1 // SPDX-License-Identifier: GPL-2.0 2 /* 3 BlueZ - Bluetooth protocol stack for Linux 4 5 Copyright (C) 2010 Nokia Corporation 6 Copyright (C) 2011-2012 Intel Corporation 7 8 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS 9 OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 10 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS. 11 IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY 12 CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES 13 WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN 14 ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF 15 OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. 16 17 ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS, 18 COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS 19 SOFTWARE IS DISCLAIMED. 20 */ 21 22 /* Bluetooth HCI Management interface */ 23 24 #include <linux/module.h> 25 #include <linux/unaligned.h> 26 27 #include <net/bluetooth/bluetooth.h> 28 #include <net/bluetooth/hci_core.h> 29 #include <net/bluetooth/hci_sock.h> 30 #include <net/bluetooth/l2cap.h> 31 #include <net/bluetooth/mgmt.h> 32 33 #include "smp.h" 34 #include "mgmt_util.h" 35 #include "mgmt_config.h" 36 #include "msft.h" 37 #include "eir.h" 38 #include "aosp.h" 39 40 #define MGMT_VERSION 1 41 #define MGMT_REVISION 23 42 43 static const u16 mgmt_commands[] = { 44 MGMT_OP_READ_INDEX_LIST, 45 MGMT_OP_READ_INFO, 46 MGMT_OP_SET_POWERED, 47 MGMT_OP_SET_DISCOVERABLE, 48 MGMT_OP_SET_CONNECTABLE, 49 MGMT_OP_SET_FAST_CONNECTABLE, 50 MGMT_OP_SET_BONDABLE, 51 MGMT_OP_SET_LINK_SECURITY, 52 MGMT_OP_SET_SSP, 53 MGMT_OP_SET_HS, 54 MGMT_OP_SET_LE, 55 MGMT_OP_SET_DEV_CLASS, 56 MGMT_OP_SET_LOCAL_NAME, 57 MGMT_OP_ADD_UUID, 58 MGMT_OP_REMOVE_UUID, 59 MGMT_OP_LOAD_LINK_KEYS, 60 MGMT_OP_LOAD_LONG_TERM_KEYS, 61 MGMT_OP_DISCONNECT, 62 MGMT_OP_GET_CONNECTIONS, 63 MGMT_OP_PIN_CODE_REPLY, 64 MGMT_OP_PIN_CODE_NEG_REPLY, 65 MGMT_OP_SET_IO_CAPABILITY, 66 MGMT_OP_PAIR_DEVICE, 67 MGMT_OP_CANCEL_PAIR_DEVICE, 68 MGMT_OP_UNPAIR_DEVICE, 69 MGMT_OP_USER_CONFIRM_REPLY, 70 MGMT_OP_USER_CONFIRM_NEG_REPLY, 71 MGMT_OP_USER_PASSKEY_REPLY, 72 MGMT_OP_USER_PASSKEY_NEG_REPLY, 73 MGMT_OP_READ_LOCAL_OOB_DATA, 74 MGMT_OP_ADD_REMOTE_OOB_DATA, 75 MGMT_OP_REMOVE_REMOTE_OOB_DATA, 76 MGMT_OP_START_DISCOVERY, 77 MGMT_OP_STOP_DISCOVERY, 78 MGMT_OP_CONFIRM_NAME, 79 MGMT_OP_BLOCK_DEVICE, 80 MGMT_OP_UNBLOCK_DEVICE, 81 MGMT_OP_SET_DEVICE_ID, 82 MGMT_OP_SET_ADVERTISING, 83 MGMT_OP_SET_BREDR, 84 MGMT_OP_SET_STATIC_ADDRESS, 85 MGMT_OP_SET_SCAN_PARAMS, 86 MGMT_OP_SET_SECURE_CONN, 87 MGMT_OP_SET_DEBUG_KEYS, 88 MGMT_OP_SET_PRIVACY, 89 MGMT_OP_LOAD_IRKS, 90 MGMT_OP_GET_CONN_INFO, 91 MGMT_OP_GET_CLOCK_INFO, 92 MGMT_OP_ADD_DEVICE, 93 MGMT_OP_REMOVE_DEVICE, 94 MGMT_OP_LOAD_CONN_PARAM, 95 MGMT_OP_READ_UNCONF_INDEX_LIST, 96 MGMT_OP_READ_CONFIG_INFO, 97 MGMT_OP_SET_EXTERNAL_CONFIG, 98 MGMT_OP_SET_PUBLIC_ADDRESS, 99 MGMT_OP_START_SERVICE_DISCOVERY, 100 MGMT_OP_READ_LOCAL_OOB_EXT_DATA, 101 MGMT_OP_READ_EXT_INDEX_LIST, 102 MGMT_OP_READ_ADV_FEATURES, 103 MGMT_OP_ADD_ADVERTISING, 104 MGMT_OP_REMOVE_ADVERTISING, 105 MGMT_OP_GET_ADV_SIZE_INFO, 106 MGMT_OP_START_LIMITED_DISCOVERY, 107 MGMT_OP_READ_EXT_INFO, 108 MGMT_OP_SET_APPEARANCE, 109 MGMT_OP_GET_PHY_CONFIGURATION, 110 MGMT_OP_SET_PHY_CONFIGURATION, 111 MGMT_OP_SET_BLOCKED_KEYS, 112 MGMT_OP_SET_WIDEBAND_SPEECH, 113 MGMT_OP_READ_CONTROLLER_CAP, 114 MGMT_OP_READ_EXP_FEATURES_INFO, 115 MGMT_OP_SET_EXP_FEATURE, 116 MGMT_OP_READ_DEF_SYSTEM_CONFIG, 117 MGMT_OP_SET_DEF_SYSTEM_CONFIG, 118 MGMT_OP_READ_DEF_RUNTIME_CONFIG, 119 MGMT_OP_SET_DEF_RUNTIME_CONFIG, 120 MGMT_OP_GET_DEVICE_FLAGS, 121 MGMT_OP_SET_DEVICE_FLAGS, 122 MGMT_OP_READ_ADV_MONITOR_FEATURES, 123 MGMT_OP_ADD_ADV_PATTERNS_MONITOR, 124 MGMT_OP_REMOVE_ADV_MONITOR, 125 MGMT_OP_ADD_EXT_ADV_PARAMS, 126 MGMT_OP_ADD_EXT_ADV_DATA, 127 MGMT_OP_ADD_ADV_PATTERNS_MONITOR_RSSI, 128 MGMT_OP_SET_MESH_RECEIVER, 129 MGMT_OP_MESH_READ_FEATURES, 130 MGMT_OP_MESH_SEND, 131 MGMT_OP_MESH_SEND_CANCEL, 132 MGMT_OP_HCI_CMD_SYNC, 133 }; 134 135 static const u16 mgmt_events[] = { 136 MGMT_EV_CONTROLLER_ERROR, 137 MGMT_EV_INDEX_ADDED, 138 MGMT_EV_INDEX_REMOVED, 139 MGMT_EV_NEW_SETTINGS, 140 MGMT_EV_CLASS_OF_DEV_CHANGED, 141 MGMT_EV_LOCAL_NAME_CHANGED, 142 MGMT_EV_NEW_LINK_KEY, 143 MGMT_EV_NEW_LONG_TERM_KEY, 144 MGMT_EV_DEVICE_CONNECTED, 145 MGMT_EV_DEVICE_DISCONNECTED, 146 MGMT_EV_CONNECT_FAILED, 147 MGMT_EV_PIN_CODE_REQUEST, 148 MGMT_EV_USER_CONFIRM_REQUEST, 149 MGMT_EV_USER_PASSKEY_REQUEST, 150 MGMT_EV_AUTH_FAILED, 151 MGMT_EV_DEVICE_FOUND, 152 MGMT_EV_DISCOVERING, 153 MGMT_EV_DEVICE_BLOCKED, 154 MGMT_EV_DEVICE_UNBLOCKED, 155 MGMT_EV_DEVICE_UNPAIRED, 156 MGMT_EV_PASSKEY_NOTIFY, 157 MGMT_EV_NEW_IRK, 158 MGMT_EV_NEW_CSRK, 159 MGMT_EV_DEVICE_ADDED, 160 MGMT_EV_DEVICE_REMOVED, 161 MGMT_EV_NEW_CONN_PARAM, 162 MGMT_EV_UNCONF_INDEX_ADDED, 163 MGMT_EV_UNCONF_INDEX_REMOVED, 164 MGMT_EV_NEW_CONFIG_OPTIONS, 165 MGMT_EV_EXT_INDEX_ADDED, 166 MGMT_EV_EXT_INDEX_REMOVED, 167 MGMT_EV_LOCAL_OOB_DATA_UPDATED, 168 MGMT_EV_ADVERTISING_ADDED, 169 MGMT_EV_ADVERTISING_REMOVED, 170 MGMT_EV_EXT_INFO_CHANGED, 171 MGMT_EV_PHY_CONFIGURATION_CHANGED, 172 MGMT_EV_EXP_FEATURE_CHANGED, 173 MGMT_EV_DEVICE_FLAGS_CHANGED, 174 MGMT_EV_ADV_MONITOR_ADDED, 175 MGMT_EV_ADV_MONITOR_REMOVED, 176 MGMT_EV_CONTROLLER_SUSPEND, 177 MGMT_EV_CONTROLLER_RESUME, 178 MGMT_EV_ADV_MONITOR_DEVICE_FOUND, 179 MGMT_EV_ADV_MONITOR_DEVICE_LOST, 180 }; 181 182 static const u16 mgmt_untrusted_commands[] = { 183 MGMT_OP_READ_INDEX_LIST, 184 MGMT_OP_READ_INFO, 185 MGMT_OP_READ_UNCONF_INDEX_LIST, 186 MGMT_OP_READ_CONFIG_INFO, 187 MGMT_OP_READ_EXT_INDEX_LIST, 188 MGMT_OP_READ_EXT_INFO, 189 MGMT_OP_READ_CONTROLLER_CAP, 190 MGMT_OP_READ_EXP_FEATURES_INFO, 191 MGMT_OP_READ_DEF_SYSTEM_CONFIG, 192 MGMT_OP_READ_DEF_RUNTIME_CONFIG, 193 }; 194 195 static const u16 mgmt_untrusted_events[] = { 196 MGMT_EV_INDEX_ADDED, 197 MGMT_EV_INDEX_REMOVED, 198 MGMT_EV_NEW_SETTINGS, 199 MGMT_EV_CLASS_OF_DEV_CHANGED, 200 MGMT_EV_LOCAL_NAME_CHANGED, 201 MGMT_EV_UNCONF_INDEX_ADDED, 202 MGMT_EV_UNCONF_INDEX_REMOVED, 203 MGMT_EV_NEW_CONFIG_OPTIONS, 204 MGMT_EV_EXT_INDEX_ADDED, 205 MGMT_EV_EXT_INDEX_REMOVED, 206 MGMT_EV_EXT_INFO_CHANGED, 207 MGMT_EV_EXP_FEATURE_CHANGED, 208 }; 209 210 #define CACHE_TIMEOUT secs_to_jiffies(2) 211 212 #define ZERO_KEY "\x00\x00\x00\x00\x00\x00\x00\x00" \ 213 "\x00\x00\x00\x00\x00\x00\x00\x00" 214 215 /* HCI to MGMT error code conversion table */ 216 static const u8 mgmt_status_table[] = { 217 MGMT_STATUS_SUCCESS, 218 MGMT_STATUS_UNKNOWN_COMMAND, /* Unknown Command */ 219 MGMT_STATUS_NOT_CONNECTED, /* No Connection */ 220 MGMT_STATUS_FAILED, /* Hardware Failure */ 221 MGMT_STATUS_CONNECT_FAILED, /* Page Timeout */ 222 MGMT_STATUS_AUTH_FAILED, /* Authentication Failed */ 223 MGMT_STATUS_AUTH_FAILED, /* PIN or Key Missing */ 224 MGMT_STATUS_NO_RESOURCES, /* Memory Full */ 225 MGMT_STATUS_TIMEOUT, /* Connection Timeout */ 226 MGMT_STATUS_NO_RESOURCES, /* Max Number of Connections */ 227 MGMT_STATUS_NO_RESOURCES, /* Max Number of SCO Connections */ 228 MGMT_STATUS_ALREADY_CONNECTED, /* ACL Connection Exists */ 229 MGMT_STATUS_BUSY, /* Command Disallowed */ 230 MGMT_STATUS_NO_RESOURCES, /* Rejected Limited Resources */ 231 MGMT_STATUS_REJECTED, /* Rejected Security */ 232 MGMT_STATUS_REJECTED, /* Rejected Personal */ 233 MGMT_STATUS_TIMEOUT, /* Host Timeout */ 234 MGMT_STATUS_NOT_SUPPORTED, /* Unsupported Feature */ 235 MGMT_STATUS_INVALID_PARAMS, /* Invalid Parameters */ 236 MGMT_STATUS_DISCONNECTED, /* OE User Ended Connection */ 237 MGMT_STATUS_NO_RESOURCES, /* OE Low Resources */ 238 MGMT_STATUS_DISCONNECTED, /* OE Power Off */ 239 MGMT_STATUS_DISCONNECTED, /* Connection Terminated */ 240 MGMT_STATUS_BUSY, /* Repeated Attempts */ 241 MGMT_STATUS_REJECTED, /* Pairing Not Allowed */ 242 MGMT_STATUS_FAILED, /* Unknown LMP PDU */ 243 MGMT_STATUS_NOT_SUPPORTED, /* Unsupported Remote Feature */ 244 MGMT_STATUS_REJECTED, /* SCO Offset Rejected */ 245 MGMT_STATUS_REJECTED, /* SCO Interval Rejected */ 246 MGMT_STATUS_REJECTED, /* Air Mode Rejected */ 247 MGMT_STATUS_INVALID_PARAMS, /* Invalid LMP Parameters */ 248 MGMT_STATUS_FAILED, /* Unspecified Error */ 249 MGMT_STATUS_NOT_SUPPORTED, /* Unsupported LMP Parameter Value */ 250 MGMT_STATUS_FAILED, /* Role Change Not Allowed */ 251 MGMT_STATUS_TIMEOUT, /* LMP Response Timeout */ 252 MGMT_STATUS_FAILED, /* LMP Error Transaction Collision */ 253 MGMT_STATUS_FAILED, /* LMP PDU Not Allowed */ 254 MGMT_STATUS_REJECTED, /* Encryption Mode Not Accepted */ 255 MGMT_STATUS_FAILED, /* Unit Link Key Used */ 256 MGMT_STATUS_NOT_SUPPORTED, /* QoS Not Supported */ 257 MGMT_STATUS_TIMEOUT, /* Instant Passed */ 258 MGMT_STATUS_NOT_SUPPORTED, /* Pairing Not Supported */ 259 MGMT_STATUS_FAILED, /* Transaction Collision */ 260 MGMT_STATUS_FAILED, /* Reserved for future use */ 261 MGMT_STATUS_INVALID_PARAMS, /* Unacceptable Parameter */ 262 MGMT_STATUS_REJECTED, /* QoS Rejected */ 263 MGMT_STATUS_NOT_SUPPORTED, /* Classification Not Supported */ 264 MGMT_STATUS_REJECTED, /* Insufficient Security */ 265 MGMT_STATUS_INVALID_PARAMS, /* Parameter Out Of Range */ 266 MGMT_STATUS_FAILED, /* Reserved for future use */ 267 MGMT_STATUS_BUSY, /* Role Switch Pending */ 268 MGMT_STATUS_FAILED, /* Reserved for future use */ 269 MGMT_STATUS_FAILED, /* Slot Violation */ 270 MGMT_STATUS_FAILED, /* Role Switch Failed */ 271 MGMT_STATUS_INVALID_PARAMS, /* EIR Too Large */ 272 MGMT_STATUS_NOT_SUPPORTED, /* Simple Pairing Not Supported */ 273 MGMT_STATUS_BUSY, /* Host Busy Pairing */ 274 MGMT_STATUS_REJECTED, /* Rejected, No Suitable Channel */ 275 MGMT_STATUS_BUSY, /* Controller Busy */ 276 MGMT_STATUS_INVALID_PARAMS, /* Unsuitable Connection Interval */ 277 MGMT_STATUS_TIMEOUT, /* Directed Advertising Timeout */ 278 MGMT_STATUS_AUTH_FAILED, /* Terminated Due to MIC Failure */ 279 MGMT_STATUS_CONNECT_FAILED, /* Connection Establishment Failed */ 280 MGMT_STATUS_CONNECT_FAILED, /* MAC Connection Failed */ 281 }; 282 283 static u8 mgmt_errno_status(int err) 284 { 285 switch (err) { 286 case 0: 287 return MGMT_STATUS_SUCCESS; 288 case -EPERM: 289 return MGMT_STATUS_REJECTED; 290 case -EINVAL: 291 return MGMT_STATUS_INVALID_PARAMS; 292 case -EOPNOTSUPP: 293 return MGMT_STATUS_NOT_SUPPORTED; 294 case -EBUSY: 295 return MGMT_STATUS_BUSY; 296 case -ETIMEDOUT: 297 return MGMT_STATUS_AUTH_FAILED; 298 case -ENOMEM: 299 return MGMT_STATUS_NO_RESOURCES; 300 case -EISCONN: 301 return MGMT_STATUS_ALREADY_CONNECTED; 302 case -ENOTCONN: 303 return MGMT_STATUS_DISCONNECTED; 304 } 305 306 return MGMT_STATUS_FAILED; 307 } 308 309 static u8 mgmt_status(int err) 310 { 311 if (err < 0) 312 return mgmt_errno_status(err); 313 314 if (err < ARRAY_SIZE(mgmt_status_table)) 315 return mgmt_status_table[err]; 316 317 return MGMT_STATUS_FAILED; 318 } 319 320 static int mgmt_index_event(u16 event, struct hci_dev *hdev, void *data, 321 u16 len, int flag) 322 { 323 return mgmt_send_event(event, hdev, HCI_CHANNEL_CONTROL, data, len, 324 flag, NULL); 325 } 326 327 static int mgmt_limited_event(u16 event, struct hci_dev *hdev, void *data, 328 u16 len, int flag, struct sock *skip_sk) 329 { 330 return mgmt_send_event(event, hdev, HCI_CHANNEL_CONTROL, data, len, 331 flag, skip_sk); 332 } 333 334 static int mgmt_event(u16 event, struct hci_dev *hdev, void *data, u16 len, 335 struct sock *skip_sk) 336 { 337 return mgmt_send_event(event, hdev, HCI_CHANNEL_CONTROL, data, len, 338 HCI_SOCK_TRUSTED, skip_sk); 339 } 340 341 static int mgmt_event_skb(struct sk_buff *skb, struct sock *skip_sk) 342 { 343 return mgmt_send_event_skb(HCI_CHANNEL_CONTROL, skb, HCI_SOCK_TRUSTED, 344 skip_sk); 345 } 346 347 static u8 le_addr_type(u8 mgmt_addr_type) 348 { 349 if (mgmt_addr_type == BDADDR_LE_PUBLIC) 350 return ADDR_LE_DEV_PUBLIC; 351 else 352 return ADDR_LE_DEV_RANDOM; 353 } 354 355 void mgmt_fill_version_info(void *ver) 356 { 357 struct mgmt_rp_read_version *rp = ver; 358 359 rp->version = MGMT_VERSION; 360 rp->revision = cpu_to_le16(MGMT_REVISION); 361 } 362 363 static int read_version(struct sock *sk, struct hci_dev *hdev, void *data, 364 u16 data_len) 365 { 366 struct mgmt_rp_read_version rp; 367 368 bt_dev_dbg(hdev, "sock %p", sk); 369 370 mgmt_fill_version_info(&rp); 371 372 return mgmt_cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_VERSION, 0, 373 &rp, sizeof(rp)); 374 } 375 376 static int read_commands(struct sock *sk, struct hci_dev *hdev, void *data, 377 u16 data_len) 378 { 379 struct mgmt_rp_read_commands *rp; 380 u16 num_commands, num_events; 381 size_t rp_size; 382 int i, err; 383 384 bt_dev_dbg(hdev, "sock %p", sk); 385 386 if (hci_sock_test_flag(sk, HCI_SOCK_TRUSTED)) { 387 num_commands = ARRAY_SIZE(mgmt_commands); 388 num_events = ARRAY_SIZE(mgmt_events); 389 } else { 390 num_commands = ARRAY_SIZE(mgmt_untrusted_commands); 391 num_events = ARRAY_SIZE(mgmt_untrusted_events); 392 } 393 394 rp_size = sizeof(*rp) + ((num_commands + num_events) * sizeof(u16)); 395 396 rp = kmalloc(rp_size, GFP_KERNEL); 397 if (!rp) 398 return -ENOMEM; 399 400 rp->num_commands = cpu_to_le16(num_commands); 401 rp->num_events = cpu_to_le16(num_events); 402 403 if (hci_sock_test_flag(sk, HCI_SOCK_TRUSTED)) { 404 __le16 *opcode = rp->opcodes; 405 406 for (i = 0; i < num_commands; i++, opcode++) 407 put_unaligned_le16(mgmt_commands[i], opcode); 408 409 for (i = 0; i < num_events; i++, opcode++) 410 put_unaligned_le16(mgmt_events[i], opcode); 411 } else { 412 __le16 *opcode = rp->opcodes; 413 414 for (i = 0; i < num_commands; i++, opcode++) 415 put_unaligned_le16(mgmt_untrusted_commands[i], opcode); 416 417 for (i = 0; i < num_events; i++, opcode++) 418 put_unaligned_le16(mgmt_untrusted_events[i], opcode); 419 } 420 421 err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_COMMANDS, 0, 422 rp, rp_size); 423 kfree(rp); 424 425 return err; 426 } 427 428 static int read_index_list(struct sock *sk, struct hci_dev *hdev, void *data, 429 u16 data_len) 430 { 431 struct mgmt_rp_read_index_list *rp; 432 struct hci_dev *d; 433 size_t rp_len; 434 u16 count; 435 int err; 436 437 bt_dev_dbg(hdev, "sock %p", sk); 438 439 read_lock(&hci_dev_list_lock); 440 441 count = 0; 442 list_for_each_entry(d, &hci_dev_list, list) { 443 if (!hci_dev_test_flag(d, HCI_UNCONFIGURED)) 444 count++; 445 } 446 447 rp_len = sizeof(*rp) + (2 * count); 448 rp = kmalloc(rp_len, GFP_ATOMIC); 449 if (!rp) { 450 read_unlock(&hci_dev_list_lock); 451 return -ENOMEM; 452 } 453 454 count = 0; 455 list_for_each_entry(d, &hci_dev_list, list) { 456 if (hci_dev_test_flag(d, HCI_SETUP) || 457 hci_dev_test_flag(d, HCI_CONFIG) || 458 hci_dev_test_flag(d, HCI_USER_CHANNEL)) 459 continue; 460 461 /* Devices marked as raw-only are neither configured 462 * nor unconfigured controllers. 463 */ 464 if (hci_test_quirk(d, HCI_QUIRK_RAW_DEVICE)) 465 continue; 466 467 if (!hci_dev_test_flag(d, HCI_UNCONFIGURED)) { 468 rp->index[count++] = cpu_to_le16(d->id); 469 bt_dev_dbg(hdev, "Added hci%u", d->id); 470 } 471 } 472 473 rp->num_controllers = cpu_to_le16(count); 474 rp_len = sizeof(*rp) + (2 * count); 475 476 read_unlock(&hci_dev_list_lock); 477 478 err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_INDEX_LIST, 479 0, rp, rp_len); 480 481 kfree(rp); 482 483 return err; 484 } 485 486 static int read_unconf_index_list(struct sock *sk, struct hci_dev *hdev, 487 void *data, u16 data_len) 488 { 489 struct mgmt_rp_read_unconf_index_list *rp; 490 struct hci_dev *d; 491 size_t rp_len; 492 u16 count; 493 int err; 494 495 bt_dev_dbg(hdev, "sock %p", sk); 496 497 read_lock(&hci_dev_list_lock); 498 499 count = list_count_nodes(&hci_dev_list); 500 501 rp_len = sizeof(*rp) + (sizeof(__le16) * count); 502 rp = kmalloc(rp_len, GFP_ATOMIC); 503 if (!rp) { 504 read_unlock(&hci_dev_list_lock); 505 return -ENOMEM; 506 } 507 508 count = 0; 509 list_for_each_entry(d, &hci_dev_list, list) { 510 if (hci_dev_test_flag(d, HCI_SETUP) || 511 hci_dev_test_flag(d, HCI_CONFIG) || 512 hci_dev_test_flag(d, HCI_USER_CHANNEL)) 513 continue; 514 515 /* Devices marked as raw-only are neither configured 516 * nor unconfigured controllers. 517 */ 518 if (hci_test_quirk(d, HCI_QUIRK_RAW_DEVICE)) 519 continue; 520 521 if (hci_dev_test_flag(d, HCI_UNCONFIGURED)) { 522 rp->index[count++] = cpu_to_le16(d->id); 523 bt_dev_dbg(hdev, "Added hci%u", d->id); 524 } 525 } 526 527 rp->num_controllers = cpu_to_le16(count); 528 rp_len = sizeof(*rp) + (2 * count); 529 530 read_unlock(&hci_dev_list_lock); 531 532 err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE, 533 MGMT_OP_READ_UNCONF_INDEX_LIST, 0, rp, rp_len); 534 535 kfree(rp); 536 537 return err; 538 } 539 540 static int read_ext_index_list(struct sock *sk, struct hci_dev *hdev, 541 void *data, u16 data_len) 542 { 543 struct mgmt_rp_read_ext_index_list *rp; 544 struct hci_dev *d; 545 u16 count; 546 int err; 547 548 bt_dev_dbg(hdev, "sock %p", sk); 549 550 read_lock(&hci_dev_list_lock); 551 552 count = 0; 553 list_for_each_entry(d, &hci_dev_list, list) 554 count++; 555 556 rp = kmalloc_flex(*rp, entry, count, GFP_ATOMIC); 557 if (!rp) { 558 read_unlock(&hci_dev_list_lock); 559 return -ENOMEM; 560 } 561 562 count = 0; 563 list_for_each_entry(d, &hci_dev_list, list) { 564 if (hci_dev_test_flag(d, HCI_SETUP) || 565 hci_dev_test_flag(d, HCI_CONFIG) || 566 hci_dev_test_flag(d, HCI_USER_CHANNEL)) 567 continue; 568 569 /* Devices marked as raw-only are neither configured 570 * nor unconfigured controllers. 571 */ 572 if (hci_test_quirk(d, HCI_QUIRK_RAW_DEVICE)) 573 continue; 574 575 if (hci_dev_test_flag(d, HCI_UNCONFIGURED)) 576 rp->entry[count].type = 0x01; 577 else 578 rp->entry[count].type = 0x00; 579 580 rp->entry[count].bus = d->bus; 581 rp->entry[count++].index = cpu_to_le16(d->id); 582 bt_dev_dbg(hdev, "Added hci%u", d->id); 583 } 584 585 rp->num_controllers = cpu_to_le16(count); 586 587 read_unlock(&hci_dev_list_lock); 588 589 /* If this command is called at least once, then all the 590 * default index and unconfigured index events are disabled 591 * and from now on only extended index events are used. 592 */ 593 hci_sock_set_flag(sk, HCI_MGMT_EXT_INDEX_EVENTS); 594 hci_sock_clear_flag(sk, HCI_MGMT_INDEX_EVENTS); 595 hci_sock_clear_flag(sk, HCI_MGMT_UNCONF_INDEX_EVENTS); 596 597 err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE, 598 MGMT_OP_READ_EXT_INDEX_LIST, 0, rp, 599 struct_size(rp, entry, count)); 600 601 kfree(rp); 602 603 return err; 604 } 605 606 static bool is_configured(struct hci_dev *hdev) 607 { 608 if (hci_test_quirk(hdev, HCI_QUIRK_EXTERNAL_CONFIG) && 609 !hci_dev_test_flag(hdev, HCI_EXT_CONFIGURED)) 610 return false; 611 612 if ((hci_test_quirk(hdev, HCI_QUIRK_INVALID_BDADDR) || 613 hci_test_quirk(hdev, HCI_QUIRK_USE_BDADDR_PROPERTY)) && 614 !bacmp(&hdev->public_addr, BDADDR_ANY)) 615 return false; 616 617 return true; 618 } 619 620 static __le32 get_missing_options(struct hci_dev *hdev) 621 { 622 u32 options = 0; 623 624 if (hci_test_quirk(hdev, HCI_QUIRK_EXTERNAL_CONFIG) && 625 !hci_dev_test_flag(hdev, HCI_EXT_CONFIGURED)) 626 options |= MGMT_OPTION_EXTERNAL_CONFIG; 627 628 if ((hci_test_quirk(hdev, HCI_QUIRK_INVALID_BDADDR) || 629 hci_test_quirk(hdev, HCI_QUIRK_USE_BDADDR_PROPERTY)) && 630 !bacmp(&hdev->public_addr, BDADDR_ANY)) 631 options |= MGMT_OPTION_PUBLIC_ADDRESS; 632 633 return cpu_to_le32(options); 634 } 635 636 static int new_options(struct hci_dev *hdev, struct sock *skip) 637 { 638 __le32 options = get_missing_options(hdev); 639 640 return mgmt_limited_event(MGMT_EV_NEW_CONFIG_OPTIONS, hdev, &options, 641 sizeof(options), HCI_MGMT_OPTION_EVENTS, skip); 642 } 643 644 static int send_options_rsp(struct sock *sk, u16 opcode, struct hci_dev *hdev) 645 { 646 __le32 options = get_missing_options(hdev); 647 648 return mgmt_cmd_complete(sk, hdev->id, opcode, 0, &options, 649 sizeof(options)); 650 } 651 652 static int read_config_info(struct sock *sk, struct hci_dev *hdev, 653 void *data, u16 data_len) 654 { 655 struct mgmt_rp_read_config_info rp; 656 u32 options = 0; 657 658 bt_dev_dbg(hdev, "sock %p", sk); 659 660 hci_dev_lock(hdev); 661 662 memset(&rp, 0, sizeof(rp)); 663 rp.manufacturer = cpu_to_le16(hdev->manufacturer); 664 665 if (hci_test_quirk(hdev, HCI_QUIRK_EXTERNAL_CONFIG)) 666 options |= MGMT_OPTION_EXTERNAL_CONFIG; 667 668 if (hdev->set_bdaddr) 669 options |= MGMT_OPTION_PUBLIC_ADDRESS; 670 671 rp.supported_options = cpu_to_le32(options); 672 rp.missing_options = get_missing_options(hdev); 673 674 hci_dev_unlock(hdev); 675 676 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_CONFIG_INFO, 0, 677 &rp, sizeof(rp)); 678 } 679 680 static u32 get_supported_phys(struct hci_dev *hdev) 681 { 682 u32 supported_phys = 0; 683 684 if (lmp_bredr_capable(hdev)) { 685 supported_phys |= MGMT_PHY_BR_1M_1SLOT; 686 687 if (hdev->features[0][0] & LMP_3SLOT) 688 supported_phys |= MGMT_PHY_BR_1M_3SLOT; 689 690 if (hdev->features[0][0] & LMP_5SLOT) 691 supported_phys |= MGMT_PHY_BR_1M_5SLOT; 692 693 if (lmp_edr_2m_capable(hdev)) { 694 supported_phys |= MGMT_PHY_EDR_2M_1SLOT; 695 696 if (lmp_edr_3slot_capable(hdev)) 697 supported_phys |= MGMT_PHY_EDR_2M_3SLOT; 698 699 if (lmp_edr_5slot_capable(hdev)) 700 supported_phys |= MGMT_PHY_EDR_2M_5SLOT; 701 702 if (lmp_edr_3m_capable(hdev)) { 703 supported_phys |= MGMT_PHY_EDR_3M_1SLOT; 704 705 if (lmp_edr_3slot_capable(hdev)) 706 supported_phys |= MGMT_PHY_EDR_3M_3SLOT; 707 708 if (lmp_edr_5slot_capable(hdev)) 709 supported_phys |= MGMT_PHY_EDR_3M_5SLOT; 710 } 711 } 712 } 713 714 if (lmp_le_capable(hdev)) { 715 supported_phys |= MGMT_PHY_LE_1M_TX; 716 supported_phys |= MGMT_PHY_LE_1M_RX; 717 718 if (hdev->le_features[1] & HCI_LE_PHY_2M) { 719 supported_phys |= MGMT_PHY_LE_2M_TX; 720 supported_phys |= MGMT_PHY_LE_2M_RX; 721 } 722 723 if (hdev->le_features[1] & HCI_LE_PHY_CODED) { 724 supported_phys |= MGMT_PHY_LE_CODED_TX; 725 supported_phys |= MGMT_PHY_LE_CODED_RX; 726 } 727 } 728 729 return supported_phys; 730 } 731 732 static u32 get_selected_phys(struct hci_dev *hdev) 733 { 734 u32 selected_phys = 0; 735 736 if (lmp_bredr_capable(hdev)) { 737 selected_phys |= MGMT_PHY_BR_1M_1SLOT; 738 739 if (hdev->pkt_type & (HCI_DM3 | HCI_DH3)) 740 selected_phys |= MGMT_PHY_BR_1M_3SLOT; 741 742 if (hdev->pkt_type & (HCI_DM5 | HCI_DH5)) 743 selected_phys |= MGMT_PHY_BR_1M_5SLOT; 744 745 if (lmp_edr_2m_capable(hdev)) { 746 if (!(hdev->pkt_type & HCI_2DH1)) 747 selected_phys |= MGMT_PHY_EDR_2M_1SLOT; 748 749 if (lmp_edr_3slot_capable(hdev) && 750 !(hdev->pkt_type & HCI_2DH3)) 751 selected_phys |= MGMT_PHY_EDR_2M_3SLOT; 752 753 if (lmp_edr_5slot_capable(hdev) && 754 !(hdev->pkt_type & HCI_2DH5)) 755 selected_phys |= MGMT_PHY_EDR_2M_5SLOT; 756 757 if (lmp_edr_3m_capable(hdev)) { 758 if (!(hdev->pkt_type & HCI_3DH1)) 759 selected_phys |= MGMT_PHY_EDR_3M_1SLOT; 760 761 if (lmp_edr_3slot_capable(hdev) && 762 !(hdev->pkt_type & HCI_3DH3)) 763 selected_phys |= MGMT_PHY_EDR_3M_3SLOT; 764 765 if (lmp_edr_5slot_capable(hdev) && 766 !(hdev->pkt_type & HCI_3DH5)) 767 selected_phys |= MGMT_PHY_EDR_3M_5SLOT; 768 } 769 } 770 } 771 772 if (lmp_le_capable(hdev)) { 773 if (hdev->le_tx_def_phys & HCI_LE_SET_PHY_1M) 774 selected_phys |= MGMT_PHY_LE_1M_TX; 775 776 if (hdev->le_rx_def_phys & HCI_LE_SET_PHY_1M) 777 selected_phys |= MGMT_PHY_LE_1M_RX; 778 779 if (hdev->le_tx_def_phys & HCI_LE_SET_PHY_2M) 780 selected_phys |= MGMT_PHY_LE_2M_TX; 781 782 if (hdev->le_rx_def_phys & HCI_LE_SET_PHY_2M) 783 selected_phys |= MGMT_PHY_LE_2M_RX; 784 785 if (hdev->le_tx_def_phys & HCI_LE_SET_PHY_CODED) 786 selected_phys |= MGMT_PHY_LE_CODED_TX; 787 788 if (hdev->le_rx_def_phys & HCI_LE_SET_PHY_CODED) 789 selected_phys |= MGMT_PHY_LE_CODED_RX; 790 } 791 792 return selected_phys; 793 } 794 795 static u32 get_configurable_phys(struct hci_dev *hdev) 796 { 797 return (get_supported_phys(hdev) & ~MGMT_PHY_BR_1M_1SLOT & 798 ~MGMT_PHY_LE_1M_TX & ~MGMT_PHY_LE_1M_RX); 799 } 800 801 static u32 get_supported_settings(struct hci_dev *hdev) 802 { 803 u32 settings = 0; 804 805 settings |= MGMT_SETTING_POWERED; 806 settings |= MGMT_SETTING_BONDABLE; 807 settings |= MGMT_SETTING_DEBUG_KEYS; 808 settings |= MGMT_SETTING_CONNECTABLE; 809 settings |= MGMT_SETTING_DISCOVERABLE; 810 811 if (lmp_bredr_capable(hdev)) { 812 if (hdev->hci_ver >= BLUETOOTH_VER_1_2) 813 settings |= MGMT_SETTING_FAST_CONNECTABLE; 814 settings |= MGMT_SETTING_BREDR; 815 settings |= MGMT_SETTING_LINK_SECURITY; 816 817 if (lmp_ssp_capable(hdev)) { 818 settings |= MGMT_SETTING_SSP; 819 } 820 821 if (lmp_sc_capable(hdev)) 822 settings |= MGMT_SETTING_SECURE_CONN; 823 824 if (hci_test_quirk(hdev, HCI_QUIRK_WIDEBAND_SPEECH_SUPPORTED)) 825 settings |= MGMT_SETTING_WIDEBAND_SPEECH; 826 } 827 828 if (lmp_le_capable(hdev)) { 829 settings |= MGMT_SETTING_LE; 830 settings |= MGMT_SETTING_SECURE_CONN; 831 settings |= MGMT_SETTING_PRIVACY; 832 settings |= MGMT_SETTING_STATIC_ADDRESS; 833 settings |= MGMT_SETTING_ADVERTISING; 834 } 835 836 if (hci_test_quirk(hdev, HCI_QUIRK_EXTERNAL_CONFIG) || hdev->set_bdaddr) 837 settings |= MGMT_SETTING_CONFIGURATION; 838 839 if (cis_central_capable(hdev)) 840 settings |= MGMT_SETTING_CIS_CENTRAL; 841 842 if (cis_peripheral_capable(hdev)) 843 settings |= MGMT_SETTING_CIS_PERIPHERAL; 844 845 if (bis_capable(hdev)) 846 settings |= MGMT_SETTING_ISO_BROADCASTER; 847 848 if (sync_recv_capable(hdev)) 849 settings |= MGMT_SETTING_ISO_SYNC_RECEIVER; 850 851 if (ll_privacy_capable(hdev)) 852 settings |= MGMT_SETTING_LL_PRIVACY; 853 854 if (past_sender_capable(hdev)) 855 settings |= MGMT_SETTING_PAST_SENDER; 856 857 if (past_receiver_capable(hdev)) 858 settings |= MGMT_SETTING_PAST_RECEIVER; 859 860 if (le_sci_capable(hdev)) 861 settings |= MGMT_SETTING_SCI; 862 863 settings |= MGMT_SETTING_PHY_CONFIGURATION; 864 865 return settings; 866 } 867 868 static u32 get_current_settings(struct hci_dev *hdev) 869 { 870 u32 settings = 0; 871 872 if (hdev_is_powered(hdev)) 873 settings |= MGMT_SETTING_POWERED; 874 875 if (hci_dev_test_flag(hdev, HCI_CONNECTABLE)) 876 settings |= MGMT_SETTING_CONNECTABLE; 877 878 if (hci_dev_test_flag(hdev, HCI_FAST_CONNECTABLE)) 879 settings |= MGMT_SETTING_FAST_CONNECTABLE; 880 881 if (hci_dev_test_flag(hdev, HCI_DISCOVERABLE)) 882 settings |= MGMT_SETTING_DISCOVERABLE; 883 884 if (hci_dev_test_flag(hdev, HCI_BONDABLE)) 885 settings |= MGMT_SETTING_BONDABLE; 886 887 if (hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) 888 settings |= MGMT_SETTING_BREDR; 889 890 if (hci_dev_test_flag(hdev, HCI_LE_ENABLED)) 891 settings |= MGMT_SETTING_LE; 892 893 if (hci_dev_test_flag(hdev, HCI_LINK_SECURITY)) 894 settings |= MGMT_SETTING_LINK_SECURITY; 895 896 if (hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) 897 settings |= MGMT_SETTING_SSP; 898 899 if (hci_dev_test_flag(hdev, HCI_ADVERTISING)) 900 settings |= MGMT_SETTING_ADVERTISING; 901 902 if (hci_dev_test_flag(hdev, HCI_SC_ENABLED)) 903 settings |= MGMT_SETTING_SECURE_CONN; 904 905 if (hci_dev_test_flag(hdev, HCI_KEEP_DEBUG_KEYS)) 906 settings |= MGMT_SETTING_DEBUG_KEYS; 907 908 if (hci_dev_test_flag(hdev, HCI_PRIVACY)) 909 settings |= MGMT_SETTING_PRIVACY; 910 911 /* The current setting for static address has two purposes. The 912 * first is to indicate if the static address will be used and 913 * the second is to indicate if it is actually set. 914 * 915 * This means if the static address is not configured, this flag 916 * will never be set. If the address is configured, then if the 917 * address is actually used decides if the flag is set or not. 918 * 919 * For single mode LE only controllers and dual-mode controllers 920 * with BR/EDR disabled, the existence of the static address will 921 * be evaluated. 922 */ 923 if (hci_dev_test_flag(hdev, HCI_FORCE_STATIC_ADDR) || 924 !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) || 925 !bacmp(&hdev->bdaddr, BDADDR_ANY)) { 926 if (bacmp(&hdev->static_addr, BDADDR_ANY)) 927 settings |= MGMT_SETTING_STATIC_ADDRESS; 928 } 929 930 if (hci_dev_test_flag(hdev, HCI_WIDEBAND_SPEECH_ENABLED)) 931 settings |= MGMT_SETTING_WIDEBAND_SPEECH; 932 933 if (cis_central_enabled(hdev)) 934 settings |= MGMT_SETTING_CIS_CENTRAL; 935 936 if (cis_peripheral_enabled(hdev)) 937 settings |= MGMT_SETTING_CIS_PERIPHERAL; 938 939 if (bis_enabled(hdev)) 940 settings |= MGMT_SETTING_ISO_BROADCASTER; 941 942 if (sync_recv_enabled(hdev)) 943 settings |= MGMT_SETTING_ISO_SYNC_RECEIVER; 944 945 if (ll_privacy_enabled(hdev)) 946 settings |= MGMT_SETTING_LL_PRIVACY; 947 948 if (past_sender_enabled(hdev)) 949 settings |= MGMT_SETTING_PAST_SENDER; 950 951 if (past_receiver_enabled(hdev)) 952 settings |= MGMT_SETTING_PAST_RECEIVER; 953 954 if (le_sci_enabled(hdev)) 955 settings |= MGMT_SETTING_SCI; 956 957 return settings; 958 } 959 960 static struct mgmt_pending_cmd *pending_find(u16 opcode, struct hci_dev *hdev) 961 { 962 return mgmt_pending_find(HCI_CHANNEL_CONTROL, opcode, hdev); 963 } 964 965 u8 mgmt_get_adv_discov_flags(struct hci_dev *hdev) 966 { 967 struct mgmt_pending_cmd *cmd; 968 969 /* If there's a pending mgmt command the flags will not yet have 970 * their final values, so check for this first. 971 */ 972 cmd = pending_find(MGMT_OP_SET_DISCOVERABLE, hdev); 973 if (cmd) { 974 struct mgmt_mode *cp = cmd->param; 975 if (cp->val == 0x01) 976 return LE_AD_GENERAL; 977 else if (cp->val == 0x02) 978 return LE_AD_LIMITED; 979 } else { 980 if (hci_dev_test_flag(hdev, HCI_LIMITED_DISCOVERABLE)) 981 return LE_AD_LIMITED; 982 else if (hci_dev_test_flag(hdev, HCI_DISCOVERABLE)) 983 return LE_AD_GENERAL; 984 } 985 986 return 0; 987 } 988 989 bool mgmt_get_connectable(struct hci_dev *hdev) 990 { 991 struct mgmt_pending_cmd *cmd; 992 993 /* If there's a pending mgmt command the flag will not yet have 994 * it's final value, so check for this first. 995 */ 996 cmd = pending_find(MGMT_OP_SET_CONNECTABLE, hdev); 997 if (cmd) { 998 struct mgmt_mode *cp = cmd->param; 999 1000 return cp->val; 1001 } 1002 1003 return hci_dev_test_flag(hdev, HCI_CONNECTABLE); 1004 } 1005 1006 static int service_cache_sync(struct hci_dev *hdev, void *data) 1007 { 1008 hci_update_eir_sync(hdev); 1009 hci_update_class_sync(hdev); 1010 1011 return 0; 1012 } 1013 1014 static void service_cache_off(struct work_struct *work) 1015 { 1016 struct hci_dev *hdev = container_of(work, struct hci_dev, 1017 service_cache.work); 1018 1019 if (!hci_dev_test_and_clear_flag(hdev, HCI_SERVICE_CACHE)) 1020 return; 1021 1022 hci_cmd_sync_queue(hdev, service_cache_sync, NULL, NULL); 1023 } 1024 1025 static int rpa_expired_sync(struct hci_dev *hdev, void *data) 1026 { 1027 /* The generation of a new RPA and programming it into the 1028 * controller happens in the hci_req_enable_advertising() 1029 * function. 1030 */ 1031 if (ext_adv_capable(hdev)) 1032 return hci_start_ext_adv_sync(hdev, hdev->cur_adv_instance); 1033 else 1034 return hci_enable_advertising_sync(hdev); 1035 } 1036 1037 static void rpa_expired(struct work_struct *work) 1038 { 1039 struct hci_dev *hdev = container_of(work, struct hci_dev, 1040 rpa_expired.work); 1041 1042 bt_dev_dbg(hdev, ""); 1043 1044 hci_dev_set_flag(hdev, HCI_RPA_EXPIRED); 1045 1046 if (!hci_dev_test_flag(hdev, HCI_ADVERTISING)) 1047 return; 1048 1049 hci_cmd_sync_queue(hdev, rpa_expired_sync, NULL, NULL); 1050 } 1051 1052 static int set_discoverable_sync(struct hci_dev *hdev, void *data); 1053 1054 static void discov_off(struct work_struct *work) 1055 { 1056 struct hci_dev *hdev = container_of(work, struct hci_dev, 1057 discov_off.work); 1058 1059 bt_dev_dbg(hdev, ""); 1060 1061 hci_dev_lock(hdev); 1062 1063 /* When discoverable timeout triggers, then just make sure 1064 * the limited discoverable flag is cleared. Even in the case 1065 * of a timeout triggered from general discoverable, it is 1066 * safe to unconditionally clear the flag. 1067 */ 1068 hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE); 1069 hci_dev_clear_flag(hdev, HCI_DISCOVERABLE); 1070 hdev->discov_timeout = 0; 1071 1072 hci_cmd_sync_queue(hdev, set_discoverable_sync, NULL, NULL); 1073 1074 mgmt_new_settings(hdev); 1075 1076 hci_dev_unlock(hdev); 1077 } 1078 1079 static int send_settings_rsp(struct sock *sk, u16 opcode, struct hci_dev *hdev); 1080 1081 static void mesh_send_complete(struct hci_dev *hdev, 1082 struct mgmt_mesh_tx *mesh_tx, bool silent) 1083 { 1084 u8 handle = mesh_tx->handle; 1085 1086 if (!silent) 1087 mgmt_event(MGMT_EV_MESH_PACKET_CMPLT, hdev, &handle, 1088 sizeof(handle), NULL); 1089 1090 mgmt_mesh_remove(mesh_tx); 1091 } 1092 1093 static int mesh_send_done_sync(struct hci_dev *hdev, void *data) 1094 { 1095 struct mgmt_mesh_tx *mesh_tx; 1096 1097 hci_dev_clear_flag(hdev, HCI_MESH_SENDING); 1098 if (list_empty(&hdev->adv_instances)) 1099 hci_disable_advertising_sync(hdev); 1100 mesh_tx = mgmt_mesh_next(hdev, NULL); 1101 1102 if (mesh_tx) 1103 mesh_send_complete(hdev, mesh_tx, false); 1104 1105 return 0; 1106 } 1107 1108 static int mesh_send_sync(struct hci_dev *hdev, void *data); 1109 static void mesh_send_start_complete(struct hci_dev *hdev, void *data, int err); 1110 static void mesh_next(struct hci_dev *hdev, void *data, int err) 1111 { 1112 struct mgmt_mesh_tx *mesh_tx = mgmt_mesh_next(hdev, NULL); 1113 1114 if (!mesh_tx) 1115 return; 1116 1117 err = hci_cmd_sync_queue(hdev, mesh_send_sync, mesh_tx, 1118 mesh_send_start_complete); 1119 1120 if (err < 0) 1121 mesh_send_complete(hdev, mesh_tx, false); 1122 else 1123 hci_dev_set_flag(hdev, HCI_MESH_SENDING); 1124 } 1125 1126 static void mesh_send_done(struct work_struct *work) 1127 { 1128 struct hci_dev *hdev = container_of(work, struct hci_dev, 1129 mesh_send_done.work); 1130 1131 if (!hci_dev_test_flag(hdev, HCI_MESH_SENDING)) 1132 return; 1133 1134 hci_cmd_sync_queue(hdev, mesh_send_done_sync, NULL, mesh_next); 1135 } 1136 1137 static void mgmt_init_hdev(struct sock *sk, struct hci_dev *hdev) 1138 { 1139 if (hci_dev_test_flag(hdev, HCI_MGMT)) 1140 return; 1141 1142 BT_INFO("MGMT ver %d.%d", MGMT_VERSION, MGMT_REVISION); 1143 1144 INIT_DELAYED_WORK(&hdev->discov_off, discov_off); 1145 INIT_DELAYED_WORK(&hdev->service_cache, service_cache_off); 1146 INIT_DELAYED_WORK(&hdev->rpa_expired, rpa_expired); 1147 INIT_DELAYED_WORK(&hdev->mesh_send_done, mesh_send_done); 1148 1149 /* Non-mgmt controlled devices get this bit set 1150 * implicitly so that pairing works for them, however 1151 * for mgmt we require user-space to explicitly enable 1152 * it 1153 */ 1154 hci_dev_clear_flag(hdev, HCI_BONDABLE); 1155 1156 hci_dev_set_flag(hdev, HCI_MGMT); 1157 } 1158 1159 static int read_controller_info(struct sock *sk, struct hci_dev *hdev, 1160 void *data, u16 data_len) 1161 { 1162 struct mgmt_rp_read_info rp; 1163 1164 bt_dev_dbg(hdev, "sock %p", sk); 1165 1166 hci_dev_lock(hdev); 1167 1168 memset(&rp, 0, sizeof(rp)); 1169 1170 bacpy(&rp.bdaddr, &hdev->bdaddr); 1171 1172 rp.version = hdev->hci_ver; 1173 rp.manufacturer = cpu_to_le16(hdev->manufacturer); 1174 1175 rp.supported_settings = cpu_to_le32(get_supported_settings(hdev)); 1176 rp.current_settings = cpu_to_le32(get_current_settings(hdev)); 1177 1178 memcpy(rp.dev_class, hdev->dev_class, 3); 1179 1180 memcpy(rp.name, hdev->dev_name, sizeof(hdev->dev_name)); 1181 memcpy(rp.short_name, hdev->short_name, sizeof(hdev->short_name)); 1182 1183 hci_dev_unlock(hdev); 1184 1185 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_INFO, 0, &rp, 1186 sizeof(rp)); 1187 } 1188 1189 static u16 append_eir_data_to_buf(struct hci_dev *hdev, u8 *eir) 1190 { 1191 u16 eir_len = 0; 1192 size_t name_len; 1193 1194 if (hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) 1195 eir_len = eir_append_data(eir, eir_len, EIR_CLASS_OF_DEV, 1196 hdev->dev_class, 3); 1197 1198 if (hci_dev_test_flag(hdev, HCI_LE_ENABLED)) 1199 eir_len = eir_append_le16(eir, eir_len, EIR_APPEARANCE, 1200 hdev->appearance); 1201 1202 name_len = strnlen(hdev->dev_name, sizeof(hdev->dev_name)); 1203 eir_len = eir_append_data(eir, eir_len, EIR_NAME_COMPLETE, 1204 hdev->dev_name, name_len); 1205 1206 name_len = strnlen(hdev->short_name, sizeof(hdev->short_name)); 1207 eir_len = eir_append_data(eir, eir_len, EIR_NAME_SHORT, 1208 hdev->short_name, name_len); 1209 1210 return eir_len; 1211 } 1212 1213 static int read_ext_controller_info(struct sock *sk, struct hci_dev *hdev, 1214 void *data, u16 data_len) 1215 { 1216 char buf[512]; 1217 struct mgmt_rp_read_ext_info *rp = (void *)buf; 1218 u16 eir_len; 1219 1220 bt_dev_dbg(hdev, "sock %p", sk); 1221 1222 memset(&buf, 0, sizeof(buf)); 1223 1224 hci_dev_lock(hdev); 1225 1226 bacpy(&rp->bdaddr, &hdev->bdaddr); 1227 1228 rp->version = hdev->hci_ver; 1229 rp->manufacturer = cpu_to_le16(hdev->manufacturer); 1230 1231 rp->supported_settings = cpu_to_le32(get_supported_settings(hdev)); 1232 rp->current_settings = cpu_to_le32(get_current_settings(hdev)); 1233 1234 1235 eir_len = append_eir_data_to_buf(hdev, rp->eir); 1236 rp->eir_len = cpu_to_le16(eir_len); 1237 1238 hci_dev_unlock(hdev); 1239 1240 /* If this command is called at least once, then the events 1241 * for class of device and local name changes are disabled 1242 * and only the new extended controller information event 1243 * is used. 1244 */ 1245 hci_sock_set_flag(sk, HCI_MGMT_EXT_INFO_EVENTS); 1246 hci_sock_clear_flag(sk, HCI_MGMT_DEV_CLASS_EVENTS); 1247 hci_sock_clear_flag(sk, HCI_MGMT_LOCAL_NAME_EVENTS); 1248 1249 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_EXT_INFO, 0, rp, 1250 sizeof(*rp) + eir_len); 1251 } 1252 1253 static int ext_info_changed(struct hci_dev *hdev, struct sock *skip) 1254 { 1255 char buf[512]; 1256 struct mgmt_ev_ext_info_changed *ev = (void *)buf; 1257 u16 eir_len; 1258 1259 memset(buf, 0, sizeof(buf)); 1260 1261 eir_len = append_eir_data_to_buf(hdev, ev->eir); 1262 ev->eir_len = cpu_to_le16(eir_len); 1263 1264 return mgmt_limited_event(MGMT_EV_EXT_INFO_CHANGED, hdev, ev, 1265 sizeof(*ev) + eir_len, 1266 HCI_MGMT_EXT_INFO_EVENTS, skip); 1267 } 1268 1269 static int send_settings_rsp(struct sock *sk, u16 opcode, struct hci_dev *hdev) 1270 { 1271 __le32 settings = cpu_to_le32(get_current_settings(hdev)); 1272 1273 return mgmt_cmd_complete(sk, hdev->id, opcode, 0, &settings, 1274 sizeof(settings)); 1275 } 1276 1277 void mgmt_advertising_added(struct sock *sk, struct hci_dev *hdev, u8 instance) 1278 { 1279 struct mgmt_ev_advertising_added ev; 1280 1281 ev.instance = instance; 1282 1283 mgmt_event(MGMT_EV_ADVERTISING_ADDED, hdev, &ev, sizeof(ev), sk); 1284 } 1285 1286 void mgmt_advertising_removed(struct sock *sk, struct hci_dev *hdev, 1287 u8 instance) 1288 { 1289 struct mgmt_ev_advertising_removed ev; 1290 1291 ev.instance = instance; 1292 1293 mgmt_event(MGMT_EV_ADVERTISING_REMOVED, hdev, &ev, sizeof(ev), sk); 1294 } 1295 1296 static void cancel_adv_timeout(struct hci_dev *hdev) 1297 { 1298 if (hdev->adv_instance_timeout) { 1299 hdev->adv_instance_timeout = 0; 1300 cancel_delayed_work(&hdev->adv_instance_expire); 1301 } 1302 } 1303 1304 /* This function requires the caller holds hdev->lock */ 1305 static void restart_le_actions(struct hci_dev *hdev) 1306 { 1307 struct hci_conn_params *p; 1308 1309 list_for_each_entry(p, &hdev->le_conn_params, list) { 1310 /* Needed for AUTO_OFF case where might not "really" 1311 * have been powered off. 1312 */ 1313 hci_pend_le_list_del_init(p); 1314 1315 switch (p->auto_connect) { 1316 case HCI_AUTO_CONN_DIRECT: 1317 case HCI_AUTO_CONN_ALWAYS: 1318 hci_pend_le_list_add(p, &hdev->pend_le_conns); 1319 break; 1320 case HCI_AUTO_CONN_REPORT: 1321 hci_pend_le_list_add(p, &hdev->pend_le_reports); 1322 break; 1323 default: 1324 break; 1325 } 1326 } 1327 } 1328 1329 static int new_settings(struct hci_dev *hdev, struct sock *skip) 1330 { 1331 __le32 ev = cpu_to_le32(get_current_settings(hdev)); 1332 1333 return mgmt_limited_event(MGMT_EV_NEW_SETTINGS, hdev, &ev, 1334 sizeof(ev), HCI_MGMT_SETTING_EVENTS, skip); 1335 } 1336 1337 static void mgmt_set_powered_complete(struct hci_dev *hdev, void *data, int err) 1338 { 1339 struct mgmt_pending_cmd *cmd = data; 1340 struct mgmt_mode *cp; 1341 1342 /* Make sure cmd still outstanding. */ 1343 if (err == -ECANCELED || !mgmt_pending_valid(hdev, cmd)) 1344 return; 1345 1346 cp = cmd->param; 1347 1348 bt_dev_dbg(hdev, "err %d", err); 1349 1350 if (!err) { 1351 if (cp->val) { 1352 hci_dev_lock(hdev); 1353 restart_le_actions(hdev); 1354 hci_update_passive_scan(hdev); 1355 hci_dev_unlock(hdev); 1356 } 1357 1358 send_settings_rsp(cmd->sk, cmd->opcode, hdev); 1359 1360 /* Only call new_setting for power on as power off is deferred 1361 * to hdev->power_off work which does call hci_dev_do_close. 1362 */ 1363 if (cp->val) 1364 new_settings(hdev, cmd->sk); 1365 } else { 1366 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_POWERED, 1367 mgmt_status(err)); 1368 } 1369 1370 mgmt_pending_free(cmd); 1371 } 1372 1373 static int set_powered_sync(struct hci_dev *hdev, void *data) 1374 { 1375 struct mgmt_pending_cmd *cmd = data; 1376 struct mgmt_mode cp; 1377 1378 mutex_lock(&hdev->mgmt_pending_lock); 1379 1380 /* Make sure cmd still outstanding. */ 1381 if (!__mgmt_pending_listed(hdev, cmd)) { 1382 mutex_unlock(&hdev->mgmt_pending_lock); 1383 return -ECANCELED; 1384 } 1385 1386 memcpy(&cp, cmd->param, sizeof(cp)); 1387 1388 mutex_unlock(&hdev->mgmt_pending_lock); 1389 1390 BT_DBG("%s", hdev->name); 1391 1392 return hci_set_powered_sync(hdev, cp.val); 1393 } 1394 1395 static int set_powered(struct sock *sk, struct hci_dev *hdev, void *data, 1396 u16 len) 1397 { 1398 struct mgmt_mode *cp = data; 1399 struct mgmt_pending_cmd *cmd; 1400 int err; 1401 1402 bt_dev_dbg(hdev, "sock %p", sk); 1403 1404 if (cp->val != 0x00 && cp->val != 0x01) 1405 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED, 1406 MGMT_STATUS_INVALID_PARAMS); 1407 1408 hci_dev_lock(hdev); 1409 1410 if (!cp->val) { 1411 if (hci_dev_test_flag(hdev, HCI_POWERING_DOWN)) { 1412 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED, 1413 MGMT_STATUS_BUSY); 1414 goto failed; 1415 } 1416 } 1417 1418 if (pending_find(MGMT_OP_SET_POWERED, hdev)) { 1419 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED, 1420 MGMT_STATUS_BUSY); 1421 goto failed; 1422 } 1423 1424 if (!!cp->val == hdev_is_powered(hdev)) { 1425 err = send_settings_rsp(sk, MGMT_OP_SET_POWERED, hdev); 1426 goto failed; 1427 } 1428 1429 cmd = mgmt_pending_add(sk, MGMT_OP_SET_POWERED, hdev, data, len); 1430 if (!cmd) { 1431 err = -ENOMEM; 1432 goto failed; 1433 } 1434 1435 /* Cancel potentially blocking sync operation before power off */ 1436 if (cp->val == 0x00) { 1437 hci_cmd_sync_cancel_sync(hdev, -EHOSTDOWN); 1438 err = hci_cmd_sync_queue(hdev, set_powered_sync, cmd, 1439 mgmt_set_powered_complete); 1440 } else { 1441 /* Use hci_cmd_sync_submit since hdev might not be running */ 1442 err = hci_cmd_sync_submit(hdev, set_powered_sync, cmd, 1443 mgmt_set_powered_complete); 1444 } 1445 1446 if (err < 0) 1447 mgmt_pending_remove(cmd); 1448 1449 failed: 1450 hci_dev_unlock(hdev); 1451 return err; 1452 } 1453 1454 int mgmt_new_settings(struct hci_dev *hdev) 1455 { 1456 return new_settings(hdev, NULL); 1457 } 1458 1459 struct cmd_lookup { 1460 struct sock *sk; 1461 struct hci_dev *hdev; 1462 u8 mgmt_status; 1463 }; 1464 1465 static void settings_rsp(struct mgmt_pending_cmd *cmd, void *data) 1466 { 1467 struct cmd_lookup *match = data; 1468 1469 send_settings_rsp(cmd->sk, cmd->opcode, match->hdev); 1470 1471 if (match->sk == NULL) { 1472 match->sk = cmd->sk; 1473 sock_hold(match->sk); 1474 } 1475 } 1476 1477 static void cmd_status_rsp(struct mgmt_pending_cmd *cmd, void *data) 1478 { 1479 u8 *status = data; 1480 1481 mgmt_cmd_status(cmd->sk, cmd->hdev->id, cmd->opcode, *status); 1482 } 1483 1484 static void cmd_complete_rsp(struct mgmt_pending_cmd *cmd, void *data) 1485 { 1486 struct cmd_lookup *match = data; 1487 1488 /* dequeue cmd_sync entries using cmd as data as that is about to be 1489 * removed/freed. 1490 */ 1491 hci_cmd_sync_dequeue(match->hdev, NULL, cmd, NULL); 1492 1493 if (cmd->cmd_complete) { 1494 cmd->cmd_complete(cmd, match->mgmt_status); 1495 return; 1496 } 1497 1498 cmd_status_rsp(cmd, data); 1499 } 1500 1501 static int generic_cmd_complete(struct mgmt_pending_cmd *cmd, u8 status) 1502 { 1503 return mgmt_cmd_complete(cmd->sk, cmd->hdev->id, cmd->opcode, status, 1504 cmd->param, cmd->param_len); 1505 } 1506 1507 static int addr_cmd_complete(struct mgmt_pending_cmd *cmd, u8 status) 1508 { 1509 return mgmt_cmd_complete(cmd->sk, cmd->hdev->id, cmd->opcode, status, 1510 cmd->param, sizeof(struct mgmt_addr_info)); 1511 } 1512 1513 static u8 mgmt_bredr_support(struct hci_dev *hdev) 1514 { 1515 if (!lmp_bredr_capable(hdev)) 1516 return MGMT_STATUS_NOT_SUPPORTED; 1517 else if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) 1518 return MGMT_STATUS_REJECTED; 1519 else 1520 return MGMT_STATUS_SUCCESS; 1521 } 1522 1523 static u8 mgmt_le_support(struct hci_dev *hdev) 1524 { 1525 if (!lmp_le_capable(hdev)) 1526 return MGMT_STATUS_NOT_SUPPORTED; 1527 else if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED)) 1528 return MGMT_STATUS_REJECTED; 1529 else 1530 return MGMT_STATUS_SUCCESS; 1531 } 1532 1533 static void mgmt_set_discoverable_complete(struct hci_dev *hdev, void *data, 1534 int err) 1535 { 1536 struct mgmt_pending_cmd *cmd = data; 1537 1538 bt_dev_dbg(hdev, "err %d", err); 1539 1540 /* Make sure cmd still outstanding. */ 1541 if (err == -ECANCELED || !mgmt_pending_valid(hdev, cmd)) 1542 return; 1543 1544 hci_dev_lock(hdev); 1545 1546 if (err) { 1547 u8 mgmt_err = mgmt_status(err); 1548 mgmt_cmd_status(cmd->sk, cmd->hdev->id, cmd->opcode, mgmt_err); 1549 hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE); 1550 goto done; 1551 } 1552 1553 if (hci_dev_test_flag(hdev, HCI_DISCOVERABLE) && 1554 hdev->discov_timeout > 0) { 1555 int to = secs_to_jiffies(hdev->discov_timeout); 1556 queue_delayed_work(hdev->req_workqueue, &hdev->discov_off, to); 1557 } 1558 1559 send_settings_rsp(cmd->sk, MGMT_OP_SET_DISCOVERABLE, hdev); 1560 new_settings(hdev, cmd->sk); 1561 1562 done: 1563 mgmt_pending_free(cmd); 1564 hci_dev_unlock(hdev); 1565 } 1566 1567 static int set_discoverable_sync(struct hci_dev *hdev, void *data) 1568 { 1569 if (!mgmt_pending_listed(hdev, data)) 1570 return -ECANCELED; 1571 1572 BT_DBG("%s", hdev->name); 1573 1574 return hci_update_discoverable_sync(hdev); 1575 } 1576 1577 static int set_discoverable(struct sock *sk, struct hci_dev *hdev, void *data, 1578 u16 len) 1579 { 1580 struct mgmt_cp_set_discoverable *cp = data; 1581 struct mgmt_pending_cmd *cmd; 1582 u16 timeout; 1583 int err; 1584 1585 bt_dev_dbg(hdev, "sock %p", sk); 1586 1587 if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED) && 1588 !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) 1589 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE, 1590 MGMT_STATUS_REJECTED); 1591 1592 if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02) 1593 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE, 1594 MGMT_STATUS_INVALID_PARAMS); 1595 1596 timeout = __le16_to_cpu(cp->timeout); 1597 1598 /* Disabling discoverable requires that no timeout is set, 1599 * and enabling limited discoverable requires a timeout. 1600 */ 1601 if ((cp->val == 0x00 && timeout > 0) || 1602 (cp->val == 0x02 && timeout == 0)) 1603 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE, 1604 MGMT_STATUS_INVALID_PARAMS); 1605 1606 hci_dev_lock(hdev); 1607 1608 if (!hdev_is_powered(hdev) && timeout > 0) { 1609 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE, 1610 MGMT_STATUS_NOT_POWERED); 1611 goto failed; 1612 } 1613 1614 if (pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) || 1615 pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) { 1616 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE, 1617 MGMT_STATUS_BUSY); 1618 goto failed; 1619 } 1620 1621 if (!hci_dev_test_flag(hdev, HCI_CONNECTABLE)) { 1622 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE, 1623 MGMT_STATUS_REJECTED); 1624 goto failed; 1625 } 1626 1627 if (hdev->advertising_paused) { 1628 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE, 1629 MGMT_STATUS_BUSY); 1630 goto failed; 1631 } 1632 1633 if (!hdev_is_powered(hdev)) { 1634 bool changed = false; 1635 1636 /* Setting limited discoverable when powered off is 1637 * not a valid operation since it requires a timeout 1638 * and so no need to check HCI_LIMITED_DISCOVERABLE. 1639 */ 1640 if (!!cp->val != hci_dev_test_flag(hdev, HCI_DISCOVERABLE)) { 1641 hci_dev_change_flag(hdev, HCI_DISCOVERABLE); 1642 changed = true; 1643 } 1644 1645 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev); 1646 if (err < 0) 1647 goto failed; 1648 1649 if (changed) 1650 err = new_settings(hdev, sk); 1651 1652 goto failed; 1653 } 1654 1655 /* If the current mode is the same, then just update the timeout 1656 * value with the new value. And if only the timeout gets updated, 1657 * then no need for any HCI transactions. 1658 */ 1659 if (!!cp->val == hci_dev_test_flag(hdev, HCI_DISCOVERABLE) && 1660 (cp->val == 0x02) == hci_dev_test_flag(hdev, 1661 HCI_LIMITED_DISCOVERABLE)) { 1662 cancel_delayed_work(&hdev->discov_off); 1663 hdev->discov_timeout = timeout; 1664 1665 if (cp->val && hdev->discov_timeout > 0) { 1666 int to = secs_to_jiffies(hdev->discov_timeout); 1667 queue_delayed_work(hdev->req_workqueue, 1668 &hdev->discov_off, to); 1669 } 1670 1671 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev); 1672 goto failed; 1673 } 1674 1675 cmd = mgmt_pending_add(sk, MGMT_OP_SET_DISCOVERABLE, hdev, data, len); 1676 if (!cmd) { 1677 err = -ENOMEM; 1678 goto failed; 1679 } 1680 1681 /* Cancel any potential discoverable timeout that might be 1682 * still active and store new timeout value. The arming of 1683 * the timeout happens in the complete handler. 1684 */ 1685 cancel_delayed_work(&hdev->discov_off); 1686 hdev->discov_timeout = timeout; 1687 1688 if (cp->val) 1689 hci_dev_set_flag(hdev, HCI_DISCOVERABLE); 1690 else 1691 hci_dev_clear_flag(hdev, HCI_DISCOVERABLE); 1692 1693 /* Limited discoverable mode */ 1694 if (cp->val == 0x02) 1695 hci_dev_set_flag(hdev, HCI_LIMITED_DISCOVERABLE); 1696 else 1697 hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE); 1698 1699 err = hci_cmd_sync_queue(hdev, set_discoverable_sync, cmd, 1700 mgmt_set_discoverable_complete); 1701 1702 if (err < 0) 1703 mgmt_pending_remove(cmd); 1704 1705 failed: 1706 hci_dev_unlock(hdev); 1707 return err; 1708 } 1709 1710 static void mgmt_set_connectable_complete(struct hci_dev *hdev, void *data, 1711 int err) 1712 { 1713 struct mgmt_pending_cmd *cmd = data; 1714 1715 bt_dev_dbg(hdev, "err %d", err); 1716 1717 /* Make sure cmd still outstanding. */ 1718 if (err == -ECANCELED || !mgmt_pending_valid(hdev, cmd)) 1719 return; 1720 1721 hci_dev_lock(hdev); 1722 1723 if (err) { 1724 u8 mgmt_err = mgmt_status(err); 1725 mgmt_cmd_status(cmd->sk, cmd->hdev->id, cmd->opcode, mgmt_err); 1726 goto done; 1727 } 1728 1729 send_settings_rsp(cmd->sk, MGMT_OP_SET_CONNECTABLE, hdev); 1730 new_settings(hdev, cmd->sk); 1731 1732 done: 1733 mgmt_pending_free(cmd); 1734 1735 hci_dev_unlock(hdev); 1736 } 1737 1738 static int set_connectable_update_settings(struct hci_dev *hdev, 1739 struct sock *sk, u8 val) 1740 { 1741 bool changed = false; 1742 int err; 1743 1744 if (!!val != hci_dev_test_flag(hdev, HCI_CONNECTABLE)) 1745 changed = true; 1746 1747 if (val) { 1748 hci_dev_set_flag(hdev, HCI_CONNECTABLE); 1749 } else { 1750 hci_dev_clear_flag(hdev, HCI_CONNECTABLE); 1751 hci_dev_clear_flag(hdev, HCI_DISCOVERABLE); 1752 } 1753 1754 err = send_settings_rsp(sk, MGMT_OP_SET_CONNECTABLE, hdev); 1755 if (err < 0) 1756 return err; 1757 1758 if (changed) { 1759 hci_update_scan(hdev); 1760 hci_update_passive_scan(hdev); 1761 return new_settings(hdev, sk); 1762 } 1763 1764 return 0; 1765 } 1766 1767 static int set_connectable_sync(struct hci_dev *hdev, void *data) 1768 { 1769 if (!mgmt_pending_listed(hdev, data)) 1770 return -ECANCELED; 1771 1772 BT_DBG("%s", hdev->name); 1773 1774 return hci_update_connectable_sync(hdev); 1775 } 1776 1777 static int set_connectable(struct sock *sk, struct hci_dev *hdev, void *data, 1778 u16 len) 1779 { 1780 struct mgmt_mode *cp = data; 1781 struct mgmt_pending_cmd *cmd; 1782 int err; 1783 1784 bt_dev_dbg(hdev, "sock %p", sk); 1785 1786 if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED) && 1787 !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) 1788 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE, 1789 MGMT_STATUS_REJECTED); 1790 1791 if (cp->val != 0x00 && cp->val != 0x01) 1792 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE, 1793 MGMT_STATUS_INVALID_PARAMS); 1794 1795 hci_dev_lock(hdev); 1796 1797 if (!hdev_is_powered(hdev)) { 1798 err = set_connectable_update_settings(hdev, sk, cp->val); 1799 goto failed; 1800 } 1801 1802 if (pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) || 1803 pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) { 1804 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE, 1805 MGMT_STATUS_BUSY); 1806 goto failed; 1807 } 1808 1809 cmd = mgmt_pending_add(sk, MGMT_OP_SET_CONNECTABLE, hdev, data, len); 1810 if (!cmd) { 1811 err = -ENOMEM; 1812 goto failed; 1813 } 1814 1815 if (cp->val) { 1816 hci_dev_set_flag(hdev, HCI_CONNECTABLE); 1817 } else { 1818 if (hdev->discov_timeout > 0) 1819 cancel_delayed_work(&hdev->discov_off); 1820 1821 hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE); 1822 hci_dev_clear_flag(hdev, HCI_DISCOVERABLE); 1823 hci_dev_clear_flag(hdev, HCI_CONNECTABLE); 1824 } 1825 1826 err = hci_cmd_sync_queue(hdev, set_connectable_sync, cmd, 1827 mgmt_set_connectable_complete); 1828 1829 if (err < 0) 1830 mgmt_pending_remove(cmd); 1831 1832 failed: 1833 hci_dev_unlock(hdev); 1834 return err; 1835 } 1836 1837 static int set_bondable(struct sock *sk, struct hci_dev *hdev, void *data, 1838 u16 len) 1839 { 1840 struct mgmt_mode *cp = data; 1841 bool changed; 1842 int err; 1843 1844 bt_dev_dbg(hdev, "sock %p", sk); 1845 1846 if (cp->val != 0x00 && cp->val != 0x01) 1847 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BONDABLE, 1848 MGMT_STATUS_INVALID_PARAMS); 1849 1850 hci_dev_lock(hdev); 1851 1852 if (cp->val) 1853 changed = !hci_dev_test_and_set_flag(hdev, HCI_BONDABLE); 1854 else 1855 changed = hci_dev_test_and_clear_flag(hdev, HCI_BONDABLE); 1856 1857 err = send_settings_rsp(sk, MGMT_OP_SET_BONDABLE, hdev); 1858 if (err < 0) 1859 goto unlock; 1860 1861 if (changed) { 1862 /* In limited privacy mode the change of bondable mode 1863 * may affect the local advertising address. 1864 */ 1865 hci_update_discoverable(hdev); 1866 1867 err = new_settings(hdev, sk); 1868 } 1869 1870 unlock: 1871 hci_dev_unlock(hdev); 1872 return err; 1873 } 1874 1875 static int set_link_security(struct sock *sk, struct hci_dev *hdev, void *data, 1876 u16 len) 1877 { 1878 struct mgmt_mode *cp = data; 1879 struct mgmt_pending_cmd *cmd; 1880 u8 val, status; 1881 int err; 1882 1883 bt_dev_dbg(hdev, "sock %p", sk); 1884 1885 status = mgmt_bredr_support(hdev); 1886 if (status) 1887 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY, 1888 status); 1889 1890 if (cp->val != 0x00 && cp->val != 0x01) 1891 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY, 1892 MGMT_STATUS_INVALID_PARAMS); 1893 1894 hci_dev_lock(hdev); 1895 1896 if (!hdev_is_powered(hdev)) { 1897 bool changed = false; 1898 1899 if (!!cp->val != hci_dev_test_flag(hdev, HCI_LINK_SECURITY)) { 1900 hci_dev_change_flag(hdev, HCI_LINK_SECURITY); 1901 changed = true; 1902 } 1903 1904 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev); 1905 if (err < 0) 1906 goto failed; 1907 1908 if (changed) 1909 err = new_settings(hdev, sk); 1910 1911 goto failed; 1912 } 1913 1914 if (pending_find(MGMT_OP_SET_LINK_SECURITY, hdev)) { 1915 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY, 1916 MGMT_STATUS_BUSY); 1917 goto failed; 1918 } 1919 1920 val = !!cp->val; 1921 1922 if (test_bit(HCI_AUTH, &hdev->flags) == val) { 1923 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev); 1924 goto failed; 1925 } 1926 1927 cmd = mgmt_pending_add(sk, MGMT_OP_SET_LINK_SECURITY, hdev, data, len); 1928 if (!cmd) { 1929 err = -ENOMEM; 1930 goto failed; 1931 } 1932 1933 err = hci_send_cmd(hdev, HCI_OP_WRITE_AUTH_ENABLE, sizeof(val), &val); 1934 if (err < 0) { 1935 mgmt_pending_remove(cmd); 1936 goto failed; 1937 } 1938 1939 failed: 1940 hci_dev_unlock(hdev); 1941 return err; 1942 } 1943 1944 static void set_ssp_complete(struct hci_dev *hdev, void *data, int err) 1945 { 1946 struct cmd_lookup match = { NULL, hdev }; 1947 struct mgmt_pending_cmd *cmd = data; 1948 struct mgmt_mode *cp; 1949 u8 enable; 1950 bool changed; 1951 1952 /* Make sure cmd still outstanding. */ 1953 if (err == -ECANCELED || !mgmt_pending_valid(hdev, cmd)) 1954 return; 1955 1956 cp = cmd->param; 1957 enable = cp->val; 1958 1959 if (err) { 1960 u8 mgmt_err = mgmt_status(err); 1961 1962 if (enable && hci_dev_test_and_clear_flag(hdev, 1963 HCI_SSP_ENABLED)) { 1964 new_settings(hdev, NULL); 1965 } 1966 1967 mgmt_cmd_status(cmd->sk, cmd->hdev->id, cmd->opcode, mgmt_err); 1968 mgmt_pending_free(cmd); 1969 return; 1970 } 1971 1972 if (enable) { 1973 changed = !hci_dev_test_and_set_flag(hdev, HCI_SSP_ENABLED); 1974 } else { 1975 changed = hci_dev_test_and_clear_flag(hdev, HCI_SSP_ENABLED); 1976 } 1977 1978 settings_rsp(cmd, &match); 1979 1980 if (changed) 1981 new_settings(hdev, match.sk); 1982 1983 if (match.sk) 1984 sock_put(match.sk); 1985 1986 hci_update_eir_sync(hdev); 1987 mgmt_pending_free(cmd); 1988 } 1989 1990 static int set_ssp_sync(struct hci_dev *hdev, void *data) 1991 { 1992 struct mgmt_pending_cmd *cmd = data; 1993 struct mgmt_mode cp; 1994 bool changed = false; 1995 int err; 1996 1997 mutex_lock(&hdev->mgmt_pending_lock); 1998 1999 if (!__mgmt_pending_listed(hdev, cmd)) { 2000 mutex_unlock(&hdev->mgmt_pending_lock); 2001 return -ECANCELED; 2002 } 2003 2004 memcpy(&cp, cmd->param, sizeof(cp)); 2005 2006 mutex_unlock(&hdev->mgmt_pending_lock); 2007 2008 if (cp.val) 2009 changed = !hci_dev_test_and_set_flag(hdev, HCI_SSP_ENABLED); 2010 2011 err = hci_write_ssp_mode_sync(hdev, cp.val); 2012 2013 if (!err && changed) 2014 hci_dev_clear_flag(hdev, HCI_SSP_ENABLED); 2015 2016 return err; 2017 } 2018 2019 static int set_ssp(struct sock *sk, struct hci_dev *hdev, void *data, u16 len) 2020 { 2021 struct mgmt_mode *cp = data; 2022 struct mgmt_pending_cmd *cmd; 2023 u8 status; 2024 int err; 2025 2026 bt_dev_dbg(hdev, "sock %p", sk); 2027 2028 status = mgmt_bredr_support(hdev); 2029 if (status) 2030 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP, status); 2031 2032 if (!lmp_ssp_capable(hdev)) 2033 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP, 2034 MGMT_STATUS_NOT_SUPPORTED); 2035 2036 if (cp->val != 0x00 && cp->val != 0x01) 2037 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP, 2038 MGMT_STATUS_INVALID_PARAMS); 2039 2040 hci_dev_lock(hdev); 2041 2042 if (!hdev_is_powered(hdev)) { 2043 bool changed; 2044 2045 if (cp->val) { 2046 changed = !hci_dev_test_and_set_flag(hdev, 2047 HCI_SSP_ENABLED); 2048 } else { 2049 changed = hci_dev_test_and_clear_flag(hdev, 2050 HCI_SSP_ENABLED); 2051 } 2052 2053 err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev); 2054 if (err < 0) 2055 goto failed; 2056 2057 if (changed) 2058 err = new_settings(hdev, sk); 2059 2060 goto failed; 2061 } 2062 2063 if (pending_find(MGMT_OP_SET_SSP, hdev)) { 2064 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP, 2065 MGMT_STATUS_BUSY); 2066 goto failed; 2067 } 2068 2069 if (!!cp->val == hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) { 2070 err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev); 2071 goto failed; 2072 } 2073 2074 cmd = mgmt_pending_add(sk, MGMT_OP_SET_SSP, hdev, data, len); 2075 if (!cmd) 2076 err = -ENOMEM; 2077 else 2078 err = hci_cmd_sync_queue(hdev, set_ssp_sync, cmd, 2079 set_ssp_complete); 2080 2081 if (err < 0) { 2082 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP, 2083 MGMT_STATUS_FAILED); 2084 2085 if (cmd) 2086 mgmt_pending_remove(cmd); 2087 } 2088 2089 failed: 2090 hci_dev_unlock(hdev); 2091 return err; 2092 } 2093 2094 static int set_hs(struct sock *sk, struct hci_dev *hdev, void *data, u16 len) 2095 { 2096 bt_dev_dbg(hdev, "sock %p", sk); 2097 2098 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS, 2099 MGMT_STATUS_NOT_SUPPORTED); 2100 } 2101 2102 static void set_le_complete(struct hci_dev *hdev, void *data, int err) 2103 { 2104 struct mgmt_pending_cmd *cmd = data; 2105 struct cmd_lookup match = { NULL, hdev }; 2106 u8 status = mgmt_status(err); 2107 2108 bt_dev_dbg(hdev, "err %d", err); 2109 2110 if (err == -ECANCELED || !mgmt_pending_valid(hdev, data)) 2111 return; 2112 2113 if (status) { 2114 mgmt_cmd_status(cmd->sk, cmd->hdev->id, cmd->opcode, status); 2115 goto done; 2116 } 2117 2118 settings_rsp(cmd, &match); 2119 2120 new_settings(hdev, match.sk); 2121 2122 if (match.sk) 2123 sock_put(match.sk); 2124 2125 done: 2126 mgmt_pending_free(cmd); 2127 } 2128 2129 static int set_le_sync(struct hci_dev *hdev, void *data) 2130 { 2131 struct mgmt_pending_cmd *cmd = data; 2132 struct mgmt_mode cp; 2133 u8 val; 2134 int err; 2135 2136 mutex_lock(&hdev->mgmt_pending_lock); 2137 2138 if (!__mgmt_pending_listed(hdev, cmd)) { 2139 mutex_unlock(&hdev->mgmt_pending_lock); 2140 return -ECANCELED; 2141 } 2142 2143 memcpy(&cp, cmd->param, sizeof(cp)); 2144 val = !!cp.val; 2145 2146 mutex_unlock(&hdev->mgmt_pending_lock); 2147 2148 if (!val) { 2149 hci_clear_adv_instance_sync(hdev, NULL, 0x00, true); 2150 2151 if (hci_dev_test_flag(hdev, HCI_LE_ADV)) 2152 hci_disable_advertising_sync(hdev); 2153 2154 if (ext_adv_capable(hdev)) 2155 hci_remove_ext_adv_instance_sync(hdev, 0, cmd->sk); 2156 } else { 2157 hci_dev_set_flag(hdev, HCI_LE_ENABLED); 2158 } 2159 2160 err = hci_write_le_host_supported_sync(hdev, val, 0); 2161 2162 /* Make sure the controller has a good default for 2163 * advertising data. Restrict the update to when LE 2164 * has actually been enabled. During power on, the 2165 * update in powered_update_hci will take care of it. 2166 */ 2167 if (!err && hci_dev_test_flag(hdev, HCI_LE_ENABLED)) { 2168 if (ext_adv_capable(hdev)) { 2169 int status; 2170 2171 status = hci_setup_ext_adv_instance_sync(hdev, 0x00); 2172 if (!status) 2173 hci_update_scan_rsp_data_sync(hdev, 0x00); 2174 } else { 2175 hci_update_adv_data_sync(hdev, 0x00); 2176 hci_update_scan_rsp_data_sync(hdev, 0x00); 2177 } 2178 2179 hci_update_passive_scan(hdev); 2180 } 2181 2182 return err; 2183 } 2184 2185 static void set_mesh_complete(struct hci_dev *hdev, void *data, int err) 2186 { 2187 struct mgmt_pending_cmd *cmd = data; 2188 u8 status = mgmt_status(err); 2189 struct sock *sk; 2190 2191 if (err == -ECANCELED || !mgmt_pending_valid(hdev, cmd)) 2192 return; 2193 2194 sk = cmd->sk; 2195 2196 if (status) { 2197 mgmt_cmd_status(cmd->sk, hdev->id, cmd->opcode, status); 2198 goto done; 2199 } 2200 2201 mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_MESH_RECEIVER, 0, NULL, 0); 2202 2203 done: 2204 mgmt_pending_free(cmd); 2205 } 2206 2207 static int set_mesh_sync(struct hci_dev *hdev, void *data) 2208 { 2209 struct mgmt_pending_cmd *cmd = data; 2210 DEFINE_FLEX(struct mgmt_cp_set_mesh, cp, ad_types, num_ad_types, 2211 sizeof(hdev->mesh_ad_types)); 2212 size_t len; 2213 2214 mutex_lock(&hdev->mgmt_pending_lock); 2215 2216 if (!__mgmt_pending_listed(hdev, cmd)) { 2217 mutex_unlock(&hdev->mgmt_pending_lock); 2218 return -ECANCELED; 2219 } 2220 2221 len = cmd->param_len; 2222 memcpy(cp, cmd->param, min(__struct_size(cp), len)); 2223 2224 mutex_unlock(&hdev->mgmt_pending_lock); 2225 2226 memset(hdev->mesh_ad_types, 0, sizeof(hdev->mesh_ad_types)); 2227 2228 if (cp->enable) 2229 hci_dev_set_flag(hdev, HCI_MESH); 2230 else 2231 hci_dev_clear_flag(hdev, HCI_MESH); 2232 2233 hdev->le_scan_interval = __le16_to_cpu(cp->period); 2234 hdev->le_scan_window = __le16_to_cpu(cp->window); 2235 2236 len -= sizeof(struct mgmt_cp_set_mesh); 2237 2238 /* If filters don't fit, forward all adv pkts */ 2239 if (len <= sizeof(hdev->mesh_ad_types)) 2240 memcpy(hdev->mesh_ad_types, cp->ad_types, len); 2241 2242 hci_update_passive_scan_sync(hdev); 2243 return 0; 2244 } 2245 2246 static int set_mesh(struct sock *sk, struct hci_dev *hdev, void *data, u16 len) 2247 { 2248 struct mgmt_cp_set_mesh *cp = data; 2249 struct mgmt_pending_cmd *cmd; 2250 __u16 period, window; 2251 int err = 0; 2252 2253 bt_dev_dbg(hdev, "sock %p", sk); 2254 2255 if (!lmp_le_capable(hdev) || 2256 !hci_dev_test_flag(hdev, HCI_MESH_EXPERIMENTAL)) 2257 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_MESH_RECEIVER, 2258 MGMT_STATUS_NOT_SUPPORTED); 2259 2260 if (cp->enable != 0x00 && cp->enable != 0x01) 2261 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_MESH_RECEIVER, 2262 MGMT_STATUS_INVALID_PARAMS); 2263 2264 /* Keep allowed ranges in sync with set_scan_params() */ 2265 period = __le16_to_cpu(cp->period); 2266 2267 if (period < 0x0004 || period > 0x4000) 2268 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_MESH_RECEIVER, 2269 MGMT_STATUS_INVALID_PARAMS); 2270 2271 window = __le16_to_cpu(cp->window); 2272 2273 if (window < 0x0004 || window > 0x4000) 2274 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_MESH_RECEIVER, 2275 MGMT_STATUS_INVALID_PARAMS); 2276 2277 if (window > period) 2278 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_MESH_RECEIVER, 2279 MGMT_STATUS_INVALID_PARAMS); 2280 2281 hci_dev_lock(hdev); 2282 2283 cmd = mgmt_pending_add(sk, MGMT_OP_SET_MESH_RECEIVER, hdev, data, len); 2284 if (!cmd) 2285 err = -ENOMEM; 2286 else 2287 err = hci_cmd_sync_queue(hdev, set_mesh_sync, cmd, 2288 set_mesh_complete); 2289 2290 if (err < 0) { 2291 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_MESH_RECEIVER, 2292 MGMT_STATUS_FAILED); 2293 2294 if (cmd) 2295 mgmt_pending_remove(cmd); 2296 } 2297 2298 hci_dev_unlock(hdev); 2299 return err; 2300 } 2301 2302 static void mesh_send_start_complete(struct hci_dev *hdev, void *data, int err) 2303 { 2304 struct mgmt_mesh_tx *mesh_tx = data; 2305 struct mgmt_cp_mesh_send *send = (void *)mesh_tx->param; 2306 unsigned long mesh_send_interval; 2307 u8 mgmt_err = mgmt_status(err); 2308 2309 /* Report any errors here, but don't report completion */ 2310 2311 if (mgmt_err) { 2312 hci_dev_clear_flag(hdev, HCI_MESH_SENDING); 2313 /* Send Complete Error Code for handle */ 2314 mesh_send_complete(hdev, mesh_tx, false); 2315 if (err != -ECANCELED) 2316 mesh_next(hdev, NULL, 0); 2317 return; 2318 } 2319 2320 mesh_send_interval = msecs_to_jiffies((send->cnt) * 25); 2321 queue_delayed_work(hdev->req_workqueue, &hdev->mesh_send_done, 2322 mesh_send_interval); 2323 } 2324 2325 static int mesh_send_sync(struct hci_dev *hdev, void *data) 2326 { 2327 struct mgmt_mesh_tx *mesh_tx = data; 2328 struct mgmt_cp_mesh_send *send = (void *)mesh_tx->param; 2329 struct adv_info *adv, *next_instance; 2330 u8 instance = hdev->le_num_of_adv_sets + 1; 2331 u16 timeout, duration; 2332 int err = 0; 2333 2334 if (hdev->le_num_of_adv_sets <= hdev->adv_instance_cnt) 2335 return MGMT_STATUS_BUSY; 2336 2337 timeout = 1000; 2338 duration = send->cnt * INTERVAL_TO_MS(hdev->le_adv_max_interval); 2339 adv = hci_add_adv_instance(hdev, instance, 0, 2340 send->adv_data_len, send->adv_data, 2341 0, NULL, 2342 timeout, duration, 2343 HCI_ADV_TX_POWER_NO_PREFERENCE, 2344 hdev->le_adv_min_interval, 2345 hdev->le_adv_max_interval, 2346 mesh_tx->handle); 2347 2348 if (!IS_ERR(adv)) 2349 mesh_tx->instance = instance; 2350 else 2351 err = PTR_ERR(adv); 2352 2353 if (hdev->cur_adv_instance == instance) { 2354 /* If the currently advertised instance is being changed then 2355 * cancel the current advertising and schedule the next 2356 * instance. If there is only one instance then the overridden 2357 * advertising data will be visible right away. 2358 */ 2359 cancel_adv_timeout(hdev); 2360 2361 next_instance = hci_get_next_instance(hdev, instance); 2362 if (next_instance) 2363 instance = next_instance->instance; 2364 else 2365 instance = 0; 2366 } else if (hdev->adv_instance_timeout) { 2367 /* Immediately advertise the new instance if no other, or 2368 * let it go naturally from queue if ADV is already happening 2369 */ 2370 instance = 0; 2371 } 2372 2373 if (instance) 2374 return hci_schedule_adv_instance_sync(hdev, instance, true); 2375 2376 return err; 2377 } 2378 2379 static void send_count(struct mgmt_mesh_tx *mesh_tx, void *data) 2380 { 2381 struct mgmt_rp_mesh_read_features *rp = data; 2382 2383 if (rp->used_handles >= rp->max_handles) 2384 return; 2385 2386 rp->handles[rp->used_handles++] = mesh_tx->handle; 2387 } 2388 2389 static int mesh_features(struct sock *sk, struct hci_dev *hdev, 2390 void *data, u16 len) 2391 { 2392 struct mgmt_rp_mesh_read_features rp; 2393 2394 if (!lmp_le_capable(hdev) || 2395 !hci_dev_test_flag(hdev, HCI_MESH_EXPERIMENTAL)) 2396 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_MESH_READ_FEATURES, 2397 MGMT_STATUS_NOT_SUPPORTED); 2398 2399 memset(&rp, 0, sizeof(rp)); 2400 rp.index = cpu_to_le16(hdev->id); 2401 if (hci_dev_test_flag(hdev, HCI_LE_ENABLED)) 2402 rp.max_handles = MESH_HANDLES_MAX; 2403 2404 hci_dev_lock(hdev); 2405 2406 if (rp.max_handles) 2407 mgmt_mesh_foreach(hdev, send_count, &rp, sk); 2408 2409 mgmt_cmd_complete(sk, hdev->id, MGMT_OP_MESH_READ_FEATURES, 0, &rp, 2410 rp.used_handles + sizeof(rp) - MESH_HANDLES_MAX); 2411 2412 hci_dev_unlock(hdev); 2413 return 0; 2414 } 2415 2416 static int send_cancel(struct hci_dev *hdev, void *data) 2417 { 2418 struct mgmt_pending_cmd *cmd = data; 2419 struct mgmt_cp_mesh_send_cancel *cancel = (void *)cmd->param; 2420 struct mgmt_mesh_tx *mesh_tx; 2421 2422 if (!cancel->handle) { 2423 do { 2424 mesh_tx = mgmt_mesh_next(hdev, cmd->sk); 2425 2426 if (mesh_tx) { 2427 if (!hci_cmd_sync_dequeue(hdev, mesh_send_sync, 2428 mesh_tx, NULL)) 2429 mesh_send_complete(hdev, mesh_tx, false); 2430 } 2431 } while (mesh_tx); 2432 } else { 2433 mesh_tx = mgmt_mesh_find(hdev, cancel->handle); 2434 2435 if (mesh_tx && mesh_tx->sk == cmd->sk) { 2436 if (!hci_cmd_sync_dequeue(hdev, mesh_send_sync, 2437 mesh_tx, NULL)) 2438 mesh_send_complete(hdev, mesh_tx, false); 2439 } 2440 } 2441 2442 mgmt_cmd_complete(cmd->sk, hdev->id, MGMT_OP_MESH_SEND_CANCEL, 2443 0, NULL, 0); 2444 2445 if (!hci_dev_test_flag(hdev, HCI_MESH_SENDING)) 2446 mesh_next(hdev, NULL, 0); 2447 2448 return 0; 2449 } 2450 2451 static void send_cancel_destroy(struct hci_dev *hdev, void *data, int err) 2452 { 2453 mgmt_pending_free(data); 2454 } 2455 2456 static int mesh_send_cancel(struct sock *sk, struct hci_dev *hdev, 2457 void *data, u16 len) 2458 { 2459 struct mgmt_pending_cmd *cmd; 2460 int err; 2461 2462 if (!lmp_le_capable(hdev) || 2463 !hci_dev_test_flag(hdev, HCI_MESH_EXPERIMENTAL)) 2464 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_MESH_SEND_CANCEL, 2465 MGMT_STATUS_NOT_SUPPORTED); 2466 2467 if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED)) 2468 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_MESH_SEND_CANCEL, 2469 MGMT_STATUS_REJECTED); 2470 2471 hci_dev_lock(hdev); 2472 cmd = mgmt_pending_new(sk, MGMT_OP_MESH_SEND_CANCEL, hdev, data, len); 2473 if (!cmd) 2474 err = -ENOMEM; 2475 else 2476 err = hci_cmd_sync_queue(hdev, send_cancel, cmd, 2477 send_cancel_destroy); 2478 2479 if (err < 0) { 2480 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_MESH_SEND_CANCEL, 2481 MGMT_STATUS_FAILED); 2482 2483 if (cmd) 2484 mgmt_pending_free(cmd); 2485 } 2486 2487 hci_dev_unlock(hdev); 2488 return err; 2489 } 2490 2491 static int mesh_send(struct sock *sk, struct hci_dev *hdev, void *data, u16 len) 2492 { 2493 struct mgmt_mesh_tx *mesh_tx; 2494 struct mgmt_cp_mesh_send *send = data; 2495 struct mgmt_rp_mesh_read_features rp; 2496 u16 expected_len; 2497 bool sending; 2498 int err = 0; 2499 2500 if (!lmp_le_capable(hdev) || 2501 !hci_dev_test_flag(hdev, HCI_MESH_EXPERIMENTAL)) 2502 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_MESH_SEND, 2503 MGMT_STATUS_NOT_SUPPORTED); 2504 if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED)) 2505 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_MESH_SEND, 2506 MGMT_STATUS_REJECTED); 2507 2508 if (!send->adv_data_len || send->adv_data_len > 31) 2509 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_MESH_SEND, 2510 MGMT_STATUS_REJECTED); 2511 2512 expected_len = struct_size(send, adv_data, send->adv_data_len); 2513 if (expected_len != len) 2514 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_MESH_SEND, 2515 MGMT_STATUS_INVALID_PARAMS); 2516 2517 hci_dev_lock(hdev); 2518 2519 memset(&rp, 0, sizeof(rp)); 2520 rp.max_handles = MESH_HANDLES_MAX; 2521 2522 mgmt_mesh_foreach(hdev, send_count, &rp, sk); 2523 2524 if (rp.max_handles <= rp.used_handles) { 2525 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_MESH_SEND, 2526 MGMT_STATUS_BUSY); 2527 goto done; 2528 } 2529 2530 sending = hci_dev_test_flag(hdev, HCI_MESH_SENDING); 2531 mesh_tx = mgmt_mesh_add(sk, hdev, send, len); 2532 2533 if (!mesh_tx) 2534 err = -ENOMEM; 2535 else if (!sending) 2536 err = hci_cmd_sync_queue(hdev, mesh_send_sync, mesh_tx, 2537 mesh_send_start_complete); 2538 2539 if (err < 0) { 2540 bt_dev_err(hdev, "Send Mesh Failed %d", err); 2541 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_MESH_SEND, 2542 MGMT_STATUS_FAILED); 2543 2544 if (mesh_tx) { 2545 if (sending) 2546 mgmt_mesh_remove(mesh_tx); 2547 } 2548 } else { 2549 hci_dev_set_flag(hdev, HCI_MESH_SENDING); 2550 2551 mgmt_cmd_complete(sk, hdev->id, MGMT_OP_MESH_SEND, 0, 2552 &mesh_tx->handle, 1); 2553 } 2554 2555 done: 2556 hci_dev_unlock(hdev); 2557 return err; 2558 } 2559 2560 static int set_le(struct sock *sk, struct hci_dev *hdev, void *data, u16 len) 2561 { 2562 struct mgmt_mode *cp = data; 2563 struct mgmt_pending_cmd *cmd; 2564 int err; 2565 u8 val, enabled; 2566 2567 bt_dev_dbg(hdev, "sock %p", sk); 2568 2569 if (!lmp_le_capable(hdev)) 2570 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE, 2571 MGMT_STATUS_NOT_SUPPORTED); 2572 2573 if (cp->val != 0x00 && cp->val != 0x01) 2574 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE, 2575 MGMT_STATUS_INVALID_PARAMS); 2576 2577 /* Bluetooth single mode LE only controllers or dual-mode 2578 * controllers configured as LE only devices, do not allow 2579 * switching LE off. These have either LE enabled explicitly 2580 * or BR/EDR has been previously switched off. 2581 * 2582 * When trying to enable an already enabled LE, then gracefully 2583 * send a positive response. Trying to disable it however will 2584 * result into rejection. 2585 */ 2586 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) { 2587 if (cp->val == 0x01) 2588 return send_settings_rsp(sk, MGMT_OP_SET_LE, hdev); 2589 2590 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE, 2591 MGMT_STATUS_REJECTED); 2592 } 2593 2594 hci_dev_lock(hdev); 2595 2596 val = !!cp->val; 2597 enabled = lmp_host_le_capable(hdev); 2598 2599 if (!hdev_is_powered(hdev) || val == enabled) { 2600 bool changed = false; 2601 2602 if (val != hci_dev_test_flag(hdev, HCI_LE_ENABLED)) { 2603 hci_dev_change_flag(hdev, HCI_LE_ENABLED); 2604 changed = true; 2605 } 2606 2607 if (!val && hci_dev_test_flag(hdev, HCI_ADVERTISING)) { 2608 hci_dev_clear_flag(hdev, HCI_ADVERTISING); 2609 changed = true; 2610 } 2611 2612 err = send_settings_rsp(sk, MGMT_OP_SET_LE, hdev); 2613 if (err < 0) 2614 goto unlock; 2615 2616 if (changed) 2617 err = new_settings(hdev, sk); 2618 2619 goto unlock; 2620 } 2621 2622 if (pending_find(MGMT_OP_SET_LE, hdev) || 2623 pending_find(MGMT_OP_SET_ADVERTISING, hdev)) { 2624 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE, 2625 MGMT_STATUS_BUSY); 2626 goto unlock; 2627 } 2628 2629 cmd = mgmt_pending_add(sk, MGMT_OP_SET_LE, hdev, data, len); 2630 if (!cmd) 2631 err = -ENOMEM; 2632 else 2633 err = hci_cmd_sync_queue(hdev, set_le_sync, cmd, 2634 set_le_complete); 2635 2636 if (err < 0) { 2637 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE, 2638 MGMT_STATUS_FAILED); 2639 2640 if (cmd) 2641 mgmt_pending_remove(cmd); 2642 } 2643 2644 unlock: 2645 hci_dev_unlock(hdev); 2646 return err; 2647 } 2648 2649 static int send_hci_cmd_sync(struct hci_dev *hdev, void *data) 2650 { 2651 struct mgmt_pending_cmd *cmd = data; 2652 struct mgmt_cp_hci_cmd_sync *cp = cmd->param; 2653 struct sk_buff *skb; 2654 2655 skb = __hci_cmd_sync_ev(hdev, le16_to_cpu(cp->opcode), 2656 le16_to_cpu(cp->params_len), cp->params, 2657 cp->event, cp->timeout ? 2658 secs_to_jiffies(cp->timeout) : 2659 HCI_CMD_TIMEOUT); 2660 if (IS_ERR(skb)) { 2661 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_HCI_CMD_SYNC, 2662 mgmt_status(PTR_ERR(skb))); 2663 return 0; 2664 } 2665 2666 mgmt_cmd_complete(cmd->sk, hdev->id, MGMT_OP_HCI_CMD_SYNC, 0, 2667 skb->data, skb->len); 2668 2669 kfree_skb(skb); 2670 2671 return 0; 2672 } 2673 2674 static void send_hci_cmd_sync_destroy(struct hci_dev *hdev, void *data, int err) 2675 { 2676 mgmt_pending_free(data); 2677 } 2678 2679 static int mgmt_hci_cmd_sync(struct sock *sk, struct hci_dev *hdev, 2680 void *data, u16 len) 2681 { 2682 struct mgmt_cp_hci_cmd_sync *cp = data; 2683 struct mgmt_pending_cmd *cmd; 2684 int err; 2685 2686 if (len != (offsetof(struct mgmt_cp_hci_cmd_sync, params) + 2687 le16_to_cpu(cp->params_len))) 2688 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_HCI_CMD_SYNC, 2689 MGMT_STATUS_INVALID_PARAMS); 2690 2691 /* The HCI command header carries the parameter length in a u8, a 2692 * larger value would be truncated there while the parameters are 2693 * still appended to the frame in full. 2694 */ 2695 if (le16_to_cpu(cp->params_len) > U8_MAX) 2696 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_HCI_CMD_SYNC, 2697 MGMT_STATUS_INVALID_PARAMS); 2698 2699 hci_dev_lock(hdev); 2700 cmd = mgmt_pending_new(sk, MGMT_OP_HCI_CMD_SYNC, hdev, data, len); 2701 if (!cmd) 2702 err = -ENOMEM; 2703 else 2704 err = hci_cmd_sync_queue(hdev, send_hci_cmd_sync, cmd, 2705 send_hci_cmd_sync_destroy); 2706 2707 if (err < 0) { 2708 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_HCI_CMD_SYNC, 2709 MGMT_STATUS_FAILED); 2710 2711 if (cmd) 2712 mgmt_pending_free(cmd); 2713 } 2714 2715 hci_dev_unlock(hdev); 2716 return err; 2717 } 2718 2719 /* This is a helper function to test for pending mgmt commands that can 2720 * cause CoD or EIR HCI commands. We can only allow one such pending 2721 * mgmt command at a time since otherwise we cannot easily track what 2722 * the current values are, will be, and based on that calculate if a new 2723 * HCI command needs to be sent and if yes with what value. 2724 */ 2725 static bool pending_eir_or_class(struct hci_dev *hdev) 2726 { 2727 struct mgmt_pending_cmd *cmd; 2728 bool pending = false; 2729 2730 mutex_lock(&hdev->mgmt_pending_lock); 2731 2732 list_for_each_entry(cmd, &hdev->mgmt_pending, list) { 2733 switch (cmd->opcode) { 2734 case MGMT_OP_ADD_UUID: 2735 case MGMT_OP_REMOVE_UUID: 2736 case MGMT_OP_SET_DEV_CLASS: 2737 case MGMT_OP_SET_LOCAL_NAME: 2738 case MGMT_OP_SET_POWERED: 2739 pending = true; 2740 break; 2741 } 2742 2743 if (pending) 2744 break; 2745 } 2746 2747 mutex_unlock(&hdev->mgmt_pending_lock); 2748 2749 return pending; 2750 } 2751 2752 static const u8 bluetooth_base_uuid[] = { 2753 0xfb, 0x34, 0x9b, 0x5f, 0x80, 0x00, 0x00, 0x80, 2754 0x00, 0x10, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 2755 }; 2756 2757 static u8 get_uuid_size(const u8 *uuid) 2758 { 2759 u32 val; 2760 2761 if (memcmp(uuid, bluetooth_base_uuid, 12)) 2762 return 128; 2763 2764 val = get_unaligned_le32(&uuid[12]); 2765 if (val > 0xffff) 2766 return 32; 2767 2768 return 16; 2769 } 2770 2771 static void mgmt_class_complete(struct hci_dev *hdev, void *data, int err) 2772 { 2773 struct mgmt_pending_cmd *cmd = data; 2774 2775 bt_dev_dbg(hdev, "err %d", err); 2776 2777 mgmt_cmd_complete(cmd->sk, cmd->hdev->id, cmd->opcode, 2778 mgmt_status(err), hdev->dev_class, 3); 2779 2780 mgmt_pending_free(cmd); 2781 } 2782 2783 static int add_uuid_sync(struct hci_dev *hdev, void *data) 2784 { 2785 int err; 2786 2787 err = hci_update_class_sync(hdev); 2788 if (err) 2789 return err; 2790 2791 return hci_update_eir_sync(hdev); 2792 } 2793 2794 static int add_uuid(struct sock *sk, struct hci_dev *hdev, void *data, u16 len) 2795 { 2796 struct mgmt_cp_add_uuid *cp = data; 2797 struct mgmt_pending_cmd *cmd; 2798 struct bt_uuid *uuid; 2799 int err; 2800 2801 bt_dev_dbg(hdev, "sock %p", sk); 2802 2803 hci_dev_lock(hdev); 2804 2805 if (pending_eir_or_class(hdev)) { 2806 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_UUID, 2807 MGMT_STATUS_BUSY); 2808 goto failed; 2809 } 2810 2811 uuid = kmalloc_obj(*uuid); 2812 if (!uuid) { 2813 err = -ENOMEM; 2814 goto failed; 2815 } 2816 2817 memcpy(uuid->uuid, cp->uuid, 16); 2818 uuid->svc_hint = cp->svc_hint; 2819 uuid->size = get_uuid_size(cp->uuid); 2820 2821 list_add_tail(&uuid->list, &hdev->uuids); 2822 2823 cmd = mgmt_pending_new(sk, MGMT_OP_ADD_UUID, hdev, data, len); 2824 if (!cmd) { 2825 err = -ENOMEM; 2826 goto failed; 2827 } 2828 2829 /* MGMT_OP_ADD_UUID don't require adapter the UP/Running so use 2830 * hci_cmd_sync_submit instead of hci_cmd_sync_queue. 2831 */ 2832 err = hci_cmd_sync_submit(hdev, add_uuid_sync, cmd, 2833 mgmt_class_complete); 2834 if (err < 0) { 2835 mgmt_pending_free(cmd); 2836 goto failed; 2837 } 2838 2839 failed: 2840 hci_dev_unlock(hdev); 2841 return err; 2842 } 2843 2844 static bool enable_service_cache(struct hci_dev *hdev) 2845 { 2846 if (!hdev_is_powered(hdev)) 2847 return false; 2848 2849 if (!hci_dev_test_and_set_flag(hdev, HCI_SERVICE_CACHE)) { 2850 queue_delayed_work(hdev->workqueue, &hdev->service_cache, 2851 CACHE_TIMEOUT); 2852 return true; 2853 } 2854 2855 return false; 2856 } 2857 2858 static int remove_uuid_sync(struct hci_dev *hdev, void *data) 2859 { 2860 int err; 2861 2862 err = hci_update_class_sync(hdev); 2863 if (err) 2864 return err; 2865 2866 return hci_update_eir_sync(hdev); 2867 } 2868 2869 static int remove_uuid(struct sock *sk, struct hci_dev *hdev, void *data, 2870 u16 len) 2871 { 2872 struct mgmt_cp_remove_uuid *cp = data; 2873 struct mgmt_pending_cmd *cmd; 2874 struct bt_uuid *match, *tmp; 2875 static const u8 bt_uuid_any[] = { 2876 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 2877 }; 2878 int err, found; 2879 2880 bt_dev_dbg(hdev, "sock %p", sk); 2881 2882 hci_dev_lock(hdev); 2883 2884 if (pending_eir_or_class(hdev)) { 2885 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID, 2886 MGMT_STATUS_BUSY); 2887 goto unlock; 2888 } 2889 2890 if (memcmp(cp->uuid, bt_uuid_any, 16) == 0) { 2891 hci_uuids_clear(hdev); 2892 2893 if (enable_service_cache(hdev)) { 2894 err = mgmt_cmd_complete(sk, hdev->id, 2895 MGMT_OP_REMOVE_UUID, 2896 0, hdev->dev_class, 3); 2897 goto unlock; 2898 } 2899 2900 goto update_class; 2901 } 2902 2903 found = 0; 2904 2905 list_for_each_entry_safe(match, tmp, &hdev->uuids, list) { 2906 if (memcmp(match->uuid, cp->uuid, 16) != 0) 2907 continue; 2908 2909 list_del(&match->list); 2910 kfree(match); 2911 found++; 2912 } 2913 2914 if (found == 0) { 2915 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID, 2916 MGMT_STATUS_INVALID_PARAMS); 2917 goto unlock; 2918 } 2919 2920 update_class: 2921 cmd = mgmt_pending_new(sk, MGMT_OP_REMOVE_UUID, hdev, data, len); 2922 if (!cmd) { 2923 err = -ENOMEM; 2924 goto unlock; 2925 } 2926 2927 /* MGMT_OP_REMOVE_UUID don't require adapter the UP/Running so use 2928 * hci_cmd_sync_submit instead of hci_cmd_sync_queue. 2929 */ 2930 err = hci_cmd_sync_submit(hdev, remove_uuid_sync, cmd, 2931 mgmt_class_complete); 2932 if (err < 0) 2933 mgmt_pending_free(cmd); 2934 2935 unlock: 2936 hci_dev_unlock(hdev); 2937 return err; 2938 } 2939 2940 static int set_class_sync(struct hci_dev *hdev, void *data) 2941 { 2942 int err = 0; 2943 2944 if (hci_dev_test_and_clear_flag(hdev, HCI_SERVICE_CACHE)) { 2945 cancel_delayed_work_sync(&hdev->service_cache); 2946 err = hci_update_eir_sync(hdev); 2947 } 2948 2949 if (err) 2950 return err; 2951 2952 return hci_update_class_sync(hdev); 2953 } 2954 2955 static int set_dev_class(struct sock *sk, struct hci_dev *hdev, void *data, 2956 u16 len) 2957 { 2958 struct mgmt_cp_set_dev_class *cp = data; 2959 struct mgmt_pending_cmd *cmd; 2960 int err; 2961 2962 bt_dev_dbg(hdev, "sock %p", sk); 2963 2964 if (!lmp_bredr_capable(hdev)) 2965 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 2966 MGMT_STATUS_NOT_SUPPORTED); 2967 2968 hci_dev_lock(hdev); 2969 2970 if (pending_eir_or_class(hdev)) { 2971 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 2972 MGMT_STATUS_BUSY); 2973 goto unlock; 2974 } 2975 2976 if ((cp->minor & 0x03) != 0 || (cp->major & 0xe0) != 0) { 2977 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 2978 MGMT_STATUS_INVALID_PARAMS); 2979 goto unlock; 2980 } 2981 2982 hdev->major_class = cp->major; 2983 hdev->minor_class = cp->minor; 2984 2985 if (!hdev_is_powered(hdev)) { 2986 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 0, 2987 hdev->dev_class, 3); 2988 goto unlock; 2989 } 2990 2991 cmd = mgmt_pending_new(sk, MGMT_OP_SET_DEV_CLASS, hdev, data, len); 2992 if (!cmd) { 2993 err = -ENOMEM; 2994 goto unlock; 2995 } 2996 2997 /* MGMT_OP_SET_DEV_CLASS don't require adapter the UP/Running so use 2998 * hci_cmd_sync_submit instead of hci_cmd_sync_queue. 2999 */ 3000 err = hci_cmd_sync_submit(hdev, set_class_sync, cmd, 3001 mgmt_class_complete); 3002 if (err < 0) 3003 mgmt_pending_free(cmd); 3004 3005 unlock: 3006 hci_dev_unlock(hdev); 3007 return err; 3008 } 3009 3010 static int load_link_keys(struct sock *sk, struct hci_dev *hdev, void *data, 3011 u16 len) 3012 { 3013 struct mgmt_cp_load_link_keys *cp = data; 3014 const u16 max_key_count = ((U16_MAX - sizeof(*cp)) / 3015 sizeof(struct mgmt_link_key_info)); 3016 u16 key_count, expected_len; 3017 bool changed; 3018 int i; 3019 3020 bt_dev_dbg(hdev, "sock %p", sk); 3021 3022 if (!lmp_bredr_capable(hdev)) 3023 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS, 3024 MGMT_STATUS_NOT_SUPPORTED); 3025 3026 key_count = __le16_to_cpu(cp->key_count); 3027 if (key_count > max_key_count) { 3028 bt_dev_err(hdev, "load_link_keys: too big key_count value %u", 3029 key_count); 3030 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS, 3031 MGMT_STATUS_INVALID_PARAMS); 3032 } 3033 3034 expected_len = struct_size(cp, keys, key_count); 3035 if (expected_len != len) { 3036 bt_dev_err(hdev, "load_link_keys: expected %u bytes, got %u bytes", 3037 expected_len, len); 3038 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS, 3039 MGMT_STATUS_INVALID_PARAMS); 3040 } 3041 3042 if (cp->debug_keys != 0x00 && cp->debug_keys != 0x01) 3043 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS, 3044 MGMT_STATUS_INVALID_PARAMS); 3045 3046 bt_dev_dbg(hdev, "debug_keys %u key_count %u", cp->debug_keys, 3047 key_count); 3048 3049 hci_dev_lock(hdev); 3050 3051 hci_link_keys_clear(hdev); 3052 3053 if (cp->debug_keys) 3054 changed = !hci_dev_test_and_set_flag(hdev, HCI_KEEP_DEBUG_KEYS); 3055 else 3056 changed = hci_dev_test_and_clear_flag(hdev, 3057 HCI_KEEP_DEBUG_KEYS); 3058 3059 if (changed) 3060 new_settings(hdev, NULL); 3061 3062 for (i = 0; i < key_count; i++) { 3063 struct mgmt_link_key_info *key = &cp->keys[i]; 3064 3065 if (hci_is_blocked_key(hdev, 3066 HCI_BLOCKED_KEY_TYPE_LINKKEY, 3067 key->val)) { 3068 bt_dev_warn(hdev, "Skipping blocked link key for %pMR", 3069 &key->addr.bdaddr); 3070 continue; 3071 } 3072 3073 if (key->addr.type != BDADDR_BREDR) { 3074 bt_dev_warn(hdev, 3075 "Invalid link address type %u for %pMR", 3076 key->addr.type, &key->addr.bdaddr); 3077 continue; 3078 } 3079 3080 if (key->type > 0x08) { 3081 bt_dev_warn(hdev, "Invalid link key type %u for %pMR", 3082 key->type, &key->addr.bdaddr); 3083 continue; 3084 } 3085 3086 /* Always ignore debug keys and require a new pairing if 3087 * the user wants to use them. 3088 */ 3089 if (key->type == HCI_LK_DEBUG_COMBINATION) 3090 continue; 3091 3092 hci_add_link_key(hdev, NULL, &key->addr.bdaddr, key->val, 3093 key->type, key->pin_len, NULL); 3094 } 3095 3096 mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS, 0, NULL, 0); 3097 3098 hci_dev_unlock(hdev); 3099 3100 return 0; 3101 } 3102 3103 static int device_unpaired(struct hci_dev *hdev, bdaddr_t *bdaddr, 3104 u8 addr_type, struct sock *skip_sk) 3105 { 3106 struct mgmt_ev_device_unpaired ev; 3107 3108 bacpy(&ev.addr.bdaddr, bdaddr); 3109 ev.addr.type = addr_type; 3110 3111 return mgmt_event(MGMT_EV_DEVICE_UNPAIRED, hdev, &ev, sizeof(ev), 3112 skip_sk); 3113 } 3114 3115 static void unpair_device_complete(struct hci_dev *hdev, void *data, int err) 3116 { 3117 struct mgmt_pending_cmd *cmd = data; 3118 struct mgmt_cp_unpair_device *cp = cmd->param; 3119 3120 if (!err) 3121 device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, cmd->sk); 3122 3123 cmd->cmd_complete(cmd, err); 3124 mgmt_pending_free(cmd); 3125 } 3126 3127 static int unpair_device_sync(struct hci_dev *hdev, void *data) 3128 { 3129 struct mgmt_pending_cmd *cmd = data; 3130 struct mgmt_cp_unpair_device *cp = cmd->param; 3131 struct hci_conn *conn; 3132 3133 hci_dev_lock(hdev); 3134 3135 if (cp->addr.type == BDADDR_BREDR) 3136 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, 3137 &cp->addr.bdaddr); 3138 else 3139 conn = hci_conn_hash_lookup_le(hdev, &cp->addr.bdaddr, 3140 le_addr_type(cp->addr.type)); 3141 3142 if (conn) 3143 hci_conn_get(conn); 3144 3145 hci_dev_unlock(hdev); 3146 3147 if (!conn) 3148 return 0; 3149 3150 /* Disregard any possible error since the likes of hci_abort_conn_sync 3151 * will clean up the connection no matter the error. 3152 */ 3153 hci_abort_conn(conn, HCI_ERROR_REMOTE_USER_TERM); 3154 hci_conn_put(conn); 3155 3156 return 0; 3157 } 3158 3159 static int unpair_device(struct sock *sk, struct hci_dev *hdev, void *data, 3160 u16 len) 3161 { 3162 struct mgmt_cp_unpair_device *cp = data; 3163 struct mgmt_rp_unpair_device rp; 3164 struct hci_conn_params *params; 3165 struct mgmt_pending_cmd *cmd; 3166 struct hci_conn *conn; 3167 u8 addr_type; 3168 int err; 3169 3170 memset(&rp, 0, sizeof(rp)); 3171 bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr); 3172 rp.addr.type = cp->addr.type; 3173 3174 if (!bdaddr_type_is_valid(cp->addr.type)) 3175 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE, 3176 MGMT_STATUS_INVALID_PARAMS, 3177 &rp, sizeof(rp)); 3178 3179 if (cp->disconnect != 0x00 && cp->disconnect != 0x01) 3180 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE, 3181 MGMT_STATUS_INVALID_PARAMS, 3182 &rp, sizeof(rp)); 3183 3184 hci_dev_lock(hdev); 3185 3186 if (!hdev_is_powered(hdev)) { 3187 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE, 3188 MGMT_STATUS_NOT_POWERED, &rp, 3189 sizeof(rp)); 3190 goto unlock; 3191 } 3192 3193 if (cp->addr.type == BDADDR_BREDR) { 3194 /* If disconnection is requested, then look up the 3195 * connection. If the remote device is connected, it 3196 * will be later used to terminate the link. 3197 * 3198 * Setting it to NULL explicitly will cause no 3199 * termination of the link. 3200 */ 3201 if (cp->disconnect) 3202 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, 3203 &cp->addr.bdaddr); 3204 else 3205 conn = NULL; 3206 3207 err = hci_remove_link_key(hdev, &cp->addr.bdaddr); 3208 if (err < 0) { 3209 err = mgmt_cmd_complete(sk, hdev->id, 3210 MGMT_OP_UNPAIR_DEVICE, 3211 MGMT_STATUS_NOT_PAIRED, &rp, 3212 sizeof(rp)); 3213 goto unlock; 3214 } 3215 3216 goto done; 3217 } 3218 3219 /* LE address type */ 3220 addr_type = le_addr_type(cp->addr.type); 3221 3222 /* Abort any ongoing SMP pairing. Removes ltk and irk if they exist. */ 3223 err = smp_cancel_and_remove_pairing(hdev, &cp->addr.bdaddr, addr_type); 3224 if (err < 0) { 3225 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE, 3226 MGMT_STATUS_NOT_PAIRED, &rp, 3227 sizeof(rp)); 3228 goto unlock; 3229 } 3230 3231 conn = hci_conn_hash_lookup_le(hdev, &cp->addr.bdaddr, addr_type); 3232 if (!conn) { 3233 hci_conn_params_del(hdev, &cp->addr.bdaddr, addr_type); 3234 goto done; 3235 } 3236 3237 3238 /* Defer clearing up the connection parameters until closing to 3239 * give a chance of keeping them if a repairing happens. 3240 */ 3241 set_bit(HCI_CONN_PARAM_REMOVAL_PEND, &conn->flags); 3242 3243 /* Disable auto-connection parameters if present */ 3244 params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr, addr_type); 3245 if (params) { 3246 if (params->explicit_connect) 3247 params->auto_connect = HCI_AUTO_CONN_EXPLICIT; 3248 else 3249 params->auto_connect = HCI_AUTO_CONN_DISABLED; 3250 } 3251 3252 /* If disconnection is not requested, then clear the connection 3253 * variable so that the link is not terminated. 3254 */ 3255 if (!cp->disconnect) 3256 conn = NULL; 3257 3258 done: 3259 /* If the connection variable is set, then termination of the 3260 * link is requested. 3261 */ 3262 if (!conn) { 3263 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE, 0, 3264 &rp, sizeof(rp)); 3265 device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, sk); 3266 goto unlock; 3267 } 3268 3269 cmd = mgmt_pending_new(sk, MGMT_OP_UNPAIR_DEVICE, hdev, cp, 3270 sizeof(*cp)); 3271 if (!cmd) { 3272 err = -ENOMEM; 3273 goto unlock; 3274 } 3275 3276 cmd->cmd_complete = addr_cmd_complete; 3277 3278 err = hci_cmd_sync_queue(hdev, unpair_device_sync, cmd, 3279 unpair_device_complete); 3280 if (err < 0) 3281 mgmt_pending_free(cmd); 3282 3283 unlock: 3284 hci_dev_unlock(hdev); 3285 return err; 3286 } 3287 3288 static void disconnect_complete(struct hci_dev *hdev, void *data, int err) 3289 { 3290 struct mgmt_pending_cmd *cmd = data; 3291 3292 cmd->cmd_complete(cmd, mgmt_status(err)); 3293 mgmt_pending_free(cmd); 3294 } 3295 3296 static int disconnect_sync(struct hci_dev *hdev, void *data) 3297 { 3298 struct mgmt_pending_cmd *cmd = data; 3299 struct mgmt_cp_disconnect *cp = cmd->param; 3300 struct hci_conn *conn; 3301 3302 hci_dev_lock(hdev); 3303 3304 if (cp->addr.type == BDADDR_BREDR) 3305 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, 3306 &cp->addr.bdaddr); 3307 else 3308 conn = hci_conn_hash_lookup_le(hdev, &cp->addr.bdaddr, 3309 le_addr_type(cp->addr.type)); 3310 3311 if (conn) 3312 hci_conn_get(conn); 3313 3314 hci_dev_unlock(hdev); 3315 3316 if (!conn) 3317 return -ENOTCONN; 3318 3319 /* Disregard any possible error since the likes of hci_abort_conn_sync 3320 * will clean up the connection no matter the error. 3321 */ 3322 hci_abort_conn(conn, HCI_ERROR_REMOTE_USER_TERM); 3323 hci_conn_put(conn); 3324 3325 return 0; 3326 } 3327 3328 static int disconnect(struct sock *sk, struct hci_dev *hdev, void *data, 3329 u16 len) 3330 { 3331 struct mgmt_cp_disconnect *cp = data; 3332 struct mgmt_rp_disconnect rp; 3333 struct mgmt_pending_cmd *cmd; 3334 int err; 3335 3336 bt_dev_dbg(hdev, "sock %p", sk); 3337 3338 memset(&rp, 0, sizeof(rp)); 3339 bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr); 3340 rp.addr.type = cp->addr.type; 3341 3342 if (!bdaddr_type_is_valid(cp->addr.type)) 3343 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT, 3344 MGMT_STATUS_INVALID_PARAMS, 3345 &rp, sizeof(rp)); 3346 3347 hci_dev_lock(hdev); 3348 3349 if (!test_bit(HCI_UP, &hdev->flags)) { 3350 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT, 3351 MGMT_STATUS_NOT_POWERED, &rp, 3352 sizeof(rp)); 3353 goto failed; 3354 } 3355 3356 cmd = mgmt_pending_new(sk, MGMT_OP_DISCONNECT, hdev, data, len); 3357 if (!cmd) { 3358 err = -ENOMEM; 3359 goto failed; 3360 } 3361 3362 cmd->cmd_complete = generic_cmd_complete; 3363 3364 err = hci_cmd_sync_queue(hdev, disconnect_sync, cmd, 3365 disconnect_complete); 3366 if (err < 0) 3367 mgmt_pending_free(cmd); 3368 3369 failed: 3370 hci_dev_unlock(hdev); 3371 return err; 3372 } 3373 3374 static u8 link_to_bdaddr(u8 link_type, u8 addr_type) 3375 { 3376 switch (link_type) { 3377 case CIS_LINK: 3378 case BIS_LINK: 3379 case PA_LINK: 3380 case LE_LINK: 3381 switch (addr_type) { 3382 case ADDR_LE_DEV_PUBLIC: 3383 return BDADDR_LE_PUBLIC; 3384 3385 default: 3386 /* Fallback to LE Random address type */ 3387 return BDADDR_LE_RANDOM; 3388 } 3389 3390 default: 3391 /* Fallback to BR/EDR type */ 3392 return BDADDR_BREDR; 3393 } 3394 } 3395 3396 static int get_connections(struct sock *sk, struct hci_dev *hdev, void *data, 3397 u16 data_len) 3398 { 3399 struct mgmt_rp_get_connections *rp; 3400 struct hci_conn *c; 3401 int err; 3402 u16 i; 3403 3404 bt_dev_dbg(hdev, "sock %p", sk); 3405 3406 hci_dev_lock(hdev); 3407 3408 if (!hdev_is_powered(hdev)) { 3409 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_CONNECTIONS, 3410 MGMT_STATUS_NOT_POWERED); 3411 goto unlock; 3412 } 3413 3414 i = 0; 3415 list_for_each_entry(c, &hdev->conn_hash.list, list) { 3416 if (test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags)) 3417 i++; 3418 } 3419 3420 rp = kmalloc_flex(*rp, addr, i); 3421 if (!rp) { 3422 err = -ENOMEM; 3423 goto unlock; 3424 } 3425 3426 i = 0; 3427 list_for_each_entry(c, &hdev->conn_hash.list, list) { 3428 if (!test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags)) 3429 continue; 3430 bacpy(&rp->addr[i].bdaddr, &c->dst); 3431 rp->addr[i].type = link_to_bdaddr(c->type, c->dst_type); 3432 if (c->type == SCO_LINK || c->type == ESCO_LINK) 3433 continue; 3434 i++; 3435 } 3436 3437 rp->conn_count = cpu_to_le16(i); 3438 3439 /* Recalculate length in case of filtered SCO connections, etc */ 3440 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONNECTIONS, 0, rp, 3441 struct_size(rp, addr, i)); 3442 3443 kfree(rp); 3444 3445 unlock: 3446 hci_dev_unlock(hdev); 3447 return err; 3448 } 3449 3450 static int send_pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev, 3451 struct mgmt_cp_pin_code_neg_reply *cp) 3452 { 3453 struct mgmt_pending_cmd *cmd; 3454 int err; 3455 3456 cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_NEG_REPLY, hdev, cp, 3457 sizeof(*cp)); 3458 if (!cmd) 3459 return -ENOMEM; 3460 3461 cmd->cmd_complete = addr_cmd_complete; 3462 3463 err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_NEG_REPLY, 3464 sizeof(cp->addr.bdaddr), &cp->addr.bdaddr); 3465 if (err < 0) 3466 mgmt_pending_remove(cmd); 3467 3468 return err; 3469 } 3470 3471 static int pin_code_reply(struct sock *sk, struct hci_dev *hdev, void *data, 3472 u16 len) 3473 { 3474 struct hci_conn *conn; 3475 struct mgmt_cp_pin_code_reply *cp = data; 3476 struct hci_cp_pin_code_reply reply; 3477 struct mgmt_pending_cmd *cmd; 3478 int err; 3479 3480 bt_dev_dbg(hdev, "sock %p", sk); 3481 3482 hci_dev_lock(hdev); 3483 3484 if (!hdev_is_powered(hdev)) { 3485 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY, 3486 MGMT_STATUS_NOT_POWERED); 3487 goto failed; 3488 } 3489 3490 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->addr.bdaddr); 3491 if (!conn) { 3492 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY, 3493 MGMT_STATUS_NOT_CONNECTED); 3494 goto failed; 3495 } 3496 3497 if (conn->pending_sec_level == BT_SECURITY_HIGH && cp->pin_len != 16) { 3498 struct mgmt_cp_pin_code_neg_reply ncp; 3499 3500 memcpy(&ncp.addr, &cp->addr, sizeof(ncp.addr)); 3501 3502 bt_dev_err(hdev, "PIN code is not 16 bytes long"); 3503 3504 err = send_pin_code_neg_reply(sk, hdev, &ncp); 3505 if (err >= 0) 3506 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY, 3507 MGMT_STATUS_INVALID_PARAMS); 3508 3509 goto failed; 3510 } 3511 3512 cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_REPLY, hdev, data, len); 3513 if (!cmd) { 3514 err = -ENOMEM; 3515 goto failed; 3516 } 3517 3518 cmd->cmd_complete = addr_cmd_complete; 3519 3520 bacpy(&reply.bdaddr, &cp->addr.bdaddr); 3521 reply.pin_len = cp->pin_len; 3522 memcpy(reply.pin_code, cp->pin_code, sizeof(reply.pin_code)); 3523 3524 err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_REPLY, sizeof(reply), &reply); 3525 if (err < 0) 3526 mgmt_pending_remove(cmd); 3527 3528 failed: 3529 hci_dev_unlock(hdev); 3530 return err; 3531 } 3532 3533 static int set_io_capability(struct sock *sk, struct hci_dev *hdev, void *data, 3534 u16 len) 3535 { 3536 struct mgmt_cp_set_io_capability *cp = data; 3537 3538 bt_dev_dbg(hdev, "sock %p", sk); 3539 3540 if (cp->io_capability > SMP_IO_KEYBOARD_DISPLAY) 3541 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_IO_CAPABILITY, 3542 MGMT_STATUS_INVALID_PARAMS); 3543 3544 hci_dev_lock(hdev); 3545 3546 hdev->io_capability = cp->io_capability; 3547 3548 bt_dev_dbg(hdev, "IO capability set to 0x%02x", hdev->io_capability); 3549 3550 hci_dev_unlock(hdev); 3551 3552 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_IO_CAPABILITY, 0, 3553 NULL, 0); 3554 } 3555 3556 static struct mgmt_pending_cmd *remove_pairing(struct hci_conn *conn) 3557 { 3558 struct hci_dev *hdev = conn->hdev; 3559 struct mgmt_pending_cmd *cmd; 3560 3561 mutex_lock(&hdev->mgmt_pending_lock); 3562 3563 list_for_each_entry(cmd, &hdev->mgmt_pending, list) { 3564 if (cmd->opcode != MGMT_OP_PAIR_DEVICE) 3565 continue; 3566 3567 if (cmd->user_data != conn) 3568 continue; 3569 3570 list_del(&cmd->list); 3571 mutex_unlock(&hdev->mgmt_pending_lock); 3572 return cmd; 3573 } 3574 3575 mutex_unlock(&hdev->mgmt_pending_lock); 3576 3577 return NULL; 3578 } 3579 3580 static struct mgmt_pending_cmd *remove_pairing_by_addr(struct hci_dev *hdev, 3581 bdaddr_t *bdaddr) 3582 { 3583 struct mgmt_pending_cmd *cmd; 3584 struct hci_conn *conn; 3585 3586 mutex_lock(&hdev->mgmt_pending_lock); 3587 3588 list_for_each_entry(cmd, &hdev->mgmt_pending, list) { 3589 if (cmd->opcode != MGMT_OP_PAIR_DEVICE) 3590 continue; 3591 3592 conn = cmd->user_data; 3593 if (bacmp(bdaddr, &conn->dst) != 0) 3594 continue; 3595 3596 list_del(&cmd->list); 3597 mutex_unlock(&hdev->mgmt_pending_lock); 3598 return cmd; 3599 } 3600 3601 mutex_unlock(&hdev->mgmt_pending_lock); 3602 3603 return NULL; 3604 } 3605 3606 static int pairing_complete(struct mgmt_pending_cmd *cmd, u8 status) 3607 { 3608 struct mgmt_rp_pair_device rp; 3609 struct hci_conn *conn = cmd->user_data; 3610 int err; 3611 3612 bacpy(&rp.addr.bdaddr, &conn->dst); 3613 rp.addr.type = link_to_bdaddr(conn->type, conn->dst_type); 3614 3615 err = mgmt_cmd_complete(cmd->sk, cmd->hdev->id, MGMT_OP_PAIR_DEVICE, 3616 status, &rp, sizeof(rp)); 3617 3618 /* So we don't get further callbacks for this connection */ 3619 conn->connect_cfm_cb = NULL; 3620 conn->security_cfm_cb = NULL; 3621 conn->disconn_cfm_cb = NULL; 3622 3623 hci_conn_drop(conn); 3624 3625 /* The device is paired so there is no need to remove 3626 * its connection parameters anymore. 3627 */ 3628 clear_bit(HCI_CONN_PARAM_REMOVAL_PEND, &conn->flags); 3629 3630 hci_conn_put(conn); 3631 3632 return err; 3633 } 3634 3635 void mgmt_smp_complete(struct hci_conn *conn, bool complete) 3636 { 3637 u8 status = complete ? MGMT_STATUS_SUCCESS : MGMT_STATUS_FAILED; 3638 struct mgmt_pending_cmd *cmd; 3639 3640 cmd = remove_pairing(conn); 3641 if (cmd) { 3642 cmd->cmd_complete(cmd, status); 3643 mgmt_pending_free(cmd); 3644 } 3645 } 3646 3647 static void pairing_complete_cb(struct hci_conn *conn, u8 status) 3648 { 3649 struct mgmt_pending_cmd *cmd; 3650 3651 BT_DBG("status %u", status); 3652 3653 cmd = remove_pairing(conn); 3654 if (!cmd) { 3655 BT_DBG("Unable to find a pending command"); 3656 return; 3657 } 3658 3659 cmd->cmd_complete(cmd, mgmt_status(status)); 3660 mgmt_pending_free(cmd); 3661 } 3662 3663 static void le_pairing_complete_cb(struct hci_conn *conn, u8 status) 3664 { 3665 struct mgmt_pending_cmd *cmd; 3666 3667 BT_DBG("status %u", status); 3668 3669 if (!status) 3670 return; 3671 3672 cmd = remove_pairing(conn); 3673 if (!cmd) { 3674 BT_DBG("Unable to find a pending command"); 3675 return; 3676 } 3677 3678 cmd->cmd_complete(cmd, mgmt_status(status)); 3679 mgmt_pending_free(cmd); 3680 } 3681 3682 static int pair_device(struct sock *sk, struct hci_dev *hdev, void *data, 3683 u16 len) 3684 { 3685 struct mgmt_cp_pair_device *cp = data; 3686 struct mgmt_rp_pair_device rp; 3687 struct mgmt_pending_cmd *cmd; 3688 u8 sec_level, auth_type; 3689 struct hci_conn *conn; 3690 int err; 3691 3692 bt_dev_dbg(hdev, "sock %p", sk); 3693 3694 memset(&rp, 0, sizeof(rp)); 3695 bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr); 3696 rp.addr.type = cp->addr.type; 3697 3698 if (!bdaddr_type_is_valid(cp->addr.type)) 3699 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE, 3700 MGMT_STATUS_INVALID_PARAMS, 3701 &rp, sizeof(rp)); 3702 3703 if (cp->io_cap > SMP_IO_KEYBOARD_DISPLAY) 3704 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE, 3705 MGMT_STATUS_INVALID_PARAMS, 3706 &rp, sizeof(rp)); 3707 3708 hci_dev_lock(hdev); 3709 3710 if (!hdev_is_powered(hdev)) { 3711 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE, 3712 MGMT_STATUS_NOT_POWERED, &rp, 3713 sizeof(rp)); 3714 goto unlock; 3715 } 3716 3717 if (hci_bdaddr_is_paired(hdev, &cp->addr.bdaddr, cp->addr.type)) { 3718 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE, 3719 MGMT_STATUS_ALREADY_PAIRED, &rp, 3720 sizeof(rp)); 3721 goto unlock; 3722 } 3723 3724 sec_level = BT_SECURITY_MEDIUM; 3725 auth_type = HCI_AT_DEDICATED_BONDING; 3726 3727 if (cp->addr.type == BDADDR_BREDR) { 3728 conn = hci_connect_acl(hdev, &cp->addr.bdaddr, sec_level, 3729 auth_type, CONN_REASON_PAIR_DEVICE, 3730 HCI_ACL_CONN_TIMEOUT); 3731 } else { 3732 u8 addr_type = le_addr_type(cp->addr.type); 3733 struct hci_conn_params *p; 3734 3735 /* When pairing a new device, it is expected to remember 3736 * this device for future connections. Adding the connection 3737 * parameter information ahead of time allows tracking 3738 * of the peripheral preferred values and will speed up any 3739 * further connection establishment. 3740 * 3741 * If connection parameters already exist, then they 3742 * will be kept and this function does nothing. 3743 */ 3744 p = hci_conn_params_add(hdev, &cp->addr.bdaddr, addr_type); 3745 if (!p) { 3746 err = -EIO; 3747 goto unlock; 3748 } 3749 3750 if (p->auto_connect == HCI_AUTO_CONN_EXPLICIT) 3751 p->auto_connect = HCI_AUTO_CONN_DISABLED; 3752 3753 conn = hci_connect_le_scan(hdev, &cp->addr.bdaddr, addr_type, 3754 sec_level, HCI_LE_CONN_TIMEOUT, 3755 CONN_REASON_PAIR_DEVICE); 3756 } 3757 3758 if (IS_ERR(conn)) { 3759 int status; 3760 3761 if (PTR_ERR(conn) == -EBUSY) 3762 status = MGMT_STATUS_BUSY; 3763 else if (PTR_ERR(conn) == -EOPNOTSUPP) 3764 status = MGMT_STATUS_NOT_SUPPORTED; 3765 else if (PTR_ERR(conn) == -ECONNREFUSED) 3766 status = MGMT_STATUS_REJECTED; 3767 else 3768 status = MGMT_STATUS_CONNECT_FAILED; 3769 3770 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE, 3771 status, &rp, sizeof(rp)); 3772 goto unlock; 3773 } 3774 3775 if (conn->connect_cfm_cb) { 3776 hci_conn_drop(conn); 3777 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE, 3778 MGMT_STATUS_BUSY, &rp, sizeof(rp)); 3779 goto unlock; 3780 } 3781 3782 cmd = mgmt_pending_add(sk, MGMT_OP_PAIR_DEVICE, hdev, data, len); 3783 if (!cmd) { 3784 err = -ENOMEM; 3785 hci_conn_drop(conn); 3786 goto unlock; 3787 } 3788 3789 cmd->cmd_complete = pairing_complete; 3790 3791 /* For LE, just connecting isn't a proof that the pairing finished */ 3792 if (cp->addr.type == BDADDR_BREDR) { 3793 conn->connect_cfm_cb = pairing_complete_cb; 3794 conn->security_cfm_cb = pairing_complete_cb; 3795 conn->disconn_cfm_cb = pairing_complete_cb; 3796 } else { 3797 conn->connect_cfm_cb = le_pairing_complete_cb; 3798 conn->security_cfm_cb = le_pairing_complete_cb; 3799 conn->disconn_cfm_cb = le_pairing_complete_cb; 3800 } 3801 3802 conn->io_capability = cp->io_cap; 3803 cmd->user_data = hci_conn_get(conn); 3804 3805 if ((conn->state == BT_CONNECTED || conn->state == BT_CONFIG) && 3806 hci_conn_security(conn, sec_level, auth_type, true)) { 3807 cmd->cmd_complete(cmd, 0); 3808 mgmt_pending_remove(cmd); 3809 } 3810 3811 err = 0; 3812 3813 unlock: 3814 hci_dev_unlock(hdev); 3815 return err; 3816 } 3817 3818 static int cancel_pair_device(struct sock *sk, struct hci_dev *hdev, void *data, 3819 u16 len) 3820 { 3821 struct mgmt_addr_info *addr = data; 3822 struct mgmt_pending_cmd *cmd; 3823 struct hci_conn *conn; 3824 int err; 3825 3826 bt_dev_dbg(hdev, "sock %p", sk); 3827 3828 hci_dev_lock(hdev); 3829 3830 if (!hdev_is_powered(hdev)) { 3831 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE, 3832 MGMT_STATUS_NOT_POWERED); 3833 goto unlock; 3834 } 3835 3836 cmd = remove_pairing_by_addr(hdev, &addr->bdaddr); 3837 if (!cmd) { 3838 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE, 3839 MGMT_STATUS_INVALID_PARAMS); 3840 goto unlock; 3841 } 3842 3843 conn = hci_conn_get(cmd->user_data); 3844 3845 cmd->cmd_complete(cmd, MGMT_STATUS_CANCELLED); 3846 mgmt_pending_free(cmd); 3847 3848 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE, 0, 3849 addr, sizeof(*addr)); 3850 3851 /* Since user doesn't want to proceed with the connection, abort any 3852 * ongoing pairing and then terminate the link if it was created 3853 * because of the pair device action. 3854 */ 3855 if (addr->type == BDADDR_BREDR) 3856 hci_remove_link_key(hdev, &addr->bdaddr); 3857 else 3858 smp_cancel_and_remove_pairing(hdev, &addr->bdaddr, 3859 le_addr_type(addr->type)); 3860 3861 if (conn->conn_reason == CONN_REASON_PAIR_DEVICE) 3862 hci_abort_conn(conn, HCI_ERROR_REMOTE_USER_TERM); 3863 3864 hci_conn_put(conn); 3865 3866 unlock: 3867 hci_dev_unlock(hdev); 3868 return err; 3869 } 3870 3871 static int user_pairing_resp(struct sock *sk, struct hci_dev *hdev, 3872 struct mgmt_addr_info *addr, u16 mgmt_op, 3873 u16 hci_op, __le32 passkey) 3874 { 3875 struct mgmt_pending_cmd *cmd; 3876 struct hci_conn *conn; 3877 int err; 3878 3879 hci_dev_lock(hdev); 3880 3881 if (!hdev_is_powered(hdev)) { 3882 err = mgmt_cmd_complete(sk, hdev->id, mgmt_op, 3883 MGMT_STATUS_NOT_POWERED, addr, 3884 sizeof(*addr)); 3885 goto done; 3886 } 3887 3888 if (addr->type == BDADDR_BREDR) 3889 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &addr->bdaddr); 3890 else 3891 conn = hci_conn_hash_lookup_le(hdev, &addr->bdaddr, 3892 le_addr_type(addr->type)); 3893 3894 if (!conn) { 3895 err = mgmt_cmd_complete(sk, hdev->id, mgmt_op, 3896 MGMT_STATUS_NOT_CONNECTED, addr, 3897 sizeof(*addr)); 3898 goto done; 3899 } 3900 3901 if (addr->type == BDADDR_LE_PUBLIC || addr->type == BDADDR_LE_RANDOM) { 3902 lockdep_assert_held(&conn->hdev->lock); 3903 3904 err = smp_user_confirm_reply(conn, mgmt_op, passkey); 3905 if (!err) 3906 err = mgmt_cmd_complete(sk, hdev->id, mgmt_op, 3907 MGMT_STATUS_SUCCESS, addr, 3908 sizeof(*addr)); 3909 else 3910 err = mgmt_cmd_complete(sk, hdev->id, mgmt_op, 3911 MGMT_STATUS_FAILED, addr, 3912 sizeof(*addr)); 3913 3914 goto done; 3915 } 3916 3917 cmd = mgmt_pending_add(sk, mgmt_op, hdev, addr, sizeof(*addr)); 3918 if (!cmd) { 3919 err = -ENOMEM; 3920 goto done; 3921 } 3922 3923 cmd->cmd_complete = addr_cmd_complete; 3924 3925 /* Continue with pairing via HCI */ 3926 if (hci_op == HCI_OP_USER_PASSKEY_REPLY) { 3927 struct hci_cp_user_passkey_reply cp; 3928 3929 bacpy(&cp.bdaddr, &addr->bdaddr); 3930 cp.passkey = passkey; 3931 err = hci_send_cmd(hdev, hci_op, sizeof(cp), &cp); 3932 } else 3933 err = hci_send_cmd(hdev, hci_op, sizeof(addr->bdaddr), 3934 &addr->bdaddr); 3935 3936 if (err < 0) 3937 mgmt_pending_remove(cmd); 3938 3939 done: 3940 hci_dev_unlock(hdev); 3941 return err; 3942 } 3943 3944 static int pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev, 3945 void *data, u16 len) 3946 { 3947 struct mgmt_cp_pin_code_neg_reply *cp = data; 3948 3949 bt_dev_dbg(hdev, "sock %p", sk); 3950 3951 return user_pairing_resp(sk, hdev, &cp->addr, 3952 MGMT_OP_PIN_CODE_NEG_REPLY, 3953 HCI_OP_PIN_CODE_NEG_REPLY, 0); 3954 } 3955 3956 static int user_confirm_reply(struct sock *sk, struct hci_dev *hdev, void *data, 3957 u16 len) 3958 { 3959 struct mgmt_cp_user_confirm_reply *cp = data; 3960 3961 bt_dev_dbg(hdev, "sock %p", sk); 3962 3963 if (len != sizeof(*cp)) 3964 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_USER_CONFIRM_REPLY, 3965 MGMT_STATUS_INVALID_PARAMS); 3966 3967 return user_pairing_resp(sk, hdev, &cp->addr, 3968 MGMT_OP_USER_CONFIRM_REPLY, 3969 HCI_OP_USER_CONFIRM_REPLY, 0); 3970 } 3971 3972 static int user_confirm_neg_reply(struct sock *sk, struct hci_dev *hdev, 3973 void *data, u16 len) 3974 { 3975 struct mgmt_cp_user_confirm_neg_reply *cp = data; 3976 3977 bt_dev_dbg(hdev, "sock %p", sk); 3978 3979 return user_pairing_resp(sk, hdev, &cp->addr, 3980 MGMT_OP_USER_CONFIRM_NEG_REPLY, 3981 HCI_OP_USER_CONFIRM_NEG_REPLY, 0); 3982 } 3983 3984 static int user_passkey_reply(struct sock *sk, struct hci_dev *hdev, void *data, 3985 u16 len) 3986 { 3987 struct mgmt_cp_user_passkey_reply *cp = data; 3988 3989 bt_dev_dbg(hdev, "sock %p", sk); 3990 3991 return user_pairing_resp(sk, hdev, &cp->addr, 3992 MGMT_OP_USER_PASSKEY_REPLY, 3993 HCI_OP_USER_PASSKEY_REPLY, cp->passkey); 3994 } 3995 3996 static int user_passkey_neg_reply(struct sock *sk, struct hci_dev *hdev, 3997 void *data, u16 len) 3998 { 3999 struct mgmt_cp_user_passkey_neg_reply *cp = data; 4000 4001 bt_dev_dbg(hdev, "sock %p", sk); 4002 4003 return user_pairing_resp(sk, hdev, &cp->addr, 4004 MGMT_OP_USER_PASSKEY_NEG_REPLY, 4005 HCI_OP_USER_PASSKEY_NEG_REPLY, 0); 4006 } 4007 4008 static int adv_expire_sync(struct hci_dev *hdev, u32 flags) 4009 { 4010 struct adv_info *adv_instance; 4011 4012 adv_instance = hci_find_adv_instance(hdev, hdev->cur_adv_instance); 4013 if (!adv_instance) 4014 return 0; 4015 4016 /* stop if current instance doesn't need to be changed */ 4017 if (!(adv_instance->flags & flags)) 4018 return 0; 4019 4020 cancel_adv_timeout(hdev); 4021 4022 adv_instance = hci_get_next_instance(hdev, adv_instance->instance); 4023 if (!adv_instance) 4024 return 0; 4025 4026 hci_schedule_adv_instance_sync(hdev, adv_instance->instance, true); 4027 4028 return 0; 4029 } 4030 4031 static int name_changed_sync(struct hci_dev *hdev, void *data) 4032 { 4033 return adv_expire_sync(hdev, MGMT_ADV_FLAG_LOCAL_NAME); 4034 } 4035 4036 static void set_name_complete(struct hci_dev *hdev, void *data, int err) 4037 { 4038 struct mgmt_pending_cmd *cmd = data; 4039 struct mgmt_cp_set_local_name *cp; 4040 u8 status = mgmt_status(err); 4041 4042 bt_dev_dbg(hdev, "err %d", err); 4043 4044 if (err == -ECANCELED || !mgmt_pending_valid(hdev, cmd)) 4045 return; 4046 4047 cp = cmd->param; 4048 4049 if (status) { 4050 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 4051 status); 4052 } else { 4053 mgmt_cmd_complete(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0, 4054 cp, sizeof(*cp)); 4055 4056 if (hci_dev_test_flag(hdev, HCI_LE_ADV)) 4057 hci_cmd_sync_queue(hdev, name_changed_sync, NULL, NULL); 4058 } 4059 4060 mgmt_pending_free(cmd); 4061 } 4062 4063 static int set_name_sync(struct hci_dev *hdev, void *data) 4064 { 4065 struct mgmt_pending_cmd *cmd = data; 4066 struct mgmt_cp_set_local_name cp; 4067 4068 mutex_lock(&hdev->mgmt_pending_lock); 4069 4070 if (!__mgmt_pending_listed(hdev, cmd)) { 4071 mutex_unlock(&hdev->mgmt_pending_lock); 4072 return -ECANCELED; 4073 } 4074 4075 memcpy(&cp, cmd->param, sizeof(cp)); 4076 4077 mutex_unlock(&hdev->mgmt_pending_lock); 4078 4079 if (lmp_bredr_capable(hdev)) { 4080 hci_update_name_sync(hdev, cp.name); 4081 hci_update_eir_sync(hdev); 4082 } 4083 4084 /* The name is stored in the scan response data and so 4085 * no need to update the advertising data here. 4086 */ 4087 if (lmp_le_capable(hdev) && hci_dev_test_flag(hdev, HCI_ADVERTISING)) 4088 hci_update_scan_rsp_data_sync(hdev, hdev->cur_adv_instance); 4089 4090 return 0; 4091 } 4092 4093 static int set_local_name(struct sock *sk, struct hci_dev *hdev, void *data, 4094 u16 len) 4095 { 4096 struct mgmt_cp_set_local_name *cp = data; 4097 struct mgmt_pending_cmd *cmd; 4098 int err; 4099 4100 bt_dev_dbg(hdev, "sock %p", sk); 4101 4102 hci_dev_lock(hdev); 4103 4104 /* If the old values are the same as the new ones just return a 4105 * direct command complete event. 4106 */ 4107 if (!memcmp(hdev->dev_name, cp->name, sizeof(hdev->dev_name)) && 4108 !memcmp(hdev->short_name, cp->short_name, 4109 sizeof(hdev->short_name))) { 4110 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0, 4111 data, len); 4112 goto failed; 4113 } 4114 4115 if (hdev_is_powered(hdev) && pending_eir_or_class(hdev)) { 4116 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 4117 MGMT_STATUS_BUSY); 4118 goto failed; 4119 } 4120 4121 memcpy(hdev->short_name, cp->short_name, sizeof(hdev->short_name)); 4122 4123 if (!hdev_is_powered(hdev)) { 4124 memcpy(hdev->dev_name, cp->name, sizeof(hdev->dev_name)); 4125 4126 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0, 4127 data, len); 4128 if (err < 0) 4129 goto failed; 4130 4131 err = mgmt_limited_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, data, 4132 len, HCI_MGMT_LOCAL_NAME_EVENTS, sk); 4133 ext_info_changed(hdev, sk); 4134 4135 goto failed; 4136 } 4137 4138 cmd = mgmt_pending_add(sk, MGMT_OP_SET_LOCAL_NAME, hdev, data, len); 4139 if (!cmd) 4140 err = -ENOMEM; 4141 else 4142 err = hci_cmd_sync_queue(hdev, set_name_sync, cmd, 4143 set_name_complete); 4144 4145 if (err < 0) { 4146 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 4147 MGMT_STATUS_FAILED); 4148 4149 if (cmd) 4150 mgmt_pending_remove(cmd); 4151 4152 goto failed; 4153 } 4154 4155 memcpy(hdev->dev_name, cp->name, sizeof(hdev->dev_name)); 4156 4157 failed: 4158 hci_dev_unlock(hdev); 4159 return err; 4160 } 4161 4162 static int appearance_changed_sync(struct hci_dev *hdev, void *data) 4163 { 4164 return adv_expire_sync(hdev, MGMT_ADV_FLAG_APPEARANCE); 4165 } 4166 4167 static int set_appearance(struct sock *sk, struct hci_dev *hdev, void *data, 4168 u16 len) 4169 { 4170 struct mgmt_cp_set_appearance *cp = data; 4171 u16 appearance; 4172 int err; 4173 4174 bt_dev_dbg(hdev, "sock %p", sk); 4175 4176 if (!lmp_le_capable(hdev)) 4177 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_APPEARANCE, 4178 MGMT_STATUS_NOT_SUPPORTED); 4179 4180 appearance = le16_to_cpu(cp->appearance); 4181 4182 hci_dev_lock(hdev); 4183 4184 if (hdev->appearance != appearance) { 4185 hdev->appearance = appearance; 4186 4187 if (hci_dev_test_flag(hdev, HCI_LE_ADV)) 4188 hci_cmd_sync_queue(hdev, appearance_changed_sync, NULL, 4189 NULL); 4190 4191 ext_info_changed(hdev, sk); 4192 } 4193 4194 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_APPEARANCE, 0, NULL, 4195 0); 4196 4197 hci_dev_unlock(hdev); 4198 4199 return err; 4200 } 4201 4202 static int get_phy_configuration(struct sock *sk, struct hci_dev *hdev, 4203 void *data, u16 len) 4204 { 4205 struct mgmt_rp_get_phy_configuration rp; 4206 4207 bt_dev_dbg(hdev, "sock %p", sk); 4208 4209 hci_dev_lock(hdev); 4210 4211 memset(&rp, 0, sizeof(rp)); 4212 4213 rp.supported_phys = cpu_to_le32(get_supported_phys(hdev)); 4214 rp.selected_phys = cpu_to_le32(get_selected_phys(hdev)); 4215 rp.configurable_phys = cpu_to_le32(get_configurable_phys(hdev)); 4216 4217 hci_dev_unlock(hdev); 4218 4219 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_PHY_CONFIGURATION, 0, 4220 &rp, sizeof(rp)); 4221 } 4222 4223 int mgmt_phy_configuration_changed(struct hci_dev *hdev, struct sock *skip) 4224 { 4225 struct mgmt_ev_phy_configuration_changed ev; 4226 4227 memset(&ev, 0, sizeof(ev)); 4228 4229 ev.selected_phys = cpu_to_le32(get_selected_phys(hdev)); 4230 4231 return mgmt_event(MGMT_EV_PHY_CONFIGURATION_CHANGED, hdev, &ev, 4232 sizeof(ev), skip); 4233 } 4234 4235 static void set_default_phy_complete(struct hci_dev *hdev, void *data, int err) 4236 { 4237 struct mgmt_pending_cmd *cmd = data; 4238 struct sk_buff *skb; 4239 u8 status = mgmt_status(err); 4240 4241 skb = cmd->skb; 4242 4243 if (!status) { 4244 if (!skb) 4245 status = MGMT_STATUS_FAILED; 4246 else if (IS_ERR(skb)) 4247 status = mgmt_status(PTR_ERR(skb)); 4248 else 4249 status = mgmt_status(skb->data[0]); 4250 } 4251 4252 bt_dev_dbg(hdev, "status %d", status); 4253 4254 if (status) { 4255 mgmt_cmd_status(cmd->sk, hdev->id, 4256 MGMT_OP_SET_PHY_CONFIGURATION, status); 4257 } else { 4258 mgmt_cmd_complete(cmd->sk, hdev->id, 4259 MGMT_OP_SET_PHY_CONFIGURATION, 0, 4260 NULL, 0); 4261 4262 mgmt_phy_configuration_changed(hdev, cmd->sk); 4263 } 4264 4265 if (skb && !IS_ERR(skb)) 4266 kfree_skb(skb); 4267 4268 mgmt_pending_free(cmd); 4269 } 4270 4271 static int set_default_phy_sync(struct hci_dev *hdev, void *data) 4272 { 4273 struct mgmt_pending_cmd *cmd = data; 4274 struct mgmt_cp_set_phy_configuration *cp = cmd->param; 4275 struct hci_cp_le_set_default_phy cp_phy; 4276 u32 selected_phys; 4277 4278 selected_phys = __le32_to_cpu(cp->selected_phys); 4279 4280 memset(&cp_phy, 0, sizeof(cp_phy)); 4281 4282 if (!(selected_phys & MGMT_PHY_LE_TX_MASK)) 4283 cp_phy.all_phys |= 0x01; 4284 4285 if (!(selected_phys & MGMT_PHY_LE_RX_MASK)) 4286 cp_phy.all_phys |= 0x02; 4287 4288 if (selected_phys & MGMT_PHY_LE_1M_TX) 4289 cp_phy.tx_phys |= HCI_LE_SET_PHY_1M; 4290 4291 if (selected_phys & MGMT_PHY_LE_2M_TX) 4292 cp_phy.tx_phys |= HCI_LE_SET_PHY_2M; 4293 4294 if (selected_phys & MGMT_PHY_LE_CODED_TX) 4295 cp_phy.tx_phys |= HCI_LE_SET_PHY_CODED; 4296 4297 if (selected_phys & MGMT_PHY_LE_1M_RX) 4298 cp_phy.rx_phys |= HCI_LE_SET_PHY_1M; 4299 4300 if (selected_phys & MGMT_PHY_LE_2M_RX) 4301 cp_phy.rx_phys |= HCI_LE_SET_PHY_2M; 4302 4303 if (selected_phys & MGMT_PHY_LE_CODED_RX) 4304 cp_phy.rx_phys |= HCI_LE_SET_PHY_CODED; 4305 4306 cmd->skb = __hci_cmd_sync(hdev, HCI_OP_LE_SET_DEFAULT_PHY, 4307 sizeof(cp_phy), &cp_phy, HCI_CMD_TIMEOUT); 4308 4309 return 0; 4310 } 4311 4312 static int set_phy_configuration(struct sock *sk, struct hci_dev *hdev, 4313 void *data, u16 len) 4314 { 4315 struct mgmt_cp_set_phy_configuration *cp = data; 4316 struct mgmt_pending_cmd *cmd; 4317 u32 selected_phys, configurable_phys, supported_phys, unconfigure_phys; 4318 u16 pkt_type = (HCI_DH1 | HCI_DM1); 4319 bool changed = false; 4320 int err; 4321 4322 bt_dev_dbg(hdev, "sock %p", sk); 4323 4324 configurable_phys = get_configurable_phys(hdev); 4325 supported_phys = get_supported_phys(hdev); 4326 selected_phys = __le32_to_cpu(cp->selected_phys); 4327 4328 if (selected_phys & ~supported_phys) 4329 return mgmt_cmd_status(sk, hdev->id, 4330 MGMT_OP_SET_PHY_CONFIGURATION, 4331 MGMT_STATUS_INVALID_PARAMS); 4332 4333 unconfigure_phys = supported_phys & ~configurable_phys; 4334 4335 if ((selected_phys & unconfigure_phys) != unconfigure_phys) 4336 return mgmt_cmd_status(sk, hdev->id, 4337 MGMT_OP_SET_PHY_CONFIGURATION, 4338 MGMT_STATUS_INVALID_PARAMS); 4339 4340 if (selected_phys == get_selected_phys(hdev)) 4341 return mgmt_cmd_complete(sk, hdev->id, 4342 MGMT_OP_SET_PHY_CONFIGURATION, 4343 0, NULL, 0); 4344 4345 hci_dev_lock(hdev); 4346 4347 if (!hdev_is_powered(hdev)) { 4348 err = mgmt_cmd_status(sk, hdev->id, 4349 MGMT_OP_SET_PHY_CONFIGURATION, 4350 MGMT_STATUS_REJECTED); 4351 goto unlock; 4352 } 4353 4354 if (pending_find(MGMT_OP_SET_PHY_CONFIGURATION, hdev)) { 4355 err = mgmt_cmd_status(sk, hdev->id, 4356 MGMT_OP_SET_PHY_CONFIGURATION, 4357 MGMT_STATUS_BUSY); 4358 goto unlock; 4359 } 4360 4361 if (selected_phys & MGMT_PHY_BR_1M_3SLOT) 4362 pkt_type |= (HCI_DH3 | HCI_DM3); 4363 else 4364 pkt_type &= ~(HCI_DH3 | HCI_DM3); 4365 4366 if (selected_phys & MGMT_PHY_BR_1M_5SLOT) 4367 pkt_type |= (HCI_DH5 | HCI_DM5); 4368 else 4369 pkt_type &= ~(HCI_DH5 | HCI_DM5); 4370 4371 if (selected_phys & MGMT_PHY_EDR_2M_1SLOT) 4372 pkt_type &= ~HCI_2DH1; 4373 else 4374 pkt_type |= HCI_2DH1; 4375 4376 if (selected_phys & MGMT_PHY_EDR_2M_3SLOT) 4377 pkt_type &= ~HCI_2DH3; 4378 else 4379 pkt_type |= HCI_2DH3; 4380 4381 if (selected_phys & MGMT_PHY_EDR_2M_5SLOT) 4382 pkt_type &= ~HCI_2DH5; 4383 else 4384 pkt_type |= HCI_2DH5; 4385 4386 if (selected_phys & MGMT_PHY_EDR_3M_1SLOT) 4387 pkt_type &= ~HCI_3DH1; 4388 else 4389 pkt_type |= HCI_3DH1; 4390 4391 if (selected_phys & MGMT_PHY_EDR_3M_3SLOT) 4392 pkt_type &= ~HCI_3DH3; 4393 else 4394 pkt_type |= HCI_3DH3; 4395 4396 if (selected_phys & MGMT_PHY_EDR_3M_5SLOT) 4397 pkt_type &= ~HCI_3DH5; 4398 else 4399 pkt_type |= HCI_3DH5; 4400 4401 if (pkt_type != hdev->pkt_type) { 4402 hdev->pkt_type = pkt_type; 4403 changed = true; 4404 } 4405 4406 if ((selected_phys & MGMT_PHY_LE_MASK) == 4407 (get_selected_phys(hdev) & MGMT_PHY_LE_MASK)) { 4408 if (changed) 4409 mgmt_phy_configuration_changed(hdev, sk); 4410 4411 err = mgmt_cmd_complete(sk, hdev->id, 4412 MGMT_OP_SET_PHY_CONFIGURATION, 4413 0, NULL, 0); 4414 4415 goto unlock; 4416 } 4417 4418 cmd = mgmt_pending_new(sk, MGMT_OP_SET_PHY_CONFIGURATION, hdev, data, 4419 len); 4420 if (!cmd) 4421 err = -ENOMEM; 4422 else 4423 err = hci_cmd_sync_queue(hdev, set_default_phy_sync, cmd, 4424 set_default_phy_complete); 4425 4426 if (err < 0) { 4427 err = mgmt_cmd_status(sk, hdev->id, 4428 MGMT_OP_SET_PHY_CONFIGURATION, 4429 MGMT_STATUS_FAILED); 4430 4431 if (cmd) 4432 mgmt_pending_remove(cmd); 4433 } 4434 4435 unlock: 4436 hci_dev_unlock(hdev); 4437 4438 return err; 4439 } 4440 4441 static int set_blocked_keys(struct sock *sk, struct hci_dev *hdev, void *data, 4442 u16 len) 4443 { 4444 int err = MGMT_STATUS_SUCCESS; 4445 struct mgmt_cp_set_blocked_keys *keys = data; 4446 const u16 max_key_count = ((U16_MAX - sizeof(*keys)) / 4447 sizeof(struct mgmt_blocked_key_info)); 4448 u16 key_count, expected_len; 4449 int i; 4450 4451 bt_dev_dbg(hdev, "sock %p", sk); 4452 4453 key_count = __le16_to_cpu(keys->key_count); 4454 if (key_count > max_key_count) { 4455 bt_dev_err(hdev, "too big key_count value %u", key_count); 4456 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BLOCKED_KEYS, 4457 MGMT_STATUS_INVALID_PARAMS); 4458 } 4459 4460 expected_len = struct_size(keys, keys, key_count); 4461 if (expected_len != len) { 4462 bt_dev_err(hdev, "expected %u bytes, got %u bytes", 4463 expected_len, len); 4464 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BLOCKED_KEYS, 4465 MGMT_STATUS_INVALID_PARAMS); 4466 } 4467 4468 hci_dev_lock(hdev); 4469 4470 hci_blocked_keys_clear(hdev); 4471 4472 for (i = 0; i < key_count; ++i) { 4473 struct blocked_key *b = kzalloc_obj(*b); 4474 4475 if (!b) { 4476 err = MGMT_STATUS_NO_RESOURCES; 4477 break; 4478 } 4479 4480 b->type = keys->keys[i].type; 4481 memcpy(b->val, keys->keys[i].val, sizeof(b->val)); 4482 list_add_rcu(&b->list, &hdev->blocked_keys); 4483 } 4484 hci_dev_unlock(hdev); 4485 4486 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_BLOCKED_KEYS, 4487 err, NULL, 0); 4488 } 4489 4490 static int set_wideband_speech(struct sock *sk, struct hci_dev *hdev, 4491 void *data, u16 len) 4492 { 4493 struct mgmt_mode *cp = data; 4494 int err; 4495 bool changed = false; 4496 4497 bt_dev_dbg(hdev, "sock %p", sk); 4498 4499 if (!hci_test_quirk(hdev, HCI_QUIRK_WIDEBAND_SPEECH_SUPPORTED)) 4500 return mgmt_cmd_status(sk, hdev->id, 4501 MGMT_OP_SET_WIDEBAND_SPEECH, 4502 MGMT_STATUS_NOT_SUPPORTED); 4503 4504 if (cp->val != 0x00 && cp->val != 0x01) 4505 return mgmt_cmd_status(sk, hdev->id, 4506 MGMT_OP_SET_WIDEBAND_SPEECH, 4507 MGMT_STATUS_INVALID_PARAMS); 4508 4509 hci_dev_lock(hdev); 4510 4511 if (hdev_is_powered(hdev) && 4512 !!cp->val != hci_dev_test_flag(hdev, 4513 HCI_WIDEBAND_SPEECH_ENABLED)) { 4514 err = mgmt_cmd_status(sk, hdev->id, 4515 MGMT_OP_SET_WIDEBAND_SPEECH, 4516 MGMT_STATUS_REJECTED); 4517 goto unlock; 4518 } 4519 4520 if (cp->val) 4521 changed = !hci_dev_test_and_set_flag(hdev, 4522 HCI_WIDEBAND_SPEECH_ENABLED); 4523 else 4524 changed = hci_dev_test_and_clear_flag(hdev, 4525 HCI_WIDEBAND_SPEECH_ENABLED); 4526 4527 err = send_settings_rsp(sk, MGMT_OP_SET_WIDEBAND_SPEECH, hdev); 4528 if (err < 0) 4529 goto unlock; 4530 4531 if (changed) 4532 err = new_settings(hdev, sk); 4533 4534 unlock: 4535 hci_dev_unlock(hdev); 4536 return err; 4537 } 4538 4539 static int read_controller_cap(struct sock *sk, struct hci_dev *hdev, 4540 void *data, u16 data_len) 4541 { 4542 char buf[20]; 4543 struct mgmt_rp_read_controller_cap *rp = (void *)buf; 4544 u16 cap_len = 0; 4545 u8 flags = 0; 4546 u8 tx_power_range[2]; 4547 4548 bt_dev_dbg(hdev, "sock %p", sk); 4549 4550 memset(&buf, 0, sizeof(buf)); 4551 4552 hci_dev_lock(hdev); 4553 4554 /* When the Read Simple Pairing Options command is supported, then 4555 * the remote public key validation is supported. 4556 * 4557 * Alternatively, when Microsoft extensions are available, they can 4558 * indicate support for public key validation as well. 4559 */ 4560 if ((hdev->commands[41] & 0x08) || msft_curve_validity(hdev)) 4561 flags |= 0x01; /* Remote public key validation (BR/EDR) */ 4562 4563 flags |= 0x02; /* Remote public key validation (LE) */ 4564 4565 /* When the Read Encryption Key Size command is supported, then the 4566 * encryption key size is enforced. 4567 */ 4568 if (hdev->commands[20] & 0x10) 4569 flags |= 0x04; /* Encryption key size enforcement (BR/EDR) */ 4570 4571 flags |= 0x08; /* Encryption key size enforcement (LE) */ 4572 4573 cap_len = eir_append_data(rp->cap, cap_len, MGMT_CAP_SEC_FLAGS, 4574 &flags, 1); 4575 4576 /* When the Read Simple Pairing Options command is supported, then 4577 * also max encryption key size information is provided. 4578 */ 4579 if (hdev->commands[41] & 0x08) 4580 cap_len = eir_append_le16(rp->cap, cap_len, 4581 MGMT_CAP_MAX_ENC_KEY_SIZE, 4582 hdev->max_enc_key_size); 4583 4584 cap_len = eir_append_le16(rp->cap, cap_len, 4585 MGMT_CAP_SMP_MAX_ENC_KEY_SIZE, 4586 SMP_MAX_ENC_KEY_SIZE); 4587 4588 /* Append the min/max LE tx power parameters if we were able to fetch 4589 * it from the controller 4590 */ 4591 if (hdev->commands[38] & 0x80) { 4592 memcpy(&tx_power_range[0], &hdev->min_le_tx_power, 1); 4593 memcpy(&tx_power_range[1], &hdev->max_le_tx_power, 1); 4594 cap_len = eir_append_data(rp->cap, cap_len, MGMT_CAP_LE_TX_PWR, 4595 tx_power_range, 2); 4596 } 4597 4598 rp->cap_len = cpu_to_le16(cap_len); 4599 4600 hci_dev_unlock(hdev); 4601 4602 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_CONTROLLER_CAP, 0, 4603 rp, sizeof(*rp) + cap_len); 4604 } 4605 4606 #ifdef CONFIG_BT_FEATURE_DEBUG 4607 /* d4992530-b9ec-469f-ab01-6c481c47da1c */ 4608 static const u8 debug_uuid[16] = { 4609 0x1c, 0xda, 0x47, 0x1c, 0x48, 0x6c, 0x01, 0xab, 4610 0x9f, 0x46, 0xec, 0xb9, 0x30, 0x25, 0x99, 0xd4, 4611 }; 4612 #endif 4613 4614 /* 330859bc-7506-492d-9370-9a6f0614037f */ 4615 static const u8 quality_report_uuid[16] = { 4616 0x7f, 0x03, 0x14, 0x06, 0x6f, 0x9a, 0x70, 0x93, 4617 0x2d, 0x49, 0x06, 0x75, 0xbc, 0x59, 0x08, 0x33, 4618 }; 4619 4620 /* a6695ace-ee7f-4fb9-881a-5fac66c629af */ 4621 static const u8 offload_codecs_uuid[16] = { 4622 0xaf, 0x29, 0xc6, 0x66, 0xac, 0x5f, 0x1a, 0x88, 4623 0xb9, 0x4f, 0x7f, 0xee, 0xce, 0x5a, 0x69, 0xa6, 4624 }; 4625 4626 /* 671b10b5-42c0-4696-9227-eb28d1b049d6 */ 4627 static const u8 le_simultaneous_roles_uuid[16] = { 4628 0xd6, 0x49, 0xb0, 0xd1, 0x28, 0xeb, 0x27, 0x92, 4629 0x96, 0x46, 0xc0, 0x42, 0xb5, 0x10, 0x1b, 0x67, 4630 }; 4631 4632 /* 6fbaf188-05e0-496a-9885-d6ddfdb4e03e */ 4633 static const u8 iso_socket_uuid[16] = { 4634 0x3e, 0xe0, 0xb4, 0xfd, 0xdd, 0xd6, 0x85, 0x98, 4635 0x6a, 0x49, 0xe0, 0x05, 0x88, 0xf1, 0xba, 0x6f, 4636 }; 4637 4638 /* 2ce463d7-7a03-4d8d-bf05-5f24e8f36e76 */ 4639 static const u8 mgmt_mesh_uuid[16] = { 4640 0x76, 0x6e, 0xf3, 0xe8, 0x24, 0x5f, 0x05, 0xbf, 4641 0x8d, 0x4d, 0x03, 0x7a, 0xd7, 0x63, 0xe4, 0x2c, 4642 }; 4643 4644 static int read_exp_features_info(struct sock *sk, struct hci_dev *hdev, 4645 void *data, u16 data_len) 4646 { 4647 struct mgmt_rp_read_exp_features_info *rp; 4648 size_t len; 4649 u16 idx = 0; 4650 u32 flags; 4651 int status; 4652 4653 bt_dev_dbg(hdev, "sock %p", sk); 4654 4655 /* Enough space for 7 features */ 4656 len = sizeof(*rp) + (sizeof(rp->features[0]) * 7); 4657 rp = kzalloc(len, GFP_KERNEL); 4658 if (!rp) 4659 return -ENOMEM; 4660 4661 #ifdef CONFIG_BT_FEATURE_DEBUG 4662 flags = bt_dbg_get() ? BIT(0) : 0; 4663 4664 memcpy(rp->features[idx].uuid, debug_uuid, 16); 4665 rp->features[idx].flags = cpu_to_le32(flags); 4666 idx++; 4667 #endif 4668 4669 if (hdev && hci_dev_le_state_simultaneous(hdev)) { 4670 if (hci_dev_test_flag(hdev, HCI_LE_SIMULTANEOUS_ROLES)) 4671 flags = BIT(0); 4672 else 4673 flags = 0; 4674 4675 memcpy(rp->features[idx].uuid, le_simultaneous_roles_uuid, 16); 4676 rp->features[idx].flags = cpu_to_le32(flags); 4677 idx++; 4678 } 4679 4680 if (hdev && (aosp_has_quality_report(hdev) || 4681 hdev->set_quality_report)) { 4682 if (hci_dev_test_flag(hdev, HCI_QUALITY_REPORT)) 4683 flags = BIT(0); 4684 else 4685 flags = 0; 4686 4687 memcpy(rp->features[idx].uuid, quality_report_uuid, 16); 4688 rp->features[idx].flags = cpu_to_le32(flags); 4689 idx++; 4690 } 4691 4692 if (hdev && hdev->get_data_path_id) { 4693 if (hci_dev_test_flag(hdev, HCI_OFFLOAD_CODECS_ENABLED)) 4694 flags = BIT(0); 4695 else 4696 flags = 0; 4697 4698 memcpy(rp->features[idx].uuid, offload_codecs_uuid, 16); 4699 rp->features[idx].flags = cpu_to_le32(flags); 4700 idx++; 4701 } 4702 4703 if (IS_ENABLED(CONFIG_BT_LE)) { 4704 flags = iso_inited() ? BIT(0) : 0; 4705 memcpy(rp->features[idx].uuid, iso_socket_uuid, 16); 4706 rp->features[idx].flags = cpu_to_le32(flags); 4707 idx++; 4708 } 4709 4710 if (hdev && lmp_le_capable(hdev)) { 4711 if (hci_dev_test_flag(hdev, HCI_MESH_EXPERIMENTAL)) 4712 flags = BIT(0); 4713 else 4714 flags = 0; 4715 4716 memcpy(rp->features[idx].uuid, mgmt_mesh_uuid, 16); 4717 rp->features[idx].flags = cpu_to_le32(flags); 4718 idx++; 4719 } 4720 4721 rp->feature_count = cpu_to_le16(idx); 4722 4723 /* After reading the experimental features information, enable 4724 * the events to update client on any future change. 4725 */ 4726 hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS); 4727 4728 status = mgmt_cmd_complete(sk, hdev ? hdev->id : MGMT_INDEX_NONE, 4729 MGMT_OP_READ_EXP_FEATURES_INFO, 4730 0, rp, sizeof(*rp) + (20 * idx)); 4731 4732 kfree(rp); 4733 return status; 4734 } 4735 4736 static int exp_feature_changed(struct hci_dev *hdev, const u8 *uuid, 4737 bool enabled, struct sock *skip) 4738 { 4739 struct mgmt_ev_exp_feature_changed ev; 4740 4741 memset(&ev, 0, sizeof(ev)); 4742 memcpy(ev.uuid, uuid, 16); 4743 ev.flags = cpu_to_le32(enabled ? BIT(0) : 0); 4744 4745 return mgmt_limited_event(MGMT_EV_EXP_FEATURE_CHANGED, hdev, 4746 &ev, sizeof(ev), 4747 HCI_MGMT_EXP_FEATURE_EVENTS, skip); 4748 } 4749 4750 #define EXP_FEAT(_uuid, _set_func) \ 4751 { \ 4752 .uuid = _uuid, \ 4753 .set_func = _set_func, \ 4754 } 4755 4756 /* The zero key uuid is special. Multiple exp features are set through it. */ 4757 static int set_zero_key_func(struct sock *sk, struct hci_dev *hdev, 4758 struct mgmt_cp_set_exp_feature *cp, u16 data_len) 4759 { 4760 struct mgmt_rp_set_exp_feature rp; 4761 4762 memset(rp.uuid, 0, 16); 4763 rp.flags = cpu_to_le32(0); 4764 4765 #ifdef CONFIG_BT_FEATURE_DEBUG 4766 if (!hdev) { 4767 bool changed = bt_dbg_get(); 4768 4769 bt_dbg_set(false); 4770 4771 if (changed) 4772 exp_feature_changed(NULL, ZERO_KEY, false, sk); 4773 } 4774 #endif 4775 4776 hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS); 4777 4778 return mgmt_cmd_complete(sk, hdev ? hdev->id : MGMT_INDEX_NONE, 4779 MGMT_OP_SET_EXP_FEATURE, 0, 4780 &rp, sizeof(rp)); 4781 } 4782 4783 #ifdef CONFIG_BT_FEATURE_DEBUG 4784 static int set_debug_func(struct sock *sk, struct hci_dev *hdev, 4785 struct mgmt_cp_set_exp_feature *cp, u16 data_len) 4786 { 4787 struct mgmt_rp_set_exp_feature rp; 4788 4789 bool val, changed; 4790 int err; 4791 4792 /* Command requires to use the non-controller index */ 4793 if (hdev) 4794 return mgmt_cmd_status(sk, hdev->id, 4795 MGMT_OP_SET_EXP_FEATURE, 4796 MGMT_STATUS_INVALID_INDEX); 4797 4798 /* Parameters are limited to a single octet */ 4799 if (data_len != MGMT_SET_EXP_FEATURE_SIZE + 1) 4800 return mgmt_cmd_status(sk, MGMT_INDEX_NONE, 4801 MGMT_OP_SET_EXP_FEATURE, 4802 MGMT_STATUS_INVALID_PARAMS); 4803 4804 /* Only boolean on/off is supported */ 4805 if (cp->param[0] != 0x00 && cp->param[0] != 0x01) 4806 return mgmt_cmd_status(sk, MGMT_INDEX_NONE, 4807 MGMT_OP_SET_EXP_FEATURE, 4808 MGMT_STATUS_INVALID_PARAMS); 4809 4810 val = !!cp->param[0]; 4811 changed = val ? !bt_dbg_get() : bt_dbg_get(); 4812 bt_dbg_set(val); 4813 4814 memcpy(rp.uuid, debug_uuid, 16); 4815 rp.flags = cpu_to_le32(val ? BIT(0) : 0); 4816 4817 hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS); 4818 4819 err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE, 4820 MGMT_OP_SET_EXP_FEATURE, 0, 4821 &rp, sizeof(rp)); 4822 4823 if (changed) 4824 exp_feature_changed(hdev, debug_uuid, val, sk); 4825 4826 return err; 4827 } 4828 #endif 4829 4830 static int set_mgmt_mesh_func(struct sock *sk, struct hci_dev *hdev, 4831 struct mgmt_cp_set_exp_feature *cp, u16 data_len) 4832 { 4833 struct mgmt_rp_set_exp_feature rp; 4834 bool val, changed; 4835 int err; 4836 4837 /* Command requires to use the controller index */ 4838 if (!hdev) 4839 return mgmt_cmd_status(sk, MGMT_INDEX_NONE, 4840 MGMT_OP_SET_EXP_FEATURE, 4841 MGMT_STATUS_INVALID_INDEX); 4842 4843 /* Parameters are limited to a single octet */ 4844 if (data_len != MGMT_SET_EXP_FEATURE_SIZE + 1) 4845 return mgmt_cmd_status(sk, hdev->id, 4846 MGMT_OP_SET_EXP_FEATURE, 4847 MGMT_STATUS_INVALID_PARAMS); 4848 4849 /* Only boolean on/off is supported */ 4850 if (cp->param[0] != 0x00 && cp->param[0] != 0x01) 4851 return mgmt_cmd_status(sk, hdev->id, 4852 MGMT_OP_SET_EXP_FEATURE, 4853 MGMT_STATUS_INVALID_PARAMS); 4854 4855 val = !!cp->param[0]; 4856 4857 if (val) { 4858 changed = !hci_dev_test_and_set_flag(hdev, 4859 HCI_MESH_EXPERIMENTAL); 4860 } else { 4861 hci_dev_clear_flag(hdev, HCI_MESH); 4862 changed = hci_dev_test_and_clear_flag(hdev, 4863 HCI_MESH_EXPERIMENTAL); 4864 } 4865 4866 memcpy(rp.uuid, mgmt_mesh_uuid, 16); 4867 rp.flags = cpu_to_le32(val ? BIT(0) : 0); 4868 4869 hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS); 4870 4871 err = mgmt_cmd_complete(sk, hdev->id, 4872 MGMT_OP_SET_EXP_FEATURE, 0, 4873 &rp, sizeof(rp)); 4874 4875 if (changed) 4876 exp_feature_changed(hdev, mgmt_mesh_uuid, val, sk); 4877 4878 return err; 4879 } 4880 4881 static int set_quality_report_func(struct sock *sk, struct hci_dev *hdev, 4882 struct mgmt_cp_set_exp_feature *cp, 4883 u16 data_len) 4884 { 4885 struct mgmt_rp_set_exp_feature rp; 4886 bool val, changed; 4887 int err; 4888 4889 /* Command requires to use a valid controller index */ 4890 if (!hdev) 4891 return mgmt_cmd_status(sk, MGMT_INDEX_NONE, 4892 MGMT_OP_SET_EXP_FEATURE, 4893 MGMT_STATUS_INVALID_INDEX); 4894 4895 /* Parameters are limited to a single octet */ 4896 if (data_len != MGMT_SET_EXP_FEATURE_SIZE + 1) 4897 return mgmt_cmd_status(sk, hdev->id, 4898 MGMT_OP_SET_EXP_FEATURE, 4899 MGMT_STATUS_INVALID_PARAMS); 4900 4901 /* Only boolean on/off is supported */ 4902 if (cp->param[0] != 0x00 && cp->param[0] != 0x01) 4903 return mgmt_cmd_status(sk, hdev->id, 4904 MGMT_OP_SET_EXP_FEATURE, 4905 MGMT_STATUS_INVALID_PARAMS); 4906 4907 hci_req_sync_lock(hdev); 4908 4909 val = !!cp->param[0]; 4910 changed = (val != hci_dev_test_flag(hdev, HCI_QUALITY_REPORT)); 4911 4912 if (!aosp_has_quality_report(hdev) && !hdev->set_quality_report) { 4913 err = mgmt_cmd_status(sk, hdev->id, 4914 MGMT_OP_SET_EXP_FEATURE, 4915 MGMT_STATUS_NOT_SUPPORTED); 4916 goto unlock_quality_report; 4917 } 4918 4919 if (changed) { 4920 if (hdev->set_quality_report) 4921 err = hdev->set_quality_report(hdev, val); 4922 else 4923 err = aosp_set_quality_report(hdev, val); 4924 4925 if (err) { 4926 err = mgmt_cmd_status(sk, hdev->id, 4927 MGMT_OP_SET_EXP_FEATURE, 4928 MGMT_STATUS_FAILED); 4929 goto unlock_quality_report; 4930 } 4931 4932 if (val) 4933 hci_dev_set_flag(hdev, HCI_QUALITY_REPORT); 4934 else 4935 hci_dev_clear_flag(hdev, HCI_QUALITY_REPORT); 4936 } 4937 4938 bt_dev_dbg(hdev, "quality report enable %d changed %d", val, changed); 4939 4940 memcpy(rp.uuid, quality_report_uuid, 16); 4941 rp.flags = cpu_to_le32(val ? BIT(0) : 0); 4942 hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS); 4943 4944 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_EXP_FEATURE, 0, 4945 &rp, sizeof(rp)); 4946 4947 if (changed) 4948 exp_feature_changed(hdev, quality_report_uuid, val, sk); 4949 4950 unlock_quality_report: 4951 hci_req_sync_unlock(hdev); 4952 return err; 4953 } 4954 4955 static int set_offload_codec_func(struct sock *sk, struct hci_dev *hdev, 4956 struct mgmt_cp_set_exp_feature *cp, 4957 u16 data_len) 4958 { 4959 bool val, changed; 4960 int err; 4961 struct mgmt_rp_set_exp_feature rp; 4962 4963 /* Command requires to use a valid controller index */ 4964 if (!hdev) 4965 return mgmt_cmd_status(sk, MGMT_INDEX_NONE, 4966 MGMT_OP_SET_EXP_FEATURE, 4967 MGMT_STATUS_INVALID_INDEX); 4968 4969 /* Parameters are limited to a single octet */ 4970 if (data_len != MGMT_SET_EXP_FEATURE_SIZE + 1) 4971 return mgmt_cmd_status(sk, hdev->id, 4972 MGMT_OP_SET_EXP_FEATURE, 4973 MGMT_STATUS_INVALID_PARAMS); 4974 4975 /* Only boolean on/off is supported */ 4976 if (cp->param[0] != 0x00 && cp->param[0] != 0x01) 4977 return mgmt_cmd_status(sk, hdev->id, 4978 MGMT_OP_SET_EXP_FEATURE, 4979 MGMT_STATUS_INVALID_PARAMS); 4980 4981 val = !!cp->param[0]; 4982 changed = (val != hci_dev_test_flag(hdev, HCI_OFFLOAD_CODECS_ENABLED)); 4983 4984 if (!hdev->get_data_path_id) { 4985 return mgmt_cmd_status(sk, hdev->id, 4986 MGMT_OP_SET_EXP_FEATURE, 4987 MGMT_STATUS_NOT_SUPPORTED); 4988 } 4989 4990 if (changed) { 4991 if (val) 4992 hci_dev_set_flag(hdev, HCI_OFFLOAD_CODECS_ENABLED); 4993 else 4994 hci_dev_clear_flag(hdev, HCI_OFFLOAD_CODECS_ENABLED); 4995 } 4996 4997 bt_dev_info(hdev, "offload codecs enable %d changed %d", 4998 val, changed); 4999 5000 memcpy(rp.uuid, offload_codecs_uuid, 16); 5001 rp.flags = cpu_to_le32(val ? BIT(0) : 0); 5002 hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS); 5003 err = mgmt_cmd_complete(sk, hdev->id, 5004 MGMT_OP_SET_EXP_FEATURE, 0, 5005 &rp, sizeof(rp)); 5006 5007 if (changed) 5008 exp_feature_changed(hdev, offload_codecs_uuid, val, sk); 5009 5010 return err; 5011 } 5012 5013 static int set_le_simultaneous_roles_func(struct sock *sk, struct hci_dev *hdev, 5014 struct mgmt_cp_set_exp_feature *cp, 5015 u16 data_len) 5016 { 5017 bool val, changed; 5018 int err; 5019 struct mgmt_rp_set_exp_feature rp; 5020 5021 /* Command requires to use a valid controller index */ 5022 if (!hdev) 5023 return mgmt_cmd_status(sk, MGMT_INDEX_NONE, 5024 MGMT_OP_SET_EXP_FEATURE, 5025 MGMT_STATUS_INVALID_INDEX); 5026 5027 /* Parameters are limited to a single octet */ 5028 if (data_len != MGMT_SET_EXP_FEATURE_SIZE + 1) 5029 return mgmt_cmd_status(sk, hdev->id, 5030 MGMT_OP_SET_EXP_FEATURE, 5031 MGMT_STATUS_INVALID_PARAMS); 5032 5033 /* Only boolean on/off is supported */ 5034 if (cp->param[0] != 0x00 && cp->param[0] != 0x01) 5035 return mgmt_cmd_status(sk, hdev->id, 5036 MGMT_OP_SET_EXP_FEATURE, 5037 MGMT_STATUS_INVALID_PARAMS); 5038 5039 val = !!cp->param[0]; 5040 changed = (val != hci_dev_test_flag(hdev, HCI_LE_SIMULTANEOUS_ROLES)); 5041 5042 if (!hci_dev_le_state_simultaneous(hdev)) { 5043 return mgmt_cmd_status(sk, hdev->id, 5044 MGMT_OP_SET_EXP_FEATURE, 5045 MGMT_STATUS_NOT_SUPPORTED); 5046 } 5047 5048 if (changed) { 5049 if (val) 5050 hci_dev_set_flag(hdev, HCI_LE_SIMULTANEOUS_ROLES); 5051 else 5052 hci_dev_clear_flag(hdev, HCI_LE_SIMULTANEOUS_ROLES); 5053 } 5054 5055 bt_dev_info(hdev, "LE simultaneous roles enable %d changed %d", 5056 val, changed); 5057 5058 memcpy(rp.uuid, le_simultaneous_roles_uuid, 16); 5059 rp.flags = cpu_to_le32(val ? BIT(0) : 0); 5060 hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS); 5061 err = mgmt_cmd_complete(sk, hdev->id, 5062 MGMT_OP_SET_EXP_FEATURE, 0, 5063 &rp, sizeof(rp)); 5064 5065 if (changed) 5066 exp_feature_changed(hdev, le_simultaneous_roles_uuid, val, sk); 5067 5068 return err; 5069 } 5070 5071 #ifdef CONFIG_BT_LE 5072 static int set_iso_socket_func(struct sock *sk, struct hci_dev *hdev, 5073 struct mgmt_cp_set_exp_feature *cp, u16 data_len) 5074 { 5075 struct mgmt_rp_set_exp_feature rp; 5076 bool val, changed = false; 5077 int err; 5078 5079 /* Command requires to use the non-controller index */ 5080 if (hdev) 5081 return mgmt_cmd_status(sk, hdev->id, 5082 MGMT_OP_SET_EXP_FEATURE, 5083 MGMT_STATUS_INVALID_INDEX); 5084 5085 /* Parameters are limited to a single octet */ 5086 if (data_len != MGMT_SET_EXP_FEATURE_SIZE + 1) 5087 return mgmt_cmd_status(sk, MGMT_INDEX_NONE, 5088 MGMT_OP_SET_EXP_FEATURE, 5089 MGMT_STATUS_INVALID_PARAMS); 5090 5091 /* Only boolean on/off is supported */ 5092 if (cp->param[0] != 0x00 && cp->param[0] != 0x01) 5093 return mgmt_cmd_status(sk, MGMT_INDEX_NONE, 5094 MGMT_OP_SET_EXP_FEATURE, 5095 MGMT_STATUS_INVALID_PARAMS); 5096 5097 val = cp->param[0] ? true : false; 5098 if (val) 5099 err = iso_init(); 5100 else 5101 err = iso_exit(); 5102 5103 if (!err) 5104 changed = true; 5105 5106 memcpy(rp.uuid, iso_socket_uuid, 16); 5107 rp.flags = cpu_to_le32(val ? BIT(0) : 0); 5108 5109 hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS); 5110 5111 err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE, 5112 MGMT_OP_SET_EXP_FEATURE, 0, 5113 &rp, sizeof(rp)); 5114 5115 if (changed) 5116 exp_feature_changed(hdev, iso_socket_uuid, val, sk); 5117 5118 return err; 5119 } 5120 #endif 5121 5122 static const struct mgmt_exp_feature { 5123 const u8 *uuid; 5124 int (*set_func)(struct sock *sk, struct hci_dev *hdev, 5125 struct mgmt_cp_set_exp_feature *cp, u16 data_len); 5126 } exp_features[] = { 5127 EXP_FEAT(ZERO_KEY, set_zero_key_func), 5128 #ifdef CONFIG_BT_FEATURE_DEBUG 5129 EXP_FEAT(debug_uuid, set_debug_func), 5130 #endif 5131 EXP_FEAT(mgmt_mesh_uuid, set_mgmt_mesh_func), 5132 EXP_FEAT(quality_report_uuid, set_quality_report_func), 5133 EXP_FEAT(offload_codecs_uuid, set_offload_codec_func), 5134 EXP_FEAT(le_simultaneous_roles_uuid, set_le_simultaneous_roles_func), 5135 #ifdef CONFIG_BT_LE 5136 EXP_FEAT(iso_socket_uuid, set_iso_socket_func), 5137 #endif 5138 5139 /* end with a null feature */ 5140 EXP_FEAT(NULL, NULL) 5141 }; 5142 5143 static int set_exp_feature(struct sock *sk, struct hci_dev *hdev, 5144 void *data, u16 data_len) 5145 { 5146 struct mgmt_cp_set_exp_feature *cp = data; 5147 size_t i = 0; 5148 5149 bt_dev_dbg(hdev, "sock %p", sk); 5150 5151 for (i = 0; exp_features[i].uuid; i++) { 5152 if (!memcmp(cp->uuid, exp_features[i].uuid, 16)) 5153 return exp_features[i].set_func(sk, hdev, cp, data_len); 5154 } 5155 5156 return mgmt_cmd_status(sk, hdev ? hdev->id : MGMT_INDEX_NONE, 5157 MGMT_OP_SET_EXP_FEATURE, 5158 MGMT_STATUS_NOT_SUPPORTED); 5159 } 5160 5161 static int get_device_flags(struct sock *sk, struct hci_dev *hdev, void *data, 5162 u16 data_len) 5163 { 5164 struct mgmt_cp_get_device_flags *cp = data; 5165 struct mgmt_rp_get_device_flags rp; 5166 struct bdaddr_list_with_flags *br_params; 5167 struct hci_conn_params *params; 5168 u32 supported_flags; 5169 u32 current_flags = 0; 5170 u8 status = MGMT_STATUS_INVALID_PARAMS; 5171 5172 bt_dev_dbg(hdev, "Get device flags %pMR (type 0x%x)\n", 5173 &cp->addr.bdaddr, cp->addr.type); 5174 5175 hci_dev_lock(hdev); 5176 5177 supported_flags = hdev->conn_flags; 5178 5179 memset(&rp, 0, sizeof(rp)); 5180 5181 if (cp->addr.type == BDADDR_BREDR) { 5182 br_params = hci_bdaddr_list_lookup_with_flags(&hdev->accept_list, 5183 &cp->addr.bdaddr, 5184 cp->addr.type); 5185 if (!br_params) 5186 goto done; 5187 5188 current_flags = br_params->flags; 5189 } else { 5190 params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr, 5191 le_addr_type(cp->addr.type)); 5192 if (!params) 5193 goto done; 5194 5195 current_flags = params->flags; 5196 } 5197 5198 bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr); 5199 rp.addr.type = cp->addr.type; 5200 rp.supported_flags = cpu_to_le32(supported_flags); 5201 rp.current_flags = cpu_to_le32(current_flags); 5202 5203 status = MGMT_STATUS_SUCCESS; 5204 5205 done: 5206 hci_dev_unlock(hdev); 5207 5208 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_DEVICE_FLAGS, status, 5209 &rp, sizeof(rp)); 5210 } 5211 5212 static void device_flags_changed(struct sock *sk, struct hci_dev *hdev, 5213 bdaddr_t *bdaddr, u8 bdaddr_type, 5214 u32 supported_flags, u32 current_flags) 5215 { 5216 struct mgmt_ev_device_flags_changed ev; 5217 5218 bacpy(&ev.addr.bdaddr, bdaddr); 5219 ev.addr.type = bdaddr_type; 5220 ev.supported_flags = cpu_to_le32(supported_flags); 5221 ev.current_flags = cpu_to_le32(current_flags); 5222 5223 mgmt_event(MGMT_EV_DEVICE_FLAGS_CHANGED, hdev, &ev, sizeof(ev), sk); 5224 } 5225 5226 static bool is_connected(struct hci_dev *hdev, bdaddr_t *addr, u8 type) 5227 { 5228 struct hci_conn *conn; 5229 5230 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, addr); 5231 if (!conn) 5232 return false; 5233 5234 if (conn->dst_type != type) 5235 return false; 5236 5237 if (conn->state != BT_CONNECTED) 5238 return false; 5239 5240 return true; 5241 } 5242 5243 /* This function requires the caller holds hdev->lock */ 5244 static struct hci_conn_params *hci_conn_params_set(struct hci_dev *hdev, 5245 bdaddr_t *addr, u8 addr_type, 5246 u8 auto_connect) 5247 { 5248 struct hci_conn_params *params; 5249 5250 params = hci_conn_params_add(hdev, addr, addr_type); 5251 if (!params) 5252 return NULL; 5253 5254 if (params->auto_connect == auto_connect) 5255 return params; 5256 5257 hci_pend_le_list_del_init(params); 5258 5259 switch (auto_connect) { 5260 case HCI_AUTO_CONN_DISABLED: 5261 case HCI_AUTO_CONN_LINK_LOSS: 5262 /* If auto connect is being disabled when we're trying to 5263 * connect to device, keep connecting. 5264 */ 5265 if (params->explicit_connect) 5266 hci_pend_le_list_add(params, &hdev->pend_le_conns); 5267 break; 5268 case HCI_AUTO_CONN_REPORT: 5269 if (params->explicit_connect) 5270 hci_pend_le_list_add(params, &hdev->pend_le_conns); 5271 else 5272 hci_pend_le_list_add(params, &hdev->pend_le_reports); 5273 break; 5274 case HCI_AUTO_CONN_DIRECT: 5275 case HCI_AUTO_CONN_ALWAYS: 5276 if (!is_connected(hdev, addr, addr_type)) 5277 hci_pend_le_list_add(params, &hdev->pend_le_conns); 5278 break; 5279 } 5280 5281 params->auto_connect = auto_connect; 5282 5283 bt_dev_dbg(hdev, "addr %pMR (type %u) auto_connect %u", 5284 addr, addr_type, auto_connect); 5285 5286 return params; 5287 } 5288 5289 static int set_device_flags(struct sock *sk, struct hci_dev *hdev, void *data, 5290 u16 len) 5291 { 5292 struct mgmt_cp_set_device_flags *cp = data; 5293 struct bdaddr_list_with_flags *br_params; 5294 struct hci_conn_params *params; 5295 u8 status = MGMT_STATUS_INVALID_PARAMS; 5296 u32 supported_flags; 5297 u32 current_flags = __le32_to_cpu(cp->current_flags); 5298 5299 bt_dev_dbg(hdev, "Set device flags %pMR (type 0x%x) = 0x%x", 5300 &cp->addr.bdaddr, cp->addr.type, current_flags); 5301 5302 // We should take hci_dev_lock() early, I think.. conn_flags can change 5303 supported_flags = hdev->conn_flags; 5304 5305 if ((supported_flags | current_flags) != supported_flags) { 5306 bt_dev_warn(hdev, "Bad flag given (0x%x) vs supported (0x%0x)", 5307 current_flags, supported_flags); 5308 goto done; 5309 } 5310 5311 hci_dev_lock(hdev); 5312 5313 if (cp->addr.type == BDADDR_BREDR) { 5314 br_params = hci_bdaddr_list_lookup_with_flags(&hdev->accept_list, 5315 &cp->addr.bdaddr, 5316 cp->addr.type); 5317 5318 if (br_params) { 5319 br_params->flags = current_flags; 5320 status = MGMT_STATUS_SUCCESS; 5321 } else { 5322 bt_dev_warn(hdev, "No such BR/EDR device %pMR (0x%x)", 5323 &cp->addr.bdaddr, cp->addr.type); 5324 } 5325 5326 goto unlock; 5327 } 5328 5329 params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr, 5330 le_addr_type(cp->addr.type)); 5331 if (!params) { 5332 /* Create a new hci_conn_params if it doesn't exist */ 5333 params = hci_conn_params_set(hdev, &cp->addr.bdaddr, 5334 le_addr_type(cp->addr.type), 5335 HCI_AUTO_CONN_DISABLED); 5336 if (!params) { 5337 bt_dev_warn(hdev, "No such LE device %pMR (0x%x)", 5338 &cp->addr.bdaddr, 5339 le_addr_type(cp->addr.type)); 5340 goto unlock; 5341 } 5342 } 5343 5344 supported_flags = hdev->conn_flags; 5345 5346 if ((supported_flags | current_flags) != supported_flags) { 5347 bt_dev_warn(hdev, "Bad flag given (0x%x) vs supported (0x%0x)", 5348 current_flags, supported_flags); 5349 goto unlock; 5350 } 5351 5352 WRITE_ONCE(params->flags, current_flags); 5353 status = MGMT_STATUS_SUCCESS; 5354 5355 /* Update passive scan if HCI_CONN_FLAG_DEVICE_PRIVACY 5356 * has been set. 5357 */ 5358 if (params->flags & HCI_CONN_FLAG_DEVICE_PRIVACY) 5359 hci_update_passive_scan(hdev); 5360 5361 unlock: 5362 hci_dev_unlock(hdev); 5363 5364 done: 5365 if (status == MGMT_STATUS_SUCCESS) 5366 device_flags_changed(sk, hdev, &cp->addr.bdaddr, cp->addr.type, 5367 supported_flags, current_flags); 5368 5369 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_DEVICE_FLAGS, status, 5370 &cp->addr, sizeof(cp->addr)); 5371 } 5372 5373 static void mgmt_adv_monitor_added(struct sock *sk, struct hci_dev *hdev, 5374 u16 handle) 5375 { 5376 struct mgmt_ev_adv_monitor_added ev; 5377 5378 ev.monitor_handle = cpu_to_le16(handle); 5379 5380 mgmt_event(MGMT_EV_ADV_MONITOR_ADDED, hdev, &ev, sizeof(ev), sk); 5381 } 5382 5383 static void mgmt_adv_monitor_removed(struct sock *sk, struct hci_dev *hdev, 5384 __le16 handle) 5385 { 5386 struct mgmt_ev_adv_monitor_removed ev; 5387 5388 ev.monitor_handle = handle; 5389 5390 mgmt_event(MGMT_EV_ADV_MONITOR_REMOVED, hdev, &ev, sizeof(ev), sk); 5391 } 5392 5393 static int read_adv_mon_features(struct sock *sk, struct hci_dev *hdev, 5394 void *data, u16 len) 5395 { 5396 struct adv_monitor *monitor = NULL; 5397 struct mgmt_rp_read_adv_monitor_features *rp = NULL; 5398 int handle, err; 5399 size_t rp_size = 0; 5400 __u32 supported = 0; 5401 __u32 enabled = 0; 5402 __u16 num_handles = 0; 5403 __u16 handles[HCI_MAX_ADV_MONITOR_NUM_HANDLES]; 5404 5405 BT_DBG("request for %s", hdev->name); 5406 5407 hci_dev_lock(hdev); 5408 5409 if (msft_monitor_supported(hdev)) 5410 supported |= MGMT_ADV_MONITOR_FEATURE_MASK_OR_PATTERNS; 5411 5412 idr_for_each_entry(&hdev->adv_monitors_idr, monitor, handle) 5413 handles[num_handles++] = monitor->handle; 5414 5415 hci_dev_unlock(hdev); 5416 5417 rp_size = sizeof(*rp) + (num_handles * sizeof(u16)); 5418 rp = kmalloc(rp_size, GFP_KERNEL); 5419 if (!rp) 5420 return -ENOMEM; 5421 5422 /* All supported features are currently enabled */ 5423 enabled = supported; 5424 5425 rp->supported_features = cpu_to_le32(supported); 5426 rp->enabled_features = cpu_to_le32(enabled); 5427 rp->max_num_handles = cpu_to_le16(HCI_MAX_ADV_MONITOR_NUM_HANDLES); 5428 rp->max_num_patterns = HCI_MAX_ADV_MONITOR_NUM_PATTERNS; 5429 rp->num_handles = cpu_to_le16(num_handles); 5430 if (num_handles) 5431 memcpy(&rp->handles, &handles, (num_handles * sizeof(u16))); 5432 5433 err = mgmt_cmd_complete(sk, hdev->id, 5434 MGMT_OP_READ_ADV_MONITOR_FEATURES, 5435 MGMT_STATUS_SUCCESS, rp, rp_size); 5436 5437 kfree(rp); 5438 5439 return err; 5440 } 5441 5442 static void mgmt_add_adv_patterns_monitor_complete(struct hci_dev *hdev, 5443 void *data, int status) 5444 { 5445 struct mgmt_rp_add_adv_patterns_monitor rp; 5446 struct mgmt_pending_cmd *cmd = data; 5447 struct adv_monitor *monitor; 5448 5449 /* This is likely the result of hdev being closed and mgmt_index_removed 5450 * is attempting to clean up any pending command so 5451 * hci_adv_monitors_clear is about to be called which will take care of 5452 * freeing the adv_monitor instances. 5453 */ 5454 if (status == -ECANCELED || !mgmt_pending_valid(hdev, cmd)) 5455 return; 5456 5457 monitor = cmd->user_data; 5458 5459 hci_dev_lock(hdev); 5460 5461 rp.monitor_handle = cpu_to_le16(monitor->handle); 5462 5463 if (!status) { 5464 mgmt_adv_monitor_added(cmd->sk, hdev, monitor->handle); 5465 hdev->adv_monitors_cnt++; 5466 if (monitor->state == ADV_MONITOR_STATE_NOT_REGISTERED) 5467 monitor->state = ADV_MONITOR_STATE_REGISTERED; 5468 hci_update_passive_scan(hdev); 5469 } else { 5470 hci_free_adv_monitor(hdev, monitor); 5471 } 5472 5473 mgmt_cmd_complete(cmd->sk, cmd->hdev->id, cmd->opcode, 5474 mgmt_status(status), &rp, sizeof(rp)); 5475 mgmt_pending_free(cmd); 5476 5477 hci_dev_unlock(hdev); 5478 bt_dev_dbg(hdev, "add monitor %d complete, status %d", 5479 rp.monitor_handle, status); 5480 } 5481 5482 static int mgmt_add_adv_patterns_monitor_sync(struct hci_dev *hdev, void *data) 5483 { 5484 struct mgmt_pending_cmd *cmd = data; 5485 struct adv_monitor *mon; 5486 5487 mutex_lock(&hdev->mgmt_pending_lock); 5488 5489 if (!__mgmt_pending_listed(hdev, cmd)) { 5490 mutex_unlock(&hdev->mgmt_pending_lock); 5491 return -ECANCELED; 5492 } 5493 5494 mon = cmd->user_data; 5495 5496 mutex_unlock(&hdev->mgmt_pending_lock); 5497 5498 return hci_add_adv_monitor(hdev, mon); 5499 } 5500 5501 static int __add_adv_patterns_monitor(struct sock *sk, struct hci_dev *hdev, 5502 struct adv_monitor *m, u8 status, 5503 void *data, u16 len, u16 op) 5504 { 5505 struct mgmt_pending_cmd *cmd; 5506 int err; 5507 5508 hci_dev_lock(hdev); 5509 5510 if (status) 5511 goto unlock; 5512 5513 if (pending_find(MGMT_OP_SET_LE, hdev) || 5514 pending_find(MGMT_OP_ADD_ADV_PATTERNS_MONITOR, hdev) || 5515 pending_find(MGMT_OP_ADD_ADV_PATTERNS_MONITOR_RSSI, hdev)) { 5516 status = MGMT_STATUS_BUSY; 5517 goto unlock; 5518 } 5519 5520 cmd = mgmt_pending_add(sk, op, hdev, data, len); 5521 if (!cmd) { 5522 status = MGMT_STATUS_NO_RESOURCES; 5523 goto unlock; 5524 } 5525 5526 cmd->user_data = m; 5527 err = hci_cmd_sync_queue(hdev, mgmt_add_adv_patterns_monitor_sync, cmd, 5528 mgmt_add_adv_patterns_monitor_complete); 5529 if (err) { 5530 if (err == -ENOMEM) 5531 status = MGMT_STATUS_NO_RESOURCES; 5532 else 5533 status = MGMT_STATUS_FAILED; 5534 5535 goto unlock; 5536 } 5537 5538 hci_dev_unlock(hdev); 5539 5540 return 0; 5541 5542 unlock: 5543 hci_free_adv_monitor(hdev, m); 5544 hci_dev_unlock(hdev); 5545 return mgmt_cmd_status(sk, hdev->id, op, status); 5546 } 5547 5548 static void parse_adv_monitor_rssi(struct adv_monitor *m, 5549 struct mgmt_adv_rssi_thresholds *rssi) 5550 { 5551 if (rssi) { 5552 m->rssi.low_threshold = rssi->low_threshold; 5553 m->rssi.low_threshold_timeout = 5554 __le16_to_cpu(rssi->low_threshold_timeout); 5555 m->rssi.high_threshold = rssi->high_threshold; 5556 m->rssi.high_threshold_timeout = 5557 __le16_to_cpu(rssi->high_threshold_timeout); 5558 m->rssi.sampling_period = rssi->sampling_period; 5559 } else { 5560 /* Default values. These numbers are the least constricting 5561 * parameters for MSFT API to work, so it behaves as if there 5562 * are no rssi parameter to consider. May need to be changed 5563 * if other API are to be supported. 5564 */ 5565 m->rssi.low_threshold = -127; 5566 m->rssi.low_threshold_timeout = 60; 5567 m->rssi.high_threshold = -127; 5568 m->rssi.high_threshold_timeout = 0; 5569 m->rssi.sampling_period = 0; 5570 } 5571 } 5572 5573 static u8 parse_adv_monitor_pattern(struct adv_monitor *m, u8 pattern_count, 5574 struct mgmt_adv_pattern *patterns) 5575 { 5576 u8 offset = 0, length = 0; 5577 struct adv_pattern *p = NULL; 5578 int i; 5579 5580 for (i = 0; i < pattern_count; i++) { 5581 offset = patterns[i].offset; 5582 length = patterns[i].length; 5583 if (offset >= HCI_MAX_AD_LENGTH || 5584 length > HCI_MAX_AD_LENGTH || 5585 (offset + length) > HCI_MAX_AD_LENGTH) 5586 return MGMT_STATUS_INVALID_PARAMS; 5587 5588 p = kmalloc_obj(*p); 5589 if (!p) 5590 return MGMT_STATUS_NO_RESOURCES; 5591 5592 p->ad_type = patterns[i].ad_type; 5593 p->offset = patterns[i].offset; 5594 p->length = patterns[i].length; 5595 memcpy(p->value, patterns[i].value, p->length); 5596 5597 INIT_LIST_HEAD(&p->list); 5598 list_add(&p->list, &m->patterns); 5599 } 5600 5601 return MGMT_STATUS_SUCCESS; 5602 } 5603 5604 static int add_adv_patterns_monitor(struct sock *sk, struct hci_dev *hdev, 5605 void *data, u16 len) 5606 { 5607 struct mgmt_cp_add_adv_patterns_monitor *cp = data; 5608 struct adv_monitor *m = NULL; 5609 u8 status = MGMT_STATUS_SUCCESS; 5610 size_t expected_size = sizeof(*cp); 5611 5612 BT_DBG("request for %s", hdev->name); 5613 5614 if (len <= sizeof(*cp)) { 5615 status = MGMT_STATUS_INVALID_PARAMS; 5616 goto done; 5617 } 5618 5619 expected_size += cp->pattern_count * sizeof(struct mgmt_adv_pattern); 5620 if (len != expected_size) { 5621 status = MGMT_STATUS_INVALID_PARAMS; 5622 goto done; 5623 } 5624 5625 m = kzalloc_obj(*m); 5626 if (!m) { 5627 status = MGMT_STATUS_NO_RESOURCES; 5628 goto done; 5629 } 5630 5631 INIT_LIST_HEAD(&m->patterns); 5632 5633 parse_adv_monitor_rssi(m, NULL); 5634 status = parse_adv_monitor_pattern(m, cp->pattern_count, cp->patterns); 5635 5636 done: 5637 return __add_adv_patterns_monitor(sk, hdev, m, status, data, len, 5638 MGMT_OP_ADD_ADV_PATTERNS_MONITOR); 5639 } 5640 5641 static int add_adv_patterns_monitor_rssi(struct sock *sk, struct hci_dev *hdev, 5642 void *data, u16 len) 5643 { 5644 struct mgmt_cp_add_adv_patterns_monitor_rssi *cp = data; 5645 struct adv_monitor *m = NULL; 5646 u8 status = MGMT_STATUS_SUCCESS; 5647 size_t expected_size = sizeof(*cp); 5648 5649 BT_DBG("request for %s", hdev->name); 5650 5651 if (len <= sizeof(*cp)) { 5652 status = MGMT_STATUS_INVALID_PARAMS; 5653 goto done; 5654 } 5655 5656 expected_size += cp->pattern_count * sizeof(struct mgmt_adv_pattern); 5657 if (len != expected_size) { 5658 status = MGMT_STATUS_INVALID_PARAMS; 5659 goto done; 5660 } 5661 5662 m = kzalloc_obj(*m); 5663 if (!m) { 5664 status = MGMT_STATUS_NO_RESOURCES; 5665 goto done; 5666 } 5667 5668 INIT_LIST_HEAD(&m->patterns); 5669 5670 parse_adv_monitor_rssi(m, &cp->rssi); 5671 status = parse_adv_monitor_pattern(m, cp->pattern_count, cp->patterns); 5672 5673 done: 5674 return __add_adv_patterns_monitor(sk, hdev, m, status, data, len, 5675 MGMT_OP_ADD_ADV_PATTERNS_MONITOR_RSSI); 5676 } 5677 5678 static void mgmt_remove_adv_monitor_complete(struct hci_dev *hdev, 5679 void *data, int status) 5680 { 5681 struct mgmt_rp_remove_adv_monitor rp; 5682 struct mgmt_pending_cmd *cmd = data; 5683 struct mgmt_cp_remove_adv_monitor *cp; 5684 5685 if (status == -ECANCELED) 5686 return; 5687 5688 hci_dev_lock(hdev); 5689 5690 cp = cmd->param; 5691 5692 rp.monitor_handle = cp->monitor_handle; 5693 5694 if (!status) { 5695 mgmt_adv_monitor_removed(cmd->sk, hdev, cp->monitor_handle); 5696 hci_update_passive_scan(hdev); 5697 } 5698 5699 mgmt_cmd_complete(cmd->sk, cmd->hdev->id, cmd->opcode, 5700 mgmt_status(status), &rp, sizeof(rp)); 5701 mgmt_pending_free(cmd); 5702 5703 hci_dev_unlock(hdev); 5704 bt_dev_dbg(hdev, "remove monitor %d complete, status %d", 5705 rp.monitor_handle, status); 5706 } 5707 5708 static int mgmt_remove_adv_monitor_sync(struct hci_dev *hdev, void *data) 5709 { 5710 struct mgmt_pending_cmd *cmd = data; 5711 struct mgmt_cp_remove_adv_monitor *cp = cmd->param; 5712 u16 handle = __le16_to_cpu(cp->monitor_handle); 5713 5714 if (!handle) 5715 return hci_remove_all_adv_monitor(hdev); 5716 5717 return hci_remove_single_adv_monitor(hdev, handle); 5718 } 5719 5720 static int remove_adv_monitor(struct sock *sk, struct hci_dev *hdev, 5721 void *data, u16 len) 5722 { 5723 struct mgmt_pending_cmd *cmd; 5724 int err, status; 5725 5726 hci_dev_lock(hdev); 5727 5728 if (pending_find(MGMT_OP_SET_LE, hdev) || 5729 pending_find(MGMT_OP_ADD_ADV_PATTERNS_MONITOR, hdev) || 5730 pending_find(MGMT_OP_ADD_ADV_PATTERNS_MONITOR_RSSI, hdev)) { 5731 status = MGMT_STATUS_BUSY; 5732 goto unlock; 5733 } 5734 5735 cmd = mgmt_pending_new(sk, MGMT_OP_REMOVE_ADV_MONITOR, hdev, data, len); 5736 if (!cmd) { 5737 status = MGMT_STATUS_NO_RESOURCES; 5738 goto unlock; 5739 } 5740 5741 err = hci_cmd_sync_submit(hdev, mgmt_remove_adv_monitor_sync, cmd, 5742 mgmt_remove_adv_monitor_complete); 5743 5744 if (err) { 5745 mgmt_pending_free(cmd); 5746 5747 if (err == -ENOMEM) 5748 status = MGMT_STATUS_NO_RESOURCES; 5749 else 5750 status = MGMT_STATUS_FAILED; 5751 5752 goto unlock; 5753 } 5754 5755 hci_dev_unlock(hdev); 5756 5757 return 0; 5758 5759 unlock: 5760 hci_dev_unlock(hdev); 5761 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_ADV_MONITOR, 5762 status); 5763 } 5764 5765 static void read_local_oob_data_complete(struct hci_dev *hdev, void *data, 5766 int err) 5767 { 5768 struct mgmt_rp_read_local_oob_data mgmt_rp; 5769 size_t rp_size = sizeof(mgmt_rp); 5770 struct mgmt_pending_cmd *cmd = data; 5771 struct sk_buff *skb = cmd->skb; 5772 u8 status = mgmt_status(err); 5773 5774 if (!status) { 5775 if (!skb) 5776 status = MGMT_STATUS_FAILED; 5777 else if (IS_ERR(skb)) 5778 status = mgmt_status(PTR_ERR(skb)); 5779 else 5780 status = mgmt_status(skb->data[0]); 5781 } 5782 5783 bt_dev_dbg(hdev, "status %d", status); 5784 5785 if (status) { 5786 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA, 5787 status); 5788 goto remove; 5789 } 5790 5791 memset(&mgmt_rp, 0, sizeof(mgmt_rp)); 5792 5793 if (!bredr_sc_enabled(hdev)) { 5794 struct hci_rp_read_local_oob_data *rp = (void *) skb->data; 5795 5796 if (skb->len < sizeof(*rp)) { 5797 mgmt_cmd_status(cmd->sk, hdev->id, 5798 MGMT_OP_READ_LOCAL_OOB_DATA, 5799 MGMT_STATUS_FAILED); 5800 goto remove; 5801 } 5802 5803 memcpy(mgmt_rp.hash192, rp->hash, sizeof(rp->hash)); 5804 memcpy(mgmt_rp.rand192, rp->rand, sizeof(rp->rand)); 5805 5806 rp_size -= sizeof(mgmt_rp.hash256) + sizeof(mgmt_rp.rand256); 5807 } else { 5808 struct hci_rp_read_local_oob_ext_data *rp = (void *) skb->data; 5809 5810 if (skb->len < sizeof(*rp)) { 5811 mgmt_cmd_status(cmd->sk, hdev->id, 5812 MGMT_OP_READ_LOCAL_OOB_DATA, 5813 MGMT_STATUS_FAILED); 5814 goto remove; 5815 } 5816 5817 memcpy(mgmt_rp.hash192, rp->hash192, sizeof(rp->hash192)); 5818 memcpy(mgmt_rp.rand192, rp->rand192, sizeof(rp->rand192)); 5819 5820 memcpy(mgmt_rp.hash256, rp->hash256, sizeof(rp->hash256)); 5821 memcpy(mgmt_rp.rand256, rp->rand256, sizeof(rp->rand256)); 5822 } 5823 5824 mgmt_cmd_complete(cmd->sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA, 5825 MGMT_STATUS_SUCCESS, &mgmt_rp, rp_size); 5826 5827 remove: 5828 if (skb && !IS_ERR(skb)) 5829 kfree_skb(skb); 5830 5831 mgmt_pending_free(cmd); 5832 } 5833 5834 static int read_local_oob_data_sync(struct hci_dev *hdev, void *data) 5835 { 5836 struct mgmt_pending_cmd *cmd = data; 5837 5838 if (bredr_sc_enabled(hdev)) 5839 cmd->skb = hci_read_local_oob_data_sync(hdev, true, cmd->sk); 5840 else 5841 cmd->skb = hci_read_local_oob_data_sync(hdev, false, cmd->sk); 5842 5843 if (IS_ERR(cmd->skb)) 5844 return PTR_ERR(cmd->skb); 5845 else 5846 return 0; 5847 } 5848 5849 static int read_local_oob_data(struct sock *sk, struct hci_dev *hdev, 5850 void *data, u16 data_len) 5851 { 5852 struct mgmt_pending_cmd *cmd; 5853 int err; 5854 5855 bt_dev_dbg(hdev, "sock %p", sk); 5856 5857 hci_dev_lock(hdev); 5858 5859 if (!hdev_is_powered(hdev)) { 5860 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA, 5861 MGMT_STATUS_NOT_POWERED); 5862 goto unlock; 5863 } 5864 5865 if (!lmp_ssp_capable(hdev)) { 5866 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA, 5867 MGMT_STATUS_NOT_SUPPORTED); 5868 goto unlock; 5869 } 5870 5871 cmd = mgmt_pending_new(sk, MGMT_OP_READ_LOCAL_OOB_DATA, hdev, NULL, 0); 5872 if (!cmd) 5873 err = -ENOMEM; 5874 else 5875 err = hci_cmd_sync_queue(hdev, read_local_oob_data_sync, cmd, 5876 read_local_oob_data_complete); 5877 5878 if (err < 0) { 5879 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA, 5880 MGMT_STATUS_FAILED); 5881 5882 if (cmd) 5883 mgmt_pending_free(cmd); 5884 } 5885 5886 unlock: 5887 hci_dev_unlock(hdev); 5888 return err; 5889 } 5890 5891 static int add_remote_oob_data(struct sock *sk, struct hci_dev *hdev, 5892 void *data, u16 len) 5893 { 5894 struct mgmt_addr_info *addr = data; 5895 int err; 5896 5897 bt_dev_dbg(hdev, "sock %p", sk); 5898 5899 if (!bdaddr_type_is_valid(addr->type)) 5900 return mgmt_cmd_complete(sk, hdev->id, 5901 MGMT_OP_ADD_REMOTE_OOB_DATA, 5902 MGMT_STATUS_INVALID_PARAMS, 5903 addr, sizeof(*addr)); 5904 5905 hci_dev_lock(hdev); 5906 5907 if (len == MGMT_ADD_REMOTE_OOB_DATA_SIZE) { 5908 struct mgmt_cp_add_remote_oob_data *cp = data; 5909 u8 status; 5910 5911 if (cp->addr.type != BDADDR_BREDR) { 5912 err = mgmt_cmd_complete(sk, hdev->id, 5913 MGMT_OP_ADD_REMOTE_OOB_DATA, 5914 MGMT_STATUS_INVALID_PARAMS, 5915 &cp->addr, sizeof(cp->addr)); 5916 goto unlock; 5917 } 5918 5919 err = hci_add_remote_oob_data(hdev, &cp->addr.bdaddr, 5920 cp->addr.type, cp->hash, 5921 cp->rand, NULL, NULL); 5922 if (err < 0) 5923 status = MGMT_STATUS_FAILED; 5924 else 5925 status = MGMT_STATUS_SUCCESS; 5926 5927 err = mgmt_cmd_complete(sk, hdev->id, 5928 MGMT_OP_ADD_REMOTE_OOB_DATA, status, 5929 &cp->addr, sizeof(cp->addr)); 5930 } else if (len == MGMT_ADD_REMOTE_OOB_EXT_DATA_SIZE) { 5931 struct mgmt_cp_add_remote_oob_ext_data *cp = data; 5932 u8 *rand192, *hash192, *rand256, *hash256; 5933 u8 status; 5934 5935 if (bdaddr_type_is_le(cp->addr.type)) { 5936 /* Enforce zero-valued 192-bit parameters as 5937 * long as legacy SMP OOB isn't implemented. 5938 */ 5939 if (memcmp(cp->rand192, ZERO_KEY, 16) || 5940 memcmp(cp->hash192, ZERO_KEY, 16)) { 5941 err = mgmt_cmd_complete(sk, hdev->id, 5942 MGMT_OP_ADD_REMOTE_OOB_DATA, 5943 MGMT_STATUS_INVALID_PARAMS, 5944 addr, sizeof(*addr)); 5945 goto unlock; 5946 } 5947 5948 rand192 = NULL; 5949 hash192 = NULL; 5950 } else { 5951 /* In case one of the P-192 values is set to zero, 5952 * then just disable OOB data for P-192. 5953 */ 5954 if (!memcmp(cp->rand192, ZERO_KEY, 16) || 5955 !memcmp(cp->hash192, ZERO_KEY, 16)) { 5956 rand192 = NULL; 5957 hash192 = NULL; 5958 } else { 5959 rand192 = cp->rand192; 5960 hash192 = cp->hash192; 5961 } 5962 } 5963 5964 /* In case one of the P-256 values is set to zero, then just 5965 * disable OOB data for P-256. 5966 */ 5967 if (!memcmp(cp->rand256, ZERO_KEY, 16) || 5968 !memcmp(cp->hash256, ZERO_KEY, 16)) { 5969 rand256 = NULL; 5970 hash256 = NULL; 5971 } else { 5972 rand256 = cp->rand256; 5973 hash256 = cp->hash256; 5974 } 5975 5976 err = hci_add_remote_oob_data(hdev, &cp->addr.bdaddr, 5977 cp->addr.type, hash192, rand192, 5978 hash256, rand256); 5979 if (err < 0) 5980 status = MGMT_STATUS_FAILED; 5981 else 5982 status = MGMT_STATUS_SUCCESS; 5983 5984 err = mgmt_cmd_complete(sk, hdev->id, 5985 MGMT_OP_ADD_REMOTE_OOB_DATA, 5986 status, &cp->addr, sizeof(cp->addr)); 5987 } else { 5988 bt_dev_err(hdev, "add_remote_oob_data: invalid len of %u bytes", 5989 len); 5990 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_REMOTE_OOB_DATA, 5991 MGMT_STATUS_INVALID_PARAMS); 5992 } 5993 5994 unlock: 5995 hci_dev_unlock(hdev); 5996 return err; 5997 } 5998 5999 static int remove_remote_oob_data(struct sock *sk, struct hci_dev *hdev, 6000 void *data, u16 len) 6001 { 6002 struct mgmt_cp_remove_remote_oob_data *cp = data; 6003 u8 status; 6004 int err; 6005 6006 bt_dev_dbg(hdev, "sock %p", sk); 6007 6008 if (cp->addr.type != BDADDR_BREDR) 6009 return mgmt_cmd_complete(sk, hdev->id, 6010 MGMT_OP_REMOVE_REMOTE_OOB_DATA, 6011 MGMT_STATUS_INVALID_PARAMS, 6012 &cp->addr, sizeof(cp->addr)); 6013 6014 hci_dev_lock(hdev); 6015 6016 if (!bacmp(&cp->addr.bdaddr, BDADDR_ANY)) { 6017 hci_remote_oob_data_clear(hdev); 6018 status = MGMT_STATUS_SUCCESS; 6019 goto done; 6020 } 6021 6022 err = hci_remove_remote_oob_data(hdev, &cp->addr.bdaddr, cp->addr.type); 6023 if (err < 0) 6024 status = MGMT_STATUS_INVALID_PARAMS; 6025 else 6026 status = MGMT_STATUS_SUCCESS; 6027 6028 done: 6029 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_REMOTE_OOB_DATA, 6030 status, &cp->addr, sizeof(cp->addr)); 6031 6032 hci_dev_unlock(hdev); 6033 return err; 6034 } 6035 6036 static bool discovery_type_is_valid(struct hci_dev *hdev, uint8_t type, 6037 uint8_t *mgmt_status) 6038 { 6039 switch (type) { 6040 case DISCOV_TYPE_LE: 6041 *mgmt_status = mgmt_le_support(hdev); 6042 if (*mgmt_status) 6043 return false; 6044 break; 6045 case DISCOV_TYPE_INTERLEAVED: 6046 *mgmt_status = mgmt_le_support(hdev); 6047 if (*mgmt_status) 6048 return false; 6049 fallthrough; 6050 case DISCOV_TYPE_BREDR: 6051 *mgmt_status = mgmt_bredr_support(hdev); 6052 if (*mgmt_status) 6053 return false; 6054 break; 6055 default: 6056 *mgmt_status = MGMT_STATUS_INVALID_PARAMS; 6057 return false; 6058 } 6059 6060 return true; 6061 } 6062 6063 static void start_discovery_complete(struct hci_dev *hdev, void *data, int err) 6064 { 6065 struct mgmt_pending_cmd *cmd = data; 6066 6067 bt_dev_dbg(hdev, "err %d", err); 6068 6069 if (err == -ECANCELED || !mgmt_pending_valid(hdev, cmd)) 6070 return; 6071 6072 mgmt_cmd_complete(cmd->sk, cmd->hdev->id, cmd->opcode, mgmt_status(err), 6073 cmd->param, 1); 6074 mgmt_pending_free(cmd); 6075 6076 hci_discovery_set_state(hdev, err ? DISCOVERY_STOPPED: 6077 DISCOVERY_FINDING); 6078 } 6079 6080 static int start_discovery_sync(struct hci_dev *hdev, void *data) 6081 { 6082 if (!mgmt_pending_listed(hdev, data)) 6083 return -ECANCELED; 6084 6085 return hci_start_discovery_sync(hdev); 6086 } 6087 6088 static int start_discovery_internal(struct sock *sk, struct hci_dev *hdev, 6089 u16 op, void *data, u16 len) 6090 { 6091 struct mgmt_cp_start_discovery *cp = data; 6092 struct mgmt_pending_cmd *cmd; 6093 u8 status; 6094 int err; 6095 6096 bt_dev_dbg(hdev, "sock %p", sk); 6097 6098 hci_dev_lock(hdev); 6099 6100 if (!hdev_is_powered(hdev)) { 6101 err = mgmt_cmd_complete(sk, hdev->id, op, 6102 MGMT_STATUS_NOT_POWERED, 6103 &cp->type, sizeof(cp->type)); 6104 goto failed; 6105 } 6106 6107 if (hdev->discovery.state != DISCOVERY_STOPPED || 6108 hci_dev_test_flag(hdev, HCI_PERIODIC_INQ)) { 6109 err = mgmt_cmd_complete(sk, hdev->id, op, MGMT_STATUS_BUSY, 6110 &cp->type, sizeof(cp->type)); 6111 goto failed; 6112 } 6113 6114 if (!discovery_type_is_valid(hdev, cp->type, &status)) { 6115 err = mgmt_cmd_complete(sk, hdev->id, op, status, 6116 &cp->type, sizeof(cp->type)); 6117 goto failed; 6118 } 6119 6120 /* Can't start discovery when it is paused */ 6121 if (hdev->discovery_paused) { 6122 err = mgmt_cmd_complete(sk, hdev->id, op, MGMT_STATUS_BUSY, 6123 &cp->type, sizeof(cp->type)); 6124 goto failed; 6125 } 6126 6127 /* Clear the discovery filter first to free any previously 6128 * allocated memory for the UUID list. 6129 */ 6130 hci_discovery_filter_clear(hdev); 6131 6132 hdev->discovery.type = cp->type; 6133 hdev->discovery.report_invalid_rssi = false; 6134 if (op == MGMT_OP_START_LIMITED_DISCOVERY) 6135 hdev->discovery.limited = true; 6136 else 6137 hdev->discovery.limited = false; 6138 6139 cmd = mgmt_pending_add(sk, op, hdev, data, len); 6140 if (!cmd) { 6141 err = -ENOMEM; 6142 goto failed; 6143 } 6144 6145 err = hci_cmd_sync_queue(hdev, start_discovery_sync, cmd, 6146 start_discovery_complete); 6147 if (err < 0) { 6148 mgmt_pending_remove(cmd); 6149 goto failed; 6150 } 6151 6152 hci_discovery_set_state(hdev, DISCOVERY_STARTING); 6153 6154 failed: 6155 hci_dev_unlock(hdev); 6156 return err; 6157 } 6158 6159 static int start_discovery(struct sock *sk, struct hci_dev *hdev, 6160 void *data, u16 len) 6161 { 6162 return start_discovery_internal(sk, hdev, MGMT_OP_START_DISCOVERY, 6163 data, len); 6164 } 6165 6166 static int start_limited_discovery(struct sock *sk, struct hci_dev *hdev, 6167 void *data, u16 len) 6168 { 6169 return start_discovery_internal(sk, hdev, 6170 MGMT_OP_START_LIMITED_DISCOVERY, 6171 data, len); 6172 } 6173 6174 static int start_service_discovery(struct sock *sk, struct hci_dev *hdev, 6175 void *data, u16 len) 6176 { 6177 struct mgmt_cp_start_service_discovery *cp = data; 6178 struct mgmt_pending_cmd *cmd; 6179 const u16 max_uuid_count = ((U16_MAX - sizeof(*cp)) / 16); 6180 u16 uuid_count, expected_len; 6181 u8 (*uuids)[16] = NULL; 6182 u8 status; 6183 int err; 6184 6185 bt_dev_dbg(hdev, "sock %p", sk); 6186 6187 hci_dev_lock(hdev); 6188 6189 if (!hdev_is_powered(hdev)) { 6190 err = mgmt_cmd_complete(sk, hdev->id, 6191 MGMT_OP_START_SERVICE_DISCOVERY, 6192 MGMT_STATUS_NOT_POWERED, 6193 &cp->type, sizeof(cp->type)); 6194 goto failed; 6195 } 6196 6197 if (hdev->discovery.state != DISCOVERY_STOPPED || 6198 hci_dev_test_flag(hdev, HCI_PERIODIC_INQ)) { 6199 err = mgmt_cmd_complete(sk, hdev->id, 6200 MGMT_OP_START_SERVICE_DISCOVERY, 6201 MGMT_STATUS_BUSY, &cp->type, 6202 sizeof(cp->type)); 6203 goto failed; 6204 } 6205 6206 if (hdev->discovery_paused) { 6207 err = mgmt_cmd_complete(sk, hdev->id, 6208 MGMT_OP_START_SERVICE_DISCOVERY, 6209 MGMT_STATUS_BUSY, &cp->type, 6210 sizeof(cp->type)); 6211 goto failed; 6212 } 6213 6214 uuid_count = __le16_to_cpu(cp->uuid_count); 6215 if (uuid_count > max_uuid_count) { 6216 bt_dev_err(hdev, "service_discovery: too big uuid_count value %u", 6217 uuid_count); 6218 err = mgmt_cmd_complete(sk, hdev->id, 6219 MGMT_OP_START_SERVICE_DISCOVERY, 6220 MGMT_STATUS_INVALID_PARAMS, &cp->type, 6221 sizeof(cp->type)); 6222 goto failed; 6223 } 6224 6225 expected_len = sizeof(*cp) + uuid_count * 16; 6226 if (expected_len != len) { 6227 bt_dev_err(hdev, "service_discovery: expected %u bytes, got %u bytes", 6228 expected_len, len); 6229 err = mgmt_cmd_complete(sk, hdev->id, 6230 MGMT_OP_START_SERVICE_DISCOVERY, 6231 MGMT_STATUS_INVALID_PARAMS, &cp->type, 6232 sizeof(cp->type)); 6233 goto failed; 6234 } 6235 6236 if (!discovery_type_is_valid(hdev, cp->type, &status)) { 6237 err = mgmt_cmd_complete(sk, hdev->id, 6238 MGMT_OP_START_SERVICE_DISCOVERY, 6239 status, &cp->type, sizeof(cp->type)); 6240 goto failed; 6241 } 6242 6243 cmd = mgmt_pending_add(sk, MGMT_OP_START_SERVICE_DISCOVERY, 6244 hdev, data, len); 6245 if (!cmd) { 6246 err = -ENOMEM; 6247 goto failed; 6248 } 6249 6250 /* Clear the discovery filter first to free any previously 6251 * allocated memory for the UUID list. 6252 */ 6253 hci_discovery_filter_clear(hdev); 6254 6255 hdev->discovery.result_filtering = true; 6256 hdev->discovery.type = cp->type; 6257 hdev->discovery.rssi = cp->rssi; 6258 6259 if (uuid_count > 0) { 6260 uuids = kmemdup(cp->uuids, uuid_count * sizeof(*uuids), GFP_KERNEL); 6261 if (!uuids) { 6262 err = mgmt_cmd_complete(sk, hdev->id, 6263 MGMT_OP_START_SERVICE_DISCOVERY, 6264 MGMT_STATUS_FAILED, 6265 &cp->type, sizeof(cp->type)); 6266 mgmt_pending_remove(cmd); 6267 goto failed; 6268 } 6269 } 6270 6271 spin_lock(&hdev->discovery.lock); 6272 hdev->discovery.uuids = uuids; 6273 hdev->discovery.uuid_count = uuid_count; 6274 spin_unlock(&hdev->discovery.lock); 6275 6276 err = hci_cmd_sync_queue(hdev, start_discovery_sync, cmd, 6277 start_discovery_complete); 6278 if (err < 0) { 6279 mgmt_pending_remove(cmd); 6280 goto failed; 6281 } 6282 6283 hci_discovery_set_state(hdev, DISCOVERY_STARTING); 6284 6285 failed: 6286 hci_dev_unlock(hdev); 6287 return err; 6288 } 6289 6290 static void stop_discovery_complete(struct hci_dev *hdev, void *data, int err) 6291 { 6292 struct mgmt_pending_cmd *cmd = data; 6293 6294 if (err == -ECANCELED || !mgmt_pending_valid(hdev, cmd)) 6295 return; 6296 6297 bt_dev_dbg(hdev, "err %d", err); 6298 6299 mgmt_cmd_complete(cmd->sk, cmd->hdev->id, cmd->opcode, mgmt_status(err), 6300 cmd->param, 1); 6301 mgmt_pending_free(cmd); 6302 6303 if (!err) 6304 hci_discovery_set_state(hdev, DISCOVERY_STOPPED); 6305 } 6306 6307 static int stop_discovery_sync(struct hci_dev *hdev, void *data) 6308 { 6309 if (!mgmt_pending_listed(hdev, data)) 6310 return -ECANCELED; 6311 6312 return hci_stop_discovery_sync(hdev); 6313 } 6314 6315 static int stop_discovery(struct sock *sk, struct hci_dev *hdev, void *data, 6316 u16 len) 6317 { 6318 struct mgmt_cp_stop_discovery *mgmt_cp = data; 6319 struct mgmt_pending_cmd *cmd; 6320 int err; 6321 6322 bt_dev_dbg(hdev, "sock %p", sk); 6323 6324 hci_dev_lock(hdev); 6325 6326 if (!hci_discovery_active(hdev)) { 6327 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY, 6328 MGMT_STATUS_REJECTED, &mgmt_cp->type, 6329 sizeof(mgmt_cp->type)); 6330 goto unlock; 6331 } 6332 6333 if (hdev->discovery.type != mgmt_cp->type) { 6334 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY, 6335 MGMT_STATUS_INVALID_PARAMS, 6336 &mgmt_cp->type, sizeof(mgmt_cp->type)); 6337 goto unlock; 6338 } 6339 6340 cmd = mgmt_pending_add(sk, MGMT_OP_STOP_DISCOVERY, hdev, data, len); 6341 if (!cmd) { 6342 err = -ENOMEM; 6343 goto unlock; 6344 } 6345 6346 err = hci_cmd_sync_queue(hdev, stop_discovery_sync, cmd, 6347 stop_discovery_complete); 6348 if (err < 0) { 6349 mgmt_pending_remove(cmd); 6350 goto unlock; 6351 } 6352 6353 hci_discovery_set_state(hdev, DISCOVERY_STOPPING); 6354 6355 unlock: 6356 hci_dev_unlock(hdev); 6357 return err; 6358 } 6359 6360 static int confirm_name(struct sock *sk, struct hci_dev *hdev, void *data, 6361 u16 len) 6362 { 6363 struct mgmt_cp_confirm_name *cp = data; 6364 struct inquiry_entry *e; 6365 int err; 6366 6367 bt_dev_dbg(hdev, "sock %p", sk); 6368 6369 hci_dev_lock(hdev); 6370 6371 if (!hci_discovery_active(hdev)) { 6372 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME, 6373 MGMT_STATUS_FAILED, &cp->addr, 6374 sizeof(cp->addr)); 6375 goto failed; 6376 } 6377 6378 e = hci_inquiry_cache_lookup_unknown(hdev, &cp->addr.bdaddr); 6379 if (!e) { 6380 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME, 6381 MGMT_STATUS_INVALID_PARAMS, &cp->addr, 6382 sizeof(cp->addr)); 6383 goto failed; 6384 } 6385 6386 if (cp->name_known) { 6387 e->name_state = NAME_KNOWN; 6388 list_del(&e->list); 6389 } else { 6390 e->name_state = NAME_NEEDED; 6391 hci_inquiry_cache_update_resolve(hdev, e); 6392 } 6393 6394 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME, 0, 6395 &cp->addr, sizeof(cp->addr)); 6396 6397 failed: 6398 hci_dev_unlock(hdev); 6399 return err; 6400 } 6401 6402 static int block_device(struct sock *sk, struct hci_dev *hdev, void *data, 6403 u16 len) 6404 { 6405 struct mgmt_cp_block_device *cp = data; 6406 u8 status; 6407 int err; 6408 6409 bt_dev_dbg(hdev, "sock %p", sk); 6410 6411 if (!bdaddr_type_is_valid(cp->addr.type)) 6412 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_BLOCK_DEVICE, 6413 MGMT_STATUS_INVALID_PARAMS, 6414 &cp->addr, sizeof(cp->addr)); 6415 6416 hci_dev_lock(hdev); 6417 6418 err = hci_bdaddr_list_add(&hdev->reject_list, &cp->addr.bdaddr, 6419 cp->addr.type); 6420 if (err < 0) { 6421 status = MGMT_STATUS_FAILED; 6422 goto done; 6423 } 6424 6425 mgmt_event(MGMT_EV_DEVICE_BLOCKED, hdev, &cp->addr, sizeof(cp->addr), 6426 sk); 6427 status = MGMT_STATUS_SUCCESS; 6428 6429 done: 6430 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_BLOCK_DEVICE, status, 6431 &cp->addr, sizeof(cp->addr)); 6432 6433 hci_dev_unlock(hdev); 6434 6435 return err; 6436 } 6437 6438 static int unblock_device(struct sock *sk, struct hci_dev *hdev, void *data, 6439 u16 len) 6440 { 6441 struct mgmt_cp_unblock_device *cp = data; 6442 u8 status; 6443 int err; 6444 6445 bt_dev_dbg(hdev, "sock %p", sk); 6446 6447 if (!bdaddr_type_is_valid(cp->addr.type)) 6448 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNBLOCK_DEVICE, 6449 MGMT_STATUS_INVALID_PARAMS, 6450 &cp->addr, sizeof(cp->addr)); 6451 6452 hci_dev_lock(hdev); 6453 6454 err = hci_bdaddr_list_del(&hdev->reject_list, &cp->addr.bdaddr, 6455 cp->addr.type); 6456 if (err < 0) { 6457 status = MGMT_STATUS_INVALID_PARAMS; 6458 goto done; 6459 } 6460 6461 mgmt_event(MGMT_EV_DEVICE_UNBLOCKED, hdev, &cp->addr, sizeof(cp->addr), 6462 sk); 6463 status = MGMT_STATUS_SUCCESS; 6464 6465 done: 6466 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNBLOCK_DEVICE, status, 6467 &cp->addr, sizeof(cp->addr)); 6468 6469 hci_dev_unlock(hdev); 6470 6471 return err; 6472 } 6473 6474 static int set_device_id_sync(struct hci_dev *hdev, void *data) 6475 { 6476 return hci_update_eir_sync(hdev); 6477 } 6478 6479 static int set_device_id(struct sock *sk, struct hci_dev *hdev, void *data, 6480 u16 len) 6481 { 6482 struct mgmt_cp_set_device_id *cp = data; 6483 int err; 6484 __u16 source; 6485 6486 bt_dev_dbg(hdev, "sock %p", sk); 6487 6488 source = __le16_to_cpu(cp->source); 6489 6490 if (source > 0x0002) 6491 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEVICE_ID, 6492 MGMT_STATUS_INVALID_PARAMS); 6493 6494 hci_dev_lock(hdev); 6495 6496 hdev->devid_source = source; 6497 hdev->devid_vendor = __le16_to_cpu(cp->vendor); 6498 hdev->devid_product = __le16_to_cpu(cp->product); 6499 hdev->devid_version = __le16_to_cpu(cp->version); 6500 6501 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_DEVICE_ID, 0, 6502 NULL, 0); 6503 6504 hci_cmd_sync_queue(hdev, set_device_id_sync, NULL, NULL); 6505 6506 hci_dev_unlock(hdev); 6507 6508 return err; 6509 } 6510 6511 static void enable_advertising_instance(struct hci_dev *hdev, int err) 6512 { 6513 if (err) 6514 bt_dev_err(hdev, "failed to re-configure advertising %d", err); 6515 else 6516 bt_dev_dbg(hdev, "status %d", err); 6517 } 6518 6519 static void set_advertising_complete(struct hci_dev *hdev, void *data, int err) 6520 { 6521 struct mgmt_pending_cmd *cmd = data; 6522 struct cmd_lookup match = { NULL, hdev }; 6523 u8 instance; 6524 struct adv_info *adv_instance; 6525 u8 status = mgmt_status(err); 6526 6527 if (err == -ECANCELED || !mgmt_pending_valid(hdev, data)) 6528 return; 6529 6530 if (status) { 6531 mgmt_cmd_status(cmd->sk, cmd->hdev->id, cmd->opcode, status); 6532 mgmt_pending_free(cmd); 6533 return; 6534 } 6535 6536 if (hci_dev_test_flag(hdev, HCI_LE_ADV)) 6537 hci_dev_set_flag(hdev, HCI_ADVERTISING); 6538 else 6539 hci_dev_clear_flag(hdev, HCI_ADVERTISING); 6540 6541 settings_rsp(cmd, &match); 6542 mgmt_pending_free(cmd); 6543 6544 new_settings(hdev, match.sk); 6545 6546 if (match.sk) 6547 sock_put(match.sk); 6548 6549 /* If "Set Advertising" was just disabled and instance advertising was 6550 * set up earlier, then re-enable multi-instance advertising. 6551 */ 6552 if (hci_dev_test_flag(hdev, HCI_ADVERTISING) || 6553 list_empty(&hdev->adv_instances)) 6554 return; 6555 6556 instance = hdev->cur_adv_instance; 6557 if (!instance) { 6558 adv_instance = list_first_entry_or_null(&hdev->adv_instances, 6559 struct adv_info, list); 6560 if (!adv_instance) 6561 return; 6562 6563 instance = adv_instance->instance; 6564 } 6565 6566 err = hci_schedule_adv_instance_sync(hdev, instance, true); 6567 6568 enable_advertising_instance(hdev, err); 6569 } 6570 6571 static int set_adv_sync(struct hci_dev *hdev, void *data) 6572 { 6573 struct mgmt_pending_cmd *cmd = data; 6574 struct mgmt_mode cp; 6575 u8 val; 6576 6577 mutex_lock(&hdev->mgmt_pending_lock); 6578 6579 if (!__mgmt_pending_listed(hdev, cmd)) { 6580 mutex_unlock(&hdev->mgmt_pending_lock); 6581 return -ECANCELED; 6582 } 6583 6584 memcpy(&cp, cmd->param, sizeof(cp)); 6585 6586 mutex_unlock(&hdev->mgmt_pending_lock); 6587 6588 val = !!cp.val; 6589 6590 if (cp.val == 0x02) 6591 hci_dev_set_flag(hdev, HCI_ADVERTISING_CONNECTABLE); 6592 else 6593 hci_dev_clear_flag(hdev, HCI_ADVERTISING_CONNECTABLE); 6594 6595 cancel_adv_timeout(hdev); 6596 6597 if (val) { 6598 /* Switch to instance "0" for the Set Advertising setting. 6599 * We cannot use update_[adv|scan_rsp]_data() here as the 6600 * HCI_ADVERTISING flag is not yet set. 6601 */ 6602 hdev->cur_adv_instance = 0x00; 6603 6604 if (ext_adv_capable(hdev)) { 6605 hci_start_ext_adv_sync(hdev, 0x00); 6606 } else { 6607 hci_update_adv_data_sync(hdev, 0x00); 6608 hci_update_scan_rsp_data_sync(hdev, 0x00); 6609 hci_enable_advertising_sync(hdev); 6610 } 6611 } else { 6612 hci_disable_advertising_sync(hdev); 6613 } 6614 6615 return 0; 6616 } 6617 6618 static int set_advertising(struct sock *sk, struct hci_dev *hdev, void *data, 6619 u16 len) 6620 { 6621 struct mgmt_mode *cp = data; 6622 struct mgmt_pending_cmd *cmd; 6623 u8 val, status; 6624 int err; 6625 6626 bt_dev_dbg(hdev, "sock %p", sk); 6627 6628 status = mgmt_le_support(hdev); 6629 if (status) 6630 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING, 6631 status); 6632 6633 if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02) 6634 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING, 6635 MGMT_STATUS_INVALID_PARAMS); 6636 6637 if (hdev->advertising_paused) 6638 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING, 6639 MGMT_STATUS_BUSY); 6640 6641 hci_dev_lock(hdev); 6642 6643 val = !!cp->val; 6644 6645 /* The following conditions are ones which mean that we should 6646 * not do any HCI communication but directly send a mgmt 6647 * response to user space (after toggling the flag if 6648 * necessary). 6649 */ 6650 if (!hdev_is_powered(hdev) || 6651 (val == hci_dev_test_flag(hdev, HCI_ADVERTISING) && 6652 (cp->val == 0x02) == hci_dev_test_flag(hdev, HCI_ADVERTISING_CONNECTABLE)) || 6653 hci_dev_test_flag(hdev, HCI_MESH) || 6654 hci_conn_num(hdev, LE_LINK) > 0 || 6655 (hci_dev_test_flag(hdev, HCI_LE_SCAN) && 6656 hdev->le_scan_type == LE_SCAN_ACTIVE)) { 6657 bool changed; 6658 6659 if (cp->val) { 6660 hdev->cur_adv_instance = 0x00; 6661 changed = !hci_dev_test_and_set_flag(hdev, HCI_ADVERTISING); 6662 if (cp->val == 0x02) 6663 hci_dev_set_flag(hdev, HCI_ADVERTISING_CONNECTABLE); 6664 else 6665 hci_dev_clear_flag(hdev, HCI_ADVERTISING_CONNECTABLE); 6666 } else { 6667 changed = hci_dev_test_and_clear_flag(hdev, HCI_ADVERTISING); 6668 hci_dev_clear_flag(hdev, HCI_ADVERTISING_CONNECTABLE); 6669 } 6670 6671 err = send_settings_rsp(sk, MGMT_OP_SET_ADVERTISING, hdev); 6672 if (err < 0) 6673 goto unlock; 6674 6675 if (changed) 6676 err = new_settings(hdev, sk); 6677 6678 goto unlock; 6679 } 6680 6681 if (pending_find(MGMT_OP_SET_ADVERTISING, hdev) || 6682 pending_find(MGMT_OP_SET_LE, hdev)) { 6683 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING, 6684 MGMT_STATUS_BUSY); 6685 goto unlock; 6686 } 6687 6688 cmd = mgmt_pending_add(sk, MGMT_OP_SET_ADVERTISING, hdev, data, len); 6689 if (!cmd) 6690 err = -ENOMEM; 6691 else 6692 err = hci_cmd_sync_queue(hdev, set_adv_sync, cmd, 6693 set_advertising_complete); 6694 6695 if (err < 0 && cmd) 6696 mgmt_pending_remove(cmd); 6697 6698 unlock: 6699 hci_dev_unlock(hdev); 6700 return err; 6701 } 6702 6703 static int set_static_address(struct sock *sk, struct hci_dev *hdev, 6704 void *data, u16 len) 6705 { 6706 struct mgmt_cp_set_static_address *cp = data; 6707 int err; 6708 6709 bt_dev_dbg(hdev, "sock %p", sk); 6710 6711 if (!lmp_le_capable(hdev)) 6712 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_STATIC_ADDRESS, 6713 MGMT_STATUS_NOT_SUPPORTED); 6714 6715 if (hdev_is_powered(hdev)) 6716 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_STATIC_ADDRESS, 6717 MGMT_STATUS_REJECTED); 6718 6719 if (bacmp(&cp->bdaddr, BDADDR_ANY)) { 6720 if (!bacmp(&cp->bdaddr, BDADDR_NONE)) 6721 return mgmt_cmd_status(sk, hdev->id, 6722 MGMT_OP_SET_STATIC_ADDRESS, 6723 MGMT_STATUS_INVALID_PARAMS); 6724 6725 /* Two most significant bits shall be set */ 6726 if ((cp->bdaddr.b[5] & 0xc0) != 0xc0) 6727 return mgmt_cmd_status(sk, hdev->id, 6728 MGMT_OP_SET_STATIC_ADDRESS, 6729 MGMT_STATUS_INVALID_PARAMS); 6730 } 6731 6732 hci_dev_lock(hdev); 6733 6734 bacpy(&hdev->static_addr, &cp->bdaddr); 6735 6736 err = send_settings_rsp(sk, MGMT_OP_SET_STATIC_ADDRESS, hdev); 6737 if (err < 0) 6738 goto unlock; 6739 6740 err = new_settings(hdev, sk); 6741 6742 unlock: 6743 hci_dev_unlock(hdev); 6744 return err; 6745 } 6746 6747 static int set_scan_params(struct sock *sk, struct hci_dev *hdev, 6748 void *data, u16 len) 6749 { 6750 struct mgmt_cp_set_scan_params *cp = data; 6751 __u16 interval, window; 6752 int err; 6753 6754 bt_dev_dbg(hdev, "sock %p", sk); 6755 6756 if (!lmp_le_capable(hdev)) 6757 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS, 6758 MGMT_STATUS_NOT_SUPPORTED); 6759 6760 /* Keep allowed ranges in sync with set_mesh() */ 6761 interval = __le16_to_cpu(cp->interval); 6762 6763 if (interval < 0x0004 || interval > 0x4000) 6764 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS, 6765 MGMT_STATUS_INVALID_PARAMS); 6766 6767 window = __le16_to_cpu(cp->window); 6768 6769 if (window < 0x0004 || window > 0x4000) 6770 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS, 6771 MGMT_STATUS_INVALID_PARAMS); 6772 6773 if (window > interval) 6774 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS, 6775 MGMT_STATUS_INVALID_PARAMS); 6776 6777 hci_dev_lock(hdev); 6778 6779 hdev->le_scan_interval = interval; 6780 hdev->le_scan_window = window; 6781 6782 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS, 0, 6783 NULL, 0); 6784 6785 /* If background scan is running, restart it so new parameters are 6786 * loaded. 6787 */ 6788 if (hci_dev_test_flag(hdev, HCI_LE_SCAN) && 6789 hdev->discovery.state == DISCOVERY_STOPPED) 6790 hci_update_passive_scan(hdev); 6791 6792 hci_dev_unlock(hdev); 6793 6794 return err; 6795 } 6796 6797 static void fast_connectable_complete(struct hci_dev *hdev, void *data, int err) 6798 { 6799 struct mgmt_pending_cmd *cmd = data; 6800 6801 bt_dev_dbg(hdev, "err %d", err); 6802 6803 if (err) { 6804 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE, 6805 mgmt_status(err)); 6806 } else { 6807 struct mgmt_mode *cp = cmd->param; 6808 6809 if (cp->val) 6810 hci_dev_set_flag(hdev, HCI_FAST_CONNECTABLE); 6811 else 6812 hci_dev_clear_flag(hdev, HCI_FAST_CONNECTABLE); 6813 6814 send_settings_rsp(cmd->sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev); 6815 new_settings(hdev, cmd->sk); 6816 } 6817 6818 mgmt_pending_free(cmd); 6819 } 6820 6821 static int write_fast_connectable_sync(struct hci_dev *hdev, void *data) 6822 { 6823 struct mgmt_pending_cmd *cmd = data; 6824 struct mgmt_mode *cp = cmd->param; 6825 6826 return hci_write_fast_connectable_sync(hdev, cp->val); 6827 } 6828 6829 static int set_fast_connectable(struct sock *sk, struct hci_dev *hdev, 6830 void *data, u16 len) 6831 { 6832 struct mgmt_mode *cp = data; 6833 struct mgmt_pending_cmd *cmd; 6834 int err; 6835 6836 bt_dev_dbg(hdev, "sock %p", sk); 6837 6838 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) || 6839 hdev->hci_ver < BLUETOOTH_VER_1_2) 6840 return mgmt_cmd_status(sk, hdev->id, 6841 MGMT_OP_SET_FAST_CONNECTABLE, 6842 MGMT_STATUS_NOT_SUPPORTED); 6843 6844 if (cp->val != 0x00 && cp->val != 0x01) 6845 return mgmt_cmd_status(sk, hdev->id, 6846 MGMT_OP_SET_FAST_CONNECTABLE, 6847 MGMT_STATUS_INVALID_PARAMS); 6848 6849 hci_dev_lock(hdev); 6850 6851 if (!!cp->val == hci_dev_test_flag(hdev, HCI_FAST_CONNECTABLE)) { 6852 err = send_settings_rsp(sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev); 6853 goto unlock; 6854 } 6855 6856 if (!hdev_is_powered(hdev)) { 6857 hci_dev_change_flag(hdev, HCI_FAST_CONNECTABLE); 6858 err = send_settings_rsp(sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev); 6859 new_settings(hdev, sk); 6860 goto unlock; 6861 } 6862 6863 cmd = mgmt_pending_new(sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev, data, 6864 len); 6865 if (!cmd) 6866 err = -ENOMEM; 6867 else 6868 err = hci_cmd_sync_queue(hdev, write_fast_connectable_sync, cmd, 6869 fast_connectable_complete); 6870 6871 if (err < 0) { 6872 mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE, 6873 MGMT_STATUS_FAILED); 6874 6875 if (cmd) 6876 mgmt_pending_free(cmd); 6877 } 6878 6879 unlock: 6880 hci_dev_unlock(hdev); 6881 6882 return err; 6883 } 6884 6885 static void set_bredr_complete(struct hci_dev *hdev, void *data, int err) 6886 { 6887 struct mgmt_pending_cmd *cmd = data; 6888 6889 bt_dev_dbg(hdev, "err %d", err); 6890 6891 if (err) { 6892 u8 mgmt_err = mgmt_status(err); 6893 6894 /* We need to restore the flag if related HCI commands 6895 * failed. 6896 */ 6897 hci_dev_clear_flag(hdev, HCI_BREDR_ENABLED); 6898 6899 mgmt_cmd_status(cmd->sk, cmd->hdev->id, cmd->opcode, mgmt_err); 6900 } else { 6901 send_settings_rsp(cmd->sk, MGMT_OP_SET_BREDR, hdev); 6902 new_settings(hdev, cmd->sk); 6903 } 6904 6905 mgmt_pending_free(cmd); 6906 } 6907 6908 static int set_bredr_sync(struct hci_dev *hdev, void *data) 6909 { 6910 int status; 6911 6912 status = hci_write_fast_connectable_sync(hdev, false); 6913 6914 if (!status) 6915 status = hci_update_scan_sync(hdev); 6916 6917 /* Since only the advertising data flags will change, there 6918 * is no need to update the scan response data. 6919 */ 6920 if (!status) 6921 status = hci_update_adv_data_sync(hdev, hdev->cur_adv_instance); 6922 6923 return status; 6924 } 6925 6926 static int set_bredr(struct sock *sk, struct hci_dev *hdev, void *data, u16 len) 6927 { 6928 struct mgmt_mode *cp = data; 6929 struct mgmt_pending_cmd *cmd; 6930 int err; 6931 6932 bt_dev_dbg(hdev, "sock %p", sk); 6933 6934 if (!lmp_bredr_capable(hdev) || !lmp_le_capable(hdev)) 6935 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR, 6936 MGMT_STATUS_NOT_SUPPORTED); 6937 6938 if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED)) 6939 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR, 6940 MGMT_STATUS_REJECTED); 6941 6942 if (cp->val != 0x00 && cp->val != 0x01) 6943 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR, 6944 MGMT_STATUS_INVALID_PARAMS); 6945 6946 hci_dev_lock(hdev); 6947 6948 if (cp->val == hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) { 6949 err = send_settings_rsp(sk, MGMT_OP_SET_BREDR, hdev); 6950 goto unlock; 6951 } 6952 6953 if (!hdev_is_powered(hdev)) { 6954 if (!cp->val) { 6955 hci_dev_clear_flag(hdev, HCI_DISCOVERABLE); 6956 hci_dev_clear_flag(hdev, HCI_SSP_ENABLED); 6957 hci_dev_clear_flag(hdev, HCI_LINK_SECURITY); 6958 hci_dev_clear_flag(hdev, HCI_FAST_CONNECTABLE); 6959 } 6960 6961 hci_dev_change_flag(hdev, HCI_BREDR_ENABLED); 6962 6963 err = send_settings_rsp(sk, MGMT_OP_SET_BREDR, hdev); 6964 if (err < 0) 6965 goto unlock; 6966 6967 err = new_settings(hdev, sk); 6968 goto unlock; 6969 } 6970 6971 /* Reject disabling when powered on */ 6972 if (!cp->val) { 6973 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR, 6974 MGMT_STATUS_REJECTED); 6975 goto unlock; 6976 } else { 6977 /* When configuring a dual-mode controller to operate 6978 * with LE only and using a static address, then switching 6979 * BR/EDR back on is not allowed. 6980 * 6981 * Dual-mode controllers shall operate with the public 6982 * address as its identity address for BR/EDR and LE. So 6983 * reject the attempt to create an invalid configuration. 6984 * 6985 * The same restrictions applies when secure connections 6986 * has been enabled. For BR/EDR this is a controller feature 6987 * while for LE it is a host stack feature. This means that 6988 * switching BR/EDR back on when secure connections has been 6989 * enabled is not a supported transaction. 6990 */ 6991 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) && 6992 (bacmp(&hdev->static_addr, BDADDR_ANY) || 6993 hci_dev_test_flag(hdev, HCI_SC_ENABLED))) { 6994 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR, 6995 MGMT_STATUS_REJECTED); 6996 goto unlock; 6997 } 6998 } 6999 7000 cmd = mgmt_pending_new(sk, MGMT_OP_SET_BREDR, hdev, data, len); 7001 if (!cmd) 7002 err = -ENOMEM; 7003 else 7004 err = hci_cmd_sync_queue(hdev, set_bredr_sync, cmd, 7005 set_bredr_complete); 7006 7007 if (err < 0) { 7008 mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR, 7009 MGMT_STATUS_FAILED); 7010 if (cmd) 7011 mgmt_pending_free(cmd); 7012 7013 goto unlock; 7014 } 7015 7016 /* We need to flip the bit already here so that 7017 * hci_req_update_adv_data generates the correct flags. 7018 */ 7019 hci_dev_set_flag(hdev, HCI_BREDR_ENABLED); 7020 7021 unlock: 7022 hci_dev_unlock(hdev); 7023 return err; 7024 } 7025 7026 static void set_secure_conn_complete(struct hci_dev *hdev, void *data, int err) 7027 { 7028 struct mgmt_pending_cmd *cmd = data; 7029 struct mgmt_mode *cp; 7030 7031 bt_dev_dbg(hdev, "err %d", err); 7032 7033 if (err) { 7034 u8 mgmt_err = mgmt_status(err); 7035 7036 mgmt_cmd_status(cmd->sk, cmd->hdev->id, cmd->opcode, mgmt_err); 7037 goto done; 7038 } 7039 7040 cp = cmd->param; 7041 7042 switch (cp->val) { 7043 case 0x00: 7044 hci_dev_clear_flag(hdev, HCI_SC_ENABLED); 7045 hci_dev_clear_flag(hdev, HCI_SC_ONLY); 7046 break; 7047 case 0x01: 7048 hci_dev_set_flag(hdev, HCI_SC_ENABLED); 7049 hci_dev_clear_flag(hdev, HCI_SC_ONLY); 7050 break; 7051 case 0x02: 7052 hci_dev_set_flag(hdev, HCI_SC_ENABLED); 7053 hci_dev_set_flag(hdev, HCI_SC_ONLY); 7054 break; 7055 } 7056 7057 send_settings_rsp(cmd->sk, cmd->opcode, hdev); 7058 new_settings(hdev, cmd->sk); 7059 7060 done: 7061 mgmt_pending_free(cmd); 7062 } 7063 7064 static int set_secure_conn_sync(struct hci_dev *hdev, void *data) 7065 { 7066 struct mgmt_pending_cmd *cmd = data; 7067 struct mgmt_mode *cp = cmd->param; 7068 u8 val = !!cp->val; 7069 7070 /* Force write of val */ 7071 hci_dev_set_flag(hdev, HCI_SC_ENABLED); 7072 7073 return hci_write_sc_support_sync(hdev, val); 7074 } 7075 7076 static int set_secure_conn(struct sock *sk, struct hci_dev *hdev, 7077 void *data, u16 len) 7078 { 7079 struct mgmt_mode *cp = data; 7080 struct mgmt_pending_cmd *cmd; 7081 u8 val; 7082 int err; 7083 7084 bt_dev_dbg(hdev, "sock %p", sk); 7085 7086 if (!lmp_sc_capable(hdev) && 7087 !hci_dev_test_flag(hdev, HCI_LE_ENABLED)) 7088 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN, 7089 MGMT_STATUS_NOT_SUPPORTED); 7090 7091 if (hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) && 7092 lmp_sc_capable(hdev) && 7093 !hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) 7094 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN, 7095 MGMT_STATUS_REJECTED); 7096 7097 if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02) 7098 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN, 7099 MGMT_STATUS_INVALID_PARAMS); 7100 7101 hci_dev_lock(hdev); 7102 7103 if (!hdev_is_powered(hdev) || !lmp_sc_capable(hdev) || 7104 !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) { 7105 bool changed; 7106 7107 if (cp->val) { 7108 changed = !hci_dev_test_and_set_flag(hdev, 7109 HCI_SC_ENABLED); 7110 if (cp->val == 0x02) 7111 hci_dev_set_flag(hdev, HCI_SC_ONLY); 7112 else 7113 hci_dev_clear_flag(hdev, HCI_SC_ONLY); 7114 } else { 7115 changed = hci_dev_test_and_clear_flag(hdev, 7116 HCI_SC_ENABLED); 7117 hci_dev_clear_flag(hdev, HCI_SC_ONLY); 7118 } 7119 7120 err = send_settings_rsp(sk, MGMT_OP_SET_SECURE_CONN, hdev); 7121 if (err < 0) 7122 goto failed; 7123 7124 if (changed) 7125 err = new_settings(hdev, sk); 7126 7127 goto failed; 7128 } 7129 7130 val = !!cp->val; 7131 7132 if (val == hci_dev_test_flag(hdev, HCI_SC_ENABLED) && 7133 (cp->val == 0x02) == hci_dev_test_flag(hdev, HCI_SC_ONLY)) { 7134 err = send_settings_rsp(sk, MGMT_OP_SET_SECURE_CONN, hdev); 7135 goto failed; 7136 } 7137 7138 cmd = mgmt_pending_new(sk, MGMT_OP_SET_SECURE_CONN, hdev, data, len); 7139 if (!cmd) 7140 err = -ENOMEM; 7141 else 7142 err = hci_cmd_sync_queue(hdev, set_secure_conn_sync, cmd, 7143 set_secure_conn_complete); 7144 7145 if (err < 0) { 7146 mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN, 7147 MGMT_STATUS_FAILED); 7148 if (cmd) 7149 mgmt_pending_free(cmd); 7150 } 7151 7152 failed: 7153 hci_dev_unlock(hdev); 7154 return err; 7155 } 7156 7157 static int set_debug_keys(struct sock *sk, struct hci_dev *hdev, 7158 void *data, u16 len) 7159 { 7160 struct mgmt_mode *cp = data; 7161 bool changed, use_changed; 7162 int err; 7163 7164 bt_dev_dbg(hdev, "sock %p", sk); 7165 7166 if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02) 7167 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEBUG_KEYS, 7168 MGMT_STATUS_INVALID_PARAMS); 7169 7170 hci_dev_lock(hdev); 7171 7172 if (cp->val) 7173 changed = !hci_dev_test_and_set_flag(hdev, HCI_KEEP_DEBUG_KEYS); 7174 else 7175 changed = hci_dev_test_and_clear_flag(hdev, 7176 HCI_KEEP_DEBUG_KEYS); 7177 7178 if (cp->val == 0x02) 7179 use_changed = !hci_dev_test_and_set_flag(hdev, 7180 HCI_USE_DEBUG_KEYS); 7181 else 7182 use_changed = hci_dev_test_and_clear_flag(hdev, 7183 HCI_USE_DEBUG_KEYS); 7184 7185 if (hdev_is_powered(hdev) && use_changed && 7186 hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) { 7187 u8 mode = (cp->val == 0x02) ? 0x01 : 0x00; 7188 hci_send_cmd(hdev, HCI_OP_WRITE_SSP_DEBUG_MODE, 7189 sizeof(mode), &mode); 7190 } 7191 7192 err = send_settings_rsp(sk, MGMT_OP_SET_DEBUG_KEYS, hdev); 7193 if (err < 0) 7194 goto unlock; 7195 7196 if (changed) 7197 err = new_settings(hdev, sk); 7198 7199 unlock: 7200 hci_dev_unlock(hdev); 7201 return err; 7202 } 7203 7204 static int set_privacy(struct sock *sk, struct hci_dev *hdev, void *cp_data, 7205 u16 len) 7206 { 7207 struct mgmt_cp_set_privacy *cp = cp_data; 7208 bool changed; 7209 int err; 7210 7211 bt_dev_dbg(hdev, "sock %p", sk); 7212 7213 if (!lmp_le_capable(hdev)) 7214 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY, 7215 MGMT_STATUS_NOT_SUPPORTED); 7216 7217 if (cp->privacy != 0x00 && cp->privacy != 0x01 && cp->privacy != 0x02) 7218 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY, 7219 MGMT_STATUS_INVALID_PARAMS); 7220 7221 if (hdev_is_powered(hdev)) 7222 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY, 7223 MGMT_STATUS_REJECTED); 7224 7225 hci_dev_lock(hdev); 7226 7227 /* If user space supports this command it is also expected to 7228 * handle IRKs. Therefore, set the HCI_RPA_RESOLVING flag. 7229 */ 7230 hci_dev_set_flag(hdev, HCI_RPA_RESOLVING); 7231 7232 if (cp->privacy) { 7233 changed = !hci_dev_test_and_set_flag(hdev, HCI_PRIVACY); 7234 memcpy(hdev->irk, cp->irk, sizeof(hdev->irk)); 7235 hci_dev_set_flag(hdev, HCI_RPA_EXPIRED); 7236 hci_adv_instances_set_rpa_expired(hdev, true); 7237 if (cp->privacy == 0x02) 7238 hci_dev_set_flag(hdev, HCI_LIMITED_PRIVACY); 7239 else 7240 hci_dev_clear_flag(hdev, HCI_LIMITED_PRIVACY); 7241 } else { 7242 changed = hci_dev_test_and_clear_flag(hdev, HCI_PRIVACY); 7243 memset(hdev->irk, 0, sizeof(hdev->irk)); 7244 hci_dev_clear_flag(hdev, HCI_RPA_EXPIRED); 7245 hci_adv_instances_set_rpa_expired(hdev, false); 7246 hci_dev_clear_flag(hdev, HCI_LIMITED_PRIVACY); 7247 } 7248 7249 err = send_settings_rsp(sk, MGMT_OP_SET_PRIVACY, hdev); 7250 if (err < 0) 7251 goto unlock; 7252 7253 if (changed) 7254 err = new_settings(hdev, sk); 7255 7256 unlock: 7257 hci_dev_unlock(hdev); 7258 return err; 7259 } 7260 7261 static bool irk_is_valid(struct mgmt_irk_info *irk) 7262 { 7263 switch (irk->addr.type) { 7264 case BDADDR_LE_PUBLIC: 7265 return true; 7266 7267 case BDADDR_LE_RANDOM: 7268 /* Two most significant bits shall be set */ 7269 if ((irk->addr.bdaddr.b[5] & 0xc0) != 0xc0) 7270 return false; 7271 return true; 7272 } 7273 7274 return false; 7275 } 7276 7277 static int load_irks(struct sock *sk, struct hci_dev *hdev, void *cp_data, 7278 u16 len) 7279 { 7280 struct mgmt_cp_load_irks *cp = cp_data; 7281 const u16 max_irk_count = ((U16_MAX - sizeof(*cp)) / 7282 sizeof(struct mgmt_irk_info)); 7283 u16 irk_count, expected_len; 7284 int i, err; 7285 7286 bt_dev_dbg(hdev, "sock %p", sk); 7287 7288 if (!lmp_le_capable(hdev)) 7289 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS, 7290 MGMT_STATUS_NOT_SUPPORTED); 7291 7292 irk_count = __le16_to_cpu(cp->irk_count); 7293 if (irk_count > max_irk_count) { 7294 bt_dev_err(hdev, "load_irks: too big irk_count value %u", 7295 irk_count); 7296 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS, 7297 MGMT_STATUS_INVALID_PARAMS); 7298 } 7299 7300 expected_len = struct_size(cp, irks, irk_count); 7301 if (expected_len != len) { 7302 bt_dev_err(hdev, "load_irks: expected %u bytes, got %u bytes", 7303 expected_len, len); 7304 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS, 7305 MGMT_STATUS_INVALID_PARAMS); 7306 } 7307 7308 bt_dev_dbg(hdev, "irk_count %u", irk_count); 7309 7310 for (i = 0; i < irk_count; i++) { 7311 struct mgmt_irk_info *key = &cp->irks[i]; 7312 7313 if (!irk_is_valid(key)) 7314 return mgmt_cmd_status(sk, hdev->id, 7315 MGMT_OP_LOAD_IRKS, 7316 MGMT_STATUS_INVALID_PARAMS); 7317 } 7318 7319 hci_dev_lock(hdev); 7320 7321 hci_smp_irks_clear(hdev); 7322 7323 for (i = 0; i < irk_count; i++) { 7324 struct mgmt_irk_info *irk = &cp->irks[i]; 7325 7326 if (hci_is_blocked_key(hdev, 7327 HCI_BLOCKED_KEY_TYPE_IRK, 7328 irk->val)) { 7329 bt_dev_warn(hdev, "Skipping blocked IRK for %pMR", 7330 &irk->addr.bdaddr); 7331 continue; 7332 } 7333 7334 hci_add_irk(hdev, &irk->addr.bdaddr, 7335 le_addr_type(irk->addr.type), irk->val, 7336 BDADDR_ANY); 7337 } 7338 7339 hci_dev_set_flag(hdev, HCI_RPA_RESOLVING); 7340 7341 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_IRKS, 0, NULL, 0); 7342 7343 hci_dev_unlock(hdev); 7344 7345 return err; 7346 } 7347 7348 static bool ltk_is_valid(struct mgmt_ltk_info *key) 7349 { 7350 if (key->initiator != 0x00 && key->initiator != 0x01) 7351 return false; 7352 7353 if (key->enc_size > sizeof(key->val)) 7354 return false; 7355 7356 switch (key->addr.type) { 7357 case BDADDR_LE_PUBLIC: 7358 return true; 7359 7360 case BDADDR_LE_RANDOM: 7361 /* Two most significant bits shall be set */ 7362 if ((key->addr.bdaddr.b[5] & 0xc0) != 0xc0) 7363 return false; 7364 return true; 7365 } 7366 7367 return false; 7368 } 7369 7370 static int load_long_term_keys(struct sock *sk, struct hci_dev *hdev, 7371 void *cp_data, u16 len) 7372 { 7373 struct mgmt_cp_load_long_term_keys *cp = cp_data; 7374 const u16 max_key_count = ((U16_MAX - sizeof(*cp)) / 7375 sizeof(struct mgmt_ltk_info)); 7376 u16 key_count, expected_len; 7377 int i, err; 7378 7379 bt_dev_dbg(hdev, "sock %p", sk); 7380 7381 if (!lmp_le_capable(hdev)) 7382 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS, 7383 MGMT_STATUS_NOT_SUPPORTED); 7384 7385 key_count = __le16_to_cpu(cp->key_count); 7386 if (key_count > max_key_count) { 7387 bt_dev_err(hdev, "load_ltks: too big key_count value %u", 7388 key_count); 7389 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS, 7390 MGMT_STATUS_INVALID_PARAMS); 7391 } 7392 7393 expected_len = struct_size(cp, keys, key_count); 7394 if (expected_len != len) { 7395 bt_dev_err(hdev, "load_keys: expected %u bytes, got %u bytes", 7396 expected_len, len); 7397 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS, 7398 MGMT_STATUS_INVALID_PARAMS); 7399 } 7400 7401 bt_dev_dbg(hdev, "key_count %u", key_count); 7402 7403 hci_dev_lock(hdev); 7404 7405 hci_smp_ltks_clear(hdev); 7406 7407 for (i = 0; i < key_count; i++) { 7408 struct mgmt_ltk_info *key = &cp->keys[i]; 7409 u8 type, authenticated; 7410 7411 if (hci_is_blocked_key(hdev, 7412 HCI_BLOCKED_KEY_TYPE_LTK, 7413 key->val)) { 7414 bt_dev_warn(hdev, "Skipping blocked LTK for %pMR", 7415 &key->addr.bdaddr); 7416 continue; 7417 } 7418 7419 if (!ltk_is_valid(key)) { 7420 bt_dev_warn(hdev, "Invalid LTK for %pMR", 7421 &key->addr.bdaddr); 7422 continue; 7423 } 7424 7425 switch (key->type) { 7426 case MGMT_LTK_UNAUTHENTICATED: 7427 authenticated = 0x00; 7428 type = key->initiator ? SMP_LTK : SMP_LTK_RESPONDER; 7429 break; 7430 case MGMT_LTK_AUTHENTICATED: 7431 authenticated = 0x01; 7432 type = key->initiator ? SMP_LTK : SMP_LTK_RESPONDER; 7433 break; 7434 case MGMT_LTK_P256_UNAUTH: 7435 authenticated = 0x00; 7436 type = SMP_LTK_P256; 7437 break; 7438 case MGMT_LTK_P256_AUTH: 7439 authenticated = 0x01; 7440 type = SMP_LTK_P256; 7441 break; 7442 case MGMT_LTK_P256_DEBUG: 7443 authenticated = 0x00; 7444 type = SMP_LTK_P256_DEBUG; 7445 fallthrough; 7446 default: 7447 continue; 7448 } 7449 7450 hci_add_ltk(hdev, &key->addr.bdaddr, 7451 le_addr_type(key->addr.type), type, authenticated, 7452 key->val, key->enc_size, key->ediv, key->rand); 7453 } 7454 7455 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS, 0, 7456 NULL, 0); 7457 7458 hci_dev_unlock(hdev); 7459 7460 return err; 7461 } 7462 7463 static void get_conn_info_complete(struct hci_dev *hdev, void *data, int err) 7464 { 7465 struct mgmt_pending_cmd *cmd = data; 7466 struct hci_conn *conn = cmd->user_data; 7467 struct mgmt_cp_get_conn_info *cp = cmd->param; 7468 struct mgmt_rp_get_conn_info rp; 7469 u8 status; 7470 7471 bt_dev_dbg(hdev, "err %d", err); 7472 7473 memcpy(&rp.addr, &cp->addr, sizeof(rp.addr)); 7474 7475 status = mgmt_status(err); 7476 if (status == MGMT_STATUS_SUCCESS) { 7477 rp.rssi = conn->rssi; 7478 rp.tx_power = conn->tx_power; 7479 rp.max_tx_power = conn->max_tx_power; 7480 } else { 7481 rp.rssi = HCI_RSSI_INVALID; 7482 rp.tx_power = HCI_TX_POWER_INVALID; 7483 rp.max_tx_power = HCI_TX_POWER_INVALID; 7484 } 7485 7486 if (conn) 7487 hci_conn_put(conn); 7488 7489 mgmt_cmd_complete(cmd->sk, cmd->hdev->id, MGMT_OP_GET_CONN_INFO, status, 7490 &rp, sizeof(rp)); 7491 7492 mgmt_pending_free(cmd); 7493 } 7494 7495 static int get_conn_info_sync(struct hci_dev *hdev, void *data) 7496 { 7497 struct mgmt_pending_cmd *cmd = data; 7498 struct mgmt_cp_get_conn_info *cp = cmd->param; 7499 struct hci_conn *conn; 7500 int err; 7501 __le16 handle; 7502 7503 hci_dev_lock(hdev); 7504 7505 /* Make sure we are still connected */ 7506 if (cp->addr.type == BDADDR_BREDR) 7507 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, 7508 &cp->addr.bdaddr); 7509 else 7510 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &cp->addr.bdaddr); 7511 7512 if (!conn || conn->state != BT_CONNECTED) { 7513 hci_dev_unlock(hdev); 7514 return MGMT_STATUS_NOT_CONNECTED; 7515 } 7516 7517 cmd->user_data = hci_conn_get(conn); 7518 handle = cpu_to_le16(conn->handle); 7519 7520 hci_dev_unlock(hdev); 7521 7522 /* Refresh RSSI each time */ 7523 err = hci_read_rssi_sync(hdev, handle); 7524 7525 /* For LE links TX power does not change thus we don't need to 7526 * query for it once value is known. 7527 */ 7528 if (!err && (!bdaddr_type_is_le(cp->addr.type) || 7529 conn->tx_power == HCI_TX_POWER_INVALID)) 7530 err = hci_read_tx_power_sync(hdev, handle, 0x00); 7531 7532 /* Max TX power needs to be read only once per connection */ 7533 if (!err && conn->max_tx_power == HCI_TX_POWER_INVALID) 7534 err = hci_read_tx_power_sync(hdev, handle, 0x01); 7535 7536 return err; 7537 } 7538 7539 static int get_conn_info(struct sock *sk, struct hci_dev *hdev, void *data, 7540 u16 len) 7541 { 7542 struct mgmt_cp_get_conn_info *cp = data; 7543 struct mgmt_rp_get_conn_info rp; 7544 struct hci_conn *conn; 7545 unsigned long conn_info_age; 7546 int err = 0; 7547 7548 bt_dev_dbg(hdev, "sock %p", sk); 7549 7550 memset(&rp, 0, sizeof(rp)); 7551 bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr); 7552 rp.addr.type = cp->addr.type; 7553 7554 if (!bdaddr_type_is_valid(cp->addr.type)) 7555 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO, 7556 MGMT_STATUS_INVALID_PARAMS, 7557 &rp, sizeof(rp)); 7558 7559 hci_dev_lock(hdev); 7560 7561 if (!hdev_is_powered(hdev)) { 7562 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO, 7563 MGMT_STATUS_NOT_POWERED, &rp, 7564 sizeof(rp)); 7565 goto unlock; 7566 } 7567 7568 if (cp->addr.type == BDADDR_BREDR) 7569 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, 7570 &cp->addr.bdaddr); 7571 else 7572 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &cp->addr.bdaddr); 7573 7574 if (!conn || conn->state != BT_CONNECTED) { 7575 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO, 7576 MGMT_STATUS_NOT_CONNECTED, &rp, 7577 sizeof(rp)); 7578 goto unlock; 7579 } 7580 7581 /* To avoid client trying to guess when to poll again for information we 7582 * calculate conn info age as random value between min/max set in hdev. 7583 */ 7584 conn_info_age = get_random_u32_inclusive(hdev->conn_info_min_age, 7585 hdev->conn_info_max_age - 1); 7586 7587 /* Query controller to refresh cached values if they are too old or were 7588 * never read. 7589 */ 7590 if (time_after(jiffies, conn->conn_info_timestamp + 7591 msecs_to_jiffies(conn_info_age)) || 7592 !conn->conn_info_timestamp) { 7593 struct mgmt_pending_cmd *cmd; 7594 7595 cmd = mgmt_pending_new(sk, MGMT_OP_GET_CONN_INFO, hdev, data, 7596 len); 7597 if (!cmd) { 7598 err = -ENOMEM; 7599 } else { 7600 err = hci_cmd_sync_queue(hdev, get_conn_info_sync, 7601 cmd, get_conn_info_complete); 7602 } 7603 7604 if (err < 0) { 7605 mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO, 7606 MGMT_STATUS_FAILED, &rp, sizeof(rp)); 7607 7608 if (cmd) 7609 mgmt_pending_free(cmd); 7610 7611 goto unlock; 7612 } 7613 7614 conn->conn_info_timestamp = jiffies; 7615 } else { 7616 /* Cache is valid, just reply with values cached in hci_conn */ 7617 rp.rssi = conn->rssi; 7618 rp.tx_power = conn->tx_power; 7619 rp.max_tx_power = conn->max_tx_power; 7620 7621 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO, 7622 MGMT_STATUS_SUCCESS, &rp, sizeof(rp)); 7623 } 7624 7625 unlock: 7626 hci_dev_unlock(hdev); 7627 return err; 7628 } 7629 7630 static void get_clock_info_complete(struct hci_dev *hdev, void *data, int err) 7631 { 7632 struct mgmt_pending_cmd *cmd = data; 7633 struct mgmt_cp_get_clock_info *cp = cmd->param; 7634 struct mgmt_rp_get_clock_info rp; 7635 struct hci_conn *conn = cmd->user_data; 7636 u8 status = mgmt_status(err); 7637 7638 bt_dev_dbg(hdev, "err %d", err); 7639 7640 memset(&rp, 0, sizeof(rp)); 7641 bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr); 7642 rp.addr.type = cp->addr.type; 7643 7644 if (err) 7645 goto complete; 7646 7647 rp.local_clock = cpu_to_le32(hdev->clock); 7648 7649 if (conn) { 7650 rp.piconet_clock = cpu_to_le32(conn->clock); 7651 rp.accuracy = cpu_to_le16(conn->clock_accuracy); 7652 } 7653 7654 complete: 7655 if (conn) 7656 hci_conn_put(conn); 7657 7658 mgmt_cmd_complete(cmd->sk, cmd->hdev->id, cmd->opcode, status, &rp, 7659 sizeof(rp)); 7660 7661 mgmt_pending_free(cmd); 7662 } 7663 7664 static int get_clock_info_sync(struct hci_dev *hdev, void *data) 7665 { 7666 struct mgmt_pending_cmd *cmd = data; 7667 struct mgmt_cp_get_clock_info *cp = cmd->param; 7668 struct hci_cp_read_clock hci_cp; 7669 struct hci_conn *conn; 7670 7671 memset(&hci_cp, 0, sizeof(hci_cp)); 7672 hci_read_clock_sync(hdev, &hci_cp); 7673 7674 hci_dev_lock(hdev); 7675 7676 /* Make sure connection still exists */ 7677 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->addr.bdaddr); 7678 if (!conn || conn->state != BT_CONNECTED) { 7679 hci_dev_unlock(hdev); 7680 return MGMT_STATUS_NOT_CONNECTED; 7681 } 7682 7683 cmd->user_data = hci_conn_get(conn); 7684 hci_cp.handle = cpu_to_le16(conn->handle); 7685 hci_cp.which = 0x01; /* Piconet clock */ 7686 7687 hci_dev_unlock(hdev); 7688 7689 return hci_read_clock_sync(hdev, &hci_cp); 7690 } 7691 7692 static int get_clock_info(struct sock *sk, struct hci_dev *hdev, void *data, 7693 u16 len) 7694 { 7695 struct mgmt_cp_get_clock_info *cp = data; 7696 struct mgmt_rp_get_clock_info rp; 7697 struct mgmt_pending_cmd *cmd; 7698 struct hci_conn *conn; 7699 int err; 7700 7701 bt_dev_dbg(hdev, "sock %p", sk); 7702 7703 memset(&rp, 0, sizeof(rp)); 7704 bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr); 7705 rp.addr.type = cp->addr.type; 7706 7707 if (cp->addr.type != BDADDR_BREDR) 7708 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CLOCK_INFO, 7709 MGMT_STATUS_INVALID_PARAMS, 7710 &rp, sizeof(rp)); 7711 7712 hci_dev_lock(hdev); 7713 7714 if (!hdev_is_powered(hdev)) { 7715 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CLOCK_INFO, 7716 MGMT_STATUS_NOT_POWERED, &rp, 7717 sizeof(rp)); 7718 goto unlock; 7719 } 7720 7721 if (bacmp(&cp->addr.bdaddr, BDADDR_ANY)) { 7722 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, 7723 &cp->addr.bdaddr); 7724 if (!conn || conn->state != BT_CONNECTED) { 7725 err = mgmt_cmd_complete(sk, hdev->id, 7726 MGMT_OP_GET_CLOCK_INFO, 7727 MGMT_STATUS_NOT_CONNECTED, 7728 &rp, sizeof(rp)); 7729 goto unlock; 7730 } 7731 } else { 7732 conn = NULL; 7733 } 7734 7735 cmd = mgmt_pending_new(sk, MGMT_OP_GET_CLOCK_INFO, hdev, data, len); 7736 if (!cmd) 7737 err = -ENOMEM; 7738 else 7739 err = hci_cmd_sync_queue(hdev, get_clock_info_sync, cmd, 7740 get_clock_info_complete); 7741 7742 if (err < 0) { 7743 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CLOCK_INFO, 7744 MGMT_STATUS_FAILED, &rp, sizeof(rp)); 7745 7746 if (cmd) 7747 mgmt_pending_free(cmd); 7748 } 7749 7750 7751 unlock: 7752 hci_dev_unlock(hdev); 7753 return err; 7754 } 7755 7756 static void device_added(struct sock *sk, struct hci_dev *hdev, 7757 bdaddr_t *bdaddr, u8 type, u8 action) 7758 { 7759 struct mgmt_ev_device_added ev; 7760 7761 bacpy(&ev.addr.bdaddr, bdaddr); 7762 ev.addr.type = type; 7763 ev.action = action; 7764 7765 mgmt_event(MGMT_EV_DEVICE_ADDED, hdev, &ev, sizeof(ev), sk); 7766 } 7767 7768 static void add_device_complete(struct hci_dev *hdev, void *data, int err) 7769 { 7770 struct mgmt_pending_cmd *cmd = data; 7771 struct mgmt_cp_add_device *cp = cmd->param; 7772 7773 if (!err) { 7774 struct hci_conn_params *params; 7775 7776 hci_dev_lock(hdev); 7777 7778 params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr, 7779 le_addr_type(cp->addr.type)); 7780 7781 device_added(cmd->sk, hdev, &cp->addr.bdaddr, cp->addr.type, 7782 cp->action); 7783 device_flags_changed(NULL, hdev, &cp->addr.bdaddr, 7784 cp->addr.type, hdev->conn_flags, 7785 params ? params->flags : 0); 7786 hci_dev_unlock(hdev); 7787 } 7788 7789 mgmt_cmd_complete(cmd->sk, hdev->id, MGMT_OP_ADD_DEVICE, 7790 mgmt_status(err), &cp->addr, sizeof(cp->addr)); 7791 mgmt_pending_free(cmd); 7792 } 7793 7794 static int add_device_sync(struct hci_dev *hdev, void *data) 7795 { 7796 return hci_update_passive_scan_sync(hdev); 7797 } 7798 7799 static int add_device(struct sock *sk, struct hci_dev *hdev, 7800 void *data, u16 len) 7801 { 7802 struct mgmt_pending_cmd *cmd; 7803 struct mgmt_cp_add_device *cp = data; 7804 u8 auto_conn, addr_type; 7805 struct hci_conn_params *params; 7806 int err; 7807 u32 current_flags = 0; 7808 u32 supported_flags; 7809 7810 bt_dev_dbg(hdev, "sock %p", sk); 7811 7812 if (!bdaddr_type_is_valid(cp->addr.type) || 7813 !bacmp(&cp->addr.bdaddr, BDADDR_ANY)) 7814 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE, 7815 MGMT_STATUS_INVALID_PARAMS, 7816 &cp->addr, sizeof(cp->addr)); 7817 7818 if (cp->action != 0x00 && cp->action != 0x01 && cp->action != 0x02) 7819 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE, 7820 MGMT_STATUS_INVALID_PARAMS, 7821 &cp->addr, sizeof(cp->addr)); 7822 7823 hci_dev_lock(hdev); 7824 7825 if (cp->addr.type == BDADDR_BREDR) { 7826 /* Only incoming connections action is supported for now */ 7827 if (cp->action != 0x01) { 7828 err = mgmt_cmd_complete(sk, hdev->id, 7829 MGMT_OP_ADD_DEVICE, 7830 MGMT_STATUS_INVALID_PARAMS, 7831 &cp->addr, sizeof(cp->addr)); 7832 goto unlock; 7833 } 7834 7835 err = hci_bdaddr_list_add_with_flags(&hdev->accept_list, 7836 &cp->addr.bdaddr, 7837 cp->addr.type, 0); 7838 if (err) 7839 goto unlock; 7840 7841 hci_update_scan(hdev); 7842 7843 goto added; 7844 } 7845 7846 addr_type = le_addr_type(cp->addr.type); 7847 7848 if (cp->action == 0x02) 7849 auto_conn = HCI_AUTO_CONN_ALWAYS; 7850 else if (cp->action == 0x01) 7851 auto_conn = HCI_AUTO_CONN_DIRECT; 7852 else 7853 auto_conn = HCI_AUTO_CONN_REPORT; 7854 7855 /* Kernel internally uses conn_params with resolvable private 7856 * address, but Add Device allows only identity addresses. 7857 * Make sure it is enforced before calling 7858 * hci_conn_params_lookup. 7859 */ 7860 if (!hci_is_identity_address(&cp->addr.bdaddr, addr_type)) { 7861 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE, 7862 MGMT_STATUS_INVALID_PARAMS, 7863 &cp->addr, sizeof(cp->addr)); 7864 goto unlock; 7865 } 7866 7867 /* If the connection parameters don't exist for this device, 7868 * they will be created and configured with defaults. 7869 */ 7870 params = hci_conn_params_set(hdev, &cp->addr.bdaddr, addr_type, 7871 auto_conn); 7872 if (!params) { 7873 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE, 7874 MGMT_STATUS_FAILED, &cp->addr, 7875 sizeof(cp->addr)); 7876 goto unlock; 7877 } 7878 7879 cmd = mgmt_pending_new(sk, MGMT_OP_ADD_DEVICE, hdev, data, len); 7880 if (!cmd) { 7881 err = -ENOMEM; 7882 goto unlock; 7883 } 7884 7885 err = hci_cmd_sync_queue(hdev, add_device_sync, cmd, 7886 add_device_complete); 7887 if (err < 0) { 7888 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE, 7889 MGMT_STATUS_FAILED, &cp->addr, 7890 sizeof(cp->addr)); 7891 mgmt_pending_free(cmd); 7892 } 7893 7894 goto unlock; 7895 7896 added: 7897 device_added(sk, hdev, &cp->addr.bdaddr, cp->addr.type, cp->action); 7898 supported_flags = hdev->conn_flags; 7899 device_flags_changed(NULL, hdev, &cp->addr.bdaddr, cp->addr.type, 7900 supported_flags, current_flags); 7901 7902 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE, 7903 MGMT_STATUS_SUCCESS, &cp->addr, 7904 sizeof(cp->addr)); 7905 7906 unlock: 7907 hci_dev_unlock(hdev); 7908 return err; 7909 } 7910 7911 static void device_removed(struct sock *sk, struct hci_dev *hdev, 7912 bdaddr_t *bdaddr, u8 type) 7913 { 7914 struct mgmt_ev_device_removed ev; 7915 7916 bacpy(&ev.addr.bdaddr, bdaddr); 7917 ev.addr.type = type; 7918 7919 mgmt_event(MGMT_EV_DEVICE_REMOVED, hdev, &ev, sizeof(ev), sk); 7920 } 7921 7922 static int remove_device_sync(struct hci_dev *hdev, void *data) 7923 { 7924 return hci_update_passive_scan_sync(hdev); 7925 } 7926 7927 static int remove_device(struct sock *sk, struct hci_dev *hdev, 7928 void *data, u16 len) 7929 { 7930 struct mgmt_cp_remove_device *cp = data; 7931 int err; 7932 7933 bt_dev_dbg(hdev, "sock %p", sk); 7934 7935 hci_dev_lock(hdev); 7936 7937 if (bacmp(&cp->addr.bdaddr, BDADDR_ANY)) { 7938 struct hci_conn_params *params; 7939 u8 addr_type; 7940 7941 if (!bdaddr_type_is_valid(cp->addr.type)) { 7942 err = mgmt_cmd_complete(sk, hdev->id, 7943 MGMT_OP_REMOVE_DEVICE, 7944 MGMT_STATUS_INVALID_PARAMS, 7945 &cp->addr, sizeof(cp->addr)); 7946 goto unlock; 7947 } 7948 7949 if (cp->addr.type == BDADDR_BREDR) { 7950 err = hci_bdaddr_list_del(&hdev->accept_list, 7951 &cp->addr.bdaddr, 7952 cp->addr.type); 7953 if (err) { 7954 err = mgmt_cmd_complete(sk, hdev->id, 7955 MGMT_OP_REMOVE_DEVICE, 7956 MGMT_STATUS_INVALID_PARAMS, 7957 &cp->addr, 7958 sizeof(cp->addr)); 7959 goto unlock; 7960 } 7961 7962 hci_update_scan(hdev); 7963 7964 device_removed(sk, hdev, &cp->addr.bdaddr, 7965 cp->addr.type); 7966 goto complete; 7967 } 7968 7969 addr_type = le_addr_type(cp->addr.type); 7970 7971 /* Kernel internally uses conn_params with resolvable private 7972 * address, but Remove Device allows only identity addresses. 7973 * Make sure it is enforced before calling 7974 * hci_conn_params_lookup. 7975 */ 7976 if (!hci_is_identity_address(&cp->addr.bdaddr, addr_type)) { 7977 err = mgmt_cmd_complete(sk, hdev->id, 7978 MGMT_OP_REMOVE_DEVICE, 7979 MGMT_STATUS_INVALID_PARAMS, 7980 &cp->addr, sizeof(cp->addr)); 7981 goto unlock; 7982 } 7983 7984 params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr, 7985 addr_type); 7986 if (!params) { 7987 err = mgmt_cmd_complete(sk, hdev->id, 7988 MGMT_OP_REMOVE_DEVICE, 7989 MGMT_STATUS_INVALID_PARAMS, 7990 &cp->addr, sizeof(cp->addr)); 7991 goto unlock; 7992 } 7993 7994 if (params->auto_connect == HCI_AUTO_CONN_DISABLED || 7995 params->auto_connect == HCI_AUTO_CONN_EXPLICIT) { 7996 err = mgmt_cmd_complete(sk, hdev->id, 7997 MGMT_OP_REMOVE_DEVICE, 7998 MGMT_STATUS_INVALID_PARAMS, 7999 &cp->addr, sizeof(cp->addr)); 8000 goto unlock; 8001 } 8002 8003 hci_conn_params_free(params); 8004 8005 device_removed(sk, hdev, &cp->addr.bdaddr, cp->addr.type); 8006 } else { 8007 struct hci_conn_params *p, *tmp; 8008 struct bdaddr_list *b, *btmp; 8009 8010 if (cp->addr.type) { 8011 err = mgmt_cmd_complete(sk, hdev->id, 8012 MGMT_OP_REMOVE_DEVICE, 8013 MGMT_STATUS_INVALID_PARAMS, 8014 &cp->addr, sizeof(cp->addr)); 8015 goto unlock; 8016 } 8017 8018 list_for_each_entry_safe(b, btmp, &hdev->accept_list, list) { 8019 device_removed(sk, hdev, &b->bdaddr, b->bdaddr_type); 8020 list_del(&b->list); 8021 kfree(b); 8022 } 8023 8024 hci_update_scan(hdev); 8025 8026 list_for_each_entry_safe(p, tmp, &hdev->le_conn_params, list) { 8027 if (p->auto_connect == HCI_AUTO_CONN_DISABLED) 8028 continue; 8029 device_removed(sk, hdev, &p->addr, p->addr_type); 8030 if (p->explicit_connect) { 8031 p->auto_connect = HCI_AUTO_CONN_EXPLICIT; 8032 continue; 8033 } 8034 hci_conn_params_free(p); 8035 } 8036 8037 bt_dev_dbg(hdev, "All LE connection parameters were removed"); 8038 } 8039 8040 hci_cmd_sync_queue(hdev, remove_device_sync, NULL, NULL); 8041 8042 complete: 8043 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_DEVICE, 8044 MGMT_STATUS_SUCCESS, &cp->addr, 8045 sizeof(cp->addr)); 8046 unlock: 8047 hci_dev_unlock(hdev); 8048 return err; 8049 } 8050 8051 static int conn_update_sync(struct hci_dev *hdev, void *data) 8052 { 8053 struct hci_conn *conn = data; 8054 struct hci_conn_params *params; 8055 struct hci_conn_params local = {}; 8056 8057 hci_dev_lock(hdev); 8058 8059 if (!hci_conn_valid(hdev, conn) || conn->role != HCI_ROLE_MASTER) 8060 goto cancel; 8061 8062 params = hci_conn_params_lookup(hdev, &conn->dst, conn->dst_type); 8063 if (!params) 8064 goto cancel; 8065 8066 local.conn_min_interval = params->conn_min_interval; 8067 local.conn_max_interval = params->conn_max_interval; 8068 local.conn_latency = params->conn_latency; 8069 local.supervision_timeout = params->supervision_timeout; 8070 8071 hci_dev_unlock(hdev); 8072 8073 return hci_le_conn_update_sync(hdev, conn, &local); 8074 8075 cancel: 8076 hci_dev_unlock(hdev); 8077 return -ECANCELED; 8078 } 8079 8080 static void conn_update_sync_destroy(struct hci_dev *hdev, void *data, int err) 8081 { 8082 hci_conn_put(data); 8083 } 8084 8085 static int load_conn_param(struct sock *sk, struct hci_dev *hdev, void *data, 8086 u16 len) 8087 { 8088 struct mgmt_cp_load_conn_param *cp = data; 8089 const u16 max_param_count = ((U16_MAX - sizeof(*cp)) / 8090 sizeof(struct mgmt_conn_param)); 8091 u16 param_count, expected_len; 8092 int i; 8093 8094 if (!lmp_le_capable(hdev)) 8095 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM, 8096 MGMT_STATUS_NOT_SUPPORTED); 8097 8098 param_count = __le16_to_cpu(cp->param_count); 8099 if (param_count > max_param_count) { 8100 bt_dev_err(hdev, "load_conn_param: too big param_count value %u", 8101 param_count); 8102 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM, 8103 MGMT_STATUS_INVALID_PARAMS); 8104 } 8105 8106 expected_len = struct_size(cp, params, param_count); 8107 if (expected_len != len) { 8108 bt_dev_err(hdev, "load_conn_param: expected %u bytes, got %u bytes", 8109 expected_len, len); 8110 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM, 8111 MGMT_STATUS_INVALID_PARAMS); 8112 } 8113 8114 bt_dev_dbg(hdev, "param_count %u", param_count); 8115 8116 hci_dev_lock(hdev); 8117 8118 if (param_count > 1) 8119 hci_conn_params_clear_disabled(hdev); 8120 8121 for (i = 0; i < param_count; i++) { 8122 struct mgmt_conn_param *param = &cp->params[i]; 8123 struct hci_conn_params *hci_param; 8124 u16 min, max, latency, timeout; 8125 bool update = false; 8126 u8 addr_type; 8127 8128 bt_dev_dbg(hdev, "Adding %pMR (type %u)", ¶m->addr.bdaddr, 8129 param->addr.type); 8130 8131 if (param->addr.type == BDADDR_LE_PUBLIC) { 8132 addr_type = ADDR_LE_DEV_PUBLIC; 8133 } else if (param->addr.type == BDADDR_LE_RANDOM) { 8134 addr_type = ADDR_LE_DEV_RANDOM; 8135 } else { 8136 bt_dev_err(hdev, "ignoring invalid connection parameters"); 8137 continue; 8138 } 8139 8140 min = le16_to_cpu(param->min_interval); 8141 max = le16_to_cpu(param->max_interval); 8142 latency = le16_to_cpu(param->latency); 8143 timeout = le16_to_cpu(param->timeout); 8144 8145 bt_dev_dbg(hdev, "min 0x%04x max 0x%04x latency 0x%04x timeout 0x%04x", 8146 min, max, latency, timeout); 8147 8148 if (hci_check_conn_params(min, max, latency, timeout) < 0) { 8149 bt_dev_err(hdev, "ignoring invalid connection parameters"); 8150 continue; 8151 } 8152 8153 /* Detect when the loading is for an existing parameter then 8154 * attempt to trigger the connection update procedure. 8155 */ 8156 if (!i && param_count == 1) { 8157 hci_param = hci_conn_params_lookup(hdev, 8158 ¶m->addr.bdaddr, 8159 addr_type); 8160 if (hci_param) 8161 update = true; 8162 else 8163 hci_conn_params_clear_disabled(hdev); 8164 } 8165 8166 hci_param = hci_conn_params_add(hdev, ¶m->addr.bdaddr, 8167 addr_type); 8168 if (!hci_param) { 8169 bt_dev_err(hdev, "failed to add connection parameters"); 8170 continue; 8171 } 8172 8173 hci_param->conn_min_interval = min; 8174 hci_param->conn_max_interval = max; 8175 hci_param->conn_latency = latency; 8176 hci_param->supervision_timeout = timeout; 8177 8178 /* Check if we need to trigger a connection update */ 8179 if (update) { 8180 struct hci_conn *conn; 8181 8182 /* Lookup for existing connection as central and check 8183 * if parameters match and if they don't then trigger 8184 * a connection update. 8185 */ 8186 conn = hci_conn_hash_lookup_le(hdev, &hci_param->addr, 8187 addr_type); 8188 if (conn && conn->role == HCI_ROLE_MASTER && 8189 (conn->le_conn_min_interval != min || 8190 conn->le_conn_max_interval != max || 8191 conn->le_conn_latency != latency || 8192 conn->le_supv_timeout != timeout)) { 8193 hci_conn_get(conn); 8194 if (hci_cmd_sync_queue(hdev, conn_update_sync, 8195 conn, 8196 conn_update_sync_destroy) < 0) 8197 hci_conn_put(conn); 8198 } 8199 } 8200 } 8201 8202 hci_dev_unlock(hdev); 8203 8204 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM, 0, 8205 NULL, 0); 8206 } 8207 8208 static int load_conn_subrate(struct sock *sk, struct hci_dev *hdev, void *data, 8209 u16 len) 8210 { 8211 struct mgmt_cp_load_conn_subrate *cp = data; 8212 const u16 max_param_count = ((U16_MAX - sizeof(*cp)) / 8213 sizeof(struct mgmt_conn_subrate)); 8214 u16 param_count, expected_len; 8215 int i; 8216 8217 if (!lmp_le_capable(hdev) || !le_sci_capable(hdev)) 8218 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_SUBRATE, 8219 MGMT_STATUS_NOT_SUPPORTED); 8220 8221 param_count = __le16_to_cpu(cp->param_count); 8222 if (param_count > max_param_count) { 8223 bt_dev_err(hdev, "too big param_count value %u", param_count); 8224 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_SUBRATE, 8225 MGMT_STATUS_INVALID_PARAMS); 8226 } 8227 8228 expected_len = struct_size(cp, params, param_count); 8229 if (expected_len != len) { 8230 bt_dev_err(hdev, "expected %u bytes, got %u bytes", 8231 expected_len, len); 8232 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_SUBRATE, 8233 MGMT_STATUS_INVALID_PARAMS); 8234 } 8235 8236 bt_dev_dbg(hdev, "param_count %u", param_count); 8237 8238 hci_dev_lock(hdev); 8239 8240 for (i = 0; i < param_count; i++) { 8241 struct mgmt_conn_subrate *param = &cp->params[i]; 8242 struct hci_conn_params *hci_param; 8243 u16 min, max, subrate_min, subrate_max; 8244 u16 max_latency, cont_num, supv_timeout; 8245 u8 addr_type; 8246 8247 bt_dev_dbg(hdev, "Adding subrate %pMR (type %u)", 8248 ¶m->addr.bdaddr, param->addr.type); 8249 8250 if (param->addr.type == BDADDR_LE_PUBLIC) { 8251 addr_type = ADDR_LE_DEV_PUBLIC; 8252 } else if (param->addr.type == BDADDR_LE_RANDOM) { 8253 addr_type = ADDR_LE_DEV_RANDOM; 8254 } else { 8255 bt_dev_err(hdev, "ignoring invalid connection subrate parameters"); 8256 continue; 8257 } 8258 8259 min = le16_to_cpu(param->min_interval); 8260 max = le16_to_cpu(param->max_interval); 8261 subrate_min = le16_to_cpu(param->subrate_min); 8262 subrate_max = le16_to_cpu(param->subrate_max); 8263 max_latency = le16_to_cpu(param->max_latency); 8264 cont_num = le16_to_cpu(param->cont_num); 8265 supv_timeout = le16_to_cpu(param->supv_timeout); 8266 8267 /* Validate the parameters before storing them. Reject 8268 * logically inconsistent values instead of forwarding them to 8269 * the controller. 8270 */ 8271 if (min > max || subrate_min > subrate_max || 8272 subrate_min < 1 || supv_timeout < 1) { 8273 bt_dev_err(hdev, "ignoring invalid connection subrate parameters"); 8274 continue; 8275 } 8276 8277 hci_param = hci_conn_params_add(hdev, ¶m->addr.bdaddr, 8278 addr_type); 8279 if (!hci_param) { 8280 bt_dev_err(hdev, "failed to add connection parameters"); 8281 continue; 8282 } 8283 8284 hci_param->rate_min_interval = min; 8285 hci_param->rate_max_interval = max; 8286 hci_param->subrate_min = subrate_min; 8287 hci_param->subrate_max = subrate_max; 8288 hci_param->max_latency = max_latency; 8289 hci_param->cont_num = cont_num; 8290 hci_param->rate_supv_timeout = supv_timeout; 8291 8292 /* If the device is connected as central check if the 8293 * connection rate parameters need to be updated. 8294 */ 8295 if (!i && param_count == 1) { 8296 struct hci_conn *conn; 8297 8298 conn = hci_conn_hash_lookup_le(hdev, 8299 &hci_param->addr, 8300 addr_type); 8301 if (conn && conn->state == BT_CONNECTED && 8302 conn->role == HCI_ROLE_MASTER && 8303 (conn->le_rate_interval < min || 8304 conn->le_rate_interval > max || 8305 conn->le_subrate < subrate_min || 8306 conn->le_subrate > subrate_max || 8307 conn->le_rate_latency != max_latency || 8308 conn->le_cont_num != cont_num || 8309 conn->le_rate_supv_timeout != supv_timeout)) 8310 hci_le_conn_rate_request(hdev, conn); 8311 } 8312 } 8313 8314 hci_dev_unlock(hdev); 8315 8316 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_CONN_SUBRATE, 0, 8317 NULL, 0); 8318 } 8319 8320 static int set_external_config(struct sock *sk, struct hci_dev *hdev, 8321 void *data, u16 len) 8322 { 8323 struct mgmt_cp_set_external_config *cp = data; 8324 bool changed; 8325 int err; 8326 8327 bt_dev_dbg(hdev, "sock %p", sk); 8328 8329 if (hdev_is_powered(hdev)) 8330 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_EXTERNAL_CONFIG, 8331 MGMT_STATUS_REJECTED); 8332 8333 if (cp->config != 0x00 && cp->config != 0x01) 8334 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_EXTERNAL_CONFIG, 8335 MGMT_STATUS_INVALID_PARAMS); 8336 8337 if (!hci_test_quirk(hdev, HCI_QUIRK_EXTERNAL_CONFIG)) 8338 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_EXTERNAL_CONFIG, 8339 MGMT_STATUS_NOT_SUPPORTED); 8340 8341 hci_dev_lock(hdev); 8342 8343 if (cp->config) 8344 changed = !hci_dev_test_and_set_flag(hdev, HCI_EXT_CONFIGURED); 8345 else 8346 changed = hci_dev_test_and_clear_flag(hdev, HCI_EXT_CONFIGURED); 8347 8348 err = send_options_rsp(sk, MGMT_OP_SET_EXTERNAL_CONFIG, hdev); 8349 if (err < 0) 8350 goto unlock; 8351 8352 if (!changed) 8353 goto unlock; 8354 8355 err = new_options(hdev, sk); 8356 8357 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED) == is_configured(hdev)) { 8358 mgmt_index_removed(hdev); 8359 8360 if (hci_dev_test_and_change_flag(hdev, HCI_UNCONFIGURED)) { 8361 hci_dev_set_flag(hdev, HCI_CONFIG); 8362 hci_dev_set_flag(hdev, HCI_AUTO_OFF); 8363 8364 queue_work(hdev->req_workqueue, &hdev->power_on); 8365 } else { 8366 set_bit(HCI_RAW, &hdev->flags); 8367 mgmt_index_added(hdev); 8368 } 8369 } 8370 8371 unlock: 8372 hci_dev_unlock(hdev); 8373 return err; 8374 } 8375 8376 static int set_public_address(struct sock *sk, struct hci_dev *hdev, 8377 void *data, u16 len) 8378 { 8379 struct mgmt_cp_set_public_address *cp = data; 8380 bool changed; 8381 int err; 8382 8383 bt_dev_dbg(hdev, "sock %p", sk); 8384 8385 if (hdev_is_powered(hdev)) 8386 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PUBLIC_ADDRESS, 8387 MGMT_STATUS_REJECTED); 8388 8389 if (!bacmp(&cp->bdaddr, BDADDR_ANY)) 8390 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PUBLIC_ADDRESS, 8391 MGMT_STATUS_INVALID_PARAMS); 8392 8393 if (!hdev->set_bdaddr) 8394 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PUBLIC_ADDRESS, 8395 MGMT_STATUS_NOT_SUPPORTED); 8396 8397 hci_dev_lock(hdev); 8398 8399 changed = !!bacmp(&hdev->public_addr, &cp->bdaddr); 8400 bacpy(&hdev->public_addr, &cp->bdaddr); 8401 8402 err = send_options_rsp(sk, MGMT_OP_SET_PUBLIC_ADDRESS, hdev); 8403 if (err < 0) 8404 goto unlock; 8405 8406 if (!changed) 8407 goto unlock; 8408 8409 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) 8410 err = new_options(hdev, sk); 8411 8412 if (is_configured(hdev)) { 8413 mgmt_index_removed(hdev); 8414 8415 hci_dev_clear_flag(hdev, HCI_UNCONFIGURED); 8416 8417 hci_dev_set_flag(hdev, HCI_CONFIG); 8418 hci_dev_set_flag(hdev, HCI_AUTO_OFF); 8419 8420 queue_work(hdev->req_workqueue, &hdev->power_on); 8421 } 8422 8423 unlock: 8424 hci_dev_unlock(hdev); 8425 return err; 8426 } 8427 8428 static void read_local_oob_ext_data_complete(struct hci_dev *hdev, void *data, 8429 int err) 8430 { 8431 const struct mgmt_cp_read_local_oob_ext_data *mgmt_cp; 8432 struct mgmt_rp_read_local_oob_ext_data *mgmt_rp; 8433 u8 *h192, *r192, *h256, *r256; 8434 struct mgmt_pending_cmd *cmd = data; 8435 struct sk_buff *skb = cmd->skb; 8436 u8 status = mgmt_status(err); 8437 u16 eir_len; 8438 8439 if (!status) { 8440 if (!skb) 8441 status = MGMT_STATUS_FAILED; 8442 else if (IS_ERR(skb)) 8443 status = mgmt_status(PTR_ERR(skb)); 8444 else 8445 status = mgmt_status(skb->data[0]); 8446 } 8447 8448 bt_dev_dbg(hdev, "status %u", status); 8449 8450 mgmt_cp = cmd->param; 8451 8452 if (status) { 8453 status = mgmt_status(status); 8454 eir_len = 0; 8455 8456 h192 = NULL; 8457 r192 = NULL; 8458 h256 = NULL; 8459 r256 = NULL; 8460 } else if (!bredr_sc_enabled(hdev)) { 8461 struct hci_rp_read_local_oob_data *rp; 8462 8463 if (skb->len != sizeof(*rp)) { 8464 status = MGMT_STATUS_FAILED; 8465 eir_len = 0; 8466 } else { 8467 status = MGMT_STATUS_SUCCESS; 8468 rp = (void *)skb->data; 8469 8470 eir_len = 5 + 18 + 18; 8471 h192 = rp->hash; 8472 r192 = rp->rand; 8473 h256 = NULL; 8474 r256 = NULL; 8475 } 8476 } else { 8477 struct hci_rp_read_local_oob_ext_data *rp; 8478 8479 if (skb->len != sizeof(*rp)) { 8480 status = MGMT_STATUS_FAILED; 8481 eir_len = 0; 8482 } else { 8483 status = MGMT_STATUS_SUCCESS; 8484 rp = (void *)skb->data; 8485 8486 if (hci_dev_test_flag(hdev, HCI_SC_ONLY)) { 8487 eir_len = 5 + 18 + 18; 8488 h192 = NULL; 8489 r192 = NULL; 8490 } else { 8491 eir_len = 5 + 18 + 18 + 18 + 18; 8492 h192 = rp->hash192; 8493 r192 = rp->rand192; 8494 } 8495 8496 h256 = rp->hash256; 8497 r256 = rp->rand256; 8498 } 8499 } 8500 8501 mgmt_rp = kmalloc(sizeof(*mgmt_rp) + eir_len, GFP_KERNEL); 8502 if (!mgmt_rp) 8503 goto done; 8504 8505 if (eir_len == 0) 8506 goto send_rsp; 8507 8508 eir_len = eir_append_data(mgmt_rp->eir, 0, EIR_CLASS_OF_DEV, 8509 hdev->dev_class, 3); 8510 8511 if (h192 && r192) { 8512 eir_len = eir_append_data(mgmt_rp->eir, eir_len, 8513 EIR_SSP_HASH_C192, h192, 16); 8514 eir_len = eir_append_data(mgmt_rp->eir, eir_len, 8515 EIR_SSP_RAND_R192, r192, 16); 8516 } 8517 8518 if (h256 && r256) { 8519 eir_len = eir_append_data(mgmt_rp->eir, eir_len, 8520 EIR_SSP_HASH_C256, h256, 16); 8521 eir_len = eir_append_data(mgmt_rp->eir, eir_len, 8522 EIR_SSP_RAND_R256, r256, 16); 8523 } 8524 8525 send_rsp: 8526 mgmt_rp->type = mgmt_cp->type; 8527 mgmt_rp->eir_len = cpu_to_le16(eir_len); 8528 8529 err = mgmt_cmd_complete(cmd->sk, hdev->id, 8530 MGMT_OP_READ_LOCAL_OOB_EXT_DATA, status, 8531 mgmt_rp, sizeof(*mgmt_rp) + eir_len); 8532 if (err < 0 || status) 8533 goto done; 8534 8535 hci_sock_set_flag(cmd->sk, HCI_MGMT_OOB_DATA_EVENTS); 8536 8537 err = mgmt_limited_event(MGMT_EV_LOCAL_OOB_DATA_UPDATED, hdev, 8538 mgmt_rp, sizeof(*mgmt_rp) + eir_len, 8539 HCI_MGMT_OOB_DATA_EVENTS, cmd->sk); 8540 done: 8541 if (skb && !IS_ERR(skb)) 8542 kfree_skb(skb); 8543 8544 kfree(mgmt_rp); 8545 mgmt_pending_free(cmd); 8546 } 8547 8548 static int read_local_ssp_oob_req(struct hci_dev *hdev, struct sock *sk, 8549 struct mgmt_cp_read_local_oob_ext_data *cp) 8550 { 8551 struct mgmt_pending_cmd *cmd; 8552 int err; 8553 8554 cmd = mgmt_pending_new(sk, MGMT_OP_READ_LOCAL_OOB_EXT_DATA, hdev, 8555 cp, sizeof(*cp)); 8556 if (!cmd) 8557 return -ENOMEM; 8558 8559 err = hci_cmd_sync_queue(hdev, read_local_oob_data_sync, cmd, 8560 read_local_oob_ext_data_complete); 8561 8562 if (err < 0) { 8563 mgmt_pending_remove(cmd); 8564 return err; 8565 } 8566 8567 return 0; 8568 } 8569 8570 static int read_local_oob_ext_data(struct sock *sk, struct hci_dev *hdev, 8571 void *data, u16 data_len) 8572 { 8573 struct mgmt_cp_read_local_oob_ext_data *cp = data; 8574 struct mgmt_rp_read_local_oob_ext_data *rp; 8575 size_t rp_len; 8576 u16 eir_len; 8577 u8 status, flags, role, addr[7], hash[16], rand[16]; 8578 int err; 8579 8580 bt_dev_dbg(hdev, "sock %p", sk); 8581 8582 if (hdev_is_powered(hdev)) { 8583 switch (cp->type) { 8584 case BIT(BDADDR_BREDR): 8585 status = mgmt_bredr_support(hdev); 8586 if (status) 8587 eir_len = 0; 8588 else 8589 eir_len = 5; 8590 break; 8591 case (BIT(BDADDR_LE_PUBLIC) | BIT(BDADDR_LE_RANDOM)): 8592 status = mgmt_le_support(hdev); 8593 if (status) 8594 eir_len = 0; 8595 else 8596 eir_len = 9 + 3 + 18 + 18 + 3; 8597 break; 8598 default: 8599 status = MGMT_STATUS_INVALID_PARAMS; 8600 eir_len = 0; 8601 break; 8602 } 8603 } else { 8604 status = MGMT_STATUS_NOT_POWERED; 8605 eir_len = 0; 8606 } 8607 8608 rp_len = sizeof(*rp) + eir_len; 8609 rp = kmalloc(rp_len, GFP_ATOMIC); 8610 if (!rp) 8611 return -ENOMEM; 8612 8613 if (!status && !lmp_ssp_capable(hdev)) { 8614 status = MGMT_STATUS_NOT_SUPPORTED; 8615 eir_len = 0; 8616 } 8617 8618 if (status) 8619 goto complete; 8620 8621 hci_dev_lock(hdev); 8622 8623 eir_len = 0; 8624 switch (cp->type) { 8625 case BIT(BDADDR_BREDR): 8626 if (hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) { 8627 err = read_local_ssp_oob_req(hdev, sk, cp); 8628 hci_dev_unlock(hdev); 8629 if (!err) 8630 goto done; 8631 8632 status = MGMT_STATUS_FAILED; 8633 goto complete; 8634 } else { 8635 eir_len = eir_append_data(rp->eir, eir_len, 8636 EIR_CLASS_OF_DEV, 8637 hdev->dev_class, 3); 8638 } 8639 break; 8640 case (BIT(BDADDR_LE_PUBLIC) | BIT(BDADDR_LE_RANDOM)): 8641 if (hci_dev_test_flag(hdev, HCI_SC_ENABLED) && 8642 smp_generate_oob(hdev, hash, rand) < 0) { 8643 hci_dev_unlock(hdev); 8644 status = MGMT_STATUS_FAILED; 8645 goto complete; 8646 } 8647 8648 /* This should return the active RPA, but since the RPA 8649 * is only programmed on demand, it is really hard to fill 8650 * this in at the moment. For now disallow retrieving 8651 * local out-of-band data when privacy is in use. 8652 * 8653 * Returning the identity address will not help here since 8654 * pairing happens before the identity resolving key is 8655 * known and thus the connection establishment happens 8656 * based on the RPA and not the identity address. 8657 */ 8658 if (hci_dev_test_flag(hdev, HCI_PRIVACY)) { 8659 hci_dev_unlock(hdev); 8660 status = MGMT_STATUS_REJECTED; 8661 goto complete; 8662 } 8663 8664 if (hci_dev_test_flag(hdev, HCI_FORCE_STATIC_ADDR) || 8665 !bacmp(&hdev->bdaddr, BDADDR_ANY) || 8666 (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) && 8667 bacmp(&hdev->static_addr, BDADDR_ANY))) { 8668 memcpy(addr, &hdev->static_addr, 6); 8669 addr[6] = 0x01; 8670 } else { 8671 memcpy(addr, &hdev->bdaddr, 6); 8672 addr[6] = 0x00; 8673 } 8674 8675 eir_len = eir_append_data(rp->eir, eir_len, EIR_LE_BDADDR, 8676 addr, sizeof(addr)); 8677 8678 if (hci_dev_test_flag(hdev, HCI_ADVERTISING)) 8679 role = 0x02; 8680 else 8681 role = 0x01; 8682 8683 eir_len = eir_append_data(rp->eir, eir_len, EIR_LE_ROLE, 8684 &role, sizeof(role)); 8685 8686 if (hci_dev_test_flag(hdev, HCI_SC_ENABLED)) { 8687 eir_len = eir_append_data(rp->eir, eir_len, 8688 EIR_LE_SC_CONFIRM, 8689 hash, sizeof(hash)); 8690 8691 eir_len = eir_append_data(rp->eir, eir_len, 8692 EIR_LE_SC_RANDOM, 8693 rand, sizeof(rand)); 8694 } 8695 8696 flags = mgmt_get_adv_discov_flags(hdev); 8697 8698 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) 8699 flags |= LE_AD_NO_BREDR; 8700 8701 eir_len = eir_append_data(rp->eir, eir_len, EIR_FLAGS, 8702 &flags, sizeof(flags)); 8703 break; 8704 } 8705 8706 hci_dev_unlock(hdev); 8707 8708 hci_sock_set_flag(sk, HCI_MGMT_OOB_DATA_EVENTS); 8709 8710 status = MGMT_STATUS_SUCCESS; 8711 8712 complete: 8713 rp->type = cp->type; 8714 rp->eir_len = cpu_to_le16(eir_len); 8715 8716 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_EXT_DATA, 8717 status, rp, sizeof(*rp) + eir_len); 8718 if (err < 0 || status) 8719 goto done; 8720 8721 err = mgmt_limited_event(MGMT_EV_LOCAL_OOB_DATA_UPDATED, hdev, 8722 rp, sizeof(*rp) + eir_len, 8723 HCI_MGMT_OOB_DATA_EVENTS, sk); 8724 8725 done: 8726 kfree(rp); 8727 8728 return err; 8729 } 8730 8731 static u32 get_supported_adv_flags(struct hci_dev *hdev) 8732 { 8733 u32 flags = 0; 8734 8735 flags |= MGMT_ADV_FLAG_CONNECTABLE; 8736 flags |= MGMT_ADV_FLAG_DISCOV; 8737 flags |= MGMT_ADV_FLAG_LIMITED_DISCOV; 8738 flags |= MGMT_ADV_FLAG_MANAGED_FLAGS; 8739 flags |= MGMT_ADV_FLAG_APPEARANCE; 8740 flags |= MGMT_ADV_FLAG_LOCAL_NAME; 8741 flags |= MGMT_ADV_PARAM_DURATION; 8742 flags |= MGMT_ADV_PARAM_TIMEOUT; 8743 flags |= MGMT_ADV_PARAM_INTERVALS; 8744 flags |= MGMT_ADV_PARAM_TX_POWER; 8745 flags |= MGMT_ADV_PARAM_SCAN_RSP; 8746 8747 /* In extended adv TX_POWER returned from Set Adv Param 8748 * will be always valid. 8749 */ 8750 if (hdev->adv_tx_power != HCI_TX_POWER_INVALID || ext_adv_capable(hdev)) 8751 flags |= MGMT_ADV_FLAG_TX_POWER; 8752 8753 if (ext_adv_capable(hdev)) { 8754 flags |= MGMT_ADV_FLAG_SEC_1M; 8755 flags |= MGMT_ADV_FLAG_HW_OFFLOAD; 8756 flags |= MGMT_ADV_FLAG_CAN_SET_TX_POWER; 8757 8758 if (le_2m_capable(hdev)) 8759 flags |= MGMT_ADV_FLAG_SEC_2M; 8760 8761 if (le_coded_capable(hdev)) 8762 flags |= MGMT_ADV_FLAG_SEC_CODED; 8763 } 8764 8765 return flags; 8766 } 8767 8768 static int read_adv_features(struct sock *sk, struct hci_dev *hdev, 8769 void *data, u16 data_len) 8770 { 8771 struct mgmt_rp_read_adv_features *rp; 8772 size_t rp_len; 8773 int err; 8774 struct adv_info *adv_instance; 8775 u32 supported_flags; 8776 u8 *instance; 8777 8778 bt_dev_dbg(hdev, "sock %p", sk); 8779 8780 if (!lmp_le_capable(hdev)) 8781 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_ADV_FEATURES, 8782 MGMT_STATUS_REJECTED); 8783 8784 hci_dev_lock(hdev); 8785 8786 rp_len = sizeof(*rp) + hdev->adv_instance_cnt; 8787 rp = kmalloc(rp_len, GFP_ATOMIC); 8788 if (!rp) { 8789 hci_dev_unlock(hdev); 8790 return -ENOMEM; 8791 } 8792 8793 supported_flags = get_supported_adv_flags(hdev); 8794 8795 rp->supported_flags = cpu_to_le32(supported_flags); 8796 rp->max_adv_data_len = max_adv_len(hdev); 8797 rp->max_scan_rsp_len = max_adv_len(hdev); 8798 rp->max_instances = hdev->le_num_of_adv_sets; 8799 rp->num_instances = hdev->adv_instance_cnt; 8800 8801 instance = rp->instance; 8802 list_for_each_entry(adv_instance, &hdev->adv_instances, list) { 8803 /* Only instances 1-le_num_of_adv_sets are externally visible */ 8804 if (adv_instance->instance <= hdev->adv_instance_cnt) { 8805 *instance = adv_instance->instance; 8806 instance++; 8807 } else { 8808 rp->num_instances--; 8809 rp_len--; 8810 } 8811 } 8812 8813 hci_dev_unlock(hdev); 8814 8815 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_ADV_FEATURES, 8816 MGMT_STATUS_SUCCESS, rp, rp_len); 8817 8818 kfree(rp); 8819 8820 return err; 8821 } 8822 8823 static u8 calculate_name_len(struct hci_dev *hdev) 8824 { 8825 u8 buf[HCI_MAX_SHORT_NAME_LENGTH + 2]; /* len + type + name */ 8826 8827 return eir_append_local_name(hdev, buf, 0); 8828 } 8829 8830 static u8 tlv_data_max_len(struct hci_dev *hdev, u32 adv_flags, 8831 bool is_adv_data) 8832 { 8833 u8 max_len = max_adv_len(hdev); 8834 8835 if (is_adv_data) { 8836 if (adv_flags & (MGMT_ADV_FLAG_DISCOV | 8837 MGMT_ADV_FLAG_LIMITED_DISCOV | 8838 MGMT_ADV_FLAG_MANAGED_FLAGS)) 8839 max_len -= 3; 8840 8841 if (adv_flags & MGMT_ADV_FLAG_TX_POWER) 8842 max_len -= 3; 8843 } else { 8844 if (adv_flags & MGMT_ADV_FLAG_LOCAL_NAME) 8845 max_len -= calculate_name_len(hdev); 8846 8847 if (adv_flags & (MGMT_ADV_FLAG_APPEARANCE)) 8848 max_len -= 4; 8849 } 8850 8851 return max_len; 8852 } 8853 8854 static bool flags_managed(u32 adv_flags) 8855 { 8856 return adv_flags & (MGMT_ADV_FLAG_DISCOV | 8857 MGMT_ADV_FLAG_LIMITED_DISCOV | 8858 MGMT_ADV_FLAG_MANAGED_FLAGS); 8859 } 8860 8861 static bool tx_power_managed(u32 adv_flags) 8862 { 8863 return adv_flags & MGMT_ADV_FLAG_TX_POWER; 8864 } 8865 8866 static bool name_managed(u32 adv_flags) 8867 { 8868 return adv_flags & MGMT_ADV_FLAG_LOCAL_NAME; 8869 } 8870 8871 static bool appearance_managed(u32 adv_flags) 8872 { 8873 return adv_flags & MGMT_ADV_FLAG_APPEARANCE; 8874 } 8875 8876 static bool tlv_data_is_valid(struct hci_dev *hdev, u32 adv_flags, u8 *data, 8877 u8 len, bool is_adv_data) 8878 { 8879 int i, cur_len; 8880 u8 max_len; 8881 8882 max_len = tlv_data_max_len(hdev, adv_flags, is_adv_data); 8883 8884 if (len > max_len) 8885 return false; 8886 8887 /* Make sure that the data is correctly formatted. */ 8888 for (i = 0; i < len; i += (cur_len + 1)) { 8889 cur_len = data[i]; 8890 8891 if (!cur_len) 8892 continue; 8893 8894 /* If the current field length would exceed the total data 8895 * length, then it's invalid. 8896 */ 8897 if (i + cur_len >= len) 8898 return false; 8899 8900 if (data[i + 1] == EIR_FLAGS && 8901 (!is_adv_data || flags_managed(adv_flags))) 8902 return false; 8903 8904 if (data[i + 1] == EIR_TX_POWER && tx_power_managed(adv_flags)) 8905 return false; 8906 8907 if (data[i + 1] == EIR_NAME_COMPLETE && name_managed(adv_flags)) 8908 return false; 8909 8910 if (data[i + 1] == EIR_NAME_SHORT && name_managed(adv_flags)) 8911 return false; 8912 8913 if (data[i + 1] == EIR_APPEARANCE && 8914 appearance_managed(adv_flags)) 8915 return false; 8916 } 8917 8918 return true; 8919 } 8920 8921 static bool requested_adv_flags_are_valid(struct hci_dev *hdev, u32 adv_flags) 8922 { 8923 u32 supported_flags, phy_flags; 8924 8925 /* The current implementation only supports a subset of the specified 8926 * flags. Also need to check mutual exclusiveness of sec flags. 8927 */ 8928 supported_flags = get_supported_adv_flags(hdev); 8929 phy_flags = adv_flags & MGMT_ADV_FLAG_SEC_MASK; 8930 if (adv_flags & ~supported_flags || 8931 ((phy_flags && (phy_flags ^ (phy_flags & -phy_flags))))) 8932 return false; 8933 8934 return true; 8935 } 8936 8937 static bool adv_busy(struct hci_dev *hdev) 8938 { 8939 return pending_find(MGMT_OP_SET_LE, hdev); 8940 } 8941 8942 static void add_adv_complete(struct hci_dev *hdev, struct sock *sk, u8 instance, 8943 int err) 8944 { 8945 struct adv_info *adv, *n; 8946 8947 bt_dev_dbg(hdev, "err %d", err); 8948 8949 hci_dev_lock(hdev); 8950 8951 list_for_each_entry_safe(adv, n, &hdev->adv_instances, list) { 8952 u8 instance; 8953 8954 if (!adv->pending) 8955 continue; 8956 8957 if (!err) { 8958 adv->pending = false; 8959 continue; 8960 } 8961 8962 instance = adv->instance; 8963 8964 if (hdev->cur_adv_instance == instance) 8965 cancel_adv_timeout(hdev); 8966 8967 hci_remove_adv_instance(hdev, instance); 8968 mgmt_advertising_removed(sk, hdev, instance); 8969 } 8970 8971 hci_dev_unlock(hdev); 8972 } 8973 8974 static void add_advertising_complete(struct hci_dev *hdev, void *data, int err) 8975 { 8976 struct mgmt_pending_cmd *cmd = data; 8977 struct mgmt_cp_add_advertising *cp = cmd->param; 8978 struct mgmt_rp_add_advertising rp; 8979 8980 memset(&rp, 0, sizeof(rp)); 8981 8982 rp.instance = cp->instance; 8983 8984 if (err) 8985 mgmt_cmd_status(cmd->sk, cmd->hdev->id, cmd->opcode, 8986 mgmt_status(err)); 8987 else 8988 mgmt_cmd_complete(cmd->sk, cmd->hdev->id, cmd->opcode, 8989 mgmt_status(err), &rp, sizeof(rp)); 8990 8991 add_adv_complete(hdev, cmd->sk, cp->instance, err); 8992 8993 mgmt_pending_free(cmd); 8994 } 8995 8996 static int add_advertising_sync(struct hci_dev *hdev, void *data) 8997 { 8998 struct mgmt_pending_cmd *cmd = data; 8999 struct mgmt_cp_add_advertising *cp = cmd->param; 9000 9001 return hci_schedule_adv_instance_sync(hdev, cp->instance, true); 9002 } 9003 9004 static int add_advertising(struct sock *sk, struct hci_dev *hdev, 9005 void *data, u16 data_len) 9006 { 9007 struct mgmt_cp_add_advertising *cp = data; 9008 struct mgmt_rp_add_advertising rp; 9009 u32 flags; 9010 u8 status; 9011 u16 timeout, duration; 9012 unsigned int prev_instance_cnt; 9013 u8 schedule_instance = 0; 9014 struct adv_info *adv, *next_instance; 9015 int err; 9016 struct mgmt_pending_cmd *cmd; 9017 9018 bt_dev_dbg(hdev, "sock %p", sk); 9019 9020 status = mgmt_le_support(hdev); 9021 if (status) 9022 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING, 9023 status); 9024 9025 if (cp->instance < 1 || cp->instance > hdev->le_num_of_adv_sets) 9026 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING, 9027 MGMT_STATUS_INVALID_PARAMS); 9028 9029 if (data_len != sizeof(*cp) + cp->adv_data_len + cp->scan_rsp_len) 9030 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING, 9031 MGMT_STATUS_INVALID_PARAMS); 9032 9033 flags = __le32_to_cpu(cp->flags); 9034 timeout = __le16_to_cpu(cp->timeout); 9035 duration = __le16_to_cpu(cp->duration); 9036 9037 if (!requested_adv_flags_are_valid(hdev, flags)) 9038 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING, 9039 MGMT_STATUS_INVALID_PARAMS); 9040 9041 hci_dev_lock(hdev); 9042 9043 if (timeout && !hdev_is_powered(hdev)) { 9044 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING, 9045 MGMT_STATUS_REJECTED); 9046 goto unlock; 9047 } 9048 9049 if (adv_busy(hdev)) { 9050 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING, 9051 MGMT_STATUS_BUSY); 9052 goto unlock; 9053 } 9054 9055 if (!tlv_data_is_valid(hdev, flags, cp->data, cp->adv_data_len, true) || 9056 !tlv_data_is_valid(hdev, flags, cp->data + cp->adv_data_len, 9057 cp->scan_rsp_len, false)) { 9058 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING, 9059 MGMT_STATUS_INVALID_PARAMS); 9060 goto unlock; 9061 } 9062 9063 prev_instance_cnt = hdev->adv_instance_cnt; 9064 9065 adv = hci_add_adv_instance(hdev, cp->instance, flags, 9066 cp->adv_data_len, cp->data, 9067 cp->scan_rsp_len, 9068 cp->data + cp->adv_data_len, 9069 timeout, duration, 9070 HCI_ADV_TX_POWER_NO_PREFERENCE, 9071 hdev->le_adv_min_interval, 9072 hdev->le_adv_max_interval, 0); 9073 if (IS_ERR(adv)) { 9074 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING, 9075 MGMT_STATUS_FAILED); 9076 goto unlock; 9077 } 9078 9079 /* Only trigger an advertising added event if a new instance was 9080 * actually added. 9081 */ 9082 if (hdev->adv_instance_cnt > prev_instance_cnt) 9083 mgmt_advertising_added(sk, hdev, cp->instance); 9084 9085 if (hdev->cur_adv_instance == cp->instance) { 9086 /* If the currently advertised instance is being changed then 9087 * cancel the current advertising and schedule the next 9088 * instance. If there is only one instance then the overridden 9089 * advertising data will be visible right away. 9090 */ 9091 cancel_adv_timeout(hdev); 9092 9093 next_instance = hci_get_next_instance(hdev, cp->instance); 9094 if (next_instance) 9095 schedule_instance = next_instance->instance; 9096 } else if (!hdev->adv_instance_timeout) { 9097 /* Immediately advertise the new instance if no other 9098 * instance is currently being advertised. 9099 */ 9100 schedule_instance = cp->instance; 9101 } 9102 9103 /* If the HCI_ADVERTISING flag is set or the device isn't powered or 9104 * there is no instance to be advertised then we have no HCI 9105 * communication to make. Simply return. 9106 */ 9107 if (!hdev_is_powered(hdev) || 9108 hci_dev_test_flag(hdev, HCI_ADVERTISING) || 9109 !schedule_instance) { 9110 rp.instance = cp->instance; 9111 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_ADVERTISING, 9112 MGMT_STATUS_SUCCESS, &rp, sizeof(rp)); 9113 goto unlock; 9114 } 9115 9116 /* We're good to go, update advertising data, parameters, and start 9117 * advertising. 9118 */ 9119 cmd = mgmt_pending_new(sk, MGMT_OP_ADD_ADVERTISING, hdev, data, 9120 data_len); 9121 if (!cmd) { 9122 err = -ENOMEM; 9123 goto unlock; 9124 } 9125 9126 cp->instance = schedule_instance; 9127 9128 err = hci_cmd_sync_queue(hdev, add_advertising_sync, cmd, 9129 add_advertising_complete); 9130 if (err < 0) 9131 mgmt_pending_free(cmd); 9132 9133 unlock: 9134 hci_dev_unlock(hdev); 9135 9136 return err; 9137 } 9138 9139 static void add_ext_adv_params_complete(struct hci_dev *hdev, void *data, 9140 int err) 9141 { 9142 struct mgmt_pending_cmd *cmd = data; 9143 struct mgmt_cp_add_ext_adv_params *cp = cmd->param; 9144 struct mgmt_rp_add_ext_adv_params rp; 9145 struct adv_info *adv; 9146 u32 flags; 9147 9148 BT_DBG("%s", hdev->name); 9149 9150 hci_dev_lock(hdev); 9151 9152 adv = hci_find_adv_instance(hdev, cp->instance); 9153 if (!adv) 9154 goto unlock; 9155 9156 rp.instance = cp->instance; 9157 rp.tx_power = adv->tx_power; 9158 9159 /* While we're at it, inform userspace of the available space for this 9160 * advertisement, given the flags that will be used. 9161 */ 9162 flags = __le32_to_cpu(cp->flags); 9163 rp.max_adv_data_len = tlv_data_max_len(hdev, flags, true); 9164 rp.max_scan_rsp_len = tlv_data_max_len(hdev, flags, false); 9165 9166 if (err) { 9167 /* If this advertisement was previously advertising and we 9168 * failed to update it, we signal that it has been removed and 9169 * delete its structure 9170 */ 9171 if (!adv->pending) 9172 mgmt_advertising_removed(cmd->sk, hdev, cp->instance); 9173 9174 hci_remove_adv_instance(hdev, cp->instance); 9175 9176 mgmt_cmd_status(cmd->sk, cmd->hdev->id, cmd->opcode, 9177 mgmt_status(err)); 9178 } else { 9179 mgmt_cmd_complete(cmd->sk, cmd->hdev->id, cmd->opcode, 9180 mgmt_status(err), &rp, sizeof(rp)); 9181 } 9182 9183 unlock: 9184 mgmt_pending_free(cmd); 9185 9186 hci_dev_unlock(hdev); 9187 } 9188 9189 static int add_ext_adv_params_sync(struct hci_dev *hdev, void *data) 9190 { 9191 struct mgmt_pending_cmd *cmd = data; 9192 struct mgmt_cp_add_ext_adv_params *cp = cmd->param; 9193 9194 return hci_setup_ext_adv_instance_sync(hdev, cp->instance); 9195 } 9196 9197 static int add_ext_adv_params(struct sock *sk, struct hci_dev *hdev, 9198 void *data, u16 data_len) 9199 { 9200 struct mgmt_cp_add_ext_adv_params *cp = data; 9201 struct mgmt_rp_add_ext_adv_params rp; 9202 struct mgmt_pending_cmd *cmd = NULL; 9203 struct adv_info *adv; 9204 u32 flags, min_interval, max_interval; 9205 u16 timeout, duration; 9206 u8 status; 9207 s8 tx_power; 9208 int err; 9209 9210 BT_DBG("%s", hdev->name); 9211 9212 status = mgmt_le_support(hdev); 9213 if (status) 9214 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_PARAMS, 9215 status); 9216 9217 if (cp->instance < 1 || cp->instance > hdev->le_num_of_adv_sets) 9218 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_PARAMS, 9219 MGMT_STATUS_INVALID_PARAMS); 9220 9221 /* The purpose of breaking add_advertising into two separate MGMT calls 9222 * for params and data is to allow more parameters to be added to this 9223 * structure in the future. For this reason, we verify that we have the 9224 * bare minimum structure we know of when the interface was defined. Any 9225 * extra parameters we don't know about will be ignored in this request. 9226 */ 9227 if (data_len < MGMT_ADD_EXT_ADV_PARAMS_MIN_SIZE) 9228 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_PARAMS, 9229 MGMT_STATUS_INVALID_PARAMS); 9230 9231 flags = __le32_to_cpu(cp->flags); 9232 9233 if (!requested_adv_flags_are_valid(hdev, flags)) 9234 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_PARAMS, 9235 MGMT_STATUS_INVALID_PARAMS); 9236 9237 hci_dev_lock(hdev); 9238 9239 /* In new interface, we require that we are powered to register */ 9240 if (!hdev_is_powered(hdev)) { 9241 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_PARAMS, 9242 MGMT_STATUS_REJECTED); 9243 goto unlock; 9244 } 9245 9246 if (adv_busy(hdev)) { 9247 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_PARAMS, 9248 MGMT_STATUS_BUSY); 9249 goto unlock; 9250 } 9251 9252 /* Parse defined parameters from request, use defaults otherwise */ 9253 timeout = (flags & MGMT_ADV_PARAM_TIMEOUT) ? 9254 __le16_to_cpu(cp->timeout) : 0; 9255 9256 duration = (flags & MGMT_ADV_PARAM_DURATION) ? 9257 __le16_to_cpu(cp->duration) : 9258 hdev->def_multi_adv_rotation_duration; 9259 9260 min_interval = (flags & MGMT_ADV_PARAM_INTERVALS) ? 9261 __le32_to_cpu(cp->min_interval) : 9262 hdev->le_adv_min_interval; 9263 9264 max_interval = (flags & MGMT_ADV_PARAM_INTERVALS) ? 9265 __le32_to_cpu(cp->max_interval) : 9266 hdev->le_adv_max_interval; 9267 9268 tx_power = (flags & MGMT_ADV_PARAM_TX_POWER) ? 9269 cp->tx_power : 9270 HCI_ADV_TX_POWER_NO_PREFERENCE; 9271 9272 /* Create advertising instance with no advertising or response data */ 9273 adv = hci_add_adv_instance(hdev, cp->instance, flags, 0, NULL, 0, NULL, 9274 timeout, duration, tx_power, min_interval, 9275 max_interval, 0); 9276 9277 if (IS_ERR(adv)) { 9278 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_PARAMS, 9279 MGMT_STATUS_FAILED); 9280 goto unlock; 9281 } 9282 9283 /* Submit request for advertising params if ext adv available */ 9284 if (ext_adv_capable(hdev)) { 9285 cmd = mgmt_pending_new(sk, MGMT_OP_ADD_EXT_ADV_PARAMS, hdev, 9286 data, data_len); 9287 if (!cmd) { 9288 err = -ENOMEM; 9289 hci_remove_adv_instance(hdev, cp->instance); 9290 goto unlock; 9291 } 9292 9293 err = hci_cmd_sync_queue(hdev, add_ext_adv_params_sync, cmd, 9294 add_ext_adv_params_complete); 9295 if (err < 0) 9296 mgmt_pending_free(cmd); 9297 } else { 9298 rp.instance = cp->instance; 9299 rp.tx_power = HCI_ADV_TX_POWER_NO_PREFERENCE; 9300 rp.max_adv_data_len = tlv_data_max_len(hdev, flags, true); 9301 rp.max_scan_rsp_len = tlv_data_max_len(hdev, flags, false); 9302 err = mgmt_cmd_complete(sk, hdev->id, 9303 MGMT_OP_ADD_EXT_ADV_PARAMS, 9304 MGMT_STATUS_SUCCESS, &rp, sizeof(rp)); 9305 } 9306 9307 unlock: 9308 hci_dev_unlock(hdev); 9309 9310 return err; 9311 } 9312 9313 static void add_ext_adv_data_complete(struct hci_dev *hdev, void *data, int err) 9314 { 9315 struct mgmt_pending_cmd *cmd = data; 9316 struct mgmt_cp_add_ext_adv_data *cp = cmd->param; 9317 struct mgmt_rp_add_advertising rp; 9318 9319 add_adv_complete(hdev, cmd->sk, cp->instance, err); 9320 9321 memset(&rp, 0, sizeof(rp)); 9322 9323 rp.instance = cp->instance; 9324 9325 if (err) 9326 mgmt_cmd_status(cmd->sk, cmd->hdev->id, cmd->opcode, 9327 mgmt_status(err)); 9328 else 9329 mgmt_cmd_complete(cmd->sk, cmd->hdev->id, cmd->opcode, 9330 mgmt_status(err), &rp, sizeof(rp)); 9331 9332 mgmt_pending_free(cmd); 9333 } 9334 9335 static int add_ext_adv_data_sync(struct hci_dev *hdev, void *data) 9336 { 9337 struct mgmt_pending_cmd *cmd = data; 9338 struct mgmt_cp_add_ext_adv_data *cp = cmd->param; 9339 int err; 9340 9341 if (ext_adv_capable(hdev)) { 9342 err = hci_update_adv_data_sync(hdev, cp->instance); 9343 if (err) 9344 return err; 9345 9346 err = hci_update_scan_rsp_data_sync(hdev, cp->instance); 9347 if (err) 9348 return err; 9349 9350 return hci_enable_ext_advertising_sync(hdev, cp->instance); 9351 } 9352 9353 return hci_schedule_adv_instance_sync(hdev, cp->instance, true); 9354 } 9355 9356 static int add_ext_adv_data(struct sock *sk, struct hci_dev *hdev, void *data, 9357 u16 data_len) 9358 { 9359 struct mgmt_cp_add_ext_adv_data *cp = data; 9360 struct mgmt_rp_add_ext_adv_data rp; 9361 u8 schedule_instance = 0; 9362 struct adv_info *next_instance; 9363 struct adv_info *adv_instance; 9364 int err = 0; 9365 struct mgmt_pending_cmd *cmd; 9366 u16 expected_len; 9367 9368 BT_DBG("%s", hdev->name); 9369 9370 expected_len = struct_size(cp, data, cp->adv_data_len + 9371 cp->scan_rsp_len); 9372 if (expected_len > data_len) 9373 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_DATA, 9374 MGMT_STATUS_INVALID_PARAMS); 9375 9376 hci_dev_lock(hdev); 9377 9378 adv_instance = hci_find_adv_instance(hdev, cp->instance); 9379 9380 if (!adv_instance) { 9381 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_DATA, 9382 MGMT_STATUS_INVALID_PARAMS); 9383 goto unlock; 9384 } 9385 9386 /* In new interface, we require that we are powered to register */ 9387 if (!hdev_is_powered(hdev)) { 9388 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_DATA, 9389 MGMT_STATUS_REJECTED); 9390 goto clear_new_instance; 9391 } 9392 9393 if (adv_busy(hdev)) { 9394 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_DATA, 9395 MGMT_STATUS_BUSY); 9396 goto clear_new_instance; 9397 } 9398 9399 /* Validate new data */ 9400 if (!tlv_data_is_valid(hdev, adv_instance->flags, cp->data, 9401 cp->adv_data_len, true) || 9402 !tlv_data_is_valid(hdev, adv_instance->flags, cp->data + 9403 cp->adv_data_len, cp->scan_rsp_len, false)) { 9404 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_DATA, 9405 MGMT_STATUS_INVALID_PARAMS); 9406 goto clear_new_instance; 9407 } 9408 9409 /* Set the data in the advertising instance */ 9410 hci_set_adv_instance_data(hdev, cp->instance, cp->adv_data_len, 9411 cp->data, cp->scan_rsp_len, 9412 cp->data + cp->adv_data_len); 9413 9414 /* If using software rotation, determine next instance to use */ 9415 if (hdev->cur_adv_instance == cp->instance) { 9416 /* If the currently advertised instance is being changed 9417 * then cancel the current advertising and schedule the 9418 * next instance. If there is only one instance then the 9419 * overridden advertising data will be visible right 9420 * away 9421 */ 9422 cancel_adv_timeout(hdev); 9423 9424 next_instance = hci_get_next_instance(hdev, cp->instance); 9425 if (next_instance) 9426 schedule_instance = next_instance->instance; 9427 } else if (!hdev->adv_instance_timeout) { 9428 /* Immediately advertise the new instance if no other 9429 * instance is currently being advertised. 9430 */ 9431 schedule_instance = cp->instance; 9432 } 9433 9434 /* If the HCI_ADVERTISING flag is set or there is no instance to 9435 * be advertised then we have no HCI communication to make. 9436 * Simply return. 9437 */ 9438 if (hci_dev_test_flag(hdev, HCI_ADVERTISING) || !schedule_instance) { 9439 if (adv_instance->pending) { 9440 mgmt_advertising_added(sk, hdev, cp->instance); 9441 adv_instance->pending = false; 9442 } 9443 rp.instance = cp->instance; 9444 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_DATA, 9445 MGMT_STATUS_SUCCESS, &rp, sizeof(rp)); 9446 goto unlock; 9447 } 9448 9449 cmd = mgmt_pending_new(sk, MGMT_OP_ADD_EXT_ADV_DATA, hdev, data, 9450 data_len); 9451 if (!cmd) { 9452 err = -ENOMEM; 9453 goto clear_new_instance; 9454 } 9455 9456 err = hci_cmd_sync_queue(hdev, add_ext_adv_data_sync, cmd, 9457 add_ext_adv_data_complete); 9458 if (err < 0) { 9459 mgmt_pending_free(cmd); 9460 goto clear_new_instance; 9461 } 9462 9463 /* We were successful in updating data, so trigger advertising_added 9464 * event if this is an instance that wasn't previously advertising. If 9465 * a failure occurs in the requests we initiated, we will remove the 9466 * instance again in add_advertising_complete 9467 */ 9468 if (adv_instance->pending) 9469 mgmt_advertising_added(sk, hdev, cp->instance); 9470 9471 goto unlock; 9472 9473 clear_new_instance: 9474 hci_remove_adv_instance(hdev, cp->instance); 9475 9476 unlock: 9477 hci_dev_unlock(hdev); 9478 9479 return err; 9480 } 9481 9482 static void remove_advertising_complete(struct hci_dev *hdev, void *data, 9483 int err) 9484 { 9485 struct mgmt_pending_cmd *cmd = data; 9486 struct mgmt_cp_remove_advertising *cp = cmd->param; 9487 struct mgmt_rp_remove_advertising rp; 9488 9489 bt_dev_dbg(hdev, "err %d", err); 9490 9491 memset(&rp, 0, sizeof(rp)); 9492 rp.instance = cp->instance; 9493 9494 if (err) 9495 mgmt_cmd_status(cmd->sk, cmd->hdev->id, cmd->opcode, 9496 mgmt_status(err)); 9497 else 9498 mgmt_cmd_complete(cmd->sk, cmd->hdev->id, cmd->opcode, 9499 MGMT_STATUS_SUCCESS, &rp, sizeof(rp)); 9500 9501 mgmt_pending_free(cmd); 9502 } 9503 9504 static int remove_advertising_sync(struct hci_dev *hdev, void *data) 9505 { 9506 struct mgmt_pending_cmd *cmd = data; 9507 struct mgmt_cp_remove_advertising *cp = cmd->param; 9508 int err; 9509 9510 err = hci_remove_advertising_sync(hdev, cmd->sk, cp->instance, true); 9511 if (err) 9512 return err; 9513 9514 if (list_empty(&hdev->adv_instances)) 9515 err = hci_disable_advertising_sync(hdev); 9516 9517 return err; 9518 } 9519 9520 static int remove_advertising(struct sock *sk, struct hci_dev *hdev, 9521 void *data, u16 data_len) 9522 { 9523 struct mgmt_cp_remove_advertising *cp = data; 9524 struct mgmt_pending_cmd *cmd; 9525 int err; 9526 9527 bt_dev_dbg(hdev, "sock %p", sk); 9528 9529 hci_dev_lock(hdev); 9530 9531 if (cp->instance && !hci_find_adv_instance(hdev, cp->instance)) { 9532 err = mgmt_cmd_status(sk, hdev->id, 9533 MGMT_OP_REMOVE_ADVERTISING, 9534 MGMT_STATUS_INVALID_PARAMS); 9535 goto unlock; 9536 } 9537 9538 if (pending_find(MGMT_OP_SET_LE, hdev)) { 9539 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_ADVERTISING, 9540 MGMT_STATUS_BUSY); 9541 goto unlock; 9542 } 9543 9544 if (list_empty(&hdev->adv_instances)) { 9545 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_ADVERTISING, 9546 MGMT_STATUS_INVALID_PARAMS); 9547 goto unlock; 9548 } 9549 9550 cmd = mgmt_pending_new(sk, MGMT_OP_REMOVE_ADVERTISING, hdev, data, 9551 data_len); 9552 if (!cmd) { 9553 err = -ENOMEM; 9554 goto unlock; 9555 } 9556 9557 err = hci_cmd_sync_queue(hdev, remove_advertising_sync, cmd, 9558 remove_advertising_complete); 9559 if (err < 0) 9560 mgmt_pending_free(cmd); 9561 9562 unlock: 9563 hci_dev_unlock(hdev); 9564 9565 return err; 9566 } 9567 9568 static int get_adv_size_info(struct sock *sk, struct hci_dev *hdev, 9569 void *data, u16 data_len) 9570 { 9571 struct mgmt_cp_get_adv_size_info *cp = data; 9572 struct mgmt_rp_get_adv_size_info rp; 9573 u32 flags, supported_flags; 9574 9575 bt_dev_dbg(hdev, "sock %p", sk); 9576 9577 if (!lmp_le_capable(hdev)) 9578 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_ADV_SIZE_INFO, 9579 MGMT_STATUS_REJECTED); 9580 9581 if (cp->instance < 1 || cp->instance > hdev->le_num_of_adv_sets) 9582 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_ADV_SIZE_INFO, 9583 MGMT_STATUS_INVALID_PARAMS); 9584 9585 flags = __le32_to_cpu(cp->flags); 9586 9587 /* The current implementation only supports a subset of the specified 9588 * flags. 9589 */ 9590 supported_flags = get_supported_adv_flags(hdev); 9591 if (flags & ~supported_flags) 9592 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_ADV_SIZE_INFO, 9593 MGMT_STATUS_INVALID_PARAMS); 9594 9595 rp.instance = cp->instance; 9596 rp.flags = cp->flags; 9597 rp.max_adv_data_len = tlv_data_max_len(hdev, flags, true); 9598 rp.max_scan_rsp_len = tlv_data_max_len(hdev, flags, false); 9599 9600 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_ADV_SIZE_INFO, 9601 MGMT_STATUS_SUCCESS, &rp, sizeof(rp)); 9602 } 9603 9604 static const struct hci_mgmt_handler mgmt_handlers[] = { 9605 { NULL }, /* 0x0000 (no command) */ 9606 { read_version, MGMT_READ_VERSION_SIZE, 9607 HCI_MGMT_NO_HDEV | 9608 HCI_MGMT_UNTRUSTED }, 9609 { read_commands, MGMT_READ_COMMANDS_SIZE, 9610 HCI_MGMT_NO_HDEV | 9611 HCI_MGMT_UNTRUSTED }, 9612 { read_index_list, MGMT_READ_INDEX_LIST_SIZE, 9613 HCI_MGMT_NO_HDEV | 9614 HCI_MGMT_UNTRUSTED }, 9615 { read_controller_info, MGMT_READ_INFO_SIZE, 9616 HCI_MGMT_UNTRUSTED }, 9617 { set_powered, MGMT_SETTING_SIZE }, 9618 { set_discoverable, MGMT_SET_DISCOVERABLE_SIZE }, 9619 { set_connectable, MGMT_SETTING_SIZE }, 9620 { set_fast_connectable, MGMT_SETTING_SIZE }, 9621 { set_bondable, MGMT_SETTING_SIZE }, 9622 { set_link_security, MGMT_SETTING_SIZE }, 9623 { set_ssp, MGMT_SETTING_SIZE }, 9624 { set_hs, MGMT_SETTING_SIZE }, 9625 { set_le, MGMT_SETTING_SIZE }, 9626 { set_dev_class, MGMT_SET_DEV_CLASS_SIZE }, 9627 { set_local_name, MGMT_SET_LOCAL_NAME_SIZE }, 9628 { add_uuid, MGMT_ADD_UUID_SIZE }, 9629 { remove_uuid, MGMT_REMOVE_UUID_SIZE }, 9630 { load_link_keys, MGMT_LOAD_LINK_KEYS_SIZE, 9631 HCI_MGMT_VAR_LEN }, 9632 { load_long_term_keys, MGMT_LOAD_LONG_TERM_KEYS_SIZE, 9633 HCI_MGMT_VAR_LEN }, 9634 { disconnect, MGMT_DISCONNECT_SIZE }, 9635 { get_connections, MGMT_GET_CONNECTIONS_SIZE }, 9636 { pin_code_reply, MGMT_PIN_CODE_REPLY_SIZE }, 9637 { pin_code_neg_reply, MGMT_PIN_CODE_NEG_REPLY_SIZE }, 9638 { set_io_capability, MGMT_SET_IO_CAPABILITY_SIZE }, 9639 { pair_device, MGMT_PAIR_DEVICE_SIZE }, 9640 { cancel_pair_device, MGMT_CANCEL_PAIR_DEVICE_SIZE }, 9641 { unpair_device, MGMT_UNPAIR_DEVICE_SIZE }, 9642 { user_confirm_reply, MGMT_USER_CONFIRM_REPLY_SIZE }, 9643 { user_confirm_neg_reply, MGMT_USER_CONFIRM_NEG_REPLY_SIZE }, 9644 { user_passkey_reply, MGMT_USER_PASSKEY_REPLY_SIZE }, 9645 { user_passkey_neg_reply, MGMT_USER_PASSKEY_NEG_REPLY_SIZE }, 9646 { read_local_oob_data, MGMT_READ_LOCAL_OOB_DATA_SIZE }, 9647 { add_remote_oob_data, MGMT_ADD_REMOTE_OOB_DATA_SIZE, 9648 HCI_MGMT_VAR_LEN }, 9649 { remove_remote_oob_data, MGMT_REMOVE_REMOTE_OOB_DATA_SIZE }, 9650 { start_discovery, MGMT_START_DISCOVERY_SIZE }, 9651 { stop_discovery, MGMT_STOP_DISCOVERY_SIZE }, 9652 { confirm_name, MGMT_CONFIRM_NAME_SIZE }, 9653 { block_device, MGMT_BLOCK_DEVICE_SIZE }, 9654 { unblock_device, MGMT_UNBLOCK_DEVICE_SIZE }, 9655 { set_device_id, MGMT_SET_DEVICE_ID_SIZE }, 9656 { set_advertising, MGMT_SETTING_SIZE }, 9657 { set_bredr, MGMT_SETTING_SIZE }, 9658 { set_static_address, MGMT_SET_STATIC_ADDRESS_SIZE }, 9659 { set_scan_params, MGMT_SET_SCAN_PARAMS_SIZE }, 9660 { set_secure_conn, MGMT_SETTING_SIZE }, 9661 { set_debug_keys, MGMT_SETTING_SIZE }, 9662 { set_privacy, MGMT_SET_PRIVACY_SIZE }, 9663 { load_irks, MGMT_LOAD_IRKS_SIZE, 9664 HCI_MGMT_VAR_LEN }, 9665 { get_conn_info, MGMT_GET_CONN_INFO_SIZE }, 9666 { get_clock_info, MGMT_GET_CLOCK_INFO_SIZE }, 9667 { add_device, MGMT_ADD_DEVICE_SIZE }, 9668 { remove_device, MGMT_REMOVE_DEVICE_SIZE }, 9669 { load_conn_param, MGMT_LOAD_CONN_PARAM_SIZE, 9670 HCI_MGMT_VAR_LEN }, 9671 { read_unconf_index_list, MGMT_READ_UNCONF_INDEX_LIST_SIZE, 9672 HCI_MGMT_NO_HDEV | 9673 HCI_MGMT_UNTRUSTED }, 9674 { read_config_info, MGMT_READ_CONFIG_INFO_SIZE, 9675 HCI_MGMT_UNCONFIGURED | 9676 HCI_MGMT_UNTRUSTED }, 9677 { set_external_config, MGMT_SET_EXTERNAL_CONFIG_SIZE, 9678 HCI_MGMT_UNCONFIGURED }, 9679 { set_public_address, MGMT_SET_PUBLIC_ADDRESS_SIZE, 9680 HCI_MGMT_UNCONFIGURED }, 9681 { start_service_discovery, MGMT_START_SERVICE_DISCOVERY_SIZE, 9682 HCI_MGMT_VAR_LEN }, 9683 { read_local_oob_ext_data, MGMT_READ_LOCAL_OOB_EXT_DATA_SIZE }, 9684 { read_ext_index_list, MGMT_READ_EXT_INDEX_LIST_SIZE, 9685 HCI_MGMT_NO_HDEV | 9686 HCI_MGMT_UNTRUSTED }, 9687 { read_adv_features, MGMT_READ_ADV_FEATURES_SIZE }, 9688 { add_advertising, MGMT_ADD_ADVERTISING_SIZE, 9689 HCI_MGMT_VAR_LEN }, 9690 { remove_advertising, MGMT_REMOVE_ADVERTISING_SIZE }, 9691 { get_adv_size_info, MGMT_GET_ADV_SIZE_INFO_SIZE }, 9692 { start_limited_discovery, MGMT_START_DISCOVERY_SIZE }, 9693 { read_ext_controller_info,MGMT_READ_EXT_INFO_SIZE, 9694 HCI_MGMT_UNTRUSTED }, 9695 { set_appearance, MGMT_SET_APPEARANCE_SIZE }, 9696 { get_phy_configuration, MGMT_GET_PHY_CONFIGURATION_SIZE }, 9697 { set_phy_configuration, MGMT_SET_PHY_CONFIGURATION_SIZE }, 9698 { set_blocked_keys, MGMT_OP_SET_BLOCKED_KEYS_SIZE, 9699 HCI_MGMT_VAR_LEN }, 9700 { set_wideband_speech, MGMT_SETTING_SIZE }, 9701 { read_controller_cap, MGMT_READ_CONTROLLER_CAP_SIZE, 9702 HCI_MGMT_UNTRUSTED }, 9703 { read_exp_features_info, MGMT_READ_EXP_FEATURES_INFO_SIZE, 9704 HCI_MGMT_UNTRUSTED | 9705 HCI_MGMT_HDEV_OPTIONAL }, 9706 { set_exp_feature, MGMT_SET_EXP_FEATURE_SIZE, 9707 HCI_MGMT_VAR_LEN | 9708 HCI_MGMT_HDEV_OPTIONAL }, 9709 { read_def_system_config, MGMT_READ_DEF_SYSTEM_CONFIG_SIZE, 9710 HCI_MGMT_UNTRUSTED }, 9711 { set_def_system_config, MGMT_SET_DEF_SYSTEM_CONFIG_SIZE, 9712 HCI_MGMT_VAR_LEN }, 9713 { read_def_runtime_config, MGMT_READ_DEF_RUNTIME_CONFIG_SIZE, 9714 HCI_MGMT_UNTRUSTED }, 9715 { set_def_runtime_config, MGMT_SET_DEF_RUNTIME_CONFIG_SIZE, 9716 HCI_MGMT_VAR_LEN }, 9717 { get_device_flags, MGMT_GET_DEVICE_FLAGS_SIZE }, 9718 { set_device_flags, MGMT_SET_DEVICE_FLAGS_SIZE }, 9719 { read_adv_mon_features, MGMT_READ_ADV_MONITOR_FEATURES_SIZE }, 9720 { add_adv_patterns_monitor,MGMT_ADD_ADV_PATTERNS_MONITOR_SIZE, 9721 HCI_MGMT_VAR_LEN }, 9722 { remove_adv_monitor, MGMT_REMOVE_ADV_MONITOR_SIZE }, 9723 { add_ext_adv_params, MGMT_ADD_EXT_ADV_PARAMS_MIN_SIZE, 9724 HCI_MGMT_VAR_LEN }, 9725 { add_ext_adv_data, MGMT_ADD_EXT_ADV_DATA_SIZE, 9726 HCI_MGMT_VAR_LEN }, 9727 { add_adv_patterns_monitor_rssi, 9728 MGMT_ADD_ADV_PATTERNS_MONITOR_RSSI_SIZE, 9729 HCI_MGMT_VAR_LEN }, 9730 { set_mesh, MGMT_SET_MESH_RECEIVER_SIZE, 9731 HCI_MGMT_VAR_LEN }, 9732 { mesh_features, MGMT_MESH_READ_FEATURES_SIZE }, 9733 { mesh_send, MGMT_MESH_SEND_SIZE, 9734 HCI_MGMT_VAR_LEN }, 9735 { mesh_send_cancel, MGMT_MESH_SEND_CANCEL_SIZE }, 9736 { mgmt_hci_cmd_sync, MGMT_HCI_CMD_SYNC_SIZE, HCI_MGMT_VAR_LEN }, 9737 { load_conn_subrate, MGMT_LOAD_CONN_SUBRATE_SIZE, 9738 HCI_MGMT_VAR_LEN }, 9739 }; 9740 9741 void mgmt_index_added(struct hci_dev *hdev) 9742 { 9743 struct mgmt_ev_ext_index ev; 9744 9745 if (hci_test_quirk(hdev, HCI_QUIRK_RAW_DEVICE)) 9746 return; 9747 9748 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) { 9749 mgmt_index_event(MGMT_EV_UNCONF_INDEX_ADDED, hdev, NULL, 0, 9750 HCI_MGMT_UNCONF_INDEX_EVENTS); 9751 ev.type = 0x01; 9752 } else { 9753 mgmt_index_event(MGMT_EV_INDEX_ADDED, hdev, NULL, 0, 9754 HCI_MGMT_INDEX_EVENTS); 9755 ev.type = 0x00; 9756 } 9757 9758 ev.bus = hdev->bus; 9759 9760 mgmt_index_event(MGMT_EV_EXT_INDEX_ADDED, hdev, &ev, sizeof(ev), 9761 HCI_MGMT_EXT_INDEX_EVENTS); 9762 } 9763 9764 void mgmt_index_removed(struct hci_dev *hdev) 9765 { 9766 struct mgmt_ev_ext_index ev; 9767 struct cmd_lookup match = { NULL, hdev, MGMT_STATUS_INVALID_INDEX }; 9768 9769 if (hci_test_quirk(hdev, HCI_QUIRK_RAW_DEVICE)) 9770 return; 9771 9772 mgmt_pending_foreach(0, hdev, true, cmd_complete_rsp, &match); 9773 9774 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) { 9775 mgmt_index_event(MGMT_EV_UNCONF_INDEX_REMOVED, hdev, NULL, 0, 9776 HCI_MGMT_UNCONF_INDEX_EVENTS); 9777 ev.type = 0x01; 9778 } else { 9779 mgmt_index_event(MGMT_EV_INDEX_REMOVED, hdev, NULL, 0, 9780 HCI_MGMT_INDEX_EVENTS); 9781 ev.type = 0x00; 9782 } 9783 9784 ev.bus = hdev->bus; 9785 9786 mgmt_index_event(MGMT_EV_EXT_INDEX_REMOVED, hdev, &ev, sizeof(ev), 9787 HCI_MGMT_EXT_INDEX_EVENTS); 9788 9789 /* Cancel any remaining timed work */ 9790 if (!hci_dev_test_flag(hdev, HCI_MGMT)) 9791 return; 9792 cancel_delayed_work_sync(&hdev->discov_off); 9793 cancel_delayed_work_sync(&hdev->service_cache); 9794 cancel_delayed_work_sync(&hdev->rpa_expired); 9795 cancel_delayed_work_sync(&hdev->mesh_send_done); 9796 } 9797 9798 void mgmt_power_on(struct hci_dev *hdev, int err) 9799 { 9800 struct cmd_lookup match = { NULL, hdev }; 9801 9802 bt_dev_dbg(hdev, "err %d", err); 9803 9804 hci_dev_lock(hdev); 9805 9806 if (!err) { 9807 restart_le_actions(hdev); 9808 hci_update_passive_scan(hdev); 9809 } 9810 9811 mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, true, settings_rsp, 9812 &match); 9813 9814 new_settings(hdev, match.sk); 9815 9816 if (match.sk) 9817 sock_put(match.sk); 9818 9819 hci_dev_unlock(hdev); 9820 } 9821 9822 void __mgmt_power_off(struct hci_dev *hdev) 9823 { 9824 struct cmd_lookup match = { NULL, hdev }; 9825 u8 zero_cod[] = { 0, 0, 0 }; 9826 9827 mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, true, settings_rsp, 9828 &match); 9829 9830 /* If the power off is because of hdev unregistration let 9831 * use the appropriate INVALID_INDEX status. Otherwise use 9832 * NOT_POWERED. We cover both scenarios here since later in 9833 * mgmt_index_removed() any hci_conn callbacks will have already 9834 * been triggered, potentially causing misleading DISCONNECTED 9835 * status responses. 9836 */ 9837 if (hci_dev_test_flag(hdev, HCI_UNREGISTER)) 9838 match.mgmt_status = MGMT_STATUS_INVALID_INDEX; 9839 else 9840 match.mgmt_status = MGMT_STATUS_NOT_POWERED; 9841 9842 mgmt_pending_foreach(0, hdev, true, cmd_complete_rsp, &match); 9843 9844 if (memcmp(hdev->dev_class, zero_cod, sizeof(zero_cod)) != 0) { 9845 mgmt_limited_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev, 9846 zero_cod, sizeof(zero_cod), 9847 HCI_MGMT_DEV_CLASS_EVENTS, NULL); 9848 ext_info_changed(hdev, NULL); 9849 } 9850 9851 new_settings(hdev, match.sk); 9852 9853 if (match.sk) 9854 sock_put(match.sk); 9855 } 9856 9857 void mgmt_set_powered_failed(struct hci_dev *hdev, int err) 9858 { 9859 struct mgmt_pending_cmd *cmd; 9860 u8 status; 9861 9862 cmd = pending_find(MGMT_OP_SET_POWERED, hdev); 9863 if (!cmd) 9864 return; 9865 9866 if (err == -ERFKILL) 9867 status = MGMT_STATUS_RFKILLED; 9868 else 9869 status = MGMT_STATUS_FAILED; 9870 9871 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_POWERED, status); 9872 9873 mgmt_pending_remove(cmd); 9874 } 9875 9876 void mgmt_new_link_key(struct hci_dev *hdev, struct link_key *key, 9877 bool persistent) 9878 { 9879 struct mgmt_ev_new_link_key ev; 9880 9881 memset(&ev, 0, sizeof(ev)); 9882 9883 ev.store_hint = persistent; 9884 bacpy(&ev.key.addr.bdaddr, &key->bdaddr); 9885 ev.key.addr.type = BDADDR_BREDR; 9886 ev.key.type = key->type; 9887 memcpy(ev.key.val, key->val, HCI_LINK_KEY_SIZE); 9888 ev.key.pin_len = key->pin_len; 9889 9890 mgmt_event(MGMT_EV_NEW_LINK_KEY, hdev, &ev, sizeof(ev), NULL); 9891 } 9892 9893 static u8 mgmt_ltk_type(struct smp_ltk *ltk) 9894 { 9895 switch (ltk->type) { 9896 case SMP_LTK: 9897 case SMP_LTK_RESPONDER: 9898 if (ltk->authenticated) 9899 return MGMT_LTK_AUTHENTICATED; 9900 return MGMT_LTK_UNAUTHENTICATED; 9901 case SMP_LTK_P256: 9902 if (ltk->authenticated) 9903 return MGMT_LTK_P256_AUTH; 9904 return MGMT_LTK_P256_UNAUTH; 9905 case SMP_LTK_P256_DEBUG: 9906 return MGMT_LTK_P256_DEBUG; 9907 } 9908 9909 return MGMT_LTK_UNAUTHENTICATED; 9910 } 9911 9912 void mgmt_new_ltk(struct hci_dev *hdev, struct smp_ltk *key, bool persistent) 9913 { 9914 struct mgmt_ev_new_long_term_key ev; 9915 9916 memset(&ev, 0, sizeof(ev)); 9917 9918 /* Devices using resolvable or non-resolvable random addresses 9919 * without providing an identity resolving key don't require 9920 * to store long term keys. Their addresses will change the 9921 * next time around. 9922 * 9923 * Only when a remote device provides an identity address 9924 * make sure the long term key is stored. If the remote 9925 * identity is known, the long term keys are internally 9926 * mapped to the identity address. So allow static random 9927 * and public addresses here. 9928 */ 9929 if (key->bdaddr_type == ADDR_LE_DEV_RANDOM && 9930 (key->bdaddr.b[5] & 0xc0) != 0xc0) 9931 ev.store_hint = 0x00; 9932 else 9933 ev.store_hint = persistent; 9934 9935 bacpy(&ev.key.addr.bdaddr, &key->bdaddr); 9936 ev.key.addr.type = link_to_bdaddr(LE_LINK, key->bdaddr_type); 9937 ev.key.type = mgmt_ltk_type(key); 9938 ev.key.enc_size = key->enc_size; 9939 ev.key.ediv = key->ediv; 9940 ev.key.rand = key->rand; 9941 9942 if (key->type == SMP_LTK) 9943 ev.key.initiator = 1; 9944 9945 /* Make sure we copy only the significant bytes based on the 9946 * encryption key size, and set the rest of the value to zeroes. 9947 */ 9948 memcpy(ev.key.val, key->val, key->enc_size); 9949 memset(ev.key.val + key->enc_size, 0, 9950 sizeof(ev.key.val) - key->enc_size); 9951 9952 mgmt_event(MGMT_EV_NEW_LONG_TERM_KEY, hdev, &ev, sizeof(ev), NULL); 9953 } 9954 9955 void mgmt_new_irk(struct hci_dev *hdev, struct smp_irk *irk, bool persistent) 9956 { 9957 struct mgmt_ev_new_irk ev; 9958 9959 memset(&ev, 0, sizeof(ev)); 9960 9961 ev.store_hint = persistent; 9962 9963 bacpy(&ev.rpa, &irk->rpa); 9964 bacpy(&ev.irk.addr.bdaddr, &irk->bdaddr); 9965 ev.irk.addr.type = link_to_bdaddr(LE_LINK, irk->addr_type); 9966 memcpy(ev.irk.val, irk->val, sizeof(irk->val)); 9967 9968 mgmt_event(MGMT_EV_NEW_IRK, hdev, &ev, sizeof(ev), NULL); 9969 } 9970 9971 void mgmt_new_csrk(struct hci_dev *hdev, struct smp_csrk *csrk, 9972 bool persistent) 9973 { 9974 struct mgmt_ev_new_csrk ev; 9975 9976 memset(&ev, 0, sizeof(ev)); 9977 9978 /* Devices using resolvable or non-resolvable random addresses 9979 * without providing an identity resolving key don't require 9980 * to store signature resolving keys. Their addresses will change 9981 * the next time around. 9982 * 9983 * Only when a remote device provides an identity address 9984 * make sure the signature resolving key is stored. So allow 9985 * static random and public addresses here. 9986 */ 9987 if (csrk->bdaddr_type == ADDR_LE_DEV_RANDOM && 9988 (csrk->bdaddr.b[5] & 0xc0) != 0xc0) 9989 ev.store_hint = 0x00; 9990 else 9991 ev.store_hint = persistent; 9992 9993 bacpy(&ev.key.addr.bdaddr, &csrk->bdaddr); 9994 ev.key.addr.type = link_to_bdaddr(LE_LINK, csrk->bdaddr_type); 9995 ev.key.type = csrk->type; 9996 memcpy(ev.key.val, csrk->val, sizeof(csrk->val)); 9997 9998 mgmt_event(MGMT_EV_NEW_CSRK, hdev, &ev, sizeof(ev), NULL); 9999 } 10000 10001 void mgmt_new_conn_param(struct hci_dev *hdev, bdaddr_t *bdaddr, 10002 u8 bdaddr_type, u8 store_hint, u16 min_interval, 10003 u16 max_interval, u16 latency, u16 timeout) 10004 { 10005 struct mgmt_ev_new_conn_param ev; 10006 10007 if (!hci_is_identity_address(bdaddr, bdaddr_type)) 10008 return; 10009 10010 memset(&ev, 0, sizeof(ev)); 10011 bacpy(&ev.addr.bdaddr, bdaddr); 10012 ev.addr.type = link_to_bdaddr(LE_LINK, bdaddr_type); 10013 ev.store_hint = store_hint; 10014 ev.min_interval = cpu_to_le16(min_interval); 10015 ev.max_interval = cpu_to_le16(max_interval); 10016 ev.latency = cpu_to_le16(latency); 10017 ev.timeout = cpu_to_le16(timeout); 10018 10019 mgmt_event(MGMT_EV_NEW_CONN_PARAM, hdev, &ev, sizeof(ev), NULL); 10020 } 10021 10022 void mgmt_device_connected(struct hci_dev *hdev, struct hci_conn *conn, 10023 u8 *name, u8 name_len) 10024 { 10025 struct sk_buff *skb; 10026 struct mgmt_ev_device_connected *ev; 10027 u16 eir_len = 0; 10028 u32 flags = 0; 10029 10030 if (test_and_set_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags)) 10031 return; 10032 10033 /* allocate buff for LE or BR/EDR adv */ 10034 if (conn->le_adv_data_len > 0) 10035 skb = mgmt_alloc_skb(hdev, MGMT_EV_DEVICE_CONNECTED, 10036 sizeof(*ev) + conn->le_adv_data_len); 10037 else 10038 skb = mgmt_alloc_skb(hdev, MGMT_EV_DEVICE_CONNECTED, 10039 sizeof(*ev) + (name ? eir_precalc_len(name_len) : 0) + 10040 eir_precalc_len(sizeof(conn->dev_class))); 10041 10042 if (!skb) 10043 return; 10044 10045 ev = skb_put(skb, sizeof(*ev)); 10046 bacpy(&ev->addr.bdaddr, &conn->dst); 10047 ev->addr.type = link_to_bdaddr(conn->type, conn->dst_type); 10048 10049 if (conn->out) 10050 flags |= MGMT_DEV_FOUND_INITIATED_CONN; 10051 10052 ev->flags = __cpu_to_le32(flags); 10053 10054 /* We must ensure that the EIR Data fields are ordered and 10055 * unique. Keep it simple for now and avoid the problem by not 10056 * adding any BR/EDR data to the LE adv. 10057 */ 10058 if (conn->le_adv_data_len > 0) { 10059 skb_put_data(skb, conn->le_adv_data, conn->le_adv_data_len); 10060 eir_len = conn->le_adv_data_len; 10061 } else { 10062 if (name) 10063 eir_len += eir_skb_put_data(skb, EIR_NAME_COMPLETE, name, name_len); 10064 10065 if (memcmp(conn->dev_class, "\0\0\0", sizeof(conn->dev_class))) 10066 eir_len += eir_skb_put_data(skb, EIR_CLASS_OF_DEV, 10067 conn->dev_class, sizeof(conn->dev_class)); 10068 } 10069 10070 ev->eir_len = cpu_to_le16(eir_len); 10071 10072 mgmt_event_skb(skb, NULL); 10073 } 10074 10075 static void unpair_device_rsp(struct mgmt_pending_cmd *cmd, void *data) 10076 { 10077 struct hci_dev *hdev = data; 10078 struct mgmt_cp_unpair_device *cp = cmd->param; 10079 10080 device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, cmd->sk); 10081 10082 cmd->cmd_complete(cmd, 0); 10083 } 10084 10085 bool mgmt_powering_down(struct hci_dev *hdev) 10086 { 10087 struct mgmt_pending_cmd *cmd; 10088 struct mgmt_mode *cp; 10089 10090 if (hci_dev_test_flag(hdev, HCI_POWERING_DOWN)) 10091 return true; 10092 10093 cmd = pending_find(MGMT_OP_SET_POWERED, hdev); 10094 if (!cmd) 10095 return false; 10096 10097 cp = cmd->param; 10098 if (!cp->val) 10099 return true; 10100 10101 return false; 10102 } 10103 10104 u8 hci_to_mgmt_reason(u8 err) 10105 { 10106 switch (err) { 10107 case HCI_ERROR_CONNECTION_TIMEOUT: 10108 return MGMT_DEV_DISCONN_TIMEOUT; 10109 case HCI_ERROR_REMOTE_USER_TERM: 10110 case HCI_ERROR_REMOTE_LOW_RESOURCES: 10111 case HCI_ERROR_REMOTE_POWER_OFF: 10112 return MGMT_DEV_DISCONN_REMOTE; 10113 case HCI_ERROR_LOCAL_HOST_TERM: 10114 return MGMT_DEV_DISCONN_LOCAL_HOST; 10115 default: 10116 return MGMT_DEV_DISCONN_UNKNOWN; 10117 } 10118 } 10119 10120 void mgmt_device_disconnected(struct hci_dev *hdev, bdaddr_t *bdaddr, 10121 u8 link_type, u8 addr_type, u8 reason, 10122 bool mgmt_connected) 10123 { 10124 struct mgmt_ev_device_disconnected ev; 10125 struct sock *sk = NULL; 10126 10127 if (!mgmt_connected) 10128 return; 10129 10130 if (link_type != ACL_LINK && 10131 link_type != LE_LINK && 10132 link_type != BIS_LINK) 10133 return; 10134 10135 bacpy(&ev.addr.bdaddr, bdaddr); 10136 ev.addr.type = link_to_bdaddr(link_type, addr_type); 10137 ev.reason = reason; 10138 10139 /* Report disconnects due to suspend */ 10140 if (hdev->suspended) 10141 ev.reason = MGMT_DEV_DISCONN_LOCAL_HOST_SUSPEND; 10142 10143 mgmt_event(MGMT_EV_DEVICE_DISCONNECTED, hdev, &ev, sizeof(ev), sk); 10144 10145 if (sk) 10146 sock_put(sk); 10147 } 10148 10149 void mgmt_disconnect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr, 10150 u8 link_type, u8 addr_type, u8 status) 10151 { 10152 u8 bdaddr_type = link_to_bdaddr(link_type, addr_type); 10153 struct mgmt_cp_disconnect *cp; 10154 struct mgmt_pending_cmd *cmd; 10155 10156 mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, true, 10157 unpair_device_rsp, hdev); 10158 10159 cmd = pending_find(MGMT_OP_DISCONNECT, hdev); 10160 if (!cmd) 10161 return; 10162 10163 cp = cmd->param; 10164 10165 if (bacmp(bdaddr, &cp->addr.bdaddr)) 10166 return; 10167 10168 if (cp->addr.type != bdaddr_type) 10169 return; 10170 10171 cmd->cmd_complete(cmd, mgmt_status(status)); 10172 mgmt_pending_remove(cmd); 10173 } 10174 10175 void mgmt_connect_failed(struct hci_dev *hdev, struct hci_conn *conn, u8 status) 10176 { 10177 struct mgmt_ev_connect_failed ev; 10178 10179 if (test_and_clear_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags)) { 10180 mgmt_device_disconnected(hdev, &conn->dst, conn->type, 10181 conn->dst_type, 10182 hci_to_mgmt_reason(status), true); 10183 return; 10184 } 10185 10186 bacpy(&ev.addr.bdaddr, &conn->dst); 10187 ev.addr.type = link_to_bdaddr(conn->type, conn->dst_type); 10188 ev.status = mgmt_status(status); 10189 10190 mgmt_event(MGMT_EV_CONNECT_FAILED, hdev, &ev, sizeof(ev), NULL); 10191 } 10192 10193 void mgmt_pin_code_request(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 secure) 10194 { 10195 struct mgmt_ev_pin_code_request ev; 10196 10197 bacpy(&ev.addr.bdaddr, bdaddr); 10198 ev.addr.type = BDADDR_BREDR; 10199 ev.secure = secure; 10200 10201 mgmt_event(MGMT_EV_PIN_CODE_REQUEST, hdev, &ev, sizeof(ev), NULL); 10202 } 10203 10204 void mgmt_pin_code_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr, 10205 u8 status) 10206 { 10207 struct mgmt_pending_cmd *cmd; 10208 10209 cmd = pending_find(MGMT_OP_PIN_CODE_REPLY, hdev); 10210 if (!cmd) 10211 return; 10212 10213 cmd->cmd_complete(cmd, mgmt_status(status)); 10214 mgmt_pending_remove(cmd); 10215 } 10216 10217 void mgmt_pin_code_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr, 10218 u8 status) 10219 { 10220 struct mgmt_pending_cmd *cmd; 10221 10222 cmd = pending_find(MGMT_OP_PIN_CODE_NEG_REPLY, hdev); 10223 if (!cmd) 10224 return; 10225 10226 cmd->cmd_complete(cmd, mgmt_status(status)); 10227 mgmt_pending_remove(cmd); 10228 } 10229 10230 int mgmt_user_confirm_request(struct hci_dev *hdev, bdaddr_t *bdaddr, 10231 u8 link_type, u8 addr_type, u32 value, 10232 u8 confirm_hint) 10233 { 10234 struct mgmt_ev_user_confirm_request ev; 10235 10236 bt_dev_dbg(hdev, "bdaddr %pMR", bdaddr); 10237 10238 bacpy(&ev.addr.bdaddr, bdaddr); 10239 ev.addr.type = link_to_bdaddr(link_type, addr_type); 10240 ev.confirm_hint = confirm_hint; 10241 ev.value = cpu_to_le32(value); 10242 10243 return mgmt_event(MGMT_EV_USER_CONFIRM_REQUEST, hdev, &ev, sizeof(ev), 10244 NULL); 10245 } 10246 10247 int mgmt_user_passkey_request(struct hci_dev *hdev, bdaddr_t *bdaddr, 10248 u8 link_type, u8 addr_type) 10249 { 10250 struct mgmt_ev_user_passkey_request ev; 10251 10252 bt_dev_dbg(hdev, "bdaddr %pMR", bdaddr); 10253 10254 bacpy(&ev.addr.bdaddr, bdaddr); 10255 ev.addr.type = link_to_bdaddr(link_type, addr_type); 10256 10257 return mgmt_event(MGMT_EV_USER_PASSKEY_REQUEST, hdev, &ev, sizeof(ev), 10258 NULL); 10259 } 10260 10261 static int user_pairing_resp_complete(struct hci_dev *hdev, bdaddr_t *bdaddr, 10262 u8 link_type, u8 addr_type, u8 status, 10263 u8 opcode) 10264 { 10265 struct mgmt_pending_cmd *cmd; 10266 10267 cmd = pending_find(opcode, hdev); 10268 if (!cmd) 10269 return -ENOENT; 10270 10271 cmd->cmd_complete(cmd, mgmt_status(status)); 10272 mgmt_pending_remove(cmd); 10273 10274 return 0; 10275 } 10276 10277 int mgmt_user_confirm_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr, 10278 u8 link_type, u8 addr_type, u8 status) 10279 { 10280 return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type, 10281 status, MGMT_OP_USER_CONFIRM_REPLY); 10282 } 10283 10284 int mgmt_user_confirm_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr, 10285 u8 link_type, u8 addr_type, u8 status) 10286 { 10287 return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type, 10288 status, 10289 MGMT_OP_USER_CONFIRM_NEG_REPLY); 10290 } 10291 10292 int mgmt_user_passkey_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr, 10293 u8 link_type, u8 addr_type, u8 status) 10294 { 10295 return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type, 10296 status, MGMT_OP_USER_PASSKEY_REPLY); 10297 } 10298 10299 int mgmt_user_passkey_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr, 10300 u8 link_type, u8 addr_type, u8 status) 10301 { 10302 return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type, 10303 status, 10304 MGMT_OP_USER_PASSKEY_NEG_REPLY); 10305 } 10306 10307 int mgmt_user_passkey_notify(struct hci_dev *hdev, bdaddr_t *bdaddr, 10308 u8 link_type, u8 addr_type, u32 passkey, 10309 u8 entered) 10310 { 10311 struct mgmt_ev_passkey_notify ev; 10312 10313 bt_dev_dbg(hdev, "bdaddr %pMR", bdaddr); 10314 10315 bacpy(&ev.addr.bdaddr, bdaddr); 10316 ev.addr.type = link_to_bdaddr(link_type, addr_type); 10317 ev.passkey = __cpu_to_le32(passkey); 10318 ev.entered = entered; 10319 10320 return mgmt_event(MGMT_EV_PASSKEY_NOTIFY, hdev, &ev, sizeof(ev), NULL); 10321 } 10322 10323 void mgmt_auth_failed(struct hci_conn *conn, u8 hci_status) 10324 { 10325 struct mgmt_ev_auth_failed ev; 10326 struct mgmt_pending_cmd *cmd; 10327 u8 status = mgmt_status(hci_status); 10328 10329 bacpy(&ev.addr.bdaddr, &conn->dst); 10330 ev.addr.type = link_to_bdaddr(conn->type, conn->dst_type); 10331 ev.status = status; 10332 10333 cmd = remove_pairing(conn); 10334 10335 mgmt_event(MGMT_EV_AUTH_FAILED, conn->hdev, &ev, sizeof(ev), 10336 cmd ? cmd->sk : NULL); 10337 10338 if (cmd) { 10339 cmd->cmd_complete(cmd, status); 10340 mgmt_pending_free(cmd); 10341 } 10342 } 10343 10344 void mgmt_auth_enable_complete(struct hci_dev *hdev, u8 status) 10345 { 10346 struct cmd_lookup match = { NULL, hdev }; 10347 bool changed; 10348 10349 if (status) { 10350 u8 mgmt_err = mgmt_status(status); 10351 mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev, true, 10352 cmd_status_rsp, &mgmt_err); 10353 return; 10354 } 10355 10356 if (test_bit(HCI_AUTH, &hdev->flags)) 10357 changed = !hci_dev_test_and_set_flag(hdev, HCI_LINK_SECURITY); 10358 else 10359 changed = hci_dev_test_and_clear_flag(hdev, HCI_LINK_SECURITY); 10360 10361 mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev, true, 10362 settings_rsp, &match); 10363 10364 if (changed) 10365 new_settings(hdev, match.sk); 10366 10367 if (match.sk) 10368 sock_put(match.sk); 10369 } 10370 10371 static void sk_lookup(struct mgmt_pending_cmd *cmd, void *data) 10372 { 10373 struct cmd_lookup *match = data; 10374 10375 if (match->sk == NULL) { 10376 match->sk = cmd->sk; 10377 sock_hold(match->sk); 10378 } 10379 } 10380 10381 void mgmt_set_class_of_dev_complete(struct hci_dev *hdev, u8 *dev_class, 10382 u8 status) 10383 { 10384 struct cmd_lookup match = { NULL, hdev, mgmt_status(status) }; 10385 10386 mgmt_pending_foreach(MGMT_OP_SET_DEV_CLASS, hdev, false, sk_lookup, 10387 &match); 10388 mgmt_pending_foreach(MGMT_OP_ADD_UUID, hdev, false, sk_lookup, 10389 &match); 10390 mgmt_pending_foreach(MGMT_OP_REMOVE_UUID, hdev, false, sk_lookup, 10391 &match); 10392 10393 if (!status) { 10394 mgmt_limited_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev, dev_class, 10395 3, HCI_MGMT_DEV_CLASS_EVENTS, NULL); 10396 ext_info_changed(hdev, NULL); 10397 } 10398 10399 if (match.sk) 10400 sock_put(match.sk); 10401 } 10402 10403 void mgmt_set_local_name_complete(struct hci_dev *hdev, u8 *name, u8 status) 10404 { 10405 struct mgmt_cp_set_local_name ev; 10406 struct mgmt_pending_cmd *cmd; 10407 10408 if (status) 10409 return; 10410 10411 memset(&ev, 0, sizeof(ev)); 10412 memcpy(ev.name, name, HCI_MAX_NAME_LENGTH); 10413 memcpy(ev.short_name, hdev->short_name, HCI_MAX_SHORT_NAME_LENGTH); 10414 10415 cmd = pending_find(MGMT_OP_SET_LOCAL_NAME, hdev); 10416 if (!cmd) { 10417 memcpy(hdev->dev_name, name, sizeof(hdev->dev_name)); 10418 10419 /* If this is a HCI command related to powering on the 10420 * HCI dev don't send any mgmt signals. 10421 */ 10422 if (hci_dev_test_flag(hdev, HCI_POWERING_DOWN)) 10423 return; 10424 10425 if (pending_find(MGMT_OP_SET_POWERED, hdev)) 10426 return; 10427 } 10428 10429 mgmt_limited_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, &ev, sizeof(ev), 10430 HCI_MGMT_LOCAL_NAME_EVENTS, cmd ? cmd->sk : NULL); 10431 ext_info_changed(hdev, cmd ? cmd->sk : NULL); 10432 } 10433 10434 static inline bool has_uuid(u8 *uuid, u16 uuid_count, u8 (*uuids)[16]) 10435 { 10436 int i; 10437 10438 for (i = 0; i < uuid_count; i++) { 10439 if (!memcmp(uuid, uuids[i], 16)) 10440 return true; 10441 } 10442 10443 return false; 10444 } 10445 10446 static bool eir_has_uuids(u8 *eir, u16 eir_len, u16 uuid_count, u8 (*uuids)[16]) 10447 { 10448 u16 parsed = 0; 10449 10450 while (parsed < eir_len) { 10451 u8 field_len = eir[0]; 10452 u8 uuid[16]; 10453 int i; 10454 10455 if (field_len == 0) 10456 break; 10457 10458 if (eir_len - parsed < field_len + 1) 10459 break; 10460 10461 switch (eir[1]) { 10462 case EIR_UUID16_ALL: 10463 case EIR_UUID16_SOME: 10464 for (i = 0; i + 3 <= field_len; i += 2) { 10465 memcpy(uuid, bluetooth_base_uuid, 16); 10466 uuid[13] = eir[i + 3]; 10467 uuid[12] = eir[i + 2]; 10468 if (has_uuid(uuid, uuid_count, uuids)) 10469 return true; 10470 } 10471 break; 10472 case EIR_UUID32_ALL: 10473 case EIR_UUID32_SOME: 10474 for (i = 0; i + 5 <= field_len; i += 4) { 10475 memcpy(uuid, bluetooth_base_uuid, 16); 10476 uuid[15] = eir[i + 5]; 10477 uuid[14] = eir[i + 4]; 10478 uuid[13] = eir[i + 3]; 10479 uuid[12] = eir[i + 2]; 10480 if (has_uuid(uuid, uuid_count, uuids)) 10481 return true; 10482 } 10483 break; 10484 case EIR_UUID128_ALL: 10485 case EIR_UUID128_SOME: 10486 for (i = 0; i + 17 <= field_len; i += 16) { 10487 memcpy(uuid, eir + i + 2, 16); 10488 if (has_uuid(uuid, uuid_count, uuids)) 10489 return true; 10490 } 10491 break; 10492 } 10493 10494 parsed += field_len + 1; 10495 eir += field_len + 1; 10496 } 10497 10498 return false; 10499 } 10500 10501 static bool is_filter_match(struct hci_dev *hdev, s8 rssi, u8 *eir, 10502 u16 eir_len, u8 *scan_rsp, u8 scan_rsp_len) 10503 { 10504 /* If a RSSI threshold has been specified, and 10505 * HCI_QUIRK_STRICT_DUPLICATE_FILTER is not set, then all results with 10506 * a RSSI smaller than the RSSI threshold will be dropped. If the quirk 10507 * is set, let it through for further processing, as we might need to 10508 * restart the scan. 10509 * 10510 * For BR/EDR devices (pre 1.2) providing no RSSI during inquiry, 10511 * the results are also dropped. 10512 */ 10513 if (hdev->discovery.rssi != HCI_RSSI_INVALID && 10514 (rssi == HCI_RSSI_INVALID || 10515 (rssi < hdev->discovery.rssi && 10516 !hci_test_quirk(hdev, HCI_QUIRK_STRICT_DUPLICATE_FILTER)))) 10517 return false; 10518 10519 spin_lock(&hdev->discovery.lock); 10520 if (hdev->discovery.uuid_count != 0) { 10521 /* If a list of UUIDs is provided in filter, results with no 10522 * matching UUID should be dropped. 10523 */ 10524 if (!eir_has_uuids(eir, eir_len, hdev->discovery.uuid_count, 10525 hdev->discovery.uuids) && 10526 !eir_has_uuids(scan_rsp, scan_rsp_len, 10527 hdev->discovery.uuid_count, 10528 hdev->discovery.uuids)) { 10529 spin_unlock(&hdev->discovery.lock); 10530 return false; 10531 } 10532 } 10533 spin_unlock(&hdev->discovery.lock); 10534 10535 /* If duplicate filtering does not report RSSI changes, then restart 10536 * scanning to ensure updated result with updated RSSI values. 10537 */ 10538 if (hci_test_quirk(hdev, HCI_QUIRK_STRICT_DUPLICATE_FILTER)) { 10539 /* Validate RSSI value against the RSSI threshold once more. */ 10540 if (hdev->discovery.rssi != HCI_RSSI_INVALID && 10541 rssi < hdev->discovery.rssi) 10542 return false; 10543 } 10544 10545 return true; 10546 } 10547 10548 void mgmt_adv_monitor_device_lost(struct hci_dev *hdev, u16 handle, 10549 bdaddr_t *bdaddr, u8 addr_type) 10550 { 10551 struct mgmt_ev_adv_monitor_device_lost ev; 10552 10553 ev.monitor_handle = cpu_to_le16(handle); 10554 bacpy(&ev.addr.bdaddr, bdaddr); 10555 ev.addr.type = addr_type; 10556 10557 mgmt_event(MGMT_EV_ADV_MONITOR_DEVICE_LOST, hdev, &ev, sizeof(ev), 10558 NULL); 10559 } 10560 10561 static void mgmt_send_adv_monitor_device_found(struct hci_dev *hdev, 10562 struct sk_buff *skb, 10563 struct sock *skip_sk, 10564 u16 handle) 10565 { 10566 struct sk_buff *advmon_skb; 10567 size_t advmon_skb_len; 10568 __le16 *monitor_handle; 10569 10570 if (!skb) 10571 return; 10572 10573 advmon_skb_len = (sizeof(struct mgmt_ev_adv_monitor_device_found) - 10574 sizeof(struct mgmt_ev_device_found)) + skb->len; 10575 advmon_skb = mgmt_alloc_skb(hdev, MGMT_EV_ADV_MONITOR_DEVICE_FOUND, 10576 advmon_skb_len); 10577 if (!advmon_skb) 10578 return; 10579 10580 /* ADV_MONITOR_DEVICE_FOUND is similar to DEVICE_FOUND event except 10581 * that it also has 'monitor_handle'. Make a copy of DEVICE_FOUND and 10582 * store monitor_handle of the matched monitor. 10583 */ 10584 monitor_handle = skb_put(advmon_skb, sizeof(*monitor_handle)); 10585 *monitor_handle = cpu_to_le16(handle); 10586 skb_put_data(advmon_skb, skb->data, skb->len); 10587 10588 mgmt_event_skb(advmon_skb, skip_sk); 10589 } 10590 10591 static void mgmt_adv_monitor_device_found(struct hci_dev *hdev, 10592 bdaddr_t *bdaddr, bool report_device, 10593 struct sk_buff *skb, 10594 struct sock *skip_sk) 10595 { 10596 struct monitored_device *dev, *tmp; 10597 bool matched = false; 10598 bool notified = false; 10599 10600 /* We have received the Advertisement Report because: 10601 * 1. the kernel has initiated active discovery 10602 * 2. if not, we have pend_le_reports > 0 in which case we are doing 10603 * passive scanning 10604 * 3. if none of the above is true, we have one or more active 10605 * Advertisement Monitor 10606 * 10607 * For case 1 and 2, report all advertisements via MGMT_EV_DEVICE_FOUND 10608 * and report ONLY one advertisement per device for the matched Monitor 10609 * via MGMT_EV_ADV_MONITOR_DEVICE_FOUND event. 10610 * 10611 * For case 3, since we are not active scanning and all advertisements 10612 * received are due to a matched Advertisement Monitor, report all 10613 * advertisements ONLY via MGMT_EV_ADV_MONITOR_DEVICE_FOUND event. 10614 */ 10615 if (report_device && !hdev->advmon_pend_notify) { 10616 mgmt_event_skb(skb, skip_sk); 10617 return; 10618 } 10619 10620 hdev->advmon_pend_notify = false; 10621 10622 list_for_each_entry_safe(dev, tmp, &hdev->monitored_devices, list) { 10623 if (!bacmp(&dev->bdaddr, bdaddr)) { 10624 matched = true; 10625 10626 if (!dev->notified) { 10627 mgmt_send_adv_monitor_device_found(hdev, skb, 10628 skip_sk, 10629 dev->handle); 10630 notified = true; 10631 dev->notified = true; 10632 } 10633 } 10634 10635 if (!dev->notified) 10636 hdev->advmon_pend_notify = true; 10637 } 10638 10639 if (!report_device && 10640 ((matched && !notified) || !msft_monitor_supported(hdev))) { 10641 /* Handle 0 indicates that we are not active scanning and this 10642 * is a subsequent advertisement report for an already matched 10643 * Advertisement Monitor or the controller offloading support 10644 * is not available. 10645 */ 10646 mgmt_send_adv_monitor_device_found(hdev, skb, skip_sk, 0); 10647 } 10648 10649 if (report_device) 10650 mgmt_event_skb(skb, skip_sk); 10651 else 10652 kfree_skb(skb); 10653 } 10654 10655 static void mesh_device_found(struct hci_dev *hdev, bdaddr_t *bdaddr, 10656 u8 addr_type, s8 rssi, u32 flags, u8 *eir, 10657 u16 eir_len, u8 *scan_rsp, u8 scan_rsp_len, 10658 u64 instant) 10659 { 10660 struct sk_buff *skb; 10661 struct mgmt_ev_mesh_device_found *ev; 10662 int i, j; 10663 10664 if (!hdev->mesh_ad_types[0]) 10665 goto accepted; 10666 10667 /* Scan for requested AD types */ 10668 if (eir_len > 0) { 10669 for (i = 0; i + 1 < eir_len; i += eir[i] + 1) { 10670 for (j = 0; j < sizeof(hdev->mesh_ad_types); j++) { 10671 if (!hdev->mesh_ad_types[j]) 10672 break; 10673 10674 if (hdev->mesh_ad_types[j] == eir[i + 1]) 10675 goto accepted; 10676 } 10677 } 10678 } 10679 10680 if (scan_rsp_len > 0) { 10681 for (i = 0; i + 1 < scan_rsp_len; i += scan_rsp[i] + 1) { 10682 for (j = 0; j < sizeof(hdev->mesh_ad_types); j++) { 10683 if (!hdev->mesh_ad_types[j]) 10684 break; 10685 10686 if (hdev->mesh_ad_types[j] == scan_rsp[i + 1]) 10687 goto accepted; 10688 } 10689 } 10690 } 10691 10692 return; 10693 10694 accepted: 10695 skb = mgmt_alloc_skb(hdev, MGMT_EV_MESH_DEVICE_FOUND, 10696 sizeof(*ev) + eir_len + scan_rsp_len); 10697 if (!skb) 10698 return; 10699 10700 ev = skb_put(skb, sizeof(*ev)); 10701 10702 bacpy(&ev->addr.bdaddr, bdaddr); 10703 ev->addr.type = link_to_bdaddr(LE_LINK, addr_type); 10704 ev->rssi = rssi; 10705 ev->flags = cpu_to_le32(flags); 10706 ev->instant = cpu_to_le64(instant); 10707 10708 if (eir_len > 0) 10709 /* Copy EIR or advertising data into event */ 10710 skb_put_data(skb, eir, eir_len); 10711 10712 if (scan_rsp_len > 0) 10713 /* Append scan response data to event */ 10714 skb_put_data(skb, scan_rsp, scan_rsp_len); 10715 10716 ev->eir_len = cpu_to_le16(eir_len + scan_rsp_len); 10717 10718 mgmt_event_skb(skb, NULL); 10719 } 10720 10721 void mgmt_device_found(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type, 10722 u8 addr_type, u8 *dev_class, s8 rssi, u32 flags, 10723 u8 *eir, u16 eir_len, u8 *scan_rsp, u8 scan_rsp_len, 10724 u64 instant) 10725 { 10726 struct sk_buff *skb; 10727 struct mgmt_ev_device_found *ev; 10728 bool report_device = hci_discovery_active(hdev); 10729 10730 if (hci_dev_test_flag(hdev, HCI_MESH) && link_type == LE_LINK) 10731 mesh_device_found(hdev, bdaddr, addr_type, rssi, flags, 10732 eir, eir_len, scan_rsp, scan_rsp_len, 10733 instant); 10734 10735 /* Don't send events for a non-kernel initiated discovery. With 10736 * LE one exception is if we have pend_le_reports > 0 in which 10737 * case we're doing passive scanning and want these events. 10738 */ 10739 if (!hci_discovery_active(hdev)) { 10740 if (link_type == ACL_LINK) 10741 return; 10742 if (link_type == LE_LINK && !list_empty(&hdev->pend_le_reports)) 10743 report_device = true; 10744 else if (!hci_is_adv_monitoring(hdev)) 10745 return; 10746 } 10747 10748 if (hdev->discovery.result_filtering) { 10749 /* We are using service discovery */ 10750 if (!is_filter_match(hdev, rssi, eir, eir_len, scan_rsp, 10751 scan_rsp_len)) 10752 return; 10753 } 10754 10755 if (hdev->discovery.limited) { 10756 /* Check for limited discoverable bit */ 10757 if (dev_class) { 10758 if (!(dev_class[1] & 0x20)) 10759 return; 10760 } else { 10761 u8 *flags = eir_get_data(eir, eir_len, EIR_FLAGS, NULL); 10762 if (!flags || !(flags[0] & LE_AD_LIMITED)) 10763 return; 10764 } 10765 } 10766 10767 /* Allocate skb. The 5 extra bytes are for the potential CoD field */ 10768 skb = mgmt_alloc_skb(hdev, MGMT_EV_DEVICE_FOUND, 10769 sizeof(*ev) + eir_len + scan_rsp_len + 5); 10770 if (!skb) 10771 return; 10772 10773 ev = skb_put(skb, sizeof(*ev)); 10774 10775 /* In case of device discovery with BR/EDR devices (pre 1.2), the 10776 * RSSI value was reported as 0 when not available. This behavior 10777 * is kept when using device discovery. This is required for full 10778 * backwards compatibility with the API. 10779 * 10780 * However when using service discovery, the value 127 will be 10781 * returned when the RSSI is not available. 10782 */ 10783 if (rssi == HCI_RSSI_INVALID && !hdev->discovery.report_invalid_rssi && 10784 link_type == ACL_LINK) 10785 rssi = 0; 10786 10787 bacpy(&ev->addr.bdaddr, bdaddr); 10788 ev->addr.type = link_to_bdaddr(link_type, addr_type); 10789 ev->rssi = rssi; 10790 ev->flags = cpu_to_le32(flags); 10791 10792 if (eir_len > 0) 10793 /* Copy EIR or advertising data into event */ 10794 skb_put_data(skb, eir, eir_len); 10795 10796 if (dev_class && !eir_get_data(eir, eir_len, EIR_CLASS_OF_DEV, NULL)) { 10797 u8 eir_cod[5]; 10798 10799 eir_len += eir_append_data(eir_cod, 0, EIR_CLASS_OF_DEV, 10800 dev_class, 3); 10801 skb_put_data(skb, eir_cod, sizeof(eir_cod)); 10802 } 10803 10804 if (scan_rsp_len > 0) 10805 /* Append scan response data to event */ 10806 skb_put_data(skb, scan_rsp, scan_rsp_len); 10807 10808 ev->eir_len = cpu_to_le16(eir_len + scan_rsp_len); 10809 10810 mgmt_adv_monitor_device_found(hdev, bdaddr, report_device, skb, NULL); 10811 } 10812 10813 void mgmt_remote_name(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type, 10814 u8 addr_type, s8 rssi, u8 *name, u8 name_len) 10815 { 10816 struct sk_buff *skb; 10817 struct mgmt_ev_device_found *ev; 10818 u16 eir_len = 0; 10819 u32 flags = 0; 10820 10821 skb = mgmt_alloc_skb(hdev, MGMT_EV_DEVICE_FOUND, 10822 sizeof(*ev) + (name ? eir_precalc_len(name_len) : 0)); 10823 if (!skb) 10824 return; 10825 10826 ev = skb_put(skb, sizeof(*ev)); 10827 bacpy(&ev->addr.bdaddr, bdaddr); 10828 ev->addr.type = link_to_bdaddr(link_type, addr_type); 10829 ev->rssi = rssi; 10830 10831 if (name) 10832 eir_len += eir_skb_put_data(skb, EIR_NAME_COMPLETE, name, name_len); 10833 else 10834 flags = MGMT_DEV_FOUND_NAME_REQUEST_FAILED; 10835 10836 ev->eir_len = cpu_to_le16(eir_len); 10837 ev->flags = cpu_to_le32(flags); 10838 10839 mgmt_event_skb(skb, NULL); 10840 } 10841 10842 void mgmt_discovering(struct hci_dev *hdev, u8 discovering) 10843 { 10844 struct mgmt_ev_discovering ev; 10845 10846 bt_dev_dbg(hdev, "discovering %u", discovering); 10847 10848 memset(&ev, 0, sizeof(ev)); 10849 ev.type = hdev->discovery.type; 10850 ev.discovering = discovering; 10851 10852 mgmt_event(MGMT_EV_DISCOVERING, hdev, &ev, sizeof(ev), NULL); 10853 } 10854 10855 void mgmt_suspending(struct hci_dev *hdev, u8 state) 10856 { 10857 struct mgmt_ev_controller_suspend ev; 10858 10859 ev.suspend_state = state; 10860 mgmt_event(MGMT_EV_CONTROLLER_SUSPEND, hdev, &ev, sizeof(ev), NULL); 10861 } 10862 10863 void mgmt_resuming(struct hci_dev *hdev, u8 reason, bdaddr_t *bdaddr, 10864 u8 addr_type) 10865 { 10866 struct mgmt_ev_controller_resume ev; 10867 10868 ev.wake_reason = reason; 10869 if (bdaddr) { 10870 bacpy(&ev.addr.bdaddr, bdaddr); 10871 ev.addr.type = addr_type; 10872 } else { 10873 memset(&ev.addr, 0, sizeof(ev.addr)); 10874 } 10875 10876 mgmt_event(MGMT_EV_CONTROLLER_RESUME, hdev, &ev, sizeof(ev), NULL); 10877 } 10878 10879 static struct hci_mgmt_chan chan = { 10880 .channel = HCI_CHANNEL_CONTROL, 10881 .handler_count = ARRAY_SIZE(mgmt_handlers), 10882 .handlers = mgmt_handlers, 10883 .hdev_init = mgmt_init_hdev, 10884 }; 10885 10886 int mgmt_init(void) 10887 { 10888 return hci_mgmt_chan_register(&chan); 10889 } 10890 10891 void mgmt_conn_subrate_notify(struct hci_dev *hdev, struct hci_conn *conn, 10892 u8 status) 10893 { 10894 struct mgmt_ev_conn_subrate ev; 10895 10896 bacpy(&ev.addr.bdaddr, &conn->dst); 10897 ev.addr.type = link_to_bdaddr(conn->type, conn->dst_type); 10898 ev.status = mgmt_status(status); 10899 ev.interval = cpu_to_le16(conn->le_rate_interval); 10900 ev.subrate = cpu_to_le16(conn->le_subrate); 10901 ev.latency = cpu_to_le16(conn->le_rate_latency); 10902 ev.cont_num = cpu_to_le16(conn->le_cont_num); 10903 ev.supv_timeout = cpu_to_le16(conn->le_rate_supv_timeout); 10904 10905 mgmt_event(MGMT_EV_CONN_SUBRATE, hdev, &ev, sizeof(ev), NULL); 10906 } 10907 10908 void mgmt_exit(void) 10909 { 10910 hci_mgmt_chan_unregister(&chan); 10911 } 10912 10913 void mgmt_cleanup(struct sock *sk) 10914 { 10915 struct mgmt_mesh_tx *mesh_tx; 10916 struct hci_dev *hdev; 10917 10918 read_lock(&hci_dev_list_lock); 10919 10920 list_for_each_entry(hdev, &hci_dev_list, list) { 10921 do { 10922 mesh_tx = mgmt_mesh_next(hdev, sk); 10923 10924 if (mesh_tx) 10925 mesh_send_complete(hdev, mesh_tx, true); 10926 } while (mesh_tx); 10927 } 10928 10929 read_unlock(&hci_dev_list_lock); 10930 } 10931