_TIMEOUT, /* Host Timeout */ 237 MGMT_STATUS_NOT_SUPPORTED, /* Unsupported Feature */ 238 MGMT_STATUS_INVALID_PARAMS, /* Invalid Parameters */ 239 MGMT_STATUS_DISCONNECTED, /* OE User Ended Connection */ 240 MGMT_STATUS_NO_RESOURCES, /* OE Low Resources */ 241 MGMT_STATUS_DISCONNECTED, /* OE Power Off */ 242 MGMT_STATUS_DISCONNECTED, /* Connection Terminated */ 243 MGMT_STATUS_BUSY, /* Repeated Attempts */ 244 MGMT_STATUS_REJECTED, /* Pairing Not Allowed */ 245 MGMT_STATUS_FAILED, /* Unknown LMP PDU */ 246 MGMT_STATUS_NOT_SUPPORTED, /* Unsupported Remote Feature */ 247 MGMT_STATUS_REJECTED, /* SCO Offset Rejected */ 248 MGMT_STATUS_REJECTED, /* SCO Interval Rejected */ 249 MGMT_STATUS_REJECTED, /* Air Mode Rejected */ 250 MGMT_STATUS_INVALID_PARAMS, /* Invalid LMP Parameters */ 251 MGMT_STATUS_FAILED, /* Unspecified Error */ 252 MGMT_STATUS_NOT_SUPPORTED, /* Unsupported LMP Parameter Value */ 253 MGMT_STATUS_FAILED, /* Role Change Not Allowed */ 254 MGMT_STATUS_TIMEOUT, /* LMP Response Timeout */ 255 MGMT_STATUS_FAILED, /* LMP Error Transaction Collision */ 256 MGMT_STATUS_FAILED, /* LMP PDU Not Allowed */ 257 MGMT_STATUS_REJECTED, /* Encryption Mode Not Accepted */ 258 MGMT_STATUS_FAILED, /* Unit Link Key Used */ 259 MGMT_STATUS_NOT_SUPPORTED, /* QoS Not Supported */ 260 MGMT_STATUS_TIMEOUT, /* Instant Passed */ 261 MGMT_STATUS_NOT_SUPPORTED, /* Pairing Not Supported */ 262 MGMT_STATUS_FAILED, /* Transaction Collision */ 263 MGMT_STATUS_FAILED, /* Reserved for future use */ 264 MGMT_STATUS_INVALID_PARAMS, /* Unacceptable Parameter */ 265 MGMT_STATUS_REJECTED, /* QoS Rejected */ 266 MGMT_STATUS_NOT_SUPPORTED, /* Classification Not Supported */ 267 MGMT_STATUS_REJECTED, /* Insufficient Security */ 268 MGMT_STATUS_INVALID_PARAMS, /* Parameter Out Of Range */ 269 MGMT_STATUS_FAILED, /* Reserved for future use */ 270 MGMT_STATUS_BUSY, /* Role Switch Pending */ 271 MGMT_STATUS_FAILED, /* Reserved for future use */ 272 MGMT_STATUS_FAILED, /* Slot Violation */ 273 MGMT_STATUS_FAILED, /* Role Switch Failed */ 274 MGMT_STATUS_INVALID_PARAMS, /* EIR Too Large */ 275 MGMT_STATUS_NOT_SUPPORTED, /* Simple Pairing Not Supported */ 276 MGMT_STATUS_BUSY, /* Host Busy Pairing */ 277 MGMT_STATUS_REJECTED, /* Rejected, No Suitable Channel */ 278 MGMT_STATUS_BUSY, /* Controller Busy */ 279 MGMT_STATUS_INVALID_PARAMS, /* Unsuitable Connection Interval */ 280 MGMT_STATUS_TIMEOUT, /* Directed Advertising Timeout */ 281 MGMT_STATUS_AUTH_FAILED, /* Terminated Due to MIC Failure */ 282 MGMT_STATUS_CONNECT_FAILED, /* Connection Establishment Failed */ 283 MGMT_STATUS_CONNECT_FAILED, /* MAC Connection Failed */ 284 }; 285 286 static u8 mgmt_errno_status(int err) 287 { 288 switch (err) { 289 case 0: 290 return MGMT_STATUS_SUCCESS; 291 case -EPERM: 292 return MGMT_STATUS_REJECTED; 293 case -EINVAL: 294 return MGMT_STATUS_INVALID_PARAMS; 295 case -EOPNOTSUPP: 296 return MGMT_STATUS_NOT_SUPPORTED; 297 case -EBUSY: 298 return MGMT_STATUS_BUSY; 299 case -ETIMEDOUT: 300 return MGMT_STATUS_AUTH_FAILED; 301 case -ENOMEM: 302 return MGMT_STATUS_NO_RESOURCES; 303 case -EISCONN: 304 return MGMT_STATUS_ALREADY_CONNECTED; 305 case -ENOTCONN: 306 return MGMT_STATUS_DISCONNECTED; 307 } 308 309 return MGMT_STATUS_FAILED; 310 } 311 312 static u8 mgmt_status(int err) 313 { 314 if (err < 0) 315 return mgmt_errno_status(err); 316 317 if (err < ARRAY_SIZE(mgmt_status_table)) 318 return mgmt_status_table[err]; 319 320 return MGMT_STATUS_FAILED; 321 } 322 323 static int mgmt_index_event(u16 event, struct hci_dev *hdev, void *data, 324 u16 len, int flag) 325 { 326 return mgmt_send_event(event, hdev, HCI_CHANNEL_CONTROL, data, len, 327 flag, NULL); 328 } 329 330 static int mgmt_limited_event(u16 event, struct hci_dev *hdev, void *data, 331 u16 len, int flag, struct sock *skip_sk) 332 { 333 return mgmt_send_event(event, hdev, HCI_CHANNEL_CONTROL, data, len, 334 flag, skip_sk); 335 } 336 337 static int mgmt_event(u16 event, struct hci_dev *hdev, void *data, u16 len, 338 struct sock *skip_sk) 339 { 340 return mgmt_send_event(event, hdev, HCI_CHANNEL_CONTROL, data, len, 341 HCI_SOCK_TRUSTED, skip_sk); 342 } 343 344 static int mgmt_event_skb(struct sk_buff *skb, struct sock *skip_sk) 345 { 346 return mgmt_send_event_skb(HCI_CHANNEL_CONTROL, skb, HCI_SOCK_TRUSTED, 347 skip_sk); 348 } 349 350 static u8 le_addr_type(u8 mgmt_addr_type) 351 { 352 if (mgmt_addr_type == BDADDR_LE_PUBLIC) 353 return ADDR_LE_DEV_PUBLIC; 354 else 355 return ADDR_LE_DEV_RANDOM; 356 } 357 358 void mgmt_fill_version_info(void *ver) 359 { 360 struct mgmt_rp_read_version *rp = ver; 361 362 rp->version = MGMT_VERSION; 363 rp->revision = cpu_to_le16(MGMT_REVISION); 364 } 365 366 static int read_version(struct sock *sk, struct hci_dev *hdev, void *data, 367 u16 data_len) 368 { 369 struct mgmt_rp_read_version rp; 370 371 bt_dev_dbg(hdev, "sock %p", sk); 372 373 mgmt_fill_version_info(&rp); 374 375 return mgmt_cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_VERSION, 0, 376 &rp, sizeof(rp)); 377 } 378 379 static int read_commands(struct sock *sk, struct hci_dev *hdev, void *data, 380 u16 data_len) 381 { 382 struct mgmt_rp_read_commands *rp; 383 u16 num_commands, num_events; 384 size_t rp_size; 385 int i, err; 386 387 bt_dev_dbg(hdev, "sock %p", sk); 388 389 if (hci_sock_test_flag(sk, HCI_SOCK_TRUSTED)) { 390 num_commands = ARRAY_SIZE(mgmt_commands); 391 num_events = ARRAY_SIZE(mgmt_events); 392 } else { 393 num_commands = ARRAY_SIZE(mgmt_untrusted_commands); 394 num_events = ARRAY_SIZE(mgmt_untrusted_events); 395 } 396 397 rp_size = sizeof(*rp) + ((num_commands + num_events) * sizeof(u16)); 398 399 rp = kmalloc(rp_size, GFP_KERNEL); 400 if (!rp) 401 return -ENOMEM; 402 403 rp->num_commands = cpu_to_le16(num_commands); 404 rp->num_events = cpu_to_le16(num_events); 405 406 if (hci_sock_test_flag(sk, HCI_SOCK_TRUSTED)) { 407 __le16 *opcode = rp->opcodes; 408 409 for (i = 0; i < num_commands; i++, opcode++) 410 put_unaligned_le16(mgmt_commands[i], opcode); 411 412 for (i = 0; i < num_events; i++, opcode++) 413 put_unaligned_le16(mgmt_events[i], opcode); 414 } else { 415 __le16 *opcode = rp->opcodes; 416 417 for (i = 0; i < num_commands; i++, opcode++) 418 put_unaligned_le16(mgmt_untrusted_commands[i], opcode); 419 420 for (i = 0; i < num_events; i++, opcode++) 421 put_unaligned_le16(mgmt_untrusted_events[i], opcode); 422 } 423 424 err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_COMMANDS, 0, 425 rp, rp_size); 426 kfree(rp); 427 428 return err; 429 } 430 431 static int read_index_list(struct sock *sk, struct hci_dev *hdev, void *data, 432 u16 data_len) 433 { 434 struct mgmt_rp_read_index_list *rp; 435 struct hci_dev *d; 436 size_t rp_len; 437 u16 count; 438 int err; 439 440 bt_dev_dbg(hdev, "sock %p", sk); 441 442 read_lock(&hci_dev_list_lock); 443 444 count = 0; 445 list_for_each_entry(d, &hci_dev_list, list) { 446 if (d->dev_type == HCI_PRIMARY && 447 !hci_dev_test_flag(d, HCI_UNCONFIGURED)) 448 count++; 449 } 450 451 rp_len = sizeof(*rp) + (2 * count); 452 rp = kmalloc(rp_len, GFP_ATOMIC); 453 if (!rp) { 454 read_unlock(&hci_dev_list_lock); 455 return -ENOMEM; 456 } 457 458 count = 0; 459 list_for_each_entry(d, &hci_dev_list, list) { 460 if (hci_dev_test_flag(d, HCI_SETUP) || 461 hci_dev_test_flag(d, HCI_CONFIG) || 462 hci_dev_test_flag(d, HCI_USER_CHANNEL)) 463 continue; 464 465 /* Devices marked as raw-only are neither configured 466 * nor unconfigured controllers. 467 */ 468 if (test_bit(HCI_QUIRK_RAW_DEVICE, &d->quirks)) 469 continue; 470 471 if (d->dev_type == HCI_PRIMARY && 472 !hci_dev_test_flag(d, HCI_UNCONFIGURED)) { 473 rp->index[count++] = cpu_to_le16(d->id); 474 bt_dev_dbg(hdev, "Added hci%u", d->id); 475 } 476 } 477 478 rp->num_controllers = cpu_to_le16(count); 479 rp_len = sizeof(*rp) + (2 * count); 480 481 read_unlock(&hci_dev_list_lock); 482 483 err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_INDEX_LIST, 484 0, rp, rp_len); 485 486 kfree(rp); 487 488 return err; 489 } 490 491 static int read_unconf_index_list(struct sock *sk, struct hci_dev *hdev, 492 void *data, u16 data_len) 493 { 494 struct mgmt_rp_read_unconf_index_list *rp; 495 struct hci_dev *d; 496 size_t rp_len; 497 u16 count; 498 int err; 499 500 bt_dev_dbg(hdev, "sock %p", sk); 501 502 read_lock(&hci_dev_list_lock); 503 504 count = 0; 505 list_for_each_entry(d, &hci_dev_list, list) { 506 if (d->dev_type == HCI_PRIMARY && 507 hci_dev_test_flag(d, HCI_UNCONFIGURED)) 508 count++; 509 } 510 511 rp_len = sizeof(*rp) + (2 * count); 512 rp = kmalloc(rp_len, GFP_ATOMIC); 513 if (!rp) { 514 read_unlock(&hci_dev_list_lock); 515 return -ENOMEM; 516 } 517 518 count = 0; 519 list_for_each_entry(d, &hci_dev_list, list) { 520 if (hci_dev_test_flag(d, HCI_SETUP) || 521 hci_dev_test_flag(d, HCI_CONFIG) || 522 hci_dev_test_flag(d, HCI_USER_CHANNEL)) 523 continue; 524 525 /* Devices marked as raw-only are neither configured 526 * nor unconfigured controllers. 527 */ 528 if (test_bit(HCI_QUIRK_RAW_DEVICE, &d->quirks)) 529 continue; 530 531 if (d->dev_type == HCI_PRIMARY && 532 hci_dev_test_flag(d, HCI_UNCONFIGURED)) { 533 rp->index[count++] = cpu_to_le16(d->id); 534 bt_dev_dbg(hdev, "Added hci%u", d->id); 535 } 536 } 537 538 rp->num_controllers = cpu_to_le16(count); 539 rp_len = sizeof(*rp) + (2 * count); 540 541 read_unlock(&hci_dev_list_lock); 542 543 err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE, 544 MGMT_OP_READ_UNCONF_INDEX_LIST, 0, rp, rp_len); 545 546 kfree(rp); 547 548 return err; 549 } 550 551 static int read_ext_index_list(struct sock *sk, struct hci_dev *hdev, 552 void *data, u16 data_len) 553 { 554 struct mgmt_rp_read_ext_index_list *rp; 555 struct hci_dev *d; 556 u16 count; 557 int err; 558 559 bt_dev_dbg(hdev, "sock %p", sk); 560 561 read_lock(&hci_dev_list_lock); 562 563 count = 0; 564 list_for_each_entry(d, &hci_dev_list, list) { 565 if (d->dev_type == HCI_PRIMARY || d->dev_type == HCI_AMP) 566 count++; 567 } 568 569 rp = kmalloc(struct_size(rp, entry, count), GFP_ATOMIC); 570 if (!rp) { 571 read_unlock(&hci_dev_list_lock); 572 return -ENOMEM; 573 } 574 575 count = 0; 576 list_for_each_entry(d, &hci_dev_list, list) { 577 if (hci_dev_test_flag(d, HCI_SETUP) || 578 hci_dev_test_flag(d, HCI_CONFIG) || 579 hci_dev_test_flag(d, HCI_USER_CHANNEL)) 580 continue; 581 582 /* Devices marked as raw-only are neither configured 583 * nor unconfigured controllers. 584 */ 585 if (test_bit(HCI_QUIRK_RAW_DEVICE, &d->quirks)) 586 continue; 587 588 if (d->dev_type == HCI_PRIMARY) { 589 if (hci_dev_test_flag(d, HCI_UNCONFIGURED)) 590 rp->entry[count].type = 0x01; 591 else 592 rp->entry[count].type = 0x00; 593 } else if (d->dev_type == HCI_AMP) { 594 rp->entry[count].type = 0x02; 595 } else { 596 continue; 597 } 598 599 rp->entry[count].bus = d->bus; 600 rp->entry[count++].index = cpu_to_le16(d->id); 601 bt_dev_dbg(hdev, "Added hci%u", d->id); 602 } 603 604 rp->num_controllers = cpu_to_le16(count); 605 606 read_unlock(&hci_dev_list_lock); 607 608 /* If this command is called at least once, then all the 609 * default index and unconfigured index events are disabled 610 * and from now on only extended index events are used. 611 */ 612 hci_sock_set_flag(sk, HCI_MGMT_EXT_INDEX_EVENTS); 613 hci_sock_clear_flag(sk, HCI_MGMT_INDEX_EVENTS); 614 hci_sock_clear_flag(sk, HCI_MGMT_UNCONF_INDEX_EVENTS); 615 616 err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE, 617 MGMT_OP_READ_EXT_INDEX_LIST, 0, rp, 618 struct_size(rp, entry, count)); 619 620 kfree(rp); 621 622 return err; 623 } 624 625 static bool is_configured(struct hci_dev *hdev) 626 { 627 if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks) && 628 !hci_dev_test_flag(hdev, HCI_EXT_CONFIGURED)) 629 return false; 630 631 if ((test_bit(HCI_QUIRK_INVALID_BDADDR, &hdev->quirks) || 632 test_bit(HCI_QUIRK_USE_BDADDR_PROPERTY, &hdev->quirks)) && 633 !bacmp(&hdev->public_addr, BDADDR_ANY)) 634 return false; 635 636 return true; 637 } 638 639 static __le32 get_missing_options(struct hci_dev *hdev) 640 { 641 u32 options = 0; 642 643 if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks) && 644 !hci_dev_test_flag(hdev, HCI_EXT_CONFIGURED)) 645 options |= MGMT_OPTION_EXTERNAL_CONFIG; 646 647 if ((test_bit(HCI_QUIRK_INVALID_BDADDR, &hdev->quirks) || 648 test_bit(HCI_QUIRK_USE_BDADDR_PROPERTY, &hdev->quirks)) && 649 !bacmp(&hdev->public_addr, BDADDR_ANY)) 650 options |= MGMT_OPTION_PUBLIC_ADDRESS; 651 652 return cpu_to_le32(options); 653 } 654 655 static int new_options(struct hci_dev *hdev, struct sock *skip) 656 { 657 __le32 options = get_missing_options(hdev); 658 659 return mgmt_limited_event(MGMT_EV_NEW_CONFIG_OPTIONS, hdev, &options, 660 sizeof(options), HCI_MGMT_OPTION_EVENTS, skip); 661 } 662 663 static int send_options_rsp(struct sock *sk, u16 opcode, struct hci_dev *hdev) 664 { 665 __le32 options = get_missing_options(hdev); 666 667 return mgmt_cmd_complete(sk, hdev->id, opcode, 0, &options, 668 sizeof(options)); 669 } 670 671 static int read_config_info(struct sock *sk, struct hci_dev *hdev, 672 void *data, u16 data_len) 673 { 674 struct mgmt_rp_read_config_info rp; 675 u32 options = 0; 676 677 bt_dev_dbg(hdev, "sock %p", sk); 678 679 hci_dev_lock(hdev); 680 681 memset(&rp, 0, sizeof(rp)); 682 rp.manufacturer = cpu_to_le16(hdev->manufacturer); 683 684 if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks)) 685 options |= MGMT_OPTION_EXTERNAL_CONFIG; 686 687 if (hdev->set_bdaddr) 688 options |= MGMT_OPTION_PUBLIC_ADDRESS; 689 690 rp.supported_options = cpu_to_le32(options); 691 rp.missing_options = get_missing_options(hdev); 692 693 hci_dev_unlock(hdev); 694 695 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_CONFIG_INFO, 0, 696 &rp, sizeof(rp)); 697 } 698 699 static u32 get_supported_phys(struct hci_dev *hdev) 700 { 701 u32 supported_phys = 0; 702 703 if (lmp_bredr_capable(hdev)) { 704 supported_phys |= MGMT_PHY_BR_1M_1SLOT; 705 706 if (hdev->features[0][0] & LMP_3SLOT) 707 supported_phys |= MGMT_PHY_BR_1M_3SLOT; 708 709 if (hdev->features[0][0] & LMP_5SLOT) 710 supported_phys |= MGMT_PHY_BR_1M_5SLOT; 711 712 if (lmp_edr_2m_capable(hdev)) { 713 supported_phys |= MGMT_PHY_EDR_2M_1SLOT; 714 715 if (lmp_edr_3slot_capable(hdev)) 716 supported_phys |= MGMT_PHY_EDR_2M_3SLOT; 717 718 if (lmp_edr_5slot_capable(hdev)) 719 supported_phys |= MGMT_PHY_EDR_2M_5SLOT; 720 721 if (lmp_edr_3m_capable(hdev)) { 722 supported_phys |= MGMT_PHY_EDR_3M_1SLOT; 723 724 if (lmp_edr_3slot_capable(hdev)) 725 supported_phys |= MGMT_PHY_EDR_3M_3SLOT; 726 727 if (lmp_edr_5slot_capable(hdev)) 728 supported_phys |= MGMT_PHY_EDR_3M_5SLOT; 729 } 730 } 731 } 732 733 if (lmp_le_capable(hdev)) { 734 supported_phys |= MGMT_PHY_LE_1M_TX; 735 supported_phys |= MGMT_PHY_LE_1M_RX; 736 737 if (hdev->le_features[1] & HCI_LE_PHY_2M) { 738 supported_phys |= MGMT_PHY_LE_2M_TX; 739 supported_phys |= MGMT_PHY_LE_2M_RX; 740 } 741 742 if (hdev->le_features[1] & HCI_LE_PHY_CODED) { 743 supported_phys |= MGMT_PHY_LE_CODED_TX; 744 supported_phys |= MGMT_PHY_LE_CODED_RX; 745 } 746 } 747 748 return supported_phys; 749 } 750 751 static u32 get_selected_phys(struct hci_dev *hdev) 752 { 753 u32 selected_phys = 0; 754 755 if (lmp_bredr_capable(hdev)) { 756 selected_phys |= MGMT_PHY_BR_1M_1SLOT; 757 758 if (hdev->pkt_type & (HCI_DM3 | HCI_DH3)) 759 selected_phys |= MGMT_PHY_BR_1M_3SLOT; 760 761 if (hdev->pkt_type & (HCI_DM5 | HCI_DH5)) 762 selected_phys |= MGMT_PHY_BR_1M_5SLOT; 763 764 if (lmp_edr_2m_capable(hdev)) { 765 if (!(hdev->pkt_type & HCI_2DH1)) 766 selected_phys |= MGMT_PHY_EDR_2M_1SLOT; 767 768 if (lmp_edr_3slot_capable(hdev) && 769 !(hdev->pkt_type & HCI_2DH3)) 770 selected_phys |= MGMT_PHY_EDR_2M_3SLOT; 771 772 if (lmp_edr_5slot_capable(hdev) && 773 !(hdev->pkt_type & HCI_2DH5)) 774 selected_phys |= MGMT_PHY_EDR_2M_5SLOT; 775 776 if (lmp_edr_3m_capable(hdev)) { 777 if (!(hdev->pkt_type & HCI_3DH1)) 778 selected_phys |= MGMT_PHY_EDR_3M_1SLOT; 779 780 if (lmp_edr_3slot_capable(hdev) && 781 !(hdev->pkt_type & HCI_3DH3)) 782 selected_phys |= MGMT_PHY_EDR_3M_3SLOT; 783 784 if (lmp_edr_5slot_capable(hdev) && 785 !(hdev->pkt_type & HCI_3DH5)) 786 selected_phys |= MGMT_PHY_EDR_3M_5SLOT; 787 } 788 } 789 } 790 791 if (lmp_le_capable(hdev)) { 792 if (hdev->le_tx_def_phys & HCI_LE_SET_PHY_1M) 793 selected_phys |= MGMT_PHY_LE_1M_TX; 794 795 if (hdev->le_rx_def_phys & HCI_LE_SET_PHY_1M) 796 selected_phys |= MGMT_PHY_LE_1M_RX; 797 798 if (hdev->le_tx_def_phys & HCI_LE_SET_PHY_2M) 799 selected_phys |= MGMT_PHY_LE_2M_TX; 800 801 if (hdev->le_rx_def_phys & HCI_LE_SET_PHY_2M) 802 selected_phys |= MGMT_PHY_LE_2M_RX; 803 804 if (hdev->le_tx_def_phys & HCI_LE_SET_PHY_CODED) 805 selected_phys |= MGMT_PHY_LE_CODED_TX; 806 807 if (hdev->le_rx_def_phys & HCI_LE_SET_PHY_CODED) 808 selected_phys |= MGMT_PHY_LE_CODED_RX; 809 } 810 811 return selected_phys; 812 } 813 814 static u32 get_configurable_phys(struct hci_dev *hdev) 815 { 816 return (get_supported_phys(hdev) & ~MGMT_PHY_BR_1M_1SLOT & 817 ~MGMT_PHY_LE_1M_TX & ~MGMT_PHY_LE_1M_RX); 818 } 819 820 static u32 get_supported_settings(struct hci_dev *hdev) 821 { 822 u32 settings = 0; 823 824 settings |= MGMT_SETTING_POWERED; 825 settings |= MGMT_SETTING_BONDABLE; 826 settings |= MGMT_SETTING_DEBUG_KEYS; 827 settings |= MGMT_SETTING_CONNECTABLE; 828 settings |= MGMT_SETTING_DISCOVERABLE; 829 830 if (lmp_bredr_capable(hdev)) { 831 if (hdev->hci_ver >= BLUETOOTH_VER_1_2) 832 settings |= MGMT_SETTING_FAST_CONNECTABLE; 833 settings |= MGMT_SETTING_BREDR; 834 settings |= MGMT_SETTING_LINK_SECURITY; 835 836 if (lmp_ssp_capable(hdev)) { 837 settings |= MGMT_SETTING_SSP; 838 if (IS_ENABLED(CONFIG_BT_HS)) 839 settings |= MGMT_SETTING_HS; 840 } 841 842 if (lmp_sc_capable(hdev)) 843 settings |= MGMT_SETTING_SECURE_CONN; 844 845 if (test_bit(HCI_QUIRK_WIDEBAND_SPEECH_SUPPORTED, 846 &hdev->quirks)) 847 settings |= MGMT_SETTING_WIDEBAND_SPEECH; 848 } 849 850 if (lmp_le_capable(hdev)) { 851 settings |= MGMT_SETTING_LE; 852 settings |= MGMT_SETTING_SECURE_CONN; 853 settings |= MGMT_SETTING_PRIVACY; 854 settings |= MGMT_SETTING_STATIC_ADDRESS; 855 settings |= MGMT_SETTING_ADVERTISING; 856 } 857 858 if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks) || 859 hdev->set_bdaddr) 860 settings |= MGMT_SETTING_CONFIGURATION; 861 862 if (cis_central_capable(hdev)) 863 settings |= MGMT_SETTING_CIS_CENTRAL; 864 865 if (cis_peripheral_capable(hdev)) 866 settings |= MGMT_SETTING_CIS_PERIPHERAL; 867 868 settings |= MGMT_SETTING_PHY_CONFIGURATION; 869 870 return settings; 871 } 872 873 static u32 get_current_settings(struct hci_dev *hdev) 874 { 875 u32 settings = 0; 876 877 if (hdev_is_powered(hdev)) 878 settings |= MGMT_SETTING_POWERED; 879 880 if (hci_dev_test_flag(hdev, HCI_CONNECTABLE)) 881 settings |= MGMT_SETTING_CONNECTABLE; 882 883 if (hci_dev_test_flag(hdev, HCI_FAST_CONNECTABLE)) 884 settings |= MGMT_SETTING_FAST_CONNECTABLE; 885 886 if (hci_dev_test_flag(hdev, HCI_DISCOVERABLE)) 887 settings |= MGMT_SETTING_DISCOVERABLE; 888 889 if (hci_dev_test_flag(hdev, HCI_BONDABLE)) 890 settings |= MGMT_SETTING_BONDABLE; 891 892 if (hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) 893 settings |= MGMT_SETTING_BREDR; 894 895 if (hci_dev_test_flag(hdev, HCI_LE_ENABLED)) 896 settings |= MGMT_SETTING_LE; 897 898 if (hci_dev_test_flag(hdev, HCI_LINK_SECURITY)) 899 settings |= MGMT_SETTING_LINK_SECURITY; 900 901 if (hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) 902 settings |= MGMT_SETTING_SSP; 903 904 if (hci_dev_test_flag(hdev, HCI_HS_ENABLED)) 905 settings |= MGMT_SETTING_HS; 906 907 if (hci_dev_test_flag(hdev, HCI_ADVERTISING)) 908 settings |= MGMT_SETTING_ADVERTISING; 909 910 if (hci_dev_test_flag(hdev, HCI_SC_ENABLED)) 911 settings |= MGMT_SETTING_SECURE_CONN; 912 913 if (hci_dev_test_flag(hdev, HCI_KEEP_DEBUG_KEYS)) 914 settings |= MGMT_SETTING_DEBUG_KEYS; 915 916 if (hci_dev_test_flag(hdev, HCI_PRIVACY)) 917 settings |= MGMT_SETTING_PRIVACY; 918 919 /* The current setting for static address has two purposes. The 920 * first is to indicate if the static address will be used and 921 * the second is to indicate if it is actually set. 922 * 923 * This means if the static address is not configured, this flag 924 * will never be set. If the address is configured, then if the 925 * address is actually used decides if the flag is set or not. 926 * 927 * For single mode LE only controllers and dual-mode controllers 928 * with BR/EDR disabled, the existence of the static address will 929 * be evaluated. 930 */ 931 if (hci_dev_test_flag(hdev, HCI_FORCE_STATIC_ADDR) || 932 !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) || 933 !bacmp(&hdev->bdaddr, BDADDR_ANY)) { 934 if (bacmp(&hdev->static_addr, BDADDR_ANY)) 935 settings |= MGMT_SETTING_STATIC_ADDRESS; 936 } 937 938 if (hci_dev_test_flag(hdev, HCI_WIDEBAND_SPEECH_ENABLED)) 939 settings |= MGMT_SETTING_WIDEBAND_SPEECH; 940 941 if (cis_central_capable(hdev)) 942 settings |= MGMT_SETTING_CIS_CENTRAL; 943 944 if (cis_peripheral_capable(hdev)) 945 settings |= MGMT_SETTING_CIS_PERIPHERAL; 946 947 return settings; 948 } 949 950 static struct mgmt_pending_cmd *pending_find(u16 opcode, struct hci_dev *hdev) 951 { 952 return mgmt_pending_find(HCI_CHANNEL_CONTROL, opcode, hdev); 953 } 954 955 u8 mgmt_get_adv_discov_flags(struct hci_dev *hdev) 956 { 957 struct mgmt_pending_cmd *cmd; 958 959 /* If there's a pending mgmt command the flags will not yet have 960 * their final values, so check for this first. 961 */ 962 cmd = pending_find(MGMT_OP_SET_DISCOVERABLE, hdev); 963 if (cmd) { 964 struct mgmt_mode *cp = cmd->param; 965 if (cp->val == 0x01) 966 return LE_AD_GENERAL; 967 else if (cp->val == 0x02) 968 return LE_AD_LIMITED; 969 } else { 970 if (hci_dev_test_flag(hdev, HCI_LIMITED_DISCOVERABLE)) 971 return LE_AD_LIMITED; 972 else if (hci_dev_test_flag(hdev, HCI_DISCOVERABLE)) 973 return LE_AD_GENERAL; 974 } 975 976 return 0; 977 } 978 979 bool mgmt_get_connectable(struct hci_dev *hdev) 980 { 981 struct mgmt_pending_cmd *cmd; 982 983 /* If there's a pending mgmt command the flag will not yet have 984 * it's final value, so check for this first. 985 */ 986 cmd = pending_find(MGMT_OP_SET_CONNECTABLE, hdev); 987 if (cmd) { 988 struct mgmt_mode *cp = cmd->param; 989 990 return cp->val; 991 } 992 993 return hci_dev_test_flag(hdev, HCI_CONNECTABLE); 994 } 995 996 static int service_cache_sync(struct hci_dev *hdev, void *data) 997 { 998 hci_update_eir_sync(hdev); 999 hci_update_class_sync(hdev); 1000 1001 return 0; 1002 } 1003 1004 static void service_cache_off(struct work_struct *work) 1005 { 1006 struct hci_dev *hdev = container_of(work, struct hci_dev, 1007 service_cache.work); 1008 1009 if (!hci_dev_test_and_clear_flag(hdev, HCI_SERVICE_CACHE)) 1010 return; 1011 1012 hci_cmd_sync_queue(hdev, service_cache_sync, NULL, NULL); 1013 } 1014 1015 static int rpa_expired_sync(struct hci_dev *hdev, void *data) 1016 { 1017 /* The generation of a new RPA and programming it into the 1018 * controller happens in the hci_req_enable_advertising() 1019 * function. 1020 */ 1021 if (ext_adv_capable(hdev)) 1022 return hci_start_ext_adv_sync(hdev, hdev->cur_adv_instance); 1023 else 1024 return hci_enable_advertising_sync(hdev); 1025 } 1026 1027 static void rpa_expired(struct work_struct *work) 1028 { 1029 struct hci_dev *hdev = container_of(work, struct hci_dev, 1030 rpa_expired.work); 1031 1032 bt_dev_dbg(hdev, ""); 1033 1034 hci_dev_set_flag(hdev, HCI_RPA_EXPIRED); 1035 1036 if (!hci_dev_test_flag(hdev, HCI_ADVERTISING)) 1037 return; 1038 1039 hci_cmd_sync_queue(hdev, rpa_expired_sync, NULL, NULL); 1040 } 1041 1042 static void discov_off(struct work_struct *work) 1043 { 1044 struct hci_dev *hdev = container_of(work, struct hci_dev, 1045 discov_off.work); 1046 1047 bt_dev_dbg(hdev, ""); 1048 1049 hci_dev_lock(hdev); 1050 1051 /* When discoverable timeout triggers, then just make sure 1052 * the limited discoverable flag is cleared. Even in the case 1053 * of a timeout triggered from general discoverable, it is 1054 * safe to unconditionally clear the flag. 1055 */ 1056 hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE); 1057 hci_dev_clear_flag(hdev, HCI_DISCOVERABLE); 1058 hdev->discov_timeout = 0; 1059 1060 hci_update_discoverable(hdev); 1061 1062 mgmt_new_settings(hdev); 1063 1064 hci_dev_unlock(hdev); 1065 } 1066 1067 static int send_settings_rsp(struct sock *sk, u16 opcode, struct hci_dev *hdev); 1068 1069 static void mesh_send_complete(struct hci_dev *hdev, 1070 struct mgmt_mesh_tx *mesh_tx, bool silent) 1071 { 1072 u8 handle = mesh_tx->handle; 1073 1074 if (!silent) 1075 mgmt_event(MGMT_EV_MESH_PACKET_CMPLT, hdev, &handle, 1076 sizeof(handle), NULL); 1077 1078 mgmt_mesh_remove(mesh_tx); 1079 } 1080 1081 static int mesh_send_done_sync(struct hci_dev *hdev, void *data) 1082 { 1083 struct mgmt_mesh_tx *mesh_tx; 1084 1085 hci_dev_clear_flag(hdev, HCI_MESH_SENDING); 1086 hci_disable_advertising_sync(hdev); 1087 mesh_tx = mgmt_mesh_next(hdev, NULL); 1088 1089 if (mesh_tx) 1090 mesh_send_complete(hdev, mesh_tx, false); 1091 1092 return 0; 1093 } 1094 1095 static int mesh_send_sync(struct hci_dev *hdev, void *data); 1096 static void mesh_send_start_complete(struct hci_dev *hdev, void *data, int err); 1097 static void mesh_next(struct hci_dev *hdev, void *data, int err) 1098 { 1099 struct mgmt_mesh_tx *mesh_tx = mgmt_mesh_next(hdev, NULL); 1100 1101 if (!mesh_tx) 1102 return; 1103 1104 err = hci_cmd_sync_queue(hdev, mesh_send_sync, mesh_tx, 1105 mesh_send_start_complete); 1106 1107 if (err < 0) 1108 mesh_send_complete(hdev, mesh_tx, false); 1109 else 1110 hci_dev_set_flag(hdev, HCI_MESH_SENDING); 1111 } 1112 1113 static void mesh_send_done(struct work_struct *work) 1114 { 1115 struct hci_dev *hdev = container_of(work, struct hci_dev, 1116 mesh_send_done.work); 1117 1118 if (!hci_dev_test_flag(hdev, HCI_MESH_SENDING)) 1119 return; 1120 1121 hci_cmd_sync_queue(hdev, mesh_send_done_sync, NULL, mesh_next); 1122 } 1123 1124 static void mgmt_init_hdev(struct sock *sk, struct hci_dev *hdev) 1125 { 1126 if (hci_dev_test_flag(hdev, HCI_MGMT)) 1127 return; 1128 1129 BT_INFO("MGMT ver %d.%d", MGMT_VERSION, MGMT_REVISION); 1130 1131 INIT_DELAYED_WORK(&hdev->discov_off, discov_off); 1132 INIT_DELAYED_WORK(&hdev->service_cache, service_cache_off); 1133 INIT_DELAYED_WORK(&hdev->rpa_expired, rpa_expired); 1134 INIT_DELAYED_WORK(&hdev->mesh_send_done, mesh_send_done); 1135 1136 /* Non-mgmt controlled devices get this bit set 1137 * implicitly so that pairing works for them, however 1138 * for mgmt we require user-space to explicitly enable 1139 * it 1140 */ 1141 hci_dev_clear_flag(hdev, HCI_BONDABLE); 1142 1143 hci_dev_set_flag(hdev, HCI_MGMT); 1144 } 1145 1146 static int read_controller_info(struct sock *sk, struct hci_dev *hdev, 1147 void *data, u16 data_len) 1148 { 1149 struct mgmt_rp_read_info rp; 1150 1151 bt_dev_dbg(hdev, "sock %p", sk); 1152 1153 hci_dev_lock(hdev); 1154 1155 memset(&rp, 0, sizeof(rp)); 1156 1157 bacpy(&rp.bdaddr, &hdev->bdaddr); 1158 1159 rp.version = hdev->hci_ver; 1160 rp.manufacturer = cpu_to_le16(hdev->manufacturer); 1161 1162 rp.supported_settings = cpu_to_le32(get_supported_settings(hdev)); 1163 rp.current_settings = cpu_to_le32(get_current_settings(hdev)); 1164 1165 memcpy(rp.dev_class, hdev->dev_class, 3); 1166 1167 memcpy(rp.name, hdev->dev_name, sizeof(hdev->dev_name)); 1168 memcpy(rp.short_name, hdev->short_name, sizeof(hdev->short_name)); 1169 1170 hci_dev_unlock(hdev); 1171 1172 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_INFO, 0, &rp, 1173 sizeof(rp)); 1174 } 1175 1176 static u16 append_eir_data_to_buf(struct hci_dev *hdev, u8 *eir) 1177 { 1178 u16 eir_len = 0; 1179 size_t name_len; 1180 1181 if (hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) 1182 eir_len = eir_append_data(eir, eir_len, EIR_CLASS_OF_DEV, 1183 hdev->dev_class, 3); 1184 1185 if (hci_dev_test_flag(hdev, HCI_LE_ENABLED)) 1186 eir_len = eir_append_le16(eir, eir_len, EIR_APPEARANCE, 1187 hdev->appearance); 1188 1189 name_len = strnlen(hdev->dev_name, sizeof(hdev->dev_name)); 1190 eir_len = eir_append_data(eir, eir_len, EIR_NAME_COMPLETE, 1191 hdev->dev_name, name_len); 1192 1193 name_len = strnlen(hdev->short_name, sizeof(hdev->short_name)); 1194 eir_len = eir_append_data(eir, eir_len, EIR_NAME_SHORT, 1195 hdev->short_name, name_len); 1196 1197 return eir_len; 1198 } 1199 1200 static int read_ext_controller_info(struct sock *sk, struct hci_dev *hdev, 1201 void *data, u16 data_len) 1202 { 1203 char buf[512]; 1204 struct mgmt_rp_read_ext_info *rp = (void *)buf; 1205 u16 eir_len; 1206 1207 bt_dev_dbg(hdev, "sock %p", sk); 1208 1209 memset(&buf, 0, sizeof(buf)); 1210 1211 hci_dev_lock(hdev); 1212 1213 bacpy(&rp->bdaddr, &hdev->bdaddr); 1214 1215 rp->version = hdev->hci_ver; 1216 rp->manufacturer = cpu_to_le16(hdev->manufacturer); 1217 1218 rp->supported_settings = cpu_to_le32(get_supported_settings(hdev)); 1219 rp->current_settings = cpu_to_le32(get_current_settings(hdev)); 1220 1221 1222 eir_len = append_eir_data_to_buf(hdev, rp->eir); 1223 rp->eir_len = cpu_to_le16(eir_len); 1224 1225 hci_dev_unlock(hdev); 1226 1227 /* If this command is called at least once, then the events 1228 * for class of device and local name changes are disabled 1229 * and only the new extended controller information event 1230 * is used. 1231 */ 1232 hci_sock_set_flag(sk, HCI_MGMT_EXT_INFO_EVENTS); 1233 hci_sock_clear_flag(sk, HCI_MGMT_DEV_CLASS_EVENTS); 1234 hci_sock_clear_flag(sk, HCI_MGMT_LOCAL_NAME_EVENTS); 1235 1236 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_EXT_INFO, 0, rp, 1237 sizeof(*rp) + eir_len); 1238 } 1239 1240 static int ext_info_changed(struct hci_dev *hdev, struct sock *skip) 1241 { 1242 char buf[512]; 1243 struct mgmt_ev_ext_info_changed *ev = (void *)buf; 1244 u16 eir_len; 1245 1246 memset(buf, 0, sizeof(buf)); 1247 1248 eir_len = append_eir_data_to_buf(hdev, ev->eir); 1249 ev->eir_len = cpu_to_le16(eir_len); 1250 1251 return mgmt_limited_event(MGMT_EV_EXT_INFO_CHANGED, hdev, ev, 1252 sizeof(*ev) + eir_len, 1253 HCI_MGMT_EXT_INFO_EVENTS, skip); 1254 } 1255 1256 static int send_settings_rsp(struct sock *sk, u16 opcode, struct hci_dev *hdev) 1257 { 1258 __le32 settings = cpu_to_le32(get_current_settings(hdev)); 1259 1260 return mgmt_cmd_complete(sk, hdev->id, opcode, 0, &settings, 1261 sizeof(settings)); 1262 } 1263 1264 void mgmt_advertising_added(struct sock *sk, struct hci_dev *hdev, u8 instance) 1265 { 1266 struct mgmt_ev_advertising_added ev; 1267 1268 ev.instance = instance; 1269 1270 mgmt_event(MGMT_EV_ADVERTISING_ADDED, hdev, &ev, sizeof(ev), sk); 1271 } 1272 1273 void mgmt_advertising_removed(struct sock *sk, struct hci_dev *hdev, 1274 u8 instance) 1275 { 1276 struct mgmt_ev_advertising_removed ev; 1277 1278 ev.instance = instance; 1279 1280 mgmt_event(MGMT_EV_ADVERTISING_REMOVED, hdev, &ev, sizeof(ev), sk); 1281 } 1282 1283 static void cancel_adv_timeout(struct hci_dev *hdev) 1284 { 1285 if (hdev->adv_instance_timeout) { 1286 hdev->adv_instance_timeout = 0; 1287 cancel_delayed_work(&hdev->adv_instance_expire); 1288 } 1289 } 1290 1291 /* This function requires the caller holds hdev->lock */ 1292 static void restart_le_actions(struct hci_dev *hdev) 1293 { 1294 struct hci_conn_params *p; 1295 1296 list_for_each_entry(p, &hdev->le_conn_params, list) { 1297 /* Needed for AUTO_OFF case where might not "really" 1298 * have been powered off. 1299 */ 1300 list_del_init(&p->action); 1301 1302 switch (p->auto_connect) { 1303 case HCI_AUTO_CONN_DIRECT: 1304 case HCI_AUTO_CONN_ALWAYS: 1305 list_add(&p->action, &hdev->pend_le_conns); 1306 break; 1307 case HCI_AUTO_CONN_REPORT: 1308 list_add(&p->action, &hdev->pend_le_reports); 1309 break; 1310 default: 1311 break; 1312 } 1313 } 1314 } 1315 1316 static int new_settings(struct hci_dev *hdev, struct sock *skip) 1317 { 1318 __le32 ev = cpu_to_le32(get_current_settings(hdev)); 1319 1320 return mgmt_limited_event(MGMT_EV_NEW_SETTINGS, hdev, &ev, 1321 sizeof(ev), HCI_MGMT_SETTING_EVENTS, skip); 1322 } 1323 1324 static void mgmt_set_powered_complete(struct hci_dev *hdev, void *data, int err) 1325 { 1326 struct mgmt_pending_cmd *cmd = data; 1327 struct mgmt_mode *cp; 1328 1329 /* Make sure cmd still outstanding. */ 1330 if (cmd != pending_find(MGMT_OP_SET_POWERED, hdev)) 1331 return; 1332 1333 cp = cmd->param; 1334 1335 bt_dev_dbg(hdev, "err %d", err); 1336 1337 if (!err) { 1338 if (cp->val) { 1339 hci_dev_lock(hdev); 1340 restart_le_actions(hdev); 1341 hci_update_passive_scan(hdev); 1342 hci_dev_unlock(hdev); 1343 } 1344 1345 send_settings_rsp(cmd->sk, cmd->opcode, hdev); 1346 1347 /* Only call new_setting for power on as power off is deferred 1348 * to hdev->power_off work which does call hci_dev_do_close. 1349 */ 1350 if (cp->val) 1351 new_settings(hdev, cmd->sk); 1352 } else { 1353 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_POWERED, 1354 mgmt_status(err)); 1355 } 1356 1357 mgmt_pending_remove(cmd); 1358 } 1359 1360 static int set_powered_sync(struct hci_dev *hdev, void *data) 1361 { 1362 struct mgmt_pending_cmd *cmd = data; 1363 struct mgmt_mode *cp = cmd->param; 1364 1365 BT_DBG("%s", hdev->name); 1366 1367 return hci_set_powered_sync(hdev, cp->val); 1368 } 1369 1370 static int set_powered(struct sock *sk, struct hci_dev *hdev, void *data, 1371 u16 len) 1372 { 1373 struct mgmt_mode *cp = data; 1374 struct mgmt_pending_cmd *cmd; 1375 int err; 1376 1377 bt_dev_dbg(hdev, "sock %p", sk); 1378 1379 if (cp->val != 0x00 && cp->val != 0x01) 1380 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED, 1381 MGMT_STATUS_INVALID_PARAMS); 1382 1383 hci_dev_lock(hdev); 1384 1385 if (pending_find(MGMT_OP_SET_POWERED, hdev)) { 1386 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED, 1387 MGMT_STATUS_BUSY); 1388 goto failed; 1389 } 1390 1391 if (!!cp->val == hdev_is_powered(hdev)) { 1392 err = send_settings_rsp(sk, MGMT_OP_SET_POWERED, hdev); 1393 goto failed; 1394 } 1395 1396 cmd = mgmt_pending_add(sk, MGMT_OP_SET_POWERED, hdev, data, len); 1397 if (!cmd) { 1398 err = -ENOMEM; 1399 goto failed; 1400 } 1401 1402 /* Cancel potentially blocking sync operation before power off */ 1403 if (cp->val == 0x00) { 1404 __hci_cmd_sync_cancel(hdev, -EHOSTDOWN); 1405 err = hci_cmd_sync_queue(hdev, set_powered_sync, cmd, 1406 mgmt_set_powered_complete); 1407 } else { 1408 /* Use hci_cmd_sync_submit since hdev might not be running */ 1409 err = hci_cmd_sync_submit(hdev, set_powered_sync, cmd, 1410 mgmt_set_powered_complete); 1411 } 1412 1413 if (err < 0) 1414 mgmt_pending_remove(cmd); 1415 1416 failed: 1417 hci_dev_unlock(hdev); 1418 return err; 1419 } 1420 1421 int mgmt_new_settings(struct hci_dev *hdev) 1422 { 1423 return new_settings(hdev, NULL); 1424 } 1425 1426 struct cmd_lookup { 1427 struct sock *sk; 1428 struct hci_dev *hdev; 1429 u8 mgmt_status; 1430 }; 1431 1432 static void settings_rsp(struct mgmt_pending_cmd *cmd, void *data) 1433 { 1434 struct cmd_lookup *match = data; 1435 1436 send_settings_rsp(cmd->sk, cmd->opcode, match->hdev); 1437 1438 list_del(&cmd->list); 1439 1440 if (match->sk == NULL) { 1441 match->sk = cmd->sk; 1442 sock_hold(match->sk); 1443 } 1444 1445 mgmt_pending_free(cmd); 1446 } 1447 1448 static void cmd_status_rsp(struct mgmt_pending_cmd *cmd, void *data) 1449 { 1450 u8 *status = data; 1451 1452 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, *status); 1453 mgmt_pending_remove(cmd); 1454 } 1455 1456 static void cmd_complete_rsp(struct mgmt_pending_cmd *cmd, void *data) 1457 { 1458 if (cmd->cmd_complete) { 1459 u8 *status = data; 1460 1461 cmd->cmd_complete(cmd, *status); 1462 mgmt_pending_remove(cmd); 1463 1464 return; 1465 } 1466 1467 cmd_status_rsp(cmd, data); 1468 } 1469 1470 static int generic_cmd_complete(struct mgmt_pending_cmd *cmd, u8 status) 1471 { 1472 return mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, status, 1473 cmd->param, cmd->param_len); 1474 } 1475 1476 static int addr_cmd_complete(struct mgmt_pending_cmd *cmd, u8 status) 1477 { 1478 return mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, status, 1479 cmd->param, sizeof(struct mgmt_addr_info)); 1480 } 1481 1482 static u8 mgmt_bredr_support(struct hci_dev *hdev) 1483 { 1484 if (!lmp_bredr_capable(hdev)) 1485 return MGMT_STATUS_NOT_SUPPORTED; 1486 else if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) 1487 return MGMT_STATUS_REJECTED; 1488 else 1489 return MGMT_STATUS_SUCCESS; 1490 } 1491 1492 static u8 mgmt_le_support(struct hci_dev *hdev) 1493 { 1494 if (!lmp_le_capable(hdev)) 1495 return MGMT_STATUS_NOT_SUPPORTED; 1496 else if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED)) 1497 return MGMT_STATUS_REJECTED; 1498 else 1499 return MGMT_STATUS_SUCCESS; 1500 } 1501 1502 static void mgmt_set_discoverable_complete(struct hci_dev *hdev, void *data, 1503 int err) 1504 { 1505 struct mgmt_pending_cmd *cmd = data; 1506 1507 bt_dev_dbg(hdev, "err %d", err); 1508 1509 /* Make sure cmd still outstanding. */ 1510 if (cmd != pending_find(MGMT_OP_SET_DISCOVERABLE, hdev)) 1511 return; 1512 1513 hci_dev_lock(hdev); 1514 1515 if (err) { 1516 u8 mgmt_err = mgmt_status(err); 1517 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err); 1518 hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE); 1519 goto done; 1520 } 1521 1522 if (hci_dev_test_flag(hdev, HCI_DISCOVERABLE) && 1523 hdev->discov_timeout > 0) { 1524 int to = msecs_to_jiffies(hdev->discov_timeout * 1000); 1525 queue_delayed_work(hdev->req_workqueue, &hdev->discov_off, to); 1526 } 1527 1528 send_settings_rsp(cmd->sk, MGMT_OP_SET_DISCOVERABLE, hdev); 1529 new_settings(hdev, cmd->sk); 1530 1531 done: 1532 mgmt_pending_remove(cmd); 1533 hci_dev_unlock(hdev); 1534 } 1535 1536 static int set_discoverable_sync(struct hci_dev *hdev, void *data) 1537 { 1538 BT_DBG("%s", hdev->name); 1539 1540 return hci_update_discoverable_sync(hdev); 1541 } 1542 1543 static int set_discoverable(struct sock *sk, struct hci_dev *hdev, void *data, 1544 u16 len) 1545 { 1546 struct mgmt_cp_set_discoverable *cp = data; 1547 struct mgmt_pending_cmd *cmd; 1548 u16 timeout; 1549 int err; 1550 1551 bt_dev_dbg(hdev, "sock %p", sk); 1552 1553 if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED) && 1554 !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) 1555 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE, 1556 MGMT_STATUS_REJECTED); 1557 1558 if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02) 1559 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE, 1560 MGMT_STATUS_INVALID_PARAMS); 1561 1562 timeout = __le16_to_cpu(cp->timeout); 1563 1564 /* Disabling discoverable requires that no timeout is set, 1565 * and enabling limited discoverable requires a timeout. 1566 */ 1567 if ((cp->val == 0x00 && timeout > 0) || 1568 (cp->val == 0x02 && timeout == 0)) 1569 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE, 1570 MGMT_STATUS_INVALID_PARAMS); 1571 1572 hci_dev_lock(hdev); 1573 1574 if (!hdev_is_powered(hdev) && timeout > 0) { 1575 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE, 1576 MGMT_STATUS_NOT_POWERED); 1577 goto failed; 1578 } 1579 1580 if (pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) || 1581 pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) { 1582 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE, 1583 MGMT_STATUS_BUSY); 1584 goto failed; 1585 } 1586 1587 if (!hci_dev_test_flag(hdev, HCI_CONNECTABLE)) { 1588 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE, 1589 MGMT_STATUS_REJECTED); 1590 goto failed; 1591 } 1592 1593 if (hdev->advertising_paused) { 1594 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE, 1595 MGMT_STATUS_BUSY); 1596 goto failed; 1597 } 1598 1599 if (!hdev_is_powered(hdev)) { 1600 bool changed = false; 1601 1602 /* Setting limited discoverable when powered off is 1603 * not a valid operation since it requires a timeout 1604 * and so no need to check HCI_LIMITED_DISCOVERABLE. 1605 */ 1606 if (!!cp->val != hci_dev_test_flag(hdev, HCI_DISCOVERABLE)) { 1607 hci_dev_change_flag(hdev, HCI_DISCOVERABLE); 1608 changed = true; 1609 } 1610 1611 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev); 1612 if (err < 0) 1613 goto failed; 1614 1615 if (changed) 1616 err = new_settings(hdev, sk); 1617 1618 goto failed; 1619 } 1620 1621 /* If the current mode is the same, then just update the timeout 1622 * value with the new value. And if only the timeout gets updated, 1623 * then no need for any HCI transactions. 1624 */ 1625 if (!!cp->val == hci_dev_test_flag(hdev, HCI_DISCOVERABLE) && 1626 (cp->val == 0x02) == hci_dev_test_flag(hdev, 1627 HCI_LIMITED_DISCOVERABLE)) { 1628 cancel_delayed_work(&hdev->discov_off); 1629 hdev->discov_timeout = timeout; 1630 1631 if (cp->val && hdev->discov_timeout > 0) { 1632 int to = msecs_to_jiffies(hdev->discov_timeout * 1000); 1633 queue_delayed_work(hdev->req_workqueue, 1634 &hdev->discov_off, to); 1635 } 1636 1637 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev); 1638 goto failed; 1639 } 1640 1641 cmd = mgmt_pending_add(sk, MGMT_OP_SET_DISCOVERABLE, hdev, data, len); 1642 if (!cmd) { 1643 err = -ENOMEM; 1644 goto failed; 1645 } 1646 1647 /* Cancel any potential discoverable timeout that might be 1648 * still active and store new timeout value. The arming of 1649 * the timeout happens in the complete handler. 1650 */ 1651 cancel_delayed_work(&hdev->discov_off); 1652 hdev->discov_timeout = timeout; 1653 1654 if (cp->val) 1655 hci_dev_set_flag(hdev, HCI_DISCOVERABLE); 1656 else 1657 hci_dev_clear_flag(hdev, HCI_DISCOVERABLE); 1658 1659 /* Limited discoverable mode */ 1660 if (cp->val == 0x02) 1661 hci_dev_set_flag(hdev, HCI_LIMITED_DISCOVERABLE); 1662 else 1663 hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE); 1664 1665 err = hci_cmd_sync_queue(hdev, set_discoverable_sync, cmd, 1666 mgmt_set_discoverable_complete); 1667 1668 if (err < 0) 1669 mgmt_pending_remove(cmd); 1670 1671 failed: 1672 hci_dev_unlock(hdev); 1673 return err; 1674 } 1675 1676 static void mgmt_set_connectable_complete(struct hci_dev *hdev, void *data, 1677 int err) 1678 { 1679 struct mgmt_pending_cmd *cmd = data; 1680 1681 bt_dev_dbg(hdev, "err %d", err); 1682 1683 /* Make sure cmd still outstanding. */ 1684 if (cmd != pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) 1685 return; 1686 1687 hci_dev_lock(hdev); 1688 1689 if (err) { 1690 u8 mgmt_err = mgmt_status(err); 1691 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err); 1692 goto done; 1693 } 1694 1695 send_settings_rsp(cmd->sk, MGMT_OP_SET_CONNECTABLE, hdev); 1696 new_settings(hdev, cmd->sk); 1697 1698 done: 1699 if (cmd) 1700 mgmt_pending_remove(cmd); 1701 1702 hci_dev_unlock(hdev); 1703 } 1704 1705 static int set_connectable_update_settings(struct hci_dev *hdev, 1706 struct sock *sk, u8 val) 1707 { 1708 bool changed = false; 1709 int err; 1710 1711 if (!!val != hci_dev_test_flag(hdev, HCI_CONNECTABLE)) 1712 changed = true; 1713 1714 if (val) { 1715 hci_dev_set_flag(hdev, HCI_CONNECTABLE); 1716 } else { 1717 hci_dev_clear_flag(hdev, HCI_CONNECTABLE); 1718 hci_dev_clear_flag(hdev, HCI_DISCOVERABLE); 1719 } 1720 1721 err = send_settings_rsp(sk, MGMT_OP_SET_CONNECTABLE, hdev); 1722 if (err < 0) 1723 return err; 1724 1725 if (changed) { 1726 hci_update_scan(hdev); 1727 hci_update_passive_scan(hdev); 1728 return new_settings(hdev, sk); 1729 } 1730 1731 return 0; 1732 } 1733 1734 static int set_connectable_sync(struct hci_dev *hdev, void *data) 1735 { 1736 BT_DBG("%s", hdev->name); 1737 1738 return hci_update_connectable_sync(hdev); 1739 } 1740 1741 static int set_connectable(struct sock *sk, struct hci_dev *hdev, void *data, 1742 u16 len) 1743 { 1744 struct mgmt_mode *cp = data; 1745 struct mgmt_pending_cmd *cmd; 1746 int err; 1747 1748 bt_dev_dbg(hdev, "sock %p", sk); 1749 1750 if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED) && 1751 !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) 1752 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE, 1753 MGMT_STATUS_REJECTED); 1754 1755 if (cp->val != 0x00 && cp->val != 0x01) 1756 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE, 1757 MGMT_STATUS_INVALID_PARAMS); 1758 1759 hci_dev_lock(hdev); 1760 1761 if (!hdev_is_powered(hdev)) { 1762 err = set_connectable_update_settings(hdev, sk, cp->val); 1763 goto failed; 1764 } 1765 1766 if (pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) || 1767 pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) { 1768 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE, 1769 MGMT_STATUS_BUSY); 1770 goto failed; 1771 } 1772 1773 cmd = mgmt_pending_add(sk, MGMT_OP_SET_CONNECTABLE, hdev, data, len); 1774 if (!cmd) { 1775 err = -ENOMEM; 1776 goto failed; 1777 } 1778 1779 if (cp->val) { 1780 hci_dev_set_flag(hdev, HCI_CONNECTABLE); 1781 } else { 1782 if (hdev->discov_timeout > 0) 1783 cancel_delayed_work(&hdev->discov_off); 1784 1785 hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE); 1786 hci_dev_clear_flag(hdev, HCI_DISCOVERABLE); 1787 hci_dev_clear_flag(hdev, HCI_CONNECTABLE); 1788 } 1789 1790 err = hci_cmd_sync_queue(hdev, set_connectable_sync, cmd, 1791 mgmt_set_connectable_complete); 1792 1793 if (err < 0) 1794 mgmt_pending_remove(cmd); 1795 1796 failed: 1797 hci_dev_unlock(hdev); 1798 return err; 1799 } 1800 1801 static int set_bondable(struct sock *sk, struct hci_dev *hdev, void *data, 1802 u16 len) 1803 { 1804 struct mgmt_mode *cp = data; 1805 bool changed; 1806 int err; 1807 1808 bt_dev_dbg(hdev, "sock %p", sk); 1809 1810 if (cp->val != 0x00 && cp->val != 0x01) 1811 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BONDABLE, 1812 MGMT_STATUS_INVALID_PARAMS); 1813 1814 hci_dev_lock(hdev); 1815 1816 if (cp->val) 1817 changed = !hci_dev_test_and_set_flag(hdev, HCI_BONDABLE); 1818 else 1819 changed = hci_dev_test_and_clear_flag(hdev, HCI_BONDABLE); 1820 1821 err = send_settings_rsp(sk, MGMT_OP_SET_BONDABLE, hdev); 1822 if (err < 0) 1823 goto unlock; 1824 1825 if (changed) { 1826 /* In limited privacy mode the change of bondable mode 1827 * may affect the local advertising address. 1828 */ 1829 hci_update_discoverable(hdev); 1830 1831 err = new_settings(hdev, sk); 1832 } 1833 1834 unlock: 1835 hci_dev_unlock(hdev); 1836 return err; 1837 } 1838 1839 static int set_link_security(struct sock *sk, struct hci_dev *hdev, void *data, 1840 u16 len) 1841 { 1842 struct mgmt_mode *cp = data; 1843 struct mgmt_pending_cmd *cmd; 1844 u8 val, status; 1845 int err; 1846 1847 bt_dev_dbg(hdev, "sock %p", sk); 1848 1849 status = mgmt_bredr_support(hdev); 1850 if (status) 1851 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY, 1852 status); 1853 1854 if (cp->val != 0x00 && cp->val != 0x01) 1855 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY, 1856 MGMT_STATUS_INVALID_PARAMS); 1857 1858 hci_dev_lock(hdev); 1859 1860 if (!hdev_is_powered(hdev)) { 1861 bool changed = false; 1862 1863 if (!!cp->val != hci_dev_test_flag(hdev, HCI_LINK_SECURITY)) { 1864 hci_dev_change_flag(hdev, HCI_LINK_SECURITY); 1865 changed = true; 1866 } 1867 1868 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev); 1869 if (err < 0) 1870 goto failed; 1871 1872 if (changed) 1873 err = new_settings(hdev, sk); 1874 1875 goto failed; 1876 } 1877 1878 if (pending_find(MGMT_OP_SET_LINK_SECURITY, hdev)) { 1879 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY, 1880 MGMT_STATUS_BUSY); 1881 goto failed; 1882 } 1883 1884 val = !!cp->val; 1885 1886 if (test_bit(HCI_AUTH, &hdev->flags) == val) { 1887 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev); 1888 goto failed; 1889 } 1890 1891 cmd = mgmt_pending_add(sk, MGMT_OP_SET_LINK_SECURITY, hdev, data, len); 1892 if (!cmd) { 1893 err = -ENOMEM; 1894 goto failed; 1895 } 1896 1897 err = hci_send_cmd(hdev, HCI_OP_WRITE_AUTH_ENABLE, sizeof(val), &val); 1898 if (err < 0) { 1899 mgmt_pending_remove(cmd); 1900 goto failed; 1901 } 1902 1903 failed: 1904 hci_dev_unlock(hdev); 1905 return err; 1906 } 1907 1908 static void set_ssp_complete(struct hci_dev *hdev, void *data, int err) 1909 { 1910 struct cmd_lookup match = { NULL, hdev }; 1911 struct mgmt_pending_cmd *cmd = data; 1912 struct mgmt_mode *cp = cmd->param; 1913 u8 enable = cp->val; 1914 bool changed; 1915 1916 /* Make sure cmd still outstanding. */ 1917 if (cmd != pending_find(MGMT_OP_SET_SSP, hdev)) 1918 return; 1919 1920 if (err) { 1921 u8 mgmt_err = mgmt_status(err); 1922 1923 if (enable && hci_dev_test_and_clear_flag(hdev, 1924 HCI_SSP_ENABLED)) { 1925 hci_dev_clear_flag(hdev, HCI_HS_ENABLED); 1926 new_settings(hdev, NULL); 1927 } 1928 1929 mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev, cmd_status_rsp, 1930 &mgmt_err); 1931 return; 1932 } 1933 1934 if (enable) { 1935 changed = !hci_dev_test_and_set_flag(hdev, HCI_SSP_ENABLED); 1936 } else { 1937 changed = hci_dev_test_and_clear_flag(hdev, HCI_SSP_ENABLED); 1938 1939 if (!changed) 1940 changed = hci_dev_test_and_clear_flag(hdev, 1941 HCI_HS_ENABLED); 1942 else 1943 hci_dev_clear_flag(hdev, HCI_HS_ENABLED); 1944 } 1945 1946 mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev, settings_rsp, &match); 1947 1948 if (changed) 1949 new_settings(hdev, match.sk); 1950 1951 if (match.sk) 1952 sock_put(match.sk); 1953 1954 hci_update_eir_sync(hdev); 1955 } 1956 1957 static int set_ssp_sync(struct hci_dev *hdev, void *data) 1958 { 1959 struct mgmt_pending_cmd *cmd = data; 1960 struct mgmt_mode *cp = cmd->param; 1961 bool changed = false; 1962 int err; 1963 1964 if (cp->val) 1965 changed = !hci_dev_test_and_set_flag(hdev, HCI_SSP_ENABLED); 1966 1967 err = hci_write_ssp_mode_sync(hdev, cp->val); 1968 1969 if (!err && changed) 1970 hci_dev_clear_flag(hdev, HCI_SSP_ENABLED); 1971 1972 return err; 1973 } 1974 1975 static int set_ssp(struct sock *sk, struct hci_dev *hdev, void *data, u16 len) 1976 { 1977 struct mgmt_mode *cp = data; 1978 struct mgmt_pending_cmd *cmd; 1979 u8 status; 1980 int err; 1981 1982 bt_dev_dbg(hdev, "sock %p", sk); 1983 1984 status = mgmt_bredr_support(hdev); 1985 if (status) 1986 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP, status); 1987 1988 if (!lmp_ssp_capable(hdev)) 1989 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP, 1990 MGMT_STATUS_NOT_SUPPORTED); 1991 1992 if (cp->val != 0x00 && cp->val != 0x01) 1993 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP, 1994 MGMT_STATUS_INVALID_PARAMS); 1995 1996 hci_dev_lock(hdev); 1997 1998 if (!hdev_is_powered(hdev)) { 1999 bool changed; 2000 2001 if (cp->val) { 2002 changed = !hci_dev_test_and_set_flag(hdev, 2003 HCI_SSP_ENABLED); 2004 } else { 2005 changed = hci_dev_test_and_clear_flag(hdev, 2006 HCI_SSP_ENABLED); 2007 if (!changed) 2008 changed = hci_dev_test_and_clear_flag(hdev, 2009 HCI_HS_ENABLED); 2010 else 2011 hci_dev_clear_flag(hdev, HCI_HS_ENABLED); 2012 } 2013 2014 err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev); 2015 if (err < 0) 2016 goto failed; 2017 2018 if (changed) 2019 err = new_settings(hdev, sk); 2020 2021 goto failed; 2022 } 2023 2024 if (pending_find(MGMT_OP_SET_SSP, hdev)) { 2025 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP, 2026 MGMT_STATUS_BUSY); 2027 goto failed; 2028 } 2029 2030 if (!!cp->val == hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) { 2031 err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev); 2032 goto failed; 2033 } 2034 2035 cmd = mgmt_pending_add(sk, MGMT_OP_SET_SSP, hdev, data, len); 2036 if (!cmd) 2037 err = -ENOMEM; 2038 else 2039 err = hci_cmd_sync_queue(hdev, set_ssp_sync, cmd, 2040 set_ssp_complete); 2041 2042 if (err < 0) { 2043 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP, 2044 MGMT_STATUS_FAILED); 2045 2046 if (cmd) 2047 mgmt_pending_remove(cmd); 2048 } 2049 2050 failed: 2051 hci_dev_unlock(hdev); 2052 return err; 2053 } 2054 2055 static int set_hs(struct sock *sk, struct hci_dev *hdev, void *data, u16 len) 2056 { 2057 struct mgmt_mode *cp = data; 2058 bool changed; 2059 u8 status; 2060 int err; 2061 2062 bt_dev_dbg(hdev, "sock %p", sk); 2063 2064 if (!IS_ENABLED(CONFIG_BT_HS)) 2065 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS, 2066 MGMT_STATUS_NOT_SUPPORTED); 2067 2068 status = mgmt_bredr_support(hdev); 2069 if (status) 2070 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS, status); 2071 2072 if (!lmp_ssp_capable(hdev)) 2073 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS, 2074 MGMT_STATUS_NOT_SUPPORTED); 2075 2076 if (!hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) 2077 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS, 2078 MGMT_STATUS_REJECTED); 2079 2080 if (cp->val != 0x00 && cp->val != 0x01) 2081 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS, 2082 MGMT_STATUS_INVALID_PARAMS); 2083 2084 hci_dev_lock(hdev); 2085 2086 if (pending_find(MGMT_OP_SET_SSP, hdev)) { 2087 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS, 2088 MGMT_STATUS_BUSY); 2089 goto unlock; 2090 } 2091 2092 if (cp->val) { 2093 changed = !hci_dev_test_and_set_flag(hdev, HCI_HS_ENABLED); 2094 } else { 2095 if (hdev_is_powered(hdev)) { 2096 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS, 2097 MGMT_STATUS_REJECTED); 2098 goto unlock; 2099 } 2100 2101 changed = hci_dev_test_and_clear_flag(hdev, HCI_HS_ENABLED); 2102 } 2103 2104 err = send_settings_rsp(sk, MGMT_OP_SET_HS, hdev); 2105 if (err < 0) 2106 goto unlock; 2107 2108 if (changed) 2109 err = new_settings(hdev, sk); 2110 2111 unlock: 2112 hci_dev_unlock(hdev); 2113 return err; 2114 } 2115 2116 static void set_le_complete(struct hci_dev *hdev, void *data, int err) 2117 { 2118 struct cmd_lookup match = { NULL, hdev }; 2119 u8 status = mgmt_status(err); 2120 2121 bt_dev_dbg(hdev, "err %d", err); 2122 2123 if (status) { 2124 mgmt_pending_foreach(MGMT_OP_SET_LE, hdev, cmd_status_rsp, 2125 &status); 2126 return; 2127 } 2128 2129 mgmt_pending_foreach(MGMT_OP_SET_LE, hdev, settings_rsp, &match); 2130 2131 new_settings(hdev, match.sk); 2132 2133 if (match.sk) 2134 sock_put(match.sk); 2135 } 2136 2137 static int set_le_sync(struct hci_dev *hdev, void *data) 2138 { 2139 struct mgmt_pending_cmd *cmd = data; 2140 struct mgmt_mode *cp = cmd->param; 2141 u8 val = !!cp->val; 2142 int err; 2143 2144 if (!val) { 2145 hci_clear_adv_instance_sync(hdev, NULL, 0x00, true); 2146 2147 if (hci_dev_test_flag(hdev, HCI_LE_ADV)) 2148 hci_disable_advertising_sync(hdev); 2149 2150 if (ext_adv_capable(hdev)) 2151 hci_remove_ext_adv_instance_sync(hdev, 0, cmd->sk); 2152 } else { 2153 hci_dev_set_flag(hdev, HCI_LE_ENABLED); 2154 } 2155 2156 err = hci_write_le_host_supported_sync(hdev, val, 0); 2157 2158 /* Make sure the controller has a good default for 2159 * advertising data. Restrict the update to when LE 2160 * has actually been enabled. During power on, the 2161 * update in powered_update_hci will take care of it. 2162 */ 2163 if (!err && hci_dev_test_flag(hdev, HCI_LE_ENABLED)) { 2164 if (ext_adv_capable(hdev)) { 2165 int status; 2166 2167 status = hci_setup_ext_adv_instance_sync(hdev, 0x00); 2168 if (!status) 2169 hci_update_scan_rsp_data_sync(hdev, 0x00); 2170 } else { 2171 hci_update_adv_data_sync(hdev, 0x00); 2172 hci_update_scan_rsp_data_sync(hdev, 0x00); 2173 } 2174 2175 hci_update_passive_scan(hdev); 2176 } 2177 2178 return err; 2179 } 2180 2181 static void set_mesh_complete(struct hci_dev *hdev, void *data, int err) 2182 { 2183 struct mgmt_pending_cmd *cmd = data; 2184 u8 status = mgmt_status(err); 2185 struct sock *sk = cmd->sk; 2186 2187 if (status) { 2188 mgmt_pending_foreach(MGMT_OP_SET_MESH_RECEIVER, hdev, 2189 cmd_status_rsp, &status); 2190 return; 2191 } 2192 2193 mgmt_pending_remove(cmd); 2194 mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_MESH_RECEIVER, 0, NULL, 0); 2195 } 2196 2197 static int set_mesh_sync(struct hci_dev *hdev, void *data) 2198 { 2199 struct mgmt_pending_cmd *cmd = data; 2200 struct mgmt_cp_set_mesh *cp = cmd->param; 2201 size_t len = cmd->param_len; 2202 2203 memset(hdev->mesh_ad_types, 0, sizeof(hdev->mesh_ad_types)); 2204 2205 if (cp->enable) 2206 hci_dev_set_flag(hdev, HCI_MESH); 2207 else 2208 hci_dev_clear_flag(hdev, HCI_MESH); 2209 2210 len -= sizeof(*cp); 2211 2212 /* If filters don't fit, forward all adv pkts */ 2213 if (len <= sizeof(hdev->mesh_ad_types)) 2214 memcpy(hdev->mesh_ad_types, cp->ad_types, len); 2215 2216 hci_update_passive_scan_sync(hdev); 2217 return 0; 2218 } 2219 2220 static int set_mesh(struct sock *sk, struct hci_dev *hdev, void *data, u16 len) 2221 { 2222 struct mgmt_cp_set_mesh *cp = data; 2223 struct mgmt_pending_cmd *cmd; 2224 int err = 0; 2225 2226 bt_dev_dbg(hdev, "sock %p", sk); 2227 2228 if (!lmp_le_capable(hdev) || 2229 !hci_dev_test_flag(hdev, HCI_MESH_EXPERIMENTAL)) 2230 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_MESH_RECEIVER, 2231 MGMT_STATUS_NOT_SUPPORTED); 2232 2233 if (cp->enable != 0x00 && cp->enable != 0x01) 2234 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_MESH_RECEIVER, 2235 MGMT_STATUS_INVALID_PARAMS); 2236 2237 hci_dev_lock(hdev); 2238 2239 cmd = mgmt_pending_add(sk, MGMT_OP_SET_MESH_RECEIVER, hdev, data, len); 2240 if (!cmd) 2241 err = -ENOMEM; 2242 else 2243 err = hci_cmd_sync_queue(hdev, set_mesh_sync, cmd, 2244 set_mesh_complete); 2245 2246 if (err < 0) { 2247 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_MESH_RECEIVER, 2248 MGMT_STATUS_FAILED); 2249 2250 if (cmd) 2251 mgmt_pending_remove(cmd); 2252 } 2253 2254 hci_dev_unlock(hdev); 2255 return err; 2256 } 2257 2258 static void mesh_send_start_complete(struct hci_dev *hdev, void *data, int err) 2259 { 2260 struct mgmt_mesh_tx *mesh_tx = data; 2261 struct mgmt_cp_mesh_send *send = (void *)mesh_tx->param; 2262 unsigned long mesh_send_interval; 2263 u8 mgmt_err = mgmt_status(err); 2264 2265 /* Report any errors here, but don't report completion */ 2266 2267 if (mgmt_err) { 2268 hci_dev_clear_flag(hdev, HCI_MESH_SENDING); 2269 /* Send Complete Error Code for handle */ 2270 mesh_send_complete(hdev, mesh_tx, false); 2271 return; 2272 } 2273 2274 mesh_send_interval = msecs_to_jiffies((send->cnt) * 25); 2275 queue_delayed_work(hdev->req_workqueue, &hdev->mesh_send_done, 2276 mesh_send_interval); 2277 } 2278 2279 static int mesh_send_sync(struct hci_dev *hdev, void *data) 2280 { 2281 struct mgmt_mesh_tx *mesh_tx = data; 2282 struct mgmt_cp_mesh_send *send = (void *)mesh_tx->param; 2283 struct adv_info *adv, *next_instance; 2284 u8 instance = hdev->le_num_of_adv_sets + 1; 2285 u16 timeout, duration; 2286 int err = 0; 2287 2288 if (hdev->le_num_of_adv_sets <= hdev->adv_instance_cnt) 2289 return MGMT_STATUS_BUSY; 2290 2291 timeout = 1000; 2292 duration = send->cnt * INTERVAL_TO_MS(hdev->le_adv_max_interval); 2293 adv = hci_add_adv_instance(hdev, instance, 0, 2294 send->adv_data_len, send->adv_data, 2295 0, NULL, 2296 timeout, duration, 2297 HCI_ADV_TX_POWER_NO_PREFERENCE, 2298 hdev->le_adv_min_interval, 2299 hdev->le_adv_max_interval, 2300 mesh_tx->handle); 2301 2302 if (!IS_ERR(adv)) 2303 mesh_tx->instance = instance; 2304 else 2305 err = PTR_ERR(adv); 2306 2307 if (hdev->cur_adv_instance == instance) { 2308 /* If the currently advertised instance is being changed then 2309 * cancel the current advertising and schedule the next 2310 * instance. If there is only one instance then the overridden 2311 * advertising data will be visible right away. 2312 */ 2313 cancel_adv_timeout(hdev); 2314 2315 next_instance = hci_get_next_instance(hdev, instance); 2316 if (next_instance) 2317 instance = next_instance->instance; 2318 else 2319 instance = 0; 2320 } else if (hdev->adv_instance_timeout) { 2321 /* Immediately advertise the new instance if no other, or 2322 * let it go naturally from queue if ADV is already happening 2323 */ 2324 instance = 0; 2325 } 2326 2327 if (instance) 2328 return hci_schedule_adv_instance_sync(hdev, instance, true); 2329 2330 return err; 2331 } 2332 2333 static void send_count(struct mgmt_mesh_tx *mesh_tx, void *data) 2334 { 2335 struct mgmt_rp_mesh_read_features *rp = data; 2336 2337 if (rp->used_handles >= rp->max_handles) 2338 return; 2339 2340 rp->handles[rp->used_handles++] = mesh_tx->handle; 2341 } 2342 2343 static int mesh_features(struct sock *sk, struct hci_dev *hdev, 2344 void *data, u16 len) 2345 { 2346 struct mgmt_rp_mesh_read_features rp; 2347 2348 if (!lmp_le_capable(hdev) || 2349 !hci_dev_test_flag(hdev, HCI_MESH_EXPERIMENTAL)) 2350 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_MESH_READ_FEATURES, 2351 MGMT_STATUS_NOT_SUPPORTED); 2352 2353 memset(&rp, 0, sizeof(rp)); 2354 rp.index = cpu_to_le16(hdev->id); 2355 if (hci_dev_test_flag(hdev, HCI_LE_ENABLED)) 2356 rp.max_handles = MESH_HANDLES_MAX; 2357 2358 hci_dev_lock(hdev); 2359 2360 if (rp.max_handles) 2361 mgmt_mesh_foreach(hdev, send_count, &rp, sk); 2362 2363 mgmt_cmd_complete(sk, hdev->id, MGMT_OP_MESH_READ_FEATURES, 0, &rp, 2364 rp.used_handles + sizeof(rp) - MESH_HANDLES_MAX); 2365 2366 hci_dev_unlock(hdev); 2367 return 0; 2368 } 2369 2370 static int send_cancel(struct hci_dev *hdev, void *data) 2371 { 2372 struct mgmt_pending_cmd *cmd = data; 2373 struct mgmt_cp_mesh_send_cancel *cancel = (void *)cmd->param; 2374 struct mgmt_mesh_tx *mesh_tx; 2375 2376 if (!cancel->handle) { 2377 do { 2378 mesh_tx = mgmt_mesh_next(hdev, cmd->sk); 2379 2380 if (mesh_tx) 2381 mesh_send_complete(hdev, mesh_tx, false); 2382 } while (mesh_tx); 2383 } else { 2384 mesh_tx = mgmt_mesh_find(hdev, cancel->handle); 2385 2386 if (mesh_tx && mesh_tx->sk == cmd->sk) 2387 mesh_send_complete(hdev, mesh_tx, false); 2388 } 2389 2390 mgmt_cmd_complete(cmd->sk, hdev->id, MGMT_OP_MESH_SEND_CANCEL, 2391 0, NULL, 0); 2392 mgmt_pending_free(cmd); 2393 2394 return 0; 2395 } 2396 2397 static int mesh_send_cancel(struct sock *sk, struct hci_dev *hdev, 2398 void *data, u16 len) 2399 { 2400 struct mgmt_pending_cmd *cmd; 2401 int err; 2402 2403 if (!lmp_le_capable(hdev) || 2404 !hci_dev_test_flag(hdev, HCI_MESH_EXPERIMENTAL)) 2405 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_MESH_SEND_CANCEL, 2406 MGMT_STATUS_NOT_SUPPORTED); 2407 2408 if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED)) 2409 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_MESH_SEND_CANCEL, 2410 MGMT_STATUS_REJECTED); 2411 2412 hci_dev_lock(hdev); 2413 cmd = mgmt_pending_new(sk, MGMT_OP_MESH_SEND_CANCEL, hdev, data, len); 2414 if (!cmd) 2415 err = -ENOMEM; 2416 else 2417 err = hci_cmd_sync_queue(hdev, send_cancel, cmd, NULL); 2418 2419 if (err < 0) { 2420 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_MESH_SEND_CANCEL, 2421 MGMT_STATUS_FAILED); 2422 2423 if (cmd) 2424 mgmt_pending_free(cmd); 2425 } 2426 2427 hci_dev_unlock(hdev); 2428 return err; 2429 } 2430 2431 static int mesh_send(struct sock *sk, struct hci_dev *hdev, void *data, u16 len) 2432 { 2433 struct mgmt_mesh_tx *mesh_tx; 2434 struct mgmt_cp_mesh_send *send = data; 2435 struct mgmt_rp_mesh_read_features rp; 2436 bool sending; 2437 int err = 0; 2438 2439 if (!lmp_le_capable(hdev) || 2440 !hci_dev_test_flag(hdev, HCI_MESH_EXPERIMENTAL)) 2441 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_MESH_SEND, 2442 MGMT_STATUS_NOT_SUPPORTED); 2443 if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED) || 2444 len <= MGMT_MESH_SEND_SIZE || 2445 len > (MGMT_MESH_SEND_SIZE + 31)) 2446 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_MESH_SEND, 2447 MGMT_STATUS_REJECTED); 2448 2449 hci_dev_lock(hdev); 2450 2451 memset(&rp, 0, sizeof(rp)); 2452 rp.max_handles = MESH_HANDLES_MAX; 2453 2454 mgmt_mesh_foreach(hdev, send_count, &rp, sk); 2455 2456 if (rp.max_handles <= rp.used_handles) { 2457 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_MESH_SEND, 2458 MGMT_STATUS_BUSY); 2459 goto done; 2460 } 2461 2462 sending = hci_dev_test_flag(hdev, HCI_MESH_SENDING); 2463 mesh_tx = mgmt_mesh_add(sk, hdev, send, len); 2464 2465 if (!mesh_tx) 2466 err = -ENOMEM; 2467 else if (!sending) 2468 err = hci_cmd_sync_queue(hdev, mesh_send_sync, mesh_tx, 2469 mesh_send_start_complete); 2470 2471 if (err < 0) { 2472 bt_dev_err(hdev, "Send Mesh Failed %d", err); 2473 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_MESH_SEND, 2474 MGMT_STATUS_FAILED); 2475 2476 if (mesh_tx) { 2477 if (sending) 2478 mgmt_mesh_remove(mesh_tx); 2479 } 2480 } else { 2481 hci_dev_set_flag(hdev, HCI_MESH_SENDING); 2482 2483 mgmt_cmd_complete(sk, hdev->id, MGMT_OP_MESH_SEND, 0, 2484 &mesh_tx->handle, 1); 2485 } 2486 2487 done: 2488 hci_dev_unlock(hdev); 2489 return err; 2490 } 2491 2492 static int set_le(struct sock *sk, struct hci_dev *hdev, void *data, u16 len) 2493 { 2494 struct mgmt_mode *cp = data; 2495 struct mgmt_pending_cmd *cmd; 2496 int err; 2497 u8 val, enabled; 2498 2499 bt_dev_dbg(hdev, "sock %p", sk); 2500 2501 if (!lmp_le_capable(hdev)) 2502 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE, 2503 MGMT_STATUS_NOT_SUPPORTED); 2504 2505 if (cp->val != 0x00 && cp->val != 0x01) 2506 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE, 2507 MGMT_STATUS_INVALID_PARAMS); 2508 2509 /* Bluetooth single mode LE only controllers or dual-mode 2510 * controllers configured as LE only devices, do not allow 2511 * switching LE off. These have either LE enabled explicitly 2512 * or BR/EDR has been previously switched off. 2513 * 2514 * When trying to enable an already enabled LE, then gracefully 2515 * send a positive response. Trying to disable it however will 2516 * result into rejection. 2517 */ 2518 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) { 2519 if (cp->val == 0x01) 2520 return send_settings_rsp(sk, MGMT_OP_SET_LE, hdev); 2521 2522 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE, 2523 MGMT_STATUS_REJECTED); 2524 } 2525 2526 hci_dev_lock(hdev); 2527 2528 val = !!cp->val; 2529 enabled = lmp_host_le_capable(hdev); 2530 2531 if (!hdev_is_powered(hdev) || val == enabled) { 2532 bool changed = false; 2533 2534 if (val != hci_dev_test_flag(hdev, HCI_LE_ENABLED)) { 2535 hci_dev_change_flag(hdev, HCI_LE_ENABLED); 2536 changed = true; 2537 } 2538 2539 if (!val && hci_dev_test_flag(hdev, HCI_ADVERTISING)) { 2540 hci_dev_clear_flag(hdev, HCI_ADVERTISING); 2541 changed = true; 2542 } 2543 2544 err = send_settings_rsp(sk, MGMT_OP_SET_LE, hdev); 2545 if (err < 0) 2546 goto unlock; 2547 2548 if (changed) 2549 err = new_settings(hdev, sk); 2550 2551 goto unlock; 2552 } 2553 2554 if (pending_find(MGMT_OP_SET_LE, hdev) || 2555 pending_find(MGMT_OP_SET_ADVERTISING, hdev)) { 2556 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE, 2557 MGMT_STATUS_BUSY); 2558 goto unlock; 2559 } 2560 2561 cmd = mgmt_pending_add(sk, MGMT_OP_SET_LE, hdev, data, len); 2562 if (!cmd) 2563 err = -ENOMEM; 2564 else 2565 err = hci_cmd_sync_queue(hdev, set_le_sync, cmd, 2566 set_le_complete); 2567 2568 if (err < 0) { 2569 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE, 2570 MGMT_STATUS_FAILED); 2571 2572 if (cmd) 2573 mgmt_pending_remove(cmd); 2574 } 2575 2576 unlock: 2577 hci_dev_unlock(hdev); 2578 return err; 2579 } 2580 2581 /* This is a helper function to test for pending mgmt commands that can 2582 * cause CoD or EIR HCI commands. We can only allow one such pending 2583 * mgmt command at a time since otherwise we cannot easily track what 2584 * the current values are, will be, and based on that calculate if a new 2585 * HCI command needs to be sent and if yes with what value. 2586 */ 2587 static bool pending_eir_or_class(struct hci_dev *hdev) 2588 { 2589 struct mgmt_pending_cmd *cmd; 2590 2591 list_for_each_entry(cmd, &hdev->mgmt_pending, list) { 2592 switch (cmd->opcode) { 2593 case MGMT_OP_ADD_UUID: 2594 case MGMT_OP_REMOVE_UUID: 2595 case MGMT_OP_SET_DEV_CLASS: 2596 case MGMT_OP_SET_POWERED: 2597 return true; 2598 } 2599 } 2600 2601 return false; 2602 } 2603 2604 static const u8 bluetooth_base_uuid[] = { 2605 0xfb, 0x34, 0x9b, 0x5f, 0x80, 0x00, 0x00, 0x80, 2606 0x00, 0x10, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 2607 }; 2608 2609 static u8 get_uuid_size(const u8 *uuid) 2610 { 2611 u32 val; 2612 2613 if (memcmp(uuid, bluetooth_base_uuid, 12)) 2614 return 128; 2615 2616 val = get_unaligned_le32(&uuid[12]); 2617 if (val > 0xffff) 2618 return 32; 2619 2620 return 16; 2621 } 2622 2623 static void mgmt_class_complete(struct hci_dev *hdev, void *data, int err) 2624 { 2625 struct mgmt_pending_cmd *cmd = data; 2626 2627 bt_dev_dbg(hdev, "err %d", err); 2628 2629 mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, 2630 mgmt_status(err), hdev->dev_class, 3); 2631 2632 mgmt_pending_free(cmd); 2633 } 2634 2635 static int add_uuid_sync(struct hci_dev *hdev, void *data) 2636 { 2637 int err; 2638 2639 err = hci_update_class_sync(hdev); 2640 if (err) 2641 return err; 2642 2643 return hci_update_eir_sync(hdev); 2644 } 2645 2646 static int add_uuid(struct sock *sk, struct hci_dev *hdev, void *data, u16 len) 2647 { 2648 struct mgmt_cp_add_uuid *cp = data; 2649 struct mgmt_pending_cmd *cmd; 2650 struct bt_uuid *uuid; 2651 int err; 2652 2653 bt_dev_dbg(hdev, "sock %p", sk); 2654 2655 hci_dev_lock(hdev); 2656 2657 if (pending_eir_or_class(hdev)) { 2658 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_UUID, 2659 MGMT_STATUS_BUSY); 2660 goto failed; 2661 } 2662 2663 uuid = kmalloc(sizeof(*uuid), GFP_KERNEL); 2664 if (!uuid) { 2665 err = -ENOMEM; 2666 goto failed; 2667 } 2668 2669 memcpy(uuid->uuid, cp->uuid, 16); 2670 uuid->svc_hint = cp->svc_hint; 2671 uuid->size = get_uuid_size(cp->uuid); 2672 2673 list_add_tail(&uuid->list, &hdev->uuids); 2674 2675 cmd = mgmt_pending_new(sk, MGMT_OP_ADD_UUID, hdev, data, len); 2676 if (!cmd) { 2677 err = -ENOMEM; 2678 goto failed; 2679 } 2680 2681 err = hci_cmd_sync_queue(hdev, add_uuid_sync, cmd, mgmt_class_complete); 2682 if (err < 0) { 2683 mgmt_pending_free(cmd); 2684 goto failed; 2685 } 2686 2687 failed: 2688 hci_dev_unlock(hdev); 2689 return err; 2690 } 2691 2692 static bool enable_service_cache(struct hci_dev *hdev) 2693 { 2694 if (!hdev_is_powered(hdev)) 2695 return false; 2696 2697 if (!hci_dev_test_and_set_flag(hdev, HCI_SERVICE_CACHE)) { 2698 queue_delayed_work(hdev->workqueue, &hdev->service_cache, 2699 CACHE_TIMEOUT); 2700 return true; 2701 } 2702 2703 return false; 2704 } 2705 2706 static int remove_uuid_sync(struct hci_dev *hdev, void *data) 2707 { 2708 int err; 2709 2710 err = hci_update_class_sync(hdev); 2711 if (err) 2712 return err; 2713 2714 return hci_update_eir_sync(hdev); 2715 } 2716 2717 static int remove_uuid(struct sock *sk, struct hci_dev *hdev, void *data, 2718 u16 len) 2719 { 2720 struct mgmt_cp_remove_uuid *cp = data; 2721 struct mgmt_pending_cmd *cmd; 2722 struct bt_uuid *match, *tmp; 2723 static const u8 bt_uuid_any[] = { 2724 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 2725 }; 2726 int err, found; 2727 2728 bt_dev_dbg(hdev, "sock %p", sk); 2729 2730 hci_dev_lock(hdev); 2731 2732 if (pending_eir_or_class(hdev)) { 2733 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID, 2734 MGMT_STATUS_BUSY); 2735 goto unlock; 2736 } 2737 2738 if (memcmp(cp->uuid, bt_uuid_any, 16) == 0) { 2739 hci_uuids_clear(hdev); 2740 2741 if (enable_service_cache(hdev)) { 2742 err = mgmt_cmd_complete(sk, hdev->id, 2743 MGMT_OP_REMOVE_UUID, 2744 0, hdev->dev_class, 3); 2745 goto unlock; 2746 } 2747 2748 goto update_class; 2749 } 2750 2751 found = 0; 2752 2753 list_for_each_entry_safe(match, tmp, &hdev->uuids, list) { 2754 if (memcmp(match->uuid, cp->uuid, 16) != 0) 2755 continue; 2756 2757 list_del(&match->list); 2758 kfree(match); 2759 found++; 2760 } 2761 2762 if (found == 0) { 2763 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID, 2764 MGMT_STATUS_INVALID_PARAMS); 2765 goto unlock; 2766 } 2767 2768 update_class: 2769 cmd = mgmt_pending_new(sk, MGMT_OP_REMOVE_UUID, hdev, data, len); 2770 if (!cmd) { 2771 err = -ENOMEM; 2772 goto unlock; 2773 } 2774 2775 err = hci_cmd_sync_queue(hdev, remove_uuid_sync, cmd, 2776 mgmt_class_complete); 2777 if (err < 0) 2778 mgmt_pending_free(cmd); 2779 2780 unlock: 2781 hci_dev_unlock(hdev); 2782 return err; 2783 } 2784 2785 static int set_class_sync(struct hci_dev *hdev, void *data) 2786 { 2787 int err = 0; 2788 2789 if (hci_dev_test_and_clear_flag(hdev, HCI_SERVICE_CACHE)) { 2790 cancel_delayed_work_sync(&hdev->service_cache); 2791 err = hci_update_eir_sync(hdev); 2792 } 2793 2794 if (err) 2795 return err; 2796 2797 return hci_update_class_sync(hdev); 2798 } 2799 2800 static int set_dev_class(struct sock *sk, struct hci_dev *hdev, void *data, 2801 u16 len) 2802 { 2803 struct mgmt_cp_set_dev_class *cp = data; 2804 struct mgmt_pending_cmd *cmd; 2805 int err; 2806 2807 bt_dev_dbg(hdev, "sock %p", sk); 2808 2809 if (!lmp_bredr_capable(hdev)) 2810 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 2811 MGMT_STATUS_NOT_SUPPORTED); 2812 2813 hci_dev_lock(hdev); 2814 2815 if (pending_eir_or_class(hdev)) { 2816 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 2817 MGMT_STATUS_BUSY); 2818 goto unlock; 2819 } 2820 2821 if ((cp->minor & 0x03) != 0 || (cp->major & 0xe0) != 0) { 2822 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 2823 MGMT_STATUS_INVALID_PARAMS); 2824 goto unlock; 2825 } 2826 2827 hdev->major_class = cp->major; 2828 hdev->minor_class = cp->minor; 2829 2830 if (!hdev_is_powered(hdev)) { 2831 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 0, 2832 hdev->dev_class, 3); 2833 goto unlock; 2834 } 2835 2836 cmd = mgmt_pending_new(sk, MGMT_OP_SET_DEV_CLASS, hdev, data, len); 2837 if (!cmd) { 2838 err = -ENOMEM; 2839 goto unlock; 2840 } 2841 2842 err = hci_cmd_sync_queue(hdev, set_class_sync, cmd, 2843 mgmt_class_complete); 2844 if (err < 0) 2845 mgmt_pending_free(cmd); 2846 2847 unlock: 2848 hci_dev_unlock(hdev); 2849 return err; 2850 } 2851 2852 static int load_link_keys(struct sock *sk, struct hci_dev *hdev, void *data, 2853 u16 len) 2854 { 2855 struct mgmt_cp_load_link_keys *cp = data; 2856 const u16 max_key_count = ((U16_MAX - sizeof(*cp)) / 2857 sizeof(struct mgmt_link_key_info)); 2858 u16 key_count, expected_len; 2859 bool changed; 2860 int i; 2861 2862 bt_dev_dbg(hdev, "sock %p", sk); 2863 2864 if (!lmp_bredr_capable(hdev)) 2865 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS, 2866 MGMT_STATUS_NOT_SUPPORTED); 2867 2868 key_count = __le16_to_cpu(cp->key_count); 2869 if (key_count > max_key_count) { 2870 bt_dev_err(hdev, "load_link_keys: too big key_count value %u", 2871 key_count); 2872 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS, 2873 MGMT_STATUS_INVALID_PARAMS); 2874 } 2875 2876 expected_len = struct_size(cp, keys, key_count); 2877 if (expected_len != len) { 2878 bt_dev_err(hdev, "load_link_keys: expected %u bytes, got %u bytes", 2879 expected_len, len); 2880 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS, 2881 MGMT_STATUS_INVALID_PARAMS); 2882 } 2883 2884 if (cp->debug_keys != 0x00 && cp->debug_keys != 0x01) 2885 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS, 2886 MGMT_STATUS_INVALID_PARAMS); 2887 2888 bt_dev_dbg(hdev, "debug_keys %u key_count %u", cp->debug_keys, 2889 key_count); 2890 2891 for (i = 0; i < key_count; i++) { 2892 struct mgmt_link_key_info *key = &cp->keys[i]; 2893 2894 if (key->addr.type != BDADDR_BREDR || key->type > 0x08) 2895 return mgmt_cmd_status(sk, hdev->id, 2896 MGMT_OP_LOAD_LINK_KEYS, 2897 MGMT_STATUS_INVALID_PARAMS); 2898 } 2899 2900 hci_dev_lock(hdev); 2901 2902 hci_link_keys_clear(hdev); 2903 2904 if (cp->debug_keys) 2905 changed = !hci_dev_test_and_set_flag(hdev, HCI_KEEP_DEBUG_KEYS); 2906 else 2907 changed = hci_dev_test_and_clear_flag(hdev, 2908 HCI_KEEP_DEBUG_KEYS); 2909 2910 if (changed) 2911 new_settings(hdev, NULL); 2912 2913 for (i = 0; i < key_count; i++) { 2914 struct mgmt_link_key_info *key = &cp->keys[i]; 2915 2916 if (hci_is_blocked_key(hdev, 2917 HCI_BLOCKED_KEY_TYPE_LINKKEY, 2918 key->val)) { 2919 bt_dev_warn(hdev, "Skipping blocked link key for %pMR", 2920 &key->addr.bdaddr); 2921 continue; 2922 } 2923 2924 /* Always ignore debug keys and require a new pairing if 2925 * the user wants to use them. 2926 */ 2927 if (key->type == HCI_LK_DEBUG_COMBINATION) 2928 continue; 2929 2930 hci_add_link_key(hdev, NULL, &key->addr.bdaddr, key->val, 2931 key->type, key->pin_len, NULL); 2932 } 2933 2934 mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS, 0, NULL, 0); 2935 2936 hci_dev_unlock(hdev); 2937 2938 return 0; 2939 } 2940 2941 static int device_unpaired(struct hci_dev *hdev, bdaddr_t *bdaddr, 2942 u8 addr_type, struct sock *skip_sk) 2943 { 2944 struct mgmt_ev_device_unpaired ev; 2945 2946 bacpy(&ev.addr.bdaddr, bdaddr); 2947 ev.addr.type = addr_type; 2948 2949 return mgmt_event(MGMT_EV_DEVICE_UNPAIRED, hdev, &ev, sizeof(ev), 2950 skip_sk); 2951 } 2952 2953 static void unpair_device_complete(struct hci_dev *hdev, void *data, int err) 2954 { 2955 struct mgmt_pending_cmd *cmd = data; 2956 struct mgmt_cp_unpair_device *cp = cmd->param; 2957 2958 if (!err) 2959 device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, cmd->sk); 2960 2961 cmd->cmd_complete(cmd, err); 2962 mgmt_pending_free(cmd); 2963 } 2964 2965 static int unpair_device_sync(struct hci_dev *hdev, void *data) 2966 { 2967 struct mgmt_pending_cmd *cmd = data; 2968 struct mgmt_cp_unpair_device *cp = cmd->param; 2969 struct hci_conn *conn; 2970 2971 if (cp->addr.type == BDADDR_BREDR) 2972 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, 2973 &cp->addr.bdaddr); 2974 else 2975 conn = hci_conn_hash_lookup_le(hdev, &cp->addr.bdaddr, 2976 le_addr_type(cp->addr.type)); 2977 2978 if (!conn) 2979 return 0; 2980 2981 return hci_abort_conn_sync(hdev, conn, HCI_ERROR_REMOTE_USER_TERM); 2982 } 2983 2984 static int unpair_device(struct sock *sk, struct hci_dev *hdev, void *data, 2985 u16 len) 2986 { 2987 struct mgmt_cp_unpair_device *cp = data; 2988 struct mgmt_rp_unpair_device rp; 2989 struct hci_conn_params *params; 2990 struct mgmt_pending_cmd *cmd; 2991 struct hci_conn *conn; 2992 u8 addr_type; 2993 int err; 2994 2995 memset(&rp, 0, sizeof(rp)); 2996 bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr); 2997 rp.addr.type = cp->addr.type; 2998 2999 if (!bdaddr_type_is_valid(cp->addr.type)) 3000 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE, 3001 MGMT_STATUS_INVALID_PARAMS, 3002 &rp, sizeof(rp)); 3003 3004 if (cp->disconnect != 0x00 && cp->disconnect != 0x01) 3005 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE, 3006 MGMT_STATUS_INVALID_PARAMS, 3007 &rp, sizeof(rp)); 3008 3009 hci_dev_lock(hdev); 3010 3011 if (!hdev_is_powered(hdev)) { 3012 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE, 3013 MGMT_STATUS_NOT_POWERED, &rp, 3014 sizeof(rp)); 3015 goto unlock; 3016 } 3017 3018 if (cp->addr.type == BDADDR_BREDR) { 3019 /* If disconnection is requested, then look up the 3020 * connection. If the remote device is connected, it 3021 * will be later used to terminate the link. 3022 * 3023 * Setting it to NULL explicitly will cause no 3024 * termination of the link. 3025 */ 3026 if (cp->disconnect) 3027 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, 3028 &cp->addr.bdaddr); 3029 else 3030 conn = NULL; 3031 3032 err = hci_remove_link_key(hdev, &cp->addr.bdaddr); 3033 if (err < 0) { 3034 err = mgmt_cmd_complete(sk, hdev->id, 3035 MGMT_OP_UNPAIR_DEVICE, 3036 MGMT_STATUS_NOT_PAIRED, &rp, 3037 sizeof(rp)); 3038 goto unlock; 3039 } 3040 3041 goto done; 3042 } 3043 3044 /* LE address type */ 3045 addr_type = le_addr_type(cp->addr.type); 3046 3047 /* Abort any ongoing SMP pairing. Removes ltk and irk if they exist. */ 3048 err = smp_cancel_and_remove_pairing(hdev, &cp->addr.bdaddr, addr_type); 3049 if (err < 0) { 3050 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE, 3051 MGMT_STATUS_NOT_PAIRED, &rp, 3052 sizeof(rp)); 3053 goto unlock; 3054 } 3055 3056 conn = hci_conn_hash_lookup_le(hdev, &cp->addr.bdaddr, addr_type); 3057 if (!conn) { 3058 hci_conn_params_del(hdev, &cp->addr.bdaddr, addr_type); 3059 goto done; 3060 } 3061 3062 3063 /* Defer clearing up the connection parameters until closing to 3064 * give a chance of keeping them if a repairing happens. 3065 */ 3066 set_bit(HCI_CONN_PARAM_REMOVAL_PEND, &conn->flags); 3067 3068 /* Disable auto-connection parameters if present */ 3069 params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr, addr_type); 3070 if (params) { 3071 if (params->explicit_connect) 3072 params->auto_connect = HCI_AUTO_CONN_EXPLICIT; 3073 else 3074 params->auto_connect = HCI_AUTO_CONN_DISABLED; 3075 } 3076 3077 /* If disconnection is not requested, then clear the connection 3078 * variable so that the link is not terminated. 3079 */ 3080 if (!cp->disconnect) 3081 conn = NULL; 3082 3083 done: 3084 /* If the connection variable is set, then termination of the 3085 * link is requested. 3086 */ 3087 if (!conn) { 3088 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE, 0, 3089 &rp, sizeof(rp)); 3090 device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, sk); 3091 goto unlock; 3092 } 3093 3094 cmd = mgmt_pending_new(sk, MGMT_OP_UNPAIR_DEVICE, hdev, cp, 3095 sizeof(*cp)); 3096 if (!cmd) { 3097 err = -ENOMEM; 3098 goto unlock; 3099 } 3100 3101 cmd->cmd_complete = addr_cmd_complete; 3102 3103 err = hci_cmd_sync_queue(hdev, unpair_device_sync, cmd, 3104 unpair_device_complete); 3105 if (err < 0) 3106 mgmt_pending_free(cmd); 3107 3108 unlock: 3109 hci_dev_unlock(hdev); 3110 return err; 3111 } 3112 3113 static int disconnect(struct sock *sk, struct hci_dev *hdev, void *data, 3114 u16 len) 3115 { 3116 struct mgmt_cp_disconnect *cp = data; 3117 struct mgmt_rp_disconnect rp; 3118 struct mgmt_pending_cmd *cmd; 3119 struct hci_conn *conn; 3120 int err; 3121 3122 bt_dev_dbg(hdev, "sock %p", sk); 3123 3124 memset(&rp, 0, sizeof(rp)); 3125 bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr); 3126 rp.addr.type = cp->addr.type; 3127 3128 if (!bdaddr_type_is_valid(cp->addr.type)) 3129 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT, 3130 MGMT_STATUS_INVALID_PARAMS, 3131 &rp, sizeof(rp)); 3132 3133 hci_dev_lock(hdev); 3134 3135 if (!test_bit(HCI_UP, &hdev->flags)) { 3136 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT, 3137 MGMT_STATUS_NOT_POWERED, &rp, 3138 sizeof(rp)); 3139 goto failed; 3140 } 3141 3142 if (pending_find(MGMT_OP_DISCONNECT, hdev)) { 3143 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT, 3144 MGMT_STATUS_BUSY, &rp, sizeof(rp)); 3145 goto failed; 3146 } 3147 3148 if (cp->addr.type == BDADDR_BREDR) 3149 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, 3150 &cp->addr.bdaddr); 3151 else 3152 conn = hci_conn_hash_lookup_le(hdev, &cp->addr.bdaddr, 3153 le_addr_type(cp->addr.type)); 3154 3155 if (!conn || conn->state == BT_OPEN || conn->state == BT_CLOSED) { 3156 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT, 3157 MGMT_STATUS_NOT_CONNECTED, &rp, 3158 sizeof(rp)); 3159 goto failed; 3160 } 3161 3162 cmd = mgmt_pending_add(sk, MGMT_OP_DISCONNECT, hdev, data, len); 3163 if (!cmd) { 3164 err = -ENOMEM; 3165 goto failed; 3166 } 3167 3168 cmd->cmd_complete = generic_cmd_complete; 3169 3170 err = hci_disconnect(conn, HCI_ERROR_REMOTE_USER_TERM); 3171 if (err < 0) 3172 mgmt_pending_remove(cmd); 3173 3174 failed: 3175 hci_dev_unlock(hdev); 3176 return err; 3177 } 3178 3179 static u8 link_to_bdaddr(u8 link_type, u8 addr_type) 3180 { 3181 switch (link_type) { 3182 case LE_LINK: 3183 switch (addr_type) { 3184 case ADDR_LE_DEV_PUBLIC: 3185 return BDADDR_LE_PUBLIC; 3186 3187 default: 3188 /* Fallback to LE Random address type */ 3189 return BDADDR_LE_RANDOM; 3190 } 3191 3192 default: 3193 /* Fallback to BR/EDR type */ 3194 return BDADDR_BREDR; 3195 } 3196 } 3197 3198 static int get_connections(struct sock *sk, struct hci_dev *hdev, void *data, 3199 u16 data_len) 3200 { 3201 struct mgmt_rp_get_connections *rp; 3202 struct hci_conn *c; 3203 int err; 3204 u16 i; 3205 3206 bt_dev_dbg(hdev, "sock %p", sk); 3207 3208 hci_dev_lock(hdev); 3209 3210 if (!hdev_is_powered(hdev)) { 3211 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_CONNECTIONS, 3212 MGMT_STATUS_NOT_POWERED); 3213 goto unlock; 3214 } 3215 3216 i = 0; 3217 list_for_each_entry(c, &hdev->conn_hash.list, list) { 3218 if (test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags)) 3219 i++; 3220 } 3221 3222 rp = kmalloc(struct_size(rp, addr, i), GFP_KERNEL); 3223 if (!rp) { 3224 err = -ENOMEM; 3225 goto unlock; 3226 } 3227 3228 i = 0; 3229 list_for_each_entry(c, &hdev->conn_hash.list, list) { 3230 if (!test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags)) 3231 continue; 3232 bacpy(&rp->addr[i].bdaddr, &c->dst); 3233 rp->addr[i].type = link_to_bdaddr(c->type, c->dst_type); 3234 if (c->type == SCO_LINK || c->type == ESCO_LINK) 3235 continue; 3236 i++; 3237 } 3238 3239 rp->conn_count = cpu_to_le16(i); 3240 3241 /* Recalculate length in case of filtered SCO connections, etc */ 3242 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONNECTIONS, 0, rp, 3243 struct_size(rp, addr, i)); 3244 3245 kfree(rp); 3246 3247 unlock: 3248 hci_dev_unlock(hdev); 3249 return err; 3250 } 3251 3252 static int send_pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev, 3253 struct mgmt_cp_pin_code_neg_reply *cp) 3254 { 3255 struct mgmt_pending_cmd *cmd; 3256 int err; 3257 3258 cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_NEG_REPLY, hdev, cp, 3259 sizeof(*cp)); 3260 if (!cmd) 3261 return -ENOMEM; 3262 3263 cmd->cmd_complete = addr_cmd_complete; 3264 3265 err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_NEG_REPLY, 3266 sizeof(cp->addr.bdaddr), &cp->addr.bdaddr); 3267 if (err < 0) 3268 mgmt_pending_remove(cmd); 3269 3270 return err; 3271 } 3272 3273 static int pin_code_reply(struct sock *sk, struct hci_dev *hdev, void *data, 3274 u16 len) 3275 { 3276 struct hci_conn *conn; 3277 struct mgmt_cp_pin_code_reply *cp = data; 3278 struct hci_cp_pin_code_reply reply; 3279 struct mgmt_pending_cmd *cmd; 3280 int err; 3281 3282 bt_dev_dbg(hdev, "sock %p", sk); 3283 3284 hci_dev_lock(hdev); 3285 3286 if (!hdev_is_powered(hdev)) { 3287 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY, 3288 MGMT_STATUS_NOT_POWERED); 3289 goto failed; 3290 } 3291 3292 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->addr.bdaddr); 3293 if (!conn) { 3294 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY, 3295 MGMT_STATUS_NOT_CONNECTED); 3296 goto failed; 3297 } 3298 3299 if (conn->pending_sec_level == BT_SECURITY_HIGH && cp->pin_len != 16) { 3300 struct mgmt_cp_pin_code_neg_reply ncp; 3301 3302 memcpy(&ncp.addr, &cp->addr, sizeof(ncp.addr)); 3303 3304 bt_dev_err(hdev, "PIN code is not 16 bytes long"); 3305 3306 err = send_pin_code_neg_reply(sk, hdev, &ncp); 3307 if (err >= 0) 3308 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY, 3309 MGMT_STATUS_INVALID_PARAMS); 3310 3311 goto failed; 3312 } 3313 3314 cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_REPLY, hdev, data, len); 3315 if (!cmd) { 3316 err = -ENOMEM; 3317 goto failed; 3318 } 3319 3320 cmd->cmd_complete = addr_cmd_complete; 3321 3322 bacpy(&reply.bdaddr, &cp->addr.bdaddr); 3323 reply.pin_len = cp->pin_len; 3324 memcpy(reply.pin_code, cp->pin_code, sizeof(reply.pin_code)); 3325 3326 err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_REPLY, sizeof(reply), &reply); 3327 if (err < 0) 3328 mgmt_pending_remove(cmd); 3329 3330 failed: 3331 hci_dev_unlock(hdev); 3332 return err; 3333 } 3334 3335 static int set_io_capability(struct sock *sk, struct hci_dev *hdev, void *data, 3336 u16 len) 3337 { 3338 struct mgmt_cp_set_io_capability *cp = data; 3339 3340 bt_dev_dbg(hdev, "sock %p", sk); 3341 3342 if (cp->io_capability > SMP_IO_KEYBOARD_DISPLAY) 3343 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_IO_CAPABILITY, 3344 MGMT_STATUS_INVALID_PARAMS); 3345 3346 hci_dev_lock(hdev); 3347 3348 hdev->io_capability = cp->io_capability; 3349 3350 bt_dev_dbg(hdev, "IO capability set to 0x%02x", hdev->io_capability); 3351 3352 hci_dev_unlock(hdev); 3353 3354 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_IO_CAPABILITY, 0, 3355 NULL, 0); 3356 } 3357 3358 static struct mgmt_pending_cmd *find_pairing(struct hci_conn *conn) 3359 { 3360 struct hci_dev *hdev = conn->hdev; 3361 struct mgmt_pending_cmd *cmd; 3362 3363 list_for_each_entry(cmd, &hdev->mgmt_pending, list) { 3364 if (cmd->opcode != MGMT_OP_PAIR_DEVICE) 3365 continue; 3366 3367 if (cmd->user_data != conn) 3368 continue; 3369 3370 return cmd; 3371 } 3372 3373 return NULL; 3374 } 3375 3376 static int pairing_complete(struct mgmt_pending_cmd *cmd, u8 status) 3377 { 3378 struct mgmt_rp_pair_device rp; 3379 struct hci_conn *conn = cmd->user_data; 3380 int err; 3381 3382 bacpy(&rp.addr.bdaddr, &conn->dst); 3383 rp.addr.type = link_to_bdaddr(conn->type, conn->dst_type); 3384 3385 err = mgmt_cmd_complete(cmd->sk, cmd->index, MGMT_OP_PAIR_DEVICE, 3386 status, &rp, sizeof(rp)); 3387 3388 /* So we don't get further callbacks for this connection */ 3389 conn->connect_cfm_cb = NULL; 3390 conn->security_cfm_cb = NULL; 3391 conn->disconn_cfm_cb = NULL; 3392 3393 hci_conn_drop(conn); 3394 3395 /* The device is paired so there is no need to remove 3396 * its connection parameters anymore. 3397 */ 3398 clear_bit(HCI_CONN_PARAM_REMOVAL_PEND, &conn->flags); 3399 3400 hci_conn_put(conn); 3401 3402 return err; 3403 } 3404 3405 void mgmt_smp_complete(struct hci_conn *conn, bool complete) 3406 { 3407 u8 status = complete ? MGMT_STATUS_SUCCESS : MGMT_STATUS_FAILED; 3408 struct mgmt_pending_cmd *cmd; 3409 3410 cmd = find_pairing(conn); 3411 if (cmd) { 3412 cmd->cmd_complete(cmd, status); 3413 mgmt_pending_remove(cmd); 3414 } 3415 } 3416 3417 static void pairing_complete_cb(struct hci_conn *conn, u8 status) 3418 { 3419 struct mgmt_pending_cmd *cmd; 3420 3421 BT_DBG("status %u", status); 3422 3423 cmd = find_pairing(conn); 3424 if (!cmd) { 3425 BT_DBG("Unable to find a pending command"); 3426 return; 3427 } 3428 3429 cmd->cmd_complete(cmd, mgmt_status(status)); 3430 mgmt_pending_remove(cmd); 3431 } 3432 3433 static void le_pairing_complete_cb(struct hci_conn *conn, u8 status) 3434 { 3435 struct mgmt_pending_cmd *cmd; 3436 3437 BT_DBG("status %u", status); 3438 3439 if (!status) 3440 return; 3441 3442 cmd = find_pairing(conn); 3443 if (!cmd) { 3444 BT_DBG("Unable to find a pending command"); 3445 return; 3446 } 3447 3448 cmd->cmd_complete(cmd, mgmt_status(status)); 3449 mgmt_pending_remove(cmd); 3450 } 3451 3452 static int pair_device(struct sock *sk, struct hci_dev *hdev, void *data, 3453 u16 len) 3454 { 3455 struct mgmt_cp_pair_device *cp = data; 3456 struct mgmt_rp_pair_device rp; 3457 struct mgmt_pending_cmd *cmd; 3458 u8 sec_level, auth_type; 3459 struct hci_conn *conn; 3460 int err; 3461 3462 bt_dev_dbg(hdev, "sock %p", sk); 3463 3464 memset(&rp, 0, sizeof(rp)); 3465 bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr); 3466 rp.addr.type = cp->addr.type; 3467 3468 if (!bdaddr_type_is_valid(cp->addr.type)) 3469 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE, 3470 MGMT_STATUS_INVALID_PARAMS, 3471 &rp, sizeof(rp)); 3472 3473 if (cp->io_cap > SMP_IO_KEYBOARD_DISPLAY) 3474 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE, 3475 MGMT_STATUS_INVALID_PARAMS, 3476 &rp, sizeof(rp)); 3477 3478 hci_dev_lock(hdev); 3479 3480 if (!hdev_is_powered(hdev)) { 3481 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE, 3482 MGMT_STATUS_NOT_POWERED, &rp, 3483 sizeof(rp)); 3484 goto unlock; 3485 } 3486 3487 if (hci_bdaddr_is_paired(hdev, &cp->addr.bdaddr, cp->addr.type)) { 3488 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE, 3489 MGMT_STATUS_ALREADY_PAIRED, &rp, 3490 sizeof(rp)); 3491 goto unlock; 3492 } 3493 3494 sec_level = BT_SECURITY_MEDIUM; 3495 auth_type = HCI_AT_DEDICATED_BONDING; 3496 3497 if (cp->addr.type == BDADDR_BREDR) { 3498 conn = hci_connect_acl(hdev, &cp->addr.bdaddr, sec_level, 3499 auth_type, CONN_REASON_PAIR_DEVICE); 3500 } else { 3501 u8 addr_type = le_addr_type(cp->addr.type); 3502 struct hci_conn_params *p; 3503 3504 /* When pairing a new device, it is expected to remember 3505 * this device for future connections. Adding the connection 3506 * parameter information ahead of time allows tracking 3507 * of the peripheral preferred values and will speed up any 3508 * further connection establishment. 3509 * 3510 * If connection parameters already exist, then they 3511 * will be kept and this function does nothing. 3512 */ 3513 p = hci_conn_params_add(hdev, &cp->addr.bdaddr, addr_type); 3514 3515 if (p->auto_connect == HCI_AUTO_CONN_EXPLICIT) 3516 p->auto_connect = HCI_AUTO_CONN_DISABLED; 3517 3518 conn = hci_connect_le_scan(hdev, &cp->addr.bdaddr, addr_type, 3519 sec_level, HCI_LE_CONN_TIMEOUT, 3520 CONN_REASON_PAIR_DEVICE); 3521 } 3522 3523 if (IS_ERR(conn)) { 3524 int status; 3525 3526 if (PTR_ERR(conn) == -EBUSY) 3527 status = MGMT_STATUS_BUSY; 3528 else if (PTR_ERR(conn) == -EOPNOTSUPP) 3529 status = MGMT_STATUS_NOT_SUPPORTED; 3530 else if (PTR_ERR(conn) == -ECONNREFUSED) 3531 status = MGMT_STATUS_REJECTED; 3532 else 3533 status = MGMT_STATUS_CONNECT_FAILED; 3534 3535 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE, 3536 status, &rp, sizeof(rp)); 3537 goto unlock; 3538 } 3539 3540 if (conn->connect_cfm_cb) { 3541 hci_conn_drop(conn); 3542 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE, 3543 MGMT_STATUS_BUSY, &rp, sizeof(rp)); 3544 goto unlock; 3545 } 3546 3547 cmd = mgmt_pending_add(sk, MGMT_OP_PAIR_DEVICE, hdev, data, len); 3548 if (!cmd) { 3549 err = -ENOMEM; 3550 hci_conn_drop(conn); 3551 goto unlock; 3552 } 3553 3554 cmd->cmd_complete = pairing_complete; 3555 3556 /* For LE, just connecting isn't a proof that the pairing finished */ 3557 if (cp->addr.type == BDADDR_BREDR) { 3558 conn->connect_cfm_cb = pairing_complete_cb; 3559 conn->security_cfm_cb = pairing_complete_cb; 3560 conn->disconn_cfm_cb = pairing_complete_cb; 3561 } else { 3562 conn->connect_cfm_cb = le_pairing_complete_cb; 3563 conn->security_cfm_cb = le_pairing_complete_cb; 3564 conn->disconn_cfm_cb = le_pairing_complete_cb; 3565 } 3566 3567 conn->io_capability = cp->io_cap; 3568 cmd->user_data = hci_conn_get(conn); 3569 3570 if ((conn->state == BT_CONNECTED || conn->state == BT_CONFIG) && 3571 hci_conn_security(conn, sec_level, auth_type, true)) { 3572 cmd->cmd_complete(cmd, 0); 3573 mgmt_pending_remove(cmd); 3574 } 3575 3576 err = 0; 3577 3578 unlock: 3579 hci_dev_unlock(hdev); 3580 return err; 3581 } 3582 3583 static int abort_conn_sync(struct hci_dev *hdev, void *data) 3584 { 3585 struct hci_conn *conn; 3586 u16 handle = PTR_ERR(data); 3587 3588 conn = hci_conn_hash_lookup_handle(hdev, handle); 3589 if (!conn) 3590 return 0; 3591 3592 return hci_abort_conn_sync(hdev, conn, HCI_ERROR_REMOTE_USER_TERM); 3593 } 3594 3595 static int cancel_pair_device(struct sock *sk, struct hci_dev *hdev, void *data, 3596 u16 len) 3597 { 3598 struct mgmt_addr_info *addr = data; 3599 struct mgmt_pending_cmd *cmd; 3600 struct hci_conn *conn; 3601 int err; 3602 3603 bt_dev_dbg(hdev, "sock %p", sk); 3604 3605 hci_dev_lock(hdev); 3606 3607 if (!hdev_is_powered(hdev)) { 3608 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE, 3609 MGMT_STATUS_NOT_POWERED); 3610 goto unlock; 3611 } 3612 3613 cmd = pending_find(MGMT_OP_PAIR_DEVICE, hdev); 3614 if (!cmd) { 3615 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE, 3616 MGMT_STATUS_INVALID_PARAMS); 3617 goto unlock; 3618 } 3619 3620 conn = cmd->user_data; 3621 3622 if (bacmp(&addr->bdaddr, &conn->dst) != 0) { 3623 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE, 3624 MGMT_STATUS_INVALID_PARAMS); 3625 goto unlock; 3626 } 3627 3628 cmd->cmd_complete(cmd, MGMT_STATUS_CANCELLED); 3629 mgmt_pending_remove(cmd); 3630 3631 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE, 0, 3632 addr, sizeof(*addr)); 3633 3634 /* Since user doesn't want to proceed with the connection, abort any 3635 * ongoing pairing and then terminate the link if it was created 3636 * because of the pair device action. 3637 */ 3638 if (addr->type == BDADDR_BREDR) 3639 hci_remove_link_key(hdev, &addr->bdaddr); 3640 else 3641 smp_cancel_and_remove_pairing(hdev, &addr->bdaddr, 3642 le_addr_type(addr->type)); 3643 3644 if (conn->conn_reason == CONN_REASON_PAIR_DEVICE) 3645 hci_cmd_sync_queue(hdev, abort_conn_sync, ERR_PTR(conn->handle), 3646 NULL); 3647 3648 unlock: 3649 hci_dev_unlock(hdev); 3650 return err; 3651 } 3652 3653 static int user_pairing_resp(struct sock *sk, struct hci_dev *hdev, 3654 struct mgmt_addr_info *addr, u16 mgmt_op, 3655 u16 hci_op, __le32 passkey) 3656 { 3657 struct mgmt_pending_cmd *cmd; 3658 struct hci_conn *conn; 3659 int err; 3660 3661 hci_dev_lock(hdev); 3662 3663 if (!hdev_is_powered(hdev)) { 3664 err = mgmt_cmd_complete(sk, hdev->id, mgmt_op, 3665 MGMT_STATUS_NOT_POWERED, addr, 3666 sizeof(*addr)); 3667 goto done; 3668 } 3669 3670 if (addr->type == BDADDR_BREDR) 3671 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &addr->bdaddr); 3672 else 3673 conn = hci_conn_hash_lookup_le(hdev, &addr->bdaddr, 3674 le_addr_type(addr->type)); 3675 3676 if (!conn) { 3677 err = mgmt_cmd_complete(sk, hdev->id, mgmt_op, 3678 MGMT_STATUS_NOT_CONNECTED, addr, 3679 sizeof(*addr)); 3680 goto done; 3681 } 3682 3683 if (addr->type == BDADDR_LE_PUBLIC || addr->type == BDADDR_LE_RANDOM) { 3684 err = smp_user_confirm_reply(conn, mgmt_op, passkey); 3685 if (!err) 3686 err = mgmt_cmd_complete(sk, hdev->id, mgmt_op, 3687 MGMT_STATUS_SUCCESS, addr, 3688 sizeof(*addr)); 3689 else 3690 err = mgmt_cmd_complete(sk, hdev->id, mgmt_op, 3691 MGMT_STATUS_FAILED, addr, 3692 sizeof(*addr)); 3693 3694 goto done; 3695 } 3696 3697 cmd = mgmt_pending_add(sk, mgmt_op, hdev, addr, sizeof(*addr)); 3698 if (!cmd) { 3699 err = -ENOMEM; 3700 goto done; 3701 } 3702 3703 cmd->cmd_complete = addr_cmd_complete; 3704 3705 /* Continue with pairing via HCI */ 3706 if (hci_op == HCI_OP_USER_PASSKEY_REPLY) { 3707 struct hci_cp_user_passkey_reply cp; 3708 3709 bacpy(&cp.bdaddr, &addr->bdaddr); 3710 cp.passkey = passkey; 3711 err = hci_send_cmd(hdev, hci_op, sizeof(cp), &cp); 3712 } else 3713 err = hci_send_cmd(hdev, hci_op, sizeof(addr->bdaddr), 3714 &addr->bdaddr); 3715 3716 if (err < 0) 3717 mgmt_pending_remove(cmd); 3718 3719 done: 3720 hci_dev_unlock(hdev); 3721 return err; 3722 } 3723 3724 static int pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev, 3725 void *data, u16 len) 3726 { 3727 struct mgmt_cp_pin_code_neg_reply *cp = data; 3728 3729 bt_dev_dbg(hdev, "sock %p", sk); 3730 3731 return user_pairing_resp(sk, hdev, &cp->addr, 3732 MGMT_OP_PIN_CODE_NEG_REPLY, 3733 HCI_OP_PIN_CODE_NEG_REPLY, 0); 3734 } 3735 3736 static int user_confirm_reply(struct sock *sk, struct hci_dev *hdev, void *data, 3737 u16 len) 3738 { 3739 struct mgmt_cp_user_confirm_reply *cp = data; 3740 3741 bt_dev_dbg(hdev, "sock %p", sk); 3742 3743 if (len != sizeof(*cp)) 3744 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_USER_CONFIRM_REPLY, 3745 MGMT_STATUS_INVALID_PARAMS); 3746 3747 return user_pairing_resp(sk, hdev, &cp->addr, 3748 MGMT_OP_USER_CONFIRM_REPLY, 3749 HCI_OP_USER_CONFIRM_REPLY, 0); 3750 } 3751 3752 static int user_confirm_neg_reply(struct sock *sk, struct hci_dev *hdev, 3753 void *data, u16 len) 3754 { 3755 struct mgmt_cp_user_confirm_neg_reply *cp = data; 3756 3757 bt_dev_dbg(hdev, "sock %p", sk); 3758 3759 return user_pairing_resp(sk, hdev, &cp->addr, 3760 MGMT_OP_USER_CONFIRM_NEG_REPLY, 3761 HCI_OP_USER_CONFIRM_NEG_REPLY, 0); 3762 } 3763 3764 static int user_passkey_reply(struct sock *sk, struct hci_dev *hdev, void *data, 3765 u16 len) 3766 { 3767 struct mgmt_cp_user_passkey_reply *cp = data; 3768 3769 bt_dev_dbg(hdev, "sock %p", sk); 3770 3771 return user_pairing_resp(sk, hdev, &cp->addr, 3772 MGMT_OP_USER_PASSKEY_REPLY, 3773 HCI_OP_USER_PASSKEY_REPLY, cp->passkey); 3774 } 3775 3776 static int user_passkey_neg_reply(struct sock *sk, struct hci_dev *hdev, 3777 void *data, u16 len) 3778 { 3779 struct mgmt_cp_user_passkey_neg_reply *cp = data; 3780 3781 bt_dev_dbg(hdev, "sock %p", sk); 3782 3783 return user_pairing_resp(sk, hdev, &cp->addr, 3784 MGMT_OP_USER_PASSKEY_NEG_REPLY, 3785 HCI_OP_USER_PASSKEY_NEG_REPLY, 0); 3786 } 3787 3788 static int adv_expire_sync(struct hci_dev *hdev, u32 flags) 3789 { 3790 struct adv_info *adv_instance; 3791 3792 adv_instance = hci_find_adv_instance(hdev, hdev->cur_adv_instance); 3793 if (!adv_instance) 3794 return 0; 3795 3796 /* stop if current instance doesn't need to be changed */ 3797 if (!(adv_instance->flags & flags)) 3798 return 0; 3799 3800 cancel_adv_timeout(hdev); 3801 3802 adv_instance = hci_get_next_instance(hdev, adv_instance->instance); 3803 if (!adv_instance) 3804 return 0; 3805 3806 hci_schedule_adv_instance_sync(hdev, adv_instance->instance, true); 3807 3808 return 0; 3809 } 3810 3811 static int name_changed_sync(struct hci_dev *hdev, void *data) 3812 { 3813 return adv_expire_sync(hdev, MGMT_ADV_FLAG_LOCAL_NAME); 3814 } 3815 3816 static void set_name_complete(struct hci_dev *hdev, void *data, int err) 3817 { 3818 struct mgmt_pending_cmd *cmd = data; 3819 struct mgmt_cp_set_local_name *cp = cmd->param; 3820 u8 status = mgmt_status(err); 3821 3822 bt_dev_dbg(hdev, "err %d", err); 3823 3824 if (cmd != pending_find(MGMT_OP_SET_LOCAL_NAME, hdev)) 3825 return; 3826 3827 if (status) { 3828 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 3829 status); 3830 } else { 3831 mgmt_cmd_complete(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0, 3832 cp, sizeof(*cp)); 3833 3834 if (hci_dev_test_flag(hdev, HCI_LE_ADV)) 3835 hci_cmd_sync_queue(hdev, name_changed_sync, NULL, NULL); 3836 } 3837 3838 mgmt_pending_remove(cmd); 3839 } 3840 3841 static int set_name_sync(struct hci_dev *hdev, void *data) 3842 { 3843 if (lmp_bredr_capable(hdev)) { 3844 hci_update_name_sync(hdev); 3845 hci_update_eir_sync(hdev); 3846 } 3847 3848 /* The name is stored in the scan response data and so 3849 * no need to update the advertising data here. 3850 */ 3851 if (lmp_le_capable(hdev) && hci_dev_test_flag(hdev, HCI_ADVERTISING)) 3852 hci_update_scan_rsp_data_sync(hdev, hdev->cur_adv_instance); 3853 3854 return 0; 3855 } 3856 3857 static int set_local_name(struct sock *sk, struct hci_dev *hdev, void *data, 3858 u16 len) 3859 { 3860 struct mgmt_cp_set_local_name *cp = data; 3861 struct mgmt_pending_cmd *cmd; 3862 int err; 3863 3864 bt_dev_dbg(hdev, "sock %p", sk); 3865 3866 hci_dev_lock(hdev); 3867 3868 /* If the old values are the same as the new ones just return a 3869 * direct command complete event. 3870 */ 3871 if (!memcmp(hdev->dev_name, cp->name, sizeof(hdev->dev_name)) && 3872 !memcmp(hdev->short_name, cp->short_name, 3873 sizeof(hdev->short_name))) { 3874 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0, 3875 data, len); 3876 goto failed; 3877 } 3878 3879 memcpy(hdev->short_name, cp->short_name, sizeof(hdev->short_name)); 3880 3881 if (!hdev_is_powered(hdev)) { 3882 memcpy(hdev->dev_name, cp->name, sizeof(hdev->dev_name)); 3883 3884 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0, 3885 data, len); 3886 if (err < 0) 3887 goto failed; 3888 3889 err = mgmt_limited_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, data, 3890 len, HCI_MGMT_LOCAL_NAME_EVENTS, sk); 3891 ext_info_changed(hdev, sk); 3892 3893 goto failed; 3894 } 3895 3896 cmd = mgmt_pending_add(sk, MGMT_OP_SET_LOCAL_NAME, hdev, data, len); 3897 if (!cmd) 3898 err = -ENOMEM; 3899 else 3900 err = hci_cmd_sync_queue(hdev, set_name_sync, cmd, 3901 set_name_complete); 3902 3903 if (err < 0) { 3904 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 3905 MGMT_STATUS_FAILED); 3906 3907 if (cmd) 3908 mgmt_pending_remove(cmd); 3909 3910 goto failed; 3911 } 3912 3913 memcpy(hdev->dev_name, cp->name, sizeof(hdev->dev_name)); 3914 3915 failed: 3916 hci_dev_unlock(hdev); 3917 return err; 3918 } 3919 3920 static int appearance_changed_sync(struct hci_dev *hdev, void *data) 3921 { 3922 return adv_expire_sync(hdev, MGMT_ADV_FLAG_APPEARANCE); 3923 } 3924 3925 static int set_appearance(struct sock *sk, struct hci_dev *hdev, void *data, 3926 u16 len) 3927 { 3928 struct mgmt_cp_set_appearance *cp = data; 3929 u16 appearance; 3930 int err; 3931 3932 bt_dev_dbg(hdev, "sock %p", sk); 3933 3934 if (!lmp_le_capable(hdev)) 3935 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_APPEARANCE, 3936 MGMT_STATUS_NOT_SUPPORTED); 3937 3938 appearance = le16_to_cpu(cp->appearance); 3939 3940 hci_dev_lock(hdev); 3941 3942 if (hdev->appearance != appearance) { 3943 hdev->appearance = appearance; 3944 3945 if (hci_dev_test_flag(hdev, HCI_LE_ADV)) 3946 hci_cmd_sync_queue(hdev, appearance_changed_sync, NULL, 3947 NULL); 3948 3949 ext_info_changed(hdev, sk); 3950 } 3951 3952 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_APPEARANCE, 0, NULL, 3953 0); 3954 3955 hci_dev_unlock(hdev); 3956 3957 return err; 3958 } 3959 3960 static int get_phy_configuration(struct sock *sk, struct hci_dev *hdev, 3961 void *data, u16 len) 3962 { 3963 struct mgmt_rp_get_phy_configuration rp; 3964 3965 bt_dev_dbg(hdev, "sock %p", sk); 3966 3967 hci_dev_lock(hdev); 3968 3969 memset(&rp, 0, sizeof(rp)); 3970 3971 rp.supported_phys = cpu_to_le32(get_supported_phys(hdev)); 3972 rp.selected_phys = cpu_to_le32(get_selected_phys(hdev)); 3973 rp.configurable_phys = cpu_to_le32(get_configurable_phys(hdev)); 3974 3975 hci_dev_unlock(hdev); 3976 3977 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_PHY_CONFIGURATION, 0, 3978 &rp, sizeof(rp)); 3979 } 3980 3981 int mgmt_phy_configuration_changed(struct hci_dev *hdev, struct sock *skip) 3982 { 3983 struct mgmt_ev_phy_configuration_changed ev; 3984 3985 memset(&ev, 0, sizeof(ev)); 3986 3987 ev.selected_phys = cpu_to_le32(get_selected_phys(hdev)); 3988 3989 return mgmt_event(MGMT_EV_PHY_CONFIGURATION_CHANGED, hdev, &ev, 3990 sizeof(ev), skip); 3991 } 3992 3993 static void set_default_phy_complete(struct hci_dev *hdev, void *data, int err) 3994 { 3995 struct mgmt_pending_cmd *cmd = data; 3996 struct sk_buff *skb = cmd->skb; 3997 u8 status = mgmt_status(err); 3998 3999 if (cmd != pending_find(MGMT_OP_SET_PHY_CONFIGURATION, hdev)) 4000 return; 4001 4002 if (!status) { 4003 if (!skb) 4004 status = MGMT_STATUS_FAILED; 4005 else if (IS_ERR(skb)) 4006 status = mgmt_status(PTR_ERR(skb)); 4007 else 4008 status = mgmt_status(skb->data[0]); 4009 } 4010 4011 bt_dev_dbg(hdev, "status %d", status); 4012 4013 if (status) { 4014 mgmt_cmd_status(cmd->sk, hdev->id, 4015 MGMT_OP_SET_PHY_CONFIGURATION, status); 4016 } else { 4017 mgmt_cmd_complete(cmd->sk, hdev->id, 4018 MGMT_OP_SET_PHY_CONFIGURATION, 0, 4019 NULL, 0); 4020 4021 mgmt_phy_configuration_changed(hdev, cmd->sk); 4022 } 4023 4024 if (skb && !IS_ERR(skb)) 4025 kfree_skb(skb); 4026 4027 mgmt_pending_remove(cmd); 4028 } 4029 4030 static int set_default_phy_sync(struct hci_dev *hdev, void *data) 4031 { 4032 struct mgmt_pending_cmd *cmd = data; 4033 struct mgmt_cp_set_phy_configuration *cp = cmd->param; 4034 struct hci_cp_le_set_default_phy cp_phy; 4035 u32 selected_phys = __le32_to_cpu(cp->selected_phys); 4036 4037 memset(&cp_phy, 0, sizeof(cp_phy)); 4038 4039 if (!(selected_phys & MGMT_PHY_LE_TX_MASK)) 4040 cp_phy.all_phys |= 0x01; 4041 4042 if (!(selected_phys & MGMT_PHY_LE_RX_MASK)) 4043 cp_phy.all_phys |= 0x02; 4044 4045 if (selected_phys & MGMT_PHY_LE_1M_TX) 4046 cp_phy.tx_phys |= HCI_LE_SET_PHY_1M; 4047 4048 if (selected_phys & MGMT_PHY_LE_2M_TX) 4049 cp_phy.tx_phys |= HCI_LE_SET_PHY_2M; 4050 4051 if (selected_phys & MGMT_PHY_LE_CODED_TX) 4052 cp_phy.tx_phys |= HCI_LE_SET_PHY_CODED; 4053 4054 if (selected_phys & MGMT_PHY_LE_1M_RX) 4055 cp_phy.rx_phys |= HCI_LE_SET_PHY_1M; 4056 4057 if (selected_phys & MGMT_PHY_LE_2M_RX) 4058 cp_phy.rx_phys |= HCI_LE_SET_PHY_2M; 4059 4060 if (selected_phys & MGMT_PHY_LE_CODED_RX) 4061 cp_phy.rx_phys |= HCI_LE_SET_PHY_CODED; 4062 4063 cmd->skb = __hci_cmd_sync(hdev, HCI_OP_LE_SET_DEFAULT_PHY, 4064 sizeof(cp_phy), &cp_phy, HCI_CMD_TIMEOUT); 4065 4066 return 0; 4067 } 4068 4069 static int set_phy_configuration(struct sock *sk, struct hci_dev *hdev, 4070 void *data, u16 len) 4071 { 4072 struct mgmt_cp_set_phy_configuration *cp = data; 4073 struct mgmt_pending_cmd *cmd; 4074 u32 selected_phys, configurable_phys, supported_phys, unconfigure_phys; 4075 u16 pkt_type = (HCI_DH1 | HCI_DM1); 4076 bool changed = false; 4077 int err; 4078 4079 bt_dev_dbg(hdev, "sock %p", sk); 4080 4081 configurable_phys = get_configurable_phys(hdev); 4082 supported_phys = get_supported_phys(hdev); 4083 selected_phys = __le32_to_cpu(cp->selected_phys); 4084 4085 if (selected_phys & ~supported_phys) 4086 return mgmt_cmd_status(sk, hdev->id, 4087 MGMT_OP_SET_PHY_CONFIGURATION, 4088 MGMT_STATUS_INVALID_PARAMS); 4089 4090 unconfigure_phys = supported_phys & ~configurable_phys; 4091 4092 if ((selected_phys & unconfigure_phys) != unconfigure_phys) 4093 return mgmt_cmd_status(sk, hdev->id, 4094 MGMT_OP_SET_PHY_CONFIGURATION, 4095 MGMT_STATUS_INVALID_PARAMS); 4096 4097 if (selected_phys == get_selected_phys(hdev)) 4098 return mgmt_cmd_complete(sk, hdev->id, 4099 MGMT_OP_SET_PHY_CONFIGURATION, 4100 0, NULL, 0); 4101 4102 hci_dev_lock(hdev); 4103 4104 if (!hdev_is_powered(hdev)) { 4105 err = mgmt_cmd_status(sk, hdev->id, 4106 MGMT_OP_SET_PHY_CONFIGURATION, 4107 MGMT_STATUS_REJECTED); 4108 goto unlock; 4109 } 4110 4111 if (pending_find(MGMT_OP_SET_PHY_CONFIGURATION, hdev)) { 4112 err = mgmt_cmd_status(sk, hdev->id, 4113 MGMT_OP_SET_PHY_CONFIGURATION, 4114 MGMT_STATUS_BUSY); 4115 goto unlock; 4116 } 4117 4118 if (selected_phys & MGMT_PHY_BR_1M_3SLOT) 4119 pkt_type |= (HCI_DH3 | HCI_DM3); 4120 else 4121 pkt_type &= ~(HCI_DH3 | HCI_DM3); 4122 4123 if (selected_phys & MGMT_PHY_BR_1M_5SLOT) 4124 pkt_type |= (HCI_DH5 | HCI_DM5); 4125 else 4126 pkt_type &= ~(HCI_DH5 | HCI_DM5); 4127 4128 if (selected_phys & MGMT_PHY_EDR_2M_1SLOT) 4129 pkt_type &= ~HCI_2DH1; 4130 else 4131 pkt_type |= HCI_2DH1; 4132 4133 if (selected_phys & MGMT_PHY_EDR_2M_3SLOT) 4134 pkt_type &= ~HCI_2DH3; 4135 else 4136 pkt_type |= HCI_2DH3; 4137 4138 if (selected_phys & MGMT_PHY_EDR_2M_5SLOT) 4139 pkt_type &= ~HCI_2DH5; 4140 else 4141 pkt_type |= HCI_2DH5; 4142 4143 if (selected_phys & MGMT_PHY_EDR_3M_1SLOT) 4144 pkt_type &= ~HCI_3DH1; 4145 else 4146 pkt_type |= HCI_3DH1; 4147 4148 if (selected_phys & MGMT_PHY_EDR_3M_3SLOT) 4149 pkt_type &= ~HCI_3DH3; 4150 else 4151 pkt_type |= HCI_3DH3; 4152 4153 if (selected_phys & MGMT_PHY_EDR_3M_5SLOT) 4154 pkt_type &= ~HCI_3DH5; 4155 else 4156 pkt_type |= HCI_3DH5; 4157 4158 if (pkt_type != hdev->pkt_type) { 4159 hdev->pkt_type = pkt_type; 4160 changed = true; 4161 } 4162 4163 if ((selected_phys & MGMT_PHY_LE_MASK) == 4164 (get_selected_phys(hdev) & MGMT_PHY_LE_MASK)) { 4165 if (changed) 4166 mgmt_phy_configuration_changed(hdev, sk); 4167 4168 err = mgmt_cmd_complete(sk, hdev->id, 4169 MGMT_OP_SET_PHY_CONFIGURATION, 4170 0, NULL, 0); 4171 4172 goto unlock; 4173 } 4174 4175 cmd = mgmt_pending_add(sk, MGMT_OP_SET_PHY_CONFIGURATION, hdev, data, 4176 len); 4177 if (!cmd) 4178 err = -ENOMEM; 4179 else 4180 err = hci_cmd_sync_queue(hdev, set_default_phy_sync, cmd, 4181 set_default_phy_complete); 4182 4183 if (err < 0) { 4184 err = mgmt_cmd_status(sk, hdev->id, 4185 MGMT_OP_SET_PHY_CONFIGURATION, 4186 MGMT_STATUS_FAILED); 4187 4188 if (cmd) 4189 mgmt_pending_remove(cmd); 4190 } 4191 4192 unlock: 4193 hci_dev_unlock(hdev); 4194 4195 return err; 4196 } 4197 4198 static int set_blocked_keys(struct sock *sk, struct hci_dev *hdev, void *data, 4199 u16 len) 4200 { 4201 int err = MGMT_STATUS_SUCCESS; 4202 struct mgmt_cp_set_blocked_keys *keys = data; 4203 const u16 max_key_count = ((U16_MAX - sizeof(*keys)) / 4204 sizeof(struct mgmt_blocked_key_info)); 4205 u16 key_count, expected_len; 4206 int i; 4207 4208 bt_dev_dbg(hdev, "sock %p", sk); 4209 4210 key_count = __le16_to_cpu(keys->key_count); 4211 if (key_count > max_key_count) { 4212 bt_dev_err(hdev, "too big key_count value %u", key_count); 4213 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BLOCKED_KEYS, 4214 MGMT_STATUS_INVALID_PARAMS); 4215 } 4216 4217 expected_len = struct_size(keys, keys, key_count); 4218 if (expected_len != len) { 4219 bt_dev_err(hdev, "expected %u bytes, got %u bytes", 4220 expected_len, len); 4221 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BLOCKED_KEYS, 4222 MGMT_STATUS_INVALID_PARAMS); 4223 } 4224 4225 hci_dev_lock(hdev); 4226 4227 hci_blocked_keys_clear(hdev); 4228 4229 for (i = 0; i < key_count; ++i) { 4230 struct blocked_key *b = kzalloc(sizeof(*b), GFP_KERNEL); 4231 4232 if (!b) { 4233 err = MGMT_STATUS_NO_RESOURCES; 4234 break; 4235 } 4236 4237 b->type = keys->keys[i].type; 4238 memcpy(b->val, keys->keys[i].val, sizeof(b->val)); 4239 list_add_rcu(&b->list, &hdev->blocked_keys); 4240 } 4241 hci_dev_unlock(hdev); 4242 4243 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_BLOCKED_KEYS, 4244 err, NULL, 0); 4245 } 4246 4247 static int set_wideband_speech(struct sock *sk, struct hci_dev *hdev, 4248 void *data, u16 len) 4249 { 4250 struct mgmt_mode *cp = data; 4251 int err; 4252 bool changed = false; 4253 4254 bt_dev_dbg(hdev, "sock %p", sk); 4255 4256 if (!test_bit(HCI_QUIRK_WIDEBAND_SPEECH_SUPPORTED, &hdev->quirks)) 4257 return mgmt_cmd_status(sk, hdev->id, 4258 MGMT_OP_SET_WIDEBAND_SPEECH, 4259 MGMT_STATUS_NOT_SUPPORTED); 4260 4261 if (cp->val != 0x00 && cp->val != 0x01) 4262 return mgmt_cmd_status(sk, hdev->id, 4263 MGMT_OP_SET_WIDEBAND_SPEECH, 4264 MGMT_STATUS_INVALID_PARAMS); 4265 4266 hci_dev_lock(hdev); 4267 4268 if (hdev_is_powered(hdev) && 4269 !!cp->val != hci_dev_test_flag(hdev, 4270 HCI_WIDEBAND_SPEECH_ENABLED)) { 4271 err = mgmt_cmd_status(sk, hdev->id, 4272 MGMT_OP_SET_WIDEBAND_SPEECH, 4273 MGMT_STATUS_REJECTED); 4274 goto unlock; 4275 } 4276 4277 if (cp->val) 4278 changed = !hci_dev_test_and_set_flag(hdev, 4279 HCI_WIDEBAND_SPEECH_ENABLED); 4280 else 4281 changed = hci_dev_test_and_clear_flag(hdev, 4282 HCI_WIDEBAND_SPEECH_ENABLED); 4283 4284 err = send_settings_rsp(sk, MGMT_OP_SET_WIDEBAND_SPEECH, hdev); 4285 if (err < 0) 4286 goto unlock; 4287 4288 if (changed) 4289 err = new_settings(hdev, sk); 4290 4291 unlock: 4292 hci_dev_unlock(hdev); 4293 return err; 4294 } 4295 4296 static int read_controller_cap(struct sock *sk, struct hci_dev *hdev, 4297 void *data, u16 data_len) 4298 { 4299 char buf[20]; 4300 struct mgmt_rp_read_controller_cap *rp = (void *)buf; 4301 u16 cap_len = 0; 4302 u8 flags = 0; 4303 u8 tx_power_range[2]; 4304 4305 bt_dev_dbg(hdev, "sock %p", sk); 4306 4307 memset(&buf, 0, sizeof(buf)); 4308 4309 hci_dev_lock(hdev); 4310 4311 /* When the Read Simple Pairing Options command is supported, then 4312 * the remote public key validation is supported. 4313 * 4314 * Alternatively, when Microsoft extensions are available, they can 4315 * indicate support for public key validation as well. 4316 */ 4317 if ((hdev->commands[41] & 0x08) || msft_curve_validity(hdev)) 4318 flags |= 0x01; /* Remote public key validation (BR/EDR) */ 4319 4320 flags |= 0x02; /* Remote public key validation (LE) */ 4321 4322 /* When the Read Encryption Key Size command is supported, then the 4323 * encryption key size is enforced. 4324 */ 4325 if (hdev->commands[20] & 0x10) 4326 flags |= 0x04; /* Encryption key size enforcement (BR/EDR) */ 4327 4328 flags |= 0x08; /* Encryption key size enforcement (LE) */ 4329 4330 cap_len = eir_append_data(rp->cap, cap_len, MGMT_CAP_SEC_FLAGS, 4331 &flags, 1); 4332 4333 /* When the Read Simple Pairing Options command is supported, then 4334 * also max encryption key size information is provided. 4335 */ 4336 if (hdev->commands[41] & 0x08) 4337 cap_len = eir_append_le16(rp->cap, cap_len, 4338 MGMT_CAP_MAX_ENC_KEY_SIZE, 4339 hdev->max_enc_key_size); 4340 4341 cap_len = eir_append_le16(rp->cap, cap_len, 4342 MGMT_CAP_SMP_MAX_ENC_KEY_SIZE, 4343 SMP_MAX_ENC_KEY_SIZE); 4344 4345 /* Append the min/max LE tx power parameters if we were able to fetch 4346 * it from the controller 4347 */ 4348 if (hdev->commands[38] & 0x80) { 4349 memcpy(&tx_power_range[0], &hdev->min_le_tx_power, 1); 4350 memcpy(&tx_power_range[1], &hdev->max_le_tx_power, 1); 4351 cap_len = eir_append_data(rp->cap, cap_len, MGMT_CAP_LE_TX_PWR, 4352 tx_power_range, 2); 4353 } 4354 4355 rp->cap_len = cpu_to_le16(cap_len); 4356 4357 hci_dev_unlock(hdev); 4358 4359 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_CONTROLLER_CAP, 0, 4360 rp, sizeof(*rp) + cap_len); 4361 } 4362 4363 #ifdef CONFIG_BT_FEATURE_DEBUG 4364 /* d4992530-b9ec-469f-ab01-6c481c47da1c */ 4365 static const u8 debug_uuid[16] = { 4366 0x1c, 0xda, 0x47, 0x1c, 0x48, 0x6c, 0x01, 0xab, 4367 0x9f, 0x46, 0xec, 0xb9, 0x30, 0x25, 0x99, 0xd4, 4368 }; 4369 #endif 4370 4371 /* 330859bc-7506-492d-9370-9a6f0614037f */ 4372 static const u8 quality_report_uuid[16] = { 4373 0x7f, 0x03, 0x14, 0x06, 0x6f, 0x9a, 0x70, 0x93, 4374 0x2d, 0x49, 0x06, 0x75, 0xbc, 0x59, 0x08, 0x33, 4375 }; 4376 4377 /* a6695ace-ee7f-4fb9-881a-5fac66c629af */ 4378 static const u8 offload_codecs_uuid[16] = { 4379 0xaf, 0x29, 0xc6, 0x66, 0xac, 0x5f, 0x1a, 0x88, 4380 0xb9, 0x4f, 0x7f, 0xee, 0xce, 0x5a, 0x69, 0xa6, 4381 }; 4382 4383 /* 671b10b5-42c0-4696-9227-eb28d1b049d6 */ 4384 static const u8 le_simultaneous_roles_uuid[16] = { 4385 0xd6, 0x49, 0xb0, 0xd1, 0x28, 0xeb, 0x27, 0x92, 4386 0x96, 0x46, 0xc0, 0x42, 0xb5, 0x10, 0x1b, 0x67, 4387 }; 4388 4389 /* 15c0a148-c273-11ea-b3de-0242ac130004 */ 4390 static const u8 rpa_resolution_uuid[16] = { 4391 0x04, 0x00, 0x13, 0xac, 0x42, 0x02, 0xde, 0xb3, 4392 0xea, 0x11, 0x73, 0xc2, 0x48, 0xa1, 0xc0, 0x15, 4393 }; 4394 4395 /* 6fbaf188-05e0-496a-9885-d6ddfdb4e03e */ 4396 static const u8 iso_socket_uuid[16] = { 4397 0x3e, 0xe0, 0xb4, 0xfd, 0xdd, 0xd6, 0x85, 0x98, 4398 0x6a, 0x49, 0xe0, 0x05, 0x88, 0xf1, 0xba, 0x6f, 4399 }; 4400 4401 /* 2ce463d7-7a03-4d8d-bf05-5f24e8f36e76 */ 4402 static const u8 mgmt_mesh_uuid[16] = { 4403 0x76, 0x6e, 0xf3, 0xe8, 0x24, 0x5f, 0x05, 0xbf, 4404 0x8d, 0x4d, 0x03, 0x7a, 0xd7, 0x63, 0xe4, 0x2c, 4405 }; 4406 4407 static int read_exp_features_info(struct sock *sk, struct hci_dev *hdev, 4408 void *data, u16 data_len) 4409 { 4410 struct mgmt_rp_read_exp_features_info *rp; 4411 size_t len; 4412 u16 idx = 0; 4413 u32 flags; 4414 int status; 4415 4416 bt_dev_dbg(hdev, "sock %p", sk); 4417 4418 /* Enough space for 7 features */ 4419 len = sizeof(*rp) + (sizeof(rp->features[0]) * 7); 4420 rp = kzalloc(len, GFP_KERNEL); 4421 if (!rp) 4422 return -ENOMEM; 4423 4424 #ifdef CONFIG_BT_FEATURE_DEBUG 4425 if (!hdev) { 4426 flags = bt_dbg_get() ? BIT(0) : 0; 4427 4428 memcpy(rp->features[idx].uuid, debug_uuid, 16); 4429 rp->features[idx].flags = cpu_to_le32(flags); 4430 idx++; 4431 } 4432 #endif 4433 4434 if (hdev && hci_dev_le_state_simultaneous(hdev)) { 4435 if (hci_dev_test_flag(hdev, HCI_LE_SIMULTANEOUS_ROLES)) 4436 flags = BIT(0); 4437 else 4438 flags = 0; 4439 4440 memcpy(rp->features[idx].uuid, le_simultaneous_roles_uuid, 16); 4441 rp->features[idx].flags = cpu_to_le32(flags); 4442 idx++; 4443 } 4444 4445 if (hdev && ll_privacy_capable(hdev)) { 4446 if (hci_dev_test_flag(hdev, HCI_ENABLE_LL_PRIVACY)) 4447 flags = BIT(0) | BIT(1); 4448 else 4449 flags = BIT(1); 4450 4451 memcpy(rp->features[idx].uuid, rpa_resolution_uuid, 16); 4452 rp->features[idx].flags = cpu_to_le32(flags); 4453 idx++; 4454 } 4455 4456 if (hdev && (aosp_has_quality_report(hdev) || 4457 hdev->set_quality_report)) { 4458 if (hci_dev_test_flag(hdev, HCI_QUALITY_REPORT)) 4459 flags = BIT(0); 4460 else 4461 flags = 0; 4462 4463 memcpy(rp->features[idx].uuid, quality_report_uuid, 16); 4464 rp->features[idx].flags = cpu_to_le32(flags); 4465 idx++; 4466 } 4467 4468 if (hdev && hdev->get_data_path_id) { 4469 if (hci_dev_test_flag(hdev, HCI_OFFLOAD_CODECS_ENABLED)) 4470 flags = BIT(0); 4471 else 4472 flags = 0; 4473 4474 memcpy(rp->features[idx].uuid, offload_codecs_uuid, 16); 4475 rp->features[idx].flags = cpu_to_le32(flags); 4476 idx++; 4477 } 4478 4479 if (IS_ENABLED(CONFIG_BT_LE)) { 4480 flags = iso_enabled() ? BIT(0) : 0; 4481 memcpy(rp->features[idx].uuid, iso_socket_uuid, 16); 4482 rp->features[idx].flags = cpu_to_le32(flags); 4483 idx++; 4484 } 4485 4486 if (hdev && lmp_le_capable(hdev)) { 4487 if (hci_dev_test_flag(hdev, HCI_MESH_EXPERIMENTAL)) 4488 flags = BIT(0); 4489 else 4490 flags = 0; 4491 4492 memcpy(rp->features[idx].uuid, mgmt_mesh_uuid, 16); 4493 rp->features[idx].flags = cpu_to_le32(flags); 4494 idx++; 4495 } 4496 4497 rp->feature_count = cpu_to_le16(idx); 4498 4499 /* After reading the experimental features information, enable 4500 * the events to update client on any future change. 4501 */ 4502 hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS); 4503 4504 status = mgmt_cmd_complete(sk, hdev ? hdev->id : MGMT_INDEX_NONE, 4505 MGMT_OP_READ_EXP_FEATURES_INFO, 4506 0, rp, sizeof(*rp) + (20 * idx)); 4507 4508 kfree(rp); 4509 return status; 4510 } 4511 4512 static int exp_ll_privacy_feature_changed(bool enabled, struct hci_dev *hdev, 4513 struct sock *skip) 4514 { 4515 struct mgmt_ev_exp_feature_changed ev; 4516 4517 memset(&ev, 0, sizeof(ev)); 4518 memcpy(ev.uuid, rpa_resolution_uuid, 16); 4519 ev.flags = cpu_to_le32((enabled ? BIT(0) : 0) | BIT(1)); 4520 4521 // Do we need to be atomic with the conn_flags? 4522 if (enabled && privacy_mode_capable(hdev)) 4523 hdev->conn_flags |= HCI_CONN_FLAG_DEVICE_PRIVACY; 4524 else 4525 hdev->conn_flags &= ~HCI_CONN_FLAG_DEVICE_PRIVACY; 4526 4527 return mgmt_limited_event(MGMT_EV_EXP_FEATURE_CHANGED, hdev, 4528 &ev, sizeof(ev), 4529 HCI_MGMT_EXP_FEATURE_EVENTS, skip); 4530 4531 } 4532 4533 static int exp_feature_changed(struct hci_dev *hdev, const u8 *uuid, 4534 bool enabled, struct sock *skip) 4535 { 4536 struct mgmt_ev_exp_feature_changed ev; 4537 4538 memset(&ev, 0, sizeof(ev)); 4539 memcpy(ev.uuid, uuid, 16); 4540 ev.flags = cpu_to_le32(enabled ? BIT(0) : 0); 4541 4542 return mgmt_limited_event(MGMT_EV_EXP_FEATURE_CHANGED, hdev, 4543 &ev, sizeof(ev), 4544 HCI_MGMT_EXP_FEATURE_EVENTS, skip); 4545 } 4546 4547 #define EXP_FEAT(_uuid, _set_func) \ 4548 { \ 4549 .uuid = _uuid, \ 4550 .set_func = _set_func, \ 4551 } 4552 4553 /* The zero key uuid is special. Multiple exp features are set through it. */ 4554 static int set_zero_key_func(struct sock *sk, struct hci_dev *hdev, 4555 struct mgmt_cp_set_exp_feature *cp, u16 data_len) 4556 { 4557 struct mgmt_rp_set_exp_feature rp; 4558 4559 memset(rp.uuid, 0, 16); 4560 rp.flags = cpu_to_le32(0); 4561 4562 #ifdef CONFIG_BT_FEATURE_DEBUG 4563 if (!hdev) { 4564 bool changed = bt_dbg_get(); 4565 4566 bt_dbg_set(false); 4567 4568 if (changed) 4569 exp_feature_changed(NULL, ZERO_KEY, false, sk); 4570 } 4571 #endif 4572 4573 if (hdev && use_ll_privacy(hdev) && !hdev_is_powered(hdev)) { 4574 bool changed; 4575 4576 changed = hci_dev_test_and_clear_flag(hdev, 4577 HCI_ENABLE_LL_PRIVACY); 4578 if (changed) 4579 exp_feature_changed(hdev, rpa_resolution_uuid, false, 4580 sk); 4581 } 4582 4583 hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS); 4584 4585 return mgmt_cmd_complete(sk, hdev ? hdev->id : MGMT_INDEX_NONE, 4586 MGMT_OP_SET_EXP_FEATURE, 0, 4587 &rp, sizeof(rp)); 4588 } 4589 4590 #ifdef CONFIG_BT_FEATURE_DEBUG 4591 static int set_debug_func(struct sock *sk, struct hci_dev *hdev, 4592 struct mgmt_cp_set_exp_feature *cp, u16 data_len) 4593 { 4594 struct mgmt_rp_set_exp_feature rp; 4595 4596 bool val, changed; 4597 int err; 4598 4599 /* Command requires to use the non-controller index */ 4600 if (hdev) 4601 return mgmt_cmd_status(sk, hdev->id, 4602 MGMT_OP_SET_EXP_FEATURE, 4603 MGMT_STATUS_INVALID_INDEX); 4604 4605 /* Parameters are limited to a single octet */ 4606 if (data_len != MGMT_SET_EXP_FEATURE_SIZE + 1) 4607 return mgmt_cmd_status(sk, MGMT_INDEX_NONE, 4608 MGMT_OP_SET_EXP_FEATURE, 4609 MGMT_STATUS_INVALID_PARAMS); 4610 4611 /* Only boolean on/off is supported */ 4612 if (cp->param[0] != 0x00 && cp->param[0] != 0x01) 4613 return mgmt_cmd_status(sk, MGMT_INDEX_NONE, 4614 MGMT_OP_SET_EXP_FEATURE, 4615 MGMT_STATUS_INVALID_PARAMS); 4616 4617 val = !!cp->param[0]; 4618 changed = val ? !bt_dbg_get() : bt_dbg_get(); 4619 bt_dbg_set(val); 4620 4621 memcpy(rp.uuid, debug_uuid, 16); 4622 rp.flags = cpu_to_le32(val ? BIT(0) : 0); 4623 4624 hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS); 4625 4626 err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE, 4627 MGMT_OP_SET_EXP_FEATURE, 0, 4628 &rp, sizeof(rp)); 4629 4630 if (changed) 4631 exp_feature_changed(hdev, debug_uuid, val, sk); 4632 4633 return err; 4634 } 4635 #endif 4636 4637 static int set_mgmt_mesh_func(struct sock *sk, struct hci_dev *hdev, 4638 struct mgmt_cp_set_exp_feature *cp, u16 data_len) 4639 { 4640 struct mgmt_rp_set_exp_feature rp; 4641 bool val, changed; 4642 int err; 4643 4644 /* Command requires to use the controller index */ 4645 if (!hdev) 4646 return mgmt_cmd_status(sk, MGMT_INDEX_NONE, 4647 MGMT_OP_SET_EXP_FEATURE, 4648 MGMT_STATUS_INVALID_INDEX); 4649 4650 /* Parameters are limited to a single octet */ 4651 if (data_len != MGMT_SET_EXP_FEATURE_SIZE + 1) 4652 return mgmt_cmd_status(sk, hdev->id, 4653 MGMT_OP_SET_EXP_FEATURE, 4654 MGMT_STATUS_INVALID_PARAMS); 4655 4656 /* Only boolean on/off is supported */ 4657 if (cp->param[0] != 0x00 && cp->param[0] != 0x01) 4658 return mgmt_cmd_status(sk, hdev->id, 4659 MGMT_OP_SET_EXP_FEATURE, 4660 MGMT_STATUS_INVALID_PARAMS); 4661 4662 val = !!cp->param[0]; 4663 4664 if (val) { 4665 changed = !hci_dev_test_and_set_flag(hdev, 4666 HCI_MESH_EXPERIMENTAL); 4667 } else { 4668 hci_dev_clear_flag(hdev, HCI_MESH); 4669 changed = hci_dev_test_and_clear_flag(hdev, 4670 HCI_MESH_EXPERIMENTAL); 4671 } 4672 4673 memcpy(rp.uuid, mgmt_mesh_uuid, 16); 4674 rp.flags = cpu_to_le32(val ? BIT(0) : 0); 4675 4676 hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS); 4677 4678 err = mgmt_cmd_complete(sk, hdev->id, 4679 MGMT_OP_SET_EXP_FEATURE, 0, 4680 &rp, sizeof(rp)); 4681 4682 if (changed) 4683 exp_feature_changed(hdev, mgmt_mesh_uuid, val, sk); 4684 4685 return err; 4686 } 4687 4688 static int set_rpa_resolution_func(struct sock *sk, struct hci_dev *hdev, 4689 struct mgmt_cp_set_exp_feature *cp, 4690 u16 data_len) 4691 { 4692 struct mgmt_rp_set_exp_feature rp; 4693 bool val, changed; 4694 int err; 4695 u32 flags; 4696 4697 /* Command requires to use the controller index */ 4698 if (!hdev) 4699 return mgmt_cmd_status(sk, MGMT_INDEX_NONE, 4700 MGMT_OP_SET_EXP_FEATURE, 4701 MGMT_STATUS_INVALID_INDEX); 4702 4703 /* Changes can only be made when controller is powered down */ 4704 if (hdev_is_powered(hdev)) 4705 return mgmt_cmd_status(sk, hdev->id, 4706 MGMT_OP_SET_EXP_FEATURE, 4707 MGMT_STATUS_REJECTED); 4708 4709 /* Parameters are limited to a single octet */ 4710 if (data_len != MGMT_SET_EXP_FEATURE_SIZE + 1) 4711 return mgmt_cmd_status(sk, hdev->id, 4712 MGMT_OP_SET_EXP_FEATURE, 4713 MGMT_STATUS_INVALID_PARAMS); 4714 4715 /* Only boolean on/off is supported */ 4716 if (cp->param[0] != 0x00 && cp->param[0] != 0x01) 4717 return mgmt_cmd_status(sk, hdev->id, 4718 MGMT_OP_SET_EXP_FEATURE, 4719 MGMT_STATUS_INVALID_PARAMS); 4720 4721 val = !!cp->param[0]; 4722 4723 if (val) { 4724 changed = !hci_dev_test_and_set_flag(hdev, 4725 HCI_ENABLE_LL_PRIVACY); 4726 hci_dev_clear_flag(hdev, HCI_ADVERTISING); 4727 4728 /* Enable LL privacy + supported settings changed */ 4729 flags = BIT(0) | BIT(1); 4730 } else { 4731 changed = hci_dev_test_and_clear_flag(hdev, 4732 HCI_ENABLE_LL_PRIVACY); 4733 4734 /* Disable LL privacy + supported settings changed */ 4735 flags = BIT(1); 4736 } 4737 4738 memcpy(rp.uuid, rpa_resolution_uuid, 16); 4739 rp.flags = cpu_to_le32(flags); 4740 4741 hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS); 4742 4743 err = mgmt_cmd_complete(sk, hdev->id, 4744 MGMT_OP_SET_EXP_FEATURE, 0, 4745 &rp, sizeof(rp)); 4746 4747 if (changed) 4748 exp_ll_privacy_feature_changed(val, hdev, sk); 4749 4750 return err; 4751 } 4752 4753 static int set_quality_report_func(struct sock *sk, struct hci_dev *hdev, 4754 struct mgmt_cp_set_exp_feature *cp, 4755 u16 data_len) 4756 { 4757 struct mgmt_rp_set_exp_feature rp; 4758 bool val, changed; 4759 int err; 4760 4761 /* Command requires to use a valid controller index */ 4762 if (!hdev) 4763 return mgmt_cmd_status(sk, MGMT_INDEX_NONE, 4764 MGMT_OP_SET_EXP_FEATURE, 4765 MGMT_STATUS_INVALID_INDEX); 4766 4767 /* Parameters are limited to a single octet */ 4768 if (data_len != MGMT_SET_EXP_FEATURE_SIZE + 1) 4769 return mgmt_cmd_status(sk, hdev->id, 4770 MGMT_OP_SET_EXP_FEATURE, 4771 MGMT_STATUS_INVALID_PARAMS); 4772 4773 /* Only boolean on/off is supported */ 4774 if (cp->param[0] != 0x00 && cp->param[0] != 0x01) 4775 return mgmt_cmd_status(sk, hdev->id, 4776 MGMT_OP_SET_EXP_FEATURE, 4777 MGMT_STATUS_INVALID_PARAMS); 4778 4779 hci_req_sync_lock(hdev); 4780 4781 val = !!cp->param[0]; 4782 changed = (val != hci_dev_test_flag(hdev, HCI_QUALITY_REPORT)); 4783 4784 if (!aosp_has_quality_report(hdev) && !hdev->set_quality_report) { 4785 err = mgmt_cmd_status(sk, hdev->id, 4786 MGMT_OP_SET_EXP_FEATURE, 4787 MGMT_STATUS_NOT_SUPPORTED); 4788 goto unlock_quality_report; 4789 } 4790 4791 if (changed) { 4792 if (hdev->set_quality_report) 4793 err = hdev->set_quality_report(hdev, val); 4794 else 4795 err = aosp_set_quality_report(hdev, val); 4796 4797 if (err) { 4798 err = mgmt_cmd_status(sk, hdev->id, 4799 MGMT_OP_SET_EXP_FEATURE, 4800 MGMT_STATUS_FAILED); 4801 goto unlock_quality_report; 4802 } 4803 4804 if (val) 4805 hci_dev_set_flag(hdev, HCI_QUALITY_REPORT); 4806 else 4807 hci_dev_clear_flag(hdev, HCI_QUALITY_REPORT); 4808 } 4809 4810 bt_dev_dbg(hdev, "quality report enable %d changed %d", val, changed); 4811 4812 memcpy(rp.uuid, quality_report_uuid, 16); 4813 rp.flags = cpu_to_le32(val ? BIT(0) : 0); 4814 hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS); 4815 4816 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_EXP_FEATURE, 0, 4817 &rp, sizeof(rp)); 4818 4819 if (changed) 4820 exp_feature_changed(hdev, quality_report_uuid, val, sk); 4821 4822 unlock_quality_report: 4823 hci_req_sync_unlock(hdev); 4824 return err; 4825 } 4826 4827 static int set_offload_codec_func(struct sock *sk, struct hci_dev *hdev, 4828 struct mgmt_cp_set_exp_feature *cp, 4829 u16 data_len) 4830 { 4831 bool val, changed; 4832 int err; 4833 struct mgmt_rp_set_exp_feature rp; 4834 4835 /* Command requires to use a valid controller index */ 4836 if (!hdev) 4837 return mgmt_cmd_status(sk, MGMT_INDEX_NONE, 4838 MGMT_OP_SET_EXP_FEATURE, 4839 MGMT_STATUS_INVALID_INDEX); 4840 4841 /* Parameters are limited to a single octet */ 4842 if (data_len != MGMT_SET_EXP_FEATURE_SIZE + 1) 4843 return mgmt_cmd_status(sk, hdev->id, 4844 MGMT_OP_SET_EXP_FEATURE, 4845 MGMT_STATUS_INVALID_PARAMS); 4846 4847 /* Only boolean on/off is supported */ 4848 if (cp->param[0] != 0x00 && cp->param[0] != 0x01) 4849 return mgmt_cmd_status(sk, hdev->id, 4850 MGMT_OP_SET_EXP_FEATURE, 4851 MGMT_STATUS_INVALID_PARAMS); 4852 4853 val = !!cp->param[0]; 4854 changed = (val != hci_dev_test_flag(hdev, HCI_OFFLOAD_CODECS_ENABLED)); 4855 4856 if (!hdev->get_data_path_id) { 4857 return mgmt_cmd_status(sk, hdev->id, 4858 MGMT_OP_SET_EXP_FEATURE, 4859 MGMT_STATUS_NOT_SUPPORTED); 4860 } 4861 4862 if (changed) { 4863 if (val) 4864 hci_dev_set_flag(hdev, HCI_OFFLOAD_CODECS_ENABLED); 4865 else 4866 hci_dev_clear_flag(hdev, HCI_OFFLOAD_CODECS_ENABLED); 4867 } 4868 4869 bt_dev_info(hdev, "offload codecs enable %d changed %d", 4870 val, changed); 4871 4872 memcpy(rp.uuid, offload_codecs_uuid, 16); 4873 rp.flags = cpu_to_le32(val ? BIT(0) : 0); 4874 hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS); 4875 err = mgmt_cmd_complete(sk, hdev->id, 4876 MGMT_OP_SET_EXP_FEATURE, 0, 4877 &rp, sizeof(rp)); 4878 4879 if (changed) 4880 exp_feature_changed(hdev, offload_codecs_uuid, val, sk); 4881 4882 return err; 4883 } 4884 4885 static int set_le_simultaneous_roles_func(struct sock *sk, struct hci_dev *hdev, 4886 struct mgmt_cp_set_exp_feature *cp, 4887 u16 data_len) 4888 { 4889 bool val, changed; 4890 int err; 4891 struct mgmt_rp_set_exp_feature rp; 4892 4893 /* Command requires to use a valid controller index */ 4894 if (!hdev) 4895 return mgmt_cmd_status(sk, MGMT_INDEX_NONE, 4896 MGMT_OP_SET_EXP_FEATURE, 4897 MGMT_STATUS_INVALID_INDEX); 4898 4899 /* Parameters are limited to a single octet */ 4900 if (data_len != MGMT_SET_EXP_FEATURE_SIZE + 1) 4901 return mgmt_cmd_status(sk, hdev->id, 4902 MGMT_OP_SET_EXP_FEATURE, 4903 MGMT_STATUS_INVALID_PARAMS); 4904 4905 /* Only boolean on/off is supported */ 4906 if (cp->param[0] != 0x00 && cp->param[0] != 0x01) 4907 return mgmt_cmd_status(sk, hdev->id, 4908 MGMT_OP_SET_EXP_FEATURE, 4909 MGMT_STATUS_INVALID_PARAMS); 4910 4911 val = !!cp->param[0]; 4912 changed = (val != hci_dev_test_flag(hdev, HCI_LE_SIMULTANEOUS_ROLES)); 4913 4914 if (!hci_dev_le_state_simultaneous(hdev)) { 4915 return mgmt_cmd_status(sk, hdev->id, 4916 MGMT_OP_SET_EXP_FEATURE, 4917 MGMT_STATUS_NOT_SUPPORTED); 4918 } 4919 4920 if (changed) { 4921 if (val) 4922 hci_dev_set_flag(hdev, HCI_LE_SIMULTANEOUS_ROLES); 4923 else 4924 hci_dev_clear_flag(hdev, HCI_LE_SIMULTANEOUS_ROLES); 4925 } 4926 4927 bt_dev_info(hdev, "LE simultaneous roles enable %d changed %d", 4928 val, changed); 4929 4930 memcpy(rp.uuid, le_simultaneous_roles_uuid, 16); 4931 rp.flags = cpu_to_le32(val ? BIT(0) : 0); 4932 hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS); 4933 err = mgmt_cmd_complete(sk, hdev->id, 4934 MGMT_OP_SET_EXP_FEATURE, 0, 4935 &rp, sizeof(rp)); 4936 4937 if (changed) 4938 exp_feature_changed(hdev, le_simultaneous_roles_uuid, val, sk); 4939 4940 return err; 4941 } 4942 4943 #ifdef CONFIG_BT_LE 4944 static int set_iso_socket_func(struct sock *sk, struct hci_dev *hdev, 4945 struct mgmt_cp_set_exp_feature *cp, u16 data_len) 4946 { 4947 struct mgmt_rp_set_exp_feature rp; 4948 bool val, changed = false; 4949 int err; 4950 4951 /* Command requires to use the non-controller index */ 4952 if (hdev) 4953 return mgmt_cmd_status(sk, hdev->id, 4954 MGMT_OP_SET_EXP_FEATURE, 4955 MGMT_STATUS_INVALID_INDEX); 4956 4957 /* Parameters are limited to a single octet */ 4958 if (data_len != MGMT_SET_EXP_FEATURE_SIZE + 1) 4959 return mgmt_cmd_status(sk, MGMT_INDEX_NONE, 4960 MGMT_OP_SET_EXP_FEATURE, 4961 MGMT_STATUS_INVALID_PARAMS); 4962 4963 /* Only boolean on/off is supported */ 4964 if (cp->param[0] != 0x00 && cp->param[0] != 0x01) 4965 return mgmt_cmd_status(sk, MGMT_INDEX_NONE, 4966 MGMT_OP_SET_EXP_FEATURE, 4967 MGMT_STATUS_INVALID_PARAMS); 4968 4969 val = cp->param[0] ? true : false; 4970 if (val) 4971 err = iso_init(); 4972 else 4973 err = iso_exit(); 4974 4975 if (!err) 4976 changed = true; 4977 4978 memcpy(rp.uuid, iso_socket_uuid, 16); 4979 rp.flags = cpu_to_le32(val ? BIT(0) : 0); 4980 4981 hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS); 4982 4983 err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE, 4984 MGMT_OP_SET_EXP_FEATURE, 0, 4985 &rp, sizeof(rp)); 4986 4987 if (changed) 4988 exp_feature_changed(hdev, iso_socket_uuid, val, sk); 4989 4990 return err; 4991 } 4992 #endif 4993 4994 static const struct mgmt_exp_feature { 4995 const u8 *uuid; 4996 int (*set_func)(struct sock *sk, struct hci_dev *hdev, 4997 struct mgmt_cp_set_exp_feature *cp, u16 data_len); 4998 } exp_features[] = { 4999 EXP_FEAT(ZERO_KEY, set_zero_key_func), 5000 #ifdef CONFIG_BT_FEATURE_DEBUG 5001 EXP_FEAT(debug_uuid, set_debug_func), 5002 #endif 5003 EXP_FEAT(mgmt_mesh_uuid, set_mgmt_mesh_func), 5004 EXP_FEAT(rpa_resolution_uuid, set_rpa_resolution_func), 5005 EXP_FEAT(quality_report_uuid, set_quality_report_func), 5006 EXP_FEAT(offload_codecs_uuid, set_offload_codec_func), 5007 EXP_FEAT(le_simultaneous_roles_uuid, set_le_simultaneous_roles_func), 5008 #ifdef CONFIG_BT_LE 5009 EXP_FEAT(iso_socket_uuid, set_iso_socket_func), 5010 #endif 5011 5012 /* end with a null feature */ 5013 EXP_FEAT(NULL, NULL) 5014 }; 5015 5016 static int set_exp_feature(struct sock *sk, struct hci_dev *hdev, 5017 void *data, u16 data_len) 5018 { 5019 struct mgmt_cp_set_exp_feature *cp = data; 5020 size_t i = 0; 5021 5022 bt_dev_dbg(hdev, "sock %p", sk); 5023 5024 for (i = 0; exp_features[i].uuid; i++) { 5025 if (!memcmp(cp->uuid, exp_features[i].uuid, 16)) 5026 return exp_features[i].set_func(sk, hdev, cp, data_len); 5027 } 5028 5029 return mgmt_cmd_status(sk, hdev ? hdev->id : MGMT_INDEX_NONE, 5030 MGMT_OP_SET_EXP_FEATURE, 5031 MGMT_STATUS_NOT_SUPPORTED); 5032 } 5033 5034 static u32 get_params_flags(struct hci_dev *hdev, 5035 struct hci_conn_params *params) 5036 { 5037 u32 flags = hdev->conn_flags; 5038 5039 /* Devices using RPAs can only be programmed in the acceptlist if 5040 * LL Privacy has been enable otherwise they cannot mark 5041 * HCI_CONN_FLAG_REMOTE_WAKEUP. 5042 */ 5043 if ((flags & HCI_CONN_FLAG_REMOTE_WAKEUP) && !use_ll_privacy(hdev) && 5044 hci_find_irk_by_addr(hdev, ¶ms->addr, params->addr_type)) 5045 flags &= ~HCI_CONN_FLAG_REMOTE_WAKEUP; 5046 5047 return flags; 5048 } 5049 5050 static int get_device_flags(struct sock *sk, struct hci_dev *hdev, void *data, 5051 u16 data_len) 5052 { 5053 struct mgmt_cp_get_device_flags *cp = data; 5054 struct mgmt_rp_get_device_flags rp; 5055 struct bdaddr_list_with_flags *br_params; 5056 struct hci_conn_params *params; 5057 u32 supported_flags; 5058 u32 current_flags = 0; 5059 u8 status = MGMT_STATUS_INVALID_PARAMS; 5060 5061 bt_dev_dbg(hdev, "Get device flags %pMR (type 0x%x)\n", 5062 &cp->addr.bdaddr, cp->addr.type); 5063 5064 hci_dev_lock(hdev); 5065 5066 supported_flags = hdev->conn_flags; 5067 5068 memset(&rp, 0, sizeof(rp)); 5069 5070 if (cp->addr.type == BDADDR_BREDR) { 5071 br_params = hci_bdaddr_list_lookup_with_flags(&hdev->accept_list, 5072 &cp->addr.bdaddr, 5073 cp->addr.type); 5074 if (!br_params) 5075 goto done; 5076 5077 current_flags = br_params->flags; 5078 } else { 5079 params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr, 5080 le_addr_type(cp->addr.type)); 5081 if (!params) 5082 goto done; 5083 5084 supported_flags = get_params_flags(hdev, params); 5085 current_flags = params->flags; 5086 } 5087 5088 bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr); 5089 rp.addr.type = cp->addr.type; 5090 rp.supported_flags = cpu_to_le32(supported_flags); 5091 rp.current_flags = cpu_to_le32(current_flags); 5092 5093 status = MGMT_STATUS_SUCCESS; 5094 5095 done: 5096 hci_dev_unlock(hdev); 5097 5098 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_DEVICE_FLAGS, status, 5099 &rp, sizeof(rp)); 5100 } 5101 5102 static void device_flags_changed(struct sock *sk, struct hci_dev *hdev, 5103 bdaddr_t *bdaddr, u8 bdaddr_type, 5104 u32 supported_flags, u32 current_flags) 5105 { 5106 struct mgmt_ev_device_flags_changed ev; 5107 5108 bacpy(&ev.addr.bdaddr, bdaddr); 5109 ev.addr.type = bdaddr_type; 5110 ev.supported_flags = cpu_to_le32(supported_flags); 5111 ev.current_flags = cpu_to_le32(current_flags); 5112 5113 mgmt_event(MGMT_EV_DEVICE_FLAGS_CHANGED, hdev, &ev, sizeof(ev), sk); 5114 } 5115 5116 static int set_device_flags(struct sock *sk, struct hci_dev *hdev, void *data, 5117 u16 len) 5118 { 5119 struct mgmt_cp_set_device_flags *cp = data; 5120 struct bdaddr_list_with_flags *br_params; 5121 struct hci_conn_params *params; 5122 u8 status = MGMT_STATUS_INVALID_PARAMS; 5123 u32 supported_flags; 5124 u32 current_flags = __le32_to_cpu(cp->current_flags); 5125 5126 bt_dev_dbg(hdev, "Set device flags %pMR (type 0x%x) = 0x%x", 5127 &cp->addr.bdaddr, cp->addr.type, current_flags); 5128 5129 // We should take hci_dev_lock() early, I think.. conn_flags can change 5130 supported_flags = hdev->conn_flags; 5131 5132 if ((supported_flags | current_flags) != supported_flags) { 5133 bt_dev_warn(hdev, "Bad flag given (0x%x) vs supported (0x%0x)", 5134 current_flags, supported_flags); 5135 goto done; 5136 } 5137 5138 hci_dev_lock(hdev); 5139 5140 if (cp->addr.type == BDADDR_BREDR) { 5141 br_params = hci_bdaddr_list_lookup_with_flags(&hdev->accept_list, 5142 &cp->addr.bdaddr, 5143 cp->addr.type); 5144 5145 if (br_params) { 5146 br_params->flags = current_flags; 5147 status = MGMT_STATUS_SUCCESS; 5148 } else { 5149 bt_dev_warn(hdev, "No such BR/EDR device %pMR (0x%x)", 5150 &cp->addr.bdaddr, cp->addr.type); 5151 } 5152 5153 goto unlock; 5154 } 5155 5156 params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr, 5157 le_addr_type(cp->addr.type)); 5158 if (!params) { 5159 bt_dev_warn(hdev, "No such LE device %pMR (0x%x)", 5160 &cp->addr.bdaddr, le_addr_type(cp->addr.type)); 5161 goto unlock; 5162 } 5163 5164 supported_flags = get_params_flags(hdev, params); 5165 5166 if ((supported_flags | current_flags) != supported_flags) { 5167 bt_dev_warn(hdev, "Bad flag given (0x%x) vs supported (0x%0x)", 5168 current_flags, supported_flags); 5169 goto unlock; 5170 } 5171 5172 params->flags = current_flags; 5173 status = MGMT_STATUS_SUCCESS; 5174 5175 /* Update passive scan if HCI_CONN_FLAG_DEVICE_PRIVACY 5176 * has been set. 5177 */ 5178 if (params->flags & HCI_CONN_FLAG_DEVICE_PRIVACY) 5179 hci_update_passive_scan(hdev); 5180 5181 unlock: 5182 hci_dev_unlock(hdev); 5183 5184 done: 5185 if (status == MGMT_STATUS_SUCCESS) 5186 device_flags_changed(sk, hdev, &cp->addr.bdaddr, cp->addr.type, 5187 supported_flags, current_flags); 5188 5189 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_DEVICE_FLAGS, status, 5190 &cp->addr, sizeof(cp->addr)); 5191 } 5192 5193 static void mgmt_adv_monitor_added(struct sock *sk, struct hci_dev *hdev, 5194 u16 handle) 5195 { 5196 struct mgmt_ev_adv_monitor_added ev; 5197 5198 ev.monitor_handle = cpu_to_le16(handle); 5199 5200 mgmt_event(MGMT_EV_ADV_MONITOR_ADDED, hdev, &ev, sizeof(ev), sk); 5201 } 5202 5203 void mgmt_adv_monitor_removed(struct hci_dev *hdev, u16 handle) 5204 { 5205 struct mgmt_ev_adv_monitor_removed ev; 5206 struct mgmt_pending_cmd *cmd; 5207 struct sock *sk_skip = NULL; 5208 struct mgmt_cp_remove_adv_monitor *cp; 5209 5210 cmd = pending_find(MGMT_OP_REMOVE_ADV_MONITOR, hdev); 5211 if (cmd) { 5212 cp = cmd->param; 5213 5214 if (cp->monitor_handle) 5215 sk_skip = cmd->sk; 5216 } 5217 5218 ev.monitor_handle = cpu_to_le16(handle); 5219 5220 mgmt_event(MGMT_EV_ADV_MONITOR_REMOVED, hdev, &ev, sizeof(ev), sk_skip); 5221 } 5222 5223 static int read_adv_mon_features(struct sock *sk, struct hci_dev *hdev, 5224 void *data, u16 len) 5225 { 5226 struct adv_monitor *monitor = NULL; 5227 struct mgmt_rp_read_adv_monitor_features *rp = NULL; 5228 int handle, err; 5229 size_t rp_size = 0; 5230 __u32 supported = 0; 5231 __u32 enabled = 0; 5232 __u16 num_handles = 0; 5233 __u16 handles[HCI_MAX_ADV_MONITOR_NUM_HANDLES]; 5234 5235 BT_DBG("request for %s", hdev->name); 5236 5237 hci_dev_lock(hdev); 5238 5239 if (msft_monitor_supported(hdev)) 5240 supported |= MGMT_ADV_MONITOR_FEATURE_MASK_OR_PATTERNS; 5241 5242 idr_for_each_entry(&hdev->adv_monitors_idr, monitor, handle) 5243 handles[num_handles++] = monitor->handle; 5244 5245 hci_dev_unlock(hdev); 5246 5247 rp_size = sizeof(*rp) + (num_handles * sizeof(u16)); 5248 rp = kmalloc(rp_size, GFP_KERNEL); 5249 if (!rp) 5250 return -ENOMEM; 5251 5252 /* All supported features are currently enabled */ 5253 enabled = supported; 5254 5255 rp->supported_features = cpu_to_le32(supported); 5256 rp->enabled_features = cpu_to_le32(enabled); 5257 rp->max_num_handles = cpu_to_le16(HCI_MAX_ADV_MONITOR_NUM_HANDLES); 5258 rp->max_num_patterns = HCI_MAX_ADV_MONITOR_NUM_PATTERNS; 5259 rp->num_handles = cpu_to_le16(num_handles); 5260 if (num_handles) 5261 memcpy(&rp->handles, &handles, (num_handles * sizeof(u16))); 5262 5263 err = mgmt_cmd_complete(sk, hdev->id, 5264 MGMT_OP_READ_ADV_MONITOR_FEATURES, 5265 MGMT_STATUS_SUCCESS, rp, rp_size); 5266 5267 kfree(rp); 5268 5269 return err; 5270 } 5271 5272 static void mgmt_add_adv_patterns_monitor_complete(struct hci_dev *hdev, 5273 void *data, int status) 5274 { 5275 struct mgmt_rp_add_adv_patterns_monitor rp; 5276 struct mgmt_pending_cmd *cmd = data; 5277 struct adv_monitor *monitor = cmd->user_data; 5278 5279 hci_dev_lock(hdev); 5280 5281 rp.monitor_handle = cpu_to_le16(monitor->handle); 5282 5283 if (!status) { 5284 mgmt_adv_monitor_added(cmd->sk, hdev, monitor->handle); 5285 hdev->adv_monitors_cnt++; 5286 if (monitor->state == ADV_MONITOR_STATE_NOT_REGISTERED) 5287 monitor->state = ADV_MONITOR_STATE_REGISTERED; 5288 hci_update_passive_scan(hdev); 5289 } 5290 5291 mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, 5292 mgmt_status(status), &rp, sizeof(rp)); 5293 mgmt_pending_remove(cmd); 5294 5295 hci_dev_unlock(hdev); 5296 bt_dev_dbg(hdev, "add monitor %d complete, status %d", 5297 rp.monitor_handle, status); 5298 } 5299 5300 static int mgmt_add_adv_patterns_monitor_sync(struct hci_dev *hdev, void *data) 5301 { 5302 struct mgmt_pending_cmd *cmd = data; 5303 struct adv_monitor *monitor = cmd->user_data; 5304 5305 return hci_add_adv_monitor(hdev, monitor); 5306 } 5307 5308 static int __add_adv_patterns_monitor(struct sock *sk, struct hci_dev *hdev, 5309 struct adv_monitor *m, u8 status, 5310 void *data, u16 len, u16 op) 5311 { 5312 struct mgmt_pending_cmd *cmd; 5313 int err; 5314 5315 hci_dev_lock(hdev); 5316 5317 if (status) 5318 goto unlock; 5319 5320 if (pending_find(MGMT_OP_SET_LE, hdev) || 5321 pending_find(MGMT_OP_ADD_ADV_PATTERNS_MONITOR, hdev) || 5322 pending_find(MGMT_OP_ADD_ADV_PATTERNS_MONITOR_RSSI, hdev) || 5323 pending_find(MGMT_OP_REMOVE_ADV_MONITOR, hdev)) { 5324 status = MGMT_STATUS_BUSY; 5325 goto unlock; 5326 } 5327 5328 cmd = mgmt_pending_add(sk, op, hdev, data, len); 5329 if (!cmd) { 5330 status = MGMT_STATUS_NO_RESOURCES; 5331 goto unlock; 5332 } 5333 5334 cmd->user_data = m; 5335 err = hci_cmd_sync_queue(hdev, mgmt_add_adv_patterns_monitor_sync, cmd, 5336 mgmt_add_adv_patterns_monitor_complete); 5337 if (err) { 5338 if (err == -ENOMEM) 5339 status = MGMT_STATUS_NO_RESOURCES; 5340 else 5341 status = MGMT_STATUS_FAILED; 5342 5343 goto unlock; 5344 } 5345 5346 hci_dev_unlock(hdev); 5347 5348 return 0; 5349 5350 unlock: 5351 hci_free_adv_monitor(hdev, m); 5352 hci_dev_unlock(hdev); 5353 return mgmt_cmd_status(sk, hdev->id, op, status); 5354 } 5355 5356 static void parse_adv_monitor_rssi(struct adv_monitor *m, 5357 struct mgmt_adv_rssi_thresholds *rssi) 5358 { 5359 if (rssi) { 5360 m->rssi.low_threshold = rssi->low_threshold; 5361 m->rssi.low_threshold_timeout = 5362 __le16_to_cpu(rssi->low_threshold_timeout); 5363 m->rssi.high_threshold = rssi->high_threshold; 5364 m->rssi.high_threshold_timeout = 5365 __le16_to_cpu(rssi->high_threshold_timeout); 5366 m->rssi.sampling_period = rssi->sampling_period; 5367 } else { 5368 /* Default values. These numbers are the least constricting 5369 * parameters for MSFT API to work, so it behaves as if there 5370 * are no rssi parameter to consider. May need to be changed 5371 * if other API are to be supported. 5372 */ 5373 m->rssi.low_threshold = -127; 5374 m->rssi.low_threshold_timeout = 60; 5375 m->rssi.high_threshold = -127; 5376 m->rssi.high_threshold_timeout = 0; 5377 m->rssi.sampling_period = 0; 5378 } 5379 } 5380 5381 static u8 parse_adv_monitor_pattern(struct adv_monitor *m, u8 pattern_count, 5382 struct mgmt_adv_pattern *patterns) 5383 { 5384 u8 offset = 0, length = 0; 5385 struct adv_pattern *p = NULL; 5386 int i; 5387 5388 for (i = 0; i < pattern_count; i++) { 5389 offset = patterns[i].offset; 5390 length = patterns[i].length; 5391 if (offset >= HCI_MAX_AD_LENGTH || 5392 length > HCI_MAX_AD_LENGTH || 5393 (offset + length) > HCI_MAX_AD_LENGTH) 5394 return MGMT_STATUS_INVALID_PARAMS; 5395 5396 p = kmalloc(sizeof(*p), GFP_KERNEL); 5397 if (!p) 5398 return MGMT_STATUS_NO_RESOURCES; 5399 5400 p->ad_type = patterns[i].ad_type; 5401 p->offset = patterns[i].offset; 5402 p->length = patterns[i].length; 5403 memcpy(p->value, patterns[i].value, p->length); 5404 5405 INIT_LIST_HEAD(&p->list); 5406 list_add(&p->list, &m->patterns); 5407 } 5408 5409 return MGMT_STATUS_SUCCESS; 5410 } 5411 5412 static int add_adv_patterns_monitor(struct sock *sk, struct hci_dev *hdev, 5413 void *data, u16 len) 5414 { 5415 struct mgmt_cp_add_adv_patterns_monitor *cp = data; 5416 struct adv_monitor *m = NULL; 5417 u8 status = MGMT_STATUS_SUCCESS; 5418 size_t expected_size = sizeof(*cp); 5419 5420 BT_DBG("request for %s", hdev->name); 5421 5422 if (len <= sizeof(*cp)) { 5423 status = MGMT_STATUS_INVALID_PARAMS; 5424 goto done; 5425 } 5426 5427 expected_size += cp->pattern_count * sizeof(struct mgmt_adv_pattern); 5428 if (len != expected_size) { 5429 status = MGMT_STATUS_INVALID_PARAMS; 5430 goto done; 5431 } 5432 5433 m = kzalloc(sizeof(*m), GFP_KERNEL); 5434 if (!m) { 5435 status = MGMT_STATUS_NO_RESOURCES; 5436 goto done; 5437 } 5438 5439 INIT_LIST_HEAD(&m->patterns); 5440 5441 parse_adv_monitor_rssi(m, NULL); 5442 status = parse_adv_monitor_pattern(m, cp->pattern_count, cp->patterns); 5443 5444 done: 5445 return __add_adv_patterns_monitor(sk, hdev, m, status, data, len, 5446 MGMT_OP_ADD_ADV_PATTERNS_MONITOR); 5447 } 5448 5449 static int add_adv_patterns_monitor_rssi(struct sock *sk, struct hci_dev *hdev, 5450 void *data, u16 len) 5451 { 5452 struct mgmt_cp_add_adv_patterns_monitor_rssi *cp = data; 5453 struct adv_monitor *m = NULL; 5454 u8 status = MGMT_STATUS_SUCCESS; 5455 size_t expected_size = sizeof(*cp); 5456 5457 BT_DBG("request for %s", hdev->name); 5458 5459 if (len <= sizeof(*cp)) { 5460 status = MGMT_STATUS_INVALID_PARAMS; 5461 goto done; 5462 } 5463 5464 expected_size += cp->pattern_count * sizeof(struct mgmt_adv_pattern); 5465 if (len != expected_size) { 5466 status = MGMT_STATUS_INVALID_PARAMS; 5467 goto done; 5468 } 5469 5470 m = kzalloc(sizeof(*m), GFP_KERNEL); 5471 if (!m) { 5472 status = MGMT_STATUS_NO_RESOURCES; 5473 goto done; 5474 } 5475 5476 INIT_LIST_HEAD(&m->patterns); 5477 5478 parse_adv_monitor_rssi(m, &cp->rssi); 5479 status = parse_adv_monitor_pattern(m, cp->pattern_count, cp->patterns); 5480 5481 done: 5482 return __add_adv_patterns_monitor(sk, hdev, m, status, data, len, 5483 MGMT_OP_ADD_ADV_PATTERNS_MONITOR_RSSI); 5484 } 5485 5486 static void mgmt_remove_adv_monitor_complete(struct hci_dev *hdev, 5487 void *data, int status) 5488 { 5489 struct mgmt_rp_remove_adv_monitor rp; 5490 struct mgmt_pending_cmd *cmd = data; 5491 struct mgmt_cp_remove_adv_monitor *cp = cmd->param; 5492 5493 hci_dev_lock(hdev); 5494 5495 rp.monitor_handle = cp->monitor_handle; 5496 5497 if (!status) 5498 hci_update_passive_scan(hdev); 5499 5500 mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, 5501 mgmt_status(status), &rp, sizeof(rp)); 5502 mgmt_pending_remove(cmd); 5503 5504 hci_dev_unlock(hdev); 5505 bt_dev_dbg(hdev, "remove monitor %d complete, status %d", 5506 rp.monitor_handle, status); 5507 } 5508 5509 static int mgmt_remove_adv_monitor_sync(struct hci_dev *hdev, void *data) 5510 { 5511 struct mgmt_pending_cmd *cmd = data; 5512 struct mgmt_cp_remove_adv_monitor *cp = cmd->param; 5513 u16 handle = __le16_to_cpu(cp->monitor_handle); 5514 5515 if (!handle) 5516 return hci_remove_all_adv_monitor(hdev); 5517 5518 return hci_remove_single_adv_monitor(hdev, handle); 5519 } 5520 5521 static int remove_adv_monitor(struct sock *sk, struct hci_dev *hdev, 5522 void *data, u16 len) 5523 { 5524 struct mgmt_pending_cmd *cmd; 5525 int err, status; 5526 5527 hci_dev_lock(hdev); 5528 5529 if (pending_find(MGMT_OP_SET_LE, hdev) || 5530 pending_find(MGMT_OP_REMOVE_ADV_MONITOR, hdev) || 5531 pending_find(MGMT_OP_ADD_ADV_PATTERNS_MONITOR, hdev) || 5532 pending_find(MGMT_OP_ADD_ADV_PATTERNS_MONITOR_RSSI, hdev)) { 5533 status = MGMT_STATUS_BUSY; 5534 goto unlock; 5535 } 5536 5537 cmd = mgmt_pending_add(sk, MGMT_OP_REMOVE_ADV_MONITOR, hdev, data, len); 5538 if (!cmd) { 5539 status = MGMT_STATUS_NO_RESOURCES; 5540 goto unlock; 5541 } 5542 5543 err = hci_cmd_sync_queue(hdev, mgmt_remove_adv_monitor_sync, cmd, 5544 mgmt_remove_adv_monitor_complete); 5545 5546 if (err) { 5547 mgmt_pending_remove(cmd); 5548 5549 if (err == -ENOMEM) 5550 status = MGMT_STATUS_NO_RESOURCES; 5551 else 5552 status = MGMT_STATUS_FAILED; 5553 5554 goto unlock; 5555 } 5556 5557 hci_dev_unlock(hdev); 5558 5559 return 0; 5560 5561 unlock: 5562 hci_dev_unlock(hdev); 5563 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_ADV_MONITOR, 5564 status); 5565 } 5566 5567 static void read_local_oob_data_complete(struct hci_dev *hdev, void *data, int err) 5568 { 5569 struct mgmt_rp_read_local_oob_data mgmt_rp; 5570 size_t rp_size = sizeof(mgmt_rp); 5571 struct mgmt_pending_cmd *cmd = data; 5572 struct sk_buff *skb = cmd->skb; 5573 u8 status = mgmt_status(err); 5574 5575 if (!status) { 5576 if (!skb) 5577 status = MGMT_STATUS_FAILED; 5578 else if (IS_ERR(skb)) 5579 status = mgmt_status(PTR_ERR(skb)); 5580 else 5581 status = mgmt_status(skb->data[0]); 5582 } 5583 5584 bt_dev_dbg(hdev, "status %d", status); 5585 5586 if (status) { 5587 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA, status); 5588 goto remove; 5589 } 5590 5591 memset(&mgmt_rp, 0, sizeof(mgmt_rp)); 5592 5593 if (!bredr_sc_enabled(hdev)) { 5594 struct hci_rp_read_local_oob_data *rp = (void *) skb->data; 5595 5596 if (skb->len < sizeof(*rp)) { 5597 mgmt_cmd_status(cmd->sk, hdev->id, 5598 MGMT_OP_READ_LOCAL_OOB_DATA, 5599 MGMT_STATUS_FAILED); 5600 goto remove; 5601 } 5602 5603 memcpy(mgmt_rp.hash192, rp->hash, sizeof(rp->hash)); 5604 memcpy(mgmt_rp.rand192, rp->rand, sizeof(rp->rand)); 5605 5606 rp_size -= sizeof(mgmt_rp.hash256) + sizeof(mgmt_rp.rand256); 5607 } else { 5608 struct hci_rp_read_local_oob_ext_data *rp = (void *) skb->data; 5609 5610 if (skb->len < sizeof(*rp)) { 5611 mgmt_cmd_status(cmd->sk, hdev->id, 5612 MGMT_OP_READ_LOCAL_OOB_DATA, 5613 MGMT_STATUS_FAILED); 5614 goto remove; 5615 } 5616 5617 memcpy(mgmt_rp.hash192, rp->hash192, sizeof(rp->hash192)); 5618 memcpy(mgmt_rp.rand192, rp->rand192, sizeof(rp->rand192)); 5619 5620 memcpy(mgmt_rp.hash256, rp->hash256, sizeof(rp->hash256)); 5621 memcpy(mgmt_rp.rand256, rp->rand256, sizeof(rp->rand256)); 5622 } 5623 5624 mgmt_cmd_complete(cmd->sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA, 5625 MGMT_STATUS_SUCCESS, &mgmt_rp, rp_size); 5626 5627 remove: 5628 if (skb && !IS_ERR(skb)) 5629 kfree_skb(skb); 5630 5631 mgmt_pending_free(cmd); 5632 } 5633 5634 static int read_local_oob_data_sync(struct hci_dev *hdev, void *data) 5635 { 5636 struct mgmt_pending_cmd *cmd = data; 5637 5638 if (bredr_sc_enabled(hdev)) 5639 cmd->skb = hci_read_local_oob_data_sync(hdev, true, cmd->sk); 5640 else 5641 cmd->skb = hci_read_local_oob_data_sync(hdev, false, cmd->sk); 5642 5643 if (IS_ERR(cmd->skb)) 5644 return PTR_ERR(cmd->skb); 5645 else 5646 return 0; 5647 } 5648 5649 static int read_local_oob_data(struct sock *sk, struct hci_dev *hdev, 5650 void *data, u16 data_len) 5651 { 5652 struct mgmt_pending_cmd *cmd; 5653 int err; 5654 5655 bt_dev_dbg(hdev, "sock %p", sk); 5656 5657 hci_dev_lock(hdev); 5658 5659 if (!hdev_is_powered(hdev)) { 5660 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA, 5661 MGMT_STATUS_NOT_POWERED); 5662 goto unlock; 5663 } 5664 5665 if (!lmp_ssp_capable(hdev)) { 5666 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA, 5667 MGMT_STATUS_NOT_SUPPORTED); 5668 goto unlock; 5669 } 5670 5671 cmd = mgmt_pending_new(sk, MGMT_OP_READ_LOCAL_OOB_DATA, hdev, NULL, 0); 5672 if (!cmd) 5673 err = -ENOMEM; 5674 else 5675 err = hci_cmd_sync_queue(hdev, read_local_oob_data_sync, cmd, 5676 read_local_oob_data_complete); 5677 5678 if (err < 0) { 5679 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA, 5680 MGMT_STATUS_FAILED); 5681 5682 if (cmd) 5683 mgmt_pending_free(cmd); 5684 } 5685 5686 unlock: 5687 hci_dev_unlock(hdev); 5688 return err; 5689 } 5690 5691 static int add_remote_oob_data(struct sock *sk, struct hci_dev *hdev, 5692 void *data, u16 len) 5693 { 5694 struct mgmt_addr_info *addr = data; 5695 int err; 5696 5697 bt_dev_dbg(hdev, "sock %p", sk); 5698 5699 if (!bdaddr_type_is_valid(addr->type)) 5700 return mgmt_cmd_complete(sk, hdev->id, 5701 MGMT_OP_ADD_REMOTE_OOB_DATA, 5702 MGMT_STATUS_INVALID_PARAMS, 5703 addr, sizeof(*addr)); 5704 5705 hci_dev_lock(hdev); 5706 5707 if (len == MGMT_ADD_REMOTE_OOB_DATA_SIZE) { 5708 struct mgmt_cp_add_remote_oob_data *cp = data; 5709 u8 status; 5710 5711 if (cp->addr.type != BDADDR_BREDR) { 5712 err = mgmt_cmd_complete(sk, hdev->id, 5713 MGMT_OP_ADD_REMOTE_OOB_DATA, 5714 MGMT_STATUS_INVALID_PARAMS, 5715 &cp->addr, sizeof(cp->addr)); 5716 goto unlock; 5717 } 5718 5719 err = hci_add_remote_oob_data(hdev, &cp->addr.bdaddr, 5720 cp->addr.type, cp->hash, 5721 cp->rand, NULL, NULL); 5722 if (err < 0) 5723 status = MGMT_STATUS_FAILED; 5724 else 5725 status = MGMT_STATUS_SUCCESS; 5726 5727 err = mgmt_cmd_complete(sk, hdev->id, 5728 MGMT_OP_ADD_REMOTE_OOB_DATA, status, 5729 &cp->addr, sizeof(cp->addr)); 5730 } else if (len == MGMT_ADD_REMOTE_OOB_EXT_DATA_SIZE) { 5731 struct mgmt_cp_add_remote_oob_ext_data *cp = data; 5732 u8 *rand192, *hash192, *rand256, *hash256; 5733 u8 status; 5734 5735 if (bdaddr_type_is_le(cp->addr.type)) { 5736 /* Enforce zero-valued 192-bit parameters as 5737 * long as legacy SMP OOB isn't implemented. 5738 */ 5739 if (memcmp(cp->rand192, ZERO_KEY, 16) || 5740 memcmp(cp->hash192, ZERO_KEY, 16)) { 5741 err = mgmt_cmd_complete(sk, hdev->id, 5742 MGMT_OP_ADD_REMOTE_OOB_DATA, 5743 MGMT_STATUS_INVALID_PARAMS, 5744 addr, sizeof(*addr)); 5745 goto unlock; 5746 } 5747 5748 rand192 = NULL; 5749 hash192 = NULL; 5750 } else { 5751 /* In case one of the P-192 values is set to zero, 5752 * then just disable OOB data for P-192. 5753 */ 5754 if (!memcmp(cp->rand192, ZERO_KEY, 16) || 5755 !memcmp(cp->hash192, ZERO_KEY, 16)) { 5756 rand192 = NULL; 5757 hash192 = NULL; 5758 } else { 5759 rand192 = cp->rand192; 5760 hash192 = cp->hash192; 5761 } 5762 } 5763 5764 /* In case one of the P-256 values is set to zero, then just 5765 * disable OOB data for P-256. 5766 */ 5767 if (!memcmp(cp->rand256, ZERO_KEY, 16) || 5768 !memcmp(cp->hash256, ZERO_KEY, 16)) { 5769 rand256 = NULL; 5770 hash256 = NULL; 5771 } else { 5772 rand256 = cp->rand256; 5773 hash256 = cp->hash256; 5774 } 5775 5776 err = hci_add_remote_oob_data(hdev, &cp->addr.bdaddr, 5777 cp->addr.type, hash192, rand192, 5778 hash256, rand256); 5779 if (err < 0) 5780 status = MGMT_STATUS_FAILED; 5781 else 5782 status = MGMT_STATUS_SUCCESS; 5783 5784 err = mgmt_cmd_complete(sk, hdev->id, 5785 MGMT_OP_ADD_REMOTE_OOB_DATA, 5786 status, &cp->addr, sizeof(cp->addr)); 5787 } else { 5788 bt_dev_err(hdev, "add_remote_oob_data: invalid len of %u bytes", 5789 len); 5790 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_REMOTE_OOB_DATA, 5791 MGMT_STATUS_INVALID_PARAMS); 5792 } 5793 5794 unlock: 5795 hci_dev_unlock(hdev); 5796 return err; 5797 } 5798 5799 static int remove_remote_oob_data(struct sock *sk, struct hci_dev *hdev, 5800 void *data, u16 len) 5801 { 5802 struct mgmt_cp_remove_remote_oob_data *cp = data; 5803 u8 status; 5804 int err; 5805 5806 bt_dev_dbg(hdev, "sock %p", sk); 5807 5808 if (cp->addr.type != BDADDR_BREDR) 5809 return mgmt_cmd_complete(sk, hdev->id, 5810 MGMT_OP_REMOVE_REMOTE_OOB_DATA, 5811 MGMT_STATUS_INVALID_PARAMS, 5812 &cp->addr, sizeof(cp->addr)); 5813 5814 hci_dev_lock(hdev); 5815 5816 if (!bacmp(&cp->addr.bdaddr, BDADDR_ANY)) { 5817 hci_remote_oob_data_clear(hdev); 5818 status = MGMT_STATUS_SUCCESS; 5819 goto done; 5820 } 5821 5822 err = hci_remove_remote_oob_data(hdev, &cp->addr.bdaddr, cp->addr.type); 5823 if (err < 0) 5824 status = MGMT_STATUS_INVALID_PARAMS; 5825 else 5826 status = MGMT_STATUS_SUCCESS; 5827 5828 done: 5829 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_REMOTE_OOB_DATA, 5830 status, &cp->addr, sizeof(cp->addr)); 5831 5832 hci_dev_unlock(hdev); 5833 return err; 5834 } 5835 5836 void mgmt_start_discovery_complete(struct hci_dev *hdev, u8 status) 5837 { 5838 struct mgmt_pending_cmd *cmd; 5839 5840 bt_dev_dbg(hdev, "status %u", status); 5841 5842 hci_dev_lock(hdev); 5843 5844 cmd = pending_find(MGMT_OP_START_DISCOVERY, hdev); 5845 if (!cmd) 5846 cmd = pending_find(MGMT_OP_START_SERVICE_DISCOVERY, hdev); 5847 5848 if (!cmd) 5849 cmd = pending_find(MGMT_OP_START_LIMITED_DISCOVERY, hdev); 5850 5851 if (cmd) { 5852 cmd->cmd_complete(cmd, mgmt_status(status)); 5853 mgmt_pending_remove(cmd); 5854 } 5855 5856 hci_dev_unlock(hdev); 5857 } 5858 5859 static bool discovery_type_is_valid(struct hci_dev *hdev, uint8_t type, 5860 uint8_t *mgmt_status) 5861 { 5862 switch (type) { 5863 case DISCOV_TYPE_LE: 5864 *mgmt_status = mgmt_le_support(hdev); 5865 if (*mgmt_status) 5866 return false; 5867 break; 5868 case DISCOV_TYPE_INTERLEAVED: 5869 *mgmt_status = mgmt_le_support(hdev); 5870 if (*mgmt_status) 5871 return false; 5872 fallthrough; 5873 case DISCOV_TYPE_BREDR: 5874 *mgmt_status = mgmt_bredr_support(hdev); 5875 if (*mgmt_status) 5876 return false; 5877 break; 5878 default: 5879 *mgmt_status = MGMT_STATUS_INVALID_PARAMS; 5880 return false; 5881 } 5882 5883 return true; 5884 } 5885 5886 static void start_discovery_complete(struct hci_dev *hdev, void *data, int err) 5887 { 5888 struct mgmt_pending_cmd *cmd = data; 5889 5890 if (cmd != pending_find(MGMT_OP_START_DISCOVERY, hdev) && 5891 cmd != pending_find(MGMT_OP_START_LIMITED_DISCOVERY, hdev) && 5892 cmd != pending_find(MGMT_OP_START_SERVICE_DISCOVERY, hdev)) 5893 return; 5894 5895 bt_dev_dbg(hdev, "err %d", err); 5896 5897 mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, mgmt_status(err), 5898 cmd->param, 1); 5899 mgmt_pending_remove(cmd); 5900 5901 hci_discovery_set_state(hdev, err ? DISCOVERY_STOPPED: 5902 DISCOVERY_FINDING); 5903 } 5904 5905 static int start_discovery_sync(struct hci_dev *hdev, void *data) 5906 { 5907 return hci_start_discovery_sync(hdev); 5908 } 5909 5910 static int start_discovery_internal(struct sock *sk, struct hci_dev *hdev, 5911 u16 op, void *data, u16 len) 5912 { 5913 struct mgmt_cp_start_discovery *cp = data; 5914 struct mgmt_pending_cmd *cmd; 5915 u8 status; 5916 int err; 5917 5918 bt_dev_dbg(hdev, "sock %p", sk); 5919 5920 hci_dev_lock(hdev); 5921 5922 if (!hdev_is_powered(hdev)) { 5923 err = mgmt_cmd_complete(sk, hdev->id, op, 5924 MGMT_STATUS_NOT_POWERED, 5925 &cp->type, sizeof(cp->type)); 5926 goto failed; 5927 } 5928 5929 if (hdev->discovery.state != DISCOVERY_STOPPED || 5930 hci_dev_test_flag(hdev, HCI_PERIODIC_INQ)) { 5931 err = mgmt_cmd_complete(sk, hdev->id, op, MGMT_STATUS_BUSY, 5932 &cp->type, sizeof(cp->type)); 5933 goto failed; 5934 } 5935 5936 if (!discovery_type_is_valid(hdev, cp->type, &status)) { 5937 err = mgmt_cmd_complete(sk, hdev->id, op, status, 5938 &cp->type, sizeof(cp->type)); 5939 goto failed; 5940 } 5941 5942 /* Can't start discovery when it is paused */ 5943 if (hdev->discovery_paused) { 5944 err = mgmt_cmd_complete(sk, hdev->id, op, MGMT_STATUS_BUSY, 5945 &cp->type, sizeof(cp->type)); 5946 goto failed; 5947 } 5948 5949 /* Clear the discovery filter first to free any previously 5950 * allocated memory for the UUID list. 5951 */ 5952 hci_discovery_filter_clear(hdev); 5953 5954 hdev->discovery.type = cp->type; 5955 hdev->discovery.report_invalid_rssi = false; 5956 if (op == MGMT_OP_START_LIMITED_DISCOVERY) 5957 hdev->discovery.limited = true; 5958 else 5959 hdev->discovery.limited = false; 5960 5961 cmd = mgmt_pending_add(sk, op, hdev, data, len); 5962 if (!cmd) { 5963 err = -ENOMEM; 5964 goto failed; 5965 } 5966 5967 err = hci_cmd_sync_queue(hdev, start_discovery_sync, cmd, 5968 start_discovery_complete); 5969 if (err < 0) { 5970 mgmt_pending_remove(cmd); 5971 goto failed; 5972 } 5973 5974 hci_discovery_set_state(hdev, DISCOVERY_STARTING); 5975 5976 failed: 5977 hci_dev_unlock(hdev); 5978 return err; 5979 } 5980 5981 static int start_discovery(struct sock *sk, struct hci_dev *hdev, 5982 void *data, u16 len) 5983 { 5984 return start_discovery_internal(sk, hdev, MGMT_OP_START_DISCOVERY, 5985 data, len); 5986 } 5987 5988 static int start_limited_discovery(struct sock *sk, struct hci_dev *hdev, 5989 void *data, u16 len) 5990 { 5991 return start_discovery_internal(sk, hdev, 5992 MGMT_OP_START_LIMITED_DISCOVERY, 5993 data, len); 5994 } 5995 5996 static int start_service_discovery(struct sock *sk, struct hci_dev *hdev, 5997 void *data, u16 len) 5998 { 5999 struct mgmt_cp_start_service_discovery *cp = data; 6000 struct mgmt_pending_cmd *cmd; 6001 const u16 max_uuid_count = ((U16_MAX - sizeof(*cp)) / 16); 6002 u16 uuid_count, expected_len; 6003 u8 status; 6004 int err; 6005 6006 bt_dev_dbg(hdev, "sock %p", sk); 6007 6008 hci_dev_lock(hdev); 6009 6010 if (!hdev_is_powered(hdev)) { 6011 err = mgmt_cmd_complete(sk, hdev->id, 6012 MGMT_OP_START_SERVICE_DISCOVERY, 6013 MGMT_STATUS_NOT_POWERED, 6014 &cp->type, sizeof(cp->type)); 6015 goto failed; 6016 } 6017 6018 if (hdev->discovery.state != DISCOVERY_STOPPED || 6019 hci_dev_test_flag(hdev, HCI_PERIODIC_INQ)) { 6020 err = mgmt_cmd_complete(sk, hdev->id, 6021 MGMT_OP_START_SERVICE_DISCOVERY, 6022 MGMT_STATUS_BUSY, &cp->type, 6023 sizeof(cp->type)); 6024 goto failed; 6025 } 6026 6027 if (hdev->discovery_paused) { 6028 err = mgmt_cmd_complete(sk, hdev->id, 6029 MGMT_OP_START_SERVICE_DISCOVERY, 6030 MGMT_STATUS_BUSY, &cp->type, 6031 sizeof(cp->type)); 6032 goto failed; 6033 } 6034 6035 uuid_count = __le16_to_cpu(cp->uuid_count); 6036 if (uuid_count > max_uuid_count) { 6037 bt_dev_err(hdev, "service_discovery: too big uuid_count value %u", 6038 uuid_count); 6039 err = mgmt_cmd_complete(sk, hdev->id, 6040 MGMT_OP_START_SERVICE_DISCOVERY, 6041 MGMT_STATUS_INVALID_PARAMS, &cp->type, 6042 sizeof(cp->type)); 6043 goto failed; 6044 } 6045 6046 expected_len = sizeof(*cp) + uuid_count * 16; 6047 if (expected_len != len) { 6048 bt_dev_err(hdev, "service_discovery: expected %u bytes, got %u bytes", 6049 expected_len, len); 6050 err = mgmt_cmd_complete(sk, hdev->id, 6051 MGMT_OP_START_SERVICE_DISCOVERY, 6052 MGMT_STATUS_INVALID_PARAMS, &cp->type, 6053 sizeof(cp->type)); 6054 goto failed; 6055 } 6056 6057 if (!discovery_type_is_valid(hdev, cp->type, &status)) { 6058 err = mgmt_cmd_complete(sk, hdev->id, 6059 MGMT_OP_START_SERVICE_DISCOVERY, 6060 status, &cp->type, sizeof(cp->type)); 6061 goto failed; 6062 } 6063 6064 cmd = mgmt_pending_add(sk, MGMT_OP_START_SERVICE_DISCOVERY, 6065 hdev, data, len); 6066 if (!cmd) { 6067 err = -ENOMEM; 6068 goto failed; 6069 } 6070 6071 /* Clear the discovery filter first to free any previously 6072 * allocated memory for the UUID list. 6073 */ 6074 hci_discovery_filter_clear(hdev); 6075 6076 hdev->discovery.result_filtering = true; 6077 hdev->discovery.type = cp->type; 6078 hdev->discovery.rssi = cp->rssi; 6079 hdev->discovery.uuid_count = uuid_count; 6080 6081 if (uuid_count > 0) { 6082 hdev->discovery.uuids = kmemdup(cp->uuids, uuid_count * 16, 6083 GFP_KERNEL); 6084 if (!hdev->discovery.uuids) { 6085 err = mgmt_cmd_complete(sk, hdev->id, 6086 MGMT_OP_START_SERVICE_DISCOVERY, 6087 MGMT_STATUS_FAILED, 6088 &cp->type, sizeof(cp->type)); 6089 mgmt_pending_remove(cmd); 6090 goto failed; 6091 } 6092 } 6093 6094 err = hci_cmd_sync_queue(hdev, start_discovery_sync, cmd, 6095 start_discovery_complete); 6096 if (err < 0) { 6097 mgmt_pending_remove(cmd); 6098 goto failed; 6099 } 6100 6101 hci_discovery_set_state(hdev, DISCOVERY_STARTING); 6102 6103 failed: 6104 hci_dev_unlock(hdev); 6105 return err; 6106 } 6107 6108 void mgmt_stop_discovery_complete(struct hci_dev *hdev, u8 status) 6109 { 6110 struct mgmt_pending_cmd *cmd; 6111 6112 bt_dev_dbg(hdev, "status %u", status); 6113 6114 hci_dev_lock(hdev); 6115 6116 cmd = pending_find(MGMT_OP_STOP_DISCOVERY, hdev); 6117 if (cmd) { 6118 cmd->cmd_complete(cmd, mgmt_status(status)); 6119 mgmt_pending_remove(cmd); 6120 } 6121 6122 hci_dev_unlock(hdev); 6123 } 6124 6125 static void stop_discovery_complete(struct hci_dev *hdev, void *data, int err) 6126 { 6127 struct mgmt_pending_cmd *cmd = data; 6128 6129 if (cmd != pending_find(MGMT_OP_STOP_DISCOVERY, hdev)) 6130 return; 6131 6132 bt_dev_dbg(hdev, "err %d", err); 6133 6134 mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, mgmt_status(err), 6135 cmd->param, 1); 6136 mgmt_pending_remove(cmd); 6137 6138 if (!err) 6139 hci_discovery_set_state(hdev, DISCOVERY_STOPPED); 6140 } 6141 6142 static int stop_discovery_sync(struct hci_dev *hdev, void *data) 6143 { 6144 return hci_stop_discovery_sync(hdev); 6145 } 6146 6147 static int stop_discovery(struct sock *sk, struct hci_dev *hdev, void *data, 6148 u16 len) 6149 { 6150 struct mgmt_cp_stop_discovery *mgmt_cp = data; 6151 struct mgmt_pending_cmd *cmd; 6152 int err; 6153 6154 bt_dev_dbg(hdev, "sock %p", sk); 6155 6156 hci_dev_lock(hdev); 6157 6158 if (!hci_discovery_active(hdev)) { 6159 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY, 6160 MGMT_STATUS_REJECTED, &mgmt_cp->type, 6161 sizeof(mgmt_cp->type)); 6162 goto unlock; 6163 } 6164 6165 if (hdev->discovery.type != mgmt_cp->type) { 6166 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY, 6167 MGMT_STATUS_INVALID_PARAMS, 6168 &mgmt_cp->type, sizeof(mgmt_cp->type)); 6169 goto unlock; 6170 } 6171 6172 cmd = mgmt_pending_add(sk, MGMT_OP_STOP_DISCOVERY, hdev, data, len); 6173 if (!cmd) { 6174 err = -ENOMEM; 6175 goto unlock; 6176 } 6177 6178 err = hci_cmd_sync_queue(hdev, stop_discovery_sync, cmd, 6179 stop_discovery_complete); 6180 if (err < 0) { 6181 mgmt_pending_remove(cmd); 6182 goto unlock; 6183 } 6184 6185 hci_discovery_set_state(hdev, DISCOVERY_STOPPING); 6186 6187 unlock: 6188 hci_dev_unlock(hdev); 6189 return err; 6190 } 6191 6192 static int confirm_name(struct sock *sk, struct hci_dev *hdev, void *data, 6193 u16 len) 6194 { 6195 struct mgmt_cp_confirm_name *cp = data; 6196 struct inquiry_entry *e; 6197 int err; 6198 6199 bt_dev_dbg(hdev, "sock %p", sk); 6200 6201 hci_dev_lock(hdev); 6202 6203 if (!hci_discovery_active(hdev)) { 6204 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME, 6205 MGMT_STATUS_FAILED, &cp->addr, 6206 sizeof(cp->addr)); 6207 goto failed; 6208 } 6209 6210 e = hci_inquiry_cache_lookup_unknown(hdev, &cp->addr.bdaddr); 6211 if (!e) { 6212 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME, 6213 MGMT_STATUS_INVALID_PARAMS, &cp->addr, 6214 sizeof(cp->addr)); 6215 goto failed; 6216 } 6217 6218 if (cp->name_known) { 6219 e->name_state = NAME_KNOWN; 6220 list_del(&e->list); 6221 } else { 6222 e->name_state = NAME_NEEDED; 6223 hci_inquiry_cache_update_resolve(hdev, e); 6224 } 6225 6226 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME, 0, 6227 &cp->addr, sizeof(cp->addr)); 6228 6229 failed: 6230 hci_dev_unlock(hdev); 6231 return err; 6232 } 6233 6234 static int block_device(struct sock *sk, struct hci_dev *hdev, void *data, 6235 u16 len) 6236 { 6237 struct mgmt_cp_block_device *cp = data; 6238 u8 status; 6239 int err; 6240 6241 bt_dev_dbg(hdev, "sock %p", sk); 6242 6243 if (!bdaddr_type_is_valid(cp->addr.type)) 6244 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_BLOCK_DEVICE, 6245 MGMT_STATUS_INVALID_PARAMS, 6246 &cp->addr, sizeof(cp->addr)); 6247 6248 hci_dev_lock(hdev); 6249 6250 err = hci_bdaddr_list_add(&hdev->reject_list, &cp->addr.bdaddr, 6251 cp->addr.type); 6252 if (err < 0) { 6253 status = MGMT_STATUS_FAILED; 6254 goto done; 6255 } 6256 6257 mgmt_event(MGMT_EV_DEVICE_BLOCKED, hdev, &cp->addr, sizeof(cp->addr), 6258 sk); 6259 status = MGMT_STATUS_SUCCESS; 6260 6261 done: 6262 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_BLOCK_DEVICE, status, 6263 &cp->addr, sizeof(cp->addr)); 6264 6265 hci_dev_unlock(hdev); 6266 6267 return err; 6268 } 6269 6270 static int unblock_device(struct sock *sk, struct hci_dev *hdev, void *data, 6271 u16 len) 6272 { 6273 struct mgmt_cp_unblock_device *cp = data; 6274 u8 status; 6275 int err; 6276 6277 bt_dev_dbg(hdev, "sock %p", sk); 6278 6279 if (!bdaddr_type_is_valid(cp->addr.type)) 6280 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNBLOCK_DEVICE, 6281 MGMT_STATUS_INVALID_PARAMS, 6282 &cp->addr, sizeof(cp->addr)); 6283 6284 hci_dev_lock(hdev); 6285 6286 err = hci_bdaddr_list_del(&hdev->reject_list, &cp->addr.bdaddr, 6287 cp->addr.type); 6288 if (err < 0) { 6289 status = MGMT_STATUS_INVALID_PARAMS; 6290 goto done; 6291 } 6292 6293 mgmt_event(MGMT_EV_DEVICE_UNBLOCKED, hdev, &cp->addr, sizeof(cp->addr), 6294 sk); 6295 status = MGMT_STATUS_SUCCESS; 6296 6297 done: 6298 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNBLOCK_DEVICE, status, 6299 &cp->addr, sizeof(cp->addr)); 6300 6301 hci_dev_unlock(hdev); 6302 6303 return err; 6304 } 6305 6306 static int set_device_id_sync(struct hci_dev *hdev, void *data) 6307 { 6308 return hci_update_eir_sync(hdev); 6309 } 6310 6311 static int set_device_id(struct sock *sk, struct hci_dev *hdev, void *data, 6312 u16 len) 6313 { 6314 struct mgmt_cp_set_device_id *cp = data; 6315 int err; 6316 __u16 source; 6317 6318 bt_dev_dbg(hdev, "sock %p", sk); 6319 6320 source = __le16_to_cpu(cp->source); 6321 6322 if (source > 0x0002) 6323 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEVICE_ID, 6324 MGMT_STATUS_INVALID_PARAMS); 6325 6326 hci_dev_lock(hdev); 6327 6328 hdev->devid_source = source; 6329 hdev->devid_vendor = __le16_to_cpu(cp->vendor); 6330 hdev->devid_product = __le16_to_cpu(cp->product); 6331 hdev->devid_version = __le16_to_cpu(cp->version); 6332 6333 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_DEVICE_ID, 0, 6334 NULL, 0); 6335 6336 hci_cmd_sync_queue(hdev, set_device_id_sync, NULL, NULL); 6337 6338 hci_dev_unlock(hdev); 6339 6340 return err; 6341 } 6342 6343 static void enable_advertising_instance(struct hci_dev *hdev, int err) 6344 { 6345 if (err) 6346 bt_dev_err(hdev, "failed to re-configure advertising %d", err); 6347 else 6348 bt_dev_dbg(hdev, "status %d", err); 6349 } 6350 6351 static void set_advertising_complete(struct hci_dev *hdev, void *data, int err) 6352 { 6353 struct cmd_lookup match = { NULL, hdev }; 6354 u8 instance; 6355 struct adv_info *adv_instance; 6356 u8 status = mgmt_status(err); 6357 6358 if (status) { 6359 mgmt_pending_foreach(MGMT_OP_SET_ADVERTISING, hdev, 6360 cmd_status_rsp, &status); 6361 return; 6362 } 6363 6364 if (hci_dev_test_flag(hdev, HCI_LE_ADV)) 6365 hci_dev_set_flag(hdev, HCI_ADVERTISING); 6366 else 6367 hci_dev_clear_flag(hdev, HCI_ADVERTISING); 6368 6369 mgmt_pending_foreach(MGMT_OP_SET_ADVERTISING, hdev, settings_rsp, 6370 &match); 6371 6372 new_settings(hdev, match.sk); 6373 6374 if (match.sk) 6375 sock_put(match.sk); 6376 6377 /* If "Set Advertising" was just disabled and instance advertising was 6378 * set up earlier, then re-enable multi-instance advertising. 6379 */ 6380 if (hci_dev_test_flag(hdev, HCI_ADVERTISING) || 6381 list_empty(&hdev->adv_instances)) 6382 return; 6383 6384 instance = hdev->cur_adv_instance; 6385 if (!instance) { 6386 adv_instance = list_first_entry_or_null(&hdev->adv_instances, 6387 struct adv_info, list); 6388 if (!adv_instance) 6389 return; 6390 6391 instance = adv_instance->instance; 6392 } 6393 6394 err = hci_schedule_adv_instance_sync(hdev, instance, true); 6395 6396 enable_advertising_instance(hdev, err); 6397 } 6398 6399 static int set_adv_sync(struct hci_dev *hdev, void *data) 6400 { 6401 struct mgmt_pending_cmd *cmd = data; 6402 struct mgmt_mode *cp = cmd->param; 6403 u8 val = !!cp->val; 6404 6405 if (cp->val == 0x02) 6406 hci_dev_set_flag(hdev, HCI_ADVERTISING_CONNECTABLE); 6407 else 6408 hci_dev_clear_flag(hdev, HCI_ADVERTISING_CONNECTABLE); 6409 6410 cancel_adv_timeout(hdev); 6411 6412 if (val) { 6413 /* Switch to instance "0" for the Set Advertising setting. 6414 * We cannot use update_[adv|scan_rsp]_data() here as the 6415 * HCI_ADVERTISING flag is not yet set. 6416 */ 6417 hdev->cur_adv_instance = 0x00; 6418 6419 if (ext_adv_capable(hdev)) { 6420 hci_start_ext_adv_sync(hdev, 0x00); 6421 } else { 6422 hci_update_adv_data_sync(hdev, 0x00); 6423 hci_update_scan_rsp_data_sync(hdev, 0x00); 6424 hci_enable_advertising_sync(hdev); 6425 } 6426 } else { 6427 hci_disable_advertising_sync(hdev); 6428 } 6429 6430 return 0; 6431 } 6432 6433 static int set_advertising(struct sock *sk, struct hci_dev *hdev, void *data, 6434 u16 len) 6435 { 6436 struct mgmt_mode *cp = data; 6437 struct mgmt_pending_cmd *cmd; 6438 u8 val, status; 6439 int err; 6440 6441 bt_dev_dbg(hdev, "sock %p", sk); 6442 6443 status = mgmt_le_support(hdev); 6444 if (status) 6445 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING, 6446 status); 6447 6448 if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02) 6449 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING, 6450 MGMT_STATUS_INVALID_PARAMS); 6451 6452 if (hdev->advertising_paused) 6453 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING, 6454 MGMT_STATUS_BUSY); 6455 6456 hci_dev_lock(hdev); 6457 6458 val = !!cp->val; 6459 6460 /* The following conditions are ones which mean that we should 6461 * not do any HCI communication but directly send a mgmt 6462 * response to user space (after toggling the flag if 6463 * necessary). 6464 */ 6465 if (!hdev_is_powered(hdev) || 6466 (val == hci_dev_test_flag(hdev, HCI_ADVERTISING) && 6467 (cp->val == 0x02) == hci_dev_test_flag(hdev, HCI_ADVERTISING_CONNECTABLE)) || 6468 hci_dev_test_flag(hdev, HCI_MESH) || 6469 hci_conn_num(hdev, LE_LINK) > 0 || 6470 (hci_dev_test_flag(hdev, HCI_LE_SCAN) && 6471 hdev->le_scan_type == LE_SCAN_ACTIVE)) { 6472 bool changed; 6473 6474 if (cp->val) { 6475 hdev->cur_adv_instance = 0x00; 6476 changed = !hci_dev_test_and_set_flag(hdev, HCI_ADVERTISING); 6477 if (cp->val == 0x02) 6478 hci_dev_set_flag(hdev, HCI_ADVERTISING_CONNECTABLE); 6479 else 6480 hci_dev_clear_flag(hdev, HCI_ADVERTISING_CONNECTABLE); 6481 } else { 6482 changed = hci_dev_test_and_clear_flag(hdev, HCI_ADVERTISING); 6483 hci_dev_clear_flag(hdev, HCI_ADVERTISING_CONNECTABLE); 6484 } 6485 6486 err = send_settings_rsp(sk, MGMT_OP_SET_ADVERTISING, hdev); 6487 if (err < 0) 6488 goto unlock; 6489 6490 if (changed) 6491 err = new_settings(hdev, sk); 6492 6493 goto unlock; 6494 } 6495 6496 if (pending_find(MGMT_OP_SET_ADVERTISING, hdev) || 6497 pending_find(MGMT_OP_SET_LE, hdev)) { 6498 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING, 6499 MGMT_STATUS_BUSY); 6500 goto unlock; 6501 } 6502 6503 cmd = mgmt_pending_add(sk, MGMT_OP_SET_ADVERTISING, hdev, data, len); 6504 if (!cmd) 6505 err = -ENOMEM; 6506 else 6507 err = hci_cmd_sync_queue(hdev, set_adv_sync, cmd, 6508 set_advertising_complete); 6509 6510 if (err < 0 && cmd) 6511 mgmt_pending_remove(cmd); 6512 6513 unlock: 6514 hci_dev_unlock(hdev); 6515 return err; 6516 } 6517 6518 static int set_static_address(struct sock *sk, struct hci_dev *hdev, 6519 void *data, u16 len) 6520 { 6521 struct mgmt_cp_set_static_address *cp = data; 6522 int err; 6523 6524 bt_dev_dbg(hdev, "sock %p", sk); 6525 6526 if (!lmp_le_capable(hdev)) 6527 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_STATIC_ADDRESS, 6528 MGMT_STATUS_NOT_SUPPORTED); 6529 6530 if (hdev_is_powered(hdev)) 6531 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_STATIC_ADDRESS, 6532 MGMT_STATUS_REJECTED); 6533 6534 if (bacmp(&cp->bdaddr, BDADDR_ANY)) { 6535 if (!bacmp(&cp->bdaddr, BDADDR_NONE)) 6536 return mgmt_cmd_status(sk, hdev->id, 6537 MGMT_OP_SET_STATIC_ADDRESS, 6538 MGMT_STATUS_INVALID_PARAMS); 6539 6540 /* Two most significant bits shall be set */ 6541 if ((cp->bdaddr.b[5] & 0xc0) != 0xc0) 6542 return mgmt_cmd_status(sk, hdev->id, 6543 MGMT_OP_SET_STATIC_ADDRESS, 6544 MGMT_STATUS_INVALID_PARAMS); 6545 } 6546 6547 hci_dev_lock(hdev); 6548 6549 bacpy(&hdev->static_addr, &cp->bdaddr); 6550 6551 err = send_settings_rsp(sk, MGMT_OP_SET_STATIC_ADDRESS, hdev); 6552 if (err < 0) 6553 goto unlock; 6554 6555 err = new_settings(hdev, sk); 6556 6557 unlock: 6558 hci_dev_unlock(hdev); 6559 return err; 6560 } 6561 6562 static int set_scan_params(struct sock *sk, struct hci_dev *hdev, 6563 void *data, u16 len) 6564 { 6565 struct mgmt_cp_set_scan_params *cp = data; 6566 __u16 interval, window; 6567 int err; 6568 6569 bt_dev_dbg(hdev, "sock %p", sk); 6570 6571 if (!lmp_le_capable(hdev)) 6572 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS, 6573 MGMT_STATUS_NOT_SUPPORTED); 6574 6575 interval = __le16_to_cpu(cp->interval); 6576 6577 if (interval < 0x0004 || interval > 0x4000) 6578 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS, 6579 MGMT_STATUS_INVALID_PARAMS); 6580 6581 window = __le16_to_cpu(cp->window); 6582 6583 if (window < 0x0004 || window > 0x4000) 6584 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS, 6585 MGMT_STATUS_INVALID_PARAMS); 6586 6587 if (window > interval) 6588 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS, 6589 MGMT_STATUS_INVALID_PARAMS); 6590 6591 hci_dev_lock(hdev); 6592 6593 hdev->le_scan_interval = interval; 6594 hdev->le_scan_window = window; 6595 6596 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS, 0, 6597 NULL, 0); 6598 6599 /* If background scan is running, restart it so new parameters are 6600 * loaded. 6601 */ 6602 if (hci_dev_test_flag(hdev, HCI_LE_SCAN) && 6603 hdev->discovery.state == DISCOVERY_STOPPED) 6604 hci_update_passive_scan(hdev); 6605 6606 hci_dev_unlock(hdev); 6607 6608 return err; 6609 } 6610 6611 static void fast_connectable_complete(struct hci_dev *hdev, void *data, int err) 6612 { 6613 struct mgmt_pending_cmd *cmd = data; 6614 6615 bt_dev_dbg(hdev, "err %d", err); 6616 6617 if (err) { 6618 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE, 6619 mgmt_status(err)); 6620 } else { 6621 struct mgmt_mode *cp = cmd->param; 6622 6623 if (cp->val) 6624 hci_dev_set_flag(hdev, HCI_FAST_CONNECTABLE); 6625 else 6626 hci_dev_clear_flag(hdev, HCI_FAST_CONNECTABLE); 6627 6628 send_settings_rsp(cmd->sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev); 6629 new_settings(hdev, cmd->sk); 6630 } 6631 6632 mgmt_pending_free(cmd); 6633 } 6634 6635 static int write_fast_connectable_sync(struct hci_dev *hdev, void *data) 6636 { 6637 struct mgmt_pending_cmd *cmd = data; 6638 struct mgmt_mode *cp = cmd->param; 6639 6640 return hci_write_fast_connectable_sync(hdev, cp->val); 6641 } 6642 6643 static int set_fast_connectable(struct sock *sk, struct hci_dev *hdev, 6644 void *data, u16 len) 6645 { 6646 struct mgmt_mode *cp = data; 6647 struct mgmt_pending_cmd *cmd; 6648 int err; 6649 6650 bt_dev_dbg(hdev, "sock %p", sk); 6651 6652 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) || 6653 hdev->hci_ver < BLUETOOTH_VER_1_2) 6654 return mgmt_cmd_status(sk, hdev->id, 6655 MGMT_OP_SET_FAST_CONNECTABLE, 6656 MGMT_STATUS_NOT_SUPPORTED); 6657 6658 if (cp->val != 0x00 && cp->val != 0x01) 6659 return mgmt_cmd_status(sk, hdev->id, 6660 MGMT_OP_SET_FAST_CONNECTABLE, 6661 MGMT_STATUS_INVALID_PARAMS); 6662 6663 hci_dev_lock(hdev); 6664 6665 if (!!cp->val == hci_dev_test_flag(hdev, HCI_FAST_CONNECTABLE)) { 6666 err = send_settings_rsp(sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev); 6667 goto unlock; 6668 } 6669 6670 if (!hdev_is_powered(hdev)) { 6671 hci_dev_change_flag(hdev, HCI_FAST_CONNECTABLE); 6672 err = send_settings_rsp(sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev); 6673 new_settings(hdev, sk); 6674 goto unlock; 6675 } 6676 6677 cmd = mgmt_pending_new(sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev, data, 6678 len); 6679 if (!cmd) 6680 err = -ENOMEM; 6681 else 6682 err = hci_cmd_sync_queue(hdev, write_fast_connectable_sync, cmd, 6683 fast_connectable_complete); 6684 6685 if (err < 0) { 6686 mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE, 6687 MGMT_STATUS_FAILED); 6688 6689 if (cmd) 6690 mgmt_pending_free(cmd); 6691 } 6692 6693 unlock: 6694 hci_dev_unlock(hdev); 6695 6696 return err; 6697 } 6698 6699 static void set_bredr_complete(struct hci_dev *hdev, void *data, int err) 6700 { 6701 struct mgmt_pending_cmd *cmd = data; 6702 6703 bt_dev_dbg(hdev, "err %d", err); 6704 6705 if (err) { 6706 u8 mgmt_err = mgmt_status(err); 6707 6708 /* We need to restore the flag if related HCI commands 6709 * failed. 6710 */ 6711 hci_dev_clear_flag(hdev, HCI_BREDR_ENABLED); 6712 6713 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err); 6714 } else { 6715 send_settings_rsp(cmd->sk, MGMT_OP_SET_BREDR, hdev); 6716 new_settings(hdev, cmd->sk); 6717 } 6718 6719 mgmt_pending_free(cmd); 6720 } 6721 6722 static int set_bredr_sync(struct hci_dev *hdev, void *data) 6723 { 6724 int status; 6725 6726 status = hci_write_fast_connectable_sync(hdev, false); 6727 6728 if (!status) 6729 status = hci_update_scan_sync(hdev); 6730 6731 /* Since only the advertising data flags will change, there 6732 * is no need to update the scan response data. 6733 */ 6734 if (!status) 6735 status = hci_update_adv_data_sync(hdev, hdev->cur_adv_instance); 6736 6737 return status; 6738 } 6739 6740 static int set_bredr(struct sock *sk, struct hci_dev *hdev, void *data, u16 len) 6741 { 6742 struct mgmt_mode *cp = data; 6743 struct mgmt_pending_cmd *cmd; 6744 int err; 6745 6746 bt_dev_dbg(hdev, "sock %p", sk); 6747 6748 if (!lmp_bredr_capable(hdev) || !lmp_le_capable(hdev)) 6749 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR, 6750 MGMT_STATUS_NOT_SUPPORTED); 6751 6752 if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED)) 6753 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR, 6754 MGMT_STATUS_REJECTED); 6755 6756 if (cp->val != 0x00 && cp->val != 0x01) 6757 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR, 6758 MGMT_STATUS_INVALID_PARAMS); 6759 6760 hci_dev_lock(hdev); 6761 6762 if (cp->val == hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) { 6763 err = send_settings_rsp(sk, MGMT_OP_SET_BREDR, hdev); 6764 goto unlock; 6765 } 6766 6767 if (!hdev_is_powered(hdev)) { 6768 if (!cp->val) { 6769 hci_dev_clear_flag(hdev, HCI_DISCOVERABLE); 6770 hci_dev_clear_flag(hdev, HCI_SSP_ENABLED); 6771 hci_dev_clear_flag(hdev, HCI_LINK_SECURITY); 6772 hci_dev_clear_flag(hdev, HCI_FAST_CONNECTABLE); 6773 hci_dev_clear_flag(hdev, HCI_HS_ENABLED); 6774 } 6775 6776 hci_dev_change_flag(hdev, HCI_BREDR_ENABLED); 6777 6778 err = send_settings_rsp(sk, MGMT_OP_SET_BREDR, hdev); 6779 if (err < 0) 6780 goto unlock; 6781 6782 err = new_settings(hdev, sk); 6783 goto unlock; 6784 } 6785 6786 /* Reject disabling when powered on */ 6787 if (!cp->val) { 6788 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR, 6789 MGMT_STATUS_REJECTED); 6790 goto unlock; 6791 } else { 6792 /* When configuring a dual-mode controller to operate 6793 * with LE only and using a static address, then switching 6794 * BR/EDR back on is not allowed. 6795 * 6796 * Dual-mode controllers shall operate with the public 6797 * address as its identity address for BR/EDR and LE. So 6798 * reject the attempt to create an invalid configuration. 6799 * 6800 * The same restrictions applies when secure connections 6801 * has been enabled. For BR/EDR this is a controller feature 6802 * while for LE it is a host stack feature. This means that 6803 * switching BR/EDR back on when secure connections has been 6804 * enabled is not a supported transaction. 6805 */ 6806 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) && 6807 (bacmp(&hdev->static_addr, BDADDR_ANY) || 6808 hci_dev_test_flag(hdev, HCI_SC_ENABLED))) { 6809 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR, 6810 MGMT_STATUS_REJECTED); 6811 goto unlock; 6812 } 6813 } 6814 6815 cmd = mgmt_pending_new(sk, MGMT_OP_SET_BREDR, hdev, data, len); 6816 if (!cmd) 6817 err = -ENOMEM; 6818 else 6819 err = hci_cmd_sync_queue(hdev, set_bredr_sync, cmd, 6820 set_bredr_complete); 6821 6822 if (err < 0) { 6823 mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR, 6824 MGMT_STATUS_FAILED); 6825 if (cmd) 6826 mgmt_pending_free(cmd); 6827 6828 goto unlock; 6829 } 6830 6831 /* We need to flip the bit already here so that 6832 * hci_req_update_adv_data generates the correct flags. 6833 */ 6834 hci_dev_set_flag(hdev, HCI_BREDR_ENABLED); 6835 6836 unlock: 6837 hci_dev_unlock(hdev); 6838 return err; 6839 } 6840 6841 static void set_secure_conn_complete(struct hci_dev *hdev, void *data, int err) 6842 { 6843 struct mgmt_pending_cmd *cmd = data; 6844 struct mgmt_mode *cp; 6845 6846 bt_dev_dbg(hdev, "err %d", err); 6847 6848 if (err) { 6849 u8 mgmt_err = mgmt_status(err); 6850 6851 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err); 6852 goto done; 6853 } 6854 6855 cp = cmd->param; 6856 6857 switch (cp->val) { 6858 case 0x00: 6859 hci_dev_clear_flag(hdev, HCI_SC_ENABLED); 6860 hci_dev_clear_flag(hdev, HCI_SC_ONLY); 6861 break; 6862 case 0x01: 6863 hci_dev_set_flag(hdev, HCI_SC_ENABLED); 6864 hci_dev_clear_flag(hdev, HCI_SC_ONLY); 6865 break; 6866 case 0x02: 6867 hci_dev_set_flag(hdev, HCI_SC_ENABLED); 6868 hci_dev_set_flag(hdev, HCI_SC_ONLY); 6869 break; 6870 } 6871 6872 send_settings_rsp(cmd->sk, cmd->opcode, hdev); 6873 new_settings(hdev, cmd->sk); 6874 6875 done: 6876 mgmt_pending_free(cmd); 6877 } 6878 6879 static int set_secure_conn_sync(struct hci_dev *hdev, void *data) 6880 { 6881 struct mgmt_pending_cmd *cmd = data; 6882 struct mgmt_mode *cp = cmd->param; 6883 u8 val = !!cp->val; 6884 6885 /* Force write of val */ 6886 hci_dev_set_flag(hdev, HCI_SC_ENABLED); 6887 6888 return hci_write_sc_support_sync(hdev, val); 6889 } 6890 6891 static int set_secure_conn(struct sock *sk, struct hci_dev *hdev, 6892 void *data, u16 len) 6893 { 6894 struct mgmt_mode *cp = data; 6895 struct mgmt_pending_cmd *cmd; 6896 u8 val; 6897 int err; 6898 6899 bt_dev_dbg(hdev, "sock %p", sk); 6900 6901 if (!lmp_sc_capable(hdev) && 6902 !hci_dev_test_flag(hdev, HCI_LE_ENABLED)) 6903 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN, 6904 MGMT_STATUS_NOT_SUPPORTED); 6905 6906 if (hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) && 6907 lmp_sc_capable(hdev) && 6908 !hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) 6909 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN, 6910 MGMT_STATUS_REJECTED); 6911 6912 if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02) 6913 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN, 6914 MGMT_STATUS_INVALID_PARAMS); 6915 6916 hci_dev_lock(hdev); 6917 6918 if (!hdev_is_powered(hdev) || !lmp_sc_capable(hdev) || 6919 !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) { 6920 bool changed; 6921 6922 if (cp->val) { 6923 changed = !hci_dev_test_and_set_flag(hdev, 6924 HCI_SC_ENABLED); 6925 if (cp->val == 0x02) 6926 hci_dev_set_flag(hdev, HCI_SC_ONLY); 6927 else 6928 hci_dev_clear_flag(hdev, HCI_SC_ONLY); 6929 } else { 6930 changed = hci_dev_test_and_clear_flag(hdev, 6931 HCI_SC_ENABLED); 6932 hci_dev_clear_flag(hdev, HCI_SC_ONLY); 6933 } 6934 6935 err = send_settings_rsp(sk, MGMT_OP_SET_SECURE_CONN, hdev); 6936 if (err < 0) 6937 goto failed; 6938 6939 if (changed) 6940 err = new_settings(hdev, sk); 6941 6942 goto failed; 6943 } 6944 6945 val = !!cp->val; 6946 6947 if (val == hci_dev_test_flag(hdev, HCI_SC_ENABLED) && 6948 (cp->val == 0x02) == hci_dev_test_flag(hdev, HCI_SC_ONLY)) { 6949 err = send_settings_rsp(sk, MGMT_OP_SET_SECURE_CONN, hdev); 6950 goto failed; 6951 } 6952 6953 cmd = mgmt_pending_new(sk, MGMT_OP_SET_SECURE_CONN, hdev, data, len); 6954 if (!cmd) 6955 err = -ENOMEM; 6956 else 6957 err = hci_cmd_sync_queue(hdev, set_secure_conn_sync, cmd, 6958 set_secure_conn_complete); 6959 6960 if (err < 0) { 6961 mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN, 6962 MGMT_STATUS_FAILED); 6963 if (cmd) 6964 mgmt_pending_free(cmd); 6965 } 6966 6967 failed: 6968 hci_dev_unlock(hdev); 6969 return err; 6970 } 6971 6972 static int set_debug_keys(struct sock *sk, struct hci_dev *hdev, 6973 void *data, u16 len) 6974 { 6975 struct mgmt_mode *cp = data; 6976 bool changed, use_changed; 6977 int err; 6978 6979 bt_dev_dbg(hdev, "sock %p", sk); 6980 6981 if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02) 6982 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEBUG_KEYS, 6983 MGMT_STATUS_INVALID_PARAMS); 6984 6985 hci_dev_lock(hdev); 6986 6987 if (cp->val) 6988 changed = !hci_dev_test_and_set_flag(hdev, HCI_KEEP_DEBUG_KEYS); 6989 else 6990 changed = hci_dev_test_and_clear_flag(hdev, 6991 HCI_KEEP_DEBUG_KEYS); 6992 6993 if (cp->val == 0x02) 6994 use_changed = !hci_dev_test_and_set_flag(hdev, 6995 HCI_USE_DEBUG_KEYS); 6996 else 6997 use_changed = hci_dev_test_and_clear_flag(hdev, 6998 HCI_USE_DEBUG_KEYS); 6999 7000 if (hdev_is_powered(hdev) && use_changed && 7001 hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) { 7002 u8 mode = (cp->val == 0x02) ? 0x01 : 0x00; 7003 hci_send_cmd(hdev, HCI_OP_WRITE_SSP_DEBUG_MODE, 7004 sizeof(mode), &mode); 7005 } 7006 7007 err = send_settings_rsp(sk, MGMT_OP_SET_DEBUG_KEYS, hdev); 7008 if (err < 0) 7009 goto unlock; 7010 7011 if (changed) 7012 err = new_settings(hdev, sk); 7013 7014 unlock: 7015 hci_dev_unlock(hdev); 7016 return err; 7017 } 7018 7019 static int set_privacy(struct sock *sk, struct hci_dev *hdev, void *cp_data, 7020 u16 len) 7021 { 7022 struct mgmt_cp_set_privacy *cp = cp_data; 7023 bool changed; 7024 int err; 7025 7026 bt_dev_dbg(hdev, "sock %p", sk); 7027 7028 if (!lmp_le_capable(hdev)) 7029 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY, 7030 MGMT_STATUS_NOT_SUPPORTED); 7031 7032 if (cp->privacy != 0x00 && cp->privacy != 0x01 && cp->privacy != 0x02) 7033 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY, 7034 MGMT_STATUS_INVALID_PARAMS); 7035 7036 if (hdev_is_powered(hdev)) 7037 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY, 7038 MGMT_STATUS_REJECTED); 7039 7040 hci_dev_lock(hdev); 7041 7042 /* If user space supports this command it is also expected to 7043 * handle IRKs. Therefore, set the HCI_RPA_RESOLVING flag. 7044 */ 7045 hci_dev_set_flag(hdev, HCI_RPA_RESOLVING); 7046 7047 if (cp->privacy) { 7048 changed = !hci_dev_test_and_set_flag(hdev, HCI_PRIVACY); 7049 memcpy(hdev->irk, cp->irk, sizeof(hdev->irk)); 7050 hci_dev_set_flag(hdev, HCI_RPA_EXPIRED); 7051 hci_adv_instances_set_rpa_expired(hdev, true); 7052 if (cp->privacy == 0x02) 7053 hci_dev_set_flag(hdev, HCI_LIMITED_PRIVACY); 7054 else 7055 hci_dev_clear_flag(hdev, HCI_LIMITED_PRIVACY); 7056 } else { 7057 changed = hci_dev_test_and_clear_flag(hdev, HCI_PRIVACY); 7058 memset(hdev->irk, 0, sizeof(hdev->irk)); 7059 hci_dev_clear_flag(hdev, HCI_RPA_EXPIRED); 7060 hci_adv_instances_set_rpa_expired(hdev, false); 7061 hci_dev_clear_flag(hdev, HCI_LIMITED_PRIVACY); 7062 } 7063 7064 err = send_settings_rsp(sk, MGMT_OP_SET_PRIVACY, hdev); 7065 if (err < 0) 7066 goto unlock; 7067 7068 if (changed) 7069 err = new_settings(hdev, sk); 7070 7071 unlock: 7072 hci_dev_unlock(hdev); 7073 return err; 7074 } 7075 7076 static bool irk_is_valid(struct mgmt_irk_info *irk) 7077 { 7078 switch (irk->addr.type) { 7079 case BDADDR_LE_PUBLIC: 7080 return true; 7081 7082 case BDADDR_LE_RANDOM: 7083 /* Two most significant bits shall be set */ 7084 if ((irk->addr.bdaddr.b[5] & 0xc0) != 0xc0) 7085 return false; 7086 return true; 7087 } 7088 7089 return false; 7090 } 7091 7092 static int load_irks(struct sock *sk, struct hci_dev *hdev, void *cp_data, 7093 u16 len) 7094 { 7095 struct mgmt_cp_load_irks *cp = cp_data; 7096 const u16 max_irk_count = ((U16_MAX - sizeof(*cp)) / 7097 sizeof(struct mgmt_irk_info)); 7098 u16 irk_count, expected_len; 7099 int i, err; 7100 7101 bt_dev_dbg(hdev, "sock %p", sk); 7102 7103 if (!lmp_le_capable(hdev)) 7104 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS, 7105 MGMT_STATUS_NOT_SUPPORTED); 7106 7107 irk_count = __le16_to_cpu(cp->irk_count); 7108 if (irk_count > max_irk_count) { 7109 bt_dev_err(hdev, "load_irks: too big irk_count value %u", 7110 irk_count); 7111 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS, 7112 MGMT_STATUS_INVALID_PARAMS); 7113 } 7114 7115 expected_len = struct_size(cp, irks, irk_count); 7116 if (expected_len != len) { 7117 bt_dev_err(hdev, "load_irks: expected %u bytes, got %u bytes", 7118 expected_len, len); 7119 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS, 7120 MGMT_STATUS_INVALID_PARAMS); 7121 } 7122 7123 bt_dev_dbg(hdev, "irk_count %u", irk_count); 7124 7125 for (i = 0; i < irk_count; i++) { 7126 struct mgmt_irk_info *key = &cp->irks[i]; 7127 7128 if (!irk_is_valid(key)) 7129 return mgmt_cmd_status(sk, hdev->id, 7130 MGMT_OP_LOAD_IRKS, 7131 MGMT_STATUS_INVALID_PARAMS); 7132 } 7133 7134 hci_dev_lock(hdev); 7135 7136 hci_smp_irks_clear(hdev); 7137 7138 for (i = 0; i < irk_count; i++) { 7139 struct mgmt_irk_info *irk = &cp->irks[i]; 7140 7141 if (hci_is_blocked_key(hdev, 7142 HCI_BLOCKED_KEY_TYPE_IRK, 7143 irk->val)) { 7144 bt_dev_warn(hdev, "Skipping blocked IRK for %pMR", 7145 &irk->addr.bdaddr); 7146 continue; 7147 } 7148 7149 hci_add_irk(hdev, &irk->addr.bdaddr, 7150 le_addr_type(irk->addr.type), irk->val, 7151 BDADDR_ANY); 7152 } 7153 7154 hci_dev_set_flag(hdev, HCI_RPA_RESOLVING); 7155 7156 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_IRKS, 0, NULL, 0); 7157 7158 hci_dev_unlock(hdev); 7159 7160 return err; 7161 } 7162 7163 static bool ltk_is_valid(struct mgmt_ltk_info *key) 7164 { 7165 if (key->initiator != 0x00 && key->initiator != 0x01) 7166 return false; 7167 7168 switch (key->addr.type) { 7169 case BDADDR_LE_PUBLIC: 7170 return true; 7171 7172 case BDADDR_LE_RANDOM: 7173 /* Two most significant bits shall be set */ 7174 if ((key->addr.bdaddr.b[5] & 0xc0) != 0xc0) 7175 return false; 7176 return true; 7177 } 7178 7179 return false; 7180 } 7181 7182 static int load_long_term_keys(struct sock *sk, struct hci_dev *hdev, 7183 void *cp_data, u16 len) 7184 { 7185 struct mgmt_cp_load_long_term_keys *cp = cp_data; 7186 const u16 max_key_count = ((U16_MAX - sizeof(*cp)) / 7187 sizeof(struct mgmt_ltk_info)); 7188 u16 key_count, expected_len; 7189 int i, err; 7190 7191 bt_dev_dbg(hdev, "sock %p", sk); 7192 7193 if (!lmp_le_capable(hdev)) 7194 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS, 7195 MGMT_STATUS_NOT_SUPPORTED); 7196 7197 key_count = __le16_to_cpu(cp->key_count); 7198 if (key_count > max_key_count) { 7199 bt_dev_err(hdev, "load_ltks: too big key_count value %u", 7200 key_count); 7201 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS, 7202 MGMT_STATUS_INVALID_PARAMS); 7203 } 7204 7205 expected_len = struct_size(cp, keys, key_count); 7206 if (expected_len != len) { 7207 bt_dev_err(hdev, "load_keys: expected %u bytes, got %u bytes", 7208 expected_len, len); 7209 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS, 7210 MGMT_STATUS_INVALID_PARAMS); 7211 } 7212 7213 bt_dev_dbg(hdev, "key_count %u", key_count); 7214 7215 for (i = 0; i < key_count; i++) { 7216 struct mgmt_ltk_info *key = &cp->keys[i]; 7217 7218 if (!ltk_is_valid(key)) 7219 return mgmt_cmd_status(sk, hdev->id, 7220 MGMT_OP_LOAD_LONG_TERM_KEYS, 7221 MGMT_STATUS_INVALID_PARAMS); 7222 } 7223 7224 hci_dev_lock(hdev); 7225 7226 hci_smp_ltks_clear(hdev); 7227 7228 for (i = 0; i < key_count; i++) { 7229 struct mgmt_ltk_info *key = &cp->keys[i]; 7230 u8 type, authenticated; 7231 7232 if (hci_is_blocked_key(hdev, 7233 HCI_BLOCKED_KEY_TYPE_LTK, 7234 key->val)) { 7235 bt_dev_warn(hdev, "Skipping blocked LTK for %pMR", 7236 &key->addr.bdaddr); 7237 continue; 7238 } 7239 7240 switch (key->type) { 7241 case MGMT_LTK_UNAUTHENTICATED: 7242 authenticated = 0x00; 7243 type = key->initiator ? SMP_LTK : SMP_LTK_RESPONDER; 7244 break; 7245 case MGMT_LTK_AUTHENTICATED: 7246 authenticated = 0x01; 7247 type = key->initiator ? SMP_LTK : SMP_LTK_RESPONDER; 7248 break; 7249 case MGMT_LTK_P256_UNAUTH: 7250 authenticated = 0x00; 7251 type = SMP_LTK_P256; 7252 break; 7253 case MGMT_LTK_P256_AUTH: 7254 authenticated = 0x01; 7255 type = SMP_LTK_P256; 7256 break; 7257 case MGMT_LTK_P256_DEBUG: 7258 authenticated = 0x00; 7259 type = SMP_LTK_P256_DEBUG; 7260 fallthrough; 7261 default: 7262 continue; 7263 } 7264 7265 hci_add_ltk(hdev, &key->addr.bdaddr, 7266 le_addr_type(key->addr.type), type, authenticated, 7267 key->val, key->enc_size, key->ediv, key->rand); 7268 } 7269 7270 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS, 0, 7271 NULL, 0); 7272 7273 hci_dev_unlock(hdev); 7274 7275 return err; 7276 } 7277 7278 static void get_conn_info_complete(struct hci_dev *hdev, void *data, int err) 7279 { 7280 struct mgmt_pending_cmd *cmd = data; 7281 struct hci_conn *conn = cmd->user_data; 7282 struct mgmt_cp_get_conn_info *cp = cmd->param; 7283 struct mgmt_rp_get_conn_info rp; 7284 u8 status; 7285 7286 bt_dev_dbg(hdev, "err %d", err); 7287 7288 memcpy(&rp.addr, &cp->addr.bdaddr, sizeof(rp.addr)); 7289 7290 status = mgmt_status(err); 7291 if (status == MGMT_STATUS_SUCCESS) { 7292 rp.rssi = conn->rssi; 7293 rp.tx_power = conn->tx_power; 7294 rp.max_tx_power = conn->max_tx_power; 7295 } else { 7296 rp.rssi = HCI_RSSI_INVALID; 7297 rp.tx_power = HCI_TX_POWER_INVALID; 7298 rp.max_tx_power = HCI_TX_POWER_INVALID; 7299 } 7300 7301 mgmt_cmd_complete(cmd->sk, cmd->index, MGMT_OP_GET_CONN_INFO, status, 7302 &rp, sizeof(rp)); 7303 7304 mgmt_pending_free(cmd); 7305 } 7306 7307 static int get_conn_info_sync(struct hci_dev *hdev, void *data) 7308 { 7309 struct mgmt_pending_cmd *cmd = data; 7310 struct mgmt_cp_get_conn_info *cp = cmd->param; 7311 struct hci_conn *conn; 7312 int err; 7313 __le16 handle; 7314 7315 /* Make sure we are still connected */ 7316 if (cp->addr.type == BDADDR_BREDR) 7317 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, 7318 &cp->addr.bdaddr); 7319 else 7320 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &cp->addr.bdaddr); 7321 7322 if (!conn || conn->state != BT_CONNECTED) 7323 return MGMT_STATUS_NOT_CONNECTED; 7324 7325 cmd->user_data = conn; 7326 handle = cpu_to_le16(conn->handle); 7327 7328 /* Refresh RSSI each time */ 7329 err = hci_read_rssi_sync(hdev, handle); 7330 7331 /* For LE links TX power does not change thus we don't need to 7332 * query for it once value is known. 7333 */ 7334 if (!err && (!bdaddr_type_is_le(cp->addr.type) || 7335 conn->tx_power == HCI_TX_POWER_INVALID)) 7336 err = hci_read_tx_power_sync(hdev, handle, 0x00); 7337 7338 /* Max TX power needs to be read only once per connection */ 7339 if (!err && conn->max_tx_power == HCI_TX_POWER_INVALID) 7340 err = hci_read_tx_power_sync(hdev, handle, 0x01); 7341 7342 return err; 7343 } 7344 7345 static int get_conn_info(struct sock *sk, struct hci_dev *hdev, void *data, 7346 u16 len) 7347 { 7348 struct mgmt_cp_get_conn_info *cp = data; 7349 struct mgmt_rp_get_conn_info rp; 7350 struct hci_conn *conn; 7351 unsigned long conn_info_age; 7352 int err = 0; 7353 7354 bt_dev_dbg(hdev, "sock %p", sk); 7355 7356 memset(&rp, 0, sizeof(rp)); 7357 bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr); 7358 rp.addr.type = cp->addr.type; 7359 7360 if (!bdaddr_type_is_valid(cp->addr.type)) 7361 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO, 7362 MGMT_STATUS_INVALID_PARAMS, 7363 &rp, sizeof(rp)); 7364 7365 hci_dev_lock(hdev); 7366 7367 if (!hdev_is_powered(hdev)) { 7368 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO, 7369 MGMT_STATUS_NOT_POWERED, &rp, 7370 sizeof(rp)); 7371 goto unlock; 7372 } 7373 7374 if (cp->addr.type == BDADDR_BREDR) 7375 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, 7376 &cp->addr.bdaddr); 7377 else 7378 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &cp->addr.bdaddr); 7379 7380 if (!conn || conn->state != BT_CONNECTED) { 7381 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO, 7382 MGMT_STATUS_NOT_CONNECTED, &rp, 7383 sizeof(rp)); 7384 goto unlock; 7385 } 7386 7387 /* To avoid client trying to guess when to poll again for information we 7388 * calculate conn info age as random value between min/max set in hdev. 7389 */ 7390 conn_info_age = get_random_u32_inclusive(hdev->conn_info_min_age, 7391 hdev->conn_info_max_age - 1); 7392 7393 /* Query controller to refresh cached values if they are too old or were 7394 * never read. 7395 */ 7396 if (time_after(jiffies, conn->conn_info_timestamp + 7397 msecs_to_jiffies(conn_info_age)) || 7398 !conn->conn_info_timestamp) { 7399 struct mgmt_pending_cmd *cmd; 7400 7401 cmd = mgmt_pending_new(sk, MGMT_OP_GET_CONN_INFO, hdev, data, 7402 len); 7403 if (!cmd) { 7404 err = -ENOMEM; 7405 } else { 7406 err = hci_cmd_sync_queue(hdev, get_conn_info_sync, 7407 cmd, get_conn_info_complete); 7408 } 7409 7410 if (err < 0) { 7411 mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO, 7412 MGMT_STATUS_FAILED, &rp, sizeof(rp)); 7413 7414 if (cmd) 7415 mgmt_pending_free(cmd); 7416 7417 goto unlock; 7418 } 7419 7420 conn->conn_info_timestamp = jiffies; 7421 } else { 7422 /* Cache is valid, just reply with values cached in hci_conn */ 7423 rp.rssi = conn->rssi; 7424 rp.tx_power = conn->tx_power; 7425 rp.max_tx_power = conn->max_tx_power; 7426 7427 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO, 7428 MGMT_STATUS_SUCCESS, &rp, sizeof(rp)); 7429 } 7430 7431 unlock: 7432 hci_dev_unlock(hdev); 7433 return err; 7434 } 7435 7436 static void get_clock_info_complete(struct hci_dev *hdev, void *data, int err) 7437 { 7438 struct mgmt_pending_cmd *cmd = data; 7439 struct mgmt_cp_get_clock_info *cp = cmd->param; 7440 struct mgmt_rp_get_clock_info rp; 7441 struct hci_conn *conn = cmd->user_data; 7442 u8 status = mgmt_status(err); 7443 7444 bt_dev_dbg(hdev, "err %d", err); 7445 7446 memset(&rp, 0, sizeof(rp)); 7447 bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr); 7448 rp.addr.type = cp->addr.type; 7449 7450 if (err) 7451 goto complete; 7452 7453 rp.local_clock = cpu_to_le32(hdev->clock); 7454 7455 if (conn) { 7456 rp.piconet_clock = cpu_to_le32(conn->clock); 7457 rp.accuracy = cpu_to_le16(conn->clock_accuracy); 7458 } 7459 7460 complete: 7461 mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, status, &rp, 7462 sizeof(rp)); 7463 7464 mgmt_pending_free(cmd); 7465 } 7466 7467 static int get_clock_info_sync(struct hci_dev *hdev, void *data) 7468 { 7469 struct mgmt_pending_cmd *cmd = data; 7470 struct mgmt_cp_get_clock_info *cp = cmd->param; 7471 struct hci_cp_read_clock hci_cp; 7472 struct hci_conn *conn; 7473 7474 memset(&hci_cp, 0, sizeof(hci_cp)); 7475 hci_read_clock_sync(hdev, &hci_cp); 7476 7477 /* Make sure connection still exists */ 7478 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->addr.bdaddr); 7479 if (!conn || conn->state != BT_CONNECTED) 7480 return MGMT_STATUS_NOT_CONNECTED; 7481 7482 cmd->user_data = conn; 7483 hci_cp.handle = cpu_to_le16(conn->handle); 7484 hci_cp.which = 0x01; /* Piconet clock */ 7485 7486 return hci_read_clock_sync(hdev, &hci_cp); 7487 } 7488 7489 static int get_clock_info(struct sock *sk, struct hci_dev *hdev, void *data, 7490 u16 len) 7491 { 7492 struct mgmt_cp_get_clock_info *cp = data; 7493 struct mgmt_rp_get_clock_info rp; 7494 struct mgmt_pending_cmd *cmd; 7495 struct hci_conn *conn; 7496 int err; 7497 7498 bt_dev_dbg(hdev, "sock %p", sk); 7499 7500 memset(&rp, 0, sizeof(rp)); 7501 bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr); 7502 rp.addr.type = cp->addr.type; 7503 7504 if (cp->addr.type != BDADDR_BREDR) 7505 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CLOCK_INFO, 7506 MGMT_STATUS_INVALID_PARAMS, 7507 &rp, sizeof(rp)); 7508 7509 hci_dev_lock(hdev); 7510 7511 if (!hdev_is_powered(hdev)) { 7512 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CLOCK_INFO, 7513 MGMT_STATUS_NOT_POWERED, &rp, 7514 sizeof(rp)); 7515 goto unlock; 7516 } 7517 7518 if (bacmp(&cp->addr.bdaddr, BDADDR_ANY)) { 7519 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, 7520 &cp->addr.bdaddr); 7521 if (!conn || conn->state != BT_CONNECTED) { 7522 err = mgmt_cmd_complete(sk, hdev->id, 7523 MGMT_OP_GET_CLOCK_INFO, 7524 MGMT_STATUS_NOT_CONNECTED, 7525 &rp, sizeof(rp)); 7526 goto unlock; 7527 } 7528 } else { 7529 conn = NULL; 7530 } 7531 7532 cmd = mgmt_pending_new(sk, MGMT_OP_GET_CLOCK_INFO, hdev, data, len); 7533 if (!cmd) 7534 err = -ENOMEM; 7535 else 7536 err = hci_cmd_sync_queue(hdev, get_clock_info_sync, cmd, 7537 get_clock_info_complete); 7538 7539 if (err < 0) { 7540 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CLOCK_INFO, 7541 MGMT_STATUS_FAILED, &rp, sizeof(rp)); 7542 7543 if (cmd) 7544 mgmt_pending_free(cmd); 7545 } 7546 7547 7548 unlock: 7549 hci_dev_unlock(hdev); 7550 return err; 7551 } 7552 7553 static bool is_connected(struct hci_dev *hdev, bdaddr_t *addr, u8 type) 7554 { 7555 struct hci_conn *conn; 7556 7557 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, addr); 7558 if (!conn) 7559 return false; 7560 7561 if (conn->dst_type != type) 7562 return false; 7563 7564 if (conn->state != BT_CONNECTED) 7565 return false; 7566 7567 return true; 7568 } 7569 7570 /* This function requires the caller holds hdev->lock */ 7571 static int hci_conn_params_set(struct hci_dev *hdev, bdaddr_t *addr, 7572 u8 addr_type, u8 auto_connect) 7573 { 7574 struct hci_conn_params *params; 7575 7576 params = hci_conn_params_add(hdev, addr, addr_type); 7577 if (!params) 7578 return -EIO; 7579 7580 if (params->auto_connect == auto_connect) 7581 return 0; 7582 7583 list_del_init(¶ms->action); 7584 7585 switch (auto_connect) { 7586 case HCI_AUTO_CONN_DISABLED: 7587 case HCI_AUTO_CONN_LINK_LOSS: 7588 /* If auto connect is being disabled when we're trying to 7589 * connect to device, keep connecting. 7590 */ 7591 if (params->explicit_connect) 7592 list_add(¶ms->action, &hdev->pend_le_conns); 7593 break; 7594 case HCI_AUTO_CONN_REPORT: 7595 if (params->explicit_connect) 7596 list_add(¶ms->action, &hdev->pend_le_conns); 7597 else 7598 list_add(¶ms->action, &hdev->pend_le_reports); 7599 break; 7600 case HCI_AUTO_CONN_DIRECT: 7601 case HCI_AUTO_CONN_ALWAYS: 7602 if (!is_connected(hdev, addr, addr_type)) 7603 list_add(¶ms->action, &hdev->pend_le_conns); 7604 break; 7605 } 7606 7607 params->auto_connect = auto_connect; 7608 7609 bt_dev_dbg(hdev, "addr %pMR (type %u) auto_connect %u", 7610 addr, addr_type, auto_connect); 7611 7612 return 0; 7613 } 7614 7615 static void device_added(struct sock *sk, struct hci_dev *hdev, 7616 bdaddr_t *bdaddr, u8 type, u8 action) 7617 { 7618 struct mgmt_ev_device_added ev; 7619 7620 bacpy(&ev.addr.bdaddr, bdaddr); 7621 ev.addr.type = type; 7622 ev.action = action; 7623 7624 mgmt_event(MGMT_EV_DEVICE_ADDED, hdev, &ev, sizeof(ev), sk); 7625 } 7626 7627 static int add_device_sync(struct hci_dev *hdev, void *data) 7628 { 7629 return hci_update_passive_scan_sync(hdev); 7630 } 7631 7632 static int add_device(struct sock *sk, struct hci_dev *hdev, 7633 void *data, u16 len) 7634 { 7635 struct mgmt_cp_add_device *cp = data; 7636 u8 auto_conn, addr_type; 7637 struct hci_conn_params *params; 7638 int err; 7639 u32 current_flags = 0; 7640 u32 supported_flags; 7641 7642 bt_dev_dbg(hdev, "sock %p", sk); 7643 7644 if (!bdaddr_type_is_valid(cp->addr.type) || 7645 !bacmp(&cp->addr.bdaddr, BDADDR_ANY)) 7646 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE, 7647 MGMT_STATUS_INVALID_PARAMS, 7648 &cp->addr, sizeof(cp->addr)); 7649 7650 if (cp->action != 0x00 && cp->action != 0x01 && cp->action != 0x02) 7651 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE, 7652 MGMT_STATUS_INVALID_PARAMS, 7653 &cp->addr, sizeof(cp->addr)); 7654 7655 hci_dev_lock(hdev); 7656 7657 if (cp->addr.type == BDADDR_BREDR) { 7658 /* Only incoming connections action is supported for now */ 7659 if (cp->action != 0x01) { 7660 err = mgmt_cmd_complete(sk, hdev->id, 7661 MGMT_OP_ADD_DEVICE, 7662 MGMT_STATUS_INVALID_PARAMS, 7663 &cp->addr, sizeof(cp->addr)); 7664 goto unlock; 7665 } 7666 7667 err = hci_bdaddr_list_add_with_flags(&hdev->accept_list, 7668 &cp->addr.bdaddr, 7669 cp->addr.type, 0); 7670 if (err) 7671 goto unlock; 7672 7673 hci_update_scan(hdev); 7674 7675 goto added; 7676 } 7677 7678 addr_type = le_addr_type(cp->addr.type); 7679 7680 if (cp->action == 0x02) 7681 auto_conn = HCI_AUTO_CONN_ALWAYS; 7682 else if (cp->action == 0x01) 7683 auto_conn = HCI_AUTO_CONN_DIRECT; 7684 else 7685 auto_conn = HCI_AUTO_CONN_REPORT; 7686 7687 /* Kernel internally uses conn_params with resolvable private 7688 * address, but Add Device allows only identity addresses. 7689 * Make sure it is enforced before calling 7690 * hci_conn_params_lookup. 7691 */ 7692 if (!hci_is_identity_address(&cp->addr.bdaddr, addr_type)) { 7693 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE, 7694 MGMT_STATUS_INVALID_PARAMS, 7695 &cp->addr, sizeof(cp->addr)); 7696 goto unlock; 7697 } 7698 7699 /* If the connection parameters don't exist for this device, 7700 * they will be created and configured with defaults. 7701 */ 7702 if (hci_conn_params_set(hdev, &cp->addr.bdaddr, addr_type, 7703 auto_conn) < 0) { 7704 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE, 7705 MGMT_STATUS_FAILED, &cp->addr, 7706 sizeof(cp->addr)); 7707 goto unlock; 7708 } else { 7709 params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr, 7710 addr_type); 7711 if (params) 7712 current_flags = params->flags; 7713 } 7714 7715 err = hci_cmd_sync_queue(hdev, add_device_sync, NULL, NULL); 7716 if (err < 0) 7717 goto unlock; 7718 7719 added: 7720 device_added(sk, hdev, &cp->addr.bdaddr, cp->addr.type, cp->action); 7721 supported_flags = hdev->conn_flags; 7722 device_flags_changed(NULL, hdev, &cp->addr.bdaddr, cp->addr.type, 7723 supported_flags, current_flags); 7724 7725 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE, 7726 MGMT_STATUS_SUCCESS, &cp->addr, 7727 sizeof(cp->addr)); 7728 7729 unlock: 7730 hci_dev_unlock(hdev); 7731 return err; 7732 } 7733 7734 static void device_removed(struct sock *sk, struct hci_dev *hdev, 7735 bdaddr_t *bdaddr, u8 type) 7736 { 7737 struct mgmt_ev_device_removed ev; 7738 7739 bacpy(&ev.addr.bdaddr, bdaddr); 7740 ev.addr.type = type; 7741 7742 mgmt_event(MGMT_EV_DEVICE_REMOVED, hdev, &ev, sizeof(ev), sk); 7743 } 7744 7745 static int remove_device_sync(struct hci_dev *hdev, void *data) 7746 { 7747 return hci_update_passive_scan_sync(hdev); 7748 } 7749 7750 static int remove_device(struct sock *sk, struct hci_dev *hdev, 7751 void *data, u16 len) 7752 { 7753 struct mgmt_cp_remove_device *cp = data; 7754 int err; 7755 7756 bt_dev_dbg(hdev, "sock %p", sk); 7757 7758 hci_dev_lock(hdev); 7759 7760 if (bacmp(&cp->addr.bdaddr, BDADDR_ANY)) { 7761 struct hci_conn_params *params; 7762 u8 addr_type; 7763 7764 if (!bdaddr_type_is_valid(cp->addr.type)) { 7765 err = mgmt_cmd_complete(sk, hdev->id, 7766 MGMT_OP_REMOVE_DEVICE, 7767 MGMT_STATUS_INVALID_PARAMS, 7768 &cp->addr, sizeof(cp->addr)); 7769 goto unlock; 7770 } 7771 7772 if (cp->addr.type == BDADDR_BREDR) { 7773 err = hci_bdaddr_list_del(&hdev->accept_list, 7774 &cp->addr.bdaddr, 7775 cp->addr.type); 7776 if (err) { 7777 err = mgmt_cmd_complete(sk, hdev->id, 7778 MGMT_OP_REMOVE_DEVICE, 7779 MGMT_STATUS_INVALID_PARAMS, 7780 &cp->addr, 7781 sizeof(cp->addr)); 7782 goto unlock; 7783 } 7784 7785 hci_update_scan(hdev); 7786 7787 device_removed(sk, hdev, &cp->addr.bdaddr, 7788 cp->addr.type); 7789 goto complete; 7790 } 7791 7792 addr_type = le_addr_type(cp->addr.type); 7793 7794 /* Kernel internally uses conn_params with resolvable private 7795 * address, but Remove Device allows only identity addresses. 7796 * Make sure it is enforced before calling 7797 * hci_conn_params_lookup. 7798 */ 7799 if (!hci_is_identity_address(&cp->addr.bdaddr, addr_type)) { 7800 err = mgmt_cmd_complete(sk, hdev->id, 7801 MGMT_OP_REMOVE_DEVICE, 7802 MGMT_STATUS_INVALID_PARAMS, 7803 &cp->addr, sizeof(cp->addr)); 7804 goto unlock; 7805 } 7806 7807 params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr, 7808 addr_type); 7809 if (!params) { 7810 err = mgmt_cmd_complete(sk, hdev->id, 7811 MGMT_OP_REMOVE_DEVICE, 7812 MGMT_STATUS_INVALID_PARAMS, 7813 &cp->addr, sizeof(cp->addr)); 7814 goto unlock; 7815 } 7816 7817 if (params->auto_connect == HCI_AUTO_CONN_DISABLED || 7818 params->auto_connect == HCI_AUTO_CONN_EXPLICIT) { 7819 err = mgmt_cmd_complete(sk, hdev->id, 7820 MGMT_OP_REMOVE_DEVICE, 7821 MGMT_STATUS_INVALID_PARAMS, 7822 &cp->addr, sizeof(cp->addr)); 7823 goto unlock; 7824 } 7825 7826 list_del(¶ms->action); 7827 list_del(¶ms->list); 7828 kfree(params); 7829 7830 device_removed(sk, hdev, &cp->addr.bdaddr, cp->addr.type); 7831 } else { 7832 struct hci_conn_params *p, *tmp; 7833 struct bdaddr_list *b, *btmp; 7834 7835 if (cp->addr.type) { 7836 err = mgmt_cmd_complete(sk, hdev->id, 7837 MGMT_OP_REMOVE_DEVICE, 7838 MGMT_STATUS_INVALID_PARAMS, 7839 &cp->addr, sizeof(cp->addr)); 7840 goto unlock; 7841 } 7842 7843 list_for_each_entry_safe(b, btmp, &hdev->accept_list, list) { 7844 device_removed(sk, hdev, &b->bdaddr, b->bdaddr_type); 7845 list_del(&b->list); 7846 kfree(b); 7847 } 7848 7849 hci_update_scan(hdev); 7850 7851 list_for_each_entry_safe(p, tmp, &hdev->le_conn_params, list) { 7852 if (p->auto_connect == HCI_AUTO_CONN_DISABLED) 7853 continue; 7854 device_removed(sk, hdev, &p->addr, p->addr_type); 7855 if (p->explicit_connect) { 7856 p->auto_connect = HCI_AUTO_CONN_EXPLICIT; 7857 continue; 7858 } 7859 list_del(&p->action); 7860 list_del(&p->list); 7861 kfree(p); 7862 } 7863 7864 bt_dev_dbg(hdev, "All LE connection parameters were removed"); 7865 } 7866 7867 hci_cmd_sync_queue(hdev, remove_device_sync, NULL, NULL); 7868 7869 complete: 7870 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_DEVICE, 7871 MGMT_STATUS_SUCCESS, &cp->addr, 7872 sizeof(cp->addr)); 7873 unlock: 7874 hci_dev_unlock(hdev); 7875 return err; 7876 } 7877 7878 static int load_conn_param(struct sock *sk, struct hci_dev *hdev, void *data, 7879 u16 len) 7880 { 7881 struct mgmt_cp_load_conn_param *cp = data; 7882 const u16 max_param_count = ((U16_MAX - sizeof(*cp)) / 7883 sizeof(struct mgmt_conn_param)); 7884 u16 param_count, expected_len; 7885 int i; 7886 7887 if (!lmp_le_capable(hdev)) 7888 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM, 7889 MGMT_STATUS_NOT_SUPPORTED); 7890 7891 param_count = __le16_to_cpu(cp->param_count); 7892 if (param_count > max_param_count) { 7893 bt_dev_err(hdev, "load_conn_param: too big param_count value %u", 7894 param_count); 7895 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM, 7896 MGMT_STATUS_INVALID_PARAMS); 7897 } 7898 7899 expected_len = struct_size(cp, params, param_count); 7900 if (expected_len != len) { 7901 bt_dev_err(hdev, "load_conn_param: expected %u bytes, got %u bytes", 7902 expected_len, len); 7903 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM, 7904 MGMT_STATUS_INVALID_PARAMS); 7905 } 7906 7907 bt_dev_dbg(hdev, "param_count %u", param_count); 7908 7909 hci_dev_lock(hdev); 7910 7911 hci_conn_params_clear_disabled(hdev); 7912 7913 for (i = 0; i < param_count; i++) { 7914 struct mgmt_conn_param *param = &cp->params[i]; 7915 struct hci_conn_params *hci_param; 7916 u16 min, max, latency, timeout; 7917 u8 addr_type; 7918 7919 bt_dev_dbg(hdev, "Adding %pMR (type %u)", ¶m->addr.bdaddr, 7920 param->addr.type); 7921 7922 if (param->addr.type == BDADDR_LE_PUBLIC) { 7923 addr_type = ADDR_LE_DEV_PUBLIC; 7924 } else if (param->addr.type == BDADDR_LE_RANDOM) { 7925 addr_type = ADDR_LE_DEV_RANDOM; 7926 } else { 7927 bt_dev_err(hdev, "ignoring invalid connection parameters"); 7928 continue; 7929 } 7930 7931 min = le16_to_cpu(param->min_interval); 7932 max = le16_to_cpu(param->max_interval); 7933 latency = le16_to_cpu(param->latency); 7934 timeout = le16_to_cpu(param->timeout); 7935 7936 bt_dev_dbg(hdev, "min 0x%04x max 0x%04x latency 0x%04x timeout 0x%04x", 7937 min, max, latency, timeout); 7938 7939 if (hci_check_conn_params(min, max, latency, timeout) < 0) { 7940 bt_dev_err(hdev, "ignoring invalid connection parameters"); 7941 continue; 7942 } 7943 7944 hci_param = hci_conn_params_add(hdev, ¶m->addr.bdaddr, 7945 addr_type); 7946 if (!hci_param) { 7947 bt_dev_err(hdev, "failed to add connection parameters"); 7948 continue; 7949 } 7950 7951 hci_param->conn_min_interval = min; 7952 hci_param->conn_max_interval = max; 7953 hci_param->conn_latency = latency; 7954 hci_param->supervision_timeout = timeout; 7955 } 7956 7957 hci_dev_unlock(hdev); 7958 7959 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM, 0, 7960 NULL, 0); 7961 } 7962 7963 static int set_external_config(struct sock *sk, struct hci_dev *hdev, 7964 void *data, u16 len) 7965 { 7966 struct mgmt_cp_set_external_config *cp = data; 7967 bool changed; 7968 int err; 7969 7970 bt_dev_dbg(hdev, "sock %p", sk); 7971 7972 if (hdev_is_powered(hdev)) 7973 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_EXTERNAL_CONFIG, 7974 MGMT_STATUS_REJECTED); 7975 7976 if (cp->config != 0x00 && cp->config != 0x01) 7977 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_EXTERNAL_CONFIG, 7978 MGMT_STATUS_INVALID_PARAMS); 7979 7980 if (!test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks)) 7981 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_EXTERNAL_CONFIG, 7982 MGMT_STATUS_NOT_SUPPORTED); 7983 7984 hci_dev_lock(hdev); 7985 7986 if (cp->config) 7987 changed = !hci_dev_test_and_set_flag(hdev, HCI_EXT_CONFIGURED); 7988 else 7989 changed = hci_dev_test_and_clear_flag(hdev, HCI_EXT_CONFIGURED); 7990 7991 err = send_options_rsp(sk, MGMT_OP_SET_EXTERNAL_CONFIG, hdev); 7992 if (err < 0) 7993 goto unlock; 7994 7995 if (!changed) 7996 goto unlock; 7997 7998 err = new_options(hdev, sk); 7999 8000 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED) == is_configured(hdev)) { 8001 mgmt_index_removed(hdev); 8002 8003 if (hci_dev_test_and_change_flag(hdev, HCI_UNCONFIGURED)) { 8004 hci_dev_set_flag(hdev, HCI_CONFIG); 8005 hci_dev_set_flag(hdev, HCI_AUTO_OFF); 8006 8007 queue_work(hdev->req_workqueue, &hdev->power_on); 8008 } else { 8009 set_bit(HCI_RAW, &hdev->flags); 8010 mgmt_index_added(hdev); 8011 } 8012 } 8013 8014 unlock: 8015 hci_dev_unlock(hdev); 8016 return err; 8017 } 8018 8019 static int set_public_address(struct sock *sk, struct hci_dev *hdev, 8020 void *data, u16 len) 8021 { 8022 struct mgmt_cp_set_public_address *cp = data; 8023 bool changed; 8024 int err; 8025 8026 bt_dev_dbg(hdev, "sock %p", sk); 8027 8028 if (hdev_is_powered(hdev)) 8029 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PUBLIC_ADDRESS, 8030 MGMT_STATUS_REJECTED); 8031 8032 if (!bacmp(&cp->bdaddr, BDADDR_ANY)) 8033 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PUBLIC_ADDRESS, 8034 MGMT_STATUS_INVALID_PARAMS); 8035 8036 if (!hdev->set_bdaddr) 8037 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PUBLIC_ADDRESS, 8038 MGMT_STATUS_NOT_SUPPORTED); 8039 8040 hci_dev_lock(hdev); 8041 8042 changed = !!bacmp(&hdev->public_addr, &cp->bdaddr); 8043 bacpy(&hdev->public_addr, &cp->bdaddr); 8044 8045 err = send_options_rsp(sk, MGMT_OP_SET_PUBLIC_ADDRESS, hdev); 8046 if (err < 0) 8047 goto unlock; 8048 8049 if (!changed) 8050 goto unlock; 8051 8052 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) 8053 err = new_options(hdev, sk); 8054 8055 if (is_configured(hdev)) { 8056 mgmt_index_removed(hdev); 8057 8058 hci_dev_clear_flag(hdev, HCI_UNCONFIGURED); 8059 8060 hci_dev_set_flag(hdev, HCI_CONFIG); 8061 hci_dev_set_flag(hdev, HCI_AUTO_OFF); 8062 8063 queue_work(hdev->req_workqueue, &hdev->power_on); 8064 } 8065 8066 unlock: 8067 hci_dev_unlock(hdev); 8068 return err; 8069 } 8070 8071 static void read_local_oob_ext_data_complete(struct hci_dev *hdev, void *data, 8072 int err) 8073 { 8074 const struct mgmt_cp_read_local_oob_ext_data *mgmt_cp; 8075 struct mgmt_rp_read_local_oob_ext_data *mgmt_rp; 8076 u8 *h192, *r192, *h256, *r256; 8077 struct mgmt_pending_cmd *cmd = data; 8078 struct sk_buff *skb = cmd->skb; 8079 u8 status = mgmt_status(err); 8080 u16 eir_len; 8081 8082 if (cmd != pending_find(MGMT_OP_READ_LOCAL_OOB_EXT_DATA, hdev)) 8083 return; 8084 8085 if (!status) { 8086 if (!skb) 8087 status = MGMT_STATUS_FAILED; 8088 else if (IS_ERR(skb)) 8089 status = mgmt_status(PTR_ERR(skb)); 8090 else 8091 status = mgmt_status(skb->data[0]); 8092 } 8093 8094 bt_dev_dbg(hdev, "status %u", status); 8095 8096 mgmt_cp = cmd->param; 8097 8098 if (status) { 8099 status = mgmt_status(status); 8100 eir_len = 0; 8101 8102 h192 = NULL; 8103 r192 = NULL; 8104 h256 = NULL; 8105 r256 = NULL; 8106 } else if (!bredr_sc_enabled(hdev)) { 8107 struct hci_rp_read_local_oob_data *rp; 8108 8109 if (skb->len != sizeof(*rp)) { 8110 status = MGMT_STATUS_FAILED; 8111 eir_len = 0; 8112 } else { 8113 status = MGMT_STATUS_SUCCESS; 8114 rp = (void *)skb->data; 8115 8116 eir_len = 5 + 18 + 18; 8117 h192 = rp->hash; 8118 r192 = rp->rand; 8119 h256 = NULL; 8120 r256 = NULL; 8121 } 8122 } else { 8123 struct hci_rp_read_local_oob_ext_data *rp; 8124 8125 if (skb->len != sizeof(*rp)) { 8126 status = MGMT_STATUS_FAILED; 8127 eir_len = 0; 8128 } else { 8129 status = MGMT_STATUS_SUCCESS; 8130 rp = (void *)skb->data; 8131 8132 if (hci_dev_test_flag(hdev, HCI_SC_ONLY)) { 8133 eir_len = 5 + 18 + 18; 8134 h192 = NULL; 8135 r192 = NULL; 8136 } else { 8137 eir_len = 5 + 18 + 18 + 18 + 18; 8138 h192 = rp->hash192; 8139 r192 = rp->rand192; 8140 } 8141 8142 h256 = rp->hash256; 8143 r256 = rp->rand256; 8144 } 8145 } 8146 8147 mgmt_rp = kmalloc(sizeof(*mgmt_rp) + eir_len, GFP_KERNEL); 8148 if (!mgmt_rp) 8149 goto done; 8150 8151 if (eir_len == 0) 8152 goto send_rsp; 8153 8154 eir_len = eir_append_data(mgmt_rp->eir, 0, EIR_CLASS_OF_DEV, 8155 hdev->dev_class, 3); 8156 8157 if (h192 && r192) { 8158 eir_len = eir_append_data(mgmt_rp->eir, eir_len, 8159 EIR_SSP_HASH_C192, h192, 16); 8160 eir_len = eir_append_data(mgmt_rp->eir, eir_len, 8161 EIR_SSP_RAND_R192, r192, 16); 8162 } 8163 8164 if (h256 && r256) { 8165 eir_len = eir_append_data(mgmt_rp->eir, eir_len, 8166 EIR_SSP_HASH_C256, h256, 16); 8167 eir_len = eir_append_data(mgmt_rp->eir, eir_len, 8168 EIR_SSP_RAND_R256, r256, 16); 8169 } 8170 8171 send_rsp: 8172 mgmt_rp->type = mgmt_cp->type; 8173 mgmt_rp->eir_len = cpu_to_le16(eir_len); 8174 8175 err = mgmt_cmd_complete(cmd->sk, hdev->id, 8176 MGMT_OP_READ_LOCAL_OOB_EXT_DATA, status, 8177 mgmt_rp, sizeof(*mgmt_rp) + eir_len); 8178 if (err < 0 || status) 8179 goto done; 8180 8181 hci_sock_set_flag(cmd->sk, HCI_MGMT_OOB_DATA_EVENTS); 8182 8183 err = mgmt_limited_event(MGMT_EV_LOCAL_OOB_DATA_UPDATED, hdev, 8184 mgmt_rp, sizeof(*mgmt_rp) + eir_len, 8185 HCI_MGMT_OOB_DATA_EVENTS, cmd->sk); 8186 done: 8187 if (skb && !IS_ERR(skb)) 8188 kfree_skb(skb); 8189 8190 kfree(mgmt_rp); 8191 mgmt_pending_remove(cmd); 8192 } 8193 8194 static int read_local_ssp_oob_req(struct hci_dev *hdev, struct sock *sk, 8195 struct mgmt_cp_read_local_oob_ext_data *cp) 8196 { 8197 struct mgmt_pending_cmd *cmd; 8198 int err; 8199 8200 cmd = mgmt_pending_add(sk, MGMT_OP_READ_LOCAL_OOB_EXT_DATA, hdev, 8201 cp, sizeof(*cp)); 8202 if (!cmd) 8203 return -ENOMEM; 8204 8205 err = hci_cmd_sync_queue(hdev, read_local_oob_data_sync, cmd, 8206 read_local_oob_ext_data_complete); 8207 8208 if (err < 0) { 8209 mgmt_pending_remove(cmd); 8210 return err; 8211 } 8212 8213 return 0; 8214 } 8215 8216 static int read_local_oob_ext_data(struct sock *sk, struct hci_dev *hdev, 8217 void *data, u16 data_len) 8218 { 8219 struct mgmt_cp_read_local_oob_ext_data *cp = data; 8220 struct mgmt_rp_read_local_oob_ext_data *rp; 8221 size_t rp_len; 8222 u16 eir_len; 8223 u8 status, flags, role, addr[7], hash[16], rand[16]; 8224 int err; 8225 8226 bt_dev_dbg(hdev, "sock %p", sk); 8227 8228 if (hdev_is_powered(hdev)) { 8229 switch (cp->type) { 8230 case BIT(BDADDR_BREDR): 8231 status = mgmt_bredr_support(hdev); 8232 if (status) 8233 eir_len = 0; 8234 else 8235 eir_len = 5; 8236 break; 8237 case (BIT(BDADDR_LE_PUBLIC) | BIT(BDADDR_LE_RANDOM)): 8238 status = mgmt_le_support(hdev); 8239 if (status) 8240 eir_len = 0; 8241 else 8242 eir_len = 9 + 3 + 18 + 18 + 3; 8243 break; 8244 default: 8245 status = MGMT_STATUS_INVALID_PARAMS; 8246 eir_len = 0; 8247 break; 8248 } 8249 } else { 8250 status = MGMT_STATUS_NOT_POWERED; 8251 eir_len = 0; 8252 } 8253 8254 rp_len = sizeof(*rp) + eir_len; 8255 rp = kmalloc(rp_len, GFP_ATOMIC); 8256 if (!rp) 8257 return -ENOMEM; 8258 8259 if (!status && !lmp_ssp_capable(hdev)) { 8260 status = MGMT_STATUS_NOT_SUPPORTED; 8261 eir_len = 0; 8262 } 8263 8264 if (status) 8265 goto complete; 8266 8267 hci_dev_lock(hdev); 8268 8269 eir_len = 0; 8270 switch (cp->type) { 8271 case BIT(BDADDR_BREDR): 8272 if (hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) { 8273 err = read_local_ssp_oob_req(hdev, sk, cp); 8274 hci_dev_unlock(hdev); 8275 if (!err) 8276 goto done; 8277 8278 status = MGMT_STATUS_FAILED; 8279 goto complete; 8280 } else { 8281 eir_len = eir_append_data(rp->eir, eir_len, 8282 EIR_CLASS_OF_DEV, 8283 hdev->dev_class, 3); 8284 } 8285 break; 8286 case (BIT(BDADDR_LE_PUBLIC) | BIT(BDADDR_LE_RANDOM)): 8287 if (hci_dev_test_flag(hdev, HCI_SC_ENABLED) && 8288 smp_generate_oob(hdev, hash, rand) < 0) { 8289 hci_dev_unlock(hdev); 8290 status = MGMT_STATUS_FAILED; 8291 goto complete; 8292 } 8293 8294 /* This should return the active RPA, but since the RPA 8295 * is only programmed on demand, it is really hard to fill 8296 * this in at the moment. For now disallow retrieving 8297 * local out-of-band data when privacy is in use. 8298 * 8299 * Returning the identity address will not help here since 8300 * pairing happens before the identity resolving key is 8301 * known and thus the connection establishment happens 8302 * based on the RPA and not the identity address. 8303 */ 8304 if (hci_dev_test_flag(hdev, HCI_PRIVACY)) { 8305 hci_dev_unlock(hdev); 8306 status = MGMT_STATUS_REJECTED; 8307 goto complete; 8308 } 8309 8310 if (hci_dev_test_flag(hdev, HCI_FORCE_STATIC_ADDR) || 8311 !bacmp(&hdev->bdaddr, BDADDR_ANY) || 8312 (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) && 8313 bacmp(&hdev->static_addr, BDADDR_ANY))) { 8314 memcpy(addr, &hdev->static_addr, 6); 8315 addr[6] = 0x01; 8316 } else { 8317 memcpy(addr, &hdev->bdaddr, 6); 8318 addr[6] = 0x00; 8319 } 8320 8321 eir_len = eir_append_data(rp->eir, eir_len, EIR_LE_BDADDR, 8322 addr, sizeof(addr)); 8323 8324 if (hci_dev_test_flag(hdev, HCI_ADVERTISING)) 8325 role = 0x02; 8326 else 8327 role = 0x01; 8328 8329 eir_len = eir_append_data(rp->eir, eir_len, EIR_LE_ROLE, 8330 &role, sizeof(role)); 8331 8332 if (hci_dev_test_flag(hdev, HCI_SC_ENABLED)) { 8333 eir_len = eir_append_data(rp->eir, eir_len, 8334 EIR_LE_SC_CONFIRM, 8335 hash, sizeof(hash)); 8336 8337 eir_len = eir_append_data(rp->eir, eir_len, 8338 EIR_LE_SC_RANDOM, 8339 rand, sizeof(rand)); 8340 } 8341 8342 flags = mgmt_get_adv_discov_flags(hdev); 8343 8344 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) 8345 flags |= LE_AD_NO_BREDR; 8346 8347 eir_len = eir_append_data(rp->eir, eir_len, EIR_FLAGS, 8348 &flags, sizeof(flags)); 8349 break; 8350 } 8351 8352 hci_dev_unlock(hdev); 8353 8354 hci_sock_set_flag(sk, HCI_MGMT_OOB_DATA_EVENTS); 8355 8356 status = MGMT_STATUS_SUCCESS; 8357 8358 complete: 8359 rp->type = cp->type; 8360 rp->eir_len = cpu_to_le16(eir_len); 8361 8362 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_EXT_DATA, 8363 status, rp, sizeof(*rp) + eir_len); 8364 if (err < 0 || status) 8365 goto done; 8366 8367 err = mgmt_limited_event(MGMT_EV_LOCAL_OOB_DATA_UPDATED, hdev, 8368 rp, sizeof(*rp) + eir_len, 8369 HCI_MGMT_OOB_DATA_EVENTS, sk); 8370 8371 done: 8372 kfree(rp); 8373 8374 return err; 8375 } 8376 8377 static u32 get_supported_adv_flags(struct hci_dev *hdev) 8378 { 8379 u32 flags = 0; 8380 8381 flags |= MGMT_ADV_FLAG_CONNECTABLE; 8382 flags |= MGMT_ADV_FLAG_DISCOV; 8383 flags |= MGMT_ADV_FLAG_LIMITED_DISCOV; 8384 flags |= MGMT_ADV_FLAG_MANAGED_FLAGS; 8385 flags |= MGMT_ADV_FLAG_APPEARANCE; 8386 flags |= MGMT_ADV_FLAG_LOCAL_NAME; 8387 flags |= MGMT_ADV_PARAM_DURATION; 8388 flags |= MGMT_ADV_PARAM_TIMEOUT; 8389 flags |= MGMT_ADV_PARAM_INTERVALS; 8390 flags |= MGMT_ADV_PARAM_TX_POWER; 8391 flags |= MGMT_ADV_PARAM_SCAN_RSP; 8392 8393 /* In extended adv TX_POWER returned from Set Adv Param 8394 * will be always valid. 8395 */ 8396 if (hdev->adv_tx_power != HCI_TX_POWER_INVALID || ext_adv_capable(hdev)) 8397 flags |= MGMT_ADV_FLAG_TX_POWER; 8398 8399 if (ext_adv_capable(hdev)) { 8400 flags |= MGMT_ADV_FLAG_SEC_1M; 8401 flags |= MGMT_ADV_FLAG_HW_OFFLOAD; 8402 flags |= MGMT_ADV_FLAG_CAN_SET_TX_POWER; 8403 8404 if (le_2m_capable(hdev)) 8405 flags |= MGMT_ADV_FLAG_SEC_2M; 8406 8407 if (le_coded_capable(hdev)) 8408 flags |= MGMT_ADV_FLAG_SEC_CODED; 8409 } 8410 8411 return flags; 8412 } 8413 8414 static int read_adv_features(struct sock *sk, struct hci_dev *hdev, 8415 void *data, u16 data_len) 8416 { 8417 struct mgmt_rp_read_adv_features *rp; 8418 size_t rp_len; 8419 int err; 8420 struct adv_info *adv_instance; 8421 u32 supported_flags; 8422 u8 *instance; 8423 8424 bt_dev_dbg(hdev, "sock %p", sk); 8425 8426 if (!lmp_le_capable(hdev)) 8427 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_ADV_FEATURES, 8428 MGMT_STATUS_REJECTED); 8429 8430 hci_dev_lock(hdev); 8431 8432 rp_len = sizeof(*rp) + hdev->adv_instance_cnt; 8433 rp = kmalloc(rp_len, GFP_ATOMIC); 8434 if (!rp) { 8435 hci_dev_unlock(hdev); 8436 return -ENOMEM; 8437 } 8438 8439 supported_flags = get_supported_adv_flags(hdev); 8440 8441 rp->supported_flags = cpu_to_le32(supported_flags); 8442 rp->max_adv_data_len = HCI_MAX_AD_LENGTH; 8443 rp->max_scan_rsp_len = HCI_MAX_AD_LENGTH; 8444 rp->max_instances = hdev->le_num_of_adv_sets; 8445 rp->num_instances = hdev->adv_instance_cnt; 8446 8447 instance = rp->instance; 8448 list_for_each_entry(adv_instance, &hdev->adv_instances, list) { 8449 /* Only instances 1-le_num_of_adv_sets are externally visible */ 8450 if (adv_instance->instance <= hdev->adv_instance_cnt) { 8451 *instance = adv_instance->instance; 8452 instance++; 8453 } else { 8454 rp->num_instances--; 8455 rp_len--; 8456 } 8457 } 8458 8459 hci_dev_unlock(hdev); 8460 8461 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_ADV_FEATURES, 8462 MGMT_STATUS_SUCCESS, rp, rp_len); 8463 8464 kfree(rp); 8465 8466 return err; 8467 } 8468 8469 static u8 calculate_name_len(struct hci_dev *hdev) 8470 { 8471 u8 buf[HCI_MAX_SHORT_NAME_LENGTH + 3]; 8472 8473 return eir_append_local_name(hdev, buf, 0); 8474 } 8475 8476 static u8 tlv_data_max_len(struct hci_dev *hdev, u32 adv_flags, 8477 bool is_adv_data) 8478 { 8479 u8 max_len = HCI_MAX_AD_LENGTH; 8480 8481 if (is_adv_data) { 8482 if (adv_flags & (MGMT_ADV_FLAG_DISCOV | 8483 MGMT_ADV_FLAG_LIMITED_DISCOV | 8484 MGMT_ADV_FLAG_MANAGED_FLAGS)) 8485 max_len -= 3; 8486 8487 if (adv_flags & MGMT_ADV_FLAG_TX_POWER) 8488 max_len -= 3; 8489 } else { 8490 if (adv_flags & MGMT_ADV_FLAG_LOCAL_NAME) 8491 max_len -= calculate_name_len(hdev); 8492 8493 if (adv_flags & (MGMT_ADV_FLAG_APPEARANCE)) 8494 max_len -= 4; 8495 } 8496 8497 return max_len; 8498 } 8499 8500 static bool flags_managed(u32 adv_flags) 8501 { 8502 return adv_flags & (MGMT_ADV_FLAG_DISCOV | 8503 MGMT_ADV_FLAG_LIMITED_DISCOV | 8504 MGMT_ADV_FLAG_MANAGED_FLAGS); 8505 } 8506 8507 static bool tx_power_managed(u32 adv_flags) 8508 { 8509 return adv_flags & MGMT_ADV_FLAG_TX_POWER; 8510 } 8511 8512 static bool name_managed(u32 adv_flags) 8513 { 8514 return adv_flags & MGMT_ADV_FLAG_LOCAL_NAME; 8515 } 8516 8517 static bool appearance_managed(u32 adv_flags) 8518 { 8519 return adv_flags & MGMT_ADV_FLAG_APPEARANCE; 8520 } 8521 8522 static bool tlv_data_is_valid(struct hci_dev *hdev, u32 adv_flags, u8 *data, 8523 u8 len, bool is_adv_data) 8524 { 8525 int i, cur_len; 8526 u8 max_len; 8527 8528 max_len = tlv_data_max_len(hdev, adv_flags, is_adv_data); 8529 8530 if (len > max_len) 8531 return false; 8532 8533 /* Make sure that the data is correctly formatted. */ 8534 for (i = 0; i < len; i += (cur_len + 1)) { 8535 cur_len = data[i]; 8536 8537 if (!cur_len) 8538 continue; 8539 8540 if (data[i + 1] == EIR_FLAGS && 8541 (!is_adv_data || flags_managed(adv_flags))) 8542 return false; 8543 8544 if (data[i + 1] == EIR_TX_POWER && tx_power_managed(adv_flags)) 8545 return false; 8546 8547 if (data[i + 1] == EIR_NAME_COMPLETE && name_managed(adv_flags)) 8548 return false; 8549 8550 if (data[i + 1] == EIR_NAME_SHORT && name_managed(adv_flags)) 8551 return false; 8552 8553 if (data[i + 1] == EIR_APPEARANCE && 8554 appearance_managed(adv_flags)) 8555 return false; 8556 8557 /* If the current field length would exceed the total data 8558 * length, then it's invalid. 8559 */ 8560 if (i + cur_len >= len) 8561 return false; 8562 } 8563 8564 return true; 8565 } 8566 8567 static bool requested_adv_flags_are_valid(struct hci_dev *hdev, u32 adv_flags) 8568 { 8569 u32 supported_flags, phy_flags; 8570 8571 /* The current implementation only supports a subset of the specified 8572 * flags. Also need to check mutual exclusiveness of sec flags. 8573 */ 8574 supported_flags = get_supported_adv_flags(hdev); 8575 phy_flags = adv_flags & MGMT_ADV_FLAG_SEC_MASK; 8576 if (adv_flags & ~supported_flags || 8577 ((phy_flags && (phy_flags ^ (phy_flags & -phy_flags))))) 8578 return false; 8579 8580 return true; 8581 } 8582 8583 static bool adv_busy(struct hci_dev *hdev) 8584 { 8585 return pending_find(MGMT_OP_SET_LE, hdev); 8586 } 8587 8588 static void add_adv_complete(struct hci_dev *hdev, struct sock *sk, u8 instance, 8589 int err) 8590 { 8591 struct adv_info *adv, *n; 8592 8593 bt_dev_dbg(hdev, "err %d", err); 8594 8595 hci_dev_lock(hdev); 8596 8597 list_for_each_entry_safe(adv, n, &hdev->adv_instances, list) { 8598 u8 instance; 8599 8600 if (!adv->pending) 8601 continue; 8602 8603 if (!err) { 8604 adv->pending = false; 8605 continue; 8606 } 8607 8608 instance = adv->instance; 8609 8610 if (hdev->cur_adv_instance == instance) 8611 cancel_adv_timeout(hdev); 8612 8613 hci_remove_adv_instance(hdev, instance); 8614 mgmt_advertising_removed(sk, hdev, instance); 8615 } 8616 8617 hci_dev_unlock(hdev); 8618 } 8619 8620 static void add_advertising_complete(struct hci_dev *hdev, void *data, int err) 8621 { 8622 struct mgmt_pending_cmd *cmd = data; 8623 struct mgmt_cp_add_advertising *cp = cmd->param; 8624 struct mgmt_rp_add_advertising rp; 8625 8626 memset(&rp, 0, sizeof(rp)); 8627 8628 rp.instance = cp->instance; 8629 8630 if (err) 8631 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, 8632 mgmt_status(err)); 8633 else 8634 mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, 8635 mgmt_status(err), &rp, sizeof(rp)); 8636 8637 add_adv_complete(hdev, cmd->sk, cp->instance, err); 8638 8639 mgmt_pending_free(cmd); 8640 } 8641 8642 static int add_advertising_sync(struct hci_dev *hdev, void *data) 8643 { 8644 struct mgmt_pending_cmd *cmd = data; 8645 struct mgmt_cp_add_advertising *cp = cmd->param; 8646 8647 return hci_schedule_adv_instance_sync(hdev, cp->instance, true); 8648 } 8649 8650 static int add_advertising(struct sock *sk, struct hci_dev *hdev, 8651 void *data, u16 data_len) 8652 { 8653 struct mgmt_cp_add_advertising *cp = data; 8654 struct mgmt_rp_add_advertising rp; 8655 u32 flags; 8656 u8 status; 8657 u16 timeout, duration; 8658 unsigned int prev_instance_cnt; 8659 u8 schedule_instance = 0; 8660 struct adv_info *adv, *next_instance; 8661 int err; 8662 struct mgmt_pending_cmd *cmd; 8663 8664 bt_dev_dbg(hdev, "sock %p", sk); 8665 8666 status = mgmt_le_support(hdev); 8667 if (status) 8668 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING, 8669 status); 8670 8671 if (cp->instance < 1 || cp->instance > hdev->le_num_of_adv_sets) 8672 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING, 8673 MGMT_STATUS_INVALID_PARAMS); 8674 8675 if (data_len != sizeof(*cp) + cp->adv_data_len + cp->scan_rsp_len) 8676 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING, 8677 MGMT_STATUS_INVALID_PARAMS); 8678 8679 flags = __le32_to_cpu(cp->flags); 8680 timeout = __le16_to_cpu(cp->timeout); 8681 duration = __le16_to_cpu(cp->duration); 8682 8683 if (!requested_adv_flags_are_valid(hdev, flags)) 8684 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING, 8685 MGMT_STATUS_INVALID_PARAMS); 8686 8687 hci_dev_lock(hdev); 8688 8689 if (timeout && !hdev_is_powered(hdev)) { 8690 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING, 8691 MGMT_STATUS_REJECTED); 8692 goto unlock; 8693 } 8694 8695 if (adv_busy(hdev)) { 8696 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING, 8697 MGMT_STATUS_BUSY); 8698 goto unlock; 8699 } 8700 8701 if (!tlv_data_is_valid(hdev, flags, cp->data, cp->adv_data_len, true) || 8702 !tlv_data_is_valid(hdev, flags, cp->data + cp->adv_data_len, 8703 cp->scan_rsp_len, false)) { 8704 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING, 8705 MGMT_STATUS_INVALID_PARAMS); 8706 goto unlock; 8707 } 8708 8709 prev_instance_cnt = hdev->adv_instance_cnt; 8710 8711 adv = hci_add_adv_instance(hdev, cp->instance, flags, 8712 cp->adv_data_len, cp->data, 8713 cp->scan_rsp_len, 8714 cp->data + cp->adv_data_len, 8715 timeout, duration, 8716 HCI_ADV_TX_POWER_NO_PREFERENCE, 8717 hdev->le_adv_min_interval, 8718 hdev->le_adv_max_interval, 0); 8719 if (IS_ERR(adv)) { 8720 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING, 8721 MGMT_STATUS_FAILED); 8722 goto unlock; 8723 } 8724 8725 /* Only trigger an advertising added event if a new instance was 8726 * actually added. 8727 */ 8728 if (hdev->adv_instance_cnt > prev_instance_cnt) 8729 mgmt_advertising_added(sk, hdev, cp->instance); 8730 8731 if (hdev->cur_adv_instance == cp->instance) { 8732 /* If the currently advertised instance is being changed then 8733 * cancel the current advertising and schedule the next 8734 * instance. If there is only one instance then the overridden 8735 * advertising data will be visible right away. 8736 */ 8737 cancel_adv_timeout(hdev); 8738 8739 next_instance = hci_get_next_instance(hdev, cp->instance); 8740 if (next_instance) 8741 schedule_instance = next_instance->instance; 8742 } else if (!hdev->adv_instance_timeout) { 8743 /* Immediately advertise the new instance if no other 8744 * instance is currently being advertised. 8745 */ 8746 schedule_instance = cp->instance; 8747 } 8748 8749 /* If the HCI_ADVERTISING flag is set or the device isn't powered or 8750 * there is no instance to be advertised then we have no HCI 8751 * communication to make. Simply return. 8752 */ 8753 if (!hdev_is_powered(hdev) || 8754 hci_dev_test_flag(hdev, HCI_ADVERTISING) || 8755 !schedule_instance) { 8756 rp.instance = cp->instance; 8757 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_ADVERTISING, 8758 MGMT_STATUS_SUCCESS, &rp, sizeof(rp)); 8759 goto unlock; 8760 } 8761 8762 /* We're good to go, update advertising data, parameters, and start 8763 * advertising. 8764 */ 8765 cmd = mgmt_pending_new(sk, MGMT_OP_ADD_ADVERTISING, hdev, data, 8766 data_len); 8767 if (!cmd) { 8768 err = -ENOMEM; 8769 goto unlock; 8770 } 8771 8772 cp->instance = schedule_instance; 8773 8774 err = hci_cmd_sync_queue(hdev, add_advertising_sync, cmd, 8775 add_advertising_complete); 8776 if (err < 0) 8777 mgmt_pending_free(cmd); 8778 8779 unlock: 8780 hci_dev_unlock(hdev); 8781 8782 return err; 8783 } 8784 8785 static void add_ext_adv_params_complete(struct hci_dev *hdev, void *data, 8786 int err) 8787 { 8788 struct mgmt_pending_cmd *cmd = data; 8789 struct mgmt_cp_add_ext_adv_params *cp = cmd->param; 8790 struct mgmt_rp_add_ext_adv_params rp; 8791 struct adv_info *adv; 8792 u32 flags; 8793 8794 BT_DBG("%s", hdev->name); 8795 8796 hci_dev_lock(hdev); 8797 8798 adv = hci_find_adv_instance(hdev, cp->instance); 8799 if (!adv) 8800 goto unlock; 8801 8802 rp.instance = cp->instance; 8803 rp.tx_power = adv->tx_power; 8804 8805 /* While we're at it, inform userspace of the available space for this 8806 * advertisement, given the flags that will be used. 8807 */ 8808 flags = __le32_to_cpu(cp->flags); 8809 rp.max_adv_data_len = tlv_data_max_len(hdev, flags, true); 8810 rp.max_scan_rsp_len = tlv_data_max_len(hdev, flags, false); 8811 8812 if (err) { 8813 /* If this advertisement was previously advertising and we 8814 * failed to update it, we signal that it has been removed and 8815 * delete its structure 8816 */ 8817 if (!adv->pending) 8818 mgmt_advertising_removed(cmd->sk, hdev, cp->instance); 8819 8820 hci_remove_adv_instance(hdev, cp->instance); 8821 8822 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, 8823 mgmt_status(err)); 8824 } else { 8825 mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, 8826 mgmt_status(err), &rp, sizeof(rp)); 8827 } 8828 8829 unlock: 8830 if (cmd) 8831 mgmt_pending_free(cmd); 8832 8833 hci_dev_unlock(hdev); 8834 } 8835 8836 static int add_ext_adv_params_sync(struct hci_dev *hdev, void *data) 8837 { 8838 struct mgmt_pending_cmd *cmd = data; 8839 struct mgmt_cp_add_ext_adv_params *cp = cmd->param; 8840 8841 return hci_setup_ext_adv_instance_sync(hdev, cp->instance); 8842 } 8843 8844 static int add_ext_adv_params(struct sock *sk, struct hci_dev *hdev, 8845 void *data, u16 data_len) 8846 { 8847 struct mgmt_cp_add_ext_adv_params *cp = data; 8848 struct mgmt_rp_add_ext_adv_params rp; 8849 struct mgmt_pending_cmd *cmd = NULL; 8850 struct adv_info *adv; 8851 u32 flags, min_interval, max_interval; 8852 u16 timeout, duration; 8853 u8 status; 8854 s8 tx_power; 8855 int err; 8856 8857 BT_DBG("%s", hdev->name); 8858 8859 status = mgmt_le_support(hdev); 8860 if (status) 8861 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_PARAMS, 8862 status); 8863 8864 if (cp->instance < 1 || cp->instance > hdev->le_num_of_adv_sets) 8865 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_PARAMS, 8866 MGMT_STATUS_INVALID_PARAMS); 8867 8868 /* The purpose of breaking add_advertising into two separate MGMT calls 8869 * for params and data is to allow more parameters to be added to this 8870 * structure in the future. For this reason, we verify that we have the 8871 * bare minimum structure we know of when the interface was defined. Any 8872 * extra parameters we don't know about will be ignored in this request. 8873 */ 8874 if (data_len < MGMT_ADD_EXT_ADV_PARAMS_MIN_SIZE) 8875 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_PARAMS, 8876 MGMT_STATUS_INVALID_PARAMS); 8877 8878 flags = __le32_to_cpu(cp->flags); 8879 8880 if (!requested_adv_flags_are_valid(hdev, flags)) 8881 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_PARAMS, 8882 MGMT_STATUS_INVALID_PARAMS); 8883 8884 hci_dev_lock(hdev); 8885 8886 /* In new interface, we require that we are powered to register */ 8887 if (!hdev_is_powered(hdev)) { 8888 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_PARAMS, 8889 MGMT_STATUS_REJECTED); 8890 goto unlock; 8891 } 8892 8893 if (adv_busy(hdev)) { 8894 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_PARAMS, 8895 MGMT_STATUS_BUSY); 8896 goto unlock; 8897 } 8898 8899 /* Parse defined parameters from request, use defaults otherwise */ 8900 timeout = (flags & MGMT_ADV_PARAM_TIMEOUT) ? 8901 __le16_to_cpu(cp->timeout) : 0; 8902 8903 duration = (flags & MGMT_ADV_PARAM_DURATION) ? 8904 __le16_to_cpu(cp->duration) : 8905 hdev->def_multi_adv_rotation_duration; 8906 8907 min_interval = (flags & MGMT_ADV_PARAM_INTERVALS) ? 8908 __le32_to_cpu(cp->min_interval) : 8909 hdev->le_adv_min_interval; 8910 8911 max_interval = (flags & MGMT_ADV_PARAM_INTERVALS) ? 8912 __le32_to_cpu(cp->max_interval) : 8913 hdev->le_adv_max_interval; 8914 8915 tx_power = (flags & MGMT_ADV_PARAM_TX_POWER) ? 8916 cp->tx_power : 8917 HCI_ADV_TX_POWER_NO_PREFERENCE; 8918 8919 /* Create advertising instance with no advertising or response data */ 8920 adv = hci_add_adv_instance(hdev, cp->instance, flags, 0, NULL, 0, NULL, 8921 timeout, duration, tx_power, min_interval, 8922 max_interval, 0); 8923 8924 if (IS_ERR(adv)) { 8925 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_PARAMS, 8926 MGMT_STATUS_FAILED); 8927 goto unlock; 8928 } 8929 8930 /* Submit request for advertising params if ext adv available */ 8931 if (ext_adv_capable(hdev)) { 8932 cmd = mgmt_pending_new(sk, MGMT_OP_ADD_EXT_ADV_PARAMS, hdev, 8933 data, data_len); 8934 if (!cmd) { 8935 err = -ENOMEM; 8936 hci_remove_adv_instance(hdev, cp->instance); 8937 goto unlock; 8938 } 8939 8940 err = hci_cmd_sync_queue(hdev, add_ext_adv_params_sync, cmd, 8941 add_ext_adv_params_complete); 8942 if (err < 0) 8943 mgmt_pending_free(cmd); 8944 } else { 8945 rp.instance = cp->instance; 8946 rp.tx_power = HCI_ADV_TX_POWER_NO_PREFERENCE; 8947 rp.max_adv_data_len = tlv_data_max_len(hdev, flags, true); 8948 rp.max_scan_rsp_len = tlv_data_max_len(hdev, flags, false); 8949 err = mgmt_cmd_complete(sk, hdev->id, 8950 MGMT_OP_ADD_EXT_ADV_PARAMS, 8951 MGMT_STATUS_SUCCESS, &rp, sizeof(rp)); 8952 } 8953 8954 unlock: 8955 hci_dev_unlock(hdev); 8956 8957 return err; 8958 } 8959 8960 static void add_ext_adv_data_complete(struct hci_dev *hdev, void *data, int err) 8961 { 8962 struct mgmt_pending_cmd *cmd = data; 8963 struct mgmt_cp_add_ext_adv_data *cp = cmd->param; 8964 struct mgmt_rp_add_advertising rp; 8965 8966 add_adv_complete(hdev, cmd->sk, cp->instance, err); 8967 8968 memset(&rp, 0, sizeof(rp)); 8969 8970 rp.instance = cp->instance; 8971 8972 if (err) 8973 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, 8974 mgmt_status(err)); 8975 else 8976 mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, 8977 mgmt_status(err), &rp, sizeof(rp)); 8978 8979 mgmt_pending_free(cmd); 8980 } 8981 8982 static int add_ext_adv_data_sync(struct hci_dev *hdev, void *data) 8983 { 8984 struct mgmt_pending_cmd *cmd = data; 8985 struct mgmt_cp_add_ext_adv_data *cp = cmd->param; 8986 int err; 8987 8988 if (ext_adv_capable(hdev)) { 8989 err = hci_update_adv_data_sync(hdev, cp->instance); 8990 if (err) 8991 return err; 8992 8993 err = hci_update_scan_rsp_data_sync(hdev, cp->instance); 8994 if (err) 8995 return err; 8996 8997 return hci_enable_ext_advertising_sync(hdev, cp->instance); 8998 } 8999 9000 return hci_schedule_adv_instance_sync(hdev, cp->instance, true); 9001 } 9002 9003 static int add_ext_adv_data(struct sock *sk, struct hci_dev *hdev, void *data, 9004 u16 data_len) 9005 { 9006 struct mgmt_cp_add_ext_adv_data *cp = data; 9007 struct mgmt_rp_add_ext_adv_data rp; 9008 u8 schedule_instance = 0; 9009 struct adv_info *next_instance; 9010 struct adv_info *adv_instance; 9011 int err = 0; 9012 struct mgmt_pending_cmd *cmd; 9013 9014 BT_DBG("%s", hdev->name); 9015 9016 hci_dev_lock(hdev); 9017 9018 adv_instance = hci_find_adv_instance(hdev, cp->instance); 9019 9020 if (!adv_instance) { 9021 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_DATA, 9022 MGMT_STATUS_INVALID_PARAMS); 9023 goto unlock; 9024 } 9025 9026 /* In new interface, we require that we are powered to register */ 9027 if (!hdev_is_powered(hdev)) { 9028 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_DATA, 9029 MGMT_STATUS_REJECTED); 9030 goto clear_new_instance; 9031 } 9032 9033 if (adv_busy(hdev)) { 9034 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_DATA, 9035 MGMT_STATUS_BUSY); 9036 goto clear_new_instance; 9037 } 9038 9039 /* Validate new data */ 9040 if (!tlv_data_is_valid(hdev, adv_instance->flags, cp->data, 9041 cp->adv_data_len, true) || 9042 !tlv_data_is_valid(hdev, adv_instance->flags, cp->data + 9043 cp->adv_data_len, cp->scan_rsp_len, false)) { 9044 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_DATA, 9045 MGMT_STATUS_INVALID_PARAMS); 9046 goto clear_new_instance; 9047 } 9048 9049 /* Set the data in the advertising instance */ 9050 hci_set_adv_instance_data(hdev, cp->instance, cp->adv_data_len, 9051 cp->data, cp->scan_rsp_len, 9052 cp->data + cp->adv_data_len); 9053 9054 /* If using software rotation, determine next instance to use */ 9055 if (hdev->cur_adv_instance == cp->instance) { 9056 /* If the currently advertised instance is being changed 9057 * then cancel the current advertising and schedule the 9058 * next instance. If there is only one instance then the 9059 * overridden advertising data will be visible right 9060 * away 9061 */ 9062 cancel_adv_timeout(hdev); 9063 9064 next_instance = hci_get_next_instance(hdev, cp->instance); 9065 if (next_instance) 9066 schedule_instance = next_instance->instance; 9067 } else if (!hdev->adv_instance_timeout) { 9068 /* Immediately advertise the new instance if no other 9069 * instance is currently being advertised. 9070 */ 9071 schedule_instance = cp->instance; 9072 } 9073 9074 /* If the HCI_ADVERTISING flag is set or there is no instance to 9075 * be advertised then we have no HCI communication to make. 9076 * Simply return. 9077 */ 9078 if (hci_dev_test_flag(hdev, HCI_ADVERTISING) || !schedule_instance) { 9079 if (adv_instance->pending) { 9080 mgmt_advertising_added(sk, hdev, cp->instance); 9081 adv_instance->pending = false; 9082 } 9083 rp.instance = cp->instance; 9084 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_DATA, 9085 MGMT_STATUS_SUCCESS, &rp, sizeof(rp)); 9086 goto unlock; 9087 } 9088 9089 cmd = mgmt_pending_new(sk, MGMT_OP_ADD_EXT_ADV_DATA, hdev, data, 9090 data_len); 9091 if (!cmd) { 9092 err = -ENOMEM; 9093 goto clear_new_instance; 9094 } 9095 9096 err = hci_cmd_sync_queue(hdev, add_ext_adv_data_sync, cmd, 9097 add_ext_adv_data_complete); 9098 if (err < 0) { 9099 mgmt_pending_free(cmd); 9100 goto clear_new_instance; 9101 } 9102 9103 /* We were successful in updating data, so trigger advertising_added 9104 * event if this is an instance that wasn't previously advertising. If 9105 * a failure occurs in the requests we initiated, we will remove the 9106 * instance again in add_advertising_complete 9107 */ 9108 if (adv_instance->pending) 9109 mgmt_advertising_added(sk, hdev, cp->instance); 9110 9111 goto unlock; 9112 9113 clear_new_instance: 9114 hci_remove_adv_instance(hdev, cp->instance); 9115 9116 unlock: 9117 hci_dev_unlock(hdev); 9118 9119 return err; 9120 } 9121 9122 static void remove_advertising_complete(struct hci_dev *hdev, void *data, 9123 int err) 9124 { 9125 struct mgmt_pending_cmd *cmd = data; 9126 struct mgmt_cp_remove_advertising *cp = cmd->param; 9127 struct mgmt_rp_remove_advertising rp; 9128 9129 bt_dev_dbg(hdev, "err %d", err); 9130 9131 memset(&rp, 0, sizeof(rp)); 9132 rp.instance = cp->instance; 9133 9134 if (err) 9135 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, 9136 mgmt_status(err)); 9137 else 9138 mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, 9139 MGMT_STATUS_SUCCESS, &rp, sizeof(rp)); 9140 9141 mgmt_pending_free(cmd); 9142 } 9143 9144 static int remove_advertising_sync(struct hci_dev *hdev, void *data) 9145 { 9146 struct mgmt_pending_cmd *cmd = data; 9147 struct mgmt_cp_remove_advertising *cp = cmd->param; 9148 int err; 9149 9150 err = hci_remove_advertising_sync(hdev, cmd->sk, cp->instance, true); 9151 if (err) 9152 return err; 9153 9154 if (list_empty(&hdev->adv_instances)) 9155 err = hci_disable_advertising_sync(hdev); 9156 9157 return err; 9158 } 9159 9160 static int remove_advertising(struct sock *sk, struct hci_dev *hdev, 9161 void *data, u16 data_len) 9162 { 9163 struct mgmt_cp_remove_advertising *cp = data; 9164 struct mgmt_pending_cmd *cmd; 9165 int err; 9166 9167 bt_dev_dbg(hdev, "sock %p", sk); 9168 9169 hci_dev_lock(hdev); 9170 9171 if (cp->instance && !hci_find_adv_instance(hdev, cp->instance)) { 9172 err = mgmt_cmd_status(sk, hdev->id, 9173 MGMT_OP_REMOVE_ADVERTISING, 9174 MGMT_STATUS_INVALID_PARAMS); 9175 goto unlock; 9176 } 9177 9178 if (pending_find(MGMT_OP_SET_LE, hdev)) { 9179 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_ADVERTISING, 9180 MGMT_STATUS_BUSY); 9181 goto unlock; 9182 } 9183 9184 if (list_empty(&hdev->adv_instances)) { 9185 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_ADVERTISING, 9186 MGMT_STATUS_INVALID_PARAMS); 9187 goto unlock; 9188 } 9189 9190 cmd = mgmt_pending_new(sk, MGMT_OP_REMOVE_ADVERTISING, hdev, data, 9191 data_len); 9192 if (!cmd) { 9193 err = -ENOMEM; 9194 goto unlock; 9195 } 9196 9197 err = hci_cmd_sync_queue(hdev, remove_advertising_sync, cmd, 9198 remove_advertising_complete); 9199 if (err < 0) 9200 mgmt_pending_free(cmd); 9201 9202 unlock: 9203 hci_dev_unlock(hdev); 9204 9205 return err; 9206 } 9207 9208 static int get_adv_size_info(struct sock *sk, struct hci_dev *hdev, 9209 void *data, u16 data_len) 9210 { 9211 struct mgmt_cp_get_adv_size_info *cp = data; 9212 struct mgmt_rp_get_adv_size_info rp; 9213 u32 flags, supported_flags; 9214 9215 bt_dev_dbg(hdev, "sock %p", sk); 9216 9217 if (!lmp_le_capable(hdev)) 9218 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_ADV_SIZE_INFO, 9219 MGMT_STATUS_REJECTED); 9220 9221 if (cp->instance < 1 || cp->instance > hdev->le_num_of_adv_sets) 9222 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_ADV_SIZE_INFO, 9223 MGMT_STATUS_INVALID_PARAMS); 9224 9225 flags = __le32_to_cpu(cp->flags); 9226 9227 /* The current implementation only supports a subset of the specified 9228 * flags. 9229 */ 9230 supported_flags = get_supported_adv_flags(hdev); 9231 if (flags & ~supported_flags) 9232 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_ADV_SIZE_INFO, 9233 MGMT_STATUS_INVALID_PARAMS); 9234 9235 rp.instance = cp->instance; 9236 rp.flags = cp->flags; 9237 rp.max_adv_data_len = tlv_data_max_len(hdev, flags, true); 9238 rp.max_scan_rsp_len = tlv_data_max_len(hdev, flags, false); 9239 9240 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_ADV_SIZE_INFO, 9241 MGMT_STATUS_SUCCESS, &rp, sizeof(rp)); 9242 } 9243 9244 static const struct hci_mgmt_handler mgmt_handlers[] = { 9245 { NULL }, /* 0x0000 (no command) */ 9246 { read_version, MGMT_READ_VERSION_SIZE, 9247 HCI_MGMT_NO_HDEV | 9248 HCI_MGMT_UNTRUSTED }, 9249 { read_commands, MGMT_READ_COMMANDS_SIZE, 9250 HCI_MGMT_NO_HDEV | 9251 HCI_MGMT_UNTRUSTED }, 9252 { read_index_list, MGMT_READ_INDEX_LIST_SIZE, 9253 HCI_MGMT_NO_HDEV | 9254 HCI_MGMT_UNTRUSTED }, 9255 { read_controller_info, MGMT_READ_INFO_SIZE, 9256 HCI_MGMT_UNTRUSTED }, 9257 { set_powered, MGMT_SETTING_SIZE }, 9258 { set_discoverable, MGMT_SET_DISCOVERABLE_SIZE }, 9259 { set_connectable, MGMT_SETTING_SIZE }, 9260 { set_fast_connectable, MGMT_SETTING_SIZE }, 9261 { set_bondable, MGMT_SETTING_SIZE }, 9262 { set_link_security, MGMT_SETTING_SIZE }, 9263 { set_ssp, MGMT_SETTING_SIZE }, 9264 { set_hs, MGMT_SETTING_SIZE }, 9265 { set_le, MGMT_SETTING_SIZE }, 9266 { set_dev_class, MGMT_SET_DEV_CLASS_SIZE }, 9267 { set_local_name, MGMT_SET_LOCAL_NAME_SIZE }, 9268 { add_uuid, MGMT_ADD_UUID_SIZE }, 9269 { remove_uuid, MGMT_REMOVE_UUID_SIZE }, 9270 { load_link_keys, MGMT_LOAD_LINK_KEYS_SIZE, 9271 HCI_MGMT_VAR_LEN }, 9272 { load_long_term_keys, MGMT_LOAD_LONG_TERM_KEYS_SIZE, 9273 HCI_MGMT_VAR_LEN }, 9274 { disconnect, MGMT_DISCONNECT_SIZE }, 9275 { get_connections, MGMT_GET_CONNECTIONS_SIZE }, 9276 { pin_code_reply, MGMT_PIN_CODE_REPLY_SIZE }, 9277 { pin_code_neg_reply, MGMT_PIN_CODE_NEG_REPLY_SIZE }, 9278 { set_io_capability, MGMT_SET_IO_CAPABILITY_SIZE }, 9279 { pair_device, MGMT_PAIR_DEVICE_SIZE }, 9280 { cancel_pair_device, MGMT_CANCEL_PAIR_DEVICE_SIZE }, 9281 { unpair_device, MGMT_UNPAIR_DEVICE_SIZE }, 9282 { user_confirm_reply, MGMT_USER_CONFIRM_REPLY_SIZE }, 9283 { user_confirm_neg_reply, MGMT_USER_CONFIRM_NEG_REPLY_SIZE }, 9284 { user_passkey_reply, MGMT_USER_PASSKEY_REPLY_SIZE }, 9285 { user_passkey_neg_reply, MGMT_USER_PASSKEY_NEG_REPLY_SIZE }, 9286 { read_local_oob_data, MGMT_READ_LOCAL_OOB_DATA_SIZE }, 9287 { add_remote_oob_data, MGMT_ADD_REMOTE_OOB_DATA_SIZE, 9288 HCI_MGMT_VAR_LEN }, 9289 { remove_remote_oob_data, MGMT_REMOVE_REMOTE_OOB_DATA_SIZE }, 9290 { start_discovery, MGMT_START_DISCOVERY_SIZE }, 9291 { stop_discovery, MGMT_STOP_DISCOVERY_SIZE }, 9292 { confirm_name, MGMT_CONFIRM_NAME_SIZE }, 9293 { block_device, MGMT_BLOCK_DEVICE_SIZE }, 9294 { unblock_device, MGMT_UNBLOCK_DEVICE_SIZE }, 9295 { set_device_id, MGMT_SET_DEVICE_ID_SIZE }, 9296 { set_advertising, MGMT_SETTING_SIZE }, 9297 { set_bredr, MGMT_SETTING_SIZE }, 9298 { set_static_address, MGMT_SET_STATIC_ADDRESS_SIZE }, 9299 { set_scan_params, MGMT_SET_SCAN_PARAMS_SIZE }, 9300 { set_secure_conn, MGMT_SETTING_SIZE }, 9301 { set_debug_keys, MGMT_SETTING_SIZE }, 9302 { set_privacy, MGMT_SET_PRIVACY_SIZE }, 9303 { load_irks, MGMT_LOAD_IRKS_SIZE, 9304 HCI_MGMT_VAR_LEN }, 9305 { get_conn_info, MGMT_GET_CONN_INFO_SIZE }, 9306 { get_clock_info, MGMT_GET_CLOCK_INFO_SIZE }, 9307 { add_device, MGMT_ADD_DEVICE_SIZE }, 9308 { remove_device, MGMT_REMOVE_DEVICE_SIZE }, 9309 { load_conn_param, MGMT_LOAD_CONN_PARAM_SIZE, 9310 HCI_MGMT_VAR_LEN }, 9311 { read_unconf_index_list, MGMT_READ_UNCONF_INDEX_LIST_SIZE, 9312 HCI_MGMT_NO_HDEV | 9313 HCI_MGMT_UNTRUSTED }, 9314 { read_config_info, MGMT_READ_CONFIG_INFO_SIZE, 9315 HCI_MGMT_UNCONFIGURED | 9316 HCI_MGMT_UNTRUSTED }, 9317 { set_external_config, MGMT_SET_EXTERNAL_CONFIG_SIZE, 9318 HCI_MGMT_UNCONFIGURED }, 9319 { set_public_address, MGMT_SET_PUBLIC_ADDRESS_SIZE, 9320 HCI_MGMT_UNCONFIGURED }, 9321 { start_service_discovery, MGMT_START_SERVICE_DISCOVERY_SIZE, 9322 HCI_MGMT_VAR_LEN }, 9323 { read_local_oob_ext_data, MGMT_READ_LOCAL_OOB_EXT_DATA_SIZE }, 9324 { read_ext_index_list, MGMT_READ_EXT_INDEX_LIST_SIZE, 9325 HCI_MGMT_NO_HDEV | 9326 HCI_MGMT_UNTRUSTED }, 9327 { read_adv_features, MGMT_READ_ADV_FEATURES_SIZE }, 9328 { add_advertising, MGMT_ADD_ADVERTISING_SIZE, 9329 HCI_MGMT_VAR_LEN }, 9330 { remove_advertising, MGMT_REMOVE_ADVERTISING_SIZE }, 9331 { get_adv_size_info, MGMT_GET_ADV_SIZE_INFO_SIZE }, 9332 { start_limited_discovery, MGMT_START_DISCOVERY_SIZE }, 9333 { read_ext_controller_info,MGMT_READ_EXT_INFO_SIZE, 9334 HCI_MGMT_UNTRUSTED }, 9335 { set_appearance, MGMT_SET_APPEARANCE_SIZE }, 9336 { get_phy_configuration, MGMT_GET_PHY_CONFIGURATION_SIZE }, 9337 { set_phy_configuration, MGMT_SET_PHY_CONFIGURATION_SIZE }, 9338 { set_blocked_keys, MGMT_OP_SET_BLOCKED_KEYS_SIZE, 9339 HCI_MGMT_VAR_LEN }, 9340 { set_wideband_speech, MGMT_SETTING_SIZE }, 9341 { read_controller_cap, MGMT_READ_CONTROLLER_CAP_SIZE, 9342 HCI_MGMT_UNTRUSTED }, 9343 { read_exp_features_info, MGMT_READ_EXP_FEATURES_INFO_SIZE, 9344 HCI_MGMT_UNTRUSTED | 9345 HCI_MGMT_HDEV_OPTIONAL }, 9346 { set_exp_feature, MGMT_SET_EXP_FEATURE_SIZE, 9347 HCI_MGMT_VAR_LEN | 9348 HCI_MGMT_HDEV_OPTIONAL }, 9349 { read_def_system_config, MGMT_READ_DEF_SYSTEM_CONFIG_SIZE, 9350 HCI_MGMT_UNTRUSTED }, 9351 { set_def_system_config, MGMT_SET_DEF_SYSTEM_CONFIG_SIZE, 9352 HCI_MGMT_VAR_LEN }, 9353 { read_def_runtime_config, MGMT_READ_DEF_RUNTIME_CONFIG_SIZE, 9354 HCI_MGMT_UNTRUSTED }, 9355 { set_def_runtime_config, MGMT_SET_DEF_RUNTIME_CONFIG_SIZE, 9356 HCI_MGMT_VAR_LEN }, 9357 { get_device_flags, MGMT_GET_DEVICE_FLAGS_SIZE }, 9358 { set_device_flags, MGMT_SET_DEVICE_FLAGS_SIZE }, 9359 { read_adv_mon_features, MGMT_READ_ADV_MONITOR_FEATURES_SIZE }, 9360 { add_adv_patterns_monitor,MGMT_ADD_ADV_PATTERNS_MONITOR_SIZE, 9361 HCI_MGMT_VAR_LEN }, 9362 { remove_adv_monitor, MGMT_REMOVE_ADV_MONITOR_SIZE }, 9363 { add_ext_adv_params, MGMT_ADD_EXT_ADV_PARAMS_MIN_SIZE, 9364 HCI_MGMT_VAR_LEN }, 9365 { add_ext_adv_data, MGMT_ADD_EXT_ADV_DATA_SIZE, 9366 HCI_MGMT_VAR_LEN }, 9367 { add_adv_patterns_monitor_rssi, 9368 MGMT_ADD_ADV_PATTERNS_MONITOR_RSSI_SIZE, 9369 HCI_MGMT_VAR_LEN }, 9370 { set_mesh, MGMT_SET_MESH_RECEIVER_SIZE, 9371 HCI_MGMT_VAR_LEN }, 9372 { mesh_features, MGMT_MESH_READ_FEATURES_SIZE }, 9373 { mesh_send, MGMT_MESH_SEND_SIZE, 9374 HCI_MGMT_VAR_LEN }, 9375 { mesh_send_cancel, MGMT_MESH_SEND_CANCEL_SIZE }, 9376 }; 9377 9378 void mgmt_index_added(struct hci_dev *hdev) 9379 { 9380 struct mgmt_ev_ext_index ev; 9381 9382 if (test_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks)) 9383 return; 9384 9385 switch (hdev->dev_type) { 9386 case HCI_PRIMARY: 9387 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) { 9388 mgmt_index_event(MGMT_EV_UNCONF_INDEX_ADDED, hdev, 9389 NULL, 0, HCI_MGMT_UNCONF_INDEX_EVENTS); 9390 ev.type = 0x01; 9391 } else { 9392 mgmt_index_event(MGMT_EV_INDEX_ADDED, hdev, NULL, 0, 9393 HCI_MGMT_INDEX_EVENTS); 9394 ev.type = 0x00; 9395 } 9396 break; 9397 case HCI_AMP: 9398 ev.type = 0x02; 9399 break; 9400 default: 9401 return; 9402 } 9403 9404 ev.bus = hdev->bus; 9405 9406 mgmt_index_event(MGMT_EV_EXT_INDEX_ADDED, hdev, &ev, sizeof(ev), 9407 HCI_MGMT_EXT_INDEX_EVENTS); 9408 } 9409 9410 void mgmt_index_removed(struct hci_dev *hdev) 9411 { 9412 struct mgmt_ev_ext_index ev; 9413 u8 status = MGMT_STATUS_INVALID_INDEX; 9414 9415 if (test_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks)) 9416 return; 9417 9418 switch (hdev->dev_type) { 9419 case HCI_PRIMARY: 9420 mgmt_pending_foreach(0, hdev, cmd_complete_rsp, &status); 9421 9422 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) { 9423 mgmt_index_event(MGMT_EV_UNCONF_INDEX_REMOVED, hdev, 9424 NULL, 0, HCI_MGMT_UNCONF_INDEX_EVENTS); 9425 ev.type = 0x01; 9426 } else { 9427 mgmt_index_event(MGMT_EV_INDEX_REMOVED, hdev, NULL, 0, 9428 HCI_MGMT_INDEX_EVENTS); 9429 ev.type = 0x00; 9430 } 9431 break; 9432 case HCI_AMP: 9433 ev.type = 0x02; 9434 break; 9435 default: 9436 return; 9437 } 9438 9439 ev.bus = hdev->bus; 9440 9441 mgmt_index_event(MGMT_EV_EXT_INDEX_REMOVED, hdev, &ev, sizeof(ev), 9442 HCI_MGMT_EXT_INDEX_EVENTS); 9443 9444 /* Cancel any remaining timed work */ 9445 if (!hci_dev_test_flag(hdev, HCI_MGMT)) 9446 return; 9447 cancel_delayed_work_sync(&hdev->discov_off); 9448 cancel_delayed_work_sync(&hdev->service_cache); 9449 cancel_delayed_work_sync(&hdev->rpa_expired); 9450 } 9451 9452 void mgmt_power_on(struct hci_dev *hdev, int err) 9453 { 9454 struct cmd_lookup match = { NULL, hdev }; 9455 9456 bt_dev_dbg(hdev, "err %d", err); 9457 9458 hci_dev_lock(hdev); 9459 9460 if (!err) { 9461 restart_le_actions(hdev); 9462 hci_update_passive_scan(hdev); 9463 } 9464 9465 mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp, &match); 9466 9467 new_settings(hdev, match.sk); 9468 9469 if (match.sk) 9470 sock_put(match.sk); 9471 9472 hci_dev_unlock(hdev); 9473 } 9474 9475 void __mgmt_power_off(struct hci_dev *hdev) 9476 { 9477 struct cmd_lookup match = { NULL, hdev }; 9478 u8 status, zero_cod[] = { 0, 0, 0 }; 9479 9480 mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp, &match); 9481 9482 /* If the power off is because of hdev unregistration let 9483 * use the appropriate INVALID_INDEX status. Otherwise use 9484 * NOT_POWERED. We cover both scenarios here since later in 9485 * mgmt_index_removed() any hci_conn callbacks will have already 9486 * been triggered, potentially causing misleading DISCONNECTED 9487 * status responses. 9488 */ 9489 if (hci_dev_test_flag(hdev, HCI_UNREGISTER)) 9490 status = MGMT_STATUS_INVALID_INDEX; 9491 else 9492 status = MGMT_STATUS_NOT_POWERED; 9493 9494 mgmt_pending_foreach(0, hdev, cmd_complete_rsp, &status); 9495 9496 if (memcmp(hdev->dev_class, zero_cod, sizeof(zero_cod)) != 0) { 9497 mgmt_limited_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev, 9498 zero_cod, sizeof(zero_cod), 9499 HCI_MGMT_DEV_CLASS_EVENTS, NULL); 9500 ext_info_changed(hdev, NULL); 9501 } 9502 9503 new_settings(hdev, match.sk); 9504 9505 if (match.sk) 9506 sock_put(match.sk); 9507 } 9508 9509 void mgmt_set_powered_failed(struct hci_dev *hdev, int err) 9510 { 9511 struct mgmt_pending_cmd *cmd; 9512 u8 status; 9513 9514 cmd = pending_find(MGMT_OP_SET_POWERED, hdev); 9515 if (!cmd) 9516 return; 9517 9518 if (err == -ERFKILL) 9519 status = MGMT_STATUS_RFKILLED; 9520 else 9521 status = MGMT_STATUS_FAILED; 9522 9523 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_POWERED, status); 9524 9525 mgmt_pending_remove(cmd); 9526 } 9527 9528 void mgmt_new_link_key(struct hci_dev *hdev, struct link_key *key, 9529 bool persistent) 9530 { 9531 struct mgmt_ev_new_link_key ev; 9532 9533 memset(&ev, 0, sizeof(ev)); 9534 9535 ev.store_hint = persistent; 9536 bacpy(&ev.key.addr.bdaddr, &key->bdaddr); 9537 ev.key.addr.type = BDADDR_BREDR; 9538 ev.key.type = key->type; 9539 memcpy(ev.key.val, key->val, HCI_LINK_KEY_SIZE); 9540 ev.key.pin_len = key->pin_len; 9541 9542 mgmt_event(MGMT_EV_NEW_LINK_KEY, hdev, &ev, sizeof(ev), NULL); 9543 } 9544 9545 static u8 mgmt_ltk_type(struct smp_ltk *ltk) 9546 { 9547 switch (ltk->type) { 9548 case SMP_LTK: 9549 case SMP_LTK_RESPONDER: 9550 if (ltk->authenticated) 9551 return MGMT_LTK_AUTHENTICATED; 9552 return MGMT_LTK_UNAUTHENTICATED; 9553 case SMP_LTK_P256: 9554 if (ltk->authenticated) 9555 return MGMT_LTK_P256_AUTH; 9556 return MGMT_LTK_P256_UNAUTH; 9557 case SMP_LTK_P256_DEBUG: 9558 return MGMT_LTK_P256_DEBUG; 9559 } 9560 9561 return MGMT_LTK_UNAUTHENTICATED; 9562 } 9563 9564 void mgmt_new_ltk(struct hci_dev *hdev, struct smp_ltk *key, bool persistent) 9565 { 9566 struct mgmt_ev_new_long_term_key ev; 9567 9568 memset(&ev, 0, sizeof(ev)); 9569 9570 /* Devices using resolvable or non-resolvable random addresses 9571 * without providing an identity resolving key don't require 9572 * to store long term keys. Their addresses will change the 9573 * next time around. 9574 * 9575 * Only when a remote device provides an identity address 9576 * make sure the long term key is stored. If the remote 9577 * identity is known, the long term keys are internally 9578 * mapped to the identity address. So allow static random 9579 * and public addresses here. 9580 */ 9581 if (key->bdaddr_type == ADDR_LE_DEV_RANDOM && 9582 (key->bdaddr.b[5] & 0xc0) != 0xc0) 9583 ev.store_hint = 0x00; 9584 else 9585 ev.store_hint = persistent; 9586 9587 bacpy(&ev.key.addr.bdaddr, &key->bdaddr); 9588 ev.key.addr.type = link_to_bdaddr(LE_LINK, key->bdaddr_type); 9589 ev.key.type = mgmt_ltk_type(key); 9590 ev.key.enc_size = key->enc_size; 9591 ev.key.ediv = key->ediv; 9592 ev.key.rand = key->rand; 9593 9594 if (key->type == SMP_LTK) 9595 ev.key.initiator = 1; 9596 9597 /* Make sure we copy only the significant bytes based on the 9598 * encryption key size, and set the rest of the value to zeroes. 9599 */ 9600 memcpy(ev.key.val, key->val, key->enc_size); 9601 memset(ev.key.val + key->enc_size, 0, 9602 sizeof(ev.key.val) - key->enc_size); 9603 9604 mgmt_event(MGMT_EV_NEW_LONG_TERM_KEY, hdev, &ev, sizeof(ev), NULL); 9605 } 9606 9607 void mgmt_new_irk(struct hci_dev *hdev, struct smp_irk *irk, bool persistent) 9608 { 9609 struct mgmt_ev_new_irk ev; 9610 9611 memset(&ev, 0, sizeof(ev)); 9612 9613 ev.store_hint = persistent; 9614 9615 bacpy(&ev.rpa, &irk->rpa); 9616 bacpy(&ev.irk.addr.bdaddr, &irk->bdaddr); 9617 ev.irk.addr.type = link_to_bdaddr(LE_LINK, irk->addr_type); 9618 memcpy(ev.irk.val, irk->val, sizeof(irk->val)); 9619 9620 mgmt_event(MGMT_EV_NEW_IRK, hdev, &ev, sizeof(ev), NULL); 9621 } 9622 9623 void mgmt_new_csrk(struct hci_dev *hdev, struct smp_csrk *csrk, 9624 bool persistent) 9625 { 9626 struct mgmt_ev_new_csrk ev; 9627 9628 memset(&ev, 0, sizeof(ev)); 9629 9630 /* Devices using resolvable or non-resolvable random addresses 9631 * without providing an identity resolving key don't require 9632 * to store signature resolving keys. Their addresses will change 9633 * the next time around. 9634 * 9635 * Only when a remote device provides an identity address 9636 * make sure the signature resolving key is stored. So allow 9637 * static random and public addresses here. 9638 */ 9639 if (csrk->bdaddr_type == ADDR_LE_DEV_RANDOM && 9640 (csrk->bdaddr.b[5] & 0xc0) != 0xc0) 9641 ev.store_hint = 0x00; 9642 else 9643 ev.store_hint = persistent; 9644 9645 bacpy(&ev.key.addr.bdaddr, &csrk->bdaddr); 9646 ev.key.addr.type = link_to_bdaddr(LE_LINK, csrk->bdaddr_type); 9647 ev.key.type = csrk->type; 9648 memcpy(ev.key.val, csrk->val, sizeof(csrk->val)); 9649 9650 mgmt_event(MGMT_EV_NEW_CSRK, hdev, &ev, sizeof(ev), NULL); 9651 } 9652 9653 void mgmt_new_conn_param(struct hci_dev *hdev, bdaddr_t *bdaddr, 9654 u8 bdaddr_type, u8 store_hint, u16 min_interval, 9655 u16 max_interval, u16 latency, u16 timeout) 9656 { 9657 struct mgmt_ev_new_conn_param ev; 9658 9659 if (!hci_is_identity_address(bdaddr, bdaddr_type)) 9660 return; 9661 9662 memset(&ev, 0, sizeof(ev)); 9663 bacpy(&ev.addr.bdaddr, bdaddr); 9664 ev.addr.type = link_to_bdaddr(LE_LINK, bdaddr_type); 9665 ev.store_hint = store_hint; 9666 ev.min_interval = cpu_to_le16(min_interval); 9667 ev.max_interval = cpu_to_le16(max_interval); 9668 ev.latency = cpu_to_le16(latency); 9669 ev.timeout = cpu_to_le16(timeout); 9670 9671 mgmt_event(MGMT_EV_NEW_CONN_PARAM, hdev, &ev, sizeof(ev), NULL); 9672 } 9673 9674 void mgmt_device_connected(struct hci_dev *hdev, struct hci_conn *conn, 9675 u8 *name, u8 name_len) 9676 { 9677 struct sk_buff *skb; 9678 struct mgmt_ev_device_connected *ev; 9679 u16 eir_len = 0; 9680 u32 flags = 0; 9681 9682 /* allocate buff for LE or BR/EDR adv */ 9683 if (conn->le_adv_data_len > 0) 9684 skb = mgmt_alloc_skb(hdev, MGMT_EV_DEVICE_CONNECTED, 9685 sizeof(*ev) + conn->le_adv_data_len); 9686 else 9687 skb = mgmt_alloc_skb(hdev, MGMT_EV_DEVICE_CONNECTED, 9688 sizeof(*ev) + (name ? eir_precalc_len(name_len) : 0) + 9689 eir_precalc_len(sizeof(conn->dev_class))); 9690 9691 ev = skb_put(skb, sizeof(*ev)); 9692 bacpy(&ev->addr.bdaddr, &conn->dst); 9693 ev->addr.type = link_to_bdaddr(conn->type, conn->dst_type); 9694 9695 if (conn->out) 9696 flags |= MGMT_DEV_FOUND_INITIATED_CONN; 9697 9698 ev->flags = __cpu_to_le32(flags); 9699 9700 /* We must ensure that the EIR Data fields are ordered and 9701 * unique. Keep it simple for now and avoid the problem by not 9702 * adding any BR/EDR data to the LE adv. 9703 */ 9704 if (conn->le_adv_data_len > 0) { 9705 skb_put_data(skb, conn->le_adv_data, conn->le_adv_data_len); 9706 eir_len = conn->le_adv_data_len; 9707 } else { 9708 if (name) 9709 eir_len += eir_skb_put_data(skb, EIR_NAME_COMPLETE, name, name_len); 9710 9711 if (memcmp(conn->dev_class, "\0\0\0", sizeof(conn->dev_class))) 9712 eir_len += eir_skb_put_data(skb, EIR_CLASS_OF_DEV, 9713 conn->dev_class, sizeof(conn->dev_class)); 9714 } 9715 9716 ev->eir_len = cpu_to_le16(eir_len); 9717 9718 mgmt_event_skb(skb, NULL); 9719 } 9720 9721 static void disconnect_rsp(struct mgmt_pending_cmd *cmd, void *data) 9722 { 9723 struct sock **sk = data; 9724 9725 cmd->cmd_complete(cmd, 0); 9726 9727 *sk = cmd->sk; 9728 sock_hold(*sk); 9729 9730 mgmt_pending_remove(cmd); 9731 } 9732 9733 static void unpair_device_rsp(struct mgmt_pending_cmd *cmd, void *data) 9734 { 9735 struct hci_dev *hdev = data; 9736 struct mgmt_cp_unpair_device *cp = cmd->param; 9737 9738 device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, cmd->sk); 9739 9740 cmd->cmd_complete(cmd, 0); 9741 mgmt_pending_remove(cmd); 9742 } 9743 9744 bool mgmt_powering_down(struct hci_dev *hdev) 9745 { 9746 struct mgmt_pending_cmd *cmd; 9747 struct mgmt_mode *cp; 9748 9749 cmd = pending_find(MGMT_OP_SET_POWERED, hdev); 9750 if (!cmd) 9751 return false; 9752 9753 cp = cmd->param; 9754 if (!cp->val) 9755 return true; 9756 9757 return false; 9758 } 9759 9760 void mgmt_device_disconnected(struct hci_dev *hdev, bdaddr_t *bdaddr, 9761 u8 link_type, u8 addr_type, u8 reason, 9762 bool mgmt_connected) 9763 { 9764 struct mgmt_ev_device_disconnected ev; 9765 struct sock *sk = NULL; 9766 9767 /* The connection is still in hci_conn_hash so test for 1 9768 * instead of 0 to know if this is the last one. 9769 */ 9770 if (mgmt_powering_down(hdev) && hci_conn_count(hdev) == 1) { 9771 cancel_delayed_work(&hdev->power_off); 9772 queue_work(hdev->req_workqueue, &hdev->power_off.work); 9773 } 9774 9775 if (!mgmt_connected) 9776 return; 9777 9778 if (link_type != ACL_LINK && link_type != LE_LINK) 9779 return; 9780 9781 mgmt_pending_foreach(MGMT_OP_DISCONNECT, hdev, disconnect_rsp, &sk); 9782 9783 bacpy(&ev.addr.bdaddr, bdaddr); 9784 ev.addr.type = link_to_bdaddr(link_type, addr_type); 9785 ev.reason = reason; 9786 9787 /* Report disconnects due to suspend */ 9788 if (hdev->suspended) 9789 ev.reason = MGMT_DEV_DISCONN_LOCAL_HOST_SUSPEND; 9790 9791 mgmt_event(MGMT_EV_DEVICE_DISCONNECTED, hdev, &ev, sizeof(ev), sk); 9792 9793 if (sk) 9794 sock_put(sk); 9795 9796 mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, unpair_device_rsp, 9797 hdev); 9798 } 9799 9800 void mgmt_disconnect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr, 9801 u8 link_type, u8 addr_type, u8 status) 9802 { 9803 u8 bdaddr_type = link_to_bdaddr(link_type, addr_type); 9804 struct mgmt_cp_disconnect *cp; 9805 struct mgmt_pending_cmd *cmd; 9806 9807 mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, unpair_device_rsp, 9808 hdev); 9809 9810 cmd = pending_find(MGMT_OP_DISCONNECT, hdev); 9811 if (!cmd) 9812 return; 9813 9814 cp = cmd->param; 9815 9816 if (bacmp(bdaddr, &cp->addr.bdaddr)) 9817 return; 9818 9819 if (cp->addr.type != bdaddr_type) 9820 return; 9821 9822 cmd->cmd_complete(cmd, mgmt_status(status)); 9823 mgmt_pending_remove(cmd); 9824 } 9825 9826 void mgmt_connect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type, 9827 u8 addr_type, u8 status) 9828 { 9829 struct mgmt_ev_connect_failed ev; 9830 9831 /* The connection is still in hci_conn_hash so test for 1 9832 * instead of 0 to know if this is the last one. 9833 */ 9834 if (mgmt_powering_down(hdev) && hci_conn_count(hdev) == 1) { 9835 cancel_delayed_work(&hdev->power_off); 9836 queue_work(hdev->req_workqueue, &hdev->power_off.work); 9837 } 9838 9839 bacpy(&ev.addr.bdaddr, bdaddr); 9840 ev.addr.type = link_to_bdaddr(link_type, addr_type); 9841 ev.status = mgmt_status(status); 9842 9843 mgmt_event(MGMT_EV_CONNECT_FAILED, hdev, &ev, sizeof(ev), NULL); 9844 } 9845 9846 void mgmt_pin_code_request(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 secure) 9847 { 9848 struct mgmt_ev_pin_code_request ev; 9849 9850 bacpy(&ev.addr.bdaddr, bdaddr); 9851 ev.addr.type = BDADDR_BREDR; 9852 ev.secure = secure; 9853 9854 mgmt_event(MGMT_EV_PIN_CODE_REQUEST, hdev, &ev, sizeof(ev), NULL); 9855 } 9856 9857 void mgmt_pin_code_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr, 9858 u8 status) 9859 { 9860 struct mgmt_pending_cmd *cmd; 9861 9862 cmd = pending_find(MGMT_OP_PIN_CODE_REPLY, hdev); 9863 if (!cmd) 9864 return; 9865 9866 cmd->cmd_complete(cmd, mgmt_status(status)); 9867 mgmt_pending_remove(cmd); 9868 } 9869 9870 void mgmt_pin_code_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr, 9871 u8 status) 9872 { 9873 struct mgmt_pending_cmd *cmd; 9874 9875 cmd = pending_find(MGMT_OP_PIN_CODE_NEG_REPLY, hdev); 9876 if (!cmd) 9877 return; 9878 9879 cmd->cmd_complete(cmd, mgmt_status(status)); 9880 mgmt_pending_remove(cmd); 9881 } 9882 9883 int mgmt_user_confirm_request(struct hci_dev *hdev, bdaddr_t *bdaddr, 9884 u8 link_type, u8 addr_type, u32 value, 9885 u8 confirm_hint) 9886 { 9887 struct mgmt_ev_user_confirm_request ev; 9888 9889 bt_dev_dbg(hdev, "bdaddr %pMR", bdaddr); 9890 9891 bacpy(&ev.addr.bdaddr, bdaddr); 9892 ev.addr.type = link_to_bdaddr(link_type, addr_type); 9893 ev.confirm_hint = confirm_hint; 9894 ev.value = cpu_to_le32(value); 9895 9896 return mgmt_event(MGMT_EV_USER_CONFIRM_REQUEST, hdev, &ev, sizeof(ev), 9897 NULL); 9898 } 9899 9900 int mgmt_user_passkey_request(struct hci_dev *hdev, bdaddr_t *bdaddr, 9901 u8 link_type, u8 addr_type) 9902 { 9903 struct mgmt_ev_user_passkey_request ev; 9904 9905 bt_dev_dbg(hdev, "bdaddr %pMR", bdaddr); 9906 9907 bacpy(&ev.addr.bdaddr, bdaddr); 9908 ev.addr.type = link_to_bdaddr(link_type, addr_type); 9909 9910 return mgmt_event(MGMT_EV_USER_PASSKEY_REQUEST, hdev, &ev, sizeof(ev), 9911 NULL); 9912 } 9913 9914 static int user_pairing_resp_complete(struct hci_dev *hdev, bdaddr_t *bdaddr, 9915 u8 link_type, u8 addr_type, u8 status, 9916 u8 opcode) 9917 { 9918 struct mgmt_pending_cmd *cmd; 9919 9920 cmd = pending_find(opcode, hdev); 9921 if (!cmd) 9922 return -ENOENT; 9923 9924 cmd->cmd_complete(cmd, mgmt_status(status)); 9925 mgmt_pending_remove(cmd); 9926 9927 return 0; 9928 } 9929 9930 int mgmt_user_confirm_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr, 9931 u8 link_type, u8 addr_type, u8 status) 9932 { 9933 return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type, 9934 status, MGMT_OP_USER_CONFIRM_REPLY); 9935 } 9936 9937 int mgmt_user_confirm_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr, 9938 u8 link_type, u8 addr_type, u8 status) 9939 { 9940 return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type, 9941 status, 9942 MGMT_OP_USER_CONFIRM_NEG_REPLY); 9943 } 9944 9945 int mgmt_user_passkey_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr, 9946 u8 link_type, u8 addr_type, u8 status) 9947 { 9948 return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type, 9949 status, MGMT_OP_USER_PASSKEY_REPLY); 9950 } 9951 9952 int mgmt_user_passkey_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr, 9953 u8 link_type, u8 addr_type, u8 status) 9954 { 9955 return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type, 9956 status, 9957 MGMT_OP_USER_PASSKEY_NEG_REPLY); 9958 } 9959 9960 int mgmt_user_passkey_notify(struct hci_dev *hdev, bdaddr_t *bdaddr, 9961 u8 link_type, u8 addr_type, u32 passkey, 9962 u8 entered) 9963 { 9964 struct mgmt_ev_passkey_notify ev; 9965 9966 bt_dev_dbg(hdev, "bdaddr %pMR", bdaddr); 9967 9968 bacpy(&ev.addr.bdaddr, bdaddr); 9969 ev.addr.type = link_to_bdaddr(link_type, addr_type); 9970 ev.passkey = __cpu_to_le32(passkey); 9971 ev.entered = entered; 9972 9973 return mgmt_event(MGMT_EV_PASSKEY_NOTIFY, hdev, &ev, sizeof(ev), NULL); 9974 } 9975 9976 void mgmt_auth_failed(struct hci_conn *conn, u8 hci_status) 9977 { 9978 struct mgmt_ev_auth_failed ev; 9979 struct mgmt_pending_cmd *cmd; 9980 u8 status = mgmt_status(hci_status); 9981 9982 bacpy(&ev.addr.bdaddr, &conn->dst); 9983 ev.addr.type = link_to_bdaddr(conn->type, conn->dst_type); 9984 ev.status = status; 9985 9986 cmd = find_pairing(conn); 9987 9988 mgmt_event(MGMT_EV_AUTH_FAILED, conn->hdev, &ev, sizeof(ev), 9989 cmd ? cmd->sk : NULL); 9990 9991 if (cmd) { 9992 cmd->cmd_complete(cmd, status); 9993 mgmt_pending_remove(cmd); 9994 } 9995 } 9996 9997 void mgmt_auth_enable_complete(struct hci_dev *hdev, u8 status) 9998 { 9999 struct cmd_lookup match = { NULL, hdev }; 10000 bool changed; 10001 10002 if (status) { 10003 u8 mgmt_err = mgmt_status(status); 10004 mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev, 10005 cmd_status_rsp, &mgmt_err); 10006 return; 10007 } 10008 10009 if (test_bit(HCI_AUTH, &hdev->flags)) 10010 changed = !hci_dev_test_and_set_flag(hdev, HCI_LINK_SECURITY); 10011 else 10012 changed = hci_dev_test_and_clear_flag(hdev, HCI_LINK_SECURITY); 10013 10014 mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev, settings_rsp, 10015 &match); 10016 10017 if (changed) 10018 new_settings(hdev, match.sk); 10019 10020 if (match.sk) 10021 sock_put(match.sk); 10022 } 10023 10024 static void sk_lookup(struct mgmt_pending_cmd *cmd, void *data) 10025 { 10026 struct cmd_lookup *match = data; 10027 10028 if (match->sk == NULL) { 10029 match->sk = cmd->sk; 10030 sock_hold(match->sk); 10031 } 10032 } 10033 10034 void mgmt_set_class_of_dev_complete(struct hci_dev *hdev, u8 *dev_class, 10035 u8 status) 10036 { 10037 struct cmd_lookup match = { NULL, hdev, mgmt_status(status) }; 10038 10039 mgmt_pending_foreach(MGMT_OP_SET_DEV_CLASS, hdev, sk_lookup, &match); 10040 mgmt_pending_foreach(MGMT_OP_ADD_UUID, hdev, sk_lookup, &match); 10041 mgmt_pending_foreach(MGMT_OP_REMOVE_UUID, hdev, sk_lookup, &match); 10042 10043 if (!status) { 10044 mgmt_limited_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev, dev_class, 10045 3, HCI_MGMT_DEV_CLASS_EVENTS, NULL); 10046 ext_info_changed(hdev, NULL); 10047 } 10048 10049 if (match.sk) 10050 sock_put(match.sk); 10051 } 10052 10053 void mgmt_set_local_name_complete(struct hci_dev *hdev, u8 *name, u8 status) 10054 { 10055 struct mgmt_cp_set_local_name ev; 10056 struct mgmt_pending_cmd *cmd; 10057 10058 if (status) 10059 return; 10060 10061 memset(&ev, 0, sizeof(ev)); 10062 memcpy(ev.name, name, HCI_MAX_NAME_LENGTH); 10063 memcpy(ev.short_name, hdev->short_name, HCI_MAX_SHORT_NAME_LENGTH); 10064 10065 cmd = pending_find(MGMT_OP_SET_LOCAL_NAME, hdev); 10066 if (!cmd) { 10067 memcpy(hdev->dev_name, name, sizeof(hdev->dev_name)); 10068 10069 /* If this is a HCI command related to powering on the 10070 * HCI dev don't send any mgmt signals. 10071 */ 10072 if (pending_find(MGMT_OP_SET_POWERED, hdev)) 10073 return; 10074 } 10075 10076 mgmt_limited_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, &ev, sizeof(ev), 10077 HCI_MGMT_LOCAL_NAME_EVENTS, cmd ? cmd->sk : NULL); 10078 ext_info_changed(hdev, cmd ? cmd->sk : NULL); 10079 } 10080 10081 static inline bool has_uuid(u8 *uuid, u16 uuid_count, u8 (*uuids)[16]) 10082 { 10083 int i; 10084 10085 for (i = 0; i < uuid_count; i++) { 10086 if (!memcmp(uuid, uuids[i], 16)) 10087 return true; 10088 } 10089 10090 return false; 10091 } 10092 10093 static bool eir_has_uuids(u8 *eir, u16 eir_len, u16 uuid_count, u8 (*uuids)[16]) 10094 { 10095 u16 parsed = 0; 10096 10097 while (parsed < eir_len) { 10098 u8 field_len = eir[0]; 10099 u8 uuid[16]; 10100 int i; 10101 10102 if (field_len == 0) 10103 break; 10104 10105 if (eir_len - parsed < field_len + 1) 10106 break; 10107 10108 switch (eir[1]) { 10109 case EIR_UUID16_ALL: 10110 case EIR_UUID16_SOME: 10111 for (i = 0; i + 3 <= field_len; i += 2) { 10112 memcpy(uuid, bluetooth_base_uuid, 16); 10113 uuid[13] = eir[i + 3]; 10114 uuid[12] = eir[i + 2]; 10115 if (has_uuid(uuid, uuid_count, uuids)) 10116 return true; 10117 } 10118 break; 10119 case EIR_UUID32_ALL: 10120 case EIR_UUID32_SOME: 10121 for (i = 0; i + 5 <= field_len; i += 4) { 10122 memcpy(uuid, bluetooth_base_uuid, 16); 10123 uuid[15] = eir[i + 5]; 10124 uuid[14] = eir[i + 4]; 10125 uuid[13] = eir[i + 3]; 10126 uuid[12] = eir[i + 2]; 10127 if (has_uuid(uuid, uuid_count, uuids)) 10128 return true; 10129 } 10130 break; 10131 case EIR_UUID128_ALL: 10132 case EIR_UUID128_SOME: 10133 for (i = 0; i + 17 <= field_len; i += 16) { 10134 memcpy(uuid, eir + i + 2, 16); 10135 if (has_uuid(uuid, uuid_count, uuids)) 10136 return true; 10137 } 10138 break; 10139 } 10140 10141 parsed += field_len + 1; 10142 eir += field_len + 1; 10143 } 10144 10145 return false; 10146 } 10147 10148 static void restart_le_scan(struct hci_dev *hdev) 10149 { 10150 /* If controller is not scanning we are done. */ 10151 if (!hci_dev_test_flag(hdev, HCI_LE_SCAN)) 10152 return; 10153 10154 if (time_after(jiffies + DISCOV_LE_RESTART_DELAY, 10155 hdev->discovery.scan_start + 10156 hdev->discovery.scan_duration)) 10157 return; 10158 10159 queue_delayed_work(hdev->req_workqueue, &hdev->le_scan_restart, 10160 DISCOV_LE_RESTART_DELAY); 10161 } 10162 10163 static bool is_filter_match(struct hci_dev *hdev, s8 rssi, u8 *eir, 10164 u16 eir_len, u8 *scan_rsp, u8 scan_rsp_len) 10165 { 10166 /* If a RSSI threshold has been specified, and 10167 * HCI_QUIRK_STRICT_DUPLICATE_FILTER is not set, then all results with 10168 * a RSSI smaller than the RSSI threshold will be dropped. If the quirk 10169 * is set, let it through for further processing, as we might need to 10170 * restart the scan. 10171 * 10172 * For BR/EDR devices (pre 1.2) providing no RSSI during inquiry, 10173 * the results are also dropped. 10174 */ 10175 if (hdev->discovery.rssi != HCI_RSSI_INVALID && 10176 (rssi == HCI_RSSI_INVALID || 10177 (rssi < hdev->discovery.rssi && 10178 !test_bit(HCI_QUIRK_STRICT_DUPLICATE_FILTER, &hdev->quirks)))) 10179 return false; 10180 10181 if (hdev->discovery.uuid_count != 0) { 10182 /* If a list of UUIDs is provided in filter, results with no 10183 * matching UUID should be dropped. 10184 */ 10185 if (!eir_has_uuids(eir, eir_len, hdev->discovery.uuid_count, 10186 hdev->discovery.uuids) && 10187 !eir_has_uuids(scan_rsp, scan_rsp_len, 10188 hdev->discovery.uuid_count, 10189 hdev->discovery.uuids)) 10190 return false; 10191 } 10192 10193 /* If duplicate filtering does not report RSSI changes, then restart 10194 * scanning to ensure updated result with updated RSSI values. 10195 */ 10196 if (test_bit(HCI_QUIRK_STRICT_DUPLICATE_FILTER, &hdev->quirks)) { 10197 restart_le_scan(hdev); 10198 10199 /* Validate RSSI value against the RSSI threshold once more. */ 10200 if (hdev->discovery.rssi != HCI_RSSI_INVALID && 10201 rssi < hdev->discovery.rssi) 10202 return false; 10203 } 10204 10205 return true; 10206 } 10207 10208 void mgmt_adv_monitor_device_lost(struct hci_dev *hdev, u16 handle, 10209 bdaddr_t *bdaddr, u8 addr_type) 10210 { 10211 struct mgmt_ev_adv_monitor_device_lost ev; 10212 10213 ev.monitor_handle = cpu_to_le16(handle); 10214 bacpy(&ev.addr.bdaddr, bdaddr); 10215 ev.addr.type = addr_type; 10216 10217 mgmt_event(MGMT_EV_ADV_MONITOR_DEVICE_LOST, hdev, &ev, sizeof(ev), 10218 NULL); 10219 } 10220 10221 static void mgmt_send_adv_monitor_device_found(struct hci_dev *hdev, 10222 struct sk_buff *skb, 10223 struct sock *skip_sk, 10224 u16 handle) 10225 { 10226 struct sk_buff *advmon_skb; 10227 size_t advmon_skb_len; 10228 __le16 *monitor_handle; 10229 10230 if (!skb) 10231 return; 10232 10233 advmon_skb_len = (sizeof(struct mgmt_ev_adv_monitor_device_found) - 10234 sizeof(struct mgmt_ev_device_found)) + skb->len; 10235 advmon_skb = mgmt_alloc_skb(hdev, MGMT_EV_ADV_MONITOR_DEVICE_FOUND, 10236 advmon_skb_len); 10237 if (!advmon_skb) 10238 return; 10239 10240 /* ADV_MONITOR_DEVICE_FOUND is similar to DEVICE_FOUND event except 10241 * that it also has 'monitor_handle'. Make a copy of DEVICE_FOUND and 10242 * store monitor_handle of the matched monitor. 10243 */ 10244 monitor_handle = skb_put(advmon_skb, sizeof(*monitor_handle)); 10245 *monitor_handle = cpu_to_le16(handle); 10246 skb_put_data(advmon_skb, skb->data, skb->len); 10247 10248 mgmt_event_skb(advmon_skb, skip_sk); 10249 } 10250 10251 static void mgmt_adv_monitor_device_found(struct hci_dev *hdev, 10252 bdaddr_t *bdaddr, bool report_device, 10253 struct sk_buff *skb, 10254 struct sock *skip_sk) 10255 { 10256 struct monitored_device *dev, *tmp; 10257 bool matched = false; 10258 bool notified = false; 10259 10260 /* We have received the Advertisement Report because: 10261 * 1. the kernel has initiated active discovery 10262 * 2. if not, we have pend_le_reports > 0 in which case we are doing 10263 * passive scanning 10264 * 3. if none of the above is true, we have one or more active 10265 * Advertisement Monitor 10266 * 10267 * For case 1 and 2, report all advertisements via MGMT_EV_DEVICE_FOUND 10268 * and report ONLY one advertisement per device for the matched Monitor 10269 * via MGMT_EV_ADV_MONITOR_DEVICE_FOUND event. 10270 * 10271 * For case 3, since we are not active scanning and all advertisements 10272 * received are due to a matched Advertisement Monitor, report all 10273 * advertisements ONLY via MGMT_EV_ADV_MONITOR_DEVICE_FOUND event. 10274 */ 10275 if (report_device && !hdev->advmon_pend_notify) { 10276 mgmt_event_skb(skb, skip_sk); 10277 return; 10278 } 10279 10280 hdev->advmon_pend_notify = false; 10281 10282 list_for_each_entry_safe(dev, tmp, &hdev->monitored_devices, list) { 10283 if (!bacmp(&dev->bdaddr, bdaddr)) { 10284 matched = true; 10285 10286 if (!dev->notified) { 10287 mgmt_send_adv_monitor_device_found(hdev, skb, 10288 skip_sk, 10289 dev->handle); 10290 notified = true; 10291 dev->notified = true; 10292 } 10293 } 10294 10295 if (!dev->notified) 10296 hdev->advmon_pend_notify = true; 10297 } 10298 10299 if (!report_device && 10300 ((matched && !notified) || !msft_monitor_supported(hdev))) { 10301 /* Handle 0 indicates that we are not active scanning and this 10302 * is a subsequent advertisement report for an already matched 10303 * Advertisement Monitor or the controller offloading support 10304 * is not available. 10305 */ 10306 mgmt_send_adv_monitor_device_found(hdev, skb, skip_sk, 0); 10307 } 10308 10309 if (report_device) 10310 mgmt_event_skb(skb, skip_sk); 10311 else 10312 kfree_skb(skb); 10313 } 10314 10315 static void mesh_device_found(struct hci_dev *hdev, bdaddr_t *bdaddr, 10316 u8 addr_type, s8 rssi, u32 flags, u8 *eir, 10317 u16 eir_len, u8 *scan_rsp, u8 scan_rsp_len, 10318 u64 instant) 10319 { 10320 struct sk_buff *skb; 10321 struct mgmt_ev_mesh_device_found *ev; 10322 int i, j; 10323 10324 if (!hdev->mesh_ad_types[0]) 10325 goto accepted; 10326 10327 /* Scan for requested AD types */ 10328 if (eir_len > 0) { 10329 for (i = 0; i + 1 < eir_len; i += eir[i] + 1) { 10330 for (j = 0; j < sizeof(hdev->mesh_ad_types); j++) { 10331 if (!hdev->mesh_ad_types[j]) 10332 break; 10333 10334 if (hdev->mesh_ad_types[j] == eir[i + 1]) 10335 goto accepted; 10336 } 10337 } 10338 } 10339 10340 if (scan_rsp_len > 0) { 10341 for (i = 0; i + 1 < scan_rsp_len; i += scan_rsp[i] + 1) { 10342 for (j = 0; j < sizeof(hdev->mesh_ad_types); j++) { 10343 if (!hdev->mesh_ad_types[j]) 10344 break; 10345 10346 if (hdev->mesh_ad_types[j] == scan_rsp[i + 1]) 10347 goto accepted; 10348 } 10349 } 10350 } 10351 10352 return; 10353 10354 accepted: 10355 skb = mgmt_alloc_skb(hdev, MGMT_EV_MESH_DEVICE_FOUND, 10356 sizeof(*ev) + eir_len + scan_rsp_len); 10357 if (!skb) 10358 return; 10359 10360 ev = skb_put(skb, sizeof(*ev)); 10361 10362 bacpy(&ev->addr.bdaddr, bdaddr); 10363 ev->addr.type = link_to_bdaddr(LE_LINK, addr_type); 10364 ev->rssi = rssi; 10365 ev->flags = cpu_to_le32(flags); 10366 ev->instant = cpu_to_le64(instant); 10367 10368 if (eir_len > 0) 10369 /* Copy EIR or advertising data into event */ 10370 skb_put_data(skb, eir, eir_len); 10371 10372 if (scan_rsp_len > 0) 10373 /* Append scan response data to event */ 10374 skb_put_data(skb, scan_rsp, scan_rsp_len); 10375 10376 ev->eir_len = cpu_to_le16(eir_len + scan_rsp_len); 10377 10378 mgmt_event_skb(skb, NULL); 10379 } 10380 10381 void mgmt_device_found(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type, 10382 u8 addr_type, u8 *dev_class, s8 rssi, u32 flags, 10383 u8 *eir, u16 eir_len, u8 *scan_rsp, u8 scan_rsp_len, 10384 u64 instant) 10385 { 10386 struct sk_buff *skb; 10387 struct mgmt_ev_device_found *ev; 10388 bool report_device = hci_discovery_active(hdev); 10389 10390 if (hci_dev_test_flag(hdev, HCI_MESH) && link_type == LE_LINK) 10391 mesh_device_found(hdev, bdaddr, addr_type, rssi, flags, 10392 eir, eir_len, scan_rsp, scan_rsp_len, 10393 instant); 10394 10395 /* Don't send events for a non-kernel initiated discovery. With 10396 * LE one exception is if we have pend_le_reports > 0 in which 10397 * case we're doing passive scanning and want these events. 10398 */ 10399 if (!hci_discovery_active(hdev)) { 10400 if (link_type == ACL_LINK) 10401 return; 10402 if (link_type == LE_LINK && !list_empty(&hdev->pend_le_reports)) 10403 report_device = true; 10404 else if (!hci_is_adv_monitoring(hdev)) 10405 return; 10406 } 10407 10408 if (hdev->discovery.result_filtering) { 10409 /* We are using service discovery */ 10410 if (!is_filter_match(hdev, rssi, eir, eir_len, scan_rsp, 10411 scan_rsp_len)) 10412 return; 10413 } 10414 10415 if (hdev->discovery.limited) { 10416 /* Check for limited discoverable bit */ 10417 if (dev_class) { 10418 if (!(dev_class[1] & 0x20)) 10419 return; 10420 } else { 10421 u8 *flags = eir_get_data(eir, eir_len, EIR_FLAGS, NULL); 10422 if (!flags || !(flags[0] & LE_AD_LIMITED)) 10423 return; 10424 } 10425 } 10426 10427 /* Allocate skb. The 5 extra bytes are for the potential CoD field */ 10428 skb = mgmt_alloc_skb(hdev, MGMT_EV_DEVICE_FOUND, 10429 sizeof(*ev) + eir_len + scan_rsp_len + 5); 10430 if (!skb) 10431 return; 10432 10433 ev = skb_put(skb, sizeof(*ev)); 10434 10435 /* In case of device discovery with BR/EDR devices (pre 1.2), the 10436 * RSSI value was reported as 0 when not available. This behavior 10437 * is kept when using device discovery. This is required for full 10438 * backwards compatibility with the API. 10439 * 10440 * However when using service discovery, the value 127 will be 10441 * returned when the RSSI is not available. 10442 */ 10443 if (rssi == HCI_RSSI_INVALID && !hdev->discovery.report_invalid_rssi && 10444 link_type == ACL_LINK) 10445 rssi = 0; 10446 10447 bacpy(&ev->addr.bdaddr, bdaddr); 10448 ev->addr.type = link_to_bdaddr(link_type, addr_type); 10449 ev->rssi = rssi; 10450 ev->flags = cpu_to_le32(flags); 10451 10452 if (eir_len > 0) 10453 /* Copy EIR or advertising data into event */ 10454 skb_put_data(skb, eir, eir_len); 10455 10456 if (dev_class && !eir_get_data(eir, eir_len, EIR_CLASS_OF_DEV, NULL)) { 10457 u8 eir_cod[5]; 10458 10459 eir_len += eir_append_data(eir_cod, 0, EIR_CLASS_OF_DEV, 10460 dev_class, 3); 10461 skb_put_data(skb, eir_cod, sizeof(eir_cod)); 10462 } 10463 10464 if (scan_rsp_len > 0) 10465 /* Append scan response data to event */ 10466 skb_put_data(skb, scan_rsp, scan_rsp_len); 10467 10468 ev->eir_len = cpu_to_le16(eir_len + scan_rsp_len); 10469 10470 mgmt_adv_monitor_device_found(hdev, bdaddr, report_device, skb, NULL); 10471 } 10472 10473 void mgmt_remote_name(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type, 10474 u8 addr_type, s8 rssi, u8 *name, u8 name_len) 10475 { 10476 struct sk_buff *skb; 10477 struct mgmt_ev_device_found *ev; 10478 u16 eir_len = 0; 10479 u32 flags = 0; 10480 10481 skb = mgmt_alloc_skb(hdev, MGMT_EV_DEVICE_FOUND, 10482 sizeof(*ev) + (name ? eir_precalc_len(name_len) : 0)); 10483 10484 ev = skb_put(skb, sizeof(*ev)); 10485 bacpy(&ev->addr.bdaddr, bdaddr); 10486 ev->addr.type = link_to_bdaddr(link_type, addr_type); 10487 ev->rssi = rssi; 10488 10489 if (name) 10490 eir_len += eir_skb_put_data(skb, EIR_NAME_COMPLETE, name, name_len); 10491 else 10492 flags = MGMT_DEV_FOUND_NAME_REQUEST_FAILED; 10493 10494 ev->eir_len = cpu_to_le16(eir_len); 10495 ev->flags = cpu_to_le32(flags); 10496 10497 mgmt_event_skb(skb, NULL); 10498 } 10499 10500 void mgmt_discovering(struct hci_dev *hdev, u8 discovering) 10501 { 10502 struct mgmt_ev_discovering ev; 10503 10504 bt_dev_dbg(hdev, "discovering %u", discovering); 10505 10506 memset(&ev, 0, sizeof(ev)); 10507 ev.type = hdev->discovery.type; 10508 ev.discovering = discovering; 10509 10510 mgmt_event(MGMT_EV_DISCOVERING, hdev, &ev, sizeof(ev), NULL); 10511 } 10512 10513 void mgmt_suspending(struct hci_dev *hdev, u8 state) 10514 { 10515 struct mgmt_ev_controller_suspend ev; 10516 10517 ev.suspend_state = state; 10518 mgmt_event(MGMT_EV_CONTROLLER_SUSPEND, hdev, &ev, sizeof(ev), NULL); 10519 } 10520 10521 void mgmt_resuming(struct hci_dev *hdev, u8 reason, bdaddr_t *bdaddr, 10522 u8 addr_type) 10523 { 10524 struct mgmt_ev_controller_resume ev; 10525 10526 ev.wake_reason = reason; 10527 if (bdaddr) { 10528 bacpy(&ev.addr.bdaddr, bdaddr); 10529 ev.addr.type = addr_type; 10530 } else { 10531 memset(&ev.addr, 0, sizeof(ev.addr)); 10532 } 10533 10534 mgmt_event(MGMT_EV_CONTROLLER_RESUME, hdev, &ev, sizeof(ev), NULL); 10535 } 10536 10537 static struct hci_mgmt_chan chan = { 10538 .channel = HCI_CHANNEL_CONTROL, 10539 .handler_count = ARRAY_SIZE(mgmt_handlers), 10540 .handlers = mgmt_handlers, 10541 .hdev_init = mgmt_init_hdev, 10542 }; 10543 10544 int mgmt_init(void) 10545 { 10546 return hci_mgmt_chan_register(&chan); 10547 } 10548 10549 void mgmt_exit(void) 10550 { 10551 hci_mgmt_chan_unregister(&chan); 10552 } 10553 10554 void mgmt_cleanup(struct sock *sk) 10555 { 10556 struct mgmt_mesh_tx *mesh_tx; 10557 struct hci_dev *hdev; 10558 10559 read_lock(&hci_dev_list_lock); 10560 10561 list_for_each_entry(hdev, &hci_dev_list, list) { 10562 do { 10563 mesh_tx = mgmt_mesh_next(hdev, sk); 10564 10565 if (mesh_tx) 10566 mesh_send_complete(hdev, mesh_tx, true); 10567 } while (mesh_tx); 10568 } 10569 10570 read_unlock(&hci_dev_list_lock); 10571 } 10572