1 /* 2 BlueZ - Bluetooth protocol stack for Linux 3 4 Copyright (C) 2010 Nokia Corporation 5 Copyright (C) 2011-2012 Intel Corporation 6 7 This program is free software; you can redistribute it and/or modify 8 it under the terms of the GNU General Public License version 2 as 9 published by the Free Software Foundation; 10 11 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS 12 OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 13 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS. 14 IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY 15 CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES 16 WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN 17 ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF 18 OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. 19 20 ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS, 21 COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS 22 SOFTWARE IS DISCLAIMED. 23 */ 24 25 /* Bluetooth HCI Management interface */ 26 27 #include <linux/module.h> 28 #include <asm/unaligned.h> 29 30 #include <net/bluetooth/bluetooth.h> 31 #include <net/bluetooth/hci_core.h> 32 #include <net/bluetooth/hci_sock.h> 33 #include <net/bluetooth/l2cap.h> 34 #include <net/bluetooth/mgmt.h> 35 36 #include "hci_request.h" 37 #include "smp.h" 38 #include "mgmt_util.h" 39 #include "mgmt_config.h" 40 #include "msft.h" 41 #include "eir.h" 42 #include "aosp.h" 43 44 #define MGMT_VERSION 1 45 #define MGMT_REVISION 22 46 47 static const u16 mgmt_commands[] = { 48 MGMT_OP_READ_INDEX_LIST, 49 MGMT_OP_READ_INFO, 50 MGMT_OP_SET_POWERED, 51 MGMT_OP_SET_DISCOVERABLE, 52 MGMT_OP_SET_CONNECTABLE, 53 MGMT_OP_SET_FAST_CONNECTABLE, 54 MGMT_OP_SET_BONDABLE, 55 MGMT_OP_SET_LINK_SECURITY, 56 MGMT_OP_SET_SSP, 57 MGMT_OP_SET_HS, 58 MGMT_OP_SET_LE, 59 MGMT_OP_SET_DEV_CLASS, 60 MGMT_OP_SET_LOCAL_NAME, 61 MGMT_OP_ADD_UUID, 62 MGMT_OP_REMOVE_UUID, 63 MGMT_OP_LOAD_LINK_KEYS, 64 MGMT_OP_LOAD_LONG_TERM_KEYS, 65 MGMT_OP_DISCONNECT, 66 MGMT_OP_GET_CONNECTIONS, 67 MGMT_OP_PIN_CODE_REPLY, 68 MGMT_OP_PIN_CODE_NEG_REPLY, 69 MGMT_OP_SET_IO_CAPABILITY, 70 MGMT_OP_PAIR_DEVICE, 71 MGMT_OP_CANCEL_PAIR_DEVICE, 72 MGMT_OP_UNPAIR_DEVICE, 73 MGMT_OP_USER_CONFIRM_REPLY, 74 MGMT_OP_USER_CONFIRM_NEG_REPLY, 75 MGMT_OP_USER_PASSKEY_REPLY, 76 MGMT_OP_USER_PASSKEY_NEG_REPLY, 77 MGMT_OP_READ_LOCAL_OOB_DATA, 78 MGMT_OP_ADD_REMOTE_OOB_DATA, 79 MGMT_OP_REMOVE_REMOTE_OOB_DATA, 80 MGMT_OP_START_DISCOVERY, 81 MGMT_OP_STOP_DISCOVERY, 82 MGMT_OP_CONFIRM_NAME, 83 MGMT_OP_BLOCK_DEVICE, 84 MGMT_OP_UNBLOCK_DEVICE, 85 MGMT_OP_SET_DEVICE_ID, 86 MGMT_OP_SET_ADVERTISING, 87 MGMT_OP_SET_BREDR, 88 MGMT_OP_SET_STATIC_ADDRESS, 89 MGMT_OP_SET_SCAN_PARAMS, 90 MGMT_OP_SET_SECURE_CONN, 91 MGMT_OP_SET_DEBUG_KEYS, 92 MGMT_OP_SET_PRIVACY, 93 MGMT_OP_LOAD_IRKS, 94 MGMT_OP_GET_CONN_INFO, 95 MGMT_OP_GET_CLOCK_INFO, 96 MGMT_OP_ADD_DEVICE, 97 MGMT_OP_REMOVE_DEVICE, 98 MGMT_OP_LOAD_CONN_PARAM, 99 MGMT_OP_READ_UNCONF_INDEX_LIST, 100 MGMT_OP_READ_CONFIG_INFO, 101 MGMT_OP_SET_EXTERNAL_CONFIG, 102 MGMT_OP_SET_PUBLIC_ADDRESS, 103 MGMT_OP_START_SERVICE_DISCOVERY, 104 MGMT_OP_READ_LOCAL_OOB_EXT_DATA, 105 MGMT_OP_READ_EXT_INDEX_LIST, 106 MGMT_OP_READ_ADV_FEATURES, 107 MGMT_OP_ADD_ADVERTISING, 108 MGMT_OP_REMOVE_ADVERTISING, 109 MGMT_OP_GET_ADV_SIZE_INFO, 110 MGMT_OP_START_LIMITED_DISCOVERY, 111 MGMT_OP_READ_EXT_INFO, 112 MGMT_OP_SET_APPEARANCE, 113 MGMT_OP_GET_PHY_CONFIGURATION, 114 MGMT_OP_SET_PHY_CONFIGURATION, 115 MGMT_OP_SET_BLOCKED_KEYS, 116 MGMT_OP_SET_WIDEBAND_SPEECH, 117 MGMT_OP_READ_CONTROLLER_CAP, 118 MGMT_OP_READ_EXP_FEATURES_INFO, 119 MGMT_OP_SET_EXP_FEATURE, 120 MGMT_OP_READ_DEF_SYSTEM_CONFIG, 121 MGMT_OP_SET_DEF_SYSTEM_CONFIG, 122 MGMT_OP_READ_DEF_RUNTIME_CONFIG, 123 MGMT_OP_SET_DEF_RUNTIME_CONFIG, 124 MGMT_OP_GET_DEVICE_FLAGS, 125 MGMT_OP_SET_DEVICE_FLAGS, 126 MGMT_OP_READ_ADV_MONITOR_FEATURES, 127 MGMT_OP_ADD_ADV_PATTERNS_MONITOR, 128 MGMT_OP_REMOVE_ADV_MONITOR, 129 MGMT_OP_ADD_EXT_ADV_PARAMS, 130 MGMT_OP_ADD_EXT_ADV_DATA, 131 MGMT_OP_ADD_ADV_PATTERNS_MONITOR_RSSI, 132 MGMT_OP_SET_MESH_RECEIVER, 133 MGMT_OP_MESH_READ_FEATURES, 134 MGMT_OP_MESH_SEND, 135 MGMT_OP_MESH_SEND_CANCEL, 136 }; 137 138 static const u16 mgmt_events[] = { 139 MGMT_EV_CONTROLLER_ERROR, 140 MGMT_EV_INDEX_ADDED, 141 MGMT_EV_INDEX_REMOVED, 142 MGMT_EV_NEW_SETTINGS, 143 MGMT_EV_CLASS_OF_DEV_CHANGED, 144 MGMT_EV_LOCAL_NAME_CHANGED, 145 MGMT_EV_NEW_LINK_KEY, 146 MGMT_EV_NEW_LONG_TERM_KEY, 147 MGMT_EV_DEVICE_CONNECTED, 148 MGMT_EV_DEVICE_DISCONNECTED, 149 MGMT_EV_CONNECT_FAILED, 150 MGMT_EV_PIN_CODE_REQUEST, 151 MGMT_EV_USER_CONFIRM_REQUEST, 152 MGMT_EV_USER_PASSKEY_REQUEST, 153 MGMT_EV_AUTH_FAILED, 154 MGMT_EV_DEVICE_FOUND, 155 MGMT_EV_DISCOVERING, 156 MGMT_EV_DEVICE_BLOCKED, 157 MGMT_EV_DEVICE_UNBLOCKED, 158 MGMT_EV_DEVICE_UNPAIRED, 159 MGMT_EV_PASSKEY_NOTIFY, 160 MGMT_EV_NEW_IRK, 161 MGMT_EV_NEW_CSRK, 162 MGMT_EV_DEVICE_ADDED, 163 MGMT_EV_DEVICE_REMOVED, 164 MGMT_EV_NEW_CONN_PARAM, 165 MGMT_EV_UNCONF_INDEX_ADDED, 166 MGMT_EV_UNCONF_INDEX_REMOVED, 167 MGMT_EV_NEW_CONFIG_OPTIONS, 168 MGMT_EV_EXT_INDEX_ADDED, 169 MGMT_EV_EXT_INDEX_REMOVED, 170 MGMT_EV_LOCAL_OOB_DATA_UPDATED, 171 MGMT_EV_ADVERTISING_ADDED, 172 MGMT_EV_ADVERTISING_REMOVED, 173 MGMT_EV_EXT_INFO_CHANGED, 174 MGMT_EV_PHY_CONFIGURATION_CHANGED, 175 MGMT_EV_EXP_FEATURE_CHANGED, 176 MGMT_EV_DEVICE_FLAGS_CHANGED, 177 MGMT_EV_ADV_MONITOR_ADDED, 178 MGMT_EV_ADV_MONITOR_REMOVED, 179 MGMT_EV_CONTROLLER_SUSPEND, 180 MGMT_EV_CONTROLLER_RESUME, 181 MGMT_EV_ADV_MONITOR_DEVICE_FOUND, 182 MGMT_EV_ADV_MONITOR_DEVICE_LOST, 183 }; 184 185 static const u16 mgmt_untrusted_commands[] = { 186 MGMT_OP_READ_INDEX_LIST, 187 MGMT_OP_READ_INFO, 188 MGMT_OP_READ_UNCONF_INDEX_LIST, 189 MGMT_OP_READ_CONFIG_INFO, 190 MGMT_OP_READ_EXT_INDEX_LIST, 191 MGMT_OP_READ_EXT_INFO, 192 MGMT_OP_READ_CONTROLLER_CAP, 193 MGMT_OP_READ_EXP_FEATURES_INFO, 194 MGMT_OP_READ_DEF_SYSTEM_CONFIG, 195 MGMT_OP_READ_DEF_RUNTIME_CONFIG, 196 }; 197 198 static const u16 mgmt_untrusted_events[] = { 199 MGMT_EV_INDEX_ADDED, 200 MGMT_EV_INDEX_REMOVED, 201 MGMT_EV_NEW_SETTINGS, 202 MGMT_EV_CLASS_OF_DEV_CHANGED, 203 MGMT_EV_LOCAL_NAME_CHANGED, 204 MGMT_EV_UNCONF_INDEX_ADDED, 205 MGMT_EV_UNCONF_INDEX_REMOVED, 206 MGMT_EV_NEW_CONFIG_OPTIONS, 207 MGMT_EV_EXT_INDEX_ADDED, 208 MGMT_EV_EXT_INDEX_REMOVED, 209 MGMT_EV_EXT_INFO_CHANGED, 210 MGMT_EV_EXP_FEATURE_CHANGED, 211 }; 212 213 #define CACHE_TIMEOUT msecs_to_jiffies(2 * 1000) 214 215 #define ZERO_KEY "\x00\x00\x00\x00\x00\x00\x00\x00" \ 216 "\x00\x00\x00\x00\x00\x00\x00\x00" 217 218 /* HCI to MGMT error code conversion table */ 219 static const u8 mgmt_status_table[] = { 220 MGMT_STATUS_SUCCESS, 221 MGMT_STATUS_UNKNOWN_COMMAND, /* Unknown Command */ 222 MGMT_STATUS_NOT_CONNECTED, /* No Connection */ 223 MGMT_STATUS_FAILED, /* Hardware Failure */ 224 MGMT_STATUS_CONNECT_FAILED, /* Page Timeout */ 225 MGMT_STATUS_AUTH_FAILED, /* Authentication Failed */ 226 MGMT_STATUS_AUTH_FAILED, /* PIN or Key Missing */ 227 MGMT_STATUS_NO_RESOURCES, /* Memory Full */ 228 MGMT_STATUS_TIMEOUT, /* Connection Timeout */ 229 MGMT_STATUS_NO_RESOURCES, /* Max Number of Connections */ 230 MGMT_STATUS_NO_RESOURCES, /* Max Number of SCO Connections */ 231 MGMT_STATUS_ALREADY_CONNECTED, /* ACL Connection Exists */ 232 MGMT_STATUS_BUSY, /* Command Disallowed */ 233 MGMT_STATUS_NO_RESOURCES, /* Rejected Limited Resources */ 234 MGMT_STATUS_REJECTED, /* Rejected Security */ 235 MGMT_STATUS_REJECTED, /* Rejected Personal */ 236 MGMT_STATUS_TIMEOUT, /* Host Timeout */ 237 MGMT_STATUS_NOT_SUPPORTED, /* Unsupported Feature */ 238 MGMT_STATUS_INVALID_PARAMS, /* Invalid Parameters */ 239 MGMT_STATUS_DISCONNECTED, /* OE User Ended Connection */ 240 MGMT_STATUS_NO_RESOURCES, /* OE Low Resources */ 241 MGMT_STATUS_DISCONNECTED, /* OE Power Off */ 242 MGMT_STATUS_DISCONNECTED, /* Connection Terminated */ 243 MGMT_STATUS_BUSY, /* Repeated Attempts */ 244 MGMT_STATUS_REJECTED, /* Pairing Not Allowed */ 245 MGMT_STATUS_FAILED, /* Unknown LMP PDU */ 246 MGMT_STATUS_NOT_SUPPORTED, /* Unsupported Remote Feature */ 247 MGMT_STATUS_REJECTED, /* SCO Offset Rejected */ 248 MGMT_STATUS_REJECTED, /* SCO Interval Rejected */ 249 MGMT_STATUS_REJECTED, /* Air Mode Rejected */ 250 MGMT_STATUS_INVALID_PARAMS, /* Invalid LMP Parameters */ 251 MGMT_STATUS_FAILED, /* Unspecified Error */ 252 MGMT_STATUS_NOT_SUPPORTED, /* Unsupported LMP Parameter Value */ 253 MGMT_STATUS_FAILED, /* Role Change Not Allowed */ 254 MGMT_STATUS_TIMEOUT, /* LMP Response Timeout */ 255 MGMT_STATUS_FAILED, /* LMP Error Transaction Collision */ 256 MGMT_STATUS_FAILED, /* LMP PDU Not Allowed */ 257 MGMT_STATUS_REJECTED, /* Encryption Mode Not Accepted */ 258 MGMT_STATUS_FAILED, /* Unit Link Key Used */ 259 MGMT_STATUS_NOT_SUPPORTED, /* QoS Not Supported */ 260 MGMT_STATUS_TIMEOUT, /* Instant Passed */ 261 MGMT_STATUS_NOT_SUPPORTED, /* Pairing Not Supported */ 262 MGMT_STATUS_FAILED, /* Transaction Collision */ 263 MGMT_STATUS_FAILED, /* Reserved for future use */ 264 MGMT_STATUS_INVALID_PARAMS, /* Unacceptable Parameter */ 265 MGMT_STATUS_REJECTED, /* QoS Rejected */ 266 MGMT_STATUS_NOT_SUPPORTED, /* Classification Not Supported */ 267 MGMT_STATUS_REJECTED, /* Insufficient Security */ 268 MGMT_STATUS_INVALID_PARAMS, /* Parameter Out Of Range */ 269 MGMT_STATUS_FAILED, /* Reserved for future use */ 270 MGMT_STATUS_BUSY, /* Role Switch Pending */ 271 MGMT_STATUS_FAILED, /* Reserved for future use */ 272 MGMT_STATUS_FAILED, /* Slot Violation */ 273 MGMT_STATUS_FAILED, /* Role Switch Failed */ 274 MGMT_STATUS_INVALID_PARAMS, /* EIR Too Large */ 275 MGMT_STATUS_NOT_SUPPORTED, /* Simple Pairing Not Supported */ 276 MGMT_STATUS_BUSY, /* Host Busy Pairing */ 277 MGMT_STATUS_REJECTED, /* Rejected, No Suitable Channel */ 278 MGMT_STATUS_BUSY, /* Controller Busy */ 279 MGMT_STATUS_INVALID_PARAMS, /* Unsuitable Connection Interval */ 280 MGMT_STATUS_TIMEOUT, /* Directed Advertising Timeout */ 281 MGMT_STATUS_AUTH_FAILED, /* Terminated Due to MIC Failure */ 282 MGMT_STATUS_CONNECT_FAILED, /* Connection Establishment Failed */ 283 MGMT_STATUS_CONNECT_FAILED, /* MAC Connection Failed */ 284 }; 285 286 static u8 mgmt_errno_status(int err) 287 { 288 switch (err) { 289 case 0: 290 return MGMT_STATUS_SUCCESS; 291 case -EPERM: 292 return MGMT_STATUS_REJECTED; 293 case -EINVAL: 294 return MGMT_STATUS_INVALID_PARAMS; 295 case -EOPNOTSUPP: 296 return MGMT_STATUS_NOT_SUPPORTED; 297 case -EBUSY: 298 return MGMT_STATUS_BUSY; 299 case -ETIMEDOUT: 300 return MGMT_STATUS_AUTH_FAILED; 301 case -ENOMEM: 302 return MGMT_STATUS_NO_RESOURCES; 303 case -EISCONN: 304 return MGMT_STATUS_ALREADY_CONNECTED; 305 case -ENOTCONN: 306 return MGMT_STATUS_DISCONNECTED; 307 } 308 309 return MGMT_STATUS_FAILED; 310 } 311 312 static u8 mgmt_status(int err) 313 { 314 if (err < 0) 315 return mgmt_errno_status(err); 316 317 if (err < ARRAY_SIZE(mgmt_status_table)) 318 return mgmt_status_table[err]; 319 320 return MGMT_STATUS_FAILED; 321 } 322 323 static int mgmt_index_event(u16 event, struct hci_dev *hdev, void *data, 324 u16 len, int flag) 325 { 326 return mgmt_send_event(event, hdev, HCI_CHANNEL_CONTROL, data, len, 327 flag, NULL); 328 } 329 330 static int mgmt_limited_event(u16 event, struct hci_dev *hdev, void *data, 331 u16 len, int flag, struct sock *skip_sk) 332 { 333 return mgmt_send_event(event, hdev, HCI_CHANNEL_CONTROL, data, len, 334 flag, skip_sk); 335 } 336 337 static int mgmt_event(u16 event, struct hci_dev *hdev, void *data, u16 len, 338 struct sock *skip_sk) 339 { 340 return mgmt_send_event(event, hdev, HCI_CHANNEL_CONTROL, data, len, 341 HCI_SOCK_TRUSTED, skip_sk); 342 } 343 344 static int mgmt_event_skb(struct sk_buff *skb, struct sock *skip_sk) 345 { 346 return mgmt_send_event_skb(HCI_CHANNEL_CONTROL, skb, HCI_SOCK_TRUSTED, 347 skip_sk); 348 } 349 350 static u8 le_addr_type(u8 mgmt_addr_type) 351 { 352 if (mgmt_addr_type == BDADDR_LE_PUBLIC) 353 return ADDR_LE_DEV_PUBLIC; 354 else 355 return ADDR_LE_DEV_RANDOM; 356 } 357 358 void mgmt_fill_version_info(void *ver) 359 { 360 struct mgmt_rp_read_version *rp = ver; 361 362 rp->version = MGMT_VERSION; 363 rp->revision = cpu_to_le16(MGMT_REVISION); 364 } 365 366 static int read_version(struct sock *sk, struct hci_dev *hdev, void *data, 367 u16 data_len) 368 { 369 struct mgmt_rp_read_version rp; 370 371 bt_dev_dbg(hdev, "sock %p", sk); 372 373 mgmt_fill_version_info(&rp); 374 375 return mgmt_cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_VERSION, 0, 376 &rp, sizeof(rp)); 377 } 378 379 static int read_commands(struct sock *sk, struct hci_dev *hdev, void *data, 380 u16 data_len) 381 { 382 struct mgmt_rp_read_commands *rp; 383 u16 num_commands, num_events; 384 size_t rp_size; 385 int i, err; 386 387 bt_dev_dbg(hdev, "sock %p", sk); 388 389 if (hci_sock_test_flag(sk, HCI_SOCK_TRUSTED)) { 390 num_commands = ARRAY_SIZE(mgmt_commands); 391 num_events = ARRAY_SIZE(mgmt_events); 392 } else { 393 num_commands = ARRAY_SIZE(mgmt_untrusted_commands); 394 num_events = ARRAY_SIZE(mgmt_untrusted_events); 395 } 396 397 rp_size = sizeof(*rp) + ((num_commands + num_events) * sizeof(u16)); 398 399 rp = kmalloc(rp_size, GFP_KERNEL); 400 if (!rp) 401 return -ENOMEM; 402 403 rp->num_commands = cpu_to_le16(num_commands); 404 rp->num_events = cpu_to_le16(num_events); 405 406 if (hci_sock_test_flag(sk, HCI_SOCK_TRUSTED)) { 407 __le16 *opcode = rp->opcodes; 408 409 for (i = 0; i < num_commands; i++, opcode++) 410 put_unaligned_le16(mgmt_commands[i], opcode); 411 412 for (i = 0; i < num_events; i++, opcode++) 413 put_unaligned_le16(mgmt_events[i], opcode); 414 } else { 415 __le16 *opcode = rp->opcodes; 416 417 for (i = 0; i < num_commands; i++, opcode++) 418 put_unaligned_le16(mgmt_untrusted_commands[i], opcode); 419 420 for (i = 0; i < num_events; i++, opcode++) 421 put_unaligned_le16(mgmt_untrusted_events[i], opcode); 422 } 423 424 err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_COMMANDS, 0, 425 rp, rp_size); 426 kfree(rp); 427 428 return err; 429 } 430 431 static int read_index_list(struct sock *sk, struct hci_dev *hdev, void *data, 432 u16 data_len) 433 { 434 struct mgmt_rp_read_index_list *rp; 435 struct hci_dev *d; 436 size_t rp_len; 437 u16 count; 438 int err; 439 440 bt_dev_dbg(hdev, "sock %p", sk); 441 442 read_lock(&hci_dev_list_lock); 443 444 count = 0; 445 list_for_each_entry(d, &hci_dev_list, list) { 446 if (!hci_dev_test_flag(d, HCI_UNCONFIGURED)) 447 count++; 448 } 449 450 rp_len = sizeof(*rp) + (2 * count); 451 rp = kmalloc(rp_len, GFP_ATOMIC); 452 if (!rp) { 453 read_unlock(&hci_dev_list_lock); 454 return -ENOMEM; 455 } 456 457 count = 0; 458 list_for_each_entry(d, &hci_dev_list, list) { 459 if (hci_dev_test_flag(d, HCI_SETUP) || 460 hci_dev_test_flag(d, HCI_CONFIG) || 461 hci_dev_test_flag(d, HCI_USER_CHANNEL)) 462 continue; 463 464 /* Devices marked as raw-only are neither configured 465 * nor unconfigured controllers. 466 */ 467 if (test_bit(HCI_QUIRK_RAW_DEVICE, &d->quirks)) 468 continue; 469 470 if (!hci_dev_test_flag(d, HCI_UNCONFIGURED)) { 471 rp->index[count++] = cpu_to_le16(d->id); 472 bt_dev_dbg(hdev, "Added hci%u", d->id); 473 } 474 } 475 476 rp->num_controllers = cpu_to_le16(count); 477 rp_len = sizeof(*rp) + (2 * count); 478 479 read_unlock(&hci_dev_list_lock); 480 481 err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_INDEX_LIST, 482 0, rp, rp_len); 483 484 kfree(rp); 485 486 return err; 487 } 488 489 static int read_unconf_index_list(struct sock *sk, struct hci_dev *hdev, 490 void *data, u16 data_len) 491 { 492 struct mgmt_rp_read_unconf_index_list *rp; 493 struct hci_dev *d; 494 size_t rp_len; 495 u16 count; 496 int err; 497 498 bt_dev_dbg(hdev, "sock %p", sk); 499 500 read_lock(&hci_dev_list_lock); 501 502 count = 0; 503 list_for_each_entry(d, &hci_dev_list, list) { 504 if (hci_dev_test_flag(d, HCI_UNCONFIGURED)) 505 count++; 506 } 507 508 rp_len = sizeof(*rp) + (2 * count); 509 rp = kmalloc(rp_len, GFP_ATOMIC); 510 if (!rp) { 511 read_unlock(&hci_dev_list_lock); 512 return -ENOMEM; 513 } 514 515 count = 0; 516 list_for_each_entry(d, &hci_dev_list, list) { 517 if (hci_dev_test_flag(d, HCI_SETUP) || 518 hci_dev_test_flag(d, HCI_CONFIG) || 519 hci_dev_test_flag(d, HCI_USER_CHANNEL)) 520 continue; 521 522 /* Devices marked as raw-only are neither configured 523 * nor unconfigured controllers. 524 */ 525 if (test_bit(HCI_QUIRK_RAW_DEVICE, &d->quirks)) 526 continue; 527 528 if (hci_dev_test_flag(d, HCI_UNCONFIGURED)) { 529 rp->index[count++] = cpu_to_le16(d->id); 530 bt_dev_dbg(hdev, "Added hci%u", d->id); 531 } 532 } 533 534 rp->num_controllers = cpu_to_le16(count); 535 rp_len = sizeof(*rp) + (2 * count); 536 537 read_unlock(&hci_dev_list_lock); 538 539 err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE, 540 MGMT_OP_READ_UNCONF_INDEX_LIST, 0, rp, rp_len); 541 542 kfree(rp); 543 544 return err; 545 } 546 547 static int read_ext_index_list(struct sock *sk, struct hci_dev *hdev, 548 void *data, u16 data_len) 549 { 550 struct mgmt_rp_read_ext_index_list *rp; 551 struct hci_dev *d; 552 u16 count; 553 int err; 554 555 bt_dev_dbg(hdev, "sock %p", sk); 556 557 read_lock(&hci_dev_list_lock); 558 559 count = 0; 560 list_for_each_entry(d, &hci_dev_list, list) 561 count++; 562 563 rp = kmalloc(struct_size(rp, entry, count), GFP_ATOMIC); 564 if (!rp) { 565 read_unlock(&hci_dev_list_lock); 566 return -ENOMEM; 567 } 568 569 count = 0; 570 list_for_each_entry(d, &hci_dev_list, list) { 571 if (hci_dev_test_flag(d, HCI_SETUP) || 572 hci_dev_test_flag(d, HCI_CONFIG) || 573 hci_dev_test_flag(d, HCI_USER_CHANNEL)) 574 continue; 575 576 /* Devices marked as raw-only are neither configured 577 * nor unconfigured controllers. 578 */ 579 if (test_bit(HCI_QUIRK_RAW_DEVICE, &d->quirks)) 580 continue; 581 582 if (hci_dev_test_flag(d, HCI_UNCONFIGURED)) 583 rp->entry[count].type = 0x01; 584 else 585 rp->entry[count].type = 0x00; 586 587 rp->entry[count].bus = d->bus; 588 rp->entry[count++].index = cpu_to_le16(d->id); 589 bt_dev_dbg(hdev, "Added hci%u", d->id); 590 } 591 592 rp->num_controllers = cpu_to_le16(count); 593 594 read_unlock(&hci_dev_list_lock); 595 596 /* If this command is called at least once, then all the 597 * default index and unconfigured index events are disabled 598 * and from now on only extended index events are used. 599 */ 600 hci_sock_set_flag(sk, HCI_MGMT_EXT_INDEX_EVENTS); 601 hci_sock_clear_flag(sk, HCI_MGMT_INDEX_EVENTS); 602 hci_sock_clear_flag(sk, HCI_MGMT_UNCONF_INDEX_EVENTS); 603 604 err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE, 605 MGMT_OP_READ_EXT_INDEX_LIST, 0, rp, 606 struct_size(rp, entry, count)); 607 608 kfree(rp); 609 610 return err; 611 } 612 613 static bool is_configured(struct hci_dev *hdev) 614 { 615 if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks) && 616 !hci_dev_test_flag(hdev, HCI_EXT_CONFIGURED)) 617 return false; 618 619 if ((test_bit(HCI_QUIRK_INVALID_BDADDR, &hdev->quirks) || 620 test_bit(HCI_QUIRK_USE_BDADDR_PROPERTY, &hdev->quirks)) && 621 !bacmp(&hdev->public_addr, BDADDR_ANY)) 622 return false; 623 624 return true; 625 } 626 627 static __le32 get_missing_options(struct hci_dev *hdev) 628 { 629 u32 options = 0; 630 631 if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks) && 632 !hci_dev_test_flag(hdev, HCI_EXT_CONFIGURED)) 633 options |= MGMT_OPTION_EXTERNAL_CONFIG; 634 635 if ((test_bit(HCI_QUIRK_INVALID_BDADDR, &hdev->quirks) || 636 test_bit(HCI_QUIRK_USE_BDADDR_PROPERTY, &hdev->quirks)) && 637 !bacmp(&hdev->public_addr, BDADDR_ANY)) 638 options |= MGMT_OPTION_PUBLIC_ADDRESS; 639 640 return cpu_to_le32(options); 641 } 642 643 static int new_options(struct hci_dev *hdev, struct sock *skip) 644 { 645 __le32 options = get_missing_options(hdev); 646 647 return mgmt_limited_event(MGMT_EV_NEW_CONFIG_OPTIONS, hdev, &options, 648 sizeof(options), HCI_MGMT_OPTION_EVENTS, skip); 649 } 650 651 static int send_options_rsp(struct sock *sk, u16 opcode, struct hci_dev *hdev) 652 { 653 __le32 options = get_missing_options(hdev); 654 655 return mgmt_cmd_complete(sk, hdev->id, opcode, 0, &options, 656 sizeof(options)); 657 } 658 659 static int read_config_info(struct sock *sk, struct hci_dev *hdev, 660 void *data, u16 data_len) 661 { 662 struct mgmt_rp_read_config_info rp; 663 u32 options = 0; 664 665 bt_dev_dbg(hdev, "sock %p", sk); 666 667 hci_dev_lock(hdev); 668 669 memset(&rp, 0, sizeof(rp)); 670 rp.manufacturer = cpu_to_le16(hdev->manufacturer); 671 672 if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks)) 673 options |= MGMT_OPTION_EXTERNAL_CONFIG; 674 675 if (hdev->set_bdaddr) 676 options |= MGMT_OPTION_PUBLIC_ADDRESS; 677 678 rp.supported_options = cpu_to_le32(options); 679 rp.missing_options = get_missing_options(hdev); 680 681 hci_dev_unlock(hdev); 682 683 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_CONFIG_INFO, 0, 684 &rp, sizeof(rp)); 685 } 686 687 static u32 get_supported_phys(struct hci_dev *hdev) 688 { 689 u32 supported_phys = 0; 690 691 if (lmp_bredr_capable(hdev)) { 692 supported_phys |= MGMT_PHY_BR_1M_1SLOT; 693 694 if (hdev->features[0][0] & LMP_3SLOT) 695 supported_phys |= MGMT_PHY_BR_1M_3SLOT; 696 697 if (hdev->features[0][0] & LMP_5SLOT) 698 supported_phys |= MGMT_PHY_BR_1M_5SLOT; 699 700 if (lmp_edr_2m_capable(hdev)) { 701 supported_phys |= MGMT_PHY_EDR_2M_1SLOT; 702 703 if (lmp_edr_3slot_capable(hdev)) 704 supported_phys |= MGMT_PHY_EDR_2M_3SLOT; 705 706 if (lmp_edr_5slot_capable(hdev)) 707 supported_phys |= MGMT_PHY_EDR_2M_5SLOT; 708 709 if (lmp_edr_3m_capable(hdev)) { 710 supported_phys |= MGMT_PHY_EDR_3M_1SLOT; 711 712 if (lmp_edr_3slot_capable(hdev)) 713 supported_phys |= MGMT_PHY_EDR_3M_3SLOT; 714 715 if (lmp_edr_5slot_capable(hdev)) 716 supported_phys |= MGMT_PHY_EDR_3M_5SLOT; 717 } 718 } 719 } 720 721 if (lmp_le_capable(hdev)) { 722 supported_phys |= MGMT_PHY_LE_1M_TX; 723 supported_phys |= MGMT_PHY_LE_1M_RX; 724 725 if (hdev->le_features[1] & HCI_LE_PHY_2M) { 726 supported_phys |= MGMT_PHY_LE_2M_TX; 727 supported_phys |= MGMT_PHY_LE_2M_RX; 728 } 729 730 if (hdev->le_features[1] & HCI_LE_PHY_CODED) { 731 supported_phys |= MGMT_PHY_LE_CODED_TX; 732 supported_phys |= MGMT_PHY_LE_CODED_RX; 733 } 734 } 735 736 return supported_phys; 737 } 738 739 static u32 get_selected_phys(struct hci_dev *hdev) 740 { 741 u32 selected_phys = 0; 742 743 if (lmp_bredr_capable(hdev)) { 744 selected_phys |= MGMT_PHY_BR_1M_1SLOT; 745 746 if (hdev->pkt_type & (HCI_DM3 | HCI_DH3)) 747 selected_phys |= MGMT_PHY_BR_1M_3SLOT; 748 749 if (hdev->pkt_type & (HCI_DM5 | HCI_DH5)) 750 selected_phys |= MGMT_PHY_BR_1M_5SLOT; 751 752 if (lmp_edr_2m_capable(hdev)) { 753 if (!(hdev->pkt_type & HCI_2DH1)) 754 selected_phys |= MGMT_PHY_EDR_2M_1SLOT; 755 756 if (lmp_edr_3slot_capable(hdev) && 757 !(hdev->pkt_type & HCI_2DH3)) 758 selected_phys |= MGMT_PHY_EDR_2M_3SLOT; 759 760 if (lmp_edr_5slot_capable(hdev) && 761 !(hdev->pkt_type & HCI_2DH5)) 762 selected_phys |= MGMT_PHY_EDR_2M_5SLOT; 763 764 if (lmp_edr_3m_capable(hdev)) { 765 if (!(hdev->pkt_type & HCI_3DH1)) 766 selected_phys |= MGMT_PHY_EDR_3M_1SLOT; 767 768 if (lmp_edr_3slot_capable(hdev) && 769 !(hdev->pkt_type & HCI_3DH3)) 770 selected_phys |= MGMT_PHY_EDR_3M_3SLOT; 771 772 if (lmp_edr_5slot_capable(hdev) && 773 !(hdev->pkt_type & HCI_3DH5)) 774 selected_phys |= MGMT_PHY_EDR_3M_5SLOT; 775 } 776 } 777 } 778 779 if (lmp_le_capable(hdev)) { 780 if (hdev->le_tx_def_phys & HCI_LE_SET_PHY_1M) 781 selected_phys |= MGMT_PHY_LE_1M_TX; 782 783 if (hdev->le_rx_def_phys & HCI_LE_SET_PHY_1M) 784 selected_phys |= MGMT_PHY_LE_1M_RX; 785 786 if (hdev->le_tx_def_phys & HCI_LE_SET_PHY_2M) 787 selected_phys |= MGMT_PHY_LE_2M_TX; 788 789 if (hdev->le_rx_def_phys & HCI_LE_SET_PHY_2M) 790 selected_phys |= MGMT_PHY_LE_2M_RX; 791 792 if (hdev->le_tx_def_phys & HCI_LE_SET_PHY_CODED) 793 selected_phys |= MGMT_PHY_LE_CODED_TX; 794 795 if (hdev->le_rx_def_phys & HCI_LE_SET_PHY_CODED) 796 selected_phys |= MGMT_PHY_LE_CODED_RX; 797 } 798 799 return selected_phys; 800 } 801 802 static u32 get_configurable_phys(struct hci_dev *hdev) 803 { 804 return (get_supported_phys(hdev) & ~MGMT_PHY_BR_1M_1SLOT & 805 ~MGMT_PHY_LE_1M_TX & ~MGMT_PHY_LE_1M_RX); 806 } 807 808 static u32 get_supported_settings(struct hci_dev *hdev) 809 { 810 u32 settings = 0; 811 812 settings |= MGMT_SETTING_POWERED; 813 settings |= MGMT_SETTING_BONDABLE; 814 settings |= MGMT_SETTING_DEBUG_KEYS; 815 settings |= MGMT_SETTING_CONNECTABLE; 816 settings |= MGMT_SETTING_DISCOVERABLE; 817 818 if (lmp_bredr_capable(hdev)) { 819 if (hdev->hci_ver >= BLUETOOTH_VER_1_2) 820 settings |= MGMT_SETTING_FAST_CONNECTABLE; 821 settings |= MGMT_SETTING_BREDR; 822 settings |= MGMT_SETTING_LINK_SECURITY; 823 824 if (lmp_ssp_capable(hdev)) { 825 settings |= MGMT_SETTING_SSP; 826 } 827 828 if (lmp_sc_capable(hdev)) 829 settings |= MGMT_SETTING_SECURE_CONN; 830 831 if (test_bit(HCI_QUIRK_WIDEBAND_SPEECH_SUPPORTED, 832 &hdev->quirks)) 833 settings |= MGMT_SETTING_WIDEBAND_SPEECH; 834 } 835 836 if (lmp_le_capable(hdev)) { 837 settings |= MGMT_SETTING_LE; 838 settings |= MGMT_SETTING_SECURE_CONN; 839 settings |= MGMT_SETTING_PRIVACY; 840 settings |= MGMT_SETTING_STATIC_ADDRESS; 841 settings |= MGMT_SETTING_ADVERTISING; 842 } 843 844 if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks) || 845 hdev->set_bdaddr) 846 settings |= MGMT_SETTING_CONFIGURATION; 847 848 if (cis_central_capable(hdev)) 849 settings |= MGMT_SETTING_CIS_CENTRAL; 850 851 if (cis_peripheral_capable(hdev)) 852 settings |= MGMT_SETTING_CIS_PERIPHERAL; 853 854 settings |= MGMT_SETTING_PHY_CONFIGURATION; 855 856 return settings; 857 } 858 859 static u32 get_current_settings(struct hci_dev *hdev) 860 { 861 u32 settings = 0; 862 863 if (hdev_is_powered(hdev)) 864 settings |= MGMT_SETTING_POWERED; 865 866 if (hci_dev_test_flag(hdev, HCI_CONNECTABLE)) 867 settings |= MGMT_SETTING_CONNECTABLE; 868 869 if (hci_dev_test_flag(hdev, HCI_FAST_CONNECTABLE)) 870 settings |= MGMT_SETTING_FAST_CONNECTABLE; 871 872 if (hci_dev_test_flag(hdev, HCI_DISCOVERABLE)) 873 settings |= MGMT_SETTING_DISCOVERABLE; 874 875 if (hci_dev_test_flag(hdev, HCI_BONDABLE)) 876 settings |= MGMT_SETTING_BONDABLE; 877 878 if (hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) 879 settings |= MGMT_SETTING_BREDR; 880 881 if (hci_dev_test_flag(hdev, HCI_LE_ENABLED)) 882 settings |= MGMT_SETTING_LE; 883 884 if (hci_dev_test_flag(hdev, HCI_LINK_SECURITY)) 885 settings |= MGMT_SETTING_LINK_SECURITY; 886 887 if (hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) 888 settings |= MGMT_SETTING_SSP; 889 890 if (hci_dev_test_flag(hdev, HCI_ADVERTISING)) 891 settings |= MGMT_SETTING_ADVERTISING; 892 893 if (hci_dev_test_flag(hdev, HCI_SC_ENABLED)) 894 settings |= MGMT_SETTING_SECURE_CONN; 895 896 if (hci_dev_test_flag(hdev, HCI_KEEP_DEBUG_KEYS)) 897 settings |= MGMT_SETTING_DEBUG_KEYS; 898 899 if (hci_dev_test_flag(hdev, HCI_PRIVACY)) 900 settings |= MGMT_SETTING_PRIVACY; 901 902 /* The current setting for static address has two purposes. The 903 * first is to indicate if the static address will be used and 904 * the second is to indicate if it is actually set. 905 * 906 * This means if the static address is not configured, this flag 907 * will never be set. If the address is configured, then if the 908 * address is actually used decides if the flag is set or not. 909 * 910 * For single mode LE only controllers and dual-mode controllers 911 * with BR/EDR disabled, the existence of the static address will 912 * be evaluated. 913 */ 914 if (hci_dev_test_flag(hdev, HCI_FORCE_STATIC_ADDR) || 915 !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) || 916 !bacmp(&hdev->bdaddr, BDADDR_ANY)) { 917 if (bacmp(&hdev->static_addr, BDADDR_ANY)) 918 settings |= MGMT_SETTING_STATIC_ADDRESS; 919 } 920 921 if (hci_dev_test_flag(hdev, HCI_WIDEBAND_SPEECH_ENABLED)) 922 settings |= MGMT_SETTING_WIDEBAND_SPEECH; 923 924 if (cis_central_capable(hdev)) 925 settings |= MGMT_SETTING_CIS_CENTRAL; 926 927 if (cis_peripheral_capable(hdev)) 928 settings |= MGMT_SETTING_CIS_PERIPHERAL; 929 930 if (bis_capable(hdev)) 931 settings |= MGMT_SETTING_ISO_BROADCASTER; 932 933 if (sync_recv_capable(hdev)) 934 settings |= MGMT_SETTING_ISO_SYNC_RECEIVER; 935 936 return settings; 937 } 938 939 static struct mgmt_pending_cmd *pending_find(u16 opcode, struct hci_dev *hdev) 940 { 941 return mgmt_pending_find(HCI_CHANNEL_CONTROL, opcode, hdev); 942 } 943 944 u8 mgmt_get_adv_discov_flags(struct hci_dev *hdev) 945 { 946 struct mgmt_pending_cmd *cmd; 947 948 /* If there's a pending mgmt command the flags will not yet have 949 * their final values, so check for this first. 950 */ 951 cmd = pending_find(MGMT_OP_SET_DISCOVERABLE, hdev); 952 if (cmd) { 953 struct mgmt_mode *cp = cmd->param; 954 if (cp->val == 0x01) 955 return LE_AD_GENERAL; 956 else if (cp->val == 0x02) 957 return LE_AD_LIMITED; 958 } else { 959 if (hci_dev_test_flag(hdev, HCI_LIMITED_DISCOVERABLE)) 960 return LE_AD_LIMITED; 961 else if (hci_dev_test_flag(hdev, HCI_DISCOVERABLE)) 962 return LE_AD_GENERAL; 963 } 964 965 return 0; 966 } 967 968 bool mgmt_get_connectable(struct hci_dev *hdev) 969 { 970 struct mgmt_pending_cmd *cmd; 971 972 /* If there's a pending mgmt command the flag will not yet have 973 * it's final value, so check for this first. 974 */ 975 cmd = pending_find(MGMT_OP_SET_CONNECTABLE, hdev); 976 if (cmd) { 977 struct mgmt_mode *cp = cmd->param; 978 979 return cp->val; 980 } 981 982 return hci_dev_test_flag(hdev, HCI_CONNECTABLE); 983 } 984 985 static int service_cache_sync(struct hci_dev *hdev, void *data) 986 { 987 hci_update_eir_sync(hdev); 988 hci_update_class_sync(hdev); 989 990 return 0; 991 } 992 993 static void service_cache_off(struct work_struct *work) 994 { 995 struct hci_dev *hdev = container_of(work, struct hci_dev, 996 service_cache.work); 997 998 if (!hci_dev_test_and_clear_flag(hdev, HCI_SERVICE_CACHE)) 999 return; 1000 1001 hci_cmd_sync_queue(hdev, service_cache_sync, NULL, NULL); 1002 } 1003 1004 static int rpa_expired_sync(struct hci_dev *hdev, void *data) 1005 { 1006 /* The generation of a new RPA and programming it into the 1007 * controller happens in the hci_req_enable_advertising() 1008 * function. 1009 */ 1010 if (ext_adv_capable(hdev)) 1011 return hci_start_ext_adv_sync(hdev, hdev->cur_adv_instance); 1012 else 1013 return hci_enable_advertising_sync(hdev); 1014 } 1015 1016 static void rpa_expired(struct work_struct *work) 1017 { 1018 struct hci_dev *hdev = container_of(work, struct hci_dev, 1019 rpa_expired.work); 1020 1021 bt_dev_dbg(hdev, ""); 1022 1023 hci_dev_set_flag(hdev, HCI_RPA_EXPIRED); 1024 1025 if (!hci_dev_test_flag(hdev, HCI_ADVERTISING)) 1026 return; 1027 1028 hci_cmd_sync_queue(hdev, rpa_expired_sync, NULL, NULL); 1029 } 1030 1031 static int set_discoverable_sync(struct hci_dev *hdev, void *data); 1032 1033 static void discov_off(struct work_struct *work) 1034 { 1035 struct hci_dev *hdev = container_of(work, struct hci_dev, 1036 discov_off.work); 1037 1038 bt_dev_dbg(hdev, ""); 1039 1040 hci_dev_lock(hdev); 1041 1042 /* When discoverable timeout triggers, then just make sure 1043 * the limited discoverable flag is cleared. Even in the case 1044 * of a timeout triggered from general discoverable, it is 1045 * safe to unconditionally clear the flag. 1046 */ 1047 hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE); 1048 hci_dev_clear_flag(hdev, HCI_DISCOVERABLE); 1049 hdev->discov_timeout = 0; 1050 1051 hci_cmd_sync_queue(hdev, set_discoverable_sync, NULL, NULL); 1052 1053 mgmt_new_settings(hdev); 1054 1055 hci_dev_unlock(hdev); 1056 } 1057 1058 static int send_settings_rsp(struct sock *sk, u16 opcode, struct hci_dev *hdev); 1059 1060 static void mesh_send_complete(struct hci_dev *hdev, 1061 struct mgmt_mesh_tx *mesh_tx, bool silent) 1062 { 1063 u8 handle = mesh_tx->handle; 1064 1065 if (!silent) 1066 mgmt_event(MGMT_EV_MESH_PACKET_CMPLT, hdev, &handle, 1067 sizeof(handle), NULL); 1068 1069 mgmt_mesh_remove(mesh_tx); 1070 } 1071 1072 static int mesh_send_done_sync(struct hci_dev *hdev, void *data) 1073 { 1074 struct mgmt_mesh_tx *mesh_tx; 1075 1076 hci_dev_clear_flag(hdev, HCI_MESH_SENDING); 1077 hci_disable_advertising_sync(hdev); 1078 mesh_tx = mgmt_mesh_next(hdev, NULL); 1079 1080 if (mesh_tx) 1081 mesh_send_complete(hdev, mesh_tx, false); 1082 1083 return 0; 1084 } 1085 1086 static int mesh_send_sync(struct hci_dev *hdev, void *data); 1087 static void mesh_send_start_complete(struct hci_dev *hdev, void *data, int err); 1088 static void mesh_next(struct hci_dev *hdev, void *data, int err) 1089 { 1090 struct mgmt_mesh_tx *mesh_tx = mgmt_mesh_next(hdev, NULL); 1091 1092 if (!mesh_tx) 1093 return; 1094 1095 err = hci_cmd_sync_queue(hdev, mesh_send_sync, mesh_tx, 1096 mesh_send_start_complete); 1097 1098 if (err < 0) 1099 mesh_send_complete(hdev, mesh_tx, false); 1100 else 1101 hci_dev_set_flag(hdev, HCI_MESH_SENDING); 1102 } 1103 1104 static void mesh_send_done(struct work_struct *work) 1105 { 1106 struct hci_dev *hdev = container_of(work, struct hci_dev, 1107 mesh_send_done.work); 1108 1109 if (!hci_dev_test_flag(hdev, HCI_MESH_SENDING)) 1110 return; 1111 1112 hci_cmd_sync_queue(hdev, mesh_send_done_sync, NULL, mesh_next); 1113 } 1114 1115 static void mgmt_init_hdev(struct sock *sk, struct hci_dev *hdev) 1116 { 1117 if (hci_dev_test_flag(hdev, HCI_MGMT)) 1118 return; 1119 1120 BT_INFO("MGMT ver %d.%d", MGMT_VERSION, MGMT_REVISION); 1121 1122 INIT_DELAYED_WORK(&hdev->discov_off, discov_off); 1123 INIT_DELAYED_WORK(&hdev->service_cache, service_cache_off); 1124 INIT_DELAYED_WORK(&hdev->rpa_expired, rpa_expired); 1125 INIT_DELAYED_WORK(&hdev->mesh_send_done, mesh_send_done); 1126 1127 /* Non-mgmt controlled devices get this bit set 1128 * implicitly so that pairing works for them, however 1129 * for mgmt we require user-space to explicitly enable 1130 * it 1131 */ 1132 hci_dev_clear_flag(hdev, HCI_BONDABLE); 1133 1134 hci_dev_set_flag(hdev, HCI_MGMT); 1135 } 1136 1137 static int read_controller_info(struct sock *sk, struct hci_dev *hdev, 1138 void *data, u16 data_len) 1139 { 1140 struct mgmt_rp_read_info rp; 1141 1142 bt_dev_dbg(hdev, "sock %p", sk); 1143 1144 hci_dev_lock(hdev); 1145 1146 memset(&rp, 0, sizeof(rp)); 1147 1148 bacpy(&rp.bdaddr, &hdev->bdaddr); 1149 1150 rp.version = hdev->hci_ver; 1151 rp.manufacturer = cpu_to_le16(hdev->manufacturer); 1152 1153 rp.supported_settings = cpu_to_le32(get_supported_settings(hdev)); 1154 rp.current_settings = cpu_to_le32(get_current_settings(hdev)); 1155 1156 memcpy(rp.dev_class, hdev->dev_class, 3); 1157 1158 memcpy(rp.name, hdev->dev_name, sizeof(hdev->dev_name)); 1159 memcpy(rp.short_name, hdev->short_name, sizeof(hdev->short_name)); 1160 1161 hci_dev_unlock(hdev); 1162 1163 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_INFO, 0, &rp, 1164 sizeof(rp)); 1165 } 1166 1167 static u16 append_eir_data_to_buf(struct hci_dev *hdev, u8 *eir) 1168 { 1169 u16 eir_len = 0; 1170 size_t name_len; 1171 1172 if (hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) 1173 eir_len = eir_append_data(eir, eir_len, EIR_CLASS_OF_DEV, 1174 hdev->dev_class, 3); 1175 1176 if (hci_dev_test_flag(hdev, HCI_LE_ENABLED)) 1177 eir_len = eir_append_le16(eir, eir_len, EIR_APPEARANCE, 1178 hdev->appearance); 1179 1180 name_len = strnlen(hdev->dev_name, sizeof(hdev->dev_name)); 1181 eir_len = eir_append_data(eir, eir_len, EIR_NAME_COMPLETE, 1182 hdev->dev_name, name_len); 1183 1184 name_len = strnlen(hdev->short_name, sizeof(hdev->short_name)); 1185 eir_len = eir_append_data(eir, eir_len, EIR_NAME_SHORT, 1186 hdev->short_name, name_len); 1187 1188 return eir_len; 1189 } 1190 1191 static int read_ext_controller_info(struct sock *sk, struct hci_dev *hdev, 1192 void *data, u16 data_len) 1193 { 1194 char buf[512]; 1195 struct mgmt_rp_read_ext_info *rp = (void *)buf; 1196 u16 eir_len; 1197 1198 bt_dev_dbg(hdev, "sock %p", sk); 1199 1200 memset(&buf, 0, sizeof(buf)); 1201 1202 hci_dev_lock(hdev); 1203 1204 bacpy(&rp->bdaddr, &hdev->bdaddr); 1205 1206 rp->version = hdev->hci_ver; 1207 rp->manufacturer = cpu_to_le16(hdev->manufacturer); 1208 1209 rp->supported_settings = cpu_to_le32(get_supported_settings(hdev)); 1210 rp->current_settings = cpu_to_le32(get_current_settings(hdev)); 1211 1212 1213 eir_len = append_eir_data_to_buf(hdev, rp->eir); 1214 rp->eir_len = cpu_to_le16(eir_len); 1215 1216 hci_dev_unlock(hdev); 1217 1218 /* If this command is called at least once, then the events 1219 * for class of device and local name changes are disabled 1220 * and only the new extended controller information event 1221 * is used. 1222 */ 1223 hci_sock_set_flag(sk, HCI_MGMT_EXT_INFO_EVENTS); 1224 hci_sock_clear_flag(sk, HCI_MGMT_DEV_CLASS_EVENTS); 1225 hci_sock_clear_flag(sk, HCI_MGMT_LOCAL_NAME_EVENTS); 1226 1227 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_EXT_INFO, 0, rp, 1228 sizeof(*rp) + eir_len); 1229 } 1230 1231 static int ext_info_changed(struct hci_dev *hdev, struct sock *skip) 1232 { 1233 char buf[512]; 1234 struct mgmt_ev_ext_info_changed *ev = (void *)buf; 1235 u16 eir_len; 1236 1237 memset(buf, 0, sizeof(buf)); 1238 1239 eir_len = append_eir_data_to_buf(hdev, ev->eir); 1240 ev->eir_len = cpu_to_le16(eir_len); 1241 1242 return mgmt_limited_event(MGMT_EV_EXT_INFO_CHANGED, hdev, ev, 1243 sizeof(*ev) + eir_len, 1244 HCI_MGMT_EXT_INFO_EVENTS, skip); 1245 } 1246 1247 static int send_settings_rsp(struct sock *sk, u16 opcode, struct hci_dev *hdev) 1248 { 1249 __le32 settings = cpu_to_le32(get_current_settings(hdev)); 1250 1251 return mgmt_cmd_complete(sk, hdev->id, opcode, 0, &settings, 1252 sizeof(settings)); 1253 } 1254 1255 void mgmt_advertising_added(struct sock *sk, struct hci_dev *hdev, u8 instance) 1256 { 1257 struct mgmt_ev_advertising_added ev; 1258 1259 ev.instance = instance; 1260 1261 mgmt_event(MGMT_EV_ADVERTISING_ADDED, hdev, &ev, sizeof(ev), sk); 1262 } 1263 1264 void mgmt_advertising_removed(struct sock *sk, struct hci_dev *hdev, 1265 u8 instance) 1266 { 1267 struct mgmt_ev_advertising_removed ev; 1268 1269 ev.instance = instance; 1270 1271 mgmt_event(MGMT_EV_ADVERTISING_REMOVED, hdev, &ev, sizeof(ev), sk); 1272 } 1273 1274 static void cancel_adv_timeout(struct hci_dev *hdev) 1275 { 1276 if (hdev->adv_instance_timeout) { 1277 hdev->adv_instance_timeout = 0; 1278 cancel_delayed_work(&hdev->adv_instance_expire); 1279 } 1280 } 1281 1282 /* This function requires the caller holds hdev->lock */ 1283 static void restart_le_actions(struct hci_dev *hdev) 1284 { 1285 struct hci_conn_params *p; 1286 1287 list_for_each_entry(p, &hdev->le_conn_params, list) { 1288 /* Needed for AUTO_OFF case where might not "really" 1289 * have been powered off. 1290 */ 1291 hci_pend_le_list_del_init(p); 1292 1293 switch (p->auto_connect) { 1294 case HCI_AUTO_CONN_DIRECT: 1295 case HCI_AUTO_CONN_ALWAYS: 1296 hci_pend_le_list_add(p, &hdev->pend_le_conns); 1297 break; 1298 case HCI_AUTO_CONN_REPORT: 1299 hci_pend_le_list_add(p, &hdev->pend_le_reports); 1300 break; 1301 default: 1302 break; 1303 } 1304 } 1305 } 1306 1307 static int new_settings(struct hci_dev *hdev, struct sock *skip) 1308 { 1309 __le32 ev = cpu_to_le32(get_current_settings(hdev)); 1310 1311 return mgmt_limited_event(MGMT_EV_NEW_SETTINGS, hdev, &ev, 1312 sizeof(ev), HCI_MGMT_SETTING_EVENTS, skip); 1313 } 1314 1315 static void mgmt_set_powered_complete(struct hci_dev *hdev, void *data, int err) 1316 { 1317 struct mgmt_pending_cmd *cmd = data; 1318 struct mgmt_mode *cp; 1319 1320 /* Make sure cmd still outstanding. */ 1321 if (cmd != pending_find(MGMT_OP_SET_POWERED, hdev)) 1322 return; 1323 1324 cp = cmd->param; 1325 1326 bt_dev_dbg(hdev, "err %d", err); 1327 1328 if (!err) { 1329 if (cp->val) { 1330 hci_dev_lock(hdev); 1331 restart_le_actions(hdev); 1332 hci_update_passive_scan(hdev); 1333 hci_dev_unlock(hdev); 1334 } 1335 1336 send_settings_rsp(cmd->sk, cmd->opcode, hdev); 1337 1338 /* Only call new_setting for power on as power off is deferred 1339 * to hdev->power_off work which does call hci_dev_do_close. 1340 */ 1341 if (cp->val) 1342 new_settings(hdev, cmd->sk); 1343 } else { 1344 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_POWERED, 1345 mgmt_status(err)); 1346 } 1347 1348 mgmt_pending_remove(cmd); 1349 } 1350 1351 static int set_powered_sync(struct hci_dev *hdev, void *data) 1352 { 1353 struct mgmt_pending_cmd *cmd = data; 1354 struct mgmt_mode *cp = cmd->param; 1355 1356 BT_DBG("%s", hdev->name); 1357 1358 return hci_set_powered_sync(hdev, cp->val); 1359 } 1360 1361 static int set_powered(struct sock *sk, struct hci_dev *hdev, void *data, 1362 u16 len) 1363 { 1364 struct mgmt_mode *cp = data; 1365 struct mgmt_pending_cmd *cmd; 1366 int err; 1367 1368 bt_dev_dbg(hdev, "sock %p", sk); 1369 1370 if (cp->val != 0x00 && cp->val != 0x01) 1371 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED, 1372 MGMT_STATUS_INVALID_PARAMS); 1373 1374 hci_dev_lock(hdev); 1375 1376 if (!cp->val) { 1377 if (hci_dev_test_flag(hdev, HCI_POWERING_DOWN)) { 1378 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED, 1379 MGMT_STATUS_BUSY); 1380 goto failed; 1381 } 1382 } 1383 1384 if (pending_find(MGMT_OP_SET_POWERED, hdev)) { 1385 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED, 1386 MGMT_STATUS_BUSY); 1387 goto failed; 1388 } 1389 1390 if (!!cp->val == hdev_is_powered(hdev)) { 1391 err = send_settings_rsp(sk, MGMT_OP_SET_POWERED, hdev); 1392 goto failed; 1393 } 1394 1395 cmd = mgmt_pending_add(sk, MGMT_OP_SET_POWERED, hdev, data, len); 1396 if (!cmd) { 1397 err = -ENOMEM; 1398 goto failed; 1399 } 1400 1401 /* Cancel potentially blocking sync operation before power off */ 1402 if (cp->val == 0x00) { 1403 hci_cmd_sync_cancel_sync(hdev, -EHOSTDOWN); 1404 err = hci_cmd_sync_queue(hdev, set_powered_sync, cmd, 1405 mgmt_set_powered_complete); 1406 } else { 1407 /* Use hci_cmd_sync_submit since hdev might not be running */ 1408 err = hci_cmd_sync_submit(hdev, set_powered_sync, cmd, 1409 mgmt_set_powered_complete); 1410 } 1411 1412 if (err < 0) 1413 mgmt_pending_remove(cmd); 1414 1415 failed: 1416 hci_dev_unlock(hdev); 1417 return err; 1418 } 1419 1420 int mgmt_new_settings(struct hci_dev *hdev) 1421 { 1422 return new_settings(hdev, NULL); 1423 } 1424 1425 struct cmd_lookup { 1426 struct sock *sk; 1427 struct hci_dev *hdev; 1428 u8 mgmt_status; 1429 }; 1430 1431 static void settings_rsp(struct mgmt_pending_cmd *cmd, void *data) 1432 { 1433 struct cmd_lookup *match = data; 1434 1435 send_settings_rsp(cmd->sk, cmd->opcode, match->hdev); 1436 1437 list_del(&cmd->list); 1438 1439 if (match->sk == NULL) { 1440 match->sk = cmd->sk; 1441 sock_hold(match->sk); 1442 } 1443 1444 mgmt_pending_free(cmd); 1445 } 1446 1447 static void cmd_status_rsp(struct mgmt_pending_cmd *cmd, void *data) 1448 { 1449 u8 *status = data; 1450 1451 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, *status); 1452 mgmt_pending_remove(cmd); 1453 } 1454 1455 static void cmd_complete_rsp(struct mgmt_pending_cmd *cmd, void *data) 1456 { 1457 if (cmd->cmd_complete) { 1458 u8 *status = data; 1459 1460 cmd->cmd_complete(cmd, *status); 1461 mgmt_pending_remove(cmd); 1462 1463 return; 1464 } 1465 1466 cmd_status_rsp(cmd, data); 1467 } 1468 1469 static int generic_cmd_complete(struct mgmt_pending_cmd *cmd, u8 status) 1470 { 1471 return mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, status, 1472 cmd->param, cmd->param_len); 1473 } 1474 1475 static int addr_cmd_complete(struct mgmt_pending_cmd *cmd, u8 status) 1476 { 1477 return mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, status, 1478 cmd->param, sizeof(struct mgmt_addr_info)); 1479 } 1480 1481 static u8 mgmt_bredr_support(struct hci_dev *hdev) 1482 { 1483 if (!lmp_bredr_capable(hdev)) 1484 return MGMT_STATUS_NOT_SUPPORTED; 1485 else if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) 1486 return MGMT_STATUS_REJECTED; 1487 else 1488 return MGMT_STATUS_SUCCESS; 1489 } 1490 1491 static u8 mgmt_le_support(struct hci_dev *hdev) 1492 { 1493 if (!lmp_le_capable(hdev)) 1494 return MGMT_STATUS_NOT_SUPPORTED; 1495 else if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED)) 1496 return MGMT_STATUS_REJECTED; 1497 else 1498 return MGMT_STATUS_SUCCESS; 1499 } 1500 1501 static void mgmt_set_discoverable_complete(struct hci_dev *hdev, void *data, 1502 int err) 1503 { 1504 struct mgmt_pending_cmd *cmd = data; 1505 1506 bt_dev_dbg(hdev, "err %d", err); 1507 1508 /* Make sure cmd still outstanding. */ 1509 if (cmd != pending_find(MGMT_OP_SET_DISCOVERABLE, hdev)) 1510 return; 1511 1512 hci_dev_lock(hdev); 1513 1514 if (err) { 1515 u8 mgmt_err = mgmt_status(err); 1516 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err); 1517 hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE); 1518 goto done; 1519 } 1520 1521 if (hci_dev_test_flag(hdev, HCI_DISCOVERABLE) && 1522 hdev->discov_timeout > 0) { 1523 int to = msecs_to_jiffies(hdev->discov_timeout * 1000); 1524 queue_delayed_work(hdev->req_workqueue, &hdev->discov_off, to); 1525 } 1526 1527 send_settings_rsp(cmd->sk, MGMT_OP_SET_DISCOVERABLE, hdev); 1528 new_settings(hdev, cmd->sk); 1529 1530 done: 1531 mgmt_pending_remove(cmd); 1532 hci_dev_unlock(hdev); 1533 } 1534 1535 static int set_discoverable_sync(struct hci_dev *hdev, void *data) 1536 { 1537 BT_DBG("%s", hdev->name); 1538 1539 return hci_update_discoverable_sync(hdev); 1540 } 1541 1542 static int set_discoverable(struct sock *sk, struct hci_dev *hdev, void *data, 1543 u16 len) 1544 { 1545 struct mgmt_cp_set_discoverable *cp = data; 1546 struct mgmt_pending_cmd *cmd; 1547 u16 timeout; 1548 int err; 1549 1550 bt_dev_dbg(hdev, "sock %p", sk); 1551 1552 if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED) && 1553 !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) 1554 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE, 1555 MGMT_STATUS_REJECTED); 1556 1557 if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02) 1558 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE, 1559 MGMT_STATUS_INVALID_PARAMS); 1560 1561 timeout = __le16_to_cpu(cp->timeout); 1562 1563 /* Disabling discoverable requires that no timeout is set, 1564 * and enabling limited discoverable requires a timeout. 1565 */ 1566 if ((cp->val == 0x00 && timeout > 0) || 1567 (cp->val == 0x02 && timeout == 0)) 1568 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE, 1569 MGMT_STATUS_INVALID_PARAMS); 1570 1571 hci_dev_lock(hdev); 1572 1573 if (!hdev_is_powered(hdev) && timeout > 0) { 1574 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE, 1575 MGMT_STATUS_NOT_POWERED); 1576 goto failed; 1577 } 1578 1579 if (pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) || 1580 pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) { 1581 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE, 1582 MGMT_STATUS_BUSY); 1583 goto failed; 1584 } 1585 1586 if (!hci_dev_test_flag(hdev, HCI_CONNECTABLE)) { 1587 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE, 1588 MGMT_STATUS_REJECTED); 1589 goto failed; 1590 } 1591 1592 if (hdev->advertising_paused) { 1593 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE, 1594 MGMT_STATUS_BUSY); 1595 goto failed; 1596 } 1597 1598 if (!hdev_is_powered(hdev)) { 1599 bool changed = false; 1600 1601 /* Setting limited discoverable when powered off is 1602 * not a valid operation since it requires a timeout 1603 * and so no need to check HCI_LIMITED_DISCOVERABLE. 1604 */ 1605 if (!!cp->val != hci_dev_test_flag(hdev, HCI_DISCOVERABLE)) { 1606 hci_dev_change_flag(hdev, HCI_DISCOVERABLE); 1607 changed = true; 1608 } 1609 1610 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev); 1611 if (err < 0) 1612 goto failed; 1613 1614 if (changed) 1615 err = new_settings(hdev, sk); 1616 1617 goto failed; 1618 } 1619 1620 /* If the current mode is the same, then just update the timeout 1621 * value with the new value. And if only the timeout gets updated, 1622 * then no need for any HCI transactions. 1623 */ 1624 if (!!cp->val == hci_dev_test_flag(hdev, HCI_DISCOVERABLE) && 1625 (cp->val == 0x02) == hci_dev_test_flag(hdev, 1626 HCI_LIMITED_DISCOVERABLE)) { 1627 cancel_delayed_work(&hdev->discov_off); 1628 hdev->discov_timeout = timeout; 1629 1630 if (cp->val && hdev->discov_timeout > 0) { 1631 int to = msecs_to_jiffies(hdev->discov_timeout * 1000); 1632 queue_delayed_work(hdev->req_workqueue, 1633 &hdev->discov_off, to); 1634 } 1635 1636 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev); 1637 goto failed; 1638 } 1639 1640 cmd = mgmt_pending_add(sk, MGMT_OP_SET_DISCOVERABLE, hdev, data, len); 1641 if (!cmd) { 1642 err = -ENOMEM; 1643 goto failed; 1644 } 1645 1646 /* Cancel any potential discoverable timeout that might be 1647 * still active and store new timeout value. The arming of 1648 * the timeout happens in the complete handler. 1649 */ 1650 cancel_delayed_work(&hdev->discov_off); 1651 hdev->discov_timeout = timeout; 1652 1653 if (cp->val) 1654 hci_dev_set_flag(hdev, HCI_DISCOVERABLE); 1655 else 1656 hci_dev_clear_flag(hdev, HCI_DISCOVERABLE); 1657 1658 /* Limited discoverable mode */ 1659 if (cp->val == 0x02) 1660 hci_dev_set_flag(hdev, HCI_LIMITED_DISCOVERABLE); 1661 else 1662 hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE); 1663 1664 err = hci_cmd_sync_queue(hdev, set_discoverable_sync, cmd, 1665 mgmt_set_discoverable_complete); 1666 1667 if (err < 0) 1668 mgmt_pending_remove(cmd); 1669 1670 failed: 1671 hci_dev_unlock(hdev); 1672 return err; 1673 } 1674 1675 static void mgmt_set_connectable_complete(struct hci_dev *hdev, void *data, 1676 int err) 1677 { 1678 struct mgmt_pending_cmd *cmd = data; 1679 1680 bt_dev_dbg(hdev, "err %d", err); 1681 1682 /* Make sure cmd still outstanding. */ 1683 if (cmd != pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) 1684 return; 1685 1686 hci_dev_lock(hdev); 1687 1688 if (err) { 1689 u8 mgmt_err = mgmt_status(err); 1690 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err); 1691 goto done; 1692 } 1693 1694 send_settings_rsp(cmd->sk, MGMT_OP_SET_CONNECTABLE, hdev); 1695 new_settings(hdev, cmd->sk); 1696 1697 done: 1698 mgmt_pending_remove(cmd); 1699 1700 hci_dev_unlock(hdev); 1701 } 1702 1703 static int set_connectable_update_settings(struct hci_dev *hdev, 1704 struct sock *sk, u8 val) 1705 { 1706 bool changed = false; 1707 int err; 1708 1709 if (!!val != hci_dev_test_flag(hdev, HCI_CONNECTABLE)) 1710 changed = true; 1711 1712 if (val) { 1713 hci_dev_set_flag(hdev, HCI_CONNECTABLE); 1714 } else { 1715 hci_dev_clear_flag(hdev, HCI_CONNECTABLE); 1716 hci_dev_clear_flag(hdev, HCI_DISCOVERABLE); 1717 } 1718 1719 err = send_settings_rsp(sk, MGMT_OP_SET_CONNECTABLE, hdev); 1720 if (err < 0) 1721 return err; 1722 1723 if (changed) { 1724 hci_update_scan(hdev); 1725 hci_update_passive_scan(hdev); 1726 return new_settings(hdev, sk); 1727 } 1728 1729 return 0; 1730 } 1731 1732 static int set_connectable_sync(struct hci_dev *hdev, void *data) 1733 { 1734 BT_DBG("%s", hdev->name); 1735 1736 return hci_update_connectable_sync(hdev); 1737 } 1738 1739 static int set_connectable(struct sock *sk, struct hci_dev *hdev, void *data, 1740 u16 len) 1741 { 1742 struct mgmt_mode *cp = data; 1743 struct mgmt_pending_cmd *cmd; 1744 int err; 1745 1746 bt_dev_dbg(hdev, "sock %p", sk); 1747 1748 if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED) && 1749 !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) 1750 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE, 1751 MGMT_STATUS_REJECTED); 1752 1753 if (cp->val != 0x00 && cp->val != 0x01) 1754 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE, 1755 MGMT_STATUS_INVALID_PARAMS); 1756 1757 hci_dev_lock(hdev); 1758 1759 if (!hdev_is_powered(hdev)) { 1760 err = set_connectable_update_settings(hdev, sk, cp->val); 1761 goto failed; 1762 } 1763 1764 if (pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) || 1765 pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) { 1766 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE, 1767 MGMT_STATUS_BUSY); 1768 goto failed; 1769 } 1770 1771 cmd = mgmt_pending_add(sk, MGMT_OP_SET_CONNECTABLE, hdev, data, len); 1772 if (!cmd) { 1773 err = -ENOMEM; 1774 goto failed; 1775 } 1776 1777 if (cp->val) { 1778 hci_dev_set_flag(hdev, HCI_CONNECTABLE); 1779 } else { 1780 if (hdev->discov_timeout > 0) 1781 cancel_delayed_work(&hdev->discov_off); 1782 1783 hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE); 1784 hci_dev_clear_flag(hdev, HCI_DISCOVERABLE); 1785 hci_dev_clear_flag(hdev, HCI_CONNECTABLE); 1786 } 1787 1788 err = hci_cmd_sync_queue(hdev, set_connectable_sync, cmd, 1789 mgmt_set_connectable_complete); 1790 1791 if (err < 0) 1792 mgmt_pending_remove(cmd); 1793 1794 failed: 1795 hci_dev_unlock(hdev); 1796 return err; 1797 } 1798 1799 static int set_bondable(struct sock *sk, struct hci_dev *hdev, void *data, 1800 u16 len) 1801 { 1802 struct mgmt_mode *cp = data; 1803 bool changed; 1804 int err; 1805 1806 bt_dev_dbg(hdev, "sock %p", sk); 1807 1808 if (cp->val != 0x00 && cp->val != 0x01) 1809 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BONDABLE, 1810 MGMT_STATUS_INVALID_PARAMS); 1811 1812 hci_dev_lock(hdev); 1813 1814 if (cp->val) 1815 changed = !hci_dev_test_and_set_flag(hdev, HCI_BONDABLE); 1816 else 1817 changed = hci_dev_test_and_clear_flag(hdev, HCI_BONDABLE); 1818 1819 err = send_settings_rsp(sk, MGMT_OP_SET_BONDABLE, hdev); 1820 if (err < 0) 1821 goto unlock; 1822 1823 if (changed) { 1824 /* In limited privacy mode the change of bondable mode 1825 * may affect the local advertising address. 1826 */ 1827 hci_update_discoverable(hdev); 1828 1829 err = new_settings(hdev, sk); 1830 } 1831 1832 unlock: 1833 hci_dev_unlock(hdev); 1834 return err; 1835 } 1836 1837 static int set_link_security(struct sock *sk, struct hci_dev *hdev, void *data, 1838 u16 len) 1839 { 1840 struct mgmt_mode *cp = data; 1841 struct mgmt_pending_cmd *cmd; 1842 u8 val, status; 1843 int err; 1844 1845 bt_dev_dbg(hdev, "sock %p", sk); 1846 1847 status = mgmt_bredr_support(hdev); 1848 if (status) 1849 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY, 1850 status); 1851 1852 if (cp->val != 0x00 && cp->val != 0x01) 1853 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY, 1854 MGMT_STATUS_INVALID_PARAMS); 1855 1856 hci_dev_lock(hdev); 1857 1858 if (!hdev_is_powered(hdev)) { 1859 bool changed = false; 1860 1861 if (!!cp->val != hci_dev_test_flag(hdev, HCI_LINK_SECURITY)) { 1862 hci_dev_change_flag(hdev, HCI_LINK_SECURITY); 1863 changed = true; 1864 } 1865 1866 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev); 1867 if (err < 0) 1868 goto failed; 1869 1870 if (changed) 1871 err = new_settings(hdev, sk); 1872 1873 goto failed; 1874 } 1875 1876 if (pending_find(MGMT_OP_SET_LINK_SECURITY, hdev)) { 1877 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY, 1878 MGMT_STATUS_BUSY); 1879 goto failed; 1880 } 1881 1882 val = !!cp->val; 1883 1884 if (test_bit(HCI_AUTH, &hdev->flags) == val) { 1885 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev); 1886 goto failed; 1887 } 1888 1889 cmd = mgmt_pending_add(sk, MGMT_OP_SET_LINK_SECURITY, hdev, data, len); 1890 if (!cmd) { 1891 err = -ENOMEM; 1892 goto failed; 1893 } 1894 1895 err = hci_send_cmd(hdev, HCI_OP_WRITE_AUTH_ENABLE, sizeof(val), &val); 1896 if (err < 0) { 1897 mgmt_pending_remove(cmd); 1898 goto failed; 1899 } 1900 1901 failed: 1902 hci_dev_unlock(hdev); 1903 return err; 1904 } 1905 1906 static void set_ssp_complete(struct hci_dev *hdev, void *data, int err) 1907 { 1908 struct cmd_lookup match = { NULL, hdev }; 1909 struct mgmt_pending_cmd *cmd = data; 1910 struct mgmt_mode *cp = cmd->param; 1911 u8 enable = cp->val; 1912 bool changed; 1913 1914 /* Make sure cmd still outstanding. */ 1915 if (cmd != pending_find(MGMT_OP_SET_SSP, hdev)) 1916 return; 1917 1918 if (err) { 1919 u8 mgmt_err = mgmt_status(err); 1920 1921 if (enable && hci_dev_test_and_clear_flag(hdev, 1922 HCI_SSP_ENABLED)) { 1923 new_settings(hdev, NULL); 1924 } 1925 1926 mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev, cmd_status_rsp, 1927 &mgmt_err); 1928 return; 1929 } 1930 1931 if (enable) { 1932 changed = !hci_dev_test_and_set_flag(hdev, HCI_SSP_ENABLED); 1933 } else { 1934 changed = hci_dev_test_and_clear_flag(hdev, HCI_SSP_ENABLED); 1935 } 1936 1937 mgmt_pending_foreach(MGMT_OP_SET_SSP, hdev, settings_rsp, &match); 1938 1939 if (changed) 1940 new_settings(hdev, match.sk); 1941 1942 if (match.sk) 1943 sock_put(match.sk); 1944 1945 hci_update_eir_sync(hdev); 1946 } 1947 1948 static int set_ssp_sync(struct hci_dev *hdev, void *data) 1949 { 1950 struct mgmt_pending_cmd *cmd = data; 1951 struct mgmt_mode *cp = cmd->param; 1952 bool changed = false; 1953 int err; 1954 1955 if (cp->val) 1956 changed = !hci_dev_test_and_set_flag(hdev, HCI_SSP_ENABLED); 1957 1958 err = hci_write_ssp_mode_sync(hdev, cp->val); 1959 1960 if (!err && changed) 1961 hci_dev_clear_flag(hdev, HCI_SSP_ENABLED); 1962 1963 return err; 1964 } 1965 1966 static int set_ssp(struct sock *sk, struct hci_dev *hdev, void *data, u16 len) 1967 { 1968 struct mgmt_mode *cp = data; 1969 struct mgmt_pending_cmd *cmd; 1970 u8 status; 1971 int err; 1972 1973 bt_dev_dbg(hdev, "sock %p", sk); 1974 1975 status = mgmt_bredr_support(hdev); 1976 if (status) 1977 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP, status); 1978 1979 if (!lmp_ssp_capable(hdev)) 1980 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP, 1981 MGMT_STATUS_NOT_SUPPORTED); 1982 1983 if (cp->val != 0x00 && cp->val != 0x01) 1984 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP, 1985 MGMT_STATUS_INVALID_PARAMS); 1986 1987 hci_dev_lock(hdev); 1988 1989 if (!hdev_is_powered(hdev)) { 1990 bool changed; 1991 1992 if (cp->val) { 1993 changed = !hci_dev_test_and_set_flag(hdev, 1994 HCI_SSP_ENABLED); 1995 } else { 1996 changed = hci_dev_test_and_clear_flag(hdev, 1997 HCI_SSP_ENABLED); 1998 } 1999 2000 err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev); 2001 if (err < 0) 2002 goto failed; 2003 2004 if (changed) 2005 err = new_settings(hdev, sk); 2006 2007 goto failed; 2008 } 2009 2010 if (pending_find(MGMT_OP_SET_SSP, hdev)) { 2011 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP, 2012 MGMT_STATUS_BUSY); 2013 goto failed; 2014 } 2015 2016 if (!!cp->val == hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) { 2017 err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev); 2018 goto failed; 2019 } 2020 2021 cmd = mgmt_pending_add(sk, MGMT_OP_SET_SSP, hdev, data, len); 2022 if (!cmd) 2023 err = -ENOMEM; 2024 else 2025 err = hci_cmd_sync_queue(hdev, set_ssp_sync, cmd, 2026 set_ssp_complete); 2027 2028 if (err < 0) { 2029 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP, 2030 MGMT_STATUS_FAILED); 2031 2032 if (cmd) 2033 mgmt_pending_remove(cmd); 2034 } 2035 2036 failed: 2037 hci_dev_unlock(hdev); 2038 return err; 2039 } 2040 2041 static int set_hs(struct sock *sk, struct hci_dev *hdev, void *data, u16 len) 2042 { 2043 bt_dev_dbg(hdev, "sock %p", sk); 2044 2045 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS, 2046 MGMT_STATUS_NOT_SUPPORTED); 2047 } 2048 2049 static void set_le_complete(struct hci_dev *hdev, void *data, int err) 2050 { 2051 struct cmd_lookup match = { NULL, hdev }; 2052 u8 status = mgmt_status(err); 2053 2054 bt_dev_dbg(hdev, "err %d", err); 2055 2056 if (status) { 2057 mgmt_pending_foreach(MGMT_OP_SET_LE, hdev, cmd_status_rsp, 2058 &status); 2059 return; 2060 } 2061 2062 mgmt_pending_foreach(MGMT_OP_SET_LE, hdev, settings_rsp, &match); 2063 2064 new_settings(hdev, match.sk); 2065 2066 if (match.sk) 2067 sock_put(match.sk); 2068 } 2069 2070 static int set_le_sync(struct hci_dev *hdev, void *data) 2071 { 2072 struct mgmt_pending_cmd *cmd = data; 2073 struct mgmt_mode *cp = cmd->param; 2074 u8 val = !!cp->val; 2075 int err; 2076 2077 if (!val) { 2078 hci_clear_adv_instance_sync(hdev, NULL, 0x00, true); 2079 2080 if (hci_dev_test_flag(hdev, HCI_LE_ADV)) 2081 hci_disable_advertising_sync(hdev); 2082 2083 if (ext_adv_capable(hdev)) 2084 hci_remove_ext_adv_instance_sync(hdev, 0, cmd->sk); 2085 } else { 2086 hci_dev_set_flag(hdev, HCI_LE_ENABLED); 2087 } 2088 2089 err = hci_write_le_host_supported_sync(hdev, val, 0); 2090 2091 /* Make sure the controller has a good default for 2092 * advertising data. Restrict the update to when LE 2093 * has actually been enabled. During power on, the 2094 * update in powered_update_hci will take care of it. 2095 */ 2096 if (!err && hci_dev_test_flag(hdev, HCI_LE_ENABLED)) { 2097 if (ext_adv_capable(hdev)) { 2098 int status; 2099 2100 status = hci_setup_ext_adv_instance_sync(hdev, 0x00); 2101 if (!status) 2102 hci_update_scan_rsp_data_sync(hdev, 0x00); 2103 } else { 2104 hci_update_adv_data_sync(hdev, 0x00); 2105 hci_update_scan_rsp_data_sync(hdev, 0x00); 2106 } 2107 2108 hci_update_passive_scan(hdev); 2109 } 2110 2111 return err; 2112 } 2113 2114 static void set_mesh_complete(struct hci_dev *hdev, void *data, int err) 2115 { 2116 struct mgmt_pending_cmd *cmd = data; 2117 u8 status = mgmt_status(err); 2118 struct sock *sk = cmd->sk; 2119 2120 if (status) { 2121 mgmt_pending_foreach(MGMT_OP_SET_MESH_RECEIVER, hdev, 2122 cmd_status_rsp, &status); 2123 return; 2124 } 2125 2126 mgmt_pending_remove(cmd); 2127 mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_MESH_RECEIVER, 0, NULL, 0); 2128 } 2129 2130 static int set_mesh_sync(struct hci_dev *hdev, void *data) 2131 { 2132 struct mgmt_pending_cmd *cmd = data; 2133 struct mgmt_cp_set_mesh *cp = cmd->param; 2134 size_t len = cmd->param_len; 2135 2136 memset(hdev->mesh_ad_types, 0, sizeof(hdev->mesh_ad_types)); 2137 2138 if (cp->enable) 2139 hci_dev_set_flag(hdev, HCI_MESH); 2140 else 2141 hci_dev_clear_flag(hdev, HCI_MESH); 2142 2143 len -= sizeof(*cp); 2144 2145 /* If filters don't fit, forward all adv pkts */ 2146 if (len <= sizeof(hdev->mesh_ad_types)) 2147 memcpy(hdev->mesh_ad_types, cp->ad_types, len); 2148 2149 hci_update_passive_scan_sync(hdev); 2150 return 0; 2151 } 2152 2153 static int set_mesh(struct sock *sk, struct hci_dev *hdev, void *data, u16 len) 2154 { 2155 struct mgmt_cp_set_mesh *cp = data; 2156 struct mgmt_pending_cmd *cmd; 2157 int err = 0; 2158 2159 bt_dev_dbg(hdev, "sock %p", sk); 2160 2161 if (!lmp_le_capable(hdev) || 2162 !hci_dev_test_flag(hdev, HCI_MESH_EXPERIMENTAL)) 2163 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_MESH_RECEIVER, 2164 MGMT_STATUS_NOT_SUPPORTED); 2165 2166 if (cp->enable != 0x00 && cp->enable != 0x01) 2167 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_MESH_RECEIVER, 2168 MGMT_STATUS_INVALID_PARAMS); 2169 2170 hci_dev_lock(hdev); 2171 2172 cmd = mgmt_pending_add(sk, MGMT_OP_SET_MESH_RECEIVER, hdev, data, len); 2173 if (!cmd) 2174 err = -ENOMEM; 2175 else 2176 err = hci_cmd_sync_queue(hdev, set_mesh_sync, cmd, 2177 set_mesh_complete); 2178 2179 if (err < 0) { 2180 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_MESH_RECEIVER, 2181 MGMT_STATUS_FAILED); 2182 2183 if (cmd) 2184 mgmt_pending_remove(cmd); 2185 } 2186 2187 hci_dev_unlock(hdev); 2188 return err; 2189 } 2190 2191 static void mesh_send_start_complete(struct hci_dev *hdev, void *data, int err) 2192 { 2193 struct mgmt_mesh_tx *mesh_tx = data; 2194 struct mgmt_cp_mesh_send *send = (void *)mesh_tx->param; 2195 unsigned long mesh_send_interval; 2196 u8 mgmt_err = mgmt_status(err); 2197 2198 /* Report any errors here, but don't report completion */ 2199 2200 if (mgmt_err) { 2201 hci_dev_clear_flag(hdev, HCI_MESH_SENDING); 2202 /* Send Complete Error Code for handle */ 2203 mesh_send_complete(hdev, mesh_tx, false); 2204 return; 2205 } 2206 2207 mesh_send_interval = msecs_to_jiffies((send->cnt) * 25); 2208 queue_delayed_work(hdev->req_workqueue, &hdev->mesh_send_done, 2209 mesh_send_interval); 2210 } 2211 2212 static int mesh_send_sync(struct hci_dev *hdev, void *data) 2213 { 2214 struct mgmt_mesh_tx *mesh_tx = data; 2215 struct mgmt_cp_mesh_send *send = (void *)mesh_tx->param; 2216 struct adv_info *adv, *next_instance; 2217 u8 instance = hdev->le_num_of_adv_sets + 1; 2218 u16 timeout, duration; 2219 int err = 0; 2220 2221 if (hdev->le_num_of_adv_sets <= hdev->adv_instance_cnt) 2222 return MGMT_STATUS_BUSY; 2223 2224 timeout = 1000; 2225 duration = send->cnt * INTERVAL_TO_MS(hdev->le_adv_max_interval); 2226 adv = hci_add_adv_instance(hdev, instance, 0, 2227 send->adv_data_len, send->adv_data, 2228 0, NULL, 2229 timeout, duration, 2230 HCI_ADV_TX_POWER_NO_PREFERENCE, 2231 hdev->le_adv_min_interval, 2232 hdev->le_adv_max_interval, 2233 mesh_tx->handle); 2234 2235 if (!IS_ERR(adv)) 2236 mesh_tx->instance = instance; 2237 else 2238 err = PTR_ERR(adv); 2239 2240 if (hdev->cur_adv_instance == instance) { 2241 /* If the currently advertised instance is being changed then 2242 * cancel the current advertising and schedule the next 2243 * instance. If there is only one instance then the overridden 2244 * advertising data will be visible right away. 2245 */ 2246 cancel_adv_timeout(hdev); 2247 2248 next_instance = hci_get_next_instance(hdev, instance); 2249 if (next_instance) 2250 instance = next_instance->instance; 2251 else 2252 instance = 0; 2253 } else if (hdev->adv_instance_timeout) { 2254 /* Immediately advertise the new instance if no other, or 2255 * let it go naturally from queue if ADV is already happening 2256 */ 2257 instance = 0; 2258 } 2259 2260 if (instance) 2261 return hci_schedule_adv_instance_sync(hdev, instance, true); 2262 2263 return err; 2264 } 2265 2266 static void send_count(struct mgmt_mesh_tx *mesh_tx, void *data) 2267 { 2268 struct mgmt_rp_mesh_read_features *rp = data; 2269 2270 if (rp->used_handles >= rp->max_handles) 2271 return; 2272 2273 rp->handles[rp->used_handles++] = mesh_tx->handle; 2274 } 2275 2276 static int mesh_features(struct sock *sk, struct hci_dev *hdev, 2277 void *data, u16 len) 2278 { 2279 struct mgmt_rp_mesh_read_features rp; 2280 2281 if (!lmp_le_capable(hdev) || 2282 !hci_dev_test_flag(hdev, HCI_MESH_EXPERIMENTAL)) 2283 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_MESH_READ_FEATURES, 2284 MGMT_STATUS_NOT_SUPPORTED); 2285 2286 memset(&rp, 0, sizeof(rp)); 2287 rp.index = cpu_to_le16(hdev->id); 2288 if (hci_dev_test_flag(hdev, HCI_LE_ENABLED)) 2289 rp.max_handles = MESH_HANDLES_MAX; 2290 2291 hci_dev_lock(hdev); 2292 2293 if (rp.max_handles) 2294 mgmt_mesh_foreach(hdev, send_count, &rp, sk); 2295 2296 mgmt_cmd_complete(sk, hdev->id, MGMT_OP_MESH_READ_FEATURES, 0, &rp, 2297 rp.used_handles + sizeof(rp) - MESH_HANDLES_MAX); 2298 2299 hci_dev_unlock(hdev); 2300 return 0; 2301 } 2302 2303 static int send_cancel(struct hci_dev *hdev, void *data) 2304 { 2305 struct mgmt_pending_cmd *cmd = data; 2306 struct mgmt_cp_mesh_send_cancel *cancel = (void *)cmd->param; 2307 struct mgmt_mesh_tx *mesh_tx; 2308 2309 if (!cancel->handle) { 2310 do { 2311 mesh_tx = mgmt_mesh_next(hdev, cmd->sk); 2312 2313 if (mesh_tx) 2314 mesh_send_complete(hdev, mesh_tx, false); 2315 } while (mesh_tx); 2316 } else { 2317 mesh_tx = mgmt_mesh_find(hdev, cancel->handle); 2318 2319 if (mesh_tx && mesh_tx->sk == cmd->sk) 2320 mesh_send_complete(hdev, mesh_tx, false); 2321 } 2322 2323 mgmt_cmd_complete(cmd->sk, hdev->id, MGMT_OP_MESH_SEND_CANCEL, 2324 0, NULL, 0); 2325 mgmt_pending_free(cmd); 2326 2327 return 0; 2328 } 2329 2330 static int mesh_send_cancel(struct sock *sk, struct hci_dev *hdev, 2331 void *data, u16 len) 2332 { 2333 struct mgmt_pending_cmd *cmd; 2334 int err; 2335 2336 if (!lmp_le_capable(hdev) || 2337 !hci_dev_test_flag(hdev, HCI_MESH_EXPERIMENTAL)) 2338 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_MESH_SEND_CANCEL, 2339 MGMT_STATUS_NOT_SUPPORTED); 2340 2341 if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED)) 2342 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_MESH_SEND_CANCEL, 2343 MGMT_STATUS_REJECTED); 2344 2345 hci_dev_lock(hdev); 2346 cmd = mgmt_pending_new(sk, MGMT_OP_MESH_SEND_CANCEL, hdev, data, len); 2347 if (!cmd) 2348 err = -ENOMEM; 2349 else 2350 err = hci_cmd_sync_queue(hdev, send_cancel, cmd, NULL); 2351 2352 if (err < 0) { 2353 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_MESH_SEND_CANCEL, 2354 MGMT_STATUS_FAILED); 2355 2356 if (cmd) 2357 mgmt_pending_free(cmd); 2358 } 2359 2360 hci_dev_unlock(hdev); 2361 return err; 2362 } 2363 2364 static int mesh_send(struct sock *sk, struct hci_dev *hdev, void *data, u16 len) 2365 { 2366 struct mgmt_mesh_tx *mesh_tx; 2367 struct mgmt_cp_mesh_send *send = data; 2368 struct mgmt_rp_mesh_read_features rp; 2369 bool sending; 2370 int err = 0; 2371 2372 if (!lmp_le_capable(hdev) || 2373 !hci_dev_test_flag(hdev, HCI_MESH_EXPERIMENTAL)) 2374 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_MESH_SEND, 2375 MGMT_STATUS_NOT_SUPPORTED); 2376 if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED) || 2377 len <= MGMT_MESH_SEND_SIZE || 2378 len > (MGMT_MESH_SEND_SIZE + 31)) 2379 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_MESH_SEND, 2380 MGMT_STATUS_REJECTED); 2381 2382 hci_dev_lock(hdev); 2383 2384 memset(&rp, 0, sizeof(rp)); 2385 rp.max_handles = MESH_HANDLES_MAX; 2386 2387 mgmt_mesh_foreach(hdev, send_count, &rp, sk); 2388 2389 if (rp.max_handles <= rp.used_handles) { 2390 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_MESH_SEND, 2391 MGMT_STATUS_BUSY); 2392 goto done; 2393 } 2394 2395 sending = hci_dev_test_flag(hdev, HCI_MESH_SENDING); 2396 mesh_tx = mgmt_mesh_add(sk, hdev, send, len); 2397 2398 if (!mesh_tx) 2399 err = -ENOMEM; 2400 else if (!sending) 2401 err = hci_cmd_sync_queue(hdev, mesh_send_sync, mesh_tx, 2402 mesh_send_start_complete); 2403 2404 if (err < 0) { 2405 bt_dev_err(hdev, "Send Mesh Failed %d", err); 2406 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_MESH_SEND, 2407 MGMT_STATUS_FAILED); 2408 2409 if (mesh_tx) { 2410 if (sending) 2411 mgmt_mesh_remove(mesh_tx); 2412 } 2413 } else { 2414 hci_dev_set_flag(hdev, HCI_MESH_SENDING); 2415 2416 mgmt_cmd_complete(sk, hdev->id, MGMT_OP_MESH_SEND, 0, 2417 &mesh_tx->handle, 1); 2418 } 2419 2420 done: 2421 hci_dev_unlock(hdev); 2422 return err; 2423 } 2424 2425 static int set_le(struct sock *sk, struct hci_dev *hdev, void *data, u16 len) 2426 { 2427 struct mgmt_mode *cp = data; 2428 struct mgmt_pending_cmd *cmd; 2429 int err; 2430 u8 val, enabled; 2431 2432 bt_dev_dbg(hdev, "sock %p", sk); 2433 2434 if (!lmp_le_capable(hdev)) 2435 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE, 2436 MGMT_STATUS_NOT_SUPPORTED); 2437 2438 if (cp->val != 0x00 && cp->val != 0x01) 2439 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE, 2440 MGMT_STATUS_INVALID_PARAMS); 2441 2442 /* Bluetooth single mode LE only controllers or dual-mode 2443 * controllers configured as LE only devices, do not allow 2444 * switching LE off. These have either LE enabled explicitly 2445 * or BR/EDR has been previously switched off. 2446 * 2447 * When trying to enable an already enabled LE, then gracefully 2448 * send a positive response. Trying to disable it however will 2449 * result into rejection. 2450 */ 2451 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) { 2452 if (cp->val == 0x01) 2453 return send_settings_rsp(sk, MGMT_OP_SET_LE, hdev); 2454 2455 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE, 2456 MGMT_STATUS_REJECTED); 2457 } 2458 2459 hci_dev_lock(hdev); 2460 2461 val = !!cp->val; 2462 enabled = lmp_host_le_capable(hdev); 2463 2464 if (!hdev_is_powered(hdev) || val == enabled) { 2465 bool changed = false; 2466 2467 if (val != hci_dev_test_flag(hdev, HCI_LE_ENABLED)) { 2468 hci_dev_change_flag(hdev, HCI_LE_ENABLED); 2469 changed = true; 2470 } 2471 2472 if (!val && hci_dev_test_flag(hdev, HCI_ADVERTISING)) { 2473 hci_dev_clear_flag(hdev, HCI_ADVERTISING); 2474 changed = true; 2475 } 2476 2477 err = send_settings_rsp(sk, MGMT_OP_SET_LE, hdev); 2478 if (err < 0) 2479 goto unlock; 2480 2481 if (changed) 2482 err = new_settings(hdev, sk); 2483 2484 goto unlock; 2485 } 2486 2487 if (pending_find(MGMT_OP_SET_LE, hdev) || 2488 pending_find(MGMT_OP_SET_ADVERTISING, hdev)) { 2489 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE, 2490 MGMT_STATUS_BUSY); 2491 goto unlock; 2492 } 2493 2494 cmd = mgmt_pending_add(sk, MGMT_OP_SET_LE, hdev, data, len); 2495 if (!cmd) 2496 err = -ENOMEM; 2497 else 2498 err = hci_cmd_sync_queue(hdev, set_le_sync, cmd, 2499 set_le_complete); 2500 2501 if (err < 0) { 2502 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE, 2503 MGMT_STATUS_FAILED); 2504 2505 if (cmd) 2506 mgmt_pending_remove(cmd); 2507 } 2508 2509 unlock: 2510 hci_dev_unlock(hdev); 2511 return err; 2512 } 2513 2514 /* This is a helper function to test for pending mgmt commands that can 2515 * cause CoD or EIR HCI commands. We can only allow one such pending 2516 * mgmt command at a time since otherwise we cannot easily track what 2517 * the current values are, will be, and based on that calculate if a new 2518 * HCI command needs to be sent and if yes with what value. 2519 */ 2520 static bool pending_eir_or_class(struct hci_dev *hdev) 2521 { 2522 struct mgmt_pending_cmd *cmd; 2523 2524 list_for_each_entry(cmd, &hdev->mgmt_pending, list) { 2525 switch (cmd->opcode) { 2526 case MGMT_OP_ADD_UUID: 2527 case MGMT_OP_REMOVE_UUID: 2528 case MGMT_OP_SET_DEV_CLASS: 2529 case MGMT_OP_SET_POWERED: 2530 return true; 2531 } 2532 } 2533 2534 return false; 2535 } 2536 2537 static const u8 bluetooth_base_uuid[] = { 2538 0xfb, 0x34, 0x9b, 0x5f, 0x80, 0x00, 0x00, 0x80, 2539 0x00, 0x10, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 2540 }; 2541 2542 static u8 get_uuid_size(const u8 *uuid) 2543 { 2544 u32 val; 2545 2546 if (memcmp(uuid, bluetooth_base_uuid, 12)) 2547 return 128; 2548 2549 val = get_unaligned_le32(&uuid[12]); 2550 if (val > 0xffff) 2551 return 32; 2552 2553 return 16; 2554 } 2555 2556 static void mgmt_class_complete(struct hci_dev *hdev, void *data, int err) 2557 { 2558 struct mgmt_pending_cmd *cmd = data; 2559 2560 bt_dev_dbg(hdev, "err %d", err); 2561 2562 mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, 2563 mgmt_status(err), hdev->dev_class, 3); 2564 2565 mgmt_pending_free(cmd); 2566 } 2567 2568 static int add_uuid_sync(struct hci_dev *hdev, void *data) 2569 { 2570 int err; 2571 2572 err = hci_update_class_sync(hdev); 2573 if (err) 2574 return err; 2575 2576 return hci_update_eir_sync(hdev); 2577 } 2578 2579 static int add_uuid(struct sock *sk, struct hci_dev *hdev, void *data, u16 len) 2580 { 2581 struct mgmt_cp_add_uuid *cp = data; 2582 struct mgmt_pending_cmd *cmd; 2583 struct bt_uuid *uuid; 2584 int err; 2585 2586 bt_dev_dbg(hdev, "sock %p", sk); 2587 2588 hci_dev_lock(hdev); 2589 2590 if (pending_eir_or_class(hdev)) { 2591 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_UUID, 2592 MGMT_STATUS_BUSY); 2593 goto failed; 2594 } 2595 2596 uuid = kmalloc(sizeof(*uuid), GFP_KERNEL); 2597 if (!uuid) { 2598 err = -ENOMEM; 2599 goto failed; 2600 } 2601 2602 memcpy(uuid->uuid, cp->uuid, 16); 2603 uuid->svc_hint = cp->svc_hint; 2604 uuid->size = get_uuid_size(cp->uuid); 2605 2606 list_add_tail(&uuid->list, &hdev->uuids); 2607 2608 cmd = mgmt_pending_new(sk, MGMT_OP_ADD_UUID, hdev, data, len); 2609 if (!cmd) { 2610 err = -ENOMEM; 2611 goto failed; 2612 } 2613 2614 /* MGMT_OP_ADD_UUID don't require adapter the UP/Running so use 2615 * hci_cmd_sync_submit instead of hci_cmd_sync_queue. 2616 */ 2617 err = hci_cmd_sync_submit(hdev, add_uuid_sync, cmd, 2618 mgmt_class_complete); 2619 if (err < 0) { 2620 mgmt_pending_free(cmd); 2621 goto failed; 2622 } 2623 2624 failed: 2625 hci_dev_unlock(hdev); 2626 return err; 2627 } 2628 2629 static bool enable_service_cache(struct hci_dev *hdev) 2630 { 2631 if (!hdev_is_powered(hdev)) 2632 return false; 2633 2634 if (!hci_dev_test_and_set_flag(hdev, HCI_SERVICE_CACHE)) { 2635 queue_delayed_work(hdev->workqueue, &hdev->service_cache, 2636 CACHE_TIMEOUT); 2637 return true; 2638 } 2639 2640 return false; 2641 } 2642 2643 static int remove_uuid_sync(struct hci_dev *hdev, void *data) 2644 { 2645 int err; 2646 2647 err = hci_update_class_sync(hdev); 2648 if (err) 2649 return err; 2650 2651 return hci_update_eir_sync(hdev); 2652 } 2653 2654 static int remove_uuid(struct sock *sk, struct hci_dev *hdev, void *data, 2655 u16 len) 2656 { 2657 struct mgmt_cp_remove_uuid *cp = data; 2658 struct mgmt_pending_cmd *cmd; 2659 struct bt_uuid *match, *tmp; 2660 static const u8 bt_uuid_any[] = { 2661 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 2662 }; 2663 int err, found; 2664 2665 bt_dev_dbg(hdev, "sock %p", sk); 2666 2667 hci_dev_lock(hdev); 2668 2669 if (pending_eir_or_class(hdev)) { 2670 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID, 2671 MGMT_STATUS_BUSY); 2672 goto unlock; 2673 } 2674 2675 if (memcmp(cp->uuid, bt_uuid_any, 16) == 0) { 2676 hci_uuids_clear(hdev); 2677 2678 if (enable_service_cache(hdev)) { 2679 err = mgmt_cmd_complete(sk, hdev->id, 2680 MGMT_OP_REMOVE_UUID, 2681 0, hdev->dev_class, 3); 2682 goto unlock; 2683 } 2684 2685 goto update_class; 2686 } 2687 2688 found = 0; 2689 2690 list_for_each_entry_safe(match, tmp, &hdev->uuids, list) { 2691 if (memcmp(match->uuid, cp->uuid, 16) != 0) 2692 continue; 2693 2694 list_del(&match->list); 2695 kfree(match); 2696 found++; 2697 } 2698 2699 if (found == 0) { 2700 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID, 2701 MGMT_STATUS_INVALID_PARAMS); 2702 goto unlock; 2703 } 2704 2705 update_class: 2706 cmd = mgmt_pending_new(sk, MGMT_OP_REMOVE_UUID, hdev, data, len); 2707 if (!cmd) { 2708 err = -ENOMEM; 2709 goto unlock; 2710 } 2711 2712 /* MGMT_OP_REMOVE_UUID don't require adapter the UP/Running so use 2713 * hci_cmd_sync_submit instead of hci_cmd_sync_queue. 2714 */ 2715 err = hci_cmd_sync_submit(hdev, remove_uuid_sync, cmd, 2716 mgmt_class_complete); 2717 if (err < 0) 2718 mgmt_pending_free(cmd); 2719 2720 unlock: 2721 hci_dev_unlock(hdev); 2722 return err; 2723 } 2724 2725 static int set_class_sync(struct hci_dev *hdev, void *data) 2726 { 2727 int err = 0; 2728 2729 if (hci_dev_test_and_clear_flag(hdev, HCI_SERVICE_CACHE)) { 2730 cancel_delayed_work_sync(&hdev->service_cache); 2731 err = hci_update_eir_sync(hdev); 2732 } 2733 2734 if (err) 2735 return err; 2736 2737 return hci_update_class_sync(hdev); 2738 } 2739 2740 static int set_dev_class(struct sock *sk, struct hci_dev *hdev, void *data, 2741 u16 len) 2742 { 2743 struct mgmt_cp_set_dev_class *cp = data; 2744 struct mgmt_pending_cmd *cmd; 2745 int err; 2746 2747 bt_dev_dbg(hdev, "sock %p", sk); 2748 2749 if (!lmp_bredr_capable(hdev)) 2750 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 2751 MGMT_STATUS_NOT_SUPPORTED); 2752 2753 hci_dev_lock(hdev); 2754 2755 if (pending_eir_or_class(hdev)) { 2756 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 2757 MGMT_STATUS_BUSY); 2758 goto unlock; 2759 } 2760 2761 if ((cp->minor & 0x03) != 0 || (cp->major & 0xe0) != 0) { 2762 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 2763 MGMT_STATUS_INVALID_PARAMS); 2764 goto unlock; 2765 } 2766 2767 hdev->major_class = cp->major; 2768 hdev->minor_class = cp->minor; 2769 2770 if (!hdev_is_powered(hdev)) { 2771 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 0, 2772 hdev->dev_class, 3); 2773 goto unlock; 2774 } 2775 2776 cmd = mgmt_pending_new(sk, MGMT_OP_SET_DEV_CLASS, hdev, data, len); 2777 if (!cmd) { 2778 err = -ENOMEM; 2779 goto unlock; 2780 } 2781 2782 /* MGMT_OP_SET_DEV_CLASS don't require adapter the UP/Running so use 2783 * hci_cmd_sync_submit instead of hci_cmd_sync_queue. 2784 */ 2785 err = hci_cmd_sync_submit(hdev, set_class_sync, cmd, 2786 mgmt_class_complete); 2787 if (err < 0) 2788 mgmt_pending_free(cmd); 2789 2790 unlock: 2791 hci_dev_unlock(hdev); 2792 return err; 2793 } 2794 2795 static int load_link_keys(struct sock *sk, struct hci_dev *hdev, void *data, 2796 u16 len) 2797 { 2798 struct mgmt_cp_load_link_keys *cp = data; 2799 const u16 max_key_count = ((U16_MAX - sizeof(*cp)) / 2800 sizeof(struct mgmt_link_key_info)); 2801 u16 key_count, expected_len; 2802 bool changed; 2803 int i; 2804 2805 bt_dev_dbg(hdev, "sock %p", sk); 2806 2807 if (!lmp_bredr_capable(hdev)) 2808 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS, 2809 MGMT_STATUS_NOT_SUPPORTED); 2810 2811 key_count = __le16_to_cpu(cp->key_count); 2812 if (key_count > max_key_count) { 2813 bt_dev_err(hdev, "load_link_keys: too big key_count value %u", 2814 key_count); 2815 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS, 2816 MGMT_STATUS_INVALID_PARAMS); 2817 } 2818 2819 expected_len = struct_size(cp, keys, key_count); 2820 if (expected_len != len) { 2821 bt_dev_err(hdev, "load_link_keys: expected %u bytes, got %u bytes", 2822 expected_len, len); 2823 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS, 2824 MGMT_STATUS_INVALID_PARAMS); 2825 } 2826 2827 if (cp->debug_keys != 0x00 && cp->debug_keys != 0x01) 2828 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS, 2829 MGMT_STATUS_INVALID_PARAMS); 2830 2831 bt_dev_dbg(hdev, "debug_keys %u key_count %u", cp->debug_keys, 2832 key_count); 2833 2834 for (i = 0; i < key_count; i++) { 2835 struct mgmt_link_key_info *key = &cp->keys[i]; 2836 2837 /* Considering SMP over BREDR/LE, there is no need to check addr_type */ 2838 if (key->type > 0x08) 2839 return mgmt_cmd_status(sk, hdev->id, 2840 MGMT_OP_LOAD_LINK_KEYS, 2841 MGMT_STATUS_INVALID_PARAMS); 2842 } 2843 2844 hci_dev_lock(hdev); 2845 2846 hci_link_keys_clear(hdev); 2847 2848 if (cp->debug_keys) 2849 changed = !hci_dev_test_and_set_flag(hdev, HCI_KEEP_DEBUG_KEYS); 2850 else 2851 changed = hci_dev_test_and_clear_flag(hdev, 2852 HCI_KEEP_DEBUG_KEYS); 2853 2854 if (changed) 2855 new_settings(hdev, NULL); 2856 2857 for (i = 0; i < key_count; i++) { 2858 struct mgmt_link_key_info *key = &cp->keys[i]; 2859 2860 if (hci_is_blocked_key(hdev, 2861 HCI_BLOCKED_KEY_TYPE_LINKKEY, 2862 key->val)) { 2863 bt_dev_warn(hdev, "Skipping blocked link key for %pMR", 2864 &key->addr.bdaddr); 2865 continue; 2866 } 2867 2868 /* Always ignore debug keys and require a new pairing if 2869 * the user wants to use them. 2870 */ 2871 if (key->type == HCI_LK_DEBUG_COMBINATION) 2872 continue; 2873 2874 hci_add_link_key(hdev, NULL, &key->addr.bdaddr, key->val, 2875 key->type, key->pin_len, NULL); 2876 } 2877 2878 mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS, 0, NULL, 0); 2879 2880 hci_dev_unlock(hdev); 2881 2882 return 0; 2883 } 2884 2885 static int device_unpaired(struct hci_dev *hdev, bdaddr_t *bdaddr, 2886 u8 addr_type, struct sock *skip_sk) 2887 { 2888 struct mgmt_ev_device_unpaired ev; 2889 2890 bacpy(&ev.addr.bdaddr, bdaddr); 2891 ev.addr.type = addr_type; 2892 2893 return mgmt_event(MGMT_EV_DEVICE_UNPAIRED, hdev, &ev, sizeof(ev), 2894 skip_sk); 2895 } 2896 2897 static void unpair_device_complete(struct hci_dev *hdev, void *data, int err) 2898 { 2899 struct mgmt_pending_cmd *cmd = data; 2900 struct mgmt_cp_unpair_device *cp = cmd->param; 2901 2902 if (!err) 2903 device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, cmd->sk); 2904 2905 cmd->cmd_complete(cmd, err); 2906 mgmt_pending_free(cmd); 2907 } 2908 2909 static int unpair_device_sync(struct hci_dev *hdev, void *data) 2910 { 2911 struct mgmt_pending_cmd *cmd = data; 2912 struct mgmt_cp_unpair_device *cp = cmd->param; 2913 struct hci_conn *conn; 2914 2915 if (cp->addr.type == BDADDR_BREDR) 2916 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, 2917 &cp->addr.bdaddr); 2918 else 2919 conn = hci_conn_hash_lookup_le(hdev, &cp->addr.bdaddr, 2920 le_addr_type(cp->addr.type)); 2921 2922 if (!conn) 2923 return 0; 2924 2925 return hci_abort_conn_sync(hdev, conn, HCI_ERROR_REMOTE_USER_TERM); 2926 } 2927 2928 static int unpair_device(struct sock *sk, struct hci_dev *hdev, void *data, 2929 u16 len) 2930 { 2931 struct mgmt_cp_unpair_device *cp = data; 2932 struct mgmt_rp_unpair_device rp; 2933 struct hci_conn_params *params; 2934 struct mgmt_pending_cmd *cmd; 2935 struct hci_conn *conn; 2936 u8 addr_type; 2937 int err; 2938 2939 memset(&rp, 0, sizeof(rp)); 2940 bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr); 2941 rp.addr.type = cp->addr.type; 2942 2943 if (!bdaddr_type_is_valid(cp->addr.type)) 2944 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE, 2945 MGMT_STATUS_INVALID_PARAMS, 2946 &rp, sizeof(rp)); 2947 2948 if (cp->disconnect != 0x00 && cp->disconnect != 0x01) 2949 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE, 2950 MGMT_STATUS_INVALID_PARAMS, 2951 &rp, sizeof(rp)); 2952 2953 hci_dev_lock(hdev); 2954 2955 if (!hdev_is_powered(hdev)) { 2956 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE, 2957 MGMT_STATUS_NOT_POWERED, &rp, 2958 sizeof(rp)); 2959 goto unlock; 2960 } 2961 2962 if (cp->addr.type == BDADDR_BREDR) { 2963 /* If disconnection is requested, then look up the 2964 * connection. If the remote device is connected, it 2965 * will be later used to terminate the link. 2966 * 2967 * Setting it to NULL explicitly will cause no 2968 * termination of the link. 2969 */ 2970 if (cp->disconnect) 2971 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, 2972 &cp->addr.bdaddr); 2973 else 2974 conn = NULL; 2975 2976 err = hci_remove_link_key(hdev, &cp->addr.bdaddr); 2977 if (err < 0) { 2978 err = mgmt_cmd_complete(sk, hdev->id, 2979 MGMT_OP_UNPAIR_DEVICE, 2980 MGMT_STATUS_NOT_PAIRED, &rp, 2981 sizeof(rp)); 2982 goto unlock; 2983 } 2984 2985 goto done; 2986 } 2987 2988 /* LE address type */ 2989 addr_type = le_addr_type(cp->addr.type); 2990 2991 /* Abort any ongoing SMP pairing. Removes ltk and irk if they exist. */ 2992 err = smp_cancel_and_remove_pairing(hdev, &cp->addr.bdaddr, addr_type); 2993 if (err < 0) { 2994 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE, 2995 MGMT_STATUS_NOT_PAIRED, &rp, 2996 sizeof(rp)); 2997 goto unlock; 2998 } 2999 3000 conn = hci_conn_hash_lookup_le(hdev, &cp->addr.bdaddr, addr_type); 3001 if (!conn) { 3002 hci_conn_params_del(hdev, &cp->addr.bdaddr, addr_type); 3003 goto done; 3004 } 3005 3006 3007 /* Defer clearing up the connection parameters until closing to 3008 * give a chance of keeping them if a repairing happens. 3009 */ 3010 set_bit(HCI_CONN_PARAM_REMOVAL_PEND, &conn->flags); 3011 3012 /* Disable auto-connection parameters if present */ 3013 params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr, addr_type); 3014 if (params) { 3015 if (params->explicit_connect) 3016 params->auto_connect = HCI_AUTO_CONN_EXPLICIT; 3017 else 3018 params->auto_connect = HCI_AUTO_CONN_DISABLED; 3019 } 3020 3021 /* If disconnection is not requested, then clear the connection 3022 * variable so that the link is not terminated. 3023 */ 3024 if (!cp->disconnect) 3025 conn = NULL; 3026 3027 done: 3028 /* If the connection variable is set, then termination of the 3029 * link is requested. 3030 */ 3031 if (!conn) { 3032 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE, 0, 3033 &rp, sizeof(rp)); 3034 device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, sk); 3035 goto unlock; 3036 } 3037 3038 cmd = mgmt_pending_new(sk, MGMT_OP_UNPAIR_DEVICE, hdev, cp, 3039 sizeof(*cp)); 3040 if (!cmd) { 3041 err = -ENOMEM; 3042 goto unlock; 3043 } 3044 3045 cmd->cmd_complete = addr_cmd_complete; 3046 3047 err = hci_cmd_sync_queue(hdev, unpair_device_sync, cmd, 3048 unpair_device_complete); 3049 if (err < 0) 3050 mgmt_pending_free(cmd); 3051 3052 unlock: 3053 hci_dev_unlock(hdev); 3054 return err; 3055 } 3056 3057 static int disconnect(struct sock *sk, struct hci_dev *hdev, void *data, 3058 u16 len) 3059 { 3060 struct mgmt_cp_disconnect *cp = data; 3061 struct mgmt_rp_disconnect rp; 3062 struct mgmt_pending_cmd *cmd; 3063 struct hci_conn *conn; 3064 int err; 3065 3066 bt_dev_dbg(hdev, "sock %p", sk); 3067 3068 memset(&rp, 0, sizeof(rp)); 3069 bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr); 3070 rp.addr.type = cp->addr.type; 3071 3072 if (!bdaddr_type_is_valid(cp->addr.type)) 3073 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT, 3074 MGMT_STATUS_INVALID_PARAMS, 3075 &rp, sizeof(rp)); 3076 3077 hci_dev_lock(hdev); 3078 3079 if (!test_bit(HCI_UP, &hdev->flags)) { 3080 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT, 3081 MGMT_STATUS_NOT_POWERED, &rp, 3082 sizeof(rp)); 3083 goto failed; 3084 } 3085 3086 if (pending_find(MGMT_OP_DISCONNECT, hdev)) { 3087 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT, 3088 MGMT_STATUS_BUSY, &rp, sizeof(rp)); 3089 goto failed; 3090 } 3091 3092 if (cp->addr.type == BDADDR_BREDR) 3093 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, 3094 &cp->addr.bdaddr); 3095 else 3096 conn = hci_conn_hash_lookup_le(hdev, &cp->addr.bdaddr, 3097 le_addr_type(cp->addr.type)); 3098 3099 if (!conn || conn->state == BT_OPEN || conn->state == BT_CLOSED) { 3100 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT, 3101 MGMT_STATUS_NOT_CONNECTED, &rp, 3102 sizeof(rp)); 3103 goto failed; 3104 } 3105 3106 cmd = mgmt_pending_add(sk, MGMT_OP_DISCONNECT, hdev, data, len); 3107 if (!cmd) { 3108 err = -ENOMEM; 3109 goto failed; 3110 } 3111 3112 cmd->cmd_complete = generic_cmd_complete; 3113 3114 err = hci_disconnect(conn, HCI_ERROR_REMOTE_USER_TERM); 3115 if (err < 0) 3116 mgmt_pending_remove(cmd); 3117 3118 failed: 3119 hci_dev_unlock(hdev); 3120 return err; 3121 } 3122 3123 static u8 link_to_bdaddr(u8 link_type, u8 addr_type) 3124 { 3125 switch (link_type) { 3126 case ISO_LINK: 3127 case LE_LINK: 3128 switch (addr_type) { 3129 case ADDR_LE_DEV_PUBLIC: 3130 return BDADDR_LE_PUBLIC; 3131 3132 default: 3133 /* Fallback to LE Random address type */ 3134 return BDADDR_LE_RANDOM; 3135 } 3136 3137 default: 3138 /* Fallback to BR/EDR type */ 3139 return BDADDR_BREDR; 3140 } 3141 } 3142 3143 static int get_connections(struct sock *sk, struct hci_dev *hdev, void *data, 3144 u16 data_len) 3145 { 3146 struct mgmt_rp_get_connections *rp; 3147 struct hci_conn *c; 3148 int err; 3149 u16 i; 3150 3151 bt_dev_dbg(hdev, "sock %p", sk); 3152 3153 hci_dev_lock(hdev); 3154 3155 if (!hdev_is_powered(hdev)) { 3156 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_CONNECTIONS, 3157 MGMT_STATUS_NOT_POWERED); 3158 goto unlock; 3159 } 3160 3161 i = 0; 3162 list_for_each_entry(c, &hdev->conn_hash.list, list) { 3163 if (test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags)) 3164 i++; 3165 } 3166 3167 rp = kmalloc(struct_size(rp, addr, i), GFP_KERNEL); 3168 if (!rp) { 3169 err = -ENOMEM; 3170 goto unlock; 3171 } 3172 3173 i = 0; 3174 list_for_each_entry(c, &hdev->conn_hash.list, list) { 3175 if (!test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags)) 3176 continue; 3177 bacpy(&rp->addr[i].bdaddr, &c->dst); 3178 rp->addr[i].type = link_to_bdaddr(c->type, c->dst_type); 3179 if (c->type == SCO_LINK || c->type == ESCO_LINK) 3180 continue; 3181 i++; 3182 } 3183 3184 rp->conn_count = cpu_to_le16(i); 3185 3186 /* Recalculate length in case of filtered SCO connections, etc */ 3187 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONNECTIONS, 0, rp, 3188 struct_size(rp, addr, i)); 3189 3190 kfree(rp); 3191 3192 unlock: 3193 hci_dev_unlock(hdev); 3194 return err; 3195 } 3196 3197 static int send_pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev, 3198 struct mgmt_cp_pin_code_neg_reply *cp) 3199 { 3200 struct mgmt_pending_cmd *cmd; 3201 int err; 3202 3203 cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_NEG_REPLY, hdev, cp, 3204 sizeof(*cp)); 3205 if (!cmd) 3206 return -ENOMEM; 3207 3208 cmd->cmd_complete = addr_cmd_complete; 3209 3210 err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_NEG_REPLY, 3211 sizeof(cp->addr.bdaddr), &cp->addr.bdaddr); 3212 if (err < 0) 3213 mgmt_pending_remove(cmd); 3214 3215 return err; 3216 } 3217 3218 static int pin_code_reply(struct sock *sk, struct hci_dev *hdev, void *data, 3219 u16 len) 3220 { 3221 struct hci_conn *conn; 3222 struct mgmt_cp_pin_code_reply *cp = data; 3223 struct hci_cp_pin_code_reply reply; 3224 struct mgmt_pending_cmd *cmd; 3225 int err; 3226 3227 bt_dev_dbg(hdev, "sock %p", sk); 3228 3229 hci_dev_lock(hdev); 3230 3231 if (!hdev_is_powered(hdev)) { 3232 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY, 3233 MGMT_STATUS_NOT_POWERED); 3234 goto failed; 3235 } 3236 3237 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->addr.bdaddr); 3238 if (!conn) { 3239 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY, 3240 MGMT_STATUS_NOT_CONNECTED); 3241 goto failed; 3242 } 3243 3244 if (conn->pending_sec_level == BT_SECURITY_HIGH && cp->pin_len != 16) { 3245 struct mgmt_cp_pin_code_neg_reply ncp; 3246 3247 memcpy(&ncp.addr, &cp->addr, sizeof(ncp.addr)); 3248 3249 bt_dev_err(hdev, "PIN code is not 16 bytes long"); 3250 3251 err = send_pin_code_neg_reply(sk, hdev, &ncp); 3252 if (err >= 0) 3253 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY, 3254 MGMT_STATUS_INVALID_PARAMS); 3255 3256 goto failed; 3257 } 3258 3259 cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_REPLY, hdev, data, len); 3260 if (!cmd) { 3261 err = -ENOMEM; 3262 goto failed; 3263 } 3264 3265 cmd->cmd_complete = addr_cmd_complete; 3266 3267 bacpy(&reply.bdaddr, &cp->addr.bdaddr); 3268 reply.pin_len = cp->pin_len; 3269 memcpy(reply.pin_code, cp->pin_code, sizeof(reply.pin_code)); 3270 3271 err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_REPLY, sizeof(reply), &reply); 3272 if (err < 0) 3273 mgmt_pending_remove(cmd); 3274 3275 failed: 3276 hci_dev_unlock(hdev); 3277 return err; 3278 } 3279 3280 static int set_io_capability(struct sock *sk, struct hci_dev *hdev, void *data, 3281 u16 len) 3282 { 3283 struct mgmt_cp_set_io_capability *cp = data; 3284 3285 bt_dev_dbg(hdev, "sock %p", sk); 3286 3287 if (cp->io_capability > SMP_IO_KEYBOARD_DISPLAY) 3288 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_IO_CAPABILITY, 3289 MGMT_STATUS_INVALID_PARAMS); 3290 3291 hci_dev_lock(hdev); 3292 3293 hdev->io_capability = cp->io_capability; 3294 3295 bt_dev_dbg(hdev, "IO capability set to 0x%02x", hdev->io_capability); 3296 3297 hci_dev_unlock(hdev); 3298 3299 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_IO_CAPABILITY, 0, 3300 NULL, 0); 3301 } 3302 3303 static struct mgmt_pending_cmd *find_pairing(struct hci_conn *conn) 3304 { 3305 struct hci_dev *hdev = conn->hdev; 3306 struct mgmt_pending_cmd *cmd; 3307 3308 list_for_each_entry(cmd, &hdev->mgmt_pending, list) { 3309 if (cmd->opcode != MGMT_OP_PAIR_DEVICE) 3310 continue; 3311 3312 if (cmd->user_data != conn) 3313 continue; 3314 3315 return cmd; 3316 } 3317 3318 return NULL; 3319 } 3320 3321 static int pairing_complete(struct mgmt_pending_cmd *cmd, u8 status) 3322 { 3323 struct mgmt_rp_pair_device rp; 3324 struct hci_conn *conn = cmd->user_data; 3325 int err; 3326 3327 bacpy(&rp.addr.bdaddr, &conn->dst); 3328 rp.addr.type = link_to_bdaddr(conn->type, conn->dst_type); 3329 3330 err = mgmt_cmd_complete(cmd->sk, cmd->index, MGMT_OP_PAIR_DEVICE, 3331 status, &rp, sizeof(rp)); 3332 3333 /* So we don't get further callbacks for this connection */ 3334 conn->connect_cfm_cb = NULL; 3335 conn->security_cfm_cb = NULL; 3336 conn->disconn_cfm_cb = NULL; 3337 3338 hci_conn_drop(conn); 3339 3340 /* The device is paired so there is no need to remove 3341 * its connection parameters anymore. 3342 */ 3343 clear_bit(HCI_CONN_PARAM_REMOVAL_PEND, &conn->flags); 3344 3345 hci_conn_put(conn); 3346 3347 return err; 3348 } 3349 3350 void mgmt_smp_complete(struct hci_conn *conn, bool complete) 3351 { 3352 u8 status = complete ? MGMT_STATUS_SUCCESS : MGMT_STATUS_FAILED; 3353 struct mgmt_pending_cmd *cmd; 3354 3355 cmd = find_pairing(conn); 3356 if (cmd) { 3357 cmd->cmd_complete(cmd, status); 3358 mgmt_pending_remove(cmd); 3359 } 3360 } 3361 3362 static void pairing_complete_cb(struct hci_conn *conn, u8 status) 3363 { 3364 struct mgmt_pending_cmd *cmd; 3365 3366 BT_DBG("status %u", status); 3367 3368 cmd = find_pairing(conn); 3369 if (!cmd) { 3370 BT_DBG("Unable to find a pending command"); 3371 return; 3372 } 3373 3374 cmd->cmd_complete(cmd, mgmt_status(status)); 3375 mgmt_pending_remove(cmd); 3376 } 3377 3378 static void le_pairing_complete_cb(struct hci_conn *conn, u8 status) 3379 { 3380 struct mgmt_pending_cmd *cmd; 3381 3382 BT_DBG("status %u", status); 3383 3384 if (!status) 3385 return; 3386 3387 cmd = find_pairing(conn); 3388 if (!cmd) { 3389 BT_DBG("Unable to find a pending command"); 3390 return; 3391 } 3392 3393 cmd->cmd_complete(cmd, mgmt_status(status)); 3394 mgmt_pending_remove(cmd); 3395 } 3396 3397 static int pair_device(struct sock *sk, struct hci_dev *hdev, void *data, 3398 u16 len) 3399 { 3400 struct mgmt_cp_pair_device *cp = data; 3401 struct mgmt_rp_pair_device rp; 3402 struct mgmt_pending_cmd *cmd; 3403 u8 sec_level, auth_type; 3404 struct hci_conn *conn; 3405 int err; 3406 3407 bt_dev_dbg(hdev, "sock %p", sk); 3408 3409 memset(&rp, 0, sizeof(rp)); 3410 bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr); 3411 rp.addr.type = cp->addr.type; 3412 3413 if (!bdaddr_type_is_valid(cp->addr.type)) 3414 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE, 3415 MGMT_STATUS_INVALID_PARAMS, 3416 &rp, sizeof(rp)); 3417 3418 if (cp->io_cap > SMP_IO_KEYBOARD_DISPLAY) 3419 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE, 3420 MGMT_STATUS_INVALID_PARAMS, 3421 &rp, sizeof(rp)); 3422 3423 hci_dev_lock(hdev); 3424 3425 if (!hdev_is_powered(hdev)) { 3426 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE, 3427 MGMT_STATUS_NOT_POWERED, &rp, 3428 sizeof(rp)); 3429 goto unlock; 3430 } 3431 3432 if (hci_bdaddr_is_paired(hdev, &cp->addr.bdaddr, cp->addr.type)) { 3433 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE, 3434 MGMT_STATUS_ALREADY_PAIRED, &rp, 3435 sizeof(rp)); 3436 goto unlock; 3437 } 3438 3439 sec_level = BT_SECURITY_MEDIUM; 3440 auth_type = HCI_AT_DEDICATED_BONDING; 3441 3442 if (cp->addr.type == BDADDR_BREDR) { 3443 conn = hci_connect_acl(hdev, &cp->addr.bdaddr, sec_level, 3444 auth_type, CONN_REASON_PAIR_DEVICE, 3445 HCI_ACL_CONN_TIMEOUT); 3446 } else { 3447 u8 addr_type = le_addr_type(cp->addr.type); 3448 struct hci_conn_params *p; 3449 3450 /* When pairing a new device, it is expected to remember 3451 * this device for future connections. Adding the connection 3452 * parameter information ahead of time allows tracking 3453 * of the peripheral preferred values and will speed up any 3454 * further connection establishment. 3455 * 3456 * If connection parameters already exist, then they 3457 * will be kept and this function does nothing. 3458 */ 3459 p = hci_conn_params_add(hdev, &cp->addr.bdaddr, addr_type); 3460 3461 if (p->auto_connect == HCI_AUTO_CONN_EXPLICIT) 3462 p->auto_connect = HCI_AUTO_CONN_DISABLED; 3463 3464 conn = hci_connect_le_scan(hdev, &cp->addr.bdaddr, addr_type, 3465 sec_level, HCI_LE_CONN_TIMEOUT, 3466 CONN_REASON_PAIR_DEVICE); 3467 } 3468 3469 if (IS_ERR(conn)) { 3470 int status; 3471 3472 if (PTR_ERR(conn) == -EBUSY) 3473 status = MGMT_STATUS_BUSY; 3474 else if (PTR_ERR(conn) == -EOPNOTSUPP) 3475 status = MGMT_STATUS_NOT_SUPPORTED; 3476 else if (PTR_ERR(conn) == -ECONNREFUSED) 3477 status = MGMT_STATUS_REJECTED; 3478 else 3479 status = MGMT_STATUS_CONNECT_FAILED; 3480 3481 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE, 3482 status, &rp, sizeof(rp)); 3483 goto unlock; 3484 } 3485 3486 if (conn->connect_cfm_cb) { 3487 hci_conn_drop(conn); 3488 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE, 3489 MGMT_STATUS_BUSY, &rp, sizeof(rp)); 3490 goto unlock; 3491 } 3492 3493 cmd = mgmt_pending_add(sk, MGMT_OP_PAIR_DEVICE, hdev, data, len); 3494 if (!cmd) { 3495 err = -ENOMEM; 3496 hci_conn_drop(conn); 3497 goto unlock; 3498 } 3499 3500 cmd->cmd_complete = pairing_complete; 3501 3502 /* For LE, just connecting isn't a proof that the pairing finished */ 3503 if (cp->addr.type == BDADDR_BREDR) { 3504 conn->connect_cfm_cb = pairing_complete_cb; 3505 conn->security_cfm_cb = pairing_complete_cb; 3506 conn->disconn_cfm_cb = pairing_complete_cb; 3507 } else { 3508 conn->connect_cfm_cb = le_pairing_complete_cb; 3509 conn->security_cfm_cb = le_pairing_complete_cb; 3510 conn->disconn_cfm_cb = le_pairing_complete_cb; 3511 } 3512 3513 conn->io_capability = cp->io_cap; 3514 cmd->user_data = hci_conn_get(conn); 3515 3516 if ((conn->state == BT_CONNECTED || conn->state == BT_CONFIG) && 3517 hci_conn_security(conn, sec_level, auth_type, true)) { 3518 cmd->cmd_complete(cmd, 0); 3519 mgmt_pending_remove(cmd); 3520 } 3521 3522 err = 0; 3523 3524 unlock: 3525 hci_dev_unlock(hdev); 3526 return err; 3527 } 3528 3529 static int cancel_pair_device(struct sock *sk, struct hci_dev *hdev, void *data, 3530 u16 len) 3531 { 3532 struct mgmt_addr_info *addr = data; 3533 struct mgmt_pending_cmd *cmd; 3534 struct hci_conn *conn; 3535 int err; 3536 3537 bt_dev_dbg(hdev, "sock %p", sk); 3538 3539 hci_dev_lock(hdev); 3540 3541 if (!hdev_is_powered(hdev)) { 3542 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE, 3543 MGMT_STATUS_NOT_POWERED); 3544 goto unlock; 3545 } 3546 3547 cmd = pending_find(MGMT_OP_PAIR_DEVICE, hdev); 3548 if (!cmd) { 3549 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE, 3550 MGMT_STATUS_INVALID_PARAMS); 3551 goto unlock; 3552 } 3553 3554 conn = cmd->user_data; 3555 3556 if (bacmp(&addr->bdaddr, &conn->dst) != 0) { 3557 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE, 3558 MGMT_STATUS_INVALID_PARAMS); 3559 goto unlock; 3560 } 3561 3562 cmd->cmd_complete(cmd, MGMT_STATUS_CANCELLED); 3563 mgmt_pending_remove(cmd); 3564 3565 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE, 0, 3566 addr, sizeof(*addr)); 3567 3568 /* Since user doesn't want to proceed with the connection, abort any 3569 * ongoing pairing and then terminate the link if it was created 3570 * because of the pair device action. 3571 */ 3572 if (addr->type == BDADDR_BREDR) 3573 hci_remove_link_key(hdev, &addr->bdaddr); 3574 else 3575 smp_cancel_and_remove_pairing(hdev, &addr->bdaddr, 3576 le_addr_type(addr->type)); 3577 3578 if (conn->conn_reason == CONN_REASON_PAIR_DEVICE) 3579 hci_abort_conn(conn, HCI_ERROR_REMOTE_USER_TERM); 3580 3581 unlock: 3582 hci_dev_unlock(hdev); 3583 return err; 3584 } 3585 3586 static int user_pairing_resp(struct sock *sk, struct hci_dev *hdev, 3587 struct mgmt_addr_info *addr, u16 mgmt_op, 3588 u16 hci_op, __le32 passkey) 3589 { 3590 struct mgmt_pending_cmd *cmd; 3591 struct hci_conn *conn; 3592 int err; 3593 3594 hci_dev_lock(hdev); 3595 3596 if (!hdev_is_powered(hdev)) { 3597 err = mgmt_cmd_complete(sk, hdev->id, mgmt_op, 3598 MGMT_STATUS_NOT_POWERED, addr, 3599 sizeof(*addr)); 3600 goto done; 3601 } 3602 3603 if (addr->type == BDADDR_BREDR) 3604 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &addr->bdaddr); 3605 else 3606 conn = hci_conn_hash_lookup_le(hdev, &addr->bdaddr, 3607 le_addr_type(addr->type)); 3608 3609 if (!conn) { 3610 err = mgmt_cmd_complete(sk, hdev->id, mgmt_op, 3611 MGMT_STATUS_NOT_CONNECTED, addr, 3612 sizeof(*addr)); 3613 goto done; 3614 } 3615 3616 if (addr->type == BDADDR_LE_PUBLIC || addr->type == BDADDR_LE_RANDOM) { 3617 err = smp_user_confirm_reply(conn, mgmt_op, passkey); 3618 if (!err) 3619 err = mgmt_cmd_complete(sk, hdev->id, mgmt_op, 3620 MGMT_STATUS_SUCCESS, addr, 3621 sizeof(*addr)); 3622 else 3623 err = mgmt_cmd_complete(sk, hdev->id, mgmt_op, 3624 MGMT_STATUS_FAILED, addr, 3625 sizeof(*addr)); 3626 3627 goto done; 3628 } 3629 3630 cmd = mgmt_pending_add(sk, mgmt_op, hdev, addr, sizeof(*addr)); 3631 if (!cmd) { 3632 err = -ENOMEM; 3633 goto done; 3634 } 3635 3636 cmd->cmd_complete = addr_cmd_complete; 3637 3638 /* Continue with pairing via HCI */ 3639 if (hci_op == HCI_OP_USER_PASSKEY_REPLY) { 3640 struct hci_cp_user_passkey_reply cp; 3641 3642 bacpy(&cp.bdaddr, &addr->bdaddr); 3643 cp.passkey = passkey; 3644 err = hci_send_cmd(hdev, hci_op, sizeof(cp), &cp); 3645 } else 3646 err = hci_send_cmd(hdev, hci_op, sizeof(addr->bdaddr), 3647 &addr->bdaddr); 3648 3649 if (err < 0) 3650 mgmt_pending_remove(cmd); 3651 3652 done: 3653 hci_dev_unlock(hdev); 3654 return err; 3655 } 3656 3657 static int pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev, 3658 void *data, u16 len) 3659 { 3660 struct mgmt_cp_pin_code_neg_reply *cp = data; 3661 3662 bt_dev_dbg(hdev, "sock %p", sk); 3663 3664 return user_pairing_resp(sk, hdev, &cp->addr, 3665 MGMT_OP_PIN_CODE_NEG_REPLY, 3666 HCI_OP_PIN_CODE_NEG_REPLY, 0); 3667 } 3668 3669 static int user_confirm_reply(struct sock *sk, struct hci_dev *hdev, void *data, 3670 u16 len) 3671 { 3672 struct mgmt_cp_user_confirm_reply *cp = data; 3673 3674 bt_dev_dbg(hdev, "sock %p", sk); 3675 3676 if (len != sizeof(*cp)) 3677 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_USER_CONFIRM_REPLY, 3678 MGMT_STATUS_INVALID_PARAMS); 3679 3680 return user_pairing_resp(sk, hdev, &cp->addr, 3681 MGMT_OP_USER_CONFIRM_REPLY, 3682 HCI_OP_USER_CONFIRM_REPLY, 0); 3683 } 3684 3685 static int user_confirm_neg_reply(struct sock *sk, struct hci_dev *hdev, 3686 void *data, u16 len) 3687 { 3688 struct mgmt_cp_user_confirm_neg_reply *cp = data; 3689 3690 bt_dev_dbg(hdev, "sock %p", sk); 3691 3692 return user_pairing_resp(sk, hdev, &cp->addr, 3693 MGMT_OP_USER_CONFIRM_NEG_REPLY, 3694 HCI_OP_USER_CONFIRM_NEG_REPLY, 0); 3695 } 3696 3697 static int user_passkey_reply(struct sock *sk, struct hci_dev *hdev, void *data, 3698 u16 len) 3699 { 3700 struct mgmt_cp_user_passkey_reply *cp = data; 3701 3702 bt_dev_dbg(hdev, "sock %p", sk); 3703 3704 return user_pairing_resp(sk, hdev, &cp->addr, 3705 MGMT_OP_USER_PASSKEY_REPLY, 3706 HCI_OP_USER_PASSKEY_REPLY, cp->passkey); 3707 } 3708 3709 static int user_passkey_neg_reply(struct sock *sk, struct hci_dev *hdev, 3710 void *data, u16 len) 3711 { 3712 struct mgmt_cp_user_passkey_neg_reply *cp = data; 3713 3714 bt_dev_dbg(hdev, "sock %p", sk); 3715 3716 return user_pairing_resp(sk, hdev, &cp->addr, 3717 MGMT_OP_USER_PASSKEY_NEG_REPLY, 3718 HCI_OP_USER_PASSKEY_NEG_REPLY, 0); 3719 } 3720 3721 static int adv_expire_sync(struct hci_dev *hdev, u32 flags) 3722 { 3723 struct adv_info *adv_instance; 3724 3725 adv_instance = hci_find_adv_instance(hdev, hdev->cur_adv_instance); 3726 if (!adv_instance) 3727 return 0; 3728 3729 /* stop if current instance doesn't need to be changed */ 3730 if (!(adv_instance->flags & flags)) 3731 return 0; 3732 3733 cancel_adv_timeout(hdev); 3734 3735 adv_instance = hci_get_next_instance(hdev, adv_instance->instance); 3736 if (!adv_instance) 3737 return 0; 3738 3739 hci_schedule_adv_instance_sync(hdev, adv_instance->instance, true); 3740 3741 return 0; 3742 } 3743 3744 static int name_changed_sync(struct hci_dev *hdev, void *data) 3745 { 3746 return adv_expire_sync(hdev, MGMT_ADV_FLAG_LOCAL_NAME); 3747 } 3748 3749 static void set_name_complete(struct hci_dev *hdev, void *data, int err) 3750 { 3751 struct mgmt_pending_cmd *cmd = data; 3752 struct mgmt_cp_set_local_name *cp = cmd->param; 3753 u8 status = mgmt_status(err); 3754 3755 bt_dev_dbg(hdev, "err %d", err); 3756 3757 if (cmd != pending_find(MGMT_OP_SET_LOCAL_NAME, hdev)) 3758 return; 3759 3760 if (status) { 3761 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 3762 status); 3763 } else { 3764 mgmt_cmd_complete(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0, 3765 cp, sizeof(*cp)); 3766 3767 if (hci_dev_test_flag(hdev, HCI_LE_ADV)) 3768 hci_cmd_sync_queue(hdev, name_changed_sync, NULL, NULL); 3769 } 3770 3771 mgmt_pending_remove(cmd); 3772 } 3773 3774 static int set_name_sync(struct hci_dev *hdev, void *data) 3775 { 3776 if (lmp_bredr_capable(hdev)) { 3777 hci_update_name_sync(hdev); 3778 hci_update_eir_sync(hdev); 3779 } 3780 3781 /* The name is stored in the scan response data and so 3782 * no need to update the advertising data here. 3783 */ 3784 if (lmp_le_capable(hdev) && hci_dev_test_flag(hdev, HCI_ADVERTISING)) 3785 hci_update_scan_rsp_data_sync(hdev, hdev->cur_adv_instance); 3786 3787 return 0; 3788 } 3789 3790 static int set_local_name(struct sock *sk, struct hci_dev *hdev, void *data, 3791 u16 len) 3792 { 3793 struct mgmt_cp_set_local_name *cp = data; 3794 struct mgmt_pending_cmd *cmd; 3795 int err; 3796 3797 bt_dev_dbg(hdev, "sock %p", sk); 3798 3799 hci_dev_lock(hdev); 3800 3801 /* If the old values are the same as the new ones just return a 3802 * direct command complete event. 3803 */ 3804 if (!memcmp(hdev->dev_name, cp->name, sizeof(hdev->dev_name)) && 3805 !memcmp(hdev->short_name, cp->short_name, 3806 sizeof(hdev->short_name))) { 3807 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0, 3808 data, len); 3809 goto failed; 3810 } 3811 3812 memcpy(hdev->short_name, cp->short_name, sizeof(hdev->short_name)); 3813 3814 if (!hdev_is_powered(hdev)) { 3815 memcpy(hdev->dev_name, cp->name, sizeof(hdev->dev_name)); 3816 3817 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0, 3818 data, len); 3819 if (err < 0) 3820 goto failed; 3821 3822 err = mgmt_limited_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, data, 3823 len, HCI_MGMT_LOCAL_NAME_EVENTS, sk); 3824 ext_info_changed(hdev, sk); 3825 3826 goto failed; 3827 } 3828 3829 cmd = mgmt_pending_add(sk, MGMT_OP_SET_LOCAL_NAME, hdev, data, len); 3830 if (!cmd) 3831 err = -ENOMEM; 3832 else 3833 err = hci_cmd_sync_queue(hdev, set_name_sync, cmd, 3834 set_name_complete); 3835 3836 if (err < 0) { 3837 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 3838 MGMT_STATUS_FAILED); 3839 3840 if (cmd) 3841 mgmt_pending_remove(cmd); 3842 3843 goto failed; 3844 } 3845 3846 memcpy(hdev->dev_name, cp->name, sizeof(hdev->dev_name)); 3847 3848 failed: 3849 hci_dev_unlock(hdev); 3850 return err; 3851 } 3852 3853 static int appearance_changed_sync(struct hci_dev *hdev, void *data) 3854 { 3855 return adv_expire_sync(hdev, MGMT_ADV_FLAG_APPEARANCE); 3856 } 3857 3858 static int set_appearance(struct sock *sk, struct hci_dev *hdev, void *data, 3859 u16 len) 3860 { 3861 struct mgmt_cp_set_appearance *cp = data; 3862 u16 appearance; 3863 int err; 3864 3865 bt_dev_dbg(hdev, "sock %p", sk); 3866 3867 if (!lmp_le_capable(hdev)) 3868 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_APPEARANCE, 3869 MGMT_STATUS_NOT_SUPPORTED); 3870 3871 appearance = le16_to_cpu(cp->appearance); 3872 3873 hci_dev_lock(hdev); 3874 3875 if (hdev->appearance != appearance) { 3876 hdev->appearance = appearance; 3877 3878 if (hci_dev_test_flag(hdev, HCI_LE_ADV)) 3879 hci_cmd_sync_queue(hdev, appearance_changed_sync, NULL, 3880 NULL); 3881 3882 ext_info_changed(hdev, sk); 3883 } 3884 3885 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_APPEARANCE, 0, NULL, 3886 0); 3887 3888 hci_dev_unlock(hdev); 3889 3890 return err; 3891 } 3892 3893 static int get_phy_configuration(struct sock *sk, struct hci_dev *hdev, 3894 void *data, u16 len) 3895 { 3896 struct mgmt_rp_get_phy_configuration rp; 3897 3898 bt_dev_dbg(hdev, "sock %p", sk); 3899 3900 hci_dev_lock(hdev); 3901 3902 memset(&rp, 0, sizeof(rp)); 3903 3904 rp.supported_phys = cpu_to_le32(get_supported_phys(hdev)); 3905 rp.selected_phys = cpu_to_le32(get_selected_phys(hdev)); 3906 rp.configurable_phys = cpu_to_le32(get_configurable_phys(hdev)); 3907 3908 hci_dev_unlock(hdev); 3909 3910 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_PHY_CONFIGURATION, 0, 3911 &rp, sizeof(rp)); 3912 } 3913 3914 int mgmt_phy_configuration_changed(struct hci_dev *hdev, struct sock *skip) 3915 { 3916 struct mgmt_ev_phy_configuration_changed ev; 3917 3918 memset(&ev, 0, sizeof(ev)); 3919 3920 ev.selected_phys = cpu_to_le32(get_selected_phys(hdev)); 3921 3922 return mgmt_event(MGMT_EV_PHY_CONFIGURATION_CHANGED, hdev, &ev, 3923 sizeof(ev), skip); 3924 } 3925 3926 static void set_default_phy_complete(struct hci_dev *hdev, void *data, int err) 3927 { 3928 struct mgmt_pending_cmd *cmd = data; 3929 struct sk_buff *skb = cmd->skb; 3930 u8 status = mgmt_status(err); 3931 3932 if (cmd != pending_find(MGMT_OP_SET_PHY_CONFIGURATION, hdev)) 3933 return; 3934 3935 if (!status) { 3936 if (!skb) 3937 status = MGMT_STATUS_FAILED; 3938 else if (IS_ERR(skb)) 3939 status = mgmt_status(PTR_ERR(skb)); 3940 else 3941 status = mgmt_status(skb->data[0]); 3942 } 3943 3944 bt_dev_dbg(hdev, "status %d", status); 3945 3946 if (status) { 3947 mgmt_cmd_status(cmd->sk, hdev->id, 3948 MGMT_OP_SET_PHY_CONFIGURATION, status); 3949 } else { 3950 mgmt_cmd_complete(cmd->sk, hdev->id, 3951 MGMT_OP_SET_PHY_CONFIGURATION, 0, 3952 NULL, 0); 3953 3954 mgmt_phy_configuration_changed(hdev, cmd->sk); 3955 } 3956 3957 if (skb && !IS_ERR(skb)) 3958 kfree_skb(skb); 3959 3960 mgmt_pending_remove(cmd); 3961 } 3962 3963 static int set_default_phy_sync(struct hci_dev *hdev, void *data) 3964 { 3965 struct mgmt_pending_cmd *cmd = data; 3966 struct mgmt_cp_set_phy_configuration *cp = cmd->param; 3967 struct hci_cp_le_set_default_phy cp_phy; 3968 u32 selected_phys = __le32_to_cpu(cp->selected_phys); 3969 3970 memset(&cp_phy, 0, sizeof(cp_phy)); 3971 3972 if (!(selected_phys & MGMT_PHY_LE_TX_MASK)) 3973 cp_phy.all_phys |= 0x01; 3974 3975 if (!(selected_phys & MGMT_PHY_LE_RX_MASK)) 3976 cp_phy.all_phys |= 0x02; 3977 3978 if (selected_phys & MGMT_PHY_LE_1M_TX) 3979 cp_phy.tx_phys |= HCI_LE_SET_PHY_1M; 3980 3981 if (selected_phys & MGMT_PHY_LE_2M_TX) 3982 cp_phy.tx_phys |= HCI_LE_SET_PHY_2M; 3983 3984 if (selected_phys & MGMT_PHY_LE_CODED_TX) 3985 cp_phy.tx_phys |= HCI_LE_SET_PHY_CODED; 3986 3987 if (selected_phys & MGMT_PHY_LE_1M_RX) 3988 cp_phy.rx_phys |= HCI_LE_SET_PHY_1M; 3989 3990 if (selected_phys & MGMT_PHY_LE_2M_RX) 3991 cp_phy.rx_phys |= HCI_LE_SET_PHY_2M; 3992 3993 if (selected_phys & MGMT_PHY_LE_CODED_RX) 3994 cp_phy.rx_phys |= HCI_LE_SET_PHY_CODED; 3995 3996 cmd->skb = __hci_cmd_sync(hdev, HCI_OP_LE_SET_DEFAULT_PHY, 3997 sizeof(cp_phy), &cp_phy, HCI_CMD_TIMEOUT); 3998 3999 return 0; 4000 } 4001 4002 static int set_phy_configuration(struct sock *sk, struct hci_dev *hdev, 4003 void *data, u16 len) 4004 { 4005 struct mgmt_cp_set_phy_configuration *cp = data; 4006 struct mgmt_pending_cmd *cmd; 4007 u32 selected_phys, configurable_phys, supported_phys, unconfigure_phys; 4008 u16 pkt_type = (HCI_DH1 | HCI_DM1); 4009 bool changed = false; 4010 int err; 4011 4012 bt_dev_dbg(hdev, "sock %p", sk); 4013 4014 configurable_phys = get_configurable_phys(hdev); 4015 supported_phys = get_supported_phys(hdev); 4016 selected_phys = __le32_to_cpu(cp->selected_phys); 4017 4018 if (selected_phys & ~supported_phys) 4019 return mgmt_cmd_status(sk, hdev->id, 4020 MGMT_OP_SET_PHY_CONFIGURATION, 4021 MGMT_STATUS_INVALID_PARAMS); 4022 4023 unconfigure_phys = supported_phys & ~configurable_phys; 4024 4025 if ((selected_phys & unconfigure_phys) != unconfigure_phys) 4026 return mgmt_cmd_status(sk, hdev->id, 4027 MGMT_OP_SET_PHY_CONFIGURATION, 4028 MGMT_STATUS_INVALID_PARAMS); 4029 4030 if (selected_phys == get_selected_phys(hdev)) 4031 return mgmt_cmd_complete(sk, hdev->id, 4032 MGMT_OP_SET_PHY_CONFIGURATION, 4033 0, NULL, 0); 4034 4035 hci_dev_lock(hdev); 4036 4037 if (!hdev_is_powered(hdev)) { 4038 err = mgmt_cmd_status(sk, hdev->id, 4039 MGMT_OP_SET_PHY_CONFIGURATION, 4040 MGMT_STATUS_REJECTED); 4041 goto unlock; 4042 } 4043 4044 if (pending_find(MGMT_OP_SET_PHY_CONFIGURATION, hdev)) { 4045 err = mgmt_cmd_status(sk, hdev->id, 4046 MGMT_OP_SET_PHY_CONFIGURATION, 4047 MGMT_STATUS_BUSY); 4048 goto unlock; 4049 } 4050 4051 if (selected_phys & MGMT_PHY_BR_1M_3SLOT) 4052 pkt_type |= (HCI_DH3 | HCI_DM3); 4053 else 4054 pkt_type &= ~(HCI_DH3 | HCI_DM3); 4055 4056 if (selected_phys & MGMT_PHY_BR_1M_5SLOT) 4057 pkt_type |= (HCI_DH5 | HCI_DM5); 4058 else 4059 pkt_type &= ~(HCI_DH5 | HCI_DM5); 4060 4061 if (selected_phys & MGMT_PHY_EDR_2M_1SLOT) 4062 pkt_type &= ~HCI_2DH1; 4063 else 4064 pkt_type |= HCI_2DH1; 4065 4066 if (selected_phys & MGMT_PHY_EDR_2M_3SLOT) 4067 pkt_type &= ~HCI_2DH3; 4068 else 4069 pkt_type |= HCI_2DH3; 4070 4071 if (selected_phys & MGMT_PHY_EDR_2M_5SLOT) 4072 pkt_type &= ~HCI_2DH5; 4073 else 4074 pkt_type |= HCI_2DH5; 4075 4076 if (selected_phys & MGMT_PHY_EDR_3M_1SLOT) 4077 pkt_type &= ~HCI_3DH1; 4078 else 4079 pkt_type |= HCI_3DH1; 4080 4081 if (selected_phys & MGMT_PHY_EDR_3M_3SLOT) 4082 pkt_type &= ~HCI_3DH3; 4083 else 4084 pkt_type |= HCI_3DH3; 4085 4086 if (selected_phys & MGMT_PHY_EDR_3M_5SLOT) 4087 pkt_type &= ~HCI_3DH5; 4088 else 4089 pkt_type |= HCI_3DH5; 4090 4091 if (pkt_type != hdev->pkt_type) { 4092 hdev->pkt_type = pkt_type; 4093 changed = true; 4094 } 4095 4096 if ((selected_phys & MGMT_PHY_LE_MASK) == 4097 (get_selected_phys(hdev) & MGMT_PHY_LE_MASK)) { 4098 if (changed) 4099 mgmt_phy_configuration_changed(hdev, sk); 4100 4101 err = mgmt_cmd_complete(sk, hdev->id, 4102 MGMT_OP_SET_PHY_CONFIGURATION, 4103 0, NULL, 0); 4104 4105 goto unlock; 4106 } 4107 4108 cmd = mgmt_pending_add(sk, MGMT_OP_SET_PHY_CONFIGURATION, hdev, data, 4109 len); 4110 if (!cmd) 4111 err = -ENOMEM; 4112 else 4113 err = hci_cmd_sync_queue(hdev, set_default_phy_sync, cmd, 4114 set_default_phy_complete); 4115 4116 if (err < 0) { 4117 err = mgmt_cmd_status(sk, hdev->id, 4118 MGMT_OP_SET_PHY_CONFIGURATION, 4119 MGMT_STATUS_FAILED); 4120 4121 if (cmd) 4122 mgmt_pending_remove(cmd); 4123 } 4124 4125 unlock: 4126 hci_dev_unlock(hdev); 4127 4128 return err; 4129 } 4130 4131 static int set_blocked_keys(struct sock *sk, struct hci_dev *hdev, void *data, 4132 u16 len) 4133 { 4134 int err = MGMT_STATUS_SUCCESS; 4135 struct mgmt_cp_set_blocked_keys *keys = data; 4136 const u16 max_key_count = ((U16_MAX - sizeof(*keys)) / 4137 sizeof(struct mgmt_blocked_key_info)); 4138 u16 key_count, expected_len; 4139 int i; 4140 4141 bt_dev_dbg(hdev, "sock %p", sk); 4142 4143 key_count = __le16_to_cpu(keys->key_count); 4144 if (key_count > max_key_count) { 4145 bt_dev_err(hdev, "too big key_count value %u", key_count); 4146 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BLOCKED_KEYS, 4147 MGMT_STATUS_INVALID_PARAMS); 4148 } 4149 4150 expected_len = struct_size(keys, keys, key_count); 4151 if (expected_len != len) { 4152 bt_dev_err(hdev, "expected %u bytes, got %u bytes", 4153 expected_len, len); 4154 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BLOCKED_KEYS, 4155 MGMT_STATUS_INVALID_PARAMS); 4156 } 4157 4158 hci_dev_lock(hdev); 4159 4160 hci_blocked_keys_clear(hdev); 4161 4162 for (i = 0; i < key_count; ++i) { 4163 struct blocked_key *b = kzalloc(sizeof(*b), GFP_KERNEL); 4164 4165 if (!b) { 4166 err = MGMT_STATUS_NO_RESOURCES; 4167 break; 4168 } 4169 4170 b->type = keys->keys[i].type; 4171 memcpy(b->val, keys->keys[i].val, sizeof(b->val)); 4172 list_add_rcu(&b->list, &hdev->blocked_keys); 4173 } 4174 hci_dev_unlock(hdev); 4175 4176 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_BLOCKED_KEYS, 4177 err, NULL, 0); 4178 } 4179 4180 static int set_wideband_speech(struct sock *sk, struct hci_dev *hdev, 4181 void *data, u16 len) 4182 { 4183 struct mgmt_mode *cp = data; 4184 int err; 4185 bool changed = false; 4186 4187 bt_dev_dbg(hdev, "sock %p", sk); 4188 4189 if (!test_bit(HCI_QUIRK_WIDEBAND_SPEECH_SUPPORTED, &hdev->quirks)) 4190 return mgmt_cmd_status(sk, hdev->id, 4191 MGMT_OP_SET_WIDEBAND_SPEECH, 4192 MGMT_STATUS_NOT_SUPPORTED); 4193 4194 if (cp->val != 0x00 && cp->val != 0x01) 4195 return mgmt_cmd_status(sk, hdev->id, 4196 MGMT_OP_SET_WIDEBAND_SPEECH, 4197 MGMT_STATUS_INVALID_PARAMS); 4198 4199 hci_dev_lock(hdev); 4200 4201 if (hdev_is_powered(hdev) && 4202 !!cp->val != hci_dev_test_flag(hdev, 4203 HCI_WIDEBAND_SPEECH_ENABLED)) { 4204 err = mgmt_cmd_status(sk, hdev->id, 4205 MGMT_OP_SET_WIDEBAND_SPEECH, 4206 MGMT_STATUS_REJECTED); 4207 goto unlock; 4208 } 4209 4210 if (cp->val) 4211 changed = !hci_dev_test_and_set_flag(hdev, 4212 HCI_WIDEBAND_SPEECH_ENABLED); 4213 else 4214 changed = hci_dev_test_and_clear_flag(hdev, 4215 HCI_WIDEBAND_SPEECH_ENABLED); 4216 4217 err = send_settings_rsp(sk, MGMT_OP_SET_WIDEBAND_SPEECH, hdev); 4218 if (err < 0) 4219 goto unlock; 4220 4221 if (changed) 4222 err = new_settings(hdev, sk); 4223 4224 unlock: 4225 hci_dev_unlock(hdev); 4226 return err; 4227 } 4228 4229 static int read_controller_cap(struct sock *sk, struct hci_dev *hdev, 4230 void *data, u16 data_len) 4231 { 4232 char buf[20]; 4233 struct mgmt_rp_read_controller_cap *rp = (void *)buf; 4234 u16 cap_len = 0; 4235 u8 flags = 0; 4236 u8 tx_power_range[2]; 4237 4238 bt_dev_dbg(hdev, "sock %p", sk); 4239 4240 memset(&buf, 0, sizeof(buf)); 4241 4242 hci_dev_lock(hdev); 4243 4244 /* When the Read Simple Pairing Options command is supported, then 4245 * the remote public key validation is supported. 4246 * 4247 * Alternatively, when Microsoft extensions are available, they can 4248 * indicate support for public key validation as well. 4249 */ 4250 if ((hdev->commands[41] & 0x08) || msft_curve_validity(hdev)) 4251 flags |= 0x01; /* Remote public key validation (BR/EDR) */ 4252 4253 flags |= 0x02; /* Remote public key validation (LE) */ 4254 4255 /* When the Read Encryption Key Size command is supported, then the 4256 * encryption key size is enforced. 4257 */ 4258 if (hdev->commands[20] & 0x10) 4259 flags |= 0x04; /* Encryption key size enforcement (BR/EDR) */ 4260 4261 flags |= 0x08; /* Encryption key size enforcement (LE) */ 4262 4263 cap_len = eir_append_data(rp->cap, cap_len, MGMT_CAP_SEC_FLAGS, 4264 &flags, 1); 4265 4266 /* When the Read Simple Pairing Options command is supported, then 4267 * also max encryption key size information is provided. 4268 */ 4269 if (hdev->commands[41] & 0x08) 4270 cap_len = eir_append_le16(rp->cap, cap_len, 4271 MGMT_CAP_MAX_ENC_KEY_SIZE, 4272 hdev->max_enc_key_size); 4273 4274 cap_len = eir_append_le16(rp->cap, cap_len, 4275 MGMT_CAP_SMP_MAX_ENC_KEY_SIZE, 4276 SMP_MAX_ENC_KEY_SIZE); 4277 4278 /* Append the min/max LE tx power parameters if we were able to fetch 4279 * it from the controller 4280 */ 4281 if (hdev->commands[38] & 0x80) { 4282 memcpy(&tx_power_range[0], &hdev->min_le_tx_power, 1); 4283 memcpy(&tx_power_range[1], &hdev->max_le_tx_power, 1); 4284 cap_len = eir_append_data(rp->cap, cap_len, MGMT_CAP_LE_TX_PWR, 4285 tx_power_range, 2); 4286 } 4287 4288 rp->cap_len = cpu_to_le16(cap_len); 4289 4290 hci_dev_unlock(hdev); 4291 4292 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_CONTROLLER_CAP, 0, 4293 rp, sizeof(*rp) + cap_len); 4294 } 4295 4296 #ifdef CONFIG_BT_FEATURE_DEBUG 4297 /* d4992530-b9ec-469f-ab01-6c481c47da1c */ 4298 static const u8 debug_uuid[16] = { 4299 0x1c, 0xda, 0x47, 0x1c, 0x48, 0x6c, 0x01, 0xab, 4300 0x9f, 0x46, 0xec, 0xb9, 0x30, 0x25, 0x99, 0xd4, 4301 }; 4302 #endif 4303 4304 /* 330859bc-7506-492d-9370-9a6f0614037f */ 4305 static const u8 quality_report_uuid[16] = { 4306 0x7f, 0x03, 0x14, 0x06, 0x6f, 0x9a, 0x70, 0x93, 4307 0x2d, 0x49, 0x06, 0x75, 0xbc, 0x59, 0x08, 0x33, 4308 }; 4309 4310 /* a6695ace-ee7f-4fb9-881a-5fac66c629af */ 4311 static const u8 offload_codecs_uuid[16] = { 4312 0xaf, 0x29, 0xc6, 0x66, 0xac, 0x5f, 0x1a, 0x88, 4313 0xb9, 0x4f, 0x7f, 0xee, 0xce, 0x5a, 0x69, 0xa6, 4314 }; 4315 4316 /* 671b10b5-42c0-4696-9227-eb28d1b049d6 */ 4317 static const u8 le_simultaneous_roles_uuid[16] = { 4318 0xd6, 0x49, 0xb0, 0xd1, 0x28, 0xeb, 0x27, 0x92, 4319 0x96, 0x46, 0xc0, 0x42, 0xb5, 0x10, 0x1b, 0x67, 4320 }; 4321 4322 /* 15c0a148-c273-11ea-b3de-0242ac130004 */ 4323 static const u8 rpa_resolution_uuid[16] = { 4324 0x04, 0x00, 0x13, 0xac, 0x42, 0x02, 0xde, 0xb3, 4325 0xea, 0x11, 0x73, 0xc2, 0x48, 0xa1, 0xc0, 0x15, 4326 }; 4327 4328 /* 6fbaf188-05e0-496a-9885-d6ddfdb4e03e */ 4329 static const u8 iso_socket_uuid[16] = { 4330 0x3e, 0xe0, 0xb4, 0xfd, 0xdd, 0xd6, 0x85, 0x98, 4331 0x6a, 0x49, 0xe0, 0x05, 0x88, 0xf1, 0xba, 0x6f, 4332 }; 4333 4334 /* 2ce463d7-7a03-4d8d-bf05-5f24e8f36e76 */ 4335 static const u8 mgmt_mesh_uuid[16] = { 4336 0x76, 0x6e, 0xf3, 0xe8, 0x24, 0x5f, 0x05, 0xbf, 4337 0x8d, 0x4d, 0x03, 0x7a, 0xd7, 0x63, 0xe4, 0x2c, 4338 }; 4339 4340 static int read_exp_features_info(struct sock *sk, struct hci_dev *hdev, 4341 void *data, u16 data_len) 4342 { 4343 struct mgmt_rp_read_exp_features_info *rp; 4344 size_t len; 4345 u16 idx = 0; 4346 u32 flags; 4347 int status; 4348 4349 bt_dev_dbg(hdev, "sock %p", sk); 4350 4351 /* Enough space for 7 features */ 4352 len = sizeof(*rp) + (sizeof(rp->features[0]) * 7); 4353 rp = kzalloc(len, GFP_KERNEL); 4354 if (!rp) 4355 return -ENOMEM; 4356 4357 #ifdef CONFIG_BT_FEATURE_DEBUG 4358 if (!hdev) { 4359 flags = bt_dbg_get() ? BIT(0) : 0; 4360 4361 memcpy(rp->features[idx].uuid, debug_uuid, 16); 4362 rp->features[idx].flags = cpu_to_le32(flags); 4363 idx++; 4364 } 4365 #endif 4366 4367 if (hdev && hci_dev_le_state_simultaneous(hdev)) { 4368 if (hci_dev_test_flag(hdev, HCI_LE_SIMULTANEOUS_ROLES)) 4369 flags = BIT(0); 4370 else 4371 flags = 0; 4372 4373 memcpy(rp->features[idx].uuid, le_simultaneous_roles_uuid, 16); 4374 rp->features[idx].flags = cpu_to_le32(flags); 4375 idx++; 4376 } 4377 4378 if (hdev && ll_privacy_capable(hdev)) { 4379 if (hci_dev_test_flag(hdev, HCI_ENABLE_LL_PRIVACY)) 4380 flags = BIT(0) | BIT(1); 4381 else 4382 flags = BIT(1); 4383 4384 memcpy(rp->features[idx].uuid, rpa_resolution_uuid, 16); 4385 rp->features[idx].flags = cpu_to_le32(flags); 4386 idx++; 4387 } 4388 4389 if (hdev && (aosp_has_quality_report(hdev) || 4390 hdev->set_quality_report)) { 4391 if (hci_dev_test_flag(hdev, HCI_QUALITY_REPORT)) 4392 flags = BIT(0); 4393 else 4394 flags = 0; 4395 4396 memcpy(rp->features[idx].uuid, quality_report_uuid, 16); 4397 rp->features[idx].flags = cpu_to_le32(flags); 4398 idx++; 4399 } 4400 4401 if (hdev && hdev->get_data_path_id) { 4402 if (hci_dev_test_flag(hdev, HCI_OFFLOAD_CODECS_ENABLED)) 4403 flags = BIT(0); 4404 else 4405 flags = 0; 4406 4407 memcpy(rp->features[idx].uuid, offload_codecs_uuid, 16); 4408 rp->features[idx].flags = cpu_to_le32(flags); 4409 idx++; 4410 } 4411 4412 if (IS_ENABLED(CONFIG_BT_LE)) { 4413 flags = iso_enabled() ? BIT(0) : 0; 4414 memcpy(rp->features[idx].uuid, iso_socket_uuid, 16); 4415 rp->features[idx].flags = cpu_to_le32(flags); 4416 idx++; 4417 } 4418 4419 if (hdev && lmp_le_capable(hdev)) { 4420 if (hci_dev_test_flag(hdev, HCI_MESH_EXPERIMENTAL)) 4421 flags = BIT(0); 4422 else 4423 flags = 0; 4424 4425 memcpy(rp->features[idx].uuid, mgmt_mesh_uuid, 16); 4426 rp->features[idx].flags = cpu_to_le32(flags); 4427 idx++; 4428 } 4429 4430 rp->feature_count = cpu_to_le16(idx); 4431 4432 /* After reading the experimental features information, enable 4433 * the events to update client on any future change. 4434 */ 4435 hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS); 4436 4437 status = mgmt_cmd_complete(sk, hdev ? hdev->id : MGMT_INDEX_NONE, 4438 MGMT_OP_READ_EXP_FEATURES_INFO, 4439 0, rp, sizeof(*rp) + (20 * idx)); 4440 4441 kfree(rp); 4442 return status; 4443 } 4444 4445 static int exp_ll_privacy_feature_changed(bool enabled, struct hci_dev *hdev, 4446 struct sock *skip) 4447 { 4448 struct mgmt_ev_exp_feature_changed ev; 4449 4450 memset(&ev, 0, sizeof(ev)); 4451 memcpy(ev.uuid, rpa_resolution_uuid, 16); 4452 ev.flags = cpu_to_le32((enabled ? BIT(0) : 0) | BIT(1)); 4453 4454 // Do we need to be atomic with the conn_flags? 4455 if (enabled && privacy_mode_capable(hdev)) 4456 hdev->conn_flags |= HCI_CONN_FLAG_DEVICE_PRIVACY; 4457 else 4458 hdev->conn_flags &= ~HCI_CONN_FLAG_DEVICE_PRIVACY; 4459 4460 return mgmt_limited_event(MGMT_EV_EXP_FEATURE_CHANGED, hdev, 4461 &ev, sizeof(ev), 4462 HCI_MGMT_EXP_FEATURE_EVENTS, skip); 4463 4464 } 4465 4466 static int exp_feature_changed(struct hci_dev *hdev, const u8 *uuid, 4467 bool enabled, struct sock *skip) 4468 { 4469 struct mgmt_ev_exp_feature_changed ev; 4470 4471 memset(&ev, 0, sizeof(ev)); 4472 memcpy(ev.uuid, uuid, 16); 4473 ev.flags = cpu_to_le32(enabled ? BIT(0) : 0); 4474 4475 return mgmt_limited_event(MGMT_EV_EXP_FEATURE_CHANGED, hdev, 4476 &ev, sizeof(ev), 4477 HCI_MGMT_EXP_FEATURE_EVENTS, skip); 4478 } 4479 4480 #define EXP_FEAT(_uuid, _set_func) \ 4481 { \ 4482 .uuid = _uuid, \ 4483 .set_func = _set_func, \ 4484 } 4485 4486 /* The zero key uuid is special. Multiple exp features are set through it. */ 4487 static int set_zero_key_func(struct sock *sk, struct hci_dev *hdev, 4488 struct mgmt_cp_set_exp_feature *cp, u16 data_len) 4489 { 4490 struct mgmt_rp_set_exp_feature rp; 4491 4492 memset(rp.uuid, 0, 16); 4493 rp.flags = cpu_to_le32(0); 4494 4495 #ifdef CONFIG_BT_FEATURE_DEBUG 4496 if (!hdev) { 4497 bool changed = bt_dbg_get(); 4498 4499 bt_dbg_set(false); 4500 4501 if (changed) 4502 exp_feature_changed(NULL, ZERO_KEY, false, sk); 4503 } 4504 #endif 4505 4506 if (hdev && use_ll_privacy(hdev) && !hdev_is_powered(hdev)) { 4507 bool changed; 4508 4509 changed = hci_dev_test_and_clear_flag(hdev, 4510 HCI_ENABLE_LL_PRIVACY); 4511 if (changed) 4512 exp_feature_changed(hdev, rpa_resolution_uuid, false, 4513 sk); 4514 } 4515 4516 hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS); 4517 4518 return mgmt_cmd_complete(sk, hdev ? hdev->id : MGMT_INDEX_NONE, 4519 MGMT_OP_SET_EXP_FEATURE, 0, 4520 &rp, sizeof(rp)); 4521 } 4522 4523 #ifdef CONFIG_BT_FEATURE_DEBUG 4524 static int set_debug_func(struct sock *sk, struct hci_dev *hdev, 4525 struct mgmt_cp_set_exp_feature *cp, u16 data_len) 4526 { 4527 struct mgmt_rp_set_exp_feature rp; 4528 4529 bool val, changed; 4530 int err; 4531 4532 /* Command requires to use the non-controller index */ 4533 if (hdev) 4534 return mgmt_cmd_status(sk, hdev->id, 4535 MGMT_OP_SET_EXP_FEATURE, 4536 MGMT_STATUS_INVALID_INDEX); 4537 4538 /* Parameters are limited to a single octet */ 4539 if (data_len != MGMT_SET_EXP_FEATURE_SIZE + 1) 4540 return mgmt_cmd_status(sk, MGMT_INDEX_NONE, 4541 MGMT_OP_SET_EXP_FEATURE, 4542 MGMT_STATUS_INVALID_PARAMS); 4543 4544 /* Only boolean on/off is supported */ 4545 if (cp->param[0] != 0x00 && cp->param[0] != 0x01) 4546 return mgmt_cmd_status(sk, MGMT_INDEX_NONE, 4547 MGMT_OP_SET_EXP_FEATURE, 4548 MGMT_STATUS_INVALID_PARAMS); 4549 4550 val = !!cp->param[0]; 4551 changed = val ? !bt_dbg_get() : bt_dbg_get(); 4552 bt_dbg_set(val); 4553 4554 memcpy(rp.uuid, debug_uuid, 16); 4555 rp.flags = cpu_to_le32(val ? BIT(0) : 0); 4556 4557 hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS); 4558 4559 err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE, 4560 MGMT_OP_SET_EXP_FEATURE, 0, 4561 &rp, sizeof(rp)); 4562 4563 if (changed) 4564 exp_feature_changed(hdev, debug_uuid, val, sk); 4565 4566 return err; 4567 } 4568 #endif 4569 4570 static int set_mgmt_mesh_func(struct sock *sk, struct hci_dev *hdev, 4571 struct mgmt_cp_set_exp_feature *cp, u16 data_len) 4572 { 4573 struct mgmt_rp_set_exp_feature rp; 4574 bool val, changed; 4575 int err; 4576 4577 /* Command requires to use the controller index */ 4578 if (!hdev) 4579 return mgmt_cmd_status(sk, MGMT_INDEX_NONE, 4580 MGMT_OP_SET_EXP_FEATURE, 4581 MGMT_STATUS_INVALID_INDEX); 4582 4583 /* Parameters are limited to a single octet */ 4584 if (data_len != MGMT_SET_EXP_FEATURE_SIZE + 1) 4585 return mgmt_cmd_status(sk, hdev->id, 4586 MGMT_OP_SET_EXP_FEATURE, 4587 MGMT_STATUS_INVALID_PARAMS); 4588 4589 /* Only boolean on/off is supported */ 4590 if (cp->param[0] != 0x00 && cp->param[0] != 0x01) 4591 return mgmt_cmd_status(sk, hdev->id, 4592 MGMT_OP_SET_EXP_FEATURE, 4593 MGMT_STATUS_INVALID_PARAMS); 4594 4595 val = !!cp->param[0]; 4596 4597 if (val) { 4598 changed = !hci_dev_test_and_set_flag(hdev, 4599 HCI_MESH_EXPERIMENTAL); 4600 } else { 4601 hci_dev_clear_flag(hdev, HCI_MESH); 4602 changed = hci_dev_test_and_clear_flag(hdev, 4603 HCI_MESH_EXPERIMENTAL); 4604 } 4605 4606 memcpy(rp.uuid, mgmt_mesh_uuid, 16); 4607 rp.flags = cpu_to_le32(val ? BIT(0) : 0); 4608 4609 hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS); 4610 4611 err = mgmt_cmd_complete(sk, hdev->id, 4612 MGMT_OP_SET_EXP_FEATURE, 0, 4613 &rp, sizeof(rp)); 4614 4615 if (changed) 4616 exp_feature_changed(hdev, mgmt_mesh_uuid, val, sk); 4617 4618 return err; 4619 } 4620 4621 static int set_rpa_resolution_func(struct sock *sk, struct hci_dev *hdev, 4622 struct mgmt_cp_set_exp_feature *cp, 4623 u16 data_len) 4624 { 4625 struct mgmt_rp_set_exp_feature rp; 4626 bool val, changed; 4627 int err; 4628 u32 flags; 4629 4630 /* Command requires to use the controller index */ 4631 if (!hdev) 4632 return mgmt_cmd_status(sk, MGMT_INDEX_NONE, 4633 MGMT_OP_SET_EXP_FEATURE, 4634 MGMT_STATUS_INVALID_INDEX); 4635 4636 /* Changes can only be made when controller is powered down */ 4637 if (hdev_is_powered(hdev)) 4638 return mgmt_cmd_status(sk, hdev->id, 4639 MGMT_OP_SET_EXP_FEATURE, 4640 MGMT_STATUS_REJECTED); 4641 4642 /* Parameters are limited to a single octet */ 4643 if (data_len != MGMT_SET_EXP_FEATURE_SIZE + 1) 4644 return mgmt_cmd_status(sk, hdev->id, 4645 MGMT_OP_SET_EXP_FEATURE, 4646 MGMT_STATUS_INVALID_PARAMS); 4647 4648 /* Only boolean on/off is supported */ 4649 if (cp->param[0] != 0x00 && cp->param[0] != 0x01) 4650 return mgmt_cmd_status(sk, hdev->id, 4651 MGMT_OP_SET_EXP_FEATURE, 4652 MGMT_STATUS_INVALID_PARAMS); 4653 4654 val = !!cp->param[0]; 4655 4656 if (val) { 4657 changed = !hci_dev_test_and_set_flag(hdev, 4658 HCI_ENABLE_LL_PRIVACY); 4659 hci_dev_clear_flag(hdev, HCI_ADVERTISING); 4660 4661 /* Enable LL privacy + supported settings changed */ 4662 flags = BIT(0) | BIT(1); 4663 } else { 4664 changed = hci_dev_test_and_clear_flag(hdev, 4665 HCI_ENABLE_LL_PRIVACY); 4666 4667 /* Disable LL privacy + supported settings changed */ 4668 flags = BIT(1); 4669 } 4670 4671 memcpy(rp.uuid, rpa_resolution_uuid, 16); 4672 rp.flags = cpu_to_le32(flags); 4673 4674 hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS); 4675 4676 err = mgmt_cmd_complete(sk, hdev->id, 4677 MGMT_OP_SET_EXP_FEATURE, 0, 4678 &rp, sizeof(rp)); 4679 4680 if (changed) 4681 exp_ll_privacy_feature_changed(val, hdev, sk); 4682 4683 return err; 4684 } 4685 4686 static int set_quality_report_func(struct sock *sk, struct hci_dev *hdev, 4687 struct mgmt_cp_set_exp_feature *cp, 4688 u16 data_len) 4689 { 4690 struct mgmt_rp_set_exp_feature rp; 4691 bool val, changed; 4692 int err; 4693 4694 /* Command requires to use a valid controller index */ 4695 if (!hdev) 4696 return mgmt_cmd_status(sk, MGMT_INDEX_NONE, 4697 MGMT_OP_SET_EXP_FEATURE, 4698 MGMT_STATUS_INVALID_INDEX); 4699 4700 /* Parameters are limited to a single octet */ 4701 if (data_len != MGMT_SET_EXP_FEATURE_SIZE + 1) 4702 return mgmt_cmd_status(sk, hdev->id, 4703 MGMT_OP_SET_EXP_FEATURE, 4704 MGMT_STATUS_INVALID_PARAMS); 4705 4706 /* Only boolean on/off is supported */ 4707 if (cp->param[0] != 0x00 && cp->param[0] != 0x01) 4708 return mgmt_cmd_status(sk, hdev->id, 4709 MGMT_OP_SET_EXP_FEATURE, 4710 MGMT_STATUS_INVALID_PARAMS); 4711 4712 hci_req_sync_lock(hdev); 4713 4714 val = !!cp->param[0]; 4715 changed = (val != hci_dev_test_flag(hdev, HCI_QUALITY_REPORT)); 4716 4717 if (!aosp_has_quality_report(hdev) && !hdev->set_quality_report) { 4718 err = mgmt_cmd_status(sk, hdev->id, 4719 MGMT_OP_SET_EXP_FEATURE, 4720 MGMT_STATUS_NOT_SUPPORTED); 4721 goto unlock_quality_report; 4722 } 4723 4724 if (changed) { 4725 if (hdev->set_quality_report) 4726 err = hdev->set_quality_report(hdev, val); 4727 else 4728 err = aosp_set_quality_report(hdev, val); 4729 4730 if (err) { 4731 err = mgmt_cmd_status(sk, hdev->id, 4732 MGMT_OP_SET_EXP_FEATURE, 4733 MGMT_STATUS_FAILED); 4734 goto unlock_quality_report; 4735 } 4736 4737 if (val) 4738 hci_dev_set_flag(hdev, HCI_QUALITY_REPORT); 4739 else 4740 hci_dev_clear_flag(hdev, HCI_QUALITY_REPORT); 4741 } 4742 4743 bt_dev_dbg(hdev, "quality report enable %d changed %d", val, changed); 4744 4745 memcpy(rp.uuid, quality_report_uuid, 16); 4746 rp.flags = cpu_to_le32(val ? BIT(0) : 0); 4747 hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS); 4748 4749 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_EXP_FEATURE, 0, 4750 &rp, sizeof(rp)); 4751 4752 if (changed) 4753 exp_feature_changed(hdev, quality_report_uuid, val, sk); 4754 4755 unlock_quality_report: 4756 hci_req_sync_unlock(hdev); 4757 return err; 4758 } 4759 4760 static int set_offload_codec_func(struct sock *sk, struct hci_dev *hdev, 4761 struct mgmt_cp_set_exp_feature *cp, 4762 u16 data_len) 4763 { 4764 bool val, changed; 4765 int err; 4766 struct mgmt_rp_set_exp_feature rp; 4767 4768 /* Command requires to use a valid controller index */ 4769 if (!hdev) 4770 return mgmt_cmd_status(sk, MGMT_INDEX_NONE, 4771 MGMT_OP_SET_EXP_FEATURE, 4772 MGMT_STATUS_INVALID_INDEX); 4773 4774 /* Parameters are limited to a single octet */ 4775 if (data_len != MGMT_SET_EXP_FEATURE_SIZE + 1) 4776 return mgmt_cmd_status(sk, hdev->id, 4777 MGMT_OP_SET_EXP_FEATURE, 4778 MGMT_STATUS_INVALID_PARAMS); 4779 4780 /* Only boolean on/off is supported */ 4781 if (cp->param[0] != 0x00 && cp->param[0] != 0x01) 4782 return mgmt_cmd_status(sk, hdev->id, 4783 MGMT_OP_SET_EXP_FEATURE, 4784 MGMT_STATUS_INVALID_PARAMS); 4785 4786 val = !!cp->param[0]; 4787 changed = (val != hci_dev_test_flag(hdev, HCI_OFFLOAD_CODECS_ENABLED)); 4788 4789 if (!hdev->get_data_path_id) { 4790 return mgmt_cmd_status(sk, hdev->id, 4791 MGMT_OP_SET_EXP_FEATURE, 4792 MGMT_STATUS_NOT_SUPPORTED); 4793 } 4794 4795 if (changed) { 4796 if (val) 4797 hci_dev_set_flag(hdev, HCI_OFFLOAD_CODECS_ENABLED); 4798 else 4799 hci_dev_clear_flag(hdev, HCI_OFFLOAD_CODECS_ENABLED); 4800 } 4801 4802 bt_dev_info(hdev, "offload codecs enable %d changed %d", 4803 val, changed); 4804 4805 memcpy(rp.uuid, offload_codecs_uuid, 16); 4806 rp.flags = cpu_to_le32(val ? BIT(0) : 0); 4807 hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS); 4808 err = mgmt_cmd_complete(sk, hdev->id, 4809 MGMT_OP_SET_EXP_FEATURE, 0, 4810 &rp, sizeof(rp)); 4811 4812 if (changed) 4813 exp_feature_changed(hdev, offload_codecs_uuid, val, sk); 4814 4815 return err; 4816 } 4817 4818 static int set_le_simultaneous_roles_func(struct sock *sk, struct hci_dev *hdev, 4819 struct mgmt_cp_set_exp_feature *cp, 4820 u16 data_len) 4821 { 4822 bool val, changed; 4823 int err; 4824 struct mgmt_rp_set_exp_feature rp; 4825 4826 /* Command requires to use a valid controller index */ 4827 if (!hdev) 4828 return mgmt_cmd_status(sk, MGMT_INDEX_NONE, 4829 MGMT_OP_SET_EXP_FEATURE, 4830 MGMT_STATUS_INVALID_INDEX); 4831 4832 /* Parameters are limited to a single octet */ 4833 if (data_len != MGMT_SET_EXP_FEATURE_SIZE + 1) 4834 return mgmt_cmd_status(sk, hdev->id, 4835 MGMT_OP_SET_EXP_FEATURE, 4836 MGMT_STATUS_INVALID_PARAMS); 4837 4838 /* Only boolean on/off is supported */ 4839 if (cp->param[0] != 0x00 && cp->param[0] != 0x01) 4840 return mgmt_cmd_status(sk, hdev->id, 4841 MGMT_OP_SET_EXP_FEATURE, 4842 MGMT_STATUS_INVALID_PARAMS); 4843 4844 val = !!cp->param[0]; 4845 changed = (val != hci_dev_test_flag(hdev, HCI_LE_SIMULTANEOUS_ROLES)); 4846 4847 if (!hci_dev_le_state_simultaneous(hdev)) { 4848 return mgmt_cmd_status(sk, hdev->id, 4849 MGMT_OP_SET_EXP_FEATURE, 4850 MGMT_STATUS_NOT_SUPPORTED); 4851 } 4852 4853 if (changed) { 4854 if (val) 4855 hci_dev_set_flag(hdev, HCI_LE_SIMULTANEOUS_ROLES); 4856 else 4857 hci_dev_clear_flag(hdev, HCI_LE_SIMULTANEOUS_ROLES); 4858 } 4859 4860 bt_dev_info(hdev, "LE simultaneous roles enable %d changed %d", 4861 val, changed); 4862 4863 memcpy(rp.uuid, le_simultaneous_roles_uuid, 16); 4864 rp.flags = cpu_to_le32(val ? BIT(0) : 0); 4865 hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS); 4866 err = mgmt_cmd_complete(sk, hdev->id, 4867 MGMT_OP_SET_EXP_FEATURE, 0, 4868 &rp, sizeof(rp)); 4869 4870 if (changed) 4871 exp_feature_changed(hdev, le_simultaneous_roles_uuid, val, sk); 4872 4873 return err; 4874 } 4875 4876 #ifdef CONFIG_BT_LE 4877 static int set_iso_socket_func(struct sock *sk, struct hci_dev *hdev, 4878 struct mgmt_cp_set_exp_feature *cp, u16 data_len) 4879 { 4880 struct mgmt_rp_set_exp_feature rp; 4881 bool val, changed = false; 4882 int err; 4883 4884 /* Command requires to use the non-controller index */ 4885 if (hdev) 4886 return mgmt_cmd_status(sk, hdev->id, 4887 MGMT_OP_SET_EXP_FEATURE, 4888 MGMT_STATUS_INVALID_INDEX); 4889 4890 /* Parameters are limited to a single octet */ 4891 if (data_len != MGMT_SET_EXP_FEATURE_SIZE + 1) 4892 return mgmt_cmd_status(sk, MGMT_INDEX_NONE, 4893 MGMT_OP_SET_EXP_FEATURE, 4894 MGMT_STATUS_INVALID_PARAMS); 4895 4896 /* Only boolean on/off is supported */ 4897 if (cp->param[0] != 0x00 && cp->param[0] != 0x01) 4898 return mgmt_cmd_status(sk, MGMT_INDEX_NONE, 4899 MGMT_OP_SET_EXP_FEATURE, 4900 MGMT_STATUS_INVALID_PARAMS); 4901 4902 val = cp->param[0] ? true : false; 4903 if (val) 4904 err = iso_init(); 4905 else 4906 err = iso_exit(); 4907 4908 if (!err) 4909 changed = true; 4910 4911 memcpy(rp.uuid, iso_socket_uuid, 16); 4912 rp.flags = cpu_to_le32(val ? BIT(0) : 0); 4913 4914 hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS); 4915 4916 err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE, 4917 MGMT_OP_SET_EXP_FEATURE, 0, 4918 &rp, sizeof(rp)); 4919 4920 if (changed) 4921 exp_feature_changed(hdev, iso_socket_uuid, val, sk); 4922 4923 return err; 4924 } 4925 #endif 4926 4927 static const struct mgmt_exp_feature { 4928 const u8 *uuid; 4929 int (*set_func)(struct sock *sk, struct hci_dev *hdev, 4930 struct mgmt_cp_set_exp_feature *cp, u16 data_len); 4931 } exp_features[] = { 4932 EXP_FEAT(ZERO_KEY, set_zero_key_func), 4933 #ifdef CONFIG_BT_FEATURE_DEBUG 4934 EXP_FEAT(debug_uuid, set_debug_func), 4935 #endif 4936 EXP_FEAT(mgmt_mesh_uuid, set_mgmt_mesh_func), 4937 EXP_FEAT(rpa_resolution_uuid, set_rpa_resolution_func), 4938 EXP_FEAT(quality_report_uuid, set_quality_report_func), 4939 EXP_FEAT(offload_codecs_uuid, set_offload_codec_func), 4940 EXP_FEAT(le_simultaneous_roles_uuid, set_le_simultaneous_roles_func), 4941 #ifdef CONFIG_BT_LE 4942 EXP_FEAT(iso_socket_uuid, set_iso_socket_func), 4943 #endif 4944 4945 /* end with a null feature */ 4946 EXP_FEAT(NULL, NULL) 4947 }; 4948 4949 static int set_exp_feature(struct sock *sk, struct hci_dev *hdev, 4950 void *data, u16 data_len) 4951 { 4952 struct mgmt_cp_set_exp_feature *cp = data; 4953 size_t i = 0; 4954 4955 bt_dev_dbg(hdev, "sock %p", sk); 4956 4957 for (i = 0; exp_features[i].uuid; i++) { 4958 if (!memcmp(cp->uuid, exp_features[i].uuid, 16)) 4959 return exp_features[i].set_func(sk, hdev, cp, data_len); 4960 } 4961 4962 return mgmt_cmd_status(sk, hdev ? hdev->id : MGMT_INDEX_NONE, 4963 MGMT_OP_SET_EXP_FEATURE, 4964 MGMT_STATUS_NOT_SUPPORTED); 4965 } 4966 4967 static u32 get_params_flags(struct hci_dev *hdev, 4968 struct hci_conn_params *params) 4969 { 4970 u32 flags = hdev->conn_flags; 4971 4972 /* Devices using RPAs can only be programmed in the acceptlist if 4973 * LL Privacy has been enable otherwise they cannot mark 4974 * HCI_CONN_FLAG_REMOTE_WAKEUP. 4975 */ 4976 if ((flags & HCI_CONN_FLAG_REMOTE_WAKEUP) && !use_ll_privacy(hdev) && 4977 hci_find_irk_by_addr(hdev, ¶ms->addr, params->addr_type)) 4978 flags &= ~HCI_CONN_FLAG_REMOTE_WAKEUP; 4979 4980 return flags; 4981 } 4982 4983 static int get_device_flags(struct sock *sk, struct hci_dev *hdev, void *data, 4984 u16 data_len) 4985 { 4986 struct mgmt_cp_get_device_flags *cp = data; 4987 struct mgmt_rp_get_device_flags rp; 4988 struct bdaddr_list_with_flags *br_params; 4989 struct hci_conn_params *params; 4990 u32 supported_flags; 4991 u32 current_flags = 0; 4992 u8 status = MGMT_STATUS_INVALID_PARAMS; 4993 4994 bt_dev_dbg(hdev, "Get device flags %pMR (type 0x%x)\n", 4995 &cp->addr.bdaddr, cp->addr.type); 4996 4997 hci_dev_lock(hdev); 4998 4999 supported_flags = hdev->conn_flags; 5000 5001 memset(&rp, 0, sizeof(rp)); 5002 5003 if (cp->addr.type == BDADDR_BREDR) { 5004 br_params = hci_bdaddr_list_lookup_with_flags(&hdev->accept_list, 5005 &cp->addr.bdaddr, 5006 cp->addr.type); 5007 if (!br_params) 5008 goto done; 5009 5010 current_flags = br_params->flags; 5011 } else { 5012 params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr, 5013 le_addr_type(cp->addr.type)); 5014 if (!params) 5015 goto done; 5016 5017 supported_flags = get_params_flags(hdev, params); 5018 current_flags = params->flags; 5019 } 5020 5021 bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr); 5022 rp.addr.type = cp->addr.type; 5023 rp.supported_flags = cpu_to_le32(supported_flags); 5024 rp.current_flags = cpu_to_le32(current_flags); 5025 5026 status = MGMT_STATUS_SUCCESS; 5027 5028 done: 5029 hci_dev_unlock(hdev); 5030 5031 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_DEVICE_FLAGS, status, 5032 &rp, sizeof(rp)); 5033 } 5034 5035 static void device_flags_changed(struct sock *sk, struct hci_dev *hdev, 5036 bdaddr_t *bdaddr, u8 bdaddr_type, 5037 u32 supported_flags, u32 current_flags) 5038 { 5039 struct mgmt_ev_device_flags_changed ev; 5040 5041 bacpy(&ev.addr.bdaddr, bdaddr); 5042 ev.addr.type = bdaddr_type; 5043 ev.supported_flags = cpu_to_le32(supported_flags); 5044 ev.current_flags = cpu_to_le32(current_flags); 5045 5046 mgmt_event(MGMT_EV_DEVICE_FLAGS_CHANGED, hdev, &ev, sizeof(ev), sk); 5047 } 5048 5049 static int set_device_flags(struct sock *sk, struct hci_dev *hdev, void *data, 5050 u16 len) 5051 { 5052 struct mgmt_cp_set_device_flags *cp = data; 5053 struct bdaddr_list_with_flags *br_params; 5054 struct hci_conn_params *params; 5055 u8 status = MGMT_STATUS_INVALID_PARAMS; 5056 u32 supported_flags; 5057 u32 current_flags = __le32_to_cpu(cp->current_flags); 5058 5059 bt_dev_dbg(hdev, "Set device flags %pMR (type 0x%x) = 0x%x", 5060 &cp->addr.bdaddr, cp->addr.type, current_flags); 5061 5062 // We should take hci_dev_lock() early, I think.. conn_flags can change 5063 supported_flags = hdev->conn_flags; 5064 5065 if ((supported_flags | current_flags) != supported_flags) { 5066 bt_dev_warn(hdev, "Bad flag given (0x%x) vs supported (0x%0x)", 5067 current_flags, supported_flags); 5068 goto done; 5069 } 5070 5071 hci_dev_lock(hdev); 5072 5073 if (cp->addr.type == BDADDR_BREDR) { 5074 br_params = hci_bdaddr_list_lookup_with_flags(&hdev->accept_list, 5075 &cp->addr.bdaddr, 5076 cp->addr.type); 5077 5078 if (br_params) { 5079 br_params->flags = current_flags; 5080 status = MGMT_STATUS_SUCCESS; 5081 } else { 5082 bt_dev_warn(hdev, "No such BR/EDR device %pMR (0x%x)", 5083 &cp->addr.bdaddr, cp->addr.type); 5084 } 5085 5086 goto unlock; 5087 } 5088 5089 params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr, 5090 le_addr_type(cp->addr.type)); 5091 if (!params) { 5092 bt_dev_warn(hdev, "No such LE device %pMR (0x%x)", 5093 &cp->addr.bdaddr, le_addr_type(cp->addr.type)); 5094 goto unlock; 5095 } 5096 5097 supported_flags = get_params_flags(hdev, params); 5098 5099 if ((supported_flags | current_flags) != supported_flags) { 5100 bt_dev_warn(hdev, "Bad flag given (0x%x) vs supported (0x%0x)", 5101 current_flags, supported_flags); 5102 goto unlock; 5103 } 5104 5105 WRITE_ONCE(params->flags, current_flags); 5106 status = MGMT_STATUS_SUCCESS; 5107 5108 /* Update passive scan if HCI_CONN_FLAG_DEVICE_PRIVACY 5109 * has been set. 5110 */ 5111 if (params->flags & HCI_CONN_FLAG_DEVICE_PRIVACY) 5112 hci_update_passive_scan(hdev); 5113 5114 unlock: 5115 hci_dev_unlock(hdev); 5116 5117 done: 5118 if (status == MGMT_STATUS_SUCCESS) 5119 device_flags_changed(sk, hdev, &cp->addr.bdaddr, cp->addr.type, 5120 supported_flags, current_flags); 5121 5122 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_DEVICE_FLAGS, status, 5123 &cp->addr, sizeof(cp->addr)); 5124 } 5125 5126 static void mgmt_adv_monitor_added(struct sock *sk, struct hci_dev *hdev, 5127 u16 handle) 5128 { 5129 struct mgmt_ev_adv_monitor_added ev; 5130 5131 ev.monitor_handle = cpu_to_le16(handle); 5132 5133 mgmt_event(MGMT_EV_ADV_MONITOR_ADDED, hdev, &ev, sizeof(ev), sk); 5134 } 5135 5136 void mgmt_adv_monitor_removed(struct hci_dev *hdev, u16 handle) 5137 { 5138 struct mgmt_ev_adv_monitor_removed ev; 5139 struct mgmt_pending_cmd *cmd; 5140 struct sock *sk_skip = NULL; 5141 struct mgmt_cp_remove_adv_monitor *cp; 5142 5143 cmd = pending_find(MGMT_OP_REMOVE_ADV_MONITOR, hdev); 5144 if (cmd) { 5145 cp = cmd->param; 5146 5147 if (cp->monitor_handle) 5148 sk_skip = cmd->sk; 5149 } 5150 5151 ev.monitor_handle = cpu_to_le16(handle); 5152 5153 mgmt_event(MGMT_EV_ADV_MONITOR_REMOVED, hdev, &ev, sizeof(ev), sk_skip); 5154 } 5155 5156 static int read_adv_mon_features(struct sock *sk, struct hci_dev *hdev, 5157 void *data, u16 len) 5158 { 5159 struct adv_monitor *monitor = NULL; 5160 struct mgmt_rp_read_adv_monitor_features *rp = NULL; 5161 int handle, err; 5162 size_t rp_size = 0; 5163 __u32 supported = 0; 5164 __u32 enabled = 0; 5165 __u16 num_handles = 0; 5166 __u16 handles[HCI_MAX_ADV_MONITOR_NUM_HANDLES]; 5167 5168 BT_DBG("request for %s", hdev->name); 5169 5170 hci_dev_lock(hdev); 5171 5172 if (msft_monitor_supported(hdev)) 5173 supported |= MGMT_ADV_MONITOR_FEATURE_MASK_OR_PATTERNS; 5174 5175 idr_for_each_entry(&hdev->adv_monitors_idr, monitor, handle) 5176 handles[num_handles++] = monitor->handle; 5177 5178 hci_dev_unlock(hdev); 5179 5180 rp_size = sizeof(*rp) + (num_handles * sizeof(u16)); 5181 rp = kmalloc(rp_size, GFP_KERNEL); 5182 if (!rp) 5183 return -ENOMEM; 5184 5185 /* All supported features are currently enabled */ 5186 enabled = supported; 5187 5188 rp->supported_features = cpu_to_le32(supported); 5189 rp->enabled_features = cpu_to_le32(enabled); 5190 rp->max_num_handles = cpu_to_le16(HCI_MAX_ADV_MONITOR_NUM_HANDLES); 5191 rp->max_num_patterns = HCI_MAX_ADV_MONITOR_NUM_PATTERNS; 5192 rp->num_handles = cpu_to_le16(num_handles); 5193 if (num_handles) 5194 memcpy(&rp->handles, &handles, (num_handles * sizeof(u16))); 5195 5196 err = mgmt_cmd_complete(sk, hdev->id, 5197 MGMT_OP_READ_ADV_MONITOR_FEATURES, 5198 MGMT_STATUS_SUCCESS, rp, rp_size); 5199 5200 kfree(rp); 5201 5202 return err; 5203 } 5204 5205 static void mgmt_add_adv_patterns_monitor_complete(struct hci_dev *hdev, 5206 void *data, int status) 5207 { 5208 struct mgmt_rp_add_adv_patterns_monitor rp; 5209 struct mgmt_pending_cmd *cmd = data; 5210 struct adv_monitor *monitor = cmd->user_data; 5211 5212 hci_dev_lock(hdev); 5213 5214 rp.monitor_handle = cpu_to_le16(monitor->handle); 5215 5216 if (!status) { 5217 mgmt_adv_monitor_added(cmd->sk, hdev, monitor->handle); 5218 hdev->adv_monitors_cnt++; 5219 if (monitor->state == ADV_MONITOR_STATE_NOT_REGISTERED) 5220 monitor->state = ADV_MONITOR_STATE_REGISTERED; 5221 hci_update_passive_scan(hdev); 5222 } 5223 5224 mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, 5225 mgmt_status(status), &rp, sizeof(rp)); 5226 mgmt_pending_remove(cmd); 5227 5228 hci_dev_unlock(hdev); 5229 bt_dev_dbg(hdev, "add monitor %d complete, status %d", 5230 rp.monitor_handle, status); 5231 } 5232 5233 static int mgmt_add_adv_patterns_monitor_sync(struct hci_dev *hdev, void *data) 5234 { 5235 struct mgmt_pending_cmd *cmd = data; 5236 struct adv_monitor *monitor = cmd->user_data; 5237 5238 return hci_add_adv_monitor(hdev, monitor); 5239 } 5240 5241 static int __add_adv_patterns_monitor(struct sock *sk, struct hci_dev *hdev, 5242 struct adv_monitor *m, u8 status, 5243 void *data, u16 len, u16 op) 5244 { 5245 struct mgmt_pending_cmd *cmd; 5246 int err; 5247 5248 hci_dev_lock(hdev); 5249 5250 if (status) 5251 goto unlock; 5252 5253 if (pending_find(MGMT_OP_SET_LE, hdev) || 5254 pending_find(MGMT_OP_ADD_ADV_PATTERNS_MONITOR, hdev) || 5255 pending_find(MGMT_OP_ADD_ADV_PATTERNS_MONITOR_RSSI, hdev) || 5256 pending_find(MGMT_OP_REMOVE_ADV_MONITOR, hdev)) { 5257 status = MGMT_STATUS_BUSY; 5258 goto unlock; 5259 } 5260 5261 cmd = mgmt_pending_add(sk, op, hdev, data, len); 5262 if (!cmd) { 5263 status = MGMT_STATUS_NO_RESOURCES; 5264 goto unlock; 5265 } 5266 5267 cmd->user_data = m; 5268 err = hci_cmd_sync_queue(hdev, mgmt_add_adv_patterns_monitor_sync, cmd, 5269 mgmt_add_adv_patterns_monitor_complete); 5270 if (err) { 5271 if (err == -ENOMEM) 5272 status = MGMT_STATUS_NO_RESOURCES; 5273 else 5274 status = MGMT_STATUS_FAILED; 5275 5276 goto unlock; 5277 } 5278 5279 hci_dev_unlock(hdev); 5280 5281 return 0; 5282 5283 unlock: 5284 hci_free_adv_monitor(hdev, m); 5285 hci_dev_unlock(hdev); 5286 return mgmt_cmd_status(sk, hdev->id, op, status); 5287 } 5288 5289 static void parse_adv_monitor_rssi(struct adv_monitor *m, 5290 struct mgmt_adv_rssi_thresholds *rssi) 5291 { 5292 if (rssi) { 5293 m->rssi.low_threshold = rssi->low_threshold; 5294 m->rssi.low_threshold_timeout = 5295 __le16_to_cpu(rssi->low_threshold_timeout); 5296 m->rssi.high_threshold = rssi->high_threshold; 5297 m->rssi.high_threshold_timeout = 5298 __le16_to_cpu(rssi->high_threshold_timeout); 5299 m->rssi.sampling_period = rssi->sampling_period; 5300 } else { 5301 /* Default values. These numbers are the least constricting 5302 * parameters for MSFT API to work, so it behaves as if there 5303 * are no rssi parameter to consider. May need to be changed 5304 * if other API are to be supported. 5305 */ 5306 m->rssi.low_threshold = -127; 5307 m->rssi.low_threshold_timeout = 60; 5308 m->rssi.high_threshold = -127; 5309 m->rssi.high_threshold_timeout = 0; 5310 m->rssi.sampling_period = 0; 5311 } 5312 } 5313 5314 static u8 parse_adv_monitor_pattern(struct adv_monitor *m, u8 pattern_count, 5315 struct mgmt_adv_pattern *patterns) 5316 { 5317 u8 offset = 0, length = 0; 5318 struct adv_pattern *p = NULL; 5319 int i; 5320 5321 for (i = 0; i < pattern_count; i++) { 5322 offset = patterns[i].offset; 5323 length = patterns[i].length; 5324 if (offset >= HCI_MAX_EXT_AD_LENGTH || 5325 length > HCI_MAX_EXT_AD_LENGTH || 5326 (offset + length) > HCI_MAX_EXT_AD_LENGTH) 5327 return MGMT_STATUS_INVALID_PARAMS; 5328 5329 p = kmalloc(sizeof(*p), GFP_KERNEL); 5330 if (!p) 5331 return MGMT_STATUS_NO_RESOURCES; 5332 5333 p->ad_type = patterns[i].ad_type; 5334 p->offset = patterns[i].offset; 5335 p->length = patterns[i].length; 5336 memcpy(p->value, patterns[i].value, p->length); 5337 5338 INIT_LIST_HEAD(&p->list); 5339 list_add(&p->list, &m->patterns); 5340 } 5341 5342 return MGMT_STATUS_SUCCESS; 5343 } 5344 5345 static int add_adv_patterns_monitor(struct sock *sk, struct hci_dev *hdev, 5346 void *data, u16 len) 5347 { 5348 struct mgmt_cp_add_adv_patterns_monitor *cp = data; 5349 struct adv_monitor *m = NULL; 5350 u8 status = MGMT_STATUS_SUCCESS; 5351 size_t expected_size = sizeof(*cp); 5352 5353 BT_DBG("request for %s", hdev->name); 5354 5355 if (len <= sizeof(*cp)) { 5356 status = MGMT_STATUS_INVALID_PARAMS; 5357 goto done; 5358 } 5359 5360 expected_size += cp->pattern_count * sizeof(struct mgmt_adv_pattern); 5361 if (len != expected_size) { 5362 status = MGMT_STATUS_INVALID_PARAMS; 5363 goto done; 5364 } 5365 5366 m = kzalloc(sizeof(*m), GFP_KERNEL); 5367 if (!m) { 5368 status = MGMT_STATUS_NO_RESOURCES; 5369 goto done; 5370 } 5371 5372 INIT_LIST_HEAD(&m->patterns); 5373 5374 parse_adv_monitor_rssi(m, NULL); 5375 status = parse_adv_monitor_pattern(m, cp->pattern_count, cp->patterns); 5376 5377 done: 5378 return __add_adv_patterns_monitor(sk, hdev, m, status, data, len, 5379 MGMT_OP_ADD_ADV_PATTERNS_MONITOR); 5380 } 5381 5382 static int add_adv_patterns_monitor_rssi(struct sock *sk, struct hci_dev *hdev, 5383 void *data, u16 len) 5384 { 5385 struct mgmt_cp_add_adv_patterns_monitor_rssi *cp = data; 5386 struct adv_monitor *m = NULL; 5387 u8 status = MGMT_STATUS_SUCCESS; 5388 size_t expected_size = sizeof(*cp); 5389 5390 BT_DBG("request for %s", hdev->name); 5391 5392 if (len <= sizeof(*cp)) { 5393 status = MGMT_STATUS_INVALID_PARAMS; 5394 goto done; 5395 } 5396 5397 expected_size += cp->pattern_count * sizeof(struct mgmt_adv_pattern); 5398 if (len != expected_size) { 5399 status = MGMT_STATUS_INVALID_PARAMS; 5400 goto done; 5401 } 5402 5403 m = kzalloc(sizeof(*m), GFP_KERNEL); 5404 if (!m) { 5405 status = MGMT_STATUS_NO_RESOURCES; 5406 goto done; 5407 } 5408 5409 INIT_LIST_HEAD(&m->patterns); 5410 5411 parse_adv_monitor_rssi(m, &cp->rssi); 5412 status = parse_adv_monitor_pattern(m, cp->pattern_count, cp->patterns); 5413 5414 done: 5415 return __add_adv_patterns_monitor(sk, hdev, m, status, data, len, 5416 MGMT_OP_ADD_ADV_PATTERNS_MONITOR_RSSI); 5417 } 5418 5419 static void mgmt_remove_adv_monitor_complete(struct hci_dev *hdev, 5420 void *data, int status) 5421 { 5422 struct mgmt_rp_remove_adv_monitor rp; 5423 struct mgmt_pending_cmd *cmd = data; 5424 struct mgmt_cp_remove_adv_monitor *cp = cmd->param; 5425 5426 hci_dev_lock(hdev); 5427 5428 rp.monitor_handle = cp->monitor_handle; 5429 5430 if (!status) 5431 hci_update_passive_scan(hdev); 5432 5433 mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, 5434 mgmt_status(status), &rp, sizeof(rp)); 5435 mgmt_pending_remove(cmd); 5436 5437 hci_dev_unlock(hdev); 5438 bt_dev_dbg(hdev, "remove monitor %d complete, status %d", 5439 rp.monitor_handle, status); 5440 } 5441 5442 static int mgmt_remove_adv_monitor_sync(struct hci_dev *hdev, void *data) 5443 { 5444 struct mgmt_pending_cmd *cmd = data; 5445 struct mgmt_cp_remove_adv_monitor *cp = cmd->param; 5446 u16 handle = __le16_to_cpu(cp->monitor_handle); 5447 5448 if (!handle) 5449 return hci_remove_all_adv_monitor(hdev); 5450 5451 return hci_remove_single_adv_monitor(hdev, handle); 5452 } 5453 5454 static int remove_adv_monitor(struct sock *sk, struct hci_dev *hdev, 5455 void *data, u16 len) 5456 { 5457 struct mgmt_pending_cmd *cmd; 5458 int err, status; 5459 5460 hci_dev_lock(hdev); 5461 5462 if (pending_find(MGMT_OP_SET_LE, hdev) || 5463 pending_find(MGMT_OP_REMOVE_ADV_MONITOR, hdev) || 5464 pending_find(MGMT_OP_ADD_ADV_PATTERNS_MONITOR, hdev) || 5465 pending_find(MGMT_OP_ADD_ADV_PATTERNS_MONITOR_RSSI, hdev)) { 5466 status = MGMT_STATUS_BUSY; 5467 goto unlock; 5468 } 5469 5470 cmd = mgmt_pending_add(sk, MGMT_OP_REMOVE_ADV_MONITOR, hdev, data, len); 5471 if (!cmd) { 5472 status = MGMT_STATUS_NO_RESOURCES; 5473 goto unlock; 5474 } 5475 5476 err = hci_cmd_sync_submit(hdev, mgmt_remove_adv_monitor_sync, cmd, 5477 mgmt_remove_adv_monitor_complete); 5478 5479 if (err) { 5480 mgmt_pending_remove(cmd); 5481 5482 if (err == -ENOMEM) 5483 status = MGMT_STATUS_NO_RESOURCES; 5484 else 5485 status = MGMT_STATUS_FAILED; 5486 5487 goto unlock; 5488 } 5489 5490 hci_dev_unlock(hdev); 5491 5492 return 0; 5493 5494 unlock: 5495 hci_dev_unlock(hdev); 5496 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_ADV_MONITOR, 5497 status); 5498 } 5499 5500 static void read_local_oob_data_complete(struct hci_dev *hdev, void *data, int err) 5501 { 5502 struct mgmt_rp_read_local_oob_data mgmt_rp; 5503 size_t rp_size = sizeof(mgmt_rp); 5504 struct mgmt_pending_cmd *cmd = data; 5505 struct sk_buff *skb = cmd->skb; 5506 u8 status = mgmt_status(err); 5507 5508 if (!status) { 5509 if (!skb) 5510 status = MGMT_STATUS_FAILED; 5511 else if (IS_ERR(skb)) 5512 status = mgmt_status(PTR_ERR(skb)); 5513 else 5514 status = mgmt_status(skb->data[0]); 5515 } 5516 5517 bt_dev_dbg(hdev, "status %d", status); 5518 5519 if (status) { 5520 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA, status); 5521 goto remove; 5522 } 5523 5524 memset(&mgmt_rp, 0, sizeof(mgmt_rp)); 5525 5526 if (!bredr_sc_enabled(hdev)) { 5527 struct hci_rp_read_local_oob_data *rp = (void *) skb->data; 5528 5529 if (skb->len < sizeof(*rp)) { 5530 mgmt_cmd_status(cmd->sk, hdev->id, 5531 MGMT_OP_READ_LOCAL_OOB_DATA, 5532 MGMT_STATUS_FAILED); 5533 goto remove; 5534 } 5535 5536 memcpy(mgmt_rp.hash192, rp->hash, sizeof(rp->hash)); 5537 memcpy(mgmt_rp.rand192, rp->rand, sizeof(rp->rand)); 5538 5539 rp_size -= sizeof(mgmt_rp.hash256) + sizeof(mgmt_rp.rand256); 5540 } else { 5541 struct hci_rp_read_local_oob_ext_data *rp = (void *) skb->data; 5542 5543 if (skb->len < sizeof(*rp)) { 5544 mgmt_cmd_status(cmd->sk, hdev->id, 5545 MGMT_OP_READ_LOCAL_OOB_DATA, 5546 MGMT_STATUS_FAILED); 5547 goto remove; 5548 } 5549 5550 memcpy(mgmt_rp.hash192, rp->hash192, sizeof(rp->hash192)); 5551 memcpy(mgmt_rp.rand192, rp->rand192, sizeof(rp->rand192)); 5552 5553 memcpy(mgmt_rp.hash256, rp->hash256, sizeof(rp->hash256)); 5554 memcpy(mgmt_rp.rand256, rp->rand256, sizeof(rp->rand256)); 5555 } 5556 5557 mgmt_cmd_complete(cmd->sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA, 5558 MGMT_STATUS_SUCCESS, &mgmt_rp, rp_size); 5559 5560 remove: 5561 if (skb && !IS_ERR(skb)) 5562 kfree_skb(skb); 5563 5564 mgmt_pending_free(cmd); 5565 } 5566 5567 static int read_local_oob_data_sync(struct hci_dev *hdev, void *data) 5568 { 5569 struct mgmt_pending_cmd *cmd = data; 5570 5571 if (bredr_sc_enabled(hdev)) 5572 cmd->skb = hci_read_local_oob_data_sync(hdev, true, cmd->sk); 5573 else 5574 cmd->skb = hci_read_local_oob_data_sync(hdev, false, cmd->sk); 5575 5576 if (IS_ERR(cmd->skb)) 5577 return PTR_ERR(cmd->skb); 5578 else 5579 return 0; 5580 } 5581 5582 static int read_local_oob_data(struct sock *sk, struct hci_dev *hdev, 5583 void *data, u16 data_len) 5584 { 5585 struct mgmt_pending_cmd *cmd; 5586 int err; 5587 5588 bt_dev_dbg(hdev, "sock %p", sk); 5589 5590 hci_dev_lock(hdev); 5591 5592 if (!hdev_is_powered(hdev)) { 5593 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA, 5594 MGMT_STATUS_NOT_POWERED); 5595 goto unlock; 5596 } 5597 5598 if (!lmp_ssp_capable(hdev)) { 5599 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA, 5600 MGMT_STATUS_NOT_SUPPORTED); 5601 goto unlock; 5602 } 5603 5604 cmd = mgmt_pending_new(sk, MGMT_OP_READ_LOCAL_OOB_DATA, hdev, NULL, 0); 5605 if (!cmd) 5606 err = -ENOMEM; 5607 else 5608 err = hci_cmd_sync_queue(hdev, read_local_oob_data_sync, cmd, 5609 read_local_oob_data_complete); 5610 5611 if (err < 0) { 5612 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA, 5613 MGMT_STATUS_FAILED); 5614 5615 if (cmd) 5616 mgmt_pending_free(cmd); 5617 } 5618 5619 unlock: 5620 hci_dev_unlock(hdev); 5621 return err; 5622 } 5623 5624 static int add_remote_oob_data(struct sock *sk, struct hci_dev *hdev, 5625 void *data, u16 len) 5626 { 5627 struct mgmt_addr_info *addr = data; 5628 int err; 5629 5630 bt_dev_dbg(hdev, "sock %p", sk); 5631 5632 if (!bdaddr_type_is_valid(addr->type)) 5633 return mgmt_cmd_complete(sk, hdev->id, 5634 MGMT_OP_ADD_REMOTE_OOB_DATA, 5635 MGMT_STATUS_INVALID_PARAMS, 5636 addr, sizeof(*addr)); 5637 5638 hci_dev_lock(hdev); 5639 5640 if (len == MGMT_ADD_REMOTE_OOB_DATA_SIZE) { 5641 struct mgmt_cp_add_remote_oob_data *cp = data; 5642 u8 status; 5643 5644 if (cp->addr.type != BDADDR_BREDR) { 5645 err = mgmt_cmd_complete(sk, hdev->id, 5646 MGMT_OP_ADD_REMOTE_OOB_DATA, 5647 MGMT_STATUS_INVALID_PARAMS, 5648 &cp->addr, sizeof(cp->addr)); 5649 goto unlock; 5650 } 5651 5652 err = hci_add_remote_oob_data(hdev, &cp->addr.bdaddr, 5653 cp->addr.type, cp->hash, 5654 cp->rand, NULL, NULL); 5655 if (err < 0) 5656 status = MGMT_STATUS_FAILED; 5657 else 5658 status = MGMT_STATUS_SUCCESS; 5659 5660 err = mgmt_cmd_complete(sk, hdev->id, 5661 MGMT_OP_ADD_REMOTE_OOB_DATA, status, 5662 &cp->addr, sizeof(cp->addr)); 5663 } else if (len == MGMT_ADD_REMOTE_OOB_EXT_DATA_SIZE) { 5664 struct mgmt_cp_add_remote_oob_ext_data *cp = data; 5665 u8 *rand192, *hash192, *rand256, *hash256; 5666 u8 status; 5667 5668 if (bdaddr_type_is_le(cp->addr.type)) { 5669 /* Enforce zero-valued 192-bit parameters as 5670 * long as legacy SMP OOB isn't implemented. 5671 */ 5672 if (memcmp(cp->rand192, ZERO_KEY, 16) || 5673 memcmp(cp->hash192, ZERO_KEY, 16)) { 5674 err = mgmt_cmd_complete(sk, hdev->id, 5675 MGMT_OP_ADD_REMOTE_OOB_DATA, 5676 MGMT_STATUS_INVALID_PARAMS, 5677 addr, sizeof(*addr)); 5678 goto unlock; 5679 } 5680 5681 rand192 = NULL; 5682 hash192 = NULL; 5683 } else { 5684 /* In case one of the P-192 values is set to zero, 5685 * then just disable OOB data for P-192. 5686 */ 5687 if (!memcmp(cp->rand192, ZERO_KEY, 16) || 5688 !memcmp(cp->hash192, ZERO_KEY, 16)) { 5689 rand192 = NULL; 5690 hash192 = NULL; 5691 } else { 5692 rand192 = cp->rand192; 5693 hash192 = cp->hash192; 5694 } 5695 } 5696 5697 /* In case one of the P-256 values is set to zero, then just 5698 * disable OOB data for P-256. 5699 */ 5700 if (!memcmp(cp->rand256, ZERO_KEY, 16) || 5701 !memcmp(cp->hash256, ZERO_KEY, 16)) { 5702 rand256 = NULL; 5703 hash256 = NULL; 5704 } else { 5705 rand256 = cp->rand256; 5706 hash256 = cp->hash256; 5707 } 5708 5709 err = hci_add_remote_oob_data(hdev, &cp->addr.bdaddr, 5710 cp->addr.type, hash192, rand192, 5711 hash256, rand256); 5712 if (err < 0) 5713 status = MGMT_STATUS_FAILED; 5714 else 5715 status = MGMT_STATUS_SUCCESS; 5716 5717 err = mgmt_cmd_complete(sk, hdev->id, 5718 MGMT_OP_ADD_REMOTE_OOB_DATA, 5719 status, &cp->addr, sizeof(cp->addr)); 5720 } else { 5721 bt_dev_err(hdev, "add_remote_oob_data: invalid len of %u bytes", 5722 len); 5723 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_REMOTE_OOB_DATA, 5724 MGMT_STATUS_INVALID_PARAMS); 5725 } 5726 5727 unlock: 5728 hci_dev_unlock(hdev); 5729 return err; 5730 } 5731 5732 static int remove_remote_oob_data(struct sock *sk, struct hci_dev *hdev, 5733 void *data, u16 len) 5734 { 5735 struct mgmt_cp_remove_remote_oob_data *cp = data; 5736 u8 status; 5737 int err; 5738 5739 bt_dev_dbg(hdev, "sock %p", sk); 5740 5741 if (cp->addr.type != BDADDR_BREDR) 5742 return mgmt_cmd_complete(sk, hdev->id, 5743 MGMT_OP_REMOVE_REMOTE_OOB_DATA, 5744 MGMT_STATUS_INVALID_PARAMS, 5745 &cp->addr, sizeof(cp->addr)); 5746 5747 hci_dev_lock(hdev); 5748 5749 if (!bacmp(&cp->addr.bdaddr, BDADDR_ANY)) { 5750 hci_remote_oob_data_clear(hdev); 5751 status = MGMT_STATUS_SUCCESS; 5752 goto done; 5753 } 5754 5755 err = hci_remove_remote_oob_data(hdev, &cp->addr.bdaddr, cp->addr.type); 5756 if (err < 0) 5757 status = MGMT_STATUS_INVALID_PARAMS; 5758 else 5759 status = MGMT_STATUS_SUCCESS; 5760 5761 done: 5762 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_REMOTE_OOB_DATA, 5763 status, &cp->addr, sizeof(cp->addr)); 5764 5765 hci_dev_unlock(hdev); 5766 return err; 5767 } 5768 5769 void mgmt_start_discovery_complete(struct hci_dev *hdev, u8 status) 5770 { 5771 struct mgmt_pending_cmd *cmd; 5772 5773 bt_dev_dbg(hdev, "status %u", status); 5774 5775 hci_dev_lock(hdev); 5776 5777 cmd = pending_find(MGMT_OP_START_DISCOVERY, hdev); 5778 if (!cmd) 5779 cmd = pending_find(MGMT_OP_START_SERVICE_DISCOVERY, hdev); 5780 5781 if (!cmd) 5782 cmd = pending_find(MGMT_OP_START_LIMITED_DISCOVERY, hdev); 5783 5784 if (cmd) { 5785 cmd->cmd_complete(cmd, mgmt_status(status)); 5786 mgmt_pending_remove(cmd); 5787 } 5788 5789 hci_dev_unlock(hdev); 5790 } 5791 5792 static bool discovery_type_is_valid(struct hci_dev *hdev, uint8_t type, 5793 uint8_t *mgmt_status) 5794 { 5795 switch (type) { 5796 case DISCOV_TYPE_LE: 5797 *mgmt_status = mgmt_le_support(hdev); 5798 if (*mgmt_status) 5799 return false; 5800 break; 5801 case DISCOV_TYPE_INTERLEAVED: 5802 *mgmt_status = mgmt_le_support(hdev); 5803 if (*mgmt_status) 5804 return false; 5805 fallthrough; 5806 case DISCOV_TYPE_BREDR: 5807 *mgmt_status = mgmt_bredr_support(hdev); 5808 if (*mgmt_status) 5809 return false; 5810 break; 5811 default: 5812 *mgmt_status = MGMT_STATUS_INVALID_PARAMS; 5813 return false; 5814 } 5815 5816 return true; 5817 } 5818 5819 static void start_discovery_complete(struct hci_dev *hdev, void *data, int err) 5820 { 5821 struct mgmt_pending_cmd *cmd = data; 5822 5823 if (cmd != pending_find(MGMT_OP_START_DISCOVERY, hdev) && 5824 cmd != pending_find(MGMT_OP_START_LIMITED_DISCOVERY, hdev) && 5825 cmd != pending_find(MGMT_OP_START_SERVICE_DISCOVERY, hdev)) 5826 return; 5827 5828 bt_dev_dbg(hdev, "err %d", err); 5829 5830 mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, mgmt_status(err), 5831 cmd->param, 1); 5832 mgmt_pending_remove(cmd); 5833 5834 hci_discovery_set_state(hdev, err ? DISCOVERY_STOPPED: 5835 DISCOVERY_FINDING); 5836 } 5837 5838 static int start_discovery_sync(struct hci_dev *hdev, void *data) 5839 { 5840 return hci_start_discovery_sync(hdev); 5841 } 5842 5843 static int start_discovery_internal(struct sock *sk, struct hci_dev *hdev, 5844 u16 op, void *data, u16 len) 5845 { 5846 struct mgmt_cp_start_discovery *cp = data; 5847 struct mgmt_pending_cmd *cmd; 5848 u8 status; 5849 int err; 5850 5851 bt_dev_dbg(hdev, "sock %p", sk); 5852 5853 hci_dev_lock(hdev); 5854 5855 if (!hdev_is_powered(hdev)) { 5856 err = mgmt_cmd_complete(sk, hdev->id, op, 5857 MGMT_STATUS_NOT_POWERED, 5858 &cp->type, sizeof(cp->type)); 5859 goto failed; 5860 } 5861 5862 if (hdev->discovery.state != DISCOVERY_STOPPED || 5863 hci_dev_test_flag(hdev, HCI_PERIODIC_INQ)) { 5864 err = mgmt_cmd_complete(sk, hdev->id, op, MGMT_STATUS_BUSY, 5865 &cp->type, sizeof(cp->type)); 5866 goto failed; 5867 } 5868 5869 if (!discovery_type_is_valid(hdev, cp->type, &status)) { 5870 err = mgmt_cmd_complete(sk, hdev->id, op, status, 5871 &cp->type, sizeof(cp->type)); 5872 goto failed; 5873 } 5874 5875 /* Can't start discovery when it is paused */ 5876 if (hdev->discovery_paused) { 5877 err = mgmt_cmd_complete(sk, hdev->id, op, MGMT_STATUS_BUSY, 5878 &cp->type, sizeof(cp->type)); 5879 goto failed; 5880 } 5881 5882 /* Clear the discovery filter first to free any previously 5883 * allocated memory for the UUID list. 5884 */ 5885 hci_discovery_filter_clear(hdev); 5886 5887 hdev->discovery.type = cp->type; 5888 hdev->discovery.report_invalid_rssi = false; 5889 if (op == MGMT_OP_START_LIMITED_DISCOVERY) 5890 hdev->discovery.limited = true; 5891 else 5892 hdev->discovery.limited = false; 5893 5894 cmd = mgmt_pending_add(sk, op, hdev, data, len); 5895 if (!cmd) { 5896 err = -ENOMEM; 5897 goto failed; 5898 } 5899 5900 err = hci_cmd_sync_queue(hdev, start_discovery_sync, cmd, 5901 start_discovery_complete); 5902 if (err < 0) { 5903 mgmt_pending_remove(cmd); 5904 goto failed; 5905 } 5906 5907 hci_discovery_set_state(hdev, DISCOVERY_STARTING); 5908 5909 failed: 5910 hci_dev_unlock(hdev); 5911 return err; 5912 } 5913 5914 static int start_discovery(struct sock *sk, struct hci_dev *hdev, 5915 void *data, u16 len) 5916 { 5917 return start_discovery_internal(sk, hdev, MGMT_OP_START_DISCOVERY, 5918 data, len); 5919 } 5920 5921 static int start_limited_discovery(struct sock *sk, struct hci_dev *hdev, 5922 void *data, u16 len) 5923 { 5924 return start_discovery_internal(sk, hdev, 5925 MGMT_OP_START_LIMITED_DISCOVERY, 5926 data, len); 5927 } 5928 5929 static int start_service_discovery(struct sock *sk, struct hci_dev *hdev, 5930 void *data, u16 len) 5931 { 5932 struct mgmt_cp_start_service_discovery *cp = data; 5933 struct mgmt_pending_cmd *cmd; 5934 const u16 max_uuid_count = ((U16_MAX - sizeof(*cp)) / 16); 5935 u16 uuid_count, expected_len; 5936 u8 status; 5937 int err; 5938 5939 bt_dev_dbg(hdev, "sock %p", sk); 5940 5941 hci_dev_lock(hdev); 5942 5943 if (!hdev_is_powered(hdev)) { 5944 err = mgmt_cmd_complete(sk, hdev->id, 5945 MGMT_OP_START_SERVICE_DISCOVERY, 5946 MGMT_STATUS_NOT_POWERED, 5947 &cp->type, sizeof(cp->type)); 5948 goto failed; 5949 } 5950 5951 if (hdev->discovery.state != DISCOVERY_STOPPED || 5952 hci_dev_test_flag(hdev, HCI_PERIODIC_INQ)) { 5953 err = mgmt_cmd_complete(sk, hdev->id, 5954 MGMT_OP_START_SERVICE_DISCOVERY, 5955 MGMT_STATUS_BUSY, &cp->type, 5956 sizeof(cp->type)); 5957 goto failed; 5958 } 5959 5960 if (hdev->discovery_paused) { 5961 err = mgmt_cmd_complete(sk, hdev->id, 5962 MGMT_OP_START_SERVICE_DISCOVERY, 5963 MGMT_STATUS_BUSY, &cp->type, 5964 sizeof(cp->type)); 5965 goto failed; 5966 } 5967 5968 uuid_count = __le16_to_cpu(cp->uuid_count); 5969 if (uuid_count > max_uuid_count) { 5970 bt_dev_err(hdev, "service_discovery: too big uuid_count value %u", 5971 uuid_count); 5972 err = mgmt_cmd_complete(sk, hdev->id, 5973 MGMT_OP_START_SERVICE_DISCOVERY, 5974 MGMT_STATUS_INVALID_PARAMS, &cp->type, 5975 sizeof(cp->type)); 5976 goto failed; 5977 } 5978 5979 expected_len = sizeof(*cp) + uuid_count * 16; 5980 if (expected_len != len) { 5981 bt_dev_err(hdev, "service_discovery: expected %u bytes, got %u bytes", 5982 expected_len, len); 5983 err = mgmt_cmd_complete(sk, hdev->id, 5984 MGMT_OP_START_SERVICE_DISCOVERY, 5985 MGMT_STATUS_INVALID_PARAMS, &cp->type, 5986 sizeof(cp->type)); 5987 goto failed; 5988 } 5989 5990 if (!discovery_type_is_valid(hdev, cp->type, &status)) { 5991 err = mgmt_cmd_complete(sk, hdev->id, 5992 MGMT_OP_START_SERVICE_DISCOVERY, 5993 status, &cp->type, sizeof(cp->type)); 5994 goto failed; 5995 } 5996 5997 cmd = mgmt_pending_add(sk, MGMT_OP_START_SERVICE_DISCOVERY, 5998 hdev, data, len); 5999 if (!cmd) { 6000 err = -ENOMEM; 6001 goto failed; 6002 } 6003 6004 /* Clear the discovery filter first to free any previously 6005 * allocated memory for the UUID list. 6006 */ 6007 hci_discovery_filter_clear(hdev); 6008 6009 hdev->discovery.result_filtering = true; 6010 hdev->discovery.type = cp->type; 6011 hdev->discovery.rssi = cp->rssi; 6012 hdev->discovery.uuid_count = uuid_count; 6013 6014 if (uuid_count > 0) { 6015 hdev->discovery.uuids = kmemdup(cp->uuids, uuid_count * 16, 6016 GFP_KERNEL); 6017 if (!hdev->discovery.uuids) { 6018 err = mgmt_cmd_complete(sk, hdev->id, 6019 MGMT_OP_START_SERVICE_DISCOVERY, 6020 MGMT_STATUS_FAILED, 6021 &cp->type, sizeof(cp->type)); 6022 mgmt_pending_remove(cmd); 6023 goto failed; 6024 } 6025 } 6026 6027 err = hci_cmd_sync_queue(hdev, start_discovery_sync, cmd, 6028 start_discovery_complete); 6029 if (err < 0) { 6030 mgmt_pending_remove(cmd); 6031 goto failed; 6032 } 6033 6034 hci_discovery_set_state(hdev, DISCOVERY_STARTING); 6035 6036 failed: 6037 hci_dev_unlock(hdev); 6038 return err; 6039 } 6040 6041 void mgmt_stop_discovery_complete(struct hci_dev *hdev, u8 status) 6042 { 6043 struct mgmt_pending_cmd *cmd; 6044 6045 bt_dev_dbg(hdev, "status %u", status); 6046 6047 hci_dev_lock(hdev); 6048 6049 cmd = pending_find(MGMT_OP_STOP_DISCOVERY, hdev); 6050 if (cmd) { 6051 cmd->cmd_complete(cmd, mgmt_status(status)); 6052 mgmt_pending_remove(cmd); 6053 } 6054 6055 hci_dev_unlock(hdev); 6056 } 6057 6058 static void stop_discovery_complete(struct hci_dev *hdev, void *data, int err) 6059 { 6060 struct mgmt_pending_cmd *cmd = data; 6061 6062 if (cmd != pending_find(MGMT_OP_STOP_DISCOVERY, hdev)) 6063 return; 6064 6065 bt_dev_dbg(hdev, "err %d", err); 6066 6067 mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, mgmt_status(err), 6068 cmd->param, 1); 6069 mgmt_pending_remove(cmd); 6070 6071 if (!err) 6072 hci_discovery_set_state(hdev, DISCOVERY_STOPPED); 6073 } 6074 6075 static int stop_discovery_sync(struct hci_dev *hdev, void *data) 6076 { 6077 return hci_stop_discovery_sync(hdev); 6078 } 6079 6080 static int stop_discovery(struct sock *sk, struct hci_dev *hdev, void *data, 6081 u16 len) 6082 { 6083 struct mgmt_cp_stop_discovery *mgmt_cp = data; 6084 struct mgmt_pending_cmd *cmd; 6085 int err; 6086 6087 bt_dev_dbg(hdev, "sock %p", sk); 6088 6089 hci_dev_lock(hdev); 6090 6091 if (!hci_discovery_active(hdev)) { 6092 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY, 6093 MGMT_STATUS_REJECTED, &mgmt_cp->type, 6094 sizeof(mgmt_cp->type)); 6095 goto unlock; 6096 } 6097 6098 if (hdev->discovery.type != mgmt_cp->type) { 6099 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY, 6100 MGMT_STATUS_INVALID_PARAMS, 6101 &mgmt_cp->type, sizeof(mgmt_cp->type)); 6102 goto unlock; 6103 } 6104 6105 cmd = mgmt_pending_add(sk, MGMT_OP_STOP_DISCOVERY, hdev, data, len); 6106 if (!cmd) { 6107 err = -ENOMEM; 6108 goto unlock; 6109 } 6110 6111 err = hci_cmd_sync_queue(hdev, stop_discovery_sync, cmd, 6112 stop_discovery_complete); 6113 if (err < 0) { 6114 mgmt_pending_remove(cmd); 6115 goto unlock; 6116 } 6117 6118 hci_discovery_set_state(hdev, DISCOVERY_STOPPING); 6119 6120 unlock: 6121 hci_dev_unlock(hdev); 6122 return err; 6123 } 6124 6125 static int confirm_name(struct sock *sk, struct hci_dev *hdev, void *data, 6126 u16 len) 6127 { 6128 struct mgmt_cp_confirm_name *cp = data; 6129 struct inquiry_entry *e; 6130 int err; 6131 6132 bt_dev_dbg(hdev, "sock %p", sk); 6133 6134 hci_dev_lock(hdev); 6135 6136 if (!hci_discovery_active(hdev)) { 6137 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME, 6138 MGMT_STATUS_FAILED, &cp->addr, 6139 sizeof(cp->addr)); 6140 goto failed; 6141 } 6142 6143 e = hci_inquiry_cache_lookup_unknown(hdev, &cp->addr.bdaddr); 6144 if (!e) { 6145 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME, 6146 MGMT_STATUS_INVALID_PARAMS, &cp->addr, 6147 sizeof(cp->addr)); 6148 goto failed; 6149 } 6150 6151 if (cp->name_known) { 6152 e->name_state = NAME_KNOWN; 6153 list_del(&e->list); 6154 } else { 6155 e->name_state = NAME_NEEDED; 6156 hci_inquiry_cache_update_resolve(hdev, e); 6157 } 6158 6159 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME, 0, 6160 &cp->addr, sizeof(cp->addr)); 6161 6162 failed: 6163 hci_dev_unlock(hdev); 6164 return err; 6165 } 6166 6167 static int block_device(struct sock *sk, struct hci_dev *hdev, void *data, 6168 u16 len) 6169 { 6170 struct mgmt_cp_block_device *cp = data; 6171 u8 status; 6172 int err; 6173 6174 bt_dev_dbg(hdev, "sock %p", sk); 6175 6176 if (!bdaddr_type_is_valid(cp->addr.type)) 6177 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_BLOCK_DEVICE, 6178 MGMT_STATUS_INVALID_PARAMS, 6179 &cp->addr, sizeof(cp->addr)); 6180 6181 hci_dev_lock(hdev); 6182 6183 err = hci_bdaddr_list_add(&hdev->reject_list, &cp->addr.bdaddr, 6184 cp->addr.type); 6185 if (err < 0) { 6186 status = MGMT_STATUS_FAILED; 6187 goto done; 6188 } 6189 6190 mgmt_event(MGMT_EV_DEVICE_BLOCKED, hdev, &cp->addr, sizeof(cp->addr), 6191 sk); 6192 status = MGMT_STATUS_SUCCESS; 6193 6194 done: 6195 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_BLOCK_DEVICE, status, 6196 &cp->addr, sizeof(cp->addr)); 6197 6198 hci_dev_unlock(hdev); 6199 6200 return err; 6201 } 6202 6203 static int unblock_device(struct sock *sk, struct hci_dev *hdev, void *data, 6204 u16 len) 6205 { 6206 struct mgmt_cp_unblock_device *cp = data; 6207 u8 status; 6208 int err; 6209 6210 bt_dev_dbg(hdev, "sock %p", sk); 6211 6212 if (!bdaddr_type_is_valid(cp->addr.type)) 6213 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNBLOCK_DEVICE, 6214 MGMT_STATUS_INVALID_PARAMS, 6215 &cp->addr, sizeof(cp->addr)); 6216 6217 hci_dev_lock(hdev); 6218 6219 err = hci_bdaddr_list_del(&hdev->reject_list, &cp->addr.bdaddr, 6220 cp->addr.type); 6221 if (err < 0) { 6222 status = MGMT_STATUS_INVALID_PARAMS; 6223 goto done; 6224 } 6225 6226 mgmt_event(MGMT_EV_DEVICE_UNBLOCKED, hdev, &cp->addr, sizeof(cp->addr), 6227 sk); 6228 status = MGMT_STATUS_SUCCESS; 6229 6230 done: 6231 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNBLOCK_DEVICE, status, 6232 &cp->addr, sizeof(cp->addr)); 6233 6234 hci_dev_unlock(hdev); 6235 6236 return err; 6237 } 6238 6239 static int set_device_id_sync(struct hci_dev *hdev, void *data) 6240 { 6241 return hci_update_eir_sync(hdev); 6242 } 6243 6244 static int set_device_id(struct sock *sk, struct hci_dev *hdev, void *data, 6245 u16 len) 6246 { 6247 struct mgmt_cp_set_device_id *cp = data; 6248 int err; 6249 __u16 source; 6250 6251 bt_dev_dbg(hdev, "sock %p", sk); 6252 6253 source = __le16_to_cpu(cp->source); 6254 6255 if (source > 0x0002) 6256 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEVICE_ID, 6257 MGMT_STATUS_INVALID_PARAMS); 6258 6259 hci_dev_lock(hdev); 6260 6261 hdev->devid_source = source; 6262 hdev->devid_vendor = __le16_to_cpu(cp->vendor); 6263 hdev->devid_product = __le16_to_cpu(cp->product); 6264 hdev->devid_version = __le16_to_cpu(cp->version); 6265 6266 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_DEVICE_ID, 0, 6267 NULL, 0); 6268 6269 hci_cmd_sync_queue(hdev, set_device_id_sync, NULL, NULL); 6270 6271 hci_dev_unlock(hdev); 6272 6273 return err; 6274 } 6275 6276 static void enable_advertising_instance(struct hci_dev *hdev, int err) 6277 { 6278 if (err) 6279 bt_dev_err(hdev, "failed to re-configure advertising %d", err); 6280 else 6281 bt_dev_dbg(hdev, "status %d", err); 6282 } 6283 6284 static void set_advertising_complete(struct hci_dev *hdev, void *data, int err) 6285 { 6286 struct cmd_lookup match = { NULL, hdev }; 6287 u8 instance; 6288 struct adv_info *adv_instance; 6289 u8 status = mgmt_status(err); 6290 6291 if (status) { 6292 mgmt_pending_foreach(MGMT_OP_SET_ADVERTISING, hdev, 6293 cmd_status_rsp, &status); 6294 return; 6295 } 6296 6297 if (hci_dev_test_flag(hdev, HCI_LE_ADV)) 6298 hci_dev_set_flag(hdev, HCI_ADVERTISING); 6299 else 6300 hci_dev_clear_flag(hdev, HCI_ADVERTISING); 6301 6302 mgmt_pending_foreach(MGMT_OP_SET_ADVERTISING, hdev, settings_rsp, 6303 &match); 6304 6305 new_settings(hdev, match.sk); 6306 6307 if (match.sk) 6308 sock_put(match.sk); 6309 6310 /* If "Set Advertising" was just disabled and instance advertising was 6311 * set up earlier, then re-enable multi-instance advertising. 6312 */ 6313 if (hci_dev_test_flag(hdev, HCI_ADVERTISING) || 6314 list_empty(&hdev->adv_instances)) 6315 return; 6316 6317 instance = hdev->cur_adv_instance; 6318 if (!instance) { 6319 adv_instance = list_first_entry_or_null(&hdev->adv_instances, 6320 struct adv_info, list); 6321 if (!adv_instance) 6322 return; 6323 6324 instance = adv_instance->instance; 6325 } 6326 6327 err = hci_schedule_adv_instance_sync(hdev, instance, true); 6328 6329 enable_advertising_instance(hdev, err); 6330 } 6331 6332 static int set_adv_sync(struct hci_dev *hdev, void *data) 6333 { 6334 struct mgmt_pending_cmd *cmd = data; 6335 struct mgmt_mode *cp = cmd->param; 6336 u8 val = !!cp->val; 6337 6338 if (cp->val == 0x02) 6339 hci_dev_set_flag(hdev, HCI_ADVERTISING_CONNECTABLE); 6340 else 6341 hci_dev_clear_flag(hdev, HCI_ADVERTISING_CONNECTABLE); 6342 6343 cancel_adv_timeout(hdev); 6344 6345 if (val) { 6346 /* Switch to instance "0" for the Set Advertising setting. 6347 * We cannot use update_[adv|scan_rsp]_data() here as the 6348 * HCI_ADVERTISING flag is not yet set. 6349 */ 6350 hdev->cur_adv_instance = 0x00; 6351 6352 if (ext_adv_capable(hdev)) { 6353 hci_start_ext_adv_sync(hdev, 0x00); 6354 } else { 6355 hci_update_adv_data_sync(hdev, 0x00); 6356 hci_update_scan_rsp_data_sync(hdev, 0x00); 6357 hci_enable_advertising_sync(hdev); 6358 } 6359 } else { 6360 hci_disable_advertising_sync(hdev); 6361 } 6362 6363 return 0; 6364 } 6365 6366 static int set_advertising(struct sock *sk, struct hci_dev *hdev, void *data, 6367 u16 len) 6368 { 6369 struct mgmt_mode *cp = data; 6370 struct mgmt_pending_cmd *cmd; 6371 u8 val, status; 6372 int err; 6373 6374 bt_dev_dbg(hdev, "sock %p", sk); 6375 6376 status = mgmt_le_support(hdev); 6377 if (status) 6378 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING, 6379 status); 6380 6381 if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02) 6382 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING, 6383 MGMT_STATUS_INVALID_PARAMS); 6384 6385 if (hdev->advertising_paused) 6386 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING, 6387 MGMT_STATUS_BUSY); 6388 6389 hci_dev_lock(hdev); 6390 6391 val = !!cp->val; 6392 6393 /* The following conditions are ones which mean that we should 6394 * not do any HCI communication but directly send a mgmt 6395 * response to user space (after toggling the flag if 6396 * necessary). 6397 */ 6398 if (!hdev_is_powered(hdev) || 6399 (val == hci_dev_test_flag(hdev, HCI_ADVERTISING) && 6400 (cp->val == 0x02) == hci_dev_test_flag(hdev, HCI_ADVERTISING_CONNECTABLE)) || 6401 hci_dev_test_flag(hdev, HCI_MESH) || 6402 hci_conn_num(hdev, LE_LINK) > 0 || 6403 (hci_dev_test_flag(hdev, HCI_LE_SCAN) && 6404 hdev->le_scan_type == LE_SCAN_ACTIVE)) { 6405 bool changed; 6406 6407 if (cp->val) { 6408 hdev->cur_adv_instance = 0x00; 6409 changed = !hci_dev_test_and_set_flag(hdev, HCI_ADVERTISING); 6410 if (cp->val == 0x02) 6411 hci_dev_set_flag(hdev, HCI_ADVERTISING_CONNECTABLE); 6412 else 6413 hci_dev_clear_flag(hdev, HCI_ADVERTISING_CONNECTABLE); 6414 } else { 6415 changed = hci_dev_test_and_clear_flag(hdev, HCI_ADVERTISING); 6416 hci_dev_clear_flag(hdev, HCI_ADVERTISING_CONNECTABLE); 6417 } 6418 6419 err = send_settings_rsp(sk, MGMT_OP_SET_ADVERTISING, hdev); 6420 if (err < 0) 6421 goto unlock; 6422 6423 if (changed) 6424 err = new_settings(hdev, sk); 6425 6426 goto unlock; 6427 } 6428 6429 if (pending_find(MGMT_OP_SET_ADVERTISING, hdev) || 6430 pending_find(MGMT_OP_SET_LE, hdev)) { 6431 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING, 6432 MGMT_STATUS_BUSY); 6433 goto unlock; 6434 } 6435 6436 cmd = mgmt_pending_add(sk, MGMT_OP_SET_ADVERTISING, hdev, data, len); 6437 if (!cmd) 6438 err = -ENOMEM; 6439 else 6440 err = hci_cmd_sync_queue(hdev, set_adv_sync, cmd, 6441 set_advertising_complete); 6442 6443 if (err < 0 && cmd) 6444 mgmt_pending_remove(cmd); 6445 6446 unlock: 6447 hci_dev_unlock(hdev); 6448 return err; 6449 } 6450 6451 static int set_static_address(struct sock *sk, struct hci_dev *hdev, 6452 void *data, u16 len) 6453 { 6454 struct mgmt_cp_set_static_address *cp = data; 6455 int err; 6456 6457 bt_dev_dbg(hdev, "sock %p", sk); 6458 6459 if (!lmp_le_capable(hdev)) 6460 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_STATIC_ADDRESS, 6461 MGMT_STATUS_NOT_SUPPORTED); 6462 6463 if (hdev_is_powered(hdev)) 6464 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_STATIC_ADDRESS, 6465 MGMT_STATUS_REJECTED); 6466 6467 if (bacmp(&cp->bdaddr, BDADDR_ANY)) { 6468 if (!bacmp(&cp->bdaddr, BDADDR_NONE)) 6469 return mgmt_cmd_status(sk, hdev->id, 6470 MGMT_OP_SET_STATIC_ADDRESS, 6471 MGMT_STATUS_INVALID_PARAMS); 6472 6473 /* Two most significant bits shall be set */ 6474 if ((cp->bdaddr.b[5] & 0xc0) != 0xc0) 6475 return mgmt_cmd_status(sk, hdev->id, 6476 MGMT_OP_SET_STATIC_ADDRESS, 6477 MGMT_STATUS_INVALID_PARAMS); 6478 } 6479 6480 hci_dev_lock(hdev); 6481 6482 bacpy(&hdev->static_addr, &cp->bdaddr); 6483 6484 err = send_settings_rsp(sk, MGMT_OP_SET_STATIC_ADDRESS, hdev); 6485 if (err < 0) 6486 goto unlock; 6487 6488 err = new_settings(hdev, sk); 6489 6490 unlock: 6491 hci_dev_unlock(hdev); 6492 return err; 6493 } 6494 6495 static int set_scan_params(struct sock *sk, struct hci_dev *hdev, 6496 void *data, u16 len) 6497 { 6498 struct mgmt_cp_set_scan_params *cp = data; 6499 __u16 interval, window; 6500 int err; 6501 6502 bt_dev_dbg(hdev, "sock %p", sk); 6503 6504 if (!lmp_le_capable(hdev)) 6505 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS, 6506 MGMT_STATUS_NOT_SUPPORTED); 6507 6508 interval = __le16_to_cpu(cp->interval); 6509 6510 if (interval < 0x0004 || interval > 0x4000) 6511 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS, 6512 MGMT_STATUS_INVALID_PARAMS); 6513 6514 window = __le16_to_cpu(cp->window); 6515 6516 if (window < 0x0004 || window > 0x4000) 6517 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS, 6518 MGMT_STATUS_INVALID_PARAMS); 6519 6520 if (window > interval) 6521 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS, 6522 MGMT_STATUS_INVALID_PARAMS); 6523 6524 hci_dev_lock(hdev); 6525 6526 hdev->le_scan_interval = interval; 6527 hdev->le_scan_window = window; 6528 6529 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS, 0, 6530 NULL, 0); 6531 6532 /* If background scan is running, restart it so new parameters are 6533 * loaded. 6534 */ 6535 if (hci_dev_test_flag(hdev, HCI_LE_SCAN) && 6536 hdev->discovery.state == DISCOVERY_STOPPED) 6537 hci_update_passive_scan(hdev); 6538 6539 hci_dev_unlock(hdev); 6540 6541 return err; 6542 } 6543 6544 static void fast_connectable_complete(struct hci_dev *hdev, void *data, int err) 6545 { 6546 struct mgmt_pending_cmd *cmd = data; 6547 6548 bt_dev_dbg(hdev, "err %d", err); 6549 6550 if (err) { 6551 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE, 6552 mgmt_status(err)); 6553 } else { 6554 struct mgmt_mode *cp = cmd->param; 6555 6556 if (cp->val) 6557 hci_dev_set_flag(hdev, HCI_FAST_CONNECTABLE); 6558 else 6559 hci_dev_clear_flag(hdev, HCI_FAST_CONNECTABLE); 6560 6561 send_settings_rsp(cmd->sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev); 6562 new_settings(hdev, cmd->sk); 6563 } 6564 6565 mgmt_pending_free(cmd); 6566 } 6567 6568 static int write_fast_connectable_sync(struct hci_dev *hdev, void *data) 6569 { 6570 struct mgmt_pending_cmd *cmd = data; 6571 struct mgmt_mode *cp = cmd->param; 6572 6573 return hci_write_fast_connectable_sync(hdev, cp->val); 6574 } 6575 6576 static int set_fast_connectable(struct sock *sk, struct hci_dev *hdev, 6577 void *data, u16 len) 6578 { 6579 struct mgmt_mode *cp = data; 6580 struct mgmt_pending_cmd *cmd; 6581 int err; 6582 6583 bt_dev_dbg(hdev, "sock %p", sk); 6584 6585 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) || 6586 hdev->hci_ver < BLUETOOTH_VER_1_2) 6587 return mgmt_cmd_status(sk, hdev->id, 6588 MGMT_OP_SET_FAST_CONNECTABLE, 6589 MGMT_STATUS_NOT_SUPPORTED); 6590 6591 if (cp->val != 0x00 && cp->val != 0x01) 6592 return mgmt_cmd_status(sk, hdev->id, 6593 MGMT_OP_SET_FAST_CONNECTABLE, 6594 MGMT_STATUS_INVALID_PARAMS); 6595 6596 hci_dev_lock(hdev); 6597 6598 if (!!cp->val == hci_dev_test_flag(hdev, HCI_FAST_CONNECTABLE)) { 6599 err = send_settings_rsp(sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev); 6600 goto unlock; 6601 } 6602 6603 if (!hdev_is_powered(hdev)) { 6604 hci_dev_change_flag(hdev, HCI_FAST_CONNECTABLE); 6605 err = send_settings_rsp(sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev); 6606 new_settings(hdev, sk); 6607 goto unlock; 6608 } 6609 6610 cmd = mgmt_pending_new(sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev, data, 6611 len); 6612 if (!cmd) 6613 err = -ENOMEM; 6614 else 6615 err = hci_cmd_sync_queue(hdev, write_fast_connectable_sync, cmd, 6616 fast_connectable_complete); 6617 6618 if (err < 0) { 6619 mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE, 6620 MGMT_STATUS_FAILED); 6621 6622 if (cmd) 6623 mgmt_pending_free(cmd); 6624 } 6625 6626 unlock: 6627 hci_dev_unlock(hdev); 6628 6629 return err; 6630 } 6631 6632 static void set_bredr_complete(struct hci_dev *hdev, void *data, int err) 6633 { 6634 struct mgmt_pending_cmd *cmd = data; 6635 6636 bt_dev_dbg(hdev, "err %d", err); 6637 6638 if (err) { 6639 u8 mgmt_err = mgmt_status(err); 6640 6641 /* We need to restore the flag if related HCI commands 6642 * failed. 6643 */ 6644 hci_dev_clear_flag(hdev, HCI_BREDR_ENABLED); 6645 6646 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err); 6647 } else { 6648 send_settings_rsp(cmd->sk, MGMT_OP_SET_BREDR, hdev); 6649 new_settings(hdev, cmd->sk); 6650 } 6651 6652 mgmt_pending_free(cmd); 6653 } 6654 6655 static int set_bredr_sync(struct hci_dev *hdev, void *data) 6656 { 6657 int status; 6658 6659 status = hci_write_fast_connectable_sync(hdev, false); 6660 6661 if (!status) 6662 status = hci_update_scan_sync(hdev); 6663 6664 /* Since only the advertising data flags will change, there 6665 * is no need to update the scan response data. 6666 */ 6667 if (!status) 6668 status = hci_update_adv_data_sync(hdev, hdev->cur_adv_instance); 6669 6670 return status; 6671 } 6672 6673 static int set_bredr(struct sock *sk, struct hci_dev *hdev, void *data, u16 len) 6674 { 6675 struct mgmt_mode *cp = data; 6676 struct mgmt_pending_cmd *cmd; 6677 int err; 6678 6679 bt_dev_dbg(hdev, "sock %p", sk); 6680 6681 if (!lmp_bredr_capable(hdev) || !lmp_le_capable(hdev)) 6682 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR, 6683 MGMT_STATUS_NOT_SUPPORTED); 6684 6685 if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED)) 6686 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR, 6687 MGMT_STATUS_REJECTED); 6688 6689 if (cp->val != 0x00 && cp->val != 0x01) 6690 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR, 6691 MGMT_STATUS_INVALID_PARAMS); 6692 6693 hci_dev_lock(hdev); 6694 6695 if (cp->val == hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) { 6696 err = send_settings_rsp(sk, MGMT_OP_SET_BREDR, hdev); 6697 goto unlock; 6698 } 6699 6700 if (!hdev_is_powered(hdev)) { 6701 if (!cp->val) { 6702 hci_dev_clear_flag(hdev, HCI_DISCOVERABLE); 6703 hci_dev_clear_flag(hdev, HCI_SSP_ENABLED); 6704 hci_dev_clear_flag(hdev, HCI_LINK_SECURITY); 6705 hci_dev_clear_flag(hdev, HCI_FAST_CONNECTABLE); 6706 } 6707 6708 hci_dev_change_flag(hdev, HCI_BREDR_ENABLED); 6709 6710 err = send_settings_rsp(sk, MGMT_OP_SET_BREDR, hdev); 6711 if (err < 0) 6712 goto unlock; 6713 6714 err = new_settings(hdev, sk); 6715 goto unlock; 6716 } 6717 6718 /* Reject disabling when powered on */ 6719 if (!cp->val) { 6720 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR, 6721 MGMT_STATUS_REJECTED); 6722 goto unlock; 6723 } else { 6724 /* When configuring a dual-mode controller to operate 6725 * with LE only and using a static address, then switching 6726 * BR/EDR back on is not allowed. 6727 * 6728 * Dual-mode controllers shall operate with the public 6729 * address as its identity address for BR/EDR and LE. So 6730 * reject the attempt to create an invalid configuration. 6731 * 6732 * The same restrictions applies when secure connections 6733 * has been enabled. For BR/EDR this is a controller feature 6734 * while for LE it is a host stack feature. This means that 6735 * switching BR/EDR back on when secure connections has been 6736 * enabled is not a supported transaction. 6737 */ 6738 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) && 6739 (bacmp(&hdev->static_addr, BDADDR_ANY) || 6740 hci_dev_test_flag(hdev, HCI_SC_ENABLED))) { 6741 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR, 6742 MGMT_STATUS_REJECTED); 6743 goto unlock; 6744 } 6745 } 6746 6747 cmd = mgmt_pending_new(sk, MGMT_OP_SET_BREDR, hdev, data, len); 6748 if (!cmd) 6749 err = -ENOMEM; 6750 else 6751 err = hci_cmd_sync_queue(hdev, set_bredr_sync, cmd, 6752 set_bredr_complete); 6753 6754 if (err < 0) { 6755 mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR, 6756 MGMT_STATUS_FAILED); 6757 if (cmd) 6758 mgmt_pending_free(cmd); 6759 6760 goto unlock; 6761 } 6762 6763 /* We need to flip the bit already here so that 6764 * hci_req_update_adv_data generates the correct flags. 6765 */ 6766 hci_dev_set_flag(hdev, HCI_BREDR_ENABLED); 6767 6768 unlock: 6769 hci_dev_unlock(hdev); 6770 return err; 6771 } 6772 6773 static void set_secure_conn_complete(struct hci_dev *hdev, void *data, int err) 6774 { 6775 struct mgmt_pending_cmd *cmd = data; 6776 struct mgmt_mode *cp; 6777 6778 bt_dev_dbg(hdev, "err %d", err); 6779 6780 if (err) { 6781 u8 mgmt_err = mgmt_status(err); 6782 6783 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, mgmt_err); 6784 goto done; 6785 } 6786 6787 cp = cmd->param; 6788 6789 switch (cp->val) { 6790 case 0x00: 6791 hci_dev_clear_flag(hdev, HCI_SC_ENABLED); 6792 hci_dev_clear_flag(hdev, HCI_SC_ONLY); 6793 break; 6794 case 0x01: 6795 hci_dev_set_flag(hdev, HCI_SC_ENABLED); 6796 hci_dev_clear_flag(hdev, HCI_SC_ONLY); 6797 break; 6798 case 0x02: 6799 hci_dev_set_flag(hdev, HCI_SC_ENABLED); 6800 hci_dev_set_flag(hdev, HCI_SC_ONLY); 6801 break; 6802 } 6803 6804 send_settings_rsp(cmd->sk, cmd->opcode, hdev); 6805 new_settings(hdev, cmd->sk); 6806 6807 done: 6808 mgmt_pending_free(cmd); 6809 } 6810 6811 static int set_secure_conn_sync(struct hci_dev *hdev, void *data) 6812 { 6813 struct mgmt_pending_cmd *cmd = data; 6814 struct mgmt_mode *cp = cmd->param; 6815 u8 val = !!cp->val; 6816 6817 /* Force write of val */ 6818 hci_dev_set_flag(hdev, HCI_SC_ENABLED); 6819 6820 return hci_write_sc_support_sync(hdev, val); 6821 } 6822 6823 static int set_secure_conn(struct sock *sk, struct hci_dev *hdev, 6824 void *data, u16 len) 6825 { 6826 struct mgmt_mode *cp = data; 6827 struct mgmt_pending_cmd *cmd; 6828 u8 val; 6829 int err; 6830 6831 bt_dev_dbg(hdev, "sock %p", sk); 6832 6833 if (!lmp_sc_capable(hdev) && 6834 !hci_dev_test_flag(hdev, HCI_LE_ENABLED)) 6835 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN, 6836 MGMT_STATUS_NOT_SUPPORTED); 6837 6838 if (hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) && 6839 lmp_sc_capable(hdev) && 6840 !hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) 6841 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN, 6842 MGMT_STATUS_REJECTED); 6843 6844 if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02) 6845 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN, 6846 MGMT_STATUS_INVALID_PARAMS); 6847 6848 hci_dev_lock(hdev); 6849 6850 if (!hdev_is_powered(hdev) || !lmp_sc_capable(hdev) || 6851 !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) { 6852 bool changed; 6853 6854 if (cp->val) { 6855 changed = !hci_dev_test_and_set_flag(hdev, 6856 HCI_SC_ENABLED); 6857 if (cp->val == 0x02) 6858 hci_dev_set_flag(hdev, HCI_SC_ONLY); 6859 else 6860 hci_dev_clear_flag(hdev, HCI_SC_ONLY); 6861 } else { 6862 changed = hci_dev_test_and_clear_flag(hdev, 6863 HCI_SC_ENABLED); 6864 hci_dev_clear_flag(hdev, HCI_SC_ONLY); 6865 } 6866 6867 err = send_settings_rsp(sk, MGMT_OP_SET_SECURE_CONN, hdev); 6868 if (err < 0) 6869 goto failed; 6870 6871 if (changed) 6872 err = new_settings(hdev, sk); 6873 6874 goto failed; 6875 } 6876 6877 val = !!cp->val; 6878 6879 if (val == hci_dev_test_flag(hdev, HCI_SC_ENABLED) && 6880 (cp->val == 0x02) == hci_dev_test_flag(hdev, HCI_SC_ONLY)) { 6881 err = send_settings_rsp(sk, MGMT_OP_SET_SECURE_CONN, hdev); 6882 goto failed; 6883 } 6884 6885 cmd = mgmt_pending_new(sk, MGMT_OP_SET_SECURE_CONN, hdev, data, len); 6886 if (!cmd) 6887 err = -ENOMEM; 6888 else 6889 err = hci_cmd_sync_queue(hdev, set_secure_conn_sync, cmd, 6890 set_secure_conn_complete); 6891 6892 if (err < 0) { 6893 mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN, 6894 MGMT_STATUS_FAILED); 6895 if (cmd) 6896 mgmt_pending_free(cmd); 6897 } 6898 6899 failed: 6900 hci_dev_unlock(hdev); 6901 return err; 6902 } 6903 6904 static int set_debug_keys(struct sock *sk, struct hci_dev *hdev, 6905 void *data, u16 len) 6906 { 6907 struct mgmt_mode *cp = data; 6908 bool changed, use_changed; 6909 int err; 6910 6911 bt_dev_dbg(hdev, "sock %p", sk); 6912 6913 if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02) 6914 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEBUG_KEYS, 6915 MGMT_STATUS_INVALID_PARAMS); 6916 6917 hci_dev_lock(hdev); 6918 6919 if (cp->val) 6920 changed = !hci_dev_test_and_set_flag(hdev, HCI_KEEP_DEBUG_KEYS); 6921 else 6922 changed = hci_dev_test_and_clear_flag(hdev, 6923 HCI_KEEP_DEBUG_KEYS); 6924 6925 if (cp->val == 0x02) 6926 use_changed = !hci_dev_test_and_set_flag(hdev, 6927 HCI_USE_DEBUG_KEYS); 6928 else 6929 use_changed = hci_dev_test_and_clear_flag(hdev, 6930 HCI_USE_DEBUG_KEYS); 6931 6932 if (hdev_is_powered(hdev) && use_changed && 6933 hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) { 6934 u8 mode = (cp->val == 0x02) ? 0x01 : 0x00; 6935 hci_send_cmd(hdev, HCI_OP_WRITE_SSP_DEBUG_MODE, 6936 sizeof(mode), &mode); 6937 } 6938 6939 err = send_settings_rsp(sk, MGMT_OP_SET_DEBUG_KEYS, hdev); 6940 if (err < 0) 6941 goto unlock; 6942 6943 if (changed) 6944 err = new_settings(hdev, sk); 6945 6946 unlock: 6947 hci_dev_unlock(hdev); 6948 return err; 6949 } 6950 6951 static int set_privacy(struct sock *sk, struct hci_dev *hdev, void *cp_data, 6952 u16 len) 6953 { 6954 struct mgmt_cp_set_privacy *cp = cp_data; 6955 bool changed; 6956 int err; 6957 6958 bt_dev_dbg(hdev, "sock %p", sk); 6959 6960 if (!lmp_le_capable(hdev)) 6961 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY, 6962 MGMT_STATUS_NOT_SUPPORTED); 6963 6964 if (cp->privacy != 0x00 && cp->privacy != 0x01 && cp->privacy != 0x02) 6965 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY, 6966 MGMT_STATUS_INVALID_PARAMS); 6967 6968 if (hdev_is_powered(hdev)) 6969 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY, 6970 MGMT_STATUS_REJECTED); 6971 6972 hci_dev_lock(hdev); 6973 6974 /* If user space supports this command it is also expected to 6975 * handle IRKs. Therefore, set the HCI_RPA_RESOLVING flag. 6976 */ 6977 hci_dev_set_flag(hdev, HCI_RPA_RESOLVING); 6978 6979 if (cp->privacy) { 6980 changed = !hci_dev_test_and_set_flag(hdev, HCI_PRIVACY); 6981 memcpy(hdev->irk, cp->irk, sizeof(hdev->irk)); 6982 hci_dev_set_flag(hdev, HCI_RPA_EXPIRED); 6983 hci_adv_instances_set_rpa_expired(hdev, true); 6984 if (cp->privacy == 0x02) 6985 hci_dev_set_flag(hdev, HCI_LIMITED_PRIVACY); 6986 else 6987 hci_dev_clear_flag(hdev, HCI_LIMITED_PRIVACY); 6988 } else { 6989 changed = hci_dev_test_and_clear_flag(hdev, HCI_PRIVACY); 6990 memset(hdev->irk, 0, sizeof(hdev->irk)); 6991 hci_dev_clear_flag(hdev, HCI_RPA_EXPIRED); 6992 hci_adv_instances_set_rpa_expired(hdev, false); 6993 hci_dev_clear_flag(hdev, HCI_LIMITED_PRIVACY); 6994 } 6995 6996 err = send_settings_rsp(sk, MGMT_OP_SET_PRIVACY, hdev); 6997 if (err < 0) 6998 goto unlock; 6999 7000 if (changed) 7001 err = new_settings(hdev, sk); 7002 7003 unlock: 7004 hci_dev_unlock(hdev); 7005 return err; 7006 } 7007 7008 static bool irk_is_valid(struct mgmt_irk_info *irk) 7009 { 7010 switch (irk->addr.type) { 7011 case BDADDR_LE_PUBLIC: 7012 return true; 7013 7014 case BDADDR_LE_RANDOM: 7015 /* Two most significant bits shall be set */ 7016 if ((irk->addr.bdaddr.b[5] & 0xc0) != 0xc0) 7017 return false; 7018 return true; 7019 } 7020 7021 return false; 7022 } 7023 7024 static int load_irks(struct sock *sk, struct hci_dev *hdev, void *cp_data, 7025 u16 len) 7026 { 7027 struct mgmt_cp_load_irks *cp = cp_data; 7028 const u16 max_irk_count = ((U16_MAX - sizeof(*cp)) / 7029 sizeof(struct mgmt_irk_info)); 7030 u16 irk_count, expected_len; 7031 int i, err; 7032 7033 bt_dev_dbg(hdev, "sock %p", sk); 7034 7035 if (!lmp_le_capable(hdev)) 7036 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS, 7037 MGMT_STATUS_NOT_SUPPORTED); 7038 7039 irk_count = __le16_to_cpu(cp->irk_count); 7040 if (irk_count > max_irk_count) { 7041 bt_dev_err(hdev, "load_irks: too big irk_count value %u", 7042 irk_count); 7043 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS, 7044 MGMT_STATUS_INVALID_PARAMS); 7045 } 7046 7047 expected_len = struct_size(cp, irks, irk_count); 7048 if (expected_len != len) { 7049 bt_dev_err(hdev, "load_irks: expected %u bytes, got %u bytes", 7050 expected_len, len); 7051 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS, 7052 MGMT_STATUS_INVALID_PARAMS); 7053 } 7054 7055 bt_dev_dbg(hdev, "irk_count %u", irk_count); 7056 7057 for (i = 0; i < irk_count; i++) { 7058 struct mgmt_irk_info *key = &cp->irks[i]; 7059 7060 if (!irk_is_valid(key)) 7061 return mgmt_cmd_status(sk, hdev->id, 7062 MGMT_OP_LOAD_IRKS, 7063 MGMT_STATUS_INVALID_PARAMS); 7064 } 7065 7066 hci_dev_lock(hdev); 7067 7068 hci_smp_irks_clear(hdev); 7069 7070 for (i = 0; i < irk_count; i++) { 7071 struct mgmt_irk_info *irk = &cp->irks[i]; 7072 u8 addr_type = le_addr_type(irk->addr.type); 7073 7074 if (hci_is_blocked_key(hdev, 7075 HCI_BLOCKED_KEY_TYPE_IRK, 7076 irk->val)) { 7077 bt_dev_warn(hdev, "Skipping blocked IRK for %pMR", 7078 &irk->addr.bdaddr); 7079 continue; 7080 } 7081 7082 /* When using SMP over BR/EDR, the addr type should be set to BREDR */ 7083 if (irk->addr.type == BDADDR_BREDR) 7084 addr_type = BDADDR_BREDR; 7085 7086 hci_add_irk(hdev, &irk->addr.bdaddr, 7087 addr_type, irk->val, 7088 BDADDR_ANY); 7089 } 7090 7091 hci_dev_set_flag(hdev, HCI_RPA_RESOLVING); 7092 7093 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_IRKS, 0, NULL, 0); 7094 7095 hci_dev_unlock(hdev); 7096 7097 return err; 7098 } 7099 7100 static bool ltk_is_valid(struct mgmt_ltk_info *key) 7101 { 7102 if (key->initiator != 0x00 && key->initiator != 0x01) 7103 return false; 7104 7105 switch (key->addr.type) { 7106 case BDADDR_LE_PUBLIC: 7107 return true; 7108 7109 case BDADDR_LE_RANDOM: 7110 /* Two most significant bits shall be set */ 7111 if ((key->addr.bdaddr.b[5] & 0xc0) != 0xc0) 7112 return false; 7113 return true; 7114 } 7115 7116 return false; 7117 } 7118 7119 static int load_long_term_keys(struct sock *sk, struct hci_dev *hdev, 7120 void *cp_data, u16 len) 7121 { 7122 struct mgmt_cp_load_long_term_keys *cp = cp_data; 7123 const u16 max_key_count = ((U16_MAX - sizeof(*cp)) / 7124 sizeof(struct mgmt_ltk_info)); 7125 u16 key_count, expected_len; 7126 int i, err; 7127 7128 bt_dev_dbg(hdev, "sock %p", sk); 7129 7130 if (!lmp_le_capable(hdev)) 7131 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS, 7132 MGMT_STATUS_NOT_SUPPORTED); 7133 7134 key_count = __le16_to_cpu(cp->key_count); 7135 if (key_count > max_key_count) { 7136 bt_dev_err(hdev, "load_ltks: too big key_count value %u", 7137 key_count); 7138 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS, 7139 MGMT_STATUS_INVALID_PARAMS); 7140 } 7141 7142 expected_len = struct_size(cp, keys, key_count); 7143 if (expected_len != len) { 7144 bt_dev_err(hdev, "load_keys: expected %u bytes, got %u bytes", 7145 expected_len, len); 7146 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS, 7147 MGMT_STATUS_INVALID_PARAMS); 7148 } 7149 7150 bt_dev_dbg(hdev, "key_count %u", key_count); 7151 7152 for (i = 0; i < key_count; i++) { 7153 struct mgmt_ltk_info *key = &cp->keys[i]; 7154 7155 if (!ltk_is_valid(key)) 7156 return mgmt_cmd_status(sk, hdev->id, 7157 MGMT_OP_LOAD_LONG_TERM_KEYS, 7158 MGMT_STATUS_INVALID_PARAMS); 7159 } 7160 7161 hci_dev_lock(hdev); 7162 7163 hci_smp_ltks_clear(hdev); 7164 7165 for (i = 0; i < key_count; i++) { 7166 struct mgmt_ltk_info *key = &cp->keys[i]; 7167 u8 type, authenticated; 7168 u8 addr_type = le_addr_type(key->addr.type); 7169 7170 if (hci_is_blocked_key(hdev, 7171 HCI_BLOCKED_KEY_TYPE_LTK, 7172 key->val)) { 7173 bt_dev_warn(hdev, "Skipping blocked LTK for %pMR", 7174 &key->addr.bdaddr); 7175 continue; 7176 } 7177 7178 switch (key->type) { 7179 case MGMT_LTK_UNAUTHENTICATED: 7180 authenticated = 0x00; 7181 type = key->initiator ? SMP_LTK : SMP_LTK_RESPONDER; 7182 break; 7183 case MGMT_LTK_AUTHENTICATED: 7184 authenticated = 0x01; 7185 type = key->initiator ? SMP_LTK : SMP_LTK_RESPONDER; 7186 break; 7187 case MGMT_LTK_P256_UNAUTH: 7188 authenticated = 0x00; 7189 type = SMP_LTK_P256; 7190 break; 7191 case MGMT_LTK_P256_AUTH: 7192 authenticated = 0x01; 7193 type = SMP_LTK_P256; 7194 break; 7195 case MGMT_LTK_P256_DEBUG: 7196 authenticated = 0x00; 7197 type = SMP_LTK_P256_DEBUG; 7198 fallthrough; 7199 default: 7200 continue; 7201 } 7202 7203 /* When using SMP over BR/EDR, the addr type should be set to BREDR */ 7204 if (key->addr.type == BDADDR_BREDR) 7205 addr_type = BDADDR_BREDR; 7206 7207 hci_add_ltk(hdev, &key->addr.bdaddr, 7208 addr_type, type, authenticated, 7209 key->val, key->enc_size, key->ediv, key->rand); 7210 } 7211 7212 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS, 0, 7213 NULL, 0); 7214 7215 hci_dev_unlock(hdev); 7216 7217 return err; 7218 } 7219 7220 static void get_conn_info_complete(struct hci_dev *hdev, void *data, int err) 7221 { 7222 struct mgmt_pending_cmd *cmd = data; 7223 struct hci_conn *conn = cmd->user_data; 7224 struct mgmt_cp_get_conn_info *cp = cmd->param; 7225 struct mgmt_rp_get_conn_info rp; 7226 u8 status; 7227 7228 bt_dev_dbg(hdev, "err %d", err); 7229 7230 memcpy(&rp.addr, &cp->addr, sizeof(rp.addr)); 7231 7232 status = mgmt_status(err); 7233 if (status == MGMT_STATUS_SUCCESS) { 7234 rp.rssi = conn->rssi; 7235 rp.tx_power = conn->tx_power; 7236 rp.max_tx_power = conn->max_tx_power; 7237 } else { 7238 rp.rssi = HCI_RSSI_INVALID; 7239 rp.tx_power = HCI_TX_POWER_INVALID; 7240 rp.max_tx_power = HCI_TX_POWER_INVALID; 7241 } 7242 7243 mgmt_cmd_complete(cmd->sk, cmd->index, MGMT_OP_GET_CONN_INFO, status, 7244 &rp, sizeof(rp)); 7245 7246 mgmt_pending_free(cmd); 7247 } 7248 7249 static int get_conn_info_sync(struct hci_dev *hdev, void *data) 7250 { 7251 struct mgmt_pending_cmd *cmd = data; 7252 struct mgmt_cp_get_conn_info *cp = cmd->param; 7253 struct hci_conn *conn; 7254 int err; 7255 __le16 handle; 7256 7257 /* Make sure we are still connected */ 7258 if (cp->addr.type == BDADDR_BREDR) 7259 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, 7260 &cp->addr.bdaddr); 7261 else 7262 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &cp->addr.bdaddr); 7263 7264 if (!conn || conn->state != BT_CONNECTED) 7265 return MGMT_STATUS_NOT_CONNECTED; 7266 7267 cmd->user_data = conn; 7268 handle = cpu_to_le16(conn->handle); 7269 7270 /* Refresh RSSI each time */ 7271 err = hci_read_rssi_sync(hdev, handle); 7272 7273 /* For LE links TX power does not change thus we don't need to 7274 * query for it once value is known. 7275 */ 7276 if (!err && (!bdaddr_type_is_le(cp->addr.type) || 7277 conn->tx_power == HCI_TX_POWER_INVALID)) 7278 err = hci_read_tx_power_sync(hdev, handle, 0x00); 7279 7280 /* Max TX power needs to be read only once per connection */ 7281 if (!err && conn->max_tx_power == HCI_TX_POWER_INVALID) 7282 err = hci_read_tx_power_sync(hdev, handle, 0x01); 7283 7284 return err; 7285 } 7286 7287 static int get_conn_info(struct sock *sk, struct hci_dev *hdev, void *data, 7288 u16 len) 7289 { 7290 struct mgmt_cp_get_conn_info *cp = data; 7291 struct mgmt_rp_get_conn_info rp; 7292 struct hci_conn *conn; 7293 unsigned long conn_info_age; 7294 int err = 0; 7295 7296 bt_dev_dbg(hdev, "sock %p", sk); 7297 7298 memset(&rp, 0, sizeof(rp)); 7299 bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr); 7300 rp.addr.type = cp->addr.type; 7301 7302 if (!bdaddr_type_is_valid(cp->addr.type)) 7303 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO, 7304 MGMT_STATUS_INVALID_PARAMS, 7305 &rp, sizeof(rp)); 7306 7307 hci_dev_lock(hdev); 7308 7309 if (!hdev_is_powered(hdev)) { 7310 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO, 7311 MGMT_STATUS_NOT_POWERED, &rp, 7312 sizeof(rp)); 7313 goto unlock; 7314 } 7315 7316 if (cp->addr.type == BDADDR_BREDR) 7317 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, 7318 &cp->addr.bdaddr); 7319 else 7320 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &cp->addr.bdaddr); 7321 7322 if (!conn || conn->state != BT_CONNECTED) { 7323 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO, 7324 MGMT_STATUS_NOT_CONNECTED, &rp, 7325 sizeof(rp)); 7326 goto unlock; 7327 } 7328 7329 /* To avoid client trying to guess when to poll again for information we 7330 * calculate conn info age as random value between min/max set in hdev. 7331 */ 7332 conn_info_age = get_random_u32_inclusive(hdev->conn_info_min_age, 7333 hdev->conn_info_max_age - 1); 7334 7335 /* Query controller to refresh cached values if they are too old or were 7336 * never read. 7337 */ 7338 if (time_after(jiffies, conn->conn_info_timestamp + 7339 msecs_to_jiffies(conn_info_age)) || 7340 !conn->conn_info_timestamp) { 7341 struct mgmt_pending_cmd *cmd; 7342 7343 cmd = mgmt_pending_new(sk, MGMT_OP_GET_CONN_INFO, hdev, data, 7344 len); 7345 if (!cmd) { 7346 err = -ENOMEM; 7347 } else { 7348 err = hci_cmd_sync_queue(hdev, get_conn_info_sync, 7349 cmd, get_conn_info_complete); 7350 } 7351 7352 if (err < 0) { 7353 mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO, 7354 MGMT_STATUS_FAILED, &rp, sizeof(rp)); 7355 7356 if (cmd) 7357 mgmt_pending_free(cmd); 7358 7359 goto unlock; 7360 } 7361 7362 conn->conn_info_timestamp = jiffies; 7363 } else { 7364 /* Cache is valid, just reply with values cached in hci_conn */ 7365 rp.rssi = conn->rssi; 7366 rp.tx_power = conn->tx_power; 7367 rp.max_tx_power = conn->max_tx_power; 7368 7369 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO, 7370 MGMT_STATUS_SUCCESS, &rp, sizeof(rp)); 7371 } 7372 7373 unlock: 7374 hci_dev_unlock(hdev); 7375 return err; 7376 } 7377 7378 static void get_clock_info_complete(struct hci_dev *hdev, void *data, int err) 7379 { 7380 struct mgmt_pending_cmd *cmd = data; 7381 struct mgmt_cp_get_clock_info *cp = cmd->param; 7382 struct mgmt_rp_get_clock_info rp; 7383 struct hci_conn *conn = cmd->user_data; 7384 u8 status = mgmt_status(err); 7385 7386 bt_dev_dbg(hdev, "err %d", err); 7387 7388 memset(&rp, 0, sizeof(rp)); 7389 bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr); 7390 rp.addr.type = cp->addr.type; 7391 7392 if (err) 7393 goto complete; 7394 7395 rp.local_clock = cpu_to_le32(hdev->clock); 7396 7397 if (conn) { 7398 rp.piconet_clock = cpu_to_le32(conn->clock); 7399 rp.accuracy = cpu_to_le16(conn->clock_accuracy); 7400 } 7401 7402 complete: 7403 mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, status, &rp, 7404 sizeof(rp)); 7405 7406 mgmt_pending_free(cmd); 7407 } 7408 7409 static int get_clock_info_sync(struct hci_dev *hdev, void *data) 7410 { 7411 struct mgmt_pending_cmd *cmd = data; 7412 struct mgmt_cp_get_clock_info *cp = cmd->param; 7413 struct hci_cp_read_clock hci_cp; 7414 struct hci_conn *conn; 7415 7416 memset(&hci_cp, 0, sizeof(hci_cp)); 7417 hci_read_clock_sync(hdev, &hci_cp); 7418 7419 /* Make sure connection still exists */ 7420 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->addr.bdaddr); 7421 if (!conn || conn->state != BT_CONNECTED) 7422 return MGMT_STATUS_NOT_CONNECTED; 7423 7424 cmd->user_data = conn; 7425 hci_cp.handle = cpu_to_le16(conn->handle); 7426 hci_cp.which = 0x01; /* Piconet clock */ 7427 7428 return hci_read_clock_sync(hdev, &hci_cp); 7429 } 7430 7431 static int get_clock_info(struct sock *sk, struct hci_dev *hdev, void *data, 7432 u16 len) 7433 { 7434 struct mgmt_cp_get_clock_info *cp = data; 7435 struct mgmt_rp_get_clock_info rp; 7436 struct mgmt_pending_cmd *cmd; 7437 struct hci_conn *conn; 7438 int err; 7439 7440 bt_dev_dbg(hdev, "sock %p", sk); 7441 7442 memset(&rp, 0, sizeof(rp)); 7443 bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr); 7444 rp.addr.type = cp->addr.type; 7445 7446 if (cp->addr.type != BDADDR_BREDR) 7447 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CLOCK_INFO, 7448 MGMT_STATUS_INVALID_PARAMS, 7449 &rp, sizeof(rp)); 7450 7451 hci_dev_lock(hdev); 7452 7453 if (!hdev_is_powered(hdev)) { 7454 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CLOCK_INFO, 7455 MGMT_STATUS_NOT_POWERED, &rp, 7456 sizeof(rp)); 7457 goto unlock; 7458 } 7459 7460 if (bacmp(&cp->addr.bdaddr, BDADDR_ANY)) { 7461 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, 7462 &cp->addr.bdaddr); 7463 if (!conn || conn->state != BT_CONNECTED) { 7464 err = mgmt_cmd_complete(sk, hdev->id, 7465 MGMT_OP_GET_CLOCK_INFO, 7466 MGMT_STATUS_NOT_CONNECTED, 7467 &rp, sizeof(rp)); 7468 goto unlock; 7469 } 7470 } else { 7471 conn = NULL; 7472 } 7473 7474 cmd = mgmt_pending_new(sk, MGMT_OP_GET_CLOCK_INFO, hdev, data, len); 7475 if (!cmd) 7476 err = -ENOMEM; 7477 else 7478 err = hci_cmd_sync_queue(hdev, get_clock_info_sync, cmd, 7479 get_clock_info_complete); 7480 7481 if (err < 0) { 7482 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CLOCK_INFO, 7483 MGMT_STATUS_FAILED, &rp, sizeof(rp)); 7484 7485 if (cmd) 7486 mgmt_pending_free(cmd); 7487 } 7488 7489 7490 unlock: 7491 hci_dev_unlock(hdev); 7492 return err; 7493 } 7494 7495 static bool is_connected(struct hci_dev *hdev, bdaddr_t *addr, u8 type) 7496 { 7497 struct hci_conn *conn; 7498 7499 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, addr); 7500 if (!conn) 7501 return false; 7502 7503 if (conn->dst_type != type) 7504 return false; 7505 7506 if (conn->state != BT_CONNECTED) 7507 return false; 7508 7509 return true; 7510 } 7511 7512 /* This function requires the caller holds hdev->lock */ 7513 static int hci_conn_params_set(struct hci_dev *hdev, bdaddr_t *addr, 7514 u8 addr_type, u8 auto_connect) 7515 { 7516 struct hci_conn_params *params; 7517 7518 params = hci_conn_params_add(hdev, addr, addr_type); 7519 if (!params) 7520 return -EIO; 7521 7522 if (params->auto_connect == auto_connect) 7523 return 0; 7524 7525 hci_pend_le_list_del_init(params); 7526 7527 switch (auto_connect) { 7528 case HCI_AUTO_CONN_DISABLED: 7529 case HCI_AUTO_CONN_LINK_LOSS: 7530 /* If auto connect is being disabled when we're trying to 7531 * connect to device, keep connecting. 7532 */ 7533 if (params->explicit_connect) 7534 hci_pend_le_list_add(params, &hdev->pend_le_conns); 7535 break; 7536 case HCI_AUTO_CONN_REPORT: 7537 if (params->explicit_connect) 7538 hci_pend_le_list_add(params, &hdev->pend_le_conns); 7539 else 7540 hci_pend_le_list_add(params, &hdev->pend_le_reports); 7541 break; 7542 case HCI_AUTO_CONN_DIRECT: 7543 case HCI_AUTO_CONN_ALWAYS: 7544 if (!is_connected(hdev, addr, addr_type)) 7545 hci_pend_le_list_add(params, &hdev->pend_le_conns); 7546 break; 7547 } 7548 7549 params->auto_connect = auto_connect; 7550 7551 bt_dev_dbg(hdev, "addr %pMR (type %u) auto_connect %u", 7552 addr, addr_type, auto_connect); 7553 7554 return 0; 7555 } 7556 7557 static void device_added(struct sock *sk, struct hci_dev *hdev, 7558 bdaddr_t *bdaddr, u8 type, u8 action) 7559 { 7560 struct mgmt_ev_device_added ev; 7561 7562 bacpy(&ev.addr.bdaddr, bdaddr); 7563 ev.addr.type = type; 7564 ev.action = action; 7565 7566 mgmt_event(MGMT_EV_DEVICE_ADDED, hdev, &ev, sizeof(ev), sk); 7567 } 7568 7569 static int add_device_sync(struct hci_dev *hdev, void *data) 7570 { 7571 return hci_update_passive_scan_sync(hdev); 7572 } 7573 7574 static int add_device(struct sock *sk, struct hci_dev *hdev, 7575 void *data, u16 len) 7576 { 7577 struct mgmt_cp_add_device *cp = data; 7578 u8 auto_conn, addr_type; 7579 struct hci_conn_params *params; 7580 int err; 7581 u32 current_flags = 0; 7582 u32 supported_flags; 7583 7584 bt_dev_dbg(hdev, "sock %p", sk); 7585 7586 if (!bdaddr_type_is_valid(cp->addr.type) || 7587 !bacmp(&cp->addr.bdaddr, BDADDR_ANY)) 7588 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE, 7589 MGMT_STATUS_INVALID_PARAMS, 7590 &cp->addr, sizeof(cp->addr)); 7591 7592 if (cp->action != 0x00 && cp->action != 0x01 && cp->action != 0x02) 7593 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE, 7594 MGMT_STATUS_INVALID_PARAMS, 7595 &cp->addr, sizeof(cp->addr)); 7596 7597 hci_dev_lock(hdev); 7598 7599 if (cp->addr.type == BDADDR_BREDR) { 7600 /* Only incoming connections action is supported for now */ 7601 if (cp->action != 0x01) { 7602 err = mgmt_cmd_complete(sk, hdev->id, 7603 MGMT_OP_ADD_DEVICE, 7604 MGMT_STATUS_INVALID_PARAMS, 7605 &cp->addr, sizeof(cp->addr)); 7606 goto unlock; 7607 } 7608 7609 err = hci_bdaddr_list_add_with_flags(&hdev->accept_list, 7610 &cp->addr.bdaddr, 7611 cp->addr.type, 0); 7612 if (err) 7613 goto unlock; 7614 7615 hci_update_scan(hdev); 7616 7617 goto added; 7618 } 7619 7620 addr_type = le_addr_type(cp->addr.type); 7621 7622 if (cp->action == 0x02) 7623 auto_conn = HCI_AUTO_CONN_ALWAYS; 7624 else if (cp->action == 0x01) 7625 auto_conn = HCI_AUTO_CONN_DIRECT; 7626 else 7627 auto_conn = HCI_AUTO_CONN_REPORT; 7628 7629 /* Kernel internally uses conn_params with resolvable private 7630 * address, but Add Device allows only identity addresses. 7631 * Make sure it is enforced before calling 7632 * hci_conn_params_lookup. 7633 */ 7634 if (!hci_is_identity_address(&cp->addr.bdaddr, addr_type)) { 7635 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE, 7636 MGMT_STATUS_INVALID_PARAMS, 7637 &cp->addr, sizeof(cp->addr)); 7638 goto unlock; 7639 } 7640 7641 /* If the connection parameters don't exist for this device, 7642 * they will be created and configured with defaults. 7643 */ 7644 if (hci_conn_params_set(hdev, &cp->addr.bdaddr, addr_type, 7645 auto_conn) < 0) { 7646 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE, 7647 MGMT_STATUS_FAILED, &cp->addr, 7648 sizeof(cp->addr)); 7649 goto unlock; 7650 } else { 7651 params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr, 7652 addr_type); 7653 if (params) 7654 current_flags = params->flags; 7655 } 7656 7657 err = hci_cmd_sync_queue(hdev, add_device_sync, NULL, NULL); 7658 if (err < 0) 7659 goto unlock; 7660 7661 added: 7662 device_added(sk, hdev, &cp->addr.bdaddr, cp->addr.type, cp->action); 7663 supported_flags = hdev->conn_flags; 7664 device_flags_changed(NULL, hdev, &cp->addr.bdaddr, cp->addr.type, 7665 supported_flags, current_flags); 7666 7667 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE, 7668 MGMT_STATUS_SUCCESS, &cp->addr, 7669 sizeof(cp->addr)); 7670 7671 unlock: 7672 hci_dev_unlock(hdev); 7673 return err; 7674 } 7675 7676 static void device_removed(struct sock *sk, struct hci_dev *hdev, 7677 bdaddr_t *bdaddr, u8 type) 7678 { 7679 struct mgmt_ev_device_removed ev; 7680 7681 bacpy(&ev.addr.bdaddr, bdaddr); 7682 ev.addr.type = type; 7683 7684 mgmt_event(MGMT_EV_DEVICE_REMOVED, hdev, &ev, sizeof(ev), sk); 7685 } 7686 7687 static int remove_device_sync(struct hci_dev *hdev, void *data) 7688 { 7689 return hci_update_passive_scan_sync(hdev); 7690 } 7691 7692 static int remove_device(struct sock *sk, struct hci_dev *hdev, 7693 void *data, u16 len) 7694 { 7695 struct mgmt_cp_remove_device *cp = data; 7696 int err; 7697 7698 bt_dev_dbg(hdev, "sock %p", sk); 7699 7700 hci_dev_lock(hdev); 7701 7702 if (bacmp(&cp->addr.bdaddr, BDADDR_ANY)) { 7703 struct hci_conn_params *params; 7704 u8 addr_type; 7705 7706 if (!bdaddr_type_is_valid(cp->addr.type)) { 7707 err = mgmt_cmd_complete(sk, hdev->id, 7708 MGMT_OP_REMOVE_DEVICE, 7709 MGMT_STATUS_INVALID_PARAMS, 7710 &cp->addr, sizeof(cp->addr)); 7711 goto unlock; 7712 } 7713 7714 if (cp->addr.type == BDADDR_BREDR) { 7715 err = hci_bdaddr_list_del(&hdev->accept_list, 7716 &cp->addr.bdaddr, 7717 cp->addr.type); 7718 if (err) { 7719 err = mgmt_cmd_complete(sk, hdev->id, 7720 MGMT_OP_REMOVE_DEVICE, 7721 MGMT_STATUS_INVALID_PARAMS, 7722 &cp->addr, 7723 sizeof(cp->addr)); 7724 goto unlock; 7725 } 7726 7727 hci_update_scan(hdev); 7728 7729 device_removed(sk, hdev, &cp->addr.bdaddr, 7730 cp->addr.type); 7731 goto complete; 7732 } 7733 7734 addr_type = le_addr_type(cp->addr.type); 7735 7736 /* Kernel internally uses conn_params with resolvable private 7737 * address, but Remove Device allows only identity addresses. 7738 * Make sure it is enforced before calling 7739 * hci_conn_params_lookup. 7740 */ 7741 if (!hci_is_identity_address(&cp->addr.bdaddr, addr_type)) { 7742 err = mgmt_cmd_complete(sk, hdev->id, 7743 MGMT_OP_REMOVE_DEVICE, 7744 MGMT_STATUS_INVALID_PARAMS, 7745 &cp->addr, sizeof(cp->addr)); 7746 goto unlock; 7747 } 7748 7749 params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr, 7750 addr_type); 7751 if (!params) { 7752 err = mgmt_cmd_complete(sk, hdev->id, 7753 MGMT_OP_REMOVE_DEVICE, 7754 MGMT_STATUS_INVALID_PARAMS, 7755 &cp->addr, sizeof(cp->addr)); 7756 goto unlock; 7757 } 7758 7759 if (params->auto_connect == HCI_AUTO_CONN_DISABLED || 7760 params->auto_connect == HCI_AUTO_CONN_EXPLICIT) { 7761 err = mgmt_cmd_complete(sk, hdev->id, 7762 MGMT_OP_REMOVE_DEVICE, 7763 MGMT_STATUS_INVALID_PARAMS, 7764 &cp->addr, sizeof(cp->addr)); 7765 goto unlock; 7766 } 7767 7768 hci_conn_params_free(params); 7769 7770 device_removed(sk, hdev, &cp->addr.bdaddr, cp->addr.type); 7771 } else { 7772 struct hci_conn_params *p, *tmp; 7773 struct bdaddr_list *b, *btmp; 7774 7775 if (cp->addr.type) { 7776 err = mgmt_cmd_complete(sk, hdev->id, 7777 MGMT_OP_REMOVE_DEVICE, 7778 MGMT_STATUS_INVALID_PARAMS, 7779 &cp->addr, sizeof(cp->addr)); 7780 goto unlock; 7781 } 7782 7783 list_for_each_entry_safe(b, btmp, &hdev->accept_list, list) { 7784 device_removed(sk, hdev, &b->bdaddr, b->bdaddr_type); 7785 list_del(&b->list); 7786 kfree(b); 7787 } 7788 7789 hci_update_scan(hdev); 7790 7791 list_for_each_entry_safe(p, tmp, &hdev->le_conn_params, list) { 7792 if (p->auto_connect == HCI_AUTO_CONN_DISABLED) 7793 continue; 7794 device_removed(sk, hdev, &p->addr, p->addr_type); 7795 if (p->explicit_connect) { 7796 p->auto_connect = HCI_AUTO_CONN_EXPLICIT; 7797 continue; 7798 } 7799 hci_conn_params_free(p); 7800 } 7801 7802 bt_dev_dbg(hdev, "All LE connection parameters were removed"); 7803 } 7804 7805 hci_cmd_sync_queue(hdev, remove_device_sync, NULL, NULL); 7806 7807 complete: 7808 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_DEVICE, 7809 MGMT_STATUS_SUCCESS, &cp->addr, 7810 sizeof(cp->addr)); 7811 unlock: 7812 hci_dev_unlock(hdev); 7813 return err; 7814 } 7815 7816 static int load_conn_param(struct sock *sk, struct hci_dev *hdev, void *data, 7817 u16 len) 7818 { 7819 struct mgmt_cp_load_conn_param *cp = data; 7820 const u16 max_param_count = ((U16_MAX - sizeof(*cp)) / 7821 sizeof(struct mgmt_conn_param)); 7822 u16 param_count, expected_len; 7823 int i; 7824 7825 if (!lmp_le_capable(hdev)) 7826 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM, 7827 MGMT_STATUS_NOT_SUPPORTED); 7828 7829 param_count = __le16_to_cpu(cp->param_count); 7830 if (param_count > max_param_count) { 7831 bt_dev_err(hdev, "load_conn_param: too big param_count value %u", 7832 param_count); 7833 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM, 7834 MGMT_STATUS_INVALID_PARAMS); 7835 } 7836 7837 expected_len = struct_size(cp, params, param_count); 7838 if (expected_len != len) { 7839 bt_dev_err(hdev, "load_conn_param: expected %u bytes, got %u bytes", 7840 expected_len, len); 7841 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM, 7842 MGMT_STATUS_INVALID_PARAMS); 7843 } 7844 7845 bt_dev_dbg(hdev, "param_count %u", param_count); 7846 7847 hci_dev_lock(hdev); 7848 7849 hci_conn_params_clear_disabled(hdev); 7850 7851 for (i = 0; i < param_count; i++) { 7852 struct mgmt_conn_param *param = &cp->params[i]; 7853 struct hci_conn_params *hci_param; 7854 u16 min, max, latency, timeout; 7855 u8 addr_type; 7856 7857 bt_dev_dbg(hdev, "Adding %pMR (type %u)", ¶m->addr.bdaddr, 7858 param->addr.type); 7859 7860 if (param->addr.type == BDADDR_LE_PUBLIC) { 7861 addr_type = ADDR_LE_DEV_PUBLIC; 7862 } else if (param->addr.type == BDADDR_LE_RANDOM) { 7863 addr_type = ADDR_LE_DEV_RANDOM; 7864 } else { 7865 bt_dev_err(hdev, "ignoring invalid connection parameters"); 7866 continue; 7867 } 7868 7869 min = le16_to_cpu(param->min_interval); 7870 max = le16_to_cpu(param->max_interval); 7871 latency = le16_to_cpu(param->latency); 7872 timeout = le16_to_cpu(param->timeout); 7873 7874 bt_dev_dbg(hdev, "min 0x%04x max 0x%04x latency 0x%04x timeout 0x%04x", 7875 min, max, latency, timeout); 7876 7877 if (hci_check_conn_params(min, max, latency, timeout) < 0) { 7878 bt_dev_err(hdev, "ignoring invalid connection parameters"); 7879 continue; 7880 } 7881 7882 hci_param = hci_conn_params_add(hdev, ¶m->addr.bdaddr, 7883 addr_type); 7884 if (!hci_param) { 7885 bt_dev_err(hdev, "failed to add connection parameters"); 7886 continue; 7887 } 7888 7889 hci_param->conn_min_interval = min; 7890 hci_param->conn_max_interval = max; 7891 hci_param->conn_latency = latency; 7892 hci_param->supervision_timeout = timeout; 7893 } 7894 7895 hci_dev_unlock(hdev); 7896 7897 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM, 0, 7898 NULL, 0); 7899 } 7900 7901 static int set_external_config(struct sock *sk, struct hci_dev *hdev, 7902 void *data, u16 len) 7903 { 7904 struct mgmt_cp_set_external_config *cp = data; 7905 bool changed; 7906 int err; 7907 7908 bt_dev_dbg(hdev, "sock %p", sk); 7909 7910 if (hdev_is_powered(hdev)) 7911 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_EXTERNAL_CONFIG, 7912 MGMT_STATUS_REJECTED); 7913 7914 if (cp->config != 0x00 && cp->config != 0x01) 7915 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_EXTERNAL_CONFIG, 7916 MGMT_STATUS_INVALID_PARAMS); 7917 7918 if (!test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks)) 7919 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_EXTERNAL_CONFIG, 7920 MGMT_STATUS_NOT_SUPPORTED); 7921 7922 hci_dev_lock(hdev); 7923 7924 if (cp->config) 7925 changed = !hci_dev_test_and_set_flag(hdev, HCI_EXT_CONFIGURED); 7926 else 7927 changed = hci_dev_test_and_clear_flag(hdev, HCI_EXT_CONFIGURED); 7928 7929 err = send_options_rsp(sk, MGMT_OP_SET_EXTERNAL_CONFIG, hdev); 7930 if (err < 0) 7931 goto unlock; 7932 7933 if (!changed) 7934 goto unlock; 7935 7936 err = new_options(hdev, sk); 7937 7938 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED) == is_configured(hdev)) { 7939 mgmt_index_removed(hdev); 7940 7941 if (hci_dev_test_and_change_flag(hdev, HCI_UNCONFIGURED)) { 7942 hci_dev_set_flag(hdev, HCI_CONFIG); 7943 hci_dev_set_flag(hdev, HCI_AUTO_OFF); 7944 7945 queue_work(hdev->req_workqueue, &hdev->power_on); 7946 } else { 7947 set_bit(HCI_RAW, &hdev->flags); 7948 mgmt_index_added(hdev); 7949 } 7950 } 7951 7952 unlock: 7953 hci_dev_unlock(hdev); 7954 return err; 7955 } 7956 7957 static int set_public_address(struct sock *sk, struct hci_dev *hdev, 7958 void *data, u16 len) 7959 { 7960 struct mgmt_cp_set_public_address *cp = data; 7961 bool changed; 7962 int err; 7963 7964 bt_dev_dbg(hdev, "sock %p", sk); 7965 7966 if (hdev_is_powered(hdev)) 7967 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PUBLIC_ADDRESS, 7968 MGMT_STATUS_REJECTED); 7969 7970 if (!bacmp(&cp->bdaddr, BDADDR_ANY)) 7971 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PUBLIC_ADDRESS, 7972 MGMT_STATUS_INVALID_PARAMS); 7973 7974 if (!hdev->set_bdaddr) 7975 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PUBLIC_ADDRESS, 7976 MGMT_STATUS_NOT_SUPPORTED); 7977 7978 hci_dev_lock(hdev); 7979 7980 changed = !!bacmp(&hdev->public_addr, &cp->bdaddr); 7981 bacpy(&hdev->public_addr, &cp->bdaddr); 7982 7983 err = send_options_rsp(sk, MGMT_OP_SET_PUBLIC_ADDRESS, hdev); 7984 if (err < 0) 7985 goto unlock; 7986 7987 if (!changed) 7988 goto unlock; 7989 7990 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) 7991 err = new_options(hdev, sk); 7992 7993 if (is_configured(hdev)) { 7994 mgmt_index_removed(hdev); 7995 7996 hci_dev_clear_flag(hdev, HCI_UNCONFIGURED); 7997 7998 hci_dev_set_flag(hdev, HCI_CONFIG); 7999 hci_dev_set_flag(hdev, HCI_AUTO_OFF); 8000 8001 queue_work(hdev->req_workqueue, &hdev->power_on); 8002 } 8003 8004 unlock: 8005 hci_dev_unlock(hdev); 8006 return err; 8007 } 8008 8009 static void read_local_oob_ext_data_complete(struct hci_dev *hdev, void *data, 8010 int err) 8011 { 8012 const struct mgmt_cp_read_local_oob_ext_data *mgmt_cp; 8013 struct mgmt_rp_read_local_oob_ext_data *mgmt_rp; 8014 u8 *h192, *r192, *h256, *r256; 8015 struct mgmt_pending_cmd *cmd = data; 8016 struct sk_buff *skb = cmd->skb; 8017 u8 status = mgmt_status(err); 8018 u16 eir_len; 8019 8020 if (cmd != pending_find(MGMT_OP_READ_LOCAL_OOB_EXT_DATA, hdev)) 8021 return; 8022 8023 if (!status) { 8024 if (!skb) 8025 status = MGMT_STATUS_FAILED; 8026 else if (IS_ERR(skb)) 8027 status = mgmt_status(PTR_ERR(skb)); 8028 else 8029 status = mgmt_status(skb->data[0]); 8030 } 8031 8032 bt_dev_dbg(hdev, "status %u", status); 8033 8034 mgmt_cp = cmd->param; 8035 8036 if (status) { 8037 status = mgmt_status(status); 8038 eir_len = 0; 8039 8040 h192 = NULL; 8041 r192 = NULL; 8042 h256 = NULL; 8043 r256 = NULL; 8044 } else if (!bredr_sc_enabled(hdev)) { 8045 struct hci_rp_read_local_oob_data *rp; 8046 8047 if (skb->len != sizeof(*rp)) { 8048 status = MGMT_STATUS_FAILED; 8049 eir_len = 0; 8050 } else { 8051 status = MGMT_STATUS_SUCCESS; 8052 rp = (void *)skb->data; 8053 8054 eir_len = 5 + 18 + 18; 8055 h192 = rp->hash; 8056 r192 = rp->rand; 8057 h256 = NULL; 8058 r256 = NULL; 8059 } 8060 } else { 8061 struct hci_rp_read_local_oob_ext_data *rp; 8062 8063 if (skb->len != sizeof(*rp)) { 8064 status = MGMT_STATUS_FAILED; 8065 eir_len = 0; 8066 } else { 8067 status = MGMT_STATUS_SUCCESS; 8068 rp = (void *)skb->data; 8069 8070 if (hci_dev_test_flag(hdev, HCI_SC_ONLY)) { 8071 eir_len = 5 + 18 + 18; 8072 h192 = NULL; 8073 r192 = NULL; 8074 } else { 8075 eir_len = 5 + 18 + 18 + 18 + 18; 8076 h192 = rp->hash192; 8077 r192 = rp->rand192; 8078 } 8079 8080 h256 = rp->hash256; 8081 r256 = rp->rand256; 8082 } 8083 } 8084 8085 mgmt_rp = kmalloc(sizeof(*mgmt_rp) + eir_len, GFP_KERNEL); 8086 if (!mgmt_rp) 8087 goto done; 8088 8089 if (eir_len == 0) 8090 goto send_rsp; 8091 8092 eir_len = eir_append_data(mgmt_rp->eir, 0, EIR_CLASS_OF_DEV, 8093 hdev->dev_class, 3); 8094 8095 if (h192 && r192) { 8096 eir_len = eir_append_data(mgmt_rp->eir, eir_len, 8097 EIR_SSP_HASH_C192, h192, 16); 8098 eir_len = eir_append_data(mgmt_rp->eir, eir_len, 8099 EIR_SSP_RAND_R192, r192, 16); 8100 } 8101 8102 if (h256 && r256) { 8103 eir_len = eir_append_data(mgmt_rp->eir, eir_len, 8104 EIR_SSP_HASH_C256, h256, 16); 8105 eir_len = eir_append_data(mgmt_rp->eir, eir_len, 8106 EIR_SSP_RAND_R256, r256, 16); 8107 } 8108 8109 send_rsp: 8110 mgmt_rp->type = mgmt_cp->type; 8111 mgmt_rp->eir_len = cpu_to_le16(eir_len); 8112 8113 err = mgmt_cmd_complete(cmd->sk, hdev->id, 8114 MGMT_OP_READ_LOCAL_OOB_EXT_DATA, status, 8115 mgmt_rp, sizeof(*mgmt_rp) + eir_len); 8116 if (err < 0 || status) 8117 goto done; 8118 8119 hci_sock_set_flag(cmd->sk, HCI_MGMT_OOB_DATA_EVENTS); 8120 8121 err = mgmt_limited_event(MGMT_EV_LOCAL_OOB_DATA_UPDATED, hdev, 8122 mgmt_rp, sizeof(*mgmt_rp) + eir_len, 8123 HCI_MGMT_OOB_DATA_EVENTS, cmd->sk); 8124 done: 8125 if (skb && !IS_ERR(skb)) 8126 kfree_skb(skb); 8127 8128 kfree(mgmt_rp); 8129 mgmt_pending_remove(cmd); 8130 } 8131 8132 static int read_local_ssp_oob_req(struct hci_dev *hdev, struct sock *sk, 8133 struct mgmt_cp_read_local_oob_ext_data *cp) 8134 { 8135 struct mgmt_pending_cmd *cmd; 8136 int err; 8137 8138 cmd = mgmt_pending_add(sk, MGMT_OP_READ_LOCAL_OOB_EXT_DATA, hdev, 8139 cp, sizeof(*cp)); 8140 if (!cmd) 8141 return -ENOMEM; 8142 8143 err = hci_cmd_sync_queue(hdev, read_local_oob_data_sync, cmd, 8144 read_local_oob_ext_data_complete); 8145 8146 if (err < 0) { 8147 mgmt_pending_remove(cmd); 8148 return err; 8149 } 8150 8151 return 0; 8152 } 8153 8154 static int read_local_oob_ext_data(struct sock *sk, struct hci_dev *hdev, 8155 void *data, u16 data_len) 8156 { 8157 struct mgmt_cp_read_local_oob_ext_data *cp = data; 8158 struct mgmt_rp_read_local_oob_ext_data *rp; 8159 size_t rp_len; 8160 u16 eir_len; 8161 u8 status, flags, role, addr[7], hash[16], rand[16]; 8162 int err; 8163 8164 bt_dev_dbg(hdev, "sock %p", sk); 8165 8166 if (hdev_is_powered(hdev)) { 8167 switch (cp->type) { 8168 case BIT(BDADDR_BREDR): 8169 status = mgmt_bredr_support(hdev); 8170 if (status) 8171 eir_len = 0; 8172 else 8173 eir_len = 5; 8174 break; 8175 case (BIT(BDADDR_LE_PUBLIC) | BIT(BDADDR_LE_RANDOM)): 8176 status = mgmt_le_support(hdev); 8177 if (status) 8178 eir_len = 0; 8179 else 8180 eir_len = 9 + 3 + 18 + 18 + 3; 8181 break; 8182 default: 8183 status = MGMT_STATUS_INVALID_PARAMS; 8184 eir_len = 0; 8185 break; 8186 } 8187 } else { 8188 status = MGMT_STATUS_NOT_POWERED; 8189 eir_len = 0; 8190 } 8191 8192 rp_len = sizeof(*rp) + eir_len; 8193 rp = kmalloc(rp_len, GFP_ATOMIC); 8194 if (!rp) 8195 return -ENOMEM; 8196 8197 if (!status && !lmp_ssp_capable(hdev)) { 8198 status = MGMT_STATUS_NOT_SUPPORTED; 8199 eir_len = 0; 8200 } 8201 8202 if (status) 8203 goto complete; 8204 8205 hci_dev_lock(hdev); 8206 8207 eir_len = 0; 8208 switch (cp->type) { 8209 case BIT(BDADDR_BREDR): 8210 if (hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) { 8211 err = read_local_ssp_oob_req(hdev, sk, cp); 8212 hci_dev_unlock(hdev); 8213 if (!err) 8214 goto done; 8215 8216 status = MGMT_STATUS_FAILED; 8217 goto complete; 8218 } else { 8219 eir_len = eir_append_data(rp->eir, eir_len, 8220 EIR_CLASS_OF_DEV, 8221 hdev->dev_class, 3); 8222 } 8223 break; 8224 case (BIT(BDADDR_LE_PUBLIC) | BIT(BDADDR_LE_RANDOM)): 8225 if (hci_dev_test_flag(hdev, HCI_SC_ENABLED) && 8226 smp_generate_oob(hdev, hash, rand) < 0) { 8227 hci_dev_unlock(hdev); 8228 status = MGMT_STATUS_FAILED; 8229 goto complete; 8230 } 8231 8232 /* This should return the active RPA, but since the RPA 8233 * is only programmed on demand, it is really hard to fill 8234 * this in at the moment. For now disallow retrieving 8235 * local out-of-band data when privacy is in use. 8236 * 8237 * Returning the identity address will not help here since 8238 * pairing happens before the identity resolving key is 8239 * known and thus the connection establishment happens 8240 * based on the RPA and not the identity address. 8241 */ 8242 if (hci_dev_test_flag(hdev, HCI_PRIVACY)) { 8243 hci_dev_unlock(hdev); 8244 status = MGMT_STATUS_REJECTED; 8245 goto complete; 8246 } 8247 8248 if (hci_dev_test_flag(hdev, HCI_FORCE_STATIC_ADDR) || 8249 !bacmp(&hdev->bdaddr, BDADDR_ANY) || 8250 (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) && 8251 bacmp(&hdev->static_addr, BDADDR_ANY))) { 8252 memcpy(addr, &hdev->static_addr, 6); 8253 addr[6] = 0x01; 8254 } else { 8255 memcpy(addr, &hdev->bdaddr, 6); 8256 addr[6] = 0x00; 8257 } 8258 8259 eir_len = eir_append_data(rp->eir, eir_len, EIR_LE_BDADDR, 8260 addr, sizeof(addr)); 8261 8262 if (hci_dev_test_flag(hdev, HCI_ADVERTISING)) 8263 role = 0x02; 8264 else 8265 role = 0x01; 8266 8267 eir_len = eir_append_data(rp->eir, eir_len, EIR_LE_ROLE, 8268 &role, sizeof(role)); 8269 8270 if (hci_dev_test_flag(hdev, HCI_SC_ENABLED)) { 8271 eir_len = eir_append_data(rp->eir, eir_len, 8272 EIR_LE_SC_CONFIRM, 8273 hash, sizeof(hash)); 8274 8275 eir_len = eir_append_data(rp->eir, eir_len, 8276 EIR_LE_SC_RANDOM, 8277 rand, sizeof(rand)); 8278 } 8279 8280 flags = mgmt_get_adv_discov_flags(hdev); 8281 8282 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) 8283 flags |= LE_AD_NO_BREDR; 8284 8285 eir_len = eir_append_data(rp->eir, eir_len, EIR_FLAGS, 8286 &flags, sizeof(flags)); 8287 break; 8288 } 8289 8290 hci_dev_unlock(hdev); 8291 8292 hci_sock_set_flag(sk, HCI_MGMT_OOB_DATA_EVENTS); 8293 8294 status = MGMT_STATUS_SUCCESS; 8295 8296 complete: 8297 rp->type = cp->type; 8298 rp->eir_len = cpu_to_le16(eir_len); 8299 8300 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_EXT_DATA, 8301 status, rp, sizeof(*rp) + eir_len); 8302 if (err < 0 || status) 8303 goto done; 8304 8305 err = mgmt_limited_event(MGMT_EV_LOCAL_OOB_DATA_UPDATED, hdev, 8306 rp, sizeof(*rp) + eir_len, 8307 HCI_MGMT_OOB_DATA_EVENTS, sk); 8308 8309 done: 8310 kfree(rp); 8311 8312 return err; 8313 } 8314 8315 static u32 get_supported_adv_flags(struct hci_dev *hdev) 8316 { 8317 u32 flags = 0; 8318 8319 flags |= MGMT_ADV_FLAG_CONNECTABLE; 8320 flags |= MGMT_ADV_FLAG_DISCOV; 8321 flags |= MGMT_ADV_FLAG_LIMITED_DISCOV; 8322 flags |= MGMT_ADV_FLAG_MANAGED_FLAGS; 8323 flags |= MGMT_ADV_FLAG_APPEARANCE; 8324 flags |= MGMT_ADV_FLAG_LOCAL_NAME; 8325 flags |= MGMT_ADV_PARAM_DURATION; 8326 flags |= MGMT_ADV_PARAM_TIMEOUT; 8327 flags |= MGMT_ADV_PARAM_INTERVALS; 8328 flags |= MGMT_ADV_PARAM_TX_POWER; 8329 flags |= MGMT_ADV_PARAM_SCAN_RSP; 8330 8331 /* In extended adv TX_POWER returned from Set Adv Param 8332 * will be always valid. 8333 */ 8334 if (hdev->adv_tx_power != HCI_TX_POWER_INVALID || ext_adv_capable(hdev)) 8335 flags |= MGMT_ADV_FLAG_TX_POWER; 8336 8337 if (ext_adv_capable(hdev)) { 8338 flags |= MGMT_ADV_FLAG_SEC_1M; 8339 flags |= MGMT_ADV_FLAG_HW_OFFLOAD; 8340 flags |= MGMT_ADV_FLAG_CAN_SET_TX_POWER; 8341 8342 if (le_2m_capable(hdev)) 8343 flags |= MGMT_ADV_FLAG_SEC_2M; 8344 8345 if (le_coded_capable(hdev)) 8346 flags |= MGMT_ADV_FLAG_SEC_CODED; 8347 } 8348 8349 return flags; 8350 } 8351 8352 static int read_adv_features(struct sock *sk, struct hci_dev *hdev, 8353 void *data, u16 data_len) 8354 { 8355 struct mgmt_rp_read_adv_features *rp; 8356 size_t rp_len; 8357 int err; 8358 struct adv_info *adv_instance; 8359 u32 supported_flags; 8360 u8 *instance; 8361 8362 bt_dev_dbg(hdev, "sock %p", sk); 8363 8364 if (!lmp_le_capable(hdev)) 8365 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_ADV_FEATURES, 8366 MGMT_STATUS_REJECTED); 8367 8368 hci_dev_lock(hdev); 8369 8370 rp_len = sizeof(*rp) + hdev->adv_instance_cnt; 8371 rp = kmalloc(rp_len, GFP_ATOMIC); 8372 if (!rp) { 8373 hci_dev_unlock(hdev); 8374 return -ENOMEM; 8375 } 8376 8377 supported_flags = get_supported_adv_flags(hdev); 8378 8379 rp->supported_flags = cpu_to_le32(supported_flags); 8380 rp->max_adv_data_len = max_adv_len(hdev); 8381 rp->max_scan_rsp_len = max_adv_len(hdev); 8382 rp->max_instances = hdev->le_num_of_adv_sets; 8383 rp->num_instances = hdev->adv_instance_cnt; 8384 8385 instance = rp->instance; 8386 list_for_each_entry(adv_instance, &hdev->adv_instances, list) { 8387 /* Only instances 1-le_num_of_adv_sets are externally visible */ 8388 if (adv_instance->instance <= hdev->adv_instance_cnt) { 8389 *instance = adv_instance->instance; 8390 instance++; 8391 } else { 8392 rp->num_instances--; 8393 rp_len--; 8394 } 8395 } 8396 8397 hci_dev_unlock(hdev); 8398 8399 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_ADV_FEATURES, 8400 MGMT_STATUS_SUCCESS, rp, rp_len); 8401 8402 kfree(rp); 8403 8404 return err; 8405 } 8406 8407 static u8 calculate_name_len(struct hci_dev *hdev) 8408 { 8409 u8 buf[HCI_MAX_SHORT_NAME_LENGTH + 2]; /* len + type + name */ 8410 8411 return eir_append_local_name(hdev, buf, 0); 8412 } 8413 8414 static u8 tlv_data_max_len(struct hci_dev *hdev, u32 adv_flags, 8415 bool is_adv_data) 8416 { 8417 u8 max_len = max_adv_len(hdev); 8418 8419 if (is_adv_data) { 8420 if (adv_flags & (MGMT_ADV_FLAG_DISCOV | 8421 MGMT_ADV_FLAG_LIMITED_DISCOV | 8422 MGMT_ADV_FLAG_MANAGED_FLAGS)) 8423 max_len -= 3; 8424 8425 if (adv_flags & MGMT_ADV_FLAG_TX_POWER) 8426 max_len -= 3; 8427 } else { 8428 if (adv_flags & MGMT_ADV_FLAG_LOCAL_NAME) 8429 max_len -= calculate_name_len(hdev); 8430 8431 if (adv_flags & (MGMT_ADV_FLAG_APPEARANCE)) 8432 max_len -= 4; 8433 } 8434 8435 return max_len; 8436 } 8437 8438 static bool flags_managed(u32 adv_flags) 8439 { 8440 return adv_flags & (MGMT_ADV_FLAG_DISCOV | 8441 MGMT_ADV_FLAG_LIMITED_DISCOV | 8442 MGMT_ADV_FLAG_MANAGED_FLAGS); 8443 } 8444 8445 static bool tx_power_managed(u32 adv_flags) 8446 { 8447 return adv_flags & MGMT_ADV_FLAG_TX_POWER; 8448 } 8449 8450 static bool name_managed(u32 adv_flags) 8451 { 8452 return adv_flags & MGMT_ADV_FLAG_LOCAL_NAME; 8453 } 8454 8455 static bool appearance_managed(u32 adv_flags) 8456 { 8457 return adv_flags & MGMT_ADV_FLAG_APPEARANCE; 8458 } 8459 8460 static bool tlv_data_is_valid(struct hci_dev *hdev, u32 adv_flags, u8 *data, 8461 u8 len, bool is_adv_data) 8462 { 8463 int i, cur_len; 8464 u8 max_len; 8465 8466 max_len = tlv_data_max_len(hdev, adv_flags, is_adv_data); 8467 8468 if (len > max_len) 8469 return false; 8470 8471 /* Make sure that the data is correctly formatted. */ 8472 for (i = 0; i < len; i += (cur_len + 1)) { 8473 cur_len = data[i]; 8474 8475 if (!cur_len) 8476 continue; 8477 8478 if (data[i + 1] == EIR_FLAGS && 8479 (!is_adv_data || flags_managed(adv_flags))) 8480 return false; 8481 8482 if (data[i + 1] == EIR_TX_POWER && tx_power_managed(adv_flags)) 8483 return false; 8484 8485 if (data[i + 1] == EIR_NAME_COMPLETE && name_managed(adv_flags)) 8486 return false; 8487 8488 if (data[i + 1] == EIR_NAME_SHORT && name_managed(adv_flags)) 8489 return false; 8490 8491 if (data[i + 1] == EIR_APPEARANCE && 8492 appearance_managed(adv_flags)) 8493 return false; 8494 8495 /* If the current field length would exceed the total data 8496 * length, then it's invalid. 8497 */ 8498 if (i + cur_len >= len) 8499 return false; 8500 } 8501 8502 return true; 8503 } 8504 8505 static bool requested_adv_flags_are_valid(struct hci_dev *hdev, u32 adv_flags) 8506 { 8507 u32 supported_flags, phy_flags; 8508 8509 /* The current implementation only supports a subset of the specified 8510 * flags. Also need to check mutual exclusiveness of sec flags. 8511 */ 8512 supported_flags = get_supported_adv_flags(hdev); 8513 phy_flags = adv_flags & MGMT_ADV_FLAG_SEC_MASK; 8514 if (adv_flags & ~supported_flags || 8515 ((phy_flags && (phy_flags ^ (phy_flags & -phy_flags))))) 8516 return false; 8517 8518 return true; 8519 } 8520 8521 static bool adv_busy(struct hci_dev *hdev) 8522 { 8523 return pending_find(MGMT_OP_SET_LE, hdev); 8524 } 8525 8526 static void add_adv_complete(struct hci_dev *hdev, struct sock *sk, u8 instance, 8527 int err) 8528 { 8529 struct adv_info *adv, *n; 8530 8531 bt_dev_dbg(hdev, "err %d", err); 8532 8533 hci_dev_lock(hdev); 8534 8535 list_for_each_entry_safe(adv, n, &hdev->adv_instances, list) { 8536 u8 instance; 8537 8538 if (!adv->pending) 8539 continue; 8540 8541 if (!err) { 8542 adv->pending = false; 8543 continue; 8544 } 8545 8546 instance = adv->instance; 8547 8548 if (hdev->cur_adv_instance == instance) 8549 cancel_adv_timeout(hdev); 8550 8551 hci_remove_adv_instance(hdev, instance); 8552 mgmt_advertising_removed(sk, hdev, instance); 8553 } 8554 8555 hci_dev_unlock(hdev); 8556 } 8557 8558 static void add_advertising_complete(struct hci_dev *hdev, void *data, int err) 8559 { 8560 struct mgmt_pending_cmd *cmd = data; 8561 struct mgmt_cp_add_advertising *cp = cmd->param; 8562 struct mgmt_rp_add_advertising rp; 8563 8564 memset(&rp, 0, sizeof(rp)); 8565 8566 rp.instance = cp->instance; 8567 8568 if (err) 8569 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, 8570 mgmt_status(err)); 8571 else 8572 mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, 8573 mgmt_status(err), &rp, sizeof(rp)); 8574 8575 add_adv_complete(hdev, cmd->sk, cp->instance, err); 8576 8577 mgmt_pending_free(cmd); 8578 } 8579 8580 static int add_advertising_sync(struct hci_dev *hdev, void *data) 8581 { 8582 struct mgmt_pending_cmd *cmd = data; 8583 struct mgmt_cp_add_advertising *cp = cmd->param; 8584 8585 return hci_schedule_adv_instance_sync(hdev, cp->instance, true); 8586 } 8587 8588 static int add_advertising(struct sock *sk, struct hci_dev *hdev, 8589 void *data, u16 data_len) 8590 { 8591 struct mgmt_cp_add_advertising *cp = data; 8592 struct mgmt_rp_add_advertising rp; 8593 u32 flags; 8594 u8 status; 8595 u16 timeout, duration; 8596 unsigned int prev_instance_cnt; 8597 u8 schedule_instance = 0; 8598 struct adv_info *adv, *next_instance; 8599 int err; 8600 struct mgmt_pending_cmd *cmd; 8601 8602 bt_dev_dbg(hdev, "sock %p", sk); 8603 8604 status = mgmt_le_support(hdev); 8605 if (status) 8606 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING, 8607 status); 8608 8609 if (cp->instance < 1 || cp->instance > hdev->le_num_of_adv_sets) 8610 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING, 8611 MGMT_STATUS_INVALID_PARAMS); 8612 8613 if (data_len != sizeof(*cp) + cp->adv_data_len + cp->scan_rsp_len) 8614 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING, 8615 MGMT_STATUS_INVALID_PARAMS); 8616 8617 flags = __le32_to_cpu(cp->flags); 8618 timeout = __le16_to_cpu(cp->timeout); 8619 duration = __le16_to_cpu(cp->duration); 8620 8621 if (!requested_adv_flags_are_valid(hdev, flags)) 8622 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING, 8623 MGMT_STATUS_INVALID_PARAMS); 8624 8625 hci_dev_lock(hdev); 8626 8627 if (timeout && !hdev_is_powered(hdev)) { 8628 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING, 8629 MGMT_STATUS_REJECTED); 8630 goto unlock; 8631 } 8632 8633 if (adv_busy(hdev)) { 8634 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING, 8635 MGMT_STATUS_BUSY); 8636 goto unlock; 8637 } 8638 8639 if (!tlv_data_is_valid(hdev, flags, cp->data, cp->adv_data_len, true) || 8640 !tlv_data_is_valid(hdev, flags, cp->data + cp->adv_data_len, 8641 cp->scan_rsp_len, false)) { 8642 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING, 8643 MGMT_STATUS_INVALID_PARAMS); 8644 goto unlock; 8645 } 8646 8647 prev_instance_cnt = hdev->adv_instance_cnt; 8648 8649 adv = hci_add_adv_instance(hdev, cp->instance, flags, 8650 cp->adv_data_len, cp->data, 8651 cp->scan_rsp_len, 8652 cp->data + cp->adv_data_len, 8653 timeout, duration, 8654 HCI_ADV_TX_POWER_NO_PREFERENCE, 8655 hdev->le_adv_min_interval, 8656 hdev->le_adv_max_interval, 0); 8657 if (IS_ERR(adv)) { 8658 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING, 8659 MGMT_STATUS_FAILED); 8660 goto unlock; 8661 } 8662 8663 /* Only trigger an advertising added event if a new instance was 8664 * actually added. 8665 */ 8666 if (hdev->adv_instance_cnt > prev_instance_cnt) 8667 mgmt_advertising_added(sk, hdev, cp->instance); 8668 8669 if (hdev->cur_adv_instance == cp->instance) { 8670 /* If the currently advertised instance is being changed then 8671 * cancel the current advertising and schedule the next 8672 * instance. If there is only one instance then the overridden 8673 * advertising data will be visible right away. 8674 */ 8675 cancel_adv_timeout(hdev); 8676 8677 next_instance = hci_get_next_instance(hdev, cp->instance); 8678 if (next_instance) 8679 schedule_instance = next_instance->instance; 8680 } else if (!hdev->adv_instance_timeout) { 8681 /* Immediately advertise the new instance if no other 8682 * instance is currently being advertised. 8683 */ 8684 schedule_instance = cp->instance; 8685 } 8686 8687 /* If the HCI_ADVERTISING flag is set or the device isn't powered or 8688 * there is no instance to be advertised then we have no HCI 8689 * communication to make. Simply return. 8690 */ 8691 if (!hdev_is_powered(hdev) || 8692 hci_dev_test_flag(hdev, HCI_ADVERTISING) || 8693 !schedule_instance) { 8694 rp.instance = cp->instance; 8695 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_ADVERTISING, 8696 MGMT_STATUS_SUCCESS, &rp, sizeof(rp)); 8697 goto unlock; 8698 } 8699 8700 /* We're good to go, update advertising data, parameters, and start 8701 * advertising. 8702 */ 8703 cmd = mgmt_pending_new(sk, MGMT_OP_ADD_ADVERTISING, hdev, data, 8704 data_len); 8705 if (!cmd) { 8706 err = -ENOMEM; 8707 goto unlock; 8708 } 8709 8710 cp->instance = schedule_instance; 8711 8712 err = hci_cmd_sync_queue(hdev, add_advertising_sync, cmd, 8713 add_advertising_complete); 8714 if (err < 0) 8715 mgmt_pending_free(cmd); 8716 8717 unlock: 8718 hci_dev_unlock(hdev); 8719 8720 return err; 8721 } 8722 8723 static void add_ext_adv_params_complete(struct hci_dev *hdev, void *data, 8724 int err) 8725 { 8726 struct mgmt_pending_cmd *cmd = data; 8727 struct mgmt_cp_add_ext_adv_params *cp = cmd->param; 8728 struct mgmt_rp_add_ext_adv_params rp; 8729 struct adv_info *adv; 8730 u32 flags; 8731 8732 BT_DBG("%s", hdev->name); 8733 8734 hci_dev_lock(hdev); 8735 8736 adv = hci_find_adv_instance(hdev, cp->instance); 8737 if (!adv) 8738 goto unlock; 8739 8740 rp.instance = cp->instance; 8741 rp.tx_power = adv->tx_power; 8742 8743 /* While we're at it, inform userspace of the available space for this 8744 * advertisement, given the flags that will be used. 8745 */ 8746 flags = __le32_to_cpu(cp->flags); 8747 rp.max_adv_data_len = tlv_data_max_len(hdev, flags, true); 8748 rp.max_scan_rsp_len = tlv_data_max_len(hdev, flags, false); 8749 8750 if (err) { 8751 /* If this advertisement was previously advertising and we 8752 * failed to update it, we signal that it has been removed and 8753 * delete its structure 8754 */ 8755 if (!adv->pending) 8756 mgmt_advertising_removed(cmd->sk, hdev, cp->instance); 8757 8758 hci_remove_adv_instance(hdev, cp->instance); 8759 8760 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, 8761 mgmt_status(err)); 8762 } else { 8763 mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, 8764 mgmt_status(err), &rp, sizeof(rp)); 8765 } 8766 8767 unlock: 8768 mgmt_pending_free(cmd); 8769 8770 hci_dev_unlock(hdev); 8771 } 8772 8773 static int add_ext_adv_params_sync(struct hci_dev *hdev, void *data) 8774 { 8775 struct mgmt_pending_cmd *cmd = data; 8776 struct mgmt_cp_add_ext_adv_params *cp = cmd->param; 8777 8778 return hci_setup_ext_adv_instance_sync(hdev, cp->instance); 8779 } 8780 8781 static int add_ext_adv_params(struct sock *sk, struct hci_dev *hdev, 8782 void *data, u16 data_len) 8783 { 8784 struct mgmt_cp_add_ext_adv_params *cp = data; 8785 struct mgmt_rp_add_ext_adv_params rp; 8786 struct mgmt_pending_cmd *cmd = NULL; 8787 struct adv_info *adv; 8788 u32 flags, min_interval, max_interval; 8789 u16 timeout, duration; 8790 u8 status; 8791 s8 tx_power; 8792 int err; 8793 8794 BT_DBG("%s", hdev->name); 8795 8796 status = mgmt_le_support(hdev); 8797 if (status) 8798 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_PARAMS, 8799 status); 8800 8801 if (cp->instance < 1 || cp->instance > hdev->le_num_of_adv_sets) 8802 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_PARAMS, 8803 MGMT_STATUS_INVALID_PARAMS); 8804 8805 /* The purpose of breaking add_advertising into two separate MGMT calls 8806 * for params and data is to allow more parameters to be added to this 8807 * structure in the future. For this reason, we verify that we have the 8808 * bare minimum structure we know of when the interface was defined. Any 8809 * extra parameters we don't know about will be ignored in this request. 8810 */ 8811 if (data_len < MGMT_ADD_EXT_ADV_PARAMS_MIN_SIZE) 8812 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_PARAMS, 8813 MGMT_STATUS_INVALID_PARAMS); 8814 8815 flags = __le32_to_cpu(cp->flags); 8816 8817 if (!requested_adv_flags_are_valid(hdev, flags)) 8818 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_PARAMS, 8819 MGMT_STATUS_INVALID_PARAMS); 8820 8821 hci_dev_lock(hdev); 8822 8823 /* In new interface, we require that we are powered to register */ 8824 if (!hdev_is_powered(hdev)) { 8825 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_PARAMS, 8826 MGMT_STATUS_REJECTED); 8827 goto unlock; 8828 } 8829 8830 if (adv_busy(hdev)) { 8831 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_PARAMS, 8832 MGMT_STATUS_BUSY); 8833 goto unlock; 8834 } 8835 8836 /* Parse defined parameters from request, use defaults otherwise */ 8837 timeout = (flags & MGMT_ADV_PARAM_TIMEOUT) ? 8838 __le16_to_cpu(cp->timeout) : 0; 8839 8840 duration = (flags & MGMT_ADV_PARAM_DURATION) ? 8841 __le16_to_cpu(cp->duration) : 8842 hdev->def_multi_adv_rotation_duration; 8843 8844 min_interval = (flags & MGMT_ADV_PARAM_INTERVALS) ? 8845 __le32_to_cpu(cp->min_interval) : 8846 hdev->le_adv_min_interval; 8847 8848 max_interval = (flags & MGMT_ADV_PARAM_INTERVALS) ? 8849 __le32_to_cpu(cp->max_interval) : 8850 hdev->le_adv_max_interval; 8851 8852 tx_power = (flags & MGMT_ADV_PARAM_TX_POWER) ? 8853 cp->tx_power : 8854 HCI_ADV_TX_POWER_NO_PREFERENCE; 8855 8856 /* Create advertising instance with no advertising or response data */ 8857 adv = hci_add_adv_instance(hdev, cp->instance, flags, 0, NULL, 0, NULL, 8858 timeout, duration, tx_power, min_interval, 8859 max_interval, 0); 8860 8861 if (IS_ERR(adv)) { 8862 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_PARAMS, 8863 MGMT_STATUS_FAILED); 8864 goto unlock; 8865 } 8866 8867 /* Submit request for advertising params if ext adv available */ 8868 if (ext_adv_capable(hdev)) { 8869 cmd = mgmt_pending_new(sk, MGMT_OP_ADD_EXT_ADV_PARAMS, hdev, 8870 data, data_len); 8871 if (!cmd) { 8872 err = -ENOMEM; 8873 hci_remove_adv_instance(hdev, cp->instance); 8874 goto unlock; 8875 } 8876 8877 err = hci_cmd_sync_queue(hdev, add_ext_adv_params_sync, cmd, 8878 add_ext_adv_params_complete); 8879 if (err < 0) 8880 mgmt_pending_free(cmd); 8881 } else { 8882 rp.instance = cp->instance; 8883 rp.tx_power = HCI_ADV_TX_POWER_NO_PREFERENCE; 8884 rp.max_adv_data_len = tlv_data_max_len(hdev, flags, true); 8885 rp.max_scan_rsp_len = tlv_data_max_len(hdev, flags, false); 8886 err = mgmt_cmd_complete(sk, hdev->id, 8887 MGMT_OP_ADD_EXT_ADV_PARAMS, 8888 MGMT_STATUS_SUCCESS, &rp, sizeof(rp)); 8889 } 8890 8891 unlock: 8892 hci_dev_unlock(hdev); 8893 8894 return err; 8895 } 8896 8897 static void add_ext_adv_data_complete(struct hci_dev *hdev, void *data, int err) 8898 { 8899 struct mgmt_pending_cmd *cmd = data; 8900 struct mgmt_cp_add_ext_adv_data *cp = cmd->param; 8901 struct mgmt_rp_add_advertising rp; 8902 8903 add_adv_complete(hdev, cmd->sk, cp->instance, err); 8904 8905 memset(&rp, 0, sizeof(rp)); 8906 8907 rp.instance = cp->instance; 8908 8909 if (err) 8910 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, 8911 mgmt_status(err)); 8912 else 8913 mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, 8914 mgmt_status(err), &rp, sizeof(rp)); 8915 8916 mgmt_pending_free(cmd); 8917 } 8918 8919 static int add_ext_adv_data_sync(struct hci_dev *hdev, void *data) 8920 { 8921 struct mgmt_pending_cmd *cmd = data; 8922 struct mgmt_cp_add_ext_adv_data *cp = cmd->param; 8923 int err; 8924 8925 if (ext_adv_capable(hdev)) { 8926 err = hci_update_adv_data_sync(hdev, cp->instance); 8927 if (err) 8928 return err; 8929 8930 err = hci_update_scan_rsp_data_sync(hdev, cp->instance); 8931 if (err) 8932 return err; 8933 8934 return hci_enable_ext_advertising_sync(hdev, cp->instance); 8935 } 8936 8937 return hci_schedule_adv_instance_sync(hdev, cp->instance, true); 8938 } 8939 8940 static int add_ext_adv_data(struct sock *sk, struct hci_dev *hdev, void *data, 8941 u16 data_len) 8942 { 8943 struct mgmt_cp_add_ext_adv_data *cp = data; 8944 struct mgmt_rp_add_ext_adv_data rp; 8945 u8 schedule_instance = 0; 8946 struct adv_info *next_instance; 8947 struct adv_info *adv_instance; 8948 int err = 0; 8949 struct mgmt_pending_cmd *cmd; 8950 8951 BT_DBG("%s", hdev->name); 8952 8953 hci_dev_lock(hdev); 8954 8955 adv_instance = hci_find_adv_instance(hdev, cp->instance); 8956 8957 if (!adv_instance) { 8958 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_DATA, 8959 MGMT_STATUS_INVALID_PARAMS); 8960 goto unlock; 8961 } 8962 8963 /* In new interface, we require that we are powered to register */ 8964 if (!hdev_is_powered(hdev)) { 8965 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_DATA, 8966 MGMT_STATUS_REJECTED); 8967 goto clear_new_instance; 8968 } 8969 8970 if (adv_busy(hdev)) { 8971 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_DATA, 8972 MGMT_STATUS_BUSY); 8973 goto clear_new_instance; 8974 } 8975 8976 /* Validate new data */ 8977 if (!tlv_data_is_valid(hdev, adv_instance->flags, cp->data, 8978 cp->adv_data_len, true) || 8979 !tlv_data_is_valid(hdev, adv_instance->flags, cp->data + 8980 cp->adv_data_len, cp->scan_rsp_len, false)) { 8981 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_DATA, 8982 MGMT_STATUS_INVALID_PARAMS); 8983 goto clear_new_instance; 8984 } 8985 8986 /* Set the data in the advertising instance */ 8987 hci_set_adv_instance_data(hdev, cp->instance, cp->adv_data_len, 8988 cp->data, cp->scan_rsp_len, 8989 cp->data + cp->adv_data_len); 8990 8991 /* If using software rotation, determine next instance to use */ 8992 if (hdev->cur_adv_instance == cp->instance) { 8993 /* If the currently advertised instance is being changed 8994 * then cancel the current advertising and schedule the 8995 * next instance. If there is only one instance then the 8996 * overridden advertising data will be visible right 8997 * away 8998 */ 8999 cancel_adv_timeout(hdev); 9000 9001 next_instance = hci_get_next_instance(hdev, cp->instance); 9002 if (next_instance) 9003 schedule_instance = next_instance->instance; 9004 } else if (!hdev->adv_instance_timeout) { 9005 /* Immediately advertise the new instance if no other 9006 * instance is currently being advertised. 9007 */ 9008 schedule_instance = cp->instance; 9009 } 9010 9011 /* If the HCI_ADVERTISING flag is set or there is no instance to 9012 * be advertised then we have no HCI communication to make. 9013 * Simply return. 9014 */ 9015 if (hci_dev_test_flag(hdev, HCI_ADVERTISING) || !schedule_instance) { 9016 if (adv_instance->pending) { 9017 mgmt_advertising_added(sk, hdev, cp->instance); 9018 adv_instance->pending = false; 9019 } 9020 rp.instance = cp->instance; 9021 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_DATA, 9022 MGMT_STATUS_SUCCESS, &rp, sizeof(rp)); 9023 goto unlock; 9024 } 9025 9026 cmd = mgmt_pending_new(sk, MGMT_OP_ADD_EXT_ADV_DATA, hdev, data, 9027 data_len); 9028 if (!cmd) { 9029 err = -ENOMEM; 9030 goto clear_new_instance; 9031 } 9032 9033 err = hci_cmd_sync_queue(hdev, add_ext_adv_data_sync, cmd, 9034 add_ext_adv_data_complete); 9035 if (err < 0) { 9036 mgmt_pending_free(cmd); 9037 goto clear_new_instance; 9038 } 9039 9040 /* We were successful in updating data, so trigger advertising_added 9041 * event if this is an instance that wasn't previously advertising. If 9042 * a failure occurs in the requests we initiated, we will remove the 9043 * instance again in add_advertising_complete 9044 */ 9045 if (adv_instance->pending) 9046 mgmt_advertising_added(sk, hdev, cp->instance); 9047 9048 goto unlock; 9049 9050 clear_new_instance: 9051 hci_remove_adv_instance(hdev, cp->instance); 9052 9053 unlock: 9054 hci_dev_unlock(hdev); 9055 9056 return err; 9057 } 9058 9059 static void remove_advertising_complete(struct hci_dev *hdev, void *data, 9060 int err) 9061 { 9062 struct mgmt_pending_cmd *cmd = data; 9063 struct mgmt_cp_remove_advertising *cp = cmd->param; 9064 struct mgmt_rp_remove_advertising rp; 9065 9066 bt_dev_dbg(hdev, "err %d", err); 9067 9068 memset(&rp, 0, sizeof(rp)); 9069 rp.instance = cp->instance; 9070 9071 if (err) 9072 mgmt_cmd_status(cmd->sk, cmd->index, cmd->opcode, 9073 mgmt_status(err)); 9074 else 9075 mgmt_cmd_complete(cmd->sk, cmd->index, cmd->opcode, 9076 MGMT_STATUS_SUCCESS, &rp, sizeof(rp)); 9077 9078 mgmt_pending_free(cmd); 9079 } 9080 9081 static int remove_advertising_sync(struct hci_dev *hdev, void *data) 9082 { 9083 struct mgmt_pending_cmd *cmd = data; 9084 struct mgmt_cp_remove_advertising *cp = cmd->param; 9085 int err; 9086 9087 err = hci_remove_advertising_sync(hdev, cmd->sk, cp->instance, true); 9088 if (err) 9089 return err; 9090 9091 if (list_empty(&hdev->adv_instances)) 9092 err = hci_disable_advertising_sync(hdev); 9093 9094 return err; 9095 } 9096 9097 static int remove_advertising(struct sock *sk, struct hci_dev *hdev, 9098 void *data, u16 data_len) 9099 { 9100 struct mgmt_cp_remove_advertising *cp = data; 9101 struct mgmt_pending_cmd *cmd; 9102 int err; 9103 9104 bt_dev_dbg(hdev, "sock %p", sk); 9105 9106 hci_dev_lock(hdev); 9107 9108 if (cp->instance && !hci_find_adv_instance(hdev, cp->instance)) { 9109 err = mgmt_cmd_status(sk, hdev->id, 9110 MGMT_OP_REMOVE_ADVERTISING, 9111 MGMT_STATUS_INVALID_PARAMS); 9112 goto unlock; 9113 } 9114 9115 if (pending_find(MGMT_OP_SET_LE, hdev)) { 9116 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_ADVERTISING, 9117 MGMT_STATUS_BUSY); 9118 goto unlock; 9119 } 9120 9121 if (list_empty(&hdev->adv_instances)) { 9122 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_ADVERTISING, 9123 MGMT_STATUS_INVALID_PARAMS); 9124 goto unlock; 9125 } 9126 9127 cmd = mgmt_pending_new(sk, MGMT_OP_REMOVE_ADVERTISING, hdev, data, 9128 data_len); 9129 if (!cmd) { 9130 err = -ENOMEM; 9131 goto unlock; 9132 } 9133 9134 err = hci_cmd_sync_queue(hdev, remove_advertising_sync, cmd, 9135 remove_advertising_complete); 9136 if (err < 0) 9137 mgmt_pending_free(cmd); 9138 9139 unlock: 9140 hci_dev_unlock(hdev); 9141 9142 return err; 9143 } 9144 9145 static int get_adv_size_info(struct sock *sk, struct hci_dev *hdev, 9146 void *data, u16 data_len) 9147 { 9148 struct mgmt_cp_get_adv_size_info *cp = data; 9149 struct mgmt_rp_get_adv_size_info rp; 9150 u32 flags, supported_flags; 9151 9152 bt_dev_dbg(hdev, "sock %p", sk); 9153 9154 if (!lmp_le_capable(hdev)) 9155 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_ADV_SIZE_INFO, 9156 MGMT_STATUS_REJECTED); 9157 9158 if (cp->instance < 1 || cp->instance > hdev->le_num_of_adv_sets) 9159 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_ADV_SIZE_INFO, 9160 MGMT_STATUS_INVALID_PARAMS); 9161 9162 flags = __le32_to_cpu(cp->flags); 9163 9164 /* The current implementation only supports a subset of the specified 9165 * flags. 9166 */ 9167 supported_flags = get_supported_adv_flags(hdev); 9168 if (flags & ~supported_flags) 9169 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_ADV_SIZE_INFO, 9170 MGMT_STATUS_INVALID_PARAMS); 9171 9172 rp.instance = cp->instance; 9173 rp.flags = cp->flags; 9174 rp.max_adv_data_len = tlv_data_max_len(hdev, flags, true); 9175 rp.max_scan_rsp_len = tlv_data_max_len(hdev, flags, false); 9176 9177 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_ADV_SIZE_INFO, 9178 MGMT_STATUS_SUCCESS, &rp, sizeof(rp)); 9179 } 9180 9181 static const struct hci_mgmt_handler mgmt_handlers[] = { 9182 { NULL }, /* 0x0000 (no command) */ 9183 { read_version, MGMT_READ_VERSION_SIZE, 9184 HCI_MGMT_NO_HDEV | 9185 HCI_MGMT_UNTRUSTED }, 9186 { read_commands, MGMT_READ_COMMANDS_SIZE, 9187 HCI_MGMT_NO_HDEV | 9188 HCI_MGMT_UNTRUSTED }, 9189 { read_index_list, MGMT_READ_INDEX_LIST_SIZE, 9190 HCI_MGMT_NO_HDEV | 9191 HCI_MGMT_UNTRUSTED }, 9192 { read_controller_info, MGMT_READ_INFO_SIZE, 9193 HCI_MGMT_UNTRUSTED }, 9194 { set_powered, MGMT_SETTING_SIZE }, 9195 { set_discoverable, MGMT_SET_DISCOVERABLE_SIZE }, 9196 { set_connectable, MGMT_SETTING_SIZE }, 9197 { set_fast_connectable, MGMT_SETTING_SIZE }, 9198 { set_bondable, MGMT_SETTING_SIZE }, 9199 { set_link_security, MGMT_SETTING_SIZE }, 9200 { set_ssp, MGMT_SETTING_SIZE }, 9201 { set_hs, MGMT_SETTING_SIZE }, 9202 { set_le, MGMT_SETTING_SIZE }, 9203 { set_dev_class, MGMT_SET_DEV_CLASS_SIZE }, 9204 { set_local_name, MGMT_SET_LOCAL_NAME_SIZE }, 9205 { add_uuid, MGMT_ADD_UUID_SIZE }, 9206 { remove_uuid, MGMT_REMOVE_UUID_SIZE }, 9207 { load_link_keys, MGMT_LOAD_LINK_KEYS_SIZE, 9208 HCI_MGMT_VAR_LEN }, 9209 { load_long_term_keys, MGMT_LOAD_LONG_TERM_KEYS_SIZE, 9210 HCI_MGMT_VAR_LEN }, 9211 { disconnect, MGMT_DISCONNECT_SIZE }, 9212 { get_connections, MGMT_GET_CONNECTIONS_SIZE }, 9213 { pin_code_reply, MGMT_PIN_CODE_REPLY_SIZE }, 9214 { pin_code_neg_reply, MGMT_PIN_CODE_NEG_REPLY_SIZE }, 9215 { set_io_capability, MGMT_SET_IO_CAPABILITY_SIZE }, 9216 { pair_device, MGMT_PAIR_DEVICE_SIZE }, 9217 { cancel_pair_device, MGMT_CANCEL_PAIR_DEVICE_SIZE }, 9218 { unpair_device, MGMT_UNPAIR_DEVICE_SIZE }, 9219 { user_confirm_reply, MGMT_USER_CONFIRM_REPLY_SIZE }, 9220 { user_confirm_neg_reply, MGMT_USER_CONFIRM_NEG_REPLY_SIZE }, 9221 { user_passkey_reply, MGMT_USER_PASSKEY_REPLY_SIZE }, 9222 { user_passkey_neg_reply, MGMT_USER_PASSKEY_NEG_REPLY_SIZE }, 9223 { read_local_oob_data, MGMT_READ_LOCAL_OOB_DATA_SIZE }, 9224 { add_remote_oob_data, MGMT_ADD_REMOTE_OOB_DATA_SIZE, 9225 HCI_MGMT_VAR_LEN }, 9226 { remove_remote_oob_data, MGMT_REMOVE_REMOTE_OOB_DATA_SIZE }, 9227 { start_discovery, MGMT_START_DISCOVERY_SIZE }, 9228 { stop_discovery, MGMT_STOP_DISCOVERY_SIZE }, 9229 { confirm_name, MGMT_CONFIRM_NAME_SIZE }, 9230 { block_device, MGMT_BLOCK_DEVICE_SIZE }, 9231 { unblock_device, MGMT_UNBLOCK_DEVICE_SIZE }, 9232 { set_device_id, MGMT_SET_DEVICE_ID_SIZE }, 9233 { set_advertising, MGMT_SETTING_SIZE }, 9234 { set_bredr, MGMT_SETTING_SIZE }, 9235 { set_static_address, MGMT_SET_STATIC_ADDRESS_SIZE }, 9236 { set_scan_params, MGMT_SET_SCAN_PARAMS_SIZE }, 9237 { set_secure_conn, MGMT_SETTING_SIZE }, 9238 { set_debug_keys, MGMT_SETTING_SIZE }, 9239 { set_privacy, MGMT_SET_PRIVACY_SIZE }, 9240 { load_irks, MGMT_LOAD_IRKS_SIZE, 9241 HCI_MGMT_VAR_LEN }, 9242 { get_conn_info, MGMT_GET_CONN_INFO_SIZE }, 9243 { get_clock_info, MGMT_GET_CLOCK_INFO_SIZE }, 9244 { add_device, MGMT_ADD_DEVICE_SIZE }, 9245 { remove_device, MGMT_REMOVE_DEVICE_SIZE }, 9246 { load_conn_param, MGMT_LOAD_CONN_PARAM_SIZE, 9247 HCI_MGMT_VAR_LEN }, 9248 { read_unconf_index_list, MGMT_READ_UNCONF_INDEX_LIST_SIZE, 9249 HCI_MGMT_NO_HDEV | 9250 HCI_MGMT_UNTRUSTED }, 9251 { read_config_info, MGMT_READ_CONFIG_INFO_SIZE, 9252 HCI_MGMT_UNCONFIGURED | 9253 HCI_MGMT_UNTRUSTED }, 9254 { set_external_config, MGMT_SET_EXTERNAL_CONFIG_SIZE, 9255 HCI_MGMT_UNCONFIGURED }, 9256 { set_public_address, MGMT_SET_PUBLIC_ADDRESS_SIZE, 9257 HCI_MGMT_UNCONFIGURED }, 9258 { start_service_discovery, MGMT_START_SERVICE_DISCOVERY_SIZE, 9259 HCI_MGMT_VAR_LEN }, 9260 { read_local_oob_ext_data, MGMT_READ_LOCAL_OOB_EXT_DATA_SIZE }, 9261 { read_ext_index_list, MGMT_READ_EXT_INDEX_LIST_SIZE, 9262 HCI_MGMT_NO_HDEV | 9263 HCI_MGMT_UNTRUSTED }, 9264 { read_adv_features, MGMT_READ_ADV_FEATURES_SIZE }, 9265 { add_advertising, MGMT_ADD_ADVERTISING_SIZE, 9266 HCI_MGMT_VAR_LEN }, 9267 { remove_advertising, MGMT_REMOVE_ADVERTISING_SIZE }, 9268 { get_adv_size_info, MGMT_GET_ADV_SIZE_INFO_SIZE }, 9269 { start_limited_discovery, MGMT_START_DISCOVERY_SIZE }, 9270 { read_ext_controller_info,MGMT_READ_EXT_INFO_SIZE, 9271 HCI_MGMT_UNTRUSTED }, 9272 { set_appearance, MGMT_SET_APPEARANCE_SIZE }, 9273 { get_phy_configuration, MGMT_GET_PHY_CONFIGURATION_SIZE }, 9274 { set_phy_configuration, MGMT_SET_PHY_CONFIGURATION_SIZE }, 9275 { set_blocked_keys, MGMT_OP_SET_BLOCKED_KEYS_SIZE, 9276 HCI_MGMT_VAR_LEN }, 9277 { set_wideband_speech, MGMT_SETTING_SIZE }, 9278 { read_controller_cap, MGMT_READ_CONTROLLER_CAP_SIZE, 9279 HCI_MGMT_UNTRUSTED }, 9280 { read_exp_features_info, MGMT_READ_EXP_FEATURES_INFO_SIZE, 9281 HCI_MGMT_UNTRUSTED | 9282 HCI_MGMT_HDEV_OPTIONAL }, 9283 { set_exp_feature, MGMT_SET_EXP_FEATURE_SIZE, 9284 HCI_MGMT_VAR_LEN | 9285 HCI_MGMT_HDEV_OPTIONAL }, 9286 { read_def_system_config, MGMT_READ_DEF_SYSTEM_CONFIG_SIZE, 9287 HCI_MGMT_UNTRUSTED }, 9288 { set_def_system_config, MGMT_SET_DEF_SYSTEM_CONFIG_SIZE, 9289 HCI_MGMT_VAR_LEN }, 9290 { read_def_runtime_config, MGMT_READ_DEF_RUNTIME_CONFIG_SIZE, 9291 HCI_MGMT_UNTRUSTED }, 9292 { set_def_runtime_config, MGMT_SET_DEF_RUNTIME_CONFIG_SIZE, 9293 HCI_MGMT_VAR_LEN }, 9294 { get_device_flags, MGMT_GET_DEVICE_FLAGS_SIZE }, 9295 { set_device_flags, MGMT_SET_DEVICE_FLAGS_SIZE }, 9296 { read_adv_mon_features, MGMT_READ_ADV_MONITOR_FEATURES_SIZE }, 9297 { add_adv_patterns_monitor,MGMT_ADD_ADV_PATTERNS_MONITOR_SIZE, 9298 HCI_MGMT_VAR_LEN }, 9299 { remove_adv_monitor, MGMT_REMOVE_ADV_MONITOR_SIZE }, 9300 { add_ext_adv_params, MGMT_ADD_EXT_ADV_PARAMS_MIN_SIZE, 9301 HCI_MGMT_VAR_LEN }, 9302 { add_ext_adv_data, MGMT_ADD_EXT_ADV_DATA_SIZE, 9303 HCI_MGMT_VAR_LEN }, 9304 { add_adv_patterns_monitor_rssi, 9305 MGMT_ADD_ADV_PATTERNS_MONITOR_RSSI_SIZE, 9306 HCI_MGMT_VAR_LEN }, 9307 { set_mesh, MGMT_SET_MESH_RECEIVER_SIZE, 9308 HCI_MGMT_VAR_LEN }, 9309 { mesh_features, MGMT_MESH_READ_FEATURES_SIZE }, 9310 { mesh_send, MGMT_MESH_SEND_SIZE, 9311 HCI_MGMT_VAR_LEN }, 9312 { mesh_send_cancel, MGMT_MESH_SEND_CANCEL_SIZE }, 9313 }; 9314 9315 void mgmt_index_added(struct hci_dev *hdev) 9316 { 9317 struct mgmt_ev_ext_index ev; 9318 9319 if (test_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks)) 9320 return; 9321 9322 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) { 9323 mgmt_index_event(MGMT_EV_UNCONF_INDEX_ADDED, hdev, NULL, 0, 9324 HCI_MGMT_UNCONF_INDEX_EVENTS); 9325 ev.type = 0x01; 9326 } else { 9327 mgmt_index_event(MGMT_EV_INDEX_ADDED, hdev, NULL, 0, 9328 HCI_MGMT_INDEX_EVENTS); 9329 ev.type = 0x00; 9330 } 9331 9332 ev.bus = hdev->bus; 9333 9334 mgmt_index_event(MGMT_EV_EXT_INDEX_ADDED, hdev, &ev, sizeof(ev), 9335 HCI_MGMT_EXT_INDEX_EVENTS); 9336 } 9337 9338 void mgmt_index_removed(struct hci_dev *hdev) 9339 { 9340 struct mgmt_ev_ext_index ev; 9341 u8 status = MGMT_STATUS_INVALID_INDEX; 9342 9343 if (test_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks)) 9344 return; 9345 9346 mgmt_pending_foreach(0, hdev, cmd_complete_rsp, &status); 9347 9348 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) { 9349 mgmt_index_event(MGMT_EV_UNCONF_INDEX_REMOVED, hdev, NULL, 0, 9350 HCI_MGMT_UNCONF_INDEX_EVENTS); 9351 ev.type = 0x01; 9352 } else { 9353 mgmt_index_event(MGMT_EV_INDEX_REMOVED, hdev, NULL, 0, 9354 HCI_MGMT_INDEX_EVENTS); 9355 ev.type = 0x00; 9356 } 9357 9358 ev.bus = hdev->bus; 9359 9360 mgmt_index_event(MGMT_EV_EXT_INDEX_REMOVED, hdev, &ev, sizeof(ev), 9361 HCI_MGMT_EXT_INDEX_EVENTS); 9362 9363 /* Cancel any remaining timed work */ 9364 if (!hci_dev_test_flag(hdev, HCI_MGMT)) 9365 return; 9366 cancel_delayed_work_sync(&hdev->discov_off); 9367 cancel_delayed_work_sync(&hdev->service_cache); 9368 cancel_delayed_work_sync(&hdev->rpa_expired); 9369 } 9370 9371 void mgmt_power_on(struct hci_dev *hdev, int err) 9372 { 9373 struct cmd_lookup match = { NULL, hdev }; 9374 9375 bt_dev_dbg(hdev, "err %d", err); 9376 9377 hci_dev_lock(hdev); 9378 9379 if (!err) { 9380 restart_le_actions(hdev); 9381 hci_update_passive_scan(hdev); 9382 } 9383 9384 mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp, &match); 9385 9386 new_settings(hdev, match.sk); 9387 9388 if (match.sk) 9389 sock_put(match.sk); 9390 9391 hci_dev_unlock(hdev); 9392 } 9393 9394 void __mgmt_power_off(struct hci_dev *hdev) 9395 { 9396 struct cmd_lookup match = { NULL, hdev }; 9397 u8 status, zero_cod[] = { 0, 0, 0 }; 9398 9399 mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp, &match); 9400 9401 /* If the power off is because of hdev unregistration let 9402 * use the appropriate INVALID_INDEX status. Otherwise use 9403 * NOT_POWERED. We cover both scenarios here since later in 9404 * mgmt_index_removed() any hci_conn callbacks will have already 9405 * been triggered, potentially causing misleading DISCONNECTED 9406 * status responses. 9407 */ 9408 if (hci_dev_test_flag(hdev, HCI_UNREGISTER)) 9409 status = MGMT_STATUS_INVALID_INDEX; 9410 else 9411 status = MGMT_STATUS_NOT_POWERED; 9412 9413 mgmt_pending_foreach(0, hdev, cmd_complete_rsp, &status); 9414 9415 if (memcmp(hdev->dev_class, zero_cod, sizeof(zero_cod)) != 0) { 9416 mgmt_limited_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev, 9417 zero_cod, sizeof(zero_cod), 9418 HCI_MGMT_DEV_CLASS_EVENTS, NULL); 9419 ext_info_changed(hdev, NULL); 9420 } 9421 9422 new_settings(hdev, match.sk); 9423 9424 if (match.sk) 9425 sock_put(match.sk); 9426 } 9427 9428 void mgmt_set_powered_failed(struct hci_dev *hdev, int err) 9429 { 9430 struct mgmt_pending_cmd *cmd; 9431 u8 status; 9432 9433 cmd = pending_find(MGMT_OP_SET_POWERED, hdev); 9434 if (!cmd) 9435 return; 9436 9437 if (err == -ERFKILL) 9438 status = MGMT_STATUS_RFKILLED; 9439 else 9440 status = MGMT_STATUS_FAILED; 9441 9442 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_POWERED, status); 9443 9444 mgmt_pending_remove(cmd); 9445 } 9446 9447 void mgmt_new_link_key(struct hci_dev *hdev, struct link_key *key, 9448 bool persistent) 9449 { 9450 struct mgmt_ev_new_link_key ev; 9451 9452 memset(&ev, 0, sizeof(ev)); 9453 9454 ev.store_hint = persistent; 9455 bacpy(&ev.key.addr.bdaddr, &key->bdaddr); 9456 ev.key.addr.type = link_to_bdaddr(key->link_type, key->bdaddr_type); 9457 ev.key.type = key->type; 9458 memcpy(ev.key.val, key->val, HCI_LINK_KEY_SIZE); 9459 ev.key.pin_len = key->pin_len; 9460 9461 mgmt_event(MGMT_EV_NEW_LINK_KEY, hdev, &ev, sizeof(ev), NULL); 9462 } 9463 9464 static u8 mgmt_ltk_type(struct smp_ltk *ltk) 9465 { 9466 switch (ltk->type) { 9467 case SMP_LTK: 9468 case SMP_LTK_RESPONDER: 9469 if (ltk->authenticated) 9470 return MGMT_LTK_AUTHENTICATED; 9471 return MGMT_LTK_UNAUTHENTICATED; 9472 case SMP_LTK_P256: 9473 if (ltk->authenticated) 9474 return MGMT_LTK_P256_AUTH; 9475 return MGMT_LTK_P256_UNAUTH; 9476 case SMP_LTK_P256_DEBUG: 9477 return MGMT_LTK_P256_DEBUG; 9478 } 9479 9480 return MGMT_LTK_UNAUTHENTICATED; 9481 } 9482 9483 void mgmt_new_ltk(struct hci_dev *hdev, struct smp_ltk *key, bool persistent) 9484 { 9485 struct mgmt_ev_new_long_term_key ev; 9486 9487 memset(&ev, 0, sizeof(ev)); 9488 9489 /* Devices using resolvable or non-resolvable random addresses 9490 * without providing an identity resolving key don't require 9491 * to store long term keys. Their addresses will change the 9492 * next time around. 9493 * 9494 * Only when a remote device provides an identity address 9495 * make sure the long term key is stored. If the remote 9496 * identity is known, the long term keys are internally 9497 * mapped to the identity address. So allow static random 9498 * and public addresses here. 9499 */ 9500 if (key->bdaddr_type == ADDR_LE_DEV_RANDOM && 9501 (key->bdaddr.b[5] & 0xc0) != 0xc0) 9502 ev.store_hint = 0x00; 9503 else 9504 ev.store_hint = persistent; 9505 9506 bacpy(&ev.key.addr.bdaddr, &key->bdaddr); 9507 ev.key.addr.type = link_to_bdaddr(key->link_type, key->bdaddr_type); 9508 ev.key.type = mgmt_ltk_type(key); 9509 ev.key.enc_size = key->enc_size; 9510 ev.key.ediv = key->ediv; 9511 ev.key.rand = key->rand; 9512 9513 if (key->type == SMP_LTK) 9514 ev.key.initiator = 1; 9515 9516 /* Make sure we copy only the significant bytes based on the 9517 * encryption key size, and set the rest of the value to zeroes. 9518 */ 9519 memcpy(ev.key.val, key->val, key->enc_size); 9520 memset(ev.key.val + key->enc_size, 0, 9521 sizeof(ev.key.val) - key->enc_size); 9522 9523 mgmt_event(MGMT_EV_NEW_LONG_TERM_KEY, hdev, &ev, sizeof(ev), NULL); 9524 } 9525 9526 void mgmt_new_irk(struct hci_dev *hdev, struct smp_irk *irk, bool persistent) 9527 { 9528 struct mgmt_ev_new_irk ev; 9529 9530 memset(&ev, 0, sizeof(ev)); 9531 9532 ev.store_hint = persistent; 9533 9534 bacpy(&ev.rpa, &irk->rpa); 9535 bacpy(&ev.irk.addr.bdaddr, &irk->bdaddr); 9536 ev.irk.addr.type = link_to_bdaddr(irk->link_type, irk->addr_type); 9537 memcpy(ev.irk.val, irk->val, sizeof(irk->val)); 9538 9539 mgmt_event(MGMT_EV_NEW_IRK, hdev, &ev, sizeof(ev), NULL); 9540 } 9541 9542 void mgmt_new_csrk(struct hci_dev *hdev, struct smp_csrk *csrk, 9543 bool persistent) 9544 { 9545 struct mgmt_ev_new_csrk ev; 9546 9547 memset(&ev, 0, sizeof(ev)); 9548 9549 /* Devices using resolvable or non-resolvable random addresses 9550 * without providing an identity resolving key don't require 9551 * to store signature resolving keys. Their addresses will change 9552 * the next time around. 9553 * 9554 * Only when a remote device provides an identity address 9555 * make sure the signature resolving key is stored. So allow 9556 * static random and public addresses here. 9557 */ 9558 if (csrk->bdaddr_type == ADDR_LE_DEV_RANDOM && 9559 (csrk->bdaddr.b[5] & 0xc0) != 0xc0) 9560 ev.store_hint = 0x00; 9561 else 9562 ev.store_hint = persistent; 9563 9564 bacpy(&ev.key.addr.bdaddr, &csrk->bdaddr); 9565 ev.key.addr.type = link_to_bdaddr(csrk->link_type, csrk->bdaddr_type); 9566 ev.key.type = csrk->type; 9567 memcpy(ev.key.val, csrk->val, sizeof(csrk->val)); 9568 9569 mgmt_event(MGMT_EV_NEW_CSRK, hdev, &ev, sizeof(ev), NULL); 9570 } 9571 9572 void mgmt_new_conn_param(struct hci_dev *hdev, bdaddr_t *bdaddr, 9573 u8 bdaddr_type, u8 store_hint, u16 min_interval, 9574 u16 max_interval, u16 latency, u16 timeout) 9575 { 9576 struct mgmt_ev_new_conn_param ev; 9577 9578 if (!hci_is_identity_address(bdaddr, bdaddr_type)) 9579 return; 9580 9581 memset(&ev, 0, sizeof(ev)); 9582 bacpy(&ev.addr.bdaddr, bdaddr); 9583 ev.addr.type = link_to_bdaddr(LE_LINK, bdaddr_type); 9584 ev.store_hint = store_hint; 9585 ev.min_interval = cpu_to_le16(min_interval); 9586 ev.max_interval = cpu_to_le16(max_interval); 9587 ev.latency = cpu_to_le16(latency); 9588 ev.timeout = cpu_to_le16(timeout); 9589 9590 mgmt_event(MGMT_EV_NEW_CONN_PARAM, hdev, &ev, sizeof(ev), NULL); 9591 } 9592 9593 void mgmt_device_connected(struct hci_dev *hdev, struct hci_conn *conn, 9594 u8 *name, u8 name_len) 9595 { 9596 struct sk_buff *skb; 9597 struct mgmt_ev_device_connected *ev; 9598 u16 eir_len = 0; 9599 u32 flags = 0; 9600 9601 if (test_and_set_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags)) 9602 return; 9603 9604 /* allocate buff for LE or BR/EDR adv */ 9605 if (conn->le_adv_data_len > 0) 9606 skb = mgmt_alloc_skb(hdev, MGMT_EV_DEVICE_CONNECTED, 9607 sizeof(*ev) + conn->le_adv_data_len); 9608 else 9609 skb = mgmt_alloc_skb(hdev, MGMT_EV_DEVICE_CONNECTED, 9610 sizeof(*ev) + (name ? eir_precalc_len(name_len) : 0) + 9611 eir_precalc_len(sizeof(conn->dev_class))); 9612 9613 ev = skb_put(skb, sizeof(*ev)); 9614 bacpy(&ev->addr.bdaddr, &conn->dst); 9615 ev->addr.type = link_to_bdaddr(conn->type, conn->dst_type); 9616 9617 if (conn->out) 9618 flags |= MGMT_DEV_FOUND_INITIATED_CONN; 9619 9620 ev->flags = __cpu_to_le32(flags); 9621 9622 /* We must ensure that the EIR Data fields are ordered and 9623 * unique. Keep it simple for now and avoid the problem by not 9624 * adding any BR/EDR data to the LE adv. 9625 */ 9626 if (conn->le_adv_data_len > 0) { 9627 skb_put_data(skb, conn->le_adv_data, conn->le_adv_data_len); 9628 eir_len = conn->le_adv_data_len; 9629 } else { 9630 if (name) 9631 eir_len += eir_skb_put_data(skb, EIR_NAME_COMPLETE, name, name_len); 9632 9633 if (memcmp(conn->dev_class, "\0\0\0", sizeof(conn->dev_class))) 9634 eir_len += eir_skb_put_data(skb, EIR_CLASS_OF_DEV, 9635 conn->dev_class, sizeof(conn->dev_class)); 9636 } 9637 9638 ev->eir_len = cpu_to_le16(eir_len); 9639 9640 mgmt_event_skb(skb, NULL); 9641 } 9642 9643 static void disconnect_rsp(struct mgmt_pending_cmd *cmd, void *data) 9644 { 9645 struct sock **sk = data; 9646 9647 cmd->cmd_complete(cmd, 0); 9648 9649 *sk = cmd->sk; 9650 sock_hold(*sk); 9651 9652 mgmt_pending_remove(cmd); 9653 } 9654 9655 static void unpair_device_rsp(struct mgmt_pending_cmd *cmd, void *data) 9656 { 9657 struct hci_dev *hdev = data; 9658 struct mgmt_cp_unpair_device *cp = cmd->param; 9659 9660 device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, cmd->sk); 9661 9662 cmd->cmd_complete(cmd, 0); 9663 mgmt_pending_remove(cmd); 9664 } 9665 9666 bool mgmt_powering_down(struct hci_dev *hdev) 9667 { 9668 struct mgmt_pending_cmd *cmd; 9669 struct mgmt_mode *cp; 9670 9671 if (hci_dev_test_flag(hdev, HCI_POWERING_DOWN)) 9672 return true; 9673 9674 cmd = pending_find(MGMT_OP_SET_POWERED, hdev); 9675 if (!cmd) 9676 return false; 9677 9678 cp = cmd->param; 9679 if (!cp->val) 9680 return true; 9681 9682 return false; 9683 } 9684 9685 void mgmt_device_disconnected(struct hci_dev *hdev, bdaddr_t *bdaddr, 9686 u8 link_type, u8 addr_type, u8 reason, 9687 bool mgmt_connected) 9688 { 9689 struct mgmt_ev_device_disconnected ev; 9690 struct sock *sk = NULL; 9691 9692 if (!mgmt_connected) 9693 return; 9694 9695 if (link_type != ACL_LINK && link_type != LE_LINK) 9696 return; 9697 9698 mgmt_pending_foreach(MGMT_OP_DISCONNECT, hdev, disconnect_rsp, &sk); 9699 9700 bacpy(&ev.addr.bdaddr, bdaddr); 9701 ev.addr.type = link_to_bdaddr(link_type, addr_type); 9702 ev.reason = reason; 9703 9704 /* Report disconnects due to suspend */ 9705 if (hdev->suspended) 9706 ev.reason = MGMT_DEV_DISCONN_LOCAL_HOST_SUSPEND; 9707 9708 mgmt_event(MGMT_EV_DEVICE_DISCONNECTED, hdev, &ev, sizeof(ev), sk); 9709 9710 if (sk) 9711 sock_put(sk); 9712 9713 mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, unpair_device_rsp, 9714 hdev); 9715 } 9716 9717 void mgmt_disconnect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr, 9718 u8 link_type, u8 addr_type, u8 status) 9719 { 9720 u8 bdaddr_type = link_to_bdaddr(link_type, addr_type); 9721 struct mgmt_cp_disconnect *cp; 9722 struct mgmt_pending_cmd *cmd; 9723 9724 mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, unpair_device_rsp, 9725 hdev); 9726 9727 cmd = pending_find(MGMT_OP_DISCONNECT, hdev); 9728 if (!cmd) 9729 return; 9730 9731 cp = cmd->param; 9732 9733 if (bacmp(bdaddr, &cp->addr.bdaddr)) 9734 return; 9735 9736 if (cp->addr.type != bdaddr_type) 9737 return; 9738 9739 cmd->cmd_complete(cmd, mgmt_status(status)); 9740 mgmt_pending_remove(cmd); 9741 } 9742 9743 void mgmt_connect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type, 9744 u8 addr_type, u8 status) 9745 { 9746 struct mgmt_ev_connect_failed ev; 9747 9748 bacpy(&ev.addr.bdaddr, bdaddr); 9749 ev.addr.type = link_to_bdaddr(link_type, addr_type); 9750 ev.status = mgmt_status(status); 9751 9752 mgmt_event(MGMT_EV_CONNECT_FAILED, hdev, &ev, sizeof(ev), NULL); 9753 } 9754 9755 void mgmt_pin_code_request(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 secure) 9756 { 9757 struct mgmt_ev_pin_code_request ev; 9758 9759 bacpy(&ev.addr.bdaddr, bdaddr); 9760 ev.addr.type = BDADDR_BREDR; 9761 ev.secure = secure; 9762 9763 mgmt_event(MGMT_EV_PIN_CODE_REQUEST, hdev, &ev, sizeof(ev), NULL); 9764 } 9765 9766 void mgmt_pin_code_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr, 9767 u8 status) 9768 { 9769 struct mgmt_pending_cmd *cmd; 9770 9771 cmd = pending_find(MGMT_OP_PIN_CODE_REPLY, hdev); 9772 if (!cmd) 9773 return; 9774 9775 cmd->cmd_complete(cmd, mgmt_status(status)); 9776 mgmt_pending_remove(cmd); 9777 } 9778 9779 void mgmt_pin_code_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr, 9780 u8 status) 9781 { 9782 struct mgmt_pending_cmd *cmd; 9783 9784 cmd = pending_find(MGMT_OP_PIN_CODE_NEG_REPLY, hdev); 9785 if (!cmd) 9786 return; 9787 9788 cmd->cmd_complete(cmd, mgmt_status(status)); 9789 mgmt_pending_remove(cmd); 9790 } 9791 9792 int mgmt_user_confirm_request(struct hci_dev *hdev, bdaddr_t *bdaddr, 9793 u8 link_type, u8 addr_type, u32 value, 9794 u8 confirm_hint) 9795 { 9796 struct mgmt_ev_user_confirm_request ev; 9797 9798 bt_dev_dbg(hdev, "bdaddr %pMR", bdaddr); 9799 9800 bacpy(&ev.addr.bdaddr, bdaddr); 9801 ev.addr.type = link_to_bdaddr(link_type, addr_type); 9802 ev.confirm_hint = confirm_hint; 9803 ev.value = cpu_to_le32(value); 9804 9805 return mgmt_event(MGMT_EV_USER_CONFIRM_REQUEST, hdev, &ev, sizeof(ev), 9806 NULL); 9807 } 9808 9809 int mgmt_user_passkey_request(struct hci_dev *hdev, bdaddr_t *bdaddr, 9810 u8 link_type, u8 addr_type) 9811 { 9812 struct mgmt_ev_user_passkey_request ev; 9813 9814 bt_dev_dbg(hdev, "bdaddr %pMR", bdaddr); 9815 9816 bacpy(&ev.addr.bdaddr, bdaddr); 9817 ev.addr.type = link_to_bdaddr(link_type, addr_type); 9818 9819 return mgmt_event(MGMT_EV_USER_PASSKEY_REQUEST, hdev, &ev, sizeof(ev), 9820 NULL); 9821 } 9822 9823 static int user_pairing_resp_complete(struct hci_dev *hdev, bdaddr_t *bdaddr, 9824 u8 link_type, u8 addr_type, u8 status, 9825 u8 opcode) 9826 { 9827 struct mgmt_pending_cmd *cmd; 9828 9829 cmd = pending_find(opcode, hdev); 9830 if (!cmd) 9831 return -ENOENT; 9832 9833 cmd->cmd_complete(cmd, mgmt_status(status)); 9834 mgmt_pending_remove(cmd); 9835 9836 return 0; 9837 } 9838 9839 int mgmt_user_confirm_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr, 9840 u8 link_type, u8 addr_type, u8 status) 9841 { 9842 return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type, 9843 status, MGMT_OP_USER_CONFIRM_REPLY); 9844 } 9845 9846 int mgmt_user_confirm_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr, 9847 u8 link_type, u8 addr_type, u8 status) 9848 { 9849 return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type, 9850 status, 9851 MGMT_OP_USER_CONFIRM_NEG_REPLY); 9852 } 9853 9854 int mgmt_user_passkey_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr, 9855 u8 link_type, u8 addr_type, u8 status) 9856 { 9857 return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type, 9858 status, MGMT_OP_USER_PASSKEY_REPLY); 9859 } 9860 9861 int mgmt_user_passkey_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr, 9862 u8 link_type, u8 addr_type, u8 status) 9863 { 9864 return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type, 9865 status, 9866 MGMT_OP_USER_PASSKEY_NEG_REPLY); 9867 } 9868 9869 int mgmt_user_passkey_notify(struct hci_dev *hdev, bdaddr_t *bdaddr, 9870 u8 link_type, u8 addr_type, u32 passkey, 9871 u8 entered) 9872 { 9873 struct mgmt_ev_passkey_notify ev; 9874 9875 bt_dev_dbg(hdev, "bdaddr %pMR", bdaddr); 9876 9877 bacpy(&ev.addr.bdaddr, bdaddr); 9878 ev.addr.type = link_to_bdaddr(link_type, addr_type); 9879 ev.passkey = __cpu_to_le32(passkey); 9880 ev.entered = entered; 9881 9882 return mgmt_event(MGMT_EV_PASSKEY_NOTIFY, hdev, &ev, sizeof(ev), NULL); 9883 } 9884 9885 void mgmt_auth_failed(struct hci_conn *conn, u8 hci_status) 9886 { 9887 struct mgmt_ev_auth_failed ev; 9888 struct mgmt_pending_cmd *cmd; 9889 u8 status = mgmt_status(hci_status); 9890 9891 bacpy(&ev.addr.bdaddr, &conn->dst); 9892 ev.addr.type = link_to_bdaddr(conn->type, conn->dst_type); 9893 ev.status = status; 9894 9895 cmd = find_pairing(conn); 9896 9897 mgmt_event(MGMT_EV_AUTH_FAILED, conn->hdev, &ev, sizeof(ev), 9898 cmd ? cmd->sk : NULL); 9899 9900 if (cmd) { 9901 cmd->cmd_complete(cmd, status); 9902 mgmt_pending_remove(cmd); 9903 } 9904 } 9905 9906 void mgmt_auth_enable_complete(struct hci_dev *hdev, u8 status) 9907 { 9908 struct cmd_lookup match = { NULL, hdev }; 9909 bool changed; 9910 9911 if (status) { 9912 u8 mgmt_err = mgmt_status(status); 9913 mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev, 9914 cmd_status_rsp, &mgmt_err); 9915 return; 9916 } 9917 9918 if (test_bit(HCI_AUTH, &hdev->flags)) 9919 changed = !hci_dev_test_and_set_flag(hdev, HCI_LINK_SECURITY); 9920 else 9921 changed = hci_dev_test_and_clear_flag(hdev, HCI_LINK_SECURITY); 9922 9923 mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev, settings_rsp, 9924 &match); 9925 9926 if (changed) 9927 new_settings(hdev, match.sk); 9928 9929 if (match.sk) 9930 sock_put(match.sk); 9931 } 9932 9933 static void sk_lookup(struct mgmt_pending_cmd *cmd, void *data) 9934 { 9935 struct cmd_lookup *match = data; 9936 9937 if (match->sk == NULL) { 9938 match->sk = cmd->sk; 9939 sock_hold(match->sk); 9940 } 9941 } 9942 9943 void mgmt_set_class_of_dev_complete(struct hci_dev *hdev, u8 *dev_class, 9944 u8 status) 9945 { 9946 struct cmd_lookup match = { NULL, hdev, mgmt_status(status) }; 9947 9948 mgmt_pending_foreach(MGMT_OP_SET_DEV_CLASS, hdev, sk_lookup, &match); 9949 mgmt_pending_foreach(MGMT_OP_ADD_UUID, hdev, sk_lookup, &match); 9950 mgmt_pending_foreach(MGMT_OP_REMOVE_UUID, hdev, sk_lookup, &match); 9951 9952 if (!status) { 9953 mgmt_limited_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev, dev_class, 9954 3, HCI_MGMT_DEV_CLASS_EVENTS, NULL); 9955 ext_info_changed(hdev, NULL); 9956 } 9957 9958 if (match.sk) 9959 sock_put(match.sk); 9960 } 9961 9962 void mgmt_set_local_name_complete(struct hci_dev *hdev, u8 *name, u8 status) 9963 { 9964 struct mgmt_cp_set_local_name ev; 9965 struct mgmt_pending_cmd *cmd; 9966 9967 if (status) 9968 return; 9969 9970 memset(&ev, 0, sizeof(ev)); 9971 memcpy(ev.name, name, HCI_MAX_NAME_LENGTH); 9972 memcpy(ev.short_name, hdev->short_name, HCI_MAX_SHORT_NAME_LENGTH); 9973 9974 cmd = pending_find(MGMT_OP_SET_LOCAL_NAME, hdev); 9975 if (!cmd) { 9976 memcpy(hdev->dev_name, name, sizeof(hdev->dev_name)); 9977 9978 /* If this is a HCI command related to powering on the 9979 * HCI dev don't send any mgmt signals. 9980 */ 9981 if (hci_dev_test_flag(hdev, HCI_POWERING_DOWN)) 9982 return; 9983 9984 if (pending_find(MGMT_OP_SET_POWERED, hdev)) 9985 return; 9986 } 9987 9988 mgmt_limited_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, &ev, sizeof(ev), 9989 HCI_MGMT_LOCAL_NAME_EVENTS, cmd ? cmd->sk : NULL); 9990 ext_info_changed(hdev, cmd ? cmd->sk : NULL); 9991 } 9992 9993 static inline bool has_uuid(u8 *uuid, u16 uuid_count, u8 (*uuids)[16]) 9994 { 9995 int i; 9996 9997 for (i = 0; i < uuid_count; i++) { 9998 if (!memcmp(uuid, uuids[i], 16)) 9999 return true; 10000 } 10001 10002 return false; 10003 } 10004 10005 static bool eir_has_uuids(u8 *eir, u16 eir_len, u16 uuid_count, u8 (*uuids)[16]) 10006 { 10007 u16 parsed = 0; 10008 10009 while (parsed < eir_len) { 10010 u8 field_len = eir[0]; 10011 u8 uuid[16]; 10012 int i; 10013 10014 if (field_len == 0) 10015 break; 10016 10017 if (eir_len - parsed < field_len + 1) 10018 break; 10019 10020 switch (eir[1]) { 10021 case EIR_UUID16_ALL: 10022 case EIR_UUID16_SOME: 10023 for (i = 0; i + 3 <= field_len; i += 2) { 10024 memcpy(uuid, bluetooth_base_uuid, 16); 10025 uuid[13] = eir[i + 3]; 10026 uuid[12] = eir[i + 2]; 10027 if (has_uuid(uuid, uuid_count, uuids)) 10028 return true; 10029 } 10030 break; 10031 case EIR_UUID32_ALL: 10032 case EIR_UUID32_SOME: 10033 for (i = 0; i + 5 <= field_len; i += 4) { 10034 memcpy(uuid, bluetooth_base_uuid, 16); 10035 uuid[15] = eir[i + 5]; 10036 uuid[14] = eir[i + 4]; 10037 uuid[13] = eir[i + 3]; 10038 uuid[12] = eir[i + 2]; 10039 if (has_uuid(uuid, uuid_count, uuids)) 10040 return true; 10041 } 10042 break; 10043 case EIR_UUID128_ALL: 10044 case EIR_UUID128_SOME: 10045 for (i = 0; i + 17 <= field_len; i += 16) { 10046 memcpy(uuid, eir + i + 2, 16); 10047 if (has_uuid(uuid, uuid_count, uuids)) 10048 return true; 10049 } 10050 break; 10051 } 10052 10053 parsed += field_len + 1; 10054 eir += field_len + 1; 10055 } 10056 10057 return false; 10058 } 10059 10060 static bool is_filter_match(struct hci_dev *hdev, s8 rssi, u8 *eir, 10061 u16 eir_len, u8 *scan_rsp, u8 scan_rsp_len) 10062 { 10063 /* If a RSSI threshold has been specified, and 10064 * HCI_QUIRK_STRICT_DUPLICATE_FILTER is not set, then all results with 10065 * a RSSI smaller than the RSSI threshold will be dropped. If the quirk 10066 * is set, let it through for further processing, as we might need to 10067 * restart the scan. 10068 * 10069 * For BR/EDR devices (pre 1.2) providing no RSSI during inquiry, 10070 * the results are also dropped. 10071 */ 10072 if (hdev->discovery.rssi != HCI_RSSI_INVALID && 10073 (rssi == HCI_RSSI_INVALID || 10074 (rssi < hdev->discovery.rssi && 10075 !test_bit(HCI_QUIRK_STRICT_DUPLICATE_FILTER, &hdev->quirks)))) 10076 return false; 10077 10078 if (hdev->discovery.uuid_count != 0) { 10079 /* If a list of UUIDs is provided in filter, results with no 10080 * matching UUID should be dropped. 10081 */ 10082 if (!eir_has_uuids(eir, eir_len, hdev->discovery.uuid_count, 10083 hdev->discovery.uuids) && 10084 !eir_has_uuids(scan_rsp, scan_rsp_len, 10085 hdev->discovery.uuid_count, 10086 hdev->discovery.uuids)) 10087 return false; 10088 } 10089 10090 /* If duplicate filtering does not report RSSI changes, then restart 10091 * scanning to ensure updated result with updated RSSI values. 10092 */ 10093 if (test_bit(HCI_QUIRK_STRICT_DUPLICATE_FILTER, &hdev->quirks)) { 10094 /* Validate RSSI value against the RSSI threshold once more. */ 10095 if (hdev->discovery.rssi != HCI_RSSI_INVALID && 10096 rssi < hdev->discovery.rssi) 10097 return false; 10098 } 10099 10100 return true; 10101 } 10102 10103 void mgmt_adv_monitor_device_lost(struct hci_dev *hdev, u16 handle, 10104 bdaddr_t *bdaddr, u8 addr_type) 10105 { 10106 struct mgmt_ev_adv_monitor_device_lost ev; 10107 10108 ev.monitor_handle = cpu_to_le16(handle); 10109 bacpy(&ev.addr.bdaddr, bdaddr); 10110 ev.addr.type = addr_type; 10111 10112 mgmt_event(MGMT_EV_ADV_MONITOR_DEVICE_LOST, hdev, &ev, sizeof(ev), 10113 NULL); 10114 } 10115 10116 static void mgmt_send_adv_monitor_device_found(struct hci_dev *hdev, 10117 struct sk_buff *skb, 10118 struct sock *skip_sk, 10119 u16 handle) 10120 { 10121 struct sk_buff *advmon_skb; 10122 size_t advmon_skb_len; 10123 __le16 *monitor_handle; 10124 10125 if (!skb) 10126 return; 10127 10128 advmon_skb_len = (sizeof(struct mgmt_ev_adv_monitor_device_found) - 10129 sizeof(struct mgmt_ev_device_found)) + skb->len; 10130 advmon_skb = mgmt_alloc_skb(hdev, MGMT_EV_ADV_MONITOR_DEVICE_FOUND, 10131 advmon_skb_len); 10132 if (!advmon_skb) 10133 return; 10134 10135 /* ADV_MONITOR_DEVICE_FOUND is similar to DEVICE_FOUND event except 10136 * that it also has 'monitor_handle'. Make a copy of DEVICE_FOUND and 10137 * store monitor_handle of the matched monitor. 10138 */ 10139 monitor_handle = skb_put(advmon_skb, sizeof(*monitor_handle)); 10140 *monitor_handle = cpu_to_le16(handle); 10141 skb_put_data(advmon_skb, skb->data, skb->len); 10142 10143 mgmt_event_skb(advmon_skb, skip_sk); 10144 } 10145 10146 static void mgmt_adv_monitor_device_found(struct hci_dev *hdev, 10147 bdaddr_t *bdaddr, bool report_device, 10148 struct sk_buff *skb, 10149 struct sock *skip_sk) 10150 { 10151 struct monitored_device *dev, *tmp; 10152 bool matched = false; 10153 bool notified = false; 10154 10155 /* We have received the Advertisement Report because: 10156 * 1. the kernel has initiated active discovery 10157 * 2. if not, we have pend_le_reports > 0 in which case we are doing 10158 * passive scanning 10159 * 3. if none of the above is true, we have one or more active 10160 * Advertisement Monitor 10161 * 10162 * For case 1 and 2, report all advertisements via MGMT_EV_DEVICE_FOUND 10163 * and report ONLY one advertisement per device for the matched Monitor 10164 * via MGMT_EV_ADV_MONITOR_DEVICE_FOUND event. 10165 * 10166 * For case 3, since we are not active scanning and all advertisements 10167 * received are due to a matched Advertisement Monitor, report all 10168 * advertisements ONLY via MGMT_EV_ADV_MONITOR_DEVICE_FOUND event. 10169 */ 10170 if (report_device && !hdev->advmon_pend_notify) { 10171 mgmt_event_skb(skb, skip_sk); 10172 return; 10173 } 10174 10175 hdev->advmon_pend_notify = false; 10176 10177 list_for_each_entry_safe(dev, tmp, &hdev->monitored_devices, list) { 10178 if (!bacmp(&dev->bdaddr, bdaddr)) { 10179 matched = true; 10180 10181 if (!dev->notified) { 10182 mgmt_send_adv_monitor_device_found(hdev, skb, 10183 skip_sk, 10184 dev->handle); 10185 notified = true; 10186 dev->notified = true; 10187 } 10188 } 10189 10190 if (!dev->notified) 10191 hdev->advmon_pend_notify = true; 10192 } 10193 10194 if (!report_device && 10195 ((matched && !notified) || !msft_monitor_supported(hdev))) { 10196 /* Handle 0 indicates that we are not active scanning and this 10197 * is a subsequent advertisement report for an already matched 10198 * Advertisement Monitor or the controller offloading support 10199 * is not available. 10200 */ 10201 mgmt_send_adv_monitor_device_found(hdev, skb, skip_sk, 0); 10202 } 10203 10204 if (report_device) 10205 mgmt_event_skb(skb, skip_sk); 10206 else 10207 kfree_skb(skb); 10208 } 10209 10210 static void mesh_device_found(struct hci_dev *hdev, bdaddr_t *bdaddr, 10211 u8 addr_type, s8 rssi, u32 flags, u8 *eir, 10212 u16 eir_len, u8 *scan_rsp, u8 scan_rsp_len, 10213 u64 instant) 10214 { 10215 struct sk_buff *skb; 10216 struct mgmt_ev_mesh_device_found *ev; 10217 int i, j; 10218 10219 if (!hdev->mesh_ad_types[0]) 10220 goto accepted; 10221 10222 /* Scan for requested AD types */ 10223 if (eir_len > 0) { 10224 for (i = 0; i + 1 < eir_len; i += eir[i] + 1) { 10225 for (j = 0; j < sizeof(hdev->mesh_ad_types); j++) { 10226 if (!hdev->mesh_ad_types[j]) 10227 break; 10228 10229 if (hdev->mesh_ad_types[j] == eir[i + 1]) 10230 goto accepted; 10231 } 10232 } 10233 } 10234 10235 if (scan_rsp_len > 0) { 10236 for (i = 0; i + 1 < scan_rsp_len; i += scan_rsp[i] + 1) { 10237 for (j = 0; j < sizeof(hdev->mesh_ad_types); j++) { 10238 if (!hdev->mesh_ad_types[j]) 10239 break; 10240 10241 if (hdev->mesh_ad_types[j] == scan_rsp[i + 1]) 10242 goto accepted; 10243 } 10244 } 10245 } 10246 10247 return; 10248 10249 accepted: 10250 skb = mgmt_alloc_skb(hdev, MGMT_EV_MESH_DEVICE_FOUND, 10251 sizeof(*ev) + eir_len + scan_rsp_len); 10252 if (!skb) 10253 return; 10254 10255 ev = skb_put(skb, sizeof(*ev)); 10256 10257 bacpy(&ev->addr.bdaddr, bdaddr); 10258 ev->addr.type = link_to_bdaddr(LE_LINK, addr_type); 10259 ev->rssi = rssi; 10260 ev->flags = cpu_to_le32(flags); 10261 ev->instant = cpu_to_le64(instant); 10262 10263 if (eir_len > 0) 10264 /* Copy EIR or advertising data into event */ 10265 skb_put_data(skb, eir, eir_len); 10266 10267 if (scan_rsp_len > 0) 10268 /* Append scan response data to event */ 10269 skb_put_data(skb, scan_rsp, scan_rsp_len); 10270 10271 ev->eir_len = cpu_to_le16(eir_len + scan_rsp_len); 10272 10273 mgmt_event_skb(skb, NULL); 10274 } 10275 10276 void mgmt_device_found(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type, 10277 u8 addr_type, u8 *dev_class, s8 rssi, u32 flags, 10278 u8 *eir, u16 eir_len, u8 *scan_rsp, u8 scan_rsp_len, 10279 u64 instant) 10280 { 10281 struct sk_buff *skb; 10282 struct mgmt_ev_device_found *ev; 10283 bool report_device = hci_discovery_active(hdev); 10284 10285 if (hci_dev_test_flag(hdev, HCI_MESH) && link_type == LE_LINK) 10286 mesh_device_found(hdev, bdaddr, addr_type, rssi, flags, 10287 eir, eir_len, scan_rsp, scan_rsp_len, 10288 instant); 10289 10290 /* Don't send events for a non-kernel initiated discovery. With 10291 * LE one exception is if we have pend_le_reports > 0 in which 10292 * case we're doing passive scanning and want these events. 10293 */ 10294 if (!hci_discovery_active(hdev)) { 10295 if (link_type == ACL_LINK) 10296 return; 10297 if (link_type == LE_LINK && !list_empty(&hdev->pend_le_reports)) 10298 report_device = true; 10299 else if (!hci_is_adv_monitoring(hdev)) 10300 return; 10301 } 10302 10303 if (hdev->discovery.result_filtering) { 10304 /* We are using service discovery */ 10305 if (!is_filter_match(hdev, rssi, eir, eir_len, scan_rsp, 10306 scan_rsp_len)) 10307 return; 10308 } 10309 10310 if (hdev->discovery.limited) { 10311 /* Check for limited discoverable bit */ 10312 if (dev_class) { 10313 if (!(dev_class[1] & 0x20)) 10314 return; 10315 } else { 10316 u8 *flags = eir_get_data(eir, eir_len, EIR_FLAGS, NULL); 10317 if (!flags || !(flags[0] & LE_AD_LIMITED)) 10318 return; 10319 } 10320 } 10321 10322 /* Allocate skb. The 5 extra bytes are for the potential CoD field */ 10323 skb = mgmt_alloc_skb(hdev, MGMT_EV_DEVICE_FOUND, 10324 sizeof(*ev) + eir_len + scan_rsp_len + 5); 10325 if (!skb) 10326 return; 10327 10328 ev = skb_put(skb, sizeof(*ev)); 10329 10330 /* In case of device discovery with BR/EDR devices (pre 1.2), the 10331 * RSSI value was reported as 0 when not available. This behavior 10332 * is kept when using device discovery. This is required for full 10333 * backwards compatibility with the API. 10334 * 10335 * However when using service discovery, the value 127 will be 10336 * returned when the RSSI is not available. 10337 */ 10338 if (rssi == HCI_RSSI_INVALID && !hdev->discovery.report_invalid_rssi && 10339 link_type == ACL_LINK) 10340 rssi = 0; 10341 10342 bacpy(&ev->addr.bdaddr, bdaddr); 10343 ev->addr.type = link_to_bdaddr(link_type, addr_type); 10344 ev->rssi = rssi; 10345 ev->flags = cpu_to_le32(flags); 10346 10347 if (eir_len > 0) 10348 /* Copy EIR or advertising data into event */ 10349 skb_put_data(skb, eir, eir_len); 10350 10351 if (dev_class && !eir_get_data(eir, eir_len, EIR_CLASS_OF_DEV, NULL)) { 10352 u8 eir_cod[5]; 10353 10354 eir_len += eir_append_data(eir_cod, 0, EIR_CLASS_OF_DEV, 10355 dev_class, 3); 10356 skb_put_data(skb, eir_cod, sizeof(eir_cod)); 10357 } 10358 10359 if (scan_rsp_len > 0) 10360 /* Append scan response data to event */ 10361 skb_put_data(skb, scan_rsp, scan_rsp_len); 10362 10363 ev->eir_len = cpu_to_le16(eir_len + scan_rsp_len); 10364 10365 mgmt_adv_monitor_device_found(hdev, bdaddr, report_device, skb, NULL); 10366 } 10367 10368 void mgmt_remote_name(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type, 10369 u8 addr_type, s8 rssi, u8 *name, u8 name_len) 10370 { 10371 struct sk_buff *skb; 10372 struct mgmt_ev_device_found *ev; 10373 u16 eir_len = 0; 10374 u32 flags = 0; 10375 10376 skb = mgmt_alloc_skb(hdev, MGMT_EV_DEVICE_FOUND, 10377 sizeof(*ev) + (name ? eir_precalc_len(name_len) : 0)); 10378 10379 ev = skb_put(skb, sizeof(*ev)); 10380 bacpy(&ev->addr.bdaddr, bdaddr); 10381 ev->addr.type = link_to_bdaddr(link_type, addr_type); 10382 ev->rssi = rssi; 10383 10384 if (name) 10385 eir_len += eir_skb_put_data(skb, EIR_NAME_COMPLETE, name, name_len); 10386 else 10387 flags = MGMT_DEV_FOUND_NAME_REQUEST_FAILED; 10388 10389 ev->eir_len = cpu_to_le16(eir_len); 10390 ev->flags = cpu_to_le32(flags); 10391 10392 mgmt_event_skb(skb, NULL); 10393 } 10394 10395 void mgmt_discovering(struct hci_dev *hdev, u8 discovering) 10396 { 10397 struct mgmt_ev_discovering ev; 10398 10399 bt_dev_dbg(hdev, "discovering %u", discovering); 10400 10401 memset(&ev, 0, sizeof(ev)); 10402 ev.type = hdev->discovery.type; 10403 ev.discovering = discovering; 10404 10405 mgmt_event(MGMT_EV_DISCOVERING, hdev, &ev, sizeof(ev), NULL); 10406 } 10407 10408 void mgmt_suspending(struct hci_dev *hdev, u8 state) 10409 { 10410 struct mgmt_ev_controller_suspend ev; 10411 10412 ev.suspend_state = state; 10413 mgmt_event(MGMT_EV_CONTROLLER_SUSPEND, hdev, &ev, sizeof(ev), NULL); 10414 } 10415 10416 void mgmt_resuming(struct hci_dev *hdev, u8 reason, bdaddr_t *bdaddr, 10417 u8 addr_type) 10418 { 10419 struct mgmt_ev_controller_resume ev; 10420 10421 ev.wake_reason = reason; 10422 if (bdaddr) { 10423 bacpy(&ev.addr.bdaddr, bdaddr); 10424 ev.addr.type = addr_type; 10425 } else { 10426 memset(&ev.addr, 0, sizeof(ev.addr)); 10427 } 10428 10429 mgmt_event(MGMT_EV_CONTROLLER_RESUME, hdev, &ev, sizeof(ev), NULL); 10430 } 10431 10432 static struct hci_mgmt_chan chan = { 10433 .channel = HCI_CHANNEL_CONTROL, 10434 .handler_count = ARRAY_SIZE(mgmt_handlers), 10435 .handlers = mgmt_handlers, 10436 .hdev_init = mgmt_init_hdev, 10437 }; 10438 10439 int mgmt_init(void) 10440 { 10441 return hci_mgmt_chan_register(&chan); 10442 } 10443 10444 void mgmt_exit(void) 10445 { 10446 hci_mgmt_chan_unregister(&chan); 10447 } 10448 10449 void mgmt_cleanup(struct sock *sk) 10450 { 10451 struct mgmt_mesh_tx *mesh_tx; 10452 struct hci_dev *hdev; 10453 10454 read_lock(&hci_dev_list_lock); 10455 10456 list_for_each_entry(hdev, &hci_dev_list, list) { 10457 do { 10458 mesh_tx = mgmt_mesh_next(hdev, sk); 10459 10460 if (mesh_tx) 10461 mesh_send_complete(hdev, mesh_tx, true); 10462 } while (mesh_tx); 10463 } 10464 10465 read_unlock(&hci_dev_list_lock); 10466 } 10467