1 // SPDX-License-Identifier: GPL-2.0 2 /* 3 BlueZ - Bluetooth protocol stack for Linux 4 5 Copyright (C) 2010 Nokia Corporation 6 Copyright (C) 2011-2012 Intel Corporation 7 8 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS 9 OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 10 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS. 11 IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY 12 CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES 13 WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN 14 ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF 15 OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. 16 17 ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS, 18 COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS 19 SOFTWARE IS DISCLAIMED. 20 */ 21 22 /* Bluetooth HCI Management interface */ 23 24 #include <linux/module.h> 25 #include <linux/unaligned.h> 26 27 #include <net/bluetooth/bluetooth.h> 28 #include <net/bluetooth/hci_core.h> 29 #include <net/bluetooth/hci_sock.h> 30 #include <net/bluetooth/l2cap.h> 31 #include <net/bluetooth/mgmt.h> 32 33 #include "smp.h" 34 #include "mgmt_util.h" 35 #include "mgmt_config.h" 36 #include "msft.h" 37 #include "eir.h" 38 #include "aosp.h" 39 40 #define MGMT_VERSION 1 41 #define MGMT_REVISION 23 42 43 static const u16 mgmt_commands[] = { 44 MGMT_OP_READ_INDEX_LIST, 45 MGMT_OP_READ_INFO, 46 MGMT_OP_SET_POWERED, 47 MGMT_OP_SET_DISCOVERABLE, 48 MGMT_OP_SET_CONNECTABLE, 49 MGMT_OP_SET_FAST_CONNECTABLE, 50 MGMT_OP_SET_BONDABLE, 51 MGMT_OP_SET_LINK_SECURITY, 52 MGMT_OP_SET_SSP, 53 MGMT_OP_SET_HS, 54 MGMT_OP_SET_LE, 55 MGMT_OP_SET_DEV_CLASS, 56 MGMT_OP_SET_LOCAL_NAME, 57 MGMT_OP_ADD_UUID, 58 MGMT_OP_REMOVE_UUID, 59 MGMT_OP_LOAD_LINK_KEYS, 60 MGMT_OP_LOAD_LONG_TERM_KEYS, 61 MGMT_OP_DISCONNECT, 62 MGMT_OP_GET_CONNECTIONS, 63 MGMT_OP_PIN_CODE_REPLY, 64 MGMT_OP_PIN_CODE_NEG_REPLY, 65 MGMT_OP_SET_IO_CAPABILITY, 66 MGMT_OP_PAIR_DEVICE, 67 MGMT_OP_CANCEL_PAIR_DEVICE, 68 MGMT_OP_UNPAIR_DEVICE, 69 MGMT_OP_USER_CONFIRM_REPLY, 70 MGMT_OP_USER_CONFIRM_NEG_REPLY, 71 MGMT_OP_USER_PASSKEY_REPLY, 72 MGMT_OP_USER_PASSKEY_NEG_REPLY, 73 MGMT_OP_READ_LOCAL_OOB_DATA, 74 MGMT_OP_ADD_REMOTE_OOB_DATA, 75 MGMT_OP_REMOVE_REMOTE_OOB_DATA, 76 MGMT_OP_START_DISCOVERY, 77 MGMT_OP_STOP_DISCOVERY, 78 MGMT_OP_CONFIRM_NAME, 79 MGMT_OP_BLOCK_DEVICE, 80 MGMT_OP_UNBLOCK_DEVICE, 81 MGMT_OP_SET_DEVICE_ID, 82 MGMT_OP_SET_ADVERTISING, 83 MGMT_OP_SET_BREDR, 84 MGMT_OP_SET_STATIC_ADDRESS, 85 MGMT_OP_SET_SCAN_PARAMS, 86 MGMT_OP_SET_SECURE_CONN, 87 MGMT_OP_SET_DEBUG_KEYS, 88 MGMT_OP_SET_PRIVACY, 89 MGMT_OP_LOAD_IRKS, 90 MGMT_OP_GET_CONN_INFO, 91 MGMT_OP_GET_CLOCK_INFO, 92 MGMT_OP_ADD_DEVICE, 93 MGMT_OP_REMOVE_DEVICE, 94 MGMT_OP_LOAD_CONN_PARAM, 95 MGMT_OP_READ_UNCONF_INDEX_LIST, 96 MGMT_OP_READ_CONFIG_INFO, 97 MGMT_OP_SET_EXTERNAL_CONFIG, 98 MGMT_OP_SET_PUBLIC_ADDRESS, 99 MGMT_OP_START_SERVICE_DISCOVERY, 100 MGMT_OP_READ_LOCAL_OOB_EXT_DATA, 101 MGMT_OP_READ_EXT_INDEX_LIST, 102 MGMT_OP_READ_ADV_FEATURES, 103 MGMT_OP_ADD_ADVERTISING, 104 MGMT_OP_REMOVE_ADVERTISING, 105 MGMT_OP_GET_ADV_SIZE_INFO, 106 MGMT_OP_START_LIMITED_DISCOVERY, 107 MGMT_OP_READ_EXT_INFO, 108 MGMT_OP_SET_APPEARANCE, 109 MGMT_OP_GET_PHY_CONFIGURATION, 110 MGMT_OP_SET_PHY_CONFIGURATION, 111 MGMT_OP_SET_BLOCKED_KEYS, 112 MGMT_OP_SET_WIDEBAND_SPEECH, 113 MGMT_OP_READ_CONTROLLER_CAP, 114 MGMT_OP_READ_EXP_FEATURES_INFO, 115 MGMT_OP_SET_EXP_FEATURE, 116 MGMT_OP_READ_DEF_SYSTEM_CONFIG, 117 MGMT_OP_SET_DEF_SYSTEM_CONFIG, 118 MGMT_OP_READ_DEF_RUNTIME_CONFIG, 119 MGMT_OP_SET_DEF_RUNTIME_CONFIG, 120 MGMT_OP_GET_DEVICE_FLAGS, 121 MGMT_OP_SET_DEVICE_FLAGS, 122 MGMT_OP_READ_ADV_MONITOR_FEATURES, 123 MGMT_OP_ADD_ADV_PATTERNS_MONITOR, 124 MGMT_OP_REMOVE_ADV_MONITOR, 125 MGMT_OP_ADD_EXT_ADV_PARAMS, 126 MGMT_OP_ADD_EXT_ADV_DATA, 127 MGMT_OP_ADD_ADV_PATTERNS_MONITOR_RSSI, 128 MGMT_OP_SET_MESH_RECEIVER, 129 MGMT_OP_MESH_READ_FEATURES, 130 MGMT_OP_MESH_SEND, 131 MGMT_OP_MESH_SEND_CANCEL, 132 MGMT_OP_HCI_CMD_SYNC, 133 }; 134 135 static const u16 mgmt_events[] = { 136 MGMT_EV_CONTROLLER_ERROR, 137 MGMT_EV_INDEX_ADDED, 138 MGMT_EV_INDEX_REMOVED, 139 MGMT_EV_NEW_SETTINGS, 140 MGMT_EV_CLASS_OF_DEV_CHANGED, 141 MGMT_EV_LOCAL_NAME_CHANGED, 142 MGMT_EV_NEW_LINK_KEY, 143 MGMT_EV_NEW_LONG_TERM_KEY, 144 MGMT_EV_DEVICE_CONNECTED, 145 MGMT_EV_DEVICE_DISCONNECTED, 146 MGMT_EV_CONNECT_FAILED, 147 MGMT_EV_PIN_CODE_REQUEST, 148 MGMT_EV_USER_CONFIRM_REQUEST, 149 MGMT_EV_USER_PASSKEY_REQUEST, 150 MGMT_EV_AUTH_FAILED, 151 MGMT_EV_DEVICE_FOUND, 152 MGMT_EV_DISCOVERING, 153 MGMT_EV_DEVICE_BLOCKED, 154 MGMT_EV_DEVICE_UNBLOCKED, 155 MGMT_EV_DEVICE_UNPAIRED, 156 MGMT_EV_PASSKEY_NOTIFY, 157 MGMT_EV_NEW_IRK, 158 MGMT_EV_NEW_CSRK, 159 MGMT_EV_DEVICE_ADDED, 160 MGMT_EV_DEVICE_REMOVED, 161 MGMT_EV_NEW_CONN_PARAM, 162 MGMT_EV_UNCONF_INDEX_ADDED, 163 MGMT_EV_UNCONF_INDEX_REMOVED, 164 MGMT_EV_NEW_CONFIG_OPTIONS, 165 MGMT_EV_EXT_INDEX_ADDED, 166 MGMT_EV_EXT_INDEX_REMOVED, 167 MGMT_EV_LOCAL_OOB_DATA_UPDATED, 168 MGMT_EV_ADVERTISING_ADDED, 169 MGMT_EV_ADVERTISING_REMOVED, 170 MGMT_EV_EXT_INFO_CHANGED, 171 MGMT_EV_PHY_CONFIGURATION_CHANGED, 172 MGMT_EV_EXP_FEATURE_CHANGED, 173 MGMT_EV_DEVICE_FLAGS_CHANGED, 174 MGMT_EV_ADV_MONITOR_ADDED, 175 MGMT_EV_ADV_MONITOR_REMOVED, 176 MGMT_EV_CONTROLLER_SUSPEND, 177 MGMT_EV_CONTROLLER_RESUME, 178 MGMT_EV_ADV_MONITOR_DEVICE_FOUND, 179 MGMT_EV_ADV_MONITOR_DEVICE_LOST, 180 MGMT_EV_SECURITY_LEVEL_CHANGED, 181 }; 182 183 static const u16 mgmt_untrusted_commands[] = { 184 MGMT_OP_READ_INDEX_LIST, 185 MGMT_OP_READ_INFO, 186 MGMT_OP_READ_UNCONF_INDEX_LIST, 187 MGMT_OP_READ_CONFIG_INFO, 188 MGMT_OP_READ_EXT_INDEX_LIST, 189 MGMT_OP_READ_EXT_INFO, 190 MGMT_OP_READ_CONTROLLER_CAP, 191 MGMT_OP_READ_EXP_FEATURES_INFO, 192 MGMT_OP_READ_DEF_SYSTEM_CONFIG, 193 MGMT_OP_READ_DEF_RUNTIME_CONFIG, 194 }; 195 196 static const u16 mgmt_untrusted_events[] = { 197 MGMT_EV_INDEX_ADDED, 198 MGMT_EV_INDEX_REMOVED, 199 MGMT_EV_NEW_SETTINGS, 200 MGMT_EV_CLASS_OF_DEV_CHANGED, 201 MGMT_EV_LOCAL_NAME_CHANGED, 202 MGMT_EV_UNCONF_INDEX_ADDED, 203 MGMT_EV_UNCONF_INDEX_REMOVED, 204 MGMT_EV_NEW_CONFIG_OPTIONS, 205 MGMT_EV_EXT_INDEX_ADDED, 206 MGMT_EV_EXT_INDEX_REMOVED, 207 MGMT_EV_EXT_INFO_CHANGED, 208 MGMT_EV_EXP_FEATURE_CHANGED, 209 }; 210 211 #define CACHE_TIMEOUT secs_to_jiffies(2) 212 213 #define ZERO_KEY "\x00\x00\x00\x00\x00\x00\x00\x00" \ 214 "\x00\x00\x00\x00\x00\x00\x00\x00" 215 216 /* HCI to MGMT error code conversion table */ 217 static const u8 mgmt_status_table[] = { 218 MGMT_STATUS_SUCCESS, 219 MGMT_STATUS_UNKNOWN_COMMAND, /* Unknown Command */ 220 MGMT_STATUS_NOT_CONNECTED, /* No Connection */ 221 MGMT_STATUS_FAILED, /* Hardware Failure */ 222 MGMT_STATUS_CONNECT_FAILED, /* Page Timeout */ 223 MGMT_STATUS_AUTH_FAILED, /* Authentication Failed */ 224 MGMT_STATUS_AUTH_FAILED, /* PIN or Key Missing */ 225 MGMT_STATUS_NO_RESOURCES, /* Memory Full */ 226 MGMT_STATUS_TIMEOUT, /* Connection Timeout */ 227 MGMT_STATUS_NO_RESOURCES, /* Max Number of Connections */ 228 MGMT_STATUS_NO_RESOURCES, /* Max Number of SCO Connections */ 229 MGMT_STATUS_ALREADY_CONNECTED, /* ACL Connection Exists */ 230 MGMT_STATUS_BUSY, /* Command Disallowed */ 231 MGMT_STATUS_NO_RESOURCES, /* Rejected Limited Resources */ 232 MGMT_STATUS_REJECTED, /* Rejected Security */ 233 MGMT_STATUS_REJECTED, /* Rejected Personal */ 234 MGMT_STATUS_TIMEOUT, /* Host Timeout */ 235 MGMT_STATUS_NOT_SUPPORTED, /* Unsupported Feature */ 236 MGMT_STATUS_INVALID_PARAMS, /* Invalid Parameters */ 237 MGMT_STATUS_DISCONNECTED, /* OE User Ended Connection */ 238 MGMT_STATUS_NO_RESOURCES, /* OE Low Resources */ 239 MGMT_STATUS_DISCONNECTED, /* OE Power Off */ 240 MGMT_STATUS_DISCONNECTED, /* Connection Terminated */ 241 MGMT_STATUS_BUSY, /* Repeated Attempts */ 242 MGMT_STATUS_REJECTED, /* Pairing Not Allowed */ 243 MGMT_STATUS_FAILED, /* Unknown LMP PDU */ 244 MGMT_STATUS_NOT_SUPPORTED, /* Unsupported Remote Feature */ 245 MGMT_STATUS_REJECTED, /* SCO Offset Rejected */ 246 MGMT_STATUS_REJECTED, /* SCO Interval Rejected */ 247 MGMT_STATUS_REJECTED, /* Air Mode Rejected */ 248 MGMT_STATUS_INVALID_PARAMS, /* Invalid LMP Parameters */ 249 MGMT_STATUS_FAILED, /* Unspecified Error */ 250 MGMT_STATUS_NOT_SUPPORTED, /* Unsupported LMP Parameter Value */ 251 MGMT_STATUS_FAILED, /* Role Change Not Allowed */ 252 MGMT_STATUS_TIMEOUT, /* LMP Response Timeout */ 253 MGMT_STATUS_FAILED, /* LMP Error Transaction Collision */ 254 MGMT_STATUS_FAILED, /* LMP PDU Not Allowed */ 255 MGMT_STATUS_REJECTED, /* Encryption Mode Not Accepted */ 256 MGMT_STATUS_FAILED, /* Unit Link Key Used */ 257 MGMT_STATUS_NOT_SUPPORTED, /* QoS Not Supported */ 258 MGMT_STATUS_TIMEOUT, /* Instant Passed */ 259 MGMT_STATUS_NOT_SUPPORTED, /* Pairing Not Supported */ 260 MGMT_STATUS_FAILED, /* Transaction Collision */ 261 MGMT_STATUS_FAILED, /* Reserved for future use */ 262 MGMT_STATUS_INVALID_PARAMS, /* Unacceptable Parameter */ 263 MGMT_STATUS_REJECTED, /* QoS Rejected */ 264 MGMT_STATUS_NOT_SUPPORTED, /* Classification Not Supported */ 265 MGMT_STATUS_REJECTED, /* Insufficient Security */ 266 MGMT_STATUS_INVALID_PARAMS, /* Parameter Out Of Range */ 267 MGMT_STATUS_FAILED, /* Reserved for future use */ 268 MGMT_STATUS_BUSY, /* Role Switch Pending */ 269 MGMT_STATUS_FAILED, /* Reserved for future use */ 270 MGMT_STATUS_FAILED, /* Slot Violation */ 271 MGMT_STATUS_FAILED, /* Role Switch Failed */ 272 MGMT_STATUS_INVALID_PARAMS, /* EIR Too Large */ 273 MGMT_STATUS_NOT_SUPPORTED, /* Simple Pairing Not Supported */ 274 MGMT_STATUS_BUSY, /* Host Busy Pairing */ 275 MGMT_STATUS_REJECTED, /* Rejected, No Suitable Channel */ 276 MGMT_STATUS_BUSY, /* Controller Busy */ 277 MGMT_STATUS_INVALID_PARAMS, /* Unsuitable Connection Interval */ 278 MGMT_STATUS_TIMEOUT, /* Directed Advertising Timeout */ 279 MGMT_STATUS_AUTH_FAILED, /* Terminated Due to MIC Failure */ 280 MGMT_STATUS_CONNECT_FAILED, /* Connection Establishment Failed */ 281 MGMT_STATUS_CONNECT_FAILED, /* MAC Connection Failed */ 282 }; 283 284 static u8 mgmt_errno_status(int err) 285 { 286 switch (err) { 287 case 0: 288 return MGMT_STATUS_SUCCESS; 289 case -EPERM: 290 return MGMT_STATUS_REJECTED; 291 case -EINVAL: 292 return MGMT_STATUS_INVALID_PARAMS; 293 case -EOPNOTSUPP: 294 return MGMT_STATUS_NOT_SUPPORTED; 295 case -EBUSY: 296 return MGMT_STATUS_BUSY; 297 case -ETIMEDOUT: 298 return MGMT_STATUS_AUTH_FAILED; 299 case -ENOMEM: 300 return MGMT_STATUS_NO_RESOURCES; 301 case -EISCONN: 302 return MGMT_STATUS_ALREADY_CONNECTED; 303 case -ENOTCONN: 304 return MGMT_STATUS_DISCONNECTED; 305 case -ECANCELED: 306 return MGMT_STATUS_CANCELLED; 307 } 308 309 return MGMT_STATUS_FAILED; 310 } 311 312 static u8 mgmt_status(int err) 313 { 314 if (err < 0) 315 return mgmt_errno_status(err); 316 317 if (err < ARRAY_SIZE(mgmt_status_table)) 318 return mgmt_status_table[err]; 319 320 return MGMT_STATUS_FAILED; 321 } 322 323 static int mgmt_index_event(u16 event, struct hci_dev *hdev, void *data, 324 u16 len, int flag) 325 { 326 return mgmt_send_event(event, hdev, HCI_CHANNEL_CONTROL, data, len, 327 flag, NULL); 328 } 329 330 static int mgmt_limited_event(u16 event, struct hci_dev *hdev, void *data, 331 u16 len, int flag, struct sock *skip_sk) 332 { 333 return mgmt_send_event(event, hdev, HCI_CHANNEL_CONTROL, data, len, 334 flag, skip_sk); 335 } 336 337 static int mgmt_event(u16 event, struct hci_dev *hdev, void *data, u16 len, 338 struct sock *skip_sk) 339 { 340 return mgmt_send_event(event, hdev, HCI_CHANNEL_CONTROL, data, len, 341 HCI_SOCK_TRUSTED, skip_sk); 342 } 343 344 static int mgmt_event_skb(struct sk_buff *skb, struct sock *skip_sk) 345 { 346 return mgmt_send_event_skb(HCI_CHANNEL_CONTROL, skb, HCI_SOCK_TRUSTED, 347 skip_sk); 348 } 349 350 static u8 le_addr_type(u8 mgmt_addr_type) 351 { 352 if (mgmt_addr_type == BDADDR_LE_PUBLIC) 353 return ADDR_LE_DEV_PUBLIC; 354 else 355 return ADDR_LE_DEV_RANDOM; 356 } 357 358 void mgmt_fill_version_info(void *ver) 359 { 360 struct mgmt_rp_read_version *rp = ver; 361 362 rp->version = MGMT_VERSION; 363 rp->revision = cpu_to_le16(MGMT_REVISION); 364 } 365 366 static int read_version(struct sock *sk, struct hci_dev *hdev, void *data, 367 u16 data_len) 368 { 369 struct mgmt_rp_read_version rp; 370 371 bt_dev_dbg(hdev, "sock %p", sk); 372 373 mgmt_fill_version_info(&rp); 374 375 return mgmt_cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_VERSION, 0, 376 &rp, sizeof(rp)); 377 } 378 379 static int read_commands(struct sock *sk, struct hci_dev *hdev, void *data, 380 u16 data_len) 381 { 382 struct mgmt_rp_read_commands *rp; 383 u16 num_commands, num_events; 384 size_t rp_size; 385 int i, err; 386 387 bt_dev_dbg(hdev, "sock %p", sk); 388 389 if (hci_sock_test_flag(sk, HCI_SOCK_TRUSTED)) { 390 num_commands = ARRAY_SIZE(mgmt_commands); 391 num_events = ARRAY_SIZE(mgmt_events); 392 } else { 393 num_commands = ARRAY_SIZE(mgmt_untrusted_commands); 394 num_events = ARRAY_SIZE(mgmt_untrusted_events); 395 } 396 397 rp_size = sizeof(*rp) + ((num_commands + num_events) * sizeof(u16)); 398 399 rp = kmalloc(rp_size, GFP_KERNEL); 400 if (!rp) 401 return -ENOMEM; 402 403 rp->num_commands = cpu_to_le16(num_commands); 404 rp->num_events = cpu_to_le16(num_events); 405 406 if (hci_sock_test_flag(sk, HCI_SOCK_TRUSTED)) { 407 __le16 *opcode = rp->opcodes; 408 409 for (i = 0; i < num_commands; i++, opcode++) 410 put_unaligned_le16(mgmt_commands[i], opcode); 411 412 for (i = 0; i < num_events; i++, opcode++) 413 put_unaligned_le16(mgmt_events[i], opcode); 414 } else { 415 __le16 *opcode = rp->opcodes; 416 417 for (i = 0; i < num_commands; i++, opcode++) 418 put_unaligned_le16(mgmt_untrusted_commands[i], opcode); 419 420 for (i = 0; i < num_events; i++, opcode++) 421 put_unaligned_le16(mgmt_untrusted_events[i], opcode); 422 } 423 424 err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_COMMANDS, 0, 425 rp, rp_size); 426 kfree(rp); 427 428 return err; 429 } 430 431 static int read_index_list(struct sock *sk, struct hci_dev *hdev, void *data, 432 u16 data_len) 433 { 434 struct mgmt_rp_read_index_list *rp; 435 struct hci_dev *d; 436 size_t rp_len; 437 u16 count; 438 int err; 439 440 bt_dev_dbg(hdev, "sock %p", sk); 441 442 read_lock(&hci_dev_list_lock); 443 444 count = 0; 445 list_for_each_entry(d, &hci_dev_list, list) { 446 if (!hci_dev_test_flag(d, HCI_UNCONFIGURED)) 447 count++; 448 } 449 450 rp_len = sizeof(*rp) + (2 * count); 451 rp = kmalloc(rp_len, GFP_ATOMIC); 452 if (!rp) { 453 read_unlock(&hci_dev_list_lock); 454 return -ENOMEM; 455 } 456 457 count = 0; 458 list_for_each_entry(d, &hci_dev_list, list) { 459 if (hci_dev_test_flag(d, HCI_SETUP) || 460 hci_dev_test_flag(d, HCI_CONFIG) || 461 hci_dev_test_flag(d, HCI_USER_CHANNEL)) 462 continue; 463 464 /* Devices marked as raw-only are neither configured 465 * nor unconfigured controllers. 466 */ 467 if (hci_test_quirk(d, HCI_QUIRK_RAW_DEVICE)) 468 continue; 469 470 if (!hci_dev_test_flag(d, HCI_UNCONFIGURED)) { 471 rp->index[count++] = cpu_to_le16(d->id); 472 bt_dev_dbg(hdev, "Added hci%u", d->id); 473 } 474 } 475 476 rp->num_controllers = cpu_to_le16(count); 477 rp_len = sizeof(*rp) + (2 * count); 478 479 read_unlock(&hci_dev_list_lock); 480 481 err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_INDEX_LIST, 482 0, rp, rp_len); 483 484 kfree(rp); 485 486 return err; 487 } 488 489 static int read_unconf_index_list(struct sock *sk, struct hci_dev *hdev, 490 void *data, u16 data_len) 491 { 492 struct mgmt_rp_read_unconf_index_list *rp; 493 struct hci_dev *d; 494 size_t rp_len; 495 u16 count; 496 int err; 497 498 bt_dev_dbg(hdev, "sock %p", sk); 499 500 read_lock(&hci_dev_list_lock); 501 502 count = list_count_nodes(&hci_dev_list); 503 504 rp_len = sizeof(*rp) + (sizeof(__le16) * count); 505 rp = kmalloc(rp_len, GFP_ATOMIC); 506 if (!rp) { 507 read_unlock(&hci_dev_list_lock); 508 return -ENOMEM; 509 } 510 511 count = 0; 512 list_for_each_entry(d, &hci_dev_list, list) { 513 if (hci_dev_test_flag(d, HCI_SETUP) || 514 hci_dev_test_flag(d, HCI_CONFIG) || 515 hci_dev_test_flag(d, HCI_USER_CHANNEL)) 516 continue; 517 518 /* Devices marked as raw-only are neither configured 519 * nor unconfigured controllers. 520 */ 521 if (hci_test_quirk(d, HCI_QUIRK_RAW_DEVICE)) 522 continue; 523 524 if (hci_dev_test_flag(d, HCI_UNCONFIGURED)) { 525 rp->index[count++] = cpu_to_le16(d->id); 526 bt_dev_dbg(hdev, "Added hci%u", d->id); 527 } 528 } 529 530 rp->num_controllers = cpu_to_le16(count); 531 rp_len = sizeof(*rp) + (2 * count); 532 533 read_unlock(&hci_dev_list_lock); 534 535 err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE, 536 MGMT_OP_READ_UNCONF_INDEX_LIST, 0, rp, rp_len); 537 538 kfree(rp); 539 540 return err; 541 } 542 543 static int read_ext_index_list(struct sock *sk, struct hci_dev *hdev, 544 void *data, u16 data_len) 545 { 546 struct mgmt_rp_read_ext_index_list *rp; 547 struct hci_dev *d; 548 u16 count; 549 int err; 550 551 bt_dev_dbg(hdev, "sock %p", sk); 552 553 read_lock(&hci_dev_list_lock); 554 555 count = 0; 556 list_for_each_entry(d, &hci_dev_list, list) 557 count++; 558 559 rp = kmalloc_flex(*rp, entry, count, GFP_ATOMIC); 560 if (!rp) { 561 read_unlock(&hci_dev_list_lock); 562 return -ENOMEM; 563 } 564 565 count = 0; 566 list_for_each_entry(d, &hci_dev_list, list) { 567 if (hci_dev_test_flag(d, HCI_SETUP) || 568 hci_dev_test_flag(d, HCI_CONFIG) || 569 hci_dev_test_flag(d, HCI_USER_CHANNEL)) 570 continue; 571 572 /* Devices marked as raw-only are neither configured 573 * nor unconfigured controllers. 574 */ 575 if (hci_test_quirk(d, HCI_QUIRK_RAW_DEVICE)) 576 continue; 577 578 if (hci_dev_test_flag(d, HCI_UNCONFIGURED)) 579 rp->entry[count].type = 0x01; 580 else 581 rp->entry[count].type = 0x00; 582 583 rp->entry[count].bus = d->bus; 584 rp->entry[count++].index = cpu_to_le16(d->id); 585 bt_dev_dbg(hdev, "Added hci%u", d->id); 586 } 587 588 rp->num_controllers = cpu_to_le16(count); 589 590 read_unlock(&hci_dev_list_lock); 591 592 /* If this command is called at least once, then all the 593 * default index and unconfigured index events are disabled 594 * and from now on only extended index events are used. 595 */ 596 hci_sock_set_flag(sk, HCI_MGMT_EXT_INDEX_EVENTS); 597 hci_sock_clear_flag(sk, HCI_MGMT_INDEX_EVENTS); 598 hci_sock_clear_flag(sk, HCI_MGMT_UNCONF_INDEX_EVENTS); 599 600 err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE, 601 MGMT_OP_READ_EXT_INDEX_LIST, 0, rp, 602 struct_size(rp, entry, count)); 603 604 kfree(rp); 605 606 return err; 607 } 608 609 static bool is_configured(struct hci_dev *hdev) 610 { 611 if (hci_test_quirk(hdev, HCI_QUIRK_EXTERNAL_CONFIG) && 612 !hci_dev_test_flag(hdev, HCI_EXT_CONFIGURED)) 613 return false; 614 615 if ((hci_test_quirk(hdev, HCI_QUIRK_INVALID_BDADDR) || 616 hci_test_quirk(hdev, HCI_QUIRK_USE_BDADDR_PROPERTY)) && 617 !bacmp(&hdev->public_addr, BDADDR_ANY)) 618 return false; 619 620 return true; 621 } 622 623 static __le32 get_missing_options(struct hci_dev *hdev) 624 { 625 u32 options = 0; 626 627 if (hci_test_quirk(hdev, HCI_QUIRK_EXTERNAL_CONFIG) && 628 !hci_dev_test_flag(hdev, HCI_EXT_CONFIGURED)) 629 options |= MGMT_OPTION_EXTERNAL_CONFIG; 630 631 if ((hci_test_quirk(hdev, HCI_QUIRK_INVALID_BDADDR) || 632 hci_test_quirk(hdev, HCI_QUIRK_USE_BDADDR_PROPERTY)) && 633 !bacmp(&hdev->public_addr, BDADDR_ANY)) 634 options |= MGMT_OPTION_PUBLIC_ADDRESS; 635 636 return cpu_to_le32(options); 637 } 638 639 static int new_options(struct hci_dev *hdev, struct sock *skip) 640 { 641 __le32 options = get_missing_options(hdev); 642 643 return mgmt_limited_event(MGMT_EV_NEW_CONFIG_OPTIONS, hdev, &options, 644 sizeof(options), HCI_MGMT_OPTION_EVENTS, skip); 645 } 646 647 static int send_options_rsp(struct sock *sk, u16 opcode, struct hci_dev *hdev) 648 { 649 __le32 options = get_missing_options(hdev); 650 651 return mgmt_cmd_complete(sk, hdev->id, opcode, 0, &options, 652 sizeof(options)); 653 } 654 655 static int read_config_info(struct sock *sk, struct hci_dev *hdev, 656 void *data, u16 data_len) 657 { 658 struct mgmt_rp_read_config_info rp; 659 u32 options = 0; 660 661 bt_dev_dbg(hdev, "sock %p", sk); 662 663 hci_dev_lock(hdev); 664 665 memset(&rp, 0, sizeof(rp)); 666 rp.manufacturer = cpu_to_le16(hdev->manufacturer); 667 668 if (hci_test_quirk(hdev, HCI_QUIRK_EXTERNAL_CONFIG)) 669 options |= MGMT_OPTION_EXTERNAL_CONFIG; 670 671 if (hdev->set_bdaddr) 672 options |= MGMT_OPTION_PUBLIC_ADDRESS; 673 674 rp.supported_options = cpu_to_le32(options); 675 rp.missing_options = get_missing_options(hdev); 676 677 hci_dev_unlock(hdev); 678 679 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_CONFIG_INFO, 0, 680 &rp, sizeof(rp)); 681 } 682 683 static u32 get_supported_phys(struct hci_dev *hdev) 684 { 685 u32 supported_phys = 0; 686 687 if (lmp_bredr_capable(hdev)) { 688 supported_phys |= MGMT_PHY_BR_1M_1SLOT; 689 690 if (hdev->features[0][0] & LMP_3SLOT) 691 supported_phys |= MGMT_PHY_BR_1M_3SLOT; 692 693 if (hdev->features[0][0] & LMP_5SLOT) 694 supported_phys |= MGMT_PHY_BR_1M_5SLOT; 695 696 if (lmp_edr_2m_capable(hdev)) { 697 supported_phys |= MGMT_PHY_EDR_2M_1SLOT; 698 699 if (lmp_edr_3slot_capable(hdev)) 700 supported_phys |= MGMT_PHY_EDR_2M_3SLOT; 701 702 if (lmp_edr_5slot_capable(hdev)) 703 supported_phys |= MGMT_PHY_EDR_2M_5SLOT; 704 705 if (lmp_edr_3m_capable(hdev)) { 706 supported_phys |= MGMT_PHY_EDR_3M_1SLOT; 707 708 if (lmp_edr_3slot_capable(hdev)) 709 supported_phys |= MGMT_PHY_EDR_3M_3SLOT; 710 711 if (lmp_edr_5slot_capable(hdev)) 712 supported_phys |= MGMT_PHY_EDR_3M_5SLOT; 713 } 714 } 715 } 716 717 if (lmp_le_capable(hdev)) { 718 supported_phys |= MGMT_PHY_LE_1M_TX; 719 supported_phys |= MGMT_PHY_LE_1M_RX; 720 721 if (hdev->le_features[1] & HCI_LE_PHY_2M) { 722 supported_phys |= MGMT_PHY_LE_2M_TX; 723 supported_phys |= MGMT_PHY_LE_2M_RX; 724 } 725 726 if (hdev->le_features[1] & HCI_LE_PHY_CODED) { 727 supported_phys |= MGMT_PHY_LE_CODED_TX; 728 supported_phys |= MGMT_PHY_LE_CODED_RX; 729 } 730 } 731 732 return supported_phys; 733 } 734 735 static u32 get_selected_phys(struct hci_dev *hdev) 736 { 737 u32 selected_phys = 0; 738 739 if (lmp_bredr_capable(hdev)) { 740 selected_phys |= MGMT_PHY_BR_1M_1SLOT; 741 742 if (hdev->pkt_type & (HCI_DM3 | HCI_DH3)) 743 selected_phys |= MGMT_PHY_BR_1M_3SLOT; 744 745 if (hdev->pkt_type & (HCI_DM5 | HCI_DH5)) 746 selected_phys |= MGMT_PHY_BR_1M_5SLOT; 747 748 if (lmp_edr_2m_capable(hdev)) { 749 if (!(hdev->pkt_type & HCI_2DH1)) 750 selected_phys |= MGMT_PHY_EDR_2M_1SLOT; 751 752 if (lmp_edr_3slot_capable(hdev) && 753 !(hdev->pkt_type & HCI_2DH3)) 754 selected_phys |= MGMT_PHY_EDR_2M_3SLOT; 755 756 if (lmp_edr_5slot_capable(hdev) && 757 !(hdev->pkt_type & HCI_2DH5)) 758 selected_phys |= MGMT_PHY_EDR_2M_5SLOT; 759 760 if (lmp_edr_3m_capable(hdev)) { 761 if (!(hdev->pkt_type & HCI_3DH1)) 762 selected_phys |= MGMT_PHY_EDR_3M_1SLOT; 763 764 if (lmp_edr_3slot_capable(hdev) && 765 !(hdev->pkt_type & HCI_3DH3)) 766 selected_phys |= MGMT_PHY_EDR_3M_3SLOT; 767 768 if (lmp_edr_5slot_capable(hdev) && 769 !(hdev->pkt_type & HCI_3DH5)) 770 selected_phys |= MGMT_PHY_EDR_3M_5SLOT; 771 } 772 } 773 } 774 775 if (lmp_le_capable(hdev)) { 776 if (hdev->le_tx_def_phys & HCI_LE_SET_PHY_1M) 777 selected_phys |= MGMT_PHY_LE_1M_TX; 778 779 if (hdev->le_rx_def_phys & HCI_LE_SET_PHY_1M) 780 selected_phys |= MGMT_PHY_LE_1M_RX; 781 782 if (hdev->le_tx_def_phys & HCI_LE_SET_PHY_2M) 783 selected_phys |= MGMT_PHY_LE_2M_TX; 784 785 if (hdev->le_rx_def_phys & HCI_LE_SET_PHY_2M) 786 selected_phys |= MGMT_PHY_LE_2M_RX; 787 788 if (hdev->le_tx_def_phys & HCI_LE_SET_PHY_CODED) 789 selected_phys |= MGMT_PHY_LE_CODED_TX; 790 791 if (hdev->le_rx_def_phys & HCI_LE_SET_PHY_CODED) 792 selected_phys |= MGMT_PHY_LE_CODED_RX; 793 } 794 795 return selected_phys; 796 } 797 798 static u32 get_configurable_phys(struct hci_dev *hdev) 799 { 800 return (get_supported_phys(hdev) & ~MGMT_PHY_BR_1M_1SLOT & 801 ~MGMT_PHY_LE_1M_TX & ~MGMT_PHY_LE_1M_RX); 802 } 803 804 static u32 get_supported_settings(struct hci_dev *hdev) 805 { 806 u32 settings = 0; 807 808 settings |= MGMT_SETTING_POWERED; 809 settings |= MGMT_SETTING_BONDABLE; 810 settings |= MGMT_SETTING_DEBUG_KEYS; 811 settings |= MGMT_SETTING_CONNECTABLE; 812 settings |= MGMT_SETTING_DISCOVERABLE; 813 814 if (lmp_bredr_capable(hdev)) { 815 if (hdev->hci_ver >= BLUETOOTH_VER_1_2) 816 settings |= MGMT_SETTING_FAST_CONNECTABLE; 817 settings |= MGMT_SETTING_BREDR; 818 settings |= MGMT_SETTING_LINK_SECURITY; 819 820 if (lmp_ssp_capable(hdev)) { 821 settings |= MGMT_SETTING_SSP; 822 } 823 824 if (lmp_sc_capable(hdev)) 825 settings |= MGMT_SETTING_SECURE_CONN; 826 827 if (hci_test_quirk(hdev, HCI_QUIRK_WIDEBAND_SPEECH_SUPPORTED)) 828 settings |= MGMT_SETTING_WIDEBAND_SPEECH; 829 } 830 831 if (lmp_le_capable(hdev)) { 832 settings |= MGMT_SETTING_LE; 833 settings |= MGMT_SETTING_SECURE_CONN; 834 settings |= MGMT_SETTING_PRIVACY; 835 settings |= MGMT_SETTING_STATIC_ADDRESS; 836 settings |= MGMT_SETTING_ADVERTISING; 837 } 838 839 if (hci_test_quirk(hdev, HCI_QUIRK_EXTERNAL_CONFIG) || hdev->set_bdaddr) 840 settings |= MGMT_SETTING_CONFIGURATION; 841 842 if (cis_central_capable(hdev)) 843 settings |= MGMT_SETTING_CIS_CENTRAL; 844 845 if (cis_peripheral_capable(hdev)) 846 settings |= MGMT_SETTING_CIS_PERIPHERAL; 847 848 if (bis_capable(hdev)) 849 settings |= MGMT_SETTING_ISO_BROADCASTER; 850 851 if (sync_recv_capable(hdev)) 852 settings |= MGMT_SETTING_ISO_SYNC_RECEIVER; 853 854 if (ll_privacy_capable(hdev)) 855 settings |= MGMT_SETTING_LL_PRIVACY; 856 857 if (past_sender_capable(hdev)) 858 settings |= MGMT_SETTING_PAST_SENDER; 859 860 if (past_receiver_capable(hdev)) 861 settings |= MGMT_SETTING_PAST_RECEIVER; 862 863 if (le_sci_capable(hdev)) 864 settings |= MGMT_SETTING_SCI; 865 866 settings |= MGMT_SETTING_PHY_CONFIGURATION; 867 868 return settings; 869 } 870 871 static u32 get_current_settings(struct hci_dev *hdev) 872 { 873 u32 settings = 0; 874 875 if (hdev_is_powered(hdev)) 876 settings |= MGMT_SETTING_POWERED; 877 878 if (hci_dev_test_flag(hdev, HCI_CONNECTABLE)) 879 settings |= MGMT_SETTING_CONNECTABLE; 880 881 if (hci_dev_test_flag(hdev, HCI_FAST_CONNECTABLE)) 882 settings |= MGMT_SETTING_FAST_CONNECTABLE; 883 884 if (hci_dev_test_flag(hdev, HCI_DISCOVERABLE)) 885 settings |= MGMT_SETTING_DISCOVERABLE; 886 887 if (hci_dev_test_flag(hdev, HCI_BONDABLE)) 888 settings |= MGMT_SETTING_BONDABLE; 889 890 if (hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) 891 settings |= MGMT_SETTING_BREDR; 892 893 if (hci_dev_test_flag(hdev, HCI_LE_ENABLED)) 894 settings |= MGMT_SETTING_LE; 895 896 if (hci_dev_test_flag(hdev, HCI_LINK_SECURITY)) 897 settings |= MGMT_SETTING_LINK_SECURITY; 898 899 if (hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) 900 settings |= MGMT_SETTING_SSP; 901 902 if (hci_dev_test_flag(hdev, HCI_ADVERTISING)) 903 settings |= MGMT_SETTING_ADVERTISING; 904 905 if (hci_dev_test_flag(hdev, HCI_SC_ENABLED)) 906 settings |= MGMT_SETTING_SECURE_CONN; 907 908 if (hci_dev_test_flag(hdev, HCI_KEEP_DEBUG_KEYS)) 909 settings |= MGMT_SETTING_DEBUG_KEYS; 910 911 if (hci_dev_test_flag(hdev, HCI_PRIVACY)) 912 settings |= MGMT_SETTING_PRIVACY; 913 914 /* The current setting for static address has two purposes. The 915 * first is to indicate if the static address will be used and 916 * the second is to indicate if it is actually set. 917 * 918 * This means if the static address is not configured, this flag 919 * will never be set. If the address is configured, then if the 920 * address is actually used decides if the flag is set or not. 921 * 922 * For single mode LE only controllers and dual-mode controllers 923 * with BR/EDR disabled, the existence of the static address will 924 * be evaluated. 925 */ 926 if (hci_dev_test_flag(hdev, HCI_FORCE_STATIC_ADDR) || 927 !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) || 928 !bacmp(&hdev->bdaddr, BDADDR_ANY)) { 929 if (bacmp(&hdev->static_addr, BDADDR_ANY)) 930 settings |= MGMT_SETTING_STATIC_ADDRESS; 931 } 932 933 if (hci_dev_test_flag(hdev, HCI_WIDEBAND_SPEECH_ENABLED)) 934 settings |= MGMT_SETTING_WIDEBAND_SPEECH; 935 936 if (cis_central_enabled(hdev)) 937 settings |= MGMT_SETTING_CIS_CENTRAL; 938 939 if (cis_peripheral_enabled(hdev)) 940 settings |= MGMT_SETTING_CIS_PERIPHERAL; 941 942 if (bis_enabled(hdev)) 943 settings |= MGMT_SETTING_ISO_BROADCASTER; 944 945 if (sync_recv_enabled(hdev)) 946 settings |= MGMT_SETTING_ISO_SYNC_RECEIVER; 947 948 if (ll_privacy_enabled(hdev)) 949 settings |= MGMT_SETTING_LL_PRIVACY; 950 951 if (past_sender_enabled(hdev)) 952 settings |= MGMT_SETTING_PAST_SENDER; 953 954 if (past_receiver_enabled(hdev)) 955 settings |= MGMT_SETTING_PAST_RECEIVER; 956 957 if (le_sci_enabled(hdev)) 958 settings |= MGMT_SETTING_SCI; 959 960 return settings; 961 } 962 963 static struct mgmt_pending_cmd *pending_find(u16 opcode, struct hci_dev *hdev) 964 { 965 return mgmt_pending_find(HCI_CHANNEL_CONTROL, opcode, hdev); 966 } 967 968 u8 mgmt_get_adv_discov_flags(struct hci_dev *hdev) 969 { 970 struct mgmt_pending_cmd *cmd; 971 972 /* If there's a pending mgmt command the flags will not yet have 973 * their final values, so check for this first. 974 */ 975 cmd = pending_find(MGMT_OP_SET_DISCOVERABLE, hdev); 976 if (cmd) { 977 struct mgmt_mode *cp = cmd->param; 978 if (cp->val == 0x01) 979 return LE_AD_GENERAL; 980 else if (cp->val == 0x02) 981 return LE_AD_LIMITED; 982 } else { 983 if (hci_dev_test_flag(hdev, HCI_LIMITED_DISCOVERABLE)) 984 return LE_AD_LIMITED; 985 else if (hci_dev_test_flag(hdev, HCI_DISCOVERABLE)) 986 return LE_AD_GENERAL; 987 } 988 989 return 0; 990 } 991 992 bool mgmt_get_connectable(struct hci_dev *hdev) 993 { 994 struct mgmt_pending_cmd *cmd; 995 996 /* If there's a pending mgmt command the flag will not yet have 997 * it's final value, so check for this first. 998 */ 999 cmd = pending_find(MGMT_OP_SET_CONNECTABLE, hdev); 1000 if (cmd) { 1001 struct mgmt_mode *cp = cmd->param; 1002 1003 return cp->val; 1004 } 1005 1006 return hci_dev_test_flag(hdev, HCI_CONNECTABLE); 1007 } 1008 1009 static int service_cache_sync(struct hci_dev *hdev, void *data) 1010 { 1011 hci_update_eir_sync(hdev); 1012 hci_update_class_sync(hdev); 1013 1014 return 0; 1015 } 1016 1017 static void service_cache_off(struct work_struct *work) 1018 { 1019 struct hci_dev *hdev = container_of(work, struct hci_dev, 1020 service_cache.work); 1021 1022 if (!hci_dev_test_and_clear_flag(hdev, HCI_SERVICE_CACHE)) 1023 return; 1024 1025 hci_cmd_sync_queue(hdev, service_cache_sync, NULL, NULL); 1026 } 1027 1028 static int rpa_expired_sync(struct hci_dev *hdev, void *data) 1029 { 1030 /* The generation of a new RPA and programming it into the 1031 * controller happens in the hci_req_enable_advertising() 1032 * function. 1033 */ 1034 if (ext_adv_capable(hdev)) 1035 return hci_start_ext_adv_sync(hdev, hdev->cur_adv_instance); 1036 else 1037 return hci_enable_advertising_sync(hdev); 1038 } 1039 1040 static void rpa_expired(struct work_struct *work) 1041 { 1042 struct hci_dev *hdev = container_of(work, struct hci_dev, 1043 rpa_expired.work); 1044 1045 bt_dev_dbg(hdev, ""); 1046 1047 hci_dev_set_flag(hdev, HCI_RPA_EXPIRED); 1048 1049 if (!hci_dev_test_flag(hdev, HCI_ADVERTISING)) 1050 return; 1051 1052 hci_cmd_sync_queue(hdev, rpa_expired_sync, NULL, NULL); 1053 } 1054 1055 static int set_discoverable_sync(struct hci_dev *hdev, void *data); 1056 1057 static void discov_off(struct work_struct *work) 1058 { 1059 struct hci_dev *hdev = container_of(work, struct hci_dev, 1060 discov_off.work); 1061 1062 bt_dev_dbg(hdev, ""); 1063 1064 hci_dev_lock(hdev); 1065 1066 /* When discoverable timeout triggers, then just make sure 1067 * the limited discoverable flag is cleared. Even in the case 1068 * of a timeout triggered from general discoverable, it is 1069 * safe to unconditionally clear the flag. 1070 */ 1071 hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE); 1072 hci_dev_clear_flag(hdev, HCI_DISCOVERABLE); 1073 hdev->discov_timeout = 0; 1074 1075 hci_cmd_sync_queue(hdev, set_discoverable_sync, NULL, NULL); 1076 1077 mgmt_new_settings(hdev); 1078 1079 hci_dev_unlock(hdev); 1080 } 1081 1082 static int send_settings_rsp(struct sock *sk, u16 opcode, struct hci_dev *hdev); 1083 1084 static void mesh_send_complete(struct hci_dev *hdev, 1085 struct mgmt_mesh_tx *mesh_tx, bool silent) 1086 { 1087 u8 handle = mesh_tx->handle; 1088 1089 if (!silent) 1090 mgmt_event(MGMT_EV_MESH_PACKET_CMPLT, hdev, &handle, 1091 sizeof(handle), NULL); 1092 1093 mgmt_mesh_remove(mesh_tx); 1094 } 1095 1096 static int mesh_send_done_sync(struct hci_dev *hdev, void *data) 1097 { 1098 struct mgmt_mesh_tx *mesh_tx; 1099 1100 hci_dev_clear_flag(hdev, HCI_MESH_SENDING); 1101 if (list_empty(&hdev->adv_instances)) 1102 hci_disable_advertising_sync(hdev); 1103 mesh_tx = mgmt_mesh_next(hdev, NULL); 1104 1105 if (mesh_tx) 1106 mesh_send_complete(hdev, mesh_tx, false); 1107 1108 return 0; 1109 } 1110 1111 static int mesh_send_sync(struct hci_dev *hdev, void *data); 1112 static void mesh_send_start_complete(struct hci_dev *hdev, void *data, int err); 1113 static void mesh_next(struct hci_dev *hdev, void *data, int err) 1114 { 1115 struct mgmt_mesh_tx *mesh_tx = mgmt_mesh_next(hdev, NULL); 1116 1117 if (!mesh_tx) 1118 return; 1119 1120 err = hci_cmd_sync_queue(hdev, mesh_send_sync, mesh_tx, 1121 mesh_send_start_complete); 1122 1123 if (err < 0) 1124 mesh_send_complete(hdev, mesh_tx, false); 1125 else 1126 hci_dev_set_flag(hdev, HCI_MESH_SENDING); 1127 } 1128 1129 static void mesh_send_done(struct work_struct *work) 1130 { 1131 struct hci_dev *hdev = container_of(work, struct hci_dev, 1132 mesh_send_done.work); 1133 1134 if (!hci_dev_test_flag(hdev, HCI_MESH_SENDING)) 1135 return; 1136 1137 hci_cmd_sync_queue(hdev, mesh_send_done_sync, NULL, mesh_next); 1138 } 1139 1140 static void mgmt_init_hdev(struct sock *sk, struct hci_dev *hdev) 1141 { 1142 if (hci_dev_test_flag(hdev, HCI_MGMT)) 1143 return; 1144 1145 BT_INFO("MGMT ver %d.%d", MGMT_VERSION, MGMT_REVISION); 1146 1147 INIT_DELAYED_WORK(&hdev->discov_off, discov_off); 1148 INIT_DELAYED_WORK(&hdev->service_cache, service_cache_off); 1149 INIT_DELAYED_WORK(&hdev->rpa_expired, rpa_expired); 1150 INIT_DELAYED_WORK(&hdev->mesh_send_done, mesh_send_done); 1151 1152 /* Non-mgmt controlled devices get this bit set 1153 * implicitly so that pairing works for them, however 1154 * for mgmt we require user-space to explicitly enable 1155 * it 1156 */ 1157 hci_dev_clear_flag(hdev, HCI_BONDABLE); 1158 1159 hci_dev_set_flag(hdev, HCI_MGMT); 1160 } 1161 1162 static int read_controller_info(struct sock *sk, struct hci_dev *hdev, 1163 void *data, u16 data_len) 1164 { 1165 struct mgmt_rp_read_info rp; 1166 1167 bt_dev_dbg(hdev, "sock %p", sk); 1168 1169 hci_dev_lock(hdev); 1170 1171 memset(&rp, 0, sizeof(rp)); 1172 1173 bacpy(&rp.bdaddr, &hdev->bdaddr); 1174 1175 rp.version = hdev->hci_ver; 1176 rp.manufacturer = cpu_to_le16(hdev->manufacturer); 1177 1178 rp.supported_settings = cpu_to_le32(get_supported_settings(hdev)); 1179 rp.current_settings = cpu_to_le32(get_current_settings(hdev)); 1180 1181 memcpy(rp.dev_class, hdev->dev_class, 3); 1182 1183 memcpy(rp.name, hdev->dev_name, sizeof(hdev->dev_name)); 1184 memcpy(rp.short_name, hdev->short_name, sizeof(hdev->short_name)); 1185 1186 hci_dev_unlock(hdev); 1187 1188 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_INFO, 0, &rp, 1189 sizeof(rp)); 1190 } 1191 1192 static u16 append_eir_data_to_buf(struct hci_dev *hdev, u8 *eir) 1193 { 1194 u16 eir_len = 0; 1195 size_t name_len; 1196 1197 if (hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) 1198 eir_len = eir_append_data(eir, eir_len, EIR_CLASS_OF_DEV, 1199 hdev->dev_class, 3); 1200 1201 if (hci_dev_test_flag(hdev, HCI_LE_ENABLED)) 1202 eir_len = eir_append_le16(eir, eir_len, EIR_APPEARANCE, 1203 hdev->appearance); 1204 1205 name_len = strnlen(hdev->dev_name, sizeof(hdev->dev_name)); 1206 eir_len = eir_append_data(eir, eir_len, EIR_NAME_COMPLETE, 1207 hdev->dev_name, name_len); 1208 1209 name_len = strnlen(hdev->short_name, sizeof(hdev->short_name)); 1210 eir_len = eir_append_data(eir, eir_len, EIR_NAME_SHORT, 1211 hdev->short_name, name_len); 1212 1213 return eir_len; 1214 } 1215 1216 static int read_ext_controller_info(struct sock *sk, struct hci_dev *hdev, 1217 void *data, u16 data_len) 1218 { 1219 char buf[512]; 1220 struct mgmt_rp_read_ext_info *rp = (void *)buf; 1221 u16 eir_len; 1222 1223 bt_dev_dbg(hdev, "sock %p", sk); 1224 1225 memset(&buf, 0, sizeof(buf)); 1226 1227 hci_dev_lock(hdev); 1228 1229 bacpy(&rp->bdaddr, &hdev->bdaddr); 1230 1231 rp->version = hdev->hci_ver; 1232 rp->manufacturer = cpu_to_le16(hdev->manufacturer); 1233 1234 rp->supported_settings = cpu_to_le32(get_supported_settings(hdev)); 1235 rp->current_settings = cpu_to_le32(get_current_settings(hdev)); 1236 1237 1238 eir_len = append_eir_data_to_buf(hdev, rp->eir); 1239 rp->eir_len = cpu_to_le16(eir_len); 1240 1241 hci_dev_unlock(hdev); 1242 1243 /* If this command is called at least once, then the events 1244 * for class of device and local name changes are disabled 1245 * and only the new extended controller information event 1246 * is used. 1247 */ 1248 hci_sock_set_flag(sk, HCI_MGMT_EXT_INFO_EVENTS); 1249 hci_sock_clear_flag(sk, HCI_MGMT_DEV_CLASS_EVENTS); 1250 hci_sock_clear_flag(sk, HCI_MGMT_LOCAL_NAME_EVENTS); 1251 1252 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_EXT_INFO, 0, rp, 1253 sizeof(*rp) + eir_len); 1254 } 1255 1256 static int ext_info_changed(struct hci_dev *hdev, struct sock *skip) 1257 { 1258 char buf[512]; 1259 struct mgmt_ev_ext_info_changed *ev = (void *)buf; 1260 u16 eir_len; 1261 1262 memset(buf, 0, sizeof(buf)); 1263 1264 eir_len = append_eir_data_to_buf(hdev, ev->eir); 1265 ev->eir_len = cpu_to_le16(eir_len); 1266 1267 return mgmt_limited_event(MGMT_EV_EXT_INFO_CHANGED, hdev, ev, 1268 sizeof(*ev) + eir_len, 1269 HCI_MGMT_EXT_INFO_EVENTS, skip); 1270 } 1271 1272 static int send_settings_rsp(struct sock *sk, u16 opcode, struct hci_dev *hdev) 1273 { 1274 __le32 settings = cpu_to_le32(get_current_settings(hdev)); 1275 1276 return mgmt_cmd_complete(sk, hdev->id, opcode, 0, &settings, 1277 sizeof(settings)); 1278 } 1279 1280 void mgmt_advertising_added(struct sock *sk, struct hci_dev *hdev, u8 instance) 1281 { 1282 struct mgmt_ev_advertising_added ev; 1283 1284 ev.instance = instance; 1285 1286 mgmt_event(MGMT_EV_ADVERTISING_ADDED, hdev, &ev, sizeof(ev), sk); 1287 } 1288 1289 void mgmt_advertising_removed(struct sock *sk, struct hci_dev *hdev, 1290 u8 instance) 1291 { 1292 struct mgmt_ev_advertising_removed ev; 1293 1294 ev.instance = instance; 1295 1296 mgmt_event(MGMT_EV_ADVERTISING_REMOVED, hdev, &ev, sizeof(ev), sk); 1297 } 1298 1299 static void cancel_adv_timeout(struct hci_dev *hdev) 1300 { 1301 if (hdev->adv_instance_timeout) { 1302 hdev->adv_instance_timeout = false; 1303 cancel_delayed_work(&hdev->adv_instance_expire); 1304 } 1305 } 1306 1307 /* This function requires the caller holds hdev->lock */ 1308 static void restart_le_actions(struct hci_dev *hdev) 1309 { 1310 struct hci_conn_params *p; 1311 1312 list_for_each_entry(p, &hdev->le_conn_params, list) { 1313 /* Needed for AUTO_OFF case where might not "really" 1314 * have been powered off. 1315 */ 1316 hci_pend_le_list_del_init(p); 1317 1318 switch (p->auto_connect) { 1319 case HCI_AUTO_CONN_DIRECT: 1320 case HCI_AUTO_CONN_ALWAYS: 1321 hci_pend_le_list_add(p, &hdev->pend_le_conns); 1322 break; 1323 case HCI_AUTO_CONN_REPORT: 1324 hci_pend_le_list_add(p, &hdev->pend_le_reports); 1325 break; 1326 default: 1327 break; 1328 } 1329 } 1330 } 1331 1332 static int new_settings(struct hci_dev *hdev, struct sock *skip) 1333 { 1334 __le32 ev = cpu_to_le32(get_current_settings(hdev)); 1335 1336 return mgmt_limited_event(MGMT_EV_NEW_SETTINGS, hdev, &ev, 1337 sizeof(ev), HCI_MGMT_SETTING_EVENTS, skip); 1338 } 1339 1340 static void mgmt_set_powered_complete(struct hci_dev *hdev, void *data, int err) 1341 { 1342 struct mgmt_pending_cmd *cmd = data; 1343 struct mgmt_mode *cp; 1344 1345 /* Make sure cmd still outstanding. */ 1346 if (err == -ECANCELED || !mgmt_pending_valid(hdev, cmd)) 1347 return; 1348 1349 cp = cmd->param; 1350 1351 bt_dev_dbg(hdev, "err %d", err); 1352 1353 if (!err) { 1354 if (cp->val) { 1355 hci_dev_lock(hdev); 1356 restart_le_actions(hdev); 1357 hci_update_passive_scan(hdev); 1358 hci_dev_unlock(hdev); 1359 } 1360 1361 send_settings_rsp(cmd->sk, cmd->opcode, hdev); 1362 1363 /* Only call new_setting for power on as power off is deferred 1364 * to hdev->power_off work which does call hci_dev_do_close. 1365 */ 1366 if (cp->val) 1367 new_settings(hdev, cmd->sk); 1368 } else { 1369 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_POWERED, 1370 mgmt_status(err)); 1371 } 1372 1373 mgmt_pending_free(cmd); 1374 } 1375 1376 static int set_powered_sync(struct hci_dev *hdev, void *data) 1377 { 1378 struct mgmt_pending_cmd *cmd = data; 1379 struct mgmt_mode cp; 1380 1381 mutex_lock(&hdev->mgmt_pending_lock); 1382 1383 /* Make sure cmd still outstanding. */ 1384 if (!__mgmt_pending_listed(hdev, cmd)) { 1385 mutex_unlock(&hdev->mgmt_pending_lock); 1386 return -ECANCELED; 1387 } 1388 1389 memcpy(&cp, cmd->param, sizeof(cp)); 1390 1391 mutex_unlock(&hdev->mgmt_pending_lock); 1392 1393 BT_DBG("%s", hdev->name); 1394 1395 return hci_set_powered_sync(hdev, cp.val); 1396 } 1397 1398 static int set_powered(struct sock *sk, struct hci_dev *hdev, void *data, 1399 u16 len) 1400 { 1401 struct mgmt_mode *cp = data; 1402 struct mgmt_pending_cmd *cmd; 1403 int err; 1404 1405 bt_dev_dbg(hdev, "sock %p", sk); 1406 1407 if (cp->val != 0x00 && cp->val != 0x01) 1408 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED, 1409 MGMT_STATUS_INVALID_PARAMS); 1410 1411 hci_dev_lock(hdev); 1412 1413 if (!cp->val) { 1414 if (hci_dev_test_flag(hdev, HCI_POWERING_DOWN)) { 1415 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED, 1416 MGMT_STATUS_BUSY); 1417 goto failed; 1418 } 1419 } 1420 1421 if (pending_find(MGMT_OP_SET_POWERED, hdev)) { 1422 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED, 1423 MGMT_STATUS_BUSY); 1424 goto failed; 1425 } 1426 1427 if (!!cp->val == hdev_is_powered(hdev)) { 1428 err = send_settings_rsp(sk, MGMT_OP_SET_POWERED, hdev); 1429 goto failed; 1430 } 1431 1432 cmd = mgmt_pending_add(sk, MGMT_OP_SET_POWERED, hdev, data, len); 1433 if (!cmd) { 1434 err = -ENOMEM; 1435 goto failed; 1436 } 1437 1438 /* Cancel potentially blocking sync operation before power off */ 1439 if (cp->val == 0x00) { 1440 hci_cmd_sync_cancel_sync(hdev, -EHOSTDOWN); 1441 err = hci_cmd_sync_queue(hdev, set_powered_sync, cmd, 1442 mgmt_set_powered_complete); 1443 } else { 1444 /* Use hci_cmd_sync_submit since hdev might not be running */ 1445 err = hci_cmd_sync_submit(hdev, set_powered_sync, cmd, 1446 mgmt_set_powered_complete); 1447 } 1448 1449 if (err < 0) 1450 mgmt_pending_remove(cmd); 1451 1452 failed: 1453 hci_dev_unlock(hdev); 1454 return err; 1455 } 1456 1457 int mgmt_new_settings(struct hci_dev *hdev) 1458 { 1459 return new_settings(hdev, NULL); 1460 } 1461 1462 struct cmd_lookup { 1463 struct sock *sk; 1464 struct hci_dev *hdev; 1465 u8 mgmt_status; 1466 }; 1467 1468 static void settings_rsp(struct mgmt_pending_cmd *cmd, void *data) 1469 { 1470 struct cmd_lookup *match = data; 1471 1472 send_settings_rsp(cmd->sk, cmd->opcode, match->hdev); 1473 1474 if (match->sk == NULL) { 1475 match->sk = cmd->sk; 1476 sock_hold(match->sk); 1477 } 1478 } 1479 1480 static void cmd_status_rsp(struct mgmt_pending_cmd *cmd, void *data) 1481 { 1482 u8 *status = data; 1483 1484 mgmt_cmd_status(cmd->sk, cmd->hdev->id, cmd->opcode, *status); 1485 } 1486 1487 static void cmd_complete_rsp(struct mgmt_pending_cmd *cmd, void *data) 1488 { 1489 struct cmd_lookup *match = data; 1490 1491 /* dequeue cmd_sync entries using cmd as data as that is about to be 1492 * removed/freed. 1493 */ 1494 hci_cmd_sync_dequeue(match->hdev, NULL, cmd, NULL); 1495 1496 if (cmd->cmd_complete) { 1497 cmd->cmd_complete(cmd, match->mgmt_status); 1498 return; 1499 } 1500 1501 cmd_status_rsp(cmd, &match->mgmt_status); 1502 } 1503 1504 static int generic_cmd_complete(struct mgmt_pending_cmd *cmd, u8 status) 1505 { 1506 return mgmt_cmd_complete(cmd->sk, cmd->hdev->id, cmd->opcode, status, 1507 cmd->param, cmd->param_len); 1508 } 1509 1510 static int addr_cmd_complete(struct mgmt_pending_cmd *cmd, u8 status) 1511 { 1512 return mgmt_cmd_complete(cmd->sk, cmd->hdev->id, cmd->opcode, status, 1513 cmd->param, sizeof(struct mgmt_addr_info)); 1514 } 1515 1516 static u8 mgmt_bredr_support(struct hci_dev *hdev) 1517 { 1518 if (!lmp_bredr_capable(hdev)) 1519 return MGMT_STATUS_NOT_SUPPORTED; 1520 else if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) 1521 return MGMT_STATUS_REJECTED; 1522 else 1523 return MGMT_STATUS_SUCCESS; 1524 } 1525 1526 static u8 mgmt_le_support(struct hci_dev *hdev) 1527 { 1528 if (!lmp_le_capable(hdev)) 1529 return MGMT_STATUS_NOT_SUPPORTED; 1530 else if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED)) 1531 return MGMT_STATUS_REJECTED; 1532 else 1533 return MGMT_STATUS_SUCCESS; 1534 } 1535 1536 static void mgmt_set_discoverable_complete(struct hci_dev *hdev, void *data, 1537 int err) 1538 { 1539 struct mgmt_pending_cmd *cmd = data; 1540 1541 bt_dev_dbg(hdev, "err %d", err); 1542 1543 /* Make sure cmd still outstanding. */ 1544 if (err == -ECANCELED || !mgmt_pending_valid(hdev, cmd)) 1545 return; 1546 1547 hci_dev_lock(hdev); 1548 1549 if (err) { 1550 u8 mgmt_err = mgmt_status(err); 1551 mgmt_cmd_status(cmd->sk, cmd->hdev->id, cmd->opcode, mgmt_err); 1552 hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE); 1553 goto done; 1554 } 1555 1556 if (hci_dev_test_flag(hdev, HCI_DISCOVERABLE) && 1557 hdev->discov_timeout > 0) { 1558 int to = secs_to_jiffies(hdev->discov_timeout); 1559 queue_delayed_work(hdev->req_workqueue, &hdev->discov_off, to); 1560 } 1561 1562 send_settings_rsp(cmd->sk, MGMT_OP_SET_DISCOVERABLE, hdev); 1563 new_settings(hdev, cmd->sk); 1564 1565 done: 1566 mgmt_pending_free(cmd); 1567 hci_dev_unlock(hdev); 1568 } 1569 1570 static int set_discoverable_sync(struct hci_dev *hdev, void *data) 1571 { 1572 if (!mgmt_pending_listed(hdev, data)) 1573 return -ECANCELED; 1574 1575 BT_DBG("%s", hdev->name); 1576 1577 return hci_update_discoverable_sync(hdev); 1578 } 1579 1580 static int set_discoverable(struct sock *sk, struct hci_dev *hdev, void *data, 1581 u16 len) 1582 { 1583 struct mgmt_cp_set_discoverable *cp = data; 1584 struct mgmt_pending_cmd *cmd; 1585 u16 timeout; 1586 int err; 1587 1588 bt_dev_dbg(hdev, "sock %p", sk); 1589 1590 if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED) && 1591 !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) 1592 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE, 1593 MGMT_STATUS_REJECTED); 1594 1595 if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02) 1596 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE, 1597 MGMT_STATUS_INVALID_PARAMS); 1598 1599 timeout = __le16_to_cpu(cp->timeout); 1600 1601 /* Disabling discoverable requires that no timeout is set, 1602 * and enabling limited discoverable requires a timeout. 1603 */ 1604 if ((cp->val == 0x00 && timeout > 0) || 1605 (cp->val == 0x02 && timeout == 0)) 1606 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE, 1607 MGMT_STATUS_INVALID_PARAMS); 1608 1609 hci_dev_lock(hdev); 1610 1611 if (!hdev_is_powered(hdev) && timeout > 0) { 1612 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE, 1613 MGMT_STATUS_NOT_POWERED); 1614 goto failed; 1615 } 1616 1617 if (pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) || 1618 pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) { 1619 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE, 1620 MGMT_STATUS_BUSY); 1621 goto failed; 1622 } 1623 1624 if (!hci_dev_test_flag(hdev, HCI_CONNECTABLE)) { 1625 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE, 1626 MGMT_STATUS_REJECTED); 1627 goto failed; 1628 } 1629 1630 if (hdev->advertising_paused) { 1631 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE, 1632 MGMT_STATUS_BUSY); 1633 goto failed; 1634 } 1635 1636 if (!hdev_is_powered(hdev)) { 1637 bool changed = false; 1638 1639 /* Setting limited discoverable when powered off is 1640 * not a valid operation since it requires a timeout 1641 * and so no need to check HCI_LIMITED_DISCOVERABLE. 1642 */ 1643 if (!!cp->val != hci_dev_test_flag(hdev, HCI_DISCOVERABLE)) { 1644 hci_dev_change_flag(hdev, HCI_DISCOVERABLE); 1645 changed = true; 1646 } 1647 1648 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev); 1649 if (err < 0) 1650 goto failed; 1651 1652 if (changed) 1653 err = new_settings(hdev, sk); 1654 1655 goto failed; 1656 } 1657 1658 /* If the current mode is the same, then just update the timeout 1659 * value with the new value. And if only the timeout gets updated, 1660 * then no need for any HCI transactions. 1661 */ 1662 if (!!cp->val == hci_dev_test_flag(hdev, HCI_DISCOVERABLE) && 1663 (cp->val == 0x02) == hci_dev_test_flag(hdev, 1664 HCI_LIMITED_DISCOVERABLE)) { 1665 cancel_delayed_work(&hdev->discov_off); 1666 hdev->discov_timeout = timeout; 1667 1668 if (cp->val && hdev->discov_timeout > 0) { 1669 int to = secs_to_jiffies(hdev->discov_timeout); 1670 queue_delayed_work(hdev->req_workqueue, 1671 &hdev->discov_off, to); 1672 } 1673 1674 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev); 1675 goto failed; 1676 } 1677 1678 cmd = mgmt_pending_add(sk, MGMT_OP_SET_DISCOVERABLE, hdev, data, len); 1679 if (!cmd) { 1680 err = -ENOMEM; 1681 goto failed; 1682 } 1683 1684 /* Cancel any potential discoverable timeout that might be 1685 * still active and store new timeout value. The arming of 1686 * the timeout happens in the complete handler. 1687 */ 1688 cancel_delayed_work(&hdev->discov_off); 1689 hdev->discov_timeout = timeout; 1690 1691 if (cp->val) 1692 hci_dev_set_flag(hdev, HCI_DISCOVERABLE); 1693 else 1694 hci_dev_clear_flag(hdev, HCI_DISCOVERABLE); 1695 1696 /* Limited discoverable mode */ 1697 if (cp->val == 0x02) 1698 hci_dev_set_flag(hdev, HCI_LIMITED_DISCOVERABLE); 1699 else 1700 hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE); 1701 1702 err = hci_cmd_sync_queue(hdev, set_discoverable_sync, cmd, 1703 mgmt_set_discoverable_complete); 1704 1705 if (err < 0) 1706 mgmt_pending_remove(cmd); 1707 1708 failed: 1709 hci_dev_unlock(hdev); 1710 return err; 1711 } 1712 1713 static void mgmt_set_connectable_complete(struct hci_dev *hdev, void *data, 1714 int err) 1715 { 1716 struct mgmt_pending_cmd *cmd = data; 1717 1718 bt_dev_dbg(hdev, "err %d", err); 1719 1720 /* Make sure cmd still outstanding. */ 1721 if (err == -ECANCELED || !mgmt_pending_valid(hdev, cmd)) 1722 return; 1723 1724 hci_dev_lock(hdev); 1725 1726 if (err) { 1727 u8 mgmt_err = mgmt_status(err); 1728 mgmt_cmd_status(cmd->sk, cmd->hdev->id, cmd->opcode, mgmt_err); 1729 goto done; 1730 } 1731 1732 send_settings_rsp(cmd->sk, MGMT_OP_SET_CONNECTABLE, hdev); 1733 new_settings(hdev, cmd->sk); 1734 1735 done: 1736 mgmt_pending_free(cmd); 1737 1738 hci_dev_unlock(hdev); 1739 } 1740 1741 static int set_connectable_update_settings(struct hci_dev *hdev, 1742 struct sock *sk, u8 val) 1743 { 1744 bool changed = false; 1745 int err; 1746 1747 if (!!val != hci_dev_test_flag(hdev, HCI_CONNECTABLE)) 1748 changed = true; 1749 1750 if (val) { 1751 hci_dev_set_flag(hdev, HCI_CONNECTABLE); 1752 } else { 1753 hci_dev_clear_flag(hdev, HCI_CONNECTABLE); 1754 hci_dev_clear_flag(hdev, HCI_DISCOVERABLE); 1755 } 1756 1757 err = send_settings_rsp(sk, MGMT_OP_SET_CONNECTABLE, hdev); 1758 if (err < 0) 1759 return err; 1760 1761 if (changed) { 1762 hci_update_scan(hdev); 1763 hci_update_passive_scan(hdev); 1764 return new_settings(hdev, sk); 1765 } 1766 1767 return 0; 1768 } 1769 1770 static int set_connectable_sync(struct hci_dev *hdev, void *data) 1771 { 1772 if (!mgmt_pending_listed(hdev, data)) 1773 return -ECANCELED; 1774 1775 BT_DBG("%s", hdev->name); 1776 1777 return hci_update_connectable_sync(hdev); 1778 } 1779 1780 static int set_connectable(struct sock *sk, struct hci_dev *hdev, void *data, 1781 u16 len) 1782 { 1783 struct mgmt_mode *cp = data; 1784 struct mgmt_pending_cmd *cmd; 1785 int err; 1786 1787 bt_dev_dbg(hdev, "sock %p", sk); 1788 1789 if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED) && 1790 !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) 1791 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE, 1792 MGMT_STATUS_REJECTED); 1793 1794 if (cp->val != 0x00 && cp->val != 0x01) 1795 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE, 1796 MGMT_STATUS_INVALID_PARAMS); 1797 1798 hci_dev_lock(hdev); 1799 1800 if (!hdev_is_powered(hdev)) { 1801 err = set_connectable_update_settings(hdev, sk, cp->val); 1802 goto failed; 1803 } 1804 1805 if (pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) || 1806 pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) { 1807 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE, 1808 MGMT_STATUS_BUSY); 1809 goto failed; 1810 } 1811 1812 cmd = mgmt_pending_add(sk, MGMT_OP_SET_CONNECTABLE, hdev, data, len); 1813 if (!cmd) { 1814 err = -ENOMEM; 1815 goto failed; 1816 } 1817 1818 if (cp->val) { 1819 hci_dev_set_flag(hdev, HCI_CONNECTABLE); 1820 } else { 1821 if (hdev->discov_timeout > 0) 1822 cancel_delayed_work(&hdev->discov_off); 1823 1824 hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE); 1825 hci_dev_clear_flag(hdev, HCI_DISCOVERABLE); 1826 hci_dev_clear_flag(hdev, HCI_CONNECTABLE); 1827 } 1828 1829 err = hci_cmd_sync_queue(hdev, set_connectable_sync, cmd, 1830 mgmt_set_connectable_complete); 1831 1832 if (err < 0) 1833 mgmt_pending_remove(cmd); 1834 1835 failed: 1836 hci_dev_unlock(hdev); 1837 return err; 1838 } 1839 1840 static int set_bondable(struct sock *sk, struct hci_dev *hdev, void *data, 1841 u16 len) 1842 { 1843 struct mgmt_mode *cp = data; 1844 bool changed; 1845 int err; 1846 1847 bt_dev_dbg(hdev, "sock %p", sk); 1848 1849 if (cp->val != 0x00 && cp->val != 0x01) 1850 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BONDABLE, 1851 MGMT_STATUS_INVALID_PARAMS); 1852 1853 hci_dev_lock(hdev); 1854 1855 if (cp->val) 1856 changed = !hci_dev_test_and_set_flag(hdev, HCI_BONDABLE); 1857 else 1858 changed = hci_dev_test_and_clear_flag(hdev, HCI_BONDABLE); 1859 1860 err = send_settings_rsp(sk, MGMT_OP_SET_BONDABLE, hdev); 1861 if (err < 0) 1862 goto unlock; 1863 1864 if (changed) { 1865 /* In limited privacy mode the change of bondable mode 1866 * may affect the local advertising address. 1867 */ 1868 hci_update_discoverable(hdev); 1869 1870 err = new_settings(hdev, sk); 1871 } 1872 1873 unlock: 1874 hci_dev_unlock(hdev); 1875 return err; 1876 } 1877 1878 static int set_link_security(struct sock *sk, struct hci_dev *hdev, void *data, 1879 u16 len) 1880 { 1881 struct mgmt_mode *cp = data; 1882 struct mgmt_pending_cmd *cmd; 1883 u8 val, status; 1884 int err; 1885 1886 bt_dev_dbg(hdev, "sock %p", sk); 1887 1888 status = mgmt_bredr_support(hdev); 1889 if (status) 1890 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY, 1891 status); 1892 1893 if (cp->val != 0x00 && cp->val != 0x01) 1894 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY, 1895 MGMT_STATUS_INVALID_PARAMS); 1896 1897 hci_dev_lock(hdev); 1898 1899 if (!hdev_is_powered(hdev)) { 1900 bool changed = false; 1901 1902 if (!!cp->val != hci_dev_test_flag(hdev, HCI_LINK_SECURITY)) { 1903 hci_dev_change_flag(hdev, HCI_LINK_SECURITY); 1904 changed = true; 1905 } 1906 1907 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev); 1908 if (err < 0) 1909 goto failed; 1910 1911 if (changed) 1912 err = new_settings(hdev, sk); 1913 1914 goto failed; 1915 } 1916 1917 if (pending_find(MGMT_OP_SET_LINK_SECURITY, hdev)) { 1918 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY, 1919 MGMT_STATUS_BUSY); 1920 goto failed; 1921 } 1922 1923 val = !!cp->val; 1924 1925 if (test_bit(HCI_AUTH, &hdev->flags) == val) { 1926 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev); 1927 goto failed; 1928 } 1929 1930 cmd = mgmt_pending_add(sk, MGMT_OP_SET_LINK_SECURITY, hdev, data, len); 1931 if (!cmd) { 1932 err = -ENOMEM; 1933 goto failed; 1934 } 1935 1936 err = hci_send_cmd(hdev, HCI_OP_WRITE_AUTH_ENABLE, sizeof(val), &val); 1937 if (err < 0) { 1938 mgmt_pending_remove(cmd); 1939 goto failed; 1940 } 1941 1942 failed: 1943 hci_dev_unlock(hdev); 1944 return err; 1945 } 1946 1947 static void set_ssp_complete(struct hci_dev *hdev, void *data, int err) 1948 { 1949 struct cmd_lookup match = { NULL, hdev }; 1950 struct mgmt_pending_cmd *cmd = data; 1951 struct mgmt_mode *cp; 1952 u8 enable; 1953 bool changed; 1954 1955 /* Make sure cmd still outstanding. */ 1956 if (err == -ECANCELED || !mgmt_pending_valid(hdev, cmd)) 1957 return; 1958 1959 cp = cmd->param; 1960 enable = cp->val; 1961 1962 if (err) { 1963 u8 mgmt_err = mgmt_status(err); 1964 1965 if (enable && hci_dev_test_and_clear_flag(hdev, 1966 HCI_SSP_ENABLED)) { 1967 new_settings(hdev, NULL); 1968 } 1969 1970 mgmt_cmd_status(cmd->sk, cmd->hdev->id, cmd->opcode, mgmt_err); 1971 mgmt_pending_free(cmd); 1972 return; 1973 } 1974 1975 if (enable) { 1976 changed = !hci_dev_test_and_set_flag(hdev, HCI_SSP_ENABLED); 1977 } else { 1978 changed = hci_dev_test_and_clear_flag(hdev, HCI_SSP_ENABLED); 1979 } 1980 1981 settings_rsp(cmd, &match); 1982 1983 if (changed) 1984 new_settings(hdev, match.sk); 1985 1986 if (match.sk) 1987 sock_put(match.sk); 1988 1989 hci_update_eir_sync(hdev); 1990 mgmt_pending_free(cmd); 1991 } 1992 1993 static int set_ssp_sync(struct hci_dev *hdev, void *data) 1994 { 1995 struct mgmt_pending_cmd *cmd = data; 1996 struct mgmt_mode cp; 1997 bool changed = false; 1998 int err; 1999 2000 mutex_lock(&hdev->mgmt_pending_lock); 2001 2002 if (!__mgmt_pending_listed(hdev, cmd)) { 2003 mutex_unlock(&hdev->mgmt_pending_lock); 2004 return -ECANCELED; 2005 } 2006 2007 memcpy(&cp, cmd->param, sizeof(cp)); 2008 2009 mutex_unlock(&hdev->mgmt_pending_lock); 2010 2011 if (cp.val) 2012 changed = !hci_dev_test_and_set_flag(hdev, HCI_SSP_ENABLED); 2013 2014 err = hci_write_ssp_mode_sync(hdev, cp.val); 2015 2016 if (!err && changed) 2017 hci_dev_clear_flag(hdev, HCI_SSP_ENABLED); 2018 2019 return err; 2020 } 2021 2022 static int set_ssp(struct sock *sk, struct hci_dev *hdev, void *data, u16 len) 2023 { 2024 struct mgmt_mode *cp = data; 2025 struct mgmt_pending_cmd *cmd; 2026 u8 status; 2027 int err; 2028 2029 bt_dev_dbg(hdev, "sock %p", sk); 2030 2031 status = mgmt_bredr_support(hdev); 2032 if (status) 2033 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP, status); 2034 2035 if (!lmp_ssp_capable(hdev)) 2036 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP, 2037 MGMT_STATUS_NOT_SUPPORTED); 2038 2039 if (cp->val != 0x00 && cp->val != 0x01) 2040 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP, 2041 MGMT_STATUS_INVALID_PARAMS); 2042 2043 hci_dev_lock(hdev); 2044 2045 if (!hdev_is_powered(hdev)) { 2046 bool changed; 2047 2048 if (cp->val) { 2049 changed = !hci_dev_test_and_set_flag(hdev, 2050 HCI_SSP_ENABLED); 2051 } else { 2052 changed = hci_dev_test_and_clear_flag(hdev, 2053 HCI_SSP_ENABLED); 2054 } 2055 2056 err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev); 2057 if (err < 0) 2058 goto failed; 2059 2060 if (changed) 2061 err = new_settings(hdev, sk); 2062 2063 goto failed; 2064 } 2065 2066 if (pending_find(MGMT_OP_SET_SSP, hdev)) { 2067 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP, 2068 MGMT_STATUS_BUSY); 2069 goto failed; 2070 } 2071 2072 if (!!cp->val == hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) { 2073 err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev); 2074 goto failed; 2075 } 2076 2077 cmd = mgmt_pending_add(sk, MGMT_OP_SET_SSP, hdev, data, len); 2078 if (!cmd) 2079 err = -ENOMEM; 2080 else 2081 err = hci_cmd_sync_queue(hdev, set_ssp_sync, cmd, 2082 set_ssp_complete); 2083 2084 if (err < 0) { 2085 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP, 2086 MGMT_STATUS_FAILED); 2087 2088 if (cmd) 2089 mgmt_pending_remove(cmd); 2090 } 2091 2092 failed: 2093 hci_dev_unlock(hdev); 2094 return err; 2095 } 2096 2097 static int set_hs(struct sock *sk, struct hci_dev *hdev, void *data, u16 len) 2098 { 2099 bt_dev_dbg(hdev, "sock %p", sk); 2100 2101 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS, 2102 MGMT_STATUS_NOT_SUPPORTED); 2103 } 2104 2105 static void set_le_complete(struct hci_dev *hdev, void *data, int err) 2106 { 2107 struct mgmt_pending_cmd *cmd = data; 2108 struct cmd_lookup match = { NULL, hdev }; 2109 u8 status = mgmt_status(err); 2110 2111 bt_dev_dbg(hdev, "err %d", err); 2112 2113 if (err == -ECANCELED || !mgmt_pending_valid(hdev, data)) 2114 return; 2115 2116 if (status) { 2117 mgmt_cmd_status(cmd->sk, cmd->hdev->id, cmd->opcode, status); 2118 goto done; 2119 } 2120 2121 settings_rsp(cmd, &match); 2122 2123 new_settings(hdev, match.sk); 2124 2125 if (match.sk) 2126 sock_put(match.sk); 2127 2128 done: 2129 mgmt_pending_free(cmd); 2130 } 2131 2132 static int set_le_sync(struct hci_dev *hdev, void *data) 2133 { 2134 struct mgmt_pending_cmd *cmd = data; 2135 struct mgmt_mode cp; 2136 u8 val; 2137 int err; 2138 2139 mutex_lock(&hdev->mgmt_pending_lock); 2140 2141 if (!__mgmt_pending_listed(hdev, cmd)) { 2142 mutex_unlock(&hdev->mgmt_pending_lock); 2143 return -ECANCELED; 2144 } 2145 2146 memcpy(&cp, cmd->param, sizeof(cp)); 2147 val = !!cp.val; 2148 2149 mutex_unlock(&hdev->mgmt_pending_lock); 2150 2151 if (!val) { 2152 hci_clear_adv_instance_sync(hdev, NULL, 0x00, true); 2153 2154 if (hci_dev_test_flag(hdev, HCI_LE_ADV)) 2155 hci_disable_advertising_sync(hdev); 2156 2157 if (ext_adv_capable(hdev)) 2158 hci_remove_ext_adv_instance_sync(hdev, 0, cmd->sk); 2159 } else { 2160 hci_dev_set_flag(hdev, HCI_LE_ENABLED); 2161 } 2162 2163 err = hci_write_le_host_supported_sync(hdev, val, 0); 2164 2165 /* Make sure the controller has a good default for 2166 * advertising data. Restrict the update to when LE 2167 * has actually been enabled. During power on, the 2168 * update in powered_update_hci will take care of it. 2169 */ 2170 if (!err && hci_dev_test_flag(hdev, HCI_LE_ENABLED)) { 2171 if (ext_adv_capable(hdev)) { 2172 int status; 2173 2174 status = hci_setup_ext_adv_instance_sync(hdev, 0x00); 2175 if (!status) 2176 hci_update_scan_rsp_data_sync(hdev, 0x00); 2177 } else { 2178 hci_update_adv_data_sync(hdev, 0x00); 2179 hci_update_scan_rsp_data_sync(hdev, 0x00); 2180 } 2181 2182 hci_update_passive_scan(hdev); 2183 } 2184 2185 return err; 2186 } 2187 2188 static void set_mesh_complete(struct hci_dev *hdev, void *data, int err) 2189 { 2190 struct mgmt_pending_cmd *cmd = data; 2191 u8 status = mgmt_status(err); 2192 struct sock *sk; 2193 2194 if (err == -ECANCELED || !mgmt_pending_valid(hdev, cmd)) 2195 return; 2196 2197 sk = cmd->sk; 2198 2199 if (status) { 2200 mgmt_cmd_status(cmd->sk, hdev->id, cmd->opcode, status); 2201 goto done; 2202 } 2203 2204 mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_MESH_RECEIVER, 0, NULL, 0); 2205 2206 done: 2207 mgmt_pending_free(cmd); 2208 } 2209 2210 static int set_mesh_sync(struct hci_dev *hdev, void *data) 2211 { 2212 struct mgmt_pending_cmd *cmd = data; 2213 DEFINE_FLEX(struct mgmt_cp_set_mesh, cp, ad_types, num_ad_types, 2214 sizeof(hdev->mesh_ad_types)); 2215 size_t len; 2216 2217 mutex_lock(&hdev->mgmt_pending_lock); 2218 2219 if (!__mgmt_pending_listed(hdev, cmd)) { 2220 mutex_unlock(&hdev->mgmt_pending_lock); 2221 return -ECANCELED; 2222 } 2223 2224 len = cmd->param_len; 2225 memcpy(cp, cmd->param, min(__struct_size(cp), len)); 2226 2227 mutex_unlock(&hdev->mgmt_pending_lock); 2228 2229 memset(hdev->mesh_ad_types, 0, sizeof(hdev->mesh_ad_types)); 2230 2231 if (cp->enable) 2232 hci_dev_set_flag(hdev, HCI_MESH); 2233 else 2234 hci_dev_clear_flag(hdev, HCI_MESH); 2235 2236 hdev->le_scan_interval = __le16_to_cpu(cp->period); 2237 hdev->le_scan_window = __le16_to_cpu(cp->window); 2238 2239 len -= sizeof(struct mgmt_cp_set_mesh); 2240 2241 /* If filters don't fit, forward all adv pkts */ 2242 if (len <= sizeof(hdev->mesh_ad_types)) 2243 memcpy(hdev->mesh_ad_types, cp->ad_types, len); 2244 2245 hci_update_passive_scan_sync(hdev); 2246 return 0; 2247 } 2248 2249 static int set_mesh(struct sock *sk, struct hci_dev *hdev, void *data, u16 len) 2250 { 2251 struct mgmt_cp_set_mesh *cp = data; 2252 struct mgmt_pending_cmd *cmd; 2253 __u16 period, window; 2254 int err = 0; 2255 2256 bt_dev_dbg(hdev, "sock %p", sk); 2257 2258 if (!lmp_le_capable(hdev) || 2259 !hci_dev_test_flag(hdev, HCI_MESH_EXPERIMENTAL)) 2260 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_MESH_RECEIVER, 2261 MGMT_STATUS_NOT_SUPPORTED); 2262 2263 if (cp->enable != 0x00 && cp->enable != 0x01) 2264 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_MESH_RECEIVER, 2265 MGMT_STATUS_INVALID_PARAMS); 2266 2267 /* Keep allowed ranges in sync with set_scan_params() */ 2268 period = __le16_to_cpu(cp->period); 2269 2270 if (period < 0x0004 || period > 0x4000) 2271 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_MESH_RECEIVER, 2272 MGMT_STATUS_INVALID_PARAMS); 2273 2274 window = __le16_to_cpu(cp->window); 2275 2276 if (window < 0x0004 || window > 0x4000) 2277 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_MESH_RECEIVER, 2278 MGMT_STATUS_INVALID_PARAMS); 2279 2280 if (window > period) 2281 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_MESH_RECEIVER, 2282 MGMT_STATUS_INVALID_PARAMS); 2283 2284 hci_dev_lock(hdev); 2285 2286 cmd = mgmt_pending_add(sk, MGMT_OP_SET_MESH_RECEIVER, hdev, data, len); 2287 if (!cmd) 2288 err = -ENOMEM; 2289 else 2290 err = hci_cmd_sync_queue(hdev, set_mesh_sync, cmd, 2291 set_mesh_complete); 2292 2293 if (err < 0) { 2294 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_MESH_RECEIVER, 2295 MGMT_STATUS_FAILED); 2296 2297 if (cmd) 2298 mgmt_pending_remove(cmd); 2299 } 2300 2301 hci_dev_unlock(hdev); 2302 return err; 2303 } 2304 2305 static void mesh_send_start_complete(struct hci_dev *hdev, void *data, int err) 2306 { 2307 struct mgmt_mesh_tx *mesh_tx = data; 2308 struct mgmt_cp_mesh_send *send = (void *)mesh_tx->param; 2309 unsigned long mesh_send_interval; 2310 u8 mgmt_err = mgmt_status(err); 2311 2312 /* Report any errors here, but don't report completion */ 2313 2314 if (mgmt_err) { 2315 hci_dev_clear_flag(hdev, HCI_MESH_SENDING); 2316 /* Send Complete Error Code for handle */ 2317 mesh_send_complete(hdev, mesh_tx, false); 2318 if (err != -ECANCELED) 2319 mesh_next(hdev, NULL, 0); 2320 return; 2321 } 2322 2323 mesh_send_interval = msecs_to_jiffies((send->cnt) * 25); 2324 queue_delayed_work(hdev->req_workqueue, &hdev->mesh_send_done, 2325 mesh_send_interval); 2326 } 2327 2328 static int mesh_send_sync(struct hci_dev *hdev, void *data) 2329 { 2330 struct mgmt_mesh_tx *mesh_tx = data; 2331 struct mgmt_cp_mesh_send *send = (void *)mesh_tx->param; 2332 struct adv_info *adv, *next_instance; 2333 u8 instance = hdev->le_num_of_adv_sets + 1; 2334 u16 timeout, duration; 2335 int err = 0; 2336 2337 if (hdev->le_num_of_adv_sets <= hdev->adv_instance_cnt) 2338 return MGMT_STATUS_BUSY; 2339 2340 timeout = 1000; 2341 duration = send->cnt * INTERVAL_TO_MS(hdev->le_adv_max_interval); 2342 adv = hci_add_adv_instance(hdev, instance, 0, 2343 send->adv_data_len, send->adv_data, 2344 0, NULL, 2345 timeout, duration, 2346 HCI_ADV_TX_POWER_NO_PREFERENCE, 2347 hdev->le_adv_min_interval, 2348 hdev->le_adv_max_interval, 2349 mesh_tx->handle); 2350 2351 if (!IS_ERR(adv)) 2352 mesh_tx->instance = instance; 2353 else 2354 err = PTR_ERR(adv); 2355 2356 if (hdev->cur_adv_instance == instance) { 2357 /* If the currently advertised instance is being changed then 2358 * cancel the current advertising and schedule the next 2359 * instance. If there is only one instance then the overridden 2360 * advertising data will be visible right away. 2361 */ 2362 cancel_adv_timeout(hdev); 2363 2364 next_instance = hci_get_next_instance(hdev, instance); 2365 if (next_instance) 2366 instance = next_instance->instance; 2367 else 2368 instance = 0; 2369 } else if (hdev->adv_instance_timeout) { 2370 /* Immediately advertise the new instance if no other, or 2371 * let it go naturally from queue if ADV is already happening 2372 */ 2373 instance = 0; 2374 } 2375 2376 if (instance) 2377 return hci_schedule_adv_instance_sync(hdev, instance, true); 2378 2379 return err; 2380 } 2381 2382 static void send_count(struct mgmt_mesh_tx *mesh_tx, void *data) 2383 { 2384 struct mgmt_rp_mesh_read_features *rp = data; 2385 2386 if (rp->used_handles >= rp->max_handles) 2387 return; 2388 2389 rp->handles[rp->used_handles++] = mesh_tx->handle; 2390 } 2391 2392 static int mesh_features(struct sock *sk, struct hci_dev *hdev, 2393 void *data, u16 len) 2394 { 2395 struct mgmt_rp_mesh_read_features rp; 2396 2397 if (!lmp_le_capable(hdev) || 2398 !hci_dev_test_flag(hdev, HCI_MESH_EXPERIMENTAL)) 2399 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_MESH_READ_FEATURES, 2400 MGMT_STATUS_NOT_SUPPORTED); 2401 2402 memset(&rp, 0, sizeof(rp)); 2403 rp.index = cpu_to_le16(hdev->id); 2404 if (hci_dev_test_flag(hdev, HCI_LE_ENABLED)) 2405 rp.max_handles = MESH_HANDLES_MAX; 2406 2407 hci_dev_lock(hdev); 2408 2409 if (rp.max_handles) 2410 mgmt_mesh_foreach(hdev, send_count, &rp, sk); 2411 2412 mgmt_cmd_complete(sk, hdev->id, MGMT_OP_MESH_READ_FEATURES, 0, &rp, 2413 rp.used_handles + sizeof(rp) - MESH_HANDLES_MAX); 2414 2415 hci_dev_unlock(hdev); 2416 return 0; 2417 } 2418 2419 static int send_cancel(struct hci_dev *hdev, void *data) 2420 { 2421 struct mgmt_pending_cmd *cmd = data; 2422 struct mgmt_cp_mesh_send_cancel *cancel = (void *)cmd->param; 2423 struct mgmt_mesh_tx *mesh_tx; 2424 2425 if (!cancel->handle) { 2426 do { 2427 mesh_tx = mgmt_mesh_next(hdev, cmd->sk); 2428 2429 if (mesh_tx) { 2430 if (!hci_cmd_sync_dequeue(hdev, mesh_send_sync, 2431 mesh_tx, NULL)) 2432 mesh_send_complete(hdev, mesh_tx, false); 2433 } 2434 } while (mesh_tx); 2435 } else { 2436 mesh_tx = mgmt_mesh_find(hdev, cancel->handle); 2437 2438 if (mesh_tx && mesh_tx->sk == cmd->sk) { 2439 if (!hci_cmd_sync_dequeue(hdev, mesh_send_sync, 2440 mesh_tx, NULL)) 2441 mesh_send_complete(hdev, mesh_tx, false); 2442 } 2443 } 2444 2445 mgmt_cmd_complete(cmd->sk, hdev->id, MGMT_OP_MESH_SEND_CANCEL, 2446 0, NULL, 0); 2447 2448 if (!hci_dev_test_flag(hdev, HCI_MESH_SENDING)) 2449 mesh_next(hdev, NULL, 0); 2450 2451 return 0; 2452 } 2453 2454 static void send_cancel_destroy(struct hci_dev *hdev, void *data, int err) 2455 { 2456 mgmt_pending_free(data); 2457 } 2458 2459 static int mesh_send_cancel(struct sock *sk, struct hci_dev *hdev, 2460 void *data, u16 len) 2461 { 2462 struct mgmt_pending_cmd *cmd; 2463 int err; 2464 2465 if (!lmp_le_capable(hdev) || 2466 !hci_dev_test_flag(hdev, HCI_MESH_EXPERIMENTAL)) 2467 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_MESH_SEND_CANCEL, 2468 MGMT_STATUS_NOT_SUPPORTED); 2469 2470 if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED)) 2471 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_MESH_SEND_CANCEL, 2472 MGMT_STATUS_REJECTED); 2473 2474 hci_dev_lock(hdev); 2475 cmd = mgmt_pending_new(sk, MGMT_OP_MESH_SEND_CANCEL, hdev, data, len); 2476 if (!cmd) 2477 err = -ENOMEM; 2478 else 2479 err = hci_cmd_sync_queue(hdev, send_cancel, cmd, 2480 send_cancel_destroy); 2481 2482 if (err < 0) { 2483 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_MESH_SEND_CANCEL, 2484 MGMT_STATUS_FAILED); 2485 2486 if (cmd) 2487 mgmt_pending_free(cmd); 2488 } 2489 2490 hci_dev_unlock(hdev); 2491 return err; 2492 } 2493 2494 static int mesh_send(struct sock *sk, struct hci_dev *hdev, void *data, u16 len) 2495 { 2496 struct mgmt_mesh_tx *mesh_tx; 2497 struct mgmt_cp_mesh_send *send = data; 2498 struct mgmt_rp_mesh_read_features rp; 2499 u16 expected_len; 2500 bool sending; 2501 int err = 0; 2502 2503 if (!lmp_le_capable(hdev) || 2504 !hci_dev_test_flag(hdev, HCI_MESH_EXPERIMENTAL)) 2505 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_MESH_SEND, 2506 MGMT_STATUS_NOT_SUPPORTED); 2507 if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED)) 2508 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_MESH_SEND, 2509 MGMT_STATUS_REJECTED); 2510 2511 if (!send->adv_data_len || send->adv_data_len > 31) 2512 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_MESH_SEND, 2513 MGMT_STATUS_REJECTED); 2514 2515 expected_len = struct_size(send, adv_data, send->adv_data_len); 2516 if (expected_len != len) 2517 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_MESH_SEND, 2518 MGMT_STATUS_INVALID_PARAMS); 2519 2520 hci_dev_lock(hdev); 2521 2522 memset(&rp, 0, sizeof(rp)); 2523 rp.max_handles = MESH_HANDLES_MAX; 2524 2525 mgmt_mesh_foreach(hdev, send_count, &rp, sk); 2526 2527 if (rp.max_handles <= rp.used_handles) { 2528 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_MESH_SEND, 2529 MGMT_STATUS_BUSY); 2530 goto done; 2531 } 2532 2533 sending = hci_dev_test_flag(hdev, HCI_MESH_SENDING); 2534 mesh_tx = mgmt_mesh_add(sk, hdev, send, len); 2535 2536 if (!mesh_tx) 2537 err = -ENOMEM; 2538 else if (!sending) 2539 err = hci_cmd_sync_queue(hdev, mesh_send_sync, mesh_tx, 2540 mesh_send_start_complete); 2541 2542 if (err < 0) { 2543 bt_dev_err(hdev, "Send Mesh Failed %d", err); 2544 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_MESH_SEND, 2545 MGMT_STATUS_FAILED); 2546 2547 if (mesh_tx) { 2548 if (sending) 2549 mgmt_mesh_remove(mesh_tx); 2550 } 2551 } else { 2552 hci_dev_set_flag(hdev, HCI_MESH_SENDING); 2553 2554 mgmt_cmd_complete(sk, hdev->id, MGMT_OP_MESH_SEND, 0, 2555 &mesh_tx->handle, 1); 2556 } 2557 2558 done: 2559 hci_dev_unlock(hdev); 2560 return err; 2561 } 2562 2563 static int set_le(struct sock *sk, struct hci_dev *hdev, void *data, u16 len) 2564 { 2565 struct mgmt_mode *cp = data; 2566 struct mgmt_pending_cmd *cmd; 2567 int err; 2568 u8 val, enabled; 2569 2570 bt_dev_dbg(hdev, "sock %p", sk); 2571 2572 if (!lmp_le_capable(hdev)) 2573 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE, 2574 MGMT_STATUS_NOT_SUPPORTED); 2575 2576 if (cp->val != 0x00 && cp->val != 0x01) 2577 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE, 2578 MGMT_STATUS_INVALID_PARAMS); 2579 2580 /* Bluetooth single mode LE only controllers or dual-mode 2581 * controllers configured as LE only devices, do not allow 2582 * switching LE off. These have either LE enabled explicitly 2583 * or BR/EDR has been previously switched off. 2584 * 2585 * When trying to enable an already enabled LE, then gracefully 2586 * send a positive response. Trying to disable it however will 2587 * result into rejection. 2588 */ 2589 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) { 2590 if (cp->val == 0x01) 2591 return send_settings_rsp(sk, MGMT_OP_SET_LE, hdev); 2592 2593 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE, 2594 MGMT_STATUS_REJECTED); 2595 } 2596 2597 hci_dev_lock(hdev); 2598 2599 val = !!cp->val; 2600 enabled = lmp_host_le_capable(hdev); 2601 2602 if (!hdev_is_powered(hdev) || val == enabled) { 2603 bool changed = false; 2604 2605 if (val != hci_dev_test_flag(hdev, HCI_LE_ENABLED)) { 2606 hci_dev_change_flag(hdev, HCI_LE_ENABLED); 2607 changed = true; 2608 } 2609 2610 if (!val && hci_dev_test_flag(hdev, HCI_ADVERTISING)) { 2611 hci_dev_clear_flag(hdev, HCI_ADVERTISING); 2612 changed = true; 2613 } 2614 2615 err = send_settings_rsp(sk, MGMT_OP_SET_LE, hdev); 2616 if (err < 0) 2617 goto unlock; 2618 2619 if (changed) 2620 err = new_settings(hdev, sk); 2621 2622 goto unlock; 2623 } 2624 2625 if (pending_find(MGMT_OP_SET_LE, hdev) || 2626 pending_find(MGMT_OP_SET_ADVERTISING, hdev)) { 2627 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE, 2628 MGMT_STATUS_BUSY); 2629 goto unlock; 2630 } 2631 2632 cmd = mgmt_pending_add(sk, MGMT_OP_SET_LE, hdev, data, len); 2633 if (!cmd) 2634 err = -ENOMEM; 2635 else 2636 err = hci_cmd_sync_queue(hdev, set_le_sync, cmd, 2637 set_le_complete); 2638 2639 if (err < 0) { 2640 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE, 2641 MGMT_STATUS_FAILED); 2642 2643 if (cmd) 2644 mgmt_pending_remove(cmd); 2645 } 2646 2647 unlock: 2648 hci_dev_unlock(hdev); 2649 return err; 2650 } 2651 2652 static int send_hci_cmd_sync(struct hci_dev *hdev, void *data) 2653 { 2654 struct mgmt_pending_cmd *cmd = data; 2655 struct mgmt_cp_hci_cmd_sync *cp = cmd->param; 2656 struct sk_buff *skb; 2657 2658 skb = __hci_cmd_sync_ev(hdev, le16_to_cpu(cp->opcode), 2659 le16_to_cpu(cp->params_len), cp->params, 2660 cp->event, cp->timeout ? 2661 secs_to_jiffies(cp->timeout) : 2662 HCI_CMD_TIMEOUT); 2663 if (IS_ERR(skb)) { 2664 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_HCI_CMD_SYNC, 2665 mgmt_status(PTR_ERR(skb))); 2666 return 0; 2667 } 2668 2669 mgmt_cmd_complete(cmd->sk, hdev->id, MGMT_OP_HCI_CMD_SYNC, 0, 2670 skb->data, skb->len); 2671 2672 kfree_skb(skb); 2673 2674 return 0; 2675 } 2676 2677 static void send_hci_cmd_sync_destroy(struct hci_dev *hdev, void *data, int err) 2678 { 2679 mgmt_pending_free(data); 2680 } 2681 2682 static int mgmt_hci_cmd_sync(struct sock *sk, struct hci_dev *hdev, 2683 void *data, u16 len) 2684 { 2685 struct mgmt_cp_hci_cmd_sync *cp = data; 2686 struct mgmt_pending_cmd *cmd; 2687 int err; 2688 2689 if (len != (offsetof(struct mgmt_cp_hci_cmd_sync, params) + 2690 le16_to_cpu(cp->params_len))) 2691 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_HCI_CMD_SYNC, 2692 MGMT_STATUS_INVALID_PARAMS); 2693 2694 /* The HCI command header carries the parameter length in a u8, a 2695 * larger value would be truncated there while the parameters are 2696 * still appended to the frame in full. 2697 */ 2698 if (le16_to_cpu(cp->params_len) > U8_MAX) 2699 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_HCI_CMD_SYNC, 2700 MGMT_STATUS_INVALID_PARAMS); 2701 2702 hci_dev_lock(hdev); 2703 cmd = mgmt_pending_new(sk, MGMT_OP_HCI_CMD_SYNC, hdev, data, len); 2704 if (!cmd) 2705 err = -ENOMEM; 2706 else 2707 err = hci_cmd_sync_queue(hdev, send_hci_cmd_sync, cmd, 2708 send_hci_cmd_sync_destroy); 2709 2710 if (err < 0) { 2711 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_HCI_CMD_SYNC, 2712 MGMT_STATUS_FAILED); 2713 2714 if (cmd) 2715 mgmt_pending_free(cmd); 2716 } 2717 2718 hci_dev_unlock(hdev); 2719 return err; 2720 } 2721 2722 /* This is a helper function to test for pending mgmt commands that can 2723 * cause CoD or EIR HCI commands. We can only allow one such pending 2724 * mgmt command at a time since otherwise we cannot easily track what 2725 * the current values are, will be, and based on that calculate if a new 2726 * HCI command needs to be sent and if yes with what value. 2727 */ 2728 static bool pending_eir_or_class(struct hci_dev *hdev) 2729 { 2730 struct mgmt_pending_cmd *cmd; 2731 bool pending = false; 2732 2733 mutex_lock(&hdev->mgmt_pending_lock); 2734 2735 list_for_each_entry(cmd, &hdev->mgmt_pending, list) { 2736 switch (cmd->opcode) { 2737 case MGMT_OP_ADD_UUID: 2738 case MGMT_OP_REMOVE_UUID: 2739 case MGMT_OP_SET_DEV_CLASS: 2740 case MGMT_OP_SET_LOCAL_NAME: 2741 case MGMT_OP_SET_POWERED: 2742 pending = true; 2743 break; 2744 } 2745 2746 if (pending) 2747 break; 2748 } 2749 2750 mutex_unlock(&hdev->mgmt_pending_lock); 2751 2752 return pending; 2753 } 2754 2755 static const u8 bluetooth_base_uuid[] = { 2756 0xfb, 0x34, 0x9b, 0x5f, 0x80, 0x00, 0x00, 0x80, 2757 0x00, 0x10, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 2758 }; 2759 2760 static u8 get_uuid_size(const u8 *uuid) 2761 { 2762 u32 val; 2763 2764 if (memcmp(uuid, bluetooth_base_uuid, 12)) 2765 return 128; 2766 2767 val = get_unaligned_le32(&uuid[12]); 2768 if (val > 0xffff) 2769 return 32; 2770 2771 return 16; 2772 } 2773 2774 static void mgmt_class_complete(struct hci_dev *hdev, void *data, int err) 2775 { 2776 struct mgmt_pending_cmd *cmd = data; 2777 2778 bt_dev_dbg(hdev, "err %d", err); 2779 2780 mgmt_cmd_complete(cmd->sk, cmd->hdev->id, cmd->opcode, 2781 mgmt_status(err), hdev->dev_class, 3); 2782 2783 mgmt_pending_free(cmd); 2784 } 2785 2786 static int add_uuid_sync(struct hci_dev *hdev, void *data) 2787 { 2788 int err; 2789 2790 err = hci_update_class_sync(hdev); 2791 if (err) 2792 return err; 2793 2794 return hci_update_eir_sync(hdev); 2795 } 2796 2797 static int add_uuid(struct sock *sk, struct hci_dev *hdev, void *data, u16 len) 2798 { 2799 struct mgmt_cp_add_uuid *cp = data; 2800 struct mgmt_pending_cmd *cmd; 2801 struct bt_uuid *uuid; 2802 int err; 2803 2804 bt_dev_dbg(hdev, "sock %p", sk); 2805 2806 hci_dev_lock(hdev); 2807 2808 if (pending_eir_or_class(hdev)) { 2809 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_UUID, 2810 MGMT_STATUS_BUSY); 2811 goto failed; 2812 } 2813 2814 uuid = kmalloc_obj(*uuid); 2815 if (!uuid) { 2816 err = -ENOMEM; 2817 goto failed; 2818 } 2819 2820 memcpy(uuid->uuid, cp->uuid, 16); 2821 uuid->svc_hint = cp->svc_hint; 2822 uuid->size = get_uuid_size(cp->uuid); 2823 2824 list_add_tail(&uuid->list, &hdev->uuids); 2825 2826 cmd = mgmt_pending_new(sk, MGMT_OP_ADD_UUID, hdev, data, len); 2827 if (!cmd) { 2828 err = -ENOMEM; 2829 goto failed; 2830 } 2831 2832 /* MGMT_OP_ADD_UUID don't require adapter the UP/Running so use 2833 * hci_cmd_sync_submit instead of hci_cmd_sync_queue. 2834 */ 2835 err = hci_cmd_sync_submit(hdev, add_uuid_sync, cmd, 2836 mgmt_class_complete); 2837 if (err < 0) { 2838 mgmt_pending_free(cmd); 2839 goto failed; 2840 } 2841 2842 failed: 2843 hci_dev_unlock(hdev); 2844 return err; 2845 } 2846 2847 static bool enable_service_cache(struct hci_dev *hdev) 2848 { 2849 if (!hdev_is_powered(hdev)) 2850 return false; 2851 2852 if (!hci_dev_test_and_set_flag(hdev, HCI_SERVICE_CACHE)) { 2853 queue_delayed_work(hdev->workqueue, &hdev->service_cache, 2854 CACHE_TIMEOUT); 2855 return true; 2856 } 2857 2858 return false; 2859 } 2860 2861 static int remove_uuid_sync(struct hci_dev *hdev, void *data) 2862 { 2863 int err; 2864 2865 err = hci_update_class_sync(hdev); 2866 if (err) 2867 return err; 2868 2869 return hci_update_eir_sync(hdev); 2870 } 2871 2872 static int remove_uuid(struct sock *sk, struct hci_dev *hdev, void *data, 2873 u16 len) 2874 { 2875 struct mgmt_cp_remove_uuid *cp = data; 2876 struct mgmt_pending_cmd *cmd; 2877 struct bt_uuid *match, *tmp; 2878 static const u8 bt_uuid_any[] = { 2879 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 2880 }; 2881 int err, found; 2882 2883 bt_dev_dbg(hdev, "sock %p", sk); 2884 2885 hci_dev_lock(hdev); 2886 2887 if (pending_eir_or_class(hdev)) { 2888 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID, 2889 MGMT_STATUS_BUSY); 2890 goto unlock; 2891 } 2892 2893 if (memcmp(cp->uuid, bt_uuid_any, 16) == 0) { 2894 hci_uuids_clear(hdev); 2895 2896 if (enable_service_cache(hdev)) { 2897 err = mgmt_cmd_complete(sk, hdev->id, 2898 MGMT_OP_REMOVE_UUID, 2899 0, hdev->dev_class, 3); 2900 goto unlock; 2901 } 2902 2903 goto update_class; 2904 } 2905 2906 found = 0; 2907 2908 list_for_each_entry_safe(match, tmp, &hdev->uuids, list) { 2909 if (memcmp(match->uuid, cp->uuid, 16) != 0) 2910 continue; 2911 2912 list_del(&match->list); 2913 kfree(match); 2914 found++; 2915 } 2916 2917 if (found == 0) { 2918 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID, 2919 MGMT_STATUS_INVALID_PARAMS); 2920 goto unlock; 2921 } 2922 2923 update_class: 2924 cmd = mgmt_pending_new(sk, MGMT_OP_REMOVE_UUID, hdev, data, len); 2925 if (!cmd) { 2926 err = -ENOMEM; 2927 goto unlock; 2928 } 2929 2930 /* MGMT_OP_REMOVE_UUID don't require adapter the UP/Running so use 2931 * hci_cmd_sync_submit instead of hci_cmd_sync_queue. 2932 */ 2933 err = hci_cmd_sync_submit(hdev, remove_uuid_sync, cmd, 2934 mgmt_class_complete); 2935 if (err < 0) 2936 mgmt_pending_free(cmd); 2937 2938 unlock: 2939 hci_dev_unlock(hdev); 2940 return err; 2941 } 2942 2943 static int set_class_sync(struct hci_dev *hdev, void *data) 2944 { 2945 int err = 0; 2946 2947 if (hci_dev_test_and_clear_flag(hdev, HCI_SERVICE_CACHE)) { 2948 cancel_delayed_work_sync(&hdev->service_cache); 2949 err = hci_update_eir_sync(hdev); 2950 } 2951 2952 if (err) 2953 return err; 2954 2955 return hci_update_class_sync(hdev); 2956 } 2957 2958 static int set_dev_class(struct sock *sk, struct hci_dev *hdev, void *data, 2959 u16 len) 2960 { 2961 struct mgmt_cp_set_dev_class *cp = data; 2962 struct mgmt_pending_cmd *cmd; 2963 int err; 2964 2965 bt_dev_dbg(hdev, "sock %p", sk); 2966 2967 if (!lmp_bredr_capable(hdev)) 2968 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 2969 MGMT_STATUS_NOT_SUPPORTED); 2970 2971 hci_dev_lock(hdev); 2972 2973 if (pending_eir_or_class(hdev)) { 2974 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 2975 MGMT_STATUS_BUSY); 2976 goto unlock; 2977 } 2978 2979 if ((cp->minor & 0x03) != 0 || (cp->major & 0xe0) != 0) { 2980 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 2981 MGMT_STATUS_INVALID_PARAMS); 2982 goto unlock; 2983 } 2984 2985 hdev->major_class = cp->major; 2986 hdev->minor_class = cp->minor; 2987 2988 if (!hdev_is_powered(hdev)) { 2989 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 0, 2990 hdev->dev_class, 3); 2991 goto unlock; 2992 } 2993 2994 cmd = mgmt_pending_new(sk, MGMT_OP_SET_DEV_CLASS, hdev, data, len); 2995 if (!cmd) { 2996 err = -ENOMEM; 2997 goto unlock; 2998 } 2999 3000 /* MGMT_OP_SET_DEV_CLASS don't require adapter the UP/Running so use 3001 * hci_cmd_sync_submit instead of hci_cmd_sync_queue. 3002 */ 3003 err = hci_cmd_sync_submit(hdev, set_class_sync, cmd, 3004 mgmt_class_complete); 3005 if (err < 0) 3006 mgmt_pending_free(cmd); 3007 3008 unlock: 3009 hci_dev_unlock(hdev); 3010 return err; 3011 } 3012 3013 static int load_link_keys(struct sock *sk, struct hci_dev *hdev, void *data, 3014 u16 len) 3015 { 3016 struct mgmt_cp_load_link_keys *cp = data; 3017 const u16 max_key_count = ((U16_MAX - sizeof(*cp)) / 3018 sizeof(struct mgmt_link_key_info)); 3019 u16 key_count, expected_len; 3020 bool changed; 3021 int i; 3022 3023 bt_dev_dbg(hdev, "sock %p", sk); 3024 3025 if (!lmp_bredr_capable(hdev)) 3026 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS, 3027 MGMT_STATUS_NOT_SUPPORTED); 3028 3029 key_count = __le16_to_cpu(cp->key_count); 3030 if (key_count > max_key_count) { 3031 bt_dev_err(hdev, "load_link_keys: too big key_count value %u", 3032 key_count); 3033 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS, 3034 MGMT_STATUS_INVALID_PARAMS); 3035 } 3036 3037 expected_len = struct_size(cp, keys, key_count); 3038 if (expected_len != len) { 3039 bt_dev_err(hdev, "load_link_keys: expected %u bytes, got %u bytes", 3040 expected_len, len); 3041 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS, 3042 MGMT_STATUS_INVALID_PARAMS); 3043 } 3044 3045 if (cp->debug_keys != 0x00 && cp->debug_keys != 0x01) 3046 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS, 3047 MGMT_STATUS_INVALID_PARAMS); 3048 3049 bt_dev_dbg(hdev, "debug_keys %u key_count %u", cp->debug_keys, 3050 key_count); 3051 3052 hci_dev_lock(hdev); 3053 3054 hci_link_keys_clear(hdev); 3055 3056 if (cp->debug_keys) 3057 changed = !hci_dev_test_and_set_flag(hdev, HCI_KEEP_DEBUG_KEYS); 3058 else 3059 changed = hci_dev_test_and_clear_flag(hdev, 3060 HCI_KEEP_DEBUG_KEYS); 3061 3062 if (changed) 3063 new_settings(hdev, NULL); 3064 3065 for (i = 0; i < key_count; i++) { 3066 struct mgmt_link_key_info *key = &cp->keys[i]; 3067 3068 if (hci_is_blocked_key(hdev, 3069 HCI_BLOCKED_KEY_TYPE_LINKKEY, 3070 key->val)) { 3071 bt_dev_warn(hdev, "Skipping blocked link key for %pMR", 3072 &key->addr.bdaddr); 3073 continue; 3074 } 3075 3076 if (key->addr.type != BDADDR_BREDR) { 3077 bt_dev_warn(hdev, 3078 "Invalid link address type %u for %pMR", 3079 key->addr.type, &key->addr.bdaddr); 3080 continue; 3081 } 3082 3083 if (key->type > 0x08) { 3084 bt_dev_warn(hdev, "Invalid link key type %u for %pMR", 3085 key->type, &key->addr.bdaddr); 3086 continue; 3087 } 3088 3089 /* Always ignore debug keys and require a new pairing if 3090 * the user wants to use them. 3091 */ 3092 if (key->type == HCI_LK_DEBUG_COMBINATION) 3093 continue; 3094 3095 hci_add_link_key(hdev, NULL, &key->addr.bdaddr, key->val, 3096 key->type, key->pin_len, NULL); 3097 } 3098 3099 mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS, 0, NULL, 0); 3100 3101 hci_dev_unlock(hdev); 3102 3103 return 0; 3104 } 3105 3106 static int device_unpaired(struct hci_dev *hdev, bdaddr_t *bdaddr, 3107 u8 addr_type, struct sock *skip_sk) 3108 { 3109 struct mgmt_ev_device_unpaired ev; 3110 3111 bacpy(&ev.addr.bdaddr, bdaddr); 3112 ev.addr.type = addr_type; 3113 3114 return mgmt_event(MGMT_EV_DEVICE_UNPAIRED, hdev, &ev, sizeof(ev), 3115 skip_sk); 3116 } 3117 3118 static void unpair_device_complete(struct hci_dev *hdev, void *data, int err) 3119 { 3120 struct mgmt_pending_cmd *cmd = data; 3121 struct mgmt_cp_unpair_device *cp = cmd->param; 3122 3123 if (!err) 3124 device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, cmd->sk); 3125 3126 cmd->cmd_complete(cmd, err); 3127 mgmt_pending_free(cmd); 3128 } 3129 3130 static int unpair_device_sync(struct hci_dev *hdev, void *data) 3131 { 3132 struct mgmt_pending_cmd *cmd = data; 3133 struct mgmt_cp_unpair_device *cp = cmd->param; 3134 struct hci_conn *conn; 3135 3136 hci_dev_lock(hdev); 3137 3138 if (cp->addr.type == BDADDR_BREDR) 3139 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, 3140 &cp->addr.bdaddr); 3141 else 3142 conn = hci_conn_hash_lookup_le(hdev, &cp->addr.bdaddr, 3143 le_addr_type(cp->addr.type)); 3144 3145 if (conn) 3146 hci_conn_get(conn); 3147 3148 hci_dev_unlock(hdev); 3149 3150 if (!conn) 3151 return 0; 3152 3153 /* Disregard any possible error since the likes of hci_abort_conn_sync 3154 * will clean up the connection no matter the error. 3155 */ 3156 hci_abort_conn(conn, HCI_ERROR_REMOTE_USER_TERM); 3157 hci_conn_put(conn); 3158 3159 return 0; 3160 } 3161 3162 static int unpair_device(struct sock *sk, struct hci_dev *hdev, void *data, 3163 u16 len) 3164 { 3165 struct mgmt_cp_unpair_device *cp = data; 3166 struct mgmt_rp_unpair_device rp; 3167 struct hci_conn_params *params; 3168 struct mgmt_pending_cmd *cmd; 3169 struct hci_conn *conn; 3170 u8 addr_type; 3171 int err; 3172 3173 memset(&rp, 0, sizeof(rp)); 3174 bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr); 3175 rp.addr.type = cp->addr.type; 3176 3177 if (!bdaddr_type_is_valid(cp->addr.type)) 3178 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE, 3179 MGMT_STATUS_INVALID_PARAMS, 3180 &rp, sizeof(rp)); 3181 3182 if (cp->disconnect != 0x00 && cp->disconnect != 0x01) 3183 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE, 3184 MGMT_STATUS_INVALID_PARAMS, 3185 &rp, sizeof(rp)); 3186 3187 hci_dev_lock(hdev); 3188 3189 if (!hdev_is_powered(hdev)) { 3190 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE, 3191 MGMT_STATUS_NOT_POWERED, &rp, 3192 sizeof(rp)); 3193 goto unlock; 3194 } 3195 3196 if (cp->addr.type == BDADDR_BREDR) { 3197 /* If disconnection is requested, then look up the 3198 * connection. If the remote device is connected, it 3199 * will be later used to terminate the link. 3200 * 3201 * Setting it to NULL explicitly will cause no 3202 * termination of the link. 3203 */ 3204 if (cp->disconnect) 3205 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, 3206 &cp->addr.bdaddr); 3207 else 3208 conn = NULL; 3209 3210 err = hci_remove_link_key(hdev, &cp->addr.bdaddr); 3211 if (err < 0) { 3212 err = mgmt_cmd_complete(sk, hdev->id, 3213 MGMT_OP_UNPAIR_DEVICE, 3214 MGMT_STATUS_NOT_PAIRED, &rp, 3215 sizeof(rp)); 3216 goto unlock; 3217 } 3218 3219 goto done; 3220 } 3221 3222 /* LE address type */ 3223 addr_type = le_addr_type(cp->addr.type); 3224 3225 /* Abort any ongoing SMP pairing. Removes ltk and irk if they exist. */ 3226 err = smp_cancel_and_remove_pairing(hdev, &cp->addr.bdaddr, addr_type); 3227 if (err < 0) { 3228 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE, 3229 MGMT_STATUS_NOT_PAIRED, &rp, 3230 sizeof(rp)); 3231 goto unlock; 3232 } 3233 3234 conn = hci_conn_hash_lookup_le(hdev, &cp->addr.bdaddr, addr_type); 3235 if (!conn) { 3236 hci_conn_params_del(hdev, &cp->addr.bdaddr, addr_type); 3237 goto done; 3238 } 3239 3240 3241 /* Defer clearing up the connection parameters until closing to 3242 * give a chance of keeping them if a repairing happens. 3243 */ 3244 set_bit(HCI_CONN_PARAM_REMOVAL_PEND, &conn->flags); 3245 3246 /* Disable auto-connection parameters if present */ 3247 params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr, addr_type); 3248 if (params) { 3249 if (params->explicit_connect) 3250 params->auto_connect = HCI_AUTO_CONN_EXPLICIT; 3251 else 3252 params->auto_connect = HCI_AUTO_CONN_DISABLED; 3253 } 3254 3255 /* If disconnection is not requested, then clear the connection 3256 * variable so that the link is not terminated. 3257 */ 3258 if (!cp->disconnect) 3259 conn = NULL; 3260 3261 done: 3262 /* If the connection variable is set, then termination of the 3263 * link is requested. 3264 */ 3265 if (!conn) { 3266 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE, 0, 3267 &rp, sizeof(rp)); 3268 device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, sk); 3269 goto unlock; 3270 } 3271 3272 cmd = mgmt_pending_new(sk, MGMT_OP_UNPAIR_DEVICE, hdev, cp, 3273 sizeof(*cp)); 3274 if (!cmd) { 3275 err = -ENOMEM; 3276 goto unlock; 3277 } 3278 3279 cmd->cmd_complete = addr_cmd_complete; 3280 3281 err = hci_cmd_sync_queue(hdev, unpair_device_sync, cmd, 3282 unpair_device_complete); 3283 if (err < 0) 3284 mgmt_pending_free(cmd); 3285 3286 unlock: 3287 hci_dev_unlock(hdev); 3288 return err; 3289 } 3290 3291 static void disconnect_complete(struct hci_dev *hdev, void *data, int err) 3292 { 3293 struct mgmt_pending_cmd *cmd = data; 3294 3295 cmd->cmd_complete(cmd, mgmt_status(err)); 3296 mgmt_pending_free(cmd); 3297 } 3298 3299 static int disconnect_sync(struct hci_dev *hdev, void *data) 3300 { 3301 struct mgmt_pending_cmd *cmd = data; 3302 struct mgmt_cp_disconnect *cp = cmd->param; 3303 struct hci_conn *conn; 3304 3305 hci_dev_lock(hdev); 3306 3307 if (cp->addr.type == BDADDR_BREDR) 3308 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, 3309 &cp->addr.bdaddr); 3310 else 3311 conn = hci_conn_hash_lookup_le(hdev, &cp->addr.bdaddr, 3312 le_addr_type(cp->addr.type)); 3313 3314 if (conn) 3315 hci_conn_get(conn); 3316 3317 hci_dev_unlock(hdev); 3318 3319 if (!conn) 3320 return -ENOTCONN; 3321 3322 /* Disregard any possible error since the likes of hci_abort_conn_sync 3323 * will clean up the connection no matter the error. 3324 */ 3325 hci_abort_conn(conn, HCI_ERROR_REMOTE_USER_TERM); 3326 hci_conn_put(conn); 3327 3328 return 0; 3329 } 3330 3331 static int disconnect(struct sock *sk, struct hci_dev *hdev, void *data, 3332 u16 len) 3333 { 3334 struct mgmt_cp_disconnect *cp = data; 3335 struct mgmt_rp_disconnect rp; 3336 struct mgmt_pending_cmd *cmd; 3337 int err; 3338 3339 bt_dev_dbg(hdev, "sock %p", sk); 3340 3341 memset(&rp, 0, sizeof(rp)); 3342 bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr); 3343 rp.addr.type = cp->addr.type; 3344 3345 if (!bdaddr_type_is_valid(cp->addr.type)) 3346 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT, 3347 MGMT_STATUS_INVALID_PARAMS, 3348 &rp, sizeof(rp)); 3349 3350 hci_dev_lock(hdev); 3351 3352 if (!test_bit(HCI_UP, &hdev->flags)) { 3353 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT, 3354 MGMT_STATUS_NOT_POWERED, &rp, 3355 sizeof(rp)); 3356 goto failed; 3357 } 3358 3359 cmd = mgmt_pending_new(sk, MGMT_OP_DISCONNECT, hdev, data, len); 3360 if (!cmd) { 3361 err = -ENOMEM; 3362 goto failed; 3363 } 3364 3365 cmd->cmd_complete = generic_cmd_complete; 3366 3367 err = hci_cmd_sync_queue(hdev, disconnect_sync, cmd, 3368 disconnect_complete); 3369 if (err < 0) 3370 mgmt_pending_free(cmd); 3371 3372 failed: 3373 hci_dev_unlock(hdev); 3374 return err; 3375 } 3376 3377 static u8 link_to_bdaddr(u8 link_type, u8 addr_type) 3378 { 3379 switch (link_type) { 3380 case CIS_LINK: 3381 case BIS_LINK: 3382 case PA_LINK: 3383 case LE_LINK: 3384 switch (addr_type) { 3385 case ADDR_LE_DEV_PUBLIC: 3386 return BDADDR_LE_PUBLIC; 3387 3388 default: 3389 /* Fallback to LE Random address type */ 3390 return BDADDR_LE_RANDOM; 3391 } 3392 3393 default: 3394 /* Fallback to BR/EDR type */ 3395 return BDADDR_BREDR; 3396 } 3397 } 3398 3399 static int get_connections(struct sock *sk, struct hci_dev *hdev, void *data, 3400 u16 data_len) 3401 { 3402 struct mgmt_rp_get_connections *rp; 3403 struct hci_conn *c; 3404 int err; 3405 u16 i; 3406 3407 bt_dev_dbg(hdev, "sock %p", sk); 3408 3409 hci_dev_lock(hdev); 3410 3411 if (!hdev_is_powered(hdev)) { 3412 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_CONNECTIONS, 3413 MGMT_STATUS_NOT_POWERED); 3414 goto unlock; 3415 } 3416 3417 i = 0; 3418 list_for_each_entry(c, &hdev->conn_hash.list, list) { 3419 if (test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags)) 3420 i++; 3421 } 3422 3423 rp = kmalloc_flex(*rp, addr, i); 3424 if (!rp) { 3425 err = -ENOMEM; 3426 goto unlock; 3427 } 3428 3429 i = 0; 3430 list_for_each_entry(c, &hdev->conn_hash.list, list) { 3431 if (!test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags)) 3432 continue; 3433 bacpy(&rp->addr[i].bdaddr, &c->dst); 3434 rp->addr[i].type = link_to_bdaddr(c->type, c->dst_type); 3435 if (c->type == SCO_LINK || c->type == ESCO_LINK) 3436 continue; 3437 i++; 3438 } 3439 3440 rp->conn_count = cpu_to_le16(i); 3441 3442 /* Recalculate length in case of filtered SCO connections, etc */ 3443 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONNECTIONS, 0, rp, 3444 struct_size(rp, addr, i)); 3445 3446 kfree(rp); 3447 3448 unlock: 3449 hci_dev_unlock(hdev); 3450 return err; 3451 } 3452 3453 static int send_pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev, 3454 struct mgmt_cp_pin_code_neg_reply *cp) 3455 { 3456 struct mgmt_pending_cmd *cmd; 3457 int err; 3458 3459 cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_NEG_REPLY, hdev, cp, 3460 sizeof(*cp)); 3461 if (!cmd) 3462 return -ENOMEM; 3463 3464 cmd->cmd_complete = addr_cmd_complete; 3465 3466 err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_NEG_REPLY, 3467 sizeof(cp->addr.bdaddr), &cp->addr.bdaddr); 3468 if (err < 0) 3469 mgmt_pending_remove(cmd); 3470 3471 return err; 3472 } 3473 3474 static int pin_code_reply(struct sock *sk, struct hci_dev *hdev, void *data, 3475 u16 len) 3476 { 3477 struct hci_conn *conn; 3478 struct mgmt_cp_pin_code_reply *cp = data; 3479 struct hci_cp_pin_code_reply reply; 3480 struct mgmt_pending_cmd *cmd; 3481 int err; 3482 3483 bt_dev_dbg(hdev, "sock %p", sk); 3484 3485 hci_dev_lock(hdev); 3486 3487 if (!hdev_is_powered(hdev)) { 3488 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY, 3489 MGMT_STATUS_NOT_POWERED); 3490 goto failed; 3491 } 3492 3493 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->addr.bdaddr); 3494 if (!conn) { 3495 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY, 3496 MGMT_STATUS_NOT_CONNECTED); 3497 goto failed; 3498 } 3499 3500 if (conn->pending_sec_level == BT_SECURITY_HIGH && cp->pin_len != 16) { 3501 struct mgmt_cp_pin_code_neg_reply ncp; 3502 3503 memcpy(&ncp.addr, &cp->addr, sizeof(ncp.addr)); 3504 3505 bt_dev_err(hdev, "PIN code is not 16 bytes long"); 3506 3507 err = send_pin_code_neg_reply(sk, hdev, &ncp); 3508 if (err >= 0) 3509 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY, 3510 MGMT_STATUS_INVALID_PARAMS); 3511 3512 goto failed; 3513 } 3514 3515 cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_REPLY, hdev, data, len); 3516 if (!cmd) { 3517 err = -ENOMEM; 3518 goto failed; 3519 } 3520 3521 cmd->cmd_complete = addr_cmd_complete; 3522 3523 bacpy(&reply.bdaddr, &cp->addr.bdaddr); 3524 reply.pin_len = cp->pin_len; 3525 memcpy(reply.pin_code, cp->pin_code, sizeof(reply.pin_code)); 3526 3527 err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_REPLY, sizeof(reply), &reply); 3528 if (err < 0) 3529 mgmt_pending_remove(cmd); 3530 3531 failed: 3532 hci_dev_unlock(hdev); 3533 return err; 3534 } 3535 3536 static int set_io_capability(struct sock *sk, struct hci_dev *hdev, void *data, 3537 u16 len) 3538 { 3539 struct mgmt_cp_set_io_capability *cp = data; 3540 3541 bt_dev_dbg(hdev, "sock %p", sk); 3542 3543 if (cp->io_capability > SMP_IO_KEYBOARD_DISPLAY) 3544 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_IO_CAPABILITY, 3545 MGMT_STATUS_INVALID_PARAMS); 3546 3547 hci_dev_lock(hdev); 3548 3549 hdev->io_capability = cp->io_capability; 3550 3551 bt_dev_dbg(hdev, "IO capability set to 0x%02x", hdev->io_capability); 3552 3553 hci_dev_unlock(hdev); 3554 3555 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_IO_CAPABILITY, 0, 3556 NULL, 0); 3557 } 3558 3559 static struct mgmt_pending_cmd *remove_pairing(struct hci_conn *conn) 3560 { 3561 struct hci_dev *hdev = conn->hdev; 3562 struct mgmt_pending_cmd *cmd; 3563 3564 mutex_lock(&hdev->mgmt_pending_lock); 3565 3566 list_for_each_entry(cmd, &hdev->mgmt_pending, list) { 3567 if (cmd->opcode != MGMT_OP_PAIR_DEVICE) 3568 continue; 3569 3570 if (cmd->user_data != conn) 3571 continue; 3572 3573 list_del(&cmd->list); 3574 mutex_unlock(&hdev->mgmt_pending_lock); 3575 return cmd; 3576 } 3577 3578 mutex_unlock(&hdev->mgmt_pending_lock); 3579 3580 return NULL; 3581 } 3582 3583 static struct mgmt_pending_cmd *remove_pairing_by_addr(struct hci_dev *hdev, 3584 bdaddr_t *bdaddr) 3585 { 3586 struct mgmt_pending_cmd *cmd; 3587 struct hci_conn *conn; 3588 3589 mutex_lock(&hdev->mgmt_pending_lock); 3590 3591 list_for_each_entry(cmd, &hdev->mgmt_pending, list) { 3592 if (cmd->opcode != MGMT_OP_PAIR_DEVICE) 3593 continue; 3594 3595 conn = cmd->user_data; 3596 if (bacmp(bdaddr, &conn->dst) != 0) 3597 continue; 3598 3599 list_del(&cmd->list); 3600 mutex_unlock(&hdev->mgmt_pending_lock); 3601 return cmd; 3602 } 3603 3604 mutex_unlock(&hdev->mgmt_pending_lock); 3605 3606 return NULL; 3607 } 3608 3609 static int pairing_complete(struct mgmt_pending_cmd *cmd, u8 status) 3610 { 3611 struct mgmt_rp_pair_device rp; 3612 struct hci_conn *conn = cmd->user_data; 3613 int err; 3614 3615 bacpy(&rp.addr.bdaddr, &conn->dst); 3616 rp.addr.type = link_to_bdaddr(conn->type, conn->dst_type); 3617 3618 err = mgmt_cmd_complete(cmd->sk, cmd->hdev->id, MGMT_OP_PAIR_DEVICE, 3619 status, &rp, sizeof(rp)); 3620 3621 /* So we don't get further callbacks for this connection */ 3622 conn->connect_cfm_cb = NULL; 3623 conn->security_cfm_cb = NULL; 3624 conn->disconn_cfm_cb = NULL; 3625 3626 hci_conn_drop(conn); 3627 3628 /* The device is paired so there is no need to remove 3629 * its connection parameters anymore. 3630 */ 3631 clear_bit(HCI_CONN_PARAM_REMOVAL_PEND, &conn->flags); 3632 3633 hci_conn_put(conn); 3634 3635 return err; 3636 } 3637 3638 void mgmt_smp_complete(struct hci_conn *conn, bool complete) 3639 { 3640 u8 status = complete ? MGMT_STATUS_SUCCESS : MGMT_STATUS_FAILED; 3641 struct mgmt_pending_cmd *cmd; 3642 3643 cmd = remove_pairing(conn); 3644 if (cmd) { 3645 cmd->cmd_complete(cmd, status); 3646 mgmt_pending_free(cmd); 3647 } 3648 } 3649 3650 static void pairing_complete_cb(struct hci_conn *conn, u8 status) 3651 { 3652 struct mgmt_pending_cmd *cmd; 3653 3654 BT_DBG("status %u", status); 3655 3656 cmd = remove_pairing(conn); 3657 if (!cmd) { 3658 BT_DBG("Unable to find a pending command"); 3659 return; 3660 } 3661 3662 cmd->cmd_complete(cmd, mgmt_status(status)); 3663 mgmt_pending_free(cmd); 3664 } 3665 3666 static void le_pairing_complete_cb(struct hci_conn *conn, u8 status) 3667 { 3668 struct mgmt_pending_cmd *cmd; 3669 3670 BT_DBG("status %u", status); 3671 3672 if (!status) 3673 return; 3674 3675 cmd = remove_pairing(conn); 3676 if (!cmd) { 3677 BT_DBG("Unable to find a pending command"); 3678 return; 3679 } 3680 3681 cmd->cmd_complete(cmd, mgmt_status(status)); 3682 mgmt_pending_free(cmd); 3683 } 3684 3685 static int pair_device(struct sock *sk, struct hci_dev *hdev, void *data, 3686 u16 len) 3687 { 3688 struct mgmt_cp_pair_device *cp = data; 3689 struct mgmt_rp_pair_device rp; 3690 struct mgmt_pending_cmd *cmd; 3691 u8 sec_level, auth_type; 3692 struct hci_conn *conn; 3693 int err; 3694 3695 bt_dev_dbg(hdev, "sock %p", sk); 3696 3697 memset(&rp, 0, sizeof(rp)); 3698 bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr); 3699 rp.addr.type = cp->addr.type; 3700 3701 if (!bdaddr_type_is_valid(cp->addr.type)) 3702 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE, 3703 MGMT_STATUS_INVALID_PARAMS, 3704 &rp, sizeof(rp)); 3705 3706 if (cp->io_cap > SMP_IO_KEYBOARD_DISPLAY) 3707 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE, 3708 MGMT_STATUS_INVALID_PARAMS, 3709 &rp, sizeof(rp)); 3710 3711 hci_dev_lock(hdev); 3712 3713 if (!hdev_is_powered(hdev)) { 3714 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE, 3715 MGMT_STATUS_NOT_POWERED, &rp, 3716 sizeof(rp)); 3717 goto unlock; 3718 } 3719 3720 if (hci_bdaddr_is_paired(hdev, &cp->addr.bdaddr, cp->addr.type)) { 3721 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE, 3722 MGMT_STATUS_ALREADY_PAIRED, &rp, 3723 sizeof(rp)); 3724 goto unlock; 3725 } 3726 3727 sec_level = BT_SECURITY_MEDIUM; 3728 auth_type = HCI_AT_DEDICATED_BONDING; 3729 3730 if (cp->addr.type == BDADDR_BREDR) { 3731 conn = hci_connect_acl(hdev, &cp->addr.bdaddr, sec_level, 3732 auth_type, CONN_REASON_PAIR_DEVICE, 3733 HCI_ACL_CONN_TIMEOUT); 3734 } else { 3735 u8 addr_type = le_addr_type(cp->addr.type); 3736 struct hci_conn_params *p; 3737 3738 /* When pairing a new device, it is expected to remember 3739 * this device for future connections. Adding the connection 3740 * parameter information ahead of time allows tracking 3741 * of the peripheral preferred values and will speed up any 3742 * further connection establishment. 3743 * 3744 * If connection parameters already exist, then they 3745 * will be kept and this function does nothing. 3746 */ 3747 p = hci_conn_params_add(hdev, &cp->addr.bdaddr, addr_type); 3748 if (!p) { 3749 err = -EIO; 3750 goto unlock; 3751 } 3752 3753 if (p->auto_connect == HCI_AUTO_CONN_EXPLICIT) 3754 p->auto_connect = HCI_AUTO_CONN_DISABLED; 3755 3756 conn = hci_connect_le_scan(hdev, &cp->addr.bdaddr, addr_type, 3757 sec_level, HCI_LE_CONN_TIMEOUT, 3758 CONN_REASON_PAIR_DEVICE); 3759 } 3760 3761 if (IS_ERR(conn)) { 3762 int status; 3763 3764 if (PTR_ERR(conn) == -EBUSY) 3765 status = MGMT_STATUS_BUSY; 3766 else if (PTR_ERR(conn) == -EOPNOTSUPP) 3767 status = MGMT_STATUS_NOT_SUPPORTED; 3768 else if (PTR_ERR(conn) == -ECONNREFUSED) 3769 status = MGMT_STATUS_REJECTED; 3770 else 3771 status = MGMT_STATUS_CONNECT_FAILED; 3772 3773 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE, 3774 status, &rp, sizeof(rp)); 3775 goto unlock; 3776 } 3777 3778 if (conn->connect_cfm_cb) { 3779 hci_conn_drop(conn); 3780 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE, 3781 MGMT_STATUS_BUSY, &rp, sizeof(rp)); 3782 goto unlock; 3783 } 3784 3785 cmd = mgmt_pending_add(sk, MGMT_OP_PAIR_DEVICE, hdev, data, len); 3786 if (!cmd) { 3787 err = -ENOMEM; 3788 hci_conn_drop(conn); 3789 goto unlock; 3790 } 3791 3792 cmd->cmd_complete = pairing_complete; 3793 3794 /* For LE, just connecting isn't a proof that the pairing finished */ 3795 if (cp->addr.type == BDADDR_BREDR) { 3796 conn->connect_cfm_cb = pairing_complete_cb; 3797 conn->security_cfm_cb = pairing_complete_cb; 3798 conn->disconn_cfm_cb = pairing_complete_cb; 3799 } else { 3800 conn->connect_cfm_cb = le_pairing_complete_cb; 3801 conn->security_cfm_cb = le_pairing_complete_cb; 3802 conn->disconn_cfm_cb = le_pairing_complete_cb; 3803 } 3804 3805 conn->io_capability = cp->io_cap; 3806 cmd->user_data = hci_conn_get(conn); 3807 3808 if ((conn->state == BT_CONNECTED || conn->state == BT_CONFIG) && 3809 hci_conn_security(conn, sec_level, auth_type, true)) { 3810 cmd->cmd_complete(cmd, 0); 3811 mgmt_pending_remove(cmd); 3812 } 3813 3814 err = 0; 3815 3816 unlock: 3817 hci_dev_unlock(hdev); 3818 return err; 3819 } 3820 3821 static int cancel_pair_device(struct sock *sk, struct hci_dev *hdev, void *data, 3822 u16 len) 3823 { 3824 struct mgmt_addr_info *addr = data; 3825 struct mgmt_pending_cmd *cmd; 3826 struct hci_conn *conn; 3827 int err; 3828 3829 bt_dev_dbg(hdev, "sock %p", sk); 3830 3831 hci_dev_lock(hdev); 3832 3833 if (!hdev_is_powered(hdev)) { 3834 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE, 3835 MGMT_STATUS_NOT_POWERED); 3836 goto unlock; 3837 } 3838 3839 cmd = remove_pairing_by_addr(hdev, &addr->bdaddr); 3840 if (!cmd) { 3841 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE, 3842 MGMT_STATUS_INVALID_PARAMS); 3843 goto unlock; 3844 } 3845 3846 conn = hci_conn_get(cmd->user_data); 3847 3848 cmd->cmd_complete(cmd, MGMT_STATUS_CANCELLED); 3849 mgmt_pending_free(cmd); 3850 3851 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE, 0, 3852 addr, sizeof(*addr)); 3853 3854 /* Since user doesn't want to proceed with the connection, abort any 3855 * ongoing pairing and then terminate the link if it was created 3856 * because of the pair device action. 3857 */ 3858 if (addr->type == BDADDR_BREDR) 3859 hci_remove_link_key(hdev, &addr->bdaddr); 3860 else 3861 smp_cancel_and_remove_pairing(hdev, &addr->bdaddr, 3862 le_addr_type(addr->type)); 3863 3864 if (conn->conn_reason == CONN_REASON_PAIR_DEVICE) 3865 hci_abort_conn(conn, HCI_ERROR_REMOTE_USER_TERM); 3866 3867 hci_conn_put(conn); 3868 3869 unlock: 3870 hci_dev_unlock(hdev); 3871 return err; 3872 } 3873 3874 static int user_pairing_resp(struct sock *sk, struct hci_dev *hdev, 3875 struct mgmt_addr_info *addr, u16 mgmt_op, 3876 u16 hci_op, __le32 passkey) 3877 { 3878 struct mgmt_pending_cmd *cmd; 3879 struct hci_conn *conn; 3880 int err; 3881 3882 hci_dev_lock(hdev); 3883 3884 if (!hdev_is_powered(hdev)) { 3885 err = mgmt_cmd_complete(sk, hdev->id, mgmt_op, 3886 MGMT_STATUS_NOT_POWERED, addr, 3887 sizeof(*addr)); 3888 goto done; 3889 } 3890 3891 if (addr->type == BDADDR_BREDR) 3892 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &addr->bdaddr); 3893 else 3894 conn = hci_conn_hash_lookup_le(hdev, &addr->bdaddr, 3895 le_addr_type(addr->type)); 3896 3897 if (!conn) { 3898 err = mgmt_cmd_complete(sk, hdev->id, mgmt_op, 3899 MGMT_STATUS_NOT_CONNECTED, addr, 3900 sizeof(*addr)); 3901 goto done; 3902 } 3903 3904 if (addr->type == BDADDR_LE_PUBLIC || addr->type == BDADDR_LE_RANDOM) { 3905 lockdep_assert_held(&conn->hdev->lock); 3906 3907 err = smp_user_confirm_reply(conn, mgmt_op, passkey); 3908 if (!err) 3909 err = mgmt_cmd_complete(sk, hdev->id, mgmt_op, 3910 MGMT_STATUS_SUCCESS, addr, 3911 sizeof(*addr)); 3912 else 3913 err = mgmt_cmd_complete(sk, hdev->id, mgmt_op, 3914 MGMT_STATUS_FAILED, addr, 3915 sizeof(*addr)); 3916 3917 goto done; 3918 } 3919 3920 cmd = mgmt_pending_add(sk, mgmt_op, hdev, addr, sizeof(*addr)); 3921 if (!cmd) { 3922 err = -ENOMEM; 3923 goto done; 3924 } 3925 3926 cmd->cmd_complete = addr_cmd_complete; 3927 3928 /* Continue with pairing via HCI */ 3929 if (hci_op == HCI_OP_USER_PASSKEY_REPLY) { 3930 struct hci_cp_user_passkey_reply cp; 3931 3932 bacpy(&cp.bdaddr, &addr->bdaddr); 3933 cp.passkey = passkey; 3934 err = hci_send_cmd(hdev, hci_op, sizeof(cp), &cp); 3935 } else 3936 err = hci_send_cmd(hdev, hci_op, sizeof(addr->bdaddr), 3937 &addr->bdaddr); 3938 3939 if (err < 0) 3940 mgmt_pending_remove(cmd); 3941 3942 done: 3943 hci_dev_unlock(hdev); 3944 return err; 3945 } 3946 3947 static int pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev, 3948 void *data, u16 len) 3949 { 3950 struct mgmt_cp_pin_code_neg_reply *cp = data; 3951 3952 bt_dev_dbg(hdev, "sock %p", sk); 3953 3954 return user_pairing_resp(sk, hdev, &cp->addr, 3955 MGMT_OP_PIN_CODE_NEG_REPLY, 3956 HCI_OP_PIN_CODE_NEG_REPLY, 0); 3957 } 3958 3959 static int user_confirm_reply(struct sock *sk, struct hci_dev *hdev, void *data, 3960 u16 len) 3961 { 3962 struct mgmt_cp_user_confirm_reply *cp = data; 3963 3964 bt_dev_dbg(hdev, "sock %p", sk); 3965 3966 if (len != sizeof(*cp)) 3967 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_USER_CONFIRM_REPLY, 3968 MGMT_STATUS_INVALID_PARAMS); 3969 3970 return user_pairing_resp(sk, hdev, &cp->addr, 3971 MGMT_OP_USER_CONFIRM_REPLY, 3972 HCI_OP_USER_CONFIRM_REPLY, 0); 3973 } 3974 3975 static int user_confirm_neg_reply(struct sock *sk, struct hci_dev *hdev, 3976 void *data, u16 len) 3977 { 3978 struct mgmt_cp_user_confirm_neg_reply *cp = data; 3979 3980 bt_dev_dbg(hdev, "sock %p", sk); 3981 3982 return user_pairing_resp(sk, hdev, &cp->addr, 3983 MGMT_OP_USER_CONFIRM_NEG_REPLY, 3984 HCI_OP_USER_CONFIRM_NEG_REPLY, 0); 3985 } 3986 3987 static int user_passkey_reply(struct sock *sk, struct hci_dev *hdev, void *data, 3988 u16 len) 3989 { 3990 struct mgmt_cp_user_passkey_reply *cp = data; 3991 3992 bt_dev_dbg(hdev, "sock %p", sk); 3993 3994 return user_pairing_resp(sk, hdev, &cp->addr, 3995 MGMT_OP_USER_PASSKEY_REPLY, 3996 HCI_OP_USER_PASSKEY_REPLY, cp->passkey); 3997 } 3998 3999 static int user_passkey_neg_reply(struct sock *sk, struct hci_dev *hdev, 4000 void *data, u16 len) 4001 { 4002 struct mgmt_cp_user_passkey_neg_reply *cp = data; 4003 4004 bt_dev_dbg(hdev, "sock %p", sk); 4005 4006 return user_pairing_resp(sk, hdev, &cp->addr, 4007 MGMT_OP_USER_PASSKEY_NEG_REPLY, 4008 HCI_OP_USER_PASSKEY_NEG_REPLY, 0); 4009 } 4010 4011 static int adv_expire_sync(struct hci_dev *hdev, u32 flags) 4012 { 4013 struct adv_info *adv_instance; 4014 4015 adv_instance = hci_find_adv_instance(hdev, hdev->cur_adv_instance); 4016 if (!adv_instance) 4017 return 0; 4018 4019 /* stop if current instance doesn't need to be changed */ 4020 if (!(adv_instance->flags & flags)) 4021 return 0; 4022 4023 cancel_adv_timeout(hdev); 4024 4025 adv_instance = hci_get_next_instance(hdev, adv_instance->instance); 4026 if (!adv_instance) 4027 return 0; 4028 4029 hci_schedule_adv_instance_sync(hdev, adv_instance->instance, true); 4030 4031 return 0; 4032 } 4033 4034 static int name_changed_sync(struct hci_dev *hdev, void *data) 4035 { 4036 return adv_expire_sync(hdev, MGMT_ADV_FLAG_LOCAL_NAME); 4037 } 4038 4039 static void set_name_complete(struct hci_dev *hdev, void *data, int err) 4040 { 4041 struct mgmt_pending_cmd *cmd = data; 4042 struct mgmt_cp_set_local_name *cp; 4043 u8 status = mgmt_status(err); 4044 4045 bt_dev_dbg(hdev, "err %d", err); 4046 4047 if (err == -ECANCELED || !mgmt_pending_valid(hdev, cmd)) 4048 return; 4049 4050 cp = cmd->param; 4051 4052 if (status) { 4053 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 4054 status); 4055 } else { 4056 mgmt_cmd_complete(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0, 4057 cp, sizeof(*cp)); 4058 4059 if (hci_dev_test_flag(hdev, HCI_LE_ADV)) 4060 hci_cmd_sync_queue(hdev, name_changed_sync, NULL, NULL); 4061 } 4062 4063 mgmt_pending_free(cmd); 4064 } 4065 4066 static int set_name_sync(struct hci_dev *hdev, void *data) 4067 { 4068 struct mgmt_pending_cmd *cmd = data; 4069 struct mgmt_cp_set_local_name cp; 4070 4071 mutex_lock(&hdev->mgmt_pending_lock); 4072 4073 if (!__mgmt_pending_listed(hdev, cmd)) { 4074 mutex_unlock(&hdev->mgmt_pending_lock); 4075 return -ECANCELED; 4076 } 4077 4078 memcpy(&cp, cmd->param, sizeof(cp)); 4079 4080 mutex_unlock(&hdev->mgmt_pending_lock); 4081 4082 if (lmp_bredr_capable(hdev)) { 4083 hci_update_name_sync(hdev, cp.name); 4084 hci_update_eir_sync(hdev); 4085 } 4086 4087 /* The name is stored in the scan response data and so 4088 * no need to update the advertising data here. 4089 */ 4090 if (lmp_le_capable(hdev) && hci_dev_test_flag(hdev, HCI_ADVERTISING)) 4091 hci_update_scan_rsp_data_sync(hdev, hdev->cur_adv_instance); 4092 4093 return 0; 4094 } 4095 4096 static int set_local_name(struct sock *sk, struct hci_dev *hdev, void *data, 4097 u16 len) 4098 { 4099 struct mgmt_cp_set_local_name *cp = data; 4100 struct mgmt_pending_cmd *cmd; 4101 int err; 4102 4103 bt_dev_dbg(hdev, "sock %p", sk); 4104 4105 hci_dev_lock(hdev); 4106 4107 /* If the old values are the same as the new ones just return a 4108 * direct command complete event. 4109 */ 4110 if (!memcmp(hdev->dev_name, cp->name, sizeof(hdev->dev_name)) && 4111 !memcmp(hdev->short_name, cp->short_name, 4112 sizeof(hdev->short_name))) { 4113 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0, 4114 data, len); 4115 goto failed; 4116 } 4117 4118 if (hdev_is_powered(hdev) && pending_eir_or_class(hdev)) { 4119 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 4120 MGMT_STATUS_BUSY); 4121 goto failed; 4122 } 4123 4124 memcpy(hdev->short_name, cp->short_name, sizeof(hdev->short_name)); 4125 4126 if (!hdev_is_powered(hdev)) { 4127 memcpy(hdev->dev_name, cp->name, sizeof(hdev->dev_name)); 4128 4129 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0, 4130 data, len); 4131 if (err < 0) 4132 goto failed; 4133 4134 err = mgmt_limited_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, data, 4135 len, HCI_MGMT_LOCAL_NAME_EVENTS, sk); 4136 ext_info_changed(hdev, sk); 4137 4138 goto failed; 4139 } 4140 4141 cmd = mgmt_pending_add(sk, MGMT_OP_SET_LOCAL_NAME, hdev, data, len); 4142 if (!cmd) 4143 err = -ENOMEM; 4144 else 4145 err = hci_cmd_sync_queue(hdev, set_name_sync, cmd, 4146 set_name_complete); 4147 4148 if (err < 0) { 4149 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 4150 MGMT_STATUS_FAILED); 4151 4152 if (cmd) 4153 mgmt_pending_remove(cmd); 4154 4155 goto failed; 4156 } 4157 4158 memcpy(hdev->dev_name, cp->name, sizeof(hdev->dev_name)); 4159 4160 failed: 4161 hci_dev_unlock(hdev); 4162 return err; 4163 } 4164 4165 static int appearance_changed_sync(struct hci_dev *hdev, void *data) 4166 { 4167 return adv_expire_sync(hdev, MGMT_ADV_FLAG_APPEARANCE); 4168 } 4169 4170 static int set_appearance(struct sock *sk, struct hci_dev *hdev, void *data, 4171 u16 len) 4172 { 4173 struct mgmt_cp_set_appearance *cp = data; 4174 u16 appearance; 4175 int err; 4176 4177 bt_dev_dbg(hdev, "sock %p", sk); 4178 4179 if (!lmp_le_capable(hdev)) 4180 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_APPEARANCE, 4181 MGMT_STATUS_NOT_SUPPORTED); 4182 4183 appearance = le16_to_cpu(cp->appearance); 4184 4185 hci_dev_lock(hdev); 4186 4187 if (hdev->appearance != appearance) { 4188 hdev->appearance = appearance; 4189 4190 if (hci_dev_test_flag(hdev, HCI_LE_ADV)) 4191 hci_cmd_sync_queue(hdev, appearance_changed_sync, NULL, 4192 NULL); 4193 4194 ext_info_changed(hdev, sk); 4195 } 4196 4197 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_APPEARANCE, 0, NULL, 4198 0); 4199 4200 hci_dev_unlock(hdev); 4201 4202 return err; 4203 } 4204 4205 static int get_phy_configuration(struct sock *sk, struct hci_dev *hdev, 4206 void *data, u16 len) 4207 { 4208 struct mgmt_rp_get_phy_configuration rp; 4209 4210 bt_dev_dbg(hdev, "sock %p", sk); 4211 4212 hci_dev_lock(hdev); 4213 4214 memset(&rp, 0, sizeof(rp)); 4215 4216 rp.supported_phys = cpu_to_le32(get_supported_phys(hdev)); 4217 rp.selected_phys = cpu_to_le32(get_selected_phys(hdev)); 4218 rp.configurable_phys = cpu_to_le32(get_configurable_phys(hdev)); 4219 4220 hci_dev_unlock(hdev); 4221 4222 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_PHY_CONFIGURATION, 0, 4223 &rp, sizeof(rp)); 4224 } 4225 4226 int mgmt_phy_configuration_changed(struct hci_dev *hdev, struct sock *skip) 4227 { 4228 struct mgmt_ev_phy_configuration_changed ev; 4229 4230 memset(&ev, 0, sizeof(ev)); 4231 4232 ev.selected_phys = cpu_to_le32(get_selected_phys(hdev)); 4233 4234 return mgmt_event(MGMT_EV_PHY_CONFIGURATION_CHANGED, hdev, &ev, 4235 sizeof(ev), skip); 4236 } 4237 4238 static void set_default_phy_complete(struct hci_dev *hdev, void *data, int err) 4239 { 4240 struct mgmt_pending_cmd *cmd = data; 4241 struct sk_buff *skb; 4242 u8 status = mgmt_status(err); 4243 4244 skb = cmd->skb; 4245 4246 if (!status) { 4247 if (!skb) 4248 status = MGMT_STATUS_FAILED; 4249 else if (IS_ERR(skb)) 4250 status = mgmt_status(PTR_ERR(skb)); 4251 else 4252 status = mgmt_status(skb->data[0]); 4253 } 4254 4255 bt_dev_dbg(hdev, "status %d", status); 4256 4257 if (status) { 4258 mgmt_cmd_status(cmd->sk, hdev->id, 4259 MGMT_OP_SET_PHY_CONFIGURATION, status); 4260 } else { 4261 mgmt_cmd_complete(cmd->sk, hdev->id, 4262 MGMT_OP_SET_PHY_CONFIGURATION, 0, 4263 NULL, 0); 4264 4265 mgmt_phy_configuration_changed(hdev, cmd->sk); 4266 } 4267 4268 if (skb && !IS_ERR(skb)) 4269 kfree_skb(skb); 4270 4271 mgmt_pending_free(cmd); 4272 } 4273 4274 static int set_default_phy_sync(struct hci_dev *hdev, void *data) 4275 { 4276 struct mgmt_pending_cmd *cmd = data; 4277 struct mgmt_cp_set_phy_configuration *cp = cmd->param; 4278 struct hci_cp_le_set_default_phy cp_phy; 4279 u32 selected_phys; 4280 4281 selected_phys = __le32_to_cpu(cp->selected_phys); 4282 4283 memset(&cp_phy, 0, sizeof(cp_phy)); 4284 4285 if (!(selected_phys & MGMT_PHY_LE_TX_MASK)) 4286 cp_phy.all_phys |= 0x01; 4287 4288 if (!(selected_phys & MGMT_PHY_LE_RX_MASK)) 4289 cp_phy.all_phys |= 0x02; 4290 4291 if (selected_phys & MGMT_PHY_LE_1M_TX) 4292 cp_phy.tx_phys |= HCI_LE_SET_PHY_1M; 4293 4294 if (selected_phys & MGMT_PHY_LE_2M_TX) 4295 cp_phy.tx_phys |= HCI_LE_SET_PHY_2M; 4296 4297 if (selected_phys & MGMT_PHY_LE_CODED_TX) 4298 cp_phy.tx_phys |= HCI_LE_SET_PHY_CODED; 4299 4300 if (selected_phys & MGMT_PHY_LE_1M_RX) 4301 cp_phy.rx_phys |= HCI_LE_SET_PHY_1M; 4302 4303 if (selected_phys & MGMT_PHY_LE_2M_RX) 4304 cp_phy.rx_phys |= HCI_LE_SET_PHY_2M; 4305 4306 if (selected_phys & MGMT_PHY_LE_CODED_RX) 4307 cp_phy.rx_phys |= HCI_LE_SET_PHY_CODED; 4308 4309 cmd->skb = __hci_cmd_sync(hdev, HCI_OP_LE_SET_DEFAULT_PHY, 4310 sizeof(cp_phy), &cp_phy, HCI_CMD_TIMEOUT); 4311 4312 return 0; 4313 } 4314 4315 static int set_phy_configuration(struct sock *sk, struct hci_dev *hdev, 4316 void *data, u16 len) 4317 { 4318 struct mgmt_cp_set_phy_configuration *cp = data; 4319 struct mgmt_pending_cmd *cmd; 4320 u32 selected_phys, configurable_phys, supported_phys, unconfigure_phys; 4321 u16 pkt_type = (HCI_DH1 | HCI_DM1); 4322 bool changed = false; 4323 int err; 4324 4325 bt_dev_dbg(hdev, "sock %p", sk); 4326 4327 configurable_phys = get_configurable_phys(hdev); 4328 supported_phys = get_supported_phys(hdev); 4329 selected_phys = __le32_to_cpu(cp->selected_phys); 4330 4331 if (selected_phys & ~supported_phys) 4332 return mgmt_cmd_status(sk, hdev->id, 4333 MGMT_OP_SET_PHY_CONFIGURATION, 4334 MGMT_STATUS_INVALID_PARAMS); 4335 4336 unconfigure_phys = supported_phys & ~configurable_phys; 4337 4338 if ((selected_phys & unconfigure_phys) != unconfigure_phys) 4339 return mgmt_cmd_status(sk, hdev->id, 4340 MGMT_OP_SET_PHY_CONFIGURATION, 4341 MGMT_STATUS_INVALID_PARAMS); 4342 4343 if (selected_phys == get_selected_phys(hdev)) 4344 return mgmt_cmd_complete(sk, hdev->id, 4345 MGMT_OP_SET_PHY_CONFIGURATION, 4346 0, NULL, 0); 4347 4348 hci_dev_lock(hdev); 4349 4350 if (!hdev_is_powered(hdev)) { 4351 err = mgmt_cmd_status(sk, hdev->id, 4352 MGMT_OP_SET_PHY_CONFIGURATION, 4353 MGMT_STATUS_REJECTED); 4354 goto unlock; 4355 } 4356 4357 if (pending_find(MGMT_OP_SET_PHY_CONFIGURATION, hdev)) { 4358 err = mgmt_cmd_status(sk, hdev->id, 4359 MGMT_OP_SET_PHY_CONFIGURATION, 4360 MGMT_STATUS_BUSY); 4361 goto unlock; 4362 } 4363 4364 if (selected_phys & MGMT_PHY_BR_1M_3SLOT) 4365 pkt_type |= (HCI_DH3 | HCI_DM3); 4366 else 4367 pkt_type &= ~(HCI_DH3 | HCI_DM3); 4368 4369 if (selected_phys & MGMT_PHY_BR_1M_5SLOT) 4370 pkt_type |= (HCI_DH5 | HCI_DM5); 4371 else 4372 pkt_type &= ~(HCI_DH5 | HCI_DM5); 4373 4374 if (selected_phys & MGMT_PHY_EDR_2M_1SLOT) 4375 pkt_type &= ~HCI_2DH1; 4376 else 4377 pkt_type |= HCI_2DH1; 4378 4379 if (selected_phys & MGMT_PHY_EDR_2M_3SLOT) 4380 pkt_type &= ~HCI_2DH3; 4381 else 4382 pkt_type |= HCI_2DH3; 4383 4384 if (selected_phys & MGMT_PHY_EDR_2M_5SLOT) 4385 pkt_type &= ~HCI_2DH5; 4386 else 4387 pkt_type |= HCI_2DH5; 4388 4389 if (selected_phys & MGMT_PHY_EDR_3M_1SLOT) 4390 pkt_type &= ~HCI_3DH1; 4391 else 4392 pkt_type |= HCI_3DH1; 4393 4394 if (selected_phys & MGMT_PHY_EDR_3M_3SLOT) 4395 pkt_type &= ~HCI_3DH3; 4396 else 4397 pkt_type |= HCI_3DH3; 4398 4399 if (selected_phys & MGMT_PHY_EDR_3M_5SLOT) 4400 pkt_type &= ~HCI_3DH5; 4401 else 4402 pkt_type |= HCI_3DH5; 4403 4404 if (pkt_type != hdev->pkt_type) { 4405 hdev->pkt_type = pkt_type; 4406 changed = true; 4407 } 4408 4409 if ((selected_phys & MGMT_PHY_LE_MASK) == 4410 (get_selected_phys(hdev) & MGMT_PHY_LE_MASK)) { 4411 if (changed) 4412 mgmt_phy_configuration_changed(hdev, sk); 4413 4414 err = mgmt_cmd_complete(sk, hdev->id, 4415 MGMT_OP_SET_PHY_CONFIGURATION, 4416 0, NULL, 0); 4417 4418 goto unlock; 4419 } 4420 4421 cmd = mgmt_pending_new(sk, MGMT_OP_SET_PHY_CONFIGURATION, hdev, data, 4422 len); 4423 if (!cmd) 4424 err = -ENOMEM; 4425 else 4426 err = hci_cmd_sync_queue(hdev, set_default_phy_sync, cmd, 4427 set_default_phy_complete); 4428 4429 if (err < 0) { 4430 err = mgmt_cmd_status(sk, hdev->id, 4431 MGMT_OP_SET_PHY_CONFIGURATION, 4432 MGMT_STATUS_FAILED); 4433 4434 if (cmd) 4435 mgmt_pending_remove(cmd); 4436 } 4437 4438 unlock: 4439 hci_dev_unlock(hdev); 4440 4441 return err; 4442 } 4443 4444 static int set_blocked_keys(struct sock *sk, struct hci_dev *hdev, void *data, 4445 u16 len) 4446 { 4447 int err = MGMT_STATUS_SUCCESS; 4448 struct mgmt_cp_set_blocked_keys *keys = data; 4449 const u16 max_key_count = ((U16_MAX - sizeof(*keys)) / 4450 sizeof(struct mgmt_blocked_key_info)); 4451 u16 key_count, expected_len; 4452 int i; 4453 4454 bt_dev_dbg(hdev, "sock %p", sk); 4455 4456 key_count = __le16_to_cpu(keys->key_count); 4457 if (key_count > max_key_count) { 4458 bt_dev_err(hdev, "too big key_count value %u", key_count); 4459 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BLOCKED_KEYS, 4460 MGMT_STATUS_INVALID_PARAMS); 4461 } 4462 4463 expected_len = struct_size(keys, keys, key_count); 4464 if (expected_len != len) { 4465 bt_dev_err(hdev, "expected %u bytes, got %u bytes", 4466 expected_len, len); 4467 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BLOCKED_KEYS, 4468 MGMT_STATUS_INVALID_PARAMS); 4469 } 4470 4471 hci_dev_lock(hdev); 4472 4473 hci_blocked_keys_clear(hdev); 4474 4475 for (i = 0; i < key_count; ++i) { 4476 struct blocked_key *b = kzalloc_obj(*b); 4477 4478 if (!b) { 4479 err = MGMT_STATUS_NO_RESOURCES; 4480 break; 4481 } 4482 4483 b->type = keys->keys[i].type; 4484 memcpy(b->val, keys->keys[i].val, sizeof(b->val)); 4485 list_add_rcu(&b->list, &hdev->blocked_keys); 4486 } 4487 hci_dev_unlock(hdev); 4488 4489 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_BLOCKED_KEYS, 4490 err, NULL, 0); 4491 } 4492 4493 static int set_wideband_speech(struct sock *sk, struct hci_dev *hdev, 4494 void *data, u16 len) 4495 { 4496 struct mgmt_mode *cp = data; 4497 int err; 4498 bool changed = false; 4499 4500 bt_dev_dbg(hdev, "sock %p", sk); 4501 4502 if (!hci_test_quirk(hdev, HCI_QUIRK_WIDEBAND_SPEECH_SUPPORTED)) 4503 return mgmt_cmd_status(sk, hdev->id, 4504 MGMT_OP_SET_WIDEBAND_SPEECH, 4505 MGMT_STATUS_NOT_SUPPORTED); 4506 4507 if (cp->val != 0x00 && cp->val != 0x01) 4508 return mgmt_cmd_status(sk, hdev->id, 4509 MGMT_OP_SET_WIDEBAND_SPEECH, 4510 MGMT_STATUS_INVALID_PARAMS); 4511 4512 hci_dev_lock(hdev); 4513 4514 if (hdev_is_powered(hdev) && 4515 !!cp->val != hci_dev_test_flag(hdev, 4516 HCI_WIDEBAND_SPEECH_ENABLED)) { 4517 err = mgmt_cmd_status(sk, hdev->id, 4518 MGMT_OP_SET_WIDEBAND_SPEECH, 4519 MGMT_STATUS_REJECTED); 4520 goto unlock; 4521 } 4522 4523 if (cp->val) 4524 changed = !hci_dev_test_and_set_flag(hdev, 4525 HCI_WIDEBAND_SPEECH_ENABLED); 4526 else 4527 changed = hci_dev_test_and_clear_flag(hdev, 4528 HCI_WIDEBAND_SPEECH_ENABLED); 4529 4530 err = send_settings_rsp(sk, MGMT_OP_SET_WIDEBAND_SPEECH, hdev); 4531 if (err < 0) 4532 goto unlock; 4533 4534 if (changed) 4535 err = new_settings(hdev, sk); 4536 4537 unlock: 4538 hci_dev_unlock(hdev); 4539 return err; 4540 } 4541 4542 static int read_controller_cap(struct sock *sk, struct hci_dev *hdev, 4543 void *data, u16 data_len) 4544 { 4545 char buf[20]; 4546 struct mgmt_rp_read_controller_cap *rp = (void *)buf; 4547 u16 cap_len = 0; 4548 u8 flags = 0; 4549 u8 tx_power_range[2]; 4550 4551 bt_dev_dbg(hdev, "sock %p", sk); 4552 4553 memset(&buf, 0, sizeof(buf)); 4554 4555 hci_dev_lock(hdev); 4556 4557 /* When the Read Simple Pairing Options command is supported, then 4558 * the remote public key validation is supported. 4559 * 4560 * Alternatively, when Microsoft extensions are available, they can 4561 * indicate support for public key validation as well. 4562 */ 4563 if ((hdev->commands[41] & 0x08) || msft_curve_validity(hdev)) 4564 flags |= 0x01; /* Remote public key validation (BR/EDR) */ 4565 4566 flags |= 0x02; /* Remote public key validation (LE) */ 4567 4568 /* When the Read Encryption Key Size command is supported, then the 4569 * encryption key size is enforced. 4570 */ 4571 if (hdev->commands[20] & 0x10) 4572 flags |= 0x04; /* Encryption key size enforcement (BR/EDR) */ 4573 4574 flags |= 0x08; /* Encryption key size enforcement (LE) */ 4575 4576 cap_len = eir_append_data(rp->cap, cap_len, MGMT_CAP_SEC_FLAGS, 4577 &flags, 1); 4578 4579 /* When the Read Simple Pairing Options command is supported, then 4580 * also max encryption key size information is provided. 4581 */ 4582 if (hdev->commands[41] & 0x08) 4583 cap_len = eir_append_le16(rp->cap, cap_len, 4584 MGMT_CAP_MAX_ENC_KEY_SIZE, 4585 hdev->max_enc_key_size); 4586 4587 cap_len = eir_append_le16(rp->cap, cap_len, 4588 MGMT_CAP_SMP_MAX_ENC_KEY_SIZE, 4589 SMP_MAX_ENC_KEY_SIZE); 4590 4591 /* Append the min/max LE tx power parameters if we were able to fetch 4592 * it from the controller 4593 */ 4594 if (hdev->commands[38] & 0x80) { 4595 memcpy(&tx_power_range[0], &hdev->min_le_tx_power, 1); 4596 memcpy(&tx_power_range[1], &hdev->max_le_tx_power, 1); 4597 cap_len = eir_append_data(rp->cap, cap_len, MGMT_CAP_LE_TX_PWR, 4598 tx_power_range, 2); 4599 } 4600 4601 rp->cap_len = cpu_to_le16(cap_len); 4602 4603 hci_dev_unlock(hdev); 4604 4605 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_CONTROLLER_CAP, 0, 4606 rp, sizeof(*rp) + cap_len); 4607 } 4608 4609 #ifdef CONFIG_BT_FEATURE_DEBUG 4610 /* d4992530-b9ec-469f-ab01-6c481c47da1c */ 4611 static const u8 debug_uuid[16] = { 4612 0x1c, 0xda, 0x47, 0x1c, 0x48, 0x6c, 0x01, 0xab, 4613 0x9f, 0x46, 0xec, 0xb9, 0x30, 0x25, 0x99, 0xd4, 4614 }; 4615 #endif 4616 4617 /* 330859bc-7506-492d-9370-9a6f0614037f */ 4618 static const u8 quality_report_uuid[16] = { 4619 0x7f, 0x03, 0x14, 0x06, 0x6f, 0x9a, 0x70, 0x93, 4620 0x2d, 0x49, 0x06, 0x75, 0xbc, 0x59, 0x08, 0x33, 4621 }; 4622 4623 /* a6695ace-ee7f-4fb9-881a-5fac66c629af */ 4624 static const u8 offload_codecs_uuid[16] = { 4625 0xaf, 0x29, 0xc6, 0x66, 0xac, 0x5f, 0x1a, 0x88, 4626 0xb9, 0x4f, 0x7f, 0xee, 0xce, 0x5a, 0x69, 0xa6, 4627 }; 4628 4629 /* 671b10b5-42c0-4696-9227-eb28d1b049d6 */ 4630 static const u8 le_simultaneous_roles_uuid[16] = { 4631 0xd6, 0x49, 0xb0, 0xd1, 0x28, 0xeb, 0x27, 0x92, 4632 0x96, 0x46, 0xc0, 0x42, 0xb5, 0x10, 0x1b, 0x67, 4633 }; 4634 4635 /* 6fbaf188-05e0-496a-9885-d6ddfdb4e03e */ 4636 static const u8 iso_socket_uuid[16] = { 4637 0x3e, 0xe0, 0xb4, 0xfd, 0xdd, 0xd6, 0x85, 0x98, 4638 0x6a, 0x49, 0xe0, 0x05, 0x88, 0xf1, 0xba, 0x6f, 4639 }; 4640 4641 /* 2ce463d7-7a03-4d8d-bf05-5f24e8f36e76 */ 4642 static const u8 mgmt_mesh_uuid[16] = { 4643 0x76, 0x6e, 0xf3, 0xe8, 0x24, 0x5f, 0x05, 0xbf, 4644 0x8d, 0x4d, 0x03, 0x7a, 0xd7, 0x63, 0xe4, 0x2c, 4645 }; 4646 4647 static int read_exp_features_info(struct sock *sk, struct hci_dev *hdev, 4648 void *data, u16 data_len) 4649 { 4650 struct mgmt_rp_read_exp_features_info *rp; 4651 size_t len; 4652 u16 idx = 0; 4653 u32 flags; 4654 int status; 4655 4656 bt_dev_dbg(hdev, "sock %p", sk); 4657 4658 /* Enough space for 7 features */ 4659 len = sizeof(*rp) + (sizeof(rp->features[0]) * 7); 4660 rp = kzalloc(len, GFP_KERNEL); 4661 if (!rp) 4662 return -ENOMEM; 4663 4664 #ifdef CONFIG_BT_FEATURE_DEBUG 4665 flags = bt_dbg_get() ? BIT(0) : 0; 4666 4667 memcpy(rp->features[idx].uuid, debug_uuid, 16); 4668 rp->features[idx].flags = cpu_to_le32(flags); 4669 idx++; 4670 #endif 4671 4672 if (hdev && hci_dev_le_state_simultaneous(hdev)) { 4673 if (hci_dev_test_flag(hdev, HCI_LE_SIMULTANEOUS_ROLES)) 4674 flags = BIT(0); 4675 else 4676 flags = 0; 4677 4678 memcpy(rp->features[idx].uuid, le_simultaneous_roles_uuid, 16); 4679 rp->features[idx].flags = cpu_to_le32(flags); 4680 idx++; 4681 } 4682 4683 if (hdev && (aosp_has_quality_report(hdev) || 4684 hdev->set_quality_report)) { 4685 if (hci_dev_test_flag(hdev, HCI_QUALITY_REPORT)) 4686 flags = BIT(0); 4687 else 4688 flags = 0; 4689 4690 memcpy(rp->features[idx].uuid, quality_report_uuid, 16); 4691 rp->features[idx].flags = cpu_to_le32(flags); 4692 idx++; 4693 } 4694 4695 if (hdev && hdev->get_data_path_id) { 4696 if (hci_dev_test_flag(hdev, HCI_OFFLOAD_CODECS_ENABLED)) 4697 flags = BIT(0); 4698 else 4699 flags = 0; 4700 4701 memcpy(rp->features[idx].uuid, offload_codecs_uuid, 16); 4702 rp->features[idx].flags = cpu_to_le32(flags); 4703 idx++; 4704 } 4705 4706 if (IS_ENABLED(CONFIG_BT_LE)) { 4707 flags = iso_inited() ? BIT(0) : 0; 4708 memcpy(rp->features[idx].uuid, iso_socket_uuid, 16); 4709 rp->features[idx].flags = cpu_to_le32(flags); 4710 idx++; 4711 } 4712 4713 if (hdev && lmp_le_capable(hdev)) { 4714 if (hci_dev_test_flag(hdev, HCI_MESH_EXPERIMENTAL)) 4715 flags = BIT(0); 4716 else 4717 flags = 0; 4718 4719 memcpy(rp->features[idx].uuid, mgmt_mesh_uuid, 16); 4720 rp->features[idx].flags = cpu_to_le32(flags); 4721 idx++; 4722 } 4723 4724 rp->feature_count = cpu_to_le16(idx); 4725 4726 /* After reading the experimental features information, enable 4727 * the events to update client on any future change. 4728 */ 4729 hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS); 4730 4731 status = mgmt_cmd_complete(sk, hdev ? hdev->id : MGMT_INDEX_NONE, 4732 MGMT_OP_READ_EXP_FEATURES_INFO, 4733 0, rp, sizeof(*rp) + (20 * idx)); 4734 4735 kfree(rp); 4736 return status; 4737 } 4738 4739 static int exp_feature_changed(struct hci_dev *hdev, const u8 *uuid, 4740 bool enabled, struct sock *skip) 4741 { 4742 struct mgmt_ev_exp_feature_changed ev; 4743 4744 memset(&ev, 0, sizeof(ev)); 4745 memcpy(ev.uuid, uuid, 16); 4746 ev.flags = cpu_to_le32(enabled ? BIT(0) : 0); 4747 4748 return mgmt_limited_event(MGMT_EV_EXP_FEATURE_CHANGED, hdev, 4749 &ev, sizeof(ev), 4750 HCI_MGMT_EXP_FEATURE_EVENTS, skip); 4751 } 4752 4753 #define EXP_FEAT(_uuid, _set_func) \ 4754 { \ 4755 .uuid = _uuid, \ 4756 .set_func = _set_func, \ 4757 } 4758 4759 /* The zero key uuid is special. Multiple exp features are set through it. */ 4760 static int set_zero_key_func(struct sock *sk, struct hci_dev *hdev, 4761 struct mgmt_cp_set_exp_feature *cp, u16 data_len) 4762 { 4763 struct mgmt_rp_set_exp_feature rp; 4764 4765 memset(rp.uuid, 0, 16); 4766 rp.flags = cpu_to_le32(0); 4767 4768 #ifdef CONFIG_BT_FEATURE_DEBUG 4769 if (!hdev) { 4770 bool changed = bt_dbg_get(); 4771 4772 bt_dbg_set(false); 4773 4774 if (changed) 4775 exp_feature_changed(NULL, ZERO_KEY, false, sk); 4776 } 4777 #endif 4778 4779 hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS); 4780 4781 return mgmt_cmd_complete(sk, hdev ? hdev->id : MGMT_INDEX_NONE, 4782 MGMT_OP_SET_EXP_FEATURE, 0, 4783 &rp, sizeof(rp)); 4784 } 4785 4786 #ifdef CONFIG_BT_FEATURE_DEBUG 4787 static int set_debug_func(struct sock *sk, struct hci_dev *hdev, 4788 struct mgmt_cp_set_exp_feature *cp, u16 data_len) 4789 { 4790 struct mgmt_rp_set_exp_feature rp; 4791 4792 bool val, changed; 4793 int err; 4794 4795 /* Command requires to use the non-controller index */ 4796 if (hdev) 4797 return mgmt_cmd_status(sk, hdev->id, 4798 MGMT_OP_SET_EXP_FEATURE, 4799 MGMT_STATUS_INVALID_INDEX); 4800 4801 /* Parameters are limited to a single octet */ 4802 if (data_len != MGMT_SET_EXP_FEATURE_SIZE + 1) 4803 return mgmt_cmd_status(sk, MGMT_INDEX_NONE, 4804 MGMT_OP_SET_EXP_FEATURE, 4805 MGMT_STATUS_INVALID_PARAMS); 4806 4807 /* Only boolean on/off is supported */ 4808 if (cp->param[0] != 0x00 && cp->param[0] != 0x01) 4809 return mgmt_cmd_status(sk, MGMT_INDEX_NONE, 4810 MGMT_OP_SET_EXP_FEATURE, 4811 MGMT_STATUS_INVALID_PARAMS); 4812 4813 val = !!cp->param[0]; 4814 changed = val ? !bt_dbg_get() : bt_dbg_get(); 4815 bt_dbg_set(val); 4816 4817 memcpy(rp.uuid, debug_uuid, 16); 4818 rp.flags = cpu_to_le32(val ? BIT(0) : 0); 4819 4820 hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS); 4821 4822 err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE, 4823 MGMT_OP_SET_EXP_FEATURE, 0, 4824 &rp, sizeof(rp)); 4825 4826 if (changed) 4827 exp_feature_changed(hdev, debug_uuid, val, sk); 4828 4829 return err; 4830 } 4831 #endif 4832 4833 static int set_mgmt_mesh_func(struct sock *sk, struct hci_dev *hdev, 4834 struct mgmt_cp_set_exp_feature *cp, u16 data_len) 4835 { 4836 struct mgmt_rp_set_exp_feature rp; 4837 bool val, changed; 4838 int err; 4839 4840 /* Command requires to use the controller index */ 4841 if (!hdev) 4842 return mgmt_cmd_status(sk, MGMT_INDEX_NONE, 4843 MGMT_OP_SET_EXP_FEATURE, 4844 MGMT_STATUS_INVALID_INDEX); 4845 4846 /* Parameters are limited to a single octet */ 4847 if (data_len != MGMT_SET_EXP_FEATURE_SIZE + 1) 4848 return mgmt_cmd_status(sk, hdev->id, 4849 MGMT_OP_SET_EXP_FEATURE, 4850 MGMT_STATUS_INVALID_PARAMS); 4851 4852 /* Only boolean on/off is supported */ 4853 if (cp->param[0] != 0x00 && cp->param[0] != 0x01) 4854 return mgmt_cmd_status(sk, hdev->id, 4855 MGMT_OP_SET_EXP_FEATURE, 4856 MGMT_STATUS_INVALID_PARAMS); 4857 4858 val = !!cp->param[0]; 4859 4860 if (val) { 4861 changed = !hci_dev_test_and_set_flag(hdev, 4862 HCI_MESH_EXPERIMENTAL); 4863 } else { 4864 hci_dev_clear_flag(hdev, HCI_MESH); 4865 changed = hci_dev_test_and_clear_flag(hdev, 4866 HCI_MESH_EXPERIMENTAL); 4867 } 4868 4869 memcpy(rp.uuid, mgmt_mesh_uuid, 16); 4870 rp.flags = cpu_to_le32(val ? BIT(0) : 0); 4871 4872 hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS); 4873 4874 err = mgmt_cmd_complete(sk, hdev->id, 4875 MGMT_OP_SET_EXP_FEATURE, 0, 4876 &rp, sizeof(rp)); 4877 4878 if (changed) 4879 exp_feature_changed(hdev, mgmt_mesh_uuid, val, sk); 4880 4881 return err; 4882 } 4883 4884 static int set_quality_report_func(struct sock *sk, struct hci_dev *hdev, 4885 struct mgmt_cp_set_exp_feature *cp, 4886 u16 data_len) 4887 { 4888 struct mgmt_rp_set_exp_feature rp; 4889 bool val, changed; 4890 int err; 4891 4892 /* Command requires to use a valid controller index */ 4893 if (!hdev) 4894 return mgmt_cmd_status(sk, MGMT_INDEX_NONE, 4895 MGMT_OP_SET_EXP_FEATURE, 4896 MGMT_STATUS_INVALID_INDEX); 4897 4898 /* Parameters are limited to a single octet */ 4899 if (data_len != MGMT_SET_EXP_FEATURE_SIZE + 1) 4900 return mgmt_cmd_status(sk, hdev->id, 4901 MGMT_OP_SET_EXP_FEATURE, 4902 MGMT_STATUS_INVALID_PARAMS); 4903 4904 /* Only boolean on/off is supported */ 4905 if (cp->param[0] != 0x00 && cp->param[0] != 0x01) 4906 return mgmt_cmd_status(sk, hdev->id, 4907 MGMT_OP_SET_EXP_FEATURE, 4908 MGMT_STATUS_INVALID_PARAMS); 4909 4910 hci_req_sync_lock(hdev); 4911 4912 if (hci_dev_test_flag(hdev, HCI_UNREGISTER)) { 4913 err = mgmt_cmd_status(sk, hdev->id, 4914 MGMT_OP_SET_EXP_FEATURE, 4915 MGMT_STATUS_INVALID_INDEX); 4916 goto unlock_quality_report; 4917 } 4918 4919 val = !!cp->param[0]; 4920 changed = (val != hci_dev_test_flag(hdev, HCI_QUALITY_REPORT)); 4921 4922 if (!aosp_has_quality_report(hdev) && !hdev->set_quality_report) { 4923 err = mgmt_cmd_status(sk, hdev->id, 4924 MGMT_OP_SET_EXP_FEATURE, 4925 MGMT_STATUS_NOT_SUPPORTED); 4926 goto unlock_quality_report; 4927 } 4928 4929 if (changed) { 4930 if (hdev->set_quality_report) 4931 err = hdev->set_quality_report(hdev, val); 4932 else 4933 err = aosp_set_quality_report(hdev, val); 4934 4935 if (err) { 4936 err = mgmt_cmd_status(sk, hdev->id, 4937 MGMT_OP_SET_EXP_FEATURE, 4938 MGMT_STATUS_FAILED); 4939 goto unlock_quality_report; 4940 } 4941 4942 if (val) 4943 hci_dev_set_flag(hdev, HCI_QUALITY_REPORT); 4944 else 4945 hci_dev_clear_flag(hdev, HCI_QUALITY_REPORT); 4946 } 4947 4948 bt_dev_dbg(hdev, "quality report enable %d changed %d", val, changed); 4949 4950 memcpy(rp.uuid, quality_report_uuid, 16); 4951 rp.flags = cpu_to_le32(val ? BIT(0) : 0); 4952 hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS); 4953 4954 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_EXP_FEATURE, 0, 4955 &rp, sizeof(rp)); 4956 4957 if (changed) 4958 exp_feature_changed(hdev, quality_report_uuid, val, sk); 4959 4960 unlock_quality_report: 4961 hci_req_sync_unlock(hdev); 4962 return err; 4963 } 4964 4965 static int set_offload_codec_func(struct sock *sk, struct hci_dev *hdev, 4966 struct mgmt_cp_set_exp_feature *cp, 4967 u16 data_len) 4968 { 4969 bool val, changed; 4970 int err; 4971 struct mgmt_rp_set_exp_feature rp; 4972 4973 /* Command requires to use a valid controller index */ 4974 if (!hdev) 4975 return mgmt_cmd_status(sk, MGMT_INDEX_NONE, 4976 MGMT_OP_SET_EXP_FEATURE, 4977 MGMT_STATUS_INVALID_INDEX); 4978 4979 /* Parameters are limited to a single octet */ 4980 if (data_len != MGMT_SET_EXP_FEATURE_SIZE + 1) 4981 return mgmt_cmd_status(sk, hdev->id, 4982 MGMT_OP_SET_EXP_FEATURE, 4983 MGMT_STATUS_INVALID_PARAMS); 4984 4985 /* Only boolean on/off is supported */ 4986 if (cp->param[0] != 0x00 && cp->param[0] != 0x01) 4987 return mgmt_cmd_status(sk, hdev->id, 4988 MGMT_OP_SET_EXP_FEATURE, 4989 MGMT_STATUS_INVALID_PARAMS); 4990 4991 val = !!cp->param[0]; 4992 changed = (val != hci_dev_test_flag(hdev, HCI_OFFLOAD_CODECS_ENABLED)); 4993 4994 if (!hdev->get_data_path_id) { 4995 return mgmt_cmd_status(sk, hdev->id, 4996 MGMT_OP_SET_EXP_FEATURE, 4997 MGMT_STATUS_NOT_SUPPORTED); 4998 } 4999 5000 if (changed) { 5001 if (val) 5002 hci_dev_set_flag(hdev, HCI_OFFLOAD_CODECS_ENABLED); 5003 else 5004 hci_dev_clear_flag(hdev, HCI_OFFLOAD_CODECS_ENABLED); 5005 } 5006 5007 bt_dev_info(hdev, "offload codecs enable %d changed %d", 5008 val, changed); 5009 5010 memcpy(rp.uuid, offload_codecs_uuid, 16); 5011 rp.flags = cpu_to_le32(val ? BIT(0) : 0); 5012 hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS); 5013 err = mgmt_cmd_complete(sk, hdev->id, 5014 MGMT_OP_SET_EXP_FEATURE, 0, 5015 &rp, sizeof(rp)); 5016 5017 if (changed) 5018 exp_feature_changed(hdev, offload_codecs_uuid, val, sk); 5019 5020 return err; 5021 } 5022 5023 static int set_le_simultaneous_roles_func(struct sock *sk, struct hci_dev *hdev, 5024 struct mgmt_cp_set_exp_feature *cp, 5025 u16 data_len) 5026 { 5027 bool val, changed; 5028 int err; 5029 struct mgmt_rp_set_exp_feature rp; 5030 5031 /* Command requires to use a valid controller index */ 5032 if (!hdev) 5033 return mgmt_cmd_status(sk, MGMT_INDEX_NONE, 5034 MGMT_OP_SET_EXP_FEATURE, 5035 MGMT_STATUS_INVALID_INDEX); 5036 5037 /* Parameters are limited to a single octet */ 5038 if (data_len != MGMT_SET_EXP_FEATURE_SIZE + 1) 5039 return mgmt_cmd_status(sk, hdev->id, 5040 MGMT_OP_SET_EXP_FEATURE, 5041 MGMT_STATUS_INVALID_PARAMS); 5042 5043 /* Only boolean on/off is supported */ 5044 if (cp->param[0] != 0x00 && cp->param[0] != 0x01) 5045 return mgmt_cmd_status(sk, hdev->id, 5046 MGMT_OP_SET_EXP_FEATURE, 5047 MGMT_STATUS_INVALID_PARAMS); 5048 5049 val = !!cp->param[0]; 5050 changed = (val != hci_dev_test_flag(hdev, HCI_LE_SIMULTANEOUS_ROLES)); 5051 5052 if (!hci_dev_le_state_simultaneous(hdev)) { 5053 return mgmt_cmd_status(sk, hdev->id, 5054 MGMT_OP_SET_EXP_FEATURE, 5055 MGMT_STATUS_NOT_SUPPORTED); 5056 } 5057 5058 if (changed) { 5059 if (val) 5060 hci_dev_set_flag(hdev, HCI_LE_SIMULTANEOUS_ROLES); 5061 else 5062 hci_dev_clear_flag(hdev, HCI_LE_SIMULTANEOUS_ROLES); 5063 } 5064 5065 bt_dev_info(hdev, "LE simultaneous roles enable %d changed %d", 5066 val, changed); 5067 5068 memcpy(rp.uuid, le_simultaneous_roles_uuid, 16); 5069 rp.flags = cpu_to_le32(val ? BIT(0) : 0); 5070 hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS); 5071 err = mgmt_cmd_complete(sk, hdev->id, 5072 MGMT_OP_SET_EXP_FEATURE, 0, 5073 &rp, sizeof(rp)); 5074 5075 if (changed) 5076 exp_feature_changed(hdev, le_simultaneous_roles_uuid, val, sk); 5077 5078 return err; 5079 } 5080 5081 #ifdef CONFIG_BT_LE 5082 static int set_iso_socket_func(struct sock *sk, struct hci_dev *hdev, 5083 struct mgmt_cp_set_exp_feature *cp, u16 data_len) 5084 { 5085 struct mgmt_rp_set_exp_feature rp; 5086 bool val, changed = false; 5087 int err; 5088 5089 /* Command requires to use the non-controller index */ 5090 if (hdev) 5091 return mgmt_cmd_status(sk, hdev->id, 5092 MGMT_OP_SET_EXP_FEATURE, 5093 MGMT_STATUS_INVALID_INDEX); 5094 5095 /* Parameters are limited to a single octet */ 5096 if (data_len != MGMT_SET_EXP_FEATURE_SIZE + 1) 5097 return mgmt_cmd_status(sk, MGMT_INDEX_NONE, 5098 MGMT_OP_SET_EXP_FEATURE, 5099 MGMT_STATUS_INVALID_PARAMS); 5100 5101 /* Only boolean on/off is supported */ 5102 if (cp->param[0] != 0x00 && cp->param[0] != 0x01) 5103 return mgmt_cmd_status(sk, MGMT_INDEX_NONE, 5104 MGMT_OP_SET_EXP_FEATURE, 5105 MGMT_STATUS_INVALID_PARAMS); 5106 5107 val = cp->param[0] ? true : false; 5108 if (val) 5109 err = iso_init(); 5110 else 5111 err = iso_exit(); 5112 5113 if (!err) 5114 changed = true; 5115 5116 memcpy(rp.uuid, iso_socket_uuid, 16); 5117 rp.flags = cpu_to_le32(val ? BIT(0) : 0); 5118 5119 hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS); 5120 5121 err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE, 5122 MGMT_OP_SET_EXP_FEATURE, 0, 5123 &rp, sizeof(rp)); 5124 5125 if (changed) 5126 exp_feature_changed(hdev, iso_socket_uuid, val, sk); 5127 5128 return err; 5129 } 5130 #endif 5131 5132 static const struct mgmt_exp_feature { 5133 const u8 *uuid; 5134 int (*set_func)(struct sock *sk, struct hci_dev *hdev, 5135 struct mgmt_cp_set_exp_feature *cp, u16 data_len); 5136 } exp_features[] = { 5137 EXP_FEAT(ZERO_KEY, set_zero_key_func), 5138 #ifdef CONFIG_BT_FEATURE_DEBUG 5139 EXP_FEAT(debug_uuid, set_debug_func), 5140 #endif 5141 EXP_FEAT(mgmt_mesh_uuid, set_mgmt_mesh_func), 5142 EXP_FEAT(quality_report_uuid, set_quality_report_func), 5143 EXP_FEAT(offload_codecs_uuid, set_offload_codec_func), 5144 EXP_FEAT(le_simultaneous_roles_uuid, set_le_simultaneous_roles_func), 5145 #ifdef CONFIG_BT_LE 5146 EXP_FEAT(iso_socket_uuid, set_iso_socket_func), 5147 #endif 5148 5149 /* end with a null feature */ 5150 EXP_FEAT(NULL, NULL) 5151 }; 5152 5153 static int set_exp_feature(struct sock *sk, struct hci_dev *hdev, 5154 void *data, u16 data_len) 5155 { 5156 struct mgmt_cp_set_exp_feature *cp = data; 5157 size_t i = 0; 5158 5159 bt_dev_dbg(hdev, "sock %p", sk); 5160 5161 for (i = 0; exp_features[i].uuid; i++) { 5162 if (!memcmp(cp->uuid, exp_features[i].uuid, 16)) 5163 return exp_features[i].set_func(sk, hdev, cp, data_len); 5164 } 5165 5166 return mgmt_cmd_status(sk, hdev ? hdev->id : MGMT_INDEX_NONE, 5167 MGMT_OP_SET_EXP_FEATURE, 5168 MGMT_STATUS_NOT_SUPPORTED); 5169 } 5170 5171 static int get_device_flags(struct sock *sk, struct hci_dev *hdev, void *data, 5172 u16 data_len) 5173 { 5174 struct mgmt_cp_get_device_flags *cp = data; 5175 struct mgmt_rp_get_device_flags rp; 5176 struct bdaddr_list_with_flags *br_params; 5177 struct hci_conn_params *params; 5178 u32 supported_flags; 5179 u32 current_flags = 0; 5180 u8 status = MGMT_STATUS_INVALID_PARAMS; 5181 5182 bt_dev_dbg(hdev, "Get device flags %pMR (type 0x%x)\n", 5183 &cp->addr.bdaddr, cp->addr.type); 5184 5185 hci_dev_lock(hdev); 5186 5187 supported_flags = hdev->conn_flags; 5188 5189 memset(&rp, 0, sizeof(rp)); 5190 5191 if (cp->addr.type == BDADDR_BREDR) { 5192 br_params = hci_bdaddr_list_lookup_with_flags(&hdev->accept_list, 5193 &cp->addr.bdaddr, 5194 cp->addr.type); 5195 if (!br_params) 5196 goto done; 5197 5198 current_flags = br_params->flags; 5199 } else { 5200 params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr, 5201 le_addr_type(cp->addr.type)); 5202 if (!params) 5203 goto done; 5204 5205 current_flags = params->flags; 5206 } 5207 5208 bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr); 5209 rp.addr.type = cp->addr.type; 5210 rp.supported_flags = cpu_to_le32(supported_flags); 5211 rp.current_flags = cpu_to_le32(current_flags); 5212 5213 status = MGMT_STATUS_SUCCESS; 5214 5215 done: 5216 hci_dev_unlock(hdev); 5217 5218 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_DEVICE_FLAGS, status, 5219 &rp, sizeof(rp)); 5220 } 5221 5222 static void device_flags_changed(struct sock *sk, struct hci_dev *hdev, 5223 bdaddr_t *bdaddr, u8 bdaddr_type, 5224 u32 supported_flags, u32 current_flags) 5225 { 5226 struct mgmt_ev_device_flags_changed ev; 5227 5228 bacpy(&ev.addr.bdaddr, bdaddr); 5229 ev.addr.type = bdaddr_type; 5230 ev.supported_flags = cpu_to_le32(supported_flags); 5231 ev.current_flags = cpu_to_le32(current_flags); 5232 5233 mgmt_event(MGMT_EV_DEVICE_FLAGS_CHANGED, hdev, &ev, sizeof(ev), sk); 5234 } 5235 5236 static bool is_connected(struct hci_dev *hdev, bdaddr_t *addr, u8 type) 5237 { 5238 struct hci_conn *conn; 5239 5240 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, addr); 5241 if (!conn) 5242 return false; 5243 5244 if (conn->dst_type != type) 5245 return false; 5246 5247 if (conn->state != BT_CONNECTED) 5248 return false; 5249 5250 return true; 5251 } 5252 5253 /* This function requires the caller holds hdev->lock */ 5254 static struct hci_conn_params *hci_conn_params_set(struct hci_dev *hdev, 5255 bdaddr_t *addr, u8 addr_type, 5256 u8 auto_connect) 5257 { 5258 struct hci_conn_params *params; 5259 5260 params = hci_conn_params_add(hdev, addr, addr_type); 5261 if (!params) 5262 return NULL; 5263 5264 if (params->auto_connect == auto_connect) 5265 return params; 5266 5267 hci_pend_le_list_del_init(params); 5268 5269 switch (auto_connect) { 5270 case HCI_AUTO_CONN_DISABLED: 5271 case HCI_AUTO_CONN_LINK_LOSS: 5272 /* If auto connect is being disabled when we're trying to 5273 * connect to device, keep connecting. 5274 */ 5275 if (params->explicit_connect) 5276 hci_pend_le_list_add(params, &hdev->pend_le_conns); 5277 break; 5278 case HCI_AUTO_CONN_REPORT: 5279 if (params->explicit_connect) 5280 hci_pend_le_list_add(params, &hdev->pend_le_conns); 5281 else 5282 hci_pend_le_list_add(params, &hdev->pend_le_reports); 5283 break; 5284 case HCI_AUTO_CONN_DIRECT: 5285 case HCI_AUTO_CONN_ALWAYS: 5286 if (!is_connected(hdev, addr, addr_type)) 5287 hci_pend_le_list_add(params, &hdev->pend_le_conns); 5288 break; 5289 } 5290 5291 params->auto_connect = auto_connect; 5292 5293 bt_dev_dbg(hdev, "addr %pMR (type %u) auto_connect %u", 5294 addr, addr_type, auto_connect); 5295 5296 return params; 5297 } 5298 5299 static int set_device_flags(struct sock *sk, struct hci_dev *hdev, void *data, 5300 u16 len) 5301 { 5302 struct mgmt_cp_set_device_flags *cp = data; 5303 struct bdaddr_list_with_flags *br_params; 5304 struct hci_conn_params *params; 5305 u8 status = MGMT_STATUS_INVALID_PARAMS; 5306 u32 supported_flags; 5307 u32 current_flags = __le32_to_cpu(cp->current_flags); 5308 5309 bt_dev_dbg(hdev, "Set device flags %pMR (type 0x%x) = 0x%x", 5310 &cp->addr.bdaddr, cp->addr.type, current_flags); 5311 5312 // We should take hci_dev_lock() early, I think.. conn_flags can change 5313 supported_flags = hdev->conn_flags; 5314 5315 if ((supported_flags | current_flags) != supported_flags) { 5316 bt_dev_warn(hdev, "Bad flag given (0x%x) vs supported (0x%0x)", 5317 current_flags, supported_flags); 5318 goto done; 5319 } 5320 5321 hci_dev_lock(hdev); 5322 5323 if (cp->addr.type == BDADDR_BREDR) { 5324 br_params = hci_bdaddr_list_lookup_with_flags(&hdev->accept_list, 5325 &cp->addr.bdaddr, 5326 cp->addr.type); 5327 5328 if (br_params) { 5329 br_params->flags = current_flags; 5330 status = MGMT_STATUS_SUCCESS; 5331 } else { 5332 bt_dev_warn(hdev, "No such BR/EDR device %pMR (0x%x)", 5333 &cp->addr.bdaddr, cp->addr.type); 5334 } 5335 5336 goto unlock; 5337 } 5338 5339 params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr, 5340 le_addr_type(cp->addr.type)); 5341 if (!params) { 5342 /* Create a new hci_conn_params if it doesn't exist */ 5343 params = hci_conn_params_set(hdev, &cp->addr.bdaddr, 5344 le_addr_type(cp->addr.type), 5345 HCI_AUTO_CONN_DISABLED); 5346 if (!params) { 5347 bt_dev_warn(hdev, "No such LE device %pMR (0x%x)", 5348 &cp->addr.bdaddr, 5349 le_addr_type(cp->addr.type)); 5350 goto unlock; 5351 } 5352 } 5353 5354 supported_flags = hdev->conn_flags; 5355 5356 if ((supported_flags | current_flags) != supported_flags) { 5357 bt_dev_warn(hdev, "Bad flag given (0x%x) vs supported (0x%0x)", 5358 current_flags, supported_flags); 5359 goto unlock; 5360 } 5361 5362 WRITE_ONCE(params->flags, current_flags); 5363 status = MGMT_STATUS_SUCCESS; 5364 5365 /* Update passive scan if HCI_CONN_FLAG_DEVICE_PRIVACY 5366 * has been set. 5367 */ 5368 if (params->flags & HCI_CONN_FLAG_DEVICE_PRIVACY) 5369 hci_update_passive_scan(hdev); 5370 5371 unlock: 5372 hci_dev_unlock(hdev); 5373 5374 done: 5375 if (status == MGMT_STATUS_SUCCESS) 5376 device_flags_changed(sk, hdev, &cp->addr.bdaddr, cp->addr.type, 5377 supported_flags, current_flags); 5378 5379 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_DEVICE_FLAGS, status, 5380 &cp->addr, sizeof(cp->addr)); 5381 } 5382 5383 static void mgmt_adv_monitor_added(struct sock *sk, struct hci_dev *hdev, 5384 u16 handle) 5385 { 5386 struct mgmt_ev_adv_monitor_added ev; 5387 5388 ev.monitor_handle = cpu_to_le16(handle); 5389 5390 mgmt_event(MGMT_EV_ADV_MONITOR_ADDED, hdev, &ev, sizeof(ev), sk); 5391 } 5392 5393 static void mgmt_adv_monitor_removed(struct sock *sk, struct hci_dev *hdev, 5394 __le16 handle) 5395 { 5396 struct mgmt_ev_adv_monitor_removed ev; 5397 5398 ev.monitor_handle = handle; 5399 5400 mgmt_event(MGMT_EV_ADV_MONITOR_REMOVED, hdev, &ev, sizeof(ev), sk); 5401 } 5402 5403 static int read_adv_mon_features(struct sock *sk, struct hci_dev *hdev, 5404 void *data, u16 len) 5405 { 5406 struct adv_monitor *monitor = NULL; 5407 struct mgmt_rp_read_adv_monitor_features *rp = NULL; 5408 int handle, err; 5409 size_t rp_size = 0; 5410 __u32 supported = 0; 5411 __u32 enabled = 0; 5412 __u16 num_handles = 0; 5413 __u16 handles[HCI_MAX_ADV_MONITOR_NUM_HANDLES]; 5414 5415 BT_DBG("request for %s", hdev->name); 5416 5417 hci_dev_lock(hdev); 5418 5419 if (msft_monitor_supported(hdev)) 5420 supported |= MGMT_ADV_MONITOR_FEATURE_MASK_OR_PATTERNS; 5421 5422 idr_for_each_entry(&hdev->adv_monitors_idr, monitor, handle) 5423 handles[num_handles++] = monitor->handle; 5424 5425 hci_dev_unlock(hdev); 5426 5427 rp_size = sizeof(*rp) + (num_handles * sizeof(u16)); 5428 rp = kmalloc(rp_size, GFP_KERNEL); 5429 if (!rp) 5430 return -ENOMEM; 5431 5432 /* All supported features are currently enabled */ 5433 enabled = supported; 5434 5435 rp->supported_features = cpu_to_le32(supported); 5436 rp->enabled_features = cpu_to_le32(enabled); 5437 rp->max_num_handles = cpu_to_le16(HCI_MAX_ADV_MONITOR_NUM_HANDLES); 5438 rp->max_num_patterns = HCI_MAX_ADV_MONITOR_NUM_PATTERNS; 5439 rp->num_handles = cpu_to_le16(num_handles); 5440 if (num_handles) 5441 memcpy(&rp->handles, &handles, (num_handles * sizeof(u16))); 5442 5443 err = mgmt_cmd_complete(sk, hdev->id, 5444 MGMT_OP_READ_ADV_MONITOR_FEATURES, 5445 MGMT_STATUS_SUCCESS, rp, rp_size); 5446 5447 kfree(rp); 5448 5449 return err; 5450 } 5451 5452 static void mgmt_add_adv_patterns_monitor_complete(struct hci_dev *hdev, 5453 void *data, int status) 5454 { 5455 struct mgmt_rp_add_adv_patterns_monitor rp; 5456 struct mgmt_pending_cmd *cmd = data; 5457 struct adv_monitor *monitor; 5458 5459 /* This is likely the result of hdev being closed and mgmt_index_removed 5460 * is attempting to clean up any pending command so 5461 * hci_adv_monitors_clear is about to be called which will take care of 5462 * freeing the adv_monitor instances. 5463 */ 5464 if (status == -ECANCELED || !mgmt_pending_valid(hdev, cmd)) 5465 return; 5466 5467 monitor = cmd->user_data; 5468 5469 hci_dev_lock(hdev); 5470 5471 rp.monitor_handle = cpu_to_le16(monitor->handle); 5472 5473 if (!status) { 5474 mgmt_adv_monitor_added(cmd->sk, hdev, monitor->handle); 5475 hdev->adv_monitors_cnt++; 5476 if (monitor->state == ADV_MONITOR_STATE_NOT_REGISTERED) 5477 monitor->state = ADV_MONITOR_STATE_REGISTERED; 5478 hci_update_passive_scan(hdev); 5479 } else { 5480 hci_free_adv_monitor(hdev, monitor); 5481 } 5482 5483 mgmt_cmd_complete(cmd->sk, cmd->hdev->id, cmd->opcode, 5484 mgmt_status(status), &rp, sizeof(rp)); 5485 mgmt_pending_free(cmd); 5486 5487 hci_dev_unlock(hdev); 5488 bt_dev_dbg(hdev, "add monitor %d complete, status %d", 5489 rp.monitor_handle, status); 5490 } 5491 5492 static int mgmt_add_adv_patterns_monitor_sync(struct hci_dev *hdev, void *data) 5493 { 5494 struct mgmt_pending_cmd *cmd = data; 5495 struct adv_monitor *mon; 5496 5497 mutex_lock(&hdev->mgmt_pending_lock); 5498 5499 if (!__mgmt_pending_listed(hdev, cmd)) { 5500 mutex_unlock(&hdev->mgmt_pending_lock); 5501 return -ECANCELED; 5502 } 5503 5504 mon = cmd->user_data; 5505 5506 mutex_unlock(&hdev->mgmt_pending_lock); 5507 5508 return hci_add_adv_monitor(hdev, mon); 5509 } 5510 5511 static int __add_adv_patterns_monitor(struct sock *sk, struct hci_dev *hdev, 5512 struct adv_monitor *m, u8 status, 5513 void *data, u16 len, u16 op) 5514 { 5515 struct mgmt_pending_cmd *cmd; 5516 int err; 5517 5518 hci_dev_lock(hdev); 5519 5520 if (status) 5521 goto unlock; 5522 5523 if (pending_find(MGMT_OP_SET_LE, hdev) || 5524 pending_find(MGMT_OP_ADD_ADV_PATTERNS_MONITOR, hdev) || 5525 pending_find(MGMT_OP_ADD_ADV_PATTERNS_MONITOR_RSSI, hdev)) { 5526 status = MGMT_STATUS_BUSY; 5527 goto unlock; 5528 } 5529 5530 cmd = mgmt_pending_add(sk, op, hdev, data, len); 5531 if (!cmd) { 5532 status = MGMT_STATUS_NO_RESOURCES; 5533 goto unlock; 5534 } 5535 5536 cmd->user_data = m; 5537 err = hci_cmd_sync_queue(hdev, mgmt_add_adv_patterns_monitor_sync, cmd, 5538 mgmt_add_adv_patterns_monitor_complete); 5539 if (err) { 5540 if (err == -ENOMEM) 5541 status = MGMT_STATUS_NO_RESOURCES; 5542 else 5543 status = MGMT_STATUS_FAILED; 5544 5545 goto unlock; 5546 } 5547 5548 hci_dev_unlock(hdev); 5549 5550 return 0; 5551 5552 unlock: 5553 hci_free_adv_monitor(hdev, m); 5554 hci_dev_unlock(hdev); 5555 return mgmt_cmd_status(sk, hdev->id, op, status); 5556 } 5557 5558 static void parse_adv_monitor_rssi(struct adv_monitor *m, 5559 struct mgmt_adv_rssi_thresholds *rssi) 5560 { 5561 if (rssi) { 5562 m->rssi.low_threshold = rssi->low_threshold; 5563 m->rssi.low_threshold_timeout = 5564 __le16_to_cpu(rssi->low_threshold_timeout); 5565 m->rssi.high_threshold = rssi->high_threshold; 5566 m->rssi.high_threshold_timeout = 5567 __le16_to_cpu(rssi->high_threshold_timeout); 5568 m->rssi.sampling_period = rssi->sampling_period; 5569 } else { 5570 /* Default values. These numbers are the least constricting 5571 * parameters for MSFT API to work, so it behaves as if there 5572 * are no rssi parameter to consider. May need to be changed 5573 * if other API are to be supported. 5574 */ 5575 m->rssi.low_threshold = -127; 5576 m->rssi.low_threshold_timeout = 60; 5577 m->rssi.high_threshold = -127; 5578 m->rssi.high_threshold_timeout = 0; 5579 m->rssi.sampling_period = 0; 5580 } 5581 } 5582 5583 static u8 parse_adv_monitor_pattern(struct adv_monitor *m, u8 pattern_count, 5584 struct mgmt_adv_pattern *patterns) 5585 { 5586 u8 offset = 0, length = 0; 5587 struct adv_pattern *p = NULL; 5588 int i; 5589 5590 for (i = 0; i < pattern_count; i++) { 5591 offset = patterns[i].offset; 5592 length = patterns[i].length; 5593 if (offset >= HCI_MAX_AD_LENGTH || 5594 length > HCI_MAX_AD_LENGTH || 5595 (offset + length) > HCI_MAX_AD_LENGTH) 5596 return MGMT_STATUS_INVALID_PARAMS; 5597 5598 p = kmalloc_obj(*p); 5599 if (!p) 5600 return MGMT_STATUS_NO_RESOURCES; 5601 5602 p->ad_type = patterns[i].ad_type; 5603 p->offset = patterns[i].offset; 5604 p->length = patterns[i].length; 5605 memcpy(p->value, patterns[i].value, p->length); 5606 5607 INIT_LIST_HEAD(&p->list); 5608 list_add(&p->list, &m->patterns); 5609 } 5610 5611 return MGMT_STATUS_SUCCESS; 5612 } 5613 5614 static int add_adv_patterns_monitor(struct sock *sk, struct hci_dev *hdev, 5615 void *data, u16 len) 5616 { 5617 struct mgmt_cp_add_adv_patterns_monitor *cp = data; 5618 struct adv_monitor *m = NULL; 5619 u8 status = MGMT_STATUS_SUCCESS; 5620 size_t expected_size = sizeof(*cp); 5621 5622 BT_DBG("request for %s", hdev->name); 5623 5624 if (len <= sizeof(*cp)) { 5625 status = MGMT_STATUS_INVALID_PARAMS; 5626 goto done; 5627 } 5628 5629 expected_size += cp->pattern_count * sizeof(struct mgmt_adv_pattern); 5630 if (len != expected_size) { 5631 status = MGMT_STATUS_INVALID_PARAMS; 5632 goto done; 5633 } 5634 5635 m = kzalloc_obj(*m); 5636 if (!m) { 5637 status = MGMT_STATUS_NO_RESOURCES; 5638 goto done; 5639 } 5640 5641 INIT_LIST_HEAD(&m->patterns); 5642 5643 parse_adv_monitor_rssi(m, NULL); 5644 status = parse_adv_monitor_pattern(m, cp->pattern_count, cp->patterns); 5645 5646 done: 5647 return __add_adv_patterns_monitor(sk, hdev, m, status, data, len, 5648 MGMT_OP_ADD_ADV_PATTERNS_MONITOR); 5649 } 5650 5651 static int add_adv_patterns_monitor_rssi(struct sock *sk, struct hci_dev *hdev, 5652 void *data, u16 len) 5653 { 5654 struct mgmt_cp_add_adv_patterns_monitor_rssi *cp = data; 5655 struct adv_monitor *m = NULL; 5656 u8 status = MGMT_STATUS_SUCCESS; 5657 size_t expected_size = sizeof(*cp); 5658 5659 BT_DBG("request for %s", hdev->name); 5660 5661 if (len <= sizeof(*cp)) { 5662 status = MGMT_STATUS_INVALID_PARAMS; 5663 goto done; 5664 } 5665 5666 expected_size += cp->pattern_count * sizeof(struct mgmt_adv_pattern); 5667 if (len != expected_size) { 5668 status = MGMT_STATUS_INVALID_PARAMS; 5669 goto done; 5670 } 5671 5672 m = kzalloc_obj(*m); 5673 if (!m) { 5674 status = MGMT_STATUS_NO_RESOURCES; 5675 goto done; 5676 } 5677 5678 INIT_LIST_HEAD(&m->patterns); 5679 5680 parse_adv_monitor_rssi(m, &cp->rssi); 5681 status = parse_adv_monitor_pattern(m, cp->pattern_count, cp->patterns); 5682 5683 done: 5684 return __add_adv_patterns_monitor(sk, hdev, m, status, data, len, 5685 MGMT_OP_ADD_ADV_PATTERNS_MONITOR_RSSI); 5686 } 5687 5688 static void mgmt_remove_adv_monitor_complete(struct hci_dev *hdev, 5689 void *data, int status) 5690 { 5691 struct mgmt_rp_remove_adv_monitor rp; 5692 struct mgmt_pending_cmd *cmd = data; 5693 struct mgmt_cp_remove_adv_monitor *cp; 5694 5695 /* Reply to a cancelled command so bluetoothd's serialised mgmt queue 5696 * is not blocked. 5697 */ 5698 if (status == -ECANCELED) { 5699 cp = cmd->param; 5700 rp.monitor_handle = cp->monitor_handle; 5701 5702 mgmt_cmd_complete(cmd->sk, cmd->hdev->id, cmd->opcode, 5703 mgmt_status(status), &rp, sizeof(rp)); 5704 mgmt_pending_free(cmd); 5705 return; 5706 } 5707 5708 hci_dev_lock(hdev); 5709 5710 cp = cmd->param; 5711 5712 rp.monitor_handle = cp->monitor_handle; 5713 5714 if (!status) { 5715 mgmt_adv_monitor_removed(cmd->sk, hdev, cp->monitor_handle); 5716 hci_update_passive_scan(hdev); 5717 } 5718 5719 mgmt_cmd_complete(cmd->sk, cmd->hdev->id, cmd->opcode, 5720 mgmt_status(status), &rp, sizeof(rp)); 5721 mgmt_pending_free(cmd); 5722 5723 hci_dev_unlock(hdev); 5724 bt_dev_dbg(hdev, "remove monitor %d complete, status %d", 5725 rp.monitor_handle, status); 5726 } 5727 5728 static int mgmt_remove_adv_monitor_sync(struct hci_dev *hdev, void *data) 5729 { 5730 struct mgmt_pending_cmd *cmd = data; 5731 struct mgmt_cp_remove_adv_monitor *cp = cmd->param; 5732 u16 handle = __le16_to_cpu(cp->monitor_handle); 5733 5734 if (!handle) 5735 return hci_remove_all_adv_monitor(hdev); 5736 5737 return hci_remove_single_adv_monitor(hdev, handle); 5738 } 5739 5740 static int remove_adv_monitor(struct sock *sk, struct hci_dev *hdev, 5741 void *data, u16 len) 5742 { 5743 struct mgmt_pending_cmd *cmd; 5744 int err, status; 5745 5746 hci_dev_lock(hdev); 5747 5748 if (pending_find(MGMT_OP_SET_LE, hdev) || 5749 pending_find(MGMT_OP_ADD_ADV_PATTERNS_MONITOR, hdev) || 5750 pending_find(MGMT_OP_ADD_ADV_PATTERNS_MONITOR_RSSI, hdev)) { 5751 status = MGMT_STATUS_BUSY; 5752 goto unlock; 5753 } 5754 5755 cmd = mgmt_pending_new(sk, MGMT_OP_REMOVE_ADV_MONITOR, hdev, data, len); 5756 if (!cmd) { 5757 status = MGMT_STATUS_NO_RESOURCES; 5758 goto unlock; 5759 } 5760 5761 err = hci_cmd_sync_submit(hdev, mgmt_remove_adv_monitor_sync, cmd, 5762 mgmt_remove_adv_monitor_complete); 5763 5764 if (err) { 5765 mgmt_pending_free(cmd); 5766 5767 if (err == -ENOMEM) 5768 status = MGMT_STATUS_NO_RESOURCES; 5769 else 5770 status = MGMT_STATUS_FAILED; 5771 5772 goto unlock; 5773 } 5774 5775 hci_dev_unlock(hdev); 5776 5777 return 0; 5778 5779 unlock: 5780 hci_dev_unlock(hdev); 5781 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_ADV_MONITOR, 5782 status); 5783 } 5784 5785 static void read_local_oob_data_complete(struct hci_dev *hdev, void *data, 5786 int err) 5787 { 5788 struct mgmt_rp_read_local_oob_data mgmt_rp; 5789 size_t rp_size = sizeof(mgmt_rp); 5790 struct mgmt_pending_cmd *cmd = data; 5791 struct sk_buff *skb = cmd->skb; 5792 u8 status = mgmt_status(err); 5793 5794 if (!status) { 5795 if (!skb) 5796 status = MGMT_STATUS_FAILED; 5797 else if (IS_ERR(skb)) 5798 status = mgmt_status(PTR_ERR(skb)); 5799 else 5800 status = mgmt_status(skb->data[0]); 5801 } 5802 5803 bt_dev_dbg(hdev, "status %d", status); 5804 5805 if (status) { 5806 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA, 5807 status); 5808 goto remove; 5809 } 5810 5811 memset(&mgmt_rp, 0, sizeof(mgmt_rp)); 5812 5813 if (!bredr_sc_enabled(hdev)) { 5814 struct hci_rp_read_local_oob_data *rp = (void *) skb->data; 5815 5816 if (skb->len < sizeof(*rp)) { 5817 mgmt_cmd_status(cmd->sk, hdev->id, 5818 MGMT_OP_READ_LOCAL_OOB_DATA, 5819 MGMT_STATUS_FAILED); 5820 goto remove; 5821 } 5822 5823 memcpy(mgmt_rp.hash192, rp->hash, sizeof(rp->hash)); 5824 memcpy(mgmt_rp.rand192, rp->rand, sizeof(rp->rand)); 5825 5826 rp_size -= sizeof(mgmt_rp.hash256) + sizeof(mgmt_rp.rand256); 5827 } else { 5828 struct hci_rp_read_local_oob_ext_data *rp = (void *) skb->data; 5829 5830 if (skb->len < sizeof(*rp)) { 5831 mgmt_cmd_status(cmd->sk, hdev->id, 5832 MGMT_OP_READ_LOCAL_OOB_DATA, 5833 MGMT_STATUS_FAILED); 5834 goto remove; 5835 } 5836 5837 memcpy(mgmt_rp.hash192, rp->hash192, sizeof(rp->hash192)); 5838 memcpy(mgmt_rp.rand192, rp->rand192, sizeof(rp->rand192)); 5839 5840 memcpy(mgmt_rp.hash256, rp->hash256, sizeof(rp->hash256)); 5841 memcpy(mgmt_rp.rand256, rp->rand256, sizeof(rp->rand256)); 5842 } 5843 5844 mgmt_cmd_complete(cmd->sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA, 5845 MGMT_STATUS_SUCCESS, &mgmt_rp, rp_size); 5846 5847 remove: 5848 if (skb && !IS_ERR(skb)) 5849 kfree_skb(skb); 5850 5851 mgmt_pending_free(cmd); 5852 } 5853 5854 static int read_local_oob_data_sync(struct hci_dev *hdev, void *data) 5855 { 5856 struct mgmt_pending_cmd *cmd = data; 5857 5858 if (bredr_sc_enabled(hdev)) 5859 cmd->skb = hci_read_local_oob_data_sync(hdev, true, cmd->sk); 5860 else 5861 cmd->skb = hci_read_local_oob_data_sync(hdev, false, cmd->sk); 5862 5863 if (IS_ERR(cmd->skb)) 5864 return PTR_ERR(cmd->skb); 5865 else 5866 return 0; 5867 } 5868 5869 static int read_local_oob_data(struct sock *sk, struct hci_dev *hdev, 5870 void *data, u16 data_len) 5871 { 5872 struct mgmt_pending_cmd *cmd; 5873 int err; 5874 5875 bt_dev_dbg(hdev, "sock %p", sk); 5876 5877 hci_dev_lock(hdev); 5878 5879 if (!hdev_is_powered(hdev)) { 5880 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA, 5881 MGMT_STATUS_NOT_POWERED); 5882 goto unlock; 5883 } 5884 5885 if (!lmp_ssp_capable(hdev)) { 5886 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA, 5887 MGMT_STATUS_NOT_SUPPORTED); 5888 goto unlock; 5889 } 5890 5891 cmd = mgmt_pending_new(sk, MGMT_OP_READ_LOCAL_OOB_DATA, hdev, NULL, 0); 5892 if (!cmd) 5893 err = -ENOMEM; 5894 else 5895 err = hci_cmd_sync_queue(hdev, read_local_oob_data_sync, cmd, 5896 read_local_oob_data_complete); 5897 5898 if (err < 0) { 5899 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA, 5900 MGMT_STATUS_FAILED); 5901 5902 if (cmd) 5903 mgmt_pending_free(cmd); 5904 } 5905 5906 unlock: 5907 hci_dev_unlock(hdev); 5908 return err; 5909 } 5910 5911 static int add_remote_oob_data(struct sock *sk, struct hci_dev *hdev, 5912 void *data, u16 len) 5913 { 5914 struct mgmt_addr_info *addr = data; 5915 int err; 5916 5917 bt_dev_dbg(hdev, "sock %p", sk); 5918 5919 if (!bdaddr_type_is_valid(addr->type)) 5920 return mgmt_cmd_complete(sk, hdev->id, 5921 MGMT_OP_ADD_REMOTE_OOB_DATA, 5922 MGMT_STATUS_INVALID_PARAMS, 5923 addr, sizeof(*addr)); 5924 5925 hci_dev_lock(hdev); 5926 5927 if (len == MGMT_ADD_REMOTE_OOB_DATA_SIZE) { 5928 struct mgmt_cp_add_remote_oob_data *cp = data; 5929 u8 status; 5930 5931 if (cp->addr.type != BDADDR_BREDR) { 5932 err = mgmt_cmd_complete(sk, hdev->id, 5933 MGMT_OP_ADD_REMOTE_OOB_DATA, 5934 MGMT_STATUS_INVALID_PARAMS, 5935 &cp->addr, sizeof(cp->addr)); 5936 goto unlock; 5937 } 5938 5939 err = hci_add_remote_oob_data(hdev, &cp->addr.bdaddr, 5940 cp->addr.type, cp->hash, 5941 cp->rand, NULL, NULL); 5942 if (err < 0) 5943 status = MGMT_STATUS_FAILED; 5944 else 5945 status = MGMT_STATUS_SUCCESS; 5946 5947 err = mgmt_cmd_complete(sk, hdev->id, 5948 MGMT_OP_ADD_REMOTE_OOB_DATA, status, 5949 &cp->addr, sizeof(cp->addr)); 5950 } else if (len == MGMT_ADD_REMOTE_OOB_EXT_DATA_SIZE) { 5951 struct mgmt_cp_add_remote_oob_ext_data *cp = data; 5952 u8 *rand192, *hash192, *rand256, *hash256; 5953 u8 status; 5954 5955 if (bdaddr_type_is_le(cp->addr.type)) { 5956 /* Enforce zero-valued 192-bit parameters as 5957 * long as legacy SMP OOB isn't implemented. 5958 */ 5959 if (memcmp(cp->rand192, ZERO_KEY, 16) || 5960 memcmp(cp->hash192, ZERO_KEY, 16)) { 5961 err = mgmt_cmd_complete(sk, hdev->id, 5962 MGMT_OP_ADD_REMOTE_OOB_DATA, 5963 MGMT_STATUS_INVALID_PARAMS, 5964 addr, sizeof(*addr)); 5965 goto unlock; 5966 } 5967 5968 rand192 = NULL; 5969 hash192 = NULL; 5970 } else { 5971 /* In case one of the P-192 values is set to zero, 5972 * then just disable OOB data for P-192. 5973 */ 5974 if (!memcmp(cp->rand192, ZERO_KEY, 16) || 5975 !memcmp(cp->hash192, ZERO_KEY, 16)) { 5976 rand192 = NULL; 5977 hash192 = NULL; 5978 } else { 5979 rand192 = cp->rand192; 5980 hash192 = cp->hash192; 5981 } 5982 } 5983 5984 /* In case one of the P-256 values is set to zero, then just 5985 * disable OOB data for P-256. 5986 */ 5987 if (!memcmp(cp->rand256, ZERO_KEY, 16) || 5988 !memcmp(cp->hash256, ZERO_KEY, 16)) { 5989 rand256 = NULL; 5990 hash256 = NULL; 5991 } else { 5992 rand256 = cp->rand256; 5993 hash256 = cp->hash256; 5994 } 5995 5996 err = hci_add_remote_oob_data(hdev, &cp->addr.bdaddr, 5997 cp->addr.type, hash192, rand192, 5998 hash256, rand256); 5999 if (err < 0) 6000 status = MGMT_STATUS_FAILED; 6001 else 6002 status = MGMT_STATUS_SUCCESS; 6003 6004 err = mgmt_cmd_complete(sk, hdev->id, 6005 MGMT_OP_ADD_REMOTE_OOB_DATA, 6006 status, &cp->addr, sizeof(cp->addr)); 6007 } else { 6008 bt_dev_err(hdev, "add_remote_oob_data: invalid len of %u bytes", 6009 len); 6010 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_REMOTE_OOB_DATA, 6011 MGMT_STATUS_INVALID_PARAMS); 6012 } 6013 6014 unlock: 6015 hci_dev_unlock(hdev); 6016 return err; 6017 } 6018 6019 static int remove_remote_oob_data(struct sock *sk, struct hci_dev *hdev, 6020 void *data, u16 len) 6021 { 6022 struct mgmt_cp_remove_remote_oob_data *cp = data; 6023 u8 status; 6024 int err; 6025 6026 bt_dev_dbg(hdev, "sock %p", sk); 6027 6028 if (cp->addr.type != BDADDR_BREDR) 6029 return mgmt_cmd_complete(sk, hdev->id, 6030 MGMT_OP_REMOVE_REMOTE_OOB_DATA, 6031 MGMT_STATUS_INVALID_PARAMS, 6032 &cp->addr, sizeof(cp->addr)); 6033 6034 hci_dev_lock(hdev); 6035 6036 if (!bacmp(&cp->addr.bdaddr, BDADDR_ANY)) { 6037 hci_remote_oob_data_clear(hdev); 6038 status = MGMT_STATUS_SUCCESS; 6039 goto done; 6040 } 6041 6042 err = hci_remove_remote_oob_data(hdev, &cp->addr.bdaddr, cp->addr.type); 6043 if (err < 0) 6044 status = MGMT_STATUS_INVALID_PARAMS; 6045 else 6046 status = MGMT_STATUS_SUCCESS; 6047 6048 done: 6049 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_REMOTE_OOB_DATA, 6050 status, &cp->addr, sizeof(cp->addr)); 6051 6052 hci_dev_unlock(hdev); 6053 return err; 6054 } 6055 6056 static bool discovery_type_is_valid(struct hci_dev *hdev, uint8_t type, 6057 uint8_t *mgmt_status) 6058 { 6059 switch (type) { 6060 case DISCOV_TYPE_LE: 6061 *mgmt_status = mgmt_le_support(hdev); 6062 if (*mgmt_status) 6063 return false; 6064 break; 6065 case DISCOV_TYPE_INTERLEAVED: 6066 *mgmt_status = mgmt_le_support(hdev); 6067 if (*mgmt_status) 6068 return false; 6069 fallthrough; 6070 case DISCOV_TYPE_BREDR: 6071 *mgmt_status = mgmt_bredr_support(hdev); 6072 if (*mgmt_status) 6073 return false; 6074 break; 6075 default: 6076 *mgmt_status = MGMT_STATUS_INVALID_PARAMS; 6077 return false; 6078 } 6079 6080 return true; 6081 } 6082 6083 static void start_discovery_complete(struct hci_dev *hdev, void *data, int err) 6084 { 6085 struct mgmt_pending_cmd *cmd = data; 6086 6087 bt_dev_dbg(hdev, "err %d", err); 6088 6089 if (err == -ECANCELED || !mgmt_pending_valid(hdev, cmd)) 6090 return; 6091 6092 mgmt_cmd_complete(cmd->sk, cmd->hdev->id, cmd->opcode, mgmt_status(err), 6093 cmd->param, 1); 6094 mgmt_pending_free(cmd); 6095 6096 hci_discovery_set_state(hdev, err ? DISCOVERY_STOPPED: 6097 DISCOVERY_FINDING); 6098 } 6099 6100 static int start_discovery_sync(struct hci_dev *hdev, void *data) 6101 { 6102 if (!mgmt_pending_listed(hdev, data)) 6103 return -ECANCELED; 6104 6105 return hci_start_discovery_sync(hdev); 6106 } 6107 6108 static int start_discovery_internal(struct sock *sk, struct hci_dev *hdev, 6109 u16 op, void *data, u16 len) 6110 { 6111 struct mgmt_cp_start_discovery *cp = data; 6112 struct mgmt_pending_cmd *cmd; 6113 u8 status; 6114 int err; 6115 6116 bt_dev_dbg(hdev, "sock %p", sk); 6117 6118 hci_dev_lock(hdev); 6119 6120 if (!hdev_is_powered(hdev)) { 6121 err = mgmt_cmd_complete(sk, hdev->id, op, 6122 MGMT_STATUS_NOT_POWERED, 6123 &cp->type, sizeof(cp->type)); 6124 goto failed; 6125 } 6126 6127 if (hdev->discovery.state != DISCOVERY_STOPPED || 6128 hci_dev_test_flag(hdev, HCI_PERIODIC_INQ)) { 6129 err = mgmt_cmd_complete(sk, hdev->id, op, MGMT_STATUS_BUSY, 6130 &cp->type, sizeof(cp->type)); 6131 goto failed; 6132 } 6133 6134 if (!discovery_type_is_valid(hdev, cp->type, &status)) { 6135 err = mgmt_cmd_complete(sk, hdev->id, op, status, 6136 &cp->type, sizeof(cp->type)); 6137 goto failed; 6138 } 6139 6140 /* Can't start discovery when it is paused */ 6141 if (hdev->discovery_paused) { 6142 err = mgmt_cmd_complete(sk, hdev->id, op, MGMT_STATUS_BUSY, 6143 &cp->type, sizeof(cp->type)); 6144 goto failed; 6145 } 6146 6147 /* Clear the discovery filter first to free any previously 6148 * allocated memory for the UUID list. 6149 */ 6150 hci_discovery_filter_clear(hdev); 6151 6152 hdev->discovery.type = cp->type; 6153 hdev->discovery.report_invalid_rssi = false; 6154 if (op == MGMT_OP_START_LIMITED_DISCOVERY) 6155 hdev->discovery.limited = true; 6156 else 6157 hdev->discovery.limited = false; 6158 6159 cmd = mgmt_pending_add(sk, op, hdev, data, len); 6160 if (!cmd) { 6161 err = -ENOMEM; 6162 goto failed; 6163 } 6164 6165 err = hci_cmd_sync_queue(hdev, start_discovery_sync, cmd, 6166 start_discovery_complete); 6167 if (err < 0) { 6168 mgmt_pending_remove(cmd); 6169 goto failed; 6170 } 6171 6172 hci_discovery_set_state(hdev, DISCOVERY_STARTING); 6173 6174 failed: 6175 hci_dev_unlock(hdev); 6176 return err; 6177 } 6178 6179 static int start_discovery(struct sock *sk, struct hci_dev *hdev, 6180 void *data, u16 len) 6181 { 6182 return start_discovery_internal(sk, hdev, MGMT_OP_START_DISCOVERY, 6183 data, len); 6184 } 6185 6186 static int start_limited_discovery(struct sock *sk, struct hci_dev *hdev, 6187 void *data, u16 len) 6188 { 6189 return start_discovery_internal(sk, hdev, 6190 MGMT_OP_START_LIMITED_DISCOVERY, 6191 data, len); 6192 } 6193 6194 static int start_service_discovery(struct sock *sk, struct hci_dev *hdev, 6195 void *data, u16 len) 6196 { 6197 struct mgmt_cp_start_service_discovery *cp = data; 6198 struct mgmt_pending_cmd *cmd; 6199 const u16 max_uuid_count = ((U16_MAX - sizeof(*cp)) / 16); 6200 u16 uuid_count, expected_len; 6201 u8 (*uuids)[16] = NULL; 6202 u8 status; 6203 int err; 6204 6205 bt_dev_dbg(hdev, "sock %p", sk); 6206 6207 hci_dev_lock(hdev); 6208 6209 if (!hdev_is_powered(hdev)) { 6210 err = mgmt_cmd_complete(sk, hdev->id, 6211 MGMT_OP_START_SERVICE_DISCOVERY, 6212 MGMT_STATUS_NOT_POWERED, 6213 &cp->type, sizeof(cp->type)); 6214 goto failed; 6215 } 6216 6217 if (hdev->discovery.state != DISCOVERY_STOPPED || 6218 hci_dev_test_flag(hdev, HCI_PERIODIC_INQ)) { 6219 err = mgmt_cmd_complete(sk, hdev->id, 6220 MGMT_OP_START_SERVICE_DISCOVERY, 6221 MGMT_STATUS_BUSY, &cp->type, 6222 sizeof(cp->type)); 6223 goto failed; 6224 } 6225 6226 if (hdev->discovery_paused) { 6227 err = mgmt_cmd_complete(sk, hdev->id, 6228 MGMT_OP_START_SERVICE_DISCOVERY, 6229 MGMT_STATUS_BUSY, &cp->type, 6230 sizeof(cp->type)); 6231 goto failed; 6232 } 6233 6234 uuid_count = __le16_to_cpu(cp->uuid_count); 6235 if (uuid_count > max_uuid_count) { 6236 bt_dev_err(hdev, "service_discovery: too big uuid_count value %u", 6237 uuid_count); 6238 err = mgmt_cmd_complete(sk, hdev->id, 6239 MGMT_OP_START_SERVICE_DISCOVERY, 6240 MGMT_STATUS_INVALID_PARAMS, &cp->type, 6241 sizeof(cp->type)); 6242 goto failed; 6243 } 6244 6245 expected_len = sizeof(*cp) + uuid_count * 16; 6246 if (expected_len != len) { 6247 bt_dev_err(hdev, "service_discovery: expected %u bytes, got %u bytes", 6248 expected_len, len); 6249 err = mgmt_cmd_complete(sk, hdev->id, 6250 MGMT_OP_START_SERVICE_DISCOVERY, 6251 MGMT_STATUS_INVALID_PARAMS, &cp->type, 6252 sizeof(cp->type)); 6253 goto failed; 6254 } 6255 6256 if (!discovery_type_is_valid(hdev, cp->type, &status)) { 6257 err = mgmt_cmd_complete(sk, hdev->id, 6258 MGMT_OP_START_SERVICE_DISCOVERY, 6259 status, &cp->type, sizeof(cp->type)); 6260 goto failed; 6261 } 6262 6263 cmd = mgmt_pending_add(sk, MGMT_OP_START_SERVICE_DISCOVERY, 6264 hdev, data, len); 6265 if (!cmd) { 6266 err = -ENOMEM; 6267 goto failed; 6268 } 6269 6270 /* Clear the discovery filter first to free any previously 6271 * allocated memory for the UUID list. 6272 */ 6273 hci_discovery_filter_clear(hdev); 6274 6275 hdev->discovery.result_filtering = true; 6276 hdev->discovery.type = cp->type; 6277 hdev->discovery.rssi = cp->rssi; 6278 6279 if (uuid_count > 0) { 6280 uuids = kmemdup(cp->uuids, uuid_count * sizeof(*uuids), GFP_KERNEL); 6281 if (!uuids) { 6282 err = mgmt_cmd_complete(sk, hdev->id, 6283 MGMT_OP_START_SERVICE_DISCOVERY, 6284 MGMT_STATUS_FAILED, 6285 &cp->type, sizeof(cp->type)); 6286 mgmt_pending_remove(cmd); 6287 goto failed; 6288 } 6289 } 6290 6291 spin_lock(&hdev->discovery.lock); 6292 hdev->discovery.uuids = uuids; 6293 hdev->discovery.uuid_count = uuid_count; 6294 spin_unlock(&hdev->discovery.lock); 6295 6296 err = hci_cmd_sync_queue(hdev, start_discovery_sync, cmd, 6297 start_discovery_complete); 6298 if (err < 0) { 6299 mgmt_pending_remove(cmd); 6300 goto failed; 6301 } 6302 6303 hci_discovery_set_state(hdev, DISCOVERY_STARTING); 6304 6305 failed: 6306 hci_dev_unlock(hdev); 6307 return err; 6308 } 6309 6310 static void stop_discovery_complete(struct hci_dev *hdev, void *data, int err) 6311 { 6312 struct mgmt_pending_cmd *cmd = data; 6313 6314 if (err == -ECANCELED || !mgmt_pending_valid(hdev, cmd)) 6315 return; 6316 6317 bt_dev_dbg(hdev, "err %d", err); 6318 6319 mgmt_cmd_complete(cmd->sk, cmd->hdev->id, cmd->opcode, mgmt_status(err), 6320 cmd->param, 1); 6321 mgmt_pending_free(cmd); 6322 6323 if (!err) 6324 hci_discovery_set_state(hdev, DISCOVERY_STOPPED); 6325 } 6326 6327 static int stop_discovery_sync(struct hci_dev *hdev, void *data) 6328 { 6329 if (!mgmt_pending_listed(hdev, data)) 6330 return -ECANCELED; 6331 6332 return hci_stop_discovery_sync(hdev); 6333 } 6334 6335 static int stop_discovery(struct sock *sk, struct hci_dev *hdev, void *data, 6336 u16 len) 6337 { 6338 struct mgmt_cp_stop_discovery *mgmt_cp = data; 6339 struct mgmt_pending_cmd *cmd; 6340 int err; 6341 6342 bt_dev_dbg(hdev, "sock %p", sk); 6343 6344 hci_dev_lock(hdev); 6345 6346 if (!hci_discovery_active(hdev)) { 6347 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY, 6348 MGMT_STATUS_REJECTED, &mgmt_cp->type, 6349 sizeof(mgmt_cp->type)); 6350 goto unlock; 6351 } 6352 6353 if (hdev->discovery.type != mgmt_cp->type) { 6354 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY, 6355 MGMT_STATUS_INVALID_PARAMS, 6356 &mgmt_cp->type, sizeof(mgmt_cp->type)); 6357 goto unlock; 6358 } 6359 6360 cmd = mgmt_pending_add(sk, MGMT_OP_STOP_DISCOVERY, hdev, data, len); 6361 if (!cmd) { 6362 err = -ENOMEM; 6363 goto unlock; 6364 } 6365 6366 err = hci_cmd_sync_queue(hdev, stop_discovery_sync, cmd, 6367 stop_discovery_complete); 6368 if (err < 0) { 6369 mgmt_pending_remove(cmd); 6370 goto unlock; 6371 } 6372 6373 hci_discovery_set_state(hdev, DISCOVERY_STOPPING); 6374 6375 unlock: 6376 hci_dev_unlock(hdev); 6377 return err; 6378 } 6379 6380 static int confirm_name(struct sock *sk, struct hci_dev *hdev, void *data, 6381 u16 len) 6382 { 6383 struct mgmt_cp_confirm_name *cp = data; 6384 struct inquiry_entry *e; 6385 int err; 6386 6387 bt_dev_dbg(hdev, "sock %p", sk); 6388 6389 hci_dev_lock(hdev); 6390 6391 if (!hci_discovery_active(hdev)) { 6392 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME, 6393 MGMT_STATUS_FAILED, &cp->addr, 6394 sizeof(cp->addr)); 6395 goto failed; 6396 } 6397 6398 e = hci_inquiry_cache_lookup_unknown(hdev, &cp->addr.bdaddr); 6399 if (!e) { 6400 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME, 6401 MGMT_STATUS_INVALID_PARAMS, &cp->addr, 6402 sizeof(cp->addr)); 6403 goto failed; 6404 } 6405 6406 if (cp->name_known) { 6407 e->name_state = NAME_KNOWN; 6408 list_del(&e->list); 6409 } else { 6410 e->name_state = NAME_NEEDED; 6411 hci_inquiry_cache_update_resolve(hdev, e); 6412 } 6413 6414 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME, 0, 6415 &cp->addr, sizeof(cp->addr)); 6416 6417 failed: 6418 hci_dev_unlock(hdev); 6419 return err; 6420 } 6421 6422 static int block_device(struct sock *sk, struct hci_dev *hdev, void *data, 6423 u16 len) 6424 { 6425 struct mgmt_cp_block_device *cp = data; 6426 u8 status; 6427 int err; 6428 6429 bt_dev_dbg(hdev, "sock %p", sk); 6430 6431 if (!bdaddr_type_is_valid(cp->addr.type)) 6432 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_BLOCK_DEVICE, 6433 MGMT_STATUS_INVALID_PARAMS, 6434 &cp->addr, sizeof(cp->addr)); 6435 6436 hci_dev_lock(hdev); 6437 6438 err = hci_bdaddr_list_add(&hdev->reject_list, &cp->addr.bdaddr, 6439 cp->addr.type); 6440 if (err < 0) { 6441 status = MGMT_STATUS_FAILED; 6442 goto done; 6443 } 6444 6445 mgmt_event(MGMT_EV_DEVICE_BLOCKED, hdev, &cp->addr, sizeof(cp->addr), 6446 sk); 6447 status = MGMT_STATUS_SUCCESS; 6448 6449 done: 6450 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_BLOCK_DEVICE, status, 6451 &cp->addr, sizeof(cp->addr)); 6452 6453 hci_dev_unlock(hdev); 6454 6455 return err; 6456 } 6457 6458 static int unblock_device(struct sock *sk, struct hci_dev *hdev, void *data, 6459 u16 len) 6460 { 6461 struct mgmt_cp_unblock_device *cp = data; 6462 u8 status; 6463 int err; 6464 6465 bt_dev_dbg(hdev, "sock %p", sk); 6466 6467 if (!bdaddr_type_is_valid(cp->addr.type)) 6468 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNBLOCK_DEVICE, 6469 MGMT_STATUS_INVALID_PARAMS, 6470 &cp->addr, sizeof(cp->addr)); 6471 6472 hci_dev_lock(hdev); 6473 6474 err = hci_bdaddr_list_del(&hdev->reject_list, &cp->addr.bdaddr, 6475 cp->addr.type); 6476 if (err < 0) { 6477 status = MGMT_STATUS_INVALID_PARAMS; 6478 goto done; 6479 } 6480 6481 mgmt_event(MGMT_EV_DEVICE_UNBLOCKED, hdev, &cp->addr, sizeof(cp->addr), 6482 sk); 6483 status = MGMT_STATUS_SUCCESS; 6484 6485 done: 6486 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNBLOCK_DEVICE, status, 6487 &cp->addr, sizeof(cp->addr)); 6488 6489 hci_dev_unlock(hdev); 6490 6491 return err; 6492 } 6493 6494 static int set_device_id_sync(struct hci_dev *hdev, void *data) 6495 { 6496 return hci_update_eir_sync(hdev); 6497 } 6498 6499 static int set_device_id(struct sock *sk, struct hci_dev *hdev, void *data, 6500 u16 len) 6501 { 6502 struct mgmt_cp_set_device_id *cp = data; 6503 int err; 6504 __u16 source; 6505 6506 bt_dev_dbg(hdev, "sock %p", sk); 6507 6508 source = __le16_to_cpu(cp->source); 6509 6510 if (source > 0x0002) 6511 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEVICE_ID, 6512 MGMT_STATUS_INVALID_PARAMS); 6513 6514 hci_dev_lock(hdev); 6515 6516 hdev->devid_source = source; 6517 hdev->devid_vendor = __le16_to_cpu(cp->vendor); 6518 hdev->devid_product = __le16_to_cpu(cp->product); 6519 hdev->devid_version = __le16_to_cpu(cp->version); 6520 6521 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_DEVICE_ID, 0, 6522 NULL, 0); 6523 6524 hci_cmd_sync_queue(hdev, set_device_id_sync, NULL, NULL); 6525 6526 hci_dev_unlock(hdev); 6527 6528 return err; 6529 } 6530 6531 static void enable_advertising_instance(struct hci_dev *hdev, int err) 6532 { 6533 if (err) 6534 bt_dev_err(hdev, "failed to re-configure advertising %d", err); 6535 else 6536 bt_dev_dbg(hdev, "status %d", err); 6537 } 6538 6539 static void set_advertising_complete(struct hci_dev *hdev, void *data, int err) 6540 { 6541 struct mgmt_pending_cmd *cmd = data; 6542 struct cmd_lookup match = { NULL, hdev }; 6543 u8 instance; 6544 struct adv_info *adv_instance; 6545 u8 status = mgmt_status(err); 6546 6547 if (err == -ECANCELED || !mgmt_pending_valid(hdev, data)) 6548 return; 6549 6550 if (status) { 6551 mgmt_cmd_status(cmd->sk, cmd->hdev->id, cmd->opcode, status); 6552 mgmt_pending_free(cmd); 6553 return; 6554 } 6555 6556 /* With extended advertising global advertising (instance 0) has its 6557 * own advertising set so only consider its state, other instances may 6558 * still be enabled. 6559 */ 6560 if (ext_adv_capable(hdev) ? hci_dev_test_flag(hdev, HCI_LE_ADV_0) : 6561 hci_dev_test_flag(hdev, HCI_LE_ADV)) 6562 hci_dev_set_flag(hdev, HCI_ADVERTISING); 6563 else 6564 hci_dev_clear_flag(hdev, HCI_ADVERTISING); 6565 6566 settings_rsp(cmd, &match); 6567 mgmt_pending_free(cmd); 6568 6569 new_settings(hdev, match.sk); 6570 6571 if (match.sk) 6572 sock_put(match.sk); 6573 6574 /* If "Set Advertising" was just disabled and instance advertising was 6575 * set up earlier, then re-enable multi-instance advertising. 6576 */ 6577 if (hci_dev_test_flag(hdev, HCI_ADVERTISING) || 6578 list_empty(&hdev->adv_instances)) 6579 return; 6580 6581 /* With extended advertising instances are not overridden by global 6582 * advertising, except the ones sharing its set, so only (re)start the 6583 * instances that are not already enabled. 6584 * 6585 * Lookup instances by identifier while holding hdev->lock since the 6586 * list may change while waiting for the HCI commands to complete. 6587 */ 6588 if (ext_adv_capable(hdev)) { 6589 u16 i; 6590 6591 for (i = 1; i <= hdev->le_num_of_adv_sets + 1; i++) { 6592 bool enabled; 6593 6594 hci_dev_lock(hdev); 6595 adv_instance = hci_find_adv_instance(hdev, i); 6596 enabled = !adv_instance || adv_instance->enabled; 6597 hci_dev_unlock(hdev); 6598 6599 if (enabled) 6600 continue; 6601 6602 err = hci_schedule_adv_instance_sync(hdev, i, true); 6603 enable_advertising_instance(hdev, err); 6604 } 6605 6606 return; 6607 } 6608 6609 instance = hdev->cur_adv_instance; 6610 if (!instance) { 6611 adv_instance = list_first_entry_or_null(&hdev->adv_instances, 6612 struct adv_info, list); 6613 if (!adv_instance) 6614 return; 6615 6616 instance = adv_instance->instance; 6617 } 6618 6619 err = hci_schedule_adv_instance_sync(hdev, instance, true); 6620 6621 enable_advertising_instance(hdev, err); 6622 } 6623 6624 static int set_adv_sync(struct hci_dev *hdev, void *data) 6625 { 6626 struct mgmt_pending_cmd *cmd = data; 6627 struct mgmt_mode cp; 6628 u8 val; 6629 6630 mutex_lock(&hdev->mgmt_pending_lock); 6631 6632 if (!__mgmt_pending_listed(hdev, cmd)) { 6633 mutex_unlock(&hdev->mgmt_pending_lock); 6634 return -ECANCELED; 6635 } 6636 6637 memcpy(&cp, cmd->param, sizeof(cp)); 6638 6639 mutex_unlock(&hdev->mgmt_pending_lock); 6640 6641 val = !!cp.val; 6642 6643 if (cp.val == 0x02) 6644 hci_dev_set_flag(hdev, HCI_ADVERTISING_CONNECTABLE); 6645 else 6646 hci_dev_clear_flag(hdev, HCI_ADVERTISING_CONNECTABLE); 6647 6648 cancel_adv_timeout(hdev); 6649 6650 if (val) { 6651 /* Switch to instance "0" for the Set Advertising setting. 6652 * We cannot use update_[adv|scan_rsp]_data() here as the 6653 * HCI_ADVERTISING flag is not yet set. 6654 */ 6655 hdev->cur_adv_instance = 0x00; 6656 6657 if (ext_adv_capable(hdev)) { 6658 hci_start_ext_adv_sync(hdev, 0x00); 6659 } else { 6660 hci_update_adv_data_sync(hdev, 0x00); 6661 hci_update_scan_rsp_data_sync(hdev, 0x00); 6662 hci_enable_advertising_sync(hdev); 6663 } 6664 } else if (ext_adv_capable(hdev)) { 6665 /* Only disable global advertising (instance 0) leaving other 6666 * instances untouched. 6667 */ 6668 hci_disable_ext_adv_legacy_instance_sync(hdev); 6669 } else { 6670 hci_disable_advertising_sync(hdev); 6671 } 6672 6673 return 0; 6674 } 6675 6676 static int set_advertising(struct sock *sk, struct hci_dev *hdev, void *data, 6677 u16 len) 6678 { 6679 struct mgmt_mode *cp = data; 6680 struct mgmt_pending_cmd *cmd; 6681 u8 val, status; 6682 int err; 6683 6684 bt_dev_dbg(hdev, "sock %p", sk); 6685 6686 status = mgmt_le_support(hdev); 6687 if (status) 6688 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING, 6689 status); 6690 6691 if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02) 6692 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING, 6693 MGMT_STATUS_INVALID_PARAMS); 6694 6695 if (hdev->advertising_paused) 6696 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING, 6697 MGMT_STATUS_BUSY); 6698 6699 hci_dev_lock(hdev); 6700 6701 val = !!cp->val; 6702 6703 /* The following conditions are ones which mean that we should 6704 * not do any HCI communication but directly send a mgmt 6705 * response to user space (after toggling the flag if 6706 * necessary). 6707 */ 6708 if (!hdev_is_powered(hdev) || 6709 (val == hci_dev_test_flag(hdev, HCI_ADVERTISING) && 6710 (cp->val == 0x02) == hci_dev_test_flag(hdev, HCI_ADVERTISING_CONNECTABLE)) || 6711 hci_dev_test_flag(hdev, HCI_MESH) || 6712 hci_conn_num(hdev, LE_LINK) > 0 || 6713 (hci_dev_test_flag(hdev, HCI_LE_SCAN) && 6714 hdev->le_scan_type == LE_SCAN_ACTIVE)) { 6715 bool changed; 6716 6717 if (cp->val) { 6718 hdev->cur_adv_instance = 0x00; 6719 changed = !hci_dev_test_and_set_flag(hdev, HCI_ADVERTISING); 6720 if (cp->val == 0x02) 6721 hci_dev_set_flag(hdev, HCI_ADVERTISING_CONNECTABLE); 6722 else 6723 hci_dev_clear_flag(hdev, HCI_ADVERTISING_CONNECTABLE); 6724 } else { 6725 changed = hci_dev_test_and_clear_flag(hdev, HCI_ADVERTISING); 6726 hci_dev_clear_flag(hdev, HCI_ADVERTISING_CONNECTABLE); 6727 } 6728 6729 err = send_settings_rsp(sk, MGMT_OP_SET_ADVERTISING, hdev); 6730 if (err < 0) 6731 goto unlock; 6732 6733 if (changed) 6734 err = new_settings(hdev, sk); 6735 6736 goto unlock; 6737 } 6738 6739 if (pending_find(MGMT_OP_SET_ADVERTISING, hdev) || 6740 pending_find(MGMT_OP_SET_LE, hdev)) { 6741 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING, 6742 MGMT_STATUS_BUSY); 6743 goto unlock; 6744 } 6745 6746 cmd = mgmt_pending_add(sk, MGMT_OP_SET_ADVERTISING, hdev, data, len); 6747 if (!cmd) 6748 err = -ENOMEM; 6749 else 6750 err = hci_cmd_sync_queue(hdev, set_adv_sync, cmd, 6751 set_advertising_complete); 6752 6753 if (err < 0 && cmd) 6754 mgmt_pending_remove(cmd); 6755 6756 unlock: 6757 hci_dev_unlock(hdev); 6758 return err; 6759 } 6760 6761 static int set_static_address(struct sock *sk, struct hci_dev *hdev, 6762 void *data, u16 len) 6763 { 6764 struct mgmt_cp_set_static_address *cp = data; 6765 int err; 6766 6767 bt_dev_dbg(hdev, "sock %p", sk); 6768 6769 if (!lmp_le_capable(hdev)) 6770 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_STATIC_ADDRESS, 6771 MGMT_STATUS_NOT_SUPPORTED); 6772 6773 if (hdev_is_powered(hdev)) 6774 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_STATIC_ADDRESS, 6775 MGMT_STATUS_REJECTED); 6776 6777 if (bacmp(&cp->bdaddr, BDADDR_ANY)) { 6778 if (!bacmp(&cp->bdaddr, BDADDR_NONE)) 6779 return mgmt_cmd_status(sk, hdev->id, 6780 MGMT_OP_SET_STATIC_ADDRESS, 6781 MGMT_STATUS_INVALID_PARAMS); 6782 6783 /* Two most significant bits shall be set */ 6784 if ((cp->bdaddr.b[5] & 0xc0) != 0xc0) 6785 return mgmt_cmd_status(sk, hdev->id, 6786 MGMT_OP_SET_STATIC_ADDRESS, 6787 MGMT_STATUS_INVALID_PARAMS); 6788 } 6789 6790 hci_dev_lock(hdev); 6791 6792 bacpy(&hdev->static_addr, &cp->bdaddr); 6793 6794 err = send_settings_rsp(sk, MGMT_OP_SET_STATIC_ADDRESS, hdev); 6795 if (err < 0) 6796 goto unlock; 6797 6798 err = new_settings(hdev, sk); 6799 6800 unlock: 6801 hci_dev_unlock(hdev); 6802 return err; 6803 } 6804 6805 static int set_scan_params(struct sock *sk, struct hci_dev *hdev, 6806 void *data, u16 len) 6807 { 6808 struct mgmt_cp_set_scan_params *cp = data; 6809 __u16 interval, window; 6810 int err; 6811 6812 bt_dev_dbg(hdev, "sock %p", sk); 6813 6814 if (!lmp_le_capable(hdev)) 6815 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS, 6816 MGMT_STATUS_NOT_SUPPORTED); 6817 6818 /* Keep allowed ranges in sync with set_mesh() */ 6819 interval = __le16_to_cpu(cp->interval); 6820 6821 if (interval < 0x0004 || interval > 0x4000) 6822 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS, 6823 MGMT_STATUS_INVALID_PARAMS); 6824 6825 window = __le16_to_cpu(cp->window); 6826 6827 if (window < 0x0004 || window > 0x4000) 6828 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS, 6829 MGMT_STATUS_INVALID_PARAMS); 6830 6831 if (window > interval) 6832 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS, 6833 MGMT_STATUS_INVALID_PARAMS); 6834 6835 hci_dev_lock(hdev); 6836 6837 hdev->le_scan_interval = interval; 6838 hdev->le_scan_window = window; 6839 6840 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS, 0, 6841 NULL, 0); 6842 6843 /* If background scan is running, restart it so new parameters are 6844 * loaded. 6845 */ 6846 if (hci_dev_test_flag(hdev, HCI_LE_SCAN) && 6847 hdev->discovery.state == DISCOVERY_STOPPED) 6848 hci_update_passive_scan(hdev); 6849 6850 hci_dev_unlock(hdev); 6851 6852 return err; 6853 } 6854 6855 static void fast_connectable_complete(struct hci_dev *hdev, void *data, int err) 6856 { 6857 struct mgmt_pending_cmd *cmd = data; 6858 6859 bt_dev_dbg(hdev, "err %d", err); 6860 6861 if (err) { 6862 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE, 6863 mgmt_status(err)); 6864 } else { 6865 struct mgmt_mode *cp = cmd->param; 6866 6867 if (cp->val) 6868 hci_dev_set_flag(hdev, HCI_FAST_CONNECTABLE); 6869 else 6870 hci_dev_clear_flag(hdev, HCI_FAST_CONNECTABLE); 6871 6872 send_settings_rsp(cmd->sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev); 6873 new_settings(hdev, cmd->sk); 6874 } 6875 6876 mgmt_pending_free(cmd); 6877 } 6878 6879 static int write_fast_connectable_sync(struct hci_dev *hdev, void *data) 6880 { 6881 struct mgmt_pending_cmd *cmd = data; 6882 struct mgmt_mode *cp = cmd->param; 6883 6884 return hci_write_fast_connectable_sync(hdev, cp->val); 6885 } 6886 6887 static int set_fast_connectable(struct sock *sk, struct hci_dev *hdev, 6888 void *data, u16 len) 6889 { 6890 struct mgmt_mode *cp = data; 6891 struct mgmt_pending_cmd *cmd; 6892 int err; 6893 6894 bt_dev_dbg(hdev, "sock %p", sk); 6895 6896 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) || 6897 hdev->hci_ver < BLUETOOTH_VER_1_2) 6898 return mgmt_cmd_status(sk, hdev->id, 6899 MGMT_OP_SET_FAST_CONNECTABLE, 6900 MGMT_STATUS_NOT_SUPPORTED); 6901 6902 if (cp->val != 0x00 && cp->val != 0x01) 6903 return mgmt_cmd_status(sk, hdev->id, 6904 MGMT_OP_SET_FAST_CONNECTABLE, 6905 MGMT_STATUS_INVALID_PARAMS); 6906 6907 hci_dev_lock(hdev); 6908 6909 if (!!cp->val == hci_dev_test_flag(hdev, HCI_FAST_CONNECTABLE)) { 6910 err = send_settings_rsp(sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev); 6911 goto unlock; 6912 } 6913 6914 if (!hdev_is_powered(hdev)) { 6915 hci_dev_change_flag(hdev, HCI_FAST_CONNECTABLE); 6916 err = send_settings_rsp(sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev); 6917 new_settings(hdev, sk); 6918 goto unlock; 6919 } 6920 6921 cmd = mgmt_pending_new(sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev, data, 6922 len); 6923 if (!cmd) 6924 err = -ENOMEM; 6925 else 6926 err = hci_cmd_sync_queue(hdev, write_fast_connectable_sync, cmd, 6927 fast_connectable_complete); 6928 6929 if (err < 0) { 6930 mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE, 6931 MGMT_STATUS_FAILED); 6932 6933 if (cmd) 6934 mgmt_pending_free(cmd); 6935 } 6936 6937 unlock: 6938 hci_dev_unlock(hdev); 6939 6940 return err; 6941 } 6942 6943 static void set_bredr_complete(struct hci_dev *hdev, void *data, int err) 6944 { 6945 struct mgmt_pending_cmd *cmd = data; 6946 6947 bt_dev_dbg(hdev, "err %d", err); 6948 6949 if (err) { 6950 u8 mgmt_err = mgmt_status(err); 6951 6952 /* We need to restore the flag if related HCI commands 6953 * failed. 6954 */ 6955 hci_dev_clear_flag(hdev, HCI_BREDR_ENABLED); 6956 6957 mgmt_cmd_status(cmd->sk, cmd->hdev->id, cmd->opcode, mgmt_err); 6958 } else { 6959 send_settings_rsp(cmd->sk, MGMT_OP_SET_BREDR, hdev); 6960 new_settings(hdev, cmd->sk); 6961 } 6962 6963 mgmt_pending_free(cmd); 6964 } 6965 6966 static int set_bredr_sync(struct hci_dev *hdev, void *data) 6967 { 6968 int status; 6969 6970 status = hci_write_fast_connectable_sync(hdev, false); 6971 6972 if (!status) 6973 status = hci_update_scan_sync(hdev); 6974 6975 /* Since only the advertising data flags will change, there 6976 * is no need to update the scan response data. 6977 */ 6978 if (!status) 6979 status = hci_update_adv_data_sync(hdev, hdev->cur_adv_instance); 6980 6981 return status; 6982 } 6983 6984 static int set_bredr(struct sock *sk, struct hci_dev *hdev, void *data, u16 len) 6985 { 6986 struct mgmt_mode *cp = data; 6987 struct mgmt_pending_cmd *cmd; 6988 int err; 6989 6990 bt_dev_dbg(hdev, "sock %p", sk); 6991 6992 if (!lmp_bredr_capable(hdev) || !lmp_le_capable(hdev)) 6993 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR, 6994 MGMT_STATUS_NOT_SUPPORTED); 6995 6996 if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED)) 6997 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR, 6998 MGMT_STATUS_REJECTED); 6999 7000 if (cp->val != 0x00 && cp->val != 0x01) 7001 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR, 7002 MGMT_STATUS_INVALID_PARAMS); 7003 7004 hci_dev_lock(hdev); 7005 7006 if (cp->val == hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) { 7007 err = send_settings_rsp(sk, MGMT_OP_SET_BREDR, hdev); 7008 goto unlock; 7009 } 7010 7011 if (!hdev_is_powered(hdev)) { 7012 if (!cp->val) { 7013 hci_dev_clear_flag(hdev, HCI_DISCOVERABLE); 7014 hci_dev_clear_flag(hdev, HCI_SSP_ENABLED); 7015 hci_dev_clear_flag(hdev, HCI_LINK_SECURITY); 7016 hci_dev_clear_flag(hdev, HCI_FAST_CONNECTABLE); 7017 } 7018 7019 hci_dev_change_flag(hdev, HCI_BREDR_ENABLED); 7020 7021 err = send_settings_rsp(sk, MGMT_OP_SET_BREDR, hdev); 7022 if (err < 0) 7023 goto unlock; 7024 7025 err = new_settings(hdev, sk); 7026 goto unlock; 7027 } 7028 7029 /* Reject disabling when powered on */ 7030 if (!cp->val) { 7031 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR, 7032 MGMT_STATUS_REJECTED); 7033 goto unlock; 7034 } else { 7035 /* When configuring a dual-mode controller to operate 7036 * with LE only and using a static address, then switching 7037 * BR/EDR back on is not allowed. 7038 * 7039 * Dual-mode controllers shall operate with the public 7040 * address as its identity address for BR/EDR and LE. So 7041 * reject the attempt to create an invalid configuration. 7042 * 7043 * The same restrictions applies when secure connections 7044 * has been enabled. For BR/EDR this is a controller feature 7045 * while for LE it is a host stack feature. This means that 7046 * switching BR/EDR back on when secure connections has been 7047 * enabled is not a supported transaction. 7048 */ 7049 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) && 7050 (bacmp(&hdev->static_addr, BDADDR_ANY) || 7051 hci_dev_test_flag(hdev, HCI_SC_ENABLED))) { 7052 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR, 7053 MGMT_STATUS_REJECTED); 7054 goto unlock; 7055 } 7056 } 7057 7058 cmd = mgmt_pending_new(sk, MGMT_OP_SET_BREDR, hdev, data, len); 7059 if (!cmd) 7060 err = -ENOMEM; 7061 else 7062 err = hci_cmd_sync_queue(hdev, set_bredr_sync, cmd, 7063 set_bredr_complete); 7064 7065 if (err < 0) { 7066 mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR, 7067 MGMT_STATUS_FAILED); 7068 if (cmd) 7069 mgmt_pending_free(cmd); 7070 7071 goto unlock; 7072 } 7073 7074 /* We need to flip the bit already here so that 7075 * hci_req_update_adv_data generates the correct flags. 7076 */ 7077 hci_dev_set_flag(hdev, HCI_BREDR_ENABLED); 7078 7079 unlock: 7080 hci_dev_unlock(hdev); 7081 return err; 7082 } 7083 7084 static void set_secure_conn_complete(struct hci_dev *hdev, void *data, int err) 7085 { 7086 struct mgmt_pending_cmd *cmd = data; 7087 struct mgmt_mode *cp; 7088 7089 bt_dev_dbg(hdev, "err %d", err); 7090 7091 if (err) { 7092 u8 mgmt_err = mgmt_status(err); 7093 7094 mgmt_cmd_status(cmd->sk, cmd->hdev->id, cmd->opcode, mgmt_err); 7095 goto done; 7096 } 7097 7098 cp = cmd->param; 7099 7100 switch (cp->val) { 7101 case 0x00: 7102 hci_dev_clear_flag(hdev, HCI_SC_ENABLED); 7103 hci_dev_clear_flag(hdev, HCI_SC_ONLY); 7104 break; 7105 case 0x01: 7106 hci_dev_set_flag(hdev, HCI_SC_ENABLED); 7107 hci_dev_clear_flag(hdev, HCI_SC_ONLY); 7108 break; 7109 case 0x02: 7110 hci_dev_set_flag(hdev, HCI_SC_ENABLED); 7111 hci_dev_set_flag(hdev, HCI_SC_ONLY); 7112 break; 7113 } 7114 7115 send_settings_rsp(cmd->sk, cmd->opcode, hdev); 7116 new_settings(hdev, cmd->sk); 7117 7118 done: 7119 mgmt_pending_free(cmd); 7120 } 7121 7122 static int set_secure_conn_sync(struct hci_dev *hdev, void *data) 7123 { 7124 struct mgmt_pending_cmd *cmd = data; 7125 struct mgmt_mode *cp = cmd->param; 7126 u8 val = !!cp->val; 7127 7128 /* Force write of val */ 7129 hci_dev_set_flag(hdev, HCI_SC_ENABLED); 7130 7131 return hci_write_sc_support_sync(hdev, val); 7132 } 7133 7134 static int set_secure_conn(struct sock *sk, struct hci_dev *hdev, 7135 void *data, u16 len) 7136 { 7137 struct mgmt_mode *cp = data; 7138 struct mgmt_pending_cmd *cmd; 7139 u8 val; 7140 int err; 7141 7142 bt_dev_dbg(hdev, "sock %p", sk); 7143 7144 if (!lmp_sc_capable(hdev) && 7145 !hci_dev_test_flag(hdev, HCI_LE_ENABLED)) 7146 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN, 7147 MGMT_STATUS_NOT_SUPPORTED); 7148 7149 if (hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) && 7150 lmp_sc_capable(hdev) && 7151 !hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) 7152 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN, 7153 MGMT_STATUS_REJECTED); 7154 7155 if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02) 7156 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN, 7157 MGMT_STATUS_INVALID_PARAMS); 7158 7159 hci_dev_lock(hdev); 7160 7161 if (!hdev_is_powered(hdev) || !lmp_sc_capable(hdev) || 7162 !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) { 7163 bool changed; 7164 7165 if (cp->val) { 7166 changed = !hci_dev_test_and_set_flag(hdev, 7167 HCI_SC_ENABLED); 7168 if (cp->val == 0x02) 7169 hci_dev_set_flag(hdev, HCI_SC_ONLY); 7170 else 7171 hci_dev_clear_flag(hdev, HCI_SC_ONLY); 7172 } else { 7173 changed = hci_dev_test_and_clear_flag(hdev, 7174 HCI_SC_ENABLED); 7175 hci_dev_clear_flag(hdev, HCI_SC_ONLY); 7176 } 7177 7178 err = send_settings_rsp(sk, MGMT_OP_SET_SECURE_CONN, hdev); 7179 if (err < 0) 7180 goto failed; 7181 7182 if (changed) 7183 err = new_settings(hdev, sk); 7184 7185 goto failed; 7186 } 7187 7188 val = !!cp->val; 7189 7190 if (val == hci_dev_test_flag(hdev, HCI_SC_ENABLED) && 7191 (cp->val == 0x02) == hci_dev_test_flag(hdev, HCI_SC_ONLY)) { 7192 err = send_settings_rsp(sk, MGMT_OP_SET_SECURE_CONN, hdev); 7193 goto failed; 7194 } 7195 7196 cmd = mgmt_pending_new(sk, MGMT_OP_SET_SECURE_CONN, hdev, data, len); 7197 if (!cmd) 7198 err = -ENOMEM; 7199 else 7200 err = hci_cmd_sync_queue(hdev, set_secure_conn_sync, cmd, 7201 set_secure_conn_complete); 7202 7203 if (err < 0) { 7204 mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN, 7205 MGMT_STATUS_FAILED); 7206 if (cmd) 7207 mgmt_pending_free(cmd); 7208 } 7209 7210 failed: 7211 hci_dev_unlock(hdev); 7212 return err; 7213 } 7214 7215 static int set_debug_keys(struct sock *sk, struct hci_dev *hdev, 7216 void *data, u16 len) 7217 { 7218 struct mgmt_mode *cp = data; 7219 bool changed, use_changed; 7220 int err; 7221 7222 bt_dev_dbg(hdev, "sock %p", sk); 7223 7224 if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02) 7225 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEBUG_KEYS, 7226 MGMT_STATUS_INVALID_PARAMS); 7227 7228 hci_dev_lock(hdev); 7229 7230 if (cp->val) 7231 changed = !hci_dev_test_and_set_flag(hdev, HCI_KEEP_DEBUG_KEYS); 7232 else 7233 changed = hci_dev_test_and_clear_flag(hdev, 7234 HCI_KEEP_DEBUG_KEYS); 7235 7236 if (cp->val == 0x02) 7237 use_changed = !hci_dev_test_and_set_flag(hdev, 7238 HCI_USE_DEBUG_KEYS); 7239 else 7240 use_changed = hci_dev_test_and_clear_flag(hdev, 7241 HCI_USE_DEBUG_KEYS); 7242 7243 if (hdev_is_powered(hdev) && use_changed && 7244 hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) { 7245 u8 mode = (cp->val == 0x02) ? 0x01 : 0x00; 7246 hci_send_cmd(hdev, HCI_OP_WRITE_SSP_DEBUG_MODE, 7247 sizeof(mode), &mode); 7248 } 7249 7250 err = send_settings_rsp(sk, MGMT_OP_SET_DEBUG_KEYS, hdev); 7251 if (err < 0) 7252 goto unlock; 7253 7254 if (changed) 7255 err = new_settings(hdev, sk); 7256 7257 unlock: 7258 hci_dev_unlock(hdev); 7259 return err; 7260 } 7261 7262 static int set_privacy(struct sock *sk, struct hci_dev *hdev, void *cp_data, 7263 u16 len) 7264 { 7265 struct mgmt_cp_set_privacy *cp = cp_data; 7266 bool changed; 7267 int err; 7268 7269 bt_dev_dbg(hdev, "sock %p", sk); 7270 7271 if (!lmp_le_capable(hdev)) 7272 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY, 7273 MGMT_STATUS_NOT_SUPPORTED); 7274 7275 if (cp->privacy != 0x00 && cp->privacy != 0x01 && cp->privacy != 0x02) 7276 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY, 7277 MGMT_STATUS_INVALID_PARAMS); 7278 7279 if (hdev_is_powered(hdev)) 7280 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY, 7281 MGMT_STATUS_REJECTED); 7282 7283 hci_dev_lock(hdev); 7284 7285 /* If user space supports this command it is also expected to 7286 * handle IRKs. Therefore, set the HCI_RPA_RESOLVING flag. 7287 */ 7288 hci_dev_set_flag(hdev, HCI_RPA_RESOLVING); 7289 7290 if (cp->privacy) { 7291 changed = !hci_dev_test_and_set_flag(hdev, HCI_PRIVACY); 7292 memcpy(hdev->irk, cp->irk, sizeof(hdev->irk)); 7293 hci_dev_set_flag(hdev, HCI_RPA_EXPIRED); 7294 hci_adv_instances_set_rpa_expired(hdev, true); 7295 if (cp->privacy == 0x02) 7296 hci_dev_set_flag(hdev, HCI_LIMITED_PRIVACY); 7297 else 7298 hci_dev_clear_flag(hdev, HCI_LIMITED_PRIVACY); 7299 } else { 7300 changed = hci_dev_test_and_clear_flag(hdev, HCI_PRIVACY); 7301 memset(hdev->irk, 0, sizeof(hdev->irk)); 7302 hci_dev_clear_flag(hdev, HCI_RPA_EXPIRED); 7303 hci_adv_instances_set_rpa_expired(hdev, false); 7304 hci_dev_clear_flag(hdev, HCI_LIMITED_PRIVACY); 7305 } 7306 7307 err = send_settings_rsp(sk, MGMT_OP_SET_PRIVACY, hdev); 7308 if (err < 0) 7309 goto unlock; 7310 7311 if (changed) 7312 err = new_settings(hdev, sk); 7313 7314 unlock: 7315 hci_dev_unlock(hdev); 7316 return err; 7317 } 7318 7319 static bool irk_is_valid(struct mgmt_irk_info *irk) 7320 { 7321 switch (irk->addr.type) { 7322 case BDADDR_LE_PUBLIC: 7323 return true; 7324 7325 case BDADDR_LE_RANDOM: 7326 /* Two most significant bits shall be set */ 7327 if ((irk->addr.bdaddr.b[5] & 0xc0) != 0xc0) 7328 return false; 7329 return true; 7330 } 7331 7332 return false; 7333 } 7334 7335 static int load_irks(struct sock *sk, struct hci_dev *hdev, void *cp_data, 7336 u16 len) 7337 { 7338 struct mgmt_cp_load_irks *cp = cp_data; 7339 const u16 max_irk_count = ((U16_MAX - sizeof(*cp)) / 7340 sizeof(struct mgmt_irk_info)); 7341 u16 irk_count, expected_len; 7342 int i, err; 7343 7344 bt_dev_dbg(hdev, "sock %p", sk); 7345 7346 if (!lmp_le_capable(hdev)) 7347 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS, 7348 MGMT_STATUS_NOT_SUPPORTED); 7349 7350 irk_count = __le16_to_cpu(cp->irk_count); 7351 if (irk_count > max_irk_count) { 7352 bt_dev_err(hdev, "load_irks: too big irk_count value %u", 7353 irk_count); 7354 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS, 7355 MGMT_STATUS_INVALID_PARAMS); 7356 } 7357 7358 expected_len = struct_size(cp, irks, irk_count); 7359 if (expected_len != len) { 7360 bt_dev_err(hdev, "load_irks: expected %u bytes, got %u bytes", 7361 expected_len, len); 7362 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS, 7363 MGMT_STATUS_INVALID_PARAMS); 7364 } 7365 7366 bt_dev_dbg(hdev, "irk_count %u", irk_count); 7367 7368 for (i = 0; i < irk_count; i++) { 7369 struct mgmt_irk_info *key = &cp->irks[i]; 7370 7371 if (!irk_is_valid(key)) 7372 return mgmt_cmd_status(sk, hdev->id, 7373 MGMT_OP_LOAD_IRKS, 7374 MGMT_STATUS_INVALID_PARAMS); 7375 } 7376 7377 hci_dev_lock(hdev); 7378 7379 hci_smp_irks_clear(hdev); 7380 7381 for (i = 0; i < irk_count; i++) { 7382 struct mgmt_irk_info *irk = &cp->irks[i]; 7383 7384 if (hci_is_blocked_key(hdev, 7385 HCI_BLOCKED_KEY_TYPE_IRK, 7386 irk->val)) { 7387 bt_dev_warn(hdev, "Skipping blocked IRK for %pMR", 7388 &irk->addr.bdaddr); 7389 continue; 7390 } 7391 7392 hci_add_irk(hdev, &irk->addr.bdaddr, 7393 le_addr_type(irk->addr.type), irk->val, 7394 BDADDR_ANY); 7395 } 7396 7397 hci_dev_set_flag(hdev, HCI_RPA_RESOLVING); 7398 7399 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_IRKS, 0, NULL, 0); 7400 7401 hci_dev_unlock(hdev); 7402 7403 return err; 7404 } 7405 7406 static bool ltk_is_valid(struct mgmt_ltk_info *key) 7407 { 7408 if (key->initiator != 0x00 && key->initiator != 0x01) 7409 return false; 7410 7411 if (key->enc_size > sizeof(key->val)) 7412 return false; 7413 7414 switch (key->addr.type) { 7415 case BDADDR_LE_PUBLIC: 7416 return true; 7417 7418 case BDADDR_LE_RANDOM: 7419 /* Two most significant bits shall be set */ 7420 if ((key->addr.bdaddr.b[5] & 0xc0) != 0xc0) 7421 return false; 7422 return true; 7423 } 7424 7425 return false; 7426 } 7427 7428 static int load_long_term_keys(struct sock *sk, struct hci_dev *hdev, 7429 void *cp_data, u16 len) 7430 { 7431 struct mgmt_cp_load_long_term_keys *cp = cp_data; 7432 const u16 max_key_count = ((U16_MAX - sizeof(*cp)) / 7433 sizeof(struct mgmt_ltk_info)); 7434 u16 key_count, expected_len; 7435 int i, err; 7436 7437 bt_dev_dbg(hdev, "sock %p", sk); 7438 7439 if (!lmp_le_capable(hdev)) 7440 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS, 7441 MGMT_STATUS_NOT_SUPPORTED); 7442 7443 key_count = __le16_to_cpu(cp->key_count); 7444 if (key_count > max_key_count) { 7445 bt_dev_err(hdev, "load_ltks: too big key_count value %u", 7446 key_count); 7447 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS, 7448 MGMT_STATUS_INVALID_PARAMS); 7449 } 7450 7451 expected_len = struct_size(cp, keys, key_count); 7452 if (expected_len != len) { 7453 bt_dev_err(hdev, "load_keys: expected %u bytes, got %u bytes", 7454 expected_len, len); 7455 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS, 7456 MGMT_STATUS_INVALID_PARAMS); 7457 } 7458 7459 bt_dev_dbg(hdev, "key_count %u", key_count); 7460 7461 hci_dev_lock(hdev); 7462 7463 hci_smp_ltks_clear(hdev); 7464 7465 for (i = 0; i < key_count; i++) { 7466 struct mgmt_ltk_info *key = &cp->keys[i]; 7467 u8 type, authenticated; 7468 7469 if (hci_is_blocked_key(hdev, 7470 HCI_BLOCKED_KEY_TYPE_LTK, 7471 key->val)) { 7472 bt_dev_warn(hdev, "Skipping blocked LTK for %pMR", 7473 &key->addr.bdaddr); 7474 continue; 7475 } 7476 7477 if (!ltk_is_valid(key)) { 7478 bt_dev_warn(hdev, "Invalid LTK for %pMR", 7479 &key->addr.bdaddr); 7480 continue; 7481 } 7482 7483 switch (key->type) { 7484 case MGMT_LTK_UNAUTHENTICATED: 7485 authenticated = 0x00; 7486 type = key->initiator ? SMP_LTK : SMP_LTK_RESPONDER; 7487 break; 7488 case MGMT_LTK_AUTHENTICATED: 7489 authenticated = 0x01; 7490 type = key->initiator ? SMP_LTK : SMP_LTK_RESPONDER; 7491 break; 7492 case MGMT_LTK_P256_UNAUTH: 7493 authenticated = 0x00; 7494 type = SMP_LTK_P256; 7495 break; 7496 case MGMT_LTK_P256_AUTH: 7497 authenticated = 0x01; 7498 type = SMP_LTK_P256; 7499 break; 7500 case MGMT_LTK_P256_DEBUG: 7501 authenticated = 0x00; 7502 type = SMP_LTK_P256_DEBUG; 7503 fallthrough; 7504 default: 7505 continue; 7506 } 7507 7508 hci_add_ltk(hdev, &key->addr.bdaddr, 7509 le_addr_type(key->addr.type), type, authenticated, 7510 key->val, key->enc_size, key->ediv, key->rand); 7511 } 7512 7513 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS, 0, 7514 NULL, 0); 7515 7516 hci_dev_unlock(hdev); 7517 7518 return err; 7519 } 7520 7521 static void get_conn_info_complete(struct hci_dev *hdev, void *data, int err) 7522 { 7523 struct mgmt_pending_cmd *cmd = data; 7524 struct hci_conn *conn = cmd->user_data; 7525 struct mgmt_cp_get_conn_info *cp = cmd->param; 7526 struct mgmt_rp_get_conn_info rp; 7527 u8 status; 7528 7529 bt_dev_dbg(hdev, "err %d", err); 7530 7531 memcpy(&rp.addr, &cp->addr, sizeof(rp.addr)); 7532 7533 status = mgmt_status(err); 7534 if (status == MGMT_STATUS_SUCCESS) { 7535 rp.rssi = conn->rssi; 7536 rp.tx_power = conn->tx_power; 7537 rp.max_tx_power = conn->max_tx_power; 7538 } else { 7539 rp.rssi = HCI_RSSI_INVALID; 7540 rp.tx_power = HCI_TX_POWER_INVALID; 7541 rp.max_tx_power = HCI_TX_POWER_INVALID; 7542 } 7543 7544 if (conn) 7545 hci_conn_put(conn); 7546 7547 mgmt_cmd_complete(cmd->sk, cmd->hdev->id, MGMT_OP_GET_CONN_INFO, status, 7548 &rp, sizeof(rp)); 7549 7550 mgmt_pending_free(cmd); 7551 } 7552 7553 static int get_conn_info_sync(struct hci_dev *hdev, void *data) 7554 { 7555 struct mgmt_pending_cmd *cmd = data; 7556 struct mgmt_cp_get_conn_info *cp = cmd->param; 7557 struct hci_conn *conn; 7558 int err; 7559 __le16 handle; 7560 7561 hci_dev_lock(hdev); 7562 7563 /* Make sure we are still connected */ 7564 if (cp->addr.type == BDADDR_BREDR) 7565 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, 7566 &cp->addr.bdaddr); 7567 else 7568 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &cp->addr.bdaddr); 7569 7570 if (!conn || conn->state != BT_CONNECTED) { 7571 hci_dev_unlock(hdev); 7572 return MGMT_STATUS_NOT_CONNECTED; 7573 } 7574 7575 cmd->user_data = hci_conn_get(conn); 7576 handle = cpu_to_le16(conn->handle); 7577 7578 hci_dev_unlock(hdev); 7579 7580 /* Refresh RSSI each time */ 7581 err = hci_read_rssi_sync(hdev, handle); 7582 7583 /* For LE links TX power does not change thus we don't need to 7584 * query for it once value is known. 7585 */ 7586 if (!err && (!bdaddr_type_is_le(cp->addr.type) || 7587 conn->tx_power == HCI_TX_POWER_INVALID)) 7588 err = hci_read_tx_power_sync(hdev, handle, 0x00); 7589 7590 /* Max TX power needs to be read only once per connection */ 7591 if (!err && conn->max_tx_power == HCI_TX_POWER_INVALID) 7592 err = hci_read_tx_power_sync(hdev, handle, 0x01); 7593 7594 return err; 7595 } 7596 7597 static int get_conn_info(struct sock *sk, struct hci_dev *hdev, void *data, 7598 u16 len) 7599 { 7600 struct mgmt_cp_get_conn_info *cp = data; 7601 struct mgmt_rp_get_conn_info rp; 7602 struct hci_conn *conn; 7603 unsigned long conn_info_age; 7604 int err = 0; 7605 7606 bt_dev_dbg(hdev, "sock %p", sk); 7607 7608 memset(&rp, 0, sizeof(rp)); 7609 bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr); 7610 rp.addr.type = cp->addr.type; 7611 7612 if (!bdaddr_type_is_valid(cp->addr.type)) 7613 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO, 7614 MGMT_STATUS_INVALID_PARAMS, 7615 &rp, sizeof(rp)); 7616 7617 hci_dev_lock(hdev); 7618 7619 if (!hdev_is_powered(hdev)) { 7620 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO, 7621 MGMT_STATUS_NOT_POWERED, &rp, 7622 sizeof(rp)); 7623 goto unlock; 7624 } 7625 7626 if (cp->addr.type == BDADDR_BREDR) 7627 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, 7628 &cp->addr.bdaddr); 7629 else 7630 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &cp->addr.bdaddr); 7631 7632 if (!conn || conn->state != BT_CONNECTED) { 7633 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO, 7634 MGMT_STATUS_NOT_CONNECTED, &rp, 7635 sizeof(rp)); 7636 goto unlock; 7637 } 7638 7639 /* To avoid client trying to guess when to poll again for information we 7640 * calculate conn info age as random value between min/max set in hdev. 7641 */ 7642 conn_info_age = get_random_u32_inclusive(hdev->conn_info_min_age, 7643 hdev->conn_info_max_age - 1); 7644 7645 /* Query controller to refresh cached values if they are too old or were 7646 * never read. 7647 */ 7648 if (time_after(jiffies, conn->conn_info_timestamp + 7649 msecs_to_jiffies(conn_info_age)) || 7650 !conn->conn_info_timestamp) { 7651 struct mgmt_pending_cmd *cmd; 7652 7653 cmd = mgmt_pending_new(sk, MGMT_OP_GET_CONN_INFO, hdev, data, 7654 len); 7655 if (!cmd) { 7656 err = -ENOMEM; 7657 } else { 7658 err = hci_cmd_sync_queue(hdev, get_conn_info_sync, 7659 cmd, get_conn_info_complete); 7660 } 7661 7662 if (err < 0) { 7663 mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO, 7664 MGMT_STATUS_FAILED, &rp, sizeof(rp)); 7665 7666 if (cmd) 7667 mgmt_pending_free(cmd); 7668 7669 goto unlock; 7670 } 7671 7672 conn->conn_info_timestamp = jiffies; 7673 } else { 7674 /* Cache is valid, just reply with values cached in hci_conn */ 7675 rp.rssi = conn->rssi; 7676 rp.tx_power = conn->tx_power; 7677 rp.max_tx_power = conn->max_tx_power; 7678 7679 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO, 7680 MGMT_STATUS_SUCCESS, &rp, sizeof(rp)); 7681 } 7682 7683 unlock: 7684 hci_dev_unlock(hdev); 7685 return err; 7686 } 7687 7688 static void get_clock_info_complete(struct hci_dev *hdev, void *data, int err) 7689 { 7690 struct mgmt_pending_cmd *cmd = data; 7691 struct mgmt_cp_get_clock_info *cp = cmd->param; 7692 struct mgmt_rp_get_clock_info rp; 7693 struct hci_conn *conn = cmd->user_data; 7694 u8 status = mgmt_status(err); 7695 7696 bt_dev_dbg(hdev, "err %d", err); 7697 7698 memset(&rp, 0, sizeof(rp)); 7699 bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr); 7700 rp.addr.type = cp->addr.type; 7701 7702 if (err) 7703 goto complete; 7704 7705 rp.local_clock = cpu_to_le32(hdev->clock); 7706 7707 if (conn) { 7708 rp.piconet_clock = cpu_to_le32(conn->clock); 7709 rp.accuracy = cpu_to_le16(conn->clock_accuracy); 7710 } 7711 7712 complete: 7713 if (conn) 7714 hci_conn_put(conn); 7715 7716 mgmt_cmd_complete(cmd->sk, cmd->hdev->id, cmd->opcode, status, &rp, 7717 sizeof(rp)); 7718 7719 mgmt_pending_free(cmd); 7720 } 7721 7722 static int get_clock_info_sync(struct hci_dev *hdev, void *data) 7723 { 7724 struct mgmt_pending_cmd *cmd = data; 7725 struct mgmt_cp_get_clock_info *cp = cmd->param; 7726 struct hci_cp_read_clock hci_cp; 7727 struct hci_conn *conn; 7728 7729 memset(&hci_cp, 0, sizeof(hci_cp)); 7730 hci_read_clock_sync(hdev, &hci_cp); 7731 7732 hci_dev_lock(hdev); 7733 7734 /* Make sure connection still exists */ 7735 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->addr.bdaddr); 7736 if (!conn || conn->state != BT_CONNECTED) { 7737 hci_dev_unlock(hdev); 7738 return MGMT_STATUS_NOT_CONNECTED; 7739 } 7740 7741 cmd->user_data = hci_conn_get(conn); 7742 hci_cp.handle = cpu_to_le16(conn->handle); 7743 hci_cp.which = 0x01; /* Piconet clock */ 7744 7745 hci_dev_unlock(hdev); 7746 7747 return hci_read_clock_sync(hdev, &hci_cp); 7748 } 7749 7750 static int get_clock_info(struct sock *sk, struct hci_dev *hdev, void *data, 7751 u16 len) 7752 { 7753 struct mgmt_cp_get_clock_info *cp = data; 7754 struct mgmt_rp_get_clock_info rp; 7755 struct mgmt_pending_cmd *cmd; 7756 struct hci_conn *conn; 7757 int err; 7758 7759 bt_dev_dbg(hdev, "sock %p", sk); 7760 7761 memset(&rp, 0, sizeof(rp)); 7762 bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr); 7763 rp.addr.type = cp->addr.type; 7764 7765 if (cp->addr.type != BDADDR_BREDR) 7766 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CLOCK_INFO, 7767 MGMT_STATUS_INVALID_PARAMS, 7768 &rp, sizeof(rp)); 7769 7770 hci_dev_lock(hdev); 7771 7772 if (!hdev_is_powered(hdev)) { 7773 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CLOCK_INFO, 7774 MGMT_STATUS_NOT_POWERED, &rp, 7775 sizeof(rp)); 7776 goto unlock; 7777 } 7778 7779 if (bacmp(&cp->addr.bdaddr, BDADDR_ANY)) { 7780 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, 7781 &cp->addr.bdaddr); 7782 if (!conn || conn->state != BT_CONNECTED) { 7783 err = mgmt_cmd_complete(sk, hdev->id, 7784 MGMT_OP_GET_CLOCK_INFO, 7785 MGMT_STATUS_NOT_CONNECTED, 7786 &rp, sizeof(rp)); 7787 goto unlock; 7788 } 7789 } else { 7790 conn = NULL; 7791 } 7792 7793 cmd = mgmt_pending_new(sk, MGMT_OP_GET_CLOCK_INFO, hdev, data, len); 7794 if (!cmd) 7795 err = -ENOMEM; 7796 else 7797 err = hci_cmd_sync_queue(hdev, get_clock_info_sync, cmd, 7798 get_clock_info_complete); 7799 7800 if (err < 0) { 7801 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CLOCK_INFO, 7802 MGMT_STATUS_FAILED, &rp, sizeof(rp)); 7803 7804 if (cmd) 7805 mgmt_pending_free(cmd); 7806 } 7807 7808 7809 unlock: 7810 hci_dev_unlock(hdev); 7811 return err; 7812 } 7813 7814 static void device_added(struct sock *sk, struct hci_dev *hdev, 7815 bdaddr_t *bdaddr, u8 type, u8 action) 7816 { 7817 struct mgmt_ev_device_added ev; 7818 7819 bacpy(&ev.addr.bdaddr, bdaddr); 7820 ev.addr.type = type; 7821 ev.action = action; 7822 7823 mgmt_event(MGMT_EV_DEVICE_ADDED, hdev, &ev, sizeof(ev), sk); 7824 } 7825 7826 static void add_device_complete(struct hci_dev *hdev, void *data, int err) 7827 { 7828 struct mgmt_pending_cmd *cmd = data; 7829 struct mgmt_cp_add_device *cp = cmd->param; 7830 7831 if (!err) { 7832 struct hci_conn_params *params; 7833 7834 hci_dev_lock(hdev); 7835 7836 params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr, 7837 le_addr_type(cp->addr.type)); 7838 7839 device_added(cmd->sk, hdev, &cp->addr.bdaddr, cp->addr.type, 7840 cp->action); 7841 device_flags_changed(NULL, hdev, &cp->addr.bdaddr, 7842 cp->addr.type, hdev->conn_flags, 7843 params ? params->flags : 0); 7844 hci_dev_unlock(hdev); 7845 } 7846 7847 mgmt_cmd_complete(cmd->sk, hdev->id, MGMT_OP_ADD_DEVICE, 7848 mgmt_status(err), &cp->addr, sizeof(cp->addr)); 7849 mgmt_pending_free(cmd); 7850 } 7851 7852 static int add_device_sync(struct hci_dev *hdev, void *data) 7853 { 7854 return hci_update_passive_scan_sync(hdev); 7855 } 7856 7857 static int add_device(struct sock *sk, struct hci_dev *hdev, 7858 void *data, u16 len) 7859 { 7860 struct mgmt_pending_cmd *cmd; 7861 struct mgmt_cp_add_device *cp = data; 7862 u8 auto_conn, addr_type; 7863 struct hci_conn_params *params; 7864 int err; 7865 u32 current_flags = 0; 7866 u32 supported_flags; 7867 7868 bt_dev_dbg(hdev, "sock %p", sk); 7869 7870 if (!bdaddr_type_is_valid(cp->addr.type) || 7871 !bacmp(&cp->addr.bdaddr, BDADDR_ANY)) 7872 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE, 7873 MGMT_STATUS_INVALID_PARAMS, 7874 &cp->addr, sizeof(cp->addr)); 7875 7876 if (cp->action != 0x00 && cp->action != 0x01 && cp->action != 0x02) 7877 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE, 7878 MGMT_STATUS_INVALID_PARAMS, 7879 &cp->addr, sizeof(cp->addr)); 7880 7881 hci_dev_lock(hdev); 7882 7883 if (cp->addr.type == BDADDR_BREDR) { 7884 /* Only incoming connections action is supported for now */ 7885 if (cp->action != 0x01) { 7886 err = mgmt_cmd_complete(sk, hdev->id, 7887 MGMT_OP_ADD_DEVICE, 7888 MGMT_STATUS_INVALID_PARAMS, 7889 &cp->addr, sizeof(cp->addr)); 7890 goto unlock; 7891 } 7892 7893 err = hci_bdaddr_list_add_with_flags(&hdev->accept_list, 7894 &cp->addr.bdaddr, 7895 cp->addr.type, 0); 7896 if (err) 7897 goto unlock; 7898 7899 hci_update_scan(hdev); 7900 7901 goto added; 7902 } 7903 7904 addr_type = le_addr_type(cp->addr.type); 7905 7906 if (cp->action == 0x02) 7907 auto_conn = HCI_AUTO_CONN_ALWAYS; 7908 else if (cp->action == 0x01) 7909 auto_conn = HCI_AUTO_CONN_DIRECT; 7910 else 7911 auto_conn = HCI_AUTO_CONN_REPORT; 7912 7913 /* Kernel internally uses conn_params with resolvable private 7914 * address, but Add Device allows only identity addresses. 7915 * Make sure it is enforced before calling 7916 * hci_conn_params_lookup. 7917 */ 7918 if (!hci_is_identity_address(&cp->addr.bdaddr, addr_type)) { 7919 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE, 7920 MGMT_STATUS_INVALID_PARAMS, 7921 &cp->addr, sizeof(cp->addr)); 7922 goto unlock; 7923 } 7924 7925 /* If the connection parameters don't exist for this device, 7926 * they will be created and configured with defaults. 7927 */ 7928 params = hci_conn_params_set(hdev, &cp->addr.bdaddr, addr_type, 7929 auto_conn); 7930 if (!params) { 7931 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE, 7932 MGMT_STATUS_FAILED, &cp->addr, 7933 sizeof(cp->addr)); 7934 goto unlock; 7935 } 7936 7937 cmd = mgmt_pending_new(sk, MGMT_OP_ADD_DEVICE, hdev, data, len); 7938 if (!cmd) { 7939 err = -ENOMEM; 7940 goto unlock; 7941 } 7942 7943 err = hci_cmd_sync_queue(hdev, add_device_sync, cmd, 7944 add_device_complete); 7945 if (err < 0) { 7946 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE, 7947 MGMT_STATUS_FAILED, &cp->addr, 7948 sizeof(cp->addr)); 7949 mgmt_pending_free(cmd); 7950 } 7951 7952 goto unlock; 7953 7954 added: 7955 device_added(sk, hdev, &cp->addr.bdaddr, cp->addr.type, cp->action); 7956 supported_flags = hdev->conn_flags; 7957 device_flags_changed(NULL, hdev, &cp->addr.bdaddr, cp->addr.type, 7958 supported_flags, current_flags); 7959 7960 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE, 7961 MGMT_STATUS_SUCCESS, &cp->addr, 7962 sizeof(cp->addr)); 7963 7964 unlock: 7965 hci_dev_unlock(hdev); 7966 return err; 7967 } 7968 7969 static void device_removed(struct sock *sk, struct hci_dev *hdev, 7970 bdaddr_t *bdaddr, u8 type) 7971 { 7972 struct mgmt_ev_device_removed ev; 7973 7974 bacpy(&ev.addr.bdaddr, bdaddr); 7975 ev.addr.type = type; 7976 7977 mgmt_event(MGMT_EV_DEVICE_REMOVED, hdev, &ev, sizeof(ev), sk); 7978 } 7979 7980 static int remove_device_sync(struct hci_dev *hdev, void *data) 7981 { 7982 return hci_update_passive_scan_sync(hdev); 7983 } 7984 7985 static int remove_device(struct sock *sk, struct hci_dev *hdev, 7986 void *data, u16 len) 7987 { 7988 struct mgmt_cp_remove_device *cp = data; 7989 int err; 7990 7991 bt_dev_dbg(hdev, "sock %p", sk); 7992 7993 hci_dev_lock(hdev); 7994 7995 if (bacmp(&cp->addr.bdaddr, BDADDR_ANY)) { 7996 struct hci_conn_params *params; 7997 u8 addr_type; 7998 7999 if (!bdaddr_type_is_valid(cp->addr.type)) { 8000 err = mgmt_cmd_complete(sk, hdev->id, 8001 MGMT_OP_REMOVE_DEVICE, 8002 MGMT_STATUS_INVALID_PARAMS, 8003 &cp->addr, sizeof(cp->addr)); 8004 goto unlock; 8005 } 8006 8007 if (cp->addr.type == BDADDR_BREDR) { 8008 err = hci_bdaddr_list_del(&hdev->accept_list, 8009 &cp->addr.bdaddr, 8010 cp->addr.type); 8011 if (err) { 8012 err = mgmt_cmd_complete(sk, hdev->id, 8013 MGMT_OP_REMOVE_DEVICE, 8014 MGMT_STATUS_INVALID_PARAMS, 8015 &cp->addr, 8016 sizeof(cp->addr)); 8017 goto unlock; 8018 } 8019 8020 hci_update_scan(hdev); 8021 8022 device_removed(sk, hdev, &cp->addr.bdaddr, 8023 cp->addr.type); 8024 goto complete; 8025 } 8026 8027 addr_type = le_addr_type(cp->addr.type); 8028 8029 /* Kernel internally uses conn_params with resolvable private 8030 * address, but Remove Device allows only identity addresses. 8031 * Make sure it is enforced before calling 8032 * hci_conn_params_lookup. 8033 */ 8034 if (!hci_is_identity_address(&cp->addr.bdaddr, addr_type)) { 8035 err = mgmt_cmd_complete(sk, hdev->id, 8036 MGMT_OP_REMOVE_DEVICE, 8037 MGMT_STATUS_INVALID_PARAMS, 8038 &cp->addr, sizeof(cp->addr)); 8039 goto unlock; 8040 } 8041 8042 params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr, 8043 addr_type); 8044 if (!params) { 8045 err = mgmt_cmd_complete(sk, hdev->id, 8046 MGMT_OP_REMOVE_DEVICE, 8047 MGMT_STATUS_INVALID_PARAMS, 8048 &cp->addr, sizeof(cp->addr)); 8049 goto unlock; 8050 } 8051 8052 if (params->auto_connect == HCI_AUTO_CONN_DISABLED || 8053 params->auto_connect == HCI_AUTO_CONN_EXPLICIT) { 8054 err = mgmt_cmd_complete(sk, hdev->id, 8055 MGMT_OP_REMOVE_DEVICE, 8056 MGMT_STATUS_INVALID_PARAMS, 8057 &cp->addr, sizeof(cp->addr)); 8058 goto unlock; 8059 } 8060 8061 hci_conn_params_free(params); 8062 8063 device_removed(sk, hdev, &cp->addr.bdaddr, cp->addr.type); 8064 } else { 8065 struct hci_conn_params *p, *tmp; 8066 struct bdaddr_list *b, *btmp; 8067 8068 if (cp->addr.type) { 8069 err = mgmt_cmd_complete(sk, hdev->id, 8070 MGMT_OP_REMOVE_DEVICE, 8071 MGMT_STATUS_INVALID_PARAMS, 8072 &cp->addr, sizeof(cp->addr)); 8073 goto unlock; 8074 } 8075 8076 list_for_each_entry_safe(b, btmp, &hdev->accept_list, list) { 8077 device_removed(sk, hdev, &b->bdaddr, b->bdaddr_type); 8078 list_del(&b->list); 8079 kfree(b); 8080 } 8081 8082 hci_update_scan(hdev); 8083 8084 list_for_each_entry_safe(p, tmp, &hdev->le_conn_params, list) { 8085 if (p->auto_connect == HCI_AUTO_CONN_DISABLED) 8086 continue; 8087 device_removed(sk, hdev, &p->addr, p->addr_type); 8088 if (p->explicit_connect) { 8089 p->auto_connect = HCI_AUTO_CONN_EXPLICIT; 8090 continue; 8091 } 8092 hci_conn_params_free(p); 8093 } 8094 8095 bt_dev_dbg(hdev, "All LE connection parameters were removed"); 8096 } 8097 8098 hci_cmd_sync_queue(hdev, remove_device_sync, NULL, NULL); 8099 8100 complete: 8101 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_DEVICE, 8102 MGMT_STATUS_SUCCESS, &cp->addr, 8103 sizeof(cp->addr)); 8104 unlock: 8105 hci_dev_unlock(hdev); 8106 return err; 8107 } 8108 8109 static int conn_update_sync(struct hci_dev *hdev, void *data) 8110 { 8111 struct hci_conn *conn = data; 8112 struct hci_conn_params *params; 8113 struct hci_conn_params local = {}; 8114 8115 hci_dev_lock(hdev); 8116 8117 if (!hci_conn_valid(hdev, conn) || conn->role != HCI_ROLE_MASTER) 8118 goto cancel; 8119 8120 params = hci_conn_params_lookup(hdev, &conn->dst, conn->dst_type); 8121 if (!params) 8122 goto cancel; 8123 8124 local.conn_min_interval = params->conn_min_interval; 8125 local.conn_max_interval = params->conn_max_interval; 8126 local.conn_latency = params->conn_latency; 8127 local.supervision_timeout = params->supervision_timeout; 8128 8129 hci_dev_unlock(hdev); 8130 8131 return hci_le_conn_update_sync(hdev, conn, &local); 8132 8133 cancel: 8134 hci_dev_unlock(hdev); 8135 return -ECANCELED; 8136 } 8137 8138 static void conn_update_sync_destroy(struct hci_dev *hdev, void *data, int err) 8139 { 8140 hci_conn_put(data); 8141 } 8142 8143 static int load_conn_param(struct sock *sk, struct hci_dev *hdev, void *data, 8144 u16 len) 8145 { 8146 struct mgmt_cp_load_conn_param *cp = data; 8147 const u16 max_param_count = ((U16_MAX - sizeof(*cp)) / 8148 sizeof(struct mgmt_conn_param)); 8149 u16 param_count, expected_len; 8150 int i; 8151 8152 if (!lmp_le_capable(hdev)) 8153 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM, 8154 MGMT_STATUS_NOT_SUPPORTED); 8155 8156 param_count = __le16_to_cpu(cp->param_count); 8157 if (param_count > max_param_count) { 8158 bt_dev_err(hdev, "load_conn_param: too big param_count value %u", 8159 param_count); 8160 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM, 8161 MGMT_STATUS_INVALID_PARAMS); 8162 } 8163 8164 expected_len = struct_size(cp, params, param_count); 8165 if (expected_len != len) { 8166 bt_dev_err(hdev, "load_conn_param: expected %u bytes, got %u bytes", 8167 expected_len, len); 8168 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM, 8169 MGMT_STATUS_INVALID_PARAMS); 8170 } 8171 8172 bt_dev_dbg(hdev, "param_count %u", param_count); 8173 8174 hci_dev_lock(hdev); 8175 8176 if (param_count > 1) 8177 hci_conn_params_clear_disabled(hdev); 8178 8179 for (i = 0; i < param_count; i++) { 8180 struct mgmt_conn_param *param = &cp->params[i]; 8181 struct hci_conn_params *hci_param; 8182 u16 min, max, latency, timeout; 8183 bool update = false; 8184 u8 addr_type; 8185 8186 bt_dev_dbg(hdev, "Adding %pMR (type %u)", ¶m->addr.bdaddr, 8187 param->addr.type); 8188 8189 if (param->addr.type == BDADDR_LE_PUBLIC) { 8190 addr_type = ADDR_LE_DEV_PUBLIC; 8191 } else if (param->addr.type == BDADDR_LE_RANDOM) { 8192 addr_type = ADDR_LE_DEV_RANDOM; 8193 } else { 8194 bt_dev_err(hdev, "ignoring invalid connection parameters"); 8195 continue; 8196 } 8197 8198 min = le16_to_cpu(param->min_interval); 8199 max = le16_to_cpu(param->max_interval); 8200 latency = le16_to_cpu(param->latency); 8201 timeout = le16_to_cpu(param->timeout); 8202 8203 bt_dev_dbg(hdev, "min 0x%04x max 0x%04x latency 0x%04x timeout 0x%04x", 8204 min, max, latency, timeout); 8205 8206 if (hci_check_conn_params(min, max, latency, timeout) < 0) { 8207 bt_dev_err(hdev, "ignoring invalid connection parameters"); 8208 continue; 8209 } 8210 8211 /* Detect when the loading is for an existing parameter then 8212 * attempt to trigger the connection update procedure. 8213 */ 8214 if (!i && param_count == 1) { 8215 hci_param = hci_conn_params_lookup(hdev, 8216 ¶m->addr.bdaddr, 8217 addr_type); 8218 if (hci_param) 8219 update = true; 8220 else 8221 hci_conn_params_clear_disabled(hdev); 8222 } 8223 8224 hci_param = hci_conn_params_add(hdev, ¶m->addr.bdaddr, 8225 addr_type); 8226 if (!hci_param) { 8227 bt_dev_err(hdev, "failed to add connection parameters"); 8228 continue; 8229 } 8230 8231 hci_param->conn_min_interval = min; 8232 hci_param->conn_max_interval = max; 8233 hci_param->conn_latency = latency; 8234 hci_param->supervision_timeout = timeout; 8235 8236 /* Check if we need to trigger a connection update */ 8237 if (update) { 8238 struct hci_conn *conn; 8239 8240 /* Lookup for existing connection as central and check 8241 * if parameters match and if they don't then trigger 8242 * a connection update. 8243 */ 8244 conn = hci_conn_hash_lookup_le(hdev, &hci_param->addr, 8245 addr_type); 8246 if (conn && conn->role == HCI_ROLE_MASTER && 8247 (conn->le_conn_min_interval != min || 8248 conn->le_conn_max_interval != max || 8249 conn->le_conn_latency != latency || 8250 conn->le_supv_timeout != timeout)) { 8251 hci_conn_get(conn); 8252 if (hci_cmd_sync_queue(hdev, conn_update_sync, 8253 conn, 8254 conn_update_sync_destroy) < 0) 8255 hci_conn_put(conn); 8256 } 8257 } 8258 } 8259 8260 hci_dev_unlock(hdev); 8261 8262 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM, 0, 8263 NULL, 0); 8264 } 8265 8266 static int load_conn_subrate(struct sock *sk, struct hci_dev *hdev, void *data, 8267 u16 len) 8268 { 8269 struct mgmt_cp_load_conn_subrate *cp = data; 8270 const u16 max_param_count = ((U16_MAX - sizeof(*cp)) / 8271 sizeof(struct mgmt_conn_subrate)); 8272 u16 param_count, expected_len; 8273 int i; 8274 8275 if (!lmp_le_capable(hdev) || !le_sci_capable(hdev)) 8276 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_SUBRATE, 8277 MGMT_STATUS_NOT_SUPPORTED); 8278 8279 param_count = __le16_to_cpu(cp->param_count); 8280 if (param_count > max_param_count) { 8281 bt_dev_err(hdev, "too big param_count value %u", param_count); 8282 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_SUBRATE, 8283 MGMT_STATUS_INVALID_PARAMS); 8284 } 8285 8286 expected_len = struct_size(cp, params, param_count); 8287 if (expected_len != len) { 8288 bt_dev_err(hdev, "expected %u bytes, got %u bytes", 8289 expected_len, len); 8290 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_SUBRATE, 8291 MGMT_STATUS_INVALID_PARAMS); 8292 } 8293 8294 bt_dev_dbg(hdev, "param_count %u", param_count); 8295 8296 hci_dev_lock(hdev); 8297 8298 for (i = 0; i < param_count; i++) { 8299 struct mgmt_conn_subrate *param = &cp->params[i]; 8300 struct hci_conn_params *hci_param; 8301 u16 min, max, subrate_min, subrate_max; 8302 u16 max_latency, cont_num, supv_timeout; 8303 u8 addr_type; 8304 8305 bt_dev_dbg(hdev, "Adding subrate %pMR (type %u)", 8306 ¶m->addr.bdaddr, param->addr.type); 8307 8308 if (param->addr.type == BDADDR_LE_PUBLIC) { 8309 addr_type = ADDR_LE_DEV_PUBLIC; 8310 } else if (param->addr.type == BDADDR_LE_RANDOM) { 8311 addr_type = ADDR_LE_DEV_RANDOM; 8312 } else { 8313 bt_dev_err(hdev, "ignoring invalid connection subrate parameters"); 8314 continue; 8315 } 8316 8317 min = le16_to_cpu(param->min_interval); 8318 max = le16_to_cpu(param->max_interval); 8319 subrate_min = le16_to_cpu(param->subrate_min); 8320 subrate_max = le16_to_cpu(param->subrate_max); 8321 max_latency = le16_to_cpu(param->max_latency); 8322 cont_num = le16_to_cpu(param->cont_num); 8323 supv_timeout = le16_to_cpu(param->supv_timeout); 8324 8325 /* Validate the parameters before storing them. Reject 8326 * logically inconsistent values instead of forwarding them to 8327 * the controller. 8328 */ 8329 if (min > max || subrate_min > subrate_max || 8330 subrate_min < 1 || supv_timeout < 1) { 8331 bt_dev_err(hdev, "ignoring invalid connection subrate parameters"); 8332 continue; 8333 } 8334 8335 hci_param = hci_conn_params_add(hdev, ¶m->addr.bdaddr, 8336 addr_type); 8337 if (!hci_param) { 8338 bt_dev_err(hdev, "failed to add connection parameters"); 8339 continue; 8340 } 8341 8342 hci_param->rate_min_interval = min; 8343 hci_param->rate_max_interval = max; 8344 hci_param->subrate_min = subrate_min; 8345 hci_param->subrate_max = subrate_max; 8346 hci_param->max_latency = max_latency; 8347 hci_param->cont_num = cont_num; 8348 hci_param->rate_supv_timeout = supv_timeout; 8349 8350 /* If the device is connected check if the connection rate 8351 * parameters need to be updated, either role can initiate the 8352 * Connection Rate Update procedure, e.g. a HID device acting 8353 * as peripheral once the HID host requests a HID SCI mode. 8354 */ 8355 if (!i && param_count == 1) { 8356 struct hci_conn *conn; 8357 8358 conn = hci_conn_hash_lookup_le(hdev, 8359 &hci_param->addr, 8360 addr_type); 8361 if (conn && conn->state == BT_CONNECTED && 8362 (conn->le_rate_interval < min || 8363 conn->le_rate_interval > max || 8364 conn->le_subrate < subrate_min || 8365 conn->le_subrate > subrate_max || 8366 conn->le_rate_latency != max_latency || 8367 conn->le_cont_num != cont_num || 8368 conn->le_rate_supv_timeout != supv_timeout)) 8369 hci_le_conn_rate_request(hdev, conn); 8370 } 8371 } 8372 8373 hci_dev_unlock(hdev); 8374 8375 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_CONN_SUBRATE, 0, 8376 NULL, 0); 8377 } 8378 8379 static int set_external_config(struct sock *sk, struct hci_dev *hdev, 8380 void *data, u16 len) 8381 { 8382 struct mgmt_cp_set_external_config *cp = data; 8383 bool changed; 8384 int err; 8385 8386 bt_dev_dbg(hdev, "sock %p", sk); 8387 8388 if (hdev_is_powered(hdev)) 8389 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_EXTERNAL_CONFIG, 8390 MGMT_STATUS_REJECTED); 8391 8392 if (cp->config != 0x00 && cp->config != 0x01) 8393 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_EXTERNAL_CONFIG, 8394 MGMT_STATUS_INVALID_PARAMS); 8395 8396 if (!hci_test_quirk(hdev, HCI_QUIRK_EXTERNAL_CONFIG)) 8397 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_EXTERNAL_CONFIG, 8398 MGMT_STATUS_NOT_SUPPORTED); 8399 8400 hci_dev_lock(hdev); 8401 8402 if (cp->config) 8403 changed = !hci_dev_test_and_set_flag(hdev, HCI_EXT_CONFIGURED); 8404 else 8405 changed = hci_dev_test_and_clear_flag(hdev, HCI_EXT_CONFIGURED); 8406 8407 err = send_options_rsp(sk, MGMT_OP_SET_EXTERNAL_CONFIG, hdev); 8408 if (err < 0) 8409 goto unlock; 8410 8411 if (!changed) 8412 goto unlock; 8413 8414 err = new_options(hdev, sk); 8415 8416 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED) == is_configured(hdev)) { 8417 mgmt_index_removed(hdev); 8418 8419 if (hci_dev_test_and_change_flag(hdev, HCI_UNCONFIGURED)) { 8420 hci_dev_set_flag(hdev, HCI_CONFIG); 8421 hci_dev_set_flag(hdev, HCI_AUTO_OFF); 8422 8423 queue_work(hdev->req_workqueue, &hdev->power_on); 8424 } else { 8425 set_bit(HCI_RAW, &hdev->flags); 8426 mgmt_index_added(hdev); 8427 } 8428 } 8429 8430 unlock: 8431 hci_dev_unlock(hdev); 8432 return err; 8433 } 8434 8435 static int set_public_address(struct sock *sk, struct hci_dev *hdev, 8436 void *data, u16 len) 8437 { 8438 struct mgmt_cp_set_public_address *cp = data; 8439 bool changed; 8440 int err; 8441 8442 bt_dev_dbg(hdev, "sock %p", sk); 8443 8444 if (hdev_is_powered(hdev)) 8445 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PUBLIC_ADDRESS, 8446 MGMT_STATUS_REJECTED); 8447 8448 if (!bacmp(&cp->bdaddr, BDADDR_ANY)) 8449 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PUBLIC_ADDRESS, 8450 MGMT_STATUS_INVALID_PARAMS); 8451 8452 if (!hdev->set_bdaddr) 8453 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PUBLIC_ADDRESS, 8454 MGMT_STATUS_NOT_SUPPORTED); 8455 8456 hci_dev_lock(hdev); 8457 8458 changed = !!bacmp(&hdev->public_addr, &cp->bdaddr); 8459 bacpy(&hdev->public_addr, &cp->bdaddr); 8460 8461 err = send_options_rsp(sk, MGMT_OP_SET_PUBLIC_ADDRESS, hdev); 8462 if (err < 0) 8463 goto unlock; 8464 8465 if (!changed) 8466 goto unlock; 8467 8468 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) 8469 err = new_options(hdev, sk); 8470 8471 if (is_configured(hdev)) { 8472 mgmt_index_removed(hdev); 8473 8474 hci_dev_clear_flag(hdev, HCI_UNCONFIGURED); 8475 8476 hci_dev_set_flag(hdev, HCI_CONFIG); 8477 hci_dev_set_flag(hdev, HCI_AUTO_OFF); 8478 8479 queue_work(hdev->req_workqueue, &hdev->power_on); 8480 } 8481 8482 unlock: 8483 hci_dev_unlock(hdev); 8484 return err; 8485 } 8486 8487 static void read_local_oob_ext_data_complete(struct hci_dev *hdev, void *data, 8488 int err) 8489 { 8490 const struct mgmt_cp_read_local_oob_ext_data *mgmt_cp; 8491 struct mgmt_rp_read_local_oob_ext_data *mgmt_rp; 8492 u8 *h192, *r192, *h256, *r256; 8493 struct mgmt_pending_cmd *cmd = data; 8494 struct sk_buff *skb = cmd->skb; 8495 u8 status = mgmt_status(err); 8496 u16 eir_len; 8497 8498 if (!status) { 8499 if (!skb) 8500 status = MGMT_STATUS_FAILED; 8501 else if (IS_ERR(skb)) 8502 status = mgmt_status(PTR_ERR(skb)); 8503 else 8504 status = mgmt_status(skb->data[0]); 8505 } 8506 8507 bt_dev_dbg(hdev, "status %u", status); 8508 8509 mgmt_cp = cmd->param; 8510 8511 if (status) { 8512 status = mgmt_status(status); 8513 eir_len = 0; 8514 8515 h192 = NULL; 8516 r192 = NULL; 8517 h256 = NULL; 8518 r256 = NULL; 8519 } else if (!bredr_sc_enabled(hdev)) { 8520 struct hci_rp_read_local_oob_data *rp; 8521 8522 if (skb->len != sizeof(*rp)) { 8523 status = MGMT_STATUS_FAILED; 8524 eir_len = 0; 8525 } else { 8526 status = MGMT_STATUS_SUCCESS; 8527 rp = (void *)skb->data; 8528 8529 eir_len = 5 + 18 + 18; 8530 h192 = rp->hash; 8531 r192 = rp->rand; 8532 h256 = NULL; 8533 r256 = NULL; 8534 } 8535 } else { 8536 struct hci_rp_read_local_oob_ext_data *rp; 8537 8538 if (skb->len != sizeof(*rp)) { 8539 status = MGMT_STATUS_FAILED; 8540 eir_len = 0; 8541 } else { 8542 status = MGMT_STATUS_SUCCESS; 8543 rp = (void *)skb->data; 8544 8545 if (hci_dev_test_flag(hdev, HCI_SC_ONLY)) { 8546 eir_len = 5 + 18 + 18; 8547 h192 = NULL; 8548 r192 = NULL; 8549 } else { 8550 eir_len = 5 + 18 + 18 + 18 + 18; 8551 h192 = rp->hash192; 8552 r192 = rp->rand192; 8553 } 8554 8555 h256 = rp->hash256; 8556 r256 = rp->rand256; 8557 } 8558 } 8559 8560 mgmt_rp = kmalloc(sizeof(*mgmt_rp) + eir_len, GFP_KERNEL); 8561 if (!mgmt_rp) 8562 goto done; 8563 8564 if (eir_len == 0) 8565 goto send_rsp; 8566 8567 eir_len = eir_append_data(mgmt_rp->eir, 0, EIR_CLASS_OF_DEV, 8568 hdev->dev_class, 3); 8569 8570 if (h192 && r192) { 8571 eir_len = eir_append_data(mgmt_rp->eir, eir_len, 8572 EIR_SSP_HASH_C192, h192, 16); 8573 eir_len = eir_append_data(mgmt_rp->eir, eir_len, 8574 EIR_SSP_RAND_R192, r192, 16); 8575 } 8576 8577 if (h256 && r256) { 8578 eir_len = eir_append_data(mgmt_rp->eir, eir_len, 8579 EIR_SSP_HASH_C256, h256, 16); 8580 eir_len = eir_append_data(mgmt_rp->eir, eir_len, 8581 EIR_SSP_RAND_R256, r256, 16); 8582 } 8583 8584 send_rsp: 8585 mgmt_rp->type = mgmt_cp->type; 8586 mgmt_rp->eir_len = cpu_to_le16(eir_len); 8587 8588 err = mgmt_cmd_complete(cmd->sk, hdev->id, 8589 MGMT_OP_READ_LOCAL_OOB_EXT_DATA, status, 8590 mgmt_rp, sizeof(*mgmt_rp) + eir_len); 8591 if (err < 0 || status) 8592 goto done; 8593 8594 hci_sock_set_flag(cmd->sk, HCI_MGMT_OOB_DATA_EVENTS); 8595 8596 err = mgmt_limited_event(MGMT_EV_LOCAL_OOB_DATA_UPDATED, hdev, 8597 mgmt_rp, sizeof(*mgmt_rp) + eir_len, 8598 HCI_MGMT_OOB_DATA_EVENTS, cmd->sk); 8599 done: 8600 if (skb && !IS_ERR(skb)) 8601 kfree_skb(skb); 8602 8603 kfree(mgmt_rp); 8604 mgmt_pending_free(cmd); 8605 } 8606 8607 static int read_local_ssp_oob_req(struct hci_dev *hdev, struct sock *sk, 8608 struct mgmt_cp_read_local_oob_ext_data *cp) 8609 { 8610 struct mgmt_pending_cmd *cmd; 8611 int err; 8612 8613 cmd = mgmt_pending_new(sk, MGMT_OP_READ_LOCAL_OOB_EXT_DATA, hdev, 8614 cp, sizeof(*cp)); 8615 if (!cmd) 8616 return -ENOMEM; 8617 8618 err = hci_cmd_sync_queue(hdev, read_local_oob_data_sync, cmd, 8619 read_local_oob_ext_data_complete); 8620 8621 if (err < 0) { 8622 mgmt_pending_remove(cmd); 8623 return err; 8624 } 8625 8626 return 0; 8627 } 8628 8629 static int read_local_oob_ext_data(struct sock *sk, struct hci_dev *hdev, 8630 void *data, u16 data_len) 8631 { 8632 struct mgmt_cp_read_local_oob_ext_data *cp = data; 8633 struct mgmt_rp_read_local_oob_ext_data *rp; 8634 size_t rp_len; 8635 u16 eir_len; 8636 u8 status, flags, role, addr[7], hash[16], rand[16]; 8637 int err; 8638 8639 bt_dev_dbg(hdev, "sock %p", sk); 8640 8641 if (hdev_is_powered(hdev)) { 8642 switch (cp->type) { 8643 case BIT(BDADDR_BREDR): 8644 status = mgmt_bredr_support(hdev); 8645 if (status) 8646 eir_len = 0; 8647 else 8648 eir_len = 5; 8649 break; 8650 case (BIT(BDADDR_LE_PUBLIC) | BIT(BDADDR_LE_RANDOM)): 8651 status = mgmt_le_support(hdev); 8652 if (status) 8653 eir_len = 0; 8654 else 8655 eir_len = 9 + 3 + 18 + 18 + 3; 8656 break; 8657 default: 8658 status = MGMT_STATUS_INVALID_PARAMS; 8659 eir_len = 0; 8660 break; 8661 } 8662 } else { 8663 status = MGMT_STATUS_NOT_POWERED; 8664 eir_len = 0; 8665 } 8666 8667 rp_len = sizeof(*rp) + eir_len; 8668 rp = kmalloc(rp_len, GFP_ATOMIC); 8669 if (!rp) 8670 return -ENOMEM; 8671 8672 if (!status && !lmp_ssp_capable(hdev)) { 8673 status = MGMT_STATUS_NOT_SUPPORTED; 8674 eir_len = 0; 8675 } 8676 8677 if (status) 8678 goto complete; 8679 8680 hci_dev_lock(hdev); 8681 8682 eir_len = 0; 8683 switch (cp->type) { 8684 case BIT(BDADDR_BREDR): 8685 if (hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) { 8686 err = read_local_ssp_oob_req(hdev, sk, cp); 8687 hci_dev_unlock(hdev); 8688 if (!err) 8689 goto done; 8690 8691 status = MGMT_STATUS_FAILED; 8692 goto complete; 8693 } else { 8694 eir_len = eir_append_data(rp->eir, eir_len, 8695 EIR_CLASS_OF_DEV, 8696 hdev->dev_class, 3); 8697 } 8698 break; 8699 case (BIT(BDADDR_LE_PUBLIC) | BIT(BDADDR_LE_RANDOM)): 8700 if (hci_dev_test_flag(hdev, HCI_SC_ENABLED) && 8701 smp_generate_oob(hdev, hash, rand) < 0) { 8702 hci_dev_unlock(hdev); 8703 status = MGMT_STATUS_FAILED; 8704 goto complete; 8705 } 8706 8707 /* This should return the active RPA, but since the RPA 8708 * is only programmed on demand, it is really hard to fill 8709 * this in at the moment. For now disallow retrieving 8710 * local out-of-band data when privacy is in use. 8711 * 8712 * Returning the identity address will not help here since 8713 * pairing happens before the identity resolving key is 8714 * known and thus the connection establishment happens 8715 * based on the RPA and not the identity address. 8716 */ 8717 if (hci_dev_test_flag(hdev, HCI_PRIVACY)) { 8718 hci_dev_unlock(hdev); 8719 status = MGMT_STATUS_REJECTED; 8720 goto complete; 8721 } 8722 8723 if (hci_dev_test_flag(hdev, HCI_FORCE_STATIC_ADDR) || 8724 !bacmp(&hdev->bdaddr, BDADDR_ANY) || 8725 (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) && 8726 bacmp(&hdev->static_addr, BDADDR_ANY))) { 8727 memcpy(addr, &hdev->static_addr, 6); 8728 addr[6] = 0x01; 8729 } else { 8730 memcpy(addr, &hdev->bdaddr, 6); 8731 addr[6] = 0x00; 8732 } 8733 8734 eir_len = eir_append_data(rp->eir, eir_len, EIR_LE_BDADDR, 8735 addr, sizeof(addr)); 8736 8737 if (hci_dev_test_flag(hdev, HCI_ADVERTISING)) 8738 role = 0x02; 8739 else 8740 role = 0x01; 8741 8742 eir_len = eir_append_data(rp->eir, eir_len, EIR_LE_ROLE, 8743 &role, sizeof(role)); 8744 8745 if (hci_dev_test_flag(hdev, HCI_SC_ENABLED)) { 8746 eir_len = eir_append_data(rp->eir, eir_len, 8747 EIR_LE_SC_CONFIRM, 8748 hash, sizeof(hash)); 8749 8750 eir_len = eir_append_data(rp->eir, eir_len, 8751 EIR_LE_SC_RANDOM, 8752 rand, sizeof(rand)); 8753 } 8754 8755 flags = mgmt_get_adv_discov_flags(hdev); 8756 8757 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) 8758 flags |= LE_AD_NO_BREDR; 8759 8760 eir_len = eir_append_data(rp->eir, eir_len, EIR_FLAGS, 8761 &flags, sizeof(flags)); 8762 break; 8763 } 8764 8765 hci_dev_unlock(hdev); 8766 8767 hci_sock_set_flag(sk, HCI_MGMT_OOB_DATA_EVENTS); 8768 8769 status = MGMT_STATUS_SUCCESS; 8770 8771 complete: 8772 rp->type = cp->type; 8773 rp->eir_len = cpu_to_le16(eir_len); 8774 8775 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_EXT_DATA, 8776 status, rp, sizeof(*rp) + eir_len); 8777 if (err < 0 || status) 8778 goto done; 8779 8780 err = mgmt_limited_event(MGMT_EV_LOCAL_OOB_DATA_UPDATED, hdev, 8781 rp, sizeof(*rp) + eir_len, 8782 HCI_MGMT_OOB_DATA_EVENTS, sk); 8783 8784 done: 8785 kfree(rp); 8786 8787 return err; 8788 } 8789 8790 static u32 get_supported_adv_flags(struct hci_dev *hdev) 8791 { 8792 u32 flags = 0; 8793 8794 flags |= MGMT_ADV_FLAG_CONNECTABLE; 8795 flags |= MGMT_ADV_FLAG_DISCOV; 8796 flags |= MGMT_ADV_FLAG_LIMITED_DISCOV; 8797 flags |= MGMT_ADV_FLAG_MANAGED_FLAGS; 8798 flags |= MGMT_ADV_FLAG_APPEARANCE; 8799 flags |= MGMT_ADV_FLAG_LOCAL_NAME; 8800 flags |= MGMT_ADV_PARAM_DURATION; 8801 flags |= MGMT_ADV_PARAM_TIMEOUT; 8802 flags |= MGMT_ADV_PARAM_INTERVALS; 8803 flags |= MGMT_ADV_PARAM_TX_POWER; 8804 flags |= MGMT_ADV_PARAM_SCAN_RSP; 8805 8806 /* In extended adv TX_POWER returned from Set Adv Param 8807 * will be always valid. 8808 */ 8809 if (hdev->adv_tx_power != HCI_TX_POWER_INVALID || ext_adv_capable(hdev)) 8810 flags |= MGMT_ADV_FLAG_TX_POWER; 8811 8812 if (ext_adv_capable(hdev)) { 8813 flags |= MGMT_ADV_FLAG_SEC_1M; 8814 flags |= MGMT_ADV_FLAG_HW_OFFLOAD; 8815 flags |= MGMT_ADV_FLAG_CAN_SET_TX_POWER; 8816 8817 if (le_2m_capable(hdev)) 8818 flags |= MGMT_ADV_FLAG_SEC_2M; 8819 8820 if (le_coded_capable(hdev)) 8821 flags |= MGMT_ADV_FLAG_SEC_CODED; 8822 } 8823 8824 return flags; 8825 } 8826 8827 static int read_adv_features(struct sock *sk, struct hci_dev *hdev, 8828 void *data, u16 data_len) 8829 { 8830 struct mgmt_rp_read_adv_features *rp; 8831 size_t rp_len; 8832 int err; 8833 struct adv_info *adv_instance; 8834 u32 supported_flags; 8835 u8 *instance; 8836 8837 bt_dev_dbg(hdev, "sock %p", sk); 8838 8839 if (!lmp_le_capable(hdev)) 8840 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_ADV_FEATURES, 8841 MGMT_STATUS_REJECTED); 8842 8843 hci_dev_lock(hdev); 8844 8845 rp_len = sizeof(*rp) + hdev->adv_instance_cnt; 8846 rp = kmalloc(rp_len, GFP_ATOMIC); 8847 if (!rp) { 8848 hci_dev_unlock(hdev); 8849 return -ENOMEM; 8850 } 8851 8852 supported_flags = get_supported_adv_flags(hdev); 8853 8854 rp->supported_flags = cpu_to_le32(supported_flags); 8855 rp->max_adv_data_len = max_adv_len(hdev); 8856 rp->max_scan_rsp_len = max_adv_len(hdev); 8857 rp->max_instances = hdev->le_num_of_adv_sets; 8858 rp->num_instances = hdev->adv_instance_cnt; 8859 8860 instance = rp->instance; 8861 list_for_each_entry(adv_instance, &hdev->adv_instances, list) { 8862 /* Only instances 1-le_num_of_adv_sets are externally visible */ 8863 if (adv_instance->instance <= hdev->adv_instance_cnt) { 8864 *instance = adv_instance->instance; 8865 instance++; 8866 } else { 8867 rp->num_instances--; 8868 rp_len--; 8869 } 8870 } 8871 8872 hci_dev_unlock(hdev); 8873 8874 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_ADV_FEATURES, 8875 MGMT_STATUS_SUCCESS, rp, rp_len); 8876 8877 kfree(rp); 8878 8879 return err; 8880 } 8881 8882 static u8 calculate_name_len(struct hci_dev *hdev) 8883 { 8884 u8 buf[HCI_MAX_SHORT_NAME_LENGTH + 2]; /* len + type + name */ 8885 8886 return eir_append_local_name(hdev, buf, 0); 8887 } 8888 8889 static u8 tlv_data_max_len(struct hci_dev *hdev, u32 adv_flags, 8890 bool is_adv_data) 8891 { 8892 u8 max_len = max_adv_len(hdev); 8893 8894 if (is_adv_data) { 8895 if (adv_flags & (MGMT_ADV_FLAG_DISCOV | 8896 MGMT_ADV_FLAG_LIMITED_DISCOV | 8897 MGMT_ADV_FLAG_MANAGED_FLAGS)) 8898 max_len -= 3; 8899 8900 if (adv_flags & MGMT_ADV_FLAG_TX_POWER) 8901 max_len -= 3; 8902 } else { 8903 if (adv_flags & MGMT_ADV_FLAG_LOCAL_NAME) 8904 max_len -= calculate_name_len(hdev); 8905 8906 if (adv_flags & (MGMT_ADV_FLAG_APPEARANCE)) 8907 max_len -= 4; 8908 } 8909 8910 return max_len; 8911 } 8912 8913 static bool flags_managed(u32 adv_flags) 8914 { 8915 return adv_flags & (MGMT_ADV_FLAG_DISCOV | 8916 MGMT_ADV_FLAG_LIMITED_DISCOV | 8917 MGMT_ADV_FLAG_MANAGED_FLAGS); 8918 } 8919 8920 static bool tx_power_managed(u32 adv_flags) 8921 { 8922 return adv_flags & MGMT_ADV_FLAG_TX_POWER; 8923 } 8924 8925 static bool name_managed(u32 adv_flags) 8926 { 8927 return adv_flags & MGMT_ADV_FLAG_LOCAL_NAME; 8928 } 8929 8930 static bool appearance_managed(u32 adv_flags) 8931 { 8932 return adv_flags & MGMT_ADV_FLAG_APPEARANCE; 8933 } 8934 8935 static bool tlv_data_is_valid(struct hci_dev *hdev, u32 adv_flags, u8 *data, 8936 u8 len, bool is_adv_data) 8937 { 8938 int i, cur_len; 8939 u8 max_len; 8940 8941 max_len = tlv_data_max_len(hdev, adv_flags, is_adv_data); 8942 8943 if (len > max_len) 8944 return false; 8945 8946 /* Make sure that the data is correctly formatted. */ 8947 for (i = 0; i < len; i += (cur_len + 1)) { 8948 cur_len = data[i]; 8949 8950 if (!cur_len) 8951 continue; 8952 8953 /* If the current field length would exceed the total data 8954 * length, then it's invalid. 8955 */ 8956 if (i + cur_len >= len) 8957 return false; 8958 8959 if (data[i + 1] == EIR_FLAGS && 8960 (!is_adv_data || flags_managed(adv_flags))) 8961 return false; 8962 8963 if (data[i + 1] == EIR_TX_POWER && tx_power_managed(adv_flags)) 8964 return false; 8965 8966 if (data[i + 1] == EIR_NAME_COMPLETE && name_managed(adv_flags)) 8967 return false; 8968 8969 if (data[i + 1] == EIR_NAME_SHORT && name_managed(adv_flags)) 8970 return false; 8971 8972 if (data[i + 1] == EIR_APPEARANCE && 8973 appearance_managed(adv_flags)) 8974 return false; 8975 } 8976 8977 return true; 8978 } 8979 8980 static bool requested_adv_flags_are_valid(struct hci_dev *hdev, u32 adv_flags) 8981 { 8982 u32 supported_flags, phy_flags; 8983 8984 /* The current implementation only supports a subset of the specified 8985 * flags. Also need to check mutual exclusiveness of sec flags. 8986 */ 8987 supported_flags = get_supported_adv_flags(hdev); 8988 phy_flags = adv_flags & MGMT_ADV_FLAG_SEC_MASK; 8989 if (adv_flags & ~supported_flags || 8990 ((phy_flags && (phy_flags ^ (phy_flags & -phy_flags))))) 8991 return false; 8992 8993 return true; 8994 } 8995 8996 static bool adv_busy(struct hci_dev *hdev) 8997 { 8998 return pending_find(MGMT_OP_SET_LE, hdev); 8999 } 9000 9001 /* Global advertising, enabled with MGMT_OP_SET_ADVERTISING, uses instance 0 9002 * and takes precedence over any instance that would share its advertising 9003 * set: with legacy advertising there is only a single set so all instances 9004 * are overridden, whereas with extended advertising only an instance using 9005 * handle 0x00 is. 9006 */ 9007 static bool adv_overridden_by_global(struct hci_dev *hdev, 9008 struct adv_info *adv) 9009 { 9010 if (!hci_dev_test_flag(hdev, HCI_ADVERTISING)) 9011 return false; 9012 9013 return !ext_adv_capable(hdev) || !adv->handle; 9014 } 9015 9016 static void add_adv_complete(struct hci_dev *hdev, struct sock *sk, u8 instance, 9017 int err) 9018 { 9019 struct adv_info *adv, *n; 9020 9021 bt_dev_dbg(hdev, "err %d", err); 9022 9023 hci_dev_lock(hdev); 9024 9025 list_for_each_entry_safe(adv, n, &hdev->adv_instances, list) { 9026 u8 instance; 9027 9028 if (!adv->pending) 9029 continue; 9030 9031 if (!err) { 9032 adv->pending = false; 9033 continue; 9034 } 9035 9036 instance = adv->instance; 9037 9038 if (hdev->cur_adv_instance == instance) 9039 cancel_adv_timeout(hdev); 9040 9041 hci_remove_adv_instance(hdev, instance); 9042 mgmt_advertising_removed(sk, hdev, instance); 9043 } 9044 9045 hci_dev_unlock(hdev); 9046 } 9047 9048 static void add_advertising_complete(struct hci_dev *hdev, void *data, int err) 9049 { 9050 struct mgmt_pending_cmd *cmd = data; 9051 struct mgmt_cp_add_advertising *cp = cmd->param; 9052 struct mgmt_rp_add_advertising rp; 9053 9054 memset(&rp, 0, sizeof(rp)); 9055 9056 rp.instance = cp->instance; 9057 9058 if (err) 9059 mgmt_cmd_status(cmd->sk, cmd->hdev->id, cmd->opcode, 9060 mgmt_status(err)); 9061 else 9062 mgmt_cmd_complete(cmd->sk, cmd->hdev->id, cmd->opcode, 9063 mgmt_status(err), &rp, sizeof(rp)); 9064 9065 add_adv_complete(hdev, cmd->sk, cp->instance, err); 9066 9067 mgmt_pending_free(cmd); 9068 } 9069 9070 static int add_advertising_sync(struct hci_dev *hdev, void *data) 9071 { 9072 struct mgmt_pending_cmd *cmd = data; 9073 struct mgmt_cp_add_advertising *cp = cmd->param; 9074 9075 return hci_schedule_adv_instance_sync(hdev, cp->instance, true); 9076 } 9077 9078 static int add_advertising(struct sock *sk, struct hci_dev *hdev, 9079 void *data, u16 data_len) 9080 { 9081 struct mgmt_cp_add_advertising *cp = data; 9082 struct mgmt_rp_add_advertising rp; 9083 u32 flags; 9084 u8 status; 9085 u16 timeout, duration; 9086 unsigned int prev_instance_cnt; 9087 u8 schedule_instance = 0; 9088 struct adv_info *adv, *next_instance; 9089 int err; 9090 struct mgmt_pending_cmd *cmd; 9091 9092 bt_dev_dbg(hdev, "sock %p", sk); 9093 9094 status = mgmt_le_support(hdev); 9095 if (status) 9096 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING, 9097 status); 9098 9099 if (cp->instance < 1 || cp->instance > hdev->le_num_of_adv_sets) 9100 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING, 9101 MGMT_STATUS_INVALID_PARAMS); 9102 9103 if (data_len != sizeof(*cp) + cp->adv_data_len + cp->scan_rsp_len) 9104 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING, 9105 MGMT_STATUS_INVALID_PARAMS); 9106 9107 flags = __le32_to_cpu(cp->flags); 9108 timeout = __le16_to_cpu(cp->timeout); 9109 duration = __le16_to_cpu(cp->duration); 9110 9111 if (!requested_adv_flags_are_valid(hdev, flags)) 9112 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING, 9113 MGMT_STATUS_INVALID_PARAMS); 9114 9115 hci_dev_lock(hdev); 9116 9117 if (timeout && !hdev_is_powered(hdev)) { 9118 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING, 9119 MGMT_STATUS_REJECTED); 9120 goto unlock; 9121 } 9122 9123 if (adv_busy(hdev)) { 9124 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING, 9125 MGMT_STATUS_BUSY); 9126 goto unlock; 9127 } 9128 9129 if (!tlv_data_is_valid(hdev, flags, cp->data, cp->adv_data_len, true) || 9130 !tlv_data_is_valid(hdev, flags, cp->data + cp->adv_data_len, 9131 cp->scan_rsp_len, false)) { 9132 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING, 9133 MGMT_STATUS_INVALID_PARAMS); 9134 goto unlock; 9135 } 9136 9137 prev_instance_cnt = hdev->adv_instance_cnt; 9138 9139 adv = hci_add_adv_instance(hdev, cp->instance, flags, 9140 cp->adv_data_len, cp->data, 9141 cp->scan_rsp_len, 9142 cp->data + cp->adv_data_len, 9143 timeout, duration, 9144 HCI_ADV_TX_POWER_NO_PREFERENCE, 9145 hdev->le_adv_min_interval, 9146 hdev->le_adv_max_interval, 0); 9147 if (IS_ERR(adv)) { 9148 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING, 9149 MGMT_STATUS_FAILED); 9150 goto unlock; 9151 } 9152 9153 /* Only trigger an advertising added event if a new instance was 9154 * actually added. 9155 */ 9156 if (hdev->adv_instance_cnt > prev_instance_cnt) 9157 mgmt_advertising_added(sk, hdev, cp->instance); 9158 9159 if (hdev->cur_adv_instance == cp->instance) { 9160 /* If the currently advertised instance is being changed then 9161 * cancel the current advertising and schedule the next 9162 * instance. If there is only one instance then the overridden 9163 * advertising data will be visible right away. 9164 */ 9165 cancel_adv_timeout(hdev); 9166 9167 next_instance = hci_get_next_instance(hdev, cp->instance); 9168 if (next_instance) 9169 schedule_instance = next_instance->instance; 9170 } else if (!hdev->adv_instance_timeout) { 9171 /* Immediately advertise the new instance if no other 9172 * instance is currently being advertised. 9173 */ 9174 schedule_instance = cp->instance; 9175 } 9176 9177 /* If the instance is overridden by global advertising or the device 9178 * isn't powered or there is no instance to be advertised then we have 9179 * no HCI communication to make. Simply return. 9180 */ 9181 if (!hdev_is_powered(hdev) || 9182 adv_overridden_by_global(hdev, adv) || 9183 !schedule_instance) { 9184 /* Instance has been accepted so it shall no longer be 9185 * considered pending, otherwise a later failure in 9186 * add_adv_complete would remove it. 9187 */ 9188 adv->pending = false; 9189 9190 rp.instance = cp->instance; 9191 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_ADVERTISING, 9192 MGMT_STATUS_SUCCESS, &rp, sizeof(rp)); 9193 goto unlock; 9194 } 9195 9196 /* We're good to go, update advertising data, parameters, and start 9197 * advertising. 9198 */ 9199 cmd = mgmt_pending_new(sk, MGMT_OP_ADD_ADVERTISING, hdev, data, 9200 data_len); 9201 if (!cmd) { 9202 err = -ENOMEM; 9203 goto unlock; 9204 } 9205 9206 cp->instance = schedule_instance; 9207 9208 err = hci_cmd_sync_queue(hdev, add_advertising_sync, cmd, 9209 add_advertising_complete); 9210 if (err < 0) 9211 mgmt_pending_free(cmd); 9212 9213 unlock: 9214 hci_dev_unlock(hdev); 9215 9216 return err; 9217 } 9218 9219 static void add_ext_adv_params_complete(struct hci_dev *hdev, void *data, 9220 int err) 9221 { 9222 struct mgmt_pending_cmd *cmd = data; 9223 struct mgmt_cp_add_ext_adv_params *cp = cmd->param; 9224 struct mgmt_rp_add_ext_adv_params rp; 9225 struct adv_info *adv; 9226 u32 flags; 9227 9228 BT_DBG("%s", hdev->name); 9229 9230 hci_dev_lock(hdev); 9231 9232 adv = hci_find_adv_instance(hdev, cp->instance); 9233 if (!adv) 9234 goto unlock; 9235 9236 rp.instance = cp->instance; 9237 rp.tx_power = adv->tx_power; 9238 9239 /* While we're at it, inform userspace of the available space for this 9240 * advertisement, given the flags that will be used. 9241 */ 9242 flags = __le32_to_cpu(cp->flags); 9243 rp.max_adv_data_len = tlv_data_max_len(hdev, flags, true); 9244 rp.max_scan_rsp_len = tlv_data_max_len(hdev, flags, false); 9245 9246 if (err) { 9247 /* If this advertisement was previously advertising and we 9248 * failed to update it, we signal that it has been removed and 9249 * delete its structure 9250 */ 9251 if (!adv->pending) 9252 mgmt_advertising_removed(cmd->sk, hdev, cp->instance); 9253 9254 hci_remove_adv_instance(hdev, cp->instance); 9255 9256 mgmt_cmd_status(cmd->sk, cmd->hdev->id, cmd->opcode, 9257 mgmt_status(err)); 9258 } else { 9259 mgmt_cmd_complete(cmd->sk, cmd->hdev->id, cmd->opcode, 9260 mgmt_status(err), &rp, sizeof(rp)); 9261 } 9262 9263 unlock: 9264 mgmt_pending_free(cmd); 9265 9266 hci_dev_unlock(hdev); 9267 } 9268 9269 static int add_ext_adv_params_sync(struct hci_dev *hdev, void *data) 9270 { 9271 struct mgmt_pending_cmd *cmd = data; 9272 struct mgmt_cp_add_ext_adv_params *cp = cmd->param; 9273 9274 return hci_setup_ext_adv_instance_sync(hdev, cp->instance); 9275 } 9276 9277 static int add_ext_adv_params(struct sock *sk, struct hci_dev *hdev, 9278 void *data, u16 data_len) 9279 { 9280 struct mgmt_cp_add_ext_adv_params *cp = data; 9281 struct mgmt_rp_add_ext_adv_params rp; 9282 struct mgmt_pending_cmd *cmd = NULL; 9283 struct adv_info *adv; 9284 u32 flags, min_interval, max_interval; 9285 u16 timeout, duration; 9286 u8 status; 9287 s8 tx_power; 9288 int err; 9289 9290 BT_DBG("%s", hdev->name); 9291 9292 status = mgmt_le_support(hdev); 9293 if (status) 9294 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_PARAMS, 9295 status); 9296 9297 if (cp->instance < 1 || cp->instance > hdev->le_num_of_adv_sets) 9298 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_PARAMS, 9299 MGMT_STATUS_INVALID_PARAMS); 9300 9301 /* The purpose of breaking add_advertising into two separate MGMT calls 9302 * for params and data is to allow more parameters to be added to this 9303 * structure in the future. For this reason, we verify that we have the 9304 * bare minimum structure we know of when the interface was defined. Any 9305 * extra parameters we don't know about will be ignored in this request. 9306 */ 9307 if (data_len < MGMT_ADD_EXT_ADV_PARAMS_MIN_SIZE) 9308 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_PARAMS, 9309 MGMT_STATUS_INVALID_PARAMS); 9310 9311 flags = __le32_to_cpu(cp->flags); 9312 9313 if (!requested_adv_flags_are_valid(hdev, flags)) 9314 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_PARAMS, 9315 MGMT_STATUS_INVALID_PARAMS); 9316 9317 hci_dev_lock(hdev); 9318 9319 /* In new interface, we require that we are powered to register */ 9320 if (!hdev_is_powered(hdev)) { 9321 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_PARAMS, 9322 MGMT_STATUS_REJECTED); 9323 goto unlock; 9324 } 9325 9326 if (adv_busy(hdev)) { 9327 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_PARAMS, 9328 MGMT_STATUS_BUSY); 9329 goto unlock; 9330 } 9331 9332 /* Parse defined parameters from request, use defaults otherwise */ 9333 timeout = (flags & MGMT_ADV_PARAM_TIMEOUT) ? 9334 __le16_to_cpu(cp->timeout) : 0; 9335 9336 duration = (flags & MGMT_ADV_PARAM_DURATION) ? 9337 __le16_to_cpu(cp->duration) : 9338 hdev->def_multi_adv_rotation_duration; 9339 9340 min_interval = (flags & MGMT_ADV_PARAM_INTERVALS) ? 9341 __le32_to_cpu(cp->min_interval) : 9342 hdev->le_adv_min_interval; 9343 9344 max_interval = (flags & MGMT_ADV_PARAM_INTERVALS) ? 9345 __le32_to_cpu(cp->max_interval) : 9346 hdev->le_adv_max_interval; 9347 9348 tx_power = (flags & MGMT_ADV_PARAM_TX_POWER) ? 9349 cp->tx_power : 9350 HCI_ADV_TX_POWER_NO_PREFERENCE; 9351 9352 /* Create advertising instance with no advertising or response data */ 9353 adv = hci_add_adv_instance(hdev, cp->instance, flags, 0, NULL, 0, NULL, 9354 timeout, duration, tx_power, min_interval, 9355 max_interval, 0); 9356 9357 if (IS_ERR(adv)) { 9358 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_PARAMS, 9359 MGMT_STATUS_FAILED); 9360 goto unlock; 9361 } 9362 9363 /* Submit request for advertising params if ext adv available, unless 9364 * the set is in use by global advertising in which case the params 9365 * will be programmed once the instance is scheduled. 9366 */ 9367 if (ext_adv_capable(hdev) && !adv_overridden_by_global(hdev, adv)) { 9368 cmd = mgmt_pending_new(sk, MGMT_OP_ADD_EXT_ADV_PARAMS, hdev, 9369 data, data_len); 9370 if (!cmd) { 9371 err = -ENOMEM; 9372 goto remove; 9373 } 9374 9375 err = hci_cmd_sync_queue(hdev, add_ext_adv_params_sync, cmd, 9376 add_ext_adv_params_complete); 9377 if (err < 0) { 9378 mgmt_pending_free(cmd); 9379 goto remove; 9380 } 9381 } else { 9382 rp.instance = cp->instance; 9383 rp.tx_power = HCI_ADV_TX_POWER_NO_PREFERENCE; 9384 rp.max_adv_data_len = tlv_data_max_len(hdev, flags, true); 9385 rp.max_scan_rsp_len = tlv_data_max_len(hdev, flags, false); 9386 err = mgmt_cmd_complete(sk, hdev->id, 9387 MGMT_OP_ADD_EXT_ADV_PARAMS, 9388 MGMT_STATUS_SUCCESS, &rp, sizeof(rp)); 9389 } 9390 9391 goto unlock; 9392 9393 remove: 9394 /* The instance may have been modified already so remove it, like it 9395 * is done in add_ext_adv_params_complete, signaling it has been 9396 * removed if it was previously added. 9397 */ 9398 if (!adv->pending) 9399 mgmt_advertising_removed(sk, hdev, cp->instance); 9400 9401 hci_remove_adv_instance(hdev, cp->instance); 9402 9403 unlock: 9404 hci_dev_unlock(hdev); 9405 9406 return err; 9407 } 9408 9409 static void add_ext_adv_data_complete(struct hci_dev *hdev, void *data, int err) 9410 { 9411 struct mgmt_pending_cmd *cmd = data; 9412 struct mgmt_cp_add_ext_adv_data *cp = cmd->param; 9413 struct mgmt_rp_add_advertising rp; 9414 9415 add_adv_complete(hdev, cmd->sk, cp->instance, err); 9416 9417 memset(&rp, 0, sizeof(rp)); 9418 9419 rp.instance = cp->instance; 9420 9421 if (err) 9422 mgmt_cmd_status(cmd->sk, cmd->hdev->id, cmd->opcode, 9423 mgmt_status(err)); 9424 else 9425 mgmt_cmd_complete(cmd->sk, cmd->hdev->id, cmd->opcode, 9426 mgmt_status(err), &rp, sizeof(rp)); 9427 9428 mgmt_pending_free(cmd); 9429 } 9430 9431 static int add_ext_adv_data_sync(struct hci_dev *hdev, void *data) 9432 { 9433 struct mgmt_pending_cmd *cmd = data; 9434 struct mgmt_cp_add_ext_adv_data *cp = cmd->param; 9435 int err; 9436 9437 if (ext_adv_capable(hdev)) { 9438 err = hci_update_adv_data_sync(hdev, cp->instance); 9439 if (err) 9440 return err; 9441 9442 err = hci_update_scan_rsp_data_sync(hdev, cp->instance); 9443 if (err) 9444 return err; 9445 9446 return hci_enable_ext_advertising_sync(hdev, cp->instance); 9447 } 9448 9449 return hci_schedule_adv_instance_sync(hdev, cp->instance, true); 9450 } 9451 9452 static int add_ext_adv_data(struct sock *sk, struct hci_dev *hdev, void *data, 9453 u16 data_len) 9454 { 9455 struct mgmt_cp_add_ext_adv_data *cp = data; 9456 struct mgmt_rp_add_ext_adv_data rp; 9457 u8 schedule_instance = 0; 9458 struct adv_info *next_instance; 9459 struct adv_info *adv_instance; 9460 int err = 0; 9461 struct mgmt_pending_cmd *cmd; 9462 u16 expected_len; 9463 9464 BT_DBG("%s", hdev->name); 9465 9466 expected_len = struct_size(cp, data, cp->adv_data_len + 9467 cp->scan_rsp_len); 9468 if (expected_len > data_len) 9469 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_DATA, 9470 MGMT_STATUS_INVALID_PARAMS); 9471 9472 hci_dev_lock(hdev); 9473 9474 adv_instance = hci_find_adv_instance(hdev, cp->instance); 9475 9476 if (!adv_instance) { 9477 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_DATA, 9478 MGMT_STATUS_INVALID_PARAMS); 9479 goto unlock; 9480 } 9481 9482 /* In new interface, we require that we are powered to register */ 9483 if (!hdev_is_powered(hdev)) { 9484 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_DATA, 9485 MGMT_STATUS_REJECTED); 9486 goto clear_new_instance; 9487 } 9488 9489 if (adv_busy(hdev)) { 9490 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_DATA, 9491 MGMT_STATUS_BUSY); 9492 goto clear_new_instance; 9493 } 9494 9495 /* Validate new data */ 9496 if (!tlv_data_is_valid(hdev, adv_instance->flags, cp->data, 9497 cp->adv_data_len, true) || 9498 !tlv_data_is_valid(hdev, adv_instance->flags, cp->data + 9499 cp->adv_data_len, cp->scan_rsp_len, false)) { 9500 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_DATA, 9501 MGMT_STATUS_INVALID_PARAMS); 9502 goto clear_new_instance; 9503 } 9504 9505 /* Set the data in the advertising instance */ 9506 hci_set_adv_instance_data(hdev, cp->instance, cp->adv_data_len, 9507 cp->data, cp->scan_rsp_len, 9508 cp->data + cp->adv_data_len); 9509 9510 /* If using software rotation, determine next instance to use */ 9511 if (hdev->cur_adv_instance == cp->instance) { 9512 /* If the currently advertised instance is being changed 9513 * then cancel the current advertising and schedule the 9514 * next instance. If there is only one instance then the 9515 * overridden advertising data will be visible right 9516 * away 9517 */ 9518 cancel_adv_timeout(hdev); 9519 9520 next_instance = hci_get_next_instance(hdev, cp->instance); 9521 if (next_instance) 9522 schedule_instance = next_instance->instance; 9523 } else if (!hdev->adv_instance_timeout) { 9524 /* Immediately advertise the new instance if no other 9525 * instance is currently being advertised. 9526 */ 9527 schedule_instance = cp->instance; 9528 } 9529 9530 /* If the instance is overridden by global advertising or there is no 9531 * instance to be advertised then we have no HCI communication to make. 9532 * Simply return. 9533 */ 9534 if (adv_overridden_by_global(hdev, adv_instance) || 9535 !schedule_instance) { 9536 if (adv_instance->pending) { 9537 mgmt_advertising_added(sk, hdev, cp->instance); 9538 adv_instance->pending = false; 9539 } 9540 rp.instance = cp->instance; 9541 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_DATA, 9542 MGMT_STATUS_SUCCESS, &rp, sizeof(rp)); 9543 goto unlock; 9544 } 9545 9546 cmd = mgmt_pending_new(sk, MGMT_OP_ADD_EXT_ADV_DATA, hdev, data, 9547 data_len); 9548 if (!cmd) { 9549 err = -ENOMEM; 9550 goto clear_new_instance; 9551 } 9552 9553 err = hci_cmd_sync_queue(hdev, add_ext_adv_data_sync, cmd, 9554 add_ext_adv_data_complete); 9555 if (err < 0) { 9556 mgmt_pending_free(cmd); 9557 goto clear_new_instance; 9558 } 9559 9560 /* We were successful in updating data, so trigger advertising_added 9561 * event if this is an instance that wasn't previously advertising. If 9562 * a failure occurs in the requests we initiated, we will remove the 9563 * instance again in add_advertising_complete 9564 */ 9565 if (adv_instance->pending) 9566 mgmt_advertising_added(sk, hdev, cp->instance); 9567 9568 goto unlock; 9569 9570 clear_new_instance: 9571 hci_remove_adv_instance(hdev, cp->instance); 9572 9573 unlock: 9574 hci_dev_unlock(hdev); 9575 9576 return err; 9577 } 9578 9579 static void remove_advertising_complete(struct hci_dev *hdev, void *data, 9580 int err) 9581 { 9582 struct mgmt_pending_cmd *cmd = data; 9583 struct mgmt_cp_remove_advertising *cp = cmd->param; 9584 struct mgmt_rp_remove_advertising rp; 9585 9586 bt_dev_dbg(hdev, "err %d", err); 9587 9588 memset(&rp, 0, sizeof(rp)); 9589 rp.instance = cp->instance; 9590 9591 if (err) 9592 mgmt_cmd_status(cmd->sk, cmd->hdev->id, cmd->opcode, 9593 mgmt_status(err)); 9594 else 9595 mgmt_cmd_complete(cmd->sk, cmd->hdev->id, cmd->opcode, 9596 MGMT_STATUS_SUCCESS, &rp, sizeof(rp)); 9597 9598 mgmt_pending_free(cmd); 9599 } 9600 9601 static int remove_advertising_sync(struct hci_dev *hdev, void *data) 9602 { 9603 struct mgmt_pending_cmd *cmd = data; 9604 struct mgmt_cp_remove_advertising *cp = cmd->param; 9605 int err; 9606 9607 err = hci_remove_advertising_sync(hdev, cmd->sk, cp->instance, true); 9608 if (err) 9609 return err; 9610 9611 /* Don't disable advertising if global advertising (instance 0) is 9612 * enabled since it is not affected by removing instances. 9613 */ 9614 if (list_empty(&hdev->adv_instances) && 9615 !hci_dev_test_flag(hdev, HCI_ADVERTISING)) 9616 err = hci_disable_advertising_sync(hdev); 9617 9618 return err; 9619 } 9620 9621 static int remove_advertising(struct sock *sk, struct hci_dev *hdev, 9622 void *data, u16 data_len) 9623 { 9624 struct mgmt_cp_remove_advertising *cp = data; 9625 struct mgmt_pending_cmd *cmd; 9626 int err; 9627 9628 bt_dev_dbg(hdev, "sock %p", sk); 9629 9630 hci_dev_lock(hdev); 9631 9632 if (cp->instance && !hci_find_adv_instance(hdev, cp->instance)) { 9633 err = mgmt_cmd_status(sk, hdev->id, 9634 MGMT_OP_REMOVE_ADVERTISING, 9635 MGMT_STATUS_INVALID_PARAMS); 9636 goto unlock; 9637 } 9638 9639 if (pending_find(MGMT_OP_SET_LE, hdev)) { 9640 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_ADVERTISING, 9641 MGMT_STATUS_BUSY); 9642 goto unlock; 9643 } 9644 9645 if (list_empty(&hdev->adv_instances)) { 9646 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_ADVERTISING, 9647 MGMT_STATUS_INVALID_PARAMS); 9648 goto unlock; 9649 } 9650 9651 cmd = mgmt_pending_new(sk, MGMT_OP_REMOVE_ADVERTISING, hdev, data, 9652 data_len); 9653 if (!cmd) { 9654 err = -ENOMEM; 9655 goto unlock; 9656 } 9657 9658 err = hci_cmd_sync_queue(hdev, remove_advertising_sync, cmd, 9659 remove_advertising_complete); 9660 if (err < 0) 9661 mgmt_pending_free(cmd); 9662 9663 unlock: 9664 hci_dev_unlock(hdev); 9665 9666 return err; 9667 } 9668 9669 static int get_adv_size_info(struct sock *sk, struct hci_dev *hdev, 9670 void *data, u16 data_len) 9671 { 9672 struct mgmt_cp_get_adv_size_info *cp = data; 9673 struct mgmt_rp_get_adv_size_info rp; 9674 u32 flags, supported_flags; 9675 9676 bt_dev_dbg(hdev, "sock %p", sk); 9677 9678 if (!lmp_le_capable(hdev)) 9679 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_ADV_SIZE_INFO, 9680 MGMT_STATUS_REJECTED); 9681 9682 if (cp->instance < 1 || cp->instance > hdev->le_num_of_adv_sets) 9683 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_ADV_SIZE_INFO, 9684 MGMT_STATUS_INVALID_PARAMS); 9685 9686 flags = __le32_to_cpu(cp->flags); 9687 9688 /* The current implementation only supports a subset of the specified 9689 * flags. 9690 */ 9691 supported_flags = get_supported_adv_flags(hdev); 9692 if (flags & ~supported_flags) 9693 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_ADV_SIZE_INFO, 9694 MGMT_STATUS_INVALID_PARAMS); 9695 9696 rp.instance = cp->instance; 9697 rp.flags = cp->flags; 9698 rp.max_adv_data_len = tlv_data_max_len(hdev, flags, true); 9699 rp.max_scan_rsp_len = tlv_data_max_len(hdev, flags, false); 9700 9701 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_ADV_SIZE_INFO, 9702 MGMT_STATUS_SUCCESS, &rp, sizeof(rp)); 9703 } 9704 9705 static const struct hci_mgmt_handler mgmt_handlers[] = { 9706 { NULL }, /* 0x0000 (no command) */ 9707 { read_version, MGMT_READ_VERSION_SIZE, 9708 HCI_MGMT_NO_HDEV | 9709 HCI_MGMT_UNTRUSTED }, 9710 { read_commands, MGMT_READ_COMMANDS_SIZE, 9711 HCI_MGMT_NO_HDEV | 9712 HCI_MGMT_UNTRUSTED }, 9713 { read_index_list, MGMT_READ_INDEX_LIST_SIZE, 9714 HCI_MGMT_NO_HDEV | 9715 HCI_MGMT_UNTRUSTED }, 9716 { read_controller_info, MGMT_READ_INFO_SIZE, 9717 HCI_MGMT_UNTRUSTED }, 9718 { set_powered, MGMT_SETTING_SIZE }, 9719 { set_discoverable, MGMT_SET_DISCOVERABLE_SIZE }, 9720 { set_connectable, MGMT_SETTING_SIZE }, 9721 { set_fast_connectable, MGMT_SETTING_SIZE }, 9722 { set_bondable, MGMT_SETTING_SIZE }, 9723 { set_link_security, MGMT_SETTING_SIZE }, 9724 { set_ssp, MGMT_SETTING_SIZE }, 9725 { set_hs, MGMT_SETTING_SIZE }, 9726 { set_le, MGMT_SETTING_SIZE }, 9727 { set_dev_class, MGMT_SET_DEV_CLASS_SIZE }, 9728 { set_local_name, MGMT_SET_LOCAL_NAME_SIZE }, 9729 { add_uuid, MGMT_ADD_UUID_SIZE }, 9730 { remove_uuid, MGMT_REMOVE_UUID_SIZE }, 9731 { load_link_keys, MGMT_LOAD_LINK_KEYS_SIZE, 9732 HCI_MGMT_VAR_LEN }, 9733 { load_long_term_keys, MGMT_LOAD_LONG_TERM_KEYS_SIZE, 9734 HCI_MGMT_VAR_LEN }, 9735 { disconnect, MGMT_DISCONNECT_SIZE }, 9736 { get_connections, MGMT_GET_CONNECTIONS_SIZE }, 9737 { pin_code_reply, MGMT_PIN_CODE_REPLY_SIZE }, 9738 { pin_code_neg_reply, MGMT_PIN_CODE_NEG_REPLY_SIZE }, 9739 { set_io_capability, MGMT_SET_IO_CAPABILITY_SIZE }, 9740 { pair_device, MGMT_PAIR_DEVICE_SIZE }, 9741 { cancel_pair_device, MGMT_CANCEL_PAIR_DEVICE_SIZE }, 9742 { unpair_device, MGMT_UNPAIR_DEVICE_SIZE }, 9743 { user_confirm_reply, MGMT_USER_CONFIRM_REPLY_SIZE }, 9744 { user_confirm_neg_reply, MGMT_USER_CONFIRM_NEG_REPLY_SIZE }, 9745 { user_passkey_reply, MGMT_USER_PASSKEY_REPLY_SIZE }, 9746 { user_passkey_neg_reply, MGMT_USER_PASSKEY_NEG_REPLY_SIZE }, 9747 { read_local_oob_data, MGMT_READ_LOCAL_OOB_DATA_SIZE }, 9748 { add_remote_oob_data, MGMT_ADD_REMOTE_OOB_DATA_SIZE, 9749 HCI_MGMT_VAR_LEN }, 9750 { remove_remote_oob_data, MGMT_REMOVE_REMOTE_OOB_DATA_SIZE }, 9751 { start_discovery, MGMT_START_DISCOVERY_SIZE }, 9752 { stop_discovery, MGMT_STOP_DISCOVERY_SIZE }, 9753 { confirm_name, MGMT_CONFIRM_NAME_SIZE }, 9754 { block_device, MGMT_BLOCK_DEVICE_SIZE }, 9755 { unblock_device, MGMT_UNBLOCK_DEVICE_SIZE }, 9756 { set_device_id, MGMT_SET_DEVICE_ID_SIZE }, 9757 { set_advertising, MGMT_SETTING_SIZE }, 9758 { set_bredr, MGMT_SETTING_SIZE }, 9759 { set_static_address, MGMT_SET_STATIC_ADDRESS_SIZE }, 9760 { set_scan_params, MGMT_SET_SCAN_PARAMS_SIZE }, 9761 { set_secure_conn, MGMT_SETTING_SIZE }, 9762 { set_debug_keys, MGMT_SETTING_SIZE }, 9763 { set_privacy, MGMT_SET_PRIVACY_SIZE }, 9764 { load_irks, MGMT_LOAD_IRKS_SIZE, 9765 HCI_MGMT_VAR_LEN }, 9766 { get_conn_info, MGMT_GET_CONN_INFO_SIZE }, 9767 { get_clock_info, MGMT_GET_CLOCK_INFO_SIZE }, 9768 { add_device, MGMT_ADD_DEVICE_SIZE }, 9769 { remove_device, MGMT_REMOVE_DEVICE_SIZE }, 9770 { load_conn_param, MGMT_LOAD_CONN_PARAM_SIZE, 9771 HCI_MGMT_VAR_LEN }, 9772 { read_unconf_index_list, MGMT_READ_UNCONF_INDEX_LIST_SIZE, 9773 HCI_MGMT_NO_HDEV | 9774 HCI_MGMT_UNTRUSTED }, 9775 { read_config_info, MGMT_READ_CONFIG_INFO_SIZE, 9776 HCI_MGMT_UNCONFIGURED | 9777 HCI_MGMT_UNTRUSTED }, 9778 { set_external_config, MGMT_SET_EXTERNAL_CONFIG_SIZE, 9779 HCI_MGMT_UNCONFIGURED }, 9780 { set_public_address, MGMT_SET_PUBLIC_ADDRESS_SIZE, 9781 HCI_MGMT_UNCONFIGURED }, 9782 { start_service_discovery, MGMT_START_SERVICE_DISCOVERY_SIZE, 9783 HCI_MGMT_VAR_LEN }, 9784 { read_local_oob_ext_data, MGMT_READ_LOCAL_OOB_EXT_DATA_SIZE }, 9785 { read_ext_index_list, MGMT_READ_EXT_INDEX_LIST_SIZE, 9786 HCI_MGMT_NO_HDEV | 9787 HCI_MGMT_UNTRUSTED }, 9788 { read_adv_features, MGMT_READ_ADV_FEATURES_SIZE }, 9789 { add_advertising, MGMT_ADD_ADVERTISING_SIZE, 9790 HCI_MGMT_VAR_LEN }, 9791 { remove_advertising, MGMT_REMOVE_ADVERTISING_SIZE }, 9792 { get_adv_size_info, MGMT_GET_ADV_SIZE_INFO_SIZE }, 9793 { start_limited_discovery, MGMT_START_DISCOVERY_SIZE }, 9794 { read_ext_controller_info,MGMT_READ_EXT_INFO_SIZE, 9795 HCI_MGMT_UNTRUSTED }, 9796 { set_appearance, MGMT_SET_APPEARANCE_SIZE }, 9797 { get_phy_configuration, MGMT_GET_PHY_CONFIGURATION_SIZE }, 9798 { set_phy_configuration, MGMT_SET_PHY_CONFIGURATION_SIZE }, 9799 { set_blocked_keys, MGMT_OP_SET_BLOCKED_KEYS_SIZE, 9800 HCI_MGMT_VAR_LEN }, 9801 { set_wideband_speech, MGMT_SETTING_SIZE }, 9802 { read_controller_cap, MGMT_READ_CONTROLLER_CAP_SIZE, 9803 HCI_MGMT_UNTRUSTED }, 9804 { read_exp_features_info, MGMT_READ_EXP_FEATURES_INFO_SIZE, 9805 HCI_MGMT_UNTRUSTED | 9806 HCI_MGMT_HDEV_OPTIONAL }, 9807 { set_exp_feature, MGMT_SET_EXP_FEATURE_SIZE, 9808 HCI_MGMT_VAR_LEN | 9809 HCI_MGMT_HDEV_OPTIONAL }, 9810 { read_def_system_config, MGMT_READ_DEF_SYSTEM_CONFIG_SIZE, 9811 HCI_MGMT_UNTRUSTED }, 9812 { set_def_system_config, MGMT_SET_DEF_SYSTEM_CONFIG_SIZE, 9813 HCI_MGMT_VAR_LEN }, 9814 { read_def_runtime_config, MGMT_READ_DEF_RUNTIME_CONFIG_SIZE, 9815 HCI_MGMT_UNTRUSTED }, 9816 { set_def_runtime_config, MGMT_SET_DEF_RUNTIME_CONFIG_SIZE, 9817 HCI_MGMT_VAR_LEN }, 9818 { get_device_flags, MGMT_GET_DEVICE_FLAGS_SIZE }, 9819 { set_device_flags, MGMT_SET_DEVICE_FLAGS_SIZE }, 9820 { read_adv_mon_features, MGMT_READ_ADV_MONITOR_FEATURES_SIZE }, 9821 { add_adv_patterns_monitor,MGMT_ADD_ADV_PATTERNS_MONITOR_SIZE, 9822 HCI_MGMT_VAR_LEN }, 9823 { remove_adv_monitor, MGMT_REMOVE_ADV_MONITOR_SIZE }, 9824 { add_ext_adv_params, MGMT_ADD_EXT_ADV_PARAMS_MIN_SIZE, 9825 HCI_MGMT_VAR_LEN }, 9826 { add_ext_adv_data, MGMT_ADD_EXT_ADV_DATA_SIZE, 9827 HCI_MGMT_VAR_LEN }, 9828 { add_adv_patterns_monitor_rssi, 9829 MGMT_ADD_ADV_PATTERNS_MONITOR_RSSI_SIZE, 9830 HCI_MGMT_VAR_LEN }, 9831 { set_mesh, MGMT_SET_MESH_RECEIVER_SIZE, 9832 HCI_MGMT_VAR_LEN }, 9833 { mesh_features, MGMT_MESH_READ_FEATURES_SIZE }, 9834 { mesh_send, MGMT_MESH_SEND_SIZE, 9835 HCI_MGMT_VAR_LEN }, 9836 { mesh_send_cancel, MGMT_MESH_SEND_CANCEL_SIZE }, 9837 { mgmt_hci_cmd_sync, MGMT_HCI_CMD_SYNC_SIZE, HCI_MGMT_VAR_LEN }, 9838 { load_conn_subrate, MGMT_LOAD_CONN_SUBRATE_SIZE, 9839 HCI_MGMT_VAR_LEN }, 9840 }; 9841 9842 void mgmt_index_added(struct hci_dev *hdev) 9843 { 9844 struct mgmt_ev_ext_index ev; 9845 9846 if (hci_test_quirk(hdev, HCI_QUIRK_RAW_DEVICE)) 9847 return; 9848 9849 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) { 9850 mgmt_index_event(MGMT_EV_UNCONF_INDEX_ADDED, hdev, NULL, 0, 9851 HCI_MGMT_UNCONF_INDEX_EVENTS); 9852 ev.type = 0x01; 9853 } else { 9854 mgmt_index_event(MGMT_EV_INDEX_ADDED, hdev, NULL, 0, 9855 HCI_MGMT_INDEX_EVENTS); 9856 ev.type = 0x00; 9857 } 9858 9859 ev.bus = hdev->bus; 9860 9861 mgmt_index_event(MGMT_EV_EXT_INDEX_ADDED, hdev, &ev, sizeof(ev), 9862 HCI_MGMT_EXT_INDEX_EVENTS); 9863 } 9864 9865 void mgmt_index_removed(struct hci_dev *hdev) 9866 { 9867 struct mgmt_ev_ext_index ev; 9868 struct cmd_lookup match = { NULL, hdev, MGMT_STATUS_INVALID_INDEX }; 9869 9870 if (hci_test_quirk(hdev, HCI_QUIRK_RAW_DEVICE)) 9871 return; 9872 9873 mgmt_pending_foreach(0, hdev, true, cmd_complete_rsp, &match); 9874 9875 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) { 9876 mgmt_index_event(MGMT_EV_UNCONF_INDEX_REMOVED, hdev, NULL, 0, 9877 HCI_MGMT_UNCONF_INDEX_EVENTS); 9878 ev.type = 0x01; 9879 } else { 9880 mgmt_index_event(MGMT_EV_INDEX_REMOVED, hdev, NULL, 0, 9881 HCI_MGMT_INDEX_EVENTS); 9882 ev.type = 0x00; 9883 } 9884 9885 ev.bus = hdev->bus; 9886 9887 mgmt_index_event(MGMT_EV_EXT_INDEX_REMOVED, hdev, &ev, sizeof(ev), 9888 HCI_MGMT_EXT_INDEX_EVENTS); 9889 9890 /* Cancel any remaining timed work */ 9891 if (!hci_dev_test_flag(hdev, HCI_MGMT)) 9892 return; 9893 cancel_delayed_work_sync(&hdev->discov_off); 9894 cancel_delayed_work_sync(&hdev->service_cache); 9895 cancel_delayed_work_sync(&hdev->rpa_expired); 9896 cancel_delayed_work_sync(&hdev->mesh_send_done); 9897 } 9898 9899 void mgmt_power_on(struct hci_dev *hdev, int err) 9900 { 9901 struct cmd_lookup match = { NULL, hdev }; 9902 9903 bt_dev_dbg(hdev, "err %d", err); 9904 9905 hci_dev_lock(hdev); 9906 9907 if (!err) { 9908 restart_le_actions(hdev); 9909 hci_update_passive_scan(hdev); 9910 } 9911 9912 mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, true, settings_rsp, 9913 &match); 9914 9915 new_settings(hdev, match.sk); 9916 9917 if (match.sk) 9918 sock_put(match.sk); 9919 9920 hci_dev_unlock(hdev); 9921 } 9922 9923 void __mgmt_power_off(struct hci_dev *hdev) 9924 { 9925 struct cmd_lookup match = { NULL, hdev }; 9926 u8 zero_cod[] = { 0, 0, 0 }; 9927 9928 mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, true, settings_rsp, 9929 &match); 9930 9931 /* If the power off is because of hdev unregistration let 9932 * use the appropriate INVALID_INDEX status. Otherwise use 9933 * NOT_POWERED. We cover both scenarios here since later in 9934 * mgmt_index_removed() any hci_conn callbacks will have already 9935 * been triggered, potentially causing misleading DISCONNECTED 9936 * status responses. 9937 */ 9938 if (hci_dev_test_flag(hdev, HCI_UNREGISTER)) 9939 match.mgmt_status = MGMT_STATUS_INVALID_INDEX; 9940 else 9941 match.mgmt_status = MGMT_STATUS_NOT_POWERED; 9942 9943 mgmt_pending_foreach(0, hdev, true, cmd_complete_rsp, &match); 9944 9945 if (memcmp(hdev->dev_class, zero_cod, sizeof(zero_cod)) != 0) { 9946 mgmt_limited_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev, 9947 zero_cod, sizeof(zero_cod), 9948 HCI_MGMT_DEV_CLASS_EVENTS, NULL); 9949 ext_info_changed(hdev, NULL); 9950 } 9951 9952 new_settings(hdev, match.sk); 9953 9954 if (match.sk) 9955 sock_put(match.sk); 9956 } 9957 9958 void mgmt_set_powered_failed(struct hci_dev *hdev, int err) 9959 { 9960 struct mgmt_pending_cmd *cmd; 9961 u8 status; 9962 9963 cmd = pending_find(MGMT_OP_SET_POWERED, hdev); 9964 if (!cmd) 9965 return; 9966 9967 if (err == -ERFKILL) 9968 status = MGMT_STATUS_RFKILLED; 9969 else 9970 status = MGMT_STATUS_FAILED; 9971 9972 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_POWERED, status); 9973 9974 mgmt_pending_remove(cmd); 9975 } 9976 9977 void mgmt_new_link_key(struct hci_dev *hdev, struct link_key *key, 9978 bool persistent) 9979 { 9980 struct mgmt_ev_new_link_key ev; 9981 9982 memset(&ev, 0, sizeof(ev)); 9983 9984 ev.store_hint = persistent; 9985 bacpy(&ev.key.addr.bdaddr, &key->bdaddr); 9986 ev.key.addr.type = BDADDR_BREDR; 9987 ev.key.type = key->type; 9988 memcpy(ev.key.val, key->val, HCI_LINK_KEY_SIZE); 9989 ev.key.pin_len = key->pin_len; 9990 9991 mgmt_event(MGMT_EV_NEW_LINK_KEY, hdev, &ev, sizeof(ev), NULL); 9992 } 9993 9994 static u8 mgmt_ltk_type(struct smp_ltk *ltk) 9995 { 9996 switch (ltk->type) { 9997 case SMP_LTK: 9998 case SMP_LTK_RESPONDER: 9999 if (ltk->authenticated) 10000 return MGMT_LTK_AUTHENTICATED; 10001 return MGMT_LTK_UNAUTHENTICATED; 10002 case SMP_LTK_P256: 10003 if (ltk->authenticated) 10004 return MGMT_LTK_P256_AUTH; 10005 return MGMT_LTK_P256_UNAUTH; 10006 case SMP_LTK_P256_DEBUG: 10007 return MGMT_LTK_P256_DEBUG; 10008 } 10009 10010 return MGMT_LTK_UNAUTHENTICATED; 10011 } 10012 10013 void mgmt_new_ltk(struct hci_dev *hdev, struct smp_ltk *key, bool persistent) 10014 { 10015 struct mgmt_ev_new_long_term_key ev; 10016 10017 memset(&ev, 0, sizeof(ev)); 10018 10019 /* Devices using resolvable or non-resolvable random addresses 10020 * without providing an identity resolving key don't require 10021 * to store long term keys. Their addresses will change the 10022 * next time around. 10023 * 10024 * Only when a remote device provides an identity address 10025 * make sure the long term key is stored. If the remote 10026 * identity is known, the long term keys are internally 10027 * mapped to the identity address. So allow static random 10028 * and public addresses here. 10029 */ 10030 if (key->bdaddr_type == ADDR_LE_DEV_RANDOM && 10031 (key->bdaddr.b[5] & 0xc0) != 0xc0) 10032 ev.store_hint = 0x00; 10033 else 10034 ev.store_hint = persistent; 10035 10036 bacpy(&ev.key.addr.bdaddr, &key->bdaddr); 10037 ev.key.addr.type = link_to_bdaddr(LE_LINK, key->bdaddr_type); 10038 ev.key.type = mgmt_ltk_type(key); 10039 ev.key.enc_size = key->enc_size; 10040 ev.key.ediv = key->ediv; 10041 ev.key.rand = key->rand; 10042 10043 if (key->type == SMP_LTK) 10044 ev.key.initiator = 1; 10045 10046 /* Make sure we copy only the significant bytes based on the 10047 * encryption key size, and set the rest of the value to zeroes. 10048 */ 10049 memcpy(ev.key.val, key->val, key->enc_size); 10050 memset(ev.key.val + key->enc_size, 0, 10051 sizeof(ev.key.val) - key->enc_size); 10052 10053 mgmt_event(MGMT_EV_NEW_LONG_TERM_KEY, hdev, &ev, sizeof(ev), NULL); 10054 } 10055 10056 void mgmt_new_irk(struct hci_dev *hdev, struct smp_irk *irk, bool persistent) 10057 { 10058 struct mgmt_ev_new_irk ev; 10059 10060 memset(&ev, 0, sizeof(ev)); 10061 10062 ev.store_hint = persistent; 10063 10064 bacpy(&ev.rpa, &irk->rpa); 10065 bacpy(&ev.irk.addr.bdaddr, &irk->bdaddr); 10066 ev.irk.addr.type = link_to_bdaddr(LE_LINK, irk->addr_type); 10067 memcpy(ev.irk.val, irk->val, sizeof(irk->val)); 10068 10069 mgmt_event(MGMT_EV_NEW_IRK, hdev, &ev, sizeof(ev), NULL); 10070 } 10071 10072 void mgmt_new_csrk(struct hci_dev *hdev, struct smp_csrk *csrk, 10073 bool persistent) 10074 { 10075 struct mgmt_ev_new_csrk ev; 10076 10077 memset(&ev, 0, sizeof(ev)); 10078 10079 /* Devices using resolvable or non-resolvable random addresses 10080 * without providing an identity resolving key don't require 10081 * to store signature resolving keys. Their addresses will change 10082 * the next time around. 10083 * 10084 * Only when a remote device provides an identity address 10085 * make sure the signature resolving key is stored. So allow 10086 * static random and public addresses here. 10087 */ 10088 if (csrk->bdaddr_type == ADDR_LE_DEV_RANDOM && 10089 (csrk->bdaddr.b[5] & 0xc0) != 0xc0) 10090 ev.store_hint = 0x00; 10091 else 10092 ev.store_hint = persistent; 10093 10094 bacpy(&ev.key.addr.bdaddr, &csrk->bdaddr); 10095 ev.key.addr.type = link_to_bdaddr(LE_LINK, csrk->bdaddr_type); 10096 ev.key.type = csrk->type; 10097 memcpy(ev.key.val, csrk->val, sizeof(csrk->val)); 10098 10099 mgmt_event(MGMT_EV_NEW_CSRK, hdev, &ev, sizeof(ev), NULL); 10100 } 10101 10102 void mgmt_new_conn_param(struct hci_dev *hdev, bdaddr_t *bdaddr, 10103 u8 bdaddr_type, u8 store_hint, u16 min_interval, 10104 u16 max_interval, u16 latency, u16 timeout) 10105 { 10106 struct mgmt_ev_new_conn_param ev; 10107 10108 if (!hci_is_identity_address(bdaddr, bdaddr_type)) 10109 return; 10110 10111 memset(&ev, 0, sizeof(ev)); 10112 bacpy(&ev.addr.bdaddr, bdaddr); 10113 ev.addr.type = link_to_bdaddr(LE_LINK, bdaddr_type); 10114 ev.store_hint = store_hint; 10115 ev.min_interval = cpu_to_le16(min_interval); 10116 ev.max_interval = cpu_to_le16(max_interval); 10117 ev.latency = cpu_to_le16(latency); 10118 ev.timeout = cpu_to_le16(timeout); 10119 10120 mgmt_event(MGMT_EV_NEW_CONN_PARAM, hdev, &ev, sizeof(ev), NULL); 10121 } 10122 10123 void mgmt_device_connected(struct hci_dev *hdev, struct hci_conn *conn, 10124 u8 *name, u8 name_len) 10125 { 10126 struct sk_buff *skb; 10127 struct mgmt_ev_device_connected *ev; 10128 u16 eir_len = 0; 10129 u32 flags = 0; 10130 10131 if (test_and_set_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags)) 10132 return; 10133 10134 /* allocate buff for LE or BR/EDR adv */ 10135 if (conn->le_adv_data_len > 0) 10136 skb = mgmt_alloc_skb(hdev, MGMT_EV_DEVICE_CONNECTED, 10137 sizeof(*ev) + conn->le_adv_data_len); 10138 else 10139 skb = mgmt_alloc_skb(hdev, MGMT_EV_DEVICE_CONNECTED, 10140 sizeof(*ev) + (name ? eir_precalc_len(name_len) : 0) + 10141 eir_precalc_len(sizeof(conn->dev_class))); 10142 10143 if (!skb) 10144 return; 10145 10146 ev = skb_put(skb, sizeof(*ev)); 10147 bacpy(&ev->addr.bdaddr, &conn->dst); 10148 ev->addr.type = link_to_bdaddr(conn->type, conn->dst_type); 10149 10150 if (conn->out) 10151 flags |= MGMT_DEV_FOUND_INITIATED_CONN; 10152 10153 ev->flags = __cpu_to_le32(flags); 10154 10155 /* We must ensure that the EIR Data fields are ordered and 10156 * unique. Keep it simple for now and avoid the problem by not 10157 * adding any BR/EDR data to the LE adv. 10158 */ 10159 if (conn->le_adv_data_len > 0) { 10160 skb_put_data(skb, conn->le_adv_data, conn->le_adv_data_len); 10161 eir_len = conn->le_adv_data_len; 10162 } else { 10163 if (name) 10164 eir_len += eir_skb_put_data(skb, EIR_NAME_COMPLETE, name, name_len); 10165 10166 if (memcmp(conn->dev_class, "\0\0\0", sizeof(conn->dev_class))) 10167 eir_len += eir_skb_put_data(skb, EIR_CLASS_OF_DEV, 10168 conn->dev_class, sizeof(conn->dev_class)); 10169 } 10170 10171 ev->eir_len = cpu_to_le16(eir_len); 10172 10173 mgmt_event_skb(skb, NULL); 10174 10175 /* Connections that negotiated encryption as part of setup (e.g. via 10176 * an existing link key) had their security level change suppressed 10177 * since userspace did not know about them yet, so report it now. 10178 * Unencrypted connections have no change to report. 10179 */ 10180 if (test_bit(HCI_CONN_ENCRYPT, &conn->flags)) 10181 mgmt_security_level_changed(conn); 10182 } 10183 10184 static void unpair_device_rsp(struct mgmt_pending_cmd *cmd, void *data) 10185 { 10186 struct hci_dev *hdev = data; 10187 struct mgmt_cp_unpair_device *cp = cmd->param; 10188 10189 device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, cmd->sk); 10190 10191 cmd->cmd_complete(cmd, 0); 10192 } 10193 10194 bool mgmt_powering_down(struct hci_dev *hdev) 10195 { 10196 struct mgmt_pending_cmd *cmd; 10197 struct mgmt_mode *cp; 10198 10199 if (hci_dev_test_flag(hdev, HCI_POWERING_DOWN)) 10200 return true; 10201 10202 cmd = pending_find(MGMT_OP_SET_POWERED, hdev); 10203 if (!cmd) 10204 return false; 10205 10206 cp = cmd->param; 10207 if (!cp->val) 10208 return true; 10209 10210 return false; 10211 } 10212 10213 u8 hci_to_mgmt_reason(u8 err) 10214 { 10215 switch (err) { 10216 case HCI_ERROR_CONNECTION_TIMEOUT: 10217 return MGMT_DEV_DISCONN_TIMEOUT; 10218 case HCI_ERROR_REMOTE_USER_TERM: 10219 case HCI_ERROR_REMOTE_LOW_RESOURCES: 10220 case HCI_ERROR_REMOTE_POWER_OFF: 10221 return MGMT_DEV_DISCONN_REMOTE; 10222 case HCI_ERROR_LOCAL_HOST_TERM: 10223 return MGMT_DEV_DISCONN_LOCAL_HOST; 10224 default: 10225 return MGMT_DEV_DISCONN_UNKNOWN; 10226 } 10227 } 10228 10229 void mgmt_device_disconnected(struct hci_dev *hdev, bdaddr_t *bdaddr, 10230 u8 link_type, u8 addr_type, u8 reason, 10231 bool mgmt_connected) 10232 { 10233 struct mgmt_ev_device_disconnected ev; 10234 struct sock *sk = NULL; 10235 10236 if (!mgmt_connected) 10237 return; 10238 10239 if (link_type != ACL_LINK && 10240 link_type != LE_LINK && 10241 link_type != BIS_LINK) 10242 return; 10243 10244 bacpy(&ev.addr.bdaddr, bdaddr); 10245 ev.addr.type = link_to_bdaddr(link_type, addr_type); 10246 ev.reason = reason; 10247 10248 /* Report disconnects due to suspend */ 10249 if (hdev->suspended) 10250 ev.reason = MGMT_DEV_DISCONN_LOCAL_HOST_SUSPEND; 10251 10252 mgmt_event(MGMT_EV_DEVICE_DISCONNECTED, hdev, &ev, sizeof(ev), sk); 10253 10254 if (sk) 10255 sock_put(sk); 10256 } 10257 10258 void mgmt_disconnect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr, 10259 u8 link_type, u8 addr_type, u8 status) 10260 { 10261 u8 bdaddr_type = link_to_bdaddr(link_type, addr_type); 10262 struct mgmt_cp_disconnect *cp; 10263 struct mgmt_pending_cmd *cmd; 10264 10265 mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, true, 10266 unpair_device_rsp, hdev); 10267 10268 cmd = pending_find(MGMT_OP_DISCONNECT, hdev); 10269 if (!cmd) 10270 return; 10271 10272 cp = cmd->param; 10273 10274 if (bacmp(bdaddr, &cp->addr.bdaddr)) 10275 return; 10276 10277 if (cp->addr.type != bdaddr_type) 10278 return; 10279 10280 cmd->cmd_complete(cmd, mgmt_status(status)); 10281 mgmt_pending_remove(cmd); 10282 } 10283 10284 void mgmt_connect_failed(struct hci_dev *hdev, struct hci_conn *conn, u8 status) 10285 { 10286 struct mgmt_ev_connect_failed ev; 10287 10288 /* Only peek at the flag here: hci_conn_del() (via hci_conn_unlink()) 10289 * still needs it set to know whether to report the security level 10290 * reset, so it is consumed there instead of here. 10291 */ 10292 if (test_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags)) { 10293 mgmt_device_disconnected(hdev, &conn->dst, conn->type, 10294 conn->dst_type, 10295 hci_to_mgmt_reason(status), true); 10296 return; 10297 } 10298 10299 bacpy(&ev.addr.bdaddr, &conn->dst); 10300 ev.addr.type = link_to_bdaddr(conn->type, conn->dst_type); 10301 ev.status = mgmt_status(status); 10302 10303 mgmt_event(MGMT_EV_CONNECT_FAILED, hdev, &ev, sizeof(ev), NULL); 10304 } 10305 10306 void mgmt_pin_code_request(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 secure) 10307 { 10308 struct mgmt_ev_pin_code_request ev; 10309 10310 bacpy(&ev.addr.bdaddr, bdaddr); 10311 ev.addr.type = BDADDR_BREDR; 10312 ev.secure = secure; 10313 10314 mgmt_event(MGMT_EV_PIN_CODE_REQUEST, hdev, &ev, sizeof(ev), NULL); 10315 } 10316 10317 void mgmt_pin_code_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr, 10318 u8 status) 10319 { 10320 struct mgmt_pending_cmd *cmd; 10321 10322 cmd = pending_find(MGMT_OP_PIN_CODE_REPLY, hdev); 10323 if (!cmd) 10324 return; 10325 10326 cmd->cmd_complete(cmd, mgmt_status(status)); 10327 mgmt_pending_remove(cmd); 10328 } 10329 10330 void mgmt_pin_code_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr, 10331 u8 status) 10332 { 10333 struct mgmt_pending_cmd *cmd; 10334 10335 cmd = pending_find(MGMT_OP_PIN_CODE_NEG_REPLY, hdev); 10336 if (!cmd) 10337 return; 10338 10339 cmd->cmd_complete(cmd, mgmt_status(status)); 10340 mgmt_pending_remove(cmd); 10341 } 10342 10343 int mgmt_user_confirm_request(struct hci_dev *hdev, bdaddr_t *bdaddr, 10344 u8 link_type, u8 addr_type, u32 value, 10345 u8 confirm_hint) 10346 { 10347 struct mgmt_ev_user_confirm_request ev; 10348 10349 bt_dev_dbg(hdev, "bdaddr %pMR", bdaddr); 10350 10351 bacpy(&ev.addr.bdaddr, bdaddr); 10352 ev.addr.type = link_to_bdaddr(link_type, addr_type); 10353 ev.confirm_hint = confirm_hint; 10354 ev.value = cpu_to_le32(value); 10355 10356 return mgmt_event(MGMT_EV_USER_CONFIRM_REQUEST, hdev, &ev, sizeof(ev), 10357 NULL); 10358 } 10359 10360 int mgmt_user_passkey_request(struct hci_dev *hdev, bdaddr_t *bdaddr, 10361 u8 link_type, u8 addr_type) 10362 { 10363 struct mgmt_ev_user_passkey_request ev; 10364 10365 bt_dev_dbg(hdev, "bdaddr %pMR", bdaddr); 10366 10367 bacpy(&ev.addr.bdaddr, bdaddr); 10368 ev.addr.type = link_to_bdaddr(link_type, addr_type); 10369 10370 return mgmt_event(MGMT_EV_USER_PASSKEY_REQUEST, hdev, &ev, sizeof(ev), 10371 NULL); 10372 } 10373 10374 static int user_pairing_resp_complete(struct hci_dev *hdev, bdaddr_t *bdaddr, 10375 u8 link_type, u8 addr_type, u8 status, 10376 u8 opcode) 10377 { 10378 struct mgmt_pending_cmd *cmd; 10379 10380 cmd = pending_find(opcode, hdev); 10381 if (!cmd) 10382 return -ENOENT; 10383 10384 cmd->cmd_complete(cmd, mgmt_status(status)); 10385 mgmt_pending_remove(cmd); 10386 10387 return 0; 10388 } 10389 10390 int mgmt_user_confirm_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr, 10391 u8 link_type, u8 addr_type, u8 status) 10392 { 10393 return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type, 10394 status, MGMT_OP_USER_CONFIRM_REPLY); 10395 } 10396 10397 int mgmt_user_confirm_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr, 10398 u8 link_type, u8 addr_type, u8 status) 10399 { 10400 return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type, 10401 status, 10402 MGMT_OP_USER_CONFIRM_NEG_REPLY); 10403 } 10404 10405 int mgmt_user_passkey_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr, 10406 u8 link_type, u8 addr_type, u8 status) 10407 { 10408 return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type, 10409 status, MGMT_OP_USER_PASSKEY_REPLY); 10410 } 10411 10412 int mgmt_user_passkey_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr, 10413 u8 link_type, u8 addr_type, u8 status) 10414 { 10415 return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type, 10416 status, 10417 MGMT_OP_USER_PASSKEY_NEG_REPLY); 10418 } 10419 10420 int mgmt_user_passkey_notify(struct hci_dev *hdev, bdaddr_t *bdaddr, 10421 u8 link_type, u8 addr_type, u32 passkey, 10422 u8 entered) 10423 { 10424 struct mgmt_ev_passkey_notify ev; 10425 10426 bt_dev_dbg(hdev, "bdaddr %pMR", bdaddr); 10427 10428 bacpy(&ev.addr.bdaddr, bdaddr); 10429 ev.addr.type = link_to_bdaddr(link_type, addr_type); 10430 ev.passkey = __cpu_to_le32(passkey); 10431 ev.entered = entered; 10432 10433 return mgmt_event(MGMT_EV_PASSKEY_NOTIFY, hdev, &ev, sizeof(ev), NULL); 10434 } 10435 10436 void mgmt_auth_failed(struct hci_conn *conn, u8 hci_status) 10437 { 10438 struct mgmt_ev_auth_failed ev; 10439 struct mgmt_pending_cmd *cmd; 10440 u8 status = mgmt_status(hci_status); 10441 10442 bacpy(&ev.addr.bdaddr, &conn->dst); 10443 ev.addr.type = link_to_bdaddr(conn->type, conn->dst_type); 10444 ev.status = status; 10445 10446 cmd = remove_pairing(conn); 10447 10448 mgmt_event(MGMT_EV_AUTH_FAILED, conn->hdev, &ev, sizeof(ev), 10449 cmd ? cmd->sk : NULL); 10450 10451 if (cmd) { 10452 cmd->cmd_complete(cmd, status); 10453 mgmt_pending_free(cmd); 10454 } 10455 } 10456 10457 void mgmt_auth_enable_complete(struct hci_dev *hdev, u8 status) 10458 { 10459 struct cmd_lookup match = { NULL, hdev }; 10460 bool changed; 10461 10462 if (status) { 10463 u8 mgmt_err = mgmt_status(status); 10464 mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev, true, 10465 cmd_status_rsp, &mgmt_err); 10466 return; 10467 } 10468 10469 if (test_bit(HCI_AUTH, &hdev->flags)) 10470 changed = !hci_dev_test_and_set_flag(hdev, HCI_LINK_SECURITY); 10471 else 10472 changed = hci_dev_test_and_clear_flag(hdev, HCI_LINK_SECURITY); 10473 10474 mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev, true, 10475 settings_rsp, &match); 10476 10477 if (changed) 10478 new_settings(hdev, match.sk); 10479 10480 if (match.sk) 10481 sock_put(match.sk); 10482 } 10483 10484 static void sk_lookup(struct mgmt_pending_cmd *cmd, void *data) 10485 { 10486 struct cmd_lookup *match = data; 10487 10488 if (match->sk == NULL) { 10489 match->sk = cmd->sk; 10490 sock_hold(match->sk); 10491 } 10492 } 10493 10494 void mgmt_set_class_of_dev_complete(struct hci_dev *hdev, u8 *dev_class, 10495 u8 status) 10496 { 10497 struct cmd_lookup match = { NULL, hdev, mgmt_status(status) }; 10498 10499 mgmt_pending_foreach(MGMT_OP_SET_DEV_CLASS, hdev, false, sk_lookup, 10500 &match); 10501 mgmt_pending_foreach(MGMT_OP_ADD_UUID, hdev, false, sk_lookup, 10502 &match); 10503 mgmt_pending_foreach(MGMT_OP_REMOVE_UUID, hdev, false, sk_lookup, 10504 &match); 10505 10506 if (!status) { 10507 mgmt_limited_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev, dev_class, 10508 3, HCI_MGMT_DEV_CLASS_EVENTS, NULL); 10509 ext_info_changed(hdev, NULL); 10510 } 10511 10512 if (match.sk) 10513 sock_put(match.sk); 10514 } 10515 10516 void mgmt_set_local_name_complete(struct hci_dev *hdev, u8 *name, u8 status) 10517 { 10518 struct mgmt_cp_set_local_name ev; 10519 struct mgmt_pending_cmd *cmd; 10520 10521 if (status) 10522 return; 10523 10524 memset(&ev, 0, sizeof(ev)); 10525 memcpy(ev.name, name, HCI_MAX_NAME_LENGTH); 10526 memcpy(ev.short_name, hdev->short_name, HCI_MAX_SHORT_NAME_LENGTH); 10527 10528 cmd = pending_find(MGMT_OP_SET_LOCAL_NAME, hdev); 10529 if (!cmd) { 10530 memcpy(hdev->dev_name, name, sizeof(hdev->dev_name)); 10531 10532 /* If this is a HCI command related to powering on the 10533 * HCI dev don't send any mgmt signals. 10534 */ 10535 if (hci_dev_test_flag(hdev, HCI_POWERING_DOWN)) 10536 return; 10537 10538 if (pending_find(MGMT_OP_SET_POWERED, hdev)) 10539 return; 10540 } 10541 10542 mgmt_limited_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, &ev, sizeof(ev), 10543 HCI_MGMT_LOCAL_NAME_EVENTS, cmd ? cmd->sk : NULL); 10544 ext_info_changed(hdev, cmd ? cmd->sk : NULL); 10545 } 10546 10547 static inline bool has_uuid(u8 *uuid, u16 uuid_count, u8 (*uuids)[16]) 10548 { 10549 int i; 10550 10551 for (i = 0; i < uuid_count; i++) { 10552 if (!memcmp(uuid, uuids[i], 16)) 10553 return true; 10554 } 10555 10556 return false; 10557 } 10558 10559 static bool eir_has_uuids(u8 *eir, u16 eir_len, u16 uuid_count, u8 (*uuids)[16]) 10560 { 10561 u16 parsed = 0; 10562 10563 while (parsed < eir_len) { 10564 u8 field_len = eir[0]; 10565 u8 uuid[16]; 10566 int i; 10567 10568 if (field_len == 0) 10569 break; 10570 10571 if (eir_len - parsed < field_len + 1) 10572 break; 10573 10574 switch (eir[1]) { 10575 case EIR_UUID16_ALL: 10576 case EIR_UUID16_SOME: 10577 for (i = 0; i + 3 <= field_len; i += 2) { 10578 memcpy(uuid, bluetooth_base_uuid, 16); 10579 uuid[13] = eir[i + 3]; 10580 uuid[12] = eir[i + 2]; 10581 if (has_uuid(uuid, uuid_count, uuids)) 10582 return true; 10583 } 10584 break; 10585 case EIR_UUID32_ALL: 10586 case EIR_UUID32_SOME: 10587 for (i = 0; i + 5 <= field_len; i += 4) { 10588 memcpy(uuid, bluetooth_base_uuid, 16); 10589 uuid[15] = eir[i + 5]; 10590 uuid[14] = eir[i + 4]; 10591 uuid[13] = eir[i + 3]; 10592 uuid[12] = eir[i + 2]; 10593 if (has_uuid(uuid, uuid_count, uuids)) 10594 return true; 10595 } 10596 break; 10597 case EIR_UUID128_ALL: 10598 case EIR_UUID128_SOME: 10599 for (i = 0; i + 17 <= field_len; i += 16) { 10600 memcpy(uuid, eir + i + 2, 16); 10601 if (has_uuid(uuid, uuid_count, uuids)) 10602 return true; 10603 } 10604 break; 10605 } 10606 10607 parsed += field_len + 1; 10608 eir += field_len + 1; 10609 } 10610 10611 return false; 10612 } 10613 10614 static bool is_filter_match(struct hci_dev *hdev, s8 rssi, u8 *eir, 10615 u16 eir_len, u8 *scan_rsp, u8 scan_rsp_len) 10616 { 10617 /* If a RSSI threshold has been specified, and 10618 * HCI_QUIRK_STRICT_DUPLICATE_FILTER is not set, then all results with 10619 * a RSSI smaller than the RSSI threshold will be dropped. If the quirk 10620 * is set, let it through for further processing, as we might need to 10621 * restart the scan. 10622 * 10623 * For BR/EDR devices (pre 1.2) providing no RSSI during inquiry, 10624 * the results are also dropped. 10625 */ 10626 if (hdev->discovery.rssi != HCI_RSSI_INVALID && 10627 (rssi == HCI_RSSI_INVALID || 10628 (rssi < hdev->discovery.rssi && 10629 !hci_test_quirk(hdev, HCI_QUIRK_STRICT_DUPLICATE_FILTER)))) 10630 return false; 10631 10632 spin_lock(&hdev->discovery.lock); 10633 if (hdev->discovery.uuid_count != 0) { 10634 /* If a list of UUIDs is provided in filter, results with no 10635 * matching UUID should be dropped. 10636 */ 10637 if (!eir_has_uuids(eir, eir_len, hdev->discovery.uuid_count, 10638 hdev->discovery.uuids) && 10639 !eir_has_uuids(scan_rsp, scan_rsp_len, 10640 hdev->discovery.uuid_count, 10641 hdev->discovery.uuids)) { 10642 spin_unlock(&hdev->discovery.lock); 10643 return false; 10644 } 10645 } 10646 spin_unlock(&hdev->discovery.lock); 10647 10648 /* If duplicate filtering does not report RSSI changes, then restart 10649 * scanning to ensure updated result with updated RSSI values. 10650 */ 10651 if (hci_test_quirk(hdev, HCI_QUIRK_STRICT_DUPLICATE_FILTER)) { 10652 /* Validate RSSI value against the RSSI threshold once more. */ 10653 if (hdev->discovery.rssi != HCI_RSSI_INVALID && 10654 rssi < hdev->discovery.rssi) 10655 return false; 10656 } 10657 10658 return true; 10659 } 10660 10661 void mgmt_adv_monitor_device_lost(struct hci_dev *hdev, u16 handle, 10662 bdaddr_t *bdaddr, u8 addr_type) 10663 { 10664 struct mgmt_ev_adv_monitor_device_lost ev; 10665 10666 ev.monitor_handle = cpu_to_le16(handle); 10667 bacpy(&ev.addr.bdaddr, bdaddr); 10668 ev.addr.type = addr_type; 10669 10670 mgmt_event(MGMT_EV_ADV_MONITOR_DEVICE_LOST, hdev, &ev, sizeof(ev), 10671 NULL); 10672 } 10673 10674 static void mgmt_send_adv_monitor_device_found(struct hci_dev *hdev, 10675 struct sk_buff *skb, 10676 struct sock *skip_sk, 10677 u16 handle) 10678 { 10679 struct sk_buff *advmon_skb; 10680 size_t advmon_skb_len; 10681 __le16 *monitor_handle; 10682 10683 if (!skb) 10684 return; 10685 10686 advmon_skb_len = (sizeof(struct mgmt_ev_adv_monitor_device_found) - 10687 sizeof(struct mgmt_ev_device_found)) + skb->len; 10688 advmon_skb = mgmt_alloc_skb(hdev, MGMT_EV_ADV_MONITOR_DEVICE_FOUND, 10689 advmon_skb_len); 10690 if (!advmon_skb) 10691 return; 10692 10693 /* ADV_MONITOR_DEVICE_FOUND is similar to DEVICE_FOUND event except 10694 * that it also has 'monitor_handle'. Make a copy of DEVICE_FOUND and 10695 * store monitor_handle of the matched monitor. 10696 */ 10697 monitor_handle = skb_put(advmon_skb, sizeof(*monitor_handle)); 10698 *monitor_handle = cpu_to_le16(handle); 10699 skb_put_data(advmon_skb, skb->data, skb->len); 10700 10701 mgmt_event_skb(advmon_skb, skip_sk); 10702 } 10703 10704 static void mgmt_adv_monitor_device_found(struct hci_dev *hdev, 10705 bdaddr_t *bdaddr, bool report_device, 10706 struct sk_buff *skb, 10707 struct sock *skip_sk) 10708 { 10709 struct monitored_device *dev, *tmp; 10710 bool matched = false; 10711 bool notified = false; 10712 10713 /* We have received the Advertisement Report because: 10714 * 1. the kernel has initiated active discovery 10715 * 2. if not, we have pend_le_reports > 0 in which case we are doing 10716 * passive scanning 10717 * 3. if none of the above is true, we have one or more active 10718 * Advertisement Monitor 10719 * 10720 * For case 1 and 2, report all advertisements via MGMT_EV_DEVICE_FOUND 10721 * and report ONLY one advertisement per device for the matched Monitor 10722 * via MGMT_EV_ADV_MONITOR_DEVICE_FOUND event. 10723 * 10724 * For case 3, since we are not active scanning and all advertisements 10725 * received are due to a matched Advertisement Monitor, report all 10726 * advertisements ONLY via MGMT_EV_ADV_MONITOR_DEVICE_FOUND event. 10727 */ 10728 if (report_device && !hdev->advmon_pend_notify) { 10729 mgmt_event_skb(skb, skip_sk); 10730 return; 10731 } 10732 10733 hdev->advmon_pend_notify = false; 10734 10735 list_for_each_entry_safe(dev, tmp, &hdev->monitored_devices, list) { 10736 if (!bacmp(&dev->bdaddr, bdaddr)) { 10737 matched = true; 10738 10739 if (!dev->notified) { 10740 mgmt_send_adv_monitor_device_found(hdev, skb, 10741 skip_sk, 10742 dev->handle); 10743 notified = true; 10744 dev->notified = true; 10745 } 10746 } 10747 10748 if (!dev->notified) 10749 hdev->advmon_pend_notify = true; 10750 } 10751 10752 if (!report_device && 10753 ((matched && !notified) || !msft_monitor_supported(hdev))) { 10754 /* Handle 0 indicates that we are not active scanning and this 10755 * is a subsequent advertisement report for an already matched 10756 * Advertisement Monitor or the controller offloading support 10757 * is not available. 10758 */ 10759 mgmt_send_adv_monitor_device_found(hdev, skb, skip_sk, 0); 10760 } 10761 10762 if (report_device) 10763 mgmt_event_skb(skb, skip_sk); 10764 else 10765 kfree_skb(skb); 10766 } 10767 10768 static void mesh_device_found(struct hci_dev *hdev, bdaddr_t *bdaddr, 10769 u8 addr_type, s8 rssi, u32 flags, u8 *eir, 10770 u16 eir_len, u8 *scan_rsp, u8 scan_rsp_len, 10771 u64 instant) 10772 { 10773 struct sk_buff *skb; 10774 struct mgmt_ev_mesh_device_found *ev; 10775 int i, j; 10776 10777 if (!hdev->mesh_ad_types[0]) 10778 goto accepted; 10779 10780 /* Scan for requested AD types */ 10781 if (eir_len > 0) { 10782 for (i = 0; i + 1 < eir_len; i += eir[i] + 1) { 10783 for (j = 0; j < sizeof(hdev->mesh_ad_types); j++) { 10784 if (!hdev->mesh_ad_types[j]) 10785 break; 10786 10787 if (hdev->mesh_ad_types[j] == eir[i + 1]) 10788 goto accepted; 10789 } 10790 } 10791 } 10792 10793 if (scan_rsp_len > 0) { 10794 for (i = 0; i + 1 < scan_rsp_len; i += scan_rsp[i] + 1) { 10795 for (j = 0; j < sizeof(hdev->mesh_ad_types); j++) { 10796 if (!hdev->mesh_ad_types[j]) 10797 break; 10798 10799 if (hdev->mesh_ad_types[j] == scan_rsp[i + 1]) 10800 goto accepted; 10801 } 10802 } 10803 } 10804 10805 return; 10806 10807 accepted: 10808 skb = mgmt_alloc_skb(hdev, MGMT_EV_MESH_DEVICE_FOUND, 10809 sizeof(*ev) + eir_len + scan_rsp_len); 10810 if (!skb) 10811 return; 10812 10813 ev = skb_put(skb, sizeof(*ev)); 10814 10815 bacpy(&ev->addr.bdaddr, bdaddr); 10816 ev->addr.type = link_to_bdaddr(LE_LINK, addr_type); 10817 ev->rssi = rssi; 10818 ev->flags = cpu_to_le32(flags); 10819 ev->instant = cpu_to_le64(instant); 10820 10821 if (eir_len > 0) 10822 /* Copy EIR or advertising data into event */ 10823 skb_put_data(skb, eir, eir_len); 10824 10825 if (scan_rsp_len > 0) 10826 /* Append scan response data to event */ 10827 skb_put_data(skb, scan_rsp, scan_rsp_len); 10828 10829 ev->eir_len = cpu_to_le16(eir_len + scan_rsp_len); 10830 10831 mgmt_event_skb(skb, NULL); 10832 } 10833 10834 void mgmt_device_found(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type, 10835 u8 addr_type, u8 *dev_class, s8 rssi, u32 flags, 10836 u8 *eir, u16 eir_len, u8 *scan_rsp, u8 scan_rsp_len, 10837 u64 instant) 10838 { 10839 struct sk_buff *skb; 10840 struct mgmt_ev_device_found *ev; 10841 bool report_device = hci_discovery_active(hdev); 10842 10843 if (hci_dev_test_flag(hdev, HCI_MESH) && link_type == LE_LINK) 10844 mesh_device_found(hdev, bdaddr, addr_type, rssi, flags, 10845 eir, eir_len, scan_rsp, scan_rsp_len, 10846 instant); 10847 10848 /* Don't send events for a non-kernel initiated discovery. With 10849 * LE one exception is if we have pend_le_reports > 0 in which 10850 * case we're doing passive scanning and want these events. 10851 */ 10852 if (!hci_discovery_active(hdev)) { 10853 if (link_type == ACL_LINK) 10854 return; 10855 if (link_type == LE_LINK && !list_empty(&hdev->pend_le_reports)) 10856 report_device = true; 10857 else if (!hci_is_adv_monitoring(hdev)) 10858 return; 10859 } 10860 10861 if (hdev->discovery.result_filtering) { 10862 /* We are using service discovery */ 10863 if (!is_filter_match(hdev, rssi, eir, eir_len, scan_rsp, 10864 scan_rsp_len)) 10865 return; 10866 } 10867 10868 if (hdev->discovery.limited) { 10869 /* Check for limited discoverable bit */ 10870 if (dev_class) { 10871 if (!(dev_class[1] & 0x20)) 10872 return; 10873 } else { 10874 u8 *flags = eir_get_data(eir, eir_len, EIR_FLAGS, NULL); 10875 if (!flags || !(flags[0] & LE_AD_LIMITED)) 10876 return; 10877 } 10878 } 10879 10880 /* Allocate skb. The 5 extra bytes are for the potential CoD field */ 10881 skb = mgmt_alloc_skb(hdev, MGMT_EV_DEVICE_FOUND, 10882 sizeof(*ev) + eir_len + scan_rsp_len + 5); 10883 if (!skb) 10884 return; 10885 10886 ev = skb_put(skb, sizeof(*ev)); 10887 10888 /* In case of device discovery with BR/EDR devices (pre 1.2), the 10889 * RSSI value was reported as 0 when not available. This behavior 10890 * is kept when using device discovery. This is required for full 10891 * backwards compatibility with the API. 10892 * 10893 * However when using service discovery, the value 127 will be 10894 * returned when the RSSI is not available. 10895 */ 10896 if (rssi == HCI_RSSI_INVALID && !hdev->discovery.report_invalid_rssi && 10897 link_type == ACL_LINK) 10898 rssi = 0; 10899 10900 bacpy(&ev->addr.bdaddr, bdaddr); 10901 ev->addr.type = link_to_bdaddr(link_type, addr_type); 10902 ev->rssi = rssi; 10903 ev->flags = cpu_to_le32(flags); 10904 10905 if (eir_len > 0) 10906 /* Copy EIR or advertising data into event */ 10907 skb_put_data(skb, eir, eir_len); 10908 10909 if (dev_class && !eir_get_data(eir, eir_len, EIR_CLASS_OF_DEV, NULL)) { 10910 u8 eir_cod[5]; 10911 10912 eir_len += eir_append_data(eir_cod, 0, EIR_CLASS_OF_DEV, 10913 dev_class, 3); 10914 skb_put_data(skb, eir_cod, sizeof(eir_cod)); 10915 } 10916 10917 if (scan_rsp_len > 0) 10918 /* Append scan response data to event */ 10919 skb_put_data(skb, scan_rsp, scan_rsp_len); 10920 10921 ev->eir_len = cpu_to_le16(eir_len + scan_rsp_len); 10922 10923 mgmt_adv_monitor_device_found(hdev, bdaddr, report_device, skb, NULL); 10924 } 10925 10926 void mgmt_security_level_changed(struct hci_conn *conn) 10927 { 10928 struct mgmt_ev_security_level_changed *ev; 10929 struct mgmt_tlv *tlv; 10930 u8 *tlv_data; 10931 u8 tlv_len; 10932 10933 if (!test_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags)) 10934 return; 10935 10936 /* Only ACL, LE and BIS links are tracked as mgmt connections, so 10937 * restrict the event to those link types. Other transports (SCO, 10938 * CIS, PA sync, ...) share the parent's address and would otherwise 10939 * report a spurious security level change for it. 10940 */ 10941 if (conn->type != ACL_LINK && conn->type != LE_LINK && 10942 conn->type != BIS_LINK) 10943 return; 10944 10945 tlv_len = 2 * (sizeof(*tlv) + sizeof(__u8)); 10946 ev = kzalloc_flex(*ev, tlv_data, tlv_len, GFP_KERNEL); 10947 if (!ev) 10948 return; 10949 10950 bacpy(&ev->addr.bdaddr, &conn->dst); 10951 ev->addr.type = link_to_bdaddr(conn->type, conn->dst_type); 10952 ev->tlv_length = tlv_len; 10953 10954 tlv_data = ev->tlv_data; 10955 tlv = (void *)tlv_data; 10956 tlv->type = cpu_to_le16(MGMT_SEC_LEVEL_CHANGED_PARAM_LEVEL); 10957 tlv->length = sizeof(__u8); 10958 tlv->value[0] = conn->sec_level; 10959 10960 tlv_data += sizeof(*tlv) + sizeof(__u8); 10961 tlv = (void *)tlv_data; 10962 tlv->type = cpu_to_le16(MGMT_SEC_LEVEL_CHANGED_PARAM_ENC_TYPE); 10963 tlv->length = sizeof(__u8); 10964 if (!test_bit(HCI_CONN_ENCRYPT, &conn->flags)) 10965 tlv->value[0] = MGMT_CONN_SEC_ENCRYPT_NONE; 10966 else if (test_bit(HCI_CONN_AES_CCM, &conn->flags)) 10967 tlv->value[0] = MGMT_CONN_SEC_ENCRYPT_AES_CCM; 10968 else 10969 tlv->value[0] = MGMT_CONN_SEC_ENCRYPT_E0; 10970 10971 mgmt_event(MGMT_EV_SECURITY_LEVEL_CHANGED, conn->hdev, ev, 10972 struct_size(ev, tlv_data, tlv_len), NULL); 10973 10974 kfree(ev); 10975 } 10976 10977 void mgmt_remote_name(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type, 10978 u8 addr_type, s8 rssi, u8 *name, u8 name_len) 10979 { 10980 struct sk_buff *skb; 10981 struct mgmt_ev_device_found *ev; 10982 u16 eir_len = 0; 10983 u32 flags = 0; 10984 10985 skb = mgmt_alloc_skb(hdev, MGMT_EV_DEVICE_FOUND, 10986 sizeof(*ev) + (name ? eir_precalc_len(name_len) : 0)); 10987 if (!skb) 10988 return; 10989 10990 ev = skb_put(skb, sizeof(*ev)); 10991 bacpy(&ev->addr.bdaddr, bdaddr); 10992 ev->addr.type = link_to_bdaddr(link_type, addr_type); 10993 ev->rssi = rssi; 10994 10995 if (name) 10996 eir_len += eir_skb_put_data(skb, EIR_NAME_COMPLETE, name, name_len); 10997 else 10998 flags = MGMT_DEV_FOUND_NAME_REQUEST_FAILED; 10999 11000 ev->eir_len = cpu_to_le16(eir_len); 11001 ev->flags = cpu_to_le32(flags); 11002 11003 mgmt_event_skb(skb, NULL); 11004 } 11005 11006 void mgmt_discovering(struct hci_dev *hdev, u8 discovering) 11007 { 11008 struct mgmt_ev_discovering ev; 11009 11010 bt_dev_dbg(hdev, "discovering %u", discovering); 11011 11012 memset(&ev, 0, sizeof(ev)); 11013 ev.type = hdev->discovery.type; 11014 ev.discovering = discovering; 11015 11016 mgmt_event(MGMT_EV_DISCOVERING, hdev, &ev, sizeof(ev), NULL); 11017 } 11018 11019 void mgmt_suspending(struct hci_dev *hdev, u8 state) 11020 { 11021 struct mgmt_ev_controller_suspend ev; 11022 11023 ev.suspend_state = state; 11024 mgmt_event(MGMT_EV_CONTROLLER_SUSPEND, hdev, &ev, sizeof(ev), NULL); 11025 } 11026 11027 void mgmt_resuming(struct hci_dev *hdev, u8 reason, bdaddr_t *bdaddr, 11028 u8 addr_type) 11029 { 11030 struct mgmt_ev_controller_resume ev; 11031 11032 ev.wake_reason = reason; 11033 if (bdaddr) { 11034 bacpy(&ev.addr.bdaddr, bdaddr); 11035 ev.addr.type = addr_type; 11036 } else { 11037 memset(&ev.addr, 0, sizeof(ev.addr)); 11038 } 11039 11040 mgmt_event(MGMT_EV_CONTROLLER_RESUME, hdev, &ev, sizeof(ev), NULL); 11041 } 11042 11043 static struct hci_mgmt_chan chan = { 11044 .channel = HCI_CHANNEL_CONTROL, 11045 .handler_count = ARRAY_SIZE(mgmt_handlers), 11046 .handlers = mgmt_handlers, 11047 .hdev_init = mgmt_init_hdev, 11048 }; 11049 11050 int mgmt_init(void) 11051 { 11052 return hci_mgmt_chan_register(&chan); 11053 } 11054 11055 void mgmt_conn_subrate_notify(struct hci_dev *hdev, struct hci_conn *conn, 11056 u8 status) 11057 { 11058 struct mgmt_ev_conn_subrate ev; 11059 11060 bacpy(&ev.addr.bdaddr, &conn->dst); 11061 ev.addr.type = link_to_bdaddr(conn->type, conn->dst_type); 11062 ev.status = mgmt_status(status); 11063 ev.interval = cpu_to_le16(conn->le_rate_interval); 11064 ev.subrate = cpu_to_le16(conn->le_subrate); 11065 ev.latency = cpu_to_le16(conn->le_rate_latency); 11066 ev.cont_num = cpu_to_le16(conn->le_cont_num); 11067 ev.supv_timeout = cpu_to_le16(conn->le_rate_supv_timeout); 11068 11069 mgmt_event(MGMT_EV_CONN_SUBRATE, hdev, &ev, sizeof(ev), NULL); 11070 } 11071 11072 void mgmt_exit(void) 11073 { 11074 hci_mgmt_chan_unregister(&chan); 11075 } 11076 11077 void mgmt_cleanup(struct sock *sk) 11078 { 11079 struct mgmt_mesh_tx *mesh_tx; 11080 struct hci_dev *hdev; 11081 11082 read_lock(&hci_dev_list_lock); 11083 11084 list_for_each_entry(hdev, &hci_dev_list, list) { 11085 do { 11086 mesh_tx = mgmt_mesh_next(hdev, sk); 11087 11088 if (mesh_tx) 11089 mesh_send_complete(hdev, mesh_tx, true); 11090 } while (mesh_tx); 11091 } 11092 11093 read_unlock(&hci_dev_list_lock); 11094 } 11095