1 // SPDX-License-Identifier: GPL-2.0 2 /* 3 BlueZ - Bluetooth protocol stack for Linux 4 5 Copyright (C) 2010 Nokia Corporation 6 Copyright (C) 2011-2012 Intel Corporation 7 8 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS 9 OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 10 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS. 11 IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY 12 CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES 13 WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN 14 ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF 15 OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. 16 17 ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS, 18 COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS 19 SOFTWARE IS DISCLAIMED. 20 */ 21 22 /* Bluetooth HCI Management interface */ 23 24 #include <linux/module.h> 25 #include <linux/unaligned.h> 26 27 #include <net/bluetooth/bluetooth.h> 28 #include <net/bluetooth/hci_core.h> 29 #include <net/bluetooth/hci_sock.h> 30 #include <net/bluetooth/l2cap.h> 31 #include <net/bluetooth/mgmt.h> 32 33 #include "smp.h" 34 #include "mgmt_util.h" 35 #include "mgmt_config.h" 36 #include "msft.h" 37 #include "eir.h" 38 #include "aosp.h" 39 40 #define MGMT_VERSION 1 41 #define MGMT_REVISION 23 42 43 static const u16 mgmt_commands[] = { 44 MGMT_OP_READ_INDEX_LIST, 45 MGMT_OP_READ_INFO, 46 MGMT_OP_SET_POWERED, 47 MGMT_OP_SET_DISCOVERABLE, 48 MGMT_OP_SET_CONNECTABLE, 49 MGMT_OP_SET_FAST_CONNECTABLE, 50 MGMT_OP_SET_BONDABLE, 51 MGMT_OP_SET_LINK_SECURITY, 52 MGMT_OP_SET_SSP, 53 MGMT_OP_SET_HS, 54 MGMT_OP_SET_LE, 55 MGMT_OP_SET_DEV_CLASS, 56 MGMT_OP_SET_LOCAL_NAME, 57 MGMT_OP_ADD_UUID, 58 MGMT_OP_REMOVE_UUID, 59 MGMT_OP_LOAD_LINK_KEYS, 60 MGMT_OP_LOAD_LONG_TERM_KEYS, 61 MGMT_OP_DISCONNECT, 62 MGMT_OP_GET_CONNECTIONS, 63 MGMT_OP_PIN_CODE_REPLY, 64 MGMT_OP_PIN_CODE_NEG_REPLY, 65 MGMT_OP_SET_IO_CAPABILITY, 66 MGMT_OP_PAIR_DEVICE, 67 MGMT_OP_CANCEL_PAIR_DEVICE, 68 MGMT_OP_UNPAIR_DEVICE, 69 MGMT_OP_USER_CONFIRM_REPLY, 70 MGMT_OP_USER_CONFIRM_NEG_REPLY, 71 MGMT_OP_USER_PASSKEY_REPLY, 72 MGMT_OP_USER_PASSKEY_NEG_REPLY, 73 MGMT_OP_READ_LOCAL_OOB_DATA, 74 MGMT_OP_ADD_REMOTE_OOB_DATA, 75 MGMT_OP_REMOVE_REMOTE_OOB_DATA, 76 MGMT_OP_START_DISCOVERY, 77 MGMT_OP_STOP_DISCOVERY, 78 MGMT_OP_CONFIRM_NAME, 79 MGMT_OP_BLOCK_DEVICE, 80 MGMT_OP_UNBLOCK_DEVICE, 81 MGMT_OP_SET_DEVICE_ID, 82 MGMT_OP_SET_ADVERTISING, 83 MGMT_OP_SET_BREDR, 84 MGMT_OP_SET_STATIC_ADDRESS, 85 MGMT_OP_SET_SCAN_PARAMS, 86 MGMT_OP_SET_SECURE_CONN, 87 MGMT_OP_SET_DEBUG_KEYS, 88 MGMT_OP_SET_PRIVACY, 89 MGMT_OP_LOAD_IRKS, 90 MGMT_OP_GET_CONN_INFO, 91 MGMT_OP_GET_CLOCK_INFO, 92 MGMT_OP_ADD_DEVICE, 93 MGMT_OP_REMOVE_DEVICE, 94 MGMT_OP_LOAD_CONN_PARAM, 95 MGMT_OP_READ_UNCONF_INDEX_LIST, 96 MGMT_OP_READ_CONFIG_INFO, 97 MGMT_OP_SET_EXTERNAL_CONFIG, 98 MGMT_OP_SET_PUBLIC_ADDRESS, 99 MGMT_OP_START_SERVICE_DISCOVERY, 100 MGMT_OP_READ_LOCAL_OOB_EXT_DATA, 101 MGMT_OP_READ_EXT_INDEX_LIST, 102 MGMT_OP_READ_ADV_FEATURES, 103 MGMT_OP_ADD_ADVERTISING, 104 MGMT_OP_REMOVE_ADVERTISING, 105 MGMT_OP_GET_ADV_SIZE_INFO, 106 MGMT_OP_START_LIMITED_DISCOVERY, 107 MGMT_OP_READ_EXT_INFO, 108 MGMT_OP_SET_APPEARANCE, 109 MGMT_OP_GET_PHY_CONFIGURATION, 110 MGMT_OP_SET_PHY_CONFIGURATION, 111 MGMT_OP_SET_BLOCKED_KEYS, 112 MGMT_OP_SET_WIDEBAND_SPEECH, 113 MGMT_OP_READ_CONTROLLER_CAP, 114 MGMT_OP_READ_EXP_FEATURES_INFO, 115 MGMT_OP_SET_EXP_FEATURE, 116 MGMT_OP_READ_DEF_SYSTEM_CONFIG, 117 MGMT_OP_SET_DEF_SYSTEM_CONFIG, 118 MGMT_OP_READ_DEF_RUNTIME_CONFIG, 119 MGMT_OP_SET_DEF_RUNTIME_CONFIG, 120 MGMT_OP_GET_DEVICE_FLAGS, 121 MGMT_OP_SET_DEVICE_FLAGS, 122 MGMT_OP_READ_ADV_MONITOR_FEATURES, 123 MGMT_OP_ADD_ADV_PATTERNS_MONITOR, 124 MGMT_OP_REMOVE_ADV_MONITOR, 125 MGMT_OP_ADD_EXT_ADV_PARAMS, 126 MGMT_OP_ADD_EXT_ADV_DATA, 127 MGMT_OP_ADD_ADV_PATTERNS_MONITOR_RSSI, 128 MGMT_OP_SET_MESH_RECEIVER, 129 MGMT_OP_MESH_READ_FEATURES, 130 MGMT_OP_MESH_SEND, 131 MGMT_OP_MESH_SEND_CANCEL, 132 MGMT_OP_HCI_CMD_SYNC, 133 }; 134 135 static const u16 mgmt_events[] = { 136 MGMT_EV_CONTROLLER_ERROR, 137 MGMT_EV_INDEX_ADDED, 138 MGMT_EV_INDEX_REMOVED, 139 MGMT_EV_NEW_SETTINGS, 140 MGMT_EV_CLASS_OF_DEV_CHANGED, 141 MGMT_EV_LOCAL_NAME_CHANGED, 142 MGMT_EV_NEW_LINK_KEY, 143 MGMT_EV_NEW_LONG_TERM_KEY, 144 MGMT_EV_DEVICE_CONNECTED, 145 MGMT_EV_DEVICE_DISCONNECTED, 146 MGMT_EV_CONNECT_FAILED, 147 MGMT_EV_PIN_CODE_REQUEST, 148 MGMT_EV_USER_CONFIRM_REQUEST, 149 MGMT_EV_USER_PASSKEY_REQUEST, 150 MGMT_EV_AUTH_FAILED, 151 MGMT_EV_DEVICE_FOUND, 152 MGMT_EV_DISCOVERING, 153 MGMT_EV_DEVICE_BLOCKED, 154 MGMT_EV_DEVICE_UNBLOCKED, 155 MGMT_EV_DEVICE_UNPAIRED, 156 MGMT_EV_PASSKEY_NOTIFY, 157 MGMT_EV_NEW_IRK, 158 MGMT_EV_NEW_CSRK, 159 MGMT_EV_DEVICE_ADDED, 160 MGMT_EV_DEVICE_REMOVED, 161 MGMT_EV_NEW_CONN_PARAM, 162 MGMT_EV_UNCONF_INDEX_ADDED, 163 MGMT_EV_UNCONF_INDEX_REMOVED, 164 MGMT_EV_NEW_CONFIG_OPTIONS, 165 MGMT_EV_EXT_INDEX_ADDED, 166 MGMT_EV_EXT_INDEX_REMOVED, 167 MGMT_EV_LOCAL_OOB_DATA_UPDATED, 168 MGMT_EV_ADVERTISING_ADDED, 169 MGMT_EV_ADVERTISING_REMOVED, 170 MGMT_EV_EXT_INFO_CHANGED, 171 MGMT_EV_PHY_CONFIGURATION_CHANGED, 172 MGMT_EV_EXP_FEATURE_CHANGED, 173 MGMT_EV_DEVICE_FLAGS_CHANGED, 174 MGMT_EV_ADV_MONITOR_ADDED, 175 MGMT_EV_ADV_MONITOR_REMOVED, 176 MGMT_EV_CONTROLLER_SUSPEND, 177 MGMT_EV_CONTROLLER_RESUME, 178 MGMT_EV_ADV_MONITOR_DEVICE_FOUND, 179 MGMT_EV_ADV_MONITOR_DEVICE_LOST, 180 }; 181 182 static const u16 mgmt_untrusted_commands[] = { 183 MGMT_OP_READ_INDEX_LIST, 184 MGMT_OP_READ_INFO, 185 MGMT_OP_READ_UNCONF_INDEX_LIST, 186 MGMT_OP_READ_CONFIG_INFO, 187 MGMT_OP_READ_EXT_INDEX_LIST, 188 MGMT_OP_READ_EXT_INFO, 189 MGMT_OP_READ_CONTROLLER_CAP, 190 MGMT_OP_READ_EXP_FEATURES_INFO, 191 MGMT_OP_READ_DEF_SYSTEM_CONFIG, 192 MGMT_OP_READ_DEF_RUNTIME_CONFIG, 193 }; 194 195 static const u16 mgmt_untrusted_events[] = { 196 MGMT_EV_INDEX_ADDED, 197 MGMT_EV_INDEX_REMOVED, 198 MGMT_EV_NEW_SETTINGS, 199 MGMT_EV_CLASS_OF_DEV_CHANGED, 200 MGMT_EV_LOCAL_NAME_CHANGED, 201 MGMT_EV_UNCONF_INDEX_ADDED, 202 MGMT_EV_UNCONF_INDEX_REMOVED, 203 MGMT_EV_NEW_CONFIG_OPTIONS, 204 MGMT_EV_EXT_INDEX_ADDED, 205 MGMT_EV_EXT_INDEX_REMOVED, 206 MGMT_EV_EXT_INFO_CHANGED, 207 MGMT_EV_EXP_FEATURE_CHANGED, 208 }; 209 210 #define CACHE_TIMEOUT secs_to_jiffies(2) 211 212 #define ZERO_KEY "\x00\x00\x00\x00\x00\x00\x00\x00" \ 213 "\x00\x00\x00\x00\x00\x00\x00\x00" 214 215 /* HCI to MGMT error code conversion table */ 216 static const u8 mgmt_status_table[] = { 217 MGMT_STATUS_SUCCESS, 218 MGMT_STATUS_UNKNOWN_COMMAND, /* Unknown Command */ 219 MGMT_STATUS_NOT_CONNECTED, /* No Connection */ 220 MGMT_STATUS_FAILED, /* Hardware Failure */ 221 MGMT_STATUS_CONNECT_FAILED, /* Page Timeout */ 222 MGMT_STATUS_AUTH_FAILED, /* Authentication Failed */ 223 MGMT_STATUS_AUTH_FAILED, /* PIN or Key Missing */ 224 MGMT_STATUS_NO_RESOURCES, /* Memory Full */ 225 MGMT_STATUS_TIMEOUT, /* Connection Timeout */ 226 MGMT_STATUS_NO_RESOURCES, /* Max Number of Connections */ 227 MGMT_STATUS_NO_RESOURCES, /* Max Number of SCO Connections */ 228 MGMT_STATUS_ALREADY_CONNECTED, /* ACL Connection Exists */ 229 MGMT_STATUS_BUSY, /* Command Disallowed */ 230 MGMT_STATUS_NO_RESOURCES, /* Rejected Limited Resources */ 231 MGMT_STATUS_REJECTED, /* Rejected Security */ 232 MGMT_STATUS_REJECTED, /* Rejected Personal */ 233 MGMT_STATUS_TIMEOUT, /* Host Timeout */ 234 MGMT_STATUS_NOT_SUPPORTED, /* Unsupported Feature */ 235 MGMT_STATUS_INVALID_PARAMS, /* Invalid Parameters */ 236 MGMT_STATUS_DISCONNECTED, /* OE User Ended Connection */ 237 MGMT_STATUS_NO_RESOURCES, /* OE Low Resources */ 238 MGMT_STATUS_DISCONNECTED, /* OE Power Off */ 239 MGMT_STATUS_DISCONNECTED, /* Connection Terminated */ 240 MGMT_STATUS_BUSY, /* Repeated Attempts */ 241 MGMT_STATUS_REJECTED, /* Pairing Not Allowed */ 242 MGMT_STATUS_FAILED, /* Unknown LMP PDU */ 243 MGMT_STATUS_NOT_SUPPORTED, /* Unsupported Remote Feature */ 244 MGMT_STATUS_REJECTED, /* SCO Offset Rejected */ 245 MGMT_STATUS_REJECTED, /* SCO Interval Rejected */ 246 MGMT_STATUS_REJECTED, /* Air Mode Rejected */ 247 MGMT_STATUS_INVALID_PARAMS, /* Invalid LMP Parameters */ 248 MGMT_STATUS_FAILED, /* Unspecified Error */ 249 MGMT_STATUS_NOT_SUPPORTED, /* Unsupported LMP Parameter Value */ 250 MGMT_STATUS_FAILED, /* Role Change Not Allowed */ 251 MGMT_STATUS_TIMEOUT, /* LMP Response Timeout */ 252 MGMT_STATUS_FAILED, /* LMP Error Transaction Collision */ 253 MGMT_STATUS_FAILED, /* LMP PDU Not Allowed */ 254 MGMT_STATUS_REJECTED, /* Encryption Mode Not Accepted */ 255 MGMT_STATUS_FAILED, /* Unit Link Key Used */ 256 MGMT_STATUS_NOT_SUPPORTED, /* QoS Not Supported */ 257 MGMT_STATUS_TIMEOUT, /* Instant Passed */ 258 MGMT_STATUS_NOT_SUPPORTED, /* Pairing Not Supported */ 259 MGMT_STATUS_FAILED, /* Transaction Collision */ 260 MGMT_STATUS_FAILED, /* Reserved for future use */ 261 MGMT_STATUS_INVALID_PARAMS, /* Unacceptable Parameter */ 262 MGMT_STATUS_REJECTED, /* QoS Rejected */ 263 MGMT_STATUS_NOT_SUPPORTED, /* Classification Not Supported */ 264 MGMT_STATUS_REJECTED, /* Insufficient Security */ 265 MGMT_STATUS_INVALID_PARAMS, /* Parameter Out Of Range */ 266 MGMT_STATUS_FAILED, /* Reserved for future use */ 267 MGMT_STATUS_BUSY, /* Role Switch Pending */ 268 MGMT_STATUS_FAILED, /* Reserved for future use */ 269 MGMT_STATUS_FAILED, /* Slot Violation */ 270 MGMT_STATUS_FAILED, /* Role Switch Failed */ 271 MGMT_STATUS_INVALID_PARAMS, /* EIR Too Large */ 272 MGMT_STATUS_NOT_SUPPORTED, /* Simple Pairing Not Supported */ 273 MGMT_STATUS_BUSY, /* Host Busy Pairing */ 274 MGMT_STATUS_REJECTED, /* Rejected, No Suitable Channel */ 275 MGMT_STATUS_BUSY, /* Controller Busy */ 276 MGMT_STATUS_INVALID_PARAMS, /* Unsuitable Connection Interval */ 277 MGMT_STATUS_TIMEOUT, /* Directed Advertising Timeout */ 278 MGMT_STATUS_AUTH_FAILED, /* Terminated Due to MIC Failure */ 279 MGMT_STATUS_CONNECT_FAILED, /* Connection Establishment Failed */ 280 MGMT_STATUS_CONNECT_FAILED, /* MAC Connection Failed */ 281 }; 282 283 static u8 mgmt_errno_status(int err) 284 { 285 switch (err) { 286 case 0: 287 return MGMT_STATUS_SUCCESS; 288 case -EPERM: 289 return MGMT_STATUS_REJECTED; 290 case -EINVAL: 291 return MGMT_STATUS_INVALID_PARAMS; 292 case -EOPNOTSUPP: 293 return MGMT_STATUS_NOT_SUPPORTED; 294 case -EBUSY: 295 return MGMT_STATUS_BUSY; 296 case -ETIMEDOUT: 297 return MGMT_STATUS_AUTH_FAILED; 298 case -ENOMEM: 299 return MGMT_STATUS_NO_RESOURCES; 300 case -EISCONN: 301 return MGMT_STATUS_ALREADY_CONNECTED; 302 case -ENOTCONN: 303 return MGMT_STATUS_DISCONNECTED; 304 } 305 306 return MGMT_STATUS_FAILED; 307 } 308 309 static u8 mgmt_status(int err) 310 { 311 if (err < 0) 312 return mgmt_errno_status(err); 313 314 if (err < ARRAY_SIZE(mgmt_status_table)) 315 return mgmt_status_table[err]; 316 317 return MGMT_STATUS_FAILED; 318 } 319 320 static int mgmt_index_event(u16 event, struct hci_dev *hdev, void *data, 321 u16 len, int flag) 322 { 323 return mgmt_send_event(event, hdev, HCI_CHANNEL_CONTROL, data, len, 324 flag, NULL); 325 } 326 327 static int mgmt_limited_event(u16 event, struct hci_dev *hdev, void *data, 328 u16 len, int flag, struct sock *skip_sk) 329 { 330 return mgmt_send_event(event, hdev, HCI_CHANNEL_CONTROL, data, len, 331 flag, skip_sk); 332 } 333 334 static int mgmt_event(u16 event, struct hci_dev *hdev, void *data, u16 len, 335 struct sock *skip_sk) 336 { 337 return mgmt_send_event(event, hdev, HCI_CHANNEL_CONTROL, data, len, 338 HCI_SOCK_TRUSTED, skip_sk); 339 } 340 341 static int mgmt_event_skb(struct sk_buff *skb, struct sock *skip_sk) 342 { 343 return mgmt_send_event_skb(HCI_CHANNEL_CONTROL, skb, HCI_SOCK_TRUSTED, 344 skip_sk); 345 } 346 347 static u8 le_addr_type(u8 mgmt_addr_type) 348 { 349 if (mgmt_addr_type == BDADDR_LE_PUBLIC) 350 return ADDR_LE_DEV_PUBLIC; 351 else 352 return ADDR_LE_DEV_RANDOM; 353 } 354 355 void mgmt_fill_version_info(void *ver) 356 { 357 struct mgmt_rp_read_version *rp = ver; 358 359 rp->version = MGMT_VERSION; 360 rp->revision = cpu_to_le16(MGMT_REVISION); 361 } 362 363 static int read_version(struct sock *sk, struct hci_dev *hdev, void *data, 364 u16 data_len) 365 { 366 struct mgmt_rp_read_version rp; 367 368 bt_dev_dbg(hdev, "sock %p", sk); 369 370 mgmt_fill_version_info(&rp); 371 372 return mgmt_cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_VERSION, 0, 373 &rp, sizeof(rp)); 374 } 375 376 static int read_commands(struct sock *sk, struct hci_dev *hdev, void *data, 377 u16 data_len) 378 { 379 struct mgmt_rp_read_commands *rp; 380 u16 num_commands, num_events; 381 size_t rp_size; 382 int i, err; 383 384 bt_dev_dbg(hdev, "sock %p", sk); 385 386 if (hci_sock_test_flag(sk, HCI_SOCK_TRUSTED)) { 387 num_commands = ARRAY_SIZE(mgmt_commands); 388 num_events = ARRAY_SIZE(mgmt_events); 389 } else { 390 num_commands = ARRAY_SIZE(mgmt_untrusted_commands); 391 num_events = ARRAY_SIZE(mgmt_untrusted_events); 392 } 393 394 rp_size = sizeof(*rp) + ((num_commands + num_events) * sizeof(u16)); 395 396 rp = kmalloc(rp_size, GFP_KERNEL); 397 if (!rp) 398 return -ENOMEM; 399 400 rp->num_commands = cpu_to_le16(num_commands); 401 rp->num_events = cpu_to_le16(num_events); 402 403 if (hci_sock_test_flag(sk, HCI_SOCK_TRUSTED)) { 404 __le16 *opcode = rp->opcodes; 405 406 for (i = 0; i < num_commands; i++, opcode++) 407 put_unaligned_le16(mgmt_commands[i], opcode); 408 409 for (i = 0; i < num_events; i++, opcode++) 410 put_unaligned_le16(mgmt_events[i], opcode); 411 } else { 412 __le16 *opcode = rp->opcodes; 413 414 for (i = 0; i < num_commands; i++, opcode++) 415 put_unaligned_le16(mgmt_untrusted_commands[i], opcode); 416 417 for (i = 0; i < num_events; i++, opcode++) 418 put_unaligned_le16(mgmt_untrusted_events[i], opcode); 419 } 420 421 err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_COMMANDS, 0, 422 rp, rp_size); 423 kfree(rp); 424 425 return err; 426 } 427 428 static int read_index_list(struct sock *sk, struct hci_dev *hdev, void *data, 429 u16 data_len) 430 { 431 struct mgmt_rp_read_index_list *rp; 432 struct hci_dev *d; 433 size_t rp_len; 434 u16 count; 435 int err; 436 437 bt_dev_dbg(hdev, "sock %p", sk); 438 439 read_lock(&hci_dev_list_lock); 440 441 count = 0; 442 list_for_each_entry(d, &hci_dev_list, list) { 443 if (!hci_dev_test_flag(d, HCI_UNCONFIGURED)) 444 count++; 445 } 446 447 rp_len = sizeof(*rp) + (2 * count); 448 rp = kmalloc(rp_len, GFP_ATOMIC); 449 if (!rp) { 450 read_unlock(&hci_dev_list_lock); 451 return -ENOMEM; 452 } 453 454 count = 0; 455 list_for_each_entry(d, &hci_dev_list, list) { 456 if (hci_dev_test_flag(d, HCI_SETUP) || 457 hci_dev_test_flag(d, HCI_CONFIG) || 458 hci_dev_test_flag(d, HCI_USER_CHANNEL)) 459 continue; 460 461 /* Devices marked as raw-only are neither configured 462 * nor unconfigured controllers. 463 */ 464 if (hci_test_quirk(d, HCI_QUIRK_RAW_DEVICE)) 465 continue; 466 467 if (!hci_dev_test_flag(d, HCI_UNCONFIGURED)) { 468 rp->index[count++] = cpu_to_le16(d->id); 469 bt_dev_dbg(hdev, "Added hci%u", d->id); 470 } 471 } 472 473 rp->num_controllers = cpu_to_le16(count); 474 rp_len = sizeof(*rp) + (2 * count); 475 476 read_unlock(&hci_dev_list_lock); 477 478 err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE, MGMT_OP_READ_INDEX_LIST, 479 0, rp, rp_len); 480 481 kfree(rp); 482 483 return err; 484 } 485 486 static int read_unconf_index_list(struct sock *sk, struct hci_dev *hdev, 487 void *data, u16 data_len) 488 { 489 struct mgmt_rp_read_unconf_index_list *rp; 490 struct hci_dev *d; 491 size_t rp_len; 492 u16 count; 493 int err; 494 495 bt_dev_dbg(hdev, "sock %p", sk); 496 497 read_lock(&hci_dev_list_lock); 498 499 count = 0; 500 list_for_each_entry(d, &hci_dev_list, list) { 501 if (hci_dev_test_flag(d, HCI_UNCONFIGURED)) 502 count++; 503 } 504 505 rp_len = sizeof(*rp) + (2 * count); 506 rp = kmalloc(rp_len, GFP_ATOMIC); 507 if (!rp) { 508 read_unlock(&hci_dev_list_lock); 509 return -ENOMEM; 510 } 511 512 count = 0; 513 list_for_each_entry(d, &hci_dev_list, list) { 514 if (hci_dev_test_flag(d, HCI_SETUP) || 515 hci_dev_test_flag(d, HCI_CONFIG) || 516 hci_dev_test_flag(d, HCI_USER_CHANNEL)) 517 continue; 518 519 /* Devices marked as raw-only are neither configured 520 * nor unconfigured controllers. 521 */ 522 if (hci_test_quirk(d, HCI_QUIRK_RAW_DEVICE)) 523 continue; 524 525 if (hci_dev_test_flag(d, HCI_UNCONFIGURED)) { 526 rp->index[count++] = cpu_to_le16(d->id); 527 bt_dev_dbg(hdev, "Added hci%u", d->id); 528 } 529 } 530 531 rp->num_controllers = cpu_to_le16(count); 532 rp_len = sizeof(*rp) + (2 * count); 533 534 read_unlock(&hci_dev_list_lock); 535 536 err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE, 537 MGMT_OP_READ_UNCONF_INDEX_LIST, 0, rp, rp_len); 538 539 kfree(rp); 540 541 return err; 542 } 543 544 static int read_ext_index_list(struct sock *sk, struct hci_dev *hdev, 545 void *data, u16 data_len) 546 { 547 struct mgmt_rp_read_ext_index_list *rp; 548 struct hci_dev *d; 549 u16 count; 550 int err; 551 552 bt_dev_dbg(hdev, "sock %p", sk); 553 554 read_lock(&hci_dev_list_lock); 555 556 count = 0; 557 list_for_each_entry(d, &hci_dev_list, list) 558 count++; 559 560 rp = kmalloc_flex(*rp, entry, count, GFP_ATOMIC); 561 if (!rp) { 562 read_unlock(&hci_dev_list_lock); 563 return -ENOMEM; 564 } 565 566 count = 0; 567 list_for_each_entry(d, &hci_dev_list, list) { 568 if (hci_dev_test_flag(d, HCI_SETUP) || 569 hci_dev_test_flag(d, HCI_CONFIG) || 570 hci_dev_test_flag(d, HCI_USER_CHANNEL)) 571 continue; 572 573 /* Devices marked as raw-only are neither configured 574 * nor unconfigured controllers. 575 */ 576 if (hci_test_quirk(d, HCI_QUIRK_RAW_DEVICE)) 577 continue; 578 579 if (hci_dev_test_flag(d, HCI_UNCONFIGURED)) 580 rp->entry[count].type = 0x01; 581 else 582 rp->entry[count].type = 0x00; 583 584 rp->entry[count].bus = d->bus; 585 rp->entry[count++].index = cpu_to_le16(d->id); 586 bt_dev_dbg(hdev, "Added hci%u", d->id); 587 } 588 589 rp->num_controllers = cpu_to_le16(count); 590 591 read_unlock(&hci_dev_list_lock); 592 593 /* If this command is called at least once, then all the 594 * default index and unconfigured index events are disabled 595 * and from now on only extended index events are used. 596 */ 597 hci_sock_set_flag(sk, HCI_MGMT_EXT_INDEX_EVENTS); 598 hci_sock_clear_flag(sk, HCI_MGMT_INDEX_EVENTS); 599 hci_sock_clear_flag(sk, HCI_MGMT_UNCONF_INDEX_EVENTS); 600 601 err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE, 602 MGMT_OP_READ_EXT_INDEX_LIST, 0, rp, 603 struct_size(rp, entry, count)); 604 605 kfree(rp); 606 607 return err; 608 } 609 610 static bool is_configured(struct hci_dev *hdev) 611 { 612 if (hci_test_quirk(hdev, HCI_QUIRK_EXTERNAL_CONFIG) && 613 !hci_dev_test_flag(hdev, HCI_EXT_CONFIGURED)) 614 return false; 615 616 if ((hci_test_quirk(hdev, HCI_QUIRK_INVALID_BDADDR) || 617 hci_test_quirk(hdev, HCI_QUIRK_USE_BDADDR_PROPERTY)) && 618 !bacmp(&hdev->public_addr, BDADDR_ANY)) 619 return false; 620 621 return true; 622 } 623 624 static __le32 get_missing_options(struct hci_dev *hdev) 625 { 626 u32 options = 0; 627 628 if (hci_test_quirk(hdev, HCI_QUIRK_EXTERNAL_CONFIG) && 629 !hci_dev_test_flag(hdev, HCI_EXT_CONFIGURED)) 630 options |= MGMT_OPTION_EXTERNAL_CONFIG; 631 632 if ((hci_test_quirk(hdev, HCI_QUIRK_INVALID_BDADDR) || 633 hci_test_quirk(hdev, HCI_QUIRK_USE_BDADDR_PROPERTY)) && 634 !bacmp(&hdev->public_addr, BDADDR_ANY)) 635 options |= MGMT_OPTION_PUBLIC_ADDRESS; 636 637 return cpu_to_le32(options); 638 } 639 640 static int new_options(struct hci_dev *hdev, struct sock *skip) 641 { 642 __le32 options = get_missing_options(hdev); 643 644 return mgmt_limited_event(MGMT_EV_NEW_CONFIG_OPTIONS, hdev, &options, 645 sizeof(options), HCI_MGMT_OPTION_EVENTS, skip); 646 } 647 648 static int send_options_rsp(struct sock *sk, u16 opcode, struct hci_dev *hdev) 649 { 650 __le32 options = get_missing_options(hdev); 651 652 return mgmt_cmd_complete(sk, hdev->id, opcode, 0, &options, 653 sizeof(options)); 654 } 655 656 static int read_config_info(struct sock *sk, struct hci_dev *hdev, 657 void *data, u16 data_len) 658 { 659 struct mgmt_rp_read_config_info rp; 660 u32 options = 0; 661 662 bt_dev_dbg(hdev, "sock %p", sk); 663 664 hci_dev_lock(hdev); 665 666 memset(&rp, 0, sizeof(rp)); 667 rp.manufacturer = cpu_to_le16(hdev->manufacturer); 668 669 if (hci_test_quirk(hdev, HCI_QUIRK_EXTERNAL_CONFIG)) 670 options |= MGMT_OPTION_EXTERNAL_CONFIG; 671 672 if (hdev->set_bdaddr) 673 options |= MGMT_OPTION_PUBLIC_ADDRESS; 674 675 rp.supported_options = cpu_to_le32(options); 676 rp.missing_options = get_missing_options(hdev); 677 678 hci_dev_unlock(hdev); 679 680 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_CONFIG_INFO, 0, 681 &rp, sizeof(rp)); 682 } 683 684 static u32 get_supported_phys(struct hci_dev *hdev) 685 { 686 u32 supported_phys = 0; 687 688 if (lmp_bredr_capable(hdev)) { 689 supported_phys |= MGMT_PHY_BR_1M_1SLOT; 690 691 if (hdev->features[0][0] & LMP_3SLOT) 692 supported_phys |= MGMT_PHY_BR_1M_3SLOT; 693 694 if (hdev->features[0][0] & LMP_5SLOT) 695 supported_phys |= MGMT_PHY_BR_1M_5SLOT; 696 697 if (lmp_edr_2m_capable(hdev)) { 698 supported_phys |= MGMT_PHY_EDR_2M_1SLOT; 699 700 if (lmp_edr_3slot_capable(hdev)) 701 supported_phys |= MGMT_PHY_EDR_2M_3SLOT; 702 703 if (lmp_edr_5slot_capable(hdev)) 704 supported_phys |= MGMT_PHY_EDR_2M_5SLOT; 705 706 if (lmp_edr_3m_capable(hdev)) { 707 supported_phys |= MGMT_PHY_EDR_3M_1SLOT; 708 709 if (lmp_edr_3slot_capable(hdev)) 710 supported_phys |= MGMT_PHY_EDR_3M_3SLOT; 711 712 if (lmp_edr_5slot_capable(hdev)) 713 supported_phys |= MGMT_PHY_EDR_3M_5SLOT; 714 } 715 } 716 } 717 718 if (lmp_le_capable(hdev)) { 719 supported_phys |= MGMT_PHY_LE_1M_TX; 720 supported_phys |= MGMT_PHY_LE_1M_RX; 721 722 if (hdev->le_features[1] & HCI_LE_PHY_2M) { 723 supported_phys |= MGMT_PHY_LE_2M_TX; 724 supported_phys |= MGMT_PHY_LE_2M_RX; 725 } 726 727 if (hdev->le_features[1] & HCI_LE_PHY_CODED) { 728 supported_phys |= MGMT_PHY_LE_CODED_TX; 729 supported_phys |= MGMT_PHY_LE_CODED_RX; 730 } 731 } 732 733 return supported_phys; 734 } 735 736 static u32 get_selected_phys(struct hci_dev *hdev) 737 { 738 u32 selected_phys = 0; 739 740 if (lmp_bredr_capable(hdev)) { 741 selected_phys |= MGMT_PHY_BR_1M_1SLOT; 742 743 if (hdev->pkt_type & (HCI_DM3 | HCI_DH3)) 744 selected_phys |= MGMT_PHY_BR_1M_3SLOT; 745 746 if (hdev->pkt_type & (HCI_DM5 | HCI_DH5)) 747 selected_phys |= MGMT_PHY_BR_1M_5SLOT; 748 749 if (lmp_edr_2m_capable(hdev)) { 750 if (!(hdev->pkt_type & HCI_2DH1)) 751 selected_phys |= MGMT_PHY_EDR_2M_1SLOT; 752 753 if (lmp_edr_3slot_capable(hdev) && 754 !(hdev->pkt_type & HCI_2DH3)) 755 selected_phys |= MGMT_PHY_EDR_2M_3SLOT; 756 757 if (lmp_edr_5slot_capable(hdev) && 758 !(hdev->pkt_type & HCI_2DH5)) 759 selected_phys |= MGMT_PHY_EDR_2M_5SLOT; 760 761 if (lmp_edr_3m_capable(hdev)) { 762 if (!(hdev->pkt_type & HCI_3DH1)) 763 selected_phys |= MGMT_PHY_EDR_3M_1SLOT; 764 765 if (lmp_edr_3slot_capable(hdev) && 766 !(hdev->pkt_type & HCI_3DH3)) 767 selected_phys |= MGMT_PHY_EDR_3M_3SLOT; 768 769 if (lmp_edr_5slot_capable(hdev) && 770 !(hdev->pkt_type & HCI_3DH5)) 771 selected_phys |= MGMT_PHY_EDR_3M_5SLOT; 772 } 773 } 774 } 775 776 if (lmp_le_capable(hdev)) { 777 if (hdev->le_tx_def_phys & HCI_LE_SET_PHY_1M) 778 selected_phys |= MGMT_PHY_LE_1M_TX; 779 780 if (hdev->le_rx_def_phys & HCI_LE_SET_PHY_1M) 781 selected_phys |= MGMT_PHY_LE_1M_RX; 782 783 if (hdev->le_tx_def_phys & HCI_LE_SET_PHY_2M) 784 selected_phys |= MGMT_PHY_LE_2M_TX; 785 786 if (hdev->le_rx_def_phys & HCI_LE_SET_PHY_2M) 787 selected_phys |= MGMT_PHY_LE_2M_RX; 788 789 if (hdev->le_tx_def_phys & HCI_LE_SET_PHY_CODED) 790 selected_phys |= MGMT_PHY_LE_CODED_TX; 791 792 if (hdev->le_rx_def_phys & HCI_LE_SET_PHY_CODED) 793 selected_phys |= MGMT_PHY_LE_CODED_RX; 794 } 795 796 return selected_phys; 797 } 798 799 static u32 get_configurable_phys(struct hci_dev *hdev) 800 { 801 return (get_supported_phys(hdev) & ~MGMT_PHY_BR_1M_1SLOT & 802 ~MGMT_PHY_LE_1M_TX & ~MGMT_PHY_LE_1M_RX); 803 } 804 805 static u32 get_supported_settings(struct hci_dev *hdev) 806 { 807 u32 settings = 0; 808 809 settings |= MGMT_SETTING_POWERED; 810 settings |= MGMT_SETTING_BONDABLE; 811 settings |= MGMT_SETTING_DEBUG_KEYS; 812 settings |= MGMT_SETTING_CONNECTABLE; 813 settings |= MGMT_SETTING_DISCOVERABLE; 814 815 if (lmp_bredr_capable(hdev)) { 816 if (hdev->hci_ver >= BLUETOOTH_VER_1_2) 817 settings |= MGMT_SETTING_FAST_CONNECTABLE; 818 settings |= MGMT_SETTING_BREDR; 819 settings |= MGMT_SETTING_LINK_SECURITY; 820 821 if (lmp_ssp_capable(hdev)) { 822 settings |= MGMT_SETTING_SSP; 823 } 824 825 if (lmp_sc_capable(hdev)) 826 settings |= MGMT_SETTING_SECURE_CONN; 827 828 if (hci_test_quirk(hdev, HCI_QUIRK_WIDEBAND_SPEECH_SUPPORTED)) 829 settings |= MGMT_SETTING_WIDEBAND_SPEECH; 830 } 831 832 if (lmp_le_capable(hdev)) { 833 settings |= MGMT_SETTING_LE; 834 settings |= MGMT_SETTING_SECURE_CONN; 835 settings |= MGMT_SETTING_PRIVACY; 836 settings |= MGMT_SETTING_STATIC_ADDRESS; 837 settings |= MGMT_SETTING_ADVERTISING; 838 } 839 840 if (hci_test_quirk(hdev, HCI_QUIRK_EXTERNAL_CONFIG) || hdev->set_bdaddr) 841 settings |= MGMT_SETTING_CONFIGURATION; 842 843 if (cis_central_capable(hdev)) 844 settings |= MGMT_SETTING_CIS_CENTRAL; 845 846 if (cis_peripheral_capable(hdev)) 847 settings |= MGMT_SETTING_CIS_PERIPHERAL; 848 849 if (bis_capable(hdev)) 850 settings |= MGMT_SETTING_ISO_BROADCASTER; 851 852 if (sync_recv_capable(hdev)) 853 settings |= MGMT_SETTING_ISO_SYNC_RECEIVER; 854 855 if (ll_privacy_capable(hdev)) 856 settings |= MGMT_SETTING_LL_PRIVACY; 857 858 if (past_sender_capable(hdev)) 859 settings |= MGMT_SETTING_PAST_SENDER; 860 861 if (past_receiver_capable(hdev)) 862 settings |= MGMT_SETTING_PAST_RECEIVER; 863 864 if (le_sci_capable(hdev)) 865 settings |= MGMT_SETTING_SCI; 866 867 settings |= MGMT_SETTING_PHY_CONFIGURATION; 868 869 return settings; 870 } 871 872 static u32 get_current_settings(struct hci_dev *hdev) 873 { 874 u32 settings = 0; 875 876 if (hdev_is_powered(hdev)) 877 settings |= MGMT_SETTING_POWERED; 878 879 if (hci_dev_test_flag(hdev, HCI_CONNECTABLE)) 880 settings |= MGMT_SETTING_CONNECTABLE; 881 882 if (hci_dev_test_flag(hdev, HCI_FAST_CONNECTABLE)) 883 settings |= MGMT_SETTING_FAST_CONNECTABLE; 884 885 if (hci_dev_test_flag(hdev, HCI_DISCOVERABLE)) 886 settings |= MGMT_SETTING_DISCOVERABLE; 887 888 if (hci_dev_test_flag(hdev, HCI_BONDABLE)) 889 settings |= MGMT_SETTING_BONDABLE; 890 891 if (hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) 892 settings |= MGMT_SETTING_BREDR; 893 894 if (hci_dev_test_flag(hdev, HCI_LE_ENABLED)) 895 settings |= MGMT_SETTING_LE; 896 897 if (hci_dev_test_flag(hdev, HCI_LINK_SECURITY)) 898 settings |= MGMT_SETTING_LINK_SECURITY; 899 900 if (hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) 901 settings |= MGMT_SETTING_SSP; 902 903 if (hci_dev_test_flag(hdev, HCI_ADVERTISING)) 904 settings |= MGMT_SETTING_ADVERTISING; 905 906 if (hci_dev_test_flag(hdev, HCI_SC_ENABLED)) 907 settings |= MGMT_SETTING_SECURE_CONN; 908 909 if (hci_dev_test_flag(hdev, HCI_KEEP_DEBUG_KEYS)) 910 settings |= MGMT_SETTING_DEBUG_KEYS; 911 912 if (hci_dev_test_flag(hdev, HCI_PRIVACY)) 913 settings |= MGMT_SETTING_PRIVACY; 914 915 /* The current setting for static address has two purposes. The 916 * first is to indicate if the static address will be used and 917 * the second is to indicate if it is actually set. 918 * 919 * This means if the static address is not configured, this flag 920 * will never be set. If the address is configured, then if the 921 * address is actually used decides if the flag is set or not. 922 * 923 * For single mode LE only controllers and dual-mode controllers 924 * with BR/EDR disabled, the existence of the static address will 925 * be evaluated. 926 */ 927 if (hci_dev_test_flag(hdev, HCI_FORCE_STATIC_ADDR) || 928 !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) || 929 !bacmp(&hdev->bdaddr, BDADDR_ANY)) { 930 if (bacmp(&hdev->static_addr, BDADDR_ANY)) 931 settings |= MGMT_SETTING_STATIC_ADDRESS; 932 } 933 934 if (hci_dev_test_flag(hdev, HCI_WIDEBAND_SPEECH_ENABLED)) 935 settings |= MGMT_SETTING_WIDEBAND_SPEECH; 936 937 if (cis_central_enabled(hdev)) 938 settings |= MGMT_SETTING_CIS_CENTRAL; 939 940 if (cis_peripheral_enabled(hdev)) 941 settings |= MGMT_SETTING_CIS_PERIPHERAL; 942 943 if (bis_enabled(hdev)) 944 settings |= MGMT_SETTING_ISO_BROADCASTER; 945 946 if (sync_recv_enabled(hdev)) 947 settings |= MGMT_SETTING_ISO_SYNC_RECEIVER; 948 949 if (ll_privacy_enabled(hdev)) 950 settings |= MGMT_SETTING_LL_PRIVACY; 951 952 if (past_sender_enabled(hdev)) 953 settings |= MGMT_SETTING_PAST_SENDER; 954 955 if (past_receiver_enabled(hdev)) 956 settings |= MGMT_SETTING_PAST_RECEIVER; 957 958 if (le_sci_enabled(hdev)) 959 settings |= MGMT_SETTING_SCI; 960 961 return settings; 962 } 963 964 static struct mgmt_pending_cmd *pending_find(u16 opcode, struct hci_dev *hdev) 965 { 966 return mgmt_pending_find(HCI_CHANNEL_CONTROL, opcode, hdev); 967 } 968 969 u8 mgmt_get_adv_discov_flags(struct hci_dev *hdev) 970 { 971 struct mgmt_pending_cmd *cmd; 972 973 /* If there's a pending mgmt command the flags will not yet have 974 * their final values, so check for this first. 975 */ 976 cmd = pending_find(MGMT_OP_SET_DISCOVERABLE, hdev); 977 if (cmd) { 978 struct mgmt_mode *cp = cmd->param; 979 if (cp->val == 0x01) 980 return LE_AD_GENERAL; 981 else if (cp->val == 0x02) 982 return LE_AD_LIMITED; 983 } else { 984 if (hci_dev_test_flag(hdev, HCI_LIMITED_DISCOVERABLE)) 985 return LE_AD_LIMITED; 986 else if (hci_dev_test_flag(hdev, HCI_DISCOVERABLE)) 987 return LE_AD_GENERAL; 988 } 989 990 return 0; 991 } 992 993 bool mgmt_get_connectable(struct hci_dev *hdev) 994 { 995 struct mgmt_pending_cmd *cmd; 996 997 /* If there's a pending mgmt command the flag will not yet have 998 * it's final value, so check for this first. 999 */ 1000 cmd = pending_find(MGMT_OP_SET_CONNECTABLE, hdev); 1001 if (cmd) { 1002 struct mgmt_mode *cp = cmd->param; 1003 1004 return cp->val; 1005 } 1006 1007 return hci_dev_test_flag(hdev, HCI_CONNECTABLE); 1008 } 1009 1010 static int service_cache_sync(struct hci_dev *hdev, void *data) 1011 { 1012 hci_update_eir_sync(hdev); 1013 hci_update_class_sync(hdev); 1014 1015 return 0; 1016 } 1017 1018 static void service_cache_off(struct work_struct *work) 1019 { 1020 struct hci_dev *hdev = container_of(work, struct hci_dev, 1021 service_cache.work); 1022 1023 if (!hci_dev_test_and_clear_flag(hdev, HCI_SERVICE_CACHE)) 1024 return; 1025 1026 hci_cmd_sync_queue(hdev, service_cache_sync, NULL, NULL); 1027 } 1028 1029 static int rpa_expired_sync(struct hci_dev *hdev, void *data) 1030 { 1031 /* The generation of a new RPA and programming it into the 1032 * controller happens in the hci_req_enable_advertising() 1033 * function. 1034 */ 1035 if (ext_adv_capable(hdev)) 1036 return hci_start_ext_adv_sync(hdev, hdev->cur_adv_instance); 1037 else 1038 return hci_enable_advertising_sync(hdev); 1039 } 1040 1041 static void rpa_expired(struct work_struct *work) 1042 { 1043 struct hci_dev *hdev = container_of(work, struct hci_dev, 1044 rpa_expired.work); 1045 1046 bt_dev_dbg(hdev, ""); 1047 1048 hci_dev_set_flag(hdev, HCI_RPA_EXPIRED); 1049 1050 if (!hci_dev_test_flag(hdev, HCI_ADVERTISING)) 1051 return; 1052 1053 hci_cmd_sync_queue(hdev, rpa_expired_sync, NULL, NULL); 1054 } 1055 1056 static int set_discoverable_sync(struct hci_dev *hdev, void *data); 1057 1058 static void discov_off(struct work_struct *work) 1059 { 1060 struct hci_dev *hdev = container_of(work, struct hci_dev, 1061 discov_off.work); 1062 1063 bt_dev_dbg(hdev, ""); 1064 1065 hci_dev_lock(hdev); 1066 1067 /* When discoverable timeout triggers, then just make sure 1068 * the limited discoverable flag is cleared. Even in the case 1069 * of a timeout triggered from general discoverable, it is 1070 * safe to unconditionally clear the flag. 1071 */ 1072 hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE); 1073 hci_dev_clear_flag(hdev, HCI_DISCOVERABLE); 1074 hdev->discov_timeout = 0; 1075 1076 hci_cmd_sync_queue(hdev, set_discoverable_sync, NULL, NULL); 1077 1078 mgmt_new_settings(hdev); 1079 1080 hci_dev_unlock(hdev); 1081 } 1082 1083 static int send_settings_rsp(struct sock *sk, u16 opcode, struct hci_dev *hdev); 1084 1085 static void mesh_send_complete(struct hci_dev *hdev, 1086 struct mgmt_mesh_tx *mesh_tx, bool silent) 1087 { 1088 u8 handle = mesh_tx->handle; 1089 1090 if (!silent) 1091 mgmt_event(MGMT_EV_MESH_PACKET_CMPLT, hdev, &handle, 1092 sizeof(handle), NULL); 1093 1094 mgmt_mesh_remove(mesh_tx); 1095 } 1096 1097 static int mesh_send_done_sync(struct hci_dev *hdev, void *data) 1098 { 1099 struct mgmt_mesh_tx *mesh_tx; 1100 1101 hci_dev_clear_flag(hdev, HCI_MESH_SENDING); 1102 if (list_empty(&hdev->adv_instances)) 1103 hci_disable_advertising_sync(hdev); 1104 mesh_tx = mgmt_mesh_next(hdev, NULL); 1105 1106 if (mesh_tx) 1107 mesh_send_complete(hdev, mesh_tx, false); 1108 1109 return 0; 1110 } 1111 1112 static int mesh_send_sync(struct hci_dev *hdev, void *data); 1113 static void mesh_send_start_complete(struct hci_dev *hdev, void *data, int err); 1114 static void mesh_next(struct hci_dev *hdev, void *data, int err) 1115 { 1116 struct mgmt_mesh_tx *mesh_tx = mgmt_mesh_next(hdev, NULL); 1117 1118 if (!mesh_tx) 1119 return; 1120 1121 err = hci_cmd_sync_queue(hdev, mesh_send_sync, mesh_tx, 1122 mesh_send_start_complete); 1123 1124 if (err < 0) 1125 mesh_send_complete(hdev, mesh_tx, false); 1126 else 1127 hci_dev_set_flag(hdev, HCI_MESH_SENDING); 1128 } 1129 1130 static void mesh_send_done(struct work_struct *work) 1131 { 1132 struct hci_dev *hdev = container_of(work, struct hci_dev, 1133 mesh_send_done.work); 1134 1135 if (!hci_dev_test_flag(hdev, HCI_MESH_SENDING)) 1136 return; 1137 1138 hci_cmd_sync_queue(hdev, mesh_send_done_sync, NULL, mesh_next); 1139 } 1140 1141 static void mgmt_init_hdev(struct sock *sk, struct hci_dev *hdev) 1142 { 1143 if (hci_dev_test_flag(hdev, HCI_MGMT)) 1144 return; 1145 1146 BT_INFO("MGMT ver %d.%d", MGMT_VERSION, MGMT_REVISION); 1147 1148 INIT_DELAYED_WORK(&hdev->discov_off, discov_off); 1149 INIT_DELAYED_WORK(&hdev->service_cache, service_cache_off); 1150 INIT_DELAYED_WORK(&hdev->rpa_expired, rpa_expired); 1151 INIT_DELAYED_WORK(&hdev->mesh_send_done, mesh_send_done); 1152 1153 /* Non-mgmt controlled devices get this bit set 1154 * implicitly so that pairing works for them, however 1155 * for mgmt we require user-space to explicitly enable 1156 * it 1157 */ 1158 hci_dev_clear_flag(hdev, HCI_BONDABLE); 1159 1160 hci_dev_set_flag(hdev, HCI_MGMT); 1161 } 1162 1163 static int read_controller_info(struct sock *sk, struct hci_dev *hdev, 1164 void *data, u16 data_len) 1165 { 1166 struct mgmt_rp_read_info rp; 1167 1168 bt_dev_dbg(hdev, "sock %p", sk); 1169 1170 hci_dev_lock(hdev); 1171 1172 memset(&rp, 0, sizeof(rp)); 1173 1174 bacpy(&rp.bdaddr, &hdev->bdaddr); 1175 1176 rp.version = hdev->hci_ver; 1177 rp.manufacturer = cpu_to_le16(hdev->manufacturer); 1178 1179 rp.supported_settings = cpu_to_le32(get_supported_settings(hdev)); 1180 rp.current_settings = cpu_to_le32(get_current_settings(hdev)); 1181 1182 memcpy(rp.dev_class, hdev->dev_class, 3); 1183 1184 memcpy(rp.name, hdev->dev_name, sizeof(hdev->dev_name)); 1185 memcpy(rp.short_name, hdev->short_name, sizeof(hdev->short_name)); 1186 1187 hci_dev_unlock(hdev); 1188 1189 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_INFO, 0, &rp, 1190 sizeof(rp)); 1191 } 1192 1193 static u16 append_eir_data_to_buf(struct hci_dev *hdev, u8 *eir) 1194 { 1195 u16 eir_len = 0; 1196 size_t name_len; 1197 1198 if (hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) 1199 eir_len = eir_append_data(eir, eir_len, EIR_CLASS_OF_DEV, 1200 hdev->dev_class, 3); 1201 1202 if (hci_dev_test_flag(hdev, HCI_LE_ENABLED)) 1203 eir_len = eir_append_le16(eir, eir_len, EIR_APPEARANCE, 1204 hdev->appearance); 1205 1206 name_len = strnlen(hdev->dev_name, sizeof(hdev->dev_name)); 1207 eir_len = eir_append_data(eir, eir_len, EIR_NAME_COMPLETE, 1208 hdev->dev_name, name_len); 1209 1210 name_len = strnlen(hdev->short_name, sizeof(hdev->short_name)); 1211 eir_len = eir_append_data(eir, eir_len, EIR_NAME_SHORT, 1212 hdev->short_name, name_len); 1213 1214 return eir_len; 1215 } 1216 1217 static int read_ext_controller_info(struct sock *sk, struct hci_dev *hdev, 1218 void *data, u16 data_len) 1219 { 1220 char buf[512]; 1221 struct mgmt_rp_read_ext_info *rp = (void *)buf; 1222 u16 eir_len; 1223 1224 bt_dev_dbg(hdev, "sock %p", sk); 1225 1226 memset(&buf, 0, sizeof(buf)); 1227 1228 hci_dev_lock(hdev); 1229 1230 bacpy(&rp->bdaddr, &hdev->bdaddr); 1231 1232 rp->version = hdev->hci_ver; 1233 rp->manufacturer = cpu_to_le16(hdev->manufacturer); 1234 1235 rp->supported_settings = cpu_to_le32(get_supported_settings(hdev)); 1236 rp->current_settings = cpu_to_le32(get_current_settings(hdev)); 1237 1238 1239 eir_len = append_eir_data_to_buf(hdev, rp->eir); 1240 rp->eir_len = cpu_to_le16(eir_len); 1241 1242 hci_dev_unlock(hdev); 1243 1244 /* If this command is called at least once, then the events 1245 * for class of device and local name changes are disabled 1246 * and only the new extended controller information event 1247 * is used. 1248 */ 1249 hci_sock_set_flag(sk, HCI_MGMT_EXT_INFO_EVENTS); 1250 hci_sock_clear_flag(sk, HCI_MGMT_DEV_CLASS_EVENTS); 1251 hci_sock_clear_flag(sk, HCI_MGMT_LOCAL_NAME_EVENTS); 1252 1253 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_EXT_INFO, 0, rp, 1254 sizeof(*rp) + eir_len); 1255 } 1256 1257 static int ext_info_changed(struct hci_dev *hdev, struct sock *skip) 1258 { 1259 char buf[512]; 1260 struct mgmt_ev_ext_info_changed *ev = (void *)buf; 1261 u16 eir_len; 1262 1263 memset(buf, 0, sizeof(buf)); 1264 1265 eir_len = append_eir_data_to_buf(hdev, ev->eir); 1266 ev->eir_len = cpu_to_le16(eir_len); 1267 1268 return mgmt_limited_event(MGMT_EV_EXT_INFO_CHANGED, hdev, ev, 1269 sizeof(*ev) + eir_len, 1270 HCI_MGMT_EXT_INFO_EVENTS, skip); 1271 } 1272 1273 static int send_settings_rsp(struct sock *sk, u16 opcode, struct hci_dev *hdev) 1274 { 1275 __le32 settings = cpu_to_le32(get_current_settings(hdev)); 1276 1277 return mgmt_cmd_complete(sk, hdev->id, opcode, 0, &settings, 1278 sizeof(settings)); 1279 } 1280 1281 void mgmt_advertising_added(struct sock *sk, struct hci_dev *hdev, u8 instance) 1282 { 1283 struct mgmt_ev_advertising_added ev; 1284 1285 ev.instance = instance; 1286 1287 mgmt_event(MGMT_EV_ADVERTISING_ADDED, hdev, &ev, sizeof(ev), sk); 1288 } 1289 1290 void mgmt_advertising_removed(struct sock *sk, struct hci_dev *hdev, 1291 u8 instance) 1292 { 1293 struct mgmt_ev_advertising_removed ev; 1294 1295 ev.instance = instance; 1296 1297 mgmt_event(MGMT_EV_ADVERTISING_REMOVED, hdev, &ev, sizeof(ev), sk); 1298 } 1299 1300 static void cancel_adv_timeout(struct hci_dev *hdev) 1301 { 1302 if (hdev->adv_instance_timeout) { 1303 hdev->adv_instance_timeout = 0; 1304 cancel_delayed_work(&hdev->adv_instance_expire); 1305 } 1306 } 1307 1308 /* This function requires the caller holds hdev->lock */ 1309 static void restart_le_actions(struct hci_dev *hdev) 1310 { 1311 struct hci_conn_params *p; 1312 1313 list_for_each_entry(p, &hdev->le_conn_params, list) { 1314 /* Needed for AUTO_OFF case where might not "really" 1315 * have been powered off. 1316 */ 1317 hci_pend_le_list_del_init(p); 1318 1319 switch (p->auto_connect) { 1320 case HCI_AUTO_CONN_DIRECT: 1321 case HCI_AUTO_CONN_ALWAYS: 1322 hci_pend_le_list_add(p, &hdev->pend_le_conns); 1323 break; 1324 case HCI_AUTO_CONN_REPORT: 1325 hci_pend_le_list_add(p, &hdev->pend_le_reports); 1326 break; 1327 default: 1328 break; 1329 } 1330 } 1331 } 1332 1333 static int new_settings(struct hci_dev *hdev, struct sock *skip) 1334 { 1335 __le32 ev = cpu_to_le32(get_current_settings(hdev)); 1336 1337 return mgmt_limited_event(MGMT_EV_NEW_SETTINGS, hdev, &ev, 1338 sizeof(ev), HCI_MGMT_SETTING_EVENTS, skip); 1339 } 1340 1341 static void mgmt_set_powered_complete(struct hci_dev *hdev, void *data, int err) 1342 { 1343 struct mgmt_pending_cmd *cmd = data; 1344 struct mgmt_mode *cp; 1345 1346 /* Make sure cmd still outstanding. */ 1347 if (err == -ECANCELED || !mgmt_pending_valid(hdev, cmd)) 1348 return; 1349 1350 cp = cmd->param; 1351 1352 bt_dev_dbg(hdev, "err %d", err); 1353 1354 if (!err) { 1355 if (cp->val) { 1356 hci_dev_lock(hdev); 1357 restart_le_actions(hdev); 1358 hci_update_passive_scan(hdev); 1359 hci_dev_unlock(hdev); 1360 } 1361 1362 send_settings_rsp(cmd->sk, cmd->opcode, hdev); 1363 1364 /* Only call new_setting for power on as power off is deferred 1365 * to hdev->power_off work which does call hci_dev_do_close. 1366 */ 1367 if (cp->val) 1368 new_settings(hdev, cmd->sk); 1369 } else { 1370 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_POWERED, 1371 mgmt_status(err)); 1372 } 1373 1374 mgmt_pending_free(cmd); 1375 } 1376 1377 static int set_powered_sync(struct hci_dev *hdev, void *data) 1378 { 1379 struct mgmt_pending_cmd *cmd = data; 1380 struct mgmt_mode cp; 1381 1382 mutex_lock(&hdev->mgmt_pending_lock); 1383 1384 /* Make sure cmd still outstanding. */ 1385 if (!__mgmt_pending_listed(hdev, cmd)) { 1386 mutex_unlock(&hdev->mgmt_pending_lock); 1387 return -ECANCELED; 1388 } 1389 1390 memcpy(&cp, cmd->param, sizeof(cp)); 1391 1392 mutex_unlock(&hdev->mgmt_pending_lock); 1393 1394 BT_DBG("%s", hdev->name); 1395 1396 return hci_set_powered_sync(hdev, cp.val); 1397 } 1398 1399 static int set_powered(struct sock *sk, struct hci_dev *hdev, void *data, 1400 u16 len) 1401 { 1402 struct mgmt_mode *cp = data; 1403 struct mgmt_pending_cmd *cmd; 1404 int err; 1405 1406 bt_dev_dbg(hdev, "sock %p", sk); 1407 1408 if (cp->val != 0x00 && cp->val != 0x01) 1409 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED, 1410 MGMT_STATUS_INVALID_PARAMS); 1411 1412 hci_dev_lock(hdev); 1413 1414 if (!cp->val) { 1415 if (hci_dev_test_flag(hdev, HCI_POWERING_DOWN)) { 1416 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED, 1417 MGMT_STATUS_BUSY); 1418 goto failed; 1419 } 1420 } 1421 1422 if (pending_find(MGMT_OP_SET_POWERED, hdev)) { 1423 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_POWERED, 1424 MGMT_STATUS_BUSY); 1425 goto failed; 1426 } 1427 1428 if (!!cp->val == hdev_is_powered(hdev)) { 1429 err = send_settings_rsp(sk, MGMT_OP_SET_POWERED, hdev); 1430 goto failed; 1431 } 1432 1433 cmd = mgmt_pending_add(sk, MGMT_OP_SET_POWERED, hdev, data, len); 1434 if (!cmd) { 1435 err = -ENOMEM; 1436 goto failed; 1437 } 1438 1439 /* Cancel potentially blocking sync operation before power off */ 1440 if (cp->val == 0x00) { 1441 hci_cmd_sync_cancel_sync(hdev, -EHOSTDOWN); 1442 err = hci_cmd_sync_queue(hdev, set_powered_sync, cmd, 1443 mgmt_set_powered_complete); 1444 } else { 1445 /* Use hci_cmd_sync_submit since hdev might not be running */ 1446 err = hci_cmd_sync_submit(hdev, set_powered_sync, cmd, 1447 mgmt_set_powered_complete); 1448 } 1449 1450 if (err < 0) 1451 mgmt_pending_remove(cmd); 1452 1453 failed: 1454 hci_dev_unlock(hdev); 1455 return err; 1456 } 1457 1458 int mgmt_new_settings(struct hci_dev *hdev) 1459 { 1460 return new_settings(hdev, NULL); 1461 } 1462 1463 struct cmd_lookup { 1464 struct sock *sk; 1465 struct hci_dev *hdev; 1466 u8 mgmt_status; 1467 }; 1468 1469 static void settings_rsp(struct mgmt_pending_cmd *cmd, void *data) 1470 { 1471 struct cmd_lookup *match = data; 1472 1473 send_settings_rsp(cmd->sk, cmd->opcode, match->hdev); 1474 1475 if (match->sk == NULL) { 1476 match->sk = cmd->sk; 1477 sock_hold(match->sk); 1478 } 1479 } 1480 1481 static void cmd_status_rsp(struct mgmt_pending_cmd *cmd, void *data) 1482 { 1483 u8 *status = data; 1484 1485 mgmt_cmd_status(cmd->sk, cmd->hdev->id, cmd->opcode, *status); 1486 } 1487 1488 static void cmd_complete_rsp(struct mgmt_pending_cmd *cmd, void *data) 1489 { 1490 struct cmd_lookup *match = data; 1491 1492 /* dequeue cmd_sync entries using cmd as data as that is about to be 1493 * removed/freed. 1494 */ 1495 hci_cmd_sync_dequeue(match->hdev, NULL, cmd, NULL); 1496 1497 if (cmd->cmd_complete) { 1498 cmd->cmd_complete(cmd, match->mgmt_status); 1499 return; 1500 } 1501 1502 cmd_status_rsp(cmd, data); 1503 } 1504 1505 static int generic_cmd_complete(struct mgmt_pending_cmd *cmd, u8 status) 1506 { 1507 return mgmt_cmd_complete(cmd->sk, cmd->hdev->id, cmd->opcode, status, 1508 cmd->param, cmd->param_len); 1509 } 1510 1511 static int addr_cmd_complete(struct mgmt_pending_cmd *cmd, u8 status) 1512 { 1513 return mgmt_cmd_complete(cmd->sk, cmd->hdev->id, cmd->opcode, status, 1514 cmd->param, sizeof(struct mgmt_addr_info)); 1515 } 1516 1517 static u8 mgmt_bredr_support(struct hci_dev *hdev) 1518 { 1519 if (!lmp_bredr_capable(hdev)) 1520 return MGMT_STATUS_NOT_SUPPORTED; 1521 else if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) 1522 return MGMT_STATUS_REJECTED; 1523 else 1524 return MGMT_STATUS_SUCCESS; 1525 } 1526 1527 static u8 mgmt_le_support(struct hci_dev *hdev) 1528 { 1529 if (!lmp_le_capable(hdev)) 1530 return MGMT_STATUS_NOT_SUPPORTED; 1531 else if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED)) 1532 return MGMT_STATUS_REJECTED; 1533 else 1534 return MGMT_STATUS_SUCCESS; 1535 } 1536 1537 static void mgmt_set_discoverable_complete(struct hci_dev *hdev, void *data, 1538 int err) 1539 { 1540 struct mgmt_pending_cmd *cmd = data; 1541 1542 bt_dev_dbg(hdev, "err %d", err); 1543 1544 /* Make sure cmd still outstanding. */ 1545 if (err == -ECANCELED || !mgmt_pending_valid(hdev, cmd)) 1546 return; 1547 1548 hci_dev_lock(hdev); 1549 1550 if (err) { 1551 u8 mgmt_err = mgmt_status(err); 1552 mgmt_cmd_status(cmd->sk, cmd->hdev->id, cmd->opcode, mgmt_err); 1553 hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE); 1554 goto done; 1555 } 1556 1557 if (hci_dev_test_flag(hdev, HCI_DISCOVERABLE) && 1558 hdev->discov_timeout > 0) { 1559 int to = secs_to_jiffies(hdev->discov_timeout); 1560 queue_delayed_work(hdev->req_workqueue, &hdev->discov_off, to); 1561 } 1562 1563 send_settings_rsp(cmd->sk, MGMT_OP_SET_DISCOVERABLE, hdev); 1564 new_settings(hdev, cmd->sk); 1565 1566 done: 1567 mgmt_pending_free(cmd); 1568 hci_dev_unlock(hdev); 1569 } 1570 1571 static int set_discoverable_sync(struct hci_dev *hdev, void *data) 1572 { 1573 if (!mgmt_pending_listed(hdev, data)) 1574 return -ECANCELED; 1575 1576 BT_DBG("%s", hdev->name); 1577 1578 return hci_update_discoverable_sync(hdev); 1579 } 1580 1581 static int set_discoverable(struct sock *sk, struct hci_dev *hdev, void *data, 1582 u16 len) 1583 { 1584 struct mgmt_cp_set_discoverable *cp = data; 1585 struct mgmt_pending_cmd *cmd; 1586 u16 timeout; 1587 int err; 1588 1589 bt_dev_dbg(hdev, "sock %p", sk); 1590 1591 if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED) && 1592 !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) 1593 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE, 1594 MGMT_STATUS_REJECTED); 1595 1596 if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02) 1597 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE, 1598 MGMT_STATUS_INVALID_PARAMS); 1599 1600 timeout = __le16_to_cpu(cp->timeout); 1601 1602 /* Disabling discoverable requires that no timeout is set, 1603 * and enabling limited discoverable requires a timeout. 1604 */ 1605 if ((cp->val == 0x00 && timeout > 0) || 1606 (cp->val == 0x02 && timeout == 0)) 1607 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE, 1608 MGMT_STATUS_INVALID_PARAMS); 1609 1610 hci_dev_lock(hdev); 1611 1612 if (!hdev_is_powered(hdev) && timeout > 0) { 1613 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE, 1614 MGMT_STATUS_NOT_POWERED); 1615 goto failed; 1616 } 1617 1618 if (pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) || 1619 pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) { 1620 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE, 1621 MGMT_STATUS_BUSY); 1622 goto failed; 1623 } 1624 1625 if (!hci_dev_test_flag(hdev, HCI_CONNECTABLE)) { 1626 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE, 1627 MGMT_STATUS_REJECTED); 1628 goto failed; 1629 } 1630 1631 if (hdev->advertising_paused) { 1632 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DISCOVERABLE, 1633 MGMT_STATUS_BUSY); 1634 goto failed; 1635 } 1636 1637 if (!hdev_is_powered(hdev)) { 1638 bool changed = false; 1639 1640 /* Setting limited discoverable when powered off is 1641 * not a valid operation since it requires a timeout 1642 * and so no need to check HCI_LIMITED_DISCOVERABLE. 1643 */ 1644 if (!!cp->val != hci_dev_test_flag(hdev, HCI_DISCOVERABLE)) { 1645 hci_dev_change_flag(hdev, HCI_DISCOVERABLE); 1646 changed = true; 1647 } 1648 1649 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev); 1650 if (err < 0) 1651 goto failed; 1652 1653 if (changed) 1654 err = new_settings(hdev, sk); 1655 1656 goto failed; 1657 } 1658 1659 /* If the current mode is the same, then just update the timeout 1660 * value with the new value. And if only the timeout gets updated, 1661 * then no need for any HCI transactions. 1662 */ 1663 if (!!cp->val == hci_dev_test_flag(hdev, HCI_DISCOVERABLE) && 1664 (cp->val == 0x02) == hci_dev_test_flag(hdev, 1665 HCI_LIMITED_DISCOVERABLE)) { 1666 cancel_delayed_work(&hdev->discov_off); 1667 hdev->discov_timeout = timeout; 1668 1669 if (cp->val && hdev->discov_timeout > 0) { 1670 int to = secs_to_jiffies(hdev->discov_timeout); 1671 queue_delayed_work(hdev->req_workqueue, 1672 &hdev->discov_off, to); 1673 } 1674 1675 err = send_settings_rsp(sk, MGMT_OP_SET_DISCOVERABLE, hdev); 1676 goto failed; 1677 } 1678 1679 cmd = mgmt_pending_add(sk, MGMT_OP_SET_DISCOVERABLE, hdev, data, len); 1680 if (!cmd) { 1681 err = -ENOMEM; 1682 goto failed; 1683 } 1684 1685 /* Cancel any potential discoverable timeout that might be 1686 * still active and store new timeout value. The arming of 1687 * the timeout happens in the complete handler. 1688 */ 1689 cancel_delayed_work(&hdev->discov_off); 1690 hdev->discov_timeout = timeout; 1691 1692 if (cp->val) 1693 hci_dev_set_flag(hdev, HCI_DISCOVERABLE); 1694 else 1695 hci_dev_clear_flag(hdev, HCI_DISCOVERABLE); 1696 1697 /* Limited discoverable mode */ 1698 if (cp->val == 0x02) 1699 hci_dev_set_flag(hdev, HCI_LIMITED_DISCOVERABLE); 1700 else 1701 hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE); 1702 1703 err = hci_cmd_sync_queue(hdev, set_discoverable_sync, cmd, 1704 mgmt_set_discoverable_complete); 1705 1706 if (err < 0) 1707 mgmt_pending_remove(cmd); 1708 1709 failed: 1710 hci_dev_unlock(hdev); 1711 return err; 1712 } 1713 1714 static void mgmt_set_connectable_complete(struct hci_dev *hdev, void *data, 1715 int err) 1716 { 1717 struct mgmt_pending_cmd *cmd = data; 1718 1719 bt_dev_dbg(hdev, "err %d", err); 1720 1721 /* Make sure cmd still outstanding. */ 1722 if (err == -ECANCELED || !mgmt_pending_valid(hdev, cmd)) 1723 return; 1724 1725 hci_dev_lock(hdev); 1726 1727 if (err) { 1728 u8 mgmt_err = mgmt_status(err); 1729 mgmt_cmd_status(cmd->sk, cmd->hdev->id, cmd->opcode, mgmt_err); 1730 goto done; 1731 } 1732 1733 send_settings_rsp(cmd->sk, MGMT_OP_SET_CONNECTABLE, hdev); 1734 new_settings(hdev, cmd->sk); 1735 1736 done: 1737 mgmt_pending_free(cmd); 1738 1739 hci_dev_unlock(hdev); 1740 } 1741 1742 static int set_connectable_update_settings(struct hci_dev *hdev, 1743 struct sock *sk, u8 val) 1744 { 1745 bool changed = false; 1746 int err; 1747 1748 if (!!val != hci_dev_test_flag(hdev, HCI_CONNECTABLE)) 1749 changed = true; 1750 1751 if (val) { 1752 hci_dev_set_flag(hdev, HCI_CONNECTABLE); 1753 } else { 1754 hci_dev_clear_flag(hdev, HCI_CONNECTABLE); 1755 hci_dev_clear_flag(hdev, HCI_DISCOVERABLE); 1756 } 1757 1758 err = send_settings_rsp(sk, MGMT_OP_SET_CONNECTABLE, hdev); 1759 if (err < 0) 1760 return err; 1761 1762 if (changed) { 1763 hci_update_scan(hdev); 1764 hci_update_passive_scan(hdev); 1765 return new_settings(hdev, sk); 1766 } 1767 1768 return 0; 1769 } 1770 1771 static int set_connectable_sync(struct hci_dev *hdev, void *data) 1772 { 1773 if (!mgmt_pending_listed(hdev, data)) 1774 return -ECANCELED; 1775 1776 BT_DBG("%s", hdev->name); 1777 1778 return hci_update_connectable_sync(hdev); 1779 } 1780 1781 static int set_connectable(struct sock *sk, struct hci_dev *hdev, void *data, 1782 u16 len) 1783 { 1784 struct mgmt_mode *cp = data; 1785 struct mgmt_pending_cmd *cmd; 1786 int err; 1787 1788 bt_dev_dbg(hdev, "sock %p", sk); 1789 1790 if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED) && 1791 !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) 1792 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE, 1793 MGMT_STATUS_REJECTED); 1794 1795 if (cp->val != 0x00 && cp->val != 0x01) 1796 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE, 1797 MGMT_STATUS_INVALID_PARAMS); 1798 1799 hci_dev_lock(hdev); 1800 1801 if (!hdev_is_powered(hdev)) { 1802 err = set_connectable_update_settings(hdev, sk, cp->val); 1803 goto failed; 1804 } 1805 1806 if (pending_find(MGMT_OP_SET_DISCOVERABLE, hdev) || 1807 pending_find(MGMT_OP_SET_CONNECTABLE, hdev)) { 1808 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_CONNECTABLE, 1809 MGMT_STATUS_BUSY); 1810 goto failed; 1811 } 1812 1813 cmd = mgmt_pending_add(sk, MGMT_OP_SET_CONNECTABLE, hdev, data, len); 1814 if (!cmd) { 1815 err = -ENOMEM; 1816 goto failed; 1817 } 1818 1819 if (cp->val) { 1820 hci_dev_set_flag(hdev, HCI_CONNECTABLE); 1821 } else { 1822 if (hdev->discov_timeout > 0) 1823 cancel_delayed_work(&hdev->discov_off); 1824 1825 hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE); 1826 hci_dev_clear_flag(hdev, HCI_DISCOVERABLE); 1827 hci_dev_clear_flag(hdev, HCI_CONNECTABLE); 1828 } 1829 1830 err = hci_cmd_sync_queue(hdev, set_connectable_sync, cmd, 1831 mgmt_set_connectable_complete); 1832 1833 if (err < 0) 1834 mgmt_pending_remove(cmd); 1835 1836 failed: 1837 hci_dev_unlock(hdev); 1838 return err; 1839 } 1840 1841 static int set_bondable(struct sock *sk, struct hci_dev *hdev, void *data, 1842 u16 len) 1843 { 1844 struct mgmt_mode *cp = data; 1845 bool changed; 1846 int err; 1847 1848 bt_dev_dbg(hdev, "sock %p", sk); 1849 1850 if (cp->val != 0x00 && cp->val != 0x01) 1851 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BONDABLE, 1852 MGMT_STATUS_INVALID_PARAMS); 1853 1854 hci_dev_lock(hdev); 1855 1856 if (cp->val) 1857 changed = !hci_dev_test_and_set_flag(hdev, HCI_BONDABLE); 1858 else 1859 changed = hci_dev_test_and_clear_flag(hdev, HCI_BONDABLE); 1860 1861 err = send_settings_rsp(sk, MGMT_OP_SET_BONDABLE, hdev); 1862 if (err < 0) 1863 goto unlock; 1864 1865 if (changed) { 1866 /* In limited privacy mode the change of bondable mode 1867 * may affect the local advertising address. 1868 */ 1869 hci_update_discoverable(hdev); 1870 1871 err = new_settings(hdev, sk); 1872 } 1873 1874 unlock: 1875 hci_dev_unlock(hdev); 1876 return err; 1877 } 1878 1879 static int set_link_security(struct sock *sk, struct hci_dev *hdev, void *data, 1880 u16 len) 1881 { 1882 struct mgmt_mode *cp = data; 1883 struct mgmt_pending_cmd *cmd; 1884 u8 val, status; 1885 int err; 1886 1887 bt_dev_dbg(hdev, "sock %p", sk); 1888 1889 status = mgmt_bredr_support(hdev); 1890 if (status) 1891 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY, 1892 status); 1893 1894 if (cp->val != 0x00 && cp->val != 0x01) 1895 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY, 1896 MGMT_STATUS_INVALID_PARAMS); 1897 1898 hci_dev_lock(hdev); 1899 1900 if (!hdev_is_powered(hdev)) { 1901 bool changed = false; 1902 1903 if (!!cp->val != hci_dev_test_flag(hdev, HCI_LINK_SECURITY)) { 1904 hci_dev_change_flag(hdev, HCI_LINK_SECURITY); 1905 changed = true; 1906 } 1907 1908 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev); 1909 if (err < 0) 1910 goto failed; 1911 1912 if (changed) 1913 err = new_settings(hdev, sk); 1914 1915 goto failed; 1916 } 1917 1918 if (pending_find(MGMT_OP_SET_LINK_SECURITY, hdev)) { 1919 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LINK_SECURITY, 1920 MGMT_STATUS_BUSY); 1921 goto failed; 1922 } 1923 1924 val = !!cp->val; 1925 1926 if (test_bit(HCI_AUTH, &hdev->flags) == val) { 1927 err = send_settings_rsp(sk, MGMT_OP_SET_LINK_SECURITY, hdev); 1928 goto failed; 1929 } 1930 1931 cmd = mgmt_pending_add(sk, MGMT_OP_SET_LINK_SECURITY, hdev, data, len); 1932 if (!cmd) { 1933 err = -ENOMEM; 1934 goto failed; 1935 } 1936 1937 err = hci_send_cmd(hdev, HCI_OP_WRITE_AUTH_ENABLE, sizeof(val), &val); 1938 if (err < 0) { 1939 mgmt_pending_remove(cmd); 1940 goto failed; 1941 } 1942 1943 failed: 1944 hci_dev_unlock(hdev); 1945 return err; 1946 } 1947 1948 static void set_ssp_complete(struct hci_dev *hdev, void *data, int err) 1949 { 1950 struct cmd_lookup match = { NULL, hdev }; 1951 struct mgmt_pending_cmd *cmd = data; 1952 struct mgmt_mode *cp; 1953 u8 enable; 1954 bool changed; 1955 1956 /* Make sure cmd still outstanding. */ 1957 if (err == -ECANCELED || !mgmt_pending_valid(hdev, cmd)) 1958 return; 1959 1960 cp = cmd->param; 1961 enable = cp->val; 1962 1963 if (err) { 1964 u8 mgmt_err = mgmt_status(err); 1965 1966 if (enable && hci_dev_test_and_clear_flag(hdev, 1967 HCI_SSP_ENABLED)) { 1968 new_settings(hdev, NULL); 1969 } 1970 1971 mgmt_cmd_status(cmd->sk, cmd->hdev->id, cmd->opcode, mgmt_err); 1972 mgmt_pending_free(cmd); 1973 return; 1974 } 1975 1976 if (enable) { 1977 changed = !hci_dev_test_and_set_flag(hdev, HCI_SSP_ENABLED); 1978 } else { 1979 changed = hci_dev_test_and_clear_flag(hdev, HCI_SSP_ENABLED); 1980 } 1981 1982 settings_rsp(cmd, &match); 1983 1984 if (changed) 1985 new_settings(hdev, match.sk); 1986 1987 if (match.sk) 1988 sock_put(match.sk); 1989 1990 hci_update_eir_sync(hdev); 1991 mgmt_pending_free(cmd); 1992 } 1993 1994 static int set_ssp_sync(struct hci_dev *hdev, void *data) 1995 { 1996 struct mgmt_pending_cmd *cmd = data; 1997 struct mgmt_mode cp; 1998 bool changed = false; 1999 int err; 2000 2001 mutex_lock(&hdev->mgmt_pending_lock); 2002 2003 if (!__mgmt_pending_listed(hdev, cmd)) { 2004 mutex_unlock(&hdev->mgmt_pending_lock); 2005 return -ECANCELED; 2006 } 2007 2008 memcpy(&cp, cmd->param, sizeof(cp)); 2009 2010 mutex_unlock(&hdev->mgmt_pending_lock); 2011 2012 if (cp.val) 2013 changed = !hci_dev_test_and_set_flag(hdev, HCI_SSP_ENABLED); 2014 2015 err = hci_write_ssp_mode_sync(hdev, cp.val); 2016 2017 if (!err && changed) 2018 hci_dev_clear_flag(hdev, HCI_SSP_ENABLED); 2019 2020 return err; 2021 } 2022 2023 static int set_ssp(struct sock *sk, struct hci_dev *hdev, void *data, u16 len) 2024 { 2025 struct mgmt_mode *cp = data; 2026 struct mgmt_pending_cmd *cmd; 2027 u8 status; 2028 int err; 2029 2030 bt_dev_dbg(hdev, "sock %p", sk); 2031 2032 status = mgmt_bredr_support(hdev); 2033 if (status) 2034 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP, status); 2035 2036 if (!lmp_ssp_capable(hdev)) 2037 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP, 2038 MGMT_STATUS_NOT_SUPPORTED); 2039 2040 if (cp->val != 0x00 && cp->val != 0x01) 2041 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP, 2042 MGMT_STATUS_INVALID_PARAMS); 2043 2044 hci_dev_lock(hdev); 2045 2046 if (!hdev_is_powered(hdev)) { 2047 bool changed; 2048 2049 if (cp->val) { 2050 changed = !hci_dev_test_and_set_flag(hdev, 2051 HCI_SSP_ENABLED); 2052 } else { 2053 changed = hci_dev_test_and_clear_flag(hdev, 2054 HCI_SSP_ENABLED); 2055 } 2056 2057 err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev); 2058 if (err < 0) 2059 goto failed; 2060 2061 if (changed) 2062 err = new_settings(hdev, sk); 2063 2064 goto failed; 2065 } 2066 2067 if (pending_find(MGMT_OP_SET_SSP, hdev)) { 2068 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP, 2069 MGMT_STATUS_BUSY); 2070 goto failed; 2071 } 2072 2073 if (!!cp->val == hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) { 2074 err = send_settings_rsp(sk, MGMT_OP_SET_SSP, hdev); 2075 goto failed; 2076 } 2077 2078 cmd = mgmt_pending_add(sk, MGMT_OP_SET_SSP, hdev, data, len); 2079 if (!cmd) 2080 err = -ENOMEM; 2081 else 2082 err = hci_cmd_sync_queue(hdev, set_ssp_sync, cmd, 2083 set_ssp_complete); 2084 2085 if (err < 0) { 2086 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SSP, 2087 MGMT_STATUS_FAILED); 2088 2089 if (cmd) 2090 mgmt_pending_remove(cmd); 2091 } 2092 2093 failed: 2094 hci_dev_unlock(hdev); 2095 return err; 2096 } 2097 2098 static int set_hs(struct sock *sk, struct hci_dev *hdev, void *data, u16 len) 2099 { 2100 bt_dev_dbg(hdev, "sock %p", sk); 2101 2102 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_HS, 2103 MGMT_STATUS_NOT_SUPPORTED); 2104 } 2105 2106 static void set_le_complete(struct hci_dev *hdev, void *data, int err) 2107 { 2108 struct mgmt_pending_cmd *cmd = data; 2109 struct cmd_lookup match = { NULL, hdev }; 2110 u8 status = mgmt_status(err); 2111 2112 bt_dev_dbg(hdev, "err %d", err); 2113 2114 if (err == -ECANCELED || !mgmt_pending_valid(hdev, data)) 2115 return; 2116 2117 if (status) { 2118 mgmt_cmd_status(cmd->sk, cmd->hdev->id, cmd->opcode, status); 2119 goto done; 2120 } 2121 2122 settings_rsp(cmd, &match); 2123 2124 new_settings(hdev, match.sk); 2125 2126 if (match.sk) 2127 sock_put(match.sk); 2128 2129 done: 2130 mgmt_pending_free(cmd); 2131 } 2132 2133 static int set_le_sync(struct hci_dev *hdev, void *data) 2134 { 2135 struct mgmt_pending_cmd *cmd = data; 2136 struct mgmt_mode cp; 2137 u8 val; 2138 int err; 2139 2140 mutex_lock(&hdev->mgmt_pending_lock); 2141 2142 if (!__mgmt_pending_listed(hdev, cmd)) { 2143 mutex_unlock(&hdev->mgmt_pending_lock); 2144 return -ECANCELED; 2145 } 2146 2147 memcpy(&cp, cmd->param, sizeof(cp)); 2148 val = !!cp.val; 2149 2150 mutex_unlock(&hdev->mgmt_pending_lock); 2151 2152 if (!val) { 2153 hci_clear_adv_instance_sync(hdev, NULL, 0x00, true); 2154 2155 if (hci_dev_test_flag(hdev, HCI_LE_ADV)) 2156 hci_disable_advertising_sync(hdev); 2157 2158 if (ext_adv_capable(hdev)) 2159 hci_remove_ext_adv_instance_sync(hdev, 0, cmd->sk); 2160 } else { 2161 hci_dev_set_flag(hdev, HCI_LE_ENABLED); 2162 } 2163 2164 err = hci_write_le_host_supported_sync(hdev, val, 0); 2165 2166 /* Make sure the controller has a good default for 2167 * advertising data. Restrict the update to when LE 2168 * has actually been enabled. During power on, the 2169 * update in powered_update_hci will take care of it. 2170 */ 2171 if (!err && hci_dev_test_flag(hdev, HCI_LE_ENABLED)) { 2172 if (ext_adv_capable(hdev)) { 2173 int status; 2174 2175 status = hci_setup_ext_adv_instance_sync(hdev, 0x00); 2176 if (!status) 2177 hci_update_scan_rsp_data_sync(hdev, 0x00); 2178 } else { 2179 hci_update_adv_data_sync(hdev, 0x00); 2180 hci_update_scan_rsp_data_sync(hdev, 0x00); 2181 } 2182 2183 hci_update_passive_scan(hdev); 2184 } 2185 2186 return err; 2187 } 2188 2189 static void set_mesh_complete(struct hci_dev *hdev, void *data, int err) 2190 { 2191 struct mgmt_pending_cmd *cmd = data; 2192 u8 status = mgmt_status(err); 2193 struct sock *sk; 2194 2195 if (err == -ECANCELED || !mgmt_pending_valid(hdev, cmd)) 2196 return; 2197 2198 sk = cmd->sk; 2199 2200 if (status) { 2201 mgmt_cmd_status(cmd->sk, hdev->id, cmd->opcode, status); 2202 goto done; 2203 } 2204 2205 mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_MESH_RECEIVER, 0, NULL, 0); 2206 2207 done: 2208 mgmt_pending_free(cmd); 2209 } 2210 2211 static int set_mesh_sync(struct hci_dev *hdev, void *data) 2212 { 2213 struct mgmt_pending_cmd *cmd = data; 2214 DEFINE_FLEX(struct mgmt_cp_set_mesh, cp, ad_types, num_ad_types, 2215 sizeof(hdev->mesh_ad_types)); 2216 size_t len; 2217 2218 mutex_lock(&hdev->mgmt_pending_lock); 2219 2220 if (!__mgmt_pending_listed(hdev, cmd)) { 2221 mutex_unlock(&hdev->mgmt_pending_lock); 2222 return -ECANCELED; 2223 } 2224 2225 len = cmd->param_len; 2226 memcpy(cp, cmd->param, min(__struct_size(cp), len)); 2227 2228 mutex_unlock(&hdev->mgmt_pending_lock); 2229 2230 memset(hdev->mesh_ad_types, 0, sizeof(hdev->mesh_ad_types)); 2231 2232 if (cp->enable) 2233 hci_dev_set_flag(hdev, HCI_MESH); 2234 else 2235 hci_dev_clear_flag(hdev, HCI_MESH); 2236 2237 hdev->le_scan_interval = __le16_to_cpu(cp->period); 2238 hdev->le_scan_window = __le16_to_cpu(cp->window); 2239 2240 len -= sizeof(struct mgmt_cp_set_mesh); 2241 2242 /* If filters don't fit, forward all adv pkts */ 2243 if (len <= sizeof(hdev->mesh_ad_types)) 2244 memcpy(hdev->mesh_ad_types, cp->ad_types, len); 2245 2246 hci_update_passive_scan_sync(hdev); 2247 return 0; 2248 } 2249 2250 static int set_mesh(struct sock *sk, struct hci_dev *hdev, void *data, u16 len) 2251 { 2252 struct mgmt_cp_set_mesh *cp = data; 2253 struct mgmt_pending_cmd *cmd; 2254 __u16 period, window; 2255 int err = 0; 2256 2257 bt_dev_dbg(hdev, "sock %p", sk); 2258 2259 if (!lmp_le_capable(hdev) || 2260 !hci_dev_test_flag(hdev, HCI_MESH_EXPERIMENTAL)) 2261 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_MESH_RECEIVER, 2262 MGMT_STATUS_NOT_SUPPORTED); 2263 2264 if (cp->enable != 0x00 && cp->enable != 0x01) 2265 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_MESH_RECEIVER, 2266 MGMT_STATUS_INVALID_PARAMS); 2267 2268 /* Keep allowed ranges in sync with set_scan_params() */ 2269 period = __le16_to_cpu(cp->period); 2270 2271 if (period < 0x0004 || period > 0x4000) 2272 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_MESH_RECEIVER, 2273 MGMT_STATUS_INVALID_PARAMS); 2274 2275 window = __le16_to_cpu(cp->window); 2276 2277 if (window < 0x0004 || window > 0x4000) 2278 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_MESH_RECEIVER, 2279 MGMT_STATUS_INVALID_PARAMS); 2280 2281 if (window > period) 2282 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_MESH_RECEIVER, 2283 MGMT_STATUS_INVALID_PARAMS); 2284 2285 hci_dev_lock(hdev); 2286 2287 cmd = mgmt_pending_add(sk, MGMT_OP_SET_MESH_RECEIVER, hdev, data, len); 2288 if (!cmd) 2289 err = -ENOMEM; 2290 else 2291 err = hci_cmd_sync_queue(hdev, set_mesh_sync, cmd, 2292 set_mesh_complete); 2293 2294 if (err < 0) { 2295 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_MESH_RECEIVER, 2296 MGMT_STATUS_FAILED); 2297 2298 if (cmd) 2299 mgmt_pending_remove(cmd); 2300 } 2301 2302 hci_dev_unlock(hdev); 2303 return err; 2304 } 2305 2306 static void mesh_send_start_complete(struct hci_dev *hdev, void *data, int err) 2307 { 2308 struct mgmt_mesh_tx *mesh_tx = data; 2309 struct mgmt_cp_mesh_send *send = (void *)mesh_tx->param; 2310 unsigned long mesh_send_interval; 2311 u8 mgmt_err = mgmt_status(err); 2312 2313 /* Report any errors here, but don't report completion */ 2314 2315 if (mgmt_err) { 2316 hci_dev_clear_flag(hdev, HCI_MESH_SENDING); 2317 /* Send Complete Error Code for handle */ 2318 mesh_send_complete(hdev, mesh_tx, false); 2319 return; 2320 } 2321 2322 mesh_send_interval = msecs_to_jiffies((send->cnt) * 25); 2323 queue_delayed_work(hdev->req_workqueue, &hdev->mesh_send_done, 2324 mesh_send_interval); 2325 } 2326 2327 static int mesh_send_sync(struct hci_dev *hdev, void *data) 2328 { 2329 struct mgmt_mesh_tx *mesh_tx = data; 2330 struct mgmt_cp_mesh_send *send = (void *)mesh_tx->param; 2331 struct adv_info *adv, *next_instance; 2332 u8 instance = hdev->le_num_of_adv_sets + 1; 2333 u16 timeout, duration; 2334 int err = 0; 2335 2336 if (hdev->le_num_of_adv_sets <= hdev->adv_instance_cnt) 2337 return MGMT_STATUS_BUSY; 2338 2339 timeout = 1000; 2340 duration = send->cnt * INTERVAL_TO_MS(hdev->le_adv_max_interval); 2341 adv = hci_add_adv_instance(hdev, instance, 0, 2342 send->adv_data_len, send->adv_data, 2343 0, NULL, 2344 timeout, duration, 2345 HCI_ADV_TX_POWER_NO_PREFERENCE, 2346 hdev->le_adv_min_interval, 2347 hdev->le_adv_max_interval, 2348 mesh_tx->handle); 2349 2350 if (!IS_ERR(adv)) 2351 mesh_tx->instance = instance; 2352 else 2353 err = PTR_ERR(adv); 2354 2355 if (hdev->cur_adv_instance == instance) { 2356 /* If the currently advertised instance is being changed then 2357 * cancel the current advertising and schedule the next 2358 * instance. If there is only one instance then the overridden 2359 * advertising data will be visible right away. 2360 */ 2361 cancel_adv_timeout(hdev); 2362 2363 next_instance = hci_get_next_instance(hdev, instance); 2364 if (next_instance) 2365 instance = next_instance->instance; 2366 else 2367 instance = 0; 2368 } else if (hdev->adv_instance_timeout) { 2369 /* Immediately advertise the new instance if no other, or 2370 * let it go naturally from queue if ADV is already happening 2371 */ 2372 instance = 0; 2373 } 2374 2375 if (instance) 2376 return hci_schedule_adv_instance_sync(hdev, instance, true); 2377 2378 return err; 2379 } 2380 2381 static void send_count(struct mgmt_mesh_tx *mesh_tx, void *data) 2382 { 2383 struct mgmt_rp_mesh_read_features *rp = data; 2384 2385 if (rp->used_handles >= rp->max_handles) 2386 return; 2387 2388 rp->handles[rp->used_handles++] = mesh_tx->handle; 2389 } 2390 2391 static int mesh_features(struct sock *sk, struct hci_dev *hdev, 2392 void *data, u16 len) 2393 { 2394 struct mgmt_rp_mesh_read_features rp; 2395 2396 if (!lmp_le_capable(hdev) || 2397 !hci_dev_test_flag(hdev, HCI_MESH_EXPERIMENTAL)) 2398 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_MESH_READ_FEATURES, 2399 MGMT_STATUS_NOT_SUPPORTED); 2400 2401 memset(&rp, 0, sizeof(rp)); 2402 rp.index = cpu_to_le16(hdev->id); 2403 if (hci_dev_test_flag(hdev, HCI_LE_ENABLED)) 2404 rp.max_handles = MESH_HANDLES_MAX; 2405 2406 hci_dev_lock(hdev); 2407 2408 if (rp.max_handles) 2409 mgmt_mesh_foreach(hdev, send_count, &rp, sk); 2410 2411 mgmt_cmd_complete(sk, hdev->id, MGMT_OP_MESH_READ_FEATURES, 0, &rp, 2412 rp.used_handles + sizeof(rp) - MESH_HANDLES_MAX); 2413 2414 hci_dev_unlock(hdev); 2415 return 0; 2416 } 2417 2418 static int send_cancel(struct hci_dev *hdev, void *data) 2419 { 2420 struct mgmt_pending_cmd *cmd = data; 2421 struct mgmt_cp_mesh_send_cancel *cancel = (void *)cmd->param; 2422 struct mgmt_mesh_tx *mesh_tx; 2423 2424 if (!cancel->handle) { 2425 do { 2426 mesh_tx = mgmt_mesh_next(hdev, cmd->sk); 2427 2428 if (mesh_tx) 2429 mesh_send_complete(hdev, mesh_tx, false); 2430 } while (mesh_tx); 2431 } else { 2432 mesh_tx = mgmt_mesh_find(hdev, cancel->handle); 2433 2434 if (mesh_tx && mesh_tx->sk == cmd->sk) 2435 mesh_send_complete(hdev, mesh_tx, false); 2436 } 2437 2438 mgmt_cmd_complete(cmd->sk, hdev->id, MGMT_OP_MESH_SEND_CANCEL, 2439 0, NULL, 0); 2440 2441 return 0; 2442 } 2443 2444 static void send_cancel_destroy(struct hci_dev *hdev, void *data, int err) 2445 { 2446 mgmt_pending_free(data); 2447 } 2448 2449 static int mesh_send_cancel(struct sock *sk, struct hci_dev *hdev, 2450 void *data, u16 len) 2451 { 2452 struct mgmt_pending_cmd *cmd; 2453 int err; 2454 2455 if (!lmp_le_capable(hdev) || 2456 !hci_dev_test_flag(hdev, HCI_MESH_EXPERIMENTAL)) 2457 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_MESH_SEND_CANCEL, 2458 MGMT_STATUS_NOT_SUPPORTED); 2459 2460 if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED)) 2461 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_MESH_SEND_CANCEL, 2462 MGMT_STATUS_REJECTED); 2463 2464 hci_dev_lock(hdev); 2465 cmd = mgmt_pending_new(sk, MGMT_OP_MESH_SEND_CANCEL, hdev, data, len); 2466 if (!cmd) 2467 err = -ENOMEM; 2468 else 2469 err = hci_cmd_sync_queue(hdev, send_cancel, cmd, 2470 send_cancel_destroy); 2471 2472 if (err < 0) { 2473 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_MESH_SEND_CANCEL, 2474 MGMT_STATUS_FAILED); 2475 2476 if (cmd) 2477 mgmt_pending_free(cmd); 2478 } 2479 2480 hci_dev_unlock(hdev); 2481 return err; 2482 } 2483 2484 static int mesh_send(struct sock *sk, struct hci_dev *hdev, void *data, u16 len) 2485 { 2486 struct mgmt_mesh_tx *mesh_tx; 2487 struct mgmt_cp_mesh_send *send = data; 2488 struct mgmt_rp_mesh_read_features rp; 2489 u16 expected_len; 2490 bool sending; 2491 int err = 0; 2492 2493 if (!lmp_le_capable(hdev) || 2494 !hci_dev_test_flag(hdev, HCI_MESH_EXPERIMENTAL)) 2495 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_MESH_SEND, 2496 MGMT_STATUS_NOT_SUPPORTED); 2497 if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED)) 2498 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_MESH_SEND, 2499 MGMT_STATUS_REJECTED); 2500 2501 if (!send->adv_data_len || send->adv_data_len > 31) 2502 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_MESH_SEND, 2503 MGMT_STATUS_REJECTED); 2504 2505 expected_len = struct_size(send, adv_data, send->adv_data_len); 2506 if (expected_len != len) 2507 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_MESH_SEND, 2508 MGMT_STATUS_INVALID_PARAMS); 2509 2510 hci_dev_lock(hdev); 2511 2512 memset(&rp, 0, sizeof(rp)); 2513 rp.max_handles = MESH_HANDLES_MAX; 2514 2515 mgmt_mesh_foreach(hdev, send_count, &rp, sk); 2516 2517 if (rp.max_handles <= rp.used_handles) { 2518 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_MESH_SEND, 2519 MGMT_STATUS_BUSY); 2520 goto done; 2521 } 2522 2523 sending = hci_dev_test_flag(hdev, HCI_MESH_SENDING); 2524 mesh_tx = mgmt_mesh_add(sk, hdev, send, len); 2525 2526 if (!mesh_tx) 2527 err = -ENOMEM; 2528 else if (!sending) 2529 err = hci_cmd_sync_queue(hdev, mesh_send_sync, mesh_tx, 2530 mesh_send_start_complete); 2531 2532 if (err < 0) { 2533 bt_dev_err(hdev, "Send Mesh Failed %d", err); 2534 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_MESH_SEND, 2535 MGMT_STATUS_FAILED); 2536 2537 if (mesh_tx) { 2538 if (sending) 2539 mgmt_mesh_remove(mesh_tx); 2540 } 2541 } else { 2542 hci_dev_set_flag(hdev, HCI_MESH_SENDING); 2543 2544 mgmt_cmd_complete(sk, hdev->id, MGMT_OP_MESH_SEND, 0, 2545 &mesh_tx->handle, 1); 2546 } 2547 2548 done: 2549 hci_dev_unlock(hdev); 2550 return err; 2551 } 2552 2553 static int set_le(struct sock *sk, struct hci_dev *hdev, void *data, u16 len) 2554 { 2555 struct mgmt_mode *cp = data; 2556 struct mgmt_pending_cmd *cmd; 2557 int err; 2558 u8 val, enabled; 2559 2560 bt_dev_dbg(hdev, "sock %p", sk); 2561 2562 if (!lmp_le_capable(hdev)) 2563 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE, 2564 MGMT_STATUS_NOT_SUPPORTED); 2565 2566 if (cp->val != 0x00 && cp->val != 0x01) 2567 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE, 2568 MGMT_STATUS_INVALID_PARAMS); 2569 2570 /* Bluetooth single mode LE only controllers or dual-mode 2571 * controllers configured as LE only devices, do not allow 2572 * switching LE off. These have either LE enabled explicitly 2573 * or BR/EDR has been previously switched off. 2574 * 2575 * When trying to enable an already enabled LE, then gracefully 2576 * send a positive response. Trying to disable it however will 2577 * result into rejection. 2578 */ 2579 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) { 2580 if (cp->val == 0x01) 2581 return send_settings_rsp(sk, MGMT_OP_SET_LE, hdev); 2582 2583 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE, 2584 MGMT_STATUS_REJECTED); 2585 } 2586 2587 hci_dev_lock(hdev); 2588 2589 val = !!cp->val; 2590 enabled = lmp_host_le_capable(hdev); 2591 2592 if (!hdev_is_powered(hdev) || val == enabled) { 2593 bool changed = false; 2594 2595 if (val != hci_dev_test_flag(hdev, HCI_LE_ENABLED)) { 2596 hci_dev_change_flag(hdev, HCI_LE_ENABLED); 2597 changed = true; 2598 } 2599 2600 if (!val && hci_dev_test_flag(hdev, HCI_ADVERTISING)) { 2601 hci_dev_clear_flag(hdev, HCI_ADVERTISING); 2602 changed = true; 2603 } 2604 2605 err = send_settings_rsp(sk, MGMT_OP_SET_LE, hdev); 2606 if (err < 0) 2607 goto unlock; 2608 2609 if (changed) 2610 err = new_settings(hdev, sk); 2611 2612 goto unlock; 2613 } 2614 2615 if (pending_find(MGMT_OP_SET_LE, hdev) || 2616 pending_find(MGMT_OP_SET_ADVERTISING, hdev)) { 2617 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE, 2618 MGMT_STATUS_BUSY); 2619 goto unlock; 2620 } 2621 2622 cmd = mgmt_pending_add(sk, MGMT_OP_SET_LE, hdev, data, len); 2623 if (!cmd) 2624 err = -ENOMEM; 2625 else 2626 err = hci_cmd_sync_queue(hdev, set_le_sync, cmd, 2627 set_le_complete); 2628 2629 if (err < 0) { 2630 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LE, 2631 MGMT_STATUS_FAILED); 2632 2633 if (cmd) 2634 mgmt_pending_remove(cmd); 2635 } 2636 2637 unlock: 2638 hci_dev_unlock(hdev); 2639 return err; 2640 } 2641 2642 static int send_hci_cmd_sync(struct hci_dev *hdev, void *data) 2643 { 2644 struct mgmt_pending_cmd *cmd = data; 2645 struct mgmt_cp_hci_cmd_sync *cp = cmd->param; 2646 struct sk_buff *skb; 2647 2648 skb = __hci_cmd_sync_ev(hdev, le16_to_cpu(cp->opcode), 2649 le16_to_cpu(cp->params_len), cp->params, 2650 cp->event, cp->timeout ? 2651 secs_to_jiffies(cp->timeout) : 2652 HCI_CMD_TIMEOUT); 2653 if (IS_ERR(skb)) { 2654 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_HCI_CMD_SYNC, 2655 mgmt_status(PTR_ERR(skb))); 2656 return 0; 2657 } 2658 2659 mgmt_cmd_complete(cmd->sk, hdev->id, MGMT_OP_HCI_CMD_SYNC, 0, 2660 skb->data, skb->len); 2661 2662 kfree_skb(skb); 2663 2664 return 0; 2665 } 2666 2667 static void send_hci_cmd_sync_destroy(struct hci_dev *hdev, void *data, int err) 2668 { 2669 mgmt_pending_free(data); 2670 } 2671 2672 static int mgmt_hci_cmd_sync(struct sock *sk, struct hci_dev *hdev, 2673 void *data, u16 len) 2674 { 2675 struct mgmt_cp_hci_cmd_sync *cp = data; 2676 struct mgmt_pending_cmd *cmd; 2677 int err; 2678 2679 if (len != (offsetof(struct mgmt_cp_hci_cmd_sync, params) + 2680 le16_to_cpu(cp->params_len))) 2681 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_HCI_CMD_SYNC, 2682 MGMT_STATUS_INVALID_PARAMS); 2683 2684 /* The HCI command header carries the parameter length in a u8, a 2685 * larger value would be truncated there while the parameters are 2686 * still appended to the frame in full. 2687 */ 2688 if (le16_to_cpu(cp->params_len) > U8_MAX) 2689 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_HCI_CMD_SYNC, 2690 MGMT_STATUS_INVALID_PARAMS); 2691 2692 hci_dev_lock(hdev); 2693 cmd = mgmt_pending_new(sk, MGMT_OP_HCI_CMD_SYNC, hdev, data, len); 2694 if (!cmd) 2695 err = -ENOMEM; 2696 else 2697 err = hci_cmd_sync_queue(hdev, send_hci_cmd_sync, cmd, 2698 send_hci_cmd_sync_destroy); 2699 2700 if (err < 0) { 2701 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_HCI_CMD_SYNC, 2702 MGMT_STATUS_FAILED); 2703 2704 if (cmd) 2705 mgmt_pending_free(cmd); 2706 } 2707 2708 hci_dev_unlock(hdev); 2709 return err; 2710 } 2711 2712 /* This is a helper function to test for pending mgmt commands that can 2713 * cause CoD or EIR HCI commands. We can only allow one such pending 2714 * mgmt command at a time since otherwise we cannot easily track what 2715 * the current values are, will be, and based on that calculate if a new 2716 * HCI command needs to be sent and if yes with what value. 2717 */ 2718 static bool pending_eir_or_class(struct hci_dev *hdev) 2719 { 2720 struct mgmt_pending_cmd *cmd; 2721 bool pending = false; 2722 2723 mutex_lock(&hdev->mgmt_pending_lock); 2724 2725 list_for_each_entry(cmd, &hdev->mgmt_pending, list) { 2726 switch (cmd->opcode) { 2727 case MGMT_OP_ADD_UUID: 2728 case MGMT_OP_REMOVE_UUID: 2729 case MGMT_OP_SET_DEV_CLASS: 2730 case MGMT_OP_SET_LOCAL_NAME: 2731 case MGMT_OP_SET_POWERED: 2732 pending = true; 2733 break; 2734 } 2735 2736 if (pending) 2737 break; 2738 } 2739 2740 mutex_unlock(&hdev->mgmt_pending_lock); 2741 2742 return pending; 2743 } 2744 2745 static const u8 bluetooth_base_uuid[] = { 2746 0xfb, 0x34, 0x9b, 0x5f, 0x80, 0x00, 0x00, 0x80, 2747 0x00, 0x10, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 2748 }; 2749 2750 static u8 get_uuid_size(const u8 *uuid) 2751 { 2752 u32 val; 2753 2754 if (memcmp(uuid, bluetooth_base_uuid, 12)) 2755 return 128; 2756 2757 val = get_unaligned_le32(&uuid[12]); 2758 if (val > 0xffff) 2759 return 32; 2760 2761 return 16; 2762 } 2763 2764 static void mgmt_class_complete(struct hci_dev *hdev, void *data, int err) 2765 { 2766 struct mgmt_pending_cmd *cmd = data; 2767 2768 bt_dev_dbg(hdev, "err %d", err); 2769 2770 mgmt_cmd_complete(cmd->sk, cmd->hdev->id, cmd->opcode, 2771 mgmt_status(err), hdev->dev_class, 3); 2772 2773 mgmt_pending_free(cmd); 2774 } 2775 2776 static int add_uuid_sync(struct hci_dev *hdev, void *data) 2777 { 2778 int err; 2779 2780 err = hci_update_class_sync(hdev); 2781 if (err) 2782 return err; 2783 2784 return hci_update_eir_sync(hdev); 2785 } 2786 2787 static int add_uuid(struct sock *sk, struct hci_dev *hdev, void *data, u16 len) 2788 { 2789 struct mgmt_cp_add_uuid *cp = data; 2790 struct mgmt_pending_cmd *cmd; 2791 struct bt_uuid *uuid; 2792 int err; 2793 2794 bt_dev_dbg(hdev, "sock %p", sk); 2795 2796 hci_dev_lock(hdev); 2797 2798 if (pending_eir_or_class(hdev)) { 2799 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_UUID, 2800 MGMT_STATUS_BUSY); 2801 goto failed; 2802 } 2803 2804 uuid = kmalloc_obj(*uuid); 2805 if (!uuid) { 2806 err = -ENOMEM; 2807 goto failed; 2808 } 2809 2810 memcpy(uuid->uuid, cp->uuid, 16); 2811 uuid->svc_hint = cp->svc_hint; 2812 uuid->size = get_uuid_size(cp->uuid); 2813 2814 list_add_tail(&uuid->list, &hdev->uuids); 2815 2816 cmd = mgmt_pending_new(sk, MGMT_OP_ADD_UUID, hdev, data, len); 2817 if (!cmd) { 2818 err = -ENOMEM; 2819 goto failed; 2820 } 2821 2822 /* MGMT_OP_ADD_UUID don't require adapter the UP/Running so use 2823 * hci_cmd_sync_submit instead of hci_cmd_sync_queue. 2824 */ 2825 err = hci_cmd_sync_submit(hdev, add_uuid_sync, cmd, 2826 mgmt_class_complete); 2827 if (err < 0) { 2828 mgmt_pending_free(cmd); 2829 goto failed; 2830 } 2831 2832 failed: 2833 hci_dev_unlock(hdev); 2834 return err; 2835 } 2836 2837 static bool enable_service_cache(struct hci_dev *hdev) 2838 { 2839 if (!hdev_is_powered(hdev)) 2840 return false; 2841 2842 if (!hci_dev_test_and_set_flag(hdev, HCI_SERVICE_CACHE)) { 2843 queue_delayed_work(hdev->workqueue, &hdev->service_cache, 2844 CACHE_TIMEOUT); 2845 return true; 2846 } 2847 2848 return false; 2849 } 2850 2851 static int remove_uuid_sync(struct hci_dev *hdev, void *data) 2852 { 2853 int err; 2854 2855 err = hci_update_class_sync(hdev); 2856 if (err) 2857 return err; 2858 2859 return hci_update_eir_sync(hdev); 2860 } 2861 2862 static int remove_uuid(struct sock *sk, struct hci_dev *hdev, void *data, 2863 u16 len) 2864 { 2865 struct mgmt_cp_remove_uuid *cp = data; 2866 struct mgmt_pending_cmd *cmd; 2867 struct bt_uuid *match, *tmp; 2868 static const u8 bt_uuid_any[] = { 2869 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 2870 }; 2871 int err, found; 2872 2873 bt_dev_dbg(hdev, "sock %p", sk); 2874 2875 hci_dev_lock(hdev); 2876 2877 if (pending_eir_or_class(hdev)) { 2878 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID, 2879 MGMT_STATUS_BUSY); 2880 goto unlock; 2881 } 2882 2883 if (memcmp(cp->uuid, bt_uuid_any, 16) == 0) { 2884 hci_uuids_clear(hdev); 2885 2886 if (enable_service_cache(hdev)) { 2887 err = mgmt_cmd_complete(sk, hdev->id, 2888 MGMT_OP_REMOVE_UUID, 2889 0, hdev->dev_class, 3); 2890 goto unlock; 2891 } 2892 2893 goto update_class; 2894 } 2895 2896 found = 0; 2897 2898 list_for_each_entry_safe(match, tmp, &hdev->uuids, list) { 2899 if (memcmp(match->uuid, cp->uuid, 16) != 0) 2900 continue; 2901 2902 list_del(&match->list); 2903 kfree(match); 2904 found++; 2905 } 2906 2907 if (found == 0) { 2908 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_UUID, 2909 MGMT_STATUS_INVALID_PARAMS); 2910 goto unlock; 2911 } 2912 2913 update_class: 2914 cmd = mgmt_pending_new(sk, MGMT_OP_REMOVE_UUID, hdev, data, len); 2915 if (!cmd) { 2916 err = -ENOMEM; 2917 goto unlock; 2918 } 2919 2920 /* MGMT_OP_REMOVE_UUID don't require adapter the UP/Running so use 2921 * hci_cmd_sync_submit instead of hci_cmd_sync_queue. 2922 */ 2923 err = hci_cmd_sync_submit(hdev, remove_uuid_sync, cmd, 2924 mgmt_class_complete); 2925 if (err < 0) 2926 mgmt_pending_free(cmd); 2927 2928 unlock: 2929 hci_dev_unlock(hdev); 2930 return err; 2931 } 2932 2933 static int set_class_sync(struct hci_dev *hdev, void *data) 2934 { 2935 int err = 0; 2936 2937 if (hci_dev_test_and_clear_flag(hdev, HCI_SERVICE_CACHE)) { 2938 cancel_delayed_work_sync(&hdev->service_cache); 2939 err = hci_update_eir_sync(hdev); 2940 } 2941 2942 if (err) 2943 return err; 2944 2945 return hci_update_class_sync(hdev); 2946 } 2947 2948 static int set_dev_class(struct sock *sk, struct hci_dev *hdev, void *data, 2949 u16 len) 2950 { 2951 struct mgmt_cp_set_dev_class *cp = data; 2952 struct mgmt_pending_cmd *cmd; 2953 int err; 2954 2955 bt_dev_dbg(hdev, "sock %p", sk); 2956 2957 if (!lmp_bredr_capable(hdev)) 2958 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 2959 MGMT_STATUS_NOT_SUPPORTED); 2960 2961 hci_dev_lock(hdev); 2962 2963 if (pending_eir_or_class(hdev)) { 2964 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 2965 MGMT_STATUS_BUSY); 2966 goto unlock; 2967 } 2968 2969 if ((cp->minor & 0x03) != 0 || (cp->major & 0xe0) != 0) { 2970 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 2971 MGMT_STATUS_INVALID_PARAMS); 2972 goto unlock; 2973 } 2974 2975 hdev->major_class = cp->major; 2976 hdev->minor_class = cp->minor; 2977 2978 if (!hdev_is_powered(hdev)) { 2979 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_DEV_CLASS, 0, 2980 hdev->dev_class, 3); 2981 goto unlock; 2982 } 2983 2984 cmd = mgmt_pending_new(sk, MGMT_OP_SET_DEV_CLASS, hdev, data, len); 2985 if (!cmd) { 2986 err = -ENOMEM; 2987 goto unlock; 2988 } 2989 2990 /* MGMT_OP_SET_DEV_CLASS don't require adapter the UP/Running so use 2991 * hci_cmd_sync_submit instead of hci_cmd_sync_queue. 2992 */ 2993 err = hci_cmd_sync_submit(hdev, set_class_sync, cmd, 2994 mgmt_class_complete); 2995 if (err < 0) 2996 mgmt_pending_free(cmd); 2997 2998 unlock: 2999 hci_dev_unlock(hdev); 3000 return err; 3001 } 3002 3003 static int load_link_keys(struct sock *sk, struct hci_dev *hdev, void *data, 3004 u16 len) 3005 { 3006 struct mgmt_cp_load_link_keys *cp = data; 3007 const u16 max_key_count = ((U16_MAX - sizeof(*cp)) / 3008 sizeof(struct mgmt_link_key_info)); 3009 u16 key_count, expected_len; 3010 bool changed; 3011 int i; 3012 3013 bt_dev_dbg(hdev, "sock %p", sk); 3014 3015 if (!lmp_bredr_capable(hdev)) 3016 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS, 3017 MGMT_STATUS_NOT_SUPPORTED); 3018 3019 key_count = __le16_to_cpu(cp->key_count); 3020 if (key_count > max_key_count) { 3021 bt_dev_err(hdev, "load_link_keys: too big key_count value %u", 3022 key_count); 3023 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS, 3024 MGMT_STATUS_INVALID_PARAMS); 3025 } 3026 3027 expected_len = struct_size(cp, keys, key_count); 3028 if (expected_len != len) { 3029 bt_dev_err(hdev, "load_link_keys: expected %u bytes, got %u bytes", 3030 expected_len, len); 3031 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS, 3032 MGMT_STATUS_INVALID_PARAMS); 3033 } 3034 3035 if (cp->debug_keys != 0x00 && cp->debug_keys != 0x01) 3036 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS, 3037 MGMT_STATUS_INVALID_PARAMS); 3038 3039 bt_dev_dbg(hdev, "debug_keys %u key_count %u", cp->debug_keys, 3040 key_count); 3041 3042 hci_dev_lock(hdev); 3043 3044 hci_link_keys_clear(hdev); 3045 3046 if (cp->debug_keys) 3047 changed = !hci_dev_test_and_set_flag(hdev, HCI_KEEP_DEBUG_KEYS); 3048 else 3049 changed = hci_dev_test_and_clear_flag(hdev, 3050 HCI_KEEP_DEBUG_KEYS); 3051 3052 if (changed) 3053 new_settings(hdev, NULL); 3054 3055 for (i = 0; i < key_count; i++) { 3056 struct mgmt_link_key_info *key = &cp->keys[i]; 3057 3058 if (hci_is_blocked_key(hdev, 3059 HCI_BLOCKED_KEY_TYPE_LINKKEY, 3060 key->val)) { 3061 bt_dev_warn(hdev, "Skipping blocked link key for %pMR", 3062 &key->addr.bdaddr); 3063 continue; 3064 } 3065 3066 if (key->addr.type != BDADDR_BREDR) { 3067 bt_dev_warn(hdev, 3068 "Invalid link address type %u for %pMR", 3069 key->addr.type, &key->addr.bdaddr); 3070 continue; 3071 } 3072 3073 if (key->type > 0x08) { 3074 bt_dev_warn(hdev, "Invalid link key type %u for %pMR", 3075 key->type, &key->addr.bdaddr); 3076 continue; 3077 } 3078 3079 /* Always ignore debug keys and require a new pairing if 3080 * the user wants to use them. 3081 */ 3082 if (key->type == HCI_LK_DEBUG_COMBINATION) 3083 continue; 3084 3085 hci_add_link_key(hdev, NULL, &key->addr.bdaddr, key->val, 3086 key->type, key->pin_len, NULL); 3087 } 3088 3089 mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_LINK_KEYS, 0, NULL, 0); 3090 3091 hci_dev_unlock(hdev); 3092 3093 return 0; 3094 } 3095 3096 static int device_unpaired(struct hci_dev *hdev, bdaddr_t *bdaddr, 3097 u8 addr_type, struct sock *skip_sk) 3098 { 3099 struct mgmt_ev_device_unpaired ev; 3100 3101 bacpy(&ev.addr.bdaddr, bdaddr); 3102 ev.addr.type = addr_type; 3103 3104 return mgmt_event(MGMT_EV_DEVICE_UNPAIRED, hdev, &ev, sizeof(ev), 3105 skip_sk); 3106 } 3107 3108 static void unpair_device_complete(struct hci_dev *hdev, void *data, int err) 3109 { 3110 struct mgmt_pending_cmd *cmd = data; 3111 struct mgmt_cp_unpair_device *cp = cmd->param; 3112 3113 if (!err) 3114 device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, cmd->sk); 3115 3116 cmd->cmd_complete(cmd, err); 3117 mgmt_pending_free(cmd); 3118 } 3119 3120 static int unpair_device_sync(struct hci_dev *hdev, void *data) 3121 { 3122 struct mgmt_pending_cmd *cmd = data; 3123 struct mgmt_cp_unpair_device *cp = cmd->param; 3124 struct hci_conn *conn; 3125 3126 hci_dev_lock(hdev); 3127 3128 if (cp->addr.type == BDADDR_BREDR) 3129 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, 3130 &cp->addr.bdaddr); 3131 else 3132 conn = hci_conn_hash_lookup_le(hdev, &cp->addr.bdaddr, 3133 le_addr_type(cp->addr.type)); 3134 3135 if (conn) 3136 hci_conn_get(conn); 3137 3138 hci_dev_unlock(hdev); 3139 3140 if (!conn) 3141 return 0; 3142 3143 /* Disregard any possible error since the likes of hci_abort_conn_sync 3144 * will clean up the connection no matter the error. 3145 */ 3146 hci_abort_conn(conn, HCI_ERROR_REMOTE_USER_TERM); 3147 hci_conn_put(conn); 3148 3149 return 0; 3150 } 3151 3152 static int unpair_device(struct sock *sk, struct hci_dev *hdev, void *data, 3153 u16 len) 3154 { 3155 struct mgmt_cp_unpair_device *cp = data; 3156 struct mgmt_rp_unpair_device rp; 3157 struct hci_conn_params *params; 3158 struct mgmt_pending_cmd *cmd; 3159 struct hci_conn *conn; 3160 u8 addr_type; 3161 int err; 3162 3163 memset(&rp, 0, sizeof(rp)); 3164 bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr); 3165 rp.addr.type = cp->addr.type; 3166 3167 if (!bdaddr_type_is_valid(cp->addr.type)) 3168 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE, 3169 MGMT_STATUS_INVALID_PARAMS, 3170 &rp, sizeof(rp)); 3171 3172 if (cp->disconnect != 0x00 && cp->disconnect != 0x01) 3173 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE, 3174 MGMT_STATUS_INVALID_PARAMS, 3175 &rp, sizeof(rp)); 3176 3177 hci_dev_lock(hdev); 3178 3179 if (!hdev_is_powered(hdev)) { 3180 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE, 3181 MGMT_STATUS_NOT_POWERED, &rp, 3182 sizeof(rp)); 3183 goto unlock; 3184 } 3185 3186 if (cp->addr.type == BDADDR_BREDR) { 3187 /* If disconnection is requested, then look up the 3188 * connection. If the remote device is connected, it 3189 * will be later used to terminate the link. 3190 * 3191 * Setting it to NULL explicitly will cause no 3192 * termination of the link. 3193 */ 3194 if (cp->disconnect) 3195 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, 3196 &cp->addr.bdaddr); 3197 else 3198 conn = NULL; 3199 3200 err = hci_remove_link_key(hdev, &cp->addr.bdaddr); 3201 if (err < 0) { 3202 err = mgmt_cmd_complete(sk, hdev->id, 3203 MGMT_OP_UNPAIR_DEVICE, 3204 MGMT_STATUS_NOT_PAIRED, &rp, 3205 sizeof(rp)); 3206 goto unlock; 3207 } 3208 3209 goto done; 3210 } 3211 3212 /* LE address type */ 3213 addr_type = le_addr_type(cp->addr.type); 3214 3215 /* Abort any ongoing SMP pairing. Removes ltk and irk if they exist. */ 3216 err = smp_cancel_and_remove_pairing(hdev, &cp->addr.bdaddr, addr_type); 3217 if (err < 0) { 3218 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE, 3219 MGMT_STATUS_NOT_PAIRED, &rp, 3220 sizeof(rp)); 3221 goto unlock; 3222 } 3223 3224 conn = hci_conn_hash_lookup_le(hdev, &cp->addr.bdaddr, addr_type); 3225 if (!conn) { 3226 hci_conn_params_del(hdev, &cp->addr.bdaddr, addr_type); 3227 goto done; 3228 } 3229 3230 3231 /* Defer clearing up the connection parameters until closing to 3232 * give a chance of keeping them if a repairing happens. 3233 */ 3234 set_bit(HCI_CONN_PARAM_REMOVAL_PEND, &conn->flags); 3235 3236 /* Disable auto-connection parameters if present */ 3237 params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr, addr_type); 3238 if (params) { 3239 if (params->explicit_connect) 3240 params->auto_connect = HCI_AUTO_CONN_EXPLICIT; 3241 else 3242 params->auto_connect = HCI_AUTO_CONN_DISABLED; 3243 } 3244 3245 /* If disconnection is not requested, then clear the connection 3246 * variable so that the link is not terminated. 3247 */ 3248 if (!cp->disconnect) 3249 conn = NULL; 3250 3251 done: 3252 /* If the connection variable is set, then termination of the 3253 * link is requested. 3254 */ 3255 if (!conn) { 3256 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNPAIR_DEVICE, 0, 3257 &rp, sizeof(rp)); 3258 device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, sk); 3259 goto unlock; 3260 } 3261 3262 cmd = mgmt_pending_new(sk, MGMT_OP_UNPAIR_DEVICE, hdev, cp, 3263 sizeof(*cp)); 3264 if (!cmd) { 3265 err = -ENOMEM; 3266 goto unlock; 3267 } 3268 3269 cmd->cmd_complete = addr_cmd_complete; 3270 3271 err = hci_cmd_sync_queue(hdev, unpair_device_sync, cmd, 3272 unpair_device_complete); 3273 if (err < 0) 3274 mgmt_pending_free(cmd); 3275 3276 unlock: 3277 hci_dev_unlock(hdev); 3278 return err; 3279 } 3280 3281 static void disconnect_complete(struct hci_dev *hdev, void *data, int err) 3282 { 3283 struct mgmt_pending_cmd *cmd = data; 3284 3285 cmd->cmd_complete(cmd, mgmt_status(err)); 3286 mgmt_pending_free(cmd); 3287 } 3288 3289 static int disconnect_sync(struct hci_dev *hdev, void *data) 3290 { 3291 struct mgmt_pending_cmd *cmd = data; 3292 struct mgmt_cp_disconnect *cp = cmd->param; 3293 struct hci_conn *conn; 3294 3295 hci_dev_lock(hdev); 3296 3297 if (cp->addr.type == BDADDR_BREDR) 3298 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, 3299 &cp->addr.bdaddr); 3300 else 3301 conn = hci_conn_hash_lookup_le(hdev, &cp->addr.bdaddr, 3302 le_addr_type(cp->addr.type)); 3303 3304 if (conn) 3305 hci_conn_get(conn); 3306 3307 hci_dev_unlock(hdev); 3308 3309 if (!conn) 3310 return -ENOTCONN; 3311 3312 /* Disregard any possible error since the likes of hci_abort_conn_sync 3313 * will clean up the connection no matter the error. 3314 */ 3315 hci_abort_conn(conn, HCI_ERROR_REMOTE_USER_TERM); 3316 hci_conn_put(conn); 3317 3318 return 0; 3319 } 3320 3321 static int disconnect(struct sock *sk, struct hci_dev *hdev, void *data, 3322 u16 len) 3323 { 3324 struct mgmt_cp_disconnect *cp = data; 3325 struct mgmt_rp_disconnect rp; 3326 struct mgmt_pending_cmd *cmd; 3327 int err; 3328 3329 bt_dev_dbg(hdev, "sock %p", sk); 3330 3331 memset(&rp, 0, sizeof(rp)); 3332 bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr); 3333 rp.addr.type = cp->addr.type; 3334 3335 if (!bdaddr_type_is_valid(cp->addr.type)) 3336 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT, 3337 MGMT_STATUS_INVALID_PARAMS, 3338 &rp, sizeof(rp)); 3339 3340 hci_dev_lock(hdev); 3341 3342 if (!test_bit(HCI_UP, &hdev->flags)) { 3343 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_DISCONNECT, 3344 MGMT_STATUS_NOT_POWERED, &rp, 3345 sizeof(rp)); 3346 goto failed; 3347 } 3348 3349 cmd = mgmt_pending_new(sk, MGMT_OP_DISCONNECT, hdev, data, len); 3350 if (!cmd) { 3351 err = -ENOMEM; 3352 goto failed; 3353 } 3354 3355 cmd->cmd_complete = generic_cmd_complete; 3356 3357 err = hci_cmd_sync_queue(hdev, disconnect_sync, cmd, 3358 disconnect_complete); 3359 if (err < 0) 3360 mgmt_pending_free(cmd); 3361 3362 failed: 3363 hci_dev_unlock(hdev); 3364 return err; 3365 } 3366 3367 static u8 link_to_bdaddr(u8 link_type, u8 addr_type) 3368 { 3369 switch (link_type) { 3370 case CIS_LINK: 3371 case BIS_LINK: 3372 case PA_LINK: 3373 case LE_LINK: 3374 switch (addr_type) { 3375 case ADDR_LE_DEV_PUBLIC: 3376 return BDADDR_LE_PUBLIC; 3377 3378 default: 3379 /* Fallback to LE Random address type */ 3380 return BDADDR_LE_RANDOM; 3381 } 3382 3383 default: 3384 /* Fallback to BR/EDR type */ 3385 return BDADDR_BREDR; 3386 } 3387 } 3388 3389 static int get_connections(struct sock *sk, struct hci_dev *hdev, void *data, 3390 u16 data_len) 3391 { 3392 struct mgmt_rp_get_connections *rp; 3393 struct hci_conn *c; 3394 int err; 3395 u16 i; 3396 3397 bt_dev_dbg(hdev, "sock %p", sk); 3398 3399 hci_dev_lock(hdev); 3400 3401 if (!hdev_is_powered(hdev)) { 3402 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_CONNECTIONS, 3403 MGMT_STATUS_NOT_POWERED); 3404 goto unlock; 3405 } 3406 3407 i = 0; 3408 list_for_each_entry(c, &hdev->conn_hash.list, list) { 3409 if (test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags)) 3410 i++; 3411 } 3412 3413 rp = kmalloc_flex(*rp, addr, i); 3414 if (!rp) { 3415 err = -ENOMEM; 3416 goto unlock; 3417 } 3418 3419 i = 0; 3420 list_for_each_entry(c, &hdev->conn_hash.list, list) { 3421 if (!test_bit(HCI_CONN_MGMT_CONNECTED, &c->flags)) 3422 continue; 3423 bacpy(&rp->addr[i].bdaddr, &c->dst); 3424 rp->addr[i].type = link_to_bdaddr(c->type, c->dst_type); 3425 if (c->type == SCO_LINK || c->type == ESCO_LINK) 3426 continue; 3427 i++; 3428 } 3429 3430 rp->conn_count = cpu_to_le16(i); 3431 3432 /* Recalculate length in case of filtered SCO connections, etc */ 3433 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONNECTIONS, 0, rp, 3434 struct_size(rp, addr, i)); 3435 3436 kfree(rp); 3437 3438 unlock: 3439 hci_dev_unlock(hdev); 3440 return err; 3441 } 3442 3443 static int send_pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev, 3444 struct mgmt_cp_pin_code_neg_reply *cp) 3445 { 3446 struct mgmt_pending_cmd *cmd; 3447 int err; 3448 3449 cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_NEG_REPLY, hdev, cp, 3450 sizeof(*cp)); 3451 if (!cmd) 3452 return -ENOMEM; 3453 3454 cmd->cmd_complete = addr_cmd_complete; 3455 3456 err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_NEG_REPLY, 3457 sizeof(cp->addr.bdaddr), &cp->addr.bdaddr); 3458 if (err < 0) 3459 mgmt_pending_remove(cmd); 3460 3461 return err; 3462 } 3463 3464 static int pin_code_reply(struct sock *sk, struct hci_dev *hdev, void *data, 3465 u16 len) 3466 { 3467 struct hci_conn *conn; 3468 struct mgmt_cp_pin_code_reply *cp = data; 3469 struct hci_cp_pin_code_reply reply; 3470 struct mgmt_pending_cmd *cmd; 3471 int err; 3472 3473 bt_dev_dbg(hdev, "sock %p", sk); 3474 3475 hci_dev_lock(hdev); 3476 3477 if (!hdev_is_powered(hdev)) { 3478 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY, 3479 MGMT_STATUS_NOT_POWERED); 3480 goto failed; 3481 } 3482 3483 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->addr.bdaddr); 3484 if (!conn) { 3485 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY, 3486 MGMT_STATUS_NOT_CONNECTED); 3487 goto failed; 3488 } 3489 3490 if (conn->pending_sec_level == BT_SECURITY_HIGH && cp->pin_len != 16) { 3491 struct mgmt_cp_pin_code_neg_reply ncp; 3492 3493 memcpy(&ncp.addr, &cp->addr, sizeof(ncp.addr)); 3494 3495 bt_dev_err(hdev, "PIN code is not 16 bytes long"); 3496 3497 err = send_pin_code_neg_reply(sk, hdev, &ncp); 3498 if (err >= 0) 3499 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_PIN_CODE_REPLY, 3500 MGMT_STATUS_INVALID_PARAMS); 3501 3502 goto failed; 3503 } 3504 3505 cmd = mgmt_pending_add(sk, MGMT_OP_PIN_CODE_REPLY, hdev, data, len); 3506 if (!cmd) { 3507 err = -ENOMEM; 3508 goto failed; 3509 } 3510 3511 cmd->cmd_complete = addr_cmd_complete; 3512 3513 bacpy(&reply.bdaddr, &cp->addr.bdaddr); 3514 reply.pin_len = cp->pin_len; 3515 memcpy(reply.pin_code, cp->pin_code, sizeof(reply.pin_code)); 3516 3517 err = hci_send_cmd(hdev, HCI_OP_PIN_CODE_REPLY, sizeof(reply), &reply); 3518 if (err < 0) 3519 mgmt_pending_remove(cmd); 3520 3521 failed: 3522 hci_dev_unlock(hdev); 3523 return err; 3524 } 3525 3526 static int set_io_capability(struct sock *sk, struct hci_dev *hdev, void *data, 3527 u16 len) 3528 { 3529 struct mgmt_cp_set_io_capability *cp = data; 3530 3531 bt_dev_dbg(hdev, "sock %p", sk); 3532 3533 if (cp->io_capability > SMP_IO_KEYBOARD_DISPLAY) 3534 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_IO_CAPABILITY, 3535 MGMT_STATUS_INVALID_PARAMS); 3536 3537 hci_dev_lock(hdev); 3538 3539 hdev->io_capability = cp->io_capability; 3540 3541 bt_dev_dbg(hdev, "IO capability set to 0x%02x", hdev->io_capability); 3542 3543 hci_dev_unlock(hdev); 3544 3545 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_IO_CAPABILITY, 0, 3546 NULL, 0); 3547 } 3548 3549 static struct mgmt_pending_cmd *remove_pairing(struct hci_conn *conn) 3550 { 3551 struct hci_dev *hdev = conn->hdev; 3552 struct mgmt_pending_cmd *cmd; 3553 3554 mutex_lock(&hdev->mgmt_pending_lock); 3555 3556 list_for_each_entry(cmd, &hdev->mgmt_pending, list) { 3557 if (cmd->opcode != MGMT_OP_PAIR_DEVICE) 3558 continue; 3559 3560 if (cmd->user_data != conn) 3561 continue; 3562 3563 list_del(&cmd->list); 3564 mutex_unlock(&hdev->mgmt_pending_lock); 3565 return cmd; 3566 } 3567 3568 mutex_unlock(&hdev->mgmt_pending_lock); 3569 3570 return NULL; 3571 } 3572 3573 static struct mgmt_pending_cmd *remove_pairing_by_addr(struct hci_dev *hdev, 3574 bdaddr_t *bdaddr) 3575 { 3576 struct mgmt_pending_cmd *cmd; 3577 struct hci_conn *conn; 3578 3579 mutex_lock(&hdev->mgmt_pending_lock); 3580 3581 list_for_each_entry(cmd, &hdev->mgmt_pending, list) { 3582 if (cmd->opcode != MGMT_OP_PAIR_DEVICE) 3583 continue; 3584 3585 conn = cmd->user_data; 3586 if (bacmp(bdaddr, &conn->dst) != 0) 3587 continue; 3588 3589 list_del(&cmd->list); 3590 mutex_unlock(&hdev->mgmt_pending_lock); 3591 return cmd; 3592 } 3593 3594 mutex_unlock(&hdev->mgmt_pending_lock); 3595 3596 return NULL; 3597 } 3598 3599 static int pairing_complete(struct mgmt_pending_cmd *cmd, u8 status) 3600 { 3601 struct mgmt_rp_pair_device rp; 3602 struct hci_conn *conn = cmd->user_data; 3603 int err; 3604 3605 bacpy(&rp.addr.bdaddr, &conn->dst); 3606 rp.addr.type = link_to_bdaddr(conn->type, conn->dst_type); 3607 3608 err = mgmt_cmd_complete(cmd->sk, cmd->hdev->id, MGMT_OP_PAIR_DEVICE, 3609 status, &rp, sizeof(rp)); 3610 3611 /* So we don't get further callbacks for this connection */ 3612 conn->connect_cfm_cb = NULL; 3613 conn->security_cfm_cb = NULL; 3614 conn->disconn_cfm_cb = NULL; 3615 3616 hci_conn_drop(conn); 3617 3618 /* The device is paired so there is no need to remove 3619 * its connection parameters anymore. 3620 */ 3621 clear_bit(HCI_CONN_PARAM_REMOVAL_PEND, &conn->flags); 3622 3623 hci_conn_put(conn); 3624 3625 return err; 3626 } 3627 3628 void mgmt_smp_complete(struct hci_conn *conn, bool complete) 3629 { 3630 u8 status = complete ? MGMT_STATUS_SUCCESS : MGMT_STATUS_FAILED; 3631 struct mgmt_pending_cmd *cmd; 3632 3633 cmd = remove_pairing(conn); 3634 if (cmd) { 3635 cmd->cmd_complete(cmd, status); 3636 mgmt_pending_free(cmd); 3637 } 3638 } 3639 3640 static void pairing_complete_cb(struct hci_conn *conn, u8 status) 3641 { 3642 struct mgmt_pending_cmd *cmd; 3643 3644 BT_DBG("status %u", status); 3645 3646 cmd = remove_pairing(conn); 3647 if (!cmd) { 3648 BT_DBG("Unable to find a pending command"); 3649 return; 3650 } 3651 3652 cmd->cmd_complete(cmd, mgmt_status(status)); 3653 mgmt_pending_free(cmd); 3654 } 3655 3656 static void le_pairing_complete_cb(struct hci_conn *conn, u8 status) 3657 { 3658 struct mgmt_pending_cmd *cmd; 3659 3660 BT_DBG("status %u", status); 3661 3662 if (!status) 3663 return; 3664 3665 cmd = remove_pairing(conn); 3666 if (!cmd) { 3667 BT_DBG("Unable to find a pending command"); 3668 return; 3669 } 3670 3671 cmd->cmd_complete(cmd, mgmt_status(status)); 3672 mgmt_pending_free(cmd); 3673 } 3674 3675 static int pair_device(struct sock *sk, struct hci_dev *hdev, void *data, 3676 u16 len) 3677 { 3678 struct mgmt_cp_pair_device *cp = data; 3679 struct mgmt_rp_pair_device rp; 3680 struct mgmt_pending_cmd *cmd; 3681 u8 sec_level, auth_type; 3682 struct hci_conn *conn; 3683 int err; 3684 3685 bt_dev_dbg(hdev, "sock %p", sk); 3686 3687 memset(&rp, 0, sizeof(rp)); 3688 bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr); 3689 rp.addr.type = cp->addr.type; 3690 3691 if (!bdaddr_type_is_valid(cp->addr.type)) 3692 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE, 3693 MGMT_STATUS_INVALID_PARAMS, 3694 &rp, sizeof(rp)); 3695 3696 if (cp->io_cap > SMP_IO_KEYBOARD_DISPLAY) 3697 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE, 3698 MGMT_STATUS_INVALID_PARAMS, 3699 &rp, sizeof(rp)); 3700 3701 hci_dev_lock(hdev); 3702 3703 if (!hdev_is_powered(hdev)) { 3704 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE, 3705 MGMT_STATUS_NOT_POWERED, &rp, 3706 sizeof(rp)); 3707 goto unlock; 3708 } 3709 3710 if (hci_bdaddr_is_paired(hdev, &cp->addr.bdaddr, cp->addr.type)) { 3711 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE, 3712 MGMT_STATUS_ALREADY_PAIRED, &rp, 3713 sizeof(rp)); 3714 goto unlock; 3715 } 3716 3717 sec_level = BT_SECURITY_MEDIUM; 3718 auth_type = HCI_AT_DEDICATED_BONDING; 3719 3720 if (cp->addr.type == BDADDR_BREDR) { 3721 conn = hci_connect_acl(hdev, &cp->addr.bdaddr, sec_level, 3722 auth_type, CONN_REASON_PAIR_DEVICE, 3723 HCI_ACL_CONN_TIMEOUT); 3724 } else { 3725 u8 addr_type = le_addr_type(cp->addr.type); 3726 struct hci_conn_params *p; 3727 3728 /* When pairing a new device, it is expected to remember 3729 * this device for future connections. Adding the connection 3730 * parameter information ahead of time allows tracking 3731 * of the peripheral preferred values and will speed up any 3732 * further connection establishment. 3733 * 3734 * If connection parameters already exist, then they 3735 * will be kept and this function does nothing. 3736 */ 3737 p = hci_conn_params_add(hdev, &cp->addr.bdaddr, addr_type); 3738 if (!p) { 3739 err = -EIO; 3740 goto unlock; 3741 } 3742 3743 if (p->auto_connect == HCI_AUTO_CONN_EXPLICIT) 3744 p->auto_connect = HCI_AUTO_CONN_DISABLED; 3745 3746 conn = hci_connect_le_scan(hdev, &cp->addr.bdaddr, addr_type, 3747 sec_level, HCI_LE_CONN_TIMEOUT, 3748 CONN_REASON_PAIR_DEVICE); 3749 } 3750 3751 if (IS_ERR(conn)) { 3752 int status; 3753 3754 if (PTR_ERR(conn) == -EBUSY) 3755 status = MGMT_STATUS_BUSY; 3756 else if (PTR_ERR(conn) == -EOPNOTSUPP) 3757 status = MGMT_STATUS_NOT_SUPPORTED; 3758 else if (PTR_ERR(conn) == -ECONNREFUSED) 3759 status = MGMT_STATUS_REJECTED; 3760 else 3761 status = MGMT_STATUS_CONNECT_FAILED; 3762 3763 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE, 3764 status, &rp, sizeof(rp)); 3765 goto unlock; 3766 } 3767 3768 if (conn->connect_cfm_cb) { 3769 hci_conn_drop(conn); 3770 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_PAIR_DEVICE, 3771 MGMT_STATUS_BUSY, &rp, sizeof(rp)); 3772 goto unlock; 3773 } 3774 3775 cmd = mgmt_pending_add(sk, MGMT_OP_PAIR_DEVICE, hdev, data, len); 3776 if (!cmd) { 3777 err = -ENOMEM; 3778 hci_conn_drop(conn); 3779 goto unlock; 3780 } 3781 3782 cmd->cmd_complete = pairing_complete; 3783 3784 /* For LE, just connecting isn't a proof that the pairing finished */ 3785 if (cp->addr.type == BDADDR_BREDR) { 3786 conn->connect_cfm_cb = pairing_complete_cb; 3787 conn->security_cfm_cb = pairing_complete_cb; 3788 conn->disconn_cfm_cb = pairing_complete_cb; 3789 } else { 3790 conn->connect_cfm_cb = le_pairing_complete_cb; 3791 conn->security_cfm_cb = le_pairing_complete_cb; 3792 conn->disconn_cfm_cb = le_pairing_complete_cb; 3793 } 3794 3795 conn->io_capability = cp->io_cap; 3796 cmd->user_data = hci_conn_get(conn); 3797 3798 if ((conn->state == BT_CONNECTED || conn->state == BT_CONFIG) && 3799 hci_conn_security(conn, sec_level, auth_type, true)) { 3800 cmd->cmd_complete(cmd, 0); 3801 mgmt_pending_remove(cmd); 3802 } 3803 3804 err = 0; 3805 3806 unlock: 3807 hci_dev_unlock(hdev); 3808 return err; 3809 } 3810 3811 static int cancel_pair_device(struct sock *sk, struct hci_dev *hdev, void *data, 3812 u16 len) 3813 { 3814 struct mgmt_addr_info *addr = data; 3815 struct mgmt_pending_cmd *cmd; 3816 struct hci_conn *conn; 3817 int err; 3818 3819 bt_dev_dbg(hdev, "sock %p", sk); 3820 3821 hci_dev_lock(hdev); 3822 3823 if (!hdev_is_powered(hdev)) { 3824 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE, 3825 MGMT_STATUS_NOT_POWERED); 3826 goto unlock; 3827 } 3828 3829 cmd = remove_pairing_by_addr(hdev, &addr->bdaddr); 3830 if (!cmd) { 3831 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE, 3832 MGMT_STATUS_INVALID_PARAMS); 3833 goto unlock; 3834 } 3835 3836 conn = hci_conn_get(cmd->user_data); 3837 3838 cmd->cmd_complete(cmd, MGMT_STATUS_CANCELLED); 3839 mgmt_pending_free(cmd); 3840 3841 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE, 0, 3842 addr, sizeof(*addr)); 3843 3844 /* Since user doesn't want to proceed with the connection, abort any 3845 * ongoing pairing and then terminate the link if it was created 3846 * because of the pair device action. 3847 */ 3848 if (addr->type == BDADDR_BREDR) 3849 hci_remove_link_key(hdev, &addr->bdaddr); 3850 else 3851 smp_cancel_and_remove_pairing(hdev, &addr->bdaddr, 3852 le_addr_type(addr->type)); 3853 3854 if (conn->conn_reason == CONN_REASON_PAIR_DEVICE) 3855 hci_abort_conn(conn, HCI_ERROR_REMOTE_USER_TERM); 3856 3857 hci_conn_put(conn); 3858 3859 unlock: 3860 hci_dev_unlock(hdev); 3861 return err; 3862 } 3863 3864 static int user_pairing_resp(struct sock *sk, struct hci_dev *hdev, 3865 struct mgmt_addr_info *addr, u16 mgmt_op, 3866 u16 hci_op, __le32 passkey) 3867 { 3868 struct mgmt_pending_cmd *cmd; 3869 struct hci_conn *conn; 3870 int err; 3871 3872 hci_dev_lock(hdev); 3873 3874 if (!hdev_is_powered(hdev)) { 3875 err = mgmt_cmd_complete(sk, hdev->id, mgmt_op, 3876 MGMT_STATUS_NOT_POWERED, addr, 3877 sizeof(*addr)); 3878 goto done; 3879 } 3880 3881 if (addr->type == BDADDR_BREDR) 3882 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &addr->bdaddr); 3883 else 3884 conn = hci_conn_hash_lookup_le(hdev, &addr->bdaddr, 3885 le_addr_type(addr->type)); 3886 3887 if (!conn) { 3888 err = mgmt_cmd_complete(sk, hdev->id, mgmt_op, 3889 MGMT_STATUS_NOT_CONNECTED, addr, 3890 sizeof(*addr)); 3891 goto done; 3892 } 3893 3894 if (addr->type == BDADDR_LE_PUBLIC || addr->type == BDADDR_LE_RANDOM) { 3895 lockdep_assert_held(&conn->hdev->lock); 3896 3897 err = smp_user_confirm_reply(conn, mgmt_op, passkey); 3898 if (!err) 3899 err = mgmt_cmd_complete(sk, hdev->id, mgmt_op, 3900 MGMT_STATUS_SUCCESS, addr, 3901 sizeof(*addr)); 3902 else 3903 err = mgmt_cmd_complete(sk, hdev->id, mgmt_op, 3904 MGMT_STATUS_FAILED, addr, 3905 sizeof(*addr)); 3906 3907 goto done; 3908 } 3909 3910 cmd = mgmt_pending_add(sk, mgmt_op, hdev, addr, sizeof(*addr)); 3911 if (!cmd) { 3912 err = -ENOMEM; 3913 goto done; 3914 } 3915 3916 cmd->cmd_complete = addr_cmd_complete; 3917 3918 /* Continue with pairing via HCI */ 3919 if (hci_op == HCI_OP_USER_PASSKEY_REPLY) { 3920 struct hci_cp_user_passkey_reply cp; 3921 3922 bacpy(&cp.bdaddr, &addr->bdaddr); 3923 cp.passkey = passkey; 3924 err = hci_send_cmd(hdev, hci_op, sizeof(cp), &cp); 3925 } else 3926 err = hci_send_cmd(hdev, hci_op, sizeof(addr->bdaddr), 3927 &addr->bdaddr); 3928 3929 if (err < 0) 3930 mgmt_pending_remove(cmd); 3931 3932 done: 3933 hci_dev_unlock(hdev); 3934 return err; 3935 } 3936 3937 static int pin_code_neg_reply(struct sock *sk, struct hci_dev *hdev, 3938 void *data, u16 len) 3939 { 3940 struct mgmt_cp_pin_code_neg_reply *cp = data; 3941 3942 bt_dev_dbg(hdev, "sock %p", sk); 3943 3944 return user_pairing_resp(sk, hdev, &cp->addr, 3945 MGMT_OP_PIN_CODE_NEG_REPLY, 3946 HCI_OP_PIN_CODE_NEG_REPLY, 0); 3947 } 3948 3949 static int user_confirm_reply(struct sock *sk, struct hci_dev *hdev, void *data, 3950 u16 len) 3951 { 3952 struct mgmt_cp_user_confirm_reply *cp = data; 3953 3954 bt_dev_dbg(hdev, "sock %p", sk); 3955 3956 if (len != sizeof(*cp)) 3957 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_USER_CONFIRM_REPLY, 3958 MGMT_STATUS_INVALID_PARAMS); 3959 3960 return user_pairing_resp(sk, hdev, &cp->addr, 3961 MGMT_OP_USER_CONFIRM_REPLY, 3962 HCI_OP_USER_CONFIRM_REPLY, 0); 3963 } 3964 3965 static int user_confirm_neg_reply(struct sock *sk, struct hci_dev *hdev, 3966 void *data, u16 len) 3967 { 3968 struct mgmt_cp_user_confirm_neg_reply *cp = data; 3969 3970 bt_dev_dbg(hdev, "sock %p", sk); 3971 3972 return user_pairing_resp(sk, hdev, &cp->addr, 3973 MGMT_OP_USER_CONFIRM_NEG_REPLY, 3974 HCI_OP_USER_CONFIRM_NEG_REPLY, 0); 3975 } 3976 3977 static int user_passkey_reply(struct sock *sk, struct hci_dev *hdev, void *data, 3978 u16 len) 3979 { 3980 struct mgmt_cp_user_passkey_reply *cp = data; 3981 3982 bt_dev_dbg(hdev, "sock %p", sk); 3983 3984 return user_pairing_resp(sk, hdev, &cp->addr, 3985 MGMT_OP_USER_PASSKEY_REPLY, 3986 HCI_OP_USER_PASSKEY_REPLY, cp->passkey); 3987 } 3988 3989 static int user_passkey_neg_reply(struct sock *sk, struct hci_dev *hdev, 3990 void *data, u16 len) 3991 { 3992 struct mgmt_cp_user_passkey_neg_reply *cp = data; 3993 3994 bt_dev_dbg(hdev, "sock %p", sk); 3995 3996 return user_pairing_resp(sk, hdev, &cp->addr, 3997 MGMT_OP_USER_PASSKEY_NEG_REPLY, 3998 HCI_OP_USER_PASSKEY_NEG_REPLY, 0); 3999 } 4000 4001 static int adv_expire_sync(struct hci_dev *hdev, u32 flags) 4002 { 4003 struct adv_info *adv_instance; 4004 4005 adv_instance = hci_find_adv_instance(hdev, hdev->cur_adv_instance); 4006 if (!adv_instance) 4007 return 0; 4008 4009 /* stop if current instance doesn't need to be changed */ 4010 if (!(adv_instance->flags & flags)) 4011 return 0; 4012 4013 cancel_adv_timeout(hdev); 4014 4015 adv_instance = hci_get_next_instance(hdev, adv_instance->instance); 4016 if (!adv_instance) 4017 return 0; 4018 4019 hci_schedule_adv_instance_sync(hdev, adv_instance->instance, true); 4020 4021 return 0; 4022 } 4023 4024 static int name_changed_sync(struct hci_dev *hdev, void *data) 4025 { 4026 return adv_expire_sync(hdev, MGMT_ADV_FLAG_LOCAL_NAME); 4027 } 4028 4029 static void set_name_complete(struct hci_dev *hdev, void *data, int err) 4030 { 4031 struct mgmt_pending_cmd *cmd = data; 4032 struct mgmt_cp_set_local_name *cp; 4033 u8 status = mgmt_status(err); 4034 4035 bt_dev_dbg(hdev, "err %d", err); 4036 4037 if (err == -ECANCELED || !mgmt_pending_valid(hdev, cmd)) 4038 return; 4039 4040 cp = cmd->param; 4041 4042 if (status) { 4043 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 4044 status); 4045 } else { 4046 mgmt_cmd_complete(cmd->sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0, 4047 cp, sizeof(*cp)); 4048 4049 if (hci_dev_test_flag(hdev, HCI_LE_ADV)) 4050 hci_cmd_sync_queue(hdev, name_changed_sync, NULL, NULL); 4051 } 4052 4053 mgmt_pending_free(cmd); 4054 } 4055 4056 static int set_name_sync(struct hci_dev *hdev, void *data) 4057 { 4058 struct mgmt_pending_cmd *cmd = data; 4059 struct mgmt_cp_set_local_name cp; 4060 4061 mutex_lock(&hdev->mgmt_pending_lock); 4062 4063 if (!__mgmt_pending_listed(hdev, cmd)) { 4064 mutex_unlock(&hdev->mgmt_pending_lock); 4065 return -ECANCELED; 4066 } 4067 4068 memcpy(&cp, cmd->param, sizeof(cp)); 4069 4070 mutex_unlock(&hdev->mgmt_pending_lock); 4071 4072 if (lmp_bredr_capable(hdev)) { 4073 hci_update_name_sync(hdev, cp.name); 4074 hci_update_eir_sync(hdev); 4075 } 4076 4077 /* The name is stored in the scan response data and so 4078 * no need to update the advertising data here. 4079 */ 4080 if (lmp_le_capable(hdev) && hci_dev_test_flag(hdev, HCI_ADVERTISING)) 4081 hci_update_scan_rsp_data_sync(hdev, hdev->cur_adv_instance); 4082 4083 return 0; 4084 } 4085 4086 static int set_local_name(struct sock *sk, struct hci_dev *hdev, void *data, 4087 u16 len) 4088 { 4089 struct mgmt_cp_set_local_name *cp = data; 4090 struct mgmt_pending_cmd *cmd; 4091 int err; 4092 4093 bt_dev_dbg(hdev, "sock %p", sk); 4094 4095 hci_dev_lock(hdev); 4096 4097 /* If the old values are the same as the new ones just return a 4098 * direct command complete event. 4099 */ 4100 if (!memcmp(hdev->dev_name, cp->name, sizeof(hdev->dev_name)) && 4101 !memcmp(hdev->short_name, cp->short_name, 4102 sizeof(hdev->short_name))) { 4103 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0, 4104 data, len); 4105 goto failed; 4106 } 4107 4108 if (hdev_is_powered(hdev) && pending_eir_or_class(hdev)) { 4109 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 4110 MGMT_STATUS_BUSY); 4111 goto failed; 4112 } 4113 4114 memcpy(hdev->short_name, cp->short_name, sizeof(hdev->short_name)); 4115 4116 if (!hdev_is_powered(hdev)) { 4117 memcpy(hdev->dev_name, cp->name, sizeof(hdev->dev_name)); 4118 4119 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 0, 4120 data, len); 4121 if (err < 0) 4122 goto failed; 4123 4124 err = mgmt_limited_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, data, 4125 len, HCI_MGMT_LOCAL_NAME_EVENTS, sk); 4126 ext_info_changed(hdev, sk); 4127 4128 goto failed; 4129 } 4130 4131 cmd = mgmt_pending_add(sk, MGMT_OP_SET_LOCAL_NAME, hdev, data, len); 4132 if (!cmd) 4133 err = -ENOMEM; 4134 else 4135 err = hci_cmd_sync_queue(hdev, set_name_sync, cmd, 4136 set_name_complete); 4137 4138 if (err < 0) { 4139 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_LOCAL_NAME, 4140 MGMT_STATUS_FAILED); 4141 4142 if (cmd) 4143 mgmt_pending_remove(cmd); 4144 4145 goto failed; 4146 } 4147 4148 memcpy(hdev->dev_name, cp->name, sizeof(hdev->dev_name)); 4149 4150 failed: 4151 hci_dev_unlock(hdev); 4152 return err; 4153 } 4154 4155 static int appearance_changed_sync(struct hci_dev *hdev, void *data) 4156 { 4157 return adv_expire_sync(hdev, MGMT_ADV_FLAG_APPEARANCE); 4158 } 4159 4160 static int set_appearance(struct sock *sk, struct hci_dev *hdev, void *data, 4161 u16 len) 4162 { 4163 struct mgmt_cp_set_appearance *cp = data; 4164 u16 appearance; 4165 int err; 4166 4167 bt_dev_dbg(hdev, "sock %p", sk); 4168 4169 if (!lmp_le_capable(hdev)) 4170 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_APPEARANCE, 4171 MGMT_STATUS_NOT_SUPPORTED); 4172 4173 appearance = le16_to_cpu(cp->appearance); 4174 4175 hci_dev_lock(hdev); 4176 4177 if (hdev->appearance != appearance) { 4178 hdev->appearance = appearance; 4179 4180 if (hci_dev_test_flag(hdev, HCI_LE_ADV)) 4181 hci_cmd_sync_queue(hdev, appearance_changed_sync, NULL, 4182 NULL); 4183 4184 ext_info_changed(hdev, sk); 4185 } 4186 4187 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_APPEARANCE, 0, NULL, 4188 0); 4189 4190 hci_dev_unlock(hdev); 4191 4192 return err; 4193 } 4194 4195 static int get_phy_configuration(struct sock *sk, struct hci_dev *hdev, 4196 void *data, u16 len) 4197 { 4198 struct mgmt_rp_get_phy_configuration rp; 4199 4200 bt_dev_dbg(hdev, "sock %p", sk); 4201 4202 hci_dev_lock(hdev); 4203 4204 memset(&rp, 0, sizeof(rp)); 4205 4206 rp.supported_phys = cpu_to_le32(get_supported_phys(hdev)); 4207 rp.selected_phys = cpu_to_le32(get_selected_phys(hdev)); 4208 rp.configurable_phys = cpu_to_le32(get_configurable_phys(hdev)); 4209 4210 hci_dev_unlock(hdev); 4211 4212 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_PHY_CONFIGURATION, 0, 4213 &rp, sizeof(rp)); 4214 } 4215 4216 int mgmt_phy_configuration_changed(struct hci_dev *hdev, struct sock *skip) 4217 { 4218 struct mgmt_ev_phy_configuration_changed ev; 4219 4220 memset(&ev, 0, sizeof(ev)); 4221 4222 ev.selected_phys = cpu_to_le32(get_selected_phys(hdev)); 4223 4224 return mgmt_event(MGMT_EV_PHY_CONFIGURATION_CHANGED, hdev, &ev, 4225 sizeof(ev), skip); 4226 } 4227 4228 static void set_default_phy_complete(struct hci_dev *hdev, void *data, int err) 4229 { 4230 struct mgmt_pending_cmd *cmd = data; 4231 struct sk_buff *skb; 4232 u8 status = mgmt_status(err); 4233 4234 skb = cmd->skb; 4235 4236 if (!status) { 4237 if (!skb) 4238 status = MGMT_STATUS_FAILED; 4239 else if (IS_ERR(skb)) 4240 status = mgmt_status(PTR_ERR(skb)); 4241 else 4242 status = mgmt_status(skb->data[0]); 4243 } 4244 4245 bt_dev_dbg(hdev, "status %d", status); 4246 4247 if (status) { 4248 mgmt_cmd_status(cmd->sk, hdev->id, 4249 MGMT_OP_SET_PHY_CONFIGURATION, status); 4250 } else { 4251 mgmt_cmd_complete(cmd->sk, hdev->id, 4252 MGMT_OP_SET_PHY_CONFIGURATION, 0, 4253 NULL, 0); 4254 4255 mgmt_phy_configuration_changed(hdev, cmd->sk); 4256 } 4257 4258 if (skb && !IS_ERR(skb)) 4259 kfree_skb(skb); 4260 4261 mgmt_pending_free(cmd); 4262 } 4263 4264 static int set_default_phy_sync(struct hci_dev *hdev, void *data) 4265 { 4266 struct mgmt_pending_cmd *cmd = data; 4267 struct mgmt_cp_set_phy_configuration *cp = cmd->param; 4268 struct hci_cp_le_set_default_phy cp_phy; 4269 u32 selected_phys; 4270 4271 selected_phys = __le32_to_cpu(cp->selected_phys); 4272 4273 memset(&cp_phy, 0, sizeof(cp_phy)); 4274 4275 if (!(selected_phys & MGMT_PHY_LE_TX_MASK)) 4276 cp_phy.all_phys |= 0x01; 4277 4278 if (!(selected_phys & MGMT_PHY_LE_RX_MASK)) 4279 cp_phy.all_phys |= 0x02; 4280 4281 if (selected_phys & MGMT_PHY_LE_1M_TX) 4282 cp_phy.tx_phys |= HCI_LE_SET_PHY_1M; 4283 4284 if (selected_phys & MGMT_PHY_LE_2M_TX) 4285 cp_phy.tx_phys |= HCI_LE_SET_PHY_2M; 4286 4287 if (selected_phys & MGMT_PHY_LE_CODED_TX) 4288 cp_phy.tx_phys |= HCI_LE_SET_PHY_CODED; 4289 4290 if (selected_phys & MGMT_PHY_LE_1M_RX) 4291 cp_phy.rx_phys |= HCI_LE_SET_PHY_1M; 4292 4293 if (selected_phys & MGMT_PHY_LE_2M_RX) 4294 cp_phy.rx_phys |= HCI_LE_SET_PHY_2M; 4295 4296 if (selected_phys & MGMT_PHY_LE_CODED_RX) 4297 cp_phy.rx_phys |= HCI_LE_SET_PHY_CODED; 4298 4299 cmd->skb = __hci_cmd_sync(hdev, HCI_OP_LE_SET_DEFAULT_PHY, 4300 sizeof(cp_phy), &cp_phy, HCI_CMD_TIMEOUT); 4301 4302 return 0; 4303 } 4304 4305 static int set_phy_configuration(struct sock *sk, struct hci_dev *hdev, 4306 void *data, u16 len) 4307 { 4308 struct mgmt_cp_set_phy_configuration *cp = data; 4309 struct mgmt_pending_cmd *cmd; 4310 u32 selected_phys, configurable_phys, supported_phys, unconfigure_phys; 4311 u16 pkt_type = (HCI_DH1 | HCI_DM1); 4312 bool changed = false; 4313 int err; 4314 4315 bt_dev_dbg(hdev, "sock %p", sk); 4316 4317 configurable_phys = get_configurable_phys(hdev); 4318 supported_phys = get_supported_phys(hdev); 4319 selected_phys = __le32_to_cpu(cp->selected_phys); 4320 4321 if (selected_phys & ~supported_phys) 4322 return mgmt_cmd_status(sk, hdev->id, 4323 MGMT_OP_SET_PHY_CONFIGURATION, 4324 MGMT_STATUS_INVALID_PARAMS); 4325 4326 unconfigure_phys = supported_phys & ~configurable_phys; 4327 4328 if ((selected_phys & unconfigure_phys) != unconfigure_phys) 4329 return mgmt_cmd_status(sk, hdev->id, 4330 MGMT_OP_SET_PHY_CONFIGURATION, 4331 MGMT_STATUS_INVALID_PARAMS); 4332 4333 if (selected_phys == get_selected_phys(hdev)) 4334 return mgmt_cmd_complete(sk, hdev->id, 4335 MGMT_OP_SET_PHY_CONFIGURATION, 4336 0, NULL, 0); 4337 4338 hci_dev_lock(hdev); 4339 4340 if (!hdev_is_powered(hdev)) { 4341 err = mgmt_cmd_status(sk, hdev->id, 4342 MGMT_OP_SET_PHY_CONFIGURATION, 4343 MGMT_STATUS_REJECTED); 4344 goto unlock; 4345 } 4346 4347 if (pending_find(MGMT_OP_SET_PHY_CONFIGURATION, hdev)) { 4348 err = mgmt_cmd_status(sk, hdev->id, 4349 MGMT_OP_SET_PHY_CONFIGURATION, 4350 MGMT_STATUS_BUSY); 4351 goto unlock; 4352 } 4353 4354 if (selected_phys & MGMT_PHY_BR_1M_3SLOT) 4355 pkt_type |= (HCI_DH3 | HCI_DM3); 4356 else 4357 pkt_type &= ~(HCI_DH3 | HCI_DM3); 4358 4359 if (selected_phys & MGMT_PHY_BR_1M_5SLOT) 4360 pkt_type |= (HCI_DH5 | HCI_DM5); 4361 else 4362 pkt_type &= ~(HCI_DH5 | HCI_DM5); 4363 4364 if (selected_phys & MGMT_PHY_EDR_2M_1SLOT) 4365 pkt_type &= ~HCI_2DH1; 4366 else 4367 pkt_type |= HCI_2DH1; 4368 4369 if (selected_phys & MGMT_PHY_EDR_2M_3SLOT) 4370 pkt_type &= ~HCI_2DH3; 4371 else 4372 pkt_type |= HCI_2DH3; 4373 4374 if (selected_phys & MGMT_PHY_EDR_2M_5SLOT) 4375 pkt_type &= ~HCI_2DH5; 4376 else 4377 pkt_type |= HCI_2DH5; 4378 4379 if (selected_phys & MGMT_PHY_EDR_3M_1SLOT) 4380 pkt_type &= ~HCI_3DH1; 4381 else 4382 pkt_type |= HCI_3DH1; 4383 4384 if (selected_phys & MGMT_PHY_EDR_3M_3SLOT) 4385 pkt_type &= ~HCI_3DH3; 4386 else 4387 pkt_type |= HCI_3DH3; 4388 4389 if (selected_phys & MGMT_PHY_EDR_3M_5SLOT) 4390 pkt_type &= ~HCI_3DH5; 4391 else 4392 pkt_type |= HCI_3DH5; 4393 4394 if (pkt_type != hdev->pkt_type) { 4395 hdev->pkt_type = pkt_type; 4396 changed = true; 4397 } 4398 4399 if ((selected_phys & MGMT_PHY_LE_MASK) == 4400 (get_selected_phys(hdev) & MGMT_PHY_LE_MASK)) { 4401 if (changed) 4402 mgmt_phy_configuration_changed(hdev, sk); 4403 4404 err = mgmt_cmd_complete(sk, hdev->id, 4405 MGMT_OP_SET_PHY_CONFIGURATION, 4406 0, NULL, 0); 4407 4408 goto unlock; 4409 } 4410 4411 cmd = mgmt_pending_new(sk, MGMT_OP_SET_PHY_CONFIGURATION, hdev, data, 4412 len); 4413 if (!cmd) 4414 err = -ENOMEM; 4415 else 4416 err = hci_cmd_sync_queue(hdev, set_default_phy_sync, cmd, 4417 set_default_phy_complete); 4418 4419 if (err < 0) { 4420 err = mgmt_cmd_status(sk, hdev->id, 4421 MGMT_OP_SET_PHY_CONFIGURATION, 4422 MGMT_STATUS_FAILED); 4423 4424 if (cmd) 4425 mgmt_pending_remove(cmd); 4426 } 4427 4428 unlock: 4429 hci_dev_unlock(hdev); 4430 4431 return err; 4432 } 4433 4434 static int set_blocked_keys(struct sock *sk, struct hci_dev *hdev, void *data, 4435 u16 len) 4436 { 4437 int err = MGMT_STATUS_SUCCESS; 4438 struct mgmt_cp_set_blocked_keys *keys = data; 4439 const u16 max_key_count = ((U16_MAX - sizeof(*keys)) / 4440 sizeof(struct mgmt_blocked_key_info)); 4441 u16 key_count, expected_len; 4442 int i; 4443 4444 bt_dev_dbg(hdev, "sock %p", sk); 4445 4446 key_count = __le16_to_cpu(keys->key_count); 4447 if (key_count > max_key_count) { 4448 bt_dev_err(hdev, "too big key_count value %u", key_count); 4449 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BLOCKED_KEYS, 4450 MGMT_STATUS_INVALID_PARAMS); 4451 } 4452 4453 expected_len = struct_size(keys, keys, key_count); 4454 if (expected_len != len) { 4455 bt_dev_err(hdev, "expected %u bytes, got %u bytes", 4456 expected_len, len); 4457 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BLOCKED_KEYS, 4458 MGMT_STATUS_INVALID_PARAMS); 4459 } 4460 4461 hci_dev_lock(hdev); 4462 4463 hci_blocked_keys_clear(hdev); 4464 4465 for (i = 0; i < key_count; ++i) { 4466 struct blocked_key *b = kzalloc_obj(*b); 4467 4468 if (!b) { 4469 err = MGMT_STATUS_NO_RESOURCES; 4470 break; 4471 } 4472 4473 b->type = keys->keys[i].type; 4474 memcpy(b->val, keys->keys[i].val, sizeof(b->val)); 4475 list_add_rcu(&b->list, &hdev->blocked_keys); 4476 } 4477 hci_dev_unlock(hdev); 4478 4479 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_BLOCKED_KEYS, 4480 err, NULL, 0); 4481 } 4482 4483 static int set_wideband_speech(struct sock *sk, struct hci_dev *hdev, 4484 void *data, u16 len) 4485 { 4486 struct mgmt_mode *cp = data; 4487 int err; 4488 bool changed = false; 4489 4490 bt_dev_dbg(hdev, "sock %p", sk); 4491 4492 if (!hci_test_quirk(hdev, HCI_QUIRK_WIDEBAND_SPEECH_SUPPORTED)) 4493 return mgmt_cmd_status(sk, hdev->id, 4494 MGMT_OP_SET_WIDEBAND_SPEECH, 4495 MGMT_STATUS_NOT_SUPPORTED); 4496 4497 if (cp->val != 0x00 && cp->val != 0x01) 4498 return mgmt_cmd_status(sk, hdev->id, 4499 MGMT_OP_SET_WIDEBAND_SPEECH, 4500 MGMT_STATUS_INVALID_PARAMS); 4501 4502 hci_dev_lock(hdev); 4503 4504 if (hdev_is_powered(hdev) && 4505 !!cp->val != hci_dev_test_flag(hdev, 4506 HCI_WIDEBAND_SPEECH_ENABLED)) { 4507 err = mgmt_cmd_status(sk, hdev->id, 4508 MGMT_OP_SET_WIDEBAND_SPEECH, 4509 MGMT_STATUS_REJECTED); 4510 goto unlock; 4511 } 4512 4513 if (cp->val) 4514 changed = !hci_dev_test_and_set_flag(hdev, 4515 HCI_WIDEBAND_SPEECH_ENABLED); 4516 else 4517 changed = hci_dev_test_and_clear_flag(hdev, 4518 HCI_WIDEBAND_SPEECH_ENABLED); 4519 4520 err = send_settings_rsp(sk, MGMT_OP_SET_WIDEBAND_SPEECH, hdev); 4521 if (err < 0) 4522 goto unlock; 4523 4524 if (changed) 4525 err = new_settings(hdev, sk); 4526 4527 unlock: 4528 hci_dev_unlock(hdev); 4529 return err; 4530 } 4531 4532 static int read_controller_cap(struct sock *sk, struct hci_dev *hdev, 4533 void *data, u16 data_len) 4534 { 4535 char buf[20]; 4536 struct mgmt_rp_read_controller_cap *rp = (void *)buf; 4537 u16 cap_len = 0; 4538 u8 flags = 0; 4539 u8 tx_power_range[2]; 4540 4541 bt_dev_dbg(hdev, "sock %p", sk); 4542 4543 memset(&buf, 0, sizeof(buf)); 4544 4545 hci_dev_lock(hdev); 4546 4547 /* When the Read Simple Pairing Options command is supported, then 4548 * the remote public key validation is supported. 4549 * 4550 * Alternatively, when Microsoft extensions are available, they can 4551 * indicate support for public key validation as well. 4552 */ 4553 if ((hdev->commands[41] & 0x08) || msft_curve_validity(hdev)) 4554 flags |= 0x01; /* Remote public key validation (BR/EDR) */ 4555 4556 flags |= 0x02; /* Remote public key validation (LE) */ 4557 4558 /* When the Read Encryption Key Size command is supported, then the 4559 * encryption key size is enforced. 4560 */ 4561 if (hdev->commands[20] & 0x10) 4562 flags |= 0x04; /* Encryption key size enforcement (BR/EDR) */ 4563 4564 flags |= 0x08; /* Encryption key size enforcement (LE) */ 4565 4566 cap_len = eir_append_data(rp->cap, cap_len, MGMT_CAP_SEC_FLAGS, 4567 &flags, 1); 4568 4569 /* When the Read Simple Pairing Options command is supported, then 4570 * also max encryption key size information is provided. 4571 */ 4572 if (hdev->commands[41] & 0x08) 4573 cap_len = eir_append_le16(rp->cap, cap_len, 4574 MGMT_CAP_MAX_ENC_KEY_SIZE, 4575 hdev->max_enc_key_size); 4576 4577 cap_len = eir_append_le16(rp->cap, cap_len, 4578 MGMT_CAP_SMP_MAX_ENC_KEY_SIZE, 4579 SMP_MAX_ENC_KEY_SIZE); 4580 4581 /* Append the min/max LE tx power parameters if we were able to fetch 4582 * it from the controller 4583 */ 4584 if (hdev->commands[38] & 0x80) { 4585 memcpy(&tx_power_range[0], &hdev->min_le_tx_power, 1); 4586 memcpy(&tx_power_range[1], &hdev->max_le_tx_power, 1); 4587 cap_len = eir_append_data(rp->cap, cap_len, MGMT_CAP_LE_TX_PWR, 4588 tx_power_range, 2); 4589 } 4590 4591 rp->cap_len = cpu_to_le16(cap_len); 4592 4593 hci_dev_unlock(hdev); 4594 4595 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_CONTROLLER_CAP, 0, 4596 rp, sizeof(*rp) + cap_len); 4597 } 4598 4599 #ifdef CONFIG_BT_FEATURE_DEBUG 4600 /* d4992530-b9ec-469f-ab01-6c481c47da1c */ 4601 static const u8 debug_uuid[16] = { 4602 0x1c, 0xda, 0x47, 0x1c, 0x48, 0x6c, 0x01, 0xab, 4603 0x9f, 0x46, 0xec, 0xb9, 0x30, 0x25, 0x99, 0xd4, 4604 }; 4605 #endif 4606 4607 /* 330859bc-7506-492d-9370-9a6f0614037f */ 4608 static const u8 quality_report_uuid[16] = { 4609 0x7f, 0x03, 0x14, 0x06, 0x6f, 0x9a, 0x70, 0x93, 4610 0x2d, 0x49, 0x06, 0x75, 0xbc, 0x59, 0x08, 0x33, 4611 }; 4612 4613 /* a6695ace-ee7f-4fb9-881a-5fac66c629af */ 4614 static const u8 offload_codecs_uuid[16] = { 4615 0xaf, 0x29, 0xc6, 0x66, 0xac, 0x5f, 0x1a, 0x88, 4616 0xb9, 0x4f, 0x7f, 0xee, 0xce, 0x5a, 0x69, 0xa6, 4617 }; 4618 4619 /* 671b10b5-42c0-4696-9227-eb28d1b049d6 */ 4620 static const u8 le_simultaneous_roles_uuid[16] = { 4621 0xd6, 0x49, 0xb0, 0xd1, 0x28, 0xeb, 0x27, 0x92, 4622 0x96, 0x46, 0xc0, 0x42, 0xb5, 0x10, 0x1b, 0x67, 4623 }; 4624 4625 /* 6fbaf188-05e0-496a-9885-d6ddfdb4e03e */ 4626 static const u8 iso_socket_uuid[16] = { 4627 0x3e, 0xe0, 0xb4, 0xfd, 0xdd, 0xd6, 0x85, 0x98, 4628 0x6a, 0x49, 0xe0, 0x05, 0x88, 0xf1, 0xba, 0x6f, 4629 }; 4630 4631 /* 2ce463d7-7a03-4d8d-bf05-5f24e8f36e76 */ 4632 static const u8 mgmt_mesh_uuid[16] = { 4633 0x76, 0x6e, 0xf3, 0xe8, 0x24, 0x5f, 0x05, 0xbf, 4634 0x8d, 0x4d, 0x03, 0x7a, 0xd7, 0x63, 0xe4, 0x2c, 4635 }; 4636 4637 static int read_exp_features_info(struct sock *sk, struct hci_dev *hdev, 4638 void *data, u16 data_len) 4639 { 4640 struct mgmt_rp_read_exp_features_info *rp; 4641 size_t len; 4642 u16 idx = 0; 4643 u32 flags; 4644 int status; 4645 4646 bt_dev_dbg(hdev, "sock %p", sk); 4647 4648 /* Enough space for 7 features */ 4649 len = sizeof(*rp) + (sizeof(rp->features[0]) * 7); 4650 rp = kzalloc(len, GFP_KERNEL); 4651 if (!rp) 4652 return -ENOMEM; 4653 4654 #ifdef CONFIG_BT_FEATURE_DEBUG 4655 flags = bt_dbg_get() ? BIT(0) : 0; 4656 4657 memcpy(rp->features[idx].uuid, debug_uuid, 16); 4658 rp->features[idx].flags = cpu_to_le32(flags); 4659 idx++; 4660 #endif 4661 4662 if (hdev && hci_dev_le_state_simultaneous(hdev)) { 4663 if (hci_dev_test_flag(hdev, HCI_LE_SIMULTANEOUS_ROLES)) 4664 flags = BIT(0); 4665 else 4666 flags = 0; 4667 4668 memcpy(rp->features[idx].uuid, le_simultaneous_roles_uuid, 16); 4669 rp->features[idx].flags = cpu_to_le32(flags); 4670 idx++; 4671 } 4672 4673 if (hdev && (aosp_has_quality_report(hdev) || 4674 hdev->set_quality_report)) { 4675 if (hci_dev_test_flag(hdev, HCI_QUALITY_REPORT)) 4676 flags = BIT(0); 4677 else 4678 flags = 0; 4679 4680 memcpy(rp->features[idx].uuid, quality_report_uuid, 16); 4681 rp->features[idx].flags = cpu_to_le32(flags); 4682 idx++; 4683 } 4684 4685 if (hdev && hdev->get_data_path_id) { 4686 if (hci_dev_test_flag(hdev, HCI_OFFLOAD_CODECS_ENABLED)) 4687 flags = BIT(0); 4688 else 4689 flags = 0; 4690 4691 memcpy(rp->features[idx].uuid, offload_codecs_uuid, 16); 4692 rp->features[idx].flags = cpu_to_le32(flags); 4693 idx++; 4694 } 4695 4696 if (IS_ENABLED(CONFIG_BT_LE)) { 4697 flags = iso_inited() ? BIT(0) : 0; 4698 memcpy(rp->features[idx].uuid, iso_socket_uuid, 16); 4699 rp->features[idx].flags = cpu_to_le32(flags); 4700 idx++; 4701 } 4702 4703 if (hdev && lmp_le_capable(hdev)) { 4704 if (hci_dev_test_flag(hdev, HCI_MESH_EXPERIMENTAL)) 4705 flags = BIT(0); 4706 else 4707 flags = 0; 4708 4709 memcpy(rp->features[idx].uuid, mgmt_mesh_uuid, 16); 4710 rp->features[idx].flags = cpu_to_le32(flags); 4711 idx++; 4712 } 4713 4714 rp->feature_count = cpu_to_le16(idx); 4715 4716 /* After reading the experimental features information, enable 4717 * the events to update client on any future change. 4718 */ 4719 hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS); 4720 4721 status = mgmt_cmd_complete(sk, hdev ? hdev->id : MGMT_INDEX_NONE, 4722 MGMT_OP_READ_EXP_FEATURES_INFO, 4723 0, rp, sizeof(*rp) + (20 * idx)); 4724 4725 kfree(rp); 4726 return status; 4727 } 4728 4729 static int exp_feature_changed(struct hci_dev *hdev, const u8 *uuid, 4730 bool enabled, struct sock *skip) 4731 { 4732 struct mgmt_ev_exp_feature_changed ev; 4733 4734 memset(&ev, 0, sizeof(ev)); 4735 memcpy(ev.uuid, uuid, 16); 4736 ev.flags = cpu_to_le32(enabled ? BIT(0) : 0); 4737 4738 return mgmt_limited_event(MGMT_EV_EXP_FEATURE_CHANGED, hdev, 4739 &ev, sizeof(ev), 4740 HCI_MGMT_EXP_FEATURE_EVENTS, skip); 4741 } 4742 4743 #define EXP_FEAT(_uuid, _set_func) \ 4744 { \ 4745 .uuid = _uuid, \ 4746 .set_func = _set_func, \ 4747 } 4748 4749 /* The zero key uuid is special. Multiple exp features are set through it. */ 4750 static int set_zero_key_func(struct sock *sk, struct hci_dev *hdev, 4751 struct mgmt_cp_set_exp_feature *cp, u16 data_len) 4752 { 4753 struct mgmt_rp_set_exp_feature rp; 4754 4755 memset(rp.uuid, 0, 16); 4756 rp.flags = cpu_to_le32(0); 4757 4758 #ifdef CONFIG_BT_FEATURE_DEBUG 4759 if (!hdev) { 4760 bool changed = bt_dbg_get(); 4761 4762 bt_dbg_set(false); 4763 4764 if (changed) 4765 exp_feature_changed(NULL, ZERO_KEY, false, sk); 4766 } 4767 #endif 4768 4769 hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS); 4770 4771 return mgmt_cmd_complete(sk, hdev ? hdev->id : MGMT_INDEX_NONE, 4772 MGMT_OP_SET_EXP_FEATURE, 0, 4773 &rp, sizeof(rp)); 4774 } 4775 4776 #ifdef CONFIG_BT_FEATURE_DEBUG 4777 static int set_debug_func(struct sock *sk, struct hci_dev *hdev, 4778 struct mgmt_cp_set_exp_feature *cp, u16 data_len) 4779 { 4780 struct mgmt_rp_set_exp_feature rp; 4781 4782 bool val, changed; 4783 int err; 4784 4785 /* Command requires to use the non-controller index */ 4786 if (hdev) 4787 return mgmt_cmd_status(sk, hdev->id, 4788 MGMT_OP_SET_EXP_FEATURE, 4789 MGMT_STATUS_INVALID_INDEX); 4790 4791 /* Parameters are limited to a single octet */ 4792 if (data_len != MGMT_SET_EXP_FEATURE_SIZE + 1) 4793 return mgmt_cmd_status(sk, MGMT_INDEX_NONE, 4794 MGMT_OP_SET_EXP_FEATURE, 4795 MGMT_STATUS_INVALID_PARAMS); 4796 4797 /* Only boolean on/off is supported */ 4798 if (cp->param[0] != 0x00 && cp->param[0] != 0x01) 4799 return mgmt_cmd_status(sk, MGMT_INDEX_NONE, 4800 MGMT_OP_SET_EXP_FEATURE, 4801 MGMT_STATUS_INVALID_PARAMS); 4802 4803 val = !!cp->param[0]; 4804 changed = val ? !bt_dbg_get() : bt_dbg_get(); 4805 bt_dbg_set(val); 4806 4807 memcpy(rp.uuid, debug_uuid, 16); 4808 rp.flags = cpu_to_le32(val ? BIT(0) : 0); 4809 4810 hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS); 4811 4812 err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE, 4813 MGMT_OP_SET_EXP_FEATURE, 0, 4814 &rp, sizeof(rp)); 4815 4816 if (changed) 4817 exp_feature_changed(hdev, debug_uuid, val, sk); 4818 4819 return err; 4820 } 4821 #endif 4822 4823 static int set_mgmt_mesh_func(struct sock *sk, struct hci_dev *hdev, 4824 struct mgmt_cp_set_exp_feature *cp, u16 data_len) 4825 { 4826 struct mgmt_rp_set_exp_feature rp; 4827 bool val, changed; 4828 int err; 4829 4830 /* Command requires to use the controller index */ 4831 if (!hdev) 4832 return mgmt_cmd_status(sk, MGMT_INDEX_NONE, 4833 MGMT_OP_SET_EXP_FEATURE, 4834 MGMT_STATUS_INVALID_INDEX); 4835 4836 /* Parameters are limited to a single octet */ 4837 if (data_len != MGMT_SET_EXP_FEATURE_SIZE + 1) 4838 return mgmt_cmd_status(sk, hdev->id, 4839 MGMT_OP_SET_EXP_FEATURE, 4840 MGMT_STATUS_INVALID_PARAMS); 4841 4842 /* Only boolean on/off is supported */ 4843 if (cp->param[0] != 0x00 && cp->param[0] != 0x01) 4844 return mgmt_cmd_status(sk, hdev->id, 4845 MGMT_OP_SET_EXP_FEATURE, 4846 MGMT_STATUS_INVALID_PARAMS); 4847 4848 val = !!cp->param[0]; 4849 4850 if (val) { 4851 changed = !hci_dev_test_and_set_flag(hdev, 4852 HCI_MESH_EXPERIMENTAL); 4853 } else { 4854 hci_dev_clear_flag(hdev, HCI_MESH); 4855 changed = hci_dev_test_and_clear_flag(hdev, 4856 HCI_MESH_EXPERIMENTAL); 4857 } 4858 4859 memcpy(rp.uuid, mgmt_mesh_uuid, 16); 4860 rp.flags = cpu_to_le32(val ? BIT(0) : 0); 4861 4862 hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS); 4863 4864 err = mgmt_cmd_complete(sk, hdev->id, 4865 MGMT_OP_SET_EXP_FEATURE, 0, 4866 &rp, sizeof(rp)); 4867 4868 if (changed) 4869 exp_feature_changed(hdev, mgmt_mesh_uuid, val, sk); 4870 4871 return err; 4872 } 4873 4874 static int set_quality_report_func(struct sock *sk, struct hci_dev *hdev, 4875 struct mgmt_cp_set_exp_feature *cp, 4876 u16 data_len) 4877 { 4878 struct mgmt_rp_set_exp_feature rp; 4879 bool val, changed; 4880 int err; 4881 4882 /* Command requires to use a valid controller index */ 4883 if (!hdev) 4884 return mgmt_cmd_status(sk, MGMT_INDEX_NONE, 4885 MGMT_OP_SET_EXP_FEATURE, 4886 MGMT_STATUS_INVALID_INDEX); 4887 4888 /* Parameters are limited to a single octet */ 4889 if (data_len != MGMT_SET_EXP_FEATURE_SIZE + 1) 4890 return mgmt_cmd_status(sk, hdev->id, 4891 MGMT_OP_SET_EXP_FEATURE, 4892 MGMT_STATUS_INVALID_PARAMS); 4893 4894 /* Only boolean on/off is supported */ 4895 if (cp->param[0] != 0x00 && cp->param[0] != 0x01) 4896 return mgmt_cmd_status(sk, hdev->id, 4897 MGMT_OP_SET_EXP_FEATURE, 4898 MGMT_STATUS_INVALID_PARAMS); 4899 4900 hci_req_sync_lock(hdev); 4901 4902 val = !!cp->param[0]; 4903 changed = (val != hci_dev_test_flag(hdev, HCI_QUALITY_REPORT)); 4904 4905 if (!aosp_has_quality_report(hdev) && !hdev->set_quality_report) { 4906 err = mgmt_cmd_status(sk, hdev->id, 4907 MGMT_OP_SET_EXP_FEATURE, 4908 MGMT_STATUS_NOT_SUPPORTED); 4909 goto unlock_quality_report; 4910 } 4911 4912 if (changed) { 4913 if (hdev->set_quality_report) 4914 err = hdev->set_quality_report(hdev, val); 4915 else 4916 err = aosp_set_quality_report(hdev, val); 4917 4918 if (err) { 4919 err = mgmt_cmd_status(sk, hdev->id, 4920 MGMT_OP_SET_EXP_FEATURE, 4921 MGMT_STATUS_FAILED); 4922 goto unlock_quality_report; 4923 } 4924 4925 if (val) 4926 hci_dev_set_flag(hdev, HCI_QUALITY_REPORT); 4927 else 4928 hci_dev_clear_flag(hdev, HCI_QUALITY_REPORT); 4929 } 4930 4931 bt_dev_dbg(hdev, "quality report enable %d changed %d", val, changed); 4932 4933 memcpy(rp.uuid, quality_report_uuid, 16); 4934 rp.flags = cpu_to_le32(val ? BIT(0) : 0); 4935 hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS); 4936 4937 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_EXP_FEATURE, 0, 4938 &rp, sizeof(rp)); 4939 4940 if (changed) 4941 exp_feature_changed(hdev, quality_report_uuid, val, sk); 4942 4943 unlock_quality_report: 4944 hci_req_sync_unlock(hdev); 4945 return err; 4946 } 4947 4948 static int set_offload_codec_func(struct sock *sk, struct hci_dev *hdev, 4949 struct mgmt_cp_set_exp_feature *cp, 4950 u16 data_len) 4951 { 4952 bool val, changed; 4953 int err; 4954 struct mgmt_rp_set_exp_feature rp; 4955 4956 /* Command requires to use a valid controller index */ 4957 if (!hdev) 4958 return mgmt_cmd_status(sk, MGMT_INDEX_NONE, 4959 MGMT_OP_SET_EXP_FEATURE, 4960 MGMT_STATUS_INVALID_INDEX); 4961 4962 /* Parameters are limited to a single octet */ 4963 if (data_len != MGMT_SET_EXP_FEATURE_SIZE + 1) 4964 return mgmt_cmd_status(sk, hdev->id, 4965 MGMT_OP_SET_EXP_FEATURE, 4966 MGMT_STATUS_INVALID_PARAMS); 4967 4968 /* Only boolean on/off is supported */ 4969 if (cp->param[0] != 0x00 && cp->param[0] != 0x01) 4970 return mgmt_cmd_status(sk, hdev->id, 4971 MGMT_OP_SET_EXP_FEATURE, 4972 MGMT_STATUS_INVALID_PARAMS); 4973 4974 val = !!cp->param[0]; 4975 changed = (val != hci_dev_test_flag(hdev, HCI_OFFLOAD_CODECS_ENABLED)); 4976 4977 if (!hdev->get_data_path_id) { 4978 return mgmt_cmd_status(sk, hdev->id, 4979 MGMT_OP_SET_EXP_FEATURE, 4980 MGMT_STATUS_NOT_SUPPORTED); 4981 } 4982 4983 if (changed) { 4984 if (val) 4985 hci_dev_set_flag(hdev, HCI_OFFLOAD_CODECS_ENABLED); 4986 else 4987 hci_dev_clear_flag(hdev, HCI_OFFLOAD_CODECS_ENABLED); 4988 } 4989 4990 bt_dev_info(hdev, "offload codecs enable %d changed %d", 4991 val, changed); 4992 4993 memcpy(rp.uuid, offload_codecs_uuid, 16); 4994 rp.flags = cpu_to_le32(val ? BIT(0) : 0); 4995 hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS); 4996 err = mgmt_cmd_complete(sk, hdev->id, 4997 MGMT_OP_SET_EXP_FEATURE, 0, 4998 &rp, sizeof(rp)); 4999 5000 if (changed) 5001 exp_feature_changed(hdev, offload_codecs_uuid, val, sk); 5002 5003 return err; 5004 } 5005 5006 static int set_le_simultaneous_roles_func(struct sock *sk, struct hci_dev *hdev, 5007 struct mgmt_cp_set_exp_feature *cp, 5008 u16 data_len) 5009 { 5010 bool val, changed; 5011 int err; 5012 struct mgmt_rp_set_exp_feature rp; 5013 5014 /* Command requires to use a valid controller index */ 5015 if (!hdev) 5016 return mgmt_cmd_status(sk, MGMT_INDEX_NONE, 5017 MGMT_OP_SET_EXP_FEATURE, 5018 MGMT_STATUS_INVALID_INDEX); 5019 5020 /* Parameters are limited to a single octet */ 5021 if (data_len != MGMT_SET_EXP_FEATURE_SIZE + 1) 5022 return mgmt_cmd_status(sk, hdev->id, 5023 MGMT_OP_SET_EXP_FEATURE, 5024 MGMT_STATUS_INVALID_PARAMS); 5025 5026 /* Only boolean on/off is supported */ 5027 if (cp->param[0] != 0x00 && cp->param[0] != 0x01) 5028 return mgmt_cmd_status(sk, hdev->id, 5029 MGMT_OP_SET_EXP_FEATURE, 5030 MGMT_STATUS_INVALID_PARAMS); 5031 5032 val = !!cp->param[0]; 5033 changed = (val != hci_dev_test_flag(hdev, HCI_LE_SIMULTANEOUS_ROLES)); 5034 5035 if (!hci_dev_le_state_simultaneous(hdev)) { 5036 return mgmt_cmd_status(sk, hdev->id, 5037 MGMT_OP_SET_EXP_FEATURE, 5038 MGMT_STATUS_NOT_SUPPORTED); 5039 } 5040 5041 if (changed) { 5042 if (val) 5043 hci_dev_set_flag(hdev, HCI_LE_SIMULTANEOUS_ROLES); 5044 else 5045 hci_dev_clear_flag(hdev, HCI_LE_SIMULTANEOUS_ROLES); 5046 } 5047 5048 bt_dev_info(hdev, "LE simultaneous roles enable %d changed %d", 5049 val, changed); 5050 5051 memcpy(rp.uuid, le_simultaneous_roles_uuid, 16); 5052 rp.flags = cpu_to_le32(val ? BIT(0) : 0); 5053 hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS); 5054 err = mgmt_cmd_complete(sk, hdev->id, 5055 MGMT_OP_SET_EXP_FEATURE, 0, 5056 &rp, sizeof(rp)); 5057 5058 if (changed) 5059 exp_feature_changed(hdev, le_simultaneous_roles_uuid, val, sk); 5060 5061 return err; 5062 } 5063 5064 #ifdef CONFIG_BT_LE 5065 static int set_iso_socket_func(struct sock *sk, struct hci_dev *hdev, 5066 struct mgmt_cp_set_exp_feature *cp, u16 data_len) 5067 { 5068 struct mgmt_rp_set_exp_feature rp; 5069 bool val, changed = false; 5070 int err; 5071 5072 /* Command requires to use the non-controller index */ 5073 if (hdev) 5074 return mgmt_cmd_status(sk, hdev->id, 5075 MGMT_OP_SET_EXP_FEATURE, 5076 MGMT_STATUS_INVALID_INDEX); 5077 5078 /* Parameters are limited to a single octet */ 5079 if (data_len != MGMT_SET_EXP_FEATURE_SIZE + 1) 5080 return mgmt_cmd_status(sk, MGMT_INDEX_NONE, 5081 MGMT_OP_SET_EXP_FEATURE, 5082 MGMT_STATUS_INVALID_PARAMS); 5083 5084 /* Only boolean on/off is supported */ 5085 if (cp->param[0] != 0x00 && cp->param[0] != 0x01) 5086 return mgmt_cmd_status(sk, MGMT_INDEX_NONE, 5087 MGMT_OP_SET_EXP_FEATURE, 5088 MGMT_STATUS_INVALID_PARAMS); 5089 5090 val = cp->param[0] ? true : false; 5091 if (val) 5092 err = iso_init(); 5093 else 5094 err = iso_exit(); 5095 5096 if (!err) 5097 changed = true; 5098 5099 memcpy(rp.uuid, iso_socket_uuid, 16); 5100 rp.flags = cpu_to_le32(val ? BIT(0) : 0); 5101 5102 hci_sock_set_flag(sk, HCI_MGMT_EXP_FEATURE_EVENTS); 5103 5104 err = mgmt_cmd_complete(sk, MGMT_INDEX_NONE, 5105 MGMT_OP_SET_EXP_FEATURE, 0, 5106 &rp, sizeof(rp)); 5107 5108 if (changed) 5109 exp_feature_changed(hdev, iso_socket_uuid, val, sk); 5110 5111 return err; 5112 } 5113 #endif 5114 5115 static const struct mgmt_exp_feature { 5116 const u8 *uuid; 5117 int (*set_func)(struct sock *sk, struct hci_dev *hdev, 5118 struct mgmt_cp_set_exp_feature *cp, u16 data_len); 5119 } exp_features[] = { 5120 EXP_FEAT(ZERO_KEY, set_zero_key_func), 5121 #ifdef CONFIG_BT_FEATURE_DEBUG 5122 EXP_FEAT(debug_uuid, set_debug_func), 5123 #endif 5124 EXP_FEAT(mgmt_mesh_uuid, set_mgmt_mesh_func), 5125 EXP_FEAT(quality_report_uuid, set_quality_report_func), 5126 EXP_FEAT(offload_codecs_uuid, set_offload_codec_func), 5127 EXP_FEAT(le_simultaneous_roles_uuid, set_le_simultaneous_roles_func), 5128 #ifdef CONFIG_BT_LE 5129 EXP_FEAT(iso_socket_uuid, set_iso_socket_func), 5130 #endif 5131 5132 /* end with a null feature */ 5133 EXP_FEAT(NULL, NULL) 5134 }; 5135 5136 static int set_exp_feature(struct sock *sk, struct hci_dev *hdev, 5137 void *data, u16 data_len) 5138 { 5139 struct mgmt_cp_set_exp_feature *cp = data; 5140 size_t i = 0; 5141 5142 bt_dev_dbg(hdev, "sock %p", sk); 5143 5144 for (i = 0; exp_features[i].uuid; i++) { 5145 if (!memcmp(cp->uuid, exp_features[i].uuid, 16)) 5146 return exp_features[i].set_func(sk, hdev, cp, data_len); 5147 } 5148 5149 return mgmt_cmd_status(sk, hdev ? hdev->id : MGMT_INDEX_NONE, 5150 MGMT_OP_SET_EXP_FEATURE, 5151 MGMT_STATUS_NOT_SUPPORTED); 5152 } 5153 5154 static int get_device_flags(struct sock *sk, struct hci_dev *hdev, void *data, 5155 u16 data_len) 5156 { 5157 struct mgmt_cp_get_device_flags *cp = data; 5158 struct mgmt_rp_get_device_flags rp; 5159 struct bdaddr_list_with_flags *br_params; 5160 struct hci_conn_params *params; 5161 u32 supported_flags; 5162 u32 current_flags = 0; 5163 u8 status = MGMT_STATUS_INVALID_PARAMS; 5164 5165 bt_dev_dbg(hdev, "Get device flags %pMR (type 0x%x)\n", 5166 &cp->addr.bdaddr, cp->addr.type); 5167 5168 hci_dev_lock(hdev); 5169 5170 supported_flags = hdev->conn_flags; 5171 5172 memset(&rp, 0, sizeof(rp)); 5173 5174 if (cp->addr.type == BDADDR_BREDR) { 5175 br_params = hci_bdaddr_list_lookup_with_flags(&hdev->accept_list, 5176 &cp->addr.bdaddr, 5177 cp->addr.type); 5178 if (!br_params) 5179 goto done; 5180 5181 current_flags = br_params->flags; 5182 } else { 5183 params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr, 5184 le_addr_type(cp->addr.type)); 5185 if (!params) 5186 goto done; 5187 5188 current_flags = params->flags; 5189 } 5190 5191 bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr); 5192 rp.addr.type = cp->addr.type; 5193 rp.supported_flags = cpu_to_le32(supported_flags); 5194 rp.current_flags = cpu_to_le32(current_flags); 5195 5196 status = MGMT_STATUS_SUCCESS; 5197 5198 done: 5199 hci_dev_unlock(hdev); 5200 5201 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_DEVICE_FLAGS, status, 5202 &rp, sizeof(rp)); 5203 } 5204 5205 static void device_flags_changed(struct sock *sk, struct hci_dev *hdev, 5206 bdaddr_t *bdaddr, u8 bdaddr_type, 5207 u32 supported_flags, u32 current_flags) 5208 { 5209 struct mgmt_ev_device_flags_changed ev; 5210 5211 bacpy(&ev.addr.bdaddr, bdaddr); 5212 ev.addr.type = bdaddr_type; 5213 ev.supported_flags = cpu_to_le32(supported_flags); 5214 ev.current_flags = cpu_to_le32(current_flags); 5215 5216 mgmt_event(MGMT_EV_DEVICE_FLAGS_CHANGED, hdev, &ev, sizeof(ev), sk); 5217 } 5218 5219 static bool is_connected(struct hci_dev *hdev, bdaddr_t *addr, u8 type) 5220 { 5221 struct hci_conn *conn; 5222 5223 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, addr); 5224 if (!conn) 5225 return false; 5226 5227 if (conn->dst_type != type) 5228 return false; 5229 5230 if (conn->state != BT_CONNECTED) 5231 return false; 5232 5233 return true; 5234 } 5235 5236 /* This function requires the caller holds hdev->lock */ 5237 static struct hci_conn_params *hci_conn_params_set(struct hci_dev *hdev, 5238 bdaddr_t *addr, u8 addr_type, 5239 u8 auto_connect) 5240 { 5241 struct hci_conn_params *params; 5242 5243 params = hci_conn_params_add(hdev, addr, addr_type); 5244 if (!params) 5245 return NULL; 5246 5247 if (params->auto_connect == auto_connect) 5248 return params; 5249 5250 hci_pend_le_list_del_init(params); 5251 5252 switch (auto_connect) { 5253 case HCI_AUTO_CONN_DISABLED: 5254 case HCI_AUTO_CONN_LINK_LOSS: 5255 /* If auto connect is being disabled when we're trying to 5256 * connect to device, keep connecting. 5257 */ 5258 if (params->explicit_connect) 5259 hci_pend_le_list_add(params, &hdev->pend_le_conns); 5260 break; 5261 case HCI_AUTO_CONN_REPORT: 5262 if (params->explicit_connect) 5263 hci_pend_le_list_add(params, &hdev->pend_le_conns); 5264 else 5265 hci_pend_le_list_add(params, &hdev->pend_le_reports); 5266 break; 5267 case HCI_AUTO_CONN_DIRECT: 5268 case HCI_AUTO_CONN_ALWAYS: 5269 if (!is_connected(hdev, addr, addr_type)) 5270 hci_pend_le_list_add(params, &hdev->pend_le_conns); 5271 break; 5272 } 5273 5274 params->auto_connect = auto_connect; 5275 5276 bt_dev_dbg(hdev, "addr %pMR (type %u) auto_connect %u", 5277 addr, addr_type, auto_connect); 5278 5279 return params; 5280 } 5281 5282 static int set_device_flags(struct sock *sk, struct hci_dev *hdev, void *data, 5283 u16 len) 5284 { 5285 struct mgmt_cp_set_device_flags *cp = data; 5286 struct bdaddr_list_with_flags *br_params; 5287 struct hci_conn_params *params; 5288 u8 status = MGMT_STATUS_INVALID_PARAMS; 5289 u32 supported_flags; 5290 u32 current_flags = __le32_to_cpu(cp->current_flags); 5291 5292 bt_dev_dbg(hdev, "Set device flags %pMR (type 0x%x) = 0x%x", 5293 &cp->addr.bdaddr, cp->addr.type, current_flags); 5294 5295 // We should take hci_dev_lock() early, I think.. conn_flags can change 5296 supported_flags = hdev->conn_flags; 5297 5298 if ((supported_flags | current_flags) != supported_flags) { 5299 bt_dev_warn(hdev, "Bad flag given (0x%x) vs supported (0x%0x)", 5300 current_flags, supported_flags); 5301 goto done; 5302 } 5303 5304 hci_dev_lock(hdev); 5305 5306 if (cp->addr.type == BDADDR_BREDR) { 5307 br_params = hci_bdaddr_list_lookup_with_flags(&hdev->accept_list, 5308 &cp->addr.bdaddr, 5309 cp->addr.type); 5310 5311 if (br_params) { 5312 br_params->flags = current_flags; 5313 status = MGMT_STATUS_SUCCESS; 5314 } else { 5315 bt_dev_warn(hdev, "No such BR/EDR device %pMR (0x%x)", 5316 &cp->addr.bdaddr, cp->addr.type); 5317 } 5318 5319 goto unlock; 5320 } 5321 5322 params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr, 5323 le_addr_type(cp->addr.type)); 5324 if (!params) { 5325 /* Create a new hci_conn_params if it doesn't exist */ 5326 params = hci_conn_params_set(hdev, &cp->addr.bdaddr, 5327 le_addr_type(cp->addr.type), 5328 HCI_AUTO_CONN_DISABLED); 5329 if (!params) { 5330 bt_dev_warn(hdev, "No such LE device %pMR (0x%x)", 5331 &cp->addr.bdaddr, 5332 le_addr_type(cp->addr.type)); 5333 goto unlock; 5334 } 5335 } 5336 5337 supported_flags = hdev->conn_flags; 5338 5339 if ((supported_flags | current_flags) != supported_flags) { 5340 bt_dev_warn(hdev, "Bad flag given (0x%x) vs supported (0x%0x)", 5341 current_flags, supported_flags); 5342 goto unlock; 5343 } 5344 5345 WRITE_ONCE(params->flags, current_flags); 5346 status = MGMT_STATUS_SUCCESS; 5347 5348 /* Update passive scan if HCI_CONN_FLAG_DEVICE_PRIVACY 5349 * has been set. 5350 */ 5351 if (params->flags & HCI_CONN_FLAG_DEVICE_PRIVACY) 5352 hci_update_passive_scan(hdev); 5353 5354 unlock: 5355 hci_dev_unlock(hdev); 5356 5357 done: 5358 if (status == MGMT_STATUS_SUCCESS) 5359 device_flags_changed(sk, hdev, &cp->addr.bdaddr, cp->addr.type, 5360 supported_flags, current_flags); 5361 5362 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_DEVICE_FLAGS, status, 5363 &cp->addr, sizeof(cp->addr)); 5364 } 5365 5366 static void mgmt_adv_monitor_added(struct sock *sk, struct hci_dev *hdev, 5367 u16 handle) 5368 { 5369 struct mgmt_ev_adv_monitor_added ev; 5370 5371 ev.monitor_handle = cpu_to_le16(handle); 5372 5373 mgmt_event(MGMT_EV_ADV_MONITOR_ADDED, hdev, &ev, sizeof(ev), sk); 5374 } 5375 5376 static void mgmt_adv_monitor_removed(struct sock *sk, struct hci_dev *hdev, 5377 __le16 handle) 5378 { 5379 struct mgmt_ev_adv_monitor_removed ev; 5380 5381 ev.monitor_handle = handle; 5382 5383 mgmt_event(MGMT_EV_ADV_MONITOR_REMOVED, hdev, &ev, sizeof(ev), sk); 5384 } 5385 5386 static int read_adv_mon_features(struct sock *sk, struct hci_dev *hdev, 5387 void *data, u16 len) 5388 { 5389 struct adv_monitor *monitor = NULL; 5390 struct mgmt_rp_read_adv_monitor_features *rp = NULL; 5391 int handle, err; 5392 size_t rp_size = 0; 5393 __u32 supported = 0; 5394 __u32 enabled = 0; 5395 __u16 num_handles = 0; 5396 __u16 handles[HCI_MAX_ADV_MONITOR_NUM_HANDLES]; 5397 5398 BT_DBG("request for %s", hdev->name); 5399 5400 hci_dev_lock(hdev); 5401 5402 if (msft_monitor_supported(hdev)) 5403 supported |= MGMT_ADV_MONITOR_FEATURE_MASK_OR_PATTERNS; 5404 5405 idr_for_each_entry(&hdev->adv_monitors_idr, monitor, handle) 5406 handles[num_handles++] = monitor->handle; 5407 5408 hci_dev_unlock(hdev); 5409 5410 rp_size = sizeof(*rp) + (num_handles * sizeof(u16)); 5411 rp = kmalloc(rp_size, GFP_KERNEL); 5412 if (!rp) 5413 return -ENOMEM; 5414 5415 /* All supported features are currently enabled */ 5416 enabled = supported; 5417 5418 rp->supported_features = cpu_to_le32(supported); 5419 rp->enabled_features = cpu_to_le32(enabled); 5420 rp->max_num_handles = cpu_to_le16(HCI_MAX_ADV_MONITOR_NUM_HANDLES); 5421 rp->max_num_patterns = HCI_MAX_ADV_MONITOR_NUM_PATTERNS; 5422 rp->num_handles = cpu_to_le16(num_handles); 5423 if (num_handles) 5424 memcpy(&rp->handles, &handles, (num_handles * sizeof(u16))); 5425 5426 err = mgmt_cmd_complete(sk, hdev->id, 5427 MGMT_OP_READ_ADV_MONITOR_FEATURES, 5428 MGMT_STATUS_SUCCESS, rp, rp_size); 5429 5430 kfree(rp); 5431 5432 return err; 5433 } 5434 5435 static void mgmt_add_adv_patterns_monitor_complete(struct hci_dev *hdev, 5436 void *data, int status) 5437 { 5438 struct mgmt_rp_add_adv_patterns_monitor rp; 5439 struct mgmt_pending_cmd *cmd = data; 5440 struct adv_monitor *monitor; 5441 5442 /* This is likely the result of hdev being closed and mgmt_index_removed 5443 * is attempting to clean up any pending command so 5444 * hci_adv_monitors_clear is about to be called which will take care of 5445 * freeing the adv_monitor instances. 5446 */ 5447 if (status == -ECANCELED || !mgmt_pending_valid(hdev, cmd)) 5448 return; 5449 5450 monitor = cmd->user_data; 5451 5452 hci_dev_lock(hdev); 5453 5454 rp.monitor_handle = cpu_to_le16(monitor->handle); 5455 5456 if (!status) { 5457 mgmt_adv_monitor_added(cmd->sk, hdev, monitor->handle); 5458 hdev->adv_monitors_cnt++; 5459 if (monitor->state == ADV_MONITOR_STATE_NOT_REGISTERED) 5460 monitor->state = ADV_MONITOR_STATE_REGISTERED; 5461 hci_update_passive_scan(hdev); 5462 } else { 5463 hci_free_adv_monitor(hdev, monitor); 5464 } 5465 5466 mgmt_cmd_complete(cmd->sk, cmd->hdev->id, cmd->opcode, 5467 mgmt_status(status), &rp, sizeof(rp)); 5468 mgmt_pending_free(cmd); 5469 5470 hci_dev_unlock(hdev); 5471 bt_dev_dbg(hdev, "add monitor %d complete, status %d", 5472 rp.monitor_handle, status); 5473 } 5474 5475 static int mgmt_add_adv_patterns_monitor_sync(struct hci_dev *hdev, void *data) 5476 { 5477 struct mgmt_pending_cmd *cmd = data; 5478 struct adv_monitor *mon; 5479 5480 mutex_lock(&hdev->mgmt_pending_lock); 5481 5482 if (!__mgmt_pending_listed(hdev, cmd)) { 5483 mutex_unlock(&hdev->mgmt_pending_lock); 5484 return -ECANCELED; 5485 } 5486 5487 mon = cmd->user_data; 5488 5489 mutex_unlock(&hdev->mgmt_pending_lock); 5490 5491 return hci_add_adv_monitor(hdev, mon); 5492 } 5493 5494 static int __add_adv_patterns_monitor(struct sock *sk, struct hci_dev *hdev, 5495 struct adv_monitor *m, u8 status, 5496 void *data, u16 len, u16 op) 5497 { 5498 struct mgmt_pending_cmd *cmd; 5499 int err; 5500 5501 hci_dev_lock(hdev); 5502 5503 if (status) 5504 goto unlock; 5505 5506 if (pending_find(MGMT_OP_SET_LE, hdev) || 5507 pending_find(MGMT_OP_ADD_ADV_PATTERNS_MONITOR, hdev) || 5508 pending_find(MGMT_OP_ADD_ADV_PATTERNS_MONITOR_RSSI, hdev)) { 5509 status = MGMT_STATUS_BUSY; 5510 goto unlock; 5511 } 5512 5513 cmd = mgmt_pending_add(sk, op, hdev, data, len); 5514 if (!cmd) { 5515 status = MGMT_STATUS_NO_RESOURCES; 5516 goto unlock; 5517 } 5518 5519 cmd->user_data = m; 5520 err = hci_cmd_sync_queue(hdev, mgmt_add_adv_patterns_monitor_sync, cmd, 5521 mgmt_add_adv_patterns_monitor_complete); 5522 if (err) { 5523 if (err == -ENOMEM) 5524 status = MGMT_STATUS_NO_RESOURCES; 5525 else 5526 status = MGMT_STATUS_FAILED; 5527 5528 goto unlock; 5529 } 5530 5531 hci_dev_unlock(hdev); 5532 5533 return 0; 5534 5535 unlock: 5536 hci_free_adv_monitor(hdev, m); 5537 hci_dev_unlock(hdev); 5538 return mgmt_cmd_status(sk, hdev->id, op, status); 5539 } 5540 5541 static void parse_adv_monitor_rssi(struct adv_monitor *m, 5542 struct mgmt_adv_rssi_thresholds *rssi) 5543 { 5544 if (rssi) { 5545 m->rssi.low_threshold = rssi->low_threshold; 5546 m->rssi.low_threshold_timeout = 5547 __le16_to_cpu(rssi->low_threshold_timeout); 5548 m->rssi.high_threshold = rssi->high_threshold; 5549 m->rssi.high_threshold_timeout = 5550 __le16_to_cpu(rssi->high_threshold_timeout); 5551 m->rssi.sampling_period = rssi->sampling_period; 5552 } else { 5553 /* Default values. These numbers are the least constricting 5554 * parameters for MSFT API to work, so it behaves as if there 5555 * are no rssi parameter to consider. May need to be changed 5556 * if other API are to be supported. 5557 */ 5558 m->rssi.low_threshold = -127; 5559 m->rssi.low_threshold_timeout = 60; 5560 m->rssi.high_threshold = -127; 5561 m->rssi.high_threshold_timeout = 0; 5562 m->rssi.sampling_period = 0; 5563 } 5564 } 5565 5566 static u8 parse_adv_monitor_pattern(struct adv_monitor *m, u8 pattern_count, 5567 struct mgmt_adv_pattern *patterns) 5568 { 5569 u8 offset = 0, length = 0; 5570 struct adv_pattern *p = NULL; 5571 int i; 5572 5573 for (i = 0; i < pattern_count; i++) { 5574 offset = patterns[i].offset; 5575 length = patterns[i].length; 5576 if (offset >= HCI_MAX_AD_LENGTH || 5577 length > HCI_MAX_AD_LENGTH || 5578 (offset + length) > HCI_MAX_AD_LENGTH) 5579 return MGMT_STATUS_INVALID_PARAMS; 5580 5581 p = kmalloc_obj(*p); 5582 if (!p) 5583 return MGMT_STATUS_NO_RESOURCES; 5584 5585 p->ad_type = patterns[i].ad_type; 5586 p->offset = patterns[i].offset; 5587 p->length = patterns[i].length; 5588 memcpy(p->value, patterns[i].value, p->length); 5589 5590 INIT_LIST_HEAD(&p->list); 5591 list_add(&p->list, &m->patterns); 5592 } 5593 5594 return MGMT_STATUS_SUCCESS; 5595 } 5596 5597 static int add_adv_patterns_monitor(struct sock *sk, struct hci_dev *hdev, 5598 void *data, u16 len) 5599 { 5600 struct mgmt_cp_add_adv_patterns_monitor *cp = data; 5601 struct adv_monitor *m = NULL; 5602 u8 status = MGMT_STATUS_SUCCESS; 5603 size_t expected_size = sizeof(*cp); 5604 5605 BT_DBG("request for %s", hdev->name); 5606 5607 if (len <= sizeof(*cp)) { 5608 status = MGMT_STATUS_INVALID_PARAMS; 5609 goto done; 5610 } 5611 5612 expected_size += cp->pattern_count * sizeof(struct mgmt_adv_pattern); 5613 if (len != expected_size) { 5614 status = MGMT_STATUS_INVALID_PARAMS; 5615 goto done; 5616 } 5617 5618 m = kzalloc_obj(*m); 5619 if (!m) { 5620 status = MGMT_STATUS_NO_RESOURCES; 5621 goto done; 5622 } 5623 5624 INIT_LIST_HEAD(&m->patterns); 5625 5626 parse_adv_monitor_rssi(m, NULL); 5627 status = parse_adv_monitor_pattern(m, cp->pattern_count, cp->patterns); 5628 5629 done: 5630 return __add_adv_patterns_monitor(sk, hdev, m, status, data, len, 5631 MGMT_OP_ADD_ADV_PATTERNS_MONITOR); 5632 } 5633 5634 static int add_adv_patterns_monitor_rssi(struct sock *sk, struct hci_dev *hdev, 5635 void *data, u16 len) 5636 { 5637 struct mgmt_cp_add_adv_patterns_monitor_rssi *cp = data; 5638 struct adv_monitor *m = NULL; 5639 u8 status = MGMT_STATUS_SUCCESS; 5640 size_t expected_size = sizeof(*cp); 5641 5642 BT_DBG("request for %s", hdev->name); 5643 5644 if (len <= sizeof(*cp)) { 5645 status = MGMT_STATUS_INVALID_PARAMS; 5646 goto done; 5647 } 5648 5649 expected_size += cp->pattern_count * sizeof(struct mgmt_adv_pattern); 5650 if (len != expected_size) { 5651 status = MGMT_STATUS_INVALID_PARAMS; 5652 goto done; 5653 } 5654 5655 m = kzalloc_obj(*m); 5656 if (!m) { 5657 status = MGMT_STATUS_NO_RESOURCES; 5658 goto done; 5659 } 5660 5661 INIT_LIST_HEAD(&m->patterns); 5662 5663 parse_adv_monitor_rssi(m, &cp->rssi); 5664 status = parse_adv_monitor_pattern(m, cp->pattern_count, cp->patterns); 5665 5666 done: 5667 return __add_adv_patterns_monitor(sk, hdev, m, status, data, len, 5668 MGMT_OP_ADD_ADV_PATTERNS_MONITOR_RSSI); 5669 } 5670 5671 static void mgmt_remove_adv_monitor_complete(struct hci_dev *hdev, 5672 void *data, int status) 5673 { 5674 struct mgmt_rp_remove_adv_monitor rp; 5675 struct mgmt_pending_cmd *cmd = data; 5676 struct mgmt_cp_remove_adv_monitor *cp; 5677 5678 if (status == -ECANCELED) 5679 return; 5680 5681 hci_dev_lock(hdev); 5682 5683 cp = cmd->param; 5684 5685 rp.monitor_handle = cp->monitor_handle; 5686 5687 if (!status) { 5688 mgmt_adv_monitor_removed(cmd->sk, hdev, cp->monitor_handle); 5689 hci_update_passive_scan(hdev); 5690 } 5691 5692 mgmt_cmd_complete(cmd->sk, cmd->hdev->id, cmd->opcode, 5693 mgmt_status(status), &rp, sizeof(rp)); 5694 mgmt_pending_free(cmd); 5695 5696 hci_dev_unlock(hdev); 5697 bt_dev_dbg(hdev, "remove monitor %d complete, status %d", 5698 rp.monitor_handle, status); 5699 } 5700 5701 static int mgmt_remove_adv_monitor_sync(struct hci_dev *hdev, void *data) 5702 { 5703 struct mgmt_pending_cmd *cmd = data; 5704 struct mgmt_cp_remove_adv_monitor *cp = cmd->param; 5705 u16 handle = __le16_to_cpu(cp->monitor_handle); 5706 5707 if (!handle) 5708 return hci_remove_all_adv_monitor(hdev); 5709 5710 return hci_remove_single_adv_monitor(hdev, handle); 5711 } 5712 5713 static int remove_adv_monitor(struct sock *sk, struct hci_dev *hdev, 5714 void *data, u16 len) 5715 { 5716 struct mgmt_pending_cmd *cmd; 5717 int err, status; 5718 5719 hci_dev_lock(hdev); 5720 5721 if (pending_find(MGMT_OP_SET_LE, hdev) || 5722 pending_find(MGMT_OP_ADD_ADV_PATTERNS_MONITOR, hdev) || 5723 pending_find(MGMT_OP_ADD_ADV_PATTERNS_MONITOR_RSSI, hdev)) { 5724 status = MGMT_STATUS_BUSY; 5725 goto unlock; 5726 } 5727 5728 cmd = mgmt_pending_new(sk, MGMT_OP_REMOVE_ADV_MONITOR, hdev, data, len); 5729 if (!cmd) { 5730 status = MGMT_STATUS_NO_RESOURCES; 5731 goto unlock; 5732 } 5733 5734 err = hci_cmd_sync_submit(hdev, mgmt_remove_adv_monitor_sync, cmd, 5735 mgmt_remove_adv_monitor_complete); 5736 5737 if (err) { 5738 mgmt_pending_free(cmd); 5739 5740 if (err == -ENOMEM) 5741 status = MGMT_STATUS_NO_RESOURCES; 5742 else 5743 status = MGMT_STATUS_FAILED; 5744 5745 goto unlock; 5746 } 5747 5748 hci_dev_unlock(hdev); 5749 5750 return 0; 5751 5752 unlock: 5753 hci_dev_unlock(hdev); 5754 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_ADV_MONITOR, 5755 status); 5756 } 5757 5758 static void read_local_oob_data_complete(struct hci_dev *hdev, void *data, 5759 int err) 5760 { 5761 struct mgmt_rp_read_local_oob_data mgmt_rp; 5762 size_t rp_size = sizeof(mgmt_rp); 5763 struct mgmt_pending_cmd *cmd = data; 5764 struct sk_buff *skb = cmd->skb; 5765 u8 status = mgmt_status(err); 5766 5767 if (!status) { 5768 if (!skb) 5769 status = MGMT_STATUS_FAILED; 5770 else if (IS_ERR(skb)) 5771 status = mgmt_status(PTR_ERR(skb)); 5772 else 5773 status = mgmt_status(skb->data[0]); 5774 } 5775 5776 bt_dev_dbg(hdev, "status %d", status); 5777 5778 if (status) { 5779 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA, 5780 status); 5781 goto remove; 5782 } 5783 5784 memset(&mgmt_rp, 0, sizeof(mgmt_rp)); 5785 5786 if (!bredr_sc_enabled(hdev)) { 5787 struct hci_rp_read_local_oob_data *rp = (void *) skb->data; 5788 5789 if (skb->len < sizeof(*rp)) { 5790 mgmt_cmd_status(cmd->sk, hdev->id, 5791 MGMT_OP_READ_LOCAL_OOB_DATA, 5792 MGMT_STATUS_FAILED); 5793 goto remove; 5794 } 5795 5796 memcpy(mgmt_rp.hash192, rp->hash, sizeof(rp->hash)); 5797 memcpy(mgmt_rp.rand192, rp->rand, sizeof(rp->rand)); 5798 5799 rp_size -= sizeof(mgmt_rp.hash256) + sizeof(mgmt_rp.rand256); 5800 } else { 5801 struct hci_rp_read_local_oob_ext_data *rp = (void *) skb->data; 5802 5803 if (skb->len < sizeof(*rp)) { 5804 mgmt_cmd_status(cmd->sk, hdev->id, 5805 MGMT_OP_READ_LOCAL_OOB_DATA, 5806 MGMT_STATUS_FAILED); 5807 goto remove; 5808 } 5809 5810 memcpy(mgmt_rp.hash192, rp->hash192, sizeof(rp->hash192)); 5811 memcpy(mgmt_rp.rand192, rp->rand192, sizeof(rp->rand192)); 5812 5813 memcpy(mgmt_rp.hash256, rp->hash256, sizeof(rp->hash256)); 5814 memcpy(mgmt_rp.rand256, rp->rand256, sizeof(rp->rand256)); 5815 } 5816 5817 mgmt_cmd_complete(cmd->sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA, 5818 MGMT_STATUS_SUCCESS, &mgmt_rp, rp_size); 5819 5820 remove: 5821 if (skb && !IS_ERR(skb)) 5822 kfree_skb(skb); 5823 5824 mgmt_pending_free(cmd); 5825 } 5826 5827 static int read_local_oob_data_sync(struct hci_dev *hdev, void *data) 5828 { 5829 struct mgmt_pending_cmd *cmd = data; 5830 5831 if (bredr_sc_enabled(hdev)) 5832 cmd->skb = hci_read_local_oob_data_sync(hdev, true, cmd->sk); 5833 else 5834 cmd->skb = hci_read_local_oob_data_sync(hdev, false, cmd->sk); 5835 5836 if (IS_ERR(cmd->skb)) 5837 return PTR_ERR(cmd->skb); 5838 else 5839 return 0; 5840 } 5841 5842 static int read_local_oob_data(struct sock *sk, struct hci_dev *hdev, 5843 void *data, u16 data_len) 5844 { 5845 struct mgmt_pending_cmd *cmd; 5846 int err; 5847 5848 bt_dev_dbg(hdev, "sock %p", sk); 5849 5850 hci_dev_lock(hdev); 5851 5852 if (!hdev_is_powered(hdev)) { 5853 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA, 5854 MGMT_STATUS_NOT_POWERED); 5855 goto unlock; 5856 } 5857 5858 if (!lmp_ssp_capable(hdev)) { 5859 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA, 5860 MGMT_STATUS_NOT_SUPPORTED); 5861 goto unlock; 5862 } 5863 5864 cmd = mgmt_pending_new(sk, MGMT_OP_READ_LOCAL_OOB_DATA, hdev, NULL, 0); 5865 if (!cmd) 5866 err = -ENOMEM; 5867 else 5868 err = hci_cmd_sync_queue(hdev, read_local_oob_data_sync, cmd, 5869 read_local_oob_data_complete); 5870 5871 if (err < 0) { 5872 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_DATA, 5873 MGMT_STATUS_FAILED); 5874 5875 if (cmd) 5876 mgmt_pending_free(cmd); 5877 } 5878 5879 unlock: 5880 hci_dev_unlock(hdev); 5881 return err; 5882 } 5883 5884 static int add_remote_oob_data(struct sock *sk, struct hci_dev *hdev, 5885 void *data, u16 len) 5886 { 5887 struct mgmt_addr_info *addr = data; 5888 int err; 5889 5890 bt_dev_dbg(hdev, "sock %p", sk); 5891 5892 if (!bdaddr_type_is_valid(addr->type)) 5893 return mgmt_cmd_complete(sk, hdev->id, 5894 MGMT_OP_ADD_REMOTE_OOB_DATA, 5895 MGMT_STATUS_INVALID_PARAMS, 5896 addr, sizeof(*addr)); 5897 5898 hci_dev_lock(hdev); 5899 5900 if (len == MGMT_ADD_REMOTE_OOB_DATA_SIZE) { 5901 struct mgmt_cp_add_remote_oob_data *cp = data; 5902 u8 status; 5903 5904 if (cp->addr.type != BDADDR_BREDR) { 5905 err = mgmt_cmd_complete(sk, hdev->id, 5906 MGMT_OP_ADD_REMOTE_OOB_DATA, 5907 MGMT_STATUS_INVALID_PARAMS, 5908 &cp->addr, sizeof(cp->addr)); 5909 goto unlock; 5910 } 5911 5912 err = hci_add_remote_oob_data(hdev, &cp->addr.bdaddr, 5913 cp->addr.type, cp->hash, 5914 cp->rand, NULL, NULL); 5915 if (err < 0) 5916 status = MGMT_STATUS_FAILED; 5917 else 5918 status = MGMT_STATUS_SUCCESS; 5919 5920 err = mgmt_cmd_complete(sk, hdev->id, 5921 MGMT_OP_ADD_REMOTE_OOB_DATA, status, 5922 &cp->addr, sizeof(cp->addr)); 5923 } else if (len == MGMT_ADD_REMOTE_OOB_EXT_DATA_SIZE) { 5924 struct mgmt_cp_add_remote_oob_ext_data *cp = data; 5925 u8 *rand192, *hash192, *rand256, *hash256; 5926 u8 status; 5927 5928 if (bdaddr_type_is_le(cp->addr.type)) { 5929 /* Enforce zero-valued 192-bit parameters as 5930 * long as legacy SMP OOB isn't implemented. 5931 */ 5932 if (memcmp(cp->rand192, ZERO_KEY, 16) || 5933 memcmp(cp->hash192, ZERO_KEY, 16)) { 5934 err = mgmt_cmd_complete(sk, hdev->id, 5935 MGMT_OP_ADD_REMOTE_OOB_DATA, 5936 MGMT_STATUS_INVALID_PARAMS, 5937 addr, sizeof(*addr)); 5938 goto unlock; 5939 } 5940 5941 rand192 = NULL; 5942 hash192 = NULL; 5943 } else { 5944 /* In case one of the P-192 values is set to zero, 5945 * then just disable OOB data for P-192. 5946 */ 5947 if (!memcmp(cp->rand192, ZERO_KEY, 16) || 5948 !memcmp(cp->hash192, ZERO_KEY, 16)) { 5949 rand192 = NULL; 5950 hash192 = NULL; 5951 } else { 5952 rand192 = cp->rand192; 5953 hash192 = cp->hash192; 5954 } 5955 } 5956 5957 /* In case one of the P-256 values is set to zero, then just 5958 * disable OOB data for P-256. 5959 */ 5960 if (!memcmp(cp->rand256, ZERO_KEY, 16) || 5961 !memcmp(cp->hash256, ZERO_KEY, 16)) { 5962 rand256 = NULL; 5963 hash256 = NULL; 5964 } else { 5965 rand256 = cp->rand256; 5966 hash256 = cp->hash256; 5967 } 5968 5969 err = hci_add_remote_oob_data(hdev, &cp->addr.bdaddr, 5970 cp->addr.type, hash192, rand192, 5971 hash256, rand256); 5972 if (err < 0) 5973 status = MGMT_STATUS_FAILED; 5974 else 5975 status = MGMT_STATUS_SUCCESS; 5976 5977 err = mgmt_cmd_complete(sk, hdev->id, 5978 MGMT_OP_ADD_REMOTE_OOB_DATA, 5979 status, &cp->addr, sizeof(cp->addr)); 5980 } else { 5981 bt_dev_err(hdev, "add_remote_oob_data: invalid len of %u bytes", 5982 len); 5983 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_REMOTE_OOB_DATA, 5984 MGMT_STATUS_INVALID_PARAMS); 5985 } 5986 5987 unlock: 5988 hci_dev_unlock(hdev); 5989 return err; 5990 } 5991 5992 static int remove_remote_oob_data(struct sock *sk, struct hci_dev *hdev, 5993 void *data, u16 len) 5994 { 5995 struct mgmt_cp_remove_remote_oob_data *cp = data; 5996 u8 status; 5997 int err; 5998 5999 bt_dev_dbg(hdev, "sock %p", sk); 6000 6001 if (cp->addr.type != BDADDR_BREDR) 6002 return mgmt_cmd_complete(sk, hdev->id, 6003 MGMT_OP_REMOVE_REMOTE_OOB_DATA, 6004 MGMT_STATUS_INVALID_PARAMS, 6005 &cp->addr, sizeof(cp->addr)); 6006 6007 hci_dev_lock(hdev); 6008 6009 if (!bacmp(&cp->addr.bdaddr, BDADDR_ANY)) { 6010 hci_remote_oob_data_clear(hdev); 6011 status = MGMT_STATUS_SUCCESS; 6012 goto done; 6013 } 6014 6015 err = hci_remove_remote_oob_data(hdev, &cp->addr.bdaddr, cp->addr.type); 6016 if (err < 0) 6017 status = MGMT_STATUS_INVALID_PARAMS; 6018 else 6019 status = MGMT_STATUS_SUCCESS; 6020 6021 done: 6022 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_REMOTE_OOB_DATA, 6023 status, &cp->addr, sizeof(cp->addr)); 6024 6025 hci_dev_unlock(hdev); 6026 return err; 6027 } 6028 6029 static bool discovery_type_is_valid(struct hci_dev *hdev, uint8_t type, 6030 uint8_t *mgmt_status) 6031 { 6032 switch (type) { 6033 case DISCOV_TYPE_LE: 6034 *mgmt_status = mgmt_le_support(hdev); 6035 if (*mgmt_status) 6036 return false; 6037 break; 6038 case DISCOV_TYPE_INTERLEAVED: 6039 *mgmt_status = mgmt_le_support(hdev); 6040 if (*mgmt_status) 6041 return false; 6042 fallthrough; 6043 case DISCOV_TYPE_BREDR: 6044 *mgmt_status = mgmt_bredr_support(hdev); 6045 if (*mgmt_status) 6046 return false; 6047 break; 6048 default: 6049 *mgmt_status = MGMT_STATUS_INVALID_PARAMS; 6050 return false; 6051 } 6052 6053 return true; 6054 } 6055 6056 static void start_discovery_complete(struct hci_dev *hdev, void *data, int err) 6057 { 6058 struct mgmt_pending_cmd *cmd = data; 6059 6060 bt_dev_dbg(hdev, "err %d", err); 6061 6062 if (err == -ECANCELED || !mgmt_pending_valid(hdev, cmd)) 6063 return; 6064 6065 mgmt_cmd_complete(cmd->sk, cmd->hdev->id, cmd->opcode, mgmt_status(err), 6066 cmd->param, 1); 6067 mgmt_pending_free(cmd); 6068 6069 hci_discovery_set_state(hdev, err ? DISCOVERY_STOPPED: 6070 DISCOVERY_FINDING); 6071 } 6072 6073 static int start_discovery_sync(struct hci_dev *hdev, void *data) 6074 { 6075 if (!mgmt_pending_listed(hdev, data)) 6076 return -ECANCELED; 6077 6078 return hci_start_discovery_sync(hdev); 6079 } 6080 6081 static int start_discovery_internal(struct sock *sk, struct hci_dev *hdev, 6082 u16 op, void *data, u16 len) 6083 { 6084 struct mgmt_cp_start_discovery *cp = data; 6085 struct mgmt_pending_cmd *cmd; 6086 u8 status; 6087 int err; 6088 6089 bt_dev_dbg(hdev, "sock %p", sk); 6090 6091 hci_dev_lock(hdev); 6092 6093 if (!hdev_is_powered(hdev)) { 6094 err = mgmt_cmd_complete(sk, hdev->id, op, 6095 MGMT_STATUS_NOT_POWERED, 6096 &cp->type, sizeof(cp->type)); 6097 goto failed; 6098 } 6099 6100 if (hdev->discovery.state != DISCOVERY_STOPPED || 6101 hci_dev_test_flag(hdev, HCI_PERIODIC_INQ)) { 6102 err = mgmt_cmd_complete(sk, hdev->id, op, MGMT_STATUS_BUSY, 6103 &cp->type, sizeof(cp->type)); 6104 goto failed; 6105 } 6106 6107 if (!discovery_type_is_valid(hdev, cp->type, &status)) { 6108 err = mgmt_cmd_complete(sk, hdev->id, op, status, 6109 &cp->type, sizeof(cp->type)); 6110 goto failed; 6111 } 6112 6113 /* Can't start discovery when it is paused */ 6114 if (hdev->discovery_paused) { 6115 err = mgmt_cmd_complete(sk, hdev->id, op, MGMT_STATUS_BUSY, 6116 &cp->type, sizeof(cp->type)); 6117 goto failed; 6118 } 6119 6120 /* Clear the discovery filter first to free any previously 6121 * allocated memory for the UUID list. 6122 */ 6123 hci_discovery_filter_clear(hdev); 6124 6125 hdev->discovery.type = cp->type; 6126 hdev->discovery.report_invalid_rssi = false; 6127 if (op == MGMT_OP_START_LIMITED_DISCOVERY) 6128 hdev->discovery.limited = true; 6129 else 6130 hdev->discovery.limited = false; 6131 6132 cmd = mgmt_pending_add(sk, op, hdev, data, len); 6133 if (!cmd) { 6134 err = -ENOMEM; 6135 goto failed; 6136 } 6137 6138 err = hci_cmd_sync_queue(hdev, start_discovery_sync, cmd, 6139 start_discovery_complete); 6140 if (err < 0) { 6141 mgmt_pending_remove(cmd); 6142 goto failed; 6143 } 6144 6145 hci_discovery_set_state(hdev, DISCOVERY_STARTING); 6146 6147 failed: 6148 hci_dev_unlock(hdev); 6149 return err; 6150 } 6151 6152 static int start_discovery(struct sock *sk, struct hci_dev *hdev, 6153 void *data, u16 len) 6154 { 6155 return start_discovery_internal(sk, hdev, MGMT_OP_START_DISCOVERY, 6156 data, len); 6157 } 6158 6159 static int start_limited_discovery(struct sock *sk, struct hci_dev *hdev, 6160 void *data, u16 len) 6161 { 6162 return start_discovery_internal(sk, hdev, 6163 MGMT_OP_START_LIMITED_DISCOVERY, 6164 data, len); 6165 } 6166 6167 static int start_service_discovery(struct sock *sk, struct hci_dev *hdev, 6168 void *data, u16 len) 6169 { 6170 struct mgmt_cp_start_service_discovery *cp = data; 6171 struct mgmt_pending_cmd *cmd; 6172 const u16 max_uuid_count = ((U16_MAX - sizeof(*cp)) / 16); 6173 u16 uuid_count, expected_len; 6174 u8 status; 6175 int err; 6176 6177 bt_dev_dbg(hdev, "sock %p", sk); 6178 6179 hci_dev_lock(hdev); 6180 6181 if (!hdev_is_powered(hdev)) { 6182 err = mgmt_cmd_complete(sk, hdev->id, 6183 MGMT_OP_START_SERVICE_DISCOVERY, 6184 MGMT_STATUS_NOT_POWERED, 6185 &cp->type, sizeof(cp->type)); 6186 goto failed; 6187 } 6188 6189 if (hdev->discovery.state != DISCOVERY_STOPPED || 6190 hci_dev_test_flag(hdev, HCI_PERIODIC_INQ)) { 6191 err = mgmt_cmd_complete(sk, hdev->id, 6192 MGMT_OP_START_SERVICE_DISCOVERY, 6193 MGMT_STATUS_BUSY, &cp->type, 6194 sizeof(cp->type)); 6195 goto failed; 6196 } 6197 6198 if (hdev->discovery_paused) { 6199 err = mgmt_cmd_complete(sk, hdev->id, 6200 MGMT_OP_START_SERVICE_DISCOVERY, 6201 MGMT_STATUS_BUSY, &cp->type, 6202 sizeof(cp->type)); 6203 goto failed; 6204 } 6205 6206 uuid_count = __le16_to_cpu(cp->uuid_count); 6207 if (uuid_count > max_uuid_count) { 6208 bt_dev_err(hdev, "service_discovery: too big uuid_count value %u", 6209 uuid_count); 6210 err = mgmt_cmd_complete(sk, hdev->id, 6211 MGMT_OP_START_SERVICE_DISCOVERY, 6212 MGMT_STATUS_INVALID_PARAMS, &cp->type, 6213 sizeof(cp->type)); 6214 goto failed; 6215 } 6216 6217 expected_len = sizeof(*cp) + uuid_count * 16; 6218 if (expected_len != len) { 6219 bt_dev_err(hdev, "service_discovery: expected %u bytes, got %u bytes", 6220 expected_len, len); 6221 err = mgmt_cmd_complete(sk, hdev->id, 6222 MGMT_OP_START_SERVICE_DISCOVERY, 6223 MGMT_STATUS_INVALID_PARAMS, &cp->type, 6224 sizeof(cp->type)); 6225 goto failed; 6226 } 6227 6228 if (!discovery_type_is_valid(hdev, cp->type, &status)) { 6229 err = mgmt_cmd_complete(sk, hdev->id, 6230 MGMT_OP_START_SERVICE_DISCOVERY, 6231 status, &cp->type, sizeof(cp->type)); 6232 goto failed; 6233 } 6234 6235 cmd = mgmt_pending_add(sk, MGMT_OP_START_SERVICE_DISCOVERY, 6236 hdev, data, len); 6237 if (!cmd) { 6238 err = -ENOMEM; 6239 goto failed; 6240 } 6241 6242 /* Clear the discovery filter first to free any previously 6243 * allocated memory for the UUID list. 6244 */ 6245 hci_discovery_filter_clear(hdev); 6246 6247 hdev->discovery.result_filtering = true; 6248 hdev->discovery.type = cp->type; 6249 hdev->discovery.rssi = cp->rssi; 6250 hdev->discovery.uuid_count = uuid_count; 6251 6252 if (uuid_count > 0) { 6253 hdev->discovery.uuids = kmemdup(cp->uuids, uuid_count * 16, 6254 GFP_KERNEL); 6255 if (!hdev->discovery.uuids) { 6256 err = mgmt_cmd_complete(sk, hdev->id, 6257 MGMT_OP_START_SERVICE_DISCOVERY, 6258 MGMT_STATUS_FAILED, 6259 &cp->type, sizeof(cp->type)); 6260 mgmt_pending_remove(cmd); 6261 goto failed; 6262 } 6263 } 6264 6265 err = hci_cmd_sync_queue(hdev, start_discovery_sync, cmd, 6266 start_discovery_complete); 6267 if (err < 0) { 6268 mgmt_pending_remove(cmd); 6269 goto failed; 6270 } 6271 6272 hci_discovery_set_state(hdev, DISCOVERY_STARTING); 6273 6274 failed: 6275 hci_dev_unlock(hdev); 6276 return err; 6277 } 6278 6279 static void stop_discovery_complete(struct hci_dev *hdev, void *data, int err) 6280 { 6281 struct mgmt_pending_cmd *cmd = data; 6282 6283 if (err == -ECANCELED || !mgmt_pending_valid(hdev, cmd)) 6284 return; 6285 6286 bt_dev_dbg(hdev, "err %d", err); 6287 6288 mgmt_cmd_complete(cmd->sk, cmd->hdev->id, cmd->opcode, mgmt_status(err), 6289 cmd->param, 1); 6290 mgmt_pending_free(cmd); 6291 6292 if (!err) 6293 hci_discovery_set_state(hdev, DISCOVERY_STOPPED); 6294 } 6295 6296 static int stop_discovery_sync(struct hci_dev *hdev, void *data) 6297 { 6298 if (!mgmt_pending_listed(hdev, data)) 6299 return -ECANCELED; 6300 6301 return hci_stop_discovery_sync(hdev); 6302 } 6303 6304 static int stop_discovery(struct sock *sk, struct hci_dev *hdev, void *data, 6305 u16 len) 6306 { 6307 struct mgmt_cp_stop_discovery *mgmt_cp = data; 6308 struct mgmt_pending_cmd *cmd; 6309 int err; 6310 6311 bt_dev_dbg(hdev, "sock %p", sk); 6312 6313 hci_dev_lock(hdev); 6314 6315 if (!hci_discovery_active(hdev)) { 6316 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY, 6317 MGMT_STATUS_REJECTED, &mgmt_cp->type, 6318 sizeof(mgmt_cp->type)); 6319 goto unlock; 6320 } 6321 6322 if (hdev->discovery.type != mgmt_cp->type) { 6323 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_STOP_DISCOVERY, 6324 MGMT_STATUS_INVALID_PARAMS, 6325 &mgmt_cp->type, sizeof(mgmt_cp->type)); 6326 goto unlock; 6327 } 6328 6329 cmd = mgmt_pending_add(sk, MGMT_OP_STOP_DISCOVERY, hdev, data, len); 6330 if (!cmd) { 6331 err = -ENOMEM; 6332 goto unlock; 6333 } 6334 6335 err = hci_cmd_sync_queue(hdev, stop_discovery_sync, cmd, 6336 stop_discovery_complete); 6337 if (err < 0) { 6338 mgmt_pending_remove(cmd); 6339 goto unlock; 6340 } 6341 6342 hci_discovery_set_state(hdev, DISCOVERY_STOPPING); 6343 6344 unlock: 6345 hci_dev_unlock(hdev); 6346 return err; 6347 } 6348 6349 static int confirm_name(struct sock *sk, struct hci_dev *hdev, void *data, 6350 u16 len) 6351 { 6352 struct mgmt_cp_confirm_name *cp = data; 6353 struct inquiry_entry *e; 6354 int err; 6355 6356 bt_dev_dbg(hdev, "sock %p", sk); 6357 6358 hci_dev_lock(hdev); 6359 6360 if (!hci_discovery_active(hdev)) { 6361 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME, 6362 MGMT_STATUS_FAILED, &cp->addr, 6363 sizeof(cp->addr)); 6364 goto failed; 6365 } 6366 6367 e = hci_inquiry_cache_lookup_unknown(hdev, &cp->addr.bdaddr); 6368 if (!e) { 6369 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME, 6370 MGMT_STATUS_INVALID_PARAMS, &cp->addr, 6371 sizeof(cp->addr)); 6372 goto failed; 6373 } 6374 6375 if (cp->name_known) { 6376 e->name_state = NAME_KNOWN; 6377 list_del(&e->list); 6378 } else { 6379 e->name_state = NAME_NEEDED; 6380 hci_inquiry_cache_update_resolve(hdev, e); 6381 } 6382 6383 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_CONFIRM_NAME, 0, 6384 &cp->addr, sizeof(cp->addr)); 6385 6386 failed: 6387 hci_dev_unlock(hdev); 6388 return err; 6389 } 6390 6391 static int block_device(struct sock *sk, struct hci_dev *hdev, void *data, 6392 u16 len) 6393 { 6394 struct mgmt_cp_block_device *cp = data; 6395 u8 status; 6396 int err; 6397 6398 bt_dev_dbg(hdev, "sock %p", sk); 6399 6400 if (!bdaddr_type_is_valid(cp->addr.type)) 6401 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_BLOCK_DEVICE, 6402 MGMT_STATUS_INVALID_PARAMS, 6403 &cp->addr, sizeof(cp->addr)); 6404 6405 hci_dev_lock(hdev); 6406 6407 err = hci_bdaddr_list_add(&hdev->reject_list, &cp->addr.bdaddr, 6408 cp->addr.type); 6409 if (err < 0) { 6410 status = MGMT_STATUS_FAILED; 6411 goto done; 6412 } 6413 6414 mgmt_event(MGMT_EV_DEVICE_BLOCKED, hdev, &cp->addr, sizeof(cp->addr), 6415 sk); 6416 status = MGMT_STATUS_SUCCESS; 6417 6418 done: 6419 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_BLOCK_DEVICE, status, 6420 &cp->addr, sizeof(cp->addr)); 6421 6422 hci_dev_unlock(hdev); 6423 6424 return err; 6425 } 6426 6427 static int unblock_device(struct sock *sk, struct hci_dev *hdev, void *data, 6428 u16 len) 6429 { 6430 struct mgmt_cp_unblock_device *cp = data; 6431 u8 status; 6432 int err; 6433 6434 bt_dev_dbg(hdev, "sock %p", sk); 6435 6436 if (!bdaddr_type_is_valid(cp->addr.type)) 6437 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNBLOCK_DEVICE, 6438 MGMT_STATUS_INVALID_PARAMS, 6439 &cp->addr, sizeof(cp->addr)); 6440 6441 hci_dev_lock(hdev); 6442 6443 err = hci_bdaddr_list_del(&hdev->reject_list, &cp->addr.bdaddr, 6444 cp->addr.type); 6445 if (err < 0) { 6446 status = MGMT_STATUS_INVALID_PARAMS; 6447 goto done; 6448 } 6449 6450 mgmt_event(MGMT_EV_DEVICE_UNBLOCKED, hdev, &cp->addr, sizeof(cp->addr), 6451 sk); 6452 status = MGMT_STATUS_SUCCESS; 6453 6454 done: 6455 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_UNBLOCK_DEVICE, status, 6456 &cp->addr, sizeof(cp->addr)); 6457 6458 hci_dev_unlock(hdev); 6459 6460 return err; 6461 } 6462 6463 static int set_device_id_sync(struct hci_dev *hdev, void *data) 6464 { 6465 return hci_update_eir_sync(hdev); 6466 } 6467 6468 static int set_device_id(struct sock *sk, struct hci_dev *hdev, void *data, 6469 u16 len) 6470 { 6471 struct mgmt_cp_set_device_id *cp = data; 6472 int err; 6473 __u16 source; 6474 6475 bt_dev_dbg(hdev, "sock %p", sk); 6476 6477 source = __le16_to_cpu(cp->source); 6478 6479 if (source > 0x0002) 6480 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEVICE_ID, 6481 MGMT_STATUS_INVALID_PARAMS); 6482 6483 hci_dev_lock(hdev); 6484 6485 hdev->devid_source = source; 6486 hdev->devid_vendor = __le16_to_cpu(cp->vendor); 6487 hdev->devid_product = __le16_to_cpu(cp->product); 6488 hdev->devid_version = __le16_to_cpu(cp->version); 6489 6490 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_DEVICE_ID, 0, 6491 NULL, 0); 6492 6493 hci_cmd_sync_queue(hdev, set_device_id_sync, NULL, NULL); 6494 6495 hci_dev_unlock(hdev); 6496 6497 return err; 6498 } 6499 6500 static void enable_advertising_instance(struct hci_dev *hdev, int err) 6501 { 6502 if (err) 6503 bt_dev_err(hdev, "failed to re-configure advertising %d", err); 6504 else 6505 bt_dev_dbg(hdev, "status %d", err); 6506 } 6507 6508 static void set_advertising_complete(struct hci_dev *hdev, void *data, int err) 6509 { 6510 struct mgmt_pending_cmd *cmd = data; 6511 struct cmd_lookup match = { NULL, hdev }; 6512 u8 instance; 6513 struct adv_info *adv_instance; 6514 u8 status = mgmt_status(err); 6515 6516 if (err == -ECANCELED || !mgmt_pending_valid(hdev, data)) 6517 return; 6518 6519 if (status) { 6520 mgmt_cmd_status(cmd->sk, cmd->hdev->id, cmd->opcode, status); 6521 mgmt_pending_free(cmd); 6522 return; 6523 } 6524 6525 if (hci_dev_test_flag(hdev, HCI_LE_ADV)) 6526 hci_dev_set_flag(hdev, HCI_ADVERTISING); 6527 else 6528 hci_dev_clear_flag(hdev, HCI_ADVERTISING); 6529 6530 settings_rsp(cmd, &match); 6531 mgmt_pending_free(cmd); 6532 6533 new_settings(hdev, match.sk); 6534 6535 if (match.sk) 6536 sock_put(match.sk); 6537 6538 /* If "Set Advertising" was just disabled and instance advertising was 6539 * set up earlier, then re-enable multi-instance advertising. 6540 */ 6541 if (hci_dev_test_flag(hdev, HCI_ADVERTISING) || 6542 list_empty(&hdev->adv_instances)) 6543 return; 6544 6545 instance = hdev->cur_adv_instance; 6546 if (!instance) { 6547 adv_instance = list_first_entry_or_null(&hdev->adv_instances, 6548 struct adv_info, list); 6549 if (!adv_instance) 6550 return; 6551 6552 instance = adv_instance->instance; 6553 } 6554 6555 err = hci_schedule_adv_instance_sync(hdev, instance, true); 6556 6557 enable_advertising_instance(hdev, err); 6558 } 6559 6560 static int set_adv_sync(struct hci_dev *hdev, void *data) 6561 { 6562 struct mgmt_pending_cmd *cmd = data; 6563 struct mgmt_mode cp; 6564 u8 val; 6565 6566 mutex_lock(&hdev->mgmt_pending_lock); 6567 6568 if (!__mgmt_pending_listed(hdev, cmd)) { 6569 mutex_unlock(&hdev->mgmt_pending_lock); 6570 return -ECANCELED; 6571 } 6572 6573 memcpy(&cp, cmd->param, sizeof(cp)); 6574 6575 mutex_unlock(&hdev->mgmt_pending_lock); 6576 6577 val = !!cp.val; 6578 6579 if (cp.val == 0x02) 6580 hci_dev_set_flag(hdev, HCI_ADVERTISING_CONNECTABLE); 6581 else 6582 hci_dev_clear_flag(hdev, HCI_ADVERTISING_CONNECTABLE); 6583 6584 cancel_adv_timeout(hdev); 6585 6586 if (val) { 6587 /* Switch to instance "0" for the Set Advertising setting. 6588 * We cannot use update_[adv|scan_rsp]_data() here as the 6589 * HCI_ADVERTISING flag is not yet set. 6590 */ 6591 hdev->cur_adv_instance = 0x00; 6592 6593 if (ext_adv_capable(hdev)) { 6594 hci_start_ext_adv_sync(hdev, 0x00); 6595 } else { 6596 hci_update_adv_data_sync(hdev, 0x00); 6597 hci_update_scan_rsp_data_sync(hdev, 0x00); 6598 hci_enable_advertising_sync(hdev); 6599 } 6600 } else { 6601 hci_disable_advertising_sync(hdev); 6602 } 6603 6604 return 0; 6605 } 6606 6607 static int set_advertising(struct sock *sk, struct hci_dev *hdev, void *data, 6608 u16 len) 6609 { 6610 struct mgmt_mode *cp = data; 6611 struct mgmt_pending_cmd *cmd; 6612 u8 val, status; 6613 int err; 6614 6615 bt_dev_dbg(hdev, "sock %p", sk); 6616 6617 status = mgmt_le_support(hdev); 6618 if (status) 6619 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING, 6620 status); 6621 6622 if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02) 6623 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING, 6624 MGMT_STATUS_INVALID_PARAMS); 6625 6626 if (hdev->advertising_paused) 6627 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING, 6628 MGMT_STATUS_BUSY); 6629 6630 hci_dev_lock(hdev); 6631 6632 val = !!cp->val; 6633 6634 /* The following conditions are ones which mean that we should 6635 * not do any HCI communication but directly send a mgmt 6636 * response to user space (after toggling the flag if 6637 * necessary). 6638 */ 6639 if (!hdev_is_powered(hdev) || 6640 (val == hci_dev_test_flag(hdev, HCI_ADVERTISING) && 6641 (cp->val == 0x02) == hci_dev_test_flag(hdev, HCI_ADVERTISING_CONNECTABLE)) || 6642 hci_dev_test_flag(hdev, HCI_MESH) || 6643 hci_conn_num(hdev, LE_LINK) > 0 || 6644 (hci_dev_test_flag(hdev, HCI_LE_SCAN) && 6645 hdev->le_scan_type == LE_SCAN_ACTIVE)) { 6646 bool changed; 6647 6648 if (cp->val) { 6649 hdev->cur_adv_instance = 0x00; 6650 changed = !hci_dev_test_and_set_flag(hdev, HCI_ADVERTISING); 6651 if (cp->val == 0x02) 6652 hci_dev_set_flag(hdev, HCI_ADVERTISING_CONNECTABLE); 6653 else 6654 hci_dev_clear_flag(hdev, HCI_ADVERTISING_CONNECTABLE); 6655 } else { 6656 changed = hci_dev_test_and_clear_flag(hdev, HCI_ADVERTISING); 6657 hci_dev_clear_flag(hdev, HCI_ADVERTISING_CONNECTABLE); 6658 } 6659 6660 err = send_settings_rsp(sk, MGMT_OP_SET_ADVERTISING, hdev); 6661 if (err < 0) 6662 goto unlock; 6663 6664 if (changed) 6665 err = new_settings(hdev, sk); 6666 6667 goto unlock; 6668 } 6669 6670 if (pending_find(MGMT_OP_SET_ADVERTISING, hdev) || 6671 pending_find(MGMT_OP_SET_LE, hdev)) { 6672 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_ADVERTISING, 6673 MGMT_STATUS_BUSY); 6674 goto unlock; 6675 } 6676 6677 cmd = mgmt_pending_add(sk, MGMT_OP_SET_ADVERTISING, hdev, data, len); 6678 if (!cmd) 6679 err = -ENOMEM; 6680 else 6681 err = hci_cmd_sync_queue(hdev, set_adv_sync, cmd, 6682 set_advertising_complete); 6683 6684 if (err < 0 && cmd) 6685 mgmt_pending_remove(cmd); 6686 6687 unlock: 6688 hci_dev_unlock(hdev); 6689 return err; 6690 } 6691 6692 static int set_static_address(struct sock *sk, struct hci_dev *hdev, 6693 void *data, u16 len) 6694 { 6695 struct mgmt_cp_set_static_address *cp = data; 6696 int err; 6697 6698 bt_dev_dbg(hdev, "sock %p", sk); 6699 6700 if (!lmp_le_capable(hdev)) 6701 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_STATIC_ADDRESS, 6702 MGMT_STATUS_NOT_SUPPORTED); 6703 6704 if (hdev_is_powered(hdev)) 6705 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_STATIC_ADDRESS, 6706 MGMT_STATUS_REJECTED); 6707 6708 if (bacmp(&cp->bdaddr, BDADDR_ANY)) { 6709 if (!bacmp(&cp->bdaddr, BDADDR_NONE)) 6710 return mgmt_cmd_status(sk, hdev->id, 6711 MGMT_OP_SET_STATIC_ADDRESS, 6712 MGMT_STATUS_INVALID_PARAMS); 6713 6714 /* Two most significant bits shall be set */ 6715 if ((cp->bdaddr.b[5] & 0xc0) != 0xc0) 6716 return mgmt_cmd_status(sk, hdev->id, 6717 MGMT_OP_SET_STATIC_ADDRESS, 6718 MGMT_STATUS_INVALID_PARAMS); 6719 } 6720 6721 hci_dev_lock(hdev); 6722 6723 bacpy(&hdev->static_addr, &cp->bdaddr); 6724 6725 err = send_settings_rsp(sk, MGMT_OP_SET_STATIC_ADDRESS, hdev); 6726 if (err < 0) 6727 goto unlock; 6728 6729 err = new_settings(hdev, sk); 6730 6731 unlock: 6732 hci_dev_unlock(hdev); 6733 return err; 6734 } 6735 6736 static int set_scan_params(struct sock *sk, struct hci_dev *hdev, 6737 void *data, u16 len) 6738 { 6739 struct mgmt_cp_set_scan_params *cp = data; 6740 __u16 interval, window; 6741 int err; 6742 6743 bt_dev_dbg(hdev, "sock %p", sk); 6744 6745 if (!lmp_le_capable(hdev)) 6746 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS, 6747 MGMT_STATUS_NOT_SUPPORTED); 6748 6749 /* Keep allowed ranges in sync with set_mesh() */ 6750 interval = __le16_to_cpu(cp->interval); 6751 6752 if (interval < 0x0004 || interval > 0x4000) 6753 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS, 6754 MGMT_STATUS_INVALID_PARAMS); 6755 6756 window = __le16_to_cpu(cp->window); 6757 6758 if (window < 0x0004 || window > 0x4000) 6759 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS, 6760 MGMT_STATUS_INVALID_PARAMS); 6761 6762 if (window > interval) 6763 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS, 6764 MGMT_STATUS_INVALID_PARAMS); 6765 6766 hci_dev_lock(hdev); 6767 6768 hdev->le_scan_interval = interval; 6769 hdev->le_scan_window = window; 6770 6771 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_SET_SCAN_PARAMS, 0, 6772 NULL, 0); 6773 6774 /* If background scan is running, restart it so new parameters are 6775 * loaded. 6776 */ 6777 if (hci_dev_test_flag(hdev, HCI_LE_SCAN) && 6778 hdev->discovery.state == DISCOVERY_STOPPED) 6779 hci_update_passive_scan(hdev); 6780 6781 hci_dev_unlock(hdev); 6782 6783 return err; 6784 } 6785 6786 static void fast_connectable_complete(struct hci_dev *hdev, void *data, int err) 6787 { 6788 struct mgmt_pending_cmd *cmd = data; 6789 6790 bt_dev_dbg(hdev, "err %d", err); 6791 6792 if (err) { 6793 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE, 6794 mgmt_status(err)); 6795 } else { 6796 struct mgmt_mode *cp = cmd->param; 6797 6798 if (cp->val) 6799 hci_dev_set_flag(hdev, HCI_FAST_CONNECTABLE); 6800 else 6801 hci_dev_clear_flag(hdev, HCI_FAST_CONNECTABLE); 6802 6803 send_settings_rsp(cmd->sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev); 6804 new_settings(hdev, cmd->sk); 6805 } 6806 6807 mgmt_pending_free(cmd); 6808 } 6809 6810 static int write_fast_connectable_sync(struct hci_dev *hdev, void *data) 6811 { 6812 struct mgmt_pending_cmd *cmd = data; 6813 struct mgmt_mode *cp = cmd->param; 6814 6815 return hci_write_fast_connectable_sync(hdev, cp->val); 6816 } 6817 6818 static int set_fast_connectable(struct sock *sk, struct hci_dev *hdev, 6819 void *data, u16 len) 6820 { 6821 struct mgmt_mode *cp = data; 6822 struct mgmt_pending_cmd *cmd; 6823 int err; 6824 6825 bt_dev_dbg(hdev, "sock %p", sk); 6826 6827 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) || 6828 hdev->hci_ver < BLUETOOTH_VER_1_2) 6829 return mgmt_cmd_status(sk, hdev->id, 6830 MGMT_OP_SET_FAST_CONNECTABLE, 6831 MGMT_STATUS_NOT_SUPPORTED); 6832 6833 if (cp->val != 0x00 && cp->val != 0x01) 6834 return mgmt_cmd_status(sk, hdev->id, 6835 MGMT_OP_SET_FAST_CONNECTABLE, 6836 MGMT_STATUS_INVALID_PARAMS); 6837 6838 hci_dev_lock(hdev); 6839 6840 if (!!cp->val == hci_dev_test_flag(hdev, HCI_FAST_CONNECTABLE)) { 6841 err = send_settings_rsp(sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev); 6842 goto unlock; 6843 } 6844 6845 if (!hdev_is_powered(hdev)) { 6846 hci_dev_change_flag(hdev, HCI_FAST_CONNECTABLE); 6847 err = send_settings_rsp(sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev); 6848 new_settings(hdev, sk); 6849 goto unlock; 6850 } 6851 6852 cmd = mgmt_pending_new(sk, MGMT_OP_SET_FAST_CONNECTABLE, hdev, data, 6853 len); 6854 if (!cmd) 6855 err = -ENOMEM; 6856 else 6857 err = hci_cmd_sync_queue(hdev, write_fast_connectable_sync, cmd, 6858 fast_connectable_complete); 6859 6860 if (err < 0) { 6861 mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_FAST_CONNECTABLE, 6862 MGMT_STATUS_FAILED); 6863 6864 if (cmd) 6865 mgmt_pending_free(cmd); 6866 } 6867 6868 unlock: 6869 hci_dev_unlock(hdev); 6870 6871 return err; 6872 } 6873 6874 static void set_bredr_complete(struct hci_dev *hdev, void *data, int err) 6875 { 6876 struct mgmt_pending_cmd *cmd = data; 6877 6878 bt_dev_dbg(hdev, "err %d", err); 6879 6880 if (err) { 6881 u8 mgmt_err = mgmt_status(err); 6882 6883 /* We need to restore the flag if related HCI commands 6884 * failed. 6885 */ 6886 hci_dev_clear_flag(hdev, HCI_BREDR_ENABLED); 6887 6888 mgmt_cmd_status(cmd->sk, cmd->hdev->id, cmd->opcode, mgmt_err); 6889 } else { 6890 send_settings_rsp(cmd->sk, MGMT_OP_SET_BREDR, hdev); 6891 new_settings(hdev, cmd->sk); 6892 } 6893 6894 mgmt_pending_free(cmd); 6895 } 6896 6897 static int set_bredr_sync(struct hci_dev *hdev, void *data) 6898 { 6899 int status; 6900 6901 status = hci_write_fast_connectable_sync(hdev, false); 6902 6903 if (!status) 6904 status = hci_update_scan_sync(hdev); 6905 6906 /* Since only the advertising data flags will change, there 6907 * is no need to update the scan response data. 6908 */ 6909 if (!status) 6910 status = hci_update_adv_data_sync(hdev, hdev->cur_adv_instance); 6911 6912 return status; 6913 } 6914 6915 static int set_bredr(struct sock *sk, struct hci_dev *hdev, void *data, u16 len) 6916 { 6917 struct mgmt_mode *cp = data; 6918 struct mgmt_pending_cmd *cmd; 6919 int err; 6920 6921 bt_dev_dbg(hdev, "sock %p", sk); 6922 6923 if (!lmp_bredr_capable(hdev) || !lmp_le_capable(hdev)) 6924 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR, 6925 MGMT_STATUS_NOT_SUPPORTED); 6926 6927 if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED)) 6928 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR, 6929 MGMT_STATUS_REJECTED); 6930 6931 if (cp->val != 0x00 && cp->val != 0x01) 6932 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR, 6933 MGMT_STATUS_INVALID_PARAMS); 6934 6935 hci_dev_lock(hdev); 6936 6937 if (cp->val == hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) { 6938 err = send_settings_rsp(sk, MGMT_OP_SET_BREDR, hdev); 6939 goto unlock; 6940 } 6941 6942 if (!hdev_is_powered(hdev)) { 6943 if (!cp->val) { 6944 hci_dev_clear_flag(hdev, HCI_DISCOVERABLE); 6945 hci_dev_clear_flag(hdev, HCI_SSP_ENABLED); 6946 hci_dev_clear_flag(hdev, HCI_LINK_SECURITY); 6947 hci_dev_clear_flag(hdev, HCI_FAST_CONNECTABLE); 6948 } 6949 6950 hci_dev_change_flag(hdev, HCI_BREDR_ENABLED); 6951 6952 err = send_settings_rsp(sk, MGMT_OP_SET_BREDR, hdev); 6953 if (err < 0) 6954 goto unlock; 6955 6956 err = new_settings(hdev, sk); 6957 goto unlock; 6958 } 6959 6960 /* Reject disabling when powered on */ 6961 if (!cp->val) { 6962 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR, 6963 MGMT_STATUS_REJECTED); 6964 goto unlock; 6965 } else { 6966 /* When configuring a dual-mode controller to operate 6967 * with LE only and using a static address, then switching 6968 * BR/EDR back on is not allowed. 6969 * 6970 * Dual-mode controllers shall operate with the public 6971 * address as its identity address for BR/EDR and LE. So 6972 * reject the attempt to create an invalid configuration. 6973 * 6974 * The same restrictions applies when secure connections 6975 * has been enabled. For BR/EDR this is a controller feature 6976 * while for LE it is a host stack feature. This means that 6977 * switching BR/EDR back on when secure connections has been 6978 * enabled is not a supported transaction. 6979 */ 6980 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) && 6981 (bacmp(&hdev->static_addr, BDADDR_ANY) || 6982 hci_dev_test_flag(hdev, HCI_SC_ENABLED))) { 6983 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR, 6984 MGMT_STATUS_REJECTED); 6985 goto unlock; 6986 } 6987 } 6988 6989 cmd = mgmt_pending_new(sk, MGMT_OP_SET_BREDR, hdev, data, len); 6990 if (!cmd) 6991 err = -ENOMEM; 6992 else 6993 err = hci_cmd_sync_queue(hdev, set_bredr_sync, cmd, 6994 set_bredr_complete); 6995 6996 if (err < 0) { 6997 mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_BREDR, 6998 MGMT_STATUS_FAILED); 6999 if (cmd) 7000 mgmt_pending_free(cmd); 7001 7002 goto unlock; 7003 } 7004 7005 /* We need to flip the bit already here so that 7006 * hci_req_update_adv_data generates the correct flags. 7007 */ 7008 hci_dev_set_flag(hdev, HCI_BREDR_ENABLED); 7009 7010 unlock: 7011 hci_dev_unlock(hdev); 7012 return err; 7013 } 7014 7015 static void set_secure_conn_complete(struct hci_dev *hdev, void *data, int err) 7016 { 7017 struct mgmt_pending_cmd *cmd = data; 7018 struct mgmt_mode *cp; 7019 7020 bt_dev_dbg(hdev, "err %d", err); 7021 7022 if (err) { 7023 u8 mgmt_err = mgmt_status(err); 7024 7025 mgmt_cmd_status(cmd->sk, cmd->hdev->id, cmd->opcode, mgmt_err); 7026 goto done; 7027 } 7028 7029 cp = cmd->param; 7030 7031 switch (cp->val) { 7032 case 0x00: 7033 hci_dev_clear_flag(hdev, HCI_SC_ENABLED); 7034 hci_dev_clear_flag(hdev, HCI_SC_ONLY); 7035 break; 7036 case 0x01: 7037 hci_dev_set_flag(hdev, HCI_SC_ENABLED); 7038 hci_dev_clear_flag(hdev, HCI_SC_ONLY); 7039 break; 7040 case 0x02: 7041 hci_dev_set_flag(hdev, HCI_SC_ENABLED); 7042 hci_dev_set_flag(hdev, HCI_SC_ONLY); 7043 break; 7044 } 7045 7046 send_settings_rsp(cmd->sk, cmd->opcode, hdev); 7047 new_settings(hdev, cmd->sk); 7048 7049 done: 7050 mgmt_pending_free(cmd); 7051 } 7052 7053 static int set_secure_conn_sync(struct hci_dev *hdev, void *data) 7054 { 7055 struct mgmt_pending_cmd *cmd = data; 7056 struct mgmt_mode *cp = cmd->param; 7057 u8 val = !!cp->val; 7058 7059 /* Force write of val */ 7060 hci_dev_set_flag(hdev, HCI_SC_ENABLED); 7061 7062 return hci_write_sc_support_sync(hdev, val); 7063 } 7064 7065 static int set_secure_conn(struct sock *sk, struct hci_dev *hdev, 7066 void *data, u16 len) 7067 { 7068 struct mgmt_mode *cp = data; 7069 struct mgmt_pending_cmd *cmd; 7070 u8 val; 7071 int err; 7072 7073 bt_dev_dbg(hdev, "sock %p", sk); 7074 7075 if (!lmp_sc_capable(hdev) && 7076 !hci_dev_test_flag(hdev, HCI_LE_ENABLED)) 7077 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN, 7078 MGMT_STATUS_NOT_SUPPORTED); 7079 7080 if (hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) && 7081 lmp_sc_capable(hdev) && 7082 !hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) 7083 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN, 7084 MGMT_STATUS_REJECTED); 7085 7086 if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02) 7087 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN, 7088 MGMT_STATUS_INVALID_PARAMS); 7089 7090 hci_dev_lock(hdev); 7091 7092 if (!hdev_is_powered(hdev) || !lmp_sc_capable(hdev) || 7093 !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) { 7094 bool changed; 7095 7096 if (cp->val) { 7097 changed = !hci_dev_test_and_set_flag(hdev, 7098 HCI_SC_ENABLED); 7099 if (cp->val == 0x02) 7100 hci_dev_set_flag(hdev, HCI_SC_ONLY); 7101 else 7102 hci_dev_clear_flag(hdev, HCI_SC_ONLY); 7103 } else { 7104 changed = hci_dev_test_and_clear_flag(hdev, 7105 HCI_SC_ENABLED); 7106 hci_dev_clear_flag(hdev, HCI_SC_ONLY); 7107 } 7108 7109 err = send_settings_rsp(sk, MGMT_OP_SET_SECURE_CONN, hdev); 7110 if (err < 0) 7111 goto failed; 7112 7113 if (changed) 7114 err = new_settings(hdev, sk); 7115 7116 goto failed; 7117 } 7118 7119 val = !!cp->val; 7120 7121 if (val == hci_dev_test_flag(hdev, HCI_SC_ENABLED) && 7122 (cp->val == 0x02) == hci_dev_test_flag(hdev, HCI_SC_ONLY)) { 7123 err = send_settings_rsp(sk, MGMT_OP_SET_SECURE_CONN, hdev); 7124 goto failed; 7125 } 7126 7127 cmd = mgmt_pending_new(sk, MGMT_OP_SET_SECURE_CONN, hdev, data, len); 7128 if (!cmd) 7129 err = -ENOMEM; 7130 else 7131 err = hci_cmd_sync_queue(hdev, set_secure_conn_sync, cmd, 7132 set_secure_conn_complete); 7133 7134 if (err < 0) { 7135 mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_SECURE_CONN, 7136 MGMT_STATUS_FAILED); 7137 if (cmd) 7138 mgmt_pending_free(cmd); 7139 } 7140 7141 failed: 7142 hci_dev_unlock(hdev); 7143 return err; 7144 } 7145 7146 static int set_debug_keys(struct sock *sk, struct hci_dev *hdev, 7147 void *data, u16 len) 7148 { 7149 struct mgmt_mode *cp = data; 7150 bool changed, use_changed; 7151 int err; 7152 7153 bt_dev_dbg(hdev, "sock %p", sk); 7154 7155 if (cp->val != 0x00 && cp->val != 0x01 && cp->val != 0x02) 7156 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_DEBUG_KEYS, 7157 MGMT_STATUS_INVALID_PARAMS); 7158 7159 hci_dev_lock(hdev); 7160 7161 if (cp->val) 7162 changed = !hci_dev_test_and_set_flag(hdev, HCI_KEEP_DEBUG_KEYS); 7163 else 7164 changed = hci_dev_test_and_clear_flag(hdev, 7165 HCI_KEEP_DEBUG_KEYS); 7166 7167 if (cp->val == 0x02) 7168 use_changed = !hci_dev_test_and_set_flag(hdev, 7169 HCI_USE_DEBUG_KEYS); 7170 else 7171 use_changed = hci_dev_test_and_clear_flag(hdev, 7172 HCI_USE_DEBUG_KEYS); 7173 7174 if (hdev_is_powered(hdev) && use_changed && 7175 hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) { 7176 u8 mode = (cp->val == 0x02) ? 0x01 : 0x00; 7177 hci_send_cmd(hdev, HCI_OP_WRITE_SSP_DEBUG_MODE, 7178 sizeof(mode), &mode); 7179 } 7180 7181 err = send_settings_rsp(sk, MGMT_OP_SET_DEBUG_KEYS, hdev); 7182 if (err < 0) 7183 goto unlock; 7184 7185 if (changed) 7186 err = new_settings(hdev, sk); 7187 7188 unlock: 7189 hci_dev_unlock(hdev); 7190 return err; 7191 } 7192 7193 static int set_privacy(struct sock *sk, struct hci_dev *hdev, void *cp_data, 7194 u16 len) 7195 { 7196 struct mgmt_cp_set_privacy *cp = cp_data; 7197 bool changed; 7198 int err; 7199 7200 bt_dev_dbg(hdev, "sock %p", sk); 7201 7202 if (!lmp_le_capable(hdev)) 7203 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY, 7204 MGMT_STATUS_NOT_SUPPORTED); 7205 7206 if (cp->privacy != 0x00 && cp->privacy != 0x01 && cp->privacy != 0x02) 7207 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY, 7208 MGMT_STATUS_INVALID_PARAMS); 7209 7210 if (hdev_is_powered(hdev)) 7211 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PRIVACY, 7212 MGMT_STATUS_REJECTED); 7213 7214 hci_dev_lock(hdev); 7215 7216 /* If user space supports this command it is also expected to 7217 * handle IRKs. Therefore, set the HCI_RPA_RESOLVING flag. 7218 */ 7219 hci_dev_set_flag(hdev, HCI_RPA_RESOLVING); 7220 7221 if (cp->privacy) { 7222 changed = !hci_dev_test_and_set_flag(hdev, HCI_PRIVACY); 7223 memcpy(hdev->irk, cp->irk, sizeof(hdev->irk)); 7224 hci_dev_set_flag(hdev, HCI_RPA_EXPIRED); 7225 hci_adv_instances_set_rpa_expired(hdev, true); 7226 if (cp->privacy == 0x02) 7227 hci_dev_set_flag(hdev, HCI_LIMITED_PRIVACY); 7228 else 7229 hci_dev_clear_flag(hdev, HCI_LIMITED_PRIVACY); 7230 } else { 7231 changed = hci_dev_test_and_clear_flag(hdev, HCI_PRIVACY); 7232 memset(hdev->irk, 0, sizeof(hdev->irk)); 7233 hci_dev_clear_flag(hdev, HCI_RPA_EXPIRED); 7234 hci_adv_instances_set_rpa_expired(hdev, false); 7235 hci_dev_clear_flag(hdev, HCI_LIMITED_PRIVACY); 7236 } 7237 7238 err = send_settings_rsp(sk, MGMT_OP_SET_PRIVACY, hdev); 7239 if (err < 0) 7240 goto unlock; 7241 7242 if (changed) 7243 err = new_settings(hdev, sk); 7244 7245 unlock: 7246 hci_dev_unlock(hdev); 7247 return err; 7248 } 7249 7250 static bool irk_is_valid(struct mgmt_irk_info *irk) 7251 { 7252 switch (irk->addr.type) { 7253 case BDADDR_LE_PUBLIC: 7254 return true; 7255 7256 case BDADDR_LE_RANDOM: 7257 /* Two most significant bits shall be set */ 7258 if ((irk->addr.bdaddr.b[5] & 0xc0) != 0xc0) 7259 return false; 7260 return true; 7261 } 7262 7263 return false; 7264 } 7265 7266 static int load_irks(struct sock *sk, struct hci_dev *hdev, void *cp_data, 7267 u16 len) 7268 { 7269 struct mgmt_cp_load_irks *cp = cp_data; 7270 const u16 max_irk_count = ((U16_MAX - sizeof(*cp)) / 7271 sizeof(struct mgmt_irk_info)); 7272 u16 irk_count, expected_len; 7273 int i, err; 7274 7275 bt_dev_dbg(hdev, "sock %p", sk); 7276 7277 if (!lmp_le_capable(hdev)) 7278 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS, 7279 MGMT_STATUS_NOT_SUPPORTED); 7280 7281 irk_count = __le16_to_cpu(cp->irk_count); 7282 if (irk_count > max_irk_count) { 7283 bt_dev_err(hdev, "load_irks: too big irk_count value %u", 7284 irk_count); 7285 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS, 7286 MGMT_STATUS_INVALID_PARAMS); 7287 } 7288 7289 expected_len = struct_size(cp, irks, irk_count); 7290 if (expected_len != len) { 7291 bt_dev_err(hdev, "load_irks: expected %u bytes, got %u bytes", 7292 expected_len, len); 7293 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_IRKS, 7294 MGMT_STATUS_INVALID_PARAMS); 7295 } 7296 7297 bt_dev_dbg(hdev, "irk_count %u", irk_count); 7298 7299 for (i = 0; i < irk_count; i++) { 7300 struct mgmt_irk_info *key = &cp->irks[i]; 7301 7302 if (!irk_is_valid(key)) 7303 return mgmt_cmd_status(sk, hdev->id, 7304 MGMT_OP_LOAD_IRKS, 7305 MGMT_STATUS_INVALID_PARAMS); 7306 } 7307 7308 hci_dev_lock(hdev); 7309 7310 hci_smp_irks_clear(hdev); 7311 7312 for (i = 0; i < irk_count; i++) { 7313 struct mgmt_irk_info *irk = &cp->irks[i]; 7314 7315 if (hci_is_blocked_key(hdev, 7316 HCI_BLOCKED_KEY_TYPE_IRK, 7317 irk->val)) { 7318 bt_dev_warn(hdev, "Skipping blocked IRK for %pMR", 7319 &irk->addr.bdaddr); 7320 continue; 7321 } 7322 7323 hci_add_irk(hdev, &irk->addr.bdaddr, 7324 le_addr_type(irk->addr.type), irk->val, 7325 BDADDR_ANY); 7326 } 7327 7328 hci_dev_set_flag(hdev, HCI_RPA_RESOLVING); 7329 7330 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_IRKS, 0, NULL, 0); 7331 7332 hci_dev_unlock(hdev); 7333 7334 return err; 7335 } 7336 7337 static bool ltk_is_valid(struct mgmt_ltk_info *key) 7338 { 7339 if (key->initiator != 0x00 && key->initiator != 0x01) 7340 return false; 7341 7342 if (key->enc_size > sizeof(key->val)) 7343 return false; 7344 7345 switch (key->addr.type) { 7346 case BDADDR_LE_PUBLIC: 7347 return true; 7348 7349 case BDADDR_LE_RANDOM: 7350 /* Two most significant bits shall be set */ 7351 if ((key->addr.bdaddr.b[5] & 0xc0) != 0xc0) 7352 return false; 7353 return true; 7354 } 7355 7356 return false; 7357 } 7358 7359 static int load_long_term_keys(struct sock *sk, struct hci_dev *hdev, 7360 void *cp_data, u16 len) 7361 { 7362 struct mgmt_cp_load_long_term_keys *cp = cp_data; 7363 const u16 max_key_count = ((U16_MAX - sizeof(*cp)) / 7364 sizeof(struct mgmt_ltk_info)); 7365 u16 key_count, expected_len; 7366 int i, err; 7367 7368 bt_dev_dbg(hdev, "sock %p", sk); 7369 7370 if (!lmp_le_capable(hdev)) 7371 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS, 7372 MGMT_STATUS_NOT_SUPPORTED); 7373 7374 key_count = __le16_to_cpu(cp->key_count); 7375 if (key_count > max_key_count) { 7376 bt_dev_err(hdev, "load_ltks: too big key_count value %u", 7377 key_count); 7378 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS, 7379 MGMT_STATUS_INVALID_PARAMS); 7380 } 7381 7382 expected_len = struct_size(cp, keys, key_count); 7383 if (expected_len != len) { 7384 bt_dev_err(hdev, "load_keys: expected %u bytes, got %u bytes", 7385 expected_len, len); 7386 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS, 7387 MGMT_STATUS_INVALID_PARAMS); 7388 } 7389 7390 bt_dev_dbg(hdev, "key_count %u", key_count); 7391 7392 hci_dev_lock(hdev); 7393 7394 hci_smp_ltks_clear(hdev); 7395 7396 for (i = 0; i < key_count; i++) { 7397 struct mgmt_ltk_info *key = &cp->keys[i]; 7398 u8 type, authenticated; 7399 7400 if (hci_is_blocked_key(hdev, 7401 HCI_BLOCKED_KEY_TYPE_LTK, 7402 key->val)) { 7403 bt_dev_warn(hdev, "Skipping blocked LTK for %pMR", 7404 &key->addr.bdaddr); 7405 continue; 7406 } 7407 7408 if (!ltk_is_valid(key)) { 7409 bt_dev_warn(hdev, "Invalid LTK for %pMR", 7410 &key->addr.bdaddr); 7411 continue; 7412 } 7413 7414 switch (key->type) { 7415 case MGMT_LTK_UNAUTHENTICATED: 7416 authenticated = 0x00; 7417 type = key->initiator ? SMP_LTK : SMP_LTK_RESPONDER; 7418 break; 7419 case MGMT_LTK_AUTHENTICATED: 7420 authenticated = 0x01; 7421 type = key->initiator ? SMP_LTK : SMP_LTK_RESPONDER; 7422 break; 7423 case MGMT_LTK_P256_UNAUTH: 7424 authenticated = 0x00; 7425 type = SMP_LTK_P256; 7426 break; 7427 case MGMT_LTK_P256_AUTH: 7428 authenticated = 0x01; 7429 type = SMP_LTK_P256; 7430 break; 7431 case MGMT_LTK_P256_DEBUG: 7432 authenticated = 0x00; 7433 type = SMP_LTK_P256_DEBUG; 7434 fallthrough; 7435 default: 7436 continue; 7437 } 7438 7439 hci_add_ltk(hdev, &key->addr.bdaddr, 7440 le_addr_type(key->addr.type), type, authenticated, 7441 key->val, key->enc_size, key->ediv, key->rand); 7442 } 7443 7444 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_LONG_TERM_KEYS, 0, 7445 NULL, 0); 7446 7447 hci_dev_unlock(hdev); 7448 7449 return err; 7450 } 7451 7452 static void get_conn_info_complete(struct hci_dev *hdev, void *data, int err) 7453 { 7454 struct mgmt_pending_cmd *cmd = data; 7455 struct hci_conn *conn = cmd->user_data; 7456 struct mgmt_cp_get_conn_info *cp = cmd->param; 7457 struct mgmt_rp_get_conn_info rp; 7458 u8 status; 7459 7460 bt_dev_dbg(hdev, "err %d", err); 7461 7462 memcpy(&rp.addr, &cp->addr, sizeof(rp.addr)); 7463 7464 status = mgmt_status(err); 7465 if (status == MGMT_STATUS_SUCCESS) { 7466 rp.rssi = conn->rssi; 7467 rp.tx_power = conn->tx_power; 7468 rp.max_tx_power = conn->max_tx_power; 7469 } else { 7470 rp.rssi = HCI_RSSI_INVALID; 7471 rp.tx_power = HCI_TX_POWER_INVALID; 7472 rp.max_tx_power = HCI_TX_POWER_INVALID; 7473 } 7474 7475 if (conn) 7476 hci_conn_put(conn); 7477 7478 mgmt_cmd_complete(cmd->sk, cmd->hdev->id, MGMT_OP_GET_CONN_INFO, status, 7479 &rp, sizeof(rp)); 7480 7481 mgmt_pending_free(cmd); 7482 } 7483 7484 static int get_conn_info_sync(struct hci_dev *hdev, void *data) 7485 { 7486 struct mgmt_pending_cmd *cmd = data; 7487 struct mgmt_cp_get_conn_info *cp = cmd->param; 7488 struct hci_conn *conn; 7489 int err; 7490 __le16 handle; 7491 7492 hci_dev_lock(hdev); 7493 7494 /* Make sure we are still connected */ 7495 if (cp->addr.type == BDADDR_BREDR) 7496 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, 7497 &cp->addr.bdaddr); 7498 else 7499 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &cp->addr.bdaddr); 7500 7501 if (!conn || conn->state != BT_CONNECTED) { 7502 hci_dev_unlock(hdev); 7503 return MGMT_STATUS_NOT_CONNECTED; 7504 } 7505 7506 cmd->user_data = hci_conn_get(conn); 7507 handle = cpu_to_le16(conn->handle); 7508 7509 hci_dev_unlock(hdev); 7510 7511 /* Refresh RSSI each time */ 7512 err = hci_read_rssi_sync(hdev, handle); 7513 7514 /* For LE links TX power does not change thus we don't need to 7515 * query for it once value is known. 7516 */ 7517 if (!err && (!bdaddr_type_is_le(cp->addr.type) || 7518 conn->tx_power == HCI_TX_POWER_INVALID)) 7519 err = hci_read_tx_power_sync(hdev, handle, 0x00); 7520 7521 /* Max TX power needs to be read only once per connection */ 7522 if (!err && conn->max_tx_power == HCI_TX_POWER_INVALID) 7523 err = hci_read_tx_power_sync(hdev, handle, 0x01); 7524 7525 return err; 7526 } 7527 7528 static int get_conn_info(struct sock *sk, struct hci_dev *hdev, void *data, 7529 u16 len) 7530 { 7531 struct mgmt_cp_get_conn_info *cp = data; 7532 struct mgmt_rp_get_conn_info rp; 7533 struct hci_conn *conn; 7534 unsigned long conn_info_age; 7535 int err = 0; 7536 7537 bt_dev_dbg(hdev, "sock %p", sk); 7538 7539 memset(&rp, 0, sizeof(rp)); 7540 bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr); 7541 rp.addr.type = cp->addr.type; 7542 7543 if (!bdaddr_type_is_valid(cp->addr.type)) 7544 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO, 7545 MGMT_STATUS_INVALID_PARAMS, 7546 &rp, sizeof(rp)); 7547 7548 hci_dev_lock(hdev); 7549 7550 if (!hdev_is_powered(hdev)) { 7551 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO, 7552 MGMT_STATUS_NOT_POWERED, &rp, 7553 sizeof(rp)); 7554 goto unlock; 7555 } 7556 7557 if (cp->addr.type == BDADDR_BREDR) 7558 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, 7559 &cp->addr.bdaddr); 7560 else 7561 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &cp->addr.bdaddr); 7562 7563 if (!conn || conn->state != BT_CONNECTED) { 7564 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO, 7565 MGMT_STATUS_NOT_CONNECTED, &rp, 7566 sizeof(rp)); 7567 goto unlock; 7568 } 7569 7570 /* To avoid client trying to guess when to poll again for information we 7571 * calculate conn info age as random value between min/max set in hdev. 7572 */ 7573 conn_info_age = get_random_u32_inclusive(hdev->conn_info_min_age, 7574 hdev->conn_info_max_age - 1); 7575 7576 /* Query controller to refresh cached values if they are too old or were 7577 * never read. 7578 */ 7579 if (time_after(jiffies, conn->conn_info_timestamp + 7580 msecs_to_jiffies(conn_info_age)) || 7581 !conn->conn_info_timestamp) { 7582 struct mgmt_pending_cmd *cmd; 7583 7584 cmd = mgmt_pending_new(sk, MGMT_OP_GET_CONN_INFO, hdev, data, 7585 len); 7586 if (!cmd) { 7587 err = -ENOMEM; 7588 } else { 7589 err = hci_cmd_sync_queue(hdev, get_conn_info_sync, 7590 cmd, get_conn_info_complete); 7591 } 7592 7593 if (err < 0) { 7594 mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO, 7595 MGMT_STATUS_FAILED, &rp, sizeof(rp)); 7596 7597 if (cmd) 7598 mgmt_pending_free(cmd); 7599 7600 goto unlock; 7601 } 7602 7603 conn->conn_info_timestamp = jiffies; 7604 } else { 7605 /* Cache is valid, just reply with values cached in hci_conn */ 7606 rp.rssi = conn->rssi; 7607 rp.tx_power = conn->tx_power; 7608 rp.max_tx_power = conn->max_tx_power; 7609 7610 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CONN_INFO, 7611 MGMT_STATUS_SUCCESS, &rp, sizeof(rp)); 7612 } 7613 7614 unlock: 7615 hci_dev_unlock(hdev); 7616 return err; 7617 } 7618 7619 static void get_clock_info_complete(struct hci_dev *hdev, void *data, int err) 7620 { 7621 struct mgmt_pending_cmd *cmd = data; 7622 struct mgmt_cp_get_clock_info *cp = cmd->param; 7623 struct mgmt_rp_get_clock_info rp; 7624 struct hci_conn *conn = cmd->user_data; 7625 u8 status = mgmt_status(err); 7626 7627 bt_dev_dbg(hdev, "err %d", err); 7628 7629 memset(&rp, 0, sizeof(rp)); 7630 bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr); 7631 rp.addr.type = cp->addr.type; 7632 7633 if (err) 7634 goto complete; 7635 7636 rp.local_clock = cpu_to_le32(hdev->clock); 7637 7638 if (conn) { 7639 rp.piconet_clock = cpu_to_le32(conn->clock); 7640 rp.accuracy = cpu_to_le16(conn->clock_accuracy); 7641 } 7642 7643 complete: 7644 if (conn) 7645 hci_conn_put(conn); 7646 7647 mgmt_cmd_complete(cmd->sk, cmd->hdev->id, cmd->opcode, status, &rp, 7648 sizeof(rp)); 7649 7650 mgmt_pending_free(cmd); 7651 } 7652 7653 static int get_clock_info_sync(struct hci_dev *hdev, void *data) 7654 { 7655 struct mgmt_pending_cmd *cmd = data; 7656 struct mgmt_cp_get_clock_info *cp = cmd->param; 7657 struct hci_cp_read_clock hci_cp; 7658 struct hci_conn *conn; 7659 7660 memset(&hci_cp, 0, sizeof(hci_cp)); 7661 hci_read_clock_sync(hdev, &hci_cp); 7662 7663 hci_dev_lock(hdev); 7664 7665 /* Make sure connection still exists */ 7666 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &cp->addr.bdaddr); 7667 if (!conn || conn->state != BT_CONNECTED) { 7668 hci_dev_unlock(hdev); 7669 return MGMT_STATUS_NOT_CONNECTED; 7670 } 7671 7672 cmd->user_data = hci_conn_get(conn); 7673 hci_cp.handle = cpu_to_le16(conn->handle); 7674 hci_cp.which = 0x01; /* Piconet clock */ 7675 7676 hci_dev_unlock(hdev); 7677 7678 return hci_read_clock_sync(hdev, &hci_cp); 7679 } 7680 7681 static int get_clock_info(struct sock *sk, struct hci_dev *hdev, void *data, 7682 u16 len) 7683 { 7684 struct mgmt_cp_get_clock_info *cp = data; 7685 struct mgmt_rp_get_clock_info rp; 7686 struct mgmt_pending_cmd *cmd; 7687 struct hci_conn *conn; 7688 int err; 7689 7690 bt_dev_dbg(hdev, "sock %p", sk); 7691 7692 memset(&rp, 0, sizeof(rp)); 7693 bacpy(&rp.addr.bdaddr, &cp->addr.bdaddr); 7694 rp.addr.type = cp->addr.type; 7695 7696 if (cp->addr.type != BDADDR_BREDR) 7697 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CLOCK_INFO, 7698 MGMT_STATUS_INVALID_PARAMS, 7699 &rp, sizeof(rp)); 7700 7701 hci_dev_lock(hdev); 7702 7703 if (!hdev_is_powered(hdev)) { 7704 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CLOCK_INFO, 7705 MGMT_STATUS_NOT_POWERED, &rp, 7706 sizeof(rp)); 7707 goto unlock; 7708 } 7709 7710 if (bacmp(&cp->addr.bdaddr, BDADDR_ANY)) { 7711 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, 7712 &cp->addr.bdaddr); 7713 if (!conn || conn->state != BT_CONNECTED) { 7714 err = mgmt_cmd_complete(sk, hdev->id, 7715 MGMT_OP_GET_CLOCK_INFO, 7716 MGMT_STATUS_NOT_CONNECTED, 7717 &rp, sizeof(rp)); 7718 goto unlock; 7719 } 7720 } else { 7721 conn = NULL; 7722 } 7723 7724 cmd = mgmt_pending_new(sk, MGMT_OP_GET_CLOCK_INFO, hdev, data, len); 7725 if (!cmd) 7726 err = -ENOMEM; 7727 else 7728 err = hci_cmd_sync_queue(hdev, get_clock_info_sync, cmd, 7729 get_clock_info_complete); 7730 7731 if (err < 0) { 7732 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_CLOCK_INFO, 7733 MGMT_STATUS_FAILED, &rp, sizeof(rp)); 7734 7735 if (cmd) 7736 mgmt_pending_free(cmd); 7737 } 7738 7739 7740 unlock: 7741 hci_dev_unlock(hdev); 7742 return err; 7743 } 7744 7745 static void device_added(struct sock *sk, struct hci_dev *hdev, 7746 bdaddr_t *bdaddr, u8 type, u8 action) 7747 { 7748 struct mgmt_ev_device_added ev; 7749 7750 bacpy(&ev.addr.bdaddr, bdaddr); 7751 ev.addr.type = type; 7752 ev.action = action; 7753 7754 mgmt_event(MGMT_EV_DEVICE_ADDED, hdev, &ev, sizeof(ev), sk); 7755 } 7756 7757 static void add_device_complete(struct hci_dev *hdev, void *data, int err) 7758 { 7759 struct mgmt_pending_cmd *cmd = data; 7760 struct mgmt_cp_add_device *cp = cmd->param; 7761 7762 if (!err) { 7763 struct hci_conn_params *params; 7764 7765 hci_dev_lock(hdev); 7766 7767 params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr, 7768 le_addr_type(cp->addr.type)); 7769 7770 device_added(cmd->sk, hdev, &cp->addr.bdaddr, cp->addr.type, 7771 cp->action); 7772 device_flags_changed(NULL, hdev, &cp->addr.bdaddr, 7773 cp->addr.type, hdev->conn_flags, 7774 params ? params->flags : 0); 7775 hci_dev_unlock(hdev); 7776 } 7777 7778 mgmt_cmd_complete(cmd->sk, hdev->id, MGMT_OP_ADD_DEVICE, 7779 mgmt_status(err), &cp->addr, sizeof(cp->addr)); 7780 mgmt_pending_free(cmd); 7781 } 7782 7783 static int add_device_sync(struct hci_dev *hdev, void *data) 7784 { 7785 return hci_update_passive_scan_sync(hdev); 7786 } 7787 7788 static int add_device(struct sock *sk, struct hci_dev *hdev, 7789 void *data, u16 len) 7790 { 7791 struct mgmt_pending_cmd *cmd; 7792 struct mgmt_cp_add_device *cp = data; 7793 u8 auto_conn, addr_type; 7794 struct hci_conn_params *params; 7795 int err; 7796 u32 current_flags = 0; 7797 u32 supported_flags; 7798 7799 bt_dev_dbg(hdev, "sock %p", sk); 7800 7801 if (!bdaddr_type_is_valid(cp->addr.type) || 7802 !bacmp(&cp->addr.bdaddr, BDADDR_ANY)) 7803 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE, 7804 MGMT_STATUS_INVALID_PARAMS, 7805 &cp->addr, sizeof(cp->addr)); 7806 7807 if (cp->action != 0x00 && cp->action != 0x01 && cp->action != 0x02) 7808 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE, 7809 MGMT_STATUS_INVALID_PARAMS, 7810 &cp->addr, sizeof(cp->addr)); 7811 7812 hci_dev_lock(hdev); 7813 7814 if (cp->addr.type == BDADDR_BREDR) { 7815 /* Only incoming connections action is supported for now */ 7816 if (cp->action != 0x01) { 7817 err = mgmt_cmd_complete(sk, hdev->id, 7818 MGMT_OP_ADD_DEVICE, 7819 MGMT_STATUS_INVALID_PARAMS, 7820 &cp->addr, sizeof(cp->addr)); 7821 goto unlock; 7822 } 7823 7824 err = hci_bdaddr_list_add_with_flags(&hdev->accept_list, 7825 &cp->addr.bdaddr, 7826 cp->addr.type, 0); 7827 if (err) 7828 goto unlock; 7829 7830 hci_update_scan(hdev); 7831 7832 goto added; 7833 } 7834 7835 addr_type = le_addr_type(cp->addr.type); 7836 7837 if (cp->action == 0x02) 7838 auto_conn = HCI_AUTO_CONN_ALWAYS; 7839 else if (cp->action == 0x01) 7840 auto_conn = HCI_AUTO_CONN_DIRECT; 7841 else 7842 auto_conn = HCI_AUTO_CONN_REPORT; 7843 7844 /* Kernel internally uses conn_params with resolvable private 7845 * address, but Add Device allows only identity addresses. 7846 * Make sure it is enforced before calling 7847 * hci_conn_params_lookup. 7848 */ 7849 if (!hci_is_identity_address(&cp->addr.bdaddr, addr_type)) { 7850 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE, 7851 MGMT_STATUS_INVALID_PARAMS, 7852 &cp->addr, sizeof(cp->addr)); 7853 goto unlock; 7854 } 7855 7856 /* If the connection parameters don't exist for this device, 7857 * they will be created and configured with defaults. 7858 */ 7859 params = hci_conn_params_set(hdev, &cp->addr.bdaddr, addr_type, 7860 auto_conn); 7861 if (!params) { 7862 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE, 7863 MGMT_STATUS_FAILED, &cp->addr, 7864 sizeof(cp->addr)); 7865 goto unlock; 7866 } 7867 7868 cmd = mgmt_pending_new(sk, MGMT_OP_ADD_DEVICE, hdev, data, len); 7869 if (!cmd) { 7870 err = -ENOMEM; 7871 goto unlock; 7872 } 7873 7874 err = hci_cmd_sync_queue(hdev, add_device_sync, cmd, 7875 add_device_complete); 7876 if (err < 0) { 7877 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE, 7878 MGMT_STATUS_FAILED, &cp->addr, 7879 sizeof(cp->addr)); 7880 mgmt_pending_free(cmd); 7881 } 7882 7883 goto unlock; 7884 7885 added: 7886 device_added(sk, hdev, &cp->addr.bdaddr, cp->addr.type, cp->action); 7887 supported_flags = hdev->conn_flags; 7888 device_flags_changed(NULL, hdev, &cp->addr.bdaddr, cp->addr.type, 7889 supported_flags, current_flags); 7890 7891 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_DEVICE, 7892 MGMT_STATUS_SUCCESS, &cp->addr, 7893 sizeof(cp->addr)); 7894 7895 unlock: 7896 hci_dev_unlock(hdev); 7897 return err; 7898 } 7899 7900 static void device_removed(struct sock *sk, struct hci_dev *hdev, 7901 bdaddr_t *bdaddr, u8 type) 7902 { 7903 struct mgmt_ev_device_removed ev; 7904 7905 bacpy(&ev.addr.bdaddr, bdaddr); 7906 ev.addr.type = type; 7907 7908 mgmt_event(MGMT_EV_DEVICE_REMOVED, hdev, &ev, sizeof(ev), sk); 7909 } 7910 7911 static int remove_device_sync(struct hci_dev *hdev, void *data) 7912 { 7913 return hci_update_passive_scan_sync(hdev); 7914 } 7915 7916 static int remove_device(struct sock *sk, struct hci_dev *hdev, 7917 void *data, u16 len) 7918 { 7919 struct mgmt_cp_remove_device *cp = data; 7920 int err; 7921 7922 bt_dev_dbg(hdev, "sock %p", sk); 7923 7924 hci_dev_lock(hdev); 7925 7926 if (bacmp(&cp->addr.bdaddr, BDADDR_ANY)) { 7927 struct hci_conn_params *params; 7928 u8 addr_type; 7929 7930 if (!bdaddr_type_is_valid(cp->addr.type)) { 7931 err = mgmt_cmd_complete(sk, hdev->id, 7932 MGMT_OP_REMOVE_DEVICE, 7933 MGMT_STATUS_INVALID_PARAMS, 7934 &cp->addr, sizeof(cp->addr)); 7935 goto unlock; 7936 } 7937 7938 if (cp->addr.type == BDADDR_BREDR) { 7939 err = hci_bdaddr_list_del(&hdev->accept_list, 7940 &cp->addr.bdaddr, 7941 cp->addr.type); 7942 if (err) { 7943 err = mgmt_cmd_complete(sk, hdev->id, 7944 MGMT_OP_REMOVE_DEVICE, 7945 MGMT_STATUS_INVALID_PARAMS, 7946 &cp->addr, 7947 sizeof(cp->addr)); 7948 goto unlock; 7949 } 7950 7951 hci_update_scan(hdev); 7952 7953 device_removed(sk, hdev, &cp->addr.bdaddr, 7954 cp->addr.type); 7955 goto complete; 7956 } 7957 7958 addr_type = le_addr_type(cp->addr.type); 7959 7960 /* Kernel internally uses conn_params with resolvable private 7961 * address, but Remove Device allows only identity addresses. 7962 * Make sure it is enforced before calling 7963 * hci_conn_params_lookup. 7964 */ 7965 if (!hci_is_identity_address(&cp->addr.bdaddr, addr_type)) { 7966 err = mgmt_cmd_complete(sk, hdev->id, 7967 MGMT_OP_REMOVE_DEVICE, 7968 MGMT_STATUS_INVALID_PARAMS, 7969 &cp->addr, sizeof(cp->addr)); 7970 goto unlock; 7971 } 7972 7973 params = hci_conn_params_lookup(hdev, &cp->addr.bdaddr, 7974 addr_type); 7975 if (!params) { 7976 err = mgmt_cmd_complete(sk, hdev->id, 7977 MGMT_OP_REMOVE_DEVICE, 7978 MGMT_STATUS_INVALID_PARAMS, 7979 &cp->addr, sizeof(cp->addr)); 7980 goto unlock; 7981 } 7982 7983 if (params->auto_connect == HCI_AUTO_CONN_DISABLED || 7984 params->auto_connect == HCI_AUTO_CONN_EXPLICIT) { 7985 err = mgmt_cmd_complete(sk, hdev->id, 7986 MGMT_OP_REMOVE_DEVICE, 7987 MGMT_STATUS_INVALID_PARAMS, 7988 &cp->addr, sizeof(cp->addr)); 7989 goto unlock; 7990 } 7991 7992 hci_conn_params_free(params); 7993 7994 device_removed(sk, hdev, &cp->addr.bdaddr, cp->addr.type); 7995 } else { 7996 struct hci_conn_params *p, *tmp; 7997 struct bdaddr_list *b, *btmp; 7998 7999 if (cp->addr.type) { 8000 err = mgmt_cmd_complete(sk, hdev->id, 8001 MGMT_OP_REMOVE_DEVICE, 8002 MGMT_STATUS_INVALID_PARAMS, 8003 &cp->addr, sizeof(cp->addr)); 8004 goto unlock; 8005 } 8006 8007 list_for_each_entry_safe(b, btmp, &hdev->accept_list, list) { 8008 device_removed(sk, hdev, &b->bdaddr, b->bdaddr_type); 8009 list_del(&b->list); 8010 kfree(b); 8011 } 8012 8013 hci_update_scan(hdev); 8014 8015 list_for_each_entry_safe(p, tmp, &hdev->le_conn_params, list) { 8016 if (p->auto_connect == HCI_AUTO_CONN_DISABLED) 8017 continue; 8018 device_removed(sk, hdev, &p->addr, p->addr_type); 8019 if (p->explicit_connect) { 8020 p->auto_connect = HCI_AUTO_CONN_EXPLICIT; 8021 continue; 8022 } 8023 hci_conn_params_free(p); 8024 } 8025 8026 bt_dev_dbg(hdev, "All LE connection parameters were removed"); 8027 } 8028 8029 hci_cmd_sync_queue(hdev, remove_device_sync, NULL, NULL); 8030 8031 complete: 8032 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_REMOVE_DEVICE, 8033 MGMT_STATUS_SUCCESS, &cp->addr, 8034 sizeof(cp->addr)); 8035 unlock: 8036 hci_dev_unlock(hdev); 8037 return err; 8038 } 8039 8040 static int conn_update_sync(struct hci_dev *hdev, void *data) 8041 { 8042 struct hci_conn *conn = data; 8043 struct hci_conn_params *params; 8044 struct hci_conn_params local = {}; 8045 8046 hci_dev_lock(hdev); 8047 8048 if (!hci_conn_valid(hdev, conn) || conn->role != HCI_ROLE_MASTER) 8049 goto cancel; 8050 8051 params = hci_conn_params_lookup(hdev, &conn->dst, conn->dst_type); 8052 if (!params) 8053 goto cancel; 8054 8055 local.conn_min_interval = params->conn_min_interval; 8056 local.conn_max_interval = params->conn_max_interval; 8057 local.conn_latency = params->conn_latency; 8058 local.supervision_timeout = params->supervision_timeout; 8059 8060 hci_dev_unlock(hdev); 8061 8062 return hci_le_conn_update_sync(hdev, conn, &local); 8063 8064 cancel: 8065 hci_dev_unlock(hdev); 8066 return -ECANCELED; 8067 } 8068 8069 static void conn_update_sync_destroy(struct hci_dev *hdev, void *data, int err) 8070 { 8071 hci_conn_put(data); 8072 } 8073 8074 static int load_conn_param(struct sock *sk, struct hci_dev *hdev, void *data, 8075 u16 len) 8076 { 8077 struct mgmt_cp_load_conn_param *cp = data; 8078 const u16 max_param_count = ((U16_MAX - sizeof(*cp)) / 8079 sizeof(struct mgmt_conn_param)); 8080 u16 param_count, expected_len; 8081 int i; 8082 8083 if (!lmp_le_capable(hdev)) 8084 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM, 8085 MGMT_STATUS_NOT_SUPPORTED); 8086 8087 param_count = __le16_to_cpu(cp->param_count); 8088 if (param_count > max_param_count) { 8089 bt_dev_err(hdev, "load_conn_param: too big param_count value %u", 8090 param_count); 8091 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM, 8092 MGMT_STATUS_INVALID_PARAMS); 8093 } 8094 8095 expected_len = struct_size(cp, params, param_count); 8096 if (expected_len != len) { 8097 bt_dev_err(hdev, "load_conn_param: expected %u bytes, got %u bytes", 8098 expected_len, len); 8099 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM, 8100 MGMT_STATUS_INVALID_PARAMS); 8101 } 8102 8103 bt_dev_dbg(hdev, "param_count %u", param_count); 8104 8105 hci_dev_lock(hdev); 8106 8107 if (param_count > 1) 8108 hci_conn_params_clear_disabled(hdev); 8109 8110 for (i = 0; i < param_count; i++) { 8111 struct mgmt_conn_param *param = &cp->params[i]; 8112 struct hci_conn_params *hci_param; 8113 u16 min, max, latency, timeout; 8114 bool update = false; 8115 u8 addr_type; 8116 8117 bt_dev_dbg(hdev, "Adding %pMR (type %u)", ¶m->addr.bdaddr, 8118 param->addr.type); 8119 8120 if (param->addr.type == BDADDR_LE_PUBLIC) { 8121 addr_type = ADDR_LE_DEV_PUBLIC; 8122 } else if (param->addr.type == BDADDR_LE_RANDOM) { 8123 addr_type = ADDR_LE_DEV_RANDOM; 8124 } else { 8125 bt_dev_err(hdev, "ignoring invalid connection parameters"); 8126 continue; 8127 } 8128 8129 min = le16_to_cpu(param->min_interval); 8130 max = le16_to_cpu(param->max_interval); 8131 latency = le16_to_cpu(param->latency); 8132 timeout = le16_to_cpu(param->timeout); 8133 8134 bt_dev_dbg(hdev, "min 0x%04x max 0x%04x latency 0x%04x timeout 0x%04x", 8135 min, max, latency, timeout); 8136 8137 if (hci_check_conn_params(min, max, latency, timeout) < 0) { 8138 bt_dev_err(hdev, "ignoring invalid connection parameters"); 8139 continue; 8140 } 8141 8142 /* Detect when the loading is for an existing parameter then 8143 * attempt to trigger the connection update procedure. 8144 */ 8145 if (!i && param_count == 1) { 8146 hci_param = hci_conn_params_lookup(hdev, 8147 ¶m->addr.bdaddr, 8148 addr_type); 8149 if (hci_param) 8150 update = true; 8151 else 8152 hci_conn_params_clear_disabled(hdev); 8153 } 8154 8155 hci_param = hci_conn_params_add(hdev, ¶m->addr.bdaddr, 8156 addr_type); 8157 if (!hci_param) { 8158 bt_dev_err(hdev, "failed to add connection parameters"); 8159 continue; 8160 } 8161 8162 hci_param->conn_min_interval = min; 8163 hci_param->conn_max_interval = max; 8164 hci_param->conn_latency = latency; 8165 hci_param->supervision_timeout = timeout; 8166 8167 /* Check if we need to trigger a connection update */ 8168 if (update) { 8169 struct hci_conn *conn; 8170 8171 /* Lookup for existing connection as central and check 8172 * if parameters match and if they don't then trigger 8173 * a connection update. 8174 */ 8175 conn = hci_conn_hash_lookup_le(hdev, &hci_param->addr, 8176 addr_type); 8177 if (conn && conn->role == HCI_ROLE_MASTER && 8178 (conn->le_conn_min_interval != min || 8179 conn->le_conn_max_interval != max || 8180 conn->le_conn_latency != latency || 8181 conn->le_supv_timeout != timeout)) { 8182 hci_conn_get(conn); 8183 if (hci_cmd_sync_queue(hdev, conn_update_sync, 8184 conn, 8185 conn_update_sync_destroy) < 0) 8186 hci_conn_put(conn); 8187 } 8188 } 8189 } 8190 8191 hci_dev_unlock(hdev); 8192 8193 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_CONN_PARAM, 0, 8194 NULL, 0); 8195 } 8196 8197 static int load_conn_subrate(struct sock *sk, struct hci_dev *hdev, void *data, 8198 u16 len) 8199 { 8200 struct mgmt_cp_load_conn_subrate *cp = data; 8201 const u16 max_param_count = ((U16_MAX - sizeof(*cp)) / 8202 sizeof(struct mgmt_conn_subrate)); 8203 u16 param_count, expected_len; 8204 int i; 8205 8206 if (!lmp_le_capable(hdev) || !le_sci_capable(hdev)) 8207 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_SUBRATE, 8208 MGMT_STATUS_NOT_SUPPORTED); 8209 8210 param_count = __le16_to_cpu(cp->param_count); 8211 if (param_count > max_param_count) { 8212 bt_dev_err(hdev, "too big param_count value %u", param_count); 8213 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_SUBRATE, 8214 MGMT_STATUS_INVALID_PARAMS); 8215 } 8216 8217 expected_len = struct_size(cp, params, param_count); 8218 if (expected_len != len) { 8219 bt_dev_err(hdev, "expected %u bytes, got %u bytes", 8220 expected_len, len); 8221 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_LOAD_CONN_SUBRATE, 8222 MGMT_STATUS_INVALID_PARAMS); 8223 } 8224 8225 bt_dev_dbg(hdev, "param_count %u", param_count); 8226 8227 hci_dev_lock(hdev); 8228 8229 for (i = 0; i < param_count; i++) { 8230 struct mgmt_conn_subrate *param = &cp->params[i]; 8231 struct hci_conn_params *hci_param; 8232 u16 min, max, subrate_min, subrate_max; 8233 u16 max_latency, cont_num, supv_timeout; 8234 u8 addr_type; 8235 8236 bt_dev_dbg(hdev, "Adding subrate %pMR (type %u)", 8237 ¶m->addr.bdaddr, param->addr.type); 8238 8239 if (param->addr.type == BDADDR_LE_PUBLIC) { 8240 addr_type = ADDR_LE_DEV_PUBLIC; 8241 } else if (param->addr.type == BDADDR_LE_RANDOM) { 8242 addr_type = ADDR_LE_DEV_RANDOM; 8243 } else { 8244 bt_dev_err(hdev, "ignoring invalid connection subrate parameters"); 8245 continue; 8246 } 8247 8248 min = le16_to_cpu(param->min_interval); 8249 max = le16_to_cpu(param->max_interval); 8250 subrate_min = le16_to_cpu(param->subrate_min); 8251 subrate_max = le16_to_cpu(param->subrate_max); 8252 max_latency = le16_to_cpu(param->max_latency); 8253 cont_num = le16_to_cpu(param->cont_num); 8254 supv_timeout = le16_to_cpu(param->supv_timeout); 8255 8256 /* Validate the parameters before storing them. Reject 8257 * logically inconsistent values instead of forwarding them to 8258 * the controller. 8259 */ 8260 if (min > max || subrate_min > subrate_max || 8261 subrate_min < 1 || supv_timeout < 1) { 8262 bt_dev_err(hdev, "ignoring invalid connection subrate parameters"); 8263 continue; 8264 } 8265 8266 hci_param = hci_conn_params_add(hdev, ¶m->addr.bdaddr, 8267 addr_type); 8268 if (!hci_param) { 8269 bt_dev_err(hdev, "failed to add connection parameters"); 8270 continue; 8271 } 8272 8273 hci_param->rate_min_interval = min; 8274 hci_param->rate_max_interval = max; 8275 hci_param->subrate_min = subrate_min; 8276 hci_param->subrate_max = subrate_max; 8277 hci_param->max_latency = max_latency; 8278 hci_param->cont_num = cont_num; 8279 hci_param->rate_supv_timeout = supv_timeout; 8280 8281 /* If the device is connected as central check if the 8282 * connection rate parameters need to be updated. 8283 */ 8284 if (!i && param_count == 1) { 8285 struct hci_conn *conn; 8286 8287 conn = hci_conn_hash_lookup_le(hdev, 8288 &hci_param->addr, 8289 addr_type); 8290 if (conn && conn->state == BT_CONNECTED && 8291 conn->role == HCI_ROLE_MASTER && 8292 (conn->le_rate_interval < min || 8293 conn->le_rate_interval > max || 8294 conn->le_subrate < subrate_min || 8295 conn->le_subrate > subrate_max || 8296 conn->le_rate_latency != max_latency || 8297 conn->le_cont_num != cont_num || 8298 conn->le_rate_supv_timeout != supv_timeout)) 8299 hci_le_conn_rate_request(hdev, conn); 8300 } 8301 } 8302 8303 hci_dev_unlock(hdev); 8304 8305 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_LOAD_CONN_SUBRATE, 0, 8306 NULL, 0); 8307 } 8308 8309 static int set_external_config(struct sock *sk, struct hci_dev *hdev, 8310 void *data, u16 len) 8311 { 8312 struct mgmt_cp_set_external_config *cp = data; 8313 bool changed; 8314 int err; 8315 8316 bt_dev_dbg(hdev, "sock %p", sk); 8317 8318 if (hdev_is_powered(hdev)) 8319 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_EXTERNAL_CONFIG, 8320 MGMT_STATUS_REJECTED); 8321 8322 if (cp->config != 0x00 && cp->config != 0x01) 8323 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_EXTERNAL_CONFIG, 8324 MGMT_STATUS_INVALID_PARAMS); 8325 8326 if (!hci_test_quirk(hdev, HCI_QUIRK_EXTERNAL_CONFIG)) 8327 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_EXTERNAL_CONFIG, 8328 MGMT_STATUS_NOT_SUPPORTED); 8329 8330 hci_dev_lock(hdev); 8331 8332 if (cp->config) 8333 changed = !hci_dev_test_and_set_flag(hdev, HCI_EXT_CONFIGURED); 8334 else 8335 changed = hci_dev_test_and_clear_flag(hdev, HCI_EXT_CONFIGURED); 8336 8337 err = send_options_rsp(sk, MGMT_OP_SET_EXTERNAL_CONFIG, hdev); 8338 if (err < 0) 8339 goto unlock; 8340 8341 if (!changed) 8342 goto unlock; 8343 8344 err = new_options(hdev, sk); 8345 8346 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED) == is_configured(hdev)) { 8347 mgmt_index_removed(hdev); 8348 8349 if (hci_dev_test_and_change_flag(hdev, HCI_UNCONFIGURED)) { 8350 hci_dev_set_flag(hdev, HCI_CONFIG); 8351 hci_dev_set_flag(hdev, HCI_AUTO_OFF); 8352 8353 queue_work(hdev->req_workqueue, &hdev->power_on); 8354 } else { 8355 set_bit(HCI_RAW, &hdev->flags); 8356 mgmt_index_added(hdev); 8357 } 8358 } 8359 8360 unlock: 8361 hci_dev_unlock(hdev); 8362 return err; 8363 } 8364 8365 static int set_public_address(struct sock *sk, struct hci_dev *hdev, 8366 void *data, u16 len) 8367 { 8368 struct mgmt_cp_set_public_address *cp = data; 8369 bool changed; 8370 int err; 8371 8372 bt_dev_dbg(hdev, "sock %p", sk); 8373 8374 if (hdev_is_powered(hdev)) 8375 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PUBLIC_ADDRESS, 8376 MGMT_STATUS_REJECTED); 8377 8378 if (!bacmp(&cp->bdaddr, BDADDR_ANY)) 8379 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PUBLIC_ADDRESS, 8380 MGMT_STATUS_INVALID_PARAMS); 8381 8382 if (!hdev->set_bdaddr) 8383 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_SET_PUBLIC_ADDRESS, 8384 MGMT_STATUS_NOT_SUPPORTED); 8385 8386 hci_dev_lock(hdev); 8387 8388 changed = !!bacmp(&hdev->public_addr, &cp->bdaddr); 8389 bacpy(&hdev->public_addr, &cp->bdaddr); 8390 8391 err = send_options_rsp(sk, MGMT_OP_SET_PUBLIC_ADDRESS, hdev); 8392 if (err < 0) 8393 goto unlock; 8394 8395 if (!changed) 8396 goto unlock; 8397 8398 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) 8399 err = new_options(hdev, sk); 8400 8401 if (is_configured(hdev)) { 8402 mgmt_index_removed(hdev); 8403 8404 hci_dev_clear_flag(hdev, HCI_UNCONFIGURED); 8405 8406 hci_dev_set_flag(hdev, HCI_CONFIG); 8407 hci_dev_set_flag(hdev, HCI_AUTO_OFF); 8408 8409 queue_work(hdev->req_workqueue, &hdev->power_on); 8410 } 8411 8412 unlock: 8413 hci_dev_unlock(hdev); 8414 return err; 8415 } 8416 8417 static void read_local_oob_ext_data_complete(struct hci_dev *hdev, void *data, 8418 int err) 8419 { 8420 const struct mgmt_cp_read_local_oob_ext_data *mgmt_cp; 8421 struct mgmt_rp_read_local_oob_ext_data *mgmt_rp; 8422 u8 *h192, *r192, *h256, *r256; 8423 struct mgmt_pending_cmd *cmd = data; 8424 struct sk_buff *skb = cmd->skb; 8425 u8 status = mgmt_status(err); 8426 u16 eir_len; 8427 8428 if (!status) { 8429 if (!skb) 8430 status = MGMT_STATUS_FAILED; 8431 else if (IS_ERR(skb)) 8432 status = mgmt_status(PTR_ERR(skb)); 8433 else 8434 status = mgmt_status(skb->data[0]); 8435 } 8436 8437 bt_dev_dbg(hdev, "status %u", status); 8438 8439 mgmt_cp = cmd->param; 8440 8441 if (status) { 8442 status = mgmt_status(status); 8443 eir_len = 0; 8444 8445 h192 = NULL; 8446 r192 = NULL; 8447 h256 = NULL; 8448 r256 = NULL; 8449 } else if (!bredr_sc_enabled(hdev)) { 8450 struct hci_rp_read_local_oob_data *rp; 8451 8452 if (skb->len != sizeof(*rp)) { 8453 status = MGMT_STATUS_FAILED; 8454 eir_len = 0; 8455 } else { 8456 status = MGMT_STATUS_SUCCESS; 8457 rp = (void *)skb->data; 8458 8459 eir_len = 5 + 18 + 18; 8460 h192 = rp->hash; 8461 r192 = rp->rand; 8462 h256 = NULL; 8463 r256 = NULL; 8464 } 8465 } else { 8466 struct hci_rp_read_local_oob_ext_data *rp; 8467 8468 if (skb->len != sizeof(*rp)) { 8469 status = MGMT_STATUS_FAILED; 8470 eir_len = 0; 8471 } else { 8472 status = MGMT_STATUS_SUCCESS; 8473 rp = (void *)skb->data; 8474 8475 if (hci_dev_test_flag(hdev, HCI_SC_ONLY)) { 8476 eir_len = 5 + 18 + 18; 8477 h192 = NULL; 8478 r192 = NULL; 8479 } else { 8480 eir_len = 5 + 18 + 18 + 18 + 18; 8481 h192 = rp->hash192; 8482 r192 = rp->rand192; 8483 } 8484 8485 h256 = rp->hash256; 8486 r256 = rp->rand256; 8487 } 8488 } 8489 8490 mgmt_rp = kmalloc(sizeof(*mgmt_rp) + eir_len, GFP_KERNEL); 8491 if (!mgmt_rp) 8492 goto done; 8493 8494 if (eir_len == 0) 8495 goto send_rsp; 8496 8497 eir_len = eir_append_data(mgmt_rp->eir, 0, EIR_CLASS_OF_DEV, 8498 hdev->dev_class, 3); 8499 8500 if (h192 && r192) { 8501 eir_len = eir_append_data(mgmt_rp->eir, eir_len, 8502 EIR_SSP_HASH_C192, h192, 16); 8503 eir_len = eir_append_data(mgmt_rp->eir, eir_len, 8504 EIR_SSP_RAND_R192, r192, 16); 8505 } 8506 8507 if (h256 && r256) { 8508 eir_len = eir_append_data(mgmt_rp->eir, eir_len, 8509 EIR_SSP_HASH_C256, h256, 16); 8510 eir_len = eir_append_data(mgmt_rp->eir, eir_len, 8511 EIR_SSP_RAND_R256, r256, 16); 8512 } 8513 8514 send_rsp: 8515 mgmt_rp->type = mgmt_cp->type; 8516 mgmt_rp->eir_len = cpu_to_le16(eir_len); 8517 8518 err = mgmt_cmd_complete(cmd->sk, hdev->id, 8519 MGMT_OP_READ_LOCAL_OOB_EXT_DATA, status, 8520 mgmt_rp, sizeof(*mgmt_rp) + eir_len); 8521 if (err < 0 || status) 8522 goto done; 8523 8524 hci_sock_set_flag(cmd->sk, HCI_MGMT_OOB_DATA_EVENTS); 8525 8526 err = mgmt_limited_event(MGMT_EV_LOCAL_OOB_DATA_UPDATED, hdev, 8527 mgmt_rp, sizeof(*mgmt_rp) + eir_len, 8528 HCI_MGMT_OOB_DATA_EVENTS, cmd->sk); 8529 done: 8530 if (skb && !IS_ERR(skb)) 8531 kfree_skb(skb); 8532 8533 kfree(mgmt_rp); 8534 mgmt_pending_free(cmd); 8535 } 8536 8537 static int read_local_ssp_oob_req(struct hci_dev *hdev, struct sock *sk, 8538 struct mgmt_cp_read_local_oob_ext_data *cp) 8539 { 8540 struct mgmt_pending_cmd *cmd; 8541 int err; 8542 8543 cmd = mgmt_pending_new(sk, MGMT_OP_READ_LOCAL_OOB_EXT_DATA, hdev, 8544 cp, sizeof(*cp)); 8545 if (!cmd) 8546 return -ENOMEM; 8547 8548 err = hci_cmd_sync_queue(hdev, read_local_oob_data_sync, cmd, 8549 read_local_oob_ext_data_complete); 8550 8551 if (err < 0) { 8552 mgmt_pending_remove(cmd); 8553 return err; 8554 } 8555 8556 return 0; 8557 } 8558 8559 static int read_local_oob_ext_data(struct sock *sk, struct hci_dev *hdev, 8560 void *data, u16 data_len) 8561 { 8562 struct mgmt_cp_read_local_oob_ext_data *cp = data; 8563 struct mgmt_rp_read_local_oob_ext_data *rp; 8564 size_t rp_len; 8565 u16 eir_len; 8566 u8 status, flags, role, addr[7], hash[16], rand[16]; 8567 int err; 8568 8569 bt_dev_dbg(hdev, "sock %p", sk); 8570 8571 if (hdev_is_powered(hdev)) { 8572 switch (cp->type) { 8573 case BIT(BDADDR_BREDR): 8574 status = mgmt_bredr_support(hdev); 8575 if (status) 8576 eir_len = 0; 8577 else 8578 eir_len = 5; 8579 break; 8580 case (BIT(BDADDR_LE_PUBLIC) | BIT(BDADDR_LE_RANDOM)): 8581 status = mgmt_le_support(hdev); 8582 if (status) 8583 eir_len = 0; 8584 else 8585 eir_len = 9 + 3 + 18 + 18 + 3; 8586 break; 8587 default: 8588 status = MGMT_STATUS_INVALID_PARAMS; 8589 eir_len = 0; 8590 break; 8591 } 8592 } else { 8593 status = MGMT_STATUS_NOT_POWERED; 8594 eir_len = 0; 8595 } 8596 8597 rp_len = sizeof(*rp) + eir_len; 8598 rp = kmalloc(rp_len, GFP_ATOMIC); 8599 if (!rp) 8600 return -ENOMEM; 8601 8602 if (!status && !lmp_ssp_capable(hdev)) { 8603 status = MGMT_STATUS_NOT_SUPPORTED; 8604 eir_len = 0; 8605 } 8606 8607 if (status) 8608 goto complete; 8609 8610 hci_dev_lock(hdev); 8611 8612 eir_len = 0; 8613 switch (cp->type) { 8614 case BIT(BDADDR_BREDR): 8615 if (hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) { 8616 err = read_local_ssp_oob_req(hdev, sk, cp); 8617 hci_dev_unlock(hdev); 8618 if (!err) 8619 goto done; 8620 8621 status = MGMT_STATUS_FAILED; 8622 goto complete; 8623 } else { 8624 eir_len = eir_append_data(rp->eir, eir_len, 8625 EIR_CLASS_OF_DEV, 8626 hdev->dev_class, 3); 8627 } 8628 break; 8629 case (BIT(BDADDR_LE_PUBLIC) | BIT(BDADDR_LE_RANDOM)): 8630 if (hci_dev_test_flag(hdev, HCI_SC_ENABLED) && 8631 smp_generate_oob(hdev, hash, rand) < 0) { 8632 hci_dev_unlock(hdev); 8633 status = MGMT_STATUS_FAILED; 8634 goto complete; 8635 } 8636 8637 /* This should return the active RPA, but since the RPA 8638 * is only programmed on demand, it is really hard to fill 8639 * this in at the moment. For now disallow retrieving 8640 * local out-of-band data when privacy is in use. 8641 * 8642 * Returning the identity address will not help here since 8643 * pairing happens before the identity resolving key is 8644 * known and thus the connection establishment happens 8645 * based on the RPA and not the identity address. 8646 */ 8647 if (hci_dev_test_flag(hdev, HCI_PRIVACY)) { 8648 hci_dev_unlock(hdev); 8649 status = MGMT_STATUS_REJECTED; 8650 goto complete; 8651 } 8652 8653 if (hci_dev_test_flag(hdev, HCI_FORCE_STATIC_ADDR) || 8654 !bacmp(&hdev->bdaddr, BDADDR_ANY) || 8655 (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) && 8656 bacmp(&hdev->static_addr, BDADDR_ANY))) { 8657 memcpy(addr, &hdev->static_addr, 6); 8658 addr[6] = 0x01; 8659 } else { 8660 memcpy(addr, &hdev->bdaddr, 6); 8661 addr[6] = 0x00; 8662 } 8663 8664 eir_len = eir_append_data(rp->eir, eir_len, EIR_LE_BDADDR, 8665 addr, sizeof(addr)); 8666 8667 if (hci_dev_test_flag(hdev, HCI_ADVERTISING)) 8668 role = 0x02; 8669 else 8670 role = 0x01; 8671 8672 eir_len = eir_append_data(rp->eir, eir_len, EIR_LE_ROLE, 8673 &role, sizeof(role)); 8674 8675 if (hci_dev_test_flag(hdev, HCI_SC_ENABLED)) { 8676 eir_len = eir_append_data(rp->eir, eir_len, 8677 EIR_LE_SC_CONFIRM, 8678 hash, sizeof(hash)); 8679 8680 eir_len = eir_append_data(rp->eir, eir_len, 8681 EIR_LE_SC_RANDOM, 8682 rand, sizeof(rand)); 8683 } 8684 8685 flags = mgmt_get_adv_discov_flags(hdev); 8686 8687 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) 8688 flags |= LE_AD_NO_BREDR; 8689 8690 eir_len = eir_append_data(rp->eir, eir_len, EIR_FLAGS, 8691 &flags, sizeof(flags)); 8692 break; 8693 } 8694 8695 hci_dev_unlock(hdev); 8696 8697 hci_sock_set_flag(sk, HCI_MGMT_OOB_DATA_EVENTS); 8698 8699 status = MGMT_STATUS_SUCCESS; 8700 8701 complete: 8702 rp->type = cp->type; 8703 rp->eir_len = cpu_to_le16(eir_len); 8704 8705 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_LOCAL_OOB_EXT_DATA, 8706 status, rp, sizeof(*rp) + eir_len); 8707 if (err < 0 || status) 8708 goto done; 8709 8710 err = mgmt_limited_event(MGMT_EV_LOCAL_OOB_DATA_UPDATED, hdev, 8711 rp, sizeof(*rp) + eir_len, 8712 HCI_MGMT_OOB_DATA_EVENTS, sk); 8713 8714 done: 8715 kfree(rp); 8716 8717 return err; 8718 } 8719 8720 static u32 get_supported_adv_flags(struct hci_dev *hdev) 8721 { 8722 u32 flags = 0; 8723 8724 flags |= MGMT_ADV_FLAG_CONNECTABLE; 8725 flags |= MGMT_ADV_FLAG_DISCOV; 8726 flags |= MGMT_ADV_FLAG_LIMITED_DISCOV; 8727 flags |= MGMT_ADV_FLAG_MANAGED_FLAGS; 8728 flags |= MGMT_ADV_FLAG_APPEARANCE; 8729 flags |= MGMT_ADV_FLAG_LOCAL_NAME; 8730 flags |= MGMT_ADV_PARAM_DURATION; 8731 flags |= MGMT_ADV_PARAM_TIMEOUT; 8732 flags |= MGMT_ADV_PARAM_INTERVALS; 8733 flags |= MGMT_ADV_PARAM_TX_POWER; 8734 flags |= MGMT_ADV_PARAM_SCAN_RSP; 8735 8736 /* In extended adv TX_POWER returned from Set Adv Param 8737 * will be always valid. 8738 */ 8739 if (hdev->adv_tx_power != HCI_TX_POWER_INVALID || ext_adv_capable(hdev)) 8740 flags |= MGMT_ADV_FLAG_TX_POWER; 8741 8742 if (ext_adv_capable(hdev)) { 8743 flags |= MGMT_ADV_FLAG_SEC_1M; 8744 flags |= MGMT_ADV_FLAG_HW_OFFLOAD; 8745 flags |= MGMT_ADV_FLAG_CAN_SET_TX_POWER; 8746 8747 if (le_2m_capable(hdev)) 8748 flags |= MGMT_ADV_FLAG_SEC_2M; 8749 8750 if (le_coded_capable(hdev)) 8751 flags |= MGMT_ADV_FLAG_SEC_CODED; 8752 } 8753 8754 return flags; 8755 } 8756 8757 static int read_adv_features(struct sock *sk, struct hci_dev *hdev, 8758 void *data, u16 data_len) 8759 { 8760 struct mgmt_rp_read_adv_features *rp; 8761 size_t rp_len; 8762 int err; 8763 struct adv_info *adv_instance; 8764 u32 supported_flags; 8765 u8 *instance; 8766 8767 bt_dev_dbg(hdev, "sock %p", sk); 8768 8769 if (!lmp_le_capable(hdev)) 8770 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_READ_ADV_FEATURES, 8771 MGMT_STATUS_REJECTED); 8772 8773 hci_dev_lock(hdev); 8774 8775 rp_len = sizeof(*rp) + hdev->adv_instance_cnt; 8776 rp = kmalloc(rp_len, GFP_ATOMIC); 8777 if (!rp) { 8778 hci_dev_unlock(hdev); 8779 return -ENOMEM; 8780 } 8781 8782 supported_flags = get_supported_adv_flags(hdev); 8783 8784 rp->supported_flags = cpu_to_le32(supported_flags); 8785 rp->max_adv_data_len = max_adv_len(hdev); 8786 rp->max_scan_rsp_len = max_adv_len(hdev); 8787 rp->max_instances = hdev->le_num_of_adv_sets; 8788 rp->num_instances = hdev->adv_instance_cnt; 8789 8790 instance = rp->instance; 8791 list_for_each_entry(adv_instance, &hdev->adv_instances, list) { 8792 /* Only instances 1-le_num_of_adv_sets are externally visible */ 8793 if (adv_instance->instance <= hdev->adv_instance_cnt) { 8794 *instance = adv_instance->instance; 8795 instance++; 8796 } else { 8797 rp->num_instances--; 8798 rp_len--; 8799 } 8800 } 8801 8802 hci_dev_unlock(hdev); 8803 8804 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_READ_ADV_FEATURES, 8805 MGMT_STATUS_SUCCESS, rp, rp_len); 8806 8807 kfree(rp); 8808 8809 return err; 8810 } 8811 8812 static u8 calculate_name_len(struct hci_dev *hdev) 8813 { 8814 u8 buf[HCI_MAX_SHORT_NAME_LENGTH + 2]; /* len + type + name */ 8815 8816 return eir_append_local_name(hdev, buf, 0); 8817 } 8818 8819 static u8 tlv_data_max_len(struct hci_dev *hdev, u32 adv_flags, 8820 bool is_adv_data) 8821 { 8822 u8 max_len = max_adv_len(hdev); 8823 8824 if (is_adv_data) { 8825 if (adv_flags & (MGMT_ADV_FLAG_DISCOV | 8826 MGMT_ADV_FLAG_LIMITED_DISCOV | 8827 MGMT_ADV_FLAG_MANAGED_FLAGS)) 8828 max_len -= 3; 8829 8830 if (adv_flags & MGMT_ADV_FLAG_TX_POWER) 8831 max_len -= 3; 8832 } else { 8833 if (adv_flags & MGMT_ADV_FLAG_LOCAL_NAME) 8834 max_len -= calculate_name_len(hdev); 8835 8836 if (adv_flags & (MGMT_ADV_FLAG_APPEARANCE)) 8837 max_len -= 4; 8838 } 8839 8840 return max_len; 8841 } 8842 8843 static bool flags_managed(u32 adv_flags) 8844 { 8845 return adv_flags & (MGMT_ADV_FLAG_DISCOV | 8846 MGMT_ADV_FLAG_LIMITED_DISCOV | 8847 MGMT_ADV_FLAG_MANAGED_FLAGS); 8848 } 8849 8850 static bool tx_power_managed(u32 adv_flags) 8851 { 8852 return adv_flags & MGMT_ADV_FLAG_TX_POWER; 8853 } 8854 8855 static bool name_managed(u32 adv_flags) 8856 { 8857 return adv_flags & MGMT_ADV_FLAG_LOCAL_NAME; 8858 } 8859 8860 static bool appearance_managed(u32 adv_flags) 8861 { 8862 return adv_flags & MGMT_ADV_FLAG_APPEARANCE; 8863 } 8864 8865 static bool tlv_data_is_valid(struct hci_dev *hdev, u32 adv_flags, u8 *data, 8866 u8 len, bool is_adv_data) 8867 { 8868 int i, cur_len; 8869 u8 max_len; 8870 8871 max_len = tlv_data_max_len(hdev, adv_flags, is_adv_data); 8872 8873 if (len > max_len) 8874 return false; 8875 8876 /* Make sure that the data is correctly formatted. */ 8877 for (i = 0; i < len; i += (cur_len + 1)) { 8878 cur_len = data[i]; 8879 8880 if (!cur_len) 8881 continue; 8882 8883 /* If the current field length would exceed the total data 8884 * length, then it's invalid. 8885 */ 8886 if (i + cur_len >= len) 8887 return false; 8888 8889 if (data[i + 1] == EIR_FLAGS && 8890 (!is_adv_data || flags_managed(adv_flags))) 8891 return false; 8892 8893 if (data[i + 1] == EIR_TX_POWER && tx_power_managed(adv_flags)) 8894 return false; 8895 8896 if (data[i + 1] == EIR_NAME_COMPLETE && name_managed(adv_flags)) 8897 return false; 8898 8899 if (data[i + 1] == EIR_NAME_SHORT && name_managed(adv_flags)) 8900 return false; 8901 8902 if (data[i + 1] == EIR_APPEARANCE && 8903 appearance_managed(adv_flags)) 8904 return false; 8905 } 8906 8907 return true; 8908 } 8909 8910 static bool requested_adv_flags_are_valid(struct hci_dev *hdev, u32 adv_flags) 8911 { 8912 u32 supported_flags, phy_flags; 8913 8914 /* The current implementation only supports a subset of the specified 8915 * flags. Also need to check mutual exclusiveness of sec flags. 8916 */ 8917 supported_flags = get_supported_adv_flags(hdev); 8918 phy_flags = adv_flags & MGMT_ADV_FLAG_SEC_MASK; 8919 if (adv_flags & ~supported_flags || 8920 ((phy_flags && (phy_flags ^ (phy_flags & -phy_flags))))) 8921 return false; 8922 8923 return true; 8924 } 8925 8926 static bool adv_busy(struct hci_dev *hdev) 8927 { 8928 return pending_find(MGMT_OP_SET_LE, hdev); 8929 } 8930 8931 static void add_adv_complete(struct hci_dev *hdev, struct sock *sk, u8 instance, 8932 int err) 8933 { 8934 struct adv_info *adv, *n; 8935 8936 bt_dev_dbg(hdev, "err %d", err); 8937 8938 hci_dev_lock(hdev); 8939 8940 list_for_each_entry_safe(adv, n, &hdev->adv_instances, list) { 8941 u8 instance; 8942 8943 if (!adv->pending) 8944 continue; 8945 8946 if (!err) { 8947 adv->pending = false; 8948 continue; 8949 } 8950 8951 instance = adv->instance; 8952 8953 if (hdev->cur_adv_instance == instance) 8954 cancel_adv_timeout(hdev); 8955 8956 hci_remove_adv_instance(hdev, instance); 8957 mgmt_advertising_removed(sk, hdev, instance); 8958 } 8959 8960 hci_dev_unlock(hdev); 8961 } 8962 8963 static void add_advertising_complete(struct hci_dev *hdev, void *data, int err) 8964 { 8965 struct mgmt_pending_cmd *cmd = data; 8966 struct mgmt_cp_add_advertising *cp = cmd->param; 8967 struct mgmt_rp_add_advertising rp; 8968 8969 memset(&rp, 0, sizeof(rp)); 8970 8971 rp.instance = cp->instance; 8972 8973 if (err) 8974 mgmt_cmd_status(cmd->sk, cmd->hdev->id, cmd->opcode, 8975 mgmt_status(err)); 8976 else 8977 mgmt_cmd_complete(cmd->sk, cmd->hdev->id, cmd->opcode, 8978 mgmt_status(err), &rp, sizeof(rp)); 8979 8980 add_adv_complete(hdev, cmd->sk, cp->instance, err); 8981 8982 mgmt_pending_free(cmd); 8983 } 8984 8985 static int add_advertising_sync(struct hci_dev *hdev, void *data) 8986 { 8987 struct mgmt_pending_cmd *cmd = data; 8988 struct mgmt_cp_add_advertising *cp = cmd->param; 8989 8990 return hci_schedule_adv_instance_sync(hdev, cp->instance, true); 8991 } 8992 8993 static int add_advertising(struct sock *sk, struct hci_dev *hdev, 8994 void *data, u16 data_len) 8995 { 8996 struct mgmt_cp_add_advertising *cp = data; 8997 struct mgmt_rp_add_advertising rp; 8998 u32 flags; 8999 u8 status; 9000 u16 timeout, duration; 9001 unsigned int prev_instance_cnt; 9002 u8 schedule_instance = 0; 9003 struct adv_info *adv, *next_instance; 9004 int err; 9005 struct mgmt_pending_cmd *cmd; 9006 9007 bt_dev_dbg(hdev, "sock %p", sk); 9008 9009 status = mgmt_le_support(hdev); 9010 if (status) 9011 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING, 9012 status); 9013 9014 if (cp->instance < 1 || cp->instance > hdev->le_num_of_adv_sets) 9015 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING, 9016 MGMT_STATUS_INVALID_PARAMS); 9017 9018 if (data_len != sizeof(*cp) + cp->adv_data_len + cp->scan_rsp_len) 9019 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING, 9020 MGMT_STATUS_INVALID_PARAMS); 9021 9022 flags = __le32_to_cpu(cp->flags); 9023 timeout = __le16_to_cpu(cp->timeout); 9024 duration = __le16_to_cpu(cp->duration); 9025 9026 if (!requested_adv_flags_are_valid(hdev, flags)) 9027 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING, 9028 MGMT_STATUS_INVALID_PARAMS); 9029 9030 hci_dev_lock(hdev); 9031 9032 if (timeout && !hdev_is_powered(hdev)) { 9033 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING, 9034 MGMT_STATUS_REJECTED); 9035 goto unlock; 9036 } 9037 9038 if (adv_busy(hdev)) { 9039 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING, 9040 MGMT_STATUS_BUSY); 9041 goto unlock; 9042 } 9043 9044 if (!tlv_data_is_valid(hdev, flags, cp->data, cp->adv_data_len, true) || 9045 !tlv_data_is_valid(hdev, flags, cp->data + cp->adv_data_len, 9046 cp->scan_rsp_len, false)) { 9047 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING, 9048 MGMT_STATUS_INVALID_PARAMS); 9049 goto unlock; 9050 } 9051 9052 prev_instance_cnt = hdev->adv_instance_cnt; 9053 9054 adv = hci_add_adv_instance(hdev, cp->instance, flags, 9055 cp->adv_data_len, cp->data, 9056 cp->scan_rsp_len, 9057 cp->data + cp->adv_data_len, 9058 timeout, duration, 9059 HCI_ADV_TX_POWER_NO_PREFERENCE, 9060 hdev->le_adv_min_interval, 9061 hdev->le_adv_max_interval, 0); 9062 if (IS_ERR(adv)) { 9063 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_ADVERTISING, 9064 MGMT_STATUS_FAILED); 9065 goto unlock; 9066 } 9067 9068 /* Only trigger an advertising added event if a new instance was 9069 * actually added. 9070 */ 9071 if (hdev->adv_instance_cnt > prev_instance_cnt) 9072 mgmt_advertising_added(sk, hdev, cp->instance); 9073 9074 if (hdev->cur_adv_instance == cp->instance) { 9075 /* If the currently advertised instance is being changed then 9076 * cancel the current advertising and schedule the next 9077 * instance. If there is only one instance then the overridden 9078 * advertising data will be visible right away. 9079 */ 9080 cancel_adv_timeout(hdev); 9081 9082 next_instance = hci_get_next_instance(hdev, cp->instance); 9083 if (next_instance) 9084 schedule_instance = next_instance->instance; 9085 } else if (!hdev->adv_instance_timeout) { 9086 /* Immediately advertise the new instance if no other 9087 * instance is currently being advertised. 9088 */ 9089 schedule_instance = cp->instance; 9090 } 9091 9092 /* If the HCI_ADVERTISING flag is set or the device isn't powered or 9093 * there is no instance to be advertised then we have no HCI 9094 * communication to make. Simply return. 9095 */ 9096 if (!hdev_is_powered(hdev) || 9097 hci_dev_test_flag(hdev, HCI_ADVERTISING) || 9098 !schedule_instance) { 9099 rp.instance = cp->instance; 9100 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_ADVERTISING, 9101 MGMT_STATUS_SUCCESS, &rp, sizeof(rp)); 9102 goto unlock; 9103 } 9104 9105 /* We're good to go, update advertising data, parameters, and start 9106 * advertising. 9107 */ 9108 cmd = mgmt_pending_new(sk, MGMT_OP_ADD_ADVERTISING, hdev, data, 9109 data_len); 9110 if (!cmd) { 9111 err = -ENOMEM; 9112 goto unlock; 9113 } 9114 9115 cp->instance = schedule_instance; 9116 9117 err = hci_cmd_sync_queue(hdev, add_advertising_sync, cmd, 9118 add_advertising_complete); 9119 if (err < 0) 9120 mgmt_pending_free(cmd); 9121 9122 unlock: 9123 hci_dev_unlock(hdev); 9124 9125 return err; 9126 } 9127 9128 static void add_ext_adv_params_complete(struct hci_dev *hdev, void *data, 9129 int err) 9130 { 9131 struct mgmt_pending_cmd *cmd = data; 9132 struct mgmt_cp_add_ext_adv_params *cp = cmd->param; 9133 struct mgmt_rp_add_ext_adv_params rp; 9134 struct adv_info *adv; 9135 u32 flags; 9136 9137 BT_DBG("%s", hdev->name); 9138 9139 hci_dev_lock(hdev); 9140 9141 adv = hci_find_adv_instance(hdev, cp->instance); 9142 if (!adv) 9143 goto unlock; 9144 9145 rp.instance = cp->instance; 9146 rp.tx_power = adv->tx_power; 9147 9148 /* While we're at it, inform userspace of the available space for this 9149 * advertisement, given the flags that will be used. 9150 */ 9151 flags = __le32_to_cpu(cp->flags); 9152 rp.max_adv_data_len = tlv_data_max_len(hdev, flags, true); 9153 rp.max_scan_rsp_len = tlv_data_max_len(hdev, flags, false); 9154 9155 if (err) { 9156 /* If this advertisement was previously advertising and we 9157 * failed to update it, we signal that it has been removed and 9158 * delete its structure 9159 */ 9160 if (!adv->pending) 9161 mgmt_advertising_removed(cmd->sk, hdev, cp->instance); 9162 9163 hci_remove_adv_instance(hdev, cp->instance); 9164 9165 mgmt_cmd_status(cmd->sk, cmd->hdev->id, cmd->opcode, 9166 mgmt_status(err)); 9167 } else { 9168 mgmt_cmd_complete(cmd->sk, cmd->hdev->id, cmd->opcode, 9169 mgmt_status(err), &rp, sizeof(rp)); 9170 } 9171 9172 unlock: 9173 mgmt_pending_free(cmd); 9174 9175 hci_dev_unlock(hdev); 9176 } 9177 9178 static int add_ext_adv_params_sync(struct hci_dev *hdev, void *data) 9179 { 9180 struct mgmt_pending_cmd *cmd = data; 9181 struct mgmt_cp_add_ext_adv_params *cp = cmd->param; 9182 9183 return hci_setup_ext_adv_instance_sync(hdev, cp->instance); 9184 } 9185 9186 static int add_ext_adv_params(struct sock *sk, struct hci_dev *hdev, 9187 void *data, u16 data_len) 9188 { 9189 struct mgmt_cp_add_ext_adv_params *cp = data; 9190 struct mgmt_rp_add_ext_adv_params rp; 9191 struct mgmt_pending_cmd *cmd = NULL; 9192 struct adv_info *adv; 9193 u32 flags, min_interval, max_interval; 9194 u16 timeout, duration; 9195 u8 status; 9196 s8 tx_power; 9197 int err; 9198 9199 BT_DBG("%s", hdev->name); 9200 9201 status = mgmt_le_support(hdev); 9202 if (status) 9203 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_PARAMS, 9204 status); 9205 9206 if (cp->instance < 1 || cp->instance > hdev->le_num_of_adv_sets) 9207 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_PARAMS, 9208 MGMT_STATUS_INVALID_PARAMS); 9209 9210 /* The purpose of breaking add_advertising into two separate MGMT calls 9211 * for params and data is to allow more parameters to be added to this 9212 * structure in the future. For this reason, we verify that we have the 9213 * bare minimum structure we know of when the interface was defined. Any 9214 * extra parameters we don't know about will be ignored in this request. 9215 */ 9216 if (data_len < MGMT_ADD_EXT_ADV_PARAMS_MIN_SIZE) 9217 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_PARAMS, 9218 MGMT_STATUS_INVALID_PARAMS); 9219 9220 flags = __le32_to_cpu(cp->flags); 9221 9222 if (!requested_adv_flags_are_valid(hdev, flags)) 9223 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_PARAMS, 9224 MGMT_STATUS_INVALID_PARAMS); 9225 9226 hci_dev_lock(hdev); 9227 9228 /* In new interface, we require that we are powered to register */ 9229 if (!hdev_is_powered(hdev)) { 9230 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_PARAMS, 9231 MGMT_STATUS_REJECTED); 9232 goto unlock; 9233 } 9234 9235 if (adv_busy(hdev)) { 9236 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_PARAMS, 9237 MGMT_STATUS_BUSY); 9238 goto unlock; 9239 } 9240 9241 /* Parse defined parameters from request, use defaults otherwise */ 9242 timeout = (flags & MGMT_ADV_PARAM_TIMEOUT) ? 9243 __le16_to_cpu(cp->timeout) : 0; 9244 9245 duration = (flags & MGMT_ADV_PARAM_DURATION) ? 9246 __le16_to_cpu(cp->duration) : 9247 hdev->def_multi_adv_rotation_duration; 9248 9249 min_interval = (flags & MGMT_ADV_PARAM_INTERVALS) ? 9250 __le32_to_cpu(cp->min_interval) : 9251 hdev->le_adv_min_interval; 9252 9253 max_interval = (flags & MGMT_ADV_PARAM_INTERVALS) ? 9254 __le32_to_cpu(cp->max_interval) : 9255 hdev->le_adv_max_interval; 9256 9257 tx_power = (flags & MGMT_ADV_PARAM_TX_POWER) ? 9258 cp->tx_power : 9259 HCI_ADV_TX_POWER_NO_PREFERENCE; 9260 9261 /* Create advertising instance with no advertising or response data */ 9262 adv = hci_add_adv_instance(hdev, cp->instance, flags, 0, NULL, 0, NULL, 9263 timeout, duration, tx_power, min_interval, 9264 max_interval, 0); 9265 9266 if (IS_ERR(adv)) { 9267 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_PARAMS, 9268 MGMT_STATUS_FAILED); 9269 goto unlock; 9270 } 9271 9272 /* Submit request for advertising params if ext adv available */ 9273 if (ext_adv_capable(hdev)) { 9274 cmd = mgmt_pending_new(sk, MGMT_OP_ADD_EXT_ADV_PARAMS, hdev, 9275 data, data_len); 9276 if (!cmd) { 9277 err = -ENOMEM; 9278 hci_remove_adv_instance(hdev, cp->instance); 9279 goto unlock; 9280 } 9281 9282 err = hci_cmd_sync_queue(hdev, add_ext_adv_params_sync, cmd, 9283 add_ext_adv_params_complete); 9284 if (err < 0) 9285 mgmt_pending_free(cmd); 9286 } else { 9287 rp.instance = cp->instance; 9288 rp.tx_power = HCI_ADV_TX_POWER_NO_PREFERENCE; 9289 rp.max_adv_data_len = tlv_data_max_len(hdev, flags, true); 9290 rp.max_scan_rsp_len = tlv_data_max_len(hdev, flags, false); 9291 err = mgmt_cmd_complete(sk, hdev->id, 9292 MGMT_OP_ADD_EXT_ADV_PARAMS, 9293 MGMT_STATUS_SUCCESS, &rp, sizeof(rp)); 9294 } 9295 9296 unlock: 9297 hci_dev_unlock(hdev); 9298 9299 return err; 9300 } 9301 9302 static void add_ext_adv_data_complete(struct hci_dev *hdev, void *data, int err) 9303 { 9304 struct mgmt_pending_cmd *cmd = data; 9305 struct mgmt_cp_add_ext_adv_data *cp = cmd->param; 9306 struct mgmt_rp_add_advertising rp; 9307 9308 add_adv_complete(hdev, cmd->sk, cp->instance, err); 9309 9310 memset(&rp, 0, sizeof(rp)); 9311 9312 rp.instance = cp->instance; 9313 9314 if (err) 9315 mgmt_cmd_status(cmd->sk, cmd->hdev->id, cmd->opcode, 9316 mgmt_status(err)); 9317 else 9318 mgmt_cmd_complete(cmd->sk, cmd->hdev->id, cmd->opcode, 9319 mgmt_status(err), &rp, sizeof(rp)); 9320 9321 mgmt_pending_free(cmd); 9322 } 9323 9324 static int add_ext_adv_data_sync(struct hci_dev *hdev, void *data) 9325 { 9326 struct mgmt_pending_cmd *cmd = data; 9327 struct mgmt_cp_add_ext_adv_data *cp = cmd->param; 9328 int err; 9329 9330 if (ext_adv_capable(hdev)) { 9331 err = hci_update_adv_data_sync(hdev, cp->instance); 9332 if (err) 9333 return err; 9334 9335 err = hci_update_scan_rsp_data_sync(hdev, cp->instance); 9336 if (err) 9337 return err; 9338 9339 return hci_enable_ext_advertising_sync(hdev, cp->instance); 9340 } 9341 9342 return hci_schedule_adv_instance_sync(hdev, cp->instance, true); 9343 } 9344 9345 static int add_ext_adv_data(struct sock *sk, struct hci_dev *hdev, void *data, 9346 u16 data_len) 9347 { 9348 struct mgmt_cp_add_ext_adv_data *cp = data; 9349 struct mgmt_rp_add_ext_adv_data rp; 9350 u8 schedule_instance = 0; 9351 struct adv_info *next_instance; 9352 struct adv_info *adv_instance; 9353 int err = 0; 9354 struct mgmt_pending_cmd *cmd; 9355 u16 expected_len; 9356 9357 BT_DBG("%s", hdev->name); 9358 9359 expected_len = struct_size(cp, data, cp->adv_data_len + 9360 cp->scan_rsp_len); 9361 if (expected_len > data_len) 9362 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_DATA, 9363 MGMT_STATUS_INVALID_PARAMS); 9364 9365 hci_dev_lock(hdev); 9366 9367 adv_instance = hci_find_adv_instance(hdev, cp->instance); 9368 9369 if (!adv_instance) { 9370 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_DATA, 9371 MGMT_STATUS_INVALID_PARAMS); 9372 goto unlock; 9373 } 9374 9375 /* In new interface, we require that we are powered to register */ 9376 if (!hdev_is_powered(hdev)) { 9377 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_DATA, 9378 MGMT_STATUS_REJECTED); 9379 goto clear_new_instance; 9380 } 9381 9382 if (adv_busy(hdev)) { 9383 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_DATA, 9384 MGMT_STATUS_BUSY); 9385 goto clear_new_instance; 9386 } 9387 9388 /* Validate new data */ 9389 if (!tlv_data_is_valid(hdev, adv_instance->flags, cp->data, 9390 cp->adv_data_len, true) || 9391 !tlv_data_is_valid(hdev, adv_instance->flags, cp->data + 9392 cp->adv_data_len, cp->scan_rsp_len, false)) { 9393 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_DATA, 9394 MGMT_STATUS_INVALID_PARAMS); 9395 goto clear_new_instance; 9396 } 9397 9398 /* Set the data in the advertising instance */ 9399 hci_set_adv_instance_data(hdev, cp->instance, cp->adv_data_len, 9400 cp->data, cp->scan_rsp_len, 9401 cp->data + cp->adv_data_len); 9402 9403 /* If using software rotation, determine next instance to use */ 9404 if (hdev->cur_adv_instance == cp->instance) { 9405 /* If the currently advertised instance is being changed 9406 * then cancel the current advertising and schedule the 9407 * next instance. If there is only one instance then the 9408 * overridden advertising data will be visible right 9409 * away 9410 */ 9411 cancel_adv_timeout(hdev); 9412 9413 next_instance = hci_get_next_instance(hdev, cp->instance); 9414 if (next_instance) 9415 schedule_instance = next_instance->instance; 9416 } else if (!hdev->adv_instance_timeout) { 9417 /* Immediately advertise the new instance if no other 9418 * instance is currently being advertised. 9419 */ 9420 schedule_instance = cp->instance; 9421 } 9422 9423 /* If the HCI_ADVERTISING flag is set or there is no instance to 9424 * be advertised then we have no HCI communication to make. 9425 * Simply return. 9426 */ 9427 if (hci_dev_test_flag(hdev, HCI_ADVERTISING) || !schedule_instance) { 9428 if (adv_instance->pending) { 9429 mgmt_advertising_added(sk, hdev, cp->instance); 9430 adv_instance->pending = false; 9431 } 9432 rp.instance = cp->instance; 9433 err = mgmt_cmd_complete(sk, hdev->id, MGMT_OP_ADD_EXT_ADV_DATA, 9434 MGMT_STATUS_SUCCESS, &rp, sizeof(rp)); 9435 goto unlock; 9436 } 9437 9438 cmd = mgmt_pending_new(sk, MGMT_OP_ADD_EXT_ADV_DATA, hdev, data, 9439 data_len); 9440 if (!cmd) { 9441 err = -ENOMEM; 9442 goto clear_new_instance; 9443 } 9444 9445 err = hci_cmd_sync_queue(hdev, add_ext_adv_data_sync, cmd, 9446 add_ext_adv_data_complete); 9447 if (err < 0) { 9448 mgmt_pending_free(cmd); 9449 goto clear_new_instance; 9450 } 9451 9452 /* We were successful in updating data, so trigger advertising_added 9453 * event if this is an instance that wasn't previously advertising. If 9454 * a failure occurs in the requests we initiated, we will remove the 9455 * instance again in add_advertising_complete 9456 */ 9457 if (adv_instance->pending) 9458 mgmt_advertising_added(sk, hdev, cp->instance); 9459 9460 goto unlock; 9461 9462 clear_new_instance: 9463 hci_remove_adv_instance(hdev, cp->instance); 9464 9465 unlock: 9466 hci_dev_unlock(hdev); 9467 9468 return err; 9469 } 9470 9471 static void remove_advertising_complete(struct hci_dev *hdev, void *data, 9472 int err) 9473 { 9474 struct mgmt_pending_cmd *cmd = data; 9475 struct mgmt_cp_remove_advertising *cp = cmd->param; 9476 struct mgmt_rp_remove_advertising rp; 9477 9478 bt_dev_dbg(hdev, "err %d", err); 9479 9480 memset(&rp, 0, sizeof(rp)); 9481 rp.instance = cp->instance; 9482 9483 if (err) 9484 mgmt_cmd_status(cmd->sk, cmd->hdev->id, cmd->opcode, 9485 mgmt_status(err)); 9486 else 9487 mgmt_cmd_complete(cmd->sk, cmd->hdev->id, cmd->opcode, 9488 MGMT_STATUS_SUCCESS, &rp, sizeof(rp)); 9489 9490 mgmt_pending_free(cmd); 9491 } 9492 9493 static int remove_advertising_sync(struct hci_dev *hdev, void *data) 9494 { 9495 struct mgmt_pending_cmd *cmd = data; 9496 struct mgmt_cp_remove_advertising *cp = cmd->param; 9497 int err; 9498 9499 err = hci_remove_advertising_sync(hdev, cmd->sk, cp->instance, true); 9500 if (err) 9501 return err; 9502 9503 if (list_empty(&hdev->adv_instances)) 9504 err = hci_disable_advertising_sync(hdev); 9505 9506 return err; 9507 } 9508 9509 static int remove_advertising(struct sock *sk, struct hci_dev *hdev, 9510 void *data, u16 data_len) 9511 { 9512 struct mgmt_cp_remove_advertising *cp = data; 9513 struct mgmt_pending_cmd *cmd; 9514 int err; 9515 9516 bt_dev_dbg(hdev, "sock %p", sk); 9517 9518 hci_dev_lock(hdev); 9519 9520 if (cp->instance && !hci_find_adv_instance(hdev, cp->instance)) { 9521 err = mgmt_cmd_status(sk, hdev->id, 9522 MGMT_OP_REMOVE_ADVERTISING, 9523 MGMT_STATUS_INVALID_PARAMS); 9524 goto unlock; 9525 } 9526 9527 if (pending_find(MGMT_OP_SET_LE, hdev)) { 9528 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_ADVERTISING, 9529 MGMT_STATUS_BUSY); 9530 goto unlock; 9531 } 9532 9533 if (list_empty(&hdev->adv_instances)) { 9534 err = mgmt_cmd_status(sk, hdev->id, MGMT_OP_REMOVE_ADVERTISING, 9535 MGMT_STATUS_INVALID_PARAMS); 9536 goto unlock; 9537 } 9538 9539 cmd = mgmt_pending_new(sk, MGMT_OP_REMOVE_ADVERTISING, hdev, data, 9540 data_len); 9541 if (!cmd) { 9542 err = -ENOMEM; 9543 goto unlock; 9544 } 9545 9546 err = hci_cmd_sync_queue(hdev, remove_advertising_sync, cmd, 9547 remove_advertising_complete); 9548 if (err < 0) 9549 mgmt_pending_free(cmd); 9550 9551 unlock: 9552 hci_dev_unlock(hdev); 9553 9554 return err; 9555 } 9556 9557 static int get_adv_size_info(struct sock *sk, struct hci_dev *hdev, 9558 void *data, u16 data_len) 9559 { 9560 struct mgmt_cp_get_adv_size_info *cp = data; 9561 struct mgmt_rp_get_adv_size_info rp; 9562 u32 flags, supported_flags; 9563 9564 bt_dev_dbg(hdev, "sock %p", sk); 9565 9566 if (!lmp_le_capable(hdev)) 9567 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_ADV_SIZE_INFO, 9568 MGMT_STATUS_REJECTED); 9569 9570 if (cp->instance < 1 || cp->instance > hdev->le_num_of_adv_sets) 9571 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_ADV_SIZE_INFO, 9572 MGMT_STATUS_INVALID_PARAMS); 9573 9574 flags = __le32_to_cpu(cp->flags); 9575 9576 /* The current implementation only supports a subset of the specified 9577 * flags. 9578 */ 9579 supported_flags = get_supported_adv_flags(hdev); 9580 if (flags & ~supported_flags) 9581 return mgmt_cmd_status(sk, hdev->id, MGMT_OP_GET_ADV_SIZE_INFO, 9582 MGMT_STATUS_INVALID_PARAMS); 9583 9584 rp.instance = cp->instance; 9585 rp.flags = cp->flags; 9586 rp.max_adv_data_len = tlv_data_max_len(hdev, flags, true); 9587 rp.max_scan_rsp_len = tlv_data_max_len(hdev, flags, false); 9588 9589 return mgmt_cmd_complete(sk, hdev->id, MGMT_OP_GET_ADV_SIZE_INFO, 9590 MGMT_STATUS_SUCCESS, &rp, sizeof(rp)); 9591 } 9592 9593 static const struct hci_mgmt_handler mgmt_handlers[] = { 9594 { NULL }, /* 0x0000 (no command) */ 9595 { read_version, MGMT_READ_VERSION_SIZE, 9596 HCI_MGMT_NO_HDEV | 9597 HCI_MGMT_UNTRUSTED }, 9598 { read_commands, MGMT_READ_COMMANDS_SIZE, 9599 HCI_MGMT_NO_HDEV | 9600 HCI_MGMT_UNTRUSTED }, 9601 { read_index_list, MGMT_READ_INDEX_LIST_SIZE, 9602 HCI_MGMT_NO_HDEV | 9603 HCI_MGMT_UNTRUSTED }, 9604 { read_controller_info, MGMT_READ_INFO_SIZE, 9605 HCI_MGMT_UNTRUSTED }, 9606 { set_powered, MGMT_SETTING_SIZE }, 9607 { set_discoverable, MGMT_SET_DISCOVERABLE_SIZE }, 9608 { set_connectable, MGMT_SETTING_SIZE }, 9609 { set_fast_connectable, MGMT_SETTING_SIZE }, 9610 { set_bondable, MGMT_SETTING_SIZE }, 9611 { set_link_security, MGMT_SETTING_SIZE }, 9612 { set_ssp, MGMT_SETTING_SIZE }, 9613 { set_hs, MGMT_SETTING_SIZE }, 9614 { set_le, MGMT_SETTING_SIZE }, 9615 { set_dev_class, MGMT_SET_DEV_CLASS_SIZE }, 9616 { set_local_name, MGMT_SET_LOCAL_NAME_SIZE }, 9617 { add_uuid, MGMT_ADD_UUID_SIZE }, 9618 { remove_uuid, MGMT_REMOVE_UUID_SIZE }, 9619 { load_link_keys, MGMT_LOAD_LINK_KEYS_SIZE, 9620 HCI_MGMT_VAR_LEN }, 9621 { load_long_term_keys, MGMT_LOAD_LONG_TERM_KEYS_SIZE, 9622 HCI_MGMT_VAR_LEN }, 9623 { disconnect, MGMT_DISCONNECT_SIZE }, 9624 { get_connections, MGMT_GET_CONNECTIONS_SIZE }, 9625 { pin_code_reply, MGMT_PIN_CODE_REPLY_SIZE }, 9626 { pin_code_neg_reply, MGMT_PIN_CODE_NEG_REPLY_SIZE }, 9627 { set_io_capability, MGMT_SET_IO_CAPABILITY_SIZE }, 9628 { pair_device, MGMT_PAIR_DEVICE_SIZE }, 9629 { cancel_pair_device, MGMT_CANCEL_PAIR_DEVICE_SIZE }, 9630 { unpair_device, MGMT_UNPAIR_DEVICE_SIZE }, 9631 { user_confirm_reply, MGMT_USER_CONFIRM_REPLY_SIZE }, 9632 { user_confirm_neg_reply, MGMT_USER_CONFIRM_NEG_REPLY_SIZE }, 9633 { user_passkey_reply, MGMT_USER_PASSKEY_REPLY_SIZE }, 9634 { user_passkey_neg_reply, MGMT_USER_PASSKEY_NEG_REPLY_SIZE }, 9635 { read_local_oob_data, MGMT_READ_LOCAL_OOB_DATA_SIZE }, 9636 { add_remote_oob_data, MGMT_ADD_REMOTE_OOB_DATA_SIZE, 9637 HCI_MGMT_VAR_LEN }, 9638 { remove_remote_oob_data, MGMT_REMOVE_REMOTE_OOB_DATA_SIZE }, 9639 { start_discovery, MGMT_START_DISCOVERY_SIZE }, 9640 { stop_discovery, MGMT_STOP_DISCOVERY_SIZE }, 9641 { confirm_name, MGMT_CONFIRM_NAME_SIZE }, 9642 { block_device, MGMT_BLOCK_DEVICE_SIZE }, 9643 { unblock_device, MGMT_UNBLOCK_DEVICE_SIZE }, 9644 { set_device_id, MGMT_SET_DEVICE_ID_SIZE }, 9645 { set_advertising, MGMT_SETTING_SIZE }, 9646 { set_bredr, MGMT_SETTING_SIZE }, 9647 { set_static_address, MGMT_SET_STATIC_ADDRESS_SIZE }, 9648 { set_scan_params, MGMT_SET_SCAN_PARAMS_SIZE }, 9649 { set_secure_conn, MGMT_SETTING_SIZE }, 9650 { set_debug_keys, MGMT_SETTING_SIZE }, 9651 { set_privacy, MGMT_SET_PRIVACY_SIZE }, 9652 { load_irks, MGMT_LOAD_IRKS_SIZE, 9653 HCI_MGMT_VAR_LEN }, 9654 { get_conn_info, MGMT_GET_CONN_INFO_SIZE }, 9655 { get_clock_info, MGMT_GET_CLOCK_INFO_SIZE }, 9656 { add_device, MGMT_ADD_DEVICE_SIZE }, 9657 { remove_device, MGMT_REMOVE_DEVICE_SIZE }, 9658 { load_conn_param, MGMT_LOAD_CONN_PARAM_SIZE, 9659 HCI_MGMT_VAR_LEN }, 9660 { read_unconf_index_list, MGMT_READ_UNCONF_INDEX_LIST_SIZE, 9661 HCI_MGMT_NO_HDEV | 9662 HCI_MGMT_UNTRUSTED }, 9663 { read_config_info, MGMT_READ_CONFIG_INFO_SIZE, 9664 HCI_MGMT_UNCONFIGURED | 9665 HCI_MGMT_UNTRUSTED }, 9666 { set_external_config, MGMT_SET_EXTERNAL_CONFIG_SIZE, 9667 HCI_MGMT_UNCONFIGURED }, 9668 { set_public_address, MGMT_SET_PUBLIC_ADDRESS_SIZE, 9669 HCI_MGMT_UNCONFIGURED }, 9670 { start_service_discovery, MGMT_START_SERVICE_DISCOVERY_SIZE, 9671 HCI_MGMT_VAR_LEN }, 9672 { read_local_oob_ext_data, MGMT_READ_LOCAL_OOB_EXT_DATA_SIZE }, 9673 { read_ext_index_list, MGMT_READ_EXT_INDEX_LIST_SIZE, 9674 HCI_MGMT_NO_HDEV | 9675 HCI_MGMT_UNTRUSTED }, 9676 { read_adv_features, MGMT_READ_ADV_FEATURES_SIZE }, 9677 { add_advertising, MGMT_ADD_ADVERTISING_SIZE, 9678 HCI_MGMT_VAR_LEN }, 9679 { remove_advertising, MGMT_REMOVE_ADVERTISING_SIZE }, 9680 { get_adv_size_info, MGMT_GET_ADV_SIZE_INFO_SIZE }, 9681 { start_limited_discovery, MGMT_START_DISCOVERY_SIZE }, 9682 { read_ext_controller_info,MGMT_READ_EXT_INFO_SIZE, 9683 HCI_MGMT_UNTRUSTED }, 9684 { set_appearance, MGMT_SET_APPEARANCE_SIZE }, 9685 { get_phy_configuration, MGMT_GET_PHY_CONFIGURATION_SIZE }, 9686 { set_phy_configuration, MGMT_SET_PHY_CONFIGURATION_SIZE }, 9687 { set_blocked_keys, MGMT_OP_SET_BLOCKED_KEYS_SIZE, 9688 HCI_MGMT_VAR_LEN }, 9689 { set_wideband_speech, MGMT_SETTING_SIZE }, 9690 { read_controller_cap, MGMT_READ_CONTROLLER_CAP_SIZE, 9691 HCI_MGMT_UNTRUSTED }, 9692 { read_exp_features_info, MGMT_READ_EXP_FEATURES_INFO_SIZE, 9693 HCI_MGMT_UNTRUSTED | 9694 HCI_MGMT_HDEV_OPTIONAL }, 9695 { set_exp_feature, MGMT_SET_EXP_FEATURE_SIZE, 9696 HCI_MGMT_VAR_LEN | 9697 HCI_MGMT_HDEV_OPTIONAL }, 9698 { read_def_system_config, MGMT_READ_DEF_SYSTEM_CONFIG_SIZE, 9699 HCI_MGMT_UNTRUSTED }, 9700 { set_def_system_config, MGMT_SET_DEF_SYSTEM_CONFIG_SIZE, 9701 HCI_MGMT_VAR_LEN }, 9702 { read_def_runtime_config, MGMT_READ_DEF_RUNTIME_CONFIG_SIZE, 9703 HCI_MGMT_UNTRUSTED }, 9704 { set_def_runtime_config, MGMT_SET_DEF_RUNTIME_CONFIG_SIZE, 9705 HCI_MGMT_VAR_LEN }, 9706 { get_device_flags, MGMT_GET_DEVICE_FLAGS_SIZE }, 9707 { set_device_flags, MGMT_SET_DEVICE_FLAGS_SIZE }, 9708 { read_adv_mon_features, MGMT_READ_ADV_MONITOR_FEATURES_SIZE }, 9709 { add_adv_patterns_monitor,MGMT_ADD_ADV_PATTERNS_MONITOR_SIZE, 9710 HCI_MGMT_VAR_LEN }, 9711 { remove_adv_monitor, MGMT_REMOVE_ADV_MONITOR_SIZE }, 9712 { add_ext_adv_params, MGMT_ADD_EXT_ADV_PARAMS_MIN_SIZE, 9713 HCI_MGMT_VAR_LEN }, 9714 { add_ext_adv_data, MGMT_ADD_EXT_ADV_DATA_SIZE, 9715 HCI_MGMT_VAR_LEN }, 9716 { add_adv_patterns_monitor_rssi, 9717 MGMT_ADD_ADV_PATTERNS_MONITOR_RSSI_SIZE, 9718 HCI_MGMT_VAR_LEN }, 9719 { set_mesh, MGMT_SET_MESH_RECEIVER_SIZE, 9720 HCI_MGMT_VAR_LEN }, 9721 { mesh_features, MGMT_MESH_READ_FEATURES_SIZE }, 9722 { mesh_send, MGMT_MESH_SEND_SIZE, 9723 HCI_MGMT_VAR_LEN }, 9724 { mesh_send_cancel, MGMT_MESH_SEND_CANCEL_SIZE }, 9725 { mgmt_hci_cmd_sync, MGMT_HCI_CMD_SYNC_SIZE, HCI_MGMT_VAR_LEN }, 9726 { load_conn_subrate, MGMT_LOAD_CONN_SUBRATE_SIZE, 9727 HCI_MGMT_VAR_LEN }, 9728 }; 9729 9730 void mgmt_index_added(struct hci_dev *hdev) 9731 { 9732 struct mgmt_ev_ext_index ev; 9733 9734 if (hci_test_quirk(hdev, HCI_QUIRK_RAW_DEVICE)) 9735 return; 9736 9737 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) { 9738 mgmt_index_event(MGMT_EV_UNCONF_INDEX_ADDED, hdev, NULL, 0, 9739 HCI_MGMT_UNCONF_INDEX_EVENTS); 9740 ev.type = 0x01; 9741 } else { 9742 mgmt_index_event(MGMT_EV_INDEX_ADDED, hdev, NULL, 0, 9743 HCI_MGMT_INDEX_EVENTS); 9744 ev.type = 0x00; 9745 } 9746 9747 ev.bus = hdev->bus; 9748 9749 mgmt_index_event(MGMT_EV_EXT_INDEX_ADDED, hdev, &ev, sizeof(ev), 9750 HCI_MGMT_EXT_INDEX_EVENTS); 9751 } 9752 9753 void mgmt_index_removed(struct hci_dev *hdev) 9754 { 9755 struct mgmt_ev_ext_index ev; 9756 struct cmd_lookup match = { NULL, hdev, MGMT_STATUS_INVALID_INDEX }; 9757 9758 if (hci_test_quirk(hdev, HCI_QUIRK_RAW_DEVICE)) 9759 return; 9760 9761 mgmt_pending_foreach(0, hdev, true, cmd_complete_rsp, &match); 9762 9763 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) { 9764 mgmt_index_event(MGMT_EV_UNCONF_INDEX_REMOVED, hdev, NULL, 0, 9765 HCI_MGMT_UNCONF_INDEX_EVENTS); 9766 ev.type = 0x01; 9767 } else { 9768 mgmt_index_event(MGMT_EV_INDEX_REMOVED, hdev, NULL, 0, 9769 HCI_MGMT_INDEX_EVENTS); 9770 ev.type = 0x00; 9771 } 9772 9773 ev.bus = hdev->bus; 9774 9775 mgmt_index_event(MGMT_EV_EXT_INDEX_REMOVED, hdev, &ev, sizeof(ev), 9776 HCI_MGMT_EXT_INDEX_EVENTS); 9777 9778 /* Cancel any remaining timed work */ 9779 if (!hci_dev_test_flag(hdev, HCI_MGMT)) 9780 return; 9781 cancel_delayed_work_sync(&hdev->discov_off); 9782 cancel_delayed_work_sync(&hdev->service_cache); 9783 cancel_delayed_work_sync(&hdev->rpa_expired); 9784 cancel_delayed_work_sync(&hdev->mesh_send_done); 9785 } 9786 9787 void mgmt_power_on(struct hci_dev *hdev, int err) 9788 { 9789 struct cmd_lookup match = { NULL, hdev }; 9790 9791 bt_dev_dbg(hdev, "err %d", err); 9792 9793 hci_dev_lock(hdev); 9794 9795 if (!err) { 9796 restart_le_actions(hdev); 9797 hci_update_passive_scan(hdev); 9798 } 9799 9800 mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, true, settings_rsp, 9801 &match); 9802 9803 new_settings(hdev, match.sk); 9804 9805 if (match.sk) 9806 sock_put(match.sk); 9807 9808 hci_dev_unlock(hdev); 9809 } 9810 9811 void __mgmt_power_off(struct hci_dev *hdev) 9812 { 9813 struct cmd_lookup match = { NULL, hdev }; 9814 u8 zero_cod[] = { 0, 0, 0 }; 9815 9816 mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, true, settings_rsp, 9817 &match); 9818 9819 /* If the power off is because of hdev unregistration let 9820 * use the appropriate INVALID_INDEX status. Otherwise use 9821 * NOT_POWERED. We cover both scenarios here since later in 9822 * mgmt_index_removed() any hci_conn callbacks will have already 9823 * been triggered, potentially causing misleading DISCONNECTED 9824 * status responses. 9825 */ 9826 if (hci_dev_test_flag(hdev, HCI_UNREGISTER)) 9827 match.mgmt_status = MGMT_STATUS_INVALID_INDEX; 9828 else 9829 match.mgmt_status = MGMT_STATUS_NOT_POWERED; 9830 9831 mgmt_pending_foreach(0, hdev, true, cmd_complete_rsp, &match); 9832 9833 if (memcmp(hdev->dev_class, zero_cod, sizeof(zero_cod)) != 0) { 9834 mgmt_limited_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev, 9835 zero_cod, sizeof(zero_cod), 9836 HCI_MGMT_DEV_CLASS_EVENTS, NULL); 9837 ext_info_changed(hdev, NULL); 9838 } 9839 9840 new_settings(hdev, match.sk); 9841 9842 if (match.sk) 9843 sock_put(match.sk); 9844 } 9845 9846 void mgmt_set_powered_failed(struct hci_dev *hdev, int err) 9847 { 9848 struct mgmt_pending_cmd *cmd; 9849 u8 status; 9850 9851 cmd = pending_find(MGMT_OP_SET_POWERED, hdev); 9852 if (!cmd) 9853 return; 9854 9855 if (err == -ERFKILL) 9856 status = MGMT_STATUS_RFKILLED; 9857 else 9858 status = MGMT_STATUS_FAILED; 9859 9860 mgmt_cmd_status(cmd->sk, hdev->id, MGMT_OP_SET_POWERED, status); 9861 9862 mgmt_pending_remove(cmd); 9863 } 9864 9865 void mgmt_new_link_key(struct hci_dev *hdev, struct link_key *key, 9866 bool persistent) 9867 { 9868 struct mgmt_ev_new_link_key ev; 9869 9870 memset(&ev, 0, sizeof(ev)); 9871 9872 ev.store_hint = persistent; 9873 bacpy(&ev.key.addr.bdaddr, &key->bdaddr); 9874 ev.key.addr.type = BDADDR_BREDR; 9875 ev.key.type = key->type; 9876 memcpy(ev.key.val, key->val, HCI_LINK_KEY_SIZE); 9877 ev.key.pin_len = key->pin_len; 9878 9879 mgmt_event(MGMT_EV_NEW_LINK_KEY, hdev, &ev, sizeof(ev), NULL); 9880 } 9881 9882 static u8 mgmt_ltk_type(struct smp_ltk *ltk) 9883 { 9884 switch (ltk->type) { 9885 case SMP_LTK: 9886 case SMP_LTK_RESPONDER: 9887 if (ltk->authenticated) 9888 return MGMT_LTK_AUTHENTICATED; 9889 return MGMT_LTK_UNAUTHENTICATED; 9890 case SMP_LTK_P256: 9891 if (ltk->authenticated) 9892 return MGMT_LTK_P256_AUTH; 9893 return MGMT_LTK_P256_UNAUTH; 9894 case SMP_LTK_P256_DEBUG: 9895 return MGMT_LTK_P256_DEBUG; 9896 } 9897 9898 return MGMT_LTK_UNAUTHENTICATED; 9899 } 9900 9901 void mgmt_new_ltk(struct hci_dev *hdev, struct smp_ltk *key, bool persistent) 9902 { 9903 struct mgmt_ev_new_long_term_key ev; 9904 9905 memset(&ev, 0, sizeof(ev)); 9906 9907 /* Devices using resolvable or non-resolvable random addresses 9908 * without providing an identity resolving key don't require 9909 * to store long term keys. Their addresses will change the 9910 * next time around. 9911 * 9912 * Only when a remote device provides an identity address 9913 * make sure the long term key is stored. If the remote 9914 * identity is known, the long term keys are internally 9915 * mapped to the identity address. So allow static random 9916 * and public addresses here. 9917 */ 9918 if (key->bdaddr_type == ADDR_LE_DEV_RANDOM && 9919 (key->bdaddr.b[5] & 0xc0) != 0xc0) 9920 ev.store_hint = 0x00; 9921 else 9922 ev.store_hint = persistent; 9923 9924 bacpy(&ev.key.addr.bdaddr, &key->bdaddr); 9925 ev.key.addr.type = link_to_bdaddr(LE_LINK, key->bdaddr_type); 9926 ev.key.type = mgmt_ltk_type(key); 9927 ev.key.enc_size = key->enc_size; 9928 ev.key.ediv = key->ediv; 9929 ev.key.rand = key->rand; 9930 9931 if (key->type == SMP_LTK) 9932 ev.key.initiator = 1; 9933 9934 /* Make sure we copy only the significant bytes based on the 9935 * encryption key size, and set the rest of the value to zeroes. 9936 */ 9937 memcpy(ev.key.val, key->val, key->enc_size); 9938 memset(ev.key.val + key->enc_size, 0, 9939 sizeof(ev.key.val) - key->enc_size); 9940 9941 mgmt_event(MGMT_EV_NEW_LONG_TERM_KEY, hdev, &ev, sizeof(ev), NULL); 9942 } 9943 9944 void mgmt_new_irk(struct hci_dev *hdev, struct smp_irk *irk, bool persistent) 9945 { 9946 struct mgmt_ev_new_irk ev; 9947 9948 memset(&ev, 0, sizeof(ev)); 9949 9950 ev.store_hint = persistent; 9951 9952 bacpy(&ev.rpa, &irk->rpa); 9953 bacpy(&ev.irk.addr.bdaddr, &irk->bdaddr); 9954 ev.irk.addr.type = link_to_bdaddr(LE_LINK, irk->addr_type); 9955 memcpy(ev.irk.val, irk->val, sizeof(irk->val)); 9956 9957 mgmt_event(MGMT_EV_NEW_IRK, hdev, &ev, sizeof(ev), NULL); 9958 } 9959 9960 void mgmt_new_csrk(struct hci_dev *hdev, struct smp_csrk *csrk, 9961 bool persistent) 9962 { 9963 struct mgmt_ev_new_csrk ev; 9964 9965 memset(&ev, 0, sizeof(ev)); 9966 9967 /* Devices using resolvable or non-resolvable random addresses 9968 * without providing an identity resolving key don't require 9969 * to store signature resolving keys. Their addresses will change 9970 * the next time around. 9971 * 9972 * Only when a remote device provides an identity address 9973 * make sure the signature resolving key is stored. So allow 9974 * static random and public addresses here. 9975 */ 9976 if (csrk->bdaddr_type == ADDR_LE_DEV_RANDOM && 9977 (csrk->bdaddr.b[5] & 0xc0) != 0xc0) 9978 ev.store_hint = 0x00; 9979 else 9980 ev.store_hint = persistent; 9981 9982 bacpy(&ev.key.addr.bdaddr, &csrk->bdaddr); 9983 ev.key.addr.type = link_to_bdaddr(LE_LINK, csrk->bdaddr_type); 9984 ev.key.type = csrk->type; 9985 memcpy(ev.key.val, csrk->val, sizeof(csrk->val)); 9986 9987 mgmt_event(MGMT_EV_NEW_CSRK, hdev, &ev, sizeof(ev), NULL); 9988 } 9989 9990 void mgmt_new_conn_param(struct hci_dev *hdev, bdaddr_t *bdaddr, 9991 u8 bdaddr_type, u8 store_hint, u16 min_interval, 9992 u16 max_interval, u16 latency, u16 timeout) 9993 { 9994 struct mgmt_ev_new_conn_param ev; 9995 9996 if (!hci_is_identity_address(bdaddr, bdaddr_type)) 9997 return; 9998 9999 memset(&ev, 0, sizeof(ev)); 10000 bacpy(&ev.addr.bdaddr, bdaddr); 10001 ev.addr.type = link_to_bdaddr(LE_LINK, bdaddr_type); 10002 ev.store_hint = store_hint; 10003 ev.min_interval = cpu_to_le16(min_interval); 10004 ev.max_interval = cpu_to_le16(max_interval); 10005 ev.latency = cpu_to_le16(latency); 10006 ev.timeout = cpu_to_le16(timeout); 10007 10008 mgmt_event(MGMT_EV_NEW_CONN_PARAM, hdev, &ev, sizeof(ev), NULL); 10009 } 10010 10011 void mgmt_device_connected(struct hci_dev *hdev, struct hci_conn *conn, 10012 u8 *name, u8 name_len) 10013 { 10014 struct sk_buff *skb; 10015 struct mgmt_ev_device_connected *ev; 10016 u16 eir_len = 0; 10017 u32 flags = 0; 10018 10019 if (test_and_set_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags)) 10020 return; 10021 10022 /* allocate buff for LE or BR/EDR adv */ 10023 if (conn->le_adv_data_len > 0) 10024 skb = mgmt_alloc_skb(hdev, MGMT_EV_DEVICE_CONNECTED, 10025 sizeof(*ev) + conn->le_adv_data_len); 10026 else 10027 skb = mgmt_alloc_skb(hdev, MGMT_EV_DEVICE_CONNECTED, 10028 sizeof(*ev) + (name ? eir_precalc_len(name_len) : 0) + 10029 eir_precalc_len(sizeof(conn->dev_class))); 10030 10031 if (!skb) 10032 return; 10033 10034 ev = skb_put(skb, sizeof(*ev)); 10035 bacpy(&ev->addr.bdaddr, &conn->dst); 10036 ev->addr.type = link_to_bdaddr(conn->type, conn->dst_type); 10037 10038 if (conn->out) 10039 flags |= MGMT_DEV_FOUND_INITIATED_CONN; 10040 10041 ev->flags = __cpu_to_le32(flags); 10042 10043 /* We must ensure that the EIR Data fields are ordered and 10044 * unique. Keep it simple for now and avoid the problem by not 10045 * adding any BR/EDR data to the LE adv. 10046 */ 10047 if (conn->le_adv_data_len > 0) { 10048 skb_put_data(skb, conn->le_adv_data, conn->le_adv_data_len); 10049 eir_len = conn->le_adv_data_len; 10050 } else { 10051 if (name) 10052 eir_len += eir_skb_put_data(skb, EIR_NAME_COMPLETE, name, name_len); 10053 10054 if (memcmp(conn->dev_class, "\0\0\0", sizeof(conn->dev_class))) 10055 eir_len += eir_skb_put_data(skb, EIR_CLASS_OF_DEV, 10056 conn->dev_class, sizeof(conn->dev_class)); 10057 } 10058 10059 ev->eir_len = cpu_to_le16(eir_len); 10060 10061 mgmt_event_skb(skb, NULL); 10062 } 10063 10064 static void unpair_device_rsp(struct mgmt_pending_cmd *cmd, void *data) 10065 { 10066 struct hci_dev *hdev = data; 10067 struct mgmt_cp_unpair_device *cp = cmd->param; 10068 10069 device_unpaired(hdev, &cp->addr.bdaddr, cp->addr.type, cmd->sk); 10070 10071 cmd->cmd_complete(cmd, 0); 10072 } 10073 10074 bool mgmt_powering_down(struct hci_dev *hdev) 10075 { 10076 struct mgmt_pending_cmd *cmd; 10077 struct mgmt_mode *cp; 10078 10079 if (hci_dev_test_flag(hdev, HCI_POWERING_DOWN)) 10080 return true; 10081 10082 cmd = pending_find(MGMT_OP_SET_POWERED, hdev); 10083 if (!cmd) 10084 return false; 10085 10086 cp = cmd->param; 10087 if (!cp->val) 10088 return true; 10089 10090 return false; 10091 } 10092 10093 u8 hci_to_mgmt_reason(u8 err) 10094 { 10095 switch (err) { 10096 case HCI_ERROR_CONNECTION_TIMEOUT: 10097 return MGMT_DEV_DISCONN_TIMEOUT; 10098 case HCI_ERROR_REMOTE_USER_TERM: 10099 case HCI_ERROR_REMOTE_LOW_RESOURCES: 10100 case HCI_ERROR_REMOTE_POWER_OFF: 10101 return MGMT_DEV_DISCONN_REMOTE; 10102 case HCI_ERROR_LOCAL_HOST_TERM: 10103 return MGMT_DEV_DISCONN_LOCAL_HOST; 10104 default: 10105 return MGMT_DEV_DISCONN_UNKNOWN; 10106 } 10107 } 10108 10109 void mgmt_device_disconnected(struct hci_dev *hdev, bdaddr_t *bdaddr, 10110 u8 link_type, u8 addr_type, u8 reason, 10111 bool mgmt_connected) 10112 { 10113 struct mgmt_ev_device_disconnected ev; 10114 struct sock *sk = NULL; 10115 10116 if (!mgmt_connected) 10117 return; 10118 10119 if (link_type != ACL_LINK && 10120 link_type != LE_LINK && 10121 link_type != BIS_LINK) 10122 return; 10123 10124 bacpy(&ev.addr.bdaddr, bdaddr); 10125 ev.addr.type = link_to_bdaddr(link_type, addr_type); 10126 ev.reason = reason; 10127 10128 /* Report disconnects due to suspend */ 10129 if (hdev->suspended) 10130 ev.reason = MGMT_DEV_DISCONN_LOCAL_HOST_SUSPEND; 10131 10132 mgmt_event(MGMT_EV_DEVICE_DISCONNECTED, hdev, &ev, sizeof(ev), sk); 10133 10134 if (sk) 10135 sock_put(sk); 10136 } 10137 10138 void mgmt_disconnect_failed(struct hci_dev *hdev, bdaddr_t *bdaddr, 10139 u8 link_type, u8 addr_type, u8 status) 10140 { 10141 u8 bdaddr_type = link_to_bdaddr(link_type, addr_type); 10142 struct mgmt_cp_disconnect *cp; 10143 struct mgmt_pending_cmd *cmd; 10144 10145 mgmt_pending_foreach(MGMT_OP_UNPAIR_DEVICE, hdev, true, 10146 unpair_device_rsp, hdev); 10147 10148 cmd = pending_find(MGMT_OP_DISCONNECT, hdev); 10149 if (!cmd) 10150 return; 10151 10152 cp = cmd->param; 10153 10154 if (bacmp(bdaddr, &cp->addr.bdaddr)) 10155 return; 10156 10157 if (cp->addr.type != bdaddr_type) 10158 return; 10159 10160 cmd->cmd_complete(cmd, mgmt_status(status)); 10161 mgmt_pending_remove(cmd); 10162 } 10163 10164 void mgmt_connect_failed(struct hci_dev *hdev, struct hci_conn *conn, u8 status) 10165 { 10166 struct mgmt_ev_connect_failed ev; 10167 10168 if (test_and_clear_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags)) { 10169 mgmt_device_disconnected(hdev, &conn->dst, conn->type, 10170 conn->dst_type, 10171 hci_to_mgmt_reason(status), true); 10172 return; 10173 } 10174 10175 bacpy(&ev.addr.bdaddr, &conn->dst); 10176 ev.addr.type = link_to_bdaddr(conn->type, conn->dst_type); 10177 ev.status = mgmt_status(status); 10178 10179 mgmt_event(MGMT_EV_CONNECT_FAILED, hdev, &ev, sizeof(ev), NULL); 10180 } 10181 10182 void mgmt_pin_code_request(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 secure) 10183 { 10184 struct mgmt_ev_pin_code_request ev; 10185 10186 bacpy(&ev.addr.bdaddr, bdaddr); 10187 ev.addr.type = BDADDR_BREDR; 10188 ev.secure = secure; 10189 10190 mgmt_event(MGMT_EV_PIN_CODE_REQUEST, hdev, &ev, sizeof(ev), NULL); 10191 } 10192 10193 void mgmt_pin_code_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr, 10194 u8 status) 10195 { 10196 struct mgmt_pending_cmd *cmd; 10197 10198 cmd = pending_find(MGMT_OP_PIN_CODE_REPLY, hdev); 10199 if (!cmd) 10200 return; 10201 10202 cmd->cmd_complete(cmd, mgmt_status(status)); 10203 mgmt_pending_remove(cmd); 10204 } 10205 10206 void mgmt_pin_code_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr, 10207 u8 status) 10208 { 10209 struct mgmt_pending_cmd *cmd; 10210 10211 cmd = pending_find(MGMT_OP_PIN_CODE_NEG_REPLY, hdev); 10212 if (!cmd) 10213 return; 10214 10215 cmd->cmd_complete(cmd, mgmt_status(status)); 10216 mgmt_pending_remove(cmd); 10217 } 10218 10219 int mgmt_user_confirm_request(struct hci_dev *hdev, bdaddr_t *bdaddr, 10220 u8 link_type, u8 addr_type, u32 value, 10221 u8 confirm_hint) 10222 { 10223 struct mgmt_ev_user_confirm_request ev; 10224 10225 bt_dev_dbg(hdev, "bdaddr %pMR", bdaddr); 10226 10227 bacpy(&ev.addr.bdaddr, bdaddr); 10228 ev.addr.type = link_to_bdaddr(link_type, addr_type); 10229 ev.confirm_hint = confirm_hint; 10230 ev.value = cpu_to_le32(value); 10231 10232 return mgmt_event(MGMT_EV_USER_CONFIRM_REQUEST, hdev, &ev, sizeof(ev), 10233 NULL); 10234 } 10235 10236 int mgmt_user_passkey_request(struct hci_dev *hdev, bdaddr_t *bdaddr, 10237 u8 link_type, u8 addr_type) 10238 { 10239 struct mgmt_ev_user_passkey_request ev; 10240 10241 bt_dev_dbg(hdev, "bdaddr %pMR", bdaddr); 10242 10243 bacpy(&ev.addr.bdaddr, bdaddr); 10244 ev.addr.type = link_to_bdaddr(link_type, addr_type); 10245 10246 return mgmt_event(MGMT_EV_USER_PASSKEY_REQUEST, hdev, &ev, sizeof(ev), 10247 NULL); 10248 } 10249 10250 static int user_pairing_resp_complete(struct hci_dev *hdev, bdaddr_t *bdaddr, 10251 u8 link_type, u8 addr_type, u8 status, 10252 u8 opcode) 10253 { 10254 struct mgmt_pending_cmd *cmd; 10255 10256 cmd = pending_find(opcode, hdev); 10257 if (!cmd) 10258 return -ENOENT; 10259 10260 cmd->cmd_complete(cmd, mgmt_status(status)); 10261 mgmt_pending_remove(cmd); 10262 10263 return 0; 10264 } 10265 10266 int mgmt_user_confirm_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr, 10267 u8 link_type, u8 addr_type, u8 status) 10268 { 10269 return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type, 10270 status, MGMT_OP_USER_CONFIRM_REPLY); 10271 } 10272 10273 int mgmt_user_confirm_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr, 10274 u8 link_type, u8 addr_type, u8 status) 10275 { 10276 return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type, 10277 status, 10278 MGMT_OP_USER_CONFIRM_NEG_REPLY); 10279 } 10280 10281 int mgmt_user_passkey_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr, 10282 u8 link_type, u8 addr_type, u8 status) 10283 { 10284 return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type, 10285 status, MGMT_OP_USER_PASSKEY_REPLY); 10286 } 10287 10288 int mgmt_user_passkey_neg_reply_complete(struct hci_dev *hdev, bdaddr_t *bdaddr, 10289 u8 link_type, u8 addr_type, u8 status) 10290 { 10291 return user_pairing_resp_complete(hdev, bdaddr, link_type, addr_type, 10292 status, 10293 MGMT_OP_USER_PASSKEY_NEG_REPLY); 10294 } 10295 10296 int mgmt_user_passkey_notify(struct hci_dev *hdev, bdaddr_t *bdaddr, 10297 u8 link_type, u8 addr_type, u32 passkey, 10298 u8 entered) 10299 { 10300 struct mgmt_ev_passkey_notify ev; 10301 10302 bt_dev_dbg(hdev, "bdaddr %pMR", bdaddr); 10303 10304 bacpy(&ev.addr.bdaddr, bdaddr); 10305 ev.addr.type = link_to_bdaddr(link_type, addr_type); 10306 ev.passkey = __cpu_to_le32(passkey); 10307 ev.entered = entered; 10308 10309 return mgmt_event(MGMT_EV_PASSKEY_NOTIFY, hdev, &ev, sizeof(ev), NULL); 10310 } 10311 10312 void mgmt_auth_failed(struct hci_conn *conn, u8 hci_status) 10313 { 10314 struct mgmt_ev_auth_failed ev; 10315 struct mgmt_pending_cmd *cmd; 10316 u8 status = mgmt_status(hci_status); 10317 10318 bacpy(&ev.addr.bdaddr, &conn->dst); 10319 ev.addr.type = link_to_bdaddr(conn->type, conn->dst_type); 10320 ev.status = status; 10321 10322 cmd = remove_pairing(conn); 10323 10324 mgmt_event(MGMT_EV_AUTH_FAILED, conn->hdev, &ev, sizeof(ev), 10325 cmd ? cmd->sk : NULL); 10326 10327 if (cmd) { 10328 cmd->cmd_complete(cmd, status); 10329 mgmt_pending_free(cmd); 10330 } 10331 } 10332 10333 void mgmt_auth_enable_complete(struct hci_dev *hdev, u8 status) 10334 { 10335 struct cmd_lookup match = { NULL, hdev }; 10336 bool changed; 10337 10338 if (status) { 10339 u8 mgmt_err = mgmt_status(status); 10340 mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev, true, 10341 cmd_status_rsp, &mgmt_err); 10342 return; 10343 } 10344 10345 if (test_bit(HCI_AUTH, &hdev->flags)) 10346 changed = !hci_dev_test_and_set_flag(hdev, HCI_LINK_SECURITY); 10347 else 10348 changed = hci_dev_test_and_clear_flag(hdev, HCI_LINK_SECURITY); 10349 10350 mgmt_pending_foreach(MGMT_OP_SET_LINK_SECURITY, hdev, true, 10351 settings_rsp, &match); 10352 10353 if (changed) 10354 new_settings(hdev, match.sk); 10355 10356 if (match.sk) 10357 sock_put(match.sk); 10358 } 10359 10360 static void sk_lookup(struct mgmt_pending_cmd *cmd, void *data) 10361 { 10362 struct cmd_lookup *match = data; 10363 10364 if (match->sk == NULL) { 10365 match->sk = cmd->sk; 10366 sock_hold(match->sk); 10367 } 10368 } 10369 10370 void mgmt_set_class_of_dev_complete(struct hci_dev *hdev, u8 *dev_class, 10371 u8 status) 10372 { 10373 struct cmd_lookup match = { NULL, hdev, mgmt_status(status) }; 10374 10375 mgmt_pending_foreach(MGMT_OP_SET_DEV_CLASS, hdev, false, sk_lookup, 10376 &match); 10377 mgmt_pending_foreach(MGMT_OP_ADD_UUID, hdev, false, sk_lookup, 10378 &match); 10379 mgmt_pending_foreach(MGMT_OP_REMOVE_UUID, hdev, false, sk_lookup, 10380 &match); 10381 10382 if (!status) { 10383 mgmt_limited_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev, dev_class, 10384 3, HCI_MGMT_DEV_CLASS_EVENTS, NULL); 10385 ext_info_changed(hdev, NULL); 10386 } 10387 10388 if (match.sk) 10389 sock_put(match.sk); 10390 } 10391 10392 void mgmt_set_local_name_complete(struct hci_dev *hdev, u8 *name, u8 status) 10393 { 10394 struct mgmt_cp_set_local_name ev; 10395 struct mgmt_pending_cmd *cmd; 10396 10397 if (status) 10398 return; 10399 10400 memset(&ev, 0, sizeof(ev)); 10401 memcpy(ev.name, name, HCI_MAX_NAME_LENGTH); 10402 memcpy(ev.short_name, hdev->short_name, HCI_MAX_SHORT_NAME_LENGTH); 10403 10404 cmd = pending_find(MGMT_OP_SET_LOCAL_NAME, hdev); 10405 if (!cmd) { 10406 memcpy(hdev->dev_name, name, sizeof(hdev->dev_name)); 10407 10408 /* If this is a HCI command related to powering on the 10409 * HCI dev don't send any mgmt signals. 10410 */ 10411 if (hci_dev_test_flag(hdev, HCI_POWERING_DOWN)) 10412 return; 10413 10414 if (pending_find(MGMT_OP_SET_POWERED, hdev)) 10415 return; 10416 } 10417 10418 mgmt_limited_event(MGMT_EV_LOCAL_NAME_CHANGED, hdev, &ev, sizeof(ev), 10419 HCI_MGMT_LOCAL_NAME_EVENTS, cmd ? cmd->sk : NULL); 10420 ext_info_changed(hdev, cmd ? cmd->sk : NULL); 10421 } 10422 10423 static inline bool has_uuid(u8 *uuid, u16 uuid_count, u8 (*uuids)[16]) 10424 { 10425 int i; 10426 10427 for (i = 0; i < uuid_count; i++) { 10428 if (!memcmp(uuid, uuids[i], 16)) 10429 return true; 10430 } 10431 10432 return false; 10433 } 10434 10435 static bool eir_has_uuids(u8 *eir, u16 eir_len, u16 uuid_count, u8 (*uuids)[16]) 10436 { 10437 u16 parsed = 0; 10438 10439 while (parsed < eir_len) { 10440 u8 field_len = eir[0]; 10441 u8 uuid[16]; 10442 int i; 10443 10444 if (field_len == 0) 10445 break; 10446 10447 if (eir_len - parsed < field_len + 1) 10448 break; 10449 10450 switch (eir[1]) { 10451 case EIR_UUID16_ALL: 10452 case EIR_UUID16_SOME: 10453 for (i = 0; i + 3 <= field_len; i += 2) { 10454 memcpy(uuid, bluetooth_base_uuid, 16); 10455 uuid[13] = eir[i + 3]; 10456 uuid[12] = eir[i + 2]; 10457 if (has_uuid(uuid, uuid_count, uuids)) 10458 return true; 10459 } 10460 break; 10461 case EIR_UUID32_ALL: 10462 case EIR_UUID32_SOME: 10463 for (i = 0; i + 5 <= field_len; i += 4) { 10464 memcpy(uuid, bluetooth_base_uuid, 16); 10465 uuid[15] = eir[i + 5]; 10466 uuid[14] = eir[i + 4]; 10467 uuid[13] = eir[i + 3]; 10468 uuid[12] = eir[i + 2]; 10469 if (has_uuid(uuid, uuid_count, uuids)) 10470 return true; 10471 } 10472 break; 10473 case EIR_UUID128_ALL: 10474 case EIR_UUID128_SOME: 10475 for (i = 0; i + 17 <= field_len; i += 16) { 10476 memcpy(uuid, eir + i + 2, 16); 10477 if (has_uuid(uuid, uuid_count, uuids)) 10478 return true; 10479 } 10480 break; 10481 } 10482 10483 parsed += field_len + 1; 10484 eir += field_len + 1; 10485 } 10486 10487 return false; 10488 } 10489 10490 static bool is_filter_match(struct hci_dev *hdev, s8 rssi, u8 *eir, 10491 u16 eir_len, u8 *scan_rsp, u8 scan_rsp_len) 10492 { 10493 /* If a RSSI threshold has been specified, and 10494 * HCI_QUIRK_STRICT_DUPLICATE_FILTER is not set, then all results with 10495 * a RSSI smaller than the RSSI threshold will be dropped. If the quirk 10496 * is set, let it through for further processing, as we might need to 10497 * restart the scan. 10498 * 10499 * For BR/EDR devices (pre 1.2) providing no RSSI during inquiry, 10500 * the results are also dropped. 10501 */ 10502 if (hdev->discovery.rssi != HCI_RSSI_INVALID && 10503 (rssi == HCI_RSSI_INVALID || 10504 (rssi < hdev->discovery.rssi && 10505 !hci_test_quirk(hdev, HCI_QUIRK_STRICT_DUPLICATE_FILTER)))) 10506 return false; 10507 10508 if (hdev->discovery.uuid_count != 0) { 10509 /* If a list of UUIDs is provided in filter, results with no 10510 * matching UUID should be dropped. 10511 */ 10512 if (!eir_has_uuids(eir, eir_len, hdev->discovery.uuid_count, 10513 hdev->discovery.uuids) && 10514 !eir_has_uuids(scan_rsp, scan_rsp_len, 10515 hdev->discovery.uuid_count, 10516 hdev->discovery.uuids)) 10517 return false; 10518 } 10519 10520 /* If duplicate filtering does not report RSSI changes, then restart 10521 * scanning to ensure updated result with updated RSSI values. 10522 */ 10523 if (hci_test_quirk(hdev, HCI_QUIRK_STRICT_DUPLICATE_FILTER)) { 10524 /* Validate RSSI value against the RSSI threshold once more. */ 10525 if (hdev->discovery.rssi != HCI_RSSI_INVALID && 10526 rssi < hdev->discovery.rssi) 10527 return false; 10528 } 10529 10530 return true; 10531 } 10532 10533 void mgmt_adv_monitor_device_lost(struct hci_dev *hdev, u16 handle, 10534 bdaddr_t *bdaddr, u8 addr_type) 10535 { 10536 struct mgmt_ev_adv_monitor_device_lost ev; 10537 10538 ev.monitor_handle = cpu_to_le16(handle); 10539 bacpy(&ev.addr.bdaddr, bdaddr); 10540 ev.addr.type = addr_type; 10541 10542 mgmt_event(MGMT_EV_ADV_MONITOR_DEVICE_LOST, hdev, &ev, sizeof(ev), 10543 NULL); 10544 } 10545 10546 static void mgmt_send_adv_monitor_device_found(struct hci_dev *hdev, 10547 struct sk_buff *skb, 10548 struct sock *skip_sk, 10549 u16 handle) 10550 { 10551 struct sk_buff *advmon_skb; 10552 size_t advmon_skb_len; 10553 __le16 *monitor_handle; 10554 10555 if (!skb) 10556 return; 10557 10558 advmon_skb_len = (sizeof(struct mgmt_ev_adv_monitor_device_found) - 10559 sizeof(struct mgmt_ev_device_found)) + skb->len; 10560 advmon_skb = mgmt_alloc_skb(hdev, MGMT_EV_ADV_MONITOR_DEVICE_FOUND, 10561 advmon_skb_len); 10562 if (!advmon_skb) 10563 return; 10564 10565 /* ADV_MONITOR_DEVICE_FOUND is similar to DEVICE_FOUND event except 10566 * that it also has 'monitor_handle'. Make a copy of DEVICE_FOUND and 10567 * store monitor_handle of the matched monitor. 10568 */ 10569 monitor_handle = skb_put(advmon_skb, sizeof(*monitor_handle)); 10570 *monitor_handle = cpu_to_le16(handle); 10571 skb_put_data(advmon_skb, skb->data, skb->len); 10572 10573 mgmt_event_skb(advmon_skb, skip_sk); 10574 } 10575 10576 static void mgmt_adv_monitor_device_found(struct hci_dev *hdev, 10577 bdaddr_t *bdaddr, bool report_device, 10578 struct sk_buff *skb, 10579 struct sock *skip_sk) 10580 { 10581 struct monitored_device *dev, *tmp; 10582 bool matched = false; 10583 bool notified = false; 10584 10585 /* We have received the Advertisement Report because: 10586 * 1. the kernel has initiated active discovery 10587 * 2. if not, we have pend_le_reports > 0 in which case we are doing 10588 * passive scanning 10589 * 3. if none of the above is true, we have one or more active 10590 * Advertisement Monitor 10591 * 10592 * For case 1 and 2, report all advertisements via MGMT_EV_DEVICE_FOUND 10593 * and report ONLY one advertisement per device for the matched Monitor 10594 * via MGMT_EV_ADV_MONITOR_DEVICE_FOUND event. 10595 * 10596 * For case 3, since we are not active scanning and all advertisements 10597 * received are due to a matched Advertisement Monitor, report all 10598 * advertisements ONLY via MGMT_EV_ADV_MONITOR_DEVICE_FOUND event. 10599 */ 10600 if (report_device && !hdev->advmon_pend_notify) { 10601 mgmt_event_skb(skb, skip_sk); 10602 return; 10603 } 10604 10605 hdev->advmon_pend_notify = false; 10606 10607 list_for_each_entry_safe(dev, tmp, &hdev->monitored_devices, list) { 10608 if (!bacmp(&dev->bdaddr, bdaddr)) { 10609 matched = true; 10610 10611 if (!dev->notified) { 10612 mgmt_send_adv_monitor_device_found(hdev, skb, 10613 skip_sk, 10614 dev->handle); 10615 notified = true; 10616 dev->notified = true; 10617 } 10618 } 10619 10620 if (!dev->notified) 10621 hdev->advmon_pend_notify = true; 10622 } 10623 10624 if (!report_device && 10625 ((matched && !notified) || !msft_monitor_supported(hdev))) { 10626 /* Handle 0 indicates that we are not active scanning and this 10627 * is a subsequent advertisement report for an already matched 10628 * Advertisement Monitor or the controller offloading support 10629 * is not available. 10630 */ 10631 mgmt_send_adv_monitor_device_found(hdev, skb, skip_sk, 0); 10632 } 10633 10634 if (report_device) 10635 mgmt_event_skb(skb, skip_sk); 10636 else 10637 kfree_skb(skb); 10638 } 10639 10640 static void mesh_device_found(struct hci_dev *hdev, bdaddr_t *bdaddr, 10641 u8 addr_type, s8 rssi, u32 flags, u8 *eir, 10642 u16 eir_len, u8 *scan_rsp, u8 scan_rsp_len, 10643 u64 instant) 10644 { 10645 struct sk_buff *skb; 10646 struct mgmt_ev_mesh_device_found *ev; 10647 int i, j; 10648 10649 if (!hdev->mesh_ad_types[0]) 10650 goto accepted; 10651 10652 /* Scan for requested AD types */ 10653 if (eir_len > 0) { 10654 for (i = 0; i + 1 < eir_len; i += eir[i] + 1) { 10655 for (j = 0; j < sizeof(hdev->mesh_ad_types); j++) { 10656 if (!hdev->mesh_ad_types[j]) 10657 break; 10658 10659 if (hdev->mesh_ad_types[j] == eir[i + 1]) 10660 goto accepted; 10661 } 10662 } 10663 } 10664 10665 if (scan_rsp_len > 0) { 10666 for (i = 0; i + 1 < scan_rsp_len; i += scan_rsp[i] + 1) { 10667 for (j = 0; j < sizeof(hdev->mesh_ad_types); j++) { 10668 if (!hdev->mesh_ad_types[j]) 10669 break; 10670 10671 if (hdev->mesh_ad_types[j] == scan_rsp[i + 1]) 10672 goto accepted; 10673 } 10674 } 10675 } 10676 10677 return; 10678 10679 accepted: 10680 skb = mgmt_alloc_skb(hdev, MGMT_EV_MESH_DEVICE_FOUND, 10681 sizeof(*ev) + eir_len + scan_rsp_len); 10682 if (!skb) 10683 return; 10684 10685 ev = skb_put(skb, sizeof(*ev)); 10686 10687 bacpy(&ev->addr.bdaddr, bdaddr); 10688 ev->addr.type = link_to_bdaddr(LE_LINK, addr_type); 10689 ev->rssi = rssi; 10690 ev->flags = cpu_to_le32(flags); 10691 ev->instant = cpu_to_le64(instant); 10692 10693 if (eir_len > 0) 10694 /* Copy EIR or advertising data into event */ 10695 skb_put_data(skb, eir, eir_len); 10696 10697 if (scan_rsp_len > 0) 10698 /* Append scan response data to event */ 10699 skb_put_data(skb, scan_rsp, scan_rsp_len); 10700 10701 ev->eir_len = cpu_to_le16(eir_len + scan_rsp_len); 10702 10703 mgmt_event_skb(skb, NULL); 10704 } 10705 10706 void mgmt_device_found(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type, 10707 u8 addr_type, u8 *dev_class, s8 rssi, u32 flags, 10708 u8 *eir, u16 eir_len, u8 *scan_rsp, u8 scan_rsp_len, 10709 u64 instant) 10710 { 10711 struct sk_buff *skb; 10712 struct mgmt_ev_device_found *ev; 10713 bool report_device = hci_discovery_active(hdev); 10714 10715 if (hci_dev_test_flag(hdev, HCI_MESH) && link_type == LE_LINK) 10716 mesh_device_found(hdev, bdaddr, addr_type, rssi, flags, 10717 eir, eir_len, scan_rsp, scan_rsp_len, 10718 instant); 10719 10720 /* Don't send events for a non-kernel initiated discovery. With 10721 * LE one exception is if we have pend_le_reports > 0 in which 10722 * case we're doing passive scanning and want these events. 10723 */ 10724 if (!hci_discovery_active(hdev)) { 10725 if (link_type == ACL_LINK) 10726 return; 10727 if (link_type == LE_LINK && !list_empty(&hdev->pend_le_reports)) 10728 report_device = true; 10729 else if (!hci_is_adv_monitoring(hdev)) 10730 return; 10731 } 10732 10733 if (hdev->discovery.result_filtering) { 10734 /* We are using service discovery */ 10735 if (!is_filter_match(hdev, rssi, eir, eir_len, scan_rsp, 10736 scan_rsp_len)) 10737 return; 10738 } 10739 10740 if (hdev->discovery.limited) { 10741 /* Check for limited discoverable bit */ 10742 if (dev_class) { 10743 if (!(dev_class[1] & 0x20)) 10744 return; 10745 } else { 10746 u8 *flags = eir_get_data(eir, eir_len, EIR_FLAGS, NULL); 10747 if (!flags || !(flags[0] & LE_AD_LIMITED)) 10748 return; 10749 } 10750 } 10751 10752 /* Allocate skb. The 5 extra bytes are for the potential CoD field */ 10753 skb = mgmt_alloc_skb(hdev, MGMT_EV_DEVICE_FOUND, 10754 sizeof(*ev) + eir_len + scan_rsp_len + 5); 10755 if (!skb) 10756 return; 10757 10758 ev = skb_put(skb, sizeof(*ev)); 10759 10760 /* In case of device discovery with BR/EDR devices (pre 1.2), the 10761 * RSSI value was reported as 0 when not available. This behavior 10762 * is kept when using device discovery. This is required for full 10763 * backwards compatibility with the API. 10764 * 10765 * However when using service discovery, the value 127 will be 10766 * returned when the RSSI is not available. 10767 */ 10768 if (rssi == HCI_RSSI_INVALID && !hdev->discovery.report_invalid_rssi && 10769 link_type == ACL_LINK) 10770 rssi = 0; 10771 10772 bacpy(&ev->addr.bdaddr, bdaddr); 10773 ev->addr.type = link_to_bdaddr(link_type, addr_type); 10774 ev->rssi = rssi; 10775 ev->flags = cpu_to_le32(flags); 10776 10777 if (eir_len > 0) 10778 /* Copy EIR or advertising data into event */ 10779 skb_put_data(skb, eir, eir_len); 10780 10781 if (dev_class && !eir_get_data(eir, eir_len, EIR_CLASS_OF_DEV, NULL)) { 10782 u8 eir_cod[5]; 10783 10784 eir_len += eir_append_data(eir_cod, 0, EIR_CLASS_OF_DEV, 10785 dev_class, 3); 10786 skb_put_data(skb, eir_cod, sizeof(eir_cod)); 10787 } 10788 10789 if (scan_rsp_len > 0) 10790 /* Append scan response data to event */ 10791 skb_put_data(skb, scan_rsp, scan_rsp_len); 10792 10793 ev->eir_len = cpu_to_le16(eir_len + scan_rsp_len); 10794 10795 mgmt_adv_monitor_device_found(hdev, bdaddr, report_device, skb, NULL); 10796 } 10797 10798 void mgmt_remote_name(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type, 10799 u8 addr_type, s8 rssi, u8 *name, u8 name_len) 10800 { 10801 struct sk_buff *skb; 10802 struct mgmt_ev_device_found *ev; 10803 u16 eir_len = 0; 10804 u32 flags = 0; 10805 10806 skb = mgmt_alloc_skb(hdev, MGMT_EV_DEVICE_FOUND, 10807 sizeof(*ev) + (name ? eir_precalc_len(name_len) : 0)); 10808 if (!skb) 10809 return; 10810 10811 ev = skb_put(skb, sizeof(*ev)); 10812 bacpy(&ev->addr.bdaddr, bdaddr); 10813 ev->addr.type = link_to_bdaddr(link_type, addr_type); 10814 ev->rssi = rssi; 10815 10816 if (name) 10817 eir_len += eir_skb_put_data(skb, EIR_NAME_COMPLETE, name, name_len); 10818 else 10819 flags = MGMT_DEV_FOUND_NAME_REQUEST_FAILED; 10820 10821 ev->eir_len = cpu_to_le16(eir_len); 10822 ev->flags = cpu_to_le32(flags); 10823 10824 mgmt_event_skb(skb, NULL); 10825 } 10826 10827 void mgmt_discovering(struct hci_dev *hdev, u8 discovering) 10828 { 10829 struct mgmt_ev_discovering ev; 10830 10831 bt_dev_dbg(hdev, "discovering %u", discovering); 10832 10833 memset(&ev, 0, sizeof(ev)); 10834 ev.type = hdev->discovery.type; 10835 ev.discovering = discovering; 10836 10837 mgmt_event(MGMT_EV_DISCOVERING, hdev, &ev, sizeof(ev), NULL); 10838 } 10839 10840 void mgmt_suspending(struct hci_dev *hdev, u8 state) 10841 { 10842 struct mgmt_ev_controller_suspend ev; 10843 10844 ev.suspend_state = state; 10845 mgmt_event(MGMT_EV_CONTROLLER_SUSPEND, hdev, &ev, sizeof(ev), NULL); 10846 } 10847 10848 void mgmt_resuming(struct hci_dev *hdev, u8 reason, bdaddr_t *bdaddr, 10849 u8 addr_type) 10850 { 10851 struct mgmt_ev_controller_resume ev; 10852 10853 ev.wake_reason = reason; 10854 if (bdaddr) { 10855 bacpy(&ev.addr.bdaddr, bdaddr); 10856 ev.addr.type = addr_type; 10857 } else { 10858 memset(&ev.addr, 0, sizeof(ev.addr)); 10859 } 10860 10861 mgmt_event(MGMT_EV_CONTROLLER_RESUME, hdev, &ev, sizeof(ev), NULL); 10862 } 10863 10864 static struct hci_mgmt_chan chan = { 10865 .channel = HCI_CHANNEL_CONTROL, 10866 .handler_count = ARRAY_SIZE(mgmt_handlers), 10867 .handlers = mgmt_handlers, 10868 .hdev_init = mgmt_init_hdev, 10869 }; 10870 10871 int mgmt_init(void) 10872 { 10873 return hci_mgmt_chan_register(&chan); 10874 } 10875 10876 void mgmt_conn_subrate_notify(struct hci_dev *hdev, struct hci_conn *conn, 10877 u8 status) 10878 { 10879 struct mgmt_ev_conn_subrate ev; 10880 10881 bacpy(&ev.addr.bdaddr, &conn->dst); 10882 ev.addr.type = link_to_bdaddr(conn->type, conn->dst_type); 10883 ev.status = mgmt_status(status); 10884 ev.interval = cpu_to_le16(conn->le_rate_interval); 10885 ev.subrate = cpu_to_le16(conn->le_subrate); 10886 ev.latency = cpu_to_le16(conn->le_rate_latency); 10887 ev.cont_num = cpu_to_le16(conn->le_cont_num); 10888 ev.supv_timeout = cpu_to_le16(conn->le_rate_supv_timeout); 10889 10890 mgmt_event(MGMT_EV_CONN_SUBRATE, hdev, &ev, sizeof(ev), NULL); 10891 } 10892 10893 void mgmt_exit(void) 10894 { 10895 hci_mgmt_chan_unregister(&chan); 10896 } 10897 10898 void mgmt_cleanup(struct sock *sk) 10899 { 10900 struct mgmt_mesh_tx *mesh_tx; 10901 struct hci_dev *hdev; 10902 10903 read_lock(&hci_dev_list_lock); 10904 10905 list_for_each_entry(hdev, &hci_dev_list, list) { 10906 do { 10907 mesh_tx = mgmt_mesh_next(hdev, sk); 10908 10909 if (mesh_tx) 10910 mesh_send_complete(hdev, mesh_tx, true); 10911 } while (mesh_tx); 10912 } 10913 10914 read_unlock(&hci_dev_list_lock); 10915 } 10916