1 /* 2 BlueZ - Bluetooth protocol stack for Linux 3 4 Copyright (C) 2010 Nokia Corporation 5 Copyright (C) 2011-2012 Intel Corporation 6 7 This program is free software; you can redistribute it and/or modify 8 it under the terms of the GNU General Public License version 2 as 9 published by the Free Software Foundation; 10 11 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS 12 OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 13 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS. 14 IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY 15 CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES 16 WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN 17 ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF 18 OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. 19 20 ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS, 21 COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS 22 SOFTWARE IS DISCLAIMED. 23 */ 24 25 /* Bluetooth HCI Management interface */ 26 27 #include <linux/module.h> 28 #include <asm/unaligned.h> 29 30 #include <net/bluetooth/bluetooth.h> 31 #include <net/bluetooth/hci_core.h> 32 #include <net/bluetooth/hci_sock.h> 33 #include <net/bluetooth/l2cap.h> 34 #include <net/bluetooth/mgmt.h> 35 36 #include "hci_request.h" 37 #include "smp.h" 38 #include "mgmt_util.h" 39 #include "mgmt_config.h" 40 #include "msft.h" 41 #include "eir.h" 42 #include "aosp.h" 43 44 #define MGMT_VERSION 1 45 #define MGMT_REVISION 22 46 47 static const u16 mgmt_commands[] = { 48 MGMT_OP_READ_INDEX_LIST, 49 MGMT_OP_READ_INFO, 50 MGMT_OP_SET_POWERED, 51 MGMT_OP_SET_DISCOVERABLE, 52 MGMT_OP_SET_CONNECTABLE, 53 MGMT_OP_SET_FAST_CONNECTABLE, 54 MGMT_OP_SET_BONDABLE, 55 MGMT_OP_SET_LINK_SECURITY, 56 MGMT_OP_SET_SSP, 57 MGMT_OP_SET_HS, 58 MGMT_OP_SET_LE, 59 MGMT_OP_SET_DEV_CLASS, 60 MGMT_OP_SET_LOCAL_NAME, 61 MGMT_OP_ADD_UUID, 62 MGMT_OP_REMOVE_UUID, 63 MGMT_OP_LOAD_LINK_KEYS, 64 MGMT_OP_LOAD_LONG_TERM_KEYS, 65 MGMT_OP_DISCONNECT, 66 MGMT_OP_GET_CONNECTIONS, 67 MGMT_OP_PIN_CODE_REPLY, 68 MGMT_OP_PIN_CODE_NEG_REPLY, 69 MGMT_OP_SET_IO_CAPABILITY, 70 MGMT_OP_PAIR_DEVICE, 71 MGMT_OP_CANCEL_PAIR_DEVICE, 72 MGMT_OP_UNPAIR_DEVICE, 73 MGMT_OP_USER_CONFIRM_REPLY, 74 MGMT_OP_USER_CONFIRM_NEG_REPLY, 75 MGMT_OP_USER_PASSKEY_REPLY, 76 MGMT_OP_USER_PASSKEY_NEG_REPLY, 77 MGMT_OP_READ_LOCAL_OOB_DATA, 78 MGMT_OP_ADD_REMOTE_OOB_DATA, 79 MGMT_OP_REMOVE_REMOTE_OOB_DATA, 80 MGMT_OP_START_DISCOVERY, 81 MGMT_OP_STOP_DISCOVERY, 82 MGMT_OP_CONFIRM_NAME, 83 MGMT_OP_BLOCK_DEVICE, 84 MGMT_OP_UNBLOCK_DEVICE, 85 MGMT_OP_SET_DEVICE_ID, 86 MGMT_OP_SET_ADVERTISING, 87 MGMT_OP_SET_BREDR, 88 MGMT_OP_SET_STATIC_ADDRESS, 89 MGMT_OP_SET_SCAN_PARAMS, 90 MGMT_OP_SET_SECURE_CONN, 91 MGMT_OP_SET_DEBUG_KEYS, 92 MGMT_OP_SET_PRIVACY, 93 MGMT_OP_LOAD_IRKS, 94 MGMT_OP_GET_CONN_INFO, 95 MGMT_OP_GET_CLOCK_INFO, 96 MGMT_OP_ADD_DEVICE, 97 MGMT_OP_REMOVE_DEVICE, 98 MGMT_OP_LOAD_CONN_PARAM, 99 MGMT_OP_READ_UNCONF_INDEX_LIST, 100 MGMT_OP_READ_CONFIG_INFO, 101 MGMT_OP_SET_EXTERNAL_CONFIG, 102 MGMT_OP_SET_PUBLIC_ADDRESS, 103 MGMT_OP_START_SERVICE_DISCOVERY, 104 MGMT_OP_READ_LOCAL_OOB_EXT_DATA, 105 MGMT_OP_READ_EXT_INDEX_LIST, 106 MGMT_OP_READ_ADV_FEATURES, 107 MGMT_OP_ADD_ADVERTISING, 108 MGMT_OP_REMOVE_ADVERTISING, 109 MGMT_OP_GET_ADV_SIZE_INFO, 110 MGMT_OP_START_LIMITED_DISCOVERY, 111 MGMT_OP_READ_EXT_INFO, 112 MGMT_OP_SET_APPEARANCE, 113 MGMT_OP_GET_PHY_CONFIGURATION, 114 MGMT_OP_SET_PHY_CONFIGURATION, 115 MGMT_OP_SET_BLOCKED_KEYS, 116 MGMT_OP_SET_WIDEBAND_SPEECH, 117 MGMT_OP_READ_CONTROLLER_CAP, 118 MGMT_OP_READ_EXP_FEATURES_INFO, 119 MGMT_OP_SET_EXP_FEATURE, 120 MGMT_OP_READ_DEF_SYSTEM_CONFIG, 121 MGMT_OP_SET_DEF_SYSTEM_CONFIG, 122 MGMT_OP_READ_DEF_RUNTIME_CONFIG, 123 MGMT_OP_SET_DEF_RUNTIME_CONFIG, 124 MGMT_OP_GET_DEVICE_FLAGS, 125 MGMT_OP_SET_DEVICE_FLAGS, 126 MGMT_OP_READ_ADV_MONITOR_FEATURES, 127 MGMT_OP_ADD_ADV_PATTERNS_MONITOR, 128 MGMT_OP_REMOVE_ADV_MONITOR, 129 MGMT_OP_ADD_EXT_ADV_PARAMS, 130 MGMT_OP_ADD_EXT_ADV_DATA, 131 MGMT_OP_ADD_ADV_PATTERNS_MONITOR_RSSI, 132 MGMT_OP_SET_MESH_RECEIVER, 133 MGMT_OP_MESH_READ_FEATURES, 134 MGMT_OP_MESH_SEND, 135 MGMT_OP_MESH_SEND_CANCEL, 136 }; 137 138 static const u16 mgmt_events[] = { 139 MGMT_EV_CONTROLLER_ERROR, 140 MGMT_EV_INDEX_ADDED, 141 MGMT_EV_INDEX_REMOVED, 142 MGMT_EV_NEW_SETTINGS, 143 MGMT_EV_CLASS_OF_DEV_CHANGED, 144 MGMT_EV_LOCAL_NAME_CHANGED, 145 MGMT_EV_NEW_LINK_KEY, 146 MGMT_EV_NEW_LONG_TERM_KEY, 147 MGMT_EV_DEVICE_CONNECTED, 148 MGMT_EV_DEVICE_DISCONNECTED, 149 MGMT_EV_CONNECT_FAILED, 150 MGMT_EV_PIN_CODE_REQUEST, 151 MGMT_EV_USER_CONFIRM_REQUEST, 152 MGMT_EV_USER_PASSKEY_REQUEST, 153 MGMT_EV_AUTH_FAILED, 154 MGMT_EV_DEVICE_FOUND, 155 MGMT_EV_DISCOVERING, 156 MGMT_EV_DEVICE_BLOCKED, 157 MGMT_EV_DEVICE_UNBLOCKED, 158 MGMT_EV_DEVICE_UNPAIRED, 159 MGMT_EV_PASSKEY_NOTIFY, 160 MGMT_EV_NEW_IRK, 161 MGMT_EV_NEW_CSRK, 162 MGMT_EV_DEVICE_ADDED, 163 MGMT_EV_DEVICE_REMOVED, 164 MGMT_EV_NEW_CONN_PARAM, 165 MGMT_EV_UNCONF_INDEX_ADDED, 166 MGMT_EV_UNCONF_INDEX_REMOVED, 167 MGMT_EV_NEW_CONFIG_OPTIONS, 168 MGMT_EV_EXT_INDEX_ADDED, 169 MGMT_EV_EXT_INDEX_REMOVED, 170 MGMT_EV_LOCAL_OOB_DATA_UPDATED, 171 MGMT_EV_ADVERTISING_ADDED, 172 MGMT_EV_ADVERTISING_REMOVED, 173 MGMT_EV_EXT_INFO_CHANGED, 174 MGMT_EV_PHY_CONFIGURATION_CHANGED, 175 MGMT_EV_EXP_FEATURE_CHANGED, 176 MGMT_EV_DEVICE_FLAGS_CHANGED, 177 MGMT_EV_ADV_MONITOR_ADDED, 178 MGMT_EV_ADV_MONITOR_REMOVED, 179 MGMT_EV_CONTROLLER_SUSPEND, 180 MGMT_EV_CONTROLLER_RESUME, 181 MGMT_EV_ADV_MONITOR_DEVICE_FOUND, 182 MGMT_EV_ADV_MONITOR_DEVICE_LOST, 183 }; 184 185 static const u16 mgmt_untrusted_commands[] = { 186 MGMT_OP_READ_INDEX_LIST, 187 MGMT_OP_READ_INFO, 188 MGMT_OP_READ_UNCONF_INDEX_LIST, 189 MGMT_OP_READ_CONFIG_INFO, 190 MGMT_OP_READ_EXT_INDEX_LIST, 191 MGMT_OP_READ_EXT_INFO, 192 MGMT_OP_READ_CONTROLLER_CAP, 193 MGMT_OP_READ_EXP_FEATURES_INFO, 194 MGMT_OP_READ_DEF_SYSTEM_CONFIG, 195 MGMT_OP_READ_DEF_RUNTIME_CONFIG, 196 }; 197 198 static const u16 mgmt_untrusted_events[] = { 199 MGMT_EV_INDEX_ADDED, 200 MGMT_EV_INDEX_REMOVED, 201 MGMT_EV_NEW_SETTINGS, 202 MGMT_EV_CLASS_OF_DEV_CHANGED, 203 MGMT_EV_LOCAL_NAME_CHANGED, 204 MGMT_EV_UNCONF_INDEX_ADDED, 205 MGMT_EV_UNCONF_INDEX_REMOVED, 206 MGMT_EV_NEW_CONFIG_OPTIONS, 207 MGMT_EV_EXT_INDEX_ADDED, 208 MGMT_EV_EXT_INDEX_REMOVED, 209 MGMT_EV_EXT_INFO_CHANGED, 210 MGMT_EV_EXP_FEATURE_CHANGED, 211 }; 212 213 #define CACHE_TIMEOUT msecs_to_jiffies(2 * 1000) 214 215 #define ZERO_KEY "\x00\x00\x00\x00\x00\x00\x00\x00" \ 216 "\x00\x00\x00\x00\x00\x00\x00\x00" 217 218 /* HCI to MGMT error code conversion table */ 219 static const u8 mgmt_status_table[] = { 220 MGMT_STATUS_SUCCESS, 221 MGMT_STATUS_UNKNOWN_COMMAND, /* Unknown Command */ 222 MGMT_STATUS_NOT_CONNECTED, /* No Connection */ 223 MGMT_STATUS_FAILED, /* Hardware Failure */ 224 MGMT_STATUS_CONNECT_FAILED, /* Page Timeout */ 225 MGMT_STATUS_AUTH_FAILED, /* Authentication Failed */ 226 MGMT_STATUS_AUTH_FAILED, /* PIN or Key Missing */ 227 MGMT_STATUS_NO_RESOURCES, /* Memory Full */ 228 MGMT_STATUS_TIMEOUT, /* Connection Timeout */ 229 MGMT_STATUS_NO_RESOURCES, /* Max Number of Connections */ 230 MGMT_STATUS_NO_RESOURCES, /* Max Number of SCO Connections */ 231 MGMT_STATUS_ALREADY_CONNECTED, /* ACL Connection Exists */ 232 MGMT_STATUS_BUSY, /* Command Disallowed */ 233 MGMT_STATUS_NO_RESOURCES, /* Rejected Limited Resources */ 234 MGMT_STATUS_REJECTED, /* Rejected Security */ 235 MGMT_STATUS_REJECTED, /* Rejected Personal */ 236 MGMT_STATUS_TIMEOUT, /* Host Timeout */ 237 MGMT_STATUS_NOT_SUPPORTED, /* Unsupported Feature */ 238 MGMT_STATUS_INVALID_PARAMS, /* Invalid Parameters */ 239 MGMT_STATUS_DISCONNECTED, /* OE User Ended Connection */ 240 MGMT_STATUS_NO_RESOURCES, /* OE Low Resources */ 241 MGMT_STATUS_DISCONNECTED, /* OE Power Off */ 242 MGMT_STATUS_DISCONNECTED, /* Connection Terminated */ 243 MGMT_STATUS_BUSY, /* Repeated Attempts */ 244 MGMT_STATUS_REJECTED, /* Pairing Not Allowed */ 245 MGMT_STATUS_FAILED, /* Unknown LMP PDU */ 246 MGMT_STATUS_NOT_SUPPORTED, /* Unsupported Remote Feature */ 247 MGMT_STATUS_REJECTED, /* SCO Offset Rejected */ 248 MGMT_STATUS_REJECTED, /* SCO Interval Rejected */ 249 MGMT_STATUS_REJECTED, /* Air Mode Rejected */ 250 MGMT_STATUS_INVALID_PARAMS, /* Invalid LMP Parameters */ 251 MGMT_STATUS_FAILED, /* Unspecified Error */ 252 MGMT_STATUS_NOT_SUPPORTED, /* Unsupported LMP Parameter Value */ 253 MGMT_STATUS_FAILED, /* Role Change Not Allowed */ 254 MGMT_STATUS_TIMEOUT, /* LMP Response Timeout */ 255 MGMT_STATUS_FAILED, /* LMP Error Transaction Collision */ 256 MGMT_STATUS_FAILED, /* LMP PDU Not Allowed */ 257 MGMT_STATUS_REJECTED, /* Encryption Mode Not Accepted */ 258 MGMT_STATUS_FAILED, /* Unit Link Key Used */ 259 MGMT_STATUS_NOT_SUPPORTED, /* QoS Not Supported */ 260 MGMT_STATUS_TIMEOUT, /* Instant Passed */ 261 MGMT_STATUS_NOT_SUPPORTED, /* Pairing Not Supported */ 262 MGMT_STATUS_FAILED, /* Transaction Collision */ 263 MGMT_STATUS_FAILED, /* Reserved for future use */ 264 MGMT_STATUS_INVALID_PARAMS, /* Unacceptable Parameter */ 265 MGMT_STATUS_REJECTED, /* QoS Rejected */ 266 MGMT_STATUS_NOT_SUPPORTED, /* Classification Not Supported */ 267 MGMT_STATUS_REJECTED, /* Insufficient Security */ 268 MGMT_STATUS_INVALID_PARAMS, /* Parameter Out Of Range */ 269 MGMT_STATUS_FAILED, /* Reserved for future use */ 270 MGMT_STATUS_BUSY, /* Role Switch Pending */ 271 MGMT_STATUS_FAILED, /* Reserved for future use */ 272 MGMT_STATUS_FAILED, /* Slot Violation */ 273 MGMT_STATUS_FAILED, /* Role Switch Failed */ 274 MGMT_STATUS_INVALID_PARAMS, /* EIR Too Large */ 275 MGMT_STATUS_NOT_SUPPORTED, /* Simple Pairing Not Supported */ 276 MGMT_STATUS_BUSY, /* Host Busy Pairing */ 277 MGMT_STATUS_REJECTED, /* Rejected, No Suitable Channel */ 278 MGMT_STATUS_BUSY, /* Controller Busy */ 279 MGMT_STATUS_INVALID_PARAMS, /* Unsuitable Connection Interval */ 280 MGMT_STATUS_TIMEOUT, /* Directed Advertising Timeout */ 281 MGMT_STATUS_AUTH_FAILED, /* Terminated Due to MIC Failure */ 282 MGMT_STATUS_CONNECT_FAILED, /* Connection Establishment Failed */ 283 MGMT_STATUS_CONNECT_FAILED, /* MAC Connection Failed */ 284 }; 285 286 static u8 mgmt_errno_status(int err) 287 { 288 switch (err) { 289 case 0: 290 return MGMT_STATUS_SUCCESS; 291 case -EPERM: 292 return MGMT_STATUS_REJECTED; 293 case -EINVAL: 294 return MGMT_STATUS_INVALID_PARAMS; 295 case -EOPNOTSUPP: 296 return MGMT_STATUS_NOT_SUPPORTED; 297 case -EBUSY: 298 return MGMT_STATUS_BUSY; 299 case -ETIMEDOUT: 300 return MGMT_STATUS_AUTH_FAILED; 301 case -ENOMEM: 302 return MGMT_STATUS_NO_RESOURCES; 303 case -EISCONN: 304 return MGMT_STATUS_ALREADY_CONNECTED; 305 case -ENOTCONN: 306 return MGMT_STATUS_DISCONNECTED; 307 } 308 309 return MGMT_STATUS_FAILED; 310 } 311 312 static u8 mgmt_status(int err) 313 { 314 if (err < 0) 315 return mgmt_errno_status(err); 316 317 if (err < ARRAY_SIZE(mgmt_status_table)) 318 return mgmt_status_table[err]; 319 320 return MGMT_STATUS_FAILED; 321 } 322 323 static int mgmt_index_event(u16 event, struct hci_dev *hdev, void *data, 324 u16 len, int flag) 325 { 326 return mgmt_send_event(event, hdev, HCI_CHANNEL_CONTROL, data, len, 327 flag, NULL); 328 } 329 330 static int mgmt_limited_event(u16 event, struct hci_dev *hdev, void *data, 331 u16 len, int flag, struct sock *skip_sk) 332 { 333 return mgmt_send_event(event, hdev, HCI_CHANNEL_CONTROL, data, len, 334 flag, skip_sk); 335 } 336 337 static int mgmt_event(u16 event, struct hci_dev *hdev, void *data, u16 len, 338 struct sock *skip_sk) 339 { 340 return mgmt_send_event(event, hdev, HCI_CHANNEL_CONTROL, data, len, 341 HCI_SOCK_TRUSTED, skip_sk); 342 } 343 344 static int mgmt_event_skb(struct sk_buff *skb, struct sock *skip_sk) 345 { 346 return mgmt_send_event_skb(HCI_CHANNEL_CONTROL, skb, HCI_SOCK_TRUSTED, 347 skip_sk); 348 } 349 350 static u8 le_addr_type(u8 mgmt_addr_type) 351 { 352 if (mgmt_addr_type == BDADDR_LE_PUBLIC) 353 return ADDR_LE_DEV_PUBLIC; 354 else 355 return ADDR_LE_DEV_RANDOM; 356 } 357 358 void mgmt_fill_version_info(void *ver) 359 { 360 struct mgmt_rp_read_version *rp = ver; 361 362 rp->version = MGMT_VERSION; 363 rp->revision = cpu_to_le16(MGMT_REVISION); 364 } 365 366 static int read_version(struct sock *sk, struct hci_dev *hdev, void *data, 367 u16 data_len) 368 { 369 struct mgmt_rp_read_version rp; 370 371 bt_dev_dbg(hdev, "sock %p", sk); 372 373 mgmt_fill_version_info(&rp); 374 375 return mgmt_cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_VERSION, 0, 376 &rp, sizeof(rp)); 377 } 378 379 static int read_commands(struct sock *sk, struct hci_dev *hdev, void *data, 380 u16 data_len) 381 { 382 struct mgmt_rp_read_commands *rp; 383 u16 num_commands, num_events; 384 size_t rp_size; 385 int i, err; 386 387 bt_dev_dbg(hdev, "sock %p", sk); 388 389 if (hci_sock_test_flag(sk, HCI_SOCK_TRUSTED)) { 390 num_commands = ARRAY_SIZE(mgmt_commands); 391 num_events = ARRAY_SIZE(mgmt_events); 392 } else { 393 num_commands = ARRAY_SIZE(mgmt_untrusted_commands); 394 num_events = ARRAY_SIZE(mgmt_untrusted_events); 395 } 396 397 rp_size = sizeof(*rp) + ((num_commands + num_events) * sizeof(u16)); 398 399 rp = kmalloc(rp_size, GFP_KERNEL); 400 if (!rp) 401 return -ENOMEM; 402 403 rp->num_commands = cpu_to_le16(num_commands); 404 rp->num_events = cpu_to_le16(num_events); 405 406 if (hci_sock_test_flag(sk, HCI_SOCK_TRUSTED)) { 407 __le16 *opcode = rp->opcodes; 408 409 for (i = 0; i < num_commands; i++, opcode++) 410 put_unaligned_le16(mgmt_commands[i], opcode); 411 412 for (i = 0; i < num_events; i++, opcode++) 413 put_unaligned_le16(mgmt_events[i], opcode); 414 } else { 415 __le16 *opcode = rp->opcodes; 416 417 for (i = 0; i < num_commands; i++, opcode++) 418 put_unaligned_le16(mgmt_untrusted_commands[i], opcode); 419 420 for (i = 0; i < num_events; i++, opcode++) 421 put_unaligned_le16(mgmt_untrusted_events[i], opcode); 422 } 423 424 err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_COMMANDS, 0, 425 rp, rp_size); 426 kfree(rp); 427 428 return err; 429 } 430 431 static int read_index_list(struct sock *sk, struct hci_dev *hdev, void *data, 432 u16 data_len) 433 { 434 struct mgmt_rp_read_index_list *rp; 435 struct hci_dev *d; 436 size_t rp_len; 437 u16 count; 438 int err; 439 440 bt_dev_dbg(hdev, "sock %p", sk); 441 442 read_lock(&hci_dev_list_lock); 443 444 count = 0; 445 list_for_each_entry(d, &hci_dev_list, list) { 446 if (d->dev_type == HCI_PRIMARY && 447 !hci_dev_test_flag(d, HCI_UNCONFIGURED)) 448 count++; 449 } 450 451 rp_len = sizeof(*rp) + (2 * count); 452 rp = kmalloc(rp_len, GFP_ATOMIC); 453 if (!rp) { 454 read_unlock(&hci_dev_list_lock); 455 return -ENOMEM; 456 } 457 458 count = 0; 459 list_for_each_entry(d, &hci_dev_list, list) { 460 if (hci_dev_test_flag(d, HCI_SETUP) || 461 hci_dev_test_flag(d, HCI_CONFIG) || 462 hci_dev_test_flag(d, HCI_USER_CHANNEL)) 463 continue; 464 465 /* Devices marked as raw-only are neither configured 466 * nor unconfigured controllers. 467 */ 468 if (test_bit(HCI_QUIRK_RAW_DEVICE, &d->quirks)) 469 continue; 470 471 if (d->dev_type == HCI_PRIMARY && 472 !hci_dev_test_flag(d, HCI_UNCONFIGURED)) { 473 rp->index[count++] = cpu_to_le16(d->id); 474 bt_dev_dbg(hdev, "Added hci%u", d->id); 475 } 476 } 477 478 rp->num_controllers = cpu_to_le16(count); 479 rp_len = sizeof(*rp) + (2 * count); 480 481 read_unlock(&hci_dev_list_lock); 482 483 err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_INDEX_LIST, 484 0, rp, rp_len); 485 486 kfree(rp); 487 488 return err; 489 } 490 491 static int read_unconf_index_list(struct sock *sk, struct hci_dev *hdev, 492 void *data, u16 data_len) 493 { 494 struct mgmt_rp_read_unconf_index_list *rp; 495 struct hci_dev *d; 496 size_t rp_len; 497 u16 count; 498 int err; 499 500 bt_dev_dbg(hdev, "sock %p", sk); 501 502 read_lock(&hci_dev_list_lock); 503 504 count = 0; 505 list_for_each_entry(d, &hci_dev_list, list) { 506 if (d->dev_type == HCI_PRIMARY && 507 hci_dev_test_flag(d, HCI_UNCONFIGURED)) 508 count++; 509 } 510 511 rp_len = sizeof(*rp) + (2 * count); 512 rp = kmalloc(rp_len, GFP_ATOMIC); 513 if (!rp) { 514 read_unlock(&hci_dev_list_lock); 515 return -ENOMEM; 516 } 517 518 count = 0; 519 list_for_each_entry(d, &hci_dev_list, list) { 520 if (hci_dev_test_flag(d, HCI_SETUP) || 521 hci_dev_test_flag(d, HCI_CONFIG) || 522 hci_dev_test_flag(d, HCI_USER_CHANNEL)) 523 continue; 524 525 /* Devices marked as raw-only are neither configured 526 * nor unconfigured controllers. 527 */ 528 if (test_bit(HCI_QUIRK_RAW_DEVICE, &d->quirks)) 529 continue; 530 531 if (d->dev_type == HCI_PRIMARY && 532 hci_dev_test_flag(d, HCI_UNCONFIGURED)) { 533 rp->index[count++] = cpu_to_le16(d->id); 534 bt_dev_dbg(hdev, "Added hci%u", d->id); 535 } 536 } 537 538 rp->num_controllers = cpu_to_le16(count); 539 rp_len = sizeof(*rp) + (2 * count); 540 541 read_unlock(&hci_dev_list_lock); 542 543 err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE, 544 MGMT_OP_READ_UNCONF_INDEX_LIST, 0, rp, rp_len); 545 546 kfree(rp); 547 548 return err; 549 } 550 551 static int read_ext_index_list(struct sock *sk, struct hci_dev *hdev, 552 void *data, u16 data_len) 553 { 554 struct mgmt_rp_read_ext_index_list *rp; 555 struct hci_dev *d; 556 u16 count; 557 int err; 558 559 bt_dev_dbg(hdev, "sock %p", sk); 560 561 read_lock(&hci_dev_list_lock); 562 563 count = 0; 564 list_for_each_entry(d, &hci_dev_list, list) { 565 if (d->dev_type == HCI_PRIMARY || d->dev_type == HCI_AMP) 566 count++; 567 } 568 569 rp = kmalloc(struct_size(rp, entry, count), GFP_ATOMIC); 570 if (!rp) { 571 read_unlock(&hci_dev_list_lock); 572 return -ENOMEM; 573 } 574 575 count = 0; 576 list_for_each_entry(d, &hci_dev_list, list) { 577 if (hci_dev_test_flag(d, HCI_SETUP) || 578 hci_dev_test_flag(d, HCI_CONFIG) || 579 hci_dev_test_flag(d, HCI_USER_CHANNEL)) 580 continue; 581 582 /* Devices marked as raw-only are neither configured 583 * nor unconfigured controllers. 584 */ 585 if (test_bit(HCI_QUIRK_RAW_DEVICE, &d->quirks)) 586 continue; 587 588 if (d->dev_type == HCI_PRIMARY) { 589 if (hci_dev_test_flag(d, HCI_UNCONFIGURED)) 590 rp->entry[count].type = 0x01; 591 else 592 rp->entry[count].type = 0x00; 593 } else if (d->dev_type == HCI_AMP) { 594 rp->entry[count].type = 0x02; 595 } else { 596 continue; 597 } 598 599 rp->entry[count].bus = d->bus; 600 rp->entry[count++].index = cpu_to_le16(d->id); 601 bt_dev_dbg(hdev, "Added hci%u", d->id); 602 } 603 604 rp->num_controllers = cpu_to_le16(count); 605 606 read_unlock(&hci_dev_list_lock); 607 608 /* If this command is called at least once, then all the 609 * default index and unconfigured index events are disabled 610 * and from now on only extended index events are used. 611 */ 612 hci_sock_set_flag(sk, HCI_MGMT_EXT_INDEX_EVENTS); 613 hci_sock_clear_flag(sk, HCI_MGMT_INDEX_EVENTS); 614 hci_sock_clear_flag(sk, HCI_MGMT_UNCONF_INDEX_EVENTS); 615 616 err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE, 617 MGMT_OP_READ_EXT_INDEX_LIST, 0, rp, 618 struct_size(rp, entry, count)); 619 620 kfree(rp); 621 622 return err; 623 } 624 625 static bool is_configured(struct hci_dev *hdev) 626 { 627 if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks) && 628 !hci_dev_test_flag(hdev, HCI_EXT_CONFIGURED)) 629 return false; 630 631 if ((test_bit(HCI_QUIRK_INVALID_BDADDR, &hdev->quirks) || 632 test_bit(HCI_QUIRK_USE_BDADDR_PROPERTY, &hdev->quirks)) && 633 !bacmp(&hdev->public_addr, BDADDR_ANY)) 634 return false; 635 636 return true; 637 } 638 639 static __le32 get_missing_options(struct hci_dev *hdev) 640 { 641 u32 options = 0; 642 643 if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks) && 644 !hci_dev_test_flag(hdev, HCI_EXT_CONFIGURED)) 645 options |= MGMT_OPTION_EXTERNAL_CONFIG; 646 647 if ((test_bit(HCI_QUIRK_INVALID_BDADDR, &hdev->quirks) || 648 test_bit(HCI_QUIRK_USE_BDADDR_PROPERTY, &hdev->quirks)) && 649 !bacmp(&hdev->public_addr, BDADDR_ANY)) 650 options |= MGMT_OPTION_PUBLIC_ADDRESS; 651 652 return cpu_to_le32(options); 653 } 654 655 static int new_options(struct hci_dev *hdev, struct sock *skip) 656 { 657 __le32 options = get_missing_options(hdev); 658 659 return mgmt_limited_event(MGMT_EV_NEW_CONFIG_OPTIONS, hdev, &options, 660 sizeof(options), HCI_MGMT_OPTION_EVENTS, skip); 661 } 662 663 static int send_options_rsp(struct sock *sk, u16 opcode, struct hci_dev *hdev) 664 { 665 __le32 options = get_missing_options(hdev); 666 667 return mgmt_cmd_complete(sk, hdev->id, opcode, 0, &options, 668 sizeof(options)); 669 } 670 671 static int read_config_info(struct sock *sk, struct hci_dev *hdev, 672 void *data, u16 data_len) 673 { 674 struct mgmt_rp_read_config_info rp; 675 u32 options = 0; 676 677 bt_dev_dbg(hdev, "sock %p", sk); 678 679 hci_dev_lock(hdev); 680 681 memset(&rp, 0, sizeof(rp)); 682 rp.manufacturer = cpu_to_le16(hdev->manufacturer); 683 684 if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks)) 685 options |= MGMT_OPTION_EXTERNAL_CONFIG; 686 687 if (hdev->set_bdaddr) 688 options |= MGMT_OPTION_PUBLIC_ADDRESS; 689 690 rp.supported_options = cpu_to_le32(options); 691 rp.missing_options = get_missing_options(hdev); 692 693 hci_dev_unlock(hdev); 694 695 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_CONFIG_INFO, 0, 696 &rp, sizeof(rp)); 697 } 698 699 static u32 get_supported_phys(struct hci_dev *hdev) 700 { 701 u32 supported_phys = 0; 702 703 if (lmp_bredr_capable(hdev)) { 704 supported_phys |= MGMT_PHY_BR_1M_1SLOT; 705 706 if (hdev->features[0][0] & LMP_3SLOT) 707 supported_phys |= MGMT_PHY_BR_1M_3SLOT; 708 709 if (hdev->features[0][0] & LMP_5SLOT) 710 supported_phys |= MGMT_PHY_BR_1M_5SLOT; 711 712 if (lmp_edr_2m_capable(hdev)) { 713 supported_phys |= MGMT_PHY_EDR_2M_1SLOT; 714 715 if (lmp_edr_3slot_capable(hdev)) 716 supported_phys |= MGMT_PHY_EDR_2M_3SLOT; 717 718 if (lmp_edr_5slot_capable(hdev)) 719 supported_phys |= MGMT_PHY_EDR_2M_5SLOT; 720 721 if (lmp_edr_3m_capable(hdev)) { 722 supported_phys |= MGMT_PHY_EDR_3M_1SLOT; 723 724 if (lmp_edr_3slot_capable(hdev)) 725 supported_phys |= MGMT_PHY_EDR_3M_3SLOT; 726 727 if (lmp_edr_5slot_capable(hdev)) 728 supported_phys |= MGMT_PHY_EDR_3M_5SLOT; 729 } 730 } 731 } 732 733 if (lmp_le_capable(hdev)) { 734 supported_phys |= MGMT_PHY_LE_1M_TX; 735 supported_phys |= MGMT_PHY_LE_1M_RX; 736 737 if (hdev->le_features[1] & HCI_LE_PHY_2M) { 738 supported_phys |= MGMT_PHY_LE_2M_TX; 739 supported_phys |= MGMT_PHY_LE_2M_RX; 740 } 741 742 if (hdev->le_features[1] & HCI_LE_PHY_CODED) { 743 supported_phys |= MGMT_PHY_LE_CODED_TX; 744 supported_phys |= MGMT_PHY_LE_CODED_RX; 745 } 746 } 747 748 return supported_phys; 749 } 750 751 static u32 get_selected_phys(struct hci_dev *hdev) 752 { 753 u32 selected_phys = 0; 754 755 if (lmp_bredr_capable(hdev)) { 756 selected_phys |= MGMT_PHY_BR_1M_1SLOT; 757 758 if (hdev->pkt_type & (HCI_DM3 | HCI_DH3)) 759 selected_phys |= MGMT_PHY_BR_1M_3SLOT; 760 761 if (hdev->pkt_type & (HCI_DM5 | HCI_DH5)) 762 selected_phys |= MGMT_PHY_BR_1M_5SLOT; 763 764 if (lmp_edr_2m_capable(hdev)) { 765 if (!(hdev->pkt_type & HCI_2DH1)) 766 selected_phys |= MGMT_PHY_EDR_2M_1SLOT; 767 768 if (lmp_edr_3slot_capable(hdev) && 769 !(hdev->pkt_type & HCI_2DH3)) 770 selected_phys |= MGMT_PHY_EDR_2M_3SLOT; 771 772 if (lmp_edr_5slot_capable(hdev) && 773 !(hdev->pkt_type & HCI_2DH5)) 774 selected_phys |= MGMT_PHY_EDR_2M_5SLOT; 775 776 if (lmp_edr_3m_capable(hdev)) { 777 if (!(hdev->pkt_type & HCI_3DH1)) 778 selected_phys |= MGMT_PHY_EDR_3M_1SLOT; 779 780 if (lmp_edr_3slot_capable(hdev) && 781 !(hdev->pkt_type & HCI_3DH3)) 782 selected_phys |= MGMT_PHY_EDR_3M_3SLOT; 783 784 if (lmp_edr_5slot_capable(hdev) && 785 !(hdev->pkt_type & HCI_3DH5)) 786 selected_phys |= MGMT_PHY_EDR_3M_5SLOT; 787 } 788 } 789 } 790 791 if (lmp_le_capable(hdev)) { 792 if (hdev->le_tx_def_phys & HCI_LE_SET_PHY_1M) 793 selected_phys |= MGMT_PHY_LE_1M_TX; 794 795 if (hdev->le_rx_def_phys & HCI_LE_SET_PHY_1M) 796 selected_phys |= MGMT_PHY_LE_1M_RX; 797 798 if (hdev->le_tx_def_phys & HCI_LE_SET_PHY_2M) 799 selected_phys |= MGMT_PHY_LE_2M_TX; 800 801 if (hdev->le_rx_def_phys & HCI_LE_SET_PHY_2M) 802 selected_phys |= MGMT_PHY_LE_2M_RX; 803 804 if (hdev->le_tx_def_phys & HCI_LE_SET_PHY_CODED) 805 selected_phys |= MGMT_PHY_LE_CODED_TX; 806 807 if (hdev->le_rx_def_phys & HCI_LE_SET_PHY_CODED) 808 selected_phys |= MGMT_PHY_LE_CODED_RX; 809 } 810 811 return selected_phys; 812 } 813 814 static u32 get_configurable_phys(struct hci_dev *hdev) 815 { 816 return (get_supported_phys(hdev) & ~MGMT_PHY_BR_1M_1SLOT & 817 ~MGMT_PHY_LE_1M_TX & ~MGMT_PHY_LE_1M_RX); 818 } 819 820 static u32 get_supported_settings(struct hci_dev *hdev) 821 { 822 u32 settings = 0; 823 824 settings |= MGMT_SETTING_POWERED; 825 settings |= MGMT_SETTING_BONDABLE; 826 settings |= MGMT_SETTING_DEBUG_KEYS; 827 settings |= MGMT_SETTING_CONNECTABLE; 828 settings |= MGMT_SETTING_DISCOVERABLE; 829 830 if (lmp_bredr_capable(hdev)) { 831 if (hdev->hci_ver >= BLUETOOTH_VER_1_2) 832 settings |= MGMT_SETTING_FAST_CONNECTABLE; 833 settings |= MGMT_SETTING_BREDR; 834 settings |= MGMT_SETTING_LINK_SECURITY; 835 836 if (lmp_ssp_capable(hdev)) { 837 settings |= MGMT_SETTING_SSP; 838 if (IS_ENABLED(CONFIG_BT_HS)) 839 settings |= MGMT_SETTING_HS; 840 } 841 842 if (lmp_sc_capable(hdev)) 843 settings |= MGMT_SETTING_SECURE_CONN; 844 845 if (test_bit(HCI_QUIRK_WIDEBAND_SPEECH_SUPPORTED, 846 &hdev->quirks)) 847 settings |= MGMT_SETTING_WIDEBAND_SPEECH; 848 } 849 850 if (lmp_le_capable(hdev)) { 851 settings |= MGMT_SETTING_LE; 852 settings |= MGMT_SETTING_SECURE_CONN; 853 settings |= MGMT_SETTING_PRIVACY; 854 settings |= MGMT_SETTING_STATIC_ADDRESS; 855 settings |= MGMT_SETTING_ADVERTISING; 856 } 857 858 if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks) || 859 hdev->set_bdaddr) 860 settings |= MGMT_SETTING_CONFIGURATION; 861 862 if (cis_central_capable(hdev)) 863 settings |= MGMT_SETTING_CIS_CENTRAL; 864 865 if (cis_peripheral_capable(hdev)) 866 settings |= MGMT_SETTING_CIS_PERIPHERAL; 867 868 settings |= MGMT_SETTING_PHY_CONFIGURATION; 869 870 return settings; 871 } 872 873 static u32 get_current_settings(struct hci_dev *hdev) 874 { 875 u32 settings = 0; 876 877 if (hdev_is_powered(hdev)) 878 settings |= MGMT_SETTING_POWERED; 879 880 if (hci_dev_test_flag(hdev, HCI_CONNECTABLE)) 881 settings |= MGMT_SETTING_CONNECTABLE; 882 883 if (hci_dev_test_flag(hdev, HCI_FAST_CONNECTABLE)) 884 settings |= MGMT_SETTING_FAST_CONNECTABLE; 885 886 if (hci_dev_test_flag(hdev, HCI_DISCOVERABLE)) 887 settings |= MGMT_SETTING_DISCOVERABLE; 888 889 if (hci_dev_test_flag(hdev, HCI_BONDABLE)) 890 settings |= MGMT_SETTING_BONDABLE; 891 892 if (hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) 893 settings |= MGMT_SETTING_BREDR; 894 895 if (hci_dev_test_flag(hdev, HCI_LE_ENABLED)) 896 settings |= MGMT_SETTING_LE; 897 898 if (hci_dev_test_flag(hdev, HCI_LINK_SECURITY)) 899 settings |= MGMT_SETTING_LINK_SECURITY; 900 901 if (hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) 902 settings |= MGMT_SETTING_SSP; 903 904 if (hci_dev_test_flag(hdev, HCI_HS_ENABLED)) 905 settings |= MGMT_SETTING_HS; 906 907 if (hci_dev_test_flag(hdev, HCI_ADVERTISING)) 908 settings |= MGMT_SETTING_ADVERTISING; 909 910 if (hci_dev_test_flag(hdev, HCI_SC_ENABLED)) 911 settings |= MGMT_SETTING_SECURE_CONN; 912 913 if (hci_dev_test_flag(hdev, HCI_KEEP_DEBUG_KEYS)) 914 settings |= MGMT_SETTING_DEBUG_KEYS; 915 916 if (hci_dev_test_flag(hdev, HCI_PRIVACY)) 917 settings |= MGMT_SETTING_PRIVACY; 918 919 /* The current setting for static address has two purposes. The 920 * first is to indicate if the static address will be used and 921 * the second is to indicate if it is actually set. 922 * 923 * This means if the static address is not configured, this flag 924 * will never be set. If the address is configured, then if the 925 * address is actually used decides if the flag is set or not. 926 * 927 * For single mode LE only controllers and dual-mode controllers 928 * with BR/EDR disabled, the existence of the static address will 929 * be evaluated. 930 */ 931 if (hci_dev_test_flag(hdev, HCI_FORCE_STATIC_ADDR) || 932 !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) || 933 !bacmp(&hdev->bdaddr, BDADDR_ANY)) { 934 if (bacmp(&hdev->static_addr, BDADDR_ANY)) 935 settings |= MGMT_SETTING_STATIC_ADDRESS; 936 } 937 938 if (hci_dev_test_flag(hdev, HCI_WIDEBAND_SPEECH_ENABLED)) 939 settings |= MGMT_SETTING_WIDEBAND_SPEECH; 940 941 if (cis_central_capable(hdev)) 942 settings |= MGMT_SETTING_CIS_CENTRAL; 943 944 if (cis_peripheral_capable(hdev)) 945 settings |= MGMT_SETTING_CIS_PERIPHERAL; 946 947 return settings; 948 } 949 950 static struct mgmt_pending_cmd *pending_find(u16 opcode, struct hci_dev *hdev) 951 { 952 return mgmt_pending_find(HCI_CHANNEL_CONTROL, opcode, hdev); 953 } 954 955 u8 mgmt_get_adv_discov_flags(struct hci_dev *hdev) 956 { 957 struct mgmt_pending_cmd *cmd; 958 959 /* If there's a pending mgmt command the flags will not yet have 960 * their final values, so check for this first. 961 */ 962 cmd = pending_find(MGMT_OP_SET_DISCOVERABLE, hdev); 963 if (cmd) { 964 struct mgmt_mode *cp = cmd->param; 965 if (cp->val == 0x01) 966 return LE_AD_GENERAL; 967 else if (cp->val == 0x02) 968 return LE_AD_LIMITED; 969 } else { 970 if (hci_dev_test_flag(hdev, HCI_LIMITED_DISCOVERABLE)) 971 return LE_AD_LIMITED; 972 else if (hci_dev_test_flag(hdev, HCI_DISCOVERABLE)) 973 return LE_AD_GENERAL; 974 } 975 976 return 0; 977 } 978 979 bool mgmt_get_connectable(struct hci_dev *hdev) 980 { 981 struct mgmt_pending_cmd *cmd; 982 983 /* If there's a pending mgmt command the flag will not yet have 984 * it's final value, so check for this first. 985 */ 986 cmd = pending_find(MGMT_OP_SET_CONNECTABLE, hdev); 987 if (cmd) { 988 struct mgmt_mode *cp = cmd->param; 989 990 return cp->val; 991 } 992 993 return hci_dev_test_flag(hdev, HCI_CONNECTABLE); 994 } 995 996 static int service_cache_sync(struct hci_dev *hdev, void *data) 997 { 998 hci_update_eir_sync(hdev); 999 hci_update_class_sync(hdev); 1000 1001 return 0; 1002 } 1003 1004 static void service_cache_off(struct work_struct *work) 1005 { 1006 struct hci_dev *hdev = container_of(work, struct hci_dev, 1007 service_cache.work); 1008 1009 if (!hci_dev_test_and_clear_flag(hdev, HCI_SERVICE_CACHE)) 1010 return; 1011 1012 hci_cmd_sync_queue(hdev, service_cache_sync, NULL, NULL); 1013 } 1014 1015 static int rpa_expired_sync(struct hci_dev *hdev, void *data) 1016 { 1017 /* The generation of a new RPA and programming it into the 1018 * controller happens in the hci_req_enable_advertising() 1019 * function. 1020 */ 1021 if (ext_adv_capable(hdev)) 1022 return hci_start_ext_adv_sync(hdev, hdev->cur_adv_instance); 1023 else 1024 return hci_enable_advertising_sync(hdev); 1025 } 1026 1027 static void rpa_expired(struct work_struct *work) 1028 { 1029 struct hci_dev *hdev = container_of(work, struct hci_dev, 1030 rpa_expired.work); 1031 1032 bt_dev_dbg(hdev, ""); 1033 1034 hci_dev_set_flag(hdev, HCI_RPA_EXPIRED); 1035 1036 if (!hci_dev_test_flag(hdev, HCI_ADVERTISING)) 1037 return; 1038 1039 hci_cmd_sync_queue(hdev, rpa_expired_sync, NULL, NULL); 1040 } 1041 1042 static void discov_off(struct work_struct *work) 1043 { 1044 struct hci_dev *hdev = container_of(work, struct hci_dev, 1045 discov_off.work); 1046 1047 bt_dev_dbg(hdev, ""); 1048 1049 hci_dev_lock(hdev); 1050 1051 /* When discoverable timeout triggers, then just make sure 1052 * the limited discoverable flag is cleared. Even in the case 1053 * of a timeout triggered from general discoverable, it is 1054 * safe to unconditionally clear the flag. 1055 */ 1056 hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE); 1057 hci_dev_clear_flag(hdev, HCI_DISCOVERABLE); 1058 hdev->discov_timeout = 0; 1059 1060 hci_update_discoverable(hdev); 1061 1062 mgmt_new_settings(hdev); 1063 1064 hci_dev_unlock(hdev); 1065 } 1066 1067 static int send_settings_rsp(struct sock *sk, u16 opcode, struct hci_dev *hdev); 1068 1069 static void mesh_send_complete(struct hci_dev *hdev, 1070 struct mgmt_mesh_tx *mesh_tx, bool silent) 1071 { 1072 u8 handle = mesh_tx->handle; 1073 1074 if (!silent) 1075 mgmt_event(MGMT_EV_MESH_PACKET_CMPLT, hdev, &handle, 1076 sizeof(handle), NULL); 1077 1078 mgmt_mesh_remove(mesh_tx); 1079 } 1080 1081 static int mesh_send_done_sync(struct hci_dev *hdev, void *data) 1082 { 1083 struct mgmt_mesh_tx *mesh_tx; 1084 1085 hci_dev_clear_flag(hdev, HCI_MESH_SENDING); 1086 hci_disable_advertising_sync(hdev); 1087 mesh_tx = mgmt_mesh_next(hdev, NULL); 1088 1089 if (mesh_tx) 1090 mesh_send_complete(hdev, mesh_tx, false); 1091 1092 return 0; 1093 } 1094 1095 static int mesh_send_sync(struct hci_dev *hdev, void *data); 1096 static void mesh_send_start_complete(struct hci_dev *hdev, void *data, int err); 1097 static void mesh_next(struct hci_dev *hdev, void *data, int err) 1098 { 1099 struct mgmt_mesh_tx *mesh_tx = mgmt_mesh_next(hdev, NULL); 1100 1101 if (!mesh_tx) 1102 return; 1103 1104 err = hci_cmd_sync_queue(hdev, mesh_send_sync, mesh_tx, 1105 mesh_send_start_complete); 1106 1107 if (err < 0) 1108 mesh_send_complete(hdev, mesh_tx, false); 1109 else 1110 hci_dev_set_flag(hdev, HCI_MESH_SENDING); 1111 } 1112 1113 static void mesh_send_done(struct work_struct *work) 1114 { 1115 struct hci_dev *hdev = container_of(work, struct hci_dev, 1116 mesh_send_done.work); 1117 1118 if (!hci_dev_test_flag(hdev, HCI_MESH_SENDING)) 1119 return; 1120 1121 hci_cmd_sync_queue(hdev, mesh_send_done_sync, NULL, mesh_next); 1122 } 1123 1124 static void mgmt_init_hdev(struct sock *sk, struct hci_dev *hdev) 1125 { 1126 if (hci_dev_test_flag(hdev, HCI_MGMT)) 1127 return; 1128 1129 BT_INFO("MGMT ver %d.%d", MGMT_VERSION, MGMT_REVISION); 1130 1131 INIT_DELAYED_WORK(&hdev->discov_off, discov_off); 1132 INIT_DELAYED_WORK(&hdev->service_cache, service_cache_off); 1133 INIT_DELAYED_WORK(&hdev->rpa_expired, rpa_expired); 1134 INIT_DELAYED_WORK(&hdev->mesh_send_done, mesh_send_done); 1135 1136 /* Non-mgmt controlled devices get this bit set 1137 * implicitly so that pairing works for them, however 1138 * for mgmt we require user-space to explicitly enable 1139 * it 1140 */ 1141 hci_dev_clear_flag(hdev, HCI_BONDABLE); 1142 1143 hci_dev_set_flag(hdev, HCI_MGMT); 1144 } 1145 1146 static int read_controller_info(struct sock *sk, struct hci_dev *hdev, 1147 void *data, u16 data_len) 1148 { 1149 struct mgmt_rp_read_info rp; 1150 1151 bt_dev_dbg(hdev, "sock %p", sk); 1152 1153 hci_dev_lock(hdev); 1154 1155 memset(&rp, 0, sizeof(rp)); 1156 1157 bacpy(&rp.bdaddr, &hdev->bdaddr); 1158 1159 rp.version = hdev->hci_ver; 1160 rp.manufacturer = cpu_to_le16(hdev->manufacturer); 1161 1162 rp.supported_settings = cpu_to_le32(get_supported_settings(hdev)); 1163 rp.current_settings = cpu_to_le32(get_current_settings(hdev)); 1164 1165 memcpy(rp.dev_class, hdev->dev_class, 3); 1166 1167 memcpy(rp.name, hdev->dev_name, sizeof(hdev->dev_name)); 1168 memcpy(rp.short_name, hdev->short_name, sizeof(hdev->short_name)); 1169 1170 hci_dev_unlock(hdev); 1171 1172 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_INFO, 0, &rp, 1173 sizeof(rp)); 1174 } 1175 1176 static u16 append_eir_data_to_buf(struct hci_dev *hdev, u8 *eir) 1177 { 1178 u16 eir_len = 0; 1179 size_t name_len; 1180 1181 if (hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) 1182 eir_len = eir_append_data(eir, eir_len, EIR_CLASS_OF_DEV, 1183 hdev->dev_class, 3); 1184 1185 if (hci_dev_test_flag(hdev, HCI_LE_ENABLED)) 1186 eir_len = eir_append_le16(eir, eir_len, EIR_APPEARANCE, 1187 hdev->appearance); 1188 1189 name_len = strnlen(hdev->dev_name, sizeof(hdev->dev_name)); 1190 eir_len = eir_append_data(eir, eir_len, EIR_NAME_COMPLETE, 1191 hdev->dev_name, name_len); 1192 1193 name_len = strnlen(hdev->short_name, sizeof(hdev->short_name)); 1194 eir_len = eir_append_data(eir, eir_len, EIR_NAME_SHORT, 1195 hdev->short_name, name_len); 1196 1197 return eir_len; 1198 } 1199 1200 static int read_ext_controller_info(struct sock *sk, struct hci_dev *hdev, 1201 void *data, u16 data_len) 1202 { 1203 char buf[512]; 1204 struct mgmt_rp_read_ext_info *rp = (void *)buf; 1205 u16 eir_len; 1206 1207 bt_dev_dbg(hdev, "sock %p", sk); 1208 1209 memset(&buf, 0, sizeof(buf)); 1210 1211 hci_dev_lock(hdev); 1212 1213 bacpy(&rp->bdaddr, &hdev->bdaddr); 1214 1215 rp->version = hdev->hci_ver; 1216 rp->manufacturer = cpu_to_le16(hdev->manufacturer); 1217 1218 rp->supported_settings = cpu_to_le32(get_supported_settings(hdev)); 1219 rp->current_settings = cpu_to_le32(get_current_settings(hdev)); 1220 1221 1222 eir_len = append_eir_data_to_buf(hdev, rp->eir); 1223 rp->eir_len = cpu_to_le16(eir_len); 1224 1225 hci_dev_unlock(hdev); 1226 1227 /* If this command is called at least once, then the events 1228 * for class of device and local name changes are disabled 1229 * and only the new extended controller information event 1230 * is used. 1231 */ 1232 hci_sock_set_flag(sk, HCI_MGMT_EXT_INFO_EVENTS); 1233 hci_sock_clear_flag(sk, HCI_MGMT_DEV_CLASS_EVENTS); 1234 hci_sock_clear_flag(sk, HCI_MGMT_LOCAL_NAME_EVENTS); 1235 1236 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_EXT_INFO, 0, rp, 1237 sizeof(*rp) + eir_len); 1238 } 1239 1240 static int ext_info_changed(struct hci_dev *hdev, struct sock *skip) 1241 { 1242 char buf[512]; 1243 struct mgmt_ev_ext_info_changed *ev = (void *)buf; 1244 u16 eir_len; 1245 1246 memset(buf, 0, sizeof(buf)); 1247 1248 eir_len = append_eir_data_to_buf(hdev, ev->eir); 1249 ev->eir_len = cpu_to_le16(eir_len); 1250 1251 return mgmt_limited_event(MGMT_EV_EXT_INFO_CHANGED, hdev, ev, 1252 sizeof(*ev) + eir_len, 1253 HCI_MGMT_EXT_INFO_EVENTS, skip); 1254 } 1255 1256 static int send_settings_rsp(struct sock *sk, u16 opcode, struct hci_dev *hdev) 1257 { 1258 __le32 settings = cpu_to_le32(get_current_settings(hdev)); 1259 1260 return mgmt_cmd_complete(sk, hdev->id, opcode, 0, &settings, 1261 sizeof(settings)); 1262 } 1263 1264 void mgmt_advertising_added(struct sock *sk, struct hci_dev *hdev, u8 instance) 1265 { 1266 struct mgmt_ev_advertising_added ev; 1267 1268 ev.instance = instance; 1269 1270 mgmt_event(MGMT_EV_ADVERTISING_ADDED, hdev, &ev, sizeof(ev), sk); 1271 } 1272 1273 void mgmt_advertising_removed(struct sock *sk, struct hci_dev *hdev, 1274 u8 instance) 1275 { 1276 struct mgmt_ev_advertising_removed ev; 1277 1278 ev.instance = instance; 1279 1280 mgmt_event(MGMT_EV_ADVERTISING_REMOVED, hdev, &ev, sizeof(ev), sk); 1281 } 1282 1283 static void cancel_adv_timeout(struct hci_dev *hdev) 1284 { 1285 if (hdev->adv_instance_timeout) { 1286 hdev->adv_instance_timeout = 0; 1287 cancel_delayed_work(&hdev->adv_instance_expire); 1288 } 1289 } 1290 1291 /* This function requires the caller holds hdev->lock */ 1292 static void restart_le_actions(struct hci_dev *hdev) 1293 { 1294 struct hci_conn_params *p; 1295 1296 list_for_each_entry(p, &hdev->le_conn_params, list) { 1297 /* Needed for AUTO_OFF case where might not "really" 1298 * have been powered off. 1299 */ 1300 list_del_init(&p->action); 1301 1302 switch (p->auto_connect) { 1303 case HCI_AUTO_CONN_DIRECT: 1304 case HCI_AUTO_CONN_ALWAYS: 1305 list_add(&p->action, &hdev->pend_le_conns); 1306 break; 1307 case HCI_AUTO_CONN_REPORT: 1308 list_add(&p->action, &hdev->pend_le_reports); 1309 break; 1310 default: 1311 break; 1312 } 1313 } 1314 } 1315 1316 static int new_settings(struct hci_dev *hdev, struct sock *skip) 1317 { 1318 __le32 ev = cpu_to_le32(get_current_settings(hdev)); 1319 1320 return mgmt_limited_event(MGMT_EV_NEW_SETTINGS, hdev, &ev, 1321 sizeof(ev), HCI_MGMT_SETTING_EVENTS, skip); 1322 } 1323 1324 static void mgmt_set_powered_complete(struct hci_dev *hdev, void *data, int err) 1325 { 1326 struct mgmt_pending_cmd *cmd = data; 1327 struct mgmt_mode *cp; 1328 1329 /* Make sure cmd still outstanding. */ 1330 if (cmd != pending_find(MGMT_OP_SET_POWERED, hdev)) 1331 return; 1332 1333 cp = cmd->param; 1334 1335 bt_dev_dbg(hdev, "err %d", err); 1336 1337 if (!err) { 1338 if (cp->val) { 1339 hci_dev_lock(hdev); 1340 restart_le_actions(hdev); 1341 hci_update_passive_scan(hdev); 1342 hci_dev_unlock(hdev); 1343 } 1344 1345 send_settings_rsp(cmd->sk, cmd->opcode, hdev); 1346 1347 /* Only call new_setting for power on as power off is deferred 1348 * to hdev->power_off work which does call hci_dev_do_close. 1349 */ 1350 if (cp->val) 1351 new_settings(hdev, cmd->sk); 1352 } else { 1353 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_POWERED, 1354 mgmt_status(err)); 1355 } 1356 1357 mgmt_pending_remove(cmd); 1358 } 1359 1360 static int set_powered_sync(struct hci_dev *hdev, void *data) 1361 { 1362 struct mgmt_pending_cmd *cmd = data; 1363 struct mgmt_mode *cp = cmd->param; 1364 1365 BT_DBG("%s", hdev->name); 1366 1367 return hci_set_powered_sync(hdev, cp->val); 1368 } 1369 1370 static int set_powered(struct sock *sk, struct hci_dev *hdev, void *data, 1371 u16 len) 1372 { 1373 struct mgmt_mode *cp = data; 1374 struct mgmt_pending_cmd *cmd; 1375 int err; 1376 1377 bt_dev_dbg(hdev, "sock %p", sk); 1378 1379 if (cp->val != 0x00 && cp->val != 0x01) 1380 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED, 1381 MGMT_STATUS_INVALID_PARAMS); 1382 1383 hci_dev_lock(hdev); 1384 1385 if (pending_find(MGMT_OP_SET_POWERED, hdev)) { 1386 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED, 1387 MGMT_STATUS_BUSY); 1388 goto failed; 1389 } 1390 1391 if (!!cp->val == hdev_is_powered(hdev)) { 1392 err = send_settings_rsp(sk, MGMT_OP_SET_POWERED, hdev); 1393 goto failed; 1394 } 1395 1396 cmd = mgmt_pending_add(sk, MGMT_OP_SET_POWERED, hdev, data, len); 1397 if (!cmd) { 1398 err = -ENOMEM; 1399 goto failed; 1400 } 1401 1402 err = hci_cmd_sync_queue(hdev, set_powered_sync, cmd, 1403 mgmt_set_powered_complete); 1404 1405 if (err < 0) 1406 mgmt_pending_remove(cmd); 1407 1408 failed: 1409 hci_dev_unlock(hdev); 1410 return err; 1411 } 1412 1413 int mgmt_new_settings(struct hci_dev *hdev) 1414 { 1415 return new_settings(hdev, NULL); 1416 } 1417 1418 struct cmd_lookup { 1419 struct sock *sk; 1420 struct hci_dev *hdev; 1421 u8 mgmt_status; 1422 }; 1423 1424 static void settings_rsp(struct mgmt_pending_cmd *cmd, void *data) 1425 { 1426 struct cmd_lookup *match = data; 1427 1428 send_settings_rsp(cmd->sk, cmd->opcode, match->hdev); 1429 1430 list_del(&cmd->list); 1431 1432 if (match->sk == NULL) { 1433 match->sk = cmd->sk; 1434 sock_hold(match->sk); 1435 } 1436 1437 mgmt_pending_free(cmd); 1438 } 1439 1440 static void cmd_status_rsp(struct mgmt_pending_cmd *cmd, void *data) 1441 { 1442 u8 *status = data; 1443 1444 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, *status); 1445 mgmt_pending_remove(cmd); 1446 } 1447 1448 static void cmd_complete_rsp(struct mgmt_pending_cmd *cmd, void *data) 1449 { 1450 if (cmd->cmd_complete) { 1451 u8 *status = data; 1452 1453 cmd->cmd_complete(cmd, *status); 1454 mgmt_pending_remove(cmd); 1455 1456 return; 1457 } 1458 1459 cmd_status_rsp(cmd, data); 1460 } 1461 1462 static int generic_cmd_complete(struct mgmt_pending_cmd *cmd, u8 status) 1463 { 1464 return mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, status, 1465 cmd->param, cmd->param_len); 1466 } 1467 1468 static int addr_cmd_complete(struct mgmt_pending_cmd *cmd, u8 status) 1469 { 1470 return mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, status, 1471 cmd->param, sizeof(struct mgmt_addr_info)); 1472 } 1473 1474 static u8 mgmt_bredr_support(struct hci_dev *hdev) 1475 { 1476 if (!lmp_bredr_capable(hdev)) 1477 return MGMT_STATUS_NOT_SUPPORTED; 1478 else if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) 1479 return MGMT_STATUS_REJECTED; 1480 else 1481 return MGMT_STATUS_SUCCESS; 1482 } 1483 1484 static u8 mgmt_le_support(struct hci_dev *hdev) 1485 { 1486 if (!lmp_le_capable(hdev)) 1487 return MGMT_STATUS_NOT_SUPPORTED; 1488 else if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED)) 1489 return MGMT_STATUS_REJECTED; 1490 else 1491 return MGMT_STATUS_SUCCESS; 1492 } 1493 1494 static void mgmt_set_discoverable_complete(struct hci_dev *hdev, void *data, 1495 int err) 1496 { 1497 struct mgmt_pending_cmd *cmd = data; 1498 1499 bt_dev_dbg(hdev, "err %d", err); 1500 1501 /* Make sure cmd still outstanding. */ 1502 if (cmd != pending_find(MGMT_OP_SET_DISCOVERABLE, hdev)) 1503 return; 1504 1505 hci_dev_lock(hdev); 1506 1507 if (err) { 1508 u8 mgmt_err = mgmt_status(err); 1509 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err); 1510 hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE); 1511 goto done; 1512 } 1513 1514 if (hci_dev_test_flag(hdev, HCI_DISCOVERABLE) && 1515 hdev->discov_timeout > 0) { 1516 int to = msecs_to_jiffies(hdev->discov_timeout * 1000); 1517 queue_delayed_work(hdev->req_workqueue, &hdev->discov_off, to); 1518 } 1519 1520 send_settings_rsp(cmd->sk, MGMT_OP_SET_DISCOVERABLE, hdev); 1521 new_settings(hdev, cmd->sk); 1522 1523 done: 1524 mgmt_pending_remove(cmd); 1525 hci_dev_unlock(hdev); 1526 } 1527 1528 static int set_discoverable_sync(struct hci_dev *hdev, void *data) 1529 { 1530 BT_DBG("%s", hdev->name); 1531 1532 return hci_update_discoverable_sync(hdev); 1533 } 1534 1535 static int set_discoverable(struct sock *sk, struct hci_dev *hdev, void *data, 1536 u16 len) 1537 { 1538 struct mgmt_cp_set_discoverable *cp = data; 1539 struct mgmt_pending_cmd *cmd; 1540 u16 timeout; 1541 int err; 1542 1543 bt_dev_dbg(hdev, "sock %p", sk); 1544 1545 if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED) && 1546 !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) 1547 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE, 1548 MGMT_STATUS_REJECTED); 1549 1550 if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02) 1551 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE, 1552 MGMT_STATUS_INVALID_PARAMS); 1553 1554 timeout = __le16_to_cpu(cp->timeout); 1555 1556 /* Disabling discoverable requires that no timeout is set, 1557 * and enabling limited discoverable requires a timeout. 1558 */ 1559 if ((cp->val == 0x00 && timeout > 0) || 1560 (cp->val == 0x02 && timeout == 0)) 1561 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE, 1562 MGMT_STATUS_INVALID_PARAMS); 1563 1564 hci_dev_lock(hdev); 1565 1566 if (!hdev_is_powered(hdev) && timeout > 0) { 1567 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE, 1568 MGMT_STATUS_NOT_POWERED); 1569 goto failed; 1570 } 1571 1572 if (pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) || 1573 pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) { 1574 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE, 1575 MGMT_STATUS_BUSY); 1576 goto failed; 1577 } 1578 1579 if (!hci_dev_test_flag(hdev, HCI_CONNECTABLE)) { 1580 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE, 1581 MGMT_STATUS_REJECTED); 1582 goto failed; 1583 } 1584 1585 if (hdev->advertising_paused) { 1586 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE, 1587 MGMT_STATUS_BUSY); 1588 goto failed; 1589 } 1590 1591 if (!hdev_is_powered(hdev)) { 1592 bool changed = false; 1593 1594 /* Setting limited discoverable when powered off is 1595 * not a valid operation since it requires a timeout 1596 * and so no need to check HCI_LIMITED_DISCOVERABLE. 1597 */ 1598 if (!!cp->val != hci_dev_test_flag(hdev, HCI_DISCOVERABLE)) { 1599 hci_dev_change_flag(hdev, HCI_DISCOVERABLE); 1600 changed = true; 1601 } 1602 1603 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev); 1604 if (err < 0) 1605 goto failed; 1606 1607 if (changed) 1608 err = new_settings(hdev, sk); 1609 1610 goto failed; 1611 } 1612 1613 /* If the current mode is the same, then just update the timeout 1614 * value with the new value. And if only the timeout gets updated, 1615 * then no need for any HCI transactions. 1616 */ 1617 if (!!cp->val == hci_dev_test_flag(hdev, HCI_DISCOVERABLE) && 1618 (cp->val == 0x02) == hci_dev_test_flag(hdev, 1619 HCI_LIMITED_DISCOVERABLE)) { 1620 cancel_delayed_work(&hdev->discov_off); 1621 hdev->discov_timeout = timeout; 1622 1623 if (cp->val && hdev->discov_timeout > 0) { 1624 int to = msecs_to_jiffies(hdev->discov_timeout * 1000); 1625 queue_delayed_work(hdev->req_workqueue, 1626 &hdev->discov_off, to); 1627 } 1628 1629 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev); 1630 goto failed; 1631 } 1632 1633 cmd = mgmt_pending_add(sk, MGMT_OP_SET_DISCOVERABLE, hdev, data, len); 1634 if (!cmd) { 1635 err = -ENOMEM; 1636 goto failed; 1637 } 1638 1639 /* Cancel any potential discoverable timeout that might be 1640 * still active and store new timeout value. The arming of 1641 * the timeout happens in the complete handler. 1642 */ 1643 cancel_delayed_work(&hdev->discov_off); 1644 hdev->discov_timeout = timeout; 1645 1646 if (cp->val) 1647 hci_dev_set_flag(hdev, HCI_DISCOVERABLE); 1648 else 1649 hci_dev_clear_flag(hdev, HCI_DISCOVERABLE); 1650 1651 /* Limited discoverable mode */ 1652 if (cp->val == 0x02) 1653 hci_dev_set_flag(hdev, HCI_LIMITED_DISCOVERABLE); 1654 else 1655 hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE); 1656 1657 err = hci_cmd_sync_queue(hdev, set_discoverable_sync, cmd, 1658 mgmt_set_discoverable_complete); 1659 1660 if (err < 0) 1661 mgmt_pending_remove(cmd); 1662 1663 failed: 1664 hci_dev_unlock(hdev); 1665 return err; 1666 } 1667 1668 static void mgmt_set_connectable_complete(struct hci_dev *hdev, void *data, 1669 int err) 1670 { 1671 struct mgmt_pending_cmd *cmd = data; 1672 1673 bt_dev_dbg(hdev, "err %d", err); 1674 1675 /* Make sure cmd still outstanding. */ 1676 if (cmd != pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) 1677 return; 1678 1679 hci_dev_lock(hdev); 1680 1681 if (err) { 1682 u8 mgmt_err = mgmt_status(err); 1683 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err); 1684 goto done; 1685 } 1686 1687 send_settings_rsp(cmd->sk, MGMT_OP_SET_CONNECTABLE, hdev); 1688 new_settings(hdev, cmd->sk); 1689 1690 done: 1691 if (cmd) 1692 mgmt_pending_remove(cmd); 1693 1694 hci_dev_unlock(hdev); 1695 } 1696 1697 static int set_connectable_update_settings(struct hci_dev *hdev, 1698 struct sock *sk, u8 val) 1699 { 1700 bool changed = false; 1701 int err; 1702 1703 if (!!val != hci_dev_test_flag(hdev, HCI_CONNECTABLE)) 1704 changed = true; 1705 1706 if (val) { 1707 hci_dev_set_flag(hdev, HCI_CONNECTABLE); 1708 } else { 1709 hci_dev_clear_flag(hdev, HCI_CONNECTABLE); 1710 hci_dev_clear_flag(hdev, HCI_DISCOVERABLE); 1711 } 1712 1713 err = send_settings_rsp(sk, MGMT_OP_SET_CONNECTABLE, hdev); 1714 if (err < 0) 1715 return err; 1716 1717 if (changed) { 1718 hci_update_scan(hdev); 1719 hci_update_passive_scan(hdev); 1720 return new_settings(hdev, sk); 1721 } 1722 1723 return 0; 1724 } 1725 1726 static int set_connectable_sync(struct hci_dev *hdev, void *data) 1727 { 1728 BT_DBG("%s", hdev->name); 1729 1730 return hci_update_connectable_sync(hdev); 1731 } 1732 1733 static int set_connectable(struct sock *sk, struct hci_dev *hdev, void *data, 1734 u16 len) 1735 { 1736 struct mgmt_mode *cp = data; 1737 struct mgmt_pending_cmd *cmd; 1738 int err; 1739 1740 bt_dev_dbg(hdev, "sock %p", sk); 1741 1742 if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED) && 1743 !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) 1744 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE, 1745 MGMT_STATUS_REJECTED); 1746 1747 if (cp->val != 0x00 && cp->val != 0x01) 1748 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE, 1749 MGMT_STATUS_INVALID_PARAMS); 1750 1751 hci_dev_lock(hdev); 1752 1753 if (!hdev_is_powered(hdev)) { 1754 err = set_connectable_update_settings(hdev, sk, cp->val); 1755 goto failed; 1756 } 1757 1758 if (pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) || 1759 pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) { 1760 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE, 1761 MGMT_STATUS_BUSY); 1762 goto failed; 1763 } 1764 1765 cmd = mgmt_pending_add(sk, MGMT_OP_SET_CONNECTABLE, hdev, data, len); 1766 if (!cmd) { 1767 err = -ENOMEM; 1768 goto failed; 1769 } 1770 1771 if (cp->val) { 1772 hci_dev_set_flag(hdev, HCI_CONNECTABLE); 1773 } else { 1774 if (hdev->discov_timeout > 0) 1775 cancel_delayed_work(&hdev->discov_off); 1776 1777 hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE); 1778 hci_dev_clear_flag(hdev, HCI_DISCOVERABLE); 1779 hci_dev_clear_flag(hdev, HCI_CONNECTABLE); 1780 } 1781 1782 err = hci_cmd_sync_queue(hdev, set_connectable_sync, cmd, 1783 mgmt_set_connectable_complete); 1784 1785 if (err < 0) 1786 mgmt_pending_remove(cmd); 1787 1788 failed: 1789 hci_dev_unlock(hdev); 1790 return err; 1791 } 1792 1793 static int set_bondable(struct sock *sk, struct hci_dev *hdev, void *data, 1794 u16 len) 1795 { 1796 struct mgmt_mode *cp = data; 1797 bool changed; 1798 int err; 1799 1800 bt_dev_dbg(hdev, "sock %p", sk); 1801 1802 if (cp->val != 0x00 && cp->val != 0x01) 1803 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BONDABLE, 1804 MGMT_STATUS_INVALID_PARAMS); 1805 1806 hci_dev_lock(hdev); 1807 1808 if (cp->val) 1809 changed = !hci_dev_test_and_set_flag(hdev, HCI_BONDABLE); 1810 else 1811 changed = hci_dev_test_and_clear_flag(hdev, HCI_BONDABLE); 1812 1813 err = send_settings_rsp(sk, MGMT_OP_SET_BONDABLE, hdev); 1814 if (err < 0) 1815 goto unlock; 1816 1817 if (changed) { 1818 /* In limited privacy mode the change of bondable mode 1819 * may affect the local advertising address. 1820 */ 1821 hci_update_discoverable(hdev); 1822 1823 err = new_settings(hdev, sk); 1824 } 1825 1826 unlock: 1827 hci_dev_unlock(hdev); 1828 return err; 1829 } 1830 1831 static int set_link_security(struct sock *sk, struct hci_dev *hdev, void *data, 1832 u16 len) 1833 { 1834 struct mgmt_mode *cp = data; 1835 struct mgmt_pending_cmd *cmd; 1836 u8 val, status; 1837 int err; 1838 1839 bt_dev_dbg(hdev, "sock %p", sk); 1840 1841 status = mgmt_bredr_support(hdev); 1842 if (status) 1843 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY, 1844 status); 1845 1846 if (cp->val != 0x00 && cp->val != 0x01) 1847 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY, 1848 MGMT_STATUS_INVALID_PARAMS); 1849 1850 hci_dev_lock(hdev); 1851 1852 if (!hdev_is_powered(hdev)) { 1853 bool changed = false; 1854 1855 if (!!cp->val != hci_dev_test_flag(hdev, HCI_LINK_SECURITY)) { 1856 hci_dev_change_flag(hdev, HCI_LINK_SECURITY); 1857 changed = true; 1858 } 1859 1860 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev); 1861 if (err < 0) 1862 goto failed; 1863 1864 if (changed) 1865 err = new_settings(hdev, sk); 1866 1867 goto failed; 1868 } 1869 1870 if (pending_find(MGMT_OP_SET_LINK_SECURITY, hdev)) { 1871 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY, 1872 MGMT_STATUS_BUSY); 1873 goto failed; 1874 } 1875 1876 val = !!cp->val; 1877 1878 if (test_bit(HCI_AUTH, &hdev->flags) == val) { 1879 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev); 1880 goto failed; 1881 } 1882 1883 cmd = mgmt_pending_add(sk, MGMT_OP_SET_LINK_SECURITY, hdev, data, len); 1884 if (!cmd) { 1885 err = -ENOMEM; 1886 goto failed; 1887 } 1888 1889 err = hci_send_cmd(hdev, HCI_OP_WRITE_AUTH_ENABLE, sizeof(val), &val); 1890 if (err < 0) { 1891 mgmt_pending_remove(cmd); 1892 goto failed; 1893 } 1894 1895 failed: 1896 hci_dev_unlock(hdev); 1897 return err; 1898 } 1899 1900 static void set_ssp_complete(struct hci_dev *hdev, void *data, int err) 1901 { 1902 struct cmd_lookup match = { NULL, hdev }; 1903 struct mgmt_pending_cmd *cmd = data; 1904 struct mgmt_mode *cp = cmd->param; 1905 u8 enable = cp->val; 1906 bool changed; 1907 1908 /* Make sure cmd still outstanding. */ 1909 if (cmd != pending_find(MGMT_OP_SET_SSP, hdev)) 1910 return; 1911 1912 if (err) { 1913 u8 mgmt_err = mgmt_status(err); 1914 1915 if (enable && hci_dev_test_and_clear_flag(hdev, 1916 HCI_SSP_ENABLED)) { 1917 hci_dev_clear_flag(hdev, HCI_HS_ENABLED); 1918 new_settings(hdev, NULL); 1919 } 1920 1921 mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev, cmd_status_rsp, 1922 &mgmt_err); 1923 return; 1924 } 1925 1926 if (enable) { 1927 changed = !hci_dev_test_and_set_flag(hdev, HCI_SSP_ENABLED); 1928 } else { 1929 changed = hci_dev_test_and_clear_flag(hdev, HCI_SSP_ENABLED); 1930 1931 if (!changed) 1932 changed = hci_dev_test_and_clear_flag(hdev, 1933 HCI_HS_ENABLED); 1934 else 1935 hci_dev_clear_flag(hdev, HCI_HS_ENABLED); 1936 } 1937 1938 mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev, settings_rsp, &match); 1939 1940 if (changed) 1941 new_settings(hdev, match.sk); 1942 1943 if (match.sk) 1944 sock_put(match.sk); 1945 1946 hci_update_eir_sync(hdev); 1947 } 1948 1949 static int set_ssp_sync(struct hci_dev *hdev, void *data) 1950 { 1951 struct mgmt_pending_cmd *cmd = data; 1952 struct mgmt_mode *cp = cmd->param; 1953 bool changed = false; 1954 int err; 1955 1956 if (cp->val) 1957 changed = !hci_dev_test_and_set_flag(hdev, HCI_SSP_ENABLED); 1958 1959 err = hci_write_ssp_mode_sync(hdev, cp->val); 1960 1961 if (!err && changed) 1962 hci_dev_clear_flag(hdev, HCI_SSP_ENABLED); 1963 1964 return err; 1965 } 1966 1967 static int set_ssp(struct sock *sk, struct hci_dev *hdev, void *data, u16 len) 1968 { 1969 struct mgmt_mode *cp = data; 1970 struct mgmt_pending_cmd *cmd; 1971 u8 status; 1972 int err; 1973 1974 bt_dev_dbg(hdev, "sock %p", sk); 1975 1976 status = mgmt_bredr_support(hdev); 1977 if (status) 1978 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP, status); 1979 1980 if (!lmp_ssp_capable(hdev)) 1981 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP, 1982 MGMT_STATUS_NOT_SUPPORTED); 1983 1984 if (cp->val != 0x00 && cp->val != 0x01) 1985 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP, 1986 MGMT_STATUS_INVALID_PARAMS); 1987 1988 hci_dev_lock(hdev); 1989 1990 if (!hdev_is_powered(hdev)) { 1991 bool changed; 1992 1993 if (cp->val) { 1994 changed = !hci_dev_test_and_set_flag(hdev, 1995 HCI_SSP_ENABLED); 1996 } else { 1997 changed = hci_dev_test_and_clear_flag(hdev, 1998 HCI_SSP_ENABLED); 1999 if (!changed) 2000 changed = hci_dev_test_and_clear_flag(hdev, 2001 HCI_HS_ENABLED); 2002 else 2003 hci_dev_clear_flag(hdev, HCI_HS_ENABLED); 2004 } 2005 2006 err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev); 2007 if (err < 0) 2008 goto failed; 2009 2010 if (changed) 2011 err = new_settings(hdev, sk); 2012 2013 goto failed; 2014 } 2015 2016 if (pending_find(MGMT_OP_SET_SSP, hdev)) { 2017 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP, 2018 MGMT_STATUS_BUSY); 2019 goto failed; 2020 } 2021 2022 if (!!cp->val == hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) { 2023 err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev); 2024 goto failed; 2025 } 2026 2027 cmd = mgmt_pending_add(sk, MGMT_OP_SET_SSP, hdev, data, len); 2028 if (!cmd) 2029 err = -ENOMEM; 2030 else 2031 err = hci_cmd_sync_queue(hdev, set_ssp_sync, cmd, 2032 set_ssp_complete); 2033 2034 if (err < 0) { 2035 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP, 2036 MGMT_STATUS_FAILED); 2037 2038 if (cmd) 2039 mgmt_pending_remove(cmd); 2040 } 2041 2042 failed: 2043 hci_dev_unlock(hdev); 2044 return err; 2045 } 2046 2047 static int set_hs(struct sock *sk, struct hci_dev *hdev, void *data, u16 len) 2048 { 2049 struct mgmt_mode *cp = data; 2050 bool changed; 2051 u8 status; 2052 int err; 2053 2054 bt_dev_dbg(hdev, "sock %p", sk); 2055 2056 if (!IS_ENABLED(CONFIG_BT_HS)) 2057 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS, 2058 MGMT_STATUS_NOT_SUPPORTED); 2059 2060 status = mgmt_bredr_support(hdev); 2061 if (status) 2062 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS, status); 2063 2064 if (!lmp_ssp_capable(hdev)) 2065 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS, 2066 MGMT_STATUS_NOT_SUPPORTED); 2067 2068 if (!hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) 2069 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS, 2070 MGMT_STATUS_REJECTED); 2071 2072 if (cp->val != 0x00 && cp->val != 0x01) 2073 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS, 2074 MGMT_STATUS_INVALID_PARAMS); 2075 2076 hci_dev_lock(hdev); 2077 2078 if (pending_find(MGMT_OP_SET_SSP, hdev)) { 2079 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS, 2080 MGMT_STATUS_BUSY); 2081 goto unlock; 2082 } 2083 2084 if (cp->val) { 2085 changed = !hci_dev_test_and_set_flag(hdev, HCI_HS_ENABLED); 2086 } else { 2087 if (hdev_is_powered(hdev)) { 2088 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS, 2089 MGMT_STATUS_REJECTED); 2090 goto unlock; 2091 } 2092 2093 changed = hci_dev_test_and_clear_flag(hdev, HCI_HS_ENABLED); 2094 } 2095 2096 err = send_settings_rsp(sk, MGMT_OP_SET_HS, hdev); 2097 if (err < 0) 2098 goto unlock; 2099 2100 if (changed) 2101 err = new_settings(hdev, sk); 2102 2103 unlock: 2104 hci_dev_unlock(hdev); 2105 return err; 2106 } 2107 2108 static void set_le_complete(struct hci_dev *hdev, void *data, int err) 2109 { 2110 struct cmd_lookup match = { NULL, hdev }; 2111 u8 status = mgmt_status(err); 2112 2113 bt_dev_dbg(hdev, "err %d", err); 2114 2115 if (status) { 2116 mgmt_pending_foreach(MGMT_OP_SET_LE, hdev, cmd_status_rsp, 2117 &status); 2118 return; 2119 } 2120 2121 mgmt_pending_foreach(MGMT_OP_SET_LE, hdev, settings_rsp, &match); 2122 2123 new_settings(hdev, match.sk); 2124 2125 if (match.sk) 2126 sock_put(match.sk); 2127 } 2128 2129 static int set_le_sync(struct hci_dev *hdev, void *data) 2130 { 2131 struct mgmt_pending_cmd *cmd = data; 2132 struct mgmt_mode *cp = cmd->param; 2133 u8 val = !!cp->val; 2134 int err; 2135 2136 if (!val) { 2137 hci_clear_adv_instance_sync(hdev, NULL, 0x00, true); 2138 2139 if (hci_dev_test_flag(hdev, HCI_LE_ADV)) 2140 hci_disable_advertising_sync(hdev); 2141 2142 if (ext_adv_capable(hdev)) 2143 hci_remove_ext_adv_instance_sync(hdev, 0, cmd->sk); 2144 } else { 2145 hci_dev_set_flag(hdev, HCI_LE_ENABLED); 2146 } 2147 2148 err = hci_write_le_host_supported_sync(hdev, val, 0); 2149 2150 /* Make sure the controller has a good default for 2151 * advertising data. Restrict the update to when LE 2152 * has actually been enabled. During power on, the 2153 * update in powered_update_hci will take care of it. 2154 */ 2155 if (!err && hci_dev_test_flag(hdev, HCI_LE_ENABLED)) { 2156 if (ext_adv_capable(hdev)) { 2157 int status; 2158 2159 status = hci_setup_ext_adv_instance_sync(hdev, 0x00); 2160 if (!status) 2161 hci_update_scan_rsp_data_sync(hdev, 0x00); 2162 } else { 2163 hci_update_adv_data_sync(hdev, 0x00); 2164 hci_update_scan_rsp_data_sync(hdev, 0x00); 2165 } 2166 2167 hci_update_passive_scan(hdev); 2168 } 2169 2170 return err; 2171 } 2172 2173 static void set_mesh_complete(struct hci_dev *hdev, void *data, int err) 2174 { 2175 struct mgmt_pending_cmd *cmd = data; 2176 u8 status = mgmt_status(err); 2177 struct sock *sk = cmd->sk; 2178 2179 if (status) { 2180 mgmt_pending_foreach(MGMT_OP_SET_MESH_RECEIVER, hdev, 2181 cmd_status_rsp, &status); 2182 return; 2183 } 2184 2185 mgmt_pending_remove(cmd); 2186 mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_MESH_RECEIVER, 0, NULL, 0); 2187 } 2188 2189 static int set_mesh_sync(struct hci_dev *hdev, void *data) 2190 { 2191 struct mgmt_pending_cmd *cmd = data; 2192 struct mgmt_cp_set_mesh *cp = cmd->param; 2193 size_t len = cmd->param_len; 2194 2195 memset(hdev->mesh_ad_types, 0, sizeof(hdev->mesh_ad_types)); 2196 2197 if (cp->enable) 2198 hci_dev_set_flag(hdev, HCI_MESH); 2199 else 2200 hci_dev_clear_flag(hdev, HCI_MESH); 2201 2202 len -= sizeof(*cp); 2203 2204 /* If filters don't fit, forward all adv pkts */ 2205 if (len <= sizeof(hdev->mesh_ad_types)) 2206 memcpy(hdev->mesh_ad_types, cp->ad_types, len); 2207 2208 hci_update_passive_scan_sync(hdev); 2209 return 0; 2210 } 2211 2212 static int set_mesh(struct sock *sk, struct hci_dev *hdev, void *data, u16 len) 2213 { 2214 struct mgmt_cp_set_mesh *cp = data; 2215 struct mgmt_pending_cmd *cmd; 2216 int err = 0; 2217 2218 bt_dev_dbg(hdev, "sock %p", sk); 2219 2220 if (!lmp_le_capable(hdev) || 2221 !hci_dev_test_flag(hdev, HCI_MESH_EXPERIMENTAL)) 2222 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_MESH_RECEIVER, 2223 MGMT_STATUS_NOT_SUPPORTED); 2224 2225 if (cp->enable != 0x00 && cp->enable != 0x01) 2226 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_MESH_RECEIVER, 2227 MGMT_STATUS_INVALID_PARAMS); 2228 2229 hci_dev_lock(hdev); 2230 2231 cmd = mgmt_pending_add(sk, MGMT_OP_SET_MESH_RECEIVER, hdev, data, len); 2232 if (!cmd) 2233 err = -ENOMEM; 2234 else 2235 err = hci_cmd_sync_queue(hdev, set_mesh_sync, cmd, 2236 set_mesh_complete); 2237 2238 if (err < 0) { 2239 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_MESH_RECEIVER, 2240 MGMT_STATUS_FAILED); 2241 2242 if (cmd) 2243 mgmt_pending_remove(cmd); 2244 } 2245 2246 hci_dev_unlock(hdev); 2247 return err; 2248 } 2249 2250 static void mesh_send_start_complete(struct hci_dev *hdev, void *data, int err) 2251 { 2252 struct mgmt_mesh_tx *mesh_tx = data; 2253 struct mgmt_cp_mesh_send *send = (void *)mesh_tx->param; 2254 unsigned long mesh_send_interval; 2255 u8 mgmt_err = mgmt_status(err); 2256 2257 /* Report any errors here, but don't report completion */ 2258 2259 if (mgmt_err) { 2260 hci_dev_clear_flag(hdev, HCI_MESH_SENDING); 2261 /* Send Complete Error Code for handle */ 2262 mesh_send_complete(hdev, mesh_tx, false); 2263 return; 2264 } 2265 2266 mesh_send_interval = msecs_to_jiffies((send->cnt) * 25); 2267 queue_delayed_work(hdev->req_workqueue, &hdev->mesh_send_done, 2268 mesh_send_interval); 2269 } 2270 2271 static int mesh_send_sync(struct hci_dev *hdev, void *data) 2272 { 2273 struct mgmt_mesh_tx *mesh_tx = data; 2274 struct mgmt_cp_mesh_send *send = (void *)mesh_tx->param; 2275 struct adv_info *adv, *next_instance; 2276 u8 instance = hdev->le_num_of_adv_sets + 1; 2277 u16 timeout, duration; 2278 int err = 0; 2279 2280 if (hdev->le_num_of_adv_sets <= hdev->adv_instance_cnt) 2281 return MGMT_STATUS_BUSY; 2282 2283 timeout = 1000; 2284 duration = send->cnt * INTERVAL_TO_MS(hdev->le_adv_max_interval); 2285 adv = hci_add_adv_instance(hdev, instance, 0, 2286 send->adv_data_len, send->adv_data, 2287 0, NULL, 2288 timeout, duration, 2289 HCI_ADV_TX_POWER_NO_PREFERENCE, 2290 hdev->le_adv_min_interval, 2291 hdev->le_adv_max_interval, 2292 mesh_tx->handle); 2293 2294 if (!IS_ERR(adv)) 2295 mesh_tx->instance = instance; 2296 else 2297 err = PTR_ERR(adv); 2298 2299 if (hdev->cur_adv_instance == instance) { 2300 /* If the currently advertised instance is being changed then 2301 * cancel the current advertising and schedule the next 2302 * instance. If there is only one instance then the overridden 2303 * advertising data will be visible right away. 2304 */ 2305 cancel_adv_timeout(hdev); 2306 2307 next_instance = hci_get_next_instance(hdev, instance); 2308 if (next_instance) 2309 instance = next_instance->instance; 2310 else 2311 instance = 0; 2312 } else if (hdev->adv_instance_timeout) { 2313 /* Immediately advertise the new instance if no other, or 2314 * let it go naturally from queue if ADV is already happening 2315 */ 2316 instance = 0; 2317 } 2318 2319 if (instance) 2320 return hci_schedule_adv_instance_sync(hdev, instance, true); 2321 2322 return err; 2323 } 2324 2325 static void send_count(struct mgmt_mesh_tx *mesh_tx, void *data) 2326 { 2327 struct mgmt_rp_mesh_read_features *rp = data; 2328 2329 if (rp->used_handles >= rp->max_handles) 2330 return; 2331 2332 rp->handles[rp->used_handles++] = mesh_tx->handle; 2333 } 2334 2335 static int mesh_features(struct sock *sk, struct hci_dev *hdev, 2336 void *data, u16 len) 2337 { 2338 struct mgmt_rp_mesh_read_features rp; 2339 2340 if (!lmp_le_capable(hdev) || 2341 !hci_dev_test_flag(hdev, HCI_MESH_EXPERIMENTAL)) 2342 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_MESH_READ_FEATURES, 2343 MGMT_STATUS_NOT_SUPPORTED); 2344 2345 memset(&rp, 0, sizeof(rp)); 2346 rp.index = cpu_to_le16(hdev->id); 2347 if (hci_dev_test_flag(hdev, HCI_LE_ENABLED)) 2348 rp.max_handles = MESH_HANDLES_MAX; 2349 2350 hci_dev_lock(hdev); 2351 2352 if (rp.max_handles) 2353 mgmt_mesh_foreach(hdev, send_count, &rp, sk); 2354 2355 mgmt_cmd_complete(sk, hdev->id, MGMT_OP_MESH_READ_FEATURES, 0, &rp, 2356 rp.used_handles + sizeof(rp) - MESH_HANDLES_MAX); 2357 2358 hci_dev_unlock(hdev); 2359 return 0; 2360 } 2361 2362 static int send_cancel(struct hci_dev *hdev, void *data) 2363 { 2364 struct mgmt_pending_cmd *cmd = data; 2365 struct mgmt_cp_mesh_send_cancel *cancel = (void *)cmd->param; 2366 struct mgmt_mesh_tx *mesh_tx; 2367 2368 if (!cancel->handle) { 2369 do { 2370 mesh_tx = mgmt_mesh_next(hdev, cmd->sk); 2371 2372 if (mesh_tx) 2373 mesh_send_complete(hdev, mesh_tx, false); 2374 } while (mesh_tx); 2375 } else { 2376 mesh_tx = mgmt_mesh_find(hdev, cancel->handle); 2377 2378 if (mesh_tx && mesh_tx->sk == cmd->sk) 2379 mesh_send_complete(hdev, mesh_tx, false); 2380 } 2381 2382 mgmt_cmd_complete(cmd->sk, hdev->id, MGMT_OP_MESH_SEND_CANCEL, 2383 0, NULL, 0); 2384 mgmt_pending_free(cmd); 2385 2386 return 0; 2387 } 2388 2389 static int mesh_send_cancel(struct sock *sk, struct hci_dev *hdev, 2390 void *data, u16 len) 2391 { 2392 struct mgmt_pending_cmd *cmd; 2393 int err; 2394 2395 if (!lmp_le_capable(hdev) || 2396 !hci_dev_test_flag(hdev, HCI_MESH_EXPERIMENTAL)) 2397 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_MESH_SEND_CANCEL, 2398 MGMT_STATUS_NOT_SUPPORTED); 2399 2400 if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED)) 2401 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_MESH_SEND_CANCEL, 2402 MGMT_STATUS_REJECTED); 2403 2404 hci_dev_lock(hdev); 2405 cmd = mgmt_pending_new(sk, MGMT_OP_MESH_SEND_CANCEL, hdev, data, len); 2406 if (!cmd) 2407 err = -ENOMEM; 2408 else 2409 err = hci_cmd_sync_queue(hdev, send_cancel, cmd, NULL); 2410 2411 if (err < 0) { 2412 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_MESH_SEND_CANCEL, 2413 MGMT_STATUS_FAILED); 2414 2415 if (cmd) 2416 mgmt_pending_free(cmd); 2417 } 2418 2419 hci_dev_unlock(hdev); 2420 return err; 2421 } 2422 2423 static int mesh_send(struct sock *sk, struct hci_dev *hdev, void *data, u16 len) 2424 { 2425 struct mgmt_mesh_tx *mesh_tx; 2426 struct mgmt_cp_mesh_send *send = data; 2427 struct mgmt_rp_mesh_read_features rp; 2428 bool sending; 2429 int err = 0; 2430 2431 if (!lmp_le_capable(hdev) || 2432 !hci_dev_test_flag(hdev, HCI_MESH_EXPERIMENTAL)) 2433 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_MESH_SEND, 2434 MGMT_STATUS_NOT_SUPPORTED); 2435 if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED) || 2436 len <= MGMT_MESH_SEND_SIZE || 2437 len > (MGMT_MESH_SEND_SIZE + 31)) 2438 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_MESH_SEND, 2439 MGMT_STATUS_REJECTED); 2440 2441 hci_dev_lock(hdev); 2442 2443 memset(&rp, 0, sizeof(rp)); 2444 rp.max_handles = MESH_HANDLES_MAX; 2445 2446 mgmt_mesh_foreach(hdev, send_count, &rp, sk); 2447 2448 if (rp.max_handles <= rp.used_handles) { 2449 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_MESH_SEND, 2450 MGMT_STATUS_BUSY); 2451 goto done; 2452 } 2453 2454 sending = hci_dev_test_flag(hdev, HCI_MESH_SENDING); 2455 mesh_tx = mgmt_mesh_add(sk, hdev, send, len); 2456 2457 if (!mesh_tx) 2458 err = -ENOMEM; 2459 else if (!sending) 2460 err = hci_cmd_sync_queue(hdev, mesh_send_sync, mesh_tx, 2461 mesh_send_start_complete); 2462 2463 if (err < 0) { 2464 bt_dev_err(hdev, "Send Mesh Failed %d", err); 2465 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_MESH_SEND, 2466 MGMT_STATUS_FAILED); 2467 2468 if (mesh_tx) { 2469 if (sending) 2470 mgmt_mesh_remove(mesh_tx); 2471 } 2472 } else { 2473 hci_dev_set_flag(hdev, HCI_MESH_SENDING); 2474 2475 mgmt_cmd_complete(sk, hdev->id, MGMT_OP_MESH_SEND, 0, 2476 &mesh_tx->handle, 1); 2477 } 2478 2479 done: 2480 hci_dev_unlock(hdev); 2481 return err; 2482 } 2483 2484 static int set_le(struct sock *sk, struct hci_dev *hdev, void *data, u16 len) 2485 { 2486 struct mgmt_mode *cp = data; 2487 struct mgmt_pending_cmd *cmd; 2488 int err; 2489 u8 val, enabled; 2490 2491 bt_dev_dbg(hdev, "sock %p", sk); 2492 2493 if (!lmp_le_capable(hdev)) 2494 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE, 2495 MGMT_STATUS_NOT_SUPPORTED); 2496 2497 if (cp->val != 0x00 && cp->val != 0x01) 2498 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE, 2499 MGMT_STATUS_INVALID_PARAMS); 2500 2501 /* Bluetooth single mode LE only controllers or dual-mode 2502 * controllers configured as LE only devices, do not allow 2503 * switching LE off. These have either LE enabled explicitly 2504 * or BR/EDR has been previously switched off. 2505 * 2506 * When trying to enable an already enabled LE, then gracefully 2507 * send a positive response. Trying to disable it however will 2508 * result into rejection. 2509 */ 2510 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) { 2511 if (cp->val == 0x01) 2512 return send_settings_rsp(sk, MGMT_OP_SET_LE, hdev); 2513 2514 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE, 2515 MGMT_STATUS_REJECTED); 2516 } 2517 2518 hci_dev_lock(hdev); 2519 2520 val = !!cp->val; 2521 enabled = lmp_host_le_capable(hdev); 2522 2523 if (!hdev_is_powered(hdev) || val == enabled) { 2524 bool changed = false; 2525 2526 if (val != hci_dev_test_flag(hdev, HCI_LE_ENABLED)) { 2527 hci_dev_change_flag(hdev, HCI_LE_ENABLED); 2528 changed = true; 2529 } 2530 2531 if (!val && hci_dev_test_flag(hdev, HCI_ADVERTISING)) { 2532 hci_dev_clear_flag(hdev, HCI_ADVERTISING); 2533 changed = true; 2534 } 2535 2536 err = send_settings_rsp(sk, MGMT_OP_SET_LE, hdev); 2537 if (err < 0) 2538 goto unlock; 2539 2540 if (changed) 2541 err = new_settings(hdev, sk); 2542 2543 goto unlock; 2544 } 2545 2546 if (pending_find(MGMT_OP_SET_LE, hdev) || 2547 pending_find(MGMT_OP_SET_ADVERTISING, hdev)) { 2548 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE, 2549 MGMT_STATUS_BUSY); 2550 goto unlock; 2551 } 2552 2553 cmd = mgmt_pending_add(sk, MGMT_OP_SET_LE, hdev, data, len); 2554 if (!cmd) 2555 err = -ENOMEM; 2556 else 2557 err = hci_cmd_sync_queue(hdev, set_le_sync, cmd, 2558 set_le_complete); 2559 2560 if (err < 0) { 2561 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE, 2562 MGMT_STATUS_FAILED); 2563 2564 if (cmd) 2565 mgmt_pending_remove(cmd); 2566 } 2567 2568 unlock: 2569 hci_dev_unlock(hdev); 2570 return err; 2571 } 2572 2573 /* This is a helper function to test for pending mgmt commands that can 2574 * cause CoD or EIR HCI commands. We can only allow one such pending 2575 * mgmt command at a time since otherwise we cannot easily track what 2576 * the current values are, will be, and based on that calculate if a new 2577 * HCI command needs to be sent and if yes with what value. 2578 */ 2579 static bool pending_eir_or_class(struct hci_dev *hdev) 2580 { 2581 struct mgmt_pending_cmd *cmd; 2582 2583 list_for_each_entry(cmd, &hdev->mgmt_pending, list) { 2584 switch (cmd->opcode) { 2585 case MGMT_OP_ADD_UUID: 2586 case MGMT_OP_REMOVE_UUID: 2587 case MGMT_OP_SET_DEV_CLASS: 2588 case MGMT_OP_SET_POWERED: 2589 return true; 2590 } 2591 } 2592 2593 return false; 2594 } 2595 2596 static const u8 bluetooth_base_uuid[] = { 2597 0xfb, 0x34, 0x9b, 0x5f, 0x80, 0x00, 0x00, 0x80, 2598 0x00, 0x10, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 2599 }; 2600 2601 static u8 get_uuid_size(const u8 *uuid) 2602 { 2603 u32 val; 2604 2605 if (memcmp(uuid, bluetooth_base_uuid, 12)) 2606 return 128; 2607 2608 val = get_unaligned_le32(&uuid[12]); 2609 if (val > 0xffff) 2610 return 32; 2611 2612 return 16; 2613 } 2614 2615 static void mgmt_class_complete(struct hci_dev *hdev, void *data, int err) 2616 { 2617 struct mgmt_pending_cmd *cmd = data; 2618 2619 bt_dev_dbg(hdev, "err %d", err); 2620 2621 mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, 2622 mgmt_status(err), hdev->dev_class, 3); 2623 2624 mgmt_pending_free(cmd); 2625 } 2626 2627 static int add_uuid_sync(struct hci_dev *hdev, void *data) 2628 { 2629 int err; 2630 2631 err = hci_update_class_sync(hdev); 2632 if (err) 2633 return err; 2634 2635 return hci_update_eir_sync(hdev); 2636 } 2637 2638 static int add_uuid(struct sock *sk, struct hci_dev *hdev, void *data, u16 len) 2639 { 2640 struct mgmt_cp_add_uuid *cp = data; 2641 struct mgmt_pending_cmd *cmd; 2642 struct bt_uuid *uuid; 2643 int err; 2644 2645 bt_dev_dbg(hdev, "sock %p", sk); 2646 2647 hci_dev_lock(hdev); 2648 2649 if (pending_eir_or_class(hdev)) { 2650 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_UUID, 2651 MGMT_STATUS_BUSY); 2652 goto failed; 2653 } 2654 2655 uuid = kmalloc(sizeof(*uuid), GFP_KERNEL); 2656 if (!uuid) { 2657 err = -ENOMEM; 2658 goto failed; 2659 } 2660 2661 memcpy(uuid->uuid, cp->uuid, 16); 2662 uuid->svc_hint = cp->svc_hint; 2663 uuid->size = get_uuid_size(cp->uuid); 2664 2665 list_add_tail(&uuid->list, &hdev->uuids); 2666 2667 cmd = mgmt_pending_new(sk, MGMT_OP_ADD_UUID, hdev, data, len); 2668 if (!cmd) { 2669 err = -ENOMEM; 2670 goto failed; 2671 } 2672 2673 err = hci_cmd_sync_queue(hdev, add_uuid_sync, cmd, mgmt_class_complete); 2674 if (err < 0) { 2675 mgmt_pending_free(cmd); 2676 goto failed; 2677 } 2678 2679 failed: 2680 hci_dev_unlock(hdev); 2681 return err; 2682 } 2683 2684 static bool enable_service_cache(struct hci_dev *hdev) 2685 { 2686 if (!hdev_is_powered(hdev)) 2687 return false; 2688 2689 if (!hci_dev_test_and_set_flag(hdev, HCI_SERVICE_CACHE)) { 2690 queue_delayed_work(hdev->workqueue, &hdev->service_cache, 2691 CACHE_TIMEOUT); 2692 return true; 2693 } 2694 2695 return false; 2696 } 2697 2698 static int remove_uuid_sync(struct hci_dev *hdev, void *data) 2699 { 2700 int err; 2701 2702 err = hci_update_class_sync(hdev); 2703 if (err) 2704 return err; 2705 2706 return hci_update_eir_sync(hdev); 2707 } 2708 2709 static int remove_uuid(struct sock *sk, struct hci_dev *hdev, void *data, 2710 u16 len) 2711 { 2712 struct mgmt_cp_remove_uuid *cp = data; 2713 struct mgmt_pending_cmd *cmd; 2714 struct bt_uuid *match, *tmp; 2715 static const u8 bt_uuid_any[] = { 2716 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 2717 }; 2718 int err, found; 2719 2720 bt_dev_dbg(hdev, "sock %p", sk); 2721 2722 hci_dev_lock(hdev); 2723 2724 if (pending_eir_or_class(hdev)) { 2725 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID, 2726 MGMT_STATUS_BUSY); 2727 goto unlock; 2728 } 2729 2730 if (memcmp(cp->uuid, bt_uuid_any, 16) == 0) { 2731 hci_uuids_clear(hdev); 2732 2733 if (enable_service_cache(hdev)) { 2734 err = mgmt_cmd_complete(sk, hdev->id, 2735 MGMT_OP_REMOVE_UUID, 2736 0, hdev->dev_class, 3); 2737 goto unlock; 2738 } 2739 2740 goto update_class; 2741 } 2742 2743 found = 0; 2744 2745 list_for_each_entry_safe(match, tmp, &hdev->uuids, list) { 2746 if (memcmp(match->uuid, cp->uuid, 16) != 0) 2747 continue; 2748 2749 list_del(&match->list); 2750 kfree(match); 2751 found++; 2752 } 2753 2754 if (found == 0) { 2755 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID, 2756 MGMT_STATUS_INVALID_PARAMS); 2757 goto unlock; 2758 } 2759 2760 update_class: 2761 cmd = mgmt_pending_new(sk, MGMT_OP_REMOVE_UUID, hdev, data, len); 2762 if (!cmd) { 2763 err = -ENOMEM; 2764 goto unlock; 2765 } 2766 2767 err = hci_cmd_sync_queue(hdev, remove_uuid_sync, cmd, 2768 mgmt_class_complete); 2769 if (err < 0) 2770 mgmt_pending_free(cmd); 2771 2772 unlock: 2773 hci_dev_unlock(hdev); 2774 return err; 2775 } 2776 2777 static int set_class_sync(struct hci_dev *hdev, void *data) 2778 { 2779 int err = 0; 2780 2781 if (hci_dev_test_and_clear_flag(hdev, HCI_SERVICE_CACHE)) { 2782 cancel_delayed_work_sync(&hdev->service_cache); 2783 err = hci_update_eir_sync(hdev); 2784 } 2785 2786 if (err) 2787 return err; 2788 2789 return hci_update_class_sync(hdev); 2790 } 2791 2792 static int set_dev_class(struct sock *sk, struct hci_dev *hdev, void *data, 2793 u16 len) 2794 { 2795 struct mgmt_cp_set_dev_class *cp = data; 2796 struct mgmt_pending_cmd *cmd; 2797 int err; 2798 2799 bt_dev_dbg(hdev, "sock %p", sk); 2800 2801 if (!lmp_bredr_capable(hdev)) 2802 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 2803 MGMT_STATUS_NOT_SUPPORTED); 2804 2805 hci_dev_lock(hdev); 2806 2807 if (pending_eir_or_class(hdev)) { 2808 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 2809 MGMT_STATUS_BUSY); 2810 goto unlock; 2811 } 2812 2813 if ((cp->minor & 0x03) != 0 || (cp->major & 0xe0) != 0) { 2814 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 2815 MGMT_STATUS_INVALID_PARAMS); 2816 goto unlock; 2817 } 2818 2819 hdev->major_class = cp->major; 2820 hdev->minor_class = cp->minor; 2821 2822 if (!hdev_is_powered(hdev)) { 2823 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 0, 2824 hdev->dev_class, 3); 2825 goto unlock; 2826 } 2827 2828 cmd = mgmt_pending_new(sk, MGMT_OP_SET_DEV_CLASS, hdev, data, len); 2829 if (!cmd) { 2830 err = -ENOMEM; 2831 goto unlock; 2832 } 2833 2834 err = hci_cmd_sync_queue(hdev, set_class_sync, cmd, 2835 mgmt_class_complete); 2836 if (err < 0) 2837 mgmt_pending_free(cmd); 2838 2839 unlock: 2840 hci_dev_unlock(hdev); 2841 return err; 2842 } 2843 2844 static int load_link_keys(struct sock *sk, struct hci_dev *hdev, void *data, 2845 u16 len) 2846 { 2847 struct mgmt_cp_load_link_keys *cp = data; 2848 const u16 max_key_count = ((U16_MAX - sizeof(*cp)) / 2849 sizeof(struct mgmt_link_key_info)); 2850 u16 key_count, expected_len; 2851 bool changed; 2852 int i; 2853 2854 bt_dev_dbg(hdev, "sock %p", sk); 2855 2856 if (!lmp_bredr_capable(hdev)) 2857 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS, 2858 MGMT_STATUS_NOT_SUPPORTED); 2859 2860 key_count = __le16_to_cpu(cp->key_count); 2861 if (key_count > max_key_count) { 2862 bt_dev_err(hdev, "load_link_keys: too big key_count value %u", 2863 key_count); 2864 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS, 2865 MGMT_STATUS_INVALID_PARAMS); 2866 } 2867 2868 expected_len = struct_size(cp, keys, key_count); 2869 if (expected_len != len) { 2870 bt_dev_err(hdev, "load_link_keys: expected %u bytes, got %u bytes", 2871 expected_len, len); 2872 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS, 2873 MGMT_STATUS_INVALID_PARAMS); 2874 } 2875 2876 if (cp->debug_keys != 0x00 && cp->debug_keys != 0x01) 2877 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS, 2878 MGMT_STATUS_INVALID_PARAMS); 2879 2880 bt_dev_dbg(hdev, "debug_keys %u key_count %u", cp->debug_keys, 2881 key_count); 2882 2883 for (i = 0; i < key_count; i++) { 2884 struct mgmt_link_key_info *key = &cp->keys[i]; 2885 2886 if (key->addr.type != BDADDR_BREDR || key->type > 0x08) 2887 return mgmt_cmd_status(sk, hdev->id, 2888 MGMT_OP_LOAD_LINK_KEYS, 2889 MGMT_STATUS_INVALID_PARAMS); 2890 } 2891 2892 hci_dev_lock(hdev); 2893 2894 hci_link_keys_clear(hdev); 2895 2896 if (cp->debug_keys) 2897 changed = !hci_dev_test_and_set_flag(hdev, HCI_KEEP_DEBUG_KEYS); 2898 else 2899 changed = hci_dev_test_and_clear_flag(hdev, 2900 HCI_KEEP_DEBUG_KEYS); 2901 2902 if (changed) 2903 new_settings(hdev, NULL); 2904 2905 for (i = 0; i < key_count; i++) { 2906 struct mgmt_link_key_info *key = &cp->keys[i]; 2907 2908 if (hci_is_blocked_key(hdev, 2909 HCI_BLOCKED_KEY_TYPE_LINKKEY, 2910 key->val)) { 2911 bt_dev_warn(hdev, "Skipping blocked link key for %pMR", 2912 &key->addr.bdaddr); 2913 continue; 2914 } 2915 2916 /* Always ignore debug keys and require a new pairing if 2917 * the user wants to use them. 2918 */ 2919 if (key->type == HCI_LK_DEBUG_COMBINATION) 2920 continue; 2921 2922 hci_add_link_key(hdev, NULL, &key->addr.bdaddr, key->val, 2923 key->type, key->pin_len, NULL); 2924 } 2925 2926 mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS, 0, NULL, 0); 2927 2928 hci_dev_unlock(hdev); 2929 2930 return 0; 2931 } 2932 2933 static int device_unpaired(struct hci_dev *hdev, bdaddr_t *bdaddr, 2934 u8 addr_type, struct sock *skip_sk) 2935 { 2936 struct mgmt_ev_device_unpaired ev; 2937 2938 bacpy(&ev.addr.bdaddr, bdaddr); 2939 ev.addr.type = addr_type; 2940 2941 return mgmt_event(MGMT_EV_DEVICE_UNPAIRED, hdev, &ev, sizeof(ev), 2942 skip_sk); 2943 } 2944 2945 static void unpair_device_complete(struct hci_dev *hdev, void *data, int err) 2946 { 2947 struct mgmt_pending_cmd *cmd = data; 2948 struct mgmt_cp_unpair_device *cp = cmd->param; 2949 2950 if (!err) 2951 device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, cmd->sk); 2952 2953 cmd->cmd_complete(cmd, err); 2954 mgmt_pending_free(cmd); 2955 } 2956 2957 static int unpair_device_sync(struct hci_dev *hdev, void *data) 2958 { 2959 struct mgmt_pending_cmd *cmd = data; 2960 struct mgmt_cp_unpair_device *cp = cmd->param; 2961 struct hci_conn *conn; 2962 2963 if (cp->addr.type == BDADDR_BREDR) 2964 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, 2965 &cp->addr.bdaddr); 2966 else 2967 conn = hci_conn_hash_lookup_le(hdev, &cp->addr.bdaddr, 2968 le_addr_type(cp->addr.type)); 2969 2970 if (!conn) 2971 return 0; 2972 2973 return hci_abort_conn_sync(hdev, conn, HCI_ERROR_REMOTE_USER_TERM); 2974 } 2975 2976 static int unpair_device(struct sock *sk, struct hci_dev *hdev, void *data, 2977 u16 len) 2978 { 2979 struct mgmt_cp_unpair_device *cp = data; 2980 struct mgmt_rp_unpair_device rp; 2981 struct hci_conn_params *params; 2982 struct mgmt_pending_cmd *cmd; 2983 struct hci_conn *conn; 2984 u8 addr_type; 2985 int err; 2986 2987 memset(&rp, 0, sizeof(rp)); 2988 bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr); 2989 rp.addr.type = cp->addr.type; 2990 2991 if (!bdaddr_type_is_valid(cp->addr.type)) 2992 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE, 2993 MGMT_STATUS_INVALID_PARAMS, 2994 &rp, sizeof(rp)); 2995 2996 if (cp->disconnect != 0x00 && cp->disconnect != 0x01) 2997 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE, 2998 MGMT_STATUS_INVALID_PARAMS, 2999 &rp, sizeof(rp)); 3000 3001 hci_dev_lock(hdev); 3002 3003 if (!hdev_is_powered(hdev)) { 3004 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE, 3005 MGMT_STATUS_NOT_POWERED, &rp, 3006 sizeof(rp)); 3007 goto unlock; 3008 } 3009 3010 if (cp->addr.type == BDADDR_BREDR) { 3011 /* If disconnection is requested, then look up the 3012 * connection. If the remote device is connected, it 3013 * will be later used to terminate the link. 3014 * 3015 * Setting it to NULL explicitly will cause no 3016 * termination of the link. 3017 */ 3018 if (cp->disconnect) 3019 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, 3020 &cp->addr.bdaddr); 3021 else 3022 conn = NULL; 3023 3024 err = hci_remove_link_key(hdev, &cp->addr.bdaddr); 3025 if (err < 0) { 3026 err = mgmt_cmd_complete(sk, hdev->id, 3027 MGMT_OP_UNPAIR_DEVICE, 3028 MGMT_STATUS_NOT_PAIRED, &rp, 3029 sizeof(rp)); 3030 goto unlock; 3031 } 3032 3033 goto done; 3034 } 3035 3036 /* LE address type */ 3037 addr_type = le_addr_type(cp->addr.type); 3038 3039 /* Abort any ongoing SMP pairing. Removes ltk and irk if they exist. */ 3040 err = smp_cancel_and_remove_pairing(hdev, &cp->addr.bdaddr, addr_type); 3041 if (err < 0) { 3042 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE, 3043 MGMT_STATUS_NOT_PAIRED, &rp, 3044 sizeof(rp)); 3045 goto unlock; 3046 } 3047 3048 conn = hci_conn_hash_lookup_le(hdev, &cp->addr.bdaddr, addr_type); 3049 if (!conn) { 3050 hci_conn_params_del(hdev, &cp->addr.bdaddr, addr_type); 3051 goto done; 3052 } 3053 3054 3055 /* Defer clearing up the connection parameters until closing to 3056 * give a chance of keeping them if a repairing happens. 3057 */ 3058 set_bit(HCI_CONN_PARAM_REMOVAL_PEND, &conn->flags); 3059 3060 /* Disable auto-connection parameters if present */ 3061 params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr, addr_type); 3062 if (params) { 3063 if (params->explicit_connect) 3064 params->auto_connect = HCI_AUTO_CONN_EXPLICIT; 3065 else 3066 params->auto_connect = HCI_AUTO_CONN_DISABLED; 3067 } 3068 3069 /* If disconnection is not requested, then clear the connection 3070 * variable so that the link is not terminated. 3071 */ 3072 if (!cp->disconnect) 3073 conn = NULL; 3074 3075 done: 3076 /* If the connection variable is set, then termination of the 3077 * link is requested. 3078 */ 3079 if (!conn) { 3080 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE, 0, 3081 &rp, sizeof(rp)); 3082 device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, sk); 3083 goto unlock; 3084 } 3085 3086 cmd = mgmt_pending_new(sk, MGMT_OP_UNPAIR_DEVICE, hdev, cp, 3087 sizeof(*cp)); 3088 if (!cmd) { 3089 err = -ENOMEM; 3090 goto unlock; 3091 } 3092 3093 cmd->cmd_complete = addr_cmd_complete; 3094 3095 err = hci_cmd_sync_queue(hdev, unpair_device_sync, cmd, 3096 unpair_device_complete); 3097 if (err < 0) 3098 mgmt_pending_free(cmd); 3099 3100 unlock: 3101 hci_dev_unlock(hdev); 3102 return err; 3103 } 3104 3105 static int disconnect(struct sock *sk, struct hci_dev *hdev, void *data, 3106 u16 len) 3107 { 3108 struct mgmt_cp_disconnect *cp = data; 3109 struct mgmt_rp_disconnect rp; 3110 struct mgmt_pending_cmd *cmd; 3111 struct hci_conn *conn; 3112 int err; 3113 3114 bt_dev_dbg(hdev, "sock %p", sk); 3115 3116 memset(&rp, 0, sizeof(rp)); 3117 bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr); 3118 rp.addr.type = cp->addr.type; 3119 3120 if (!bdaddr_type_is_valid(cp->addr.type)) 3121 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT, 3122 MGMT_STATUS_INVALID_PARAMS, 3123 &rp, sizeof(rp)); 3124 3125 hci_dev_lock(hdev); 3126 3127 if (!test_bit(HCI_UP, &hdev->flags)) { 3128 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT, 3129 MGMT_STATUS_NOT_POWERED, &rp, 3130 sizeof(rp)); 3131 goto failed; 3132 } 3133 3134 if (pending_find(MGMT_OP_DISCONNECT, hdev)) { 3135 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT, 3136 MGMT_STATUS_BUSY, &rp, sizeof(rp)); 3137 goto failed; 3138 } 3139 3140 if (cp->addr.type == BDADDR_BREDR) 3141 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, 3142 &cp->addr.bdaddr); 3143 else 3144 conn = hci_conn_hash_lookup_le(hdev, &cp->addr.bdaddr, 3145 le_addr_type(cp->addr.type)); 3146 3147 if (!conn || conn->state == BT_OPEN || conn->state == BT_CLOSED) { 3148 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT, 3149 MGMT_STATUS_NOT_CONNECTED, &rp, 3150 sizeof(rp)); 3151 goto failed; 3152 } 3153 3154 cmd = mgmt_pending_add(sk, MGMT_OP_DISCONNECT, hdev, data, len); 3155 if (!cmd) { 3156 err = -ENOMEM; 3157 goto failed; 3158 } 3159 3160 cmd->cmd_complete = generic_cmd_complete; 3161 3162 err = hci_disconnect(conn, HCI_ERROR_REMOTE_USER_TERM); 3163 if (err < 0) 3164 mgmt_pending_remove(cmd); 3165 3166 failed: 3167 hci_dev_unlock(hdev); 3168 return err; 3169 } 3170 3171 static u8 link_to_bdaddr(u8 link_type, u8 addr_type) 3172 { 3173 switch (link_type) { 3174 case LE_LINK: 3175 switch (addr_type) { 3176 case ADDR_LE_DEV_PUBLIC: 3177 return BDADDR_LE_PUBLIC; 3178 3179 default: 3180 /* Fallback to LE Random address type */ 3181 return BDADDR_LE_RANDOM; 3182 } 3183 3184 default: 3185 /* Fallback to BR/EDR type */ 3186 return BDADDR_BREDR; 3187 } 3188 } 3189 3190 static int get_connections(struct sock *sk, struct hci_dev *hdev, void *data, 3191 u16 data_len) 3192 { 3193 struct mgmt_rp_get_connections *rp; 3194 struct hci_conn *c; 3195 int err; 3196 u16 i; 3197 3198 bt_dev_dbg(hdev, "sock %p", sk); 3199 3200 hci_dev_lock(hdev); 3201 3202 if (!hdev_is_powered(hdev)) { 3203 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_CONNECTIONS, 3204 MGMT_STATUS_NOT_POWERED); 3205 goto unlock; 3206 } 3207 3208 i = 0; 3209 list_for_each_entry(c, &hdev->conn_hash.list, list) { 3210 if (test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags)) 3211 i++; 3212 } 3213 3214 rp = kmalloc(struct_size(rp, addr, i), GFP_KERNEL); 3215 if (!rp) { 3216 err = -ENOMEM; 3217 goto unlock; 3218 } 3219 3220 i = 0; 3221 list_for_each_entry(c, &hdev->conn_hash.list, list) { 3222 if (!test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags)) 3223 continue; 3224 bacpy(&rp->addr[i].bdaddr, &c->dst); 3225 rp->addr[i].type = link_to_bdaddr(c->type, c->dst_type); 3226 if (c->type == SCO_LINK || c->type == ESCO_LINK) 3227 continue; 3228 i++; 3229 } 3230 3231 rp->conn_count = cpu_to_le16(i); 3232 3233 /* Recalculate length in case of filtered SCO connections, etc */ 3234 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONNECTIONS, 0, rp, 3235 struct_size(rp, addr, i)); 3236 3237 kfree(rp); 3238 3239 unlock: 3240 hci_dev_unlock(hdev); 3241 return err; 3242 } 3243 3244 static int send_pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev, 3245 struct mgmt_cp_pin_code_neg_reply *cp) 3246 { 3247 struct mgmt_pending_cmd *cmd; 3248 int err; 3249 3250 cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_NEG_REPLY, hdev, cp, 3251 sizeof(*cp)); 3252 if (!cmd) 3253 return -ENOMEM; 3254 3255 cmd->cmd_complete = addr_cmd_complete; 3256 3257 err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_NEG_REPLY, 3258 sizeof(cp->addr.bdaddr), &cp->addr.bdaddr); 3259 if (err < 0) 3260 mgmt_pending_remove(cmd); 3261 3262 return err; 3263 } 3264 3265 static int pin_code_reply(struct sock *sk, struct hci_dev *hdev, void *data, 3266 u16 len) 3267 { 3268 struct hci_conn *conn; 3269 struct mgmt_cp_pin_code_reply *cp = data; 3270 struct hci_cp_pin_code_reply reply; 3271 struct mgmt_pending_cmd *cmd; 3272 int err; 3273 3274 bt_dev_dbg(hdev, "sock %p", sk); 3275 3276 hci_dev_lock(hdev); 3277 3278 if (!hdev_is_powered(hdev)) { 3279 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY, 3280 MGMT_STATUS_NOT_POWERED); 3281 goto failed; 3282 } 3283 3284 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->addr.bdaddr); 3285 if (!conn) { 3286 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY, 3287 MGMT_STATUS_NOT_CONNECTED); 3288 goto failed; 3289 } 3290 3291 if (conn->pending_sec_level == BT_SECURITY_HIGH && cp->pin_len != 16) { 3292 struct mgmt_cp_pin_code_neg_reply ncp; 3293 3294 memcpy(&ncp.addr, &cp->addr, sizeof(ncp.addr)); 3295 3296 bt_dev_err(hdev, "PIN code is not 16 bytes long"); 3297 3298 err = send_pin_code_neg_reply(sk, hdev, &ncp); 3299 if (err >= 0) 3300 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY, 3301 MGMT_STATUS_INVALID_PARAMS); 3302 3303 goto failed; 3304 } 3305 3306 cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_REPLY, hdev, data, len); 3307 if (!cmd) { 3308 err = -ENOMEM; 3309 goto failed; 3310 } 3311 3312 cmd->cmd_complete = addr_cmd_complete; 3313 3314 bacpy(&reply.bdaddr, &cp->addr.bdaddr); 3315 reply.pin_len = cp->pin_len; 3316 memcpy(reply.pin_code, cp->pin_code, sizeof(reply.pin_code)); 3317 3318 err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_REPLY, sizeof(reply), &reply); 3319 if (err < 0) 3320 mgmt_pending_remove(cmd); 3321 3322 failed: 3323 hci_dev_unlock(hdev); 3324 return err; 3325 } 3326 3327 static int set_io_capability(struct sock *sk, struct hci_dev *hdev, void *data, 3328 u16 len) 3329 { 3330 struct mgmt_cp_set_io_capability *cp = data; 3331 3332 bt_dev_dbg(hdev, "sock %p", sk); 3333 3334 if (cp->io_capability > SMP_IO_KEYBOARD_DISPLAY) 3335 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_IO_CAPABILITY, 3336 MGMT_STATUS_INVALID_PARAMS); 3337 3338 hci_dev_lock(hdev); 3339 3340 hdev->io_capability = cp->io_capability; 3341 3342 bt_dev_dbg(hdev, "IO capability set to 0x%02x", hdev->io_capability); 3343 3344 hci_dev_unlock(hdev); 3345 3346 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_IO_CAPABILITY, 0, 3347 NULL, 0); 3348 } 3349 3350 static struct mgmt_pending_cmd *find_pairing(struct hci_conn *conn) 3351 { 3352 struct hci_dev *hdev = conn->hdev; 3353 struct mgmt_pending_cmd *cmd; 3354 3355 list_for_each_entry(cmd, &hdev->mgmt_pending, list) { 3356 if (cmd->opcode != MGMT_OP_PAIR_DEVICE) 3357 continue; 3358 3359 if (cmd->user_data != conn) 3360 continue; 3361 3362 return cmd; 3363 } 3364 3365 return NULL; 3366 } 3367 3368 static int pairing_complete(struct mgmt_pending_cmd *cmd, u8 status) 3369 { 3370 struct mgmt_rp_pair_device rp; 3371 struct hci_conn *conn = cmd->user_data; 3372 int err; 3373 3374 bacpy(&rp.addr.bdaddr, &conn->dst); 3375 rp.addr.type = link_to_bdaddr(conn->type, conn->dst_type); 3376 3377 err = mgmt_cmd_complete(cmd->sk, cmd->index, MGMT_OP_PAIR_DEVICE, 3378 status, &rp, sizeof(rp)); 3379 3380 /* So we don't get further callbacks for this connection */ 3381 conn->connect_cfm_cb = NULL; 3382 conn->security_cfm_cb = NULL; 3383 conn->disconn_cfm_cb = NULL; 3384 3385 hci_conn_drop(conn); 3386 3387 /* The device is paired so there is no need to remove 3388 * its connection parameters anymore. 3389 */ 3390 clear_bit(HCI_CONN_PARAM_REMOVAL_PEND, &conn->flags); 3391 3392 hci_conn_put(conn); 3393 3394 return err; 3395 } 3396 3397 void mgmt_smp_complete(struct hci_conn *conn, bool complete) 3398 { 3399 u8 status = complete ? MGMT_STATUS_SUCCESS : MGMT_STATUS_FAILED; 3400 struct mgmt_pending_cmd *cmd; 3401 3402 cmd = find_pairing(conn); 3403 if (cmd) { 3404 cmd->cmd_complete(cmd, status); 3405 mgmt_pending_remove(cmd); 3406 } 3407 } 3408 3409 static void pairing_complete_cb(struct hci_conn *conn, u8 status) 3410 { 3411 struct mgmt_pending_cmd *cmd; 3412 3413 BT_DBG("status %u", status); 3414 3415 cmd = find_pairing(conn); 3416 if (!cmd) { 3417 BT_DBG("Unable to find a pending command"); 3418 return; 3419 } 3420 3421 cmd->cmd_complete(cmd, mgmt_status(status)); 3422 mgmt_pending_remove(cmd); 3423 } 3424 3425 static void le_pairing_complete_cb(struct hci_conn *conn, u8 status) 3426 { 3427 struct mgmt_pending_cmd *cmd; 3428 3429 BT_DBG("status %u", status); 3430 3431 if (!status) 3432 return; 3433 3434 cmd = find_pairing(conn); 3435 if (!cmd) { 3436 BT_DBG("Unable to find a pending command"); 3437 return; 3438 } 3439 3440 cmd->cmd_complete(cmd, mgmt_status(status)); 3441 mgmt_pending_remove(cmd); 3442 } 3443 3444 static int pair_device(struct sock *sk, struct hci_dev *hdev, void *data, 3445 u16 len) 3446 { 3447 struct mgmt_cp_pair_device *cp = data; 3448 struct mgmt_rp_pair_device rp; 3449 struct mgmt_pending_cmd *cmd; 3450 u8 sec_level, auth_type; 3451 struct hci_conn *conn; 3452 int err; 3453 3454 bt_dev_dbg(hdev, "sock %p", sk); 3455 3456 memset(&rp, 0, sizeof(rp)); 3457 bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr); 3458 rp.addr.type = cp->addr.type; 3459 3460 if (!bdaddr_type_is_valid(cp->addr.type)) 3461 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE, 3462 MGMT_STATUS_INVALID_PARAMS, 3463 &rp, sizeof(rp)); 3464 3465 if (cp->io_cap > SMP_IO_KEYBOARD_DISPLAY) 3466 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE, 3467 MGMT_STATUS_INVALID_PARAMS, 3468 &rp, sizeof(rp)); 3469 3470 hci_dev_lock(hdev); 3471 3472 if (!hdev_is_powered(hdev)) { 3473 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE, 3474 MGMT_STATUS_NOT_POWERED, &rp, 3475 sizeof(rp)); 3476 goto unlock; 3477 } 3478 3479 if (hci_bdaddr_is_paired(hdev, &cp->addr.bdaddr, cp->addr.type)) { 3480 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE, 3481 MGMT_STATUS_ALREADY_PAIRED, &rp, 3482 sizeof(rp)); 3483 goto unlock; 3484 } 3485 3486 sec_level = BT_SECURITY_MEDIUM; 3487 auth_type = HCI_AT_DEDICATED_BONDING; 3488 3489 if (cp->addr.type == BDADDR_BREDR) { 3490 conn = hci_connect_acl(hdev, &cp->addr.bdaddr, sec_level, 3491 auth_type, CONN_REASON_PAIR_DEVICE); 3492 } else { 3493 u8 addr_type = le_addr_type(cp->addr.type); 3494 struct hci_conn_params *p; 3495 3496 /* When pairing a new device, it is expected to remember 3497 * this device for future connections. Adding the connection 3498 * parameter information ahead of time allows tracking 3499 * of the peripheral preferred values and will speed up any 3500 * further connection establishment. 3501 * 3502 * If connection parameters already exist, then they 3503 * will be kept and this function does nothing. 3504 */ 3505 p = hci_conn_params_add(hdev, &cp->addr.bdaddr, addr_type); 3506 3507 if (p->auto_connect == HCI_AUTO_CONN_EXPLICIT) 3508 p->auto_connect = HCI_AUTO_CONN_DISABLED; 3509 3510 conn = hci_connect_le_scan(hdev, &cp->addr.bdaddr, addr_type, 3511 sec_level, HCI_LE_CONN_TIMEOUT, 3512 CONN_REASON_PAIR_DEVICE); 3513 } 3514 3515 if (IS_ERR(conn)) { 3516 int status; 3517 3518 if (PTR_ERR(conn) == -EBUSY) 3519 status = MGMT_STATUS_BUSY; 3520 else if (PTR_ERR(conn) == -EOPNOTSUPP) 3521 status = MGMT_STATUS_NOT_SUPPORTED; 3522 else if (PTR_ERR(conn) == -ECONNREFUSED) 3523 status = MGMT_STATUS_REJECTED; 3524 else 3525 status = MGMT_STATUS_CONNECT_FAILED; 3526 3527 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE, 3528 status, &rp, sizeof(rp)); 3529 goto unlock; 3530 } 3531 3532 if (conn->connect_cfm_cb) { 3533 hci_conn_drop(conn); 3534 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE, 3535 MGMT_STATUS_BUSY, &rp, sizeof(rp)); 3536 goto unlock; 3537 } 3538 3539 cmd = mgmt_pending_add(sk, MGMT_OP_PAIR_DEVICE, hdev, data, len); 3540 if (!cmd) { 3541 err = -ENOMEM; 3542 hci_conn_drop(conn); 3543 goto unlock; 3544 } 3545 3546 cmd->cmd_complete = pairing_complete; 3547 3548 /* For LE, just connecting isn't a proof that the pairing finished */ 3549 if (cp->addr.type == BDADDR_BREDR) { 3550 conn->connect_cfm_cb = pairing_complete_cb; 3551 conn->security_cfm_cb = pairing_complete_cb; 3552 conn->disconn_cfm_cb = pairing_complete_cb; 3553 } else { 3554 conn->connect_cfm_cb = le_pairing_complete_cb; 3555 conn->security_cfm_cb = le_pairing_complete_cb; 3556 conn->disconn_cfm_cb = le_pairing_complete_cb; 3557 } 3558 3559 conn->io_capability = cp->io_cap; 3560 cmd->user_data = hci_conn_get(conn); 3561 3562 if ((conn->state == BT_CONNECTED || conn->state == BT_CONFIG) && 3563 hci_conn_security(conn, sec_level, auth_type, true)) { 3564 cmd->cmd_complete(cmd, 0); 3565 mgmt_pending_remove(cmd); 3566 } 3567 3568 err = 0; 3569 3570 unlock: 3571 hci_dev_unlock(hdev); 3572 return err; 3573 } 3574 3575 static int abort_conn_sync(struct hci_dev *hdev, void *data) 3576 { 3577 struct hci_conn *conn; 3578 u16 handle = PTR_ERR(data); 3579 3580 conn = hci_conn_hash_lookup_handle(hdev, handle); 3581 if (!conn) 3582 return 0; 3583 3584 return hci_abort_conn_sync(hdev, conn, HCI_ERROR_REMOTE_USER_TERM); 3585 } 3586 3587 static int cancel_pair_device(struct sock *sk, struct hci_dev *hdev, void *data, 3588 u16 len) 3589 { 3590 struct mgmt_addr_info *addr = data; 3591 struct mgmt_pending_cmd *cmd; 3592 struct hci_conn *conn; 3593 int err; 3594 3595 bt_dev_dbg(hdev, "sock %p", sk); 3596 3597 hci_dev_lock(hdev); 3598 3599 if (!hdev_is_powered(hdev)) { 3600 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE, 3601 MGMT_STATUS_NOT_POWERED); 3602 goto unlock; 3603 } 3604 3605 cmd = pending_find(MGMT_OP_PAIR_DEVICE, hdev); 3606 if (!cmd) { 3607 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE, 3608 MGMT_STATUS_INVALID_PARAMS); 3609 goto unlock; 3610 } 3611 3612 conn = cmd->user_data; 3613 3614 if (bacmp(&addr->bdaddr, &conn->dst) != 0) { 3615 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE, 3616 MGMT_STATUS_INVALID_PARAMS); 3617 goto unlock; 3618 } 3619 3620 cmd->cmd_complete(cmd, MGMT_STATUS_CANCELLED); 3621 mgmt_pending_remove(cmd); 3622 3623 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE, 0, 3624 addr, sizeof(*addr)); 3625 3626 /* Since user doesn't want to proceed with the connection, abort any 3627 * ongoing pairing and then terminate the link if it was created 3628 * because of the pair device action. 3629 */ 3630 if (addr->type == BDADDR_BREDR) 3631 hci_remove_link_key(hdev, &addr->bdaddr); 3632 else 3633 smp_cancel_and_remove_pairing(hdev, &addr->bdaddr, 3634 le_addr_type(addr->type)); 3635 3636 if (conn->conn_reason == CONN_REASON_PAIR_DEVICE) 3637 hci_cmd_sync_queue(hdev, abort_conn_sync, ERR_PTR(conn->handle), 3638 NULL); 3639 3640 unlock: 3641 hci_dev_unlock(hdev); 3642 return err; 3643 } 3644 3645 static int user_pairing_resp(struct sock *sk, struct hci_dev *hdev, 3646 struct mgmt_addr_info *addr, u16 mgmt_op, 3647 u16 hci_op, __le32 passkey) 3648 { 3649 struct mgmt_pending_cmd *cmd; 3650 struct hci_conn *conn; 3651 int err; 3652 3653 hci_dev_lock(hdev); 3654 3655 if (!hdev_is_powered(hdev)) { 3656 err = mgmt_cmd_complete(sk, hdev->id, mgmt_op, 3657 MGMT_STATUS_NOT_POWERED, addr, 3658 sizeof(*addr)); 3659 goto done; 3660 } 3661 3662 if (addr->type == BDADDR_BREDR) 3663 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &addr->bdaddr); 3664 else 3665 conn = hci_conn_hash_lookup_le(hdev, &addr->bdaddr, 3666 le_addr_type(addr->type)); 3667 3668 if (!conn) { 3669 err = mgmt_cmd_complete(sk, hdev->id, mgmt_op, 3670 MGMT_STATUS_NOT_CONNECTED, addr, 3671 sizeof(*addr)); 3672 goto done; 3673 } 3674 3675 if (addr->type == BDADDR_LE_PUBLIC || addr->type == BDADDR_LE_RANDOM) { 3676 err = smp_user_confirm_reply(conn, mgmt_op, passkey); 3677 if (!err) 3678 err = mgmt_cmd_complete(sk, hdev->id, mgmt_op, 3679 MGMT_STATUS_SUCCESS, addr, 3680 sizeof(*addr)); 3681 else 3682 err = mgmt_cmd_complete(sk, hdev->id, mgmt_op, 3683 MGMT_STATUS_FAILED, addr, 3684 sizeof(*addr)); 3685 3686 goto done; 3687 } 3688 3689 cmd = mgmt_pending_add(sk, mgmt_op, hdev, addr, sizeof(*addr)); 3690 if (!cmd) { 3691 err = -ENOMEM; 3692 goto done; 3693 } 3694 3695 cmd->cmd_complete = addr_cmd_complete; 3696 3697 /* Continue with pairing via HCI */ 3698 if (hci_op == HCI_OP_USER_PASSKEY_REPLY) { 3699 struct hci_cp_user_passkey_reply cp; 3700 3701 bacpy(&cp.bdaddr, &addr->bdaddr); 3702 cp.passkey = passkey; 3703 err = hci_send_cmd(hdev, hci_op, sizeof(cp), &cp); 3704 } else 3705 err = hci_send_cmd(hdev, hci_op, sizeof(addr->bdaddr), 3706 &addr->bdaddr); 3707 3708 if (err < 0) 3709 mgmt_pending_remove(cmd); 3710 3711 done: 3712 hci_dev_unlock(hdev); 3713 return err; 3714 } 3715 3716 static int pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev, 3717 void *data, u16 len) 3718 { 3719 struct mgmt_cp_pin_code_neg_reply *cp = data; 3720 3721 bt_dev_dbg(hdev, "sock %p", sk); 3722 3723 return user_pairing_resp(sk, hdev, &cp->addr, 3724 MGMT_OP_PIN_CODE_NEG_REPLY, 3725 HCI_OP_PIN_CODE_NEG_REPLY, 0); 3726 } 3727 3728 static int user_confirm_reply(struct sock *sk, struct hci_dev *hdev, void *data, 3729 u16 len) 3730 { 3731 struct mgmt_cp_user_confirm_reply *cp = data; 3732 3733 bt_dev_dbg(hdev, "sock %p", sk); 3734 3735 if (len != sizeof(*cp)) 3736 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_USER_CONFIRM_REPLY, 3737 MGMT_STATUS_INVALID_PARAMS); 3738 3739 return user_pairing_resp(sk, hdev, &cp->addr, 3740 MGMT_OP_USER_CONFIRM_REPLY, 3741 HCI_OP_USER_CONFIRM_REPLY, 0); 3742 } 3743 3744 static int user_confirm_neg_reply(struct sock *sk, struct hci_dev *hdev, 3745 void *data, u16 len) 3746 { 3747 struct mgmt_cp_user_confirm_neg_reply *cp = data; 3748 3749 bt_dev_dbg(hdev, "sock %p", sk); 3750 3751 return user_pairing_resp(sk, hdev, &cp->addr, 3752 MGMT_OP_USER_CONFIRM_NEG_REPLY, 3753 HCI_OP_USER_CONFIRM_NEG_REPLY, 0); 3754 } 3755 3756 static int user_passkey_reply(struct sock *sk, struct hci_dev *hdev, void *data, 3757 u16 len) 3758 { 3759 struct mgmt_cp_user_passkey_reply *cp = data; 3760 3761 bt_dev_dbg(hdev, "sock %p", sk); 3762 3763 return user_pairing_resp(sk, hdev, &cp->addr, 3764 MGMT_OP_USER_PASSKEY_REPLY, 3765 HCI_OP_USER_PASSKEY_REPLY, cp->passkey); 3766 } 3767 3768 static int user_passkey_neg_reply(struct sock *sk, struct hci_dev *hdev, 3769 void *data, u16 len) 3770 { 3771 struct mgmt_cp_user_passkey_neg_reply *cp = data; 3772 3773 bt_dev_dbg(hdev, "sock %p", sk); 3774 3775 return user_pairing_resp(sk, hdev, &cp->addr, 3776 MGMT_OP_USER_PASSKEY_NEG_REPLY, 3777 HCI_OP_USER_PASSKEY_NEG_REPLY, 0); 3778 } 3779 3780 static int adv_expire_sync(struct hci_dev *hdev, u32 flags) 3781 { 3782 struct adv_info *adv_instance; 3783 3784 adv_instance = hci_find_adv_instance(hdev, hdev->cur_adv_instance); 3785 if (!adv_instance) 3786 return 0; 3787 3788 /* stop if current instance doesn't need to be changed */ 3789 if (!(adv_instance->flags & flags)) 3790 return 0; 3791 3792 cancel_adv_timeout(hdev); 3793 3794 adv_instance = hci_get_next_instance(hdev, adv_instance->instance); 3795 if (!adv_instance) 3796 return 0; 3797 3798 hci_schedule_adv_instance_sync(hdev, adv_instance->instance, true); 3799 3800 return 0; 3801 } 3802 3803 static int name_changed_sync(struct hci_dev *hdev, void *data) 3804 { 3805 return adv_expire_sync(hdev, MGMT_ADV_FLAG_LOCAL_NAME); 3806 } 3807 3808 static void set_name_complete(struct hci_dev *hdev, void *data, int err) 3809 { 3810 struct mgmt_pending_cmd *cmd = data; 3811 struct mgmt_cp_set_local_name *cp = cmd->param; 3812 u8 status = mgmt_status(err); 3813 3814 bt_dev_dbg(hdev, "err %d", err); 3815 3816 if (cmd != pending_find(MGMT_OP_SET_LOCAL_NAME, hdev)) 3817 return; 3818 3819 if (status) { 3820 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 3821 status); 3822 } else { 3823 mgmt_cmd_complete(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0, 3824 cp, sizeof(*cp)); 3825 3826 if (hci_dev_test_flag(hdev, HCI_LE_ADV)) 3827 hci_cmd_sync_queue(hdev, name_changed_sync, NULL, NULL); 3828 } 3829 3830 mgmt_pending_remove(cmd); 3831 } 3832 3833 static int set_name_sync(struct hci_dev *hdev, void *data) 3834 { 3835 if (lmp_bredr_capable(hdev)) { 3836 hci_update_name_sync(hdev); 3837 hci_update_eir_sync(hdev); 3838 } 3839 3840 /* The name is stored in the scan response data and so 3841 * no need to update the advertising data here. 3842 */ 3843 if (lmp_le_capable(hdev) && hci_dev_test_flag(hdev, HCI_ADVERTISING)) 3844 hci_update_scan_rsp_data_sync(hdev, hdev->cur_adv_instance); 3845 3846 return 0; 3847 } 3848 3849 static int set_local_name(struct sock *sk, struct hci_dev *hdev, void *data, 3850 u16 len) 3851 { 3852 struct mgmt_cp_set_local_name *cp = data; 3853 struct mgmt_pending_cmd *cmd; 3854 int err; 3855 3856 bt_dev_dbg(hdev, "sock %p", sk); 3857 3858 hci_dev_lock(hdev); 3859 3860 /* If the old values are the same as the new ones just return a 3861 * direct command complete event. 3862 */ 3863 if (!memcmp(hdev->dev_name, cp->name, sizeof(hdev->dev_name)) && 3864 !memcmp(hdev->short_name, cp->short_name, 3865 sizeof(hdev->short_name))) { 3866 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0, 3867 data, len); 3868 goto failed; 3869 } 3870 3871 memcpy(hdev->short_name, cp->short_name, sizeof(hdev->short_name)); 3872 3873 if (!hdev_is_powered(hdev)) { 3874 memcpy(hdev->dev_name, cp->name, sizeof(hdev->dev_name)); 3875 3876 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0, 3877 data, len); 3878 if (err < 0) 3879 goto failed; 3880 3881 err = mgmt_limited_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, data, 3882 len, HCI_MGMT_LOCAL_NAME_EVENTS, sk); 3883 ext_info_changed(hdev, sk); 3884 3885 goto failed; 3886 } 3887 3888 cmd = mgmt_pending_add(sk, MGMT_OP_SET_LOCAL_NAME, hdev, data, len); 3889 if (!cmd) 3890 err = -ENOMEM; 3891 else 3892 err = hci_cmd_sync_queue(hdev, set_name_sync, cmd, 3893 set_name_complete); 3894 3895 if (err < 0) { 3896 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 3897 MGMT_STATUS_FAILED); 3898 3899 if (cmd) 3900 mgmt_pending_remove(cmd); 3901 3902 goto failed; 3903 } 3904 3905 memcpy(hdev->dev_name, cp->name, sizeof(hdev->dev_name)); 3906 3907 failed: 3908 hci_dev_unlock(hdev); 3909 return err; 3910 } 3911 3912 static int appearance_changed_sync(struct hci_dev *hdev, void *data) 3913 { 3914 return adv_expire_sync(hdev, MGMT_ADV_FLAG_APPEARANCE); 3915 } 3916 3917 static int set_appearance(struct sock *sk, struct hci_dev *hdev, void *data, 3918 u16 len) 3919 { 3920 struct mgmt_cp_set_appearance *cp = data; 3921 u16 appearance; 3922 int err; 3923 3924 bt_dev_dbg(hdev, "sock %p", sk); 3925 3926 if (!lmp_le_capable(hdev)) 3927 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_APPEARANCE, 3928 MGMT_STATUS_NOT_SUPPORTED); 3929 3930 appearance = le16_to_cpu(cp->appearance); 3931 3932 hci_dev_lock(hdev); 3933 3934 if (hdev->appearance != appearance) { 3935 hdev->appearance = appearance; 3936 3937 if (hci_dev_test_flag(hdev, HCI_LE_ADV)) 3938 hci_cmd_sync_queue(hdev, appearance_changed_sync, NULL, 3939 NULL); 3940 3941 ext_info_changed(hdev, sk); 3942 } 3943 3944 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_APPEARANCE, 0, NULL, 3945 0); 3946 3947 hci_dev_unlock(hdev); 3948 3949 return err; 3950 } 3951 3952 static int get_phy_configuration(struct sock *sk, struct hci_dev *hdev, 3953 void *data, u16 len) 3954 { 3955 struct mgmt_rp_get_phy_configuration rp; 3956 3957 bt_dev_dbg(hdev, "sock %p", sk); 3958 3959 hci_dev_lock(hdev); 3960 3961 memset(&rp, 0, sizeof(rp)); 3962 3963 rp.supported_phys = cpu_to_le32(get_supported_phys(hdev)); 3964 rp.selected_phys = cpu_to_le32(get_selected_phys(hdev)); 3965 rp.configurable_phys = cpu_to_le32(get_configurable_phys(hdev)); 3966 3967 hci_dev_unlock(hdev); 3968 3969 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_PHY_CONFIGURATION, 0, 3970 &rp, sizeof(rp)); 3971 } 3972 3973 int mgmt_phy_configuration_changed(struct hci_dev *hdev, struct sock *skip) 3974 { 3975 struct mgmt_ev_phy_configuration_changed ev; 3976 3977 memset(&ev, 0, sizeof(ev)); 3978 3979 ev.selected_phys = cpu_to_le32(get_selected_phys(hdev)); 3980 3981 return mgmt_event(MGMT_EV_PHY_CONFIGURATION_CHANGED, hdev, &ev, 3982 sizeof(ev), skip); 3983 } 3984 3985 static void set_default_phy_complete(struct hci_dev *hdev, void *data, int err) 3986 { 3987 struct mgmt_pending_cmd *cmd = data; 3988 struct sk_buff *skb = cmd->skb; 3989 u8 status = mgmt_status(err); 3990 3991 if (cmd != pending_find(MGMT_OP_SET_PHY_CONFIGURATION, hdev)) 3992 return; 3993 3994 if (!status) { 3995 if (!skb) 3996 status = MGMT_STATUS_FAILED; 3997 else if (IS_ERR(skb)) 3998 status = mgmt_status(PTR_ERR(skb)); 3999 else 4000 status = mgmt_status(skb->data[0]); 4001 } 4002 4003 bt_dev_dbg(hdev, "status %d", status); 4004 4005 if (status) { 4006 mgmt_cmd_status(cmd->sk, hdev->id, 4007 MGMT_OP_SET_PHY_CONFIGURATION, status); 4008 } else { 4009 mgmt_cmd_complete(cmd->sk, hdev->id, 4010 MGMT_OP_SET_PHY_CONFIGURATION, 0, 4011 NULL, 0); 4012 4013 mgmt_phy_configuration_changed(hdev, cmd->sk); 4014 } 4015 4016 if (skb && !IS_ERR(skb)) 4017 kfree_skb(skb); 4018 4019 mgmt_pending_remove(cmd); 4020 } 4021 4022 static int set_default_phy_sync(struct hci_dev *hdev, void *data) 4023 { 4024 struct mgmt_pending_cmd *cmd = data; 4025 struct mgmt_cp_set_phy_configuration *cp = cmd->param; 4026 struct hci_cp_le_set_default_phy cp_phy; 4027 u32 selected_phys = __le32_to_cpu(cp->selected_phys); 4028 4029 memset(&cp_phy, 0, sizeof(cp_phy)); 4030 4031 if (!(selected_phys & MGMT_PHY_LE_TX_MASK)) 4032 cp_phy.all_phys |= 0x01; 4033 4034 if (!(selected_phys & MGMT_PHY_LE_RX_MASK)) 4035 cp_phy.all_phys |= 0x02; 4036 4037 if (selected_phys & MGMT_PHY_LE_1M_TX) 4038 cp_phy.tx_phys |= HCI_LE_SET_PHY_1M; 4039 4040 if (selected_phys & MGMT_PHY_LE_2M_TX) 4041 cp_phy.tx_phys |= HCI_LE_SET_PHY_2M; 4042 4043 if (selected_phys & MGMT_PHY_LE_CODED_TX) 4044 cp_phy.tx_phys |= HCI_LE_SET_PHY_CODED; 4045 4046 if (selected_phys & MGMT_PHY_LE_1M_RX) 4047 cp_phy.rx_phys |= HCI_LE_SET_PHY_1M; 4048 4049 if (selected_phys & MGMT_PHY_LE_2M_RX) 4050 cp_phy.rx_phys |= HCI_LE_SET_PHY_2M; 4051 4052 if (selected_phys & MGMT_PHY_LE_CODED_RX) 4053 cp_phy.rx_phys |= HCI_LE_SET_PHY_CODED; 4054 4055 cmd->skb = __hci_cmd_sync(hdev, HCI_OP_LE_SET_DEFAULT_PHY, 4056 sizeof(cp_phy), &cp_phy, HCI_CMD_TIMEOUT); 4057 4058 return 0; 4059 } 4060 4061 static int set_phy_configuration(struct sock *sk, struct hci_dev *hdev, 4062 void *data, u16 len) 4063 { 4064 struct mgmt_cp_set_phy_configuration *cp = data; 4065 struct mgmt_pending_cmd *cmd; 4066 u32 selected_phys, configurable_phys, supported_phys, unconfigure_phys; 4067 u16 pkt_type = (HCI_DH1 | HCI_DM1); 4068 bool changed = false; 4069 int err; 4070 4071 bt_dev_dbg(hdev, "sock %p", sk); 4072 4073 configurable_phys = get_configurable_phys(hdev); 4074 supported_phys = get_supported_phys(hdev); 4075 selected_phys = __le32_to_cpu(cp->selected_phys); 4076 4077 if (selected_phys & ~supported_phys) 4078 return mgmt_cmd_status(sk, hdev->id, 4079 MGMT_OP_SET_PHY_CONFIGURATION, 4080 MGMT_STATUS_INVALID_PARAMS); 4081 4082 unconfigure_phys = supported_phys & ~configurable_phys; 4083 4084 if ((selected_phys & unconfigure_phys) != unconfigure_phys) 4085 return mgmt_cmd_status(sk, hdev->id, 4086 MGMT_OP_SET_PHY_CONFIGURATION, 4087 MGMT_STATUS_INVALID_PARAMS); 4088 4089 if (selected_phys == get_selected_phys(hdev)) 4090 return mgmt_cmd_complete(sk, hdev->id, 4091 MGMT_OP_SET_PHY_CONFIGURATION, 4092 0, NULL, 0); 4093 4094 hci_dev_lock(hdev); 4095 4096 if (!hdev_is_powered(hdev)) { 4097 err = mgmt_cmd_status(sk, hdev->id, 4098 MGMT_OP_SET_PHY_CONFIGURATION, 4099 MGMT_STATUS_REJECTED); 4100 goto unlock; 4101 } 4102 4103 if (pending_find(MGMT_OP_SET_PHY_CONFIGURATION, hdev)) { 4104 err = mgmt_cmd_status(sk, hdev->id, 4105 MGMT_OP_SET_PHY_CONFIGURATION, 4106 MGMT_STATUS_BUSY); 4107 goto unlock; 4108 } 4109 4110 if (selected_phys & MGMT_PHY_BR_1M_3SLOT) 4111 pkt_type |= (HCI_DH3 | HCI_DM3); 4112 else 4113 pkt_type &= ~(HCI_DH3 | HCI_DM3); 4114 4115 if (selected_phys & MGMT_PHY_BR_1M_5SLOT) 4116 pkt_type |= (HCI_DH5 | HCI_DM5); 4117 else 4118 pkt_type &= ~(HCI_DH5 | HCI_DM5); 4119 4120 if (selected_phys & MGMT_PHY_EDR_2M_1SLOT) 4121 pkt_type &= ~HCI_2DH1; 4122 else 4123 pkt_type |= HCI_2DH1; 4124 4125 if (selected_phys & MGMT_PHY_EDR_2M_3SLOT) 4126 pkt_type &= ~HCI_2DH3; 4127 else 4128 pkt_type |= HCI_2DH3; 4129 4130 if (selected_phys & MGMT_PHY_EDR_2M_5SLOT) 4131 pkt_type &= ~HCI_2DH5; 4132 else 4133 pkt_type |= HCI_2DH5; 4134 4135 if (selected_phys & MGMT_PHY_EDR_3M_1SLOT) 4136 pkt_type &= ~HCI_3DH1; 4137 else 4138 pkt_type |= HCI_3DH1; 4139 4140 if (selected_phys & MGMT_PHY_EDR_3M_3SLOT) 4141 pkt_type &= ~HCI_3DH3; 4142 else 4143 pkt_type |= HCI_3DH3; 4144 4145 if (selected_phys & MGMT_PHY_EDR_3M_5SLOT) 4146 pkt_type &= ~HCI_3DH5; 4147 else 4148 pkt_type |= HCI_3DH5; 4149 4150 if (pkt_type != hdev->pkt_type) { 4151 hdev->pkt_type = pkt_type; 4152 changed = true; 4153 } 4154 4155 if ((selected_phys & MGMT_PHY_LE_MASK) == 4156 (get_selected_phys(hdev) & MGMT_PHY_LE_MASK)) { 4157 if (changed) 4158 mgmt_phy_configuration_changed(hdev, sk); 4159 4160 err = mgmt_cmd_complete(sk, hdev->id, 4161 MGMT_OP_SET_PHY_CONFIGURATION, 4162 0, NULL, 0); 4163 4164 goto unlock; 4165 } 4166 4167 cmd = mgmt_pending_add(sk, MGMT_OP_SET_PHY_CONFIGURATION, hdev, data, 4168 len); 4169 if (!cmd) 4170 err = -ENOMEM; 4171 else 4172 err = hci_cmd_sync_queue(hdev, set_default_phy_sync, cmd, 4173 set_default_phy_complete); 4174 4175 if (err < 0) { 4176 err = mgmt_cmd_status(sk, hdev->id, 4177 MGMT_OP_SET_PHY_CONFIGURATION, 4178 MGMT_STATUS_FAILED); 4179 4180 if (cmd) 4181 mgmt_pending_remove(cmd); 4182 } 4183 4184 unlock: 4185 hci_dev_unlock(hdev); 4186 4187 return err; 4188 } 4189 4190 static int set_blocked_keys(struct sock *sk, struct hci_dev *hdev, void *data, 4191 u16 len) 4192 { 4193 int err = MGMT_STATUS_SUCCESS; 4194 struct mgmt_cp_set_blocked_keys *keys = data; 4195 const u16 max_key_count = ((U16_MAX - sizeof(*keys)) / 4196 sizeof(struct mgmt_blocked_key_info)); 4197 u16 key_count, expected_len; 4198 int i; 4199 4200 bt_dev_dbg(hdev, "sock %p", sk); 4201 4202 key_count = __le16_to_cpu(keys->key_count); 4203 if (key_count > max_key_count) { 4204 bt_dev_err(hdev, "too big key_count value %u", key_count); 4205 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BLOCKED_KEYS, 4206 MGMT_STATUS_INVALID_PARAMS); 4207 } 4208 4209 expected_len = struct_size(keys, keys, key_count); 4210 if (expected_len != len) { 4211 bt_dev_err(hdev, "expected %u bytes, got %u bytes", 4212 expected_len, len); 4213 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BLOCKED_KEYS, 4214 MGMT_STATUS_INVALID_PARAMS); 4215 } 4216 4217 hci_dev_lock(hdev); 4218 4219 hci_blocked_keys_clear(hdev); 4220 4221 for (i = 0; i < key_count; ++i) { 4222 struct blocked_key *b = kzalloc(sizeof(*b), GFP_KERNEL); 4223 4224 if (!b) { 4225 err = MGMT_STATUS_NO_RESOURCES; 4226 break; 4227 } 4228 4229 b->type = keys->keys[i].type; 4230 memcpy(b->val, keys->keys[i].val, sizeof(b->val)); 4231 list_add_rcu(&b->list, &hdev->blocked_keys); 4232 } 4233 hci_dev_unlock(hdev); 4234 4235 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_BLOCKED_KEYS, 4236 err, NULL, 0); 4237 } 4238 4239 static int set_wideband_speech(struct sock *sk, struct hci_dev *hdev, 4240 void *data, u16 len) 4241 { 4242 struct mgmt_mode *cp = data; 4243 int err; 4244 bool changed = false; 4245 4246 bt_dev_dbg(hdev, "sock %p", sk); 4247 4248 if (!test_bit(HCI_QUIRK_WIDEBAND_SPEECH_SUPPORTED, &hdev->quirks)) 4249 return mgmt_cmd_status(sk, hdev->id, 4250 MGMT_OP_SET_WIDEBAND_SPEECH, 4251 MGMT_STATUS_NOT_SUPPORTED); 4252 4253 if (cp->val != 0x00 && cp->val != 0x01) 4254 return mgmt_cmd_status(sk, hdev->id, 4255 MGMT_OP_SET_WIDEBAND_SPEECH, 4256 MGMT_STATUS_INVALID_PARAMS); 4257 4258 hci_dev_lock(hdev); 4259 4260 if (hdev_is_powered(hdev) && 4261 !!cp->val != hci_dev_test_flag(hdev, 4262 HCI_WIDEBAND_SPEECH_ENABLED)) { 4263 err = mgmt_cmd_status(sk, hdev->id, 4264 MGMT_OP_SET_WIDEBAND_SPEECH, 4265 MGMT_STATUS_REJECTED); 4266 goto unlock; 4267 } 4268 4269 if (cp->val) 4270 changed = !hci_dev_test_and_set_flag(hdev, 4271 HCI_WIDEBAND_SPEECH_ENABLED); 4272 else 4273 changed = hci_dev_test_and_clear_flag(hdev, 4274 HCI_WIDEBAND_SPEECH_ENABLED); 4275 4276 err = send_settings_rsp(sk, MGMT_OP_SET_WIDEBAND_SPEECH, hdev); 4277 if (err < 0) 4278 goto unlock; 4279 4280 if (changed) 4281 err = new_settings(hdev, sk); 4282 4283 unlock: 4284 hci_dev_unlock(hdev); 4285 return err; 4286 } 4287 4288 static int read_controller_cap(struct sock *sk, struct hci_dev *hdev, 4289 void *data, u16 data_len) 4290 { 4291 char buf[20]; 4292 struct mgmt_rp_read_controller_cap *rp = (void *)buf; 4293 u16 cap_len = 0; 4294 u8 flags = 0; 4295 u8 tx_power_range[2]; 4296 4297 bt_dev_dbg(hdev, "sock %p", sk); 4298 4299 memset(&buf, 0, sizeof(buf)); 4300 4301 hci_dev_lock(hdev); 4302 4303 /* When the Read Simple Pairing Options command is supported, then 4304 * the remote public key validation is supported. 4305 * 4306 * Alternatively, when Microsoft extensions are available, they can 4307 * indicate support for public key validation as well. 4308 */ 4309 if ((hdev->commands[41] & 0x08) || msft_curve_validity(hdev)) 4310 flags |= 0x01; /* Remote public key validation (BR/EDR) */ 4311 4312 flags |= 0x02; /* Remote public key validation (LE) */ 4313 4314 /* When the Read Encryption Key Size command is supported, then the 4315 * encryption key size is enforced. 4316 */ 4317 if (hdev->commands[20] & 0x10) 4318 flags |= 0x04; /* Encryption key size enforcement (BR/EDR) */ 4319 4320 flags |= 0x08; /* Encryption key size enforcement (LE) */ 4321 4322 cap_len = eir_append_data(rp->cap, cap_len, MGMT_CAP_SEC_FLAGS, 4323 &flags, 1); 4324 4325 /* When the Read Simple Pairing Options command is supported, then 4326 * also max encryption key size information is provided. 4327 */ 4328 if (hdev->commands[41] & 0x08) 4329 cap_len = eir_append_le16(rp->cap, cap_len, 4330 MGMT_CAP_MAX_ENC_KEY_SIZE, 4331 hdev->max_enc_key_size); 4332 4333 cap_len = eir_append_le16(rp->cap, cap_len, 4334 MGMT_CAP_SMP_MAX_ENC_KEY_SIZE, 4335 SMP_MAX_ENC_KEY_SIZE); 4336 4337 /* Append the min/max LE tx power parameters if we were able to fetch 4338 * it from the controller 4339 */ 4340 if (hdev->commands[38] & 0x80) { 4341 memcpy(&tx_power_range[0], &hdev->min_le_tx_power, 1); 4342 memcpy(&tx_power_range[1], &hdev->max_le_tx_power, 1); 4343 cap_len = eir_append_data(rp->cap, cap_len, MGMT_CAP_LE_TX_PWR, 4344 tx_power_range, 2); 4345 } 4346 4347 rp->cap_len = cpu_to_le16(cap_len); 4348 4349 hci_dev_unlock(hdev); 4350 4351 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_CONTROLLER_CAP, 0, 4352 rp, sizeof(*rp) + cap_len); 4353 } 4354 4355 #ifdef CONFIG_BT_FEATURE_DEBUG 4356 /* d4992530-b9ec-469f-ab01-6c481c47da1c */ 4357 static const u8 debug_uuid[16] = { 4358 0x1c, 0xda, 0x47, 0x1c, 0x48, 0x6c, 0x01, 0xab, 4359 0x9f, 0x46, 0xec, 0xb9, 0x30, 0x25, 0x99, 0xd4, 4360 }; 4361 #endif 4362 4363 /* 330859bc-7506-492d-9370-9a6f0614037f */ 4364 static const u8 quality_report_uuid[16] = { 4365 0x7f, 0x03, 0x14, 0x06, 0x6f, 0x9a, 0x70, 0x93, 4366 0x2d, 0x49, 0x06, 0x75, 0xbc, 0x59, 0x08, 0x33, 4367 }; 4368 4369 /* a6695ace-ee7f-4fb9-881a-5fac66c629af */ 4370 static const u8 offload_codecs_uuid[16] = { 4371 0xaf, 0x29, 0xc6, 0x66, 0xac, 0x5f, 0x1a, 0x88, 4372 0xb9, 0x4f, 0x7f, 0xee, 0xce, 0x5a, 0x69, 0xa6, 4373 }; 4374 4375 /* 671b10b5-42c0-4696-9227-eb28d1b049d6 */ 4376 static const u8 le_simultaneous_roles_uuid[16] = { 4377 0xd6, 0x49, 0xb0, 0xd1, 0x28, 0xeb, 0x27, 0x92, 4378 0x96, 0x46, 0xc0, 0x42, 0xb5, 0x10, 0x1b, 0x67, 4379 }; 4380 4381 /* 15c0a148-c273-11ea-b3de-0242ac130004 */ 4382 static const u8 rpa_resolution_uuid[16] = { 4383 0x04, 0x00, 0x13, 0xac, 0x42, 0x02, 0xde, 0xb3, 4384 0xea, 0x11, 0x73, 0xc2, 0x48, 0xa1, 0xc0, 0x15, 4385 }; 4386 4387 /* 6fbaf188-05e0-496a-9885-d6ddfdb4e03e */ 4388 static const u8 iso_socket_uuid[16] = { 4389 0x3e, 0xe0, 0xb4, 0xfd, 0xdd, 0xd6, 0x85, 0x98, 4390 0x6a, 0x49, 0xe0, 0x05, 0x88, 0xf1, 0xba, 0x6f, 4391 }; 4392 4393 /* 2ce463d7-7a03-4d8d-bf05-5f24e8f36e76 */ 4394 static const u8 mgmt_mesh_uuid[16] = { 4395 0x76, 0x6e, 0xf3, 0xe8, 0x24, 0x5f, 0x05, 0xbf, 4396 0x8d, 0x4d, 0x03, 0x7a, 0xd7, 0x63, 0xe4, 0x2c, 4397 }; 4398 4399 static int read_exp_features_info(struct sock *sk, struct hci_dev *hdev, 4400 void *data, u16 data_len) 4401 { 4402 struct mgmt_rp_read_exp_features_info *rp; 4403 size_t len; 4404 u16 idx = 0; 4405 u32 flags; 4406 int status; 4407 4408 bt_dev_dbg(hdev, "sock %p", sk); 4409 4410 /* Enough space for 7 features */ 4411 len = sizeof(*rp) + (sizeof(rp->features[0]) * 7); 4412 rp = kzalloc(len, GFP_KERNEL); 4413 if (!rp) 4414 return -ENOMEM; 4415 4416 #ifdef CONFIG_BT_FEATURE_DEBUG 4417 if (!hdev) { 4418 flags = bt_dbg_get() ? BIT(0) : 0; 4419 4420 memcpy(rp->features[idx].uuid, debug_uuid, 16); 4421 rp->features[idx].flags = cpu_to_le32(flags); 4422 idx++; 4423 } 4424 #endif 4425 4426 if (hdev && hci_dev_le_state_simultaneous(hdev)) { 4427 if (hci_dev_test_flag(hdev, HCI_LE_SIMULTANEOUS_ROLES)) 4428 flags = BIT(0); 4429 else 4430 flags = 0; 4431 4432 memcpy(rp->features[idx].uuid, le_simultaneous_roles_uuid, 16); 4433 rp->features[idx].flags = cpu_to_le32(flags); 4434 idx++; 4435 } 4436 4437 if (hdev && ll_privacy_capable(hdev)) { 4438 if (hci_dev_test_flag(hdev, HCI_ENABLE_LL_PRIVACY)) 4439 flags = BIT(0) | BIT(1); 4440 else 4441 flags = BIT(1); 4442 4443 memcpy(rp->features[idx].uuid, rpa_resolution_uuid, 16); 4444 rp->features[idx].flags = cpu_to_le32(flags); 4445 idx++; 4446 } 4447 4448 if (hdev && (aosp_has_quality_report(hdev) || 4449 hdev->set_quality_report)) { 4450 if (hci_dev_test_flag(hdev, HCI_QUALITY_REPORT)) 4451 flags = BIT(0); 4452 else 4453 flags = 0; 4454 4455 memcpy(rp->features[idx].uuid, quality_report_uuid, 16); 4456 rp->features[idx].flags = cpu_to_le32(flags); 4457 idx++; 4458 } 4459 4460 if (hdev && hdev->get_data_path_id) { 4461 if (hci_dev_test_flag(hdev, HCI_OFFLOAD_CODECS_ENABLED)) 4462 flags = BIT(0); 4463 else 4464 flags = 0; 4465 4466 memcpy(rp->features[idx].uuid, offload_codecs_uuid, 16); 4467 rp->features[idx].flags = cpu_to_le32(flags); 4468 idx++; 4469 } 4470 4471 if (IS_ENABLED(CONFIG_BT_LE)) { 4472 flags = iso_enabled() ? BIT(0) : 0; 4473 memcpy(rp->features[idx].uuid, iso_socket_uuid, 16); 4474 rp->features[idx].flags = cpu_to_le32(flags); 4475 idx++; 4476 } 4477 4478 if (hdev && lmp_le_capable(hdev)) { 4479 if (hci_dev_test_flag(hdev, HCI_MESH_EXPERIMENTAL)) 4480 flags = BIT(0); 4481 else 4482 flags = 0; 4483 4484 memcpy(rp->features[idx].uuid, mgmt_mesh_uuid, 16); 4485 rp->features[idx].flags = cpu_to_le32(flags); 4486 idx++; 4487 } 4488 4489 rp->feature_count = cpu_to_le16(idx); 4490 4491 /* After reading the experimental features information, enable 4492 * the events to update client on any future change. 4493 */ 4494 hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS); 4495 4496 status = mgmt_cmd_complete(sk, hdev ? hdev->id : MGMT_INDEX_NONE, 4497 MGMT_OP_READ_EXP_FEATURES_INFO, 4498 0, rp, sizeof(*rp) + (20 * idx)); 4499 4500 kfree(rp); 4501 return status; 4502 } 4503 4504 static int exp_ll_privacy_feature_changed(bool enabled, struct hci_dev *hdev, 4505 struct sock *skip) 4506 { 4507 struct mgmt_ev_exp_feature_changed ev; 4508 4509 memset(&ev, 0, sizeof(ev)); 4510 memcpy(ev.uuid, rpa_resolution_uuid, 16); 4511 ev.flags = cpu_to_le32((enabled ? BIT(0) : 0) | BIT(1)); 4512 4513 // Do we need to be atomic with the conn_flags? 4514 if (enabled && privacy_mode_capable(hdev)) 4515 hdev->conn_flags |= HCI_CONN_FLAG_DEVICE_PRIVACY; 4516 else 4517 hdev->conn_flags &= ~HCI_CONN_FLAG_DEVICE_PRIVACY; 4518 4519 return mgmt_limited_event(MGMT_EV_EXP_FEATURE_CHANGED, hdev, 4520 &ev, sizeof(ev), 4521 HCI_MGMT_EXP_FEATURE_EVENTS, skip); 4522 4523 } 4524 4525 static int exp_feature_changed(struct hci_dev *hdev, const u8 *uuid, 4526 bool enabled, struct sock *skip) 4527 { 4528 struct mgmt_ev_exp_feature_changed ev; 4529 4530 memset(&ev, 0, sizeof(ev)); 4531 memcpy(ev.uuid, uuid, 16); 4532 ev.flags = cpu_to_le32(enabled ? BIT(0) : 0); 4533 4534 return mgmt_limited_event(MGMT_EV_EXP_FEATURE_CHANGED, hdev, 4535 &ev, sizeof(ev), 4536 HCI_MGMT_EXP_FEATURE_EVENTS, skip); 4537 } 4538 4539 #define EXP_FEAT(_uuid, _set_func) \ 4540 { \ 4541 .uuid = _uuid, \ 4542 .set_func = _set_func, \ 4543 } 4544 4545 /* The zero key uuid is special. Multiple exp features are set through it. */ 4546 static int set_zero_key_func(struct sock *sk, struct hci_dev *hdev, 4547 struct mgmt_cp_set_exp_feature *cp, u16 data_len) 4548 { 4549 struct mgmt_rp_set_exp_feature rp; 4550 4551 memset(rp.uuid, 0, 16); 4552 rp.flags = cpu_to_le32(0); 4553 4554 #ifdef CONFIG_BT_FEATURE_DEBUG 4555 if (!hdev) { 4556 bool changed = bt_dbg_get(); 4557 4558 bt_dbg_set(false); 4559 4560 if (changed) 4561 exp_feature_changed(NULL, ZERO_KEY, false, sk); 4562 } 4563 #endif 4564 4565 if (hdev && use_ll_privacy(hdev) && !hdev_is_powered(hdev)) { 4566 bool changed; 4567 4568 changed = hci_dev_test_and_clear_flag(hdev, 4569 HCI_ENABLE_LL_PRIVACY); 4570 if (changed) 4571 exp_feature_changed(hdev, rpa_resolution_uuid, false, 4572 sk); 4573 } 4574 4575 hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS); 4576 4577 return mgmt_cmd_complete(sk, hdev ? hdev->id : MGMT_INDEX_NONE, 4578 MGMT_OP_SET_EXP_FEATURE, 0, 4579 &rp, sizeof(rp)); 4580 } 4581 4582 #ifdef CONFIG_BT_FEATURE_DEBUG 4583 static int set_debug_func(struct sock *sk, struct hci_dev *hdev, 4584 struct mgmt_cp_set_exp_feature *cp, u16 data_len) 4585 { 4586 struct mgmt_rp_set_exp_feature rp; 4587 4588 bool val, changed; 4589 int err; 4590 4591 /* Command requires to use the non-controller index */ 4592 if (hdev) 4593 return mgmt_cmd_status(sk, hdev->id, 4594 MGMT_OP_SET_EXP_FEATURE, 4595 MGMT_STATUS_INVALID_INDEX); 4596 4597 /* Parameters are limited to a single octet */ 4598 if (data_len != MGMT_SET_EXP_FEATURE_SIZE + 1) 4599 return mgmt_cmd_status(sk, MGMT_INDEX_NONE, 4600 MGMT_OP_SET_EXP_FEATURE, 4601 MGMT_STATUS_INVALID_PARAMS); 4602 4603 /* Only boolean on/off is supported */ 4604 if (cp->param[0] != 0x00 && cp->param[0] != 0x01) 4605 return mgmt_cmd_status(sk, MGMT_INDEX_NONE, 4606 MGMT_OP_SET_EXP_FEATURE, 4607 MGMT_STATUS_INVALID_PARAMS); 4608 4609 val = !!cp->param[0]; 4610 changed = val ? !bt_dbg_get() : bt_dbg_get(); 4611 bt_dbg_set(val); 4612 4613 memcpy(rp.uuid, debug_uuid, 16); 4614 rp.flags = cpu_to_le32(val ? BIT(0) : 0); 4615 4616 hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS); 4617 4618 err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE, 4619 MGMT_OP_SET_EXP_FEATURE, 0, 4620 &rp, sizeof(rp)); 4621 4622 if (changed) 4623 exp_feature_changed(hdev, debug_uuid, val, sk); 4624 4625 return err; 4626 } 4627 #endif 4628 4629 static int set_mgmt_mesh_func(struct sock *sk, struct hci_dev *hdev, 4630 struct mgmt_cp_set_exp_feature *cp, u16 data_len) 4631 { 4632 struct mgmt_rp_set_exp_feature rp; 4633 bool val, changed; 4634 int err; 4635 4636 /* Command requires to use the controller index */ 4637 if (!hdev) 4638 return mgmt_cmd_status(sk, MGMT_INDEX_NONE, 4639 MGMT_OP_SET_EXP_FEATURE, 4640 MGMT_STATUS_INVALID_INDEX); 4641 4642 /* Parameters are limited to a single octet */ 4643 if (data_len != MGMT_SET_EXP_FEATURE_SIZE + 1) 4644 return mgmt_cmd_status(sk, hdev->id, 4645 MGMT_OP_SET_EXP_FEATURE, 4646 MGMT_STATUS_INVALID_PARAMS); 4647 4648 /* Only boolean on/off is supported */ 4649 if (cp->param[0] != 0x00 && cp->param[0] != 0x01) 4650 return mgmt_cmd_status(sk, hdev->id, 4651 MGMT_OP_SET_EXP_FEATURE, 4652 MGMT_STATUS_INVALID_PARAMS); 4653 4654 val = !!cp->param[0]; 4655 4656 if (val) { 4657 changed = !hci_dev_test_and_set_flag(hdev, 4658 HCI_MESH_EXPERIMENTAL); 4659 } else { 4660 hci_dev_clear_flag(hdev, HCI_MESH); 4661 changed = hci_dev_test_and_clear_flag(hdev, 4662 HCI_MESH_EXPERIMENTAL); 4663 } 4664 4665 memcpy(rp.uuid, mgmt_mesh_uuid, 16); 4666 rp.flags = cpu_to_le32(val ? BIT(0) : 0); 4667 4668 hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS); 4669 4670 err = mgmt_cmd_complete(sk, hdev->id, 4671 MGMT_OP_SET_EXP_FEATURE, 0, 4672 &rp, sizeof(rp)); 4673 4674 if (changed) 4675 exp_feature_changed(hdev, mgmt_mesh_uuid, val, sk); 4676 4677 return err; 4678 } 4679 4680 static int set_rpa_resolution_func(struct sock *sk, struct hci_dev *hdev, 4681 struct mgmt_cp_set_exp_feature *cp, 4682 u16 data_len) 4683 { 4684 struct mgmt_rp_set_exp_feature rp; 4685 bool val, changed; 4686 int err; 4687 u32 flags; 4688 4689 /* Command requires to use the controller index */ 4690 if (!hdev) 4691 return mgmt_cmd_status(sk, MGMT_INDEX_NONE, 4692 MGMT_OP_SET_EXP_FEATURE, 4693 MGMT_STATUS_INVALID_INDEX); 4694 4695 /* Changes can only be made when controller is powered down */ 4696 if (hdev_is_powered(hdev)) 4697 return mgmt_cmd_status(sk, hdev->id, 4698 MGMT_OP_SET_EXP_FEATURE, 4699 MGMT_STATUS_REJECTED); 4700 4701 /* Parameters are limited to a single octet */ 4702 if (data_len != MGMT_SET_EXP_FEATURE_SIZE + 1) 4703 return mgmt_cmd_status(sk, hdev->id, 4704 MGMT_OP_SET_EXP_FEATURE, 4705 MGMT_STATUS_INVALID_PARAMS); 4706 4707 /* Only boolean on/off is supported */ 4708 if (cp->param[0] != 0x00 && cp->param[0] != 0x01) 4709 return mgmt_cmd_status(sk, hdev->id, 4710 MGMT_OP_SET_EXP_FEATURE, 4711 MGMT_STATUS_INVALID_PARAMS); 4712 4713 val = !!cp->param[0]; 4714 4715 if (val) { 4716 changed = !hci_dev_test_and_set_flag(hdev, 4717 HCI_ENABLE_LL_PRIVACY); 4718 hci_dev_clear_flag(hdev, HCI_ADVERTISING); 4719 4720 /* Enable LL privacy + supported settings changed */ 4721 flags = BIT(0) | BIT(1); 4722 } else { 4723 changed = hci_dev_test_and_clear_flag(hdev, 4724 HCI_ENABLE_LL_PRIVACY); 4725 4726 /* Disable LL privacy + supported settings changed */ 4727 flags = BIT(1); 4728 } 4729 4730 memcpy(rp.uuid, rpa_resolution_uuid, 16); 4731 rp.flags = cpu_to_le32(flags); 4732 4733 hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS); 4734 4735 err = mgmt_cmd_complete(sk, hdev->id, 4736 MGMT_OP_SET_EXP_FEATURE, 0, 4737 &rp, sizeof(rp)); 4738 4739 if (changed) 4740 exp_ll_privacy_feature_changed(val, hdev, sk); 4741 4742 return err; 4743 } 4744 4745 static int set_quality_report_func(struct sock *sk, struct hci_dev *hdev, 4746 struct mgmt_cp_set_exp_feature *cp, 4747 u16 data_len) 4748 { 4749 struct mgmt_rp_set_exp_feature rp; 4750 bool val, changed; 4751 int err; 4752 4753 /* Command requires to use a valid controller index */ 4754 if (!hdev) 4755 return mgmt_cmd_status(sk, MGMT_INDEX_NONE, 4756 MGMT_OP_SET_EXP_FEATURE, 4757 MGMT_STATUS_INVALID_INDEX); 4758 4759 /* Parameters are limited to a single octet */ 4760 if (data_len != MGMT_SET_EXP_FEATURE_SIZE + 1) 4761 return mgmt_cmd_status(sk, hdev->id, 4762 MGMT_OP_SET_EXP_FEATURE, 4763 MGMT_STATUS_INVALID_PARAMS); 4764 4765 /* Only boolean on/off is supported */ 4766 if (cp->param[0] != 0x00 && cp->param[0] != 0x01) 4767 return mgmt_cmd_status(sk, hdev->id, 4768 MGMT_OP_SET_EXP_FEATURE, 4769 MGMT_STATUS_INVALID_PARAMS); 4770 4771 hci_req_sync_lock(hdev); 4772 4773 val = !!cp->param[0]; 4774 changed = (val != hci_dev_test_flag(hdev, HCI_QUALITY_REPORT)); 4775 4776 if (!aosp_has_quality_report(hdev) && !hdev->set_quality_report) { 4777 err = mgmt_cmd_status(sk, hdev->id, 4778 MGMT_OP_SET_EXP_FEATURE, 4779 MGMT_STATUS_NOT_SUPPORTED); 4780 goto unlock_quality_report; 4781 } 4782 4783 if (changed) { 4784 if (hdev->set_quality_report) 4785 err = hdev->set_quality_report(hdev, val); 4786 else 4787 err = aosp_set_quality_report(hdev, val); 4788 4789 if (err) { 4790 err = mgmt_cmd_status(sk, hdev->id, 4791 MGMT_OP_SET_EXP_FEATURE, 4792 MGMT_STATUS_FAILED); 4793 goto unlock_quality_report; 4794 } 4795 4796 if (val) 4797 hci_dev_set_flag(hdev, HCI_QUALITY_REPORT); 4798 else 4799 hci_dev_clear_flag(hdev, HCI_QUALITY_REPORT); 4800 } 4801 4802 bt_dev_dbg(hdev, "quality report enable %d changed %d", val, changed); 4803 4804 memcpy(rp.uuid, quality_report_uuid, 16); 4805 rp.flags = cpu_to_le32(val ? BIT(0) : 0); 4806 hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS); 4807 4808 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_EXP_FEATURE, 0, 4809 &rp, sizeof(rp)); 4810 4811 if (changed) 4812 exp_feature_changed(hdev, quality_report_uuid, val, sk); 4813 4814 unlock_quality_report: 4815 hci_req_sync_unlock(hdev); 4816 return err; 4817 } 4818 4819 static int set_offload_codec_func(struct sock *sk, struct hci_dev *hdev, 4820 struct mgmt_cp_set_exp_feature *cp, 4821 u16 data_len) 4822 { 4823 bool val, changed; 4824 int err; 4825 struct mgmt_rp_set_exp_feature rp; 4826 4827 /* Command requires to use a valid controller index */ 4828 if (!hdev) 4829 return mgmt_cmd_status(sk, MGMT_INDEX_NONE, 4830 MGMT_OP_SET_EXP_FEATURE, 4831 MGMT_STATUS_INVALID_INDEX); 4832 4833 /* Parameters are limited to a single octet */ 4834 if (data_len != MGMT_SET_EXP_FEATURE_SIZE + 1) 4835 return mgmt_cmd_status(sk, hdev->id, 4836 MGMT_OP_SET_EXP_FEATURE, 4837 MGMT_STATUS_INVALID_PARAMS); 4838 4839 /* Only boolean on/off is supported */ 4840 if (cp->param[0] != 0x00 && cp->param[0] != 0x01) 4841 return mgmt_cmd_status(sk, hdev->id, 4842 MGMT_OP_SET_EXP_FEATURE, 4843 MGMT_STATUS_INVALID_PARAMS); 4844 4845 val = !!cp->param[0]; 4846 changed = (val != hci_dev_test_flag(hdev, HCI_OFFLOAD_CODECS_ENABLED)); 4847 4848 if (!hdev->get_data_path_id) { 4849 return mgmt_cmd_status(sk, hdev->id, 4850 MGMT_OP_SET_EXP_FEATURE, 4851 MGMT_STATUS_NOT_SUPPORTED); 4852 } 4853 4854 if (changed) { 4855 if (val) 4856 hci_dev_set_flag(hdev, HCI_OFFLOAD_CODECS_ENABLED); 4857 else 4858 hci_dev_clear_flag(hdev, HCI_OFFLOAD_CODECS_ENABLED); 4859 } 4860 4861 bt_dev_info(hdev, "offload codecs enable %d changed %d", 4862 val, changed); 4863 4864 memcpy(rp.uuid, offload_codecs_uuid, 16); 4865 rp.flags = cpu_to_le32(val ? BIT(0) : 0); 4866 hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS); 4867 err = mgmt_cmd_complete(sk, hdev->id, 4868 MGMT_OP_SET_EXP_FEATURE, 0, 4869 &rp, sizeof(rp)); 4870 4871 if (changed) 4872 exp_feature_changed(hdev, offload_codecs_uuid, val, sk); 4873 4874 return err; 4875 } 4876 4877 static int set_le_simultaneous_roles_func(struct sock *sk, struct hci_dev *hdev, 4878 struct mgmt_cp_set_exp_feature *cp, 4879 u16 data_len) 4880 { 4881 bool val, changed; 4882 int err; 4883 struct mgmt_rp_set_exp_feature rp; 4884 4885 /* Command requires to use a valid controller index */ 4886 if (!hdev) 4887 return mgmt_cmd_status(sk, MGMT_INDEX_NONE, 4888 MGMT_OP_SET_EXP_FEATURE, 4889 MGMT_STATUS_INVALID_INDEX); 4890 4891 /* Parameters are limited to a single octet */ 4892 if (data_len != MGMT_SET_EXP_FEATURE_SIZE + 1) 4893 return mgmt_cmd_status(sk, hdev->id, 4894 MGMT_OP_SET_EXP_FEATURE, 4895 MGMT_STATUS_INVALID_PARAMS); 4896 4897 /* Only boolean on/off is supported */ 4898 if (cp->param[0] != 0x00 && cp->param[0] != 0x01) 4899 return mgmt_cmd_status(sk, hdev->id, 4900 MGMT_OP_SET_EXP_FEATURE, 4901 MGMT_STATUS_INVALID_PARAMS); 4902 4903 val = !!cp->param[0]; 4904 changed = (val != hci_dev_test_flag(hdev, HCI_LE_SIMULTANEOUS_ROLES)); 4905 4906 if (!hci_dev_le_state_simultaneous(hdev)) { 4907 return mgmt_cmd_status(sk, hdev->id, 4908 MGMT_OP_SET_EXP_FEATURE, 4909 MGMT_STATUS_NOT_SUPPORTED); 4910 } 4911 4912 if (changed) { 4913 if (val) 4914 hci_dev_set_flag(hdev, HCI_LE_SIMULTANEOUS_ROLES); 4915 else 4916 hci_dev_clear_flag(hdev, HCI_LE_SIMULTANEOUS_ROLES); 4917 } 4918 4919 bt_dev_info(hdev, "LE simultaneous roles enable %d changed %d", 4920 val, changed); 4921 4922 memcpy(rp.uuid, le_simultaneous_roles_uuid, 16); 4923 rp.flags = cpu_to_le32(val ? BIT(0) : 0); 4924 hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS); 4925 err = mgmt_cmd_complete(sk, hdev->id, 4926 MGMT_OP_SET_EXP_FEATURE, 0, 4927 &rp, sizeof(rp)); 4928 4929 if (changed) 4930 exp_feature_changed(hdev, le_simultaneous_roles_uuid, val, sk); 4931 4932 return err; 4933 } 4934 4935 #ifdef CONFIG_BT_LE 4936 static int set_iso_socket_func(struct sock *sk, struct hci_dev *hdev, 4937 struct mgmt_cp_set_exp_feature *cp, u16 data_len) 4938 { 4939 struct mgmt_rp_set_exp_feature rp; 4940 bool val, changed = false; 4941 int err; 4942 4943 /* Command requires to use the non-controller index */ 4944 if (hdev) 4945 return mgmt_cmd_status(sk, hdev->id, 4946 MGMT_OP_SET_EXP_FEATURE, 4947 MGMT_STATUS_INVALID_INDEX); 4948 4949 /* Parameters are limited to a single octet */ 4950 if (data_len != MGMT_SET_EXP_FEATURE_SIZE + 1) 4951 return mgmt_cmd_status(sk, MGMT_INDEX_NONE, 4952 MGMT_OP_SET_EXP_FEATURE, 4953 MGMT_STATUS_INVALID_PARAMS); 4954 4955 /* Only boolean on/off is supported */ 4956 if (cp->param[0] != 0x00 && cp->param[0] != 0x01) 4957 return mgmt_cmd_status(sk, MGMT_INDEX_NONE, 4958 MGMT_OP_SET_EXP_FEATURE, 4959 MGMT_STATUS_INVALID_PARAMS); 4960 4961 val = cp->param[0] ? true : false; 4962 if (val) 4963 err = iso_init(); 4964 else 4965 err = iso_exit(); 4966 4967 if (!err) 4968 changed = true; 4969 4970 memcpy(rp.uuid, iso_socket_uuid, 16); 4971 rp.flags = cpu_to_le32(val ? BIT(0) : 0); 4972 4973 hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS); 4974 4975 err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE, 4976 MGMT_OP_SET_EXP_FEATURE, 0, 4977 &rp, sizeof(rp)); 4978 4979 if (changed) 4980 exp_feature_changed(hdev, iso_socket_uuid, val, sk); 4981 4982 return err; 4983 } 4984 #endif 4985 4986 static const struct mgmt_exp_feature { 4987 const u8 *uuid; 4988 int (*set_func)(struct sock *sk, struct hci_dev *hdev, 4989 struct mgmt_cp_set_exp_feature *cp, u16 data_len); 4990 } exp_features[] = { 4991 EXP_FEAT(ZERO_KEY, set_zero_key_func), 4992 #ifdef CONFIG_BT_FEATURE_DEBUG 4993 EXP_FEAT(debug_uuid, set_debug_func), 4994 #endif 4995 EXP_FEAT(mgmt_mesh_uuid, set_mgmt_mesh_func), 4996 EXP_FEAT(rpa_resolution_uuid, set_rpa_resolution_func), 4997 EXP_FEAT(quality_report_uuid, set_quality_report_func), 4998 EXP_FEAT(offload_codecs_uuid, set_offload_codec_func), 4999 EXP_FEAT(le_simultaneous_roles_uuid, set_le_simultaneous_roles_func), 5000 #ifdef CONFIG_BT_LE 5001 EXP_FEAT(iso_socket_uuid, set_iso_socket_func), 5002 #endif 5003 5004 /* end with a null feature */ 5005 EXP_FEAT(NULL, NULL) 5006 }; 5007 5008 static int set_exp_feature(struct sock *sk, struct hci_dev *hdev, 5009 void *data, u16 data_len) 5010 { 5011 struct mgmt_cp_set_exp_feature *cp = data; 5012 size_t i = 0; 5013 5014 bt_dev_dbg(hdev, "sock %p", sk); 5015 5016 for (i = 0; exp_features[i].uuid; i++) { 5017 if (!memcmp(cp->uuid, exp_features[i].uuid, 16)) 5018 return exp_features[i].set_func(sk, hdev, cp, data_len); 5019 } 5020 5021 return mgmt_cmd_status(sk, hdev ? hdev->id : MGMT_INDEX_NONE, 5022 MGMT_OP_SET_EXP_FEATURE, 5023 MGMT_STATUS_NOT_SUPPORTED); 5024 } 5025 5026 static u32 get_params_flags(struct hci_dev *hdev, 5027 struct hci_conn_params *params) 5028 { 5029 u32 flags = hdev->conn_flags; 5030 5031 /* Devices using RPAs can only be programmed in the acceptlist if 5032 * LL Privacy has been enable otherwise they cannot mark 5033 * HCI_CONN_FLAG_REMOTE_WAKEUP. 5034 */ 5035 if ((flags & HCI_CONN_FLAG_REMOTE_WAKEUP) && !use_ll_privacy(hdev) && 5036 hci_find_irk_by_addr(hdev, ¶ms->addr, params->addr_type)) 5037 flags &= ~HCI_CONN_FLAG_REMOTE_WAKEUP; 5038 5039 return flags; 5040 } 5041 5042 static int get_device_flags(struct sock *sk, struct hci_dev *hdev, void *data, 5043 u16 data_len) 5044 { 5045 struct mgmt_cp_get_device_flags *cp = data; 5046 struct mgmt_rp_get_device_flags rp; 5047 struct bdaddr_list_with_flags *br_params; 5048 struct hci_conn_params *params; 5049 u32 supported_flags; 5050 u32 current_flags = 0; 5051 u8 status = MGMT_STATUS_INVALID_PARAMS; 5052 5053 bt_dev_dbg(hdev, "Get device flags %pMR (type 0x%x)\n", 5054 &cp->addr.bdaddr, cp->addr.type); 5055 5056 hci_dev_lock(hdev); 5057 5058 supported_flags = hdev->conn_flags; 5059 5060 memset(&rp, 0, sizeof(rp)); 5061 5062 if (cp->addr.type == BDADDR_BREDR) { 5063 br_params = hci_bdaddr_list_lookup_with_flags(&hdev->accept_list, 5064 &cp->addr.bdaddr, 5065 cp->addr.type); 5066 if (!br_params) 5067 goto done; 5068 5069 current_flags = br_params->flags; 5070 } else { 5071 params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr, 5072 le_addr_type(cp->addr.type)); 5073 if (!params) 5074 goto done; 5075 5076 supported_flags = get_params_flags(hdev, params); 5077 current_flags = params->flags; 5078 } 5079 5080 bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr); 5081 rp.addr.type = cp->addr.type; 5082 rp.supported_flags = cpu_to_le32(supported_flags); 5083 rp.current_flags = cpu_to_le32(current_flags); 5084 5085 status = MGMT_STATUS_SUCCESS; 5086 5087 done: 5088 hci_dev_unlock(hdev); 5089 5090 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_DEVICE_FLAGS, status, 5091 &rp, sizeof(rp)); 5092 } 5093 5094 static void device_flags_changed(struct sock *sk, struct hci_dev *hdev, 5095 bdaddr_t *bdaddr, u8 bdaddr_type, 5096 u32 supported_flags, u32 current_flags) 5097 { 5098 struct mgmt_ev_device_flags_changed ev; 5099 5100 bacpy(&ev.addr.bdaddr, bdaddr); 5101 ev.addr.type = bdaddr_type; 5102 ev.supported_flags = cpu_to_le32(supported_flags); 5103 ev.current_flags = cpu_to_le32(current_flags); 5104 5105 mgmt_event(MGMT_EV_DEVICE_FLAGS_CHANGED, hdev, &ev, sizeof(ev), sk); 5106 } 5107 5108 static int set_device_flags(struct sock *sk, struct hci_dev *hdev, void *data, 5109 u16 len) 5110 { 5111 struct mgmt_cp_set_device_flags *cp = data; 5112 struct bdaddr_list_with_flags *br_params; 5113 struct hci_conn_params *params; 5114 u8 status = MGMT_STATUS_INVALID_PARAMS; 5115 u32 supported_flags; 5116 u32 current_flags = __le32_to_cpu(cp->current_flags); 5117 5118 bt_dev_dbg(hdev, "Set device flags %pMR (type 0x%x) = 0x%x", 5119 &cp->addr.bdaddr, cp->addr.type, current_flags); 5120 5121 // We should take hci_dev_lock() early, I think.. conn_flags can change 5122 supported_flags = hdev->conn_flags; 5123 5124 if ((supported_flags | current_flags) != supported_flags) { 5125 bt_dev_warn(hdev, "Bad flag given (0x%x) vs supported (0x%0x)", 5126 current_flags, supported_flags); 5127 goto done; 5128 } 5129 5130 hci_dev_lock(hdev); 5131 5132 if (cp->addr.type == BDADDR_BREDR) { 5133 br_params = hci_bdaddr_list_lookup_with_flags(&hdev->accept_list, 5134 &cp->addr.bdaddr, 5135 cp->addr.type); 5136 5137 if (br_params) { 5138 br_params->flags = current_flags; 5139 status = MGMT_STATUS_SUCCESS; 5140 } else { 5141 bt_dev_warn(hdev, "No such BR/EDR device %pMR (0x%x)", 5142 &cp->addr.bdaddr, cp->addr.type); 5143 } 5144 5145 goto unlock; 5146 } 5147 5148 params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr, 5149 le_addr_type(cp->addr.type)); 5150 if (!params) { 5151 bt_dev_warn(hdev, "No such LE device %pMR (0x%x)", 5152 &cp->addr.bdaddr, le_addr_type(cp->addr.type)); 5153 goto unlock; 5154 } 5155 5156 supported_flags = get_params_flags(hdev, params); 5157 5158 if ((supported_flags | current_flags) != supported_flags) { 5159 bt_dev_warn(hdev, "Bad flag given (0x%x) vs supported (0x%0x)", 5160 current_flags, supported_flags); 5161 goto unlock; 5162 } 5163 5164 params->flags = current_flags; 5165 status = MGMT_STATUS_SUCCESS; 5166 5167 /* Update passive scan if HCI_CONN_FLAG_DEVICE_PRIVACY 5168 * has been set. 5169 */ 5170 if (params->flags & HCI_CONN_FLAG_DEVICE_PRIVACY) 5171 hci_update_passive_scan(hdev); 5172 5173 unlock: 5174 hci_dev_unlock(hdev); 5175 5176 done: 5177 if (status == MGMT_STATUS_SUCCESS) 5178 device_flags_changed(sk, hdev, &cp->addr.bdaddr, cp->addr.type, 5179 supported_flags, current_flags); 5180 5181 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_DEVICE_FLAGS, status, 5182 &cp->addr, sizeof(cp->addr)); 5183 } 5184 5185 static void mgmt_adv_monitor_added(struct sock *sk, struct hci_dev *hdev, 5186 u16 handle) 5187 { 5188 struct mgmt_ev_adv_monitor_added ev; 5189 5190 ev.monitor_handle = cpu_to_le16(handle); 5191 5192 mgmt_event(MGMT_EV_ADV_MONITOR_ADDED, hdev, &ev, sizeof(ev), sk); 5193 } 5194 5195 void mgmt_adv_monitor_removed(struct hci_dev *hdev, u16 handle) 5196 { 5197 struct mgmt_ev_adv_monitor_removed ev; 5198 struct mgmt_pending_cmd *cmd; 5199 struct sock *sk_skip = NULL; 5200 struct mgmt_cp_remove_adv_monitor *cp; 5201 5202 cmd = pending_find(MGMT_OP_REMOVE_ADV_MONITOR, hdev); 5203 if (cmd) { 5204 cp = cmd->param; 5205 5206 if (cp->monitor_handle) 5207 sk_skip = cmd->sk; 5208 } 5209 5210 ev.monitor_handle = cpu_to_le16(handle); 5211 5212 mgmt_event(MGMT_EV_ADV_MONITOR_REMOVED, hdev, &ev, sizeof(ev), sk_skip); 5213 } 5214 5215 static int read_adv_mon_features(struct sock *sk, struct hci_dev *hdev, 5216 void *data, u16 len) 5217 { 5218 struct adv_monitor *monitor = NULL; 5219 struct mgmt_rp_read_adv_monitor_features *rp = NULL; 5220 int handle, err; 5221 size_t rp_size = 0; 5222 __u32 supported = 0; 5223 __u32 enabled = 0; 5224 __u16 num_handles = 0; 5225 __u16 handles[HCI_MAX_ADV_MONITOR_NUM_HANDLES]; 5226 5227 BT_DBG("request for %s", hdev->name); 5228 5229 hci_dev_lock(hdev); 5230 5231 if (msft_monitor_supported(hdev)) 5232 supported |= MGMT_ADV_MONITOR_FEATURE_MASK_OR_PATTERNS; 5233 5234 idr_for_each_entry(&hdev->adv_monitors_idr, monitor, handle) 5235 handles[num_handles++] = monitor->handle; 5236 5237 hci_dev_unlock(hdev); 5238 5239 rp_size = sizeof(*rp) + (num_handles * sizeof(u16)); 5240 rp = kmalloc(rp_size, GFP_KERNEL); 5241 if (!rp) 5242 return -ENOMEM; 5243 5244 /* All supported features are currently enabled */ 5245 enabled = supported; 5246 5247 rp->supported_features = cpu_to_le32(supported); 5248 rp->enabled_features = cpu_to_le32(enabled); 5249 rp->max_num_handles = cpu_to_le16(HCI_MAX_ADV_MONITOR_NUM_HANDLES); 5250 rp->max_num_patterns = HCI_MAX_ADV_MONITOR_NUM_PATTERNS; 5251 rp->num_handles = cpu_to_le16(num_handles); 5252 if (num_handles) 5253 memcpy(&rp->handles, &handles, (num_handles * sizeof(u16))); 5254 5255 err = mgmt_cmd_complete(sk, hdev->id, 5256 MGMT_OP_READ_ADV_MONITOR_FEATURES, 5257 MGMT_STATUS_SUCCESS, rp, rp_size); 5258 5259 kfree(rp); 5260 5261 return err; 5262 } 5263 5264 static void mgmt_add_adv_patterns_monitor_complete(struct hci_dev *hdev, 5265 void *data, int status) 5266 { 5267 struct mgmt_rp_add_adv_patterns_monitor rp; 5268 struct mgmt_pending_cmd *cmd = data; 5269 struct adv_monitor *monitor = cmd->user_data; 5270 5271 hci_dev_lock(hdev); 5272 5273 rp.monitor_handle = cpu_to_le16(monitor->handle); 5274 5275 if (!status) { 5276 mgmt_adv_monitor_added(cmd->sk, hdev, monitor->handle); 5277 hdev->adv_monitors_cnt++; 5278 if (monitor->state == ADV_MONITOR_STATE_NOT_REGISTERED) 5279 monitor->state = ADV_MONITOR_STATE_REGISTERED; 5280 hci_update_passive_scan(hdev); 5281 } 5282 5283 mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, 5284 mgmt_status(status), &rp, sizeof(rp)); 5285 mgmt_pending_remove(cmd); 5286 5287 hci_dev_unlock(hdev); 5288 bt_dev_dbg(hdev, "add monitor %d complete, status %d", 5289 rp.monitor_handle, status); 5290 } 5291 5292 static int mgmt_add_adv_patterns_monitor_sync(struct hci_dev *hdev, void *data) 5293 { 5294 struct mgmt_pending_cmd *cmd = data; 5295 struct adv_monitor *monitor = cmd->user_data; 5296 5297 return hci_add_adv_monitor(hdev, monitor); 5298 } 5299 5300 static int __add_adv_patterns_monitor(struct sock *sk, struct hci_dev *hdev, 5301 struct adv_monitor *m, u8 status, 5302 void *data, u16 len, u16 op) 5303 { 5304 struct mgmt_pending_cmd *cmd; 5305 int err; 5306 5307 hci_dev_lock(hdev); 5308 5309 if (status) 5310 goto unlock; 5311 5312 if (pending_find(MGMT_OP_SET_LE, hdev) || 5313 pending_find(MGMT_OP_ADD_ADV_PATTERNS_MONITOR, hdev) || 5314 pending_find(MGMT_OP_ADD_ADV_PATTERNS_MONITOR_RSSI, hdev) || 5315 pending_find(MGMT_OP_REMOVE_ADV_MONITOR, hdev)) { 5316 status = MGMT_STATUS_BUSY; 5317 goto unlock; 5318 } 5319 5320 cmd = mgmt_pending_add(sk, op, hdev, data, len); 5321 if (!cmd) { 5322 status = MGMT_STATUS_NO_RESOURCES; 5323 goto unlock; 5324 } 5325 5326 cmd->user_data = m; 5327 err = hci_cmd_sync_queue(hdev, mgmt_add_adv_patterns_monitor_sync, cmd, 5328 mgmt_add_adv_patterns_monitor_complete); 5329 if (err) { 5330 if (err == -ENOMEM) 5331 status = MGMT_STATUS_NO_RESOURCES; 5332 else 5333 status = MGMT_STATUS_FAILED; 5334 5335 goto unlock; 5336 } 5337 5338 hci_dev_unlock(hdev); 5339 5340 return 0; 5341 5342 unlock: 5343 hci_free_adv_monitor(hdev, m); 5344 hci_dev_unlock(hdev); 5345 return mgmt_cmd_status(sk, hdev->id, op, status); 5346 } 5347 5348 static void parse_adv_monitor_rssi(struct adv_monitor *m, 5349 struct mgmt_adv_rssi_thresholds *rssi) 5350 { 5351 if (rssi) { 5352 m->rssi.low_threshold = rssi->low_threshold; 5353 m->rssi.low_threshold_timeout = 5354 __le16_to_cpu(rssi->low_threshold_timeout); 5355 m->rssi.high_threshold = rssi->high_threshold; 5356 m->rssi.high_threshold_timeout = 5357 __le16_to_cpu(rssi->high_threshold_timeout); 5358 m->rssi.sampling_period = rssi->sampling_period; 5359 } else { 5360 /* Default values. These numbers are the least constricting 5361 * parameters for MSFT API to work, so it behaves as if there 5362 * are no rssi parameter to consider. May need to be changed 5363 * if other API are to be supported. 5364 */ 5365 m->rssi.low_threshold = -127; 5366 m->rssi.low_threshold_timeout = 60; 5367 m->rssi.high_threshold = -127; 5368 m->rssi.high_threshold_timeout = 0; 5369 m->rssi.sampling_period = 0; 5370 } 5371 } 5372 5373 static u8 parse_adv_monitor_pattern(struct adv_monitor *m, u8 pattern_count, 5374 struct mgmt_adv_pattern *patterns) 5375 { 5376 u8 offset = 0, length = 0; 5377 struct adv_pattern *p = NULL; 5378 int i; 5379 5380 for (i = 0; i < pattern_count; i++) { 5381 offset = patterns[i].offset; 5382 length = patterns[i].length; 5383 if (offset >= HCI_MAX_AD_LENGTH || 5384 length > HCI_MAX_AD_LENGTH || 5385 (offset + length) > HCI_MAX_AD_LENGTH) 5386 return MGMT_STATUS_INVALID_PARAMS; 5387 5388 p = kmalloc(sizeof(*p), GFP_KERNEL); 5389 if (!p) 5390 return MGMT_STATUS_NO_RESOURCES; 5391 5392 p->ad_type = patterns[i].ad_type; 5393 p->offset = patterns[i].offset; 5394 p->length = patterns[i].length; 5395 memcpy(p->value, patterns[i].value, p->length); 5396 5397 INIT_LIST_HEAD(&p->list); 5398 list_add(&p->list, &m->patterns); 5399 } 5400 5401 return MGMT_STATUS_SUCCESS; 5402 } 5403 5404 static int add_adv_patterns_monitor(struct sock *sk, struct hci_dev *hdev, 5405 void *data, u16 len) 5406 { 5407 struct mgmt_cp_add_adv_patterns_monitor *cp = data; 5408 struct adv_monitor *m = NULL; 5409 u8 status = MGMT_STATUS_SUCCESS; 5410 size_t expected_size = sizeof(*cp); 5411 5412 BT_DBG("request for %s", hdev->name); 5413 5414 if (len <= sizeof(*cp)) { 5415 status = MGMT_STATUS_INVALID_PARAMS; 5416 goto done; 5417 } 5418 5419 expected_size += cp->pattern_count * sizeof(struct mgmt_adv_pattern); 5420 if (len != expected_size) { 5421 status = MGMT_STATUS_INVALID_PARAMS; 5422 goto done; 5423 } 5424 5425 m = kzalloc(sizeof(*m), GFP_KERNEL); 5426 if (!m) { 5427 status = MGMT_STATUS_NO_RESOURCES; 5428 goto done; 5429 } 5430 5431 INIT_LIST_HEAD(&m->patterns); 5432 5433 parse_adv_monitor_rssi(m, NULL); 5434 status = parse_adv_monitor_pattern(m, cp->pattern_count, cp->patterns); 5435 5436 done: 5437 return __add_adv_patterns_monitor(sk, hdev, m, status, data, len, 5438 MGMT_OP_ADD_ADV_PATTERNS_MONITOR); 5439 } 5440 5441 static int add_adv_patterns_monitor_rssi(struct sock *sk, struct hci_dev *hdev, 5442 void *data, u16 len) 5443 { 5444 struct mgmt_cp_add_adv_patterns_monitor_rssi *cp = data; 5445 struct adv_monitor *m = NULL; 5446 u8 status = MGMT_STATUS_SUCCESS; 5447 size_t expected_size = sizeof(*cp); 5448 5449 BT_DBG("request for %s", hdev->name); 5450 5451 if (len <= sizeof(*cp)) { 5452 status = MGMT_STATUS_INVALID_PARAMS; 5453 goto done; 5454 } 5455 5456 expected_size += cp->pattern_count * sizeof(struct mgmt_adv_pattern); 5457 if (len != expected_size) { 5458 status = MGMT_STATUS_INVALID_PARAMS; 5459 goto done; 5460 } 5461 5462 m = kzalloc(sizeof(*m), GFP_KERNEL); 5463 if (!m) { 5464 status = MGMT_STATUS_NO_RESOURCES; 5465 goto done; 5466 } 5467 5468 INIT_LIST_HEAD(&m->patterns); 5469 5470 parse_adv_monitor_rssi(m, &cp->rssi); 5471 status = parse_adv_monitor_pattern(m, cp->pattern_count, cp->patterns); 5472 5473 done: 5474 return __add_adv_patterns_monitor(sk, hdev, m, status, data, len, 5475 MGMT_OP_ADD_ADV_PATTERNS_MONITOR_RSSI); 5476 } 5477 5478 static void mgmt_remove_adv_monitor_complete(struct hci_dev *hdev, 5479 void *data, int status) 5480 { 5481 struct mgmt_rp_remove_adv_monitor rp; 5482 struct mgmt_pending_cmd *cmd = data; 5483 struct mgmt_cp_remove_adv_monitor *cp = cmd->param; 5484 5485 hci_dev_lock(hdev); 5486 5487 rp.monitor_handle = cp->monitor_handle; 5488 5489 if (!status) 5490 hci_update_passive_scan(hdev); 5491 5492 mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, 5493 mgmt_status(status), &rp, sizeof(rp)); 5494 mgmt_pending_remove(cmd); 5495 5496 hci_dev_unlock(hdev); 5497 bt_dev_dbg(hdev, "remove monitor %d complete, status %d", 5498 rp.monitor_handle, status); 5499 } 5500 5501 static int mgmt_remove_adv_monitor_sync(struct hci_dev *hdev, void *data) 5502 { 5503 struct mgmt_pending_cmd *cmd = data; 5504 struct mgmt_cp_remove_adv_monitor *cp = cmd->param; 5505 u16 handle = __le16_to_cpu(cp->monitor_handle); 5506 5507 if (!handle) 5508 return hci_remove_all_adv_monitor(hdev); 5509 5510 return hci_remove_single_adv_monitor(hdev, handle); 5511 } 5512 5513 static int remove_adv_monitor(struct sock *sk, struct hci_dev *hdev, 5514 void *data, u16 len) 5515 { 5516 struct mgmt_pending_cmd *cmd; 5517 int err, status; 5518 5519 hci_dev_lock(hdev); 5520 5521 if (pending_find(MGMT_OP_SET_LE, hdev) || 5522 pending_find(MGMT_OP_REMOVE_ADV_MONITOR, hdev) || 5523 pending_find(MGMT_OP_ADD_ADV_PATTERNS_MONITOR, hdev) || 5524 pending_find(MGMT_OP_ADD_ADV_PATTERNS_MONITOR_RSSI, hdev)) { 5525 status = MGMT_STATUS_BUSY; 5526 goto unlock; 5527 } 5528 5529 cmd = mgmt_pending_add(sk, MGMT_OP_REMOVE_ADV_MONITOR, hdev, data, len); 5530 if (!cmd) { 5531 status = MGMT_STATUS_NO_RESOURCES; 5532 goto unlock; 5533 } 5534 5535 err = hci_cmd_sync_queue(hdev, mgmt_remove_adv_monitor_sync, cmd, 5536 mgmt_remove_adv_monitor_complete); 5537 5538 if (err) { 5539 mgmt_pending_remove(cmd); 5540 5541 if (err == -ENOMEM) 5542 status = MGMT_STATUS_NO_RESOURCES; 5543 else 5544 status = MGMT_STATUS_FAILED; 5545 5546 goto unlock; 5547 } 5548 5549 hci_dev_unlock(hdev); 5550 5551 return 0; 5552 5553 unlock: 5554 hci_dev_unlock(hdev); 5555 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_ADV_MONITOR, 5556 status); 5557 } 5558 5559 static void read_local_oob_data_complete(struct hci_dev *hdev, void *data, int err) 5560 { 5561 struct mgmt_rp_read_local_oob_data mgmt_rp; 5562 size_t rp_size = sizeof(mgmt_rp); 5563 struct mgmt_pending_cmd *cmd = data; 5564 struct sk_buff *skb = cmd->skb; 5565 u8 status = mgmt_status(err); 5566 5567 if (!status) { 5568 if (!skb) 5569 status = MGMT_STATUS_FAILED; 5570 else if (IS_ERR(skb)) 5571 status = mgmt_status(PTR_ERR(skb)); 5572 else 5573 status = mgmt_status(skb->data[0]); 5574 } 5575 5576 bt_dev_dbg(hdev, "status %d", status); 5577 5578 if (status) { 5579 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA, status); 5580 goto remove; 5581 } 5582 5583 memset(&mgmt_rp, 0, sizeof(mgmt_rp)); 5584 5585 if (!bredr_sc_enabled(hdev)) { 5586 struct hci_rp_read_local_oob_data *rp = (void *) skb->data; 5587 5588 if (skb->len < sizeof(*rp)) { 5589 mgmt_cmd_status(cmd->sk, hdev->id, 5590 MGMT_OP_READ_LOCAL_OOB_DATA, 5591 MGMT_STATUS_FAILED); 5592 goto remove; 5593 } 5594 5595 memcpy(mgmt_rp.hash192, rp->hash, sizeof(rp->hash)); 5596 memcpy(mgmt_rp.rand192, rp->rand, sizeof(rp->rand)); 5597 5598 rp_size -= sizeof(mgmt_rp.hash256) + sizeof(mgmt_rp.rand256); 5599 } else { 5600 struct hci_rp_read_local_oob_ext_data *rp = (void *) skb->data; 5601 5602 if (skb->len < sizeof(*rp)) { 5603 mgmt_cmd_status(cmd->sk, hdev->id, 5604 MGMT_OP_READ_LOCAL_OOB_DATA, 5605 MGMT_STATUS_FAILED); 5606 goto remove; 5607 } 5608 5609 memcpy(mgmt_rp.hash192, rp->hash192, sizeof(rp->hash192)); 5610 memcpy(mgmt_rp.rand192, rp->rand192, sizeof(rp->rand192)); 5611 5612 memcpy(mgmt_rp.hash256, rp->hash256, sizeof(rp->hash256)); 5613 memcpy(mgmt_rp.rand256, rp->rand256, sizeof(rp->rand256)); 5614 } 5615 5616 mgmt_cmd_complete(cmd->sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA, 5617 MGMT_STATUS_SUCCESS, &mgmt_rp, rp_size); 5618 5619 remove: 5620 if (skb && !IS_ERR(skb)) 5621 kfree_skb(skb); 5622 5623 mgmt_pending_free(cmd); 5624 } 5625 5626 static int read_local_oob_data_sync(struct hci_dev *hdev, void *data) 5627 { 5628 struct mgmt_pending_cmd *cmd = data; 5629 5630 if (bredr_sc_enabled(hdev)) 5631 cmd->skb = hci_read_local_oob_data_sync(hdev, true, cmd->sk); 5632 else 5633 cmd->skb = hci_read_local_oob_data_sync(hdev, false, cmd->sk); 5634 5635 if (IS_ERR(cmd->skb)) 5636 return PTR_ERR(cmd->skb); 5637 else 5638 return 0; 5639 } 5640 5641 static int read_local_oob_data(struct sock *sk, struct hci_dev *hdev, 5642 void *data, u16 data_len) 5643 { 5644 struct mgmt_pending_cmd *cmd; 5645 int err; 5646 5647 bt_dev_dbg(hdev, "sock %p", sk); 5648 5649 hci_dev_lock(hdev); 5650 5651 if (!hdev_is_powered(hdev)) { 5652 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA, 5653 MGMT_STATUS_NOT_POWERED); 5654 goto unlock; 5655 } 5656 5657 if (!lmp_ssp_capable(hdev)) { 5658 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA, 5659 MGMT_STATUS_NOT_SUPPORTED); 5660 goto unlock; 5661 } 5662 5663 cmd = mgmt_pending_new(sk, MGMT_OP_READ_LOCAL_OOB_DATA, hdev, NULL, 0); 5664 if (!cmd) 5665 err = -ENOMEM; 5666 else 5667 err = hci_cmd_sync_queue(hdev, read_local_oob_data_sync, cmd, 5668 read_local_oob_data_complete); 5669 5670 if (err < 0) { 5671 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA, 5672 MGMT_STATUS_FAILED); 5673 5674 if (cmd) 5675 mgmt_pending_free(cmd); 5676 } 5677 5678 unlock: 5679 hci_dev_unlock(hdev); 5680 return err; 5681 } 5682 5683 static int add_remote_oob_data(struct sock *sk, struct hci_dev *hdev, 5684 void *data, u16 len) 5685 { 5686 struct mgmt_addr_info *addr = data; 5687 int err; 5688 5689 bt_dev_dbg(hdev, "sock %p", sk); 5690 5691 if (!bdaddr_type_is_valid(addr->type)) 5692 return mgmt_cmd_complete(sk, hdev->id, 5693 MGMT_OP_ADD_REMOTE_OOB_DATA, 5694 MGMT_STATUS_INVALID_PARAMS, 5695 addr, sizeof(*addr)); 5696 5697 hci_dev_lock(hdev); 5698 5699 if (len == MGMT_ADD_REMOTE_OOB_DATA_SIZE) { 5700 struct mgmt_cp_add_remote_oob_data *cp = data; 5701 u8 status; 5702 5703 if (cp->addr.type != BDADDR_BREDR) { 5704 err = mgmt_cmd_complete(sk, hdev->id, 5705 MGMT_OP_ADD_REMOTE_OOB_DATA, 5706 MGMT_STATUS_INVALID_PARAMS, 5707 &cp->addr, sizeof(cp->addr)); 5708 goto unlock; 5709 } 5710 5711 err = hci_add_remote_oob_data(hdev, &cp->addr.bdaddr, 5712 cp->addr.type, cp->hash, 5713 cp->rand, NULL, NULL); 5714 if (err < 0) 5715 status = MGMT_STATUS_FAILED; 5716 else 5717 status = MGMT_STATUS_SUCCESS; 5718 5719 err = mgmt_cmd_complete(sk, hdev->id, 5720 MGMT_OP_ADD_REMOTE_OOB_DATA, status, 5721 &cp->addr, sizeof(cp->addr)); 5722 } else if (len == MGMT_ADD_REMOTE_OOB_EXT_DATA_SIZE) { 5723 struct mgmt_cp_add_remote_oob_ext_data *cp = data; 5724 u8 *rand192, *hash192, *rand256, *hash256; 5725 u8 status; 5726 5727 if (bdaddr_type_is_le(cp->addr.type)) { 5728 /* Enforce zero-valued 192-bit parameters as 5729 * long as legacy SMP OOB isn't implemented. 5730 */ 5731 if (memcmp(cp->rand192, ZERO_KEY, 16) || 5732 memcmp(cp->hash192, ZERO_KEY, 16)) { 5733 err = mgmt_cmd_complete(sk, hdev->id, 5734 MGMT_OP_ADD_REMOTE_OOB_DATA, 5735 MGMT_STATUS_INVALID_PARAMS, 5736 addr, sizeof(*addr)); 5737 goto unlock; 5738 } 5739 5740 rand192 = NULL; 5741 hash192 = NULL; 5742 } else { 5743 /* In case one of the P-192 values is set to zero, 5744 * then just disable OOB data for P-192. 5745 */ 5746 if (!memcmp(cp->rand192, ZERO_KEY, 16) || 5747 !memcmp(cp->hash192, ZERO_KEY, 16)) { 5748 rand192 = NULL; 5749 hash192 = NULL; 5750 } else { 5751 rand192 = cp->rand192; 5752 hash192 = cp->hash192; 5753 } 5754 } 5755 5756 /* In case one of the P-256 values is set to zero, then just 5757 * disable OOB data for P-256. 5758 */ 5759 if (!memcmp(cp->rand256, ZERO_KEY, 16) || 5760 !memcmp(cp->hash256, ZERO_KEY, 16)) { 5761 rand256 = NULL; 5762 hash256 = NULL; 5763 } else { 5764 rand256 = cp->rand256; 5765 hash256 = cp->hash256; 5766 } 5767 5768 err = hci_add_remote_oob_data(hdev, &cp->addr.bdaddr, 5769 cp->addr.type, hash192, rand192, 5770 hash256, rand256); 5771 if (err < 0) 5772 status = MGMT_STATUS_FAILED; 5773 else 5774 status = MGMT_STATUS_SUCCESS; 5775 5776 err = mgmt_cmd_complete(sk, hdev->id, 5777 MGMT_OP_ADD_REMOTE_OOB_DATA, 5778 status, &cp->addr, sizeof(cp->addr)); 5779 } else { 5780 bt_dev_err(hdev, "add_remote_oob_data: invalid len of %u bytes", 5781 len); 5782 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_REMOTE_OOB_DATA, 5783 MGMT_STATUS_INVALID_PARAMS); 5784 } 5785 5786 unlock: 5787 hci_dev_unlock(hdev); 5788 return err; 5789 } 5790 5791 static int remove_remote_oob_data(struct sock *sk, struct hci_dev *hdev, 5792 void *data, u16 len) 5793 { 5794 struct mgmt_cp_remove_remote_oob_data *cp = data; 5795 u8 status; 5796 int err; 5797 5798 bt_dev_dbg(hdev, "sock %p", sk); 5799 5800 if (cp->addr.type != BDADDR_BREDR) 5801 return mgmt_cmd_complete(sk, hdev->id, 5802 MGMT_OP_REMOVE_REMOTE_OOB_DATA, 5803 MGMT_STATUS_INVALID_PARAMS, 5804 &cp->addr, sizeof(cp->addr)); 5805 5806 hci_dev_lock(hdev); 5807 5808 if (!bacmp(&cp->addr.bdaddr, BDADDR_ANY)) { 5809 hci_remote_oob_data_clear(hdev); 5810 status = MGMT_STATUS_SUCCESS; 5811 goto done; 5812 } 5813 5814 err = hci_remove_remote_oob_data(hdev, &cp->addr.bdaddr, cp->addr.type); 5815 if (err < 0) 5816 status = MGMT_STATUS_INVALID_PARAMS; 5817 else 5818 status = MGMT_STATUS_SUCCESS; 5819 5820 done: 5821 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_REMOTE_OOB_DATA, 5822 status, &cp->addr, sizeof(cp->addr)); 5823 5824 hci_dev_unlock(hdev); 5825 return err; 5826 } 5827 5828 void mgmt_start_discovery_complete(struct hci_dev *hdev, u8 status) 5829 { 5830 struct mgmt_pending_cmd *cmd; 5831 5832 bt_dev_dbg(hdev, "status %u", status); 5833 5834 hci_dev_lock(hdev); 5835 5836 cmd = pending_find(MGMT_OP_START_DISCOVERY, hdev); 5837 if (!cmd) 5838 cmd = pending_find(MGMT_OP_START_SERVICE_DISCOVERY, hdev); 5839 5840 if (!cmd) 5841 cmd = pending_find(MGMT_OP_START_LIMITED_DISCOVERY, hdev); 5842 5843 if (cmd) { 5844 cmd->cmd_complete(cmd, mgmt_status(status)); 5845 mgmt_pending_remove(cmd); 5846 } 5847 5848 hci_dev_unlock(hdev); 5849 } 5850 5851 static bool discovery_type_is_valid(struct hci_dev *hdev, uint8_t type, 5852 uint8_t *mgmt_status) 5853 { 5854 switch (type) { 5855 case DISCOV_TYPE_LE: 5856 *mgmt_status = mgmt_le_support(hdev); 5857 if (*mgmt_status) 5858 return false; 5859 break; 5860 case DISCOV_TYPE_INTERLEAVED: 5861 *mgmt_status = mgmt_le_support(hdev); 5862 if (*mgmt_status) 5863 return false; 5864 fallthrough; 5865 case DISCOV_TYPE_BREDR: 5866 *mgmt_status = mgmt_bredr_support(hdev); 5867 if (*mgmt_status) 5868 return false; 5869 break; 5870 default: 5871 *mgmt_status = MGMT_STATUS_INVALID_PARAMS; 5872 return false; 5873 } 5874 5875 return true; 5876 } 5877 5878 static void start_discovery_complete(struct hci_dev *hdev, void *data, int err) 5879 { 5880 struct mgmt_pending_cmd *cmd = data; 5881 5882 if (cmd != pending_find(MGMT_OP_START_DISCOVERY, hdev) && 5883 cmd != pending_find(MGMT_OP_START_LIMITED_DISCOVERY, hdev) && 5884 cmd != pending_find(MGMT_OP_START_SERVICE_DISCOVERY, hdev)) 5885 return; 5886 5887 bt_dev_dbg(hdev, "err %d", err); 5888 5889 mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, mgmt_status(err), 5890 cmd->param, 1); 5891 mgmt_pending_remove(cmd); 5892 5893 hci_discovery_set_state(hdev, err ? DISCOVERY_STOPPED: 5894 DISCOVERY_FINDING); 5895 } 5896 5897 static int start_discovery_sync(struct hci_dev *hdev, void *data) 5898 { 5899 return hci_start_discovery_sync(hdev); 5900 } 5901 5902 static int start_discovery_internal(struct sock *sk, struct hci_dev *hdev, 5903 u16 op, void *data, u16 len) 5904 { 5905 struct mgmt_cp_start_discovery *cp = data; 5906 struct mgmt_pending_cmd *cmd; 5907 u8 status; 5908 int err; 5909 5910 bt_dev_dbg(hdev, "sock %p", sk); 5911 5912 hci_dev_lock(hdev); 5913 5914 if (!hdev_is_powered(hdev)) { 5915 err = mgmt_cmd_complete(sk, hdev->id, op, 5916 MGMT_STATUS_NOT_POWERED, 5917 &cp->type, sizeof(cp->type)); 5918 goto failed; 5919 } 5920 5921 if (hdev->discovery.state != DISCOVERY_STOPPED || 5922 hci_dev_test_flag(hdev, HCI_PERIODIC_INQ)) { 5923 err = mgmt_cmd_complete(sk, hdev->id, op, MGMT_STATUS_BUSY, 5924 &cp->type, sizeof(cp->type)); 5925 goto failed; 5926 } 5927 5928 if (!discovery_type_is_valid(hdev, cp->type, &status)) { 5929 err = mgmt_cmd_complete(sk, hdev->id, op, status, 5930 &cp->type, sizeof(cp->type)); 5931 goto failed; 5932 } 5933 5934 /* Can't start discovery when it is paused */ 5935 if (hdev->discovery_paused) { 5936 err = mgmt_cmd_complete(sk, hdev->id, op, MGMT_STATUS_BUSY, 5937 &cp->type, sizeof(cp->type)); 5938 goto failed; 5939 } 5940 5941 /* Clear the discovery filter first to free any previously 5942 * allocated memory for the UUID list. 5943 */ 5944 hci_discovery_filter_clear(hdev); 5945 5946 hdev->discovery.type = cp->type; 5947 hdev->discovery.report_invalid_rssi = false; 5948 if (op == MGMT_OP_START_LIMITED_DISCOVERY) 5949 hdev->discovery.limited = true; 5950 else 5951 hdev->discovery.limited = false; 5952 5953 cmd = mgmt_pending_add(sk, op, hdev, data, len); 5954 if (!cmd) { 5955 err = -ENOMEM; 5956 goto failed; 5957 } 5958 5959 err = hci_cmd_sync_queue(hdev, start_discovery_sync, cmd, 5960 start_discovery_complete); 5961 if (err < 0) { 5962 mgmt_pending_remove(cmd); 5963 goto failed; 5964 } 5965 5966 hci_discovery_set_state(hdev, DISCOVERY_STARTING); 5967 5968 failed: 5969 hci_dev_unlock(hdev); 5970 return err; 5971 } 5972 5973 static int start_discovery(struct sock *sk, struct hci_dev *hdev, 5974 void *data, u16 len) 5975 { 5976 return start_discovery_internal(sk, hdev, MGMT_OP_START_DISCOVERY, 5977 data, len); 5978 } 5979 5980 static int start_limited_discovery(struct sock *sk, struct hci_dev *hdev, 5981 void *data, u16 len) 5982 { 5983 return start_discovery_internal(sk, hdev, 5984 MGMT_OP_START_LIMITED_DISCOVERY, 5985 data, len); 5986 } 5987 5988 static int start_service_discovery(struct sock *sk, struct hci_dev *hdev, 5989 void *data, u16 len) 5990 { 5991 struct mgmt_cp_start_service_discovery *cp = data; 5992 struct mgmt_pending_cmd *cmd; 5993 const u16 max_uuid_count = ((U16_MAX - sizeof(*cp)) / 16); 5994 u16 uuid_count, expected_len; 5995 u8 status; 5996 int err; 5997 5998 bt_dev_dbg(hdev, "sock %p", sk); 5999 6000 hci_dev_lock(hdev); 6001 6002 if (!hdev_is_powered(hdev)) { 6003 err = mgmt_cmd_complete(sk, hdev->id, 6004 MGMT_OP_START_SERVICE_DISCOVERY, 6005 MGMT_STATUS_NOT_POWERED, 6006 &cp->type, sizeof(cp->type)); 6007 goto failed; 6008 } 6009 6010 if (hdev->discovery.state != DISCOVERY_STOPPED || 6011 hci_dev_test_flag(hdev, HCI_PERIODIC_INQ)) { 6012 err = mgmt_cmd_complete(sk, hdev->id, 6013 MGMT_OP_START_SERVICE_DISCOVERY, 6014 MGMT_STATUS_BUSY, &cp->type, 6015 sizeof(cp->type)); 6016 goto failed; 6017 } 6018 6019 if (hdev->discovery_paused) { 6020 err = mgmt_cmd_complete(sk, hdev->id, 6021 MGMT_OP_START_SERVICE_DISCOVERY, 6022 MGMT_STATUS_BUSY, &cp->type, 6023 sizeof(cp->type)); 6024 goto failed; 6025 } 6026 6027 uuid_count = __le16_to_cpu(cp->uuid_count); 6028 if (uuid_count > max_uuid_count) { 6029 bt_dev_err(hdev, "service_discovery: too big uuid_count value %u", 6030 uuid_count); 6031 err = mgmt_cmd_complete(sk, hdev->id, 6032 MGMT_OP_START_SERVICE_DISCOVERY, 6033 MGMT_STATUS_INVALID_PARAMS, &cp->type, 6034 sizeof(cp->type)); 6035 goto failed; 6036 } 6037 6038 expected_len = sizeof(*cp) + uuid_count * 16; 6039 if (expected_len != len) { 6040 bt_dev_err(hdev, "service_discovery: expected %u bytes, got %u bytes", 6041 expected_len, len); 6042 err = mgmt_cmd_complete(sk, hdev->id, 6043 MGMT_OP_START_SERVICE_DISCOVERY, 6044 MGMT_STATUS_INVALID_PARAMS, &cp->type, 6045 sizeof(cp->type)); 6046 goto failed; 6047 } 6048 6049 if (!discovery_type_is_valid(hdev, cp->type, &status)) { 6050 err = mgmt_cmd_complete(sk, hdev->id, 6051 MGMT_OP_START_SERVICE_DISCOVERY, 6052 status, &cp->type, sizeof(cp->type)); 6053 goto failed; 6054 } 6055 6056 cmd = mgmt_pending_add(sk, MGMT_OP_START_SERVICE_DISCOVERY, 6057 hdev, data, len); 6058 if (!cmd) { 6059 err = -ENOMEM; 6060 goto failed; 6061 } 6062 6063 /* Clear the discovery filter first to free any previously 6064 * allocated memory for the UUID list. 6065 */ 6066 hci_discovery_filter_clear(hdev); 6067 6068 hdev->discovery.result_filtering = true; 6069 hdev->discovery.type = cp->type; 6070 hdev->discovery.rssi = cp->rssi; 6071 hdev->discovery.uuid_count = uuid_count; 6072 6073 if (uuid_count > 0) { 6074 hdev->discovery.uuids = kmemdup(cp->uuids, uuid_count * 16, 6075 GFP_KERNEL); 6076 if (!hdev->discovery.uuids) { 6077 err = mgmt_cmd_complete(sk, hdev->id, 6078 MGMT_OP_START_SERVICE_DISCOVERY, 6079 MGMT_STATUS_FAILED, 6080 &cp->type, sizeof(cp->type)); 6081 mgmt_pending_remove(cmd); 6082 goto failed; 6083 } 6084 } 6085 6086 err = hci_cmd_sync_queue(hdev, start_discovery_sync, cmd, 6087 start_discovery_complete); 6088 if (err < 0) { 6089 mgmt_pending_remove(cmd); 6090 goto failed; 6091 } 6092 6093 hci_discovery_set_state(hdev, DISCOVERY_STARTING); 6094 6095 failed: 6096 hci_dev_unlock(hdev); 6097 return err; 6098 } 6099 6100 void mgmt_stop_discovery_complete(struct hci_dev *hdev, u8 status) 6101 { 6102 struct mgmt_pending_cmd *cmd; 6103 6104 bt_dev_dbg(hdev, "status %u", status); 6105 6106 hci_dev_lock(hdev); 6107 6108 cmd = pending_find(MGMT_OP_STOP_DISCOVERY, hdev); 6109 if (cmd) { 6110 cmd->cmd_complete(cmd, mgmt_status(status)); 6111 mgmt_pending_remove(cmd); 6112 } 6113 6114 hci_dev_unlock(hdev); 6115 } 6116 6117 static void stop_discovery_complete(struct hci_dev *hdev, void *data, int err) 6118 { 6119 struct mgmt_pending_cmd *cmd = data; 6120 6121 if (cmd != pending_find(MGMT_OP_STOP_DISCOVERY, hdev)) 6122 return; 6123 6124 bt_dev_dbg(hdev, "err %d", err); 6125 6126 mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, mgmt_status(err), 6127 cmd->param, 1); 6128 mgmt_pending_remove(cmd); 6129 6130 if (!err) 6131 hci_discovery_set_state(hdev, DISCOVERY_STOPPED); 6132 } 6133 6134 static int stop_discovery_sync(struct hci_dev *hdev, void *data) 6135 { 6136 return hci_stop_discovery_sync(hdev); 6137 } 6138 6139 static int stop_discovery(struct sock *sk, struct hci_dev *hdev, void *data, 6140 u16 len) 6141 { 6142 struct mgmt_cp_stop_discovery *mgmt_cp = data; 6143 struct mgmt_pending_cmd *cmd; 6144 int err; 6145 6146 bt_dev_dbg(hdev, "sock %p", sk); 6147 6148 hci_dev_lock(hdev); 6149 6150 if (!hci_discovery_active(hdev)) { 6151 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY, 6152 MGMT_STATUS_REJECTED, &mgmt_cp->type, 6153 sizeof(mgmt_cp->type)); 6154 goto unlock; 6155 } 6156 6157 if (hdev->discovery.type != mgmt_cp->type) { 6158 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY, 6159 MGMT_STATUS_INVALID_PARAMS, 6160 &mgmt_cp->type, sizeof(mgmt_cp->type)); 6161 goto unlock; 6162 } 6163 6164 cmd = mgmt_pending_add(sk, MGMT_OP_STOP_DISCOVERY, hdev, data, len); 6165 if (!cmd) { 6166 err = -ENOMEM; 6167 goto unlock; 6168 } 6169 6170 err = hci_cmd_sync_queue(hdev, stop_discovery_sync, cmd, 6171 stop_discovery_complete); 6172 if (err < 0) { 6173 mgmt_pending_remove(cmd); 6174 goto unlock; 6175 } 6176 6177 hci_discovery_set_state(hdev, DISCOVERY_STOPPING); 6178 6179 unlock: 6180 hci_dev_unlock(hdev); 6181 return err; 6182 } 6183 6184 static int confirm_name(struct sock *sk, struct hci_dev *hdev, void *data, 6185 u16 len) 6186 { 6187 struct mgmt_cp_confirm_name *cp = data; 6188 struct inquiry_entry *e; 6189 int err; 6190 6191 bt_dev_dbg(hdev, "sock %p", sk); 6192 6193 hci_dev_lock(hdev); 6194 6195 if (!hci_discovery_active(hdev)) { 6196 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME, 6197 MGMT_STATUS_FAILED, &cp->addr, 6198 sizeof(cp->addr)); 6199 goto failed; 6200 } 6201 6202 e = hci_inquiry_cache_lookup_unknown(hdev, &cp->addr.bdaddr); 6203 if (!e) { 6204 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME, 6205 MGMT_STATUS_INVALID_PARAMS, &cp->addr, 6206 sizeof(cp->addr)); 6207 goto failed; 6208 } 6209 6210 if (cp->name_known) { 6211 e->name_state = NAME_KNOWN; 6212 list_del(&e->list); 6213 } else { 6214 e->name_state = NAME_NEEDED; 6215 hci_inquiry_cache_update_resolve(hdev, e); 6216 } 6217 6218 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME, 0, 6219 &cp->addr, sizeof(cp->addr)); 6220 6221 failed: 6222 hci_dev_unlock(hdev); 6223 return err; 6224 } 6225 6226 static int block_device(struct sock *sk, struct hci_dev *hdev, void *data, 6227 u16 len) 6228 { 6229 struct mgmt_cp_block_device *cp = data; 6230 u8 status; 6231 int err; 6232 6233 bt_dev_dbg(hdev, "sock %p", sk); 6234 6235 if (!bdaddr_type_is_valid(cp->addr.type)) 6236 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_BLOCK_DEVICE, 6237 MGMT_STATUS_INVALID_PARAMS, 6238 &cp->addr, sizeof(cp->addr)); 6239 6240 hci_dev_lock(hdev); 6241 6242 err = hci_bdaddr_list_add(&hdev->reject_list, &cp->addr.bdaddr, 6243 cp->addr.type); 6244 if (err < 0) { 6245 status = MGMT_STATUS_FAILED; 6246 goto done; 6247 } 6248 6249 mgmt_event(MGMT_EV_DEVICE_BLOCKED, hdev, &cp->addr, sizeof(cp->addr), 6250 sk); 6251 status = MGMT_STATUS_SUCCESS; 6252 6253 done: 6254 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_BLOCK_DEVICE, status, 6255 &cp->addr, sizeof(cp->addr)); 6256 6257 hci_dev_unlock(hdev); 6258 6259 return err; 6260 } 6261 6262 static int unblock_device(struct sock *sk, struct hci_dev *hdev, void *data, 6263 u16 len) 6264 { 6265 struct mgmt_cp_unblock_device *cp = data; 6266 u8 status; 6267 int err; 6268 6269 bt_dev_dbg(hdev, "sock %p", sk); 6270 6271 if (!bdaddr_type_is_valid(cp->addr.type)) 6272 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNBLOCK_DEVICE, 6273 MGMT_STATUS_INVALID_PARAMS, 6274 &cp->addr, sizeof(cp->addr)); 6275 6276 hci_dev_lock(hdev); 6277 6278 err = hci_bdaddr_list_del(&hdev->reject_list, &cp->addr.bdaddr, 6279 cp->addr.type); 6280 if (err < 0) { 6281 status = MGMT_STATUS_INVALID_PARAMS; 6282 goto done; 6283 } 6284 6285 mgmt_event(MGMT_EV_DEVICE_UNBLOCKED, hdev, &cp->addr, sizeof(cp->addr), 6286 sk); 6287 status = MGMT_STATUS_SUCCESS; 6288 6289 done: 6290 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNBLOCK_DEVICE, status, 6291 &cp->addr, sizeof(cp->addr)); 6292 6293 hci_dev_unlock(hdev); 6294 6295 return err; 6296 } 6297 6298 static int set_device_id_sync(struct hci_dev *hdev, void *data) 6299 { 6300 return hci_update_eir_sync(hdev); 6301 } 6302 6303 static int set_device_id(struct sock *sk, struct hci_dev *hdev, void *data, 6304 u16 len) 6305 { 6306 struct mgmt_cp_set_device_id *cp = data; 6307 int err; 6308 __u16 source; 6309 6310 bt_dev_dbg(hdev, "sock %p", sk); 6311 6312 source = __le16_to_cpu(cp->source); 6313 6314 if (source > 0x0002) 6315 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEVICE_ID, 6316 MGMT_STATUS_INVALID_PARAMS); 6317 6318 hci_dev_lock(hdev); 6319 6320 hdev->devid_source = source; 6321 hdev->devid_vendor = __le16_to_cpu(cp->vendor); 6322 hdev->devid_product = __le16_to_cpu(cp->product); 6323 hdev->devid_version = __le16_to_cpu(cp->version); 6324 6325 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_DEVICE_ID, 0, 6326 NULL, 0); 6327 6328 hci_cmd_sync_queue(hdev, set_device_id_sync, NULL, NULL); 6329 6330 hci_dev_unlock(hdev); 6331 6332 return err; 6333 } 6334 6335 static void enable_advertising_instance(struct hci_dev *hdev, int err) 6336 { 6337 if (err) 6338 bt_dev_err(hdev, "failed to re-configure advertising %d", err); 6339 else 6340 bt_dev_dbg(hdev, "status %d", err); 6341 } 6342 6343 static void set_advertising_complete(struct hci_dev *hdev, void *data, int err) 6344 { 6345 struct cmd_lookup match = { NULL, hdev }; 6346 u8 instance; 6347 struct adv_info *adv_instance; 6348 u8 status = mgmt_status(err); 6349 6350 if (status) { 6351 mgmt_pending_foreach(MGMT_OP_SET_ADVERTISING, hdev, 6352 cmd_status_rsp, &status); 6353 return; 6354 } 6355 6356 if (hci_dev_test_flag(hdev, HCI_LE_ADV)) 6357 hci_dev_set_flag(hdev, HCI_ADVERTISING); 6358 else 6359 hci_dev_clear_flag(hdev, HCI_ADVERTISING); 6360 6361 mgmt_pending_foreach(MGMT_OP_SET_ADVERTISING, hdev, settings_rsp, 6362 &match); 6363 6364 new_settings(hdev, match.sk); 6365 6366 if (match.sk) 6367 sock_put(match.sk); 6368 6369 /* If "Set Advertising" was just disabled and instance advertising was 6370 * set up earlier, then re-enable multi-instance advertising. 6371 */ 6372 if (hci_dev_test_flag(hdev, HCI_ADVERTISING) || 6373 list_empty(&hdev->adv_instances)) 6374 return; 6375 6376 instance = hdev->cur_adv_instance; 6377 if (!instance) { 6378 adv_instance = list_first_entry_or_null(&hdev->adv_instances, 6379 struct adv_info, list); 6380 if (!adv_instance) 6381 return; 6382 6383 instance = adv_instance->instance; 6384 } 6385 6386 err = hci_schedule_adv_instance_sync(hdev, instance, true); 6387 6388 enable_advertising_instance(hdev, err); 6389 } 6390 6391 static int set_adv_sync(struct hci_dev *hdev, void *data) 6392 { 6393 struct mgmt_pending_cmd *cmd = data; 6394 struct mgmt_mode *cp = cmd->param; 6395 u8 val = !!cp->val; 6396 6397 if (cp->val == 0x02) 6398 hci_dev_set_flag(hdev, HCI_ADVERTISING_CONNECTABLE); 6399 else 6400 hci_dev_clear_flag(hdev, HCI_ADVERTISING_CONNECTABLE); 6401 6402 cancel_adv_timeout(hdev); 6403 6404 if (val) { 6405 /* Switch to instance "0" for the Set Advertising setting. 6406 * We cannot use update_[adv|scan_rsp]_data() here as the 6407 * HCI_ADVERTISING flag is not yet set. 6408 */ 6409 hdev->cur_adv_instance = 0x00; 6410 6411 if (ext_adv_capable(hdev)) { 6412 hci_start_ext_adv_sync(hdev, 0x00); 6413 } else { 6414 hci_update_adv_data_sync(hdev, 0x00); 6415 hci_update_scan_rsp_data_sync(hdev, 0x00); 6416 hci_enable_advertising_sync(hdev); 6417 } 6418 } else { 6419 hci_disable_advertising_sync(hdev); 6420 } 6421 6422 return 0; 6423 } 6424 6425 static int set_advertising(struct sock *sk, struct hci_dev *hdev, void *data, 6426 u16 len) 6427 { 6428 struct mgmt_mode *cp = data; 6429 struct mgmt_pending_cmd *cmd; 6430 u8 val, status; 6431 int err; 6432 6433 bt_dev_dbg(hdev, "sock %p", sk); 6434 6435 status = mgmt_le_support(hdev); 6436 if (status) 6437 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING, 6438 status); 6439 6440 if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02) 6441 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING, 6442 MGMT_STATUS_INVALID_PARAMS); 6443 6444 if (hdev->advertising_paused) 6445 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING, 6446 MGMT_STATUS_BUSY); 6447 6448 hci_dev_lock(hdev); 6449 6450 val = !!cp->val; 6451 6452 /* The following conditions are ones which mean that we should 6453 * not do any HCI communication but directly send a mgmt 6454 * response to user space (after toggling the flag if 6455 * necessary). 6456 */ 6457 if (!hdev_is_powered(hdev) || 6458 (val == hci_dev_test_flag(hdev, HCI_ADVERTISING) && 6459 (cp->val == 0x02) == hci_dev_test_flag(hdev, HCI_ADVERTISING_CONNECTABLE)) || 6460 hci_dev_test_flag(hdev, HCI_MESH) || 6461 hci_conn_num(hdev, LE_LINK) > 0 || 6462 (hci_dev_test_flag(hdev, HCI_LE_SCAN) && 6463 hdev->le_scan_type == LE_SCAN_ACTIVE)) { 6464 bool changed; 6465 6466 if (cp->val) { 6467 hdev->cur_adv_instance = 0x00; 6468 changed = !hci_dev_test_and_set_flag(hdev, HCI_ADVERTISING); 6469 if (cp->val == 0x02) 6470 hci_dev_set_flag(hdev, HCI_ADVERTISING_CONNECTABLE); 6471 else 6472 hci_dev_clear_flag(hdev, HCI_ADVERTISING_CONNECTABLE); 6473 } else { 6474 changed = hci_dev_test_and_clear_flag(hdev, HCI_ADVERTISING); 6475 hci_dev_clear_flag(hdev, HCI_ADVERTISING_CONNECTABLE); 6476 } 6477 6478 err = send_settings_rsp(sk, MGMT_OP_SET_ADVERTISING, hdev); 6479 if (err < 0) 6480 goto unlock; 6481 6482 if (changed) 6483 err = new_settings(hdev, sk); 6484 6485 goto unlock; 6486 } 6487 6488 if (pending_find(MGMT_OP_SET_ADVERTISING, hdev) || 6489 pending_find(MGMT_OP_SET_LE, hdev)) { 6490 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING, 6491 MGMT_STATUS_BUSY); 6492 goto unlock; 6493 } 6494 6495 cmd = mgmt_pending_add(sk, MGMT_OP_SET_ADVERTISING, hdev, data, len); 6496 if (!cmd) 6497 err = -ENOMEM; 6498 else 6499 err = hci_cmd_sync_queue(hdev, set_adv_sync, cmd, 6500 set_advertising_complete); 6501 6502 if (err < 0 && cmd) 6503 mgmt_pending_remove(cmd); 6504 6505 unlock: 6506 hci_dev_unlock(hdev); 6507 return err; 6508 } 6509 6510 static int set_static_address(struct sock *sk, struct hci_dev *hdev, 6511 void *data, u16 len) 6512 { 6513 struct mgmt_cp_set_static_address *cp = data; 6514 int err; 6515 6516 bt_dev_dbg(hdev, "sock %p", sk); 6517 6518 if (!lmp_le_capable(hdev)) 6519 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_STATIC_ADDRESS, 6520 MGMT_STATUS_NOT_SUPPORTED); 6521 6522 if (hdev_is_powered(hdev)) 6523 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_STATIC_ADDRESS, 6524 MGMT_STATUS_REJECTED); 6525 6526 if (bacmp(&cp->bdaddr, BDADDR_ANY)) { 6527 if (!bacmp(&cp->bdaddr, BDADDR_NONE)) 6528 return mgmt_cmd_status(sk, hdev->id, 6529 MGMT_OP_SET_STATIC_ADDRESS, 6530 MGMT_STATUS_INVALID_PARAMS); 6531 6532 /* Two most significant bits shall be set */ 6533 if ((cp->bdaddr.b[5] & 0xc0) != 0xc0) 6534 return mgmt_cmd_status(sk, hdev->id, 6535 MGMT_OP_SET_STATIC_ADDRESS, 6536 MGMT_STATUS_INVALID_PARAMS); 6537 } 6538 6539 hci_dev_lock(hdev); 6540 6541 bacpy(&hdev->static_addr, &cp->bdaddr); 6542 6543 err = send_settings_rsp(sk, MGMT_OP_SET_STATIC_ADDRESS, hdev); 6544 if (err < 0) 6545 goto unlock; 6546 6547 err = new_settings(hdev, sk); 6548 6549 unlock: 6550 hci_dev_unlock(hdev); 6551 return err; 6552 } 6553 6554 static int set_scan_params(struct sock *sk, struct hci_dev *hdev, 6555 void *data, u16 len) 6556 { 6557 struct mgmt_cp_set_scan_params *cp = data; 6558 __u16 interval, window; 6559 int err; 6560 6561 bt_dev_dbg(hdev, "sock %p", sk); 6562 6563 if (!lmp_le_capable(hdev)) 6564 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS, 6565 MGMT_STATUS_NOT_SUPPORTED); 6566 6567 interval = __le16_to_cpu(cp->interval); 6568 6569 if (interval < 0x0004 || interval > 0x4000) 6570 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS, 6571 MGMT_STATUS_INVALID_PARAMS); 6572 6573 window = __le16_to_cpu(cp->window); 6574 6575 if (window < 0x0004 || window > 0x4000) 6576 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS, 6577 MGMT_STATUS_INVALID_PARAMS); 6578 6579 if (window > interval) 6580 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS, 6581 MGMT_STATUS_INVALID_PARAMS); 6582 6583 hci_dev_lock(hdev); 6584 6585 hdev->le_scan_interval = interval; 6586 hdev->le_scan_window = window; 6587 6588 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS, 0, 6589 NULL, 0); 6590 6591 /* If background scan is running, restart it so new parameters are 6592 * loaded. 6593 */ 6594 if (hci_dev_test_flag(hdev, HCI_LE_SCAN) && 6595 hdev->discovery.state == DISCOVERY_STOPPED) 6596 hci_update_passive_scan(hdev); 6597 6598 hci_dev_unlock(hdev); 6599 6600 return err; 6601 } 6602 6603 static void fast_connectable_complete(struct hci_dev *hdev, void *data, int err) 6604 { 6605 struct mgmt_pending_cmd *cmd = data; 6606 6607 bt_dev_dbg(hdev, "err %d", err); 6608 6609 if (err) { 6610 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE, 6611 mgmt_status(err)); 6612 } else { 6613 struct mgmt_mode *cp = cmd->param; 6614 6615 if (cp->val) 6616 hci_dev_set_flag(hdev, HCI_FAST_CONNECTABLE); 6617 else 6618 hci_dev_clear_flag(hdev, HCI_FAST_CONNECTABLE); 6619 6620 send_settings_rsp(cmd->sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev); 6621 new_settings(hdev, cmd->sk); 6622 } 6623 6624 mgmt_pending_free(cmd); 6625 } 6626 6627 static int write_fast_connectable_sync(struct hci_dev *hdev, void *data) 6628 { 6629 struct mgmt_pending_cmd *cmd = data; 6630 struct mgmt_mode *cp = cmd->param; 6631 6632 return hci_write_fast_connectable_sync(hdev, cp->val); 6633 } 6634 6635 static int set_fast_connectable(struct sock *sk, struct hci_dev *hdev, 6636 void *data, u16 len) 6637 { 6638 struct mgmt_mode *cp = data; 6639 struct mgmt_pending_cmd *cmd; 6640 int err; 6641 6642 bt_dev_dbg(hdev, "sock %p", sk); 6643 6644 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) || 6645 hdev->hci_ver < BLUETOOTH_VER_1_2) 6646 return mgmt_cmd_status(sk, hdev->id, 6647 MGMT_OP_SET_FAST_CONNECTABLE, 6648 MGMT_STATUS_NOT_SUPPORTED); 6649 6650 if (cp->val != 0x00 && cp->val != 0x01) 6651 return mgmt_cmd_status(sk, hdev->id, 6652 MGMT_OP_SET_FAST_CONNECTABLE, 6653 MGMT_STATUS_INVALID_PARAMS); 6654 6655 hci_dev_lock(hdev); 6656 6657 if (!!cp->val == hci_dev_test_flag(hdev, HCI_FAST_CONNECTABLE)) { 6658 err = send_settings_rsp(sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev); 6659 goto unlock; 6660 } 6661 6662 if (!hdev_is_powered(hdev)) { 6663 hci_dev_change_flag(hdev, HCI_FAST_CONNECTABLE); 6664 err = send_settings_rsp(sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev); 6665 new_settings(hdev, sk); 6666 goto unlock; 6667 } 6668 6669 cmd = mgmt_pending_new(sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev, data, 6670 len); 6671 if (!cmd) 6672 err = -ENOMEM; 6673 else 6674 err = hci_cmd_sync_queue(hdev, write_fast_connectable_sync, cmd, 6675 fast_connectable_complete); 6676 6677 if (err < 0) { 6678 mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE, 6679 MGMT_STATUS_FAILED); 6680 6681 if (cmd) 6682 mgmt_pending_free(cmd); 6683 } 6684 6685 unlock: 6686 hci_dev_unlock(hdev); 6687 6688 return err; 6689 } 6690 6691 static void set_bredr_complete(struct hci_dev *hdev, void *data, int err) 6692 { 6693 struct mgmt_pending_cmd *cmd = data; 6694 6695 bt_dev_dbg(hdev, "err %d", err); 6696 6697 if (err) { 6698 u8 mgmt_err = mgmt_status(err); 6699 6700 /* We need to restore the flag if related HCI commands 6701 * failed. 6702 */ 6703 hci_dev_clear_flag(hdev, HCI_BREDR_ENABLED); 6704 6705 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err); 6706 } else { 6707 send_settings_rsp(cmd->sk, MGMT_OP_SET_BREDR, hdev); 6708 new_settings(hdev, cmd->sk); 6709 } 6710 6711 mgmt_pending_free(cmd); 6712 } 6713 6714 static int set_bredr_sync(struct hci_dev *hdev, void *data) 6715 { 6716 int status; 6717 6718 status = hci_write_fast_connectable_sync(hdev, false); 6719 6720 if (!status) 6721 status = hci_update_scan_sync(hdev); 6722 6723 /* Since only the advertising data flags will change, there 6724 * is no need to update the scan response data. 6725 */ 6726 if (!status) 6727 status = hci_update_adv_data_sync(hdev, hdev->cur_adv_instance); 6728 6729 return status; 6730 } 6731 6732 static int set_bredr(struct sock *sk, struct hci_dev *hdev, void *data, u16 len) 6733 { 6734 struct mgmt_mode *cp = data; 6735 struct mgmt_pending_cmd *cmd; 6736 int err; 6737 6738 bt_dev_dbg(hdev, "sock %p", sk); 6739 6740 if (!lmp_bredr_capable(hdev) || !lmp_le_capable(hdev)) 6741 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR, 6742 MGMT_STATUS_NOT_SUPPORTED); 6743 6744 if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED)) 6745 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR, 6746 MGMT_STATUS_REJECTED); 6747 6748 if (cp->val != 0x00 && cp->val != 0x01) 6749 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR, 6750 MGMT_STATUS_INVALID_PARAMS); 6751 6752 hci_dev_lock(hdev); 6753 6754 if (cp->val == hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) { 6755 err = send_settings_rsp(sk, MGMT_OP_SET_BREDR, hdev); 6756 goto unlock; 6757 } 6758 6759 if (!hdev_is_powered(hdev)) { 6760 if (!cp->val) { 6761 hci_dev_clear_flag(hdev, HCI_DISCOVERABLE); 6762 hci_dev_clear_flag(hdev, HCI_SSP_ENABLED); 6763 hci_dev_clear_flag(hdev, HCI_LINK_SECURITY); 6764 hci_dev_clear_flag(hdev, HCI_FAST_CONNECTABLE); 6765 hci_dev_clear_flag(hdev, HCI_HS_ENABLED); 6766 } 6767 6768 hci_dev_change_flag(hdev, HCI_BREDR_ENABLED); 6769 6770 err = send_settings_rsp(sk, MGMT_OP_SET_BREDR, hdev); 6771 if (err < 0) 6772 goto unlock; 6773 6774 err = new_settings(hdev, sk); 6775 goto unlock; 6776 } 6777 6778 /* Reject disabling when powered on */ 6779 if (!cp->val) { 6780 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR, 6781 MGMT_STATUS_REJECTED); 6782 goto unlock; 6783 } else { 6784 /* When configuring a dual-mode controller to operate 6785 * with LE only and using a static address, then switching 6786 * BR/EDR back on is not allowed. 6787 * 6788 * Dual-mode controllers shall operate with the public 6789 * address as its identity address for BR/EDR and LE. So 6790 * reject the attempt to create an invalid configuration. 6791 * 6792 * The same restrictions applies when secure connections 6793 * has been enabled. For BR/EDR this is a controller feature 6794 * while for LE it is a host stack feature. This means that 6795 * switching BR/EDR back on when secure connections has been 6796 * enabled is not a supported transaction. 6797 */ 6798 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) && 6799 (bacmp(&hdev->static_addr, BDADDR_ANY) || 6800 hci_dev_test_flag(hdev, HCI_SC_ENABLED))) { 6801 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR, 6802 MGMT_STATUS_REJECTED); 6803 goto unlock; 6804 } 6805 } 6806 6807 cmd = mgmt_pending_new(sk, MGMT_OP_SET_BREDR, hdev, data, len); 6808 if (!cmd) 6809 err = -ENOMEM; 6810 else 6811 err = hci_cmd_sync_queue(hdev, set_bredr_sync, cmd, 6812 set_bredr_complete); 6813 6814 if (err < 0) { 6815 mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR, 6816 MGMT_STATUS_FAILED); 6817 if (cmd) 6818 mgmt_pending_free(cmd); 6819 6820 goto unlock; 6821 } 6822 6823 /* We need to flip the bit already here so that 6824 * hci_req_update_adv_data generates the correct flags. 6825 */ 6826 hci_dev_set_flag(hdev, HCI_BREDR_ENABLED); 6827 6828 unlock: 6829 hci_dev_unlock(hdev); 6830 return err; 6831 } 6832 6833 static void set_secure_conn_complete(struct hci_dev *hdev, void *data, int err) 6834 { 6835 struct mgmt_pending_cmd *cmd = data; 6836 struct mgmt_mode *cp; 6837 6838 bt_dev_dbg(hdev, "err %d", err); 6839 6840 if (err) { 6841 u8 mgmt_err = mgmt_status(err); 6842 6843 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err); 6844 goto done; 6845 } 6846 6847 cp = cmd->param; 6848 6849 switch (cp->val) { 6850 case 0x00: 6851 hci_dev_clear_flag(hdev, HCI_SC_ENABLED); 6852 hci_dev_clear_flag(hdev, HCI_SC_ONLY); 6853 break; 6854 case 0x01: 6855 hci_dev_set_flag(hdev, HCI_SC_ENABLED); 6856 hci_dev_clear_flag(hdev, HCI_SC_ONLY); 6857 break; 6858 case 0x02: 6859 hci_dev_set_flag(hdev, HCI_SC_ENABLED); 6860 hci_dev_set_flag(hdev, HCI_SC_ONLY); 6861 break; 6862 } 6863 6864 send_settings_rsp(cmd->sk, cmd->opcode, hdev); 6865 new_settings(hdev, cmd->sk); 6866 6867 done: 6868 mgmt_pending_free(cmd); 6869 } 6870 6871 static int set_secure_conn_sync(struct hci_dev *hdev, void *data) 6872 { 6873 struct mgmt_pending_cmd *cmd = data; 6874 struct mgmt_mode *cp = cmd->param; 6875 u8 val = !!cp->val; 6876 6877 /* Force write of val */ 6878 hci_dev_set_flag(hdev, HCI_SC_ENABLED); 6879 6880 return hci_write_sc_support_sync(hdev, val); 6881 } 6882 6883 static int set_secure_conn(struct sock *sk, struct hci_dev *hdev, 6884 void *data, u16 len) 6885 { 6886 struct mgmt_mode *cp = data; 6887 struct mgmt_pending_cmd *cmd; 6888 u8 val; 6889 int err; 6890 6891 bt_dev_dbg(hdev, "sock %p", sk); 6892 6893 if (!lmp_sc_capable(hdev) && 6894 !hci_dev_test_flag(hdev, HCI_LE_ENABLED)) 6895 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN, 6896 MGMT_STATUS_NOT_SUPPORTED); 6897 6898 if (hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) && 6899 lmp_sc_capable(hdev) && 6900 !hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) 6901 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN, 6902 MGMT_STATUS_REJECTED); 6903 6904 if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02) 6905 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN, 6906 MGMT_STATUS_INVALID_PARAMS); 6907 6908 hci_dev_lock(hdev); 6909 6910 if (!hdev_is_powered(hdev) || !lmp_sc_capable(hdev) || 6911 !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) { 6912 bool changed; 6913 6914 if (cp->val) { 6915 changed = !hci_dev_test_and_set_flag(hdev, 6916 HCI_SC_ENABLED); 6917 if (cp->val == 0x02) 6918 hci_dev_set_flag(hdev, HCI_SC_ONLY); 6919 else 6920 hci_dev_clear_flag(hdev, HCI_SC_ONLY); 6921 } else { 6922 changed = hci_dev_test_and_clear_flag(hdev, 6923 HCI_SC_ENABLED); 6924 hci_dev_clear_flag(hdev, HCI_SC_ONLY); 6925 } 6926 6927 err = send_settings_rsp(sk, MGMT_OP_SET_SECURE_CONN, hdev); 6928 if (err < 0) 6929 goto failed; 6930 6931 if (changed) 6932 err = new_settings(hdev, sk); 6933 6934 goto failed; 6935 } 6936 6937 val = !!cp->val; 6938 6939 if (val == hci_dev_test_flag(hdev, HCI_SC_ENABLED) && 6940 (cp->val == 0x02) == hci_dev_test_flag(hdev, HCI_SC_ONLY)) { 6941 err = send_settings_rsp(sk, MGMT_OP_SET_SECURE_CONN, hdev); 6942 goto failed; 6943 } 6944 6945 cmd = mgmt_pending_new(sk, MGMT_OP_SET_SECURE_CONN, hdev, data, len); 6946 if (!cmd) 6947 err = -ENOMEM; 6948 else 6949 err = hci_cmd_sync_queue(hdev, set_secure_conn_sync, cmd, 6950 set_secure_conn_complete); 6951 6952 if (err < 0) { 6953 mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN, 6954 MGMT_STATUS_FAILED); 6955 if (cmd) 6956 mgmt_pending_free(cmd); 6957 } 6958 6959 failed: 6960 hci_dev_unlock(hdev); 6961 return err; 6962 } 6963 6964 static int set_debug_keys(struct sock *sk, struct hci_dev *hdev, 6965 void *data, u16 len) 6966 { 6967 struct mgmt_mode *cp = data; 6968 bool changed, use_changed; 6969 int err; 6970 6971 bt_dev_dbg(hdev, "sock %p", sk); 6972 6973 if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02) 6974 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEBUG_KEYS, 6975 MGMT_STATUS_INVALID_PARAMS); 6976 6977 hci_dev_lock(hdev); 6978 6979 if (cp->val) 6980 changed = !hci_dev_test_and_set_flag(hdev, HCI_KEEP_DEBUG_KEYS); 6981 else 6982 changed = hci_dev_test_and_clear_flag(hdev, 6983 HCI_KEEP_DEBUG_KEYS); 6984 6985 if (cp->val == 0x02) 6986 use_changed = !hci_dev_test_and_set_flag(hdev, 6987 HCI_USE_DEBUG_KEYS); 6988 else 6989 use_changed = hci_dev_test_and_clear_flag(hdev, 6990 HCI_USE_DEBUG_KEYS); 6991 6992 if (hdev_is_powered(hdev) && use_changed && 6993 hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) { 6994 u8 mode = (cp->val == 0x02) ? 0x01 : 0x00; 6995 hci_send_cmd(hdev, HCI_OP_WRITE_SSP_DEBUG_MODE, 6996 sizeof(mode), &mode); 6997 } 6998 6999 err = send_settings_rsp(sk, MGMT_OP_SET_DEBUG_KEYS, hdev); 7000 if (err < 0) 7001 goto unlock; 7002 7003 if (changed) 7004 err = new_settings(hdev, sk); 7005 7006 unlock: 7007 hci_dev_unlock(hdev); 7008 return err; 7009 } 7010 7011 static int set_privacy(struct sock *sk, struct hci_dev *hdev, void *cp_data, 7012 u16 len) 7013 { 7014 struct mgmt_cp_set_privacy *cp = cp_data; 7015 bool changed; 7016 int err; 7017 7018 bt_dev_dbg(hdev, "sock %p", sk); 7019 7020 if (!lmp_le_capable(hdev)) 7021 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY, 7022 MGMT_STATUS_NOT_SUPPORTED); 7023 7024 if (cp->privacy != 0x00 && cp->privacy != 0x01 && cp->privacy != 0x02) 7025 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY, 7026 MGMT_STATUS_INVALID_PARAMS); 7027 7028 if (hdev_is_powered(hdev)) 7029 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY, 7030 MGMT_STATUS_REJECTED); 7031 7032 hci_dev_lock(hdev); 7033 7034 /* If user space supports this command it is also expected to 7035 * handle IRKs. Therefore, set the HCI_RPA_RESOLVING flag. 7036 */ 7037 hci_dev_set_flag(hdev, HCI_RPA_RESOLVING); 7038 7039 if (cp->privacy) { 7040 changed = !hci_dev_test_and_set_flag(hdev, HCI_PRIVACY); 7041 memcpy(hdev->irk, cp->irk, sizeof(hdev->irk)); 7042 hci_dev_set_flag(hdev, HCI_RPA_EXPIRED); 7043 hci_adv_instances_set_rpa_expired(hdev, true); 7044 if (cp->privacy == 0x02) 7045 hci_dev_set_flag(hdev, HCI_LIMITED_PRIVACY); 7046 else 7047 hci_dev_clear_flag(hdev, HCI_LIMITED_PRIVACY); 7048 } else { 7049 changed = hci_dev_test_and_clear_flag(hdev, HCI_PRIVACY); 7050 memset(hdev->irk, 0, sizeof(hdev->irk)); 7051 hci_dev_clear_flag(hdev, HCI_RPA_EXPIRED); 7052 hci_adv_instances_set_rpa_expired(hdev, false); 7053 hci_dev_clear_flag(hdev, HCI_LIMITED_PRIVACY); 7054 } 7055 7056 err = send_settings_rsp(sk, MGMT_OP_SET_PRIVACY, hdev); 7057 if (err < 0) 7058 goto unlock; 7059 7060 if (changed) 7061 err = new_settings(hdev, sk); 7062 7063 unlock: 7064 hci_dev_unlock(hdev); 7065 return err; 7066 } 7067 7068 static bool irk_is_valid(struct mgmt_irk_info *irk) 7069 { 7070 switch (irk->addr.type) { 7071 case BDADDR_LE_PUBLIC: 7072 return true; 7073 7074 case BDADDR_LE_RANDOM: 7075 /* Two most significant bits shall be set */ 7076 if ((irk->addr.bdaddr.b[5] & 0xc0) != 0xc0) 7077 return false; 7078 return true; 7079 } 7080 7081 return false; 7082 } 7083 7084 static int load_irks(struct sock *sk, struct hci_dev *hdev, void *cp_data, 7085 u16 len) 7086 { 7087 struct mgmt_cp_load_irks *cp = cp_data; 7088 const u16 max_irk_count = ((U16_MAX - sizeof(*cp)) / 7089 sizeof(struct mgmt_irk_info)); 7090 u16 irk_count, expected_len; 7091 int i, err; 7092 7093 bt_dev_dbg(hdev, "sock %p", sk); 7094 7095 if (!lmp_le_capable(hdev)) 7096 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS, 7097 MGMT_STATUS_NOT_SUPPORTED); 7098 7099 irk_count = __le16_to_cpu(cp->irk_count); 7100 if (irk_count > max_irk_count) { 7101 bt_dev_err(hdev, "load_irks: too big irk_count value %u", 7102 irk_count); 7103 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS, 7104 MGMT_STATUS_INVALID_PARAMS); 7105 } 7106 7107 expected_len = struct_size(cp, irks, irk_count); 7108 if (expected_len != len) { 7109 bt_dev_err(hdev, "load_irks: expected %u bytes, got %u bytes", 7110 expected_len, len); 7111 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS, 7112 MGMT_STATUS_INVALID_PARAMS); 7113 } 7114 7115 bt_dev_dbg(hdev, "irk_count %u", irk_count); 7116 7117 for (i = 0; i < irk_count; i++) { 7118 struct mgmt_irk_info *key = &cp->irks[i]; 7119 7120 if (!irk_is_valid(key)) 7121 return mgmt_cmd_status(sk, hdev->id, 7122 MGMT_OP_LOAD_IRKS, 7123 MGMT_STATUS_INVALID_PARAMS); 7124 } 7125 7126 hci_dev_lock(hdev); 7127 7128 hci_smp_irks_clear(hdev); 7129 7130 for (i = 0; i < irk_count; i++) { 7131 struct mgmt_irk_info *irk = &cp->irks[i]; 7132 7133 if (hci_is_blocked_key(hdev, 7134 HCI_BLOCKED_KEY_TYPE_IRK, 7135 irk->val)) { 7136 bt_dev_warn(hdev, "Skipping blocked IRK for %pMR", 7137 &irk->addr.bdaddr); 7138 continue; 7139 } 7140 7141 hci_add_irk(hdev, &irk->addr.bdaddr, 7142 le_addr_type(irk->addr.type), irk->val, 7143 BDADDR_ANY); 7144 } 7145 7146 hci_dev_set_flag(hdev, HCI_RPA_RESOLVING); 7147 7148 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_IRKS, 0, NULL, 0); 7149 7150 hci_dev_unlock(hdev); 7151 7152 return err; 7153 } 7154 7155 static bool ltk_is_valid(struct mgmt_ltk_info *key) 7156 { 7157 if (key->initiator != 0x00 && key->initiator != 0x01) 7158 return false; 7159 7160 switch (key->addr.type) { 7161 case BDADDR_LE_PUBLIC: 7162 return true; 7163 7164 case BDADDR_LE_RANDOM: 7165 /* Two most significant bits shall be set */ 7166 if ((key->addr.bdaddr.b[5] & 0xc0) != 0xc0) 7167 return false; 7168 return true; 7169 } 7170 7171 return false; 7172 } 7173 7174 static int load_long_term_keys(struct sock *sk, struct hci_dev *hdev, 7175 void *cp_data, u16 len) 7176 { 7177 struct mgmt_cp_load_long_term_keys *cp = cp_data; 7178 const u16 max_key_count = ((U16_MAX - sizeof(*cp)) / 7179 sizeof(struct mgmt_ltk_info)); 7180 u16 key_count, expected_len; 7181 int i, err; 7182 7183 bt_dev_dbg(hdev, "sock %p", sk); 7184 7185 if (!lmp_le_capable(hdev)) 7186 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS, 7187 MGMT_STATUS_NOT_SUPPORTED); 7188 7189 key_count = __le16_to_cpu(cp->key_count); 7190 if (key_count > max_key_count) { 7191 bt_dev_err(hdev, "load_ltks: too big key_count value %u", 7192 key_count); 7193 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS, 7194 MGMT_STATUS_INVALID_PARAMS); 7195 } 7196 7197 expected_len = struct_size(cp, keys, key_count); 7198 if (expected_len != len) { 7199 bt_dev_err(hdev, "load_keys: expected %u bytes, got %u bytes", 7200 expected_len, len); 7201 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS, 7202 MGMT_STATUS_INVALID_PARAMS); 7203 } 7204 7205 bt_dev_dbg(hdev, "key_count %u", key_count); 7206 7207 for (i = 0; i < key_count; i++) { 7208 struct mgmt_ltk_info *key = &cp->keys[i]; 7209 7210 if (!ltk_is_valid(key)) 7211 return mgmt_cmd_status(sk, hdev->id, 7212 MGMT_OP_LOAD_LONG_TERM_KEYS, 7213 MGMT_STATUS_INVALID_PARAMS); 7214 } 7215 7216 hci_dev_lock(hdev); 7217 7218 hci_smp_ltks_clear(hdev); 7219 7220 for (i = 0; i < key_count; i++) { 7221 struct mgmt_ltk_info *key = &cp->keys[i]; 7222 u8 type, authenticated; 7223 7224 if (hci_is_blocked_key(hdev, 7225 HCI_BLOCKED_KEY_TYPE_LTK, 7226 key->val)) { 7227 bt_dev_warn(hdev, "Skipping blocked LTK for %pMR", 7228 &key->addr.bdaddr); 7229 continue; 7230 } 7231 7232 switch (key->type) { 7233 case MGMT_LTK_UNAUTHENTICATED: 7234 authenticated = 0x00; 7235 type = key->initiator ? SMP_LTK : SMP_LTK_RESPONDER; 7236 break; 7237 case MGMT_LTK_AUTHENTICATED: 7238 authenticated = 0x01; 7239 type = key->initiator ? SMP_LTK : SMP_LTK_RESPONDER; 7240 break; 7241 case MGMT_LTK_P256_UNAUTH: 7242 authenticated = 0x00; 7243 type = SMP_LTK_P256; 7244 break; 7245 case MGMT_LTK_P256_AUTH: 7246 authenticated = 0x01; 7247 type = SMP_LTK_P256; 7248 break; 7249 case MGMT_LTK_P256_DEBUG: 7250 authenticated = 0x00; 7251 type = SMP_LTK_P256_DEBUG; 7252 fallthrough; 7253 default: 7254 continue; 7255 } 7256 7257 hci_add_ltk(hdev, &key->addr.bdaddr, 7258 le_addr_type(key->addr.type), type, authenticated, 7259 key->val, key->enc_size, key->ediv, key->rand); 7260 } 7261 7262 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS, 0, 7263 NULL, 0); 7264 7265 hci_dev_unlock(hdev); 7266 7267 return err; 7268 } 7269 7270 static void get_conn_info_complete(struct hci_dev *hdev, void *data, int err) 7271 { 7272 struct mgmt_pending_cmd *cmd = data; 7273 struct hci_conn *conn = cmd->user_data; 7274 struct mgmt_cp_get_conn_info *cp = cmd->param; 7275 struct mgmt_rp_get_conn_info rp; 7276 u8 status; 7277 7278 bt_dev_dbg(hdev, "err %d", err); 7279 7280 memcpy(&rp.addr, &cp->addr.bdaddr, sizeof(rp.addr)); 7281 7282 status = mgmt_status(err); 7283 if (status == MGMT_STATUS_SUCCESS) { 7284 rp.rssi = conn->rssi; 7285 rp.tx_power = conn->tx_power; 7286 rp.max_tx_power = conn->max_tx_power; 7287 } else { 7288 rp.rssi = HCI_RSSI_INVALID; 7289 rp.tx_power = HCI_TX_POWER_INVALID; 7290 rp.max_tx_power = HCI_TX_POWER_INVALID; 7291 } 7292 7293 mgmt_cmd_complete(cmd->sk, cmd->index, MGMT_OP_GET_CONN_INFO, status, 7294 &rp, sizeof(rp)); 7295 7296 mgmt_pending_free(cmd); 7297 } 7298 7299 static int get_conn_info_sync(struct hci_dev *hdev, void *data) 7300 { 7301 struct mgmt_pending_cmd *cmd = data; 7302 struct mgmt_cp_get_conn_info *cp = cmd->param; 7303 struct hci_conn *conn; 7304 int err; 7305 __le16 handle; 7306 7307 /* Make sure we are still connected */ 7308 if (cp->addr.type == BDADDR_BREDR) 7309 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, 7310 &cp->addr.bdaddr); 7311 else 7312 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &cp->addr.bdaddr); 7313 7314 if (!conn || conn->state != BT_CONNECTED) 7315 return MGMT_STATUS_NOT_CONNECTED; 7316 7317 cmd->user_data = conn; 7318 handle = cpu_to_le16(conn->handle); 7319 7320 /* Refresh RSSI each time */ 7321 err = hci_read_rssi_sync(hdev, handle); 7322 7323 /* For LE links TX power does not change thus we don't need to 7324 * query for it once value is known. 7325 */ 7326 if (!err && (!bdaddr_type_is_le(cp->addr.type) || 7327 conn->tx_power == HCI_TX_POWER_INVALID)) 7328 err = hci_read_tx_power_sync(hdev, handle, 0x00); 7329 7330 /* Max TX power needs to be read only once per connection */ 7331 if (!err && conn->max_tx_power == HCI_TX_POWER_INVALID) 7332 err = hci_read_tx_power_sync(hdev, handle, 0x01); 7333 7334 return err; 7335 } 7336 7337 static int get_conn_info(struct sock *sk, struct hci_dev *hdev, void *data, 7338 u16 len) 7339 { 7340 struct mgmt_cp_get_conn_info *cp = data; 7341 struct mgmt_rp_get_conn_info rp; 7342 struct hci_conn *conn; 7343 unsigned long conn_info_age; 7344 int err = 0; 7345 7346 bt_dev_dbg(hdev, "sock %p", sk); 7347 7348 memset(&rp, 0, sizeof(rp)); 7349 bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr); 7350 rp.addr.type = cp->addr.type; 7351 7352 if (!bdaddr_type_is_valid(cp->addr.type)) 7353 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO, 7354 MGMT_STATUS_INVALID_PARAMS, 7355 &rp, sizeof(rp)); 7356 7357 hci_dev_lock(hdev); 7358 7359 if (!hdev_is_powered(hdev)) { 7360 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO, 7361 MGMT_STATUS_NOT_POWERED, &rp, 7362 sizeof(rp)); 7363 goto unlock; 7364 } 7365 7366 if (cp->addr.type == BDADDR_BREDR) 7367 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, 7368 &cp->addr.bdaddr); 7369 else 7370 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &cp->addr.bdaddr); 7371 7372 if (!conn || conn->state != BT_CONNECTED) { 7373 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO, 7374 MGMT_STATUS_NOT_CONNECTED, &rp, 7375 sizeof(rp)); 7376 goto unlock; 7377 } 7378 7379 /* To avoid client trying to guess when to poll again for information we 7380 * calculate conn info age as random value between min/max set in hdev. 7381 */ 7382 conn_info_age = get_random_u32_inclusive(hdev->conn_info_min_age, 7383 hdev->conn_info_max_age - 1); 7384 7385 /* Query controller to refresh cached values if they are too old or were 7386 * never read. 7387 */ 7388 if (time_after(jiffies, conn->conn_info_timestamp + 7389 msecs_to_jiffies(conn_info_age)) || 7390 !conn->conn_info_timestamp) { 7391 struct mgmt_pending_cmd *cmd; 7392 7393 cmd = mgmt_pending_new(sk, MGMT_OP_GET_CONN_INFO, hdev, data, 7394 len); 7395 if (!cmd) { 7396 err = -ENOMEM; 7397 } else { 7398 err = hci_cmd_sync_queue(hdev, get_conn_info_sync, 7399 cmd, get_conn_info_complete); 7400 } 7401 7402 if (err < 0) { 7403 mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO, 7404 MGMT_STATUS_FAILED, &rp, sizeof(rp)); 7405 7406 if (cmd) 7407 mgmt_pending_free(cmd); 7408 7409 goto unlock; 7410 } 7411 7412 conn->conn_info_timestamp = jiffies; 7413 } else { 7414 /* Cache is valid, just reply with values cached in hci_conn */ 7415 rp.rssi = conn->rssi; 7416 rp.tx_power = conn->tx_power; 7417 rp.max_tx_power = conn->max_tx_power; 7418 7419 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO, 7420 MGMT_STATUS_SUCCESS, &rp, sizeof(rp)); 7421 } 7422 7423 unlock: 7424 hci_dev_unlock(hdev); 7425 return err; 7426 } 7427 7428 static void get_clock_info_complete(struct hci_dev *hdev, void *data, int err) 7429 { 7430 struct mgmt_pending_cmd *cmd = data; 7431 struct mgmt_cp_get_clock_info *cp = cmd->param; 7432 struct mgmt_rp_get_clock_info rp; 7433 struct hci_conn *conn = cmd->user_data; 7434 u8 status = mgmt_status(err); 7435 7436 bt_dev_dbg(hdev, "err %d", err); 7437 7438 memset(&rp, 0, sizeof(rp)); 7439 bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr); 7440 rp.addr.type = cp->addr.type; 7441 7442 if (err) 7443 goto complete; 7444 7445 rp.local_clock = cpu_to_le32(hdev->clock); 7446 7447 if (conn) { 7448 rp.piconet_clock = cpu_to_le32(conn->clock); 7449 rp.accuracy = cpu_to_le16(conn->clock_accuracy); 7450 } 7451 7452 complete: 7453 mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, status, &rp, 7454 sizeof(rp)); 7455 7456 mgmt_pending_free(cmd); 7457 } 7458 7459 static int get_clock_info_sync(struct hci_dev *hdev, void *data) 7460 { 7461 struct mgmt_pending_cmd *cmd = data; 7462 struct mgmt_cp_get_clock_info *cp = cmd->param; 7463 struct hci_cp_read_clock hci_cp; 7464 struct hci_conn *conn; 7465 7466 memset(&hci_cp, 0, sizeof(hci_cp)); 7467 hci_read_clock_sync(hdev, &hci_cp); 7468 7469 /* Make sure connection still exists */ 7470 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->addr.bdaddr); 7471 if (!conn || conn->state != BT_CONNECTED) 7472 return MGMT_STATUS_NOT_CONNECTED; 7473 7474 cmd->user_data = conn; 7475 hci_cp.handle = cpu_to_le16(conn->handle); 7476 hci_cp.which = 0x01; /* Piconet clock */ 7477 7478 return hci_read_clock_sync(hdev, &hci_cp); 7479 } 7480 7481 static int get_clock_info(struct sock *sk, struct hci_dev *hdev, void *data, 7482 u16 len) 7483 { 7484 struct mgmt_cp_get_clock_info *cp = data; 7485 struct mgmt_rp_get_clock_info rp; 7486 struct mgmt_pending_cmd *cmd; 7487 struct hci_conn *conn; 7488 int err; 7489 7490 bt_dev_dbg(hdev, "sock %p", sk); 7491 7492 memset(&rp, 0, sizeof(rp)); 7493 bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr); 7494 rp.addr.type = cp->addr.type; 7495 7496 if (cp->addr.type != BDADDR_BREDR) 7497 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CLOCK_INFO, 7498 MGMT_STATUS_INVALID_PARAMS, 7499 &rp, sizeof(rp)); 7500 7501 hci_dev_lock(hdev); 7502 7503 if (!hdev_is_powered(hdev)) { 7504 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CLOCK_INFO, 7505 MGMT_STATUS_NOT_POWERED, &rp, 7506 sizeof(rp)); 7507 goto unlock; 7508 } 7509 7510 if (bacmp(&cp->addr.bdaddr, BDADDR_ANY)) { 7511 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, 7512 &cp->addr.bdaddr); 7513 if (!conn || conn->state != BT_CONNECTED) { 7514 err = mgmt_cmd_complete(sk, hdev->id, 7515 MGMT_OP_GET_CLOCK_INFO, 7516 MGMT_STATUS_NOT_CONNECTED, 7517 &rp, sizeof(rp)); 7518 goto unlock; 7519 } 7520 } else { 7521 conn = NULL; 7522 } 7523 7524 cmd = mgmt_pending_new(sk, MGMT_OP_GET_CLOCK_INFO, hdev, data, len); 7525 if (!cmd) 7526 err = -ENOMEM; 7527 else 7528 err = hci_cmd_sync_queue(hdev, get_clock_info_sync, cmd, 7529 get_clock_info_complete); 7530 7531 if (err < 0) { 7532 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CLOCK_INFO, 7533 MGMT_STATUS_FAILED, &rp, sizeof(rp)); 7534 7535 if (cmd) 7536 mgmt_pending_free(cmd); 7537 } 7538 7539 7540 unlock: 7541 hci_dev_unlock(hdev); 7542 return err; 7543 } 7544 7545 static bool is_connected(struct hci_dev *hdev, bdaddr_t *addr, u8 type) 7546 { 7547 struct hci_conn *conn; 7548 7549 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, addr); 7550 if (!conn) 7551 return false; 7552 7553 if (conn->dst_type != type) 7554 return false; 7555 7556 if (conn->state != BT_CONNECTED) 7557 return false; 7558 7559 return true; 7560 } 7561 7562 /* This function requires the caller holds hdev->lock */ 7563 static int hci_conn_params_set(struct hci_dev *hdev, bdaddr_t *addr, 7564 u8 addr_type, u8 auto_connect) 7565 { 7566 struct hci_conn_params *params; 7567 7568 params = hci_conn_params_add(hdev, addr, addr_type); 7569 if (!params) 7570 return -EIO; 7571 7572 if (params->auto_connect == auto_connect) 7573 return 0; 7574 7575 list_del_init(¶ms->action); 7576 7577 switch (auto_connect) { 7578 case HCI_AUTO_CONN_DISABLED: 7579 case HCI_AUTO_CONN_LINK_LOSS: 7580 /* If auto connect is being disabled when we're trying to 7581 * connect to device, keep connecting. 7582 */ 7583 if (params->explicit_connect) 7584 list_add(¶ms->action, &hdev->pend_le_conns); 7585 break; 7586 case HCI_AUTO_CONN_REPORT: 7587 if (params->explicit_connect) 7588 list_add(¶ms->action, &hdev->pend_le_conns); 7589 else 7590 list_add(¶ms->action, &hdev->pend_le_reports); 7591 break; 7592 case HCI_AUTO_CONN_DIRECT: 7593 case HCI_AUTO_CONN_ALWAYS: 7594 if (!is_connected(hdev, addr, addr_type)) 7595 list_add(¶ms->action, &hdev->pend_le_conns); 7596 break; 7597 } 7598 7599 params->auto_connect = auto_connect; 7600 7601 bt_dev_dbg(hdev, "addr %pMR (type %u) auto_connect %u", 7602 addr, addr_type, auto_connect); 7603 7604 return 0; 7605 } 7606 7607 static void device_added(struct sock *sk, struct hci_dev *hdev, 7608 bdaddr_t *bdaddr, u8 type, u8 action) 7609 { 7610 struct mgmt_ev_device_added ev; 7611 7612 bacpy(&ev.addr.bdaddr, bdaddr); 7613 ev.addr.type = type; 7614 ev.action = action; 7615 7616 mgmt_event(MGMT_EV_DEVICE_ADDED, hdev, &ev, sizeof(ev), sk); 7617 } 7618 7619 static int add_device_sync(struct hci_dev *hdev, void *data) 7620 { 7621 return hci_update_passive_scan_sync(hdev); 7622 } 7623 7624 static int add_device(struct sock *sk, struct hci_dev *hdev, 7625 void *data, u16 len) 7626 { 7627 struct mgmt_cp_add_device *cp = data; 7628 u8 auto_conn, addr_type; 7629 struct hci_conn_params *params; 7630 int err; 7631 u32 current_flags = 0; 7632 u32 supported_flags; 7633 7634 bt_dev_dbg(hdev, "sock %p", sk); 7635 7636 if (!bdaddr_type_is_valid(cp->addr.type) || 7637 !bacmp(&cp->addr.bdaddr, BDADDR_ANY)) 7638 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE, 7639 MGMT_STATUS_INVALID_PARAMS, 7640 &cp->addr, sizeof(cp->addr)); 7641 7642 if (cp->action != 0x00 && cp->action != 0x01 && cp->action != 0x02) 7643 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE, 7644 MGMT_STATUS_INVALID_PARAMS, 7645 &cp->addr, sizeof(cp->addr)); 7646 7647 hci_dev_lock(hdev); 7648 7649 if (cp->addr.type == BDADDR_BREDR) { 7650 /* Only incoming connections action is supported for now */ 7651 if (cp->action != 0x01) { 7652 err = mgmt_cmd_complete(sk, hdev->id, 7653 MGMT_OP_ADD_DEVICE, 7654 MGMT_STATUS_INVALID_PARAMS, 7655 &cp->addr, sizeof(cp->addr)); 7656 goto unlock; 7657 } 7658 7659 err = hci_bdaddr_list_add_with_flags(&hdev->accept_list, 7660 &cp->addr.bdaddr, 7661 cp->addr.type, 0); 7662 if (err) 7663 goto unlock; 7664 7665 hci_update_scan(hdev); 7666 7667 goto added; 7668 } 7669 7670 addr_type = le_addr_type(cp->addr.type); 7671 7672 if (cp->action == 0x02) 7673 auto_conn = HCI_AUTO_CONN_ALWAYS; 7674 else if (cp->action == 0x01) 7675 auto_conn = HCI_AUTO_CONN_DIRECT; 7676 else 7677 auto_conn = HCI_AUTO_CONN_REPORT; 7678 7679 /* Kernel internally uses conn_params with resolvable private 7680 * address, but Add Device allows only identity addresses. 7681 * Make sure it is enforced before calling 7682 * hci_conn_params_lookup. 7683 */ 7684 if (!hci_is_identity_address(&cp->addr.bdaddr, addr_type)) { 7685 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE, 7686 MGMT_STATUS_INVALID_PARAMS, 7687 &cp->addr, sizeof(cp->addr)); 7688 goto unlock; 7689 } 7690 7691 /* If the connection parameters don't exist for this device, 7692 * they will be created and configured with defaults. 7693 */ 7694 if (hci_conn_params_set(hdev, &cp->addr.bdaddr, addr_type, 7695 auto_conn) < 0) { 7696 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE, 7697 MGMT_STATUS_FAILED, &cp->addr, 7698 sizeof(cp->addr)); 7699 goto unlock; 7700 } else { 7701 params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr, 7702 addr_type); 7703 if (params) 7704 current_flags = params->flags; 7705 } 7706 7707 err = hci_cmd_sync_queue(hdev, add_device_sync, NULL, NULL); 7708 if (err < 0) 7709 goto unlock; 7710 7711 added: 7712 device_added(sk, hdev, &cp->addr.bdaddr, cp->addr.type, cp->action); 7713 supported_flags = hdev->conn_flags; 7714 device_flags_changed(NULL, hdev, &cp->addr.bdaddr, cp->addr.type, 7715 supported_flags, current_flags); 7716 7717 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE, 7718 MGMT_STATUS_SUCCESS, &cp->addr, 7719 sizeof(cp->addr)); 7720 7721 unlock: 7722 hci_dev_unlock(hdev); 7723 return err; 7724 } 7725 7726 static void device_removed(struct sock *sk, struct hci_dev *hdev, 7727 bdaddr_t *bdaddr, u8 type) 7728 { 7729 struct mgmt_ev_device_removed ev; 7730 7731 bacpy(&ev.addr.bdaddr, bdaddr); 7732 ev.addr.type = type; 7733 7734 mgmt_event(MGMT_EV_DEVICE_REMOVED, hdev, &ev, sizeof(ev), sk); 7735 } 7736 7737 static int remove_device_sync(struct hci_dev *hdev, void *data) 7738 { 7739 return hci_update_passive_scan_sync(hdev); 7740 } 7741 7742 static int remove_device(struct sock *sk, struct hci_dev *hdev, 7743 void *data, u16 len) 7744 { 7745 struct mgmt_cp_remove_device *cp = data; 7746 int err; 7747 7748 bt_dev_dbg(hdev, "sock %p", sk); 7749 7750 hci_dev_lock(hdev); 7751 7752 if (bacmp(&cp->addr.bdaddr, BDADDR_ANY)) { 7753 struct hci_conn_params *params; 7754 u8 addr_type; 7755 7756 if (!bdaddr_type_is_valid(cp->addr.type)) { 7757 err = mgmt_cmd_complete(sk, hdev->id, 7758 MGMT_OP_REMOVE_DEVICE, 7759 MGMT_STATUS_INVALID_PARAMS, 7760 &cp->addr, sizeof(cp->addr)); 7761 goto unlock; 7762 } 7763 7764 if (cp->addr.type == BDADDR_BREDR) { 7765 err = hci_bdaddr_list_del(&hdev->accept_list, 7766 &cp->addr.bdaddr, 7767 cp->addr.type); 7768 if (err) { 7769 err = mgmt_cmd_complete(sk, hdev->id, 7770 MGMT_OP_REMOVE_DEVICE, 7771 MGMT_STATUS_INVALID_PARAMS, 7772 &cp->addr, 7773 sizeof(cp->addr)); 7774 goto unlock; 7775 } 7776 7777 hci_update_scan(hdev); 7778 7779 device_removed(sk, hdev, &cp->addr.bdaddr, 7780 cp->addr.type); 7781 goto complete; 7782 } 7783 7784 addr_type = le_addr_type(cp->addr.type); 7785 7786 /* Kernel internally uses conn_params with resolvable private 7787 * address, but Remove Device allows only identity addresses. 7788 * Make sure it is enforced before calling 7789 * hci_conn_params_lookup. 7790 */ 7791 if (!hci_is_identity_address(&cp->addr.bdaddr, addr_type)) { 7792 err = mgmt_cmd_complete(sk, hdev->id, 7793 MGMT_OP_REMOVE_DEVICE, 7794 MGMT_STATUS_INVALID_PARAMS, 7795 &cp->addr, sizeof(cp->addr)); 7796 goto unlock; 7797 } 7798 7799 params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr, 7800 addr_type); 7801 if (!params) { 7802 err = mgmt_cmd_complete(sk, hdev->id, 7803 MGMT_OP_REMOVE_DEVICE, 7804 MGMT_STATUS_INVALID_PARAMS, 7805 &cp->addr, sizeof(cp->addr)); 7806 goto unlock; 7807 } 7808 7809 if (params->auto_connect == HCI_AUTO_CONN_DISABLED || 7810 params->auto_connect == HCI_AUTO_CONN_EXPLICIT) { 7811 err = mgmt_cmd_complete(sk, hdev->id, 7812 MGMT_OP_REMOVE_DEVICE, 7813 MGMT_STATUS_INVALID_PARAMS, 7814 &cp->addr, sizeof(cp->addr)); 7815 goto unlock; 7816 } 7817 7818 list_del(¶ms->action); 7819 list_del(¶ms->list); 7820 kfree(params); 7821 7822 device_removed(sk, hdev, &cp->addr.bdaddr, cp->addr.type); 7823 } else { 7824 struct hci_conn_params *p, *tmp; 7825 struct bdaddr_list *b, *btmp; 7826 7827 if (cp->addr.type) { 7828 err = mgmt_cmd_complete(sk, hdev->id, 7829 MGMT_OP_REMOVE_DEVICE, 7830 MGMT_STATUS_INVALID_PARAMS, 7831 &cp->addr, sizeof(cp->addr)); 7832 goto unlock; 7833 } 7834 7835 list_for_each_entry_safe(b, btmp, &hdev->accept_list, list) { 7836 device_removed(sk, hdev, &b->bdaddr, b->bdaddr_type); 7837 list_del(&b->list); 7838 kfree(b); 7839 } 7840 7841 hci_update_scan(hdev); 7842 7843 list_for_each_entry_safe(p, tmp, &hdev->le_conn_params, list) { 7844 if (p->auto_connect == HCI_AUTO_CONN_DISABLED) 7845 continue; 7846 device_removed(sk, hdev, &p->addr, p->addr_type); 7847 if (p->explicit_connect) { 7848 p->auto_connect = HCI_AUTO_CONN_EXPLICIT; 7849 continue; 7850 } 7851 list_del(&p->action); 7852 list_del(&p->list); 7853 kfree(p); 7854 } 7855 7856 bt_dev_dbg(hdev, "All LE connection parameters were removed"); 7857 } 7858 7859 hci_cmd_sync_queue(hdev, remove_device_sync, NULL, NULL); 7860 7861 complete: 7862 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_DEVICE, 7863 MGMT_STATUS_SUCCESS, &cp->addr, 7864 sizeof(cp->addr)); 7865 unlock: 7866 hci_dev_unlock(hdev); 7867 return err; 7868 } 7869 7870 static int load_conn_param(struct sock *sk, struct hci_dev *hdev, void *data, 7871 u16 len) 7872 { 7873 struct mgmt_cp_load_conn_param *cp = data; 7874 const u16 max_param_count = ((U16_MAX - sizeof(*cp)) / 7875 sizeof(struct mgmt_conn_param)); 7876 u16 param_count, expected_len; 7877 int i; 7878 7879 if (!lmp_le_capable(hdev)) 7880 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM, 7881 MGMT_STATUS_NOT_SUPPORTED); 7882 7883 param_count = __le16_to_cpu(cp->param_count); 7884 if (param_count > max_param_count) { 7885 bt_dev_err(hdev, "load_conn_param: too big param_count value %u", 7886 param_count); 7887 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM, 7888 MGMT_STATUS_INVALID_PARAMS); 7889 } 7890 7891 expected_len = struct_size(cp, params, param_count); 7892 if (expected_len != len) { 7893 bt_dev_err(hdev, "load_conn_param: expected %u bytes, got %u bytes", 7894 expected_len, len); 7895 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM, 7896 MGMT_STATUS_INVALID_PARAMS); 7897 } 7898 7899 bt_dev_dbg(hdev, "param_count %u", param_count); 7900 7901 hci_dev_lock(hdev); 7902 7903 hci_conn_params_clear_disabled(hdev); 7904 7905 for (i = 0; i < param_count; i++) { 7906 struct mgmt_conn_param *param = &cp->params[i]; 7907 struct hci_conn_params *hci_param; 7908 u16 min, max, latency, timeout; 7909 u8 addr_type; 7910 7911 bt_dev_dbg(hdev, "Adding %pMR (type %u)", ¶m->addr.bdaddr, 7912 param->addr.type); 7913 7914 if (param->addr.type == BDADDR_LE_PUBLIC) { 7915 addr_type = ADDR_LE_DEV_PUBLIC; 7916 } else if (param->addr.type == BDADDR_LE_RANDOM) { 7917 addr_type = ADDR_LE_DEV_RANDOM; 7918 } else { 7919 bt_dev_err(hdev, "ignoring invalid connection parameters"); 7920 continue; 7921 } 7922 7923 min = le16_to_cpu(param->min_interval); 7924 max = le16_to_cpu(param->max_interval); 7925 latency = le16_to_cpu(param->latency); 7926 timeout = le16_to_cpu(param->timeout); 7927 7928 bt_dev_dbg(hdev, "min 0x%04x max 0x%04x latency 0x%04x timeout 0x%04x", 7929 min, max, latency, timeout); 7930 7931 if (hci_check_conn_params(min, max, latency, timeout) < 0) { 7932 bt_dev_err(hdev, "ignoring invalid connection parameters"); 7933 continue; 7934 } 7935 7936 hci_param = hci_conn_params_add(hdev, ¶m->addr.bdaddr, 7937 addr_type); 7938 if (!hci_param) { 7939 bt_dev_err(hdev, "failed to add connection parameters"); 7940 continue; 7941 } 7942 7943 hci_param->conn_min_interval = min; 7944 hci_param->conn_max_interval = max; 7945 hci_param->conn_latency = latency; 7946 hci_param->supervision_timeout = timeout; 7947 } 7948 7949 hci_dev_unlock(hdev); 7950 7951 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM, 0, 7952 NULL, 0); 7953 } 7954 7955 static int set_external_config(struct sock *sk, struct hci_dev *hdev, 7956 void *data, u16 len) 7957 { 7958 struct mgmt_cp_set_external_config *cp = data; 7959 bool changed; 7960 int err; 7961 7962 bt_dev_dbg(hdev, "sock %p", sk); 7963 7964 if (hdev_is_powered(hdev)) 7965 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_EXTERNAL_CONFIG, 7966 MGMT_STATUS_REJECTED); 7967 7968 if (cp->config != 0x00 && cp->config != 0x01) 7969 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_EXTERNAL_CONFIG, 7970 MGMT_STATUS_INVALID_PARAMS); 7971 7972 if (!test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks)) 7973 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_EXTERNAL_CONFIG, 7974 MGMT_STATUS_NOT_SUPPORTED); 7975 7976 hci_dev_lock(hdev); 7977 7978 if (cp->config) 7979 changed = !hci_dev_test_and_set_flag(hdev, HCI_EXT_CONFIGURED); 7980 else 7981 changed = hci_dev_test_and_clear_flag(hdev, HCI_EXT_CONFIGURED); 7982 7983 err = send_options_rsp(sk, MGMT_OP_SET_EXTERNAL_CONFIG, hdev); 7984 if (err < 0) 7985 goto unlock; 7986 7987 if (!changed) 7988 goto unlock; 7989 7990 err = new_options(hdev, sk); 7991 7992 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED) == is_configured(hdev)) { 7993 mgmt_index_removed(hdev); 7994 7995 if (hci_dev_test_and_change_flag(hdev, HCI_UNCONFIGURED)) { 7996 hci_dev_set_flag(hdev, HCI_CONFIG); 7997 hci_dev_set_flag(hdev, HCI_AUTO_OFF); 7998 7999 queue_work(hdev->req_workqueue, &hdev->power_on); 8000 } else { 8001 set_bit(HCI_RAW, &hdev->flags); 8002 mgmt_index_added(hdev); 8003 } 8004 } 8005 8006 unlock: 8007 hci_dev_unlock(hdev); 8008 return err; 8009 } 8010 8011 static int set_public_address(struct sock *sk, struct hci_dev *hdev, 8012 void *data, u16 len) 8013 { 8014 struct mgmt_cp_set_public_address *cp = data; 8015 bool changed; 8016 int err; 8017 8018 bt_dev_dbg(hdev, "sock %p", sk); 8019 8020 if (hdev_is_powered(hdev)) 8021 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PUBLIC_ADDRESS, 8022 MGMT_STATUS_REJECTED); 8023 8024 if (!bacmp(&cp->bdaddr, BDADDR_ANY)) 8025 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PUBLIC_ADDRESS, 8026 MGMT_STATUS_INVALID_PARAMS); 8027 8028 if (!hdev->set_bdaddr) 8029 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PUBLIC_ADDRESS, 8030 MGMT_STATUS_NOT_SUPPORTED); 8031 8032 hci_dev_lock(hdev); 8033 8034 changed = !!bacmp(&hdev->public_addr, &cp->bdaddr); 8035 bacpy(&hdev->public_addr, &cp->bdaddr); 8036 8037 err = send_options_rsp(sk, MGMT_OP_SET_PUBLIC_ADDRESS, hdev); 8038 if (err < 0) 8039 goto unlock; 8040 8041 if (!changed) 8042 goto unlock; 8043 8044 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) 8045 err = new_options(hdev, sk); 8046 8047 if (is_configured(hdev)) { 8048 mgmt_index_removed(hdev); 8049 8050 hci_dev_clear_flag(hdev, HCI_UNCONFIGURED); 8051 8052 hci_dev_set_flag(hdev, HCI_CONFIG); 8053 hci_dev_set_flag(hdev, HCI_AUTO_OFF); 8054 8055 queue_work(hdev->req_workqueue, &hdev->power_on); 8056 } 8057 8058 unlock: 8059 hci_dev_unlock(hdev); 8060 return err; 8061 } 8062 8063 static void read_local_oob_ext_data_complete(struct hci_dev *hdev, void *data, 8064 int err) 8065 { 8066 const struct mgmt_cp_read_local_oob_ext_data *mgmt_cp; 8067 struct mgmt_rp_read_local_oob_ext_data *mgmt_rp; 8068 u8 *h192, *r192, *h256, *r256; 8069 struct mgmt_pending_cmd *cmd = data; 8070 struct sk_buff *skb = cmd->skb; 8071 u8 status = mgmt_status(err); 8072 u16 eir_len; 8073 8074 if (cmd != pending_find(MGMT_OP_READ_LOCAL_OOB_EXT_DATA, hdev)) 8075 return; 8076 8077 if (!status) { 8078 if (!skb) 8079 status = MGMT_STATUS_FAILED; 8080 else if (IS_ERR(skb)) 8081 status = mgmt_status(PTR_ERR(skb)); 8082 else 8083 status = mgmt_status(skb->data[0]); 8084 } 8085 8086 bt_dev_dbg(hdev, "status %u", status); 8087 8088 mgmt_cp = cmd->param; 8089 8090 if (status) { 8091 status = mgmt_status(status); 8092 eir_len = 0; 8093 8094 h192 = NULL; 8095 r192 = NULL; 8096 h256 = NULL; 8097 r256 = NULL; 8098 } else if (!bredr_sc_enabled(hdev)) { 8099 struct hci_rp_read_local_oob_data *rp; 8100 8101 if (skb->len != sizeof(*rp)) { 8102 status = MGMT_STATUS_FAILED; 8103 eir_len = 0; 8104 } else { 8105 status = MGMT_STATUS_SUCCESS; 8106 rp = (void *)skb->data; 8107 8108 eir_len = 5 + 18 + 18; 8109 h192 = rp->hash; 8110 r192 = rp->rand; 8111 h256 = NULL; 8112 r256 = NULL; 8113 } 8114 } else { 8115 struct hci_rp_read_local_oob_ext_data *rp; 8116 8117 if (skb->len != sizeof(*rp)) { 8118 status = MGMT_STATUS_FAILED; 8119 eir_len = 0; 8120 } else { 8121 status = MGMT_STATUS_SUCCESS; 8122 rp = (void *)skb->data; 8123 8124 if (hci_dev_test_flag(hdev, HCI_SC_ONLY)) { 8125 eir_len = 5 + 18 + 18; 8126 h192 = NULL; 8127 r192 = NULL; 8128 } else { 8129 eir_len = 5 + 18 + 18 + 18 + 18; 8130 h192 = rp->hash192; 8131 r192 = rp->rand192; 8132 } 8133 8134 h256 = rp->hash256; 8135 r256 = rp->rand256; 8136 } 8137 } 8138 8139 mgmt_rp = kmalloc(sizeof(*mgmt_rp) + eir_len, GFP_KERNEL); 8140 if (!mgmt_rp) 8141 goto done; 8142 8143 if (eir_len == 0) 8144 goto send_rsp; 8145 8146 eir_len = eir_append_data(mgmt_rp->eir, 0, EIR_CLASS_OF_DEV, 8147 hdev->dev_class, 3); 8148 8149 if (h192 && r192) { 8150 eir_len = eir_append_data(mgmt_rp->eir, eir_len, 8151 EIR_SSP_HASH_C192, h192, 16); 8152 eir_len = eir_append_data(mgmt_rp->eir, eir_len, 8153 EIR_SSP_RAND_R192, r192, 16); 8154 } 8155 8156 if (h256 && r256) { 8157 eir_len = eir_append_data(mgmt_rp->eir, eir_len, 8158 EIR_SSP_HASH_C256, h256, 16); 8159 eir_len = eir_append_data(mgmt_rp->eir, eir_len, 8160 EIR_SSP_RAND_R256, r256, 16); 8161 } 8162 8163 send_rsp: 8164 mgmt_rp->type = mgmt_cp->type; 8165 mgmt_rp->eir_len = cpu_to_le16(eir_len); 8166 8167 err = mgmt_cmd_complete(cmd->sk, hdev->id, 8168 MGMT_OP_READ_LOCAL_OOB_EXT_DATA, status, 8169 mgmt_rp, sizeof(*mgmt_rp) + eir_len); 8170 if (err < 0 || status) 8171 goto done; 8172 8173 hci_sock_set_flag(cmd->sk, HCI_MGMT_OOB_DATA_EVENTS); 8174 8175 err = mgmt_limited_event(MGMT_EV_LOCAL_OOB_DATA_UPDATED, hdev, 8176 mgmt_rp, sizeof(*mgmt_rp) + eir_len, 8177 HCI_MGMT_OOB_DATA_EVENTS, cmd->sk); 8178 done: 8179 if (skb && !IS_ERR(skb)) 8180 kfree_skb(skb); 8181 8182 kfree(mgmt_rp); 8183 mgmt_pending_remove(cmd); 8184 } 8185 8186 static int read_local_ssp_oob_req(struct hci_dev *hdev, struct sock *sk, 8187 struct mgmt_cp_read_local_oob_ext_data *cp) 8188 { 8189 struct mgmt_pending_cmd *cmd; 8190 int err; 8191 8192 cmd = mgmt_pending_add(sk, MGMT_OP_READ_LOCAL_OOB_EXT_DATA, hdev, 8193 cp, sizeof(*cp)); 8194 if (!cmd) 8195 return -ENOMEM; 8196 8197 err = hci_cmd_sync_queue(hdev, read_local_oob_data_sync, cmd, 8198 read_local_oob_ext_data_complete); 8199 8200 if (err < 0) { 8201 mgmt_pending_remove(cmd); 8202 return err; 8203 } 8204 8205 return 0; 8206 } 8207 8208 static int read_local_oob_ext_data(struct sock *sk, struct hci_dev *hdev, 8209 void *data, u16 data_len) 8210 { 8211 struct mgmt_cp_read_local_oob_ext_data *cp = data; 8212 struct mgmt_rp_read_local_oob_ext_data *rp; 8213 size_t rp_len; 8214 u16 eir_len; 8215 u8 status, flags, role, addr[7], hash[16], rand[16]; 8216 int err; 8217 8218 bt_dev_dbg(hdev, "sock %p", sk); 8219 8220 if (hdev_is_powered(hdev)) { 8221 switch (cp->type) { 8222 case BIT(BDADDR_BREDR): 8223 status = mgmt_bredr_support(hdev); 8224 if (status) 8225 eir_len = 0; 8226 else 8227 eir_len = 5; 8228 break; 8229 case (BIT(BDADDR_LE_PUBLIC) | BIT(BDADDR_LE_RANDOM)): 8230 status = mgmt_le_support(hdev); 8231 if (status) 8232 eir_len = 0; 8233 else 8234 eir_len = 9 + 3 + 18 + 18 + 3; 8235 break; 8236 default: 8237 status = MGMT_STATUS_INVALID_PARAMS; 8238 eir_len = 0; 8239 break; 8240 } 8241 } else { 8242 status = MGMT_STATUS_NOT_POWERED; 8243 eir_len = 0; 8244 } 8245 8246 rp_len = sizeof(*rp) + eir_len; 8247 rp = kmalloc(rp_len, GFP_ATOMIC); 8248 if (!rp) 8249 return -ENOMEM; 8250 8251 if (!status && !lmp_ssp_capable(hdev)) { 8252 status = MGMT_STATUS_NOT_SUPPORTED; 8253 eir_len = 0; 8254 } 8255 8256 if (status) 8257 goto complete; 8258 8259 hci_dev_lock(hdev); 8260 8261 eir_len = 0; 8262 switch (cp->type) { 8263 case BIT(BDADDR_BREDR): 8264 if (hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) { 8265 err = read_local_ssp_oob_req(hdev, sk, cp); 8266 hci_dev_unlock(hdev); 8267 if (!err) 8268 goto done; 8269 8270 status = MGMT_STATUS_FAILED; 8271 goto complete; 8272 } else { 8273 eir_len = eir_append_data(rp->eir, eir_len, 8274 EIR_CLASS_OF_DEV, 8275 hdev->dev_class, 3); 8276 } 8277 break; 8278 case (BIT(BDADDR_LE_PUBLIC) | BIT(BDADDR_LE_RANDOM)): 8279 if (hci_dev_test_flag(hdev, HCI_SC_ENABLED) && 8280 smp_generate_oob(hdev, hash, rand) < 0) { 8281 hci_dev_unlock(hdev); 8282 status = MGMT_STATUS_FAILED; 8283 goto complete; 8284 } 8285 8286 /* This should return the active RPA, but since the RPA 8287 * is only programmed on demand, it is really hard to fill 8288 * this in at the moment. For now disallow retrieving 8289 * local out-of-band data when privacy is in use. 8290 * 8291 * Returning the identity address will not help here since 8292 * pairing happens before the identity resolving key is 8293 * known and thus the connection establishment happens 8294 * based on the RPA and not the identity address. 8295 */ 8296 if (hci_dev_test_flag(hdev, HCI_PRIVACY)) { 8297 hci_dev_unlock(hdev); 8298 status = MGMT_STATUS_REJECTED; 8299 goto complete; 8300 } 8301 8302 if (hci_dev_test_flag(hdev, HCI_FORCE_STATIC_ADDR) || 8303 !bacmp(&hdev->bdaddr, BDADDR_ANY) || 8304 (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) && 8305 bacmp(&hdev->static_addr, BDADDR_ANY))) { 8306 memcpy(addr, &hdev->static_addr, 6); 8307 addr[6] = 0x01; 8308 } else { 8309 memcpy(addr, &hdev->bdaddr, 6); 8310 addr[6] = 0x00; 8311 } 8312 8313 eir_len = eir_append_data(rp->eir, eir_len, EIR_LE_BDADDR, 8314 addr, sizeof(addr)); 8315 8316 if (hci_dev_test_flag(hdev, HCI_ADVERTISING)) 8317 role = 0x02; 8318 else 8319 role = 0x01; 8320 8321 eir_len = eir_append_data(rp->eir, eir_len, EIR_LE_ROLE, 8322 &role, sizeof(role)); 8323 8324 if (hci_dev_test_flag(hdev, HCI_SC_ENABLED)) { 8325 eir_len = eir_append_data(rp->eir, eir_len, 8326 EIR_LE_SC_CONFIRM, 8327 hash, sizeof(hash)); 8328 8329 eir_len = eir_append_data(rp->eir, eir_len, 8330 EIR_LE_SC_RANDOM, 8331 rand, sizeof(rand)); 8332 } 8333 8334 flags = mgmt_get_adv_discov_flags(hdev); 8335 8336 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) 8337 flags |= LE_AD_NO_BREDR; 8338 8339 eir_len = eir_append_data(rp->eir, eir_len, EIR_FLAGS, 8340 &flags, sizeof(flags)); 8341 break; 8342 } 8343 8344 hci_dev_unlock(hdev); 8345 8346 hci_sock_set_flag(sk, HCI_MGMT_OOB_DATA_EVENTS); 8347 8348 status = MGMT_STATUS_SUCCESS; 8349 8350 complete: 8351 rp->type = cp->type; 8352 rp->eir_len = cpu_to_le16(eir_len); 8353 8354 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_EXT_DATA, 8355 status, rp, sizeof(*rp) + eir_len); 8356 if (err < 0 || status) 8357 goto done; 8358 8359 err = mgmt_limited_event(MGMT_EV_LOCAL_OOB_DATA_UPDATED, hdev, 8360 rp, sizeof(*rp) + eir_len, 8361 HCI_MGMT_OOB_DATA_EVENTS, sk); 8362 8363 done: 8364 kfree(rp); 8365 8366 return err; 8367 } 8368 8369 static u32 get_supported_adv_flags(struct hci_dev *hdev) 8370 { 8371 u32 flags = 0; 8372 8373 flags |= MGMT_ADV_FLAG_CONNECTABLE; 8374 flags |= MGMT_ADV_FLAG_DISCOV; 8375 flags |= MGMT_ADV_FLAG_LIMITED_DISCOV; 8376 flags |= MGMT_ADV_FLAG_MANAGED_FLAGS; 8377 flags |= MGMT_ADV_FLAG_APPEARANCE; 8378 flags |= MGMT_ADV_FLAG_LOCAL_NAME; 8379 flags |= MGMT_ADV_PARAM_DURATION; 8380 flags |= MGMT_ADV_PARAM_TIMEOUT; 8381 flags |= MGMT_ADV_PARAM_INTERVALS; 8382 flags |= MGMT_ADV_PARAM_TX_POWER; 8383 flags |= MGMT_ADV_PARAM_SCAN_RSP; 8384 8385 /* In extended adv TX_POWER returned from Set Adv Param 8386 * will be always valid. 8387 */ 8388 if (hdev->adv_tx_power != HCI_TX_POWER_INVALID || ext_adv_capable(hdev)) 8389 flags |= MGMT_ADV_FLAG_TX_POWER; 8390 8391 if (ext_adv_capable(hdev)) { 8392 flags |= MGMT_ADV_FLAG_SEC_1M; 8393 flags |= MGMT_ADV_FLAG_HW_OFFLOAD; 8394 flags |= MGMT_ADV_FLAG_CAN_SET_TX_POWER; 8395 8396 if (hdev->le_features[1] & HCI_LE_PHY_2M) 8397 flags |= MGMT_ADV_FLAG_SEC_2M; 8398 8399 if (hdev->le_features[1] & HCI_LE_PHY_CODED) 8400 flags |= MGMT_ADV_FLAG_SEC_CODED; 8401 } 8402 8403 return flags; 8404 } 8405 8406 static int read_adv_features(struct sock *sk, struct hci_dev *hdev, 8407 void *data, u16 data_len) 8408 { 8409 struct mgmt_rp_read_adv_features *rp; 8410 size_t rp_len; 8411 int err; 8412 struct adv_info *adv_instance; 8413 u32 supported_flags; 8414 u8 *instance; 8415 8416 bt_dev_dbg(hdev, "sock %p", sk); 8417 8418 if (!lmp_le_capable(hdev)) 8419 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_ADV_FEATURES, 8420 MGMT_STATUS_REJECTED); 8421 8422 hci_dev_lock(hdev); 8423 8424 rp_len = sizeof(*rp) + hdev->adv_instance_cnt; 8425 rp = kmalloc(rp_len, GFP_ATOMIC); 8426 if (!rp) { 8427 hci_dev_unlock(hdev); 8428 return -ENOMEM; 8429 } 8430 8431 supported_flags = get_supported_adv_flags(hdev); 8432 8433 rp->supported_flags = cpu_to_le32(supported_flags); 8434 rp->max_adv_data_len = HCI_MAX_AD_LENGTH; 8435 rp->max_scan_rsp_len = HCI_MAX_AD_LENGTH; 8436 rp->max_instances = hdev->le_num_of_adv_sets; 8437 rp->num_instances = hdev->adv_instance_cnt; 8438 8439 instance = rp->instance; 8440 list_for_each_entry(adv_instance, &hdev->adv_instances, list) { 8441 /* Only instances 1-le_num_of_adv_sets are externally visible */ 8442 if (adv_instance->instance <= hdev->adv_instance_cnt) { 8443 *instance = adv_instance->instance; 8444 instance++; 8445 } else { 8446 rp->num_instances--; 8447 rp_len--; 8448 } 8449 } 8450 8451 hci_dev_unlock(hdev); 8452 8453 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_ADV_FEATURES, 8454 MGMT_STATUS_SUCCESS, rp, rp_len); 8455 8456 kfree(rp); 8457 8458 return err; 8459 } 8460 8461 static u8 calculate_name_len(struct hci_dev *hdev) 8462 { 8463 u8 buf[HCI_MAX_SHORT_NAME_LENGTH + 3]; 8464 8465 return eir_append_local_name(hdev, buf, 0); 8466 } 8467 8468 static u8 tlv_data_max_len(struct hci_dev *hdev, u32 adv_flags, 8469 bool is_adv_data) 8470 { 8471 u8 max_len = HCI_MAX_AD_LENGTH; 8472 8473 if (is_adv_data) { 8474 if (adv_flags & (MGMT_ADV_FLAG_DISCOV | 8475 MGMT_ADV_FLAG_LIMITED_DISCOV | 8476 MGMT_ADV_FLAG_MANAGED_FLAGS)) 8477 max_len -= 3; 8478 8479 if (adv_flags & MGMT_ADV_FLAG_TX_POWER) 8480 max_len -= 3; 8481 } else { 8482 if (adv_flags & MGMT_ADV_FLAG_LOCAL_NAME) 8483 max_len -= calculate_name_len(hdev); 8484 8485 if (adv_flags & (MGMT_ADV_FLAG_APPEARANCE)) 8486 max_len -= 4; 8487 } 8488 8489 return max_len; 8490 } 8491 8492 static bool flags_managed(u32 adv_flags) 8493 { 8494 return adv_flags & (MGMT_ADV_FLAG_DISCOV | 8495 MGMT_ADV_FLAG_LIMITED_DISCOV | 8496 MGMT_ADV_FLAG_MANAGED_FLAGS); 8497 } 8498 8499 static bool tx_power_managed(u32 adv_flags) 8500 { 8501 return adv_flags & MGMT_ADV_FLAG_TX_POWER; 8502 } 8503 8504 static bool name_managed(u32 adv_flags) 8505 { 8506 return adv_flags & MGMT_ADV_FLAG_LOCAL_NAME; 8507 } 8508 8509 static bool appearance_managed(u32 adv_flags) 8510 { 8511 return adv_flags & MGMT_ADV_FLAG_APPEARANCE; 8512 } 8513 8514 static bool tlv_data_is_valid(struct hci_dev *hdev, u32 adv_flags, u8 *data, 8515 u8 len, bool is_adv_data) 8516 { 8517 int i, cur_len; 8518 u8 max_len; 8519 8520 max_len = tlv_data_max_len(hdev, adv_flags, is_adv_data); 8521 8522 if (len > max_len) 8523 return false; 8524 8525 /* Make sure that the data is correctly formatted. */ 8526 for (i = 0; i < len; i += (cur_len + 1)) { 8527 cur_len = data[i]; 8528 8529 if (!cur_len) 8530 continue; 8531 8532 if (data[i + 1] == EIR_FLAGS && 8533 (!is_adv_data || flags_managed(adv_flags))) 8534 return false; 8535 8536 if (data[i + 1] == EIR_TX_POWER && tx_power_managed(adv_flags)) 8537 return false; 8538 8539 if (data[i + 1] == EIR_NAME_COMPLETE && name_managed(adv_flags)) 8540 return false; 8541 8542 if (data[i + 1] == EIR_NAME_SHORT && name_managed(adv_flags)) 8543 return false; 8544 8545 if (data[i + 1] == EIR_APPEARANCE && 8546 appearance_managed(adv_flags)) 8547 return false; 8548 8549 /* If the current field length would exceed the total data 8550 * length, then it's invalid. 8551 */ 8552 if (i + cur_len >= len) 8553 return false; 8554 } 8555 8556 return true; 8557 } 8558 8559 static bool requested_adv_flags_are_valid(struct hci_dev *hdev, u32 adv_flags) 8560 { 8561 u32 supported_flags, phy_flags; 8562 8563 /* The current implementation only supports a subset of the specified 8564 * flags. Also need to check mutual exclusiveness of sec flags. 8565 */ 8566 supported_flags = get_supported_adv_flags(hdev); 8567 phy_flags = adv_flags & MGMT_ADV_FLAG_SEC_MASK; 8568 if (adv_flags & ~supported_flags || 8569 ((phy_flags && (phy_flags ^ (phy_flags & -phy_flags))))) 8570 return false; 8571 8572 return true; 8573 } 8574 8575 static bool adv_busy(struct hci_dev *hdev) 8576 { 8577 return pending_find(MGMT_OP_SET_LE, hdev); 8578 } 8579 8580 static void add_adv_complete(struct hci_dev *hdev, struct sock *sk, u8 instance, 8581 int err) 8582 { 8583 struct adv_info *adv, *n; 8584 8585 bt_dev_dbg(hdev, "err %d", err); 8586 8587 hci_dev_lock(hdev); 8588 8589 list_for_each_entry_safe(adv, n, &hdev->adv_instances, list) { 8590 u8 instance; 8591 8592 if (!adv->pending) 8593 continue; 8594 8595 if (!err) { 8596 adv->pending = false; 8597 continue; 8598 } 8599 8600 instance = adv->instance; 8601 8602 if (hdev->cur_adv_instance == instance) 8603 cancel_adv_timeout(hdev); 8604 8605 hci_remove_adv_instance(hdev, instance); 8606 mgmt_advertising_removed(sk, hdev, instance); 8607 } 8608 8609 hci_dev_unlock(hdev); 8610 } 8611 8612 static void add_advertising_complete(struct hci_dev *hdev, void *data, int err) 8613 { 8614 struct mgmt_pending_cmd *cmd = data; 8615 struct mgmt_cp_add_advertising *cp = cmd->param; 8616 struct mgmt_rp_add_advertising rp; 8617 8618 memset(&rp, 0, sizeof(rp)); 8619 8620 rp.instance = cp->instance; 8621 8622 if (err) 8623 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, 8624 mgmt_status(err)); 8625 else 8626 mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, 8627 mgmt_status(err), &rp, sizeof(rp)); 8628 8629 add_adv_complete(hdev, cmd->sk, cp->instance, err); 8630 8631 mgmt_pending_free(cmd); 8632 } 8633 8634 static int add_advertising_sync(struct hci_dev *hdev, void *data) 8635 { 8636 struct mgmt_pending_cmd *cmd = data; 8637 struct mgmt_cp_add_advertising *cp = cmd->param; 8638 8639 return hci_schedule_adv_instance_sync(hdev, cp->instance, true); 8640 } 8641 8642 static int add_advertising(struct sock *sk, struct hci_dev *hdev, 8643 void *data, u16 data_len) 8644 { 8645 struct mgmt_cp_add_advertising *cp = data; 8646 struct mgmt_rp_add_advertising rp; 8647 u32 flags; 8648 u8 status; 8649 u16 timeout, duration; 8650 unsigned int prev_instance_cnt; 8651 u8 schedule_instance = 0; 8652 struct adv_info *adv, *next_instance; 8653 int err; 8654 struct mgmt_pending_cmd *cmd; 8655 8656 bt_dev_dbg(hdev, "sock %p", sk); 8657 8658 status = mgmt_le_support(hdev); 8659 if (status) 8660 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING, 8661 status); 8662 8663 if (cp->instance < 1 || cp->instance > hdev->le_num_of_adv_sets) 8664 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING, 8665 MGMT_STATUS_INVALID_PARAMS); 8666 8667 if (data_len != sizeof(*cp) + cp->adv_data_len + cp->scan_rsp_len) 8668 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING, 8669 MGMT_STATUS_INVALID_PARAMS); 8670 8671 flags = __le32_to_cpu(cp->flags); 8672 timeout = __le16_to_cpu(cp->timeout); 8673 duration = __le16_to_cpu(cp->duration); 8674 8675 if (!requested_adv_flags_are_valid(hdev, flags)) 8676 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING, 8677 MGMT_STATUS_INVALID_PARAMS); 8678 8679 hci_dev_lock(hdev); 8680 8681 if (timeout && !hdev_is_powered(hdev)) { 8682 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING, 8683 MGMT_STATUS_REJECTED); 8684 goto unlock; 8685 } 8686 8687 if (adv_busy(hdev)) { 8688 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING, 8689 MGMT_STATUS_BUSY); 8690 goto unlock; 8691 } 8692 8693 if (!tlv_data_is_valid(hdev, flags, cp->data, cp->adv_data_len, true) || 8694 !tlv_data_is_valid(hdev, flags, cp->data + cp->adv_data_len, 8695 cp->scan_rsp_len, false)) { 8696 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING, 8697 MGMT_STATUS_INVALID_PARAMS); 8698 goto unlock; 8699 } 8700 8701 prev_instance_cnt = hdev->adv_instance_cnt; 8702 8703 adv = hci_add_adv_instance(hdev, cp->instance, flags, 8704 cp->adv_data_len, cp->data, 8705 cp->scan_rsp_len, 8706 cp->data + cp->adv_data_len, 8707 timeout, duration, 8708 HCI_ADV_TX_POWER_NO_PREFERENCE, 8709 hdev->le_adv_min_interval, 8710 hdev->le_adv_max_interval, 0); 8711 if (IS_ERR(adv)) { 8712 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING, 8713 MGMT_STATUS_FAILED); 8714 goto unlock; 8715 } 8716 8717 /* Only trigger an advertising added event if a new instance was 8718 * actually added. 8719 */ 8720 if (hdev->adv_instance_cnt > prev_instance_cnt) 8721 mgmt_advertising_added(sk, hdev, cp->instance); 8722 8723 if (hdev->cur_adv_instance == cp->instance) { 8724 /* If the currently advertised instance is being changed then 8725 * cancel the current advertising and schedule the next 8726 * instance. If there is only one instance then the overridden 8727 * advertising data will be visible right away. 8728 */ 8729 cancel_adv_timeout(hdev); 8730 8731 next_instance = hci_get_next_instance(hdev, cp->instance); 8732 if (next_instance) 8733 schedule_instance = next_instance->instance; 8734 } else if (!hdev->adv_instance_timeout) { 8735 /* Immediately advertise the new instance if no other 8736 * instance is currently being advertised. 8737 */ 8738 schedule_instance = cp->instance; 8739 } 8740 8741 /* If the HCI_ADVERTISING flag is set or the device isn't powered or 8742 * there is no instance to be advertised then we have no HCI 8743 * communication to make. Simply return. 8744 */ 8745 if (!hdev_is_powered(hdev) || 8746 hci_dev_test_flag(hdev, HCI_ADVERTISING) || 8747 !schedule_instance) { 8748 rp.instance = cp->instance; 8749 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_ADVERTISING, 8750 MGMT_STATUS_SUCCESS, &rp, sizeof(rp)); 8751 goto unlock; 8752 } 8753 8754 /* We're good to go, update advertising data, parameters, and start 8755 * advertising. 8756 */ 8757 cmd = mgmt_pending_new(sk, MGMT_OP_ADD_ADVERTISING, hdev, data, 8758 data_len); 8759 if (!cmd) { 8760 err = -ENOMEM; 8761 goto unlock; 8762 } 8763 8764 cp->instance = schedule_instance; 8765 8766 err = hci_cmd_sync_queue(hdev, add_advertising_sync, cmd, 8767 add_advertising_complete); 8768 if (err < 0) 8769 mgmt_pending_free(cmd); 8770 8771 unlock: 8772 hci_dev_unlock(hdev); 8773 8774 return err; 8775 } 8776 8777 static void add_ext_adv_params_complete(struct hci_dev *hdev, void *data, 8778 int err) 8779 { 8780 struct mgmt_pending_cmd *cmd = data; 8781 struct mgmt_cp_add_ext_adv_params *cp = cmd->param; 8782 struct mgmt_rp_add_ext_adv_params rp; 8783 struct adv_info *adv; 8784 u32 flags; 8785 8786 BT_DBG("%s", hdev->name); 8787 8788 hci_dev_lock(hdev); 8789 8790 adv = hci_find_adv_instance(hdev, cp->instance); 8791 if (!adv) 8792 goto unlock; 8793 8794 rp.instance = cp->instance; 8795 rp.tx_power = adv->tx_power; 8796 8797 /* While we're at it, inform userspace of the available space for this 8798 * advertisement, given the flags that will be used. 8799 */ 8800 flags = __le32_to_cpu(cp->flags); 8801 rp.max_adv_data_len = tlv_data_max_len(hdev, flags, true); 8802 rp.max_scan_rsp_len = tlv_data_max_len(hdev, flags, false); 8803 8804 if (err) { 8805 /* If this advertisement was previously advertising and we 8806 * failed to update it, we signal that it has been removed and 8807 * delete its structure 8808 */ 8809 if (!adv->pending) 8810 mgmt_advertising_removed(cmd->sk, hdev, cp->instance); 8811 8812 hci_remove_adv_instance(hdev, cp->instance); 8813 8814 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, 8815 mgmt_status(err)); 8816 } else { 8817 mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, 8818 mgmt_status(err), &rp, sizeof(rp)); 8819 } 8820 8821 unlock: 8822 if (cmd) 8823 mgmt_pending_free(cmd); 8824 8825 hci_dev_unlock(hdev); 8826 } 8827 8828 static int add_ext_adv_params_sync(struct hci_dev *hdev, void *data) 8829 { 8830 struct mgmt_pending_cmd *cmd = data; 8831 struct mgmt_cp_add_ext_adv_params *cp = cmd->param; 8832 8833 return hci_setup_ext_adv_instance_sync(hdev, cp->instance); 8834 } 8835 8836 static int add_ext_adv_params(struct sock *sk, struct hci_dev *hdev, 8837 void *data, u16 data_len) 8838 { 8839 struct mgmt_cp_add_ext_adv_params *cp = data; 8840 struct mgmt_rp_add_ext_adv_params rp; 8841 struct mgmt_pending_cmd *cmd = NULL; 8842 struct adv_info *adv; 8843 u32 flags, min_interval, max_interval; 8844 u16 timeout, duration; 8845 u8 status; 8846 s8 tx_power; 8847 int err; 8848 8849 BT_DBG("%s", hdev->name); 8850 8851 status = mgmt_le_support(hdev); 8852 if (status) 8853 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_PARAMS, 8854 status); 8855 8856 if (cp->instance < 1 || cp->instance > hdev->le_num_of_adv_sets) 8857 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_PARAMS, 8858 MGMT_STATUS_INVALID_PARAMS); 8859 8860 /* The purpose of breaking add_advertising into two separate MGMT calls 8861 * for params and data is to allow more parameters to be added to this 8862 * structure in the future. For this reason, we verify that we have the 8863 * bare minimum structure we know of when the interface was defined. Any 8864 * extra parameters we don't know about will be ignored in this request. 8865 */ 8866 if (data_len < MGMT_ADD_EXT_ADV_PARAMS_MIN_SIZE) 8867 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_PARAMS, 8868 MGMT_STATUS_INVALID_PARAMS); 8869 8870 flags = __le32_to_cpu(cp->flags); 8871 8872 if (!requested_adv_flags_are_valid(hdev, flags)) 8873 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_PARAMS, 8874 MGMT_STATUS_INVALID_PARAMS); 8875 8876 hci_dev_lock(hdev); 8877 8878 /* In new interface, we require that we are powered to register */ 8879 if (!hdev_is_powered(hdev)) { 8880 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_PARAMS, 8881 MGMT_STATUS_REJECTED); 8882 goto unlock; 8883 } 8884 8885 if (adv_busy(hdev)) { 8886 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_PARAMS, 8887 MGMT_STATUS_BUSY); 8888 goto unlock; 8889 } 8890 8891 /* Parse defined parameters from request, use defaults otherwise */ 8892 timeout = (flags & MGMT_ADV_PARAM_TIMEOUT) ? 8893 __le16_to_cpu(cp->timeout) : 0; 8894 8895 duration = (flags & MGMT_ADV_PARAM_DURATION) ? 8896 __le16_to_cpu(cp->duration) : 8897 hdev->def_multi_adv_rotation_duration; 8898 8899 min_interval = (flags & MGMT_ADV_PARAM_INTERVALS) ? 8900 __le32_to_cpu(cp->min_interval) : 8901 hdev->le_adv_min_interval; 8902 8903 max_interval = (flags & MGMT_ADV_PARAM_INTERVALS) ? 8904 __le32_to_cpu(cp->max_interval) : 8905 hdev->le_adv_max_interval; 8906 8907 tx_power = (flags & MGMT_ADV_PARAM_TX_POWER) ? 8908 cp->tx_power : 8909 HCI_ADV_TX_POWER_NO_PREFERENCE; 8910 8911 /* Create advertising instance with no advertising or response data */ 8912 adv = hci_add_adv_instance(hdev, cp->instance, flags, 0, NULL, 0, NULL, 8913 timeout, duration, tx_power, min_interval, 8914 max_interval, 0); 8915 8916 if (IS_ERR(adv)) { 8917 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_PARAMS, 8918 MGMT_STATUS_FAILED); 8919 goto unlock; 8920 } 8921 8922 /* Submit request for advertising params if ext adv available */ 8923 if (ext_adv_capable(hdev)) { 8924 cmd = mgmt_pending_new(sk, MGMT_OP_ADD_EXT_ADV_PARAMS, hdev, 8925 data, data_len); 8926 if (!cmd) { 8927 err = -ENOMEM; 8928 hci_remove_adv_instance(hdev, cp->instance); 8929 goto unlock; 8930 } 8931 8932 err = hci_cmd_sync_queue(hdev, add_ext_adv_params_sync, cmd, 8933 add_ext_adv_params_complete); 8934 if (err < 0) 8935 mgmt_pending_free(cmd); 8936 } else { 8937 rp.instance = cp->instance; 8938 rp.tx_power = HCI_ADV_TX_POWER_NO_PREFERENCE; 8939 rp.max_adv_data_len = tlv_data_max_len(hdev, flags, true); 8940 rp.max_scan_rsp_len = tlv_data_max_len(hdev, flags, false); 8941 err = mgmt_cmd_complete(sk, hdev->id, 8942 MGMT_OP_ADD_EXT_ADV_PARAMS, 8943 MGMT_STATUS_SUCCESS, &rp, sizeof(rp)); 8944 } 8945 8946 unlock: 8947 hci_dev_unlock(hdev); 8948 8949 return err; 8950 } 8951 8952 static void add_ext_adv_data_complete(struct hci_dev *hdev, void *data, int err) 8953 { 8954 struct mgmt_pending_cmd *cmd = data; 8955 struct mgmt_cp_add_ext_adv_data *cp = cmd->param; 8956 struct mgmt_rp_add_advertising rp; 8957 8958 add_adv_complete(hdev, cmd->sk, cp->instance, err); 8959 8960 memset(&rp, 0, sizeof(rp)); 8961 8962 rp.instance = cp->instance; 8963 8964 if (err) 8965 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, 8966 mgmt_status(err)); 8967 else 8968 mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, 8969 mgmt_status(err), &rp, sizeof(rp)); 8970 8971 mgmt_pending_free(cmd); 8972 } 8973 8974 static int add_ext_adv_data_sync(struct hci_dev *hdev, void *data) 8975 { 8976 struct mgmt_pending_cmd *cmd = data; 8977 struct mgmt_cp_add_ext_adv_data *cp = cmd->param; 8978 int err; 8979 8980 if (ext_adv_capable(hdev)) { 8981 err = hci_update_adv_data_sync(hdev, cp->instance); 8982 if (err) 8983 return err; 8984 8985 err = hci_update_scan_rsp_data_sync(hdev, cp->instance); 8986 if (err) 8987 return err; 8988 8989 return hci_enable_ext_advertising_sync(hdev, cp->instance); 8990 } 8991 8992 return hci_schedule_adv_instance_sync(hdev, cp->instance, true); 8993 } 8994 8995 static int add_ext_adv_data(struct sock *sk, struct hci_dev *hdev, void *data, 8996 u16 data_len) 8997 { 8998 struct mgmt_cp_add_ext_adv_data *cp = data; 8999 struct mgmt_rp_add_ext_adv_data rp; 9000 u8 schedule_instance = 0; 9001 struct adv_info *next_instance; 9002 struct adv_info *adv_instance; 9003 int err = 0; 9004 struct mgmt_pending_cmd *cmd; 9005 9006 BT_DBG("%s", hdev->name); 9007 9008 hci_dev_lock(hdev); 9009 9010 adv_instance = hci_find_adv_instance(hdev, cp->instance); 9011 9012 if (!adv_instance) { 9013 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_DATA, 9014 MGMT_STATUS_INVALID_PARAMS); 9015 goto unlock; 9016 } 9017 9018 /* In new interface, we require that we are powered to register */ 9019 if (!hdev_is_powered(hdev)) { 9020 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_DATA, 9021 MGMT_STATUS_REJECTED); 9022 goto clear_new_instance; 9023 } 9024 9025 if (adv_busy(hdev)) { 9026 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_DATA, 9027 MGMT_STATUS_BUSY); 9028 goto clear_new_instance; 9029 } 9030 9031 /* Validate new data */ 9032 if (!tlv_data_is_valid(hdev, adv_instance->flags, cp->data, 9033 cp->adv_data_len, true) || 9034 !tlv_data_is_valid(hdev, adv_instance->flags, cp->data + 9035 cp->adv_data_len, cp->scan_rsp_len, false)) { 9036 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_DATA, 9037 MGMT_STATUS_INVALID_PARAMS); 9038 goto clear_new_instance; 9039 } 9040 9041 /* Set the data in the advertising instance */ 9042 hci_set_adv_instance_data(hdev, cp->instance, cp->adv_data_len, 9043 cp->data, cp->scan_rsp_len, 9044 cp->data + cp->adv_data_len); 9045 9046 /* If using software rotation, determine next instance to use */ 9047 if (hdev->cur_adv_instance == cp->instance) { 9048 /* If the currently advertised instance is being changed 9049 * then cancel the current advertising and schedule the 9050 * next instance. If there is only one instance then the 9051 * overridden advertising data will be visible right 9052 * away 9053 */ 9054 cancel_adv_timeout(hdev); 9055 9056 next_instance = hci_get_next_instance(hdev, cp->instance); 9057 if (next_instance) 9058 schedule_instance = next_instance->instance; 9059 } else if (!hdev->adv_instance_timeout) { 9060 /* Immediately advertise the new instance if no other 9061 * instance is currently being advertised. 9062 */ 9063 schedule_instance = cp->instance; 9064 } 9065 9066 /* If the HCI_ADVERTISING flag is set or there is no instance to 9067 * be advertised then we have no HCI communication to make. 9068 * Simply return. 9069 */ 9070 if (hci_dev_test_flag(hdev, HCI_ADVERTISING) || !schedule_instance) { 9071 if (adv_instance->pending) { 9072 mgmt_advertising_added(sk, hdev, cp->instance); 9073 adv_instance->pending = false; 9074 } 9075 rp.instance = cp->instance; 9076 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_DATA, 9077 MGMT_STATUS_SUCCESS, &rp, sizeof(rp)); 9078 goto unlock; 9079 } 9080 9081 cmd = mgmt_pending_new(sk, MGMT_OP_ADD_EXT_ADV_DATA, hdev, data, 9082 data_len); 9083 if (!cmd) { 9084 err = -ENOMEM; 9085 goto clear_new_instance; 9086 } 9087 9088 err = hci_cmd_sync_queue(hdev, add_ext_adv_data_sync, cmd, 9089 add_ext_adv_data_complete); 9090 if (err < 0) { 9091 mgmt_pending_free(cmd); 9092 goto clear_new_instance; 9093 } 9094 9095 /* We were successful in updating data, so trigger advertising_added 9096 * event if this is an instance that wasn't previously advertising. If 9097 * a failure occurs in the requests we initiated, we will remove the 9098 * instance again in add_advertising_complete 9099 */ 9100 if (adv_instance->pending) 9101 mgmt_advertising_added(sk, hdev, cp->instance); 9102 9103 goto unlock; 9104 9105 clear_new_instance: 9106 hci_remove_adv_instance(hdev, cp->instance); 9107 9108 unlock: 9109 hci_dev_unlock(hdev); 9110 9111 return err; 9112 } 9113 9114 static void remove_advertising_complete(struct hci_dev *hdev, void *data, 9115 int err) 9116 { 9117 struct mgmt_pending_cmd *cmd = data; 9118 struct mgmt_cp_remove_advertising *cp = cmd->param; 9119 struct mgmt_rp_remove_advertising rp; 9120 9121 bt_dev_dbg(hdev, "err %d", err); 9122 9123 memset(&rp, 0, sizeof(rp)); 9124 rp.instance = cp->instance; 9125 9126 if (err) 9127 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, 9128 mgmt_status(err)); 9129 else 9130 mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, 9131 MGMT_STATUS_SUCCESS, &rp, sizeof(rp)); 9132 9133 mgmt_pending_free(cmd); 9134 } 9135 9136 static int remove_advertising_sync(struct hci_dev *hdev, void *data) 9137 { 9138 struct mgmt_pending_cmd *cmd = data; 9139 struct mgmt_cp_remove_advertising *cp = cmd->param; 9140 int err; 9141 9142 err = hci_remove_advertising_sync(hdev, cmd->sk, cp->instance, true); 9143 if (err) 9144 return err; 9145 9146 if (list_empty(&hdev->adv_instances)) 9147 err = hci_disable_advertising_sync(hdev); 9148 9149 return err; 9150 } 9151 9152 static int remove_advertising(struct sock *sk, struct hci_dev *hdev, 9153 void *data, u16 data_len) 9154 { 9155 struct mgmt_cp_remove_advertising *cp = data; 9156 struct mgmt_pending_cmd *cmd; 9157 int err; 9158 9159 bt_dev_dbg(hdev, "sock %p", sk); 9160 9161 hci_dev_lock(hdev); 9162 9163 if (cp->instance && !hci_find_adv_instance(hdev, cp->instance)) { 9164 err = mgmt_cmd_status(sk, hdev->id, 9165 MGMT_OP_REMOVE_ADVERTISING, 9166 MGMT_STATUS_INVALID_PARAMS); 9167 goto unlock; 9168 } 9169 9170 if (pending_find(MGMT_OP_SET_LE, hdev)) { 9171 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_ADVERTISING, 9172 MGMT_STATUS_BUSY); 9173 goto unlock; 9174 } 9175 9176 if (list_empty(&hdev->adv_instances)) { 9177 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_ADVERTISING, 9178 MGMT_STATUS_INVALID_PARAMS); 9179 goto unlock; 9180 } 9181 9182 cmd = mgmt_pending_new(sk, MGMT_OP_REMOVE_ADVERTISING, hdev, data, 9183 data_len); 9184 if (!cmd) { 9185 err = -ENOMEM; 9186 goto unlock; 9187 } 9188 9189 err = hci_cmd_sync_queue(hdev, remove_advertising_sync, cmd, 9190 remove_advertising_complete); 9191 if (err < 0) 9192 mgmt_pending_free(cmd); 9193 9194 unlock: 9195 hci_dev_unlock(hdev); 9196 9197 return err; 9198 } 9199 9200 static int get_adv_size_info(struct sock *sk, struct hci_dev *hdev, 9201 void *data, u16 data_len) 9202 { 9203 struct mgmt_cp_get_adv_size_info *cp = data; 9204 struct mgmt_rp_get_adv_size_info rp; 9205 u32 flags, supported_flags; 9206 9207 bt_dev_dbg(hdev, "sock %p", sk); 9208 9209 if (!lmp_le_capable(hdev)) 9210 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_ADV_SIZE_INFO, 9211 MGMT_STATUS_REJECTED); 9212 9213 if (cp->instance < 1 || cp->instance > hdev->le_num_of_adv_sets) 9214 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_ADV_SIZE_INFO, 9215 MGMT_STATUS_INVALID_PARAMS); 9216 9217 flags = __le32_to_cpu(cp->flags); 9218 9219 /* The current implementation only supports a subset of the specified 9220 * flags. 9221 */ 9222 supported_flags = get_supported_adv_flags(hdev); 9223 if (flags & ~supported_flags) 9224 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_ADV_SIZE_INFO, 9225 MGMT_STATUS_INVALID_PARAMS); 9226 9227 rp.instance = cp->instance; 9228 rp.flags = cp->flags; 9229 rp.max_adv_data_len = tlv_data_max_len(hdev, flags, true); 9230 rp.max_scan_rsp_len = tlv_data_max_len(hdev, flags, false); 9231 9232 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_ADV_SIZE_INFO, 9233 MGMT_STATUS_SUCCESS, &rp, sizeof(rp)); 9234 } 9235 9236 static const struct hci_mgmt_handler mgmt_handlers[] = { 9237 { NULL }, /* 0x0000 (no command) */ 9238 { read_version, MGMT_READ_VERSION_SIZE, 9239 HCI_MGMT_NO_HDEV | 9240 HCI_MGMT_UNTRUSTED }, 9241 { read_commands, MGMT_READ_COMMANDS_SIZE, 9242 HCI_MGMT_NO_HDEV | 9243 HCI_MGMT_UNTRUSTED }, 9244 { read_index_list, MGMT_READ_INDEX_LIST_SIZE, 9245 HCI_MGMT_NO_HDEV | 9246 HCI_MGMT_UNTRUSTED }, 9247 { read_controller_info, MGMT_READ_INFO_SIZE, 9248 HCI_MGMT_UNTRUSTED }, 9249 { set_powered, MGMT_SETTING_SIZE }, 9250 { set_discoverable, MGMT_SET_DISCOVERABLE_SIZE }, 9251 { set_connectable, MGMT_SETTING_SIZE }, 9252 { set_fast_connectable, MGMT_SETTING_SIZE }, 9253 { set_bondable, MGMT_SETTING_SIZE }, 9254 { set_link_security, MGMT_SETTING_SIZE }, 9255 { set_ssp, MGMT_SETTING_SIZE }, 9256 { set_hs, MGMT_SETTING_SIZE }, 9257 { set_le, MGMT_SETTING_SIZE }, 9258 { set_dev_class, MGMT_SET_DEV_CLASS_SIZE }, 9259 { set_local_name, MGMT_SET_LOCAL_NAME_SIZE }, 9260 { add_uuid, MGMT_ADD_UUID_SIZE }, 9261 { remove_uuid, MGMT_REMOVE_UUID_SIZE }, 9262 { load_link_keys, MGMT_LOAD_LINK_KEYS_SIZE, 9263 HCI_MGMT_VAR_LEN }, 9264 { load_long_term_keys, MGMT_LOAD_LONG_TERM_KEYS_SIZE, 9265 HCI_MGMT_VAR_LEN }, 9266 { disconnect, MGMT_DISCONNECT_SIZE }, 9267 { get_connections, MGMT_GET_CONNECTIONS_SIZE }, 9268 { pin_code_reply, MGMT_PIN_CODE_REPLY_SIZE }, 9269 { pin_code_neg_reply, MGMT_PIN_CODE_NEG_REPLY_SIZE }, 9270 { set_io_capability, MGMT_SET_IO_CAPABILITY_SIZE }, 9271 { pair_device, MGMT_PAIR_DEVICE_SIZE }, 9272 { cancel_pair_device, MGMT_CANCEL_PAIR_DEVICE_SIZE }, 9273 { unpair_device, MGMT_UNPAIR_DEVICE_SIZE }, 9274 { user_confirm_reply, MGMT_USER_CONFIRM_REPLY_SIZE }, 9275 { user_confirm_neg_reply, MGMT_USER_CONFIRM_NEG_REPLY_SIZE }, 9276 { user_passkey_reply, MGMT_USER_PASSKEY_REPLY_SIZE }, 9277 { user_passkey_neg_reply, MGMT_USER_PASSKEY_NEG_REPLY_SIZE }, 9278 { read_local_oob_data, MGMT_READ_LOCAL_OOB_DATA_SIZE }, 9279 { add_remote_oob_data, MGMT_ADD_REMOTE_OOB_DATA_SIZE, 9280 HCI_MGMT_VAR_LEN }, 9281 { remove_remote_oob_data, MGMT_REMOVE_REMOTE_OOB_DATA_SIZE }, 9282 { start_discovery, MGMT_START_DISCOVERY_SIZE }, 9283 { stop_discovery, MGMT_STOP_DISCOVERY_SIZE }, 9284 { confirm_name, MGMT_CONFIRM_NAME_SIZE }, 9285 { block_device, MGMT_BLOCK_DEVICE_SIZE }, 9286 { unblock_device, MGMT_UNBLOCK_DEVICE_SIZE }, 9287 { set_device_id, MGMT_SET_DEVICE_ID_SIZE }, 9288 { set_advertising, MGMT_SETTING_SIZE }, 9289 { set_bredr, MGMT_SETTING_SIZE }, 9290 { set_static_address, MGMT_SET_STATIC_ADDRESS_SIZE }, 9291 { set_scan_params, MGMT_SET_SCAN_PARAMS_SIZE }, 9292 { set_secure_conn, MGMT_SETTING_SIZE }, 9293 { set_debug_keys, MGMT_SETTING_SIZE }, 9294 { set_privacy, MGMT_SET_PRIVACY_SIZE }, 9295 { load_irks, MGMT_LOAD_IRKS_SIZE, 9296 HCI_MGMT_VAR_LEN }, 9297 { get_conn_info, MGMT_GET_CONN_INFO_SIZE }, 9298 { get_clock_info, MGMT_GET_CLOCK_INFO_SIZE }, 9299 { add_device, MGMT_ADD_DEVICE_SIZE }, 9300 { remove_device, MGMT_REMOVE_DEVICE_SIZE }, 9301 { load_conn_param, MGMT_LOAD_CONN_PARAM_SIZE, 9302 HCI_MGMT_VAR_LEN }, 9303 { read_unconf_index_list, MGMT_READ_UNCONF_INDEX_LIST_SIZE, 9304 HCI_MGMT_NO_HDEV | 9305 HCI_MGMT_UNTRUSTED }, 9306 { read_config_info, MGMT_READ_CONFIG_INFO_SIZE, 9307 HCI_MGMT_UNCONFIGURED | 9308 HCI_MGMT_UNTRUSTED }, 9309 { set_external_config, MGMT_SET_EXTERNAL_CONFIG_SIZE, 9310 HCI_MGMT_UNCONFIGURED }, 9311 { set_public_address, MGMT_SET_PUBLIC_ADDRESS_SIZE, 9312 HCI_MGMT_UNCONFIGURED }, 9313 { start_service_discovery, MGMT_START_SERVICE_DISCOVERY_SIZE, 9314 HCI_MGMT_VAR_LEN }, 9315 { read_local_oob_ext_data, MGMT_READ_LOCAL_OOB_EXT_DATA_SIZE }, 9316 { read_ext_index_list, MGMT_READ_EXT_INDEX_LIST_SIZE, 9317 HCI_MGMT_NO_HDEV | 9318 HCI_MGMT_UNTRUSTED }, 9319 { read_adv_features, MGMT_READ_ADV_FEATURES_SIZE }, 9320 { add_advertising, MGMT_ADD_ADVERTISING_SIZE, 9321 HCI_MGMT_VAR_LEN }, 9322 { remove_advertising, MGMT_REMOVE_ADVERTISING_SIZE }, 9323 { get_adv_size_info, MGMT_GET_ADV_SIZE_INFO_SIZE }, 9324 { start_limited_discovery, MGMT_START_DISCOVERY_SIZE }, 9325 { read_ext_controller_info,MGMT_READ_EXT_INFO_SIZE, 9326 HCI_MGMT_UNTRUSTED }, 9327 { set_appearance, MGMT_SET_APPEARANCE_SIZE }, 9328 { get_phy_configuration, MGMT_GET_PHY_CONFIGURATION_SIZE }, 9329 { set_phy_configuration, MGMT_SET_PHY_CONFIGURATION_SIZE }, 9330 { set_blocked_keys, MGMT_OP_SET_BLOCKED_KEYS_SIZE, 9331 HCI_MGMT_VAR_LEN }, 9332 { set_wideband_speech, MGMT_SETTING_SIZE }, 9333 { read_controller_cap, MGMT_READ_CONTROLLER_CAP_SIZE, 9334 HCI_MGMT_UNTRUSTED }, 9335 { read_exp_features_info, MGMT_READ_EXP_FEATURES_INFO_SIZE, 9336 HCI_MGMT_UNTRUSTED | 9337 HCI_MGMT_HDEV_OPTIONAL }, 9338 { set_exp_feature, MGMT_SET_EXP_FEATURE_SIZE, 9339 HCI_MGMT_VAR_LEN | 9340 HCI_MGMT_HDEV_OPTIONAL }, 9341 { read_def_system_config, MGMT_READ_DEF_SYSTEM_CONFIG_SIZE, 9342 HCI_MGMT_UNTRUSTED }, 9343 { set_def_system_config, MGMT_SET_DEF_SYSTEM_CONFIG_SIZE, 9344 HCI_MGMT_VAR_LEN }, 9345 { read_def_runtime_config, MGMT_READ_DEF_RUNTIME_CONFIG_SIZE, 9346 HCI_MGMT_UNTRUSTED }, 9347 { set_def_runtime_config, MGMT_SET_DEF_RUNTIME_CONFIG_SIZE, 9348 HCI_MGMT_VAR_LEN }, 9349 { get_device_flags, MGMT_GET_DEVICE_FLAGS_SIZE }, 9350 { set_device_flags, MGMT_SET_DEVICE_FLAGS_SIZE }, 9351 { read_adv_mon_features, MGMT_READ_ADV_MONITOR_FEATURES_SIZE }, 9352 { add_adv_patterns_monitor,MGMT_ADD_ADV_PATTERNS_MONITOR_SIZE, 9353 HCI_MGMT_VAR_LEN }, 9354 { remove_adv_monitor, MGMT_REMOVE_ADV_MONITOR_SIZE }, 9355 { add_ext_adv_params, MGMT_ADD_EXT_ADV_PARAMS_MIN_SIZE, 9356 HCI_MGMT_VAR_LEN }, 9357 { add_ext_adv_data, MGMT_ADD_EXT_ADV_DATA_SIZE, 9358 HCI_MGMT_VAR_LEN }, 9359 { add_adv_patterns_monitor_rssi, 9360 MGMT_ADD_ADV_PATTERNS_MONITOR_RSSI_SIZE, 9361 HCI_MGMT_VAR_LEN }, 9362 { set_mesh, MGMT_SET_MESH_RECEIVER_SIZE, 9363 HCI_MGMT_VAR_LEN }, 9364 { mesh_features, MGMT_MESH_READ_FEATURES_SIZE }, 9365 { mesh_send, MGMT_MESH_SEND_SIZE, 9366 HCI_MGMT_VAR_LEN }, 9367 { mesh_send_cancel, MGMT_MESH_SEND_CANCEL_SIZE }, 9368 }; 9369 9370 void mgmt_index_added(struct hci_dev *hdev) 9371 { 9372 struct mgmt_ev_ext_index ev; 9373 9374 if (test_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks)) 9375 return; 9376 9377 switch (hdev->dev_type) { 9378 case HCI_PRIMARY: 9379 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) { 9380 mgmt_index_event(MGMT_EV_UNCONF_INDEX_ADDED, hdev, 9381 NULL, 0, HCI_MGMT_UNCONF_INDEX_EVENTS); 9382 ev.type = 0x01; 9383 } else { 9384 mgmt_index_event(MGMT_EV_INDEX_ADDED, hdev, NULL, 0, 9385 HCI_MGMT_INDEX_EVENTS); 9386 ev.type = 0x00; 9387 } 9388 break; 9389 case HCI_AMP: 9390 ev.type = 0x02; 9391 break; 9392 default: 9393 return; 9394 } 9395 9396 ev.bus = hdev->bus; 9397 9398 mgmt_index_event(MGMT_EV_EXT_INDEX_ADDED, hdev, &ev, sizeof(ev), 9399 HCI_MGMT_EXT_INDEX_EVENTS); 9400 } 9401 9402 void mgmt_index_removed(struct hci_dev *hdev) 9403 { 9404 struct mgmt_ev_ext_index ev; 9405 u8 status = MGMT_STATUS_INVALID_INDEX; 9406 9407 if (test_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks)) 9408 return; 9409 9410 switch (hdev->dev_type) { 9411 case HCI_PRIMARY: 9412 mgmt_pending_foreach(0, hdev, cmd_complete_rsp, &status); 9413 9414 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) { 9415 mgmt_index_event(MGMT_EV_UNCONF_INDEX_REMOVED, hdev, 9416 NULL, 0, HCI_MGMT_UNCONF_INDEX_EVENTS); 9417 ev.type = 0x01; 9418 } else { 9419 mgmt_index_event(MGMT_EV_INDEX_REMOVED, hdev, NULL, 0, 9420 HCI_MGMT_INDEX_EVENTS); 9421 ev.type = 0x00; 9422 } 9423 break; 9424 case HCI_AMP: 9425 ev.type = 0x02; 9426 break; 9427 default: 9428 return; 9429 } 9430 9431 ev.bus = hdev->bus; 9432 9433 mgmt_index_event(MGMT_EV_EXT_INDEX_REMOVED, hdev, &ev, sizeof(ev), 9434 HCI_MGMT_EXT_INDEX_EVENTS); 9435 9436 /* Cancel any remaining timed work */ 9437 if (!hci_dev_test_flag(hdev, HCI_MGMT)) 9438 return; 9439 cancel_delayed_work_sync(&hdev->discov_off); 9440 cancel_delayed_work_sync(&hdev->service_cache); 9441 cancel_delayed_work_sync(&hdev->rpa_expired); 9442 } 9443 9444 void mgmt_power_on(struct hci_dev *hdev, int err) 9445 { 9446 struct cmd_lookup match = { NULL, hdev }; 9447 9448 bt_dev_dbg(hdev, "err %d", err); 9449 9450 hci_dev_lock(hdev); 9451 9452 if (!err) { 9453 restart_le_actions(hdev); 9454 hci_update_passive_scan(hdev); 9455 } 9456 9457 mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp, &match); 9458 9459 new_settings(hdev, match.sk); 9460 9461 if (match.sk) 9462 sock_put(match.sk); 9463 9464 hci_dev_unlock(hdev); 9465 } 9466 9467 void __mgmt_power_off(struct hci_dev *hdev) 9468 { 9469 struct cmd_lookup match = { NULL, hdev }; 9470 u8 status, zero_cod[] = { 0, 0, 0 }; 9471 9472 mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp, &match); 9473 9474 /* If the power off is because of hdev unregistration let 9475 * use the appropriate INVALID_INDEX status. Otherwise use 9476 * NOT_POWERED. We cover both scenarios here since later in 9477 * mgmt_index_removed() any hci_conn callbacks will have already 9478 * been triggered, potentially causing misleading DISCONNECTED 9479 * status responses. 9480 */ 9481 if (hci_dev_test_flag(hdev, HCI_UNREGISTER)) 9482 status = MGMT_STATUS_INVALID_INDEX; 9483 else 9484 status = MGMT_STATUS_NOT_POWERED; 9485 9486 mgmt_pending_foreach(0, hdev, cmd_complete_rsp, &status); 9487 9488 if (memcmp(hdev->dev_class, zero_cod, sizeof(zero_cod)) != 0) { 9489 mgmt_limited_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev, 9490 zero_cod, sizeof(zero_cod), 9491 HCI_MGMT_DEV_CLASS_EVENTS, NULL); 9492 ext_info_changed(hdev, NULL); 9493 } 9494 9495 new_settings(hdev, match.sk); 9496 9497 if (match.sk) 9498 sock_put(match.sk); 9499 } 9500 9501 void mgmt_set_powered_failed(struct hci_dev *hdev, int err) 9502 { 9503 struct mgmt_pending_cmd *cmd; 9504 u8 status; 9505 9506 cmd = pending_find(MGMT_OP_SET_POWERED, hdev); 9507 if (!cmd) 9508 return; 9509 9510 if (err == -ERFKILL) 9511 status = MGMT_STATUS_RFKILLED; 9512 else 9513 status = MGMT_STATUS_FAILED; 9514 9515 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_POWERED, status); 9516 9517 mgmt_pending_remove(cmd); 9518 } 9519 9520 void mgmt_new_link_key(struct hci_dev *hdev, struct link_key *key, 9521 bool persistent) 9522 { 9523 struct mgmt_ev_new_link_key ev; 9524 9525 memset(&ev, 0, sizeof(ev)); 9526 9527 ev.store_hint = persistent; 9528 bacpy(&ev.key.addr.bdaddr, &key->bdaddr); 9529 ev.key.addr.type = BDADDR_BREDR; 9530 ev.key.type = key->type; 9531 memcpy(ev.key.val, key->val, HCI_LINK_KEY_SIZE); 9532 ev.key.pin_len = key->pin_len; 9533 9534 mgmt_event(MGMT_EV_NEW_LINK_KEY, hdev, &ev, sizeof(ev), NULL); 9535 } 9536 9537 static u8 mgmt_ltk_type(struct smp_ltk *ltk) 9538 { 9539 switch (ltk->type) { 9540 case SMP_LTK: 9541 case SMP_LTK_RESPONDER: 9542 if (ltk->authenticated) 9543 return MGMT_LTK_AUTHENTICATED; 9544 return MGMT_LTK_UNAUTHENTICATED; 9545 case SMP_LTK_P256: 9546 if (ltk->authenticated) 9547 return MGMT_LTK_P256_AUTH; 9548 return MGMT_LTK_P256_UNAUTH; 9549 case SMP_LTK_P256_DEBUG: 9550 return MGMT_LTK_P256_DEBUG; 9551 } 9552 9553 return MGMT_LTK_UNAUTHENTICATED; 9554 } 9555 9556 void mgmt_new_ltk(struct hci_dev *hdev, struct smp_ltk *key, bool persistent) 9557 { 9558 struct mgmt_ev_new_long_term_key ev; 9559 9560 memset(&ev, 0, sizeof(ev)); 9561 9562 /* Devices using resolvable or non-resolvable random addresses 9563 * without providing an identity resolving key don't require 9564 * to store long term keys. Their addresses will change the 9565 * next time around. 9566 * 9567 * Only when a remote device provides an identity address 9568 * make sure the long term key is stored. If the remote 9569 * identity is known, the long term keys are internally 9570 * mapped to the identity address. So allow static random 9571 * and public addresses here. 9572 */ 9573 if (key->bdaddr_type == ADDR_LE_DEV_RANDOM && 9574 (key->bdaddr.b[5] & 0xc0) != 0xc0) 9575 ev.store_hint = 0x00; 9576 else 9577 ev.store_hint = persistent; 9578 9579 bacpy(&ev.key.addr.bdaddr, &key->bdaddr); 9580 ev.key.addr.type = link_to_bdaddr(LE_LINK, key->bdaddr_type); 9581 ev.key.type = mgmt_ltk_type(key); 9582 ev.key.enc_size = key->enc_size; 9583 ev.key.ediv = key->ediv; 9584 ev.key.rand = key->rand; 9585 9586 if (key->type == SMP_LTK) 9587 ev.key.initiator = 1; 9588 9589 /* Make sure we copy only the significant bytes based on the 9590 * encryption key size, and set the rest of the value to zeroes. 9591 */ 9592 memcpy(ev.key.val, key->val, key->enc_size); 9593 memset(ev.key.val + key->enc_size, 0, 9594 sizeof(ev.key.val) - key->enc_size); 9595 9596 mgmt_event(MGMT_EV_NEW_LONG_TERM_KEY, hdev, &ev, sizeof(ev), NULL); 9597 } 9598 9599 void mgmt_new_irk(struct hci_dev *hdev, struct smp_irk *irk, bool persistent) 9600 { 9601 struct mgmt_ev_new_irk ev; 9602 9603 memset(&ev, 0, sizeof(ev)); 9604 9605 ev.store_hint = persistent; 9606 9607 bacpy(&ev.rpa, &irk->rpa); 9608 bacpy(&ev.irk.addr.bdaddr, &irk->bdaddr); 9609 ev.irk.addr.type = link_to_bdaddr(LE_LINK, irk->addr_type); 9610 memcpy(ev.irk.val, irk->val, sizeof(irk->val)); 9611 9612 mgmt_event(MGMT_EV_NEW_IRK, hdev, &ev, sizeof(ev), NULL); 9613 } 9614 9615 void mgmt_new_csrk(struct hci_dev *hdev, struct smp_csrk *csrk, 9616 bool persistent) 9617 { 9618 struct mgmt_ev_new_csrk ev; 9619 9620 memset(&ev, 0, sizeof(ev)); 9621 9622 /* Devices using resolvable or non-resolvable random addresses 9623 * without providing an identity resolving key don't require 9624 * to store signature resolving keys. Their addresses will change 9625 * the next time around. 9626 * 9627 * Only when a remote device provides an identity address 9628 * make sure the signature resolving key is stored. So allow 9629 * static random and public addresses here. 9630 */ 9631 if (csrk->bdaddr_type == ADDR_LE_DEV_RANDOM && 9632 (csrk->bdaddr.b[5] & 0xc0) != 0xc0) 9633 ev.store_hint = 0x00; 9634 else 9635 ev.store_hint = persistent; 9636 9637 bacpy(&ev.key.addr.bdaddr, &csrk->bdaddr); 9638 ev.key.addr.type = link_to_bdaddr(LE_LINK, csrk->bdaddr_type); 9639 ev.key.type = csrk->type; 9640 memcpy(ev.key.val, csrk->val, sizeof(csrk->val)); 9641 9642 mgmt_event(MGMT_EV_NEW_CSRK, hdev, &ev, sizeof(ev), NULL); 9643 } 9644 9645 void mgmt_new_conn_param(struct hci_dev *hdev, bdaddr_t *bdaddr, 9646 u8 bdaddr_type, u8 store_hint, u16 min_interval, 9647 u16 max_interval, u16 latency, u16 timeout) 9648 { 9649 struct mgmt_ev_new_conn_param ev; 9650 9651 if (!hci_is_identity_address(bdaddr, bdaddr_type)) 9652 return; 9653 9654 memset(&ev, 0, sizeof(ev)); 9655 bacpy(&ev.addr.bdaddr, bdaddr); 9656 ev.addr.type = link_to_bdaddr(LE_LINK, bdaddr_type); 9657 ev.store_hint = store_hint; 9658 ev.min_interval = cpu_to_le16(min_interval); 9659 ev.max_interval = cpu_to_le16(max_interval); 9660 ev.latency = cpu_to_le16(latency); 9661 ev.timeout = cpu_to_le16(timeout); 9662 9663 mgmt_event(MGMT_EV_NEW_CONN_PARAM, hdev, &ev, sizeof(ev), NULL); 9664 } 9665 9666 void mgmt_device_connected(struct hci_dev *hdev, struct hci_conn *conn, 9667 u8 *name, u8 name_len) 9668 { 9669 struct sk_buff *skb; 9670 struct mgmt_ev_device_connected *ev; 9671 u16 eir_len = 0; 9672 u32 flags = 0; 9673 9674 /* allocate buff for LE or BR/EDR adv */ 9675 if (conn->le_adv_data_len > 0) 9676 skb = mgmt_alloc_skb(hdev, MGMT_EV_DEVICE_CONNECTED, 9677 sizeof(*ev) + conn->le_adv_data_len); 9678 else 9679 skb = mgmt_alloc_skb(hdev, MGMT_EV_DEVICE_CONNECTED, 9680 sizeof(*ev) + (name ? eir_precalc_len(name_len) : 0) + 9681 eir_precalc_len(sizeof(conn->dev_class))); 9682 9683 ev = skb_put(skb, sizeof(*ev)); 9684 bacpy(&ev->addr.bdaddr, &conn->dst); 9685 ev->addr.type = link_to_bdaddr(conn->type, conn->dst_type); 9686 9687 if (conn->out) 9688 flags |= MGMT_DEV_FOUND_INITIATED_CONN; 9689 9690 ev->flags = __cpu_to_le32(flags); 9691 9692 /* We must ensure that the EIR Data fields are ordered and 9693 * unique. Keep it simple for now and avoid the problem by not 9694 * adding any BR/EDR data to the LE adv. 9695 */ 9696 if (conn->le_adv_data_len > 0) { 9697 skb_put_data(skb, conn->le_adv_data, conn->le_adv_data_len); 9698 eir_len = conn->le_adv_data_len; 9699 } else { 9700 if (name) 9701 eir_len += eir_skb_put_data(skb, EIR_NAME_COMPLETE, name, name_len); 9702 9703 if (memcmp(conn->dev_class, "\0\0\0", sizeof(conn->dev_class))) 9704 eir_len += eir_skb_put_data(skb, EIR_CLASS_OF_DEV, 9705 conn->dev_class, sizeof(conn->dev_class)); 9706 } 9707 9708 ev->eir_len = cpu_to_le16(eir_len); 9709 9710 mgmt_event_skb(skb, NULL); 9711 } 9712 9713 static void disconnect_rsp(struct mgmt_pending_cmd *cmd, void *data) 9714 { 9715 struct sock **sk = data; 9716 9717 cmd->cmd_complete(cmd, 0); 9718 9719 *sk = cmd->sk; 9720 sock_hold(*sk); 9721 9722 mgmt_pending_remove(cmd); 9723 } 9724 9725 static void unpair_device_rsp(struct mgmt_pending_cmd *cmd, void *data) 9726 { 9727 struct hci_dev *hdev = data; 9728 struct mgmt_cp_unpair_device *cp = cmd->param; 9729 9730 device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, cmd->sk); 9731 9732 cmd->cmd_complete(cmd, 0); 9733 mgmt_pending_remove(cmd); 9734 } 9735 9736 bool mgmt_powering_down(struct hci_dev *hdev) 9737 { 9738 struct mgmt_pending_cmd *cmd; 9739 struct mgmt_mode *cp; 9740 9741 cmd = pending_find(MGMT_OP_SET_POWERED, hdev); 9742 if (!cmd) 9743 return false; 9744 9745 cp = cmd->param; 9746 if (!cp->val) 9747 return true; 9748 9749 return false; 9750 } 9751 9752 void mgmt_device_disconnected(struct hci_dev *hdev, bdaddr_t *bdaddr, 9753 u8 link_type, u8 addr_type, u8 reason, 9754 bool mgmt_connected) 9755 { 9756 struct mgmt_ev_device_disconnected ev; 9757 struct sock *sk = NULL; 9758 9759 /* The connection is still in hci_conn_hash so test for 1 9760 * instead of 0 to know if this is the last one. 9761 */ 9762 if (mgmt_powering_down(hdev) && hci_conn_count(hdev) == 1) { 9763 cancel_delayed_work(&hdev->power_off); 9764 queue_work(hdev->req_workqueue, &hdev->power_off.work); 9765 } 9766 9767 if (!mgmt_connected) 9768 return; 9769 9770 if (link_type != ACL_LINK && link_type != LE_LINK) 9771 return; 9772 9773 mgmt_pending_foreach(MGMT_OP_DISCONNECT, hdev, disconnect_rsp, &sk); 9774 9775 bacpy(&ev.addr.bdaddr, bdaddr); 9776 ev.addr.type = link_to_bdaddr(link_type, addr_type); 9777 ev.reason = reason; 9778 9779 /* Report disconnects due to suspend */ 9780 if (hdev->suspended) 9781 ev.reason = MGMT_DEV_DISCONN_LOCAL_HOST_SUSPEND; 9782 9783 mgmt_event(MGMT_EV_DEVICE_DISCONNECTED, hdev, &ev, sizeof(ev), sk); 9784 9785 if (sk) 9786 sock_put(sk); 9787 9788 mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, unpair_device_rsp, 9789 hdev); 9790 } 9791 9792 void mgmt_disconnect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr, 9793 u8 link_type, u8 addr_type, u8 status) 9794 { 9795 u8 bdaddr_type = link_to_bdaddr(link_type, addr_type); 9796 struct mgmt_cp_disconnect *cp; 9797 struct mgmt_pending_cmd *cmd; 9798 9799 mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, unpair_device_rsp, 9800 hdev); 9801 9802 cmd = pending_find(MGMT_OP_DISCONNECT, hdev); 9803 if (!cmd) 9804 return; 9805 9806 cp = cmd->param; 9807 9808 if (bacmp(bdaddr, &cp->addr.bdaddr)) 9809 return; 9810 9811 if (cp->addr.type != bdaddr_type) 9812 return; 9813 9814 cmd->cmd_complete(cmd, mgmt_status(status)); 9815 mgmt_pending_remove(cmd); 9816 } 9817 9818 void mgmt_connect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type, 9819 u8 addr_type, u8 status) 9820 { 9821 struct mgmt_ev_connect_failed ev; 9822 9823 /* The connection is still in hci_conn_hash so test for 1 9824 * instead of 0 to know if this is the last one. 9825 */ 9826 if (mgmt_powering_down(hdev) && hci_conn_count(hdev) == 1) { 9827 cancel_delayed_work(&hdev->power_off); 9828 queue_work(hdev->req_workqueue, &hdev->power_off.work); 9829 } 9830 9831 bacpy(&ev.addr.bdaddr, bdaddr); 9832 ev.addr.type = link_to_bdaddr(link_type, addr_type); 9833 ev.status = mgmt_status(status); 9834 9835 mgmt_event(MGMT_EV_CONNECT_FAILED, hdev, &ev, sizeof(ev), NULL); 9836 } 9837 9838 void mgmt_pin_code_request(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 secure) 9839 { 9840 struct mgmt_ev_pin_code_request ev; 9841 9842 bacpy(&ev.addr.bdaddr, bdaddr); 9843 ev.addr.type = BDADDR_BREDR; 9844 ev.secure = secure; 9845 9846 mgmt_event(MGMT_EV_PIN_CODE_REQUEST, hdev, &ev, sizeof(ev), NULL); 9847 } 9848 9849 void mgmt_pin_code_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr, 9850 u8 status) 9851 { 9852 struct mgmt_pending_cmd *cmd; 9853 9854 cmd = pending_find(MGMT_OP_PIN_CODE_REPLY, hdev); 9855 if (!cmd) 9856 return; 9857 9858 cmd->cmd_complete(cmd, mgmt_status(status)); 9859 mgmt_pending_remove(cmd); 9860 } 9861 9862 void mgmt_pin_code_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr, 9863 u8 status) 9864 { 9865 struct mgmt_pending_cmd *cmd; 9866 9867 cmd = pending_find(MGMT_OP_PIN_CODE_NEG_REPLY, hdev); 9868 if (!cmd) 9869 return; 9870 9871 cmd->cmd_complete(cmd, mgmt_status(status)); 9872 mgmt_pending_remove(cmd); 9873 } 9874 9875 int mgmt_user_confirm_request(struct hci_dev *hdev, bdaddr_t *bdaddr, 9876 u8 link_type, u8 addr_type, u32 value, 9877 u8 confirm_hint) 9878 { 9879 struct mgmt_ev_user_confirm_request ev; 9880 9881 bt_dev_dbg(hdev, "bdaddr %pMR", bdaddr); 9882 9883 bacpy(&ev.addr.bdaddr, bdaddr); 9884 ev.addr.type = link_to_bdaddr(link_type, addr_type); 9885 ev.confirm_hint = confirm_hint; 9886 ev.value = cpu_to_le32(value); 9887 9888 return mgmt_event(MGMT_EV_USER_CONFIRM_REQUEST, hdev, &ev, sizeof(ev), 9889 NULL); 9890 } 9891 9892 int mgmt_user_passkey_request(struct hci_dev *hdev, bdaddr_t *bdaddr, 9893 u8 link_type, u8 addr_type) 9894 { 9895 struct mgmt_ev_user_passkey_request ev; 9896 9897 bt_dev_dbg(hdev, "bdaddr %pMR", bdaddr); 9898 9899 bacpy(&ev.addr.bdaddr, bdaddr); 9900 ev.addr.type = link_to_bdaddr(link_type, addr_type); 9901 9902 return mgmt_event(MGMT_EV_USER_PASSKEY_REQUEST, hdev, &ev, sizeof(ev), 9903 NULL); 9904 } 9905 9906 static int user_pairing_resp_complete(struct hci_dev *hdev, bdaddr_t *bdaddr, 9907 u8 link_type, u8 addr_type, u8 status, 9908 u8 opcode) 9909 { 9910 struct mgmt_pending_cmd *cmd; 9911 9912 cmd = pending_find(opcode, hdev); 9913 if (!cmd) 9914 return -ENOENT; 9915 9916 cmd->cmd_complete(cmd, mgmt_status(status)); 9917 mgmt_pending_remove(cmd); 9918 9919 return 0; 9920 } 9921 9922 int mgmt_user_confirm_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr, 9923 u8 link_type, u8 addr_type, u8 status) 9924 { 9925 return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type, 9926 status, MGMT_OP_USER_CONFIRM_REPLY); 9927 } 9928 9929 int mgmt_user_confirm_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr, 9930 u8 link_type, u8 addr_type, u8 status) 9931 { 9932 return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type, 9933 status, 9934 MGMT_OP_USER_CONFIRM_NEG_REPLY); 9935 } 9936 9937 int mgmt_user_passkey_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr, 9938 u8 link_type, u8 addr_type, u8 status) 9939 { 9940 return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type, 9941 status, MGMT_OP_USER_PASSKEY_REPLY); 9942 } 9943 9944 int mgmt_user_passkey_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr, 9945 u8 link_type, u8 addr_type, u8 status) 9946 { 9947 return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type, 9948 status, 9949 MGMT_OP_USER_PASSKEY_NEG_REPLY); 9950 } 9951 9952 int mgmt_user_passkey_notify(struct hci_dev *hdev, bdaddr_t *bdaddr, 9953 u8 link_type, u8 addr_type, u32 passkey, 9954 u8 entered) 9955 { 9956 struct mgmt_ev_passkey_notify ev; 9957 9958 bt_dev_dbg(hdev, "bdaddr %pMR", bdaddr); 9959 9960 bacpy(&ev.addr.bdaddr, bdaddr); 9961 ev.addr.type = link_to_bdaddr(link_type, addr_type); 9962 ev.passkey = __cpu_to_le32(passkey); 9963 ev.entered = entered; 9964 9965 return mgmt_event(MGMT_EV_PASSKEY_NOTIFY, hdev, &ev, sizeof(ev), NULL); 9966 } 9967 9968 void mgmt_auth_failed(struct hci_conn *conn, u8 hci_status) 9969 { 9970 struct mgmt_ev_auth_failed ev; 9971 struct mgmt_pending_cmd *cmd; 9972 u8 status = mgmt_status(hci_status); 9973 9974 bacpy(&ev.addr.bdaddr, &conn->dst); 9975 ev.addr.type = link_to_bdaddr(conn->type, conn->dst_type); 9976 ev.status = status; 9977 9978 cmd = find_pairing(conn); 9979 9980 mgmt_event(MGMT_EV_AUTH_FAILED, conn->hdev, &ev, sizeof(ev), 9981 cmd ? cmd->sk : NULL); 9982 9983 if (cmd) { 9984 cmd->cmd_complete(cmd, status); 9985 mgmt_pending_remove(cmd); 9986 } 9987 } 9988 9989 void mgmt_auth_enable_complete(struct hci_dev *hdev, u8 status) 9990 { 9991 struct cmd_lookup match = { NULL, hdev }; 9992 bool changed; 9993 9994 if (status) { 9995 u8 mgmt_err = mgmt_status(status); 9996 mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev, 9997 cmd_status_rsp, &mgmt_err); 9998 return; 9999 } 10000 10001 if (test_bit(HCI_AUTH, &hdev->flags)) 10002 changed = !hci_dev_test_and_set_flag(hdev, HCI_LINK_SECURITY); 10003 else 10004 changed = hci_dev_test_and_clear_flag(hdev, HCI_LINK_SECURITY); 10005 10006 mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev, settings_rsp, 10007 &match); 10008 10009 if (changed) 10010 new_settings(hdev, match.sk); 10011 10012 if (match.sk) 10013 sock_put(match.sk); 10014 } 10015 10016 static void sk_lookup(struct mgmt_pending_cmd *cmd, void *data) 10017 { 10018 struct cmd_lookup *match = data; 10019 10020 if (match->sk == NULL) { 10021 match->sk = cmd->sk; 10022 sock_hold(match->sk); 10023 } 10024 } 10025 10026 void mgmt_set_class_of_dev_complete(struct hci_dev *hdev, u8 *dev_class, 10027 u8 status) 10028 { 10029 struct cmd_lookup match = { NULL, hdev, mgmt_status(status) }; 10030 10031 mgmt_pending_foreach(MGMT_OP_SET_DEV_CLASS, hdev, sk_lookup, &match); 10032 mgmt_pending_foreach(MGMT_OP_ADD_UUID, hdev, sk_lookup, &match); 10033 mgmt_pending_foreach(MGMT_OP_REMOVE_UUID, hdev, sk_lookup, &match); 10034 10035 if (!status) { 10036 mgmt_limited_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev, dev_class, 10037 3, HCI_MGMT_DEV_CLASS_EVENTS, NULL); 10038 ext_info_changed(hdev, NULL); 10039 } 10040 10041 if (match.sk) 10042 sock_put(match.sk); 10043 } 10044 10045 void mgmt_set_local_name_complete(struct hci_dev *hdev, u8 *name, u8 status) 10046 { 10047 struct mgmt_cp_set_local_name ev; 10048 struct mgmt_pending_cmd *cmd; 10049 10050 if (status) 10051 return; 10052 10053 memset(&ev, 0, sizeof(ev)); 10054 memcpy(ev.name, name, HCI_MAX_NAME_LENGTH); 10055 memcpy(ev.short_name, hdev->short_name, HCI_MAX_SHORT_NAME_LENGTH); 10056 10057 cmd = pending_find(MGMT_OP_SET_LOCAL_NAME, hdev); 10058 if (!cmd) { 10059 memcpy(hdev->dev_name, name, sizeof(hdev->dev_name)); 10060 10061 /* If this is a HCI command related to powering on the 10062 * HCI dev don't send any mgmt signals. 10063 */ 10064 if (pending_find(MGMT_OP_SET_POWERED, hdev)) 10065 return; 10066 } 10067 10068 mgmt_limited_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, &ev, sizeof(ev), 10069 HCI_MGMT_LOCAL_NAME_EVENTS, cmd ? cmd->sk : NULL); 10070 ext_info_changed(hdev, cmd ? cmd->sk : NULL); 10071 } 10072 10073 static inline bool has_uuid(u8 *uuid, u16 uuid_count, u8 (*uuids)[16]) 10074 { 10075 int i; 10076 10077 for (i = 0; i < uuid_count; i++) { 10078 if (!memcmp(uuid, uuids[i], 16)) 10079 return true; 10080 } 10081 10082 return false; 10083 } 10084 10085 static bool eir_has_uuids(u8 *eir, u16 eir_len, u16 uuid_count, u8 (*uuids)[16]) 10086 { 10087 u16 parsed = 0; 10088 10089 while (parsed < eir_len) { 10090 u8 field_len = eir[0]; 10091 u8 uuid[16]; 10092 int i; 10093 10094 if (field_len == 0) 10095 break; 10096 10097 if (eir_len - parsed < field_len + 1) 10098 break; 10099 10100 switch (eir[1]) { 10101 case EIR_UUID16_ALL: 10102 case EIR_UUID16_SOME: 10103 for (i = 0; i + 3 <= field_len; i += 2) { 10104 memcpy(uuid, bluetooth_base_uuid, 16); 10105 uuid[13] = eir[i + 3]; 10106 uuid[12] = eir[i + 2]; 10107 if (has_uuid(uuid, uuid_count, uuids)) 10108 return true; 10109 } 10110 break; 10111 case EIR_UUID32_ALL: 10112 case EIR_UUID32_SOME: 10113 for (i = 0; i + 5 <= field_len; i += 4) { 10114 memcpy(uuid, bluetooth_base_uuid, 16); 10115 uuid[15] = eir[i + 5]; 10116 uuid[14] = eir[i + 4]; 10117 uuid[13] = eir[i + 3]; 10118 uuid[12] = eir[i + 2]; 10119 if (has_uuid(uuid, uuid_count, uuids)) 10120 return true; 10121 } 10122 break; 10123 case EIR_UUID128_ALL: 10124 case EIR_UUID128_SOME: 10125 for (i = 0; i + 17 <= field_len; i += 16) { 10126 memcpy(uuid, eir + i + 2, 16); 10127 if (has_uuid(uuid, uuid_count, uuids)) 10128 return true; 10129 } 10130 break; 10131 } 10132 10133 parsed += field_len + 1; 10134 eir += field_len + 1; 10135 } 10136 10137 return false; 10138 } 10139 10140 static void restart_le_scan(struct hci_dev *hdev) 10141 { 10142 /* If controller is not scanning we are done. */ 10143 if (!hci_dev_test_flag(hdev, HCI_LE_SCAN)) 10144 return; 10145 10146 if (time_after(jiffies + DISCOV_LE_RESTART_DELAY, 10147 hdev->discovery.scan_start + 10148 hdev->discovery.scan_duration)) 10149 return; 10150 10151 queue_delayed_work(hdev->req_workqueue, &hdev->le_scan_restart, 10152 DISCOV_LE_RESTART_DELAY); 10153 } 10154 10155 static bool is_filter_match(struct hci_dev *hdev, s8 rssi, u8 *eir, 10156 u16 eir_len, u8 *scan_rsp, u8 scan_rsp_len) 10157 { 10158 /* If a RSSI threshold has been specified, and 10159 * HCI_QUIRK_STRICT_DUPLICATE_FILTER is not set, then all results with 10160 * a RSSI smaller than the RSSI threshold will be dropped. If the quirk 10161 * is set, let it through for further processing, as we might need to 10162 * restart the scan. 10163 * 10164 * For BR/EDR devices (pre 1.2) providing no RSSI during inquiry, 10165 * the results are also dropped. 10166 */ 10167 if (hdev->discovery.rssi != HCI_RSSI_INVALID && 10168 (rssi == HCI_RSSI_INVALID || 10169 (rssi < hdev->discovery.rssi && 10170 !test_bit(HCI_QUIRK_STRICT_DUPLICATE_FILTER, &hdev->quirks)))) 10171 return false; 10172 10173 if (hdev->discovery.uuid_count != 0) { 10174 /* If a list of UUIDs is provided in filter, results with no 10175 * matching UUID should be dropped. 10176 */ 10177 if (!eir_has_uuids(eir, eir_len, hdev->discovery.uuid_count, 10178 hdev->discovery.uuids) && 10179 !eir_has_uuids(scan_rsp, scan_rsp_len, 10180 hdev->discovery.uuid_count, 10181 hdev->discovery.uuids)) 10182 return false; 10183 } 10184 10185 /* If duplicate filtering does not report RSSI changes, then restart 10186 * scanning to ensure updated result with updated RSSI values. 10187 */ 10188 if (test_bit(HCI_QUIRK_STRICT_DUPLICATE_FILTER, &hdev->quirks)) { 10189 restart_le_scan(hdev); 10190 10191 /* Validate RSSI value against the RSSI threshold once more. */ 10192 if (hdev->discovery.rssi != HCI_RSSI_INVALID && 10193 rssi < hdev->discovery.rssi) 10194 return false; 10195 } 10196 10197 return true; 10198 } 10199 10200 void mgmt_adv_monitor_device_lost(struct hci_dev *hdev, u16 handle, 10201 bdaddr_t *bdaddr, u8 addr_type) 10202 { 10203 struct mgmt_ev_adv_monitor_device_lost ev; 10204 10205 ev.monitor_handle = cpu_to_le16(handle); 10206 bacpy(&ev.addr.bdaddr, bdaddr); 10207 ev.addr.type = addr_type; 10208 10209 mgmt_event(MGMT_EV_ADV_MONITOR_DEVICE_LOST, hdev, &ev, sizeof(ev), 10210 NULL); 10211 } 10212 10213 static void mgmt_send_adv_monitor_device_found(struct hci_dev *hdev, 10214 struct sk_buff *skb, 10215 struct sock *skip_sk, 10216 u16 handle) 10217 { 10218 struct sk_buff *advmon_skb; 10219 size_t advmon_skb_len; 10220 __le16 *monitor_handle; 10221 10222 if (!skb) 10223 return; 10224 10225 advmon_skb_len = (sizeof(struct mgmt_ev_adv_monitor_device_found) - 10226 sizeof(struct mgmt_ev_device_found)) + skb->len; 10227 advmon_skb = mgmt_alloc_skb(hdev, MGMT_EV_ADV_MONITOR_DEVICE_FOUND, 10228 advmon_skb_len); 10229 if (!advmon_skb) 10230 return; 10231 10232 /* ADV_MONITOR_DEVICE_FOUND is similar to DEVICE_FOUND event except 10233 * that it also has 'monitor_handle'. Make a copy of DEVICE_FOUND and 10234 * store monitor_handle of the matched monitor. 10235 */ 10236 monitor_handle = skb_put(advmon_skb, sizeof(*monitor_handle)); 10237 *monitor_handle = cpu_to_le16(handle); 10238 skb_put_data(advmon_skb, skb->data, skb->len); 10239 10240 mgmt_event_skb(advmon_skb, skip_sk); 10241 } 10242 10243 static void mgmt_adv_monitor_device_found(struct hci_dev *hdev, 10244 bdaddr_t *bdaddr, bool report_device, 10245 struct sk_buff *skb, 10246 struct sock *skip_sk) 10247 { 10248 struct monitored_device *dev, *tmp; 10249 bool matched = false; 10250 bool notified = false; 10251 10252 /* We have received the Advertisement Report because: 10253 * 1. the kernel has initiated active discovery 10254 * 2. if not, we have pend_le_reports > 0 in which case we are doing 10255 * passive scanning 10256 * 3. if none of the above is true, we have one or more active 10257 * Advertisement Monitor 10258 * 10259 * For case 1 and 2, report all advertisements via MGMT_EV_DEVICE_FOUND 10260 * and report ONLY one advertisement per device for the matched Monitor 10261 * via MGMT_EV_ADV_MONITOR_DEVICE_FOUND event. 10262 * 10263 * For case 3, since we are not active scanning and all advertisements 10264 * received are due to a matched Advertisement Monitor, report all 10265 * advertisements ONLY via MGMT_EV_ADV_MONITOR_DEVICE_FOUND event. 10266 */ 10267 if (report_device && !hdev->advmon_pend_notify) { 10268 mgmt_event_skb(skb, skip_sk); 10269 return; 10270 } 10271 10272 hdev->advmon_pend_notify = false; 10273 10274 list_for_each_entry_safe(dev, tmp, &hdev->monitored_devices, list) { 10275 if (!bacmp(&dev->bdaddr, bdaddr)) { 10276 matched = true; 10277 10278 if (!dev->notified) { 10279 mgmt_send_adv_monitor_device_found(hdev, skb, 10280 skip_sk, 10281 dev->handle); 10282 notified = true; 10283 dev->notified = true; 10284 } 10285 } 10286 10287 if (!dev->notified) 10288 hdev->advmon_pend_notify = true; 10289 } 10290 10291 if (!report_device && 10292 ((matched && !notified) || !msft_monitor_supported(hdev))) { 10293 /* Handle 0 indicates that we are not active scanning and this 10294 * is a subsequent advertisement report for an already matched 10295 * Advertisement Monitor or the controller offloading support 10296 * is not available. 10297 */ 10298 mgmt_send_adv_monitor_device_found(hdev, skb, skip_sk, 0); 10299 } 10300 10301 if (report_device) 10302 mgmt_event_skb(skb, skip_sk); 10303 else 10304 kfree_skb(skb); 10305 } 10306 10307 static void mesh_device_found(struct hci_dev *hdev, bdaddr_t *bdaddr, 10308 u8 addr_type, s8 rssi, u32 flags, u8 *eir, 10309 u16 eir_len, u8 *scan_rsp, u8 scan_rsp_len, 10310 u64 instant) 10311 { 10312 struct sk_buff *skb; 10313 struct mgmt_ev_mesh_device_found *ev; 10314 int i, j; 10315 10316 if (!hdev->mesh_ad_types[0]) 10317 goto accepted; 10318 10319 /* Scan for requested AD types */ 10320 if (eir_len > 0) { 10321 for (i = 0; i + 1 < eir_len; i += eir[i] + 1) { 10322 for (j = 0; j < sizeof(hdev->mesh_ad_types); j++) { 10323 if (!hdev->mesh_ad_types[j]) 10324 break; 10325 10326 if (hdev->mesh_ad_types[j] == eir[i + 1]) 10327 goto accepted; 10328 } 10329 } 10330 } 10331 10332 if (scan_rsp_len > 0) { 10333 for (i = 0; i + 1 < scan_rsp_len; i += scan_rsp[i] + 1) { 10334 for (j = 0; j < sizeof(hdev->mesh_ad_types); j++) { 10335 if (!hdev->mesh_ad_types[j]) 10336 break; 10337 10338 if (hdev->mesh_ad_types[j] == scan_rsp[i + 1]) 10339 goto accepted; 10340 } 10341 } 10342 } 10343 10344 return; 10345 10346 accepted: 10347 skb = mgmt_alloc_skb(hdev, MGMT_EV_MESH_DEVICE_FOUND, 10348 sizeof(*ev) + eir_len + scan_rsp_len); 10349 if (!skb) 10350 return; 10351 10352 ev = skb_put(skb, sizeof(*ev)); 10353 10354 bacpy(&ev->addr.bdaddr, bdaddr); 10355 ev->addr.type = link_to_bdaddr(LE_LINK, addr_type); 10356 ev->rssi = rssi; 10357 ev->flags = cpu_to_le32(flags); 10358 ev->instant = cpu_to_le64(instant); 10359 10360 if (eir_len > 0) 10361 /* Copy EIR or advertising data into event */ 10362 skb_put_data(skb, eir, eir_len); 10363 10364 if (scan_rsp_len > 0) 10365 /* Append scan response data to event */ 10366 skb_put_data(skb, scan_rsp, scan_rsp_len); 10367 10368 ev->eir_len = cpu_to_le16(eir_len + scan_rsp_len); 10369 10370 mgmt_event_skb(skb, NULL); 10371 } 10372 10373 void mgmt_device_found(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type, 10374 u8 addr_type, u8 *dev_class, s8 rssi, u32 flags, 10375 u8 *eir, u16 eir_len, u8 *scan_rsp, u8 scan_rsp_len, 10376 u64 instant) 10377 { 10378 struct sk_buff *skb; 10379 struct mgmt_ev_device_found *ev; 10380 bool report_device = hci_discovery_active(hdev); 10381 10382 if (hci_dev_test_flag(hdev, HCI_MESH) && link_type == LE_LINK) 10383 mesh_device_found(hdev, bdaddr, addr_type, rssi, flags, 10384 eir, eir_len, scan_rsp, scan_rsp_len, 10385 instant); 10386 10387 /* Don't send events for a non-kernel initiated discovery. With 10388 * LE one exception is if we have pend_le_reports > 0 in which 10389 * case we're doing passive scanning and want these events. 10390 */ 10391 if (!hci_discovery_active(hdev)) { 10392 if (link_type == ACL_LINK) 10393 return; 10394 if (link_type == LE_LINK && !list_empty(&hdev->pend_le_reports)) 10395 report_device = true; 10396 else if (!hci_is_adv_monitoring(hdev)) 10397 return; 10398 } 10399 10400 if (hdev->discovery.result_filtering) { 10401 /* We are using service discovery */ 10402 if (!is_filter_match(hdev, rssi, eir, eir_len, scan_rsp, 10403 scan_rsp_len)) 10404 return; 10405 } 10406 10407 if (hdev->discovery.limited) { 10408 /* Check for limited discoverable bit */ 10409 if (dev_class) { 10410 if (!(dev_class[1] & 0x20)) 10411 return; 10412 } else { 10413 u8 *flags = eir_get_data(eir, eir_len, EIR_FLAGS, NULL); 10414 if (!flags || !(flags[0] & LE_AD_LIMITED)) 10415 return; 10416 } 10417 } 10418 10419 /* Allocate skb. The 5 extra bytes are for the potential CoD field */ 10420 skb = mgmt_alloc_skb(hdev, MGMT_EV_DEVICE_FOUND, 10421 sizeof(*ev) + eir_len + scan_rsp_len + 5); 10422 if (!skb) 10423 return; 10424 10425 ev = skb_put(skb, sizeof(*ev)); 10426 10427 /* In case of device discovery with BR/EDR devices (pre 1.2), the 10428 * RSSI value was reported as 0 when not available. This behavior 10429 * is kept when using device discovery. This is required for full 10430 * backwards compatibility with the API. 10431 * 10432 * However when using service discovery, the value 127 will be 10433 * returned when the RSSI is not available. 10434 */ 10435 if (rssi == HCI_RSSI_INVALID && !hdev->discovery.report_invalid_rssi && 10436 link_type == ACL_LINK) 10437 rssi = 0; 10438 10439 bacpy(&ev->addr.bdaddr, bdaddr); 10440 ev->addr.type = link_to_bdaddr(link_type, addr_type); 10441 ev->rssi = rssi; 10442 ev->flags = cpu_to_le32(flags); 10443 10444 if (eir_len > 0) 10445 /* Copy EIR or advertising data into event */ 10446 skb_put_data(skb, eir, eir_len); 10447 10448 if (dev_class && !eir_get_data(eir, eir_len, EIR_CLASS_OF_DEV, NULL)) { 10449 u8 eir_cod[5]; 10450 10451 eir_len += eir_append_data(eir_cod, 0, EIR_CLASS_OF_DEV, 10452 dev_class, 3); 10453 skb_put_data(skb, eir_cod, sizeof(eir_cod)); 10454 } 10455 10456 if (scan_rsp_len > 0) 10457 /* Append scan response data to event */ 10458 skb_put_data(skb, scan_rsp, scan_rsp_len); 10459 10460 ev->eir_len = cpu_to_le16(eir_len + scan_rsp_len); 10461 10462 mgmt_adv_monitor_device_found(hdev, bdaddr, report_device, skb, NULL); 10463 } 10464 10465 void mgmt_remote_name(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type, 10466 u8 addr_type, s8 rssi, u8 *name, u8 name_len) 10467 { 10468 struct sk_buff *skb; 10469 struct mgmt_ev_device_found *ev; 10470 u16 eir_len = 0; 10471 u32 flags = 0; 10472 10473 skb = mgmt_alloc_skb(hdev, MGMT_EV_DEVICE_FOUND, 10474 sizeof(*ev) + (name ? eir_precalc_len(name_len) : 0)); 10475 10476 ev = skb_put(skb, sizeof(*ev)); 10477 bacpy(&ev->addr.bdaddr, bdaddr); 10478 ev->addr.type = link_to_bdaddr(link_type, addr_type); 10479 ev->rssi = rssi; 10480 10481 if (name) 10482 eir_len += eir_skb_put_data(skb, EIR_NAME_COMPLETE, name, name_len); 10483 else 10484 flags = MGMT_DEV_FOUND_NAME_REQUEST_FAILED; 10485 10486 ev->eir_len = cpu_to_le16(eir_len); 10487 ev->flags = cpu_to_le32(flags); 10488 10489 mgmt_event_skb(skb, NULL); 10490 } 10491 10492 void mgmt_discovering(struct hci_dev *hdev, u8 discovering) 10493 { 10494 struct mgmt_ev_discovering ev; 10495 10496 bt_dev_dbg(hdev, "discovering %u", discovering); 10497 10498 memset(&ev, 0, sizeof(ev)); 10499 ev.type = hdev->discovery.type; 10500 ev.discovering = discovering; 10501 10502 mgmt_event(MGMT_EV_DISCOVERING, hdev, &ev, sizeof(ev), NULL); 10503 } 10504 10505 void mgmt_suspending(struct hci_dev *hdev, u8 state) 10506 { 10507 struct mgmt_ev_controller_suspend ev; 10508 10509 ev.suspend_state = state; 10510 mgmt_event(MGMT_EV_CONTROLLER_SUSPEND, hdev, &ev, sizeof(ev), NULL); 10511 } 10512 10513 void mgmt_resuming(struct hci_dev *hdev, u8 reason, bdaddr_t *bdaddr, 10514 u8 addr_type) 10515 { 10516 struct mgmt_ev_controller_resume ev; 10517 10518 ev.wake_reason = reason; 10519 if (bdaddr) { 10520 bacpy(&ev.addr.bdaddr, bdaddr); 10521 ev.addr.type = addr_type; 10522 } else { 10523 memset(&ev.addr, 0, sizeof(ev.addr)); 10524 } 10525 10526 mgmt_event(MGMT_EV_CONTROLLER_RESUME, hdev, &ev, sizeof(ev), NULL); 10527 } 10528 10529 static struct hci_mgmt_chan chan = { 10530 .channel = HCI_CHANNEL_CONTROL, 10531 .handler_count = ARRAY_SIZE(mgmt_handlers), 10532 .handlers = mgmt_handlers, 10533 .hdev_init = mgmt_init_hdev, 10534 }; 10535 10536 int mgmt_init(void) 10537 { 10538 return hci_mgmt_chan_register(&chan); 10539 } 10540 10541 void mgmt_exit(void) 10542 { 10543 hci_mgmt_chan_unregister(&chan); 10544 } 10545 10546 void mgmt_cleanup(struct sock *sk) 10547 { 10548 struct mgmt_mesh_tx *mesh_tx; 10549 struct hci_dev *hdev; 10550 10551 read_lock(&hci_dev_list_lock); 10552 10553 list_for_each_entry(hdev, &hci_dev_list, list) { 10554 do { 10555 mesh_tx = mgmt_mesh_next(hdev, sk); 10556 10557 if (mesh_tx) 10558 mesh_send_complete(hdev, mesh_tx, true); 10559 } while (mesh_tx); 10560 } 10561 10562 read_unlock(&hci_dev_list_lock); 10563 } 10564