1 // SPDX-License-Identifier: GPL-2.0 2 /* 3 BlueZ - Bluetooth protocol stack for Linux 4 5 Copyright (C) 2010 Nokia Corporation 6 Copyright (C) 2011-2012 Intel Corporation 7 8 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS 9 OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 10 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS. 11 IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY 12 CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES 13 WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN 14 ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF 15 OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. 16 17 ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS, 18 COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS 19 SOFTWARE IS DISCLAIMED. 20 */ 21 22 /* Bluetooth HCI Management interface */ 23 24 #include <linux/module.h> 25 #include <linux/unaligned.h> 26 27 #include <net/bluetooth/bluetooth.h> 28 #include <net/bluetooth/hci_core.h> 29 #include <net/bluetooth/hci_sock.h> 30 #include <net/bluetooth/l2cap.h> 31 #include <net/bluetooth/mgmt.h> 32 33 #include "smp.h" 34 #include "mgmt_util.h" 35 #include "mgmt_config.h" 36 #include "msft.h" 37 #include "eir.h" 38 #include "aosp.h" 39 40 #define MGMT_VERSION 1 41 #define MGMT_REVISION 23 42 43 static const u16 mgmt_commands[] = { 44 MGMT_OP_READ_INDEX_LIST, 45 MGMT_OP_READ_INFO, 46 MGMT_OP_SET_POWERED, 47 MGMT_OP_SET_DISCOVERABLE, 48 MGMT_OP_SET_CONNECTABLE, 49 MGMT_OP_SET_FAST_CONNECTABLE, 50 MGMT_OP_SET_BONDABLE, 51 MGMT_OP_SET_LINK_SECURITY, 52 MGMT_OP_SET_SSP, 53 MGMT_OP_SET_HS, 54 MGMT_OP_SET_LE, 55 MGMT_OP_SET_DEV_CLASS, 56 MGMT_OP_SET_LOCAL_NAME, 57 MGMT_OP_ADD_UUID, 58 MGMT_OP_REMOVE_UUID, 59 MGMT_OP_LOAD_LINK_KEYS, 60 MGMT_OP_LOAD_LONG_TERM_KEYS, 61 MGMT_OP_DISCONNECT, 62 MGMT_OP_GET_CONNECTIONS, 63 MGMT_OP_PIN_CODE_REPLY, 64 MGMT_OP_PIN_CODE_NEG_REPLY, 65 MGMT_OP_SET_IO_CAPABILITY, 66 MGMT_OP_PAIR_DEVICE, 67 MGMT_OP_CANCEL_PAIR_DEVICE, 68 MGMT_OP_UNPAIR_DEVICE, 69 MGMT_OP_USER_CONFIRM_REPLY, 70 MGMT_OP_USER_CONFIRM_NEG_REPLY, 71 MGMT_OP_USER_PASSKEY_REPLY, 72 MGMT_OP_USER_PASSKEY_NEG_REPLY, 73 MGMT_OP_READ_LOCAL_OOB_DATA, 74 MGMT_OP_ADD_REMOTE_OOB_DATA, 75 MGMT_OP_REMOVE_REMOTE_OOB_DATA, 76 MGMT_OP_START_DISCOVERY, 77 MGMT_OP_STOP_DISCOVERY, 78 MGMT_OP_CONFIRM_NAME, 79 MGMT_OP_BLOCK_DEVICE, 80 MGMT_OP_UNBLOCK_DEVICE, 81 MGMT_OP_SET_DEVICE_ID, 82 MGMT_OP_SET_ADVERTISING, 83 MGMT_OP_SET_BREDR, 84 MGMT_OP_SET_STATIC_ADDRESS, 85 MGMT_OP_SET_SCAN_PARAMS, 86 MGMT_OP_SET_SECURE_CONN, 87 MGMT_OP_SET_DEBUG_KEYS, 88 MGMT_OP_SET_PRIVACY, 89 MGMT_OP_LOAD_IRKS, 90 MGMT_OP_GET_CONN_INFO, 91 MGMT_OP_GET_CLOCK_INFO, 92 MGMT_OP_ADD_DEVICE, 93 MGMT_OP_REMOVE_DEVICE, 94 MGMT_OP_LOAD_CONN_PARAM, 95 MGMT_OP_READ_UNCONF_INDEX_LIST, 96 MGMT_OP_READ_CONFIG_INFO, 97 MGMT_OP_SET_EXTERNAL_CONFIG, 98 MGMT_OP_SET_PUBLIC_ADDRESS, 99 MGMT_OP_START_SERVICE_DISCOVERY, 100 MGMT_OP_READ_LOCAL_OOB_EXT_DATA, 101 MGMT_OP_READ_EXT_INDEX_LIST, 102 MGMT_OP_READ_ADV_FEATURES, 103 MGMT_OP_ADD_ADVERTISING, 104 MGMT_OP_REMOVE_ADVERTISING, 105 MGMT_OP_GET_ADV_SIZE_INFO, 106 MGMT_OP_START_LIMITED_DISCOVERY, 107 MGMT_OP_READ_EXT_INFO, 108 MGMT_OP_SET_APPEARANCE, 109 MGMT_OP_GET_PHY_CONFIGURATION, 110 MGMT_OP_SET_PHY_CONFIGURATION, 111 MGMT_OP_SET_BLOCKED_KEYS, 112 MGMT_OP_SET_WIDEBAND_SPEECH, 113 MGMT_OP_READ_CONTROLLER_CAP, 114 MGMT_OP_READ_EXP_FEATURES_INFO, 115 MGMT_OP_SET_EXP_FEATURE, 116 MGMT_OP_READ_DEF_SYSTEM_CONFIG, 117 MGMT_OP_SET_DEF_SYSTEM_CONFIG, 118 MGMT_OP_READ_DEF_RUNTIME_CONFIG, 119 MGMT_OP_SET_DEF_RUNTIME_CONFIG, 120 MGMT_OP_GET_DEVICE_FLAGS, 121 MGMT_OP_SET_DEVICE_FLAGS, 122 MGMT_OP_READ_ADV_MONITOR_FEATURES, 123 MGMT_OP_ADD_ADV_PATTERNS_MONITOR, 124 MGMT_OP_REMOVE_ADV_MONITOR, 125 MGMT_OP_ADD_EXT_ADV_PARAMS, 126 MGMT_OP_ADD_EXT_ADV_DATA, 127 MGMT_OP_ADD_ADV_PATTERNS_MONITOR_RSSI, 128 MGMT_OP_SET_MESH_RECEIVER, 129 MGMT_OP_MESH_READ_FEATURES, 130 MGMT_OP_MESH_SEND, 131 MGMT_OP_MESH_SEND_CANCEL, 132 MGMT_OP_HCI_CMD_SYNC, 133 }; 134 135 static const u16 mgmt_events[] = { 136 MGMT_EV_CONTROLLER_ERROR, 137 MGMT_EV_INDEX_ADDED, 138 MGMT_EV_INDEX_REMOVED, 139 MGMT_EV_NEW_SETTINGS, 140 MGMT_EV_CLASS_OF_DEV_CHANGED, 141 MGMT_EV_LOCAL_NAME_CHANGED, 142 MGMT_EV_NEW_LINK_KEY, 143 MGMT_EV_NEW_LONG_TERM_KEY, 144 MGMT_EV_DEVICE_CONNECTED, 145 MGMT_EV_DEVICE_DISCONNECTED, 146 MGMT_EV_CONNECT_FAILED, 147 MGMT_EV_PIN_CODE_REQUEST, 148 MGMT_EV_USER_CONFIRM_REQUEST, 149 MGMT_EV_USER_PASSKEY_REQUEST, 150 MGMT_EV_AUTH_FAILED, 151 MGMT_EV_DEVICE_FOUND, 152 MGMT_EV_DISCOVERING, 153 MGMT_EV_DEVICE_BLOCKED, 154 MGMT_EV_DEVICE_UNBLOCKED, 155 MGMT_EV_DEVICE_UNPAIRED, 156 MGMT_EV_PASSKEY_NOTIFY, 157 MGMT_EV_NEW_IRK, 158 MGMT_EV_NEW_CSRK, 159 MGMT_EV_DEVICE_ADDED, 160 MGMT_EV_DEVICE_REMOVED, 161 MGMT_EV_NEW_CONN_PARAM, 162 MGMT_EV_UNCONF_INDEX_ADDED, 163 MGMT_EV_UNCONF_INDEX_REMOVED, 164 MGMT_EV_NEW_CONFIG_OPTIONS, 165 MGMT_EV_EXT_INDEX_ADDED, 166 MGMT_EV_EXT_INDEX_REMOVED, 167 MGMT_EV_LOCAL_OOB_DATA_UPDATED, 168 MGMT_EV_ADVERTISING_ADDED, 169 MGMT_EV_ADVERTISING_REMOVED, 170 MGMT_EV_EXT_INFO_CHANGED, 171 MGMT_EV_PHY_CONFIGURATION_CHANGED, 172 MGMT_EV_EXP_FEATURE_CHANGED, 173 MGMT_EV_DEVICE_FLAGS_CHANGED, 174 MGMT_EV_ADV_MONITOR_ADDED, 175 MGMT_EV_ADV_MONITOR_REMOVED, 176 MGMT_EV_CONTROLLER_SUSPEND, 177 MGMT_EV_CONTROLLER_RESUME, 178 MGMT_EV_ADV_MONITOR_DEVICE_FOUND, 179 MGMT_EV_ADV_MONITOR_DEVICE_LOST, 180 }; 181 182 static const u16 mgmt_untrusted_commands[] = { 183 MGMT_OP_READ_INDEX_LIST, 184 MGMT_OP_READ_INFO, 185 MGMT_OP_READ_UNCONF_INDEX_LIST, 186 MGMT_OP_READ_CONFIG_INFO, 187 MGMT_OP_READ_EXT_INDEX_LIST, 188 MGMT_OP_READ_EXT_INFO, 189 MGMT_OP_READ_CONTROLLER_CAP, 190 MGMT_OP_READ_EXP_FEATURES_INFO, 191 MGMT_OP_READ_DEF_SYSTEM_CONFIG, 192 MGMT_OP_READ_DEF_RUNTIME_CONFIG, 193 }; 194 195 static const u16 mgmt_untrusted_events[] = { 196 MGMT_EV_INDEX_ADDED, 197 MGMT_EV_INDEX_REMOVED, 198 MGMT_EV_NEW_SETTINGS, 199 MGMT_EV_CLASS_OF_DEV_CHANGED, 200 MGMT_EV_LOCAL_NAME_CHANGED, 201 MGMT_EV_UNCONF_INDEX_ADDED, 202 MGMT_EV_UNCONF_INDEX_REMOVED, 203 MGMT_EV_NEW_CONFIG_OPTIONS, 204 MGMT_EV_EXT_INDEX_ADDED, 205 MGMT_EV_EXT_INDEX_REMOVED, 206 MGMT_EV_EXT_INFO_CHANGED, 207 MGMT_EV_EXP_FEATURE_CHANGED, 208 }; 209 210 #define CACHE_TIMEOUT secs_to_jiffies(2) 211 212 #define ZERO_KEY "\x00\x00\x00\x00\x00\x00\x00\x00" \ 213 "\x00\x00\x00\x00\x00\x00\x00\x00" 214 215 /* HCI to MGMT error code conversion table */ 216 static const u8 mgmt_status_table[] = { 217 MGMT_STATUS_SUCCESS, 218 MGMT_STATUS_UNKNOWN_COMMAND, /* Unknown Command */ 219 MGMT_STATUS_NOT_CONNECTED, /* No Connection */ 220 MGMT_STATUS_FAILED, /* Hardware Failure */ 221 MGMT_STATUS_CONNECT_FAILED, /* Page Timeout */ 222 MGMT_STATUS_AUTH_FAILED, /* Authentication Failed */ 223 MGMT_STATUS_AUTH_FAILED, /* PIN or Key Missing */ 224 MGMT_STATUS_NO_RESOURCES, /* Memory Full */ 225 MGMT_STATUS_TIMEOUT, /* Connection Timeout */ 226 MGMT_STATUS_NO_RESOURCES, /* Max Number of Connections */ 227 MGMT_STATUS_NO_RESOURCES, /* Max Number of SCO Connections */ 228 MGMT_STATUS_ALREADY_CONNECTED, /* ACL Connection Exists */ 229 MGMT_STATUS_BUSY, /* Command Disallowed */ 230 MGMT_STATUS_NO_RESOURCES, /* Rejected Limited Resources */ 231 MGMT_STATUS_REJECTED, /* Rejected Security */ 232 MGMT_STATUS_REJECTED, /* Rejected Personal */ 233 MGMT_STATUS_TIMEOUT, /* Host Timeout */ 234 MGMT_STATUS_NOT_SUPPORTED, /* Unsupported Feature */ 235 MGMT_STATUS_INVALID_PARAMS, /* Invalid Parameters */ 236 MGMT_STATUS_DISCONNECTED, /* OE User Ended Connection */ 237 MGMT_STATUS_NO_RESOURCES, /* OE Low Resources */ 238 MGMT_STATUS_DISCONNECTED, /* OE Power Off */ 239 MGMT_STATUS_DISCONNECTED, /* Connection Terminated */ 240 MGMT_STATUS_BUSY, /* Repeated Attempts */ 241 MGMT_STATUS_REJECTED, /* Pairing Not Allowed */ 242 MGMT_STATUS_FAILED, /* Unknown LMP PDU */ 243 MGMT_STATUS_NOT_SUPPORTED, /* Unsupported Remote Feature */ 244 MGMT_STATUS_REJECTED, /* SCO Offset Rejected */ 245 MGMT_STATUS_REJECTED, /* SCO Interval Rejected */ 246 MGMT_STATUS_REJECTED, /* Air Mode Rejected */ 247 MGMT_STATUS_INVALID_PARAMS, /* Invalid LMP Parameters */ 248 MGMT_STATUS_FAILED, /* Unspecified Error */ 249 MGMT_STATUS_NOT_SUPPORTED, /* Unsupported LMP Parameter Value */ 250 MGMT_STATUS_FAILED, /* Role Change Not Allowed */ 251 MGMT_STATUS_TIMEOUT, /* LMP Response Timeout */ 252 MGMT_STATUS_FAILED, /* LMP Error Transaction Collision */ 253 MGMT_STATUS_FAILED, /* LMP PDU Not Allowed */ 254 MGMT_STATUS_REJECTED, /* Encryption Mode Not Accepted */ 255 MGMT_STATUS_FAILED, /* Unit Link Key Used */ 256 MGMT_STATUS_NOT_SUPPORTED, /* QoS Not Supported */ 257 MGMT_STATUS_TIMEOUT, /* Instant Passed */ 258 MGMT_STATUS_NOT_SUPPORTED, /* Pairing Not Supported */ 259 MGMT_STATUS_FAILED, /* Transaction Collision */ 260 MGMT_STATUS_FAILED, /* Reserved for future use */ 261 MGMT_STATUS_INVALID_PARAMS, /* Unacceptable Parameter */ 262 MGMT_STATUS_REJECTED, /* QoS Rejected */ 263 MGMT_STATUS_NOT_SUPPORTED, /* Classification Not Supported */ 264 MGMT_STATUS_REJECTED, /* Insufficient Security */ 265 MGMT_STATUS_INVALID_PARAMS, /* Parameter Out Of Range */ 266 MGMT_STATUS_FAILED, /* Reserved for future use */ 267 MGMT_STATUS_BUSY, /* Role Switch Pending */ 268 MGMT_STATUS_FAILED, /* Reserved for future use */ 269 MGMT_STATUS_FAILED, /* Slot Violation */ 270 MGMT_STATUS_FAILED, /* Role Switch Failed */ 271 MGMT_STATUS_INVALID_PARAMS, /* EIR Too Large */ 272 MGMT_STATUS_NOT_SUPPORTED, /* Simple Pairing Not Supported */ 273 MGMT_STATUS_BUSY, /* Host Busy Pairing */ 274 MGMT_STATUS_REJECTED, /* Rejected, No Suitable Channel */ 275 MGMT_STATUS_BUSY, /* Controller Busy */ 276 MGMT_STATUS_INVALID_PARAMS, /* Unsuitable Connection Interval */ 277 MGMT_STATUS_TIMEOUT, /* Directed Advertising Timeout */ 278 MGMT_STATUS_AUTH_FAILED, /* Terminated Due to MIC Failure */ 279 MGMT_STATUS_CONNECT_FAILED, /* Connection Establishment Failed */ 280 MGMT_STATUS_CONNECT_FAILED, /* MAC Connection Failed */ 281 }; 282 283 static u8 mgmt_errno_status(int err) 284 { 285 switch (err) { 286 case 0: 287 return MGMT_STATUS_SUCCESS; 288 case -EPERM: 289 return MGMT_STATUS_REJECTED; 290 case -EINVAL: 291 return MGMT_STATUS_INVALID_PARAMS; 292 case -EOPNOTSUPP: 293 return MGMT_STATUS_NOT_SUPPORTED; 294 case -EBUSY: 295 return MGMT_STATUS_BUSY; 296 case -ETIMEDOUT: 297 return MGMT_STATUS_AUTH_FAILED; 298 case -ENOMEM: 299 return MGMT_STATUS_NO_RESOURCES; 300 case -EISCONN: 301 return MGMT_STATUS_ALREADY_CONNECTED; 302 case -ENOTCONN: 303 return MGMT_STATUS_DISCONNECTED; 304 } 305 306 return MGMT_STATUS_FAILED; 307 } 308 309 static u8 mgmt_status(int err) 310 { 311 if (err < 0) 312 return mgmt_errno_status(err); 313 314 if (err < ARRAY_SIZE(mgmt_status_table)) 315 return mgmt_status_table[err]; 316 317 return MGMT_STATUS_FAILED; 318 } 319 320 static int mgmt_index_event(u16 event, struct hci_dev *hdev, void *data, 321 u16 len, int flag) 322 { 323 return mgmt_send_event(event, hdev, HCI_CHANNEL_CONTROL, data, len, 324 flag, NULL); 325 } 326 327 static int mgmt_limited_event(u16 event, struct hci_dev *hdev, void *data, 328 u16 len, int flag, struct sock *skip_sk) 329 { 330 return mgmt_send_event(event, hdev, HCI_CHANNEL_CONTROL, data, len, 331 flag, skip_sk); 332 } 333 334 static int mgmt_event(u16 event, struct hci_dev *hdev, void *data, u16 len, 335 struct sock *skip_sk) 336 { 337 return mgmt_send_event(event, hdev, HCI_CHANNEL_CONTROL, data, len, 338 HCI_SOCK_TRUSTED, skip_sk); 339 } 340 341 static int mgmt_event_skb(struct sk_buff *skb, struct sock *skip_sk) 342 { 343 return mgmt_send_event_skb(HCI_CHANNEL_CONTROL, skb, HCI_SOCK_TRUSTED, 344 skip_sk); 345 } 346 347 static u8 le_addr_type(u8 mgmt_addr_type) 348 { 349 if (mgmt_addr_type == BDADDR_LE_PUBLIC) 350 return ADDR_LE_DEV_PUBLIC; 351 else 352 return ADDR_LE_DEV_RANDOM; 353 } 354 355 void mgmt_fill_version_info(void *ver) 356 { 357 struct mgmt_rp_read_version *rp = ver; 358 359 rp->version = MGMT_VERSION; 360 rp->revision = cpu_to_le16(MGMT_REVISION); 361 } 362 363 static int read_version(struct sock *sk, struct hci_dev *hdev, void *data, 364 u16 data_len) 365 { 366 struct mgmt_rp_read_version rp; 367 368 bt_dev_dbg(hdev, "sock %p", sk); 369 370 mgmt_fill_version_info(&rp); 371 372 return mgmt_cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_VERSION, 0, 373 &rp, sizeof(rp)); 374 } 375 376 static int read_commands(struct sock *sk, struct hci_dev *hdev, void *data, 377 u16 data_len) 378 { 379 struct mgmt_rp_read_commands *rp; 380 u16 num_commands, num_events; 381 size_t rp_size; 382 int i, err; 383 384 bt_dev_dbg(hdev, "sock %p", sk); 385 386 if (hci_sock_test_flag(sk, HCI_SOCK_TRUSTED)) { 387 num_commands = ARRAY_SIZE(mgmt_commands); 388 num_events = ARRAY_SIZE(mgmt_events); 389 } else { 390 num_commands = ARRAY_SIZE(mgmt_untrusted_commands); 391 num_events = ARRAY_SIZE(mgmt_untrusted_events); 392 } 393 394 rp_size = sizeof(*rp) + ((num_commands + num_events) * sizeof(u16)); 395 396 rp = kmalloc(rp_size, GFP_KERNEL); 397 if (!rp) 398 return -ENOMEM; 399 400 rp->num_commands = cpu_to_le16(num_commands); 401 rp->num_events = cpu_to_le16(num_events); 402 403 if (hci_sock_test_flag(sk, HCI_SOCK_TRUSTED)) { 404 __le16 *opcode = rp->opcodes; 405 406 for (i = 0; i < num_commands; i++, opcode++) 407 put_unaligned_le16(mgmt_commands[i], opcode); 408 409 for (i = 0; i < num_events; i++, opcode++) 410 put_unaligned_le16(mgmt_events[i], opcode); 411 } else { 412 __le16 *opcode = rp->opcodes; 413 414 for (i = 0; i < num_commands; i++, opcode++) 415 put_unaligned_le16(mgmt_untrusted_commands[i], opcode); 416 417 for (i = 0; i < num_events; i++, opcode++) 418 put_unaligned_le16(mgmt_untrusted_events[i], opcode); 419 } 420 421 err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_COMMANDS, 0, 422 rp, rp_size); 423 kfree(rp); 424 425 return err; 426 } 427 428 static int read_index_list(struct sock *sk, struct hci_dev *hdev, void *data, 429 u16 data_len) 430 { 431 struct mgmt_rp_read_index_list *rp; 432 struct hci_dev *d; 433 size_t rp_len; 434 u16 count; 435 int err; 436 437 bt_dev_dbg(hdev, "sock %p", sk); 438 439 read_lock(&hci_dev_list_lock); 440 441 count = 0; 442 list_for_each_entry(d, &hci_dev_list, list) { 443 if (!hci_dev_test_flag(d, HCI_UNCONFIGURED)) 444 count++; 445 } 446 447 rp_len = sizeof(*rp) + (2 * count); 448 rp = kmalloc(rp_len, GFP_ATOMIC); 449 if (!rp) { 450 read_unlock(&hci_dev_list_lock); 451 return -ENOMEM; 452 } 453 454 count = 0; 455 list_for_each_entry(d, &hci_dev_list, list) { 456 if (hci_dev_test_flag(d, HCI_SETUP) || 457 hci_dev_test_flag(d, HCI_CONFIG) || 458 hci_dev_test_flag(d, HCI_USER_CHANNEL)) 459 continue; 460 461 /* Devices marked as raw-only are neither configured 462 * nor unconfigured controllers. 463 */ 464 if (hci_test_quirk(d, HCI_QUIRK_RAW_DEVICE)) 465 continue; 466 467 if (!hci_dev_test_flag(d, HCI_UNCONFIGURED)) { 468 rp->index[count++] = cpu_to_le16(d->id); 469 bt_dev_dbg(hdev, "Added hci%u", d->id); 470 } 471 } 472 473 rp->num_controllers = cpu_to_le16(count); 474 rp_len = sizeof(*rp) + (2 * count); 475 476 read_unlock(&hci_dev_list_lock); 477 478 err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_INDEX_LIST, 479 0, rp, rp_len); 480 481 kfree(rp); 482 483 return err; 484 } 485 486 static int read_unconf_index_list(struct sock *sk, struct hci_dev *hdev, 487 void *data, u16 data_len) 488 { 489 struct mgmt_rp_read_unconf_index_list *rp; 490 struct hci_dev *d; 491 size_t rp_len; 492 u16 count; 493 int err; 494 495 bt_dev_dbg(hdev, "sock %p", sk); 496 497 read_lock(&hci_dev_list_lock); 498 499 count = 0; 500 list_for_each_entry(d, &hci_dev_list, list) { 501 if (hci_dev_test_flag(d, HCI_UNCONFIGURED)) 502 count++; 503 } 504 505 rp_len = sizeof(*rp) + (2 * count); 506 rp = kmalloc(rp_len, GFP_ATOMIC); 507 if (!rp) { 508 read_unlock(&hci_dev_list_lock); 509 return -ENOMEM; 510 } 511 512 count = 0; 513 list_for_each_entry(d, &hci_dev_list, list) { 514 if (hci_dev_test_flag(d, HCI_SETUP) || 515 hci_dev_test_flag(d, HCI_CONFIG) || 516 hci_dev_test_flag(d, HCI_USER_CHANNEL)) 517 continue; 518 519 /* Devices marked as raw-only are neither configured 520 * nor unconfigured controllers. 521 */ 522 if (hci_test_quirk(d, HCI_QUIRK_RAW_DEVICE)) 523 continue; 524 525 if (hci_dev_test_flag(d, HCI_UNCONFIGURED)) { 526 rp->index[count++] = cpu_to_le16(d->id); 527 bt_dev_dbg(hdev, "Added hci%u", d->id); 528 } 529 } 530 531 rp->num_controllers = cpu_to_le16(count); 532 rp_len = sizeof(*rp) + (2 * count); 533 534 read_unlock(&hci_dev_list_lock); 535 536 err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE, 537 MGMT_OP_READ_UNCONF_INDEX_LIST, 0, rp, rp_len); 538 539 kfree(rp); 540 541 return err; 542 } 543 544 static int read_ext_index_list(struct sock *sk, struct hci_dev *hdev, 545 void *data, u16 data_len) 546 { 547 struct mgmt_rp_read_ext_index_list *rp; 548 struct hci_dev *d; 549 u16 count; 550 int err; 551 552 bt_dev_dbg(hdev, "sock %p", sk); 553 554 read_lock(&hci_dev_list_lock); 555 556 count = 0; 557 list_for_each_entry(d, &hci_dev_list, list) 558 count++; 559 560 rp = kmalloc_flex(*rp, entry, count, GFP_ATOMIC); 561 if (!rp) { 562 read_unlock(&hci_dev_list_lock); 563 return -ENOMEM; 564 } 565 566 count = 0; 567 list_for_each_entry(d, &hci_dev_list, list) { 568 if (hci_dev_test_flag(d, HCI_SETUP) || 569 hci_dev_test_flag(d, HCI_CONFIG) || 570 hci_dev_test_flag(d, HCI_USER_CHANNEL)) 571 continue; 572 573 /* Devices marked as raw-only are neither configured 574 * nor unconfigured controllers. 575 */ 576 if (hci_test_quirk(d, HCI_QUIRK_RAW_DEVICE)) 577 continue; 578 579 if (hci_dev_test_flag(d, HCI_UNCONFIGURED)) 580 rp->entry[count].type = 0x01; 581 else 582 rp->entry[count].type = 0x00; 583 584 rp->entry[count].bus = d->bus; 585 rp->entry[count++].index = cpu_to_le16(d->id); 586 bt_dev_dbg(hdev, "Added hci%u", d->id); 587 } 588 589 rp->num_controllers = cpu_to_le16(count); 590 591 read_unlock(&hci_dev_list_lock); 592 593 /* If this command is called at least once, then all the 594 * default index and unconfigured index events are disabled 595 * and from now on only extended index events are used. 596 */ 597 hci_sock_set_flag(sk, HCI_MGMT_EXT_INDEX_EVENTS); 598 hci_sock_clear_flag(sk, HCI_MGMT_INDEX_EVENTS); 599 hci_sock_clear_flag(sk, HCI_MGMT_UNCONF_INDEX_EVENTS); 600 601 err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE, 602 MGMT_OP_READ_EXT_INDEX_LIST, 0, rp, 603 struct_size(rp, entry, count)); 604 605 kfree(rp); 606 607 return err; 608 } 609 610 static bool is_configured(struct hci_dev *hdev) 611 { 612 if (hci_test_quirk(hdev, HCI_QUIRK_EXTERNAL_CONFIG) && 613 !hci_dev_test_flag(hdev, HCI_EXT_CONFIGURED)) 614 return false; 615 616 if ((hci_test_quirk(hdev, HCI_QUIRK_INVALID_BDADDR) || 617 hci_test_quirk(hdev, HCI_QUIRK_USE_BDADDR_PROPERTY)) && 618 !bacmp(&hdev->public_addr, BDADDR_ANY)) 619 return false; 620 621 return true; 622 } 623 624 static __le32 get_missing_options(struct hci_dev *hdev) 625 { 626 u32 options = 0; 627 628 if (hci_test_quirk(hdev, HCI_QUIRK_EXTERNAL_CONFIG) && 629 !hci_dev_test_flag(hdev, HCI_EXT_CONFIGURED)) 630 options |= MGMT_OPTION_EXTERNAL_CONFIG; 631 632 if ((hci_test_quirk(hdev, HCI_QUIRK_INVALID_BDADDR) || 633 hci_test_quirk(hdev, HCI_QUIRK_USE_BDADDR_PROPERTY)) && 634 !bacmp(&hdev->public_addr, BDADDR_ANY)) 635 options |= MGMT_OPTION_PUBLIC_ADDRESS; 636 637 return cpu_to_le32(options); 638 } 639 640 static int new_options(struct hci_dev *hdev, struct sock *skip) 641 { 642 __le32 options = get_missing_options(hdev); 643 644 return mgmt_limited_event(MGMT_EV_NEW_CONFIG_OPTIONS, hdev, &options, 645 sizeof(options), HCI_MGMT_OPTION_EVENTS, skip); 646 } 647 648 static int send_options_rsp(struct sock *sk, u16 opcode, struct hci_dev *hdev) 649 { 650 __le32 options = get_missing_options(hdev); 651 652 return mgmt_cmd_complete(sk, hdev->id, opcode, 0, &options, 653 sizeof(options)); 654 } 655 656 static int read_config_info(struct sock *sk, struct hci_dev *hdev, 657 void *data, u16 data_len) 658 { 659 struct mgmt_rp_read_config_info rp; 660 u32 options = 0; 661 662 bt_dev_dbg(hdev, "sock %p", sk); 663 664 hci_dev_lock(hdev); 665 666 memset(&rp, 0, sizeof(rp)); 667 rp.manufacturer = cpu_to_le16(hdev->manufacturer); 668 669 if (hci_test_quirk(hdev, HCI_QUIRK_EXTERNAL_CONFIG)) 670 options |= MGMT_OPTION_EXTERNAL_CONFIG; 671 672 if (hdev->set_bdaddr) 673 options |= MGMT_OPTION_PUBLIC_ADDRESS; 674 675 rp.supported_options = cpu_to_le32(options); 676 rp.missing_options = get_missing_options(hdev); 677 678 hci_dev_unlock(hdev); 679 680 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_CONFIG_INFO, 0, 681 &rp, sizeof(rp)); 682 } 683 684 static u32 get_supported_phys(struct hci_dev *hdev) 685 { 686 u32 supported_phys = 0; 687 688 if (lmp_bredr_capable(hdev)) { 689 supported_phys |= MGMT_PHY_BR_1M_1SLOT; 690 691 if (hdev->features[0][0] & LMP_3SLOT) 692 supported_phys |= MGMT_PHY_BR_1M_3SLOT; 693 694 if (hdev->features[0][0] & LMP_5SLOT) 695 supported_phys |= MGMT_PHY_BR_1M_5SLOT; 696 697 if (lmp_edr_2m_capable(hdev)) { 698 supported_phys |= MGMT_PHY_EDR_2M_1SLOT; 699 700 if (lmp_edr_3slot_capable(hdev)) 701 supported_phys |= MGMT_PHY_EDR_2M_3SLOT; 702 703 if (lmp_edr_5slot_capable(hdev)) 704 supported_phys |= MGMT_PHY_EDR_2M_5SLOT; 705 706 if (lmp_edr_3m_capable(hdev)) { 707 supported_phys |= MGMT_PHY_EDR_3M_1SLOT; 708 709 if (lmp_edr_3slot_capable(hdev)) 710 supported_phys |= MGMT_PHY_EDR_3M_3SLOT; 711 712 if (lmp_edr_5slot_capable(hdev)) 713 supported_phys |= MGMT_PHY_EDR_3M_5SLOT; 714 } 715 } 716 } 717 718 if (lmp_le_capable(hdev)) { 719 supported_phys |= MGMT_PHY_LE_1M_TX; 720 supported_phys |= MGMT_PHY_LE_1M_RX; 721 722 if (hdev->le_features[1] & HCI_LE_PHY_2M) { 723 supported_phys |= MGMT_PHY_LE_2M_TX; 724 supported_phys |= MGMT_PHY_LE_2M_RX; 725 } 726 727 if (hdev->le_features[1] & HCI_LE_PHY_CODED) { 728 supported_phys |= MGMT_PHY_LE_CODED_TX; 729 supported_phys |= MGMT_PHY_LE_CODED_RX; 730 } 731 } 732 733 return supported_phys; 734 } 735 736 static u32 get_selected_phys(struct hci_dev *hdev) 737 { 738 u32 selected_phys = 0; 739 740 if (lmp_bredr_capable(hdev)) { 741 selected_phys |= MGMT_PHY_BR_1M_1SLOT; 742 743 if (hdev->pkt_type & (HCI_DM3 | HCI_DH3)) 744 selected_phys |= MGMT_PHY_BR_1M_3SLOT; 745 746 if (hdev->pkt_type & (HCI_DM5 | HCI_DH5)) 747 selected_phys |= MGMT_PHY_BR_1M_5SLOT; 748 749 if (lmp_edr_2m_capable(hdev)) { 750 if (!(hdev->pkt_type & HCI_2DH1)) 751 selected_phys |= MGMT_PHY_EDR_2M_1SLOT; 752 753 if (lmp_edr_3slot_capable(hdev) && 754 !(hdev->pkt_type & HCI_2DH3)) 755 selected_phys |= MGMT_PHY_EDR_2M_3SLOT; 756 757 if (lmp_edr_5slot_capable(hdev) && 758 !(hdev->pkt_type & HCI_2DH5)) 759 selected_phys |= MGMT_PHY_EDR_2M_5SLOT; 760 761 if (lmp_edr_3m_capable(hdev)) { 762 if (!(hdev->pkt_type & HCI_3DH1)) 763 selected_phys |= MGMT_PHY_EDR_3M_1SLOT; 764 765 if (lmp_edr_3slot_capable(hdev) && 766 !(hdev->pkt_type & HCI_3DH3)) 767 selected_phys |= MGMT_PHY_EDR_3M_3SLOT; 768 769 if (lmp_edr_5slot_capable(hdev) && 770 !(hdev->pkt_type & HCI_3DH5)) 771 selected_phys |= MGMT_PHY_EDR_3M_5SLOT; 772 } 773 } 774 } 775 776 if (lmp_le_capable(hdev)) { 777 if (hdev->le_tx_def_phys & HCI_LE_SET_PHY_1M) 778 selected_phys |= MGMT_PHY_LE_1M_TX; 779 780 if (hdev->le_rx_def_phys & HCI_LE_SET_PHY_1M) 781 selected_phys |= MGMT_PHY_LE_1M_RX; 782 783 if (hdev->le_tx_def_phys & HCI_LE_SET_PHY_2M) 784 selected_phys |= MGMT_PHY_LE_2M_TX; 785 786 if (hdev->le_rx_def_phys & HCI_LE_SET_PHY_2M) 787 selected_phys |= MGMT_PHY_LE_2M_RX; 788 789 if (hdev->le_tx_def_phys & HCI_LE_SET_PHY_CODED) 790 selected_phys |= MGMT_PHY_LE_CODED_TX; 791 792 if (hdev->le_rx_def_phys & HCI_LE_SET_PHY_CODED) 793 selected_phys |= MGMT_PHY_LE_CODED_RX; 794 } 795 796 return selected_phys; 797 } 798 799 static u32 get_configurable_phys(struct hci_dev *hdev) 800 { 801 return (get_supported_phys(hdev) & ~MGMT_PHY_BR_1M_1SLOT & 802 ~MGMT_PHY_LE_1M_TX & ~MGMT_PHY_LE_1M_RX); 803 } 804 805 static u32 get_supported_settings(struct hci_dev *hdev) 806 { 807 u32 settings = 0; 808 809 settings |= MGMT_SETTING_POWERED; 810 settings |= MGMT_SETTING_BONDABLE; 811 settings |= MGMT_SETTING_DEBUG_KEYS; 812 settings |= MGMT_SETTING_CONNECTABLE; 813 settings |= MGMT_SETTING_DISCOVERABLE; 814 815 if (lmp_bredr_capable(hdev)) { 816 if (hdev->hci_ver >= BLUETOOTH_VER_1_2) 817 settings |= MGMT_SETTING_FAST_CONNECTABLE; 818 settings |= MGMT_SETTING_BREDR; 819 settings |= MGMT_SETTING_LINK_SECURITY; 820 821 if (lmp_ssp_capable(hdev)) { 822 settings |= MGMT_SETTING_SSP; 823 } 824 825 if (lmp_sc_capable(hdev)) 826 settings |= MGMT_SETTING_SECURE_CONN; 827 828 if (hci_test_quirk(hdev, HCI_QUIRK_WIDEBAND_SPEECH_SUPPORTED)) 829 settings |= MGMT_SETTING_WIDEBAND_SPEECH; 830 } 831 832 if (lmp_le_capable(hdev)) { 833 settings |= MGMT_SETTING_LE; 834 settings |= MGMT_SETTING_SECURE_CONN; 835 settings |= MGMT_SETTING_PRIVACY; 836 settings |= MGMT_SETTING_STATIC_ADDRESS; 837 settings |= MGMT_SETTING_ADVERTISING; 838 } 839 840 if (hci_test_quirk(hdev, HCI_QUIRK_EXTERNAL_CONFIG) || hdev->set_bdaddr) 841 settings |= MGMT_SETTING_CONFIGURATION; 842 843 if (cis_central_capable(hdev)) 844 settings |= MGMT_SETTING_CIS_CENTRAL; 845 846 if (cis_peripheral_capable(hdev)) 847 settings |= MGMT_SETTING_CIS_PERIPHERAL; 848 849 if (bis_capable(hdev)) 850 settings |= MGMT_SETTING_ISO_BROADCASTER; 851 852 if (sync_recv_capable(hdev)) 853 settings |= MGMT_SETTING_ISO_SYNC_RECEIVER; 854 855 if (ll_privacy_capable(hdev)) 856 settings |= MGMT_SETTING_LL_PRIVACY; 857 858 if (past_sender_capable(hdev)) 859 settings |= MGMT_SETTING_PAST_SENDER; 860 861 if (past_receiver_capable(hdev)) 862 settings |= MGMT_SETTING_PAST_RECEIVER; 863 864 if (le_sci_capable(hdev)) 865 settings |= MGMT_SETTING_SCI; 866 867 settings |= MGMT_SETTING_PHY_CONFIGURATION; 868 869 return settings; 870 } 871 872 static u32 get_current_settings(struct hci_dev *hdev) 873 { 874 u32 settings = 0; 875 876 if (hdev_is_powered(hdev)) 877 settings |= MGMT_SETTING_POWERED; 878 879 if (hci_dev_test_flag(hdev, HCI_CONNECTABLE)) 880 settings |= MGMT_SETTING_CONNECTABLE; 881 882 if (hci_dev_test_flag(hdev, HCI_FAST_CONNECTABLE)) 883 settings |= MGMT_SETTING_FAST_CONNECTABLE; 884 885 if (hci_dev_test_flag(hdev, HCI_DISCOVERABLE)) 886 settings |= MGMT_SETTING_DISCOVERABLE; 887 888 if (hci_dev_test_flag(hdev, HCI_BONDABLE)) 889 settings |= MGMT_SETTING_BONDABLE; 890 891 if (hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) 892 settings |= MGMT_SETTING_BREDR; 893 894 if (hci_dev_test_flag(hdev, HCI_LE_ENABLED)) 895 settings |= MGMT_SETTING_LE; 896 897 if (hci_dev_test_flag(hdev, HCI_LINK_SECURITY)) 898 settings |= MGMT_SETTING_LINK_SECURITY; 899 900 if (hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) 901 settings |= MGMT_SETTING_SSP; 902 903 if (hci_dev_test_flag(hdev, HCI_ADVERTISING)) 904 settings |= MGMT_SETTING_ADVERTISING; 905 906 if (hci_dev_test_flag(hdev, HCI_SC_ENABLED)) 907 settings |= MGMT_SETTING_SECURE_CONN; 908 909 if (hci_dev_test_flag(hdev, HCI_KEEP_DEBUG_KEYS)) 910 settings |= MGMT_SETTING_DEBUG_KEYS; 911 912 if (hci_dev_test_flag(hdev, HCI_PRIVACY)) 913 settings |= MGMT_SETTING_PRIVACY; 914 915 /* The current setting for static address has two purposes. The 916 * first is to indicate if the static address will be used and 917 * the second is to indicate if it is actually set. 918 * 919 * This means if the static address is not configured, this flag 920 * will never be set. If the address is configured, then if the 921 * address is actually used decides if the flag is set or not. 922 * 923 * For single mode LE only controllers and dual-mode controllers 924 * with BR/EDR disabled, the existence of the static address will 925 * be evaluated. 926 */ 927 if (hci_dev_test_flag(hdev, HCI_FORCE_STATIC_ADDR) || 928 !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) || 929 !bacmp(&hdev->bdaddr, BDADDR_ANY)) { 930 if (bacmp(&hdev->static_addr, BDADDR_ANY)) 931 settings |= MGMT_SETTING_STATIC_ADDRESS; 932 } 933 934 if (hci_dev_test_flag(hdev, HCI_WIDEBAND_SPEECH_ENABLED)) 935 settings |= MGMT_SETTING_WIDEBAND_SPEECH; 936 937 if (cis_central_enabled(hdev)) 938 settings |= MGMT_SETTING_CIS_CENTRAL; 939 940 if (cis_peripheral_enabled(hdev)) 941 settings |= MGMT_SETTING_CIS_PERIPHERAL; 942 943 if (bis_enabled(hdev)) 944 settings |= MGMT_SETTING_ISO_BROADCASTER; 945 946 if (sync_recv_enabled(hdev)) 947 settings |= MGMT_SETTING_ISO_SYNC_RECEIVER; 948 949 if (ll_privacy_enabled(hdev)) 950 settings |= MGMT_SETTING_LL_PRIVACY; 951 952 if (past_sender_enabled(hdev)) 953 settings |= MGMT_SETTING_PAST_SENDER; 954 955 if (past_receiver_enabled(hdev)) 956 settings |= MGMT_SETTING_PAST_RECEIVER; 957 958 if (le_sci_enabled(hdev)) 959 settings |= MGMT_SETTING_SCI; 960 961 return settings; 962 } 963 964 static struct mgmt_pending_cmd *pending_find(u16 opcode, struct hci_dev *hdev) 965 { 966 return mgmt_pending_find(HCI_CHANNEL_CONTROL, opcode, hdev); 967 } 968 969 u8 mgmt_get_adv_discov_flags(struct hci_dev *hdev) 970 { 971 struct mgmt_pending_cmd *cmd; 972 973 /* If there's a pending mgmt command the flags will not yet have 974 * their final values, so check for this first. 975 */ 976 cmd = pending_find(MGMT_OP_SET_DISCOVERABLE, hdev); 977 if (cmd) { 978 struct mgmt_mode *cp = cmd->param; 979 if (cp->val == 0x01) 980 return LE_AD_GENERAL; 981 else if (cp->val == 0x02) 982 return LE_AD_LIMITED; 983 } else { 984 if (hci_dev_test_flag(hdev, HCI_LIMITED_DISCOVERABLE)) 985 return LE_AD_LIMITED; 986 else if (hci_dev_test_flag(hdev, HCI_DISCOVERABLE)) 987 return LE_AD_GENERAL; 988 } 989 990 return 0; 991 } 992 993 bool mgmt_get_connectable(struct hci_dev *hdev) 994 { 995 struct mgmt_pending_cmd *cmd; 996 997 /* If there's a pending mgmt command the flag will not yet have 998 * it's final value, so check for this first. 999 */ 1000 cmd = pending_find(MGMT_OP_SET_CONNECTABLE, hdev); 1001 if (cmd) { 1002 struct mgmt_mode *cp = cmd->param; 1003 1004 return cp->val; 1005 } 1006 1007 return hci_dev_test_flag(hdev, HCI_CONNECTABLE); 1008 } 1009 1010 static int service_cache_sync(struct hci_dev *hdev, void *data) 1011 { 1012 hci_update_eir_sync(hdev); 1013 hci_update_class_sync(hdev); 1014 1015 return 0; 1016 } 1017 1018 static void service_cache_off(struct work_struct *work) 1019 { 1020 struct hci_dev *hdev = container_of(work, struct hci_dev, 1021 service_cache.work); 1022 1023 if (!hci_dev_test_and_clear_flag(hdev, HCI_SERVICE_CACHE)) 1024 return; 1025 1026 hci_cmd_sync_queue(hdev, service_cache_sync, NULL, NULL); 1027 } 1028 1029 static int rpa_expired_sync(struct hci_dev *hdev, void *data) 1030 { 1031 /* The generation of a new RPA and programming it into the 1032 * controller happens in the hci_req_enable_advertising() 1033 * function. 1034 */ 1035 if (ext_adv_capable(hdev)) 1036 return hci_start_ext_adv_sync(hdev, hdev->cur_adv_instance); 1037 else 1038 return hci_enable_advertising_sync(hdev); 1039 } 1040 1041 static void rpa_expired(struct work_struct *work) 1042 { 1043 struct hci_dev *hdev = container_of(work, struct hci_dev, 1044 rpa_expired.work); 1045 1046 bt_dev_dbg(hdev, ""); 1047 1048 hci_dev_set_flag(hdev, HCI_RPA_EXPIRED); 1049 1050 if (!hci_dev_test_flag(hdev, HCI_ADVERTISING)) 1051 return; 1052 1053 hci_cmd_sync_queue(hdev, rpa_expired_sync, NULL, NULL); 1054 } 1055 1056 static int set_discoverable_sync(struct hci_dev *hdev, void *data); 1057 1058 static void discov_off(struct work_struct *work) 1059 { 1060 struct hci_dev *hdev = container_of(work, struct hci_dev, 1061 discov_off.work); 1062 1063 bt_dev_dbg(hdev, ""); 1064 1065 hci_dev_lock(hdev); 1066 1067 /* When discoverable timeout triggers, then just make sure 1068 * the limited discoverable flag is cleared. Even in the case 1069 * of a timeout triggered from general discoverable, it is 1070 * safe to unconditionally clear the flag. 1071 */ 1072 hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE); 1073 hci_dev_clear_flag(hdev, HCI_DISCOVERABLE); 1074 hdev->discov_timeout = 0; 1075 1076 hci_cmd_sync_queue(hdev, set_discoverable_sync, NULL, NULL); 1077 1078 mgmt_new_settings(hdev); 1079 1080 hci_dev_unlock(hdev); 1081 } 1082 1083 static int send_settings_rsp(struct sock *sk, u16 opcode, struct hci_dev *hdev); 1084 1085 static void mesh_send_complete(struct hci_dev *hdev, 1086 struct mgmt_mesh_tx *mesh_tx, bool silent) 1087 { 1088 u8 handle = mesh_tx->handle; 1089 1090 if (!silent) 1091 mgmt_event(MGMT_EV_MESH_PACKET_CMPLT, hdev, &handle, 1092 sizeof(handle), NULL); 1093 1094 mgmt_mesh_remove(mesh_tx); 1095 } 1096 1097 static int mesh_send_done_sync(struct hci_dev *hdev, void *data) 1098 { 1099 struct mgmt_mesh_tx *mesh_tx; 1100 1101 hci_dev_clear_flag(hdev, HCI_MESH_SENDING); 1102 if (list_empty(&hdev->adv_instances)) 1103 hci_disable_advertising_sync(hdev); 1104 mesh_tx = mgmt_mesh_next(hdev, NULL); 1105 1106 if (mesh_tx) 1107 mesh_send_complete(hdev, mesh_tx, false); 1108 1109 return 0; 1110 } 1111 1112 static int mesh_send_sync(struct hci_dev *hdev, void *data); 1113 static void mesh_send_start_complete(struct hci_dev *hdev, void *data, int err); 1114 static void mesh_next(struct hci_dev *hdev, void *data, int err) 1115 { 1116 struct mgmt_mesh_tx *mesh_tx = mgmt_mesh_next(hdev, NULL); 1117 1118 if (!mesh_tx) 1119 return; 1120 1121 err = hci_cmd_sync_queue(hdev, mesh_send_sync, mesh_tx, 1122 mesh_send_start_complete); 1123 1124 if (err < 0) 1125 mesh_send_complete(hdev, mesh_tx, false); 1126 else 1127 hci_dev_set_flag(hdev, HCI_MESH_SENDING); 1128 } 1129 1130 static void mesh_send_done(struct work_struct *work) 1131 { 1132 struct hci_dev *hdev = container_of(work, struct hci_dev, 1133 mesh_send_done.work); 1134 1135 if (!hci_dev_test_flag(hdev, HCI_MESH_SENDING)) 1136 return; 1137 1138 hci_cmd_sync_queue(hdev, mesh_send_done_sync, NULL, mesh_next); 1139 } 1140 1141 static void mgmt_init_hdev(struct sock *sk, struct hci_dev *hdev) 1142 { 1143 if (hci_dev_test_flag(hdev, HCI_MGMT)) 1144 return; 1145 1146 BT_INFO("MGMT ver %d.%d", MGMT_VERSION, MGMT_REVISION); 1147 1148 INIT_DELAYED_WORK(&hdev->discov_off, discov_off); 1149 INIT_DELAYED_WORK(&hdev->service_cache, service_cache_off); 1150 INIT_DELAYED_WORK(&hdev->rpa_expired, rpa_expired); 1151 INIT_DELAYED_WORK(&hdev->mesh_send_done, mesh_send_done); 1152 1153 /* Non-mgmt controlled devices get this bit set 1154 * implicitly so that pairing works for them, however 1155 * for mgmt we require user-space to explicitly enable 1156 * it 1157 */ 1158 hci_dev_clear_flag(hdev, HCI_BONDABLE); 1159 1160 hci_dev_set_flag(hdev, HCI_MGMT); 1161 } 1162 1163 static int read_controller_info(struct sock *sk, struct hci_dev *hdev, 1164 void *data, u16 data_len) 1165 { 1166 struct mgmt_rp_read_info rp; 1167 1168 bt_dev_dbg(hdev, "sock %p", sk); 1169 1170 hci_dev_lock(hdev); 1171 1172 memset(&rp, 0, sizeof(rp)); 1173 1174 bacpy(&rp.bdaddr, &hdev->bdaddr); 1175 1176 rp.version = hdev->hci_ver; 1177 rp.manufacturer = cpu_to_le16(hdev->manufacturer); 1178 1179 rp.supported_settings = cpu_to_le32(get_supported_settings(hdev)); 1180 rp.current_settings = cpu_to_le32(get_current_settings(hdev)); 1181 1182 memcpy(rp.dev_class, hdev->dev_class, 3); 1183 1184 memcpy(rp.name, hdev->dev_name, sizeof(hdev->dev_name)); 1185 memcpy(rp.short_name, hdev->short_name, sizeof(hdev->short_name)); 1186 1187 hci_dev_unlock(hdev); 1188 1189 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_INFO, 0, &rp, 1190 sizeof(rp)); 1191 } 1192 1193 static u16 append_eir_data_to_buf(struct hci_dev *hdev, u8 *eir) 1194 { 1195 u16 eir_len = 0; 1196 size_t name_len; 1197 1198 if (hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) 1199 eir_len = eir_append_data(eir, eir_len, EIR_CLASS_OF_DEV, 1200 hdev->dev_class, 3); 1201 1202 if (hci_dev_test_flag(hdev, HCI_LE_ENABLED)) 1203 eir_len = eir_append_le16(eir, eir_len, EIR_APPEARANCE, 1204 hdev->appearance); 1205 1206 name_len = strnlen(hdev->dev_name, sizeof(hdev->dev_name)); 1207 eir_len = eir_append_data(eir, eir_len, EIR_NAME_COMPLETE, 1208 hdev->dev_name, name_len); 1209 1210 name_len = strnlen(hdev->short_name, sizeof(hdev->short_name)); 1211 eir_len = eir_append_data(eir, eir_len, EIR_NAME_SHORT, 1212 hdev->short_name, name_len); 1213 1214 return eir_len; 1215 } 1216 1217 static int read_ext_controller_info(struct sock *sk, struct hci_dev *hdev, 1218 void *data, u16 data_len) 1219 { 1220 char buf[512]; 1221 struct mgmt_rp_read_ext_info *rp = (void *)buf; 1222 u16 eir_len; 1223 1224 bt_dev_dbg(hdev, "sock %p", sk); 1225 1226 memset(&buf, 0, sizeof(buf)); 1227 1228 hci_dev_lock(hdev); 1229 1230 bacpy(&rp->bdaddr, &hdev->bdaddr); 1231 1232 rp->version = hdev->hci_ver; 1233 rp->manufacturer = cpu_to_le16(hdev->manufacturer); 1234 1235 rp->supported_settings = cpu_to_le32(get_supported_settings(hdev)); 1236 rp->current_settings = cpu_to_le32(get_current_settings(hdev)); 1237 1238 1239 eir_len = append_eir_data_to_buf(hdev, rp->eir); 1240 rp->eir_len = cpu_to_le16(eir_len); 1241 1242 hci_dev_unlock(hdev); 1243 1244 /* If this command is called at least once, then the events 1245 * for class of device and local name changes are disabled 1246 * and only the new extended controller information event 1247 * is used. 1248 */ 1249 hci_sock_set_flag(sk, HCI_MGMT_EXT_INFO_EVENTS); 1250 hci_sock_clear_flag(sk, HCI_MGMT_DEV_CLASS_EVENTS); 1251 hci_sock_clear_flag(sk, HCI_MGMT_LOCAL_NAME_EVENTS); 1252 1253 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_EXT_INFO, 0, rp, 1254 sizeof(*rp) + eir_len); 1255 } 1256 1257 static int ext_info_changed(struct hci_dev *hdev, struct sock *skip) 1258 { 1259 char buf[512]; 1260 struct mgmt_ev_ext_info_changed *ev = (void *)buf; 1261 u16 eir_len; 1262 1263 memset(buf, 0, sizeof(buf)); 1264 1265 eir_len = append_eir_data_to_buf(hdev, ev->eir); 1266 ev->eir_len = cpu_to_le16(eir_len); 1267 1268 return mgmt_limited_event(MGMT_EV_EXT_INFO_CHANGED, hdev, ev, 1269 sizeof(*ev) + eir_len, 1270 HCI_MGMT_EXT_INFO_EVENTS, skip); 1271 } 1272 1273 static int send_settings_rsp(struct sock *sk, u16 opcode, struct hci_dev *hdev) 1274 { 1275 __le32 settings = cpu_to_le32(get_current_settings(hdev)); 1276 1277 return mgmt_cmd_complete(sk, hdev->id, opcode, 0, &settings, 1278 sizeof(settings)); 1279 } 1280 1281 void mgmt_advertising_added(struct sock *sk, struct hci_dev *hdev, u8 instance) 1282 { 1283 struct mgmt_ev_advertising_added ev; 1284 1285 ev.instance = instance; 1286 1287 mgmt_event(MGMT_EV_ADVERTISING_ADDED, hdev, &ev, sizeof(ev), sk); 1288 } 1289 1290 void mgmt_advertising_removed(struct sock *sk, struct hci_dev *hdev, 1291 u8 instance) 1292 { 1293 struct mgmt_ev_advertising_removed ev; 1294 1295 ev.instance = instance; 1296 1297 mgmt_event(MGMT_EV_ADVERTISING_REMOVED, hdev, &ev, sizeof(ev), sk); 1298 } 1299 1300 static void cancel_adv_timeout(struct hci_dev *hdev) 1301 { 1302 if (hdev->adv_instance_timeout) { 1303 hdev->adv_instance_timeout = 0; 1304 cancel_delayed_work(&hdev->adv_instance_expire); 1305 } 1306 } 1307 1308 /* This function requires the caller holds hdev->lock */ 1309 static void restart_le_actions(struct hci_dev *hdev) 1310 { 1311 struct hci_conn_params *p; 1312 1313 list_for_each_entry(p, &hdev->le_conn_params, list) { 1314 /* Needed for AUTO_OFF case where might not "really" 1315 * have been powered off. 1316 */ 1317 hci_pend_le_list_del_init(p); 1318 1319 switch (p->auto_connect) { 1320 case HCI_AUTO_CONN_DIRECT: 1321 case HCI_AUTO_CONN_ALWAYS: 1322 hci_pend_le_list_add(p, &hdev->pend_le_conns); 1323 break; 1324 case HCI_AUTO_CONN_REPORT: 1325 hci_pend_le_list_add(p, &hdev->pend_le_reports); 1326 break; 1327 default: 1328 break; 1329 } 1330 } 1331 } 1332 1333 static int new_settings(struct hci_dev *hdev, struct sock *skip) 1334 { 1335 __le32 ev = cpu_to_le32(get_current_settings(hdev)); 1336 1337 return mgmt_limited_event(MGMT_EV_NEW_SETTINGS, hdev, &ev, 1338 sizeof(ev), HCI_MGMT_SETTING_EVENTS, skip); 1339 } 1340 1341 static void mgmt_set_powered_complete(struct hci_dev *hdev, void *data, int err) 1342 { 1343 struct mgmt_pending_cmd *cmd = data; 1344 struct mgmt_mode *cp; 1345 1346 /* Make sure cmd still outstanding. */ 1347 if (err == -ECANCELED || !mgmt_pending_valid(hdev, cmd)) 1348 return; 1349 1350 cp = cmd->param; 1351 1352 bt_dev_dbg(hdev, "err %d", err); 1353 1354 if (!err) { 1355 if (cp->val) { 1356 hci_dev_lock(hdev); 1357 restart_le_actions(hdev); 1358 hci_update_passive_scan(hdev); 1359 hci_dev_unlock(hdev); 1360 } 1361 1362 send_settings_rsp(cmd->sk, cmd->opcode, hdev); 1363 1364 /* Only call new_setting for power on as power off is deferred 1365 * to hdev->power_off work which does call hci_dev_do_close. 1366 */ 1367 if (cp->val) 1368 new_settings(hdev, cmd->sk); 1369 } else { 1370 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_POWERED, 1371 mgmt_status(err)); 1372 } 1373 1374 mgmt_pending_free(cmd); 1375 } 1376 1377 static int set_powered_sync(struct hci_dev *hdev, void *data) 1378 { 1379 struct mgmt_pending_cmd *cmd = data; 1380 struct mgmt_mode cp; 1381 1382 mutex_lock(&hdev->mgmt_pending_lock); 1383 1384 /* Make sure cmd still outstanding. */ 1385 if (!__mgmt_pending_listed(hdev, cmd)) { 1386 mutex_unlock(&hdev->mgmt_pending_lock); 1387 return -ECANCELED; 1388 } 1389 1390 memcpy(&cp, cmd->param, sizeof(cp)); 1391 1392 mutex_unlock(&hdev->mgmt_pending_lock); 1393 1394 BT_DBG("%s", hdev->name); 1395 1396 return hci_set_powered_sync(hdev, cp.val); 1397 } 1398 1399 static int set_powered(struct sock *sk, struct hci_dev *hdev, void *data, 1400 u16 len) 1401 { 1402 struct mgmt_mode *cp = data; 1403 struct mgmt_pending_cmd *cmd; 1404 int err; 1405 1406 bt_dev_dbg(hdev, "sock %p", sk); 1407 1408 if (cp->val != 0x00 && cp->val != 0x01) 1409 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED, 1410 MGMT_STATUS_INVALID_PARAMS); 1411 1412 hci_dev_lock(hdev); 1413 1414 if (!cp->val) { 1415 if (hci_dev_test_flag(hdev, HCI_POWERING_DOWN)) { 1416 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED, 1417 MGMT_STATUS_BUSY); 1418 goto failed; 1419 } 1420 } 1421 1422 if (pending_find(MGMT_OP_SET_POWERED, hdev)) { 1423 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED, 1424 MGMT_STATUS_BUSY); 1425 goto failed; 1426 } 1427 1428 if (!!cp->val == hdev_is_powered(hdev)) { 1429 err = send_settings_rsp(sk, MGMT_OP_SET_POWERED, hdev); 1430 goto failed; 1431 } 1432 1433 cmd = mgmt_pending_add(sk, MGMT_OP_SET_POWERED, hdev, data, len); 1434 if (!cmd) { 1435 err = -ENOMEM; 1436 goto failed; 1437 } 1438 1439 /* Cancel potentially blocking sync operation before power off */ 1440 if (cp->val == 0x00) { 1441 hci_cmd_sync_cancel_sync(hdev, -EHOSTDOWN); 1442 err = hci_cmd_sync_queue(hdev, set_powered_sync, cmd, 1443 mgmt_set_powered_complete); 1444 } else { 1445 /* Use hci_cmd_sync_submit since hdev might not be running */ 1446 err = hci_cmd_sync_submit(hdev, set_powered_sync, cmd, 1447 mgmt_set_powered_complete); 1448 } 1449 1450 if (err < 0) 1451 mgmt_pending_remove(cmd); 1452 1453 failed: 1454 hci_dev_unlock(hdev); 1455 return err; 1456 } 1457 1458 int mgmt_new_settings(struct hci_dev *hdev) 1459 { 1460 return new_settings(hdev, NULL); 1461 } 1462 1463 struct cmd_lookup { 1464 struct sock *sk; 1465 struct hci_dev *hdev; 1466 u8 mgmt_status; 1467 }; 1468 1469 static void settings_rsp(struct mgmt_pending_cmd *cmd, void *data) 1470 { 1471 struct cmd_lookup *match = data; 1472 1473 send_settings_rsp(cmd->sk, cmd->opcode, match->hdev); 1474 1475 if (match->sk == NULL) { 1476 match->sk = cmd->sk; 1477 sock_hold(match->sk); 1478 } 1479 } 1480 1481 static void cmd_status_rsp(struct mgmt_pending_cmd *cmd, void *data) 1482 { 1483 u8 *status = data; 1484 1485 mgmt_cmd_status(cmd->sk, cmd->hdev->id, cmd->opcode, *status); 1486 } 1487 1488 static void cmd_complete_rsp(struct mgmt_pending_cmd *cmd, void *data) 1489 { 1490 struct cmd_lookup *match = data; 1491 1492 /* dequeue cmd_sync entries using cmd as data as that is about to be 1493 * removed/freed. 1494 */ 1495 hci_cmd_sync_dequeue(match->hdev, NULL, cmd, NULL); 1496 1497 if (cmd->cmd_complete) { 1498 cmd->cmd_complete(cmd, match->mgmt_status); 1499 return; 1500 } 1501 1502 cmd_status_rsp(cmd, data); 1503 } 1504 1505 static int generic_cmd_complete(struct mgmt_pending_cmd *cmd, u8 status) 1506 { 1507 return mgmt_cmd_complete(cmd->sk, cmd->hdev->id, cmd->opcode, status, 1508 cmd->param, cmd->param_len); 1509 } 1510 1511 static int addr_cmd_complete(struct mgmt_pending_cmd *cmd, u8 status) 1512 { 1513 return mgmt_cmd_complete(cmd->sk, cmd->hdev->id, cmd->opcode, status, 1514 cmd->param, sizeof(struct mgmt_addr_info)); 1515 } 1516 1517 static u8 mgmt_bredr_support(struct hci_dev *hdev) 1518 { 1519 if (!lmp_bredr_capable(hdev)) 1520 return MGMT_STATUS_NOT_SUPPORTED; 1521 else if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) 1522 return MGMT_STATUS_REJECTED; 1523 else 1524 return MGMT_STATUS_SUCCESS; 1525 } 1526 1527 static u8 mgmt_le_support(struct hci_dev *hdev) 1528 { 1529 if (!lmp_le_capable(hdev)) 1530 return MGMT_STATUS_NOT_SUPPORTED; 1531 else if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED)) 1532 return MGMT_STATUS_REJECTED; 1533 else 1534 return MGMT_STATUS_SUCCESS; 1535 } 1536 1537 static void mgmt_set_discoverable_complete(struct hci_dev *hdev, void *data, 1538 int err) 1539 { 1540 struct mgmt_pending_cmd *cmd = data; 1541 1542 bt_dev_dbg(hdev, "err %d", err); 1543 1544 /* Make sure cmd still outstanding. */ 1545 if (err == -ECANCELED || !mgmt_pending_valid(hdev, cmd)) 1546 return; 1547 1548 hci_dev_lock(hdev); 1549 1550 if (err) { 1551 u8 mgmt_err = mgmt_status(err); 1552 mgmt_cmd_status(cmd->sk, cmd->hdev->id, cmd->opcode, mgmt_err); 1553 hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE); 1554 goto done; 1555 } 1556 1557 if (hci_dev_test_flag(hdev, HCI_DISCOVERABLE) && 1558 hdev->discov_timeout > 0) { 1559 int to = secs_to_jiffies(hdev->discov_timeout); 1560 queue_delayed_work(hdev->req_workqueue, &hdev->discov_off, to); 1561 } 1562 1563 send_settings_rsp(cmd->sk, MGMT_OP_SET_DISCOVERABLE, hdev); 1564 new_settings(hdev, cmd->sk); 1565 1566 done: 1567 mgmt_pending_free(cmd); 1568 hci_dev_unlock(hdev); 1569 } 1570 1571 static int set_discoverable_sync(struct hci_dev *hdev, void *data) 1572 { 1573 if (!mgmt_pending_listed(hdev, data)) 1574 return -ECANCELED; 1575 1576 BT_DBG("%s", hdev->name); 1577 1578 return hci_update_discoverable_sync(hdev); 1579 } 1580 1581 static int set_discoverable(struct sock *sk, struct hci_dev *hdev, void *data, 1582 u16 len) 1583 { 1584 struct mgmt_cp_set_discoverable *cp = data; 1585 struct mgmt_pending_cmd *cmd; 1586 u16 timeout; 1587 int err; 1588 1589 bt_dev_dbg(hdev, "sock %p", sk); 1590 1591 if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED) && 1592 !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) 1593 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE, 1594 MGMT_STATUS_REJECTED); 1595 1596 if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02) 1597 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE, 1598 MGMT_STATUS_INVALID_PARAMS); 1599 1600 timeout = __le16_to_cpu(cp->timeout); 1601 1602 /* Disabling discoverable requires that no timeout is set, 1603 * and enabling limited discoverable requires a timeout. 1604 */ 1605 if ((cp->val == 0x00 && timeout > 0) || 1606 (cp->val == 0x02 && timeout == 0)) 1607 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE, 1608 MGMT_STATUS_INVALID_PARAMS); 1609 1610 hci_dev_lock(hdev); 1611 1612 if (!hdev_is_powered(hdev) && timeout > 0) { 1613 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE, 1614 MGMT_STATUS_NOT_POWERED); 1615 goto failed; 1616 } 1617 1618 if (pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) || 1619 pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) { 1620 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE, 1621 MGMT_STATUS_BUSY); 1622 goto failed; 1623 } 1624 1625 if (!hci_dev_test_flag(hdev, HCI_CONNECTABLE)) { 1626 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE, 1627 MGMT_STATUS_REJECTED); 1628 goto failed; 1629 } 1630 1631 if (hdev->advertising_paused) { 1632 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE, 1633 MGMT_STATUS_BUSY); 1634 goto failed; 1635 } 1636 1637 if (!hdev_is_powered(hdev)) { 1638 bool changed = false; 1639 1640 /* Setting limited discoverable when powered off is 1641 * not a valid operation since it requires a timeout 1642 * and so no need to check HCI_LIMITED_DISCOVERABLE. 1643 */ 1644 if (!!cp->val != hci_dev_test_flag(hdev, HCI_DISCOVERABLE)) { 1645 hci_dev_change_flag(hdev, HCI_DISCOVERABLE); 1646 changed = true; 1647 } 1648 1649 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev); 1650 if (err < 0) 1651 goto failed; 1652 1653 if (changed) 1654 err = new_settings(hdev, sk); 1655 1656 goto failed; 1657 } 1658 1659 /* If the current mode is the same, then just update the timeout 1660 * value with the new value. And if only the timeout gets updated, 1661 * then no need for any HCI transactions. 1662 */ 1663 if (!!cp->val == hci_dev_test_flag(hdev, HCI_DISCOVERABLE) && 1664 (cp->val == 0x02) == hci_dev_test_flag(hdev, 1665 HCI_LIMITED_DISCOVERABLE)) { 1666 cancel_delayed_work(&hdev->discov_off); 1667 hdev->discov_timeout = timeout; 1668 1669 if (cp->val && hdev->discov_timeout > 0) { 1670 int to = secs_to_jiffies(hdev->discov_timeout); 1671 queue_delayed_work(hdev->req_workqueue, 1672 &hdev->discov_off, to); 1673 } 1674 1675 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev); 1676 goto failed; 1677 } 1678 1679 cmd = mgmt_pending_add(sk, MGMT_OP_SET_DISCOVERABLE, hdev, data, len); 1680 if (!cmd) { 1681 err = -ENOMEM; 1682 goto failed; 1683 } 1684 1685 /* Cancel any potential discoverable timeout that might be 1686 * still active and store new timeout value. The arming of 1687 * the timeout happens in the complete handler. 1688 */ 1689 cancel_delayed_work(&hdev->discov_off); 1690 hdev->discov_timeout = timeout; 1691 1692 if (cp->val) 1693 hci_dev_set_flag(hdev, HCI_DISCOVERABLE); 1694 else 1695 hci_dev_clear_flag(hdev, HCI_DISCOVERABLE); 1696 1697 /* Limited discoverable mode */ 1698 if (cp->val == 0x02) 1699 hci_dev_set_flag(hdev, HCI_LIMITED_DISCOVERABLE); 1700 else 1701 hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE); 1702 1703 err = hci_cmd_sync_queue(hdev, set_discoverable_sync, cmd, 1704 mgmt_set_discoverable_complete); 1705 1706 if (err < 0) 1707 mgmt_pending_remove(cmd); 1708 1709 failed: 1710 hci_dev_unlock(hdev); 1711 return err; 1712 } 1713 1714 static void mgmt_set_connectable_complete(struct hci_dev *hdev, void *data, 1715 int err) 1716 { 1717 struct mgmt_pending_cmd *cmd = data; 1718 1719 bt_dev_dbg(hdev, "err %d", err); 1720 1721 /* Make sure cmd still outstanding. */ 1722 if (err == -ECANCELED || !mgmt_pending_valid(hdev, cmd)) 1723 return; 1724 1725 hci_dev_lock(hdev); 1726 1727 if (err) { 1728 u8 mgmt_err = mgmt_status(err); 1729 mgmt_cmd_status(cmd->sk, cmd->hdev->id, cmd->opcode, mgmt_err); 1730 goto done; 1731 } 1732 1733 send_settings_rsp(cmd->sk, MGMT_OP_SET_CONNECTABLE, hdev); 1734 new_settings(hdev, cmd->sk); 1735 1736 done: 1737 mgmt_pending_free(cmd); 1738 1739 hci_dev_unlock(hdev); 1740 } 1741 1742 static int set_connectable_update_settings(struct hci_dev *hdev, 1743 struct sock *sk, u8 val) 1744 { 1745 bool changed = false; 1746 int err; 1747 1748 if (!!val != hci_dev_test_flag(hdev, HCI_CONNECTABLE)) 1749 changed = true; 1750 1751 if (val) { 1752 hci_dev_set_flag(hdev, HCI_CONNECTABLE); 1753 } else { 1754 hci_dev_clear_flag(hdev, HCI_CONNECTABLE); 1755 hci_dev_clear_flag(hdev, HCI_DISCOVERABLE); 1756 } 1757 1758 err = send_settings_rsp(sk, MGMT_OP_SET_CONNECTABLE, hdev); 1759 if (err < 0) 1760 return err; 1761 1762 if (changed) { 1763 hci_update_scan(hdev); 1764 hci_update_passive_scan(hdev); 1765 return new_settings(hdev, sk); 1766 } 1767 1768 return 0; 1769 } 1770 1771 static int set_connectable_sync(struct hci_dev *hdev, void *data) 1772 { 1773 if (!mgmt_pending_listed(hdev, data)) 1774 return -ECANCELED; 1775 1776 BT_DBG("%s", hdev->name); 1777 1778 return hci_update_connectable_sync(hdev); 1779 } 1780 1781 static int set_connectable(struct sock *sk, struct hci_dev *hdev, void *data, 1782 u16 len) 1783 { 1784 struct mgmt_mode *cp = data; 1785 struct mgmt_pending_cmd *cmd; 1786 int err; 1787 1788 bt_dev_dbg(hdev, "sock %p", sk); 1789 1790 if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED) && 1791 !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) 1792 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE, 1793 MGMT_STATUS_REJECTED); 1794 1795 if (cp->val != 0x00 && cp->val != 0x01) 1796 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE, 1797 MGMT_STATUS_INVALID_PARAMS); 1798 1799 hci_dev_lock(hdev); 1800 1801 if (!hdev_is_powered(hdev)) { 1802 err = set_connectable_update_settings(hdev, sk, cp->val); 1803 goto failed; 1804 } 1805 1806 if (pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) || 1807 pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) { 1808 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE, 1809 MGMT_STATUS_BUSY); 1810 goto failed; 1811 } 1812 1813 cmd = mgmt_pending_add(sk, MGMT_OP_SET_CONNECTABLE, hdev, data, len); 1814 if (!cmd) { 1815 err = -ENOMEM; 1816 goto failed; 1817 } 1818 1819 if (cp->val) { 1820 hci_dev_set_flag(hdev, HCI_CONNECTABLE); 1821 } else { 1822 if (hdev->discov_timeout > 0) 1823 cancel_delayed_work(&hdev->discov_off); 1824 1825 hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE); 1826 hci_dev_clear_flag(hdev, HCI_DISCOVERABLE); 1827 hci_dev_clear_flag(hdev, HCI_CONNECTABLE); 1828 } 1829 1830 err = hci_cmd_sync_queue(hdev, set_connectable_sync, cmd, 1831 mgmt_set_connectable_complete); 1832 1833 if (err < 0) 1834 mgmt_pending_remove(cmd); 1835 1836 failed: 1837 hci_dev_unlock(hdev); 1838 return err; 1839 } 1840 1841 static int set_bondable(struct sock *sk, struct hci_dev *hdev, void *data, 1842 u16 len) 1843 { 1844 struct mgmt_mode *cp = data; 1845 bool changed; 1846 int err; 1847 1848 bt_dev_dbg(hdev, "sock %p", sk); 1849 1850 if (cp->val != 0x00 && cp->val != 0x01) 1851 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BONDABLE, 1852 MGMT_STATUS_INVALID_PARAMS); 1853 1854 hci_dev_lock(hdev); 1855 1856 if (cp->val) 1857 changed = !hci_dev_test_and_set_flag(hdev, HCI_BONDABLE); 1858 else 1859 changed = hci_dev_test_and_clear_flag(hdev, HCI_BONDABLE); 1860 1861 err = send_settings_rsp(sk, MGMT_OP_SET_BONDABLE, hdev); 1862 if (err < 0) 1863 goto unlock; 1864 1865 if (changed) { 1866 /* In limited privacy mode the change of bondable mode 1867 * may affect the local advertising address. 1868 */ 1869 hci_update_discoverable(hdev); 1870 1871 err = new_settings(hdev, sk); 1872 } 1873 1874 unlock: 1875 hci_dev_unlock(hdev); 1876 return err; 1877 } 1878 1879 static int set_link_security(struct sock *sk, struct hci_dev *hdev, void *data, 1880 u16 len) 1881 { 1882 struct mgmt_mode *cp = data; 1883 struct mgmt_pending_cmd *cmd; 1884 u8 val, status; 1885 int err; 1886 1887 bt_dev_dbg(hdev, "sock %p", sk); 1888 1889 status = mgmt_bredr_support(hdev); 1890 if (status) 1891 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY, 1892 status); 1893 1894 if (cp->val != 0x00 && cp->val != 0x01) 1895 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY, 1896 MGMT_STATUS_INVALID_PARAMS); 1897 1898 hci_dev_lock(hdev); 1899 1900 if (!hdev_is_powered(hdev)) { 1901 bool changed = false; 1902 1903 if (!!cp->val != hci_dev_test_flag(hdev, HCI_LINK_SECURITY)) { 1904 hci_dev_change_flag(hdev, HCI_LINK_SECURITY); 1905 changed = true; 1906 } 1907 1908 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev); 1909 if (err < 0) 1910 goto failed; 1911 1912 if (changed) 1913 err = new_settings(hdev, sk); 1914 1915 goto failed; 1916 } 1917 1918 if (pending_find(MGMT_OP_SET_LINK_SECURITY, hdev)) { 1919 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY, 1920 MGMT_STATUS_BUSY); 1921 goto failed; 1922 } 1923 1924 val = !!cp->val; 1925 1926 if (test_bit(HCI_AUTH, &hdev->flags) == val) { 1927 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev); 1928 goto failed; 1929 } 1930 1931 cmd = mgmt_pending_add(sk, MGMT_OP_SET_LINK_SECURITY, hdev, data, len); 1932 if (!cmd) { 1933 err = -ENOMEM; 1934 goto failed; 1935 } 1936 1937 err = hci_send_cmd(hdev, HCI_OP_WRITE_AUTH_ENABLE, sizeof(val), &val); 1938 if (err < 0) { 1939 mgmt_pending_remove(cmd); 1940 goto failed; 1941 } 1942 1943 failed: 1944 hci_dev_unlock(hdev); 1945 return err; 1946 } 1947 1948 static void set_ssp_complete(struct hci_dev *hdev, void *data, int err) 1949 { 1950 struct cmd_lookup match = { NULL, hdev }; 1951 struct mgmt_pending_cmd *cmd = data; 1952 struct mgmt_mode *cp; 1953 u8 enable; 1954 bool changed; 1955 1956 /* Make sure cmd still outstanding. */ 1957 if (err == -ECANCELED || !mgmt_pending_valid(hdev, cmd)) 1958 return; 1959 1960 cp = cmd->param; 1961 enable = cp->val; 1962 1963 if (err) { 1964 u8 mgmt_err = mgmt_status(err); 1965 1966 if (enable && hci_dev_test_and_clear_flag(hdev, 1967 HCI_SSP_ENABLED)) { 1968 new_settings(hdev, NULL); 1969 } 1970 1971 mgmt_cmd_status(cmd->sk, cmd->hdev->id, cmd->opcode, mgmt_err); 1972 mgmt_pending_free(cmd); 1973 return; 1974 } 1975 1976 if (enable) { 1977 changed = !hci_dev_test_and_set_flag(hdev, HCI_SSP_ENABLED); 1978 } else { 1979 changed = hci_dev_test_and_clear_flag(hdev, HCI_SSP_ENABLED); 1980 } 1981 1982 settings_rsp(cmd, &match); 1983 1984 if (changed) 1985 new_settings(hdev, match.sk); 1986 1987 if (match.sk) 1988 sock_put(match.sk); 1989 1990 hci_update_eir_sync(hdev); 1991 mgmt_pending_free(cmd); 1992 } 1993 1994 static int set_ssp_sync(struct hci_dev *hdev, void *data) 1995 { 1996 struct mgmt_pending_cmd *cmd = data; 1997 struct mgmt_mode cp; 1998 bool changed = false; 1999 int err; 2000 2001 mutex_lock(&hdev->mgmt_pending_lock); 2002 2003 if (!__mgmt_pending_listed(hdev, cmd)) { 2004 mutex_unlock(&hdev->mgmt_pending_lock); 2005 return -ECANCELED; 2006 } 2007 2008 memcpy(&cp, cmd->param, sizeof(cp)); 2009 2010 mutex_unlock(&hdev->mgmt_pending_lock); 2011 2012 if (cp.val) 2013 changed = !hci_dev_test_and_set_flag(hdev, HCI_SSP_ENABLED); 2014 2015 err = hci_write_ssp_mode_sync(hdev, cp.val); 2016 2017 if (!err && changed) 2018 hci_dev_clear_flag(hdev, HCI_SSP_ENABLED); 2019 2020 return err; 2021 } 2022 2023 static int set_ssp(struct sock *sk, struct hci_dev *hdev, void *data, u16 len) 2024 { 2025 struct mgmt_mode *cp = data; 2026 struct mgmt_pending_cmd *cmd; 2027 u8 status; 2028 int err; 2029 2030 bt_dev_dbg(hdev, "sock %p", sk); 2031 2032 status = mgmt_bredr_support(hdev); 2033 if (status) 2034 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP, status); 2035 2036 if (!lmp_ssp_capable(hdev)) 2037 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP, 2038 MGMT_STATUS_NOT_SUPPORTED); 2039 2040 if (cp->val != 0x00 && cp->val != 0x01) 2041 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP, 2042 MGMT_STATUS_INVALID_PARAMS); 2043 2044 hci_dev_lock(hdev); 2045 2046 if (!hdev_is_powered(hdev)) { 2047 bool changed; 2048 2049 if (cp->val) { 2050 changed = !hci_dev_test_and_set_flag(hdev, 2051 HCI_SSP_ENABLED); 2052 } else { 2053 changed = hci_dev_test_and_clear_flag(hdev, 2054 HCI_SSP_ENABLED); 2055 } 2056 2057 err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev); 2058 if (err < 0) 2059 goto failed; 2060 2061 if (changed) 2062 err = new_settings(hdev, sk); 2063 2064 goto failed; 2065 } 2066 2067 if (pending_find(MGMT_OP_SET_SSP, hdev)) { 2068 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP, 2069 MGMT_STATUS_BUSY); 2070 goto failed; 2071 } 2072 2073 if (!!cp->val == hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) { 2074 err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev); 2075 goto failed; 2076 } 2077 2078 cmd = mgmt_pending_add(sk, MGMT_OP_SET_SSP, hdev, data, len); 2079 if (!cmd) 2080 err = -ENOMEM; 2081 else 2082 err = hci_cmd_sync_queue(hdev, set_ssp_sync, cmd, 2083 set_ssp_complete); 2084 2085 if (err < 0) { 2086 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP, 2087 MGMT_STATUS_FAILED); 2088 2089 if (cmd) 2090 mgmt_pending_remove(cmd); 2091 } 2092 2093 failed: 2094 hci_dev_unlock(hdev); 2095 return err; 2096 } 2097 2098 static int set_hs(struct sock *sk, struct hci_dev *hdev, void *data, u16 len) 2099 { 2100 bt_dev_dbg(hdev, "sock %p", sk); 2101 2102 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS, 2103 MGMT_STATUS_NOT_SUPPORTED); 2104 } 2105 2106 static void set_le_complete(struct hci_dev *hdev, void *data, int err) 2107 { 2108 struct mgmt_pending_cmd *cmd = data; 2109 struct cmd_lookup match = { NULL, hdev }; 2110 u8 status = mgmt_status(err); 2111 2112 bt_dev_dbg(hdev, "err %d", err); 2113 2114 if (err == -ECANCELED || !mgmt_pending_valid(hdev, data)) 2115 return; 2116 2117 if (status) { 2118 mgmt_cmd_status(cmd->sk, cmd->hdev->id, cmd->opcode, status); 2119 goto done; 2120 } 2121 2122 settings_rsp(cmd, &match); 2123 2124 new_settings(hdev, match.sk); 2125 2126 if (match.sk) 2127 sock_put(match.sk); 2128 2129 done: 2130 mgmt_pending_free(cmd); 2131 } 2132 2133 static int set_le_sync(struct hci_dev *hdev, void *data) 2134 { 2135 struct mgmt_pending_cmd *cmd = data; 2136 struct mgmt_mode cp; 2137 u8 val; 2138 int err; 2139 2140 mutex_lock(&hdev->mgmt_pending_lock); 2141 2142 if (!__mgmt_pending_listed(hdev, cmd)) { 2143 mutex_unlock(&hdev->mgmt_pending_lock); 2144 return -ECANCELED; 2145 } 2146 2147 memcpy(&cp, cmd->param, sizeof(cp)); 2148 val = !!cp.val; 2149 2150 mutex_unlock(&hdev->mgmt_pending_lock); 2151 2152 if (!val) { 2153 hci_clear_adv_instance_sync(hdev, NULL, 0x00, true); 2154 2155 if (hci_dev_test_flag(hdev, HCI_LE_ADV)) 2156 hci_disable_advertising_sync(hdev); 2157 2158 if (ext_adv_capable(hdev)) 2159 hci_remove_ext_adv_instance_sync(hdev, 0, cmd->sk); 2160 } else { 2161 hci_dev_set_flag(hdev, HCI_LE_ENABLED); 2162 } 2163 2164 err = hci_write_le_host_supported_sync(hdev, val, 0); 2165 2166 /* Make sure the controller has a good default for 2167 * advertising data. Restrict the update to when LE 2168 * has actually been enabled. During power on, the 2169 * update in powered_update_hci will take care of it. 2170 */ 2171 if (!err && hci_dev_test_flag(hdev, HCI_LE_ENABLED)) { 2172 if (ext_adv_capable(hdev)) { 2173 int status; 2174 2175 status = hci_setup_ext_adv_instance_sync(hdev, 0x00); 2176 if (!status) 2177 hci_update_scan_rsp_data_sync(hdev, 0x00); 2178 } else { 2179 hci_update_adv_data_sync(hdev, 0x00); 2180 hci_update_scan_rsp_data_sync(hdev, 0x00); 2181 } 2182 2183 hci_update_passive_scan(hdev); 2184 } 2185 2186 return err; 2187 } 2188 2189 static void set_mesh_complete(struct hci_dev *hdev, void *data, int err) 2190 { 2191 struct mgmt_pending_cmd *cmd = data; 2192 u8 status = mgmt_status(err); 2193 struct sock *sk; 2194 2195 if (err == -ECANCELED || !mgmt_pending_valid(hdev, cmd)) 2196 return; 2197 2198 sk = cmd->sk; 2199 2200 if (status) { 2201 mgmt_cmd_status(cmd->sk, hdev->id, cmd->opcode, status); 2202 goto done; 2203 } 2204 2205 mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_MESH_RECEIVER, 0, NULL, 0); 2206 2207 done: 2208 mgmt_pending_free(cmd); 2209 } 2210 2211 static int set_mesh_sync(struct hci_dev *hdev, void *data) 2212 { 2213 struct mgmt_pending_cmd *cmd = data; 2214 DEFINE_FLEX(struct mgmt_cp_set_mesh, cp, ad_types, num_ad_types, 2215 sizeof(hdev->mesh_ad_types)); 2216 size_t len; 2217 2218 mutex_lock(&hdev->mgmt_pending_lock); 2219 2220 if (!__mgmt_pending_listed(hdev, cmd)) { 2221 mutex_unlock(&hdev->mgmt_pending_lock); 2222 return -ECANCELED; 2223 } 2224 2225 len = cmd->param_len; 2226 memcpy(cp, cmd->param, min(__struct_size(cp), len)); 2227 2228 mutex_unlock(&hdev->mgmt_pending_lock); 2229 2230 memset(hdev->mesh_ad_types, 0, sizeof(hdev->mesh_ad_types)); 2231 2232 if (cp->enable) 2233 hci_dev_set_flag(hdev, HCI_MESH); 2234 else 2235 hci_dev_clear_flag(hdev, HCI_MESH); 2236 2237 hdev->le_scan_interval = __le16_to_cpu(cp->period); 2238 hdev->le_scan_window = __le16_to_cpu(cp->window); 2239 2240 len -= sizeof(struct mgmt_cp_set_mesh); 2241 2242 /* If filters don't fit, forward all adv pkts */ 2243 if (len <= sizeof(hdev->mesh_ad_types)) 2244 memcpy(hdev->mesh_ad_types, cp->ad_types, len); 2245 2246 hci_update_passive_scan_sync(hdev); 2247 return 0; 2248 } 2249 2250 static int set_mesh(struct sock *sk, struct hci_dev *hdev, void *data, u16 len) 2251 { 2252 struct mgmt_cp_set_mesh *cp = data; 2253 struct mgmt_pending_cmd *cmd; 2254 __u16 period, window; 2255 int err = 0; 2256 2257 bt_dev_dbg(hdev, "sock %p", sk); 2258 2259 if (!lmp_le_capable(hdev) || 2260 !hci_dev_test_flag(hdev, HCI_MESH_EXPERIMENTAL)) 2261 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_MESH_RECEIVER, 2262 MGMT_STATUS_NOT_SUPPORTED); 2263 2264 if (cp->enable != 0x00 && cp->enable != 0x01) 2265 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_MESH_RECEIVER, 2266 MGMT_STATUS_INVALID_PARAMS); 2267 2268 /* Keep allowed ranges in sync with set_scan_params() */ 2269 period = __le16_to_cpu(cp->period); 2270 2271 if (period < 0x0004 || period > 0x4000) 2272 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_MESH_RECEIVER, 2273 MGMT_STATUS_INVALID_PARAMS); 2274 2275 window = __le16_to_cpu(cp->window); 2276 2277 if (window < 0x0004 || window > 0x4000) 2278 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_MESH_RECEIVER, 2279 MGMT_STATUS_INVALID_PARAMS); 2280 2281 if (window > period) 2282 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_MESH_RECEIVER, 2283 MGMT_STATUS_INVALID_PARAMS); 2284 2285 hci_dev_lock(hdev); 2286 2287 cmd = mgmt_pending_add(sk, MGMT_OP_SET_MESH_RECEIVER, hdev, data, len); 2288 if (!cmd) 2289 err = -ENOMEM; 2290 else 2291 err = hci_cmd_sync_queue(hdev, set_mesh_sync, cmd, 2292 set_mesh_complete); 2293 2294 if (err < 0) { 2295 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_MESH_RECEIVER, 2296 MGMT_STATUS_FAILED); 2297 2298 if (cmd) 2299 mgmt_pending_remove(cmd); 2300 } 2301 2302 hci_dev_unlock(hdev); 2303 return err; 2304 } 2305 2306 static void mesh_send_start_complete(struct hci_dev *hdev, void *data, int err) 2307 { 2308 struct mgmt_mesh_tx *mesh_tx = data; 2309 struct mgmt_cp_mesh_send *send = (void *)mesh_tx->param; 2310 unsigned long mesh_send_interval; 2311 u8 mgmt_err = mgmt_status(err); 2312 2313 /* Report any errors here, but don't report completion */ 2314 2315 if (mgmt_err) { 2316 hci_dev_clear_flag(hdev, HCI_MESH_SENDING); 2317 /* Send Complete Error Code for handle */ 2318 mesh_send_complete(hdev, mesh_tx, false); 2319 return; 2320 } 2321 2322 mesh_send_interval = msecs_to_jiffies((send->cnt) * 25); 2323 queue_delayed_work(hdev->req_workqueue, &hdev->mesh_send_done, 2324 mesh_send_interval); 2325 } 2326 2327 static int mesh_send_sync(struct hci_dev *hdev, void *data) 2328 { 2329 struct mgmt_mesh_tx *mesh_tx = data; 2330 struct mgmt_cp_mesh_send *send = (void *)mesh_tx->param; 2331 struct adv_info *adv, *next_instance; 2332 u8 instance = hdev->le_num_of_adv_sets + 1; 2333 u16 timeout, duration; 2334 int err = 0; 2335 2336 if (hdev->le_num_of_adv_sets <= hdev->adv_instance_cnt) 2337 return MGMT_STATUS_BUSY; 2338 2339 timeout = 1000; 2340 duration = send->cnt * INTERVAL_TO_MS(hdev->le_adv_max_interval); 2341 adv = hci_add_adv_instance(hdev, instance, 0, 2342 send->adv_data_len, send->adv_data, 2343 0, NULL, 2344 timeout, duration, 2345 HCI_ADV_TX_POWER_NO_PREFERENCE, 2346 hdev->le_adv_min_interval, 2347 hdev->le_adv_max_interval, 2348 mesh_tx->handle); 2349 2350 if (!IS_ERR(adv)) 2351 mesh_tx->instance = instance; 2352 else 2353 err = PTR_ERR(adv); 2354 2355 if (hdev->cur_adv_instance == instance) { 2356 /* If the currently advertised instance is being changed then 2357 * cancel the current advertising and schedule the next 2358 * instance. If there is only one instance then the overridden 2359 * advertising data will be visible right away. 2360 */ 2361 cancel_adv_timeout(hdev); 2362 2363 next_instance = hci_get_next_instance(hdev, instance); 2364 if (next_instance) 2365 instance = next_instance->instance; 2366 else 2367 instance = 0; 2368 } else if (hdev->adv_instance_timeout) { 2369 /* Immediately advertise the new instance if no other, or 2370 * let it go naturally from queue if ADV is already happening 2371 */ 2372 instance = 0; 2373 } 2374 2375 if (instance) 2376 return hci_schedule_adv_instance_sync(hdev, instance, true); 2377 2378 return err; 2379 } 2380 2381 static void send_count(struct mgmt_mesh_tx *mesh_tx, void *data) 2382 { 2383 struct mgmt_rp_mesh_read_features *rp = data; 2384 2385 if (rp->used_handles >= rp->max_handles) 2386 return; 2387 2388 rp->handles[rp->used_handles++] = mesh_tx->handle; 2389 } 2390 2391 static int mesh_features(struct sock *sk, struct hci_dev *hdev, 2392 void *data, u16 len) 2393 { 2394 struct mgmt_rp_mesh_read_features rp; 2395 2396 if (!lmp_le_capable(hdev) || 2397 !hci_dev_test_flag(hdev, HCI_MESH_EXPERIMENTAL)) 2398 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_MESH_READ_FEATURES, 2399 MGMT_STATUS_NOT_SUPPORTED); 2400 2401 memset(&rp, 0, sizeof(rp)); 2402 rp.index = cpu_to_le16(hdev->id); 2403 if (hci_dev_test_flag(hdev, HCI_LE_ENABLED)) 2404 rp.max_handles = MESH_HANDLES_MAX; 2405 2406 hci_dev_lock(hdev); 2407 2408 if (rp.max_handles) 2409 mgmt_mesh_foreach(hdev, send_count, &rp, sk); 2410 2411 mgmt_cmd_complete(sk, hdev->id, MGMT_OP_MESH_READ_FEATURES, 0, &rp, 2412 rp.used_handles + sizeof(rp) - MESH_HANDLES_MAX); 2413 2414 hci_dev_unlock(hdev); 2415 return 0; 2416 } 2417 2418 static int send_cancel(struct hci_dev *hdev, void *data) 2419 { 2420 struct mgmt_pending_cmd *cmd = data; 2421 struct mgmt_cp_mesh_send_cancel *cancel = (void *)cmd->param; 2422 struct mgmt_mesh_tx *mesh_tx; 2423 2424 if (!cancel->handle) { 2425 do { 2426 mesh_tx = mgmt_mesh_next(hdev, cmd->sk); 2427 2428 if (mesh_tx) 2429 mesh_send_complete(hdev, mesh_tx, false); 2430 } while (mesh_tx); 2431 } else { 2432 mesh_tx = mgmt_mesh_find(hdev, cancel->handle); 2433 2434 if (mesh_tx && mesh_tx->sk == cmd->sk) 2435 mesh_send_complete(hdev, mesh_tx, false); 2436 } 2437 2438 mgmt_cmd_complete(cmd->sk, hdev->id, MGMT_OP_MESH_SEND_CANCEL, 2439 0, NULL, 0); 2440 2441 return 0; 2442 } 2443 2444 static void send_cancel_destroy(struct hci_dev *hdev, void *data, int err) 2445 { 2446 mgmt_pending_free(data); 2447 } 2448 2449 static int mesh_send_cancel(struct sock *sk, struct hci_dev *hdev, 2450 void *data, u16 len) 2451 { 2452 struct mgmt_pending_cmd *cmd; 2453 int err; 2454 2455 if (!lmp_le_capable(hdev) || 2456 !hci_dev_test_flag(hdev, HCI_MESH_EXPERIMENTAL)) 2457 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_MESH_SEND_CANCEL, 2458 MGMT_STATUS_NOT_SUPPORTED); 2459 2460 if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED)) 2461 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_MESH_SEND_CANCEL, 2462 MGMT_STATUS_REJECTED); 2463 2464 hci_dev_lock(hdev); 2465 cmd = mgmt_pending_new(sk, MGMT_OP_MESH_SEND_CANCEL, hdev, data, len); 2466 if (!cmd) 2467 err = -ENOMEM; 2468 else 2469 err = hci_cmd_sync_queue(hdev, send_cancel, cmd, 2470 send_cancel_destroy); 2471 2472 if (err < 0) { 2473 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_MESH_SEND_CANCEL, 2474 MGMT_STATUS_FAILED); 2475 2476 if (cmd) 2477 mgmt_pending_free(cmd); 2478 } 2479 2480 hci_dev_unlock(hdev); 2481 return err; 2482 } 2483 2484 static int mesh_send(struct sock *sk, struct hci_dev *hdev, void *data, u16 len) 2485 { 2486 struct mgmt_mesh_tx *mesh_tx; 2487 struct mgmt_cp_mesh_send *send = data; 2488 struct mgmt_rp_mesh_read_features rp; 2489 u16 expected_len; 2490 bool sending; 2491 int err = 0; 2492 2493 if (!lmp_le_capable(hdev) || 2494 !hci_dev_test_flag(hdev, HCI_MESH_EXPERIMENTAL)) 2495 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_MESH_SEND, 2496 MGMT_STATUS_NOT_SUPPORTED); 2497 if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED)) 2498 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_MESH_SEND, 2499 MGMT_STATUS_REJECTED); 2500 2501 if (!send->adv_data_len || send->adv_data_len > 31) 2502 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_MESH_SEND, 2503 MGMT_STATUS_REJECTED); 2504 2505 expected_len = struct_size(send, adv_data, send->adv_data_len); 2506 if (expected_len != len) 2507 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_MESH_SEND, 2508 MGMT_STATUS_INVALID_PARAMS); 2509 2510 hci_dev_lock(hdev); 2511 2512 memset(&rp, 0, sizeof(rp)); 2513 rp.max_handles = MESH_HANDLES_MAX; 2514 2515 mgmt_mesh_foreach(hdev, send_count, &rp, sk); 2516 2517 if (rp.max_handles <= rp.used_handles) { 2518 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_MESH_SEND, 2519 MGMT_STATUS_BUSY); 2520 goto done; 2521 } 2522 2523 sending = hci_dev_test_flag(hdev, HCI_MESH_SENDING); 2524 mesh_tx = mgmt_mesh_add(sk, hdev, send, len); 2525 2526 if (!mesh_tx) 2527 err = -ENOMEM; 2528 else if (!sending) 2529 err = hci_cmd_sync_queue(hdev, mesh_send_sync, mesh_tx, 2530 mesh_send_start_complete); 2531 2532 if (err < 0) { 2533 bt_dev_err(hdev, "Send Mesh Failed %d", err); 2534 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_MESH_SEND, 2535 MGMT_STATUS_FAILED); 2536 2537 if (mesh_tx) { 2538 if (sending) 2539 mgmt_mesh_remove(mesh_tx); 2540 } 2541 } else { 2542 hci_dev_set_flag(hdev, HCI_MESH_SENDING); 2543 2544 mgmt_cmd_complete(sk, hdev->id, MGMT_OP_MESH_SEND, 0, 2545 &mesh_tx->handle, 1); 2546 } 2547 2548 done: 2549 hci_dev_unlock(hdev); 2550 return err; 2551 } 2552 2553 static int set_le(struct sock *sk, struct hci_dev *hdev, void *data, u16 len) 2554 { 2555 struct mgmt_mode *cp = data; 2556 struct mgmt_pending_cmd *cmd; 2557 int err; 2558 u8 val, enabled; 2559 2560 bt_dev_dbg(hdev, "sock %p", sk); 2561 2562 if (!lmp_le_capable(hdev)) 2563 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE, 2564 MGMT_STATUS_NOT_SUPPORTED); 2565 2566 if (cp->val != 0x00 && cp->val != 0x01) 2567 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE, 2568 MGMT_STATUS_INVALID_PARAMS); 2569 2570 /* Bluetooth single mode LE only controllers or dual-mode 2571 * controllers configured as LE only devices, do not allow 2572 * switching LE off. These have either LE enabled explicitly 2573 * or BR/EDR has been previously switched off. 2574 * 2575 * When trying to enable an already enabled LE, then gracefully 2576 * send a positive response. Trying to disable it however will 2577 * result into rejection. 2578 */ 2579 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) { 2580 if (cp->val == 0x01) 2581 return send_settings_rsp(sk, MGMT_OP_SET_LE, hdev); 2582 2583 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE, 2584 MGMT_STATUS_REJECTED); 2585 } 2586 2587 hci_dev_lock(hdev); 2588 2589 val = !!cp->val; 2590 enabled = lmp_host_le_capable(hdev); 2591 2592 if (!hdev_is_powered(hdev) || val == enabled) { 2593 bool changed = false; 2594 2595 if (val != hci_dev_test_flag(hdev, HCI_LE_ENABLED)) { 2596 hci_dev_change_flag(hdev, HCI_LE_ENABLED); 2597 changed = true; 2598 } 2599 2600 if (!val && hci_dev_test_flag(hdev, HCI_ADVERTISING)) { 2601 hci_dev_clear_flag(hdev, HCI_ADVERTISING); 2602 changed = true; 2603 } 2604 2605 err = send_settings_rsp(sk, MGMT_OP_SET_LE, hdev); 2606 if (err < 0) 2607 goto unlock; 2608 2609 if (changed) 2610 err = new_settings(hdev, sk); 2611 2612 goto unlock; 2613 } 2614 2615 if (pending_find(MGMT_OP_SET_LE, hdev) || 2616 pending_find(MGMT_OP_SET_ADVERTISING, hdev)) { 2617 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE, 2618 MGMT_STATUS_BUSY); 2619 goto unlock; 2620 } 2621 2622 cmd = mgmt_pending_add(sk, MGMT_OP_SET_LE, hdev, data, len); 2623 if (!cmd) 2624 err = -ENOMEM; 2625 else 2626 err = hci_cmd_sync_queue(hdev, set_le_sync, cmd, 2627 set_le_complete); 2628 2629 if (err < 0) { 2630 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE, 2631 MGMT_STATUS_FAILED); 2632 2633 if (cmd) 2634 mgmt_pending_remove(cmd); 2635 } 2636 2637 unlock: 2638 hci_dev_unlock(hdev); 2639 return err; 2640 } 2641 2642 static int send_hci_cmd_sync(struct hci_dev *hdev, void *data) 2643 { 2644 struct mgmt_pending_cmd *cmd = data; 2645 struct mgmt_cp_hci_cmd_sync *cp = cmd->param; 2646 struct sk_buff *skb; 2647 2648 skb = __hci_cmd_sync_ev(hdev, le16_to_cpu(cp->opcode), 2649 le16_to_cpu(cp->params_len), cp->params, 2650 cp->event, cp->timeout ? 2651 secs_to_jiffies(cp->timeout) : 2652 HCI_CMD_TIMEOUT); 2653 if (IS_ERR(skb)) { 2654 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_HCI_CMD_SYNC, 2655 mgmt_status(PTR_ERR(skb))); 2656 return 0; 2657 } 2658 2659 mgmt_cmd_complete(cmd->sk, hdev->id, MGMT_OP_HCI_CMD_SYNC, 0, 2660 skb->data, skb->len); 2661 2662 kfree_skb(skb); 2663 2664 return 0; 2665 } 2666 2667 static void send_hci_cmd_sync_destroy(struct hci_dev *hdev, void *data, int err) 2668 { 2669 mgmt_pending_free(data); 2670 } 2671 2672 static int mgmt_hci_cmd_sync(struct sock *sk, struct hci_dev *hdev, 2673 void *data, u16 len) 2674 { 2675 struct mgmt_cp_hci_cmd_sync *cp = data; 2676 struct mgmt_pending_cmd *cmd; 2677 int err; 2678 2679 if (len != (offsetof(struct mgmt_cp_hci_cmd_sync, params) + 2680 le16_to_cpu(cp->params_len))) 2681 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_HCI_CMD_SYNC, 2682 MGMT_STATUS_INVALID_PARAMS); 2683 2684 /* The HCI command header carries the parameter length in a u8, a 2685 * larger value would be truncated there while the parameters are 2686 * still appended to the frame in full. 2687 */ 2688 if (le16_to_cpu(cp->params_len) > U8_MAX) 2689 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_HCI_CMD_SYNC, 2690 MGMT_STATUS_INVALID_PARAMS); 2691 2692 hci_dev_lock(hdev); 2693 cmd = mgmt_pending_new(sk, MGMT_OP_HCI_CMD_SYNC, hdev, data, len); 2694 if (!cmd) 2695 err = -ENOMEM; 2696 else 2697 err = hci_cmd_sync_queue(hdev, send_hci_cmd_sync, cmd, 2698 send_hci_cmd_sync_destroy); 2699 2700 if (err < 0) { 2701 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_HCI_CMD_SYNC, 2702 MGMT_STATUS_FAILED); 2703 2704 if (cmd) 2705 mgmt_pending_free(cmd); 2706 } 2707 2708 hci_dev_unlock(hdev); 2709 return err; 2710 } 2711 2712 /* This is a helper function to test for pending mgmt commands that can 2713 * cause CoD or EIR HCI commands. We can only allow one such pending 2714 * mgmt command at a time since otherwise we cannot easily track what 2715 * the current values are, will be, and based on that calculate if a new 2716 * HCI command needs to be sent and if yes with what value. 2717 */ 2718 static bool pending_eir_or_class(struct hci_dev *hdev) 2719 { 2720 struct mgmt_pending_cmd *cmd; 2721 bool pending = false; 2722 2723 mutex_lock(&hdev->mgmt_pending_lock); 2724 2725 list_for_each_entry(cmd, &hdev->mgmt_pending, list) { 2726 switch (cmd->opcode) { 2727 case MGMT_OP_ADD_UUID: 2728 case MGMT_OP_REMOVE_UUID: 2729 case MGMT_OP_SET_DEV_CLASS: 2730 case MGMT_OP_SET_LOCAL_NAME: 2731 case MGMT_OP_SET_POWERED: 2732 pending = true; 2733 break; 2734 } 2735 2736 if (pending) 2737 break; 2738 } 2739 2740 mutex_unlock(&hdev->mgmt_pending_lock); 2741 2742 return pending; 2743 } 2744 2745 static const u8 bluetooth_base_uuid[] = { 2746 0xfb, 0x34, 0x9b, 0x5f, 0x80, 0x00, 0x00, 0x80, 2747 0x00, 0x10, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 2748 }; 2749 2750 static u8 get_uuid_size(const u8 *uuid) 2751 { 2752 u32 val; 2753 2754 if (memcmp(uuid, bluetooth_base_uuid, 12)) 2755 return 128; 2756 2757 val = get_unaligned_le32(&uuid[12]); 2758 if (val > 0xffff) 2759 return 32; 2760 2761 return 16; 2762 } 2763 2764 static void mgmt_class_complete(struct hci_dev *hdev, void *data, int err) 2765 { 2766 struct mgmt_pending_cmd *cmd = data; 2767 2768 bt_dev_dbg(hdev, "err %d", err); 2769 2770 mgmt_cmd_complete(cmd->sk, cmd->hdev->id, cmd->opcode, 2771 mgmt_status(err), hdev->dev_class, 3); 2772 2773 mgmt_pending_free(cmd); 2774 } 2775 2776 static int add_uuid_sync(struct hci_dev *hdev, void *data) 2777 { 2778 int err; 2779 2780 err = hci_update_class_sync(hdev); 2781 if (err) 2782 return err; 2783 2784 return hci_update_eir_sync(hdev); 2785 } 2786 2787 static int add_uuid(struct sock *sk, struct hci_dev *hdev, void *data, u16 len) 2788 { 2789 struct mgmt_cp_add_uuid *cp = data; 2790 struct mgmt_pending_cmd *cmd; 2791 struct bt_uuid *uuid; 2792 int err; 2793 2794 bt_dev_dbg(hdev, "sock %p", sk); 2795 2796 hci_dev_lock(hdev); 2797 2798 if (pending_eir_or_class(hdev)) { 2799 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_UUID, 2800 MGMT_STATUS_BUSY); 2801 goto failed; 2802 } 2803 2804 uuid = kmalloc_obj(*uuid); 2805 if (!uuid) { 2806 err = -ENOMEM; 2807 goto failed; 2808 } 2809 2810 memcpy(uuid->uuid, cp->uuid, 16); 2811 uuid->svc_hint = cp->svc_hint; 2812 uuid->size = get_uuid_size(cp->uuid); 2813 2814 list_add_tail(&uuid->list, &hdev->uuids); 2815 2816 cmd = mgmt_pending_new(sk, MGMT_OP_ADD_UUID, hdev, data, len); 2817 if (!cmd) { 2818 err = -ENOMEM; 2819 goto failed; 2820 } 2821 2822 /* MGMT_OP_ADD_UUID don't require adapter the UP/Running so use 2823 * hci_cmd_sync_submit instead of hci_cmd_sync_queue. 2824 */ 2825 err = hci_cmd_sync_submit(hdev, add_uuid_sync, cmd, 2826 mgmt_class_complete); 2827 if (err < 0) { 2828 mgmt_pending_free(cmd); 2829 goto failed; 2830 } 2831 2832 failed: 2833 hci_dev_unlock(hdev); 2834 return err; 2835 } 2836 2837 static bool enable_service_cache(struct hci_dev *hdev) 2838 { 2839 if (!hdev_is_powered(hdev)) 2840 return false; 2841 2842 if (!hci_dev_test_and_set_flag(hdev, HCI_SERVICE_CACHE)) { 2843 queue_delayed_work(hdev->workqueue, &hdev->service_cache, 2844 CACHE_TIMEOUT); 2845 return true; 2846 } 2847 2848 return false; 2849 } 2850 2851 static int remove_uuid_sync(struct hci_dev *hdev, void *data) 2852 { 2853 int err; 2854 2855 err = hci_update_class_sync(hdev); 2856 if (err) 2857 return err; 2858 2859 return hci_update_eir_sync(hdev); 2860 } 2861 2862 static int remove_uuid(struct sock *sk, struct hci_dev *hdev, void *data, 2863 u16 len) 2864 { 2865 struct mgmt_cp_remove_uuid *cp = data; 2866 struct mgmt_pending_cmd *cmd; 2867 struct bt_uuid *match, *tmp; 2868 static const u8 bt_uuid_any[] = { 2869 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 2870 }; 2871 int err, found; 2872 2873 bt_dev_dbg(hdev, "sock %p", sk); 2874 2875 hci_dev_lock(hdev); 2876 2877 if (pending_eir_or_class(hdev)) { 2878 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID, 2879 MGMT_STATUS_BUSY); 2880 goto unlock; 2881 } 2882 2883 if (memcmp(cp->uuid, bt_uuid_any, 16) == 0) { 2884 hci_uuids_clear(hdev); 2885 2886 if (enable_service_cache(hdev)) { 2887 err = mgmt_cmd_complete(sk, hdev->id, 2888 MGMT_OP_REMOVE_UUID, 2889 0, hdev->dev_class, 3); 2890 goto unlock; 2891 } 2892 2893 goto update_class; 2894 } 2895 2896 found = 0; 2897 2898 list_for_each_entry_safe(match, tmp, &hdev->uuids, list) { 2899 if (memcmp(match->uuid, cp->uuid, 16) != 0) 2900 continue; 2901 2902 list_del(&match->list); 2903 kfree(match); 2904 found++; 2905 } 2906 2907 if (found == 0) { 2908 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID, 2909 MGMT_STATUS_INVALID_PARAMS); 2910 goto unlock; 2911 } 2912 2913 update_class: 2914 cmd = mgmt_pending_new(sk, MGMT_OP_REMOVE_UUID, hdev, data, len); 2915 if (!cmd) { 2916 err = -ENOMEM; 2917 goto unlock; 2918 } 2919 2920 /* MGMT_OP_REMOVE_UUID don't require adapter the UP/Running so use 2921 * hci_cmd_sync_submit instead of hci_cmd_sync_queue. 2922 */ 2923 err = hci_cmd_sync_submit(hdev, remove_uuid_sync, cmd, 2924 mgmt_class_complete); 2925 if (err < 0) 2926 mgmt_pending_free(cmd); 2927 2928 unlock: 2929 hci_dev_unlock(hdev); 2930 return err; 2931 } 2932 2933 static int set_class_sync(struct hci_dev *hdev, void *data) 2934 { 2935 int err = 0; 2936 2937 if (hci_dev_test_and_clear_flag(hdev, HCI_SERVICE_CACHE)) { 2938 cancel_delayed_work_sync(&hdev->service_cache); 2939 err = hci_update_eir_sync(hdev); 2940 } 2941 2942 if (err) 2943 return err; 2944 2945 return hci_update_class_sync(hdev); 2946 } 2947 2948 static int set_dev_class(struct sock *sk, struct hci_dev *hdev, void *data, 2949 u16 len) 2950 { 2951 struct mgmt_cp_set_dev_class *cp = data; 2952 struct mgmt_pending_cmd *cmd; 2953 int err; 2954 2955 bt_dev_dbg(hdev, "sock %p", sk); 2956 2957 if (!lmp_bredr_capable(hdev)) 2958 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 2959 MGMT_STATUS_NOT_SUPPORTED); 2960 2961 hci_dev_lock(hdev); 2962 2963 if (pending_eir_or_class(hdev)) { 2964 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 2965 MGMT_STATUS_BUSY); 2966 goto unlock; 2967 } 2968 2969 if ((cp->minor & 0x03) != 0 || (cp->major & 0xe0) != 0) { 2970 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 2971 MGMT_STATUS_INVALID_PARAMS); 2972 goto unlock; 2973 } 2974 2975 hdev->major_class = cp->major; 2976 hdev->minor_class = cp->minor; 2977 2978 if (!hdev_is_powered(hdev)) { 2979 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 0, 2980 hdev->dev_class, 3); 2981 goto unlock; 2982 } 2983 2984 cmd = mgmt_pending_new(sk, MGMT_OP_SET_DEV_CLASS, hdev, data, len); 2985 if (!cmd) { 2986 err = -ENOMEM; 2987 goto unlock; 2988 } 2989 2990 /* MGMT_OP_SET_DEV_CLASS don't require adapter the UP/Running so use 2991 * hci_cmd_sync_submit instead of hci_cmd_sync_queue. 2992 */ 2993 err = hci_cmd_sync_submit(hdev, set_class_sync, cmd, 2994 mgmt_class_complete); 2995 if (err < 0) 2996 mgmt_pending_free(cmd); 2997 2998 unlock: 2999 hci_dev_unlock(hdev); 3000 return err; 3001 } 3002 3003 static int load_link_keys(struct sock *sk, struct hci_dev *hdev, void *data, 3004 u16 len) 3005 { 3006 struct mgmt_cp_load_link_keys *cp = data; 3007 const u16 max_key_count = ((U16_MAX - sizeof(*cp)) / 3008 sizeof(struct mgmt_link_key_info)); 3009 u16 key_count, expected_len; 3010 bool changed; 3011 int i; 3012 3013 bt_dev_dbg(hdev, "sock %p", sk); 3014 3015 if (!lmp_bredr_capable(hdev)) 3016 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS, 3017 MGMT_STATUS_NOT_SUPPORTED); 3018 3019 key_count = __le16_to_cpu(cp->key_count); 3020 if (key_count > max_key_count) { 3021 bt_dev_err(hdev, "load_link_keys: too big key_count value %u", 3022 key_count); 3023 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS, 3024 MGMT_STATUS_INVALID_PARAMS); 3025 } 3026 3027 expected_len = struct_size(cp, keys, key_count); 3028 if (expected_len != len) { 3029 bt_dev_err(hdev, "load_link_keys: expected %u bytes, got %u bytes", 3030 expected_len, len); 3031 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS, 3032 MGMT_STATUS_INVALID_PARAMS); 3033 } 3034 3035 if (cp->debug_keys != 0x00 && cp->debug_keys != 0x01) 3036 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS, 3037 MGMT_STATUS_INVALID_PARAMS); 3038 3039 bt_dev_dbg(hdev, "debug_keys %u key_count %u", cp->debug_keys, 3040 key_count); 3041 3042 hci_dev_lock(hdev); 3043 3044 hci_link_keys_clear(hdev); 3045 3046 if (cp->debug_keys) 3047 changed = !hci_dev_test_and_set_flag(hdev, HCI_KEEP_DEBUG_KEYS); 3048 else 3049 changed = hci_dev_test_and_clear_flag(hdev, 3050 HCI_KEEP_DEBUG_KEYS); 3051 3052 if (changed) 3053 new_settings(hdev, NULL); 3054 3055 for (i = 0; i < key_count; i++) { 3056 struct mgmt_link_key_info *key = &cp->keys[i]; 3057 3058 if (hci_is_blocked_key(hdev, 3059 HCI_BLOCKED_KEY_TYPE_LINKKEY, 3060 key->val)) { 3061 bt_dev_warn(hdev, "Skipping blocked link key for %pMR", 3062 &key->addr.bdaddr); 3063 continue; 3064 } 3065 3066 if (key->addr.type != BDADDR_BREDR) { 3067 bt_dev_warn(hdev, 3068 "Invalid link address type %u for %pMR", 3069 key->addr.type, &key->addr.bdaddr); 3070 continue; 3071 } 3072 3073 if (key->type > 0x08) { 3074 bt_dev_warn(hdev, "Invalid link key type %u for %pMR", 3075 key->type, &key->addr.bdaddr); 3076 continue; 3077 } 3078 3079 /* Always ignore debug keys and require a new pairing if 3080 * the user wants to use them. 3081 */ 3082 if (key->type == HCI_LK_DEBUG_COMBINATION) 3083 continue; 3084 3085 hci_add_link_key(hdev, NULL, &key->addr.bdaddr, key->val, 3086 key->type, key->pin_len, NULL); 3087 } 3088 3089 mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS, 0, NULL, 0); 3090 3091 hci_dev_unlock(hdev); 3092 3093 return 0; 3094 } 3095 3096 static int device_unpaired(struct hci_dev *hdev, bdaddr_t *bdaddr, 3097 u8 addr_type, struct sock *skip_sk) 3098 { 3099 struct mgmt_ev_device_unpaired ev; 3100 3101 bacpy(&ev.addr.bdaddr, bdaddr); 3102 ev.addr.type = addr_type; 3103 3104 return mgmt_event(MGMT_EV_DEVICE_UNPAIRED, hdev, &ev, sizeof(ev), 3105 skip_sk); 3106 } 3107 3108 static void unpair_device_complete(struct hci_dev *hdev, void *data, int err) 3109 { 3110 struct mgmt_pending_cmd *cmd = data; 3111 struct mgmt_cp_unpair_device *cp = cmd->param; 3112 3113 if (!err) 3114 device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, cmd->sk); 3115 3116 cmd->cmd_complete(cmd, err); 3117 mgmt_pending_free(cmd); 3118 } 3119 3120 static int unpair_device_sync(struct hci_dev *hdev, void *data) 3121 { 3122 struct mgmt_pending_cmd *cmd = data; 3123 struct mgmt_cp_unpair_device *cp = cmd->param; 3124 struct hci_conn *conn; 3125 3126 hci_dev_lock(hdev); 3127 3128 if (cp->addr.type == BDADDR_BREDR) 3129 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, 3130 &cp->addr.bdaddr); 3131 else 3132 conn = hci_conn_hash_lookup_le(hdev, &cp->addr.bdaddr, 3133 le_addr_type(cp->addr.type)); 3134 3135 if (conn) 3136 hci_conn_get(conn); 3137 3138 hci_dev_unlock(hdev); 3139 3140 if (!conn) 3141 return 0; 3142 3143 /* Disregard any possible error since the likes of hci_abort_conn_sync 3144 * will clean up the connection no matter the error. 3145 */ 3146 hci_abort_conn(conn, HCI_ERROR_REMOTE_USER_TERM); 3147 hci_conn_put(conn); 3148 3149 return 0; 3150 } 3151 3152 static int unpair_device(struct sock *sk, struct hci_dev *hdev, void *data, 3153 u16 len) 3154 { 3155 struct mgmt_cp_unpair_device *cp = data; 3156 struct mgmt_rp_unpair_device rp; 3157 struct hci_conn_params *params; 3158 struct mgmt_pending_cmd *cmd; 3159 struct hci_conn *conn; 3160 u8 addr_type; 3161 int err; 3162 3163 memset(&rp, 0, sizeof(rp)); 3164 bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr); 3165 rp.addr.type = cp->addr.type; 3166 3167 if (!bdaddr_type_is_valid(cp->addr.type)) 3168 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE, 3169 MGMT_STATUS_INVALID_PARAMS, 3170 &rp, sizeof(rp)); 3171 3172 if (cp->disconnect != 0x00 && cp->disconnect != 0x01) 3173 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE, 3174 MGMT_STATUS_INVALID_PARAMS, 3175 &rp, sizeof(rp)); 3176 3177 hci_dev_lock(hdev); 3178 3179 if (!hdev_is_powered(hdev)) { 3180 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE, 3181 MGMT_STATUS_NOT_POWERED, &rp, 3182 sizeof(rp)); 3183 goto unlock; 3184 } 3185 3186 if (cp->addr.type == BDADDR_BREDR) { 3187 /* If disconnection is requested, then look up the 3188 * connection. If the remote device is connected, it 3189 * will be later used to terminate the link. 3190 * 3191 * Setting it to NULL explicitly will cause no 3192 * termination of the link. 3193 */ 3194 if (cp->disconnect) 3195 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, 3196 &cp->addr.bdaddr); 3197 else 3198 conn = NULL; 3199 3200 err = hci_remove_link_key(hdev, &cp->addr.bdaddr); 3201 if (err < 0) { 3202 err = mgmt_cmd_complete(sk, hdev->id, 3203 MGMT_OP_UNPAIR_DEVICE, 3204 MGMT_STATUS_NOT_PAIRED, &rp, 3205 sizeof(rp)); 3206 goto unlock; 3207 } 3208 3209 goto done; 3210 } 3211 3212 /* LE address type */ 3213 addr_type = le_addr_type(cp->addr.type); 3214 3215 /* Abort any ongoing SMP pairing. Removes ltk and irk if they exist. */ 3216 err = smp_cancel_and_remove_pairing(hdev, &cp->addr.bdaddr, addr_type); 3217 if (err < 0) { 3218 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE, 3219 MGMT_STATUS_NOT_PAIRED, &rp, 3220 sizeof(rp)); 3221 goto unlock; 3222 } 3223 3224 conn = hci_conn_hash_lookup_le(hdev, &cp->addr.bdaddr, addr_type); 3225 if (!conn) { 3226 hci_conn_params_del(hdev, &cp->addr.bdaddr, addr_type); 3227 goto done; 3228 } 3229 3230 3231 /* Defer clearing up the connection parameters until closing to 3232 * give a chance of keeping them if a repairing happens. 3233 */ 3234 set_bit(HCI_CONN_PARAM_REMOVAL_PEND, &conn->flags); 3235 3236 /* Disable auto-connection parameters if present */ 3237 params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr, addr_type); 3238 if (params) { 3239 if (params->explicit_connect) 3240 params->auto_connect = HCI_AUTO_CONN_EXPLICIT; 3241 else 3242 params->auto_connect = HCI_AUTO_CONN_DISABLED; 3243 } 3244 3245 /* If disconnection is not requested, then clear the connection 3246 * variable so that the link is not terminated. 3247 */ 3248 if (!cp->disconnect) 3249 conn = NULL; 3250 3251 done: 3252 /* If the connection variable is set, then termination of the 3253 * link is requested. 3254 */ 3255 if (!conn) { 3256 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE, 0, 3257 &rp, sizeof(rp)); 3258 device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, sk); 3259 goto unlock; 3260 } 3261 3262 cmd = mgmt_pending_new(sk, MGMT_OP_UNPAIR_DEVICE, hdev, cp, 3263 sizeof(*cp)); 3264 if (!cmd) { 3265 err = -ENOMEM; 3266 goto unlock; 3267 } 3268 3269 cmd->cmd_complete = addr_cmd_complete; 3270 3271 err = hci_cmd_sync_queue(hdev, unpair_device_sync, cmd, 3272 unpair_device_complete); 3273 if (err < 0) 3274 mgmt_pending_free(cmd); 3275 3276 unlock: 3277 hci_dev_unlock(hdev); 3278 return err; 3279 } 3280 3281 static void disconnect_complete(struct hci_dev *hdev, void *data, int err) 3282 { 3283 struct mgmt_pending_cmd *cmd = data; 3284 3285 cmd->cmd_complete(cmd, mgmt_status(err)); 3286 mgmt_pending_free(cmd); 3287 } 3288 3289 static int disconnect_sync(struct hci_dev *hdev, void *data) 3290 { 3291 struct mgmt_pending_cmd *cmd = data; 3292 struct mgmt_cp_disconnect *cp = cmd->param; 3293 struct hci_conn *conn; 3294 3295 hci_dev_lock(hdev); 3296 3297 if (cp->addr.type == BDADDR_BREDR) 3298 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, 3299 &cp->addr.bdaddr); 3300 else 3301 conn = hci_conn_hash_lookup_le(hdev, &cp->addr.bdaddr, 3302 le_addr_type(cp->addr.type)); 3303 3304 if (conn) 3305 hci_conn_get(conn); 3306 3307 hci_dev_unlock(hdev); 3308 3309 if (!conn) 3310 return -ENOTCONN; 3311 3312 /* Disregard any possible error since the likes of hci_abort_conn_sync 3313 * will clean up the connection no matter the error. 3314 */ 3315 hci_abort_conn(conn, HCI_ERROR_REMOTE_USER_TERM); 3316 hci_conn_put(conn); 3317 3318 return 0; 3319 } 3320 3321 static int disconnect(struct sock *sk, struct hci_dev *hdev, void *data, 3322 u16 len) 3323 { 3324 struct mgmt_cp_disconnect *cp = data; 3325 struct mgmt_rp_disconnect rp; 3326 struct mgmt_pending_cmd *cmd; 3327 int err; 3328 3329 bt_dev_dbg(hdev, "sock %p", sk); 3330 3331 memset(&rp, 0, sizeof(rp)); 3332 bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr); 3333 rp.addr.type = cp->addr.type; 3334 3335 if (!bdaddr_type_is_valid(cp->addr.type)) 3336 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT, 3337 MGMT_STATUS_INVALID_PARAMS, 3338 &rp, sizeof(rp)); 3339 3340 hci_dev_lock(hdev); 3341 3342 if (!test_bit(HCI_UP, &hdev->flags)) { 3343 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT, 3344 MGMT_STATUS_NOT_POWERED, &rp, 3345 sizeof(rp)); 3346 goto failed; 3347 } 3348 3349 cmd = mgmt_pending_new(sk, MGMT_OP_DISCONNECT, hdev, data, len); 3350 if (!cmd) { 3351 err = -ENOMEM; 3352 goto failed; 3353 } 3354 3355 cmd->cmd_complete = generic_cmd_complete; 3356 3357 err = hci_cmd_sync_queue(hdev, disconnect_sync, cmd, 3358 disconnect_complete); 3359 if (err < 0) 3360 mgmt_pending_free(cmd); 3361 3362 failed: 3363 hci_dev_unlock(hdev); 3364 return err; 3365 } 3366 3367 static u8 link_to_bdaddr(u8 link_type, u8 addr_type) 3368 { 3369 switch (link_type) { 3370 case CIS_LINK: 3371 case BIS_LINK: 3372 case PA_LINK: 3373 case LE_LINK: 3374 switch (addr_type) { 3375 case ADDR_LE_DEV_PUBLIC: 3376 return BDADDR_LE_PUBLIC; 3377 3378 default: 3379 /* Fallback to LE Random address type */ 3380 return BDADDR_LE_RANDOM; 3381 } 3382 3383 default: 3384 /* Fallback to BR/EDR type */ 3385 return BDADDR_BREDR; 3386 } 3387 } 3388 3389 static int get_connections(struct sock *sk, struct hci_dev *hdev, void *data, 3390 u16 data_len) 3391 { 3392 struct mgmt_rp_get_connections *rp; 3393 struct hci_conn *c; 3394 int err; 3395 u16 i; 3396 3397 bt_dev_dbg(hdev, "sock %p", sk); 3398 3399 hci_dev_lock(hdev); 3400 3401 if (!hdev_is_powered(hdev)) { 3402 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_CONNECTIONS, 3403 MGMT_STATUS_NOT_POWERED); 3404 goto unlock; 3405 } 3406 3407 i = 0; 3408 list_for_each_entry(c, &hdev->conn_hash.list, list) { 3409 if (test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags)) 3410 i++; 3411 } 3412 3413 rp = kmalloc_flex(*rp, addr, i); 3414 if (!rp) { 3415 err = -ENOMEM; 3416 goto unlock; 3417 } 3418 3419 i = 0; 3420 list_for_each_entry(c, &hdev->conn_hash.list, list) { 3421 if (!test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags)) 3422 continue; 3423 bacpy(&rp->addr[i].bdaddr, &c->dst); 3424 rp->addr[i].type = link_to_bdaddr(c->type, c->dst_type); 3425 if (c->type == SCO_LINK || c->type == ESCO_LINK) 3426 continue; 3427 i++; 3428 } 3429 3430 rp->conn_count = cpu_to_le16(i); 3431 3432 /* Recalculate length in case of filtered SCO connections, etc */ 3433 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONNECTIONS, 0, rp, 3434 struct_size(rp, addr, i)); 3435 3436 kfree(rp); 3437 3438 unlock: 3439 hci_dev_unlock(hdev); 3440 return err; 3441 } 3442 3443 static int send_pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev, 3444 struct mgmt_cp_pin_code_neg_reply *cp) 3445 { 3446 struct mgmt_pending_cmd *cmd; 3447 int err; 3448 3449 cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_NEG_REPLY, hdev, cp, 3450 sizeof(*cp)); 3451 if (!cmd) 3452 return -ENOMEM; 3453 3454 cmd->cmd_complete = addr_cmd_complete; 3455 3456 err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_NEG_REPLY, 3457 sizeof(cp->addr.bdaddr), &cp->addr.bdaddr); 3458 if (err < 0) 3459 mgmt_pending_remove(cmd); 3460 3461 return err; 3462 } 3463 3464 static int pin_code_reply(struct sock *sk, struct hci_dev *hdev, void *data, 3465 u16 len) 3466 { 3467 struct hci_conn *conn; 3468 struct mgmt_cp_pin_code_reply *cp = data; 3469 struct hci_cp_pin_code_reply reply; 3470 struct mgmt_pending_cmd *cmd; 3471 int err; 3472 3473 bt_dev_dbg(hdev, "sock %p", sk); 3474 3475 hci_dev_lock(hdev); 3476 3477 if (!hdev_is_powered(hdev)) { 3478 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY, 3479 MGMT_STATUS_NOT_POWERED); 3480 goto failed; 3481 } 3482 3483 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->addr.bdaddr); 3484 if (!conn) { 3485 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY, 3486 MGMT_STATUS_NOT_CONNECTED); 3487 goto failed; 3488 } 3489 3490 if (conn->pending_sec_level == BT_SECURITY_HIGH && cp->pin_len != 16) { 3491 struct mgmt_cp_pin_code_neg_reply ncp; 3492 3493 memcpy(&ncp.addr, &cp->addr, sizeof(ncp.addr)); 3494 3495 bt_dev_err(hdev, "PIN code is not 16 bytes long"); 3496 3497 err = send_pin_code_neg_reply(sk, hdev, &ncp); 3498 if (err >= 0) 3499 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY, 3500 MGMT_STATUS_INVALID_PARAMS); 3501 3502 goto failed; 3503 } 3504 3505 cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_REPLY, hdev, data, len); 3506 if (!cmd) { 3507 err = -ENOMEM; 3508 goto failed; 3509 } 3510 3511 cmd->cmd_complete = addr_cmd_complete; 3512 3513 bacpy(&reply.bdaddr, &cp->addr.bdaddr); 3514 reply.pin_len = cp->pin_len; 3515 memcpy(reply.pin_code, cp->pin_code, sizeof(reply.pin_code)); 3516 3517 err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_REPLY, sizeof(reply), &reply); 3518 if (err < 0) 3519 mgmt_pending_remove(cmd); 3520 3521 failed: 3522 hci_dev_unlock(hdev); 3523 return err; 3524 } 3525 3526 static int set_io_capability(struct sock *sk, struct hci_dev *hdev, void *data, 3527 u16 len) 3528 { 3529 struct mgmt_cp_set_io_capability *cp = data; 3530 3531 bt_dev_dbg(hdev, "sock %p", sk); 3532 3533 if (cp->io_capability > SMP_IO_KEYBOARD_DISPLAY) 3534 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_IO_CAPABILITY, 3535 MGMT_STATUS_INVALID_PARAMS); 3536 3537 hci_dev_lock(hdev); 3538 3539 hdev->io_capability = cp->io_capability; 3540 3541 bt_dev_dbg(hdev, "IO capability set to 0x%02x", hdev->io_capability); 3542 3543 hci_dev_unlock(hdev); 3544 3545 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_IO_CAPABILITY, 0, 3546 NULL, 0); 3547 } 3548 3549 static struct mgmt_pending_cmd *remove_pairing(struct hci_conn *conn) 3550 { 3551 struct hci_dev *hdev = conn->hdev; 3552 struct mgmt_pending_cmd *cmd; 3553 3554 mutex_lock(&hdev->mgmt_pending_lock); 3555 3556 list_for_each_entry(cmd, &hdev->mgmt_pending, list) { 3557 if (cmd->opcode != MGMT_OP_PAIR_DEVICE) 3558 continue; 3559 3560 if (cmd->user_data != conn) 3561 continue; 3562 3563 list_del(&cmd->list); 3564 mutex_unlock(&hdev->mgmt_pending_lock); 3565 return cmd; 3566 } 3567 3568 mutex_unlock(&hdev->mgmt_pending_lock); 3569 3570 return NULL; 3571 } 3572 3573 static struct mgmt_pending_cmd *remove_pairing_by_addr(struct hci_dev *hdev, 3574 bdaddr_t *bdaddr) 3575 { 3576 struct mgmt_pending_cmd *cmd; 3577 struct hci_conn *conn; 3578 3579 mutex_lock(&hdev->mgmt_pending_lock); 3580 3581 list_for_each_entry(cmd, &hdev->mgmt_pending, list) { 3582 if (cmd->opcode != MGMT_OP_PAIR_DEVICE) 3583 continue; 3584 3585 conn = cmd->user_data; 3586 if (bacmp(bdaddr, &conn->dst) != 0) 3587 continue; 3588 3589 list_del(&cmd->list); 3590 mutex_unlock(&hdev->mgmt_pending_lock); 3591 return cmd; 3592 } 3593 3594 mutex_unlock(&hdev->mgmt_pending_lock); 3595 3596 return NULL; 3597 } 3598 3599 static int pairing_complete(struct mgmt_pending_cmd *cmd, u8 status) 3600 { 3601 struct mgmt_rp_pair_device rp; 3602 struct hci_conn *conn = cmd->user_data; 3603 int err; 3604 3605 bacpy(&rp.addr.bdaddr, &conn->dst); 3606 rp.addr.type = link_to_bdaddr(conn->type, conn->dst_type); 3607 3608 err = mgmt_cmd_complete(cmd->sk, cmd->hdev->id, MGMT_OP_PAIR_DEVICE, 3609 status, &rp, sizeof(rp)); 3610 3611 /* So we don't get further callbacks for this connection */ 3612 conn->connect_cfm_cb = NULL; 3613 conn->security_cfm_cb = NULL; 3614 conn->disconn_cfm_cb = NULL; 3615 3616 hci_conn_drop(conn); 3617 3618 /* The device is paired so there is no need to remove 3619 * its connection parameters anymore. 3620 */ 3621 clear_bit(HCI_CONN_PARAM_REMOVAL_PEND, &conn->flags); 3622 3623 hci_conn_put(conn); 3624 3625 return err; 3626 } 3627 3628 void mgmt_smp_complete(struct hci_conn *conn, bool complete) 3629 { 3630 u8 status = complete ? MGMT_STATUS_SUCCESS : MGMT_STATUS_FAILED; 3631 struct mgmt_pending_cmd *cmd; 3632 3633 cmd = remove_pairing(conn); 3634 if (cmd) { 3635 cmd->cmd_complete(cmd, status); 3636 mgmt_pending_free(cmd); 3637 } 3638 } 3639 3640 static void pairing_complete_cb(struct hci_conn *conn, u8 status) 3641 { 3642 struct mgmt_pending_cmd *cmd; 3643 3644 BT_DBG("status %u", status); 3645 3646 cmd = remove_pairing(conn); 3647 if (!cmd) { 3648 BT_DBG("Unable to find a pending command"); 3649 return; 3650 } 3651 3652 cmd->cmd_complete(cmd, mgmt_status(status)); 3653 mgmt_pending_free(cmd); 3654 } 3655 3656 static void le_pairing_complete_cb(struct hci_conn *conn, u8 status) 3657 { 3658 struct mgmt_pending_cmd *cmd; 3659 3660 BT_DBG("status %u", status); 3661 3662 if (!status) 3663 return; 3664 3665 cmd = remove_pairing(conn); 3666 if (!cmd) { 3667 BT_DBG("Unable to find a pending command"); 3668 return; 3669 } 3670 3671 cmd->cmd_complete(cmd, mgmt_status(status)); 3672 mgmt_pending_free(cmd); 3673 } 3674 3675 static int pair_device(struct sock *sk, struct hci_dev *hdev, void *data, 3676 u16 len) 3677 { 3678 struct mgmt_cp_pair_device *cp = data; 3679 struct mgmt_rp_pair_device rp; 3680 struct mgmt_pending_cmd *cmd; 3681 u8 sec_level, auth_type; 3682 struct hci_conn *conn; 3683 int err; 3684 3685 bt_dev_dbg(hdev, "sock %p", sk); 3686 3687 memset(&rp, 0, sizeof(rp)); 3688 bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr); 3689 rp.addr.type = cp->addr.type; 3690 3691 if (!bdaddr_type_is_valid(cp->addr.type)) 3692 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE, 3693 MGMT_STATUS_INVALID_PARAMS, 3694 &rp, sizeof(rp)); 3695 3696 if (cp->io_cap > SMP_IO_KEYBOARD_DISPLAY) 3697 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE, 3698 MGMT_STATUS_INVALID_PARAMS, 3699 &rp, sizeof(rp)); 3700 3701 hci_dev_lock(hdev); 3702 3703 if (!hdev_is_powered(hdev)) { 3704 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE, 3705 MGMT_STATUS_NOT_POWERED, &rp, 3706 sizeof(rp)); 3707 goto unlock; 3708 } 3709 3710 if (hci_bdaddr_is_paired(hdev, &cp->addr.bdaddr, cp->addr.type)) { 3711 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE, 3712 MGMT_STATUS_ALREADY_PAIRED, &rp, 3713 sizeof(rp)); 3714 goto unlock; 3715 } 3716 3717 sec_level = BT_SECURITY_MEDIUM; 3718 auth_type = HCI_AT_DEDICATED_BONDING; 3719 3720 if (cp->addr.type == BDADDR_BREDR) { 3721 conn = hci_connect_acl(hdev, &cp->addr.bdaddr, sec_level, 3722 auth_type, CONN_REASON_PAIR_DEVICE, 3723 HCI_ACL_CONN_TIMEOUT); 3724 } else { 3725 u8 addr_type = le_addr_type(cp->addr.type); 3726 struct hci_conn_params *p; 3727 3728 /* When pairing a new device, it is expected to remember 3729 * this device for future connections. Adding the connection 3730 * parameter information ahead of time allows tracking 3731 * of the peripheral preferred values and will speed up any 3732 * further connection establishment. 3733 * 3734 * If connection parameters already exist, then they 3735 * will be kept and this function does nothing. 3736 */ 3737 p = hci_conn_params_add(hdev, &cp->addr.bdaddr, addr_type); 3738 if (!p) { 3739 err = -EIO; 3740 goto unlock; 3741 } 3742 3743 if (p->auto_connect == HCI_AUTO_CONN_EXPLICIT) 3744 p->auto_connect = HCI_AUTO_CONN_DISABLED; 3745 3746 conn = hci_connect_le_scan(hdev, &cp->addr.bdaddr, addr_type, 3747 sec_level, HCI_LE_CONN_TIMEOUT, 3748 CONN_REASON_PAIR_DEVICE); 3749 } 3750 3751 if (IS_ERR(conn)) { 3752 int status; 3753 3754 if (PTR_ERR(conn) == -EBUSY) 3755 status = MGMT_STATUS_BUSY; 3756 else if (PTR_ERR(conn) == -EOPNOTSUPP) 3757 status = MGMT_STATUS_NOT_SUPPORTED; 3758 else if (PTR_ERR(conn) == -ECONNREFUSED) 3759 status = MGMT_STATUS_REJECTED; 3760 else 3761 status = MGMT_STATUS_CONNECT_FAILED; 3762 3763 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE, 3764 status, &rp, sizeof(rp)); 3765 goto unlock; 3766 } 3767 3768 if (conn->connect_cfm_cb) { 3769 hci_conn_drop(conn); 3770 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE, 3771 MGMT_STATUS_BUSY, &rp, sizeof(rp)); 3772 goto unlock; 3773 } 3774 3775 cmd = mgmt_pending_add(sk, MGMT_OP_PAIR_DEVICE, hdev, data, len); 3776 if (!cmd) { 3777 err = -ENOMEM; 3778 hci_conn_drop(conn); 3779 goto unlock; 3780 } 3781 3782 cmd->cmd_complete = pairing_complete; 3783 3784 /* For LE, just connecting isn't a proof that the pairing finished */ 3785 if (cp->addr.type == BDADDR_BREDR) { 3786 conn->connect_cfm_cb = pairing_complete_cb; 3787 conn->security_cfm_cb = pairing_complete_cb; 3788 conn->disconn_cfm_cb = pairing_complete_cb; 3789 } else { 3790 conn->connect_cfm_cb = le_pairing_complete_cb; 3791 conn->security_cfm_cb = le_pairing_complete_cb; 3792 conn->disconn_cfm_cb = le_pairing_complete_cb; 3793 } 3794 3795 conn->io_capability = cp->io_cap; 3796 cmd->user_data = hci_conn_get(conn); 3797 3798 if ((conn->state == BT_CONNECTED || conn->state == BT_CONFIG) && 3799 hci_conn_security(conn, sec_level, auth_type, true)) { 3800 cmd->cmd_complete(cmd, 0); 3801 mgmt_pending_remove(cmd); 3802 } 3803 3804 err = 0; 3805 3806 unlock: 3807 hci_dev_unlock(hdev); 3808 return err; 3809 } 3810 3811 static int cancel_pair_device(struct sock *sk, struct hci_dev *hdev, void *data, 3812 u16 len) 3813 { 3814 struct mgmt_addr_info *addr = data; 3815 struct mgmt_pending_cmd *cmd; 3816 struct hci_conn *conn; 3817 int err; 3818 3819 bt_dev_dbg(hdev, "sock %p", sk); 3820 3821 hci_dev_lock(hdev); 3822 3823 if (!hdev_is_powered(hdev)) { 3824 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE, 3825 MGMT_STATUS_NOT_POWERED); 3826 goto unlock; 3827 } 3828 3829 cmd = remove_pairing_by_addr(hdev, &addr->bdaddr); 3830 if (!cmd) { 3831 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE, 3832 MGMT_STATUS_INVALID_PARAMS); 3833 goto unlock; 3834 } 3835 3836 conn = hci_conn_get(cmd->user_data); 3837 3838 cmd->cmd_complete(cmd, MGMT_STATUS_CANCELLED); 3839 mgmt_pending_free(cmd); 3840 3841 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE, 0, 3842 addr, sizeof(*addr)); 3843 3844 /* Since user doesn't want to proceed with the connection, abort any 3845 * ongoing pairing and then terminate the link if it was created 3846 * because of the pair device action. 3847 */ 3848 if (addr->type == BDADDR_BREDR) 3849 hci_remove_link_key(hdev, &addr->bdaddr); 3850 else 3851 smp_cancel_and_remove_pairing(hdev, &addr->bdaddr, 3852 le_addr_type(addr->type)); 3853 3854 if (conn->conn_reason == CONN_REASON_PAIR_DEVICE) 3855 hci_abort_conn(conn, HCI_ERROR_REMOTE_USER_TERM); 3856 3857 hci_conn_put(conn); 3858 3859 unlock: 3860 hci_dev_unlock(hdev); 3861 return err; 3862 } 3863 3864 static int user_pairing_resp(struct sock *sk, struct hci_dev *hdev, 3865 struct mgmt_addr_info *addr, u16 mgmt_op, 3866 u16 hci_op, __le32 passkey) 3867 { 3868 struct mgmt_pending_cmd *cmd; 3869 struct hci_conn *conn; 3870 int err; 3871 3872 hci_dev_lock(hdev); 3873 3874 if (!hdev_is_powered(hdev)) { 3875 err = mgmt_cmd_complete(sk, hdev->id, mgmt_op, 3876 MGMT_STATUS_NOT_POWERED, addr, 3877 sizeof(*addr)); 3878 goto done; 3879 } 3880 3881 if (addr->type == BDADDR_BREDR) 3882 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &addr->bdaddr); 3883 else 3884 conn = hci_conn_hash_lookup_le(hdev, &addr->bdaddr, 3885 le_addr_type(addr->type)); 3886 3887 if (!conn) { 3888 err = mgmt_cmd_complete(sk, hdev->id, mgmt_op, 3889 MGMT_STATUS_NOT_CONNECTED, addr, 3890 sizeof(*addr)); 3891 goto done; 3892 } 3893 3894 if (addr->type == BDADDR_LE_PUBLIC || addr->type == BDADDR_LE_RANDOM) { 3895 lockdep_assert_held(&conn->hdev->lock); 3896 3897 err = smp_user_confirm_reply(conn, mgmt_op, passkey); 3898 if (!err) 3899 err = mgmt_cmd_complete(sk, hdev->id, mgmt_op, 3900 MGMT_STATUS_SUCCESS, addr, 3901 sizeof(*addr)); 3902 else 3903 err = mgmt_cmd_complete(sk, hdev->id, mgmt_op, 3904 MGMT_STATUS_FAILED, addr, 3905 sizeof(*addr)); 3906 3907 goto done; 3908 } 3909 3910 cmd = mgmt_pending_add(sk, mgmt_op, hdev, addr, sizeof(*addr)); 3911 if (!cmd) { 3912 err = -ENOMEM; 3913 goto done; 3914 } 3915 3916 cmd->cmd_complete = addr_cmd_complete; 3917 3918 /* Continue with pairing via HCI */ 3919 if (hci_op == HCI_OP_USER_PASSKEY_REPLY) { 3920 struct hci_cp_user_passkey_reply cp; 3921 3922 bacpy(&cp.bdaddr, &addr->bdaddr); 3923 cp.passkey = passkey; 3924 err = hci_send_cmd(hdev, hci_op, sizeof(cp), &cp); 3925 } else 3926 err = hci_send_cmd(hdev, hci_op, sizeof(addr->bdaddr), 3927 &addr->bdaddr); 3928 3929 if (err < 0) 3930 mgmt_pending_remove(cmd); 3931 3932 done: 3933 hci_dev_unlock(hdev); 3934 return err; 3935 } 3936 3937 static int pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev, 3938 void *data, u16 len) 3939 { 3940 struct mgmt_cp_pin_code_neg_reply *cp = data; 3941 3942 bt_dev_dbg(hdev, "sock %p", sk); 3943 3944 return user_pairing_resp(sk, hdev, &cp->addr, 3945 MGMT_OP_PIN_CODE_NEG_REPLY, 3946 HCI_OP_PIN_CODE_NEG_REPLY, 0); 3947 } 3948 3949 static int user_confirm_reply(struct sock *sk, struct hci_dev *hdev, void *data, 3950 u16 len) 3951 { 3952 struct mgmt_cp_user_confirm_reply *cp = data; 3953 3954 bt_dev_dbg(hdev, "sock %p", sk); 3955 3956 if (len != sizeof(*cp)) 3957 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_USER_CONFIRM_REPLY, 3958 MGMT_STATUS_INVALID_PARAMS); 3959 3960 return user_pairing_resp(sk, hdev, &cp->addr, 3961 MGMT_OP_USER_CONFIRM_REPLY, 3962 HCI_OP_USER_CONFIRM_REPLY, 0); 3963 } 3964 3965 static int user_confirm_neg_reply(struct sock *sk, struct hci_dev *hdev, 3966 void *data, u16 len) 3967 { 3968 struct mgmt_cp_user_confirm_neg_reply *cp = data; 3969 3970 bt_dev_dbg(hdev, "sock %p", sk); 3971 3972 return user_pairing_resp(sk, hdev, &cp->addr, 3973 MGMT_OP_USER_CONFIRM_NEG_REPLY, 3974 HCI_OP_USER_CONFIRM_NEG_REPLY, 0); 3975 } 3976 3977 static int user_passkey_reply(struct sock *sk, struct hci_dev *hdev, void *data, 3978 u16 len) 3979 { 3980 struct mgmt_cp_user_passkey_reply *cp = data; 3981 3982 bt_dev_dbg(hdev, "sock %p", sk); 3983 3984 return user_pairing_resp(sk, hdev, &cp->addr, 3985 MGMT_OP_USER_PASSKEY_REPLY, 3986 HCI_OP_USER_PASSKEY_REPLY, cp->passkey); 3987 } 3988 3989 static int user_passkey_neg_reply(struct sock *sk, struct hci_dev *hdev, 3990 void *data, u16 len) 3991 { 3992 struct mgmt_cp_user_passkey_neg_reply *cp = data; 3993 3994 bt_dev_dbg(hdev, "sock %p", sk); 3995 3996 return user_pairing_resp(sk, hdev, &cp->addr, 3997 MGMT_OP_USER_PASSKEY_NEG_REPLY, 3998 HCI_OP_USER_PASSKEY_NEG_REPLY, 0); 3999 } 4000 4001 static int adv_expire_sync(struct hci_dev *hdev, u32 flags) 4002 { 4003 struct adv_info *adv_instance; 4004 4005 adv_instance = hci_find_adv_instance(hdev, hdev->cur_adv_instance); 4006 if (!adv_instance) 4007 return 0; 4008 4009 /* stop if current instance doesn't need to be changed */ 4010 if (!(adv_instance->flags & flags)) 4011 return 0; 4012 4013 cancel_adv_timeout(hdev); 4014 4015 adv_instance = hci_get_next_instance(hdev, adv_instance->instance); 4016 if (!adv_instance) 4017 return 0; 4018 4019 hci_schedule_adv_instance_sync(hdev, adv_instance->instance, true); 4020 4021 return 0; 4022 } 4023 4024 static int name_changed_sync(struct hci_dev *hdev, void *data) 4025 { 4026 return adv_expire_sync(hdev, MGMT_ADV_FLAG_LOCAL_NAME); 4027 } 4028 4029 static void set_name_complete(struct hci_dev *hdev, void *data, int err) 4030 { 4031 struct mgmt_pending_cmd *cmd = data; 4032 struct mgmt_cp_set_local_name *cp; 4033 u8 status = mgmt_status(err); 4034 4035 bt_dev_dbg(hdev, "err %d", err); 4036 4037 if (err == -ECANCELED || !mgmt_pending_valid(hdev, cmd)) 4038 return; 4039 4040 cp = cmd->param; 4041 4042 if (status) { 4043 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 4044 status); 4045 } else { 4046 mgmt_cmd_complete(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0, 4047 cp, sizeof(*cp)); 4048 4049 if (hci_dev_test_flag(hdev, HCI_LE_ADV)) 4050 hci_cmd_sync_queue(hdev, name_changed_sync, NULL, NULL); 4051 } 4052 4053 mgmt_pending_free(cmd); 4054 } 4055 4056 static int set_name_sync(struct hci_dev *hdev, void *data) 4057 { 4058 struct mgmt_pending_cmd *cmd = data; 4059 struct mgmt_cp_set_local_name cp; 4060 4061 mutex_lock(&hdev->mgmt_pending_lock); 4062 4063 if (!__mgmt_pending_listed(hdev, cmd)) { 4064 mutex_unlock(&hdev->mgmt_pending_lock); 4065 return -ECANCELED; 4066 } 4067 4068 memcpy(&cp, cmd->param, sizeof(cp)); 4069 4070 mutex_unlock(&hdev->mgmt_pending_lock); 4071 4072 if (lmp_bredr_capable(hdev)) { 4073 hci_update_name_sync(hdev, cp.name); 4074 hci_update_eir_sync(hdev); 4075 } 4076 4077 /* The name is stored in the scan response data and so 4078 * no need to update the advertising data here. 4079 */ 4080 if (lmp_le_capable(hdev) && hci_dev_test_flag(hdev, HCI_ADVERTISING)) 4081 hci_update_scan_rsp_data_sync(hdev, hdev->cur_adv_instance); 4082 4083 return 0; 4084 } 4085 4086 static int set_local_name(struct sock *sk, struct hci_dev *hdev, void *data, 4087 u16 len) 4088 { 4089 struct mgmt_cp_set_local_name *cp = data; 4090 struct mgmt_pending_cmd *cmd; 4091 int err; 4092 4093 bt_dev_dbg(hdev, "sock %p", sk); 4094 4095 hci_dev_lock(hdev); 4096 4097 /* If the old values are the same as the new ones just return a 4098 * direct command complete event. 4099 */ 4100 if (!memcmp(hdev->dev_name, cp->name, sizeof(hdev->dev_name)) && 4101 !memcmp(hdev->short_name, cp->short_name, 4102 sizeof(hdev->short_name))) { 4103 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0, 4104 data, len); 4105 goto failed; 4106 } 4107 4108 if (hdev_is_powered(hdev) && pending_eir_or_class(hdev)) { 4109 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 4110 MGMT_STATUS_BUSY); 4111 goto failed; 4112 } 4113 4114 memcpy(hdev->short_name, cp->short_name, sizeof(hdev->short_name)); 4115 4116 if (!hdev_is_powered(hdev)) { 4117 memcpy(hdev->dev_name, cp->name, sizeof(hdev->dev_name)); 4118 4119 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0, 4120 data, len); 4121 if (err < 0) 4122 goto failed; 4123 4124 err = mgmt_limited_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, data, 4125 len, HCI_MGMT_LOCAL_NAME_EVENTS, sk); 4126 ext_info_changed(hdev, sk); 4127 4128 goto failed; 4129 } 4130 4131 cmd = mgmt_pending_add(sk, MGMT_OP_SET_LOCAL_NAME, hdev, data, len); 4132 if (!cmd) 4133 err = -ENOMEM; 4134 else 4135 err = hci_cmd_sync_queue(hdev, set_name_sync, cmd, 4136 set_name_complete); 4137 4138 if (err < 0) { 4139 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 4140 MGMT_STATUS_FAILED); 4141 4142 if (cmd) 4143 mgmt_pending_remove(cmd); 4144 4145 goto failed; 4146 } 4147 4148 memcpy(hdev->dev_name, cp->name, sizeof(hdev->dev_name)); 4149 4150 failed: 4151 hci_dev_unlock(hdev); 4152 return err; 4153 } 4154 4155 static int appearance_changed_sync(struct hci_dev *hdev, void *data) 4156 { 4157 return adv_expire_sync(hdev, MGMT_ADV_FLAG_APPEARANCE); 4158 } 4159 4160 static int set_appearance(struct sock *sk, struct hci_dev *hdev, void *data, 4161 u16 len) 4162 { 4163 struct mgmt_cp_set_appearance *cp = data; 4164 u16 appearance; 4165 int err; 4166 4167 bt_dev_dbg(hdev, "sock %p", sk); 4168 4169 if (!lmp_le_capable(hdev)) 4170 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_APPEARANCE, 4171 MGMT_STATUS_NOT_SUPPORTED); 4172 4173 appearance = le16_to_cpu(cp->appearance); 4174 4175 hci_dev_lock(hdev); 4176 4177 if (hdev->appearance != appearance) { 4178 hdev->appearance = appearance; 4179 4180 if (hci_dev_test_flag(hdev, HCI_LE_ADV)) 4181 hci_cmd_sync_queue(hdev, appearance_changed_sync, NULL, 4182 NULL); 4183 4184 ext_info_changed(hdev, sk); 4185 } 4186 4187 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_APPEARANCE, 0, NULL, 4188 0); 4189 4190 hci_dev_unlock(hdev); 4191 4192 return err; 4193 } 4194 4195 static int get_phy_configuration(struct sock *sk, struct hci_dev *hdev, 4196 void *data, u16 len) 4197 { 4198 struct mgmt_rp_get_phy_configuration rp; 4199 4200 bt_dev_dbg(hdev, "sock %p", sk); 4201 4202 hci_dev_lock(hdev); 4203 4204 memset(&rp, 0, sizeof(rp)); 4205 4206 rp.supported_phys = cpu_to_le32(get_supported_phys(hdev)); 4207 rp.selected_phys = cpu_to_le32(get_selected_phys(hdev)); 4208 rp.configurable_phys = cpu_to_le32(get_configurable_phys(hdev)); 4209 4210 hci_dev_unlock(hdev); 4211 4212 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_PHY_CONFIGURATION, 0, 4213 &rp, sizeof(rp)); 4214 } 4215 4216 int mgmt_phy_configuration_changed(struct hci_dev *hdev, struct sock *skip) 4217 { 4218 struct mgmt_ev_phy_configuration_changed ev; 4219 4220 memset(&ev, 0, sizeof(ev)); 4221 4222 ev.selected_phys = cpu_to_le32(get_selected_phys(hdev)); 4223 4224 return mgmt_event(MGMT_EV_PHY_CONFIGURATION_CHANGED, hdev, &ev, 4225 sizeof(ev), skip); 4226 } 4227 4228 static void set_default_phy_complete(struct hci_dev *hdev, void *data, int err) 4229 { 4230 struct mgmt_pending_cmd *cmd = data; 4231 struct sk_buff *skb; 4232 u8 status = mgmt_status(err); 4233 4234 skb = cmd->skb; 4235 4236 if (!status) { 4237 if (!skb) 4238 status = MGMT_STATUS_FAILED; 4239 else if (IS_ERR(skb)) 4240 status = mgmt_status(PTR_ERR(skb)); 4241 else 4242 status = mgmt_status(skb->data[0]); 4243 } 4244 4245 bt_dev_dbg(hdev, "status %d", status); 4246 4247 if (status) { 4248 mgmt_cmd_status(cmd->sk, hdev->id, 4249 MGMT_OP_SET_PHY_CONFIGURATION, status); 4250 } else { 4251 mgmt_cmd_complete(cmd->sk, hdev->id, 4252 MGMT_OP_SET_PHY_CONFIGURATION, 0, 4253 NULL, 0); 4254 4255 mgmt_phy_configuration_changed(hdev, cmd->sk); 4256 } 4257 4258 if (skb && !IS_ERR(skb)) 4259 kfree_skb(skb); 4260 4261 mgmt_pending_free(cmd); 4262 } 4263 4264 static int set_default_phy_sync(struct hci_dev *hdev, void *data) 4265 { 4266 struct mgmt_pending_cmd *cmd = data; 4267 struct mgmt_cp_set_phy_configuration *cp = cmd->param; 4268 struct hci_cp_le_set_default_phy cp_phy; 4269 u32 selected_phys; 4270 4271 selected_phys = __le32_to_cpu(cp->selected_phys); 4272 4273 memset(&cp_phy, 0, sizeof(cp_phy)); 4274 4275 if (!(selected_phys & MGMT_PHY_LE_TX_MASK)) 4276 cp_phy.all_phys |= 0x01; 4277 4278 if (!(selected_phys & MGMT_PHY_LE_RX_MASK)) 4279 cp_phy.all_phys |= 0x02; 4280 4281 if (selected_phys & MGMT_PHY_LE_1M_TX) 4282 cp_phy.tx_phys |= HCI_LE_SET_PHY_1M; 4283 4284 if (selected_phys & MGMT_PHY_LE_2M_TX) 4285 cp_phy.tx_phys |= HCI_LE_SET_PHY_2M; 4286 4287 if (selected_phys & MGMT_PHY_LE_CODED_TX) 4288 cp_phy.tx_phys |= HCI_LE_SET_PHY_CODED; 4289 4290 if (selected_phys & MGMT_PHY_LE_1M_RX) 4291 cp_phy.rx_phys |= HCI_LE_SET_PHY_1M; 4292 4293 if (selected_phys & MGMT_PHY_LE_2M_RX) 4294 cp_phy.rx_phys |= HCI_LE_SET_PHY_2M; 4295 4296 if (selected_phys & MGMT_PHY_LE_CODED_RX) 4297 cp_phy.rx_phys |= HCI_LE_SET_PHY_CODED; 4298 4299 cmd->skb = __hci_cmd_sync(hdev, HCI_OP_LE_SET_DEFAULT_PHY, 4300 sizeof(cp_phy), &cp_phy, HCI_CMD_TIMEOUT); 4301 4302 return 0; 4303 } 4304 4305 static int set_phy_configuration(struct sock *sk, struct hci_dev *hdev, 4306 void *data, u16 len) 4307 { 4308 struct mgmt_cp_set_phy_configuration *cp = data; 4309 struct mgmt_pending_cmd *cmd; 4310 u32 selected_phys, configurable_phys, supported_phys, unconfigure_phys; 4311 u16 pkt_type = (HCI_DH1 | HCI_DM1); 4312 bool changed = false; 4313 int err; 4314 4315 bt_dev_dbg(hdev, "sock %p", sk); 4316 4317 configurable_phys = get_configurable_phys(hdev); 4318 supported_phys = get_supported_phys(hdev); 4319 selected_phys = __le32_to_cpu(cp->selected_phys); 4320 4321 if (selected_phys & ~supported_phys) 4322 return mgmt_cmd_status(sk, hdev->id, 4323 MGMT_OP_SET_PHY_CONFIGURATION, 4324 MGMT_STATUS_INVALID_PARAMS); 4325 4326 unconfigure_phys = supported_phys & ~configurable_phys; 4327 4328 if ((selected_phys & unconfigure_phys) != unconfigure_phys) 4329 return mgmt_cmd_status(sk, hdev->id, 4330 MGMT_OP_SET_PHY_CONFIGURATION, 4331 MGMT_STATUS_INVALID_PARAMS); 4332 4333 if (selected_phys == get_selected_phys(hdev)) 4334 return mgmt_cmd_complete(sk, hdev->id, 4335 MGMT_OP_SET_PHY_CONFIGURATION, 4336 0, NULL, 0); 4337 4338 hci_dev_lock(hdev); 4339 4340 if (!hdev_is_powered(hdev)) { 4341 err = mgmt_cmd_status(sk, hdev->id, 4342 MGMT_OP_SET_PHY_CONFIGURATION, 4343 MGMT_STATUS_REJECTED); 4344 goto unlock; 4345 } 4346 4347 if (pending_find(MGMT_OP_SET_PHY_CONFIGURATION, hdev)) { 4348 err = mgmt_cmd_status(sk, hdev->id, 4349 MGMT_OP_SET_PHY_CONFIGURATION, 4350 MGMT_STATUS_BUSY); 4351 goto unlock; 4352 } 4353 4354 if (selected_phys & MGMT_PHY_BR_1M_3SLOT) 4355 pkt_type |= (HCI_DH3 | HCI_DM3); 4356 else 4357 pkt_type &= ~(HCI_DH3 | HCI_DM3); 4358 4359 if (selected_phys & MGMT_PHY_BR_1M_5SLOT) 4360 pkt_type |= (HCI_DH5 | HCI_DM5); 4361 else 4362 pkt_type &= ~(HCI_DH5 | HCI_DM5); 4363 4364 if (selected_phys & MGMT_PHY_EDR_2M_1SLOT) 4365 pkt_type &= ~HCI_2DH1; 4366 else 4367 pkt_type |= HCI_2DH1; 4368 4369 if (selected_phys & MGMT_PHY_EDR_2M_3SLOT) 4370 pkt_type &= ~HCI_2DH3; 4371 else 4372 pkt_type |= HCI_2DH3; 4373 4374 if (selected_phys & MGMT_PHY_EDR_2M_5SLOT) 4375 pkt_type &= ~HCI_2DH5; 4376 else 4377 pkt_type |= HCI_2DH5; 4378 4379 if (selected_phys & MGMT_PHY_EDR_3M_1SLOT) 4380 pkt_type &= ~HCI_3DH1; 4381 else 4382 pkt_type |= HCI_3DH1; 4383 4384 if (selected_phys & MGMT_PHY_EDR_3M_3SLOT) 4385 pkt_type &= ~HCI_3DH3; 4386 else 4387 pkt_type |= HCI_3DH3; 4388 4389 if (selected_phys & MGMT_PHY_EDR_3M_5SLOT) 4390 pkt_type &= ~HCI_3DH5; 4391 else 4392 pkt_type |= HCI_3DH5; 4393 4394 if (pkt_type != hdev->pkt_type) { 4395 hdev->pkt_type = pkt_type; 4396 changed = true; 4397 } 4398 4399 if ((selected_phys & MGMT_PHY_LE_MASK) == 4400 (get_selected_phys(hdev) & MGMT_PHY_LE_MASK)) { 4401 if (changed) 4402 mgmt_phy_configuration_changed(hdev, sk); 4403 4404 err = mgmt_cmd_complete(sk, hdev->id, 4405 MGMT_OP_SET_PHY_CONFIGURATION, 4406 0, NULL, 0); 4407 4408 goto unlock; 4409 } 4410 4411 cmd = mgmt_pending_new(sk, MGMT_OP_SET_PHY_CONFIGURATION, hdev, data, 4412 len); 4413 if (!cmd) 4414 err = -ENOMEM; 4415 else 4416 err = hci_cmd_sync_queue(hdev, set_default_phy_sync, cmd, 4417 set_default_phy_complete); 4418 4419 if (err < 0) { 4420 err = mgmt_cmd_status(sk, hdev->id, 4421 MGMT_OP_SET_PHY_CONFIGURATION, 4422 MGMT_STATUS_FAILED); 4423 4424 if (cmd) 4425 mgmt_pending_remove(cmd); 4426 } 4427 4428 unlock: 4429 hci_dev_unlock(hdev); 4430 4431 return err; 4432 } 4433 4434 static int set_blocked_keys(struct sock *sk, struct hci_dev *hdev, void *data, 4435 u16 len) 4436 { 4437 int err = MGMT_STATUS_SUCCESS; 4438 struct mgmt_cp_set_blocked_keys *keys = data; 4439 const u16 max_key_count = ((U16_MAX - sizeof(*keys)) / 4440 sizeof(struct mgmt_blocked_key_info)); 4441 u16 key_count, expected_len; 4442 int i; 4443 4444 bt_dev_dbg(hdev, "sock %p", sk); 4445 4446 key_count = __le16_to_cpu(keys->key_count); 4447 if (key_count > max_key_count) { 4448 bt_dev_err(hdev, "too big key_count value %u", key_count); 4449 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BLOCKED_KEYS, 4450 MGMT_STATUS_INVALID_PARAMS); 4451 } 4452 4453 expected_len = struct_size(keys, keys, key_count); 4454 if (expected_len != len) { 4455 bt_dev_err(hdev, "expected %u bytes, got %u bytes", 4456 expected_len, len); 4457 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BLOCKED_KEYS, 4458 MGMT_STATUS_INVALID_PARAMS); 4459 } 4460 4461 hci_dev_lock(hdev); 4462 4463 hci_blocked_keys_clear(hdev); 4464 4465 for (i = 0; i < key_count; ++i) { 4466 struct blocked_key *b = kzalloc_obj(*b); 4467 4468 if (!b) { 4469 err = MGMT_STATUS_NO_RESOURCES; 4470 break; 4471 } 4472 4473 b->type = keys->keys[i].type; 4474 memcpy(b->val, keys->keys[i].val, sizeof(b->val)); 4475 list_add_rcu(&b->list, &hdev->blocked_keys); 4476 } 4477 hci_dev_unlock(hdev); 4478 4479 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_BLOCKED_KEYS, 4480 err, NULL, 0); 4481 } 4482 4483 static int set_wideband_speech(struct sock *sk, struct hci_dev *hdev, 4484 void *data, u16 len) 4485 { 4486 struct mgmt_mode *cp = data; 4487 int err; 4488 bool changed = false; 4489 4490 bt_dev_dbg(hdev, "sock %p", sk); 4491 4492 if (!hci_test_quirk(hdev, HCI_QUIRK_WIDEBAND_SPEECH_SUPPORTED)) 4493 return mgmt_cmd_status(sk, hdev->id, 4494 MGMT_OP_SET_WIDEBAND_SPEECH, 4495 MGMT_STATUS_NOT_SUPPORTED); 4496 4497 if (cp->val != 0x00 && cp->val != 0x01) 4498 return mgmt_cmd_status(sk, hdev->id, 4499 MGMT_OP_SET_WIDEBAND_SPEECH, 4500 MGMT_STATUS_INVALID_PARAMS); 4501 4502 hci_dev_lock(hdev); 4503 4504 if (hdev_is_powered(hdev) && 4505 !!cp->val != hci_dev_test_flag(hdev, 4506 HCI_WIDEBAND_SPEECH_ENABLED)) { 4507 err = mgmt_cmd_status(sk, hdev->id, 4508 MGMT_OP_SET_WIDEBAND_SPEECH, 4509 MGMT_STATUS_REJECTED); 4510 goto unlock; 4511 } 4512 4513 if (cp->val) 4514 changed = !hci_dev_test_and_set_flag(hdev, 4515 HCI_WIDEBAND_SPEECH_ENABLED); 4516 else 4517 changed = hci_dev_test_and_clear_flag(hdev, 4518 HCI_WIDEBAND_SPEECH_ENABLED); 4519 4520 err = send_settings_rsp(sk, MGMT_OP_SET_WIDEBAND_SPEECH, hdev); 4521 if (err < 0) 4522 goto unlock; 4523 4524 if (changed) 4525 err = new_settings(hdev, sk); 4526 4527 unlock: 4528 hci_dev_unlock(hdev); 4529 return err; 4530 } 4531 4532 static int read_controller_cap(struct sock *sk, struct hci_dev *hdev, 4533 void *data, u16 data_len) 4534 { 4535 char buf[20]; 4536 struct mgmt_rp_read_controller_cap *rp = (void *)buf; 4537 u16 cap_len = 0; 4538 u8 flags = 0; 4539 u8 tx_power_range[2]; 4540 4541 bt_dev_dbg(hdev, "sock %p", sk); 4542 4543 memset(&buf, 0, sizeof(buf)); 4544 4545 hci_dev_lock(hdev); 4546 4547 /* When the Read Simple Pairing Options command is supported, then 4548 * the remote public key validation is supported. 4549 * 4550 * Alternatively, when Microsoft extensions are available, they can 4551 * indicate support for public key validation as well. 4552 */ 4553 if ((hdev->commands[41] & 0x08) || msft_curve_validity(hdev)) 4554 flags |= 0x01; /* Remote public key validation (BR/EDR) */ 4555 4556 flags |= 0x02; /* Remote public key validation (LE) */ 4557 4558 /* When the Read Encryption Key Size command is supported, then the 4559 * encryption key size is enforced. 4560 */ 4561 if (hdev->commands[20] & 0x10) 4562 flags |= 0x04; /* Encryption key size enforcement (BR/EDR) */ 4563 4564 flags |= 0x08; /* Encryption key size enforcement (LE) */ 4565 4566 cap_len = eir_append_data(rp->cap, cap_len, MGMT_CAP_SEC_FLAGS, 4567 &flags, 1); 4568 4569 /* When the Read Simple Pairing Options command is supported, then 4570 * also max encryption key size information is provided. 4571 */ 4572 if (hdev->commands[41] & 0x08) 4573 cap_len = eir_append_le16(rp->cap, cap_len, 4574 MGMT_CAP_MAX_ENC_KEY_SIZE, 4575 hdev->max_enc_key_size); 4576 4577 cap_len = eir_append_le16(rp->cap, cap_len, 4578 MGMT_CAP_SMP_MAX_ENC_KEY_SIZE, 4579 SMP_MAX_ENC_KEY_SIZE); 4580 4581 /* Append the min/max LE tx power parameters if we were able to fetch 4582 * it from the controller 4583 */ 4584 if (hdev->commands[38] & 0x80) { 4585 memcpy(&tx_power_range[0], &hdev->min_le_tx_power, 1); 4586 memcpy(&tx_power_range[1], &hdev->max_le_tx_power, 1); 4587 cap_len = eir_append_data(rp->cap, cap_len, MGMT_CAP_LE_TX_PWR, 4588 tx_power_range, 2); 4589 } 4590 4591 rp->cap_len = cpu_to_le16(cap_len); 4592 4593 hci_dev_unlock(hdev); 4594 4595 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_CONTROLLER_CAP, 0, 4596 rp, sizeof(*rp) + cap_len); 4597 } 4598 4599 #ifdef CONFIG_BT_FEATURE_DEBUG 4600 /* d4992530-b9ec-469f-ab01-6c481c47da1c */ 4601 static const u8 debug_uuid[16] = { 4602 0x1c, 0xda, 0x47, 0x1c, 0x48, 0x6c, 0x01, 0xab, 4603 0x9f, 0x46, 0xec, 0xb9, 0x30, 0x25, 0x99, 0xd4, 4604 }; 4605 #endif 4606 4607 /* 330859bc-7506-492d-9370-9a6f0614037f */ 4608 static const u8 quality_report_uuid[16] = { 4609 0x7f, 0x03, 0x14, 0x06, 0x6f, 0x9a, 0x70, 0x93, 4610 0x2d, 0x49, 0x06, 0x75, 0xbc, 0x59, 0x08, 0x33, 4611 }; 4612 4613 /* a6695ace-ee7f-4fb9-881a-5fac66c629af */ 4614 static const u8 offload_codecs_uuid[16] = { 4615 0xaf, 0x29, 0xc6, 0x66, 0xac, 0x5f, 0x1a, 0x88, 4616 0xb9, 0x4f, 0x7f, 0xee, 0xce, 0x5a, 0x69, 0xa6, 4617 }; 4618 4619 /* 671b10b5-42c0-4696-9227-eb28d1b049d6 */ 4620 static const u8 le_simultaneous_roles_uuid[16] = { 4621 0xd6, 0x49, 0xb0, 0xd1, 0x28, 0xeb, 0x27, 0x92, 4622 0x96, 0x46, 0xc0, 0x42, 0xb5, 0x10, 0x1b, 0x67, 4623 }; 4624 4625 /* 6fbaf188-05e0-496a-9885-d6ddfdb4e03e */ 4626 static const u8 iso_socket_uuid[16] = { 4627 0x3e, 0xe0, 0xb4, 0xfd, 0xdd, 0xd6, 0x85, 0x98, 4628 0x6a, 0x49, 0xe0, 0x05, 0x88, 0xf1, 0xba, 0x6f, 4629 }; 4630 4631 /* 2ce463d7-7a03-4d8d-bf05-5f24e8f36e76 */ 4632 static const u8 mgmt_mesh_uuid[16] = { 4633 0x76, 0x6e, 0xf3, 0xe8, 0x24, 0x5f, 0x05, 0xbf, 4634 0x8d, 0x4d, 0x03, 0x7a, 0xd7, 0x63, 0xe4, 0x2c, 4635 }; 4636 4637 static int read_exp_features_info(struct sock *sk, struct hci_dev *hdev, 4638 void *data, u16 data_len) 4639 { 4640 struct mgmt_rp_read_exp_features_info *rp; 4641 size_t len; 4642 u16 idx = 0; 4643 u32 flags; 4644 int status; 4645 4646 bt_dev_dbg(hdev, "sock %p", sk); 4647 4648 /* Enough space for 7 features */ 4649 len = sizeof(*rp) + (sizeof(rp->features[0]) * 7); 4650 rp = kzalloc(len, GFP_KERNEL); 4651 if (!rp) 4652 return -ENOMEM; 4653 4654 #ifdef CONFIG_BT_FEATURE_DEBUG 4655 flags = bt_dbg_get() ? BIT(0) : 0; 4656 4657 memcpy(rp->features[idx].uuid, debug_uuid, 16); 4658 rp->features[idx].flags = cpu_to_le32(flags); 4659 idx++; 4660 #endif 4661 4662 if (hdev && hci_dev_le_state_simultaneous(hdev)) { 4663 if (hci_dev_test_flag(hdev, HCI_LE_SIMULTANEOUS_ROLES)) 4664 flags = BIT(0); 4665 else 4666 flags = 0; 4667 4668 memcpy(rp->features[idx].uuid, le_simultaneous_roles_uuid, 16); 4669 rp->features[idx].flags = cpu_to_le32(flags); 4670 idx++; 4671 } 4672 4673 if (hdev && (aosp_has_quality_report(hdev) || 4674 hdev->set_quality_report)) { 4675 if (hci_dev_test_flag(hdev, HCI_QUALITY_REPORT)) 4676 flags = BIT(0); 4677 else 4678 flags = 0; 4679 4680 memcpy(rp->features[idx].uuid, quality_report_uuid, 16); 4681 rp->features[idx].flags = cpu_to_le32(flags); 4682 idx++; 4683 } 4684 4685 if (hdev && hdev->get_data_path_id) { 4686 if (hci_dev_test_flag(hdev, HCI_OFFLOAD_CODECS_ENABLED)) 4687 flags = BIT(0); 4688 else 4689 flags = 0; 4690 4691 memcpy(rp->features[idx].uuid, offload_codecs_uuid, 16); 4692 rp->features[idx].flags = cpu_to_le32(flags); 4693 idx++; 4694 } 4695 4696 if (IS_ENABLED(CONFIG_BT_LE)) { 4697 flags = iso_inited() ? BIT(0) : 0; 4698 memcpy(rp->features[idx].uuid, iso_socket_uuid, 16); 4699 rp->features[idx].flags = cpu_to_le32(flags); 4700 idx++; 4701 } 4702 4703 if (hdev && lmp_le_capable(hdev)) { 4704 if (hci_dev_test_flag(hdev, HCI_MESH_EXPERIMENTAL)) 4705 flags = BIT(0); 4706 else 4707 flags = 0; 4708 4709 memcpy(rp->features[idx].uuid, mgmt_mesh_uuid, 16); 4710 rp->features[idx].flags = cpu_to_le32(flags); 4711 idx++; 4712 } 4713 4714 rp->feature_count = cpu_to_le16(idx); 4715 4716 /* After reading the experimental features information, enable 4717 * the events to update client on any future change. 4718 */ 4719 hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS); 4720 4721 status = mgmt_cmd_complete(sk, hdev ? hdev->id : MGMT_INDEX_NONE, 4722 MGMT_OP_READ_EXP_FEATURES_INFO, 4723 0, rp, sizeof(*rp) + (20 * idx)); 4724 4725 kfree(rp); 4726 return status; 4727 } 4728 4729 static int exp_feature_changed(struct hci_dev *hdev, const u8 *uuid, 4730 bool enabled, struct sock *skip) 4731 { 4732 struct mgmt_ev_exp_feature_changed ev; 4733 4734 memset(&ev, 0, sizeof(ev)); 4735 memcpy(ev.uuid, uuid, 16); 4736 ev.flags = cpu_to_le32(enabled ? BIT(0) : 0); 4737 4738 return mgmt_limited_event(MGMT_EV_EXP_FEATURE_CHANGED, hdev, 4739 &ev, sizeof(ev), 4740 HCI_MGMT_EXP_FEATURE_EVENTS, skip); 4741 } 4742 4743 #define EXP_FEAT(_uuid, _set_func) \ 4744 { \ 4745 .uuid = _uuid, \ 4746 .set_func = _set_func, \ 4747 } 4748 4749 /* The zero key uuid is special. Multiple exp features are set through it. */ 4750 static int set_zero_key_func(struct sock *sk, struct hci_dev *hdev, 4751 struct mgmt_cp_set_exp_feature *cp, u16 data_len) 4752 { 4753 struct mgmt_rp_set_exp_feature rp; 4754 4755 memset(rp.uuid, 0, 16); 4756 rp.flags = cpu_to_le32(0); 4757 4758 #ifdef CONFIG_BT_FEATURE_DEBUG 4759 if (!hdev) { 4760 bool changed = bt_dbg_get(); 4761 4762 bt_dbg_set(false); 4763 4764 if (changed) 4765 exp_feature_changed(NULL, ZERO_KEY, false, sk); 4766 } 4767 #endif 4768 4769 hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS); 4770 4771 return mgmt_cmd_complete(sk, hdev ? hdev->id : MGMT_INDEX_NONE, 4772 MGMT_OP_SET_EXP_FEATURE, 0, 4773 &rp, sizeof(rp)); 4774 } 4775 4776 #ifdef CONFIG_BT_FEATURE_DEBUG 4777 static int set_debug_func(struct sock *sk, struct hci_dev *hdev, 4778 struct mgmt_cp_set_exp_feature *cp, u16 data_len) 4779 { 4780 struct mgmt_rp_set_exp_feature rp; 4781 4782 bool val, changed; 4783 int err; 4784 4785 /* Command requires to use the non-controller index */ 4786 if (hdev) 4787 return mgmt_cmd_status(sk, hdev->id, 4788 MGMT_OP_SET_EXP_FEATURE, 4789 MGMT_STATUS_INVALID_INDEX); 4790 4791 /* Parameters are limited to a single octet */ 4792 if (data_len != MGMT_SET_EXP_FEATURE_SIZE + 1) 4793 return mgmt_cmd_status(sk, MGMT_INDEX_NONE, 4794 MGMT_OP_SET_EXP_FEATURE, 4795 MGMT_STATUS_INVALID_PARAMS); 4796 4797 /* Only boolean on/off is supported */ 4798 if (cp->param[0] != 0x00 && cp->param[0] != 0x01) 4799 return mgmt_cmd_status(sk, MGMT_INDEX_NONE, 4800 MGMT_OP_SET_EXP_FEATURE, 4801 MGMT_STATUS_INVALID_PARAMS); 4802 4803 val = !!cp->param[0]; 4804 changed = val ? !bt_dbg_get() : bt_dbg_get(); 4805 bt_dbg_set(val); 4806 4807 memcpy(rp.uuid, debug_uuid, 16); 4808 rp.flags = cpu_to_le32(val ? BIT(0) : 0); 4809 4810 hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS); 4811 4812 err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE, 4813 MGMT_OP_SET_EXP_FEATURE, 0, 4814 &rp, sizeof(rp)); 4815 4816 if (changed) 4817 exp_feature_changed(hdev, debug_uuid, val, sk); 4818 4819 return err; 4820 } 4821 #endif 4822 4823 static int set_mgmt_mesh_func(struct sock *sk, struct hci_dev *hdev, 4824 struct mgmt_cp_set_exp_feature *cp, u16 data_len) 4825 { 4826 struct mgmt_rp_set_exp_feature rp; 4827 bool val, changed; 4828 int err; 4829 4830 /* Command requires to use the controller index */ 4831 if (!hdev) 4832 return mgmt_cmd_status(sk, MGMT_INDEX_NONE, 4833 MGMT_OP_SET_EXP_FEATURE, 4834 MGMT_STATUS_INVALID_INDEX); 4835 4836 /* Parameters are limited to a single octet */ 4837 if (data_len != MGMT_SET_EXP_FEATURE_SIZE + 1) 4838 return mgmt_cmd_status(sk, hdev->id, 4839 MGMT_OP_SET_EXP_FEATURE, 4840 MGMT_STATUS_INVALID_PARAMS); 4841 4842 /* Only boolean on/off is supported */ 4843 if (cp->param[0] != 0x00 && cp->param[0] != 0x01) 4844 return mgmt_cmd_status(sk, hdev->id, 4845 MGMT_OP_SET_EXP_FEATURE, 4846 MGMT_STATUS_INVALID_PARAMS); 4847 4848 val = !!cp->param[0]; 4849 4850 if (val) { 4851 changed = !hci_dev_test_and_set_flag(hdev, 4852 HCI_MESH_EXPERIMENTAL); 4853 } else { 4854 hci_dev_clear_flag(hdev, HCI_MESH); 4855 changed = hci_dev_test_and_clear_flag(hdev, 4856 HCI_MESH_EXPERIMENTAL); 4857 } 4858 4859 memcpy(rp.uuid, mgmt_mesh_uuid, 16); 4860 rp.flags = cpu_to_le32(val ? BIT(0) : 0); 4861 4862 hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS); 4863 4864 err = mgmt_cmd_complete(sk, hdev->id, 4865 MGMT_OP_SET_EXP_FEATURE, 0, 4866 &rp, sizeof(rp)); 4867 4868 if (changed) 4869 exp_feature_changed(hdev, mgmt_mesh_uuid, val, sk); 4870 4871 return err; 4872 } 4873 4874 static int set_quality_report_func(struct sock *sk, struct hci_dev *hdev, 4875 struct mgmt_cp_set_exp_feature *cp, 4876 u16 data_len) 4877 { 4878 struct mgmt_rp_set_exp_feature rp; 4879 bool val, changed; 4880 int err; 4881 4882 /* Command requires to use a valid controller index */ 4883 if (!hdev) 4884 return mgmt_cmd_status(sk, MGMT_INDEX_NONE, 4885 MGMT_OP_SET_EXP_FEATURE, 4886 MGMT_STATUS_INVALID_INDEX); 4887 4888 /* Parameters are limited to a single octet */ 4889 if (data_len != MGMT_SET_EXP_FEATURE_SIZE + 1) 4890 return mgmt_cmd_status(sk, hdev->id, 4891 MGMT_OP_SET_EXP_FEATURE, 4892 MGMT_STATUS_INVALID_PARAMS); 4893 4894 /* Only boolean on/off is supported */ 4895 if (cp->param[0] != 0x00 && cp->param[0] != 0x01) 4896 return mgmt_cmd_status(sk, hdev->id, 4897 MGMT_OP_SET_EXP_FEATURE, 4898 MGMT_STATUS_INVALID_PARAMS); 4899 4900 hci_req_sync_lock(hdev); 4901 4902 val = !!cp->param[0]; 4903 changed = (val != hci_dev_test_flag(hdev, HCI_QUALITY_REPORT)); 4904 4905 if (!aosp_has_quality_report(hdev) && !hdev->set_quality_report) { 4906 err = mgmt_cmd_status(sk, hdev->id, 4907 MGMT_OP_SET_EXP_FEATURE, 4908 MGMT_STATUS_NOT_SUPPORTED); 4909 goto unlock_quality_report; 4910 } 4911 4912 if (changed) { 4913 if (hdev->set_quality_report) 4914 err = hdev->set_quality_report(hdev, val); 4915 else 4916 err = aosp_set_quality_report(hdev, val); 4917 4918 if (err) { 4919 err = mgmt_cmd_status(sk, hdev->id, 4920 MGMT_OP_SET_EXP_FEATURE, 4921 MGMT_STATUS_FAILED); 4922 goto unlock_quality_report; 4923 } 4924 4925 if (val) 4926 hci_dev_set_flag(hdev, HCI_QUALITY_REPORT); 4927 else 4928 hci_dev_clear_flag(hdev, HCI_QUALITY_REPORT); 4929 } 4930 4931 bt_dev_dbg(hdev, "quality report enable %d changed %d", val, changed); 4932 4933 memcpy(rp.uuid, quality_report_uuid, 16); 4934 rp.flags = cpu_to_le32(val ? BIT(0) : 0); 4935 hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS); 4936 4937 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_EXP_FEATURE, 0, 4938 &rp, sizeof(rp)); 4939 4940 if (changed) 4941 exp_feature_changed(hdev, quality_report_uuid, val, sk); 4942 4943 unlock_quality_report: 4944 hci_req_sync_unlock(hdev); 4945 return err; 4946 } 4947 4948 static int set_offload_codec_func(struct sock *sk, struct hci_dev *hdev, 4949 struct mgmt_cp_set_exp_feature *cp, 4950 u16 data_len) 4951 { 4952 bool val, changed; 4953 int err; 4954 struct mgmt_rp_set_exp_feature rp; 4955 4956 /* Command requires to use a valid controller index */ 4957 if (!hdev) 4958 return mgmt_cmd_status(sk, MGMT_INDEX_NONE, 4959 MGMT_OP_SET_EXP_FEATURE, 4960 MGMT_STATUS_INVALID_INDEX); 4961 4962 /* Parameters are limited to a single octet */ 4963 if (data_len != MGMT_SET_EXP_FEATURE_SIZE + 1) 4964 return mgmt_cmd_status(sk, hdev->id, 4965 MGMT_OP_SET_EXP_FEATURE, 4966 MGMT_STATUS_INVALID_PARAMS); 4967 4968 /* Only boolean on/off is supported */ 4969 if (cp->param[0] != 0x00 && cp->param[0] != 0x01) 4970 return mgmt_cmd_status(sk, hdev->id, 4971 MGMT_OP_SET_EXP_FEATURE, 4972 MGMT_STATUS_INVALID_PARAMS); 4973 4974 val = !!cp->param[0]; 4975 changed = (val != hci_dev_test_flag(hdev, HCI_OFFLOAD_CODECS_ENABLED)); 4976 4977 if (!hdev->get_data_path_id) { 4978 return mgmt_cmd_status(sk, hdev->id, 4979 MGMT_OP_SET_EXP_FEATURE, 4980 MGMT_STATUS_NOT_SUPPORTED); 4981 } 4982 4983 if (changed) { 4984 if (val) 4985 hci_dev_set_flag(hdev, HCI_OFFLOAD_CODECS_ENABLED); 4986 else 4987 hci_dev_clear_flag(hdev, HCI_OFFLOAD_CODECS_ENABLED); 4988 } 4989 4990 bt_dev_info(hdev, "offload codecs enable %d changed %d", 4991 val, changed); 4992 4993 memcpy(rp.uuid, offload_codecs_uuid, 16); 4994 rp.flags = cpu_to_le32(val ? BIT(0) : 0); 4995 hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS); 4996 err = mgmt_cmd_complete(sk, hdev->id, 4997 MGMT_OP_SET_EXP_FEATURE, 0, 4998 &rp, sizeof(rp)); 4999 5000 if (changed) 5001 exp_feature_changed(hdev, offload_codecs_uuid, val, sk); 5002 5003 return err; 5004 } 5005 5006 static int set_le_simultaneous_roles_func(struct sock *sk, struct hci_dev *hdev, 5007 struct mgmt_cp_set_exp_feature *cp, 5008 u16 data_len) 5009 { 5010 bool val, changed; 5011 int err; 5012 struct mgmt_rp_set_exp_feature rp; 5013 5014 /* Command requires to use a valid controller index */ 5015 if (!hdev) 5016 return mgmt_cmd_status(sk, MGMT_INDEX_NONE, 5017 MGMT_OP_SET_EXP_FEATURE, 5018 MGMT_STATUS_INVALID_INDEX); 5019 5020 /* Parameters are limited to a single octet */ 5021 if (data_len != MGMT_SET_EXP_FEATURE_SIZE + 1) 5022 return mgmt_cmd_status(sk, hdev->id, 5023 MGMT_OP_SET_EXP_FEATURE, 5024 MGMT_STATUS_INVALID_PARAMS); 5025 5026 /* Only boolean on/off is supported */ 5027 if (cp->param[0] != 0x00 && cp->param[0] != 0x01) 5028 return mgmt_cmd_status(sk, hdev->id, 5029 MGMT_OP_SET_EXP_FEATURE, 5030 MGMT_STATUS_INVALID_PARAMS); 5031 5032 val = !!cp->param[0]; 5033 changed = (val != hci_dev_test_flag(hdev, HCI_LE_SIMULTANEOUS_ROLES)); 5034 5035 if (!hci_dev_le_state_simultaneous(hdev)) { 5036 return mgmt_cmd_status(sk, hdev->id, 5037 MGMT_OP_SET_EXP_FEATURE, 5038 MGMT_STATUS_NOT_SUPPORTED); 5039 } 5040 5041 if (changed) { 5042 if (val) 5043 hci_dev_set_flag(hdev, HCI_LE_SIMULTANEOUS_ROLES); 5044 else 5045 hci_dev_clear_flag(hdev, HCI_LE_SIMULTANEOUS_ROLES); 5046 } 5047 5048 bt_dev_info(hdev, "LE simultaneous roles enable %d changed %d", 5049 val, changed); 5050 5051 memcpy(rp.uuid, le_simultaneous_roles_uuid, 16); 5052 rp.flags = cpu_to_le32(val ? BIT(0) : 0); 5053 hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS); 5054 err = mgmt_cmd_complete(sk, hdev->id, 5055 MGMT_OP_SET_EXP_FEATURE, 0, 5056 &rp, sizeof(rp)); 5057 5058 if (changed) 5059 exp_feature_changed(hdev, le_simultaneous_roles_uuid, val, sk); 5060 5061 return err; 5062 } 5063 5064 #ifdef CONFIG_BT_LE 5065 static int set_iso_socket_func(struct sock *sk, struct hci_dev *hdev, 5066 struct mgmt_cp_set_exp_feature *cp, u16 data_len) 5067 { 5068 struct mgmt_rp_set_exp_feature rp; 5069 bool val, changed = false; 5070 int err; 5071 5072 /* Command requires to use the non-controller index */ 5073 if (hdev) 5074 return mgmt_cmd_status(sk, hdev->id, 5075 MGMT_OP_SET_EXP_FEATURE, 5076 MGMT_STATUS_INVALID_INDEX); 5077 5078 /* Parameters are limited to a single octet */ 5079 if (data_len != MGMT_SET_EXP_FEATURE_SIZE + 1) 5080 return mgmt_cmd_status(sk, MGMT_INDEX_NONE, 5081 MGMT_OP_SET_EXP_FEATURE, 5082 MGMT_STATUS_INVALID_PARAMS); 5083 5084 /* Only boolean on/off is supported */ 5085 if (cp->param[0] != 0x00 && cp->param[0] != 0x01) 5086 return mgmt_cmd_status(sk, MGMT_INDEX_NONE, 5087 MGMT_OP_SET_EXP_FEATURE, 5088 MGMT_STATUS_INVALID_PARAMS); 5089 5090 val = cp->param[0] ? true : false; 5091 if (val) 5092 err = iso_init(); 5093 else 5094 err = iso_exit(); 5095 5096 if (!err) 5097 changed = true; 5098 5099 memcpy(rp.uuid, iso_socket_uuid, 16); 5100 rp.flags = cpu_to_le32(val ? BIT(0) : 0); 5101 5102 hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS); 5103 5104 err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE, 5105 MGMT_OP_SET_EXP_FEATURE, 0, 5106 &rp, sizeof(rp)); 5107 5108 if (changed) 5109 exp_feature_changed(hdev, iso_socket_uuid, val, sk); 5110 5111 return err; 5112 } 5113 #endif 5114 5115 static const struct mgmt_exp_feature { 5116 const u8 *uuid; 5117 int (*set_func)(struct sock *sk, struct hci_dev *hdev, 5118 struct mgmt_cp_set_exp_feature *cp, u16 data_len); 5119 } exp_features[] = { 5120 EXP_FEAT(ZERO_KEY, set_zero_key_func), 5121 #ifdef CONFIG_BT_FEATURE_DEBUG 5122 EXP_FEAT(debug_uuid, set_debug_func), 5123 #endif 5124 EXP_FEAT(mgmt_mesh_uuid, set_mgmt_mesh_func), 5125 EXP_FEAT(quality_report_uuid, set_quality_report_func), 5126 EXP_FEAT(offload_codecs_uuid, set_offload_codec_func), 5127 EXP_FEAT(le_simultaneous_roles_uuid, set_le_simultaneous_roles_func), 5128 #ifdef CONFIG_BT_LE 5129 EXP_FEAT(iso_socket_uuid, set_iso_socket_func), 5130 #endif 5131 5132 /* end with a null feature */ 5133 EXP_FEAT(NULL, NULL) 5134 }; 5135 5136 static int set_exp_feature(struct sock *sk, struct hci_dev *hdev, 5137 void *data, u16 data_len) 5138 { 5139 struct mgmt_cp_set_exp_feature *cp = data; 5140 size_t i = 0; 5141 5142 bt_dev_dbg(hdev, "sock %p", sk); 5143 5144 for (i = 0; exp_features[i].uuid; i++) { 5145 if (!memcmp(cp->uuid, exp_features[i].uuid, 16)) 5146 return exp_features[i].set_func(sk, hdev, cp, data_len); 5147 } 5148 5149 return mgmt_cmd_status(sk, hdev ? hdev->id : MGMT_INDEX_NONE, 5150 MGMT_OP_SET_EXP_FEATURE, 5151 MGMT_STATUS_NOT_SUPPORTED); 5152 } 5153 5154 static int get_device_flags(struct sock *sk, struct hci_dev *hdev, void *data, 5155 u16 data_len) 5156 { 5157 struct mgmt_cp_get_device_flags *cp = data; 5158 struct mgmt_rp_get_device_flags rp; 5159 struct bdaddr_list_with_flags *br_params; 5160 struct hci_conn_params *params; 5161 u32 supported_flags; 5162 u32 current_flags = 0; 5163 u8 status = MGMT_STATUS_INVALID_PARAMS; 5164 5165 bt_dev_dbg(hdev, "Get device flags %pMR (type 0x%x)\n", 5166 &cp->addr.bdaddr, cp->addr.type); 5167 5168 hci_dev_lock(hdev); 5169 5170 supported_flags = hdev->conn_flags; 5171 5172 memset(&rp, 0, sizeof(rp)); 5173 5174 if (cp->addr.type == BDADDR_BREDR) { 5175 br_params = hci_bdaddr_list_lookup_with_flags(&hdev->accept_list, 5176 &cp->addr.bdaddr, 5177 cp->addr.type); 5178 if (!br_params) 5179 goto done; 5180 5181 current_flags = br_params->flags; 5182 } else { 5183 params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr, 5184 le_addr_type(cp->addr.type)); 5185 if (!params) 5186 goto done; 5187 5188 current_flags = params->flags; 5189 } 5190 5191 bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr); 5192 rp.addr.type = cp->addr.type; 5193 rp.supported_flags = cpu_to_le32(supported_flags); 5194 rp.current_flags = cpu_to_le32(current_flags); 5195 5196 status = MGMT_STATUS_SUCCESS; 5197 5198 done: 5199 hci_dev_unlock(hdev); 5200 5201 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_DEVICE_FLAGS, status, 5202 &rp, sizeof(rp)); 5203 } 5204 5205 static void device_flags_changed(struct sock *sk, struct hci_dev *hdev, 5206 bdaddr_t *bdaddr, u8 bdaddr_type, 5207 u32 supported_flags, u32 current_flags) 5208 { 5209 struct mgmt_ev_device_flags_changed ev; 5210 5211 bacpy(&ev.addr.bdaddr, bdaddr); 5212 ev.addr.type = bdaddr_type; 5213 ev.supported_flags = cpu_to_le32(supported_flags); 5214 ev.current_flags = cpu_to_le32(current_flags); 5215 5216 mgmt_event(MGMT_EV_DEVICE_FLAGS_CHANGED, hdev, &ev, sizeof(ev), sk); 5217 } 5218 5219 static bool is_connected(struct hci_dev *hdev, bdaddr_t *addr, u8 type) 5220 { 5221 struct hci_conn *conn; 5222 5223 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, addr); 5224 if (!conn) 5225 return false; 5226 5227 if (conn->dst_type != type) 5228 return false; 5229 5230 if (conn->state != BT_CONNECTED) 5231 return false; 5232 5233 return true; 5234 } 5235 5236 /* This function requires the caller holds hdev->lock */ 5237 static struct hci_conn_params *hci_conn_params_set(struct hci_dev *hdev, 5238 bdaddr_t *addr, u8 addr_type, 5239 u8 auto_connect) 5240 { 5241 struct hci_conn_params *params; 5242 5243 params = hci_conn_params_add(hdev, addr, addr_type); 5244 if (!params) 5245 return NULL; 5246 5247 if (params->auto_connect == auto_connect) 5248 return params; 5249 5250 hci_pend_le_list_del_init(params); 5251 5252 switch (auto_connect) { 5253 case HCI_AUTO_CONN_DISABLED: 5254 case HCI_AUTO_CONN_LINK_LOSS: 5255 /* If auto connect is being disabled when we're trying to 5256 * connect to device, keep connecting. 5257 */ 5258 if (params->explicit_connect) 5259 hci_pend_le_list_add(params, &hdev->pend_le_conns); 5260 break; 5261 case HCI_AUTO_CONN_REPORT: 5262 if (params->explicit_connect) 5263 hci_pend_le_list_add(params, &hdev->pend_le_conns); 5264 else 5265 hci_pend_le_list_add(params, &hdev->pend_le_reports); 5266 break; 5267 case HCI_AUTO_CONN_DIRECT: 5268 case HCI_AUTO_CONN_ALWAYS: 5269 if (!is_connected(hdev, addr, addr_type)) 5270 hci_pend_le_list_add(params, &hdev->pend_le_conns); 5271 break; 5272 } 5273 5274 params->auto_connect = auto_connect; 5275 5276 bt_dev_dbg(hdev, "addr %pMR (type %u) auto_connect %u", 5277 addr, addr_type, auto_connect); 5278 5279 return params; 5280 } 5281 5282 static int set_device_flags(struct sock *sk, struct hci_dev *hdev, void *data, 5283 u16 len) 5284 { 5285 struct mgmt_cp_set_device_flags *cp = data; 5286 struct bdaddr_list_with_flags *br_params; 5287 struct hci_conn_params *params; 5288 u8 status = MGMT_STATUS_INVALID_PARAMS; 5289 u32 supported_flags; 5290 u32 current_flags = __le32_to_cpu(cp->current_flags); 5291 5292 bt_dev_dbg(hdev, "Set device flags %pMR (type 0x%x) = 0x%x", 5293 &cp->addr.bdaddr, cp->addr.type, current_flags); 5294 5295 // We should take hci_dev_lock() early, I think.. conn_flags can change 5296 supported_flags = hdev->conn_flags; 5297 5298 if ((supported_flags | current_flags) != supported_flags) { 5299 bt_dev_warn(hdev, "Bad flag given (0x%x) vs supported (0x%0x)", 5300 current_flags, supported_flags); 5301 goto done; 5302 } 5303 5304 hci_dev_lock(hdev); 5305 5306 if (cp->addr.type == BDADDR_BREDR) { 5307 br_params = hci_bdaddr_list_lookup_with_flags(&hdev->accept_list, 5308 &cp->addr.bdaddr, 5309 cp->addr.type); 5310 5311 if (br_params) { 5312 br_params->flags = current_flags; 5313 status = MGMT_STATUS_SUCCESS; 5314 } else { 5315 bt_dev_warn(hdev, "No such BR/EDR device %pMR (0x%x)", 5316 &cp->addr.bdaddr, cp->addr.type); 5317 } 5318 5319 goto unlock; 5320 } 5321 5322 params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr, 5323 le_addr_type(cp->addr.type)); 5324 if (!params) { 5325 /* Create a new hci_conn_params if it doesn't exist */ 5326 params = hci_conn_params_set(hdev, &cp->addr.bdaddr, 5327 le_addr_type(cp->addr.type), 5328 HCI_AUTO_CONN_DISABLED); 5329 if (!params) { 5330 bt_dev_warn(hdev, "No such LE device %pMR (0x%x)", 5331 &cp->addr.bdaddr, 5332 le_addr_type(cp->addr.type)); 5333 goto unlock; 5334 } 5335 } 5336 5337 supported_flags = hdev->conn_flags; 5338 5339 if ((supported_flags | current_flags) != supported_flags) { 5340 bt_dev_warn(hdev, "Bad flag given (0x%x) vs supported (0x%0x)", 5341 current_flags, supported_flags); 5342 goto unlock; 5343 } 5344 5345 WRITE_ONCE(params->flags, current_flags); 5346 status = MGMT_STATUS_SUCCESS; 5347 5348 /* Update passive scan if HCI_CONN_FLAG_DEVICE_PRIVACY 5349 * has been set. 5350 */ 5351 if (params->flags & HCI_CONN_FLAG_DEVICE_PRIVACY) 5352 hci_update_passive_scan(hdev); 5353 5354 unlock: 5355 hci_dev_unlock(hdev); 5356 5357 done: 5358 if (status == MGMT_STATUS_SUCCESS) 5359 device_flags_changed(sk, hdev, &cp->addr.bdaddr, cp->addr.type, 5360 supported_flags, current_flags); 5361 5362 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_DEVICE_FLAGS, status, 5363 &cp->addr, sizeof(cp->addr)); 5364 } 5365 5366 static void mgmt_adv_monitor_added(struct sock *sk, struct hci_dev *hdev, 5367 u16 handle) 5368 { 5369 struct mgmt_ev_adv_monitor_added ev; 5370 5371 ev.monitor_handle = cpu_to_le16(handle); 5372 5373 mgmt_event(MGMT_EV_ADV_MONITOR_ADDED, hdev, &ev, sizeof(ev), sk); 5374 } 5375 5376 static void mgmt_adv_monitor_removed(struct sock *sk, struct hci_dev *hdev, 5377 __le16 handle) 5378 { 5379 struct mgmt_ev_adv_monitor_removed ev; 5380 5381 ev.monitor_handle = handle; 5382 5383 mgmt_event(MGMT_EV_ADV_MONITOR_REMOVED, hdev, &ev, sizeof(ev), sk); 5384 } 5385 5386 static int read_adv_mon_features(struct sock *sk, struct hci_dev *hdev, 5387 void *data, u16 len) 5388 { 5389 struct adv_monitor *monitor = NULL; 5390 struct mgmt_rp_read_adv_monitor_features *rp = NULL; 5391 int handle, err; 5392 size_t rp_size = 0; 5393 __u32 supported = 0; 5394 __u32 enabled = 0; 5395 __u16 num_handles = 0; 5396 __u16 handles[HCI_MAX_ADV_MONITOR_NUM_HANDLES]; 5397 5398 BT_DBG("request for %s", hdev->name); 5399 5400 hci_dev_lock(hdev); 5401 5402 if (msft_monitor_supported(hdev)) 5403 supported |= MGMT_ADV_MONITOR_FEATURE_MASK_OR_PATTERNS; 5404 5405 idr_for_each_entry(&hdev->adv_monitors_idr, monitor, handle) 5406 handles[num_handles++] = monitor->handle; 5407 5408 hci_dev_unlock(hdev); 5409 5410 rp_size = sizeof(*rp) + (num_handles * sizeof(u16)); 5411 rp = kmalloc(rp_size, GFP_KERNEL); 5412 if (!rp) 5413 return -ENOMEM; 5414 5415 /* All supported features are currently enabled */ 5416 enabled = supported; 5417 5418 rp->supported_features = cpu_to_le32(supported); 5419 rp->enabled_features = cpu_to_le32(enabled); 5420 rp->max_num_handles = cpu_to_le16(HCI_MAX_ADV_MONITOR_NUM_HANDLES); 5421 rp->max_num_patterns = HCI_MAX_ADV_MONITOR_NUM_PATTERNS; 5422 rp->num_handles = cpu_to_le16(num_handles); 5423 if (num_handles) 5424 memcpy(&rp->handles, &handles, (num_handles * sizeof(u16))); 5425 5426 err = mgmt_cmd_complete(sk, hdev->id, 5427 MGMT_OP_READ_ADV_MONITOR_FEATURES, 5428 MGMT_STATUS_SUCCESS, rp, rp_size); 5429 5430 kfree(rp); 5431 5432 return err; 5433 } 5434 5435 static void mgmt_add_adv_patterns_monitor_complete(struct hci_dev *hdev, 5436 void *data, int status) 5437 { 5438 struct mgmt_rp_add_adv_patterns_monitor rp; 5439 struct mgmt_pending_cmd *cmd = data; 5440 struct adv_monitor *monitor; 5441 5442 /* This is likely the result of hdev being closed and mgmt_index_removed 5443 * is attempting to clean up any pending command so 5444 * hci_adv_monitors_clear is about to be called which will take care of 5445 * freeing the adv_monitor instances. 5446 */ 5447 if (status == -ECANCELED || !mgmt_pending_valid(hdev, cmd)) 5448 return; 5449 5450 monitor = cmd->user_data; 5451 5452 hci_dev_lock(hdev); 5453 5454 rp.monitor_handle = cpu_to_le16(monitor->handle); 5455 5456 if (!status) { 5457 mgmt_adv_monitor_added(cmd->sk, hdev, monitor->handle); 5458 hdev->adv_monitors_cnt++; 5459 if (monitor->state == ADV_MONITOR_STATE_NOT_REGISTERED) 5460 monitor->state = ADV_MONITOR_STATE_REGISTERED; 5461 hci_update_passive_scan(hdev); 5462 } else { 5463 hci_free_adv_monitor(hdev, monitor); 5464 } 5465 5466 mgmt_cmd_complete(cmd->sk, cmd->hdev->id, cmd->opcode, 5467 mgmt_status(status), &rp, sizeof(rp)); 5468 mgmt_pending_free(cmd); 5469 5470 hci_dev_unlock(hdev); 5471 bt_dev_dbg(hdev, "add monitor %d complete, status %d", 5472 rp.monitor_handle, status); 5473 } 5474 5475 static int mgmt_add_adv_patterns_monitor_sync(struct hci_dev *hdev, void *data) 5476 { 5477 struct mgmt_pending_cmd *cmd = data; 5478 struct adv_monitor *mon; 5479 5480 mutex_lock(&hdev->mgmt_pending_lock); 5481 5482 if (!__mgmt_pending_listed(hdev, cmd)) { 5483 mutex_unlock(&hdev->mgmt_pending_lock); 5484 return -ECANCELED; 5485 } 5486 5487 mon = cmd->user_data; 5488 5489 mutex_unlock(&hdev->mgmt_pending_lock); 5490 5491 return hci_add_adv_monitor(hdev, mon); 5492 } 5493 5494 static int __add_adv_patterns_monitor(struct sock *sk, struct hci_dev *hdev, 5495 struct adv_monitor *m, u8 status, 5496 void *data, u16 len, u16 op) 5497 { 5498 struct mgmt_pending_cmd *cmd; 5499 int err; 5500 5501 hci_dev_lock(hdev); 5502 5503 if (status) 5504 goto unlock; 5505 5506 if (pending_find(MGMT_OP_SET_LE, hdev) || 5507 pending_find(MGMT_OP_ADD_ADV_PATTERNS_MONITOR, hdev) || 5508 pending_find(MGMT_OP_ADD_ADV_PATTERNS_MONITOR_RSSI, hdev)) { 5509 status = MGMT_STATUS_BUSY; 5510 goto unlock; 5511 } 5512 5513 cmd = mgmt_pending_add(sk, op, hdev, data, len); 5514 if (!cmd) { 5515 status = MGMT_STATUS_NO_RESOURCES; 5516 goto unlock; 5517 } 5518 5519 cmd->user_data = m; 5520 err = hci_cmd_sync_queue(hdev, mgmt_add_adv_patterns_monitor_sync, cmd, 5521 mgmt_add_adv_patterns_monitor_complete); 5522 if (err) { 5523 if (err == -ENOMEM) 5524 status = MGMT_STATUS_NO_RESOURCES; 5525 else 5526 status = MGMT_STATUS_FAILED; 5527 5528 goto unlock; 5529 } 5530 5531 hci_dev_unlock(hdev); 5532 5533 return 0; 5534 5535 unlock: 5536 hci_free_adv_monitor(hdev, m); 5537 hci_dev_unlock(hdev); 5538 return mgmt_cmd_status(sk, hdev->id, op, status); 5539 } 5540 5541 static void parse_adv_monitor_rssi(struct adv_monitor *m, 5542 struct mgmt_adv_rssi_thresholds *rssi) 5543 { 5544 if (rssi) { 5545 m->rssi.low_threshold = rssi->low_threshold; 5546 m->rssi.low_threshold_timeout = 5547 __le16_to_cpu(rssi->low_threshold_timeout); 5548 m->rssi.high_threshold = rssi->high_threshold; 5549 m->rssi.high_threshold_timeout = 5550 __le16_to_cpu(rssi->high_threshold_timeout); 5551 m->rssi.sampling_period = rssi->sampling_period; 5552 } else { 5553 /* Default values. These numbers are the least constricting 5554 * parameters for MSFT API to work, so it behaves as if there 5555 * are no rssi parameter to consider. May need to be changed 5556 * if other API are to be supported. 5557 */ 5558 m->rssi.low_threshold = -127; 5559 m->rssi.low_threshold_timeout = 60; 5560 m->rssi.high_threshold = -127; 5561 m->rssi.high_threshold_timeout = 0; 5562 m->rssi.sampling_period = 0; 5563 } 5564 } 5565 5566 static u8 parse_adv_monitor_pattern(struct adv_monitor *m, u8 pattern_count, 5567 struct mgmt_adv_pattern *patterns) 5568 { 5569 u8 offset = 0, length = 0; 5570 struct adv_pattern *p = NULL; 5571 int i; 5572 5573 for (i = 0; i < pattern_count; i++) { 5574 offset = patterns[i].offset; 5575 length = patterns[i].length; 5576 if (offset >= HCI_MAX_AD_LENGTH || 5577 length > HCI_MAX_AD_LENGTH || 5578 (offset + length) > HCI_MAX_AD_LENGTH) 5579 return MGMT_STATUS_INVALID_PARAMS; 5580 5581 p = kmalloc_obj(*p); 5582 if (!p) 5583 return MGMT_STATUS_NO_RESOURCES; 5584 5585 p->ad_type = patterns[i].ad_type; 5586 p->offset = patterns[i].offset; 5587 p->length = patterns[i].length; 5588 memcpy(p->value, patterns[i].value, p->length); 5589 5590 INIT_LIST_HEAD(&p->list); 5591 list_add(&p->list, &m->patterns); 5592 } 5593 5594 return MGMT_STATUS_SUCCESS; 5595 } 5596 5597 static int add_adv_patterns_monitor(struct sock *sk, struct hci_dev *hdev, 5598 void *data, u16 len) 5599 { 5600 struct mgmt_cp_add_adv_patterns_monitor *cp = data; 5601 struct adv_monitor *m = NULL; 5602 u8 status = MGMT_STATUS_SUCCESS; 5603 size_t expected_size = sizeof(*cp); 5604 5605 BT_DBG("request for %s", hdev->name); 5606 5607 if (len <= sizeof(*cp)) { 5608 status = MGMT_STATUS_INVALID_PARAMS; 5609 goto done; 5610 } 5611 5612 expected_size += cp->pattern_count * sizeof(struct mgmt_adv_pattern); 5613 if (len != expected_size) { 5614 status = MGMT_STATUS_INVALID_PARAMS; 5615 goto done; 5616 } 5617 5618 m = kzalloc_obj(*m); 5619 if (!m) { 5620 status = MGMT_STATUS_NO_RESOURCES; 5621 goto done; 5622 } 5623 5624 INIT_LIST_HEAD(&m->patterns); 5625 5626 parse_adv_monitor_rssi(m, NULL); 5627 status = parse_adv_monitor_pattern(m, cp->pattern_count, cp->patterns); 5628 5629 done: 5630 return __add_adv_patterns_monitor(sk, hdev, m, status, data, len, 5631 MGMT_OP_ADD_ADV_PATTERNS_MONITOR); 5632 } 5633 5634 static int add_adv_patterns_monitor_rssi(struct sock *sk, struct hci_dev *hdev, 5635 void *data, u16 len) 5636 { 5637 struct mgmt_cp_add_adv_patterns_monitor_rssi *cp = data; 5638 struct adv_monitor *m = NULL; 5639 u8 status = MGMT_STATUS_SUCCESS; 5640 size_t expected_size = sizeof(*cp); 5641 5642 BT_DBG("request for %s", hdev->name); 5643 5644 if (len <= sizeof(*cp)) { 5645 status = MGMT_STATUS_INVALID_PARAMS; 5646 goto done; 5647 } 5648 5649 expected_size += cp->pattern_count * sizeof(struct mgmt_adv_pattern); 5650 if (len != expected_size) { 5651 status = MGMT_STATUS_INVALID_PARAMS; 5652 goto done; 5653 } 5654 5655 m = kzalloc_obj(*m); 5656 if (!m) { 5657 status = MGMT_STATUS_NO_RESOURCES; 5658 goto done; 5659 } 5660 5661 INIT_LIST_HEAD(&m->patterns); 5662 5663 parse_adv_monitor_rssi(m, &cp->rssi); 5664 status = parse_adv_monitor_pattern(m, cp->pattern_count, cp->patterns); 5665 5666 done: 5667 return __add_adv_patterns_monitor(sk, hdev, m, status, data, len, 5668 MGMT_OP_ADD_ADV_PATTERNS_MONITOR_RSSI); 5669 } 5670 5671 static void mgmt_remove_adv_monitor_complete(struct hci_dev *hdev, 5672 void *data, int status) 5673 { 5674 struct mgmt_rp_remove_adv_monitor rp; 5675 struct mgmt_pending_cmd *cmd = data; 5676 struct mgmt_cp_remove_adv_monitor *cp; 5677 5678 if (status == -ECANCELED) 5679 return; 5680 5681 hci_dev_lock(hdev); 5682 5683 cp = cmd->param; 5684 5685 rp.monitor_handle = cp->monitor_handle; 5686 5687 if (!status) { 5688 mgmt_adv_monitor_removed(cmd->sk, hdev, cp->monitor_handle); 5689 hci_update_passive_scan(hdev); 5690 } 5691 5692 mgmt_cmd_complete(cmd->sk, cmd->hdev->id, cmd->opcode, 5693 mgmt_status(status), &rp, sizeof(rp)); 5694 mgmt_pending_free(cmd); 5695 5696 hci_dev_unlock(hdev); 5697 bt_dev_dbg(hdev, "remove monitor %d complete, status %d", 5698 rp.monitor_handle, status); 5699 } 5700 5701 static int mgmt_remove_adv_monitor_sync(struct hci_dev *hdev, void *data) 5702 { 5703 struct mgmt_pending_cmd *cmd = data; 5704 struct mgmt_cp_remove_adv_monitor *cp = cmd->param; 5705 u16 handle = __le16_to_cpu(cp->monitor_handle); 5706 5707 if (!handle) 5708 return hci_remove_all_adv_monitor(hdev); 5709 5710 return hci_remove_single_adv_monitor(hdev, handle); 5711 } 5712 5713 static int remove_adv_monitor(struct sock *sk, struct hci_dev *hdev, 5714 void *data, u16 len) 5715 { 5716 struct mgmt_pending_cmd *cmd; 5717 int err, status; 5718 5719 hci_dev_lock(hdev); 5720 5721 if (pending_find(MGMT_OP_SET_LE, hdev) || 5722 pending_find(MGMT_OP_ADD_ADV_PATTERNS_MONITOR, hdev) || 5723 pending_find(MGMT_OP_ADD_ADV_PATTERNS_MONITOR_RSSI, hdev)) { 5724 status = MGMT_STATUS_BUSY; 5725 goto unlock; 5726 } 5727 5728 cmd = mgmt_pending_new(sk, MGMT_OP_REMOVE_ADV_MONITOR, hdev, data, len); 5729 if (!cmd) { 5730 status = MGMT_STATUS_NO_RESOURCES; 5731 goto unlock; 5732 } 5733 5734 err = hci_cmd_sync_submit(hdev, mgmt_remove_adv_monitor_sync, cmd, 5735 mgmt_remove_adv_monitor_complete); 5736 5737 if (err) { 5738 mgmt_pending_free(cmd); 5739 5740 if (err == -ENOMEM) 5741 status = MGMT_STATUS_NO_RESOURCES; 5742 else 5743 status = MGMT_STATUS_FAILED; 5744 5745 goto unlock; 5746 } 5747 5748 hci_dev_unlock(hdev); 5749 5750 return 0; 5751 5752 unlock: 5753 hci_dev_unlock(hdev); 5754 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_ADV_MONITOR, 5755 status); 5756 } 5757 5758 static void read_local_oob_data_complete(struct hci_dev *hdev, void *data, 5759 int err) 5760 { 5761 struct mgmt_rp_read_local_oob_data mgmt_rp; 5762 size_t rp_size = sizeof(mgmt_rp); 5763 struct mgmt_pending_cmd *cmd = data; 5764 struct sk_buff *skb = cmd->skb; 5765 u8 status = mgmt_status(err); 5766 5767 if (!status) { 5768 if (!skb) 5769 status = MGMT_STATUS_FAILED; 5770 else if (IS_ERR(skb)) 5771 status = mgmt_status(PTR_ERR(skb)); 5772 else 5773 status = mgmt_status(skb->data[0]); 5774 } 5775 5776 bt_dev_dbg(hdev, "status %d", status); 5777 5778 if (status) { 5779 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA, 5780 status); 5781 goto remove; 5782 } 5783 5784 memset(&mgmt_rp, 0, sizeof(mgmt_rp)); 5785 5786 if (!bredr_sc_enabled(hdev)) { 5787 struct hci_rp_read_local_oob_data *rp = (void *) skb->data; 5788 5789 if (skb->len < sizeof(*rp)) { 5790 mgmt_cmd_status(cmd->sk, hdev->id, 5791 MGMT_OP_READ_LOCAL_OOB_DATA, 5792 MGMT_STATUS_FAILED); 5793 goto remove; 5794 } 5795 5796 memcpy(mgmt_rp.hash192, rp->hash, sizeof(rp->hash)); 5797 memcpy(mgmt_rp.rand192, rp->rand, sizeof(rp->rand)); 5798 5799 rp_size -= sizeof(mgmt_rp.hash256) + sizeof(mgmt_rp.rand256); 5800 } else { 5801 struct hci_rp_read_local_oob_ext_data *rp = (void *) skb->data; 5802 5803 if (skb->len < sizeof(*rp)) { 5804 mgmt_cmd_status(cmd->sk, hdev->id, 5805 MGMT_OP_READ_LOCAL_OOB_DATA, 5806 MGMT_STATUS_FAILED); 5807 goto remove; 5808 } 5809 5810 memcpy(mgmt_rp.hash192, rp->hash192, sizeof(rp->hash192)); 5811 memcpy(mgmt_rp.rand192, rp->rand192, sizeof(rp->rand192)); 5812 5813 memcpy(mgmt_rp.hash256, rp->hash256, sizeof(rp->hash256)); 5814 memcpy(mgmt_rp.rand256, rp->rand256, sizeof(rp->rand256)); 5815 } 5816 5817 mgmt_cmd_complete(cmd->sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA, 5818 MGMT_STATUS_SUCCESS, &mgmt_rp, rp_size); 5819 5820 remove: 5821 if (skb && !IS_ERR(skb)) 5822 kfree_skb(skb); 5823 5824 mgmt_pending_free(cmd); 5825 } 5826 5827 static int read_local_oob_data_sync(struct hci_dev *hdev, void *data) 5828 { 5829 struct mgmt_pending_cmd *cmd = data; 5830 5831 if (bredr_sc_enabled(hdev)) 5832 cmd->skb = hci_read_local_oob_data_sync(hdev, true, cmd->sk); 5833 else 5834 cmd->skb = hci_read_local_oob_data_sync(hdev, false, cmd->sk); 5835 5836 if (IS_ERR(cmd->skb)) 5837 return PTR_ERR(cmd->skb); 5838 else 5839 return 0; 5840 } 5841 5842 static int read_local_oob_data(struct sock *sk, struct hci_dev *hdev, 5843 void *data, u16 data_len) 5844 { 5845 struct mgmt_pending_cmd *cmd; 5846 int err; 5847 5848 bt_dev_dbg(hdev, "sock %p", sk); 5849 5850 hci_dev_lock(hdev); 5851 5852 if (!hdev_is_powered(hdev)) { 5853 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA, 5854 MGMT_STATUS_NOT_POWERED); 5855 goto unlock; 5856 } 5857 5858 if (!lmp_ssp_capable(hdev)) { 5859 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA, 5860 MGMT_STATUS_NOT_SUPPORTED); 5861 goto unlock; 5862 } 5863 5864 cmd = mgmt_pending_new(sk, MGMT_OP_READ_LOCAL_OOB_DATA, hdev, NULL, 0); 5865 if (!cmd) 5866 err = -ENOMEM; 5867 else 5868 err = hci_cmd_sync_queue(hdev, read_local_oob_data_sync, cmd, 5869 read_local_oob_data_complete); 5870 5871 if (err < 0) { 5872 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA, 5873 MGMT_STATUS_FAILED); 5874 5875 if (cmd) 5876 mgmt_pending_free(cmd); 5877 } 5878 5879 unlock: 5880 hci_dev_unlock(hdev); 5881 return err; 5882 } 5883 5884 static int add_remote_oob_data(struct sock *sk, struct hci_dev *hdev, 5885 void *data, u16 len) 5886 { 5887 struct mgmt_addr_info *addr = data; 5888 int err; 5889 5890 bt_dev_dbg(hdev, "sock %p", sk); 5891 5892 if (!bdaddr_type_is_valid(addr->type)) 5893 return mgmt_cmd_complete(sk, hdev->id, 5894 MGMT_OP_ADD_REMOTE_OOB_DATA, 5895 MGMT_STATUS_INVALID_PARAMS, 5896 addr, sizeof(*addr)); 5897 5898 hci_dev_lock(hdev); 5899 5900 if (len == MGMT_ADD_REMOTE_OOB_DATA_SIZE) { 5901 struct mgmt_cp_add_remote_oob_data *cp = data; 5902 u8 status; 5903 5904 if (cp->addr.type != BDADDR_BREDR) { 5905 err = mgmt_cmd_complete(sk, hdev->id, 5906 MGMT_OP_ADD_REMOTE_OOB_DATA, 5907 MGMT_STATUS_INVALID_PARAMS, 5908 &cp->addr, sizeof(cp->addr)); 5909 goto unlock; 5910 } 5911 5912 err = hci_add_remote_oob_data(hdev, &cp->addr.bdaddr, 5913 cp->addr.type, cp->hash, 5914 cp->rand, NULL, NULL); 5915 if (err < 0) 5916 status = MGMT_STATUS_FAILED; 5917 else 5918 status = MGMT_STATUS_SUCCESS; 5919 5920 err = mgmt_cmd_complete(sk, hdev->id, 5921 MGMT_OP_ADD_REMOTE_OOB_DATA, status, 5922 &cp->addr, sizeof(cp->addr)); 5923 } else if (len == MGMT_ADD_REMOTE_OOB_EXT_DATA_SIZE) { 5924 struct mgmt_cp_add_remote_oob_ext_data *cp = data; 5925 u8 *rand192, *hash192, *rand256, *hash256; 5926 u8 status; 5927 5928 if (bdaddr_type_is_le(cp->addr.type)) { 5929 /* Enforce zero-valued 192-bit parameters as 5930 * long as legacy SMP OOB isn't implemented. 5931 */ 5932 if (memcmp(cp->rand192, ZERO_KEY, 16) || 5933 memcmp(cp->hash192, ZERO_KEY, 16)) { 5934 err = mgmt_cmd_complete(sk, hdev->id, 5935 MGMT_OP_ADD_REMOTE_OOB_DATA, 5936 MGMT_STATUS_INVALID_PARAMS, 5937 addr, sizeof(*addr)); 5938 goto unlock; 5939 } 5940 5941 rand192 = NULL; 5942 hash192 = NULL; 5943 } else { 5944 /* In case one of the P-192 values is set to zero, 5945 * then just disable OOB data for P-192. 5946 */ 5947 if (!memcmp(cp->rand192, ZERO_KEY, 16) || 5948 !memcmp(cp->hash192, ZERO_KEY, 16)) { 5949 rand192 = NULL; 5950 hash192 = NULL; 5951 } else { 5952 rand192 = cp->rand192; 5953 hash192 = cp->hash192; 5954 } 5955 } 5956 5957 /* In case one of the P-256 values is set to zero, then just 5958 * disable OOB data for P-256. 5959 */ 5960 if (!memcmp(cp->rand256, ZERO_KEY, 16) || 5961 !memcmp(cp->hash256, ZERO_KEY, 16)) { 5962 rand256 = NULL; 5963 hash256 = NULL; 5964 } else { 5965 rand256 = cp->rand256; 5966 hash256 = cp->hash256; 5967 } 5968 5969 err = hci_add_remote_oob_data(hdev, &cp->addr.bdaddr, 5970 cp->addr.type, hash192, rand192, 5971 hash256, rand256); 5972 if (err < 0) 5973 status = MGMT_STATUS_FAILED; 5974 else 5975 status = MGMT_STATUS_SUCCESS; 5976 5977 err = mgmt_cmd_complete(sk, hdev->id, 5978 MGMT_OP_ADD_REMOTE_OOB_DATA, 5979 status, &cp->addr, sizeof(cp->addr)); 5980 } else { 5981 bt_dev_err(hdev, "add_remote_oob_data: invalid len of %u bytes", 5982 len); 5983 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_REMOTE_OOB_DATA, 5984 MGMT_STATUS_INVALID_PARAMS); 5985 } 5986 5987 unlock: 5988 hci_dev_unlock(hdev); 5989 return err; 5990 } 5991 5992 static int remove_remote_oob_data(struct sock *sk, struct hci_dev *hdev, 5993 void *data, u16 len) 5994 { 5995 struct mgmt_cp_remove_remote_oob_data *cp = data; 5996 u8 status; 5997 int err; 5998 5999 bt_dev_dbg(hdev, "sock %p", sk); 6000 6001 if (cp->addr.type != BDADDR_BREDR) 6002 return mgmt_cmd_complete(sk, hdev->id, 6003 MGMT_OP_REMOVE_REMOTE_OOB_DATA, 6004 MGMT_STATUS_INVALID_PARAMS, 6005 &cp->addr, sizeof(cp->addr)); 6006 6007 hci_dev_lock(hdev); 6008 6009 if (!bacmp(&cp->addr.bdaddr, BDADDR_ANY)) { 6010 hci_remote_oob_data_clear(hdev); 6011 status = MGMT_STATUS_SUCCESS; 6012 goto done; 6013 } 6014 6015 err = hci_remove_remote_oob_data(hdev, &cp->addr.bdaddr, cp->addr.type); 6016 if (err < 0) 6017 status = MGMT_STATUS_INVALID_PARAMS; 6018 else 6019 status = MGMT_STATUS_SUCCESS; 6020 6021 done: 6022 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_REMOTE_OOB_DATA, 6023 status, &cp->addr, sizeof(cp->addr)); 6024 6025 hci_dev_unlock(hdev); 6026 return err; 6027 } 6028 6029 static bool discovery_type_is_valid(struct hci_dev *hdev, uint8_t type, 6030 uint8_t *mgmt_status) 6031 { 6032 switch (type) { 6033 case DISCOV_TYPE_LE: 6034 *mgmt_status = mgmt_le_support(hdev); 6035 if (*mgmt_status) 6036 return false; 6037 break; 6038 case DISCOV_TYPE_INTERLEAVED: 6039 *mgmt_status = mgmt_le_support(hdev); 6040 if (*mgmt_status) 6041 return false; 6042 fallthrough; 6043 case DISCOV_TYPE_BREDR: 6044 *mgmt_status = mgmt_bredr_support(hdev); 6045 if (*mgmt_status) 6046 return false; 6047 break; 6048 default: 6049 *mgmt_status = MGMT_STATUS_INVALID_PARAMS; 6050 return false; 6051 } 6052 6053 return true; 6054 } 6055 6056 static void start_discovery_complete(struct hci_dev *hdev, void *data, int err) 6057 { 6058 struct mgmt_pending_cmd *cmd = data; 6059 6060 bt_dev_dbg(hdev, "err %d", err); 6061 6062 if (err == -ECANCELED || !mgmt_pending_valid(hdev, cmd)) 6063 return; 6064 6065 mgmt_cmd_complete(cmd->sk, cmd->hdev->id, cmd->opcode, mgmt_status(err), 6066 cmd->param, 1); 6067 mgmt_pending_free(cmd); 6068 6069 hci_discovery_set_state(hdev, err ? DISCOVERY_STOPPED: 6070 DISCOVERY_FINDING); 6071 } 6072 6073 static int start_discovery_sync(struct hci_dev *hdev, void *data) 6074 { 6075 if (!mgmt_pending_listed(hdev, data)) 6076 return -ECANCELED; 6077 6078 return hci_start_discovery_sync(hdev); 6079 } 6080 6081 static int start_discovery_internal(struct sock *sk, struct hci_dev *hdev, 6082 u16 op, void *data, u16 len) 6083 { 6084 struct mgmt_cp_start_discovery *cp = data; 6085 struct mgmt_pending_cmd *cmd; 6086 u8 status; 6087 int err; 6088 6089 bt_dev_dbg(hdev, "sock %p", sk); 6090 6091 hci_dev_lock(hdev); 6092 6093 if (!hdev_is_powered(hdev)) { 6094 err = mgmt_cmd_complete(sk, hdev->id, op, 6095 MGMT_STATUS_NOT_POWERED, 6096 &cp->type, sizeof(cp->type)); 6097 goto failed; 6098 } 6099 6100 if (hdev->discovery.state != DISCOVERY_STOPPED || 6101 hci_dev_test_flag(hdev, HCI_PERIODIC_INQ)) { 6102 err = mgmt_cmd_complete(sk, hdev->id, op, MGMT_STATUS_BUSY, 6103 &cp->type, sizeof(cp->type)); 6104 goto failed; 6105 } 6106 6107 if (!discovery_type_is_valid(hdev, cp->type, &status)) { 6108 err = mgmt_cmd_complete(sk, hdev->id, op, status, 6109 &cp->type, sizeof(cp->type)); 6110 goto failed; 6111 } 6112 6113 /* Can't start discovery when it is paused */ 6114 if (hdev->discovery_paused) { 6115 err = mgmt_cmd_complete(sk, hdev->id, op, MGMT_STATUS_BUSY, 6116 &cp->type, sizeof(cp->type)); 6117 goto failed; 6118 } 6119 6120 /* Clear the discovery filter first to free any previously 6121 * allocated memory for the UUID list. 6122 */ 6123 hci_discovery_filter_clear(hdev); 6124 6125 hdev->discovery.type = cp->type; 6126 hdev->discovery.report_invalid_rssi = false; 6127 if (op == MGMT_OP_START_LIMITED_DISCOVERY) 6128 hdev->discovery.limited = true; 6129 else 6130 hdev->discovery.limited = false; 6131 6132 cmd = mgmt_pending_add(sk, op, hdev, data, len); 6133 if (!cmd) { 6134 err = -ENOMEM; 6135 goto failed; 6136 } 6137 6138 err = hci_cmd_sync_queue(hdev, start_discovery_sync, cmd, 6139 start_discovery_complete); 6140 if (err < 0) { 6141 mgmt_pending_remove(cmd); 6142 goto failed; 6143 } 6144 6145 hci_discovery_set_state(hdev, DISCOVERY_STARTING); 6146 6147 failed: 6148 hci_dev_unlock(hdev); 6149 return err; 6150 } 6151 6152 static int start_discovery(struct sock *sk, struct hci_dev *hdev, 6153 void *data, u16 len) 6154 { 6155 return start_discovery_internal(sk, hdev, MGMT_OP_START_DISCOVERY, 6156 data, len); 6157 } 6158 6159 static int start_limited_discovery(struct sock *sk, struct hci_dev *hdev, 6160 void *data, u16 len) 6161 { 6162 return start_discovery_internal(sk, hdev, 6163 MGMT_OP_START_LIMITED_DISCOVERY, 6164 data, len); 6165 } 6166 6167 static int start_service_discovery(struct sock *sk, struct hci_dev *hdev, 6168 void *data, u16 len) 6169 { 6170 struct mgmt_cp_start_service_discovery *cp = data; 6171 struct mgmt_pending_cmd *cmd; 6172 const u16 max_uuid_count = ((U16_MAX - sizeof(*cp)) / 16); 6173 u16 uuid_count, expected_len; 6174 u8 (*uuids)[16] = NULL; 6175 u8 status; 6176 int err; 6177 6178 bt_dev_dbg(hdev, "sock %p", sk); 6179 6180 hci_dev_lock(hdev); 6181 6182 if (!hdev_is_powered(hdev)) { 6183 err = mgmt_cmd_complete(sk, hdev->id, 6184 MGMT_OP_START_SERVICE_DISCOVERY, 6185 MGMT_STATUS_NOT_POWERED, 6186 &cp->type, sizeof(cp->type)); 6187 goto failed; 6188 } 6189 6190 if (hdev->discovery.state != DISCOVERY_STOPPED || 6191 hci_dev_test_flag(hdev, HCI_PERIODIC_INQ)) { 6192 err = mgmt_cmd_complete(sk, hdev->id, 6193 MGMT_OP_START_SERVICE_DISCOVERY, 6194 MGMT_STATUS_BUSY, &cp->type, 6195 sizeof(cp->type)); 6196 goto failed; 6197 } 6198 6199 if (hdev->discovery_paused) { 6200 err = mgmt_cmd_complete(sk, hdev->id, 6201 MGMT_OP_START_SERVICE_DISCOVERY, 6202 MGMT_STATUS_BUSY, &cp->type, 6203 sizeof(cp->type)); 6204 goto failed; 6205 } 6206 6207 uuid_count = __le16_to_cpu(cp->uuid_count); 6208 if (uuid_count > max_uuid_count) { 6209 bt_dev_err(hdev, "service_discovery: too big uuid_count value %u", 6210 uuid_count); 6211 err = mgmt_cmd_complete(sk, hdev->id, 6212 MGMT_OP_START_SERVICE_DISCOVERY, 6213 MGMT_STATUS_INVALID_PARAMS, &cp->type, 6214 sizeof(cp->type)); 6215 goto failed; 6216 } 6217 6218 expected_len = sizeof(*cp) + uuid_count * 16; 6219 if (expected_len != len) { 6220 bt_dev_err(hdev, "service_discovery: expected %u bytes, got %u bytes", 6221 expected_len, len); 6222 err = mgmt_cmd_complete(sk, hdev->id, 6223 MGMT_OP_START_SERVICE_DISCOVERY, 6224 MGMT_STATUS_INVALID_PARAMS, &cp->type, 6225 sizeof(cp->type)); 6226 goto failed; 6227 } 6228 6229 if (!discovery_type_is_valid(hdev, cp->type, &status)) { 6230 err = mgmt_cmd_complete(sk, hdev->id, 6231 MGMT_OP_START_SERVICE_DISCOVERY, 6232 status, &cp->type, sizeof(cp->type)); 6233 goto failed; 6234 } 6235 6236 cmd = mgmt_pending_add(sk, MGMT_OP_START_SERVICE_DISCOVERY, 6237 hdev, data, len); 6238 if (!cmd) { 6239 err = -ENOMEM; 6240 goto failed; 6241 } 6242 6243 /* Clear the discovery filter first to free any previously 6244 * allocated memory for the UUID list. 6245 */ 6246 hci_discovery_filter_clear(hdev); 6247 6248 hdev->discovery.result_filtering = true; 6249 hdev->discovery.type = cp->type; 6250 hdev->discovery.rssi = cp->rssi; 6251 6252 if (uuid_count > 0) { 6253 uuids = kmemdup(cp->uuids, uuid_count * sizeof(*uuids), GFP_KERNEL); 6254 if (!uuids) { 6255 err = mgmt_cmd_complete(sk, hdev->id, 6256 MGMT_OP_START_SERVICE_DISCOVERY, 6257 MGMT_STATUS_FAILED, 6258 &cp->type, sizeof(cp->type)); 6259 mgmt_pending_remove(cmd); 6260 goto failed; 6261 } 6262 } 6263 6264 spin_lock(&hdev->discovery.lock); 6265 hdev->discovery.uuids = uuids; 6266 hdev->discovery.uuid_count = uuid_count; 6267 spin_unlock(&hdev->discovery.lock); 6268 6269 err = hci_cmd_sync_queue(hdev, start_discovery_sync, cmd, 6270 start_discovery_complete); 6271 if (err < 0) { 6272 mgmt_pending_remove(cmd); 6273 goto failed; 6274 } 6275 6276 hci_discovery_set_state(hdev, DISCOVERY_STARTING); 6277 6278 failed: 6279 hci_dev_unlock(hdev); 6280 return err; 6281 } 6282 6283 static void stop_discovery_complete(struct hci_dev *hdev, void *data, int err) 6284 { 6285 struct mgmt_pending_cmd *cmd = data; 6286 6287 if (err == -ECANCELED || !mgmt_pending_valid(hdev, cmd)) 6288 return; 6289 6290 bt_dev_dbg(hdev, "err %d", err); 6291 6292 mgmt_cmd_complete(cmd->sk, cmd->hdev->id, cmd->opcode, mgmt_status(err), 6293 cmd->param, 1); 6294 mgmt_pending_free(cmd); 6295 6296 if (!err) 6297 hci_discovery_set_state(hdev, DISCOVERY_STOPPED); 6298 } 6299 6300 static int stop_discovery_sync(struct hci_dev *hdev, void *data) 6301 { 6302 if (!mgmt_pending_listed(hdev, data)) 6303 return -ECANCELED; 6304 6305 return hci_stop_discovery_sync(hdev); 6306 } 6307 6308 static int stop_discovery(struct sock *sk, struct hci_dev *hdev, void *data, 6309 u16 len) 6310 { 6311 struct mgmt_cp_stop_discovery *mgmt_cp = data; 6312 struct mgmt_pending_cmd *cmd; 6313 int err; 6314 6315 bt_dev_dbg(hdev, "sock %p", sk); 6316 6317 hci_dev_lock(hdev); 6318 6319 if (!hci_discovery_active(hdev)) { 6320 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY, 6321 MGMT_STATUS_REJECTED, &mgmt_cp->type, 6322 sizeof(mgmt_cp->type)); 6323 goto unlock; 6324 } 6325 6326 if (hdev->discovery.type != mgmt_cp->type) { 6327 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY, 6328 MGMT_STATUS_INVALID_PARAMS, 6329 &mgmt_cp->type, sizeof(mgmt_cp->type)); 6330 goto unlock; 6331 } 6332 6333 cmd = mgmt_pending_add(sk, MGMT_OP_STOP_DISCOVERY, hdev, data, len); 6334 if (!cmd) { 6335 err = -ENOMEM; 6336 goto unlock; 6337 } 6338 6339 err = hci_cmd_sync_queue(hdev, stop_discovery_sync, cmd, 6340 stop_discovery_complete); 6341 if (err < 0) { 6342 mgmt_pending_remove(cmd); 6343 goto unlock; 6344 } 6345 6346 hci_discovery_set_state(hdev, DISCOVERY_STOPPING); 6347 6348 unlock: 6349 hci_dev_unlock(hdev); 6350 return err; 6351 } 6352 6353 static int confirm_name(struct sock *sk, struct hci_dev *hdev, void *data, 6354 u16 len) 6355 { 6356 struct mgmt_cp_confirm_name *cp = data; 6357 struct inquiry_entry *e; 6358 int err; 6359 6360 bt_dev_dbg(hdev, "sock %p", sk); 6361 6362 hci_dev_lock(hdev); 6363 6364 if (!hci_discovery_active(hdev)) { 6365 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME, 6366 MGMT_STATUS_FAILED, &cp->addr, 6367 sizeof(cp->addr)); 6368 goto failed; 6369 } 6370 6371 e = hci_inquiry_cache_lookup_unknown(hdev, &cp->addr.bdaddr); 6372 if (!e) { 6373 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME, 6374 MGMT_STATUS_INVALID_PARAMS, &cp->addr, 6375 sizeof(cp->addr)); 6376 goto failed; 6377 } 6378 6379 if (cp->name_known) { 6380 e->name_state = NAME_KNOWN; 6381 list_del(&e->list); 6382 } else { 6383 e->name_state = NAME_NEEDED; 6384 hci_inquiry_cache_update_resolve(hdev, e); 6385 } 6386 6387 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME, 0, 6388 &cp->addr, sizeof(cp->addr)); 6389 6390 failed: 6391 hci_dev_unlock(hdev); 6392 return err; 6393 } 6394 6395 static int block_device(struct sock *sk, struct hci_dev *hdev, void *data, 6396 u16 len) 6397 { 6398 struct mgmt_cp_block_device *cp = data; 6399 u8 status; 6400 int err; 6401 6402 bt_dev_dbg(hdev, "sock %p", sk); 6403 6404 if (!bdaddr_type_is_valid(cp->addr.type)) 6405 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_BLOCK_DEVICE, 6406 MGMT_STATUS_INVALID_PARAMS, 6407 &cp->addr, sizeof(cp->addr)); 6408 6409 hci_dev_lock(hdev); 6410 6411 err = hci_bdaddr_list_add(&hdev->reject_list, &cp->addr.bdaddr, 6412 cp->addr.type); 6413 if (err < 0) { 6414 status = MGMT_STATUS_FAILED; 6415 goto done; 6416 } 6417 6418 mgmt_event(MGMT_EV_DEVICE_BLOCKED, hdev, &cp->addr, sizeof(cp->addr), 6419 sk); 6420 status = MGMT_STATUS_SUCCESS; 6421 6422 done: 6423 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_BLOCK_DEVICE, status, 6424 &cp->addr, sizeof(cp->addr)); 6425 6426 hci_dev_unlock(hdev); 6427 6428 return err; 6429 } 6430 6431 static int unblock_device(struct sock *sk, struct hci_dev *hdev, void *data, 6432 u16 len) 6433 { 6434 struct mgmt_cp_unblock_device *cp = data; 6435 u8 status; 6436 int err; 6437 6438 bt_dev_dbg(hdev, "sock %p", sk); 6439 6440 if (!bdaddr_type_is_valid(cp->addr.type)) 6441 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNBLOCK_DEVICE, 6442 MGMT_STATUS_INVALID_PARAMS, 6443 &cp->addr, sizeof(cp->addr)); 6444 6445 hci_dev_lock(hdev); 6446 6447 err = hci_bdaddr_list_del(&hdev->reject_list, &cp->addr.bdaddr, 6448 cp->addr.type); 6449 if (err < 0) { 6450 status = MGMT_STATUS_INVALID_PARAMS; 6451 goto done; 6452 } 6453 6454 mgmt_event(MGMT_EV_DEVICE_UNBLOCKED, hdev, &cp->addr, sizeof(cp->addr), 6455 sk); 6456 status = MGMT_STATUS_SUCCESS; 6457 6458 done: 6459 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNBLOCK_DEVICE, status, 6460 &cp->addr, sizeof(cp->addr)); 6461 6462 hci_dev_unlock(hdev); 6463 6464 return err; 6465 } 6466 6467 static int set_device_id_sync(struct hci_dev *hdev, void *data) 6468 { 6469 return hci_update_eir_sync(hdev); 6470 } 6471 6472 static int set_device_id(struct sock *sk, struct hci_dev *hdev, void *data, 6473 u16 len) 6474 { 6475 struct mgmt_cp_set_device_id *cp = data; 6476 int err; 6477 __u16 source; 6478 6479 bt_dev_dbg(hdev, "sock %p", sk); 6480 6481 source = __le16_to_cpu(cp->source); 6482 6483 if (source > 0x0002) 6484 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEVICE_ID, 6485 MGMT_STATUS_INVALID_PARAMS); 6486 6487 hci_dev_lock(hdev); 6488 6489 hdev->devid_source = source; 6490 hdev->devid_vendor = __le16_to_cpu(cp->vendor); 6491 hdev->devid_product = __le16_to_cpu(cp->product); 6492 hdev->devid_version = __le16_to_cpu(cp->version); 6493 6494 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_DEVICE_ID, 0, 6495 NULL, 0); 6496 6497 hci_cmd_sync_queue(hdev, set_device_id_sync, NULL, NULL); 6498 6499 hci_dev_unlock(hdev); 6500 6501 return err; 6502 } 6503 6504 static void enable_advertising_instance(struct hci_dev *hdev, int err) 6505 { 6506 if (err) 6507 bt_dev_err(hdev, "failed to re-configure advertising %d", err); 6508 else 6509 bt_dev_dbg(hdev, "status %d", err); 6510 } 6511 6512 static void set_advertising_complete(struct hci_dev *hdev, void *data, int err) 6513 { 6514 struct mgmt_pending_cmd *cmd = data; 6515 struct cmd_lookup match = { NULL, hdev }; 6516 u8 instance; 6517 struct adv_info *adv_instance; 6518 u8 status = mgmt_status(err); 6519 6520 if (err == -ECANCELED || !mgmt_pending_valid(hdev, data)) 6521 return; 6522 6523 if (status) { 6524 mgmt_cmd_status(cmd->sk, cmd->hdev->id, cmd->opcode, status); 6525 mgmt_pending_free(cmd); 6526 return; 6527 } 6528 6529 if (hci_dev_test_flag(hdev, HCI_LE_ADV)) 6530 hci_dev_set_flag(hdev, HCI_ADVERTISING); 6531 else 6532 hci_dev_clear_flag(hdev, HCI_ADVERTISING); 6533 6534 settings_rsp(cmd, &match); 6535 mgmt_pending_free(cmd); 6536 6537 new_settings(hdev, match.sk); 6538 6539 if (match.sk) 6540 sock_put(match.sk); 6541 6542 /* If "Set Advertising" was just disabled and instance advertising was 6543 * set up earlier, then re-enable multi-instance advertising. 6544 */ 6545 if (hci_dev_test_flag(hdev, HCI_ADVERTISING) || 6546 list_empty(&hdev->adv_instances)) 6547 return; 6548 6549 instance = hdev->cur_adv_instance; 6550 if (!instance) { 6551 adv_instance = list_first_entry_or_null(&hdev->adv_instances, 6552 struct adv_info, list); 6553 if (!adv_instance) 6554 return; 6555 6556 instance = adv_instance->instance; 6557 } 6558 6559 err = hci_schedule_adv_instance_sync(hdev, instance, true); 6560 6561 enable_advertising_instance(hdev, err); 6562 } 6563 6564 static int set_adv_sync(struct hci_dev *hdev, void *data) 6565 { 6566 struct mgmt_pending_cmd *cmd = data; 6567 struct mgmt_mode cp; 6568 u8 val; 6569 6570 mutex_lock(&hdev->mgmt_pending_lock); 6571 6572 if (!__mgmt_pending_listed(hdev, cmd)) { 6573 mutex_unlock(&hdev->mgmt_pending_lock); 6574 return -ECANCELED; 6575 } 6576 6577 memcpy(&cp, cmd->param, sizeof(cp)); 6578 6579 mutex_unlock(&hdev->mgmt_pending_lock); 6580 6581 val = !!cp.val; 6582 6583 if (cp.val == 0x02) 6584 hci_dev_set_flag(hdev, HCI_ADVERTISING_CONNECTABLE); 6585 else 6586 hci_dev_clear_flag(hdev, HCI_ADVERTISING_CONNECTABLE); 6587 6588 cancel_adv_timeout(hdev); 6589 6590 if (val) { 6591 /* Switch to instance "0" for the Set Advertising setting. 6592 * We cannot use update_[adv|scan_rsp]_data() here as the 6593 * HCI_ADVERTISING flag is not yet set. 6594 */ 6595 hdev->cur_adv_instance = 0x00; 6596 6597 if (ext_adv_capable(hdev)) { 6598 hci_start_ext_adv_sync(hdev, 0x00); 6599 } else { 6600 hci_update_adv_data_sync(hdev, 0x00); 6601 hci_update_scan_rsp_data_sync(hdev, 0x00); 6602 hci_enable_advertising_sync(hdev); 6603 } 6604 } else { 6605 hci_disable_advertising_sync(hdev); 6606 } 6607 6608 return 0; 6609 } 6610 6611 static int set_advertising(struct sock *sk, struct hci_dev *hdev, void *data, 6612 u16 len) 6613 { 6614 struct mgmt_mode *cp = data; 6615 struct mgmt_pending_cmd *cmd; 6616 u8 val, status; 6617 int err; 6618 6619 bt_dev_dbg(hdev, "sock %p", sk); 6620 6621 status = mgmt_le_support(hdev); 6622 if (status) 6623 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING, 6624 status); 6625 6626 if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02) 6627 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING, 6628 MGMT_STATUS_INVALID_PARAMS); 6629 6630 if (hdev->advertising_paused) 6631 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING, 6632 MGMT_STATUS_BUSY); 6633 6634 hci_dev_lock(hdev); 6635 6636 val = !!cp->val; 6637 6638 /* The following conditions are ones which mean that we should 6639 * not do any HCI communication but directly send a mgmt 6640 * response to user space (after toggling the flag if 6641 * necessary). 6642 */ 6643 if (!hdev_is_powered(hdev) || 6644 (val == hci_dev_test_flag(hdev, HCI_ADVERTISING) && 6645 (cp->val == 0x02) == hci_dev_test_flag(hdev, HCI_ADVERTISING_CONNECTABLE)) || 6646 hci_dev_test_flag(hdev, HCI_MESH) || 6647 hci_conn_num(hdev, LE_LINK) > 0 || 6648 (hci_dev_test_flag(hdev, HCI_LE_SCAN) && 6649 hdev->le_scan_type == LE_SCAN_ACTIVE)) { 6650 bool changed; 6651 6652 if (cp->val) { 6653 hdev->cur_adv_instance = 0x00; 6654 changed = !hci_dev_test_and_set_flag(hdev, HCI_ADVERTISING); 6655 if (cp->val == 0x02) 6656 hci_dev_set_flag(hdev, HCI_ADVERTISING_CONNECTABLE); 6657 else 6658 hci_dev_clear_flag(hdev, HCI_ADVERTISING_CONNECTABLE); 6659 } else { 6660 changed = hci_dev_test_and_clear_flag(hdev, HCI_ADVERTISING); 6661 hci_dev_clear_flag(hdev, HCI_ADVERTISING_CONNECTABLE); 6662 } 6663 6664 err = send_settings_rsp(sk, MGMT_OP_SET_ADVERTISING, hdev); 6665 if (err < 0) 6666 goto unlock; 6667 6668 if (changed) 6669 err = new_settings(hdev, sk); 6670 6671 goto unlock; 6672 } 6673 6674 if (pending_find(MGMT_OP_SET_ADVERTISING, hdev) || 6675 pending_find(MGMT_OP_SET_LE, hdev)) { 6676 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING, 6677 MGMT_STATUS_BUSY); 6678 goto unlock; 6679 } 6680 6681 cmd = mgmt_pending_add(sk, MGMT_OP_SET_ADVERTISING, hdev, data, len); 6682 if (!cmd) 6683 err = -ENOMEM; 6684 else 6685 err = hci_cmd_sync_queue(hdev, set_adv_sync, cmd, 6686 set_advertising_complete); 6687 6688 if (err < 0 && cmd) 6689 mgmt_pending_remove(cmd); 6690 6691 unlock: 6692 hci_dev_unlock(hdev); 6693 return err; 6694 } 6695 6696 static int set_static_address(struct sock *sk, struct hci_dev *hdev, 6697 void *data, u16 len) 6698 { 6699 struct mgmt_cp_set_static_address *cp = data; 6700 int err; 6701 6702 bt_dev_dbg(hdev, "sock %p", sk); 6703 6704 if (!lmp_le_capable(hdev)) 6705 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_STATIC_ADDRESS, 6706 MGMT_STATUS_NOT_SUPPORTED); 6707 6708 if (hdev_is_powered(hdev)) 6709 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_STATIC_ADDRESS, 6710 MGMT_STATUS_REJECTED); 6711 6712 if (bacmp(&cp->bdaddr, BDADDR_ANY)) { 6713 if (!bacmp(&cp->bdaddr, BDADDR_NONE)) 6714 return mgmt_cmd_status(sk, hdev->id, 6715 MGMT_OP_SET_STATIC_ADDRESS, 6716 MGMT_STATUS_INVALID_PARAMS); 6717 6718 /* Two most significant bits shall be set */ 6719 if ((cp->bdaddr.b[5] & 0xc0) != 0xc0) 6720 return mgmt_cmd_status(sk, hdev->id, 6721 MGMT_OP_SET_STATIC_ADDRESS, 6722 MGMT_STATUS_INVALID_PARAMS); 6723 } 6724 6725 hci_dev_lock(hdev); 6726 6727 bacpy(&hdev->static_addr, &cp->bdaddr); 6728 6729 err = send_settings_rsp(sk, MGMT_OP_SET_STATIC_ADDRESS, hdev); 6730 if (err < 0) 6731 goto unlock; 6732 6733 err = new_settings(hdev, sk); 6734 6735 unlock: 6736 hci_dev_unlock(hdev); 6737 return err; 6738 } 6739 6740 static int set_scan_params(struct sock *sk, struct hci_dev *hdev, 6741 void *data, u16 len) 6742 { 6743 struct mgmt_cp_set_scan_params *cp = data; 6744 __u16 interval, window; 6745 int err; 6746 6747 bt_dev_dbg(hdev, "sock %p", sk); 6748 6749 if (!lmp_le_capable(hdev)) 6750 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS, 6751 MGMT_STATUS_NOT_SUPPORTED); 6752 6753 /* Keep allowed ranges in sync with set_mesh() */ 6754 interval = __le16_to_cpu(cp->interval); 6755 6756 if (interval < 0x0004 || interval > 0x4000) 6757 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS, 6758 MGMT_STATUS_INVALID_PARAMS); 6759 6760 window = __le16_to_cpu(cp->window); 6761 6762 if (window < 0x0004 || window > 0x4000) 6763 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS, 6764 MGMT_STATUS_INVALID_PARAMS); 6765 6766 if (window > interval) 6767 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS, 6768 MGMT_STATUS_INVALID_PARAMS); 6769 6770 hci_dev_lock(hdev); 6771 6772 hdev->le_scan_interval = interval; 6773 hdev->le_scan_window = window; 6774 6775 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS, 0, 6776 NULL, 0); 6777 6778 /* If background scan is running, restart it so new parameters are 6779 * loaded. 6780 */ 6781 if (hci_dev_test_flag(hdev, HCI_LE_SCAN) && 6782 hdev->discovery.state == DISCOVERY_STOPPED) 6783 hci_update_passive_scan(hdev); 6784 6785 hci_dev_unlock(hdev); 6786 6787 return err; 6788 } 6789 6790 static void fast_connectable_complete(struct hci_dev *hdev, void *data, int err) 6791 { 6792 struct mgmt_pending_cmd *cmd = data; 6793 6794 bt_dev_dbg(hdev, "err %d", err); 6795 6796 if (err) { 6797 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE, 6798 mgmt_status(err)); 6799 } else { 6800 struct mgmt_mode *cp = cmd->param; 6801 6802 if (cp->val) 6803 hci_dev_set_flag(hdev, HCI_FAST_CONNECTABLE); 6804 else 6805 hci_dev_clear_flag(hdev, HCI_FAST_CONNECTABLE); 6806 6807 send_settings_rsp(cmd->sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev); 6808 new_settings(hdev, cmd->sk); 6809 } 6810 6811 mgmt_pending_free(cmd); 6812 } 6813 6814 static int write_fast_connectable_sync(struct hci_dev *hdev, void *data) 6815 { 6816 struct mgmt_pending_cmd *cmd = data; 6817 struct mgmt_mode *cp = cmd->param; 6818 6819 return hci_write_fast_connectable_sync(hdev, cp->val); 6820 } 6821 6822 static int set_fast_connectable(struct sock *sk, struct hci_dev *hdev, 6823 void *data, u16 len) 6824 { 6825 struct mgmt_mode *cp = data; 6826 struct mgmt_pending_cmd *cmd; 6827 int err; 6828 6829 bt_dev_dbg(hdev, "sock %p", sk); 6830 6831 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) || 6832 hdev->hci_ver < BLUETOOTH_VER_1_2) 6833 return mgmt_cmd_status(sk, hdev->id, 6834 MGMT_OP_SET_FAST_CONNECTABLE, 6835 MGMT_STATUS_NOT_SUPPORTED); 6836 6837 if (cp->val != 0x00 && cp->val != 0x01) 6838 return mgmt_cmd_status(sk, hdev->id, 6839 MGMT_OP_SET_FAST_CONNECTABLE, 6840 MGMT_STATUS_INVALID_PARAMS); 6841 6842 hci_dev_lock(hdev); 6843 6844 if (!!cp->val == hci_dev_test_flag(hdev, HCI_FAST_CONNECTABLE)) { 6845 err = send_settings_rsp(sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev); 6846 goto unlock; 6847 } 6848 6849 if (!hdev_is_powered(hdev)) { 6850 hci_dev_change_flag(hdev, HCI_FAST_CONNECTABLE); 6851 err = send_settings_rsp(sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev); 6852 new_settings(hdev, sk); 6853 goto unlock; 6854 } 6855 6856 cmd = mgmt_pending_new(sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev, data, 6857 len); 6858 if (!cmd) 6859 err = -ENOMEM; 6860 else 6861 err = hci_cmd_sync_queue(hdev, write_fast_connectable_sync, cmd, 6862 fast_connectable_complete); 6863 6864 if (err < 0) { 6865 mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE, 6866 MGMT_STATUS_FAILED); 6867 6868 if (cmd) 6869 mgmt_pending_free(cmd); 6870 } 6871 6872 unlock: 6873 hci_dev_unlock(hdev); 6874 6875 return err; 6876 } 6877 6878 static void set_bredr_complete(struct hci_dev *hdev, void *data, int err) 6879 { 6880 struct mgmt_pending_cmd *cmd = data; 6881 6882 bt_dev_dbg(hdev, "err %d", err); 6883 6884 if (err) { 6885 u8 mgmt_err = mgmt_status(err); 6886 6887 /* We need to restore the flag if related HCI commands 6888 * failed. 6889 */ 6890 hci_dev_clear_flag(hdev, HCI_BREDR_ENABLED); 6891 6892 mgmt_cmd_status(cmd->sk, cmd->hdev->id, cmd->opcode, mgmt_err); 6893 } else { 6894 send_settings_rsp(cmd->sk, MGMT_OP_SET_BREDR, hdev); 6895 new_settings(hdev, cmd->sk); 6896 } 6897 6898 mgmt_pending_free(cmd); 6899 } 6900 6901 static int set_bredr_sync(struct hci_dev *hdev, void *data) 6902 { 6903 int status; 6904 6905 status = hci_write_fast_connectable_sync(hdev, false); 6906 6907 if (!status) 6908 status = hci_update_scan_sync(hdev); 6909 6910 /* Since only the advertising data flags will change, there 6911 * is no need to update the scan response data. 6912 */ 6913 if (!status) 6914 status = hci_update_adv_data_sync(hdev, hdev->cur_adv_instance); 6915 6916 return status; 6917 } 6918 6919 static int set_bredr(struct sock *sk, struct hci_dev *hdev, void *data, u16 len) 6920 { 6921 struct mgmt_mode *cp = data; 6922 struct mgmt_pending_cmd *cmd; 6923 int err; 6924 6925 bt_dev_dbg(hdev, "sock %p", sk); 6926 6927 if (!lmp_bredr_capable(hdev) || !lmp_le_capable(hdev)) 6928 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR, 6929 MGMT_STATUS_NOT_SUPPORTED); 6930 6931 if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED)) 6932 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR, 6933 MGMT_STATUS_REJECTED); 6934 6935 if (cp->val != 0x00 && cp->val != 0x01) 6936 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR, 6937 MGMT_STATUS_INVALID_PARAMS); 6938 6939 hci_dev_lock(hdev); 6940 6941 if (cp->val == hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) { 6942 err = send_settings_rsp(sk, MGMT_OP_SET_BREDR, hdev); 6943 goto unlock; 6944 } 6945 6946 if (!hdev_is_powered(hdev)) { 6947 if (!cp->val) { 6948 hci_dev_clear_flag(hdev, HCI_DISCOVERABLE); 6949 hci_dev_clear_flag(hdev, HCI_SSP_ENABLED); 6950 hci_dev_clear_flag(hdev, HCI_LINK_SECURITY); 6951 hci_dev_clear_flag(hdev, HCI_FAST_CONNECTABLE); 6952 } 6953 6954 hci_dev_change_flag(hdev, HCI_BREDR_ENABLED); 6955 6956 err = send_settings_rsp(sk, MGMT_OP_SET_BREDR, hdev); 6957 if (err < 0) 6958 goto unlock; 6959 6960 err = new_settings(hdev, sk); 6961 goto unlock; 6962 } 6963 6964 /* Reject disabling when powered on */ 6965 if (!cp->val) { 6966 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR, 6967 MGMT_STATUS_REJECTED); 6968 goto unlock; 6969 } else { 6970 /* When configuring a dual-mode controller to operate 6971 * with LE only and using a static address, then switching 6972 * BR/EDR back on is not allowed. 6973 * 6974 * Dual-mode controllers shall operate with the public 6975 * address as its identity address for BR/EDR and LE. So 6976 * reject the attempt to create an invalid configuration. 6977 * 6978 * The same restrictions applies when secure connections 6979 * has been enabled. For BR/EDR this is a controller feature 6980 * while for LE it is a host stack feature. This means that 6981 * switching BR/EDR back on when secure connections has been 6982 * enabled is not a supported transaction. 6983 */ 6984 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) && 6985 (bacmp(&hdev->static_addr, BDADDR_ANY) || 6986 hci_dev_test_flag(hdev, HCI_SC_ENABLED))) { 6987 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR, 6988 MGMT_STATUS_REJECTED); 6989 goto unlock; 6990 } 6991 } 6992 6993 cmd = mgmt_pending_new(sk, MGMT_OP_SET_BREDR, hdev, data, len); 6994 if (!cmd) 6995 err = -ENOMEM; 6996 else 6997 err = hci_cmd_sync_queue(hdev, set_bredr_sync, cmd, 6998 set_bredr_complete); 6999 7000 if (err < 0) { 7001 mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR, 7002 MGMT_STATUS_FAILED); 7003 if (cmd) 7004 mgmt_pending_free(cmd); 7005 7006 goto unlock; 7007 } 7008 7009 /* We need to flip the bit already here so that 7010 * hci_req_update_adv_data generates the correct flags. 7011 */ 7012 hci_dev_set_flag(hdev, HCI_BREDR_ENABLED); 7013 7014 unlock: 7015 hci_dev_unlock(hdev); 7016 return err; 7017 } 7018 7019 static void set_secure_conn_complete(struct hci_dev *hdev, void *data, int err) 7020 { 7021 struct mgmt_pending_cmd *cmd = data; 7022 struct mgmt_mode *cp; 7023 7024 bt_dev_dbg(hdev, "err %d", err); 7025 7026 if (err) { 7027 u8 mgmt_err = mgmt_status(err); 7028 7029 mgmt_cmd_status(cmd->sk, cmd->hdev->id, cmd->opcode, mgmt_err); 7030 goto done; 7031 } 7032 7033 cp = cmd->param; 7034 7035 switch (cp->val) { 7036 case 0x00: 7037 hci_dev_clear_flag(hdev, HCI_SC_ENABLED); 7038 hci_dev_clear_flag(hdev, HCI_SC_ONLY); 7039 break; 7040 case 0x01: 7041 hci_dev_set_flag(hdev, HCI_SC_ENABLED); 7042 hci_dev_clear_flag(hdev, HCI_SC_ONLY); 7043 break; 7044 case 0x02: 7045 hci_dev_set_flag(hdev, HCI_SC_ENABLED); 7046 hci_dev_set_flag(hdev, HCI_SC_ONLY); 7047 break; 7048 } 7049 7050 send_settings_rsp(cmd->sk, cmd->opcode, hdev); 7051 new_settings(hdev, cmd->sk); 7052 7053 done: 7054 mgmt_pending_free(cmd); 7055 } 7056 7057 static int set_secure_conn_sync(struct hci_dev *hdev, void *data) 7058 { 7059 struct mgmt_pending_cmd *cmd = data; 7060 struct mgmt_mode *cp = cmd->param; 7061 u8 val = !!cp->val; 7062 7063 /* Force write of val */ 7064 hci_dev_set_flag(hdev, HCI_SC_ENABLED); 7065 7066 return hci_write_sc_support_sync(hdev, val); 7067 } 7068 7069 static int set_secure_conn(struct sock *sk, struct hci_dev *hdev, 7070 void *data, u16 len) 7071 { 7072 struct mgmt_mode *cp = data; 7073 struct mgmt_pending_cmd *cmd; 7074 u8 val; 7075 int err; 7076 7077 bt_dev_dbg(hdev, "sock %p", sk); 7078 7079 if (!lmp_sc_capable(hdev) && 7080 !hci_dev_test_flag(hdev, HCI_LE_ENABLED)) 7081 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN, 7082 MGMT_STATUS_NOT_SUPPORTED); 7083 7084 if (hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) && 7085 lmp_sc_capable(hdev) && 7086 !hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) 7087 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN, 7088 MGMT_STATUS_REJECTED); 7089 7090 if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02) 7091 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN, 7092 MGMT_STATUS_INVALID_PARAMS); 7093 7094 hci_dev_lock(hdev); 7095 7096 if (!hdev_is_powered(hdev) || !lmp_sc_capable(hdev) || 7097 !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) { 7098 bool changed; 7099 7100 if (cp->val) { 7101 changed = !hci_dev_test_and_set_flag(hdev, 7102 HCI_SC_ENABLED); 7103 if (cp->val == 0x02) 7104 hci_dev_set_flag(hdev, HCI_SC_ONLY); 7105 else 7106 hci_dev_clear_flag(hdev, HCI_SC_ONLY); 7107 } else { 7108 changed = hci_dev_test_and_clear_flag(hdev, 7109 HCI_SC_ENABLED); 7110 hci_dev_clear_flag(hdev, HCI_SC_ONLY); 7111 } 7112 7113 err = send_settings_rsp(sk, MGMT_OP_SET_SECURE_CONN, hdev); 7114 if (err < 0) 7115 goto failed; 7116 7117 if (changed) 7118 err = new_settings(hdev, sk); 7119 7120 goto failed; 7121 } 7122 7123 val = !!cp->val; 7124 7125 if (val == hci_dev_test_flag(hdev, HCI_SC_ENABLED) && 7126 (cp->val == 0x02) == hci_dev_test_flag(hdev, HCI_SC_ONLY)) { 7127 err = send_settings_rsp(sk, MGMT_OP_SET_SECURE_CONN, hdev); 7128 goto failed; 7129 } 7130 7131 cmd = mgmt_pending_new(sk, MGMT_OP_SET_SECURE_CONN, hdev, data, len); 7132 if (!cmd) 7133 err = -ENOMEM; 7134 else 7135 err = hci_cmd_sync_queue(hdev, set_secure_conn_sync, cmd, 7136 set_secure_conn_complete); 7137 7138 if (err < 0) { 7139 mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN, 7140 MGMT_STATUS_FAILED); 7141 if (cmd) 7142 mgmt_pending_free(cmd); 7143 } 7144 7145 failed: 7146 hci_dev_unlock(hdev); 7147 return err; 7148 } 7149 7150 static int set_debug_keys(struct sock *sk, struct hci_dev *hdev, 7151 void *data, u16 len) 7152 { 7153 struct mgmt_mode *cp = data; 7154 bool changed, use_changed; 7155 int err; 7156 7157 bt_dev_dbg(hdev, "sock %p", sk); 7158 7159 if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02) 7160 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEBUG_KEYS, 7161 MGMT_STATUS_INVALID_PARAMS); 7162 7163 hci_dev_lock(hdev); 7164 7165 if (cp->val) 7166 changed = !hci_dev_test_and_set_flag(hdev, HCI_KEEP_DEBUG_KEYS); 7167 else 7168 changed = hci_dev_test_and_clear_flag(hdev, 7169 HCI_KEEP_DEBUG_KEYS); 7170 7171 if (cp->val == 0x02) 7172 use_changed = !hci_dev_test_and_set_flag(hdev, 7173 HCI_USE_DEBUG_KEYS); 7174 else 7175 use_changed = hci_dev_test_and_clear_flag(hdev, 7176 HCI_USE_DEBUG_KEYS); 7177 7178 if (hdev_is_powered(hdev) && use_changed && 7179 hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) { 7180 u8 mode = (cp->val == 0x02) ? 0x01 : 0x00; 7181 hci_send_cmd(hdev, HCI_OP_WRITE_SSP_DEBUG_MODE, 7182 sizeof(mode), &mode); 7183 } 7184 7185 err = send_settings_rsp(sk, MGMT_OP_SET_DEBUG_KEYS, hdev); 7186 if (err < 0) 7187 goto unlock; 7188 7189 if (changed) 7190 err = new_settings(hdev, sk); 7191 7192 unlock: 7193 hci_dev_unlock(hdev); 7194 return err; 7195 } 7196 7197 static int set_privacy(struct sock *sk, struct hci_dev *hdev, void *cp_data, 7198 u16 len) 7199 { 7200 struct mgmt_cp_set_privacy *cp = cp_data; 7201 bool changed; 7202 int err; 7203 7204 bt_dev_dbg(hdev, "sock %p", sk); 7205 7206 if (!lmp_le_capable(hdev)) 7207 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY, 7208 MGMT_STATUS_NOT_SUPPORTED); 7209 7210 if (cp->privacy != 0x00 && cp->privacy != 0x01 && cp->privacy != 0x02) 7211 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY, 7212 MGMT_STATUS_INVALID_PARAMS); 7213 7214 if (hdev_is_powered(hdev)) 7215 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY, 7216 MGMT_STATUS_REJECTED); 7217 7218 hci_dev_lock(hdev); 7219 7220 /* If user space supports this command it is also expected to 7221 * handle IRKs. Therefore, set the HCI_RPA_RESOLVING flag. 7222 */ 7223 hci_dev_set_flag(hdev, HCI_RPA_RESOLVING); 7224 7225 if (cp->privacy) { 7226 changed = !hci_dev_test_and_set_flag(hdev, HCI_PRIVACY); 7227 memcpy(hdev->irk, cp->irk, sizeof(hdev->irk)); 7228 hci_dev_set_flag(hdev, HCI_RPA_EXPIRED); 7229 hci_adv_instances_set_rpa_expired(hdev, true); 7230 if (cp->privacy == 0x02) 7231 hci_dev_set_flag(hdev, HCI_LIMITED_PRIVACY); 7232 else 7233 hci_dev_clear_flag(hdev, HCI_LIMITED_PRIVACY); 7234 } else { 7235 changed = hci_dev_test_and_clear_flag(hdev, HCI_PRIVACY); 7236 memset(hdev->irk, 0, sizeof(hdev->irk)); 7237 hci_dev_clear_flag(hdev, HCI_RPA_EXPIRED); 7238 hci_adv_instances_set_rpa_expired(hdev, false); 7239 hci_dev_clear_flag(hdev, HCI_LIMITED_PRIVACY); 7240 } 7241 7242 err = send_settings_rsp(sk, MGMT_OP_SET_PRIVACY, hdev); 7243 if (err < 0) 7244 goto unlock; 7245 7246 if (changed) 7247 err = new_settings(hdev, sk); 7248 7249 unlock: 7250 hci_dev_unlock(hdev); 7251 return err; 7252 } 7253 7254 static bool irk_is_valid(struct mgmt_irk_info *irk) 7255 { 7256 switch (irk->addr.type) { 7257 case BDADDR_LE_PUBLIC: 7258 return true; 7259 7260 case BDADDR_LE_RANDOM: 7261 /* Two most significant bits shall be set */ 7262 if ((irk->addr.bdaddr.b[5] & 0xc0) != 0xc0) 7263 return false; 7264 return true; 7265 } 7266 7267 return false; 7268 } 7269 7270 static int load_irks(struct sock *sk, struct hci_dev *hdev, void *cp_data, 7271 u16 len) 7272 { 7273 struct mgmt_cp_load_irks *cp = cp_data; 7274 const u16 max_irk_count = ((U16_MAX - sizeof(*cp)) / 7275 sizeof(struct mgmt_irk_info)); 7276 u16 irk_count, expected_len; 7277 int i, err; 7278 7279 bt_dev_dbg(hdev, "sock %p", sk); 7280 7281 if (!lmp_le_capable(hdev)) 7282 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS, 7283 MGMT_STATUS_NOT_SUPPORTED); 7284 7285 irk_count = __le16_to_cpu(cp->irk_count); 7286 if (irk_count > max_irk_count) { 7287 bt_dev_err(hdev, "load_irks: too big irk_count value %u", 7288 irk_count); 7289 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS, 7290 MGMT_STATUS_INVALID_PARAMS); 7291 } 7292 7293 expected_len = struct_size(cp, irks, irk_count); 7294 if (expected_len != len) { 7295 bt_dev_err(hdev, "load_irks: expected %u bytes, got %u bytes", 7296 expected_len, len); 7297 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS, 7298 MGMT_STATUS_INVALID_PARAMS); 7299 } 7300 7301 bt_dev_dbg(hdev, "irk_count %u", irk_count); 7302 7303 for (i = 0; i < irk_count; i++) { 7304 struct mgmt_irk_info *key = &cp->irks[i]; 7305 7306 if (!irk_is_valid(key)) 7307 return mgmt_cmd_status(sk, hdev->id, 7308 MGMT_OP_LOAD_IRKS, 7309 MGMT_STATUS_INVALID_PARAMS); 7310 } 7311 7312 hci_dev_lock(hdev); 7313 7314 hci_smp_irks_clear(hdev); 7315 7316 for (i = 0; i < irk_count; i++) { 7317 struct mgmt_irk_info *irk = &cp->irks[i]; 7318 7319 if (hci_is_blocked_key(hdev, 7320 HCI_BLOCKED_KEY_TYPE_IRK, 7321 irk->val)) { 7322 bt_dev_warn(hdev, "Skipping blocked IRK for %pMR", 7323 &irk->addr.bdaddr); 7324 continue; 7325 } 7326 7327 hci_add_irk(hdev, &irk->addr.bdaddr, 7328 le_addr_type(irk->addr.type), irk->val, 7329 BDADDR_ANY); 7330 } 7331 7332 hci_dev_set_flag(hdev, HCI_RPA_RESOLVING); 7333 7334 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_IRKS, 0, NULL, 0); 7335 7336 hci_dev_unlock(hdev); 7337 7338 return err; 7339 } 7340 7341 static bool ltk_is_valid(struct mgmt_ltk_info *key) 7342 { 7343 if (key->initiator != 0x00 && key->initiator != 0x01) 7344 return false; 7345 7346 if (key->enc_size > sizeof(key->val)) 7347 return false; 7348 7349 switch (key->addr.type) { 7350 case BDADDR_LE_PUBLIC: 7351 return true; 7352 7353 case BDADDR_LE_RANDOM: 7354 /* Two most significant bits shall be set */ 7355 if ((key->addr.bdaddr.b[5] & 0xc0) != 0xc0) 7356 return false; 7357 return true; 7358 } 7359 7360 return false; 7361 } 7362 7363 static int load_long_term_keys(struct sock *sk, struct hci_dev *hdev, 7364 void *cp_data, u16 len) 7365 { 7366 struct mgmt_cp_load_long_term_keys *cp = cp_data; 7367 const u16 max_key_count = ((U16_MAX - sizeof(*cp)) / 7368 sizeof(struct mgmt_ltk_info)); 7369 u16 key_count, expected_len; 7370 int i, err; 7371 7372 bt_dev_dbg(hdev, "sock %p", sk); 7373 7374 if (!lmp_le_capable(hdev)) 7375 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS, 7376 MGMT_STATUS_NOT_SUPPORTED); 7377 7378 key_count = __le16_to_cpu(cp->key_count); 7379 if (key_count > max_key_count) { 7380 bt_dev_err(hdev, "load_ltks: too big key_count value %u", 7381 key_count); 7382 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS, 7383 MGMT_STATUS_INVALID_PARAMS); 7384 } 7385 7386 expected_len = struct_size(cp, keys, key_count); 7387 if (expected_len != len) { 7388 bt_dev_err(hdev, "load_keys: expected %u bytes, got %u bytes", 7389 expected_len, len); 7390 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS, 7391 MGMT_STATUS_INVALID_PARAMS); 7392 } 7393 7394 bt_dev_dbg(hdev, "key_count %u", key_count); 7395 7396 hci_dev_lock(hdev); 7397 7398 hci_smp_ltks_clear(hdev); 7399 7400 for (i = 0; i < key_count; i++) { 7401 struct mgmt_ltk_info *key = &cp->keys[i]; 7402 u8 type, authenticated; 7403 7404 if (hci_is_blocked_key(hdev, 7405 HCI_BLOCKED_KEY_TYPE_LTK, 7406 key->val)) { 7407 bt_dev_warn(hdev, "Skipping blocked LTK for %pMR", 7408 &key->addr.bdaddr); 7409 continue; 7410 } 7411 7412 if (!ltk_is_valid(key)) { 7413 bt_dev_warn(hdev, "Invalid LTK for %pMR", 7414 &key->addr.bdaddr); 7415 continue; 7416 } 7417 7418 switch (key->type) { 7419 case MGMT_LTK_UNAUTHENTICATED: 7420 authenticated = 0x00; 7421 type = key->initiator ? SMP_LTK : SMP_LTK_RESPONDER; 7422 break; 7423 case MGMT_LTK_AUTHENTICATED: 7424 authenticated = 0x01; 7425 type = key->initiator ? SMP_LTK : SMP_LTK_RESPONDER; 7426 break; 7427 case MGMT_LTK_P256_UNAUTH: 7428 authenticated = 0x00; 7429 type = SMP_LTK_P256; 7430 break; 7431 case MGMT_LTK_P256_AUTH: 7432 authenticated = 0x01; 7433 type = SMP_LTK_P256; 7434 break; 7435 case MGMT_LTK_P256_DEBUG: 7436 authenticated = 0x00; 7437 type = SMP_LTK_P256_DEBUG; 7438 fallthrough; 7439 default: 7440 continue; 7441 } 7442 7443 hci_add_ltk(hdev, &key->addr.bdaddr, 7444 le_addr_type(key->addr.type), type, authenticated, 7445 key->val, key->enc_size, key->ediv, key->rand); 7446 } 7447 7448 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS, 0, 7449 NULL, 0); 7450 7451 hci_dev_unlock(hdev); 7452 7453 return err; 7454 } 7455 7456 static void get_conn_info_complete(struct hci_dev *hdev, void *data, int err) 7457 { 7458 struct mgmt_pending_cmd *cmd = data; 7459 struct hci_conn *conn = cmd->user_data; 7460 struct mgmt_cp_get_conn_info *cp = cmd->param; 7461 struct mgmt_rp_get_conn_info rp; 7462 u8 status; 7463 7464 bt_dev_dbg(hdev, "err %d", err); 7465 7466 memcpy(&rp.addr, &cp->addr, sizeof(rp.addr)); 7467 7468 status = mgmt_status(err); 7469 if (status == MGMT_STATUS_SUCCESS) { 7470 rp.rssi = conn->rssi; 7471 rp.tx_power = conn->tx_power; 7472 rp.max_tx_power = conn->max_tx_power; 7473 } else { 7474 rp.rssi = HCI_RSSI_INVALID; 7475 rp.tx_power = HCI_TX_POWER_INVALID; 7476 rp.max_tx_power = HCI_TX_POWER_INVALID; 7477 } 7478 7479 if (conn) 7480 hci_conn_put(conn); 7481 7482 mgmt_cmd_complete(cmd->sk, cmd->hdev->id, MGMT_OP_GET_CONN_INFO, status, 7483 &rp, sizeof(rp)); 7484 7485 mgmt_pending_free(cmd); 7486 } 7487 7488 static int get_conn_info_sync(struct hci_dev *hdev, void *data) 7489 { 7490 struct mgmt_pending_cmd *cmd = data; 7491 struct mgmt_cp_get_conn_info *cp = cmd->param; 7492 struct hci_conn *conn; 7493 int err; 7494 __le16 handle; 7495 7496 hci_dev_lock(hdev); 7497 7498 /* Make sure we are still connected */ 7499 if (cp->addr.type == BDADDR_BREDR) 7500 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, 7501 &cp->addr.bdaddr); 7502 else 7503 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &cp->addr.bdaddr); 7504 7505 if (!conn || conn->state != BT_CONNECTED) { 7506 hci_dev_unlock(hdev); 7507 return MGMT_STATUS_NOT_CONNECTED; 7508 } 7509 7510 cmd->user_data = hci_conn_get(conn); 7511 handle = cpu_to_le16(conn->handle); 7512 7513 hci_dev_unlock(hdev); 7514 7515 /* Refresh RSSI each time */ 7516 err = hci_read_rssi_sync(hdev, handle); 7517 7518 /* For LE links TX power does not change thus we don't need to 7519 * query for it once value is known. 7520 */ 7521 if (!err && (!bdaddr_type_is_le(cp->addr.type) || 7522 conn->tx_power == HCI_TX_POWER_INVALID)) 7523 err = hci_read_tx_power_sync(hdev, handle, 0x00); 7524 7525 /* Max TX power needs to be read only once per connection */ 7526 if (!err && conn->max_tx_power == HCI_TX_POWER_INVALID) 7527 err = hci_read_tx_power_sync(hdev, handle, 0x01); 7528 7529 return err; 7530 } 7531 7532 static int get_conn_info(struct sock *sk, struct hci_dev *hdev, void *data, 7533 u16 len) 7534 { 7535 struct mgmt_cp_get_conn_info *cp = data; 7536 struct mgmt_rp_get_conn_info rp; 7537 struct hci_conn *conn; 7538 unsigned long conn_info_age; 7539 int err = 0; 7540 7541 bt_dev_dbg(hdev, "sock %p", sk); 7542 7543 memset(&rp, 0, sizeof(rp)); 7544 bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr); 7545 rp.addr.type = cp->addr.type; 7546 7547 if (!bdaddr_type_is_valid(cp->addr.type)) 7548 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO, 7549 MGMT_STATUS_INVALID_PARAMS, 7550 &rp, sizeof(rp)); 7551 7552 hci_dev_lock(hdev); 7553 7554 if (!hdev_is_powered(hdev)) { 7555 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO, 7556 MGMT_STATUS_NOT_POWERED, &rp, 7557 sizeof(rp)); 7558 goto unlock; 7559 } 7560 7561 if (cp->addr.type == BDADDR_BREDR) 7562 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, 7563 &cp->addr.bdaddr); 7564 else 7565 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &cp->addr.bdaddr); 7566 7567 if (!conn || conn->state != BT_CONNECTED) { 7568 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO, 7569 MGMT_STATUS_NOT_CONNECTED, &rp, 7570 sizeof(rp)); 7571 goto unlock; 7572 } 7573 7574 /* To avoid client trying to guess when to poll again for information we 7575 * calculate conn info age as random value between min/max set in hdev. 7576 */ 7577 conn_info_age = get_random_u32_inclusive(hdev->conn_info_min_age, 7578 hdev->conn_info_max_age - 1); 7579 7580 /* Query controller to refresh cached values if they are too old or were 7581 * never read. 7582 */ 7583 if (time_after(jiffies, conn->conn_info_timestamp + 7584 msecs_to_jiffies(conn_info_age)) || 7585 !conn->conn_info_timestamp) { 7586 struct mgmt_pending_cmd *cmd; 7587 7588 cmd = mgmt_pending_new(sk, MGMT_OP_GET_CONN_INFO, hdev, data, 7589 len); 7590 if (!cmd) { 7591 err = -ENOMEM; 7592 } else { 7593 err = hci_cmd_sync_queue(hdev, get_conn_info_sync, 7594 cmd, get_conn_info_complete); 7595 } 7596 7597 if (err < 0) { 7598 mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO, 7599 MGMT_STATUS_FAILED, &rp, sizeof(rp)); 7600 7601 if (cmd) 7602 mgmt_pending_free(cmd); 7603 7604 goto unlock; 7605 } 7606 7607 conn->conn_info_timestamp = jiffies; 7608 } else { 7609 /* Cache is valid, just reply with values cached in hci_conn */ 7610 rp.rssi = conn->rssi; 7611 rp.tx_power = conn->tx_power; 7612 rp.max_tx_power = conn->max_tx_power; 7613 7614 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO, 7615 MGMT_STATUS_SUCCESS, &rp, sizeof(rp)); 7616 } 7617 7618 unlock: 7619 hci_dev_unlock(hdev); 7620 return err; 7621 } 7622 7623 static void get_clock_info_complete(struct hci_dev *hdev, void *data, int err) 7624 { 7625 struct mgmt_pending_cmd *cmd = data; 7626 struct mgmt_cp_get_clock_info *cp = cmd->param; 7627 struct mgmt_rp_get_clock_info rp; 7628 struct hci_conn *conn = cmd->user_data; 7629 u8 status = mgmt_status(err); 7630 7631 bt_dev_dbg(hdev, "err %d", err); 7632 7633 memset(&rp, 0, sizeof(rp)); 7634 bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr); 7635 rp.addr.type = cp->addr.type; 7636 7637 if (err) 7638 goto complete; 7639 7640 rp.local_clock = cpu_to_le32(hdev->clock); 7641 7642 if (conn) { 7643 rp.piconet_clock = cpu_to_le32(conn->clock); 7644 rp.accuracy = cpu_to_le16(conn->clock_accuracy); 7645 } 7646 7647 complete: 7648 if (conn) 7649 hci_conn_put(conn); 7650 7651 mgmt_cmd_complete(cmd->sk, cmd->hdev->id, cmd->opcode, status, &rp, 7652 sizeof(rp)); 7653 7654 mgmt_pending_free(cmd); 7655 } 7656 7657 static int get_clock_info_sync(struct hci_dev *hdev, void *data) 7658 { 7659 struct mgmt_pending_cmd *cmd = data; 7660 struct mgmt_cp_get_clock_info *cp = cmd->param; 7661 struct hci_cp_read_clock hci_cp; 7662 struct hci_conn *conn; 7663 7664 memset(&hci_cp, 0, sizeof(hci_cp)); 7665 hci_read_clock_sync(hdev, &hci_cp); 7666 7667 hci_dev_lock(hdev); 7668 7669 /* Make sure connection still exists */ 7670 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->addr.bdaddr); 7671 if (!conn || conn->state != BT_CONNECTED) { 7672 hci_dev_unlock(hdev); 7673 return MGMT_STATUS_NOT_CONNECTED; 7674 } 7675 7676 cmd->user_data = hci_conn_get(conn); 7677 hci_cp.handle = cpu_to_le16(conn->handle); 7678 hci_cp.which = 0x01; /* Piconet clock */ 7679 7680 hci_dev_unlock(hdev); 7681 7682 return hci_read_clock_sync(hdev, &hci_cp); 7683 } 7684 7685 static int get_clock_info(struct sock *sk, struct hci_dev *hdev, void *data, 7686 u16 len) 7687 { 7688 struct mgmt_cp_get_clock_info *cp = data; 7689 struct mgmt_rp_get_clock_info rp; 7690 struct mgmt_pending_cmd *cmd; 7691 struct hci_conn *conn; 7692 int err; 7693 7694 bt_dev_dbg(hdev, "sock %p", sk); 7695 7696 memset(&rp, 0, sizeof(rp)); 7697 bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr); 7698 rp.addr.type = cp->addr.type; 7699 7700 if (cp->addr.type != BDADDR_BREDR) 7701 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CLOCK_INFO, 7702 MGMT_STATUS_INVALID_PARAMS, 7703 &rp, sizeof(rp)); 7704 7705 hci_dev_lock(hdev); 7706 7707 if (!hdev_is_powered(hdev)) { 7708 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CLOCK_INFO, 7709 MGMT_STATUS_NOT_POWERED, &rp, 7710 sizeof(rp)); 7711 goto unlock; 7712 } 7713 7714 if (bacmp(&cp->addr.bdaddr, BDADDR_ANY)) { 7715 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, 7716 &cp->addr.bdaddr); 7717 if (!conn || conn->state != BT_CONNECTED) { 7718 err = mgmt_cmd_complete(sk, hdev->id, 7719 MGMT_OP_GET_CLOCK_INFO, 7720 MGMT_STATUS_NOT_CONNECTED, 7721 &rp, sizeof(rp)); 7722 goto unlock; 7723 } 7724 } else { 7725 conn = NULL; 7726 } 7727 7728 cmd = mgmt_pending_new(sk, MGMT_OP_GET_CLOCK_INFO, hdev, data, len); 7729 if (!cmd) 7730 err = -ENOMEM; 7731 else 7732 err = hci_cmd_sync_queue(hdev, get_clock_info_sync, cmd, 7733 get_clock_info_complete); 7734 7735 if (err < 0) { 7736 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CLOCK_INFO, 7737 MGMT_STATUS_FAILED, &rp, sizeof(rp)); 7738 7739 if (cmd) 7740 mgmt_pending_free(cmd); 7741 } 7742 7743 7744 unlock: 7745 hci_dev_unlock(hdev); 7746 return err; 7747 } 7748 7749 static void device_added(struct sock *sk, struct hci_dev *hdev, 7750 bdaddr_t *bdaddr, u8 type, u8 action) 7751 { 7752 struct mgmt_ev_device_added ev; 7753 7754 bacpy(&ev.addr.bdaddr, bdaddr); 7755 ev.addr.type = type; 7756 ev.action = action; 7757 7758 mgmt_event(MGMT_EV_DEVICE_ADDED, hdev, &ev, sizeof(ev), sk); 7759 } 7760 7761 static void add_device_complete(struct hci_dev *hdev, void *data, int err) 7762 { 7763 struct mgmt_pending_cmd *cmd = data; 7764 struct mgmt_cp_add_device *cp = cmd->param; 7765 7766 if (!err) { 7767 struct hci_conn_params *params; 7768 7769 hci_dev_lock(hdev); 7770 7771 params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr, 7772 le_addr_type(cp->addr.type)); 7773 7774 device_added(cmd->sk, hdev, &cp->addr.bdaddr, cp->addr.type, 7775 cp->action); 7776 device_flags_changed(NULL, hdev, &cp->addr.bdaddr, 7777 cp->addr.type, hdev->conn_flags, 7778 params ? params->flags : 0); 7779 hci_dev_unlock(hdev); 7780 } 7781 7782 mgmt_cmd_complete(cmd->sk, hdev->id, MGMT_OP_ADD_DEVICE, 7783 mgmt_status(err), &cp->addr, sizeof(cp->addr)); 7784 mgmt_pending_free(cmd); 7785 } 7786 7787 static int add_device_sync(struct hci_dev *hdev, void *data) 7788 { 7789 return hci_update_passive_scan_sync(hdev); 7790 } 7791 7792 static int add_device(struct sock *sk, struct hci_dev *hdev, 7793 void *data, u16 len) 7794 { 7795 struct mgmt_pending_cmd *cmd; 7796 struct mgmt_cp_add_device *cp = data; 7797 u8 auto_conn, addr_type; 7798 struct hci_conn_params *params; 7799 int err; 7800 u32 current_flags = 0; 7801 u32 supported_flags; 7802 7803 bt_dev_dbg(hdev, "sock %p", sk); 7804 7805 if (!bdaddr_type_is_valid(cp->addr.type) || 7806 !bacmp(&cp->addr.bdaddr, BDADDR_ANY)) 7807 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE, 7808 MGMT_STATUS_INVALID_PARAMS, 7809 &cp->addr, sizeof(cp->addr)); 7810 7811 if (cp->action != 0x00 && cp->action != 0x01 && cp->action != 0x02) 7812 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE, 7813 MGMT_STATUS_INVALID_PARAMS, 7814 &cp->addr, sizeof(cp->addr)); 7815 7816 hci_dev_lock(hdev); 7817 7818 if (cp->addr.type == BDADDR_BREDR) { 7819 /* Only incoming connections action is supported for now */ 7820 if (cp->action != 0x01) { 7821 err = mgmt_cmd_complete(sk, hdev->id, 7822 MGMT_OP_ADD_DEVICE, 7823 MGMT_STATUS_INVALID_PARAMS, 7824 &cp->addr, sizeof(cp->addr)); 7825 goto unlock; 7826 } 7827 7828 err = hci_bdaddr_list_add_with_flags(&hdev->accept_list, 7829 &cp->addr.bdaddr, 7830 cp->addr.type, 0); 7831 if (err) 7832 goto unlock; 7833 7834 hci_update_scan(hdev); 7835 7836 goto added; 7837 } 7838 7839 addr_type = le_addr_type(cp->addr.type); 7840 7841 if (cp->action == 0x02) 7842 auto_conn = HCI_AUTO_CONN_ALWAYS; 7843 else if (cp->action == 0x01) 7844 auto_conn = HCI_AUTO_CONN_DIRECT; 7845 else 7846 auto_conn = HCI_AUTO_CONN_REPORT; 7847 7848 /* Kernel internally uses conn_params with resolvable private 7849 * address, but Add Device allows only identity addresses. 7850 * Make sure it is enforced before calling 7851 * hci_conn_params_lookup. 7852 */ 7853 if (!hci_is_identity_address(&cp->addr.bdaddr, addr_type)) { 7854 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE, 7855 MGMT_STATUS_INVALID_PARAMS, 7856 &cp->addr, sizeof(cp->addr)); 7857 goto unlock; 7858 } 7859 7860 /* If the connection parameters don't exist for this device, 7861 * they will be created and configured with defaults. 7862 */ 7863 params = hci_conn_params_set(hdev, &cp->addr.bdaddr, addr_type, 7864 auto_conn); 7865 if (!params) { 7866 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE, 7867 MGMT_STATUS_FAILED, &cp->addr, 7868 sizeof(cp->addr)); 7869 goto unlock; 7870 } 7871 7872 cmd = mgmt_pending_new(sk, MGMT_OP_ADD_DEVICE, hdev, data, len); 7873 if (!cmd) { 7874 err = -ENOMEM; 7875 goto unlock; 7876 } 7877 7878 err = hci_cmd_sync_queue(hdev, add_device_sync, cmd, 7879 add_device_complete); 7880 if (err < 0) { 7881 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE, 7882 MGMT_STATUS_FAILED, &cp->addr, 7883 sizeof(cp->addr)); 7884 mgmt_pending_free(cmd); 7885 } 7886 7887 goto unlock; 7888 7889 added: 7890 device_added(sk, hdev, &cp->addr.bdaddr, cp->addr.type, cp->action); 7891 supported_flags = hdev->conn_flags; 7892 device_flags_changed(NULL, hdev, &cp->addr.bdaddr, cp->addr.type, 7893 supported_flags, current_flags); 7894 7895 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE, 7896 MGMT_STATUS_SUCCESS, &cp->addr, 7897 sizeof(cp->addr)); 7898 7899 unlock: 7900 hci_dev_unlock(hdev); 7901 return err; 7902 } 7903 7904 static void device_removed(struct sock *sk, struct hci_dev *hdev, 7905 bdaddr_t *bdaddr, u8 type) 7906 { 7907 struct mgmt_ev_device_removed ev; 7908 7909 bacpy(&ev.addr.bdaddr, bdaddr); 7910 ev.addr.type = type; 7911 7912 mgmt_event(MGMT_EV_DEVICE_REMOVED, hdev, &ev, sizeof(ev), sk); 7913 } 7914 7915 static int remove_device_sync(struct hci_dev *hdev, void *data) 7916 { 7917 return hci_update_passive_scan_sync(hdev); 7918 } 7919 7920 static int remove_device(struct sock *sk, struct hci_dev *hdev, 7921 void *data, u16 len) 7922 { 7923 struct mgmt_cp_remove_device *cp = data; 7924 int err; 7925 7926 bt_dev_dbg(hdev, "sock %p", sk); 7927 7928 hci_dev_lock(hdev); 7929 7930 if (bacmp(&cp->addr.bdaddr, BDADDR_ANY)) { 7931 struct hci_conn_params *params; 7932 u8 addr_type; 7933 7934 if (!bdaddr_type_is_valid(cp->addr.type)) { 7935 err = mgmt_cmd_complete(sk, hdev->id, 7936 MGMT_OP_REMOVE_DEVICE, 7937 MGMT_STATUS_INVALID_PARAMS, 7938 &cp->addr, sizeof(cp->addr)); 7939 goto unlock; 7940 } 7941 7942 if (cp->addr.type == BDADDR_BREDR) { 7943 err = hci_bdaddr_list_del(&hdev->accept_list, 7944 &cp->addr.bdaddr, 7945 cp->addr.type); 7946 if (err) { 7947 err = mgmt_cmd_complete(sk, hdev->id, 7948 MGMT_OP_REMOVE_DEVICE, 7949 MGMT_STATUS_INVALID_PARAMS, 7950 &cp->addr, 7951 sizeof(cp->addr)); 7952 goto unlock; 7953 } 7954 7955 hci_update_scan(hdev); 7956 7957 device_removed(sk, hdev, &cp->addr.bdaddr, 7958 cp->addr.type); 7959 goto complete; 7960 } 7961 7962 addr_type = le_addr_type(cp->addr.type); 7963 7964 /* Kernel internally uses conn_params with resolvable private 7965 * address, but Remove Device allows only identity addresses. 7966 * Make sure it is enforced before calling 7967 * hci_conn_params_lookup. 7968 */ 7969 if (!hci_is_identity_address(&cp->addr.bdaddr, addr_type)) { 7970 err = mgmt_cmd_complete(sk, hdev->id, 7971 MGMT_OP_REMOVE_DEVICE, 7972 MGMT_STATUS_INVALID_PARAMS, 7973 &cp->addr, sizeof(cp->addr)); 7974 goto unlock; 7975 } 7976 7977 params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr, 7978 addr_type); 7979 if (!params) { 7980 err = mgmt_cmd_complete(sk, hdev->id, 7981 MGMT_OP_REMOVE_DEVICE, 7982 MGMT_STATUS_INVALID_PARAMS, 7983 &cp->addr, sizeof(cp->addr)); 7984 goto unlock; 7985 } 7986 7987 if (params->auto_connect == HCI_AUTO_CONN_DISABLED || 7988 params->auto_connect == HCI_AUTO_CONN_EXPLICIT) { 7989 err = mgmt_cmd_complete(sk, hdev->id, 7990 MGMT_OP_REMOVE_DEVICE, 7991 MGMT_STATUS_INVALID_PARAMS, 7992 &cp->addr, sizeof(cp->addr)); 7993 goto unlock; 7994 } 7995 7996 hci_conn_params_free(params); 7997 7998 device_removed(sk, hdev, &cp->addr.bdaddr, cp->addr.type); 7999 } else { 8000 struct hci_conn_params *p, *tmp; 8001 struct bdaddr_list *b, *btmp; 8002 8003 if (cp->addr.type) { 8004 err = mgmt_cmd_complete(sk, hdev->id, 8005 MGMT_OP_REMOVE_DEVICE, 8006 MGMT_STATUS_INVALID_PARAMS, 8007 &cp->addr, sizeof(cp->addr)); 8008 goto unlock; 8009 } 8010 8011 list_for_each_entry_safe(b, btmp, &hdev->accept_list, list) { 8012 device_removed(sk, hdev, &b->bdaddr, b->bdaddr_type); 8013 list_del(&b->list); 8014 kfree(b); 8015 } 8016 8017 hci_update_scan(hdev); 8018 8019 list_for_each_entry_safe(p, tmp, &hdev->le_conn_params, list) { 8020 if (p->auto_connect == HCI_AUTO_CONN_DISABLED) 8021 continue; 8022 device_removed(sk, hdev, &p->addr, p->addr_type); 8023 if (p->explicit_connect) { 8024 p->auto_connect = HCI_AUTO_CONN_EXPLICIT; 8025 continue; 8026 } 8027 hci_conn_params_free(p); 8028 } 8029 8030 bt_dev_dbg(hdev, "All LE connection parameters were removed"); 8031 } 8032 8033 hci_cmd_sync_queue(hdev, remove_device_sync, NULL, NULL); 8034 8035 complete: 8036 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_DEVICE, 8037 MGMT_STATUS_SUCCESS, &cp->addr, 8038 sizeof(cp->addr)); 8039 unlock: 8040 hci_dev_unlock(hdev); 8041 return err; 8042 } 8043 8044 static int conn_update_sync(struct hci_dev *hdev, void *data) 8045 { 8046 struct hci_conn *conn = data; 8047 struct hci_conn_params *params; 8048 struct hci_conn_params local = {}; 8049 8050 hci_dev_lock(hdev); 8051 8052 if (!hci_conn_valid(hdev, conn) || conn->role != HCI_ROLE_MASTER) 8053 goto cancel; 8054 8055 params = hci_conn_params_lookup(hdev, &conn->dst, conn->dst_type); 8056 if (!params) 8057 goto cancel; 8058 8059 local.conn_min_interval = params->conn_min_interval; 8060 local.conn_max_interval = params->conn_max_interval; 8061 local.conn_latency = params->conn_latency; 8062 local.supervision_timeout = params->supervision_timeout; 8063 8064 hci_dev_unlock(hdev); 8065 8066 return hci_le_conn_update_sync(hdev, conn, &local); 8067 8068 cancel: 8069 hci_dev_unlock(hdev); 8070 return -ECANCELED; 8071 } 8072 8073 static void conn_update_sync_destroy(struct hci_dev *hdev, void *data, int err) 8074 { 8075 hci_conn_put(data); 8076 } 8077 8078 static int load_conn_param(struct sock *sk, struct hci_dev *hdev, void *data, 8079 u16 len) 8080 { 8081 struct mgmt_cp_load_conn_param *cp = data; 8082 const u16 max_param_count = ((U16_MAX - sizeof(*cp)) / 8083 sizeof(struct mgmt_conn_param)); 8084 u16 param_count, expected_len; 8085 int i; 8086 8087 if (!lmp_le_capable(hdev)) 8088 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM, 8089 MGMT_STATUS_NOT_SUPPORTED); 8090 8091 param_count = __le16_to_cpu(cp->param_count); 8092 if (param_count > max_param_count) { 8093 bt_dev_err(hdev, "load_conn_param: too big param_count value %u", 8094 param_count); 8095 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM, 8096 MGMT_STATUS_INVALID_PARAMS); 8097 } 8098 8099 expected_len = struct_size(cp, params, param_count); 8100 if (expected_len != len) { 8101 bt_dev_err(hdev, "load_conn_param: expected %u bytes, got %u bytes", 8102 expected_len, len); 8103 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM, 8104 MGMT_STATUS_INVALID_PARAMS); 8105 } 8106 8107 bt_dev_dbg(hdev, "param_count %u", param_count); 8108 8109 hci_dev_lock(hdev); 8110 8111 if (param_count > 1) 8112 hci_conn_params_clear_disabled(hdev); 8113 8114 for (i = 0; i < param_count; i++) { 8115 struct mgmt_conn_param *param = &cp->params[i]; 8116 struct hci_conn_params *hci_param; 8117 u16 min, max, latency, timeout; 8118 bool update = false; 8119 u8 addr_type; 8120 8121 bt_dev_dbg(hdev, "Adding %pMR (type %u)", ¶m->addr.bdaddr, 8122 param->addr.type); 8123 8124 if (param->addr.type == BDADDR_LE_PUBLIC) { 8125 addr_type = ADDR_LE_DEV_PUBLIC; 8126 } else if (param->addr.type == BDADDR_LE_RANDOM) { 8127 addr_type = ADDR_LE_DEV_RANDOM; 8128 } else { 8129 bt_dev_err(hdev, "ignoring invalid connection parameters"); 8130 continue; 8131 } 8132 8133 min = le16_to_cpu(param->min_interval); 8134 max = le16_to_cpu(param->max_interval); 8135 latency = le16_to_cpu(param->latency); 8136 timeout = le16_to_cpu(param->timeout); 8137 8138 bt_dev_dbg(hdev, "min 0x%04x max 0x%04x latency 0x%04x timeout 0x%04x", 8139 min, max, latency, timeout); 8140 8141 if (hci_check_conn_params(min, max, latency, timeout) < 0) { 8142 bt_dev_err(hdev, "ignoring invalid connection parameters"); 8143 continue; 8144 } 8145 8146 /* Detect when the loading is for an existing parameter then 8147 * attempt to trigger the connection update procedure. 8148 */ 8149 if (!i && param_count == 1) { 8150 hci_param = hci_conn_params_lookup(hdev, 8151 ¶m->addr.bdaddr, 8152 addr_type); 8153 if (hci_param) 8154 update = true; 8155 else 8156 hci_conn_params_clear_disabled(hdev); 8157 } 8158 8159 hci_param = hci_conn_params_add(hdev, ¶m->addr.bdaddr, 8160 addr_type); 8161 if (!hci_param) { 8162 bt_dev_err(hdev, "failed to add connection parameters"); 8163 continue; 8164 } 8165 8166 hci_param->conn_min_interval = min; 8167 hci_param->conn_max_interval = max; 8168 hci_param->conn_latency = latency; 8169 hci_param->supervision_timeout = timeout; 8170 8171 /* Check if we need to trigger a connection update */ 8172 if (update) { 8173 struct hci_conn *conn; 8174 8175 /* Lookup for existing connection as central and check 8176 * if parameters match and if they don't then trigger 8177 * a connection update. 8178 */ 8179 conn = hci_conn_hash_lookup_le(hdev, &hci_param->addr, 8180 addr_type); 8181 if (conn && conn->role == HCI_ROLE_MASTER && 8182 (conn->le_conn_min_interval != min || 8183 conn->le_conn_max_interval != max || 8184 conn->le_conn_latency != latency || 8185 conn->le_supv_timeout != timeout)) { 8186 hci_conn_get(conn); 8187 if (hci_cmd_sync_queue(hdev, conn_update_sync, 8188 conn, 8189 conn_update_sync_destroy) < 0) 8190 hci_conn_put(conn); 8191 } 8192 } 8193 } 8194 8195 hci_dev_unlock(hdev); 8196 8197 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM, 0, 8198 NULL, 0); 8199 } 8200 8201 static int load_conn_subrate(struct sock *sk, struct hci_dev *hdev, void *data, 8202 u16 len) 8203 { 8204 struct mgmt_cp_load_conn_subrate *cp = data; 8205 const u16 max_param_count = ((U16_MAX - sizeof(*cp)) / 8206 sizeof(struct mgmt_conn_subrate)); 8207 u16 param_count, expected_len; 8208 int i; 8209 8210 if (!lmp_le_capable(hdev) || !le_sci_capable(hdev)) 8211 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_SUBRATE, 8212 MGMT_STATUS_NOT_SUPPORTED); 8213 8214 param_count = __le16_to_cpu(cp->param_count); 8215 if (param_count > max_param_count) { 8216 bt_dev_err(hdev, "too big param_count value %u", param_count); 8217 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_SUBRATE, 8218 MGMT_STATUS_INVALID_PARAMS); 8219 } 8220 8221 expected_len = struct_size(cp, params, param_count); 8222 if (expected_len != len) { 8223 bt_dev_err(hdev, "expected %u bytes, got %u bytes", 8224 expected_len, len); 8225 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_SUBRATE, 8226 MGMT_STATUS_INVALID_PARAMS); 8227 } 8228 8229 bt_dev_dbg(hdev, "param_count %u", param_count); 8230 8231 hci_dev_lock(hdev); 8232 8233 for (i = 0; i < param_count; i++) { 8234 struct mgmt_conn_subrate *param = &cp->params[i]; 8235 struct hci_conn_params *hci_param; 8236 u16 min, max, subrate_min, subrate_max; 8237 u16 max_latency, cont_num, supv_timeout; 8238 u8 addr_type; 8239 8240 bt_dev_dbg(hdev, "Adding subrate %pMR (type %u)", 8241 ¶m->addr.bdaddr, param->addr.type); 8242 8243 if (param->addr.type == BDADDR_LE_PUBLIC) { 8244 addr_type = ADDR_LE_DEV_PUBLIC; 8245 } else if (param->addr.type == BDADDR_LE_RANDOM) { 8246 addr_type = ADDR_LE_DEV_RANDOM; 8247 } else { 8248 bt_dev_err(hdev, "ignoring invalid connection subrate parameters"); 8249 continue; 8250 } 8251 8252 min = le16_to_cpu(param->min_interval); 8253 max = le16_to_cpu(param->max_interval); 8254 subrate_min = le16_to_cpu(param->subrate_min); 8255 subrate_max = le16_to_cpu(param->subrate_max); 8256 max_latency = le16_to_cpu(param->max_latency); 8257 cont_num = le16_to_cpu(param->cont_num); 8258 supv_timeout = le16_to_cpu(param->supv_timeout); 8259 8260 /* Validate the parameters before storing them. Reject 8261 * logically inconsistent values instead of forwarding them to 8262 * the controller. 8263 */ 8264 if (min > max || subrate_min > subrate_max || 8265 subrate_min < 1 || supv_timeout < 1) { 8266 bt_dev_err(hdev, "ignoring invalid connection subrate parameters"); 8267 continue; 8268 } 8269 8270 hci_param = hci_conn_params_add(hdev, ¶m->addr.bdaddr, 8271 addr_type); 8272 if (!hci_param) { 8273 bt_dev_err(hdev, "failed to add connection parameters"); 8274 continue; 8275 } 8276 8277 hci_param->rate_min_interval = min; 8278 hci_param->rate_max_interval = max; 8279 hci_param->subrate_min = subrate_min; 8280 hci_param->subrate_max = subrate_max; 8281 hci_param->max_latency = max_latency; 8282 hci_param->cont_num = cont_num; 8283 hci_param->rate_supv_timeout = supv_timeout; 8284 8285 /* If the device is connected as central check if the 8286 * connection rate parameters need to be updated. 8287 */ 8288 if (!i && param_count == 1) { 8289 struct hci_conn *conn; 8290 8291 conn = hci_conn_hash_lookup_le(hdev, 8292 &hci_param->addr, 8293 addr_type); 8294 if (conn && conn->state == BT_CONNECTED && 8295 conn->role == HCI_ROLE_MASTER && 8296 (conn->le_rate_interval < min || 8297 conn->le_rate_interval > max || 8298 conn->le_subrate < subrate_min || 8299 conn->le_subrate > subrate_max || 8300 conn->le_rate_latency != max_latency || 8301 conn->le_cont_num != cont_num || 8302 conn->le_rate_supv_timeout != supv_timeout)) 8303 hci_le_conn_rate_request(hdev, conn); 8304 } 8305 } 8306 8307 hci_dev_unlock(hdev); 8308 8309 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_CONN_SUBRATE, 0, 8310 NULL, 0); 8311 } 8312 8313 static int set_external_config(struct sock *sk, struct hci_dev *hdev, 8314 void *data, u16 len) 8315 { 8316 struct mgmt_cp_set_external_config *cp = data; 8317 bool changed; 8318 int err; 8319 8320 bt_dev_dbg(hdev, "sock %p", sk); 8321 8322 if (hdev_is_powered(hdev)) 8323 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_EXTERNAL_CONFIG, 8324 MGMT_STATUS_REJECTED); 8325 8326 if (cp->config != 0x00 && cp->config != 0x01) 8327 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_EXTERNAL_CONFIG, 8328 MGMT_STATUS_INVALID_PARAMS); 8329 8330 if (!hci_test_quirk(hdev, HCI_QUIRK_EXTERNAL_CONFIG)) 8331 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_EXTERNAL_CONFIG, 8332 MGMT_STATUS_NOT_SUPPORTED); 8333 8334 hci_dev_lock(hdev); 8335 8336 if (cp->config) 8337 changed = !hci_dev_test_and_set_flag(hdev, HCI_EXT_CONFIGURED); 8338 else 8339 changed = hci_dev_test_and_clear_flag(hdev, HCI_EXT_CONFIGURED); 8340 8341 err = send_options_rsp(sk, MGMT_OP_SET_EXTERNAL_CONFIG, hdev); 8342 if (err < 0) 8343 goto unlock; 8344 8345 if (!changed) 8346 goto unlock; 8347 8348 err = new_options(hdev, sk); 8349 8350 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED) == is_configured(hdev)) { 8351 mgmt_index_removed(hdev); 8352 8353 if (hci_dev_test_and_change_flag(hdev, HCI_UNCONFIGURED)) { 8354 hci_dev_set_flag(hdev, HCI_CONFIG); 8355 hci_dev_set_flag(hdev, HCI_AUTO_OFF); 8356 8357 queue_work(hdev->req_workqueue, &hdev->power_on); 8358 } else { 8359 set_bit(HCI_RAW, &hdev->flags); 8360 mgmt_index_added(hdev); 8361 } 8362 } 8363 8364 unlock: 8365 hci_dev_unlock(hdev); 8366 return err; 8367 } 8368 8369 static int set_public_address(struct sock *sk, struct hci_dev *hdev, 8370 void *data, u16 len) 8371 { 8372 struct mgmt_cp_set_public_address *cp = data; 8373 bool changed; 8374 int err; 8375 8376 bt_dev_dbg(hdev, "sock %p", sk); 8377 8378 if (hdev_is_powered(hdev)) 8379 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PUBLIC_ADDRESS, 8380 MGMT_STATUS_REJECTED); 8381 8382 if (!bacmp(&cp->bdaddr, BDADDR_ANY)) 8383 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PUBLIC_ADDRESS, 8384 MGMT_STATUS_INVALID_PARAMS); 8385 8386 if (!hdev->set_bdaddr) 8387 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PUBLIC_ADDRESS, 8388 MGMT_STATUS_NOT_SUPPORTED); 8389 8390 hci_dev_lock(hdev); 8391 8392 changed = !!bacmp(&hdev->public_addr, &cp->bdaddr); 8393 bacpy(&hdev->public_addr, &cp->bdaddr); 8394 8395 err = send_options_rsp(sk, MGMT_OP_SET_PUBLIC_ADDRESS, hdev); 8396 if (err < 0) 8397 goto unlock; 8398 8399 if (!changed) 8400 goto unlock; 8401 8402 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) 8403 err = new_options(hdev, sk); 8404 8405 if (is_configured(hdev)) { 8406 mgmt_index_removed(hdev); 8407 8408 hci_dev_clear_flag(hdev, HCI_UNCONFIGURED); 8409 8410 hci_dev_set_flag(hdev, HCI_CONFIG); 8411 hci_dev_set_flag(hdev, HCI_AUTO_OFF); 8412 8413 queue_work(hdev->req_workqueue, &hdev->power_on); 8414 } 8415 8416 unlock: 8417 hci_dev_unlock(hdev); 8418 return err; 8419 } 8420 8421 static void read_local_oob_ext_data_complete(struct hci_dev *hdev, void *data, 8422 int err) 8423 { 8424 const struct mgmt_cp_read_local_oob_ext_data *mgmt_cp; 8425 struct mgmt_rp_read_local_oob_ext_data *mgmt_rp; 8426 u8 *h192, *r192, *h256, *r256; 8427 struct mgmt_pending_cmd *cmd = data; 8428 struct sk_buff *skb = cmd->skb; 8429 u8 status = mgmt_status(err); 8430 u16 eir_len; 8431 8432 if (!status) { 8433 if (!skb) 8434 status = MGMT_STATUS_FAILED; 8435 else if (IS_ERR(skb)) 8436 status = mgmt_status(PTR_ERR(skb)); 8437 else 8438 status = mgmt_status(skb->data[0]); 8439 } 8440 8441 bt_dev_dbg(hdev, "status %u", status); 8442 8443 mgmt_cp = cmd->param; 8444 8445 if (status) { 8446 status = mgmt_status(status); 8447 eir_len = 0; 8448 8449 h192 = NULL; 8450 r192 = NULL; 8451 h256 = NULL; 8452 r256 = NULL; 8453 } else if (!bredr_sc_enabled(hdev)) { 8454 struct hci_rp_read_local_oob_data *rp; 8455 8456 if (skb->len != sizeof(*rp)) { 8457 status = MGMT_STATUS_FAILED; 8458 eir_len = 0; 8459 } else { 8460 status = MGMT_STATUS_SUCCESS; 8461 rp = (void *)skb->data; 8462 8463 eir_len = 5 + 18 + 18; 8464 h192 = rp->hash; 8465 r192 = rp->rand; 8466 h256 = NULL; 8467 r256 = NULL; 8468 } 8469 } else { 8470 struct hci_rp_read_local_oob_ext_data *rp; 8471 8472 if (skb->len != sizeof(*rp)) { 8473 status = MGMT_STATUS_FAILED; 8474 eir_len = 0; 8475 } else { 8476 status = MGMT_STATUS_SUCCESS; 8477 rp = (void *)skb->data; 8478 8479 if (hci_dev_test_flag(hdev, HCI_SC_ONLY)) { 8480 eir_len = 5 + 18 + 18; 8481 h192 = NULL; 8482 r192 = NULL; 8483 } else { 8484 eir_len = 5 + 18 + 18 + 18 + 18; 8485 h192 = rp->hash192; 8486 r192 = rp->rand192; 8487 } 8488 8489 h256 = rp->hash256; 8490 r256 = rp->rand256; 8491 } 8492 } 8493 8494 mgmt_rp = kmalloc(sizeof(*mgmt_rp) + eir_len, GFP_KERNEL); 8495 if (!mgmt_rp) 8496 goto done; 8497 8498 if (eir_len == 0) 8499 goto send_rsp; 8500 8501 eir_len = eir_append_data(mgmt_rp->eir, 0, EIR_CLASS_OF_DEV, 8502 hdev->dev_class, 3); 8503 8504 if (h192 && r192) { 8505 eir_len = eir_append_data(mgmt_rp->eir, eir_len, 8506 EIR_SSP_HASH_C192, h192, 16); 8507 eir_len = eir_append_data(mgmt_rp->eir, eir_len, 8508 EIR_SSP_RAND_R192, r192, 16); 8509 } 8510 8511 if (h256 && r256) { 8512 eir_len = eir_append_data(mgmt_rp->eir, eir_len, 8513 EIR_SSP_HASH_C256, h256, 16); 8514 eir_len = eir_append_data(mgmt_rp->eir, eir_len, 8515 EIR_SSP_RAND_R256, r256, 16); 8516 } 8517 8518 send_rsp: 8519 mgmt_rp->type = mgmt_cp->type; 8520 mgmt_rp->eir_len = cpu_to_le16(eir_len); 8521 8522 err = mgmt_cmd_complete(cmd->sk, hdev->id, 8523 MGMT_OP_READ_LOCAL_OOB_EXT_DATA, status, 8524 mgmt_rp, sizeof(*mgmt_rp) + eir_len); 8525 if (err < 0 || status) 8526 goto done; 8527 8528 hci_sock_set_flag(cmd->sk, HCI_MGMT_OOB_DATA_EVENTS); 8529 8530 err = mgmt_limited_event(MGMT_EV_LOCAL_OOB_DATA_UPDATED, hdev, 8531 mgmt_rp, sizeof(*mgmt_rp) + eir_len, 8532 HCI_MGMT_OOB_DATA_EVENTS, cmd->sk); 8533 done: 8534 if (skb && !IS_ERR(skb)) 8535 kfree_skb(skb); 8536 8537 kfree(mgmt_rp); 8538 mgmt_pending_free(cmd); 8539 } 8540 8541 static int read_local_ssp_oob_req(struct hci_dev *hdev, struct sock *sk, 8542 struct mgmt_cp_read_local_oob_ext_data *cp) 8543 { 8544 struct mgmt_pending_cmd *cmd; 8545 int err; 8546 8547 cmd = mgmt_pending_new(sk, MGMT_OP_READ_LOCAL_OOB_EXT_DATA, hdev, 8548 cp, sizeof(*cp)); 8549 if (!cmd) 8550 return -ENOMEM; 8551 8552 err = hci_cmd_sync_queue(hdev, read_local_oob_data_sync, cmd, 8553 read_local_oob_ext_data_complete); 8554 8555 if (err < 0) { 8556 mgmt_pending_remove(cmd); 8557 return err; 8558 } 8559 8560 return 0; 8561 } 8562 8563 static int read_local_oob_ext_data(struct sock *sk, struct hci_dev *hdev, 8564 void *data, u16 data_len) 8565 { 8566 struct mgmt_cp_read_local_oob_ext_data *cp = data; 8567 struct mgmt_rp_read_local_oob_ext_data *rp; 8568 size_t rp_len; 8569 u16 eir_len; 8570 u8 status, flags, role, addr[7], hash[16], rand[16]; 8571 int err; 8572 8573 bt_dev_dbg(hdev, "sock %p", sk); 8574 8575 if (hdev_is_powered(hdev)) { 8576 switch (cp->type) { 8577 case BIT(BDADDR_BREDR): 8578 status = mgmt_bredr_support(hdev); 8579 if (status) 8580 eir_len = 0; 8581 else 8582 eir_len = 5; 8583 break; 8584 case (BIT(BDADDR_LE_PUBLIC) | BIT(BDADDR_LE_RANDOM)): 8585 status = mgmt_le_support(hdev); 8586 if (status) 8587 eir_len = 0; 8588 else 8589 eir_len = 9 + 3 + 18 + 18 + 3; 8590 break; 8591 default: 8592 status = MGMT_STATUS_INVALID_PARAMS; 8593 eir_len = 0; 8594 break; 8595 } 8596 } else { 8597 status = MGMT_STATUS_NOT_POWERED; 8598 eir_len = 0; 8599 } 8600 8601 rp_len = sizeof(*rp) + eir_len; 8602 rp = kmalloc(rp_len, GFP_ATOMIC); 8603 if (!rp) 8604 return -ENOMEM; 8605 8606 if (!status && !lmp_ssp_capable(hdev)) { 8607 status = MGMT_STATUS_NOT_SUPPORTED; 8608 eir_len = 0; 8609 } 8610 8611 if (status) 8612 goto complete; 8613 8614 hci_dev_lock(hdev); 8615 8616 eir_len = 0; 8617 switch (cp->type) { 8618 case BIT(BDADDR_BREDR): 8619 if (hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) { 8620 err = read_local_ssp_oob_req(hdev, sk, cp); 8621 hci_dev_unlock(hdev); 8622 if (!err) 8623 goto done; 8624 8625 status = MGMT_STATUS_FAILED; 8626 goto complete; 8627 } else { 8628 eir_len = eir_append_data(rp->eir, eir_len, 8629 EIR_CLASS_OF_DEV, 8630 hdev->dev_class, 3); 8631 } 8632 break; 8633 case (BIT(BDADDR_LE_PUBLIC) | BIT(BDADDR_LE_RANDOM)): 8634 if (hci_dev_test_flag(hdev, HCI_SC_ENABLED) && 8635 smp_generate_oob(hdev, hash, rand) < 0) { 8636 hci_dev_unlock(hdev); 8637 status = MGMT_STATUS_FAILED; 8638 goto complete; 8639 } 8640 8641 /* This should return the active RPA, but since the RPA 8642 * is only programmed on demand, it is really hard to fill 8643 * this in at the moment. For now disallow retrieving 8644 * local out-of-band data when privacy is in use. 8645 * 8646 * Returning the identity address will not help here since 8647 * pairing happens before the identity resolving key is 8648 * known and thus the connection establishment happens 8649 * based on the RPA and not the identity address. 8650 */ 8651 if (hci_dev_test_flag(hdev, HCI_PRIVACY)) { 8652 hci_dev_unlock(hdev); 8653 status = MGMT_STATUS_REJECTED; 8654 goto complete; 8655 } 8656 8657 if (hci_dev_test_flag(hdev, HCI_FORCE_STATIC_ADDR) || 8658 !bacmp(&hdev->bdaddr, BDADDR_ANY) || 8659 (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) && 8660 bacmp(&hdev->static_addr, BDADDR_ANY))) { 8661 memcpy(addr, &hdev->static_addr, 6); 8662 addr[6] = 0x01; 8663 } else { 8664 memcpy(addr, &hdev->bdaddr, 6); 8665 addr[6] = 0x00; 8666 } 8667 8668 eir_len = eir_append_data(rp->eir, eir_len, EIR_LE_BDADDR, 8669 addr, sizeof(addr)); 8670 8671 if (hci_dev_test_flag(hdev, HCI_ADVERTISING)) 8672 role = 0x02; 8673 else 8674 role = 0x01; 8675 8676 eir_len = eir_append_data(rp->eir, eir_len, EIR_LE_ROLE, 8677 &role, sizeof(role)); 8678 8679 if (hci_dev_test_flag(hdev, HCI_SC_ENABLED)) { 8680 eir_len = eir_append_data(rp->eir, eir_len, 8681 EIR_LE_SC_CONFIRM, 8682 hash, sizeof(hash)); 8683 8684 eir_len = eir_append_data(rp->eir, eir_len, 8685 EIR_LE_SC_RANDOM, 8686 rand, sizeof(rand)); 8687 } 8688 8689 flags = mgmt_get_adv_discov_flags(hdev); 8690 8691 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) 8692 flags |= LE_AD_NO_BREDR; 8693 8694 eir_len = eir_append_data(rp->eir, eir_len, EIR_FLAGS, 8695 &flags, sizeof(flags)); 8696 break; 8697 } 8698 8699 hci_dev_unlock(hdev); 8700 8701 hci_sock_set_flag(sk, HCI_MGMT_OOB_DATA_EVENTS); 8702 8703 status = MGMT_STATUS_SUCCESS; 8704 8705 complete: 8706 rp->type = cp->type; 8707 rp->eir_len = cpu_to_le16(eir_len); 8708 8709 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_EXT_DATA, 8710 status, rp, sizeof(*rp) + eir_len); 8711 if (err < 0 || status) 8712 goto done; 8713 8714 err = mgmt_limited_event(MGMT_EV_LOCAL_OOB_DATA_UPDATED, hdev, 8715 rp, sizeof(*rp) + eir_len, 8716 HCI_MGMT_OOB_DATA_EVENTS, sk); 8717 8718 done: 8719 kfree(rp); 8720 8721 return err; 8722 } 8723 8724 static u32 get_supported_adv_flags(struct hci_dev *hdev) 8725 { 8726 u32 flags = 0; 8727 8728 flags |= MGMT_ADV_FLAG_CONNECTABLE; 8729 flags |= MGMT_ADV_FLAG_DISCOV; 8730 flags |= MGMT_ADV_FLAG_LIMITED_DISCOV; 8731 flags |= MGMT_ADV_FLAG_MANAGED_FLAGS; 8732 flags |= MGMT_ADV_FLAG_APPEARANCE; 8733 flags |= MGMT_ADV_FLAG_LOCAL_NAME; 8734 flags |= MGMT_ADV_PARAM_DURATION; 8735 flags |= MGMT_ADV_PARAM_TIMEOUT; 8736 flags |= MGMT_ADV_PARAM_INTERVALS; 8737 flags |= MGMT_ADV_PARAM_TX_POWER; 8738 flags |= MGMT_ADV_PARAM_SCAN_RSP; 8739 8740 /* In extended adv TX_POWER returned from Set Adv Param 8741 * will be always valid. 8742 */ 8743 if (hdev->adv_tx_power != HCI_TX_POWER_INVALID || ext_adv_capable(hdev)) 8744 flags |= MGMT_ADV_FLAG_TX_POWER; 8745 8746 if (ext_adv_capable(hdev)) { 8747 flags |= MGMT_ADV_FLAG_SEC_1M; 8748 flags |= MGMT_ADV_FLAG_HW_OFFLOAD; 8749 flags |= MGMT_ADV_FLAG_CAN_SET_TX_POWER; 8750 8751 if (le_2m_capable(hdev)) 8752 flags |= MGMT_ADV_FLAG_SEC_2M; 8753 8754 if (le_coded_capable(hdev)) 8755 flags |= MGMT_ADV_FLAG_SEC_CODED; 8756 } 8757 8758 return flags; 8759 } 8760 8761 static int read_adv_features(struct sock *sk, struct hci_dev *hdev, 8762 void *data, u16 data_len) 8763 { 8764 struct mgmt_rp_read_adv_features *rp; 8765 size_t rp_len; 8766 int err; 8767 struct adv_info *adv_instance; 8768 u32 supported_flags; 8769 u8 *instance; 8770 8771 bt_dev_dbg(hdev, "sock %p", sk); 8772 8773 if (!lmp_le_capable(hdev)) 8774 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_ADV_FEATURES, 8775 MGMT_STATUS_REJECTED); 8776 8777 hci_dev_lock(hdev); 8778 8779 rp_len = sizeof(*rp) + hdev->adv_instance_cnt; 8780 rp = kmalloc(rp_len, GFP_ATOMIC); 8781 if (!rp) { 8782 hci_dev_unlock(hdev); 8783 return -ENOMEM; 8784 } 8785 8786 supported_flags = get_supported_adv_flags(hdev); 8787 8788 rp->supported_flags = cpu_to_le32(supported_flags); 8789 rp->max_adv_data_len = max_adv_len(hdev); 8790 rp->max_scan_rsp_len = max_adv_len(hdev); 8791 rp->max_instances = hdev->le_num_of_adv_sets; 8792 rp->num_instances = hdev->adv_instance_cnt; 8793 8794 instance = rp->instance; 8795 list_for_each_entry(adv_instance, &hdev->adv_instances, list) { 8796 /* Only instances 1-le_num_of_adv_sets are externally visible */ 8797 if (adv_instance->instance <= hdev->adv_instance_cnt) { 8798 *instance = adv_instance->instance; 8799 instance++; 8800 } else { 8801 rp->num_instances--; 8802 rp_len--; 8803 } 8804 } 8805 8806 hci_dev_unlock(hdev); 8807 8808 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_ADV_FEATURES, 8809 MGMT_STATUS_SUCCESS, rp, rp_len); 8810 8811 kfree(rp); 8812 8813 return err; 8814 } 8815 8816 static u8 calculate_name_len(struct hci_dev *hdev) 8817 { 8818 u8 buf[HCI_MAX_SHORT_NAME_LENGTH + 2]; /* len + type + name */ 8819 8820 return eir_append_local_name(hdev, buf, 0); 8821 } 8822 8823 static u8 tlv_data_max_len(struct hci_dev *hdev, u32 adv_flags, 8824 bool is_adv_data) 8825 { 8826 u8 max_len = max_adv_len(hdev); 8827 8828 if (is_adv_data) { 8829 if (adv_flags & (MGMT_ADV_FLAG_DISCOV | 8830 MGMT_ADV_FLAG_LIMITED_DISCOV | 8831 MGMT_ADV_FLAG_MANAGED_FLAGS)) 8832 max_len -= 3; 8833 8834 if (adv_flags & MGMT_ADV_FLAG_TX_POWER) 8835 max_len -= 3; 8836 } else { 8837 if (adv_flags & MGMT_ADV_FLAG_LOCAL_NAME) 8838 max_len -= calculate_name_len(hdev); 8839 8840 if (adv_flags & (MGMT_ADV_FLAG_APPEARANCE)) 8841 max_len -= 4; 8842 } 8843 8844 return max_len; 8845 } 8846 8847 static bool flags_managed(u32 adv_flags) 8848 { 8849 return adv_flags & (MGMT_ADV_FLAG_DISCOV | 8850 MGMT_ADV_FLAG_LIMITED_DISCOV | 8851 MGMT_ADV_FLAG_MANAGED_FLAGS); 8852 } 8853 8854 static bool tx_power_managed(u32 adv_flags) 8855 { 8856 return adv_flags & MGMT_ADV_FLAG_TX_POWER; 8857 } 8858 8859 static bool name_managed(u32 adv_flags) 8860 { 8861 return adv_flags & MGMT_ADV_FLAG_LOCAL_NAME; 8862 } 8863 8864 static bool appearance_managed(u32 adv_flags) 8865 { 8866 return adv_flags & MGMT_ADV_FLAG_APPEARANCE; 8867 } 8868 8869 static bool tlv_data_is_valid(struct hci_dev *hdev, u32 adv_flags, u8 *data, 8870 u8 len, bool is_adv_data) 8871 { 8872 int i, cur_len; 8873 u8 max_len; 8874 8875 max_len = tlv_data_max_len(hdev, adv_flags, is_adv_data); 8876 8877 if (len > max_len) 8878 return false; 8879 8880 /* Make sure that the data is correctly formatted. */ 8881 for (i = 0; i < len; i += (cur_len + 1)) { 8882 cur_len = data[i]; 8883 8884 if (!cur_len) 8885 continue; 8886 8887 /* If the current field length would exceed the total data 8888 * length, then it's invalid. 8889 */ 8890 if (i + cur_len >= len) 8891 return false; 8892 8893 if (data[i + 1] == EIR_FLAGS && 8894 (!is_adv_data || flags_managed(adv_flags))) 8895 return false; 8896 8897 if (data[i + 1] == EIR_TX_POWER && tx_power_managed(adv_flags)) 8898 return false; 8899 8900 if (data[i + 1] == EIR_NAME_COMPLETE && name_managed(adv_flags)) 8901 return false; 8902 8903 if (data[i + 1] == EIR_NAME_SHORT && name_managed(adv_flags)) 8904 return false; 8905 8906 if (data[i + 1] == EIR_APPEARANCE && 8907 appearance_managed(adv_flags)) 8908 return false; 8909 } 8910 8911 return true; 8912 } 8913 8914 static bool requested_adv_flags_are_valid(struct hci_dev *hdev, u32 adv_flags) 8915 { 8916 u32 supported_flags, phy_flags; 8917 8918 /* The current implementation only supports a subset of the specified 8919 * flags. Also need to check mutual exclusiveness of sec flags. 8920 */ 8921 supported_flags = get_supported_adv_flags(hdev); 8922 phy_flags = adv_flags & MGMT_ADV_FLAG_SEC_MASK; 8923 if (adv_flags & ~supported_flags || 8924 ((phy_flags && (phy_flags ^ (phy_flags & -phy_flags))))) 8925 return false; 8926 8927 return true; 8928 } 8929 8930 static bool adv_busy(struct hci_dev *hdev) 8931 { 8932 return pending_find(MGMT_OP_SET_LE, hdev); 8933 } 8934 8935 static void add_adv_complete(struct hci_dev *hdev, struct sock *sk, u8 instance, 8936 int err) 8937 { 8938 struct adv_info *adv, *n; 8939 8940 bt_dev_dbg(hdev, "err %d", err); 8941 8942 hci_dev_lock(hdev); 8943 8944 list_for_each_entry_safe(adv, n, &hdev->adv_instances, list) { 8945 u8 instance; 8946 8947 if (!adv->pending) 8948 continue; 8949 8950 if (!err) { 8951 adv->pending = false; 8952 continue; 8953 } 8954 8955 instance = adv->instance; 8956 8957 if (hdev->cur_adv_instance == instance) 8958 cancel_adv_timeout(hdev); 8959 8960 hci_remove_adv_instance(hdev, instance); 8961 mgmt_advertising_removed(sk, hdev, instance); 8962 } 8963 8964 hci_dev_unlock(hdev); 8965 } 8966 8967 static void add_advertising_complete(struct hci_dev *hdev, void *data, int err) 8968 { 8969 struct mgmt_pending_cmd *cmd = data; 8970 struct mgmt_cp_add_advertising *cp = cmd->param; 8971 struct mgmt_rp_add_advertising rp; 8972 8973 memset(&rp, 0, sizeof(rp)); 8974 8975 rp.instance = cp->instance; 8976 8977 if (err) 8978 mgmt_cmd_status(cmd->sk, cmd->hdev->id, cmd->opcode, 8979 mgmt_status(err)); 8980 else 8981 mgmt_cmd_complete(cmd->sk, cmd->hdev->id, cmd->opcode, 8982 mgmt_status(err), &rp, sizeof(rp)); 8983 8984 add_adv_complete(hdev, cmd->sk, cp->instance, err); 8985 8986 mgmt_pending_free(cmd); 8987 } 8988 8989 static int add_advertising_sync(struct hci_dev *hdev, void *data) 8990 { 8991 struct mgmt_pending_cmd *cmd = data; 8992 struct mgmt_cp_add_advertising *cp = cmd->param; 8993 8994 return hci_schedule_adv_instance_sync(hdev, cp->instance, true); 8995 } 8996 8997 static int add_advertising(struct sock *sk, struct hci_dev *hdev, 8998 void *data, u16 data_len) 8999 { 9000 struct mgmt_cp_add_advertising *cp = data; 9001 struct mgmt_rp_add_advertising rp; 9002 u32 flags; 9003 u8 status; 9004 u16 timeout, duration; 9005 unsigned int prev_instance_cnt; 9006 u8 schedule_instance = 0; 9007 struct adv_info *adv, *next_instance; 9008 int err; 9009 struct mgmt_pending_cmd *cmd; 9010 9011 bt_dev_dbg(hdev, "sock %p", sk); 9012 9013 status = mgmt_le_support(hdev); 9014 if (status) 9015 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING, 9016 status); 9017 9018 if (cp->instance < 1 || cp->instance > hdev->le_num_of_adv_sets) 9019 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING, 9020 MGMT_STATUS_INVALID_PARAMS); 9021 9022 if (data_len != sizeof(*cp) + cp->adv_data_len + cp->scan_rsp_len) 9023 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING, 9024 MGMT_STATUS_INVALID_PARAMS); 9025 9026 flags = __le32_to_cpu(cp->flags); 9027 timeout = __le16_to_cpu(cp->timeout); 9028 duration = __le16_to_cpu(cp->duration); 9029 9030 if (!requested_adv_flags_are_valid(hdev, flags)) 9031 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING, 9032 MGMT_STATUS_INVALID_PARAMS); 9033 9034 hci_dev_lock(hdev); 9035 9036 if (timeout && !hdev_is_powered(hdev)) { 9037 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING, 9038 MGMT_STATUS_REJECTED); 9039 goto unlock; 9040 } 9041 9042 if (adv_busy(hdev)) { 9043 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING, 9044 MGMT_STATUS_BUSY); 9045 goto unlock; 9046 } 9047 9048 if (!tlv_data_is_valid(hdev, flags, cp->data, cp->adv_data_len, true) || 9049 !tlv_data_is_valid(hdev, flags, cp->data + cp->adv_data_len, 9050 cp->scan_rsp_len, false)) { 9051 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING, 9052 MGMT_STATUS_INVALID_PARAMS); 9053 goto unlock; 9054 } 9055 9056 prev_instance_cnt = hdev->adv_instance_cnt; 9057 9058 adv = hci_add_adv_instance(hdev, cp->instance, flags, 9059 cp->adv_data_len, cp->data, 9060 cp->scan_rsp_len, 9061 cp->data + cp->adv_data_len, 9062 timeout, duration, 9063 HCI_ADV_TX_POWER_NO_PREFERENCE, 9064 hdev->le_adv_min_interval, 9065 hdev->le_adv_max_interval, 0); 9066 if (IS_ERR(adv)) { 9067 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING, 9068 MGMT_STATUS_FAILED); 9069 goto unlock; 9070 } 9071 9072 /* Only trigger an advertising added event if a new instance was 9073 * actually added. 9074 */ 9075 if (hdev->adv_instance_cnt > prev_instance_cnt) 9076 mgmt_advertising_added(sk, hdev, cp->instance); 9077 9078 if (hdev->cur_adv_instance == cp->instance) { 9079 /* If the currently advertised instance is being changed then 9080 * cancel the current advertising and schedule the next 9081 * instance. If there is only one instance then the overridden 9082 * advertising data will be visible right away. 9083 */ 9084 cancel_adv_timeout(hdev); 9085 9086 next_instance = hci_get_next_instance(hdev, cp->instance); 9087 if (next_instance) 9088 schedule_instance = next_instance->instance; 9089 } else if (!hdev->adv_instance_timeout) { 9090 /* Immediately advertise the new instance if no other 9091 * instance is currently being advertised. 9092 */ 9093 schedule_instance = cp->instance; 9094 } 9095 9096 /* If the HCI_ADVERTISING flag is set or the device isn't powered or 9097 * there is no instance to be advertised then we have no HCI 9098 * communication to make. Simply return. 9099 */ 9100 if (!hdev_is_powered(hdev) || 9101 hci_dev_test_flag(hdev, HCI_ADVERTISING) || 9102 !schedule_instance) { 9103 rp.instance = cp->instance; 9104 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_ADVERTISING, 9105 MGMT_STATUS_SUCCESS, &rp, sizeof(rp)); 9106 goto unlock; 9107 } 9108 9109 /* We're good to go, update advertising data, parameters, and start 9110 * advertising. 9111 */ 9112 cmd = mgmt_pending_new(sk, MGMT_OP_ADD_ADVERTISING, hdev, data, 9113 data_len); 9114 if (!cmd) { 9115 err = -ENOMEM; 9116 goto unlock; 9117 } 9118 9119 cp->instance = schedule_instance; 9120 9121 err = hci_cmd_sync_queue(hdev, add_advertising_sync, cmd, 9122 add_advertising_complete); 9123 if (err < 0) 9124 mgmt_pending_free(cmd); 9125 9126 unlock: 9127 hci_dev_unlock(hdev); 9128 9129 return err; 9130 } 9131 9132 static void add_ext_adv_params_complete(struct hci_dev *hdev, void *data, 9133 int err) 9134 { 9135 struct mgmt_pending_cmd *cmd = data; 9136 struct mgmt_cp_add_ext_adv_params *cp = cmd->param; 9137 struct mgmt_rp_add_ext_adv_params rp; 9138 struct adv_info *adv; 9139 u32 flags; 9140 9141 BT_DBG("%s", hdev->name); 9142 9143 hci_dev_lock(hdev); 9144 9145 adv = hci_find_adv_instance(hdev, cp->instance); 9146 if (!adv) 9147 goto unlock; 9148 9149 rp.instance = cp->instance; 9150 rp.tx_power = adv->tx_power; 9151 9152 /* While we're at it, inform userspace of the available space for this 9153 * advertisement, given the flags that will be used. 9154 */ 9155 flags = __le32_to_cpu(cp->flags); 9156 rp.max_adv_data_len = tlv_data_max_len(hdev, flags, true); 9157 rp.max_scan_rsp_len = tlv_data_max_len(hdev, flags, false); 9158 9159 if (err) { 9160 /* If this advertisement was previously advertising and we 9161 * failed to update it, we signal that it has been removed and 9162 * delete its structure 9163 */ 9164 if (!adv->pending) 9165 mgmt_advertising_removed(cmd->sk, hdev, cp->instance); 9166 9167 hci_remove_adv_instance(hdev, cp->instance); 9168 9169 mgmt_cmd_status(cmd->sk, cmd->hdev->id, cmd->opcode, 9170 mgmt_status(err)); 9171 } else { 9172 mgmt_cmd_complete(cmd->sk, cmd->hdev->id, cmd->opcode, 9173 mgmt_status(err), &rp, sizeof(rp)); 9174 } 9175 9176 unlock: 9177 mgmt_pending_free(cmd); 9178 9179 hci_dev_unlock(hdev); 9180 } 9181 9182 static int add_ext_adv_params_sync(struct hci_dev *hdev, void *data) 9183 { 9184 struct mgmt_pending_cmd *cmd = data; 9185 struct mgmt_cp_add_ext_adv_params *cp = cmd->param; 9186 9187 return hci_setup_ext_adv_instance_sync(hdev, cp->instance); 9188 } 9189 9190 static int add_ext_adv_params(struct sock *sk, struct hci_dev *hdev, 9191 void *data, u16 data_len) 9192 { 9193 struct mgmt_cp_add_ext_adv_params *cp = data; 9194 struct mgmt_rp_add_ext_adv_params rp; 9195 struct mgmt_pending_cmd *cmd = NULL; 9196 struct adv_info *adv; 9197 u32 flags, min_interval, max_interval; 9198 u16 timeout, duration; 9199 u8 status; 9200 s8 tx_power; 9201 int err; 9202 9203 BT_DBG("%s", hdev->name); 9204 9205 status = mgmt_le_support(hdev); 9206 if (status) 9207 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_PARAMS, 9208 status); 9209 9210 if (cp->instance < 1 || cp->instance > hdev->le_num_of_adv_sets) 9211 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_PARAMS, 9212 MGMT_STATUS_INVALID_PARAMS); 9213 9214 /* The purpose of breaking add_advertising into two separate MGMT calls 9215 * for params and data is to allow more parameters to be added to this 9216 * structure in the future. For this reason, we verify that we have the 9217 * bare minimum structure we know of when the interface was defined. Any 9218 * extra parameters we don't know about will be ignored in this request. 9219 */ 9220 if (data_len < MGMT_ADD_EXT_ADV_PARAMS_MIN_SIZE) 9221 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_PARAMS, 9222 MGMT_STATUS_INVALID_PARAMS); 9223 9224 flags = __le32_to_cpu(cp->flags); 9225 9226 if (!requested_adv_flags_are_valid(hdev, flags)) 9227 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_PARAMS, 9228 MGMT_STATUS_INVALID_PARAMS); 9229 9230 hci_dev_lock(hdev); 9231 9232 /* In new interface, we require that we are powered to register */ 9233 if (!hdev_is_powered(hdev)) { 9234 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_PARAMS, 9235 MGMT_STATUS_REJECTED); 9236 goto unlock; 9237 } 9238 9239 if (adv_busy(hdev)) { 9240 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_PARAMS, 9241 MGMT_STATUS_BUSY); 9242 goto unlock; 9243 } 9244 9245 /* Parse defined parameters from request, use defaults otherwise */ 9246 timeout = (flags & MGMT_ADV_PARAM_TIMEOUT) ? 9247 __le16_to_cpu(cp->timeout) : 0; 9248 9249 duration = (flags & MGMT_ADV_PARAM_DURATION) ? 9250 __le16_to_cpu(cp->duration) : 9251 hdev->def_multi_adv_rotation_duration; 9252 9253 min_interval = (flags & MGMT_ADV_PARAM_INTERVALS) ? 9254 __le32_to_cpu(cp->min_interval) : 9255 hdev->le_adv_min_interval; 9256 9257 max_interval = (flags & MGMT_ADV_PARAM_INTERVALS) ? 9258 __le32_to_cpu(cp->max_interval) : 9259 hdev->le_adv_max_interval; 9260 9261 tx_power = (flags & MGMT_ADV_PARAM_TX_POWER) ? 9262 cp->tx_power : 9263 HCI_ADV_TX_POWER_NO_PREFERENCE; 9264 9265 /* Create advertising instance with no advertising or response data */ 9266 adv = hci_add_adv_instance(hdev, cp->instance, flags, 0, NULL, 0, NULL, 9267 timeout, duration, tx_power, min_interval, 9268 max_interval, 0); 9269 9270 if (IS_ERR(adv)) { 9271 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_PARAMS, 9272 MGMT_STATUS_FAILED); 9273 goto unlock; 9274 } 9275 9276 /* Submit request for advertising params if ext adv available */ 9277 if (ext_adv_capable(hdev)) { 9278 cmd = mgmt_pending_new(sk, MGMT_OP_ADD_EXT_ADV_PARAMS, hdev, 9279 data, data_len); 9280 if (!cmd) { 9281 err = -ENOMEM; 9282 hci_remove_adv_instance(hdev, cp->instance); 9283 goto unlock; 9284 } 9285 9286 err = hci_cmd_sync_queue(hdev, add_ext_adv_params_sync, cmd, 9287 add_ext_adv_params_complete); 9288 if (err < 0) 9289 mgmt_pending_free(cmd); 9290 } else { 9291 rp.instance = cp->instance; 9292 rp.tx_power = HCI_ADV_TX_POWER_NO_PREFERENCE; 9293 rp.max_adv_data_len = tlv_data_max_len(hdev, flags, true); 9294 rp.max_scan_rsp_len = tlv_data_max_len(hdev, flags, false); 9295 err = mgmt_cmd_complete(sk, hdev->id, 9296 MGMT_OP_ADD_EXT_ADV_PARAMS, 9297 MGMT_STATUS_SUCCESS, &rp, sizeof(rp)); 9298 } 9299 9300 unlock: 9301 hci_dev_unlock(hdev); 9302 9303 return err; 9304 } 9305 9306 static void add_ext_adv_data_complete(struct hci_dev *hdev, void *data, int err) 9307 { 9308 struct mgmt_pending_cmd *cmd = data; 9309 struct mgmt_cp_add_ext_adv_data *cp = cmd->param; 9310 struct mgmt_rp_add_advertising rp; 9311 9312 add_adv_complete(hdev, cmd->sk, cp->instance, err); 9313 9314 memset(&rp, 0, sizeof(rp)); 9315 9316 rp.instance = cp->instance; 9317 9318 if (err) 9319 mgmt_cmd_status(cmd->sk, cmd->hdev->id, cmd->opcode, 9320 mgmt_status(err)); 9321 else 9322 mgmt_cmd_complete(cmd->sk, cmd->hdev->id, cmd->opcode, 9323 mgmt_status(err), &rp, sizeof(rp)); 9324 9325 mgmt_pending_free(cmd); 9326 } 9327 9328 static int add_ext_adv_data_sync(struct hci_dev *hdev, void *data) 9329 { 9330 struct mgmt_pending_cmd *cmd = data; 9331 struct mgmt_cp_add_ext_adv_data *cp = cmd->param; 9332 int err; 9333 9334 if (ext_adv_capable(hdev)) { 9335 err = hci_update_adv_data_sync(hdev, cp->instance); 9336 if (err) 9337 return err; 9338 9339 err = hci_update_scan_rsp_data_sync(hdev, cp->instance); 9340 if (err) 9341 return err; 9342 9343 return hci_enable_ext_advertising_sync(hdev, cp->instance); 9344 } 9345 9346 return hci_schedule_adv_instance_sync(hdev, cp->instance, true); 9347 } 9348 9349 static int add_ext_adv_data(struct sock *sk, struct hci_dev *hdev, void *data, 9350 u16 data_len) 9351 { 9352 struct mgmt_cp_add_ext_adv_data *cp = data; 9353 struct mgmt_rp_add_ext_adv_data rp; 9354 u8 schedule_instance = 0; 9355 struct adv_info *next_instance; 9356 struct adv_info *adv_instance; 9357 int err = 0; 9358 struct mgmt_pending_cmd *cmd; 9359 u16 expected_len; 9360 9361 BT_DBG("%s", hdev->name); 9362 9363 expected_len = struct_size(cp, data, cp->adv_data_len + 9364 cp->scan_rsp_len); 9365 if (expected_len > data_len) 9366 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_DATA, 9367 MGMT_STATUS_INVALID_PARAMS); 9368 9369 hci_dev_lock(hdev); 9370 9371 adv_instance = hci_find_adv_instance(hdev, cp->instance); 9372 9373 if (!adv_instance) { 9374 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_DATA, 9375 MGMT_STATUS_INVALID_PARAMS); 9376 goto unlock; 9377 } 9378 9379 /* In new interface, we require that we are powered to register */ 9380 if (!hdev_is_powered(hdev)) { 9381 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_DATA, 9382 MGMT_STATUS_REJECTED); 9383 goto clear_new_instance; 9384 } 9385 9386 if (adv_busy(hdev)) { 9387 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_DATA, 9388 MGMT_STATUS_BUSY); 9389 goto clear_new_instance; 9390 } 9391 9392 /* Validate new data */ 9393 if (!tlv_data_is_valid(hdev, adv_instance->flags, cp->data, 9394 cp->adv_data_len, true) || 9395 !tlv_data_is_valid(hdev, adv_instance->flags, cp->data + 9396 cp->adv_data_len, cp->scan_rsp_len, false)) { 9397 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_DATA, 9398 MGMT_STATUS_INVALID_PARAMS); 9399 goto clear_new_instance; 9400 } 9401 9402 /* Set the data in the advertising instance */ 9403 hci_set_adv_instance_data(hdev, cp->instance, cp->adv_data_len, 9404 cp->data, cp->scan_rsp_len, 9405 cp->data + cp->adv_data_len); 9406 9407 /* If using software rotation, determine next instance to use */ 9408 if (hdev->cur_adv_instance == cp->instance) { 9409 /* If the currently advertised instance is being changed 9410 * then cancel the current advertising and schedule the 9411 * next instance. If there is only one instance then the 9412 * overridden advertising data will be visible right 9413 * away 9414 */ 9415 cancel_adv_timeout(hdev); 9416 9417 next_instance = hci_get_next_instance(hdev, cp->instance); 9418 if (next_instance) 9419 schedule_instance = next_instance->instance; 9420 } else if (!hdev->adv_instance_timeout) { 9421 /* Immediately advertise the new instance if no other 9422 * instance is currently being advertised. 9423 */ 9424 schedule_instance = cp->instance; 9425 } 9426 9427 /* If the HCI_ADVERTISING flag is set or there is no instance to 9428 * be advertised then we have no HCI communication to make. 9429 * Simply return. 9430 */ 9431 if (hci_dev_test_flag(hdev, HCI_ADVERTISING) || !schedule_instance) { 9432 if (adv_instance->pending) { 9433 mgmt_advertising_added(sk, hdev, cp->instance); 9434 adv_instance->pending = false; 9435 } 9436 rp.instance = cp->instance; 9437 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_DATA, 9438 MGMT_STATUS_SUCCESS, &rp, sizeof(rp)); 9439 goto unlock; 9440 } 9441 9442 cmd = mgmt_pending_new(sk, MGMT_OP_ADD_EXT_ADV_DATA, hdev, data, 9443 data_len); 9444 if (!cmd) { 9445 err = -ENOMEM; 9446 goto clear_new_instance; 9447 } 9448 9449 err = hci_cmd_sync_queue(hdev, add_ext_adv_data_sync, cmd, 9450 add_ext_adv_data_complete); 9451 if (err < 0) { 9452 mgmt_pending_free(cmd); 9453 goto clear_new_instance; 9454 } 9455 9456 /* We were successful in updating data, so trigger advertising_added 9457 * event if this is an instance that wasn't previously advertising. If 9458 * a failure occurs in the requests we initiated, we will remove the 9459 * instance again in add_advertising_complete 9460 */ 9461 if (adv_instance->pending) 9462 mgmt_advertising_added(sk, hdev, cp->instance); 9463 9464 goto unlock; 9465 9466 clear_new_instance: 9467 hci_remove_adv_instance(hdev, cp->instance); 9468 9469 unlock: 9470 hci_dev_unlock(hdev); 9471 9472 return err; 9473 } 9474 9475 static void remove_advertising_complete(struct hci_dev *hdev, void *data, 9476 int err) 9477 { 9478 struct mgmt_pending_cmd *cmd = data; 9479 struct mgmt_cp_remove_advertising *cp = cmd->param; 9480 struct mgmt_rp_remove_advertising rp; 9481 9482 bt_dev_dbg(hdev, "err %d", err); 9483 9484 memset(&rp, 0, sizeof(rp)); 9485 rp.instance = cp->instance; 9486 9487 if (err) 9488 mgmt_cmd_status(cmd->sk, cmd->hdev->id, cmd->opcode, 9489 mgmt_status(err)); 9490 else 9491 mgmt_cmd_complete(cmd->sk, cmd->hdev->id, cmd->opcode, 9492 MGMT_STATUS_SUCCESS, &rp, sizeof(rp)); 9493 9494 mgmt_pending_free(cmd); 9495 } 9496 9497 static int remove_advertising_sync(struct hci_dev *hdev, void *data) 9498 { 9499 struct mgmt_pending_cmd *cmd = data; 9500 struct mgmt_cp_remove_advertising *cp = cmd->param; 9501 int err; 9502 9503 err = hci_remove_advertising_sync(hdev, cmd->sk, cp->instance, true); 9504 if (err) 9505 return err; 9506 9507 if (list_empty(&hdev->adv_instances)) 9508 err = hci_disable_advertising_sync(hdev); 9509 9510 return err; 9511 } 9512 9513 static int remove_advertising(struct sock *sk, struct hci_dev *hdev, 9514 void *data, u16 data_len) 9515 { 9516 struct mgmt_cp_remove_advertising *cp = data; 9517 struct mgmt_pending_cmd *cmd; 9518 int err; 9519 9520 bt_dev_dbg(hdev, "sock %p", sk); 9521 9522 hci_dev_lock(hdev); 9523 9524 if (cp->instance && !hci_find_adv_instance(hdev, cp->instance)) { 9525 err = mgmt_cmd_status(sk, hdev->id, 9526 MGMT_OP_REMOVE_ADVERTISING, 9527 MGMT_STATUS_INVALID_PARAMS); 9528 goto unlock; 9529 } 9530 9531 if (pending_find(MGMT_OP_SET_LE, hdev)) { 9532 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_ADVERTISING, 9533 MGMT_STATUS_BUSY); 9534 goto unlock; 9535 } 9536 9537 if (list_empty(&hdev->adv_instances)) { 9538 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_ADVERTISING, 9539 MGMT_STATUS_INVALID_PARAMS); 9540 goto unlock; 9541 } 9542 9543 cmd = mgmt_pending_new(sk, MGMT_OP_REMOVE_ADVERTISING, hdev, data, 9544 data_len); 9545 if (!cmd) { 9546 err = -ENOMEM; 9547 goto unlock; 9548 } 9549 9550 err = hci_cmd_sync_queue(hdev, remove_advertising_sync, cmd, 9551 remove_advertising_complete); 9552 if (err < 0) 9553 mgmt_pending_free(cmd); 9554 9555 unlock: 9556 hci_dev_unlock(hdev); 9557 9558 return err; 9559 } 9560 9561 static int get_adv_size_info(struct sock *sk, struct hci_dev *hdev, 9562 void *data, u16 data_len) 9563 { 9564 struct mgmt_cp_get_adv_size_info *cp = data; 9565 struct mgmt_rp_get_adv_size_info rp; 9566 u32 flags, supported_flags; 9567 9568 bt_dev_dbg(hdev, "sock %p", sk); 9569 9570 if (!lmp_le_capable(hdev)) 9571 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_ADV_SIZE_INFO, 9572 MGMT_STATUS_REJECTED); 9573 9574 if (cp->instance < 1 || cp->instance > hdev->le_num_of_adv_sets) 9575 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_ADV_SIZE_INFO, 9576 MGMT_STATUS_INVALID_PARAMS); 9577 9578 flags = __le32_to_cpu(cp->flags); 9579 9580 /* The current implementation only supports a subset of the specified 9581 * flags. 9582 */ 9583 supported_flags = get_supported_adv_flags(hdev); 9584 if (flags & ~supported_flags) 9585 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_ADV_SIZE_INFO, 9586 MGMT_STATUS_INVALID_PARAMS); 9587 9588 rp.instance = cp->instance; 9589 rp.flags = cp->flags; 9590 rp.max_adv_data_len = tlv_data_max_len(hdev, flags, true); 9591 rp.max_scan_rsp_len = tlv_data_max_len(hdev, flags, false); 9592 9593 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_ADV_SIZE_INFO, 9594 MGMT_STATUS_SUCCESS, &rp, sizeof(rp)); 9595 } 9596 9597 static const struct hci_mgmt_handler mgmt_handlers[] = { 9598 { NULL }, /* 0x0000 (no command) */ 9599 { read_version, MGMT_READ_VERSION_SIZE, 9600 HCI_MGMT_NO_HDEV | 9601 HCI_MGMT_UNTRUSTED }, 9602 { read_commands, MGMT_READ_COMMANDS_SIZE, 9603 HCI_MGMT_NO_HDEV | 9604 HCI_MGMT_UNTRUSTED }, 9605 { read_index_list, MGMT_READ_INDEX_LIST_SIZE, 9606 HCI_MGMT_NO_HDEV | 9607 HCI_MGMT_UNTRUSTED }, 9608 { read_controller_info, MGMT_READ_INFO_SIZE, 9609 HCI_MGMT_UNTRUSTED }, 9610 { set_powered, MGMT_SETTING_SIZE }, 9611 { set_discoverable, MGMT_SET_DISCOVERABLE_SIZE }, 9612 { set_connectable, MGMT_SETTING_SIZE }, 9613 { set_fast_connectable, MGMT_SETTING_SIZE }, 9614 { set_bondable, MGMT_SETTING_SIZE }, 9615 { set_link_security, MGMT_SETTING_SIZE }, 9616 { set_ssp, MGMT_SETTING_SIZE }, 9617 { set_hs, MGMT_SETTING_SIZE }, 9618 { set_le, MGMT_SETTING_SIZE }, 9619 { set_dev_class, MGMT_SET_DEV_CLASS_SIZE }, 9620 { set_local_name, MGMT_SET_LOCAL_NAME_SIZE }, 9621 { add_uuid, MGMT_ADD_UUID_SIZE }, 9622 { remove_uuid, MGMT_REMOVE_UUID_SIZE }, 9623 { load_link_keys, MGMT_LOAD_LINK_KEYS_SIZE, 9624 HCI_MGMT_VAR_LEN }, 9625 { load_long_term_keys, MGMT_LOAD_LONG_TERM_KEYS_SIZE, 9626 HCI_MGMT_VAR_LEN }, 9627 { disconnect, MGMT_DISCONNECT_SIZE }, 9628 { get_connections, MGMT_GET_CONNECTIONS_SIZE }, 9629 { pin_code_reply, MGMT_PIN_CODE_REPLY_SIZE }, 9630 { pin_code_neg_reply, MGMT_PIN_CODE_NEG_REPLY_SIZE }, 9631 { set_io_capability, MGMT_SET_IO_CAPABILITY_SIZE }, 9632 { pair_device, MGMT_PAIR_DEVICE_SIZE }, 9633 { cancel_pair_device, MGMT_CANCEL_PAIR_DEVICE_SIZE }, 9634 { unpair_device, MGMT_UNPAIR_DEVICE_SIZE }, 9635 { user_confirm_reply, MGMT_USER_CONFIRM_REPLY_SIZE }, 9636 { user_confirm_neg_reply, MGMT_USER_CONFIRM_NEG_REPLY_SIZE }, 9637 { user_passkey_reply, MGMT_USER_PASSKEY_REPLY_SIZE }, 9638 { user_passkey_neg_reply, MGMT_USER_PASSKEY_NEG_REPLY_SIZE }, 9639 { read_local_oob_data, MGMT_READ_LOCAL_OOB_DATA_SIZE }, 9640 { add_remote_oob_data, MGMT_ADD_REMOTE_OOB_DATA_SIZE, 9641 HCI_MGMT_VAR_LEN }, 9642 { remove_remote_oob_data, MGMT_REMOVE_REMOTE_OOB_DATA_SIZE }, 9643 { start_discovery, MGMT_START_DISCOVERY_SIZE }, 9644 { stop_discovery, MGMT_STOP_DISCOVERY_SIZE }, 9645 { confirm_name, MGMT_CONFIRM_NAME_SIZE }, 9646 { block_device, MGMT_BLOCK_DEVICE_SIZE }, 9647 { unblock_device, MGMT_UNBLOCK_DEVICE_SIZE }, 9648 { set_device_id, MGMT_SET_DEVICE_ID_SIZE }, 9649 { set_advertising, MGMT_SETTING_SIZE }, 9650 { set_bredr, MGMT_SETTING_SIZE }, 9651 { set_static_address, MGMT_SET_STATIC_ADDRESS_SIZE }, 9652 { set_scan_params, MGMT_SET_SCAN_PARAMS_SIZE }, 9653 { set_secure_conn, MGMT_SETTING_SIZE }, 9654 { set_debug_keys, MGMT_SETTING_SIZE }, 9655 { set_privacy, MGMT_SET_PRIVACY_SIZE }, 9656 { load_irks, MGMT_LOAD_IRKS_SIZE, 9657 HCI_MGMT_VAR_LEN }, 9658 { get_conn_info, MGMT_GET_CONN_INFO_SIZE }, 9659 { get_clock_info, MGMT_GET_CLOCK_INFO_SIZE }, 9660 { add_device, MGMT_ADD_DEVICE_SIZE }, 9661 { remove_device, MGMT_REMOVE_DEVICE_SIZE }, 9662 { load_conn_param, MGMT_LOAD_CONN_PARAM_SIZE, 9663 HCI_MGMT_VAR_LEN }, 9664 { read_unconf_index_list, MGMT_READ_UNCONF_INDEX_LIST_SIZE, 9665 HCI_MGMT_NO_HDEV | 9666 HCI_MGMT_UNTRUSTED }, 9667 { read_config_info, MGMT_READ_CONFIG_INFO_SIZE, 9668 HCI_MGMT_UNCONFIGURED | 9669 HCI_MGMT_UNTRUSTED }, 9670 { set_external_config, MGMT_SET_EXTERNAL_CONFIG_SIZE, 9671 HCI_MGMT_UNCONFIGURED }, 9672 { set_public_address, MGMT_SET_PUBLIC_ADDRESS_SIZE, 9673 HCI_MGMT_UNCONFIGURED }, 9674 { start_service_discovery, MGMT_START_SERVICE_DISCOVERY_SIZE, 9675 HCI_MGMT_VAR_LEN }, 9676 { read_local_oob_ext_data, MGMT_READ_LOCAL_OOB_EXT_DATA_SIZE }, 9677 { read_ext_index_list, MGMT_READ_EXT_INDEX_LIST_SIZE, 9678 HCI_MGMT_NO_HDEV | 9679 HCI_MGMT_UNTRUSTED }, 9680 { read_adv_features, MGMT_READ_ADV_FEATURES_SIZE }, 9681 { add_advertising, MGMT_ADD_ADVERTISING_SIZE, 9682 HCI_MGMT_VAR_LEN }, 9683 { remove_advertising, MGMT_REMOVE_ADVERTISING_SIZE }, 9684 { get_adv_size_info, MGMT_GET_ADV_SIZE_INFO_SIZE }, 9685 { start_limited_discovery, MGMT_START_DISCOVERY_SIZE }, 9686 { read_ext_controller_info,MGMT_READ_EXT_INFO_SIZE, 9687 HCI_MGMT_UNTRUSTED }, 9688 { set_appearance, MGMT_SET_APPEARANCE_SIZE }, 9689 { get_phy_configuration, MGMT_GET_PHY_CONFIGURATION_SIZE }, 9690 { set_phy_configuration, MGMT_SET_PHY_CONFIGURATION_SIZE }, 9691 { set_blocked_keys, MGMT_OP_SET_BLOCKED_KEYS_SIZE, 9692 HCI_MGMT_VAR_LEN }, 9693 { set_wideband_speech, MGMT_SETTING_SIZE }, 9694 { read_controller_cap, MGMT_READ_CONTROLLER_CAP_SIZE, 9695 HCI_MGMT_UNTRUSTED }, 9696 { read_exp_features_info, MGMT_READ_EXP_FEATURES_INFO_SIZE, 9697 HCI_MGMT_UNTRUSTED | 9698 HCI_MGMT_HDEV_OPTIONAL }, 9699 { set_exp_feature, MGMT_SET_EXP_FEATURE_SIZE, 9700 HCI_MGMT_VAR_LEN | 9701 HCI_MGMT_HDEV_OPTIONAL }, 9702 { read_def_system_config, MGMT_READ_DEF_SYSTEM_CONFIG_SIZE, 9703 HCI_MGMT_UNTRUSTED }, 9704 { set_def_system_config, MGMT_SET_DEF_SYSTEM_CONFIG_SIZE, 9705 HCI_MGMT_VAR_LEN }, 9706 { read_def_runtime_config, MGMT_READ_DEF_RUNTIME_CONFIG_SIZE, 9707 HCI_MGMT_UNTRUSTED }, 9708 { set_def_runtime_config, MGMT_SET_DEF_RUNTIME_CONFIG_SIZE, 9709 HCI_MGMT_VAR_LEN }, 9710 { get_device_flags, MGMT_GET_DEVICE_FLAGS_SIZE }, 9711 { set_device_flags, MGMT_SET_DEVICE_FLAGS_SIZE }, 9712 { read_adv_mon_features, MGMT_READ_ADV_MONITOR_FEATURES_SIZE }, 9713 { add_adv_patterns_monitor,MGMT_ADD_ADV_PATTERNS_MONITOR_SIZE, 9714 HCI_MGMT_VAR_LEN }, 9715 { remove_adv_monitor, MGMT_REMOVE_ADV_MONITOR_SIZE }, 9716 { add_ext_adv_params, MGMT_ADD_EXT_ADV_PARAMS_MIN_SIZE, 9717 HCI_MGMT_VAR_LEN }, 9718 { add_ext_adv_data, MGMT_ADD_EXT_ADV_DATA_SIZE, 9719 HCI_MGMT_VAR_LEN }, 9720 { add_adv_patterns_monitor_rssi, 9721 MGMT_ADD_ADV_PATTERNS_MONITOR_RSSI_SIZE, 9722 HCI_MGMT_VAR_LEN }, 9723 { set_mesh, MGMT_SET_MESH_RECEIVER_SIZE, 9724 HCI_MGMT_VAR_LEN }, 9725 { mesh_features, MGMT_MESH_READ_FEATURES_SIZE }, 9726 { mesh_send, MGMT_MESH_SEND_SIZE, 9727 HCI_MGMT_VAR_LEN }, 9728 { mesh_send_cancel, MGMT_MESH_SEND_CANCEL_SIZE }, 9729 { mgmt_hci_cmd_sync, MGMT_HCI_CMD_SYNC_SIZE, HCI_MGMT_VAR_LEN }, 9730 { load_conn_subrate, MGMT_LOAD_CONN_SUBRATE_SIZE, 9731 HCI_MGMT_VAR_LEN }, 9732 }; 9733 9734 void mgmt_index_added(struct hci_dev *hdev) 9735 { 9736 struct mgmt_ev_ext_index ev; 9737 9738 if (hci_test_quirk(hdev, HCI_QUIRK_RAW_DEVICE)) 9739 return; 9740 9741 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) { 9742 mgmt_index_event(MGMT_EV_UNCONF_INDEX_ADDED, hdev, NULL, 0, 9743 HCI_MGMT_UNCONF_INDEX_EVENTS); 9744 ev.type = 0x01; 9745 } else { 9746 mgmt_index_event(MGMT_EV_INDEX_ADDED, hdev, NULL, 0, 9747 HCI_MGMT_INDEX_EVENTS); 9748 ev.type = 0x00; 9749 } 9750 9751 ev.bus = hdev->bus; 9752 9753 mgmt_index_event(MGMT_EV_EXT_INDEX_ADDED, hdev, &ev, sizeof(ev), 9754 HCI_MGMT_EXT_INDEX_EVENTS); 9755 } 9756 9757 void mgmt_index_removed(struct hci_dev *hdev) 9758 { 9759 struct mgmt_ev_ext_index ev; 9760 struct cmd_lookup match = { NULL, hdev, MGMT_STATUS_INVALID_INDEX }; 9761 9762 if (hci_test_quirk(hdev, HCI_QUIRK_RAW_DEVICE)) 9763 return; 9764 9765 mgmt_pending_foreach(0, hdev, true, cmd_complete_rsp, &match); 9766 9767 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) { 9768 mgmt_index_event(MGMT_EV_UNCONF_INDEX_REMOVED, hdev, NULL, 0, 9769 HCI_MGMT_UNCONF_INDEX_EVENTS); 9770 ev.type = 0x01; 9771 } else { 9772 mgmt_index_event(MGMT_EV_INDEX_REMOVED, hdev, NULL, 0, 9773 HCI_MGMT_INDEX_EVENTS); 9774 ev.type = 0x00; 9775 } 9776 9777 ev.bus = hdev->bus; 9778 9779 mgmt_index_event(MGMT_EV_EXT_INDEX_REMOVED, hdev, &ev, sizeof(ev), 9780 HCI_MGMT_EXT_INDEX_EVENTS); 9781 9782 /* Cancel any remaining timed work */ 9783 if (!hci_dev_test_flag(hdev, HCI_MGMT)) 9784 return; 9785 cancel_delayed_work_sync(&hdev->discov_off); 9786 cancel_delayed_work_sync(&hdev->service_cache); 9787 cancel_delayed_work_sync(&hdev->rpa_expired); 9788 cancel_delayed_work_sync(&hdev->mesh_send_done); 9789 } 9790 9791 void mgmt_power_on(struct hci_dev *hdev, int err) 9792 { 9793 struct cmd_lookup match = { NULL, hdev }; 9794 9795 bt_dev_dbg(hdev, "err %d", err); 9796 9797 hci_dev_lock(hdev); 9798 9799 if (!err) { 9800 restart_le_actions(hdev); 9801 hci_update_passive_scan(hdev); 9802 } 9803 9804 mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, true, settings_rsp, 9805 &match); 9806 9807 new_settings(hdev, match.sk); 9808 9809 if (match.sk) 9810 sock_put(match.sk); 9811 9812 hci_dev_unlock(hdev); 9813 } 9814 9815 void __mgmt_power_off(struct hci_dev *hdev) 9816 { 9817 struct cmd_lookup match = { NULL, hdev }; 9818 u8 zero_cod[] = { 0, 0, 0 }; 9819 9820 mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, true, settings_rsp, 9821 &match); 9822 9823 /* If the power off is because of hdev unregistration let 9824 * use the appropriate INVALID_INDEX status. Otherwise use 9825 * NOT_POWERED. We cover both scenarios here since later in 9826 * mgmt_index_removed() any hci_conn callbacks will have already 9827 * been triggered, potentially causing misleading DISCONNECTED 9828 * status responses. 9829 */ 9830 if (hci_dev_test_flag(hdev, HCI_UNREGISTER)) 9831 match.mgmt_status = MGMT_STATUS_INVALID_INDEX; 9832 else 9833 match.mgmt_status = MGMT_STATUS_NOT_POWERED; 9834 9835 mgmt_pending_foreach(0, hdev, true, cmd_complete_rsp, &match); 9836 9837 if (memcmp(hdev->dev_class, zero_cod, sizeof(zero_cod)) != 0) { 9838 mgmt_limited_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev, 9839 zero_cod, sizeof(zero_cod), 9840 HCI_MGMT_DEV_CLASS_EVENTS, NULL); 9841 ext_info_changed(hdev, NULL); 9842 } 9843 9844 new_settings(hdev, match.sk); 9845 9846 if (match.sk) 9847 sock_put(match.sk); 9848 } 9849 9850 void mgmt_set_powered_failed(struct hci_dev *hdev, int err) 9851 { 9852 struct mgmt_pending_cmd *cmd; 9853 u8 status; 9854 9855 cmd = pending_find(MGMT_OP_SET_POWERED, hdev); 9856 if (!cmd) 9857 return; 9858 9859 if (err == -ERFKILL) 9860 status = MGMT_STATUS_RFKILLED; 9861 else 9862 status = MGMT_STATUS_FAILED; 9863 9864 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_POWERED, status); 9865 9866 mgmt_pending_remove(cmd); 9867 } 9868 9869 void mgmt_new_link_key(struct hci_dev *hdev, struct link_key *key, 9870 bool persistent) 9871 { 9872 struct mgmt_ev_new_link_key ev; 9873 9874 memset(&ev, 0, sizeof(ev)); 9875 9876 ev.store_hint = persistent; 9877 bacpy(&ev.key.addr.bdaddr, &key->bdaddr); 9878 ev.key.addr.type = BDADDR_BREDR; 9879 ev.key.type = key->type; 9880 memcpy(ev.key.val, key->val, HCI_LINK_KEY_SIZE); 9881 ev.key.pin_len = key->pin_len; 9882 9883 mgmt_event(MGMT_EV_NEW_LINK_KEY, hdev, &ev, sizeof(ev), NULL); 9884 } 9885 9886 static u8 mgmt_ltk_type(struct smp_ltk *ltk) 9887 { 9888 switch (ltk->type) { 9889 case SMP_LTK: 9890 case SMP_LTK_RESPONDER: 9891 if (ltk->authenticated) 9892 return MGMT_LTK_AUTHENTICATED; 9893 return MGMT_LTK_UNAUTHENTICATED; 9894 case SMP_LTK_P256: 9895 if (ltk->authenticated) 9896 return MGMT_LTK_P256_AUTH; 9897 return MGMT_LTK_P256_UNAUTH; 9898 case SMP_LTK_P256_DEBUG: 9899 return MGMT_LTK_P256_DEBUG; 9900 } 9901 9902 return MGMT_LTK_UNAUTHENTICATED; 9903 } 9904 9905 void mgmt_new_ltk(struct hci_dev *hdev, struct smp_ltk *key, bool persistent) 9906 { 9907 struct mgmt_ev_new_long_term_key ev; 9908 9909 memset(&ev, 0, sizeof(ev)); 9910 9911 /* Devices using resolvable or non-resolvable random addresses 9912 * without providing an identity resolving key don't require 9913 * to store long term keys. Their addresses will change the 9914 * next time around. 9915 * 9916 * Only when a remote device provides an identity address 9917 * make sure the long term key is stored. If the remote 9918 * identity is known, the long term keys are internally 9919 * mapped to the identity address. So allow static random 9920 * and public addresses here. 9921 */ 9922 if (key->bdaddr_type == ADDR_LE_DEV_RANDOM && 9923 (key->bdaddr.b[5] & 0xc0) != 0xc0) 9924 ev.store_hint = 0x00; 9925 else 9926 ev.store_hint = persistent; 9927 9928 bacpy(&ev.key.addr.bdaddr, &key->bdaddr); 9929 ev.key.addr.type = link_to_bdaddr(LE_LINK, key->bdaddr_type); 9930 ev.key.type = mgmt_ltk_type(key); 9931 ev.key.enc_size = key->enc_size; 9932 ev.key.ediv = key->ediv; 9933 ev.key.rand = key->rand; 9934 9935 if (key->type == SMP_LTK) 9936 ev.key.initiator = 1; 9937 9938 /* Make sure we copy only the significant bytes based on the 9939 * encryption key size, and set the rest of the value to zeroes. 9940 */ 9941 memcpy(ev.key.val, key->val, key->enc_size); 9942 memset(ev.key.val + key->enc_size, 0, 9943 sizeof(ev.key.val) - key->enc_size); 9944 9945 mgmt_event(MGMT_EV_NEW_LONG_TERM_KEY, hdev, &ev, sizeof(ev), NULL); 9946 } 9947 9948 void mgmt_new_irk(struct hci_dev *hdev, struct smp_irk *irk, bool persistent) 9949 { 9950 struct mgmt_ev_new_irk ev; 9951 9952 memset(&ev, 0, sizeof(ev)); 9953 9954 ev.store_hint = persistent; 9955 9956 bacpy(&ev.rpa, &irk->rpa); 9957 bacpy(&ev.irk.addr.bdaddr, &irk->bdaddr); 9958 ev.irk.addr.type = link_to_bdaddr(LE_LINK, irk->addr_type); 9959 memcpy(ev.irk.val, irk->val, sizeof(irk->val)); 9960 9961 mgmt_event(MGMT_EV_NEW_IRK, hdev, &ev, sizeof(ev), NULL); 9962 } 9963 9964 void mgmt_new_csrk(struct hci_dev *hdev, struct smp_csrk *csrk, 9965 bool persistent) 9966 { 9967 struct mgmt_ev_new_csrk ev; 9968 9969 memset(&ev, 0, sizeof(ev)); 9970 9971 /* Devices using resolvable or non-resolvable random addresses 9972 * without providing an identity resolving key don't require 9973 * to store signature resolving keys. Their addresses will change 9974 * the next time around. 9975 * 9976 * Only when a remote device provides an identity address 9977 * make sure the signature resolving key is stored. So allow 9978 * static random and public addresses here. 9979 */ 9980 if (csrk->bdaddr_type == ADDR_LE_DEV_RANDOM && 9981 (csrk->bdaddr.b[5] & 0xc0) != 0xc0) 9982 ev.store_hint = 0x00; 9983 else 9984 ev.store_hint = persistent; 9985 9986 bacpy(&ev.key.addr.bdaddr, &csrk->bdaddr); 9987 ev.key.addr.type = link_to_bdaddr(LE_LINK, csrk->bdaddr_type); 9988 ev.key.type = csrk->type; 9989 memcpy(ev.key.val, csrk->val, sizeof(csrk->val)); 9990 9991 mgmt_event(MGMT_EV_NEW_CSRK, hdev, &ev, sizeof(ev), NULL); 9992 } 9993 9994 void mgmt_new_conn_param(struct hci_dev *hdev, bdaddr_t *bdaddr, 9995 u8 bdaddr_type, u8 store_hint, u16 min_interval, 9996 u16 max_interval, u16 latency, u16 timeout) 9997 { 9998 struct mgmt_ev_new_conn_param ev; 9999 10000 if (!hci_is_identity_address(bdaddr, bdaddr_type)) 10001 return; 10002 10003 memset(&ev, 0, sizeof(ev)); 10004 bacpy(&ev.addr.bdaddr, bdaddr); 10005 ev.addr.type = link_to_bdaddr(LE_LINK, bdaddr_type); 10006 ev.store_hint = store_hint; 10007 ev.min_interval = cpu_to_le16(min_interval); 10008 ev.max_interval = cpu_to_le16(max_interval); 10009 ev.latency = cpu_to_le16(latency); 10010 ev.timeout = cpu_to_le16(timeout); 10011 10012 mgmt_event(MGMT_EV_NEW_CONN_PARAM, hdev, &ev, sizeof(ev), NULL); 10013 } 10014 10015 void mgmt_device_connected(struct hci_dev *hdev, struct hci_conn *conn, 10016 u8 *name, u8 name_len) 10017 { 10018 struct sk_buff *skb; 10019 struct mgmt_ev_device_connected *ev; 10020 u16 eir_len = 0; 10021 u32 flags = 0; 10022 10023 if (test_and_set_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags)) 10024 return; 10025 10026 /* allocate buff for LE or BR/EDR adv */ 10027 if (conn->le_adv_data_len > 0) 10028 skb = mgmt_alloc_skb(hdev, MGMT_EV_DEVICE_CONNECTED, 10029 sizeof(*ev) + conn->le_adv_data_len); 10030 else 10031 skb = mgmt_alloc_skb(hdev, MGMT_EV_DEVICE_CONNECTED, 10032 sizeof(*ev) + (name ? eir_precalc_len(name_len) : 0) + 10033 eir_precalc_len(sizeof(conn->dev_class))); 10034 10035 if (!skb) 10036 return; 10037 10038 ev = skb_put(skb, sizeof(*ev)); 10039 bacpy(&ev->addr.bdaddr, &conn->dst); 10040 ev->addr.type = link_to_bdaddr(conn->type, conn->dst_type); 10041 10042 if (conn->out) 10043 flags |= MGMT_DEV_FOUND_INITIATED_CONN; 10044 10045 ev->flags = __cpu_to_le32(flags); 10046 10047 /* We must ensure that the EIR Data fields are ordered and 10048 * unique. Keep it simple for now and avoid the problem by not 10049 * adding any BR/EDR data to the LE adv. 10050 */ 10051 if (conn->le_adv_data_len > 0) { 10052 skb_put_data(skb, conn->le_adv_data, conn->le_adv_data_len); 10053 eir_len = conn->le_adv_data_len; 10054 } else { 10055 if (name) 10056 eir_len += eir_skb_put_data(skb, EIR_NAME_COMPLETE, name, name_len); 10057 10058 if (memcmp(conn->dev_class, "\0\0\0", sizeof(conn->dev_class))) 10059 eir_len += eir_skb_put_data(skb, EIR_CLASS_OF_DEV, 10060 conn->dev_class, sizeof(conn->dev_class)); 10061 } 10062 10063 ev->eir_len = cpu_to_le16(eir_len); 10064 10065 mgmt_event_skb(skb, NULL); 10066 } 10067 10068 static void unpair_device_rsp(struct mgmt_pending_cmd *cmd, void *data) 10069 { 10070 struct hci_dev *hdev = data; 10071 struct mgmt_cp_unpair_device *cp = cmd->param; 10072 10073 device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, cmd->sk); 10074 10075 cmd->cmd_complete(cmd, 0); 10076 } 10077 10078 bool mgmt_powering_down(struct hci_dev *hdev) 10079 { 10080 struct mgmt_pending_cmd *cmd; 10081 struct mgmt_mode *cp; 10082 10083 if (hci_dev_test_flag(hdev, HCI_POWERING_DOWN)) 10084 return true; 10085 10086 cmd = pending_find(MGMT_OP_SET_POWERED, hdev); 10087 if (!cmd) 10088 return false; 10089 10090 cp = cmd->param; 10091 if (!cp->val) 10092 return true; 10093 10094 return false; 10095 } 10096 10097 u8 hci_to_mgmt_reason(u8 err) 10098 { 10099 switch (err) { 10100 case HCI_ERROR_CONNECTION_TIMEOUT: 10101 return MGMT_DEV_DISCONN_TIMEOUT; 10102 case HCI_ERROR_REMOTE_USER_TERM: 10103 case HCI_ERROR_REMOTE_LOW_RESOURCES: 10104 case HCI_ERROR_REMOTE_POWER_OFF: 10105 return MGMT_DEV_DISCONN_REMOTE; 10106 case HCI_ERROR_LOCAL_HOST_TERM: 10107 return MGMT_DEV_DISCONN_LOCAL_HOST; 10108 default: 10109 return MGMT_DEV_DISCONN_UNKNOWN; 10110 } 10111 } 10112 10113 void mgmt_device_disconnected(struct hci_dev *hdev, bdaddr_t *bdaddr, 10114 u8 link_type, u8 addr_type, u8 reason, 10115 bool mgmt_connected) 10116 { 10117 struct mgmt_ev_device_disconnected ev; 10118 struct sock *sk = NULL; 10119 10120 if (!mgmt_connected) 10121 return; 10122 10123 if (link_type != ACL_LINK && 10124 link_type != LE_LINK && 10125 link_type != BIS_LINK) 10126 return; 10127 10128 bacpy(&ev.addr.bdaddr, bdaddr); 10129 ev.addr.type = link_to_bdaddr(link_type, addr_type); 10130 ev.reason = reason; 10131 10132 /* Report disconnects due to suspend */ 10133 if (hdev->suspended) 10134 ev.reason = MGMT_DEV_DISCONN_LOCAL_HOST_SUSPEND; 10135 10136 mgmt_event(MGMT_EV_DEVICE_DISCONNECTED, hdev, &ev, sizeof(ev), sk); 10137 10138 if (sk) 10139 sock_put(sk); 10140 } 10141 10142 void mgmt_disconnect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr, 10143 u8 link_type, u8 addr_type, u8 status) 10144 { 10145 u8 bdaddr_type = link_to_bdaddr(link_type, addr_type); 10146 struct mgmt_cp_disconnect *cp; 10147 struct mgmt_pending_cmd *cmd; 10148 10149 mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, true, 10150 unpair_device_rsp, hdev); 10151 10152 cmd = pending_find(MGMT_OP_DISCONNECT, hdev); 10153 if (!cmd) 10154 return; 10155 10156 cp = cmd->param; 10157 10158 if (bacmp(bdaddr, &cp->addr.bdaddr)) 10159 return; 10160 10161 if (cp->addr.type != bdaddr_type) 10162 return; 10163 10164 cmd->cmd_complete(cmd, mgmt_status(status)); 10165 mgmt_pending_remove(cmd); 10166 } 10167 10168 void mgmt_connect_failed(struct hci_dev *hdev, struct hci_conn *conn, u8 status) 10169 { 10170 struct mgmt_ev_connect_failed ev; 10171 10172 if (test_and_clear_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags)) { 10173 mgmt_device_disconnected(hdev, &conn->dst, conn->type, 10174 conn->dst_type, 10175 hci_to_mgmt_reason(status), true); 10176 return; 10177 } 10178 10179 bacpy(&ev.addr.bdaddr, &conn->dst); 10180 ev.addr.type = link_to_bdaddr(conn->type, conn->dst_type); 10181 ev.status = mgmt_status(status); 10182 10183 mgmt_event(MGMT_EV_CONNECT_FAILED, hdev, &ev, sizeof(ev), NULL); 10184 } 10185 10186 void mgmt_pin_code_request(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 secure) 10187 { 10188 struct mgmt_ev_pin_code_request ev; 10189 10190 bacpy(&ev.addr.bdaddr, bdaddr); 10191 ev.addr.type = BDADDR_BREDR; 10192 ev.secure = secure; 10193 10194 mgmt_event(MGMT_EV_PIN_CODE_REQUEST, hdev, &ev, sizeof(ev), NULL); 10195 } 10196 10197 void mgmt_pin_code_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr, 10198 u8 status) 10199 { 10200 struct mgmt_pending_cmd *cmd; 10201 10202 cmd = pending_find(MGMT_OP_PIN_CODE_REPLY, hdev); 10203 if (!cmd) 10204 return; 10205 10206 cmd->cmd_complete(cmd, mgmt_status(status)); 10207 mgmt_pending_remove(cmd); 10208 } 10209 10210 void mgmt_pin_code_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr, 10211 u8 status) 10212 { 10213 struct mgmt_pending_cmd *cmd; 10214 10215 cmd = pending_find(MGMT_OP_PIN_CODE_NEG_REPLY, hdev); 10216 if (!cmd) 10217 return; 10218 10219 cmd->cmd_complete(cmd, mgmt_status(status)); 10220 mgmt_pending_remove(cmd); 10221 } 10222 10223 int mgmt_user_confirm_request(struct hci_dev *hdev, bdaddr_t *bdaddr, 10224 u8 link_type, u8 addr_type, u32 value, 10225 u8 confirm_hint) 10226 { 10227 struct mgmt_ev_user_confirm_request ev; 10228 10229 bt_dev_dbg(hdev, "bdaddr %pMR", bdaddr); 10230 10231 bacpy(&ev.addr.bdaddr, bdaddr); 10232 ev.addr.type = link_to_bdaddr(link_type, addr_type); 10233 ev.confirm_hint = confirm_hint; 10234 ev.value = cpu_to_le32(value); 10235 10236 return mgmt_event(MGMT_EV_USER_CONFIRM_REQUEST, hdev, &ev, sizeof(ev), 10237 NULL); 10238 } 10239 10240 int mgmt_user_passkey_request(struct hci_dev *hdev, bdaddr_t *bdaddr, 10241 u8 link_type, u8 addr_type) 10242 { 10243 struct mgmt_ev_user_passkey_request ev; 10244 10245 bt_dev_dbg(hdev, "bdaddr %pMR", bdaddr); 10246 10247 bacpy(&ev.addr.bdaddr, bdaddr); 10248 ev.addr.type = link_to_bdaddr(link_type, addr_type); 10249 10250 return mgmt_event(MGMT_EV_USER_PASSKEY_REQUEST, hdev, &ev, sizeof(ev), 10251 NULL); 10252 } 10253 10254 static int user_pairing_resp_complete(struct hci_dev *hdev, bdaddr_t *bdaddr, 10255 u8 link_type, u8 addr_type, u8 status, 10256 u8 opcode) 10257 { 10258 struct mgmt_pending_cmd *cmd; 10259 10260 cmd = pending_find(opcode, hdev); 10261 if (!cmd) 10262 return -ENOENT; 10263 10264 cmd->cmd_complete(cmd, mgmt_status(status)); 10265 mgmt_pending_remove(cmd); 10266 10267 return 0; 10268 } 10269 10270 int mgmt_user_confirm_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr, 10271 u8 link_type, u8 addr_type, u8 status) 10272 { 10273 return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type, 10274 status, MGMT_OP_USER_CONFIRM_REPLY); 10275 } 10276 10277 int mgmt_user_confirm_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr, 10278 u8 link_type, u8 addr_type, u8 status) 10279 { 10280 return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type, 10281 status, 10282 MGMT_OP_USER_CONFIRM_NEG_REPLY); 10283 } 10284 10285 int mgmt_user_passkey_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr, 10286 u8 link_type, u8 addr_type, u8 status) 10287 { 10288 return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type, 10289 status, MGMT_OP_USER_PASSKEY_REPLY); 10290 } 10291 10292 int mgmt_user_passkey_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr, 10293 u8 link_type, u8 addr_type, u8 status) 10294 { 10295 return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type, 10296 status, 10297 MGMT_OP_USER_PASSKEY_NEG_REPLY); 10298 } 10299 10300 int mgmt_user_passkey_notify(struct hci_dev *hdev, bdaddr_t *bdaddr, 10301 u8 link_type, u8 addr_type, u32 passkey, 10302 u8 entered) 10303 { 10304 struct mgmt_ev_passkey_notify ev; 10305 10306 bt_dev_dbg(hdev, "bdaddr %pMR", bdaddr); 10307 10308 bacpy(&ev.addr.bdaddr, bdaddr); 10309 ev.addr.type = link_to_bdaddr(link_type, addr_type); 10310 ev.passkey = __cpu_to_le32(passkey); 10311 ev.entered = entered; 10312 10313 return mgmt_event(MGMT_EV_PASSKEY_NOTIFY, hdev, &ev, sizeof(ev), NULL); 10314 } 10315 10316 void mgmt_auth_failed(struct hci_conn *conn, u8 hci_status) 10317 { 10318 struct mgmt_ev_auth_failed ev; 10319 struct mgmt_pending_cmd *cmd; 10320 u8 status = mgmt_status(hci_status); 10321 10322 bacpy(&ev.addr.bdaddr, &conn->dst); 10323 ev.addr.type = link_to_bdaddr(conn->type, conn->dst_type); 10324 ev.status = status; 10325 10326 cmd = remove_pairing(conn); 10327 10328 mgmt_event(MGMT_EV_AUTH_FAILED, conn->hdev, &ev, sizeof(ev), 10329 cmd ? cmd->sk : NULL); 10330 10331 if (cmd) { 10332 cmd->cmd_complete(cmd, status); 10333 mgmt_pending_free(cmd); 10334 } 10335 } 10336 10337 void mgmt_auth_enable_complete(struct hci_dev *hdev, u8 status) 10338 { 10339 struct cmd_lookup match = { NULL, hdev }; 10340 bool changed; 10341 10342 if (status) { 10343 u8 mgmt_err = mgmt_status(status); 10344 mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev, true, 10345 cmd_status_rsp, &mgmt_err); 10346 return; 10347 } 10348 10349 if (test_bit(HCI_AUTH, &hdev->flags)) 10350 changed = !hci_dev_test_and_set_flag(hdev, HCI_LINK_SECURITY); 10351 else 10352 changed = hci_dev_test_and_clear_flag(hdev, HCI_LINK_SECURITY); 10353 10354 mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev, true, 10355 settings_rsp, &match); 10356 10357 if (changed) 10358 new_settings(hdev, match.sk); 10359 10360 if (match.sk) 10361 sock_put(match.sk); 10362 } 10363 10364 static void sk_lookup(struct mgmt_pending_cmd *cmd, void *data) 10365 { 10366 struct cmd_lookup *match = data; 10367 10368 if (match->sk == NULL) { 10369 match->sk = cmd->sk; 10370 sock_hold(match->sk); 10371 } 10372 } 10373 10374 void mgmt_set_class_of_dev_complete(struct hci_dev *hdev, u8 *dev_class, 10375 u8 status) 10376 { 10377 struct cmd_lookup match = { NULL, hdev, mgmt_status(status) }; 10378 10379 mgmt_pending_foreach(MGMT_OP_SET_DEV_CLASS, hdev, false, sk_lookup, 10380 &match); 10381 mgmt_pending_foreach(MGMT_OP_ADD_UUID, hdev, false, sk_lookup, 10382 &match); 10383 mgmt_pending_foreach(MGMT_OP_REMOVE_UUID, hdev, false, sk_lookup, 10384 &match); 10385 10386 if (!status) { 10387 mgmt_limited_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev, dev_class, 10388 3, HCI_MGMT_DEV_CLASS_EVENTS, NULL); 10389 ext_info_changed(hdev, NULL); 10390 } 10391 10392 if (match.sk) 10393 sock_put(match.sk); 10394 } 10395 10396 void mgmt_set_local_name_complete(struct hci_dev *hdev, u8 *name, u8 status) 10397 { 10398 struct mgmt_cp_set_local_name ev; 10399 struct mgmt_pending_cmd *cmd; 10400 10401 if (status) 10402 return; 10403 10404 memset(&ev, 0, sizeof(ev)); 10405 memcpy(ev.name, name, HCI_MAX_NAME_LENGTH); 10406 memcpy(ev.short_name, hdev->short_name, HCI_MAX_SHORT_NAME_LENGTH); 10407 10408 cmd = pending_find(MGMT_OP_SET_LOCAL_NAME, hdev); 10409 if (!cmd) { 10410 memcpy(hdev->dev_name, name, sizeof(hdev->dev_name)); 10411 10412 /* If this is a HCI command related to powering on the 10413 * HCI dev don't send any mgmt signals. 10414 */ 10415 if (hci_dev_test_flag(hdev, HCI_POWERING_DOWN)) 10416 return; 10417 10418 if (pending_find(MGMT_OP_SET_POWERED, hdev)) 10419 return; 10420 } 10421 10422 mgmt_limited_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, &ev, sizeof(ev), 10423 HCI_MGMT_LOCAL_NAME_EVENTS, cmd ? cmd->sk : NULL); 10424 ext_info_changed(hdev, cmd ? cmd->sk : NULL); 10425 } 10426 10427 static inline bool has_uuid(u8 *uuid, u16 uuid_count, u8 (*uuids)[16]) 10428 { 10429 int i; 10430 10431 for (i = 0; i < uuid_count; i++) { 10432 if (!memcmp(uuid, uuids[i], 16)) 10433 return true; 10434 } 10435 10436 return false; 10437 } 10438 10439 static bool eir_has_uuids(u8 *eir, u16 eir_len, u16 uuid_count, u8 (*uuids)[16]) 10440 { 10441 u16 parsed = 0; 10442 10443 while (parsed < eir_len) { 10444 u8 field_len = eir[0]; 10445 u8 uuid[16]; 10446 int i; 10447 10448 if (field_len == 0) 10449 break; 10450 10451 if (eir_len - parsed < field_len + 1) 10452 break; 10453 10454 switch (eir[1]) { 10455 case EIR_UUID16_ALL: 10456 case EIR_UUID16_SOME: 10457 for (i = 0; i + 3 <= field_len; i += 2) { 10458 memcpy(uuid, bluetooth_base_uuid, 16); 10459 uuid[13] = eir[i + 3]; 10460 uuid[12] = eir[i + 2]; 10461 if (has_uuid(uuid, uuid_count, uuids)) 10462 return true; 10463 } 10464 break; 10465 case EIR_UUID32_ALL: 10466 case EIR_UUID32_SOME: 10467 for (i = 0; i + 5 <= field_len; i += 4) { 10468 memcpy(uuid, bluetooth_base_uuid, 16); 10469 uuid[15] = eir[i + 5]; 10470 uuid[14] = eir[i + 4]; 10471 uuid[13] = eir[i + 3]; 10472 uuid[12] = eir[i + 2]; 10473 if (has_uuid(uuid, uuid_count, uuids)) 10474 return true; 10475 } 10476 break; 10477 case EIR_UUID128_ALL: 10478 case EIR_UUID128_SOME: 10479 for (i = 0; i + 17 <= field_len; i += 16) { 10480 memcpy(uuid, eir + i + 2, 16); 10481 if (has_uuid(uuid, uuid_count, uuids)) 10482 return true; 10483 } 10484 break; 10485 } 10486 10487 parsed += field_len + 1; 10488 eir += field_len + 1; 10489 } 10490 10491 return false; 10492 } 10493 10494 static bool is_filter_match(struct hci_dev *hdev, s8 rssi, u8 *eir, 10495 u16 eir_len, u8 *scan_rsp, u8 scan_rsp_len) 10496 { 10497 /* If a RSSI threshold has been specified, and 10498 * HCI_QUIRK_STRICT_DUPLICATE_FILTER is not set, then all results with 10499 * a RSSI smaller than the RSSI threshold will be dropped. If the quirk 10500 * is set, let it through for further processing, as we might need to 10501 * restart the scan. 10502 * 10503 * For BR/EDR devices (pre 1.2) providing no RSSI during inquiry, 10504 * the results are also dropped. 10505 */ 10506 if (hdev->discovery.rssi != HCI_RSSI_INVALID && 10507 (rssi == HCI_RSSI_INVALID || 10508 (rssi < hdev->discovery.rssi && 10509 !hci_test_quirk(hdev, HCI_QUIRK_STRICT_DUPLICATE_FILTER)))) 10510 return false; 10511 10512 spin_lock(&hdev->discovery.lock); 10513 if (hdev->discovery.uuid_count != 0) { 10514 /* If a list of UUIDs is provided in filter, results with no 10515 * matching UUID should be dropped. 10516 */ 10517 if (!eir_has_uuids(eir, eir_len, hdev->discovery.uuid_count, 10518 hdev->discovery.uuids) && 10519 !eir_has_uuids(scan_rsp, scan_rsp_len, 10520 hdev->discovery.uuid_count, 10521 hdev->discovery.uuids)) { 10522 spin_unlock(&hdev->discovery.lock); 10523 return false; 10524 } 10525 } 10526 spin_unlock(&hdev->discovery.lock); 10527 10528 /* If duplicate filtering does not report RSSI changes, then restart 10529 * scanning to ensure updated result with updated RSSI values. 10530 */ 10531 if (hci_test_quirk(hdev, HCI_QUIRK_STRICT_DUPLICATE_FILTER)) { 10532 /* Validate RSSI value against the RSSI threshold once more. */ 10533 if (hdev->discovery.rssi != HCI_RSSI_INVALID && 10534 rssi < hdev->discovery.rssi) 10535 return false; 10536 } 10537 10538 return true; 10539 } 10540 10541 void mgmt_adv_monitor_device_lost(struct hci_dev *hdev, u16 handle, 10542 bdaddr_t *bdaddr, u8 addr_type) 10543 { 10544 struct mgmt_ev_adv_monitor_device_lost ev; 10545 10546 ev.monitor_handle = cpu_to_le16(handle); 10547 bacpy(&ev.addr.bdaddr, bdaddr); 10548 ev.addr.type = addr_type; 10549 10550 mgmt_event(MGMT_EV_ADV_MONITOR_DEVICE_LOST, hdev, &ev, sizeof(ev), 10551 NULL); 10552 } 10553 10554 static void mgmt_send_adv_monitor_device_found(struct hci_dev *hdev, 10555 struct sk_buff *skb, 10556 struct sock *skip_sk, 10557 u16 handle) 10558 { 10559 struct sk_buff *advmon_skb; 10560 size_t advmon_skb_len; 10561 __le16 *monitor_handle; 10562 10563 if (!skb) 10564 return; 10565 10566 advmon_skb_len = (sizeof(struct mgmt_ev_adv_monitor_device_found) - 10567 sizeof(struct mgmt_ev_device_found)) + skb->len; 10568 advmon_skb = mgmt_alloc_skb(hdev, MGMT_EV_ADV_MONITOR_DEVICE_FOUND, 10569 advmon_skb_len); 10570 if (!advmon_skb) 10571 return; 10572 10573 /* ADV_MONITOR_DEVICE_FOUND is similar to DEVICE_FOUND event except 10574 * that it also has 'monitor_handle'. Make a copy of DEVICE_FOUND and 10575 * store monitor_handle of the matched monitor. 10576 */ 10577 monitor_handle = skb_put(advmon_skb, sizeof(*monitor_handle)); 10578 *monitor_handle = cpu_to_le16(handle); 10579 skb_put_data(advmon_skb, skb->data, skb->len); 10580 10581 mgmt_event_skb(advmon_skb, skip_sk); 10582 } 10583 10584 static void mgmt_adv_monitor_device_found(struct hci_dev *hdev, 10585 bdaddr_t *bdaddr, bool report_device, 10586 struct sk_buff *skb, 10587 struct sock *skip_sk) 10588 { 10589 struct monitored_device *dev, *tmp; 10590 bool matched = false; 10591 bool notified = false; 10592 10593 /* We have received the Advertisement Report because: 10594 * 1. the kernel has initiated active discovery 10595 * 2. if not, we have pend_le_reports > 0 in which case we are doing 10596 * passive scanning 10597 * 3. if none of the above is true, we have one or more active 10598 * Advertisement Monitor 10599 * 10600 * For case 1 and 2, report all advertisements via MGMT_EV_DEVICE_FOUND 10601 * and report ONLY one advertisement per device for the matched Monitor 10602 * via MGMT_EV_ADV_MONITOR_DEVICE_FOUND event. 10603 * 10604 * For case 3, since we are not active scanning and all advertisements 10605 * received are due to a matched Advertisement Monitor, report all 10606 * advertisements ONLY via MGMT_EV_ADV_MONITOR_DEVICE_FOUND event. 10607 */ 10608 if (report_device && !hdev->advmon_pend_notify) { 10609 mgmt_event_skb(skb, skip_sk); 10610 return; 10611 } 10612 10613 hdev->advmon_pend_notify = false; 10614 10615 list_for_each_entry_safe(dev, tmp, &hdev->monitored_devices, list) { 10616 if (!bacmp(&dev->bdaddr, bdaddr)) { 10617 matched = true; 10618 10619 if (!dev->notified) { 10620 mgmt_send_adv_monitor_device_found(hdev, skb, 10621 skip_sk, 10622 dev->handle); 10623 notified = true; 10624 dev->notified = true; 10625 } 10626 } 10627 10628 if (!dev->notified) 10629 hdev->advmon_pend_notify = true; 10630 } 10631 10632 if (!report_device && 10633 ((matched && !notified) || !msft_monitor_supported(hdev))) { 10634 /* Handle 0 indicates that we are not active scanning and this 10635 * is a subsequent advertisement report for an already matched 10636 * Advertisement Monitor or the controller offloading support 10637 * is not available. 10638 */ 10639 mgmt_send_adv_monitor_device_found(hdev, skb, skip_sk, 0); 10640 } 10641 10642 if (report_device) 10643 mgmt_event_skb(skb, skip_sk); 10644 else 10645 kfree_skb(skb); 10646 } 10647 10648 static void mesh_device_found(struct hci_dev *hdev, bdaddr_t *bdaddr, 10649 u8 addr_type, s8 rssi, u32 flags, u8 *eir, 10650 u16 eir_len, u8 *scan_rsp, u8 scan_rsp_len, 10651 u64 instant) 10652 { 10653 struct sk_buff *skb; 10654 struct mgmt_ev_mesh_device_found *ev; 10655 int i, j; 10656 10657 if (!hdev->mesh_ad_types[0]) 10658 goto accepted; 10659 10660 /* Scan for requested AD types */ 10661 if (eir_len > 0) { 10662 for (i = 0; i + 1 < eir_len; i += eir[i] + 1) { 10663 for (j = 0; j < sizeof(hdev->mesh_ad_types); j++) { 10664 if (!hdev->mesh_ad_types[j]) 10665 break; 10666 10667 if (hdev->mesh_ad_types[j] == eir[i + 1]) 10668 goto accepted; 10669 } 10670 } 10671 } 10672 10673 if (scan_rsp_len > 0) { 10674 for (i = 0; i + 1 < scan_rsp_len; i += scan_rsp[i] + 1) { 10675 for (j = 0; j < sizeof(hdev->mesh_ad_types); j++) { 10676 if (!hdev->mesh_ad_types[j]) 10677 break; 10678 10679 if (hdev->mesh_ad_types[j] == scan_rsp[i + 1]) 10680 goto accepted; 10681 } 10682 } 10683 } 10684 10685 return; 10686 10687 accepted: 10688 skb = mgmt_alloc_skb(hdev, MGMT_EV_MESH_DEVICE_FOUND, 10689 sizeof(*ev) + eir_len + scan_rsp_len); 10690 if (!skb) 10691 return; 10692 10693 ev = skb_put(skb, sizeof(*ev)); 10694 10695 bacpy(&ev->addr.bdaddr, bdaddr); 10696 ev->addr.type = link_to_bdaddr(LE_LINK, addr_type); 10697 ev->rssi = rssi; 10698 ev->flags = cpu_to_le32(flags); 10699 ev->instant = cpu_to_le64(instant); 10700 10701 if (eir_len > 0) 10702 /* Copy EIR or advertising data into event */ 10703 skb_put_data(skb, eir, eir_len); 10704 10705 if (scan_rsp_len > 0) 10706 /* Append scan response data to event */ 10707 skb_put_data(skb, scan_rsp, scan_rsp_len); 10708 10709 ev->eir_len = cpu_to_le16(eir_len + scan_rsp_len); 10710 10711 mgmt_event_skb(skb, NULL); 10712 } 10713 10714 void mgmt_device_found(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type, 10715 u8 addr_type, u8 *dev_class, s8 rssi, u32 flags, 10716 u8 *eir, u16 eir_len, u8 *scan_rsp, u8 scan_rsp_len, 10717 u64 instant) 10718 { 10719 struct sk_buff *skb; 10720 struct mgmt_ev_device_found *ev; 10721 bool report_device = hci_discovery_active(hdev); 10722 10723 if (hci_dev_test_flag(hdev, HCI_MESH) && link_type == LE_LINK) 10724 mesh_device_found(hdev, bdaddr, addr_type, rssi, flags, 10725 eir, eir_len, scan_rsp, scan_rsp_len, 10726 instant); 10727 10728 /* Don't send events for a non-kernel initiated discovery. With 10729 * LE one exception is if we have pend_le_reports > 0 in which 10730 * case we're doing passive scanning and want these events. 10731 */ 10732 if (!hci_discovery_active(hdev)) { 10733 if (link_type == ACL_LINK) 10734 return; 10735 if (link_type == LE_LINK && !list_empty(&hdev->pend_le_reports)) 10736 report_device = true; 10737 else if (!hci_is_adv_monitoring(hdev)) 10738 return; 10739 } 10740 10741 if (hdev->discovery.result_filtering) { 10742 /* We are using service discovery */ 10743 if (!is_filter_match(hdev, rssi, eir, eir_len, scan_rsp, 10744 scan_rsp_len)) 10745 return; 10746 } 10747 10748 if (hdev->discovery.limited) { 10749 /* Check for limited discoverable bit */ 10750 if (dev_class) { 10751 if (!(dev_class[1] & 0x20)) 10752 return; 10753 } else { 10754 u8 *flags = eir_get_data(eir, eir_len, EIR_FLAGS, NULL); 10755 if (!flags || !(flags[0] & LE_AD_LIMITED)) 10756 return; 10757 } 10758 } 10759 10760 /* Allocate skb. The 5 extra bytes are for the potential CoD field */ 10761 skb = mgmt_alloc_skb(hdev, MGMT_EV_DEVICE_FOUND, 10762 sizeof(*ev) + eir_len + scan_rsp_len + 5); 10763 if (!skb) 10764 return; 10765 10766 ev = skb_put(skb, sizeof(*ev)); 10767 10768 /* In case of device discovery with BR/EDR devices (pre 1.2), the 10769 * RSSI value was reported as 0 when not available. This behavior 10770 * is kept when using device discovery. This is required for full 10771 * backwards compatibility with the API. 10772 * 10773 * However when using service discovery, the value 127 will be 10774 * returned when the RSSI is not available. 10775 */ 10776 if (rssi == HCI_RSSI_INVALID && !hdev->discovery.report_invalid_rssi && 10777 link_type == ACL_LINK) 10778 rssi = 0; 10779 10780 bacpy(&ev->addr.bdaddr, bdaddr); 10781 ev->addr.type = link_to_bdaddr(link_type, addr_type); 10782 ev->rssi = rssi; 10783 ev->flags = cpu_to_le32(flags); 10784 10785 if (eir_len > 0) 10786 /* Copy EIR or advertising data into event */ 10787 skb_put_data(skb, eir, eir_len); 10788 10789 if (dev_class && !eir_get_data(eir, eir_len, EIR_CLASS_OF_DEV, NULL)) { 10790 u8 eir_cod[5]; 10791 10792 eir_len += eir_append_data(eir_cod, 0, EIR_CLASS_OF_DEV, 10793 dev_class, 3); 10794 skb_put_data(skb, eir_cod, sizeof(eir_cod)); 10795 } 10796 10797 if (scan_rsp_len > 0) 10798 /* Append scan response data to event */ 10799 skb_put_data(skb, scan_rsp, scan_rsp_len); 10800 10801 ev->eir_len = cpu_to_le16(eir_len + scan_rsp_len); 10802 10803 mgmt_adv_monitor_device_found(hdev, bdaddr, report_device, skb, NULL); 10804 } 10805 10806 void mgmt_remote_name(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type, 10807 u8 addr_type, s8 rssi, u8 *name, u8 name_len) 10808 { 10809 struct sk_buff *skb; 10810 struct mgmt_ev_device_found *ev; 10811 u16 eir_len = 0; 10812 u32 flags = 0; 10813 10814 skb = mgmt_alloc_skb(hdev, MGMT_EV_DEVICE_FOUND, 10815 sizeof(*ev) + (name ? eir_precalc_len(name_len) : 0)); 10816 if (!skb) 10817 return; 10818 10819 ev = skb_put(skb, sizeof(*ev)); 10820 bacpy(&ev->addr.bdaddr, bdaddr); 10821 ev->addr.type = link_to_bdaddr(link_type, addr_type); 10822 ev->rssi = rssi; 10823 10824 if (name) 10825 eir_len += eir_skb_put_data(skb, EIR_NAME_COMPLETE, name, name_len); 10826 else 10827 flags = MGMT_DEV_FOUND_NAME_REQUEST_FAILED; 10828 10829 ev->eir_len = cpu_to_le16(eir_len); 10830 ev->flags = cpu_to_le32(flags); 10831 10832 mgmt_event_skb(skb, NULL); 10833 } 10834 10835 void mgmt_discovering(struct hci_dev *hdev, u8 discovering) 10836 { 10837 struct mgmt_ev_discovering ev; 10838 10839 bt_dev_dbg(hdev, "discovering %u", discovering); 10840 10841 memset(&ev, 0, sizeof(ev)); 10842 ev.type = hdev->discovery.type; 10843 ev.discovering = discovering; 10844 10845 mgmt_event(MGMT_EV_DISCOVERING, hdev, &ev, sizeof(ev), NULL); 10846 } 10847 10848 void mgmt_suspending(struct hci_dev *hdev, u8 state) 10849 { 10850 struct mgmt_ev_controller_suspend ev; 10851 10852 ev.suspend_state = state; 10853 mgmt_event(MGMT_EV_CONTROLLER_SUSPEND, hdev, &ev, sizeof(ev), NULL); 10854 } 10855 10856 void mgmt_resuming(struct hci_dev *hdev, u8 reason, bdaddr_t *bdaddr, 10857 u8 addr_type) 10858 { 10859 struct mgmt_ev_controller_resume ev; 10860 10861 ev.wake_reason = reason; 10862 if (bdaddr) { 10863 bacpy(&ev.addr.bdaddr, bdaddr); 10864 ev.addr.type = addr_type; 10865 } else { 10866 memset(&ev.addr, 0, sizeof(ev.addr)); 10867 } 10868 10869 mgmt_event(MGMT_EV_CONTROLLER_RESUME, hdev, &ev, sizeof(ev), NULL); 10870 } 10871 10872 static struct hci_mgmt_chan chan = { 10873 .channel = HCI_CHANNEL_CONTROL, 10874 .handler_count = ARRAY_SIZE(mgmt_handlers), 10875 .handlers = mgmt_handlers, 10876 .hdev_init = mgmt_init_hdev, 10877 }; 10878 10879 int mgmt_init(void) 10880 { 10881 return hci_mgmt_chan_register(&chan); 10882 } 10883 10884 void mgmt_conn_subrate_notify(struct hci_dev *hdev, struct hci_conn *conn, 10885 u8 status) 10886 { 10887 struct mgmt_ev_conn_subrate ev; 10888 10889 bacpy(&ev.addr.bdaddr, &conn->dst); 10890 ev.addr.type = link_to_bdaddr(conn->type, conn->dst_type); 10891 ev.status = mgmt_status(status); 10892 ev.interval = cpu_to_le16(conn->le_rate_interval); 10893 ev.subrate = cpu_to_le16(conn->le_subrate); 10894 ev.latency = cpu_to_le16(conn->le_rate_latency); 10895 ev.cont_num = cpu_to_le16(conn->le_cont_num); 10896 ev.supv_timeout = cpu_to_le16(conn->le_rate_supv_timeout); 10897 10898 mgmt_event(MGMT_EV_CONN_SUBRATE, hdev, &ev, sizeof(ev), NULL); 10899 } 10900 10901 void mgmt_exit(void) 10902 { 10903 hci_mgmt_chan_unregister(&chan); 10904 } 10905 10906 void mgmt_cleanup(struct sock *sk) 10907 { 10908 struct mgmt_mesh_tx *mesh_tx; 10909 struct hci_dev *hdev; 10910 10911 read_lock(&hci_dev_list_lock); 10912 10913 list_for_each_entry(hdev, &hci_dev_list, list) { 10914 do { 10915 mesh_tx = mgmt_mesh_next(hdev, sk); 10916 10917 if (mesh_tx) 10918 mesh_send_complete(hdev, mesh_tx, true); 10919 } while (mesh_tx); 10920 } 10921 10922 read_unlock(&hci_dev_list_lock); 10923 } 10924